Function at 0x10025430
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1009100c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10098a50]
test eax, eax
push ebx
mov ebx, ecx
mov ecx, 1
push esi
cmove eax, ecx
push edi
mov dword [0x10098a50], eax
call fcn.10023cc0
call fcn.1001cd80
mov ecx, dword [0x1009784c]
test ecx, ecx
jne 0x10025479
mov dword [0x10097154], 0x32
jmp 0x100254ad
cmp ecx, 1
jne 0x1002548a
mov dword [0x10097154], 6
jmp 0x100254ad
cmp ecx, 2
jne 0x1002549b
mov dword [0x10097154], 5
jmp 0x100254ad
mov eax, dword [0x10097154]
xor edx, edx
cmp ecx, 3
cmove eax, edx
mov dword [0x10097154], eax
call fcn.10012510
test eax, eax
je 0x1002550f
push 0x75
mov dword [0x10097ae8], 0x10012820
call fcn.10012820
cwde
shr eax, 0x10
test eax, eax
je 0x10025508
cmp byte [0x10099608], 0
je 0x100254ef
cmp dword [0x1009960c], 0
je 0x1002550f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x1009960c], eax
ja 0x1002550f
xor eax, eax
mov byte [0x10099608], 1
cmp dword [0x10096f68], eax
sete al
mov dword [0x10096f68], eax
jmp 0x1002550f
mov byte [0x10099608], 0
call fcn.1001ac90
call fcn.1001a9c0
mov ecx, ebx
call fcn.1001ae00
call fcn.100225a0
mov ecx, ebx
call fcn.1001ca30
mov ecx, dword [0x100973f0]
mov eax, dword [0x10093784]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [eax], 0
je 0x100255e2
cmp dword [0x10096f6c], 0
jne 0x100255ab
cmp dword [0x10093730], 0
jne 0x100255ab
cmp dword [0x10098ea0], 0
jne 0x100255ab
cmp dword [0x10098120], 0
jne 0x100255ab
mov ecx, dword [0x100973f0]
mov eax, dword [0x10093784]
add eax, 0x108
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x1002561c
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push edi
call esi
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
jmp 0x10025614
mov ecx, dword [0x100973f0]
mov eax, dword [0x10093784]
add eax, 0x108
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x1002561c
lea eax, [ebp - 0x10]
push eax
push 0x40
push 1
push edi
call esi
lea eax, [ebp - 0x10]
mov byte [edi], 0xcc
push eax
push dword [ebp - 0x10]
jmp 0x10025617
mov ecx, dword [0x100973f0]
mov eax, dword [0x10093784]
add eax, 0x108
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x1002561c
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
mov byte [edi], 0x55
push 1
push edi
call esi
mov ecx, dword [0x100973f0]
mov eax, dword [0x10093784]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x10025677
cmp dword [0x10097800], 0
jne 0x10025647
cmp dword [0x100980e8], 0
je 0x10025677
mov ecx, dword [0x100973f0]
mov eax, dword [0x10093784]
add eax, 0x188
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x100256b1
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0xcc
jmp 0x100256a5
mov ecx, dword [0x100973f0]
mov eax, dword [0x10093784]
add eax, 0x188
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x100256b1
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0x6a
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push edi
call esi
mov ecx, ebx
call fcn.1001f940
mov ecx, ebx
call fcn.1001e7e0
mov ecx, ebx
call fcn.1001f330
mov ecx, ebx
call fcn.1001ed80
call fcn.1001efd0
call fcn.1001f0d0
call fcn.10021970
call fcn.10021d10
call fcn.10022040
call fcn.10021860
call fcn.10022830
cmp dword [0x10096fa0], 0
je 0x100257a6
mov ecx, dword [0x100973f0]
mov eax, dword [0x10093784]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x100257a6
push 0x20
mov dword [0x10097ae8], 0x10012820
call fcn.10012820
cwde
shr eax, 0x10
test eax, eax
je 0x1002579f
cmp byte [0x10099360], 0
je 0x1002575a
cmp dword [0x10099364], 0
je 0x100257a6
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov ecx, dword [0x10099364]
inc ecx
cmp ecx, eax
ja 0x100257a6
jmp 0x10025760
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov byte [0x10099360], 1
call edi
mov ecx, dword [0x100973f0]
mov dword [0x10099364], eax
mov eax, dword [0x10093784]
add eax, 0x160
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea edi, [eax + 2]
cmp edi, 0x1000
jbe 0x100257e1
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 3
jmp 0x100257d5
mov byte [0x10099360], 0
mov ecx, dword [0x100973f0]
mov eax, dword [0x10093784]
add eax, 0x160
push eax
mov edx, dword [ecx]
call dword [edx + 4]
lea edi, [eax + 2]
cmp edi, 0x1000
jbe 0x100257e1
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0x44
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push edi
call esi
call fcn.100221b0
call fcn.10022260
mov ecx, dword [0x100973f0]
mov eax, dword [0x10093784]
add eax, 0x174
push eax
mov edx, dword [ecx]
call dword [edx + 4]
test eax, eax
je 0x1002588a
cmp dword [0x10098e6c], 1
mov ecx, dword [0x100973f0]
mov eax, dword [0x10093784]
mov edx, dword [ecx]
jne 0x1002585c
add eax, 0x1c
push eax
call dword [edx + 4]
mov ecx, dword [0x100973f0]
cmp dword [eax], 0
mov edx, dword [ecx]
mov eax, dword [0x10093784]
je 0x1002585c
add eax, 0x174
push eax
call dword [edx + 4]
lea edi, [eax + 3]
cmp edi, 0x1000
jbe 0x1002588a
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0x66
jmp 0x1002587e
add eax, 0x174
push eax
call dword [edx + 4]
lea edi, [eax + 3]
cmp edi, 0x1000
jbe 0x1002588a
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0x46
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push edi
call esi
call fcn.10022c40
call fcn.10020100
call fcn.10020040
cmp dword [0x1009739c], 0
jle 0x100258eb
mov ecx, dword [0x100973f0]
mov eax, dword [0x10093784]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x100258eb
mov ecx, dword [0x100973f0]
mov eax, dword [0x10093784]
add eax, 0x148
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x10025925
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0xcc
jmp 0x10025919
mov ecx, dword [0x100973f0]
mov eax, dword [0x10093784]
add eax, 0x148
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x10025925
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0x55
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push edi
call esi
call fcn.10022a90
call fcn.1001f1d0
call fcn.10022b80
call fcn.100226e0
call fcn.100223d0
call fcn.10022470
call fcn.100239c0
call fcn.100236d0
mov ecx, ebx
call fcn.10023a50
call fcn.10025030
call fcn.10022d80
call fcn.10023500
call fcn.10023180
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10062f29
mov esp, ebp
pop ebp
ret