Function at 0x10018040
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 5
call fcn.10019470
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 4
mov ebx, eax
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x40
push 5
mov dword [ebx], 0x90909090
push 0x4d6c26
mov byte [ebx + 4], 0x90
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x100180ab
mov eax, dword [ebx]
mov ecx, 0x4d6c26
mov dword [ecx], eax
mov al, byte [ebx + 4]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 5
push ecx
call esi
test eax, eax
jne 0x100180ad
call edi
mov eax, 0x10017da0
mov byte [ebp - 0x10], 0xe9
sub eax, 0x4d6c2b
mov dword [ebp - 4], 0
mov dword [ebp - 0xf], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x4d6c26
call esi
test eax, eax
je 0x100180ff
mov eax, dword [ebp - 0x10]
mov ecx, 0x4d6c26
mov dword [ecx], eax
mov al, byte [ebp - 0xc]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 5
push ecx
call esi
test eax, eax
jne 0x10018101
call edi
push 5
call fcn.10019470
add esp, 4
mov dword [ebp - 4], 0
mov ebx, eax
lea eax, [ebp - 4]
push eax
push 0x40
push 5
mov dword [ebx], 0x90909090
push 0x4d8af0
mov byte [ebx + 4], 0x90
call esi
test eax, eax
je 0x10018157
mov eax, dword [ebx]
mov ecx, 0x4d8af0
mov dword [ecx], eax
mov al, byte [ebx + 4]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 5
push ecx
call esi
test eax, eax
jne 0x10018159
call edi
mov eax, 0x10017dc0
mov byte [ebp - 0x10], 0xe9
sub eax, 0x4d8af5
mov dword [ebp - 4], 0
mov dword [ebp - 0xf], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x4d8af0
call esi
test eax, eax
je 0x100181ab
mov eax, dword [ebp - 0x10]
mov ecx, 0x4d8af0
mov dword [ecx], eax
mov al, byte [ebp - 0xc]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 5
push ecx
call esi
test eax, eax
jne 0x100181ad
call edi
push 5
call fcn.10019470
add esp, 4
mov dword [ebp - 4], 0
mov ebx, eax
lea eax, [ebp - 4]
push eax
push 0x40
push 5
mov dword [ebx], 0x90909090
push 0x63d1ce
mov byte [ebx + 4], 0x90
call esi
test eax, eax
je 0x10018203
mov eax, dword [ebx]
mov ecx, 0x63d1ce
mov dword [ecx], eax
mov al, byte [ebx + 4]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 5
push ecx
call esi
test eax, eax
jne 0x10018205
call edi
mov eax, 0x10017e50
mov byte [ebp - 0x10], 0xe9
sub eax, 0x63d1d3
mov dword [ebp - 4], 0
mov dword [ebp - 0xf], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x63d1ce
call esi
test eax, eax
je 0x10018257
mov eax, dword [ebp - 0x10]
mov ecx, 0x63d1ce
mov dword [ecx], eax
mov al, byte [ebp - 0xc]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 5
push ecx
call esi
test eax, eax
jne 0x10018259
call edi
push 5
call fcn.10019470
add esp, 4
mov dword [ebp - 4], 0
mov ebx, eax
lea eax, [ebp - 4]
push eax
push 0x40
push 5
mov dword [ebx], 0x90909090
push 0x63d40f
mov byte [ebx + 4], 0x90
call esi
test eax, eax
je 0x100182af
mov eax, dword [ebx]
mov ecx, 0x63d40f
mov dword [ecx], eax
mov al, byte [ebx + 4]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 5
push ecx
call esi
test eax, eax
jne 0x100182b1
call edi
mov eax, 0x10017e80
mov byte [ebp - 0x10], 0xe9
sub eax, 0x63d414
mov dword [ebp - 4], 0
mov dword [ebp - 0xf], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x63d40f
call esi
test eax, eax
je 0x10018303
mov eax, dword [ebp - 0x10]
mov ecx, 0x63d40f
mov dword [ecx], eax
mov al, byte [ebp - 0xc]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 5
push ecx
call esi
test eax, eax
jne 0x10018305
call edi
push 5
call fcn.10019470
add esp, 4
mov dword [ebp - 4], 0
mov ebx, eax
lea eax, [ebp - 4]
push eax
push 0x40
push 5
mov dword [ebx], 0x90909090
push 0x63d1eb
mov byte [ebx + 4], 0x90
call esi
test eax, eax
je 0x1001835b
mov eax, dword [ebx]
mov ecx, 0x63d1eb
mov dword [ecx], eax
mov al, byte [ebx + 4]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 5
push ecx
call esi
test eax, eax
jne 0x1001835d
call edi
mov eax, 0x10017eb0
mov byte [ebp - 0x10], 0xe9
sub eax, 0x63d1f0
mov dword [ebp - 4], 0
mov dword [ebp - 0xf], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x63d1eb
call esi
test eax, eax
je 0x100183af
mov eax, dword [ebp - 0x10]
mov ecx, 0x63d1eb
mov dword [ecx], eax
mov al, byte [ebp - 0xc]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 5
push ecx
call esi
test eax, eax
jne 0x100183b1
call edi
push 5
call fcn.10019470
add esp, 4
mov dword [ebp - 4], 0
mov ebx, eax
lea eax, [ebp - 4]
push eax
push 0x40
push 5
mov dword [ebx], 0x90909090
push 0x63d42c
mov byte [ebx + 4], 0x90
call esi
test eax, eax
je 0x10018407
mov eax, dword [ebx]
mov ecx, 0x63d42c
mov dword [ecx], eax
mov al, byte [ebx + 4]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 5
push ecx
call esi
test eax, eax
jne 0x10018409
call edi
mov eax, 0x10017ee0
mov byte [ebp - 0x10], 0xe9
sub eax, 0x63d431
mov dword [ebp - 4], 0
mov dword [ebp - 0xf], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x63d42c
call esi
test eax, eax
je 0x1001845b
mov eax, dword [ebp - 0x10]
mov ecx, 0x63d42c
mov dword [ecx], eax
mov al, byte [ebp - 0xc]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 5
push ecx
call esi
test eax, eax
jne 0x1001845d
call edi
push 5
call fcn.10019470
add esp, 4
mov dword [ebp - 4], 0
mov ebx, eax
lea eax, [ebp - 4]
push eax
push 0x40
push 5
mov dword [ebx], 0x90909090
push 0x63d208
mov byte [ebx + 4], 0x90
call esi
test eax, eax
je 0x100184b3
mov eax, dword [ebx]
mov ecx, 0x63d208
mov dword [ecx], eax
mov al, byte [ebx + 4]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 5
push ecx
call esi
test eax, eax
jne 0x100184b5
call edi
mov eax, 0x10017f10
mov byte [ebp - 0x10], 0xe9
sub eax, 0x63d20d
mov dword [ebp - 4], 0
mov dword [ebp - 0xf], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x63d208
call esi
test eax, eax
je 0x10018507
mov eax, dword [ebp - 0x10]
mov ecx, 0x63d208
mov dword [ecx], eax
mov al, byte [ebp - 0xc]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 5
push ecx
call esi
test eax, eax
jne 0x10018509
call edi
push 5
call fcn.10019470
add esp, 4
mov dword [ebp - 4], 0
mov ebx, eax
lea eax, [ebp - 4]
push eax
push 0x40
push 5
mov dword [ebx], 0x90909090
push 0x63d449
mov byte [ebx + 4], 0x90
call esi
test eax, eax
je 0x1001855f
mov eax, dword [ebx]
mov ecx, 0x63d449
mov dword [ecx], eax
mov al, byte [ebx + 4]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 5
push ecx
call esi
test eax, eax
jne 0x10018561
call edi
mov eax, 0x10017f40
mov byte [ebp - 0x10], 0xe9
sub eax, 0x63d44e
mov dword [ebp - 4], 0
mov dword [ebp - 0xf], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x63d449
call esi
test eax, eax
je 0x100185b3
mov eax, dword [ebp - 0x10]
mov ecx, 0x63d449
mov dword [ecx], eax
mov al, byte [ebp - 0xc]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 5
push ecx
call esi
test eax, eax
jne 0x100185b5
call edi
push 5
call fcn.10019470
add esp, 4
mov dword [ebp - 4], 0
mov ebx, eax
lea eax, [ebp - 4]
push eax
push 0x40
push 5
mov dword [ebx], 0x90909090
push 0x63d225
mov byte [ebx + 4], 0x90
call esi
test eax, eax
je 0x1001860b
mov eax, dword [ebx]
mov ecx, 0x63d225
mov dword [ecx], eax
mov al, byte [ebx + 4]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 5
push ecx
call esi
test eax, eax
jne 0x1001860d
call edi
mov eax, 0x10017f70
mov byte [ebp - 0x10], 0xe9
sub eax, 0x63d22a
mov dword [ebp - 4], 0
mov dword [ebp - 0xf], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x63d225
call esi
test eax, eax
je 0x1001865f
mov eax, dword [ebp - 0x10]
mov ecx, 0x63d225
mov dword [ecx], eax
mov al, byte [ebp - 0xc]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 5
push ecx
call esi
test eax, eax
jne 0x10018661
call edi
push 5
call fcn.10019470
add esp, 4
mov dword [ebp - 4], 0
mov ebx, eax
lea eax, [ebp - 4]
push eax
push 0x40
push 5
mov dword [ebx], 0x90909090
push 0x63d466
mov byte [ebx + 4], 0x90
call esi
test eax, eax
je 0x100186b7
mov eax, dword [ebx]
mov ecx, 0x63d466
mov dword [ecx], eax
mov al, byte [ebx + 4]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 5
push ecx
call esi
test eax, eax
jne 0x100186b9
call edi
mov eax, 0x10017fa0
mov byte [ebp - 0x10], 0xe9
sub eax, 0x63d46b
mov dword [ebp - 4], 0
mov dword [ebp - 0xf], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x63d466
call esi
test eax, eax
je 0x1001870b
mov eax, dword [ebp - 0x10]
mov ecx, 0x63d466
mov dword [ecx], eax
mov al, byte [ebp - 0xc]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 5
push ecx
call esi
test eax, eax
jne 0x1001870d
call edi
push 5
call fcn.10019470
add esp, 4
mov dword [ebp - 4], 0
mov ebx, eax
lea eax, [ebp - 4]
push eax
push 0x40
push 5
mov dword [ebx], 0x90909090
push 0x63d242
mov byte [ebx + 4], 0x90
call esi
test eax, eax
je 0x10018763
mov eax, dword [ebx]
mov ecx, 0x63d242
mov dword [ecx], eax
mov al, byte [ebx + 4]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 5
push ecx
call esi
test eax, eax
jne 0x10018765
call edi
mov eax, 0x10017fd0
mov byte [ebp - 0x10], 0xe9
sub eax, 0x63d247
mov dword [ebp - 4], 0
mov dword [ebp - 0xf], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x63d242
call esi
test eax, eax
je 0x100187b7
mov eax, dword [ebp - 0x10]
mov ecx, 0x63d242
mov dword [ecx], eax
mov al, byte [ebp - 0xc]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 5
push ecx
call esi
test eax, eax
jne 0x100187b9
call edi
push 5
call fcn.10019470
add esp, 4
mov dword [ebp - 4], 0
mov ebx, eax
lea eax, [ebp - 4]
push eax
push 0x40
push 5
mov dword [ebx], 0x90909090
push 0x63d483
mov byte [ebx + 4], 0x90
call esi
test eax, eax
je 0x1001880f
mov eax, dword [ebx]
mov ecx, 0x63d483
mov dword [ecx], eax
mov al, byte [ebx + 4]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 5
push ecx
call esi
test eax, eax
jne 0x10018811
call edi
mov eax, 0x10018000
mov byte [ebp - 0x10], 0xe9
sub eax, 0x63d488
mov dword [ebp - 4], 0
mov dword [ebp - 0xf], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x63d483
call esi
test eax, eax
je 0x10018863
mov eax, dword [ebp - 0x10]
mov ecx, 0x63d483
mov dword [ecx], eax
mov al, byte [ebp - 0xc]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 5
push ecx
call esi
test eax, eax
jne 0x10018865
call edi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x40
push 1
push 0x57f0fc
mov bl, 0xe9
call esi
test eax, eax
je 0x100188a3
mov eax, 0x57f0fc
mov byte [eax], bl
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 1
push 0x57f0fc
call esi
test eax, eax
jne 0x100188a5
call edi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x40
push 1
push 0x57f0fd
mov bl, 0x4a
call esi
test eax, eax
je 0x100188e3
mov eax, 0x57f0fd
mov byte [eax], bl
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 1
push 0x57f0fd
call esi
test eax, eax
jne 0x100188e5
call edi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x40
push 1
push 0x57f0fe
mov bl, 1
call esi
test eax, eax
je 0x10018923
mov eax, 0x57f0fe
mov byte [eax], bl
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 1
push 0x57f0fe
call esi
test eax, eax
jne 0x10018925
call edi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x40
push 1
push 0x57f0ff
xor bl, bl
call esi
test eax, eax
je 0x10018963
mov eax, 0x57f0ff
mov byte [eax], bl
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 1
push 0x57f0ff
call esi
test eax, eax
jne 0x10018965
call edi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x40
push 1
push 0x57f100
xor bl, bl
call esi
test eax, eax
je 0x100189a3
mov eax, 0x57f100
mov byte [eax], bl
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 1
push 0x57f100
call esi
test eax, eax
jne 0x100189a5
call edi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x40
push 1
push 0x57f101
mov bl, 0x90
call esi
test eax, eax
je 0x100189e3
mov eax, 0x57f101
mov byte [eax], bl
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 1
push 0x57f101
call esi
test eax, eax
jne 0x100189e5
call edi
push 6
call fcn.10019470
mov ebx, eax
mov dword [ebp - 4], 0
add esp, 4
mov eax, 0x90909090
mov dword [ebx], eax
mov word [ebx + 4], ax
lea eax, [ebp - 4]
push eax
push 0x40
push 6
push 0x503839
call esi
test eax, eax
je 0x10018a3e
mov eax, dword [ebx]
mov ecx, 0x503839
mov dword [ecx], eax
mov ax, word [ebx + 4]
mov word [ecx + 4], ax
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 6
push ecx
call esi
test eax, eax
jne 0x10018a40
call edi
mov eax, 0x10018030
mov byte [ebp - 0x10], 0xe9
sub eax, 0x50383e
mov dword [ebp - 4], 0
mov dword [ebp - 0xf], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x503839
call esi
test eax, eax
je 0x10018a92
mov eax, dword [ebp - 0x10]
mov ecx, 0x503839
mov dword [ecx], eax
mov al, byte [ebp - 0xc]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 5
push ecx
call esi
test eax, eax
jne 0x10018a94
call edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret