Function at 0x103ef56
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x104db7c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ecx + 4]
push ebx
mov ebx, dword [eax + 4]
mov eax, dword [eax]
shr eax, 1
and eax, 0xff
mov dword [ebp - 0x11c], ecx
lea ecx, [eax*8]
push esi
sub ecx, eax
and ebx, 0xfffffff
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [ecx*4 + 0x104e328]
add ebx, 0x1000000
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x5c], edx
call edi
mov esi, eax
mov eax, dword [ebp - 0x5c]
add eax, 4
push eax
mov dword [ebp - 0x120], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetLastError]
call esi
mov eax, dword [ebp - 0x5c]
cmp dword [eax], 0
mov dword [ebp - 0x9c], 0
jne 0x103f9fe
xor eax, eax
lea ecx, [ebp - 0x118]
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], eax
call ebx
cmp dword [ebp - 0x114], 0
mov dword [ebp - 0x48], 0
jbe 0x103f97a
mov dword [ebp - 0x58], 0
mov edi, edi
mov ecx, dword [ebp - 0x118]
mov eax, dword [ebp - 0x58]
mov ebx, dword [eax + ecx]
mov eax, dword [eax + ecx + 8]
mov ecx, dword [ebp - 0x98]
and ebx, 0xfffffff
add ebx, 0x1000000
and eax, 0xfffffff
cmp ebx, ecx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x6c], eax
jb 0x103f069
mov edx, dword [ebp - 0x94]
add eax, ebx
add ecx, edx
cmp eax, ecx
jbe 0x103f167
call edi
cmp dword [ebp - 0x88], 0
mov dword [ebp - 0x68], eax
je 0x103f0a3
mov ecx, dword [ebp - 0x90]
mov edx, dword [ebp - 0x94]
lea eax, [ebp - 0x90]
push eax
mov eax, dword [ebp - 0x98]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x88], 0
cmp dword [ebp - 0x8c], 0
je 0x103f0cc
mov dword [ebp - 0x8c], 0
call edi
push 0x104ebec
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0x2c]
push ecx
call esi
mov edx, dword [ebp - 0x68]
xor eax, eax
push edx
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x90], eax
call esi
mov ecx, dword [ebp - 0x6c]
lea edx, [ecx + ebx + 0xfff]
mov eax, ebx
and eax, 0xfffff000
and edx, 0xfffff000
sub edx, eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], edx
call edi
mov dword [ebp - 0x2c], eax
call edi
push 0x104ebec
mov edi, eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push edi
call esi
mov ecx, dword [ebp - 0x94]
mov edx, dword [ebp - 0x98]
lea eax, [ebp - 0x90]
push eax
push 0x40
push ecx
push edx
mov dword [ebp - 0x8c], 1
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edi, eax
test edi, edi
je 0x103f159
mov dword [ebp - 0x88], 1
mov eax, dword [ebp - 0x2c]
push eax
call esi
test edi, edi
je 0x103f964
test ebx, ebx
je 0x103f964
mov ecx, dword [ebp - 0x58]
mov edx, dword [ebp - 0x118]
test dword [ecx + edx + 8], 0x10000000
mov byte [ebp - 0x25], 0xa5
je 0x103f93a
mov eax, ecx
mov ecx, edx
mov ecx, dword [eax + ecx]
mov eax, dword [ebp - 0x110]
and ecx, 0xfffffff
test byte [eax], 3
mov dword [ebp - 0x124], ecx
jne 0x103f4b1
mov edx, dword [0x10011a4]
mov dword [ebp - 0x100], ecx
mov dword [ebp - 0xfc], ecx
mov ecx, dword [eax + 0x18]
mov edi, dword [eax + 0x10]
mov esi, dword [eax + 0xc]
and ecx, 0xfffffff
and edi, 0xfffffff
add ecx, 0x1000000
mov eax, 0x1000000
and esi, 0x7f
sub eax, edx
mov dword [ebp - 0x68], edi
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x54], eax
jne 0x103f25f
mov eax, 0x8421085
mul esi
mov eax, esi
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 6
imul eax, eax, 0x7c
sub esi, eax
lea edx, [ebp - 0xac]
push edx
mov edx, dword [esi*4 + 0x101db78]
lea eax, [ecx + edi]
push eax
push ecx
lea ecx, [ebp - 0x100]
push ecx
mov byte [ebp - 0xac], 0
mov byte [ebp - 0xab], 1
mov byte [ebp - 0xaa], 2
mov byte [ebp - 0xa9], 3
mov byte [ebp - 0xa8], 4
mov byte [ebp - 0xa7], 5
call edx
mov edx, dword [ebp - 0x100]
mov ebx, dword [ebp - 0xfc]
mov dword [ebp - 0x44], edx
jmp 0x103f4ba
mov ebx, dword [0x100003c]
mov eax, ecx
sub eax, 0x1000000
mov edx, eax
mov ecx, eax
add eax, edi
mov edi, eax
and edi, 0xfffff000
sub eax, edi
mov dword [ebp - 0xf0], edi
mov edi, dword [ebx + 0x10000a0]
mov ebx, dword [ebx + 0x10000a4]
add edi, 0x1000000
and edx, 0xfffff000
add ebx, edi
sub ecx, edx
cmp edi, ebx
mov dword [ebp - 0xec], eax
mov dword [ebp - 0xe8], ebx
je 0x103f2b9
cmp dword [edi], edx
jae 0x103f2b9
add edi, dword [edi + 4]
cmp edi, ebx
jne 0x103f2ae
xor eax, eax
cmp edi, ebx
je 0x103f2e9
cmp dword [edi], edx
jne 0x103f2e9
mov edx, dword [edi + 4]
sub edx, 8
shr edx, 1
mov dword [ebp - 0x2c], edx
je 0x103f2e9
lea ebx, [ebx]
movzx edx, word [edi + eax*2 + 8]
and edx, 0xfff
cmp edx, ecx
jae 0x103f2e9
add eax, 1
cmp eax, dword [ebp - 0x2c]
jne 0x103f2d2
mov ecx, dword [ebp - 0x38]
jmp 0x103f2f4
mov ebx, dword [ebp - 0xe8]
cmp edi, ebx
je 0x103f43e
mov edx, dword [ebp - 0xf0]
cmp dword [edi], edx
ja 0x103f43e
lea esp, [esp]
mov edx, dword [edi + 4]
add edx, 0xfffffff8
shr edx, 1
cmp eax, edx
jne 0x103f336
add edi, dword [edi + 4]
cmp edi, ebx
je 0x103f43e
mov eax, dword [ebp - 0xf0]
cmp dword [edi], eax
ja 0x103f43e
xor eax, eax
jmp 0x103f30d
mov edx, dword [edi]
cmp edx, dword [ebp - 0xf0]
jne 0x103f357
movzx ebx, word [edi + eax*2 + 8]
and ebx, 0xfff
cmp ebx, dword [ebp - 0xec]
jae 0x103f43e
mov ebx, eax
movzx ebx, word [edi + ebx*2 + 8]
add eax, 1
test ebx, 0xf000
mov dword [ebp - 0xe0], eax
je 0x103f2ee
and ebx, 0xfff
lea ebx, [ebx + edx + 0x1000000]
mov eax, 0x8421085
mul esi
mov eax, esi
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 6
imul eax, eax, 0x7c
mov edx, esi
sub edx, eax
lea eax, [edx*4 + 0x101db78]
lea edx, [ebp - 0xc4]
push edx
mov edx, dword [eax]
push ebx
push ecx
lea ecx, [ebp - 0x100]
push ecx
mov byte [ebp - 0xc4], 0
mov byte [ebp - 0xc3], 1
mov byte [ebp - 0xc2], 2
mov byte [ebp - 0xc1], 3
mov byte [ebp - 0xc0], 4
mov byte [ebp - 0xbf], 5
mov dword [ebp - 0x2c], eax
call edx
mov eax, dword [ebx]
sub eax, dword [ebp - 0x54]
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0xdc]
push eax
push ecx
mov ecx, dword [ebp - 0x2c]
lea edx, [ebp - 0x14]
push edx
mov edx, dword [ecx]
lea eax, [ebp - 0x100]
push eax
mov byte [ebp - 0xdc], 0
mov byte [ebp - 0xdb], 1
mov byte [ebp - 0xda], 2
mov byte [ebp - 0xd9], 3
mov byte [ebp - 0xd8], 4
mov byte [ebp - 0xd7], 5
call edx
mov eax, dword [ebp - 0xe0]
lea ecx, [ebx + 4]
jmp 0x103f2ee
mov eax, 0x8421085
mul esi
mov eax, esi
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 6
imul eax, eax, 0x7c
sub esi, eax
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0xd4]
push edx
mov edx, dword [ebp - 0x68]
add eax, edx
push eax
push ecx
mov ecx, dword [esi*4 + 0x101db78]
lea eax, [ebp - 0x100]
push eax
mov byte [ebp - 0xd4], 0
mov byte [ebp - 0xd3], 1
mov byte [ebp - 0xd2], 2
mov byte [ebp - 0xd1], 3
mov byte [ebp - 0xd0], 4
mov byte [ebp - 0xcf], 5
call ecx
mov edx, dword [ebp - 0x100]
mov ebx, dword [ebp - 0xfc]
mov dword [ebp - 0x44], edx
jmp 0x103f4ba
mov ecx, dword [eax + 4]
mov ebx, dword [eax + 8]
mov dword [ebp - 0x44], ecx
mov edx, dword [ebp - 0x6c]
mov edi, dword [ebp - 0x70]
and edx, 7
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x2c], edx
je 0x103f696
xor ecx, ecx
cmp edx, ecx
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x3c], ecx
jle 0x103f510
lea eax, [ecx + 0x38]
cmp ecx, 4
movzx esi, byte [edi]
jge 0x103f4f6
lea ecx, [eax - 0x20]
shl esi, cl
or dword [ebp - 0x60], esi
jmp 0x103f4fd
mov ecx, eax
shl esi, cl
or dword [ebp - 0x54], esi
mov ecx, dword [ebp - 0x3c]
add ecx, 1
add edi, 1
sub eax, 8
cmp ecx, edx
mov dword [ebp - 0x3c], ecx
jl 0x103f4e4
mov ecx, dword [ebp - 0x124]
movzx edx, word [ebp - 0x3e]
mov esi, ecx
sub esi, dword [ebp - 0x44]
mov eax, ecx
ror esi, 0xc
imul esi, edx
ror eax, 0xd
sub esi, eax
xor esi, ecx
mov eax, esi
xor eax, edx
rol eax, 1
movzx edx, bx
imul eax, edx
mov edx, esi
ror edx, 1
xor eax, edx
xor eax, ecx
movzx ecx, word [ebp - 0x42]
xor ebx, eax
rol ebx, 1
imul ebx, ecx
mov edx, eax
shr edx, 1
sub ebx, edx
xor esi, ebx
mov ebx, esi
xor ebx, ecx
movzx ecx, word [ebp - 0x44]
imul ebx, ecx
mov dword [ebp - 0x68], ecx
movzx ecx, word [ebp - 0x42]
mov edx, esi
ror edx, 1
add edx, ebx
xor eax, edx
mov ebx, dword [ebp - 0x40]
mov dword [ebp - 0x30], ecx
mov edx, eax
sub edx, ecx
movzx ecx, word [ebp - 0x3e]
imul edx, ecx
mov dword [ebp - 0x3c], ecx
mov ecx, eax
shr ecx, 0xa
sub edx, ecx
xor esi, edx
mov edx, dword [ebp - 0x44]
add edx, esi
ror edx, 0x1b
movzx ecx, bx
imul edx, ecx
mov dword [ebp - 0x50], ecx
mov ecx, esi
ror ecx, 0x14
add edx, ecx
xor eax, edx
mov edx, ebx
xor edx, eax
ror edx, 1
imul edx, dword [ebp - 0x30]
mov ecx, eax
ror ecx, 1
add edx, ecx
xor esi, edx
mov edx, dword [ebp - 0x44]
xor edx, esi
mov ecx, ebx
sub ecx, edx
xor eax, ecx
mov ecx, dword [ebp - 0x44]
mov edx, eax
sub edx, dword [ebp - 0x3c]
xor edx, ecx
xor esi, edx
mov edx, esi
sub edx, ecx
ror edx, 1
imul edx, dword [ebp - 0x50]
mov ecx, esi
ror ecx, 1
xor edx, ecx
xor eax, edx
mov edx, ebx
sub edx, eax
ror edx, 0x16
imul edx, dword [ebp - 0x30]
mov ecx, eax
ror ecx, 0xa
sub edx, ecx
xor esi, edx
mov edx, esi
xor edx, dword [ebp - 0x30]
mov ecx, esi
xor esi, dword [ebp - 0x54]
rol edx, 1
imul edx, dword [ebp - 0x68]
shr ecx, 1
add edx, ecx
xor edx, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x2c]
xor eax, edx
xor edx, edx
test ecx, ecx
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x3c], edx
jle 0x103f664
cmp edx, 4
mov ecx, dword [ebp - 0x38]
jge 0x103f63e
mov edx, dword [ebp - 0x64]
rol edx, 8
mov byte [ecx], dl
add ecx, 1
xor byte [ebp - 0x25], dl
mov dword [ebp - 0x64], edx
mov dword [ebp - 0x38], ecx
jmp 0x103f654
mov edx, dword [ebp - 0x50]
rol edx, 8
mov byte [ecx], dl
add ecx, 1
mov dword [ebp - 0x38], ecx
mov cl, dl
xor byte [ebp - 0x25], cl
mov dword [ebp - 0x50], edx
mov edx, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x2c]
add edx, 1
cmp edx, ecx
mov dword [ebp - 0x3c], edx
jl 0x103f620
add ecx, 0xfffffffc
test ecx, ecx
jle 0x103f682
mov edx, 4
sub edx, ecx
add edx, edx
add edx, edx
add edx, edx
mov ecx, edx
shr esi, cl
shl esi, cl
mov edx, esi
jmp 0x103f6a6
xor edx, edx
test ecx, ecx
jge 0x103f6a6
neg ecx
add ecx, ecx
add ecx, ecx
add ecx, ecx
shr eax, cl
shl eax, cl
jmp 0x103f6a6
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x54], eax
xor edx, edx
xor eax, eax
mov ecx, dword [ebp - 0x6c]
shr ecx, 3
je 0x103f85a
movzx esi, word [ebp - 0x3e]
mov dword [ebp - 0x3c], esi
movzx esi, word [ebp - 0x42]
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], ecx
jmp 0x103f6c8
mov ebx, dword [ebp - 0x40]
xor ecx, ecx
mov ch, byte [edi]
movzx esi, byte [edi + 2]
add edi, 8
mov cl, byte [edi - 7]
shl ecx, 8
or ecx, esi
movzx esi, byte [edi - 5]
shl ecx, 8
or ecx, esi
mov dword [ebp - 0x64], ecx
xor ecx, ecx
mov ch, byte [edi - 4]
xor eax, dword [ebp - 0x64]
movzx esi, byte [edi - 2]
mov cl, byte [edi - 3]
shl ecx, 8
or ecx, esi
movzx esi, byte [edi - 1]
shl ecx, 8
or ecx, esi
mov dword [ebp - 0x50], ecx
mov ecx, eax
sub ecx, dword [ebp - 0x44]
mov esi, eax
ror ecx, 0xc
imul ecx, dword [ebp - 0x3c]
ror esi, 0xd
sub ecx, esi
xor ecx, dword [ebp - 0x50]
xor edx, ecx
movzx ecx, bx
mov esi, edx
xor esi, dword [ebp - 0x3c]
rol esi, 1
imul esi, ecx
mov ecx, edx
ror ecx, 1
xor esi, ecx
mov ecx, dword [ebp - 0x30]
xor eax, esi
xor ebx, eax
rol ebx, 1
imul ebx, ecx
mov esi, eax
shr esi, 1
sub ebx, esi
xor edx, ebx
mov ebx, edx
xor ebx, ecx
movzx ecx, word [ebp - 0x44]
imul ebx, ecx
