Function at 0x10054740
Capabilities:
Execute shellcode via indirect call

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x18
cmp dword [0x101861f8], 0
push esi
mov esi, dword [0x10190afc]
push edi
mov dword [ebp - 0xc], esi
jne 0x10054782
mov byte [0x1018d29d], 0
call fcn.100a9780
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
mov cl, byte [0x1018d29d]
mov edi, 0xf9e7
mov ch, byte [0x101dd961]
test cl, cl
je 0x10054c4a
mov edx, dword [0x10186214]
test ch, ch
jne 0x100547cf
cmp edx, 3
jne 0x100547b3
mov byte [0x1018d297], 1
jmp 0x100547cf
movzx eax, byte [0x1018d299]
mov edi, 1
cmp edx, 4
cmove eax, edi
mov edi, 0xf9e7
mov byte [0x1018d299], al
cmp byte [0x10186329], 0
mov eax, dword [0x10186200]
je 0x10054800
cmp byte [0x101dd454], 0
jne 0x10054800
cmp eax, 4
je 0x10054800
and word [esi + 0x1e], di
mov edx, dword [0x10186214]
mov eax, dword [0x10186200]
mov cl, byte [0x1018d29d]
test cl, cl
je 0x10054c4a
cmp edx, 1
jne 0x1005481a
cmp dword [0x10190b10], 0x1d
jne 0x10054ca8
movzx ecx, word [esi + 0x1e]
test cl, 1
je 0x1005482c
cmp edx, 2
je 0x10054ca8
mov edx, dword [0x10186220]
cmp edx, 1
jne 0x10054846
cmp byte [0x101dd455], 0
jne 0x10054ca8
jmp 0x10054869
cmp edx, 2
jne 0x10054869
cmp byte [0x101dd455], 0
je 0x10054869
movss xmm0, dword [0x101dd45c]
comiss xmm0, dword [0x10186224]
jae 0x10054ca8
cmp eax, 4
je 0x100548ce
cmp byte [0x10186218], 0
mov dword [0x10190894], eax
je case.default.0x100548a3
cmp byte [0x101dd454], 0
jne case.default.0x100548a3
call fcn.100d7095
and eax, 0x80000003
jns 0x1005489e
dec eax
or eax, 0xfffffffc
inc eax
cmp eax, 3
ja case.default.0x100548a3
jmp dword [eax*4 + 0x10054cb4]
or word [esi + 0x1e], 8
jmp case.default.0x100548a3
or word [esi + 0x1e], 0x10
jmp case.default.0x100548a3
mov eax, 0x200
or word [esi + 0x1e], ax
jmp case.default.0x100548a3
mov eax, 0x400
or word [esi + 0x1e], ax
jmp case.default.0x100548a3
test cl, 8
je 0x100548df
mov dword [0x10190894], 0
jmp case.default.0x100548a3
test ecx, 0x200
je 0x100548f3
mov dword [0x10190894], 1
jmp case.default.0x100548a3
test ecx, 0x400
je 0x10054907
mov dword [0x10190894], 2
jmp case.default.0x100548a3
mov eax, dword [0x10190894]
test cl, 0x10
mov ecx, 3
cmovne eax, ecx
mov dword [0x10190894], eax
mov ecx, dword [0x1018b6e0]
cmp dword [ecx + 0xe0], 0xffffffff
jne 0x10054ca8
movss xmm2, dword [0x10186208]
xorps xmm0, xmm0
ucomiss xmm2, xmm0
lahf
test ah, 0x44
jnp 0x100549e8
movss xmm0, dword [0x10189d7c]
movsd xmm1, qword [0x1012ceb8]
cvtps2pd xmm0, xmm0
divsd xmm1, xmm0
cvtps2pd xmm0, xmm2
divsd xmm1, xmm0
movsd xmm0, qword [0x10189f20]
ucomisd xmm0, xmm1
movsd qword [ebp - 0x18], xmm1
lahf
test ah, 0x44
jnp 0x100549e5
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0x10190e60
push 0x40
push 8
push dword [0x1018ca5c]
call edi
movsd xmm0, qword [ebp - 0x18]
mulsd xmm0, qword [0x1012cf70]
mov eax, dword [0x1018ca5c]
push 0x10190e60
movsd qword [eax], xmm0
push dword [0x10190e60]
mov esi, dword [0x1018ca5c]
push 8
push esi
call edi
push 8
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
movsd xmm0, qword [ebp - 0x18]
mov ecx, dword [0x1018b6e0]
mov esi, dword [ebp - 0xc]
movsd qword [0x10189f20], xmm0
xorps xmm0, xmm0
mov eax, dword [0x10190894]
movss xmm1, dword [0x1018620c]
movss xmm2, dword [0x1012eb90]
movss xmm3, dword [0x1012ceec]
cmp eax, 3
ja case.default.0x10054a0a
jmp dword [eax*4 + 0x10054cc4]
movaps xmm0, xmm1
xorps xmm0, xmm2
jmp case.0x10054a0a.0
movaps xmm0, xmm1
jmp case.0x10054a0a.0
movaps xmm0, xmm1
mulss xmm0, xmm3
jmp case.0x10054a0a.0
movss xmm0, dword [ebp - 0x14]
mulss xmm1, xmm3
movss xmm3, dword [0x1012cf30]
divss xmm3, xmm1
mulss xmm3, xmm0
movss xmm0, dword [0x1012d00c]
comiss xmm0, dword [0x101dd45c]
movss dword [ebp - 8], xmm3
jbe 0x10054aac
mov eax, dword [0x10190894]
cmp eax, 3
ja case.default.0x10054a64
jmp dword [eax*4 + 0x10054cd4]
mov eax, dword [ecx + 0x1f4]
mov dword [esi + 0x10], eax
jmp case.default.0x10054a64
movss xmm0, dword [ecx + 0x1f4]
xorps xmm0, xmm2
jmp 0x10054bd0
mov eax, dword [ecx + 0x1f4]
mov dword [esi + 0x14], eax
jmp case.default.0x10054a64
movss xmm0, dword [ecx + 0x1f4]
xorps xmm0, xmm2
movss dword [esi + 0x10], xmm0
jmp case.default.0x10054a64
movss xmm1, dword [ecx + 0x5c]
movss xmm0, dword [ecx + 0x60]
call fcn.1001e990
movss xmm1, dword [esi + 8]
movaps xmm2, xmm0
mulss xmm1, dword [0x1012cf30]
movss dword [ebp - 0x10], xmm2
divss xmm1, dword [0x1012d0dc]
subss xmm0, xmm1
movss dword [ebp - 4], xmm1
subss xmm0, dword [ebp - 8]
call fcn.1001ea40
movaps xmm1, xmm0
movss dword [ebp - 0xc], xmm0
mulss xmm1, xmm0
mov dword [esi + 0x10], 0
movss xmm0, dword [0x1012cd64]
subss xmm0, xmm1
call fcn.10002f50
movaps xmm1, xmm0
movss xmm0, dword [ebp - 0xc]
call fcn.1001e990
xorps xmm1, xmm1
comiss xmm0, xmm1
movss xmm0, dword [0x10186210]
ja 0x10054b33
xorps xmm0, xmmword [0x1012eb90]
movss dword [ebp - 0xc], xmm0
movss xmm0, dword [ebp - 4]
call fcn.1001ea40
movss dword [ebp - 0x14], xmm0
movss xmm0, dword [ebp - 4]
call fcn.1001e9d0
movss dword [ebp - 4], xmm0
movss xmm0, dword [esi + 8]
addss xmm0, xmm0
mulss xmm0, dword [0x1012cf30]
divss xmm0, dword [0x1012d0dc]
subss xmm0, dword [ebp - 0x10]
addss xmm0, dword [ebp - 8]
movss dword [ebp - 0x10], xmm0
call fcn.1001ea40
movss dword [ebp - 8], xmm0
movss xmm0, dword [ebp - 0x10]
call fcn.1001e9d0
movss xmm3, dword [ebp - 8]
movaps xmm2, xmm0
mulss xmm2, dword [ebp - 0x14]
movaps xmm1, xmm3
mulss xmm1, dword [ebp - 4]
mulss xmm0, dword [ebp - 4]
mulss xmm3, dword [ebp - 0x14]
subss xmm2, xmm1
addss xmm0, xmm3
mulss xmm2, dword [ebp - 0xc]
mulss xmm0, dword [ebp - 0xc]
movss dword [esi + 0x10], xmm2
movss xmm2, dword [0x1012eb90]
movss dword [esi + 0x14], xmm0
mov eax, dword [0x10190894]
movss xmm0, dword [esi + 0x10]
movss xmm1, dword [esi + 0x14]
cmp eax, 3
ja case.default.0x10054be9
jmp dword [eax*4 + 0x10054ce4]
xorps xmm0, xmm2
movss dword [esi + 0x10], xmm1
movss dword [esi + 0x14], xmm0
mov byte [0x101dd961], 1
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
xorps xmm1, xmm2
movss dword [esi + 0x14], xmm0
movss dword [esi + 0x10], xmm1
mov byte [0x101dd961], 1
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
xorps xmm0, xmm2
xorps xmm1, xmm2
movss dword [esi + 0x14], xmm1
movss dword [esi + 0x10], xmm0
mov byte [0x101dd961], 1
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.100a9780
mov dword [0x10190894], 4
test ch, ch
je 0x10054c8b
movzx eax, byte [0x1018d297]
xor edx, edx
cmp dword [0x10186214], 3
cmove eax, edx
cmp dword [0x10186214], 4
mov byte [0x1018d297], al
movzx eax, byte [0x1018d299]
cmove eax, edx
mov byte [0x1018d299], al
cmp byte [0x10186329], 0
mov byte [0x101dd961], 0
je 0x10054ca8
cmp byte [0x101dd454], 0
jne 0x10054ca8
and word [esi + 0x1e], di
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret