Function at 0x1002b780
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100a700c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x100ab380]
test eax, eax
push ebx
mov ebx, ecx
mov ecx, 1
cmove eax, ecx
mov ecx, ebx
push esi
push edi
mov dword [0x100ab380], eax
call fcn.100283e0
call fcn.10027e50
call fcn.10020620
mov ecx, dword [0x100a9d5c]
test ecx, ecx
jne 0x1002b7d0
mov dword [0x100b1cc0], 0x32
jmp 0x1002b804
cmp ecx, 1
jne 0x1002b7e1
mov dword [0x100b1cc0], 6
jmp 0x1002b804
cmp ecx, 2
jne 0x1002b7f2
mov dword [0x100b1cc0], 5
jmp 0x1002b804
mov eax, dword [0x100b1cc0]
xor edx, edx
cmp ecx, 3
cmove eax, edx
mov dword [0x100b1cc0], eax
call fcn.10015740
test eax, eax
je 0x1002b866
push 0x75
mov dword [0x100aa004], 0x10015a50
call fcn.10015a50
cwde
shr eax, 0x10
test eax, eax
je 0x1002b85f
cmp byte [0x100b23a8], 0
je 0x1002b846
cmp dword [0x100b23ac], 0
je 0x1002b866
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x100b23ac], eax
ja 0x1002b866
xor eax, eax
mov byte [0x100b23a8], 1
cmp dword [0x100b16e0], eax
sete al
mov dword [0x100b16e0], eax
jmp 0x1002b866
mov byte [0x100b23a8], 0
call fcn.1001e530
call fcn.1001e260
mov ecx, ebx
call fcn.1001e6a0
call fcn.10026310
mov ecx, ebx
call fcn.100202d0
mov ecx, ebx
call fcn.10023620
mov ecx, dword [0x100a98fc]
mov eax, dword [0x100adaf8]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [eax], 0
je 0x1002b940
cmp dword [0x100b16e4], 0
jne 0x1002b909
cmp dword [0x100adaa0], 0
jne 0x1002b909
cmp dword [0x100acbd8], 0
jne 0x1002b909
cmp dword [0x100aaa48], 0
jne 0x1002b909
mov ecx, dword [0x100a98fc]
mov eax, dword [0x100adaf8]
add eax, 0x108
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x1002b97a
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push edi
call esi
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
jmp 0x1002b972
mov ecx, dword [0x100a98fc]
mov eax, dword [0x100adaf8]
add eax, 0x108
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x1002b97a
lea eax, [ebp - 0x10]
push eax
push 0x40
push 1
push edi
call esi
lea eax, [ebp - 0x10]
mov byte [edi], 0xcc
push eax
push dword [ebp - 0x10]
jmp 0x1002b975
mov ecx, dword [0x100a98fc]
mov eax, dword [0x100adaf8]
add eax, 0x108
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x1002b97a
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
mov byte [edi], 0x55
push 1
push edi
call esi
mov ecx, dword [0x100a98fc]
mov eax, dword [0x100adaf8]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x1002b9d5
cmp dword [0x100a9d08], 0
jne 0x1002b9a5
cmp dword [0x100aaa0c], 0
je 0x1002b9d5
mov ecx, dword [0x100a98fc]
mov eax, dword [0x100adaf8]
add eax, 0x194
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x1002ba0f
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0xcc
jmp 0x1002ba03
mov ecx, dword [0x100a98fc]
mov eax, dword [0x100adaf8]
add eax, 0x194
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x1002ba0f
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0x6a
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push edi
call esi
mov ecx, ebx
call fcn.10022f00
mov ecx, ebx
call fcn.10021a00
mov ecx, ebx
call fcn.10022630
mov ecx, ebx
call fcn.10022090
call fcn.100222d0
call fcn.100223d0
call fcn.100256e0
call fcn.10025a80
call fcn.10025db0
call fcn.100255d0
call fcn.10026620
cmp dword [0x100b1720], 0
je 0x1002bb04
mov ecx, dword [0x100a98fc]
mov eax, dword [0x100adaf8]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x1002bb04
push 0x20
mov dword [0x100aa004], 0x10015a50
call fcn.10015a50
cwde
shr eax, 0x10
test eax, eax
je 0x1002bafd
cmp byte [0x100b2100], 0
je 0x1002bab8
cmp dword [0x100b2104], 0
je 0x1002bb04
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov ecx, dword [0x100b2104]
inc ecx
cmp ecx, eax
ja 0x1002bb04
jmp 0x1002babe
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov byte [0x100b2100], 1
call edi
mov ecx, dword [0x100a98fc]
mov dword [0x100b2104], eax
mov eax, dword [0x100adaf8]
add eax, 0x16c
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea edi, [eax + 2]
cmp edi, 0x1000
jbe 0x1002bb3f
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 3
jmp 0x1002bb33
mov byte [0x100b2100], 0
mov ecx, dword [0x100a98fc]
mov eax, dword [0x100adaf8]
add eax, 0x16c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
lea edi, [eax + 2]
cmp edi, 0x1000
jbe 0x1002bb3f
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0x44
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push edi
call esi
call fcn.10025f20
call fcn.10025fd0
mov ecx, dword [0x100a98fc]
mov eax, dword [0x100adaf8]
add eax, 0x180
push eax
mov edx, dword [ecx]
call dword [edx + 4]
test eax, eax
je 0x1002bbe8
cmp dword [0x100acba4], 1
mov ecx, dword [0x100a98fc]
mov eax, dword [0x100adaf8]
mov edx, dword [ecx]
jne 0x1002bbba
add eax, 0x1c
push eax
call dword [edx + 4]
mov ecx, dword [0x100a98fc]
cmp dword [eax], 0
mov edx, dword [ecx]
mov eax, dword [0x100adaf8]
je 0x1002bbba
add eax, 0x180
push eax
call dword [edx + 4]
lea edi, [eax + 3]
cmp edi, 0x1000
jbe 0x1002bbe8
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0x66
jmp 0x1002bbdc
add eax, 0x180
push eax
call dword [edx + 4]
lea edi, [eax + 3]
cmp edi, 0x1000
jbe 0x1002bbe8
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0x46
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push edi
call esi
call fcn.10026a30
call fcn.10022bc0
cmp dword [0x100a9884], 1
jne 0x1002bc67
mov ecx, dword [0x100a98fc]
mov eax, dword [0x100adaf8]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x1002bc67
cmp dword [0x100adc14], 1
jne 0x1002bcb4
mov ecx, dword [0x100a98fc]
mov eax, dword [0x100adaf8]
add eax, 0x150
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x1002bc5b
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
lea eax, [ebp - 8]
mov byte [edi], 0xcc
push eax
push dword [ebp - 8]
push 1
push edi
call esi
mov dword [0x100adc14], 0
jmp 0x1002bcb4
cmp dword [0x100adc14], 0
jne 0x1002bcb4
mov ecx, dword [0x100a98fc]
mov eax, dword [0x100adaf8]
add eax, 0x150
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x1002bcaa
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
lea eax, [ebp - 8]
mov byte [edi], 0x68
push eax
push dword [ebp - 8]
push 1
push edi
call esi
mov dword [0x100adc14], 1
call fcn.10023e70
call fcn.10023db0
cmp dword [0x100a989c], 0
jle 0x1002bd5b
mov ecx, dword [0x100a98fc]
mov eax, dword [0x100adaf8]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x1002bd5b
mov eax, dword [0x100a989c]
cmp eax, 1
jne 0x1002bcfa
mov dword [0x100ad870], 0x42c80000
jmp 0x1002bd2b
cmp eax, 2
jne 0x1002bd0b
mov dword [0x100ad870], 0x42dc0000
jmp 0x1002bd2b
cmp eax, 3
jne 0x1002bd1c
mov dword [0x100ad870], 0x42f00000
jmp 0x1002bd2b
cmp eax, 4
jne 0x1002bd2b
mov dword [0x100ad870], 0x42fa0000
mov ecx, dword [0x100a98fc]
mov eax, dword [0x100adaf8]
add eax, 0x154
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x1002bd95
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0xcc
jmp 0x1002bd89
mov ecx, dword [0x100a98fc]
mov eax, dword [0x100adaf8]
add eax, 0x154
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x1002bd95
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0x55
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push edi
call esi
call fcn.10026880
call fcn.100224d0
call fcn.10026970
call fcn.10026450
call fcn.10026140
call fcn.100261e0
call fcn.100277f0
call fcn.10027500
mov ecx, ebx
call fcn.10027880
call fcn.1002b380
call fcn.10026b70
call fcn.10027330
call fcn.10026fa0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10073bc9
mov esp, ebp
pop ebp
ret