Function at 0x10029860
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x100b200c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x100bb1e0]
test eax, eax
push ebx
mov ebx, ecx
mov ecx, 1
push esi
cmove eax, ecx
push edi
mov dword [0x100bb1e0], eax
call fcn.100288d0
call fcn.10022240
mov ecx, dword [0x100b9b9c]
test ecx, ecx
jne 0x100298a9
mov dword [0x100b94a4], 0x32
jmp 0x100298dd
cmp ecx, 1
jne 0x100298ba
mov dword [0x100b94a4], 6
jmp 0x100298dd
cmp ecx, 2
jne 0x100298cb
mov dword [0x100b94a4], 5
jmp 0x100298dd
mov eax, dword [0x100b94a4]
xor edx, edx
cmp ecx, 3
cmove eax, edx
mov dword [0x100b94a4], eax
call fcn.10016f70
test eax, eax
je 0x1002993f
push 0x75
mov dword [0x100b9e44], 0x10017280
call fcn.10017280
cwde
shr eax, 0x10
test eax, eax
je 0x10029938
cmp byte [0x100be348], 0
je 0x1002991f
cmp dword [0x100be34c], 0
je 0x1002993f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x100be34c], eax
ja 0x1002993f
xor eax, eax
mov byte [0x100be348], 1
cmp dword [0x100b8eb8], eax
sete al
mov dword [0x100b8eb8], eax
jmp 0x1002993f
mov byte [0x100be348], 0
call fcn.10020150
call fcn.1001fe80
mov ecx, ebx
call fcn.100202c0
call fcn.10025910
mov ecx, ebx
call fcn.10021ef0
call fcn.100244d0
mov ecx, dword [0x100b9748]
mov eax, dword [0x100b52c4]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [eax], 0
je 0x100299c2
cmp dword [0x100b9b54], 0
jne 0x10029992
cmp dword [0x100ba860], 0
je 0x100299c2
mov ecx, dword [0x100b9748]
mov eax, dword [0x100b52c4]
add eax, 0x194
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x100299fc
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0xcc
jmp 0x100299f0
mov ecx, dword [0x100b9748]
mov eax, dword [0x100b52c4]
add eax, 0x194
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x100299fc
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0x6a
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push edi
call esi
mov ecx, ebx
call fcn.10023e60
mov ecx, ebx
call fcn.10022ed0
mov ecx, ebx
call fcn.10023560
call fcn.100237a0
call fcn.100238a0
call fcn.10024d80
call fcn.100251f0
call fcn.10024c80
call fcn.10025d10
cmp dword [0x100b8ef8], 0
je 0x10029ae5
mov ecx, dword [0x100b9748]
mov eax, dword [0x100b52c4]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x10029ae5
push 0x20
mov dword [0x100b9e44], 0x10017280
call fcn.10017280
cwde
shr eax, 0x10
test eax, eax
je 0x10029ade
cmp byte [0x100be0a0], 0
je 0x10029a99
cmp dword [0x100be0a4], 0
je 0x10029ae5
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov ecx, dword [0x100be0a4]
inc ecx
cmp ecx, eax
ja 0x10029ae5
jmp 0x10029a9f
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov byte [0x100be0a0], 1
call edi
mov ecx, dword [0x100b9748]
mov dword [0x100be0a4], eax
mov eax, dword [0x100b52c4]
add eax, 0x16c
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea edi, [eax + 2]
cmp edi, 0x1000
jbe 0x10029b20
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 3
jmp 0x10029b14
mov byte [0x100be0a0], 0
mov ecx, dword [0x100b9748]
mov eax, dword [0x100b52c4]
add eax, 0x16c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
lea edi, [eax + 2]
cmp edi, 0x1000
jbe 0x10029b20
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0x44
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push edi
call esi
call fcn.10025520
call fcn.100255d0
call fcn.10026120
call fcn.10024b50
call fcn.10024970
cmp dword [0x100b96f4], 0
jle 0x10029bd6
mov ecx, dword [0x100b9748]
mov eax, dword [0x100b52c4]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x10029bd6
mov eax, dword [0x100b96f4]
cmp eax, 1
jne 0x10029b75
mov dword [0x100bdbcc], 0x42c80000
jmp 0x10029ba6
cmp eax, 2
jne 0x10029b86
mov dword [0x100bdbcc], 0x42dc0000
jmp 0x10029ba6
cmp eax, 3
jne 0x10029b97
mov dword [0x100bdbcc], 0x42f00000
jmp 0x10029ba6
cmp eax, 4
jne 0x10029ba6
mov dword [0x100bdbcc], 0x42fa0000
mov ecx, dword [0x100b9748]
mov eax, dword [0x100b52c4]
add eax, 0x154
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x10029c10
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0xcc
jmp 0x10029c04
mov ecx, dword [0x100b9748]
mov eax, dword [0x100b52c4]
add eax, 0x154
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x10029c10
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0x55
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push edi
call esi
call fcn.10025f70
call fcn.100239a0
call fcn.10026060
call fcn.10025a50
call fcn.10025b30
call fcn.10025740
call fcn.100257e0
call fcn.10028580
call fcn.10028290
mov ecx, ebx
call fcn.10028610
call fcn.10029440
call fcn.10026260
call fcn.100280c0
call fcn.10027bc0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1007bea9
mov esp, ebp
pop ebp
ret