Function at 0x10073030
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [ebp - 8], 0x24
xor edi, edi
mov dword [ebp - 4], 1
mov ebx, 2
nop
lea ecx, [ebx + 1]
mov eax, 0xf0f0f0f1
mul ecx
mov eax, edi
shr edx, 4
mov ecx, edx
shl ecx, 4
add ecx, edx
sub eax, ecx
movzx eax, byte [eax + 0x102e049b]
xor al, byte [ebx + 0x102e0446]
movzx esi, al
mov eax, 0xf0f0f0f1
mul ebx
mov eax, edi
add ebx, 4
shr edx, 4
mov ecx, edx
shl ecx, 4
add ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 4]
movzx eax, byte [eax + 0x102e049a]
xor al, byte [ecx + 0x102e0446]
movzx eax, al
add si, ax
mov eax, 0xf0f0f0f1
mul edi
mov eax, edi
shr edx, 4
mov ecx, edx
shl ecx, 4
add ecx, edx
sub eax, ecx
movzx eax, byte [eax + 0x102e0498]
xor al, byte [edi + 0x102e0445]
movzx eax, al
add si, ax
mov eax, 0xf0f0f0f1
mul dword [ebp - 4]
add dword [ebp - 4], 4
mov eax, edi
shr edx, 4
mov ecx, edx
shl ecx, 4
add ecx, edx
sub eax, ecx
movzx eax, byte [eax + 0x102e0499]
xor al, byte [edi + 0x102e0446]
add edi, 4
movzx eax, al
add si, ax
add word [ebp - 8], si
cmp ebx, 0x22
jb 0x10073050
mov al, byte [ebp - 8]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub al, 0x12
mov byte [0x1054acba], al
mov eax, dword [ebp - 8]
shr eax, 8
dec al
mov byte [0x1054acb9], al
mov eax, dword [0xd227b0]
mov dword [0x11329b20], eax
mov eax, dword [0xd227f8]
mov dword [0x11329b1c], eax
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0xd227b0
call esi
lea eax, [ebp - 8]
mov dword [0xd227b0], 0x10072e00
push eax
push dword [ebp - 8]
push 4
push 0xd227b0
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0xd227f8
call esi
lea eax, [ebp - 8]
mov dword [0xd227f8], 0x10072f10
push eax
push dword [ebp - 8]
push 4
push 0xd227f8
call esi
cmp dword [0x102e0720], 5
jne 0x1007330e
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x4d597b
call esi
lea eax, [ebp - 8]
mov dword [0x4d597b], 0x11329b18
push eax
push dword [ebp - 8]
push 4
push 0x4d597b
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x4da289
call esi
lea eax, [ebp - 8]
mov dword [0x4da289], 0x11329b18
push eax
push dword [ebp - 8]
push 4
push 0x4da289
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x4da297
call esi
lea eax, [ebp - 8]
mov dword [0x4da297], 0x11329b18
push eax
push dword [ebp - 8]
push 4
push 0x4da297
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x4da3a2
call esi
lea eax, [ebp - 8]
mov dword [0x4da3a2], 0x11329b18
push eax
push dword [ebp - 8]
push 4
push 0x4da3a2
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x4da3ce
call esi
lea eax, [ebp - 8]
mov dword [0x4da3ce], 0x11329b18
push eax
push dword [ebp - 8]
push 4
push 0x4da3ce
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x4da3d9
call esi
lea eax, [ebp - 8]
mov dword [0x4da3d9], 0x11329b18
push eax
push dword [ebp - 8]
push 4
push 0x4da3d9
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x63d326
call esi
lea eax, [ebp - 8]
mov dword [0x63d326], 0x11329b18
push eax
push dword [ebp - 8]
push 4
push 0x63d326
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x642112
call esi
lea eax, [ebp - 8]
mov dword [0x642112], 0x11329b18
push eax
push dword [ebp - 8]
push 4
push 0x642112
call esi
push 0x10073000
push 0x4da280
push 0xe9
call fcn.100d0480
push 0x10073320
push 0x4da3a1
push 0xe9
call fcn.100d0480
add esp, 0x18
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret