Function at 0x1000c7e8
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [0x1005c030]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x42c], eax
xor edi, edi
lea eax, [ebp - 0x418]
mov dword [ebp - 0x41c], ecx
push eax
push ecx
mov dword [ebp - 0x420], edi
mov dword [ebp - 0x418], edi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [ebp - 0x418]
push edi
push 0x38
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x1000ca5e
push 0x40
mov eax, 0x1000
push eax
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x408], eax
test eax, eax
je 0x1000ca5e
push ebx
push 0x400
lea eax, [ebp - 0x404]
mov dword [ebp - 0x414], edi
push edi
push eax
call fcn.10022d40
add esp, 0xc
mov dword [ebp - 0x410], 0x12
mov dword [ebp - 0x40c], edi
push 0xc
pop ebx
push str.IsWow64Process
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x1000c8bf
lea eax, [ebp - 0x40c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call edi
cmp dword [ebp - 0x40c], 0
je 0x1000c8d5
push 0x10
pop ebx
mov dword [ebp - 0x410], 0x18
xor edi, edi
push edi
push edi
push 0x418
push dword [ebp - 0x41c]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, eax
mov eax, edi
mov edi, dword [ebp - 0x408]
mov dword [ebp - 0x430], ecx
mov dword [ebp - 0x424], eax
test ecx, ecx
jle 0x1000ca40
add ebx, edi
mov dword [ebp - 0x40c], ebx
push edi
push eax
push 0x417
push dword [ebp - 0x41c]
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
push eax
push 4
lea eax, [ebp - 0x414]
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [ebp - 0x414], 0xffffffff
je 0x1000ca27
xor eax, eax
push eax
push 0x400
lea eax, [ebp - 0x404]
push eax
push dword [ebp - 0x414]
push esi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push 8
call fcn.100206d9
mov ebx, eax
lea edx, [ebp - 0x404]
xor eax, eax
mov dword [ebp - 0x428], ebx
pop ecx
mov dword [ebp - 0x428], ebx
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov eax, dword [ebp - 0x410]
lea edx, [edx + eax*2]
test edx, edx
je 0x1000c9c4
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x408], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x420]
jne 0x1000c99b
sub ecx, dword [ebp - 0x408]
sar ecx, 1
je 0x1000c9be
push edx
call fcn.1002a79a
pop ecx
mov dword [ebx + 4], eax
mov eax, dword [ebp - 0x410]
lea edx, [ebp - 0x1fc]
lea edx, [edx + eax*2]
test edx, edx
je 0x1000c9fe
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x408], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x420]
jne 0x1000c9dc
sub ecx, dword [ebp - 0x408]
sar ecx, 1
je 0x1000c9fe
push edx
call fcn.1002a79a
pop ecx
mov dword [ebx], eax
mov ecx, dword [ebp - 0x42c]
mov eax, dword [ecx + 4]
cmp dword [ecx + 8], eax
je 0x1000ca14
mov dword [eax], ebx
add dword [ecx + 4], 4
jmp 0x1000ca21
lea edx, [ebp - 0x428]
push edx
push eax
call fcn.10004121
mov ebx, dword [ebp - 0x40c]
mov eax, dword [ebp - 0x424]
inc eax
mov dword [ebp - 0x424], eax
cmp eax, dword [ebp - 0x430]
jl 0x1000c910
push 0x8000
push 0x1000
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ebx
jmp 0x1000ca60
xor al, al
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.100206ba
leave
ret 8