Function at 0x10026130
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1009400c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10096ba8]
test eax, eax
push ebx
mov ebx, ecx
mov ecx, 1
push esi
cmove eax, ecx
push edi
mov dword [0x10096ba8], eax
call fcn.10024a10
call fcn.1001e050
mov ecx, dword [0x1009bbfc]
test ecx, ecx
jne 0x10026179
mov dword [0x1009b504], 0x32
jmp 0x100261ad
cmp ecx, 1
jne 0x1002618a
mov dword [0x1009b504], 6
jmp 0x100261ad
cmp ecx, 2
jne 0x1002619b
mov dword [0x1009b504], 5
jmp 0x100261ad
mov eax, dword [0x1009b504]
xor edx, edx
cmp ecx, 3
cmove eax, edx
mov dword [0x1009b504], eax
call fcn.10013360
test eax, eax
je 0x1002620f
push 0x75
mov dword [0x1009be98], 0x10013670
call fcn.10013670
cwde
shr eax, 0x10
test eax, eax
je 0x10026208
cmp byte [0x1009c950], 0
je 0x100261ef
cmp dword [0x1009c954], 0
je 0x1002620f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x1009c954], eax
ja 0x1002620f
xor eax, eax
mov byte [0x1009c950], 1
cmp dword [0x1009b314], eax
sete al
mov dword [0x1009b314], eax
jmp 0x1002620f
mov byte [0x1009c950], 0
call fcn.1001bf60
call fcn.1001bc90
mov ecx, ebx
call fcn.1001c0d0
call fcn.10023210
mov ecx, ebx
call fcn.1001dd00
mov ecx, dword [0x1009b7a0]
mov eax, dword [0x10097b24]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [eax], 0
je 0x100262e2
cmp dword [0x1009b318], 0
jne 0x100262ab
cmp dword [0x10097acc], 0
jne 0x100262ab
cmp dword [0x10096ff8], 0
jne 0x100262ab
cmp dword [0x10096274], 0
jne 0x100262ab
mov ecx, dword [0x1009b7a0]
mov eax, dword [0x10097b24]
add eax, 0x108
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x1002631c
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push edi
call esi
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
jmp 0x10026314
mov ecx, dword [0x1009b7a0]
mov eax, dword [0x10097b24]
add eax, 0x108
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x1002631c
lea eax, [ebp - 0x10]
push eax
push 0x40
push 1
push edi
call esi
lea eax, [ebp - 0x10]
mov byte [edi], 0xcc
push eax
push dword [ebp - 0x10]
jmp 0x10026317
mov ecx, dword [0x1009b7a0]
mov eax, dword [0x10097b24]
add eax, 0x108
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x1002631c
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
mov byte [edi], 0x55
push 1
push edi
call esi
mov ecx, dword [0x1009b7a0]
mov eax, dword [0x10097b24]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x10026377
cmp dword [0x1009bbb0], 0
jne 0x10026347
cmp dword [0x1009623c], 0
je 0x10026377
mov ecx, dword [0x1009b7a0]
mov eax, dword [0x10097b24]
add eax, 0x188
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x100263b1
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0xcc
jmp 0x100263a5
mov ecx, dword [0x1009b7a0]
mov eax, dword [0x10097b24]
add eax, 0x188
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x100263b1
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0x6a
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push edi
call esi
mov ecx, ebx
call fcn.10020580
mov ecx, ebx
call fcn.1001f2f0
mov ecx, ebx
call fcn.1001fe40
mov ecx, ebx
call fcn.1001f890
call fcn.1001fad0
call fcn.1001fbd0
call fcn.100225e0
call fcn.10022980
call fcn.10022cb0
call fcn.100224d0
call fcn.10023520
cmp dword [0x1009b34c], 0
je 0x100264a6
mov ecx, dword [0x1009b7a0]
mov eax, dword [0x10097b24]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x100264a6
push 0x20
mov dword [0x1009be98], 0x10013670
call fcn.10013670
cwde
shr eax, 0x10
test eax, eax
je 0x1002649f
cmp byte [0x1009c6a8], 0
je 0x1002645a
cmp dword [0x1009c6ac], 0
je 0x100264a6
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov ecx, dword [0x1009c6ac]
inc ecx
cmp ecx, eax
ja 0x100264a6
jmp 0x10026460
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov byte [0x1009c6a8], 1
call edi
mov ecx, dword [0x1009b7a0]
mov dword [0x1009c6ac], eax
mov eax, dword [0x10097b24]
add eax, 0x160
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea edi, [eax + 2]
cmp edi, 0x1000
jbe 0x100264e1
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 3
jmp 0x100264d5
mov byte [0x1009c6a8], 0
mov ecx, dword [0x1009b7a0]
mov eax, dword [0x10097b24]
add eax, 0x160
push eax
mov edx, dword [ecx]
call dword [edx + 4]
lea edi, [eax + 2]
cmp edi, 0x1000
jbe 0x100264e1
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0x44
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push edi
call esi
call fcn.10022e20
call fcn.10022ed0
mov ecx, dword [0x1009b7a0]
mov eax, dword [0x10097b24]
add eax, 0x174
push eax
mov edx, dword [ecx]
call dword [edx + 4]
test eax, eax
je 0x1002658a
cmp dword [0x10096fc4], 1
mov ecx, dword [0x1009b7a0]
mov eax, dword [0x10097b24]
mov edx, dword [ecx]
jne 0x1002655c
add eax, 0x1c
push eax
call dword [edx + 4]
mov ecx, dword [0x1009b7a0]
cmp dword [eax], 0
mov edx, dword [ecx]
mov eax, dword [0x10097b24]
je 0x1002655c
add eax, 0x174
push eax
call dword [edx + 4]
lea edi, [eax + 3]
cmp edi, 0x1000
jbe 0x1002658a
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0x66
jmp 0x1002657e
add eax, 0x174
push eax
call dword [edx + 4]
lea edi, [eax + 3]
cmp edi, 0x1000
jbe 0x1002658a
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0x46
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push edi
call esi
call fcn.10023930
call fcn.10020d70
call fcn.10020cb0
cmp dword [0x1009b74c], 0
jle 0x10026636
mov ecx, dword [0x1009b7a0]
mov eax, dword [0x10097b24]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x10026636
mov eax, dword [0x1009b74c]
cmp eax, 1
jne 0x100265d5
mov dword [0x100978a0], 0x42c80000
jmp 0x10026606
cmp eax, 2
jne 0x100265e6
mov dword [0x100978a0], 0x42dc0000
jmp 0x10026606
cmp eax, 3
jne 0x100265f7
mov dword [0x100978a0], 0x42f00000
jmp 0x10026606
cmp eax, 4
jne 0x10026606
mov dword [0x100978a0], 0x42fa0000
mov ecx, dword [0x1009b7a0]
mov eax, dword [0x10097b24]
add eax, 0x148
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x10026670
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0xcc
jmp 0x10026664
mov ecx, dword [0x1009b7a0]
mov eax, dword [0x10097b24]
add eax, 0x148
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x10026670
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0x55
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push edi
call esi
call fcn.10023780
call fcn.1001fcd0
call fcn.10023870
call fcn.10023350
call fcn.10023040
call fcn.100230e0
call fcn.100246b0
call fcn.100243c0
mov ecx, ebx
call fcn.10024740
call fcn.10025d30
call fcn.10023a70
call fcn.100241f0
call fcn.10023e70
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100656e9
mov esp, ebp
pop ebp
ret