Function at 0x100f1330
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x178
mov eax, dword [0x10273240]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10266e0a], 0
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, ecx
mov dword [ebp - 0x170], edi
je 0x100f16e1
mov eax, dword [0x102782dc]
cmp byte [eax + 0x18], 0
jne 0x100f16e1
cmp dword [ebx + 0x20], 0
jne 0x100f16e1
cmp dword [0x101ac07c], 0
je 0x100f16e1
mov ecx, dword [0x10274040]
push esi
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
call eax
mov esi, dword [ebx + 8]
inc esi
mov dword [ebp - 0x16c], esi
cmp eax, esi
je 0x100f16e0
cmp dword [ebx + 0x28], 0
jne 0x100f13b9
cmp dword [ebx + 0x24], 0
jne 0x100f13b9
cmp dword [ebx + 0x2c], 0
je 0x100f16e0
test esi, esi
js 0x100f16e0
cmp esi, 0x3f
jg 0x100f16e0
push 0x80
xorps xmm0, xmm0
lea eax, [ebp - 0x14c]
push 0
push eax
movlpd qword [ebp - 0x15c], xmm0
movq qword [ebp - 0x154], xmm0
call sub.VCRUNTIME140.dll_memset
push 0x80
xorps xmm0, xmm0
mov dword [ebp - 0xcc], 0
lea eax, [ebp - 0xa0]
mov dword [ebp - 0xb8], 0
push 0
push eax
movups xmmword [ebp - 0xc8], xmm0
mov dword [ebp - 0xa4], 0
movups xmmword [ebp - 0xb4], xmm0
call sub.VCRUNTIME140.dll_memset
mov ecx, dword [0x10274040]
lea edx, [ebp - 0x15c]
add esp, 0x18
mov word [ebp - 0x20], 0
xorps xmm0, xmm0
mov byte [ebp - 0xc], 0
movups xmmword [ebp - 0x1c], xmm0
mov eax, dword [ecx]
push edx
push esi
mov eax, dword [eax + 0x20]
call eax
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x164], eax
cmp dword [edi + esi*8 + 4], eax
je 0x100f16e0
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x174], eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x178], eax
mov eax, dword [0x1027ea90]
test eax, eax
jne 0x100f14be
push 0x40
push 0x1000
push 0x1d8
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, 0x76
mov dword [0x1027ea90], eax
mov esi, 0x102726a8
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x16c]
mov edi, dword [ebp - 0x170]
mov edx, dword [ebp - 0x164]
mov ecx, ebx
call eax
cmp dword [ebx + 0x14], 0
mov byte [ebp - 0x165], al
je 0x100f14f1
cmp byte [ebx + 0x18], 0x38
jne 0x100f14f1
mov ecx, dword [ebx + 0x2c]
add ecx, dword [ebx + 0x24]
add ecx, dword [ebx + 0x28]
shl ecx, 4
mov byte [ebp - 0x15d], 1
test ecx, ecx
jne 0x100f14f8
mov byte [ebp - 0x15d], 0
movzx eax, word [ebx + 0x10]
mov edx, 0x7ffa
mov ecx, eax
cmp cx, dx
je 0x100f1516
mov edx, 0x7ffb
cmp cx, dx
je 0x100f1516
xor dh, dh
jmp 0x100f1518
mov dh, 1
mov dword [ebp - 0x164], 0x7ffc
cmp cx, word [ebp - 0x164]
je 0x100f1542
mov dword [ebp - 0x164], 0x7ffd
cmp cx, word [ebp - 0x164]
je 0x100f1542
xor dl, dl
jmp 0x100f1544
mov dl, 1
mov dword [ebp - 0x164], 0x695b
cmp cx, word [ebp - 0x164]
je 0x100f156e
mov dword [ebp - 0x164], 0x1b39
cmp cx, word [ebp - 0x164]
je 0x100f156e
xor cl, cl
jmp 0x100f1570
mov cl, 1
cmp byte [ebp - 0x165], 0
je 0x100f1593
mov dword [edi + esi*8], 1
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10106b52
mov esp, ebp
pop ebp
ret 4
test dh, dh
je 0x100f15b1
mov dword [edi + esi*8], 2
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10106b52
mov esp, ebp
pop ebp
ret 4
test dl, dl
je 0x100f15cf
mov dword [edi + esi*8], 3
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10106b52
mov esp, ebp
pop ebp
ret 4
mov edx, 0x57fa
cmp ax, dx
jne 0x100f15f3
mov dword [edi + esi*8], 4
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10106b52
mov esp, ebp
pop ebp
ret 4
test cl, cl
je 0x100f1611
mov dword [edi + esi*8], 5
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10106b52
mov esp, ebp
pop ebp
ret 4
mov ecx, 0xbeef
cmp ax, cx
jne 0x100f1635
mov dword [edi + esi*8], 6
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10106b52
mov esp, ebp
pop ebp
ret 4
cmp byte [ebp - 0x15d], 0
je 0x100f1658
mov dword [edi + esi*8], 0xa
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10106b52
mov esp, ebp
pop ebp
ret 4
cmp dword [ebx + 0x10], 0x10c600
jne 0x100f167b
mov dword [edi + esi*8], 0xb
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10106b52
mov esp, ebp
pop ebp
ret 4
xor esi, esi
mov eax, 0xfe938395
lea edi, [esi + 0x20]
mov ecx, esi
mov edx, 1
shl edx, cl
mov ecx, edx
and edx, 0x203e4064
and ecx, eax
cmp ecx, edx
jne 0x100f16a1
btr eax, esi
jmp 0x100f16a4
bts eax, esi
inc esi
sub edi, 1
jne 0x100f1685
mov edx, dword [ebp - 0x174]
mov ecx, edx
xor ecx, eax
test ecx, 0xffff00ff
jne 0x100f16e0
cmp byte [ebp - 0x178], 0x40
ja 0x100f16e0
shr edx, 8
cmp dl, 0xc3
jne 0x100f16e0
mov eax, dword [ebp - 0x16c]
mov ecx, dword [ebp - 0x170]
mov dword [ecx + eax*8], 8
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.10106b52
mov esp, ebp
pop ebp
ret 4