Function at 0x10054900
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x10155018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10229dfc]
cmp eax, 3
je 0x10054923
cmp eax, 4
jne 0x10055b4a
push esi
push edi
push 0x10050830
push 0x8679d0
push 0xe9
call fcn.10087110
push 0x1004a610
push 0x84f406
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x84f43a
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x84f477
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x84f4c0
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x84f4ff
push 0xe8
call fcn.10087110
add esp, 0x48
push 0x1004a610
push 0x8643b6
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x8643ea
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x864427
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x864470
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x8644af
push 0xe8
call fcn.10087110
push 0x1004d5c0
push 0x857890
push 0xe8
call fcn.10087110
add esp, 0x44
mov edx, 5
mov ecx, 0x856776
call fcn.10083c10
push 0x1004d8d0
push 0x85676e
push 0xe8
call fcn.10087110
push 0x1004a7a0
push 0x83510e
push 0xe8
call fcn.10087110
add esp, 0x18
mov edx, 5
mov ecx, 0x7d4fa6
call fcn.10083c10
mov edx, 5
mov ecx, 0x847046
call fcn.10083c10
mov edx, 5
mov ecx, 0x847036
call fcn.10083c10
push 0x1004dd50
push 0x84702e
push 0xe8
call fcn.10087110
push 0x1004ee90
push 0x82ca22
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x82cb4b
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x82cb00
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x82caa5
push 0xe8
call fcn.10087110
add esp, 0x40
push 0x1004a730
push 0x82ca5c
push 0xe8
call fcn.10087110
push 0x1004f100
push 0x842460
push 0xe8
call fcn.10087110
add esp, 0x14
mov edx, 5
mov ecx, 0x835116
call fcn.10083c10
mov edx, 5
mov ecx, 0x8337b8
call fcn.10083c10
push 0x1004d580
push 0x835cb1
push 0xe9
call fcn.10087110
push 0x1004d540
push 0x835c86
push 0xe9
call fcn.10087110
push 0x1004d520
push 0x83516f
push 0xe9
call fcn.10087110
push 0x1004d530
push 0x8352b1
push 0xe9
call fcn.10087110
push 0x1004d430
push 0x83538a
push 0xe8
call fcn.10087110
add esp, 0x40
push 0x1004d360
push 0x834c8d
push 0xe8
call fcn.10087110
push 0x1004a780
push 0x83baf4
push 0xe9
call fcn.10087110
push 0x1004a790
push 0x83bb94
push 0xe9
call fcn.10087110
push 0x10051c80
push 0x77f7ee
push 0xe8
call fcn.10087110
add esp, 0x2c
mov edx, 5
mov ecx, 0x77e906
call fcn.10083c10
push 0x10054800
push 0x77f8ca
push 0xe9
call fcn.10087110
push 0x10054810
push 0x77fa1c
push 0xe9
call fcn.10087110
push 0x10054820
push 0x77faa7
push 0xe9
call fcn.10087110
push 0x10053df0
push 0x7801d7
push 0xe9
call fcn.10087110
push 0x10053e60
push 0x780215
push 0xe9
call fcn.10087110
add esp, 0x40
push 0x10053f30
push 0x781758
push 0xe9
call fcn.10087110
push 0x10053f70
push 0x781805
push 0xe9
call fcn.10087110
push 0x10053fb0
push 0x78190b
push 0xe9
call fcn.10087110
push 0x10054020
push 0x78194c
push 0xe9
call fcn.10087110
push 0x100540f0
push 0x782854
push 0xe9
call fcn.10087110
push 0x10054130
push 0x782a30
push 0xe9
call fcn.10087110
add esp, 0x48
push 0x10054170
push 0x782b83
push 0xe9
call fcn.10087110
push 0x100541d0
push 0x782d13
push 0xe9
call fcn.10087110
push 0x10054240
push 0x782d54
push 0xe9
call fcn.10087110
push 0x10054370
push 0x782f69
push 0xe9
call fcn.10087110
push 0x100543b0
push 0x782fdf
push 0xe9
call fcn.10087110
push 0x100543f0
push 0x7830ed
push 0xe9
call fcn.10087110
add esp, 0x48
push 0x10054460
push 0x78312e
push 0xe9
call fcn.10087110
push 0x10054530
push 0x7832d5
push 0xe9
call fcn.10087110
push 0x10054570
push 0x784029
push 0xe9
call fcn.10087110
push 0x100545a0
push 0x78482d
push 0xe9
call fcn.10087110
push 0x100545d0
push 0x7848a5
push 0xe9
call fcn.10087110
push 0x10054600
push 0x784904
push 0xe9
call fcn.10087110
add esp, 0x48
push 0x10054630
push 0x784973
push 0xe9
call fcn.10087110
push 0x10054660
push 0x7849e4
push 0xe9
call fcn.10087110
push 0x10054690
push 0x784a64
push 0xe9
call fcn.10087110
push 0x100546c0
push 0x784b6b
push 0xe9
call fcn.10087110
push 0x10054730
push 0x784bac
push 0xe9
call fcn.10087110
push 0x1004a610
push 0x882f52
push 0xe8
call fcn.10087110
add esp, 0x48
push 0x1004a730
push 0x882f8c
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x882fd5
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x883030
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x88307b
push 0xe8
call fcn.10087110
push 0x1004a610
push 0x893102
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x89313c
push 0xe8
call fcn.10087110
add esp, 0x48
push 0x1004a730
push 0x893185
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x8931e0
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x89322b
push 0xe8
call fcn.10087110
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
add esp, 0x24
push eax
push 0x40
push 1
push 0x87494c
call esi
lea eax, [ebp - 8]
mov byte [0x87494c], 0x1e
push eax
push dword [ebp - 8]
push 1
push 0x87494c
call esi
push 0x1004a610
push 0x8812a2
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x8812dc
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x881325
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x881380
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x8813cb
push 0xe8
call fcn.10087110
push 0x1004a610
push 0x879ee2
push 0xe8
call fcn.10087110
add esp, 0x48
push 0x1004a730
push 0x879f1c
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x879f65
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x879fc0
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x87a00b
push 0xe8
call fcn.10087110
push 0x1004a6a0
push 0x8747b6
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x8747f0
push 0xe8
call fcn.10087110
add esp, 0x48
push 0x1004a730
push 0x87483c
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x8748a0
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x8748f2
push 0xe8
call fcn.10087110
add esp, 0x24
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x87494c
call esi
lea eax, [ebp - 8]
mov byte [0x87494c], 0x1e
push eax
push dword [ebp - 8]
push 1
push 0x87494c
call esi
push 0x1004a6a0
push 0x8781bc
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x8781f0
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x878230
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x878282
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x8782c8
push 0xe8
call fcn.10087110
add esp, 0x3c
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x87831c
call esi
lea eax, [ebp - 8]
mov byte [0x87831c], 0x1e
push eax
push dword [ebp - 8]
push 1
push 0x87831c
call esi
push 0x1004a6a0
push 0x84d01a
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x84d05a
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x84d0ac
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x84d116
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x84d16e
push 0xe8
call fcn.10087110
add esp, 0x3c
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x84d1af
call esi
lea eax, [ebp - 8]
mov byte [0x84d1af], 0x1e
push eax
push dword [ebp - 8]
push 1
push 0x84d1af
call esi
push 0x1004a6a0
push 0x84a546
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x84a57a
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x84a5ba
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x84a60c
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x84a652
push 0xe8
call fcn.10087110
add esp, 0x3c
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x84a69a
call esi
lea eax, [ebp - 8]
mov byte [0x84a69a], 0x1e
push eax
push dword [ebp - 8]
push 1
push 0x84a69a
call esi
push 0x1004a610
push 0x7c46e6
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x7c471a
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x7c4757
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x7c47a0
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x7c47df
push 0xe8
call fcn.10087110
push 0x1004a6a0
push 0x7f65a6
push 0xe8
call fcn.10087110
add esp, 0x48
push 0x1004a730
push 0x7f65e6
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x7f6638
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x7f66a2
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x7f66fa
push 0xe8
call fcn.10087110
add esp, 0x30
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x7f673a
call esi
lea eax, [ebp - 8]
mov byte [0x7f673a], 0x1e
push eax
push dword [ebp - 8]
push 1
push 0x7f673a
call esi
push 0x1004a610
push 0x80c848
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x80c87c
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x80c8bc
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x80c90e
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x80c954
push 0xe8
call fcn.10087110
push 0x1004a610
push 0x7d1786
push 0xe8
call fcn.10087110
add esp, 0x48
push 0x1004a730
push 0x7d17ba
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x7d17f7
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x7d1840
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x7d187f
push 0xe8
call fcn.10087110
push 0x1004a6a0
push 0x7cb6f6
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x7cb72a
push 0xe8
call fcn.10087110
add esp, 0x48
push 0x1004a730
push 0x7cb767
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x7cb7b0
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x7cb7ef
push 0xe8
call fcn.10087110
add esp, 0x24
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x7cb8d2
call esi
lea eax, [ebp - 8]
mov byte [0x7cb8d2], 0x1e
push eax
push dword [ebp - 8]
push 1
push 0x7cb8d2
call esi
push 0x1004a6a0
push 0x843826
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x84385a
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x843897
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x8438e0
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x84391f
push 0xe8
call fcn.10087110
add esp, 0x3c
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x843af9
call esi
lea eax, [ebp - 8]
mov byte [0x843af9], 0x96
push eax
push dword [ebp - 8]
push 1
push 0x843af9
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x843af4
call esi
lea eax, [ebp - 8]
mov byte [0x843af4], 0xff
push eax
push dword [ebp - 8]
push 1
push 0x843af4
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x843aef
call esi
lea eax, [ebp - 8]
mov byte [0x843aef], 0xf0
push eax
push dword [ebp - 8]
push 1
push 0x843aef
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x843b10
call esi
lea eax, [ebp - 8]
mov byte [0x843b10], 0xbe
push eax
push dword [ebp - 8]
push 1
push 0x843b10
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x843b27
call esi
lea eax, [ebp - 8]
mov byte [0x843b27], 0x1e
push eax
push dword [ebp - 8]
push 1
push 0x843b27
call esi
push 0x1004a610
push 0x83ea46
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x83ea7a
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x83eab7
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x83eb00
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x83eb3f
push 0xe8
call fcn.10087110
push 0x1004a610
push 0x845956
push 0xe8
call fcn.10087110
add esp, 0x48
push 0x1004a730
push 0x84598a
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x8459c7
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x845a10
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x845a4f
push 0xe8
call fcn.10087110
push 0x1004a610
push 0x7c6bcc
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x7c6c06
push 0xe8
call fcn.10087110
add esp, 0x48
push 0x1004a730
push 0x7c6c49
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x7c6c98
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x7c6cdd
push 0xe8
call fcn.10087110
push 0x1004a610
push 0x7c7d0c
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x7c7d46
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x7c7d89
push 0xe8
call fcn.10087110
add esp, 0x48
push 0x1004a730
push 0x7c7dd8
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x7c7e1d
push 0xe8
call fcn.10087110
push 0x1004a610
push 0x850966
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x85099a
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x8509d7
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x850a20
push 0xe8
call fcn.10087110
add esp, 0x48
push 0x1004a730
push 0x850a5f
push 0xe8
call fcn.10087110
push 0x1004a610
push 0x852476
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x8524aa
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x8524e7
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x852530
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x85256f
push 0xe8
call fcn.10087110
add esp, 0x48
push 0x1004a610
push 0x8540b6
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x8540ea
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x854127
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x854170
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x8541af
push 0xe8
call fcn.10087110
push 0x1004a610
push 0x868052
push 0xe8
call fcn.10087110
add esp, 0x48
push 0x1004a730
push 0x86808c
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x8680d5
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x868130
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x86817b
push 0xe8
call fcn.10087110
push 0x1004a610
push 0x87f886
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x87f8ba
push 0xe8
call fcn.10087110
add esp, 0x48
push 0x1004a730
push 0x87f8f7
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x87f940
push 0xe8
call fcn.10087110
push 0x1004a730
push 0x87f97f
push 0xe8
call fcn.10087110
add esp, 0x24
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x7d0ef7
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1005598b
lea eax, [ebp - 0xc]
mov dword [0x7d0ef7], 0x15e
push eax
push dword [ebp - 8]
mov dword [ebp - 0xc], 0
push 4
push 0x7d0ef7
call esi
test eax, eax
jne 0x1005598d
call edi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 4
push 0x7d0f5e
call esi
test eax, eax
je 0x100559cc
lea eax, [ebp - 0xc]
mov dword [0x7d0f5e], 0x15e
push eax
push dword [ebp - 8]
mov dword [ebp - 0xc], 0
push 4
push 0x7d0f5e
call esi
test eax, eax
jne 0x100559ce
call edi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 1
push 0x7d0f07
call esi
test eax, eax
je 0x10055a0a
lea eax, [ebp - 0xc]
mov byte [0x7d0f07], 0x2b
push eax
push dword [ebp - 8]
mov dword [ebp - 0xc], 0
push 1
push 0x7d0f07
call esi
test eax, eax
jne 0x10055a0c
call edi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 1
push 0x7d0f6e
call esi
test eax, eax
je 0x10055a48
lea eax, [ebp - 0xc]
mov byte [0x7d0f6e], 0x58
push eax
push dword [ebp - 8]
mov dword [ebp - 0xc], 0
push 1
push 0x7d0f6e
call esi
test eax, eax
jne 0x10055a4a
call edi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 4
push 0x7d11e0
call esi
test eax, eax
je 0x10055a89
lea eax, [ebp - 0xc]
mov dword [0x7d11e0], 0x15e
push eax
push dword [ebp - 8]
mov dword [ebp - 0xc], 0
push 4
push 0x7d11e0
call esi
test eax, eax
jne 0x10055a8b
call edi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 4
push 0x7d124b
call esi
test eax, eax
je 0x10055aca
lea eax, [ebp - 0xc]
mov dword [0x7d124b], 0x15e
push eax
push dword [ebp - 8]
mov dword [ebp - 0xc], 0
push 4
push 0x7d124b
call esi
test eax, eax
jne 0x10055acc
call edi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 1
push 0x7d11f0
call esi
test eax, eax
je 0x10055b08
lea eax, [ebp - 0xc]
mov byte [0x7d11f0], 0x2b
push eax
push dword [ebp - 8]
mov dword [ebp - 0xc], 0
push 1
push 0x7d11f0
call esi
test eax, eax
jne 0x10055b0a
call edi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 1
push 0x7d125b
call esi
test eax, eax
je 0x10055b46
lea eax, [ebp - 0xc]
mov byte [0x7d125b], 0x58
push eax
push dword [ebp - 8]
mov dword [ebp - 0xc], 0
push 1
push 0x7d125b
call esi
test eax, eax
jne 0x10055b48
call edi
pop edi
pop esi
push 0x1004a5d0
push 0x787ba0
push 0xe9
call fcn.10087110
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
call fcn.100a3a28
mov esp, ebp
pop ebp
ret