Function at 0x10010490
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10052434]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
mov edx, str.effects2
push ebx
push esi
mov eax, ecx
nop dword [eax]
mov bl, byte [eax]
cmp bl, byte [edx]
jne 0x100104d0
test bl, bl
je 0x100104cc
mov bl, byte [eax + 1]
cmp bl, byte [edx + 1]
jne 0x100104d0
add eax, 2
add edx, 2
test bl, bl
jne 0x100104b0
xor eax, eax
jmp 0x100104d5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x100105e8
cmp dword [0x13fab64], 0
lea eax, [ebp - 8]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push 4
mov dword [ebp - 8], 0x40
push 0x49b50a
je 0x10010574
mov dword [ebp - 0x10], str.Effects
call esi
mov dword [0x49b50b], 0xffffaaaa
mov eax, dword [0x6bdaf0]
mov dword [ebp - 0xc], eax
push dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
call dword [0x10061de0]
lea eax, [ebp - 8]
mov dword [0x49b50b], 0xffffaaaa
push eax
push dword [ebp - 8]
push 4
push 0x49b50a
call esi
mov dword ds:[0x13fab64], 0
mov dword ds:[0x13fab68], 0
mov dword ds:[0x13fab6c], 0
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10019411
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0xc], str.Effects
call esi
mov dword [0x49b50b], 0xffffaaaa
mov eax, dword [0x6bdaf0]
mov dword [ebp - 0x10], eax
push dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
call dword [0x10061de0]
lea eax, [ebp - 8]
mov dword [0x49b50b], 0xffffaaaa
push eax
push dword [ebp - 8]
push 4
push 0x49b50a
call esi
mov dword ds:[0x13fab64], 1
mov dword ds:[0x13fab68], 1
mov dword ds:[0x13fab6c], 1
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10019411
mov esp, ebp
pop ebp
ret
mov edx, str._fps
mov eax, ecx
nop
mov bl, byte [eax]
cmp bl, byte [edx]
jne 0x10010610
test bl, bl
je 0x1001060c
mov bl, byte [eax + 1]
cmp bl, byte [edx + 1]
jne 0x10010610
add eax, 2
add edx, 2
test bl, bl
jne 0x100105f0
xor eax, eax
jmp 0x10010615
sbb eax, eax
or eax, 1
test eax, eax
jne 0x10010681
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x49b50a
mov dword [ebp - 8], 0x40
call esi
mov dword [0x49b50b], 0xffffaaaa
mov eax, dword [0x6bdaf0]
mov dword [ebp - 0xc], eax
push 0x606eab
mov ecx, dword [ebp - 0xc]
call dword [0x10061de0]
lea eax, [ebp - 8]
mov dword [0x49b50b], 0xffffaaaa
push eax
push dword [ebp - 8]
push 4
push 0x49b50a
call esi
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10019411
mov esp, ebp
pop ebp
ret
mov edx, str._macroperga
mov eax, ecx
mov bl, byte [eax]
cmp bl, byte [edx]
jne 0x100106a8
test bl, bl
je 0x100106a4
mov bl, byte [eax + 1]
cmp bl, byte [edx + 1]
jne 0x100106a8
add eax, 2
add edx, 2
test bl, bl
jne 0x10010688
xor eax, eax
jmp 0x100106ad
sbb eax, eax
or eax, 1
test eax, eax
jne 0x100107b2
movzx eax, byte [0x10098f91]
sub eax, 0
je 0x1001073e
sub eax, 1
jne 0x100108cf
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x49b50a
mov dword [ebp - 0xc], str.Macro_Perga_OFF
mov dword [ebp - 8], 0x40
call esi
mov dword [0x49b50b], 0xffff0000
mov eax, dword [0x6bdaf0]
mov dword [ebp - 0x10], eax
push dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
call dword [0x10061de0]
lea eax, [ebp - 8]
mov dword [0x49b50b], 0xffffaaaa
push eax
push dword [ebp - 8]
push 4
push 0x49b50a
call esi
mov byte [0x10098f91], 0
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10019411
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x49b50a
mov dword [ebp - 0xc], str.Macro_Perga_ON
mov dword [ebp - 8], 0x40
call esi
mov dword [0x49b50b], 0xff00ff00
mov eax, dword [0x6bdaf0]
mov dword [ebp - 0x10], eax
push dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
call dword [0x10061de0]
lea eax, [ebp - 8]
mov dword [0x49b50b], 0xffffaaaa
push eax
push dword [ebp - 8]
push 4
push 0x49b50a
call esi
mov byte [0x10098f91], 1
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10019411
mov esp, ebp
pop ebp
ret
mov eax, str._macrojoia
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x100107d7
test dl, dl
je 0x100107d3
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x100107d7
add ecx, 2
add eax, 2
test dl, dl
jne 0x100107b7
xor eax, eax
jmp 0x100107dc
sbb eax, eax
or eax, 1
test eax, eax
jne 0x100108e1
movzx eax, byte [0x10098f90]
sub eax, 0
je 0x1001086d
sub eax, 1
jne 0x100108cf
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x49b50a
mov dword [ebp - 0xc], str.Macro_Joia_OFF
mov dword [ebp - 8], 0x40
call esi
mov dword [0x49b50b], 0xffff0000
mov eax, dword [0x6bdaf0]
mov dword [ebp - 0x10], eax
push dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
call dword [0x10061de0]
lea eax, [ebp - 8]
mov dword [0x49b50b], 0xffffaaaa
push eax
push dword [ebp - 8]
push 4
push 0x49b50a
call esi
mov byte [0x10098f90], 0
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10019411
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x49b50a
mov dword [ebp - 0xc], str.Macro_Joia_ON
mov dword [ebp - 8], 0x40
call esi
mov dword [0x49b50b], 0xff00ff00
mov eax, dword [0x6bdaf0]
mov dword [ebp - 0x10], eax
push dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
call dword [0x10061de0]
lea eax, [ebp - 8]
mov dword [0x49b50b], 0xffffaaaa
push eax
push dword [ebp - 8]
push 4
push 0x49b50a
call esi
mov byte [0x10098f90], 1
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10019411
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
pop esi
xor ecx, ebp
pop ebx
call fcn.10019411
mov esp, ebp
pop ebp
ret