Function at 0x1000f290
Capabilities:
Allocate or change rwx memory
Encrypt data using rc4 prga
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10139040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0x14], edi
mov ebx, 0x402bc0
mov edi, 0x96a4c0
push esi
call ebx
mov ecx, eax
call edi
test eax, eax
je 0x1000f2c7
mov byte [eax + 0x314], 0
inc esi
cmp esi, 0xa
jl 0x1000f2b5
mov eax, 0x63cb40
call eax
mov edi, dword [ebp - 0x14]
movzx eax, byte [edi + 5]
push eax
mov eax, 0x4d5130
call eax
add esp, 4
cmp dword [0xe609e8], 4
jne 0x1000f2f9
mov dword [0xe61e18], 0x49
xor ebx, ebx
cmp byte [edi + 7], bl
jbe 0x1000f4b6
lea esi, [edi + 0x16]
mov ecx, 0x587380
mov edi, 0x586da0
movzx eax, byte [esi - 0xc]
cmp eax, 4
ja case.default.0x1000f31e
jmp dword [eax*4 + 0x1000f550]
movss xmm0, dword [0x1012e4d8]
movss dword [ebp - 8], xmm0
movss xmm0, dword [0x1012e4e8]
movss dword [ebp - 0x10], xmm0
movss xmm0, dword [0x1012e3fc]
jmp 0x1000f3e9
movss xmm0, dword [0x1012e4d4]
movss dword [ebp - 8], xmm0
movss xmm0, dword [0x1012e4ec]
movss dword [ebp - 0x10], xmm0
movss xmm0, dword [0x1012e3e0]
jmp 0x1000f3e9
movss xmm0, dword [0x1012e4dc]
movss dword [ebp - 8], xmm0
movss xmm0, dword [0x1012e4f0]
movss dword [ebp - 0x10], xmm0
movss xmm0, dword [0x1012e3d4]
jmp 0x1000f3e9
movss xmm0, dword [0x1012e4e0]
movss dword [ebp - 8], xmm0
movss xmm0, dword [0x1012e4f4]
movss dword [ebp - 0x10], xmm0
movss xmm0, dword [0x1012e3cc]
jmp 0x1000f3e9
movss xmm0, dword [0x1012e4e4]
movss dword [ebp - 8], xmm0
movss xmm0, dword [0x1012e4f8]
movss dword [ebp - 0x10], xmm0
movss xmm0, dword [0x1012e3b8]
jmp 0x1000f3e9
xorps xmm0, xmm0
movss dword [ebp - 8], xmm0
movss dword [ebp - 0x10], xmm0
movzx eax, byte [esi + 3]
push eax
movss dword [ebp - 0xc], xmm0
call ecx
movss xmm0, dword [ebp - 0xc]
movzx ecx, byte [esi - 0xc]
movss dword [esp], xmm0
sub esp, 8
movss xmm0, dword [ebp - 0x10]
movss dword [esp + 4], xmm0
movss xmm0, dword [ebp - 8]
movss dword [esp], xmm0
push 0
push eax
push ecx
call edi
mov edi, eax
add esp, 0x18
test edi, edi
je 0x1000f499
cmp byte [0x10149d04], 0
je 0x1000f44f
movzx ecx, byte [esi - 0xc]
push ecx
push 0x1012b404
push str.SetCharacterPosition
push 0x1013a448
call fcn.10041730
add esp, 0x10
mov ax, word [esi]
mov word [edi + 0x82], ax
movzx eax, byte [esi + 2]
mov byte [edi + 0x15], al
movups xmm0, xmmword [esi - 0xb]
push 0
push 0
movups xmmword [edi + 0x38], xmm0
movq xmm0, qword [esi + 5]
movq qword [edi + 0x48], xmm0
movzx eax, byte [esi + 0xd]
mov byte [edi + 0x50], al
mov byte [edi + 0x42], 0
movzx eax, byte [esi + 0x15]
mov byte [edi + 0x18], al
lea eax, [esi + 4]
push eax
movzx eax, byte [esi - 0xc]
push eax
call fcn.1005fab0
add esp, 0x10
mov edi, dword [ebp - 0x14]
inc ebx
add esi, 0x22
mov ecx, 0x587380
movzx eax, byte [edi + 7]
mov edi, 0x586da0
cmp ebx, eax
jl 0x1000f311
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x87935a4
call edi
lea eax, [ebp - 8]
mov dword [0x87935a4], 0x33
push eax
push dword [ebp - 8]
push 4
push 0x87935a4
call edi
mov eax, dword [ebp - 0x14]
mov bl, byte [eax + 8]
mov eax, 0x861110
call eax
mov edx, 0x861a80
mov ecx, eax
call edx
push ebx
mov edx, 0x856bd0
mov ecx, eax
call edx
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov esi, eax
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0xe8cb30
call edi
lea eax, [ebp - 8]
mov dword [0xe8cb30], esi
push eax
push dword [ebp - 8]
push 4
push 0xe8cb30
call edi
mov ecx, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
movzx eax, byte [ecx + 9]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov dword [0x1013a474], eax
call fcn.100890df
mov esp, ebp
pop ebp
ret