Function at 0x100ad520
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x1013e00c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x101eb0a8], 2
push ebx
push esi
mov ebx, ecx
push edi
mov dword [ebp - 0x10], ebx
jne 0x100ad54b
movss xmm0, dword [0x10135b24]
jmp 0x100ad553
movss xmm0, dword [0x10135abc]
mov edi, 0x861110
movss dword [ebp - 0xc], xmm0
call edi
mov edx, 0x861260
mov ecx, eax
call edx
mov eax, dword [eax + 0x28]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10136550]
cvtpd2ps xmm0, xmm0
addss xmm0, dword [ebp - 0xc]
cvttss2si esi, xmm0
call edi
mov ecx, eax
mov eax, 0x861260
call eax
push 0x12
push 0x12
push esi
mov eax, dword [eax + 0x24]
add eax, 0x23
push eax
mov eax, 0x790b10
call eax
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 0x10
mov esi, 0x83c080
mov ecx, 0x791070
test al, al
je 0x100ad5fe
push 1
call ecx
add esp, 4
test eax, eax
je 0x100ad5fe
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x83703d
call edi
lea eax, [ebp - 8]
mov byte [0x83703d], 0xc
push eax
push dword [ebp - 8]
push 1
push 0x83703d
call edi
mov dword [0x10541610], 0
call esi
mov eax, 0x861110
call eax
mov ecx, eax
mov eax, 0x861260
call eax
mov eax, dword [eax + 0x28]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10136550]
mov eax, 0x861110
cvtpd2ps xmm0, xmm0
addss xmm0, dword [ebp - 0xc]
cvttss2si esi, xmm0
call eax
mov ecx, eax
mov eax, 0x861260
call eax
push 0x12
push 0x12
push esi
mov eax, dword [eax + 0x24]
add eax, 0x87
push eax
mov eax, 0x790b10
call eax
add esp, 0x10
test al, al
je 0x100ad6a5
push 1
mov eax, 0x791070
call eax
add esp, 4
test eax, eax
je 0x100ad6a5
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x83703d
call edi
lea eax, [ebp - 8]
mov byte [0x83703d], 9
push eax
push dword [ebp - 8]
push 1
push 0x83703d
call edi
mov eax, 0x83c080
mov dword [0x10541610], 1
call eax
cmp dword [0x10541610], 0
je 0x100ad790
mov dword [ebx + 0x11c], 0xffffffff
mov ecx, 0x405230
xor ebx, ebx
mov dword [ebp - 0xc], ebx
cmp ebx, 5
jne 0x100ad6de
mov eax, dword [0x7bc4f04]
movzx eax, byte [eax + 0x13]
push eax
call ecx
add esp, 4
cmp al, 6
je 0x100ad747
lea esi, [ebx*8]
mov eax, 0x861110
sub esi, ebx
shl esi, 2
mov dword [ebp - 8], esi
mov edi, dword [esi + 0x10541628]
mov ebx, dword [esi + 0x10541624]
call eax
mov ecx, eax
mov eax, 0x861260
call eax
mov esi, dword [esi + 0x10541620]
mov eax, dword [eax + 0x28]
add esi, eax
mov eax, 0x861110
call eax
mov ecx, eax
mov eax, 0x861260
call eax
mov ecx, dword [ebp - 8]
push edi
push ebx
mov eax, dword [eax + 0x24]
mov ecx, dword [ecx + 0x1054161c]
add ecx, eax
mov eax, 0x790b10
push esi
push ecx
call eax
add esp, 0x10
test al, al
jne 0x100ad76c
mov ebx, dword [ebp - 0xc]
inc ebx
mov ecx, 0x405230
mov dword [ebp - 0xc], ebx
cmp ebx, 9
jl 0x100ad6c6
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100d7712
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
pop edi
add eax, 0xf0
pop esi
mov dword [ecx + 0x11c], eax
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100d7712
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100d7712
mov esp, ebp
pop ebp
ret