Function at 0x10002670
Capabilities:
Allocate or change rwx memory
Check for software breakpoints
Execute shellcode via indirect call

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x14]
push ebx
push ebp
xor ebp, ebp
push esi
cmp eax, ebp
push edi
mov dword [esp + 0x10], ebp
je 0x10002687
mov dword [eax], ebp
mov ebx, dword [esp + 0x28]
cmp ebx, ebp
je 0x10002691
mov dword [ebx], ebp
mov esi, dword [esp + 0x2c]
cmp esi, ebp
je 0x1000269b
mov dword [esi], ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x1000bee8], eax
je 0x100026b8
pop edi
pop esi
pop ebp
mov eax, 0x10dd
pop ebx
add esp, 8
ret 0x14
mov eax, dword [0x1000beec]
cmp eax, ebp
jne 0x10002956
mov ecx, dword [esp + 0x1c]
cmp ecx, ebp
jne 0x100026dc
pop edi
pop esi
pop ebp
mov eax, 6
pop ebx
add esp, 8
ret 0x14
mov eax, dword [ecx]
cmp eax, ebp
jne 0x100026fc
pop edi
mov eax, 6
pop esi
pop ebp
mov dword [0x1000beec], eax
mov dword [0x1000bef0], ecx
pop ebx
add esp, 8
ret 0x14
push ebp
push eax
mov dword [esp + 0x30], ebp
call fcn.10002040
mov edi, eax
push 0
mov eax, dword [esp + 0x24]
mov dword [esp + 0x18], edi
push eax
call fcn.10002040
cmp eax, edi
mov dword [esp + 0x20], eax
jne 0x10002733
mov eax, dword [0x1000bee4]
test eax, eax
jne 0x100028f9
jmp 0x100028d1
test ebx, ebx
je 0x10002739
mov dword [ebx], edi
test esi, esi
je 0x1000273f
mov dword [esi], eax
push 0x18
call fcn.10003571
add esp, 4
mov dword [esp + 0x28], eax
test eax, eax
jne 0x1000275e
mov dword [esp + 0x10], 8
jmp 0x100028d1
push edi
call fcn.10002960
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x1000277a
mov dword [esp + 0x10], 8
jmp 0x100028d1
mov eax, dword [esp + 0x24]
test eax, eax
je 0x10002784
mov dword [eax], ebp
mov eax, edi
xor ebx, ebx
lea ecx, [esp + 0x24]
lea edx, [ebx + ebp]
push ecx
push 0
push eax
push edx
mov esi, eax
mov dword [esp + 0x34], 0
call fcn.10002c30
mov ecx, dword [esp + 0x24]
test ecx, ecx
jne 0x10002806
mov cl, byte [esi]
mov ebx, eax
sub ebx, edi
cmp cl, 0xe9
je 0x10002806
cmp cl, 0xe0
je 0x10002806
cmp cl, 0xc2
je 0x10002806
cmp cl, 0xc3
je 0x10002806
cmp cl, 0xcc
je 0x10002806
cmp cl, 0xff
jne 0x100027d5
cmp byte [esi + 1], 0x25
je 0x10002806
cmp cl, 0x26
je 0x100027f3
cmp cl, 0x2e
je 0x100027f3
cmp cl, 0x36
je 0x100027f3
cmp cl, 0xe3
je 0x100027f3
cmp cl, 0x64
je 0x100027f3
cmp cl, 0x65
jne 0x100027ff
cmp byte [esi + 1], 0xff
jne 0x100027ff
cmp byte [esi + 2], 0x25
je 0x10002806
cmp ebx, 5
jge 0x10002825
jmp 0x10002788
cmp ebx, 5
jge 0x10002825
mov eax, dword [0x1000bee4]
mov dword [esp + 0x10], 9
test eax, eax
jne 0x100028db
jmp 0x100028d1
cmp ebx, 0x12
jbe 0x10002837
mov dword [esp + 0x10], 6
jmp 0x100028d1
mov eax, dword [esp + 0x20]
lea ecx, [ebp + 0x17]
mov dword [ebp + 0x1c], eax
lea edx, [ebx + edi]
lea eax, [ebx + ebp]
mov dword [ebp + 0x18], edx
mov byte [ecx], bl
lea esi, [eax + 5]
mov byte [eax], 0xe9
inc eax
sub edx, esi
lea edi, [eax + 4]
mov dword [eax], edx
cmp edi, ecx
jae 0x10002873
sub ecx, edi
mov eax, 0xcccccccc
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 0x2c]
push eax
push 0x40
push ebx
mov ebx, dword [esp + 0x20]
push ebx
mov dword [esp + 0x3c], 0
call edi
test eax, eax
je 0x100028c7
push ebx
call fcn.10002b90
mov esi, eax
add esp, 4
test esi, esi
je 0x10002928
cmp word [esi + 0x1c], 0x6544
je 0x10002928
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], 0
push ecx
push 0x40
push 0x40
push esi
call edi
test eax, eax
jne 0x10002910
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x10]
mov dword [0x1000beec], edx
test ebp, ebp
je 0x100028e8
push ebp
call fcn.100022f0
add esp, 4
mov eax, dword [esp + 0x28]
test eax, eax
je 0x100028f9
push eax
call fcn.10003210
add esp, 4
mov eax, dword [esp + 0x1c]
pop edi
pop esi
mov dword [0x1000bef0], eax
mov eax, dword [esp + 8]
pop ebp
pop ebx
add esp, 8
ret 0x14
mov word [esi + 0x1c], 0x6544
mov word [esi + 0x1e], 0x6f74
mov word [esi + 0x20], 0x7275
mov word [esi + 0x22], 0x2173
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x1c]
mov dword [eax + 4], 0
mov dword [eax + 8], ecx
mov dword [eax + 0x10], ebp
mov dword [eax + 0xc], ebx
mov edx, dword [esp + 0x2c]
mov dword [eax + 0x14], edx
mov ecx, dword [0x1000bef8]
mov dword [eax], ecx
mov dword [0x1000bef8], eax
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0x14