Function at 0x10001770
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov dword [ebp - 0x224], eax
lea eax, [ebp - 0x220]
push eax
push 0x40
mov esi, ecx
push edx
xor ebx, ebx
push esi
mov dword [ebp - 0x214], edx
mov dword [ebp - 0x210], esi
mov dword [ebp - 0x220], ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x100017cb
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10001cd5
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x214]
push edi
xor edi, edi
test eax, eax
je 0x100018d6
mov ebx, dword [ebp + 0x10]
nop
lea ecx, [edi + 0x31]
mov dword [ebp - 0x21c], ecx
cmp ecx, eax
jae 0x100018ce
mov edx, dword [ebp - 0x210]
xor esi, esi
lea eax, [edx + edi]
mov dword [ebp - 0x218], eax
lea ecx, [eax + esi]
mov eax, dword [ebp + 8]
mov al, byte [esi + eax]
mov byte [ecx], al
test ebx, ebx
je 0x10001815
cmp ecx, ebx
je 0x10001827
inc esi
cmp esi, 0x31
jge 0x100018b6
mov eax, dword [ebp - 0x218]
jmp 0x10001802
cmp esi, 1
jle 0x1000184a
mov ecx, dword [ebp - 0x218]
lea edx, [esi - 2]
call fcn.10001ae0
mov ecx, dword [ebp - 0x210]
lea eax, [ecx + esi]
mov byte [eax + edi - 2], 0xeb
jmp 0x10001879
jne 0x10001866
mov ecx, dword [ebp - 0x218]
xor edx, edx
call fcn.10001ae0
mov ecx, dword [ebp - 0x210]
mov byte [ecx + edi - 1], 0xeb
jmp 0x10001886
lea ecx, [edx - 0x31]
mov edx, 0x2f
call fcn.10001ae0
mov ecx, dword [ebp - 0x210]
cmp esi, 1
jle 0x10001886
lea eax, [ecx + esi]
mov byte [eax + edi - 1], 7
add ecx, esi
add ecx, edi
mov edx, 0x2a
sub edx, esi
mov dword [ecx], 0x4000f083
mov word [ecx + 4], 0xcc2
mov byte [ecx + 6], 0
test edx, edx
jle 0x100018af
add ecx, 7
call fcn.10001ae0
jmp 0x100018b6
add edi, 7
add edi, esi
jne 0x100018bc
mov edi, dword [ebp - 0x21c]
mov eax, dword [ebp - 0x214]
cmp edi, eax
jb 0x100017e0
xor ebx, ebx
jmp 0x100018d0
mov ebx, edi
mov esi, dword [ebp - 0x210]
mov edx, eax
sub edx, ebx
lea ecx, [esi + ebx]
call fcn.10001ae0
mov ebx, dword [ebp - 0x214]
add ebx, esi
cmp dword [ebp + 0xc], 0
jne 0x100018f3
sub ebx, 8
cmp dword [0x1000fb60], 0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
jne 0x10001942
push 0x40
push 0x3000
push 0x1ff
push 0
call esi
mov dword [0x1000fb60], eax
test eax, eax
jne 0x1000192e
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10001cd5
mov esp, ebp
pop ebp
ret
push 0x1ff
push dword [ebp - 0x224]
push eax
call fcn.10006250
add esp, 0xc
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
mov dword [ebp - 0x21c], 0
call fcn.10005c50
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push dword [0x1000fb5c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x100019ab
push 0x40
push 0x3000
push 0x104
push 0
call esi
test eax, eax
je 0x100019ad
mov ecx, 0x41
lea esi, [ebp - 0x20c]
mov edi, eax
rep movsd dword es:[edi], dword [esi]
jmp 0x100019ad
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
mov dword [ebx + 1], eax
pop esi
mov byte [ebx], 0x68
mov word [ebx + 5], 0x15ff
mov dword [ebx + 7], 0x1000fb60
mov word [ebx + 0xb], 0x15ff
mov dword [ebx + 0xd], 0x1000fb64
xor ecx, ebp
mov al, 1
pop ebx
call fcn.10001cd5
mov esp, ebp
pop ebp
ret