Function at 0x100060f0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1000c040]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
mov ecx, str._camera
push ebx
push esi
mov eax, edx
nop dword [eax]
mov bl, byte [eax]
cmp bl, byte [ecx]
jne 0x10006130
test bl, bl
je 0x1000612c
mov bl, byte [eax + 1]
cmp bl, byte [ecx + 1]
jne 0x10006130
add eax, 2
add ecx, 2
test bl, bl
jne 0x10006110
xor eax, eax
jmp 0x10006135
sbb eax, eax
or eax, 1
test eax, eax
jne 0x100061f3
cmp dword [0x1000cd00], 0
lea eax, [ebp - 8]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push 4
mov dword [ebp - 8], 0x40
push 0x49099a
je 0x10006193
mov dword [0x1000cd00], 0
mov dword [ebp - 0xc], str.Camera_Zoom_Desativada
call esi
mov dword [0x49099b], 0xffff0000
mov eax, dword [0x684bb0]
mov dword [ebp - 0x10], eax
push dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
call dword [0x1000c094]
jmp 0x100061c4
mov dword [0x1000cd00], 1
mov dword [ebp - 0x10], str.Camera_Zoom_Ativada
call esi
mov dword [0x49099b], 0xffffff00
mov eax, dword [0x684bb0]
mov dword [ebp - 0xc], eax
push dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
call dword [0x1000c094]
lea eax, [ebp - 8]
mov dword [0x49099b], 0xffffaaaa
push eax
push dword [ebp - 8]
push 4
push 0x49099a
call esi
mov eax, 1
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10006933
mov esp, ebp
pop ebp
ret
mov ecx, str._noeffects
mov eax, edx
nop word [eax + eax]
mov bl, byte [eax]
cmp bl, byte [ecx]
jne 0x10006220
test bl, bl
je 0x1000621c
mov bl, byte [eax + 1]
cmp bl, byte [ecx + 1]
jne 0x10006220
add eax, 2
add ecx, 2
test bl, bl
jne 0x10006200
xor eax, eax
jmp 0x10006225
sbb eax, eax
or eax, 1
test eax, eax
jne 0x10006338
cmp dword [0x9362d8], 0
lea eax, [ebp - 8]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push 4
mov dword [ebp - 8], 0x40
push 0x49099a
je 0x100062c4
mov dword [ebp - 0x10], str.Effects_ON
call esi
mov dword [0x49099b], 0xffffaaaa
mov eax, dword [0x684bb0]
mov dword [ebp - 0xc], eax
push dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
call dword [0x1000c094]
lea eax, [ebp - 8]
mov dword [0x49099b], 0xffffaaaa
push eax
push dword [ebp - 8]
push 4
push 0x49099a
call esi
mov dword ds:[0x9362d8], 0
mov dword ds:[0x9362dc], 0
mov dword ds:[0x9362e0], 0
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10006933
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x10], str.Effects_OFF
call esi
mov dword [0x49099b], 0xffffaaaa
mov eax, dword [0x684bb0]
mov dword [ebp - 0xc], eax
push dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
call dword [0x1000c094]
lea eax, [ebp - 8]
mov dword [0x49099b], 0xffffaaaa
push eax
push dword [ebp - 8]
push 4
push 0x49099a
call esi
mov dword ds:[0x9362d8], 1
mov dword ds:[0x9362dc], 1
mov dword ds:[0x9362e0], 1
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10006933
mov esp, ebp
pop ebp
ret
mov ecx, str._effects2
mov eax, edx
nop
mov bl, byte [eax]
cmp bl, byte [ecx]
jne 0x10006360
test bl, bl
je 0x1000635c
mov bl, byte [eax + 1]
cmp bl, byte [ecx + 1]
jne 0x10006360
add eax, 2
add ecx, 2
test bl, bl
jne 0x10006340
xor eax, eax
jmp 0x10006365
sbb eax, eax
or eax, 1
test eax, eax
je 0x100066bd
mov ecx, str.effects2
mov eax, edx
mov bl, byte [eax]
cmp bl, byte [ecx]
jne 0x10006394
test bl, bl
je 0x10006390
mov bl, byte [eax + 1]
cmp bl, byte [ecx + 1]
jne 0x10006394
add eax, 2
add ecx, 2
test bl, bl
jne 0x10006374
xor eax, eax
jmp 0x10006399
sbb eax, eax
or eax, 1
test eax, eax
je 0x100066bd
mov ecx, str._autogrupo
mov eax, edx
mov bl, byte [eax]
cmp bl, byte [ecx]
jne 0x100063c8
test bl, bl
je 0x100063c4
mov bl, byte [eax + 1]
cmp bl, byte [ecx + 1]
jne 0x100063c8
add eax, 2
add ecx, 2
test bl, bl
jne 0x100063a8
xor eax, eax
jmp 0x100063cd
sbb eax, eax
or eax, 1
test eax, eax
jne 0x100064d2
movzx eax, byte [0x1000c721]
sub eax, 0
je 0x1000645e
sub eax, 1
jne 0x100067b6
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x49099a
mov dword [ebp - 0x10], str.Auto_Grupo_Destivado
mov dword [ebp - 8], 0x40
call esi
mov dword [0x49099b], 0xffff0000
mov eax, dword [0x684bb0]
mov dword [ebp - 0xc], eax
push dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
call dword [0x1000c094]
lea eax, [ebp - 8]
mov dword [0x49099b], 0xffffaaaa
push eax
push dword [ebp - 8]
push 4
push 0x49099a
call esi
mov byte [0x1000c721], 0
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10006933
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push 0x49099a
mov dword [ebp - 0x10], str.Auto_Grupo_Ativado
mov dword [ebp - 8], 0x40
call esi
mov dword [0x49099b], 0xff00ff00
mov eax, dword [0x684bb0]
mov dword [ebp - 0xc], eax
push dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
call dword [0x1000c094]
lea eax, [ebp - 8]
mov dword [0x49099b], 0xffffaaaa
push eax
push dword [ebp - 8]
push 4
push 0x49099a
call esi
mov byte [0x1000c721], 1
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10006933
mov esp, ebp
pop ebp
ret
mov ecx, str._macropergaon
mov eax, edx
nop dword [eax]
mov bl, byte [eax]
cmp bl, byte [ecx]
jne 0x10006500
test bl, bl
je 0x100064fc
mov bl, byte [eax + 1]
cmp bl, byte [ecx + 1]
jne 0x10006500
add eax, 2
add ecx, 2
test bl, bl
jne 0x100064e0
xor eax, eax
jmp 0x10006505
sbb eax, eax
or eax, 1
test eax, eax
jne 0x100065b6
cmp byte [0x1000c720], 0
lea eax, [ebp - 8]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push 4
mov dword [ebp - 8], 0x40
push 0x49099a
jne 0x1000658a
mov dword [ebp - 0x10], str.Macro_de_Pergaminho_Ativado
call esi
mov dword [0x49099b], 0xff00ff00
mov eax, dword [0x684bb0]
mov dword [ebp - 0xc], eax
push dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
call dword [0x1000c094]
lea eax, [ebp - 8]
mov dword [0x49099b], 0xffffaaaa
push eax
push dword [ebp - 8]
push 4
push 0x49099a
call esi
mov byte [0x1000c720], 1
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10006933
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x10], str.Macro_de_Pergaminho_J
call esi
mov dword [0x49099b], 0xff00ff00
mov eax, dword [0x684bb0]
mov dword [ebp - 0xc], eax
push dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
call dword [0x1000c094]
jmp 0x10006691
mov eax, str._macropergaoff
nop dword [eax + eax]
mov cl, byte [edx]
cmp cl, byte [eax]
jne 0x100065e0
test cl, cl
je 0x100065dc
mov cl, byte [edx + 1]
cmp cl, byte [eax + 1]
jne 0x100065e0
add edx, 2
add eax, 2
test cl, cl
jne 0x100065c0
xor eax, eax
jmp 0x100065e5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x100061de
cmp byte [0x1000c720], 0
lea eax, [ebp - 8]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push 4
mov dword [ebp - 8], 0x40
push 0x49099a
je 0x1000666a
mov dword [ebp - 0x10], str.Macro_de_Pergaminho_Desativado
call esi
mov dword [0x49099b], 0xffff0000
mov eax, dword [0x684bb0]
mov dword [ebp - 0xc], eax
push dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
call dword [0x1000c094]
lea eax, [ebp - 8]
mov dword [0x49099b], 0xffffaaaa
push eax
push dword [ebp - 8]
push 4
push 0x49099a
call esi
mov byte [0x1000c720], 0
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10006933
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x10], str.Macro_de_Pergaminho_j
call esi
mov dword [0x49099b], 0xffff0000
mov eax, dword [0x684bb0]
mov dword [ebp - 0xc], eax
push dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
call dword [0x1000c094]
lea eax, [ebp - 8]
mov dword [0x49099b], 0xffffaaaa
push eax
push dword [ebp - 8]
push 4
push 0x49099a
call esi
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10006933
mov esp, ebp
pop ebp
ret
cmp dword [0x9362d8], 0
lea eax, [ebp - 8]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push eax
push 0x40
push 4
mov dword [ebp - 8], 0x40
push 0x49099a
je 0x10006754
mov dword [ebp - 0x10], str.Effects_ON
call esi
mov dword [0x49099b], 0xffffaaaa
mov eax, dword [0x684bb0]
mov dword [ebp - 0xc], eax
push dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
call dword [0x1000c094]
lea eax, [ebp - 8]
mov dword [0x49099b], 0xffffaaaa
push eax
push dword [ebp - 8]
push 4
push 0x49099a
call esi
mov dword ds:[0x9362d8], 0
mov dword ds:[0x9362dc], 0
mov dword ds:[0x9362e0], 0
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10006933
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x10], str.Effects_OFF
call esi
mov dword [0x49099b], 0xffffaaaa
mov eax, dword [0x684bb0]
mov dword [ebp - 0xc], eax
push dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
call dword [0x1000c094]
lea eax, [ebp - 8]
mov dword [0x49099b], 0xffffaaaa
push eax
push dword [ebp - 8]
push 4
push 0x49099a
call esi
mov dword ds:[0x9362d8], 1
mov dword ds:[0x9362dc], 1
mov dword ds:[0x9362e0], 1
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.10006933
mov esp, ebp
pop ebp
ret