Function at 0x1012df14
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
push ebx
push esi
push edi
mov edi, dword [0x101c0bb0]
mov esi, ecx
mov byte [ebp - 1], dl
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x40], edi
mov eax, dword [edi + 0x1a6c]
mov byte [eax + 0x84], 1
mov ebx, dword [edi + 0x1a6c]
cmp byte [ebx + 0x87], 0
jne 0x1012e255
mov ecx, dword [ebx + 0xc4]
xor edx, edx
mov eax, dword [ebx + 0xcc]
push dword [eax + ecx*4 - 4]
mov ecx, esi
call fcn.100f1430
mov esi, eax
add esp, 4
mov dword [ebp - 0xc], esi
cmp dword [edi + 0x1aa4], esi
jne 0x1012da49
mov dword [edi + 0x1aa8], esi
cmp dword [edi + 0x1adc], esi
jne 0x1012da58
mov byte [edi + 0x1ae0], 1
mov edx, dword [ebp - 0x28]
mov eax, edx
cmp edx, 0xffffffff
jae 0x1012da78
mov cl, byte [eax]
test cl, cl
je 0x1012da78
cmp cl, 0x23
jne 0x1012da72
cmp byte [eax + 1], cl
je 0x1012da78
inc eax
cmp eax, 0xffffffff
jb 0x1012da62
movss xmm0, dword [edi + 0x1930]
xorps xmm7, xmm7
cmp edx, eax
jne 0x1012da8c
xorps xmm1, xmm1
jmp 0x1012dad2
movss xmm3, dword [0x101afe18]
movaps xmm2, xmm0
push 0
push eax
push edx
push ecx
mov ecx, dword [edi + 0x192c]
lea eax, [ebp - 0x30]
mov dword [esp], 0xbf800000
push eax
call fcn.10104640
movss xmm0, dword [ebp - 0x30]
xorps xmm7, xmm7
addss xmm0, dword [0x101afc28]
cvttss2si eax, xmm0
movss xmm0, dword [ebp - 0x2c]
movd xmm1, eax
cvtdq2ps xmm1, xmm1
mov ecx, dword [ebp + 0xc]
movss dword [ebp - 0x44], xmm0
movss dword [ebp - 0x48], xmm1
movss xmm2, dword [ecx + 4]
ucomiss xmm2, xmm7
movss dword [ebp - 0x18], xmm2
lahf
test ah, 0x44
jp 0x1012dafa
movaps xmm2, xmm0
movss dword [ebp - 0x18], xmm0
movss xmm0, dword [ecx]
ucomiss xmm0, xmm7
movss dword [ebp - 0x14], xmm0
lahf
test ah, 0x44
jp 0x1012db14
movaps xmm0, xmm1
movss dword [ebp - 0x14], xmm1
movss dword [ebp - 0x20], xmm0
lea ecx, [ebp - 0x20]
movss xmm0, dword [ebx + 0xd0]
xorps xmm1, xmm1
movss dword [ebp - 0x10], xmm0
movss xmm0, dword [ebx + 0xd4]
addss xmm0, dword [ebx + 0x100]
movss dword [ebp - 0x1c], xmm2
movss dword [ebp - 0x2c], xmm0
call fcn.100e1660
mov edx, dword [ebp + 8]
mov ecx, edx
movss xmm2, dword [ebp - 0x10]
shr ecx, 1
and cl, 1
mov dword [ebp - 8], edx
mov dword [ebp - 0x1c], ecx
je 0x1012db74
movss xmm5, dword [ebx + 0x220]
movss xmm1, dword [ebx + 0x228]
jmp 0x1012db7f
movss xmm1, dword [ebx + 0x218]
movaps xmm5, xmm2
mov eax, dword [ebp + 0xc]
movss xmm0, dword [eax]
ucomiss xmm0, xmm7
lahf
test ah, 0x44
jnp 0x1012db97
test edx, 0x800000
je 0x1012dba6
movss xmm4, dword [ebp - 0x48]
subss xmm1, xmm5
maxss xmm4, xmm1
jmp 0x1012dbab
movss xmm4, dword [ebp - 0x14]
movss xmm6, dword [ebp - 0x2c]
addss xmm4, xmm5
movss dword [ebp - 0x58], xmm2
movaps xmm0, xmm6
movss dword [ebp - 0x54], xmm6
movss dword [ebp - 0x68], xmm5
movss dword [ebp - 0x64], xmm6
movss dword [ebp - 0x50], xmm4
movss dword [ebp - 0x60], xmm4
addss xmm0, dword [ebp - 0x18]
movss dword [ebp - 0x2c], xmm0
movss dword [ebp - 0x4c], xmm0
movss dword [ebp - 0x5c], xmm0
test edx, 0x4000000
jne 0x1012dc5e
test cl, cl
jne 0x1012dbfd
movss xmm7, dword [edi + 0x1560]
movss xmm3, dword [edi + 0x1564]
movaps xmm0, xmm7
mulss xmm0, dword [0x101afbec]
cvttss2si eax, xmm0
movaps xmm0, xmm3
mulss xmm0, dword [0x101afbec]
movd xmm2, eax
cvttss2si eax, xmm0
cvtdq2ps xmm2, xmm2
movd xmm0, eax
cvtdq2ps xmm0, xmm0
subss xmm7, xmm2
subss xmm3, xmm0
subss xmm5, xmm2
subss xmm6, xmm0
addss xmm7, xmm4
addss xmm3, dword [ebp - 0x2c]
movss dword [ebp - 0x68], xmm5
movss dword [ebp - 0x64], xmm6
movss dword [ebp - 0x60], xmm7
movss dword [ebp - 0x5c], xmm3
movss xmm0, dword [ebx + 0x230]
movss dword [ebp - 0x2c], xmm0
movss xmm0, dword [ebx + 0x238]
movss dword [ebp - 0x14], xmm0
test cl, cl
je 0x1012dc94
mov eax, dword [ebx + 0x220]
mov dword [ebx + 0x230], eax
mov eax, dword [ebx + 0x228]
mov dword [ebx + 0x238], eax
mov eax, edx
lea ecx, [ebp - 0x68]
and eax, 8
mov dword [ebp - 0x18], eax
push 0
je 0x1012dcc4
mov esi, dword [ebx + 0x1ac]
mov eax, esi
mov edx, dword [ebp - 0xc]
or eax, 0x14
mov dword [ebx + 0x1ac], eax
call fcn.100e1470
mov dword [ebx + 0x1ac], esi
jmp 0x1012dccb
mov edx, esi
call fcn.100e1470
mov cl, al
add esp, 4
mov eax, dword [ebp - 0x1c]
test al, al
je 0x1012dcf1
movss xmm0, dword [ebp - 0x2c]
movss dword [ebx + 0x230], xmm0
movss xmm0, dword [ebp - 0x14]
movss dword [ebx + 0x238], xmm0
test cl, cl
je 0x1012e255
test al, al
je 0x1012ddcc
cmp dword [ebx + 0x194], 0
je 0x1012dd14
call fcn.10109c20
jmp 0x1012ddcc
cmp dword [edi + 0x1ef4], 0
je 0x1012ddcc
mov eax, dword [0x101c0bb0]
mov esi, dword [eax + 0x1a6c]
mov edx, dword [eax + 0x1ef4]
movups xmm0, xmmword [esi + 0x230]
movups xmmword [edx + 0x14c], xmm0
mov eax, dword [esi + 0x284]
movups xmm0, xmmword [edx + 0x10c]
movss xmm1, dword [edx + 0x10c]
movss xmm2, dword [edx + 0x110]
movss xmm3, dword [edx + 0x114]
movss xmm4, dword [edx + 0x118]
movups xmmword [esi + 0x230], xmm0
movss dword [ebp - 0x38], xmm1
movss dword [ebp - 0x34], xmm2
movss dword [ebp - 0x30], xmm3
movss dword [ebp - 0x2c], xmm4
movss dword [eax + 0x60], xmm1
movss dword [eax + 0x64], xmm2
movss dword [eax + 0x68], xmm3
movss dword [eax + 0x6c], xmm4
mov eax, dword [esi + 0x284]
movups xmm0, xmmword [ebp - 0x38]
mov ecx, dword [eax + 0x3c]
mov eax, dword [eax + 0x44]
add ecx, ecx
movups xmmword [eax + ecx*8 - 0x10], xmm0
movzx eax, byte [edx + 0x1e1]
lea ecx, [edx + 0x194]
push eax
push dword [esi + 0x284]
call fcn.100f8ff0
mov eax, dword [ebp - 8]
mov ecx, eax
mov esi, dword [ebp - 8]
shr ecx, 3
and ecx, 0x20000
mov edx, ecx
or edx, 0x10
and eax, 0x200000
mov eax, esi
cmove edx, ecx
mov ecx, edx
or ecx, 0x80
and eax, 0x400000
mov eax, esi
cmove ecx, edx
mov edx, ecx
or edx, 0x4000
cmp dword [ebp - 0x18], 0
cmove edx, ecx
mov ecx, edx
or ecx, 0x120
and al, 4
movzx eax, byte [ebp - 1]
cmove ecx, edx
mov edx, esi
and edx, 0x10
mov esi, 0
cmp dword [ebp - 0x18], 0
mov dword [ebp - 0x2c], edx
cmove esi, eax
mov eax, ecx
or eax, 0x1000
mov dword [ebp - 0x18], esi
mov esi, dword [ebp - 0xc]
test edx, edx
mov edx, esi
cmove eax, ecx
lea ecx, [ebp - 0x68]
push eax
lea eax, [ebp - 3]
push eax
lea eax, [ebp - 2]
push eax
call fcn.1012e520
add esp, 0xc
mov byte [ebp - 1], al
test al, al
mov al, byte [ebp - 2]
mov dword [ebp - 0x10], eax
jne 0x1012de74
test al, al
je 0x1012dee5
test dword [ebp - 8], 0x2000000
je 0x1012dee5
cmp byte [edi + 0x1c17], 0
jne 0x1012dec4
cmp dword [edi + 0x1bc4], ebx
jne 0x1012dec4
mov eax, dword [edi + 0x1c0c]
cmp eax, dword [ebx + 0x13c]
jne 0x1012dec4
mov eax, dword [0x101c0bb0]
mov byte [edi + 0x1c16], 1
mov ecx, dword [ebx + 0x148]
mov edx, dword [ebx + 0x13c]
mov dword [eax + 0x1bc8], esi
mov dword [eax + 0x1bcc], ecx
mov eax, dword [eax + 0x1bc4]
mov dword [eax + edx*4 + 0x328], esi
cmp byte [ebp - 1], 0
je 0x1012dee5
mov eax, dword [0x101c0bb0]
mov word [eax + 0x1ab4], 0x101
mov eax, dword [eax + 0x1a6c]
or dword [eax + 0x118], 4
cmp dword [ebp - 0x2c], 0
je 0x1012def0
call fcn.100e83b0
cmp byte [ebp - 3], 0
mov ecx, 1
je 0x1012df0e
mov eax, dword [ebp - 0x10]
test dword [ebp - 8], 0x1000000
movzx eax, al
cmovne eax, ecx
mov dword [ebp - 0x10], eax
cmp byte [ebp - 0x1c], 0
je 0x1012dfd9
cmp dword [ebx + 0x194], 0
je 0x1012df2b
call fcn.10109b80
jmp 0x1012dfd9
cmp dword [edi + 0x1ef4], 0
je 0x1012dfd9
mov eax, dword [0x101c0bb0]
mov edx, dword [eax + 0x1ef4]
mov edi, dword [eax + 0x1a6c]
imul esi, dword [edx + 0x5c], 0x6c
movups xmm0, xmmword [edx + 0x14c]
mov eax, dword [edi + 0x284]
movss xmm1, dword [edx + 0x14c]
movss xmm2, dword [edx + 0x150]
movss xmm3, dword [edx + 0x154]
movss xmm4, dword [edx + 0x158]
add esi, dword [edx + 0xc]
movups xmmword [edi + 0x230], xmm0
movss dword [ebp - 0x38], xmm1
movss dword [ebp - 0x34], xmm2
movss dword [ebp - 0x30], xmm3
movss dword [ebp - 0x2c], xmm4
movss dword [eax + 0x60], xmm1
movss dword [eax + 0x64], xmm2
movss dword [eax + 0x68], xmm3
movss dword [eax + 0x6c], xmm4
mov eax, dword [edi + 0x284]
movups xmm0, xmmword [ebp - 0x38]
mov ecx, dword [eax + 0x3c]
mov eax, dword [eax + 0x44]
add ecx, ecx
movups xmmword [eax + ecx*8 - 0x10], xmm0
movzx eax, byte [esi + 0x5b]
lea ecx, [edx + 0x194]
push eax
push dword [edi + 0x284]
call fcn.100f8ff0
mov eax, dword fs:[0x2c]
mov ecx, dword [0x101bf848]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x101c6c68]
cmp eax, dword [ecx + 4]
jg 0x1012e25e
cmp byte [0x101c0c0c], 0
je 0x1012e02c
mov esi, dword [0x101c6c84]
mov ecx, 0x101c6c84
push dword [esi + 4]
push 0x101c6c84
call fcn.1002b870
mov dword [esi + 4], esi
mov dword [esi], esi
mov dword [esi + 8], esi
mov dword [0x101c6c88], 0
mov edi, dword [ebp - 0xc]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x2c], edi
push eax
call fcn.1002f420
mov esi, dword [ebp - 0x1c]
mov eax, dword [0x101c6c84]
mov dword [ebp - 0x2c], eax
cmp byte [esi + 0xd], 0
jne 0x1012e055
cmp edi, dword [esi + 0x10]
jge 0x1012e057
mov esi, eax
cmp esi, eax
jne 0x1012e0ff
push 0x24
call fcn.100775d3
movaps xmm0, xmmword [0x101b0b00]
mov esi, eax
mov eax, dword [ebp - 0x2c]
lea ecx, [esi + 0x10]
mov dword [ecx], edi
add esp, 4
movups xmmword [ecx + 4], xmm0
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
lea eax, [ebp - 0x24]
push ecx
push eax
mov word [esi + 0xc], 0
call fcn.1002f420
movq xmm0, qword [eax]
mov eax, dword [eax + 8]
movq qword [ebp - 0x34], xmm0
cmp byte [eax + 0xd], 0
jne 0x1012e0ba
cmp edi, dword [eax + 0x10]
jl 0x1012e0ba
push 0x24
push esi
call fcn.1007739f
add esp, 8
jmp 0x1012e0db
cmp dword [0x101c6c88], 0x71c71c7
je 0x1012e2b4
push esi
push dword [ebp - 0x30]
mov ecx, 0x101c6c84
push dword [ebp - 0x34]
call fcn.1002f820
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], edi
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.1002f420
mov esi, dword [ebp - 0x1c]
cmp byte [esi + 0xd], 0
jne 0x1012e0f9
cmp edi, dword [esi + 0x10]
jge 0x1012e0ff
mov esi, dword [0x101c6c84]
cmp byte [ebp - 0x18], 0
je 0x1012e11f
movss xmm2, dword [0x101be734]
movss xmm5, dword [0x101be738]
movss xmm4, dword [0x101be730]
jmp 0x1012e148
cmp byte [ebp - 0x10], 0
xorps xmm2, xmm2
xorps xmm5, xmm5
je 0x1012e145
movss xmm2, dword [0x101be744]
movss xmm5, dword [0x101be748]
movss xmm4, dword [0x101be740]
jmp 0x1012e148
xorps xmm4, xmm4
mov eax, dword [0x101c0bb0]
movss xmm3, dword [esi + 0x14]
comiss xmm4, xmm3
movss xmm1, dword [eax + 0x18]
mulss xmm1, dword [0x101afd04]
jbe 0x1012e170
movaps xmm0, xmm1
addss xmm3, xmm0
movss dword [esi + 0x14], xmm3
comiss xmm3, xmm4
jbe 0x1012e17e
subss xmm3, xmm1
movss dword [esi + 0x14], xmm3
movss xmm3, dword [esi + 0x18]
comiss xmm2, xmm3
jbe 0x1012e194
movaps xmm0, xmm1
addss xmm3, xmm0
movss dword [esi + 0x18], xmm3
comiss xmm3, xmm2
jbe 0x1012e1a2
subss xmm3, xmm1
movss dword [esi + 0x18], xmm3
movss xmm2, dword [esi + 0x1c]
comiss xmm5, xmm2
jbe 0x1012e1b8
movaps xmm0, xmm1
addss xmm2, xmm0
movss dword [esi + 0x1c], xmm2
comiss xmm2, xmm5
jbe 0x1012e1c6
subss xmm2, xmm1
movss dword [esi + 0x1c], xmm2
mov edi, dword [0x101c0bb0]
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x3c], 0
movups xmm0, xmmword [edi + 0x15dc]
lea ecx, [edi + 0x1b64]
movups xmmword [ebp - 0x38], xmm0
call fcn.1001e8b0
movups xmm0, xmmword [esi + 0x14]
mov esi, dword [ebp - 0x28]
lea eax, [ebp - 0x68]
push eax
mov eax, dword [ebp - 0x40]
lea edx, [ebp - 0x50]
add eax, 0x15b4
lea ecx, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push esi
movups xmmword [edi + 0x15dc], xmm0
call fcn.100ee7e0
add esp, 0x14
mov ecx, 1
call fcn.100ef130
mov al, byte [ebp - 1]
test al, al
je 0x1012e257
test dword [ebx + 8], 0x4000000
je 0x1012e257
test byte [ebp - 8], 1
jne 0x1012e257
test byte [ebx + 0x1ac], 0x20
jne 0x1012e257
call fcn.100df9d0
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x101c6c68
call fcn.100774e5
add esp, 4
cmp dword [0x101c6c68], 0xffffffff
jne 0x1012dff9
push 0x24
call fcn.100775d3
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
push 0x101658f0
mov dword [0x101c6c84], eax
call fcn.1007738a
add esp, 4
push 0x101c6c68
call fcn.1007749b
add esp, 4
jmp 0x1012dff9
call fcn.10025150
int3