Function at 0x10026c10
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1009400c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x100977b0]
test eax, eax
push ebx
mov ebx, ecx
mov ecx, 1
push esi
cmove eax, ecx
push edi
mov dword [0x100977b0], eax
call fcn.10024db0
call fcn.10025100
call fcn.1001e1a0
mov ecx, dword [0x1009c824]
test ecx, ecx
jne 0x10026c5e
mov dword [0x1009c128], 0x32
jmp 0x10026c92
cmp ecx, 1
jne 0x10026c6f
mov dword [0x1009c128], 6
jmp 0x10026c92
cmp ecx, 2
jne 0x10026c80
mov dword [0x1009c128], 5
jmp 0x10026c92
mov eax, dword [0x1009c128]
xor edx, edx
cmp ecx, 3
cmove eax, edx
mov dword [0x1009c128], eax
call fcn.100134c0
test eax, eax
je 0x10026cf4
push 0x75
mov dword [0x1009cac4], 0x100137d0
call fcn.100137d0
cwde
shr eax, 0x10
test eax, eax
je 0x10026ced
cmp byte [0x1009d598], 0
je 0x10026cd4
cmp dword [0x1009d59c], 0
je 0x10026cf4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x1009d59c], eax
ja 0x10026cf4
xor eax, eax
mov byte [0x1009d598], 1
cmp dword [0x1009bf38], eax
sete al
mov dword [0x1009bf38], eax
jmp 0x10026cf4
mov byte [0x1009d598], 0
call fcn.1001c0a0
call fcn.1001bdd0
mov ecx, ebx
call fcn.1001c210
call fcn.100234e0
mov ecx, ebx
call fcn.1001de50
mov ecx, dword [0x1009c3c4]
mov eax, dword [0x10098738]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [eax], 0
je 0x10026dc7
cmp dword [0x1009bf3c], 0
jne 0x10026d90
cmp dword [0x100986dc], 0
jne 0x10026d90
cmp dword [0x10097c00], 0
jne 0x10026d90
cmp dword [0x10096e70], 0
jne 0x10026d90
mov ecx, dword [0x1009c3c4]
mov eax, dword [0x10098738]
add eax, 0x108
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x10026e01
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push edi
call esi
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
jmp 0x10026df9
mov ecx, dword [0x1009c3c4]
mov eax, dword [0x10098738]
add eax, 0x108
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x10026e01
lea eax, [ebp - 0x10]
push eax
push 0x40
push 1
push edi
call esi
lea eax, [ebp - 0x10]
mov byte [edi], 0xcc
push eax
push dword [ebp - 0x10]
jmp 0x10026dfc
mov ecx, dword [0x1009c3c4]
mov eax, dword [0x10098738]
add eax, 0x108
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x10026e01
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
mov byte [edi], 0x55
push 1
push edi
call esi
mov ecx, dword [0x1009c3c4]
mov eax, dword [0x10098738]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x10026e5c
cmp dword [0x1009c7d4], 0
jne 0x10026e2c
cmp dword [0x1009d0c8], 0
je 0x10026e5c
mov ecx, dword [0x1009c3c4]
mov eax, dword [0x10098738]
add eax, 0x188
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x10026e96
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0xcc
jmp 0x10026e8a
mov ecx, dword [0x1009c3c4]
mov eax, dword [0x10098738]
add eax, 0x188
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x10026e96
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0x6a
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push edi
call esi
mov ecx, ebx
call fcn.10020850
mov ecx, ebx
call fcn.1001f440
mov ecx, ebx
call fcn.1001ff90
mov ecx, ebx
call fcn.1001f9e0
call fcn.1001fc20
call fcn.1001fd20
call fcn.100228b0
call fcn.10022c50
call fcn.10022f80
call fcn.100227a0
call fcn.100237f0
cmp dword [0x1009bf70], 0
je 0x10026f8b
mov ecx, dword [0x1009c3c4]
mov eax, dword [0x10098738]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x10026f8b
push 0x20
mov dword [0x1009cac4], 0x100137d0
call fcn.100137d0
cwde
shr eax, 0x10
test eax, eax
je 0x10026f84
cmp byte [0x1009d2f0], 0
je 0x10026f3f
cmp dword [0x1009d2f4], 0
je 0x10026f8b
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov ecx, dword [0x1009d2f4]
inc ecx
cmp ecx, eax
ja 0x10026f8b
jmp 0x10026f45
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov byte [0x1009d2f0], 1
call edi
mov ecx, dword [0x1009c3c4]
mov dword [0x1009d2f4], eax
mov eax, dword [0x10098738]
add eax, 0x160
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea edi, [eax + 2]
cmp edi, 0x1000
jbe 0x10026fc6
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 3
jmp 0x10026fba
mov byte [0x1009d2f0], 0
mov ecx, dword [0x1009c3c4]
mov eax, dword [0x10098738]
add eax, 0x160
push eax
mov edx, dword [ecx]
call dword [edx + 4]
lea edi, [eax + 2]
cmp edi, 0x1000
jbe 0x10026fc6
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0x44
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push edi
call esi
call fcn.100230f0
call fcn.100231a0
mov ecx, dword [0x1009c3c4]
mov eax, dword [0x10098738]
add eax, 0x174
push eax
mov edx, dword [ecx]
call dword [edx + 4]
test eax, eax
je 0x1002706f
cmp dword [0x10097bcc], 1
mov ecx, dword [0x1009c3c4]
mov eax, dword [0x10098738]
mov edx, dword [ecx]
jne 0x10027041
add eax, 0x1c
push eax
call dword [edx + 4]
mov ecx, dword [0x1009c3c4]
cmp dword [eax], 0
mov edx, dword [ecx]
mov eax, dword [0x10098738]
je 0x10027041
add eax, 0x174
push eax
call dword [edx + 4]
lea edi, [eax + 3]
cmp edi, 0x1000
jbe 0x1002706f
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0x66
jmp 0x10027063
add eax, 0x174
push eax
call dword [edx + 4]
lea edi, [eax + 3]
cmp edi, 0x1000
jbe 0x1002706f
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0x46
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push edi
call esi
call fcn.10023c00
call fcn.10020510
call fcn.10021040
call fcn.10020f80
cmp dword [0x1009c370], 0
jle 0x10027120
mov ecx, dword [0x1009c3c4]
mov eax, dword [0x10098738]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x10027120
mov eax, dword [0x1009c370]
cmp eax, 1
jne 0x100270bf
mov dword [0x100984b0], 0x42c80000
jmp 0x100270f0
cmp eax, 2
jne 0x100270d0
mov dword [0x100984b0], 0x42dc0000
jmp 0x100270f0
cmp eax, 3
jne 0x100270e1
mov dword [0x100984b0], 0x42f00000
jmp 0x100270f0
cmp eax, 4
jne 0x100270f0
mov dword [0x100984b0], 0x42fa0000
mov ecx, dword [0x1009c3c4]
mov eax, dword [0x10098738]
add eax, 0x148
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x1002715a
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0xcc
jmp 0x1002714e
mov ecx, dword [0x1009c3c4]
mov eax, dword [0x10098738]
add eax, 0x148
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x1002715a
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0x55
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push edi
call esi
call fcn.10023a50
call fcn.1001fe20
call fcn.10023b40
call fcn.10023620
call fcn.10023310
call fcn.100233b0
call fcn.100249a0
call fcn.100246b0
mov ecx, ebx
call fcn.10024a30
call fcn.10026800
call fcn.10023d40
call fcn.100244e0
call fcn.10024150
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100662d9
mov esp, ebp
pop ebp
ret