Function at 0x10022810
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 8
mov eax, dword [0x100bbc58]
push ebx
push ebp
push esi
push edi
push eax
call fcn.10080a42
mov ebp, eax
call fcn.10081ab1
mov esi, eax
imul esi, esi, 0xff
call fcn.10081ab1
mov edx, dword [0x100bbc58]
mov ecx, dword [0x100bbc64]
push edx
mov ebx, eax
push 0x90
add ebx, esi
push ebp
mov byte [esp + 0x23], bl
mov dword [esp + 0x24], ecx
call fcn.10082ee0
mov eax, dword [0x100bbc50]
add eax, 0xffffffff
add esp, 0x10
cmp eax, 0xe
ja case.default.0x1002286e
jmp dword [eax*4 + 0x10022af8]
mov byte [ebp], 0xe9
mov eax, dword [esp + 0x14]
sub eax, dword [0x100bbc60]
sub eax, 5
mov dword [ebp + 1], eax
jmp case.default.0x1002286e
mov byte [ebp], 0x68
mov ecx, dword [esp + 0x14]
mov dword [ebp + 1], ecx
mov byte [ebp + 5], 0xc3
jmp case.default.0x1002286e
mov byte [ebp + 1], 0xe9
mov edx, dword [esp + 0x14]
sub edx, dword [0x100bbc60]
sub edx, 6
mov dword [ebp + 2], edx
jmp case.default.0x1002286e
mov byte [ebp + 2], 0xe9
mov eax, dword [esp + 0x14]
sub eax, dword [0x100bbc60]
sub eax, 7
mov dword [ebp + 3], eax
jmp case.default.0x1002286e
mov byte [ebp], 0xf9
mov byte [ebp + 1], 0xf
mov byte [ebp + 2], 0x82
mov ecx, dword [esp + 0x14]
sub ecx, dword [0x100bbc60]
sub ecx, 7
mov dword [ebp + 3], ecx
jmp case.default.0x1002286e
mov byte [ebp], 0xf8
mov byte [ebp + 1], 0xf
mov byte [ebp + 2], 0x83
mov edx, dword [esp + 0x14]
sub edx, dword [0x100bbc60]
sub edx, 7
mov dword [ebp + 3], edx
jmp case.default.0x1002286e
mov byte [ebp + 1], 0xf9
mov byte [ebp + 2], 0xf
mov byte [ebp + 3], 0x82
mov eax, dword [esp + 0x14]
sub eax, dword [0x100bbc60]
sub eax, 8
mov dword [ebp + 4], eax
jmp case.default.0x1002286e
mov byte [ebp + 2], 0xf8
mov byte [ebp + 3], 0xf
mov byte [ebp + 4], 0x83
mov ecx, dword [esp + 0x14]
sub ecx, dword [0x100bbc60]
sub ecx, 9
mov dword [ebp + 5], ecx
jmp case.default.0x1002286e
mov byte [ebp + 3], 0xf9
mov byte [ebp + 4], 0xf
mov byte [ebp + 5], 0x82
mov edx, dword [esp + 0x14]
sub edx, dword [0x100bbc60]
sub edx, 0xa
mov dword [ebp + 6], edx
jmp case.default.0x1002286e
mov byte [ebp + 4], 0xf9
mov byte [ebp + 5], 0xf
mov byte [ebp + 6], 0x82
mov eax, dword [esp + 0x14]
sub eax, dword [0x100bbc60]
sub eax, 0xb
mov dword [ebp + 7], eax
jmp case.default.0x1002286e
mov byte [ebp], 0xb8
mov dword [ebp + 1], ebx
mov byte [ebp + 5], 5
mov ecx, dword [esp + 0x14]
mov byte [ebp + 0xa], 0xff
mov byte [ebp + 0xb], 0xe0
jmp 0x10022a91
mov dword [ebp + 3], ebx
neg ebx
mov byte [ebp], 0x33
mov byte [ebp + 1], 0xc0
mov byte [ebp + 2], 0x2d
mov byte [ebp + 7], 0x35
xor ebx, dword [esp + 0x14]
mov byte [ebp + 0xc], 0xff
mov dword [ebp + 8], ebx
mov byte [ebp + 0xd], 0xe0
jmp case.default.0x1002286e
mov byte [ebp], 0x68
mov dword [ebp + 1], ebx
mov byte [ebp + 5], 0x81
mov byte [ebp + 6], 0x34
mov byte [ebp + 7], 0x24
mov edx, dword [esp + 0x14]
xor edx, ebx
mov dword [ebp + 8], edx
mov byte [ebp + 0xc], 0xc3
jmp case.default.0x1002286e
movzx eax, bl
and eax, 0x8000001f
jns 0x10022a13
dec eax
or eax, 0xffffffe0
inc eax
jne 0x10022a30
call fcn.10081ab1
movzx ecx, al
and ecx, 0x8000001f
mov byte [esp + 0x13], al
jns 0x10022a2e
dec ecx
or ecx, 0xffffffe0
inc ecx
je 0x10022a15
pushal
mov cl, byte [esp + 0x33]
mov eax, dword [esp + 0x34]
rol eax, cl
mov dword [esp + 0x34], eax
popal
mov dl, byte [esp + 0x13]
mov byte [ebp], 0x51
mov byte [ebp + 1], 0xb1
mov byte [ebp + 2], dl
mov byte [ebp + 3], 0xb8
mov eax, dword [esp + 0x14]
mov dword [ebp + 4], eax
mov byte [ebp + 8], 0xd3
mov byte [ebp + 9], 0xc8
mov byte [ebp + 0xa], 0x59
mov byte [ebp + 0xb], 0xff
mov byte [ebp + 0xc], 0xe0
jmp case.default.0x1002286e
mov byte [ebp], 0xb8
mov dword [ebp + 1], ebx
mov byte [ebp + 5], 5
mov ecx, dword [esp + 0x14]
not ecx
mov byte [ebp + 0xa], 0xf7
mov byte [ebp + 0xb], 0xd0
mov byte [ebp + 0xc], 0xff
mov byte [ebp + 0xd], 0xe0
sub ecx, ebx
mov dword [ebp + 6], ecx
mov edx, dword [0x100bbc58]
mov eax, dword [0x100bbc60]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0x100bbc5c
push 0x40
push edx
push eax
call esi
mov ecx, dword [0x100bbc58]
mov edx, dword [0x100bbc60]
push ecx
push ebp
push edx
call fcn.10083e00
mov eax, dword [0x100bbc5c]
mov ecx, dword [0x100bbc58]
mov edx, dword [0x100bbc60]
add esp, 0xc
push 0x100bbc5c
push eax
push ecx
push edx
call esi
push ebp
call fcn.10081d27
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret