Function at 0x1005aaec
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x1018b06c]
xor eax, esp
mov dword [esp + 0x20], eax
cmp dword [0x101ee950], 1
push ebx
push esi
push edi
jne 0x1005a5c7
push 0x1005a440
push 0x66271f
push 0xe9
call fcn.100b1680
add esp, 0xc
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 0x28]
push eax
push 0x40
push 1
push 0x8553d0
call edi
lea eax, [esp + 0x28]
mov byte [0x8553d0], 0xc3
push eax
push dword [esp + 0x2c]
push 1
push 0x8553d0
call edi
lea eax, [esp + 0x28]
push eax
push 0x40
push 1
push 0x59a8d0
call edi
lea eax, [esp + 0x28]
mov byte [0x59a8d0], 0xeb
push eax
push dword [esp + 0x2c]
push 1
push 0x59a8d0
call edi
push 0x1005a460
push 0x561740
push 0xe9
call fcn.100b1680
push 0x1005a530
push 0x57ddd7
push 0xe9
call fcn.100b1680
add esp, 0x18
lea eax, [esp + 0x28]
push eax
push 0x40
push 5
push 0x792b7f
call edi
mov eax, 0x792b7f
mov dword [eax], 0x90909090
mov byte [eax + 4], 0x90
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x2c]
push 5
push 0x792b7f
call edi
push 0x10024ee0
push 0x63764c
push 0xe9
call fcn.100b1680
push 0x82a9f3
push 0x82a983
push 0xe9
call fcn.100b1680
push 0x82a9f3
push 0x82a983
push 0xe9
call fcn.100b1680
add esp, 0x24
cmp dword [0x101ee958], 1
jne 0x1005a6da
push 0x1005a400
push 0x78f56e
push 0xe9
call fcn.100b1680
add esp, 0xc
push 0x1003fce0
push 0x4d92e2
push 0xe8
call fcn.100b1680
push fcn.10040290
push 0x95e310
push 0xe8
call fcn.100b1680
push fcn.10040290
push 0x95e6eb
push 0xe8
call fcn.100b1680
add esp, 0x24
lea eax, [esp + 0x28]
push eax
push 0x40
push 1
push 0x649e27
call edi
lea eax, [esp + 0x28]
mov byte [0x649e27], 0xe
push eax
push dword [esp + 0x2c]
push 1
push 0x649e27
call edi
lea eax, [esp + 0x28]
push eax
push 0x40
push 1
push 0x556c38
call edi
lea eax, [esp + 0x28]
mov byte [0x556c38], 2
push eax
push dword [esp + 0x2c]
push 1
push 0x556c38
call edi
push 0x18
call fcn.100d591e
movaps xmm0, xmmword [0x1017f290]
mov edx, eax
push 0x18
mov ecx, 0x77eecd
movups xmmword [eax], xmm0
movq qword [eax + 0x10], xmm0
call fcn.100b0de0
push 0x5db408
push 0x5db322
push 0xe9
call fcn.100b1680
push 0x58811f
push 0x5880f0
push 0xe9
call fcn.100b1680
add esp, 0x20
lea eax, [esp + 0x28]
push eax
push 0x40
push 4
push 0x588447
call edi
lea eax, [esp + 0x28]
mov dword [0x588447], 0xfff
push eax
push dword [esp + 0x2c]
push 4
push 0x588447
call edi
push 0x59b00e
push 0x59affa
push 0xe8
call fcn.100b1680
push 0x95dfd3
push 0x95dfbe
push 0xe9
call fcn.100b1680
push 0x720894
push 0x71ae92
push 0xe9
call fcn.100b1680
push 0x720894
push 0x71b1a3
push 0xe9
call fcn.100b1680
push 0x644537
push 0x64452a
push 0xe9
call fcn.100b1680
add esp, 0x3c
lea eax, [esp + 0x28]
push eax
push 0x40
push 1
push 0x4d128f
call edi
lea eax, [esp + 0x28]
mov byte [0x4d128f], 0x1d
push eax
push dword [esp + 0x2c]
push 1
push 0x4d128f
call edi
movzx esi, word [0x101ee8e8]
lea eax, [esp + 0x28]
push eax
push 0x40
push 2
push 0x405b7c
call edi
lea eax, [esp + 0x28]
mov word [0x405b7c], si
push eax
push dword [esp + 0x2c]
push 2
push 0x405b7c
call edi
movzx esi, word [0x101ee8e8]
lea eax, [esp + 0x28]
push eax
push 0x40
push 2
push 0x40cc40
call edi
lea eax, [esp + 0x28]
mov word [0x40cc40], si
push eax
push dword [esp + 0x2c]
push 2
push 0x40cc40
call edi
lea eax, [esp + 0x28]
push eax
push 0x40
push 4
push 0x5b57ed
call edi
lea eax, [esp + 0x28]
mov dword [0x5b57ed], 0x400
push eax
push dword [esp + 0x2c]
push 4
push 0x5b57ed
call edi
lea eax, [esp + 0x28]
push eax
push 0x40
push 4
push 0x589dbe
call edi
lea eax, [esp + 0x28]
mov dword [0x589dbe], 0x400
push eax
push dword [esp + 0x2c]
push 4
push 0x589dbe
call edi
lea eax, [esp + 0x28]
push eax
push 0x40
push 4
push 0x4d2cb2
call edi
lea eax, [esp + 0x28]
mov dword [0x4d2cb2], 0x3800
push eax
push dword [esp + 0x2c]
push 4
push 0x4d2cb2
call edi
lea eax, [esp + 0x28]
push eax
push 0x40
push 4
push 0x4d2d9c
call edi
lea eax, [esp + 0x28]
mov dword [0x4d2d9c], 0x3800
push eax
push dword [esp + 0x2c]
push 4
push 0x4d2d9c
call edi
mov eax, dword [0x101ee9e8]
dec eax
cmp eax, 3
ja case.default.0x1005a995
jmp dword [eax*4 + 0x1005b394]
push 3
push 0x1017c098
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0xf
mov byte [esp + 0x18], 0
call fcn.1000bb40
lea eax, [esp + 0x10]
push eax
call fcn.1005a320
mov edx, dword [esp + 0x24]
movzx ebx, ax
cmp edx, 0x10
jb 0x1005ab57
mov ecx, dword [esp + 0x10]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1005a9fe
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1005b38d
push edx
push ecx
call fcn.100d5624
add esp, 8
jmp 0x1005ab57
push 3
push 0x1017c09c
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0xf
mov byte [esp + 0x18], 0
call fcn.1000bb40
lea eax, [esp + 0x10]
push eax
call fcn.1005a320
mov edx, dword [esp + 0x24]
movzx ebx, ax
cmp edx, 0x10
jb 0x1005ab57
mov ecx, dword [esp + 0x10]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1005aa6f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1005b38d
push edx
push ecx
call fcn.100d5624
add esp, 8
jmp 0x1005ab57
push 3
push 0x1017c0a0
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0xf
mov byte [esp + 0x18], 0
call fcn.1000bb40
lea eax, [esp + 0x10]
push eax
call fcn.1005a320
mov edx, dword [esp + 0x24]
movzx ebx, ax
cmp edx, 0x10
jb 0x1005ab57
mov ecx, dword [esp + 0x10]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1005aae0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1005b38d
push edx
push ecx
call fcn.100d5624
add esp, 8
jmp 0x1005ab57
push 3
push 0x1017c0a4
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0xf
mov byte [esp + 0x18], 0
call fcn.1000bb40
lea eax, [esp + 0x10]
push eax
call fcn.1005a320
mov edx, dword [esp + 0x24]
movzx ebx, ax
cmp edx, 0x10
jb 0x1005ab57
mov ecx, dword [esp + 0x10]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1005a9fe
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1005b38d
jmp 0x1005a9fe
mov ebx, dword [esp + 0x28]
cmp dword [0x101ee9e8], 1
jb 0x1005b0d4
lea eax, [esp + 0x28]
push eax
push 0x40
push 1
push 0x958d4f
call edi
lea eax, [esp + 0x28]
mov byte [0x958d4f], bl
push eax
push dword [esp + 0x2c]
push 1
push 0x958d4f
call edi
lea eax, [esp + 0x28]
push eax
push 0x40
push 1
push 0x958d50
call edi
lea eax, [esp + 0x28]
mov byte [0x958d50], 3
push eax
push dword [esp + 0x2c]
push 1
push 0x958d50
call edi
lea eax, [esp + 0x28]
push eax
push 0x40
push 1
push 0x959036
call edi
lea eax, [esp + 0x28]
mov byte [0x959036], 0
push eax
push dword [esp + 0x2c]
push 1
push 0x959036
call edi
lea eax, [esp + 0x28]
push eax
push 0x40
push 1
push 0x95903a
call edi
lea eax, [esp + 0x28]
mov byte [0x95903a], bl
push eax
push dword [esp + 0x2c]
push 1
push 0x95903a
call edi
lea eax, [esp + 0x28]
push eax
push 0x40
push 1
push 0x95903b
call edi
lea eax, [esp + 0x28]
mov byte [0x95903b], 3
push eax
push dword [esp + 0x2c]
push 1
push 0x95903b
call edi
lea eax, [esp + 0x28]
push eax
push 0x40
push 1
push 0x787041
call edi
lea eax, [esp + 0x28]
mov byte [0x787041], bl
push eax
push dword [esp + 0x2c]
push 1
push 0x787041
call edi
lea eax, [esp + 0x28]
push eax
push 0x40
push 1
push 0x787042
call edi
lea eax, [esp + 0x28]
mov byte [0x787042], 3
push eax
push dword [esp + 0x2c]
push 1
push 0x787042
call edi
lea eax, [esp + 0x28]
push eax
push 0x40
push 1
push 0x4215c2
call edi
lea eax, [esp + 0x28]
mov byte [0x4215c2], 0
push eax
push dword [esp + 0x2c]
push 1
push 0x4215c2
call edi
lea eax, [esp + 0x28]
push eax
push 0x40
push 1
push 0x78b410
call edi
lea eax, [esp + 0x28]
mov byte [0x78b410], bl
push eax
push dword [esp + 0x2c]
push 1
push 0x78b410
call edi
lea eax, [esp + 0x28]
push eax
push 0x40
push 1
push 0x78b411
call edi
lea eax, [esp + 0x28]
mov byte [0x78b411], 3
push eax
push dword [esp + 0x2c]
push 1
push 0x78b411
call edi
lea eax, [esp + 0x28]
push eax
push 0x40
push 1
push 0x78b46b
call edi
lea eax, [esp + 0x28]
mov byte [0x78b46b], bl
push eax
push dword [esp + 0x2c]
push 1
push 0x78b46b
call edi
lea eax, [esp + 0x28]
push eax
push 0x40
push 1
push 0x78b46c
call edi
lea eax, [esp + 0x28]
mov byte [0x78b46c], 3
push eax
push dword [esp + 0x2c]
push 1
push 0x78b46c
call edi
lea eax, [esp + 0x28]
push eax
push 0x40
push 1
push 0x48d621
call edi
lea eax, [esp + 0x28]
mov byte [0x48d621], bl
push eax
push dword [esp + 0x2c]
push 1
push 0x48d621
call edi
lea eax, [esp + 0x28]
push eax
push 0x40
push 1
push 0x48d622
call edi
lea eax, [esp + 0x28]
mov byte [0x48d622], 3
push eax
push dword [esp + 0x2c]
push 1
push 0x48d622
call edi
lea eax, [esp + 0x28]
push eax
push 0x40
push 1
push 0x4918c9
call edi
lea eax, [esp + 0x28]
mov byte [0x4918c9], bl
push eax
push dword [esp + 0x2c]
push 1
push 0x4918c9
call edi
lea eax, [esp + 0x28]
push eax
push 0x40
push 1
push 0x4918ca
call edi
lea eax, [esp + 0x28]
mov byte [0x4918ca], 3
push eax
push dword [esp + 0x2c]
push 1
push 0x4918ca
call edi
lea eax, [esp + 0x28]
push eax
push 0x40
push 1
push 0x4918ea
call edi
lea eax, [esp + 0x28]
mov byte [0x4918ea], bl
push eax
push dword [esp + 0x2c]
push 1
push 0x4918ea
call edi
lea eax, [esp + 0x28]
push eax
push 0x40
push 1
push 0x4918eb
call edi
lea eax, [esp + 0x28]
mov byte [0x4918eb], 3
push eax
push dword [esp + 0x2c]
push 1
push 0x4918eb
call edi
lea eax, [esp + 0x28]
push eax
push 0x40
push 1
push 0x786d31
call edi
lea eax, [esp + 0x28]
mov byte [0x786d31], bl
push eax
push dword [esp + 0x2c]
push 1
push 0x786d31
call edi
lea eax, [esp + 0x28]
push eax
push 0x40
push 1
push 0x786d32
call edi
lea eax, [esp + 0x28]
mov byte [0x786d32], 3
push eax
push dword [esp + 0x2c]
push 1
push 0x786d32
call edi
lea eax, [esp + 0x28]
push eax
push 0x40
push 1
push 0x786d31
call edi
lea eax, [esp + 0x28]
mov byte [0x786d31], bl
push eax
push dword [esp + 0x2c]
push 1
push 0x786d31
call edi
lea eax, [esp + 0x28]
push eax
push 0x40
push 1
push 0x786d32
call edi
lea eax, [esp + 0x28]
mov byte [0x786d32], 3
push eax
push dword [esp + 0x2c]
push 1
push 0x786d32
call edi
lea eax, [esp + 0x28]
push eax
push 0x40
push 1
push 0x787041
call edi
lea eax, [esp + 0x28]
mov byte [0x787041], bl
push eax
push dword [esp + 0x2c]
push 1
push 0x787041
call edi
lea eax, [esp + 0x28]
push eax
push 0x40
push 1
push 0x787042
call edi
lea eax, [esp + 0x28]
mov byte [0x787042], 3
push eax
push dword [esp + 0x2c]
push 1
push 0x787042
call edi
lea eax, [esp + 0x28]
push eax
push 0x40
push 1
push 0x78b410
call edi
lea eax, [esp + 0x28]
mov byte [0x78b410], bl
push eax
push dword [esp + 0x2c]
push 1
push 0x78b410
call edi
lea eax, [esp + 0x28]
push eax
push 0x40
push 1
push 0x78b411
call edi
lea eax, [esp + 0x28]
mov byte [0x78b411], 3
push eax
push dword [esp + 0x2c]
push 1
push 0x78b411
call edi
lea eax, [esp + 0x28]
push eax
push 0x40
push 1
push 0x78b46b
call edi
lea eax, [esp + 0x28]
mov byte [0x78b46b], bl
push eax
push dword [esp + 0x2c]
push 1
push 0x78b46b
call edi
lea eax, [esp + 0x28]
push eax
push 0x40
push 1
push 0x78b46c
call edi
lea eax, [esp + 0x28]
mov byte [0x78b46c], 3
push eax
push dword [esp + 0x2c]
push 1
push 0x78b46c
call edi
lea eax, [esp + 0x28]
push eax
push 0x40
push 1
push 0x840e76
call edi
lea eax, [esp + 0x28]
mov byte [0x840e76], bl
push eax
push dword [esp + 0x2c]
push 1
push 0x840e76
call edi
lea eax, [esp + 0x28]
push eax
push 0x40
push 1
push 0x840e77
call edi
lea eax, [esp + 0x28]
mov byte [0x840e77], 3
push eax
push dword [esp + 0x2c]
push 1
push 0x840e77
call edi
cmp dword [0x101ee920], 1
jne 0x1005b0d4
lea eax, [esp + 0x28]
push eax
push 0x40
push 1
push 0x9591d3
call edi
lea eax, [esp + 0x28]
mov byte [0x9591d3], 0x58
push eax
push dword [esp + 0x2c]
push 1
push 0x9591d3
call edi
lea eax, [esp + 0x28]
push eax
push 0x40
push 1
push 0x9591d4
call edi
lea eax, [esp + 0x28]
mov byte [0x9591d4], 0xfc
push eax
push dword [esp + 0x2c]
push 1
push 0x9591d4
call edi
lea eax, [esp + 0x28]
push eax
push 0x40
push 1
push 0x9591d8
call edi
lea eax, [esp + 0x28]
mov byte [0x9591d8], bl
push eax
push dword [esp + 0x2c]
push 1
push 0x9591d8
call edi
lea eax, [esp + 0x28]
push eax
push 0x40
push 1
push 0x9591d9
call edi
lea eax, [esp + 0x28]
mov byte [0x9591d9], 3
push eax
push dword [esp + 0x2c]
push 1
push 0x9591d9
call edi
cmp dword [0x101ee91c], 1
jne 0x1005b106
lea eax, [esp + 0x28]
push eax
push 0x40
push 1
push 0x4215a7
call edi
lea eax, [esp + 0x28]
mov byte [0x4215a7], 0xeb
push eax
push dword [esp + 0x2c]
push 1
push 0x4215a7
call edi
cmp dword [0x101ee920], 1
jne 0x1005b138
lea eax, [esp + 0x28]
push eax
push 0x40
push 1
push 0x507aeb
call edi
lea eax, [esp + 0x28]
mov byte [0x507aeb], 0x72
push eax
push dword [esp + 0x2c]
push 1
push 0x507aeb
call edi
cmp dword [0x101ee924], 1
jne 0x1005b16a
lea eax, [esp + 0x28]
push eax
push 0x40
push 1
push 0x507afd
call edi
lea eax, [esp + 0x28]
mov byte [0x507afd], 0xeb
push eax
push dword [esp + 0x2c]
push 1
push 0x507afd
call edi
cmp dword [0x101ee94c], 1
jne 0x1005b350
lea eax, [esp + 0x28]
push eax
push 0x40
push 1
push 0x501957
call edi
lea eax, [esp + 0x28]
mov byte [0x501957], 0
push eax
push dword [esp + 0x2c]
push 1
push 0x501957
call edi
lea eax, [esp + 0x28]
push eax
push 0x40
push 6
push 0x54eae1
call edi
mov eax, 0x54eae1
mov ecx, 0x90909090
mov dword [eax], ecx
mov word [eax + 4], cx
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x2c]
push 6
push 0x54eae1
call edi
lea eax, [esp + 0x28]
push eax
push 0x40
push 6
push 0x54fc92
call edi
mov eax, 0x54fc92
mov ecx, 0x90909090
mov dword [eax], ecx
mov word [eax + 4], cx
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x2c]
push 6
push 0x54fc92
call edi
lea eax, [esp + 0x28]
push eax
push 0x40
push 1
push 0x50226b
call edi
lea eax, [esp + 0x28]
mov byte [0x50226b], 0
push eax
push dword [esp + 0x2c]
push 1
push 0x50226b
call edi
lea eax, [esp + 0x28]
push eax
push 0x40
push 6
push 0x54eca3
call edi
mov eax, 0x54eca3
mov ecx, 0x90909090
mov dword [eax], ecx
mov word [eax + 4], cx
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x2c]
push 6
push 0x54eca3
call edi
lea eax, [esp + 0x28]
push eax
push 0x40
push 6
push 0x54fcec
call edi
mov ecx, 0x90909090
mov eax, 0x54fcec
mov dword [eax], ecx
mov word [eax + 4], cx
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x2c]
push 6
push 0x54fcec
call edi
lea eax, [esp + 0x28]
push eax
push 0x40
push 1
push 0x502c4d
call edi
lea eax, [esp + 0x28]
mov byte [0x502c4d], 0
push eax
push dword [esp + 0x2c]
push 1
push 0x502c4d
call edi
lea eax, [esp + 0x28]
push eax
push 0x40
push 6
push 0x54ed6d
call edi
mov eax, 0x54ed6d
mov ecx, 0x90909090
mov dword [eax], ecx
mov word [eax + 4], cx
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x2c]
push 6
push 0x54ed6d
call edi
lea eax, [esp + 0x28]
push eax
push 0x40
push 6
push 0x54fd5f
call edi
mov eax, 0x54fd5f
mov ecx, 0x90909090
mov dword [eax], ecx
mov word [eax + 4], cx
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x2c]
push 6
push 0x54fd5f
call edi
lea eax, [esp + 0x28]
push eax
push 0x40
push 6
push 0x54fe3e
call edi
mov eax, 0x54fe3e
mov ecx, 0x90909090
mov dword [eax], ecx
mov word [eax + 4], cx
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x2c]
push 6
push 0x54fe3e
call edi
push 0x1005b3b0
push 0x614aef
push 0xe8
call fcn.100b1680
push 0x1005b3b0
push 0x772460
push 0xe8
call fcn.100b1680
mov ecx, dword [esp + 0x44]
add esp, 0x18
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100d52b0
mov esp, ebp
pop ebp
ret
call fcn.1012c43c
nop
pushfd
test eax, -1441984507
add eax, 0x5aa7e10
adc ah, ch
stosb byte es:[edi], al
add eax, 0xcccccc10
int3