Function at 0x10001310
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x50
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov ebx, edx
and ebx, 0xffff
cmp dx, 0x27
ja case.0x10001331.3
jmp dword [ebx*4 + 0x1000537c]
mov edx, dword [eax + 0xc4]
add edx, 0x18
mov dword [eax + 0xc4], edx
mov edx, 0x78
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret 8
mov ebx, dword [eax + 0xc4]
mov edx, 0x78
add ebx, 0x10
mov dword [eax + 0xc4], ebx
jmp 0x1000134c
mov edx, dword [eax + 0xc4]
add edx, 4
mov dword [eax + 0xc4], edx
mov edx, 0x78
jmp 0x1000134c
mov edi, dword [eax + 0xc4]
mov edx, 0x78
add edi, 8
mov dword [eax + 0xc4], edi
jmp 0x1000134c
mov ecx, dword [eax + 0xc4]
add ecx, 0xc
mov dword [eax + 0xc4], ecx
mov eax, dword [section..bss]
test eax, eax
jne 0x100013cb
test byte [0x10003018], 2
jne 0x10001b78
inc eax
mov dword [section..bss], eax
lea esp, [ebp - 0xc]
mov edx, 0x78
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret 8
mov al, byte [global___dbch]
and eax, 1
cmp dx, 0x28
ja 0x10001a38
test al, al
jne 0x10001ca8
or edx, 0xffffffff
jmp 0x1000134c
mov edx, dword [eax + 0xc4]
lea ecx, [edx + 4]
mov ebx, dword [edx]
mov dword [eax + 0xc4], ecx
lea ecx, [edx + 8]
mov esi, dword [edx + 4]
mov dword [eax + 0xc4], ecx
mov ecx, dword [edx + 8]
add edx, 0xc
mov dword [eax + 0xc4], edx
test byte [0x10003018], 1
je 0x100013cb
mov eax, ecx
call sym._wine_dbgstr_an.constprop.0
mov edi, eax
mov eax, esi
call sym._wine_dbgstr_an.constprop.0
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.RegLoadKey__p__s__s_:_stub_n
mov dword [esp + 8], 0x1000542c
mov dword [esp + 4], global___dbch
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0
jmp 0x100013cb
mov edx, dword [eax + 0xc4]
lea ecx, [edx + 4]
mov ebx, dword [edx]
mov dword [eax + 0xc4], ecx
lea ecx, [edx + 8]
mov esi, dword [edx + 4]
mov dword [eax + 0xc4], ecx
mov ecx, dword [edx + 8]
add edx, 0xc
mov dword [eax + 0xc4], edx
test byte [0x10003018], 8
jne 0x10001b40
cmp ebx, 0x80080000
je 0x10001ce3
cmp ebx, 0x80000400
je 0x10001a70
cmp ebx, 0x80060000
je 0x10001a70
shl ebx, 0xc
shl esi, 0xc
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x2000
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_VirtualAlloc]
sub esp, 0x10
mov edx, eax
test byte [0x10003018], 8
jne 0x10001c68
test edx, edx
jne 0x1000134c
jmp 0x100013fa
mov ecx, dword [eax + 0xc4]
mov edx, 0x78
add ecx, 0x20
mov dword [eax + 0xc4], ecx
jmp 0x1000134c
mov esi, dword [eax + 0xc4]
mov edx, 0x78
add esi, 0x14
mov dword [eax + 0xc4], esi
jmp 0x1000134c
mov edx, dword [eax + 0xc4]
lea ecx, [edx + 4]
mov ebx, dword [edx]
mov dword [eax + 0xc4], ecx
lea ecx, [edx + 8]
mov esi, dword [edx + 4]
mov dword [eax + 0xc4], ecx
lea ecx, [edx + 0xc]
mov edi, dword [edx + 8]
mov dword [eax + 0xc4], ecx
add edx, 0x10
mov ecx, dword [edx - 4]
mov dword [eax + 0xc4], edx
test byte [0x10003018], 1
je 0x100013cb
mov eax, ecx
call sym._wine_dbgstr_an.constprop.0
mov dword [ebp - 0x30], eax
mov eax, edi
call sym._wine_dbgstr_an.constprop.0
mov edi, eax
mov eax, esi
call sym._wine_dbgstr_an.constprop.0
mov edx, dword [ebp - 0x30]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.RegReplaceKey__p__s__s__s_:_stub_n
mov dword [esp + 8], 0x1000542c
mov dword [esp + 4], global___dbch
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0
mov edx, 0x78
jmp 0x1000134c
mov edx, dword [eax + 0xc4]
lea ecx, [edx + 4]
mov esi, dword [edx]
mov dword [eax + 0xc4], ecx
lea ecx, [edx + 8]
mov edi, dword [edx + 4]
mov dword [eax + 0xc4], ecx
mov ecx, dword [edx + 8]
mov dword [ebp - 0x30], ecx
lea ecx, [edx + 0xc]
mov dword [eax + 0xc4], ecx
add edx, 0x10
mov ebx, dword [edx - 4]
mov dword [eax + 0xc4], edx
test byte [0x10003018], 8
jne 0x10001bd8
shl esi, 0xc
lea eax, [ebp - 0x28]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_VirtualQuery]
mov eax, dword [ebp - 0x14]
sub esp, 0xc
mov dword [ebp - 0x2c], eax
cmp eax, 0x20
ja 0x10001a18
cmp eax, 1
jbe 0x10001a08
lea ecx, [eax - 2]
mov edx, 1
shl edx, cl
test edx, 0x40004001
jne 0x10001abb
and edx, 0x44
jne 0x10001a20
xor ecx, ecx
and ebx, 0xdfffffff
xor al, al
or ebx, ecx
test ebx, 0x40000
je 0x100016bd
and ebx, 0x20000
je 0x10001ca0
or eax, 0x40
lea ecx, [ebp - 0x2c]
mov dword [esp + 8], eax
shl edi, 0xc
mov dword [esp + 0xc], ecx
mov dword [esp + 4], edi
mov dword [esp], esi
mov dword [ebp - 0x30], edx
call dword [sym.imp.kernel32.dll_VirtualProtect]
mov edx, dword [ebp - 0x30]
sub esp, 0x10
test eax, eax
je 0x10001a78
test byte [0x10003018], 8
je 0x1000134c
mov dword [esp + 0x10], edx
mov dword [ebp - 0x30], edx
mov dword [esp + 0xc], str.Returning:__08lx_n
lea esi, [esi]
mov dword [esp + 8], 0x1000542c
mov dword [esp + 4], global___dbch
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
mov edx, dword [ebp - 0x30]
jmp 0x1000134c
mov edx, dword [eax + 0xc4]
lea ecx, [edx + 4]
mov ebx, dword [edx]
mov dword [eax + 0xc4], ecx
add edx, 8
mov ecx, dword [edx - 4]
mov dword [eax + 0xc4], edx
test byte [0x10003018], 8
jne 0x10001b08
mov dword [esp + 8], 0x8000
mov dword [esp + 4], 0
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_VirtualFree]
sub esp, 0xc
mov edx, eax
test byte [0x10003018], 8
je 0x1000134c
mov dword [esp + 0x10], eax
mov dword [ebp - 0x30], eax
mov dword [esp + 0xc], str.Returning:__d_n
jmp 0x10001708
mov edx, dword [eax + 0xc4]
lea ecx, [edx + 4]
mov ebx, dword [edx]
mov dword [eax + 0xc4], ecx
add edx, 8
mov ecx, dword [edx - 4]
mov dword [eax + 0xc4], edx
test byte [0x10003018], 1
je 0x100013cb
mov eax, ecx
call sym._wine_dbgstr_an.constprop.0
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], str.RegUnLoadKey__p__s_:_stub_n
mov dword [esp + 8], 0x1000542c
mov dword [esp + 4], global___dbch
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0
mov edx, 0x78
jmp 0x1000134c
mov ecx, dword [eax + 0xc4]
lea edx, [ecx + 4]
mov esi, dword [ecx]
mov dword [eax + 0xc4], edx
lea edx, [ecx + 8]
mov edi, dword [ecx + 4]
mov dword [eax + 0xc4], edx
mov edx, dword [ecx + 8]
mov dword [ebp - 0x34], edx
lea edx, [ecx + 0xc]
mov dword [eax + 0xc4], edx
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x30], edx
lea edx, [ecx + 0x10]
mov dword [eax + 0xc4], edx
add ecx, 0x14
mov edx, dword [ecx - 4]
mov dword [eax + 0xc4], ecx
test byte [0x10003018], 8
jne 0x10001c18
test edx, 0x40000
je 0x10001875
and edx, 0x20000
cmp edx, 1
sbb ebx, ebx
and ebx, 0xffffffe0
add ebx, 0x40
shl edi, 0xc
mov dword [esp + 0xc], ebx
shl esi, 0xc
mov dword [esp + 8], 0x1000
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_VirtualAlloc]
sub esp, 0x10
mov edx, eax
test byte [0x10003018], 8
je 0x1000134c
mov dword [esp + 0x10], eax
mov dword [ebp - 0x30], eax
mov dword [esp + 0xc], str.PageCommit:_Returning:__p_n
jmp 0x10001708
mov edx, dword [eax + 0xc4]
lea ecx, [edx + 4]
mov ebx, dword [edx]
mov dword [eax + 0xc4], ecx
add edx, 8
mov ecx, dword [edx - 4]
mov dword [eax + 0xc4], edx
xor edx, edx
test byte [0x10003018], 1
je 0x1000134c
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.GetDemandPageInfo__08lx__08lx_:_stub__n
mov dword [esp + 8], 0x1000542c
mov dword [esp + 4], global___dbch
mov dword [esp], 0
mov dword [ebp - 0x30], edx
call sym._wine_dbg_log.constprop.0
mov edx, dword [ebp - 0x30]
jmp 0x1000134c
mov edx, dword [eax + 0xc4]
lea ecx, [edx + 4]
mov ebx, dword [edx]
mov dword [eax + 0xc4], ecx
lea ecx, [edx + 8]
mov esi, dword [edx + 4]
mov dword [eax + 0xc4], ecx
mov ecx, dword [edx + 8]
add edx, 0xc
mov dword [eax + 0xc4], edx
test byte [0x10003018], 8
jne 0x10001ad0
shl esi, 0xc
mov dword [esp + 8], 0x4000
shl ebx, 0xc
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_VirtualFree]
sub esp, 0xc
mov edx, eax
test byte [0x10003018], 8
je 0x1000134c
mov eax, str.TRUE
test edx, edx
jne 0x10001999
mov eax, str.FALSE
mov dword [ebp - 0x30], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.PageDecommit:_Returning:__s_n
jmp 0x10001708
mov edx, dword [eax + 0xc4]
lea ecx, [edx + 4]
mov ebx, dword [edx]
lea esi, [edx + 8]
mov dword [eax + 0xc4], ecx
mov ecx, dword [edx + 4]
mov dword [eax + 0xc4], esi
mov esi, dword [edx + 8]
add edx, 0xc
mov dword [eax + 0xc4], edx
test byte [0x10003018], 1
je 0x100013cb
mov eax, ecx
call sym._wine_dbgstr_an.constprop.0
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.RegSaveKey__p__s__p_:_stub_n
jmp 0x1000145e
xor ecx, ecx
xor edx, edx
jmp 0x1000169c
lea edx, [eax - 0x40]
and edx, 0xffffffbf
jne 0x10001a08
mov ecx, dword [ebp - 0x30]
mov edx, 0x60000
and ecx, 0x60000
jmp 0x1000169c
test al, al
je 0x100013fa
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], str.Unknown_service__08lx_n
mov dword [esp + 8], 0x1000542c
mov dword [esp + 4], global___dbch
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0
jmp 0x100013fa
xor ebx, ebx
jmp 0x100014dd
or edx, 0xffffffff
test byte [0x10003018], 2
je 0x1000134c
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], str.Cant_change_page_permissions_for__p_n
mov dword [esp + 8], 0x1000542c
mov dword [esp + 4], global___dbch
mov dword [esp], 1
mov dword [ebp - 0x30], edx
call sym._wine_dbg_log.constprop.0
mov edx, dword [ebp - 0x30]
jmp 0x1000134c
mov ecx, dword [ebp - 0x30]
mov edx, 0x40000
and ecx, 0x40000
jmp 0x1000169c
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.PageDecommit:_page:__08lx__npages:__08lx__flags:__08lx_partial_stub_n
mov dword [esp + 8], 0x1000542c
mov dword [esp + 4], global___dbch
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x1000195e
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.PageFree:_hmem:__p__flags:__08lx_partial_stub_n
mov dword [esp + 8], 0x1000542c
mov dword [esp + 4], global___dbch
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x1000175a
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.PageReserve:_page:__08lx__npages:__08lx__flags:__08lx_partial_stub__n
mov dword [esp + 8], 0x1000542c
mov dword [esp + 4], global___dbch
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x100014b6
mov dword [esp + 0xc], str.Using_the_native_Win95_advapi32.dll_is_no_longer_supported._n
mov dword [esp + 8], 0x1000542c
mov dword [esp + 4], global___dbch
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0
test byte [0x10003018], 2
je 0x10001bc9
mov dword [esp + 0xc], str.Please_configure_advapi32_to_builtin._n
mov dword [esp + 8], 0x1000542c
mov dword [esp + 4], global___dbch
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0
mov eax, dword [section..bss]
jmp 0x100013c5
mov eax, dword [ebp - 0x30]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], str.PageModifyPermissions__08lx__08lx__08lx__08lx_partial_stub_n
mov dword [esp + 8], 0x1000542c
mov dword [esp + 4], global___dbch
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x10001645
mov eax, dword [ebp - 0x30]
mov dword [esp + 0x20], edx
mov dword [esp + 0x1c], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], str.PageCommit:_page:__08lx__npages:__08lx__hpd:__08lx_pagerdata:__08lx__flags:__08lx_partial_stub_n
mov dword [esp + 8], 0x1000542c
mov dword [esp + 4], global___dbch
mov dword [esp], 3
mov dword [ebp - 0x38], edx
call sym._wine_dbg_log.constprop.0
mov edx, dword [ebp - 0x38]
jmp 0x1000185c
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.PageReserve:_returning:__p_n
mov dword [esp + 8], 0x1000542c
mov dword [esp + 4], global___dbch
mov dword [esp], 3
mov dword [ebp - 0x30], eax
call sym._wine_dbg_log.constprop.0
mov edx, dword [ebp - 0x30]
jmp 0x1000150f
or eax, 0x20
jmp 0x100016bd
mov eax, dword [ebx*4 + 0x10005660]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Unimplemented_service__s___08lx__n
mov dword [esp + 8], 0x1000542c
mov dword [esp + 4], global___dbch
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0
or edx, 0xffffffff
jmp 0x1000134c
test byte [0x10003018], 2
je 0x100013fa
mov dword [esp + 0xc], str.Cant_reserve_ring_1_memory_n
mov dword [esp + 8], 0x1000542c
mov dword [esp + 4], global___dbch
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0
or edx, 0xffffffff
jmp 0x1000134c