Function at 0x1001a8a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0x1001a6e0
push 0x8cbe1d
mov bl, 0xe8
call fcn.100b6700
push 0x1001a730
push 0x8cbe4a
call fcn.100b6700
push 0x1001a780
push 0x8cbe77
call fcn.100b6700
push 0x1001a800
push 0x8cbea4
call fcn.100b6700
push 0x1001a850
push 0x8cbed1
call fcn.100b6700
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
xor ebx, ebx
add esp, 0x28
cmp dword [0x102ee018], ebx
jne 0x1001aa84
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x81a3f5
mov edi, str.CustomInterfaceS6Master_Icon.jpg
mov dword [ebp - 4], ebx
call esi
test eax, eax
je 0x1001a943
mov ecx, 0x81a3f5
mov dword [ecx], edi
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push eax
push 4
push ecx
mov dword [ebp - 8], ebx
call esi
test eax, eax
jne 0x1001a949
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 4]
push ecx
push 0x40
push 4
push 0x81a415
mov edi, str.CustomInterfaceS6Master_non_Icon.jpg
mov dword [ebp - 4], ebx
call esi
test eax, eax
jne 0x1001a96e
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
jmp 0x1001a995
mov edx, 0x81a415
mov dword [edx], edi
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ecx
push 4
push edx
mov dword [ebp - 8], ebx
call esi
test eax, eax
jne 0x1001a98f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [ebp - 4]
push edx
push 0x40
push 4
push 0x8124fb
call esi
mov ebx, str.CustomInterfaceS6Skill2.jpg
lea eax, [ebp - 4]
push eax
mov dword [0x8124fb], ebx
mov ecx, dword [ebp - 4]
push ecx
push 4
push 0x8124fb
call esi
lea edx, [ebp - 4]
push edx
push 0x40
push 4
push 0x86d10d
call esi
lea eax, [ebp - 4]
push eax
mov dword [0x86d10d], ebx
mov ecx, dword [ebp - 4]
push ecx
push 4
push 0x86d10d
call esi
lea edx, [ebp - 4]
push edx
push 0x40
push 4
push 0x888e7b
call esi
lea eax, [ebp - 4]
push eax
mov dword [0x888e7b], ebx
mov ecx, dword [ebp - 4]
push ecx
push 4
push 0x888e7b
call esi
lea edx, [ebp - 4]
push edx
push 0x40
push 4
push 0x81259b
call esi
mov ebx, str.CustomInterfaceS6Non_Skill2.jpg
lea eax, [ebp - 4]
push eax
mov dword [0x81259b], ebx
mov ecx, dword [ebp - 4]
push ecx
push 4
push 0x81259b
call esi
lea edx, [ebp - 4]
push edx
push 0x40
push 4
push 0x86d12d
call esi
lea eax, [ebp - 4]
push eax
mov dword [0x86d12d], ebx
mov ecx, dword [ebp - 4]
push ecx
push 4
push 0x86d12d
call esi
push 0x1001a310
push 0x7e020c
mov bl, 0xe8
call fcn.100b6700
push 0x1001a310
push 0x7e0298
call fcn.100b6700
add esp, 0x10
xor ebx, ebx
jmp 0x1001aa8a
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x102ee018], 4
jne 0x1001aab8
push 0x1001a310
push 0x7e020c
mov bl, 0xe8
call fcn.100b6700
push 0x1001a310
push 0x7e0298
call fcn.100b6700
add esp, 0x10
xor ebx, ebx
cmp dword [0x102ee01c], ebx
jne 0x1001aad6
push 0x1001a200
push 0x4d712a
mov bl, 0xe8
call fcn.100b6700
add esp, 8
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push 0x40
mov edx, 0x1001a680
push 5
sub edx, 0x4d87cd
push 0x4d87c8
mov byte [ebp - 0x10], 0xe9
mov dword [ebp - 0xf], edx
mov dword [ebp - 4], ebx
call esi
test eax, eax
je 0x1001ab26
mov ecx, dword [ebp - 0x10]
mov dl, byte [ebp - 0xc]
mov eax, 0x4d87c8
mov dword [eax], ecx
mov byte [eax + 4], dl
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ecx
push 5
push 0x4d87c8
mov dword [ebp - 8], ebx
call esi
test eax, eax
jne 0x1001ab28
call edi
lea eax, [ebp - 4]
push eax
push 0x40
mov edx, 0x1001a6a0
push 5
sub edx, 0x4d8801
push 0x4d87fc
mov byte [ebp - 0x10], 0xe9
mov dword [ebp - 0xf], edx
mov dword [ebp - 4], ebx
call esi
test eax, eax
je 0x1001ab78
mov ecx, dword [ebp - 0x10]
mov dl, byte [ebp - 0xc]
mov eax, 0x4d87fc
mov dword [eax], ecx
mov byte [eax + 4], dl
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ecx
push 5
push 0x4d87fc
mov dword [ebp - 8], ebx
call esi
test eax, eax
jne 0x1001ab7a
call edi
lea eax, [ebp - 4]
push eax
push 0x40
mov edx, 0x1001a6c0
push 5
sub edx, 0x5db530
push 0x5db52b
mov byte [ebp - 0x10], 0xe9
mov dword [ebp - 0xf], edx
mov dword [ebp - 4], ebx
call esi
test eax, eax
je 0x1001abca
mov ecx, dword [ebp - 0x10]
mov dl, byte [ebp - 0xc]
mov eax, 0x5db52b
mov dword [eax], ecx
mov byte [eax + 4], dl
mov ecx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
push ecx
push 5
push 0x5db52b
mov dword [ebp - 8], ebx
call esi
test eax, eax
jne 0x1001abcc
call edi
mov edi, 1
cmp dword [0x102ee01c], edi
jne 0x1001b0b8
push 0x10013f50
push 0x62df68
mov bl, 0xe8
call fcn.100b6700
push 0x10019c50
push 0x4d76fb
call fcn.100b6700
push 0x10019c50
push 0x4d79c3
call fcn.100b6700
add esp, 0x18
lea edx, [ebp - 4]
push edx
push 0x40
push 4
push 0x4d75f0
call esi
lea eax, [ebp - 4]
push eax
mov dword [0x4d75f0], 0x63
mov ecx, dword [ebp - 4]
push ecx
push 4
push 0x4d75f0
call esi
push 0x10019d30
push 0x5edda9
call fcn.100b6700
push 0x100197a0
push 0x4032ab
mov dword [0x103a041c], edi
call fcn.100b6700
push 0x100199c0
push 0x4d5ec3
call fcn.100b6700
push 0x100197a0
push 0x4d712a
call fcn.100b6700
push 0x100199d0
push 0x4d7568
call fcn.100b6700
push 0x100199d0
push 0x4d7534
call fcn.100b6700
add esp, 0x30
lea edx, [ebp - 4]
push edx
push 0x40
push 4
push 0x4d6c2c
call esi
lea eax, [ebp - 4]
push eax
mov dword [0x4d6c2c], 0xffffffff
mov ecx, dword [ebp - 4]
push ecx
push 4
push 0x4d6c2c
call esi
lea edx, [ebp - 4]
push edx
push 0x40
push 4
push 0x483947
call esi
lea eax, [ebp - 4]
push eax
mov dword [0x483947], 0xe5ebf8
mov ecx, dword [ebp - 4]
push ecx
push 4
push 0x483947
call esi
lea edx, [ebp - 4]
push edx
push 0x40
push 4
push 0x4d7179
call esi
mov dword [0x4d7179], 0x1e0
lea eax, [ebp - 4]
mov ecx, dword [ebp - 4]
push eax
push ecx
push 4
push 0x4d7179
call esi
lea edx, [ebp - 4]
push edx
push 0x40
push edi
push 0x4d7183
call esi
lea eax, [ebp - 4]
push eax
mov byte [0x4d7183], 0
mov ecx, dword [ebp - 4]
push ecx
push edi
push 0x4d7183
call esi
lea edx, [ebp - 4]
push edx
push 0x40
push 4
push 0xd41dcc
call esi
fld dword [0x100d32b4]
lea eax, [ebp - 4]
fstp dword [0xd41dcc]
mov ecx, dword [ebp - 4]
push eax
push ecx
push 4
push 0xd41dcc
call esi
lea edx, [ebp - 4]
push edx
push 0x40
push 4
push 0xd41dc8
call esi
fld dword [0x100d32b0]
lea eax, [ebp - 4]
fstp dword [0xd41dc8]
mov ecx, dword [ebp - 4]
push eax
push ecx
push 4
push 0xd41dc8
call esi
lea edx, [ebp - 4]
push edx
push 0x40
push 4
push 0xd41dc4
call esi
fld dword [0x100d32ac]
lea eax, [ebp - 4]
fstp dword [0xd41dc4]
mov ecx, dword [ebp - 4]
push eax
push ecx
push 4
push 0xd41dc4
call esi
lea edx, [ebp - 4]
push edx
push 0x40
push 4
push 0xd41dc0
call esi
fld dword [0x100d32a8]
lea eax, [ebp - 4]
fstp dword [0xd41dc0]
mov ecx, dword [ebp - 4]
push eax
push ecx
push 4
push 0xd41dc0
call esi
lea edx, [ebp - 4]
push edx
push 0x40
push 4
push 0xd41dbc
call esi
fld dword [0x100d32a4]
lea eax, [ebp - 4]
fstp dword [0xd41dbc]
mov ecx, dword [ebp - 4]
push eax
push ecx
push 4
push 0xd41dbc
call esi
lea edx, [ebp - 4]
push edx
push 0x40
push 4
push 0xd41db8
call esi
fld dword [0x100d32a0]
lea eax, [ebp - 4]
fstp dword [0xd41db8]
mov ecx, dword [ebp - 4]
push eax
push ecx
push 4
push 0xd41db8
call esi
lea edx, [ebp - 4]
push edx
push 0x40
push 4
push 0xd41db4
call esi
fld dword [0x100d32ac]
lea eax, [ebp - 4]
fstp dword [0xd41db4]
mov ecx, dword [ebp - 4]
push eax
push ecx
push 4
push 0xd41db4
call esi
lea edx, [ebp - 4]
push edx
push 0x40
push 4
push 0xd41db0
call esi
fld dword [0x100d329c]
lea eax, [ebp - 4]
fstp dword [0xd41db0]
mov ecx, dword [ebp - 4]
push eax
push ecx
push 4
push 0xd41db0
call esi
lea edx, [ebp - 4]
push edx
push 0x40
push 4
push 0xd41dac
call esi
fld dword [0x100d32b4]
lea eax, [ebp - 4]
fstp dword [0xd41dac]
mov ecx, dword [ebp - 4]
push eax
push ecx
push 4
push 0xd41dac
call esi
lea edx, [ebp - 4]
push edx
push 0x40
push 4
push 0xd41da8
call esi
fld dword [0x100d3298]
lea eax, [ebp - 4]
fstp dword [0xd41da8]
mov ecx, dword [ebp - 4]
push eax
push ecx
push 4
push 0xd41da8
call esi
lea edx, [ebp - 4]
push edx
push 0x40
push 8
push 0xe5ebb8
call esi
fld qword [0x100d3290]
lea eax, [ebp - 4]
fstp qword [0xe5ebb8]
mov ecx, dword [ebp - 4]
push eax
push ecx
push 8
push 0xe5ebb8
call esi
lea edx, [ebp - 4]
push edx
push 0x40
push 4
push 0x401e0b
call esi
lea eax, [ebp - 4]
push eax
mov dword [0x401e0b], 0xe5ebb8
mov ecx, dword [ebp - 4]
push ecx
push 4
push 0x401e0b
call esi
lea edx, [ebp - 4]
push edx
push 0x40
push 4
push 0x401d30
call esi
lea eax, [ebp - 4]
push eax
mov dword [0x401d30], 0x6d4
mov ecx, dword [ebp - 4]
push ecx
push 4
push 0x401d30
call esi
lea edx, [ebp - 4]
push edx
push 0x40
push 0x20d
push 0x405380
call esi
push 0x20d
push 0x90
push 0x405380
call sub.MSVCR100.dll_memset
mov ecx, dword [ebp - 4]
add esp, 0xc
lea eax, [ebp - 4]
push eax
push ecx
push 0x20d
push 0x405380
call esi
lea edx, [ebp - 4]
push edx
push 0x40
push 5
push 0x4d74ce
call esi
mov eax, 0x90909090
mov ecx, 0x4d74ce
mov dword [ecx], eax
mov byte [ecx + 4], al
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
push ecx
push 5
push 0x4d74ce
call esi
lea edx, [ebp - 4]
push edx
push 0x40
push 5
push 0x4d7568
call esi
mov eax, 0x90909090
mov ecx, 0x4d7568
mov dword [ecx], eax
mov byte [ecx + 4], al
mov ecx, dword [ebp - 4]
lea eax, [ebp - 4]
push eax
push ecx
push 5
push 0x4d7568
call esi
lea edx, [ebp - 4]
push edx
push 0x40
push 5
push 0x4d7465
call esi
mov eax, 0x90909090
mov ecx, 0x4d7465
mov dword [ecx], eax
mov byte [ecx + 4], al
mov ecx, dword [ebp - 4]
lea eax, [ebp - 4]
push eax
push ecx
push 5
push 0x4d7465
call esi
mov cl, 0xe9
mov eax, 0x1001a120
mov esi, 0x57f159
call fcn.100b6500
mov cl, 0xe9
mov eax, 0x1001a140
mov esi, 0x57f148
call fcn.100b6500
mov cl, 0xe9
mov eax, 0x1001a160
mov esi, 0x57f16a
call fcn.100b6500
mov cl, 0xe9
mov eax, 0x1001a180
mov esi, 0x57f137
call fcn.100b6500
mov cl, 0xe9
mov eax, 0x1001a1a0
mov esi, 0x57f17b
call fcn.100b6500
mov cl, 0xe9
mov eax, 0x1001a1c0
mov esi, 0x57f18c
call fcn.100b6500
mov cl, 0xe9
mov eax, 0x1001a1e0
mov esi, 0x57f19d
call fcn.100b6500
cmp dword [0x103104b8], edi
jne 0x1001b0fc
push 0x10013f50
push 0x62df68
mov bl, 0xe8
mov dword [0x103a041c], edi
call fcn.100b6700
push 0x10019a40
push 0x403320
mov bl, 0xe9
call fcn.100b6700
push 0x10017f10
push 0x40464e
mov bl, 0xe8
call fcn.100b6700
add esp, 0x18
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret