Function at 0x10001560
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 0x108
push ebp
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
push 0x104
lea eax, [esp + 0x14]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x10001599
mov cl, 0x5c
lea ebx, [ebx]
cmp byte [esp + eax + 0x10], cl
je 0x10001599
dec eax
jne 0x10001590
lea esi, [esp + eax + 0x11]
mov ecx, 0x100013ec
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100015c4
test dl, dl
je 0x100015c0
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100015c4
add eax, 2
add ecx, 2
test dl, dl
jne 0x100015a4
xor eax, eax
jmp 0x100015c9
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1000170a
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [esp + 0xc]
push ecx
push 0x40
push 0x10
lea ebp, [edi + 0x4cc0b0]
push ebp
call esi
lea edx, [esp + 0xc]
push edx
mov dword [ebp], 0x4e44c8b
mov dword [ebp + 4], 0xc0332089
mov dword [ebp + 8], 0xcc0014c2
mov eax, dword [esp + 0x10]
push eax
push 0x10
push ebp
call esi
lea ecx, [esp + 0xc]
push ecx
push 0x40
push 0x10
lea ebp, [edi + 0x4cd280]
push ebp
call esi
mov edx, 0x100014d0
sub edx, ebp
sub edx, 5
lea eax, [esp + 0xc]
push eax
mov byte [ebp], 0xe9
mov dword [ebp + 1], edx
mov ecx, dword [esp + 0x10]
push ecx
push 0x10
push ebp
call esi
lea edx, [esp + 0xc]
push edx
push 0x40
push 0x10
lea ebp, [edi + 0x4cc450]
push ebp
call esi
mov eax, 0x10001480
sub eax, ebp
sub eax, 5
lea ecx, [esp + 0xc]
push ecx
mov byte [ebp], 0xe9
mov dword [ebp + 1], eax
mov edx, dword [esp + 0x10]
push edx
push 0x10
push ebp
call esi
lea eax, [esp + 0xc]
push eax
push 0x40
push 0x10
lea ebp, [edi + 0x4ccd70]
push ebp
call esi
mov ecx, 0x10001460
sub ecx, ebp
sub ecx, 5
lea edx, [esp + 0xc]
push edx
mov byte [ebp], 0xe9
mov dword [ebp + 1], ecx
mov eax, dword [esp + 0x10]
push eax
push 0x10
push ebp
call esi
lea ecx, [esp + 0xc]
push ecx
push 0x40
lea ebp, [edi + 0x4cd650]
push 0x10
push ebp
call esi
lea edx, [esp + 0xc]
push edx
mov dword [ebp], 0x4c2c033
mov byte [ebp + 4], 0
mov eax, dword [esp + 0x10]
push eax
push 0x10
push ebp
call esi
lea ecx, [esp + 0xc]
push ecx
push 0x40
push 0x10
add edi, 0x4cb270
push edi
call esi
mov edx, 0x10001410
sub edx, edi
sub edx, 5
lea eax, [esp + 0xc]
push eax
mov byte [edi], 0xe9
mov dword [edi + 1], edx
mov ecx, dword [esp + 0x10]
push ecx
push 0x10
push edi
call esi
pop edi
pop esi
pop ebp
add esp, 0x108
ret
mov ecx, 0x100013e0
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10001731
test dl, dl
je 0x1000172d
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10001731
add eax, 2
add ecx, 2
test dl, dl
jne 0x10001711
xor eax, eax
jmp 0x10001736
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1000186d
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea edx, [esp + 0xc]
push edx
push 0x40
push 0x10
lea ebp, [edi + 0x5af5c0]
push ebp
call esi
lea eax, [esp + 0xc]
push eax
mov dword [ebp], 0x4e44c8b
mov dword [ebp + 4], 0xc0332089
mov dword [ebp + 8], 0xcc0014c2
mov ecx, dword [esp + 0x10]
push ecx
push 0x10
push ebp
call esi
lea edx, [esp + 0xc]
push edx
push 0x40
push 0x10
lea ebp, [edi + 0x5b14d0]
push ebp
call esi
mov eax, 0x100014d0
sub eax, ebp
sub eax, 5
lea ecx, [esp + 0xc]
push ecx
mov byte [ebp], 0xe9
mov dword [ebp + 1], eax
mov edx, dword [esp + 0x10]
push edx
push 0x10
push ebp
call esi
lea eax, [esp + 0xc]
push eax
push 0x40
push 0x10
lea ebp, [edi + 0x5afce0]
push ebp
call esi
mov ecx, 0x10001480
sub ecx, ebp
sub ecx, 5
lea edx, [esp + 0xc]
push edx
mov byte [ebp], 0xe9
mov dword [ebp + 1], ecx
mov eax, dword [esp + 0x10]
push eax
push 0x10
push ebp
call esi
lea ecx, [esp + 0xc]
push ecx
push 0x40
push 0x10
lea ebp, [edi + 0x5b06e0]
push ebp
call esi
mov edx, 0x10001460
sub edx, ebp
sub edx, 5
lea eax, [esp + 0xc]
push eax
mov byte [ebp], 0xe9
mov dword [ebp + 1], edx
mov ecx, dword [esp + 0x10]
push ecx
push 0x10
push ebp
call esi
lea edx, [esp + 0xc]
push edx
push 0x40
lea ebp, [edi + 0x5b1970]
push 0x10
push ebp
call esi
lea eax, [esp + 0xc]
push eax
mov dword [ebp], 0x4c2c033
mov byte [ebp + 4], 0
mov ecx, dword [esp + 0x10]
push ecx
push 0x10
push ebp
call esi
lea edx, [esp + 0xc]
push edx
push 0x40
push 0x10
add edi, 0x4b13f0
push edi
call esi
mov eax, 0x10001410
sub eax, edi
sub eax, 5
lea ecx, [esp + 0xc]
push ecx
mov byte [edi], 0xe9
mov dword [edi + 1], eax
mov edx, dword [esp + 0x10]
push edx
push 0x10
push edi
call esi
pop edi
pop esi
pop ebp
add esp, 0x108
ret