Function at 0x1002c2c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100ab00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x100afb70]
test eax, eax
push ebx
mov ebx, ecx
mov ecx, 1
cmove eax, ecx
mov ecx, ebx
push esi
push edi
mov dword [0x100afb70], eax
call fcn.10028760
call fcn.100281b0
call fcn.1001f9b0
mov ecx, dword [0x100ae534]
test ecx, ecx
jne 0x1002c310
mov dword [0x100ade10], 0x32
jmp 0x1002c344
cmp ecx, 1
jne 0x1002c321
mov dword [0x100ade10], 6
jmp 0x1002c344
cmp ecx, 2
jne 0x1002c332
mov dword [0x100ade10], 5
jmp 0x1002c344
mov eax, dword [0x100ade10]
xor edx, edx
cmp ecx, 3
cmove eax, edx
mov dword [0x100ade10], eax
call fcn.10014ce0
test eax, eax
je 0x1002c3a6
push 0x75
mov dword [0x100ae7e4], 0x10014ff0
call fcn.10014ff0
cwde
shr eax, 0x10
test eax, eax
je 0x1002c39f
cmp byte [0x100b6e08], 0
je 0x1002c386
cmp dword [0x100b6e0c], 0
je 0x1002c3a6
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x100b6e0c], eax
ja 0x1002c3a6
xor eax, eax
mov byte [0x100b6e08], 1
cmp dword [0x100b68e8], eax
sete al
mov dword [0x100b68e8], eax
jmp 0x1002c3a6
mov byte [0x100b6e08], 0
call fcn.1001d8c0
call fcn.1001d5f0
mov ecx, ebx
call fcn.1001da30
call fcn.10025490
mov ecx, ebx
call fcn.1001f660
mov ecx, ebx
call fcn.100227b0
mov ecx, dword [0x100ae0c4]
mov eax, dword [0x100b2cf4]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [eax], 0
je 0x1002c480
cmp dword [0x100b68f0], 0
jne 0x1002c449
cmp dword [0x100b2c9c], 0
jne 0x1002c449
cmp dword [0x100b1dd0], 0
jne 0x1002c449
cmp dword [0x100af22c], 0
jne 0x1002c449
mov ecx, dword [0x100ae0c4]
mov eax, dword [0x100b2cf4]
add eax, 0x108
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x1002c4ba
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push edi
call esi
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
jmp 0x1002c4b2
mov ecx, dword [0x100ae0c4]
mov eax, dword [0x100b2cf4]
add eax, 0x108
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x1002c4ba
lea eax, [ebp - 0x10]
push eax
push 0x40
push 1
push edi
call esi
lea eax, [ebp - 0x10]
mov byte [edi], 0xcc
push eax
push dword [ebp - 0x10]
jmp 0x1002c4b5
mov ecx, dword [0x100ae0c4]
mov eax, dword [0x100b2cf4]
add eax, 0x108
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x1002c4ba
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
mov byte [edi], 0x55
push 1
push edi
call esi
mov ecx, dword [0x100ae0c4]
mov eax, dword [0x100b2cf4]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x1002c515
cmp dword [0x100ae4d8], 0
jne 0x1002c4e5
cmp dword [0x100af1f0], 0
je 0x1002c515
mov ecx, dword [0x100ae0c4]
mov eax, dword [0x100b2cf4]
add eax, 0x194
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x1002c54f
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0xcc
jmp 0x1002c543
mov ecx, dword [0x100ae0c4]
mov eax, dword [0x100b2cf4]
add eax, 0x194
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x1002c54f
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0x6a
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push edi
call esi
mov ecx, ebx
call fcn.10022130
mov ecx, ebx
call fcn.10020da0
mov ecx, ebx
call fcn.100219d0
mov ecx, ebx
call fcn.10021430
call fcn.10021670
call fcn.10021770
call fcn.10024860
call fcn.10024c00
call fcn.10024f30
call fcn.10024750
call fcn.10025720
cmp dword [0x100b6928], 0
je 0x1002c644
mov ecx, dword [0x100ae0c4]
mov eax, dword [0x100b2cf4]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x1002c644
push 0x20
mov dword [0x100ae7e4], 0x10014ff0
call fcn.10014ff0
cwde
shr eax, 0x10
test eax, eax
je 0x1002c63d
cmp byte [0x100b6b60], 0
je 0x1002c5f8
cmp dword [0x100b6b64], 0
je 0x1002c644
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov ecx, dword [0x100b6b64]
inc ecx
cmp ecx, eax
ja 0x1002c644
jmp 0x1002c5fe
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov byte [0x100b6b60], 1
call edi
mov ecx, dword [0x100ae0c4]
mov dword [0x100b6b64], eax
mov eax, dword [0x100b2cf4]
add eax, 0x16c
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea edi, [eax + 2]
cmp edi, 0x1000
jbe 0x1002c67f
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 3
jmp 0x1002c673
mov byte [0x100b6b60], 0
mov ecx, dword [0x100ae0c4]
mov eax, dword [0x100b2cf4]
add eax, 0x16c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
lea edi, [eax + 2]
cmp edi, 0x1000
jbe 0x1002c67f
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0x44
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push edi
call esi
call fcn.100250a0
call fcn.10025150
mov ecx, dword [0x100ae0c4]
mov eax, dword [0x100b2cf4]
add eax, 0x180
push eax
mov edx, dword [ecx]
call dword [edx + 4]
test eax, eax
je 0x1002c728
cmp dword [0x100b1d9c], 1
mov ecx, dword [0x100ae0c4]
mov eax, dword [0x100b2cf4]
mov edx, dword [ecx]
jne 0x1002c6fa
add eax, 0x1c
push eax
call dword [edx + 4]
mov ecx, dword [0x100ae0c4]
cmp dword [eax], 0
mov edx, dword [ecx]
mov eax, dword [0x100b2cf4]
je 0x1002c6fa
add eax, 0x180
push eax
call dword [edx + 4]
lea edi, [eax + 3]
cmp edi, 0x1000
jbe 0x1002c728
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0x66
jmp 0x1002c71c
add eax, 0x180
push eax
call dword [edx + 4]
lea edi, [eax + 3]
cmp edi, 0x1000
jbe 0x1002c728
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0x46
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push edi
call esi
call fcn.10025b30
call fcn.10021f20
cmp dword [0x100ae048], 1
jne 0x1002c7a7
mov ecx, dword [0x100ae0c4]
mov eax, dword [0x100b2cf4]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x1002c7a7
cmp dword [0x100b2e0c], 1
jne 0x1002c7f4
mov ecx, dword [0x100ae0c4]
mov eax, dword [0x100b2cf4]
add eax, 0x150
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x1002c79b
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
lea eax, [ebp - 8]
mov byte [edi], 0xcc
push eax
push dword [ebp - 8]
push 1
push edi
call esi
mov dword [0x100b2e0c], 0
jmp 0x1002c7f4
cmp dword [0x100b2e0c], 0
jne 0x1002c7f4
mov ecx, dword [0x100ae0c4]
mov eax, dword [0x100b2cf4]
add eax, 0x150
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x1002c7ea
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
lea eax, [ebp - 8]
mov byte [edi], 0x68
push eax
push dword [ebp - 8]
push 1
push edi
call esi
mov dword [0x100b2e0c], 1
call fcn.10022ff0
call fcn.10022f10
cmp dword [0x100ae060], 0
jle 0x1002c850
mov ecx, dword [0x100ae0c4]
mov eax, dword [0x100b2cf4]
add eax, 0x1c
push eax
mov edx, dword [ecx]
call dword [edx + 4]
cmp dword [eax], 0
je 0x1002c850
mov ecx, dword [0x100ae0c4]
mov eax, dword [0x100b2cf4]
add eax, 0x154
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x1002c88a
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0xcc
jmp 0x1002c87e
mov ecx, dword [0x100ae0c4]
mov eax, dword [0x100b2cf4]
add eax, 0x154
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov edi, eax
cmp edi, 0x1000
jbe 0x1002c88a
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push edi
call esi
mov byte [edi], 0x55
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push edi
call esi
call fcn.10025980
call fcn.10021870
call fcn.10025a70
call fcn.100255d0
call fcn.100252c0
call fcn.10025360
call fcn.10027b20
call fcn.10027830
mov ecx, ebx
call fcn.10027bb0
call fcn.1002bec0
call fcn.10025c70
call fcn.10027660
call fcn.10027180
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10077b59
mov esp, ebp
pop ebp
ret