Function at 0x1002bea0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x100b500c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x100be1f0]
test eax, eax
push ebx
push esi
push edi
mov edi, ecx
mov ecx, 1
cmove eax, ecx
mov ecx, edi
mov dword [0x100be1f0], eax
call fcn.10028b30
call fcn.10028890
call fcn.100221b0
mov ecx, dword [0x100bcba4]
test ecx, ecx
jne 0x1002bef0
mov dword [0x100bc4a0], 0x32
jmp 0x1002bf24
cmp ecx, 1
jne 0x1002bf01
mov dword [0x100bc4a0], 6
jmp 0x1002bf24
cmp ecx, 2
jne 0x1002bf12
mov dword [0x100bc4a0], 5
jmp 0x1002bf24
mov eax, dword [0x100bc4a0]
xor edx, edx
cmp ecx, 3
cmove eax, edx
mov dword [0x100bc4a0], eax
call fcn.10016f00
test eax, eax
je 0x1002bf86
push 0x75
mov dword [0x100bce54], 0x10017210
call fcn.10017210
cwde
shr eax, 0x10
test eax, eax
je 0x1002bf7f
cmp byte [0x100c1370], 0
je 0x1002bf66
cmp dword [0x100c1374], 0
je 0x1002bf86
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x100c1374], eax
ja 0x1002bf86
xor eax, eax
mov byte [0x100c1370], 1
cmp dword [0x100bbeb0], eax
sete al
mov dword [0x100bbeb0], eax
jmp 0x1002bf86
mov byte [0x100c1370], 0
call fcn.100200c0
call fcn.1001fdf0
mov ecx, edi
call fcn.10020230
call fcn.10025860
mov ecx, edi
call fcn.10021e60
call fcn.10024420
mov ecx, dword [0x100bc74c]
mov eax, dword [0x100b82b8]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [eax], 0
je 0x1002c009
cmp dword [0x100bcb58], 0
jne 0x1002bfd9
cmp dword [0x100bd870], 0
je 0x1002c009
mov ecx, dword [0x100bc74c]
mov eax, dword [0x100b82b8]
add eax, 0x194
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov ebx, eax
cmp ebx, 0x1000
jbe 0x1002c043
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push ebx
call esi
mov byte [ebx], 0xcc
jmp 0x1002c037
mov ecx, dword [0x100bc74c]
mov eax, dword [0x100b82b8]
add eax, 0x194
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov ebx, eax
cmp ebx, 0x1000
jbe 0x1002c043
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push ebx
call esi
mov byte [ebx], 0x6a
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push ebx
call esi
mov ecx, edi
call fcn.10023db0
mov ecx, edi
call fcn.10022e40
mov ecx, edi
call fcn.100234d0
call fcn.10023710
call fcn.10023810
call fcn.10024cd0
call fcn.10025140
call fcn.10024bd0
call fcn.10025c60
cmp dword [0x100bbef4], 0
je 0x1002c12c
mov ecx, dword [0x100bc74c]
mov eax, dword [0x100b82b8]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x1002c12c
push 0x20
mov dword [0x100bce54], 0x10017210
call fcn.10017210
cwde
shr eax, 0x10
test eax, eax
je 0x1002c125
cmp byte [0x100c10c8], 0
je 0x1002c0e0
cmp dword [0x100c10cc], 0
je 0x1002c12c
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
mov ecx, dword [0x100c10cc]
inc ecx
cmp ecx, eax
ja 0x1002c12c
jmp 0x1002c0e6
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov byte [0x100c10c8], 1
call ebx
mov ecx, dword [0x100bc74c]
mov dword [0x100c10cc], eax
mov eax, dword [0x100b82b8]
add eax, 0x16c
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea ebx, [eax + 2]
cmp ebx, 0x1000
jbe 0x1002c167
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push ebx
call esi
mov byte [ebx], 3
jmp 0x1002c15b
mov byte [0x100c10c8], 0
mov ecx, dword [0x100bc74c]
mov eax, dword [0x100b82b8]
add eax, 0x16c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
lea ebx, [eax + 2]
cmp ebx, 0x1000
jbe 0x1002c167
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push ebx
call esi
mov byte [ebx], 0x44
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push ebx
call esi
call fcn.10025470
call fcn.10025520
call fcn.10026090
call fcn.10024aa0
call fcn.100248c0
cmp dword [0x100bc6f0], 0
jle 0x1002c21d
mov ecx, dword [0x100bc74c]
mov eax, dword [0x100b82b8]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x1002c21d
mov eax, dword [0x100bc6f0]
cmp eax, 1
jne 0x1002c1bc
mov dword [0x100c0be4], 0x42c80000
jmp 0x1002c1ed
cmp eax, 2
jne 0x1002c1cd
mov dword [0x100c0be4], 0x42dc0000
jmp 0x1002c1ed
cmp eax, 3
jne 0x1002c1de
mov dword [0x100c0be4], 0x42f00000
jmp 0x1002c1ed
cmp eax, 4
jne 0x1002c1ed
mov dword [0x100c0be4], 0x42fa0000
mov ecx, dword [0x100bc74c]
mov eax, dword [0x100b82b8]
add eax, 0x154
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov ebx, eax
cmp ebx, 0x1000
jbe 0x1002c257
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push ebx
call esi
mov byte [ebx], 0xcc
jmp 0x1002c24b
mov ecx, dword [0x100bc74c]
mov eax, dword [0x100b82b8]
add eax, 0x154
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov ebx, eax
cmp ebx, 0x1000
jbe 0x1002c257
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push ebx
call esi
mov byte [ebx], 0x55
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push ebx
call esi
call fcn.10025ec0
call fcn.10023910
call fcn.10025fd0
call fcn.100259a0
call fcn.10025a80
call fcn.10025690
call fcn.10025730
call fcn.100284e0
call fcn.100281f0
mov ecx, edi
call fcn.10028570
call fcn.1002ba80
call fcn.100261d0
call fcn.10028020
call fcn.10027b20
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1007e249
mov esp, ebp
pop ebp
ret