Function at 0x1002c860
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x100b700c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x100c053c]
test eax, eax
push ebx
mov ebx, ecx
mov ecx, 1
push esi
cmove eax, ecx
push edi
mov dword [0x100c053c], eax
call fcn.10029de0
call fcn.10023210
mov ecx, dword [0x100beee8]
test ecx, ecx
jne 0x1002c8a9
mov dword [0x100be7e8], 0x32
jmp 0x1002c8dd
cmp ecx, 1
jne 0x1002c8ba
mov dword [0x100be7e8], 6
jmp 0x1002c8dd
cmp ecx, 2
jne 0x1002c8cb
mov dword [0x100be7e8], 5
jmp 0x1002c8dd
mov eax, dword [0x100be7e8]
xor edx, edx
cmp ecx, 3
cmove eax, edx
mov dword [0x100be7e8], eax
call fcn.10017710
test eax, eax
je 0x1002c93f
push 0x75
mov dword [0x100bf194], 0x10017a20
call fcn.10017a20
cwde
shr eax, 0x10
test eax, eax
je 0x1002c938
cmp byte [0x100c4700], 0
je 0x1002c91f
cmp dword [0x100c4704], 0
je 0x1002c93f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x100c4704], eax
ja 0x1002c93f
xor eax, eax
mov byte [0x100c4700], 1
cmp dword [0x100be1fc], eax
sete al
mov dword [0x100be1fc], eax
jmp 0x1002c93f
mov byte [0x100c4700], 0
call fcn.10021120
call fcn.10025db0
call fcn.100275c0
call fcn.10020e50
mov ecx, ebx
call fcn.10021290
call fcn.10026b00
mov ecx, ebx
call fcn.10022ec0
call fcn.10025480
mov ecx, dword [0x100bea90]
mov eax, dword [0x100ba604]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [eax], 0
je 0x1002c9cc
cmp dword [0x100bee9c], 0
jne 0x1002c99c
cmp dword [0x100bfbb4], 0
je 0x1002c9cc
mov ecx, dword [0x100bea90]
mov eax, dword [0x100ba604]
add eax, 0x1b8
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x1002ca06
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0xcc
jmp 0x1002c9fa
mov ecx, dword [0x100bea90]
mov eax, dword [0x100ba604]
add eax, 0x1b8
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x1002ca06
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0x6a
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push edi
call esi
mov ecx, ebx
call fcn.10024e10
mov ecx, ebx
call fcn.10023ea0
mov ecx, ebx
call fcn.10024530
call fcn.10024770
call fcn.10024870
call fcn.10025f70
call fcn.100263e0
call fcn.10025c30
call fcn.10026f10
cmp dword [0x100be23c], 0
je 0x1002caef
mov ecx, dword [0x100bea90]
mov eax, dword [0x100ba604]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x1002caef
push 0x20
mov dword [0x100bf194], 0x10017a20
call fcn.10017a20
cwde
shr eax, 0x10
test eax, eax
je 0x1002cae8
cmp byte [0x100c4458], 0
je 0x1002caa3
cmp dword [0x100c445c], 0
je 0x1002caef
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov ecx, dword [0x100c445c]
inc ecx
cmp ecx, eax
ja 0x1002caef
jmp 0x1002caa9
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov byte [0x100c4458], 1
call edi
mov ecx, dword [0x100bea90]
mov dword [0x100c445c], eax
mov eax, dword [0x100ba604]
add eax, 0x190
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea edi, [eax + 2]
cmp edi, 0x1000
jbe 0x1002cb2a
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 3
jmp 0x1002cb1e
mov byte [0x100c4458], 0
mov ecx, dword [0x100bea90]
mov eax, dword [0x100ba604]
add eax, 0x190
push eax
mov edx, dword [ecx]
call dword [edx + 4]
lea edi, [eax + 2]
cmp edi, 0x1000
jbe 0x1002cb2a
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0x44
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push edi
call esi
call fcn.10026710
call fcn.100267c0
call fcn.10027320
call fcn.10027460
call fcn.10025b00
call fcn.10025920
cmp dword [0x100bea38], 0
jle 0x1002cbe5
mov ecx, dword [0x100bea90]
mov eax, dword [0x100ba604]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x1002cbe5
mov eax, dword [0x100bea38]
cmp eax, 1
jne 0x1002cb84
mov dword [0x100ba374], 0x42c80000
jmp 0x1002cbb5
cmp eax, 2
jne 0x1002cb95
mov dword [0x100ba374], 0x42dc0000
jmp 0x1002cbb5
cmp eax, 3
jne 0x1002cba6
mov dword [0x100ba374], 0x42f00000
jmp 0x1002cbb5
cmp eax, 4
jne 0x1002cbb5
mov dword [0x100ba374], 0x42fa0000
mov ecx, dword [0x100bea90]
mov eax, dword [0x100ba604]
add eax, 0x178
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x1002cc1f
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0xcc
jmp 0x1002cc13
mov ecx, dword [0x100bea90]
mov eax, dword [0x100ba604]
add eax, 0x178
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x1002cc1f
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0x55
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push edi
call esi
call fcn.10027170
call fcn.10024970
call fcn.10027260
call fcn.10026c40
call fcn.10026d20
call fcn.10026930
call fcn.100269d0
call fcn.10029ad0
call fcn.100297e0
mov ecx, ebx
call fcn.10029b60
call fcn.1002c440
call fcn.100277a0
call fcn.10029610
call fcn.10029110
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1007f759
mov esp, ebp
pop ebp
ret