Function at 0x1000f660
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005eb65
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x1006d040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edx, edx
cmp byte [0x101279b4], dl
je 0x1000f6e3
mov ecx, 0xb2
nop word [eax + eax]
mov al, byte [edx + 0x10060abc]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x24], al
and ecx, 0x800000ff
jns 0x1000f6bd
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x13
jl 0x1000f6a0
mov byte [ebp - 0x11], 0
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 0
mov dword [ebp - 0x28], eax
push dword [ebp - 0x28]
mov eax, dword [0x10127b88]
call eax
add esp, 4
jmp 0x1000f731
mov ecx, 0x40
nop dword [eax + eax]
mov al, byte [edx + 0x10060ad0]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x24], al
and ecx, 0x800000ff
jns 0x1000f70d
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x13
jl 0x1000f6f0
mov byte [ebp - 0x11], 0
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 1
mov dword [ebp - 0x28], eax
push dword [ebp - 0x28]
mov eax, dword [0x10127b88]
call eax
add esp, 4
xor edx, edx
cmp byte [0x101279af], dl
je 0x1000f783
mov ecx, 0x3e
mov al, byte [edx + str.zM_6]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x24], al
and ecx, 0x800000ff
jns 0x1000f75d
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x13
jl 0x1000f740
mov byte [ebp - 0x11], 0
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 2
mov dword [ebp - 0x28], eax
push dword [ebp - 0x28]
mov eax, dword [0x10127b88]
call eax
add esp, 4
jmp 0x1000f7d1
mov ecx, 0x31
nop dword [eax + eax]
mov al, byte [edx + str.u_RCcY_MT_Z__42br]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x24], al
and ecx, 0x800000ff
jns 0x1000f7ad
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x13
jl 0x1000f790
mov byte [ebp - 0x11], 0
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 3
mov dword [ebp - 0x28], eax
push dword [ebp - 0x28]
mov eax, dword [0x10127b88]
call eax
add esp, 4
xor edx, edx
cmp byte [0x101279b0], dl
je 0x1000f823
mov ecx, 6
mov al, byte [edx + str._AgnOemobj0_]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x20], al
and ecx, 0x800000ff
jns 0x1000f7fd
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xc
jl 0x1000f7e0
mov byte [ebp - 0x14], 0
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 4
mov dword [ebp - 0x28], eax
push dword [ebp - 0x28]
mov eax, dword [0x10127b88]
call eax
add esp, 4
jmp 0x1000f871
mov ecx, 0x9d
nop dword [eax + eax]
mov al, byte [edx + 0x10060b1c]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x20], al
and ecx, 0x800000ff
jns 0x1000f84d
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xc
jl 0x1000f830
mov byte [ebp - 0x14], 0
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 5
mov dword [ebp - 0x28], eax
push dword [ebp - 0x28]
mov eax, dword [0x10127b88]
call eax
add esp, 4
xor edx, edx
cmp byte [0x101279ad], dl
je 0x1000f8c3
mov ecx, 0xbc
mov al, byte [edx + 0x10060b2c]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x1c], al
and ecx, 0x800000ff
jns 0x1000f89d
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xb
jl 0x1000f880
mov byte [ebp - 0x11], 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 6
mov dword [ebp - 0x28], eax
push dword [ebp - 0x28]
mov eax, dword [0x10127b88]
call eax
add esp, 4
jmp 0x1000f911
mov ecx, 0x4c
nop dword [eax + eax]
mov al, byte [edx + str.g_t_.6ug]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x1c], al
and ecx, 0x800000ff
jns 0x1000f8ed
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xb
jl 0x1000f8d0
mov byte [ebp - 0x11], 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 7
mov dword [ebp - 0x28], eax
push dword [ebp - 0x28]
mov eax, dword [0x10127b88]
call eax
add esp, 4
xor edx, edx
cmp byte [0x101279a2], dl
je 0x1000f963
mov ecx, 0x6a
mov al, byte [edx + 0x10060b44]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x20], al
and ecx, 0x800000ff
jns 0x1000f93d
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xf
jl 0x1000f920
mov byte [ebp - 0x11], 0
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 8
mov dword [ebp - 0x28], eax
push dword [ebp - 0x28]
mov eax, dword [0x10127b88]
call eax
add esp, 4
jmp 0x1000f9b1
mov ecx, 0x70
nop dword [eax + eax]
mov al, byte [edx + 0x10060b54]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x20], al
and ecx, 0x800000ff
jns 0x1000f98d
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xf
jl 0x1000f970
mov byte [ebp - 0x11], 0
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 9
mov dword [ebp - 0x28], eax
push dword [ebp - 0x28]
mov eax, dword [0x10127b88]
call eax
add esp, 4
xor edx, edx
cmp byte [0x101279ab], dl
je 0x1000fa03
mov ecx, 0x2d
mov al, byte [edx + 0x10060b64]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x24], al
and ecx, 0x800000ff
jns 0x1000f9dd
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x13
jl 0x1000f9c0
mov byte [ebp - 0x11], 0
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x28], eax
push dword [ebp - 0x28]
mov eax, dword [0x10127b88]
call eax
add esp, 4
jmp 0x1000fa51
mov ecx, 1
nop dword [eax + eax]
mov al, byte [edx + str.Q_v_ciOeeIcomt2]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x24], al
and ecx, 0x800000ff
jns 0x1000fa2d
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x13
jl 0x1000fa10
mov byte [ebp - 0x11], 0
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x28], eax
push dword [ebp - 0x28]
mov eax, dword [0x10127b88]
call eax
add esp, 4
xor edx, edx
cmp byte [0x101279b5], dl
je 0x1000faa3
mov ecx, 0x31
mov al, byte [edx + 0x10060b8c]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x24], al
and ecx, 0x800000ff
jns 0x1000fa7d
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x10
jl 0x1000fa60
mov byte [ebp - 0x14], 0
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x28], eax
push dword [ebp - 0x28]
mov eax, dword [0x10127b88]
call eax
add esp, 4
jmp 0x1000faf1
mov ecx, 0x62
nop dword [eax + eax]
mov al, byte [edx + 0x10060ba0]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x24], al
and ecx, 0x800000ff
jns 0x1000facd
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x10
jl 0x1000fab0
mov byte [ebp - 0x14], 0
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x28], eax
push dword [ebp - 0x28]
mov eax, dword [0x10127b88]
call eax
add esp, 4
xor edx, edx
cmp byte [0x101279ae], dl
je 0x1000fb43
mov ecx, 0x5c
mov al, byte [edx + str.we3_f]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x20], al
and ecx, 0x800000ff
jns 0x1000fb1d
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xd
jl 0x1000fb00
mov byte [ebp - 0x13], 0
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x28], eax
push dword [ebp - 0x28]
mov eax, dword [0x10127b88]
call eax
add esp, 4
jmp 0x1000fb91
mov ecx, 0x2c
nop dword [eax + eax]
mov al, byte [edx + str._ak_C_s_ZS_B]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x20], al
and ecx, 0x800000ff
jns 0x1000fb6d
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xd
jl 0x1000fb50
mov byte [ebp - 0x13], 0
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x28], eax
push dword [ebp - 0x28]
mov eax, dword [0x10127b88]
call eax
add esp, 4
cmp byte [0x101279aa], 0
mov dword [ebp - 0x1c], 0x776f6853
mov dword [ebp - 0x18], 0x20445548
je 0x1000fbca
mov word [ebp - 0x14], 0x30
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x28], eax
push dword [ebp - 0x28]
mov eax, dword [0x10127b88]
call eax
add esp, 4
jmp 0x1000fbea
mov word [ebp - 0x14], 0x31
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x28], eax
push dword [ebp - 0x28]
mov eax, dword [0x10127b88]
call eax
add esp, 4
cmp byte [0x101279b2], 0
mov dword [ebp - 0x1c], 0x6172542b
mov dword [ebp - 0x18], 0x73726563
mov byte [ebp - 0x12], 0
je 0x1000fc27
mov word [ebp - 0x14], 0x3120
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 0x12
mov dword [ebp - 0x28], eax
push dword [ebp - 0x28]
mov eax, dword [0x10127b88]
call eax
add esp, 4
jmp 0x1000fc47
mov word [ebp - 0x14], 0x3020
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 0x13
mov dword [ebp - 0x28], eax
push dword [ebp - 0x28]
mov eax, dword [0x10127b88]
call eax
add esp, 4
cmp byte [0x101279b3], 0
movss xmm0, dword [0x10068484]
mov eax, dword [0x10127af0]
je 0x1000fc65
mov dword [eax], 0x3f800000
jmp 0x1000fc6b
mov dword [eax], 0
cmp byte [0x101279ac], 0
jne 0x1000fc77
xorps xmm0, xmm0
xor edx, edx
movss dword [0x38391d84], xmm0
cmp byte [0x101279b6], dl
je 0x1000fcd3
mov ecx, 0xe
nop
mov al, byte [edx + str.JqfEfyrCj]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x20], al
and ecx, 0x800000ff
jns 0x1000fcad
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xf
jl 0x1000fc90
mov byte [ebp - 0x11], 0
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 0x14
mov dword [ebp - 0x28], eax
push dword [ebp - 0x28]
mov eax, dword [0x10127b88]
call eax
add esp, 4
jmp 0x1000fd21
mov ecx, 8
nop dword [eax + eax]
mov al, byte [edx + str.Lk_bctE_vq5]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x20], al
and ecx, 0x800000ff
jns 0x1000fcfd
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xf
jl 0x1000fce0
mov byte [ebp - 0x11], 0
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 0x15
mov dword [ebp - 0x28], eax
push dword [ebp - 0x28]
mov eax, dword [0x10127b88]
call eax
add esp, 4
xor edx, edx
cmp byte [0x101279b1], dl
je 0x1000fd73
mov ecx, 0x14
mov al, byte [edx + str.Pgw_Jt]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x24], al
and ecx, 0x800000ff
jns 0x1000fd4d
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x12
jl 0x1000fd30
mov byte [ebp - 0x12], 0
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 0x16
mov dword [ebp - 0x28], eax
push dword [ebp - 0x28]
mov eax, dword [0x10127b88]
call eax
add esp, 4
jmp 0x1000fdc1
mov ecx, 0x4b
nop dword [eax + eax]
mov al, byte [edx + 0x10060c08]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x24], al
and ecx, 0x800000ff
jns 0x1000fd9d
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x12
jl 0x1000fd80
mov byte [ebp - 0x12], 0
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 0x17
mov dword [ebp - 0x28], eax
push dword [ebp - 0x28]
mov eax, dword [0x10127b88]
call eax
add esp, 4
cmp byte [0x101279a3], 0
lea eax, [ebp - 0x28]
mov esi, dword [0x10127b3c]
mov ebx, 0x850f
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push 2
push esi
je 0x1000fdeb
call edi
mov word [esi], bx
jmp 0x1000fdf5
call edi
mov eax, 0x840f
mov word [esi], ax
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
push 2
push esi
call edi
cmp byte [0x101279a9], 0
lea eax, [ebp - 0x28]
mov esi, dword [0x100b258c]
push eax
push 0x40
push 2
push esi
je 0x1000fe20
call edi
mov word [esi], bx
jmp 0x1000fe2a
call edi
mov eax, 0x840f
mov word [esi], ax
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
push 2
push esi
call edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1005cb94
mov esp, ebp
pop ebp
ret