Function at 0x1000d920
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x40a7ef
call esi
mov eax, 0x40a7ef
mov dword [eax], 0x90909090
mov byte [eax + 4], 0x90
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 5
push 0x40a7ef
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x40a87e
call esi
mov eax, 0x40a87e
mov dword [eax], 0x90909090
mov byte [eax + 4], 0x90
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 5
push 0x40a87e
call esi
push 0x4d1dc2
push 0x4d1cf0
push 0xe9
call fcn.10018b80
add esp, 0xc
lea eax, [ebp - 4]
push eax
push 0x40
push 0x1b
push 0xd20170
call esi
mov eax, 0xd20170
mov ecx, 0x90909090
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov word [eax + 0x18], cx
mov byte [eax + 0x1a], cl
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 0x1b
push 0xd20170
call esi
push 0x82a9f3
push 0x82a983
push 0xe9
call fcn.10018b80
add esp, 0xc
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0xd477ac
call esi
lea eax, [ebp - 4]
mov dword [0xd477ac], 0
push eax
push dword [ebp - 4]
push 4
push 0xd477ac
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x5c9a8f
call esi
lea eax, [ebp - 4]
mov byte [0x5c9a8f], 5
push eax
push dword [ebp - 4]
push 1
push 0x5c9a8f
call esi
push 0x1000d7a0
push 0x4f9cbd
push 0xe8
call fcn.10018b80
push 0x1000d820
push 0x54ee78
push 0xe9
call fcn.10018b80
push 0x1000d860
push 0x54ffb7
push 0xe9
call fcn.10018b80
push 0x1000d8a0
push 0x5880ad
push 0xe9
call fcn.10018b80
push 0x1000d8e0
push 0x560ce6
push 0xe9
call fcn.10018b80
push 0x58811f
push 0x5880f0
push 0xe9
call fcn.10018b80
add esp, 0x48
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x588447
call esi
lea eax, [ebp - 4]
mov dword [0x588447], 0xfff
push eax
push dword [ebp - 4]
push 4
push 0x588447
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0xd2bce8
call esi
lea eax, [ebp - 4]
mov dword [0xd2bce8], 0x4cbebc20
push eax
push dword [ebp - 4]
push 4
push 0xd2bce8
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x50f68d
call esi
lea eax, [ebp - 4]
mov byte [0x50f68d], 0
push eax
push dword [ebp - 4]
push 1
push 0x50f68d
call esi
push 0x644537
push 0x64452a
push 0xe9
call fcn.10018b80
push 0x1000d500
push 0x54fc7d
push 0xe9
call fcn.10018b80
push 0x1000d490
push 0x54ec8f
push 0xe9
call fcn.10018b80
push 0x1000d650
push 0x63764c
push 0xe9
call fcn.10018b80
add esp, 0x30
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x4d7a0e
call esi
test eax, eax
je 0x1000dbce
mov eax, 0x4d7a0e
mov dword [eax], 0x1e0
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 4
push 0x4d7a0e
call esi
test eax, eax
jne 0x1000dbd4
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x40
push 1
push 0x4d7a18
xor bl, bl
call esi
test eax, eax
je 0x1000dc12
mov eax, 0x4d7a18
mov byte [eax], bl
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 1
push 0x4d7a18
call esi
test eax, eax
jne 0x1000dc18
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x1000d670
push 0x5bafab
push 0xe8
call fcn.10018b80
add esp, 0xc
lea eax, [ebp - 4]
push eax
push 0x40
push 0x2d
push 0x4f8760
call esi
push 0x2d
push 0x90
push 0x4f8760
call fcn.1001a590
add esp, 0xc
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 0x2d
push 0x4f8760
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 0x2d
push 0x4f879a
call esi
push 0x2d
push 0x90
push 0x4f879a
call fcn.1001a590
add esp, 0xc
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 0x2d
push 0x4f879a
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 0x2d
push 0x4f87da
call esi
push 0x2d
push 0x90
push 0x4f87da
call fcn.1001a590
add esp, 0xc
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 0x2d
push 0x4f87da
call esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret