Function at 0x10001320
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x50
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
movzx ebx, dx
cmp dx, 0x27
ja case.0x1000133c.3
jmp dword [ebx*4 + 0x1000537c]
add dword [eax + 0xc4], 0x18
mov ebx, 0x78
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 8
add dword [eax + 0xc4], 0x10
mov ebx, 0x78
jmp 0x10001354
add dword [eax + 0xc4], 4
mov ebx, 0x78
jmp 0x10001354
add dword [eax + 0xc4], 8
mov ebx, 0x78
jmp 0x10001354
add dword [eax + 0xc4], 0xc
mov eax, dword [section..bss]
test eax, eax
jne 0x100013b5
test byte [0x10003018], 2
jne 0x10001bb0
add eax, 1
mov dword [section..bss], eax
lea esp, [ebp - 0xc]
mov ebx, 0x78
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 8
movzx eax, byte [global___dbch]
and eax, 1
cmp dx, 0x28
ja 0x10001a68
test al, al
jne 0x10001ce5
mov ebx, 0xffffffff
jmp 0x10001354
mov edx, dword [eax + 0xc4]
lea ecx, [edx + 4]
mov ebx, dword [edx]
mov dword [eax + 0xc4], ecx
lea ecx, [edx + 8]
mov esi, dword [edx + 4]
add edx, 0xc
mov dword [eax + 0xc4], ecx
mov ecx, dword [edx - 4]
mov dword [eax + 0xc4], edx
test byte [0x10003018], 1
je 0x100013b5
mov eax, ecx
call sym._wine_dbgstr_an.constprop.0
mov edi, eax
mov eax, esi
call sym._wine_dbgstr_an.constprop.0
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.RegLoadKey__p__s__s_:_stub_n
mov dword [esp + 8], 0x1000542c
mov dword [esp + 4], global___dbch
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0
jmp 0x100013b5
mov edx, dword [eax + 0xc4]
lea ecx, [edx + 4]
mov esi, dword [edx]
mov dword [eax + 0xc4], ecx
lea ecx, [edx + 8]
mov ebx, dword [edx + 4]
add edx, 0xc
mov dword [eax + 0xc4], ecx
mov ecx, dword [edx - 4]
mov dword [eax + 0xc4], edx
test byte [0x10003018], 8
jne 0x10001c80
cmp esi, 0x80080000
je 0x10001d22
cmp esi, 0x80000400
je 0x10001aa0
cmp esi, 0x80060000
je 0x10001aa0
mov eax, esi
shl eax, 0xc
shl ebx, 0xc
mov dword [esp + 0xc], 0x40
mov dword [esp + 4], ebx
mov dword [esp + 8], 0x2000
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_VirtualAlloc]
sub esp, 0x10
mov ebx, eax
test byte [0x10003018], 8
jne 0x10001cb8
test ebx, ebx
jne 0x10001354
jmp 0x100013ec
add dword [eax + 0xc4], 0x20
mov ebx, 0x78
jmp 0x10001354
add dword [eax + 0xc4], 0x14
mov ebx, 0x78
jmp 0x10001354
mov edx, dword [eax + 0xc4]
lea ecx, [edx + 4]
mov ebx, dword [edx]
mov dword [eax + 0xc4], ecx
lea ecx, [edx + 8]
mov esi, dword [edx + 4]
mov dword [eax + 0xc4], ecx
lea ecx, [edx + 0xc]
mov edi, dword [edx + 8]
add edx, 0x10
mov dword [eax + 0xc4], ecx
mov ecx, dword [edx - 4]
mov dword [eax + 0xc4], edx
test byte [0x10003018], 1
je 0x100013b5
mov eax, ecx
call sym._wine_dbgstr_an.constprop.0
mov dword [ebp - 0x30], eax
mov eax, edi
call sym._wine_dbgstr_an.constprop.0
mov edi, eax
mov eax, esi
call sym._wine_dbgstr_an.constprop.0
mov edx, dword [ebp - 0x30]
mov dword [esp + 0x10], ebx
mov ebx, 0x78
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], str.RegReplaceKey__p__s__s__s_:_stub_n
mov dword [esp + 8], 0x1000542c
mov dword [esp + 4], global___dbch
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0
jmp 0x10001354
mov edx, dword [eax + 0xc4]
lea ecx, [edx + 4]
mov edi, dword [edx]
mov dword [eax + 0xc4], ecx
mov esi, dword [edx + 4]
lea ecx, [edx + 8]
mov dword [eax + 0xc4], ecx
lea ecx, [edx + 0xc]
add edx, 0x10
mov dword [ebp - 0x30], esi
mov esi, dword [edx - 8]
mov dword [eax + 0xc4], ecx
mov dword [ebp - 0x34], esi
mov esi, dword [edx - 4]
mov dword [eax + 0xc4], edx
test byte [0x10003018], 8
jne 0x10001b68
lea eax, [ebp - 0x28]
shl edi, 0xc
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_VirtualQuery]
mov eax, dword [ebp - 0x14]
sub esp, 0xc
mov dword [ebp - 0x2c], eax
cmp eax, 0x20
ja 0x10001a40
cmp eax, 1
jbe 0x10001ab0
lea ecx, [eax - 2]
mov ebx, 1
shl ebx, cl
test ebx, 0x40004001
jne 0x10001aff
and ebx, 0x44
jne 0x10001a50
xor edx, edx
and esi, 0xdfffffff
xor al, al
or esi, edx
test esi, 0x40000
je 0x100016b2
mov edx, eax
or eax, 0x20
or edx, 0x40
and esi, 0x20000
cmovne eax, edx
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x30]
lea edx, [ebp - 0x2c]
mov dword [esp + 0xc], edx
shl eax, 0xc
mov dword [esp], edi
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x10001ac0
test byte [0x10003018], 8
je 0x10001354
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.Returning:__08lx_n
mov dword [esp + 8], 0x1000542c
mov dword [esp + 4], global___dbch
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x10001354
mov edx, dword [eax + 0xc4]
lea ecx, [edx + 4]
mov ebx, dword [edx]
add edx, 8
mov dword [eax + 0xc4], ecx
mov ecx, dword [edx - 4]
mov dword [eax + 0xc4], edx
test byte [0x10003018], 8
jne 0x10001c10
mov dword [esp], ebx
mov dword [esp + 8], 0x8000
mov dword [esp + 4], 0
call dword [sym.imp.kernel32.dll_VirtualFree]
sub esp, 0xc
mov ebx, eax
test byte [0x10003018], 8
je 0x10001354
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Returning:__d_n
mov dword [esp + 8], 0x1000542c
mov dword [esp + 4], global___dbch
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x10001354
mov edx, dword [eax + 0xc4]
lea ecx, [edx + 4]
mov ebx, dword [edx]
add edx, 8
mov dword [eax + 0xc4], ecx
mov ecx, dword [edx - 4]
mov dword [eax + 0xc4], edx
test byte [0x10003018], 1
je 0x100013b5
mov eax, ecx
call sym._wine_dbgstr_an.constprop.0
mov dword [esp + 0x10], ebx
mov ebx, 0x78
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], str.RegUnLoadKey__p__s_:_stub_n
mov dword [esp + 8], 0x1000542c
mov dword [esp + 4], global___dbch
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0
jmp 0x10001354
mov ecx, dword [eax + 0xc4]
lea edx, [ecx + 4]
mov esi, dword [ecx]
mov dword [eax + 0xc4], edx
lea edx, [ecx + 8]
mov edi, dword [ecx + 4]
mov dword [eax + 0xc4], edx
mov edx, dword [ecx + 8]
mov dword [ebp - 0x34], edx
lea edx, [ecx + 0xc]
mov dword [eax + 0xc4], edx
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x30], edx
lea edx, [ecx + 0x10]
add ecx, 0x14
mov dword [eax + 0xc4], edx
mov edx, dword [ecx - 4]
mov dword [eax + 0xc4], ecx
test byte [0x10003018], 8
jne 0x10001b18
test edx, 0x40000
je 0x1000187d
and edx, 0x20000
cmp edx, 1
sbb ebx, ebx
and ebx, 0xffffffe0
add ebx, 0x40
shl edi, 0xc
shl esi, 0xc
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x1000
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_VirtualAlloc]
sub esp, 0x10
mov ebx, eax
test byte [0x10003018], 8
je 0x10001354
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.PageCommit:_Returning:__p_n
mov dword [esp + 8], 0x1000542c
mov dword [esp + 4], global___dbch
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x10001354
mov edx, dword [eax + 0xc4]
xor ebx, ebx
lea ecx, [edx + 4]
mov esi, dword [edx]
add edx, 8
mov dword [eax + 0xc4], ecx
mov ecx, dword [edx - 4]
mov dword [eax + 0xc4], edx
test byte [0x10003018], 1
je 0x10001354
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], str.GetDemandPageInfo__08lx__08lx_:_stub__n
mov dword [esp + 8], 0x1000542c
mov dword [esp + 4], global___dbch
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0
jmp 0x10001354
mov edx, dword [eax + 0xc4]
lea ecx, [edx + 4]
mov ebx, dword [edx]
mov dword [eax + 0xc4], ecx
lea ecx, [edx + 8]
mov esi, dword [edx + 4]
add edx, 0xc
mov dword [eax + 0xc4], ecx
mov ecx, dword [edx - 4]
mov dword [eax + 0xc4], edx
test byte [0x10003018], 8
jne 0x10001c48
shl ebx, 0xc
shl esi, 0xc
mov dword [esp + 8], 0x4000
mov dword [esp], ebx
mov dword [esp + 4], esi
call dword [sym.imp.kernel32.dll_VirtualFree]
sub esp, 0xc
mov ebx, eax
test byte [0x10003018], 8
je 0x10001354
test eax, eax
mov edx, str.FALSE
mov eax, str.TRUE
mov dword [esp + 0xc], str.PageDecommit:_Returning:__s_n
cmove eax, edx
mov dword [esp + 8], 0x1000542c
mov dword [esp + 4], global___dbch
mov dword [esp + 0x10], eax
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x10001354
mov edx, dword [eax + 0xc4]
lea ecx, [edx + 4]
lea esi, [edx + 8]
mov ebx, dword [edx]
add edx, 0xc
mov dword [eax + 0xc4], ecx
mov ecx, dword [edx - 8]
mov dword [eax + 0xc4], esi
mov esi, dword [edx - 4]
mov dword [eax + 0xc4], edx
test byte [0x10003018], 1
je 0x100013b5
mov eax, ecx
call sym._wine_dbgstr_an.constprop.0
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.RegSaveKey__p__s__p_:_stub_n
jmp 0x10001456
lea ecx, [eax - 0x40]
xor edx, edx
xor ebx, ebx
and ecx, 0xffffffbf
jne 0x1000168f
mov edx, dword [ebp - 0x34]
mov ebx, 0x60000
and edx, 0x60000
jmp 0x1000168f
test al, al
je 0x100013ec
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], str.Unknown_service__08lx_n
mov dword [esp + 8], 0x1000542c
mov dword [esp + 4], global___dbch
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0
jmp 0x100013ec
xor eax, eax
jmp 0x100014df
xor edx, edx
xor ebx, ebx
jmp 0x1000168f
mov ebx, 0xffffffff
test byte [0x10003018], 2
je 0x10001354
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], str.Cant_change_page_permissions_for__p_n
mov dword [esp + 8], 0x1000542c
mov dword [esp + 4], global___dbch
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0
jmp 0x10001354
mov edx, dword [ebp - 0x34]
mov ebx, 0x40000
and edx, 0x40000
jmp 0x1000168f
mov eax, dword [ebp - 0x30]
mov dword [esp + 0x20], edx
mov dword [esp + 0x14], edi
mov dword [esp + 0x1c], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 0x10], esi
mov dword [esp + 0x18], eax
mov dword [esp + 0xc], str.PageCommit:_page:__08lx__npages:__08lx__hpd:__08lx_pagerdata:__08lx__flags:__08lx_partial_stub_n
mov dword [esp + 8], 0x1000542c
mov dword [esp + 4], global___dbch
mov dword [esp], 3
mov dword [ebp - 0x38], edx
call sym._wine_dbg_log.constprop.0
mov edx, dword [ebp - 0x38]
jmp 0x10001864
mov eax, dword [ebp - 0x34]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x10], edi
mov dword [esp + 0x18], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 0xc], str.PageModifyPermissions__08lx__08lx__08lx__08lx_partial_stub_n
mov dword [esp + 0x14], eax
mov dword [esp + 8], 0x1000542c
mov dword [esp + 4], global___dbch
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x10001638
mov dword [esp + 0xc], str.Using_the_native_Win95_advapi32.dll_is_no_longer_supported._n
mov dword [esp + 8], 0x1000542c
mov dword [esp + 4], global___dbch
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0
test byte [0x10003018], 2
je 0x10001c01
mov dword [esp + 0xc], str.Please_configure_advapi32_to_builtin._n
mov dword [esp + 8], 0x1000542c
mov dword [esp + 4], global___dbch
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0
mov eax, dword [section..bss]
jmp 0x100013ad
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.PageFree:_hmem:__p__flags:__08lx_partial_stub_n
mov dword [esp + 8], 0x1000542c
mov dword [esp + 4], global___dbch
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x10001742
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.PageDecommit:_page:__08lx__npages:__08lx__flags:__08lx_partial_stub_n
mov dword [esp + 8], 0x1000542c
mov dword [esp + 4], global___dbch
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x10001976
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], str.PageReserve:_page:__08lx__npages:__08lx__flags:__08lx_partial_stub__n
mov dword [esp + 8], 0x1000542c
mov dword [esp + 4], global___dbch
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x100014b6
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.PageReserve:_returning:__p_n
mov dword [esp + 8], 0x1000542c
mov dword [esp + 4], global___dbch
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x10001511
mov eax, dword [ebx*4 + 0x10005660]
mov dword [esp + 0x14], edx
mov ebx, 0xffffffff
mov dword [esp + 0xc], str.Unimplemented_service__s___08lx__n
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0x1000542c
mov dword [esp + 4], global___dbch
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0
jmp 0x10001354
test byte [0x10003018], 2
je 0x100013ec
mov dword [esp + 0xc], str.Cant_reserve_ring_1_memory_n
mov ebx, 0xffffffff
mov dword [esp + 8], 0x1000542c
mov dword [esp + 4], global___dbch
mov dword [esp], 1
call sym._wine_dbg_log.constprop.0
jmp 0x10001354