Function at 0x1002c9d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x102e1878]
test eax, eax
je 0x1002cddf
cmp eax, 1
je 0x1002cba9
cmp eax, 2
je 0x1002cba9
mov eax, dword [ebp + 8]
push esi
cmp eax, 2
jne 0x1002cbdf
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp + 0xc]
push eax
push 0x40
push 5
push 0x785b44
call esi
mov eax, 0x785b44
mov dword [eax], 0x90909090
mov byte [eax + 4], 0x90
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 0xc]
push 5
push 0x785b44
call esi
push 0x1002c0a0
push 0x78adcc
push 0xe8
call fcn.100d0e40
push 0x1002c0a0
push 0x78ae15
push 0xe8
call fcn.100d0e40
push 0x1002c0a0
push 0x78ae5e
push 0xe8
call fcn.100d0e40
push 0x1002bc80
push 0x78b09a
push 0xe8
call fcn.100d0e40
push 0x1002be60
push 0x78b0cf
push 0xe8
call fcn.100d0e40
push 0x1002a460
push 0x787620
push 0xe8
call fcn.100d0e40
add esp, 0x48
push 0x1002bbf0
push 0x787748
push 0xe8
call fcn.100d0e40
push 0x1002a9d0
push 0x787628
push 0xe8
call fcn.100d0e40
push 0x1002ba00
push 0x7864b3
push 0xe8
call fcn.100d0e40
push 0x1002ba00
push 0x78641e
push 0xe8
call fcn.100d0e40
push 0x1002ba00
push 0x7863a8
push 0xe8
call fcn.100d0e40
push 0x1002ba00
push 0x786347
push 0xe8
call fcn.100d0e40
add esp, 0x48
push 0x1002ba00
push 0x7862e2
push 0xe8
call fcn.100d0e40
push 0x1002ba00
push 0x78628e
push 0xe8
call fcn.100d0e40
push 0x1002a450
push 0x857dc0
push 0xe9
call fcn.100d0e40
push 0x1002a440
push 0x7d2e50
push 0xe9
call fcn.100d0e40
push 0x1002a430
push 0x78b0f0
push 0xe9
call fcn.100d0e40
push 0x1002a420
push 0x787ba0
push 0xe9
call fcn.100d0e40
add esp, 0x48
pop esi
pop ebp
ret 8
cmp dword [ebp + 0xc], 1
jne 0x1002c9f5
mov eax, 0x861110
call eax
mov ecx, dword [0x11479250]
mov edx, 0x785870
push 0x180
add ecx, 0xba
push ecx
push dword [eax + 0x10]
mov ecx, dword [eax + 0xc]
push dword [eax]
call edx
pop ebp
ret 8
cmp eax, 1
jne 0x1002cdde
push 0x1002c9b0
push 0x7864b3
push 0xe8
call fcn.100d0e40
push 0x1002c9b0
push 0x78641e
push 0xe8
call fcn.100d0e40
push 0x1002c9b0
push 0x7863a8
push 0xe8
call fcn.100d0e40
push 0x1002c9b0
push 0x786347
push 0xe8
call fcn.100d0e40
push 0x1002c9b0
push 0x7862e2
push 0xe8
call fcn.100d0e40
push 0x1002c9b0
push 0x78628e
push 0xe8
call fcn.100d0e40
add esp, 0x48
push 0x1002c970
push 0x789084
push 0xe9
call fcn.100d0e40
push 0x1002c920
push 0x7890c6
push 0xe9
call fcn.100d0e40
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp + 8]
add esp, 0x18
push eax
push 0x40
push 5
push 0x785b44
call esi
mov eax, 0x785b44
mov dword [eax], 0x90909090
mov byte [eax + 4], 0x90
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
push 5
push 0x785b44
call esi
lea eax, [ebp + 8]
push eax
push 0x40
push 5
push 0x787628
call esi
mov eax, 0x787628
mov dword [eax], 0x90909090
mov byte [eax + 4], 0x90
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
push 5
push 0x787628
call esi
lea eax, [ebp + 8]
push eax
push 0x40
push 5
push 0x787630
call esi
mov eax, 0x787630
mov dword [eax], 0x90909090
mov byte [eax + 4], 0x90
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
push 5
push 0x787630
call esi
push 0x1002c470
push 0x78b09a
push 0xe8
call fcn.100d0e40
push 0x1002c4d0
push 0x78b0cf
push 0xe8
call fcn.100d0e40
push 0x1002c380
push 0x85a425
push 0xe9
call fcn.100d0e40
push 0x1002c440
push 0x785959
push 0xe9
call fcn.100d0e40
push 0x1002c8d0
push 0x78770e
push 0xe9
call fcn.100d0e40
push 0x1002c410
push 0x785a54
push 0xe9
call fcn.100d0e40
add esp, 0x48
push 0x1002c140
push 0x787620
push 0xe8
call fcn.100d0e40
add esp, 0xc
cmp dword [ebp + 0xc], 0
je 0x1002cdde
mov eax, 0x861110
call eax
mov ecx, dword [0x11479250]
mov edx, 0x785870
push 0x180
add ecx, 0xba
push ecx
push dword [eax + 0x10]
mov ecx, dword [eax + 0xc]
push dword [eax]
call edx
pop esi
pop ebp
ret 8