Function at 0x1006ab70
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10138040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x1006a6d0
push 0x62ec6d
push 0xe9
call fcn.1006e640
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
add esp, 0xc
mov dword [ebp - 8], 0
push eax
push 0x40
push 4
push 0x4d75f0
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1006abe4
lea eax, [ebp - 0xc]
mov dword [0x4d75f0], 0x4d
push eax
push dword [ebp - 8]
mov dword [ebp - 0xc], 0
push 4
push 0x4d75f0
call esi
test eax, eax
jne 0x1006abe6
call edi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 4
push 0x4d6c2c
call esi
test eax, eax
je 0x1006ac25
lea eax, [ebp - 0xc]
mov dword [0x4d6c2c], 0x4e
push eax
push dword [ebp - 8]
mov dword [ebp - 0xc], 0
push 4
push 0x4d6c2c
call esi
test eax, eax
jne 0x1006ac27
call edi
push 0x1006a0c0
push 0x4d76fb
push 0xe8
call fcn.1006e640
push 0x1006a0c0
push 0x4d79c3
push 0xe8
call fcn.1006e640
push 0x1006a0c0
push 0x4d712a
push 0xe8
call fcn.1006e640
push 0x1006a6f0
push 0x91006d
push 0xe9
call fcn.1006e640
push 0x1006a710
push 0x910076
push 0xe9
call fcn.1006e640
push 0x1006a730
push 0x4da0a6
push 0xe9
call fcn.1006e640
add esp, 0x48
push 0x1006a750
push 0x5524d9
push 0xe9
call fcn.1006e640
push 0x1006a770
push 0x5d9629
push 0xe9
call fcn.1006e640
push 0x1006a790
push 0x5db835
push 0xe9
call fcn.1006e640
push 0x1006a7b0
push 0x5dc58c
push 0xe9
call fcn.1006e640
push 0x1006a7d0
push 0x5ee0c8
push 0xe9
call fcn.1006e640
push 0x1006a7f0
push 0x62f10c
push 0xe9
call fcn.1006e640
add esp, 0x48
push 0x1006a810
push 0x8fcedd
push 0xe9
call fcn.1006e640
push 0x1006a830
push 0x8fe63c
push 0xe9
call fcn.1006e640
push 0x1006a850
push 0x4d7c98
push 0xe8
call fcn.1006e640
push 0x1006a850
push 0x4d7c0d
push 0xe8
call fcn.1006e640
push 0x1006a960
push 0x4d7af9
push 0xe8
call fcn.1006e640
push 0x1006a590
push 0x5ede8b
push 0xe8
call fcn.1006e640
mov eax, 0x1006a670
mov byte [ebp - 0x14], 0xe9
add esp, 0x48
mov dword [ebp - 8], 0
sub eax, 0x4d87cd
mov dword [ebp - 0x13], eax
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push 0x4d87c8
call esi
test eax, eax
je 0x1006adea
mov eax, dword [ebp - 0x14]
mov ecx, 0x4d87c8
mov dword [ecx], eax
mov al, byte [ebp - 0x10]
mov byte [ecx + 4], al
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
mov dword [ebp - 0xc], 0
push 5
push ecx
call esi
test eax, eax
jne 0x1006adec
call edi
mov eax, 0x1006a690
mov byte [ebp - 0x14], 0xe9
sub eax, 0x4d8801
mov dword [ebp - 8], 0
mov dword [ebp - 0x13], eax
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push 0x4d87fc
call esi
test eax, eax
je 0x1006ae3e
mov eax, dword [ebp - 0x14]
mov ecx, 0x4d87fc
mov dword [ecx], eax
mov al, byte [ebp - 0x10]
mov byte [ecx + 4], al
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
mov dword [ebp - 0xc], 0
push 5
push ecx
call esi
test eax, eax
jne 0x1006ae40
call edi
mov eax, 0x1006a6b0
mov byte [ebp - 0x14], 0xe9
sub eax, 0x5db530
mov dword [ebp - 8], 0
mov dword [ebp - 0x13], eax
lea eax, [ebp - 8]
push eax
push 0x40
push 5
push 0x5db52b
call esi
test eax, eax
je 0x1006ae92
mov eax, dword [ebp - 0x14]
mov ecx, 0x5db52b
mov dword [ecx], eax
mov al, byte [ebp - 0x10]
mov byte [ecx + 4], al
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
mov dword [ebp - 0xc], 0
push 5
push ecx
call esi
test eax, eax
jne 0x1006ae94
call edi
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0xd27b0c
call esi
lea eax, [ebp - 8]
mov dword [0xd27b0c], 0x42740000
push eax
push dword [ebp - 8]
push 4
push 0xd27b0c
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0xd27b08
call esi
lea eax, [ebp - 8]
mov dword [0xd27b08], 0x42200000
push eax
push dword [ebp - 8]
push 4
push 0xd27b08
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x57f0fc
call esi
lea eax, [ebp - 8]
mov dword [0x57f0fc], 0xffffffe9
push eax
push dword [ebp - 8]
push 4
push 0x57f0fc
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x57f0fd
call esi
lea eax, [ebp - 8]
mov dword [0x57f0fd], 0x4a
push eax
push dword [ebp - 8]
push 4
push 0x57f0fd
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x57f0fe
call esi
lea eax, [ebp - 8]
mov dword [0x57f0fe], 1
push eax
push dword [ebp - 8]
push 4
push 0x57f0fe
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x57f0ff
call esi
lea eax, [ebp - 8]
mov dword [0x57f0ff], 0
push eax
push dword [ebp - 8]
push 4
push 0x57f0ff
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x57f100
call esi
lea eax, [ebp - 8]
mov dword [0x57f100], 0
push eax
push dword [ebp - 8]
push 4
push 0x57f100
call esi
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x57f101
call esi
lea eax, [ebp - 8]
mov dword [0x57f101], 0xffffff90
push eax
push dword [ebp - 8]
push 4
push 0x57f101
call esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10087e2f
mov esp, ebp
pop ebp
ret