Function at 0x1002ac60
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100a500c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x100a9320]
test eax, eax
push ebx
mov ebx, ecx
mov ecx, 1
cmove eax, ecx
mov ecx, ebx
push esi
push edi
mov dword [0x100a9320], eax
call fcn.100283a0
call fcn.10027e10
call fcn.100205d0
mov ecx, dword [0x100a7d00]
test ecx, ecx
jne 0x1002acb0
mov dword [0x100afc58], 0x32
jmp 0x1002ace4
cmp ecx, 1
jne 0x1002acc1
mov dword [0x100afc58], 6
jmp 0x1002ace4
cmp ecx, 2
jne 0x1002acd2
mov dword [0x100afc58], 5
jmp 0x1002ace4
mov eax, dword [0x100afc58]
xor edx, edx
cmp ecx, 3
cmove eax, edx
mov dword [0x100afc58], eax
call fcn.100156e0
test eax, eax
je 0x1002ad46
push 0x75
mov dword [0x100a7fac], 0x100159f0
call fcn.100159f0
cwde
shr eax, 0x10
test eax, eax
je 0x1002ad3f
cmp byte [0x100b0398], 0
je 0x1002ad26
cmp dword [0x100b039c], 0
je 0x1002ad46
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x100b039c], eax
ja 0x1002ad46
xor eax, eax
mov byte [0x100b0398], 1
cmp dword [0x100af678], eax
sete al
mov dword [0x100af678], eax
jmp 0x1002ad46
mov byte [0x100b0398], 0
call fcn.1001e4e0
call fcn.1001e210
mov ecx, ebx
call fcn.1001e650
call fcn.100262d0
mov ecx, ebx
call fcn.10020280
mov ecx, ebx
call fcn.100235d0
mov ecx, dword [0x100a78a0]
mov eax, dword [0x100aba90]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [eax], 0
je 0x1002ae20
cmp dword [0x100af67c], 0
jne 0x1002ade9
cmp dword [0x100aba38], 0
jne 0x1002ade9
cmp dword [0x100aab78], 0
jne 0x1002ade9
cmp dword [0x100a89e8], 0
jne 0x1002ade9
mov ecx, dword [0x100a78a0]
mov eax, dword [0x100aba90]
add eax, 0x108
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x1002ae5a
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push edi
call esi
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
jmp 0x1002ae52
mov ecx, dword [0x100a78a0]
mov eax, dword [0x100aba90]
add eax, 0x108
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x1002ae5a
lea eax, [ebp - 0x10]
push eax
push 0x40
push 1
push edi
call esi
lea eax, [ebp - 0x10]
mov byte [edi], 0xcc
push eax
push dword [ebp - 0x10]
jmp 0x1002ae55
mov ecx, dword [0x100a78a0]
mov eax, dword [0x100aba90]
add eax, 0x108
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x1002ae5a
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
mov byte [edi], 0x55
push 1
push edi
call esi
mov ecx, dword [0x100a78a0]
mov eax, dword [0x100aba90]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x1002aeb5
cmp dword [0x100a7cac], 0
jne 0x1002ae85
cmp dword [0x100a89ac], 0
je 0x1002aeb5
mov ecx, dword [0x100a78a0]
mov eax, dword [0x100aba90]
add eax, 0x194
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x1002aeef
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0xcc
jmp 0x1002aee3
mov ecx, dword [0x100a78a0]
mov eax, dword [0x100aba90]
add eax, 0x194
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x1002aeef
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0x6a
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push edi
call esi
mov ecx, ebx
call fcn.10022eb0
mov ecx, ebx
call fcn.100219b0
mov ecx, ebx
call fcn.100225e0
mov ecx, ebx
call fcn.10022040
call fcn.10022280
call fcn.10022380
call fcn.100256a0
call fcn.10025a40
call fcn.10025d70
call fcn.10025590
call fcn.100265e0
cmp dword [0x100af6b8], 0
je 0x1002afe4
mov ecx, dword [0x100a78a0]
mov eax, dword [0x100aba90]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x1002afe4
push 0x20
mov dword [0x100a7fac], 0x100159f0
call fcn.100159f0
cwde
shr eax, 0x10
test eax, eax
je 0x1002afdd
cmp byte [0x100b00f0], 0
je 0x1002af98
cmp dword [0x100b00f4], 0
je 0x1002afe4
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov ecx, dword [0x100b00f4]
inc ecx
cmp ecx, eax
ja 0x1002afe4
jmp 0x1002af9e
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov byte [0x100b00f0], 1
call edi
mov ecx, dword [0x100a78a0]
mov dword [0x100b00f4], eax
mov eax, dword [0x100aba90]
add eax, 0x16c
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea edi, [eax + 2]
cmp edi, 0x1000
jbe 0x1002b01f
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 3
jmp 0x1002b013
mov byte [0x100b00f0], 0
mov ecx, dword [0x100a78a0]
mov eax, dword [0x100aba90]
add eax, 0x16c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
lea edi, [eax + 2]
cmp edi, 0x1000
jbe 0x1002b01f
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0x44
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push edi
call esi
call fcn.10025ee0
call fcn.10025f90
mov ecx, dword [0x100a78a0]
mov eax, dword [0x100aba90]
add eax, 0x180
push eax
mov edx, dword [ecx]
call dword [edx + 4]
test eax, eax
je 0x1002b0c8
cmp dword [0x100aab44], 1
mov ecx, dword [0x100a78a0]
mov eax, dword [0x100aba90]
mov edx, dword [ecx]
jne 0x1002b09a
add eax, 0x1c
push eax
call dword [edx + 4]
mov ecx, dword [0x100a78a0]
cmp dword [eax], 0
mov edx, dword [ecx]
mov eax, dword [0x100aba90]
je 0x1002b09a
add eax, 0x180
push eax
call dword [edx + 4]
lea edi, [eax + 3]
cmp edi, 0x1000
jbe 0x1002b0c8
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0x66
jmp 0x1002b0bc
add eax, 0x180
push eax
call dword [edx + 4]
lea edi, [eax + 3]
cmp edi, 0x1000
jbe 0x1002b0c8
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0x46
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push edi
call esi
call fcn.100269f0
call fcn.10022b70
cmp dword [0x100afe8c], 1
jne 0x1002b147
mov ecx, dword [0x100a78a0]
mov eax, dword [0x100aba90]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x1002b147
cmp dword [0x100abbac], 1
jne 0x1002b194
mov ecx, dword [0x100a78a0]
mov eax, dword [0x100aba90]
add eax, 0x150
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x1002b13b
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
lea eax, [ebp - 8]
mov byte [edi], 0xcc
push eax
push dword [ebp - 8]
push 1
push edi
call esi
mov dword [0x100abbac], 0
jmp 0x1002b194
cmp dword [0x100abbac], 0
jne 0x1002b194
mov ecx, dword [0x100a78a0]
mov eax, dword [0x100aba90]
add eax, 0x150
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x1002b18a
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
lea eax, [ebp - 8]
mov byte [edi], 0x68
push eax
push dword [ebp - 8]
push 1
push edi
call esi
mov dword [0x100abbac], 1
call fcn.10023e30
call fcn.10023d60
cmp dword [0x100afea4], 0
jle 0x1002b23b
mov ecx, dword [0x100a78a0]
mov eax, dword [0x100aba90]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x1002b23b
mov eax, dword [0x100afea4]
cmp eax, 1
jne 0x1002b1da
mov dword [0x100ab808], 0x42c80000
jmp 0x1002b20b
cmp eax, 2
jne 0x1002b1eb
mov dword [0x100ab808], 0x42dc0000
jmp 0x1002b20b
cmp eax, 3
jne 0x1002b1fc
mov dword [0x100ab808], 0x42f00000
jmp 0x1002b20b
cmp eax, 4
jne 0x1002b20b
mov dword [0x100ab808], 0x42fa0000
mov ecx, dword [0x100a78a0]
mov eax, dword [0x100aba90]
add eax, 0x154
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x1002b275
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0xcc
jmp 0x1002b269
mov ecx, dword [0x100a78a0]
mov eax, dword [0x100aba90]
add eax, 0x154
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x1002b275
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0x55
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push edi
call esi
call fcn.10026840
call fcn.10022480
call fcn.10026930
call fcn.10026410
call fcn.10026100
call fcn.100261a0
call fcn.100277a0
call fcn.100274b0
mov ecx, ebx
call fcn.10027830
call fcn.1002a860
call fcn.10026b30
call fcn.100272e0
call fcn.10026f50
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10071759
mov esp, ebp
pop ebp
ret