Function at 0x10009560
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
mov eax, dword [0x10016018]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
xor ebx, ebx
push esi
push edi
cmp dword [0x1001afdc], ebx
je 0x100096c5
cmp dword [0x1001a850], ebx
je 0x100096c5
mov eax, dword [0x1001aeb0]
mov esi, dword [eax + 0x12c]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [esp + 0x18]
push ecx
push 0x40
push 5
push esi
call edi
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x28]
push eax
push ecx
mov edx, 0x100094e0
sub edx, esi
push 5
sub edx, 5
push esi
mov byte [esi], 0xe9
mov dword [esi + 1], edx
call edi
mov ecx, dword [0x1001aeb0]
mov esi, dword [ecx + 8]
mov edx, dword [ecx + 0x34]
mov esi, dword [esi]
mov edx, dword [esi + edx]
mov al, bl
not al
and al, 1
and edx, 0x80000001
jns 0x100095f1
dec edx
or edx, 0xfffffffe
inc edx
sete dl
cmp al, dl
je 0x100096b9
push 0
call fcn.10008660
lea ecx, [esp + 0x10]
add esp, 4
push ecx
mov ecx, 5
mov edx, eax
call fcn.10004c00
fld dword [esp + 0x10]
mov edx, dword [esp + 0x10]
fstp dword [0x1001b120]
fld dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
sub esp, 8
fstp dword [0x1001b124]
fld dword [esp + 0x20]
mov eax, esp
mov dword [eax], edx
fstp dword [0x1001b128]
mov edx, dword [esp + 0x20]
mov dword [eax + 4], ecx
lea edi, [esp + 0x28]
mov dword [eax + 8], edx
call fcn.10004a80
add esp, 0xc
test al, al
je 0x100096a9
fld dword [esp + 0x20]
call fcn.1000f8c0
fld dword [esp + 0x1c]
mov esi, eax
call fcn.1000f8c0
push 0xffffffffffffffff
push 0x10
lea edx, [esp + 0x34]
push edx
mov dword [esp + 0x38], eax
add eax, 0x1f4
push 0xffffffffffffffff
mov dword [esp + 0x44], eax
mov eax, dword [0x1001aea8]
mov ecx, dword [eax]
push str.Target
push 0
mov dword [esp + 0x48], esi
add esi, 0x14
push eax
mov eax, dword [ecx + 0x38]
mov dword [esp + 0x54], esi
call eax
mov ecx, dword [0x1001aeb0]
mov dword [0x1001b138], 1
inc ebx
cmp ebx, 0xf
jle 0x100095d3
jmp 0x100096d1
mov ecx, dword [0x1001aeb0]
mov dword [0x1001b138], ebx
cmp dword [0x1001afe0], 0
je 0x1000985c
cmp dword [0x10017ef8], 0
je 0x1000985c
mov esi, dword [ecx + 0x130]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [esp + 0x18]
push ecx
push 0x40
push 5
push esi
call edi
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x28]
push eax
push ecx
mov edx, 0x10009520
sub edx, esi
push 5
sub edx, 5
push esi
mov byte [esi], 0xe9
mov dword [esi + 1], edx
call edi
mov ecx, dword [0x1001aeb0]
xor ebx, ebx
lea ebx, [ebx]
mov esi, dword [ecx + 8]
mov edx, dword [ecx + 0x34]
mov esi, dword [esi]
mov edx, dword [esi + edx]
mov al, bl
not al
and al, 1
and edx, 0x80000001
jns 0x1000974e
dec edx
or edx, 0xfffffffe
inc edx
sete dl
cmp al, dl
je 0x10009840
mov eax, dword [ecx + 0x54]
mov edx, dword [ecx + 0xc]
imul eax, ebx
mov edx, dword [edx]
mov eax, dword [eax + edx + 0x14]
test eax, eax
je 0x10009783
fld dword [0x10013f68]
fcomp dword [eax + 0x17c]
fnstsw ax
test ah, 0x41
jne 0x10009840
push 5
call fcn.10008660
lea ecx, [esp + 0x10]
add esp, 4
push ecx
mov ecx, 5
mov edx, eax
call fcn.10004c00
fld dword [esp + 0x10]
mov edx, dword [esp + 0x10]
fstp dword [0x1001b12c]
fld dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
sub esp, 8
fstp dword [0x1001b130]
fld dword [esp + 0x20]
mov eax, esp
mov dword [eax], edx
fstp dword [0x1001b134]
mov edx, dword [esp + 0x20]
mov dword [eax + 4], ecx
lea edi, [esp + 0x28]
mov dword [eax + 8], edx
call fcn.10004a80
add esp, 0xc
test al, al
je 0x10009830
fld dword [esp + 0x20]
call fcn.1000f8c0
fld dword [esp + 0x1c]
mov esi, eax
call fcn.1000f8c0
push 0xffffffffffffffff
push 0x10
lea edx, [esp + 0x34]
push edx
mov dword [esp + 0x38], eax
add eax, 0x1f4
push 0xffffffffffffffff
mov dword [esp + 0x44], eax
mov eax, dword [0x1001aea8]
mov ecx, dword [eax]
push str.Target
push 0
mov dword [esp + 0x48], esi
add esi, 0x14
push eax
mov eax, dword [ecx + 0x38]
mov dword [esp + 0x54], esi
call eax
mov ecx, dword [0x1001aeb0]
mov dword [0x1001b13c], 1
inc ebx
cmp ebx, 0xf
jle 0x10009730
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.1000eefe
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
xor ecx, esp
mov dword [0x1001b13c], 0
call fcn.1000eefe
mov esp, ebp
pop ebp
ret