Function at 0x10004690
Capabilities:
Allocate or change rwx memory
Check for software breakpoints
Execute shellcode via indirect call
Hook routines via microsoft detours

Disassembly:
sub esp, 0xa8
mov eax, dword [0x10023040]
xor eax, esp
mov dword [esp + 0xa4], eax
push ebx
push ebp
push esi
push edi
mov edi, edx
mov ebx, ecx
xor esi, esi
mov dword [esp + 0x38], ebx
test edi, edi
jne 0x100046be
lea eax, [edx + 0x57]
jmp 0x10004ac5
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x1002495c], eax
je 0x100046d6
mov eax, 0x10dd
jmp 0x10004ac5
mov eax, dword [0x10024960]
test eax, eax
jne 0x10004ac5
test ebx, ebx
je 0x100046fd
mov ecx, dword [ebx]
test ecx, ecx
jne 0x10004707
mov dword [0x10024960], 6
mov dword [0x10024954], ebx
mov eax, 6
jmp 0x10004ac5
xor eax, eax
xor ebx, ebx
mov dword [esp + 0x24], eax
call fcn.10004140
mov ebp, eax
mov ecx, edi
mov dword [esp + 0x1c], ebp
call fcn.10004140
mov dword [esp + 0x2c], eax
cmp eax, ebp
jne 0x1000473a
cmp dword [0x10024944], ebx
jne 0x10004aba
jmp 0x10004ae7
push 0x18
call fcn.10005827
add esp, 4
mov dword [esp + 0x24], eax
lea eax, [esp + 0x28]
mov ecx, ebp
lea edx, [esp + 0x20]
push eax
call fcn.10003d00
mov ecx, dword [0x10024958]
add esp, 4
mov edi, dword [esp + 0x28]
mov ebp, dword [esp + 0x20]
mov eax, dword [0x10024950]
test ecx, ecx
jne 0x1000477e
test eax, eax
je 0x10004791
mov ecx, eax
mov dword [0x10024958], ecx
mov edx, dword [ecx + 8]
test edx, edx
je 0x10004791
cmp edx, ebp
jb 0x10004791
cmp edx, edi
jbe 0x10004818
mov ecx, eax
mov dword [0x10024958], ecx
test eax, eax
je 0x100047bf
mov edx, eax
mov eax, dword [edx + 8]
test eax, eax
je 0x100047ae
cmp eax, ebp
jb 0x100047ae
cmp eax, edi
jbe 0x10004818
mov ecx, dword [ecx + 4]
mov eax, ecx
mov dword [0x10024958], ecx
mov edx, ecx
test eax, eax
jne 0x1000479f
mov ecx, dword [esp + 0x1c]
mov edx, ebp
push edi
and ecx, 0xffff0000
call fcn.10003f80
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x10004ae0
mov dword [ecx], 0x52727464
xor edx, edx
mov dword [ecx + 8], ebx
mov esi, 0x38b
mov eax, dword [0x10024950]
mov dword [ecx + 4], eax
lea eax, [ecx + 0xffa8]
mov dword [0x10024958], ecx
mov dword [0x10024950], ecx
mov dword [eax + 0x40], edx
mov edx, eax
sub eax, 0x48
sub esi, 1
jne 0x10004808
mov dword [ecx + 8], edx
mov ebx, dword [ecx + 8]
cmp ebx, ebp
jb 0x10004ae0
cmp ebx, edi
ja 0x10004ae0
mov eax, dword [ebx + 0x40]
push 0x48
push 0xcc
push ebx
mov dword [ecx + 8], eax
call fcn.10006a00
add esp, 0xc
test ebx, ebx
je 0x10004ae2
mov ebp, dword [esp + 0x1c]
lea eax, [ebx + 0x38]
xorps xmm0, xmm0
mov dword [esp + 0x28], eax
movq qword [eax], xmm0
mov edx, ebx
lea eax, [ebx + 0x1e]
mov dword [esp + 0x20], edx
mov esi, ebp
mov dword [esp + 0x3c], eax
mov dword [esp + 0x1c], 0
mov byte [esp + 0x17], bl
mov dword [esp + 0x18], ebx
nop word [eax + eax]
lea eax, [esp + 0x6c]
mov dword [esp + 0x50], 0
test edx, edx
mov dword [esp + 0x60], eax
lea ecx, [esp + 0x70]
mov dword [esp + 0x54], 0
xorps xmm0, xmm0
mov dword [esp + 0x58], 0
lea eax, [esp + 0x30]
mov dword [esp + 0x6c], 0
cmovne ecx, edx
mov dword [esp + 0x64], eax
mov dword [esp + 0x30], 0
mov edi, esi
movups xmmword [esp + 0x40], xmm0
test esi, esi
