Function at 0x100011a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x10
push ebx
push esi
push edi
sub eax, 0
je 0x10001397
sub eax, 1
jne 0x1000145f
xor ebx, ebx
mov ecx, 1
mov edi, 0x1001753c
lock cmpxchg dword [edi], ecx
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
test eax, eax
je 0x100011f5
cmp ebx, 0x20
jae 0x100011e1
push 0
jmp 0x100011e3
push 1
call esi
inc ebx
mov ecx, 1
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0x100011d8
cmp dword [0x10017540], 0
jne 0x10001388
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov ecx, eax
xor eax, eax
mov dword [0x10017540], ecx
xchg dword [edi], eax
test ecx, ecx
je 0x1000138c
push ecx
mov ecx, dword [sym.imp.KERNEL32.dll_GetVersion]
call fcn.10001a54
test eax, eax
jne 0x1000138c
xor ebx, ebx
mov ecx, 1
lock cmpxchg dword [edi], ecx
test eax, eax
je 0x10001262
cmp ebx, 0x20
jae 0x1000124e
push 0
jmp 0x10001250
push 1
call esi
inc ebx
mov ecx, 1
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0x10001245
cmp dword [0x10017540], 0
je 0x10001388
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersion]
test ebx, ebx
jne 0x10001285
lea ecx, [ebx + 1]
call fcn.10001979
mov esi, eax
jmp 0x100012b1
mov ecx, dword [0x10017568]
xor edx, edx
test ecx, ecx
je 0x100012ac
mov esi, dword [0x10017560]
mov eax, esi
nop dword [eax]
cmp ebx, dword [eax]
je 0x100012c8
inc edx
add eax, 0x2c
cmp edx, ecx
jb 0x100012a0
mov esi, 4
xor eax, eax
xchg dword [edi], eax
test esi, esi
je 0x1000145f
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp edx, 0xffffffff
je 0x100012ac
imul ebx, edx, 0x2c
test byte [ebx + esi + 0x14], 2
jne 0x1000137e
push 1
lea ecx, [ebp - 0x10]
call fcn.10001791
mov esi, eax
add esp, 4
test esi, esi
jne 0x100012b1
add ebx, dword [0x10017560]
mov eax, dword [ebx]
mov cl, byte [ebx + 0x14]
and cl, 1
lea esi, [eax - 5]
cmove esi, eax
movzx eax, cl
lea ecx, [ebp + 0xc]
push ecx
push 0x40
lea eax, [eax*2 + 5]
push eax
push esi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1000132e
lea ecx, [ebp - 0x10]
lea esi, [eax + 0xa]
call fcn.10001841
jmp 0x100012b1
mov byte [esi], 0xe9
mov eax, dword [ebx + 4]
sub eax, esi
sub eax, 5
mov dword [esi + 1], eax
test byte [ebx + 0x14], 1
je 0x10001349
mov eax, dword [ebx]
mov word [eax], 0xf9eb
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 0xc]
push dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
or byte [ebx + 0x14], 6
lea ecx, [ebp - 0x10]
xor esi, esi
call fcn.10001841
jmp 0x100012b1
mov esi, 5
jmp 0x100012b1
xor eax, eax
xchg dword [edi], eax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc
xor esi, esi
mov ecx, 1
mov edi, 0x1001753c
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
je 0x100013d0
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, 0x20
jae 0x100013bc
push 0
jmp 0x100013be
push 1
call ebx
inc esi
mov ecx, 1
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0x100013b3
cmp dword [0x10017540], 0
je 0x1000145b
xor ecx, ecx
call fcn.10001979
test eax, eax
jne 0x1000145b
mov eax, dword [0x10017558]
mov dword [0x10017558], 0
test eax, eax
je 0x10001413
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualFree]
mov esi, dword [eax]
push 0x8000
push 0
push eax
call ebx
mov eax, esi
test esi, esi
jne 0x10001401
push dword [0x10017560]
push 0
push dword [0x10017540]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [0x10017540]
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
mov dword [0x10017540], 0
mov dword [0x10017560], 0
mov dword [0x10017564], 0
mov dword [0x10017568], 0
xor ecx, ecx
xchg dword [edi], ecx
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc