Function at 0x1006bb50
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10139040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x1006b690
push 0x62ec6d
push 0xe9
call fcn.1006c3c0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
add esp, 0xc
mov dword [ebp - 8], 0
push eax
push 0x40
push 4
push 0x4d75f0
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1006bbc4
lea eax, [ebp - 0xc]
mov dword [0x4d75f0], 0x4d
push eax
push dword [ebp - 8]
mov dword [ebp - 0xc], 0
push 4
push 0x4d75f0
call esi
test eax, eax
jne 0x1006bbc6
call edi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 4
push 0x4d6c2c
call esi
test eax, eax
je 0x1006bc05
lea eax, [ebp - 0xc]
mov dword [0x4d6c2c], 0x4e
push eax
push dword [ebp - 8]
mov dword [ebp - 0xc], 0
push 4
push 0x4d6c2c
call esi
test eax, eax
jne 0x1006bc07
call edi
push 0x1006b080
push 0x4d76fb
push 0xe8
call fcn.1006c3c0
push 0x1006b080
push 0x4d79c3
push 0xe8
call fcn.1006c3c0
push 0x1006b080
push 0x4d712a
push 0xe8
call fcn.1006c3c0
push 0x1006b6b0
push 0x91006d
push 0xe9
call fcn.1006c3c0
push 0x1006b6d0
push 0x910076
push 0xe9
call fcn.1006c3c0
push 0x1006b6f0
push 0x4da0a6
push 0xe9
call fcn.1006c3c0
add esp, 0x48
push 0x1006b710
push 0x5524d9
push 0xe9
call fcn.1006c3c0
push 0x1006b730
push 0x5d9629
push 0xe9
call fcn.1006c3c0
push 0x1006b750
push 0x5db835
push 0xe9
call fcn.1006c3c0
push 0x1006b770
push 0x5dc58c
push 0xe9
call fcn.1006c3c0
push 0x1006b790
push 0x5ee0c8
push 0xe9
call fcn.1006c3c0
push 0x1006b7b0
push 0x62f10c
push 0xe9
call fcn.1006c3c0
add esp, 0x48
push 0x1006b7d0
push 0x8fcedd
push 0xe9
call fcn.1006c3c0
push 0x1006b7f0
push 0x8fe63c
push 0xe9
call fcn.1006c3c0
push 0x1006b810
push 0x4d7c98
push 0xe8
call fcn.1006c3c0
push 0x1006b810
push 0x4d7c0d
push 0xe8
call fcn.1006c3c0
push 0x1006b940
push 0x4d7af9
push 0xe8
call fcn.1006c3c0
push 0x1006b550
push 0x5ede8b
push 0xe8
call fcn.1006c3c0
mov eax, 0x1006b630
mov byte [ebp - 0x14], 0xe9
add esp, 0x48
mov dword [ebp - 8], 0
sub eax, 0x4d87cd
mov dword [ebp - 0x13], eax
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push 0x4d87c8
call esi
test eax, eax
je 0x1006bdca
mov eax, dword [ebp - 0x14]
mov ecx, 0x4d87c8
mov dword [ecx], eax
mov al, byte [ebp - 0x10]
mov byte [ecx + 4], al
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
mov dword [ebp - 0xc], 0
push 5
push ecx
call esi
test eax, eax
jne 0x1006bdcc
call edi
mov eax, 0x1006b650
mov byte [ebp - 0x14], 0xe9
sub eax, 0x4d8801
mov dword [ebp - 8], 0
mov dword [ebp - 0x13], eax
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push 0x4d87fc
call esi
test eax, eax
je 0x1006be1e
mov eax, dword [ebp - 0x14]
mov ecx, 0x4d87fc
mov dword [ecx], eax
mov al, byte [ebp - 0x10]
mov byte [ecx + 4], al
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
mov dword [ebp - 0xc], 0
push 5
push ecx
call esi
test eax, eax
jne 0x1006be20
call edi
mov eax, 0x1006b670
mov byte [ebp - 0x14], 0xe9
sub eax, 0x5db530
mov dword [ebp - 8], 0
mov dword [ebp - 0x13], eax
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push 0x5db52b
call esi
test eax, eax
je 0x1006be72
mov eax, dword [ebp - 0x14]
mov ecx, 0x5db52b
mov dword [ecx], eax
mov al, byte [ebp - 0x10]
mov byte [ecx + 4], al
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
mov dword [ebp - 0xc], 0
push 5
push ecx
call esi
test eax, eax
jne 0x1006be74
call edi
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0xd27b0c
call esi
lea eax, [ebp - 8]
mov dword [0xd27b0c], 0x42740000
push eax
push dword [ebp - 8]
push 4
push 0xd27b0c
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0xd27b08
call esi
lea eax, [ebp - 8]
mov dword [0xd27b08], 0x42200000
push eax
push dword [ebp - 8]
push 4
push 0xd27b08
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x57f0fc
call esi
lea eax, [ebp - 8]
mov dword [0x57f0fc], 0xffffffe9
push eax
push dword [ebp - 8]
push 4
push 0x57f0fc
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x57f0fd
call esi
lea eax, [ebp - 8]
mov dword [0x57f0fd], 0x4a
push eax
push dword [ebp - 8]
push 4
push 0x57f0fd
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x57f0fe
call esi
lea eax, [ebp - 8]
mov dword [0x57f0fe], 1
push eax
push dword [ebp - 8]
push 4
push 0x57f0fe
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x57f0ff
call esi
lea eax, [ebp - 8]
mov dword [0x57f0ff], 0
push eax
push dword [ebp - 8]
push 4
push 0x57f0ff
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x57f100
call esi
lea eax, [ebp - 8]
mov dword [0x57f100], 0
push eax
push dword [ebp - 8]
push 4
push 0x57f100
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x57f101
call esi
lea eax, [ebp - 8]
mov dword [0x57f101], 0xffffff90
push eax
push dword [ebp - 8]
push 4
push 0x57f101
call esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.100890df
mov esp, ebp
pop ebp
ret