Function at 0x1000c760
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov eax, dword [0x10016018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10017f00]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
jne 0x1000c7a1
push str.Audioses.dll
call edi
push 0x1e
mov dword [0x10017f00], eax
call ebx
mov eax, dword [0x10017f00]
test eax, eax
je 0x1000c788
cmp dword [0x1001996c], 0
jne 0x1000ca11
test eax, eax
je 0x1000ca11
mov esi, dword [sym.imp.MSVCR100.dll_void____cdecl_operator_new_unsigned_int_]
push 0x294
call esi
add esp, 4
push 0x294
push 0
push eax
mov dword [0x1001aeb0], eax
call sub.MSVCR100.dll_memset
add esp, 0xc
push 4
call esi
add esp, 4
test eax, eax
je 0x1000c7f3
mov dword [eax], vtable.mSearch.0
mov dword [0x1001aeb8], eax
jmp 0x1000c7fd
mov dword [0x1001aeb8], 0
push 0x96
call esi
add esp, 4
test eax, eax
je 0x1000c814
mov esi, eax
call fcn.10002050
jmp 0x1000c816
xor eax, eax
mov dword [0x1001aec0], eax
call fcn.10002120
call fcn.1000c540
push str.PointBlank.exe
call edi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualQuery]
add eax, 0x1000
mov dword [0x1001ae8c], eax
lea esp, [esp]
push str.PointBlank.exe
call edi
add eax, 0x1000
push 0x32
mov dword [0x1001ae8c], eax
call ebx
mov eax, dword [0x1001ae8c]
push 0x1c
push 0x10019988
push eax
call esi
test eax, eax
je 0x1000c840
mov eax, dword [0x10019994]
cmp eax, 0x100
jbe 0x1000ca11
push 0x40
push 0x1000
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [0x10019994]
mov edx, dword [0x10019988]
push ecx
mov esi, eax
push edx
push esi
call sub.MSVCR100.dll_memcpy
mov eax, dword [0x1001a88c]
add esp, 0xc
test eax, eax
jne 0x1000c8e3
lea ebx, [ebx]
cmp dword [0x10019170], 0
jne 0x1000c8db
mov eax, esi
sub eax, dword [0x10019988]
push 0x1e
mov dword [0x1001a88c], eax
mov dword [0x10019170], esi
call ebx
mov eax, dword [0x1001a88c]
test eax, eax
je 0x1000c8b0
jmp 0x1000c8e3
test eax, eax
je 0x1000ca11
cmp dword [0x10019170], 0
je 0x1000ca11
call fcn.100035f0
mov eax, dword [0x1001ae8c]
mov ecx, dword [0x10019994]
mov edx, dword [0x1001aeb0]
add ecx, eax
mov dword [0x10019168], eax
mov eax, dword [edx + 0x18]
cmp dword [eax], 0xffffffff
mov dword [0x100199a8], ecx
jne 0x1000c935
jmp 0x1000c920
push 0x1f4
call ebx
mov ecx, dword [0x1001aeb0]
mov edx, dword [ecx + 0x18]
cmp dword [edx], 0xffffffff
je 0x1000c920
call fcn.1000c6b0
call fcn.100051f0
mov esi, dword [0x1001b248]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x74]
push eax
push 0x40
push 5
push esi
call edi
mov eax, dword [ebp - 0x74]
lea edx, [ebp - 0x78]
push edx
push eax
mov ecx, 0x10005170
sub ecx, esi
push 5
sub ecx, 5
push esi
mov byte [esi], 0xe9
mov dword [esi + 1], ecx
call edi
mov esi, dword [0x1001b2a0]
lea ecx, [ebp - 0x74]
push ecx
push 0x40
push 5
push esi
call edi
mov ecx, dword [ebp - 0x74]
lea eax, [ebp - 0x78]
push eax
push ecx
mov edx, 0x100051b0
sub edx, esi
push 5
sub edx, 5
push esi
mov byte [esi], 0xe9
mov dword [esi + 1], edx
call edi
push 0x63
lea edx, [ebp - 0x6f]
push 0
push edx
mov byte [ebp - 0x70], 0
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
jmp 0x1000c9c0
mov cl, byte [eax + 0x10013c54]
not cl
xor cl, 0xd3
mov byte [ebp + eax - 0x70], cl
inc eax
cmp eax, 0x17
jl 0x1000c9c0
lea edx, [ebp - 0x70]
push edx
call fcn.1000cdb0
add esp, 4
test al, al
je 0x1000ca32
call fcn.1000b3d0
mov eax, dword [0x1001aeb0]
mov ecx, dword [eax + 0x18]
cmp dword [ecx], 7
jne 0x1000ca0c
push 0x1f4
call ebx
mov edx, dword [0x1001aeb0]
mov eax, dword [edx + 0x18]
cmp dword [eax], 7
je 0x1000c9f7
call fcn.1000b880
cmp dword [0x1001aeb4], 0
jne 0x1000ca21
push 0x7d0
call ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000eefe
mov esp, ebp
pop ebp
ret
push 0
call dword [sym.imp.MSVCR100.dll_exit]
int3