Function at 0x1000d810
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1010800c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x101128e0], 0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
mov byte [ebp - 0x14], 0xe8
mov dword [ebp - 8], 0
jne 0x1000d9a5
mov eax, 0x1000dab0
sub eax, 0x78b0c1
mov dword [ebp - 0x13], eax
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push 0x78b0bc
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1000d88d
mov eax, dword [ebp - 0x14]
mov ecx, 0x78b0bc
mov dword [ecx], eax
mov al, byte [ebp - 0x10]
mov byte [ecx + 4], al
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
mov dword [ebp - 0xc], 0
push 5
push ecx
call esi
test eax, eax
jne 0x1000d88f
call edi
mov eax, 0x1000d7b0
mov byte [ebp - 0x14], 0xe9
sub eax, 0x78976c
mov dword [ebp - 8], 0
mov dword [ebp - 0x13], eax
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push 0x789767
call esi
test eax, eax
je 0x1000d8e1
mov eax, dword [ebp - 0x14]
mov ecx, 0x789767
mov dword [ecx], eax
mov al, byte [ebp - 0x10]
mov byte [ecx + 4], al
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
mov dword [ebp - 0xc], 0
push 5
push ecx
call esi
test eax, eax
jne 0x1000d8e3
call edi
mov eax, 0x1000d7d0
mov byte [ebp - 0x14], 0xe9
sub eax, 0x789a68
mov dword [ebp - 8], 0
mov dword [ebp - 0x13], eax
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push 0x789a63
call esi
test eax, eax
je 0x1000d935
mov eax, dword [ebp - 0x14]
mov ecx, 0x789a63
mov dword [ecx], eax
mov al, byte [ebp - 0x10]
mov byte [ecx + 4], al
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
mov dword [ebp - 0xc], 0
push 5
push ecx
call esi
test eax, eax
jne 0x1000d937
call edi
mov eax, 0x1000d7f0
mov byte [ebp - 0x14], 0xe9
sub eax, 0x789db1
mov dword [ebp - 8], 0
mov dword [ebp - 0x13], eax
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push 0x789dac
call esi
test eax, eax
je 0x1000d989
mov eax, dword [ebp - 0x14]
mov ecx, 0x789dac
mov dword [ecx], eax
mov al, byte [ebp - 0x10]
mov byte [ecx + 4], al
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
mov dword [ebp - 0xc], 0
push 5
push ecx
call esi
test eax, eax
jne 0x1000d98b
call edi
pop edi
mov dword [0x101128e0], 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100617e6
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 8]
mov dword [ebp - 0x13], 0x246959
push eax
push 0x40
push 5
push 0x789767
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1000d9ec
mov eax, dword [ebp - 0x14]
mov ecx, 0x789767
mov dword [ecx], eax
mov al, byte [ebp - 0x10]
mov byte [ecx + 4], al
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
mov dword [ebp - 0xc], 0
push 5
push ecx
call esi
test eax, eax
jne 0x1000d9ee
call edi
lea eax, [ebp - 8]
mov byte [ebp - 0x14], 0xe8
push eax
push 0x40
push 5
push 0x789a63
mov dword [ebp - 0x13], 0x24665d
mov dword [ebp - 8], 0
call esi
test eax, eax
je 0x1000da3a
mov eax, dword [ebp - 0x14]
mov ecx, 0x789a63
mov dword [ecx], eax
mov al, byte [ebp - 0x10]
mov byte [ecx + 4], al
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
mov dword [ebp - 0xc], 0
push 5
push ecx
call esi
test eax, eax
jne 0x1000da3c
call edi
lea eax, [ebp - 8]
mov byte [ebp - 0x14], 0xe8
push eax
push 0x40
push 5
push 0x789dac
mov dword [ebp - 0x13], 0x246314
mov dword [ebp - 8], 0
call esi
test eax, eax
je 0x1000da88
mov eax, dword [ebp - 0x14]
mov ecx, 0x789dac
mov dword [ecx], eax
mov al, byte [ebp - 0x10]
mov byte [ecx + 4], al
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
mov dword [ebp - 0xc], 0
push 5
push ecx
call esi
test eax, eax
jne 0x1000da8a
call edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov dword [0x101128e0], 0
pop esi
call fcn.100617e6
mov esp, ebp
pop ebp
ret