Function at 0x100637be
Capabilities:
Execute shellcode via indirect call

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a85dd
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x80
mov eax, dword [0x100d1400]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebx + 8]
xorps xmm0, xmm0
movups xmmword [ebp - 0x34], xmm0
mov dword [ebp - 0x24], 0
push 8
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
call fcn.1007a728
lea ecx, [ebp - 0x34]
add esp, 4
mov dword [eax + 4], 0
mov dword [ebp - 0x34], eax
mov dword [eax], ecx
mov dword [ebp - 4], 0
mov eax, dword [0x100d4404]
cmp eax, 4
ja case.default.0x10063766
jmp dword [eax*4 + 0x10063fbc]
mov dword [ebp - 0x38], 0xb
jmp 0x100638be
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], 7
push eax
lea ecx, [ebp - 0x34]
call fcn.100085d0
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], 8
push eax
lea ecx, [ebp - 0x34]
call fcn.100085d0
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], 9
push eax
lea ecx, [ebp - 0x34]
call fcn.100085d0
mov dword [ebp - 0x38], 0xa
jmp 0x100638be
mov dword [ebp - 0x38], 0
jmp 0x100638be
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], 0xc
push eax
lea ecx, [ebp - 0x34]
call fcn.100085d0
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], 0xd
push eax
lea ecx, [ebp - 0x34]
call fcn.100085d0
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], 0xe
push eax
lea ecx, [ebp - 0x34]
call fcn.100085d0
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], 0xf
push eax
lea ecx, [ebp - 0x34]
call fcn.100085d0
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], 0x10
push eax
lea ecx, [ebp - 0x34]
call fcn.100085d0
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], 0x11
push eax
lea ecx, [ebp - 0x34]
call fcn.100085d0
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], 0x12
push eax
lea ecx, [ebp - 0x34]
call fcn.100085d0
mov dword [ebp - 0x38], 0x13
jmp 0x100638be
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], 1
push eax
lea ecx, [ebp - 0x34]
call fcn.100085d0
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], 2
push eax
lea ecx, [ebp - 0x34]
call fcn.100085d0
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], 3
push eax
lea ecx, [ebp - 0x34]
call fcn.100085d0
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], 4
push eax
lea ecx, [ebp - 0x34]
call fcn.100085d0
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], 5
push eax
lea ecx, [ebp - 0x34]
call fcn.100085d0
mov dword [ebp - 0x38], 6
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x34]
call fcn.100085d0
cmp byte [0x100d43f0], 0
jne 0x100638dd
call fcn.10063520
jmp 0x10063f93
cmp dword [0x100d43f4], 0
je 0x100638ef
cmp byte [0x100d4079], 0
je 0x100638d3
cmp byte [0x10124ff4], 0
jne 0x100638d3
cmp byte [0x100d43fc], 0
mov byte [0x100d4074], 1
je 0x1006390f
mov byte [0x100d4447], 1
cmp byte [0x100d4409], 0
je 0x1006392a
cmp dword [0x100d89d0], 0x1d
je 0x1006392a
mov word [0x100d4413], 0x101
lea eax, [esi + 4]
test eax, eax
je 0x10063941
movss xmm2, dword [eax + 8]
movss xmm0, dword [eax]
movss xmm3, dword [eax + 4]
jmp 0x1006394a
xorps xmm2, xmm2
xorps xmm0, xmm0
xorps xmm3, xmm3
mov eax, dword [0x100d3810]
movss xmm5, dword [0x100c26dc]
movss xmm4, dword [0x100c2788]
movss dword [ebp - 0x18], xmm2
movss xmm1, dword [eax + 0x2abf0]
addss xmm1, xmm1
addss xmm1, xmm0
movss xmm0, dword [eax + 0x2abf4]
addss xmm0, xmm0
comiss xmm1, xmm5
addss xmm0, xmm3
movss dword [ebp - 0x20], xmm1
movss xmm3, dword [0x100c26f8]
movss dword [ebp - 0x1c], xmm0
jbe 0x100639a1
subss xmm1, xmm3
jmp 0x100639aa
comiss xmm4, xmm1
jbe 0x100639af
addss xmm1, xmm3
movss dword [ebp - 0x20], xmm1
comiss xmm0, xmm5
jbe 0x100639ba
subss xmm0, xmm3
jmp 0x100639c3
comiss xmm4, xmm0
jbe 0x100639c8
addss xmm0, xmm3
movss dword [ebp - 0x1c], xmm0
comiss xmm2, xmm5
jbe 0x100639d3
subss xmm2, xmm3
jmp 0x100639dc
comiss xmm4, xmm2
jbe 0x100639e1
addss xmm2, xmm3
movss dword [ebp - 0x18], xmm2
push 0
push 0
lea eax, [ebp - 0x90]
push eax
lea ecx, [ebp - 0x20]
call fcn.10054cb0
xorps xmm3, xmm3
or esi, 0xffffffff
movss dword [ebp - 0x68], xmm3
xorps xmm7, xmm7
movss dword [ebp - 0x38], xmm3
xor edi, edi
movss xmm3, dword [0x100c273c]
mov dword [ebp - 0x3c], esi
mov esi, 1
movss dword [ebp - 0x58], xmm7
movss dword [ebp - 0x4c], xmm3
push 1
push esi
call fcn.10065e30
inc esi
cmp esi, 0x20
jle 0x10063a23
mov eax, dword [0x10124fd8]
mov edx, 1
movss xmm4, dword [0x100d2250]
mov dword [ebp - 0x64], edx
cmp edx, eax
je 0x10063c41
jge 0x10063a5e
imul eax, edx, 0xc4c
lea esi, [eax + 0x100dc688]
jmp 0x10063a6d
lea eax, [edx - 2]
imul esi, eax, 0xc4c
add esi, 0x100dd2d4
test esi, esi
je 0x10063c3c
cmp byte [0x100d43fc], 0
jne 0x10063a8c
mov eax, dword [0x10124fdc]
cmp dword [esi + 4], eax
je 0x10063c3c
cmp byte [esi + 0x1a], 0
jne 0x10063c3c
cmp byte [0x100d4436], 0
je 0x10063aa9
cmp dword [esi + 0x10], 1
je 0x10063c3c
movss xmm2, dword [esi + 0x5c]
movaps xmm0, xmm4
mulss xmm0, dword [esi + 0x50]
movaps xmm1, xmm4
mov ecx, dword [ebp - 0x28]
mulss xmm1, dword [esi + 0x54]
mov eax, dword [ebp - 0x24]
mulss xmm4, dword [esi + 0x58]
addss xmm0, xmm2
add eax, ecx
mov dword [ebp - 0x5c], ecx
movss xmm5, dword [esi + 0x60]
movss xmm6, dword [esi + 0x64]
addss xmm1, xmm5
movss dword [ebp - 0x7c], xmm2
addss xmm4, xmm6
movss dword [ebp - 0x80], xmm5
movss dword [ebp - 0x84], xmm6
movss dword [ebp - 0x60], xmm0
movss dword [ebp - 0x50], xmm1
movss dword [ebp - 0x54], xmm4
mov dword [ebp - 0x78], eax
cmp ecx, eax
je 0x10063c34
mov edx, dword [ebp - 0x2c]
dec edx
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x6c], eax
mov eax, ecx
shr eax, 2
and ecx, 3
and eax, edx
mov dword [ebp - 0x74], edi
mov edx, dword [ebp - 0x30]
movss dword [ebp - 0x3c], xmm3
movss dword [ebp - 0x70], xmm3
movss xmm3, dword [0x10125024]
mov eax, dword [edx + eax*4]
