Function at 0x1000e6e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push esi
push edi
nop dword [eax]
push str.samp.dll
call ebp
push 0xa
mov esi, eax
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
test esi, esi
jne 0x1000e722
cmp dword [0xc8d4c0], 6
jl 0x1000e700
jmp 0x1000e74a
add esi, 0x85e3
xor eax, eax
cmp dword [esi], 0xbb8
cmovne esi, eax
cmp esi, 1
jbe 0x1000e74a
lea eax, [esp + 0x10]
push eax
push 0x40
push 4
push esi
call edi
mov dword [esi], 0
lea eax, [esp + 0x10]
push eax
push 0x40
push 4
push 0xc8d4c0
call edi
lea eax, [esp + 0x10]
mov dword [0xc8d4c0], 5
push eax
push 0x20
push 1
push 0x748c2b
call edi
mov bl, byte [0x748c2b]
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x14]
push 1
push 0x748c2b
call edi
lea eax, [esp + 0x10]
push eax
cmp bl, 0xe8
jne 0x1000e7c2
push 0x40
push 5
push 0x748c2b
call edi
mov eax, 0x748c2b
mov dword [eax], 0x90909090
mov byte [eax + 4], 0x90
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x14]
push 5
push 0x748c2b
jmp 0x1000e819
push 0x20
push 1
push 0x748c7b
call edi
mov bl, byte [0x748c7b]
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x14]
push 1
push 0x748c7b
call edi
cmp bl, 0xe8
jne 0x1000e81b
lea eax, [esp + 0x10]
push eax
push 0x40
push 5
push 0x748c7b
call edi
mov eax, 0x748c7b
mov dword [eax], 0x90909090
mov byte [eax + 4], 0x90
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x14]
push 5
push 0x748c7b
call edi
lea eax, [esp + 0x10]
push eax
push 0x20
push 1
push 0x5909aa
call edi
mov bl, byte [0x5909aa]
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x14]
push 1
push 0x5909aa
call edi
cmp bl, 0xbe
jne 0x1000e862
lea eax, [esp + 0x10]
push eax
push 0x40
push 4
push 0x5909ab
call edi
mov dword [0x5909ab], 1
lea eax, [esp + 0x10]
push eax
push 0x20
push 1
push 0x590a1d
call edi
mov bl, byte [0x590a1d]
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x14]
push 1
push 0x590a1d
call edi
cmp bl, 0xbe
jne 0x1000e8c0
lea eax, [esp + 0x10]
push eax
push 0x40
push 1
push 0x590a1d
call edi
lea eax, [esp + 0x10]
mov byte [0x590a1d], 0xe9
push eax
push 0x40
push 4
push 0x590a1e
call edi
mov dword [0x590a1e], 0x8d
lea eax, [esp + 0x10]
push eax
push 0x20
push 1
push 0x748c6b
call edi
mov bl, byte [0x748c6b]
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x14]
push 1
push 0x748c6b
call edi
lea eax, [esp + 0x10]
push eax
cmp bl, 0xc6
jne 0x1000e922
push 0x40
push 7
push 0x748c6b
call edi
mov eax, 0x748c6b
mov ecx, 0x90909090
mov dword [eax], ecx
mov word [eax + 4], cx
mov byte [eax + 6], cl
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x14]
push 7
push 0x748c6b
jmp 0x1000e97d
push 0x20
push 1
push 0x748cbb
call edi
mov bl, byte [0x748cbb]
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x14]
push 1
push 0x748cbb
call edi
cmp bl, 0xc6
jne 0x1000e97f
lea eax, [esp + 0x10]
push eax
push 0x40
push 7
push 0x748cbb
call edi
mov eax, 0x748cbb
mov ecx, 0x90909090
mov dword [eax], ecx
mov word [eax + 4], cx
mov byte [eax + 6], cl
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x14]
push 7
push 0x748cbb
call edi
lea eax, [esp + 0x10]
push eax
push 0x20
push 1
push 0x5745dd
call edi
mov bl, byte [0x5745dd]
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x14]
push 1
push 0x5745dd
call edi
cmp bl, 0xc6
jne 0x1000e9c3
lea eax, [esp + 0x10]
push eax
push 0x40
push 1
push 0x5745e3
call edi
mov byte [0x5745e3], 9
lea eax, [esp + 0x10]
push eax
push 0x20
push 1
push 0x5737e0
call edi
mov bl, byte [0x5737e0]
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x14]
push 1
push 0x5737e0
call edi
cmp bl, 0x74
jne 0x1000ea07
lea eax, [esp + 0x10]
push eax
push 0x40
push 1
push 0x5737e0
call edi
mov byte [0x5737e0], 0x75
lea eax, [esp + 0x10]
push eax
push 0x20
push 1
push 0x590af0
call edi
mov bl, byte [0x590af0]
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x14]
push 1
push 0x590af0
call edi
cmp bl, 0xa1
jne 0x1000ea65
lea eax, [esp + 0x10]
push eax
push 0x40
push 1
push 0x590af0
call edi
lea eax, [esp + 0x10]
mov byte [0x590af0], 0xe9
push eax
push 0x40
push 4
push 0x590af1
call edi
mov dword [0x590af1], 0x140
lea eax, [esp + 0x10]
push eax
push 0x20
push 1
push 0x748e52
call edi
mov bl, byte [0x748e52]
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x14]
push 1
push 0x748e52
call edi
cmp bl, 0x74
jne 0x1000ea9b
mov word [0x748e52], 0x1275
lea eax, [esp + 0x10]
push eax
push 0x20
push 1
push 0x619440
call edi
mov bl, byte [0x619440]
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x14]
push 1
push 0x619440
call edi
cmp bl, 0xe9
jne 0x1000eaf8
mov eax, dword [0x619441]
mov esi, 0x1000ec30
add eax, 0x619445
sub esi, 0x619445
mov dword [0x1003efc0], eax
lea eax, [esp + 0x10]
push eax
push 0x40
push 4
push 0x619441
call edi
mov dword [0x619441], esi
lea eax, [esp + 0x10]
push eax
push 0x20
push 1
push 0x748d1a
call edi
mov bl, byte [0x748d1a]
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x14]
push 1
push 0x748d1a
call edi
cmp bl, 0xe9
jne 0x1000eb57
mov eax, dword [0x748d1b]
mov esi, 0x1000ec60
add eax, 0x748d1f
sub esi, 0x748d1f
mov dword [0x1003efbc], eax
lea eax, [esp + 0x10]
push eax
push 0x40
push 4
push 0x748d1b
call edi
mov dword [0x748d1b], esi
jmp 0x1000ebb4
lea eax, [esp + 0x10]
push eax
push 0x20
push 1
push 0x748d6a
call edi
mov bl, byte [0x748d6a]
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x14]
push 1
push 0x748d6a
call edi
cmp bl, 0xe9
jne 0x1000ebb4
mov eax, dword [0x748d6b]
mov esi, 0x1000ec60
add eax, 0x748d6f
sub esi, 0x748d6f
mov dword [0x1003efbc], eax
lea eax, [esp + 0x10]
push eax
push 0x40
push 4
push 0x748d6b
call edi
mov dword [0x748d6b], esi
lea eax, [esp + 0x10]
push eax
push 0x20
push 1
push 0x573683
call edi
mov bl, byte [0x573683]
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x14]
push 1
push 0x573683
call edi
cmp bl, 0x8a
jne 0x1000ec19
lea eax, [esp + 0x10]
push eax
push 0x40
push 1
push 0x573683
call edi
lea eax, [esp + 0x10]
mov byte [0x573683], 0xe9
push eax
push 0x40
push 4
mov esi, 0x1000ecc0
push 0x573684
sub esi, 0x573688
call edi
mov dword [0x573684], esi
pop edi
mov al, 1
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret