Function at 0x100185f0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
push ebx
push esi
push edi
test cl, cl
je 0x10018611
mov dword [0x10097f44], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x10097f44]
cmp eax, 0xa
jge 0x10018624
inc eax
mov dword [0x10097f44], eax
cmp eax, 0xa
jne 0x100189cc
push str.Applying_drug_dealer_fix..._n
call fcn.10015060
mov eax, dword [0x100bfbfc]
add esp, 4
mov eax, dword [eax + 0x15aec]
mov dword [ebp - 0x18], eax
mov edi, dword [eax]
cmp edi, eax
je 0x100189b5
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, 0x12c
mov dword [ebp - 0x10], 0xfe
movzx esi, word [edi + 8]
cmp si, cx
jbe 0x100189ab
mov edx, dword [edi + 0xc]
cmp edx, dword [edi + 0x10]
je 0x100189ab
nop word [eax + eax]
movzx ecx, word [edx]
cmp ecx, 0x1c
je 0x100186a5
cmp ecx, 0x1d
je 0x100186a5
cmp ecx, 0x1e
je 0x100186a5
cmp cx, word [ebp - 0x10]
je 0x100186a5
add edx, 2
cmp edx, dword [edi + 0x10]
jne 0x10018680
jmp 0x100189a6
mov ecx, dword [0x100bfd24]
mov eax, esi
mov edx, dword [0x100bfd28]
cmp ecx, edx
je 0x100186c3
cmp word [ecx], si
je 0x100186c3
add ecx, 2
cmp ecx, edx
jne 0x100186b7
push eax
cmp ecx, edx
mov eax, str._uSP_n
mov ecx, 0x10087814
cmove eax, ecx
push eax
call fcn.10015060
add esp, 8
mov dword [ebp - 0xc], 0x476d56
lea eax, [ebp - 0x9c]
lea ecx, [ebp - 0xc]
push eax
call fcn.1000b390
mov dword [ebp - 0x24], 1
mov esi, dword [eax]
lea eax, [ebp - 0x20]
push eax
push 0x40
push 1
push esi
mov dword [ebp - 8], esi
mov dword [ebp - 0x28], esi
call ebx
test eax, eax
setne byte [ebp - 0x1c]
mov cl, byte [esi]
mov byte [ebp - 1], cl
test eax, eax
je 0x10018731
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0xc]
push ecx
push eax
push dword [ebp - 0x24]
mov dword [ebp - 0xc], eax
push dword [ebp - 0x28]
call ebx
mov cl, byte [ebp - 1]
movzx eax, cl
sub eax, 0xe8
je 0x100187d8
sub eax, 1
je 0x100187d8
sub eax, 0x16
jne 0x100187d4
lea eax, [ebp - 0x30]
mov dword [ebp - 0x34], 1
push eax
push 0x40
inc esi
push 1
push esi
mov dword [ebp - 0x38], esi
call ebx
test eax, eax
setne byte [ebp - 0x2c]
mov cl, byte [esi]
mov byte [ebp - 1], cl
test eax, eax
je 0x1001878c
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0xc]
push ecx
push eax
push dword [ebp - 0x34]
mov dword [ebp - 0xc], eax
push dword [ebp - 0x38]
call ebx
mov cl, byte [ebp - 1]
cmp cl, 0x15
je 0x10018796
cmp cl, 0x25
jne 0x100187d4
mov esi, dword [ebp - 8]
lea eax, [ebp - 0x40]
push eax
push 0x40
add esi, 2
mov dword [ebp - 0x44], 4
push 4
push esi
mov dword [ebp - 0x48], esi
call ebx
test eax, eax
setne byte [ebp - 0x3c]
mov esi, dword [esi]
test eax, eax
je 0x100187d0
mov eax, dword [ebp - 0x40]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x44]
mov dword [ebp - 8], eax
push dword [ebp - 0x48]
call ebx
mov eax, dword [esi]
jmp 0x10018818
xor eax, eax
jmp 0x10018818
lea eax, [ebp - 0x50]
mov dword [ebp - 0x54], 4
push eax
push 0x40
inc esi
push 4
push esi
mov dword [ebp - 0x58], esi
call ebx
test eax, eax
setne byte [ebp - 0x4c]
mov ecx, dword [esi]
mov dword [ebp - 0xc], ecx
test eax, eax
je 0x10018813
mov eax, dword [ebp - 0x50]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x54]
mov dword [ebp - 8], eax
push dword [ebp - 0x58]
call ebx
mov ecx, dword [ebp - 0xc]
lea eax, [esi + 4]
add eax, ecx
mov ecx, dword [0x476d51]
push 0x13
call eax
movzx eax, ax
lea ecx, [ebp - 8]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0xa0]
push eax
mov dword [ebp - 8], 0x476d86
call fcn.1000b390
mov dword [ebp - 0x64], 1
mov esi, dword [eax]
lea eax, [ebp - 0x60]
push eax
push 0x40
push 1
push esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x68], esi
call ebx
test eax, eax
setne byte [ebp - 0x5c]
mov cl, byte [esi]
mov byte [ebp - 1], cl
test eax, eax
je 0x1001887d
mov eax, dword [ebp - 0x60]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x64]
mov dword [ebp - 8], eax
push dword [ebp - 0x68]
call ebx
mov cl, byte [ebp - 1]
movzx eax, cl
sub eax, 0xe8
je 0x10018930
sub eax, 1
je 0x10018930
sub eax, 0x16
jne 0x1001892c
lea eax, [ebp - 0x70]
mov dword [ebp - 0x74], 1
push eax
push 0x40
inc esi
push 1
push esi
mov dword [ebp - 0x78], esi
call ebx
test eax, eax
setne byte [ebp - 0x6c]
mov cl, byte [esi]
mov byte [ebp - 1], cl
test eax, eax
je 0x100188d8
mov eax, dword [ebp - 0x70]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x74]
mov dword [ebp - 8], eax
push dword [ebp - 0x78]
call ebx
mov cl, byte [ebp - 1]
cmp cl, 0x15
je 0x100188e2
cmp cl, 0x25
jne 0x1001892c
mov esi, dword [ebp - 0xc]
lea eax, [ebp - 0x80]
push eax
push 0x40
add esi, 2
mov dword [ebp - 0x84], 4
push 4
push esi
mov dword [ebp - 0x88], esi
call ebx
test eax, eax
setne byte [ebp - 0x7c]
mov esi, dword [esi]
test eax, eax
je 0x10018928
mov eax, dword [ebp - 0x80]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x84]
mov dword [ebp - 8], eax
push dword [ebp - 0x88]
call ebx
mov eax, dword [esi]
jmp 0x10018985
xor eax, eax
jmp 0x10018985
lea eax, [ebp - 0x90]
mov dword [ebp - 0x94], 4
push eax
push 0x40
inc esi
push 4
push esi
mov dword [ebp - 0x98], esi
call ebx
test eax, eax
setne byte [ebp - 0x8c]
mov ecx, dword [esi]
mov dword [ebp - 0xc], ecx
test eax, eax
je 0x10018980
mov eax, dword [ebp - 0x90]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp - 0x94]
mov dword [ebp - 8], eax
push dword [ebp - 0x98]
call ebx
mov ecx, dword [ebp - 0xc]
lea eax, [ecx + 4]
add eax, esi
push ecx
movzx ecx, word [edi + 8]
mov dword [esp], 0xbf800000
push 0xffffffffffffffff
push 0
push 0x64
push ecx
push dword [ebp - 0x14]
mov ecx, dword [0x476d7d]
call eax
mov eax, dword [ebp - 0x18]
mov ecx, 0x12c
mov edi, dword [edi]
cmp edi, eax
jne 0x10018661
push 0x100877e8
call fcn.10015060
add esp, 4
mov dword [0x10097f44], 0xb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret