Function at 0x10023e50
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x1006b00c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x10072118], 0
push ebx
mov ebx, ecx
jne 0x100240e1
push esi
push edi
call fcn.10023610
mov eax, dword [0x100710d0]
mov ecx, fcn.10006e50
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esi, [eax + 0x40]
cmp esi, 0x1000
jbe 0x10023ec1
cmp ecx, 0x1000
jbe 0x10023ec1
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x2c]
mov dword [esi], fcn.10006e50
push eax
push dword [ebp - 8]
push 4
push esi
call edi
mov eax, dword [0x100710d0]
mov ecx, fcn.10006e50
lea esi, [eax + 0x44]
cmp esi, 0x1000
jbe 0x10023ef6
cmp ecx, 0x1000
jbe 0x10023ef6
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x30]
mov dword [esi], fcn.10006e50
push eax
push dword [ebp - 0xc]
push 4
push esi
call edi
mov eax, dword [0x100710d0]
lea esi, [eax + 0x48]
mov ecx, fcn.10006e50
cmp esi, 0x1000
jbe 0x10023f35
cmp ecx, 0x1000
jbe 0x10023f35
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x34]
mov dword [esi], fcn.10006e50
push eax
push dword [ebp - 0x10]
push 4
push esi
call edi
mov eax, dword [0x100710d0]
mov ecx, fcn.10006e50
lea esi, [eax + 0x4c]
cmp esi, 0x1000
jbe 0x10023f6a
cmp ecx, 0x1000
jbe 0x10023f6a
lea eax, [ebp - 0x14]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x38]
mov dword [esi], fcn.10006e50
push eax
push dword [ebp - 0x14]
push 4
push esi
call edi
mov eax, dword [0x100710d0]
lea esi, [eax + 0x50]
mov ecx, fcn.10006e50
cmp esi, 0x1000
jbe 0x10023fa9
cmp ecx, 0x1000
jbe 0x10023fa9
lea eax, [ebp - 0x18]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x3c]
mov dword [esi], fcn.10006e50
push eax
push dword [ebp - 0x18]
push 4
push esi
call edi
mov eax, dword [0x100710d0]
mov ecx, fcn.10006e50
lea esi, [eax + 0x54]
cmp esi, 0x1000
jbe 0x10023fde
cmp ecx, 0x1000
jbe 0x10023fde
lea eax, [ebp - 0x1c]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x40]
mov dword [esi], fcn.10006e50
push eax
push dword [ebp - 0x1c]
push 4
push esi
call edi
mov eax, dword [0x100710d0]
lea esi, [eax + 0x58]
cmp esi, 0x1000
jbe 0x10024018
mov ecx, fcn.10006e50
cmp ecx, 0x1000
jbe 0x10024018
lea eax, [ebp - 0x20]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x44]
mov dword [esi], fcn.10006e50
push eax
push dword [ebp - 0x20]
push 4
push esi
call edi
mov eax, dword [0x100710d0]
cmp dword [0x10072ca4], 0
jne 0x10024066
lea esi, [eax + 0x38]
cmp esi, 0x1000
jbe 0x1002405f
mov eax, 0x100234a0
cmp eax, 0x1000
jbe 0x1002405f
mov eax, dword [esi]
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x24]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x28]
mov dword [esi], 0x100234a0
push eax
push dword [ebp - 0x24]
push 4
push esi
call edi
mov eax, dword [ebp - 0x48]
jmp 0x10024061
xor eax, eax
mov dword [0x10072ca4], eax
cmp dword [0x10070ef0], 0
jne 0x100240d5
mov ecx, dword [0x10070afc]
mov eax, dword [0x10073044]
add eax, 0x2f8
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov dword [ebp - 0x48], eax
cmp eax, 0x1000
jbe 0x100240ce
push 0xc
call fcn.1004a636
add esp, 4
mov esi, eax
lea eax, [ebp - 0x28]
push eax
push 0x40
push 0xc
push esi
call edi
mov edx, dword [ebp - 0x48]
mov ecx, dword [edx]
mov dword [esi], ecx
mov ax, word [edx + 4]
mov word [esi + 4], ax
mov al, byte [edx + 6]
mov byte [esi + 6], al
lea eax, [esi + 7]
sub edx, eax
mov byte [eax], 0xe9
add edx, 2
mov dword [eax + 1], edx
add eax, 0xfffffff9
jmp 0x100240d0
xor eax, eax
mov dword [0x10070ef0], eax
pop edi
mov dword [0x10072118], 1
pop esi
call fcn.1001c250
mov ecx, dword [0x10070f40]
test ecx, ecx
jne 0x100240fc
mov dword [0x1007085c], 0x32
jmp 0x10024130
cmp ecx, 1
jne 0x1002410d
mov dword [0x1007085c], 6
jmp 0x10024130
cmp ecx, 2
jne 0x1002411e
mov dword [0x1007085c], 5
jmp 0x10024130
mov eax, dword [0x1007085c]
xor edx, edx
cmp ecx, 3
cmove eax, edx
mov dword [0x1007085c], eax
call fcn.10019e90
call fcn.1001a160
mov ecx, ebx
call fcn.1001a2d0
mov ecx, ebx
call fcn.1001bf00
call fcn.10021c80
mov ecx, ebx
call fcn.1001d890
mov ecx, ebx
call fcn.1001de10
call fcn.100208a0
call fcn.100212a0
call fcn.100209b0
call fcn.1001f070
call fcn.100211f0
call fcn.1001f140
call fcn.10021ad0
call fcn.10021bc0
call fcn.10021720
call fcn.10021410
call fcn.10021dc0
call fcn.10022500
call fcn.100221a0
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.10049dd9
mov esp, ebp
pop ebp
ret