Function at 0x1003fe20
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10047ff0
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x10054040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [0x100552cc]
lea eax, [ebp - 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esi, 0x783f0
push eax
push 0x40
push 9
push esi
call edi
movq xmm0, qword [0x1004e990]
movq qword [esi], xmm0
movzx eax, byte [0x1004e998]
mov byte [esi + 8], al
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x14]
push 9
push esi
call edi
mov esi, dword [0x100552cc]
lea eax, [ebp - 0x14]
push eax
push 0x40
push 6
add esi, 0x78405
push esi
call edi
mov eax, dword [0x1004e99c]
mov dword [esi], eax
movzx eax, word [0x1004e9a0]
mov word [esi + 4], ax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x14]
push 6
push esi
call edi
mov esi, dword [0x100552cc]
lea eax, [ebp - 0x14]
push eax
push 0x40
push 5
add esi, 0x20fee0
push esi
call edi
mov eax, dword [0x1004e9a4]
mov dword [esi], eax
movzx eax, byte [0x1004e9a8]
mov byte [esi + 4], al
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x14]
push 5
push esi
call edi
mov esi, dword [0x100552cc]
lea eax, [ebp - 0x14]
push eax
push 0x40
push 5
add esi, 0x5ca38
push esi
call edi
mov eax, dword [0x1004e9ac]
mov dword [esi], eax
movzx eax, byte [0x1004e9b0]
mov byte [esi + 4], al
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x14]
push 5
push esi
call edi
mov esi, dword [0x100552cc]
lea eax, [ebp - 0x14]
push eax
push 0x40
add esi, 0x4f49b
push 6
push esi
call edi
mov eax, dword [0x1004e9b4]
mov dword [esi], eax
movzx eax, word [0x1004e9b8]
mov word [esi + 4], ax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x14]
push 6
push esi
call edi
mov esi, dword [0x100552cc]
lea eax, [ebp - 0x14]
push eax
push 0x40
push 6
add esi, 0x77593
push esi
call edi
mov eax, dword [0x1004e9bc]
mov dword [esi], eax
movzx eax, word [0x1004e9c0]
mov word [esi + 4], ax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x14]
push 6
push esi
call edi
mov esi, dword [0x100552cc]
lea eax, [ebp - 0x14]
push eax
push 0x40
push 6
add esi, 0x101b6f
push esi
call edi
mov eax, dword [0x1004e9c4]
mov dword [esi], eax
movzx eax, word [0x1004e9c8]
mov word [esi + 4], ax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x14]
push 6
push esi
call edi
mov esi, dword [0x100552cc]
lea eax, [ebp - 0x14]
push eax
push 0x40
push 5
add esi, 0x7da5c
push esi
call edi
mov eax, dword [0x1004e9cc]
mov dword [esi], eax
movzx eax, byte [0x1004e9d0]
mov byte [esi + 4], al
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x14]
push 5
push esi
call edi
mov esi, dword [0x100552cc]
lea eax, [ebp - 0x14]
push eax
push 0x40
add esi, 0x2d6fb8
push 6
push esi
call edi
mov eax, dword [0x1004e9d4]
mov dword [esi], eax
movzx eax, word [0x1004e9d8]
mov word [esi + 4], ax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x14]
push 6
push esi
call edi
mov esi, dword [0x100552cc]
lea eax, [ebp - 0x14]
push eax
push 0x40
push 6
add esi, 0x14b85
push esi
call edi
mov eax, dword [0x1004e9dc]
mov dword [esi], eax
movzx eax, word [0x1004e9e0]
mov word [esi + 4], ax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x14]
push 6
push esi
call edi
mov esi, dword [0x100552cc]
lea eax, [ebp - 0x14]
push eax
push 0x40
push 0xa
add esi, 0x5cf40
push esi
call edi
movq xmm0, qword [0x1004e9e4]
movq qword [esi], xmm0
movzx eax, word [0x1004e9ec]
mov word [esi + 8], ax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x14]
push 0xa
push esi
call edi
mov esi, dword [0x100552cc]
lea eax, [ebp - 0x14]
push eax
push 0x40
push 5
add esi, 0x26467
push esi
call edi
mov eax, dword [0x1004e9f0]
mov dword [esi], eax
movzx eax, byte [0x1004e9f4]
mov byte [esi + 4], al
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x14]
push 5
push esi
call edi
mov esi, dword [0x100552cc]
lea eax, [ebp - 0x14]
push eax
push 0x40
push 6
add esi, 0x2ed069
push esi
call edi
mov eax, dword [0x1004e9f8]
mov dword [esi], eax
movzx eax, word [0x1004e9fc]
mov word [esi + 4], ax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x14]
push 6
push esi
call edi
mov esi, dword [0x100552cc]
lea eax, [ebp - 0x14]
push eax
push 0x40
add esi, 0x2e43a4
push 6
push esi
call edi
mov eax, dword [0x1004ea00]
mov dword [esi], eax
movzx eax, word [0x1004ea04]
mov word [esi + 4], ax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x14]
push 6
push esi
call edi
mov esi, dword [0x100552cc]
lea eax, [ebp - 0x14]
push eax
push 0x40
push 8
add esi, 0x2f6ea0
push esi
call edi
lea eax, [ebp - 0x18]
mov dword [esi], 0xe8345ed9
push eax
push dword [ebp - 0x14]
mov dword [esi + 4], 0xffffd2a8
push 8
push esi
call edi
mov esi, dword [0x100552cc]
lea eax, [ebp - 0x14]
push eax
push 0x40
push 6
add esi, 0x2f8de4
push esi
call edi
mov eax, dword [0x1004ea00]
mov dword [esi], eax
movzx eax, word [0x1004ea04]
mov word [esi + 4], ax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x14]
push 6
push esi
call edi
mov esi, dword [0x100552cc]
lea eax, [ebp - 0x14]
push eax
push 0x40
push 7
add esi, 0x2fae50
push esi
call edi
mov eax, dword [0x1004ea08]
mov dword [esi], eax
movzx eax, word [0x1004ea0c]
mov word [esi + 4], ax
movzx eax, byte [0x1004ea0e]
mov byte [esi + 6], al
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x14]
push 7
push esi
call edi
mov esi, dword [0x100552cc]
lea eax, [ebp - 0x14]
push eax
push 0x40
add esi, 0x26135
push 6
push esi
call edi
mov eax, dword [0x1004ea10]
mov dword [esi], eax
movzx eax, word [0x1004ea14]
mov word [esi + 4], ax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x14]
push 6
push esi
call edi
mov esi, dword [0x100552cc]
lea eax, [ebp - 0x14]
push eax
push 0x40
push 5
add esi, 0x3b01c
push esi
call edi
mov eax, dword [0x1004ea18]
mov dword [esi], eax
movzx eax, byte [0x1004ea1c]
mov byte [esi + 4], al
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x14]
push 5
push esi
call edi
mov esi, dword [0x100552cc]
lea eax, [ebp - 0x1c]
push eax
push 0x40
push 5
add esi, 0x10cd30
push esi
call edi
mov eax, dword [0x1004ea20]
mov dword [esi], eax
movzx eax, byte [0x1004ea24]
mov byte [esi + 4], al
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x1c]
push 5
push esi
call edi
mov edi, dword [0x10055178]
test edi, edi
je 0x1004028c
mov esi, dword [edi + 0x78]
jmp 0x1004028e
xor esi, esi
call fcn.100290b0
mov ecx, dword [esi]
test ecx, ecx
je 0x1004029f
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, dword [0x10055178]
mov dword [edi + 0x70], 0
mov dword [edi + 0x78], 0
test eax, eax
je 0x100402bc
dec dword [eax + 0xb0]
mov edi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
push esi
call edi
mov eax, dword [0x10055178]
add esp, 4
test eax, eax
je 0x100402d6
mov esi, dword [eax + 0x74]
jmp 0x100402d8
xor esi, esi
mov ecx, dword [esi + 0x28]
lea ebx, [eax + 8]
test ecx, ecx
je 0x100402ee
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [0x10055178]
mov dword [ebx + 0x64], 0
mov dword [ebx + 0x6c], 0
test eax, eax
je 0x10040306
dec dword [eax + 0xb0]
push esi
call edi
mov esi, dword [0x10055178]
add esp, 4
mov dword [0x10055178], esi
call fcn.10008ef0
mov dword [0x10055178], 0
test esi, esi
je 0x10040347
mov ecx, esi
call fcn.10019290
mov eax, dword [0x10055178]
test eax, eax
je 0x10040341
dec dword [eax + 0xb0]
push esi
call edi
add esp, 4
push dword [0x100552b4]
push 0xfffffffffffffffc
push dword [0x100552f8]
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov dword [ebp - 4], 0
mov ecx, dword [0x10055280]
test ecx, ecx
je 0x1004037c
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [0x10055280], 0
mov ecx, dword [0x10055278]
test ecx, ecx
je 0x10040396
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [0x10055278], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100462db
mov esp, ebp
pop ebp
ret