Function at 0x10001ab0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [0x101df410], 0
je 0x10001cea
fld dword [0x101df414]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
fstp dword [ebp - 8]
push edi
mov edi, dword [0x101df3e0]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push edi
call esi
fld dword [ebp - 8]
mov edx, dword [ebp - 4]
fstp dword [edi]
lea ecx, [ebp - 4]
push ecx
push edx
push 4
push edi
call esi
fld dword [0x101df418]
mov edi, dword [0x101df3e4]
fstp dword [ebp - 8]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push edi
call esi
fld dword [ebp - 8]
mov edx, dword [ebp - 4]
fstp dword [edi]
lea ecx, [ebp - 4]
push ecx
push edx
push 4
push edi
call esi
fld dword [0x101df41c]
mov edi, dword [0x101df3e8]
fstp dword [ebp - 8]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push edi
call esi
fld dword [ebp - 8]
mov edx, dword [ebp - 4]
fstp dword [edi]
lea ecx, [ebp - 4]
push ecx
push edx
push 4
push edi
call esi
fld dword [0x101df420]
mov edi, dword [0x101df3ec]
fstp dword [ebp - 8]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push edi
call esi
fld dword [ebp - 8]
mov edx, dword [ebp - 4]
fstp dword [edi]
lea ecx, [ebp - 4]
push ecx
push edx
push 4
push edi
call esi
fld dword [0x101df424]
mov edi, dword [0x101df3f0]
fstp dword [ebp - 8]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push edi
call esi
fld dword [ebp - 8]
mov edx, dword [ebp - 4]
fstp dword [edi]
lea ecx, [ebp - 4]
push ecx
push edx
push 4
push edi
call esi
fld dword [0x101df428]
mov edi, dword [0x101df3f4]
fstp dword [ebp - 8]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push edi
call esi
fld dword [ebp - 8]
mov edx, dword [ebp - 4]
fstp dword [edi]
lea ecx, [ebp - 4]
push ecx
push edx
push 4
push edi
call esi
fld dword [0x101df42c]
mov edi, dword [0x101df3f8]
fstp dword [ebp - 8]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push edi
call esi
fld dword [ebp - 8]
mov edx, dword [ebp - 4]
fstp dword [edi]
lea ecx, [ebp - 4]
push ecx
push edx
push 4
push edi
call esi
fld dword [0x101df430]
mov edi, dword [0x101df3fc]
fstp dword [ebp - 8]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push edi
call esi
fld dword [ebp - 8]
mov edx, dword [ebp - 4]
fstp dword [edi]
lea ecx, [ebp - 4]
push ecx
push edx
push 4
push edi
call esi
cmp dword [0x6b8d48], 0x1e
jne 0x10001ce8
mov edi, dword [0x101df400]
fld dword [0x101df434]
lea eax, [ebp - 4]
fstp dword [ebp - 8]
push eax
push 0x40
push 4
push edi
call esi
fld dword [ebp - 8]
mov edx, dword [ebp - 4]
fstp dword [edi]
lea ecx, [ebp - 4]
push ecx
push edx
push 4
push edi
call esi
fld dword [0x101df438]
mov edi, dword [0x101df404]
fstp dword [ebp - 8]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push edi
call esi
fld dword [ebp - 8]
mov edx, dword [ebp - 4]
fstp dword [edi]
lea ecx, [ebp - 4]
push ecx
push edx
push 4
push edi
call esi
fld dword [0x101df43c]
mov edi, dword [0x101df408]
fstp dword [ebp - 8]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push edi
call esi
fld dword [ebp - 8]
mov edx, dword [ebp - 4]
fstp dword [edi]
lea ecx, [ebp - 4]
push ecx
push edx
push 4
push edi
call esi
fld dword [0x101df440]
mov edi, dword [0x101df40c]
fstp dword [ebp - 8]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push edi
call esi
fld dword [ebp - 8]
mov edx, dword [ebp - 4]
fstp dword [edi]
lea ecx, [ebp - 4]
push ecx
push edx
push 4
push edi
call esi
pop edi
pop esi
mov ecx, 3
call fcn.10002e30
test eax, eax
jne 0x10001d0e
mov eax, 0x10061988
push 1
push eax
mov eax, 0x548ab0
call eax
add esp, 8
mov esp, ebp
pop ebp
ret
add eax, 4
push 1
push eax
mov eax, 0x548ab0
call eax
add esp, 8
mov esp, ebp
pop ebp
ret