Function at 0x1011ace
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x1050d74]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ecx + 4]
push ebx
mov ebx, dword [eax]
movzx eax, byte [eax + 4]
mov dword [ebp - 0x12c], ecx
lea ecx, [eax*8]
push esi
sub ecx, eax
and ebx, 0xfffffff
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea edx, [ecx*4 + 0x104eee8]
add ebx, 0x1000000
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x48], edx
call edi
mov esi, eax
mov eax, dword [ebp - 0x48]
add eax, 4
push eax
mov dword [ebp - 0x128], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetLastError]
call esi
mov eax, dword [ebp - 0x48]
cmp dword [eax], 0
mov dword [ebp - 0xa8], 0
jne 0x1012552
xor eax, eax
lea ecx, [ebp - 0x124]
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], eax
call ebx
cmp dword [ebp - 0x120], 0
mov dword [ebp - 0x4c], 0
jbe 0x10124da
mov dword [ebp - 0x58], 0
mov ecx, dword [ebp - 0x124]
mov eax, dword [ebp - 0x58]
mov ebx, dword [eax + ecx + 4]
mov eax, dword [eax + ecx]
mov ecx, dword [ebp - 0x8c]
and ebx, 0xfffffff
add ebx, 0x1000000
and eax, 0xfffffff
cmp ebx, ecx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x74], eax
jb 0x1011bd3
mov edx, dword [ebp - 0x88]
add eax, ebx
add ecx, edx
cmp eax, ecx
jbe 0x1011cbf
call edi
cmp dword [ebp - 0x7c], 0
mov dword [ebp - 0x2c], eax
je 0x1011c07
mov ecx, dword [ebp - 0x84]
mov edx, dword [ebp - 0x88]
lea eax, [ebp - 0x84]
push eax
mov eax, dword [ebp - 0x8c]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x7c], 0
cmp dword [ebp - 0x80], 0
je 0x1011c2a
mov dword [ebp - 0x80], 0
call edi
push 0x104eba4
mov dword [ebp - 0x30], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0x30]
push ecx
call esi
mov edx, dword [ebp - 0x2c]
xor eax, eax
push edx
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x84], eax
call esi
mov ecx, dword [ebp - 0x74]
lea edx, [ecx + ebx + 0xfff]
mov eax, ebx
and eax, 0xfffff000
and edx, 0xfffff000
sub edx, eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], edx
call edi
mov dword [ebp - 0x30], eax
call edi
push 0x104eba4
mov edi, eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push edi
call esi
mov ecx, dword [ebp - 0x88]
mov edx, dword [ebp - 0x8c]
lea eax, [ebp - 0x84]
push eax
push 0x40
push ecx
push edx
mov dword [ebp - 0x80], 1
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edi, eax
test edi, edi
je 0x1011cb1
mov dword [ebp - 0x7c], 1
mov eax, dword [ebp - 0x30]
push eax
call esi
test edi, edi
je 0x10124c4
test ebx, ebx
je 0x10124c4
mov ecx, dword [ebp - 0x58]
mov edx, dword [ebp - 0x124]
test dword [ecx + edx], 0x10000000
mov byte [ebp - 0x25], 0xa5
je 0x101249a
mov eax, ecx
mov ecx, edx
mov ecx, dword [eax + ecx + 4]
mov eax, dword [ebp - 0x11c]
and ecx, 0xfffffff
test byte [eax + 0x10], 3
mov dword [ebp - 0x130], ecx
jne 0x1012000
mov edx, dword [0x1002900]
mov dword [ebp - 0x10c], ecx
mov dword [ebp - 0x108], ecx
mov edi, dword [eax + 0x10]
mov ecx, dword [eax]
mov esi, dword [eax + 4]
shr edi, 2
and ecx, 0xfffffff
shr esi, 8
and edi, 0xfffffff
add ecx, 0x1000000
mov eax, 0x1000000
and esi, 0x7f
sub eax, edx
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x70], eax
jne 0x1011dba
mov eax, 0x8421085
mul esi
mov eax, esi
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 6
imul eax, eax, 0x7c
sub esi, eax
lea edx, [ebp - 0xe8]
push edx
mov edx, dword [esi*4 + 0x1038b60]
lea eax, [ecx + edi]
push eax
push ecx
lea ecx, [ebp - 0x10c]
push ecx
mov byte [ebp - 0xe8], 0
mov byte [ebp - 0xe7], 1
mov byte [ebp - 0xe6], 2
mov byte [ebp - 0xe5], 3
mov byte [ebp - 0xe4], 4
mov byte [ebp - 0xe3], 5
call edx
mov ebx, dword [ebp - 0x10c]
mov edi, dword [ebp - 0x108]
jmp 0x1012006
mov edx, dword [0x100003c]
mov eax, ecx
sub eax, 0x1000000
mov ecx, eax
mov ebx, eax
add eax, edi
mov edi, eax
and edi, 0xfffff000
sub eax, edi
mov dword [ebp - 0xfc], edi
mov edi, dword [edx + 0x10000a0]
mov dword [ebp - 0xf8], eax
mov eax, dword [edx + 0x10000a4]
add edi, 0x1000000
and ecx, 0xfffff000
add eax, edi
sub ebx, ecx
cmp edi, eax
mov dword [ebp - 0xf4], eax
je 0x1011e14
cmp dword [edi], ecx
jae 0x1011e14
add edi, dword [edi + 4]
cmp edi, eax
jne 0x1011e09
xor edx, edx
cmp edi, eax
je 0x1011e42
cmp dword [edi], ecx
jne 0x1011e42
mov ecx, dword [edi + 4]
sub ecx, 8
shr ecx, 1
mov dword [ebp - 0x44], ecx
je 0x1011e42
movzx ecx, word [edi + edx*2 + 8]
and ecx, 0xfff
cmp ecx, ebx
jae 0x1011e42
add edx, 1
cmp edx, dword [ebp - 0x44]
jne 0x1011e2b
mov ecx, dword [ebp - 0x30]
jmp 0x1011e4d
mov eax, dword [ebp - 0xf4]
cmp edi, eax
je 0x1011f90
mov ebx, dword [edi]
cmp ebx, dword [ebp - 0xfc]
ja 0x1011f90
lea esp, [esp]
mov ebx, dword [edi + 4]
add ebx, 0xfffffff8
shr ebx, 1
cmp edx, ebx
jne 0x1011e8f
add edi, dword [edi + 4]
cmp edi, eax
je 0x1011f90
mov edx, dword [ebp - 0xfc]
cmp dword [edi], edx
ja 0x1011f90
xor edx, edx
jmp 0x1011e66
mov ebx, dword [edi]
cmp ebx, dword [ebp - 0xfc]
jne 0x1011eaf
movzx eax, word [edi + edx*2 + 8]
and eax, 0xfff
cmp eax, dword [ebp - 0xf8]
jae 0x1011f90
mov eax, edx
movzx eax, word [edi + eax*2 + 8]
add edx, 1
test eax, 0xf000
mov dword [ebp - 0xec], edx
je 0x1011e47
and eax, 0xfff
lea ebx, [eax + ebx + 0x1000000]
mov eax, 0x8421085
mul esi
mov eax, esi
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 6
imul eax, eax, 0x7c
mov edx, esi
sub edx, eax
lea eax, [edx*4 + 0x1038b60]
lea edx, [ebp - 0xb0]
push edx
mov edx, dword [eax]
push ebx
push ecx
lea ecx, [ebp - 0x10c]
push ecx
mov byte [ebp - 0xb0], 0
mov byte [ebp - 0xaf], 1
mov byte [ebp - 0xae], 2
mov byte [ebp - 0xad], 3
mov byte [ebp - 0xac], 4
mov byte [ebp - 0xab], 5
mov dword [ebp - 0x44], eax
call edx
mov eax, dword [ebx]
