Function at 0x10006210
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1000c040]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
mov ecx, str._fps
push ebx
push esi
mov eax, edx
nop dword [eax]
mov bl, byte [eax]
cmp bl, byte [ecx]
jne 0x10006250
test bl, bl
je 0x1000624c
mov bl, byte [eax + 1]
cmp bl, byte [ecx + 1]
jne 0x10006250
add eax, 2
add ecx, 2
test bl, bl
jne 0x10006230
xor eax, eax
jmp 0x10006255
sbb eax, eax
or eax, 1
test eax, eax
jne 0x100062c1
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x49b50a
mov dword [ebp - 8], 0x40
call esi
mov dword [0x49b50b], 0xffff0000
mov eax, dword [0x6bdaf0]
mov dword [ebp - 0xc], eax
push 0x606eab
mov ecx, dword [ebp - 0xc]
call dword [0x1000c094]
lea eax, [ebp - 8]
mov dword [0x49b50b], 0xffffaaaa
push eax
push dword [ebp - 8]
push 4
push 0x49b50a
call esi
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10007116
mov esp, ebp
pop ebp
ret
mov ecx, str.speedatkon
mov eax, edx
mov bl, byte [eax]
cmp bl, byte [ecx]
jne 0x100062e8
test bl, bl
je 0x100062e4
mov bl, byte [eax + 1]
cmp bl, byte [ecx + 1]
jne 0x100062e8
add eax, 2
add ecx, 2
test bl, bl
jne 0x100062c8
xor eax, eax
jmp 0x100062ed
sbb eax, eax
or eax, 1
test eax, eax
je 0x100065e2
mov ecx, str.opencargo
mov eax, edx
nop dword [eax]
mov bl, byte [eax]
cmp bl, byte [ecx]
jne 0x10006320
test bl, bl
je 0x1000631c
mov bl, byte [eax + 1]
cmp bl, byte [ecx + 1]
jne 0x10006320
add eax, 2
add ecx, 2
test bl, bl
jne 0x10006300
xor eax, eax
jmp 0x10006325
sbb eax, eax
or eax, 1
test eax, eax
je 0x100065e2
mov ecx, str.allon
mov eax, edx
mov bl, byte [eax]
cmp bl, byte [ecx]
jne 0x10006354
test bl, bl
je 0x10006350
mov bl, byte [eax + 1]
cmp bl, byte [ecx + 1]
jne 0x10006354
add eax, 2
add ecx, 2
test bl, bl
jne 0x10006334
xor eax, eax
jmp 0x10006359
sbb eax, eax
or eax, 1
test eax, eax
je 0x100065e2
mov ecx, str.indexon
mov eax, edx
mov bl, byte [eax]
cmp bl, byte [ecx]
jne 0x10006388
test bl, bl
je 0x10006384
mov bl, byte [eax + 1]
cmp bl, byte [ecx + 1]
jne 0x10006388
add eax, 2
add ecx, 2
test bl, bl
jne 0x10006368
xor eax, eax
jmp 0x1000638d
sbb eax, eax
or eax, 1
test eax, eax
je 0x100065e2
mov ecx, str._Macroon
mov eax, edx
nop dword [eax]
mov bl, byte [eax]
cmp bl, byte [ecx]
jne 0x100063c0
test bl, bl
je 0x100063bc
mov bl, byte [eax + 1]
cmp bl, byte [ecx + 1]
jne 0x100063c0
add eax, 2
add ecx, 2
test bl, bl
jne 0x100063a0
xor eax, eax
jmp 0x100063c5
sbb eax, eax
or eax, 1
test eax, eax
je 0x1000652b
mov ecx, str._macroon
mov eax, edx
mov bl, byte [eax]
cmp bl, byte [ecx]
jne 0x100063f4
test bl, bl
je 0x100063f0
mov bl, byte [eax + 1]
cmp bl, byte [ecx + 1]
jne 0x100063f4
add eax, 2
add ecx, 2
test bl, bl
jne 0x100063d4
xor eax, eax
jmp 0x100063f9
sbb eax, eax
or eax, 1
test eax, eax
je 0x1000652b
mov ecx, str._Macrooff
mov eax, edx
mov bl, byte [eax]
cmp bl, byte [ecx]
jne 0x10006428
test bl, bl
je 0x10006424
mov bl, byte [eax + 1]
cmp bl, byte [ecx + 1]
jne 0x10006428
add eax, 2
add ecx, 2
test bl, bl
jne 0x10006408
xor eax, eax
jmp 0x1000642d
sbb eax, eax
or eax, 1
test eax, eax
je 0x10006474
mov eax, str._macrooff
mov cl, byte [edx]
cmp cl, byte [eax]
jne 0x10006456
test cl, cl
je 0x10006452
mov cl, byte [edx + 1]
cmp cl, byte [eax + 1]
jne 0x10006456
add edx, 2
add eax, 2
test cl, cl
jne 0x10006436
xor eax, eax
jmp 0x1000645b
sbb eax, eax
or eax, 1
test eax, eax
je 0x10006474
mov eax, 1
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10007116
mov esp, ebp
pop ebp
ret
cmp byte [0x1000c654], 0
lea eax, [ebp - 8]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push 4
mov dword [ebp - 8], 0x40
push 0x49b50a
je 0x100064f1
mov dword [ebp - 0xc], str.Macro_de_Pergaminho_Desativado
call esi
mov dword [0x49b50b], 0xffff0000
mov eax, dword [0x6bdaf0]
mov dword [ebp - 0x10], eax
push dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
call dword [0x1000c094]
lea eax, [ebp - 8]
mov dword [0x49b50b], 0xffffaaaa
push eax
push dword [ebp - 8]
push 4
push 0x49b50a
call esi
mov byte [0x1000c654], 0
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10007116
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x10], str.Macro_de_Pergaminho_j
call esi
mov dword [0x49b50b], 0xffff0000
mov eax, dword [0x6bdaf0]
mov dword [ebp - 0xc], eax
push dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
call dword [0x1000c094]
lea eax, [ebp - 8]
mov dword [0x49b50b], 0xffffaaaa
push eax
jmp 0x100062a3
cmp byte [0x1000c654], 0
lea eax, [ebp - 8]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push 4
mov dword [ebp - 8], 0x40
push 0x49b50a
jne 0x100065a8
mov dword [ebp - 0x10], str.Macro_de_Pergaminho_Ativado
call esi
mov dword [0x49b50b], 0xff00ff00
mov eax, dword [0x6bdaf0]
mov dword [ebp - 0xc], eax
push dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
call dword [0x1000c094]
lea eax, [ebp - 8]
mov dword [0x49b50b], 0xffffaaaa
push eax
push dword [ebp - 8]
push 4
push 0x49b50a
call esi
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
mov byte [0x1000c654], 1
pop ebx
call fcn.10007116
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x10], str.Macro_de_Pergaminho_J
call esi
mov dword [0x49b50b], 0xff00ff00
mov eax, dword [0x6bdaf0]
mov dword [ebp - 0xc], eax
push dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
call dword [0x1000c094]
lea eax, [ebp - 8]
mov dword [0x49b50b], 0xffffaaaa
push eax
jmp 0x100062a3
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3