Function at 0x1000a740
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push edi
nop
mov eax, dword [0x1015bac0]
cmp byte [eax], 0xe9
jne 0x1000a791
mov ecx, dword [0x1015bac4]
cmp byte [ecx], 0xe9
jne 0x1000a791
mov edx, dword [0x1015bac8]
cmp byte [edx], 0xe9
jne 0x1000a791
mov ecx, dword [0x1015bad0]
cmp byte [ecx], 0xe9
jne 0x1000a791
mov edx, dword [0x1015bacc]
cmp byte [edx], 0xe9
jne 0x1000a791
mov ecx, dword [0x1015bad8]
cmp byte [ecx], 0xe9
je 0x1000a797
push 0x32
call esi
jmp 0x1000a750
mov edx, dword [eax + 1]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ebx, [edx + eax + 5]
lea eax, [ebp - 4]
push eax
push 0x40
push 2
push ebx
call esi
mov edi, dword [sym.imp.MSVCR100.dll_memmove]
push 2
push 0x100257b8
push ebx
call edi
mov edx, dword [ebp - 4]
add esp, 0xc
lea ecx, [ebp - 8]
push ecx
push edx
push 2
push ebx
call esi
push 2
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov eax, dword [0x1015bac4]
mov ecx, dword [eax + 1]
lea edx, [ebp - 8]
push edx
push 0x40
lea eax, [ecx + eax + 5]
push 2
push eax
mov dword [ebp - 4], eax
call esi
mov eax, dword [ebp - 4]
push 2
push 0x100257b8
push eax
call edi
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
add esp, 0xc
lea ecx, [ebp - 0xc]
push ecx
push edx
push 2
push eax
call esi
mov ecx, dword [ebp - 4]
push 2
push ecx
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov eax, dword [0x1015bac8]
mov edx, dword [eax + 1]
lea ecx, [ebp - 8]
push ecx
push 0x40
lea eax, [edx + eax + 5]
push 2
push eax
mov dword [ebp - 4], eax
call esi
mov edx, dword [ebp - 4]
push 2
push 0x100257b8
push edx
call edi
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
push ecx
push 2
push edx
call esi
mov eax, dword [ebp - 4]
push 2
push eax
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov eax, dword [0x1015bad0]
mov ecx, dword [eax + 1]
lea edx, [ebp - 8]
push edx
push 0x40
lea eax, [ecx + eax + 5]
push 2
push eax
mov dword [ebp - 4], eax
call esi
mov eax, dword [ebp - 4]
push 2
push 0x100257b8
push eax
call edi
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
add esp, 0xc
lea ecx, [ebp - 0xc]
push ecx
push edx
push 2
push eax
call esi
mov ecx, dword [ebp - 4]
push 2
push ecx
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov eax, dword [0x1015bacc]
mov edx, dword [eax + 1]
lea ecx, [ebp - 8]
push ecx
push 0x40
lea eax, [edx + eax + 5]
push 2
push eax
mov dword [ebp - 4], eax
call esi
mov edx, dword [ebp - 4]
push 2
push 0x100257b8
push edx
call edi
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
push ecx
push 2
push edx
call esi
mov eax, dword [ebp - 4]
push 2
push eax
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov eax, dword [0x1015bad8]
mov ecx, dword [eax + 1]
lea edx, [ebp - 8]
push edx
push 0x40
lea eax, [ecx + eax + 5]
push 2
push eax
mov dword [ebp - 4], eax
call esi
mov eax, dword [ebp - 4]
push 2
push 0x100257b8
push eax
call edi
mov edx, dword [ebp - 8]
mov edi, dword [ebp - 4]
add esp, 0xc
lea ecx, [ebp - 0xc]
push ecx
push edx
push 2
push edi
call esi
push 2
push edi
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret