Function at 0x1002c860
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x100b400c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x100bd214]
test eax, eax
push ebx
push esi
push edi
mov edi, ecx
mov ecx, 1
cmove eax, ecx
mov ecx, edi
mov dword [0x100bd214], eax
call fcn.10028300
call fcn.10028060
call fcn.10021a50
mov ecx, dword [0x100bbbd0]
test ecx, ecx
jne 0x1002c8b0
mov dword [0x100bb4cc], 0x32
jmp 0x1002c8e4
cmp ecx, 1
jne 0x1002c8c1
mov dword [0x100bb4cc], 6
jmp 0x1002c8e4
cmp ecx, 2
jne 0x1002c8d2
mov dword [0x100bb4cc], 5
jmp 0x1002c8e4
mov eax, dword [0x100bb4cc]
xor edx, edx
cmp ecx, 3
cmove eax, edx
mov dword [0x100bb4cc], eax
call fcn.10016850
test eax, eax
je 0x1002c946
push 0x75
mov dword [0x100bbe7c], 0x10016b60
call fcn.10016b60
cwde
shr eax, 0x10
test eax, eax
je 0x1002c93f
cmp byte [0x100c0300], 0
je 0x1002c926
cmp dword [0x100c0304], 0
je 0x1002c946
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x100c0304], eax
ja 0x1002c946
xor eax, eax
mov byte [0x100c0300], 1
cmp dword [0x100baee4], eax
sete al
mov dword [0x100baee4], eax
jmp 0x1002c946
mov byte [0x100c0300], 0
call fcn.1001f960
call fcn.1001f690
mov ecx, edi
call fcn.1001fad0
call fcn.10024f40
mov ecx, edi
call fcn.10021700
call fcn.10023bc0
mov ecx, dword [0x100bb778]
mov eax, dword [0x100b72f4]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [eax], 0
je 0x1002c9c9
cmp dword [0x100bbb84], 0
jne 0x1002c999
cmp dword [0x100bc894], 0
je 0x1002c9c9
mov ecx, dword [0x100bb778]
mov eax, dword [0x100b72f4]
add eax, 0x1a4
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov ebx, eax
cmp ebx, 0x1000
jbe 0x1002ca03
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push ebx
call esi
mov byte [ebx], 0xcc
jmp 0x1002c9f7
mov ecx, dword [0x100bb778]
mov eax, dword [0x100b72f4]
add eax, 0x1a4
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov ebx, eax
cmp ebx, 0x1000
jbe 0x1002ca03
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push ebx
call esi
mov byte [ebx], 0x6a
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push ebx
call esi
mov ecx, edi
call fcn.10023550
mov ecx, edi
call fcn.100226e0
mov ecx, edi
call fcn.10022d70
call fcn.10022fb0
call fcn.100230b0
call fcn.100243b0
call fcn.10024820
call fcn.100242b0
call fcn.100252c0
cmp dword [0x100baf24], 0
je 0x1002caec
mov ecx, dword [0x100bb778]
mov eax, dword [0x100b72f4]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x1002caec
push 0x20
mov dword [0x100bbe7c], 0x10016b60
call fcn.10016b60
cwde
shr eax, 0x10
test eax, eax
je 0x1002cae5
cmp byte [0x100c0058], 0
je 0x1002caa0
cmp dword [0x100c005c], 0
je 0x1002caec
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
mov ecx, dword [0x100c005c]
inc ecx
cmp ecx, eax
ja 0x1002caec
jmp 0x1002caa6
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov byte [0x100c0058], 1
call ebx
mov ecx, dword [0x100bb778]
mov dword [0x100c005c], eax
mov eax, dword [0x100b72f4]
add eax, 0x17c
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea ebx, [eax + 2]
cmp ebx, 0x1000
jbe 0x1002cb27
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push ebx
call esi
mov byte [ebx], 3
jmp 0x1002cb1b
mov byte [0x100c0058], 0
mov ecx, dword [0x100bb778]
mov eax, dword [0x100b72f4]
add eax, 0x17c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
lea ebx, [eax + 2]
cmp ebx, 0x1000
jbe 0x1002cb27
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push ebx
call esi
mov byte [ebx], 0x44
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push ebx
call esi
call fcn.10024b50
call fcn.10024c00
call fcn.100256d0
call fcn.10025810
call fcn.10024180
call fcn.10023fa0
cmp dword [0x100bb71c], 0
jle 0x1002cb97
mov ecx, dword [0x100bb778]
mov eax, dword [0x100b72f4]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x1002cb97
mov ecx, dword [0x100bb778]
mov eax, dword [0x100b72f4]
add eax, 0x164
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov ebx, eax
cmp ebx, 0x1000
jbe 0x1002cbd1
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push ebx
call esi
mov byte [ebx], 0xcc
jmp 0x1002cbc5
mov ecx, dword [0x100bb778]
mov eax, dword [0x100b72f4]
add eax, 0x164
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov ebx, eax
cmp ebx, 0x1000
jbe 0x1002cbd1
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push ebx
call esi
mov byte [ebx], 0x55
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push ebx
call esi
call fcn.10025520
call fcn.100231b0
call fcn.10025610
call fcn.10025080
call fcn.10025160
call fcn.10024d70
call fcn.10024e10
call fcn.10027ca0
call fcn.100279b0
mov ecx, edi
call fcn.10027d30
call fcn.1002c440
call fcn.10025970
call fcn.100277e0
call fcn.100272e0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1007d0d9
mov esp, ebp
pop ebp
ret