Function at 0x100029d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebx
push ebp
push esi
push edi
call fcn.10002220
mov esi, dword [esp + 0x14]
or edi, 0xffffffff
mov ebp, dword [esp + 0x18]
mov edx, dword [sym.imp.kernel32.dll_VirtualAlloc]
test byte [esi + 0x1b4], 1
je 0x10002aa7
cmp ebp, dword [0x10006048]
jb 0x10002aa7
mov ecx, dword [0x10006044]
lea ebx, [ebp + 0x1f]
add ebx, ecx
lea eax, [ecx - 1]
not eax
and ebx, eax
cmp ebx, ebp
jbe 0x10002aad
push 0x40
push 0x103000
push ebx
push 0
call edx
test eax, eax
mov edx, edi
cmovne edx, eax
cmp edx, edi
je 0x10002aa1
mov eax, edx
and eax, 7
je 0x10002a40
neg eax
and eax, 7
lea ebp, [eax + edx]
mov ecx, ebx
sub ecx, eax
mov dword [esp + 0x14], ebp
or eax, 1
mov dword [ebp], eax
lea eax, [ecx - 0x10]
or eax, 2
mov dword [ebp + 4], eax
mov eax, ebp
mov ebp, dword [esp + 0x18]
mov dword [eax + ecx - 0xc], 7
mov dword [eax + ecx - 8], 0
cmp edx, dword [esi + 0x10]
jae 0x10002a78
mov dword [esi + 0x10], edx
mov eax, dword [esi + 0x1ac]
add eax, ebx
mov dword [esi + 0x1ac], eax
cmp eax, dword [esi + 0x1b0]
jbe 0x10002a94
mov dword [esi + 0x1b0], eax
mov eax, dword [esp + 0x14]
add eax, 8
jne 0x10002c47
mov edx, dword [sym.imp.kernel32.dll_VirtualAlloc]
mov ecx, dword [0x10006044]
lea ebx, [ebp + 0x29]
lea eax, [ecx - 1]
add ebx, ecx
not eax
and ebx, eax
cmp ebx, ebp
jbe 0x10002c45
push 0x40
push 0x3000
push ebx
push 0
call edx
test eax, eax
cmovne edi, eax
cmp edi, 0xffffffff
je 0x10002c45
mov eax, dword [esi + 0x1ac]
add eax, ebx
mov dword [esi + 0x1ac], eax
cmp eax, dword [esi + 0x1b0]
jbe 0x10002af7
mov dword [esi + 0x1b0], eax
cmp dword [esi + 0x18], 0
lea ecx, [esi + 0x1bc]
jne 0x10002b8a
mov dword [esi + 0x10], edi
mov dword [ecx], edi
mov dword [esi + 0x1c0], ebx
mov ecx, dword [edi + ebx - 4]
mov dword [esi + 0x1c8], ecx
lea eax, [ecx + edi]
cmp dword [eax + ebx - 4], ecx
je 0x10002b2b
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
mov eax, dword [0x1000603c]
lea ecx, [esi + 0x24]
mov dword [edi + ebx - 4], 0
mov edx, 0x20
mov dword [esi + 0x20], eax
mov dword [ecx + 0xc], ecx
mov dword [ecx + 8], ecx
add ecx, 8
sub edx, 1
jne 0x10002b43
cmp esi, 0x10006058
jne 0x10002b6b
add ebx, 0xffffffd8
mov eax, edi
push ebx
push eax
push esi
call fcn.100022d0
add esp, 0xc
jmp 0x10002bd1
mov eax, dword [esi - 4]
add ebx, 0xffffffd8
and eax, 0xfffffffc
add eax, 0xfffffff8
add eax, esi
sub edi, eax
add ebx, edi
push ebx
push eax
push esi
call fcn.100022d0
add esp, 0xc
jmp 0x10002bd1
mov edx, ecx
test edx, edx
je 0x10002ba8
mov eax, dword [edx]
add eax, dword [edx + 4]
mov ebp, dword [esp + 0x18]
mov dword [esp + 0x14], eax
cmp edi, eax
je 0x10002bfa
mov edx, dword [edx + 8]
test edx, edx
jne 0x10002b90
cmp edi, dword [esi + 0x10]
jae 0x10002bb0
mov dword [esi + 0x10], edi
test ecx, ecx
je 0x10002bc4
lea eax, [edi + ebx]
mov edx, dword [ecx]
cmp edx, eax
je 0x10002c27
mov ecx, dword [ecx + 8]
test ecx, ecx
jne 0x10002bb7
push 1
push ebx
push edi
push esi
call fcn.10001570
add esp, 0x10
mov edx, dword [esi + 0xc]
cmp ebp, edx
jae 0x10002c45
mov ecx, dword [esi + 0x18]
sub edx, ebp
mov dword [esi + 0xc], edx
or edx, 1
pop edi
lea eax, [ecx + ebp]
or ebp, 3
mov dword [esi + 0x18], eax
mov dword [eax + 4], edx
lea eax, [ecx + 8]
pop esi
mov dword [ecx + 4], ebp
pop ebp
pop ebx
ret
mov eax, dword [edi + ebx - 4]
cmp eax, dword [edx + 0xc]
jne 0x10002ba8
mov eax, dword [esi + 0x18]
cmp eax, dword [edx]
jb 0x10002ba8
cmp eax, dword [esp + 0x14]
jae 0x10002ba8
add dword [edx + 4], ebx
mov eax, dword [esi + 0xc]
add eax, ebx
push eax
push dword [esi + 0x18]
push esi
call fcn.100022d0
add esp, 0xc
jmp 0x10002bd1
mov eax, dword [eax - 4]
cmp eax, dword [ecx + 0xc]
jne 0x10002bc4
add dword [ecx + 4], ebx
push ebp
push edx
push edi
push esi
mov dword [ecx], edi
call fcn.10002310
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
ret
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret