Function at 0x10003aa0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002b13d
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x30
mov eax, dword [0x1003a040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.10009520
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 1
jne 0x10003bcf
mov eax, dword fs:[0x2c]
mov ecx, dword [0x1003c6b0]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1003d260]
cmp eax, dword [ecx + 4]
jle 0x10003b41
push 0x1003d260
call fcn.1000da07
add esp, 4
cmp dword [0x1003d260], 0xffffffff
jne 0x10003b41
push 0x10035028
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x1003d260
mov dword [0x1003d264], eax
call fcn.1000d9b6
add esp, 4
mov edi, dword [0x1003d264]
lea eax, [ebp - 0x18]
push eax
push 0x40
push 2
lea esi, [edi + 0xe40e]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0x4e20
mov word [esi], ax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x18]
push 2
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x18]
push eax
push 0x40
push 1
lea esi, [edi + 0x6240c]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x18]
mov byte [esi], 0xeb
push eax
push dword [ebp - 0x18]
push 1
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x18]
push eax
push 0x40
lea esi, [edi + 0x607c9]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0x12
push esi
call edi
movaps xmm0, xmmword [0x10036130]
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x18]
movups xmmword [esi], xmm0
push 0x12
push esi
mov word [esi + 0x10], 0x9090
call edi
lea eax, [ebp - 0x18]
push eax
push 0x40
push 5
push 0x5b2bfd
call edi
mov eax, 0x5b2bfd
mov dword [eax], 0x90909090
mov byte [eax + 4], 0x90
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x18]
push 5
push 0x5b2bfd
call edi
lea eax, [ebp - 0x18]
push eax
push 0x40
push 1
push 0x590861
call edi
mov eax, 0x590861
mov byte [eax], 0x90
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x18]
push 1
push 0x590861
call edi
lea eax, [ebp - 0x18]
push eax
push 0x40
push 6
push 0x59087a
call edi
mov eax, dword [0x10034c94]
mov ecx, 0x59087a
mov dword [ecx], eax
mov ax, word [0x10034c98]
mov word [ecx + 4], ax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x18]
push 6
push ecx
call edi
lea eax, [ebp - 0x18]
push eax
push 0x40
push 2
push 0x590a1b
call edi
mov eax, 0x590a1b
mov ecx, 0x90909090
mov word [eax], cx
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x18]
push 2
push 0x590a1b
call edi
lea eax, [ebp - 0x18]
push eax
push 0x40
push 5
push 0x590a22
call edi
mov eax, dword [0x10034c9c]
mov ecx, 0x590a22
mov dword [ecx], eax
movzx eax, byte [0x10034ca0]
mov byte [ecx + 4], al
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x18]
push 5
push ecx
call edi
lea eax, [ebp - 0x18]
push eax
push 0x40
push 5
push 0x590ae4
call edi
mov eax, dword [0x10034ca4]
mov ecx, 0x590ae4
mov dword [ecx], eax
movzx eax, byte [0x10034ca8]
mov byte [ecx + 4], al
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x18]
push 5
push ecx
call edi
lea eax, [ebp - 0x18]
push eax
push 0x40
push 0x49
push 0x8d0444
call edi
movups xmm0, xmmword [str.6FEP_RES]
mov ecx, 0x8d0444
movups xmmword [ecx], xmm0
movups xmm0, xmmword [0x10035048]
movups xmmword [ecx + 0x10], xmm0
movups xmm0, xmmword [0x10035058]
movups xmmword [ecx + 0x20], xmm0
movups xmm0, xmmword [0x10035068]
movups xmmword [ecx + 0x30], xmm0
movq xmm0, qword [0x10035078]
movq qword [ecx + 0x40], xmm0
movzx eax, byte [0x10035080]
mov byte [ecx + 0x48], al
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x18]
push 0x49
push ecx
call edi
lea eax, [ebp - 0x18]
push eax
push 0x40
push 0x90
push 0x8d048c
call edi
push 0x90
push 0x90
push 0x8d048c
call fcn.10011be0
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x18]
push 0x90
push 0x8d048c
call edi
lea eax, [ebp - 0x18]
push eax
push 0x40
push 1
push 0x8ce47b
call edi
lea eax, [ebp - 0x18]
mov byte [0x8ce47b], 1
push eax
push dword [ebp - 0x18]
push 1
push 0x8ce47b
call edi
lea eax, [ebp - 0x18]
push eax
push 0x40
push 1
push 0x8cfd33
call edi
lea eax, [ebp - 0x18]
mov byte [0x8cfd33], 2
push eax
push dword [ebp - 0x18]
push 1
push 0x8cfd33
call edi
lea eax, [ebp - 0x18]
push eax
push 0x40
push 1
push 0x8cfef7
call edi
lea eax, [ebp - 0x18]
mov byte [0x8cfef7], 3
push eax
push dword [ebp - 0x18]
push 1
push 0x8cfef7
call edi
push 0x1003d1b8
mov edx, 0x1000c4b0
mov ecx, 0x4c8220
call fcn.100077f0
mov edi, 0x1003d150
test eax, eax
jne 0x10003e55
call fcn.100077a0
cmp dword [0x1003d154], 0
je 0x10003e51
mov edx, dword [0x1003d2b8]
xor eax, eax
test edx, edx
je 0x10003e51
mov esi, dword [0x1003d2b0]
mov ecx, esi
cmp dword [ecx], 0x4c8220
je 0x10003e44
inc eax
add ecx, 0x2c
cmp eax, edx
jb 0x10003e32
jmp 0x10003e51
cmp eax, 0xffffffff
je 0x10003e51
imul eax, eax, 0x2c
or byte [eax + esi + 0x14], 4
xor eax, eax
xchg dword [edi], eax
push 0x1003d1b4
mov edx, 0x1000c740
mov ecx, 0x6d64f0
call fcn.100077f0
test eax, eax
jne 0x10003eb3
call fcn.100077a0
cmp dword [0x1003d154], 0
je 0x10003eaf
mov edx, dword [0x1003d2b8]
xor eax, eax
test edx, edx
je 0x10003eaf
mov esi, dword [0x1003d2b0]
mov ecx, esi
nop
cmp dword [ecx], 0x6d64f0
je 0x10003ea2
inc eax
add ecx, 0x2c
cmp eax, edx
jb 0x10003e90
jmp 0x10003eaf
cmp eax, 0xffffffff
je 0x10003eaf
imul eax, eax, 0x2c
or byte [eax + esi + 0x14], 4
xor eax, eax
xchg dword [edi], eax
push 0x1003d1b0
mov edx, 0x1000c820
mov ecx, 0x6e2b40
call fcn.100077f0
test eax, eax
jne 0x10003f13
call fcn.100077a0
cmp dword [0x1003d154], 0
je 0x10003f0f
mov edx, dword [0x1003d2b8]
xor eax, eax
test edx, edx
je 0x10003f0f
mov esi, dword [0x1003d2b0]
mov ecx, esi
nop dword [eax]
cmp dword [ecx], 0x6e2b40
je 0x10003f02
inc eax
add ecx, 0x2c
cmp eax, edx
jb 0x10003ef0
jmp 0x10003f0f
cmp eax, 0xffffffff
je 0x10003f0f
imul eax, eax, 0x2c
or byte [eax + esi + 0x14], 4
xor eax, eax
xchg dword [edi], eax
call fcn.10009520
cmp eax, 1
jne 0x10004004
mov eax, dword [0x1003c6b0]
mov ecx, dword fs:[0x2c]
mov ecx, dword [ecx + eax*4]
mov eax, dword [0x1003d260]
cmp eax, dword [ecx + 4]
jle 0x10003f70
push 0x1003d260
call fcn.1000da07
add esp, 4
cmp dword [0x1003d260], 0xffffffff
jne 0x10003f70
push 0x10035028
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x1003d260
mov dword [0x1003d264], eax
call fcn.1000d9b6
add esp, 4
mov esi, dword [0x1003d264]
mov edx, 0x1000afc0
add esi, 0xcab44
push 0x1003d184
mov ecx, esi
call fcn.100077f0
test eax, eax
jne 0x10004004
call fcn.100077a0
cmp dword [0x1003d154], 0
je 0x10004000
test esi, esi
jne 0x10003fc8
xor ecx, ecx
cmp dword [0x1003d2b8], ecx
jbe 0x10004000
xor edx, edx
nop
mov eax, dword [0x1003d2b0]
lea edx, [edx + 0x2c]
inc ecx
or byte [edx + eax - 0x18], 4
cmp ecx, dword [0x1003d2b8]
jb 0x10003fb0
jmp 0x10004000
mov edx, dword [0x1003d2b8]
xor eax, eax
test edx, edx
je 0x10004000
mov edi, dword [0x1003d2b0]
mov ecx, edi
nop dword [eax]
cmp esi, dword [ecx]
je 0x10003fee
inc eax
add ecx, 0x2c
cmp eax, edx
jb 0x10003fe0
jmp 0x10003ffb
cmp eax, 0xffffffff
je 0x10003ffb
imul eax, eax, 0x2c
or byte [eax + edi + 0x14], 4
mov edi, 0x1003d150
xor eax, eax
xchg dword [edi], eax
call fcn.10007a90
lea eax, [ebp - 0x40]
mov dword [ebp - 0x40], vtable.std::_Func_impl_no_alloc_class__void___cdecl_start_void_::_2::_lambda_1___void___.0
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
mov eax, dword [0x1003c6b0]
mov ecx, dword fs:[0x2c]
mov ecx, dword [ecx + eax*4]
mov eax, dword [0x1003d1f0]
cmp eax, dword [ecx + 4]
jle 0x10004117
push 0x1003d1f0
call fcn.1000da07
add esp, 4
cmp dword [0x1003d1f0], 0xffffffff
jne 0x10004117
xorps xmm0, xmm0
mov dword [0x1003d228], 0
movups xmmword [0x1003d208], xmm0
mov dword [0x1003d208], 0
movups xmmword [0x1003d218], xmm0
mov dword [0x1003d20c], 0
mov dword [0x1003d210], 0
mov byte [ebp - 4], 2
push 0x38
mov dword [0x1003d214], 0
mov byte [0x1003d218], 0
mov dword [0x1003d21c], 0
mov dword [0x1003d220], 0
call fcn.1000da6b
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [0x1003d21c], eax
mov byte [ebp - 4], 3
push 0x38
mov dword [0x1003d224], 0
mov dword [0x1003d228], 0
call fcn.1000da6b
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
push 0x1002c150
mov dword [0x1003d224], eax
call fcn.1000dda0
add esp, 4
mov byte [ebp - 4], 0
push 0x1003d1f0
call fcn.1000d9b6
add esp, 4
push ecx
lea eax, [ebp - 0x40]
mov ecx, 0x1003d208
push eax
push 0x1003d224
call fcn.10004860
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x10004143
mov edx, dword [ecx]
lea eax, [ebp - 0x40]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1000d97d
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret