Function at 0x1002b3a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x100b700c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x100c0204]
test eax, eax
push ebx
mov ebx, ecx
mov ecx, 1
push esi
cmove eax, ecx
push edi
mov dword [0x100c0204], eax
call fcn.10028980
call fcn.10022170
mov ecx, dword [0x100bebc0]
test ecx, ecx
jne 0x1002b3e9
mov dword [0x100be4c0], 0x32
jmp 0x1002b41d
cmp ecx, 1
jne 0x1002b3fa
mov dword [0x100be4c0], 6
jmp 0x1002b41d
cmp ecx, 2
jne 0x1002b40b
mov dword [0x100be4c0], 5
jmp 0x1002b41d
mov eax, dword [0x100be4c0]
xor edx, edx
cmp ecx, 3
cmove eax, edx
mov dword [0x100be4c0], eax
call fcn.10016f60
test eax, eax
je 0x1002b47f
push 0x75
mov dword [0x100bee68], 0x10017270
call fcn.10017270
cwde
shr eax, 0x10
test eax, eax
je 0x1002b478
cmp byte [0x100c3338], 0
je 0x1002b45f
cmp dword [0x100c333c], 0
je 0x1002b47f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x100c333c], eax
ja 0x1002b47f
xor eax, eax
mov byte [0x100c3338], 1
cmp dword [0x100bded4], eax
sete al
mov dword [0x100bded4], eax
jmp 0x1002b47f
mov byte [0x100c3338], 0
call fcn.10020070
call fcn.1001fda0
mov ecx, ebx
call fcn.100201f0
call fcn.10025820
mov ecx, ebx
call fcn.10021e20
call fcn.100243e0
mov ecx, dword [0x100be768]
mov eax, dword [0x100ba2dc]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [eax], 0
je 0x1002b502
cmp dword [0x100beb74], 0
jne 0x1002b4d2
cmp dword [0x100bf884], 0
je 0x1002b502
mov ecx, dword [0x100be768]
mov eax, dword [0x100ba2dc]
add eax, 0x1a4
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x1002b53c
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0xcc
jmp 0x1002b530
mov ecx, dword [0x100be768]
mov eax, dword [0x100ba2dc]
add eax, 0x1a4
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x1002b53c
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0x6a
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push edi
call esi
mov ecx, ebx
call fcn.10023d70
mov ecx, ebx
call fcn.10022e00
mov ecx, ebx
call fcn.10023490
call fcn.100236d0
call fcn.100237d0
call fcn.10024c90
call fcn.10025100
call fcn.10024b90
call fcn.10025c20
cmp dword [0x100bdf14], 0
je 0x1002b625
mov ecx, dword [0x100be768]
mov eax, dword [0x100ba2dc]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x1002b625
push 0x20
mov dword [0x100bee68], 0x10017270
call fcn.10017270
cwde
shr eax, 0x10
test eax, eax
je 0x1002b61e
cmp byte [0x100c3090], 0
je 0x1002b5d9
cmp dword [0x100c3094], 0
je 0x1002b625
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov ecx, dword [0x100c3094]
inc ecx
cmp ecx, eax
ja 0x1002b625
jmp 0x1002b5df
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov byte [0x100c3090], 1
call edi
mov ecx, dword [0x100be768]
mov dword [0x100c3094], eax
mov eax, dword [0x100ba2dc]
add eax, 0x17c
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea edi, [eax + 2]
cmp edi, 0x1000
jbe 0x1002b660
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 3
jmp 0x1002b654
mov byte [0x100c3090], 0
mov ecx, dword [0x100be768]
mov eax, dword [0x100ba2dc]
add eax, 0x17c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
lea edi, [eax + 2]
cmp edi, 0x1000
jbe 0x1002b660
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0x44
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push edi
call esi
call fcn.10025430
call fcn.100254e0
call fcn.10026030
call fcn.10026170
call fcn.10024a60
call fcn.10024880
cmp dword [0x100be710], 0
jle 0x1002b71b
mov ecx, dword [0x100be768]
mov eax, dword [0x100ba2dc]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x1002b71b
mov eax, dword [0x100be710]
cmp eax, 1
jne 0x1002b6ba
mov dword [0x100c2bf4], 0x42c80000
jmp 0x1002b6eb
cmp eax, 2
jne 0x1002b6cb
mov dword [0x100c2bf4], 0x42dc0000
jmp 0x1002b6eb
cmp eax, 3
jne 0x1002b6dc
mov dword [0x100c2bf4], 0x42f00000
jmp 0x1002b6eb
cmp eax, 4
jne 0x1002b6eb
mov dword [0x100c2bf4], 0x42fa0000
mov ecx, dword [0x100be768]
mov eax, dword [0x100ba2dc]
add eax, 0x164
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x1002b755
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0xcc
jmp 0x1002b749
mov ecx, dword [0x100be768]
mov eax, dword [0x100ba2dc]
add eax, 0x164
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x1002b755
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0x55
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push edi
call esi
call fcn.10025e80
call fcn.100238d0
call fcn.10025f70
call fcn.10025960
call fcn.10025a40
call fcn.10025650
call fcn.100256f0
call fcn.10028600
call fcn.10028310
mov ecx, ebx
call fcn.10028690
call fcn.1002af80
call fcn.100262d0
call fcn.10028140
call fcn.10027c40
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1007f7c9
mov esp, ebp
pop ebp
ret