mov edi, dword [eax + ecx*4]
lea eax, [edi + edi*2]
addss xmm0, dword [esi + eax*4 + 0x80]
subss xmm0, xmm2
movss xmm2, dword [0x10125028]
subss xmm3, xmm0
movaps xmm0, xmm1
addss xmm0, dword [esi + eax*4 + 0x84]
movss xmm1, dword [0x1012502c]
mulss xmm3, xmm3
subss xmm0, xmm5
subss xmm2, xmm0
movaps xmm0, xmm4
addss xmm0, dword [esi + eax*4 + 0x88]
mulss xmm2, xmm2
subss xmm0, xmm6
addss xmm2, xmm3
subss xmm1, xmm0
mulss xmm1, xmm1
addss xmm2, xmm1
movaps xmm0, xmm2
call fcn.10001610
movss xmm3, dword [ebp - 0x4c]
comiss xmm3, xmm0
movss xmm1, dword [ebp - 0x50]
movss xmm4, dword [ebp - 0x54]
jbe 0x10063bdf
movss xmm7, dword [ebp - 0x60]
movaps xmm3, xmm0
movss dword [ebp - 0x4c], xmm3
movss dword [ebp - 0x58], xmm7
movss dword [ebp - 0x68], xmm1
movss dword [ebp - 0x38], xmm4
jmp 0x10063be4
movss xmm7, dword [ebp - 0x58]
movss xmm2, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x5c]
comiss xmm2, xmm0
mov edx, dword [ebp - 0x40]
movss xmm2, dword [ebp - 0x70]
movss xmm5, dword [ebp - 0x80]
cmovbe edi, dword [ebp - 0x6c]
movss xmm6, dword [ebp - 0x84]
comiss xmm2, xmm0
mov dword [ebp - 0x3c], edi
mov edi, esi
movss xmm0, dword [ebp - 0x60]
movss xmm2, dword [ebp - 0x7c]
cmovbe edi, dword [ebp - 0x74]
inc ecx
mov dword [ebp - 0x5c], ecx
cmp ecx, dword [ebp - 0x78]
jne 0x10063b17
mov esi, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x64]
mov dword [ebp - 0x3c], esi
movss xmm4, dword [0x100d2250]
mov eax, dword [0x10124fd8]
inc edx
mov dword [ebp - 0x64], edx
cmp edx, 0x20
jle 0x10063a46
mov esi, 1
push 0
push esi
call fcn.10065e30
inc esi
cmp esi, 0x20
jle 0x10063c53
mov esi, dword [ebp - 0x3c]
test edi, edi
je 0x10063f8c
movss xmm2, dword [0x100d2250]
lea eax, [esi + esi*2]
mov dword [ebp - 0x20], 0
movaps xmm1, xmm2
mov dword [ebp - 0x1c], 0
movaps xmm0, xmm2
mov dword [ebp - 0x18], 0
mulss xmm1, dword [edi + 0x50]
mulss xmm0, dword [edi + 0x54]
mulss xmm2, dword [edi + 0x58]
addss xmm1, xmm7
addss xmm0, dword [ebp - 0x68]
addss xmm2, dword [ebp - 0x38]
addss xmm1, dword [edi + eax*4 + 0x80]
addss xmm0, dword [edi + eax*4 + 0x84]
addss xmm2, dword [edi + eax*4 + 0x88]
subss xmm1, dword [edi + 0x5c]
lea eax, [ebp - 0x20]
subss xmm0, dword [edi + 0x60]
push eax
subss xmm2, dword [edi + 0x64]
subss xmm1, dword [0x10125024]
lea eax, [ebp - 0x90]
subss xmm0, dword [0x10125028]
push eax
subss xmm2, dword [0x1012502c]
movss dword [ebp - 0x90], xmm1
movss dword [ebp - 0x8c], xmm0
movss dword [ebp - 0x88], xmm2
call fcn.10065550
movss xmm2, dword [ebp - 0x20]
movss xmm5, dword [0x100c26dc]
comiss xmm2, xmm5
movss xmm1, dword [ebp - 0x1c]
movss xmm0, dword [ebp - 0x18]
movss xmm4, dword [0x100c2788]
movss xmm3, dword [0x100c26f8]
jbe 0x10063d4b
subss xmm2, xmm3
jmp 0x10063d54
comiss xmm4, xmm2
jbe 0x10063d54
addss xmm2, xmm3
comiss xmm1, xmm5
jbe 0x10063d5f
subss xmm1, xmm3
jmp 0x10063d68
comiss xmm4, xmm1
jbe 0x10063d68
addss xmm1, xmm3
comiss xmm0, xmm5
jbe 0x10063d73
subss xmm0, xmm3
jmp 0x10063d7c
comiss xmm4, xmm0
jbe 0x10063d7c
addss xmm0, xmm3
mov esi, dword [ebp - 0x44]
push esi
movss dword [ebp - 0x20], xmm2
movss dword [ebp - 0x1c], xmm1
movss dword [ebp - 0x18], xmm0
call fcn.10065bc0
movss xmm0, dword [ebp - 0x20]
movss dword [esi + 4], xmm0
movss xmm0, dword [ebp - 0x1c]
movss dword [esi + 8], xmm0
movss xmm0, dword [ebp - 0x18]
movss dword [esi + 0xc], xmm0
movss xmm1, dword [esi + 0x10]
movss xmm0, dword [esi + 0x14]
mulss xmm0, xmm0
mulss xmm1, xmm1
addss xmm0, xmm1
call fcn.10001610
xorps xmm1, xmm1
movss dword [ebp - 0x38], xmm0
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jnp 0x10063e89
movss xmm1, dword [esi + 0x10]
movss xmm0, dword [esi + 0x14]
call fcn.10010230
movss xmm1, dword [ebp - 0x1c]
subss xmm1, dword [0x100d8a9c]
mulss xmm1, dword [0x100c2390]
addss xmm0, xmm1
movss dword [ebp - 0x44], xmm0
call fcn.10010270
mulss xmm0, dword [ebp - 0x38]
movss dword [ebp - 0x40], xmm0
movss dword [esi + 0x10], xmm0
movss xmm0, dword [ebp - 0x44]
call fcn.100102b0
mulss xmm0, dword [ebp - 0x38]
movss xmm2, dword [0x100c26bc]
movss xmm1, dword [0x100c2780]
movss dword [esi + 0x14], xmm0
movss xmm0, dword [0x100d8a98]
comiss xmm0, xmm2
ja 0x10063e5d
comiss xmm1, xmm0
ja 0x10063e5d
xor cl, cl
jmp 0x10063e5f
mov cl, 1
movss xmm0, dword [ebp - 0x20]
comiss xmm0, xmm2
ja 0x10063e72
comiss xmm1, xmm0
ja 0x10063e72
xor al, al
jmp 0x10063e74
mov al, 1
cmp cl, al
je 0x10063e89
movss xmm0, dword [ebp - 0x40]
xorps xmm0, xmmword [0x100c32f0]
movss dword [esi + 0x10], xmm0
lea eax, [ebp - 0x20]
push eax
call dword [0x100d38a4]
movss xmm0, dword [0x100d43f8]
add esp, 4
divss xmm0, dword [0x100c26c4]
mulss xmm0, dword [0x100c2620]
cvtps2pd xmm1, xmm0
movsd xmm0, qword [0x100d23c8]
addsd xmm1, qword [0x100c2570]
ucomisd xmm0, xmm1
movsd qword [ebp - 0x48], xmm1
lahf
test ah, 0x44
jnp 0x10063f30
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0x100d8a94
push 0x40
push 8
push dword [0x100d3f88]
call edi
movsd xmm0, qword [ebp - 0x48]
mulsd xmm0, qword [0x100c2610]
mov eax, dword [0x100d3f88]
push 0x100d8a94
movsd qword [eax], xmm0
push dword [0x100d8a94]
mov esi, dword [0x100d3f88]
push 8
push esi
call edi
push 8
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
movsd xmm0, qword [ebp - 0x48]
movsd qword [0x100d23c8], xmm0
cmp byte [0x1012552d], 0
jne 0x10063f40
mov byte [0x1012552d], 1
push str.forward
call dword [0x100d3868]
add esp, 4
cmp byte [0x100d4408], 0
je 0x10063f65
push str.duck
call dword [0x100d3868]
add esp, 4
cmp byte [0x100d4409], 0
je 0x10063f8c
cmp dword [0x100d89d0], 0x1d
je 0x10063f7e
push str.attack
jmp 0x10063f83
push str._attack
call dword [0x100d3868]
add esp, 4
mov byte [0x1012552d], 1
lea ecx, [ebp - 0x34]
call fcn.10008660
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1007a635
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4