Function at 0x1001cfa0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
call fcn.1001c890
mov ebp, dword [esp + 0x1c]
or edi, 0xffffffff
test byte [esi + 0x1b4], 1
mov edx, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
je 0x1001d078
cmp ebp, dword [0x10060990]
jb 0x1001d078
mov ecx, dword [0x1006098c]
lea ebx, [ecx + 0x1f]
lea eax, [ecx - 1]
add ebx, ebp
not eax
and ebx, eax
cmp ebx, ebp
jbe 0x1001d07e
push 0x40
push 0x103000
push ebx
push 0
call edx
test eax, eax
mov edx, edi
cmovne edx, eax
cmp edx, edi
je 0x1001d072
mov eax, edx
and eax, 7
je 0x1001d011
neg eax
and eax, 7
lea ebp, [eax + edx]
mov ecx, ebx
sub ecx, eax
mov dword [esp + 0x18], ebp
or eax, 1
mov dword [ebp], eax
lea eax, [ecx - 0x10]
or eax, 2
mov dword [ebp + 4], eax
mov eax, ebp
mov ebp, dword [esp + 0x1c]
mov dword [eax + ecx - 0xc], 7
mov dword [eax + ecx - 8], 0
cmp edx, dword [esi + 0x10]
jae 0x1001d049
mov dword [esi + 0x10], edx
mov eax, dword [esi + 0x1ac]
add eax, ebx
mov dword [esi + 0x1ac], eax
cmp eax, dword [esi + 0x1b0]
jbe 0x1001d065
mov dword [esi + 0x1b0], eax
mov eax, dword [esp + 0x18]
add eax, 8
jne 0x1001d2c2
mov edx, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [0x1006098c]
lea ebx, [ebp + 0x29]
lea eax, [ecx - 1]
add ebx, ecx
not eax
and ebx, eax
cmp ebx, ebp
jbe 0x1001d2c0
push 0x40
push 0x3000
push ebx
push 0
call edx
test eax, eax
cmovne edi, eax
cmp edi, 0xffffffff
je 0x1001d2c0
mov eax, dword [esi + 0x1ac]
add eax, ebx
mov dword [esp + 0x18], 1
mov dword [esi + 0x1ac], eax
cmp eax, dword [esi + 0x1b0]
jbe 0x1001d0d0
mov dword [esi + 0x1b0], eax
cmp dword [esi + 0x18], 0
lea ecx, [esi + 0x1bc]
jne 0x1001d1af
mov dword [ecx], edi
lea ecx, [ebx + edi]
mov dword [esi + 0x10], edi
mov dword [esi + 0x1c0], ebx
mov eax, dword [ecx - 4]
mov dword [esi + 0x1c8], eax
cmp dword [ecx + eax - 4], eax
jne 0x1001d2c8
mov eax, dword [0x10060984]
mov edx, 0x20
mov dword [ecx - 4], 0
lea ecx, [esi + 0x24]
mov dword [esi + 0x20], eax
nop dword [eax + eax]
mov dword [ecx + 0xc], ecx
mov dword [ecx + 8], ecx
add ecx, 8
sub edx, 1
jne 0x1001d120
cmp esi, 0x100609a0
jne 0x1001d16d
mov eax, edi
add ebx, 0xffffffd8
and eax, 7
je 0x1001d145
neg eax
and eax, 7
lea ecx, [eax + edi]
sub ebx, eax
mov eax, ebx
mov dword [esi + 0x18], ecx
or eax, 1
mov dword [esi + 0xc], ebx
mov dword [ecx + 4], eax
mov eax, dword [0x10060994]
mov dword [ecx + ebx + 4], 0x28
mov dword [esi + 0x1c], eax
jmp 0x1001d211
mov ecx, dword [esi - 4]
and ecx, 0xfffffffc
add ecx, 0xfffffff8
add ecx, esi
sub ebx, ecx
mov eax, ecx
lea edx, [ebx - 0x28]
add edx, edi
and eax, 7
je 0x1001d18b
neg eax
and eax, 7
add ecx, eax
sub edx, eax
mov eax, edx
mov dword [esi + 0x18], ecx
or eax, 1
mov dword [esi + 0xc], edx
mov dword [ecx + 4], eax
mov eax, dword [0x10060994]
mov dword [ecx + edx + 4], 0x28
mov dword [esi + 0x1c], eax
jmp 0x1001d211
mov edx, ecx
test edx, edx
je 0x1001d1d8
mov dword [esp + 0x18], 1
nop dword [eax]
mov eax, dword [edx]
add eax, dword [edx + 4]
mov ebp, dword [esp + 0x1c]
mov dword [esp + 0x10], eax
cmp edi, eax
je 0x1001d23f
mov edx, dword [edx + 8]
test edx, edx
jne 0x1001d1c0
cmp edi, dword [esi + 0x10]
jae 0x1001d1e0
mov dword [esi + 0x10], edi
test ecx, ecx
je 0x1001d201
lea eax, [ebx + edi]
nop word [eax + eax]
mov edx, dword [ecx]
cmp edx, eax
je 0x1001d290
mov ecx, dword [ecx + 8]
test ecx, ecx
jne 0x1001d1f0
mov eax, dword [esp + 0x18]
push eax
push ebx
push edi
push esi
call fcn.1001cce0
add esp, 0x10
mov edx, dword [esi + 0xc]
cmp ebp, edx
jae 0x1001d2c0
mov ecx, dword [esi + 0x18]
sub edx, ebp
mov dword [esi + 0xc], edx
or edx, 1
pop edi
lea eax, [ecx + ebp]
or ebp, 3
mov dword [esi + 0x18], eax
mov dword [eax + 4], edx
lea eax, [ecx + 8]
pop esi
mov dword [ecx + 4], ebp
pop ebp
pop ebx
pop ecx
ret
mov eax, dword [ebx + edi - 4]
cmp eax, dword [edx + 0xc]
jne 0x1001d1d8
mov eax, dword [esi + 0x18]
cmp eax, dword [edx]
jb 0x1001d1d8
cmp eax, dword [esp + 0x10]
jae 0x1001d1d8
add dword [edx + 4], ebx
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 0x18]
add ecx, ebx
mov eax, edx
and eax, 7
je 0x1001d26c
neg eax
and eax, 7
add edx, eax
sub ecx, eax
mov eax, ecx
mov dword [esi + 0x18], edx
or eax, 1
mov dword [esi + 0xc], ecx
mov dword [edx + 4], eax
mov eax, dword [0x10060994]
mov dword [edx + ecx + 4], 0x28
mov dword [esi + 0x1c], eax
jmp 0x1001d211
mov eax, dword [eax - 4]
cmp eax, dword [ecx + 0xc]
jne 0x1001d201
mov eax, dword [esp + 0x18]
cmp eax, 1
jne 0x1001d205
add dword [ecx + 4], ebx
push ebp
push edx
push edi
push esi
mov dword [ecx], edi
call fcn.1001c940
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
call fcn.100275b7
int3