Function at 0x1000f2fa
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x10065040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10105508]
push ebx
mov bh, byte [0x101c30e8]
dec eax
push esi
push edi
cmp eax, 5
ja case.default.0x1000f278
jmp dword [eax*4 + 0x1000f730]
mov bl, 0x72
mov al, 0x41
mov cl, 0x44
mov dl, 0x42
mov byte [ebp - 0xc], 0
xor al, bl
xor cl, bl
mov byte [ebp - 0x10], bl
xor dl, bl
mov byte [ebp - 0xc], 0
mov byte [ebp - 0xf], al
mov al, 0x11
mov byte [ebp - 0xd], dl
mov dl, 0x34
xor al, dl
mov byte [ebp - 0xe], cl
mov byte [ebp - 0x1b], al
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1b]
push eax
lea eax, [ebp - 0xf]
jmp 0x1000f33e
mov cl, 0x3f
mov bl, 0xf
mov al, 0x3a
mov dl, cl
jmp 0x1000f287
mov al, 0x23
mov bl, 0x14
mov cl, al
mov dl, al
jmp 0x1000f287
mov al, 0x61
mov bl, 0x58
mov cl, al
mov dl, al
jmp 0x1000f287
mov ah, 0x65
mov byte [ebp - 0xb], 0
mov dl, 0x55
mov byte [ebp - 0x10], ah
mov al, 0x54
mov byte [ebp - 0xb], 0
mov cl, 0x50
mov bl, dl
xor al, ah
xor cl, ah
xor dl, ah
xor bl, ah
mov byte [ebp - 0xc], bl
jmp 0x1000f298
mov al, 0x60
mov byte [ebp - 0x22], 0
mov dl, al
mov byte [ebp - 0x22], 0
mov ch, 0x59
mov cl, al
mov bl, al
mov byte [ebp - 0x28], ch
mov ah, al
xor dl, ch
xor al, ch
mov byte [ebp - 0x25], dl
mov byte [ebp - 0x27], al
xor ah, ch
mov al, 0x11
mov byte [ebp - 0x23], ah
xor cl, ch
xor bl, ch
mov dl, 0x34
mov byte [ebp - 0x26], cl
xor al, dl
mov byte [ebp - 0x24], bl
mov byte [ebp - 0x1b], al
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1b]
push eax
lea eax, [ebp - 0x27]
mov cl, 0x5d
mov byte [ebp - 0x19], 0
xor cl, dl
mov byte [ebp - 0x1c], dl
push eax
mov byte [ebp - 0x1a], cl
mov byte [ebp - 0x19], 0
call fcn.10001350
mov eax, dword [ebp - 0x14]
add esp, 0xc
mov byte [0x101c1d9c], 1
mov dword [0x101645b0], eax
cmp byte [ebp + 8], 1
jne 0x1000f372
mov dl, 0xeb
jmp 0x1000f3cd
mov ah, 0x7a
mov byte [ebp - 0xb], 0
mov al, 0x4a
mov byte [ebp - 0x10], ah
xor al, ah
mov byte [ebp - 0x19], 0
mov dl, 0x4d
mov byte [ebp - 0xf], al
xor dl, ah
mov byte [ebp - 0xb], 0
mov byte [ebp - 0xd], dl
mov al, 0x33
mov dl, 0x16
mov byte [ebp - 0x19], 0
xor al, dl
mov byte [ebp - 0x1c], dl
mov cl, 2
mov byte [ebp - 0x1b], al
xor cl, ah
mov bl, 0x4e
xor bl, ah
mov byte [ebp - 0xe], cl
lea eax, [ebp - 0x14]
mov byte [ebp - 0xc], bl
push eax
lea eax, [ebp - 0x1b]
mov cl, 0x6e
push eax
lea eax, [ebp - 0xf]
xor cl, dl
push eax
mov byte [ebp - 0x1a], cl
call fcn.10001350
mov dl, byte [ebp - 0x14]
add esp, 0xc
mov ecx, dword [0x101c307c]
call fcn.100023d0
test bh, bh
je 0x1000f442
mov ah, 0x23
mov byte [ebp - 0xb], 0
mov al, 0x13
mov byte [ebp - 0x10], ah
xor al, ah
mov byte [ebp - 0x19], 0
mov dl, 0x60
mov byte [ebp - 0xf], al
xor dl, ah
mov byte [ebp - 0xb], 0
mov byte [ebp - 0xd], dl
mov al, 0x33
mov dl, 0x16
mov byte [ebp - 0x19], 0
xor al, dl
mov byte [ebp - 0x1c], dl
mov cl, 0x5b
mov byte [ebp - 0x1b], al
xor cl, ah
mov bl, 0x10
xor bl, ah
mov byte [ebp - 0xe], cl
lea eax, [ebp - 0x14]
mov byte [ebp - 0xc], bl
push eax
lea eax, [ebp - 0x1b]
mov cl, 0x6e
push eax
lea eax, [ebp - 0xf]
xor cl, dl
push eax
mov byte [ebp - 0x1a], cl
call fcn.10001350
mov dl, byte [ebp - 0x14]
add esp, 0xc
mov ecx, dword [0x101c3060]
call fcn.100023d0
xor eax, eax
cmp byte [0x101c30c7], al
setne al
cmp byte [ebp + 0x18], 1
mov dword [0x101c1db8], eax
jne 0x1000f490
mov al, 0x73
mov byte [ebp - 0xc], 0
mov dl, al
mov byte [ebp - 0xc], 0
mov cl, al
mov bl, 0x4a
xor al, bl
mov byte [ebp - 0x10], bl
mov byte [ebp - 0xf], al
xor dl, bl
mov byte [ebp - 0xd], dl
mov al, 0x7b
xor cl, bl
mov dl, 0x5e
xor al, dl
mov byte [ebp - 0xe], cl
mov byte [ebp - 0x1b], al
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1b]
push eax
lea eax, [ebp - 0xf]
jmp 0x1000f4c6
movaps xmm0, xmmword [0x1005f590]
xor ecx, ecx
movups xmmword [ebp - 0x3c], xmm0
mov byte [ebp - 0x2c], 0
mov al, byte [ebp - 0x3c]
xor byte [ebp + ecx - 0x3b], al
inc ecx
cmp ecx, 0xf
jb 0x1000f4a1
mov al, 0x7b
mov byte [ebp - 0x2c], 0
mov dl, 0x5e
xor al, dl
mov byte [ebp - 0x1b], al
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1b]
push eax
lea eax, [ebp - 0x3b]
mov cl, 0x38
mov byte [ebp - 0x19], 0
xor cl, dl
mov byte [ebp - 0x1c], dl
push eax
mov byte [ebp - 0x1a], cl
mov byte [ebp - 0x19], 0
call fcn.10001350
movss xmm0, dword [ebp - 0x14]
add esp, 0xc
call fcn.10006480
cmp byte [ebp + 0x1c], 1
jne 0x1000f581
mov ah, 0x2c
mov byte [ebp - 0x23], 0
mov cl, 0x15
mov byte [ebp - 0x28], ah
mov dl, cl
mov byte [ebp - 0x19], 0
xor dl, ah
mov byte [ebp - 0x23], 0
mov al, 1
mov byte [ebp - 0x25], dl
xor al, ah
mov byte [ebp - 0x19], 0
mov byte [ebp - 0x27], al
mov dl, 0x5e
mov bl, cl
mov byte [ebp - 0x1c], dl
xor cl, ah
mov al, 0x7b
xor al, dl
mov byte [ebp - 0x26], cl
xor bl, ah
mov byte [ebp - 0x1b], al
lea eax, [ebp - 0x14]
mov byte [ebp - 0x24], bl
push eax
lea eax, [ebp - 0x1b]
mov cl, 0x38
push eax
lea eax, [ebp - 0x27]
xor cl, dl
push eax
mov byte [ebp - 0x1a], cl
call fcn.10001350
movss xmm0, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
mov esi, dword [0x101c1ee8]
add esp, 0xc
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
movss dword [ebp - 0x40], xmm0
mov dword [ebp - 0xc], 0
push eax
push 0x40
push 8
push esi
call edi
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x18]
jmp 0x1000f611
mov cl, 0x39
mov dword [ebp - 0x3c], 0x170939
mov dword [ebp - 0x38], 0x9090900
xor eax, eax
mov dword [ebp - 0x34], 0x90909
mov word [ebp - 0x30], 0xc
xor byte [ebp + eax - 0x3b], cl
inc eax
cmp eax, 0xc
jae 0x1000f5af
mov cl, byte [ebp - 0x3c]
jmp 0x1000f5a0
mov dl, 0x5e
mov byte [ebp - 0x19], 0
mov al, 0x7b
mov byte [ebp - 0x2f], 0
xor al, dl
mov byte [ebp - 0x1c], dl
mov byte [ebp - 0x1b], al
mov cl, 0x38
lea eax, [ebp - 0x18]
mov byte [ebp - 0x19], 0
push eax
lea eax, [ebp - 0x1b]
xor cl, dl
push eax
lea eax, [ebp - 0x3b]
mov byte [ebp - 0x1a], cl
push eax
call fcn.10001350
movss xmm0, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov esi, dword [0x101c1ee8]
add esp, 0xc
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
movss dword [ebp - 0x40], xmm0
mov dword [ebp - 0x24], 0
push eax
push 0x40
push 8
push esi
call edi
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x14]
movss xmm0, dword [ebp - 0x40]
push 8
push esi
movss dword [esi], xmm0
call edi
cmp byte [ebp + 0x14], 1
jne 0x1000f6d9
call fcn.100033d0
mov ecx, eax
call fcn.10003510
test eax, eax
je 0x1000f6d9
mov eax, dword [0x101c3084]
add eax, dword [0x101c1e5c]
push 0
push eax
call fcn.1002cfd0
cvttss2si eax, xmm0
add esp, 8
cmp eax, 0x2a
jne 0x1000f6b6
cmp byte [0x101c1e2b], 0
jne 0x1000f6b6
mov byte [0x101c1e2b], 1
call fcn.100033d0
mov ecx, eax
call fcn.10003510
mov esi, dword [0x101c3084]
add esi, dword [0x101c1e5c]
test eax, eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x24], 0
push eax
push 0x40
push 8
push esi
je 0x1000f6a2
call edi
mov dword [esi], 0x4237999a
jmp 0x1000f6aa
call edi
mov dword [esi], 0x422a0000
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x18]
push 8
push esi
call edi
mov eax, dword [0x101c3084]
add eax, dword [0x101c1e5c]
push 0
push eax
call fcn.1002cfd0
cvttss2si eax, xmm0
add esp, 8
test eax, eax
jne 0x1000f6d9
mov byte [0x101c1e2b], al
mov esi, dword [0x101c30c0]
lea eax, [ebp - 0x18]
push eax
push 0x40
push 8
push esi
mov dword [ebp - 0x24], 0
call edi
cmp byte [ebp + 0x20], 1
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x18]
push 8
push esi
jne 0x1000f717
mov byte [esi], 4
call edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1002eb4c
mov esp, ebp
pop ebp
ret
mov byte [esi], 8
call edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002eb4c
mov esp, ebp
pop ebp
ret