Function at 0x1000a050
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100b0d58
push 0x1006e560
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x100b60c0]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
mov eax, str.CoD2_MP
mov ecx, 0x5a1d3c
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x1000a0b7
test dl, dl
je 0x1000a0b3
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x1000a0b7
add ecx, 2
add eax, 2
test dl, dl
jne 0x1000a097
xor eax, eax
jmp 0x1000a0bc
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1000a5a9
mov dword [ebp - 4], 0xfffffffe
lea eax, [ebp - 0x24]
push eax
push fcn.1000a050
push 4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExA]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
js 0x1000a0f9
lea eax, [ebp - 0x20]
push eax
push 0x40
mov ecx, dword [ebp - 0x24]
mov eax, dword [ecx + 0x3c]
push dword [eax + ecx + 0x50]
push ecx
call ebx
lea eax, [ebp - 0x20]
push eax
push 0x40
push 6
push 0x464827
call ebx
mov byte [0x464827], 0xe8
lea eax, [ebp - 0x20]
push eax
push 0x40
push 5
push 0x464827
call ebx
mov esi, 0x10009d40
lea eax, [esi - 0x46482c]
mov dword [0x464828], eax
push 5
push 0x464827
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call ebx
push eax
mov edi, dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 5
push 0x464827
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov byte [0x46482c], 0x90
lea eax, [ebp - 0x20]
push eax
push 0x40
push 6
push 0x4649d5
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov byte [0x4649d5], 0xe8
lea eax, [ebp - 0x20]
push eax
push 0x40
push 5
push 0x4649d5
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esi, 0x4649da
mov dword [0x4649d6], esi
push 5
push 0x4649d5
call ebx
push eax
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 5
push 0x4649d5
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call esi
mov byte [0x4649da], 0x90
lea eax, [ebp - 0x20]
push eax
push 0x40
push 6
push 0x46479f
call esi
mov byte [0x46479f], 0xe8
lea eax, [ebp - 0x20]
push eax
push 0x40
push 5
push 0x46479f
call esi
mov esi, 0x10009d10
lea eax, [esi - 0x4647a4]
mov dword [0x4647a0], eax
push 5
push 0x46479f
call ebx
push eax
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 5
push 0x46479f
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov byte [0x4647a4], 0x90
lea eax, [ebp - 0x20]
push eax
push 0x40
push 6
push 0x46483b
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov byte [0x46483b], 0xe8
lea eax, [ebp - 0x20]
push eax
push 0x40
push 5
push 0x46483b
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esi - 0x464840]
mov dword [0x46483c], eax
push 5
push 0x46483b
call ebx
push eax
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 5
push 0x46483b
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov byte [0x464840], 0x90
lea eax, [ebp - 0x20]
push eax
push 0x40
push 6
push 0x4649e9
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov byte [0x4649e9], 0xe8
lea eax, [ebp - 0x20]
push eax
push 0x40
push 5
push 0x4649e9
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esi, 0x4649ee
mov dword [0x4649ea], esi
push 5
push 0x4649e9
call ebx
push eax
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 5
push 0x4649e9
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call esi
mov byte [0x4649ee], 0x90
mov dword [0x4b4f11], 0x63d9
lea eax, [ebp - 0x20]
push eax
push 0x40
push 5
push 0x41162f
call esi
mov eax, 0x1000a010
sub eax, 0x411634
mov dword [0x411630], eax
push 5
push 0x41162f
call ebx
push eax
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 5
push 0x41162f
call esi
lea eax, [ebp - 0x20]
push eax
push 0x40
push 5
push 0x40ef9c
call esi
mov eax, fcn.10001f60
sub eax, 0x40efa1
mov dword [0x40ef9d], eax
push 5
push 0x40ef9c
call ebx
push eax
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 5
push 0x40ef9c
call esi
lea eax, [ebp - 0x20]
push eax
push 0x40
push 5
push 0x57dcd3
call esi
mov eax, 0x1006cbb0
sub eax, 0x57dcd8
mov dword [0x57dcd4], eax
push 5
push 0x57dcd3
call ebx
push eax
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 5
push 0x57dcd3
call esi
lea eax, [ebp - 0x20]
push eax
push 0x40
push 5
push 0x43506a
call esi
mov eax, 0x10001f00
sub eax, 0x43506f
mov dword [0x43506b], eax
push 5
push 0x43506a
call ebx
push eax
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 5
push 0x43506a
call esi
lea eax, [ebp - 0x20]
push eax
push 0x40
push 5
push 0x4348b9
call esi
mov eax, 0x10001f80
sub eax, 0x4348be
mov dword [0x4348ba], eax
push 5
push 0x4348b9
call ebx
push eax
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 5
push 0x4348b9
call esi
lea eax, [ebp - 0x20]
push eax
push 0x40
push 5
push 0x402c98
call esi
mov eax, 0x10001da0
sub eax, 0x402c9d
mov dword [0x402c99], eax
push 5
push 0x402c98
call ebx
push eax
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 5
push 0x402c98
call esi
push 0x10068c40
push dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call fcn.100010f0
mov dword [0x10123f54], eax
lea eax, [ebp - 0x20]
push eax
push 0x40
push 5
push 0x4d216f
call esi
mov eax, 0x10001eb0
sub eax, 0x4d2174
mov dword [0x4d2170], eax
push 5
push 0x4d216f
call ebx
push eax
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 5
push 0x4d216f
call esi
lea eax, [ebp - 0x20]
push eax
push 0x40
push 5
push 0x466270
call esi
mov byte [0x466270], 0xe9
mov eax, 0x10009d00
sub eax, 0x466275
mov dword [0x466271], eax
push 5
push 0x466270
call ebx
push eax
call edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 5
push 0x466270
call esi
lea eax, [ebp - 0x20]
push eax
push 0x40
push 0xa
push 0x4663d1
call esi
mov dword [0x4663d5], 0x10009e20
lea eax, [ebp - 0x20]
push eax
push 0x40
push 0xa
push 0x43477c
call esi
mov dword [0x43477d], 0x1009ecbc
lea eax, [ebp - 0x20]
push eax
push 0x40
push 0xa
push 0x434701
call esi
mov dword [0x434702], 0x1009ecbc
lea eax, [ebp - 0x20]
push eax
push 0x40
push 0xa
push 0x4064c1
call esi
mov dword [0x4064c2], 0x1009ecbc
lea eax, [ebp - 0x20]
push eax
push 0x40
push 0xa
push 0x4346de
call esi
mov dword [0x4346df], 0x1009ecc4
lea eax, [ebp - 0x20]
push eax
push 0x40
push 0xa
push 0x4346e3
call esi
mov dword [0x4346e4], 0x1009ecbc
lea eax, [ebp - 0x20]
push eax
push 0x40
push 0xa
push 0x407180
call esi
mov dword [0x407181], 0x1009ecc4
lea eax, [ebp - 0x20]
push eax
push 0x40
push 0xa
push 0x407185
call esi
mov dword [0x407186], 0x1009ecbc
jmp 0x1000a5b0
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1006cde1
mov esp, ebp
pop ebp
ret