Function at 0x10005c20
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x1008c3cc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0x225a8116
lea ecx, [ebp - 0x10]
call fcn.100020b0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, eax
xorps xmm0, xmm0
mov dword [ebp - 0x1c], ebx
movq qword [ebp - 0x10], xmm0
mov word [ebp - 8], 0
mov byte [ebp - 6], 0
test ebx, ebx
je 0x1000699a
cmp byte [0x10154a38], 0
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
jne 0x10005d43
sub esp, 8
push str.0____000000000____00____
push 0x10078ba8
push ebx
call fcn.10008660
sub esp, 8
mov esi, eax
push str.00____00000
push 0x100783ac
push ebx
mov dword [0x100b4530], esi
call fcn.10008660
sub esp, 8
mov ebx, eax
push str.0____0_0__0_00____00____0000____0
push 0x10078be8
push dword [ebp - 0x1c]
mov dword [0x1015455c], ebx
call fcn.10008660
sub esp, 8
mov dword [0x10154558], eax
push str.00_000_000_00____0____0
push 0x10078c24
push 0x400000
call fcn.10008660
sub esp, 8
mov dword [0x1009c524], eax
push str.0000
push 0x10078c44
push dword [ebp - 0x1c]
call fcn.10008660
sub esp, 8
mov dword [0x100b4534], eax
push str.00____0____0
push 0x10078c5c
push dword [ebp - 0x1c]
call fcn.10008660
mov dword [0x10150554], eax
mov eax, dword [esi + 1]
mov dword [0x10140544], eax
test ebx, ebx
je 0x10005d3c
push 4
add ebx, 2
push ebx
call edi
test eax, eax
jne 0x10005d35
mov eax, dword [ebx]
jmp 0x10005d37
xor eax, eax
mov dword [0x1015455c], eax
mov byte [0x10154a38], 1
mov eax, dword [0x10154558]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0x10140540
push 0x40
push 6
add eax, 0xc
push eax
call ebx
mov ecx, dword [0x10154558]
mov eax, dword [0x10078c6c]
add ecx, 0xc
push 0
mov dword [ecx], eax
mov ax, word [0x10078c70]
mov word [ecx + 4], ax
push dword [0x10140540]
push 6
push ecx
call ebx
push 0x100c8538
push 0x40
push 4
push dword [0x1009c524]
call ebx
mov eax, dword [0x1009c524]
push 0
mov dword [eax], 0x5210558b
push dword [0x100c8538]
push 4
push eax
call ebx
mov eax, dword [0x1015455c]
mov esi, dword [eax]
mov dword [ebp - 0x18], esi
test esi, esi
je 0x10006998
cmp byte [0x101549b0], 0
jne 0x100061a0
mov ebx, dword [ebp - 0x18]
mov esi, 0x100d0540
sub ebx, esi
mov edi, dword [ebx + esi]
test edi, edi
je 0x10005df8
push 0x5220
call fcn.1003d6a3
push 0x5220
push edi
push eax
mov dword [esi], eax
call fcn.1003f050
add esp, 0x10
add esi, 4
cmp esi, 0x100d4540
jl 0x10005dd6
mov ecx, dword [ebp - 0x18]
sub ecx, 0x100b0530
mov eax, 0x100d8540
xor ebx, ebx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x2c], ebx
lea esp, [esp]
mov esi, dword [ecx + ebx + 0x100b0530]
test esi, esi
je 0x10006179
mov ebx, 0x1008de80
mov dword [ebp - 0x14], eax
mov edi, dword [ebx]
push 4
add edi, esi
push edi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x10005e4e
movss xmm0, dword [edi]
jmp 0x10005e51
xorps xmm0, xmm0
mov eax, dword [ebp - 0x14]
add ebx, 4
movss dword [eax], xmm0
add eax, 4
mov dword [ebp - 0x14], eax
cmp ebx, 0x1008dee8
jl 0x10005e37
mov edi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 4
lea ebx, [esi + 0x13b0]
push ebx
call edi
test eax, eax
jne 0x10005e84
movss xmm0, dword [ebx]
jmp 0x10005e87
xorps xmm0, xmm0
mov ebx, dword [ebp - 0x2c]
lea eax, [esi + 0x13ac]
push 4
push eax
movss dword [ebx + 0x100b0530], xmm0
call edi
test eax, eax
jne 0x10005eab
movss xmm0, dword [esi + 0x13ac]
jmp 0x10005eae
xorps xmm0, xmm0
lea eax, [esi + 0xe24]
push 4
push eax
movss dword [ebx + 0x100d4540], xmm0
call edi
test eax, eax
jne 0x10005ecf
movss xmm0, dword [esi + 0xe24]
jmp 0x10005ed2
xorps xmm0, xmm0
lea eax, [esi + 0x1134]
push 4
push eax
movss dword [ebx + 0x100ac530], xmm0
call edi
test eax, eax
jne 0x10005ef1
mov eax, dword [esi + 0x1134]
jmp 0x10005ef3
xor eax, eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
push 4
addsd xmm0, qword [eax*8 + 0x10079f60]
lea eax, [esi + 0xe34]
push eax
cvtpd2ps xmm0, xmm0
movss dword [ebx + 0x10144548], xmm0
call edi
test eax, eax
jne 0x10005f2c
movss xmm0, dword [esi + 0xe34]
jmp 0x10005f2f
xorps xmm0, xmm0
lea eax, [esi + 0x11cc]
push 4
push eax
movss dword [ebx + 0x10150558], xmm0
call edi
test eax, eax
jne 0x10005f50
movss xmm0, dword [esi + 0x11cc]
jmp 0x10005f53
xorps xmm0, xmm0
lea eax, [esi + 0x1074]
push 4
push eax
movss dword [ebx + 0x100cc540], xmm0
call edi
test eax, eax
jne 0x10005f74
movss xmm0, dword [esi + 0x1074]
jmp 0x10005f77
xorps xmm0, xmm0
lea eax, [esi + 0x1078]
push 4
push eax
movss dword [ebx + 0x100c8540], xmm0
call edi
test eax, eax
jne 0x10005f98
movss xmm0, dword [esi + 0x1078]
jmp 0x10005f9b
xorps xmm0, xmm0
lea eax, [esi + 0x10a4]
push 4
push eax
movss dword [ebx + 0x10140548], xmm0
call edi
test eax, eax
jne 0x10005fbc
movss xmm0, dword [esi + 0x10a4]
jmp 0x10005fbf
xorps xmm0, xmm0
lea eax, [esi + 0x1104]
push 4
push eax
movss dword [ebx + 0x100a4528], xmm0
call edi
test eax, eax
jne 0x10005fe0
movss xmm0, dword [esi + 0x1104]
jmp 0x10005fe3
xorps xmm0, xmm0
lea eax, [esi + 0x1084]
push 4
push eax
movss dword [ebx + 0x100b4538], xmm0
call edi
test eax, eax
jne 0x10006004
movss xmm0, dword [esi + 0x1084]
jmp 0x10006007
xorps xmm0, xmm0
lea eax, [esi + 0x1088]
push 4
push eax
movss dword [ebx + 0x100a8530], xmm0
call edi
test eax, eax
jne 0x10006028
movss xmm0, dword [esi + 0x1088]
jmp 0x1000602b
xorps xmm0, xmm0
lea eax, [esi + 0x108c]
push 4
push eax
movss dword [ebx + 0x1009c528], xmm0
call edi
test eax, eax
jne 0x1000604c
movss xmm0, dword [esi + 0x108c]
jmp 0x1000604f
xorps xmm0, xmm0
lea eax, [esi + 0x1090]
push 4
push eax
movss dword [ebx + 0x1014c548], xmm0
call edi
test eax, eax
jne 0x10006070
movss xmm0, dword [esi + 0x1090]
jmp 0x10006073
xorps xmm0, xmm0
lea eax, [esi + 0x10b4]
push 4
push eax
movss dword [ebx + 0x100bc538], xmm0
call edi
test eax, eax
jne 0x10006094
movss xmm0, dword [esi + 0x10b4]
jmp 0x10006097
xorps xmm0, xmm0
lea eax, [esi + 0x1110]
push 4
push eax
movss dword [ebx + 0x100c4538], xmm0
call edi
test eax, eax
jne 0x100060b8
movss xmm0, dword [esi + 0x1110]
jmp 0x100060bb
xorps xmm0, xmm0
lea eax, [esi + 0x1094]
push 4
push eax
movss dword [ebx + 0x100b8538], xmm0
call edi
test eax, eax
jne 0x100060dc
movss xmm0, dword [esi + 0x1094]
jmp 0x100060df
xorps xmm0, xmm0
lea eax, [esi + 0x1098]
push 4
push eax
movss dword [ebx + 0x10098520], xmm0
call edi
test eax, eax
jne 0x10006100
movss xmm0, dword [esi + 0x1098]
jmp 0x10006103
xorps xmm0, xmm0
lea eax, [esi + 0x109c]
push 4
push eax
movss dword [ebx + 0x100c0538], xmm0
call edi
test eax, eax
jne 0x10006124
movss xmm0, dword [esi + 0x109c]
jmp 0x10006127
xorps xmm0, xmm0
lea eax, [esi + 0x10c4]
push 4
push eax
movss dword [ebx + 0x10094520], xmm0
call edi
test eax, eax
jne 0x10006148
movss xmm0, dword [esi + 0x10c4]
jmp 0x1000614b
xorps xmm0, xmm0
push 4
add esi, 0x10c0
push esi
movss dword [ebx + 0x100a0528], xmm0
call edi
test eax, eax
jne 0x10006168
movss xmm0, dword [esi]
jmp 0x1000616b
xorps xmm0, xmm0
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x20]
movss dword [ebx + 0x10148548], xmm0
add eax, 0x68
add ebx, 4
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ebx
cmp eax, 0x10140540
jl 0x10005e20
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, dword [ebp - 0x18]
mov byte [0x101549b0], 1
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ecx + 0x15dd8c8]
test eax, eax
je 0x10006203
cmp dword [ecx + 0x1643d34], 0xb
jne 0x10006203
mov eax, dword [eax + 0x2d0]
test eax, eax
je 0x10006203
mov eax, dword [eax + 4]
test eax, eax
je 0x10006203
cmp dword [eax + 0x153c], 0
je 0x10006230
mov eax, dword [0x100b4530]
push 0x100a8528
push 0x40
push 4
inc eax
push eax
call ebx
mov eax, dword [0x100b4530]
mov ecx, 0x10005c10
lea edx, [eax + 1]
sub ecx, eax
push 0
sub ecx, 5
mov dword [edx], ecx
push dword [0x100a8528]
push 4
push edx
jmp 0x1000622e
mov eax, dword [0x100b4530]
push 0x100a8528
push 0x40
push 4
inc eax
push eax
call ebx
mov ecx, dword [0x100b4530]
mov eax, dword [0x10140544]
inc ecx
push 0
mov dword [ecx], eax
push dword [0x100a8528]
push 4
push ecx
call ebx
movss xmm3, dword [0x10079f38]
movss xmm2, dword [0x10079f3c]
movss xmm4, dword [0x10079f34]
movss xmm5, dword [0x10079f2c]
movss xmm6, dword [0x10079f28]
xor edi, edi
lea ebx, [ebx]
mov edx, dword [esi + edi*4]
test edx, edx
je 0x1000698b
cmp dword [0x100944ac], 0
mov ebx, dword [ebp - 0x1c]
je 0x1000628c
cmp dword [ebx + 0x1643d34], 0xb
jne 0x1000628c
mov dword [edx + 0x1134], 2
jmp 0x100062b4
fld dword [edi*4 + 0x10144548]
fnstcw word [ebp - 0x12]
movzx eax, word [ebp - 0x12]
or eax, 0xc00
mov dword [ebp - 0x20], eax
fldcw word [ebp - 0x20]
fistp qword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov dword [edx + 0x1134], eax
fldcw word [ebp - 0x12]
xor esi, esi
jmp 0x100062c0
mov eax, dword [0x10094450]
test eax, eax
je 0x100063bc
cmp dword [ebx + 0x1643d34], 0xb
jne 0x100063bc
cmp eax, 1
jne 0x10006303
mov eax, edi
imul eax, eax, 0x1a
add eax, esi
movss xmm0, dword [eax*4 + 0x100d8540]
mulss xmm0, xmm3
mov eax, dword [esi*4 + 0x1008de80]
divss xmm0, xmm2
movss dword [edx + eax], xmm0
cmp dword [0x10094450], 2
jne 0x10006330
mov eax, edi
imul eax, eax, 0x1a
add eax, esi
movss xmm0, dword [eax*4 + 0x100d8540]
mulss xmm0, xmm4
mov eax, dword [esi*4 + 0x1008de80]
divss xmm0, xmm2
movss dword [edx + eax], xmm0
cmp dword [0x10094450], 3
jne 0x1000635d
mov eax, edi
imul eax, eax, 0x1a
add eax, esi
movss xmm0, dword [eax*4 + 0x100d8540]
mulss xmm0, xmm5
mov eax, dword [esi*4 + 0x1008de80]
divss xmm0, xmm2
movss dword [edx + eax], xmm0
cmp dword [0x10094450], 4
jne 0x1000638a
mov eax, edi
imul eax, eax, 0x1a
add eax, esi
movss xmm0, dword [eax*4 + 0x100d8540]
mulss xmm0, xmm6
mov eax, dword [esi*4 + 0x1008de80]
divss xmm0, xmm2
movss dword [edx + eax], xmm0
cmp dword [0x10094450], 5
xorps xmm1, xmm1
jne 0x100063d7
mov eax, edi
imul eax, eax, 0x1a
add eax, esi
movss xmm0, dword [eax*4 + 0x100d8540]
mulss xmm0, xmm1
mov eax, dword [esi*4 + 0x1008de80]
divss xmm0, xmm2
movss dword [edx + eax], xmm0
jmp 0x100063d7
mov ecx, dword [esi*4 + 0x1008de80]
mov eax, edi
imul eax, eax, 0x1a
add eax, esi
xorps xmm1, xmm1
mov eax, dword [eax*4 + 0x100d8540]
mov dword [edx + ecx], eax
inc esi
cmp esi, 0x1a
jl 0x100062c0
mov eax, dword [0x10094468]
test eax, eax
je 0x10006454
cmp dword [ebx + 0x1643d34], 0xb
jne 0x10006454
cmp eax, 1
jne 0x10006407
mov dword [edx + 0x13b0], 0x3fcccccd
mov eax, dword [0x10094468]
cmp eax, 2
jne 0x1000641b
mov dword [edx + 0x13b0], 0x402ccccd
mov eax, dword [0x10094468]
cmp eax, 3
jne 0x1000642f
mov dword [edx + 0x13b0], 0x40b9999a
mov eax, dword [0x10094468]
cmp eax, 4
jne 0x10006443
mov dword [edx + 0x13b0], 0x4129999a
mov eax, dword [0x10094468]
cmp eax, 5
jne 0x10006461
mov dword [edx + 0x13b0], 0x42480000
jmp 0x10006461
mov eax, dword [edi*4 + 0x100b0530]
mov dword [edx + 0x13b0], eax
mov eax, dword [0x1009445c]
test eax, eax
je 0x100064d4
cmp dword [ebx + 0x1643d34], 0xb
jne 0x100064d4
cmp eax, 1
jne 0x10006487
mov dword [edx + 0x13ac], 0x3fcccccd
mov eax, dword [0x1009445c]
cmp eax, 2
jne 0x1000649b
mov dword [edx + 0x13ac], 0x402ccccd
mov eax, dword [0x1009445c]
cmp eax, 3
jne 0x100064af
mov dword [edx + 0x13ac], 0x40b9999a
mov eax, dword [0x1009445c]
cmp eax, 4
jne 0x100064c3
mov dword [edx + 0x13ac], 0x4129999a
mov eax, dword [0x1009445c]
cmp eax, 5
jne 0x100064e1
mov dword [edx + 0x13ac], 0x42480000
jmp 0x100064e1
mov eax, dword [edi*4 + 0x100d4540]
mov dword [edx + 0x13ac], eax
mov cl, byte [edx + 2]
cmp cl, 6
jne 0x100065c0
mov eax, dword [0x10094488]
test eax, eax
je 0x100065b3
cmp dword [ebx + 0x1643d34], 0xb
jne 0x100065b3
cmp eax, 1
jne 0x1000652a
movss xmm0, dword [edi*4 + 0x100ac530]
mulss xmm0, xmm3
divss xmm0, xmm2
movss dword [edx + 0xe24], xmm0
mov eax, dword [0x10094488]
cmp eax, 2
jne 0x1000654d
movss xmm0, dword [edi*4 + 0x100ac530]
mulss xmm0, xmm4
divss xmm0, xmm2
movss dword [edx + 0xe24], xmm0
mov eax, dword [0x10094488]
cmp eax, 3
jne 0x10006570
movss xmm0, dword [edi*4 + 0x100ac530]
mulss xmm0, xmm5
divss xmm0, xmm2
movss dword [edx + 0xe24], xmm0
mov eax, dword [0x10094488]
cmp eax, 4
jne 0x10006593
movss xmm0, dword [edi*4 + 0x100ac530]
mulss xmm0, xmm6
divss xmm0, xmm2
movss dword [edx + 0xe24], xmm0
mov eax, dword [0x10094488]
cmp eax, 5
jne 0x100065c0
movss xmm0, dword [edi*4 + 0x100ac530]
mulss xmm0, xmm1
divss xmm0, xmm2
movss dword [edx + 0xe24], xmm0
jmp 0x100065c0
mov eax, dword [edi*4 + 0x100ac530]
mov dword [edx + 0xe24], eax
cmp cl, 7
je 0x100065d8
movzx eax, cl
cmp eax, 0x10007
je 0x100065d8
cmp cl, 0xc
jne 0x10006988
fld dword [edi*4 + 0x10144548]
fnstcw word [ebp - 0x12]
movzx eax, word [ebp - 0x12]
or eax, 0xc00
mov dword [ebp - 0x20], eax
fldcw word [ebp - 0x20]
fistp qword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov dword [edx + 0x1134], eax
mov eax, dword [0x10094494]
fldcw word [ebp - 0x12]
test eax, eax
je 0x100066a7
cmp dword [ebx + 0x1643d34], 0xb
jne 0x100066a7
cmp eax, 1
jne 0x10006660
mov dword [edx + 0x1084], 0x43480000
mov dword [edx + 0x1088], 0x43480000
mov dword [edx + 0x108c], 0x43480000
mov dword [edx + 0x1090], 0x43480000
mov dword [edx + 0x10b4], 0x43480000
mov dword [edx + 0x1110], 0x43480000
mov eax, dword [0x10094494]
cmp eax, 2
jne 0x100066f5
mov dword [edx + 0x1084], 0x4b18967f
mov dword [edx + 0x1088], 0x4b18967f
mov dword [edx + 0x108c], 0x4b18967f
mov dword [edx + 0x1090], 0x4b18967f
mov dword [edx + 0x10b4], 0x4b18967f
mov dword [edx + 0x1110], 0x4b18967f
jmp 0x100066f5
mov eax, dword [edi*4 + 0x100a8530]
mov dword [edx + 0x1084], eax
mov eax, dword [edi*4 + 0x1009c528]
mov dword [edx + 0x1088], eax
mov eax, dword [edi*4 + 0x1014c548]
mov dword [edx + 0x108c], eax
mov eax, dword [edi*4 + 0x100bc538]
mov dword [edx + 0x1090], eax
mov eax, dword [edi*4 + 0x100c4538]
mov dword [edx + 0x10b4], eax
mov eax, dword [edi*4 + 0x100b8538]
mov dword [edx + 0x1110], eax
mov eax, dword [0x10094470]
test eax, eax
je 0x100067fc
cmp dword [ebx + 0x1643d34], 0xb
jne 0x100067fc
cmp eax, 1
jne 0x1000674b
mov dword [edx + 0xe24], 0x43fa0000
mov dword [edx + 0x1074], 0x43fa0000
mov dword [edx + 0x1078], 0x43fa0000
mov dword [edx + 0x10a4], 0x43fa0000
mov dword [edx + 0x1104], 0x43fa0000
mov eax, dword [0x10094470]
cmp eax, 2
jne 0x10006787
mov dword [edx + 0xe24], 0x44160000
mov dword [edx + 0x1074], 0x44160000
mov dword [edx + 0x1078], 0x44160000
mov dword [edx + 0x10a4], 0x44160000
mov dword [edx + 0x1104], 0x44160000
mov eax, dword [0x10094470]
cmp eax, 3
jne 0x100067c3
mov dword [edx + 0xe24], 0x447a0000
mov dword [edx + 0x1074], 0x447a0000
mov dword [edx + 0x1078], 0x447a0000
mov dword [edx + 0x10a4], 0x447a0000
mov dword [edx + 0x1104], 0x447a0000
mov eax, dword [0x10094470]
cmp eax, 4
jne 0x1000683d
mov dword [edx + 0xe24], 0x4b18967f
mov dword [edx + 0x1074], 0x4b18967f
mov dword [edx + 0x1078], 0x4b18967f
mov dword [edx + 0x10a4], 0x4b18967f
mov dword [edx + 0x1104], 0x4b18967f
jmp 0x1000683d
mov eax, dword [edi*4 + 0x100ac530]
mov dword [edx + 0xe24], eax
mov eax, dword [edi*4 + 0x100c8540]
mov dword [edx + 0x1074], eax
mov eax, dword [edi*4 + 0x10140548]
mov dword [edx + 0x1078], eax
mov eax, dword [edi*4 + 0x100a4528]
mov dword [edx + 0x10a4], eax
mov eax, dword [edi*4 + 0x100b4538]
mov dword [edx + 0x1104], eax
mov eax, dword [0x1009446c]
test eax, eax
je 0x10006947
cmp dword [ebx + 0x1643d34], 0xb
jne 0x10006947
cmp eax, 1
jne 0x10006893
mov dword [edx + 0x1094], 0x3fcccccd
mov dword [edx + 0x1098], 0x3fcccccd
mov dword [edx + 0x109c], 0x3fcccccd
mov dword [edx + 0x10c4], 0x3fcccccd
mov dword [edx + 0x10c0], 0x3fcccccd
mov eax, dword [0x1009446c]
cmp eax, 2
jne 0x100068cf
mov dword [edx + 0x1094], 0x402ccccd
mov dword [edx + 0x1098], 0x402ccccd
mov dword [edx + 0x109c], 0x402ccccd
mov dword [edx + 0x10c4], 0x402ccccd
mov dword [edx + 0x10c0], 0x402ccccd
mov eax, dword [0x1009446c]
cmp eax, 3
jne 0x1000690b
mov dword [edx + 0x1094], 0x40b66666
mov dword [edx + 0x1098], 0x40b66666
mov dword [edx + 0x109c], 0x40b66666
mov dword [edx + 0x10c4], 0x40b66666
mov dword [edx + 0x10c0], 0x40b66666
mov eax, dword [0x1009446c]
mov esi, dword [ebp - 0x18]
cmp eax, 4
jne 0x1000698b
mov dword [edx + 0x1094], 0x41700000
mov dword [edx + 0x1098], 0x41700000
mov dword [edx + 0x109c], 0x41700000
mov dword [edx + 0x10c4], 0x41700000
mov dword [edx + 0x10c0], 0x41700000
jmp 0x1000698b
mov eax, dword [edi*4 + 0x10098520]
mov dword [edx + 0x1094], eax
mov eax, dword [edi*4 + 0x100c0538]
mov dword [edx + 0x1098], eax
mov eax, dword [edi*4 + 0x10094520]
mov dword [edx + 0x109c], eax
mov eax, dword [edi*4 + 0x100a0528]
mov dword [edx + 0x10c4], eax
mov eax, dword [edi*4 + 0x10148548]
mov dword [edx + 0x10c0], eax
mov esi, dword [ebp - 0x18]
inc edi
cmp edi, 0x1000
jl 0x10006260
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.1003cd0a
mov esp, ebp
pop ebp
ret