Function at 0x1016332
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xb0
mov eax, dword [0x1039074]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ecx + 4]
mov eax, dword [ebx + 4]
push esi
mov esi, dword [ebx]
push edi
lea edi, [eax*8]
sub edi, eax
lea edi, [edi*4 + 0x103a324]
lea eax, [edi + 4]
push eax
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0xb0], ebx
add esi, 0x1000000
mov dword [ebp - 0x84], 0
mov dword [ebp - 0x48], edi
mov dword [ebp - 0xa8], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [edi], 0
jne 0x1016ab3
xor edi, edi
lea ecx, [ebp - 0x90]
mov byte [ebp - 0x15], 0xa5
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], edi
call esi
xor esi, esi
cmp dword [ebp - 0x8c], edi
mov dword [ebp - 0x7c], esi
jbe 0x1016a54
mov eax, dword [ebp - 0x90]
mov edi, dword [eax + esi*8]
mov ebx, dword [eax + esi*8 + 4]
mov eax, dword [ebp - 0x40]
add edi, 0x1000000
and ebx, 0x7fffffff
cmp edi, eax
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x78], ebx
jb 0x10163fb
mov ecx, dword [ebp - 0x3c]
add ecx, eax
lea edx, [ebx + edi]
cmp edx, ecx
jbe 0x101648b
cmp dword [ebp - 0x30], 0
je 0x101641b
mov edx, dword [ebp - 0x38]
lea ecx, [ebp - 0x38]
push ecx
mov ecx, dword [ebp - 0x3c]
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x30], 0
cmp dword [ebp - 0x34], 0
je 0x1016433
push 0x103a2f0
mov dword [ebp - 0x34], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
and eax, 0xfffff000
lea edx, [ebx + edi + 0xfff]
and edx, 0xfffff000
sub edx, eax
push 0x103a2f0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], edx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x40]
lea eax, [ebp - 0x38]
push eax
push 0x40
push ecx
push edx
mov dword [ebp - 0x34], 1
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1016a4a
mov dword [ebp - 0x30], 1
test edi, edi
je 0x1016a4a
mov eax, dword [ebp - 0x90]
mov ecx, dword [eax + esi*8 + 4]
and ecx, 0x80000000
cmp ecx, 0x80000000
jne 0x1016a32
mov edx, dword [eax + esi*8]
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], 0
mov dl, byte [eax + 7]
test dl, 1
jne 0x1016760
movzx ecx, word [eax + 4]
mov dword [ebp - 0x4c], ecx
mov ecx, dword [eax]
movzx esi, dl
add ecx, 0x1000000
mov eax, 0x1000000
shr esi, 1
sub eax, dword [0x103a30c]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x80], eax
jne 0x1016542
mov eax, 0x8421085
mul esi
mov eax, esi
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 6
imul eax, eax, 0x7c
sub esi, eax
mov eax, dword [ebp - 0x4c]
lea edx, [ebp - 0x54]
push edx
lea edx, [ecx + eax]
push edx
push ecx
mov ecx, dword [esi*4 + 0x1039120]
lea eax, [ebp - 0x2c]
push eax
mov byte [ebp - 0x54], 0
