Function at 0x10025160
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x1007700c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x1007ea08], 0
push ebx
mov ebx, ecx
jne 0x100253f1
push esi
push edi
call fcn.10024660
mov eax, dword [0x1007d9ac]
mov ecx, fcn.10007980
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esi, [eax + 0x40]
cmp esi, 0x1000
jbe 0x100251d1
cmp ecx, 0x1000
jbe 0x100251d1
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x2c]
mov dword [esi], fcn.10007980
push eax
push dword [ebp - 8]
push 4
push esi
call edi
mov eax, dword [0x1007d9ac]
mov ecx, fcn.10007980
lea esi, [eax + 0x44]
cmp esi, 0x1000
jbe 0x10025206
cmp ecx, 0x1000
jbe 0x10025206
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x30]
mov dword [esi], fcn.10007980
push eax
push dword [ebp - 0xc]
push 4
push esi
call edi
mov eax, dword [0x1007d9ac]
lea esi, [eax + 0x48]
mov ecx, fcn.10007980
cmp esi, 0x1000
jbe 0x10025245
cmp ecx, 0x1000
jbe 0x10025245
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x34]
mov dword [esi], fcn.10007980
push eax
push dword [ebp - 0x10]
push 4
push esi
call edi
mov eax, dword [0x1007d9ac]
mov ecx, fcn.10007980
lea esi, [eax + 0x4c]
cmp esi, 0x1000
jbe 0x1002527a
cmp ecx, 0x1000
jbe 0x1002527a
lea eax, [ebp - 0x14]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x38]
mov dword [esi], fcn.10007980
push eax
push dword [ebp - 0x14]
push 4
push esi
call edi
mov eax, dword [0x1007d9ac]
lea esi, [eax + 0x50]
mov ecx, fcn.10007980
cmp esi, 0x1000
jbe 0x100252b9
cmp ecx, 0x1000
jbe 0x100252b9
lea eax, [ebp - 0x18]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x3c]
mov dword [esi], fcn.10007980
push eax
push dword [ebp - 0x18]
push 4
push esi
call edi
mov eax, dword [0x1007d9ac]
mov ecx, fcn.10007980
lea esi, [eax + 0x54]
cmp esi, 0x1000
jbe 0x100252ee
cmp ecx, 0x1000
jbe 0x100252ee
lea eax, [ebp - 0x1c]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x40]
mov dword [esi], fcn.10007980
push eax
push dword [ebp - 0x1c]
push 4
push esi
call edi
mov eax, dword [0x1007d9ac]
lea esi, [eax + 0x58]
cmp esi, 0x1000
jbe 0x10025328
mov ecx, fcn.10007980
cmp ecx, 0x1000
jbe 0x10025328
lea eax, [ebp - 0x20]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x44]
mov dword [esi], fcn.10007980
push eax
push dword [ebp - 0x20]
push 4
push esi
call edi
mov eax, dword [0x1007d9ac]
cmp dword [0x100793b4], 0
jne 0x10025376
lea esi, [eax + 0x38]
cmp esi, 0x1000
jbe 0x1002536f
mov eax, 0x100244f0
cmp eax, 0x1000
jbe 0x1002536f
mov eax, dword [esi]
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x24]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x28]
mov dword [esi], 0x100244f0
push eax
push dword [ebp - 0x24]
push 4
push esi
call edi
mov eax, dword [ebp - 0x48]
jmp 0x10025371
xor eax, eax
mov dword [0x100793b4], eax
cmp dword [0x1007d7cc], 0
jne 0x100253e5
mov ecx, dword [0x1007d3d8]
mov eax, dword [0x10079760]
add eax, 0x2f8
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov dword [ebp - 0x48], eax
cmp eax, 0x1000
jbe 0x100253de
push 0xc
call fcn.10052afe
add esp, 4
mov esi, eax
lea eax, [ebp - 0x28]
push eax
push 0x40
push 0xc
push esi
call edi
mov edx, dword [ebp - 0x48]
mov ecx, dword [edx]
mov dword [esi], ecx
mov ax, word [edx + 4]
mov word [esi + 4], ax
mov al, byte [edx + 6]
mov byte [esi + 6], al
lea eax, [esi + 7]
sub edx, eax
mov byte [eax], 0xe9
add edx, 2
mov dword [eax + 1], edx
add eax, 0xfffffff9
jmp 0x100253e0
xor eax, eax
mov dword [0x1007d7cc], eax
pop edi
mov dword [0x1007ea08], 1
pop esi
call fcn.1001d0a0
mov ecx, dword [0x1007d81c]
test ecx, ecx
jne 0x1002540c
mov dword [0x1007d138], 0x32
jmp 0x10025440
cmp ecx, 1
jne 0x1002541d
mov dword [0x1007d138], 6
jmp 0x10025440
cmp ecx, 2
jne 0x1002542e
mov dword [0x1007d138], 5
jmp 0x10025440
mov eax, dword [0x1007d138]
xor edx, edx
cmp ecx, 3
cmove eax, edx
mov dword [0x1007d138], eax
call fcn.1001ace0
call fcn.1001afb0
mov ecx, ebx
call fcn.1001b120
mov ecx, ebx
call fcn.1001cd50
call fcn.10022cd0
mov ecx, ebx
call fcn.1001e6e0
mov ecx, ebx
call fcn.1001ec60
call fcn.10021860
call fcn.10022270
call fcn.10021970
call fcn.10020030
call fcn.100221c0
call fcn.10020100
call fcn.10022b20
call fcn.10022c10
call fcn.100226f0
call fcn.100223e0
call fcn.10022e10
call fcn.10023550
call fcn.100231f0
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.100521c9
mov esp, ebp
pop ebp
ret