Function at 0x100200a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x294]
mov ecx, 0xa5
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x1014f440]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
mov ecx, 0x101c1374
call fcn.1011c410
mov eax, dword [ebp - 0xc]
movzx ecx, byte [eax + 8]
test ecx, ecx
je 0x10020119
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax]
jne 0x10020111
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 4]
cmp ecx, dword [ebp + 0xc]
je 0x10020111
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
mov dword [eax + 4], ecx
push 0
mov ecx, dword [ebp - 0xc]
call fcn.10021ad0
mov al, 1
jmp 0x1002038f
mov ecx, dword [ebp - 0xc]
call fcn.100229c0
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
mov dword [eax + 4], ecx
mov esi, esp
lea eax, [ebp - 0x18]
push eax
push 0x40
push 0xe
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.1011c3e0
test eax, eax
jne 0x10020152
xor al, al
jmp 0x1002038f
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
movzx edx, byte [ecx]
cmp edx, 0xe9
je 0x10020176
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
movzx edx, byte [ecx]
cmp edx, 0xe8
jne 0x10020376
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 1]
mov eax, dword [ebp - 0xc]
add edx, dword [eax]
mov dword [ebp - 0x284], edx
mov esi, esp
push 0x1c
lea eax, [ebp - 0x278]
push eax
mov ecx, dword [ebp - 0x284]
push ecx
mov edi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp edi, esp
call fcn.1011c3e0
push eax
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
cmp esi, esp
call fcn.1011c3e0
test eax, eax
je 0x100201d6
cmp dword [ebp - 0x268], 0x1000
jne 0x100201d6
mov eax, dword [ebp - 0x274]
mov dword [ebp - 0x254], eax
jmp 0x100201e2
mov eax, dword [ebp - 0x284]
mov dword [ebp - 0x254], eax
push 0x103
lea eax, [ebp - 0x13c]
push eax
mov ecx, dword [ebp - 0x254]
push ecx
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp esi, esp
call fcn.1011c3e0
push eax
call sub.KERNEL32.dll_K32GetMappedFileNameA
test eax, eax
je 0x10020219
lea eax, [ebp - 0x13c]
mov dword [ebp - 0x24], eax
jmp 0x10020251
mov esi, esp
push 0x103
lea eax, [ebp - 0x13c]
push eax
mov ecx, dword [ebp - 0x254]
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp esi, esp
call fcn.1011c3e0
test eax, eax
je 0x1002024a
lea eax, [ebp - 0x13c]
mov dword [ebp - 0x24], eax
jmp 0x10020251
mov dword [ebp - 0x24], str.unknown
mov esi, esp
push 0x1c
lea eax, [ebp - 0x278]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
push edx
mov edi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp edi, esp
call fcn.1011c3e0
push eax
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
cmp esi, esp
call fcn.1011c3e0
test eax, eax
je 0x1002029d
cmp dword [ebp - 0x268], 0x1000
jne 0x1002029d
mov eax, dword [ebp - 0x274]
mov dword [ebp - 0x254], eax
jmp 0x100202a8
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
mov dword [ebp - 0x254], ecx
push 0x103
lea eax, [ebp - 0x248]
push eax
mov ecx, dword [ebp - 0x254]
push ecx
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp esi, esp
call fcn.1011c3e0
push eax
call sub.KERNEL32.dll_K32GetMappedFileNameA
test eax, eax
je 0x100202df
lea eax, [ebp - 0x248]
mov dword [ebp - 0x30], eax
jmp 0x10020317
mov esi, esp
push 0x103
lea eax, [ebp - 0x248]
push eax
mov ecx, dword [ebp - 0x254]
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp esi, esp
call fcn.1011c3e0
test eax, eax
je 0x10020310
lea eax, [ebp - 0x248]
mov dword [ebp - 0x30], eax
jmp 0x10020317
mov dword [ebp - 0x30], str.unknown
push 0x5c
mov eax, dword [ebp - 0x30]
push eax
call fcn.10025d50
add esp, 8
mov dword [ebp - 0x290], eax
cmp dword [ebp - 0x290], 0
je 0x10020340
mov eax, dword [ebp - 0x290]
add eax, 1
mov dword [ebp - 0x30], eax
cmp dword [0x1014fee8], 0
je 0x10020376
mov esi, esp
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x30]
push ecx
push str.WARNING:_Another_hook_is_already_present_while_trying_to_hook__s__hook_target_is__s._If_you_experience_crashes__try_disabling_the_other_hooking_application._n
mov edx, dword [0x1014fee8]
mov eax, dword [edx]
mov ecx, dword [0x1014fee8]
push ecx
mov edx, dword [eax + 0x1c]
call edx
add esp, 0x10
cmp esi, esp
call fcn.1011c3e0
push 0xe
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp - 0xc]
add edx, 9
push edx
call sub.VCRUNTIME140D.dll_memcpy
add esp, 0xc
mov al, 1
push edx
mov ecx, ebp
push eax
lea edx, [0x100203c0]
call fcn.1011c380
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1011c450
add esp, 0x414
cmp ebp, esp
call fcn.1011c3e0
mov esp, ebp
pop ebp
ret 8