Function at 0x10001950
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [0x101d9848], 0
je 0x10001b8a
fld dword [0x101d984c]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
fstp dword [ebp - 8]
push edi
mov edi, dword [0x101d9818]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push edi
call esi
fld dword [ebp - 8]
mov edx, dword [ebp - 4]
fstp dword [edi]
lea ecx, [ebp - 4]
push ecx
push edx
push 4
push edi
call esi
fld dword [0x101d9850]
mov edi, dword [0x101d981c]
fstp dword [ebp - 8]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push edi
call esi
fld dword [ebp - 8]
mov edx, dword [ebp - 4]
fstp dword [edi]
lea ecx, [ebp - 4]
push ecx
push edx
push 4
push edi
call esi
fld dword [0x101d9854]
mov edi, dword [0x101d9820]
fstp dword [ebp - 8]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push edi
call esi
fld dword [ebp - 8]
mov edx, dword [ebp - 4]
fstp dword [edi]
lea ecx, [ebp - 4]
push ecx
push edx
push 4
push edi
call esi
fld dword [0x101d9858]
mov edi, dword [0x101d9824]
fstp dword [ebp - 8]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push edi
call esi
fld dword [ebp - 8]
mov edx, dword [ebp - 4]
fstp dword [edi]
lea ecx, [ebp - 4]
push ecx
push edx
push 4
push edi
call esi
fld dword [0x101d985c]
mov edi, dword [0x101d9828]
fstp dword [ebp - 8]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push edi
call esi
fld dword [ebp - 8]
mov edx, dword [ebp - 4]
fstp dword [edi]
lea ecx, [ebp - 4]
push ecx
push edx
push 4
push edi
call esi
fld dword [0x101d9860]
mov edi, dword [0x101d982c]
fstp dword [ebp - 8]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push edi
call esi
fld dword [ebp - 8]
mov edx, dword [ebp - 4]
fstp dword [edi]
lea ecx, [ebp - 4]
push ecx
push edx
push 4
push edi
call esi
fld dword [0x101d9864]
mov edi, dword [0x101d9830]
fstp dword [ebp - 8]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push edi
call esi
fld dword [ebp - 8]
mov edx, dword [ebp - 4]
fstp dword [edi]
lea ecx, [ebp - 4]
push ecx
push edx
push 4
push edi
call esi
fld dword [0x101d9868]
mov edi, dword [0x101d9834]
fstp dword [ebp - 8]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push edi
call esi
fld dword [ebp - 8]
mov edx, dword [ebp - 4]
fstp dword [edi]
lea ecx, [ebp - 4]
push ecx
push edx
push 4
push edi
call esi
cmp dword [0x6b8d48], 0x1e
jne 0x10001b88
mov edi, dword [0x101d9838]
fld dword [0x101d986c]
lea eax, [ebp - 4]
fstp dword [ebp - 8]
push eax
push 0x40
push 4
push edi
call esi
fld dword [ebp - 8]
mov edx, dword [ebp - 4]
fstp dword [edi]
lea ecx, [ebp - 4]
push ecx
push edx
push 4
push edi
call esi
fld dword [0x101d9870]
mov edi, dword [0x101d983c]
fstp dword [ebp - 8]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push edi
call esi
fld dword [ebp - 8]
mov edx, dword [ebp - 4]
fstp dword [edi]
lea ecx, [ebp - 4]
push ecx
push edx
push 4
push edi
call esi
fld dword [0x101d9874]
mov edi, dword [0x101d9840]
fstp dword [ebp - 8]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push edi
call esi
fld dword [ebp - 8]
mov edx, dword [ebp - 4]
fstp dword [edi]
lea ecx, [ebp - 4]
push ecx
push edx
push 4
push edi
call esi
fld dword [0x101d9878]
mov edi, dword [0x101d9844]
fstp dword [ebp - 8]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push edi
call esi
fld dword [ebp - 8]
mov edx, dword [ebp - 4]
fstp dword [edi]
lea ecx, [ebp - 4]
push ecx
push edx
push 4
push edi
call esi
pop edi
pop esi
mov ecx, 3
call fcn.10002cc0
test eax, eax
jne 0x10001bae
mov eax, 0x1005bd48
push 1
push eax
mov eax, 0x548ab0
call eax
add esp, 8
mov esp, ebp
pop ebp
ret
add eax, 4
push 1
push eax
mov eax, 0x548ab0
call eax
add esp, 8
mov esp, ebp
pop ebp
ret