Function at 0x1000d4da
Capabilities:
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x10063040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10069470]
push ebx
mov bh, byte [0x1007c598]
dec eax
push esi
push edi
cmp eax, 5
ja case.default.0x1000d498
jmp dword [eax*4 + 0x1000d9c8]
mov bl, 0x29
mov al, 0x1a
mov cl, 0x1f
mov dl, 0x19
mov byte [ebp - 0xc], 0
xor al, bl
xor cl, bl
mov byte [ebp - 0x10], bl
xor dl, bl
mov byte [ebp - 0xc], 0
mov byte [ebp - 0xf], al
mov al, 0x6f
mov byte [ebp - 0xd], dl
mov dl, 0x4a
xor al, dl
mov byte [ebp - 0xe], cl
mov byte [ebp - 0x1b], al
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1b]
push eax
lea eax, [ebp - 0xf]
jmp 0x1000d58f
mov cl, 0x11
mov bl, 0x21
mov al, 0x14
mov dl, cl
jmp 0x1000d4a7
mov al, 0x74
mov byte [ebp - 0xc], 0
mov dl, al
mov byte [ebp - 0xc], 0
mov cl, al
mov bl, 0x43
xor al, bl
mov byte [ebp - 0x10], bl
mov byte [ebp - 0xf], al
xor dl, bl
mov byte [ebp - 0xd], dl
mov al, 0x6f
xor cl, bl
mov dl, 0x4a
xor al, dl
mov byte [ebp - 0xe], cl
mov byte [ebp - 0x1b], al
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1b]
push eax
lea eax, [ebp - 0xf]
jmp 0x1000d58f
mov al, 0x20
mov bl, 0x19
mov cl, al
mov dl, al
jmp 0x1000d4a7
mov ah, 0x64
mov byte [ebp - 0xb], 0
mov dl, 0x54
mov byte [ebp - 0x10], ah
mov al, 0x55
mov byte [ebp - 0xb], 0
mov cl, 0x51
mov bl, dl
xor al, ah
xor cl, ah
xor dl, ah
xor bl, ah
mov byte [ebp - 0xc], bl
jmp 0x1000d4b8
mov al, 5
mov byte [ebp - 0x22], 0
mov dl, al
mov byte [ebp - 0x22], 0
mov ch, 0x3c
mov cl, al
mov bl, al
mov byte [ebp - 0x28], ch
mov ah, al
xor dl, ch
xor al, ch
mov byte [ebp - 0x25], dl
mov byte [ebp - 0x27], al
xor ah, ch
mov al, 0x6f
mov byte [ebp - 0x23], ah
xor cl, ch
xor bl, ch
mov dl, 0x4a
mov byte [ebp - 0x26], cl
xor al, dl
mov byte [ebp - 0x24], bl
mov byte [ebp - 0x1b], al
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1b]
push eax
lea eax, [ebp - 0x27]
mov cl, 0x23
mov byte [ebp - 0x19], 0
xor cl, dl
mov byte [ebp - 0x1c], dl
push eax
mov byte [ebp - 0x1a], cl
mov byte [ebp - 0x19], 0
call fcn.10001350
mov eax, dword [ebp - 0x14]
add esp, 0xc
mov byte [0x1007b221], 1
mov dword [0x10079904], eax
cmp byte [ebp + 8], 1
jne 0x1000d5c3
mov dl, 0xeb
jmp 0x1000d61e
mov ah, 0x39
mov byte [ebp - 0xb], 0
mov al, 9
mov byte [ebp - 0x10], ah
xor al, ah
mov byte [ebp - 0x19], 0
mov dl, 0xe
mov byte [ebp - 0xf], al
xor dl, ah
mov byte [ebp - 0xb], 0
mov byte [ebp - 0xd], dl
mov al, 0x20
mov dl, 5
mov byte [ebp - 0x19], 0
xor al, dl
mov byte [ebp - 0x1c], dl
mov cl, 0x41
mov byte [ebp - 0x1b], al
xor cl, ah
mov bl, 0xd
xor bl, ah
mov byte [ebp - 0xe], cl
lea eax, [ebp - 0x14]
mov byte [ebp - 0xc], bl
push eax
lea eax, [ebp - 0x1b]
mov cl, 0x7d
push eax
lea eax, [ebp - 0xf]
xor cl, dl
push eax
mov byte [ebp - 0x1a], cl
call fcn.10001350
mov dl, byte [ebp - 0x14]
add esp, 0xc
mov ecx, dword [0x1007c52c]
call fcn.100023d0
test bh, bh
je 0x1000d693
mov ah, 0x52
mov byte [ebp - 0xb], 0
mov al, 0x62
mov byte [ebp - 0x10], ah
xor al, ah
mov byte [ebp - 0x19], 0
mov dl, 0x11
mov byte [ebp - 0xf], al
xor dl, ah
mov byte [ebp - 0xb], 0
mov byte [ebp - 0xd], dl
mov al, 0x20
mov dl, 5
mov byte [ebp - 0x19], 0
xor al, dl
mov byte [ebp - 0x1c], dl
mov cl, 0x2a
mov byte [ebp - 0x1b], al
xor cl, ah
mov bl, 0x61
xor bl, ah
mov byte [ebp - 0xe], cl
lea eax, [ebp - 0x14]
mov byte [ebp - 0xc], bl
push eax
lea eax, [ebp - 0x1b]
mov cl, 0x7d
push eax
lea eax, [ebp - 0xf]
xor cl, dl
push eax
mov byte [ebp - 0x1a], cl
call fcn.10001350
mov dl, byte [ebp - 0x14]
add esp, 0xc
mov ecx, dword [0x1007c510]
call fcn.100023d0
cmp byte [0x1007b39f], 0
je 0x1000d6b1
cmp byte [0x1007b27e], 0
jne 0x1000d6bb
mov dword [0x1007b268], 1
jmp 0x1000d6bb
mov dword [0x1007b268], 0
cmp byte [ebp + 0x18], 1
jne 0x1000d6f9
mov al, 0x6b
mov byte [ebp - 0xc], 0
mov dl, al
mov byte [ebp - 0xc], 0
mov cl, al
mov bl, 0x52
xor al, bl
mov byte [ebp - 0x10], bl
mov byte [ebp - 0xf], al
xor dl, bl
mov byte [ebp - 0xd], dl
mov al, 0x17
xor cl, bl
mov dl, 0x32
xor al, dl
mov byte [ebp - 0xe], cl
mov byte [ebp - 0x1b], al
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1b]
push eax
lea eax, [ebp - 0xf]
jmp 0x1000d735
movaps xmm0, xmmword [0x1005ed80]
xor ecx, ecx
movups xmmword [ebp - 0x3c], xmm0
mov byte [ebp - 0x2c], 0
nop word [eax + eax]
mov al, byte [ebp - 0x3c]
xor byte [ebp + ecx - 0x3b], al
inc ecx
cmp ecx, 0xf
jb 0x1000d710
mov al, 0x17
mov byte [ebp - 0x2c], 0
mov dl, 0x32
xor al, dl
mov byte [ebp - 0x1b], al
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1b]
push eax
lea eax, [ebp - 0x3b]
mov cl, 0x54
mov byte [ebp - 0x19], 0
xor cl, dl
mov byte [ebp - 0x1c], dl
push eax
mov byte [ebp - 0x1a], cl
mov byte [ebp - 0x19], 0
call fcn.10001350
movss xmm0, dword [ebp - 0x14]
add esp, 0xc
call fcn.10006470
cmp byte [ebp + 0x1c], 1
jne 0x1000d7f0
mov ah, 0x77
mov byte [ebp - 0x23], 0
mov cl, 0x4e
mov byte [ebp - 0x28], ah
mov dl, cl
mov byte [ebp - 0x19], 0
xor dl, ah
mov byte [ebp - 0x23], 0
mov al, 0x5a
mov byte [ebp - 0x25], dl
xor al, ah
mov byte [ebp - 0x19], 0
mov byte [ebp - 0x27], al
mov dl, 0x32
mov bl, cl
mov byte [ebp - 0x1c], dl
xor cl, ah
mov al, 0x17
xor al, dl
mov byte [ebp - 0x26], cl
xor bl, ah
mov byte [ebp - 0x1b], al
lea eax, [ebp - 0x14]
mov byte [ebp - 0x24], bl
push eax
lea eax, [ebp - 0x1b]
mov cl, 0x54
push eax
lea eax, [ebp - 0x27]
xor cl, dl
push eax
mov byte [ebp - 0x1a], cl
call fcn.10001350
movss xmm0, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
mov esi, dword [0x1007b394]
add esp, 0xc
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
movss dword [ebp - 0x40], xmm0
mov dword [ebp - 0xc], 0
push eax
push 0x40
push 8
push esi
call edi
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x18]
jmp 0x1000d881
mov cl, 0x6e
mov dword [ebp - 0x3c], 0x57405e6e
mov dword [ebp - 0x38], 0x5e5e5e57
xor eax, eax
mov dword [ebp - 0x34], 0x575e5e5e
mov word [ebp - 0x30], 0x5b
nop
xor byte [ebp + eax - 0x3b], cl
inc eax
cmp eax, 0xc
jae 0x1000d81f
mov cl, byte [ebp - 0x3c]
jmp 0x1000d810
mov dl, 0x32
mov byte [ebp - 0x19], 0
mov al, 0x17
mov byte [ebp - 0x2f], 0
xor al, dl
mov byte [ebp - 0x1c], dl
mov byte [ebp - 0x1b], al
mov cl, 0x54
lea eax, [ebp - 0x18]
mov byte [ebp - 0x19], 0
push eax
lea eax, [ebp - 0x1b]
xor cl, dl
push eax
lea eax, [ebp - 0x3b]
mov byte [ebp - 0x1a], cl
push eax
call fcn.10001350
movss xmm0, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov esi, dword [0x1007b394]
add esp, 0xc
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
movss dword [ebp - 0x40], xmm0
mov dword [ebp - 0x24], 0
push eax
push 0x40
push 8
push esi
call edi
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x14]
movss xmm0, dword [ebp - 0x40]
push 8
push esi
movss dword [esi], xmm0
call edi
cmp byte [ebp + 0x14], 1
jne 0x1000d949
call fcn.10003430
mov ecx, eax
call fcn.10003570
test eax, eax
je 0x1000d949
mov eax, dword [0x1007c534]
add eax, dword [0x1007b30c]
push 0
push eax
call fcn.1002b260
cvttss2si eax, xmm0
add esp, 8
cmp eax, 0x2a
jne 0x1000d926
cmp byte [0x1007b27f], 0
jne 0x1000d926
mov byte [0x1007b27f], 1
call fcn.10003430
mov ecx, eax
call fcn.10003570
mov esi, dword [0x1007c534]
add esi, dword [0x1007b30c]
test eax, eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x24], 0
push eax
push 0x40
push 8
push esi
je 0x1000d912
call edi
mov dword [esi], 0x42393333
jmp 0x1000d91a
call edi
mov dword [esi], 0x422a0000
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x18]
push 8
push esi
call edi
mov eax, dword [0x1007c534]
add eax, dword [0x1007b30c]
push 0
push eax
call fcn.1002b260
cvttss2si eax, xmm0
add esp, 8
test eax, eax
jne 0x1000d949
mov byte [0x1007b27f], al
mov esi, dword [0x1007c570]
lea eax, [ebp - 0x18]
push eax
push 0x40
push 8
push esi
mov dword [ebp - 0x24], 0
call edi
cmp byte [ebp + 0x20], 1
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x18]
push 8
push esi
jne 0x1000d976
mov byte [esi], 4
jmp 0x1000d979
mov byte [esi], 8
call edi
cmp byte [0x1007b1f3], 0
je 0x1000d9b7
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount64]
call esi
mov ecx, dword [0x1007c5e8]
add ecx, 0x1f4
test edx, edx
jb 0x1000d9b7
ja 0x1000d9a2
cmp eax, ecx
jbe 0x1000d9b7
call esi
cmp byte [0x1007b223], 0
mov dword [0x1007c5e8], eax
sete byte [0x1007b223]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002cddc
mov esp, ebp
pop ebp
ret