Function at 0x10006c60
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001f8c0
mov eax, dword fs:[0]
push eax
sub esp, 0x17c
mov eax, dword [0x1002b040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x138], eax
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x118], eax
call dword [sym.imp.CLEO.asi_Ordinal_28]
movzx ebx, byte [ebp + 0x14]
mov edi, eax
mov eax, dword [ebp - 0x118]
lea ecx, [ebx + eax]
cmp ecx, edi
je 0x100067fb
mov edx, esi
lea ecx, [ebp - 0x154]
call fcn.10005400
cmp dword [eax + 0x14], 0xf
jbe 0x100067a7
mov eax, dword [eax]
push eax
sub edi, ebx
push edi
push dword [ebp - 0x118]
push str.Declared__d_input_args__but_provided__d_in_script__s_nScript_suspended.
call fcn.10005560
mov ecx, dword [ebp - 0x140]
add esp, 0x10
cmp ecx, 0xf
jbe 0x10006afc
mov edx, dword [ebp - 0x154]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10006af2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10006bfa
jmp 0x10006af2
cmp edi, 0x20
jbe 0x10006842
mov edx, esi
lea ecx, [ebp - 0x154]
call fcn.10005400
cmp dword [eax + 0x14], 0xf
jbe 0x10006815
mov eax, dword [eax]
push eax
push 0x20
push edi
push str.Provided_more___d__than_supported___d__arguments_in_script__s_nScript_suspended.
call fcn.10005560
add esp, 0x10
lea ecx, [ebp - 0x154]
call fcn.1000ce60
mov dword [esi + 0xcc], 0xffffffff
mov al, 1
jmp 0x10006bde
lea eax, [eax*4 + 0x1002c4e0]
mov dword [ebp - 0x134], eax
xor eax, eax
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp + 0x10]
shl eax, 2
mov dword [ebp + 0x10], eax
call dword [sym.imp.CLEO.asi_Ordinal_41]
cmp dword [ebp - 0x118], 0
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x128], 0
jbe 0x100069f5
mov dword [ebp - 0x124], 0x1002caa0
mov dword [ebp - 0x114], 0x1002c4e0
mov dword [ebp - 0x120], 0
mov eax, dword [esi + 0x14]
mov bl, byte [eax]
movzx ecx, bl
mov eax, ecx
sub eax, 9
je 0x10006920
sub eax, 5
je 0x10006920
sub eax, 1
je 0x10006920
lea edi, [ecx - 0xa]
cmp edi, 9
ja case.0x100068c9.14
movzx eax, byte [edi + 0x10006c0c]
jmp dword [eax*4 + 0x10006c04]
mov eax, ecx
sub eax, 1
je case.0x100068f9.2
sub eax, 3
je case.0x100068f9.2
sub eax, 1
je case.0x100068f9.2
cmp bl, 6
je case.0x100068f9.2
add ecx, 0xfffffffe
cmp ecx, 6
ja case.0x100068f9.4
movzx eax, byte [ecx + 0x10006c20]
jmp dword [eax*4 + 0x10006c18]
push 1
push esi
call dword [sym.imp.CLEO.asi_Ordinal_9]
mov ecx, dword [ebp - 0x130]
mov eax, dword [ecx]
mov ecx, dword [ebp - 0x114]
mov dword [ecx], eax
mov eax, ecx
jmp 0x100069d3
lea edi, [ecx - 0xa]
push esi
call dword [sym.imp.CLEO.asi_Ordinal_31]
cmp eax, 0x5000000
jae case.0x1000693d.4
cmp edi, 9
ja case.0x1000693d.4
movzx eax, byte [edi + 0x10006c30]
jmp dword [eax*4 + 0x10006c28]
push esi
call dword [sym.imp.CLEO.asi_Ordinal_19]
mov ecx, dword [ebp - 0x114]
mov dword [ecx], eax
mov eax, ecx
jmp 0x100069d3
mov ebx, dword [ebp - 0x120]
cmp ebx, 0x4fb
jae 0x10006a95
push ecx
lea edx, [ebp - 0x110]
mov ecx, esi
call fcn.10005940
add esp, 4
lea edx, [ebp - 0x110]
test eax, eax
cmove edx, eax
call fcn.100058b0
test al, al
je 0x10006b22
mov edi, dword [ebp - 0x124]
mov ecx, edi
sub ecx, edx
nop dword [eax]
mov al, byte [edx]
lea edx, [edx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x100069a0
mov eax, dword [ebp - 0x114]
add ebx, 0xff
inc dword [ebp - 0x11c]
mov dword [ebp - 0x120], ebx
mov dword [eax], edi
add edi, 0xff
mov dword [ebp - 0x124], edi
mov edx, dword [ebp - 0x128]
add eax, 4
inc edx
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x128], edx
cmp edx, dword [ebp - 0x118]
jb 0x100068a1
lea ecx, [0x1002c4e0]
cmp ecx, dword [ebp - 0x134]
jae 0x10006a0a
push dword [ecx]
add ecx, 4
jmp 0x100069fb
mov ecx, dword [ebp - 0x138]
xor eax, eax
call dword [ebp - 0x13c]
mov dword [ebp - 0x12c], eax
add esp, dword [ebp + 0x10]
cmp byte [ebp + 0x14], 0
je case.0x10006bce.2
mov eax, dword [esi + 0x14]
movzx eax, byte [eax]
add eax, 0xfffffff6
cmp eax, 9
ja case.0x10006a44.14
movzx eax, byte [eax + 0x10006c44]
jmp dword [eax*4 + 0x10006c3c]
mov edx, esi
lea ecx, [ebp - 0x154]
call fcn.10005400
cmp dword [eax + 0x14], 0xf
jbe 0x10006a60
mov eax, dword [eax]
push eax
or dl, 0xff
mov cl, bl
call fcn.10004e60
push eax
push str.Invalid_param_type___s__in_script__s__nScript_suspended.
call fcn.10005560
add esp, 0xc
lea ecx, [ebp - 0x154]
call fcn.1000ce60
mov dword [esi + 0xcc], 0xffffffff
mov al, 1
jmp 0x10006bde
mov edx, esi
lea ecx, [ebp - 0x154]
call fcn.10005400
cmp dword [eax + 0x14], 0xf
jbe 0x10006aaa
mov eax, dword [eax]
push eax
mov eax, dword [ebp - 0x11c]
push 5
inc eax
push eax
push str.Provided_more___d__than_supported___d__string_arguments_in_script__s_nScript_suspended.
call fcn.10005560
mov ecx, dword [ebp - 0x140]
add esp, 0x10
cmp ecx, 0xf
jbe 0x10006afc
mov edx, dword [ebp - 0x154]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10006af2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10006bff
push ecx
push edx
call fcn.1000e3f5
add esp, 8
mov dword [esi + 0xcc], 0xffffffff
mov al, 1
jmp 0x10006bde
mov edx, dword [ebp - 0x12c]
mov ecx, esi
call fcn.10005d90
test al, al
jne case.0x10006bce.2
mov al, 1
jmp 0x10006bde
mov edx, dword [ebp - 0x12c]
mov ecx, esi
call fcn.10005770
mov al, byte [0x1002b8f0]
cmp al, 0xff
je 0x10006bb8
test al, al
sete al
test al, al
jne case.0x10006bce.2
mov edx, esi
lea ecx, [ebp - 0x184]
call fcn.10005400
mov edi, eax
mov dword [ebp - 4], 0
cmp dword [edi + 0x14], 0xf
jbe 0x10006b6a
mov edi, dword [edi]
mov dl, byte [0x1002b8f0]
mov cl, byte [0x1002c56d]
call fcn.10004e60
xor edx, edx
lea ecx, [ebp - 0x16c]
mov ebx, eax
call fcn.10005650
cmp dword [eax + 0x14], 0xf
jbe 0x10006b92
mov eax, dword [eax]
push edi
push ebx
push eax
push str.Output_argument__s_expected_to_be_variable_int__got__s_in_script__s_nScript_suspended.
call fcn.10005560
add esp, 0x10
lea ecx, [ebp - 0x16c]
call fcn.1000ce60
lea ecx, [ebp - 0x184]
jmp 0x1000682c
movzx eax, byte [0x1002c56d]
add eax, 0xfffffffe
cmp eax, 6
ja case.0x10006bce.4
movzx eax, byte [eax + 0x10006c58]
jmp dword [eax*4 + 0x10006c50]
push esi
call dword [sym.imp.CLEO.asi_Ordinal_29]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000e09d
mov esp, ebp
pop ebp
ret
call fcn.100130c1
call fcn.100130c1
and ebp, dword [ecx]
adc al, dl
push 0x1000
add byte [eax], al
add dword [ecx], eax
add byte [eax], al
add byte [eax], al
nop
add byte [ecx], ch
adc byte [ebx + 106], cl
add byte [eax], dl
add byte [eax], al
add dword [ecx], eax
add dword [eax], eax
add byte [eax + case.0x1000693d.0], dl
push edi
imul eax, dword [eax], 16
add byte [ecx], al
add dword [eax], eax
add byte [eax], al
add byte [esi - 112], ah
or eax, 688914539
imul eax, dword [eax], 16
add byte [eax], al
add byte [eax], al
add dword [ecx], eax
add byte [eax], al
add byte [eax], al
nop
aad 0x6b
add byte [eax], dl
dec esp
imul eax, dword [eax], 16
add byte [eax], al
add dword [ecx], eax
add dword [eax], eax
add ah, cl
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001f915
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x1002b040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov ecx, esi
call fcn.10005700
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov al, byte [0x1002b8f0]
cmp al, 0xff
je 0x10006d29
test al, al
sete al
test al, al
je 0x10006d61
mov eax, dword [0x1002c578]
cmp dword [eax], 0x10000
ja 0x10006e3c
mov edx, esi
lea ecx, [ebp - 0x50]
call fcn.10005400
mov edi, eax
mov dword [ebp - 4], 1
cmp dword [edi + 0x14], 0xf
jbe 0x10006ce0
mov edi, dword [edi]
xor edx, edx
lea ecx, [ebp - 0x38]
call fcn.10005650
cmp dword [eax + 0x14], 0xf
jbe 0x10006cf2
mov eax, dword [eax]
push edi
push eax
mov eax, dword [0x1002c578]
push dword [eax]
push str.Invalid_pointer_0x_X_input_argument__s_in_script__s__nScript_suspended.
call fcn.10005560
add esp, 0x10
lea ecx, [ebp - 0x38]
call fcn.1000ce60
lea ecx, [ebp - 0x50]
call fcn.1000ce60
mov dword [esi + 0xcc], 0xffffffff
mov al, 1
jmp 0x10007060
movzx ecx, byte [0x1002c56d]
lea eax, [ecx - 2]
cmp eax, 6
ja case.0x10006d3f.4
movzx eax, byte [eax + 0x1000708c]
jmp dword [eax*4 + 0x10007084]
sub ecx, 1
je case.0x10006d3f.2
sub ecx, 3
je case.0x10006d3f.2
sub ecx, 1
je case.0x10006d3f.2
mov edx, esi
lea ecx, [ebp - 0x38]
call fcn.10005400
mov edi, eax
mov dword [ebp - 4], 0
cmp dword [edi + 0x14], 0xf
jbe 0x10006d7c
mov edi, dword [edi]
mov dl, byte [0x1002b8f0]
mov cl, byte [0x1002c56d]
call fcn.10004e60
xor edx, edx
lea ecx, [ebp - 0x50]
mov ebx, eax
call fcn.10005650
cmp dword [eax + 0x14], 0xf
jbe 0x10006da1
mov eax, dword [eax]
push edi
push ebx
push eax
push str.Input_argument__s_expected_to_be_integer__got__s_in_script__s_nScript_suspended.
call fcn.10005560
mov ecx, dword [ebp - 0x3c]
add esp, 0x10
cmp ecx, 0xf
jbe 0x10006de5
mov edx, dword [ebp - 0x50]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10006ddb
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000707e
push ecx
push edx
call fcn.1000e3f5
add esp, 8
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0xf
mov byte [ebp - 0x50], 0
cmp ecx, 0xf
jbe 0x10006e2b
mov edx, dword [ebp - 0x38]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10006e21
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000707e
push ecx
push edx
call fcn.1000e3f5
add esp, 8
mov dword [esi + 0xcc], 0xffffffff
mov al, 1
jmp 0x10007060
mov ecx, esi
call fcn.10005700
mov edi, dword [eax]
mov al, byte [0x1002b8f0]
cmp al, 0xff
je 0x10006e7d
test al, al
sete al
test al, al
je 0x10006ea9
mov eax, dword [esi + 0x14]
mov byte [ebp - 0x19], 0
mov cl, byte [eax]
movzx edx, cl
lea eax, [edx - 2]
cmp eax, 6
ja case.0x10006e76.4
movzx eax, byte [eax + 0x1000709c]
jmp dword [eax*4 + 0x10007094]
movzx ecx, byte [0x1002c56d]
lea eax, [ecx - 2]
cmp eax, 6
ja case.0x10006e93.4
movzx eax, byte [eax + 0x100070ac]
jmp dword [eax*4 + 0x100070a4]
sub ecx, 1
je case.0x10006e93.2
sub ecx, 3
je case.0x10006e93.2
sub ecx, 1
je case.0x10006e93.2
mov edx, esi
lea ecx, [ebp - 0x50]
call fcn.10005400
mov edi, eax
mov dword [ebp - 4], 2
cmp dword [edi + 0x14], 0xf
jbe 0x10006ec4
mov edi, dword [edi]
mov dl, byte [0x1002b8f0]
mov cl, byte [0x1002c56d]
call fcn.10004e60
xor edx, edx
lea ecx, [ebp - 0x38]
mov ebx, eax
call fcn.10005650
cmp dword [eax + 0x14], 0xf
jbe 0x10006ee9
mov eax, dword [eax]
push edi
push ebx
push eax
push str.Input_argument__s_expected_to_be_integer__got__s_in_script__s_nScript_suspended.
jmp 0x10006d00
call fcn.10004df0
test al, al
jne case.0x10006e76.2
sub edx, 9
je 0x10006f2f
sub edx, 5
je 0x10006f2f
sub edx, 1
je 0x10006f2f
push 1
push esi
call dword [sym.imp.CLEO.asi_Ordinal_9]
call dword [sym.imp.CLEO.asi_Ordinal_41]
mov ebx, 0x1002c58c
mov eax, dword [eax]
mov dword [0x1002c58c], eax
jmp 0x10006f95
cmp edi, 0xff
jbe 0x10006f65
mov edx, esi
lea ecx, [ebp - 0x38]
call fcn.10005400
cmp dword [eax + 0x14], 0xf
jbe 0x10006f49
mov eax, dword [eax]
push eax
push 0xff
push edi
push str.Size_argument___d__greater_than_supported___d__in_script__s_nScript_suspended.
call fcn.10005560
add esp, 0x10
lea ecx, [ebp - 0x38]
jmp 0x10006d13
push edi
push 0
push 0x1002c590
call fcn.1000f590
add esp, 0xc
push 0xff
push 0x1002c590
push esi
call dword [sym.imp.CLEO.asi_Ordinal_6]
mov byte [ebp - 0x19], 1
jmp 0x10006f93
push esi
call dword [sym.imp.CLEO.asi_Ordinal_19]
mov ebx, eax
mov ecx, esi
call fcn.10005700
mov edx, dword [eax]
mov al, byte [0x1002b8f0]
cmp al, 0xff
je 0x10006fdd
test al, al
sete al
test al, al
je 0x10007009
test edi, edi
jns 0x10007021
mov edx, esi
lea ecx, [ebp - 0x38]
call fcn.10005400
cmp dword [eax + 0x14], 0xf
jbe 0x10006fc6
mov eax, dword [eax]
push eax
push edi
push str.Invalid__d_size_argument_in_script__s_nScript_suspended.
call fcn.10005560
add esp, 0xc
lea ecx, [ebp - 0x38]
jmp 0x10006d13
movzx ecx, byte [0x1002c56d]
lea eax, [ecx - 2]
cmp eax, 6
ja case.0x10006ff3.4
movzx eax, byte [eax + 0x100070bc]
jmp dword [eax*4 + 0x100070b4]
sub ecx, 1
je case.0x10006ff3.2
sub ecx, 3
je case.0x10006ff3.2
sub ecx, 1
je case.0x10006ff3.2
mov edx, esi
lea ecx, [ebp - 0x50]
call fcn.10005400
mov edi, eax
mov dword [ebp - 4], 3
jmp 0x10006ebc
je 0x1000705e
mov esi, dword [ebp - 0x20]
test edx, edx
je 0x10007038
lea eax, [ebp - 0x18]
push eax
push 0x40
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp byte [ebp - 0x19], 0
jne 0x10007053
cmp edi, 2
je 0x10007053
cmp edi, 4
je 0x10007053
push edi
push dword [ebx]
push esi
call fcn.1000f590
jmp 0x1000705b
push edi
push ebx
push esi
call fcn.10010a80
add esp, 0xc
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1000e09d
mov esp, ebp
pop ebp
ret 4
call fcn.100130c1
nop
mov ah, 0x6c
add byte [eax], dl
inc esi
insd dword es:[edi], dx
add byte [eax], dl
add byte [eax], al
add dword [ecx], eax
add dword [eax], eax
add byte [eax + case.0x10006e76.2], dl
imul byte [esi]
adc byte [eax], al
add byte [ecx], al
add dword [ecx], eax
add byte [eax], al
nop
push edi
outsb dx, byte [esi]
add byte [eax], dl
lcall 0x100, 0x10006e
add dword [ecx], eax
add byte [eax], al
nop
mov al, 0x6f
add byte [eax], dl
cli
outsd dx, dword [esi]
add byte [eax], dl
add byte [eax], al
add dword [ecx], eax
add dword [eax], eax
add ah, cl
int3