jne 0x100048d9
push 0xd
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x100048f5
movzx eax, byte [esi]
mov edx, dword [eax*8 + 0x10025824]
lea eax, [eax*8 + 0x10025820]
push esi
push ecx
push eax
lea ecx, [esp + 0x4c]
call edx
mov esi, eax
mov edx, dword [esp + 0x20]
mov eax, esi
sub eax, edi
mov ebx, esi
add eax, dword [esp + 0x30]
sub ebx, ebp
add edx, eax
mov al, bl
mov cl, dl
mov dword [esp + 0x20], edx
sub cl, byte [esp + 0x17]
and al, 7
shl cl, 3
or cl, al
mov eax, dword [esp + 0x28]
mov byte [eax], cl
inc eax
mov ecx, dword [esp + 0x1c]
inc ecx
mov dword [esp + 0x28], eax
mov dword [esp + 0x1c], ecx
cmp ecx, 8
jae 0x10004988
mov al, byte [edi]
cmp al, 0xeb
je 0x10004988
cmp al, 0xe9
je 0x10004988
cmp al, 0xe0
je 0x10004988
cmp al, 0xc2
je 0x10004988
cmp al, 0xc3
je 0x10004988
cmp al, 0xcc
je 0x10004988
cmp al, 0xf3
jne 0x100049f1
cmp byte [edi + 1], 0xc3
je 0x10004988
cmp al, 0x26
je 0x10004973
cmp al, 0x2e
je 0x10004973
cmp al, 0x36
je 0x10004973
cmp al, 0x3e
je 0x10004973
cmp al, 0x64
je 0x10004973
cmp al, 0x65
jne 0x1000497f
cmp byte [edi + 1], 0xff
jne 0x1000497f
cmp byte [edi + 2], 0x25
je 0x10004988
cmp ebx, 5
jb 0x10004880
cmp ebx, 5
jae 0x100049b2
nop dword [eax]
mov ecx, esi
call fcn.10003d90
test eax, eax
je 0x10004a8e
add esi, eax
mov ebx, esi
sub ebx, ebp
cmp ebx, 5
jb 0x10004990
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
cmp ecx, 8
ja 0x10004a8e
mov edi, dword [esp + 0x3c]
cmp edx, edi
jbe 0x100049c4
int3
mov eax, dword [esp + 0x18]
sub dl, al
push ebx
push ebp
mov byte [eax + 0x1e], dl
mov byte [eax + 0x36], bl
add eax, 0x20
push eax
call fcn.10007ef0
add esp, 0xc
cmp ebx, 0x19
jbe 0x10004a02
mov ebx, dword [esp + 0x18]
mov esi, 6
jmp 0x10004ae7
cmp al, 0xff
jne 0x1000495b
cmp byte [edi + 1], 0x25
jmp 0x1000497d
mov eax, dword [esp + 0x18]
lea esi, [ebx + ebp]
mov ecx, dword [esp + 0x2c]
mov edx, edi
mov dword [eax + 0x44], ecx
movzx ecx, byte [eax + 0x1e]
add ecx, eax
mov dword [eax + 0x40], esi
lea eax, [ecx + 5]
mov byte [ecx], 0xe9
sub esi, eax
mov dword [ecx + 1], esi
add ecx, 5
call fcn.10003cd0
lea eax, [esp + 0x34]
mov dword [esp + 0x34], 0
push eax
push 0x40
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10004a5a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [esp + 0x18]
mov esi, eax
jmp 0x10004ae7
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x38]
mov dword [ecx + 8], eax
mov eax, dword [esp + 0x18]
mov dword [ecx + 0x10], eax
mov dword [ecx + 4], 0
mov dword [ecx + 0xc], ebp
mov eax, dword [esp + 0x34]
mov dword [ecx + 0x14], eax
mov eax, dword [0x10024940]
mov dword [ecx], eax
xor eax, eax
mov dword [0x10024940], ecx
jmp 0x10004ac5
cmp dword [0x10024944], 0
mov esi, 9
mov ebx, dword [esp + 0x18]
je 0x10004ae7
mov edi, dword [esp + 0x24]
mov ecx, ebx
call fcn.10004110
test edi, edi
je 0x10004aba
push 0x18
push edi
call fcn.100054fa
add esp, 8
mov eax, dword [esp + 0x38]
mov dword [0x10024954], eax
mov eax, esi
mov ecx, dword [esp + 0xb4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100054ec
add esp, 0xa8
ret 0xc
xor ebx, ebx
mov esi, 8
mov edi, dword [esp + 0x24]
mov dword [0x10024960], esi
test ebx, ebx
je 0x10004aab
jmp 0x10004aa4