Function at 0x1005fa50
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x100b6018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x1c], edi
mov ecx, dword [edi + 0x48]
cmp ecx, dword [edi + 0x4c]
je 0x10060148
imul eax, dword [edi + 0x24], 0x3110
add eax, ecx
mov edx, dword [eax + 0x3108]
lea ecx, [eax + 0x3104]
mov dword [ebp - 0x14], eax
mov eax, dword [ecx]
cmp eax, edx
je 0x1005faac
mov dword [ecx + 4], eax
mov edx, eax
mov esi, eax
mov eax, 0x66666667
sub edx, esi
imul edx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x1005fac6
mov dword [ecx + 4], esi
mov ecx, edi
call fcn.1005f7a0
mov eax, dword [ebp - 0x1c]
mov esi, dword [edi + 4]
mov edi, dword [edi + 8]
mov dword [ebp - 0x20], esi
mov dword [eax + 0x1c], 0
lea eax, [ebp - 8]
push eax
push 0x40
push 1
push 0x405360
mov dword [ebp - 0x30], edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0
mov byte [0x405360], 0xc3
push dword [ebp - 8]
push 1
push 0x405360
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 8], 0
cmp dword [ecx + 8], 0
jbe 0x10060051
lea eax, [edi + 0x28]
mov dword [ebp - 0xc], 0x56b5d0
mov dword [ebp - 0x2c], eax
mov edx, 0x40e6a0
mov al, byte [ecx + 0xc]
mov byte [esi + 0x1a], al
mov al, byte [ecx + 0xd]
mov ecx, dword [esi]
mov byte [esi + 0x1b], al
mov eax, 0x74e338
mov eax, dword [eax]
mov dword [ecx + 0xdc], eax
cmp dword [edi + 0x2c], 0
mov eax, dword [esi]
movss xmm0, dword [eax + 0x108]
movss dword [ebp - 0x68], xmm0
movss xmm0, dword [eax + 0x10c]
movss dword [ebp - 0x64], xmm0
movss xmm0, dword [eax + 0x110]
movss dword [ebp - 0x60], xmm0
movups xmm0, xmmword [eax + 0x1c]
movaps xmmword [ebp - 0x80], xmm0
movss xmm0, dword [eax + 0x2c]
movss dword [ebp - 0x70], xmm0
movss xmm0, dword [eax + 0x30]
mov al, byte [esi + 0x1a]
mov byte [ebp - 0x5c], al
mov al, byte [esi + 0x1b]
movss dword [ebp - 0x6c], xmm0
mov byte [ebp - 0x5b], al
je 0x1005fbc3
mov eax, dword [0x100ba520]
cmp byte [eax + 0x44], 0
je 0x1005fbb9
or dword [esi + 8], 0x2002
mov eax, 0x7d
mov dword [ebp - 0x3c], eax
jmp 0x1005fbc6
mov eax, dword [ebp - 0x3c]
push esi
mov dword [ebp - 0x28], eax
call edx
mov eax, dword [esi]
add esp, 4
movss xmm1, dword [eax + 0x28]
movss xmm0, dword [eax + 0x2c]
mulss xmm0, xmm0
mulss xmm1, xmm1
addss xmm0, xmm1
call fcn.10005cf0
comiss xmm0, dword [0x100aeb00]
mov eax, dword [edi + 0x2c]
jae 0x1005fbfc
test eax, eax
jne 0x1005fc13
test eax, eax
lea ecx, [ebp - 0x80]
setne dl
call fcn.10006f20
mov eax, dword [esi]
movss dword [eax + 0x10c], xmm0
mov esi, dword [esi]
movss xmm0, dword [esi + 0x10c]
mulss xmm0, dword [0x100ae8f4]
movss dword [ebp - 0x10], xmm0
call fcn.1002c5b0
movss dword [0x100bd69c], xmm0
movss xmm0, dword [ebp - 0x10]
cvtps2pd xmm0, xmm0
call sub.api_ms_win_crt_math_l1_1_0.dll__libm_sse2_cos_precise
cvtsd2ss xmm0, xmm0
movss dword [0x100bd6a0], xmm0
movss xmm0, dword [esi + 0x108]
mulss xmm0, dword [0x100ae8f4]
movss dword [ebp - 0x10], xmm0
call fcn.1002c5b0
movss dword [0x100bd6a4], xmm0
movss xmm0, dword [ebp - 0x10]
cvtps2pd xmm0, xmm0
call sub.api_ms_win_crt_math_l1_1_0.dll__libm_sse2_cos_precise
cvtsd2ss xmm0, xmm0
movss dword [0x100bd6a8], xmm0
movss xmm0, dword [esi + 0x110]
mulss xmm0, dword [0x100ae8f4]
movss dword [ebp - 0x24], xmm0
call fcn.1002c5b0
movss dword [ebp - 0x10], xmm0
movss dword [0x100bd6ac], xmm0
movss xmm0, dword [ebp - 0x24]
cvtps2pd xmm0, xmm0
call sub.api_ms_win_crt_math_l1_1_0.dll__libm_sse2_cos_precise
movss xmm6, dword [0x100bd6a0]
lea eax, [edi + 0xc]
movss xmm5, dword [0x100bd69c]
xorps xmm3, xmm3
movss xmm7, dword [0x100bd6a4]
movaps xmm2, xmm5
movss xmm1, dword [0x100aee30]
movss xmm4, dword [ebp - 0x10]
xorps xmm2, xmm1
cvtsd2ss xmm3, xmm0
movss xmm0, dword [0x100bd6a8]
mulss xmm0, xmm6
movss dword [0x100bd6b0], xmm3
movss dword [edi], xmm0
movaps xmm0, xmm5
mulss xmm0, dword [0x100bd6a8]
movss dword [edi + 4], xmm0
movaps xmm0, xmm7
xorps xmm0, xmm1
movss dword [edi + 8], xmm0
test eax, eax
je 0x1005fd88
movaps xmm1, xmm3
movaps xmm0, xmm4
mulss xmm1, dword [0x100aeba0]
mulss xmm0, xmm7
mulss xmm1, xmm2
mulss xmm0, xmm6
subss xmm1, xmm0
movaps xmm0, xmm4
mulss xmm0, xmm7
movss dword [eax], xmm1
movaps xmm1, xmm3
mulss xmm1, dword [0x100aeba0]
mulss xmm0, xmm5
mulss xmm1, xmm6
subss xmm1, xmm0
movaps xmm0, xmm4
mulss xmm0, dword [0x100aeba0]
mulss xmm0, dword [0x100bd6a8]
movss dword [eax + 4], xmm1
movss dword [eax + 8], xmm0
lea eax, [edi + 0x18]
test eax, eax
je 0x1005fdce
movaps xmm1, xmm3
movaps xmm0, xmm4
mulss xmm1, xmm7
mulss xmm0, xmm2
mulss xmm1, xmm6
mulss xmm4, xmm6
subss xmm1, xmm0
movaps xmm0, xmm3
mulss xmm3, dword [0x100bd6a8]
mulss xmm0, xmm7
movss dword [eax], xmm1
movss dword [eax + 8], xmm3
mulss xmm0, xmm5
subss xmm0, xmm4
movss dword [eax + 4], xmm0
cmp dword [edi + 0x2c], 0
mov esi, dword [ebp - 0x20]
jne 0x1005fdf0
mov eax, dword [esi]
mov dl, byte [esi + 0x1b]
mov cl, byte [esi + 0x1a]
movss xmm0, dword [eax + 0x10c]
call fcn.10061260
mov ecx, eax
jmp 0x1005fdf3
mov ecx, dword [ebp - 0x28]
test ecx, ecx
mov eax, 0x7d
cmove ecx, eax
mov eax, 0x3e8
cdq
idiv ecx
mov ecx, dword [ebp - 0x2c]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
mov dword [ecx], eax
divss xmm0, dword [0x100aeb44]
movss dword [edi + 0x24], xmm0
mov edi, str.g_gravity
call dword [ebp - 0xc]
test eax, eax
je 0x1005fe45
movss xmm0, dword [eax + 0xc]
ucomiss xmm0, dword [0x100ae8bc]
lahf
test ah, 0x44
jp 0x1005fe45
mov eax, dword [esi]
mov dword [eax + 0x58], 0x320
mov edi, dword [ebp - 0x30]
cmp dword [edi + 0x2c], 0
je 0x1005fe87
mov eax, dword [esi]
movss xmm1, dword [eax + 0x28]
movss xmm0, dword [eax + 0x2c]
mulss xmm0, xmm0
mulss xmm1, xmm1
addss xmm0, xmm1
call fcn.10005cf0
mov eax, dword [0x100ba51c]
comiss xmm0, dword [eax + 0xc]
jb 0x1005fe7d
or dword [esi + 8], 0x400
push edi
push esi
call dword [0x100b9c98]
jmp 0x1005fe8f
push edi
push esi
call dword [0x100b6b9c]
add esp, 8
mov eax, 0x410660
push edi
push esi
call eax
push edi
push esi
call fcn.10004d10
mov eax, dword [esi]
add esp, 0x10
movss xmm0, dword [eax + 0x28]
movss dword [ebp - 0x10], xmm0
fld dword [ebp - 0x10]
fistp dword [ebp - 0x18]
movd xmm0, dword [ebp - 0x18]
cvtdq2ps xmm0, xmm0
movss dword [eax + 0x28], xmm0
movss xmm0, dword [eax + 0x2c]
movss dword [ebp - 0x10], xmm0
fld dword [ebp - 0x10]
fistp dword [ebp - 0x18]
movd xmm0, dword [ebp - 0x18]
cvtdq2ps xmm0, xmm0
movss dword [eax + 0x2c], xmm0
movss xmm0, dword [eax + 0x30]
movss dword [ebp - 0x10], xmm0
fld dword [ebp - 0x10]
fistp dword [ebp - 0x18]
movd xmm0, dword [ebp - 0x18]
cvtdq2ps xmm0, xmm0
mov ecx, dword [ebp - 0x2c]
mov word [ebp - 0x40], 0
mov word [ebp - 0x38], 0
movss dword [eax + 0x30], xmm0
mov eax, dword [esi]
movss xmm0, dword [eax + 0x108]
movss dword [ebp - 0x68], xmm0
movss xmm0, dword [eax + 0x10c]
movss dword [ebp - 0x64], xmm0
movss xmm0, dword [eax + 0x110]
movss dword [ebp - 0x60], xmm0
movups xmm0, xmmword [eax + 0x1c]
movaps xmmword [ebp - 0x80], xmm0
movss xmm0, dword [eax + 0x2c]
movss dword [ebp - 0x70], xmm0
movss xmm0, dword [eax + 0x30]
mov al, byte [esi + 0x1a]
mov byte [ebp - 0x5c], al
mov al, byte [esi + 0x1b]
mov byte [ebp - 0x5b], al
mov eax, 0x3e8
cdq
idiv dword [ecx]
movss dword [ebp - 0x6c], xmm0
movups xmm0, xmmword [esi + 0xcc]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x14]
movups xmmword [ebp - 0x58], xmm0
movss xmm0, dword [esi + 0xdc]
movss dword [ebp - 0x48], xmm0
movss xmm0, dword [esi + 0xe0]
movss dword [ebp - 0x44], xmm0
movups xmm0, xmmword [esi + 4]
movups xmmword [esi + 0x24], xmm0
movups xmm0, xmmword [esi + 0x14]
mov dword [esi + 8], 0
movups xmmword [esi + 0x34], xmm0
mov ecx, dword [eax + 0x3108]
mov dword [ebp - 0x24], ecx
sub ecx, dword [eax + 0x3104]
mov eax, 0x66666667
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
inc eax
add eax, edx
cmp eax, 0x3333333
jae 0x10060020
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
add ecx, 0x3104
cmp eax, dword [ecx + 8]
je 0x10060011
movups xmm0, xmmword [ebp - 0x80]
movups xmmword [eax], xmm0
movups xmm0, xmmword [ebp - 0x70]
movups xmmword [eax + 0x10], xmm0
movups xmm0, xmmword [ebp - 0x60]
movups xmmword [eax + 0x20], xmm0
movups xmm0, xmmword [ebp - 0x50]
movups xmmword [eax + 0x30], xmm0
movups xmm0, xmmword [ebp - 0x40]
movups xmmword [eax + 0x40], xmm0
add dword [ecx + 4], 0x50
mov eax, dword [ebp - 0x1c]
jmp 0x10060036
lea edx, [ebp - 0x80]
push edx
push eax
call fcn.1005cab0
mov eax, dword [ebp - 0x1c]
jmp 0x10060036
push str.exceeded_maximum_amount_of_frames__n
push 1
call fcn.1000ae00
mov eax, dword [ebp - 0x1c]
add esp, 8
mov byte [eax + 0x54], 0
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
inc edx
inc dword [eax + 0x1c]
mov dword [ebp - 8], edx
cmp edx, dword [ecx + 8]
mov edx, 0x40e6a0
jb 0x1005fb35
mov edi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
lea edx, [ecx + 0x10]
test edx, edx
je 0x10060089
test esi, esi
je 0x10060079
mov ecx, 0x44
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov edi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov esi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo]
jmp 0x10060099
push 0x110
push 0
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
call edi
mov esi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo]
mov dword [eax], 0x16
call esi
mov eax, dword [ebp - 0x14]
add eax, 0x120
jne 0x100600a7
call edi
jmp 0x100600dd
mov esi, dword [ebp - 0x30]
test esi, esi
je 0x100600c5
mov ecx, 0x20
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov edi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov esi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo]
jmp 0x100600e5
push 0x80
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
call edi
mov esi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo]
mov dword [eax], 0x16
call esi
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x14]
add eax, 0x1a0
je 0x10060114
push 0x2f64
test ecx, ecx
je 0x10060109
push ecx
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
jmp 0x1006011e
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
call edi
mov dword [eax], 0x16
call esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0xc]
push eax
push 0x40
push 1
push 0x405360
call esi
push 0
mov byte [0x405360], 0x53
push dword [ebp - 0xc]
push 1
push 0x405360
call esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1007dbea
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4