Function at 0x1003d090
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x1004d040]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [0x1005b8ff]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
cmp al, byte [0x1005b8f5]
je 0x1003d143
push str.xxxxxxx
cmp al, 1
jne 0x1003d0fb
mov edx, 0x10048d40
call fcn.1003cfb0
mov edi, eax
add esp, 4
test edi, edi
je 0x1003d5d9
lea eax, [ebp - 0x44]
push eax
push 0x40
push 7
push edi
call esi
mov dword [edi], 0x4c8b23eb
jmp 0x1003d123
mov edx, 0x10048d50
call fcn.1003cfb0
mov edi, eax
add esp, 4
test edi, edi
je 0x1003d5d9
lea eax, [ebp - 0x44]
push eax
push 0x40
push 7
push edi
call esi
mov dword [edi], 0x4c8b2374
lea eax, [ebp - 0x44]
mov word [edi + 4], 0x3424
push eax
push dword [ebp - 0x44]
mov byte [edi + 6], 0x51
push 7
push edi
call esi
mov al, byte [0x1005b8ff]
mov byte [0x1005b8f5], al
mov al, byte [0x1005b8f7]
cmp al, byte [0x1005b8fc]
je 0x1003d206
cmp al, 1
jne 0x1003d1b8
push str.xxxxxxxxxxxxx
mov edx, 0x10048d58
call fcn.1003cfb0
mov edi, eax
add esp, 4
test edi, edi
je 0x1003d5d9
lea eax, [ebp - 0x44]
mov dword [ebp - 0x40], 0
push eax
push 0x40
push 0xd
push edi
mov dword [ebp - 0x3c], 0x40000000
mov dword [ebp - 0x38], 7
mov byte [ebp - 0x45], 0x43
call esi
movq xmm0, qword [ebp - 0x40]
mov eax, dword [ebp - 0x38]
movq qword [edi], xmm0
mov dword [edi + 8], eax
mov al, byte [ebp - 0x45]
mov byte [edi + 0xc], al
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x44]
push 0xd
jmp 0x1003d1f9
push str.xxxxxxxxx
mov edx, 0x10048d78
call fcn.1003cfb0
mov edi, eax
add esp, 4
test edi, edi
je 0x1003d5d9
lea eax, [ebp - 0x44]
push eax
push 0x40
push 9
push edi
call esi
lea eax, [ebp - 0x44]
mov dword [edi], 0x3de40d8b
push eax
push dword [ebp - 0x44]
mov dword [edi + 4], 0x8e890097
mov byte [edi + 8], 0x78
push 9
push edi
call esi
mov al, byte [0x1005b8f7]
mov byte [0x1005b8fc], al
mov al, byte [0x1005b8d6]
cmp al, byte [0x1005b8f6]
je 0x1003d284
push str.xxxx
cmp al, 1
jne 0x1003d246
mov edx, 0x10048d94
call fcn.1003cfb0
mov edi, eax
add esp, 4
test edi, edi
je 0x1003d5d9
lea eax, [ebp - 0x44]
push eax
push 0x40
push 4
push edi
call esi
mov dword [edi], 0xce835201
jmp 0x1003d26e
mov edx, 0x10048da4
call fcn.1003cfb0
mov edi, eax
add esp, 4
test edi, edi
je 0x1003d5d9
lea eax, [ebp - 0x44]
push eax
push 0x40
push 4
push edi
call esi
mov dword [edi], 0xce835202
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x44]
push 4
push edi
call esi
mov al, byte [0x1005b8d6]
mov byte [0x1005b8f6], al
mov al, byte [0x1005b902]
cmp al, byte [0x1005b8d5]
je 0x1003d308
push str.xxxxxx
cmp al, 1
jne 0x1003d2c4
mov edx, 0x10048dac
call fcn.1003cfb0
mov edi, eax
add esp, 4
test edi, edi
je 0x1003d5d9
lea eax, [ebp - 0x44]
push eax
push 0x40
push 6
push edi
call esi
mov dword [edi], 0x4e8b09eb
jmp 0x1003d2ec
mov edx, 0x10048dbc
call fcn.1003cfb0
mov edi, eax
add esp, 4
test edi, edi
je 0x1003d5d9
lea eax, [ebp - 0x44]
push eax
push 0x40
push 6
push edi
call esi
mov dword [edi], 0x4e8b0975
lea eax, [ebp - 0x44]
mov word [edi + 4], 0x8920
push eax
push dword [ebp - 0x44]
push 6
push edi
call esi
mov al, byte [0x1005b902]
mov byte [0x1005b8d5], al
mov al, byte [0x1005b8fe]
cmp al, byte [0x1005b905]
je 0x1003d3db
push str.xxxxxxxxxxxxxxxx
cmp al, 1
jne 0x1003d373
mov edx, 0x10048dc4
call fcn.1003cfb0
mov edi, eax
add esp, 4
test edi, edi
je 0x1003d5d9
lea eax, [ebp - 0x44]
mov dword [ebp - 0x20], 0x40810000
push eax
push 0x40
push 0x10
push edi
mov dword [ebp - 0x1c], 0x19886c7
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0x86c64120
call esi
lea ecx, [ebp - 0x11]
lea eax, [edi + 0xf]
cmp edi, ecx
ja 0x1003d36d
lea ecx, [ebp - 0x20]
movups xmm0, xmmword [ebp - 0x20]
jmp 0x1003d3c2
mov edx, 0x10048dec
call fcn.1003cfb0
mov edi, eax
add esp, 4
test edi, edi
je 0x1003d5d9
lea eax, [ebp - 0x44]
mov dword [ebp - 0x30], 0x40a00000
push eax
push 0x40
push 0x10
push edi
mov dword [ebp - 0x2c], 0x19886c7
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0x86c64120
call esi
lea ecx, [ebp - 0x21]
lea eax, [edi + 0xf]
cmp edi, ecx
ja 0x1003d3be
lea ecx, [ebp - 0x30]
movups xmm0, xmmword [ebp - 0x30]
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x44]
movups xmmword [edi], xmm0
push 0x10
push edi
call esi
mov al, byte [0x1005b8fe]
mov byte [0x1005b905], al
mov al, byte [0x1005b8f4]
cmp al, byte [0x1005b904]
je 0x1003d460
push str.xxxxxxxx
cmp al, 1
jne 0x1003d41b
mov edx, 0x10048e00
call fcn.1003cfb0
mov edi, eax
add esp, 4
test edi, edi
je 0x1003d5d9
lea eax, [ebp - 0x44]
push eax
push 0x40
push 8
push edi
call esi
mov dword [edi], 0x492f0000
jmp 0x1003d443
mov edx, 0x10048e18
call fcn.1003cfb0
mov edi, eax
add esp, 4
test edi, edi
je 0x1003d5d9
lea eax, [ebp - 0x44]
push eax
push 0x40
push 8
push edi
call esi
mov dword [edi], 0x442f0000
lea eax, [ebp - 0x44]
mov dword [edi + 4], 0x441b0000
push eax
push dword [ebp - 0x44]
push 8
push edi
call esi
mov al, byte [0x1005b8f4]
mov byte [0x1005b904], al
mov al, byte [0x1005b8d7]
cmp al, byte [0x1005b903]
je 0x1003d4ea
push str.xxxxxxxxx
cmp al, 1
jne 0x1003d4a1
mov edx, 0x10048e24
call fcn.1003cfb0
mov edi, eax
add esp, 4
test edi, edi
je 0x1003d5d9
lea eax, [ebp - 0x44]
push eax
push 0x40
push 9
push edi
call esi
mov dword [edi + 4], 0xefa3543
jmp 0x1003d4ca
mov edx, 0x10048e30
call fcn.1003cfb0
mov edi, eax
add esp, 4
test edi, edi
je 0x1003d5d9
lea eax, [ebp - 0x44]
push eax
push 0x40
push 9
push edi
call esi
mov dword [edi + 4], 0xefa3542
lea eax, [ebp - 0x44]
mov dword [edi], 0xa00000be
push eax
push dword [ebp - 0x44]
mov byte [edi + 8], 0x3c
push 9
push edi
call esi
mov al, byte [0x1005b8d7]
mov byte [0x1005b903], al
mov al, byte [0x1005b901]
cmp al, byte [0x1005b8fd]
je 0x1003d5c4
push str.xxxxxxx
cmp al, 1
jne 0x1003d541
mov edx, 0x10048e3c
call fcn.1003cfb0
mov edi, eax
add esp, 4
test edi, edi
je 0x1003d5d9
lea eax, [ebp - 0x44]
push eax
push 0x40
push 7
push edi
call esi
lea eax, [ebp - 0x44]
mov dword [edi], 0x7cc09dd8
push eax
push dword [ebp - 0x44]
mov word [edi + 4], 0
mov byte [edi + 6], 0x8d
push 7
jmp 0x1003d5b7
mov edx, 0x10048e44
call fcn.1003cfb0
mov edi, eax
add esp, 4
test edi, edi
je 0x1003d5d9
lea eax, [ebp - 0x44]
mov byte [ebp - 0x45], 0xd9
push eax
push 0x40
push 9
push edi
mov byte [ebp - 0x46], 0x9d
mov byte [ebp - 0x47], 0xc0
mov byte [ebp - 0x48], 0x7c
mov byte [ebp - 0x49], 0
mov byte [ebp - 0x4a], 0
mov byte [ebp - 0x4b], 0x8d
call esi
mov al, byte [ebp - 0x45]
mov byte [edi], al
mov al, byte [ebp - 0x46]
mov byte [edi + 1], al
mov al, byte [ebp - 0x47]
mov byte [edi + 2], al
mov al, byte [ebp - 0x48]
mov byte [edi + 3], al
mov al, byte [ebp - 0x49]
mov byte [edi + 4], al
mov al, byte [ebp - 0x4a]
mov byte [edi + 5], al
mov al, byte [ebp - 0x4b]
mov byte [edi + 6], al
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x44]
mov word [edi + 7], 0
push 9
push edi
call esi
mov al, byte [0x1005b901]
mov byte [0x1005b8fd], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004085b
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
xor ecx, ebp
pop esi
call fcn.1004085b
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret