Function at 0x10018640
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea eax, [ebp - 0xc]
push esi
push edi
push eax
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0xe9
push eax
push 0x467913
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push eax
call edi
mov eax, 0x10018610
sub eax, 0x467918
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 0x10]
push eax
push 0x467914
call ebx
push eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x14]
push eax
push 0x40
push 2
push 0x467918
call esi
mov eax, 0x467918
mov ecx, 0x90909090
mov word [eax], cx
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push 2
push 0x467918
call esi
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 0xe9
push eax
push 1
lea eax, [ebp - 4]
push eax
push 0x52679e
call ebx
push eax
call edi
mov eax, 0x10017ed0
sub eax, 0x5267a3
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
push 0x52679f
call ebx
push eax
call edi
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 0xe9
push eax
push 1
lea eax, [ebp - 4]
push eax
push 0x51f534
call ebx
push eax
call edi
mov eax, 0x10018220
sub eax, 0x51f539
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
push 0x51f535
call ebx
push eax
call edi
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 0xe9
push eax
push 1
lea eax, [ebp - 4]
push eax
push 0x4571c4
call ebx
push eax
call edi
mov eax, 0x10018260
sub eax, 0x4571c9
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
push 0x4571c5
call ebx
push eax
call edi
lea eax, [ebp - 0x14]
push eax
push 0x40
push 1
push 0x4571c9
call esi
mov eax, 0x4571c9
mov byte [eax], 0x90
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push 1
push 0x4571c9
call esi
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 0xe9
push eax
push 1
lea eax, [ebp - 4]
push eax
push 0x5293f7
call ebx
push eax
call edi
mov eax, 0x10018370
sub eax, 0x5293fc
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
push 0x5293f8
call ebx
push eax
call edi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x90
push eax
push 0x5293fc
call ebx
push eax
call edi
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x90
push eax
push 0x5293fd
call ebx
push eax
call edi
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 0xe9
push eax
push 1
lea eax, [ebp - 4]
push eax
push 0x4150c4
call ebx
push eax
call edi
mov eax, 0x100183e0
sub eax, 0x4150c9
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
push 0x4150c5
call ebx
push eax
call edi
lea eax, [ebp - 0x14]
push eax
push 0x40
push 2
push 0x4150c9
call esi
mov eax, 0x4150c9
mov ecx, 0x90909090
mov word [eax], cx
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push 2
push 0x4150c9
call esi
lea eax, [ebp - 0xc]
mov byte [ebp - 4], 0xf
push eax
push 1
lea eax, [ebp - 4]
mov byte [ebp - 5], 0x87
push eax
push 0x4bd382
call ebx
push eax
call edi
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 5]
push eax
push 0x4bd383
call ebx
push eax
call edi
mov eax, 0x10018540
sub eax, 0x4bd388
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 0x10]
push eax
push 0x4bd384
call ebx
push eax
call edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret