Function at 0x100575f0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005e66d
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x10071040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x24], ecx
mov edi, dword [0x10076e80]
mov edx, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov eax, dword [edi + 0x19d0]
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x40], ecx
mov byte [eax + 0x7c], 1
mov esi, dword [edi + 0x19d0]
mov dword [ebp - 0x20], esi
test edx, 0x100
je 0x1005767a
test ebx, ebx
je 0x10057658
mov byte [ebx], 0
test ecx, ecx
je 0x1005765f
mov byte [ecx], 0
mov eax, dword [edi + 0x1a04]
cmp eax, dword [ebp - 0x18]
jne 0x10057673
xor edx, edx
xor ecx, ecx
call fcn.10006560
xor al, al
jmp 0x10057ccd
mov eax, dword [edi + 0x19d4]
mov ecx, edx
or ecx, 2
mov dword [ebp - 0x34], eax
test dl, 0x1e
cmovne ecx, edx
mov dword [ebp - 0x14], ecx
test cl, 0x20
je 0x100576aa
cmp dword [edi + 0x19d8], esi
jne 0x100576aa
mov byte [ebp - 0x25], 1
mov dword [edi + 0x19d4], esi
jmp 0x100576ae
mov byte [ebp - 0x25], 0
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x24]
mov byte [ebp - 0x2c], 0
call fcn.10006b30
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
test al, al
je 0x100576eb
cmp byte [edi + 0x1d54], 0
je 0x100577b4
cmp dword [edi + 0x1d6c], ebx
jne 0x100576eb
test byte [edi + 0x1d58], 2
jne 0x100576eb
mov byte [ebp - 0x1c], 0
jmp 0x100576f8
cmp byte [edi + 0x1d54], 0
je 0x100577b4
mov ecx, dword [ebp - 0x14]
test ecx, 0x1000
je 0x100577b7
test byte [edi + 0x1d58], 4
jne 0x100577b7
mov ecx, 0x20
call fcn.10006a10
test al, al
je 0x100577b1
mov eax, dword [0x10076e80]
mov edx, 1
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
mov dword [eax + 0x19f0], ecx
mov byte [eax + 0x19f4], 0
test ecx, ecx
je 0x10057763
cmp dword [eax + 0x19f8], ecx
je 0x10057763
mov dword [eax + 0x1a00], 0
mov dword [eax + 0x19fc], 0
movss xmm0, dword [edi + 0x19fc]
addss xmm0, dword [0x1006a5f8]
ucomiss xmm0, dword [0x1006a5cc]
movaps xmm1, xmm0
subss xmm1, dword [edi + 0x18]
lahf
test ah, 0x44
jnp 0x100577a7
comiss xmm1, xmm0
jae 0x1005779f
movss xmm2, dword [0x1006a64c]
comiss xmm2, xmm1
jbe 0x1005779f
comiss xmm0, xmm2
jae 0x100577a7
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
jmp 0x100577ba
mov ecx, esi
mov byte [ebp - 0x2c], dl
call fcn.1000eea0
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x1c]
cmp byte [ebp - 0x25], 0
je 0x100577c9
mov eax, dword [ebp - 0x34]
mov dword [edi + 0x19d4], eax
test dl, dl
je 0x1005794e
test cl, 0x40
je 0x100577ee
mov eax, dword [edi + 0x19f8]
cmp eax, ebx
je 0x100577ee
test eax, eax
je 0x100577ee
xor dl, dl
mov dword [ebp - 0x1c], edx
jmp 0x10057951
test ecx, 0x400
je 0x1005781d
cmp byte [edi + 0x100], 0
jne 0x10057941
cmp byte [edi + 0x101], 0
jne 0x10057941
cmp byte [edi + 0x102], 0
jne 0x10057941
test cl, 2
je 0x10057852
cmp byte [edi + 0x3d8], 0
je 0x10057852
mov edx, esi
mov ecx, ebx
call fcn.10006560
test dword [ebp - 0x14], 0x2000
jne 0x10057845
mov ecx, dword [ebp - 0x18]
call fcn.10006640
mov ecx, esi
call fcn.1000eea0
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
test cl, 4
je 0x10057860
cmp byte [edi + 0x3d8], 0
jne 0x1005786e
test cl, 0x10
je 0x10057896
cmp byte [edi + 0x3dd], 0
je 0x10057896
mov byte [ebp - 0x2c], 1
test ecx, 0x800
je 0x10057880
xor edx, edx
xor ecx, ecx
jmp 0x10057884
mov edx, esi
mov ecx, ebx
call fcn.10006560
mov ecx, esi
call fcn.1000eea0
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
test cl, 8
je 0x100578cd
cmp byte [edi + 0x3e2], 0
je 0x100578cd
test cl, 1
je 0x100578ba
movss xmm0, dword [edi + 0x408]
comiss xmm0, dword [edi + 0x8c]
jae 0x100578be
mov byte [ebp - 0x2c], 1
xor edx, edx
xor ecx, ecx
call fcn.10006560
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
test cl, 1
je 0x10057941
cmp dword [edi + 0x1a04], ebx
jne 0x10057941
movss xmm0, dword [edi + 0x3f4]
xorps xmm4, xmm4
comiss xmm0, xmm4
jbe 0x10057941
mov edx, dword [0x10076e80]
movss xmm1, dword [edx + 0x3f4]
ucomiss xmm1, xmm4
lahf
test ah, 0x44
jnp 0x10057a46
movss xmm2, dword [edx + 0x8c]
comiss xmm1, xmm2
jbe 0x10057941
movss xmm3, dword [edx + 0x90]
movaps xmm0, xmm1
subss xmm0, dword [edx + 0x18]
mulss xmm3, dword [0x1006a638]
comiss xmm0, xmm1
jae 0x10057941
comiss xmm4, xmm3
jb 0x10057a1a
comiss xmm2, xmm0
ja 0x10057a46
cmp byte [ebp - 0x2c], 0
je 0x1005794e
mov byte [edi + 0x1b52], 1
mov edx, dword [ebp - 0x1c]
cmp dword [edi + 0x1af4], ebx
jne 0x10057992
cmp byte [edi + 0x1b52], 0
jne 0x10057992
cmp byte [edi + 0x1b53], 0
je 0x10057992
mov eax, dword [edi + 0x1a04]
test eax, eax
je 0x1005797e
cmp eax, ebx
je 0x1005797e
cmp eax, dword [esi + 0x48]
jne 0x10057992
test ecx, 0x4000
movzx edx, dl
mov eax, 1
cmove edx, eax
mov dword [ebp - 0x1c], edx
cmp dword [edi + 0x1afc], ebx
jne 0x10057a57
mov esi, dword [edi + 0x1af8]
mov edx, ecx
cmp esi, ebx
sete byte [ebp - 0x25]
and edx, 1
add edx, edx
xor ecx, ecx
or edx, 1
call fcn.10012740
comiss xmm0, dword [0x1006a5cc]
seta al
mov byte [ebp - 0x2d], al
cmp esi, ebx
je 0x100579d0
test al, al
je 0x100579d4
mov byte [ebp - 0x2c], 1
cmp byte [ebp - 0x25], 0
jne 0x100579e6
test al, al
jne 0x100579e6
cmp dword [edi + 0x1a04], ebx
jne 0x10057a57
mov edx, dword [ebp - 0x20]
mov ecx, ebx
mov dword [edi + 0x1af8], ebx
call fcn.10006560
cmp byte [ebp - 0x25], 0
jne 0x10057a02
cmp byte [ebp - 0x2d], 0
je 0x10057a4f
mov esi, dword [ebp - 0x14]
test esi, 0x2000
jne 0x10057a52
mov ecx, dword [ebp - 0x18]
call fcn.10006640
mov ebx, dword [ebp - 0x18]
jmp 0x10057a5a
comiss xmm2, xmm0
jbe 0x10057a24
or edx, 0xffffffff
jmp 0x10057a30
subss xmm0, xmm2
divss xmm0, xmm3
cvttss2si edx, xmm0
subss xmm1, xmm2
divss xmm1, xmm3
cvttss2si eax, xmm1
sub eax, edx
test eax, eax
jle 0x10057941
mov byte [ebp - 0x2c], 1
jmp 0x10057947
mov esi, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x18]
jmp 0x10057a5a
mov esi, dword [ebp - 0x14]
mov byte [ebp - 0x25], 0
cmp dword [edi + 0x1a04], ebx
jne 0x10057b61
mov ecx, dword [ebp - 0x2c]
test cl, cl
je 0x10057a78
mov byte [edi + 0x1a12], 1
mov eax, dword [edi + 0x1a34]
cmp eax, 1
jne 0x10057b48
cmp byte [edi + 0x1a10], 0
je 0x10057abc
mov eax, dword [ebp - 0x24]
movss xmm1, dword [edi + 0xe8]
movss xmm0, dword [edi + 0xec]
subss xmm1, dword [eax]
subss xmm0, dword [eax + 4]
movss dword [edi + 0x1a28], xmm1
movss dword [edi + 0x1a2c], xmm0
cmp byte [edi + 0xf0], 0
je 0x10057acb
mov byte [ebp - 0x25], 1
jmp 0x10057b37
cmp byte [ebp - 0x1c], 0
je 0x10057b2b
mov eax, dword [ebp - 0x14]
test al, 2
je 0x10057b28
cmp byte [edi + 0x1d54], 0
jne 0x10057b28
test al, 0x10
je 0x10057af2
cmp byte [edi + 0x3ec], 0
je 0x10057af2
mov dl, 1
jmp 0x10057af4
xor dl, dl
test al, 1
je 0x10057b0d
movss xmm0, dword [edi + 0x408]
comiss xmm0, dword [edi + 0x8c]
jb 0x10057b0d
mov al, 1
jmp 0x10057b0f
xor al, al
mov esi, dword [ebp - 0x14]
test dl, dl
jne 0x10057b2b
test al, al
movzx ecx, cl
mov eax, 1
cmove ecx, eax
mov dword [ebp - 0x2c], ecx
jmp 0x10057b2b
mov esi, dword [ebp - 0x14]
xor edx, edx
xor ecx, ecx
call fcn.10006560
mov ebx, dword [ebp - 0x18]
test esi, 0x2000
jne 0x10057b61
mov byte [edi + 0x1b52], 1
jmp 0x10057b61
cmp eax, 2
jne 0x10057b61
cmp dword [edi + 0x1afc], ebx
je 0x10057b61
xor edx, edx
xor ecx, ecx
call fcn.10006560
mov ebx, dword [ebp - 0x18]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x4c]
push eax
call fcn.10058d60
mov eax, dword [ebp - 0x44]
cmp byte [eax + 0xd], 0
jne 0x10057b89
cmp ebx, dword [eax + 0x10]
jb 0x10057b89
cmp eax, dword [0x10077248]
je 0x10057b89
mov al, byte [eax + 0x14]
jmp 0x10057b8b
xor al, al
mov ebx, dword [ebp - 0x1c]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
test bl, bl
je 0x10057c68
test al, al
jne 0x10057c75
mov esi, dword [0x10077040]
lea eax, [ebp - 0x24]
push eax
push 0x40
push 2
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
push eax
call edi
movzx eax, word [esi + 0x7c]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x24]
lea eax, [ebp - 0x1c]
push 2
push eax
call edi
mov ecx, dword [ebp - 0x1c]
call fcn.1004af50
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x4c]
push eax
call fcn.10058d60
mov ecx, dword [ebp - 0x44]
cmp byte [ecx + 0xd], 0
jne 0x10057bfb
mov eax, dword [ebp - 0x18]
cmp eax, dword [ecx + 0x10]
jae 0x10057c62
cmp dword [0x1007724c], 0xaaaaaaa
je 0x10057ce9
mov esi, dword [0x10077248]
mov dword [ebp - 0x38], 0x10077248
mov dword [ebp - 4], 0
push 0x18
mov dword [ebp - 0x34], 0
call fcn.1005b521
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x18]
mov dword [eax + 0x10], ecx
mov ecx, 0x10077248
push eax
push dword [ebp - 0x48]
mov byte [eax + 0x14], 0
push dword [ebp - 0x4c]
mov dword [eax], esi
mov dword [eax + 4], esi
mov dword [eax + 8], esi
mov word [eax + 0xc], 0
call fcn.10046830
mov ecx, eax
mov byte [ecx + 0x14], 1
jmp 0x10057c75
test al, al
je 0x10057c75
lea eax, [ebp - 0x18]
push eax
call fcn.10058650
mov eax, dword [ebp - 0x2c]
test al, al
je 0x10057cb8
mov esi, dword [0x10077040]
lea eax, [ebp - 0x20]
push eax
push 0x40
push 2
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
call edi
movzx eax, word [esi + 0x78]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
lea eax, [ebp - 0x14]
push 2
push eax
call edi
mov ecx, dword [ebp - 0x14]
call fcn.1004af50
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x3c]
test ecx, ecx
je 0x10057cc1
mov byte [ecx], bl
mov edx, dword [ebp - 0x40]
test edx, edx
je 0x10057ccd
mov cl, byte [ebp - 0x25]
mov byte [edx], cl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1005ae5b
mov esp, ebp
pop ebp
ret
call fcn.1003f950
int3