mov byte [ebp - 0x53], 1
mov byte [ebp - 0x52], 2
mov byte [ebp - 0x51], 3
mov byte [ebp - 0x50], 4
mov byte [ebp - 0x4f], 5
call ecx
jmp 0x101674a
mov edi, dword [ebp - 0x4c]
mov edx, dword [0x100003c]
mov eax, ecx
sub eax, 0x1000000
mov ecx, eax
mov ebx, eax
add eax, edi
mov edi, eax
and edi, 0xfffff000
sub eax, edi
mov dword [ebp - 0xa4], edi
mov edi, dword [edx + 0x10000a0]
mov dword [ebp - 0xa0], eax
mov eax, dword [edx + 0x10000a4]
add edi, 0x1000000
and ecx, 0xfffff000
add eax, edi
sub ebx, ecx
cmp edi, eax
mov dword [ebp - 0x9c], eax
je 0x101659f
cmp dword [edi], ecx
jae 0x101659f
add edi, dword [edi + 4]
cmp edi, eax
jne 0x1016594
xor edx, edx
cmp edi, eax
je 0x10165d3
cmp dword [edi], ecx
jne 0x10165d3
mov ecx, dword [edi + 4]
sub ecx, 8
shr ecx, 1
mov dword [ebp - 0xac], ecx
je 0x10165d3
movzx ecx, word [edi + edx*2 + 8]
and ecx, 0xfff
cmp ecx, ebx
jae 0x10165d3
add edx, 1
cmp edx, dword [ebp - 0xac]
jne 0x10165b9
mov ecx, dword [ebp - 0x24]
jmp 0x10165de
mov eax, dword [ebp - 0x9c]
cmp edi, eax
je 0x10166fa
mov ebx, dword [edi]
cmp ebx, dword [ebp - 0xa4]
ja 0x10166fa
lea esp, [esp]
mov ebx, dword [edi + 4]
add ebx, 0xfffffff8
shr ebx, 1
cmp edx, ebx
jne 0x1016620
add edi, dword [edi + 4]
cmp edi, eax
je 0x10166fa
mov edx, dword [ebp - 0xa4]
cmp dword [edi], edx
ja 0x10166fa
xor edx, edx
jmp 0x10165f7
mov ebx, dword [edi]
cmp ebx, dword [ebp - 0xa4]
jne 0x1016640
movzx eax, word [edi + edx*2 + 8]
and eax, 0xfff
cmp eax, dword [ebp - 0xa0]
jae 0x10166fa
mov eax, edx
movzx eax, word [edi + eax*2 + 8]
add edx, 1
test eax, 0xf000
mov dword [ebp - 0x94], edx
je 0x10165d8
and eax, 0xfff
lea ebx, [eax + ebx + 0x1000000]
mov eax, 0x8421085
mul esi
mov eax, esi
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 6
imul eax, eax, 0x7c
mov edx, esi
sub edx, eax
lea eax, [edx*4 + 0x1039120]
lea edx, [ebp - 0x64]
push edx
mov edx, dword [eax]
push ebx
push ecx
lea ecx, [ebp - 0x2c]
push ecx
mov byte [ebp - 0x64], 0
mov byte [ebp - 0x63], 1
mov byte [ebp - 0x62], 2
mov byte [ebp - 0x61], 3
mov byte [ebp - 0x60], 4
mov byte [ebp - 0x5f], 5
mov dword [ebp - 0xac], eax
call edx
mov eax, dword [ebx]
sub eax, dword [ebp - 0x80]
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x5c]
push eax
push ecx
mov ecx, dword [ebp - 0xac]
lea edx, [ebp - 0x14]
push edx
mov edx, dword [ecx]
lea eax, [ebp - 0x2c]
push eax
mov byte [ebp - 0x5c], 0
mov byte [ebp - 0x5b], 1
mov byte [ebp - 0x5a], 2
mov byte [ebp - 0x59], 3
mov byte [ebp - 0x58], 4
mov byte [ebp - 0x57], 5
call edx
mov edx, dword [ebp - 0x94]
add esp, 0x20
lea ecx, [ebx + 4]
jmp 0x10165d8
mov eax, 0x8421085
mul esi
mov eax, esi
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 6
imul eax, eax, 0x7c
sub esi, eax
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x6c]
push edx
mov edx, dword [ebp - 0x4c]
add eax, edx
push eax
push ecx
mov ecx, dword [esi*4 + 0x1039120]
lea eax, [ebp - 0x2c]
push eax
mov byte [ebp - 0x6c], 0
mov byte [ebp - 0x6b], 1
mov byte [ebp - 0x6a], 2
mov byte [ebp - 0x69], 3
mov byte [ebp - 0x68], 4
mov byte [ebp - 0x67], 5
call ecx
mov edi, dword [ebp - 0x70]
mov ebx, dword [ebp - 0x78]
or byte [ebp - 0x2c], 1
or byte [ebp - 0x2a], 1
or byte [ebp - 0x28], 1
add esp, 0x10
or byte [ebp - 0x27], 1
lea eax, [ebp - 0x2c]
test ebx, ebx
mov edx, dword [eax]
mov ax, word [eax + 4]
mov dword [ebp - 0x20], edx
mov word [ebp - 0x1c], ax
jbe 0x1016963
mov ebx, dword [ebp - 0x78]
add ebx, 0xffffffff
mov dword [ebp - 0x24], ebx
je 0x10168dd
lea ecx, [ecx]
test bl, 1
je 0x1016821
mov ecx, dword [ebp - 0x70]
mov cl, byte [ebx + ecx]
mov dl, byte [ebp - 0x1d]
movzx eax, byte [ebp - 0x1d]
xor dl, cl
and dl, 1
movzx ecx, cl
je 0x10167c3
movzx esi, byte [ebp - 0x1e]
mov ebx, dword [ebp - 0x24]
mov edi, eax
shr edi, 1
shr esi, 1
xor esi, edi
mov edi, ecx
xor edi, 0x100
sar edi, 1
xor esi, edi
jmp 0x10167c9
mov esi, eax
xor esi, ecx
shr esi, 1
mov edi, dword [ebp - 0x70]
movzx edi, byte [ebx + edi - 1]
mov ebx, esi
xor ebx, edi
test bl, 1
je 0x1016810
test dl, dl
je 0x10167f4
movzx edx, byte [ebp - 0x1e]
shr edx, 1
shr eax, 1
xor ecx, 0x100
xor edx, eax
sar ecx, 1
xor edx, ecx
jmp 0x10167fa
xor eax, ecx
shr eax, 1
mov edx, eax
movzx eax, byte [ebp - 0x1b]
shr eax, 1
xor edx, edi
xor eax, 0x80
sar edx, 1
xor eax, edx
jmp 0x10168c5
test dl, dl
je 0x10168b9
movzx edx, byte [ebp - 0x1e]
jmp 0x10168a7
mov edx, dword [ebp - 0x70]
mov cl, byte [ebx + edx]
mov dl, byte [ebp - 0x1f]
movzx eax, byte [ebp - 0x1f]
xor dl, cl
and dl, 1
movzx ecx, cl
je 0x1016855
movzx esi, byte [ebp - 0x20]
mov ebx, dword [ebp - 0x24]
mov edi, eax
shr edi, 1
shr esi, 1
xor esi, edi
mov edi, ecx
xor edi, 0x100
sar edi, 1
xor esi, edi
jmp 0x101685b
mov esi, eax
xor esi, ecx
shr esi, 1
mov edi, dword [ebp - 0x70]
movzx edi, byte [ebx + edi - 1]
mov ebx, esi
xor ebx, edi
test bl, 1
je 0x101689f
test dl, dl
je 0x1016886
movzx edx, byte [ebp - 0x20]
shr edx, 1
shr eax, 1
xor ecx, 0x100
xor edx, eax
sar ecx, 1
xor edx, ecx
jmp 0x101688c
xor eax, ecx
shr eax, 1
mov edx, eax
movzx eax, byte [ebp - 0x1c]
shr eax, 1
xor edx, edi
xor eax, 0x80
sar edx, 1
xor eax, edx
jmp 0x10168c5
test dl, dl
je 0x10168b9
movzx edx, byte [ebp - 0x20]
shr edx, 1
shr eax, 1
xor ecx, 0x100
xor edx, eax
sar ecx, 1
xor edx, ecx
jmp 0x10168bf
xor eax, ecx
shr eax, 1
mov edx, eax
xor edx, edi
sar edx, 1
mov eax, edx
mov ebx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x70]
xor byte [ebp - 0x15], al
mov byte [ebx + ecx], al
sub ebx, 1
mov dword [ebp - 0x24], ebx
jne 0x1016786
mov al, byte [ebp - 0x1f]
mov esi, dword [ebp - 0x70]
mov cl, byte [esi]
mov bl, byte [ebp - 0x20]
mov dl, al
xor dl, cl
movzx eax, al
movzx ecx, cl
xor eax, ecx
shr eax, 1
and dl, 1
je 0x101690a
movzx ecx, bl
xor ecx, 0x100
sar ecx, 1
xor ecx, eax
jmp 0x101690c
mov ecx, eax
test cl, 1
je 0x1016942
test dl, dl
je 0x1016931
movzx ecx, bl
xor ecx, 0x100
sar ecx, 1
xor ecx, eax
movzx eax, byte [ebp - 0x1c]
xor eax, ecx
xor eax, 0x100
sar eax, 1
jmp 0x101695b
mov ecx, eax
movzx eax, byte [ebp - 0x1c]
xor eax, ecx
xor eax, 0x100
sar eax, 1
jmp 0x101695b
test dl, dl
je 0x1016955
movzx ecx, bl
xor ecx, 0x100
sar ecx, 1
xor ecx, eax
jmp 0x1016957
mov ecx, eax
sar ecx, 1
mov eax, ecx
xor byte [ebp - 0x15], al
mov edi, dword [ebp - 0x70]
mov byte [esi], al
mov eax, 0x1000000
sub eax, dword [0x103a30c]
mov dword [ebp - 0x4c], eax
je 0x1016a1b
mov edx, dword [ebp - 0x78]
mov esi, dword [0x1001eac]
sub edi, 0x1000000
mov ebx, edi
lea eax, [ebx + edx]
xor edi, edi
add esi, 0xffffffff
mov dword [ebp - 0x80], eax
js 0x10169c1
nop
lea eax, [esi + edi]
cdq
sub eax, edx
sar eax, 1
mov ecx, dword [eax*4 + 0x1001eb0]
and ecx, 0xfffffff
cmp ebx, ecx
jae 0x10169b4
lea esi, [eax - 1]
jmp 0x10169b9
jbe 0x10169bf
lea edi, [eax + 1]
cmp esi, edi
jge 0x1016996
jmp 0x10169c1
mov edi, eax
cmp edi, dword [0x1001eac]
jae 0x1016a1b
mov ebx, dword [ebp - 0x80]
mov eax, dword [edi*4 + 0x1001eb0]
mov esi, eax
and esi, 0xfffffff
cmp esi, ebx
jae 0x1016a1b
mov ecx, eax
add eax, eax
add eax, eax
sar eax, 0x1e
sar ecx, 0x1e
and eax, 3
and ecx, 3
xor edx, edx
sub eax, 1
je 0x1016a02
sub eax, 1
je 0x1016a46
sub eax, 1
jne 0x1016a05
mov edx, dword [ebp - 0x4c]
sub ecx, 2
jne 0x1016a10
add dword [esi + 0x1000000], edx
add edi, 1
cmp edi, dword [0x1001eac]
jb 0x10169cc
mov ecx, dword [ebp - 0x7c]
mov edx, dword [ebp - 0x90]
and dword [edx + ecx*8 + 4], 0x7fffffff
lea eax, [edx + ecx*8 + 4]
mov esi, ecx
add esi, 1
cmp esi, dword [ebp - 0x8c]
mov dword [ebp - 0x7c], esi
jb 0x10163c5
jmp 0x1016a54
xor edx, edx
jmp 0x1016a05
mov dword [ebp - 0x84], 0x8007000e
xor esi, esi
cmp dword [ebp - 0x30], esi
je 0x1016a74
mov ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 0x3c]
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x40]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x30], esi
cmp dword [ebp - 0x34], esi
je 0x1016a87
push 0x103a2f0
mov dword [ebp - 0x34], esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0x88]
mov ebx, dword [ebp - 0xb0]
mov edi, dword [ebp - 0x48]
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], esi
mov dl, byte [ecx + 6]
xor dl, byte [ebp - 0x15]
je 0x1016ab5
mov dword [ebp - 0x84], 0x80004005
jmp 0x1016ab5
xor esi, esi
mov eax, dword [ebp - 0xa8]
add dword [edi], 1
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 0x74]
add dword [eax + 4], 8
cmp dword [ebp - 0x84], esi
jge 0x101717d
mov esi, dword [ebx]
mov ebx, dword [ebx + 4]
lea edi, [ebx*8]
sub edi, ebx
lea edi, [edi*4 + 0x103a324]
lea eax, [edi + 4]
push eax
add esi, 0x1000000
mov dword [ebp - 0x80], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
add dword [edi], 0xffffffff
jne 0x1017173
xor ebx, ebx
lea ecx, [ebp - 0x90]
mov byte [ebp - 0x15], 0xa5
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
call esi
xor edi, edi
cmp dword [ebp - 0x8c], ebx
mov dword [ebp - 0x4c], edi
jbe 0x1017136
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x90]
mov esi, dword [ecx + edi*8]
mov edx, dword [ecx + edi*8 + 4]
add esi, 0x1000000
and edx, 0x7fffffff
cmp esi, eax
mov dword [ebp - 0x78], esi
mov dword [ebp - 0x24], edx
jb 0x1016b6e
mov ebx, dword [ebp - 0x3c]
add edx, esi
add ebx, eax
cmp edx, ebx
jbe 0x1016bfe
xor ebx, ebx
cmp dword [ebp - 0x30], ebx
je 0x1016b89
mov edx, dword [ebp - 0x38]
lea ecx, [ebp - 0x38]
push ecx
mov ecx, dword [ebp - 0x3c]
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x30], ebx
cmp dword [ebp - 0x34], ebx
je 0x1016b9c
push 0x103a2f0
mov dword [ebp - 0x34], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edx, dword [ebp - 0x24]
lea ecx, [edx + esi + 0xfff]
mov eax, esi
and eax, 0xfffff000
and ecx, 0xfffff000
sub ecx, eax
push 0x103a2f0
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], ecx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x40]
lea edx, [ebp - 0x38]
push edx
push 0x40
push eax
push ecx
mov dword [ebp - 0x34], 1
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, ebx
je 0x1017136
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x90]
mov dword [ebp - 0x30], 1
jmp 0x1016c00
xor ebx, ebx
cmp esi, ebx
je 0x1017139
test dword [ecx + edi*8 + 4], 0x80000000
jne 0x1017122
mov eax, dword [ecx + edi*8]
mov edx, dword [ebp - 0x88]
mov dword [ebp - 0x28], ebx
mov ebx, dword [0x103a30c]
sub ebx, 0x1000000
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x2c], eax
je 0x1016cdd
mov edx, dword [ebp - 0x24]
mov ecx, esi
mov esi, dword [0x1001eac]
sub ecx, 0x1000000
lea eax, [edx + ecx]
xor edi, edi
add esi, 0xffffffff
mov dword [ebp - 0x74], eax
js 0x1016c83
lea eax, [esi + edi]
cdq
sub eax, edx
sar eax, 1
mov edx, dword [eax*4 + 0x1001eb0]
and edx, 0xfffffff
cmp ecx, edx
jae 0x1016c76
lea esi, [eax - 1]
jmp 0x1016c7b
jbe 0x1016c81
lea edi, [eax + 1]
cmp esi, edi
jge 0x1016c58
jmp 0x1016c83
mov edi, eax
cmp edi, dword [0x1001eac]
jae 0x1016cda
mov eax, dword [edi*4 + 0x1001eb0]
mov esi, eax
and esi, 0xfffffff
cmp esi, dword [ebp - 0x74]
jae 0x1016cda
mov ecx, eax
add eax, eax
add eax, eax
sar eax, 0x1e
sar ecx, 0x1e
and eax, 3
and ecx, 3
xor edx, edx
sub eax, 1
je 0x1016cc2
sub eax, 1
je 0x1016ceb
sub eax, 1
jne 0x1016cc4
mov edx, ebx
sub ecx, 2
jne 0x1016ccf
add dword [esi + 0x1000000], edx
add edi, 1
cmp edi, dword [0x1001eac]
jb 0x1016c8b
mov edx, dword [ebp - 0x48]
mov al, byte [edx + 7]
test al, 1
je 0x1016cef
mov eax, edx
jmp 0x1016f73
xor edx, edx
jmp 0x1016cc4
mov ecx, dword [edx]
movzx edi, word [edx + 4]
movzx esi, al
add ecx, 0x1000000
mov eax, 0x1000000
shr esi, 1
sub eax, dword [0x103a30c]
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0xa8], eax
jne 0x1016d63
mov eax, 0x8421085
mul esi
mov eax, esi
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 6
imul eax, eax, 0x7c
sub esi, eax
lea edx, [ebp - 0x6c]
push edx
mov edx, dword [esi*4 + 0x1039120]
lea eax, [ecx + edi]
push eax
push ecx
lea ecx, [ebp - 0x2c]
push ecx
mov byte [ebp - 0x6c], 0
mov byte [ebp - 0x6b], 1
mov byte [ebp - 0x6a], 2
mov byte [ebp - 0x69], 3
mov byte [ebp - 0x68], 4
mov byte [ebp - 0x67], 5
call edx
jmp 0x1016f5d
mov eax, dword [ebp - 0x7c]
mov edi, dword [ebp - 0x48]
mov edx, dword [0x100003c]
sub eax, 0x1000000
mov ecx, eax
mov ebx, eax
add eax, edi
mov edi, eax
and edi, 0xfffff000
sub eax, edi
mov dword [ebp - 0xa4], edi
mov edi, dword [edx + 0x10000a0]
mov dword [ebp - 0xa0], eax
mov eax, dword [edx + 0x10000a4]
add edi, 0x1000000
and ecx, 0xfffff000
add eax, edi
sub ebx, ecx
cmp edi, eax
mov dword [ebp - 0x9c], eax
je 0x1016dc1
cmp dword [edi], ecx
jae 0x1016dc1
add edi, dword [edi + 4]
cmp edi, eax
jne 0x1016db6
xor edx, edx
cmp edi, eax
je 0x1016def
cmp dword [edi], ecx
jne 0x1016def
mov ecx, dword [edi + 4]
sub ecx, 8
shr ecx, 1
mov dword [ebp - 0x74], ecx
je 0x1016def
movzx ecx, word [edi + edx*2 + 8]
and ecx, 0xfff
cmp ecx, ebx
jae 0x1016def
add edx, 1
cmp edx, dword [ebp - 0x74]
jne 0x1016dd8
mov ecx, dword [ebp - 0x7c]
jmp 0x1016dfa
mov eax, dword [ebp - 0x9c]
cmp edi, eax
je 0x1016f13
mov ebx, dword [edi]
cmp ebx, dword [ebp - 0xa4]
ja 0x1016f13
lea esp, [esp]
mov ebx, dword [edi + 4]
add ebx, 0xfffffff8
shr ebx, 1
cmp edx, ebx
jne 0x1016e3c
add edi, dword [edi + 4]
cmp edi, eax
je 0x1016f13
mov edx, dword [ebp - 0xa4]
cmp dword [edi], edx
ja 0x1016f13
xor edx, edx
jmp 0x1016e13
mov ebx, dword [edi]
cmp ebx, dword [ebp - 0xa4]
