Function at 0x1000d010
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10048434]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
mov edx, str.effects2
push ebx
push esi
mov eax, ecx
nop dword [eax]
mov bl, byte [eax]
cmp bl, byte [edx]
jne 0x1000d050
test bl, bl
je 0x1000d04c
mov bl, byte [eax + 1]
cmp bl, byte [edx + 1]
jne 0x1000d050
add eax, 2
add edx, 2
test bl, bl
jne 0x1000d030
xor eax, eax
jmp 0x1000d055
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1000d168
cmp dword [0x13fab64], 0
lea eax, [ebp - 8]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push 4
mov dword [ebp - 8], 0x40
push 0x49b50a
je 0x1000d0f4
mov dword [ebp - 0x10], str.Effects
call esi
mov dword [0x49b50b], 0xffffaaaa
mov eax, dword [0x6bdaf0]
mov dword [ebp - 0xc], eax
push dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
call dword [0x10057aac]
lea eax, [ebp - 8]
mov dword [0x49b50b], 0xffffaaaa
push eax
push dword [ebp - 8]
push 4
push 0x49b50a
call esi
mov dword ds:[0x13fab64], 0
mov dword ds:[0x13fab68], 0
mov dword ds:[0x13fab6c], 0
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001401b
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0xc], str.Effects
call esi
mov dword [0x49b50b], 0xffffaaaa
mov eax, dword [0x6bdaf0]
mov dword [ebp - 0x10], eax
push dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
call dword [0x10057aac]
lea eax, [ebp - 8]
mov dword [0x49b50b], 0xffffaaaa
push eax
push dword [ebp - 8]
push 4
push 0x49b50a
call esi
mov dword ds:[0x13fab64], 1
mov dword ds:[0x13fab68], 1
mov dword ds:[0x13fab6c], 1
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001401b
mov esp, ebp
pop ebp
ret
mov edx, str._fps
mov eax, ecx
nop
mov bl, byte [eax]
cmp bl, byte [edx]
jne 0x1000d190
test bl, bl
je 0x1000d18c
mov bl, byte [eax + 1]
cmp bl, byte [edx + 1]
jne 0x1000d190
add eax, 2
add edx, 2
test bl, bl
jne 0x1000d170
xor eax, eax
jmp 0x1000d195
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1000d201
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x49b50a
mov dword [ebp - 8], 0x40
call esi
mov dword [0x49b50b], 0xffffaaaa
mov eax, dword [0x6bdaf0]
mov dword [ebp - 0xc], eax
push 0x606eab
mov ecx, dword [ebp - 0xc]
call dword [0x10057aac]
lea eax, [ebp - 8]
mov dword [0x49b50b], 0xffffaaaa
push eax
push dword [ebp - 8]
push 4
push 0x49b50a
call esi
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001401b
mov esp, ebp
pop ebp
ret
mov edx, str._macroperga
mov eax, ecx
mov bl, byte [eax]
cmp bl, byte [edx]
jne 0x1000d228
test bl, bl
je 0x1000d224
mov bl, byte [eax + 1]
cmp bl, byte [edx + 1]
jne 0x1000d228
add eax, 2
add edx, 2
test bl, bl
jne 0x1000d208
xor eax, eax
jmp 0x1000d22d
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1000d332
movzx eax, byte [0x1008eb39]
sub eax, 0
je 0x1000d2be
sub eax, 1
jne 0x1000d44f
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x49b50a
mov dword [ebp - 0xc], str.Macro_Perga_OFF
mov dword [ebp - 8], 0x40
call esi
mov dword [0x49b50b], 0xffff0000
mov eax, dword [0x6bdaf0]
mov dword [ebp - 0x10], eax
push dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
call dword [0x10057aac]
lea eax, [ebp - 8]
mov dword [0x49b50b], 0xffffaaaa
push eax
push dword [ebp - 8]
push 4
push 0x49b50a
call esi
mov byte [0x1008eb39], 0
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001401b
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x49b50a
mov dword [ebp - 0xc], str.Macro_Perga_ON
mov dword [ebp - 8], 0x40
call esi
mov dword [0x49b50b], 0xff00ff00
mov eax, dword [0x6bdaf0]
mov dword [ebp - 0x10], eax
push dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
call dword [0x10057aac]
lea eax, [ebp - 8]
mov dword [0x49b50b], 0xffffaaaa
push eax
push dword [ebp - 8]
push 4
push 0x49b50a
call esi
mov byte [0x1008eb39], 1
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001401b
mov esp, ebp
pop ebp
ret
mov eax, str._macrojoia
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x1000d357
test dl, dl
je 0x1000d353
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x1000d357
add ecx, 2
add eax, 2
test dl, dl
jne 0x1000d337
xor eax, eax
jmp 0x1000d35c
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1000d461
movzx eax, byte [0x1008eb38]
sub eax, 0
je 0x1000d3ed
sub eax, 1
jne 0x1000d44f
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x49b50a
mov dword [ebp - 0xc], str.Macro_Joia_OFF
mov dword [ebp - 8], 0x40
call esi
mov dword [0x49b50b], 0xffff0000
mov eax, dword [0x6bdaf0]
mov dword [ebp - 0x10], eax
push dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
call dword [0x10057aac]
lea eax, [ebp - 8]
mov dword [0x49b50b], 0xffffaaaa
push eax
push dword [ebp - 8]
push 4
push 0x49b50a
call esi
mov byte [0x1008eb38], 0
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001401b
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x49b50a
mov dword [ebp - 0xc], str.Macro_Joia_ON
mov dword [ebp - 8], 0x40
call esi
mov dword [0x49b50b], 0xff00ff00
mov eax, dword [0x6bdaf0]
mov dword [ebp - 0x10], eax
push dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
call dword [0x10057aac]
lea eax, [ebp - 8]
mov dword [0x49b50b], 0xffffaaaa
push eax
push dword [ebp - 8]
push 4
push 0x49b50a
call esi
mov byte [0x1008eb38], 1
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001401b
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
pop esi
xor ecx, ebp
pop ebx
call fcn.1001401b
mov esp, ebp
pop ebp
ret