Function at 0x10025470
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x1009400c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 0x24], 0x10025b00
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov esi, eax
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push 0x5db9bc
push esi
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 0
push 4
push 0x101db6b0
push 0x5db9bc
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push 0x5db9bc
push esi
call ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea eax, [ebp - 0x24]
push 0
push 4
push eax
push 0x5db9bc
push esi
call ebx
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call eax
mov dword [ebp - 0x1c], 0x10025b20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push 0x5dbb8c
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
push 0x101db6b4
push 0x5dbb8c
push esi
call edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push 0x5dbb8c
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x1c]
push eax
push 0x5dbb8c
push esi
call ebx
push esi
call edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push 0x5dbd3c
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x1c]
push eax
push 0x5dbd3c
push esi
call ebx
push esi
call edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push 0x5dbe9c
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x1c]
push eax
push 0x5dbe9c
push esi
call ebx
push esi
call edi
mov dword [ebp - 0x20], 0x10025ae0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push 0x5dbfd4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x20]
push eax
push 0x5dbfd4
push esi
call ebx
push esi
call edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push 0x5dc1dc
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x20]
push eax
push 0x5dc1dc
push esi
call ebx
push esi
call edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push 0x5dc34c
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x20]
push eax
push 0x5dc34c
push esi
call ebx
push esi
call edi
mov dword [ebp - 0xc], 0x90909090
mov word [ebp - 8], 0x9090
mov byte [ebp - 6], 0x90
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x10]
push eax
push 0x40
push 7
push 0x51b26e
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 7
lea eax, [ebp - 0xc]
push eax
push 0x51b26e
push esi
call ebx
push esi
call edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x10]
push eax
push 0x40
push 7
push 0x518448
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 7
lea eax, [ebp - 0xc]
push eax
push 0x518448
push esi
call ebx
push esi
call edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x10]
push eax
push 0x40
push 7
push 0x5185dc
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 7
lea eax, [ebp - 0xc]
push eax
push 0x5185dc
push esi
call ebx
push esi
call edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x10]
push eax
push 0x40
push 2
push 0x5185e3
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 2
lea eax, [ebp - 0xc]
push eax
push 0x5185e3
push esi
call ebx
push esi
call edi
mov dword [ebp - 0x28], 0x10025ac0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push 0x5e058c
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x28]
push eax
push 0x5e058c
push esi
call ebx
push esi
call edi
mov dword [ebp - 0x2c], 0x10025a30
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push 0x5c6b48
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x2c]
push eax
push 0x5c6b48
push esi
call ebx
push esi
call edi
push str.shading.dll
mov dword [ebp - 0x30], 0x10025a10
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov byte [ebp - 0x11], 0xba
lea ebx, [eax + 0x118a7]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x10]
push eax
push 0x40
push 1
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 1
lea eax, [ebp - 0x11]
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call edi
lea edi, [ebx + 1]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x30]
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call eax
mov word [ebp - 0x18], 0xe2ff
lea edi, [ebx + 5]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x10]
push eax
push 0x40
push 2
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea eax, [ebp - 0x18]
push 0
push 2
push eax
push edi
push esi
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call edi
mov byte [ebp - 0x12], 0xeb
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x10]
push eax
push 0x40
push 1
push 0x5554e9
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 1
lea eax, [ebp - 0x12]
push eax
push 0x5554e9
push esi
call ebx
push esi
call edi
mov dword [ebp - 0x34], 0x10025a00
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push 0x5d9ae8
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x34]
push eax
push 0x5d9ae8
push esi
call ebx
push esi
call edi
mov dword [ebp - 0x38], 0x100259e0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push 0x5dc364
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 4
lea eax, [ebp - 0x38]
push eax
push 0x5dc364
push esi
call ebx
push esi
call edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004d763
mov esp, ebp
pop ebp
ret