Function at 0x1000e2a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x1001ff00]
sub esp, 0x10
test eax, eax
je 0x1000e477
push esi
mov esi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push edi
push 0x1001fb60
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
push 1
mov dword [ebp - 8], eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test ebx, ebx
je 0x1000e459
cmp dword [ebp + 8], 0
je 0x1000e459
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x1000e459
push 4
push eax
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
test eax, eax
jne 0x1000e459
push 0x1001fb78
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x20
push 8
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x1000e406
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 8], ebx
mov cl, byte [ebx]
mov edx, ebx
mov byte [esi + 0xc], cl
call fcn.1000e5c0
mov dword [esi + 0x14], eax
test eax, eax
je 0x1000e406
push 0x30
push 8
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x1000e381
push 0x30
push 0
push edi
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [esi + 0x10], edi
test edi, edi
je 0x1000e406
mov edx, dword [0x1001f5f8]
mov dword [edi], edx
mov eax, dword [0x1001f5fc]
mov dword [edi + 4], eax
mov ecx, dword [0x1001f600]
mov dword [edi + 8], ecx
mov edx, dword [0x1001f604]
mov dword [edi + 0xc], edx
mov eax, dword [0x1001f608]
mov dword [edi + 0x10], eax
mov cx, word [0x1001f60c]
mov word [edi + 0x14], cx
mov edx, dword [esi + 0x14]
mov eax, dword [esi + 0x10]
push edx
push ebx
push eax
call sub.MSVCRT.dll_memcpy
mov ecx, dword [esi + 0x14]
mov edx, dword [esi + 0x10]
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
add ecx, ebx
push 0x40
mov dword [edx + 0x11], ecx
mov ecx, dword [esi + 0x10]
push 1
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1000e406
mov eax, dword [0x1001fb90]
mov dword [esi], eax
mov dword [esi + 4], 0x1001fb90
mov dword [eax + 4], esi
mov dword [0x1001fb90], esi
push 0x1001fb78
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test esi, esi
je 0x1000e459
mov edx, dword [esi + 0x10]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [eax], edx
lea edx, [ebp - 4]
push edx
push 0x40
push 1
mov dword [esi + 0x18], ecx
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebx
call esi
test eax, eax
je 0x1000e459
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x10]
push eax
push ecx
push 1
push ebx
mov byte [ebx], 0xfa
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 0x1001fb60
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
xor eax, eax
mov esp, ebp
pop ebp
ret 8