Function at 0x1006b350
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1009e040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
test ebx, ebx
jne 0x1006b378
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100828aa
mov esp, ebp
pop ebp
ret
push esi
push edi
push 0
push 0
push ebx
push 0
xor edx, edx
mov ecx, str.SIMPLEFRAME
call fcn.1006bf00
push 8
push 0xffffffffffffffff
push str.plugin_memory
mov edi, eax
mov dword [ebp - 0xc], 0x40
push 0x158
mov dword [ebp - 0x14], edi
call dword [0x100a163c]
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
push 0x158
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test esi, esi
je 0x1006b3d9
push 5
push 0
push edi
xor edx, edx
mov ecx, esi
call dword [0x100a353c]
mov edi, eax
jmp 0x1006b3db
xor edi, edi
mov eax, dword [ebp - 0x14]
push 8
push 0xffffffffffffffff
push str.plugin_memory
push 0xe8
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 0x40
call dword [0x100a163c]
mov esi, eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x10]
push 0xe8
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test esi, esi
je 0x1006b42a
push 1
push 2
push dword [ebp - 0x18]
xor edx, edx
mov ecx, esi
call dword [0x100a354c]
mov esi, eax
jmp 0x1006b42c
xor esi, esi
mov ecx, dword [ebp - 0x14]
call fcn.10073d60
mov dword [ebp - 0x20], eax
test edi, edi
je 0x1006b4b1
mov eax, dword [edi]
mov eax, dword [eax + 0x1c]
test eax, eax
je 0x1006b472
cmp eax, dword [0x100a34cc]
je 0x1006b45a
lea ecx, [edi + 0xb4]
cmp eax, dword [0x100a34bc]
jne 0x1006b45c
mov ecx, edi
test ecx, ecx
je 0x1006b472
mov dword [ebp - 0x18], 0x3cf5c28f
xor edx, edx
push dword [ebp - 0x18]
call dword [0x100a34c4]
mov eax, dword [edi]
mov eax, dword [eax + 0x1c]
test eax, eax
je 0x1006b4a9
cmp eax, dword [0x100a34cc]
je 0x1006b491
lea ecx, [edi + 0xb4]
cmp eax, dword [0x100a34bc]
jne 0x1006b493
mov ecx, edi
test ecx, ecx
je 0x1006b4a9
mov dword [ebp - 0x18], 0x3b23d70a
xor edx, edx
push dword [ebp - 0x18]
call dword [0x100a34c0]
mov ecx, dword [edi + 0x134]
jmp 0x1006b4b3
xor ecx, ecx
push 0xff
push 0x96
push 0
push 0xff
call fcn.1006c530
mov eax, dword [ebx]
mov edx, dword [0x100a34cc]
mov ecx, dword [0x100a34bc]
mov eax, dword [eax + 0x1c]
test eax, eax
je 0x1006b4f6
cmp eax, edx
je 0x1006b4f1
cmp eax, ecx
je 0x1006b4f1
lea eax, [ebx + 0xb4]
mov dword [ebp - 0x1c], eax
jmp 0x1006b4fd
mov dword [ebp - 0x1c], ebx
jmp 0x1006b4fd
mov dword [ebp - 0x1c], 0
test edi, edi
je 0x1006b55f
mov eax, dword [edi]
mov eax, dword [eax + 0x1c]
test eax, eax
je 0x1006b55f
cmp eax, edx
je 0x1006b51d
cmp eax, ecx
je 0x1006b51d
lea eax, [edi + 0xb4]
mov dword [ebp - 0x18], eax
jmp 0x1006b522
mov eax, edi
mov dword [ebp - 0x18], edi
test eax, eax
je 0x1006b55f
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1006b55f
mov ecx, dword [ebp - 0x18]
xor edx, edx
push 1
mov dword [ebp - 0x1c], 0xbb16bb99
push dword [ebp - 0x1c]
mov dword [ebp - 8], 0
push dword [ebp - 8]
push 6
push eax
push 0
call dword [0x100a34c8]
mov edx, dword [0x100a34cc]
mov ecx, dword [0x100a34bc]
mov eax, dword [ebx]
mov eax, dword [eax + 0x1c]
test eax, eax
je 0x1006b580
cmp eax, edx
je 0x1006b57b
cmp eax, ecx
je 0x1006b57b
lea eax, [ebx + 0xb4]
mov dword [ebp - 0x1c], eax
jmp 0x1006b587
mov dword [ebp - 0x1c], ebx
jmp 0x1006b587
mov dword [ebp - 0x1c], 0
test edi, edi
je 0x1006b5e9
mov eax, dword [edi]
mov eax, dword [eax + 0x1c]
test eax, eax
je 0x1006b5e9
cmp eax, edx
je 0x1006b5a7
cmp eax, ecx
je 0x1006b5a7
lea eax, [edi + 0xb4]
mov dword [ebp - 0x18], eax
jmp 0x1006b5ac
mov eax, edi
mov dword [ebp - 0x18], edi
test eax, eax
je 0x1006b5e9
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1006b5e9
mov ecx, dword [ebp - 0x18]
xor edx, edx
push 1
mov dword [ebp - 8], 0xbb16bb99
push dword [ebp - 8]
mov dword [ebp - 0x1c], 0
push dword [ebp - 0x1c]
push 8
push eax
push 2
call dword [0x100a34c8]
mov edx, dword [0x100a34cc]
mov ecx, dword [0x100a34bc]
test esi, esi
je 0x1006b64b
mov eax, dword [esi]
mov eax, dword [eax + 0x1c]
test eax, eax
je 0x1006b64b
cmp eax, edx
je 0x1006b609
cmp eax, ecx
je 0x1006b609
lea eax, [esi + 0xb4]
mov dword [ebp - 0x18], eax
jmp 0x1006b60e
mov eax, esi
mov dword [ebp - 0x18], esi
test eax, eax
je 0x1006b64b
mov dword [ebp - 8], 0x3c343958
xor edx, edx
push dword [ebp - 8]
mov ecx, eax
call dword [0x100a34c4]
test eax, eax
je 0x1006b63f
mov ecx, dword [ebp - 0x18]
xor edx, edx
mov dword [ebp - 8], 0x3c343958
push dword [ebp - 8]
call dword [0x100a34c0]
mov ecx, dword [0x100a34bc]
mov edx, dword [0x100a34cc]
mov eax, dword [ebx]
mov eax, dword [eax + 0x1c]
test eax, eax
je 0x1006b664
cmp eax, edx
je 0x1006b666
cmp eax, ecx
je 0x1006b666
add ebx, 0xb4
jmp 0x1006b666
xor ebx, ebx
test esi, esi
je 0x1006b6bc
mov eax, dword [esi]
mov eax, dword [eax + 0x1c]
test eax, eax
je 0x1006b6bc
cmp eax, edx
je 0x1006b681
cmp eax, ecx
lea eax, [esi + 0xb4]
jne 0x1006b683
mov eax, esi
test eax, eax
je 0x1006b6bc
test ebx, ebx
je 0x1006b6bc
push 1
mov dword [ebp - 8], 0
xor edx, edx
push dword [ebp - 8]
mov dword [ebp - 0x18], 0xba03126f
mov ecx, eax
push dword [ebp - 0x18]
push 0
push ebx
push 2
call dword [0x100a34c8]
mov edx, dword [0x100a34cc]
mov ecx, dword [0x100a34bc]
test edi, edi
je 0x1006b6d9
mov eax, dword [edi]
mov eax, dword [eax + 0x1c]
