Function at 0x10008b97
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x10011040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edx, 0x10008a83
mov ecx, 0x45c3a5
call fcn.10009b40
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x20]
push eax
push 4
push 4
mov edi, 0x5b8610
mov dword [ebp - 0x24], 0x10007e35
push edi
call esi
mov ebx, dword [sym.imp.VCRUNTIME140.dll_memcpy]
lea eax, [ebp - 0x24]
push 4
push eax
push edi
call ebx
add esp, 0xc
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x20]
push 4
push edi
call esi
lea eax, [ebp - 0x20]
mov dword [ebp - 0x24], 0x10007db8
push eax
push 4
push 4
mov edi, 0x5b8574
push edi
call esi
push 4
lea eax, [ebp - 0x24]
push eax
push edi
call ebx
add esp, 0xc
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x20]
push 4
push edi
call esi
mov edx, 0x4b96e0
mov ecx, 0x4c6e87
call fcn.10009b40
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov edi, eax
lea eax, [ebp - 0x2c]
push eax
push 4
push 4
push 0x5bd9c0
push edi
call esi
lea eax, [ebp - 0x30]
mov dword [0x5bd9c0], 0x100082bb
push eax
push dword [ebp - 0x2c]
push 4
push 0x5bd9c0
push edi
call esi
mov edx, 0x1000813e
mov ecx, 0x453283
call fcn.10009b40
mov edx, 0x10007e68
mov ecx, 0x45cab6
call fcn.10009b40
lea eax, [ebp - 0x30]
mov esi, 0x100088f0
push eax
push 0x80
sub esi, 0x45a34f
push 4
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0x45a34b
call edi
push 4
lea eax, [ebp - 0x2c]
push 0x45a34b
push eax
call ebx
mov eax, dword [ebp - 0x2c]
add esp, 0xc
add eax, 0x45a34f
mov dword [0x100115f4], eax
lea eax, [ebp - 0x34]
mov dword [0x45a34b], esi
push eax
push dword [ebp - 0x30]
push 5
push 0x45a34b
call edi
lea eax, [ebp - 0x20]
mov ebx, 0x238000
push eax
push 0x40
push ebx
mov esi, 0x401000
push esi
call edi
mov eax, 0xbbf2
mov word [0x4ab9da], ax
mov eax, 0x9090
mov word [0x4ab9de], ax
mov eax, 0x6c64
mov byte [0x4ab9e0], 0x90
mov dword [0x50080c], 0xfc8a448b
mov byte [0x500810], 0x90
mov dword [0x500944], 0xb7157e9
mov dword [0x500948], 0x90909000
mov byte [0x50094c], 0x90
mov word [0x500968], ax
mov dword [0x500972], 0x908a0489
mov dword [0x5b7aa0], 0xbd048d3e
mov dword [0x5b7aa8], 0x9f64e850
mov dword [0x5b7aac], 0x9ae9fffb
mov dword [0x5b7ab0], 0xfff48e
mov byte [0x50bca4], 0xeb
mov byte [0x415fcd], 5
mov byte [0x41695c], 5
call fcn.100071c5
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x20]
push ebx
push esi
call edi
push str.109120132967399429278860960508995541528237502902798129123468757937266291492576446330739696001110603907230888610072655818825358503429057592827629436413108566029093628212635953836686562675849720620786279431090218017681061521755056710823876476444260558147179707119674283982419152118103759076030616683978566631413
lea ecx, [ebp - 0x1c]
call fcn.1000307f
lea eax, [ebp - 0x20]
mov esi, 0x5b8980
push eax
push 0x40
push dword [ebp - 0xc]
push esi
call edi
cmp dword [ebp - 8], 0xf
lea eax, [ebp - 0x1c]
cmova eax, dword [ebp - 0x1c]
push eax
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy]
pop ecx
pop ecx
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x20]
push dword [ebp - 0xc]
push esi
call edi
lea ecx, [ebp - 0x1c]
call fcn.1000305c
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1000a77d
leave
ret