Function at 0x10005f40
Capabilities:
Allocate or change rwx memory
Execute command
Execute shellcode via indirect call
Write and execute a file
Write file on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x688
mov eax, dword [0x1000d00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebx + 8]
mov ecx, 0x1000
mov dword [ebp - 0x54], edi
mov eax, 0x1000e260
nop dword [eax + eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x10005f80
movsx eax, word [edi]
test eax, eax
je 0x10005fd0
cmp eax, 0x1000
ja 0x10005faa
push eax
push edi
push 0x1000e260
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
jmp 0x10005fd0
push 0x1000
push 0
push 0x1000e260
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [eax], 0x22
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo]
movzx eax, word [edi + 4]
mov edx, 0xd1d
cmp ax, dx
jne 0x10006006
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x54]
push eax
push 0x40
push 4
push 0x49a477
mov dword [ebp - 0x54], 0x40
call esi
mov dword [0x49a477], 0xff00cd00
jmp 0x10006048
mov ecx, 0xd1e
cmp ax, cx
jne 0x1000605d
mov word [edi + 4], dx
mov eax, dword [0x1000e2c8]
mov dword [ebp - 0x5c], eax
test eax, eax
je 0x10006692
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x54]
push eax
push 0x40
push 4
push 0x49a477
mov dword [ebp - 0x54], 0x40
call esi
mov eax, dword [ebp - 0x5c]
mov dword [0x49a477], eax
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x54]
push 4
push 0x49a477
call esi
jmp 0x10006692
mov ecx, 0x37f
cmp ax, cx
jne 0x10006179
cmp word [edi + 0x2a], 1
mov esi, 0x20
mov ecx, 0x3ab
mov edx, 0x569b76
jne 0x100060fa
movups xmm0, xmmword [edi]
movups xmm1, xmmword [edi + 0x10]
movups xmmword [ebp - 0x90], xmm0
movq xmm0, qword [edi + 0x20]
movq qword [ebp - 0x70], xmm0
xorps xmm0, xmm0
movaps xmmword [ebp - 0x30], xmm0
movaps xmmword [ebp - 0x80], xmm1
movaps xmmword [ebp - 0x20], xmm0
mov word [ebp - 0x30], si
mov word [ebp - 0x2c], cx
mov ecx, dword ds:[0x13c1aac]
add ecx, 0xdfc
xor eax, eax
mov ax, word ds:[ecx]
movq xmm0, qword [ebp - 0x7a]
mov word [ebp - 0x2a], ax
pextrw eax, xmm1, 2
push esi
movq qword [ebp - 0x22], xmm0
mov word [ebp - 0x24], ax
mov eax, dword [ebp - 0x72]
mov dword [ebp - 0x1a], eax
mov al, byte [ebp - 0x6e]
mov byte [ebp - 0x16], al
lea eax, [ebp - 0x30]
push eax
call edx
add esp, 8
mov ecx, 0x3ab
mov edx, 0x569b76
cmp byte [0x1000d6d9], 0
je 0x10006692
movups xmm0, xmmword [edi]
movups xmm1, xmmword [edi + 0x10]
movups xmmword [ebp - 0x90], xmm0
movq xmm0, qword [edi + 0x20]
movq qword [ebp - 0x70], xmm0
xorps xmm0, xmm0
movaps xmmword [ebp - 0x50], xmm0
movaps xmmword [ebp - 0x80], xmm1
movaps xmmword [ebp - 0x40], xmm0
mov word [ebp - 0x50], si
mov word [ebp - 0x4c], cx
mov ecx, dword ds:[0x13c1aac]
add ecx, 0xdfc
xor eax, eax
mov ax, word ds:[ecx]
movq xmm0, qword [ebp - 0x7a]
mov word [ebp - 0x4a], ax
pextrw eax, xmm1, 2
push 0x20
movq qword [ebp - 0x42], xmm0
mov word [ebp - 0x44], ax
mov eax, dword [ebp - 0x72]
mov dword [ebp - 0x3a], eax
mov al, byte [ebp - 0x6e]
mov byte [ebp - 0x36], al
lea eax, [ebp - 0x50]
push eax
call edx
jmp 0x1000668f
mov ecx, 0xdde
cmp ax, cx
jne 0x100061e2
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [edi + 0xc]
mov dword [ebp - 0x5c], eax
lea eax, [ebp - 0x54]
push eax
push 0x40
push 4
push 0x49099a
mov dword [ebp - 0x54], 0x40
call esi
mov dword [0x49099b], 0xffffff00
mov eax, dword [0x684bb0]
mov dword [ebp - 0x60], eax
push dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x60]
call dword [0x1000d024]
lea eax, [ebp - 0x54]
mov dword [0x49099b], 0xffffaaaa
push eax
push dword [ebp - 0x54]
push 4
push 0x49099a
call esi
jmp 0x10006692
mov ecx, 0x666
cmp ax, cx
jne 0x1000621d
movups xmm0, xmmword [edi + 0xc]
movups xmmword [0x1000d7c0], xmm0
movups xmm0, xmmword [edi + 0x1c]
movups xmmword [0x1000d7d0], xmm0
movups xmm0, xmmword [edi + 0x2c]
movups xmmword [0x1000d7e0], xmm0
movups xmm0, xmmword [edi + 0x3c]
movups xmmword [0x1000d7f0], xmm0
jmp 0x10006692
mov ecx, 0xafa
cmp ax, cx
jne 0x10006253
push ecx
push str.PACKET_SUCESSO_Type:__d
call fcn.10005f00
add esp, 8
cmp word [edi + 4], 2
jne 0x10006692
push str.shutdown__s__t_2
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 4
jmp 0x10006692
mov ecx, 0x10a
cmp ax, cx
jne 0x100062ab
xor eax, eax
push 0x1000a41c
mov word [0x1000d804], ax
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x54]
push str.UI_acc.bin
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
mov eax, dword [ebp - 0x54]
add esp, 0xc
test eax, eax
je 0x10006692
push eax
push 2
push 1
push 0x1000d804
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push dword [ebp - 0x54]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
jmp 0x10006692
mov ecx, 0x182
cmp ax, cx
je 0x100062c0
mov word [0x1000d7bc], ax
jmp 0x10006692
mov eax, dword [0x1000dcb8]
mov ecx, dword [0x1000dcbc]
mov byte [ebp - 0x55], 0
cmp eax, ecx
je 0x100062e8
movzx edx, word [edi + 0x10]
cmp edx, dword [eax]
je 0x100062e4
add eax, 4
cmp eax, ecx
jne 0x100062d7
jmp 0x100062e8
mov byte [ebp - 0x55], 1
mov eax, dword ds:[0x13c1aac]
add eax, 0x6ec
mov esi, eax
lea edi, [ebp - 0x680]
mov ecx, 0xbd
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x5bc]
mov ecx, 0xf43
cmp ax, cx
je 0x1000632b
mov ecx, 0xf4c
cmp ax, cx
je 0x1000632b
mov edi, dword [ebp - 0x54]
mov byte [0x1000d6da], 0
jmp 0x10006475
mov edi, dword [ebp - 0x54]
xor edx, edx
mov byte [0x1000d6da], 1
movzx ecx, word [edi + 0x10]
mov eax, ecx
cmp ecx, 0x309
ja 0x10006369
je case.0x10006464.6421
sub eax, 0x19c
cmp eax, 0xa6
ja case.default.0x10006464
movzx eax, byte [eax + 0x100066b4]
jmp dword [eax*4 + 0x100066ac]
cmp ecx, 0x6cb
ja 0x10006393
je case.0x10006464.6421
sub eax, 0x30a
cmp eax, 7
ja case.default.0x10006464
movzx eax, byte [eax + 0x10006760]
jmp dword [eax*4 + 0x1000675c]
cmp ecx, 0xbd3
ja 0x100063bd
je case.0x10006464.6421
sub eax, 0x956
cmp eax, 0x3a
ja case.default.0x10006464
movzx eax, byte [eax + 0x10006770]
jmp dword [eax*4 + 0x10006768]
cmp ecx, 0xcee
ja 0x100063e1
je case.0x10006464.6421
sub eax, 0xbd4
cmp eax, 0xb5
ja case.default.0x10006464
movzx eax, byte [eax + 0x100067b4]
jmp dword [eax*4 + 0x100067ac]
cmp ecx, 0xfaa
ja 0x10006403
je case.0x10006464.6421
sub eax, 0xcf2
cmp eax, 0x51
ja case.default.0x10006464
movzx eax, byte [eax + 0x10006874]
jmp dword [eax*4 + 0x1000686c]
cmp ecx, 0x17d5
ja 0x10006427
je case.0x10006464.6421
sub eax, 0xfab
cmp eax, 0x87
ja case.default.0x10006464
movzx eax, byte [eax + 0x100068d0]
jmp dword [eax*4 + 0x100068c8]
cmp ecx, 0x1914
ja 0x1000645a
je case.0x10006464.6421
