Function at 0x10013930
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x1002f0ac], 0
push esi
jne 0x10013b3d
push edi
call fcn.10013840
mov edi, dword [0x1003045c]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
add edi, 0x10
push edi
call esi
mov edx, dword [ebp - 4]
lea ecx, [ebp - 8]
push ecx
push edx
push 4
push edi
mov dword [edi], method.EncryptMemory.virtual_32
call esi
mov edi, dword [0x1003045c]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
add edi, 0x40
push edi
call esi
mov edx, dword [ebp - 4]
lea ecx, [ebp - 8]
push ecx
push edx
push 4
push edi
mov dword [edi], method.EncryptMemory.virtual_32
call esi
mov edi, dword [0x1003045c]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
add edi, 0x44
push edi
call esi
mov edx, dword [ebp - 4]
lea ecx, [ebp - 8]
push ecx
push edx
push 4
push edi
mov dword [edi], method.EncryptMemory.virtual_32
call esi
mov edi, dword [0x1003045c]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
add edi, 0x48
push edi
call esi
mov edx, dword [ebp - 4]
lea ecx, [ebp - 8]
push ecx
push edx
push 4
push edi
mov dword [edi], method.EncryptMemory.virtual_32
call esi
mov edi, dword [0x1003045c]
lea eax, [ebp - 4]
push eax
push 0x40
add edi, 0x4c
push 4
push edi
call esi
mov edx, dword [ebp - 4]
lea ecx, [ebp - 8]
push ecx
push edx
mov dword [edi], method.EncryptMemory.virtual_32
push 4
push edi
call esi
mov edi, dword [0x1003045c]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
add edi, 0x50
push edi
call esi
mov edx, dword [ebp - 4]
lea ecx, [ebp - 8]
push ecx
push edx
push 4
push edi
mov dword [edi], method.EncryptMemory.virtual_32
call esi
mov edi, dword [0x1003045c]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
add edi, 0x54
push edi
call esi
mov edx, dword [ebp - 4]
lea ecx, [ebp - 8]
push ecx
push edx
push 4
push edi
mov dword [edi], method.EncryptMemory.virtual_32
call esi
mov edi, dword [0x1003045c]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
add edi, 0x58
push edi
call esi
mov edx, dword [ebp - 4]
lea ecx, [ebp - 8]
push ecx
push edx
push 4
push edi
mov dword [edi], method.EncryptMemory.virtual_32
call esi
cmp dword [0x10030458], 0
jne 0x10013aef
mov ecx, dword [0x10030938]
mov edx, dword [0x10033bf0]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
push ebx
add edx, 0x2c8
push edx
call eax
push 0xc
mov ebx, eax
call fcn.1002140e
add esp, 4
lea ecx, [ebp - 0xc]
push ecx
push 0x40
mov edi, eax
push 0xc
push edi
call esi
mov edx, dword [ebx]
mov dword [edi], edx
mov ax, word [ebx + 4]
mov word [edi + 4], ax
mov cl, byte [ebx + 6]
mov byte [edi + 6], cl
add edi, 7
sub ebx, edi
add ebx, 2
mov dword [edi + 1], ebx
mov byte [edi], 0xe9
add edi, 0xfffffff9
mov dword [0x10030458], edi
pop ebx
mov ecx, dword [0x10030938]
mov eax, dword [0x10033bf0]
mov edx, dword [ecx]
mov edx, dword [edx + 4]
add eax, 0x2c8
push eax
call edx
mov edi, eax
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push edi
call esi
push 1
push 0x1002813c
push edi
call dword [sym.imp.MSVCR100.dll_memmove]
mov edx, dword [ebp - 4]
add esp, 0xc
lea ecx, [ebp - 4]
push ecx
push edx
push 1
push edi
call esi
mov dword [0x1002f0ac], 1
pop edi
call fcn.1000d4f0
call fcn.1000d6d0
call fcn.1000c780
mov esi, dword [ebp + 8]
push esi
call fcn.1000ca20
mov ecx, esi
call fcn.1000d140
call fcn.10010020
push esi
call fcn.1000fcd0
mov ecx, esi
call fcn.1000f110
mov ecx, esi
call fcn.1000f5a0
push esi
call fcn.1000f7b0
add esp, 0xc
call fcn.100111f0
call fcn.100110f0
call fcn.10011bc0
call fcn.10011510
call fcn.10011680
call fcn.10011fd0
call fcn.1000fa00
call fcn.10010400
call fcn.10010280
call fcn.10011e00
call fcn.1000f8b0
call fcn.10011ef0
call fcn.10011a10
call fcn.10011840
call fcn.100118e0
call fcn.100128a0
call fcn.10012710
call fcn.10012ac0
call fcn.10012930
call fcn.10012100
call fcn.10012620
call fcn.100123c0
pop esi
mov esp, ebp
pop ebp
ret