Function at 0x100028d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18c
movzx eax, byte [0x10056d05]
test eax, eax
jne 0x10003041
mov dword [0x10056d20], 0
mov dword [0x10056d24], 0
cmp dword [0x10056d20], 0
je 0x1000292a
cmp dword [0x10056d24], 0
je 0x1000292a
push 0x10056d28
push 0
push 0x10002860
push 0
call dword [0x10056d20]
test eax, eax
je 0x1000303a
mov dword [0x10056d28], 0
cmp dword [0x10056d1c], 0
jne 0x1000294e
push 0
push 0x100382fc
call fcn.100063f0
mov dword [0x10056d1c], eax
movzx ecx, byte [0x10056d06]
test ecx, ecx
jne 0x10002f91
mov byte [0x10056d06], 1
push 0x12
call fcn.10006e80
test eax, eax
jne 0x10002f91
lea edx, [ebp - 0x24]
mov dword [ebp - 4], edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x20
lea eax, [ebp - 0x24]
push eax
push 0x10038338
call fcn.10006240
push eax
push str._s__x
push 0x20
lea ecx, [ebp - 0x44]
push ecx
call fcn.1001a556
add esp, 0x14
lea edx, [ebp - 0x44]
push edx
push 0xc
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
je 0x10002f91
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 0xb7
setne cl
mov byte [ebp - 0x49], cl
push 0
push 0
push 0
push 0xf001f
mov edx, dword [ebp - 0x48]
push edx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
je 0x10002f81
mov dword [ebp - 0x54], 0
jmp 0x10002a0c
mov eax, dword [ebp - 0x54]
add eax, 1
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0x32
jge 0x10002a60
movzx ecx, byte [ebp - 0x49]
test ecx, ecx
jne 0x10002a52
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp - 4]
mov dword [ebp - 0x180], edx
mov dword [ebp - 0x184], eax
mov ecx, dword [ebp - 0x180]
mov edx, dword [ebp - 0x184]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x10002a56
mov ecx, dword [ebp - 0x180]
mov edx, dword [ebp - 0x184]
mov eax, dword [ecx + 4]
cmp eax, dword [edx + 4]
jne 0x10002a56
jmp 0x10002a60
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10002a03
movzx ecx, byte [ebp - 0x49]
test ecx, ecx
jne 0x10002aa4
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp - 4]
mov dword [ebp - 0x188], edx
mov dword [ebp - 0x18c], eax
mov ecx, dword [ebp - 0x188]
mov edx, dword [ebp - 0x18c]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x10002aa4
mov ecx, dword [ebp - 0x188]
mov edx, dword [ebp - 0x18c]
mov eax, dword [ecx + 4]
cmp eax, dword [edx + 4]
je 0x10002f6c
push 1
push 0x10038328
call fcn.10006380
mov dword [ebp - 0x130], eax
mov ecx, dword [ebp - 0x130]
mov edx, dword [ecx]
mov dword [ebp - 0x140], edx
mov eax, dword [ecx + 4]
mov dword [ebp - 0x13c], eax
mov ecx, dword [ebp - 0x130]
push ecx
call fcn.10001dd0
test eax, eax
jne 0x10002af1
mov dword [ebp - 0x140], 0
mov dword [ebp - 0x13c], 0
mov edx, dword [ebp - 0x130]
push edx
lea ecx, [ebp - 0x128]
call fcn.1000a100
push 1
push 0x100382f0
call fcn.100063f0
mov dword [ebp - 0x134], eax
mov eax, dword [ebp - 0xcc]
push eax
push 0xe
call fcn.10002050
add esp, 8
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x144], 0
jmp 0x10002b47
mov ecx, dword [ebp - 0x144]
add ecx, 1
mov dword [ebp - 0x144], ecx
mov edx, dword [ebp - 0x74]
mov dword [ebp - 0x164], edx
mov eax, dword [ebp - 0x144]
cmp eax, dword [ebp - 0x164]
jge 0x10002e99
mov ecx, dword [ebp - 0x144]
imul ecx, ecx, 0x1c
