Function at 0x1000a670
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10048400]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 6
push 0x5d4622
mov dword [ebp - 0x10], 0x5d4622
call esi
test eax, eax
je 0x1000a6db
mov eax, dword [ebp - 0x10]
mov edx, 0x90909090
mov ecx, 0x1000a440
sub ecx, eax
sub ecx, 5
mov dword [eax], edx
mov eax, dword [ebp - 0x10]
mov word [eax + 4], dx
mov eax, dword [ebp - 0x10]
mov byte [eax], 0xe9
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov dword [eax], ecx
dec dword [ebp - 0x10]
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 6
push dword [ebp - 0x10]
call esi
lea eax, [ebp - 8]
mov dword [ebp - 0x10], 0x5dbc35
push eax
push 0x40
push 0xa
push 0x5dbc35
call esi
test eax, eax
je 0x1000a735
mov eax, dword [ebp - 0x10]
mov edx, 0x90909090
mov ecx, 0x1000a4c0
sub ecx, eax
sub ecx, 5
mov dword [eax], edx
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x10]
mov word [eax + 8], dx
mov eax, dword [ebp - 0x10]
mov byte [eax], 0xe9
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov dword [eax], ecx
dec dword [ebp - 0x10]
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 0xa
push dword [ebp - 0x10]
call esi
lea eax, [ebp - 8]
mov dword [ebp - 0x10], 0x5dca2a
push eax
push 0x40
push 7
push 0x5dca2a
call esi
test eax, eax
je 0x1000a78f
mov eax, dword [ebp - 0x10]
mov edx, 0x90909090
mov ecx, 0x1000a4e0
sub ecx, eax
sub ecx, 5
mov dword [eax], edx
mov eax, dword [ebp - 0x10]
mov word [eax + 4], dx
mov eax, dword [ebp - 0x10]
mov byte [eax + 6], dl
mov eax, dword [ebp - 0x10]
mov byte [eax], 0xe9
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov dword [eax], ecx
dec dword [ebp - 0x10]
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 7
push dword [ebp - 0x10]
call esi
lea eax, [ebp - 8]
mov dword [ebp - 0x10], 0x5dc8fa
push eax
push 0x40
push 7
push 0x5dc8fa
call esi
test eax, eax
je 0x1000a7e9
mov eax, dword [ebp - 0x10]
mov edx, 0x90909090
mov ecx, 0x1000a510
sub ecx, eax
sub ecx, 5
mov dword [eax], edx
mov eax, dword [ebp - 0x10]
mov word [eax + 4], dx
mov eax, dword [ebp - 0x10]
mov byte [eax + 6], dl
mov eax, dword [ebp - 0x10]
mov byte [eax], 0xe9
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov dword [eax], ecx
dec dword [ebp - 0x10]
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 7
push dword [ebp - 0x10]
call esi
lea eax, [ebp - 8]
mov dword [ebp - 0x10], 0x5dc87f
push eax
push 0x40
push 7
push 0x5dc87f
call esi
test eax, eax
je 0x1000a843
mov eax, dword [ebp - 0x10]
mov edx, 0x90909090
mov ecx, 0x1000a550
sub ecx, eax
sub ecx, 5
mov dword [eax], edx
mov eax, dword [ebp - 0x10]
mov word [eax + 4], dx
mov eax, dword [ebp - 0x10]
mov byte [eax + 6], dl
mov eax, dword [ebp - 0x10]
mov byte [eax], 0xe9
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov dword [eax], ecx
dec dword [ebp - 0x10]
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 7
push dword [ebp - 0x10]
call esi
lea eax, [ebp - 8]
mov dword [ebp - 0x10], 0x5dcb37
push eax
push 0x40
push 7
push 0x5dcb37
call esi
test eax, eax
je 0x1000a89d
mov eax, dword [ebp - 0x10]
mov edx, 0x90909090
mov ecx, 0x1000a580
sub ecx, eax
sub ecx, 5
mov dword [eax], edx
mov eax, dword [ebp - 0x10]
mov word [eax + 4], dx
mov eax, dword [ebp - 0x10]
mov byte [eax + 6], dl
mov eax, dword [ebp - 0x10]
mov byte [eax], 0xe9
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov dword [eax], ecx
dec dword [ebp - 0x10]
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 7
push dword [ebp - 0x10]
call esi
lea eax, [ebp - 8]
mov dword [ebp - 0x10], 0x69487e
push eax
push 0x40
push 7
push 0x69487e
call esi
test eax, eax
je 0x1000a8f7
mov eax, dword [ebp - 0x10]
mov edx, 0x90909090
mov ecx, 0x1000a5b0
sub ecx, eax
sub ecx, 5
mov dword [eax], edx
mov eax, dword [ebp - 0x10]
mov word [eax + 4], dx
mov eax, dword [ebp - 0x10]
mov byte [eax + 6], dl
mov eax, dword [ebp - 0x10]
mov byte [eax], 0xe9
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov dword [eax], ecx
dec dword [ebp - 0x10]
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 7
push dword [ebp - 0x10]
call esi
lea eax, [ebp - 8]
mov dword [ebp - 0x10], 0x695909
push eax
push 0x40
push 7
push 0x695909
call esi
test eax, eax
je 0x1000a951
mov eax, dword [ebp - 0x10]
mov edx, 0x90909090
mov ecx, 0x1000a5e0
sub ecx, eax
sub ecx, 5
mov dword [eax], edx
mov eax, dword [ebp - 0x10]
mov word [eax + 4], dx
mov eax, dword [ebp - 0x10]
mov byte [eax + 6], dl
mov eax, dword [ebp - 0x10]
mov byte [eax], 0xe9
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov dword [eax], ecx
dec dword [ebp - 0x10]
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 7
push dword [ebp - 0x10]
call esi
lea eax, [ebp - 8]
mov dword [ebp - 0x10], 0x69500c
push eax
push 0x40
push 0xa
push 0x69500c
call esi
test eax, eax
je 0x1000a9ab
mov eax, dword [ebp - 0x10]
mov edx, 0x90909090
mov ecx, 0x1000a620
sub ecx, eax
sub ecx, 5
mov dword [eax], edx
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x10]
mov word [eax + 8], dx
mov eax, dword [ebp - 0x10]
mov byte [eax], 0xe9
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov dword [eax], ecx
dec dword [ebp - 0x10]
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 0xa
push dword [ebp - 0x10]
call esi
lea eax, [ebp - 8]
mov byte [ebp - 9], 2
push eax
push 0x40
push 1
push 0x69559c
call esi
test eax, eax
je 0x1000a9f0
push 0
push 1
lea eax, [ebp - 9]
push eax
push 0x69559c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x1000a9f0
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 1
push 0x69559c
call esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10017809
mov esp, ebp
pop ebp
ret