Function at 0x10055700
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x1009f004]
xor eax, esp
mov dword [esp + 0x20], eax
cmp dword [0x100afe80], 0
push ebx
push esi
push edi
jne 0x100557c6
push 0x20000
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
add esp, 4
mov dword [0x100afe80], esi
test esi, esi
jne 0x10055752
call fcn.10079c50
test al, al
je 0x100557c6
push str.Failed_to_allocate_g_cachedOverwriteArr_
jmp 0x100557be
push 0x20000
push 0xffffffffffffffff
push esi
call sub.VCRUNTIME140.dll_memset
mov eax, dword [0x100aff98]
add esp, 0xc
xor ebx, ebx
test eax, eax
je 0x100557c6
mov edi, 0x100aff98
cmp edi, 0x1016ff8c
jge 0x100557b0
cmp eax, 0xffff
ja 0x10055787
mov word [esi + eax*2], bx
jmp 0x100557a3
call fcn.10079c50
test al, al
je 0x1005579d
push str.id___65536_in__overwriteItem_
call fcn.10079e60
add esp, 4
mov esi, dword [0x100afe80]
mov eax, dword [edi + 0xc]
add edi, 0xc
inc ebx
test eax, eax
jne 0x10055772
jmp 0x100557c6
call fcn.10079c50
test al, al
je 0x100557c6
push str.i___65535_in__overwriteItem_count_
call fcn.10079e60
add esp, 4
mov ebx, dword [0x5dda7d]
mov edi, 0x10055690
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add ebx, 0x5dda81
mov byte [esp + 0xc], 0xe8
mov dword [esp + 0x28], 0
lea eax, [edi - 0x5dda81]
mov dword [esp + 0xd], eax
lea eax, [esp + 0x28]
push eax
push 0x40
push 5
push 0x5dda7c
call esi
test eax, eax
je 0x10055828
mov eax, dword [esp + 0xc]
mov ecx, 0x5dda7c
mov dword [ecx], eax
mov al, byte [esp + 0x10]
mov byte [ecx + 4], al
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x2c]
push 5
push ecx
call esi
lea eax, [edi - 0x5de5d4]
mov dword [0x1009fe50], ebx
mov dword [esp + 0xd], eax
lea eax, [esp + 0x28]
push eax
push 0x40
push 5
push 0x5de5cf
mov byte [esp + 0x1c], 0xe8
mov dword [esp + 0x38], 0
call esi
test eax, eax
je 0x10055879
mov eax, dword [esp + 0xc]
mov ecx, 0x5de5cf
mov dword [ecx], eax
mov al, byte [esp + 0x10]
mov byte [ecx + 4], al
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x2c]
push 5
push ecx
call esi
lea eax, [edi - 0x7ffa96]
mov byte [esp + 0xc], 0xe8
mov dword [esp + 0xd], eax
lea eax, [esp + 0x28]
push eax
push 0x40
push 5
push 0x7ffa91
mov dword [esp + 0x38], 0
call esi
test eax, eax
je 0x100558c4
mov eax, dword [esp + 0xc]
mov ecx, 0x7ffa91
mov dword [ecx], eax
mov al, byte [esp + 0x10]
mov byte [ecx + 4], al
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x2c]
push 5
push ecx
call esi
lea eax, [esp + 0x28]
mov byte [esp + 0xc], 0xe8
push eax
push 0x40
push 5
sub edi, 0x80928f
mov dword [esp + 0x34], 0
push 0x80928a
mov dword [esp + 0x1d], edi
call esi
test eax, eax
je 0x1005590f
mov eax, dword [esp + 0xc]
mov ecx, 0x80928a
mov dword [ecx], eax
mov al, byte [esp + 0x10]
mov byte [ecx + 4], al
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x2c]
push 5
push ecx
call esi
mov edi, dword [0x4066e6]
mov eax, 0x10054560
sub eax, 0x4066ea
mov byte [esp + 0xc], 0xe8
mov dword [esp + 0xd], eax
add edi, 0x4066ea
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 0
push eax
push 0x40
push 5
push 0x4066e5
call esi
test eax, eax
je 0x1005596a
mov eax, dword [esp + 0xc]
mov ecx, 0x4066e5
mov dword [ecx], eax
mov al, byte [esp + 0x10]
mov byte [ecx + 4], al
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x2c]
push 5
push ecx
call esi
mov eax, 0x10054490
mov dword [0x1009fe5c], edi
mov edi, dword [0x4041b9]
sub eax, 0x4041bd
mov dword [esp + 0xd], eax
add edi, 0x4041bd
lea eax, [esp + 0x28]
mov byte [esp + 0xc], 0xe8
push eax
push 0x40
push 5
push 0x4041b8
mov dword [esp + 0x38], 0
call esi
test eax, eax
je 0x100559cb
mov eax, dword [esp + 0xc]
mov ecx, 0x4041b8
mov dword [ecx], eax
mov al, byte [esp + 0x10]
mov byte [ecx + 4], al
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x2c]
push 5
push ecx
call esi
mov eax, 0x10054610
mov dword [0x1009fe38], edi
mov edi, dword [0x4db8f6]
sub eax, 0x4db8fa
mov dword [esp + 0xd], eax
add edi, 0x4db8fa
lea eax, [esp + 0x28]
mov byte [esp + 0xc], 0xe8
push eax
push 0x40
push 5
push 0x4db8f5
mov dword [esp + 0x38], 0
call esi
test eax, eax
je 0x10055a2c
mov eax, dword [esp + 0xc]
mov ecx, 0x4db8f5
mov dword [ecx], eax
mov al, byte [esp + 0x10]
mov byte [ecx + 4], al
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x2c]
push 5
push ecx
call esi
mov ebx, dword [0x4066e1]
mov dword [0x1009fe34], edi
add ebx, 0x4066e5
mov edi, 0x10054640
mov byte [esp + 0xc], 0xe8
mov dword [esp + 0x28], 0
lea eax, [edi - 0x4066e5]
mov dword [esp + 0xd], eax
lea eax, [esp + 0x28]
push eax
push 0x40
push 5
push 0x4066e0
call esi
test eax, eax
je 0x10055a8e
mov eax, dword [esp + 0xc]
mov ecx, 0x4066e0
mov dword [ecx], eax
mov al, byte [esp + 0x10]
mov byte [ecx + 4], al
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x2c]
push 5
push ecx
call esi
mov eax, 0x10054480
mov dword [0x1009fe44], ebx
mov ebx, dword [0x4fa607]
sub eax, 0x4fa60b
mov dword [esp + 0xd], eax
add ebx, 0x4fa60b
lea eax, [esp + 0x28]
mov byte [esp + 0xc], 0xe8
push eax
push 0x40
push 5
push 0x4fa606
mov dword [esp + 0x38], 0
call esi
test eax, eax
je 0x10055aef
mov eax, dword [esp + 0xc]
mov ecx, 0x4fa606
mov dword [ecx], eax
mov al, byte [esp + 0x10]
mov byte [ecx + 4], al
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x2c]
push 5
push ecx
call esi
lea eax, [edi - 0x4daa93]
mov dword [0x1009fe60], ebx
mov dword [esp + 0xd], eax
lea eax, [esp + 0x28]
push eax
push 0x40
push 5
push 0x4daa8e
mov byte [esp + 0x1c], 0xe8
mov dword [esp + 0x38], 0
call esi
test eax, eax
je 0x10055b40
mov eax, dword [esp + 0xc]
mov ecx, 0x4daa8e
mov dword [ecx], eax
mov al, byte [esp + 0x10]
mov byte [ecx + 4], al
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x2c]
push 5
push ecx
call esi
lea eax, [edi - 0x6b20ac]
mov byte [esp + 0xc], 0xe8
mov dword [esp + 0xd], eax
lea eax, [esp + 0x28]
push eax
push 0x40
push 5
push 0x6b20a7
mov dword [esp + 0x38], 0
call esi
test eax, eax
je 0x10055b8b
mov eax, dword [esp + 0xc]
mov ecx, 0x6b20a7
mov dword [ecx], eax
mov al, byte [esp + 0x10]
mov byte [ecx + 4], al
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x2c]
push 5
push ecx
call esi
lea eax, [esp + 0x28]
mov byte [esp + 0xc], 0xe8
push eax
push 0x40
push 5
sub edi, 0x6b21b5
mov dword [esp + 0x34], 0
push 0x6b21b0
mov dword [esp + 0x1d], edi
call esi
test eax, eax
je 0x10055bd6
mov eax, dword [esp + 0xc]
mov ecx, 0x6b21b0
mov dword [ecx], eax
mov al, byte [esp + 0x10]
mov byte [ecx + 4], al
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x2c]
push 5
push ecx
call esi
mov edi, dword [0x512268]
mov eax, 0x10055520
sub eax, 0x51226c
mov byte [esp + 0xc], 0xe8
mov dword [esp + 0xd], eax
add edi, 0x51226c
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 0
push eax
push 0x40
push 5
push 0x512267
call esi
test eax, eax
je 0x10055c31
mov eax, dword [esp + 0xc]
mov ecx, 0x512267
mov dword [ecx], eax
mov al, byte [esp + 0x10]
mov byte [ecx + 4], al
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x2c]
push 5
push ecx
call esi
mov eax, 0x10055640
mov dword [0x1009fe54], edi
mov edi, dword [0x52b04e]
sub eax, 0x52b052
mov dword [esp + 0xd], eax
add edi, 0x52b052
lea eax, [esp + 0x28]
mov byte [esp + 0xc], 0xe8
push eax
push 0x40
push 5
push 0x52b04d
mov dword [esp + 0x38], 0
call esi
test eax, eax
je 0x10055c92
mov eax, dword [esp + 0xc]
mov ecx, 0x52b04d
mov dword [ecx], eax
mov al, byte [esp + 0x10]
mov byte [ecx + 4], al
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x2c]
push 5
push ecx
call esi
mov dword [0x1009fe40], edi
xor ebx, ebx
mov edi, dword [0x10096f60]
mov byte [esp + 0x14], 0xe8
nop word [eax + eax]
mov eax, 0x10054800
mov dword [esp + 0x28], 0
sub eax, edi
sub eax, 5
mov dword [esp + 0x15], eax
mov eax, dword [edi + 1]
add eax, 5
add eax, edi
mov dword [esp + 0xc], eax
lea eax, [esp + 0x28]
push eax
push 0x40
push 5
push edi
call esi
test eax, eax
je 0x10055cfd
mov eax, dword [esp + 0x14]
mov dword [edi], eax
mov al, byte [esp + 0x18]
mov byte [edi + 4], al
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x2c]
push 5
push edi
call esi
mov eax, dword [esp + 0xc]
test ebx, ebx
jne 0x10055d0c
mov dword [0x1009fe3c], eax
jmp 0x10055d18
cmp dword [0x1009fe3c], eax
jne 0x10055e65
mov edi, dword [ebx*4 + 0x10096f64]
inc ebx
test edi, edi
jne 0x10055cb0
mov edi, 0x100915e0
mov byte [esp + 0x14], 0xe8
mov dword [esp + 0x28], 0
lea eax, [edi - 0x805ec3]
mov dword [esp + 0x15], eax
lea eax, [esp + 0x28]
push eax
push 0x40
push 5
push 0x805ebe
call esi
test eax, eax
je 0x10055d74
mov eax, dword [esp + 0x14]
mov ecx, 0x805ebe
mov dword [ecx], eax
mov al, byte [esp + 0x18]
mov byte [ecx + 4], al
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x2c]
push 5
push ecx
call esi
lea eax, [edi - 0x80700d]
mov byte [esp + 0x14], 0xe8
mov dword [esp + 0x15], eax
lea eax, [esp + 0x28]
push eax
push 0x40
push 5
push 0x807008
mov dword [esp + 0x38], 0
call esi
test eax, eax
je 0x10055dbf
mov eax, dword [esp + 0x14]
mov ecx, 0x807008
mov dword [ecx], eax
mov al, byte [esp + 0x18]
mov byte [ecx + 4], al
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x2c]
push 5
push ecx
call esi
lea eax, [esp + 0x28]
mov byte [esp + 0x14], 0xe8
push eax
push 0x40
push 5
sub edi, 0x80fe3b
mov dword [esp + 0x34], 0
push 0x80fe36
mov dword [esp + 0x25], edi
call esi
test eax, eax
je 0x10055e0a
mov eax, dword [esp + 0x14]
mov ecx, 0x80fe36
mov dword [ecx], eax
mov al, byte [esp + 0x18]
mov byte [ecx + 4], al
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x2c]
push 5
push ecx
call esi
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 0
push eax
push 0x40
push 1
push 0x634e28
call esi
test eax, eax
je 0x10055e3f
lea eax, [esp + 0x28]
mov byte [0x634e28], 0
push eax
push dword [esp + 0x2c]
push 1
push 0x634e28
call esi
call fcn.100548e0
call fcn.10054ba0
call fcn.10054cb0
call fcn.10055390
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100928e8
mov esp, ebp
pop ebp
ret
lea ecx, [esp + 0x1c]
call fcn.100543c0
push 0x1009c678
mov eax, ecx
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3