test eax, eax
je 0x1006b6d9
cmp eax, edx
je 0x1006b6db
cmp eax, ecx
je 0x1006b6db
add edi, 0xb4
jmp 0x1006b6db
xor edi, edi
test esi, esi
je 0x1006b781
mov eax, dword [esi]
mov eax, dword [eax + 0x1c]
test eax, eax
je 0x1006b727
cmp eax, edx
je 0x1006b6fa
cmp eax, ecx
lea ecx, [esi + 0xb4]
jne 0x1006b6fc
mov ecx, esi
test ecx, ecx
je 0x1006b727
test edi, edi
je 0x1006b727
push 1
mov dword [ebp - 8], 0
xor edx, edx
push dword [ebp - 8]
mov dword [ebp - 0x18], 0xba03126f
push dword [ebp - 0x18]
push 6
push edi
push 8
call dword [0x100a34c8]
push esi
call fcn.1007c930
mov eax, dword [eax]
test eax, eax
je 0x1006b781
mov eax, dword [eax + 0xc]
test eax, eax
je 0x1006b76a
cmp eax, 0x26
je 0x1006b757
cmp eax, 0x40
jne 0x1006b781
push 0
push str.UIWidgetsConsoleHumanCommandButtonhuman_multipleselection_border.blp
xor edx, edx
mov ecx, esi
call dword [0x100a3544]
jmp 0x1006b781
push 0
push str.UIWidgetsConsoleHumanCommandButtonhuman_multipleselection_border.blp
xor edx, edx
mov ecx, esi
call dword [0x100a3538]
jmp 0x1006b781
push 1
push 0
push 0
push 0
push str.UIWidgetsConsoleHumanCommandButtonhuman_multipleselection_border.blp
xor edx, edx
mov ecx, esi
call dword [0x100a347c]
lea eax, [ebp - 8]
mov dword [ebp - 8], 0xff000000
push eax
xor edx, edx
mov ecx, esi
call dword [0x100a3548]
mov ebx, dword [ebp - 0x20]
mov ecx, ebx
push 0xffffffffffffffff
call fcn.1006c4a0
movss xmm2, dword [0x10097318]
mov ecx, ebx
push 0
push str.Fontsdffn_b31.ttf
call fcn.1006c880
mov edx, dword [0x100a34cc]
mov ecx, dword [0x100a34bc]
test esi, esi
je 0x1006b7e1
mov eax, dword [esi]
mov eax, dword [eax + 0x1c]
test eax, eax
je 0x1006b7e1
cmp eax, edx
je 0x1006b7e3
cmp eax, ecx
je 0x1006b7e3
add esi, 0xb4
jmp 0x1006b7e3
xor esi, esi
test ebx, ebx
je 0x1006b82b
mov eax, dword [ebx]
mov eax, dword [eax + 0x1c]
test eax, eax
je 0x1006b82b
cmp eax, edx
je 0x1006b7fe
cmp eax, ecx
je 0x1006b7fe
add ebx, 0xb4
test ebx, ebx
je 0x1006b82b
test esi, esi
je 0x1006b82b
push 1
mov dword [ebp - 0x20], 0
xor edx, edx
push dword [ebp - 0x20]
mov dword [ebp - 8], 0
mov ecx, ebx
push dword [ebp - 8]
push 4
push esi
push 4
call dword [0x100a34c8]
mov ecx, dword [ebp - 0x14]
call dword [0x100a3510]
mov ecx, dword [0x100a30cc]
pop edi
pop esi
cmp ecx, dword [0x100a30d0]
je 0x1006b852
mov eax, dword [ebp - 0x14]
mov dword [ecx], eax
add dword [0x100a30cc], 4
jmp 0x1006b85c
lea eax, [ebp - 0x14]
push eax
push ecx
call fcn.1006bd80
lea eax, [ebp - 0x14]
push eax
call fcn.1006b880
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
mov byte [eax], 1
mov eax, dword [ebp - 0x14]
call fcn.100828aa
mov esp, ebp
pop ebp
ret