Function at 0x1002bf60
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x100b700c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x100c021c]
test eax, eax
push ebx
push esi
push edi
mov edi, ecx
mov ecx, 1
cmove eax, ecx
mov ecx, edi
mov dword [0x100c021c], eax
call fcn.10028c20
call fcn.10028980
call fcn.10022120
mov ecx, dword [0x100bebc8]
test ecx, ecx
jne 0x1002bfb0
mov dword [0x100be4c4], 0x32
jmp 0x1002bfe4
cmp ecx, 1
jne 0x1002bfc1
mov dword [0x100be4c4], 6
jmp 0x1002bfe4
cmp ecx, 2
jne 0x1002bfd2
mov dword [0x100be4c4], 5
jmp 0x1002bfe4
mov eax, dword [0x100be4c4]
xor edx, edx
cmp ecx, 3
cmove eax, edx
mov dword [0x100be4c4], eax
call fcn.10016f40
test eax, eax
je 0x1002c046
push 0x75
mov dword [0x100bee78], 0x10017250
call fcn.10017250
cwde
shr eax, 0x10
test eax, eax
je 0x1002c03f
cmp byte [0x100c3330], 0
je 0x1002c026
cmp dword [0x100c3334], 0
je 0x1002c046
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x100c3334], eax
ja 0x1002c046
xor eax, eax
mov byte [0x100c3330], 1
cmp dword [0x100bded4], eax
sete al
mov dword [0x100bded4], eax
jmp 0x1002c046
mov byte [0x100c3330], 0
call fcn.10020030
call fcn.1001fd60
mov ecx, edi
call fcn.100201a0
call fcn.100257d0
mov ecx, edi
call fcn.10021dd0
call fcn.10024390
mov ecx, dword [0x100be770]
mov eax, dword [0x100ba2dc]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [eax], 0
je 0x1002c0c9
cmp dword [0x100beb7c], 0
jne 0x1002c099
cmp dword [0x100bf89c], 0
je 0x1002c0c9
mov ecx, dword [0x100be770]
mov eax, dword [0x100ba2dc]
add eax, 0x1a4
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov ebx, eax
cmp ebx, 0x1000
jbe 0x1002c103
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push ebx
call esi
mov byte [ebx], 0xcc
jmp 0x1002c0f7
mov ecx, dword [0x100be770]
mov eax, dword [0x100ba2dc]
add eax, 0x1a4
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov ebx, eax
cmp ebx, 0x1000
jbe 0x1002c103
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push ebx
call esi
mov byte [ebx], 0x6a
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push ebx
call esi
mov ecx, edi
call fcn.10023d20
mov ecx, edi
call fcn.10022db0
mov ecx, edi
call fcn.10023440
call fcn.10023680
call fcn.10023780
call fcn.10024c40
call fcn.100250b0
call fcn.10024b40
call fcn.10025bd0
cmp dword [0x100bdf18], 0
je 0x1002c1ec
mov ecx, dword [0x100be770]
mov eax, dword [0x100ba2dc]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x1002c1ec
push 0x20
mov dword [0x100bee78], 0x10017250
call fcn.10017250
cwde
shr eax, 0x10
test eax, eax
je 0x1002c1e5
cmp byte [0x100c3088], 0
je 0x1002c1a0
cmp dword [0x100c308c], 0
je 0x1002c1ec
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
mov ecx, dword [0x100c308c]
inc ecx
cmp ecx, eax
ja 0x1002c1ec
jmp 0x1002c1a6
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov byte [0x100c3088], 1
call ebx
mov ecx, dword [0x100be770]
mov dword [0x100c308c], eax
mov eax, dword [0x100ba2dc]
add eax, 0x17c
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea ebx, [eax + 2]
cmp ebx, 0x1000
jbe 0x1002c227
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push ebx
call esi
mov byte [ebx], 3
jmp 0x1002c21b
mov byte [0x100c3088], 0
mov ecx, dword [0x100be770]
mov eax, dword [0x100ba2dc]
add eax, 0x17c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
lea ebx, [eax + 2]
cmp ebx, 0x1000
jbe 0x1002c227
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push ebx
call esi
mov byte [ebx], 0x44
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push ebx
call esi
call fcn.100253e0
call fcn.10025490
call fcn.10025ff0
call fcn.10026130
call fcn.10024a10
call fcn.10024830
cmp dword [0x100be714], 0
jle 0x1002c2e2
mov ecx, dword [0x100be770]
mov eax, dword [0x100ba2dc]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x1002c2e2
mov eax, dword [0x100be714]
cmp eax, 1
jne 0x1002c281
mov dword [0x100c2c14], 0x42c80000
jmp 0x1002c2b2
cmp eax, 2
jne 0x1002c292
mov dword [0x100c2c14], 0x42dc0000
jmp 0x1002c2b2
cmp eax, 3
jne 0x1002c2a3
mov dword [0x100c2c14], 0x42f00000
jmp 0x1002c2b2
cmp eax, 4
jne 0x1002c2b2
mov dword [0x100c2c14], 0x42fa0000
mov ecx, dword [0x100be770]
mov eax, dword [0x100ba2dc]
add eax, 0x164
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov ebx, eax
cmp ebx, 0x1000
jbe 0x1002c31c
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push ebx
call esi
mov byte [ebx], 0xcc
jmp 0x1002c310
mov ecx, dword [0x100be770]
mov eax, dword [0x100ba2dc]
add eax, 0x164
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov ebx, eax
cmp ebx, 0x1000
jbe 0x1002c31c
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push ebx
call esi
mov byte [ebx], 0x55
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push ebx
call esi
call fcn.10025e30
call fcn.10023880
call fcn.10025f20
call fcn.10025910
call fcn.100259f0
call fcn.10025600
call fcn.100256a0
call fcn.100285d0
call fcn.100282e0
mov ecx, edi
call fcn.10028660
call fcn.1002bb40
call fcn.10026290
call fcn.10028110
call fcn.10027c10
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1007fe99
mov esp, ebp
pop ebp
ret