Function at 0x1101b370
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [0x110c6754]
sub esp, 0x48
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 0x280
jle 0x1101b8cd
mov ecx, dword [0x110c0ac0]
cmp ecx, 0x280
jle 0x1101b8cd
cmp eax, ecx
push 0x6400
cmovg eax, ecx
mov dword [0x110c6754], eax
add eax, 0xfffffe27
mov dword [0x110c6748], eax
call fcn.1107e661
add esp, 4
mov dword [0x110c0ac4], eax
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x45d951
call edi
mov eax, 0x1101b050
sub eax, 0x45d955
mov dword [0x45d951], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x45d951
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x45e35d
call edi
mov eax, 0x1101b070
sub eax, 0x45e361
mov dword [0x45e35d], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x45e35d
call edi
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x45ee43
lea ecx, [esp + 8]
mov dword [esp + 0xc], 0x45eedf
push eax
push ecx
mov ecx, 0x1101b090
mov dword [esp + 0x18], 0x45ef2d
call fcn.1100fcf0
lea eax, [esp + 0x40]
mov dword [esp + 0x18], 0x45da0e
lea ecx, [esp + 0x18]
mov dword [esp + 0x1c], 0x45daed
push eax
push ecx
mov ecx, 0x1101b0f0
mov dword [esp + 0x28], 0x45dc0d
mov dword [esp + 0x2c], 0x45dd44
mov dword [esp + 0x30], 0x45de33
mov dword [esp + 0x34], 0x45df22
mov dword [esp + 0x38], 0x45e0b5
mov dword [esp + 0x3c], 0x45e1ef
mov dword [esp + 0x40], 0x460883
mov dword [esp + 0x44], 0x4609e3
call fcn.1100fcf0
lea eax, [esp + 0x18]
mov dword [esp + 8], 0x45fa2a
lea ecx, [esp + 8]
mov dword [esp + 0xc], 0x45fa7b
push eax
push ecx
mov ecx, 0x1101b0b0
mov dword [esp + 0x18], 0x45fb87
mov dword [esp + 0x1c], 0x45fbd1
call fcn.1100fcf0
lea eax, [esp + 0x10]
mov dword [esp + 8], 0x45fc72
lea ecx, [esp + 8]
mov dword [esp + 0xc], 0x45fd06
push eax
push ecx
mov ecx, 0x1101b0d0
call fcn.1100fcf0
lea eax, [esp + 8]
push eax
push 0x40
push 5
push 0x43166f
call edi
mov eax, 0x1101b100
mov byte [0x43166f], 0xe8
sub eax, 0x431674
mov dword [0x431670], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 5
push 0x43166f
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x431705
call edi
mov eax, 0x1101b110
sub eax, 0x431709
mov dword [0x431705], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x431705
call edi
mov esi, dword [0x110c6748]
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x43172a
call edi
lea eax, [esp + 8]
mov dword [0x43172a], esi
push eax
push dword [esp + 0xc]
push 4
push 0x43172a
call edi
mov esi, dword [0x110c6748]
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x431770
call edi
lea eax, [esp + 8]
mov dword [0x431770], esi
push eax
push dword [esp + 0xc]
push 4
push 0x431770
call edi
lea eax, [esp + 0x10]
mov dword [esp + 8], 0x4317ee
lea ecx, [esp + 8]
mov dword [esp + 0xc], 0x431841
push eax
push ecx
mov ecx, 0x1101b190
call fcn.1100fcf0
lea eax, [esp + 8]
push eax
push 0x40
push 1
push 0x4317c1
call edi
lea eax, [esp + 8]
mov byte [0x4317c1], 0xeb
push eax
push dword [esp + 0xc]
push 1
push 0x4317c1
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 1
push 0x431814
call edi
lea eax, [esp + 8]
mov byte [0x431814], 0xeb
push eax
push dword [esp + 0xc]
push 1
push 0x431814
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 5
push 0x431b19
call edi
mov eax, 0x1101b180
mov byte [0x431b19], 0xe8
sub eax, 0x431b1e
mov dword [0x431b1a], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 5
push 0x431b19
call edi
mov esi, dword [0x110c6748]
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x431ab9
call edi
lea eax, [esp + 8]
mov dword [0x431ab9], esi
push eax
push dword [esp + 0xc]
push 4
push 0x431ab9
call edi
mov esi, dword [0x110c6748]
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x431ac0
call edi
lea eax, [esp + 8]
mov dword [0x431ac0], esi
push eax
push dword [esp + 0xc]
push 4
push 0x431ac0
call edi
mov esi, dword [0x110c6748]
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x431b3b
call edi
lea eax, [esp + 8]
mov dword [0x431b3b], esi
push eax
push dword [esp + 0xc]
push 4
push 0x431b3b
call edi
mov esi, dword [0x110c0ac4]
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x431b36
call edi
lea eax, [esp + 8]
mov dword [0x431b36], esi
push eax
push dword [esp + 0xc]
push 4
push 0x431b36
call edi
push 4
push 0x1101b1b0
mov edx, 0x460bf3
mov cl, 0xe8
call fcn.1100fb30
lea eax, [esp + 8]
push eax
push 0x40
push 2
push 0x460c02
call edi
mov eax, 0x9090
mov word [0x460c02], ax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 2
push 0x460c02
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 1
push 0x460c04
call edi
lea eax, [esp + 8]
mov byte [0x460c04], 0x90
push eax
push dword [esp + 0xc]
push 1
push 0x460c04
call edi
lea eax, [esp + 0x50]
mov dword [esp + 0x18], 0x460cc4
lea ecx, [esp + 0x18]
mov dword [esp + 0x1c], 0x460cf8
push eax
push ecx
mov ecx, 0x1101b1d0
mov dword [esp + 0x28], 0x460d2c
mov dword [esp + 0x2c], 0x460d75
mov dword [esp + 0x30], 0x460ea1
mov dword [esp + 0x34], 0x460ef1
mov dword [esp + 0x38], 0x460f47
mov dword [esp + 0x3c], 0x460fa0
mov dword [esp + 0x40], 0x460fdd
mov dword [esp + 0x44], 0x461010
mov dword [esp + 0x48], 0x461060
mov dword [esp + 0x4c], 0x461085
mov dword [esp + 0x50], 0x4610ab
mov dword [esp + 0x54], 0x4610ec
call fcn.1100fcf0
cmp dword [0x110c6750], 0
jne 0x1101b8d7
lea eax, [esp + 8]
push eax
push 0x40
push 5
push 0x460aa6
call edi
mov eax, 0x1101b1e0
mov byte [0x460aa6], 0xe8
sub eax, 0x460aab
mov dword [0x460aa7], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 5
push 0x460aa6
call edi
mov ecx, dword [0x110c6754]
lea eax, [esp + 0x14]
push eax
lea edx, [esp + 0xc]
mov dword [esp + 0xc], 0x460ac8
mov dword [esp + 0x10], 0x460ad8
mov dword [esp + 0x14], 0x460ae3
call fcn.1100f980
imul esi, dword [0x110c6754], 0x1a
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x460ab4
call edi
lea eax, [esp + 8]
mov dword [0x460ab4], esi
push eax
push dword [esp + 0xc]
push 4
push 0x460ab4
call edi
jmp 0x1101b8d7
mov dword [0x110c6754], 0x280
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x45d8bd
call edi
mov eax, 0x1101acf0
sub eax, 0x45d8c1
mov dword [0x45d8bd], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x45d8bd
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x461600
call edi
mov eax, 0x1101ada0
sub eax, 0x461604
mov dword [0x461600], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x461600
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x4ac261
call edi
mov eax, 0x1101adc0
sub eax, 0x4ac265
mov dword [0x4ac261], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x4ac261
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x45ea49
call edi
mov eax, 0x1101ad40
sub eax, 0x45ea4d
mov dword [0x45ea49], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x45ea49
call edi
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x45e3f5
lea ecx, [esp + 8]
mov dword [esp + 0xc], 0x45e8fb
push eax
push ecx
mov ecx, 0x1101ad90
mov dword [esp + 0x18], 0x45e9fd
call fcn.1100fcf0
mov eax, dword [0x110c6750]
test eax, eax
je 0x1101ba12
js 0x1101b9d7
cmp eax, 3
jle 0x1101b9e1
mov dword [0x110c6750], 1
lea eax, [esp + 8]
push eax
push 0x40
push 4
push 0x45f955
call edi
mov eax, 0x1101b350
sub eax, 0x45f959
mov dword [0x45f955], eax
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push 4
push 0x45f955
call edi
cmp dword [0x110c675c], 0
jle 0x1101bb15
lea eax, [esp + 8]
push eax
push 0x40
push 1
push 0x481cdf
call edi
lea eax, [esp + 8]
mov byte [0x481cdf], 1
push eax
push dword [esp + 0xc]
push 1
push 0x481cdf
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 1
push 0x481e2e
call edi
lea eax, [esp + 8]
mov byte [0x481e2e], 1
push eax
push dword [esp + 0xc]
push 1
push 0x481e2e
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 1
push 0x481dc3
call edi
lea eax, [esp + 8]
mov byte [0x481dc3], 0xff
push eax
push dword [esp + 0xc]
push 1
push 0x481dc3
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 1
push 0x482bf5
call edi
lea eax, [esp + 8]
mov byte [0x482bf5], 0xff
push eax
push dword [esp + 0xc]
push 1
push 0x482bf5
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 1
push 0x4827a9
call edi
lea eax, [esp + 8]
mov byte [0x4827a9], 0xff
push eax
push dword [esp + 0xc]
push 1
push 0x4827a9
call edi
lea eax, [esp + 8]
push eax
push 0x40
push 1
push 0x48284f
call edi
lea eax, [esp + 8]
mov byte [0x48284f], 0
push eax
push dword [esp + 0xc]
push 1
push 0x48284f
call edi
sub esp, 0x28
mov ecx, 0x110e5154
mov eax, esp
mov dword [eax], 0x110b43a8
mov dword [eax + 0x24], eax
lea eax, [esp + 0x30]
push eax
call fcn.110053e0
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x1101bb6c
push dword [esp + 8]
mov edx, dword [esp + 0x10]
push ecx
call fcn.11008d10
mov edx, dword [esp + 0x10]
mov eax, 0x66666667
mov ecx, dword [esp + 8]
sub edx, ecx
imul edx
push 0x28
mov eax, edx
sar eax, 4
mov edx, eax
shr edx, 0x1f
add edx, eax
call fcn.11004ac0
pop edi
pop esi
mov esp, ebp
pop ebp
ret