Function at 0x1002dd30
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
xor ebx, ebx
mov esi, eax
mov dword [0x101e4870], ebx
mov dword [0x101e4874], ebx
call edi
mov dword [0x101e4878], eax
call edi
mov ecx, dword [esi + 0x3c]
mov dword [0x101e487c], eax
mov eax, dword [esi + 0x38]
mov dword [0x101e47a0], ecx
mov edx, dword [esi + 0x40]
mov dword [0x101e47a8], edx
mov dword [0x101e4798], eax
mov eax, dword [esi + 0x44]
mov dword [0x101e47ac], eax
mov ecx, dword [esi + 0x48]
mov dword [0x101e47b0], ecx
mov edx, dword [esi + 0x4c]
mov dword [0x101e47b4], edx
mov eax, dword [esi + 0x50]
mov ecx, dword [esi + 0x54]
mov edx, dword [esi + 0x58]
mov dword [0x101e47d0], edx
mov dword [0x101e47b8], eax
mov eax, dword [esi + 0x5c]
mov dword [0x101e47d4], eax
mov dword [0x101e47bc], ecx
mov ecx, dword [esi + 0x60]
mov dword [0x101e47d8], ecx
mov edx, dword [esi + 0x64]
mov dword [0x101e47dc], edx
mov eax, dword [esi + 0x68]
mov dword [0x101e47e0], eax
movzx ecx, word [esi + 0x6e]
mov edx, dword [esi + 0x72]
mov dword [0x101dbac0], edx
mov eax, dword [esi + 0x76]
mov dword [0x101dbac4], eax
mov dword [0x101e47a4], ecx
mov cx, word [esi + 0x7a]
mov word [0x101dbac8], cx
mov dx, word [esi + 0x70]
mov word [0x101e47c8], dx
mov eax, dword [0x74d2b2c]
xor ecx, ecx
mov word [eax + 0x22c], cx
mov edx, dword [0x74d2b2c]
mov byte [edx], bl
mov eax, dword [0x74d2c5c]
push eax
mov edx, 0x40b3c0
mov ecx, 0x7afea08
mov dword [0x101e4880], ebx
mov dword [0x101e4884], ebx
mov dword [0x101e4888], ebx
mov dword [0x101e488c], ebx
call edx
mov eax, dword [0x74d2c58]
movzx ecx, byte [eax + 0xb]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea edx, [ebp - 4]
push edx
push 0x40
push 1
and ecx, 7
mov bl, byte [ecx + 0x10116530]
push 0x510e56
call edi
lea eax, [ebp - 4]
push eax
mov byte [0x510e56], bl
mov ecx, dword [ebp - 4]
push ecx
push 1
push 0x510e56
call edi
mov edx, dword [0x74d2c5c]
push edx
mov eax, 0x40b460
mov ecx, 0x7afea08
call eax
movzx eax, word [esi + 0x6c]
mov word [0x101e4868], ax
cmp eax, 5
ja case.default.0x1002dea0
jmp dword [eax*4 + 0x1002df90]
cmp dword [0x10116510], 0xffff
lea ecx, [ebp - 4]
push ecx
push 0x40
sbb bl, bl
push 1
and bl, 0xd
push 0x510e56
add bl, 2
call edi
lea edx, [ebp - 4]
push edx
mov byte [0x510e56], bl
mov eax, dword [ebp - 4]
push eax
push 1
push 0x510e56
call edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [0x101e47d4], 0xfde8
mov esi, 0x510e56
jae 0x1002df1c
cmp dword [0x10116514], 0xffff
sbb cl, cl
and cl, 0xd
add cl, 2
movzx edx, cl
push edx
call fcn.10034b30
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xf
call fcn.10034b30
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [0x10116518], 0xffff
jmp 0x1002df5b
cmp dword [0x1011651c], 0xffff
jmp 0x1002df5b
cmp dword [0x10116520], 0xffff
jmp 0x1002df5b
cmp dword [0x10116524], 0xffff
lea eax, [ebp - 4]
push eax
push 0x40
sbb bl, bl
push 1
and bl, 0xd
push 0x510e56
add bl, 2
call edi
lea ecx, [ebp - 4]
push ecx
mov byte [0x510e56], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x510e56
call edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret