Function at 0x10091a10
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 0xc]
push edi
push eax
push 0x40
push 4
push 0x508680
call esi
lea eax, [esp + 0x10]
mov dword [0x508680], 0xa0000001
push eax
push dword [esp + 0x14]
push 4
push 0x508680
call esi
lea eax, [esp + 0x10]
push eax
push 0x40
push 4
push 0x973aaa
call esi
lea eax, [esp + 0x10]
mov dword [0x973aaa], 0xa0000002
push eax
push dword [esp + 0x14]
push 4
push 0x973aaa
call esi
lea eax, [esp + 0x10]
push eax
push 0x40
push 4
push 0x508649
call esi
lea eax, [esp + 0x10]
mov dword [0x508649], 0xa0000001
push eax
push dword [esp + 0x14]
push 4
push 0x508649
call esi
lea eax, [esp + 0x10]
push eax
push 0x40
push 4
push 0x9721d2
call esi
lea eax, [esp + 0x10]
mov dword [0x9721d2], 0xa0000002
push eax
push dword [esp + 0x14]
push 4
push 0x9721d2
call esi
lea eax, [esp + 0x10]
push eax
push 0x40
push 4
push 0x972210
call esi
lea eax, [esp + 0x10]
mov dword [0x972210], 0xa0000003
push eax
push dword [esp + 0x14]
push 4
push 0x972210
call esi
lea eax, [esp + 0x10]
push eax
push 0x40
push 1
push 0x97391d
call esi
mov eax, 0x97391d
mov byte [eax], 0xeb
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push 1
push 0x97391d
call esi
lea eax, [esp + 0x10]
push eax
push 0x40
push 1
push 0x97253f
call esi
mov eax, 0x97253f
mov byte [eax], 0xeb
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push 1
push 0x97253f
call esi
lea eax, [esp + 0x10]
push eax
push 0x40
push 1
push 0x973d80
call esi
mov eax, 0x973d80
mov byte [eax], 0xeb
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push 1
push 0x973d80
call esi
lea eax, [esp + 0x10]
push eax
push 0x40
push 2
push 0x973c20
call esi
mov eax, 0x973c20
mov edi, 0x90909090
mov word [eax], di
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push 2
push 0x973c20
call esi
lea eax, [esp + 0x10]
push eax
push 0x40
push 1
push 0x972402
call esi
mov eax, 0x972402
mov byte [eax], 0xeb
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push 1
push 0x972402
call esi
lea eax, [esp + 0x10]
push eax
push 0x40
push 1
push 0x9755fd
call esi
mov eax, 0x9755fd
mov byte [eax], 0xeb
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push 1
push 0x9755fd
call esi
lea eax, [esp + 0x10]
push eax
push 0x40
push 1
push 0x976012
call esi
mov eax, 0x976012
mov byte [eax], 0xeb
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push 1
push 0x976012
call esi
lea eax, [esp + 0x10]
push eax
push 0x40
push 2
push 0x96fef6
call esi
mov eax, 0x96fef6
mov word [eax], di
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push 2
push 0x96fef6
call esi
lea eax, [esp + 0x10]
push eax
push 0x40
push 2
push 0x9945bd
call esi
mov eax, 0x9945bd
mov word [eax], di
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push 2
push 0x9945bd
call esi
lea eax, [esp + 0x10]
push eax
push 0x40
push 2
push 0x9945cc
call esi
mov eax, 0x9945cc
mov word [eax], di
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push 2
push 0x9945cc
call esi
lea eax, [esp + 0x10]
push eax
push 0x40
push 2
push 0x994614
call esi
mov eax, 0x994614
mov word [eax], di
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push 2
push 0x994614
call esi
lea eax, [esp + 0x10]
push eax
push 0x40
push 2
push 0x994623
call esi
mov eax, 0x994623
mov word [eax], di
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push 2
push 0x994623
call esi
lea eax, [esp + 0x10]
push eax
push 0x40
push 2
push 0x994874
call esi
mov eax, 0x994874
mov word [eax], di
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push 2
push 0x994874
call esi
lea eax, [esp + 0x10]
push eax
push 0x40
push 2
push 0x994883
call esi
mov eax, 0x994883
mov word [eax], di
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push 2
push 0x994883
call esi
lea eax, [esp + 0x10]
push eax
push 0x40
push 2
push 0x994744
call esi
mov eax, 0x994744
mov word [eax], di
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push 2
push 0x994744
call esi
lea eax, [esp + 0x10]
push eax
push 0x40
push 2
push 0x994753
call esi
mov eax, 0x994753
mov word [eax], di
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push 2
push 0x994753
call esi
lea eax, [esp + 0x10]
push eax
push 0x40
push 6
push 0x9702e4
call esi
mov eax, 0x9702e4
mov ecx, edi
mov dword [eax], ecx
mov word [eax + 4], cx
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push 6
push 0x9702e4
call esi
lea eax, [esp + 0x10]
push eax
push 0x40
push 6
push 0x9703e2
call esi
mov eax, 0x9703e2
mov ecx, edi
mov dword [eax], ecx
mov word [eax + 4], cx
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push 6
push 0x9703e2
call esi
lea eax, [esp + 0x10]
push eax
push 0x40
push 6
push 0x9704e0
call esi
mov eax, 0x9704e0
mov ecx, edi
mov dword [eax], ecx
mov word [eax + 4], cx
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push 6
push 0x9704e0
call esi
lea eax, [esp + 0x10]
push eax
push 0x40
push 6
push 0x97064e
call esi
mov eax, 0x97064e
mov ecx, edi
mov dword [eax], ecx
mov word [eax + 4], cx
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push 6
push 0x97064e
call esi
lea eax, [esp + 0x10]
push eax
push 0x40
push 6
push 0x97076e
call esi
mov eax, 0x97076e
mov ecx, edi
mov dword [eax], ecx
mov word [eax + 4], cx
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x14]
push 6
push 0x97076e
call esi
push 0x10092e50
push 0x96ff0a
push 0xe9
call fcn.10099d10
push 0x10092e60
push 0x9945e8
push 0xe9
call fcn.10099d10
push 0x10092e80
push 0x99463f
push 0xe9
call fcn.10099d10
push 0x10092ea0
push 0x99489f
push 0xe9
call fcn.10099d10
push 0x10092ec0
push 0x99476f
push 0xe9
call fcn.10099d10
push 0x10092ee0
push 0x64b98f
push 0xe9
call fcn.10099d10
add esp, 0x48
push 0x10092f10
push 0x64ba4a
push 0xe9
call fcn.10099d10
push 0x10092f50
push 0x436d38
push 0xe9
call fcn.10099d10
push 0x10092f90
push 0x59b695
push 0xe9
call fcn.10099d10
push 0x10092fb0
push 0x59b90b
push 0xe9
call fcn.10099d10
push 0x10092fd0
push 0x970358
push 0xe9
call fcn.10099d10
push 0x10092ff0
push 0x970456
push 0xe9
call fcn.10099d10
add esp, 0x48
push 0x10093010
push 0x9705be
push 0xe9
call fcn.10099d10
push 0x10093030
push 0x9706c5
push 0xe9
call fcn.10099d10
push 0x10093050
push 0x9707e5
push 0xe9
call fcn.10099d10
push 0x10093070
push 0x97c4f4
push 0xe9
call fcn.10099d10
push 0x100930a0
push 0x97c546
push 0xe9
call fcn.10099d10
push 0x100930b0
push 0x97c746
push 0xe9
call fcn.10099d10
add esp, 0x48
push 0x100930e0
push 0x97c7bf
push 0xe9
call fcn.10099d10
push 0x10092500
push 0x51dd27
push 0xe8
call fcn.10099d10
push 0x10092500
push 0x51dd7a
push 0xe8
call fcn.10099d10
push 0x100924c0
push 0x51dddc
push 0xe8
call fcn.10099d10
push 0x100924c0
push 0x51de3e
push 0xe8
call fcn.10099d10
push 0x10092500
push 0x51deb5
push 0xe8
call fcn.10099d10
add esp, 0x48
push 0x100924c0
push 0x51def3
push 0xe8
call fcn.10099d10
push 0x10092500
push 0x51df1b
push 0xe8
call fcn.10099d10
push 0x100924c0
push 0x547a0c
push 0xe8
call fcn.10099d10
push 0x100924c0
push 0x63cf1d
push 0xe8
call fcn.10099d10
push 0x100924c0
push 0x63d13f
push 0xe8
call fcn.10099d10
push 0x100924c0
push 0x63d2b6
push 0xe8
call fcn.10099d10
add esp, 0x48
push 0x100924e0
push 0x63d324
push 0xe8
call fcn.10099d10
push 0x100924c0
push 0x63d79c
push 0xe8
call fcn.10099d10
push 0x100924c0
push 0x63d81f
push 0xe8
call fcn.10099d10
push 0x100924c0
push 0x63d88b
push 0xe8
call fcn.10099d10
push 0x100924c0
push 0x63d8d3
push 0xe8
call fcn.10099d10
push 0x100924c0
push 0x63d93a
push 0xe8
call fcn.10099d10
add esp, 0x48
push 0x100924c0
push 0x63d9b1
push 0xe8
call fcn.10099d10
push 0x100924c0
push 0x63da28
push 0xe8
call fcn.10099d10
push 0x100924c0
push 0x63dabf
push 0xe8
call fcn.10099d10
push 0x100924c0
push 0x63db0c
push 0xe8
call fcn.10099d10
push 0x100924c0
push 0x63db39
push 0xe8
call fcn.10099d10
push 0x100924e0
push 0x63dbb3
push 0xe8
call fcn.10099d10
add esp, 0x48
push 0x100924c0
push 0x63dd80
push 0xe8
call fcn.10099d10
push 0x10092540
push 0x63dda9
push 0xe8
call fcn.10099d10
push 0x100924c0
push 0x64397d
push 0xe8
call fcn.10099d10
push 0x100924c0
push 0x643bce
push 0xe8
call fcn.10099d10
push 0x100924c0
push 0x643c3e
push 0xe8
call fcn.10099d10
push 0x100924c0
push 0x643f67
push 0xe8
call fcn.10099d10
add esp, 0x48
push 0x100924c0
push 0x643fc4
push 0xe8
call fcn.10099d10
push 0x100936f0
push 0x994932
push 0xe9
call fcn.10099d10
push 0x10093720
push 0x9948c0
push 0xe9
call fcn.10099d10
push 0x10093af0
push 0x9459c9
push 0xe9
call fcn.10099d10
add esp, 0x30
xorps xmm0, xmm0
cmp dword [0x104f9600], 6
mov eax, 1
movlpd qword [0x10641b00], xmm0
mov dword [esp + 0x14], eax
jl 0x10092400
movaps xmm5, xmmword [0x100d2330]
mov edx, 0x10641b00
movaps xmm6, xmmword [0x100d25b0]
movaps xmm7, xmmword [0x100d1f70]
movaps xmm4, xmmword [0x100d1f60]
nop dword [eax + eax]
movq xmm3, qword [0x100d1fe0]
lea ecx, [eax + 2]
movd xmm0, eax
pshufd xmm1, xmm0, 0
movq xmm0, xmm5
paddd xmm1, xmm3
paddd xmm1, xmm0
pmovsxdq xmm2, xmm1
movaps xmm1, xmm2
paddq xmm1, xmm6
movaps xmm0, xmm1
paddq xmm0, xmm4
vpmullq xmm0, xmm0, xmm1
vpmullq xmm0, xmm0, xmm1
vpmullq xmm1, xmm0, xmmword [0x100d1f80]
movaps xmm0, xmm2
paddq xmm0, xmm4
vpmullq xmm0, xmm0, xmm2
vpmullq xmm0, xmm0, xmm2
paddq xmm1, xmm0
vpmullq xmm0, xmm1, xmm7
paddq xmm0, xmmword [0x100d25a0]
psrlq xmm0, 1
movups xmmword [edx + eax*8], xmm0
movd xmm0, ecx
pshufd xmm1, xmm0, 0
movq xmm0, xmm5
paddd xmm1, xmm3
paddd xmm1, xmm0
movaps xmm0, xmm4
pmovsxdq xmm2, xmm1
movaps xmm1, xmm6
paddq xmm1, xmm2
paddq xmm0, xmm1
vpmullq xmm0, xmm0, xmm1
vpmullq xmm0, xmm0, xmm1
vpmullq xmm1, xmm0, xmmword [0x100d1f80]
movaps xmm0, xmm4
paddq xmm0, xmm2
vpmullq xmm0, xmm0, xmm2
vpmullq xmm0, xmm0, xmm2
paddq xmm1, xmm0
vpmullq xmm0, xmm1, xmm7
paddq xmm0, xmmword [0x100d25a0]
psrlq xmm0, 1
movups xmmword [eax*8 + 0x10641b10], xmm0
add eax, 4
cmp eax, 0x3e9
jl 0x10092300
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
add eax, 0x190
cdq
mov edi, eax
mov dword [esp + 0x10], eax
add edi, 0xffffff01
mov ebx, edx
mov esi, ebx
mov ecx, edi
adc esi, 0xffffffff
add ecx, 9
push esi
mov eax, esi
push edi
adc eax, 0
push eax
push ecx
call fcn.100c0b90
push esi
push edi
push edx
push eax
call fcn.100c0b90
mov ecx, eax
mov esi, 0x64
mov eax, edx
mul esi
push ebx
mov edi, eax
mov eax, ecx
mul esi
mov ecx, ebx
add edi, edx
mov esi, eax
mov eax, dword [esp + 0x14]
mov edx, eax
add edx, 9
push eax
adc ecx, 0
push ecx
push edx
call fcn.100c0b90
push ebx
push dword [esp + 0x14]
push edx
push eax
call fcn.100c0b90
add esi, eax
mov eax, esi
adc edi, edx
mov ecx, edi
shld ecx, eax, 2
shl eax, 2
add esi, eax
mov eax, dword [esp + 0x14]
adc edi, ecx
shld edi, esi, 1
add esi, esi
add esi, 0x1800fa70
adc edi, 0xffffffff
shrd esi, edi, 1
shr edi, 1
mov dword [eax*8 + 0x10641b00], esi
mov dword [eax*8 + 0x10641b04], edi
inc eax
mov dword [esp + 0x14], eax
cmp eax, 0x3e9
jl 0x10092400
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret