Function at 0x10006c30
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
mov eax, dword [0x10056cc0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1005b3d2], 0
jne 0x1000789f
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push edi
lea esp, [esp]
push str.d3d9.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x64
mov edi, eax
call esi
test edi, edi
je 0x10006c60
push 0x9c
lea eax, [ebp - 0xac]
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea esi, [ebp - 0xac]
mov dword [ebp - 0xac], 0x9c
call fcn.100010a0
push 0x1c
lea ecx, [ebp - 0xcc]
push ecx
add edi, 0x1000
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
call fcn.100010a0
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 1
jne 0x10006f70
cmp dword [ebp - 0xa8], 5
jne 0x10006f70
mov eax, dword [ebp - 0xa4]
cmp eax, 1
je 0x10006ceb
cmp eax, 2
jne 0x10006f70
mov esi, dword [ebp - 0xc0]
mov edx, dword [ebp - 0xcc]
push 0
push 0
push str.x____xxx
push 0x1004a950
push esi
push edx
call fcn.10007a50
push 0
push 0
push str.x____xxx
mov ebx, eax
push 0x1004a950
lea eax, [ebx + 1]
push esi
push eax
mov dword [0x1005b2e0], ebx
call fcn.10007a50
push 0
push 0
push str.x____xxx
push 0x1004a950
mov dword [0x1005b2f4], eax
inc eax
push esi
push eax
call fcn.10007a50
mov ecx, dword [ebp - 0xcc]
add esp, 0x48
push 0
push 0
push str.x____xxx
push 0x1004a95c
push esi
push ecx
mov dword [0x1005b308], eax
call fcn.10007a50
mov edx, dword [ebp - 0xcc]
push 0
push 0
push str.x____xxx
push 0x1004a968
push esi
push edx
mov dword [0x1005b31c], eax
call fcn.10007a50
push 0
push 0
push str.x____xxx
push 0x1004a974
mov dword [0x1005b330], eax
mov eax, dword [ebp - 0xcc]
push esi
push eax
call fcn.10007a50
add esp, 0x48
lea edx, [ebp - 0xb0]
push edx
mov dword [0x1005b344], eax
mov ecx, dword [ebx + 1]
push 0x40
lea esi, [ecx + ebx + 5]
push 5
add ebx, 5
push esi
mov dword [0x1005b2e4], esi
mov dword [0x1005b2f0], ebx
call edi
mov edx, dword [ebp - 0xb0]
lea ecx, [ebp - 0xb0]
push ecx
push edx
mov eax, 0x10002e80
sub eax, esi
push 5
sub eax, 5
push esi
mov byte [esi], 0xe9
mov dword [esi + 1], eax
call edi
mov eax, dword [0x1005b2f4]
mov ecx, dword [eax + 1]
lea edx, [ebp - 0xb0]
push edx
push 0x40
lea esi, [ecx + eax + 5]
push 5
add eax, 5
push esi
mov dword [0x1005b2f8], esi
mov dword [0x1005b304], eax
call edi
mov edx, dword [ebp - 0xb0]
lea ecx, [ebp - 0xb0]
push ecx
push edx
mov eax, 0x10002e90
sub eax, esi
push 5
sub eax, 5
push esi
mov byte [esi], 0xe9
mov dword [esi + 1], eax
call edi
mov eax, dword [0x1005b308]
mov ecx, dword [eax + 1]
lea edx, [ebp - 0xb0]
push edx
push 0x40
lea esi, [ecx + eax + 5]
push 5
add eax, 5
push esi
mov dword [0x1005b30c], esi
mov dword [0x1005b318], eax
call edi
mov edx, dword [ebp - 0xb0]
lea ecx, [ebp - 0xb0]
push ecx
push edx
mov eax, 0x10002ea0
sub eax, esi
push 5
sub eax, 5
push esi
mov byte [esi], 0xe9
mov dword [esi + 1], eax
call edi
mov eax, dword [0x1005b31c]
mov ecx, dword [eax + 1]
lea edx, [ebp - 0xb0]
push edx
push 0x40
lea esi, [ecx + eax + 5]
push 5
add eax, 5
push esi
mov dword [0x1005b320], esi
mov dword [0x1005b32c], eax
call edi
