Function at 0x10006700
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004ef15
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x1009f040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edx, edx
cmp byte [0x10122493], dl
je 0x10006783
mov ecx, 0xb2
nop word [eax + eax]
mov al, byte [edx + 0x1009a420]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x24], al
and ecx, 0x800000ff
jns 0x1000675d
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x13
jl 0x10006740
mov byte [ebp - 0x11], 0
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 0
mov dword [ebp - 0x28], eax
push dword [ebp - 0x28]
mov eax, 0x495200
call eax
add esp, 4
jmp 0x100067d1
mov ecx, 0x40
nop dword [eax + eax]
mov al, byte [edx + 0x1009a434]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x24], al
and ecx, 0x800000ff
jns 0x100067ad
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x13
jl 0x10006790
mov byte [ebp - 0x11], 0
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 1
mov dword [ebp - 0x28], eax
push dword [ebp - 0x28]
mov eax, 0x495200
call eax
add esp, 4
xor edx, edx
cmp byte [0x1012248e], dl
je 0x10006823
mov ecx, 0x3e
mov al, byte [edx + str.zM_6]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x24], al
and ecx, 0x800000ff
jns 0x100067fd
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x13
jl 0x100067e0
mov byte [ebp - 0x11], 0
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 2
mov dword [ebp - 0x28], eax
push dword [ebp - 0x28]
mov eax, 0x495200
call eax
add esp, 4
jmp 0x10006871
mov ecx, 0x31
nop dword [eax + eax]
mov al, byte [edx + str.u_RCcY_MT_Z__42br]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x24], al
and ecx, 0x800000ff
jns 0x1000684d
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x13
jl 0x10006830
mov byte [ebp - 0x11], 0
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 3
mov dword [ebp - 0x28], eax
push dword [ebp - 0x28]
mov eax, 0x495200
call eax
add esp, 4
xor edx, edx
cmp byte [0x1012248f], dl
je 0x100068c3
mov ecx, 6
mov al, byte [edx + str._AgnOemobj0_]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x20], al
and ecx, 0x800000ff
jns 0x1000689d
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xc
jl 0x10006880
mov byte [ebp - 0x14], 0
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 4
mov dword [ebp - 0x28], eax
push dword [ebp - 0x28]
mov eax, 0x495200
call eax
add esp, 4
jmp 0x10006911
mov ecx, 0x9d
nop dword [eax + eax]
mov al, byte [edx + 0x1009a480]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x20], al
and ecx, 0x800000ff
jns 0x100068ed
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xc
jl 0x100068d0
mov byte [ebp - 0x14], 0
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 5
mov dword [ebp - 0x28], eax
push dword [ebp - 0x28]
mov eax, 0x495200
call eax
add esp, 4
xor edx, edx
cmp byte [0x1012248c], dl
je 0x10006963
mov ecx, 0xbc
mov al, byte [edx + 0x1009a490]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x1c], al
and ecx, 0x800000ff
jns 0x1000693d
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xb
jl 0x10006920
mov byte [ebp - 0x11], 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 6
mov dword [ebp - 0x28], eax
push dword [ebp - 0x28]
mov eax, 0x495200
call eax
add esp, 4
jmp 0x100069b1
mov ecx, 0x4c
nop dword [eax + eax]
mov al, byte [edx + str.g_t_.6ug]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x1c], al
and ecx, 0x800000ff
jns 0x1000698d
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xb
jl 0x10006970
mov byte [ebp - 0x11], 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 7
mov dword [ebp - 0x28], eax
push dword [ebp - 0x28]
mov eax, 0x495200
call eax
add esp, 4
xor edx, edx
cmp byte [0x1012242c], dl
je 0x10006a03
mov ecx, 0x6a
mov al, byte [edx + 0x1009a4a8]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x20], al
and ecx, 0x800000ff
jns 0x100069dd
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xf
jl 0x100069c0
mov byte [ebp - 0x11], 0
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 8
mov dword [ebp - 0x28], eax
push dword [ebp - 0x28]
mov eax, 0x495200
call eax
add esp, 4
jmp 0x10006a51
mov ecx, 0x70
nop dword [eax + eax]
mov al, byte [edx + 0x1009a4b8]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x20], al
and ecx, 0x800000ff
jns 0x10006a2d
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xf
jl 0x10006a10
mov byte [ebp - 0x11], 0
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 9
mov dword [ebp - 0x28], eax
push dword [ebp - 0x28]
mov eax, 0x495200
call eax
add esp, 4
xor edx, edx
cmp byte [0x1012242f], dl
je 0x10006aa3
mov ecx, 0x2d
mov al, byte [edx + 0x1009a4c8]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x24], al
and ecx, 0x800000ff
jns 0x10006a7d
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x13
jl 0x10006a60
mov byte [ebp - 0x11], 0
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x28], eax
push dword [ebp - 0x28]
mov eax, 0x495200
call eax
add esp, 4
jmp 0x10006af1
mov ecx, 1
nop dword [eax + eax]
mov al, byte [edx + str.Q_v_ciOeeIcomt2]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x24], al
and ecx, 0x800000ff
jns 0x10006acd
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x13
jl 0x10006ab0
mov byte [ebp - 0x11], 0
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x28], eax
push dword [ebp - 0x28]
mov eax, 0x495200
call eax
add esp, 4
xor edx, edx
cmp byte [0x10122496], dl
je 0x10006b43
mov ecx, 0x31
mov al, byte [edx + 0x1009a4f0]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x24], al
and ecx, 0x800000ff
jns 0x10006b1d
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x10
jl 0x10006b00
mov byte [ebp - 0x14], 0
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x28], eax
push dword [ebp - 0x28]
mov eax, 0x495200
call eax
add esp, 4
jmp 0x10006b91
mov ecx, 0x62
nop dword [eax + eax]
mov al, byte [edx + 0x1009a504]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x24], al
and ecx, 0x800000ff
jns 0x10006b6d
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x10
jl 0x10006b50
mov byte [ebp - 0x14], 0
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x28], eax
push dword [ebp - 0x28]
mov eax, 0x495200
call eax
add esp, 4
xor edx, edx
cmp byte [0x1012248d], dl
je 0x10006be3
mov ecx, 0x5c
mov al, byte [edx + str.we3_f]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x20], al
and ecx, 0x800000ff
jns 0x10006bbd
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xd
jl 0x10006ba0
mov byte [ebp - 0x13], 0
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x28], eax
push dword [ebp - 0x28]
mov eax, 0x495200
call eax
add esp, 4
jmp 0x10006c31
mov ecx, 0x2c
nop dword [eax + eax]
mov al, byte [edx + str._ak_C_s_ZS_B]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x20], al
and ecx, 0x800000ff
jns 0x10006c0d
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xd
jl 0x10006bf0
mov byte [ebp - 0x13], 0
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x28], eax
push dword [ebp - 0x28]
mov eax, 0x495200
call eax
add esp, 4
cmp byte [0x1012242e], 0
mov dword [ebp - 0x1c], 0x776f6853
mov dword [ebp - 0x18], 0x20445548
je 0x10006c6a
mov word [ebp - 0x14], 0x30
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x28], eax
push dword [ebp - 0x28]
mov eax, 0x495200
call eax
add esp, 4
jmp 0x10006c8a
mov word [ebp - 0x14], 0x31
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x28], eax
push dword [ebp - 0x28]
mov eax, 0x495200
call eax
add esp, 4
cmp byte [0x10122490], 0
mov dword [ebp - 0x1c], 0x6172542b
mov dword [ebp - 0x18], 0x73726563
mov byte [ebp - 0x12], 0
je 0x10006cc7
mov word [ebp - 0x14], 0x3120
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 0x12
mov dword [ebp - 0x28], eax
push dword [ebp - 0x28]
mov eax, 0x495200
call eax
add esp, 4
jmp 0x10006ce7
mov word [ebp - 0x14], 0x3020
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 0x13
mov dword [ebp - 0x28], eax
push dword [ebp - 0x28]
mov eax, 0x495200
call eax
add esp, 4
cmp byte [0x10122491], 0
je 0x10006cfa
movss xmm0, dword [0x1009b3d4]
jmp 0x10006cfd
xorps xmm0, xmm0
lea eax, [ebp - 0x28]
movss dword [0x38391d60], xmm0
cmp byte [0x1012242d], 0
mov ebx, 0x574
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push 2
lea edi, [ebx + 1]
push 0x37122c77
je 0x10006d34
call esi
mov word [0x37122c77], di
jmp 0x10006d3d
call esi
mov word [0x37122c77], bx
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
push 2
push 0x37122c77
call esi
cmp byte [0x10122494], 0
lea eax, [ebp - 0x28]
push eax
push 0x40
push 2
push 0x3712324a
je 0x10006d6e
call esi
mov word [0x3712324a], di
jmp 0x10006d77
call esi
mov word [0x3712324a], bx
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
push 2
push 0x3712324a
call esi
cmp byte [0x10122492], 0
lea eax, [ebp - 0x28]
push eax
push 0x40
push 2
push 0x37122fd4
je 0x10006da6
call esi
mov eax, 0x275
jmp 0x10006dad
call esi
mov eax, 0x274
mov word [0x37122fd4], ax
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
push 2
push 0x37122fd4
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004d560
mov esp, ebp
pop ebp
ret