Function at 0x10068940
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006fc9d
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x10084040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x24], ecx
mov edi, dword [0x10089f58]
mov edx, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov eax, dword [edi + 0x19d0]
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x40], ecx
mov byte [eax + 0x7c], 1
mov esi, dword [edi + 0x19d0]
mov dword [ebp - 0x20], esi
test edx, 0x100
je 0x100689ca
test ebx, ebx
je 0x100689a8
mov byte [ebx], 0
test ecx, ecx
je 0x100689af
mov byte [ecx], 0
mov eax, dword [edi + 0x1a04]
cmp eax, dword [ebp - 0x18]
jne 0x100689c3
xor edx, edx
xor ecx, ecx
call fcn.100108a0
xor al, al
jmp 0x1006901d
mov eax, dword [edi + 0x19d4]
mov ecx, edx
or ecx, 2
mov dword [ebp - 0x34], eax
test dl, 0x1e
cmovne ecx, edx
mov dword [ebp - 0x14], ecx
test cl, 0x20
je 0x100689fa
cmp dword [edi + 0x19d8], esi
jne 0x100689fa
mov byte [ebp - 0x25], 1
mov dword [edi + 0x19d4], esi
jmp 0x100689fe
mov byte [ebp - 0x25], 0
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x24]
mov byte [ebp - 0x2c], 0
call fcn.10010e70
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
test al, al
je 0x10068a3b
cmp byte [edi + 0x1d54], 0
je 0x10068b04
cmp dword [edi + 0x1d6c], ebx
jne 0x10068a3b
test byte [edi + 0x1d58], 2
jne 0x10068a3b
mov byte [ebp - 0x1c], 0
jmp 0x10068a48
cmp byte [edi + 0x1d54], 0
je 0x10068b04
mov ecx, dword [ebp - 0x14]
test ecx, 0x1000
je 0x10068b07
test byte [edi + 0x1d58], 4
jne 0x10068b07
mov ecx, 0x20
call fcn.10010d50
test al, al
je 0x10068b01
mov eax, dword [0x10089f58]
mov edx, 1
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
mov dword [eax + 0x19f0], ecx
mov byte [eax + 0x19f4], 0
test ecx, ecx
je 0x10068ab3
cmp dword [eax + 0x19f8], ecx
je 0x10068ab3
mov dword [eax + 0x1a00], 0
mov dword [eax + 0x19fc], 0
movss xmm0, dword [edi + 0x19fc]
addss xmm0, dword [0x1007d17c]
ucomiss xmm0, dword [0x1007d148]
movaps xmm1, xmm0
subss xmm1, dword [edi + 0x18]
lahf
test ah, 0x44
jnp 0x10068af7
comiss xmm1, xmm0
jae 0x10068aef
movss xmm2, dword [0x1007d1d8]
comiss xmm2, xmm1
jbe 0x10068aef
comiss xmm0, xmm2
jae 0x10068af7
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
jmp 0x10068b0a
mov ecx, esi
mov byte [ebp - 0x2c], dl
call fcn.100191e0
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x1c]
cmp byte [ebp - 0x25], 0
je 0x10068b19
mov eax, dword [ebp - 0x34]
mov dword [edi + 0x19d4], eax
test dl, dl
je 0x10068c9e
test cl, 0x40
je 0x10068b3e
mov eax, dword [edi + 0x19f8]
cmp eax, ebx
je 0x10068b3e
test eax, eax
je 0x10068b3e
xor dl, dl
mov dword [ebp - 0x1c], edx
jmp 0x10068ca1
test ecx, 0x400
je 0x10068b6d
cmp byte [edi + 0x100], 0
jne 0x10068c91
cmp byte [edi + 0x101], 0
jne 0x10068c91
cmp byte [edi + 0x102], 0
jne 0x10068c91
test cl, 2
je 0x10068ba2
cmp byte [edi + 0x3d8], 0
je 0x10068ba2
mov edx, esi
mov ecx, ebx
call fcn.100108a0
test dword [ebp - 0x14], 0x2000
jne 0x10068b95
mov ecx, dword [ebp - 0x18]
call fcn.10010980
mov ecx, esi
call fcn.100191e0
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
test cl, 4
je 0x10068bb0
cmp byte [edi + 0x3d8], 0
jne 0x10068bbe
test cl, 0x10
je 0x10068be6
cmp byte [edi + 0x3dd], 0
je 0x10068be6
mov byte [ebp - 0x2c], 1
test ecx, 0x800
je 0x10068bd0
xor edx, edx
xor ecx, ecx
jmp 0x10068bd4
mov edx, esi
mov ecx, ebx
call fcn.100108a0
mov ecx, esi
call fcn.100191e0
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
test cl, 8
je 0x10068c1d
cmp byte [edi + 0x3e2], 0
je 0x10068c1d
test cl, 1
je 0x10068c0a
movss xmm0, dword [edi + 0x408]
comiss xmm0, dword [edi + 0x8c]
jae 0x10068c0e
mov byte [ebp - 0x2c], 1
xor edx, edx
xor ecx, ecx
call fcn.100108a0
mov ebx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
test cl, 1
je 0x10068c91
cmp dword [edi + 0x1a04], ebx
jne 0x10068c91
movss xmm0, dword [edi + 0x3f4]
xorps xmm4, xmm4
comiss xmm0, xmm4
jbe 0x10068c91
mov edx, dword [0x10089f58]
movss xmm1, dword [edx + 0x3f4]
ucomiss xmm1, xmm4
lahf
test ah, 0x44
jnp 0x10068d96
movss xmm2, dword [edx + 0x8c]
comiss xmm1, xmm2
jbe 0x10068c91
movss xmm3, dword [edx + 0x90]
movaps xmm0, xmm1
subss xmm0, dword [edx + 0x18]
mulss xmm3, dword [0x1007d1c4]
comiss xmm0, xmm1
jae 0x10068c91
comiss xmm4, xmm3
jb 0x10068d6a
comiss xmm2, xmm0
ja 0x10068d96
cmp byte [ebp - 0x2c], 0
je 0x10068c9e
mov byte [edi + 0x1b52], 1
mov edx, dword [ebp - 0x1c]
cmp dword [edi + 0x1af4], ebx
jne 0x10068ce2
cmp byte [edi + 0x1b52], 0
jne 0x10068ce2
cmp byte [edi + 0x1b53], 0
je 0x10068ce2
mov eax, dword [edi + 0x1a04]
test eax, eax
je 0x10068cce
cmp eax, ebx
je 0x10068cce
cmp eax, dword [esi + 0x48]
jne 0x10068ce2
test ecx, 0x4000
movzx edx, dl
mov eax, 1
cmove edx, eax
mov dword [ebp - 0x1c], edx
cmp dword [edi + 0x1afc], ebx
jne 0x10068da7
mov esi, dword [edi + 0x1af8]
mov edx, ecx
cmp esi, ebx
sete byte [ebp - 0x25]
and edx, 1
add edx, edx
xor ecx, ecx
or edx, 1
call fcn.1001ca80
comiss xmm0, dword [0x1007d148]
seta al
mov byte [ebp - 0x2d], al
cmp esi, ebx
je 0x10068d20
test al, al
je 0x10068d24
mov byte [ebp - 0x2c], 1
cmp byte [ebp - 0x25], 0
jne 0x10068d36
test al, al
jne 0x10068d36
cmp dword [edi + 0x1a04], ebx
jne 0x10068da7
mov edx, dword [ebp - 0x20]
mov ecx, ebx
mov dword [edi + 0x1af8], ebx
call fcn.100108a0
cmp byte [ebp - 0x25], 0
jne 0x10068d52
cmp byte [ebp - 0x2d], 0
je 0x10068d9f
mov esi, dword [ebp - 0x14]
test esi, 0x2000
jne 0x10068da2
mov ecx, dword [ebp - 0x18]
call fcn.10010980
mov ebx, dword [ebp - 0x18]
jmp 0x10068daa
comiss xmm2, xmm0
jbe 0x10068d74
or edx, 0xffffffff
jmp 0x10068d80
subss xmm0, xmm2
divss xmm0, xmm3
cvttss2si edx, xmm0
subss xmm1, xmm2
divss xmm1, xmm3
cvttss2si eax, xmm1
sub eax, edx
test eax, eax
jle 0x10068c91
mov byte [ebp - 0x2c], 1
jmp 0x10068c97
mov esi, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x18]
jmp 0x10068daa
mov esi, dword [ebp - 0x14]
mov byte [ebp - 0x25], 0
cmp dword [edi + 0x1a04], ebx
jne 0x10068eb1
mov ecx, dword [ebp - 0x2c]
test cl, cl
je 0x10068dc8
mov byte [edi + 0x1a12], 1
mov eax, dword [edi + 0x1a34]
cmp eax, 1
jne 0x10068e98
cmp byte [edi + 0x1a10], 0
je 0x10068e0c
mov eax, dword [ebp - 0x24]
movss xmm1, dword [edi + 0xe8]
movss xmm0, dword [edi + 0xec]
subss xmm1, dword [eax]
subss xmm0, dword [eax + 4]
movss dword [edi + 0x1a28], xmm1
movss dword [edi + 0x1a2c], xmm0
cmp byte [edi + 0xf0], 0
je 0x10068e1b
mov byte [ebp - 0x25], 1
jmp 0x10068e87
cmp byte [ebp - 0x1c], 0
je 0x10068e7b
mov eax, dword [ebp - 0x14]
test al, 2
je 0x10068e78
cmp byte [edi + 0x1d54], 0
jne 0x10068e78
test al, 0x10
je 0x10068e42
cmp byte [edi + 0x3ec], 0
je 0x10068e42
mov dl, 1
jmp 0x10068e44
xor dl, dl
test al, 1
je 0x10068e5d
movss xmm0, dword [edi + 0x408]
comiss xmm0, dword [edi + 0x8c]
jb 0x10068e5d
mov al, 1
jmp 0x10068e5f
xor al, al
mov esi, dword [ebp - 0x14]
test dl, dl
jne 0x10068e7b
test al, al
movzx ecx, cl
mov eax, 1
cmove ecx, eax
mov dword [ebp - 0x2c], ecx
jmp 0x10068e7b
mov esi, dword [ebp - 0x14]
xor edx, edx
xor ecx, ecx
call fcn.100108a0
mov ebx, dword [ebp - 0x18]
test esi, 0x2000
jne 0x10068eb1
mov byte [edi + 0x1b52], 1
jmp 0x10068eb1
cmp eax, 2
jne 0x10068eb1
cmp dword [edi + 0x1afc], ebx
je 0x10068eb1
xor edx, edx
xor ecx, ecx
call fcn.100108a0
mov ebx, dword [ebp - 0x18]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x4c]
push eax
call fcn.1006a0b0
mov eax, dword [ebp - 0x44]
cmp byte [eax + 0xd], 0
jne 0x10068ed9
cmp ebx, dword [eax + 0x10]
jb 0x10068ed9
cmp eax, dword [0x1008a9e4]
je 0x10068ed9
mov al, byte [eax + 0x14]
jmp 0x10068edb
xor al, al
mov ebx, dword [ebp - 0x1c]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
test bl, bl
je 0x10068fb8
test al, al
jne 0x10068fc5
mov esi, dword [0x1008a188]
lea eax, [ebp - 0x24]
push eax
push 0x40
push 2
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
push eax
call edi
movzx eax, word [esi + 0x7c]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x24]
lea eax, [ebp - 0x1c]
push 2
push eax
call edi
mov ecx, dword [ebp - 0x1c]
call fcn.1005c9c0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x4c]
push eax
call fcn.1006a0b0
mov ecx, dword [ebp - 0x44]
cmp byte [ecx + 0xd], 0
jne 0x10068f4b
mov eax, dword [ebp - 0x18]
cmp eax, dword [ecx + 0x10]
jae 0x10068fb2
cmp dword [0x1008a9e8], 0xaaaaaaa
je 0x10069039
mov esi, dword [0x1008a9e4]
mov dword [ebp - 0x38], 0x1008a9e4
mov dword [ebp - 4], 0
push 0x18
mov dword [ebp - 0x34], 0
call fcn.1006c299
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x18]
mov dword [eax + 0x10], ecx
mov ecx, 0x1008a9e4
push eax
push dword [ebp - 0x48]
mov byte [eax + 0x14], 0
push dword [ebp - 0x4c]
mov dword [eax], esi
mov dword [eax + 4], esi
mov dword [eax + 8], esi
mov word [eax + 0xc], 0
call fcn.10057580
mov ecx, eax
mov byte [ecx + 0x14], 1
jmp 0x10068fc5
test al, al
je 0x10068fc5
lea eax, [ebp - 0x18]
push eax
call fcn.100699a0
mov eax, dword [ebp - 0x2c]
test al, al
je 0x10069008
mov esi, dword [0x1008a188]
lea eax, [ebp - 0x20]
push eax
push 0x40
push 2
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
call edi
movzx eax, word [esi + 0x78]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
lea eax, [ebp - 0x14]
push 2
push eax
call edi
mov ecx, dword [ebp - 0x14]
call fcn.1005c9c0
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x3c]
test ecx, ecx
je 0x10069011
mov byte [ecx], bl
mov edx, dword [ebp - 0x40]
test edx, edx
je 0x1006901d
mov cl, byte [ebp - 0x25]
mov byte [edx], cl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006c1ab
mov esp, ebp
pop ebp
ret
call fcn.10001e80
int3