Function at 0x10005d90
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x74
push ebx
push esi
push edi
push str.PointBlank.exe
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, dword [0x10056db8]
mov edi, dword [ecx + eax]
mov eax, dword [ecx + eax - 0x34]
mov ecx, dword [0x10056d80]
lea esi, [ecx + edi]
push 0x21
mov dword [esp + 0x30], edi
mov dword [esp + 0x38], eax
mov dword [esp + 0x34], esi
call sub.MSVCR90.dll_void____cdecl_operator_new___unsigned_int_
add esp, 4
push 0x21
mov dword [esp + 0x4c], eax
call sub.MSVCR90.dll_void____cdecl_operator_new___unsigned_int_
add esp, 4
push 0x21
call sub.MSVCR90.dll_void____cdecl_operator_new___unsigned_int_
add esp, 4
push 0x21
call sub.MSVCR90.dll_void____cdecl_operator_new___unsigned_int_
fild dword [0x1005709c]
mov edx, dword [0x1005709c]
add esp, 4
test edx, edx
jge 0x10005e0b
fadd dword [0x10049370]
fmul qword [0x10049388]
mov eax, dword [0x100570a0]
fstp dword [esp + 0x40]
fild dword [0x100570a0]
test eax, eax
jge 0x10005e2a
fadd dword [0x10049370]
mov cl, byte [esi]
fstp dword [esp + 0x3c]
xor eax, eax
movsx ecx, cl
cmp eax, ecx
je 0x10005e84
add eax, 2
cmp eax, 0x10
jl 0x10005e35
mov eax, 1
cmp eax, ecx
je 0x10005e8e
add eax, 2
cmp eax, 0x10
jl 0x10005e46
mov dword [esp + 0x24], 0xffffffff
mov ecx, dword [0x10056d4c]
movzx edx, byte [ecx]
mov dword [esp + 0x28], edx
fild dword [esp + 0x28]
fcomp qword [0x10049368]
fnstsw ax
test ah, 0x41
jne 0x100064b3
xor edx, edx
mov dword [esp + 0x20], edx
jmp 0x10005ea8
mov dword [esp + 0x24], 2
jmp 0x10005e5a
mov dword [esp + 0x24], 1
jmp 0x10005e5a
mov edi, dword [esp + 0x2c]
mov esi, dword [esp + 0x30]
test edi, edi
je 0x100064a1
mov eax, dword [0x10056e20]
mov ecx, dword [0x10056d60]
imul eax, edx
add eax, dword [0x10056f34]
add eax, edi
mov edi, dword [0x10056d70]
imul edi, edx
add edi, dword [0x10056f38]
mov dword [esp + 0x28], eax
mov eax, dword [0x10056d68]
mov eax, dword [eax]
add edi, dword [esp + 0x34]
lea edx, [ecx + edx*4]
mov ebx, dword [edx + eax]
movzx edx, byte [esi]
lea ecx, [ecx + edx*4]
mov esi, dword [ecx + eax]
lea edx, [esp + 0x1c]
push edx
push 0x40
push 4
push ebx
mov dword [esp + 0x28], edi
mov dword [esp + 0x54], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 0x1c]
push eax
push 0x40
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x1c]
push ecx
push edx
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x1c]
push eax
push ecx
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
fld dword [ebx + 0x6c]
fstp dword [0x10056e24]
fld dword [ebx + 0x70]
fstp dword [0x10056e28]
fld dword [ebx + 0x74]
fstp dword [0x10056e2c]
fld dword [ebx + 0x6c]
fstp dword [0x10056f74]
fld dword [ebx + 0x70]
fadd qword [0x10049408]
fstp dword [0x10056f78]
fld dword [ebx + 0x74]
fstp dword [0x10056f7c]
fld dword [esi + 0x6c]
fsub dword [ebx + 0x6c]
fstp dword [esp + 0x64]
fld dword [esi + 0x70]
fsub dword [ebx + 0x70]
fstp dword [esp + 0x68]
fld dword [esi + 0x74]
fsub dword [ebx + 0x74]
fstp dword [esp + 0x6c]
fld dword [esp + 0x64]
fld dword [esp + 0x68]
fld dword [esp + 0x6c]
fld st(1)
fmulp st(2)
fld st(2)
fmulp st(3)
fxch st(1)
faddp st(2)
fmul st(0), st(0)
faddp st(1)
fstp dword [esp + 0x38]
fld dword [esp + 0x38]
call sub.MSVCR90.dll__CIsqrt
movsx ecx, byte [esp + 0x20]
fstp dword [esp + 0x38]
fld dword [esp + 0x38]
xor eax, eax
fstp dword [esp + 0x38]
cmp eax, ecx
je 0x10006012
add eax, 2
cmp eax, 0x10
jl 0x10005fd7
mov eax, 1
cmp eax, ecx
je 0x10006019
add eax, 2
cmp eax, 0x10
jl 0x10005fe8
or eax, 0xffffffff
cmp eax, dword [esp + 0x24]
je 0x100064a1
cmp eax, 1
jne 0x10006020
mov dword [0x10056f3c], 0xff0000ff
jmp 0x10006033
mov eax, 2
jmp 0x10005ff7
mov eax, 1
jmp 0x10005ff7
cmp eax, 2
jne 0x100064a1
mov dword [0x10056f3c], 0xffff0000
mov edx, dword [0x10056e24]
mov ecx, dword [0x10056e28]
sub esp, 0xc
mov eax, esp
mov dword [eax], edx
mov edx, dword [0x10056e2c]
mov dword [eax + 4], ecx
mov dword [eax + 8], edx
mov eax, dword [ebp + 8]
mov esi, 0x10056e30
call fcn.10001740
test al, al
je 0x100064a1
fld1
fcomp dword [edi]
fnstsw ax
test ah, 5
jp 0x10006122
push str.PointBlank.exe
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, dword [0x10056dc4]
cmp dword [ecx + eax], 0
jbe 0x10006122
cmp dword [0x10057114], 0
je 0x10006122
fld dword [esp + 0x38]
fld st(0)
fdivr qword [0x10049400]
fld qword [0x10049380]
fdivr st(1)
fld qword [0x10049378]
fmul st(1), st(0)
fld qword [0x100493f8]
fdiv st(2), st(0)
fxch st(2)
call fcn.100385a0
fxch st(2)
fdiv qword [0x100493f0]
mov edi, eax
fmulp st(2)
fdivp st(1)
call fcn.100385a0
fld dword [0x10056e34]
fld st(1)
push eax
fdivr qword [0x100493e8]
fdiv qword [0x100493e0]
fsubp st(1)
call fcn.100385a0
fld dword [0x10056e30]
fld qword [0x100493d8]
push eax
fdivrp st(2)
fxch st(1)
fdiv qword [0x10049398]
fsubp st(1)
call fcn.100385a0
mov esi, dword [ebp + 8]
mov ecx, eax
mov eax, edi
call fcn.10001c60
mov edx, dword [esp + 0x20]
push edx
xor eax, eax
lea edi, [esp + 0x50]
call fcn.10003cb0
add esp, 4
test al, al
je 0x100064a1
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x50]
sub esp, 0xc
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x60]
mov dword [eax + 4], edx
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
lea esi, [esp + 0x64]
call fcn.10001740
test al, al
je 0x100061b4
fld1
mov edx, dword [esp + 0x18]
fcomp dword [edx]
fnstsw ax
test ah, 5
jp 0x100061b4
call fcn.100021a0
test al, al
je 0x100061b4
cmp dword [0x1005710c], 0
je 0x100061b4
fld dword [esp + 0x5c]
call fcn.100385a0
fld dword [esp + 0x58]
push eax
call fcn.100385a0
fld dword [esp + 0x40]
push eax
call fcn.100385a0
fld dword [esp + 0x48]
push eax
call fcn.100385a0
push eax
call fcn.10001680
mov eax, dword [esp + 0x20]
push eax
mov eax, 7
lea edi, [esp + 0x50]
call fcn.10003cb0
add esp, 4
test al, al
je 0x100064a1
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x50]
sub esp, 0xc
mov eax, esp
mov dword [eax], ecx
mov ecx, dword [esp + 0x60]
mov dword [eax + 4], edx
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
lea esi, [esp + 0x64]
call fcn.10001740
test al, al
je 0x100064a1
fld1
mov edx, dword [esp + 0x18]
fcomp dword [edx]
fnstsw ax
test ah, 5
jp 0x100064a1
call fcn.100021a0
test al, al
je 0x100064a1
cmp dword [0x10057100], 0
je 0x100062bc
fld dword [esp + 0x5c]
fsub qword [0x100493d0]
call fcn.100385a0
fld dword [esp + 0x58]
fsub qword [0x100493a0]
mov esi, eax
call fcn.100385a0
mov ecx, dword [esp + 0x28]
mov edx, dword [0x10056f3c]
mov edi, eax
mov eax, dword [esp + 0x18]
fld dword [eax]
sub esp, 8
fstp qword [esp]
push ecx
push str._s____0.0f_HP
push edx
push esi
mov ecx, edi
call fcn.10001840
mov eax, dword [esp + 0x30]
fld dword [eax]
mov ecx, dword [esp + 0x40]
add esp, 0x10
fstp qword [esp]
push ecx
push str._s____0.0f_HP
push 0x96000000
push esi
mov ecx, edi
call fcn.10001840
mov edx, dword [esp + 0x30]
fld dword [edx]
mov eax, dword [esp + 0x40]
add esp, 0x10
fstp qword [esp]
push eax
push str._s____0.0f_HP
push 0x96000000
push esi
mov ecx, edi
call fcn.10001840
add esp, 0x18
call fcn.100021a0
test al, al
je 0x100064a1
cmp dword [0x10057118], 0
je 0x100063c9
mov eax, dword [esp + 0x44]
fld dword [eax + 0x70]
fsub dword [ebx + 0x70]
fld dword [eax + 0x6c]
fsub dword [ebx + 0x6c]
fld dword [eax + 0x74]
fsub dword [ebx + 0x74]
fld st(1)
fmulp st(2)
fld st(2)
fmulp st(3)
fxch st(1)
faddp st(2)
fmul st(0), st(0)
faddp st(1)
fstp dword [esp + 0x44]
fld dword [esp + 0x44]
call sub.MSVCR90.dll__CIsqrt
fstp dword [esp + 0x44]
fld dword [esp + 0x44]
mov esi, dword [esp + 0x48]
fmul qword [0x100493c8]
sub esp, 8
fstp qword [esp]
push str._Dist:__0.0f_M_
push esi
call dword [sym.imp.MSVCR90.dll_sprintf]
fld dword [0x10056e34]
fadd qword [0x100493c0]
add esp, 0x10
push 0xff0000ff
call fcn.100385a0
fld dword [0x10056e30]
fsub qword [0x100493b8]
mov edi, eax
call fcn.100385a0
push esi
mov ecx, edi
mov edx, eax
call fcn.10001630
fld dword [0x10056e34]
fadd qword [0x100493c0]
push 0x96000000
call fcn.100385a0
fld dword [0x10056e30]
fsub qword [0x100493b8]
mov edi, eax
call fcn.100385a0
push esi
mov ecx, edi
mov edx, eax
call fcn.10001630
fld dword [0x10056e34]
fadd qword [0x100493c0]
push 0x96000000
call fcn.100385a0
fld dword [0x10056e30]
fsub qword [0x100493b8]
mov edi, eax
call fcn.100385a0
push esi
mov ecx, edi
mov edx, eax
call fcn.10001630
call fcn.100021a0
test al, al
je 0x100064a1
cmp dword [0x10057104], 0
je 0x10006423
mov ecx, dword [esp + 0x18]
fld dword [ecx]
mov esi, dword [ebp + 8]
sub esp, 0xc
fstp dword [esp + 8]
fld dword [0x10056e34]
fadd qword [0x100493b0]
fstp dword [esp + 0x50]
fld dword [esp + 0x50]
fstp dword [esp + 4]
fld dword [0x10056e30]
fsub qword [0x100493b8]
fstp dword [esp + 0x50]
fld dword [esp + 0x50]
fstp dword [esp]
call fcn.10001f40
call fcn.100021a0
test al, al
je 0x100064a1
cmp dword [0x10057108], 0
je 0x100064a1
fld dword [esp + 0x5c]
call fcn.100385a0
fld dword [esp + 0x58]
mov esi, eax
call fcn.100385a0
test eax, eax
jge 0x10006452
mov eax, 1
test esi, esi
jge 0x1000645b
mov esi, 1
fldz
push 0
push ecx
fstp dword [esp]
push 0xffffff00
mov dword [esp + 0x7c], eax
add eax, 3
push 1
lea ecx, [esp + 0x80]
mov dword [esp + 0x88], eax
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov edx, dword [edx + 0xac]
push ecx
mov dword [esp + 0x88], esi
push 1
add esi, 3
push eax
mov dword [esp + 0x98], esi
call edx
mov edx, dword [esp + 0x20]
inc edx
cmp edx, 0x16
mov dword [esp + 0x20], edx
jle 0x10005ea0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret