Function at 0x10076bc0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100854d3
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
mov eax, dword [0x100b3040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [0xd415b8], 1
mov dword [0xd415bc], 0x7fffffff
mov dword [0xb6af54], 1
mov dword [0xb6af5c], 1
cmp dword [0x100b4aac], 0
jne 0x10076c78
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
mov edx, 0x100b4aac
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x10076c78
mov esi, dword [0x100b4aa0]
mov dword [0x100b4a90], eax
mov dword [0x100b4a98], eax
mov dword [0x100b4aa4], eax
test esi, esi
je 0x10076c71
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x40]
push eax
push 0x40
push 0x10000
push esi
call edi
test eax, eax
je 0x10076e8a
mov esi, dword [esi + 4]
test esi, esi
jne 0x10076c54
xor eax, eax
mov dword [0x100b4ab0], eax
call fcn.100404c0
sub esp, 0xc
mov edx, 0x10079bb0
mov ecx, 0x100b315c
call fcn.1007e0e0
sub esp, 0xc
mov edx, 0x10079f00
mov ecx, 0x100b3158
call fcn.1007e0e0
sub esp, 0xc
mov edx, 0x10079c10
mov ecx, 0x100b316c
call fcn.1007e0e0
sub esp, 0xc
mov edx, 0x10079d20
mov ecx, 0x100b3164
call fcn.1007e0e0
sub esp, 0xc
mov edx, 0x10079df0
mov ecx, 0x100b3160
call fcn.1007e0e0
sub esp, 0xc
mov edx, 0x10079e10
mov ecx, 0x100b3168
call fcn.1007e0e0
sub esp, 0xc
mov edx, 0x10079ff0
mov ecx, 0x100b314c
call fcn.1007e0e0
sub esp, 0xc
mov edx, 0x1007a010
mov ecx, 0x100b3150
call fcn.1007e0e0
sub esp, 0xc
mov edx, 0x1007a030
mov ecx, 0x100b3148
call fcn.1007e0e0
sub esp, 0xc
mov edx, 0x1007a050
mov ecx, 0x100b3140
call fcn.1007e0e0
sub esp, 0xc
mov edx, 0x1007a060
mov ecx, 0x100b3154
call fcn.1007e0e0
sub esp, 0xc
mov edx, 0x1007a1a0
mov ecx, 0x100b3144
call fcn.1007e0e0
sub esp, 0xc
mov edx, 0x1007a1b0
mov ecx, 0x100b3170
call fcn.1007e0e0
call fcn.100404c0
push 0x10079fb0
lea ecx, [eax + 0xc]
call fcn.100425c0
sub esp, 0xc
mov edx, 0x100401a0
mov ecx, 0x100b3094
call fcn.1007e0e0
sub esp, 0xc
mov edx, 0x10040260
mov ecx, 0x100b3098
call fcn.1007e0e0
sub esp, 0xc
mov edx, 0x10043ae0
mov ecx, 0x100b30b4
call fcn.1007e0e0
sub esp, 0xc
mov edx, 0x10043b10
mov ecx, 0x100b30b0
call fcn.1007e0e0
sub esp, 0xc
mov edx, 0x10043d30
mov ecx, 0x100b30bc
call fcn.1007e0e0
sub esp, 0xc
mov edx, 0x10043d50
mov ecx, 0x100b30d0
call fcn.1007e0e0
call fcn.10040a40
call fcn.10052b10
sub esp, 0xc
mov edx, 0x10058b20
mov ecx, 0x100b30f8
call fcn.1007e0e0
sub esp, 0xc
mov edx, 0x10058b70
mov ecx, 0x100b30f4
call fcn.1007e0e0
call fcn.10043150
call fcn.10043880
call fcn.100404c0
push 0x10079a70
lea ecx, [eax + 0x34]
call fcn.10040d80
call fcn.100404c0
push 0x10079a50
lea ecx, [eax + 0x40]
call fcn.10040d80
call fcn.100404c0
push 0x100799a0
lea ecx, [eax + 0x4c]
call fcn.10040d80
mov eax, dword [0x100b4bbc]
mov dword [ebp - 0x18], 0x10079860
mov dword [ebp - 0x40], 0x521
cmp eax, dword [0x100b4bc0]
je 0x10076e95
mov dword [eax], 0x521
mov dword [eax + 4], 0x10079860
mov eax, dword [0x100b4bbc]
add eax, 8
mov dword [0x100b4bbc], eax
jmp 0x10076ea8
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x10076c73
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x40]
push ecx
push eax
call fcn.10060930
mov eax, dword [0x100b4bbc]
mov dword [ebp - 0x40], 0x100798e0
mov dword [ebp - 0x18], 0x522
cmp eax, dword [0x100b4bc0]
je 0x10076ed4
mov dword [eax], 0x522
mov dword [eax + 4], 0x100798e0
add dword [0x100b4bbc], 8
jmp 0x10076ee2
lea ecx, [ebp - 0x40]
push ecx
lea ecx, [ebp - 0x18]
push ecx
push eax
call fcn.10060930
call fcn.10043150
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], str.GetInventoryItemTransmog
push ecx
mov esi, eax
mov dword [ebp - 0x18], 0x1007acd0
lea eax, [ebp - 0x14]
push eax
push ecx
lea ecx, [ebp - 0x4c]
call fcn.10043470
sub esp, 0x18
mov dword [ebp - 4], 0
mov eax, esp
xorps xmm0, xmm0
mov ecx, esi
movups xmmword [eax], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0x4c]
push eax
push 1
call fcn.1007afc0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x4c]
test ecx, ecx
je 0x10076f7f
mov eax, dword [ebp - 0x44]
sub eax, ecx
sar eax, 3
lea edx, [eax*8]
mov eax, ecx
cmp edx, 0x1000
jb 0x10076f75
mov ecx, dword [eax - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10076f75
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.1008095a
add esp, 8
call fcn.1007c060
call fcn.100404c0
mov eax, dword [0x100b5400]
mov dword [ebp - 0x34], 0x100b4a78
mov dword [ebp - 0x30], str.cameraFov
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x24], 0x100abb64
mov dword [ebp - 0x20], 0x1007b670
cmp eax, dword [0x100b5404]
je 0x10076ff2
mov dword [eax], 0x100b4a78
mov dword [eax + 4], str.cameraFov
mov dword [eax + 8], 0
mov dword [eax + 0xc], 1
mov dword [eax + 0x10], 0x100abb64
mov dword [eax + 0x14], 0x1007b670
add dword [0x100b5400], 0x18
jmp 0x10076ffc
lea ecx, [ebp - 0x34]
push ecx
push eax
call fcn.1007aad0
call fcn.10043150
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x3c], 0x100abb74
push ecx
mov esi, eax
mov dword [ebp - 0x38], 0x1007b5c0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x34], str.IsWindowFocused
push eax
push ecx
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x30], 0x1007b5e0
mov dword [ebp - 0x2c], str.FocusWindow
mov dword [ebp - 0x28], 0x1007b620
mov dword [ebp - 0x24], str.CopyToClipboard
mov dword [ebp - 0x20], 0x1007b640
call fcn.10043470
sub esp, 0x18
mov dword [ebp - 4], 1
mov eax, esp
xorps xmm0, xmm0
mov ecx, esi
movups xmmword [eax], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0x4c]
push eax
push 1
call fcn.1007afc0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x4c]
test ecx, ecx
je 0x100770c3
mov eax, dword [ebp - 0x44]
sub eax, ecx
sar eax, 3
lea edx, [eax*8]
mov eax, ecx
cmp edx, 0x1000
jb 0x100770b9
mov ecx, dword [eax - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x100770b9
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.1008095a
add esp, 8
sub esp, 0xc
mov edx, 0x1007b6e0
mov ecx, 0x100b3174
call fcn.1007e0e0
sub esp, 0xc
mov edx, 0x10060900
mov ecx, 0x100b30fc
call fcn.1007e0e0
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x500c7
xor edi, edi
mov dword [ebp - 0x18], 0x1b30000
xor eax, eax
mov word [ebp - 0x14], 0x9090
lea esi, [ebp - 0x11]
mov byte [ebp - 0x12], 0x90
sub esi, ecx
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x48], edi
mov ecx, eax
mov dword [ebp - 0x44], eax
je 0x10077138
push esi
lea ecx, [ebp - 0x4c]
call fcn.10042910
mov edi, dword [ebp - 0x4c]
lea eax, [ebp - 0x1c]
push esi
push eax
push edi
call sub.VCRUNTIME140.dll_memmove
mov eax, dword [ebp - 0x44]
lea ecx, [esi + edi]
add esp, 0xc
mov dword [ebp - 4], 2
mov dword [ebp - 0x2c], 0x421f87
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], eax
push ecx
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x40], 0
lea edi, [ebp - 0x2c]
lea esi, [ebp - 0x1c]
call fcn.100423a0
push esi
push edi
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 4
call fcn.100426e0
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0xb4]
call fcn.10041730
lea ecx, [ebp - 0x68]
call fcn.100420c0
lea ecx, [ebp - 0x70]
call fcn.100421b0
push fcn.10041c40
push 1
push 0x10
mov eax, edi
mov byte [ebp - 4], 8
push eax
call fcn.10080db5
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 9
call fcn.10041810
lea ecx, [ebp - 0x88]
mov dword [ebp - 4], 0xffffffff
call fcn.100420c0
lea ecx, [ebp - 0x90]
call fcn.100421b0
lea ecx, [ebp - 0xa8]
call fcn.100420c0
lea ecx, [ebp - 0xb0]
call fcn.100421b0
call fcn.1007dc90
call fcn.10043150
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x54], str.debugbreak
push ecx
mov esi, eax
mov dword [ebp - 0x50], fcn.10076bb0
lea eax, [ebp - 0x4c]
push eax
push ecx
lea ecx, [ebp - 0x4c]
call fcn.10043470
sub esp, 0x18
mov dword [ebp - 4], 0xa
mov eax, esp
xorps xmm0, xmm0
movups xmmword [eax], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0x4c]
push eax
push 3
mov ecx, esi
call fcn.1007afc0
mov edx, dword [ebp - 0x4c]
test edx, edx
je 0x1007729e
mov ecx, dword [ebp - 0x44]
mov eax, edx
sub ecx, edx
and ecx, 0xfffffff8
cmp ecx, 0x1000
jb 0x10077294
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10077294
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.1008095a
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10080947
mov esp, ebp
pop ebp
ret