Function at 0x1007fab0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014c658
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
push edi
mov eax, dword [0x1018d0d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 8]
xor esi, esi
test ecx, ecx
jne 0x1007faf3
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ecx]
lea edx, [ebp + 8]
push edx
push 0x10159450
push ecx
mov dword [ebp + 8], esi
call dword [eax]
mov ecx, dword [ebp + 8]
xor edx, edx
test eax, eax
cmovs ecx, edx
mov dword [ebp + 8], ecx
mov dword [ebp - 4], edx
mov dword [ebp - 0x18], edx
mov byte [ebp - 4], 1
test ecx, ecx
je 0x1007fd5c
mov eax, dword [ecx]
lea edx, [ebp - 0x18]
push edx
push ecx
call dword [eax + 0x48]
test eax, eax
js 0x1007fd59
cmp dword [ebp - 0x18], 0
je 0x1007fd59
push str.RPCRT4.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1007fd54
push 0xc
lea ecx, [ebp - 0x2c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call sub.PSAPI.DLL_GetModuleInformation
test eax, eax
je 0x1007fd54
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
add eax, ecx
mov dword [0x1018fb60], ecx
mov dword [0x1018fb64], eax
xor ecx, ecx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], ecx
test eax, eax
je 0x1007fba7
mov ecx, dword [eax]
lea edx, [ebp - 0x10]
push edx
push 0x10159478
push eax
call dword [ecx]
mov ecx, dword [ebp - 0x10]
xor edx, edx
test eax, eax
cmovs ecx, edx
mov dword [ebp - 0x10], ecx
test ecx, ecx
je 0x1007fd54
mov dword [ebp - 0x14], 0
mov eax, dword [ecx]
lea edx, [ebp - 0x14]
push edx
push 0x10168800
push 0x101687f0
push ecx
mov byte [ebp - 4], 3
call dword [eax + 0xc]
mov ecx, dword [ebp - 0x14]
test eax, eax
js 0x1007fd35
test ecx, ecx
je 0x1007fd37
mov eax, dword [ebp - 0x18]
xor edx, edx
mov dword [ebp - 0x1c], edx
test eax, eax
je 0x1007fc0b
mov ecx, dword [eax]
lea edx, [ebp - 0x1c]
push edx
push 0x10159488
push eax
call dword [ecx]
mov edx, dword [ebp - 0x1c]
xor ecx, ecx
test eax, eax
cmovs edx, ecx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x1c], edx
mov byte [ebp - 4], 4
test edx, edx
je 0x1007fd35
mov eax, dword [edx + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
mov dword [ebp - 0x20], eax
mov eax, dword [edx + 0x10]
push 0xc
mov esi, dword [eax + 0x24]
push esi
call edi
test eax, eax
jne 0x1007fcba
cmp dword [esi], 0x424448b
je 0x1007fc47
cmp dword [esi + 4], 0xa0ff088b
jne 0x1007fcba
mov eax, dword [ebp - 0x20]
mov esi, dword [esi + 8]
push 4
add esi, dword [eax]
push esi
call edi
test eax, eax
jne 0x1007fcba
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_IsBadCodePtr]
test eax, eax
jne 0x1007fcba
push 0x10159498
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov dword [0x1018fb5c], eax
lea eax, [ebp - 0x20]
push eax
push 0x40
push 0x38
push 0x1018faec
mov dword [ebp - 0x20], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0x38
push 0
push 0x1018faec
call fcn.1011a400
push 0x1018faec
mov dword [0x1018faec], esi
mov dword [0x1018faf0], 0x1007f410
call fcn.10054180
add esp, 0x10
mov eax, dword [ebp - 0x14]
push 0x10
mov eax, dword [eax]
mov esi, dword [eax + 0x48]
push esi
call edi
test eax, eax
jne 0x1007fd0c
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push 0x40
push 0x38
push 0x1018fab4
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0x38
push 0
push 0x1018fab4
call fcn.1011a400
push 0x1018fab4
mov dword [0x1018fab4], esi
mov dword [0x1018fab8], 0x1007f920
call fcn.10054180
add esp, 0x10
mov eax, dword [ebp - 0x1c]
mov esi, 1
mov byte [ebp - 4], 3
test eax, eax
je 0x1007fd22
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], 2
test eax, eax
je 0x1007fd43
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x1007fd43
test ecx, ecx
mov byte [ebp - 4], 2
je 0x1007fd43
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, dword [ebp - 0x10]
mov byte [ebp - 4], 1
test eax, eax
je 0x1007fd54
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp + 8]
jmp 0x1007fd5e
mov ecx, dword [ebp + 8]
xor esi, esi
mov eax, dword [ebp - 0x18]
mov byte [ebp - 4], 0
test eax, eax
je 0x1007fd72
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], 0xffffffff
test ecx, ecx
je 0x1007fd83
mov edx, dword [ecx]
push ecx
call dword [edx + 8]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret