Function at 0x10006a40
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x304
mov eax, dword [0x1000d00c]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
mov ecx, str._fps
push ebx
push esi
push edi
mov eax, edx
mov bl, byte [eax]
cmp bl, byte [ecx]
jne 0x10006a80
test bl, bl
je 0x10006a7c
mov bl, byte [eax + 1]
cmp bl, byte [ecx + 1]
jne 0x10006a80
add eax, 2
add ecx, 2
test bl, bl
jne 0x10006a60
xor eax, eax
jmp 0x10006a85
sbb eax, eax
or eax, 1
test eax, eax
jne 0x10006ad0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x49099a
mov dword [ebp - 8], 0x40
call esi
mov dword [0x49099b], 0xff00ff00
mov eax, dword [0x684bb0]
mov dword [ebp - 0x300], eax
push 0x606eab
mov ecx, dword [ebp - 0x300]
call dword [0x1000d024]
jmp 0x1000710e
mov ecx, str._noeffects
mov eax, edx
mov bl, byte [eax]
cmp bl, byte [ecx]
jne 0x10006af7
test bl, bl
je 0x10006af3
mov bl, byte [eax + 1]
cmp bl, byte [ecx + 1]
jne 0x10006af7
add eax, 2
add ecx, 2
test bl, bl
jne 0x10006ad7
xor eax, eax
jmp 0x10006afc
sbb eax, eax
or eax, 1
test eax, eax
jne 0x10006c2d
cmp dword [0x9362d8], 0
lea eax, [ebp - 8]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push 4
mov dword [ebp - 8], 0x40
push 0x49099a
je 0x10006bac
mov dword [ebp - 0x300], str.Effects_ON
call esi
mov dword [0x49099b], 0xffffaaaa
mov eax, dword [0x684bb0]
mov dword [ebp - 0x304], eax
push dword [ebp - 0x300]
mov ecx, dword [ebp - 0x304]
call dword [0x1000d024]
lea eax, [ebp - 8]
mov dword [0x49099b], 0xffffaaaa
push eax
push dword [ebp - 8]
push 4
push 0x49099a
call esi
mov dword ds:[0x9362d8], 0
mov dword ds:[0x9362dc], 0
mov dword ds:[0x9362e0], 0
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10007863
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x304], str.Effects_OFF
call esi
mov dword [0x49099b], 0xffffaaaa
mov eax, dword [0x684bb0]
mov dword [ebp - 0x300], eax
push dword [ebp - 0x304]
mov ecx, dword [ebp - 0x300]
call dword [0x1000d024]
lea eax, [ebp - 8]
mov dword [0x49099b], 0xffffaaaa
push eax
push dword [ebp - 8]
push 4
push 0x49099a
call esi
mov dword ds:[0x9362d8], 1
mov dword ds:[0x9362dc], 1
mov dword ds:[0x9362e0], 1
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10007863
mov esp, ebp
pop ebp
ret
mov ecx, str._effects2
mov eax, edx
mov bl, byte [eax]
cmp bl, byte [ecx]
jne 0x10006c54
test bl, bl
je 0x10006c50
mov bl, byte [eax + 1]
cmp bl, byte [ecx + 1]
jne 0x10006c54
add eax, 2
add ecx, 2
test bl, bl
jne 0x10006c34
xor eax, eax
jmp 0x10006c59
sbb eax, eax
or eax, 1
test eax, eax
je 0x100073c2
mov ecx, str.effects2
mov eax, edx
mov bl, byte [eax]
cmp bl, byte [ecx]
jne 0x10006c88
test bl, bl
je 0x10006c84
mov bl, byte [eax + 1]
cmp bl, byte [ecx + 1]
jne 0x10006c88
add eax, 2
add ecx, 2
test bl, bl
jne 0x10006c68
xor eax, eax
jmp 0x10006c8d
sbb eax, eax
or eax, 1
test eax, eax
je 0x100073c2
mov ecx, str._autogrupo
mov eax, edx
nop dword [eax]
mov bl, byte [eax]
cmp bl, byte [ecx]
jne 0x10006cc0
test bl, bl
je 0x10006cbc
mov bl, byte [eax + 1]
cmp bl, byte [ecx + 1]
jne 0x10006cc0
add eax, 2
add ecx, 2
test bl, bl
jne 0x10006ca0
xor eax, eax
jmp 0x10006cc5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x10006de8
movzx eax, byte [0x1000d6d9]
sub eax, 0
je 0x10006d67
sub eax, 1
jne 0x100074d8
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x49099a
mov dword [ebp - 0x304], str.Auto_Grupo_Destivado
mov dword [ebp - 8], 0x40
call esi
mov dword [0x49099b], 0xffff0000
mov eax, dword [0x684bb0]
mov dword [ebp - 0x300], eax
push dword [ebp - 0x304]
mov ecx, dword [ebp - 0x300]
call dword [0x1000d024]
lea eax, [ebp - 8]
mov dword [0x49099b], 0xffffaaaa
push eax
push dword [ebp - 8]
push 4
push 0x49099a
call esi
mov byte [0x1000d6d9], 0
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10007863
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x49099a
mov dword [ebp - 0x304], str.Auto_Grupo_Ativado
mov dword [ebp - 8], 0x40
call esi
mov dword [0x49099b], 0xff00ff00
mov eax, dword [0x684bb0]
mov dword [ebp - 0x300], eax
push dword [ebp - 0x304]
mov ecx, dword [ebp - 0x300]
call dword [0x1000d024]
lea eax, [ebp - 8]
mov dword [0x49099b], 0xffffaaaa
push eax
push dword [ebp - 8]
push 4
push 0x49099a
call esi
mov byte [0x1000d6d9], 1
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10007863
mov esp, ebp
pop ebp
ret
mov ecx, str._agrupadoroff
mov eax, edx
nop
mov bl, byte [eax]
cmp bl, byte [ecx]
jne 0x10006e10
test bl, bl
je 0x10006e0c
mov bl, byte [eax + 1]
cmp bl, byte [ecx + 1]
jne 0x10006e10
add eax, 2
add ecx, 2
test bl, bl
jne 0x10006df0
xor eax, eax
jmp 0x10006e15
sbb eax, eax
or eax, 1
test eax, eax
je 0x1000735f
mov ecx, str._Agrupadoroff
mov eax, edx
mov bl, byte [eax]
cmp bl, byte [ecx]
jne 0x10006e44
test bl, bl
je 0x10006e40
mov bl, byte [eax + 1]
cmp bl, byte [ecx + 1]
jne 0x10006e44
add eax, 2
add ecx, 2
test bl, bl
jne 0x10006e24
xor eax, eax
jmp 0x10006e49
sbb eax, eax
or eax, 1
test eax, eax
je 0x1000735f
mov ecx, str._AGRUPADOROFF
mov eax, edx
mov bl, byte [eax]
cmp bl, byte [ecx]
jne 0x10006e78
test bl, bl
je 0x10006e74
mov bl, byte [eax + 1]
cmp bl, byte [ecx + 1]
jne 0x10006e78
add eax, 2
add ecx, 2
test bl, bl
jne 0x10006e58
xor eax, eax
jmp 0x10006e7d
sbb eax, eax
or eax, 1
test eax, eax
je 0x1000735f
mov ecx, str._agrupar
mov eax, edx
nop dword [eax]
mov bl, byte [eax]
cmp bl, byte [ecx]
jne 0x10006eb0
test bl, bl
je 0x10006eac
mov bl, byte [eax + 1]
cmp bl, byte [ecx + 1]
jne 0x10006eb0
add eax, 2
add ecx, 2
test bl, bl
jne 0x10006e90
xor eax, eax
jmp 0x10006eb5
sbb eax, eax
or eax, 1
test eax, eax
je 0x10007151
mov ecx, str._AGRUPAR
mov eax, edx
mov bl, byte [eax]
cmp bl, byte [ecx]
jne 0x10006ee4
test bl, bl
je 0x10006ee0
mov bl, byte [eax + 1]
cmp bl, byte [ecx + 1]
jne 0x10006ee4
add eax, 2
add ecx, 2
test bl, bl
jne 0x10006ec4
xor eax, eax
jmp 0x10006ee9
sbb eax, eax
or eax, 1
test eax, eax
je 0x10007151
mov ecx, str._Agrupar
mov eax, edx
mov bl, byte [eax]
cmp bl, byte [ecx]
jne 0x10006f18
test bl, bl
je 0x10006f14
mov bl, byte [eax + 1]
cmp bl, byte [ecx + 1]
jne 0x10006f18
add eax, 2
add ecx, 2
test bl, bl
jne 0x10006ef8
xor eax, eax
jmp 0x10006f1d
sbb eax, eax
or eax, 1
test eax, eax
je 0x10007151
mov ecx, str._macropergaon
mov eax, edx
nop dword [eax]
mov bl, byte [eax]
cmp bl, byte [ecx]
jne 0x10006f50
test bl, bl
je 0x10006f4c
mov bl, byte [eax + 1]
cmp bl, byte [ecx + 1]
jne 0x10006f50
add eax, 2
add ecx, 2
test bl, bl
jne 0x10006f30
xor eax, eax
jmp 0x10006f55
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1000701f
cmp byte [0x1000d6d8], 0
lea eax, [ebp - 8]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push 4
mov dword [ebp - 8], 0x40
push 0x49099a
jne 0x10006fe7
mov dword [ebp - 0x304], str.Macro_de_Pergaminho_Ativado
call esi
mov dword [0x49099b], 0xff00ff00
mov eax, dword [0x684bb0]
mov dword [ebp - 0x300], eax
push dword [ebp - 0x304]
mov ecx, dword [ebp - 0x300]
call dword [0x1000d024]
lea eax, [ebp - 8]
mov dword [0x49099b], 0xffffaaaa
push eax
push dword [ebp - 8]
push 4
push 0x49099a
call esi
mov byte [0x1000d6d8], 1
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10007863
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x304], str.Macro_de_Pergaminho_J
call esi
mov dword [0x49099b], 0xff00ff00
mov eax, dword [0x684bb0]
mov dword [ebp - 0x300], eax
push dword [ebp - 0x304]
mov ecx, dword [ebp - 0x300]
call dword [0x1000d024]
jmp 0x1000710e
mov eax, str._macropergaoff
mov cl, byte [edx]
cmp cl, byte [eax]
jne 0x10007044
test cl, cl
je 0x10007040
mov cl, byte [edx + 1]
cmp cl, byte [eax + 1]
jne 0x10007044
add edx, 2
add eax, 2
test cl, cl
jne 0x10007024
xor eax, eax
jmp 0x10007049
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1000713b
cmp byte [0x1000d6d8], 0
lea eax, [ebp - 8]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push 4
mov dword [ebp - 8], 0x40
push 0x49099a
je 0x100070db
mov dword [ebp - 0x304], str.Macro_de_Pergaminho_Desativado
call esi
mov dword [0x49099b], 0xffff0000
mov eax, dword [0x684bb0]
mov dword [ebp - 0x300], eax
push dword [ebp - 0x304]
mov ecx, dword [ebp - 0x300]
call dword [0x1000d024]
lea eax, [ebp - 8]
mov dword [0x49099b], 0xffffaaaa
push eax
push dword [ebp - 8]
push 4
push 0x49099a
call esi
mov byte [0x1000d6d8], 0
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10007863
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x304], str.Macro_de_Pergaminho_j
call esi
mov dword [0x49099b], 0xffff0000
mov eax, dword [0x684bb0]
mov dword [ebp - 0x300], eax
push dword [ebp - 0x304]
mov ecx, dword [ebp - 0x300]
call dword [0x1000d024]
lea eax, [ebp - 8]
mov dword [0x49099b], 0xffffaaaa
push eax
push dword [ebp - 8]
push 4
push 0x49099a
call esi
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10007863
mov esp, ebp
pop ebp
ret
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10007863
mov esp, ebp
pop ebp
ret
mov eax, dword ds:[0x13c1aac]
add eax, 0x6ec
mov ecx, 0xbd
lea edi, [ebp - 0x2fc]
mov esi, eax
rep movsd dword es:[edi], dword [esi]
mov ebx, dword [ebp - 0x30]
test bx, bx
je 0x1000730d
mov eax, dword [0x1000dcb8]
xor edi, edi
movzx ecx, bx
mov dword [0x1000dcbc], eax
mov eax, ecx
mov byte [0x1000d6da], 0
cmp ecx, 0xbd3
ja 0x10007223
je case.0x10007286.4011
cmp ecx, 0x956
ja 0x10007207
je case.0x10007286.4011
cmp ecx, 0x242
ja 0x100071d9
je case.0x10007286.4011
sub eax, 0x19c
cmp eax, 0x46
ja case.0x10007286.4012
movzx eax, byte [eax + 0x100074f4]
jmp dword [eax*4 + 0x100074ec]
cmp ecx, 0x6cb
ja case.0x10007286.4012
je case.0x10007286.4011
sub eax, 0x309
cmp eax, 8
ja case.0x10007286.4012
movzx eax, byte [eax + 0x10007540]
jmp dword [eax*4 + 0x1000753c]
sub eax, 0x957
cmp eax, 0x39
ja case.0x10007286.4012
movzx eax, byte [eax + 0x10007554]
jmp dword [eax*4 + 0x1000754c]
cmp ecx, 0xcee
ja 0x10007247
je case.0x10007286.4011
sub eax, 0xbd4
cmp eax, 0xb5
ja case.0x10007286.4012
movzx eax, byte [eax + 0x10007598]
jmp dword [eax*4 + 0x10007590]
cmp ecx, 0xfaa
ja 0x10007269
je case.0x10007286.4011
sub eax, 0xcf2
cmp eax, 0xc
ja case.0x10007286.4012
movzx eax, byte [eax + 0x10007658]
jmp dword [eax*4 + 0x10007650]
cmp ecx, 0x17d5
ja 0x1000728d
je case.0x10007286.4011
sub eax, 0xfab
cmp eax, 0x87
ja case.0x10007286.4012
movzx eax, byte [eax + 0x10007670]
jmp dword [eax*4 + 0x10007668]
sub eax, 0x17d6
je case.0x10007286.4011
sub eax, 3
jne case.0x10007286.4012
mov edi, ecx
xor esi, esi
nop dword [eax]
movzx eax, word [ebp + esi*8 - 0x220]
cmp eax, edi
jne 0x100072b5
mov edx, ebx
mov ecx, esi
call fcn.100033e0
inc esi
cmp esi, 0x3f
jl 0x100072a0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x49099a
mov dword [ebp - 0x304], str.Item_agrupado_com_sucesso.
mov dword [ebp - 8], 0x40
call esi
mov dword [0x49099b], 0xffffff00
mov eax, dword [0x684bb0]
mov dword [ebp - 0x300], eax
push dword [ebp - 0x304]
mov ecx, dword [ebp - 0x300]
call dword [0x1000d024]
jmp 0x1000710e
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x49099a
mov dword [ebp - 0x304], str.Coloque_o_item_no_ultimo_slot.
mov dword [ebp - 8], 0x40
call esi
mov dword [0x49099b], 0xffffff00
mov eax, dword [0x684bb0]
mov dword [ebp - 0x300], eax
push dword [ebp - 0x304]
mov ecx, dword [ebp - 0x300]
call dword [0x1000d024]
jmp 0x1000710e
mov eax, dword [0x1000dcb8]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [0x1000dcbc], eax
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x49099a
mov byte [0x1000d6da], 0
mov dword [ebp - 0x304], str.Agrupador_desativado.use____agrupadoron_Para_ativar_o_agrupamento_autom
mov dword [ebp - 8], 0x40
call esi
mov dword [0x49099b], 0xffffff00
mov eax, dword [0x684bb0]
mov dword [ebp - 0x300], eax
push dword [ebp - 0x304]
mov ecx, dword [ebp - 0x300]
call dword [0x1000d024]
jmp 0x1000710e
cmp dword [0x9362d8], 0
lea eax, [ebp - 8]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push 4
mov dword [ebp - 8], 0x40
push 0x49099a
je 0x1000746a
mov dword [ebp - 0x304], str.Effects_ON
call esi
mov dword [0x49099b], 0xffffaaaa
mov eax, dword [0x684bb0]
mov dword [ebp - 0x300], eax
push dword [ebp - 0x304]
mov ecx, dword [ebp - 0x300]
call dword [0x1000d024]
lea eax, [ebp - 8]
mov dword [0x49099b], 0xffffaaaa
push eax
push dword [ebp - 8]
push 4
push 0x49099a
call esi
mov dword ds:[0x9362d8], 0
mov dword ds:[0x9362dc], 0
mov dword ds:[0x9362e0], 0
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10007863
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x304], str.Effects_OFF
call esi
mov dword [0x49099b], 0xffffaaaa
mov eax, dword [0x684bb0]
mov dword [ebp - 0x300], eax
push dword [ebp - 0x304]
mov ecx, dword [ebp - 0x300]
call dword [0x1000d024]
lea eax, [ebp - 8]
mov dword [0x49099b], 0xffffaaaa
push eax
push dword [ebp - 8]
push 4
push 0x49099a
call esi
mov dword ds:[0x9362d8], 1
mov dword ds:[0x9362dc], 1
mov dword ds:[0x9362e0], 1
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10007863
mov esp, ebp
pop ebp
ret