Function at 0x10024f40
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x1006f00c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x10076404], 0
push ebx
mov ebx, ecx
jne 0x100251d1
push esi
push edi
call fcn.100246a0
mov eax, dword [0x100753b4]
mov ecx, fcn.10007950
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esi, [eax + 0x40]
cmp esi, 0x1000
jbe 0x10024fb1
cmp ecx, 0x1000
jbe 0x10024fb1
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x2c]
mov dword [esi], fcn.10007950
push eax
push dword [ebp - 8]
push 4
push esi
call edi
mov eax, dword [0x100753b4]
mov ecx, fcn.10007950
lea esi, [eax + 0x44]
cmp esi, 0x1000
jbe 0x10024fe6
cmp ecx, 0x1000
jbe 0x10024fe6
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x30]
mov dword [esi], fcn.10007950
push eax
push dword [ebp - 0xc]
push 4
push esi
call edi
mov eax, dword [0x100753b4]
lea esi, [eax + 0x48]
mov ecx, fcn.10007950
cmp esi, 0x1000
jbe 0x10025025
cmp ecx, 0x1000
jbe 0x10025025
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x34]
mov dword [esi], fcn.10007950
push eax
push dword [ebp - 0x10]
push 4
push esi
call edi
mov eax, dword [0x100753b4]
mov ecx, fcn.10007950
lea esi, [eax + 0x4c]
cmp esi, 0x1000
jbe 0x1002505a
cmp ecx, 0x1000
jbe 0x1002505a
lea eax, [ebp - 0x14]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x38]
mov dword [esi], fcn.10007950
push eax
push dword [ebp - 0x14]
push 4
push esi
call edi
mov eax, dword [0x100753b4]
lea esi, [eax + 0x50]
mov ecx, fcn.10007950
cmp esi, 0x1000
jbe 0x10025099
cmp ecx, 0x1000
jbe 0x10025099
lea eax, [ebp - 0x18]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x3c]
mov dword [esi], fcn.10007950
push eax
push dword [ebp - 0x18]
push 4
push esi
call edi
mov eax, dword [0x100753b4]
mov ecx, fcn.10007950
lea esi, [eax + 0x54]
cmp esi, 0x1000
jbe 0x100250ce
cmp ecx, 0x1000
jbe 0x100250ce
lea eax, [ebp - 0x1c]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x40]
mov dword [esi], fcn.10007950
push eax
push dword [ebp - 0x1c]
push 4
push esi
call edi
mov eax, dword [0x100753b4]
lea esi, [eax + 0x58]
cmp esi, 0x1000
jbe 0x10025108
mov ecx, fcn.10007950
cmp ecx, 0x1000
jbe 0x10025108
lea eax, [ebp - 0x20]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x44]
mov dword [esi], fcn.10007950
push eax
push dword [ebp - 0x20]
push 4
push esi
call edi
mov eax, dword [0x100753b4]
cmp dword [0x10076fa0], 0
jne 0x10025156
lea esi, [eax + 0x38]
cmp esi, 0x1000
jbe 0x1002514f
mov eax, 0x10024530
cmp eax, 0x1000
jbe 0x1002514f
mov eax, dword [esi]
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x24]
push eax
push 0x40
push 4
push esi
call edi
lea eax, [ebp - 0x28]
mov dword [esi], 0x10024530
push eax
push dword [ebp - 0x24]
push 4
push esi
call edi
mov eax, dword [ebp - 0x48]
jmp 0x10025151
xor eax, eax
mov dword [0x10076fa0], eax
cmp dword [0x100751d4], 0
jne 0x100251c5
mov ecx, dword [0x10074de0]
mov eax, dword [0x10071168]
add eax, 0x2f8
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov dword [ebp - 0x48], eax
cmp eax, 0x1000
jbe 0x100251be
push 0xc
call fcn.1004de0e
add esp, 4
mov esi, eax
lea eax, [ebp - 0x28]
push eax
push 0x40
push 0xc
push esi
call edi
mov edx, dword [ebp - 0x48]
mov ecx, dword [edx]
mov dword [esi], ecx
mov ax, word [edx + 4]
mov word [esi + 4], ax
mov al, byte [edx + 6]
mov byte [esi + 6], al
lea eax, [esi + 7]
sub edx, eax
mov byte [eax], 0xe9
add edx, 2
mov dword [eax + 1], edx
add eax, 0xfffffff9
jmp 0x100251c0
xor eax, eax
mov dword [0x100751d4], eax
pop edi
mov dword [0x10076404], 1
pop esi
call fcn.1001d0e0
mov ecx, dword [0x10075224]
test ecx, ecx
jne 0x100251ec
mov dword [0x10074b40], 0x32
jmp 0x10025220
cmp ecx, 1
jne 0x100251fd
mov dword [0x10074b40], 6
jmp 0x10025220
cmp ecx, 2
jne 0x1002520e
mov dword [0x10074b40], 5
jmp 0x10025220
mov eax, dword [0x10074b40]
xor edx, edx
cmp ecx, 3
cmove eax, edx
mov dword [0x10074b40], eax
call fcn.1001ad20
call fcn.1001aff0
mov ecx, ebx
call fcn.1001b160
mov ecx, ebx
call fcn.1001cd90
call fcn.10022d00
mov ecx, ebx
call fcn.1001e720
mov ecx, ebx
call fcn.1001eca0
call fcn.100218a0
call fcn.100222a0
call fcn.100219b0
call fcn.10020080
call fcn.100221f0
call fcn.10020140
call fcn.10022b50
call fcn.10022c40
call fcn.10022720
call fcn.10022410
call fcn.10022e50
call fcn.10023590
call fcn.10023230
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.1004d4d9
mov esp, ebp
pop ebp
ret