Function at 0x1000ff50
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov eax, dword [0x1006b850]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x100], 0x60
mov dword [ebp - 0xfc], 0x9c
mov dword [ebp - 0xf8], 0xb2
mov dword [ebp - 0xf4], 1
mov dword [ebp - 0xf0], 0xbe
mov dword [ebp - 0xec], 0
mov dword [ebp - 0xe8], 0
mov dword [ebp - 0xe4], 0
mov dword [ebp - 0xe0], 0
mov dword [ebp - 0xdc], 0x8d
mov dword [ebp - 0xd8], 0xbe
mov dword [ebp - 0xd4], pe_nt_image_headers32
mov dword [ebp - 0xd0], pe_nt_image_headers32
mov dword [ebp - 0xcc], pe_nt_image_headers32
mov dword [ebp - 0xc8], pe_nt_image_headers32
mov dword [ebp - 0xc4], 0x8d
mov dword [ebp - 0xc0], 0x3f
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x104], 0
jmp 0x10010046
mov eax, dword [ebp - 0x104]
add eax, 1
mov dword [ebp - 0x104], eax
mov ecx, dword [ebp + 0xc]
sub ecx, 0x40
cmp dword [ebp - 0x104], ecx
jge 0x10010092
push 0x11
lea edx, [ebp - 0x100]
push edx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x104]
push eax
call fcn.1000ff00
add esp, 0xc
test eax, eax
je 0x10010090
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x104]
mov dword [ebp - 0x114], ecx
mov edx, dword [ebp - 0x104]
mov dword [ebp - 0x128], edx
jmp 0x10010092
jmp 0x10010037
mov eax, dword [ebp - 0x128]
add eax, 0x40
mov dword [ebp - 0x110], eax
jmp 0x100100b2
mov ecx, dword [ebp - 0x110]
add ecx, 1
mov dword [ebp - 0x110], ecx
mov edx, dword [ebp + 0xc]
sub edx, 0x40
cmp dword [ebp - 0x110], edx
jge 0x100100f2
push 0x11
lea eax, [ebp - 0x100]
push eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x110]
push ecx
call fcn.1000ff00
add esp, 0xc
test eax, eax
je 0x100100f0
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x110]
mov dword [ebp - 0x118], edx
jmp 0x100100f2
jmp 0x100100a3
cmp dword [ebp - 0x114], 0
je 0x100101ef
mov byte [ebp - 0x3c], 0x60
mov byte [ebp - 0x3b], 0x9c
mov byte [ebp - 0x3a], 0x54
mov byte [ebp - 0x39], 0xe8
mov byte [ebp - 0x38], 0
mov byte [ebp - 0x37], 0
mov byte [ebp - 0x36], 0
mov byte [ebp - 0x35], 0
mov byte [ebp - 0x34], 0x85
mov byte [ebp - 0x33], 0xc0
mov byte [ebp - 0x32], 0x74
mov byte [ebp - 0x31], 9
mov byte [ebp - 0x30], 0x9d
mov byte [ebp - 0x2f], 0x61
mov byte [ebp - 0x2e], 0x58
mov byte [ebp - 0x2d], 0xb8
mov byte [ebp - 0x2c], 1
mov byte [ebp - 0x2b], 0
mov byte [ebp - 0x2a], 0
mov byte [ebp - 0x29], 0
mov byte [ebp - 0x28], 0xc3
mov byte [ebp - 0x27], 0x9d
mov byte [ebp - 0x26], 0x61
mov byte [ebp - 0x25], 0xe9
mov byte [ebp - 0x24], 0
mov byte [ebp - 0x23], 0
mov byte [ebp - 0x22], 0
mov byte [ebp - 0x21], 0
push 0x40
push 0x3000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x10c], eax
push 0x1c
lea eax, [ebp - 0x3c]
push eax
mov ecx, dword [ebp - 0x10c]
push ecx
call fcn.10043eb0
add esp, 0xc
push 9
mov edx, dword [ebp - 0x10c]
push edx
mov eax, dword [ebp - 0x114]
push eax
call fcn.1000e150
add esp, 0xc
mov dword [ebp - 0x134], eax
mov ecx, dword [ebp - 0x10c]
add ecx, 8
mov edx, 0x1000fe10
sub edx, ecx
mov eax, dword [ebp - 0x10c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x10c]
add ecx, 0x1c
mov edx, dword [ebp - 0x134]
sub edx, ecx
mov eax, dword [ebp - 0x10c]
mov dword [eax + 0x18], edx
cmp dword [ebp - 0x118], 0
je 0x100102ec
mov byte [ebp - 0x20], 0x60
mov byte [ebp - 0x1f], 0x9c
mov byte [ebp - 0x1e], 0x54
mov byte [ebp - 0x1d], 0xe8
mov byte [ebp - 0x1c], 0
mov byte [ebp - 0x1b], 0
mov byte [ebp - 0x1a], 0
mov byte [ebp - 0x19], 0
mov byte [ebp - 0x18], 0x85
mov byte [ebp - 0x17], 0xc0
mov byte [ebp - 0x16], 0x74
mov byte [ebp - 0x15], 9
mov byte [ebp - 0x14], 0x9d
mov byte [ebp - 0x13], 0x61
mov byte [ebp - 0x12], 0x58
mov byte [ebp - 0x11], 0xb8
mov byte [ebp - 0x10], 1
mov byte [ebp - 0xf], 0
mov byte [ebp - 0xe], 0
mov byte [ebp - 0xd], 0
mov byte [ebp - 0xc], 0xc3
mov byte [ebp - 0xb], 0x9d
mov byte [ebp - 0xa], 0x61
mov byte [ebp - 9], 0xe9
mov byte [ebp - 8], 0
mov byte [ebp - 7], 0
mov byte [ebp - 6], 0
mov byte [ebp - 5], 0
push 0x40
push 0x3000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x108], eax
push 0x1c
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x108]
push edx
call fcn.10043eb0
add esp, 0xc
push 9
mov eax, dword [ebp - 0x108]
push eax
mov ecx, dword [ebp - 0x118]
push ecx
call fcn.1000e150
add esp, 0xc
mov dword [ebp - 0x12c], eax
mov edx, dword [ebp - 0x108]
add edx, 8
mov eax, 0x1000fe10
sub eax, edx
mov ecx, dword [ebp - 0x108]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x108]
add edx, 0x1c
mov eax, dword [ebp - 0x12c]
sub eax, edx
mov ecx, dword [ebp - 0x108]
mov dword [ecx + 0x18], eax
mov edx, 1
imul eax, edx, 0
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0x80
jae 0x10010308
jmp 0x1001030d
call fcn.1001ca83
mov ecx, dword [ebp - 0x120]
mov byte [ebp + ecx - 0xbc], 0
lea edx, [ebp - 0xbc]
push edx
push 0x1004b8d8
call fcn.10001240
add esp, 8
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0
jg 0x10010340
jmp 0x1001036d
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0x80
jae 0x1001035a
jmp 0x1001035f
call fcn.1001ca83
mov ecx, dword [ebp - 0x124]
mov byte [ebp + ecx - 0xbc], 0
lea edx, [ebp - 0xbc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.1000e940
add esp, 8
mov dword [ebp - 0x130], eax
mov dword [0x1010a278], 1
call dword [ebp - 0x130]
mov dword [ebp - 0x138], eax
mov dword [0x1010a278], 0
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001c906
mov esp, ebp
pop ebp
ret