Function at 0x10006c70
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
mov eax, dword [0x10056cc0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1005b3d6], 0
jne 0x100078df
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push edi
lea esp, [esp]
push str.d3d9.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x64
mov edi, eax
call esi
test edi, edi
je 0x10006ca0
push 0x9c
lea eax, [ebp - 0xac]
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea esi, [ebp - 0xac]
mov dword [ebp - 0xac], 0x9c
call fcn.100010a0
push 0x1c
lea ecx, [ebp - 0xcc]
push ecx
add edi, 0x1000
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
call fcn.100010a0
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 1
jne 0x10006fb0
cmp dword [ebp - 0xa8], 5
jne 0x10006fb0
mov eax, dword [ebp - 0xa4]
cmp eax, 1
je 0x10006d2b
cmp eax, 2
jne 0x10006fb0
mov esi, dword [ebp - 0xc0]
mov edx, dword [ebp - 0xcc]
push 0
push 0
push str.x____xxx
push 0x1004a950
push esi
push edx
call fcn.10007a90
push 0
push 0
push str.x____xxx
mov ebx, eax
push 0x1004a950
lea eax, [ebx + 1]
push esi
push eax
mov dword [0x1005b2e8], ebx
call fcn.10007a90
push 0
push 0
push str.x____xxx
push 0x1004a950
mov dword [0x1005b2fc], eax
inc eax
push esi
push eax
call fcn.10007a90
mov ecx, dword [ebp - 0xcc]
add esp, 0x48
push 0
push 0
push str.x____xxx
push 0x1004a95c
push esi
push ecx
mov dword [0x1005b310], eax
call fcn.10007a90
mov edx, dword [ebp - 0xcc]
push 0
push 0
push str.x____xxx
push 0x1004a968
push esi
push edx
mov dword [0x1005b324], eax
call fcn.10007a90
push 0
push 0
push str.x____xxx
push 0x1004a974
mov dword [0x1005b338], eax
mov eax, dword [ebp - 0xcc]
push esi
push eax
call fcn.10007a90
add esp, 0x48
lea edx, [ebp - 0xb0]
push edx
mov dword [0x1005b34c], eax
mov ecx, dword [ebx + 1]
push 0x40
lea esi, [ecx + ebx + 5]
push 5
add ebx, 5
push esi
mov dword [0x1005b2ec], esi
mov dword [0x1005b2f8], ebx
call edi
mov edx, dword [ebp - 0xb0]
lea ecx, [ebp - 0xb0]
push ecx
push edx
mov eax, 0x10002eb0
sub eax, esi
push 5
sub eax, 5
push esi
mov byte [esi], 0xe9
mov dword [esi + 1], eax
call edi
mov eax, dword [0x1005b2fc]
mov ecx, dword [eax + 1]
lea edx, [ebp - 0xb0]
push edx
push 0x40
lea esi, [ecx + eax + 5]
push 5
add eax, 5
push esi
mov dword [0x1005b300], esi
mov dword [0x1005b30c], eax
call edi
mov edx, dword [ebp - 0xb0]
lea ecx, [ebp - 0xb0]
push ecx
push edx
mov eax, 0x10002ec0
sub eax, esi
push 5
sub eax, 5
push esi
mov byte [esi], 0xe9
mov dword [esi + 1], eax
call edi
mov eax, dword [0x1005b310]
mov ecx, dword [eax + 1]
lea edx, [ebp - 0xb0]
push edx
push 0x40
lea esi, [ecx + eax + 5]
push 5
add eax, 5
push esi
mov dword [0x1005b314], esi
mov dword [0x1005b320], eax
call edi
mov edx, dword [ebp - 0xb0]
lea ecx, [ebp - 0xb0]
push ecx
push edx
mov eax, 0x10002ed0
sub eax, esi
push 5
sub eax, 5
push esi
mov byte [esi], 0xe9
mov dword [esi + 1], eax
call edi
mov eax, dword [0x1005b324]
mov ecx, dword [eax + 1]
lea edx, [ebp - 0xb0]
push edx
push 0x40
lea esi, [ecx + eax + 5]
push 5
add eax, 5
push esi
mov dword [0x1005b328], esi
mov dword [0x1005b334], eax
call edi
mov edx, dword [ebp - 0xb0]
lea ecx, [ebp - 0xb0]
push ecx
push edx
mov eax, 0x10002ee0
sub eax, esi
push 5
sub eax, 5
push esi
mov byte [esi], 0xe9
mov dword [esi + 1], eax
call edi
mov eax, dword [0x1005b338]
mov ecx, dword [eax + 1]
lea esi, [ecx + eax + 5]
lea edx, [ebp - 0xb0]
add eax, 5
push edx
mov dword [0x1005b33c], esi
mov dword [0x1005b348], eax
push 0x40
push 5
push esi
call edi
mov edx, dword [ebp - 0xb0]
lea ecx, [ebp - 0xb0]
push ecx
push edx
mov eax, 0x10002ef0
sub eax, esi
push 5
sub eax, 5
push esi
mov byte [esi], 0xe9
mov dword [esi + 1], eax
call edi
mov eax, dword [0x1005b34c]
mov ecx, dword [eax + 1]
lea edx, [ebp - 0xb0]
push edx
push 0x40
lea esi, [ecx + eax + 5]
push 5
add eax, 5
push esi
mov dword [0x1005b350], esi
mov dword [0x1005b35c], eax
call edi
mov edx, dword [ebp - 0xb0]
lea ecx, [ebp - 0xb0]
push ecx
push edx
mov eax, 0x10002ea0
sub eax, esi
push 5
sub eax, 5
push esi
mov byte [esi], 0xe9
mov dword [esi + 1], eax
call edi
lea esi, [ebp - 0xac]
call fcn.100010a0
cmp eax, 1
jne 0x10007269
cmp dword [ebp - 0xa8], 6
jne 0x10007269
mov eax, dword [ebp - 0xa4]
test eax, eax
je 0x10006fe4
cmp eax, 1
jne 0x10007269
mov esi, dword [ebp - 0xc0]
mov eax, dword [ebp - 0xcc]
push 0
push 0
push str.x____xxx
push 0x1004a950
push esi
push eax
call fcn.10007a90
push 0
push 0
push str.x____xxx
mov ebx, eax
push 0x1004a950
lea ecx, [ebx + 1]
push esi
push ecx
mov dword [0x1005b2e8], ebx
call fcn.10007a90
push 0
push 0
push str.x____xxx
push 0x1004a950
mov dword [0x1005b2fc], eax
inc eax
push esi
push eax
call fcn.10007a90
mov edx, dword [ebp - 0xcc]
add esp, 0x48
push 0
push 0
push str.x____xxx
push 0x1004a974
push esi
push edx
mov dword [0x1005b310], eax
call fcn.10007a90
push 0
push 0
push str.x____xxx
push 0x1004a980
mov dword [0x1005b34c], eax
mov eax, dword [ebp - 0xcc]
push esi
push eax
call fcn.10007a90
mov ecx, dword [ebp - 0xcc]
push 0
push 0
push str.x____xx
push 0x1004a994
push esi
push ecx
mov dword [0x1005b324], eax
call fcn.10007a90
add esp, 0x48
mov dword [0x1005b338], eax
mov edx, dword [ebx + 1]
lea eax, [ebp - 0xb0]
push eax
push 0x40
lea esi, [edx + ebx + 5]
push 5
add ebx, 5
push esi
mov dword [0x1005b2ec], esi
mov dword [0x1005b2f8], ebx
call edi
mov eax, dword [ebp - 0xb0]
lea edx, [ebp - 0xb0]
push edx
push eax
mov ecx, 0x10002eb0
sub ecx, esi
push 5
sub ecx, 5
push esi
mov byte [esi], 0xe9
mov dword [esi + 1], ecx
call edi
mov eax, dword [0x1005b2fc]
mov ecx, dword [eax + 1]
lea edx, [ebp - 0xb0]
push edx
push 0x40
lea esi, [ecx + eax + 5]
push 5
add eax, 5
push esi
mov dword [0x1005b300], esi
mov dword [0x1005b30c], eax
call edi
mov edx, dword [ebp - 0xb0]
lea ecx, [ebp - 0xb0]
push ecx
push edx
mov eax, 0x10002ec0
sub eax, esi
push 5
sub eax, 5
push esi
mov byte [esi], 0xe9
mov dword [esi + 1], eax
call edi
mov eax, dword [0x1005b310]
mov ecx, dword [eax + 1]
lea edx, [ebp - 0xb0]
push edx
push 0x40
lea esi, [ecx + eax + 5]
push 5
add eax, 5
push esi
mov dword [0x1005b314], esi
mov dword [0x1005b320], eax
call edi
mov edx, dword [ebp - 0xb0]
lea ecx, [ebp - 0xb0]
push ecx
push edx
mov eax, 0x10002ed0
sub eax, esi
push 5
sub eax, 5
push esi
mov byte [esi], 0xe9
mov dword [esi + 1], eax
call edi
mov eax, dword [0x1005b34c]
mov ecx, dword [eax + 1]
lea edx, [ebp - 0xb0]
push edx
push 0x40
lea esi, [ecx + eax + 5]
push 5
add eax, 5
push esi
mov dword [0x1005b350], esi
mov dword [0x1005b35c], eax
call edi
mov edx, dword [ebp - 0xb0]
lea ecx, [ebp - 0xb0]
push ecx
push edx
mov eax, 0x10002ea0
sub eax, esi
push 5
sub eax, 5
push esi
mov byte [esi], 0xe9
mov dword [esi + 1], eax
call edi
mov eax, dword [0x1005b324]
mov ecx, dword [eax + 1]
lea esi, [ecx + eax + 5]
lea edx, [ebp - 0xb0]
add eax, 5
push edx
mov dword [0x1005b328], esi
mov dword [0x1005b334], eax
push 0x40
push 5
push esi
call edi
mov edx, dword [ebp - 0xb0]
lea ecx, [ebp - 0xb0]
push ecx
push edx
mov eax, 0x10002ee0
sub eax, esi
push 5
sub eax, 5
push esi
mov byte [esi], 0xe9
mov dword [esi + 1], eax
call edi
mov eax, dword [0x1005b338]
mov ecx, dword [eax + 1]
lea edx, [ebp - 0xb0]
push edx
push 0x40
lea esi, [ecx + eax + 5]
push 5
add eax, 5
push esi
mov dword [0x1005b33c], esi
mov dword [0x1005b348], eax
call edi
mov edx, dword [ebp - 0xb0]
lea ecx, [ebp - 0xb0]
push ecx
push edx
mov eax, 0x10002ef0
sub eax, esi
push 5
sub eax, 5
push esi
mov byte [esi], 0xe9
mov dword [esi + 1], eax
call edi
lea esi, [ebp - 0xac]
call fcn.100010a0
cmp eax, 1
jne 0x100075f8
cmp dword [ebp - 0xa8], 6
jne 0x100075f8
cmp dword [ebp - 0xa4], 3
jne 0x100075f8
cmp dword [0x1005b2e8], 0
mov esi, dword [ebp - 0xc0]
jne 0x100072c9
mov eax, dword [ebp - 0xcc]
push 0
push 0
push str.x____xxx
push 0x1004a5d8
push esi
push eax
call fcn.10007a90
add esp, 0x18
mov dword [0x1005b2e8], eax
mov ebx, dword [0x1005b2fc]
test ebx, ebx
jne 0x100072f8
mov ecx, dword [0x1005b2e8]
push ebx
push ebx
push str.x____xxx
push 0x1004a5d8
inc ecx
push esi
push ecx
call fcn.10007a90
mov ebx, eax
add esp, 0x18
mov dword [0x1005b2fc], ebx
cmp dword [0x1005b310], 0
jne 0x10007321
push 0
push 0
push str.x____xxx
push 0x1004a5d8
lea edx, [ebx + 1]
push esi
push edx
call fcn.10007a90
add esp, 0x18
mov dword [0x1005b310], eax
cmp dword [0x1005b324], 0
jne 0x1000734d
mov eax, dword [ebp - 0xcc]
push 0
push 0
push str.x____xx
push 0x1004a99c
push esi
push eax
call fcn.10007a90
add esp, 0x18
mov dword [0x1005b324], eax
mov eax, dword [0x1005b338]
test eax, eax
jne 0x10007413
mov ecx, dword [ebp - 0xcc]
push eax
push eax
push str.x____xxx
push 0x1004a9a4
push esi
push ecx
call fcn.10007a90
add esp, 0x18
mov dword [0x1005b338], eax
test eax, eax
jne 0x10007413
mov edx, dword [ebp - 0xcc]
push eax
push eax
push str.x____xxx
push 0x1004a9b0
push esi
push edx
call fcn.10007a90
add esp, 0x18
mov dword [0x1005b338], eax
test eax, eax
jne 0x10007413
push eax
push eax
mov eax, dword [ebp - 0xcc]
push str.x____xxxx
push 0x1004a9c8
push esi
push eax
call fcn.10007a90
add esp, 0x18
mov dword [0x1005b338], eax
test eax, eax
jne 0x10007413
mov ecx, dword [ebp - 0xcc]
push eax
push eax
push str.x____xxx
push 0x1004a9d4
push esi
push ecx
call fcn.10007a90
add esp, 0x18
mov dword [0x1005b338], eax
test eax, eax
jne 0x10007413
mov edx, dword [ebp - 0xcc]
push eax
push eax
push str.x____xxx
push 0x1004a95c
push esi
push edx
call fcn.10007a90
add esp, 0x18
mov dword [0x1005b338], eax
cmp dword [0x1005b34c], 0
jne 0x1000743a
push 0
push 0
push str.x____xxx
push 0x1004a9a4
inc eax
push esi
push eax
call fcn.10007a90
add esp, 0x18
mov dword [0x1005b34c], eax
mov eax, dword [0x1005b2e8]
mov ecx, dword [eax + 1]
lea edx, [ecx + eax + 5]
add eax, 7
mov dword [0x1005b2f8], eax
mov dword [0x1005b2ec], edx
xor ecx, ecx
mov dword [0x1005b2f0], ecx
mov eax, dword [ebx + 1]
lea edx, [eax + ebx + 5]
mov eax, dword [0x1005b310]
mov dword [0x1005b300], edx
mov dword [0x1005b304], ecx
add ebx, 7
mov dword [0x1005b30c], ebx
mov edx, dword [eax + 1]
lea edx, [edx + eax + 5]
add eax, 7
mov dword [0x1005b314], edx
mov dword [0x1005b320], eax
mov eax, dword [0x1005b324]
lea edx, [ebp - 0xb0]
push edx
mov dword [0x1005b318], ecx
mov ecx, dword [eax + 1]
push 0x40
lea esi, [ecx + eax + 5]
push 5
add eax, 5
push esi
mov dword [0x1005b328], esi
mov dword [0x1005b334], eax
call edi
mov edx, dword [ebp - 0xb0]
lea ecx, [ebp - 0xb0]
push ecx
push edx
mov eax, 0x10002ee0
sub eax, esi
push 5
sub eax, 5
push esi
mov byte [esi], 0xe9
mov dword [esi + 1], eax
call edi
mov eax, dword [0x1005b338]
mov ecx, dword [eax + 1]
lea edx, [ebp - 0xb0]
push edx
push 0x40
lea esi, [ecx + eax + 5]
push 5
add eax, 5
push esi
mov dword [0x1005b33c], esi
mov dword [0x1005b348], eax
call edi
mov edx, dword [ebp - 0xb0]
lea ecx, [ebp - 0xb0]
push ecx
push edx
mov eax, 0x10002ef0
sub eax, esi
push 5
sub eax, 5
push esi
mov byte [esi], 0xe9
mov dword [esi + 1], eax
call edi
mov eax, dword [0x1005b34c]
mov ecx, dword [eax + 1]
lea edx, [ebp - 0xb0]
push edx
push 0x40
lea esi, [ecx + eax + 5]
push 5
add eax, 5
push esi
mov dword [0x1005b350], esi
mov dword [0x1005b35c], eax
call edi
mov edx, dword [ebp - 0xb0]
lea ecx, [ebp - 0xb0]
push ecx
push edx
mov eax, 0x10002ea0
sub eax, esi
push 5
sub eax, 5
push esi
mov byte [esi], 0xe9
mov dword [esi + 1], eax
call edi
mov esi, dword [0x1005b2ec]
test esi, esi
je 0x100075f8
mov eax, dword [0x1005b2e8]
cmp byte [eax + 0xd], 0x7d
jne 0x100075be
mov eax, 0x10002e20
call fcn.10001230
mov esi, dword [0x1005b300]
mov eax, 0x10002e30
call fcn.10001230
mov esi, dword [0x1005b314]
mov eax, 0x10002e40
call fcn.10001230
mov esi, dword [0x1005b2ec]
test esi, esi
je 0x100075f8
mov ecx, dword [0x1005b2e8]
cmp byte [ecx + 0xd], 0x75
jne 0x100075f8
mov eax, 0x10002e50
call fcn.10001230
mov esi, dword [0x1005b300]
mov eax, 0x10002e80
call fcn.10001230
mov esi, dword [0x1005b314]
mov eax, 0x10002e60
call fcn.10001230
lea esi, [ebp - 0xac]
call fcn.100010a0
cmp eax, 1
jne 0x100078d5
cmp dword [ebp - 0xa8], 0xa
jne 0x100078d5
mov eax, dword [ebp - 0xa4]
test eax, eax
je 0x1000762c
cmp eax, 1
jne 0x100078d5
cmp dword [0x1005b2e8], 0
mov esi, dword [ebp - 0xc0]
mov edi, dword [ebp - 0xcc]
jne 0x1000765e
push 0
push 0
push str.x____xxx
push 0x1004a5d8
push esi
push edi
call fcn.10007a90
add esp, 0x18
mov dword [0x1005b2e8], eax
mov ebx, dword [0x1005b2fc]
test ebx, ebx
jne 0x1000768d
mov edx, dword [0x1005b2e8]
push ebx
push ebx
push str.x____xxx
push 0x1004a5d8
inc edx
push esi
push edx
call fcn.10007a90
mov ebx, eax
add esp, 0x18
mov dword [0x1005b2fc], ebx
cmp dword [0x1005b310], 0
jne 0x100076b6
push 0
push 0
push str.x____xxx
push 0x1004a5d8
lea eax, [ebx + 1]
push esi
push eax
call fcn.10007a90
add esp, 0x18
mov dword [0x1005b310], eax
cmp dword [0x1005b34c], 0
jne 0x100076dc
push 0
push 0
push str.x____xx
push 0x1004a99c
push esi
push edi
call fcn.10007a90
add esp, 0x18
mov dword [0x1005b34c], eax
cmp dword [0x1005b324], 0
jne 0x10007709
mov ecx, dword [0x1005b34c]
push 0
push 0
push str.x____xx
push 0x1004a99c
inc ecx
push esi
push ecx
call fcn.10007a90
add esp, 0x18
mov dword [0x1005b324], eax
mov eax, dword [0x1005b338]
test eax, eax
jne 0x1000778a
push eax
push eax
push str.x____xxx
push 0x1004a9b0
push esi
push edi
call fcn.10007a90
add esp, 0x18
mov dword [0x1005b338], eax
test eax, eax
jne 0x1000778a
push eax
push eax
push str.x____xxxx
push 0x1004a9c8
push esi
push edi
call fcn.10007a90
add esp, 0x18
mov dword [0x1005b338], eax
test eax, eax
jne 0x1000778a
push eax
push eax
push str.x____xxx
push 0x1004a9d4
push esi
push edi
call fcn.10007a90
add esp, 0x18
mov dword [0x1005b338], eax
test eax, eax
jne 0x1000778a
push eax
push eax
push str.x____xxx
push 0x1004a95c
push esi
push edi
call fcn.10007a90
add esp, 0x18
mov dword [0x1005b338], eax
mov ecx, dword [0x1005b2e8]
test ecx, ecx
je 0x100077e8
mov edx, dword [ecx + 1]
lea eax, [edx + ecx + 5]
mov dword [0x1005b2ec], eax
mov ecx, 0x17fe1cbb
lea eax, [ebp - 0x10]
call fcn.1000a140
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, dword [0x1005b2e8]
mov esi, dword [0x1005b2ec]
add eax, 0x7d812
mov dword [0x1005b2f0], eax
add ecx, 7
mov eax, 0x10002e70
mov dword [0x1005b2f8], ecx
call fcn.10001230
mov eax, dword [0x1005b338]
mov ebx, dword [0x1005b2fc]
test ebx, ebx
je 0x1000781b
mov edx, dword [ebx + 1]
lea esi, [edx + ebx + 5]
add ebx, 7
mov eax, 0x10002e80
mov dword [0x1005b300], esi
mov dword [0x1005b304], 0
mov dword [0x1005b30c], ebx
call fcn.10001230
mov eax, dword [0x1005b338]
mov ecx, dword [0x1005b310]
test ecx, ecx
je 0x10007854
mov eax, dword [ecx + 1]
lea esi, [eax + ecx + 5]
add ecx, 7
mov eax, 0x10002e90
mov dword [0x1005b314], esi
mov dword [0x1005b318], 0
mov dword [0x1005b320], ecx
call fcn.10001230
mov eax, dword [0x1005b338]
mov ecx, dword [0x1005b34c]
test ecx, ecx
je 0x10007883
mov edx, dword [ecx + 1]
lea esi, [edx + ecx + 5]
add ecx, 5
mov eax, 0x10002ea0
mov dword [0x1005b350], esi
mov dword [0x1005b35c], ecx
call fcn.10001230
mov eax, dword [0x1005b338]
mov ecx, dword [0x1005b324]
test ecx, ecx
je 0x100078b2
mov eax, dword [ecx + 1]
lea esi, [eax + ecx + 5]
add ecx, 5
mov eax, 0x10002ee0
mov dword [0x1005b328], esi
mov dword [0x1005b334], ecx
call fcn.10001230
mov eax, dword [0x1005b338]
test eax, eax
je 0x100078d5
mov ecx, dword [eax + 1]
lea esi, [ecx + eax + 5]
add eax, 5
mov dword [0x1005b348], eax
mov eax, 0x10002ef0
mov dword [0x1005b33c], esi
call fcn.10001230
pop edi
pop esi
mov byte [0x1005b3d6], 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003884a
mov esp, ebp
pop ebp
ret