Function at 0x10035470
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x100ab3c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov bl, byte [0x100b9dc7]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
cmp bl, byte [0x100b9dfc]
je 0x10035507
mov eax, 0x100a5ed0
mov dword [0x100b9df0], 0x100a5ec4
test bl, bl
mov edx, 0x100a5edc
push str.xxxxxxxx
cmove edx, eax
mov dword [0x100b9e00], edx
call fcn.10035390
mov edi, eax
add esp, 4
mov dword [0x100b9df4], edi
test edi, edi
je 0x10035507
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push edi
call esi
test bl, bl
mov word [edi + 1], 0x8a36
mov ecx, 0xeb
mov byte [edi + 3], 0x48
mov eax, 0x74
cmovne eax, ecx
mov byte [edi], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 4
push edi
call esi
mov byte [0x100b9dfc], bl
mov bl, byte [0x100b9dfa]
cmp bl, byte [0x100b9dfd]
je 0x1003557c
mov eax, 0x100a5ef0
mov dword [0x100b9df0], 0x100a5ee8
test bl, bl
mov edx, 0x100a5ef8
push str.xxxxxxx
cmove edx, eax
mov dword [0x100b9e00], edx
call fcn.10035390
mov edi, eax
add esp, 4
mov dword [0x100b9df4], edi
test edi, edi
je 0x1003557c
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push edi
call esi
test bl, bl
mov dword [edi], 0x20000068
setne al
dec al
and al, 0x41
mov byte [edi + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 5
push edi
call esi
mov byte [0x100b9dfd], bl
mov bl, byte [0x100b9de6]
cmp bl, byte [0x100b9de2]
je 0x100355fa
mov eax, 0x100a5f08
mov dword [0x100b9df0], 0x100a5f00
test bl, bl
mov edx, 0x100a5f10
push str.xxxxxx
cmove edx, eax
mov dword [0x100b9e00], edx
call fcn.10035390
mov edi, eax
add esp, 4
mov dword [0x100b9df4], edi
test edi, edi
je 0x100355fa
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push edi
call esi
test bl, bl
mov word [edi], 0x3966
mov ecx, 0xef
mov byte [edi + 2], 0x4b
mov eax, 0x10
cmovne eax, ecx
mov byte [edi + 3], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 4
push edi
call esi
mov byte [0x100b9de2], bl
mov bl, byte [0x100b9df8]
cmp bl, byte [0x100b9de3]
je 0x1003567b
mov eax, 0x100a5f20
mov dword [0x100b9df0], 0x100a5ee8
test bl, bl
mov edx, 0x100a5f18
push str.xxxxxxx
cmove edx, eax
mov dword [0x100b9e00], edx
call fcn.10035390
mov edi, eax
add esp, 4
mov dword [0x100b9df4], edi
test edi, edi
je 0x1003567b
lea eax, [ebp - 8]
push eax
push 0x40
push 7
push edi
call esi
test bl, bl
mov dword [edi + 1], 0x246c8b21
mov ecx, 0xeb
mov word [edi + 5], 0x5534
mov eax, 0x74
cmovne eax, ecx
mov byte [edi], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 7
push edi
call esi
mov byte [0x100b9de3], bl
mov bl, byte [0x100b9dc5]
cmp bl, byte [0x100b9dfb]
je 0x100356fa
mov eax, 0x100a5f30
mov dword [0x100b9df0], 0x100a5f00
test bl, bl
mov edx, 0x100a5f28
push str.xxxxxx
cmove edx, eax
mov dword [0x100b9e00], edx
call fcn.10035390
mov edi, eax
add esp, 4
mov dword [0x100b9df4], edi
test edi, edi
je 0x100356fa
lea eax, [ebp - 8]
push eax
push 0x40
push 6
push edi
call esi
test bl, bl
mov dword [edi + 1], 0x204e8b09
mov ecx, 0xeb
mov byte [edi + 5], 0x89
mov eax, 0x75
cmovne eax, ecx
mov byte [edi], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 6
push edi
call esi
mov byte [0x100b9dfb], bl
mov bl, byte [0x100b9de5]
cmp bl, byte [0x100b9de7]
je 0x10035772
mov eax, 0x100a5f38
mov dword [0x100b9df0], 0x100a5ee8
test bl, bl
mov edx, 0x100a5f48
push str.xxxxxxx
cmove edx, eax
mov dword [0x100b9e00], edx
call fcn.10035390
mov edi, eax
add esp, 4
mov dword [0x100b9df4], edi
test edi, edi
je 0x10035772
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push edi
call esi
test bl, bl
mov word [edi], 0
mov byte [edi + 2], 0
setne al
dec al
and al, 0x42
mov byte [edi + 3], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 4
push edi
call esi
mov byte [0x100b9de7], bl
mov bl, byte [0x100b9de1]
cmp bl, byte [0x100b9de4]
je 0x100357e8
mov eax, 0x100a5f60
mov dword [0x100b9df0], 0x100a5f68
test bl, bl
mov edx, 0x100a5f58
push str.xxxx
cmove edx, eax
mov dword [0x100b9e00], edx
call fcn.10035390
mov edi, eax
add esp, 4
mov dword [0x100b9df4], edi
test edi, edi
je 0x100357e8
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push edi
call esi
test bl, bl
mov word [edi + 1], 0x8352
mov byte [edi + 3], 0xce
sete al
inc al
mov byte [edi], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 4
push edi
call esi
mov byte [0x100b9de4], bl
mov bl, byte [0x100b9dc6]
cmp bl, byte [0x100b9de0]
je 0x10035860
mov eax, 0x100a5f84
mov dword [0x100b9df0], 0x100a5f70
test bl, bl
mov edx, 0x100a5f98
push str.xxxxxxxxxxxxxxxx
cmove edx, eax
mov dword [0x100b9e00], edx
call fcn.10035390
mov edi, eax
add esp, 4
mov dword [0x100b9df4], edi
test edi, edi
je 0x10035860
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push edi
call esi
test bl, bl
mov word [edi], 0
mov byte [edi + 3], 0x40
setne al
dec al
and al, 0xa0
mov byte [edi + 2], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 4
push edi
call esi
mov byte [0x100b9de0], bl
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1008f042
mov esp, ebp
pop ebp
ret