Function at 0x1002d9b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100b200c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x100b6be8]
test eax, eax
push ebx
mov ebx, ecx
mov ecx, 1
cmove eax, ecx
mov ecx, ebx
push esi
push edi
mov dword [0x100b6be8], eax
call fcn.10029d30
call fcn.100297a0
call fcn.10020780
mov ecx, dword [0x100b558c]
test ecx, ecx
jne 0x1002da00
mov dword [0x100b4e68], 0x32
jmp 0x1002da34
cmp ecx, 1
jne 0x1002da11
mov dword [0x100b4e68], 6
jmp 0x1002da34
cmp ecx, 2
jne 0x1002da22
mov dword [0x100b4e68], 5
jmp 0x1002da34
mov eax, dword [0x100b4e68]
xor edx, edx
cmp ecx, 3
cmove eax, edx
mov dword [0x100b4e68], eax
call fcn.10015880
test eax, eax
je 0x1002da96
push 0x75
mov dword [0x100b5848], 0x10015b90
call fcn.10015b90
cwde
shr eax, 0x10
test eax, eax
je 0x1002da8f
cmp byte [0x100bed70], 0
je 0x1002da76
cmp dword [0x100bed74], 0
je 0x1002da96
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x100bed74], eax
ja 0x1002da96
xor eax, eax
mov byte [0x100bed70], 1
cmp dword [0x100b4880], eax
sete al
mov dword [0x100b4880], eax
jmp 0x1002da96
mov byte [0x100bed70], 0
call fcn.1001e680
call fcn.1001e3b0
mov ecx, ebx
call fcn.1001e800
call fcn.100265b0
mov ecx, ebx
call fcn.10020430
mov ecx, ebx
call fcn.100238d0
mov ecx, dword [0x100b511c]
mov eax, dword [0x100bac94]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [eax], 0
je 0x1002db70
cmp dword [0x100b4888], 0
jne 0x1002db39
cmp dword [0x100bac34], 0
jne 0x1002db39
cmp dword [0x100b9d48], 0
jne 0x1002db39
cmp dword [0x100b62a0], 0
jne 0x1002db39
mov ecx, dword [0x100b511c]
mov eax, dword [0x100bac94]
add eax, 0x108
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x1002dbaa
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push edi
call esi
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
jmp 0x1002dba2
mov ecx, dword [0x100b511c]
mov eax, dword [0x100bac94]
add eax, 0x108
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x1002dbaa
lea eax, [ebp - 0x10]
push eax
push 0x40
push 1
push edi
call esi
lea eax, [ebp - 0x10]
mov byte [edi], 0xcc
push eax
push dword [ebp - 0x10]
jmp 0x1002dba5
mov ecx, dword [0x100b511c]
mov eax, dword [0x100bac94]
add eax, 0x108
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x1002dbaa
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
mov byte [edi], 0x55
push 1
push edi
call esi
mov ecx, dword [0x100b511c]
mov eax, dword [0x100bac94]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x1002dc05
cmp dword [0x100b5530], 0
jne 0x1002dbd5
cmp dword [0x100b6264], 0
je 0x1002dc05
mov ecx, dword [0x100b511c]
mov eax, dword [0x100bac94]
add eax, 0x194
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x1002dc3f
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0xcc
jmp 0x1002dc33
mov ecx, dword [0x100b511c]
mov eax, dword [0x100bac94]
add eax, 0x194
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x1002dc3f
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0x6a
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push edi
call esi
mov ecx, ebx
call fcn.10023170
mov ecx, ebx
call fcn.10021b60
mov ecx, ebx
call fcn.10022790
mov ecx, ebx
call fcn.100221f0
call fcn.10022430
call fcn.10022530
call fcn.10025980
call fcn.10025d20
call fcn.10026050
call fcn.10025880
call fcn.100268c0
cmp dword [0x100b48c4], 0
je 0x1002dd34
mov ecx, dword [0x100b511c]
mov eax, dword [0x100bac94]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x1002dd34
push 0x20
mov dword [0x100b5848], 0x10015b90
call fcn.10015b90
cwde
shr eax, 0x10
test eax, eax
je 0x1002dd2d
cmp byte [0x100beac8], 0
je 0x1002dce8
cmp dword [0x100beacc], 0
je 0x1002dd34
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov ecx, dword [0x100beacc]
inc ecx
cmp ecx, eax
ja 0x1002dd34
jmp 0x1002dcee
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov byte [0x100beac8], 1
call edi
mov ecx, dword [0x100b511c]
mov dword [0x100beacc], eax
mov eax, dword [0x100bac94]
add eax, 0x16c
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea edi, [eax + 2]
cmp edi, 0x1000
jbe 0x1002dd6f
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 3
jmp 0x1002dd63
mov byte [0x100beac8], 0
mov ecx, dword [0x100b511c]
mov eax, dword [0x100bac94]
add eax, 0x16c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
lea edi, [eax + 2]
cmp edi, 0x1000
jbe 0x1002dd6f
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0x44
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push edi
call esi
call fcn.100261c0
call fcn.10026270
mov ecx, dword [0x100b511c]
mov eax, dword [0x100bac94]
add eax, 0x180
push eax
mov edx, dword [ecx]
call dword [edx + 4]
test eax, eax
je 0x1002de18
cmp dword [0x100b9d14], 1
mov ecx, dword [0x100b511c]
mov eax, dword [0x100bac94]
mov edx, dword [ecx]
jne 0x1002ddea
add eax, 0x1c
push eax
call dword [edx + 4]
mov ecx, dword [0x100b511c]
cmp dword [eax], 0
mov edx, dword [ecx]
mov eax, dword [0x100bac94]
je 0x1002ddea
add eax, 0x180
push eax
call dword [edx + 4]
lea edi, [eax + 3]
cmp edi, 0x1000
jbe 0x1002de18
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0x66
jmp 0x1002de0c
add eax, 0x180
push eax
call dword [edx + 4]
lea edi, [eax + 3]
cmp edi, 0x1000
jbe 0x1002de18
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0x46
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push edi
call esi
call fcn.10026cd0
call fcn.10022d20
cmp dword [0x100b50a0], 1
jne 0x1002de97
mov ecx, dword [0x100b511c]
mov eax, dword [0x100bac94]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x1002de97
cmp dword [0x100badb0], 1
jne 0x1002dee4
mov ecx, dword [0x100b511c]
mov eax, dword [0x100bac94]
add eax, 0x150
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x1002de8b
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
lea eax, [ebp - 8]
mov byte [edi], 0xcc
push eax
push dword [ebp - 8]
push 1
push edi
call esi
mov dword [0x100badb0], 0
jmp 0x1002dee4
cmp dword [0x100badb0], 0
jne 0x1002dee4
mov ecx, dword [0x100b511c]
mov eax, dword [0x100bac94]
add eax, 0x150
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x1002deda
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
lea eax, [ebp - 8]
mov byte [edi], 0x68
push eax
push dword [ebp - 8]
push 1
push edi
call esi
mov dword [0x100badb0], 1
call fcn.10024120
call fcn.10024060
cmp dword [0x100b50b8], 0
jle 0x1002df8b
mov ecx, dword [0x100b511c]
mov eax, dword [0x100bac94]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x1002df8b
mov eax, dword [0x100b50b8]
cmp eax, 1
jne 0x1002df2a
mov dword [0x100baa04], 0x42c80000
jmp 0x1002df5b
cmp eax, 2
jne 0x1002df3b
mov dword [0x100baa04], 0x42dc0000
jmp 0x1002df5b
cmp eax, 3
jne 0x1002df4c
mov dword [0x100baa04], 0x42f00000
jmp 0x1002df5b
cmp eax, 4
jne 0x1002df5b
mov dword [0x100baa04], 0x42fa0000
mov ecx, dword [0x100b511c]
mov eax, dword [0x100bac94]
add eax, 0x154
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x1002dfc5
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0xcc
jmp 0x1002dfb9
mov ecx, dword [0x100b511c]
mov eax, dword [0x100bac94]
add eax, 0x154
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x1002dfc5
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0x55
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push edi
call esi
call fcn.10026b20
call fcn.10022630
call fcn.10026c10
call fcn.100266f0
call fcn.100263e0
call fcn.10026480
call fcn.10029110
call fcn.10028e20
mov ecx, ebx
call fcn.100291a0
call fcn.1002d590
call fcn.10026e20
call fcn.10028c50
call fcn.10028760
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1007cc49
mov esp, ebp
pop ebp
ret