Function at 0x10004640
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x5f308d
call esi
mov eax, 0x5f308d
mov edx, 0x10530548
mov dword ds:[eax], edx
mov edx, dword [ebp - 4]
lea ecx, [ebp - 4]
push ecx
push edx
push 4
push 0x5f308d
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x6f8101
call esi
mov eax, 0x6f8101
mov edx, 0x10530548
mov dword ds:[eax], edx
mov edx, dword [ebp - 4]
lea ecx, [ebp - 4]
push ecx
push edx
push 4
push 0x6f8101
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x72d1e4
call esi
mov eax, 0x72d1e4
mov edx, 0x10530548
mov dword ds:[eax], edx
mov edx, dword [ebp - 4]
lea ecx, [ebp - 4]
push ecx
push edx
push 4
push 0x72d1e4
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x735e90
call esi
mov eax, 0x735e90
mov edx, 0x10530548
mov dword ds:[eax], edx
mov edx, dword [ebp - 4]
lea ecx, [ebp - 4]
push ecx
push edx
push 4
push 0x735e90
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x735f3c
call esi
mov eax, 0x735f3c
mov edx, 0x10530548
mov dword ds:[eax], edx
mov edx, dword [ebp - 4]
lea ecx, [ebp - 4]
push ecx
push edx
push 4
push 0x735f3c
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x735f9c
call esi
mov eax, 0x735f9c
mov edx, 0x10530548
mov dword ds:[eax], edx
mov edx, dword [ebp - 4]
lea ecx, [ebp - 4]
push ecx
push edx
push 4
push 0x735f9c
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x747d2c
call esi
mov eax, 0x747d2c
mov edx, 0x10530548
mov dword ds:[eax], edx
mov edx, dword [ebp - 4]
lea ecx, [ebp - 4]
push ecx
push edx
push 4
push 0x747d2c
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x747d93
call esi
mov eax, 0x747d93
mov edx, 0x10530548
mov dword ds:[eax], edx
mov edx, dword [ebp - 4]
lea ecx, [ebp - 4]
push ecx
push edx
push 4
push 0x747d93
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x747d1b
call esi
mov edi, 0x1388
lea ecx, [ebp - 4]
push ecx
mov dword [0x747d1b], edi
mov edx, dword [ebp - 4]
push edx
push 4
push 0x747d1b
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x72d1cf
call esi
lea ecx, [ebp - 4]
push ecx
mov dword [0x72d1cf], edi
mov edx, dword [ebp - 4]
push edx
push 4
push 0x72d1cf
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x735f8b
call esi
lea ecx, [ebp - 4]
push ecx
mov dword [0x735f8b], edi
mov edx, dword [ebp - 4]
push edx
push 4
push 0x735f8b
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x735f2b
call esi
lea ecx, [ebp - 4]
push ecx
mov dword [0x735f2b], edi
mov edx, dword [ebp - 4]
push edx
push 4
push 0x735f2b
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x735e7b
call esi
lea ecx, [ebp - 4]
push ecx
mov dword [0x735e7b], edi
mov edx, dword [ebp - 4]
push edx
push 4
push 0x735e7b
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x5f307c
call esi
lea ecx, [ebp - 4]
push ecx
mov dword [0x5f307c], edi
mov edx, dword [ebp - 4]
push edx
push 4
push 0x5f307c
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x550e84
call esi
mov ecx, 0x10004280
mov bl, 0xe9
mov byte [0x550e84], bl
sub ecx, 0x550e89
lea edx, [ebp - 8]
push edx
mov dword [0x550e85], ecx
mov eax, dword [ebp - 4]
push eax
push 5
push 0x550e84
call esi
lea ecx, [ebp - 4]
push ecx
push 0x40
push 5
push 0x550ccb
call esi
mov edx, 0x100042b0
mov byte [0x550ccb], bl
sub edx, 0x550cd0
lea eax, [ebp - 8]
push eax
mov dword [0x550ccc], edx
mov ecx, dword [ebp - 4]
push ecx
push 5
push 0x550ccb
call esi
lea edx, [ebp - 4]
push edx
push 0x40
push 5
push 0x550b2c
call esi
mov byte [0x550b2c], bl
mov eax, 0x100042e0
sub eax, 0x550b31
lea ecx, [ebp - 8]
push ecx
mov dword [0x550b2d], eax
mov edx, dword [ebp - 4]
push edx
push 5
push 0x550b2c
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x551379
call esi
mov ecx, 0x10004310
mov byte [0x551379], bl
sub ecx, 0x55137e
lea edx, [ebp - 8]
push edx
mov dword [0x55137a], ecx
mov eax, dword [ebp - 4]
push eax
push 5
push 0x551379
call esi
lea ecx, [ebp - 4]
push ecx
push 0x40
push 5
push 0x55787e
call esi
mov edx, 0x10004340
mov byte [0x55787e], bl
sub edx, 0x557883
lea eax, [ebp - 8]
push eax
mov dword [0x55787f], edx
mov ecx, dword [ebp - 4]
push ecx
push 5
push 0x55787e
call esi
lea edx, [ebp - 4]
push edx
push 0x40
push 5
push 0x5513a2
call esi
mov eax, 0x10004370
mov byte [0x5513a2], bl
sub eax, 0x5513a7
lea ecx, [ebp - 8]
push ecx
mov dword [0x5513a3], eax
mov edx, dword [ebp - 4]
push edx
push 5
push 0x5513a2
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x5513c5
call esi
mov ecx, 0x100043a0
mov byte [0x5513c5], bl
sub ecx, 0x5513ca
lea edx, [ebp - 8]
push edx
mov dword [0x5513c6], ecx
mov eax, dword [ebp - 4]
push eax
push 5
push 0x5513c5
call esi
lea ecx, [ebp - 4]
push ecx
push 0x40
push 5
push 0x5a04c0
call esi
mov edx, 0x100043d0
mov byte [0x5a04c0], bl
sub edx, 0x5a04c5
lea eax, [ebp - 8]
push eax
mov dword [0x5a04c1], edx
mov ecx, dword [ebp - 4]
push ecx
push 5
push 0x5a04c0
call esi
lea edx, [ebp - 4]
push edx
push 0x40
push 5
push 0x5515b8
call esi
mov eax, 0x10004400
mov byte [0x5515b8], bl
sub eax, 0x5515bd
lea ecx, [ebp - 8]
push ecx
mov dword [0x5515b9], eax
mov edx, dword [ebp - 4]
push edx
push 5
push 0x5515b8
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x551097
call esi
mov ecx, 0x10004430
mov byte [0x551097], bl
sub ecx, 0x55109c
lea edx, [ebp - 8]
push edx
mov dword [0x551098], ecx
mov eax, dword [ebp - 4]
push eax
push 5
push 0x551097
call esi
lea ecx, [ebp - 4]
push ecx
push 0x40
push 5
push 0x550b4c
call esi
mov edx, 0x10004460
mov byte [0x550b4c], bl
sub edx, 0x550b51
lea eax, [ebp - 8]
push eax
mov dword [0x550b4d], edx
mov ecx, dword [ebp - 4]
push ecx
push 5
push 0x550b4c
call esi
lea edx, [ebp - 4]
push edx
push 0x40
push 5
push 0x550dec
call esi
mov eax, 0x10004490
mov byte [0x550dec], bl
sub eax, 0x550df1
lea ecx, [ebp - 8]
push ecx
mov dword [0x550ded], eax
mov edx, dword [ebp - 4]
push edx
push 5
push 0x550dec
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x576a63
call esi
mov ecx, 0x100044c0
mov byte [0x576a63], bl
sub ecx, 0x576a68
lea edx, [ebp - 8]
push edx
mov dword [0x576a64], ecx
mov eax, dword [ebp - 4]
push eax
push 5
push 0x576a63
call esi
lea ecx, [ebp - 4]
push ecx
push 0x40
push 5
push 0x550c1b
call esi
mov edx, 0x100044f0
mov byte [0x550c1b], bl
sub edx, 0x550c20
lea eax, [ebp - 8]
push eax
mov dword [0x550c1c], edx
mov ecx, dword [ebp - 4]
push ecx
push 5
push 0x550c1b
call esi
lea edx, [ebp - 4]
push edx
push 0x40
push 5
push 0x5b55ea
call esi
mov eax, 0x10004520
mov byte [0x5b55ea], bl
sub eax, 0x5b55ef
lea ecx, [ebp - 8]
push ecx
mov dword [0x5b55eb], eax
mov edx, dword [ebp - 4]
push edx
push 5
push 0x5b55ea
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x5a3c70
call esi
mov ecx, 0x10004620
mov byte [0x5a3c70], bl
sub ecx, 0x5a3c75
lea edx, [ebp - 8]
push edx
mov dword [0x5a3c71], ecx
mov eax, dword [ebp - 4]
push eax
push 5
push 0x5a3c70
call esi
lea ecx, [ebp - 4]
push ecx
push 0x40
push 5
push 0x550a2d
call esi
mov edx, 0x10004560
sub edx, 0x550a32
lea eax, [ebp - 8]
mov byte [0x550a2d], bl
mov dword [0x550a2e], edx
push eax
mov ecx, dword [ebp - 4]
push ecx
push 5
push 0x550a2d
call esi
lea edx, [ebp - 4]
push edx
push 0x40
push 5
push 0x59c6dd
call esi
mov eax, 0x100045b0
mov byte [0x59c6dd], bl
sub eax, 0x59c6e2
lea ecx, [ebp - 8]
push ecx
mov dword [0x59c6de], eax
mov edx, dword [ebp - 4]
push edx
push 5
push 0x59c6dd
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 8
push 0xd27ef8
call esi
fld qword [0x10020750]
lea ecx, [ebp - 4]
fstp qword [0xd27ef8]
mov edx, dword [ebp - 4]
push ecx
push edx
push 8
push 0xd27ef8
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 6
push 0x55774d
call esi
mov eax, 0x90909090
mov ecx, 0x55774d
mov dword [ecx], eax
mov word [ecx + 4], ax
mov edx, dword [ebp - 4]
lea ecx, [ebp - 4]
push ecx
push edx
push 6
push 0x55774d
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 6
push 0x5578b3
call esi
mov eax, 0x90909090
mov ecx, 0x5578b3
mov dword [ecx], eax
mov word [ecx + 4], ax
mov edx, dword [ebp - 4]
lea ecx, [ebp - 4]
push ecx
push edx
push 6
push 0x5578b3
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 3
push 0x556d5a
call esi
mov cx, word [0x1001f968]
mov eax, 0x556d5a
mov word [eax], cx
mov dl, byte [0x1001f96a]
mov byte [eax + 2], dl
mov ecx, dword [ebp - 4]
lea eax, [ebp - 4]
push eax
push ecx
push 3
push 0x556d5a
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret