Function at 0x1000a790
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100201c0
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x1002c018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x20
call dword [sym.imp.MSVCR100.dll_void____cdecl_operator_new_unsigned_int_]
xor edi, edi
add esp, 4
cmp eax, edi
je 0x1000a7df
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
mov dword [eax + 0x10], edi
mov dword [eax + 0x14], edi
mov dword [eax + 0x18], edi
jmp 0x1000a7e1
xor eax, eax
mov dword [0x1015f8dc], eax
mov ecx, 0x50
xor eax, eax
lea ecx, [ecx]
mov dl, byte [eax + 0x100264f0]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x2c], dl
jns 0x1000a80d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x1b
jl 0x1000a7f0
mov byte [ebp - 0x11], 0
mov dword [ebp - 4], edi
mov ecx, dword [0x1015f4e0]
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
lea edx, [ebp - 0x2c]
push edx
call eax
mov ecx, eax
mov eax, 0x36
call fcn.1000a370
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov ecx, 0xc
mov dl, byte [eax + str.5kkksssspdm]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x3c], dl
jns 0x1000a870
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xe
jl 0x1000a853
mov byte [ebp - 0x2e], 0
mov dword [ebp - 4], 1
mov ecx, dword [0x1015f4e0]
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
lea edx, [ebp - 0x3c]
push edx
call eax
mov ecx, eax
mov eax, 0xa
call fcn.1000a370
mov dword [ebp - 4], 0xffffffff
call fcn.1000a500
cmp eax, edi
je 0x1000a8b3
mov ecx, dword [eax + 0x4c]
jmp 0x1000a8b5
xor ecx, ecx
mov eax, 0xa
call fcn.1000a370
mov ecx, dword [0x1015fb2c]
mov dword [ecx], edi
call fcn.1000a500
cmp eax, edi
je 0x1000a8d5
mov eax, dword [eax + 0x38]
jmp 0x1000a8d7
xor eax, eax
mov dword [0x1015ee30], eax
call fcn.1000a500
cmp eax, edi
je 0x1000a8ea
mov eax, dword [eax + 0x30]
jmp 0x1000a8ec
xor eax, eax
mov dword [0x1015ec08], eax
call fcn.1000a500
cmp eax, edi
jbe 0x1000a8fd
lea edi, [eax + 0x30]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea edx, [ebp - 0x40]
push edx
push 0x40
push 4
push edi
call esi
mov ecx, dword [ebp - 0x40]
lea eax, [ebp - 0x44]
push eax
push ecx
push 4
push edi
mov dword [edi], 0x1000a730
call esi
push 4
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
push eax
call ebx
call fcn.1000a500
test eax, eax
je 0x1000a946
mov edx, dword [eax + 0x10]
mov dword [ebp - 0x40], edx
jmp 0x1000a94d
mov dword [ebp - 0x40], 0
mov ecx, dword [ebp - 0x40]
lea eax, [ebp - 0x44]
push eax
push 0x40
push 1
push ecx
call esi
mov edx, dword [ebp - 0x40]
push 1
push 0x100267ec
push edx
call dword [sym.imp.MSVCR100.dll_memmove]
mov ecx, dword [ebp - 0x44]
mov edx, dword [ebp - 0x40]
add esp, 0xc
lea eax, [ebp - 0x48]
push eax
push ecx
push 1
push edx
call esi
mov eax, dword [ebp - 0x40]
push 1
push eax
call edi
push eax
call ebx
call fcn.1000a500
test eax, eax
je 0x1000a99b
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x40], ecx
jmp 0x1000a9a2
mov dword [ebp - 0x40], 0
mov eax, dword [ebp - 0x40]
lea edx, [ebp - 0x44]
push edx
push 0x40
push 1
push eax
call esi
mov ecx, dword [ebp - 0x40]
push 1
push 0x100267ec
push ecx
call dword [sym.imp.MSVCR100.dll_memmove]
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x40]
add esp, 0xc
lea edx, [ebp - 0x48]
push edx
push eax
push 1
push ecx
call esi
mov edx, dword [ebp - 0x40]
push 1
push edx
call edi
push eax
call ebx
call fcn.1000a500
test eax, eax
je 0x1000a9f0
add eax, 0x40
mov dword [ebp - 0x40], eax
jmp 0x1000a9f7
mov dword [ebp - 0x40], 0
mov ecx, dword [ebp - 0x40]
lea eax, [ebp - 0x44]
push eax
push 0x40
push 4
push ecx
call esi
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x40]
lea edx, [ebp - 0x48]
push edx
push ecx
push 4
push eax
mov dword [eax], 0x1000a590
call esi
mov edx, dword [ebp - 0x40]
push 4
push edx
call edi
push eax
call ebx
call fcn.1000a500
test eax, eax
je 0x1000aa37
add eax, 0x44
mov dword [ebp - 0x40], eax
jmp 0x1000aa3e
mov dword [ebp - 0x40], 0
mov ecx, dword [ebp - 0x40]
lea eax, [ebp - 0x44]
push eax
push 0x40
push 4
push ecx
call esi
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x40]
lea edx, [ebp - 0x48]
push edx
push ecx
push 4
push eax
mov dword [eax], 0x1000a590
call esi
mov edx, dword [ebp - 0x40]
push 4
push edx
call edi
push eax
call ebx
call fcn.1000a500
test eax, eax
je 0x1000aa7e
add eax, 0x48
mov dword [ebp - 0x40], eax
jmp 0x1000aa85
mov dword [ebp - 0x40], 0
mov ecx, dword [ebp - 0x40]
lea eax, [ebp - 0x44]
push eax
push 0x40
push 4
push ecx
call esi
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x40]
lea edx, [ebp - 0x48]
push edx
push ecx
push 4
push eax
mov dword [eax], 0x1000a590
call esi
mov edx, dword [ebp - 0x40]
push 4
push edx
call edi
push eax
call ebx
call fcn.1000a500
test eax, eax
je 0x1000aac5
add eax, 0x4c
mov dword [ebp - 0x40], eax
jmp 0x1000aacc
mov dword [ebp - 0x40], 0
mov ecx, dword [ebp - 0x40]
lea eax, [ebp - 0x44]
push eax
push 0x40
push 4
push ecx
call esi
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x40]
lea edx, [ebp - 0x48]
push edx
push ecx
push 4
push eax
mov dword [eax], 0x1000a590
call esi
mov edx, dword [ebp - 0x40]
push 4
push edx
call edi
push eax
call ebx
call fcn.1000a500
test eax, eax
je 0x1000ab0c
add eax, 0x50
mov dword [ebp - 0x40], eax
jmp 0x1000ab13
mov dword [ebp - 0x40], 0
mov ecx, dword [ebp - 0x40]
lea eax, [ebp - 0x44]
push eax
push 0x40
push 4
push ecx
call esi
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x40]
lea edx, [ebp - 0x48]
push edx
push ecx
push 4
push eax
mov dword [eax], 0x1000a590
call esi
mov edx, dword [ebp - 0x40]
push 4
push edx
call edi
push eax
call ebx
call fcn.1000a500
test eax, eax
je 0x1000ab53
add eax, 0x54
mov dword [ebp - 0x40], eax
jmp 0x1000ab5a
mov dword [ebp - 0x40], 0
mov ecx, dword [ebp - 0x40]
lea eax, [ebp - 0x44]
push eax
push 0x40
push 4
push ecx
call esi
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x40]
lea edx, [ebp - 0x48]
push edx
push ecx
push 4
push eax
mov dword [eax], 0x1000a590
call esi
mov edx, dword [ebp - 0x40]
push 4
push edx
call edi
push eax
call ebx
call fcn.1000a500
test eax, eax
je 0x1000ab9a
add eax, 0x58
mov dword [ebp - 0x40], eax
jmp 0x1000aba1
mov dword [ebp - 0x40], 0
mov ecx, dword [ebp - 0x40]
lea eax, [ebp - 0x4c]
push eax
push 0x40
push 4
push ecx
call esi
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x40]
lea edx, [ebp - 0x50]
push edx
push ecx
push 4
push eax
mov dword [eax], 0x1000a590
call esi
mov edx, dword [ebp - 0x40]
push 4
push edx
call edi
push eax
call ebx
mov edx, dword [0x1015fb5c]
mov ecx, 0x1000a690
call fcn.10002d00
mov edx, dword [0x1015fc88]
mov ecx, 0x1000a6d0
call fcn.10002d00
mov edx, dword [0x1015fa34]
mov ecx, 0x1000a6f0
call fcn.10002d00
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001df15
mov esp, ebp
pop ebp
ret