Function at 0x1002c140
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1009400c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0x101db6d8
push 0x40
push 5
push 0x424ad4
call esi
push 0x101db6d8
push 0x40
push 1
push 0x4af1e7
call esi
push 0x101db6d8
push 0x40
push 5
push 0x40f623
call esi
push 0x101db6d8
push 0x40
push 0x13
push 0x41d9c3
call esi
push 0x101db6d8
push 0x40
push 0x3c
push 0x499a3b
call esi
push 0x101db6d8
push 0x40
push 5
push 0x494605
call esi
push 0x101db6d8
push 0x40
push 5
push 0x49485b
call esi
push 0x101db6d8
push 0x40
push 4
push 0x59d5fd
call esi
push 0x101db6d8
push 4
push 4
push 0x5d7e58
call esi
push 0x101db6d8
push 0x40
push 4
push 0x415cc7
call esi
push 0x101db6d8
push 0x40
push 4
push 0x416663
call esi
push 0x101db6d8
push 0x40
push 4
push 0x416913
call esi
push 0x101db6d8
push 0x40
push 4
push 0x416be3
call esi
push 0x101db6d8
push 0x40
push 4
push 0x412e8d
call esi
mov byte [0x424ad4], 0xe8
mov eax, 0x1002bff0
sub eax, 0x424ad9
mov dword [0x424ad5], eax
mov eax, 0x1002c0b0
mov byte [0x4af1e7], 0xeb
sub eax, 0x40f628
mov byte [0x40f623], 0xe9
mov dword [0x40f624], eax
mov byte [0x41d9c5], 0x54
mov eax, 0x1002c0d0
mov dword [0x41d9d3], 0x5d1cfc
sub eax, 0x49460a
mov byte [0x499a3c], 0x54
mov dword [0x499a44], 0x438
mov byte [0x499a49], 0x20
mov dword [0x499a6b], 0x360
mov byte [0x499a6f], 0x73
mov dword [0x499a72], 0x300
mov word [0x499a76], 0xeb73
mov dword [0x494606], eax
mov eax, 0x1002c0f0
push 0x101db6d8
sub eax, 0x494860
mov dword [0x49485c], eax
mov dword [0x412e8d], 0x101db6d0
push 0x40
mov dword [0x416be3], 0x101db6d0
mov dword [0x416913], 0x101db6d0
push 0xb
mov dword [0x416663], 0x101db6d0
push 0x56223f
mov dword [0x415cc7], 0x101db6d0
call esi
push 0x101db6d8
push 0x40
push 0x5e
push 0x4a9835
call esi
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0xc]
mov dword [0x56223f], eax
mov eax, dword [ebp - 8]
mov dword [0x562246], eax
xor eax, eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
cmp edx, dword [eax*4 + 0x101da524]
jne 0x1002c362
cmp ecx, dword [eax*4 + 0x101da510]
je 0x1002c368
inc eax
cmp eax, 5
jl 0x1002c350
cmp eax, 5
jne 0x1002c3fb
movups xmm1, xmmword [0x101da528]
mov dword [0x101da534], edx
movups xmm0, xmmword [0x101da514]
mov dword [0x101da520], ecx
movups xmmword [0x101da524], xmm1
movups xmmword [0x101da510], xmm0
movd dword [0x4a9835], xmm1
mov eax, dword [0x101da510]
mov dword [0x4a9867], eax
mov eax, dword [0x101da528]
mov dword [0x4a983f], eax
mov eax, dword [0x101da514]
mov dword [0x4a9871], eax
mov eax, dword [0x101da52c]
mov dword [0x4a9849], eax
mov eax, dword [0x101da518]
mov dword [0x4a987b], eax
mov eax, dword [0x101da530]
mov dword [0x4a9853], eax
mov eax, dword [0x101da51c]
mov dword [0x4a9885], eax
mov eax, dword [0x101da534]
mov dword [0x4a985d], eax
mov eax, dword [0x101da520]
mov dword [0x4a988f], eax
push 0x101db6d8
push 0x40
push 6
push 0x4c7940
call esi
push 0x101db6d8
push 0x40
push 4
push 0x4c7f14
call esi
mov ecx, dword [ebp - 4]
mov eax, 0x1002c110
sub eax, 0x4c7945
mov byte [0x4c7940], 0xe8
mov dword [0x4c7941], eax
xor ecx, ebp
mov byte [0x4c7945], 0x90
pop esi
call fcn.1004d763
mov esp, ebp
pop ebp
ret