Function at 0x10006a30
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Inject apc
Patch process command line

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100094bd
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x68
mov eax, dword [0x1000e008]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov eax, ecx
mov dword [ebp - 0x6c], eax
mov ecx, dword [ebx + 0xc]
mov edi, dword [ebx + 8]
push 0x40
push 0x3000
push 0x100
push 0
mov dword [ebp - 0x64], ecx
mov ecx, dword [ebx + 0x10]
push eax
mov dword [ebp - 0x74], ecx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0x68], eax
test eax, eax
jne 0x10006ab5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x64]
mov dword [ecx], eax
mov eax, 0x10400001
jmp 0x10006c35
push 0
push 0x2a
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x38], esi
mov esi, dword [ebp - 0x6c]
push ecx
push eax
push esi
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x34], 0xebec8b55
mov dword [ebp - 0x30], 0x5d8b5300
mov dword [ebp - 0x2c], 0x473ff08
mov dword [ebp - 0x28], 0x850853ff
mov dword [ebp - 0x24], 0x890674c0
mov dword [ebp - 0x20], 0x1043c603
mov dword [ebp - 0x1c], 0xc25d5b15
mov word [ebp - 0x18], 4
mov dword [ebp - 0x3c], edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x10006b37
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x64]
push 0x8000
push 0
mov dword [ecx], eax
mov eax, dword [ebp - 0x68]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov eax, 0x10400002
jmp 0x10006c35
xorps xmm0, xmm0
mov dword [ebp - 0x44], 0
movups xmmword [ebp - 0x5c], xmm0
push 0x1000a350
movq qword [ebp - 0x4c], xmm0
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
test edi, edi
je 0x10006bc8
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtQueryInformationProcess
push edi
call esi
push str.NtQuerySystemInformation
push edi
mov dword [ebp - 0x48], eax
call esi
cmp dword [ebp - 0x48], 0
mov dword [ebp - 0x44], eax
je 0x10006bc8
test eax, eax
je 0x10006bc8
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x50], 0x10000
mov dword [ebp - 0x58], 0
call fcn.100054e0
mov edi, dword [ebp - 0x6c]
mov dword [ebp - 4], 0
test edi, edi
je 0x10006c1e
cmp dword [ebp - 0x58], 0
jne 0x10006be8
lea ecx, [ebp - 0x5c]
call fcn.100054e0
test al, al
je 0x10006c1e
push edi
mov dword [ebp - 0x4c], edi
call dword [sym.imp.KERNEL32.dll_GetProcessId]
mov edx, dword [ebp - 0x5c]
mov edi, eax
mov esi, dword [edx]
lea ecx, [esi + edx]
cmp ecx, edx
je 0x10006c13
cmp dword [edx + 0x44], edi
je 0x10006c53
add edx, esi
mov dword [ebp - 0x5c], edx
mov esi, dword [edx]
lea eax, [edx + esi]
cmp eax, edx
jne 0x10006c00
cmp dword [edx + 0x44], edi
je 0x10006c53
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x5c], eax
mov esi, 0x10200001
mov eax, dword [ebp - 0x58]
test eax, eax
je 0x10006c33
push eax
call fcn.1000829d
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10008286
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
xor al, al
lea ecx, [edx + 0xb8]
mov byte [ebp - 0x5d], al
mov eax, dword [ebp - 0x68]
add eax, 0xc
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x58], 0
mov dword [ebp - 0x54], ecx
je 0x10006cd0
cmp dword [ecx + 0x38], 0xf
je 0x10006cca
mov esi, dword [ecx + 0x24]
test esi, esi
je 0x10006cca
push esi
push 0
push 0x10
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edi, eax
test edi, edi
je 0x10006cc4
push dword [ebp - 0x68]
push edi
push dword [ebp - 0x70]
call dword [sym.imp.KERNEL32.dll_QueueUserAPC]
test eax, eax
je 0x10006cb2
push 0
push 0
push 0
push esi
mov byte [ebp - 0x5d], 1
call dword [sym.imp.USER32.dll_PostThreadMessageW]
jmp 0x10006cbd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x64]
mov dword [ecx], eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x54]
cmp dword [ebp - 0x58], 0
jne 0x10006ce2
lea ecx, [ebp - 0x5c]
call fcn.100054e0
test al, al
je 0x10006d0b
mov ecx, dword [ebp - 0x54]
mov edx, dword [ebp - 0x5c]
xor eax, eax
cmp dword [edx + 4], eax
je 0x10006d02
lea esi, [edx + 0xdc]
nop
mov edi, dword [ecx + 0x24]
inc eax
cmp dword [esi], edi
mov edi, dword [edx + 4]
je 0x10006d2e
add esi, 0x40
cmp eax, edi
jne 0x10006cf0
lea eax, [edx + 0xb8]
mov dword [ebp - 0x54], eax
cmp byte [ebp - 0x5d], 0
jne 0x10006d3a
push 0x8000
push 0
push dword [ebp - 0x68]
push dword [ebp - 0x6c]
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov esi, 0x10400005
jmp 0x10006c23
cmp eax, edi
je 0x10006d02
add ecx, 0x40
jmp 0x10006c67
mov eax, dword [ebp - 0x64]
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov dword [eax], 0
call edi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x64], edx
mov dword [eax], 0
push 0
push 4
push eax
push dword [ebp - 0x68]
push dword [ebp - 0x6c]
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
call edi
sub eax, dword [ebp - 0x70]
sbb edx, dword [ebp - 0x64]
test edx, edx
ja 0x10006d99
jb 0x10006d86
cmp eax, 0x7d0
ja 0x10006d99
push 0xa
call esi
mov eax, dword [ebp - 0x74]
cmp dword [eax], 0
je 0x10006d60
xor esi, esi
jmp 0x10006c23
mov esi, 0x10400006
jmp 0x10006c23