Function at 0x1000b9c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x100a9114]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor edx, edx
mov ecx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
movzx ebx, al
mov dword [ebp - 0x14], edx
push edi
mov edi, esi
test al, al
jne 0x1000b9fd
xor al, al
jmp 0x1000ba1e
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], ebx
push eax
push 0x40
push ebx
push esi
mov dword [ebp - 0x14], esi
call ecx
mov esi, dword [ebp + 0xc]
test eax, eax
mov edx, dword [ebp - 0x14]
mov ecx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
setne al
mov byte [ebp - 8], al
mov ah, byte [edi]
mov byte [ebp - 0x21], ah
test al, al
je 0x1000ba41
mov eax, dword [ebp - 0xc]
lea esi, [ebp - 0x20]
push esi
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
push edx
call ecx
mov esi, dword [ebp + 0xc]
mov ah, byte [ebp - 0x21]
movzx eax, ah
sub eax, 0xe8
je 0x1000bae5
sub eax, 1
je 0x1000bae5
sub eax, 0x16
jne 0x1000ba79
push dword [ebp + 0x14]
inc edi
push ecx
mov eax, esp
mov dword [eax], edi
call fcn.100016d0
add esp, 8
cmp al, 0x15
je 0x1000ba88
cmp al, 0x25
je 0x1000ba88
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x28]
mov edi, dword [ebp - 0x1c]
inc edi
mov dword [ecx], 0
jmp 0x1000baff
mov esi, dword [ebp - 0x18]
lea eax, [ebx*4]
xor ecx, ecx
add esi, 2
mov dword [ebp - 0x14], ecx
test eax, eax
jne 0x1000baa2
xor al, al
jmp 0x1000babe
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x10], eax
push ecx
push 0x40
push eax
push esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 0x14]
test eax, eax
setne al
mov byte [ebp - 8], al
mov esi, dword [esi]
test al, al
je 0x1000badc
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 0x18]
push edx
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 0x28]
mov eax, dword [esi]
mov dword [ecx], eax
jmp 0x1000bafc
push dword [ebp + 0x14]
inc edi
push 4
push ecx
mov ecx, dword [ebp - 0x28]
mov eax, esp
push ecx
mov dword [eax], edi
call fcn.1000bd50
add esp, 0x10
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x14], 0
test ebx, ebx
jne 0x1000bb12
mov byte [ebp - 8], bl
mov byte [esi], 0xe8
jmp 0x1000bb4a
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], ebx
push eax
push 0x40
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push esi
mov dword [ebp - 0x14], esi
call ebx
test eax, eax
setne al
mov byte [ebp - 8], al
mov byte [esi], 0xe8
test al, al
je 0x1000bb4a
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 0x1c]
push ecx
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x14]
call ebx
push dword [ebp + 0x14]
push 4
push ecx
mov ecx, dword [ebp + 0x10]
mov edx, esp
push ecx
mov dword [edx], ecx
mov ecx, esp
mov dword [ecx], edi
call fcn.1000bb80
mov ecx, dword [ebp - 4]
add esp, 0x10
mov eax, dword [ebp - 0x28]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.10040e3d
mov esp, ebp
pop ebp
ret