Function at 0x1002c8a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x100ba00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x100c3574]
test eax, eax
push ebx
mov ebx, ecx
mov ecx, 1
push esi
cmove eax, ecx
push edi
mov dword [0x100c3574], eax
call fcn.10029e20
call fcn.10023240
mov ecx, dword [0x100c1f20]
test ecx, ecx
jne 0x1002c8e9
mov dword [0x100c1820], 0x32
jmp 0x1002c91d
cmp ecx, 1
jne 0x1002c8fa
mov dword [0x100c1820], 6
jmp 0x1002c91d
cmp ecx, 2
jne 0x1002c90b
mov dword [0x100c1820], 5
jmp 0x1002c91d
mov eax, dword [0x100c1820]
xor edx, edx
cmp ecx, 3
cmove eax, edx
mov dword [0x100c1820], eax
call fcn.10017710
test eax, eax
je 0x1002c97f
push 0x75
mov dword [0x100c21cc], 0x10017a20
call fcn.10017a20
cwde
shr eax, 0x10
test eax, eax
je 0x1002c978
cmp byte [0x100c7738], 0
je 0x1002c95f
cmp dword [0x100c773c], 0
je 0x1002c97f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x100c773c], eax
ja 0x1002c97f
xor eax, eax
mov byte [0x100c7738], 1
cmp dword [0x100c1234], eax
sete al
mov dword [0x100c1234], eax
jmp 0x1002c97f
mov byte [0x100c7738], 0
call fcn.10021150
call fcn.10025e00
call fcn.100275f0
call fcn.10020e80
mov ecx, ebx
call fcn.100212c0
call fcn.10026b40
mov ecx, ebx
call fcn.10022ef0
call fcn.100254d0
mov ecx, dword [0x100c1ac8]
mov eax, dword [0x100bd63c]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [eax], 0
je 0x1002ca0c
cmp dword [0x100c1ed4], 0
jne 0x1002c9dc
cmp dword [0x100c2bec], 0
je 0x1002ca0c
mov ecx, dword [0x100c1ac8]
mov eax, dword [0x100bd63c]
add eax, 0x1b8
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x1002ca46
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0xcc
jmp 0x1002ca3a
mov ecx, dword [0x100c1ac8]
mov eax, dword [0x100bd63c]
add eax, 0x1b8
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x1002ca46
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0x6a
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push edi
call esi
mov ecx, ebx
call fcn.10024e60
mov ecx, ebx
call fcn.10023ed0
mov ecx, ebx
call fcn.10024560
call fcn.100247a0
call fcn.100248a0
call fcn.10025fb0
call fcn.10026420
call fcn.10025c80
call fcn.10026f40
cmp dword [0x100c1274], 0
je 0x1002cb2f
mov ecx, dword [0x100c1ac8]
mov eax, dword [0x100bd63c]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x1002cb2f
push 0x20
mov dword [0x100c21cc], 0x10017a20
call fcn.10017a20
cwde
shr eax, 0x10
test eax, eax
je 0x1002cb28
cmp byte [0x100c7490], 0
je 0x1002cae3
cmp dword [0x100c7494], 0
je 0x1002cb2f
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov ecx, dword [0x100c7494]
inc ecx
cmp ecx, eax
ja 0x1002cb2f
jmp 0x1002cae9
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov byte [0x100c7490], 1
call edi
mov ecx, dword [0x100c1ac8]
mov dword [0x100c7494], eax
mov eax, dword [0x100bd63c]
add eax, 0x190
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea edi, [eax + 2]
cmp edi, 0x1000
jbe 0x1002cb6a
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 3
jmp 0x1002cb5e
mov byte [0x100c7490], 0
mov ecx, dword [0x100c1ac8]
mov eax, dword [0x100bd63c]
add eax, 0x190
push eax
mov edx, dword [ecx]
call dword [edx + 4]
lea edi, [eax + 2]
cmp edi, 0x1000
jbe 0x1002cb6a
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0x44
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push edi
call esi
call fcn.10026750
call fcn.10026800
call fcn.10027350
call fcn.10027490
call fcn.10025b50
call fcn.10025970
cmp dword [0x100c1a70], 0
jle 0x1002cc25
mov ecx, dword [0x100c1ac8]
mov eax, dword [0x100bd63c]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x1002cc25
mov eax, dword [0x100c1a70]
cmp eax, 1
jne 0x1002cbc4
mov dword [0x100bd3ac], 0x42c80000
jmp 0x1002cbf5
cmp eax, 2
jne 0x1002cbd5
mov dword [0x100bd3ac], 0x42dc0000
jmp 0x1002cbf5
cmp eax, 3
jne 0x1002cbe6
mov dword [0x100bd3ac], 0x42f00000
jmp 0x1002cbf5
cmp eax, 4
jne 0x1002cbf5
mov dword [0x100bd3ac], 0x42fa0000
mov ecx, dword [0x100c1ac8]
mov eax, dword [0x100bd63c]
add eax, 0x178
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x1002cc5f
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0xcc
jmp 0x1002cc53
mov ecx, dword [0x100c1ac8]
mov eax, dword [0x100bd63c]
add eax, 0x178
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x1002cc5f
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0x55
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push edi
call esi
call fcn.100271a0
call fcn.100249a0
call fcn.10027290
call fcn.10026c80
call fcn.10026d60
call fcn.10026970
call fcn.10026a10
call fcn.10029b10
call fcn.10029820
mov ecx, ebx
call fcn.10029ba0
call fcn.1002c480
call fcn.100277d0
call fcn.10029650
call fcn.10029150
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100813c9
mov esp, ebp
pop ebp
ret