Function at 0x10020950
Capabilities:
Allocate or change rwx memory
Check if file exists
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x124
mov eax, dword [0x100e8018]
xor eax, esp
mov dword [esp + 0x120], eax
push ebx
push esi
push edi
push 0xf4
xor edi, edi
lea eax, [esp + 0x30]
push edi
push eax
mov esi, ecx
call fcn.100346a0
add esp, 0xc
mov dword [esp + 0x124], edi
push 0x20000
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0x100000
mov ecx, eax
call fcn.1002f150
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x100209d6
push str.FindFirstFreeMemZone_could_not_find_any_memory_zone_n
push dword [0x100ee8a4]
call fcn.1000f610
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x120]
xor ecx, esp
call fcn.100313c7
mov esp, ebp
pop ebp
ret
push esi
lea eax, [ebx + 0xff00]
push 0x3000
mov dword [esp + 0x18], eax
lea eax, [ebx + 0x10000]
push 0x1000
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x10020a2f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.VirtualAlloc_call_failed__Error_code__d_n
push dword [0x100ee8a4]
call fcn.1000f610
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x120]
xor ecx, esp
call fcn.100313c7
mov esp, ebp
pop ebp
ret
lea eax, [ebx + 0x10000]
cmp esi, eax
je 0x10020a73
push eax
push esi
push str.Memory_allocated__p__is_not_at_the_requested_address__p__n
push dword [0x100ee8a4]
call fcn.1000f610
add esp, 0x10
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x120]
xor ecx, esp
call fcn.100313c7
mov esp, ebp
pop ebp
ret
push 4
push 0x3000
push 0x10000
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebx, eax
test ebx, ebx
jne 0x10020aa8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.VirtualAlloc_call_failed__Error_code__d_n
push dword [0x100ee8a4]
call fcn.1000f610
add esp, 0xc
jmp 0x10020a4e
mov eax, dword [sym.imp.KERNEL32.dll_WinExec]
movups xmm0, xmmword [0x100d9d30]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x14]
push eax
push 0x40
push 0x100
push dword [esp + 0x1c]
mov dword [esp + 0x130], edi
movups xmmword [esp + 0x2c], xmm0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10020af3
push str.run_shellcode_VirtualProtectEx___failed__n
push dword [0x100ee8a4]
call fcn.1000f610
add esp, 8
jmp 0x10020b6b
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x100
push dword [esp + 0x14]
lea edx, [esp + 0x20]
mov ecx, 0x10027a10
push 0
push 0
push pe_nt_image_headers32
call fcn.1002d300
add esp, 0x14
test al, al
jne 0x10020b39
push str.RunShellcode_failed_for_shellcode_winexec_n
push dword [0x100ee8a4]
call fcn.1000f610
add esp, 8
xor edi, edi
jmp 0x10020b6b
cmp dword [esp + 0x120], 0x1f
ja 0x10020b66
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x10020b66
push eax
push str.WinExec_call_failed__Error_code__d_n
push dword [0x100ee8a4]
call fcn.1000f610
add esp, 0xc
xor edi, edi
jmp 0x10020b6b
mov edi, 1
push 0x8000
push 0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualFree]
call esi
push 0x8000
push 0
push ebx
call esi
mov ecx, dword [esp + 0x12c]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100313c7
mov esp, ebp
pop ebp
ret