Function at 0x10016120
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0xe61144
call edi
lea eax, [ebp - 4]
mov byte [0xe61144], 0xa0
push eax
push dword [ebp - 4]
push 1
push 0xe61144
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x4d1e69
call edi
lea eax, [ebp - 4]
mov byte [0x4d1e69], 0xeb
push eax
push dword [ebp - 4]
push 1
push 0x4d1e69
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x4d228d
call edi
lea eax, [ebp - 4]
mov byte [0x4d228d], 0xe9
push eax
push dword [ebp - 4]
push 1
push 0x4d228d
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x4d228e
call edi
lea eax, [ebp - 4]
mov byte [0x4d228e], 0x8b
push eax
push dword [ebp - 4]
push 1
push 0x4d228e
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x4d228f
call edi
lea eax, [ebp - 4]
mov byte [0x4d228f], 0
push eax
push dword [ebp - 4]
push 1
push 0x4d228f
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x4d2290
call edi
lea eax, [ebp - 4]
mov byte [0x4d2290], 0
push eax
push dword [ebp - 4]
push 1
push 0x4d2290
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x4d2291
call edi
lea eax, [ebp - 4]
mov byte [0x4d2291], 0
push eax
push dword [ebp - 4]
push 1
push 0x4d2291
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x4d559c
call edi
lea eax, [ebp - 4]
mov byte [0x4d559c], 0xeb
push eax
push dword [ebp - 4]
push 1
push 0x4d559c
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x633f7a
call edi
lea eax, [ebp - 4]
mov byte [0x633f7a], 0xeb
push eax
push dword [ebp - 4]
push 1
push 0x633f7a
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x634403
call edi
lea eax, [ebp - 4]
mov byte [0x634403], 0xeb
push eax
push dword [ebp - 4]
push 1
push 0x634403
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x63e6c4
call edi
lea eax, [ebp - 4]
mov byte [0x63e6c4], 0xeb
push eax
push dword [ebp - 4]
push 1
push 0x63e6c4
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x4d2246
call edi
lea eax, [ebp - 4]
mov byte [0x4d2246], 0xeb
push eax
push dword [ebp - 4]
push 1
push 0x4d2246
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x501163
call edi
lea eax, [ebp - 4]
mov byte [0x501163], 0xeb
push eax
push dword [ebp - 4]
push 1
push 0x501163
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x40af0a
call edi
lea eax, [ebp - 4]
mov byte [0x40af0a], 0
push eax
push dword [ebp - 4]
push 1
push 0x40af0a
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x40b4bc
call edi
lea eax, [ebp - 4]
mov byte [0x40b4bc], 0x50
push eax
push dword [ebp - 4]
push 1
push 0x40b4bc
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x40b4c5
call edi
lea eax, [ebp - 4]
mov byte [0x40b4c5], 0x50
push eax
push dword [ebp - 4]
push 1
push 0x40b4c5
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x40b4cf
call edi
lea eax, [ebp - 4]
mov byte [0x40b4cf], 0x18
push eax
push dword [ebp - 4]
push 1
push 0x40b4cf
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x40af0a
call edi
lea eax, [ebp - 4]
mov byte [0x40af0a], 0
push eax
push dword [ebp - 4]
push 1
push 0x40af0a
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x40afd5
call edi
lea eax, [ebp - 4]
mov byte [0x40afd5], 0xeb
push eax
push dword [ebp - 4]
push 1
push 0x40afd5
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x777fd6
call edi
lea eax, [ebp - 4]
mov byte [0x777fd6], 0x70
push eax
push dword [ebp - 4]
push 1
push 0x777fd6
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x777fd7
call edi
lea eax, [ebp - 4]
mov byte [0x777fd7], 0x17
push eax
push dword [ebp - 4]
push 1
push 0x777fd7
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x4ebec7
call edi
lea eax, [ebp - 4]
mov byte [0x4ebec7], 0x3c
push eax
push dword [ebp - 4]
push 1
push 0x4ebec7
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x5c4004
call edi
lea eax, [ebp - 4]
mov byte [0x5c4004], 0x3c
push eax
push dword [ebp - 4]
push 1
push 0x5c4004
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x7e40bb
call edi
lea eax, [ebp - 4]
mov byte [0x7e40bb], 0x3c
push eax
push dword [ebp - 4]
push 1
push 0x7e40bb
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x81b546
call edi
mov byte [0x81b546], 0x3c
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 1
push 0x81b546
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x81b58d
call edi
lea eax, [ebp - 4]
mov byte [0x81b58d], 0x3c
push eax
push dword [ebp - 4]
push 1
push 0x81b58d
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x86e284
call edi
lea eax, [ebp - 4]
mov byte [0x86e284], 0x3c
push eax
push dword [ebp - 4]
push 1
push 0x86e284
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x86e44c
call edi
lea eax, [ebp - 4]
mov byte [0x86e44c], 0x3c
push eax
push dword [ebp - 4]
push 1
push 0x86e44c
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x86e573
call edi
lea eax, [ebp - 4]
mov byte [0x86e573], 0x3c
push eax
push dword [ebp - 4]
push 1
push 0x86e573
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x86f8fc
call edi
lea eax, [ebp - 4]
mov byte [0x86f8fc], 0x3c
push eax
push dword [ebp - 4]
push 1
push 0x86f8fc
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x7da373
call edi
lea eax, [ebp - 4]
mov byte [0x7da373], 0xb7
push eax
push dword [ebp - 4]
push 1
push 0x7da373
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x7e1c44
call edi
lea eax, [ebp - 4]
mov byte [0x7e1c44], 0xb7
push eax
push dword [ebp - 4]
push 1
push 0x7e1c44
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x52100d
call edi
lea eax, [ebp - 4]
mov byte [0x52100d], 0xeb
push eax
push dword [ebp - 4]
push 1
push 0x52100d
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x9543c4
call edi
lea eax, [ebp - 4]
mov byte [0x9543c4], 0
push eax
push dword [ebp - 4]
push 1
push 0x9543c4
call edi
cmp dword [0x102e061c], 0
mov eax, 0xeb
mov ebx, 0x50
cmove ebx, eax
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x64cbd1
call edi
lea eax, [ebp - 4]
mov byte [0x64cbd1], bl
push eax
push dword [ebp - 4]
push 1
push 0x64cbd1
call edi
mov bl, byte [0x102e0620]
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x64cbd0
call edi
lea eax, [ebp - 4]
mov byte [0x64cbd0], bl
push eax
push dword [ebp - 4]
push 1
push 0x64cbd0
call edi
mov bl, byte [0x102e0620]
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x95ceef
call edi
mov byte [0x95ceef], bl
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 1
push 0x95ceef
call edi
mov bl, byte [0x102e0620]
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x95cf14
call edi
lea eax, [ebp - 4]
mov byte [0x95cf14], bl
push eax
push dword [ebp - 4]
push 1
push 0x95cf14
call edi
mov bl, byte [0x102e0490]
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0xe61f68
inc bl
call edi
lea eax, [ebp - 4]
mov byte [0xe61f68], bl
push eax
push dword [ebp - 4]
push 1
push 0xe61f68
call edi
mov bl, byte [0x102e0492]
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0xe61f69
add bl, 2
call edi
lea eax, [ebp - 4]
mov byte [0xe61f69], bl
push eax
push dword [ebp - 4]
push 1
push 0xe61f69
call edi
mov bl, byte [0x102e0493]
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0xe61f6a
add bl, 3
call edi
lea eax, [ebp - 4]
mov byte [0xe61f6a], bl
push eax
push dword [ebp - 4]
push 1
push 0xe61f6a
call edi
mov bl, byte [0x102e0495]
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0xe61f6b
add bl, 4
call edi
lea eax, [ebp - 4]
mov byte [0xe61f6b], bl
push eax
push dword [ebp - 4]
push 1
push 0xe61f6b
call edi
mov bl, byte [0x102e0496]
add bl, 5
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0xe61f6c
call edi
lea eax, [ebp - 4]
mov byte [0xe61f6c], bl
push eax
push dword [ebp - 4]
push 1
push 0xe61f6c
call edi
movzx esi, word [0x102e0486]
lea eax, [ebp - 4]
push eax
push 0x40
push 2
push 0xe609e4
call edi
lea eax, [ebp - 4]
mov word [0xe609e4], si
push eax
push dword [ebp - 4]
push 2
push 0xe609e4
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x4d9d3b
call edi
lea eax, [ebp - 4]
mov dword [0x4d9d3b], 0x11329aec
push eax
push dword [ebp - 4]
push 4
push 0x4d9d3b
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x4dac60
call edi
lea eax, [ebp - 4]
mov dword [0x4dac60], 0x11329aec
push eax
push dword [ebp - 4]
push 4
push 0x4dac60
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x4d0e09
call edi
lea eax, [ebp - 4]
mov dword [0x4d0e09], 0x102e04a9
push eax
push dword [ebp - 4]
push 4
push 0x4d0e09
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x4d9f55
call edi
lea eax, [ebp - 4]
mov dword [0x4d9f55], 0x102e04c9
push eax
push dword [ebp - 4]
push 4
push 0x4d9f55
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 0x14
push 0x63e908
call edi
mov eax, 0x63e908
mov dword [eax], 0x90909090
mov dword [eax + 4], 0x90909090
mov dword [eax + 8], 0x90909090
mov dword [eax + 0xc], 0x90909090
mov dword [eax + 0x10], 0x90909090
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 0x14
push 0x63e908
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 0x20
push 0xe611b2
call edi
movups xmm0, xmmword [0x102e0465]
mov eax, 0xe611b2
movups xmmword [eax], xmm0
movups xmm0, xmmword [0x102e0475]
movups xmmword [eax + 0x10], xmm0
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 0x20
push 0xe611b2
call edi
lea eax, [ebp - 4]
push eax
push 0x40
push 0x11
push 0xe61f70
call edi
movups xmm0, xmmword [0x102e0498]
mov ecx, 0xe61f70
movups xmmword [ecx], xmm0
mov al, byte [0x102e04a8]
mov byte [ecx + 0x10], al
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 0x11
push ecx
call edi
push fcn.100c0f40
push 0x65fd79
push 0xff
call fcn.100d0480
mov ebx, dword [0x102e0720]
add esp, 0xc
cmp ebx, 5
je 0x10016a26
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x4d9f04
call edi
lea eax, [ebp - 4]
mov byte [0x4d9f04], bl
push eax
push dword [ebp - 4]
push 1
push 0x4d9f04
call edi
mov bl, byte [0x102e0720]
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x4da3b3
call edi
lea eax, [ebp - 4]
mov byte [0x4da3b3], bl
push eax
push dword [ebp - 4]
push 1
push 0x4da3b3
call edi
mov bl, byte [0x102e0720]
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x4da3e0
call edi
lea eax, [ebp - 4]
mov byte [0x4da3e0], bl
push eax
push dword [ebp - 4]
push 1
push 0x4da3e0
call edi
mov bl, byte [0x102e0720]
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x4da3af
call edi
lea eax, [ebp - 4]
mov byte [0x4da3af], bl
push eax
push dword [ebp - 4]
push 1
push 0x4da3af
call edi
push 0x11478570
mov edx, 0x6a
call fcn.100d0500
push 0x11478480
mov edx, 0x6b
call fcn.100d0500
push 0x11478660
mov edx, 0x6c
call fcn.100d0500
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret