Function at 0x1006c9b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1013e00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x101eb0e4]
lea eax, [ebp - 8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push 4
push 0x4d6c2c
call edi
lea eax, [ebp - 8]
mov dword [0x4d6c2c], esi
push eax
push dword [ebp - 8]
push 4
push 0x4d6c2c
call edi
push 5
call fcn.100d7d9e
add esp, 4
mov dword [ebp - 8], 0
mov ebx, eax
lea eax, [ebp - 8]
push eax
push 0x40
push 5
mov dword [ebx], 0x90909090
push 0x4d8af0
mov byte [ebx + 4], 0x90
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1006ca50
mov eax, dword [ebx]
mov ecx, 0x4d8af0
mov dword [ecx], eax
mov al, byte [ebx + 4]
mov byte [ecx + 4], al
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
mov dword [ebp - 0xc], 0
push 5
push ecx
call edi
test eax, eax
jne 0x1006ca52
call esi
push 0xe9
mov edx, 0x1006c740
mov ecx, 0x4d8af0
call fcn.100c7ff0
push 5
call fcn.100d7d9e
add esp, 8
mov dword [ebp - 8], 0
mov ebx, eax
lea eax, [ebp - 8]
push eax
push 0x40
push 5
mov dword [ebx], 0x90909090
push 0x63d1ce
mov byte [ebx + 4], 0x90
call edi
test eax, eax
je 0x1006cabc
mov eax, dword [ebx]
mov ecx, 0x63d1ce
mov dword [ecx], eax
mov al, byte [ebx + 4]
mov byte [ecx + 4], al
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
mov dword [ebp - 0xc], 0
push 5
push ecx
call edi
test eax, eax
jne 0x1006cabe
call esi
push 0xe9
mov edx, 0x1006c7d0
mov ecx, 0x63d1ce
call fcn.100c7ff0
push 5
call fcn.100d7d9e
add esp, 8
mov dword [ebp - 8], 0
mov ebx, eax
lea eax, [ebp - 8]
push eax
push 0x40
push 5
mov dword [ebx], 0x90909090
push 0x63d40f
mov byte [ebx + 4], 0x90
call edi
test eax, eax
je 0x1006cb28
mov eax, dword [ebx]
mov ecx, 0x63d40f
mov dword [ecx], eax
mov al, byte [ebx + 4]
mov byte [ecx + 4], al
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
mov dword [ebp - 0xc], 0
push 5
push ecx
call edi
test eax, eax
jne 0x1006cb2a
call esi
push 0xe9
mov edx, 0x1006c800
mov ecx, 0x63d40f
call fcn.100c7ff0
push 5
call fcn.100d7d9e
add esp, 8
mov dword [ebp - 8], 0
mov ebx, eax
lea eax, [ebp - 8]
push eax
push 0x40
push 5
mov dword [ebx], 0x90909090
push 0x63d1eb
mov byte [ebx + 4], 0x90
call edi
test eax, eax
je 0x1006cb94
mov eax, dword [ebx]
mov ecx, 0x63d1eb
mov dword [ecx], eax
mov al, byte [ebx + 4]
mov byte [ecx + 4], al
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
mov dword [ebp - 0xc], 0
push 5
push ecx
call edi
test eax, eax
jne 0x1006cb96
call esi
push 0xe9
mov edx, 0x1006c830
mov ecx, 0x63d1eb
call fcn.100c7ff0
push 5
call fcn.100d7d9e
add esp, 8
mov dword [ebp - 8], 0
mov ebx, eax
lea eax, [ebp - 8]
push eax
push 0x40
push 5
mov dword [ebx], 0x90909090
push 0x63d42c
mov byte [ebx + 4], 0x90
call edi
test eax, eax
je 0x1006cc00
mov eax, dword [ebx]
mov ecx, 0x63d42c
mov dword [ecx], eax
mov al, byte [ebx + 4]
mov byte [ecx + 4], al
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
mov dword [ebp - 0xc], 0
push 5
push ecx
call edi
test eax, eax
jne 0x1006cc02
call esi
push 0xe9
mov edx, 0x1006c860
mov ecx, 0x63d42c
call fcn.100c7ff0
push 5
call fcn.100d7d9e
add esp, 8
mov dword [ebp - 8], 0
mov ebx, eax
lea eax, [ebp - 8]
push eax
push 0x40
push 5
mov dword [ebx], 0x90909090
push 0x63d208
mov byte [ebx + 4], 0x90
call edi
test eax, eax
je 0x1006cc6c
mov eax, dword [ebx]
mov ecx, 0x63d208
mov dword [ecx], eax
mov al, byte [ebx + 4]
mov byte [ecx + 4], al
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
mov dword [ebp - 0xc], 0
push 5
push ecx
call edi
test eax, eax
jne 0x1006cc6e
call esi
push 0xe9
mov edx, 0x1006c890
mov ecx, 0x63d208
call fcn.100c7ff0
push 5
call fcn.100d7d9e
add esp, 8
mov dword [ebp - 8], 0
mov ebx, eax
lea eax, [ebp - 8]
push eax
push 0x40
push 5
mov dword [ebx], 0x90909090
push 0x63d449
mov byte [ebx + 4], 0x90
call edi
test eax, eax
je 0x1006ccd8
mov eax, dword [ebx]
mov ecx, 0x63d449
mov dword [ecx], eax
mov al, byte [ebx + 4]
mov byte [ecx + 4], al
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
mov dword [ebp - 0xc], 0
push 5
push ecx
call edi
test eax, eax
jne 0x1006ccda
call esi
push 0xe9
mov edx, 0x1006c8c0
mov ecx, 0x63d449
call fcn.100c7ff0
push 5
call fcn.100d7d9e
add esp, 8
mov dword [ebp - 8], 0
mov ebx, eax
lea eax, [ebp - 8]
push eax
push 0x40
push 5
mov dword [ebx], 0x90909090
push 0x63d225
mov byte [ebx + 4], 0x90
call edi
test eax, eax
je 0x1006cd44
mov eax, dword [ebx]
mov ecx, 0x63d225
mov dword [ecx], eax
mov al, byte [ebx + 4]
mov byte [ecx + 4], al
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
mov dword [ebp - 0xc], 0
push 5
push ecx
call edi
test eax, eax
jne 0x1006cd46
call esi
push 0xe9
mov edx, 0x1006c8f0
mov ecx, 0x63d225
call fcn.100c7ff0
push 5
call fcn.100d7d9e
add esp, 8
mov dword [ebp - 8], 0
mov ebx, eax
lea eax, [ebp - 8]
push eax
push 0x40
push 5
mov dword [ebx], 0x90909090
push 0x63d466
mov byte [ebx + 4], 0x90
call edi
test eax, eax
je 0x1006cdb0
mov eax, dword [ebx]
mov ecx, 0x63d466
mov dword [ecx], eax
mov al, byte [ebx + 4]
mov byte [ecx + 4], al
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
mov dword [ebp - 0xc], 0
push 5
push ecx
call edi
test eax, eax
jne 0x1006cdb2
call esi
push 0xe9
mov edx, 0x1006c920
mov ecx, 0x63d466
call fcn.100c7ff0
push 5
call fcn.100d7d9e
add esp, 8
mov dword [ebp - 8], 0
mov ebx, eax
lea eax, [ebp - 8]
push eax
push 0x40
push 5
mov dword [ebx], 0x90909090
push 0x63d242
mov byte [ebx + 4], 0x90
call edi
test eax, eax
je 0x1006ce1c
mov eax, dword [ebx]
mov ecx, 0x63d242
mov dword [ecx], eax
mov al, byte [ebx + 4]
mov byte [ecx + 4], al
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
mov dword [ebp - 0xc], 0
push 5
push ecx
call edi
test eax, eax
jne 0x1006ce1e
call esi
push 0xe9
mov edx, 0x1006c950
mov ecx, 0x63d242
call fcn.100c7ff0
push 5
call fcn.100d7d9e
add esp, 8
mov dword [ebp - 8], 0
mov ebx, eax
lea eax, [ebp - 8]
push eax
push 0x40
push 5
mov dword [ebx], 0x90909090
push 0x63d483
mov byte [ebx + 4], 0x90
call edi
test eax, eax
je 0x1006ce88
mov eax, dword [ebx]
mov ecx, 0x63d483
mov dword [ecx], eax
mov al, byte [ebx + 4]
mov byte [ecx + 4], al
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
mov dword [ebp - 0xc], 0
push 5
push ecx
call edi
test eax, eax
jne 0x1006ce8a
call esi
push 0xe9
mov edx, 0x1006c980
mov ecx, 0x63d483
call fcn.100c7ff0
add esp, 4
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
mov bl, 0xe9
push eax
push 0x40
push 1
push 0x57f0fc
call edi
test eax, eax
je 0x1006cedf
mov eax, 0x57f0fc
mov byte [eax], bl
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
mov dword [ebp - 0xc], 0
push 1
push 0x57f0fc
call edi
test eax, eax
jne 0x1006cee1
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 1
push 0x57f0fd
mov bl, 0x4a
call edi
test eax, eax
je 0x1006cf1f
mov eax, 0x57f0fd
mov byte [eax], bl
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
mov dword [ebp - 0xc], 0
push 1
push 0x57f0fd
call edi
test eax, eax
jne 0x1006cf21
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 1
push 0x57f0fe
mov bl, 1
call edi
test eax, eax
je 0x1006cf5f
mov eax, 0x57f0fe
mov byte [eax], bl
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
mov dword [ebp - 0xc], 0
push 1
push 0x57f0fe
call edi
test eax, eax
jne 0x1006cf61
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 1
push 0x57f0ff
xor bl, bl
call edi
test eax, eax
je 0x1006cf9f
mov eax, 0x57f0ff
mov byte [eax], bl
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
mov dword [ebp - 0xc], 0
push 1
push 0x57f0ff
call edi
test eax, eax
jne 0x1006cfa1
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 1
push 0x57f100
xor bl, bl
call edi
test eax, eax
je 0x1006cfdf
mov eax, 0x57f100
mov byte [eax], bl
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
mov dword [ebp - 0xc], 0
push 1
push 0x57f100
call edi
test eax, eax
jne 0x1006cfe1
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 1
push 0x57f101
mov bl, 0x90
call edi
test eax, eax
je 0x1006d01f
mov eax, 0x57f101
mov byte [eax], bl
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
mov dword [ebp - 0xc], 0
push 1
push 0x57f101
call edi
test eax, eax
jne 0x1006d021
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0x40
push 1
push 0x503834
mov bl, 0xeb
call edi
test eax, eax
je 0x1006d05f
mov eax, 0x503834
mov byte [eax], bl
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
mov dword [ebp - 0xc], 0
push 1
push 0x503834
call edi
test eax, eax
jne 0x1006d061
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100d7712
mov esp, ebp
pop ebp
ret