Function at 0x100adc90
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x88
mov eax, dword [0x1019813c]
mov esi, edx
mov edi, ecx
cmp eax, 2
jne 0x100ae0b7
mov cl, 1
xor eax, eax
lock cmpxchg byte [0x10198144], cl
jne 0x100ae0ce
mov eax, dword [0x1019913c]
test eax, 0x7fffffff
jne 0x100ae0e9
xor ebx, ebx
movzx eax, byte [0x10198145]
test al, al
jne 0x100ae102
movzx eax, byte [esi + 0x50]
test al, al
sete al
xor al, byte [esp + 0x9c]
je 0x100add04
mov dword [edi], 0x8000000d
test bl, bl
jne 0x100ae081
jmp 0x100ae071
mov edx, dword [esi + 0x48]
lea ecx, [esp + 8]
push dword [esi + 0x4c]
call fcn.100ac8b0
add esp, 4
mov ebp, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
cmp ebp, 0x80000005
jne 0x100ae065
mov ecx, dword [0x10199018]
mov dword [esp + 0x24], eax
cmp ecx, 4
jne 0x100ae163
mov ecx, edx
mov dword [esp + 0x4c], 1
mov dword [esp], edx
mov dword [esp + 0x30], 0x80000005
add ecx, eax
mov eax, 0xffffffff
mov dword [esp + 0x48], ecx
cmovae eax, ecx
mov ecx, dword [0x10199028]
cmp eax, ecx
cmovae eax, ecx
mov ecx, dword [0x10199024]
cmp edx, ecx
cmova ecx, edx
mov dword [esp + 0x50], ecx
lea ecx, [esp + 0x30]
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], edx
lea edx, [esp + 0x4c]
mov dword [esp + 0x5c], ecx
lea ecx, [esp + 0x74]
call fcn.100ae290
cmp byte [esp + 0x86], 2
jne 0x100addd4
mov ebp, dword [esp + 0x30]
cmp ebp, 0x80000005
jne 0x100ae037
mov edx, dword [esp]
mov dword [esp + 0x2c], esi
mov dword [esp + 4], ebx
mov ebx, 4
xor esi, esi
mov dword [esp + 0x28], 0
jmp 0x100adecf
mov dword [esp + 0x2c], esi
mov dword [esp + 0x20], edi
mov dword [esp + 4], ebx
xor ecx, ecx
mov edx, 0x50
movzx eax, byte [0x10199148]
call fcn.100ea7d0
test eax, eax
je 0x100ae271
mov ebx, eax
mov eax, dword [esp + 0x84]
mov esi, 1
mov edi, 0x14
lea ebp, [esp + 0x60]
mov dword [ebx + 0x10], eax
movsd xmm0, qword [esp + 0x74]
movsd xmm1, qword [esp + 0x7c]
movsd qword [ebx + 8], xmm1
movsd qword [ebx], xmm0
mov dword [esp + 0x3c], 4
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], 1
mov eax, dword [esp + 0x5c]
movsd xmm0, qword [esp + 0x4c]
movsd xmm1, qword [esp + 0x54]
mov dword [esp + 0x70], eax
movsd qword [esp + 0x68], xmm1
movsd qword [esp + 0x60], xmm0
jmp 0x100ade87
mov eax, dword [esp + 0x18]
inc esi
mov dword [ebx + edi + 0x10], eax
movsd xmm0, qword [esp + 8]
movsd xmm1, qword [esp + 0x10]
movsd qword [ebx + edi + 8], xmm1
movsd qword [ebx + edi], xmm0
mov dword [esp + 0x44], esi
add edi, 0x14
lea ecx, [esp + 8]
mov edx, ebp
call fcn.100ae290
cmp byte [esp + 0x1a], 2
je 0x100adeb0
cmp esi, dword [esp + 0x3c]
jne 0x100ade60
lea ecx, [esp + 0x3c]
mov edx, esi
call fcn.101130b0
mov ebx, dword [esp + 0x40]
jmp 0x100ade60
mov ebp, dword [esp + 0x30]
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp]
cmp ebp, 0x80000005
jne 0x100ae0a5
mov edi, dword [esp + 0x20]
mov dword [esp + 0x28], ecx
lea ecx, [esp + 8]
push dword [esp + 0x24]
call fcn.100ac8b0
add esp, 4
mov ebp, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
cmp ebp, 0x80000005
jne 0x100ae041
lea edx, [esp + 8]
mov dword [esp + 8], 0
push edx
push 0x40
push eax
push ecx
call dword [sym.imp.kernel32.dll_VirtualProtect]
test eax, eax
je 0x100ae12e
test esi, esi
mov dword [esp + 0x20], edi
je 0x100adf44
mov eax, dword [esp]
mov ebp, dword [esp + 0x48]
mov edi, 0xffffffff
mov dword [ebx], eax
lea eax, [esi + esi*4]
mov ecx, dword [ebx + eax*4 - 8]
mov edx, dword [ebx + eax*4 - 0x14]
add edx, ecx
cmovae edi, edx
add ebp, ecx
sub ebp, edi
mov dword [ebx + eax*4 - 8], ebp
mov ebp, dword [esp + 0x2c]
lea edx, [ebp + 0x38]
lea edi, [ebp + 0x44]
lea ecx, [ebp + 0x10]
lea eax, [ebp + 4]
mov dword [esp], edx
movzx edx, byte [esp + 0x9c]
test dl, dl
mov byte [esp + 0x24], dl
cmove edi, dword [esp]
cmovne eax, ecx
mov ecx, dword [ebp + 0x4c]
mov edx, dword [edi]
cmp ecx, edx
jne 0x100ae280
push ecx
push dword [eax + 0x30]
push dword [ebp + 0x48]
call fcn.10100490
add esp, 0xc
movzx eax, byte [esp + 0x24]
test esi, esi
xchg byte [ebp + 0x50], al
lea ebp, [esp + 8]
mov eax, dword [esp + 0x20]
mov dword [eax], 0x8000000d
je 0x100ae205
lea eax, [esi + esi*4]
mov edi, ebx
lea eax, [ebx + eax*4]
mov dword [esp], eax
nop word cs:[eax + eax]
nop dword [eax + eax]
mov edx, dword [edi]
mov esi, dword [edi + 4]
mov ecx, ebp
push dword [edi + 0xc]
call fcn.100ac8b0
add esp, 4
mov ebp, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
cmp ebp, 0x80000005
jne 0x100ae186
cmp esi, 8
mov dword [esp + 0x74], esi
jae 0x100ae22b
mov ecx, 0xfb
bt ecx, esi
jae 0x100ae22b
mov ecx, dword [esi*4 + 0x101906f0]
lea ebp, [esp + 8]
mov dword [esp + 8], 0
push ebp
push ecx
push eax
push edx
call dword [sym.imp.kernel32.dll_VirtualProtect]
test eax, eax
je 0x100ae18a
add edi, 0x14
cmp edi, dword [esp]
jne 0x100adfc0
jmp 0x100ae205
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
jmp 0x100ae065
mov edx, ecx
cmp dword [esp + 0x28], 0
je 0x100ae061
push ebx
push 0
push dword [0x101990e0]
mov esi, edx
mov ebx, eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, ebx
mov edx, esi
mov ebx, dword [esp + 4]
mov dword [edi], ebp
mov dword [edi + 4], edx
mov dword [edi + 8], eax
test bl, bl
jne 0x100ae081
mov eax, dword [0x1019913c]
test eax, 0x7fffffff
jne 0x100ae14a
xor eax, eax
xchg byte [0x10198144], al
cmp al, 2
jne 0x100ae09a
lea eax, [0x10198144]
push eax
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_WakeByAddressSingle]
add esp, 0x88
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
mov edi, dword [esp + 0x20]
test ecx, ecx
jne 0x100ae04a
jmp 0x100ae061
call fcn.10113030
mov cl, 1
xor eax, eax
lock cmpxchg byte [0x10198144], cl
je 0x100adcbe
lea ecx, [0x10198144]
call fcn.101149f0
mov eax, dword [0x1019913c]
test eax, 0x7fffffff
je 0x100adcce
call fcn.10114a90
mov ebx, eax
xor bl, 1
movzx eax, byte [0x10198145]
test al, al
je 0x100adcdf
lea eax, [0x10198144]
mov ecx, str.called__Result::unwrap____on_an__Err__value
mov edx, 0x2b
mov dword [esp + 8], eax
mov byte [esp + 0xc], bl
lea eax, [esp + 8]
push 0x101842e4
push 0x10183fac
push eax
call fcn.1010d2e0
mov ebp, 0x80000003
call sub.kernel32.dll_GetLastError
xor edx, edx
cmp dword [esp + 0x28], 0
jne 0x100ae04a
jmp 0x100ae061
call fcn.10114a90
test al, al
jne 0x100ae081
mov byte [0x10198145], 1
jmp 0x100ae081
lea ecx, [esp + 0x60]
mov byte [esp + 0x60], 1
mov ebp, edx
mov dword [esp + 8], ecx
lea ecx, [esp + 8]
call fcn.10112d70
mov eax, dword [esp + 0x24]
mov edx, ebp
jmp 0x100add41
mov esi, edx
jmp 0x100ae196
mov ebp, 0x80000003
xor esi, esi
call sub.kernel32.dll_GetLastError
lea ecx, [ebp - 0x80000000]
mov edx, 2
cmp ecx, 5
cmovb edx, ecx
cmp edx, 3
je 0x100ae1b8
cmp edx, 2
jne 0x100ae205
test ebp, ebp
je 0x100ae205
push esi
jmp 0x100ae1f7
mov ecx, esi
cmp cl, 3
jne 0x100ae205
mov esi, dword [eax + 4]
mov edi, dword [eax]
mov ecx, dword [esi]
test ecx, ecx
je 0x100ae1d4
push edi
mov ebp, eax
call ecx
mov eax, ebp
add esp, 4
cmp dword [esi + 4], 0
je 0x100ae1f6
cmp dword [esi + 8], 9
jb 0x100ae1e3
mov edi, dword [edi - 4]
mov esi, eax
push edi
push 0
push dword [0x101990e0]
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, esi
push eax
push 0
push dword [0x101990e0]
call dword [sym.imp.kernel32.dll_HeapFree]
cmp dword [esp + 0x28], 0
je 0x100ae21b
push ebx
push 0
push dword [0x101990e0]
call dword [sym.imp.kernel32.dll_HeapFree]
cmp byte [esp + 4], 0
jne 0x100ae081
jmp 0x100ae071
lea ecx, [esp + 0x60]
lea eax, [esp + 0x74]
mov dword [esp + 8], 0x10183f00
mov dword [esp + 0xc], 1
mov dword [esp + 0x18], 0
mov edx, 0x10183f08
mov dword [esp + 0x10], ecx
lea ecx, [esp + 8]
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], 0x100aaa50
mov dword [esp + 0x14], 1
call fcn.1010cf40
mov ecx, 4
mov edx, 0x50
call fcn.1010cb60
push 0x10184438
call fcn.1010d550
int3