mov edx, dword [ebp - 0x78]
mov eax, dword [edx + ecx + 0xc]
cmp eax, dword [ebp - 0x134]
jne 0x10002e94
mov ecx, dword [ebp - 0x144]
imul ecx, ecx, 0x1c
mov edx, dword [ebp - 0x78]
cmp dword [edx + ecx + 0x14], 0
jne 0x10002ba8
mov eax, dword [ebp - 0x144]
imul eax, eax, 0x1c
mov ecx, dword [ebp - 0x78]
cmp dword [ecx + eax + 0x18], 0
je 0x10002e92
mov edx, dword [ebp - 0x12c]
mov byte [edx], 0xff
mov eax, dword [ebp - 0x12c]
mov byte [eax + 1], 0x25
mov ecx, dword [ebp - 0x12c]
add ecx, 6
mov edx, dword [ebp - 0x12c]
mov dword [edx + 2], ecx
mov eax, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0x134]
mov dword [eax + 6], ecx
mov edx, dword [ebp - 0x12c]
mov eax, dword [ebp - 0x12c]
mov dword [edx + 0xa], eax
lea ecx, [ebp - 0x148]
push ecx
push 0x20
push 0xe
mov edx, dword [ebp - 0x12c]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x12c]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 0x144]
imul edx, edx, 0x1c
mov eax, dword [ebp - 0x78]
cmp dword [eax + edx + 0x10], 0
je 0x10002cfe
mov ecx, dword [ebp - 0x144]
imul ecx, ecx, 0x1c
add ecx, dword [ebp - 0x78]
mov dword [ebp - 0x168], ecx
lea edx, [ebp - 0x14c]
push edx
push 0x40
push 8
mov eax, dword [ebp - 0x168]
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x10002cf9
mov edx, dword [ebp - 0x144]
imul edx, edx, 0x1c
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x12c]
sub ecx, dword [eax + edx + 4]
sub ecx, 5
mov dword [ebp - 0x150], ecx
mov edx, dword [ebp - 0x144]
imul edx, edx, 0x1c
add edx, dword [ebp - 0x78]
mov dword [ebp - 0x16c], edx
push 4
mov eax, dword [ebp - 0x16c]
mov ecx, dword [eax + 0x14]
push ecx
lea edx, [ebp - 0x150]
push edx
call fcn.10009f30
test eax, eax
jne 0x10002cc0
mov eax, dword [ebp - 0x144]
imul eax, eax, 0x1c
mov ecx, dword [ebp - 0x78]
mov edx, dword [ecx + eax + 0x14]
mov eax, dword [ebp - 0x150]
mov dword [edx], eax
lea ecx, [ebp - 0x14c]
push ecx
mov edx, dword [ebp - 0x14c]
push edx
push 8
mov eax, dword [ebp - 0x144]
imul eax, eax, 0x1c
mov ecx, dword [ebp - 0x78]
mov edx, dword [ecx + eax + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 0x12c]
mov dword [0x10056d18], eax
mov dword [ebp - 0x48], 0
jmp 0x10002e92
mov ecx, dword [ebp - 0x144]
imul ecx, ecx, 0x1c
mov edx, dword [ebp - 0x78]
cmp dword [edx + ecx + 0x14], 0
je 0x10002dcf
mov eax, dword [ebp - 0x144]
imul eax, eax, 0x1c
add eax, dword [ebp - 0x78]
mov dword [ebp - 0x170], eax
lea ecx, [ebp - 0x154]
push ecx
push 0x40
push 8
mov edx, dword [ebp - 0x170]
mov eax, dword [edx + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x10002dca
mov ecx, dword [ebp - 0x144]
imul ecx, ecx, 0x1c
add ecx, dword [ebp - 0x78]
mov dword [ebp - 0x174], ecx
push 4
mov edx, dword [ebp - 0x174]
mov eax, dword [edx + 0x14]
push eax
lea ecx, [ebp - 0x12c]
push ecx
call fcn.10009f30
test eax, eax
jne 0x10002d90
mov edx, dword [ebp - 0x144]
imul edx, edx, 0x1c
mov eax, dword [ebp - 0x78]
mov ecx, dword [eax + edx + 0x14]
mov edx, dword [ebp - 0x12c]
mov dword [ecx], edx
lea eax, [ebp - 0x154]
push eax
mov ecx, dword [ebp - 0x154]
push ecx
push 8
mov edx, dword [ebp - 0x144]
imul edx, edx, 0x1c
mov eax, dword [ebp - 0x78]
mov ecx, dword [eax + edx + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [ebp - 0x12c]
mov dword [0x10056d18], edx
mov dword [ebp - 0x48], 0
jmp 0x10002e92
mov eax, dword [ebp - 0x144]
imul eax, eax, 0x1c
add eax, dword [ebp - 0x78]
mov dword [ebp - 0x178], eax
lea ecx, [ebp - 0x158]
push ecx
push 0x40
push 8
mov edx, dword [ebp - 0x178]
mov eax, dword [edx + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x10002e92
mov ecx, dword [ebp - 0x12c]
add ecx, 0xa
mov dword [ebp - 0x15c], ecx
mov edx, dword [ebp - 0x144]
imul edx, edx, 0x1c
add edx, dword [ebp - 0x78]
mov dword [ebp - 0x17c], edx
push 4
mov eax, dword [ebp - 0x17c]
mov ecx, dword [eax + 0x18]
push ecx
lea edx, [ebp - 0x15c]
push edx
call fcn.10009f30
test eax, eax
jne 0x10002e59
mov eax, dword [ebp - 0x144]
imul eax, eax, 0x1c
mov ecx, dword [ebp - 0x78]
mov edx, dword [ecx + eax + 0x18]
mov eax, dword [ebp - 0x15c]
mov dword [edx], eax
lea ecx, [ebp - 0x158]
push ecx
mov edx, dword [ebp - 0x158]
push edx
push 8
mov eax, dword [ebp - 0x144]
imul eax, eax, 0x1c
mov ecx, dword [ebp - 0x78]
mov edx, dword [ecx + eax + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 0x12c]
mov dword [0x10056d18], eax
mov dword [ebp - 0x48], 0
jmp 0x10002e99
jmp 0x10002b38
mov ecx, dword [ebp - 0x140]
or ecx, dword [ebp - 0x13c]
je 0x10002f26
lea edx, [ebp - 0x160]
push edx
push 0x40
push 8
mov eax, dword [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x10002f26
push 8
mov ecx, dword [ebp - 0x130]
push ecx
lea edx, [ebp - 0x140]
push edx
call fcn.10009f30
test eax, eax
jne 0x10002ef3
mov eax, dword [ebp - 0x130]
mov ecx, dword [ebp - 0x140]
mov dword [eax], ecx
mov edx, dword [ebp - 0x13c]
mov dword [eax + 4], edx
push 8
mov eax, dword [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea ecx, [ebp - 0x160]
push ecx
mov edx, dword [ebp - 0x160]
push edx
push 8
mov eax, dword [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [0x10056d18], 0
jne 0x10002f4f
mov ecx, dword [ebp - 0x50]
push ecx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push 0x8000
push 0
mov edx, dword [ebp - 0x12c]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x10002f5f
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [eax], edx
mov ecx, dword [ecx + 4]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0x128]
call fcn.1000a310
jmp 0x10002f81
mov edx, dword [ebp - 0x50]
mov eax, dword [edx + 8]
mov dword [0x10056d18], eax
mov ecx, dword [ebp - 0x50]
push ecx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
cmp dword [ebp - 0x48], 0
je 0x10002f91
mov edx, dword [ebp - 0x48]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x10056d18], 0
je 0x10002fc8
push 0
push 0
push 0x10056d10
push 0x10003150
mov eax, dword [0x10056d18]
push eax
push 0
push 0x1003845a
push 0x1003845a
push 0
push 0
call fcn.100016d0
add esp, 0x28
jmp 0x10003001
push 0
push 0
push 0x10056d0c
push 0x10003050
push 1
push 0x10038328
call fcn.10006380
push eax
call fcn.100052f0
push eax
push 0
push 0x1003845a
push 0x1003845a
push 0
push 0
call fcn.100016d0
add esp, 0x28
push 0
push 0
push 0x10056d14
push 0x10003220
push 1
push 0x1003830c
call fcn.100063f0
push eax
call fcn.100052f0
push eax
push 0
push 0x1003845a
push 0x1003845a
push 0
push 0
call fcn.100016d0
add esp, 0x28
mov byte [0x10056d05], 1
mov esp, ebp
pop ebp
ret