Function at 0x10009110
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100a900c]
xor eax, ebp
mov dword [ebp - 4], eax
mov cl, byte [0x100b0520]
mov dl, byte [0x100b0522]
mov al, byte [0x100b0524]
mov byte [0x100b0521], cl
mov byte [0x100b0523], dl
mov byte [0x100b0525], al
test cl, cl
je 0x1000941b
push esi
mov esi, dword [0x100cab48]
lea eax, [ebp - 8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esi, 0x64660
mov dword [ebp - 0xc], 5
mov dword [ebp - 0x10], esi
push eax
push 0x40
push 5
push esi
test dl, dl
je 0x10009242
call edi
mov eax, fcn.1006f0e0
mov byte [esi], 0xe9
sub eax, esi
sub eax, 5
mov dword [esi + 1], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call edi
mov esi, dword [0x100cab48]
lea eax, [ebp - 8]
push eax
push 0x40
add esi, 0x64e90
mov dword [ebp - 0xc], 5
push 5
push esi
mov dword [ebp - 0x10], esi
call edi
mov eax, 0x1006f1e0
mov byte [esi], 0xe9
sub eax, esi
sub eax, 5
mov dword [esi + 1], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call edi
mov esi, dword [0x100cab48]
lea eax, [ebp - 8]
push eax
push 0x40
add esi, 0x641a0
mov dword [ebp - 0xc], 5
push 5
push esi
mov dword [ebp - 0x10], esi
call edi
mov eax, 0x1006f640
mov byte [esi], 0xe9
sub eax, esi
sub eax, 5
mov dword [esi + 1], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call edi
mov esi, dword [0x100cab48]
lea eax, [ebp - 8]
push eax
push 0x40
add esi, 0x64250
mov dword [ebp - 0xc], 5
push 5
push esi
mov dword [ebp - 0x10], esi
call edi
mov eax, 0x1006f7a0
jmp 0x10009249
call edi
mov eax, 0x1006efa0
sub eax, esi
sub eax, 5
mov dword [esi + 1], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
mov byte [esi], 0xe9
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call edi
cmp byte [0x100b0525], 0
je 0x100092ac
mov esi, dword [0x100cab48]
lea eax, [ebp - 8]
push eax
push 0x40
add esi, 0x64550
mov dword [ebp - 0xc], 5
push 5
push esi
mov dword [ebp - 0x10], esi
call edi
mov eax, 0x1006f230
mov byte [esi], 0xe9
sub eax, esi
sub eax, 5
mov dword [esi + 1], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call edi
mov eax, dword [0x100cab48]
lea ecx, [ebp - 8]
push ecx
push 0x40
add eax, 0x64d15
mov dword [ebp - 0xc], 6
push 6
push eax
mov dword [ebp - 0x10], eax
call edi
mov eax, dword [0x100cab48]
mov ecx, 0x90909090
mov dword [eax + 0x64d15], ecx
mov word [eax + 0x64d19], cx
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call edi
mov eax, dword [0x100cab48]
lea ecx, [ebp - 8]
push ecx
push 0x40
add eax, 0x6442a
mov dword [ebp - 0xc], 6
push 6
push eax
mov dword [ebp - 0x10], eax
call edi
mov eax, dword [0x100cab48]
mov ecx, 0x90909090
mov dword [eax + 0x6442a], ecx
mov word [eax + 0x6442e], cx
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call edi
mov eax, dword [0x100cab48]
lea ecx, [ebp - 8]
push ecx
push 0x40
add eax, 0x64d64
mov dword [ebp - 0xc], 8
push 8
push eax
mov dword [ebp - 0x10], eax
call edi
mov eax, dword [ebp - 0x10]
mov byte [eax], 0xff
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0x100b0024
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call edi
mov eax, dword [0x100cab48]
lea ecx, [ebp - 8]
push ecx
push 0x40
add eax, 0x64d44
mov dword [ebp - 0xc], 4
push 4
push eax
mov dword [ebp - 0x10], eax
call edi
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x100b0028
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call edi
mov eax, dword [0x100cab48]
add eax, 0x6448b
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 8]
mov dword [ebp - 0xc], 4
push ecx
push 0x40
push 4
push eax
call edi
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x100b0028
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call edi
mov eax, dword [0x100cab48]
lea ecx, [ebp - 8]
push ecx
push 0x40
add eax, 0x64449
mov dword [ebp - 0xc], 4
push 4
push eax
mov dword [ebp - 0x10], eax
call edi
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x100b0028
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call edi
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007491a
mov esp, ebp
pop ebp
ret