Function at 0x1002caf0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea eax, [ebp - 0xc]
push edi
push eax
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0xe8
push eax
push 0x4ad3d4
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push eax
call ebx
mov edi, 0x1002be60
lea eax, [edi - 0x4ad3d9]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 0x10]
push eax
push 0x4ad3d5
call esi
push eax
call ebx
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 0xe8
push eax
push 1
lea eax, [ebp - 4]
push eax
push 0x4ad40f
call esi
push eax
call ebx
lea eax, [edi - 0x4ad414]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
push 0x4ad410
call esi
push eax
call ebx
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 0xe8
push eax
push 1
lea eax, [ebp - 4]
push eax
push 0x4ae836
call esi
push eax
call ebx
lea eax, [edi - 0x4ae83b]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
push 0x4ae837
call esi
push eax
call ebx
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 0xe8
push eax
push 1
lea eax, [ebp - 4]
push eax
push 0x4ae8a5
call esi
push eax
call ebx
lea eax, [edi - 0x4ae8aa]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
push 0x4ae8a6
call esi
push eax
call ebx
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 0xe8
push eax
push 1
lea eax, [ebp - 4]
push eax
push 0x52a817
call esi
push eax
call ebx
lea eax, [ebp - 0x10]
mov esi, 0x1002be60
push eax
push 4
lea eax, [ebp - 0xc]
sub esi, 0x52a81c
push eax
push 0x52a818
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 0xe8
push eax
push 1
lea eax, [ebp - 4]
push eax
push 0x52a817
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
push 0x52a818
call esi
push eax
call ebx
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 0xe8
push eax
push 1
lea eax, [ebp - 4]
push eax
push 0x52a84b
call esi
push eax
call ebx
lea eax, [edi - 0x52a850]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
push 0x52a84c
call esi
push eax
call ebx
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 0xe8
push eax
push 1
lea eax, [ebp - 4]
push eax
push 0x52d342
call esi
push eax
call ebx
lea eax, [edi - 0x52d347]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
push 0x52d343
call esi
push eax
call ebx
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 0xe8
push eax
push 1
lea eax, [ebp - 4]
push eax
push 0x52dd91
call esi
push eax
call ebx
lea eax, [ebp - 0x10]
sub edi, 0x52dd96
push eax
push 4
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], edi
push eax
push 0x52dd92
mov edi, esi
call edi
push eax
call ebx
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 0xe9
push eax
push 1
lea eax, [ebp - 4]
push eax
push 0x41f09d
call edi
push eax
call ebx
mov eax, 0x1002be30
sub eax, 0x41f0a2
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
push 0x41f09e
call edi
push eax
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x14]
push eax
push 0x40
push 1
push 0x41f0a2
call esi
mov eax, 0x41f0a2
mov byte [eax], 0x90
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push 1
push 0x41f0a2
call esi
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 0xe9
push eax
push 1
lea eax, [ebp - 4]
push eax
push 0x4e06e9
call edi
push eax
call ebx
mov eax, 0x1002c3b0
sub eax, 0x4e06ee
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
push 0x4e06ea
call edi
push eax
call ebx
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x26
push eax
push 0x41e76a
call edi
push eax
call ebx
push 0
push 1
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x26
push eax
push 0x41e772
call edi
push eax
call ebx
lea eax, [ebp - 0xc]
mov byte [ebp - 4], 0xf
push eax
push 1
lea eax, [ebp - 4]
mov byte [ebp - 8], 0x87
push eax
push 0x41e7c0
call edi
push eax
call ebx
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 8]
push eax
push 0x41e7c1
call edi
push eax
call ebx
mov eax, 0x1002c510
sub eax, 0x41e7c6
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 0x10]
push eax
push 0x41e7c2
call edi
push eax
call ebx
lea eax, [ebp - 0x10]
mov byte [ebp - 8], 0xe9
push eax
push 1
lea eax, [ebp - 8]
push eax
push 0x4db425
call edi
push eax
call ebx
mov eax, 0x1002c310
sub eax, 0x4db42a
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
push 0x4db426
call edi
push eax
call ebx
lea eax, [ebp - 0x10]
mov byte [ebp - 8], 0xe9
push eax
push 1
lea eax, [ebp - 8]
push eax
push 0x4e34ea
call edi
push eax
call ebx
mov eax, 0x1002c340
sub eax, 0x4e34ef
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
push 0x4e34eb
call edi
push eax
call ebx
lea eax, [ebp - 0xc]
mov byte [ebp - 8], 0xf
push eax
push 1
lea eax, [ebp - 8]
mov byte [ebp - 4], 0x8e
push eax
push 0x4e0427
call edi
push eax
call ebx
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 4]
push eax
push 0x4e0428
call edi
push eax
call ebx
mov eax, 0x1002be50
sub eax, 0x4e042d
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 0x10]
push eax
push 0x4e0429
call edi
push eax
call ebx
lea eax, [ebp - 0x10]
mov byte [ebp - 8], 0xe8
push eax
push 1
lea eax, [ebp - 8]
push eax
push 0x4e09ac
call edi
push eax
call ebx
mov eax, 0x1002c420
sub eax, 0x4e09b1
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
push 0x4e09ad
call edi
push eax
call ebx
mov byte [ebp - 8], 0xe9
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 8]
push eax
push 0x4e07a3
call edi
push eax
call ebx
mov eax, 0x1002c000
sub eax, 0x4e07a8
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
push 0x4e07a4
call edi
push eax
call ebx
lea eax, [ebp - 0x14]
push eax
push 0x40
push 1
push 0x4e07a8
call esi
mov eax, 0x4e07a8
mov byte [eax], 0x90
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push 1
push 0x4e07a8
call esi
lea eax, [ebp - 0x10]
mov byte [ebp - 8], 0xe8
push eax
push 1
lea eax, [ebp - 8]
push eax
push 0x4e08f7
call edi
push eax
call ebx
mov eax, 0x1002c6f0
sub eax, 0x4e08fc
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
push 0x4e08f8
call edi
push eax
call ebx
lea eax, [ebp - 0x10]
mov byte [ebp - 8], 0xe9
push eax
push 1
lea eax, [ebp - 8]
push eax
push 0x4e060d
call edi
push eax
call ebx
mov eax, 0x1002c680
sub eax, 0x4e0612
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
push 0x4e060e
call edi
push eax
call ebx
mov byte [ebp - 8], 0xe9
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 8]
push eax
push 0x4e464d
call edi
push eax
call ebx
mov eax, 0x1002ca90
sub eax, 0x4e4652
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
push 0x4e464e
call edi
push eax
call ebx
lea eax, [ebp - 0x14]
push eax
push 0x40
push 1
push 0x4e4652
call esi
mov eax, 0x4e4652
mov byte [eax], 0x90
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push 1
push 0x4e4652
call esi
lea eax, [ebp - 0x10]
mov byte [ebp - 8], 0xe9
push eax
push 1
lea eax, [ebp - 8]
push eax
push 0x44bf53
call edi
push eax
call ebx
mov eax, 0x1002bcd0
sub eax, 0x44bf58
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push 4
lea eax, [ebp - 0xc]
push eax
push 0x44bf54
call edi
push eax
call ebx
lea eax, [ebp - 0x14]
push eax
push 0x40
push 1
push 0x44bf58
call esi
mov eax, 0x44bf58
mov byte [eax], 0x90
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push 1
push 0x44bf58
call esi
push 0
push 1
lea eax, [ebp - 8]
mov byte [ebp - 8], 0xeb
push eax
push 0x44c08f
call edi
push eax
call ebx
mov byte [ebp - 8], 0x2c
push 0
push 1
lea eax, [ebp - 8]
push eax
push 0x44c090
call edi
push eax
call ebx
lea eax, [ebp - 0x14]
push eax
push 0x40
push 4
push 0x44c091
call esi
mov eax, 0x44c091
mov dword [eax], 0x90909090
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push 4
push 0x44c091
call esi
push 0
push 1
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x6e
push eax
push 0x4d6fde
call edi
push eax
call ebx
push 0
push 1
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x6a
push eax
push 0x4d6fdf
call edi
push eax
call ebx
push 0
push 1
lea eax, [ebp - 8]
mov byte [ebp - 8], 0xeb
push eax
push 0x4d6fe0
call edi
push eax
call ebx
push 0
push 1
lea eax, [ebp - 8]
mov byte [ebp - 8], 0xf5
push eax
push 0x4d6ff3
call edi
push eax
call ebx
push 0
push 1
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x55
push eax
push 0x4d6ff4
call edi
push eax
call ebx
push 0
push 1
lea eax, [ebp - 8]
mov byte [ebp - 8], 0x55
push eax
push 0x4d6ff5
call edi
push eax
call ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret