Function at 0x10003bb0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x10016004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
mov dword [ebp - 0x44], 1
xor ecx, ecx
mov dword [ebp - 0x40], 5
push edi
mov dword [ebp - 0xc], ebx
xor edx, edx
nop dword [eax]
mov eax, dword [ebp + edx*4 - 0x44]
cmp eax, 0x18
ja case.0x10003bf0.18
movzx eax, byte [eax + 0x10003e94]
jmp dword [eax*4 + 0x10003e88]
inc ecx
jmp case.0x10003bf0.18
add ecx, 4
inc ebx
inc edx
cmp edx, 2
jb 0x10003be0
add ecx, 5
mov dword [ebp - 0xc], ebx
xor edx, edx
nop dword [eax]
mov eax, dword [ebp + edx*4 - 0x44]
cmp dword [eax*4 + 0x10013380], 0x1a
jne 0x10003c23
add ecx, 3
jmp case.default.0x10003c2f
cmp eax, 0x15
ja case.default.0x10003c2f
movzx eax, byte [eax + 0x10003eb4]
jmp dword [eax*4 + 0x10003eb0]
inc ecx
inc edx
cmp edx, 2
jb 0x10003c10
push esi
test ebx, ebx
lea esi, [ecx + 3]
cmovle esi, ecx
mov ecx, dword [0x101246ec]
inc esi
cmp ecx, 0xffffffff
jne 0x10003c65
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov ecx, dword [ebp - 0x34]
mov dword [0x101246ec], ecx
mov edx, dword [0x101259ec]
test edx, edx
je 0x10003c7c
mov ebx, dword [0x101259f0]
lea eax, [ebx + esi]
cmp eax, ecx
jle 0x10003c96
push 0x40
push 0x3000
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, eax
xor ebx, ebx
mov dword [0x101259ec], edx
lea ecx, [ebx + esi]
mov eax, ecx
mov dword [0x101259f0], ecx
lea edi, [ebx + edx]
and eax, 0x8000000f
jns 0x10003cb2
dec eax
or eax, 0xfffffff0
add eax, 1
je 0x10003ccd
mov eax, ecx
and eax, 0x8000000f
jns 0x10003cc2
dec eax
or eax, 0xfffffff0
inc eax
sub ecx, eax
add ecx, 0x10
mov dword [0x101259f0], ecx
mov dl, byte [ebp - 0xc]
xor esi, esi
shl dl, 2
mov ecx, 1
mov byte [ebp - 0x39], dl
nop dword [eax]
mov eax, dword [ebp + ecx*4 - 0x44]
cmp eax, 0x18
ja case.0x10003cf0.18
movzx eax, byte [eax + 0x10003ef0]
jmp dword [eax*4 + 0x10003ecc]
mov byte [edi + esi], 0x50
inc esi
jmp case.0x10003cf0.18
mov byte [edi + esi], 0x53
inc esi
jmp case.0x10003cf0.18
mov byte [edi + esi], 0x51
inc esi
jmp case.0x10003cf0.18
mov byte [edi + esi], 0x52
inc esi
jmp case.0x10003cf0.18
mov byte [edi + esi], 0x56
inc esi
jmp case.0x10003cf0.18
mov byte [edi + esi], 0x57
inc esi
jmp case.0x10003cf0.18
mov byte [edi + esi], 0x55
inc esi
jmp case.0x10003cf0.18
mov word [edi + esi], 0x74ff
mov byte [edi + esi + 2], 0x24
mov byte [edi + esi + 3], dl
add esi, 4
sub ecx, 1
jns 0x10003ce0
lea ebx, [edi + esi]
mov byte [ebp - 0x14], 0xe8
mov eax, 0x10001fa0
sub eax, ebx
sub eax, 5
cmp byte [0x101259f8], 0
mov dword [ebp - 0x13], eax
jne 0x10003d70
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [0x101259f4], eax
mov byte [0x101259f8], 1
jmp 0x10003d75
mov eax, dword [0x101259f4]
push 0
push 5
lea ecx, [ebp - 0x14]
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push eax
call ebx
add esi, 5
xor ecx, ecx
nop dword [eax]
mov eax, dword [ebp + ecx*4 - 0x44]
cmp dword [eax*4 + 0x10013380], 0x1a
jne 0x10003dae
mov word [edi + esi], 0xc483
mov byte [edi + esi + 2], 4
add esi, 3
jmp case.default.0x10003dba
cmp eax, 0x15
ja case.default.0x10003dba
movzx eax, byte [eax + 0x10003f28]
jmp dword [eax*4 + 0x10003f0c]
mov byte [edi + esi], 0x58
jmp 0x10003de9
mov byte [edi + esi], 0x5b
jmp 0x10003de9
mov byte [edi + esi], 0x59
jmp 0x10003de9
mov byte [edi + esi], 0x5a
jmp 0x10003de9
mov byte [edi + esi], 0x5e
jmp 0x10003de9
mov byte [edi + esi], 0x5f
jmp 0x10003de9
mov byte [edi + esi], 0x5d
inc esi
inc ecx
cmp ecx, 2
jb 0x10003d90
cmp dword [ebp - 0xc], 0
jle 0x10003e06
mov al, byte [ebp - 0x39]
mov word [edi + esi], 0xc483
mov byte [edi + esi + 2], al
add esi, 3
mov eax, 0x4843e0
mov byte [edi + esi], 0xc3
add edi, 0xffb7bc1b
pop esi
mov dword [ebp - 0xb], edi
cmp byte [eax], 0xe8
jne 0x10003e40
cmp byte [0x101259f8], 0
mov byte [ebp - 0xc], 0xe8
jne 0x10003e62
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov dword [0x101259f4], eax
mov byte [0x101259f8], 1
jmp 0x10003e67
cmp byte [0x101259f8], 0
mov byte [ebp - 0xc], 0xe9
jne 0x10003e62
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov dword [0x101259f4], eax
mov byte [0x101259f8], 1
jmp 0x10003e67
mov eax, dword [0x101259f4]
push 0
push 5
lea ecx, [ebp - 0xc]
push ecx
push 0x4843e0
push eax
call ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.10010943
mov esp, ebp
pop ebp
ret