Function at 0x10118e38
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0
call fcn.100170d4
push 0x101a6ad8
mov ebx, dword [ebp + 0x10]
push dword [ebx]
call fcn.10002738
add esp, 8
cmp eax, 0
je 0x10118f56
push 0x80000301
push 0
push 1
push OleUIBusyA
push 0
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebx]
test eax, eax
jne 0x10118eac
mov eax, 0x101a6ad8
push eax
push 2
mov ebx, 0x138
call fcn.101590b0
add esp, 0x1c
mov dword [ebp - 0x1c], eax
push 0x101e310c
push dword [ebp - 0x1c]
call fcn.10002738
add esp, 8
cmp eax, 0
mov eax, 0
sete al
mov dword [ebp - 0x20], eax
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x10118ef0
push ebx
call fcn.1015720f
add esp, 4
cmp dword [ebp - 0x20], 0
je 0x10118f04
mov eax, 0x101a6ad8
jmp 0x10118f09
mov eax, 0x101e310c
mov dword [ebp - 0x24], eax
mov ebx, dword [ebp + 0xc]
push dword [ebx]
push dword [ebp - 0x24]
mov ebx, dword [ebp + 0x10]
push dword [ebx]
mov ecx, 3
call fcn.100012af
add esp, 0xc
mov dword [ebp - 0x28], eax
mov ebx, dword [ebp - 0x24]
test ebx, ebx
je 0x10118f39
push ebx
call fcn.1015720f
add esp, 4
mov eax, dword [ebp - 0x28]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x10118f4d
push ebx
call fcn.1015720f
add esp, 4
pop eax
mov dword [ebp - 4], eax
jmp 0x10118fb0
push 0
mov ebx, 0x104
call fcn.101599f0
add esp, 4
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp + 0xc]
push dword [ebx]
push 0x101e310c
push dword [ebp - 0x1c]
mov ecx, 3
call fcn.100012af
add esp, 0xc
mov dword [ebp - 0x20], eax
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x10118f98
push ebx
call fcn.1015720f
add esp, 4
mov eax, dword [ebp - 0x20]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x10118fac
push ebx
call fcn.1015720f
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], esp
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
nop
nop
cmp dword [ebp - 0x1c], esp
je 0x10118fdc
push 0x1fc
push 0x436a934
push 6
call fcn.101571f7
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10118ff1
mov eax, dword [ebp - 8]
jmp 0x101196ec
mov dword [ebp - 0x1c], esp
push 0x40
push 0x1000
push 0x200
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop
nop
cmp dword [ebp - 0x1c], esp
je 0x1011902e
push 0x2cb
push 0x436a934
push 6
call fcn.101571f7
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x10119045
mov eax, 0
jmp 0x101196ec
mov dword [ebp - 0x1c], esp
push dword [0x10215648]
xor eax, eax
call dword [0x10215998]
nop
nop
cmp dword [ebp - 0x1c], esp
je 0x10119074
push 0x39b
push 0x436a934
push 6
call fcn.101571f7
add esp, 0xc
cmp dword [0x1021572c], 0
je 0x101190f8
mov dword [ebp - 0x1c], esp
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop
nop
cmp dword [ebp - 0x1c], esp
je 0x101190aa
push 0x437
push 0x436a934
push 6
call fcn.101571f7
add esp, 0xc
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], esp
push dword [0x1021572c]
push 0
push dword [ebp - 0x20]
xor eax, eax
call dword [0x1021599c]
nop
nop
cmp dword [ebp - 0x24], esp
je 0x101190e4
push 0x437
push 0x436a934
push 6
call fcn.101571f7
add esp, 0xc
mov dword [0x1021572c], 0
mov dword [0x10215730], 0
push dword [ebp - 4]
push str.___
mov ecx, 2
call fcn.100012af
add esp, 8
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], 0
push 0
push dword [ebp - 0x20]
push 0x10215730
lea eax, [ebp - 0x1c]
push eax
call fcn.10119704
mov dword [ebp - 0x24], eax
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x1011913d
push ebx
call fcn.1015720f
add esp, 4
mov eax, dword [ebp - 0x24]
mov dword [0x1021572c], eax
mov eax, dword [ebp + 0x18]
mov dword [0x10215734], eax
push dword [ebp - 0xc]
push 0x1011a58e
mov eax, str.NtQueryAttributesFile
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
push 0x10215738
call fcn.10119904
mov dword [ebp - 0x20], eax
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x1011917e
push ebx
call fcn.1015720f
add esp, 4
cmp dword [ebp - 0x20], 0
jne 0x1011918d
jmp 0x101195fd
fild dword [ebp - 0xc]
fstp qword [ebp - 0x20]
fld qword [ebp - 0x20]
fadd qword [0x10213ad4]
fstp qword [ebp - 0x28]
fld qword [ebp - 0x28]
call fcn.1000121c
push eax
push 0x1011a882
mov eax, str.NtOpenFile
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x2c]
push eax
push 0x1021573c
call fcn.10119904
mov dword [ebp - 0x30], eax
mov ebx, dword [ebp - 0x2c]
test ebx, ebx
je 0x101191d6
push ebx
call fcn.1015720f
add esp, 4
cmp dword [ebp - 0x30], 0
jne 0x101191e5
jmp 0x101195fd
fild dword [ebp - 0xc]
fstp qword [ebp - 0x20]
fld qword [ebp - 0x20]
fadd qword [0x101e474c]
fstp qword [ebp - 0x28]
fld qword [ebp - 0x28]
call fcn.1000121c
push eax
push 0x1011a936
mov eax, str.NtClose
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x2c]
push eax
push 0x10215740
call fcn.10119904
mov dword [ebp - 0x30], eax
mov ebx, dword [ebp - 0x2c]
test ebx, ebx
je 0x1011922e
push ebx
call fcn.1015720f
add esp, 4
cmp dword [ebp - 0x30], 0
jne 0x1011923d
jmp 0x101195fd
fild dword [ebp - 0xc]
fstp qword [ebp - 0x20]
fld qword [ebp - 0x20]
fadd qword [0x101a6b78]
fstp qword [ebp - 0x28]
fld qword [ebp - 0x28]
call fcn.1000121c
push eax
push 0x1011aa36
mov eax, str.NtCreateSection
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x2c]
push eax
push 0x10215744
call fcn.10119904
mov dword [ebp - 0x30], eax
mov ebx, dword [ebp - 0x2c]
test ebx, ebx
je 0x10119286
push ebx
call fcn.1015720f
add esp, 4
cmp dword [ebp - 0x30], 0
jne 0x10119295
jmp 0x101195fd
fild dword [ebp - 0xc]
fstp qword [ebp - 0x20]
fld qword [ebp - 0x20]
fadd qword [0x10214070]
fstp qword [ebp - 0x28]
fld qword [ebp - 0x28]
call fcn.1000121c
push eax
push 0x1011ab42
mov eax, 0x10214078
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x2c]
push eax
push 0x10215748
call fcn.10119904
mov dword [ebp - 0x30], eax
mov ebx, dword [ebp - 0x2c]
test ebx, ebx
je 0x101192de
push ebx
call fcn.1015720f
add esp, 4
cmp dword [ebp - 0x30], 0
jne 0x101192ed
jmp 0x101195fd
cmp dword [ebp + 0x18], 0
je 0x101194af
fild dword [ebp - 0xc]
fstp qword [ebp - 0x20]
fld qword [ebp - 0x20]
fadd qword [0x1021408c]
fstp qword [ebp - 0x28]
fld qword [ebp - 0x28]
call fcn.1000121c
push eax
push 0x1011acba
mov eax, 0x10214094
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x2c]
push eax
push 0x1021574c
call fcn.10119904
mov dword [ebp - 0x30], eax
mov ebx, dword [ebp - 0x2c]
test ebx, ebx
je 0x10119340
push ebx
call fcn.1015720f
add esp, 4
cmp dword [ebp - 0x30], 0
jne 0x1011934f
jmp 0x101195fd
fild dword [ebp - 0xc]
fstp qword [ebp - 0x20]
fld qword [ebp - 0x20]
fadd qword [0x101e468c]
fstp qword [ebp - 0x28]
fld qword [ebp - 0x28]
call fcn.1000121c
push eax
push 0x1011adf6
mov eax, str.NtQueryVolumeInformationFile
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x2c]
push eax
push 0x10215750
call fcn.10119904
mov dword [ebp - 0x30], eax
mov ebx, dword [ebp - 0x2c]
test ebx, ebx
je 0x10119398
push ebx
call fcn.1015720f
add esp, 4
cmp dword [ebp - 0x30], 0
jne 0x101193a7
jmp 0x101195fd
fild dword [ebp - 0xc]
fstp qword [ebp - 0x20]
fld qword [ebp - 0x20]
fadd qword [0x102140c4]
fstp qword [ebp - 0x28]
fld qword [ebp - 0x28]
call fcn.1000121c
push eax
push 0x1011afe2
mov eax, 0x102140cc
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x2c]
push eax
push 0x10215754
call fcn.10119904
mov dword [ebp - 0x30], eax
mov ebx, dword [ebp - 0x2c]
test ebx, ebx
je 0x101193f0
push ebx
call fcn.1015720f
add esp, 4
cmp dword [ebp - 0x30], 0
jne 0x101193ff
jmp 0x101195fd
fild dword [ebp - 0xc]
fstp qword [ebp - 0x20]
fld qword [ebp - 0x20]
fadd qword [0x102140e4]
fstp qword [ebp - 0x28]
fld qword [ebp - 0x28]
call fcn.1000121c
push eax
push 0x1011b116
mov eax, 0x102140ec
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x2c]
push eax
push 0x10215758
call fcn.10119904
mov dword [ebp - 0x30], eax
mov ebx, dword [ebp - 0x2c]
test ebx, ebx
je 0x10119448
push ebx
call fcn.1015720f
add esp, 4
cmp dword [ebp - 0x30], 0
jne 0x10119457
jmp 0x101195fd
fild dword [ebp - 0xc]
fstp qword [ebp - 0x20]
fld qword [ebp - 0x20]
fadd qword [0x101e467c]
fstp qword [ebp - 0x28]
fld qword [ebp - 0x28]
call fcn.1000121c
push eax
push 0x1011b2b6
mov eax, str.NtReadFile
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x2c]
push eax
push 0x1021575c
call fcn.10119904
mov dword [ebp - 0x30], eax
mov ebx, dword [ebp - 0x2c]
test ebx, ebx
je 0x101194a0
push ebx
call fcn.1015720f
add esp, 4
cmp dword [ebp - 0x30], 0
jne 0x101194af
jmp 0x101195fd
lea eax, [ebp - 4]
push eax
call fcn.1011a1a4
mov dword [0x10215760], eax
push dword [ebp + 8]
call fcn.1011a1c0
mov dword [0x10215764], eax
push OleUIBusyA
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x101194df
mov eax, 0x101a6c00
push eax
push 1
mov ebx, 0x194
call fcn.10158c30
add esp, 0x10
mov dword [0x10215768], eax
mov dword [ebp - 0x1c], esp
push dword [ebp - 4]
lea eax, [ebp - 0x14]
push eax
xor eax, eax
call dword [0x102159a0]
nop
nop
cmp dword [ebp - 0x1c], esp
je 0x10119527
push 0xc7a
push 0x436a934
push 6
call fcn.101571f7
add esp, 0xc
test eax, eax
je 0x101195b2
cmp dword [ebp + 0x20], 0
je 0x10119543
mov eax, 2
jmp 0x10119548
mov eax, 0
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], esp
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
xor eax, eax
call dword [0x102159a4]
nop
nop
cmp dword [ebp - 0x20], esp
je 0x10119585
push 0xcb7
push 0x436a934
push 6
call fcn.101571f7
add esp, 0xc
mov dword [ebp - 0x1c], esp
lea eax, [ebp - 0x14]
push eax
xor eax, eax
call dword [0x102159a8]
nop
nop
cmp dword [ebp - 0x1c], esp
je 0x101195b2
push 0xcf2
push 0x436a934
push 6
call fcn.101571f7
add esp, 0xc
cmp dword [0x1021576c], 0
je 0x101195fd
mov eax, dword [0x1021576c]
mov dword [ebp - 0x18], eax
mov dword [0x1021576c], 0
mov dword [ebp - 0x1c], esp
push dword [ebp - 0x18]
xor eax, eax
call dword [0x102159ac]
nop
nop
cmp dword [ebp - 0x1c], esp
je 0x101195fd
push 0xd88
push 0x436a934
push 6
call fcn.101571f7
add esp, 0xc
push 0x10215738
call fcn.1011a1e4
push 0x1021573c
call fcn.1011a1e4
push 0x10215740
call fcn.1011a1e4
push 0x10215744
call fcn.1011a1e4
push 0x10215748
call fcn.1011a1e4
cmp dword [ebp + 0x18], 0
je 0x1011966b
push 0x1021574c
call fcn.1011a1e4
push 0x10215750
call fcn.1011a1e4
push 0x10215754
call fcn.1011a1e4
push 0x10215758
call fcn.1011a1e4
push 0x1021575c
call fcn.1011a1e4
mov dword [0x10215760], 0
mov dword [ebp - 0x1c], esp
push dword [0x10215648]
xor eax, eax
call dword [0x102159b0]
nop
nop
cmp dword [ebp - 0x1c], esp
je 0x101196a4
push 0xf8c
push 0x436a934
push 6
call fcn.101571f7
add esp, 0xc
cmp dword [ebp - 0xc], 0
je 0x101196e4
mov dword [ebp - 0x1c], esp
push 0x8000
push 0
push dword [ebp - 0xc]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
nop
nop
cmp dword [ebp - 0x1c], esp
je 0x101196e4
push 0xff8
push 0x436a934
push 6
call fcn.101571f7
add esp, 0xc
mov eax, dword [ebp - 8]
jmp 0x101196ec
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x101196fd
push ebx
call fcn.1015720f
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0x20