Function at 0x10006a10
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006f270
mov eax, dword fs:[0]
push eax
sub esp, 0x2e0
mov eax, dword [0x100ae940]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x100b0ff8]
lea ecx, [ebp - 0x2b8]
push dword [0x100b1010]
mov ebx, dword [eax + 0x60]
mov dword [ebp - 0x2d0], ebx
call fcn.100027f0
lea ecx, [ebp - 0x2b8]
mov dword [ebp - 4], 0
call fcn.1000e200
mov dword [ebp - 0x2d4], eax
test ebx, ebx
je 0x10006e91
mov ecx, dword [0x100b100c]
mov ebx, dword [ecx + 0x4c]
cmp ebx, dword [ecx + 0x50]
je 0x10006e91
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, dword [ebx]
test esi, esi
je 0x10006e80
mov ecx, esi
call fcn.1000e1f0
test eax, eax
je 0x10006e80
mov eax, dword [esi + 0x24]
cmp eax, 0x20144
je 0x10006bbb
cmp eax, 0x20142
je 0x10006bbb
cmp eax, 0x20140
je 0x10006bbb
cmp eax, 0x20033
je 0x10006bbb
cmp eax, 0x20035
je 0x10006bbb
cmp eax, 0x20071
je 0x10006bbb
cmp eax, 0x20081
je 0x10006bbb
cmp eax, 0x20150
je 0x10006bbb
cmp eax, 0x20152
je 0x10006bbb
cmp eax, 0x20160
je 0x10006bbb
cmp eax, 0x20170
je 0x10006bbb
cmp eax, 0x20180
je 0x10006bbb
cmp eax, 0x20182
je 0x10006bbb
cmp eax, 0x20190
je 0x10006bbb
cmp eax, 0x20200
je 0x10006bbb
cmp eax, 0x21010
je 0x10006bbb
cmp eax, 0x20080
je 0x10006bbb
cmp eax, 0x20070
je 0x10006bbb
cmp eax, 0x20100
je 0x10006bbb
cmp eax, 0x20040
je 0x10006c43
cmp eax, 0x20220
je 0x10006bbb
cmp eax, 0x20310
je 0x10006bbb
cmp eax, 0x2070a
je 0x10006bbb
cmp eax, 0x20700
je 0x10006bbb
cmp eax, 0x20600
je 0x10006bbb
cmp eax, 0x20020
je 0x10006bbb
cmp eax, 0x201a0
je 0x10006bbb
cmp eax, 0x20110
je 0x10006bbb
cmp eax, 0x20120
je 0x10006bbb
cmp eax, 0x20121
jne 0x10006e80
mov eax, dword [ebp - 0x2d0]
mov eax, dword [eax + 0x618]
cmp eax, 0x45
je 0x10006e1d
cmp eax, 0x46
je 0x10006e1d
cmp eax, 0x100014
je 0x10006e1d
cmp eax, 0x100015
je 0x10006e1d
mov edx, dword [ebp - 0x2d4]
cmp edx, 0x470
jne 0x10006d0c
cmp eax, 0x888
mov eax, dword [0x100b0fa4]
jne 0x10006caa
add eax, 0xa3a2e2
lea ecx, [ebp - 0x2d8]
push eax
call fcn.10003300
mov eax, dword [ebp - 0x2d8]
push 1
push 2
push 0x90
push ecx
mov ecx, esp
mov dword [ecx], eax
call fcn.10008eb0
add esp, 0x10
jmp 0x10006e80
mov eax, dword [0x100b0fa4]
lea ecx, [ebp - 0x2cc]
add eax, 0xa3a2e2
mov word [ebp - 0x2bc], 0x1a8
push eax
call fcn.10003300
mov esi, dword [ebp - 0x2cc]
lea eax, [ebp - 0x1c]
push eax
push 0x40
push 2
push esi
mov dword [ebp - 0x20], 2
mov dword [ebp - 0x24], esi
call edi
test eax, eax
mov ax, word [ebp - 0x2bc]
setne byte [ebp - 0x18]
mov word [esi], ax
cmp byte [ebp - 0x18], 0
je 0x10006e80
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x14]
push ecx
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x24]
jmp 0x10006e7b
add eax, 0xa3a2e2
mov word [ebp - 0x2c0], 0x1a8
push eax
lea ecx, [ebp - 0x2dc]
call fcn.10003300
mov esi, dword [ebp - 0x2dc]
lea eax, [ebp - 0x2c]
push eax
push 0x40
push 2
push esi
mov dword [ebp - 0x30], 2
mov dword [ebp - 0x34], esi
call edi
test eax, eax
mov ax, word [ebp - 0x2c0]
setne byte [ebp - 0x28]
mov word [esi], ax
cmp byte [ebp - 0x28], 0
je 0x10006e80
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x14]
push ecx
push eax
push dword [ebp - 0x30]
push dword [ebp - 0x34]
jmp 0x10006e7b
cmp edx, 0x610
jne 0x10006dd2
cmp eax, 0xf6
je 0x10006d9b
cmp eax, 0xf5
je 0x10006d9b
cmp eax, 0x888
je 0x10006d9b
cmp eax, 0x777
je 0x10006d9b
mov eax, dword [0x100b0fa4]
lea ecx, [ebp - 0x2e0]
add eax, 0xa3a2e2
mov word [ebp - 0x2c4], 0x1a8
push eax
call fcn.10003300
mov esi, dword [ebp - 0x2e0]
lea eax, [ebp - 0x3c]
push eax
push 0x40
push 2
push esi
mov dword [ebp - 0x40], 2
mov dword [ebp - 0x44], esi
call edi
test eax, eax
mov ax, word [ebp - 0x2c4]
setne byte [ebp - 0x38]
mov word [esi], ax
cmp byte [ebp - 0x38], 0
je 0x10006e80
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0x14]
push ecx
push eax
push dword [ebp - 0x40]
push dword [ebp - 0x44]
jmp 0x10006e7b
mov eax, dword [0x100b0fa4]
lea ecx, [ebp - 0x2e4]
add eax, 0xa3a2e2
push eax
call fcn.10003300
mov eax, dword [ebp - 0x2e4]
push 1
push 2
push 0x90
push ecx
mov ecx, esp
mov dword [ecx], eax
call fcn.10008eb0
add esp, 0x10
jmp 0x10006e80
cmp eax, 0x888
je 0x10006de9
cmp eax, 0x76
je 0x10006de9
cmp eax, 0x777
jne 0x10006e80
mov eax, dword [0x100b0fa4]
lea ecx, [ebp - 0x2e8]
add eax, 0xa3a2e2
push eax
call fcn.10003300
mov eax, dword [ebp - 0x2e8]
push 1
push 2
push 0x90
push ecx
mov ecx, esp
mov dword [ecx], eax
call fcn.10008eb0
add esp, 0x10
jmp 0x10006e80
mov eax, dword [0x100b0fa4]
lea ecx, [ebp - 0x2ec]
add eax, 0xa3a2e2
mov word [ebp - 0x2c8], 0x1a8
push eax
call fcn.10003300
mov esi, dword [ebp - 0x2ec]
lea eax, [ebp - 0x4c]
push eax
push 0x40
push 2
push esi
mov dword [ebp - 0x50], 2
mov dword [ebp - 0x54], esi
call edi
test eax, eax
mov ax, word [ebp - 0x2c8]
setne byte [ebp - 0x48]
mov word [esi], ax
cmp byte [ebp - 0x48], 0
je 0x10006e80
mov eax, dword [ebp - 0x4c]
lea ecx, [ebp - 0x14]
push ecx
push eax
push dword [ebp - 0x50]
push dword [ebp - 0x54]
mov dword [ebp - 0x14], eax
call edi
mov eax, dword [0x100b100c]
mov ebx, dword [ebx + 8]
cmp ebx, dword [eax + 0x50]
jne 0x10006a95
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100459fc
mov esp, ebp
pop ebp
ret