Function at 0x11d4a4c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x11fa9098
push eax
mov eax, dword [0x12133f80]
mov dword fs:[0], esp
sub esp, 0x28
push ebx
mov ebx, dword [esp + 0x40]
push ebp
xor ebp, ebp
push esi
cmp eax, ebp
push edi
je 0x11d4a50b
cmp ebx, ebp
mov eax, ebx
jne 0x11d4a4f6
mov eax, str.NULL
push eax
push str.CSafeOLE::OnCreateFileMoniker_lpszPathName____s__1
push str.SafeOLE
push 4
call fcn.11ca5810
add esp, 0x10
push 0xffffffffffffffdd
lea ecx, [esp + 0x24]
call fcn.11e15fa0
cmp ebx, ebp
mov dword [esp + 0x40], ebp
je 0x11d4a748
cmp dword [0x12133f80], ebp
je 0x11d4a53e
push str.CSafeOLE::OnCreateFileMoniker_2
push str.SafeOLE
push 4
call fcn.11ca5810
add esp, 0xc
mov ecx, 0x1212b5c0
call fcn.11d71190
test eax, eax
jne 0x11d4a748
mov ecx, 0x1212b5c0
call fcn.11d86370
test eax, eax
jne 0x11d4a748
mov ecx, 0x1212b458
call fcn.11df5090
test eax, eax
je 0x11d4a748
push ebp
push 0x12118da8
call fcn.11c92320
add esp, 8
test eax, eax
jne 0x11d4a748
cmp dword [0x12133f80], ebp
je 0x11d4a5a6
push str.CSafeOLE::OnCreateFileMoniker_3
push str.SafeOLE
push 4
call fcn.11ca5810
add esp, 0xc
push 0xffffffffffffffdf
lea ecx, [esp + 0x30]
call fcn.11e15fa0
push 0x12084588
push ebx
mov byte [esp + 0x48], 1
call fcn.11e9ba00
add esp, 8
mov ecx, 0x1212b5c0
mov edi, eax
call fcn.11d99c30
test eax, eax
je 0x11d4a5df
cmp edi, ebp
je 0x11d4a5df
mov esi, 1
jmp 0x11d4a5e1
xor esi, esi
cmp dword [0x12133f80], ebp
je 0x11d4a5ff
push edi
push esi
push str.CSafeOLE::OnCreateFileMoniker_4___d___d_
push str.SafeOLE
push 4
call fcn.11ca5810
add esp, 0x14
cmp esi, ebp
jne 0x11d4a73a
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
push ebx
call fcn.11ee1fb0
add esp, 0x28
test eax, eax
je 0x11d4a73a
push ebx
lea ecx, [esp + 0x50]
call fcn.11e7eae0
push str.._Opening_the_file_is_forbidden______
lea ecx, [esp + 0x50]
mov byte [esp + 0x44], 2
call fcn.11e7fed0
cmp dword [0x12133f80], ebp
je 0x11d4a65f
mov eax, dword [esp + 0x4c]
push eax
push str.CSafeOLE::OnCreateFileMoniker_5___s_
push str.SafeOLE
push 4
call fcn.11ca5810
add esp, 0x10
lea ecx, [esp + 0x20]
call fcn.11e16060
mov esi, dword [esp + 0x48]
lea edx, [esp + 0x14]
lea eax, [esp + 0x48]
push edx
mov ecx, dword [esi + 0x24]
mov edi, dword [esi + 0x1c]
mov ebx, dword [esi + 0x20]
mov dword [esp + 0x1c], ecx
lea ecx, [esp + 0x14]
push eax
xor ebp, ebp
push ecx
push edi
mov dword [esp + 0x20], ebp
mov dword [esp + 0x58], ebp
mov dword [esp + 0x24], ebp
call fcn.11e15b00
mov eax, dword [esp + 0x58]
add esp, 0x10
cmp eax, ebp
je 0x11d4a6da
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov ebp, dword [esi + 0xc]
mov dword [esi + 0x1c], edx
mov edx, dword [esp + 0x50]
mov dword [esi + 0x24], ecx
mov ecx, dword [esp + 0x4c]
push edx
push ecx
push esi
mov dword [esi + 0x20], eax
call eax
mov edx, dword [esp + 0x18]
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], edx
mov dword [esi + 0xc], ebp
jmp 0x11d4a716
mov edi, dword [esi + 0x18]
cmp edi, ebp
je 0x11d4a716
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 0x4c]
push eax
push ecx
call edi
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 8]
test eax, 0x800000
je 0x11d4a716
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 0x28], eax
mov esi, dword [esi + 0x14]
lea ecx, [esp + 0x4c]
mov byte [esp + 0x40], 1
call fcn.11e7f280
lea ecx, [esp + 0x2c]
mov byte [esp + 0x40], 0
call fcn.11e15fd0
jmp 0x11d4a886
lea ecx, [esp + 0x2c]
mov byte [esp + 0x40], 0
call fcn.11e15fd0
lea ecx, [esp + 0x20]
call fcn.11e16060
mov esi, dword [esp + 0x48]
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x18], ebp
mov edx, dword [esi + 0x20]
mov eax, dword [esi + 0x24]
mov edi, dword [esi + 0x1c]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], eax
lea edx, [esp + 0x4c]
lea eax, [esp + 0x18]
push edx
push eax
push edi
mov dword [esp + 0x58], ebp
mov dword [esp + 0x20], ebp
call fcn.11e15b00
mov eax, dword [esp + 0x58]
add esp, 0x10
cmp eax, ebp
mov ebp, dword [esp + 0x50]
je 0x11d4a7c9
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov ebx, dword [esi + 0xc]
mov dword [esi + 0x1c], ecx
mov ecx, dword [esp + 0x4c]
push ebp
push ecx
push esi
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], edx
call eax
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edx
mov dword [esi + 0x24], eax
mov dword [esi + 0xc], ebx
jmp 0x11d4a7fd
mov edi, dword [esi + 0x18]
test edi, edi
je 0x11d4a7fd
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
push ebp
push ebx
call edi
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 8]
test eax, 0x800000
je 0x11d4a7fd
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 0x28], eax
mov esi, dword [esi + 0x14]
lea ecx, [esp + 0x20]
call fcn.11e16040
test esi, esi
jne 0x11d4a886
test ebp, ebp
je 0x11d4a886
mov ebp, dword [ebp]
test ebp, ebp
je 0x11d4a886
mov edi, dword [ebp]
add edi, 0x2c
mov eax, dword [edi]
cmp eax, 0x11d4a170
je 0x11d4a886
mov ecx, dword [0x12124990]
test ecx, ecx
jne 0x11d4a886
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [esp + 0x50]
push ecx
push 0x40
push 4
push edi
mov dword [0x12124990], eax
mov dword [esp + 0x60], esi
call ebp
test eax, eax
je 0x11d4a863
mov edx, dword [esp + 0x50]
push esi
push edx
push 4
push edi
mov dword [edi], 0x11d4a170
call ebp
jmp 0x11d4a886
mov eax, dword [0x12133f80]
test eax, eax
je 0x11d4a886
mov eax, dword [0x12126854]
push eax
push str.__s__CSafeOLE::OnCreateFileMoniker:_VirtualProtect._Failed._Cant_Hook___n
push str.SafeDoc
push 4
call fcn.11ca5810
add esp, 0x10
lea ecx, [esp + 0x20]
mov dword [esp + 0x40], 0xffffffff
call fcn.11e15fd0
mov ecx, dword [esp + 0x38]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x34
ret 0xc