sub eax, 0x17d6
je case.0x10006464.6421
sub eax, 3
jne case.default.0x10006464
mov edx, ecx
mov eax, dword [0x1000dcbc]
mov dword [ebp - 0x60], edx
cmp eax, dword [0x1000dcc0]
je 0x1000646b
mov dword [eax], edx
add dword [0x1000dcbc], 4
jmp 0x10006475
sub eax, 0x1915
cmp eax, 3
ja case.default.0x10006464
jmp dword [eax*4 + 0x10006958]
lea ecx, [ebp - 0x60]
push ecx
push eax
call fcn.10003910
cmp byte [ebp - 0x55], 0
je 0x1000656b
cmp byte [0x1000d6da], 0
je 0x1000656b
movzx edx, word [edi + 0x10]
mov eax, edx
cmp eax, 0x956
ja 0x100064a0
je 0x100064a0
cmp eax, 0x1d9
movzx eax, word [edi + 0xe]
mov dword [ebp - 0x60], edx
mov dword [ebp - 0x5c], eax
mov eax, dword ds:[0x13c1aac]
add eax, 0x6ec
mov esi, eax
lea edi, [ebp - 0x388]
mov ecx, 0xbd
xor eax, eax
rep movsd dword es:[edi], dword [esi]
cmp word [ebp + eax*8 - 0x2ac], dx
je 0x100064de
inc eax
or dl, 0xff
cmp eax, 0x3f
jge 0x1000650b
mov edx, dword [ebp - 0x60]
jmp 0x100064c6
lea ecx, [ebp - 0x2a9]
xor edx, edx
lea ecx, [ecx + eax*8]
nop dword [eax]
cmp byte [ecx - 1], 0x3d
jne 0x10006509
cmp byte [ecx], 0x78
jne 0x10006509
inc edx
add ecx, 2
cmp edx, 3
jl 0x100064f0
or dl, 0xff
jmp 0x1000650b
mov dl, al
xorps xmm0, xmm0
mov dword [ebp - 0x20], 0
mov eax, 0x14
movaps xmmword [ebp - 0x30], xmm0
mov word [ebp - 0x30], ax
mov eax, 0x376
mov word [ebp - 0x2c], ax
mov ecx, dword ds:[0x13c1aac]
add ecx, 0xdfc
xor eax, eax
mov ax, word ds:[ecx]
mov word [ebp - 0x2a], ax
mov eax, dword [ebp - 0x5c]
mov byte [ebp - 0x21], al
lea eax, [ebp - 0x30]
push 0x14
push eax
mov eax, 0x569b76
mov byte [ebp - 0x24], 1
mov byte [ebp - 0x23], dl
mov byte [ebp - 0x22], 1
call eax
mov eax, dword [ebp - 0x54]
add esp, 8
jmp 0x10006694
mov eax, 0x338
cmp word [0x1000d7bc], ax
jne 0x10006692
movzx ecx, word [edi + 0x10]
xor esi, esi
xor edx, edx
mov eax, ecx
cmp ecx, 0x956
ja 0x100065f4
je case.0x10006631.4019
cmp ecx, 0x1d9
ja 0x100065bb
je case.0x10006631.4019
sub eax, 0x19c
cmp eax, 8
ja case.0x10006631.4021
movzx eax, byte [eax + 0x10006970]
jmp dword [eax*4 + 0x10006968]
cmp ecx, 0x6cb
ja 0x100065dd
je case.0x10006631.4019
sub eax, 0x1db
cmp eax, 7
ja case.0x10006631.4021
movzx eax, byte [eax + 0x10006984]
jmp dword [eax*4 + 0x1000697c]
cmp ecx, 0x6ee
je case.0x10006631.4019
cmp ecx, esi
jne 0x1000663c
inc edx
cmp edx, 0x3f
jl 0x10006585
jmp 0x10006692
cmp ecx, 0xc44
ja 0x10006616
je case.0x10006631.4019
sub eax, 0x957
cmp eax, 0x39
ja case.0x10006631.4021
movzx eax, byte [eax + 0x10006994]
jmp dword [eax*4 + 0x1000698c]
cmp ecx, 0x17d5
ja case.0x10006631.4021
je case.0x10006631.4019
sub eax, 0xfb3
cmp eax, 0x66
ja case.0x10006631.4021
movzx eax, byte [eax + 0x100069d8]
jmp dword [eax*4 + 0x100069d0]
mov esi, ecx
jmp 0x100065e9
mov eax, 0x2e4
mov dword [ebp - 0x24], 0x14
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x20], ax
mov ecx, dword ds:[0x13c1aac]
add ecx, 0xdfc
xor eax, eax
mov ax, word ds:[ecx]
mov word [ebp - 0x1e], ax
mov ax, word [edi + 0x10]
mov word [ebp - 0x14], ax
movzx eax, word [edi + 0xe]
mov dword [ebp - 0x18], eax
mov eax, 5
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x24]
push 0x14
push eax
mov eax, 0x569b76
call eax
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10007863
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 8