Function at 0x100099a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov ebp, edx
mov esi, ecx
push edi
mov dword [esp + 0x14], ebp
call fcn.10009250
mov edx, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
or edi, 0xffffffff
test byte [esi + 0x1b4], 1
je 0x10009a7a
cmp ebp, dword [0x1002c5d0]
jb 0x10009a7a
mov ecx, dword [0x1002c5cc]
lea ebx, [ecx + 0x1f]
lea eax, [ecx - 1]
add ebx, ebp
not eax
and ebx, eax
cmp ebx, ebp
jbe 0x10009a80
push 0x40
push 0x103000
push ebx
push 0
call edx
test eax, eax
mov edx, edi
cmovne edx, eax
cmp edx, edi
je 0x10009a74
mov eax, edx
and eax, 7
je 0x10009a13
neg eax
and eax, 7
lea ebp, [eax + edx]
mov ecx, ebx
sub ecx, eax
mov dword [esp + 0x10], ebp
or eax, 1
mov dword [ebp], eax
lea eax, [ecx - 0x10]
or eax, 2
mov dword [ebp + 4], eax
mov eax, ebp
mov ebp, dword [esp + 0x14]
mov dword [eax + ecx - 0xc], 7
mov dword [eax + ecx - 8], 0
cmp edx, dword [esi + 0x10]
jae 0x10009a4b
mov dword [esi + 0x10], edx
mov eax, dword [esi + 0x1ac]
add eax, ebx
mov dword [esi + 0x1ac], eax
cmp eax, dword [esi + 0x1b0]
jbe 0x10009a67
mov dword [esi + 0x1b0], eax
mov eax, dword [esp + 0x10]
add eax, 8
jne 0x10009cd1
mov edx, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [0x1002c5cc]
lea ebx, [ebp + 0x29]
lea eax, [ecx - 1]
add ebx, ecx
not eax
and ebx, eax
cmp ebx, ebp
jbe 0x10009ccf
push 0x40
push 0x3000
push ebx
push 0
call edx
test eax, eax
cmovne edi, eax
cmp edi, 0xffffffff
je 0x10009ccf
mov eax, dword [esi + 0x1ac]
add eax, ebx
mov dword [esp + 0x10], 1
mov dword [esi + 0x1ac], eax
cmp eax, dword [esi + 0x1b0]
jbe 0x10009ad2
mov dword [esi + 0x1b0], eax
cmp dword [esi + 0x18], 0
lea ecx, [esi + 0x1bc]
jne 0x10009baf
mov dword [esi + 0x10], edi
mov dword [ecx], edi
mov dword [esi + 0x1c0], ebx
mov ecx, dword [edi + ebx - 4]
mov dword [esi + 0x1c8], ecx
lea eax, [ecx + edi]
cmp dword [eax + ebx - 4], ecx
jne 0x10009cd9
mov eax, dword [0x1002c5c4]
lea ecx, [esi + 0x24]
mov dword [edi + ebx - 4], 0
mov edx, 0x20
mov dword [esi + 0x20], eax
nop dword [eax]
mov dword [ecx + 0xc], ecx
mov dword [ecx + 8], ecx
add ecx, 8
sub edx, 1
jne 0x10009b20
cmp esi, 0x1002c5e0
jne 0x10009b6d
mov eax, edi
add ebx, 0xffffffd8
and eax, 7
je 0x10009b45
neg eax
and eax, 7
lea ecx, [eax + edi]
sub ebx, eax
mov eax, ebx
mov dword [esi + 0x18], ecx
or eax, 1
mov dword [esi + 0xc], ebx
mov dword [ecx + 4], eax
mov eax, dword [0x1002c5d4]
mov dword [ecx + ebx + 4], 0x28
mov dword [esi + 0x1c], eax
jmp 0x10009c13
mov eax, dword [esi - 4]
lea ecx, [esi - 8]
and eax, 0xfffffffc
lea edx, [edi - 0x28]
add ecx, eax
sub ebx, ecx
mov eax, ecx
add edx, ebx
and eax, 7
je 0x10009b8b
neg eax
and eax, 7
add ecx, eax
sub edx, eax
mov eax, edx
mov dword [esi + 0x18], ecx
or eax, 1
mov dword [esi + 0xc], edx
mov dword [ecx + 4], eax
mov eax, dword [0x1002c5d4]
mov dword [ecx + edx + 4], 0x28
mov dword [esi + 0x1c], eax
jmp 0x10009c13
mov edx, ecx
test edx, edx
je 0x10009bd8
mov dword [esp + 0x10], 1
nop dword [eax]
mov eax, dword [edx]
add eax, dword [edx + 4]
mov ebp, dword [esp + 0x14]
mov dword [esp + 0x18], eax
cmp edi, eax
je 0x10009c43
mov edx, dword [edx + 8]
test edx, edx
jne 0x10009bc0
cmp edi, dword [esi + 0x10]
jae 0x10009be0
mov dword [esi + 0x10], edi
test ecx, ecx
je 0x10009c01
lea eax, [ebx + edi]
nop word [eax + eax]
mov edx, dword [ecx]
cmp edx, eax
je 0x10009c9b
mov ecx, dword [ecx + 8]
test ecx, ecx
jne 0x10009bf0
mov eax, dword [esp + 0x10]
push eax
push ebx
mov edx, edi
mov ecx, esi
call fcn.100096e0
add esp, 8
mov edx, dword [esi + 0xc]
cmp ebp, edx
jae 0x10009ccf
mov ecx, dword [esi + 0x18]
sub edx, ebp
mov dword [esi + 0xc], edx
or edx, 1
pop edi
lea eax, [ecx + ebp]
or ebp, 3
mov dword [esi + 0x18], eax
mov dword [eax + 4], edx
lea eax, [ecx + 8]
pop esi
mov dword [ecx + 4], ebp
pop ebp
pop ebx
add esp, 0xc
ret
mov eax, dword [ebx + edi - 4]
cmp eax, dword [edx + 0xc]
jne 0x10009bd8
mov eax, dword [esi + 0x18]
cmp eax, dword [edx]
jb 0x10009bd8
cmp eax, dword [esp + 0x18]
jae 0x10009bd8
add dword [edx + 4], ebx
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 0x18]
add ecx, ebx
mov eax, edx
and eax, 7
je 0x10009c74
neg eax
and eax, 7
add edx, eax
sub ecx, eax
mov eax, ecx
mov dword [esi + 0x18], edx
or eax, 1
mov dword [esi + 0xc], ecx
mov dword [edx + 4], eax
mov eax, dword [0x1002c5d4]
mov dword [edx + ecx + 4], 0x28
mov dword [esi + 0x1c], eax
jmp 0x10009c13
mov eax, dword [eax - 4]
cmp eax, dword [ecx + 0xc]
jne 0x10009c01
mov eax, dword [esp + 0x10]
cmp eax, 1
jne 0x10009c05
add dword [ecx + 4], ebx
push ebp
mov dword [ecx], edi
mov ecx, esi
push edx
mov edx, edi
call fcn.10009320
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
call fcn.10013737
int3