mov edx, dword [ebp - 0xb0]
lea ecx, [ebp - 0xb0]
push ecx
push edx
mov eax, 0x10002e30
sub eax, esi
push 5
sub eax, 5
push esi
mov byte [esi], 0xe9
mov dword [esi + 1], eax
call edi
mov eax, dword [0x1005b330]
mov ecx, dword [eax + 1]
lea esi, [ecx + eax + 5]
lea edx, [ebp - 0xb0]
add eax, 5
push edx
mov dword [0x1005b334], esi
mov dword [0x1005b340], eax
push 0x40
push 5
push esi
call edi
mov edx, dword [ebp - 0xb0]
lea ecx, [ebp - 0xb0]
push ecx
push edx
mov eax, 0x10002e70
sub eax, esi
push 5
sub eax, 5
push esi
mov byte [esi], 0xe9
mov dword [esi + 1], eax
call edi
mov eax, dword [0x1005b344]
mov ecx, dword [eax + 1]
lea edx, [ebp - 0xb0]
push edx
push 0x40
lea esi, [ecx + eax + 5]
push 5
add eax, 5
push esi
mov dword [0x1005b348], esi
mov dword [0x1005b354], eax
call edi
mov edx, dword [ebp - 0xb0]
lea ecx, [ebp - 0xb0]
push ecx
push edx
mov eax, 0x10002e60
sub eax, esi
push 5
sub eax, 5
push esi
mov byte [esi], 0xe9
mov dword [esi + 1], eax
call edi
lea esi, [ebp - 0xac]
call fcn.100010a0
cmp eax, 1
jne 0x10007229
cmp dword [ebp - 0xa8], 6
jne 0x10007229
mov eax, dword [ebp - 0xa4]
test eax, eax
je 0x10006fa4
cmp eax, 1
jne 0x10007229
mov esi, dword [ebp - 0xc0]
mov eax, dword [ebp - 0xcc]
push 0
push 0
push str.x____xxx
push 0x1004a950
push esi
push eax
call fcn.10007a50
push 0
push 0
push str.x____xxx
mov ebx, eax
push 0x1004a950
lea ecx, [ebx + 1]
push esi
push ecx
mov dword [0x1005b2e0], ebx
call fcn.10007a50
push 0
push 0
push str.x____xxx
push 0x1004a950
mov dword [0x1005b2f4], eax
inc eax
push esi
push eax
call fcn.10007a50
mov edx, dword [ebp - 0xcc]
add esp, 0x48
push 0
push 0
push str.x____xxx
push 0x1004a974
push esi
push edx
mov dword [0x1005b308], eax
call fcn.10007a50
push 0
push 0
push str.x____xxx
push 0x1004a980
mov dword [0x1005b344], eax
mov eax, dword [ebp - 0xcc]
push esi
push eax
call fcn.10007a50
mov ecx, dword [ebp - 0xcc]
push 0
push 0
push str.x____xx
push 0x1004a994
push esi
push ecx
mov dword [0x1005b31c], eax
call fcn.10007a50
add esp, 0x48
mov dword [0x1005b330], eax
mov edx, dword [ebx + 1]
lea eax, [ebp - 0xb0]
push eax
push 0x40
lea esi, [edx + ebx + 5]
push 5
add ebx, 5
push esi
mov dword [0x1005b2e4], esi
mov dword [0x1005b2f0], ebx
call edi
mov eax, dword [ebp - 0xb0]
lea edx, [ebp - 0xb0]
push edx
push eax
mov ecx, 0x10002e80
sub ecx, esi
push 5
sub ecx, 5
push esi
mov byte [esi], 0xe9
mov dword [esi + 1], ecx
call edi
mov eax, dword [0x1005b2f4]
mov ecx, dword [eax + 1]
lea edx, [ebp - 0xb0]
push edx
push 0x40
lea esi, [ecx + eax + 5]
push 5
add eax, 5
push esi
mov dword [0x1005b2f8], esi
mov dword [0x1005b304], eax
call edi
mov edx, dword [ebp - 0xb0]
lea ecx, [ebp - 0xb0]
push ecx
push edx
mov eax, 0x10002e90
sub eax, esi
push 5
sub eax, 5
push esi
mov byte [esi], 0xe9
mov dword [esi + 1], eax
call edi
mov eax, dword [0x1005b308]
mov ecx, dword [eax + 1]
lea edx, [ebp - 0xb0]
push edx
push 0x40
lea esi, [ecx + eax + 5]
push 5
add eax, 5
push esi
mov dword [0x1005b30c], esi
mov dword [0x1005b318], eax
call edi
mov edx, dword [ebp - 0xb0]
lea ecx, [ebp - 0xb0]
push ecx
push edx
mov eax, 0x10002ea0
sub eax, esi
push 5
sub eax, 5
push esi
mov byte [esi], 0xe9
mov dword [esi + 1], eax
call edi
mov eax, dword [0x1005b344]
mov ecx, dword [eax + 1]
lea edx, [ebp - 0xb0]
push edx
push 0x40
lea esi, [ecx + eax + 5]
push 5
add eax, 5
push esi
mov dword [0x1005b348], esi
mov dword [0x1005b354], eax
call edi
mov edx, dword [ebp - 0xb0]
lea ecx, [ebp - 0xb0]
push ecx
push edx
mov eax, 0x10002e60
sub eax, esi
push 5
sub eax, 5
push esi
mov byte [esi], 0xe9
mov dword [esi + 1], eax
call edi
mov eax, dword [0x1005b31c]
mov ecx, dword [eax + 1]
lea esi, [ecx + eax + 5]
lea edx, [ebp - 0xb0]
add eax, 5
push edx
mov dword [0x1005b320], esi
mov dword [0x1005b32c], eax
push 0x40
push 5
push esi
call edi
mov edx, dword [ebp - 0xb0]
lea ecx, [ebp - 0xb0]
push ecx
push edx
mov eax, 0x10002e30
sub eax, esi
push 5
sub eax, 5
push esi
mov byte [esi], 0xe9
mov dword [esi + 1], eax
call edi
mov eax, dword [0x1005b330]
mov ecx, dword [eax + 1]
lea edx, [ebp - 0xb0]
push edx
push 0x40
lea esi, [ecx + eax + 5]
push 5
add eax, 5
push esi
mov dword [0x1005b334], esi
mov dword [0x1005b340], eax
call edi
mov edx, dword [ebp - 0xb0]
lea ecx, [ebp - 0xb0]
push ecx
push edx
mov eax, 0x10002e70
sub eax, esi
push 5
sub eax, 5
push esi
mov byte [esi], 0xe9
mov dword [esi + 1], eax
call edi
lea esi, [ebp - 0xac]
call fcn.100010a0
cmp eax, 1
jne 0x100075b8
cmp dword [ebp - 0xa8], 6
jne 0x100075b8
cmp dword [ebp - 0xa4], 3
jne 0x100075b8
cmp dword [0x1005b2e0], 0
mov esi, dword [ebp - 0xc0]
jne 0x10007289
mov eax, dword [ebp - 0xcc]
push 0
push 0
push str.x____xxx
push 0x1004a5d8
push esi
push eax
call fcn.10007a50
add esp, 0x18
mov dword [0x1005b2e0], eax
mov ebx, dword [0x1005b2f4]
test ebx, ebx
jne 0x100072b8
mov ecx, dword [0x1005b2e0]
push ebx
push ebx
push str.x____xxx
push 0x1004a5d8
inc ecx
push esi
push ecx
call fcn.10007a50
mov ebx, eax
add esp, 0x18
mov dword [0x1005b2f4], ebx
cmp dword [0x1005b308], 0
jne 0x100072e1
push 0
push 0
push str.x____xxx
push 0x1004a5d8
lea edx, [ebx + 1]
push esi
push edx
call fcn.10007a50
add esp, 0x18
mov dword [0x1005b308], eax
cmp dword [0x1005b31c], 0
jne 0x1000730d
mov eax, dword [ebp - 0xcc]
push 0
push 0
push str.x____xx
push 0x1004a99c
push esi
push eax
call fcn.10007a50
add esp, 0x18
mov dword [0x1005b31c], eax
mov eax, dword [0x1005b330]
test eax, eax
jne 0x100073d3
mov ecx, dword [ebp - 0xcc]
push eax
push eax
push str.x____xxx
push 0x1004a9a4
push esi
push ecx
call fcn.10007a50
add esp, 0x18
mov dword [0x1005b330], eax
test eax, eax
jne 0x100073d3
mov edx, dword [ebp - 0xcc]
push eax
push eax
push str.x____xxx
push 0x1004a9b0
push esi
push edx
call fcn.10007a50
add esp, 0x18
mov dword [0x1005b330], eax
test eax, eax
jne 0x100073d3
push eax
push eax
mov eax, dword [ebp - 0xcc]
push str.x____xxxx
push 0x1004a9c8
push esi
push eax
call fcn.10007a50
add esp, 0x18
mov dword [0x1005b330], eax
test eax, eax
jne 0x100073d3
mov ecx, dword [ebp - 0xcc]
push eax
push eax
push str.x____xxx
push 0x1004a9d4
push esi
push ecx
call fcn.10007a50
add esp, 0x18
mov dword [0x1005b330], eax
test eax, eax
jne 0x100073d3
mov edx, dword [ebp - 0xcc]
push eax
push eax
push str.x____xxx
push 0x1004a95c
push esi
push edx
call fcn.10007a50
add esp, 0x18
mov dword [0x1005b330], eax
cmp dword [0x1005b344], 0
jne 0x100073fa
push 0
push 0
push str.x____xxx
push 0x1004a9a4
inc eax
push esi
push eax
call fcn.10007a50
add esp, 0x18
mov dword [0x1005b344], eax
mov eax, dword [0x1005b2e0]
mov ecx, dword [eax + 1]
lea edx, [ecx + eax + 5]
add eax, 7
mov dword [0x1005b2f0], eax
mov dword [0x1005b2e4], edx
xor ecx, ecx
mov dword [0x1005b2e8], ecx
mov eax, dword [ebx + 1]
lea edx, [eax + ebx + 5]
mov eax, dword [0x1005b308]
mov dword [0x1005b2f8], edx
mov dword [0x1005b2fc], ecx
add ebx, 7
mov dword [0x1005b304], ebx
mov edx, dword [eax + 1]
lea edx, [edx + eax + 5]
add eax, 7
mov dword [0x1005b30c], edx
mov dword [0x1005b318], eax
mov eax, dword [0x1005b31c]
lea edx, [ebp - 0xb0]
push edx
mov dword [0x1005b310], ecx
mov ecx, dword [eax + 1]
push 0x40
lea esi, [ecx + eax + 5]
push 5
add eax, 5
push esi
mov dword [0x1005b320], esi
mov dword [0x1005b32c], eax
call edi
mov edx, dword [ebp - 0xb0]
lea ecx, [ebp - 0xb0]
push ecx
push edx
mov eax, 0x10002e30
sub eax, esi
push 5
sub eax, 5
push esi
mov byte [esi], 0xe9
mov dword [esi + 1], eax
call edi
mov eax, dword [0x1005b330]
mov ecx, dword [eax + 1]
lea edx, [ebp - 0xb0]
push edx
push 0x40
lea esi, [ecx + eax + 5]
push 5
add eax, 5
push esi
mov dword [0x1005b334], esi
mov dword [0x1005b340], eax
call edi
mov edx, dword [ebp - 0xb0]
lea ecx, [ebp - 0xb0]
push ecx
push edx
mov eax, 0x10002e70
sub eax, esi
push 5
sub eax, 5
push esi
mov byte [esi], 0xe9
mov dword [esi + 1], eax
call edi
mov eax, dword [0x1005b344]
mov ecx, dword [eax + 1]
lea edx, [ebp - 0xb0]
push edx
push 0x40
lea esi, [ecx + eax + 5]
push 5
add eax, 5
push esi
mov dword [0x1005b348], esi
mov dword [0x1005b354], eax
call edi
mov edx, dword [ebp - 0xb0]
lea ecx, [ebp - 0xb0]
push ecx
push edx
mov eax, 0x10002e60
sub eax, esi
push 5
sub eax, 5
push esi
mov byte [esi], 0xe9
mov dword [esi + 1], eax
call edi
mov esi, dword [0x1005b2e4]
test esi, esi
je 0x100075b8
mov eax, dword [0x1005b2e0]
cmp byte [eax + 0xd], 0x7d
jne 0x1000757e
mov eax, 0x10002dd0
call fcn.100011f0
mov esi, dword [0x1005b2f8]
mov eax, 0x10002de0
call fcn.100011f0
mov esi, dword [0x1005b30c]
mov eax, 0x10002df0
call fcn.100011f0
mov esi, dword [0x1005b2e4]
test esi, esi
je 0x100075b8
mov ecx, dword [0x1005b2e0]
cmp byte [ecx + 0xd], 0x75
jne 0x100075b8
mov eax, 0x10002e00
call fcn.100011f0
mov esi, dword [0x1005b2f8]
mov eax, 0x10002e10
call fcn.100011f0
mov esi, dword [0x1005b30c]
mov eax, 0x10002e20
call fcn.100011f0
lea esi, [ebp - 0xac]
call fcn.100010a0
cmp eax, 1
jne 0x10007895
cmp dword [ebp - 0xa8], 0xa
jne 0x10007895
mov eax, dword [ebp - 0xa4]
test eax, eax
je 0x100075ec
cmp eax, 1
jne 0x10007895
cmp dword [0x1005b2e0], 0
mov esi, dword [ebp - 0xc0]
mov edi, dword [ebp - 0xcc]
jne 0x1000761e
push 0
push 0
push str.x____xxx
push 0x1004a5d8
push esi
push edi
call fcn.10007a50
add esp, 0x18
mov dword [0x1005b2e0], eax
mov ebx, dword [0x1005b2f4]
test ebx, ebx
jne 0x1000764d
mov edx, dword [0x1005b2e0]
push ebx
push ebx
push str.x____xxx
push 0x1004a5d8
inc edx
push esi
push edx
call fcn.10007a50
mov ebx, eax
add esp, 0x18
mov dword [0x1005b2f4], ebx
cmp dword [0x1005b308], 0
jne 0x10007676
push 0
push 0
push str.x____xxx
push 0x1004a5d8
lea eax, [ebx + 1]
push esi
push eax
call fcn.10007a50
add esp, 0x18
mov dword [0x1005b308], eax
cmp dword [0x1005b344], 0
jne 0x1000769c
push 0
push 0
push str.x____xx
push 0x1004a99c
push esi
push edi
call fcn.10007a50
add esp, 0x18
mov dword [0x1005b344], eax
cmp dword [0x1005b31c], 0
jne 0x100076c9
mov ecx, dword [0x1005b344]
push 0
push 0
push str.x____xx
push 0x1004a99c
inc ecx
push esi
push ecx
call fcn.10007a50
add esp, 0x18
mov dword [0x1005b31c], eax
mov eax, dword [0x1005b330]
test eax, eax
jne 0x1000774a
push eax
push eax
push str.x____xxx
push 0x1004a9b0
push esi
push edi
call fcn.10007a50
add esp, 0x18
mov dword [0x1005b330], eax
test eax, eax
jne 0x1000774a
push eax
push eax
push str.x____xxxx
push 0x1004a9c8
push esi
push edi
call fcn.10007a50
add esp, 0x18
mov dword [0x1005b330], eax
test eax, eax
jne 0x1000774a
push eax
push eax
push str.x____xxx
push 0x1004a9d4
push esi
push edi
call fcn.10007a50
add esp, 0x18
mov dword [0x1005b330], eax
test eax, eax
jne 0x1000774a
push eax
push eax
push str.x____xxx
push 0x1004a95c
push esi
push edi
call fcn.10007a50
add esp, 0x18
mov dword [0x1005b330], eax
mov ecx, dword [0x1005b2e0]
test ecx, ecx
je 0x100077a8
mov edx, dword [ecx + 1]
lea eax, [edx + ecx + 5]
mov dword [0x1005b2e4], eax
mov ecx, 0x17fe1cbb
lea eax, [ebp - 0x10]
call fcn.1000a100
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, dword [0x1005b2e0]
mov esi, dword [0x1005b2e4]
add eax, 0x7d812
mov dword [0x1005b2e8], eax
add ecx, 7
mov eax, 0x10002e40
mov dword [0x1005b2f0], ecx
call fcn.100011f0
mov eax, dword [0x1005b330]
mov ebx, dword [0x1005b2f4]
test ebx, ebx
je 0x100077db
mov edx, dword [ebx + 1]
lea esi, [edx + ebx + 5]
add ebx, 7
mov eax, 0x10002e10
mov dword [0x1005b2f8], esi
mov dword [0x1005b2fc], 0
mov dword [0x1005b304], ebx
call fcn.100011f0
mov eax, dword [0x1005b330]
mov ecx, dword [0x1005b308]
test ecx, ecx
je 0x10007814
mov eax, dword [ecx + 1]
lea esi, [eax + ecx + 5]
add ecx, 7
mov eax, 0x10002e50
mov dword [0x1005b30c], esi
mov dword [0x1005b310], 0
mov dword [0x1005b318], ecx
call fcn.100011f0
mov eax, dword [0x1005b330]
mov ecx, dword [0x1005b344]
test ecx, ecx
je 0x10007843
mov edx, dword [ecx + 1]
lea esi, [edx + ecx + 5]
add ecx, 5
mov eax, 0x10002e60
mov dword [0x1005b348], esi
mov dword [0x1005b354], ecx
call fcn.100011f0
mov eax, dword [0x1005b330]
mov ecx, dword [0x1005b31c]
test ecx, ecx
je 0x10007872
mov eax, dword [ecx + 1]
lea esi, [eax + ecx + 5]
add ecx, 5
mov eax, 0x10002e30
mov dword [0x1005b320], esi
mov dword [0x1005b32c], ecx
call fcn.100011f0
mov eax, dword [0x1005b330]
test eax, eax
je 0x10007895
mov ecx, dword [eax + 1]
lea esi, [ecx + eax + 5]
add eax, 5
mov dword [0x1005b340], eax
mov eax, 0x10002e70
mov dword [0x1005b334], esi
call fcn.100011f0
pop edi
pop esi
mov byte [0x1005b3d2], 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003880a
mov esp, ebp
pop ebp
ret