Function at 0x100238a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x1006800c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x1006b4ac], 0
push ebx
mov ebx, ecx
jne 0x10023b31
push esi
push edi
call fcn.10023110
mov eax, dword [0x1006a46c]
mov ecx, fcn.10006d80
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esi, [eax + 0x40]
cmp esi, 0x1000
jbe 0x10023911
cmp ecx, 0x1000
jbe 0x10023911
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x2c]
mov dword [esi], fcn.10006d80
push eax
push dword [ebp - 8]
push 4
push esi
call edi
mov eax, dword [0x1006a46c]
mov ecx, fcn.10006d80
lea esi, [eax + 0x44]
cmp esi, 0x1000
jbe 0x10023946
cmp ecx, 0x1000
jbe 0x10023946
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x30]
mov dword [esi], fcn.10006d80
push eax
push dword [ebp - 0xc]
push 4
push esi
call edi
mov eax, dword [0x1006a46c]
lea esi, [eax + 0x48]
mov ecx, fcn.10006d80
cmp esi, 0x1000
jbe 0x10023985
cmp ecx, 0x1000
jbe 0x10023985
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x34]
mov dword [esi], fcn.10006d80
push eax
push dword [ebp - 0x10]
push 4
push esi
call edi
mov eax, dword [0x1006a46c]
mov ecx, fcn.10006d80
lea esi, [eax + 0x4c]
cmp esi, 0x1000
jbe 0x100239ba
cmp ecx, 0x1000
jbe 0x100239ba
lea eax, [ebp - 0x14]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x38]
mov dword [esi], fcn.10006d80
push eax
push dword [ebp - 0x14]
push 4
push esi
call edi
mov eax, dword [0x1006a46c]
lea esi, [eax + 0x50]
mov ecx, fcn.10006d80
cmp esi, 0x1000
jbe 0x100239f9
cmp ecx, 0x1000
jbe 0x100239f9
lea eax, [ebp - 0x18]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x3c]
mov dword [esi], fcn.10006d80
push eax
push dword [ebp - 0x18]
push 4
push esi
call edi
mov eax, dword [0x1006a46c]
mov ecx, fcn.10006d80
lea esi, [eax + 0x54]
cmp esi, 0x1000
jbe 0x10023a2e
cmp ecx, 0x1000
jbe 0x10023a2e
lea eax, [ebp - 0x1c]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x40]
mov dword [esi], fcn.10006d80
push eax
push dword [ebp - 0x1c]
push 4
push esi
call edi
mov eax, dword [0x1006a46c]
lea esi, [eax + 0x58]
cmp esi, 0x1000
jbe 0x10023a68
mov ecx, fcn.10006d80
cmp ecx, 0x1000
jbe 0x10023a68
lea eax, [ebp - 0x20]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x44]
mov dword [esi], fcn.10006d80
push eax
push dword [ebp - 0x20]
push 4
push esi
call edi
mov eax, dword [0x1006a46c]
cmp dword [0x1006c034], 0
jne 0x10023ab6
lea esi, [eax + 0x38]
cmp esi, 0x1000
jbe 0x10023aaf
mov eax, 0x10022fa0
cmp eax, 0x1000
jbe 0x10023aaf
mov eax, dword [esi]
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x24]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x28]
mov dword [esi], 0x10022fa0
push eax
push dword [ebp - 0x24]
push 4
push esi
call edi
mov eax, dword [ebp - 0x48]
jmp 0x10023ab1
xor eax, eax
mov dword [0x1006c034], eax
cmp dword [0x1006a294], 0
jne 0x10023b25
mov ecx, dword [0x10069ea0]
mov eax, dword [0x1006c3c4]
add eax, 0x2f8
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov dword [ebp - 0x48], eax
cmp eax, 0x1000
jbe 0x10023b1e
push 0xc
call fcn.10047c44
add esp, 4
mov esi, eax
lea eax, [ebp - 0x28]
push eax
push 0x40
push 0xc
push esi
call edi
mov edx, dword [ebp - 0x48]
mov ecx, dword [edx]
mov dword [esi], ecx
mov ax, word [edx + 4]
mov word [esi + 4], ax
mov al, byte [edx + 6]
mov byte [esi + 6], al
lea eax, [esi + 7]
sub edx, eax
mov byte [eax], 0xe9
add edx, 2
mov dword [eax + 1], edx
add eax, 0xfffffff9
jmp 0x10023b20
xor eax, eax
mov dword [0x1006a294], eax
pop edi
mov dword [0x1006b4ac], 1
pop esi
call fcn.1001be50
mov ecx, dword [0x1006a2e4]
test ecx, ecx
jne 0x10023b4c
mov dword [0x1006f9a0], 0x32
jmp 0x10023b80
cmp ecx, 1
jne 0x10023b5d
mov dword [0x1006f9a0], 6
jmp 0x10023b80
cmp ecx, 2
jne 0x10023b6e
mov dword [0x1006f9a0], 5
jmp 0x10023b80
mov eax, dword [0x1006f9a0]
xor edx, edx
cmp ecx, 3
cmove eax, edx
mov dword [0x1006f9a0], eax
call fcn.10019c70
call fcn.10019d10
mov ecx, ebx
call fcn.10019e80
mov ecx, ebx
call fcn.1001bb00
call fcn.100216c0
mov ecx, ebx
call fcn.1001d490
mov ecx, ebx
call fcn.1001da10
call fcn.100202e0
call fcn.10020ce0
call fcn.100203f0
call fcn.1001eac0
call fcn.10020c30
call fcn.1001eb80
call fcn.10021510
call fcn.10021600
call fcn.10021160
call fcn.10020e50
call fcn.10021800
call fcn.10021f00
call fcn.10021bc0
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.100473e9
mov esp, ebp
pop ebp
ret