mov esi, edx
ror esi, 1
add esi, ebx
xor eax, esi
mov dword [ebp - 0x68], ecx
mov ecx, dword [ebp - 0x30]
mov esi, eax
sub esi, ecx
imul esi, dword [ebp - 0x3c]
mov ebx, eax
shr ebx, 0xa
sub esi, ebx
xor edx, esi
mov esi, dword [ebp - 0x44]
lea ebx, [esi + edx]
movzx esi, word [ebp - 0x40]
ror ebx, 0x1b
imul ebx, esi
mov esi, edx
ror esi, 0x14
add ebx, esi
mov esi, dword [ebp - 0x40]
xor eax, ebx
xor esi, eax
ror esi, 1
imul esi, ecx
mov ebx, eax
ror ebx, 1
add esi, ebx
xor edx, esi
mov esi, dword [ebp - 0x44]
mov ebx, dword [ebp - 0x40]
xor esi, edx
sub ebx, esi
mov esi, dword [ebp - 0x44]
xor eax, ebx
mov ebx, eax
sub ebx, dword [ebp - 0x3c]
xor ebx, esi
xor edx, ebx
mov ebx, edx
sub ebx, esi
movzx esi, word [ebp - 0x40]
ror ebx, 1
imul ebx, esi
mov esi, edx
ror esi, 1
xor ebx, esi
mov esi, dword [ebp - 0x40]
xor eax, ebx
sub esi, eax
ror esi, 0x16
imul esi, ecx
mov ebx, eax
ror ebx, 0xa
sub esi, ebx
xor edx, esi
mov esi, edx
xor esi, ecx
rol esi, 1
imul esi, dword [ebp - 0x68]
mov ecx, edx
xor edx, dword [ebp - 0x54]
shr ecx, 1
add esi, ecx
xor esi, dword [ebp - 0x60]
mov cl, byte [ebp - 0x25]
xor eax, esi
mov esi, dword [ebp - 0x38]
xor cl, al
xor cl, dl
mov byte [esi + 3], al
ror eax, 8
xor cl, al
mov byte [esi + 7], dl
ror edx, 8
xor cl, dl
mov byte [esi + 2], al
ror eax, 8
mov byte [esi + 6], dl
xor cl, al
ror edx, 8
mov byte [esi + 1], al
xor cl, dl
ror eax, 8
mov byte [esi + 5], dl
ror edx, 8
mov bl, dl
xor bl, al
xor cl, bl
mov byte [ebp - 0x25], cl
mov ecx, dword [ebp - 0x64]
mov byte [esi], al
mov byte [esi + 4], dl
ror eax, 8
mov dword [ebp - 0x60], ecx
mov ecx, dword [ebp - 0x50]
add esi, 8
ror edx, 8
sub dword [ebp - 0x2c], 1
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x38], esi
jne 0x103f6c5
mov edx, dword [0x10011a4]
mov ebx, dword [ebp - 0x70]
mov eax, 0x1000000
sub eax, edx
mov dword [ebp - 0x2c], eax
je 0x103f914
mov eax, dword [ebp - 0x6c]
mov esi, dword [0x102b4c8]
sub ebx, 0x1000000
lea ecx, [eax + ebx]
xor edi, edi
add esi, 0xffffffff
mov dword [ebp - 0x70], ecx
js 0x103f8ba
lea eax, [esi + edi]
cdq
sub eax, edx
sar eax, 1
mov ecx, dword [eax*4 + 0x102b4cc]
and ecx, 0xfffffff
cmp ebx, ecx
jae 0x103f8ad
lea esi, [eax - 1]
jmp 0x103f8b2
jbe 0x103f8b8
lea edi, [eax + 1]
cmp esi, edi
jge 0x103f88f
jmp 0x103f8ba
mov edi, eax
cmp edi, dword [0x102b4c8]
jae 0x103f914
mov ebx, dword [ebp - 0x70]
mov eax, dword [edi*4 + 0x102b4cc]
mov esi, eax
and esi, 0xfffffff
cmp esi, ebx
jae 0x103f914
mov ecx, eax
add eax, eax
add eax, eax
sar eax, 0x1e
sar ecx, 0x1e
and eax, 3
and ecx, 3
xor edx, edx
sub eax, 1
je 0x103f8fb
sub eax, 1
je 0x103f960
sub eax, 1
jne 0x103f8fe
mov edx, dword [ebp - 0x2c]
sub ecx, 2
jne 0x103f909
add dword [esi + 0x1000000], edx
add edi, 1
cmp edi, dword [0x102b4c8]
jb 0x103f8c5
mov eax, dword [ebp - 0x118]
mov ecx, dword [ebp - 0x58]
and dword [ecx + eax + 8], 0xefffffff
mov edx, dword [ebp - 0x118]
add ecx, edx
push ecx
lea ecx, [ebp - 0x25]
call fcn.0102f25b
test eax, eax
je 0x103f970
mov eax, dword [ebp - 0x48]
add dword [ebp - 0x58], 0xc
add eax, 1
cmp eax, dword [ebp - 0x114]
mov dword [ebp - 0x48], eax
jae 0x103f97a
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x103f026
xor edx, edx
jmp 0x103f8fe
mov dword [ebp - 0x9c], 0x8007000e
jmp 0x103f97a
mov dword [ebp - 0x9c], 0x80004005
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
xor esi, esi
cmp dword [ebp - 0x88], esi
mov ebx, eax
je 0x103f9b6
mov ecx, dword [ebp - 0x90]
mov edx, dword [ebp - 0x94]
lea eax, [ebp - 0x90]
push eax
mov eax, dword [ebp - 0x98]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x88], esi
cmp dword [ebp - 0x8c], esi
je 0x103f9de
mov dword [ebp - 0x8c], esi
call edi
push 0x104ebec
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetLastError]
call esi
jmp 0x103f9e4
mov esi, dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
push ebx
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x90], eax
call esi
mov ebx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x5c]
add dword [eax], 1
cmp dword [ebp - 0x9c], 0
jge 0x10403ad
add dword [eax], 0xffffffff
jne 0x10403ad
xor eax, eax
lea ecx, [ebp - 0x10c]
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
call ebx
cmp dword [ebp - 0x108], 0
mov dword [ebp - 0x68], 0
jbe 0x1040355
mov edx, dword [ebp - 0x10c]
mov dword [ebp - 0x50], 0
mov ecx, dword [ebp - 0x50]
mov eax, dword [ecx + edx]
mov ecx, dword [ecx + edx + 8]
mov edx, dword [ebp - 0x84]
and eax, 0xfffffff
add eax, 0x1000000
and ecx, 0xfffffff
cmp eax, edx
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x6c], ecx
jb 0x103fa90
mov ebx, dword [ebp - 0x80]
add ebx, edx
add ecx, eax
cmp ecx, ebx
jbe 0x103fb65
call edi
cmp dword [ebp - 0x74], 0
mov ebx, eax
je 0x103faba
mov edx, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x80]
lea ecx, [ebp - 0x7c]
push ecx
mov ecx, dword [ebp - 0x84]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x74], 0
cmp dword [ebp - 0x78], 0
je 0x103fadd
mov dword [ebp - 0x78], 0
call edi
push 0x104ebec
mov dword [ebp - 0x4c], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edx, dword [ebp - 0x4c]
push edx
call esi
xor eax, eax
push ebx
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], eax
call esi
mov ecx, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x6c]
mov ebx, dword [ebp - 0x5c]
push 0x1000
add eax, ecx
and ebx, 0xfffff000
push eax
mov dword [ebp - 0x84], ebx
call fcn.0101275f
sub eax, ebx
mov dword [ebp - 0x80], eax
call edi
mov dword [ebp - 0x4c], eax
call edi
push 0x104ebec
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push ebx
call esi
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0x84]
lea edx, [ebp - 0x7c]
push edx
push 0x40
push eax
push ecx
mov dword [ebp - 0x78], 1
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ebx, eax
test ebx, ebx
je 0x103fb57
mov dword [ebp - 0x74], 1
mov edx, dword [ebp - 0x4c]
push edx
call esi
test ebx, ebx
je 0x1040355
mov ecx, dword [ebp - 0x5c]
test ecx, ecx
mov edx, dword [ebp - 0x10c]
je 0x1040355
mov eax, dword [ebp - 0x50]
test dword [eax + edx + 8], 0x10000000
mov byte [ebp - 0x26], 0xa5
jne 0x104033c
mov ebx, dword [eax + edx]
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x2c], eax
mov eax, dword [0x10011a4]
and ebx, 0xfffffff
sub eax, 0x1000000
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x48], eax
je 0x103fc58
mov edx, dword [ebp - 0x6c]
mov esi, dword [0x102b4c8]
sub ecx, 0x1000000
lea eax, [ecx + edx]
xor edi, edi
add esi, 0xffffffff
mov dword [ebp - 0x4c], eax
js 0x103fbfc
lea ebx, [ebx]
lea eax, [esi + edi]
cdq
sub eax, edx
sar eax, 1
mov edx, dword [eax*4 + 0x102b4cc]
and edx, 0xfffffff
cmp ecx, edx
jae 0x103fbef
lea esi, [eax - 1]
jmp 0x103fbf4
jbe 0x103fbfa
lea edi, [eax + 1]
cmp esi, edi
jge 0x103fbd1
jmp 0x103fbfc
mov edi, eax
cmp edi, dword [0x102b4c8]
jae 0x103fc58
mov eax, dword [edi*4 + 0x102b4cc]
mov esi, eax
and esi, 0xfffffff
cmp esi, dword [ebp - 0x4c]
jae 0x103fc58
mov ecx, eax
add eax, eax
add eax, eax
sar eax, 0x1e
sar ecx, 0x1e
and eax, 3
and ecx, 3
xor edx, edx
sub eax, 1
je 0x103fc3f
sub eax, 1
je 0x103fcfe
sub eax, 1
jne 0x103fc42
mov edx, dword [ebp - 0x48]
sub ecx, 2
jne 0x103fc4d
add dword [esi + 0x1000000], edx
add edi, 1
cmp edi, dword [0x102b4c8]
jb 0x103fc04
mov eax, dword [ebp - 0x2c]
test byte [eax], 3
jne 0x103ff61
mov edi, dword [0x10011a4]
mov ecx, eax
mov dword [ebp - 0xf8], ebx
mov dword [ebp - 0xf4], ebx
mov eax, dword [ecx + 0x18]
mov edx, dword [ecx + 0x10]
mov esi, dword [ecx + 0xc]
and eax, 0xfffffff
and edx, 0xfffffff
add eax, 0x1000000
mov ecx, 0x1000000
and esi, 0x7f
sub ecx, edi
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x58], ecx
jne 0x103fd05
mov eax, 0x8421085
mul esi
mov eax, dword [ebp - 0x70]
mov ecx, esi
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 6
imul ecx, ecx, 0x7c
lea edx, [ebp - 0xa4]
sub esi, ecx
mov ecx, dword [ebp - 0x48]
push edx
lea edx, [ecx + eax]
push edx
mov byte [ebp - 0xa4], 0
mov byte [ebp - 0xa3], 1
mov byte [ebp - 0xa2], 2
mov byte [ebp - 0xa1], 3
mov byte [ebp - 0xa0], 4
mov byte [ebp - 0x9f], 5
push eax
jmp 0x103ff3d
xor edx, edx
jmp 0x103fc42
sub eax, 0x1000000
mov ecx, eax
mov edi, eax
add eax, edx
and ecx, 0xfffff000
sub edi, ecx
mov dword [ebp - 0x4c], edi
mov edi, eax
and edi, 0xfffff000
sub eax, edi
mov dword [ebp - 0xec], eax
mov eax, dword [0x100003c]
mov dword [ebp - 0xf0], edi
mov edi, dword [eax + 0x10000a0]
mov eax, dword [eax + 0x10000a4]
add edi, 0x1000000
add eax, edi
cmp edi, eax
mov dword [ebp - 0xe8], eax
je 0x103fd5f
cmp dword [edi], ecx
jae 0x103fd5f
add edi, dword [edi + 4]
cmp edi, eax
jne 0x103fd54
xor edx, edx
cmp edi, eax
je 0x103fd93
cmp dword [edi], ecx
jne 0x103fd93
mov ecx, dword [edi + 4]
sub ecx, 8
shr ecx, 1
mov dword [ebp - 0x2c], ecx
je 0x103fd93
mov ecx, dword [ebp - 0x4c]
movzx ebx, word [edi + edx*2 + 8]
and ebx, 0xfff
cmp ebx, ecx
jae 0x103fd90
add edx, 1
cmp edx, dword [ebp - 0x2c]
jne 0x103fd79
mov ebx, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x70]
jmp 0x103fda4
mov eax, dword [ebp - 0xe8]
mov ebx, dword [ebp - 0x40]
lea esp, [esp]
cmp edi, eax
je 0x103feeb
mov ebx, dword [ebp - 0xf0]
cmp dword [edi], ebx
ja 0x103fee8
mov ebx, dword [edi + 4]
add ebx, 0xfffffff8
shr ebx, 1
cmp edx, ebx
jne 0x103fde3
add edi, dword [edi + 4]
cmp edi, eax
je 0x103fee8
mov edx, dword [ebp - 0xf0]
cmp dword [edi], edx
ja 0x103fee8
xor edx, edx
jmp 0x103fdba
mov ebx, dword [edi]
cmp ebx, dword [ebp - 0xf0]
jne 0x103fe03
movzx eax, word [edi + edx*2 + 8]
and eax, 0xfff
cmp eax, dword [ebp - 0xec]
jae 0x103fee8
mov eax, edx
movzx eax, word [edi + eax*2 + 8]
add edx, 1
test eax, 0xf000
mov dword [ebp - 0xe0], edx
je 0x103fd98
and eax, 0xfff
lea ebx, [eax + ebx + 0x1000000]
mov eax, 0x8421085
mul esi
mov eax, esi
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 6
imul eax, eax, 0x7c
mov edx, esi
sub edx, eax
lea eax, [edx*4 + 0x101db78]
lea edx, [ebp - 0xb4]
push edx
mov edx, dword [eax]
push ebx
push ecx
lea ecx, [ebp - 0xf8]
push ecx
mov byte [ebp - 0xb4], 0
mov byte [ebp - 0xb3], 1
mov byte [ebp - 0xb2], 2
mov byte [ebp - 0xb1], 3
mov byte [ebp - 0xb0], 4
mov byte [ebp - 0xaf], 5
mov dword [ebp - 0x4c], eax
call edx
mov eax, dword [ebx]
sub eax, dword [ebp - 0x58]
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0xbc]
push eax
push ecx
mov ecx, dword [ebp - 0x4c]
lea edx, [ebp - 0x24]
push edx
mov edx, dword [ecx]
lea eax, [ebp - 0xf8]
push eax
mov byte [ebp - 0xbc], 0
mov byte [ebp - 0xbb], 1
mov byte [ebp - 0xba], 2
mov byte [ebp - 0xb9], 3
mov byte [ebp - 0xb8], 4
mov byte [ebp - 0xb7], 5
call edx
mov edx, dword [ebp - 0xe0]
lea ecx, [ebx + 4]
jmp 0x103fd98
mov ebx, dword [ebp - 0x40]
mov eax, 0x8421085
mul esi
mov eax, esi
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 6
imul eax, eax, 0x7c
lea edx, [ebp - 0xcc]
push edx
mov edx, dword [ebp - 0x70]
sub esi, eax
mov eax, dword [ebp - 0x48]
add edx, eax
push edx
mov byte [ebp - 0xcc], 0
mov byte [ebp - 0xcb], 1
mov byte [ebp - 0xca], 2
mov byte [ebp - 0xc9], 3
mov byte [ebp - 0xc8], 4
mov byte [ebp - 0xc7], 5
push ecx
mov ecx, dword [esi*4 + 0x101db78]
lea eax, [ebp - 0xf8]
push eax
call ecx
mov edx, dword [ebp - 0xf8]
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], eax
jmp 0x103ff6d
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], edx
mov edx, dword [ebp - 0x6c]
mov esi, dword [ebp - 0x5c]
xor ecx, ecx
and edx, 7
mov dword [ebp - 0x54], esi
mov eax, ebx
mov edi, ebx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x2c], edx
je 0x1040141
xor eax, eax
cmp edx, ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x48], eax
jle 0x103ffda
lea edi, [ecx + 0x38]
lea esp, [esp]
cmp eax, 4
mov al, byte [esi]
jge 0x103ffba
xor byte [ebp - 0x26], al
movzx eax, al
lea ecx, [edi - 0x20]
shl eax, cl
or dword [ebp - 0x58], eax
jmp 0x103ffc7
xor byte [ebp - 0x26], al
movzx eax, al
mov ecx, edi
shl eax, cl
or dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x48]
add eax, 1
add esi, 1
sub edi, 8
cmp eax, edx
mov dword [ebp - 0x48], eax
jl 0x103ffa3
movzx edx, word [ebp - 0x2e]
mov ecx, ebx
sub ecx, dword [ebp - 0x34]
movzx edi, word [ebp - 0x30]
ror ecx, 0xc
imul ecx, edx
mov eax, ebx
ror eax, 0xd
sub ecx, eax
xor ecx, ebx
mov eax, ecx
xor eax, edx
rol eax, 1
imul eax, edi
mov edx, ecx
ror edx, 1
xor eax, edx
xor eax, ebx
movzx edx, word [ebp - 0x32]
mov edi, eax
xor edi, dword [ebp - 0x30]
mov ebx, eax
rol edi, 1
imul edi, edx
shr ebx, 1
sub edi, ebx
xor ecx, edi
mov ebx, ecx
xor ebx, edx
movzx edx, word [ebp - 0x34]
imul ebx, edx
mov edi, ecx
ror edi, 1
add edi, ebx
xor eax, edi
movzx edi, word [ebp - 0x2e]
mov dword [ebp - 0x60], edi
mov dword [ebp - 0x5c], edx
movzx edx, word [ebp - 0x32]
mov ebx, eax
sub ebx, edx
imul ebx, edi
mov edi, eax
shr edi, 0xa
sub ebx, edi
mov edi, dword [ebp - 0x34]
xor ecx, ebx
lea ebx, [ecx + edi]
movzx edi, word [ebp - 0x30]
ror ebx, 0x1b
imul ebx, edi
mov edi, ecx
ror edi, 0x14
add ebx, edi
xor eax, ebx
mov edi, eax
xor edi, dword [ebp - 0x30]
mov ebx, eax
ror edi, 1
imul edi, edx
ror ebx, 1
add edi, ebx
mov ebx, dword [ebp - 0x30]
xor ecx, edi
mov edi, ecx
xor edi, dword [ebp - 0x34]
sub ebx, edi
xor eax, ebx
mov edi, eax
sub edi, dword [ebp - 0x60]
xor edi, ecx
mov ecx, dword [ebp - 0x34]
xor edi, ecx
mov ebx, edi
sub ebx, ecx
movzx ecx, word [ebp - 0x30]
ror ebx, 1
imul ebx, ecx
mov ecx, edi
ror ecx, 1
xor ebx, ecx
mov ecx, dword [ebp - 0x30]
xor eax, ebx
sub ecx, eax
ror ecx, 0x16
imul ecx, edx
mov ebx, eax
ror ebx, 0xa
sub ecx, ebx
xor edi, ecx
mov ebx, dword [ebp - 0x2c]
mov ecx, edi
xor ecx, edx
rol ecx, 1
imul ecx, dword [ebp - 0x5c]
mov edx, edi
xor edi, dword [ebp - 0x38]
shr edx, 1
add ecx, edx
xor ecx, dword [ebp - 0x58]
mov edx, edi
xor eax, ecx
xor ecx, ecx
test ebx, ebx
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x3c], edx
jle 0x1040113
cmp ecx, 4
mov ebx, dword [ebp - 0x54]
jge 0x10400fb
mov edx, dword [ebp - 0x64]
rol edx, 8
mov dword [ebp - 0x64], edx
mov byte [ebx], dl
mov edx, dword [ebp - 0x3c]
jmp 0x1040103
rol edx, 8
mov dword [ebp - 0x3c], edx
mov byte [ebx], dl
add ebx, 1
mov dword [ebp - 0x54], ebx
mov ebx, dword [ebp - 0x2c]
add ecx, 1
cmp ecx, ebx
jl 0x10400e3
lea edx, [ebx - 4]
test edx, edx
jle 0x104012d
mov ecx, 4
sub ecx, edx
add ecx, ecx
add ecx, ecx
add ecx, ecx
shr edi, cl
shl edi, cl
jmp 0x1040141
xor edi, edi
test edx, edx
jge 0x1040141
neg edx
add edx, edx
add edx, edx
add edx, edx
mov ecx, edx
shr eax, cl
shl eax, cl
mov ecx, dword [ebp - 0x6c]
shr ecx, 3
je 0x1040308
movzx edx, word [ebp - 0x34]
mov dword [ebp - 0x5c], edx
movzx edx, word [ebp - 0x32]
mov dword [ebp - 0x48], edx
movzx edx, word [ebp - 0x2e]
mov dword [ebp - 0x60], edx
mov dword [ebp - 0x2c], ecx
mov dl, byte [esi]
xor ebx, ebx
mov bh, dl
mov cl, byte [esi + 1]
movzx edx, byte [esi + 3]
add esi, 8
mov bl, cl
movzx ecx, byte [esi - 6]
shl ebx, 8
or ebx, ecx
shl ebx, 8
or ebx, edx
mov dl, byte [esi - 4]
mov dword [ebp - 0x64], ebx
xor ebx, ebx
mov bh, dl
mov dl, byte [esi - 2]
mov cl, byte [esi - 1]
mov byte [ebp - 0x25], dl
movzx edx, dl
mov bl, byte [esi - 3]
shl ebx, 8
or ebx, edx
movzx edx, cl
xor cl, byte [ebp - 0x25]
shl ebx, 8
xor cl, byte [esi - 3]
or edx, ebx
xor cl, byte [esi - 4]
xor edi, edx
xor cl, byte [esi - 5]
mov dword [ebp - 0x3c], edx
xor cl, byte [esi - 6]
mov edx, dword [ebp - 0x48]
xor cl, byte [esi - 7]
mov ebx, edi
xor cl, byte [esi - 8]
shr ebx, 1
xor byte [ebp - 0x26], cl
mov ecx, edi
xor ecx, edx
rol ecx, 1
imul ecx, dword [ebp - 0x5c]
add ecx, ebx
xor ecx, dword [ebp - 0x64]
xor eax, ecx
mov ecx, dword [ebp - 0x30]
sub ecx, eax
ror ecx, 0x16
imul ecx, edx
mov ebx, eax
ror ebx, 0xa
sub ecx, ebx
xor edi, ecx
movzx ecx, word [ebp - 0x30]
mov ebx, edi
sub ebx, dword [ebp - 0x34]
mov dword [ebp - 0x4c], ecx
ror ebx, 1
imul ebx, ecx
mov ecx, edi
ror ecx, 1
xor ebx, ecx
xor eax, ebx
mov ecx, eax
sub ecx, dword [ebp - 0x60]
xor ecx, edi
mov edi, dword [ebp - 0x34]
xor ecx, edi
mov ebx, ecx
xor ebx, edi
mov edi, dword [ebp - 0x30]
sub edi, ebx
xor eax, edi
mov edi, eax
xor edi, dword [ebp - 0x30]
mov ebx, eax
ror edi, 1
imul edi, edx
ror ebx, 1
add edi, ebx
xor ecx, edi
mov edi, dword [ebp - 0x34]
add edi, ecx
ror edi, 0x1b
imul edi, dword [ebp - 0x4c]
mov ebx, ecx
ror ebx, 0x14
add edi, ebx
xor eax, edi
mov edi, eax
sub edi, edx
imul edi, dword [ebp - 0x60]
mov ebx, eax
shr ebx, 0xa
sub edi, ebx
xor ecx, edi
mov ebx, ecx
xor ebx, edx
movzx edx, word [ebp - 0x34]
imul ebx, edx
mov edi, ecx
ror edi, 1
add edi, ebx
xor eax, edi
mov dword [ebp - 0x5c], edx
mov edx, dword [ebp - 0x30]
mov edi, eax
xor edi, edx
rol edi, 1
imul edi, dword [ebp - 0x48]
mov ebx, eax
shr ebx, 1
sub edi, ebx
xor ecx, edi
mov edi, dword [ebp - 0x60]
mov ebx, ecx
xor ebx, edi
rol ebx, 1
movzx edx, dx
imul ebx, edx
mov edx, ecx
ror edx, 1
xor ebx, edx
xor eax, ebx
mov edx, eax
sub edx, dword [ebp - 0x34]
ror edx, 0xc
imul edx, edi
mov edi, eax
xor eax, dword [ebp - 0x58]
ror edi, 0xd
sub edx, edi
xor ecx, edx
xor ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 0x54]
mov byte [edx + 3], al
mov byte [edx + 7], cl
ror eax, 8
ror ecx, 8
mov byte [edx + 2], al
mov byte [edx + 6], cl
ror eax, 8
ror ecx, 8
mov byte [edx + 1], al
mov byte [edx + 5], cl
ror eax, 8
ror ecx, 8
mov byte [edx], al
mov byte [edx + 4], cl
ror eax, 8
ror ecx, 8
mov edi, ecx
mov ecx, dword [ebp - 0x64]
mov dword [ebp - 0x58], ecx
mov ecx, dword [ebp - 0x3c]
add edx, 8
sub dword [ebp - 0x2c], 1
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x54], edx
jne 0x1040165
mov ecx, dword [ebp - 0x10c]
mov eax, dword [ebp - 0x50]
or dword [eax + ecx + 8], 0x10000000
mov edx, dword [ebp - 0x10c]
add eax, edx
push eax
lea ecx, [ebp - 0x26]
call fcn.01018a00
mov edx, dword [ebp - 0x10c]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0x68]
add dword [ebp - 0x50], 0xc
add eax, 1
cmp eax, dword [ebp - 0x108]
mov dword [ebp - 0x68], eax
jb 0x103fa57
call edi
xor ebx, ebx
cmp dword [ebp - 0x74], ebx
mov dword [ebp - 0x48], eax
je 0x104037d
mov ecx, dword [ebp - 0x7c]
mov edx, dword [ebp - 0x80]
lea eax, [ebp - 0x7c]
push eax
mov eax, dword [ebp - 0x84]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x74], ebx
cmp dword [ebp - 0x78], ebx
je 0x104039b
mov dword [ebp - 0x78], ebx
call edi
push 0x104ebec
mov dword [ebp - 0x4c], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0x4c]
push ecx
call esi
mov edx, dword [ebp - 0x48]
push edx
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x7c], ebx
call esi
call edi
mov edi, eax
mov eax, dword [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push edi
call esi
mov eax, dword [ebp - 0x11c]
mov ecx, dword [ebp - 4]
add dword [eax + 4], 8
mov eax, dword [ebp - 0x9c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01027e5c
mov esp, ebp
pop ebp
ret