Function at 0x1028036f
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x6c]
sub esp, 0xa8
push esi
xor esi, esi
cmp dword [0x10283018], esi
push edi
jne 0x102803ea
push 0x1c
lea eax, [ebp + 0x44]
push eax
push entry0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x102803a0
mov eax, dword [ebp + 0x48]
jmp 0x102803c2
mov edi, dword [ebp + 0x74]
push 2
push edi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x102803bb
cmp word [edi], 0x5a4d
jne 0x102803bb
mov eax, edi
jmp 0x102803c2
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, dword [eax + 0x3c]
add ecx, eax
mov dword [0x10283018], eax
mov dword [0x10283010], eax
lea eax, [ebp + 0x68]
push eax
push 0x40
push 9
push 0x10283024
mov dword [0x10283014], ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [0x10283014]
movzx eax, word [eax + 0x16]
shr eax, 0xd
and eax, 1
mov dword [ebp + 0x68], eax
je 0x10280414
cmp dword [ebp + 0x78], 1
je 0x10280414
push dword [ebp + 0x7c]
push dword [ebp + 0x78]
push dword [ebp + 0x74]
call fcn.1028031a
jmp 0x10280481
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_HeapCreate]
push esi
push 0x400000
push 1
call ebx
lea esi, [ebp + 0x64]
lea edi, [ebp + 0x60]
mov dword [0x10283020], eax
call fcn.102801e0
mov edi, eax
xor esi, esi
cmp edi, esi
jne 0x1028048a
cmp dword [ebp + 0x60], 0xffffffff
push dword [ebp + 0x64]
lea eax, [ebp - 0x3c]
jne 0x1028045a
push 0x10282590
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp 0x1028046c
push dword [ebp + 0x60]
push 0x10282570
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0x30
push 0x10282560
lea eax, [ebp - 0x3c]
push eax
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop ebx
pop edi
pop esi
add ebp, 0x6c
leave
ret 0xc
push esi
push 0x14000
push esi
call ebx
push 0x10283024
push eax
push dword [0x10283018]
mov dword [0x1028301c], eax
push 0x10283008
push dword [sym.imp.KERNEL32.dll_GetProcAddress]
push dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
call edi
push edi
push 1
push dword [0x10283020]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0x8000
push dword [0x10283004]
push dword [section._data]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push dword [0x10283020]
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
xor edi, edi
cmp esi, edi
je 0x102805ac
cmp esi, 0xfffffff4
jg 0x1028053a
je 0x10280533
cmp esi, 0xffffff97
je 0x1028059b
cmp esi, 0xffffffec
jle 0x10280553
cmp esi, 0xffffffee
jle 0x1028059b
cmp esi, 0xfffffff0
je 0x1028052c
jle 0x10280553
cmp esi, 0xfffffff2
jle 0x1028059b
cmp esi, 0xfffffff3
jne 0x10280553
mov eax, 0x10282418
jmp 0x1028058c
mov eax, 0x102823d0
jmp 0x1028058c
mov eax, 0x102823a0
jmp 0x1028058c
cmp esi, 0xfffffff5
je 0x10280587
cmp esi, 0xfffffff6
je 0x10280580
cmp esi, 0xfffffffa
je 0x10280579
cmp esi, 0xfffffffc
je 0x10280572
cmp esi, 0xfffffffd
je 0x1028056b
push esi
lea eax, [ebp + 0x48]
push 0x10282394
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp + 0x48]
jmp 0x1028058c
mov eax, 0x1028235c
jmp 0x1028058c
mov eax, 0x102822f0
jmp 0x1028058c
mov eax, 0x102821a0
jmp 0x1028058c
mov eax, 0x10282120
jmp 0x1028058c
mov eax, 0x102820e4
push 0x30
push 0x102820cc
push eax
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp dword [ebp + 0x68], edi
jne 0x1028047e
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [0x10283008]
cmp eax, edi
je 0x1028059b
cmp dword [ebp + 0x68], edi
je 0x102805cd
push dword [ebp + 0x7c]
push dword [ebp + 0x78]
push dword [ebp + 0x74]
call fcn.1028031a
jmp 0x10280480
mov ecx, dword [0x10283010]
add eax, ecx
call eax
jmp 0x1028047e