Function at 0x1015c38
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa4
mov eax, dword [0x1039074]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, ecx
mov eax, dword [ebx + 4]
push edi
mov edi, dword [eax]
mov eax, dword [eax + 4]
lea esi, [eax*8]
sub esi, eax
lea esi, [esi*4 + 0x103a324]
lea eax, [esi + 4]
push eax
mov dword [ebp - 0x9c], ebx
add edi, 0x1000000
mov dword [ebp - 0x84], 0
mov dword [ebp - 0xa4], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
add dword [esi], 0xffffffff
jne 0x101630a
xor esi, esi
lea ecx, [ebp - 0x80]
mov byte [ebp - 0x15], 0xa5
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], esi
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edi, edi
cmp dword [ebp - 0x7c], esi
mov dword [ebp - 0x6c], edi
jbe 0x10162c3
mov eax, dword [ebp - 0x80]
mov ecx, dword [eax + edi*8 + 4]
mov esi, dword [eax + edi*8]
and ecx, 0x7fffffff
add esi, 0x1000000
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x44]
cmp esi, ecx
mov dword [ebp - 0x74], esi
jb 0x1015cfc
mov edx, dword [ebp - 0x40]
add edx, ecx
mov ecx, dword [ebp - 0x30]
add ecx, esi
cmp ecx, edx
jbe 0x1015d8d
cmp dword [ebp - 0x34], 0
je 0x1015d1b
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x40]
lea edx, [ebp - 0x3c]
push edx
mov edx, dword [ebp - 0x44]
push eax
push ecx
push edx
call ebx
mov dword [ebp - 0x34], 0
cmp dword [ebp - 0x38], 0
je 0x1015d33
push 0x103a2f0
mov dword [ebp - 0x38], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0x30]
lea edx, [ecx + esi + 0xfff]
mov eax, esi
and eax, 0xfffff000
and edx, 0xfffff000
sub edx, eax
push 0x103a2f0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], edx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [ebp - 0x40]
mov edx, dword [ebp - 0x44]
lea eax, [ebp - 0x3c]
push eax
push 0x40
push ecx
push edx
mov dword [ebp - 0x38], 1
call ebx
test eax, eax
je 0x10162b9
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x34], 1
test esi, esi
je 0x10162b9
test dword [eax + edi*8 + 4], 0x80000000
jne 0x10162a8
mov edx, dword [eax + edi*8]
mov ebx, dword [0x103a30c]
sub ebx, 0x1000000
mov ecx, dword [ebp - 0x78]
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], 0
je 0x1015e6a
mov eax, dword [ebp - 0x30]
mov ecx, esi
mov esi, dword [0x1001eac]
sub ecx, 0x1000000
lea edx, [ecx + eax]
xor edi, edi
add esi, 0xffffffff
mov dword [ebp - 0x24], edx
js 0x1015e13
mov edi, edi
lea eax, [esi + edi]
cdq
sub eax, edx
sar eax, 1
mov edx, dword [eax*4 + 0x1001eb0]
and edx, 0xfffffff
cmp ecx, edx
jae 0x1015e06
lea esi, [eax - 1]
jmp 0x1015e0b
jbe 0x1015e11
lea edi, [eax + 1]
cmp esi, edi
jge 0x1015de8
jmp 0x1015e13
mov edi, eax
cmp edi, dword [0x1001eac]
jae 0x1015e6a
mov eax, dword [edi*4 + 0x1001eb0]
mov esi, eax
and esi, 0xfffffff
cmp esi, dword [ebp - 0x24]
jae 0x1015e6a
mov ecx, eax
add eax, eax
add eax, eax
sar eax, 0x1e
sar ecx, 0x1e
and eax, 3
and ecx, 3
xor edx, edx
sub eax, 1
je 0x1015e52
sub eax, 1
je 0x1015e7b
sub eax, 1
jne 0x1015e54
mov edx, ebx
sub ecx, 2
jne 0x1015e5f
add dword [esi + 0x1000000], edx
add edi, 1
cmp edi, dword [0x1001eac]
jb 0x1015e1b
mov ecx, dword [ebp - 0x48]
mov al, byte [ecx + 7]
test al, 1
je 0x1015e7f
mov eax, ecx
jmp 0x1016102
xor edx, edx
jmp 0x1015e54
movzx edi, word [ecx + 4]
mov ecx, dword [ecx]
movzx esi, al
add ecx, 0x1000000
mov eax, 0x1000000
shr esi, 1
sub eax, dword [0x103a30c]
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0xa0], eax
jne 0x1015ef3
mov eax, 0x8421085
mul esi
mov eax, esi
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 6
imul eax, eax, 0x7c
sub esi, eax
lea edx, [ebp - 0x50]
push edx
mov edx, dword [esi*4 + 0x1039120]
lea eax, [ecx + edi]
push eax
push ecx
lea ecx, [ebp - 0x2c]
push ecx
mov byte [ebp - 0x50], 0
mov byte [ebp - 0x4f], 1
mov byte [ebp - 0x4e], 2
mov byte [ebp - 0x4d], 3
mov byte [ebp - 0x4c], 4
mov byte [ebp - 0x4b], 5
call edx
jmp 0x10160ec
mov edx, dword [0x100003c]
mov eax, ecx
sub eax, 0x1000000
mov ecx, eax
mov ebx, eax
add eax, edi
mov edi, eax
and edi, 0xfffff000
sub eax, edi
mov dword [ebp - 0x98], edi
mov edi, dword [edx + 0x10000a0]
mov dword [ebp - 0x94], eax
mov eax, dword [edx + 0x10000a4]
add edi, 0x1000000
and ecx, 0xfffff000
add eax, edi
sub ebx, ecx
cmp edi, eax
mov dword [ebp - 0x90], eax
je 0x1015f4d
cmp dword [edi], ecx
jae 0x1015f4d
add edi, dword [edi + 4]
cmp edi, eax
jne 0x1015f42
xor edx, edx
cmp edi, eax
je 0x1015f7e
cmp dword [edi], ecx
jne 0x1015f7e
mov ecx, dword [edi + 4]
sub ecx, 8
shr ecx, 1
mov dword [ebp - 0x70], ecx
je 0x1015f7e
lea esp, [esp]
movzx ecx, word [edi + edx*2 + 8]
and ecx, 0xfff
cmp ecx, ebx
jae 0x1015f7e
add edx, 1
cmp edx, dword [ebp - 0x70]
jne 0x1015f67
mov ecx, dword [ebp - 0x48]
jmp 0x1015f89
mov eax, dword [ebp - 0x90]
cmp edi, eax
je 0x10160a2
mov ebx, dword [edi]
cmp ebx, dword [ebp - 0x98]
ja 0x10160a2
lea esp, [esp]
mov ebx, dword [edi + 4]
add ebx, 0xfffffff8
shr ebx, 1
cmp edx, ebx
jne 0x1015fcb
add edi, dword [edi + 4]
cmp edi, eax
je 0x10160a2
mov edx, dword [ebp - 0x98]
cmp dword [edi], edx
ja 0x10160a2
xor edx, edx
jmp 0x1015fa2
mov ebx, dword [edi]
cmp ebx, dword [ebp - 0x98]
jne 0x1015feb
movzx eax, word [edi + edx*2 + 8]
and eax, 0xfff
cmp eax, dword [ebp - 0x94]
jae 0x10160a2
mov eax, edx
movzx eax, word [edi + eax*2 + 8]
add edx, 1
test eax, 0xf000
mov dword [ebp - 0x88], edx
je 0x1015f83
and eax, 0xfff
lea ebx, [eax + ebx + 0x1000000]
mov eax, 0x8421085
mul esi
mov eax, esi
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 6
imul eax, eax, 0x7c
mov edx, esi
sub edx, eax
lea eax, [edx*4 + 0x1039120]
lea edx, [ebp - 0x68]
push edx
mov edx, dword [eax]
push ebx
push ecx
lea ecx, [ebp - 0x2c]
push ecx
mov byte [ebp - 0x68], 0
mov byte [ebp - 0x67], 1
mov byte [ebp - 0x66], 2
mov byte [ebp - 0x65], 3
mov byte [ebp - 0x64], 4
mov byte [ebp - 0x63], 5
mov dword [ebp - 0x70], eax
call edx
mov eax, dword [ebx]
sub eax, dword [ebp - 0xa0]
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x60]
push eax
push ecx
mov ecx, dword [ebp - 0x70]
lea edx, [ebp - 0x14]
push edx
mov edx, dword [ecx]
lea eax, [ebp - 0x2c]
push eax
mov byte [ebp - 0x60], 0
mov byte [ebp - 0x5f], 1
mov byte [ebp - 0x5e], 2
mov byte [ebp - 0x5d], 3
mov byte [ebp - 0x5c], 4
mov byte [ebp - 0x5b], 5
call edx
mov edx, dword [ebp - 0x88]
add esp, 0x20
lea ecx, [ebx + 4]
jmp 0x1015f83
mov eax, 0x8421085
mul esi
mov eax, esi
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 6
imul eax, eax, 0x7c
sub esi, eax
mov eax, dword [ebp - 0x48]
lea edx, [ebp - 0x58]
push edx
mov edx, dword [ebp - 0x24]
add eax, edx
push eax
push ecx
mov ecx, dword [esi*4 + 0x1039120]
lea eax, [ebp - 0x2c]
push eax
mov byte [ebp - 0x58], 0
mov byte [ebp - 0x57], 1
mov byte [ebp - 0x56], 2
mov byte [ebp - 0x55], 3
mov byte [ebp - 0x54], 4
mov byte [ebp - 0x53], 5
call ecx
or byte [ebp - 0x2c], 1
or byte [ebp - 0x2a], 1
or byte [ebp - 0x28], 1
add esp, 0x10
or byte [ebp - 0x27], 1
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x30], 0
mov esi, dword [eax]
mov dx, word [eax + 4]
mov dword [ebp - 0x20], esi
mov word [ebp - 0x1c], dx
jbe 0x101628b
mov eax, dword [ebp - 0x74]
mov al, byte [eax]
xor byte [ebp - 0x15], al
mov bl, byte [ebp - 0x1c]
mov dl, al
and dl, 0x80
movzx eax, al
je 0x1016137
movzx ecx, bl
add eax, eax
xor ecx, eax
jmp 0x101613b
add eax, eax
mov ecx, eax
test cl, cl
jns 0x1016160
test dl, dl
je 0x1016153
movzx ecx, bl
xor ecx, eax
lea eax, [ecx + ecx]
movzx ecx, byte [ebp - 0x20]
xor eax, ecx
jmp 0x1016170
mov ecx, eax
lea eax, [ecx + ecx]
movzx ecx, byte [ebp - 0x20]
xor eax, ecx
jmp 0x1016170
test dl, dl
je 0x101616b
movzx ecx, bl
xor ecx, eax
jmp 0x101616d
mov ecx, eax
lea eax, [ecx + ecx]
mov edi, dword [ebp - 0x74]
mov edx, esi
shr edx, 8
mov ebx, 1
xor dl, al
cmp dword [ebp - 0x30], ebx
mov byte [edi], dl
mov dword [ebp - 0x24], ebx
jbe 0x101628b
mov al, byte [ebx + edi]
xor byte [ebp - 0x15], al
test bl, 1
je 0x1016213
mov cl, al
and cl, 0x80
movzx eax, al
mov byte [ebp - 0x16], cl
lea ecx, [eax + eax]
je 0x10161b0
movzx eax, byte [ebp - 0x1b]
xor eax, ecx
jmp 0x10161b2
mov eax, ecx
movzx edx, byte [ebx + edi - 1]
xor eax, edx
test al, al
jns 0x10161f1
cmp byte [ebp - 0x16], 0
je 0x10161dc
movzx eax, byte [ebp - 0x1b]
xor eax, ecx
movzx ecx, byte [ebp - 0x1e]
xor eax, edx
add eax, eax
xor eax, ecx
movzx ecx, byte [ebp - 0x1d]
jmp 0x1016274
mov eax, ecx
movzx ecx, byte [ebp - 0x1e]
xor eax, edx
add eax, eax
xor eax, ecx
movzx ecx, byte [ebp - 0x1d]
jmp 0x1016274
cmp byte [ebp - 0x16], 0
je 0x1016207
movzx eax, byte [ebp - 0x1b]
xor eax, ecx
movzx ecx, byte [ebp - 0x1d]
xor eax, edx
add eax, eax
jmp 0x1016274
mov eax, ecx
movzx ecx, byte [ebp - 0x1d]
xor eax, edx
add eax, eax
jmp 0x1016274
mov dl, al
and dl, 0x80
movzx eax, al
lea esi, [eax + eax]
je 0x1016228
movzx ecx, byte [ebp - 0x1c]
xor ecx, esi
jmp 0x101622a
mov ecx, esi
movzx eax, byte [ebx + edi - 1]
mov ebx, eax
xor ebx, ecx
test bl, bl
jns 0x101625b
test dl, dl
je 0x101624d
movzx ecx, byte [ebp - 0x1c]
movzx edx, byte [ebp - 0x20]
xor ecx, esi
xor eax, ecx
add eax, eax
xor eax, edx
jmp 0x101626d
movzx edx, byte [ebp - 0x20]
mov ecx, esi
xor eax, ecx
add eax, eax
xor eax, edx
jmp 0x101626d
test dl, dl
je 0x1016267
movzx ecx, byte [ebp - 0x1c]
xor ecx, esi
jmp 0x1016269
mov ecx, esi
xor eax, ecx
add eax, eax
movzx ecx, byte [ebp - 0x1f]
mov ebx, dword [ebp - 0x24]
mov edi, dword [ebp - 0x74]
xor ecx, eax
mov byte [ebx + edi], cl
add ebx, 1
cmp ebx, dword [ebp - 0x30]
mov dword [ebp - 0x24], ebx
jb 0x101618d
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0x6c]
or dword [eax + ecx*8 + 4], 0x80000000
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [eax + ecx*8 + 4]
mov eax, dword [ebp - 0x80]
mov edi, ecx
add edi, 1
cmp edi, dword [ebp - 0x7c]
mov dword [ebp - 0x6c], edi
jb 0x1015cca
jmp 0x10162c3
mov dword [ebp - 0x84], 0x8007000e
xor esi, esi
cmp dword [ebp - 0x34], esi
je 0x10162df
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x40]
lea edx, [ebp - 0x3c]
push edx
mov edx, dword [ebp - 0x44]
push eax
push ecx
push edx
call ebx
mov dword [ebp - 0x34], esi
cmp dword [ebp - 0x38], esi
je 0x10162f2
push 0x103a2f0
mov dword [ebp - 0x38], esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 0x78]
mov cl, byte [ebp - 0x15]
mov ebx, dword [ebp - 0x9c]
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x3c], esi
mov byte [eax + 6], cl
mov edx, dword [ebp - 0xa4]
push edx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
add dword [ebx + 4], 8
mov eax, dword [ebp - 0x84]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.010052b2
mov esp, ebp
pop ebp
ret