Function at 0x1104b7d0
Capabilities:
Allocate or change rwx memory
Check if file exists
Execute shellcode via indirect call
Get file attributes

Disassembly:
push ecx
push esi
push 0x10
mov byte [0x110d71ec], 1
call fcn.1107e2d6
xor ecx, ecx
push 0x10
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [0x110d71c4], eax
call fcn.1107e2d6
xor ecx, ecx
mov dword [0x110d71bc], eax
push 0x40
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
call fcn.1107e661
mov ecx, dword [0x110d71c4]
push 0x40
mov dword [ecx], eax
call fcn.1107e661
mov ecx, dword [0x110d71bc]
push 0x10
mov dword [ecx], eax
call fcn.1107e2d6
xor ecx, ecx
push 0x10
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [0x110d71c8], eax
call fcn.1107e2d6
xor ecx, ecx
mov dword [0x110d71c0], eax
push 0x40
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
call fcn.1107e661
mov ecx, dword [0x110d71c8]
push 0x40
mov dword [ecx], eax
call fcn.1107e661
mov ecx, dword [0x110d71c0]
add esp, 0x20
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push str.AppearancehmR01S00
mov dword [ecx], eax
call esi
cmp eax, 0xffffffff
jne 0x1104b8b2
push str.AppearancehfR01S00
call esi
cmp eax, 0xffffffff
jne 0x1104b8b2
push str.AppearancehmR01S00.dat
call esi
cmp eax, 0xffffffff
jne 0x1104b8b2
push str.AppearancehfR01S00.dat
call esi
cmp eax, 0xffffffff
je 0x1104b8b9
mov byte [0x110d71b3], 1
push str.AppearancehmR00S01
call esi
cmp eax, 0xffffffff
jne 0x1104b8e9
push str.AppearancehfR00S01
call esi
cmp eax, 0xffffffff
jne 0x1104b8e9
push str.AppearancehmR00S01.dat
call esi
cmp eax, 0xffffffff
jne 0x1104b8e9
push str.AppearancehfR00S01.dat
call esi
cmp eax, 0xffffffff
je 0x1104b8f0
mov byte [0x110d71b2], 1
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x431e9e
call esi
mov eax, 0x1104ab20
sub eax, 0x431ea2
mov dword [0x431e9e], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x431e9e
call esi
push 1
push 0x1104b5f0
mov edx, 0x4329d8
mov cl, 0xe8
call fcn.1100fb30
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x4322e9
call esi
mov eax, 0x1104ac00
sub eax, 0x4322ed
mov dword [0x4322e9], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x4322e9
call esi
push 1
push 0x11049400
mov edx, 0x4deee5
mov cl, 0xe8
call fcn.1100fb30
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x419560
call esi
mov eax, 0x11049420
mov byte [0x419560], 0xe8
sub eax, 0x419565
mov dword [0x419561], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x419560
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x4196b1
call esi
mov eax, 0x11049510
sub eax, 0x4196b5
mov dword [0x4196b1], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x4196b1
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x418ca3
call esi
mov eax, 0x110495d0
sub eax, 0x418ca7
mov dword [0x418ca3], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x418ca3
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x418b39
call esi
mov eax, 0x11049530
mov byte [0x418b39], 0xe8
sub eax, 0x418b3e
mov dword [0x418b3a], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x418b39
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x49f9da
call esi
mov eax, 0x11049460
mov byte [0x49f9da], 0xe8
sub eax, 0x49f9df
mov dword [0x49f9db], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x49f9da
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x519400
call esi
lea eax, [esp + 4]
mov dword [0x519400], 0x110494f0
push eax
push dword [esp + 8]
push 4
push 0x519400
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x43a788
call esi
mov eax, 0x1104ac30
mov byte [0x43a788], 0xe8
sub eax, 0x43a78d
mov dword [0x43a789], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x43a788
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x432b92
call esi
mov eax, 0x1104af30
mov byte [0x432b92], 0xe8
sub eax, 0x432b97
mov dword [0x432b93], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x432b92
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x433372
call esi
lea eax, [esp + 4]
mov dword [0x433372], 0x2484a
push eax
push dword [esp + 8]
push 4
push 0x433372
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x4362be
call esi
lea eax, [esp + 4]
mov dword [0x4362be], 0x2484a
push eax
push dword [esp + 8]
push 4
push 0x4362be
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x4362f2
call esi
lea eax, [esp + 4]
mov dword [0x4362f2], 0x22e
push eax
push dword [esp + 8]
push 4
push 0x4362f2
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x43631e
call esi
lea eax, [esp + 4]
mov dword [0x43631e], 0x22e
push eax
push dword [esp + 8]
push 4
push 0x43631e
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x436262
call esi
lea eax, [esp + 4]
mov dword [0x436262], 0x24834
push eax
push dword [esp + 8]
push 4
push 0x436262
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x43628a
call esi
lea eax, [esp + 4]
mov dword [0x43628a], 0x22e
push eax
push dword [esp + 8]
push 4
push 0x43628a
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x43b5b2
call esi
lea eax, [esp + 4]
mov dword [0x43b5b2], 0x22e
push eax
push dword [esp + 8]
push 4
push 0x43b5b2
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x433678
call esi
lea eax, [esp + 4]
mov dword [0x433678], 0x1a7
push eax
push dword [esp + 8]
push 4
push 0x433678
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x4363ce
call esi
lea eax, [esp + 4]
mov dword [0x4363ce], 0x1c0
push eax
push dword [esp + 8]
push 4
push 0x4363ce
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x43641c
call esi
lea eax, [esp + 4]
mov dword [0x43641c], 0x247
push eax
push dword [esp + 8]
push 4
push 0x43641c
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x43a74c
call esi
lea eax, [esp + 4]
mov dword [0x43a74c], 0x9d
push eax
push dword [esp + 8]
push 4
push 0x43a74c
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x43a75b
call esi
lea eax, [esp + 4]
mov dword [0x43a75b], 0x1be
push eax
push dword [esp + 8]
push 4
push 0x43a75b
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x436220
call esi
lea eax, [esp + 4]
mov dword [0x436220], 0xe40
push eax
push dword [esp + 8]
push 4
push 0x436220
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x43a71e
call esi
lea eax, [esp + 4]
mov dword [0x43a71e], 0x9b
push eax
push dword [esp + 8]
push 4
push 0x43a71e
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x43a72a
call esi
lea eax, [esp + 4]
mov dword [0x43a72a], 0x1bc
push eax
push dword [esp + 8]
push 4
push 0x43a72a
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x4361c4
call esi
lea eax, [esp + 4]
mov dword [0x4361c4], 0x1be
push eax
push dword [esp + 8]
push 4
push 0x4361c4
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x4361d9
call esi
lea eax, [esp + 4]
mov dword [0x4361d9], 0xc2
push eax
push dword [esp + 8]
push 4
push 0x4361d9
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x4361de
call esi
lea eax, [esp + 4]
mov dword [0x4361de], 0x1be
push eax
push dword [esp + 8]
push 4
push 0x4361de
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x43647c
call esi
mov dword [0x43647c], 0x253
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x43647c
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x4364fa
call esi
lea eax, [esp + 4]
mov dword [0x4364fa], 0x269
push eax
push dword [esp + 8]
push 4
push 0x4364fa
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x436567
call esi
lea eax, [esp + 4]
mov dword [0x436567], 0x269
push eax
push dword [esp + 8]
push 4
push 0x436567
call esi
push 2
push 0x1104b600
mov edx, 0x4510eb
mov cl, 0xe8
call fcn.1100fb30
lea eax, [esp + 4]
push eax
push 0x40
push 1
push 0x42df5e
call esi
lea eax, [esp + 4]
mov byte [0x42df5e], 0xf1
push eax
push dword [esp + 8]
push 1
push 0x42df5e
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x42df60
call esi
mov eax, 0x1104b6b0
sub eax, 0x42df64
mov dword [0x42df60], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x42df60
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 1
push 0x42e162
call esi
lea eax, [esp + 4]
mov byte [0x42e162], 0xf1
push eax
push dword [esp + 8]
push 1
push 0x42e162
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x42e164
call esi
mov eax, 0x1104b780
sub eax, 0x42e168
mov dword [0x42e164], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x42e164
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 5
push 0x4a7405
call esi
mov eax, 0x11049920
mov byte [0x4a7405], 0xe8
sub eax, 0x4a740a
mov dword [0x4a7406], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push 0x4a7405
call esi
lea eax, [esp + 4]
push eax
push 0x40
push 4
push 0x42613b
call esi
mov eax, 0x1104b620
sub eax, 0x42613f
mov dword [0x42613b], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push 0x42613b
call esi
pop esi
pop ecx
ret