Function at 0x1004aa40
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1018b06c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x1004a7f0
push 0x84a91a
push 0xe8
call fcn.100b1680
push 0x1004a7e0
push 0x84a6d7
push 0xe9
call fcn.100b1680
push 0x1004a2a0
push 0x84bcb0
push 0xe9
call fcn.100b1680
push 0x10049ad0
push 0x84bdb0
push 0xe9
call fcn.100b1680
push 0x10049a80
push 0x84bd50
push 0xe9
call fcn.100b1680
push 0x10049690
push 0x664568
push 0xe8
call fcn.100b1680
add esp, 0x48
mov edx, 0x10049730
mov ecx, 0x66458a
push 0xe8
call fcn.100b0f00
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
add esp, 4
mov word [ebp - 0x10], 0xc281
mov dword [ebp - 0xe], 0x101d0b84
mov dword [ebp - 8], 0
push eax
push 0x40
push 6
push 0x51c629
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1004ab40
mov eax, dword [ebp - 0x10]
mov ecx, 0x51c629
mov dword [ecx], eax
mov ax, word [ebp - 0xc]
mov word [ecx + 4], ax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 8]
mov dword [ebp - 0x14], 0
push 6
push ecx
call esi
test eax, eax
jne 0x1004ab42
call edi
lea eax, [ebp - 8]
mov byte [ebp - 0x10], 0x68
push eax
push 0x40
push 5
push 0x78f28a
mov dword [ebp - 0xf], 0x101d0b84
mov dword [ebp - 8], 0
call esi
test eax, eax
je 0x1004ab8e
mov eax, dword [ebp - 0x10]
mov ecx, 0x78f28a
mov dword [ecx], eax
mov al, byte [ebp - 0xc]
mov byte [ecx + 4], al
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 8]
mov dword [ebp - 0x14], 0
push 5
push ecx
call esi
test eax, eax
jne 0x1004ab90
call edi
push 0x89
push 0xb6
push ecx
lea edx, [ebp - 0x14]
mov dword [ebp - 0x14], 0x101d0cc4
mov ecx, 0x95fed9
call fcn.100b19a0
add esp, 0xc
mov word [ebp - 0x10], 0x918b
lea eax, [ebp - 8]
mov dword [ebp - 0xe], 0x101d0e04
mov dword [ebp - 8], 0
push eax
push 0x40
push 6
push 0x95ff91
call esi
test eax, eax
je 0x1004ac02
mov eax, dword [ebp - 0x10]
mov ecx, 0x95ff91
mov dword [ecx], eax
mov ax, word [ebp - 0xc]
mov word [ecx + 4], ax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 8]
mov dword [ebp - 0x14], 0
push 6
push ecx
call esi
test eax, eax
jne 0x1004ac04
call edi
lea eax, [ebp - 8]
mov dword [ebp - 0x14], 0x101d0b6c
push eax
push 0x40
push 6
push 0x95e6b7
mov word [ebp - 0x1c], 0x3d83
mov dword [ebp - 0x1a], 0x101d0b6c
mov dword [ebp - 8], 0
call esi
test eax, eax
je 0x1004ac5b
mov eax, dword [ebp - 0x1c]
mov ecx, 0x95e6b7
mov dword [ecx], eax
mov ax, word [ebp - 0x18]
mov word [ecx + 4], ax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
mov dword [ebp - 0x10], 0
push 6
push ecx
call esi
test eax, eax
jne 0x1004ac5d
call edi
lea eax, [ebp - 8]
mov word [ebp - 0x1c], 0x583
push eax
push 0x40
push 6
push 0x95e70d
mov dword [ebp - 0x1a], 0x101d0b6c
mov dword [ebp - 8], 0
call esi
test eax, eax
je 0x1004acad
mov eax, dword [ebp - 0x1c]
mov ecx, 0x95e70d
mov dword [ecx], eax
mov ax, word [ebp - 0x18]
mov word [ecx + 4], ax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
mov dword [ebp - 0x10], 0
push 6
push ecx
call esi
test eax, eax
jne 0x1004acaf
call edi
lea eax, [ebp - 8]
mov word [ebp - 0x1c], 0x53b
push eax
push 0x40
push 6
push 0x95fe98
mov dword [ebp - 0x1a], 0x101d0b6c
mov dword [ebp - 8], 0
call esi
test eax, eax
je 0x1004acff
mov eax, dword [ebp - 0x1c]
mov ecx, 0x95fe98
mov dword [ecx], eax
mov ax, word [ebp - 0x18]
mov word [ecx + 4], ax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
mov dword [ebp - 0x10], 0
push 6
push ecx
call esi
test eax, eax
jne 0x1004ad01
call edi
lea eax, [ebp - 8]
mov word [ebp - 0x1c], 0x53b
push eax
push 0x40
push 6
push 0x95ff7f
mov dword [ebp - 0x1a], 0x101d0b6c
mov dword [ebp - 8], 0
call esi
test eax, eax
je 0x1004ad51
mov eax, dword [ebp - 0x1c]
mov ecx, 0x95ff7f
mov dword [ecx], eax
mov ax, word [ebp - 0x18]
mov word [ecx + 4], ax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
mov dword [ebp - 0x10], 0
push 6
push ecx
call esi
test eax, eax
jne 0x1004ad53
call edi
lea eax, [ebp - 8]
mov word [ebp - 0x1c], 0xd3b
push eax
push 0x40
push 6
push 0x51c61b
mov dword [ebp - 0x1a], 0x101d0b6c
mov dword [ebp - 8], 0
call esi
test eax, eax
je 0x1004ada3
mov eax, dword [ebp - 0x1c]
mov ecx, 0x51c61b
mov dword [ecx], eax
mov ax, word [ebp - 0x18]
mov word [ecx + 4], ax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
mov dword [ebp - 0x10], 0
push 6
push ecx
call esi
test eax, eax
jne 0x1004ada5
call edi
lea eax, [ebp - 8]
mov word [ebp - 0x1c], 0x5c7
push eax
push 0x40
push 6
push 0x64e2cc
mov dword [ebp - 0x1a], 0x101d0b6c
mov dword [ebp - 8], 0
call esi
test eax, eax
je 0x1004adf5
mov eax, dword [ebp - 0x1c]
mov ecx, 0x64e2cc
mov dword [ecx], eax
mov ax, word [ebp - 0x18]
mov word [ecx + 4], ax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
mov dword [ebp - 0x10], 0
push 6
push ecx
call esi
test eax, eax
jne 0x1004adf7
call edi
lea eax, [ebp - 8]
mov word [ebp - 0x1c], 0x3d83
push eax
push 0x40
push 6
push 0x5c60cb
mov dword [ebp - 0x1a], 0x101d0b6c
mov dword [ebp - 8], 0
call esi
test eax, eax
je 0x1004ae47
mov eax, dword [ebp - 0x1c]
mov ecx, 0x5c60cb
mov dword [ecx], eax
mov ax, word [ebp - 0x18]
mov word [ecx + 4], ax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
mov dword [ebp - 0x10], 0
push 6
push ecx
call esi
test eax, eax
jne 0x1004ae49
call edi
lea eax, [ebp - 8]
mov word [ebp - 0x1c], 0x3d83
push eax
push 0x40
push 6
push 0x814033
mov dword [ebp - 0x1a], 0x101d0b6c
mov dword [ebp - 8], 0
call esi
test eax, eax
je 0x1004ae99
mov eax, dword [ebp - 0x1c]
mov ecx, 0x814033
mov dword [ecx], eax
mov ax, word [ebp - 0x18]
mov word [ecx + 4], ax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
mov dword [ebp - 0x10], 0
push 6
push ecx
call esi
test eax, eax
jne 0x1004ae9b
call edi
lea eax, [ebp - 8]
mov word [ebp - 0x1c], 0x3d83
push eax
push 0x40
push 6
push 0x5ad1b2
mov dword [ebp - 0x1a], 0x101d0b6c
mov dword [ebp - 8], 0
call esi
test eax, eax
je 0x1004aeeb
mov eax, dword [ebp - 0x1c]
mov ecx, 0x5ad1b2
mov dword [ecx], eax
mov ax, word [ebp - 0x18]
mov word [ecx + 4], ax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
mov dword [ebp - 0x10], 0
push 6
push ecx
call esi
test eax, eax
jne 0x1004aeed
call edi
lea eax, [ebp - 8]
mov word [ebp - 0x1c], 0x3d83
push eax
push 0x40
push 6
push 0x78f274
mov dword [ebp - 0x1a], 0x101d0b6c
mov dword [ebp - 8], 0
call esi
test eax, eax
je 0x1004af3d
mov eax, dword [ebp - 0x1c]
mov ecx, 0x78f274
mov dword [ecx], eax
mov ax, word [ebp - 0x18]
mov word [ecx + 4], ax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
mov dword [ebp - 0x10], 0
push 6
push ecx
call esi
test eax, eax
jne 0x1004af3f
call edi
push 0xd
push 0xaf
push ecx
lea edx, [ebp - 0x14]
mov ecx, 0x84ba51
call fcn.100b19a0
mov eax, dword [ebp - 0x14]
add esp, 0xc
mov dword [ebp - 0x1a], eax
lea eax, [ebp - 0x14]
mov word [ebp - 0x1c], 0x3d83
mov dword [ebp - 0x14], 0
push eax
push 0x40
push 6
push 0x84a47b
call esi
test eax, eax
je 0x1004afa6
mov eax, dword [ebp - 0x1c]
mov ecx, 0x84a47b
mov dword [ecx], eax
mov ax, word [ebp - 0x18]
mov word [ecx + 4], ax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
mov dword [ebp - 0x10], 0
push 6
push ecx
call esi
test eax, eax
jne 0x1004afa8
call edi
push 0x10049a60
push 0x5b8395
push 0xe8
call fcn.100b1680
push 0x10049a60
push 0x5b83ad
push 0xe8
call fcn.100b1680
push 0x10049a60
push 0x5b83c5
push 0xe8
call fcn.100b1680
push 0x10049a60
push 0x5b84eb
push 0xe8
call fcn.100b1680
push 0x10049a60
push 0x5b8506
push 0xe8
call fcn.100b1680
push 0x10049a60
push 0x5b851e
push 0xe8
call fcn.100b1680
add esp, 0x48
push 0x10049a50
push 0x5b83ee
push 0xe8
call fcn.100b1680
push 0x10049a50
push 0x5b84d3
push 0xe8
call fcn.100b1680
push 0x10049a50
push 0x5b856c
push 0xe8
call fcn.100b1680
push 0x10049a50
push 0x5b857a
push 0xe8
call fcn.100b1680
mov ecx, dword [ebp - 4]
add esp, 0x30
xor ecx, ebp
pop edi
pop esi
call fcn.100d52b0
mov esp, ebp
pop ebp
ret