Function at 0x10009100
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
push ecx
mov eax, esp
push ecx
mov ecx, esp
push 0x59dfe3
mov dword [eax], 0x10008d10
call fcn.100011b0
lea ecx, [ebp - 4]
call fcn.10001440
add esp, 4
mov eax, esp
push ecx
mov ecx, esp
mov dword [eax], 0x10008df0
push 0x43a376
call fcn.100011b0
lea ecx, [ebp - 4]
call fcn.10001440
add esp, 4
mov eax, esp
push ecx
mov ecx, esp
mov dword [eax], 0x10008d00
push 0x41db35
call fcn.100011b0
lea ecx, [ebp - 4]
call fcn.10001440
add esp, 4
mov eax, esp
push ecx
mov ecx, esp
mov dword [eax], 0x10008cd0
push 0x418829
call fcn.100011b0
lea ecx, [ebp - 4]
call fcn.10001440
add esp, 4
mov eax, esp
push ecx
mov ecx, esp
mov dword [eax], 0x10003210
push 0x4c2f94
call fcn.100011b0
lea ecx, [ebp - 4]
call fcn.10001440
add esp, 4
mov eax, esp
push ecx
mov ecx, esp
mov dword [eax], 0x10002a00
push 0x4c326e
call fcn.100011b0
lea ecx, [ebp - 4]
call fcn.10001440
add esp, 4
mov eax, esp
push ecx
mov ecx, esp
mov dword [eax], 0x504e7b
push 0x504e0a
call fcn.100011b0
lea ecx, [ebp - 4]
call fcn.10001390
add esp, 4
mov eax, esp
push ecx
mov ecx, esp
mov dword [eax], 0x10003220
push 0x504e84
call fcn.100011b0
lea ecx, [ebp - 4]
call fcn.10001390
add esp, 4
mov eax, esp
push ecx
mov ecx, esp
mov dword [eax], 0x10003350
push 0x49ed60
call fcn.100011b0
lea ecx, [ebp - 4]
call fcn.10001440
add esp, 4
mov eax, esp
push ecx
mov ecx, esp
mov dword [eax], 0x10003430
push 0x5a2ca7
call fcn.100011b0
lea ecx, [ebp - 4]
call fcn.10001440
add esp, 4
mov eax, esp
push ecx
mov ecx, esp
mov dword [eax], 0x10003430
push 0x5a2c66
call fcn.100011b0
lea ecx, [ebp - 4]
call fcn.10001440
add esp, 4
mov eax, esp
push ecx
mov ecx, esp
mov dword [eax], 0x10003500
push 0x4cd9ee
call fcn.100011b0
lea ecx, [ebp - 4]
call fcn.10001440
add esp, 4
mov eax, esp
push ecx
mov ecx, esp
mov dword [eax], 0x100035e0
push 0x49706e
call fcn.100011b0
lea ecx, [ebp - 4]
call fcn.10001440
add esp, 4
mov eax, esp
push ecx
mov ecx, esp
mov dword [eax], 0x100036c0
push 0x4ce151
call fcn.100011b0
lea ecx, [ebp - 4]
call fcn.10001440
add esp, 4
mov eax, esp
push ecx
mov ecx, esp
mov dword [eax], 0x100036c0
push 0x4ce3a3
call fcn.100011b0
lea ecx, [ebp - 4]
call fcn.10001440
add esp, 4
mov eax, esp
push ecx
mov ecx, esp
mov dword [eax], 0x100037a0
push 0x49671e
call fcn.100011b0
lea ecx, [ebp - 4]
call fcn.10001440
add esp, 4
mov eax, esp
push ecx
mov ecx, esp
mov dword [eax], 0x100037a0
push 0x4969a6
call fcn.100011b0
lea ecx, [ebp - 4]
call fcn.10001440
add esp, 4
mov eax, esp
push ecx
mov ecx, esp
mov dword [eax], 0x10003b10
push 0x423f60
call fcn.100011b0
lea ecx, [ebp - 4]
call fcn.10001440
add esp, 8
lea ecx, [ebp - 4]
push 0x6c2d9c
call fcn.100011b0
mov esi, dword [ebp - 4]
lea eax, [ebp - 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push 4
push esi
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x14], esi
call edi
test eax, eax
setne byte [ebp - 8]
mov dword [esi], 0x10003a00
cmp byte [ebp - 8], 0
je 0x10009399
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push dword [ebp - 0x14]
call edi
push 0x6c52e8
lea ecx, [ebp - 4]
call fcn.100011b0
mov esi, dword [ebp - 4]
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push esi
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x14], esi
call edi
test eax, eax
setne byte [ebp - 8]
mov dword [esi], 0x10003b50
cmp byte [ebp - 8], 0
je 0x100093e3
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push dword [ebp - 0x14]
call edi
push ecx
mov eax, esp
push ecx
mov ecx, esp
push 0x4c5ca7
mov dword [eax], 0x10003d90
call fcn.100011b0
lea ecx, [ebp - 4]
call fcn.10001440
add esp, 4
mov eax, esp
push ecx
mov ecx, esp
mov dword [eax], 0x10003d90
push 0x4c5cbf
call fcn.100011b0
lea ecx, [ebp - 4]
call fcn.10001440
add esp, 4
mov eax, esp
push ecx
mov ecx, esp
mov dword [eax], 0x10003d90
push 0x4c5cd7
call fcn.100011b0
lea ecx, [ebp - 4]
call fcn.10001440
add esp, 4
mov eax, esp
push ecx
mov ecx, esp
mov dword [eax], 0x10003ad0
push 0x4e8a2f
call fcn.100011b0
lea ecx, [ebp - 4]
call fcn.10001390
add esp, 4
mov eax, esp
push ecx
mov ecx, esp
mov dword [eax], 0x10003ee0
push 0x4b382d
call fcn.100011b0
lea ecx, [ebp - 4]
call fcn.10001440
add esp, 4
mov eax, esp
push ecx
mov ecx, esp
mov dword [eax], 0x10003260
push 0x4c3649
call fcn.100011b0
lea ecx, [ebp - 4]
call fcn.10001440
add esp, 4
mov eax, esp
push ecx
mov ecx, esp
mov dword [eax], 0x10002ce0
push 0x41706f
call fcn.100011b0
lea ecx, [ebp - 4]
call fcn.10001440
add esp, 4
mov eax, esp
push ecx
mov ecx, esp
mov dword [eax], 0x10002ce0
push 0x417086
call fcn.100011b0
lea ecx, [ebp - 4]
call fcn.10001440
add esp, 4
mov eax, esp
push ecx
mov ecx, esp
mov dword [eax], 0x10002ce0
push 0x41717e
call fcn.100011b0
lea ecx, [ebp - 4]
call fcn.10001440
add esp, 4
mov eax, esp
push ecx
mov ecx, esp
mov dword [eax], 0x10002ce0
push 0x41cf5d
call fcn.100011b0
lea ecx, [ebp - 4]
call fcn.10001440
add esp, 4
mov eax, esp
push ecx
mov ecx, esp
mov dword [eax], 0x10002ce0
push 0x41d005
call fcn.100011b0
lea ecx, [ebp - 4]
call fcn.10001440
add esp, 4
mov eax, esp
push ecx
mov ecx, esp
mov dword [eax], 0x10002ce0
push 0x41d046
call fcn.100011b0
lea ecx, [ebp - 4]
call fcn.10001440
add esp, 4
mov eax, esp
push ecx
mov ecx, esp
mov dword [eax], 0x10002ce0
push 0x4c41e1
call fcn.100011b0
lea ecx, [ebp - 4]
call fcn.10001440
add esp, 4
mov eax, esp
push ecx
mov ecx, esp
mov dword [eax], 0x10002ce0
push 0x4c9700
call fcn.100011b0
lea ecx, [ebp - 4]
call fcn.10001440
add esp, 4
mov eax, esp
push ecx
mov ecx, esp
mov dword [eax], 0x10003e00
push 0x44aaf3
call fcn.100011b0
lea ecx, [ebp - 4]
call fcn.10001390
add esp, 4
mov eax, esp
push ecx
mov ecx, esp
mov dword [eax], 0x10003e20
push 0x44aaa6
call fcn.100011b0
lea ecx, [ebp - 4]
call fcn.10001390
add esp, 4
mov eax, esp
push ecx
mov ecx, esp
mov dword [eax], 0x10003e50
push 0x44aac7
call fcn.100011b0
lea ecx, [ebp - 4]
call fcn.10001390
add esp, 4
mov eax, esp
push ecx
mov ecx, esp
mov dword [eax], 0x10003e80
push 0x44d817
call fcn.100011b0
lea ecx, [ebp - 4]
call fcn.10001390
add esp, 4
mov eax, esp
push ecx
mov ecx, esp
mov dword [eax], 0x10003eb0
push 0x44d82e
call fcn.100011b0
lea ecx, [ebp - 4]
call fcn.10001390
add esp, 4
mov eax, esp
push ecx
mov ecx, esp
mov dword [eax], 0x10008b50
push 0x40a6c4
call fcn.100011b0
lea ecx, [ebp - 4]
call fcn.10001390
add esp, 4
mov eax, esp
push ecx
mov ecx, esp
mov dword [eax], 0x10008ad0
push 0x401603
call fcn.100011b0
lea ecx, [ebp - 4]
call fcn.10001440
add esp, 4
mov eax, esp
push ecx
mov ecx, esp
mov dword [eax], 0x10008ad0
push 0x401876
call fcn.100011b0
lea ecx, [ebp - 4]
call fcn.10001440
add esp, 4
mov eax, esp
push ecx
mov ecx, esp
mov dword [eax], 0x10008ad0
push 0x40a70f
call fcn.100011b0
lea ecx, [ebp - 4]
call fcn.10001440
add esp, 4
mov eax, esp
push ecx
mov ecx, esp
mov dword [eax], 0x10008ad0
push 0x4087a9
call fcn.100011b0
lea ecx, [ebp - 4]
call fcn.10001390
add esp, 4
mov eax, esp
push ecx
mov ecx, esp
mov dword [eax], 0x10008ad0
push 0x4087c2
call fcn.100011b0
lea ecx, [ebp - 4]
call fcn.10001390
add esp, 4
mov eax, esp
push ecx
mov ecx, esp
mov dword [eax], 0x10008ad0
push 0x4087db
call fcn.100011b0
lea ecx, [ebp - 4]
call fcn.10001390
add esp, 4
mov eax, esp
push ecx
mov ecx, esp
mov dword [eax], 0x10008ad0
push 0x4087f4
call fcn.100011b0
lea ecx, [ebp - 4]
call fcn.10001390
add esp, 4
mov eax, esp
push ecx
mov ecx, esp
mov dword [eax], 0x10008ad0
push 0x40880d
call fcn.100011b0
lea ecx, [ebp - 4]
call fcn.10001390
add esp, 4
mov eax, esp
push ecx
mov ecx, esp
mov dword [eax], 0x10008ad0
push 0x4494d9
call fcn.100011b0
lea ecx, [ebp - 4]
call fcn.10001390
mov eax, dword [0x4088fc]
lea ecx, [ebp - 4]
add esp, 8
mov dword [0x10050d2c], eax
mov dword [0x100508c8], eax
push 0x4088fc
call fcn.100011b0
mov esi, dword [ebp - 4]
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push esi
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x14], esi
call edi
test eax, eax
setne byte [ebp - 8]
mov dword [esi], 0x10008b70
cmp byte [ebp - 8], 0
je 0x100097dd
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push dword [ebp - 0x14]
call edi
push ecx
mov eax, esp
push ecx
mov ecx, esp
push 0x447991
mov dword [eax], 0x10004180
call fcn.100011b0
lea ecx, [ebp - 4]
call fcn.10001440
add esp, 4
mov eax, esp
push ecx
mov ecx, esp
mov dword [eax], 0x10004180
push 0x44794e
call fcn.100011b0
lea ecx, [ebp - 4]
call fcn.10001440
add esp, 4
mov eax, esp
push ecx
mov ecx, esp
mov dword [eax], 0x4089d1
push 0x4089c3
call fcn.100011b0
lea ecx, [ebp - 4]
call fcn.10001390
add esp, 8
lea ecx, [ebp - 4]
push 0x6c1b5c
call fcn.100011b0
mov esi, dword [ebp - 4]
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push esi
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x14], esi
call edi
test eax, eax
setne byte [ebp - 8]
mov dword [esi], 0x100041a0
cmp byte [ebp - 8], 0
je 0x10009888
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push dword [ebp - 0x14]
call edi
push 0x408b04
lea ecx, [ebp - 4]
call fcn.100011b0
mov esi, dword [ebp - 4]
lea eax, [ebp - 0xc]
push eax
push 0x40
push 5
push esi
mov dword [ebp - 0x10], 5
mov dword [ebp - 0x14], esi
call edi
test eax, eax
setne byte [ebp - 8]
mov dword [esi], 0x90909090
mov byte [esi + 4], 0x90
cmp byte [ebp - 8], 0
je 0x100098d6
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push dword [ebp - 0x14]
call edi
push 0x4f30a1
lea ecx, [ebp - 4]
call fcn.100011b0
mov esi, dword [ebp - 4]
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push esi
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x14], esi
call edi
test eax, eax
setne byte [ebp - 8]
mov dword [esi], 0
cmp byte [ebp - 8], 0
je 0x10009920
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push dword [ebp - 0x14]
call edi
call fcn.100025b0
xor eax, eax
cmp byte [0x10050034], al
je 0x1000994d
mov dword [0x6fb048], 0xa
mov dword [0x6fb04c], 5
mov dword [0x6fb050], 5
pop edi
pop esi
mov esp, ebp
pop ebp
ret