Function at 0x88ee90
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0xb0e278
push 0xa847a0
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push esi
push edi
mov eax, dword [0xb196ec]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, dword [0xb8da68]
mov byte [ebp - 0x19], 1
push str.ThreatScanner_Initialize
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call edi
mov dword [0xb8da6c], eax
xor ebx, ebx
cmp eax, ebx
jne 0x88eee9
mov byte [ebp - 0x19], bl
push str.ThreatScanner_InitializeEx
push esi
call edi
mov dword [0xb8da70], eax
cmp eax, ebx
jne 0x88eefd
mov byte [ebp - 0x19], bl
push str.ThreatScanner_EnumerateDatabaseRecords
push esi
call edi
mov dword [0xb8da74], eax
cmp eax, ebx
jne 0x88ef11
mov byte [ebp - 0x19], bl
push str.ThreatScanner_Uninitialize
push esi
call edi
mov dword [0xb8da78], eax
cmp eax, ebx
jne 0x88ef25
mov byte [ebp - 0x19], bl
push str.ThreatScanner_CreateInstance
push esi
call edi
mov dword [0xb8da7c], eax
cmp eax, ebx
jne 0x88ef39
mov byte [ebp - 0x19], bl
push str.ThreatScanner_DestroyInstance
push esi
call edi
mov dword [0xb8da80], eax
cmp eax, ebx
jne 0x88ef4d
mov byte [ebp - 0x19], bl
push str.ThreatScanner_GetDatabaseInformation
push esi
call edi
mov dword [0xb8da84], eax
cmp eax, ebx
jne 0x88ef61
mov byte [ebp - 0x19], bl
push str.ThreatScanner_GetLicenseInformation
push esi
call edi
mov dword [0xb8da88], eax
cmp eax, ebx
jne 0x88ef75
mov byte [ebp - 0x19], bl
push str.ThreatScanner_SetIntOption
push esi
call edi
mov dword [0xb8da8c], eax
cmp eax, ebx
jne 0x88ef89
mov byte [ebp - 0x19], bl
push str.ThreatScanner_GetOption
push esi
call edi
mov dword [0xb8da90], eax
cmp eax, ebx
jne 0x88ef9d
mov byte [ebp - 0x19], bl
push str.ThreatScanner_SetScanPriority
push esi
call edi
mov dword [0xb8da94], eax
cmp eax, ebx
jne 0x88efb1
mov byte [ebp - 0x19], bl
push str.ThreatScanner_ScanObject
push esi
call edi
mov dword [0xb8da98], eax
cmp eax, ebx
jne 0x88efc5
mov byte [ebp - 0x19], bl
push str.ThreatScanner_SetScanCallback
push esi
call edi
mov dword [0xb8da9c], eax
cmp eax, ebx
jne 0x88efd9
mov byte [ebp - 0x19], bl
push str.ThreatScanner_ScanObjectByHandle
push esi
call edi
mov dword [0xb8daa4], eax
cmp eax, ebx
jne 0x88efed
mov byte [ebp - 0x19], bl
push str.ThreatScanner_SetPasswordCallback
push esi
call edi
mov dword [0xb8daa0], eax
cmp eax, ebx
jne 0x88f001
mov byte [ebp - 0x19], bl
push str.ThreatScanner_ScanBuffer
push esi
call edi
mov dword [0xb8daa8], eax
cmp eax, ebx
jne 0x88f01f
mov byte [ebp - 0x19], bl
call fcn.0088ee30
jmp 0x88f105
mov al, byte [ebp - 0x19]
cmp al, 1
jne 0x88f0e6
push str.ThreatScanner_ScanBufferEx
push esi
call edi
mov dword [0xb8daac], eax
mov byte [ebp - 0x19], 1
mov esi, dword [0xb8da7c]
cmp esi, ebx
je 0x88f105
mov dword [ebp - 4], ebx
add esi, 0xffffe969
cmp byte [esi], 0x8b
jne 0x88f0fe
cmp byte [esi + 1], 0xe8
jne 0x88f0fe
mov dword [ebp - 0x44], ebx
xor eax, eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
push 0x1c
lea eax, [ebp - 0x44]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
cmp eax, ebx
je 0x88f0fe
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edi, eax
lea ecx, [ebp - 0x28]
push ecx
push 0x40
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x88f0fe
mov dword [ebp - 0x24], ebx
mov byte [ebp - 0x20], 0x31
mov byte [ebp - 0x1f], 0xed
lea edx, [ebp - 0x24]
push edx
push 2
lea eax, [ebp - 0x20]
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ebx, eax
push 0
mov ecx, dword [ebp - 0x28]
push ecx
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test ebx, ebx
je 0x88f0fe
push 4
push esi
push edi
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
jmp 0x88f0fe
test al, al
jne 0x88f03b
call fcn.0088ee30
jmp 0x88f105
mov dword [ebp - 4], 0xfffffffe
mov al, byte [ebp - 0x19]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret