Function at 0x10001de0
Capabilities:
Allocate or change rwx memory
Check for software breakpoints
Execute shellcode via indirect call

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x14]
push ebx
push ebp
xor ebp, ebp
push esi
cmp eax, ebp
push edi
mov dword [esp + 0x10], ebp
je 0x10001df7
mov dword [eax], ebp
mov ebx, dword [esp + 0x28]
cmp ebx, ebp
je 0x10001e01
mov dword [ebx], ebp
mov esi, dword [esp + 0x2c]
cmp esi, ebp
je 0x10001e0b
mov dword [esi], ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x100065fc], eax
je 0x10001e28
pop edi
pop esi
pop ebp
mov eax, 0x10dd
pop ebx
add esp, 8
ret 0x14
mov eax, dword [0x10006600]
cmp eax, ebp
jne 0x100020cb
mov ecx, dword [esp + 0x1c]
cmp ecx, ebp
jne 0x10001e4c
pop edi
pop esi
pop ebp
mov eax, 6
pop ebx
add esp, 8
ret 0x14
mov eax, dword [ecx]
cmp eax, ebp
jne 0x10001e6c
pop edi
mov eax, 6
pop esi
pop ebp
mov dword [0x10006600], eax
mov dword [0x10006604], ecx
pop ebx
add esp, 8
ret 0x14
push ebp
push eax
mov dword [esp + 0x30], ebp
call fcn.100017b0
mov edi, eax
push 0
mov eax, dword [esp + 0x24]
mov dword [esp + 0x18], edi
push eax
call fcn.100017b0
cmp eax, edi
mov dword [esp + 0x20], eax
jne 0x10001ea3
mov eax, dword [0x100065f8]
test eax, eax
jne 0x1000206e
jmp 0x10002046
test ebx, ebx
je 0x10001ea9
mov dword [ebx], edi
test esi, esi
je 0x10001eaf
mov dword [esi], eax
push 0x18
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 0x28], eax
test eax, eax
jne 0x10001ece
mov dword [esp + 0x10], 8
jmp 0x10002046
call fcn.10002e00
push edi
call fcn.100020e0
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x10001eef
mov dword [esp + 0x10], 8
jmp 0x10002046
mov eax, dword [esp + 0x24]
test eax, eax
je 0x10001ef9
mov dword [eax], ebp
mov eax, edi
xor ebx, ebx
lea ecx, [esp + 0x24]
lea edx, [ebx + ebp]
push ecx
push 0
push eax
push edx
mov esi, eax
mov dword [esp + 0x34], 0
call fcn.100028f0
mov ecx, dword [esp + 0x24]
test ecx, ecx
jne 0x10001f7b
mov cl, byte [esi]
mov ebx, eax
sub ebx, edi
cmp cl, 0xe9
je 0x10001f7b
cmp cl, 0xe0
je 0x10001f7b
cmp cl, 0xc2
je 0x10001f7b
cmp cl, 0xc3
je 0x10001f7b
cmp cl, 0xcc
je 0x10001f7b
cmp cl, 0xff
jne 0x10001f4a
cmp byte [esi + 1], 0x25
je 0x10001f7b
cmp cl, 0x26
je 0x10001f68
cmp cl, 0x2e
je 0x10001f68
cmp cl, 0x36
je 0x10001f68
cmp cl, 0xe3
je 0x10001f68
cmp cl, 0x64
je 0x10001f68
cmp cl, 0x65
jne 0x10001f74
cmp byte [esi + 1], 0xff
jne 0x10001f74
cmp byte [esi + 2], 0x25
je 0x10001f7b
cmp ebx, 5
jge 0x10001f9a
jmp 0x10001efd
cmp ebx, 5
jge 0x10001f9a
mov eax, dword [0x100065f8]
mov dword [esp + 0x10], 9
test eax, eax
jne 0x10002050
jmp 0x10002046
cmp ebx, 0x12
jbe 0x10001fac
mov dword [esp + 0x10], 6
jmp 0x10002046
mov eax, dword [esp + 0x20]
lea ecx, [ebp + 0x17]
mov dword [ebp + 0x1c], eax
lea edx, [ebx + edi]
lea eax, [ebx + ebp]
mov dword [ebp + 0x18], edx
mov byte [ecx], bl
lea esi, [eax + 5]
mov byte [eax], 0xe9
inc eax
sub edx, esi
lea edi, [eax + 4]
mov dword [eax], edx
cmp edi, ecx
jae 0x10001fe8
sub ecx, edi
mov eax, 0xcccccccc
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 0x2c]
push eax
push 0x40
push ebx
mov ebx, dword [esp + 0x20]
push ebx
mov dword [esp + 0x3c], 0
call edi
test eax, eax
je 0x1000203c
push ebx
call fcn.10002310
mov esi, eax
add esp, 4
test esi, esi
je 0x1000209d
cmp word [esi + 0x1c], 0x6544
je 0x1000209d
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], 0
push ecx
push 0x40
push 0x40
push esi
call edi
test eax, eax
jne 0x10002085
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x10]
mov dword [0x10006600], edx
test ebp, ebp
je 0x1000205d
push ebp
call fcn.10001a60
add esp, 4
mov eax, dword [esp + 0x28]
test eax, eax
je 0x1000206e
push eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, dword [esp + 0x1c]
pop edi
pop esi
mov dword [0x10006604], eax
mov eax, dword [esp + 8]
pop ebp
pop ebx
add esp, 8
ret 0x14
mov word [esi + 0x1c], 0x6544
mov word [esi + 0x1e], 0x6f74
mov word [esi + 0x20], 0x7275
mov word [esi + 0x22], 0x2173
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x1c]
mov dword [eax + 4], 0
mov dword [eax + 8], ecx
mov dword [eax + 0x10], ebp
mov dword [eax + 0xc], ebx
mov edx, dword [esp + 0x2c]
mov dword [eax + 0x14], edx
mov ecx, dword [0x1000660c]
mov dword [eax], ecx
mov dword [0x1000660c], eax
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0x14