Function at 0x10022b20
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 0x100231a0
push 0x61fe3f
or bl, 0xff
call fcn.10056900
push 0x10023210
push 0x61b410
or bl, 0xff
call fcn.10056900
push 0x10023210
push 0x61feea
or bl, 0xff
call fcn.10056900
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 0x18
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x559b85
call esi
mov bl, 0xff
lea ecx, [ebp - 4]
push ecx
mov byte [0x559b85], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x559b85
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x559b86
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x559b86], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x559b86
call esi
push 0x10022ad0
push 0x55e4c5
mov bl, 0xe9
call fcn.10056900
add esp, 8
lea ecx, [ebp - 4]
push ecx
push 0x40
mov eax, 0x10023290
push 5
sub eax, 0x4e19a2
xor edi, edi
push 0x4e199d
mov byte [ebp - 0x10], 0xe8
mov dword [ebp - 0xf], eax
mov dword [ebp - 4], edi
call esi
test eax, eax
je 0x10022c1b
mov edx, dword [ebp - 0x10]
mov cl, byte [ebp - 0xc]
mov eax, 0x4e199d
mov dword [eax], edx
mov byte [eax + 4], cl
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push eax
push 5
push 0x4e199d
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x10022c21
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 4]
push ecx
push 0x40
mov ebx, 0x10023290
push 5
sub ebx, 0x58704e
push 0x587049
mov byte [ebp - 0x10], 0xe8
mov dword [ebp - 0xf], ebx
mov dword [ebp - 4], edi
call esi
test eax, eax
je 0x10022c71
mov edx, dword [ebp - 0x10]
mov cl, byte [ebp - 0xc]
mov eax, 0x587049
mov dword [eax], edx
mov byte [eax + 4], cl
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push eax
push 5
push 0x587049
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x10022c77
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 4]
push ecx
push 0x40
push 5
push 0x587049
mov byte [ebp - 0x10], 0xe8
mov dword [ebp - 0xf], ebx
mov dword [ebp - 4], edi
call esi
test eax, eax
jne 0x10022c9e
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
jmp 0x10022cd2
mov edx, dword [ebp - 0x10]
mov cl, byte [ebp - 0xc]
mov eax, 0x587049
mov dword [eax], edx
mov byte [eax + 4], cl
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push eax
push 5
push 0x587049
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x10022ccc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [ebp - 4]
push edx
push 0x40
mov ecx, 0x10023290
push 5
sub ecx, 0x590cd1
push 0x590ccc
mov byte [ebp - 0x10], 0xe8
mov dword [ebp - 0xf], ecx
mov dword [ebp - 4], edi
call esi
test eax, eax
je 0x10022d22
mov ecx, dword [ebp - 0x10]
mov dl, byte [ebp - 0xc]
mov eax, 0x590ccc
mov dword [eax], ecx
mov byte [eax + 4], dl
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ecx
push 5
push 0x590ccc
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x10022d24
call ebx
lea eax, [ebp - 4]
push eax
push 0x40
mov edx, 0x10023290
push 5
sub edx, 0x5bbeeb
push 0x5bbee6
mov byte [ebp - 0x10], 0xe8
mov dword [ebp - 0xf], edx
mov dword [ebp - 4], edi
call esi
test eax, eax
je 0x10022d74
mov ecx, dword [ebp - 0x10]
mov dl, byte [ebp - 0xc]
mov eax, 0x5bbee6
mov dword [eax], ecx
mov byte [eax + 4], dl
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ecx
push 5
push 0x5bbee6
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x10022d76
call ebx
lea eax, [ebp - 4]
push eax
push 0x40
mov edx, 0x10023290
push 5
sub edx, 0x6422a2
push 0x64229d
mov byte [ebp - 0x10], 0xe8
mov dword [ebp - 0xf], edx
mov dword [ebp - 4], edi
call esi
test eax, eax
je 0x10022dc6
mov ecx, dword [ebp - 0x10]
mov dl, byte [ebp - 0xc]
mov eax, 0x64229d
mov dword [eax], ecx
mov byte [eax + 4], dl
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ecx
push 5
push 0x64229d
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x10022dc8
call ebx
lea eax, [ebp - 4]
push eax
push 0x40
mov edx, 0x10023290
push 5
sub edx, 0x642d56
push 0x642d51
mov byte [ebp - 0x10], 0xe8
mov dword [ebp - 0xf], edx
mov dword [ebp - 4], edi
call esi
test eax, eax
je 0x10022e18
mov ecx, dword [ebp - 0x10]
mov dl, byte [ebp - 0xc]
mov eax, 0x642d51
mov dword [eax], ecx
mov byte [eax + 4], dl
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ecx
push 5
push 0x642d51
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x10022e1a
call ebx
lea eax, [ebp - 4]
push eax
push 0x40
mov edx, 0x10023290
push 5
sub edx, 0x64322e
push 0x643229
mov byte [ebp - 0x10], 0xe8
mov dword [ebp - 0xf], edx
mov dword [ebp - 4], edi
call esi
test eax, eax
je 0x10022e6a
mov ecx, dword [ebp - 0x10]
mov dl, byte [ebp - 0xc]
mov eax, 0x643229
mov dword [eax], ecx
mov byte [eax + 4], dl
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ecx
push 5
push 0x643229
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x10022e6c
call ebx
lea eax, [ebp - 4]
push eax
push 0x40
mov edx, 0x10023290
push 5
sub edx, 0x65ea8b
push 0x65ea86
mov byte [ebp - 0x10], 0xe8
mov dword [ebp - 0xf], edx
mov dword [ebp - 4], edi
call esi
test eax, eax
je 0x10022ebc
mov ecx, dword [ebp - 0x10]
mov dl, byte [ebp - 0xc]
mov eax, 0x65ea86
mov dword [eax], ecx
mov byte [eax + 4], dl
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ecx
push 5
push 0x65ea86
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x10022ebe
call ebx
lea eax, [ebp - 4]
push eax
push 0x40
mov edx, 0x10023290
push 5
sub edx, 0x911a58
push 0x911a53
mov byte [ebp - 0x10], 0xe8
mov dword [ebp - 0xf], edx
mov dword [ebp - 4], edi
call esi
test eax, eax
je 0x10022f0e
mov ecx, dword [ebp - 0x10]
mov dl, byte [ebp - 0xc]
mov eax, 0x911a53
mov dword [eax], ecx
mov byte [eax + 4], dl
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ecx
push 5
push 0x911a53
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x10022f10
call ebx
lea eax, [ebp - 4]
push eax
push 0x40
mov edx, 0x10023290
push 5
sub edx, 0x911a72
push 0x911a6d
mov byte [ebp - 0x10], 0xe8
mov dword [ebp - 0xf], edx
mov dword [ebp - 4], edi
call esi
test eax, eax
je 0x10022f60
mov ecx, dword [ebp - 0x10]
mov dl, byte [ebp - 0xc]
mov eax, 0x911a6d
mov dword [eax], ecx
mov byte [eax + 4], dl
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ecx
push 5
push 0x911a6d
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x10022f62
call ebx
lea eax, [ebp - 4]
push eax
push 0x40
mov edx, 0x10023290
push 5
sub edx, 0x911a8c
push 0x911a87
mov byte [ebp - 0x10], 0xe8
mov dword [ebp - 0xf], edx
mov dword [ebp - 4], edi
call esi
test eax, eax
je 0x10022fb2
mov ecx, dword [ebp - 0x10]
mov dl, byte [ebp - 0xc]
mov eax, 0x911a87
mov dword [eax], ecx
mov byte [eax + 4], dl
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ecx
push 5
push 0x911a87
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x10022fb4
call ebx
lea eax, [ebp - 4]
push eax
push 0x40
mov edx, 0x10023290
push 5
sub edx, 0x911aa6
push 0x911aa1
mov byte [ebp - 0x10], 0xe8
mov dword [ebp - 0xf], edx
mov dword [ebp - 4], edi
call esi
test eax, eax
je 0x10023004
mov ecx, dword [ebp - 0x10]
mov dl, byte [ebp - 0xc]
mov eax, 0x911aa1
mov dword [eax], ecx
mov byte [eax + 4], dl
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ecx
push 5
push 0x911aa1
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x10023006
call ebx
lea eax, [ebp - 4]
push eax
push 0x40
mov edx, 0x10023290
push 5
sub edx, 0x911ac0
push 0x911abb
mov byte [ebp - 0x10], 0xe8
mov dword [ebp - 0xf], edx
mov dword [ebp - 4], edi
call esi
test eax, eax
je 0x10023056
mov ecx, dword [ebp - 0x10]
mov dl, byte [ebp - 0xc]
mov eax, 0x911abb
mov dword [eax], ecx
mov byte [eax + 4], dl
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ecx
push 5
push 0x911abb
mov dword [ebp - 8], edi
call esi
test eax, eax
jne 0x10023058
call ebx
push 0x100233b0
push 0x58101a
or bl, 0xff
call fcn.10056900
push 0x100233b0
push 0x58105b
or bl, 0xff
call fcn.10056900
push 0x100233b0
push 0x58109c
or bl, 0xff
call fcn.10056900
push 0x100233b0
push 0x5810dd
or bl, 0xff
call fcn.10056900
push 0x100233b0
push 0x58111e
or bl, 0xff
call fcn.10056900
push 0x100233b0
push 0x58115f
or bl, 0xff
call fcn.10056900
push 0x100233b0
push 0x5811a0
or bl, 0xff
call fcn.10056900
push 0x100233b0
push 0x5811e1
or bl, 0xff
call fcn.10056900
add esp, 0x40
push 0x100233b0
push 0x581222
or bl, 0xff
call fcn.10056900
push 0x100233b0
push 0x581263
or bl, 0xff
call fcn.10056900
push 0x100233b0
push 0x5812a8
or bl, 0xff
call fcn.10056900
push 0x100233b0
push 0x5812ed
or bl, 0xff
call fcn.10056900
push 0x100233b0
push 0x58132e
or bl, 0xff
call fcn.10056900
push 0x100233b0
push 0x58136f
or bl, 0xff
call fcn.10056900
push 0x100233b0
push 0x5813b4
or bl, 0xff
call fcn.10056900
push 0x100233b0
push 0x5813f9
or bl, 0xff
call fcn.10056900
add esp, 0x40
push 0x100233b0
push 0x586859
or bl, 0xff
call fcn.10056900
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret