Function at 0x10016a90
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x10138018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x100174d0
push 0x40b154
push 0xe9
call fcn.1007f420
add esp, 0xc
push 0x10017550
push 0x64a79a
push 0xff
call fcn.1007f420
add esp, 0xc
push 0x10017550
push 0x64a85f
push 0xff
call fcn.1007f420
add esp, 0xc
push 0x10017550
push 0x656e03
push 0xff
call fcn.1007f420
add esp, 0xc
push 0x10017550
push 0x64ab3d
push 0xff
call fcn.1007f420
add esp, 0xc
push 0x10017550
push 0x64ac02
push 0xff
call fcn.1007f420
add esp, 0xc
push 0x10017550
push 0x63ddf2
push 0xff
call fcn.1007f420
add esp, 0xc
push 0x10017550
push 0x63df89
push 0xff
call fcn.1007f420
add esp, 0xc
push 0x10017550
push 0x63ea4c
push 0xff
call fcn.1007f420
add esp, 0xc
push 0x10017550
push 0x64ca0c
push 0xff
call fcn.1007f420
add esp, 0xc
push 0x10017550
push 0x77faf9
push 0xff
call fcn.1007f420
add esp, 0xc
push 0x10017550
push 0x81071b
push 0xff
call fcn.1007f420
add esp, 0xc
push 0x10017550
push 0x81079b
push 0xff
call fcn.1007f420
add esp, 0xc
push 0x10017450
push 0x47fe31
push 0xff
call fcn.1007f420
add esp, 0xc
push 0x10017450
push 0x59890d
push 0xff
call fcn.1007f420
add esp, 0xc
push 0x10017450
push 0x59a399
push 0xff
call fcn.1007f420
add esp, 0xc
push 0x10017450
push 0x59a93c
push 0xff
call fcn.1007f420
add esp, 0xc
push 0x10017450
push 0x59b13b
push 0xff
call fcn.1007f420
add esp, 0xc
push 0x10017450
push 0x5a4261
push 0xff
call fcn.1007f420
add esp, 0xc
push 0x10017450
push 0x5a4d52
push 0xff
call fcn.1007f420
add esp, 0xc
push 0x10017450
push 0x5b6117
push 0xff
call fcn.1007f420
add esp, 0xc
push 0x10017450
push 0x65a6ce
push 0xff
call fcn.1007f420
add esp, 0xc
push 0x10017450
push 0x727987
push 0xff
call fcn.1007f420
add esp, 0xc
push 0x10017450
push 0x7861f1
push 0xff
call fcn.1007f420
add esp, 0xc
push 0x10017450
push 0x7d32fa
push 0xff
call fcn.1007f420
add esp, 0xc
push 0x10017450
push 0x7d3b0d
push 0xff
call fcn.1007f420
add esp, 0xc
push 0x10017580
push 0x8317bd
push 0xe9
call fcn.1007f420
add esp, 0xc
push 0x10016390
push 0x772459
push 0xe9
call fcn.1007f420
add esp, 0xc
push 0x100163b0
push 0x614ae8
push 0xe9
call fcn.1007f420
add esp, 0xc
push 0x100163d0
push 0x55179f
push 0xe8
call fcn.1007f420
add esp, 0xc
push 0x100163d0
push 0x551911
push 0xe8
call fcn.1007f420
add esp, 0xc
push 0x100163d0
push 0x55272f
push 0xe8
call fcn.1007f420
add esp, 0xc
push 0x100163d0
push 0x59c2de
push 0xe8
call fcn.1007f420
add esp, 0xc
push 0x100163d0
push 0x59d02e
push 0xe8
call fcn.1007f420
add esp, 0xc
push 0x100163d0
push 0x59e6a9
push 0xe8
call fcn.1007f420
add esp, 0xc
push 0x100163d0
push 0x5ac570
push 0xe8
call fcn.1007f420
add esp, 0xc
push 0x100163d0
push 0x5ad840
push 0xe8
call fcn.1007f420
add esp, 0xc
push 0x100163d0
push 0x5adae8
push 0xe8
call fcn.1007f420
add esp, 0xc
push 0x100163d0
push 0x5ade42
push 0xe8
call fcn.1007f420
add esp, 0xc
push 0x100163d0
push 0x5ae1d1
push 0xe8
call fcn.1007f420
add esp, 0xc
push 0x100163d0
push 0x5ae870
push 0xe8
call fcn.1007f420
add esp, 0xc
push 0x100163d0
push 0x5aeb93
push 0xe8
call fcn.1007f420
add esp, 0xc
push 0x100163d0
push 0x5af1cd
push 0xe8
call fcn.1007f420
add esp, 0xc
push 0x100163d0
push 0x5af522
push 0xe8
call fcn.1007f420
add esp, 0xc
push 0x100163d0
push 0x5b05e7
push 0xe8
call fcn.1007f420
add esp, 0xc
push 0x100163d0
push 0x5b073e
push 0xe8
call fcn.1007f420
add esp, 0xc
push 0x100163d0
push 0x5b0c23
push 0xe8
call fcn.1007f420
add esp, 0xc
push 0x100163d0
push 0x5b0da8
push 0xe8
call fcn.1007f420
add esp, 0xc
push 0x100163d0
push 0x5b1898
push 0xe8
call fcn.1007f420
add esp, 0xc
push 0x100163d0
push 0x5b22b3
push 0xe8
call fcn.1007f420
add esp, 0xc
push 0x100163d0
push 0x5b2cb4
push 0xe8
call fcn.1007f420
add esp, 0xc
push 0x100163d0
push 0x5b3870
push 0xe8
call fcn.1007f420
add esp, 0xc
push 0x100163d0
push 0x616a1a
push 0xe8
call fcn.1007f420
add esp, 0xc
push 0x100163d0
push 0x63f4a7
push 0xe8
call fcn.1007f420
add esp, 0xc
push 0x100163d0
push 0x645712
push 0xe8
call fcn.1007f420
add esp, 0xc
push 0x100163d0
push 0x647503
push 0xe8
call fcn.1007f420
add esp, 0xc
push 0x100163d0
push 0x647594
push 0xe8
call fcn.1007f420
add esp, 0xc
push 0x100163d0
push 0x647bdc
push 0xe8
call fcn.1007f420
add esp, 0xc
push 0x100163d0
push 0x749b83
push 0xe8
call fcn.1007f420
add esp, 0xc
push 0x100163d0
push 0x749c03
push 0xe8
call fcn.1007f420
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
add esp, 0xc
push eax
push 0x40
push 1
push 0x8553d0
call esi
lea eax, [ebp - 8]
mov byte [0x8553d0], 0xc3
push eax
push dword [ebp - 8]
push 1
push 0x8553d0
call esi
push 0x58811f
push 0x5880f0
push 0xe9
call fcn.1007f420
add esp, 0xc
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x588447
call esi
lea eax, [ebp - 8]
mov dword [0x588447], 0xfff
push eax
push dword [ebp - 8]
push 4
push 0x588447
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x59a8d0
call esi
lea eax, [ebp - 8]
mov byte [0x59a8d0], 0xeb
push eax
push dword [ebp - 8]
push 1
push 0x59a8d0
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x59b001
call esi
lea eax, [ebp - 8]
mov byte [0x59b001], 0xeb
push eax
push dword [ebp - 8]
push 1
push 0x59b001
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x4cfa8f
call esi
lea eax, [ebp - 8]
mov byte [0x4cfa8f], 0x5b
push eax
push dword [ebp - 8]
push 1
push 0x4cfa8f
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x4cfa90
call esi
lea eax, [ebp - 8]
mov byte [0x4cfa90], 0x2f
push eax
push dword [ebp - 8]
push 1
push 0x4cfa90
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x60d985
call esi
lea eax, [ebp - 8]
mov byte [0x60d985], 0x5b
push eax
push dword [ebp - 8]
push 1
push 0x60d985
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x60d986
call esi
mov byte [0x60d986], 0x2f
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push 0x60d986
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x60f356
call esi
lea eax, [ebp - 8]
mov byte [0x60f356], 0x5b
push eax
push dword [ebp - 8]
push 1
push 0x60f356
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x60f357
call esi
lea eax, [ebp - 8]
mov byte [0x60f357], 0x2f
push eax
push dword [ebp - 8]
push 1
push 0x60f357
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x6103ee
call esi
lea eax, [ebp - 8]
mov byte [0x6103ee], 0x5b
push eax
push dword [ebp - 8]
push 1
push 0x6103ee
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x6103ef
call esi
lea eax, [ebp - 8]
mov byte [0x6103ef], 0x2f
push eax
push dword [ebp - 8]
push 1
push 0x6103ef
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x969c60
call esi
lea eax, [ebp - 8]
mov byte [0x969c60], 0x5b
push eax
push dword [ebp - 8]
push 1
push 0x969c60
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x969c61
call esi
lea eax, [ebp - 8]
mov byte [0x969c61], 0x2f
push eax
push dword [ebp - 8]
push 1
push 0x969c61
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x969b3f
call esi
lea eax, [ebp - 8]
mov byte [0x969b3f], 0xc4
push eax
push dword [ebp - 8]
push 1
push 0x969b3f
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x969b40
call esi
lea eax, [ebp - 8]
mov byte [0x969b40], 0x8a
push eax
push dword [ebp - 8]
push 1
push 0x969b40
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x969b41
call esi
lea eax, [ebp - 8]
mov byte [0x969b41], 0x37
push eax
push dword [ebp - 8]
push 1
push 0x969b41
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x969b60
call esi
lea eax, [ebp - 8]
mov byte [0x969b60], 0xb0
push eax
push dword [ebp - 8]
push 1
push 0x969b60
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x969b61
call esi
lea eax, [ebp - 8]
mov byte [0x969b61], 0x36
push eax
push dword [ebp - 8]
push 1
push 0x969b61
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x969b6f
call esi
lea eax, [ebp - 8]
mov byte [0x969b6f], 0xb0
push eax
push dword [ebp - 8]
push 1
push 0x969b6f
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x969b70
call esi
lea eax, [ebp - 8]
mov byte [0x969b70], 0x36
push eax
push dword [ebp - 8]
push 1
push 0x969b70
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x969bad
call esi
lea eax, [ebp - 8]
mov byte [0x969bad], 0xc0
push eax
push dword [ebp - 8]
push 1
push 0x969bad
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x969bae
call esi
lea eax, [ebp - 8]
mov byte [0x969bae], 0x8a
push eax
push dword [ebp - 8]
push 1
push 0x969bae
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x969baf
call esi
lea eax, [ebp - 8]
mov byte [0x969baf], 0x37
push eax
push dword [ebp - 8]
push 1
push 0x969baf
call esi
cmp byte [0x10146471], 1
jne 0x10017407
lea eax, [ebp - 8]
push eax
push 0x40
push 0xa
push 0x59ca3c
call esi
mov eax, 0x59ca3c
mov ecx, 0x90909090
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov word [eax + 8], cx
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 0xa
push 0x59ca3c
call esi
push 0x100166d0
push 0x59ca3c
push 0xe9
call fcn.1007f420
add esp, 0xc
push 0x4d1dc2
push 0x4d1cf0
push 0xe9
call fcn.1007f420
add esp, 0xc
push 0x10016a80
push 0x7850ba
push 0xe8
call fcn.1007f420
add esp, 0xc
call fcn.10016710
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1008500c
mov esp, ebp
pop ebp
ret