Function at 0x1006d420
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [0x101f47f4]
lea eax, [ebp - 4]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push 4
push 0x4d6c2c
call edi
lea eax, [ebp - 4]
mov dword [0x4d6c2c], esi
push eax
push dword [ebp - 4]
push 4
push 0x4d6c2c
call edi
push ecx
mov edx, 5
mov ecx, 0x4d8af0
call fcn.100ce7f0
add esp, 4
mov byte [ebp - 0x10], 0xe9
mov eax, 0x1006d1b0
mov dword [ebp - 4], 0
sub eax, 0x4d8af5
mov dword [ebp - 0xf], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x4d8af0
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1006d4c5
mov eax, dword [ebp - 0x10]
mov ecx, 0x4d8af0
mov dword [ecx], eax
mov al, byte [ebp - 0xc]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 5
push ecx
call edi
test eax, eax
jne 0x1006d4c7
call esi
push ecx
mov edx, 5
mov ecx, 0x63d1ce
call fcn.100ce7f0
add esp, 4
mov byte [ebp - 0x10], 0xe9
mov eax, 0x1006d240
mov dword [ebp - 4], 0
sub eax, 0x63d1d3
mov dword [ebp - 0xf], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x63d1ce
call edi
test eax, eax
je 0x1006d52c
mov eax, dword [ebp - 0x10]
mov ecx, 0x63d1ce
mov dword [ecx], eax
mov al, byte [ebp - 0xc]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 5
push ecx
call edi
test eax, eax
jne 0x1006d52e
call esi
push ecx
mov edx, 5
mov ecx, 0x63d40f
call fcn.100ce7f0
add esp, 4
mov byte [ebp - 0x10], 0xe9
mov eax, 0x1006d270
mov dword [ebp - 4], 0
sub eax, 0x63d414
mov dword [ebp - 0xf], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x63d40f
call edi
test eax, eax
je 0x1006d593
mov eax, dword [ebp - 0x10]
mov ecx, 0x63d40f
mov dword [ecx], eax
mov al, byte [ebp - 0xc]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 5
push ecx
call edi
test eax, eax
jne 0x1006d595
call esi
push ecx
mov edx, 5
mov ecx, 0x63d1eb
call fcn.100ce7f0
add esp, 4
mov byte [ebp - 0x10], 0xe9
mov eax, 0x1006d2a0
mov dword [ebp - 4], 0
sub eax, 0x63d1f0
mov dword [ebp - 0xf], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x63d1eb
call edi
test eax, eax
je 0x1006d5fa
mov eax, dword [ebp - 0x10]
mov ecx, 0x63d1eb
mov dword [ecx], eax
mov al, byte [ebp - 0xc]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 5
push ecx
call edi
test eax, eax
jne 0x1006d5fc
call esi
push ecx
mov edx, 5
mov ecx, 0x63d42c
call fcn.100ce7f0
add esp, 4
mov byte [ebp - 0x10], 0xe9
mov eax, 0x1006d2d0
mov dword [ebp - 4], 0
sub eax, 0x63d431
mov dword [ebp - 0xf], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x63d42c
call edi
test eax, eax
je 0x1006d661
mov eax, dword [ebp - 0x10]
mov ecx, 0x63d42c
mov dword [ecx], eax
mov al, byte [ebp - 0xc]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 5
push ecx
call edi
test eax, eax
jne 0x1006d663
call esi
push ecx
mov edx, 5
mov ecx, 0x63d208
call fcn.100ce7f0
add esp, 4
mov byte [ebp - 0x10], 0xe9
mov eax, 0x1006d300
mov dword [ebp - 4], 0
sub eax, 0x63d20d
mov dword [ebp - 0xf], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x63d208
call edi
test eax, eax
je 0x1006d6c8
mov eax, dword [ebp - 0x10]
mov ecx, 0x63d208
mov dword [ecx], eax
mov al, byte [ebp - 0xc]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 5
push ecx
call edi
test eax, eax
jne 0x1006d6ca
call esi
push ecx
mov edx, 5
mov ecx, 0x63d449
call fcn.100ce7f0
add esp, 4
mov byte [ebp - 0x10], 0xe9
mov eax, 0x1006d330
mov dword [ebp - 4], 0
sub eax, 0x63d44e
mov dword [ebp - 0xf], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x63d449
call edi
test eax, eax
je 0x1006d72f
mov eax, dword [ebp - 0x10]
mov ecx, 0x63d449
mov dword [ecx], eax
mov al, byte [ebp - 0xc]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 5
push ecx
call edi
test eax, eax
jne 0x1006d731
call esi
push ecx
mov edx, 5
mov ecx, 0x63d225
call fcn.100ce7f0
add esp, 4
mov byte [ebp - 0x10], 0xe9
mov eax, 0x1006d360
mov dword [ebp - 4], 0
sub eax, 0x63d22a
mov dword [ebp - 0xf], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x63d225
call edi
test eax, eax
je 0x1006d796
mov eax, dword [ebp - 0x10]
mov ecx, 0x63d225
mov dword [ecx], eax
mov al, byte [ebp - 0xc]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 5
push ecx
call edi
test eax, eax
jne 0x1006d798
call esi
push ecx
mov edx, 5
mov ecx, 0x63d466
call fcn.100ce7f0
add esp, 4
mov byte [ebp - 0x10], 0xe9
mov eax, 0x1006d390
mov dword [ebp - 4], 0
sub eax, 0x63d46b
mov dword [ebp - 0xf], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x63d466
call edi
test eax, eax
je 0x1006d7fd
mov eax, dword [ebp - 0x10]
mov ecx, 0x63d466
mov dword [ecx], eax
mov al, byte [ebp - 0xc]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 5
push ecx
call edi
test eax, eax
jne 0x1006d7ff
call esi
push ecx
mov edx, 5
mov ecx, 0x63d242
call fcn.100ce7f0
add esp, 4
mov byte [ebp - 0x10], 0xe9
mov eax, 0x1006d3c0
mov dword [ebp - 4], 0
sub eax, 0x63d247
mov dword [ebp - 0xf], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x63d242
call edi
test eax, eax
je 0x1006d864
mov eax, dword [ebp - 0x10]
mov ecx, 0x63d242
mov dword [ecx], eax
mov al, byte [ebp - 0xc]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 5
push ecx
call edi
test eax, eax
jne 0x1006d866
call esi
push ecx
mov edx, 5
mov ecx, 0x63d483
call fcn.100ce7f0
add esp, 4
mov byte [ebp - 0x10], 0xe9
mov eax, 0x1006d3f0
mov dword [ebp - 4], 0
sub eax, 0x63d488
mov dword [ebp - 0xf], eax
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x63d483
call edi
test eax, eax
je 0x1006d8cb
mov eax, dword [ebp - 0x10]
mov ecx, 0x63d483
mov dword [ecx], eax
mov al, byte [ebp - 0xc]
mov byte [ecx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 5
push ecx
call edi
test eax, eax
jne 0x1006d8cd
call esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x40
push 1
push 0x57f0fc
mov bl, 0xe9
call edi
test eax, eax
je 0x1006d90b
mov eax, 0x57f0fc
mov byte [eax], bl
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 1
push 0x57f0fc
call edi
test eax, eax
jne 0x1006d90d
call esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x40
push 1
push 0x57f0fd
mov bl, 0x4a
call edi
test eax, eax
je 0x1006d94b
mov eax, 0x57f0fd
mov byte [eax], bl
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 1
push 0x57f0fd
call edi
test eax, eax
jne 0x1006d94d
call esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x40
push 1
push 0x57f0fe
mov bl, 1
call edi
test eax, eax
je 0x1006d98b
mov eax, 0x57f0fe
mov byte [eax], bl
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 1
push 0x57f0fe
call edi
test eax, eax
jne 0x1006d98d
call esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x40
push 1
push 0x57f0ff
xor bl, bl
call edi
test eax, eax
je 0x1006d9cb
mov eax, 0x57f0ff
mov byte [eax], bl
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 1
push 0x57f0ff
call edi
test eax, eax
jne 0x1006d9cd
call esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x40
push 1
push 0x57f100
xor bl, bl
call edi
test eax, eax
je 0x1006da0b
mov eax, 0x57f100
mov byte [eax], bl
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 1
push 0x57f100
call edi
test eax, eax
jne 0x1006da0d
call esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x40
push 1
push 0x57f101
mov bl, 0x90
call edi
test eax, eax
je 0x1006da4b
mov eax, 0x57f101
mov byte [eax], bl
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 1
push 0x57f101
call edi
test eax, eax
jne 0x1006da4d
call esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x40
push 1
push 0x503834
mov bl, 0xeb
call edi
test eax, eax
je 0x1006da8b
mov eax, 0x503834
mov byte [eax], bl
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0
push 1
push 0x503834
call edi
test eax, eax
jne 0x1006da8d
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret