Function at 0x10051440
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005781d
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x10069040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x24], ecx
mov edi, dword [0x1006ee70]
mov edx, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov eax, dword [edi + 0x19d0]
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x40], ecx
mov byte [eax + 0x7c], 1
mov esi, dword [edi + 0x19d0]
mov dword [ebp - 0x20], esi
test edx, 0x100
je 0x100514ca
test ebx, ebx
je 0x100514a8
mov byte [ebx], 0
test ecx, ecx
je 0x100514af
mov byte [ecx], 0
mov eax, dword [edi + 0x1a04]
cmp eax, dword [ebp - 0x18]
jne 0x100514c3
xor edx, edx
xor ecx, ecx
call fcn.10006250
xor al, al
jmp 0x10051b1d
mov eax, dword [edi + 0x19d4]
mov ecx, edx
or ecx, 2
mov dword [ebp - 0x34], eax
test dl, 0x1e
cmovne ecx, edx
mov dword [ebp - 0x14], ecx
test cl, 0x20
je 0x100514fa
cmp dword [edi + 0x19d8], esi
jne 0x100514fa
mov byte [ebp - 0x25], 1
mov dword [edi + 0x19d4], esi
jmp 0x100514fe
mov byte [ebp - 0x25], 0
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x24]
mov byte [ebp - 0x2c], 0
call fcn.10006820
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
test al, al
je 0x1005153b
cmp byte [edi + 0x1d54], 0
je 0x10051604
cmp dword [edi + 0x1d6c], ebx
jne 0x1005153b
test byte [edi + 0x1d58], 2
jne 0x1005153b
mov byte [ebp - 0x1c], 0
jmp 0x10051548
cmp byte [edi + 0x1d54], 0
je 0x10051604
mov ecx, dword [ebp - 0x14]
test ecx, 0x1000
je 0x10051607
test byte [edi + 0x1d58], 4
jne 0x10051607
mov ecx, 0x20
call fcn.10006700
test al, al
je 0x10051601
mov eax, dword [0x1006ee70]
mov edx, 1
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
mov dword [eax + 0x19f0], ecx
mov byte [eax + 0x19f4], 0
test ecx, ecx
je 0x100515b3
cmp dword [eax + 0x19f8], ecx
je 0x100515b3
mov dword [eax + 0x1a00], 0
mov dword [eax + 0x19fc], 0
movss xmm0, dword [edi + 0x19fc]
addss xmm0, dword [0x10062eec]
ucomiss xmm0, dword [0x10062ec4]
movaps xmm1, xmm0
subss xmm1, dword [edi + 0x18]
lahf
test ah, 0x44
jnp 0x100515f7
comiss xmm1, xmm0
jae 0x100515ef
movss xmm2, dword [0x10062f40]
comiss xmm2, xmm1
jbe 0x100515ef
comiss xmm0, xmm2
jae 0x100515f7
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
jmp 0x1005160a
mov ecx, esi
mov byte [ebp - 0x2c], dl
call fcn.1000eb30
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x1c]
cmp byte [ebp - 0x25], 0
je 0x10051619
mov eax, dword [ebp - 0x34]
mov dword [edi + 0x19d4], eax
test dl, dl
je 0x1005179e
test cl, 0x40
je 0x1005163e
mov eax, dword [edi + 0x19f8]
cmp eax, ebx
je 0x1005163e
test eax, eax
je 0x1005163e
xor dl, dl
mov dword [ebp - 0x1c], edx
jmp 0x100517a1
test ecx, 0x400
je 0x1005166d
cmp byte [edi + 0x100], 0
jne 0x10051791
cmp byte [edi + 0x101], 0
jne 0x10051791
cmp byte [edi + 0x102], 0
jne 0x10051791
test cl, 2
je 0x100516a2
cmp byte [edi + 0x3d8], 0
je 0x100516a2
mov edx, esi
mov ecx, ebx
call fcn.10006250
test dword [ebp - 0x14], 0x2000
jne 0x10051695
mov ecx, dword [ebp - 0x18]
call fcn.10006330
mov ecx, esi
call fcn.1000eb30
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
test cl, 4
je 0x100516b0
cmp byte [edi + 0x3d8], 0
jne 0x100516be
test cl, 0x10
je 0x100516e6
cmp byte [edi + 0x3dd], 0
je 0x100516e6
mov byte [ebp - 0x2c], 1
test ecx, 0x800
je 0x100516d0
xor edx, edx
xor ecx, ecx
jmp 0x100516d4
mov edx, esi
mov ecx, ebx
call fcn.10006250
mov ecx, esi
call fcn.1000eb30
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
test cl, 8
je 0x1005171d
cmp byte [edi + 0x3e2], 0
je 0x1005171d
test cl, 1
je 0x1005170a
movss xmm0, dword [edi + 0x408]
comiss xmm0, dword [edi + 0x8c]
jae 0x1005170e
mov byte [ebp - 0x2c], 1
xor edx, edx
xor ecx, ecx
call fcn.10006250
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
test cl, 1
je 0x10051791
cmp dword [edi + 0x1a04], ebx
jne 0x10051791
movss xmm0, dword [edi + 0x3f4]
xorps xmm4, xmm4
comiss xmm0, xmm4
jbe 0x10051791
mov edx, dword [0x1006ee70]
movss xmm1, dword [edx + 0x3f4]
ucomiss xmm1, xmm4
lahf
test ah, 0x44
jnp 0x10051896
movss xmm2, dword [edx + 0x8c]
comiss xmm1, xmm2
jbe 0x10051791
movss xmm3, dword [edx + 0x90]
movaps xmm0, xmm1
subss xmm0, dword [edx + 0x18]
mulss xmm3, dword [0x10062f2c]
comiss xmm0, xmm1
jae 0x10051791
comiss xmm4, xmm3
jb 0x1005186a
comiss xmm2, xmm0
ja 0x10051896
cmp byte [ebp - 0x2c], 0
je 0x1005179e
mov byte [edi + 0x1b52], 1
mov edx, dword [ebp - 0x1c]
cmp dword [edi + 0x1af4], ebx
jne 0x100517e2
cmp byte [edi + 0x1b52], 0
jne 0x100517e2
cmp byte [edi + 0x1b53], 0
je 0x100517e2
mov eax, dword [edi + 0x1a04]
test eax, eax
je 0x100517ce
cmp eax, ebx
je 0x100517ce
cmp eax, dword [esi + 0x48]
jne 0x100517e2
test ecx, 0x4000
movzx edx, dl
mov eax, 1
cmove edx, eax
mov dword [ebp - 0x1c], edx
cmp dword [edi + 0x1afc], ebx
jne 0x100518a7
mov esi, dword [edi + 0x1af8]
mov edx, ecx
cmp esi, ebx
sete byte [ebp - 0x25]
and edx, 1
add edx, edx
xor ecx, ecx
or edx, 1
call fcn.100123d0
comiss xmm0, dword [0x10062ec4]
seta al
mov byte [ebp - 0x2d], al
cmp esi, ebx
je 0x10051820
test al, al
je 0x10051824
mov byte [ebp - 0x2c], 1
cmp byte [ebp - 0x25], 0
jne 0x10051836
test al, al
jne 0x10051836
cmp dword [edi + 0x1a04], ebx
jne 0x100518a7
mov edx, dword [ebp - 0x20]
mov ecx, ebx
mov dword [edi + 0x1af8], ebx
call fcn.10006250
cmp byte [ebp - 0x25], 0
jne 0x10051852
cmp byte [ebp - 0x2d], 0
je 0x1005189f
mov esi, dword [ebp - 0x14]
test esi, 0x2000
jne 0x100518a2
mov ecx, dword [ebp - 0x18]
call fcn.10006330
mov ebx, dword [ebp - 0x18]
jmp 0x100518aa
comiss xmm2, xmm0
jbe 0x10051874
or edx, 0xffffffff
jmp 0x10051880
subss xmm0, xmm2
divss xmm0, xmm3
cvttss2si edx, xmm0
subss xmm1, xmm2
divss xmm1, xmm3
cvttss2si eax, xmm1
sub eax, edx
test eax, eax
jle 0x10051791
mov byte [ebp - 0x2c], 1
jmp 0x10051797
mov esi, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x18]
jmp 0x100518aa
mov esi, dword [ebp - 0x14]
mov byte [ebp - 0x25], 0
cmp dword [edi + 0x1a04], ebx
jne 0x100519b1
mov ecx, dword [ebp - 0x2c]
test cl, cl
je 0x100518c8
mov byte [edi + 0x1a12], 1
mov eax, dword [edi + 0x1a34]
cmp eax, 1
jne 0x10051998
cmp byte [edi + 0x1a10], 0
je 0x1005190c
mov eax, dword [ebp - 0x24]
movss xmm1, dword [edi + 0xe8]
movss xmm0, dword [edi + 0xec]
subss xmm1, dword [eax]
subss xmm0, dword [eax + 4]
movss dword [edi + 0x1a28], xmm1
movss dword [edi + 0x1a2c], xmm0
cmp byte [edi + 0xf0], 0
je 0x1005191b
mov byte [ebp - 0x25], 1
jmp 0x10051987
cmp byte [ebp - 0x1c], 0
je 0x1005197b
mov eax, dword [ebp - 0x14]
test al, 2
je 0x10051978
cmp byte [edi + 0x1d54], 0
jne 0x10051978
test al, 0x10
je 0x10051942
cmp byte [edi + 0x3ec], 0
je 0x10051942
mov dl, 1
jmp 0x10051944
xor dl, dl
test al, 1
je 0x1005195d
movss xmm0, dword [edi + 0x408]
comiss xmm0, dword [edi + 0x8c]
jb 0x1005195d
mov al, 1
jmp 0x1005195f
xor al, al
mov esi, dword [ebp - 0x14]
test dl, dl
jne 0x1005197b
test al, al
movzx ecx, cl
mov eax, 1
cmove ecx, eax
mov dword [ebp - 0x2c], ecx
jmp 0x1005197b
mov esi, dword [ebp - 0x14]
xor edx, edx
xor ecx, ecx
call fcn.10006250
mov ebx, dword [ebp - 0x18]
test esi, 0x2000
jne 0x100519b1
mov byte [edi + 0x1b52], 1
jmp 0x100519b1
cmp eax, 2
jne 0x100519b1
cmp dword [edi + 0x1afc], ebx
je 0x100519b1
xor edx, edx
xor ecx, ecx
call fcn.10006250
mov ebx, dword [ebp - 0x18]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x4c]
push eax
call fcn.10052560
mov eax, dword [ebp - 0x44]
cmp byte [eax + 0xd], 0
jne 0x100519d9
cmp ebx, dword [eax + 0x10]
jb 0x100519d9
cmp eax, dword [0x1006f11c]
je 0x100519d9
mov al, byte [eax + 0x14]
jmp 0x100519db
xor al, al
mov ebx, dword [ebp - 0x1c]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
test bl, bl
je 0x10051ab8
test al, al
jne 0x10051ac5
mov esi, dword [0x1006efb8]
lea eax, [ebp - 0x24]
push eax
push 0x40
push 2
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
push eax
call edi
movzx eax, word [esi + 0x7c]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x24]
lea eax, [ebp - 0x1c]
push 2
push eax
call edi
mov ecx, dword [ebp - 0x1c]
call fcn.10045490
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x4c]
push eax
call fcn.10052560
mov ecx, dword [ebp - 0x44]
cmp byte [ecx + 0xd], 0
jne 0x10051a4b
mov eax, dword [ebp - 0x18]
cmp eax, dword [ecx + 0x10]
jae 0x10051ab2
cmp dword [0x1006f120], 0xaaaaaaa
je 0x10051b39
mov esi, dword [0x1006f11c]
mov dword [ebp - 0x38], 0x1006f11c
mov dword [ebp - 4], 0
push 0x18
mov dword [ebp - 0x34], 0
call fcn.10054cf6
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x18]
mov dword [eax + 0x10], ecx
mov ecx, 0x1006f11c
push eax
push dword [ebp - 0x48]
mov byte [eax + 0x14], 0
push dword [ebp - 0x4c]
mov dword [eax], esi
mov dword [eax + 4], esi
mov dword [eax + 8], esi
mov word [eax + 0xc], 0
call fcn.10042670
mov ecx, eax
mov byte [ecx + 0x14], 1
jmp 0x10051ac5
test al, al
je 0x10051ac5
lea eax, [ebp - 0x18]
push eax
call fcn.10051e50
mov eax, dword [ebp - 0x2c]
test al, al
je 0x10051b08
mov esi, dword [0x1006efb8]
lea eax, [ebp - 0x20]
push eax
push 0x40
push 2
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
call edi
movzx eax, word [esi + 0x78]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
lea eax, [ebp - 0x14]
push 2
push eax
call edi
mov ecx, dword [ebp - 0x14]
call fcn.10045490
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x3c]
test ecx, ecx
je 0x10051b11
mov byte [ecx], bl
mov edx, dword [ebp - 0x40]
test edx, edx
je 0x10051b1d
mov cl, byte [ebp - 0x25]
mov byte [edx], cl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1005465b
mov esp, ebp
pop ebp
ret
call fcn.1003dc20
int3