Function at 0x10006730
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Log keystrokes via polling

Disassembly:
mov eax, dword [0x10220aa0]
sub esp, 0xc
push ebx
push ebp
push esi
push edi
xor ebp, ebp
push ebp
push 4
push 0x1020897c
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp byte [0x1014e013], 0
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
je 0x100067aa
mov esi, dword [0x102207d4]
lea ecx, [esp + 0x14]
push ecx
push 0x40
push 0xa
push esi
call edi
test eax, eax
je 0x100067a3
mov edx, dword [0x1010bc24]
mov dword [esi], edx
mov eax, dword [0x1010bc28]
mov dword [esi + 4], eax
mov eax, dword [esp + 0x14]
mov cx, word [0x1010bc2c]
lea edx, [esp + 0x14]
push edx
push eax
push 0xa
push esi
mov word [esi + 8], cx
call edi
mov byte [0x1014e013], 0
cmp byte [0x1012c87e], 0
je 0x100067fa
mov esi, dword [0x102207d4]
lea ecx, [esp + 0x18]
push ecx
push 0x40
push 0xa
push esi
call edi
test eax, eax
je 0x100067f3
mov edx, dword [0x1010bc30]
mov dword [esi], edx
mov eax, dword [0x1010bc34]
mov dword [esi + 4], eax
mov eax, dword [esp + 0x18]
mov cx, word [0x1010bc38]
lea edx, [esp + 0x18]
push edx
push eax
push 0xa
push esi
mov word [esi + 8], cx
call edi
mov byte [0x1012c87e], 0
mov eax, dword [0x10220a0c]
cmp dword [eax], 0x19d9d
jne 0x1000680d
mov dword [eax], 0x19999
mov ecx, dword [0x10220a04]
cmp dword [ecx], 4
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ebx, 1
jne 0x1000688a
cmp byte [0x10129d92], 0
mov byte [0x10129d9e], bl
je 0x10006869
push str.TEXTURE_hud_BeatUp
call dword [0x10132078]
add esp, 4
push 0x294
push 0x331
call dword [0x10160a7c]
add esp, 8
push 0xffffffffffffffff
call dword [0x1018271c]
push str.logo
call dword [0x10175f5c]
add esp, 4
push 0x7b
call esi
test ax, ax
je 0x1000688a
cmp byte [0x10129d92], 0
push 0x64
sete dl
mov byte [0x10129d92], dl
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x7a
call esi
mov ecx, 0x8000
and ax, cx
mov edx, ecx
cmp ax, dx
jne 0x100068df
cmp byte [0x1014e012], 0
je 0x100068e5
cmp dword [0x102204d8], 7
fldz
fstp dword [0x10129d0c]
jne 0x100068cb
mov dword [0x102204d8], ebp
call fcn.1000e580
mov byte [0x1014e012], 0
jmp 0x100068e5
add dword [0x102204d8], ebx
call fcn.1000e580
mov byte [0x1014e012], 0
jmp 0x100068e5
mov byte [0x1014e012], bl
mov eax, dword [0x10220a04]
mov eax, dword [eax]
cmp eax, 2
je 0x100068fa
cmp eax, 3
jne 0x10006b1b
cmp byte [0x10220459], 0
je 0x1000690d
push str.Please_Register_with_Administrator___nRegister_At_:_https:__www.facebook.com_InfinityPatchLatinoamerica
call fcn.1000fc30
push str.TEXTURE_hud_BeatUp
call dword [0x10132078]
add esp, 4
push 0x294
push 0x331
call dword [0x10160a7c]
add esp, 8
push 0xffffffffffffffff
call dword [0x1018271c]
push str.logo
call dword [0x10175f5c]
mov ecx, dword [0x10220a04]
mov eax, dword [ecx]
add esp, 4
cmp eax, 3
jne 0x10006b1b
mov edx, dword [0x10220a0c]
cmp dword [edx], 0x1adad
jne 0x10006969
mov byte [0x1014e013], bl
push 0x96
push ebp
push 0x10196008
mov dword [0x1020f95c], ebx
mov byte [0x10129d02], bl
call fcn.10095ce0
add esp, 0xc
push str.TEXTURE_hud_button
mov byte [0x10129d01], bl
mov byte [0x102204a2], bl
call dword [0x10132078]
add esp, 4
cmp byte [0x10220459], 0
jne 0x100069b0
call fcn.100122a0
cmp dword [0x1012cbb4], ebx
je 0x100069c0
cmp dword [0x102077c4], ebx
jne 0x100069c7
mov eax, dword [0x102209b0]
mov dword [eax], ebp
cmp byte [0x102206ce], 0
jne 0x100069e3
call fcn.1000fbe0
test al, al
jne 0x100069e3
push str.Please_Play_At_FREE_2___CANAL_1_Channel
call fcn.1000fc30
cmp dword [0x10174d30], ebx
jne 0x10006b6f
cmp byte [0x1022045a], 0
jne 0x10006adc
cmp byte [0x10220514], 0
jne 0x10006ab5
cmp byte [0x10220459], 0
jne 0x10006aa7
mov ecx, dword [0x102204d8]
mov edx, dword [0x10220ac4]
push ecx
push edx
push str.Welcome_to_XNova_Patch___
push 0x10220310
call fcn.10091b90
mov ecx, dword [0x1022073c]
add esp, 0x10
push 0x10220310
call fcn.10008360
jmp 0x10006a50
mov eax, dword [ebp + 0x1012661c]
add eax, dword [0x1020897c]
push 0x10167e20
push ebx
lea esi, [ebp + 0x10220548]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [esi], 4
jne 0x10006a94
mov edi, dword [ebp + 0x1012661c]
add edi, dword [0x1020897c]
push 0x10196f54
mov esi, ebx
call fcn.10008080
add ebp, 4
cmp ebp, 0x18
jl 0x10006a50
mov byte [0x102204a3], 0
xor ebp, ebp
jmp 0x10006adc
mov ecx, dword [0x10220ac4]
push ecx
push str.Welcome_to_XNova_Patch___
jmp 0x10006abf
push 0x10131ff0
push str.__s___Event_ASP_2015_
push 0x10220310
call fcn.10091b90
mov ecx, dword [0x1022073c]
add esp, 0xc
push 0x10220310
call fcn.10008360
xor eax, eax
mov dword [0x10220560], eax
mov dword [0x10220564], eax
mov dword [0x10220568], eax
mov dword [0x1022056c], eax
mov dword [0x10220570], eax
mov dword [0x10220574], eax
mov dword [0x102095a4], ebp
mov dword [0x10220650], ebp
mov dword [0x10174da0], ebp
mov byte [0x102204a0], al
mov dword [0x10174d30], ebp
jmp 0x10006b6f
cmp eax, 2
jne 0x10006b50
call fcn.10010c70
mov edi, dword [0x102209cc]
cmp dword [edi], 0x5dc
jne 0x10006b42
push 0x102204a4
mov esi, 4
call fcn.10008080
mov dword [0x102204d8], ebp
mov dword [0x10175f6c], ebp
jmp 0x10006b69
cmp eax, 4
jne 0x10006b6f
cmp byte [0x10220459], 0
jne 0x10006b63
call fcn.100122a0
mov byte [0x1012c87e], bl
mov dword [0x10174d30], ebx
mov edx, dword [0x102209c4]
cmp dword [edx], ebx
jne 0x10006c5e
cmp byte [0x10131f87], 0
je 0x10006c70
cmp dword [0x102204ac], ebp
je 0x10006c70
mov eax, dword [0x10220a0c]
cmp dword [eax], 0x19999
jne 0x10006ba8
call fcn.10004ab0
call fcn.10009550
test al, al
je 0x10006bf7
cmp dword [0x101646d4], ebx
jne 0x10006c70
cmp dword [0x10220454], ebp
jne 0x10006be3
cmp byte [0x10220459], 0
jne 0x10006be3
mov edi, dword [0x10220964]
push 0x10126600
mov esi, 0x10
call fcn.10008080
mov dword [0x1022069c], ebp
mov dword [0x101646d4], ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
cmp byte [0x10220459], 0
je 0x10006c09
cmp byte [0x1022045a], 0
je 0x10006c1c
call fcn.10010cc0
cmp byte [0x1022045a], 0
jne 0x10006c1c
call fcn.1000f0f0
mov ecx, dword [0x10220a0c]
cmp dword [ecx], 0x19999
jne 0x10006c2f
call fcn.1000ecb0
call fcn.1000fa30
cmp dword [0x10174da0], eax
jge 0x10006c42
add dword [0x10174da0], ebx
mov edx, dword [0x101666a4]
cmp edx, dword [0x10220650]
jge 0x10006c70
add dword [0x101666a4], ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov dword [0x101646d4], ebx
mov dword [0x102204ac], ebp
mov byte [0x101265e6], bl
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret