Function at 0x1001f950
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x100c8564]
sub esp, 0x18
push ebx
push esi
push edi
test eax, eax
je 0x1001f981
mov ecx, dword [0x100c8568]
test ecx, ecx
je 0x1001f981
cmp eax, 0xffffffff
je 0x1001fe75
cmp ecx, 0xffffffff
jne 0x1001f99d
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 8]
push eax
call fcn.10013800
add esp, 4
mov ecx, dword [eax + 4]
mov dword [0x100c8564], ecx
mov eax, dword [eax]
mov dword [0x100c8568], eax
cmp dword [0x100c8640], 0
jne 0x1001f9ec
push 1
mov ecx, 0x100c6e90
call fcn.100017a0
push 0xffffffffffffffff
mov ecx, 0x100c6e90
call fcn.100017a0
mov eax, dword [0x100c6ec0]
push 1
push ecx
mov edx, dword [eax]
mov eax, esp
push ecx
mov ecx, esp
push edx
mov dword [eax], 0x10021480
call fcn.10018ab0
lea eax, [ebp - 4]
push eax
call fcn.1001f650
add esp, 0x10
mov eax, dword [eax]
mov dword [0x100c8640], eax
push 1
mov ecx, 0x100c6ed8
call fcn.100017a0
push 0xffffffffffffffff
mov ecx, 0x100c6ed8
call fcn.100017a0
mov eax, dword [0x100c6f08]
lea ecx, [ebp - 4]
mov eax, dword [eax]
add eax, 2
push eax
call fcn.10018ab0
mov esi, dword [ebp - 4]
lea eax, [ebp - 0x10]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push 1
push esi
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x18], esi
call ebx
test eax, eax
setne byte [ebp - 0xc]
mov byte [esi], 0x16
cmp byte [ebp - 0xc], 0
je 0x1001fa57
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 4], eax
push dword [ebp - 0x18]
call ebx
mov edi, dword [0x100c8564]
mov ecx, 0x100c6f20
push 1
call fcn.100017a0
push 0xffffffffffffffff
mov ecx, 0x100c6f20
call fcn.100017a0
mov eax, dword [0x100c6f50]
lea ecx, [ebp - 4]
mov eax, dword [eax]
add eax, 0xe
push eax
call fcn.10018ab0
mov esi, dword [ebp - 4]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push esi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0x18], esi
call ebx
test eax, eax
setne byte [ebp - 0xc]
mov dword [esi], edi
cmp byte [ebp - 0xc], 0
je 0x1001fac1
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 4], eax
push dword [ebp - 0x18]
call ebx
mov edi, dword [0x100c8568]
mov ecx, 0x100c6f20
push 1
call fcn.100017a0
push 0xffffffffffffffff
mov ecx, 0x100c6f20
call fcn.100017a0
mov eax, dword [0x100c6f50]
lea ecx, [ebp - 4]
mov eax, dword [eax]
add eax, 0x18
push eax
call fcn.10018ab0
mov esi, dword [ebp - 4]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push esi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0x18], esi
call ebx
test eax, eax
setne byte [ebp - 0xc]
mov dword [esi], edi
cmp byte [ebp - 0xc], 0
je 0x1001fb2b
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 4], eax
push dword [ebp - 0x18]
call ebx
push 1
mov ecx, 0x100c6f20
call fcn.100017a0
push 0xffffffffffffffff
mov ecx, 0x100c6f20
call fcn.100017a0
mov eax, dword [0x100c6f50]
lea ecx, [ebp - 4]
mov eax, dword [eax]
add eax, 0x22
push eax
call fcn.10018ab0
mov esi, dword [ebp - 4]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 1
push esi
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x18], esi
call ebx
test eax, eax
setne byte [ebp - 0xc]
mov byte [esi], 0x20
cmp byte [ebp - 0xc], 0
je 0x1001fb90
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 4], eax
push dword [ebp - 0x18]
call ebx
mov edi, dword [0x100c8564]
mov ecx, 0x100c6f68
push 2
call fcn.100017a0
push 0xffffffffffffffff
mov ecx, 0x100c6f68
call fcn.100017a0
mov eax, dword [0x100c6f98]
lea ecx, [ebp - 4]
mov eax, dword [eax]
add eax, 0x10
push eax
call fcn.10018ab0
mov esi, dword [ebp - 4]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push esi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0x18], esi
call ebx
test eax, eax
setne byte [ebp - 0xc]
mov dword [esi], edi
cmp byte [ebp - 0xc], 0
je 0x1001fbfa
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 4], eax
push dword [ebp - 0x18]
call ebx
mov edi, dword [0x100c8568]
mov ecx, 0x100c6f68
push 2
call fcn.100017a0
push 0xffffffffffffffff
mov ecx, 0x100c6f68
call fcn.100017a0
mov eax, dword [0x100c6f98]
lea ecx, [ebp - 4]
mov eax, dword [eax]
add eax, 0x1a
push eax
call fcn.10018ab0
mov esi, dword [ebp - 4]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push esi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0x18], esi
call ebx
test eax, eax
setne byte [ebp - 0xc]
mov dword [esi], edi
cmp byte [ebp - 0xc], 0
je 0x1001fc64
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 4], eax
push dword [ebp - 0x18]
call ebx
mov edi, dword [0x100c8564]
mov ecx, 0x100c6f68
push 2
call fcn.100017a0
push 0xffffffffffffffff
mov ecx, 0x100c6f68
call fcn.100017a0
mov eax, dword [0x100c6f98]
lea ecx, [ebp - 4]
mov eax, dword [eax + 4]
add eax, 0x10
push eax
call fcn.10018ab0
mov esi, dword [ebp - 4]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push esi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0x18], esi
call ebx
test eax, eax
setne byte [ebp - 0xc]
mov dword [esi], edi
cmp byte [ebp - 0xc], 0
je 0x1001fccf
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 4], eax
push dword [ebp - 0x18]
call ebx
mov edi, dword [0x100c8568]
mov ecx, 0x100c6f68
push 2
call fcn.100017a0
push 0xffffffffffffffff
mov ecx, 0x100c6f68
call fcn.100017a0
mov eax, dword [0x100c6f98]
lea ecx, [ebp - 4]
mov eax, dword [eax + 4]
add eax, 0x1a
push eax
call fcn.10018ab0
mov esi, dword [ebp - 4]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push esi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0x18], esi
call ebx
test eax, eax
setne byte [ebp - 0xc]
mov dword [esi], edi
cmp byte [ebp - 0xc], 0
je 0x1001fd3a
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 4], eax
push dword [ebp - 0x18]
call ebx
push 1
mov ecx, 0x100c6fb0
call fcn.100017a0
push 0xffffffffffffffff
mov ecx, 0x100c6fb0
call fcn.100017a0
mov eax, dword [0x100c6fe0]
lea ecx, [ebp - 4]
mov eax, dword [eax]
add eax, 0xf
push eax
call fcn.10018ab0
mov esi, dword [ebp - 4]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 1
push esi
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x18], esi
call ebx
test eax, eax
setne byte [ebp - 0xc]
mov byte [esi], 0xeb
cmp byte [ebp - 0xc], 0
je 0x1001fd9f
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 4], eax
push dword [ebp - 0x18]
call ebx
push 1
mov ecx, 0x100c6ff8
call fcn.100017a0
push 0xffffffffffffffff
mov ecx, 0x100c6ff8
call fcn.100017a0
mov eax, dword [0x100c7028]
lea ecx, [ebp - 4]
mov eax, dword [eax]
add eax, 5
push eax
call fcn.10018ab0
mov esi, dword [ebp - 4]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 5
push esi
mov dword [ebp - 0x14], 5
mov dword [ebp - 0x18], esi
call ebx
test eax, eax
setne byte [ebp - 0xc]
mov dword [esi], 0x90909090
mov byte [esi + 4], 0x90
cmp byte [ebp - 0xc], 0
je 0x1001fe0b
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 4], eax
push dword [ebp - 0x18]
call ebx
push 1
mov ecx, 0x100c6ff8
call fcn.100017a0
push 0xffffffffffffffff
mov ecx, 0x100c6ff8
call fcn.100017a0
mov eax, dword [0x100c7028]
lea ecx, [ebp - 4]
mov eax, dword [eax]
add eax, 5
push eax
call fcn.10018ab0
mov esi, dword [ebp - 4]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 2
push esi
mov dword [ebp - 0x14], 2
mov dword [ebp - 0x18], esi
call ebx
test eax, eax
mov eax, 0x7eb
setne byte [ebp - 0xc]
mov word [esi], ax
cmp byte [ebp - 0xc], 0
je 0x1001fe75
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 4], eax
push dword [ebp - 0x18]
call ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret