Function at 0x1003c2f0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x18
cmp byte [0x100d4073], 0
push esi
push edi
jne 0x1003c32c
call fcn.100691e0
mov dword [0x100d4084], 4
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
cmp byte [0x100d89a8], 0
mov esi, dword [0x100d43d0]
jne 0x1003c3f5
mov eax, dword [0x100d3938]
push str.hud_draw
call eax
add esp, 4
mov dword [0x100d8980], eax
mov eax, dword [0x100d3938]
push str.r_drawentities
call eax
add esp, 4
mov dword [0x100d8984], eax
mov eax, dword [0x100d3938]
push str.net_graph
call eax
add esp, 4
mov dword [0x100d8988], eax
mov eax, dword [0x100d3938]
push str.cl_showfps
call eax
add esp, 4
mov dword [0x100d898c], eax
mov eax, dword [0x100d3938]
push str.r_norefresh
call eax
mov edx, dword [0x100d8980]
add esp, 4
mov dword [0x100d8990], eax
mov eax, dword [0x100d8984]
movss xmm1, dword [edx + 0xc]
movss dword [0x100d8994], xmm1
movss xmm0, dword [eax + 0xc]
mov eax, dword [0x100d8988]
movss dword [0x100d8998], xmm0
movss xmm0, dword [eax + 0xc]
mov eax, dword [0x100d898c]
movss dword [0x100d899c], xmm0
movss xmm0, dword [eax + 0xc]
movss dword [0x100d89a0], xmm0
mov byte [0x100d89a8], 1
jmp 0x1003c403
movss xmm1, dword [0x100d8994]
mov edx, dword [0x100d8980]
mov eax, dword [0x100d897c]
mov ecx, eax
dec eax
mov dword [0x100d897c], eax
test ecx, ecx
jg 0x1003c470
mov eax, esi
and eax, 1
add eax, esi
mov dword [0x100d897c], eax
movss dword [edx + 0xc], xmm1
mov eax, dword [0x100d8984]
movss xmm0, dword [0x100d8998]
movss dword [eax + 0xc], xmm0
mov eax, dword [0x100d8988]
movss xmm0, dword [0x100d899c]
movss dword [eax + 0xc], xmm0
mov eax, dword [0x100d898c]
movss xmm0, dword [0x100d89a0]
movss dword [eax + 0xc], xmm0
mov eax, dword [0x100d8990]
mov dword [eax + 0xc], 0
mov byte [0x100d8978], 0
jmp 0x1003c4ae
mov dword [edx + 0xc], 0
mov eax, dword [0x100d8984]
mov dword [eax + 0xc], 0
mov eax, dword [0x100d8988]
mov dword [eax + 0xc], 0
mov eax, dword [0x100d898c]
mov dword [eax + 0xc], 0
mov eax, dword [0x100d8990]
mov dword [eax + 0xc], 0x3f800000
mov byte [0x100d8978], 1
cmp byte [0x10124ff8], 0
jne case.default.0x1003c7eb
mov eax, dword [0x100d43cc]
mov esi, dword [0x100d8894]
mov dword [ebp - 0xc], esi
cmp eax, 4
je 0x1003c4d5
mov dword [0x100d4084], eax
jmp 0x1003c51d
movzx eax, word [esi + 0x1e]
test al, 8
je 0x1003c4e9
mov dword [0x100d4084], 0
jmp 0x1003c51d
test eax, 0x200
je 0x1003c4fc
mov dword [0x100d4084], 1
jmp 0x1003c51d
test eax, 0x400
je 0x1003c50f
mov dword [0x100d4084], 2
jmp 0x1003c51d
test al, 0x10
je 0x1003c51d
mov dword [0x100d4084], 3
mov ecx, dword [0x100d3a30]
cmp dword [ecx + 0xe0], 0xffffffff
jne case.default.0x1003c7eb
movss xmm2, dword [0x100d43d4]
xorps xmm0, xmm0
ucomiss xmm2, xmm0
lahf
test ah, 0x44
jnp 0x1003c5e9
movss xmm0, dword [0x100d2250]
movsd xmm1, qword [0x100c2570]
cvtps2pd xmm0, xmm0
divsd xmm1, xmm0
cvtps2pd xmm0, xmm2
divsd xmm1, xmm0
movsd xmm0, qword [0x100d23c8]
ucomisd xmm0, xmm1
movsd qword [ebp - 0x18], xmm1
lahf
test ah, 0x44
jnp 0x1003c5e6
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0x100d8a94
push 0x40
push 8
push dword [0x100d3f88]
call edi
movsd xmm0, qword [ebp - 0x18]
mulsd xmm0, qword [0x100c2610]
mov eax, dword [0x100d3f88]
push 0x100d8a94
movsd qword [eax], xmm0
push dword [0x100d8a94]
mov esi, dword [0x100d3f88]
push 8
push esi
call edi
push 8
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
movsd xmm0, qword [ebp - 0x18]
mov ecx, dword [0x100d3a30]
mov esi, dword [ebp - 0xc]
movsd qword [0x100d23c8], xmm0
xorps xmm0, xmm0
mov eax, dword [0x100d4084]
movss xmm1, dword [0x100d43d8]
movss xmm2, dword [0x100c32f0]
movss xmm3, dword [0x100c25a4]
cmp eax, 3
ja case.default.0x1003c60b
jmp dword [eax*4 + 0x1003c838]
movaps xmm0, xmm1
xorps xmm0, xmm2
jmp case.0x1003c60b.0
movaps xmm0, xmm1
jmp case.0x1003c60b.0
movaps xmm0, xmm1
mulss xmm0, xmm3
jmp case.0x1003c60b.0
movss xmm0, dword [ebp - 0x14]
mulss xmm1, xmm3
movss xmm3, dword [0x100c25e0]
divss xmm3, xmm1
mulss xmm3, xmm0
movss xmm0, dword [0x100c266c]
comiss xmm0, dword [0x10124ffc]
movss dword [ebp - 8], xmm3
jbe 0x1003c6ad
mov eax, dword [0x100d4084]
cmp eax, 3
ja case.default.0x1003c665
jmp dword [eax*4 + 0x1003c848]
mov eax, dword [ecx + 0x1f4]
mov dword [esi + 0x10], eax
jmp case.default.0x1003c665
movss xmm0, dword [ecx + 0x1f4]
xorps xmm0, xmm2
jmp 0x1003c7d2
mov eax, dword [ecx + 0x1f4]
mov dword [esi + 0x14], eax
jmp case.default.0x1003c665
movss xmm0, dword [ecx + 0x1f4]
xorps xmm0, xmm2
movss dword [esi + 0x10], xmm0
jmp case.default.0x1003c665
movss xmm1, dword [ecx + 0x5c]
movss xmm0, dword [ecx + 0x60]
call fcn.10010230
movss xmm1, dword [esi + 8]
movaps xmm2, xmm0
mulss xmm1, dword [0x100c25e0]
movss dword [ebp - 0x10], xmm2
divss xmm1, dword [0x100c26dc]
subss xmm0, xmm1
movss dword [ebp - 4], xmm1
subss xmm0, dword [ebp - 8]
call fcn.100102b0
movaps xmm1, xmm0
movss dword [ebp - 0xc], xmm0
mulss xmm1, xmm0
mov dword [esi + 0x10], 0
movss xmm0, dword [0x100c2444]
subss xmm0, xmm1
call fcn.10001610
movaps xmm1, xmm0
movss xmm0, dword [ebp - 0xc]
call fcn.10010230
comiss xmm0, dword [0x100c235c]
movss xmm0, dword [0x100d43dc]
ja 0x1003c735
xorps xmm0, xmmword [0x100c32f0]
movss dword [ebp - 0xc], xmm0
movss xmm0, dword [ebp - 4]
call fcn.100102b0
movss dword [ebp - 0x14], xmm0
movss xmm0, dword [ebp - 4]
call fcn.10010270
movss dword [ebp - 4], xmm0
movss xmm0, dword [esi + 8]
addss xmm0, xmm0
mulss xmm0, dword [0x100c25e0]
divss xmm0, dword [0x100c26dc]
subss xmm0, dword [ebp - 0x10]
addss xmm0, dword [ebp - 8]
movss dword [ebp - 0x10], xmm0
call fcn.100102b0
movss dword [ebp - 8], xmm0
movss xmm0, dword [ebp - 0x10]
call fcn.10010270
movss xmm3, dword [ebp - 8]
movaps xmm2, xmm0
mulss xmm2, dword [ebp - 0x14]
movaps xmm1, xmm3
mulss xmm1, dword [ebp - 4]
mulss xmm0, dword [ebp - 4]
mulss xmm3, dword [ebp - 0x14]
subss xmm2, xmm1
addss xmm0, xmm3
mulss xmm2, dword [ebp - 0xc]
mulss xmm0, dword [ebp - 0xc]
movss dword [esi + 0x10], xmm2
movss xmm2, dword [0x100c32f0]
movss dword [esi + 0x14], xmm0
mov eax, dword [0x100d4084]
movss xmm0, dword [esi + 0x10]
movss xmm1, dword [esi + 0x14]
cmp eax, 3
ja case.default.0x1003c7eb
jmp dword [eax*4 + 0x1003c858]
xorps xmm0, xmm2
movss dword [esi + 0x10], xmm1
movss dword [esi + 0x14], xmm0
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
xorps xmm1, xmm2
movss dword [esi + 0x14], xmm0
movss dword [esi + 0x10], xmm1
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
xorps xmm0, xmm2
xorps xmm1, xmm2
movss dword [esi + 0x14], xmm1
movss dword [esi + 0x10], xmm0
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret