Function at 0x100017b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push esi
mov esi, ecx
mov dword [eax], 0
push edi
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x10], 0x40
push ecx
mov eax, dword [esi + 8]
mov edx, dword [esi + 4]
shl eax, 7
push 0x40
push eax
push edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], 0
mov byte [ebp - 8], 0
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push eax
call edi
test eax, eax
setne byte [ebp - 8]
test eax, eax
je 0x10001a79
mov ebx, dword [esi + 0xc]
cmp ebx, dword [esi + 8]
jge 0x10001a65
lea eax, [ebx + 1]
shl ebx, 7
mov dword [esi + 0xc], eax
add ebx, dword [esi + 4]
je 0x10001a65
mov edi, dword [ebp + 8]
xor esi, esi
or ecx, 0xffffffff
mov dword [ebp - 4], ecx
movzx eax, byte [esi + edi]
xor cl, cl
sub eax, 0x2e
mov edx, esi
cmp eax, 0xc5
ja case.0x10001857.47
nop word [eax + eax]
movzx eax, byte [eax + 0x10001ab0]
jmp dword [eax*4 + 0x10001a9c]
test cl, 1
jne 0x10001a6d
mov al, 1
jmp 0x10001890
test cl, 2
jne 0x10001a6d
mov al, 2
jmp 0x10001890
test cl, 4
jne 0x10001a6d
mov al, 4
jmp 0x10001890
test cl, 8
jne 0x10001a6d
mov al, 8
inc edx
or cl, al
movzx eax, byte [edx + edi]
sub eax, 0x2e
cmp eax, 0xc5
jbe 0x10001850
mov eax, edx
sub eax, esi
js 0x10001a6d
test cl, 0xc
jne 0x10001a6d
mov esi, edx
mov cl, byte [esi + edi]
mov al, cl
add al, 0x78
cmp al, 3
ja 0x10001954
inc esi
lea edx, [esi + edi]
test edx, edx
je 0x10001a6d
mov cl, byte [edx]
movzx eax, cl
and eax, 0xc0
movzx eax, byte [eax + 0x10001b8c]
jmp dword [eax*4 + 0x10001b78]
cmp cl, 0xa1
jne 0x1000195e
add esi, 5
jmp 0x100019c3
cmp cl, 0xb8
jne 0x10001968
add esi, 5
jmp 0x100019c3
cmp cl, 0x83
jne 0x10001980
mov al, byte [esi + edi + 1]
and al, 0xc0
cmp al, 0xc0
jne 0x10001a6d
add esi, 3
jmp 0x100019c3
cmp cl, 0x68
jne 0x1000198a
add esi, 5
jmp 0x100019c3
mov al, cl
and al, 0xf0
cmp al, 0x50
jne 0x10001995
inc esi
jmp 0x100019c3
cmp cl, 0x6a
jne 0x1000199f
add esi, 2
jmp 0x100019c3
cmp cl, 0xe9
jne 0x100019ac
mov dword [ebp - 4], esi
add esi, 5
jmp 0x100019c3
cmp cl, 0xff
jne 0x10001a6d
cmp byte [esi + edi + 1], 0x25
jne 0x10001a6d
add esi, 6
cmp esi, 5
jl 0x10001835
cmp esi, 0x64
jg 0x10001a6d
push edi
call dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
mov dword [ebx], eax
add ebx, 4
push edi
push ebx
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [ebp - 4]
mov eax, edi
add esp, 0xc
sub eax, ebx
test ecx, ecx
js 0x100019fd
add dword [ecx + ebx + 1], eax
jmp 0x10001a08
sub eax, 5
mov byte [esi + ebx], 0xe9
mov dword [esi + ebx + 1], eax
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], 0x40
mov dword [eax], ebx
mov dword [ebp - 0x20], 0
mov byte [ebp - 0x1c], 0
call fcn.10002270
test al, al
je 0x10001a3f
mov eax, dword [ebp + 0xc]
sub eax, edi
mov byte [edi], 0xe9
sub eax, 5
mov dword [edi + 1], eax
cmp byte [ebp - 0x1c], 0
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
je 0x10001a73
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push eax
call edi
jmp 0x10001a79
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x10001a79
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
cmp byte [ebp - 8], 0
je 0x10001a91
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call ebx
push eax
call edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc