Function at 0x100023de
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
push 0xc
pop eax
call sub.ntdll.dll__alloca_probe
mov eax, esp
mov esi, 0x85
test eax, eax
je 0x10002407
push esi
push 0xa
mov edx, 0x1002820c
call fcn.100117e3
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
mov dword [ebp - 0x10], edi
test edi, edi
jne 0x1000241e
xor eax, eax
jmp 0x10002598
mov eax, dword [edi + 0x3c]
mov eax, dword [eax + edi + 0x50]
push 0xc
mov dword [ebp - 0xc], eax
pop eax
call sub.ntdll.dll__alloca_probe
mov eax, esp
test eax, eax
je 0x10002443
push esi
push 0xb
mov edx, 0x100284f0
call fcn.100117e3
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
je 0x10002417
mov esi, dword [ebp - 0xc]
and dword [ebp - 4], 0
call fcn.10012679
mov esi, eax
mov dword [ebp - 8], esi
test esi, esi
je 0x10002417
push dword [ebp - 0xc]
push 0
push esi
call sub.ntdll.dll_memset
mov eax, esi
add esp, 0xc
sub eax, edi
mov dword [ebp - 0x14], eax
mov byte [eax + ebx], 1
jmp 0x10002484
mov edi, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
xor eax, eax
test ecx, ecx
je 0x10002587
mov edx, dword [ebp - 8]
cmp byte [eax + edx], 1
je 0x100025a0
inc eax
cmp eax, ecx
jb 0x10002491
test ecx, ecx
je 0x10002587
mov ebx, edi
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0x14]
cmp byte [ebx + eax], 2
jne 0x1000257d
and dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
push 0x40
push 0x100
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1000257d
push 3
pop ecx
mov edi, 0x1002055c
mov esi, ebx
xor eax, eax
repe cmpsw word [esi], word es:[edi]
jne 0x100024fb
inc dword [ebp - 4]
mov eax, 0x90909090
lea edi, [ebx + 8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
push 7
pop edx
mov ecx, edx
mov edi, 0x10020564
mov esi, ebx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x1000251b
inc dword [ebp - 4]
mov eax, 0x90909090
lea edi, [ebx + 7]
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, edx
mov edi, 0x1002056c
mov esi, ebx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x10002536
inc dword [ebp - 4]
mov eax, 0xe990
mov word [ebx + 7], ax
mov ecx, edx
mov edi, 0x10020574
mov esi, ebx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x10002551
inc dword [ebp - 4]
mov eax, 0xe990
mov word [ebx + 7], ax
mov ecx, edx
mov edi, 0x1002057c
mov esi, ebx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x1000256a
inc dword [ebp - 4]
mov dword [ebx + 7], 0xff981de9
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x10]
push 0x100
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
inc ebx
dec dword [ebp - 0xc]
jne 0x100024b0
mov esi, dword [ebp - 8]
call fcn.1001272d
xor eax, eax
cmp eax, dword [ebp - 4]
sbb eax, eax
neg eax
lea esp, [ebp - 0x54]
pop edi
pop esi
pop ebx
leave
ret
mov ebx, eax
test eax, eax
je 0x100024a3
mov ecx, dword [ebp - 8]
add edi, eax
mov byte [eax + ecx], 2
jmp 0x10002630
mov al, byte [edi]
xor ecx, ecx
cmp al, 0xe9
jne 0x100025c4
mov ecx, dword [edi + 1]
add ecx, esi
add ecx, ebx
cmp al, 0xeb
jne 0x100025d0
movzx ecx, byte [edi + 1]
add ecx, esi
add ecx, ebx
cmp al, 0x70
jb 0x100025d8
cmp al, 0x7f
jbe 0x100025e0
cmp al, 0xe0
jb 0x100025e8
cmp al, 0xe3
ja 0x100025e8
movzx ecx, byte [edi + 1]
add ecx, esi
add ecx, ebx
cmp al, 0xf
jne 0x100025fe
mov al, byte [edi + 1]
cmp al, 0x80
jb 0x100025fe
cmp al, 0x8f
ja 0x100025fe
mov ecx, dword [edi + 2]
add ecx, esi
add ecx, ebx
test ecx, ecx
je 0x10002614
cmp ecx, dword [ebp - 0xc]
jae 0x10002614
mov eax, dword [ebp - 8]
cmp byte [ecx + eax], 0
jne 0x10002614
mov byte [ecx + eax], 1
test dword [ebp - 0x42], 0x2000
jne 0x10002481
mov eax, dword [ebp - 0x10]
add ebx, esi
lea edi, [ebx + eax]
mov eax, dword [ebp - 8]
mov byte [ebx + eax], 2
push edi
lea esi, [ebp - 0x48]
call fcn.1001391a
mov esi, eax
pop ecx
test esi, esi
jne 0x100025b5
jmp 0x10002481