Function at 0x110239e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 0x1c
push ebx
mov bl, byte [0x46ece9]
lea eax, [esp + 8]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
xor bl, 4
push eax
push 0x40
push 1
push 0x46ece9
call esi
lea eax, [esp + 0xc]
mov byte [0x46ece9], bl
push eax
push dword [esp + 0x10]
push 1
push 0x46ece9
call esi
mov bl, byte [0x41b966]
lea eax, [esp + 0xc]
push eax
push 0x40
push 1
push 0x41b966
xor bl, 4
call esi
lea eax, [esp + 0xc]
mov byte [0x41b966], bl
push eax
push dword [esp + 0x10]
push 1
push 0x41b966
call esi
lea eax, [esp + 0xc]
push eax
push 0x40
push 1
push 0x4d5ebf
call esi
lea eax, [esp + 0xc]
mov byte [0x4d5ebf], 1
push eax
push dword [esp + 0x10]
push 1
push 0x4d5ebf
call esi
mov bl, byte [0x481cec]
lea eax, [esp + 0xc]
push eax
push 0x40
push 1
push 0x481cec
or bl, 1
call esi
lea eax, [esp + 0xc]
mov byte [0x481cec], bl
push eax
push dword [esp + 0x10]
push 1
push 0x481cec
call esi
mov bl, byte [0x44e7d2]
lea eax, [esp + 0xc]
push eax
push 0x40
push 1
push 0x44e7d2
or bl, 1
call esi
lea eax, [esp + 0xc]
mov byte [0x44e7d2], bl
push eax
push dword [esp + 0x10]
push 1
push 0x44e7d2
call esi
mov bl, byte [0x4b801b]
lea eax, [esp + 0xc]
push eax
xor bl, 1
push 0x40
push 1
push 0x4b801b
call esi
lea eax, [esp + 0xc]
mov byte [0x4b801b], bl
push eax
push dword [esp + 0x10]
push 1
push 0x4b801b
call esi
mov bl, byte [0x42f869]
lea eax, [esp + 0xc]
push eax
push 0x40
push 1
push 0x42f869
xor bl, 0x21
call esi
lea eax, [esp + 0xc]
mov byte [0x42f869], bl
push eax
push dword [esp + 0x10]
push 1
push 0x42f869
call esi
lea eax, [esp + 0xc]
push eax
push 0x40
push 4
push 0x47093d
call esi
mov eax, 0x110239b0
sub eax, 0x470941
mov dword [0x47093d], eax
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x10]
push 4
push 0x47093d
call esi
lea eax, [esp + 0xc]
mov dword [esp + 0x14], 0x8b66d38b
push eax
push 0x40
push 0xb
push 0x470971
mov dword [esp + 0x28], 0xaf0ff458
mov bl, 0x90
mov word [esp + 0x2c], 0x53d3
call esi
mov eax, dword [esp + 0x14]
mov ecx, 0x470971
mov dword [ecx], eax
mov eax, dword [esp + 0x18]
mov dword [ecx + 4], eax
mov ax, word [esp + 0x1c]
mov word [ecx + 8], ax
lea eax, [esp + 0xc]
push eax
mov byte [ecx + 0xa], bl
push dword [esp + 0x10]
push 0xb
push ecx
call esi
lea eax, [esp + 0x14]
mov dword [esp + 0xc], 0x435160
push eax
lea edx, [esp + 0x10]
mov dword [esp + 0x14], 0x435189
mov cl, 0x7f
call fcn.1101e0e0
lea eax, [esp + 0x14]
mov dword [esp + 0xc], 0x43acd5
push eax
lea edx, [esp + 0x10]
mov dword [esp + 0x14], 0x43dd37
mov cl, 0x92
call fcn.1101e0e0
lea eax, [esp + 0xc]
push eax
push 0x40
push 4
push 0x47523d
call esi
lea eax, [esp + 0xc]
mov dword [0x47523d], 0x62
push eax
push dword [esp + 0x10]
push 4
push 0x47523d
call esi
lea eax, [esp + 0xc]
push eax
push 0x40
push 4
push 0x475231
call esi
lea eax, [esp + 0xc]
mov dword [0x475231], 0xb2
push eax
push dword [esp + 0x10]
push 4
push 0x475231
call esi
lea eax, [esp + 0xc]
push eax
push 0x40
push 4
push 0x4752be
call esi
lea eax, [esp + 0xc]
mov dword [0x4752be], 0x1cc
push eax
push dword [esp + 0x10]
push 4
push 0x4752be
call esi
lea eax, [esp + 0xc]
push eax
push 0x40
push 4
push 0x4752b2
call esi
lea eax, [esp + 0xc]
mov dword [0x4752b2], 0x21c
push eax
push dword [esp + 0x10]
push 4
push 0x4752b2
call esi
pop esi
pop ebx
add esp, 0x1c
ret