Function at 0x10002dc0
Capabilities:
Allocate or change rwx memory
Check for software breakpoints
Execute shellcode via indirect call

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x14]
push ebx
push ebp
xor ebp, ebp
push esi
cmp eax, ebp
push edi
mov dword [esp + 0x10], ebp
je 0x10002dd7
mov dword [eax], ebp
mov ebx, dword [esp + 0x28]
cmp ebx, ebp
je 0x10002de1
mov dword [ebx], ebp
mov esi, dword [esp + 0x2c]
cmp esi, ebp
je 0x10002deb
mov dword [esi], ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x10009608], eax
je 0x10002e08
pop edi
pop esi
pop ebp
mov eax, 0x10dd
pop ebx
add esp, 8
ret 0x14
mov eax, dword [0x1000960c]
cmp eax, ebp
jne 0x100030ab
mov ecx, dword [esp + 0x1c]
cmp ecx, ebp
jne 0x10002e2c
pop edi
pop esi
pop ebp
mov eax, 6
pop ebx
add esp, 8
ret 0x14
mov eax, dword [ecx]
cmp eax, ebp
jne 0x10002e4c
pop edi
mov eax, 6
pop esi
pop ebp
mov dword [0x1000960c], eax
mov dword [0x10009610], ecx
pop ebx
add esp, 8
ret 0x14
push ebp
push eax
mov dword [esp + 0x30], ebp
call fcn.10002790
mov edi, eax
push 0
mov eax, dword [esp + 0x24]
mov dword [esp + 0x18], edi
push eax
call fcn.10002790
cmp eax, edi
mov dword [esp + 0x20], eax
jne 0x10002e83
mov eax, dword [0x10009604]
test eax, eax
jne 0x1000304e
jmp 0x10003026
test ebx, ebx
je 0x10002e89
mov dword [ebx], edi
test esi, esi
je 0x10002e8f
mov dword [esi], eax
push 0x18
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 0x28], eax
test eax, eax
jne 0x10002eae
mov dword [esp + 0x10], 8
jmp 0x10003026
call fcn.100039e0
push edi
call fcn.100030c0
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x10002ecf
mov dword [esp + 0x10], 8
jmp 0x10003026
mov eax, dword [esp + 0x24]
test eax, eax
je 0x10002ed9
mov dword [eax], ebp
mov eax, edi
xor ebx, ebx
lea ecx, [esp + 0x24]
lea edx, [ebx + ebp]
push ecx
push 0
push eax
push edx
mov esi, eax
mov dword [esp + 0x34], 0
call fcn.100034d0
mov ecx, dword [esp + 0x24]
test ecx, ecx
jne 0x10002f5b
mov cl, byte [esi]
mov ebx, eax
sub ebx, edi
cmp cl, 0xe9
je 0x10002f5b
cmp cl, 0xe0
je 0x10002f5b
cmp cl, 0xc2
je 0x10002f5b
cmp cl, 0xc3
je 0x10002f5b
cmp cl, 0xcc
je 0x10002f5b
cmp cl, 0xff
jne 0x10002f2a
cmp byte [esi + 1], 0x25
je 0x10002f5b
cmp cl, 0x26
je 0x10002f48
cmp cl, 0x2e
je 0x10002f48
cmp cl, 0x36
je 0x10002f48
cmp cl, 0xe3
je 0x10002f48
cmp cl, 0x64
je 0x10002f48
cmp cl, 0x65
jne 0x10002f54
cmp byte [esi + 1], 0xff
jne 0x10002f54
cmp byte [esi + 2], 0x25
je 0x10002f5b
cmp ebx, 5
jge 0x10002f7a
jmp 0x10002edd
cmp ebx, 5
jge 0x10002f7a
mov eax, dword [0x10009604]
mov dword [esp + 0x10], 9
test eax, eax
jne 0x10003030
jmp 0x10003026
cmp ebx, 0x12
jbe 0x10002f8c
mov dword [esp + 0x10], 6
jmp 0x10003026
mov eax, dword [esp + 0x20]
lea ecx, [ebp + 0x17]
mov dword [ebp + 0x1c], eax
lea edx, [ebx + edi]
lea eax, [ebx + ebp]
mov dword [ebp + 0x18], edx
mov byte [ecx], bl
lea esi, [eax + 5]
mov byte [eax], 0xe9
inc eax
sub edx, esi
lea edi, [eax + 4]
mov dword [eax], edx
cmp edi, ecx
jae 0x10002fc8
sub ecx, edi
mov eax, 0xcccccccc
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 0x2c]
push eax
push 0x40
push ebx
mov ebx, dword [esp + 0x20]
push ebx
mov dword [esp + 0x3c], 0
call edi
test eax, eax
je 0x1000301c
push ebx
call fcn.100032f0
mov esi, eax
add esp, 4
test esi, esi
je 0x1000307d
cmp word [esi + 0x1c], 0x6544
je 0x1000307d
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], 0
push ecx
push 0x40
push 0x40
push esi
call edi
test eax, eax
jne 0x10003065
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x10]
mov dword [0x1000960c], edx
test ebp, ebp
je 0x1000303d
push ebp
call fcn.10002a40
add esp, 4
mov eax, dword [esp + 0x28]
test eax, eax
je 0x1000304e
push eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, dword [esp + 0x1c]
pop edi
pop esi
mov dword [0x10009610], eax
mov eax, dword [esp + 8]
pop ebp
pop ebx
add esp, 8
ret 0x14
mov word [esi + 0x1c], 0x6544
mov word [esi + 0x1e], 0x6f74
mov word [esi + 0x20], 0x7275
mov word [esi + 0x22], 0x2173
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x1c]
mov dword [eax + 4], 0
mov dword [eax + 8], ecx
mov dword [eax + 0x10], ebp
mov dword [eax + 0xc], ebx
mov edx, dword [esp + 0x2c]
mov dword [eax + 0x14], edx
mov ecx, dword [0x10009618]
mov dword [eax], ecx
mov dword [0x10009618], eax
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0x14