Function at 0x1002c470
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x100b300c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x100bc08c]
test eax, eax
push ebx
push esi
push edi
mov edi, ecx
mov ecx, 1
cmove eax, ecx
mov ecx, edi
mov dword [0x100bc08c], eax
call fcn.10028950
call fcn.100286b0
call fcn.10021fd0
mov ecx, dword [0x100baa40]
test ecx, ecx
jne 0x1002c4c0
mov dword [0x100ba33c], 0x32
jmp 0x1002c4f4
cmp ecx, 1
jne 0x1002c4d1
mov dword [0x100ba33c], 6
jmp 0x1002c4f4
cmp ecx, 2
jne 0x1002c4e2
mov dword [0x100ba33c], 5
jmp 0x1002c4f4
mov eax, dword [0x100ba33c]
xor edx, edx
cmp ecx, 3
cmove eax, edx
mov dword [0x100ba33c], eax
call fcn.10016ef0
test eax, eax
je 0x1002c556
push 0x75
mov dword [0x100bacf0], 0x10017200
call fcn.10017200
cwde
shr eax, 0x10
test eax, eax
je 0x1002c54f
cmp byte [0x100bf338], 0
je 0x1002c536
cmp dword [0x100bf33c], 0
je 0x1002c556
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x100bf33c], eax
ja 0x1002c556
xor eax, eax
mov byte [0x100bf338], 1
cmp dword [0x100b9d4c], eax
sete al
mov dword [0x100b9d4c], eax
jmp 0x1002c556
mov byte [0x100bf338], 0
call fcn.1001fee0
call fcn.1001fc10
mov ecx, edi
call fcn.10020050
call fcn.100256a0
mov ecx, edi
call fcn.10021c80
call fcn.10024240
mov ecx, dword [0x100ba5e8]
mov eax, dword [0x100bed18]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [eax], 0
je 0x1002c5d9
cmp dword [0x100ba9f4], 0
jne 0x1002c5a9
cmp dword [0x100bb70c], 0
je 0x1002c5d9
mov ecx, dword [0x100ba5e8]
mov eax, dword [0x100bed18]
add eax, 0x194
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov ebx, eax
cmp ebx, 0x1000
jbe 0x1002c613
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push ebx
call esi
mov byte [ebx], 0xcc
jmp 0x1002c607
mov ecx, dword [0x100ba5e8]
mov eax, dword [0x100bed18]
add eax, 0x194
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov ebx, eax
cmp ebx, 0x1000
jbe 0x1002c613
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push ebx
call esi
mov byte [ebx], 0x6a
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push ebx
call esi
mov ecx, edi
call fcn.10023bd0
mov ecx, edi
call fcn.10022c60
mov ecx, edi
call fcn.100232f0
call fcn.10023530
call fcn.10023630
call fcn.10024af0
call fcn.10024f80
call fcn.100249f0
call fcn.10025aa0
cmp dword [0x100b9d90], 0
je 0x1002c6fc
mov ecx, dword [0x100ba5e8]
mov eax, dword [0x100bed18]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x1002c6fc
push 0x20
mov dword [0x100bacf0], 0x10017200
call fcn.10017200
cwde
shr eax, 0x10
test eax, eax
je 0x1002c6f5
cmp byte [0x100bf090], 0
je 0x1002c6b0
cmp dword [0x100bf094], 0
je 0x1002c6fc
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
mov ecx, dword [0x100bf094]
inc ecx
cmp ecx, eax
ja 0x1002c6fc
jmp 0x1002c6b6
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov byte [0x100bf090], 1
call ebx
mov ecx, dword [0x100ba5e8]
mov dword [0x100bf094], eax
mov eax, dword [0x100bed18]
add eax, 0x16c
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea ebx, [eax + 2]
cmp ebx, 0x1000
jbe 0x1002c737
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push ebx
call esi
mov byte [ebx], 3
jmp 0x1002c72b
mov byte [0x100bf090], 0
mov ecx, dword [0x100ba5e8]
mov eax, dword [0x100bed18]
add eax, 0x16c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
lea ebx, [eax + 2]
cmp ebx, 0x1000
jbe 0x1002c737
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push ebx
call esi
mov byte [ebx], 0x44
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push ebx
call esi
call fcn.100252b0
call fcn.10025360
call fcn.10025eb0
call fcn.100248c0
call fcn.100246e0
cmp dword [0x100ba58c], 0
jle 0x1002c7ed
mov ecx, dword [0x100ba5e8]
mov eax, dword [0x100bed18]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x1002c7ed
mov eax, dword [0x100ba58c]
cmp eax, 1
jne 0x1002c78c
mov dword [0x100bea84], 0x42c80000
jmp 0x1002c7bd
cmp eax, 2
jne 0x1002c79d
mov dword [0x100bea84], 0x42dc0000
jmp 0x1002c7bd
cmp eax, 3
jne 0x1002c7ae
mov dword [0x100bea84], 0x42f00000
jmp 0x1002c7bd
cmp eax, 4
jne 0x1002c7bd
mov dword [0x100bea84], 0x42fa0000
mov ecx, dword [0x100ba5e8]
mov eax, dword [0x100bed18]
add eax, 0x154
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov ebx, eax
cmp ebx, 0x1000
jbe 0x1002c827
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push ebx
call esi
mov byte [ebx], 0xcc
jmp 0x1002c81b
mov ecx, dword [0x100ba5e8]
mov eax, dword [0x100bed18]
add eax, 0x154
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov ebx, eax
cmp ebx, 0x1000
jbe 0x1002c827
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push ebx
call esi
mov byte [ebx], 0x55
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push ebx
call esi
call fcn.10025d00
call fcn.10023730
call fcn.10025df0
call fcn.100257e0
call fcn.100258c0
call fcn.100254d0
call fcn.10025570
call fcn.10028300
call fcn.10028010
mov ecx, edi
call fcn.10028390
call fcn.1002c050
call fcn.10025ff0
call fcn.10027e40
call fcn.10027940
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1007c649
mov esp, ebp
pop ebp
ret