jne 0x1016e5c
movzx eax, word [edi + edx*2 + 8]
and eax, 0xfff
cmp eax, dword [ebp - 0xa0]
jae 0x1016f13
mov eax, edx
movzx eax, word [edi + eax*2 + 8]
add edx, 1
test eax, 0xf000
mov dword [ebp - 0x94], edx
je 0x1016df4
and eax, 0xfff
lea ebx, [eax + ebx + 0x1000000]
mov eax, 0x8421085
mul esi
mov eax, esi
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 6
imul eax, eax, 0x7c
mov edx, esi
sub edx, eax
lea eax, [edx*4 + 0x1039120]
lea edx, [ebp - 0x5c]
push edx
mov edx, dword [eax]
push ebx
push ecx
lea ecx, [ebp - 0x2c]
push ecx
mov byte [ebp - 0x5c], 0
mov byte [ebp - 0x5b], 1
mov byte [ebp - 0x5a], 2
mov byte [ebp - 0x59], 3
mov byte [ebp - 0x58], 4
mov byte [ebp - 0x57], 5
mov dword [ebp - 0x74], eax
call edx
mov eax, dword [ebx]
sub eax, dword [ebp - 0xa8]
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x64]
push eax
push ecx
mov ecx, dword [ebp - 0x74]
lea edx, [ebp - 0x14]
push edx
mov edx, dword [ecx]
lea eax, [ebp - 0x2c]
push eax
mov byte [ebp - 0x64], 0
mov byte [ebp - 0x63], 1
mov byte [ebp - 0x62], 2
mov byte [ebp - 0x61], 3
mov byte [ebp - 0x60], 4
mov byte [ebp - 0x5f], 5
call edx
mov edx, dword [ebp - 0x94]
add esp, 0x20
lea ecx, [ebx + 4]
jmp 0x1016df4
mov eax, 0x8421085
mul esi
mov eax, esi
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 6
imul eax, eax, 0x7c
sub esi, eax
mov eax, dword [ebp - 0x7c]
lea edx, [ebp - 0x54]
push edx
mov edx, dword [ebp - 0x48]
add eax, edx
push eax
push ecx
mov ecx, dword [esi*4 + 0x1039120]
lea eax, [ebp - 0x2c]
push eax
mov byte [ebp - 0x54], 0
mov byte [ebp - 0x53], 1
mov byte [ebp - 0x52], 2
mov byte [ebp - 0x51], 3
mov byte [ebp - 0x50], 4
mov byte [ebp - 0x4f], 5
call ecx
or byte [ebp - 0x2c], 1
or byte [ebp - 0x2a], 1
or byte [ebp - 0x28], 1
add esp, 0x10
or byte [ebp - 0x27], 1
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x24], 0
mov esi, dword [eax]
mov dx, word [eax + 4]
mov dword [ebp - 0x20], esi
mov word [ebp - 0x1c], dx
jbe 0x1017100
mov eax, dword [ebp - 0x78]
mov al, byte [eax]
xor byte [ebp - 0x15], al
mov bl, byte [ebp - 0x1c]
mov dl, al
and dl, 0x80
movzx eax, al
je 0x1016fa8
movzx ecx, bl
add eax, eax
xor ecx, eax
jmp 0x1016fac
add eax, eax
mov ecx, eax
test cl, cl
jns 0x1016fd1
test dl, dl
je 0x1016fc4
movzx ecx, bl
xor ecx, eax
lea eax, [ecx + ecx]
movzx ecx, byte [ebp - 0x20]
xor eax, ecx
jmp 0x1016fe1
mov ecx, eax
lea eax, [ecx + ecx]
movzx ecx, byte [ebp - 0x20]
xor eax, ecx
jmp 0x1016fe1
test dl, dl
je 0x1016fdc
movzx ecx, bl
xor ecx, eax
jmp 0x1016fde
mov ecx, eax
lea eax, [ecx + ecx]
mov edi, dword [ebp - 0x78]
mov edx, esi
shr edx, 8
mov ebx, 1
xor dl, al
cmp dword [ebp - 0x24], ebx
mov byte [edi], dl
mov dword [ebp - 0x48], ebx
jbe 0x1017100
mov al, byte [ebx + edi]
xor byte [ebp - 0x15], al
test bl, 1
je 0x1017088
mov cl, al
and cl, 0x80
movzx eax, al
mov byte [ebp - 0x41], cl
lea ecx, [eax + eax]
je 0x1017021
movzx eax, byte [ebp - 0x1b]
xor eax, ecx
jmp 0x1017023
mov eax, ecx
movzx edx, byte [ebx + edi - 1]
xor eax, edx
test al, al
jns 0x1017062
cmp byte [ebp - 0x41], 0
je 0x101704d
movzx eax, byte [ebp - 0x1b]
xor eax, ecx
movzx ecx, byte [ebp - 0x1e]
xor eax, edx
add eax, eax
xor eax, ecx
movzx ecx, byte [ebp - 0x1d]
jmp 0x10170e9
mov eax, ecx
movzx ecx, byte [ebp - 0x1e]
xor eax, edx
add eax, eax
xor eax, ecx
movzx ecx, byte [ebp - 0x1d]
jmp 0x10170e9
cmp byte [ebp - 0x41], 0
je 0x101707a
movzx eax, byte [ebp - 0x1b]
xor eax, ecx
movzx ecx, byte [ebp - 0x1d]
xor edx, eax
add edx, edx
mov eax, edx
jmp 0x10170e9
mov eax, ecx
movzx ecx, byte [ebp - 0x1d]
xor edx, eax
add edx, edx
mov eax, edx
jmp 0x10170e9
mov dl, al
and dl, 0x80
movzx eax, al
lea esi, [eax + eax]
je 0x101709d
movzx ecx, byte [ebp - 0x1c]
xor ecx, esi
jmp 0x101709f
mov ecx, esi
movzx eax, byte [ebx + edi - 1]
mov ebx, eax
xor ebx, ecx
test bl, bl
jns 0x10170d0
test dl, dl
je 0x10170c2
movzx ecx, byte [ebp - 0x1c]
movzx edx, byte [ebp - 0x20]
xor ecx, esi
xor eax, ecx
add eax, eax
xor eax, edx
jmp 0x10170e2
movzx edx, byte [ebp - 0x20]
mov ecx, esi
xor eax, ecx
add eax, eax
xor eax, edx
jmp 0x10170e2
test dl, dl
je 0x10170dc
movzx ecx, byte [ebp - 0x1c]
xor ecx, esi
jmp 0x10170de
mov ecx, esi
xor eax, ecx
add eax, eax
movzx ecx, byte [ebp - 0x1f]
mov ebx, dword [ebp - 0x48]
mov edi, dword [ebp - 0x78]
xor ecx, eax
mov byte [ebx + edi], cl
add ebx, 1
cmp ebx, dword [ebp - 0x24]
mov dword [ebp - 0x48], ebx
jb 0x1016ffe
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x90]
or dword [eax + ecx*8 + 4], 0x80000000
lea eax, [eax + ecx*8 + 4]
mov eax, dword [ebp - 0x40]
mov edi, ecx
mov ecx, dword [ebp - 0x90]
xor ebx, ebx
add edi, 1
cmp edi, dword [ebp - 0x8c]
mov dword [ebp - 0x4c], edi
jb 0x1016b40
jmp 0x1017139
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x30], ebx
je 0x1017154
mov ecx, dword [ebp - 0x38]
lea edx, [ebp - 0x38]
push edx
mov edx, dword [ebp - 0x3c]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x30], ebx
cmp dword [ebp - 0x34], ebx
je 0x1017167
push 0x103a2f0
mov dword [ebp - 0x34], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 0x88]
mov cl, byte [ebp - 0x15]
mov byte [eax + 6], cl
mov edx, dword [ebp - 0x80]
push edx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x84]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.010052b2
mov esp, ebp
pop ebp
ret