Function at 0x10006710
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1004a434]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [0x10081438]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10081f18]
cmp eax, dword [ecx + 4]
jle 0x10006773
push 0x10081f18
call fcn.10014ed2
add esp, 4
cmp dword [0x10081f18], 0xffffffff
jne 0x10006773
push 0x10035720
mov dword [0x10081f30], 0x10043494
call fcn.10014d54
push 0x10081f18
call fcn.10014e88
add esp, 8
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x44e1fc
mov dword [ebp - 8], 0
call esi
test eax, eax
je 0x100067ae
lea eax, [ebp - 8]
mov dword [0x44e1fc], 0x10083320
push eax
push dword [ebp - 8]
push 4
push 0x44e1fc
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 4
push 0x47de47
call esi
test eax, eax
je 0x100067e2
lea eax, [ebp - 8]
mov dword [0x47de47], 0x10083320
push eax
push dword [ebp - 8]
push 4
push 0x47de47
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 4
push 0x546b6f
call esi
test eax, eax
je 0x10006816
lea eax, [ebp - 8]
mov dword [0x546b6f], 0x10083320
push eax
push dword [ebp - 8]
push 4
push 0x546b6f
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 1
push 0x44e1ec
call esi
test eax, eax
je 0x10006847
lea eax, [ebp - 8]
mov byte [0x44e1ec], 0x32
push eax
push dword [ebp - 8]
push 1
push 0x44e1ec
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 1
push 0x546b64
call esi
test eax, eax
je 0x10006878
lea eax, [ebp - 8]
mov byte [0x546b64], 0x32
push eax
push dword [ebp - 8]
push 1
push 0x546b64
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 1
push 0x47da39
call esi
test eax, eax
je 0x100068a9
lea eax, [ebp - 8]
mov byte [0x47da39], 0x32
push eax
push dword [ebp - 8]
push 1
push 0x47da39
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 1
push 0x4b8be4
call esi
test eax, eax
je 0x100068da
lea eax, [ebp - 8]
mov byte [0x4b8be4], 0xeb
push eax
push dword [ebp - 8]
push 1
push 0x4b8be4
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 1
push 0x4be4ee
call esi
test eax, eax
je 0x1000690b
lea eax, [ebp - 8]
mov byte [0x4be4ee], 0xeb
push eax
push dword [ebp - 8]
push 1
push 0x4be4ee
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 1
push 0x4ba5b2
call esi
test eax, eax
je 0x1000693c
lea eax, [ebp - 8]
mov byte [0x4ba5b2], 0xeb
push eax
push dword [ebp - 8]
push 1
push 0x4ba5b2
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 4
push 0x4c42a2
call esi
test eax, eax
je 0x10006970
lea eax, [ebp - 8]
mov dword [0x4c42a2], 0x3e8
push eax
push dword [ebp - 8]
push 4
push 0x4c42a2
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 4
push 0x4c453d
call esi
test eax, eax
je 0x100069a4
lea eax, [ebp - 8]
mov dword [0x4c453d], 0x3e8
push eax
push dword [ebp - 8]
push 4
push 0x4c453d
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 4
push 0x4383c1
call esi
test eax, eax
je 0x100069d8
lea eax, [ebp - 8]
mov dword [0x4383c1], 0x428c0000
push eax
push dword [ebp - 8]
push 4
push 0x4383c1
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 4
push 0x4383c6
call esi
test eax, eax
je 0x10006a0c
lea eax, [ebp - 8]
mov dword [0x4383c6], 0x428c0000
push eax
push dword [ebp - 8]
push 4
push 0x4383c6
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 4
push 0x438606
call esi
test eax, eax
je 0x10006a40
lea eax, [ebp - 8]
mov dword [0x438606], 0x428c0000
push eax
push dword [ebp - 8]
push 4
push 0x438606
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 4
push 0x43860b
call esi
test eax, eax
je 0x10006a74
lea eax, [ebp - 8]
mov dword [0x43860b], 0x428c0000
push eax
push dword [ebp - 8]
push 4
push 0x43860b
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 4
push 0x4384b4
call esi
test eax, eax
je 0x10006aa8
lea eax, [ebp - 8]
mov dword [0x4384b4], 0x441d8000
push eax
push dword [ebp - 8]
push 4
push 0x4384b4
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 4
push 0x4384c0
call esi
test eax, eax
je 0x10006adc
lea eax, [ebp - 8]
mov dword [0x4384c0], 0x442f0000
push eax
push dword [ebp - 8]
push 4
push 0x4384c0
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 4
push 0x4384cc
call esi
test eax, eax
je 0x10006b10
lea eax, [ebp - 8]
mov dword [0x4384cc], 0x44408000
push eax
push dword [ebp - 8]
push 4
push 0x4384cc
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 4
push 0x4384d8
call esi
test eax, eax
je 0x10006b44
lea eax, [ebp - 8]
mov dword [0x4384d8], 0x44520000
push eax
push dword [ebp - 8]
push 4
push 0x4384d8
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 4
push 0x4384eb
call esi
test eax, eax
je 0x10006b78
lea eax, [ebp - 8]
mov dword [0x4384eb], 0x428c0000
push eax
push dword [ebp - 8]
push 4
push 0x4384eb
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 4
push 0x4384f7
call esi
test eax, eax
je 0x10006bac
lea eax, [ebp - 8]
mov dword [0x4384f7], 0x428c0000
push eax
push dword [ebp - 8]
push 4
push 0x4384f7
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 4
push 0x4384fe
call esi
test eax, eax
je 0x10006be0
lea eax, [ebp - 8]
mov dword [0x4384fe], 0x428c0000
push eax
push dword [ebp - 8]
push 4
push 0x4384fe
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 4
push 0x43850a
call esi
test eax, eax
je 0x10006c14
lea eax, [ebp - 8]
mov dword [0x43850a], 0x430c0000
push eax
push dword [ebp - 8]
push 4
push 0x43850a
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 4
push 0x438511
call esi
test eax, eax
je 0x10006c48
lea eax, [ebp - 8]
mov dword [0x438511], 0x428c0000
push eax
push dword [ebp - 8]
push 4
push 0x438511
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 4
push 0x43851a
call esi
test eax, eax
je 0x10006c7c
lea eax, [ebp - 8]
mov dword [0x43851a], 0x43520000
push eax
push dword [ebp - 8]
push 4
push 0x43851a
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 4
push 0x438521
call esi
test eax, eax
je 0x10006cb0
lea eax, [ebp - 8]
mov dword [0x438521], 0x428c0000
push eax
push dword [ebp - 8]
push 4
push 0x438521
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 4
push 0x43852a
call esi
test eax, eax
je 0x10006ce4
lea eax, [ebp - 8]
mov dword [0x43852a], 0x438c0000
push eax
push dword [ebp - 8]
push 4
push 0x43852a
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 4
push 0x438531
call esi
test eax, eax
je 0x10006d18
lea eax, [ebp - 8]
mov dword [0x438531], 0x428c0000
push eax
push dword [ebp - 8]
push 4
push 0x438531
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 4
push 0x43853a
call esi
test eax, eax
je 0x10006d4c
lea eax, [ebp - 8]
mov dword [0x43853a], 0x43af0000
push eax
push dword [ebp - 8]
push 4
push 0x43853a
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 4
push 0x438541
call esi
test eax, eax
je 0x10006d80
lea eax, [ebp - 8]
mov dword [0x438541], 0x428c0000
push eax
push dword [ebp - 8]
push 4
push 0x438541
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 4
push 0x43854a
call esi
test eax, eax
je 0x10006db4
lea eax, [ebp - 8]
mov dword [0x43854a], 0x43d20000
push eax
push dword [ebp - 8]
push 4
push 0x43854a
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 4
push 0x438551
call esi
test eax, eax
je 0x10006de8
lea eax, [ebp - 8]
mov dword [0x438551], 0x428c0000
push eax
push dword [ebp - 8]
push 4
push 0x438551
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 4
push 0x43855a
call esi
test eax, eax
je 0x10006e1c
lea eax, [ebp - 8]
mov dword [0x43855a], 0x43f50000
push eax
push dword [ebp - 8]
push 4
push 0x43855a
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 4
push 0x438561
call esi
test eax, eax
je 0x10006e50
lea eax, [ebp - 8]
mov dword [0x438561], 0x428c0000
push eax
push dword [ebp - 8]
push 4
push 0x438561
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 4
push 0x43856a
call esi
test eax, eax
je 0x10006e84
lea eax, [ebp - 8]
mov dword [0x43856a], 0x440c0000
push eax
push dword [ebp - 8]
push 4
push 0x43856a
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 4
push 0x438571
call esi
test eax, eax
je 0x10006eb8
lea eax, [ebp - 8]
mov dword [0x438571], 0x428c0000
push eax
push dword [ebp - 8]
push 4
push 0x438571
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 4
push 0x43857a
call esi
test eax, eax
je 0x10006eec
lea eax, [ebp - 8]
mov dword [0x43857a], 0x441d8000
push eax
push dword [ebp - 8]
push 4
push 0x43857a
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 4
push 0x438581
call esi
test eax, eax
je 0x10006f20
lea eax, [ebp - 8]
mov dword [0x438581], 0x428c0000
push eax
push dword [ebp - 8]
push 4
push 0x438581
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 1
push 0x5bb744
call esi
test eax, eax
je 0x10006f51
lea eax, [ebp - 8]
mov byte [0x5bb744], 0x55
push eax
push dword [ebp - 8]
push 1
push 0x5bb744
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 0x1d
push 0x44b828
call esi
test eax, eax
je 0x10006fb4
mov eax, 0x44b828
mov dword [eax], 0x90909090
mov dword [eax + 4], 0x90909090
mov dword [eax + 8], 0x90909090
mov dword [eax + 0xc], 0x90909090
mov dword [eax + 0x10], 0x90909090
mov dword [eax + 0x14], 0x90909090
mov dword [eax + 0x18], 0x90909090
mov byte [eax + 0x1c], 0x90
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 0x1d
push 0x44b828
call esi
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.100148fc
mov esp, ebp
pop ebp
ret