Function at 0x10006040
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov ecx, 1
mov edx, 0x10018968
xor eax, eax
push ebx
mov ebx, dword [0x10018900]
push esi
push edi
xor edi, edi
lock cmpxchg dword [edx], ecx
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
test eax, eax
je 0x10006092
nop dword [eax + eax]
cmp edi, 0x20
jae 0x10006079
push 0
jmp 0x1000607b
push 1
call esi
inc edi
mov ecx, 1
xor eax, eax
mov edx, 0x10018968
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x10006070
cmp dword [0x1001896c], 0
je 0x10006b50
test ebx, ebx
jne 0x100060ae
xor ecx, ecx
call fcn.1000e84e
mov ebx, eax
jmp 0x100060d3
mov ecx, dword [0x10018ea8]
xor edi, edi
test ecx, ecx
je 0x100060ce
mov edx, dword [0x10018ea0]
mov eax, edx
cmp ebx, dword [eax]
je 0x1000611b
inc edi
add eax, 0x2c
cmp edi, ecx
jb 0x100060c2
mov ebx, 4
xor eax, eax
mov ecx, 0x10018968
xchg dword [ecx], eax
test ebx, ebx
jne 0x10006b54
mov ecx, dword [0x10018900]
call fcn.1000ea7a
test eax, eax
je 0x10006161
mov ecx, dword [0x10018264]
mov eax, dword [0x10018934]
cmp eax, ecx
cmovg ecx, eax
cmp ecx, 0xfffffffe
jl 0x10006b82
push str.Failed_to_remove_hook._n
push 0xad
jmp 0x10006b73
cmp edi, 0xffffffff
je 0x100060ce
imul eax, edi, 0x2c
test byte [eax + edx + 0x14], 2
je 0x10006157
push 1
mov edx, edi
lea ecx, [ebp - 0x14]
call fcn.1000e6bd
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x100060d3
xor edx, edx
mov ecx, edi
call fcn.1000e77c
lea ecx, [ebp - 0x14]
mov ebx, eax
call fcn.1000e72e
jmp 0x100060d3
mov ebx, 6
jmp 0x100060d3
mov ebx, dword [0x10018908]
xor edi, edi
mov ecx, 1
xor eax, eax
mov edx, 0x10018968
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x100061a2
nop dword [eax]
cmp edi, 0x20
jae 0x10006189
push 0
jmp 0x1000618b
push 1
call esi
inc edi
mov ecx, 1
xor eax, eax
mov edx, 0x10018968
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x10006180
cmp dword [0x1001896c], 0
je 0x10006b2b
test ebx, ebx
jne 0x100061be
xor ecx, ecx
call fcn.1000e84e
mov edi, eax
jmp 0x100061e3
mov ecx, dword [0x10018ea8]
xor edx, edx
test ecx, ecx
je 0x100061de
mov edi, dword [0x10018ea0]
mov eax, edi
cmp ebx, dword [eax]
je 0x1000622f
inc edx
add eax, 0x2c
cmp edx, ecx
jb 0x100061d2
mov edi, 4
xor eax, eax
mov ecx, 0x10018968
xchg dword [ecx], eax
test edi, edi
jne 0x10006b2f
mov ecx, dword [0x10018908]
call fcn.1000ea7a
test eax, eax
je 0x100062fa
mov ecx, dword [0x10018264]
mov eax, dword [0x10018934]
cmp eax, ecx
cmovg ecx, eax
cmp ecx, 0xfffffffe
jl 0x10006b82
push str.Failed_to_remove_hook._n
push 0xb7
jmp 0x10006b73
cmp edx, 0xffffffff
je 0x100061de
imul ebx, edx, 0x2c
test byte [ebx + edi + 0x14], 2
je 0x100062f0
push 1
lea ecx, [ebp - 0x14]
call fcn.1000e6bd
mov edi, eax
add esp, 4
test edi, edi
jne 0x100061e3
mov edi, dword [0x10018ea0]
add edi, ebx
mov eax, dword [edi]
mov cl, byte [edi + 0x14]
and cl, 1
lea ebx, [eax - 5]
cmove ebx, eax
movzx eax, cl
lea ecx, [ebp - 4]
push ecx
push 0x40
lea eax, [eax*2 + 5]
push eax
push ebx
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1000629a
lea ecx, [ebp - 0x14]
lea edi, [eax + 0xa]
call fcn.1000e72e
jmp 0x100061e3
mov eax, dword [edi + 0xc]
test byte [edi + 0x14], 1
mov dword [ebx], eax
je 0x100062b5
mov ax, word [edi + 0x10]
mov word [ebx + 4], ax
mov al, byte [edi + 0x12]
mov byte [ebx + 6], al
jmp 0x100062bb
mov al, byte [edi + 0x10]
mov byte [ebx + 4], al
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 8]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [ebp - 8]
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
and byte [edi + 0x14], 0xf9
lea ecx, [ebp - 0x14]
xor edi, edi
call fcn.1000e72e
jmp 0x100061e3
mov edi, 6
jmp 0x100061e3
mov ebx, dword [0x10018914]
xor edi, edi
mov ecx, 1
xor eax, eax
mov edx, 0x10018968
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x10006338
cmp edi, 0x20
jae 0x1000631f
push 0
jmp 0x10006321
push 1
call esi
inc edi
mov ecx, 1
xor eax, eax
mov edx, 0x10018968
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x10006316
cmp dword [0x1001896c], 0
je 0x10006b06
test ebx, ebx
jne 0x10006354
xor ecx, ecx
call fcn.1000e84e
mov edi, eax
jmp 0x10006379
mov ecx, dword [0x10018ea8]
xor edx, edx
test ecx, ecx
je 0x10006374
mov edi, dword [0x10018ea0]
mov eax, edi
cmp ebx, dword [eax]
je 0x100063c5
inc edx
add eax, 0x2c
cmp edx, ecx
jb 0x10006368
mov edi, 4
xor eax, eax
mov ecx, 0x10018968
xchg dword [ecx], eax
test edi, edi
jne 0x10006b0a
mov ecx, dword [0x10018914]
call fcn.1000ea7a
test eax, eax
je 0x10006490
mov ecx, dword [0x10018264]
mov eax, dword [0x10018934]
cmp eax, ecx
cmovg ecx, eax
cmp ecx, 0xfffffffe
jl 0x10006b82
push str.Failed_to_remove_hook._n
push 0xcb
jmp 0x10006b73
cmp edx, 0xffffffff
je 0x10006374
imul ebx, edx, 0x2c
test byte [ebx + edi + 0x14], 2
je 0x10006486
push 1
lea ecx, [ebp - 0x14]
call fcn.1000e6bd
mov edi, eax
add esp, 4
test edi, edi
jne 0x10006379
mov edi, dword [0x10018ea0]
add edi, ebx
mov eax, dword [edi]
mov cl, byte [edi + 0x14]
and cl, 1
lea ebx, [eax - 5]
cmove ebx, eax
movzx eax, cl
lea ecx, [ebp - 8]
push ecx
push 0x40
lea eax, [eax*2 + 5]
push eax
push ebx
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10006430
lea ecx, [ebp - 0x14]
lea edi, [eax + 0xa]
call fcn.1000e72e
jmp 0x10006379
mov eax, dword [edi + 0xc]
test byte [edi + 0x14], 1
mov dword [ebx], eax
je 0x1000644b
mov ax, word [edi + 0x10]
mov word [ebx + 4], ax
mov al, byte [edi + 0x12]
mov byte [ebx + 6], al
jmp 0x10006451
mov al, byte [edi + 0x10]
mov byte [ebx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
and byte [edi + 0x14], 0xf9
lea ecx, [ebp - 0x14]
xor edi, edi
call fcn.1000e72e
jmp 0x10006379
mov edi, 6
jmp 0x10006379
mov ebx, dword [0x10018910]
xor edi, edi
mov ecx, 1
xor eax, eax
mov edx, 0x10018968
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x100064d2
nop dword [eax]
cmp edi, 0x20
jae 0x100064b9
push 0
jmp 0x100064bb
push 1
call esi
inc edi
mov ecx, 1
xor eax, eax
mov edx, 0x10018968
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x100064b0
cmp dword [0x1001896c], 0
je 0x10006add
test ebx, ebx
jne 0x100064ee
xor ecx, ecx
call fcn.1000e84e
mov edi, eax
jmp 0x10006513
mov ecx, dword [0x10018ea8]
xor edx, edx
test ecx, ecx
je 0x1000650e
mov edi, dword [0x10018ea0]
mov eax, edi
cmp ebx, dword [eax]
je 0x1000655f
inc edx
add eax, 0x2c
cmp edx, ecx
jb 0x10006502
mov edi, 4
xor eax, eax
mov ecx, 0x10018968
xchg dword [ecx], eax
test edi, edi
jne 0x10006ae1
mov ecx, dword [0x10018910]
call fcn.1000ea7a
test eax, eax
je 0x1000662a
mov ecx, dword [0x10018264]
mov eax, dword [0x10018934]
cmp eax, ecx
cmovg ecx, eax
cmp ecx, 0xfffffffe
jl 0x10006b82
push str.Failed_to_remove_hook._n
push 0xd5
jmp 0x10006b73
cmp edx, 0xffffffff
je 0x1000650e
imul ebx, edx, 0x2c
test byte [ebx + edi + 0x14], 2
je 0x10006620
push 1
lea ecx, [ebp - 0x14]
call fcn.1000e6bd
mov edi, eax
add esp, 4
test edi, edi
jne 0x10006513
mov edi, dword [0x10018ea0]
add edi, ebx
mov eax, dword [edi]
mov cl, byte [edi + 0x14]
and cl, 1
lea ebx, [eax - 5]
cmove ebx, eax
movzx eax, cl
lea ecx, [ebp - 8]
push ecx
push 0x40
lea eax, [eax*2 + 5]
push eax
push ebx
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x100065ca
lea ecx, [ebp - 0x14]
lea edi, [eax + 0xa]
call fcn.1000e72e
jmp 0x10006513
mov eax, dword [edi + 0xc]
test byte [edi + 0x14], 1
mov dword [ebx], eax
je 0x100065e5
mov ax, word [edi + 0x10]
mov word [ebx + 4], ax
mov al, byte [edi + 0x12]
mov byte [ebx + 6], al
jmp 0x100065eb
mov al, byte [edi + 0x10]
mov byte [ebx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
and byte [edi + 0x14], 0xf9
lea ecx, [ebp - 0x14]
xor edi, edi
call fcn.1000e72e
jmp 0x10006513
mov edi, 6
jmp 0x10006513
mov ebx, dword [0x100188dc]
xor edi, edi
mov ecx, 1
xor eax, eax
mov edx, 0x10018968
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x10006668
cmp edi, 0x20
jae 0x1000664f
push 0
jmp 0x10006651
push 1
call esi
inc edi
mov ecx, 1
xor eax, eax
mov edx, 0x10018968
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x10006646
cmp dword [0x1001896c], 0
je 0x10006ab1
test ebx, ebx
jne 0x10006684
xor ecx, ecx
call fcn.1000e84e
mov edi, eax
jmp 0x100066a9
mov ecx, dword [0x10018ea8]
xor edx, edx
test ecx, ecx
je 0x100066a4
mov edi, dword [0x10018ea0]
mov eax, edi
cmp ebx, dword [eax]
je 0x100066f5
inc edx
add eax, 0x2c
cmp edx, ecx
jb 0x10006698
mov edi, 4
xor eax, eax
mov ecx, 0x10018968
xchg dword [ecx], eax
test edi, edi
jne 0x10006ab5
mov ecx, dword [0x100188dc]
call fcn.1000ea7a
test eax, eax
je 0x100067c0
mov ecx, dword [0x10018264]
mov eax, dword [0x10018934]
cmp eax, ecx
cmovg ecx, eax
cmp ecx, 0xfffffffe
jl 0x10006b82
push str.Failed_to_remove_hook._n
push 0xdf
jmp 0x10006b73
cmp edx, 0xffffffff
je 0x100066a4
imul ebx, edx, 0x2c
test byte [ebx + edi + 0x14], 2
je 0x100067b6
push 1
lea ecx, [ebp - 0x14]
call fcn.1000e6bd
mov edi, eax
add esp, 4
test edi, edi
jne 0x100066a9
mov edi, dword [0x10018ea0]
add edi, ebx
mov eax, dword [edi]
mov cl, byte [edi + 0x14]
and cl, 1
lea ebx, [eax - 5]
cmove ebx, eax
movzx eax, cl
lea ecx, [ebp - 8]
push ecx
push 0x40
lea eax, [eax*2 + 5]
push eax
push ebx
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10006760
lea ecx, [ebp - 0x14]
lea edi, [eax + 0xa]
call fcn.1000e72e
jmp 0x100066a9
mov eax, dword [edi + 0xc]
test byte [edi + 0x14], 1
mov dword [ebx], eax
je 0x1000677b
mov ax, word [edi + 0x10]
mov word [ebx + 4], ax
mov al, byte [edi + 0x12]
mov byte [ebx + 6], al
jmp 0x10006781
mov al, byte [edi + 0x10]
mov byte [ebx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
and byte [edi + 0x14], 0xf9
lea ecx, [ebp - 0x14]
xor edi, edi
call fcn.1000e72e
jmp 0x100066a9
mov edi, 6
jmp 0x100066a9
mov ebx, dword [0x100188f0]
xor edi, edi
mov ecx, 1
xor eax, eax
mov edx, 0x10018968
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x10006802
nop dword [eax]
cmp edi, 0x20
jae 0x100067e9
push 0
jmp 0x100067eb
push 1
call esi
inc edi
mov ecx, 1
xor eax, eax
mov edx, 0x10018968
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x100067e0
cmp dword [0x1001896c], 0
je 0x10006a85
test ebx, ebx
jne 0x1000681e
xor ecx, ecx
call fcn.1000e84e
mov edi, eax
jmp 0x10006843
mov ecx, dword [0x10018ea8]
xor edx, edx
test ecx, ecx
je 0x1000683e
mov edi, dword [0x10018ea0]
mov eax, edi
cmp ebx, dword [eax]
je 0x1000688f
inc edx
add eax, 0x2c
cmp edx, ecx
jb 0x10006832
mov edi, 4
xor eax, eax
mov ebx, 0x10018968
xchg dword [ebx], eax
test edi, edi
jne 0x10006a89
mov ecx, dword [0x100188f0]
call fcn.1000ea7a
test eax, eax
je 0x1000695a
mov ecx, dword [0x10018264]
mov eax, dword [0x10018934]
cmp eax, ecx
cmovg ecx, eax
cmp ecx, 0xfffffffe
jl 0x10006b82
push str.Failed_to_remove_hook._n
push 0xea
jmp 0x10006b73
cmp edx, 0xffffffff
je 0x1000683e
imul ebx, edx, 0x2c
test byte [ebx + edi + 0x14], 2
je 0x10006950
push 1
lea ecx, [ebp - 0x14]
call fcn.1000e6bd
mov edi, eax
add esp, 4
test edi, edi
jne 0x10006843
mov edi, dword [0x10018ea0]
add edi, ebx
mov eax, dword [edi]
mov cl, byte [edi + 0x14]
and cl, 1
lea ebx, [eax - 5]
cmove ebx, eax
movzx eax, cl
lea ecx, [ebp - 8]
push ecx
push 0x40
lea eax, [eax*2 + 5]
push eax
push ebx
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x100068fa
lea ecx, [ebp - 0x14]
lea edi, [eax + 0xa]
call fcn.1000e72e
jmp 0x10006843
mov eax, dword [edi + 0xc]
test byte [edi + 0x14], 1
mov dword [ebx], eax
je 0x10006915
mov ax, word [edi + 0x10]
mov word [ebx + 4], ax
mov al, byte [edi + 0x12]
mov byte [ebx + 6], al
jmp 0x1000691b
mov al, byte [edi + 0x10]
mov byte [ebx + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
and byte [edi + 0x14], 0xf9
lea ecx, [ebp - 0x14]
xor edi, edi
call fcn.1000e72e
jmp 0x10006843
mov edi, 6
jmp 0x10006843
xor edi, edi
mov ecx, 1
xor eax, eax
lock cmpxchg dword [ebx], ecx
test eax, eax
je 0x1000698d
nop dword [eax + eax]
cmp edi, 0x20
jae 0x10006979
push 0
jmp 0x1000697b
push 1
call esi
inc edi
mov ecx, 1
xor eax, eax
lock cmpxchg dword [ebx], ecx
test eax, eax
jne 0x10006970
cmp dword [0x1001896c], 0
je 0x10006a59
xor ecx, ecx
call fcn.1000e84e
test eax, eax
jne 0x10006a59
mov eax, dword [0x10018e94]
mov dword [0x10018e94], 0
test eax, eax
je 0x100069d4
mov edi, dword [sym.imp.KERNEL32.dll_VirtualFree]
mov esi, dword [eax]
push 0x8000
push 0
push eax
call edi
mov eax, esi
test esi, esi
jne 0x100069c2
push dword [0x10018ea0]
push 0
push dword [0x1001896c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [0x1001896c]
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
mov dword [0x1001896c], 0
xor eax, eax
mov dword [0x10018ea0], 0
mov dword [0x10018ea4], 0
mov dword [0x10018ea8], 0
xchg dword [ebx], eax
mov ecx, dword [0x10018264]
cmp dword [0x10018934], ecx
cmovg ecx, dword [0x10018934]
test ecx, ecx
js 0x10006a50
push str.Hooks_successfully_disabled_and_removed._n
push 0xf4
push str.C:UsersTOTOMAN2_source_reposStalker_COP_Qols_Moddllmain.cpp
push 0
call fcn.1000ca20
add esp, 0x10
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
xchg dword [ebx], eax
mov ecx, dword [0x10018264]
mov eax, dword [0x10018934]
cmp eax, ecx
cmovg ecx, eax
cmp ecx, 0xfffffffe
jl 0x10006b82
push str.Failed_to_uninitialize_MinHook._n
push 0xf0
jmp 0x10006b73
xor eax, eax
xchg dword [edx], eax
mov ecx, dword [0x10018264]
mov eax, dword [0x10018934]
cmp eax, ecx
cmovg ecx, eax
cmp ecx, 0xfffffffe
jl 0x10006b82
push str.Failed_to_disable_hook._n
push 0xe6
jmp 0x10006b73
xor eax, eax
xchg dword [edx], eax
mov ecx, dword [0x10018264]
mov eax, dword [0x10018934]
cmp eax, ecx
cmovg ecx, eax
cmp ecx, 0xfffffffe
jl 0x10006b82
push str.Failed_to_disable_hook._n
push 0xdb
jmp 0x10006b73
xor eax, eax
xchg dword [edx], eax
mov ecx, dword [0x10018264]
mov eax, dword [0x10018934]
cmp eax, ecx
cmovg ecx, eax
cmp ecx, 0xfffffffe
jl 0x10006b82
push str.Failed_to_disable_hook._n
push 0xd1
jmp 0x10006b73
xor eax, eax
xchg dword [edx], eax
mov ecx, dword [0x10018264]
mov eax, dword [0x10018934]
cmp eax, ecx
cmovg ecx, eax
cmp ecx, 0xfffffffe
jl 0x10006b82
push str.Failed_to_disable_hook._n
push 0xc7
jmp 0x10006b73
xor eax, eax
xchg dword [edx], eax
mov ecx, dword [0x10018264]
mov eax, dword [0x10018934]
cmp eax, ecx
cmovg ecx, eax
cmp ecx, 0xfffffffe
jl 0x10006b82
push str.Failed_to_disable_hook._n
push 0xb3
jmp 0x10006b73
xor eax, eax
xchg dword [edx], eax
mov ecx, dword [0x10018264]
mov eax, dword [0x10018934]
cmp eax, ecx
cmovg ecx, eax
cmp ecx, 0xfffffffe
jl 0x10006b82
push str.Failed_to_disable_hook._n
push 0xa9
push str.C:UsersTOTOMAN2_source_reposStalker_COP_Qols_Moddllmain.cpp
push 0xfffffffffffffffe
call fcn.1000ca20
add esp, 0x10
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret