Function at 0x100ae5d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x101a506c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x105aa634], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x10], ebx
je 0x100ae852
cmp dword [0x102529a8], 2
jne 0x100ae609
movss xmm0, dword [0x10198204]
jmp 0x100ae611
movss xmm0, dword [0x1019819c]
mov edi, 0x861110
movss dword [ebp - 0xc], xmm0
call edi
mov edx, 0x861260
mov ecx, eax
call edx
mov eax, dword [eax + 0x28]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10198ca0]
cvtpd2ps xmm0, xmm0
addss xmm0, dword [ebp - 0xc]
cvttss2si esi, xmm0
call edi
mov ecx, eax
mov eax, 0x861260
call eax
push 0x12
push 0x12
push esi
mov eax, dword [eax + 0x24]
add eax, 0x23
push eax
mov eax, 0x790b10
call eax
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 0x10
mov esi, 0x83c080
mov ecx, 0x791070
test al, al
je 0x100ae6bc
push 1
call ecx
add esp, 4
test eax, eax
je 0x100ae6bc
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x83703d
call edi
lea eax, [ebp - 8]
mov byte [0x83703d], 0xc
push eax
push dword [ebp - 8]
push 1
push 0x83703d
call edi
mov dword [0x105aa630], 0
call esi
mov eax, 0x861110
call eax
mov ecx, eax
mov eax, 0x861260
call eax
mov eax, dword [eax + 0x28]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10198ca0]
mov eax, 0x861110
cvtpd2ps xmm0, xmm0
addss xmm0, dword [ebp - 0xc]
cvttss2si esi, xmm0
call eax
mov ecx, eax
mov eax, 0x861260
call eax
push 0x12
push 0x12
push esi
mov eax, dword [eax + 0x24]
add eax, 0x87
push eax
mov eax, 0x790b10
call eax
add esp, 0x10
test al, al
je 0x100ae763
push 1
mov eax, 0x791070
call eax
add esp, 4
test eax, eax
je 0x100ae763
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x83703d
call edi
lea eax, [ebp - 8]
mov byte [0x83703d], 9
push eax
push dword [ebp - 8]
push 1
push 0x83703d
call edi
mov eax, 0x83c080
mov dword [0x105aa630], 1
call eax
cmp dword [0x105aa630], 0
je 0x100ae852
mov dword [ebx + 0x11c], 0xffffffff
mov ecx, 0x405230
xor ebx, ebx
mov dword [ebp - 0xc], ebx
cmp ebx, 5
jne 0x100ae79c
mov eax, dword [0x7bc4f04]
movzx eax, byte [eax + 0x13]
push eax
call ecx
add esp, 4
cmp al, 6
je 0x100ae805
lea esi, [ebx*8]
mov eax, 0x861110
sub esi, ebx
shl esi, 2
mov dword [ebp - 8], esi
mov edi, dword [esi + 0x105aa648]
mov ebx, dword [esi + 0x105aa644]
call eax
mov ecx, eax
mov eax, 0x861260
call eax
mov esi, dword [esi + 0x105aa640]
mov eax, dword [eax + 0x28]
add esi, eax
mov eax, 0x861110
call eax
mov ecx, eax
mov eax, 0x861260
call eax
mov ecx, dword [ebp - 8]
push edi
push ebx
mov eax, dword [eax + 0x24]
mov ecx, dword [ecx + 0x105aa63c]
add ecx, eax
mov eax, 0x790b10
push esi
push ecx
call eax
add esp, 0x10
test al, al
jne 0x100ae82c
mov ebx, dword [ebp - 0xc]
inc ebx
mov ecx, 0x405230
mov dword [ebp - 0xc], ebx
cmp ebx, 9
jl 0x100ae784
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ee3f1
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
pop edi
add eax, 0xf0
pop esi
mov dword [ecx + 0x11c], eax
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ee3f1
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100ee3f1
mov esp, ebp
pop ebp
ret 4