Function at 0x1000d370
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1004a434]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
mov edx, str.effects2
push ebx
push esi
mov eax, ecx
nop dword [eax]
mov bl, byte [eax]
cmp bl, byte [edx]
jne 0x1000d3b0
test bl, bl
je 0x1000d3ac
mov bl, byte [eax + 1]
cmp bl, byte [edx + 1]
jne 0x1000d3b0
add eax, 2
add edx, 2
test bl, bl
jne 0x1000d390
xor eax, eax
jmp 0x1000d3b5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1000d4c8
cmp dword [0x13fab64], 0
lea eax, [ebp - 8]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push 4
mov dword [ebp - 8], 0x40
push 0x49b50a
je 0x1000d454
mov dword [ebp - 0x10], str.Effects
call esi
mov dword [0x49b50b], 0xffffaaaa
mov eax, dword [0x6bdaf0]
mov dword [ebp - 0xc], eax
push dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
call dword [0x1004ae7c]
lea eax, [ebp - 8]
mov dword [0x49b50b], 0xffffaaaa
push eax
push dword [ebp - 8]
push 4
push 0x49b50a
call esi
mov dword ds:[0x13fab64], 0
mov dword ds:[0x13fab68], 0
mov dword ds:[0x13fab6c], 0
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100148fc
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0xc], str.Effects
call esi
mov dword [0x49b50b], 0xffffaaaa
mov eax, dword [0x6bdaf0]
mov dword [ebp - 0x10], eax
push dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
call dword [0x1004ae7c]
lea eax, [ebp - 8]
mov dword [0x49b50b], 0xffffaaaa
push eax
push dword [ebp - 8]
push 4
push 0x49b50a
call esi
mov dword ds:[0x13fab64], 1
mov dword ds:[0x13fab68], 1
mov dword ds:[0x13fab6c], 1
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100148fc
mov esp, ebp
pop ebp
ret
mov edx, str._fps
mov eax, ecx
nop
mov bl, byte [eax]
cmp bl, byte [edx]
jne 0x1000d4f0
test bl, bl
je 0x1000d4ec
mov bl, byte [eax + 1]
cmp bl, byte [edx + 1]
jne 0x1000d4f0
add eax, 2
add edx, 2
test bl, bl
jne 0x1000d4d0
xor eax, eax
jmp 0x1000d4f5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1000d561
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x49b50a
mov dword [ebp - 8], 0x40
call esi
mov dword [0x49b50b], 0xffffaaaa
mov eax, dword [0x6bdaf0]
mov dword [ebp - 0xc], eax
push 0x606eab
mov ecx, dword [ebp - 0xc]
call dword [0x1004ae7c]
lea eax, [ebp - 8]
mov dword [0x49b50b], 0xffffaaaa
push eax
push dword [ebp - 8]
push 4
push 0x49b50a
call esi
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100148fc
mov esp, ebp
pop ebp
ret
mov edx, str._macroperga
mov eax, ecx
mov bl, byte [eax]
cmp bl, byte [edx]
jne 0x1000d588
test bl, bl
je 0x1000d584
mov bl, byte [eax + 1]
cmp bl, byte [edx + 1]
jne 0x1000d588
add eax, 2
add edx, 2
test bl, bl
jne 0x1000d568
xor eax, eax
jmp 0x1000d58d
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1000d692
movzx eax, byte [0x10081f3d]
sub eax, 0
je 0x1000d61e
sub eax, 1
jne 0x1000d7af
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x49b50a
mov dword [ebp - 0xc], str.Macro_Perga_OFF
mov dword [ebp - 8], 0x40
call esi
mov dword [0x49b50b], 0xffff0000
mov eax, dword [0x6bdaf0]
mov dword [ebp - 0x10], eax
push dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
call dword [0x1004ae7c]
lea eax, [ebp - 8]
mov dword [0x49b50b], 0xffffaaaa
push eax
push dword [ebp - 8]
push 4
push 0x49b50a
call esi
mov byte [0x10081f3d], 0
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100148fc
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x49b50a
mov dword [ebp - 0xc], str.Macro_Perga_ON
mov dword [ebp - 8], 0x40
call esi
mov dword [0x49b50b], 0xff00ff00
mov eax, dword [0x6bdaf0]
mov dword [ebp - 0x10], eax
push dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
call dword [0x1004ae7c]
lea eax, [ebp - 8]
mov dword [0x49b50b], 0xffffaaaa
push eax
push dword [ebp - 8]
push 4
push 0x49b50a
call esi
mov byte [0x10081f3d], 1
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100148fc
mov esp, ebp
pop ebp
ret
mov eax, str._macrojoia
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x1000d6b7
test dl, dl
je 0x1000d6b3
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x1000d6b7
add ecx, 2
add eax, 2
test dl, dl
jne 0x1000d697
xor eax, eax
jmp 0x1000d6bc
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1000d7c1
movzx eax, byte [0x10081f3c]
sub eax, 0
je 0x1000d74d
sub eax, 1
jne 0x1000d7af
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x49b50a
mov dword [ebp - 0xc], str.Macro_Joia_OFF
mov dword [ebp - 8], 0x40
call esi
mov dword [0x49b50b], 0xffff0000
mov eax, dword [0x6bdaf0]
mov dword [ebp - 0x10], eax
push dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
call dword [0x1004ae7c]
lea eax, [ebp - 8]
mov dword [0x49b50b], 0xffffaaaa
push eax
push dword [ebp - 8]
push 4
push 0x49b50a
call esi
mov byte [0x10081f3c], 0
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100148fc
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x49b50a
mov dword [ebp - 0xc], str.Macro_Joia_ON
mov dword [ebp - 8], 0x40
call esi
mov dword [0x49b50b], 0xff00ff00
mov eax, dword [0x6bdaf0]
mov dword [ebp - 0x10], eax
push dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
call dword [0x1004ae7c]
lea eax, [ebp - 8]
mov dword [0x49b50b], 0xffffaaaa
push eax
push dword [ebp - 8]
push 4
push 0x49b50a
call esi
mov byte [0x10081f3c], 1
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100148fc
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
pop esi
xor ecx, ebp
pop ebx
call fcn.100148fc
mov esp, ebp
pop ebp
ret