Function at 0x100061d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1000c00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
mov ecx, 0x1000907c
push ebx
push esi
mov eax, edx
nop dword [eax]
mov bl, byte [eax]
cmp bl, byte [ecx]
jne 0x10006210
test bl, bl
je 0x1000620c
mov bl, byte [eax + 1]
cmp bl, byte [ecx + 1]
jne 0x10006210
add eax, 2
add ecx, 2
test bl, bl
jne 0x100061f0
xor eax, eax
jmp 0x10006215
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1000625a
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x49099a
mov dword [ebp - 8], 0x40
call esi
mov dword [0x49099b], 0xff00ff00
mov eax, dword [0x684bb0]
mov dword [ebp - 0xc], eax
push 0x606eab
mov ecx, dword [ebp - 0xc]
call dword [0x1000c024]
jmp 0x100066f1
mov ecx, str._noeffects
mov eax, edx
mov bl, byte [eax]
cmp bl, byte [ecx]
jne 0x10006281
test bl, bl
je 0x1000627d
mov bl, byte [eax + 1]
cmp bl, byte [ecx + 1]
jne 0x10006281
add eax, 2
add ecx, 2
test bl, bl
jne 0x10006261
xor eax, eax
jmp 0x10006286
sbb eax, eax
or eax, 1
test eax, eax
jne 0x10006399
cmp dword [0x9362d8], 0
lea eax, [ebp - 8]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push 4
mov dword [ebp - 8], 0x40
push 0x49099a
je 0x10006325
mov dword [ebp - 0xc], str.Effects_ON
call esi
mov dword [0x49099b], 0xffffaaaa
mov eax, dword [0x684bb0]
mov dword [ebp - 0x10], eax
push dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
call dword [0x1000c024]
lea eax, [ebp - 8]
mov dword [0x49099b], 0xffffaaaa
push eax
push dword [ebp - 8]
push 4
push 0x49099a
call esi
mov dword ds:[0x9362d8], 0
mov dword ds:[0x9362dc], 0
mov dword ds:[0x9362e0], 0
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100069a3
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x10], str.Effects_OFF
call esi
mov dword [0x49099b], 0xffffaaaa
mov eax, dword [0x684bb0]
mov dword [ebp - 0xc], eax
push dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
call dword [0x1000c024]
lea eax, [ebp - 8]
mov dword [0x49099b], 0xffffaaaa
push eax
push dword [ebp - 8]
push 4
push 0x49099a
call esi
mov dword ds:[0x9362d8], 1
mov dword ds:[0x9362dc], 1
mov dword ds:[0x9362e0], 1
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100069a3
mov esp, ebp
pop ebp
ret
mov ecx, str._effects2
mov eax, edx
mov bl, byte [eax]
cmp bl, byte [ecx]
jne 0x100063c0
test bl, bl
je 0x100063bc
mov bl, byte [eax + 1]
cmp bl, byte [ecx + 1]
jne 0x100063c0
add eax, 2
add ecx, 2
test bl, bl
jne 0x100063a0
xor eax, eax
jmp 0x100063c5
sbb eax, eax
or eax, 1
test eax, eax
je 0x10006732
mov ecx, str.effects2
mov eax, edx
mov bl, byte [eax]
cmp bl, byte [ecx]
jne 0x100063f4
test bl, bl
je 0x100063f0
mov bl, byte [eax + 1]
cmp bl, byte [ecx + 1]
jne 0x100063f4
add eax, 2
add ecx, 2
test bl, bl
jne 0x100063d4
xor eax, eax
jmp 0x100063f9
sbb eax, eax
or eax, 1
test eax, eax
je 0x10006732
mov ecx, str._autogrupo
mov eax, edx
mov bl, byte [eax]
cmp bl, byte [ecx]
jne 0x10006428
test bl, bl
je 0x10006424
mov bl, byte [eax + 1]
cmp bl, byte [ecx + 1]
jne 0x10006428
add eax, 2
add ecx, 2
test bl, bl
jne 0x10006408
xor eax, eax
jmp 0x1000642d
sbb eax, eax
or eax, 1
test eax, eax
jne 0x10006536
movzx eax, byte [0x1000c6d1]
sub eax, 0
je 0x100064c2
sub eax, 1
jne 0x1000682b
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x49099a
mov dword [ebp - 0x10], str.Auto_Grupo_Destivado
mov dword [ebp - 8], 0x40
call esi
mov dword [0x49099b], 0xffff0000
mov eax, dword [0x684bb0]
mov dword [ebp - 0xc], eax
push dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
call dword [0x1000c024]
lea eax, [ebp - 8]
mov dword [0x49099b], 0xffffaaaa
push eax
push dword [ebp - 8]
push 4
push 0x49099a
call esi
mov byte [0x1000c6d1], 0
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100069a3
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x49099a
mov dword [ebp - 0x10], str.Auto_Grupo_Ativado
mov dword [ebp - 8], 0x40
call esi
mov dword [0x49099b], 0xff00ff00
mov eax, dword [0x684bb0]
mov dword [ebp - 0xc], eax
push dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
call dword [0x1000c024]
lea eax, [ebp - 8]
mov dword [0x49099b], 0xffffaaaa
push eax
push dword [ebp - 8]
push 4
push 0x49099a
call esi
mov byte [0x1000c6d1], 1
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100069a3
mov esp, ebp
pop ebp
ret
mov ecx, str._macropergaon
mov eax, edx
nop dword [eax]
mov bl, byte [eax]
cmp bl, byte [ecx]
jne 0x10006560
test bl, bl
je 0x1000655c
mov bl, byte [eax + 1]
cmp bl, byte [ecx + 1]
jne 0x10006560
add eax, 2
add ecx, 2
test bl, bl
jne 0x10006540
xor eax, eax
jmp 0x10006565
sbb eax, eax
or eax, 1
test eax, eax
jne 0x10006616
cmp byte [0x1000c6d0], 0
lea eax, [ebp - 8]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push 4
mov dword [ebp - 8], 0x40
push 0x49099a
jne 0x100065ea
mov dword [ebp - 0x10], str.Macro_de_Pergaminho_Ativado
call esi
mov dword [0x49099b], 0xff00ff00
mov eax, dword [0x684bb0]
mov dword [ebp - 0xc], eax
push dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
call dword [0x1000c024]
lea eax, [ebp - 8]
mov dword [0x49099b], 0xffffaaaa
push eax
push dword [ebp - 8]
push 4
push 0x49099a
call esi
mov byte [0x1000c6d0], 1
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100069a3
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x10], str.Macro_de_Pergaminho_J
call esi
mov dword [0x49099b], 0xff00ff00
mov eax, dword [0x684bb0]
mov dword [ebp - 0xc], eax
push dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
call dword [0x1000c024]
jmp 0x100066f1
mov eax, str._macropergaoff
nop dword [eax + eax]
mov cl, byte [edx]
cmp cl, byte [eax]
jne 0x10006640
test cl, cl
je 0x1000663c
mov cl, byte [edx + 1]
cmp cl, byte [eax + 1]
jne 0x10006640
add edx, 2
add eax, 2
test cl, cl
jne 0x10006620
xor eax, eax
jmp 0x10006645
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1000671d
cmp byte [0x1000c6d0], 0
lea eax, [ebp - 8]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push 4
mov dword [ebp - 8], 0x40
push 0x49099a
je 0x100066ca
mov dword [ebp - 0x10], str.Macro_de_Pergaminho_Desativado
call esi
mov dword [0x49099b], 0xffff0000
mov eax, dword [0x684bb0]
mov dword [ebp - 0xc], eax
push dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
call dword [0x1000c024]
lea eax, [ebp - 8]
mov dword [0x49099b], 0xffffaaaa
push eax
push dword [ebp - 8]
push 4
push 0x49099a
call esi
mov byte [0x1000c6d0], 0
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100069a3
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x10], str.Macro_de_Pergaminho_j
call esi
mov dword [0x49099b], 0xffff0000
mov eax, dword [0x684bb0]
mov dword [ebp - 0xc], eax
push dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
call dword [0x1000c024]
lea eax, [ebp - 8]
mov dword [0x49099b], 0xffffaaaa
push eax
push dword [ebp - 8]
push 4
push 0x49099a
call esi
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100069a3
mov esp, ebp
pop ebp
ret
mov eax, 1
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100069a3
mov esp, ebp
pop ebp
ret
cmp dword [0x9362d8], 0
lea eax, [ebp - 8]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push 4
mov dword [ebp - 8], 0x40
push 0x49099a
je 0x100067c9
mov dword [ebp - 0x10], str.Effects_ON
call esi
mov dword [0x49099b], 0xffffaaaa
mov eax, dword [0x684bb0]
mov dword [ebp - 0xc], eax
push dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
call dword [0x1000c024]
lea eax, [ebp - 8]
mov dword [0x49099b], 0xffffaaaa
push eax
push dword [ebp - 8]
push 4
push 0x49099a
call esi
mov dword ds:[0x9362d8], 0
mov dword ds:[0x9362dc], 0
mov dword ds:[0x9362e0], 0
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100069a3
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x10], str.Effects_OFF
call esi
mov dword [0x49099b], 0xffffaaaa
mov eax, dword [0x684bb0]
mov dword [ebp - 0xc], eax
push dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
call dword [0x1000c024]
lea eax, [ebp - 8]
mov dword [0x49099b], 0xffffaaaa
push eax
push dword [ebp - 8]
push 4
push 0x49099a
call esi
mov dword ds:[0x9362d8], 1
mov dword ds:[0x9362dc], 1
mov dword ds:[0x9362e0], 1
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.100069a3
mov esp, ebp
pop ebp
ret