Function at 0x10002f70
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1005200c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov bl, byte [0x100cbe69]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
cmp bl, byte [0x100cbe65]
je 0x10003007
mov eax, 0x1004e8ac
mov dword [0x100cbe74], 0x1004e8a0
test bl, bl
mov edx, 0x1004e8b8
push str.xxxxxxxxxx
cmove edx, eax
mov dword [0x100cbe7c], edx
call fcn.10002e50
mov edi, eax
add esp, 4
mov dword [0x100cbe78], edi
test edi, edi
je 0x10003007
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push edi
call esi
test bl, bl
mov word [edi], 0xb70f
mov ecx, 0x29
mov byte [edi + 2], 0x8e
mov eax, 0x30
cmovne eax, ecx
mov byte [edi + 3], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 4
push edi
call esi
mov byte [0x100cbe65], bl
mov bl, byte [0x100cbe6a]
cmp bl, byte [0x100cbe66]
je 0x1000308c
mov eax, 0x1004e8d0
mov dword [0x100cbe74], 0x1004e8dc
test bl, bl
mov edx, 0x1004e8c4
push str.xxxxxxxx
cmove edx, eax
mov dword [0x100cbe7c], edx
call fcn.10002e50
mov edi, eax
add esp, 4
mov dword [0x100cbe78], edi
test edi, edi
je 0x1000308c
lea eax, [ebp - 8]
push eax
push 0x40
push 8
push edi
call esi
test bl, bl
mov dword [edi + 1], 0x244c8b23
mov ecx, 0xeb
mov word [edi + 5], 0x5134
mov eax, 0x74
mov byte [edi + 7], 0x8d
cmovne eax, ecx
mov byte [edi], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 8
push edi
call esi
mov byte [0x100cbe66], bl
mov bl, byte [0x100cbe5c]
cmp bl, byte [0x100cbe6b]
je 0x1000310a
mov eax, 0x1004e8f0
mov dword [0x100cbe74], 0x1004e8e8
test bl, bl
mov edx, 0x1004e8f8
push str.xxxxxxx
cmove edx, eax
mov dword [0x100cbe7c], edx
call fcn.10002e50
mov edi, eax
add esp, 4
mov dword [0x100cbe78], edi
test edi, edi
je 0x1000310a
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push edi
call esi
test bl, bl
mov word [edi + 1], 0x8b09
mov ecx, 0xeb
mov byte [edi + 3], 0x4e
mov eax, 0x75
cmovne eax, ecx
mov byte [edi], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 4
push edi
call esi
mov byte [0x100cbe6b], bl
mov bl, byte [0x100cbe68]
cmp bl, byte [0x100cbe64]
je 0x10003178
push str.xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
mov edx, 0x1004e928
mov dword [0x100cbe7c], 0x1004e928
mov dword [0x100cbe74], 0x1004e900
call fcn.10002e50
mov edi, eax
add esp, 4
mov dword [0x100cbe78], edi
test edi, edi
je 0x10003178
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push edi
call esi
test bl, bl
mov word [edi + 1], 0
mov byte [edi + 3], 0
setne al
mov byte [edi], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 4
push edi
call esi
mov byte [0x100cbe64], bl
mov bl, byte [0x100cbe5f]
cmp bl, byte [0x100cbe67]
je 0x100031ee
mov eax, 0x1004e958
mov dword [0x100cbe74], 0x1004e960
test bl, bl
mov edx, 0x1004e950
push str.xxxx
cmove edx, eax
mov dword [0x100cbe7c], edx
call fcn.10002e50
mov edi, eax
add esp, 4
mov dword [0x100cbe78], edi
test edi, edi
je 0x100031ee
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push edi
call esi
test bl, bl
mov word [edi + 1], 0x8352
mov byte [edi + 3], 0xce
sete al
inc al
mov byte [edi], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 4
push edi
call esi
mov byte [0x100cbe67], bl
mov bl, byte [0x100cbe5d]
cmp bl, byte [0x100cbe5e]
je 0x1000326c
mov eax, 0x1004e968
mov dword [0x100cbe74], 0x1004e8e8
test bl, bl
mov edx, 0x1004e970
push str.xxxxxxx
cmove edx, eax
mov dword [0x100cbe7c], edx
call fcn.10002e50
mov edi, eax
add esp, 4
mov dword [0x100cbe78], edi
test edi, edi
je 0x1000326c
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push edi
call esi
test bl, bl
mov word [edi + 1], 0x6a17
mov ecx, 0xeb
mov byte [edi + 3], 0
mov eax, 0x7a
cmovne eax, ecx
mov byte [edi], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 4
push edi
call esi
mov byte [0x100cbe5e], bl
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10047d31
mov esp, ebp
pop ebp
ret