Function at 0x1000a4e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100b1af8
push 0x1006fc80
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x100b7018]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
mov eax, str.CoD2_MP
mov ecx, 0x5a1d3c
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x1000a547
test dl, dl
je 0x1000a543
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x1000a547
add ecx, 2
add eax, 2
test dl, dl
jne 0x1000a527
xor eax, eax
jmp 0x1000a54c
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1000ad30
mov dword [ebp - 4], 0xfffffffe
lea eax, [ebp - 0x24]
push eax
push fcn.1000a4e0
push 4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExA]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
js 0x1000a589
lea eax, [ebp - 0x20]
push eax
push 0x40
mov ecx, dword [ebp - 0x24]
mov eax, dword [ecx + 0x3c]
push dword [eax + ecx + 0x50]
push ecx
call ebx
lea eax, [ebp - 0x20]
push eax
push 0x40
push 6
push 0x464827
call ebx
mov byte [0x464827], 0xe8
lea eax, [ebp - 0x20]
push eax
push 0x40
push 5
push 0x464827
call ebx
mov esi, 0x1000a1d0
lea eax, [esi - 0x46482c]
mov dword [0x464828], eax
push 5
push 0x464827
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call ebx
push eax
mov edi, dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 5
push 0x464827
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov byte [0x46482c], 0x90
lea eax, [ebp - 0x20]
push eax
push 0x40
push 6
push 0x4649d5
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov byte [0x4649d5], 0xe8
lea eax, [ebp - 0x20]
push eax
push 0x40
push 5
push 0x4649d5
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esi, 0x4649da
mov dword [0x4649d6], esi
push 5
push 0x4649d5
call ebx
push eax
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 5
push 0x4649d5
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call esi
mov byte [0x4649da], 0x90
lea eax, [ebp - 0x20]
push eax
push 0x40
push 6
push 0x46479f
call esi
mov byte [0x46479f], 0xe8
lea eax, [ebp - 0x20]
push eax
push 0x40
push 5
push 0x46479f
call esi
mov esi, 0x1000a1a0
lea eax, [esi - 0x4647a4]
mov dword [0x4647a0], eax
push 5
push 0x46479f
call ebx
push eax
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 5
push 0x46479f
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov byte [0x4647a4], 0x90
lea eax, [ebp - 0x20]
push eax
push 0x40
push 6
push 0x46483b
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov byte [0x46483b], 0xe8
lea eax, [ebp - 0x20]
push eax
push 0x40
push 5
push 0x46483b
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esi - 0x464840]
mov dword [0x46483c], eax
push 5
push 0x46483b
call ebx
push eax
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 5
push 0x46483b
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov byte [0x464840], 0x90
lea eax, [ebp - 0x20]
push eax
push 0x40
push 6
push 0x4649e9
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov byte [0x4649e9], 0xe8
lea eax, [ebp - 0x20]
push eax
push 0x40
push 5
push 0x4649e9
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esi, 0x4649ee
mov dword [0x4649ea], esi
push 5
push 0x4649e9
call ebx
push eax
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 5
push 0x4649e9
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call esi
mov byte [0x4649ee], 0x90
mov dword [0x4b4f11], 0x63d9
lea eax, [ebp - 0x20]
push eax
push 0x40
push 5
push 0x41162f
call esi
mov eax, 0x1000a4a0
sub eax, 0x411634
mov dword [0x411630], eax
push 5
push 0x41162f
call ebx
push eax
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 5
push 0x41162f
call esi
lea eax, [ebp - 0x20]
push eax
push 0x40
push 5
push 0x40ef9c
call esi
mov eax, fcn.10002400
sub eax, 0x40efa1
mov dword [0x40ef9d], eax
push 5
push 0x40ef9c
call ebx
push eax
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 5
push 0x40ef9c
call esi
lea eax, [ebp - 0x20]
push eax
push 0x40
push 5
push 0x57dcd3
call esi
mov eax, 0x1006e410
sub eax, 0x57dcd8
mov dword [0x57dcd4], eax
push 5
push 0x57dcd3
call ebx
push eax
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 5
push 0x57dcd3
call esi
lea eax, [ebp - 0x20]
push eax
push 0x40
push 5
push 0x43506a
call esi
mov eax, 0x10002370
sub eax, 0x43506f
mov dword [0x43506b], eax
push 5
push 0x43506a
call ebx
push eax
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 5
push 0x43506a
call esi
lea eax, [ebp - 0x20]
push eax
push 0x40
push 5
push 0x4348b9
call esi
mov eax, 0x10002410
sub eax, 0x4348be
mov dword [0x4348ba], eax
push 5
push 0x4348b9
call ebx
push eax
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 5
push 0x4348b9
call esi
push 0x1006a490
push dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call fcn.100010f0
mov dword [0x10124704], eax
lea eax, [ebp - 0x20]
push eax
push 0x40
push 5
push 0x4d216f
call esi
mov eax, 0x10002320
sub eax, 0x4d2174
mov dword [0x4d2170], eax
push 5
push 0x4d216f
call ebx
push eax
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 5
push 0x4d216f
call esi
lea eax, [ebp - 0x20]
push eax
push 0x40
push 1
push 0x5b375c
call esi
lea eax, [ebp - 0x20]
push eax
push 0x40
push 1
push 0x5b372d
call esi
mov byte [0x5b375c], 0x78
mov byte [0x5b372d], 0x78
lea eax, [ebp - 0x20]
push eax
push 0x40
push 0xa
push 0x4663d1
call esi
mov dword [0x4663d5], 0x1000a2b0
lea eax, [ebp - 0x20]
push eax
push 0x40
push 0xa
push 0x43477c
call esi
mov dword [0x43477d], 0x1009fd6c
lea eax, [ebp - 0x20]
push eax
push 0x40
push 0xa
push 0x434701
call esi
mov dword [0x434702], 0x1009fd6c
lea eax, [ebp - 0x20]
push eax
push 0x40
push 0xa
push 0x4064c1
call esi
mov dword [0x4064c2], 0x1009fd6c
lea eax, [ebp - 0x20]
push eax
push 0x40
push 0xa
push 0x4346de
call esi
mov dword [0x4346df], 0x1009fd70
lea eax, [ebp - 0x20]
push eax
push 0x40
push 0xa
push 0x4346e3
call esi
mov dword [0x4346e4], 0x1009fd88
lea eax, [ebp - 0x20]
push eax
push 0x40
push 0xa
push 0x407180
call esi
mov dword [0x407181], 0x1009fd70
lea eax, [ebp - 0x20]
push eax
push 0x40
push 0xa
push 0x407185
call esi
mov dword [0x407186], 0x1009fd88
lea eax, [ebp - 0x20]
push eax
push 0x40
push 0xa
push 0x409004
call esi
mov dword [0x409005], 0x1009c568
lea eax, [ebp - 0x20]
push eax
push 0x40
push 5
push 0x466555
call esi
mov eax, 0x466555
mov dword [eax], 0x90909090
mov byte [eax + 4], 0x90
push 5
push eax
call ebx
push eax
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 5
push 0x466555
call esi
lea eax, [ebp - 0x20]
push eax
push 0x40
push 2
push 0x46664a
call esi
mov ecx, 0x90909090
mov eax, 0x46664a
mov word [eax], cx
push 2
push eax
call ebx
push eax
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 2
push 0x46664a
call esi
lea eax, [ebp - 0x20]
push eax
push 0x40
push 2
push 0x4b9569
call esi
mov eax, 0x4b9569
mov ecx, 0x90909090
mov word [eax], cx
push 2
push eax
call ebx
push eax
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 2
push 0x4b9569
call esi
lea eax, [ebp - 0x20]
push eax
push 0x40
push 2
push 0x43718f
call esi
mov eax, 0x43718f
mov ecx, 0x90909090
mov word [eax], cx
push 2
push eax
call ebx
push eax
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 2
push 0x43718f
call esi
lea eax, [ebp - 0x20]
push eax
push 0x40
push 2
push 0x4371bf
call esi
mov eax, 0x4371bf
mov ecx, 0x90909090
mov word [eax], cx
push 2
push eax
call ebx
push eax
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 2
push 0x4371bf
call esi
lea eax, [ebp - 0x20]
push eax
push 0x40
push 5
push 0x4ba564
call esi
mov eax, 0x4ba564
mov dword [eax], 0x90909090
mov byte [eax + 4], 0x90
push 5
push eax
call ebx
push eax
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 5
push 0x4ba564
call esi
lea eax, [ebp - 0x20]
push eax
push 0x40
push 5
push 0x4ba52b
call esi
mov eax, 0x4ba52b
mov dword [eax], 0x90909090
mov byte [eax + 4], 0x90
push 5
push eax
call ebx
push eax
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 5
push 0x4ba52b
call esi
lea eax, [ebp - 0x20]
push eax
push 0x40
push 5
push 0x4ba53a
call esi
mov eax, 0x4ba53a
mov dword [eax], 0x90909090
mov byte [eax + 4], 0x90
push 5
push eax
call ebx
push eax
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 5
push 0x4ba53a
call esi
lea eax, [ebp - 0x20]
push eax
push 0x40
push 5
push 0x4ba7f1
call esi
mov eax, 0x4ba7f1
mov dword [eax], 0x90909090
mov byte [eax + 4], 0x90
push 5
push eax
call ebx
push eax
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 5
push 0x4ba7f1
call esi
lea eax, [ebp - 0x20]
push eax
push 0x40
push 5
push 0x4baf29
call esi
mov eax, 0x4baf29
mov dword [eax], 0x90909090
mov byte [eax + 4], 0x90
push 5
push eax
call ebx
push eax
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 5
push 0x4baf29
call esi
lea eax, [ebp - 0x20]
push eax
push 0x40
push 5
push 0x4baf57
call esi
mov eax, 0x4baf57
mov dword [eax], 0x90909090
mov byte [eax + 4], 0x90
push 5
push eax
call ebx
push eax
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 5
push 0x4baf57
call esi
lea eax, [ebp - 0x20]
push eax
push 0x40
push 5
push 0x4baf4a
call esi
mov eax, 0x4baf4a
mov dword [eax], 0x90909090
mov byte [eax + 4], 0x90
push 5
push eax
call ebx
push eax
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 5
push 0x4baf4a
call esi
lea eax, [ebp - 0x20]
push eax
push 0x40
push 5
push 0x4baf3b
call esi
mov eax, 0x4baf3b
mov dword [eax], 0x90909090
mov byte [eax + 4], 0x90
push 5
push eax
call ebx
push eax
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 5
push 0x4baf3b
call esi
lea eax, [ebp - 0x20]
push eax
push 0x40
push 5
push 0x4baeab
call esi
mov eax, 0x4baeab
mov dword [eax], 0x90909090
mov byte [eax + 4], 0x90
push 5
push eax
call ebx
push eax
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 5
push 0x4baeab
call esi
lea eax, [ebp - 0x20]
push eax
push 0x40
push 5
push 0x466270
call esi
mov byte [0x466270], 0xe9
mov eax, 0x1000a190
sub eax, 0x466275
mov dword [0x466271], eax
push 5
push 0x466270
call ebx
push eax
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 5
push 0x466270
call esi
jmp 0x1000ad37
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1006e641
mov esp, ebp
pop ebp
ret