Function at 0x10011ddb
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x1002c7d4]
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 0x10], ebx
cmp eax, ebx
jne 0x10011e43
mov esi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0x40
mov edi, 0x3000
push edi
push 0x10000
push ebx
call esi
mov dword [0x1002cdfc], eax
cmp eax, ebx
jne 0x10011e1b
xor eax, eax
jmp 0x10011fea
push 4
push edi
push 0x5000
push ebx
call esi
mov dword [0x1002ce00], eax
cmp eax, ebx
jne 0x10011e4c
push 0x8000
push ebx
push dword [0x1002cdfc]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x10011e14
cmp eax, 0x400
jl 0x10011e51
jmp 0x10011e14
mov eax, dword [0x1002c7d4]
xor edx, edx
cmp eax, ebx
jle 0x10011e69
mov ecx, dword [0x1002ce00]
cmp dword [ecx], ebx
je 0x10011e75
inc edx
add ecx, 0x14
cmp edx, eax
jl 0x10011e5d
cmp eax, 0x400
jge 0x10011e7a
mov dword [ebp - 4], eax
jmp 0x10011e7e
mov dword [ebp - 4], edx
jmp 0x10011e7e
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 4], 0xffffffff
je 0x10011e14
mov esi, dword [ebp + 0x10]
push esi
call fcn.10011d70
mov dword [ebp - 8], eax
cmp eax, 5
jge 0x10011ec5
cmp dword [0x1002c7d4], ebx
jne 0x10011e14
mov esi, dword [sym.imp.KERNEL32.dll_VirtualFree]
mov edi, 0x8000
push edi
push ebx
push dword [0x1002cdfc]
call esi
push edi
push ebx
push dword [0x1002ce00]
call esi
jmp 0x10011e14
mov ebx, dword [ebp - 4]
lea edi, [ebp - 0x50]
mov ecx, eax
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x10]
shl ebx, 6
add ebx, dword [0x1002cdfc]
mov ecx, esi
sub ecx, ebx
sub ecx, 5
mov dword [ebp + eax - 0x4f], ecx
push 5
lea edi, [ebp + eax - 0x4b]
pop ecx
mov byte [ebp + eax - 0x50], 0xe9
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0x10]
lea eax, [ebp + esi - 0x50]
cmp byte [eax], 0xe8
jne 0x10011f09
mov ecx, dword [ebp + 0x10]
sub ecx, ebx
add dword [ebp + esi - 0x4f], ecx
push 0
push eax
call section.code
add esi, eax
mov dword [ebp - 0x10], esi
cmp esi, dword [ebp - 8]
jl 0x10011ef4
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov ecx, dword [ebp - 8]
mov eax, edi
sub eax, esi
sub eax, 5
mov dword [ebp - 0x8f], eax
mov eax, dword [ebp - 4]
imul eax, eax, 0x14
add eax, dword [0x1002ce00]
inc dword [0x1002c7d4]
lea edx, [ecx + 5]
mov dword [eax], edi
mov dword [eax + 8], esi
mov byte [eax + 0x12], 5
mov byte [eax + 0x11], dl
mov dword [eax + 4], ebx
mov eax, dword [ebp + 8]
add ecx, 0xa
lea esi, [ebp - 0x50]
mov edi, ebx
rep movsb byte es:[edi], byte [esi]
mov byte [ebp - 0x90], 0xe9
mov dword [eax], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov edi, dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 2
push ebx
mov dword [ebp + 0xc], eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0xc]
push eax
push 0x40
push 5
push dword [ebp + 0x10]
call esi
test eax, eax
je 0x10011fd0
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x90]
mov edx, eax
xchg dword [edx], ecx
movzx edx, byte [ebp - 0x8c]
add eax, 4
mov ecx, dword [eax]
and ecx, 0xffffff00
add ecx, edx
xchg dword [eax], ecx
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
push 5
push dword [ebp + 0x10]
call esi
push dword [ebp + 0xc]
push ebx
call edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc