Function at 0x1000d5a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10048434]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [0x1008e038]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1008eb30]
cmp eax, dword [ecx + 4]
jle 0x1000d603
push 0x1008eb30
call fcn.100141c2
add esp, 4
cmp dword [0x1008eb30], 0xffffffff
jne 0x1000d603
push 0x10034b30
mov dword [0x1008eb34], 0x10041c34
call fcn.1001459d
push 0x1008eb30
call fcn.10014178
add esp, 8
push ebx
push esi
push edi
push 0x10036e62
push 0xa
mov dword [ebp - 8], 0
call fcn.100145b2
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, eax
mov ebx, dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
add esp, 8
test esi, esi
je 0x1000d69b
lea eax, [ebp - 8]
mov byte [esi], 0xe9
push eax
push 0x40
mov ecx, 0x1000d960
sub ecx, 0x547cc1
mov dword [esi + 1], ecx
push 0xa
mov dword [esi + 5], 0x90909090
push 0x547cbc
mov byte [esi + 9], 0x90
call edi
test eax, eax
je 0x1000d69b
movq xmm0, qword [esi]
mov ecx, 0x547cbc
movq qword [ecx], xmm0
mov ax, word [esi + 8]
mov word [ecx + 8], ax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 0xa
push ecx
call edi
test eax, eax
je 0x1000d69b
push 0xa
push 0x547cbc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
push esi
call fcn.10014029
add esp, 4
push 0x10036e62
push 6
mov dword [ebp - 8], 0
call fcn.100145b2
mov esi, eax
add esp, 8
test esi, esi
je 0x1000d719
lea eax, [ebp - 8]
mov byte [esi], 0xe9
push eax
push 0x40
mov ecx, 0x1000d990
sub ecx, 0x547f04
push 6
mov dword [esi + 1], ecx
push 0x547eff
mov byte [esi + 5], 0x90
call edi
test eax, eax
je 0x1000d719
mov eax, dword [esi]
mov ecx, 0x547eff
mov dword [ecx], eax
mov ax, word [esi + 4]
mov word [ecx + 4], ax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 6
push ecx
call edi
test eax, eax
je 0x1000d719
push 6
push 0x547eff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
push esi
call fcn.10014029
add esp, 4
push 0x10036e62
push 6
mov dword [ebp - 8], 0
call fcn.100145b2
mov esi, eax
add esp, 8
test esi, esi
je 0x1000d797
lea eax, [ebp - 8]
mov byte [esi], 0xe9
push eax
push 0x40
mov ecx, 0x1000da40
sub ecx, 0x547f85
push 6
mov dword [esi + 1], ecx
push 0x547f80
mov byte [esi + 5], 0x90
call edi
test eax, eax
je 0x1000d797
mov eax, dword [esi]
mov ecx, 0x547f80
mov dword [ecx], eax
mov ax, word [esi + 4]
mov word [ecx + 4], ax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 6
push ecx
call edi
test eax, eax
je 0x1000d797
push 6
push 0x547f80
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
push esi
call fcn.10014029
add esp, 4
push 0x10036e62
push 7
mov dword [ebp - 8], 0
call fcn.100145b2
mov esi, eax
add esp, 8
test esi, esi
je 0x1000d820
mov ecx, 0x1000dac0
mov byte [esi], 0xe9
sub ecx, 0x547fb8
mov eax, 0x90909090
mov dword [esi + 1], ecx
mov word [esi + 5], ax
lea eax, [ebp - 8]
push eax
push 0x40
push 7
push 0x547fb3
call edi
test eax, eax
je 0x1000d820
mov eax, dword [esi]
mov ecx, 0x547fb3
mov dword [ecx], eax
mov ax, word [esi + 4]
mov word [ecx + 4], ax
mov al, byte [esi + 6]
mov byte [ecx + 6], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 7
push ecx
call edi
test eax, eax
je 0x1000d820
push 7
push 0x547fb3
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
push esi
call fcn.10014029
add esp, 4
push 0x10036e62
push 5
mov dword [ebp - 8], 0
call fcn.100145b2
mov esi, eax
add esp, 8
test esi, esi
je 0x1000d898
lea eax, [ebp - 8]
mov byte [esi], 0xe9
push eax
push 0x40
mov ecx, 0x1000dae0
push 5
sub ecx, 0x47db84
push 0x47db7f
mov dword [esi + 1], ecx
call edi
test eax, eax
je 0x1000d898
mov eax, dword [esi]
mov ecx, 0x47db7f
mov dword [ecx], eax
mov al, byte [esi + 4]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 5
push ecx
call edi
test eax, eax
je 0x1000d898
push 5
push 0x47db7f
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
push esi
call fcn.10014029
add esp, 4
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001401b
mov esp, ebp
pop ebp
ret