Function at 0x1000ce70
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10138018]
xor eax, ebp
mov dword [ebp - 8], eax
cmp dword [0x1013a2d4], 0
push ebx
push esi
push edi
je 0x1000d091
cmp dword [0x1013a2d8], 0
je 0x1000d091
cmp dword [0xe609e8], 5
jne 0x1000d091
mov ebx, dword [ebp + 8]
mov eax, dword [0x1013a2dc]
movss xmm2, dword [0x1012dfc8]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, dword [ebx]
jge 0x1000cf12
mov esi, dword [0x1013a2fc]
lea eax, [ebp - 0xc]
push eax
push 0x40
push 4
movss xmm0, dword [esi]
comiss xmm0, dword [0x1012e27c]
push esi
jbe 0x1000ceea
call edi
mov dword [esi], 0xc2340000
jmp 0x1000cefe
addss xmm0, xmm2
movss dword [ebp - 0x10], xmm0
call edi
movss xmm0, dword [ebp - 0x10]
movss dword [esi], xmm0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
push 4
push esi
call edi
movss xmm2, dword [0x1012dfc8]
mov eax, dword [0x1013a2dc]
cmp eax, dword [ebx]
jle 0x1000cf65
mov esi, dword [0x1013a2fc]
lea eax, [ebp - 0xc]
movss xmm0, dword [0x1012e430]
push eax
push 0x40
movss xmm1, dword [esi]
comiss xmm0, xmm1
push 4
push esi
jbe 0x1000cf45
call edi
mov dword [esi], 0xc2340000
jmp 0x1000cf59
subss xmm1, xmm2
movss dword [ebp - 0x10], xmm1
call edi
movss xmm0, dword [ebp - 0x10]
movss dword [esi], xmm0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
push 4
push esi
call edi
mov eax, dword [ebx + 4]
mov ecx, dword [0x1013a2e0]
movss xmm2, dword [0x1012dea0]
cmp ecx, eax
jge 0x1000d008
mov esi, dword [0x1013a300]
movss xmm1, dword [0x1012e428]
movss xmm0, dword [esi]
comiss xmm1, xmm0
jbe 0x1000d006
lea eax, [ebp - 0xc]
push eax
addss xmm0, xmm2
push 0x40
push 4
push esi
movss dword [ebp - 0x10], xmm0
call edi
movss xmm0, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
movss dword [esi], xmm0
push 4
push esi
call edi
mov esi, dword [0x1013a304]
lea eax, [ebp - 0xc]
push eax
push 0x40
push 8
movsd xmm0, qword [esi]
subsd xmm0, qword [0x1012dee8]
push esi
movsd qword [ebp - 0x14], xmm0
call edi
movsd xmm0, qword [ebp - 0x14]
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
movsd qword [esi], xmm0
push 8
push esi
call edi
mov eax, dword [ebx + 4]
mov ecx, dword [0x1013a2e0]
movss xmm2, dword [0x1012dea0]
cmp ecx, eax
jle 0x1000d07d
mov esi, dword [0x1013a300]
movss xmm0, dword [esi]
comiss xmm0, dword [0x1012e42c]
jbe 0x1000d07d
lea eax, [ebp - 0xc]
push eax
subss xmm0, xmm2
push 0x40
push 4
push esi
movss dword [ebp - 0x10], xmm0
call edi
movss xmm0, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
movss dword [esi], xmm0
push 4
push esi
call edi
mov esi, dword [0x1013a304]
lea eax, [ebp - 0xc]
push eax
push 0x40
push 8
movsd xmm0, qword [esi]
addsd xmm0, qword [0x1012dee8]
push esi
movsd qword [ebp - 0x14], xmm0
call edi
movsd xmm0, qword [ebp - 0x14]
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
movsd qword [esi], xmm0
push 8
push esi
call edi
mov eax, dword [ebx]
mov dword [0x1013a2dc], eax
mov eax, dword [ebx + 4]
mov dword [0x1013a2e0], eax
call fcn.1000d0b0
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1008550c
mov esp, ebp
pop ebp
ret 4