Function at 0x10054420
Capabilities:
Execute shellcode via indirect call

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x18
cmp dword [0x101831f0], 0
push esi
mov esi, dword [0x1018d7c4]
push edi
mov dword [ebp - 0xc], esi
jne 0x10054462
mov byte [0x10189f85], 0
call fcn.100a7110
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
mov cl, byte [0x10189f85]
mov edi, 0xf9e7
mov ch, byte [0x101da629]
test cl, cl
je 0x10054932
mov edx, dword [0x1018320c]
test ch, ch
jne 0x100544af
cmp edx, 3
jne 0x10054493
mov byte [0x10189f7f], 1
jmp 0x100544af
movzx eax, byte [0x10189f81]
mov edi, 1
cmp edx, 4
cmove eax, edi
mov edi, 0xf9e7
mov byte [0x10189f81], al
cmp byte [0x10183321], 0
mov eax, dword [0x101831f8]
je 0x100544e0
cmp byte [0x101da11c], 0
jne 0x100544e0
cmp eax, 4
je 0x100544e0
and word [esi + 0x1e], di
mov edx, dword [0x1018320c]
mov eax, dword [0x101831f8]
mov cl, byte [0x10189f85]
test cl, cl
je 0x10054932
cmp edx, 1
jne 0x100544fa
cmp dword [0x1018d7d8], 0x1d
jne 0x10054454
movzx ecx, word [esi + 0x1e]
test cl, 1
je 0x1005450c
cmp edx, 2
je 0x10054454
mov edx, dword [0x10183218]
cmp edx, 1
jne 0x1005452e
cmp byte [0x101da11d], 0
je 0x10054551
call fcn.100a7110
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
cmp edx, 2
jne 0x10054551
cmp byte [0x101da11d], 0
je 0x10054551
movss xmm0, dword [0x101da124]
comiss xmm0, dword [0x1018321c]
jae 0x10054454
cmp eax, 4
je 0x100545b6
cmp byte [0x10183210], 0
mov dword [0x1018d55c], eax
je case.default.0x1005458b
cmp byte [0x101da11c], 0
jne case.default.0x1005458b
call fcn.100d4a2c
and eax, 0x80000003
jns 0x10054586
dec eax
or eax, 0xfffffffc
inc eax
cmp eax, 3
ja case.default.0x1005458b
jmp dword [eax*4 + 0x1005499c]
or word [esi + 0x1e], 8
jmp case.default.0x1005458b
or word [esi + 0x1e], 0x10
jmp case.default.0x1005458b
mov eax, 0x200
or word [esi + 0x1e], ax
jmp case.default.0x1005458b
mov eax, 0x400
or word [esi + 0x1e], ax
jmp case.default.0x1005458b
test cl, 8
je 0x100545c7
mov dword [0x1018d55c], 0
jmp case.default.0x1005458b
test ecx, 0x200
je 0x100545db
mov dword [0x1018d55c], 1
jmp case.default.0x1005458b
test ecx, 0x400
je 0x100545ef
mov dword [0x1018d55c], 2
jmp case.default.0x1005458b
mov eax, dword [0x1018d55c]
test cl, 0x10
mov ecx, 3
cmovne eax, ecx
mov dword [0x1018d55c], eax
mov ecx, dword [0x10188420]
cmp dword [ecx + 0xe0], 0xffffffff
jne 0x10054990
movss xmm2, dword [0x10183200]
xorps xmm0, xmm0
ucomiss xmm2, xmm0
lahf
test ah, 0x44
jnp 0x100546d0
movss xmm0, dword [0x10186aac]
movsd xmm1, qword [0x1012a500]
cvtps2pd xmm0, xmm0
divsd xmm1, xmm0
cvtps2pd xmm0, xmm2
divsd xmm1, xmm0
movsd xmm0, qword [0x10186c58]
ucomisd xmm0, xmm1
movsd qword [ebp - 0x18], xmm1
lahf
test ah, 0x44
jnp 0x100546cd
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0x1018db28
push 0x40
push 8
push dword [0x10189758]
call edi
movsd xmm0, qword [ebp - 0x18]
mulsd xmm0, qword [0x1012a5b8]
mov eax, dword [0x10189758]
push 0x1018db28
movsd qword [eax], xmm0
push dword [0x1018db28]
mov esi, dword [0x10189758]
push 8
push esi
call edi
push 8
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
movsd xmm0, qword [ebp - 0x18]
mov ecx, dword [0x10188420]
mov esi, dword [ebp - 0xc]
movsd qword [0x10186c58], xmm0
xorps xmm0, xmm0
mov eax, dword [0x1018d55c]
movss xmm1, dword [0x10183204]
movss xmm2, dword [0x1012c1c0]
movss xmm3, dword [0x1012a534]
cmp eax, 3
ja case.default.0x100546f2
jmp dword [eax*4 + 0x100549ac]
movaps xmm0, xmm1
xorps xmm0, xmm2
jmp case.0x100546f2.0
movaps xmm0, xmm1
jmp case.0x100546f2.0
movaps xmm0, xmm1
mulss xmm0, xmm3
jmp case.0x100546f2.0
movss xmm0, dword [ebp - 0x14]
mulss xmm1, xmm3
movss xmm3, dword [0x1012a578]
divss xmm3, xmm1
mulss xmm3, xmm0
movss xmm0, dword [0x1012a654]
comiss xmm0, dword [0x101da124]
movss dword [ebp - 8], xmm3
jbe 0x10054794
mov eax, dword [0x1018d55c]
cmp eax, 3
ja case.default.0x1005474c
jmp dword [eax*4 + 0x100549bc]
mov eax, dword [ecx + 0x1f4]
mov dword [esi + 0x10], eax
jmp case.default.0x1005474c
movss xmm0, dword [ecx + 0x1f4]
xorps xmm0, xmm2
jmp 0x100548b8
mov eax, dword [ecx + 0x1f4]
mov dword [esi + 0x14], eax
jmp case.default.0x1005474c
movss xmm0, dword [ecx + 0x1f4]
xorps xmm0, xmm2
movss dword [esi + 0x10], xmm0
jmp case.default.0x1005474c
movss xmm1, dword [ecx + 0x5c]
movss xmm0, dword [ecx + 0x60]
call fcn.1001e200
movss xmm1, dword [esi + 8]
movaps xmm2, xmm0
mulss xmm1, dword [0x1012a578]
movss dword [ebp - 0x10], xmm2
divss xmm1, dword [0x1012a734]
subss xmm0, xmm1
movss dword [ebp - 4], xmm1
subss xmm0, dword [ebp - 8]
call fcn.1001e2b0
movaps xmm1, xmm0
movss dword [ebp - 0xc], xmm0
mulss xmm1, xmm0
mov dword [esi + 0x10], 0
movss xmm0, dword [0x1012a3c4]
subss xmm0, xmm1
call fcn.10002f20
movaps xmm1, xmm0
movss xmm0, dword [ebp - 0xc]
call fcn.1001e200
xorps xmm1, xmm1
comiss xmm0, xmm1
movss xmm0, dword [0x10183208]
ja 0x1005481b
xorps xmm0, xmmword [0x1012c1c0]
movss dword [ebp - 0xc], xmm0
movss xmm0, dword [ebp - 4]
call fcn.1001e2b0
movss dword [ebp - 0x14], xmm0
movss xmm0, dword [ebp - 4]
call fcn.1001e240
movss dword [ebp - 4], xmm0
movss xmm0, dword [esi + 8]
addss xmm0, xmm0
mulss xmm0, dword [0x1012a578]
divss xmm0, dword [0x1012a734]
subss xmm0, dword [ebp - 0x10]
addss xmm0, dword [ebp - 8]
movss dword [ebp - 0x10], xmm0
call fcn.1001e2b0
movss dword [ebp - 8], xmm0
movss xmm0, dword [ebp - 0x10]
call fcn.1001e240
movss xmm3, dword [ebp - 8]
movaps xmm2, xmm0
mulss xmm2, dword [ebp - 0x14]
movaps xmm1, xmm3
mulss xmm1, dword [ebp - 4]
mulss xmm0, dword [ebp - 4]
mulss xmm3, dword [ebp - 0x14]
subss xmm2, xmm1
addss xmm0, xmm3
mulss xmm2, dword [ebp - 0xc]
mulss xmm0, dword [ebp - 0xc]
movss dword [esi + 0x10], xmm2
movss xmm2, dword [0x1012c1c0]
movss dword [esi + 0x14], xmm0
mov eax, dword [0x1018d55c]
movss xmm0, dword [esi + 0x10]
movss xmm1, dword [esi + 0x14]
cmp eax, 3
ja case.default.0x100548d1
jmp dword [eax*4 + 0x100549cc]
xorps xmm0, xmm2
movss dword [esi + 0x10], xmm1
movss dword [esi + 0x14], xmm0
mov byte [0x101da629], 1
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
xorps xmm1, xmm2
movss dword [esi + 0x14], xmm0
movss dword [esi + 0x10], xmm1
mov byte [0x101da629], 1
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
xorps xmm0, xmm2
xorps xmm1, xmm2
movss dword [esi + 0x14], xmm1
movss dword [esi + 0x10], xmm0
mov byte [0x101da629], 1
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.100a7110
mov dword [0x1018d55c], 4
test ch, ch
je 0x10054973
movzx eax, byte [0x10189f7f]
xor edx, edx
cmp dword [0x1018320c], 3
cmove eax, edx
cmp dword [0x1018320c], 4
mov byte [0x10189f7f], al
movzx eax, byte [0x10189f81]
cmove eax, edx
mov byte [0x10189f81], al
cmp byte [0x10183321], 0
mov byte [0x101da629], 0
je 0x10054990
cmp byte [0x101da11c], 0
jne 0x10054990
and word [esi + 0x1e], di
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret