Function at 0x1000e820
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push esi
push edi
push eax
push 4
push 4
push 0x5b8610
call ebx
lea eax, [ebp - 8]
mov dword [0x5b8610], 0x1000c9f0
push eax
push dword [ebp - 4]
push 4
push 0x5b8610
call ebx
lea eax, [ebp - 4]
push eax
push 4
push 4
push 0x5b8574
call ebx
lea eax, [ebp - 8]
mov dword [0x5b8574], 0x1000c970
push eax
push dword [ebp - 4]
push 4
push 0x5b8574
call ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push 4
push 5
push 0x4c6e87
push esi
call edi
lea eax, [ebp - 0x10]
mov byte [0x4c6e87], 0xe8
push eax
mov dword [0x4c6e88], 0xffff2854
push dword [ebp - 0xc]
push 5
push 0x4c6e87
push esi
call edi
call ebx
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push 4
push 4
push 0x5bd9c0
push esi
call edi
lea eax, [ebp - 0x10]
mov dword [0x5bd9c0], 0x1000d5d0
push eax
push dword [ebp - 0xc]
push 4
push 0x5bd9c0
push esi
call edi
call ebx
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push 4
push 5
push 0x453283
push esi
call edi
mov ecx, 0x1000d050
mov byte [0x453283], 0xe8
sub ecx, 0x453288
lea eax, [ebp - 0x10]
mov dword [0x453284], ecx
push eax
push dword [ebp - 0xc]
push 5
push 0x453283
push esi
call edi
call ebx
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push 4
push 5
push 0x45cab6
push esi
call edi
mov ecx, 0x1000ca30
mov byte [0x45cab6], 0xe8
lea eax, [ebp - 0x10]
sub ecx, 0x45cabb
push eax
mov dword [0x45cab7], ecx
push dword [ebp - 0xc]
push 5
push 0x45cab6
push esi
call edi
lea eax, [ebp - 0xc]
mov esi, 0x1000e600
push eax
push 0x80
push 4
push 0x45a34b
sub esi, 0x45a34f
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [0x45a34b]
add eax, 0x45a34f
mov dword [0x1001c7b8], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0xc]
mov dword [0x45a34b], esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 5
push 0x45a34b
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 0x238000
push 0x401000
call esi
mov eax, 0xbbf2
mov dword [0x1001c7b4], 0x522a90
mov word [0x4ab9da], ax
mov ecx, 0x90909090
mov byte [0x4ab9e0], 0x90
mov eax, 0x6c64
mov dword [0x50080c], 0xfc8a448b
mov byte [0x500810], 0x90
mov dword [0x500944], 0xb7157e9
mov dword [0x500948], 0x90909000
mov byte [0x50094c], 0x90
mov word [0x500968], ax
mov eax, 0x4ab9de
mov dword [0x500972], 0x908a0489
mov dword [0x5b7aa0], 0xbd048d3e
mov dword [0x5b7aa8], 0x9f64e850
mov dword [0x5b7aac], 0x9ae9fffb
mov dword [0x5b7ab0], 0xfff48e
mov byte [0x50bca4], 0xeb
mov byte [0x415fcd], 0xf
mov byte [0x41695c], 0xf
push 0x28
mov word [eax], cx
push 1
mov byte [eax + 2], cl
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
add esp, 8
mov dword [0x1001c7c0], eax
mov dword [eax + 0x14], 0x1000d810
call ebx
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push 4
push 5
push 0x4f5675
push esi
call edi
mov edi, 0x1000d950
mov byte [0x4f5675], 0xe8
lea eax, [edi - 0x4f567a]
mov dword [0x4f5676], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0xc]
push 5
push 0x4f5675
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
call ebx
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push 4
push 5
push 0x4f573e
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
lea eax, [ebp - 0x10]
mov byte [0x4f573e], 0xe8
push eax
lea ecx, [edi - 0x4f5743]
mov dword [0x4f573f], ecx
push dword [ebp - 0xc]
push 5
push 0x4f573e
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
call ebx
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push 4
push 5
push 0x4f5875
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
lea eax, [ebp - 0x10]
mov byte [0x4f5875], 0xe8
push eax
lea ecx, [edi - 0x4f587a]
mov dword [0x4f5876], ecx
push dword [ebp - 0xc]
push 5
push 0x4f5875
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
call ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push 4
push 5
push 0x4f5922
push esi
call ebx
lea eax, [ebp - 0x10]
mov byte [0x4f5922], 0xe8
push eax
sub edi, 0x4f5927
mov dword [0x4f5923], edi
push dword [ebp - 0xc]
push 5
push 0x4f5922
push esi
call ebx
mov eax, 0xffd0
mov word [0x4f57d8], ax
mov word [0x4f5912], ax
call fcn.1000b690
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push 0x238000
push 0x401000
call ebx
push 0x140
call fcn.1001328d
mov edi, eax
mov dword [ebp - 0xc], eax
mov ecx, 0x4d
mov esi, str.109120132967399429278860960508995541528237502902798129123468757937266291492576446330739696001110603907230888610072655818825358503429057592827629436413108566029093628212635953836686562675849720620786279431090218017681061521755056710823876476444260558147179707119674283982419152118103759076030616683978566631413
rep movsd dword es:[edi], dword [esi]
add esp, 4
movsb byte es:[edi], byte [esi]
mov byte [eax + 0x135], 0
lea eax, [ebp - 4]
push eax
push 0x40
push 0x135
push 0x5b8980
call ebx
mov esi, dword [ebp - 0xc]
mov edx, 0x5b8980
mov eax, esi
sub edx, esi
nop
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx + eax - 1], cl
test cl, cl
jne 0x1000ec00
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push 0x135
push 0x5b8980
call ebx
push 0x140
push esi
call fcn.100132bd
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret