Function at 0x1001c150
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004477d
mov eax, dword fs:[0]
push eax
sub esp, 0xac
mov eax, dword [0x100c7140]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0xffffffffffffffff
mov ecx, 0x100c6a10
xor esi, esi
call fcn.100017a0
mov eax, dword [0x100c6a44]
sub eax, dword [0x100c6a40]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
sar eax, 2
test eax, eax
je 0x1001c277
mov ecx, dword [0x100c8a74]
mov eax, dword fs:[0x2c]
lea eax, [eax + ecx*4]
mov dword [ebp - 0xb8], eax
nop dword [eax]
lea eax, [esi - 0xd]
cmp eax, 2
ja 0x1001c254
push 0xffffffffffffffff
mov ecx, 0x100c6a10
call fcn.100017a0
mov eax, dword [0x100c6a40]
mov edi, dword [eax + esi*4]
mov eax, dword [ebp - 0xb8]
add edi, 2
mov ecx, dword [eax]
mov eax, dword [0x100c8650]
cmp eax, dword [ecx + 4]
jg 0x1001c4b2
lea eax, [ebp - 0xac]
mov dword [ebp - 0xb0], 4
push eax
push 0x40
push 4
push edi
mov dword [ebp - 0xb4], edi
call ebx
test eax, eax
setne byte [ebp - 0xa8]
mov dword [edi], 0x100c85c8
cmp byte [ebp - 0xa8], 0
je 0x1001c254
mov eax, dword [ebp - 0xac]
lea ecx, [ebp - 0xa4]
push ecx
push eax
push dword [ebp - 0xb0]
mov dword [ebp - 0xa4], eax
push dword [ebp - 0xb4]
call ebx
push 0xffffffffffffffff
mov ecx, 0x100c6a10
inc esi
call fcn.100017a0
mov eax, dword [0x100c6a44]
sub eax, dword [0x100c6a40]
sar eax, 2
cmp esi, eax
jb 0x1001c1c0
sub esp, 8
lea ecx, [ebp - 0x58]
mov eax, esp
mov dword [eax], str.D9_05_________D8_25_________69_C0_CC_01_00_00
mov dword [eax + 4], 0x2d
call fcn.100187b0
push 2
lea ecx, [ebp - 0x58]
mov dword [ebp - 4], 0
call fcn.100017a0
push 0xffffffffffffffff
lea ecx, [ebp - 0x58]
call fcn.100017a0
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0xa4]
mov eax, dword [eax + 4]
add eax, 2
push eax
call fcn.10018ab0
mov esi, dword [ebp - 0xa4]
lea eax, [ebp - 0xac]
push eax
push 0x40
push 4
push esi
mov dword [ebp - 0xb0], 4
mov dword [ebp - 0xb4], esi
call ebx
test eax, eax
setne byte [ebp - 0xa8]
mov dword [esi], 0x100c85c0
cmp byte [ebp - 0xa8], 0
je 0x1001c31f
mov eax, dword [ebp - 0xac]
lea ecx, [ebp - 0xa4]
push ecx
push eax
push dword [ebp - 0xb0]
mov dword [ebp - 0xa4], eax
push dword [ebp - 0xb4]
call ebx
sub esp, 8
lea ecx, [ebp - 0xa0]
mov eax, esp
mov dword [eax], str.D8_0D_________D9_5C_24_24
mov dword [eax + 4], 0x19
call fcn.100187b0
push eax
lea ecx, [ebp - 0x58]
call fcn.10018e00
lea ecx, [ebp - 0xa0]
call fcn.10018d20
push 8
lea ecx, [ebp - 0x58]
call fcn.100017a0
push 0xffffffffffffffff
lea ecx, [ebp - 0x58]
call fcn.100017a0
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0xa4]
mov eax, dword [eax + 0x1c]
add eax, 2
push eax
call fcn.10018ab0
mov esi, dword [ebp - 0xa4]
lea eax, [ebp - 0xac]
push eax
push 0x40
push 4
push esi
mov dword [ebp - 0xb0], 4
mov dword [ebp - 0xb4], esi
call ebx
test eax, eax
setne byte [ebp - 0xa8]
mov dword [esi], 0x100c85c0
cmp byte [ebp - 0xa8], 0
je 0x1001c3d7
mov eax, dword [ebp - 0xac]
lea ecx, [ebp - 0xa4]
push ecx
push eax
push dword [ebp - 0xb0]
mov dword [ebp - 0xa4], eax
push dword [ebp - 0xb4]
call ebx
sub esp, 8
lea ecx, [ebp - 0xa0]
mov eax, esp
mov dword [eax], str.D8_0D_________D8_AC_24_AC_00_00_00_DD_DB_D9_C2_D8_C8_DE_C1_D9_FA
mov dword [eax + 4], 0x40
call fcn.100187b0
push eax
lea ecx, [ebp - 0x58]
call fcn.10018e00
lea ecx, [ebp - 0xa0]
call fcn.10018d20
push 1
lea ecx, [ebp - 0x58]
call fcn.100017a0
push 0xffffffffffffffff
lea ecx, [ebp - 0x58]
call fcn.100017a0
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0xa4]
mov eax, dword [eax]
add eax, 2
push eax
call fcn.10018ab0
mov esi, dword [ebp - 0xa4]
lea eax, [ebp - 0xac]
push eax
push 0x40
push 4
push esi
mov dword [ebp - 0xb0], 4
mov dword [ebp - 0xb4], esi
call ebx
test eax, eax
setne byte [ebp - 0xa8]
mov dword [esi], 0x100c85c0
cmp byte [ebp - 0xa8], 0
je 0x1001c48e
mov eax, dword [ebp - 0xac]
lea ecx, [ebp - 0xa4]
push ecx
push eax
push dword [ebp - 0xb0]
mov dword [ebp - 0xa4], eax
push dword [ebp - 0xb4]
call ebx
lea ecx, [ebp - 0x58]
call fcn.10018d20
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100230bc
mov esp, ebp
pop ebp
ret
push 0x100c8650
call fcn.100234e5
add esp, 4
cmp dword [0x100c8650], 0xffffffff
jne 0x1001c1fc
mov ecx, 0x100c8644
mov dword [0x100c8644], 0x100b543c
mov dword [0x100c864c], 0
mov dword [0x100c8648], 0
call fcn.1001b0c0
push 0x100c8650
call fcn.10023494
add esp, 4
jmp 0x1001c1fc