Function at 0x100262b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [ebp + 8], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
je 0x10026792
push esi
lea eax, [ebp - 4]
mov byte [ebp + 0xb], 0xe9
push eax
push 1
lea eax, [ebp + 0xb]
push eax
push 0x4bc801
call ebx
push eax
call edi
mov eax, 0x10026ef0
sub eax, 0x4bc806
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 4
lea eax, [ebp - 8]
push eax
push 0x4bc802
call ebx
push eax
call edi
push 0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0x1013f400], eax
lea eax, [ebp - 8]
push eax
push 1
lea eax, [ebp + 0xb]
mov byte [ebp + 0xb], 0xe9
push eax
push 0x4db44c
call ebx
push eax
call edi
mov eax, 0x100277c0
sub eax, 0x4db451
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
push 0x4db44d
call ebx
push eax
call edi
push 0
push 1
lea eax, [ebp + 8]
mov byte [ebp + 8], 0xeb
push eax
push 0x4e240f
call ebx
push eax
call edi
push 0
push 1
lea eax, [ebp + 8]
mov byte [ebp + 8], 0xeb
push eax
push 0x4e2499
call ebx
push eax
call edi
push 0
push 1
lea eax, [ebp + 8]
mov byte [ebp + 8], 0xeb
push eax
push 0x4e24eb
call ebx
push eax
call edi
push 0
push 1
lea eax, [ebp + 8]
mov byte [ebp + 8], 0xeb
push eax
push 0x4e272f
call ebx
push eax
call edi
push 0
push 1
lea eax, [ebp + 8]
mov byte [ebp + 8], 0x43
push eax
push 0x4e2730
call ebx
push eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push 0x4e2731
call esi
mov eax, 0x4e2731
mov dword [eax], 0x90909090
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 4
push 0x4e2731
call esi
lea eax, [ebp - 8]
mov byte [ebp + 0xb], 0xe9
push eax
push 1
lea eax, [ebp + 0xb]
push eax
push 0x4bc421
call ebx
push eax
call edi
mov eax, 0x10027060
sub eax, 0x4bc426
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
push 0x4bc422
call ebx
push eax
call edi
lea eax, [ebp - 8]
mov byte [ebp + 0xb], 0xe9
push eax
push 1
lea eax, [ebp + 0xb]
push eax
push 0x4e2491
call ebx
push eax
call edi
mov eax, 0x10026fa0
sub eax, 0x4e2496
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
push 0x4e2492
call ebx
push eax
call edi
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push 0x4e2496
call esi
mov eax, 0x4e2496
mov byte [eax], 0x90
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 1
push 0x4e2496
call esi
lea eax, [ebp - 8]
mov byte [ebp + 0xb], 0xe9
push eax
push 1
lea eax, [ebp + 0xb]
push eax
push 0x5a29c3
call ebx
push eax
call edi
mov eax, 0x100274c0
sub eax, 0x5a29c8
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
push 0x5a29c4
call ebx
push eax
call edi
lea eax, [ebp - 8]
mov byte [ebp + 0xb], 0xe9
push eax
push 1
lea eax, [ebp + 0xb]
push eax
push 0x4e298f
call ebx
push eax
call edi
mov eax, 0x10026fd0
sub eax, 0x4e2994
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
push 0x4e2990
call ebx
push eax
call edi
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push 0x4e2994
call esi
mov eax, 0x4e2994
mov byte [eax], 0x90
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 1
push 0x4e2994
call esi
lea eax, [ebp - 8]
mov byte [ebp + 0xb], 0xe9
push eax
push 1
lea eax, [ebp + 0xb]
push eax
push 0x4e29a5
call ebx
push eax
call edi
mov eax, 0x10026ff0
sub eax, 0x4e29aa
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
push 0x4e29a6
call ebx
push eax
call edi
lea eax, [ebp - 8]
mov byte [ebp + 0xb], 0xe9
push eax
push 1
lea eax, [ebp + 0xb]
push eax
push 0x4e27aa
call ebx
push eax
call edi
mov eax, 0x10027040
sub eax, 0x4e27af
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
push 0x4e27ab
call ebx
push eax
call edi
lea eax, [ebp - 8]
mov byte [ebp + 0xb], 0xe9
push eax
push 1
lea eax, [ebp + 0xb]
push eax
push 0x4de05e
call ebx
push eax
call edi
mov eax, 0x10026cb0
sub eax, 0x4de063
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
push 0x4de05f
call ebx
push eax
call edi
lea eax, [ebp - 8]
mov byte [ebp + 0xb], 0xe9
push eax
push 1
lea eax, [ebp + 0xb]
push eax
push 0x5abfab
call ebx
push eax
call edi
mov eax, 0x10026cd0
sub eax, 0x5abfb0
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
push 0x5abfac
call ebx
push eax
call edi
lea eax, [ebp - 0xc]
push eax
push 0x40
push 2
push 0x5abfb0
call esi
mov eax, 0x5abfb0
mov ecx, 0x90909090
mov word [eax], cx
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 2
push 0x5abfb0
call esi
lea eax, [ebp - 8]
mov byte [ebp + 0xb], 0xe9
push eax
push 1
lea eax, [ebp + 0xb]
push eax
push 0x4e2538
call ebx
push eax
call edi
mov eax, 0x10026cf0
sub eax, 0x4e253d
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
push 0x4e2539
call ebx
push eax
call edi
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push 0x4e253d
call esi
mov eax, 0x4e253d
mov byte [eax], 0x90
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push 1
push 0x4e253d
call esi
lea eax, [ebp - 8]
mov byte [ebp + 0xb], 0xe9
push eax
push 1
lea eax, [ebp + 0xb]
push eax
push 0x4ba88f
call ebx
push eax
call edi
mov eax, 0x10026d10
sub eax, 0x4ba894
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
push 0x4ba890
call ebx
push eax
call edi
lea eax, [ebp - 8]
mov byte [ebp + 0xb], 0xe9
push eax
push 1
lea eax, [ebp + 0xb]
push eax
push 0x4e285b
call ebx
push eax
call edi
mov eax, 0x10026d40
sub eax, 0x4e2860
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
push 0x4e285c
call ebx
push eax
call edi
lea eax, [ebp - 8]
mov byte [ebp + 0xb], 0xe9
push eax
push 1
lea eax, [ebp + 0xb]
push eax
push 0x4bc971
call ebx
push eax
call edi
mov eax, 0x100278c0
sub eax, 0x4bc976
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
push 0x4bc972
call ebx
push eax
call edi
push 0
push 1
lea eax, [ebp + 8]
mov byte [ebp + 8], 0xeb
push eax
push 0x4e22ae
call ebx
push eax
call edi
push 0
push 1
lea eax, [ebp + 8]
mov byte [ebp + 8], 0x3b
push eax
push 0x4d889d
call ebx
push eax
call edi
push 0
push 1
lea eax, [ebp + 8]
mov byte [ebp + 8], 0x42
push eax
push 0x4d889e
call ebx
push eax
call edi
push 0
push 1
lea eax, [ebp + 8]
mov byte [ebp + 8], 0xf
push eax
push 0x4d889f
call ebx
push eax
call edi
pop esi
push 0
push 1
lea eax, [ebp + 8]
mov byte [ebp + 8], 0x3e
push eax
push 0x4d7822
call ebx
push eax
call edi
push 0
push 1
lea eax, [ebp + 8]
mov byte [ebp + 8], 0x42
push eax
push 0x4d7823
call ebx
push eax
call edi
push 0
push 1
lea eax, [ebp + 8]
mov byte [ebp + 8], 0xf
push eax
push 0x4d7824
call ebx
push eax
call edi
push 0
push 1
lea eax, [ebp + 8]
mov byte [ebp + 8], 0x3d
push eax
push 0x4d773b
call ebx
push eax
call edi
push 0
push 1
lea eax, [ebp + 8]
mov byte [ebp + 8], 0x42
push eax
push 0x4d773c
call ebx
push eax
call edi
push 0
push 1
lea eax, [ebp + 8]
mov byte [ebp + 8], 0xf
push eax
push 0x4d773d
call ebx
push eax
call edi
lea eax, [ebp - 8]
mov byte [ebp + 0xb], 0xe9
push eax
push 1
lea eax, [ebp + 0xb]
push eax
push 0x4ac310
call ebx
push eax
call edi
mov eax, 0x10027cf0
sub eax, 0x4ac315
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
push 0x4ac311
call ebx
push eax
call edi
lea eax, [ebp - 8]
mov byte [ebp + 0xb], 0xe9
push eax
push 1
lea eax, [ebp + 0xb]
push eax
push 0x5a6cdc
call ebx
push eax
call edi
mov eax, 0x1002d190
sub eax, 0x5a6ce1
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
push 0x5a6cdd
call ebx
push eax
call edi
push 0
push 1
lea eax, [ebp + 8]
mov byte [ebp + 8], 1
push eax
push 0x4e1c35
call ebx
push eax
call edi
lea eax, [ebp - 8]
mov byte [ebp + 0xb], 0xe9
push eax
push 1
lea eax, [ebp + 0xb]
push eax
push 0x4e1c20
call ebx
push eax
call edi
mov eax, 0x10028ab0
sub eax, 0x4e1c25
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
push 0x4e1c21
call ebx
push eax
call edi
push 0
push 1
lea eax, [ebp + 8]
mov byte [ebp + 8], 0x66
push eax
push 0x4e1c55
call ebx
push eax
call edi
push 0
push 1
lea eax, [ebp + 8]
mov byte [ebp + 8], 2
push eax
push 0x4e1c53
call ebx
push eax
call edi
push 0
push 1
lea eax, [ebp + 8]
mov byte [ebp + 8], 0xa
push eax
push 0x5a6c47
call ebx
push eax
call edi
lea eax, [ebp - 8]
mov byte [ebp + 0xb], 0xe9
push eax
push 1
lea eax, [ebp + 0xb]
push eax
push 0x5a6c52
call ebx
push eax
call edi
mov eax, 0x10027ca0
sub eax, 0x5a6c57
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 4
lea eax, [ebp - 4]
push eax
push 0x5a6c53
call ebx
push eax
call edi
push 0
push 1
lea eax, [ebp + 8]
mov byte [ebp + 8], 9
push eax
push 0x5a6dd5
call ebx
push eax
call edi
push 0
push 1
lea eax, [ebp + 8]
mov byte [ebp + 8], 0x1f
push eax
push 0x5a6dde
call ebx
push eax
call edi
push 0
push 1
lea eax, [ebp + 8]
mov byte [ebp + 8], 1
push eax
push 0x5a6ddf
call ebx
push eax
call edi
push 0
push 1
lea eax, [ebp + 8]
mov byte [ebp + 8], 0xa8
push eax
push 0x5a6c81
call ebx
push eax
call edi
push 0
push 1
lea eax, [ebp + 8]
mov byte [ebp + 8], 0xff
push eax
push 0x5a6ca9
call ebx
push eax
call edi
push 0
push 1
lea eax, [ebp + 8]
mov byte [ebp + 8], 0x56
push eax
push 0x5a6cd2
call ebx
push eax
call edi
push 0
push 1
lea eax, [ebp + 8]
mov byte [ebp + 8], 0xb4
push eax
push 0x5a6d1f
call ebx
push eax
call edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret