Function at 0x10007baa
Capabilities:
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10035fc5
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x10045010]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [0x1006db24], 0
mov edi, dword [sym.imp.d3dx9_43.dll_D3DXCreateFontA]
jne 0x10007b3a
push 0x1006db24
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0x61697241
push eax
push 0
push 4
push 0
push 1
push 0
push 1
push 0x190
push 0
push 0xe
push esi
mov word [ebp - 0x14], 0x6c
call edi
cmp dword [0x1006db0c], 0
jne 0x10007b71
push 0x1006db0c
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0x61697241
push eax
push 0
push 5
push 0
push 1
push 0
push 1
push 0x190
push 0
push 0x12
push esi
mov word [ebp - 0x14], 0x6c
call edi
cmp dword [0x1006daf0], 0
jne 0x10007b86
push 0x1006daf0
push esi
call dword [sym.imp.d3dx9_43.dll_D3DXCreateLine]
mov eax, dword [0x1006dc9c]
dec eax
cmp eax, 3
ja case.default.0x10007b91
jmp dword [eax*4 + 0x10007e54]
mov ecx, esi
call fcn.100037d0
jmp case.default.0x10007b91
mov byte [0x1006db10], 1
jmp case.default.0x10007b91
mov byte [0x1006db10], 1
mov ecx, esi
call fcn.10002b80
mov eax, dword [0x1006dc8c]
sub eax, 1
je 0x10007bf4
sub eax, 1
jne 0x10007c02
movzx eax, byte [0x1006db1d]
push esi
push ecx
push eax
movzx eax, byte [0x1006db1e]
push ecx
movzx ecx, byte [0x1006db1f]
push eax
movzx eax, byte [0x100468bb]
inc ecx
push eax
call fcn.10004ff0
add esp, 0x18
jmp 0x10007c02
push esi
sub esp, 0x1c
mov cl, 1
call fcn.10004720
add esp, 0x20
call fcn.10007510
cmp byte [0x1006daf7], 0
mov esi, dword [0x384841ac]
jne 0x10007ca2
test esi, esi
je 0x10007ca2
mov edi, dword [esi + 0x15e4]
xor ecx, ecx
test edi, edi
jle 0x10007c9b
mov ebx, dword [esi + 0x15e0]
mov edx, dword [ebx + ecx*4]
test edx, edx
je 0x10007c96
mov eax, dword [edx + 0x328]
mov dword [ecx*4 + 0x100468e0], eax
mov eax, dword [edx + 0x2b8]
mov dword [ecx*4 + 0x10048820], eax
mov eax, dword [edx + 0x2bc]
mov dword [ecx*4 + 0x1004a760], eax
mov eax, dword [edx + 0x30c]
mov dword [ecx*4 + 0x1004c6a0], eax
mov eax, dword [edx + 0x3f8]
mov dword [ecx*4 + 0x1004e5e0], eax
mov eax, dword [edx + 0x3fc]
mov dword [ecx*4 + 0x10050520], eax
mov eax, dword [edx + 0x35c]
mov dword [ecx*4 + 0x10052460], eax
inc ecx
cmp ecx, edi
jl 0x10007c34
mov byte [0x1006daf7], 1
xor edx, edx
cmp dword [esi + 0x15e4], edx
jle 0x10007d1b
xorps xmm2, xmm2
nop
cmp byte [0x100468b8], 0
lea ecx, [edx*4]
mov eax, dword [esi + 0x15e0]
mov edi, dword [ecx + eax]
mov eax, 0x10048820
je 0x10007cd3
movaps xmm0, xmm2
jmp 0x10007cdb
movss xmm0, dword [ecx + 0x100468e0]
movss dword [edi + 0x328], xmm0
cmp byte [0x100468cd], 0
je 0x10007cf4
movaps xmm0, xmm2
movaps xmm1, xmm2
jmp 0x10007d02
movss xmm0, dword [eax + ecx + 0x1f40]
movss xmm1, dword [eax + ecx]
movss dword [edi + 0x2b8], xmm1
inc edx
movss dword [edi + 0x2bc], xmm0
cmp edx, dword [esi + 0x15e4]
jl 0x10007cb0
xor edx, edx
cmp byte [0x1006db10], dl
je 0x10007d73
mov ecx, 0xb2
nop word [eax + eax]
mov al, byte [edx + 0x1003df34]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x2c], al
and ecx, 0x800000ff
jns 0x10007d4d
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x13
jl 0x10007d30
mov byte [ebp - 0x19], 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], eax
push dword [ebp - 0x18]
mov eax, 0x4909f0
call eax
add esp, 4
jmp 0x10007dc1
mov ecx, 0x40
nop dword [eax + eax]
mov al, byte [edx + 0x1003df48]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x2c], al
and ecx, 0x800000ff
jns 0x10007d9d
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x13
jl 0x10007d80
mov byte [ebp - 0x19], 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], 1
mov dword [ebp - 0x18], eax
push dword [ebp - 0x18]
mov eax, 0x4909f0
call eax
add esp, 4
cmp byte [0x100468cf], 0
je 0x10007e38
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x18]
push eax
push 0x40
push 5
push 0x11d01a0
call edi
mov esi, 0x10007940
mov byte [0x11d01a0], 0xe8
lea eax, [esi - 0x5f0d617c]
mov dword [0x5f0d6178], eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x18]
push 5
push 0x11d01a0
call edi
lea eax, [ebp - 0x18]
push eax
push 0x40
push 5
push 0x5f0d61a0
call edi
lea eax, [ebp - 0x18]
mov byte [0x5f0d61a0], 0xe8
push eax
sub esi, 0x5f0d61cc
mov dword [0x5f0d61c8], esi
push dword [ebp - 0x18]
push 5
push 0x5f0d61a0
call edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10034b20
mov esp, ebp
pop ebp
ret