sub eax, dword [ebp - 0x70]
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0xe0]
push eax
push ecx
mov ecx, dword [ebp - 0x44]
lea edx, [ebp - 0x14]
push edx
mov edx, dword [ecx]
lea eax, [ebp - 0x10c]
push eax
mov byte [ebp - 0xe0], 0
mov byte [ebp - 0xdf], 1
mov byte [ebp - 0xde], 2
mov byte [ebp - 0xdd], 3
mov byte [ebp - 0xdc], 4
mov byte [ebp - 0xdb], 5
call edx
mov edx, dword [ebp - 0xec]
lea ecx, [ebx + 4]
jmp 0x1011e47
mov eax, 0x8421085
mul esi
mov eax, esi
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 6
imul eax, eax, 0x7c
sub esi, eax
mov eax, dword [ebp - 0x30]
lea edx, [ebp - 0xc0]
push edx
mov edx, dword [ebp - 0x2c]
add eax, edx
push eax
push ecx
mov ecx, dword [esi*4 + 0x1038b60]
lea eax, [ebp - 0x10c]
push eax
mov byte [ebp - 0xc0], 0
mov byte [ebp - 0xbf], 1
mov byte [ebp - 0xbe], 2
mov byte [ebp - 0xbd], 3
mov byte [ebp - 0xbc], 4
mov byte [ebp - 0xbb], 5
call ecx
mov ebx, dword [ebp - 0x10c]
mov edi, dword [ebp - 0x108]
jmp 0x1012006
mov ebx, dword [eax + 8]
mov edi, dword [eax + 0xc]
mov eax, dword [ebp - 0x74]
mov esi, dword [ebp - 0x6c]
and eax, 7
mov dword [ebp - 0x64], edi
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x30], eax
je 0x10123f9
xor edx, edx
cmp eax, edx
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x5c], edx
mov dword [ebp - 0x60], edx
jle 0x1012068
mov ecx, 0x38
mov dword [ebp - 0x2c], ecx
cmp edx, 4
movzx edx, byte [esi]
jge 0x101204a
add ecx, 0xffffffe0
shl edx, cl
or dword [ebp - 0x5c], edx
jmp 0x101204f
shl edx, cl
or dword [ebp - 0x50], edx
mov edx, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x2c]
add edx, 1
sub ecx, 8
add esi, 1
cmp edx, eax
mov dword [ebp - 0x60], edx
mov dword [ebp - 0x2c], ecx
jl 0x1012038
mov eax, ebx
mov ecx, ebx
movzx ebx, word [ebp - 0x62]
mov dword [ebp - 0x60], ebx
xor eax, edi
mov edx, edi
xor edx, eax
sub ecx, edx
xor ecx, dword [ebp - 0x130]
movzx edx, di
mov ebx, ecx
ror ebx, 1
xor ebx, edx
imul ebx, dword [ebp - 0x60]
xor eax, ebx
mov dword [ebp - 0x38], edx
movzx edx, word [ebp - 0x66]
mov ebx, edi
xor ebx, eax
ror ebx, 1
imul ebx, edx
mov edx, eax
ror edx, 1
xor ebx, edx
xor ecx, ebx
movzx edx, word [ebp - 0x68]
mov dword [ebp - 0x44], ecx
mov ebx, edi
xor ebx, ecx
ror ebx, 1
imul ebx, edx
ror ecx, 1
sub ebx, ecx
mov ecx, dword [ebp - 0x60]
xor eax, ebx
xor edx, eax
imul edx, ecx
mov ebx, eax
ror ebx, 1
add ebx, edx
mov edx, dword [ebp - 0x44]
xor edx, ebx
xor ecx, edx
imul ecx, dword [ebp - 0x38]
mov ebx, edx
shr ebx, 1
add ecx, ebx
xor eax, ecx
movzx ecx, word [ebp - 0x66]
mov ebx, eax
sub ebx, edi
ror ebx, 1
imul ebx, ecx
mov dword [ebp - 0x3c], ecx
mov ecx, eax
ror ecx, 1
add ebx, ecx
movzx ecx, word [ebp - 0x68]
xor edx, ebx
mov ebx, edi
sub ebx, edx
ror ebx, 1
imul ebx, ecx
mov dword [ebp - 0x70], ecx
mov ecx, edx
ror ecx, 1
xor ebx, ecx
mov ecx, dword [ebp - 0x38]
xor eax, ebx
mov ebx, eax
ror ebx, 2
sub ebx, dword [ebp - 0x60]
imul ebx, ecx
xor edx, ebx
mov ebx, edx
sub ebx, ecx
xor ebx, dword [ebp - 0x68]
xor eax, ebx
xor ecx, eax
imul ecx, dword [ebp - 0x3c]
mov ebx, eax
shr ebx, 1
xor ecx, ebx
xor edx, ecx
mov ecx, edi
sub ecx, edx
ror ecx, 0xe
imul ecx, dword [ebp - 0x70]
mov ebx, edx
xor edx, dword [ebp - 0x50]
ror ebx, 0x1b
add ecx, ebx
xor ecx, dword [ebp - 0x5c]
mov ebx, dword [ebp - 0x30]
xor eax, ecx
xor ecx, ecx
test ebx, ebx
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x60], ecx
jle 0x10121a5
nop
cmp ecx, 4
mov ebx, dword [ebp - 0x54]
jge 0x1012181
mov ecx, dword [ebp - 0xa4]
rol ecx, 8
mov dword [ebp - 0xa4], ecx
mov byte [ebx], cl
jmp 0x101218c
mov ecx, dword [ebp - 0x2c]
rol ecx, 8
mov dword [ebp - 0x2c], ecx
mov byte [ebx], cl
xor byte [ebp - 0x25], cl
mov ecx, dword [ebp - 0x60]
add ebx, 1
mov dword [ebp - 0x54], ebx
mov ebx, dword [ebp - 0x30]
add ecx, 1
cmp ecx, ebx
mov dword [ebp - 0x60], ecx
jl 0x1012166
add ebx, 0xfffffffc
test ebx, ebx
jle 0x10123dc
mov ecx, 4
sub ecx, ebx
add ecx, ecx
add ecx, ecx
add ecx, ecx
shr edx, cl
shl edx, cl
mov ebx, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x74]
shr ecx, 3
mov dword [ebp - 0x30], ecx
je 0x1012389
mov ecx, ebx
xor ecx, edi
mov dword [ebp - 0x78], ecx
movzx ecx, word [ebp - 0x62]
mov dword [ebp - 0x60], ecx
movzx ecx, di
mov dword [ebp - 0x38], ecx
movzx ecx, word [ebp - 0x66]
mov dword [ebp - 0x3c], ecx
movzx ecx, bx
mov dword [ebp - 0x70], ecx
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x30], ecx
xor ecx, ecx
mov ch, byte [esi]
movzx ebx, byte [esi + 2]
add esi, 8
mov cl, byte [esi - 7]
shl ecx, 8
or ecx, ebx
shl ecx, 8
movzx ebx, byte [esi - 5]
or ecx, ebx
mov dword [ebp - 0xa4], ecx
xor ecx, ecx
mov ch, byte [esi - 4]
movzx ebx, byte [esi - 2]
mov cl, byte [esi - 3]
shl ecx, 8
or ecx, ebx
movzx ebx, byte [esi - 1]
shl ecx, 8
or ecx, ebx
xor edx, ecx
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0x78]
xor ecx, dword [ebp - 0xa4]
mov ebx, dword [ebp - 0x68]
xor ecx, edx
xor eax, ecx
mov ecx, edi
xor ecx, eax
sub ebx, ecx
xor edx, ebx
mov ecx, edx
ror ecx, 1
xor ecx, dword [ebp - 0x38]
imul ecx, dword [ebp - 0x60]
xor eax, ecx
mov ecx, edi
xor ecx, eax
ror ecx, 1
imul ecx, dword [ebp - 0x3c]
mov ebx, eax
ror ebx, 1
xor ecx, ebx
xor edx, ecx
mov ecx, dword [ebp - 0x70]
xor edi, edx
ror edi, 1
imul edi, ecx
mov ebx, edx
ror ebx, 1
sub edi, ebx
mov ebx, ecx
mov ecx, dword [ebp - 0x60]
xor eax, edi
xor ebx, eax
imul ebx, ecx
mov edi, eax
ror edi, 1
add edi, ebx
xor edx, edi
mov edi, dword [ebp - 0x64]
mov ebx, ecx
xor ebx, edx
movzx ecx, di
imul ebx, ecx
mov dword [ebp - 0x38], ecx
mov ecx, edx
shr ecx, 1
add ebx, ecx
xor eax, ebx
mov ecx, eax
sub ecx, edi
ror ecx, 1
imul ecx, dword [ebp - 0x3c]
mov ebx, eax
ror ebx, 1
add ecx, ebx
xor edx, ecx
mov ebx, edi
sub ebx, edx
ror ebx, 1
movzx ecx, word [ebp - 0x68]
imul ebx, ecx
mov dword [ebp - 0x70], ecx
mov ecx, edx
ror ecx, 1
xor ebx, ecx
xor eax, ebx
mov ecx, dword [ebp - 0x38]
mov ebx, eax
ror ebx, 2
sub ebx, dword [ebp - 0x60]
imul ebx, ecx
xor edx, ebx
mov ebx, edx
sub ebx, ecx
xor ebx, dword [ebp - 0x68]
xor eax, ebx
xor ecx, eax
imul ecx, dword [ebp - 0x3c]
mov ebx, eax
shr ebx, 1
xor ecx, ebx
xor edx, ecx
mov ecx, edi
sub ecx, edx
ror ecx, 0xe
imul ecx, dword [ebp - 0x70]
mov ebx, edx
xor edx, dword [ebp - 0x50]
ror ebx, 0x1b
add ecx, ebx
xor ecx, dword [ebp - 0x5c]
mov bl, byte [ebp - 0x25]
xor eax, ecx
mov ecx, dword [ebp - 0x54]
xor bl, al
xor bl, dl
mov byte [ecx + 3], al
mov byte [ecx + 7], dl
ror eax, 8
xor bl, al
ror edx, 8
xor bl, dl
mov byte [ecx + 2], al
mov byte [ecx + 6], dl
ror eax, 8
ror edx, 8
xor bl, al
xor bl, dl
mov byte [ecx + 1], al
mov byte [ecx + 5], dl
ror eax, 8
mov dword [ebp - 0x44], edx
ror edx, 8
mov byte [ecx], al
mov byte [ecx + 4], dl
mov dword [ebp - 0x44], edx
xor dl, al
xor bl, dl
mov edx, dword [ebp - 0x44]
mov byte [ebp - 0x25], bl
mov ebx, dword [ebp - 0xa4]
ror eax, 8
mov dword [ebp - 0x5c], ebx
mov ebx, dword [ebp - 0x2c]
add ecx, 8
ror edx, 8
sub dword [ebp - 0x30], 1
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x54], ecx
jne 0x10121fa
mov edx, dword [0x1002900]
mov ebx, dword [ebp - 0x6c]
mov eax, 0x1000000
sub eax, edx
mov dword [ebp - 0x6c], eax
je 0x1012475
mov eax, dword [ebp - 0x74]
mov esi, dword [0x101d0a8]
sub ebx, 0x1000000
lea ecx, [eax + ebx]
xor edi, edi
add esi, 0xffffffff
mov dword [ebp - 0x78], ecx
js 0x101241b
lea eax, [esi + edi]
cdq
sub eax, edx
sar eax, 1
mov ecx, dword [eax*4 + 0x101d0ac]
and ecx, 0xfffffff
cmp ebx, ecx
jae 0x101240e
lea esi, [eax - 1]
jmp 0x1012413
xor edx, edx
test ebx, ebx
jge 0x10121c1
neg ebx
add ebx, ebx
add ebx, ebx
add ebx, ebx
mov ecx, ebx
shr eax, cl
shl eax, cl
jmp 0x10121c1
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x50], eax
xor edx, edx
xor eax, eax
jmp 0x10121c4
jbe 0x1012419
lea edi, [eax + 1]
cmp esi, edi
jge 0x10123be
jmp 0x101241b
mov edi, eax
cmp edi, dword [0x101d0a8]
jae 0x1012475
mov ebx, dword [ebp - 0x78]
mov eax, dword [edi*4 + 0x101d0ac]
mov esi, eax
and esi, 0xfffffff
cmp esi, ebx
jae 0x1012475
mov ecx, eax
add eax, eax
add eax, eax
sar eax, 0x1e
sar ecx, 0x1e
and eax, 3
and ecx, 3
xor edx, edx
sub eax, 1
je 0x101245c
sub eax, 1
je 0x10124c0
sub eax, 1
jne 0x101245f
mov edx, dword [ebp - 0x6c]
sub ecx, 2
jne 0x101246a
add dword [esi + 0x1000000], edx
add edi, 1
cmp edi, dword [0x101d0a8]
jb 0x1012426
mov eax, dword [ebp - 0x124]
mov ecx, dword [ebp - 0x58]
and dword [ecx + eax], 0xefffffff
mov edx, dword [ebp - 0x124]
add ecx, edx
push ecx
lea ecx, [ebp - 0x25]
call fcn.01013435
test eax, eax
je 0x10124d0
mov eax, dword [ebp - 0x4c]
add dword [ebp - 0x58], 0xc
add eax, 1
cmp eax, dword [ebp - 0x120]
mov dword [ebp - 0x4c], eax
jae 0x10124da
mov esi, dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1011b90
xor edx, edx
jmp 0x101245f
mov dword [ebp - 0xa8], 0x8007000e
jmp 0x10124da
mov dword [ebp - 0xa8], 0x80004005
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
xor esi, esi
cmp dword [ebp - 0x7c], esi
mov ebx, eax
je 0x1012510
mov ecx, dword [ebp - 0x84]
mov edx, dword [ebp - 0x88]
lea eax, [ebp - 0x84]
push eax
mov eax, dword [ebp - 0x8c]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x7c], esi
cmp dword [ebp - 0x80], esi
je 0x1012532
mov dword [ebp - 0x80], esi
call edi
push 0x104eba4
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetLastError]
call esi
jmp 0x1012538
mov esi, dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
push ebx
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x84], eax
call esi
mov ebx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x48]
add dword [eax], 1
cmp dword [ebp - 0xa8], 0
jge 0x1012f4b
add dword [eax], 0xffffffff
jne 0x1012f4b
xor eax, eax
lea ecx, [ebp - 0x118]
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x90], eax
call ebx
cmp dword [ebp - 0x114], 0
mov dword [ebp - 0x70], 0
jbe 0x1012ed8
mov edx, dword [ebp - 0x118]
mov dword [ebp - 0x5c], 0
mov ecx, dword [ebp - 0x5c]
mov eax, dword [edx + ecx + 4]
mov ecx, dword [edx + ecx]
mov edx, dword [ebp - 0xa0]
and eax, 0xfffffff
add eax, 0x1000000
and ecx, 0xfffffff
cmp eax, edx
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x74], ecx
jb 0x10125f3
mov ebx, dword [ebp - 0x9c]
add edx, ebx
add ecx, eax
cmp ecx, edx
jbe 0x10126f2
call edi
cmp dword [ebp - 0x90], 0
mov ebx, eax
je 0x101262c
mov edx, dword [ebp - 0x98]
mov eax, dword [ebp - 0x9c]
lea ecx, [ebp - 0x98]
push ecx
mov ecx, dword [ebp - 0xa0]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x90], 0
cmp dword [ebp - 0x94], 0
je 0x1012655
mov dword [ebp - 0x94], 0
call edi
push 0x104eba4
mov dword [ebp - 0x34], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edx, dword [ebp - 0x34]
push edx
call esi
xor eax, eax
push ebx
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], eax
call esi
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x74]
mov ebx, dword [ebp - 0x48]
push 0x1000
add eax, ecx
and ebx, 0xfffff000
push eax
mov dword [ebp - 0xa0], ebx
call fcn.0103139f
sub eax, ebx
mov dword [ebp - 0x9c], eax
call edi
mov dword [ebp - 0x34], eax
call edi
push 0x104eba4
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push ebx
call esi
mov eax, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0xa0]
lea edx, [ebp - 0x98]
push edx
push 0x40
push eax
push ecx
mov dword [ebp - 0x94], 1
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ebx, eax
test ebx, ebx
je 0x10126e4
mov dword [ebp - 0x90], 1
mov edx, dword [ebp - 0x34]
push edx
call esi
test ebx, ebx
je 0x1012ed8
mov ecx, dword [ebp - 0x48]
test ecx, ecx
mov edx, dword [ebp - 0x118]
je 0x1012ed8
mov eax, dword [ebp - 0x5c]
test dword [eax + edx], 0x10000000
mov byte [ebp - 0x26], 0xa5
jne 0x1012ebf
mov edx, dword [edx + eax + 4]
mov eax, dword [0x1002900]
mov ebx, dword [ebp - 0x110]
and edx, 0xfffffff
sub eax, 0x1000000
mov dword [ebp - 0x64], edx
mov dword [ebp - 0x4c], eax
je 0x10127e0
mov eax, dword [ebp - 0x74]
mov esi, dword [0x101d0a8]
sub ecx, 0x1000000
lea edx, [ecx + eax]
xor edi, edi
add esi, 0xffffffff
mov dword [ebp - 0x34], edx
js 0x1012784
lea eax, [esi + edi]
cdq
sub eax, edx
sar eax, 1
mov edx, dword [eax*4 + 0x101d0ac]
and edx, 0xfffffff
cmp ecx, edx
jae 0x1012777
lea esi, [eax - 1]
jmp 0x101277c
jbe 0x1012782
lea edi, [eax + 1]
cmp esi, edi
jge 0x1012759
jmp 0x1012784
mov edi, eax
cmp edi, dword [0x101d0a8]
jae 0x10127e0
mov eax, dword [edi*4 + 0x101d0ac]
mov esi, eax
and esi, 0xfffffff
cmp esi, dword [ebp - 0x34]
jae 0x10127e0
mov ecx, eax
add eax, eax
add eax, eax
sar eax, 0x1e
sar ecx, 0x1e
and eax, 3
and ecx, 3
xor edx, edx
sub eax, 1
je 0x10127c7
sub eax, 1
je 0x10128a5
sub eax, 1
jne 0x10127ca
mov edx, dword [ebp - 0x4c]
sub ecx, 2
jne 0x10127d5
add dword [esi + 0x1000000], edx
add edi, 1
cmp edi, dword [0x101d0a8]
jb 0x101278c
test byte [ebx + 0x10], 3
jne 0x1012af5
mov eax, dword [ebp - 0x64]
mov edx, dword [0x1002900]
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x100], eax
mov esi, dword [ebx + 0x10]
mov ecx, dword [ebx]
mov edi, dword [ebx + 4]
shr esi, 2
and ecx, 0xfffffff
shr edi, 8
and esi, 0xfffffff
add ecx, 0x1000000
mov eax, 0x1000000
and edi, 0x7f
sub eax, edx
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x78], eax
jne 0x10128ac
mov eax, 0x8421085
mul edi
mov eax, edi
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 6
imul eax, eax, 0x7c
sub edi, eax
lea edx, [ebp - 0xd8]
push edx
mov edx, dword [edi*4 + 0x1038b60]
lea eax, [ecx + esi]
push eax
push ecx
lea ecx, [ebp - 0x104]
push ecx
mov byte [ebp - 0xd8], 0
mov byte [ebp - 0xd7], 1
mov byte [ebp - 0xd6], 2
mov byte [ebp - 0xd5], 3
mov byte [ebp - 0xd4], 4
mov byte [ebp - 0xd3], 5
call edx
mov edx, dword [ebp - 0x104]
mov edi, dword [ebp - 0x100]
mov dword [ebp - 0x40], edx
jmp 0x1012afe
xor edx, edx
jmp 0x10127ca
mov edx, dword [0x100003c]
mov eax, ecx
sub eax, 0x1000000
mov ecx, eax
mov ebx, eax
add eax, esi
mov esi, eax
and esi, 0xfffff000
sub eax, esi
mov dword [ebp - 0xfc], esi
mov esi, dword [edx + 0x10000a0]
mov dword [ebp - 0xf8], eax
mov eax, dword [edx + 0x10000a4]
add esi, 0x1000000
and ecx, 0xfffff000
add eax, esi
sub ebx, ecx
cmp esi, eax
mov dword [ebp - 0xf4], eax
je 0x1012906
cmp dword [esi], ecx
jae 0x1012906
add esi, dword [esi + 4]
cmp esi, eax
jne 0x10128fb
xor edx, edx
cmp esi, eax
je 0x1012934
cmp dword [esi], ecx
jne 0x1012934
mov ecx, dword [esi + 4]
sub ecx, 8
shr ecx, 1
mov dword [ebp - 0x34], ecx
je 0x1012934
movzx ecx, word [esi + edx*2 + 8]
and ecx, 0xfff
cmp ecx, ebx
jae 0x1012934
add edx, 1
cmp edx, dword [ebp - 0x34]
jne 0x101291d
mov ecx, dword [ebp - 0x6c]
jmp 0x101293f
mov eax, dword [ebp - 0xf4]
cmp esi, eax
je 0x1012a82
mov ebx, dword [esi]
cmp ebx, dword [ebp - 0xfc]
ja 0x1012a82
lea esp, [esp]
mov ebx, dword [esi + 4]
add ebx, 0xfffffff8
shr ebx, 1
cmp edx, ebx
jne 0x1012981
add esi, dword [esi + 4]
cmp esi, eax
je 0x1012a82
mov edx, dword [ebp - 0xfc]
cmp dword [esi], edx
ja 0x1012a82
xor edx, edx
jmp 0x1012958
mov ebx, dword [esi]
cmp ebx, dword [ebp - 0xfc]
jne 0x10129a1
movzx eax, word [esi + edx*2 + 8]
and eax, 0xfff
cmp eax, dword [ebp - 0xf8]
jae 0x1012a82
mov eax, edx
movzx eax, word [esi + eax*2 + 8]
add edx, 1
test eax, 0xf000
mov dword [ebp - 0xec], edx
je 0x1012939
and eax, 0xfff
lea ebx, [eax + ebx + 0x1000000]
mov eax, 0x8421085
mul edi
mov eax, edi
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 6
imul eax, eax, 0x7c
mov edx, edi
sub edx, eax
lea eax, [edx*4 + 0x1038b60]
lea edx, [ebp - 0xc8]
push edx
mov edx, dword [eax]
push ebx
push ecx
lea ecx, [ebp - 0x104]
push ecx
mov byte [ebp - 0xc8], 0
mov byte [ebp - 0xc7], 1
mov byte [ebp - 0xc6], 2
mov byte [ebp - 0xc5], 3
mov byte [ebp - 0xc4], 4
mov byte [ebp - 0xc3], 5
mov dword [ebp - 0x34], eax
call edx
mov eax, dword [ebx]
sub eax, dword [ebp - 0x78]
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0xd0]
push eax
push ecx
mov ecx, dword [ebp - 0x34]
lea edx, [ebp - 0x24]
push edx
mov edx, dword [ecx]
lea eax, [ebp - 0x104]
push eax
mov byte [ebp - 0xd0], 0
mov byte [ebp - 0xcf], 1
mov byte [ebp - 0xce], 2
mov byte [ebp - 0xcd], 3
mov byte [ebp - 0xcc], 4
mov byte [ebp - 0xcb], 5
call edx
mov edx, dword [ebp - 0xec]
lea ecx, [ebx + 4]
jmp 0x1012939
mov eax, 0x8421085
mul edi
mov eax, edi
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 6
imul eax, eax, 0x7c
sub edi, eax
mov eax, dword [ebp - 0x6c]
lea edx, [ebp - 0xb8]
push edx
mov edx, dword [ebp - 0x4c]
add eax, edx
push eax
push ecx
mov ecx, dword [edi*4 + 0x1038b60]
lea eax, [ebp - 0x104]
push eax
mov byte [ebp - 0xb8], 0
mov byte [ebp - 0xb7], 1
mov byte [ebp - 0xb6], 2
mov byte [ebp - 0xb5], 3
mov byte [ebp - 0xb4], 4
mov byte [ebp - 0xb3], 5
call ecx
mov edx, dword [ebp - 0x104]
mov edi, dword [ebp - 0x100]
mov dword [ebp - 0x40], edx
jmp 0x1012afe
mov eax, dword [ebx + 8]
mov edi, dword [ebx + 0xc]
mov dword [ebp - 0x40], eax
mov ebx, dword [ebp - 0x74]
mov esi, dword [ebp - 0x48]
mov eax, dword [ebp - 0x64]
xor ecx, ecx
and ebx, 7
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x50], esi
mov edx, eax
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x4c], ebx
je 0x1012cce
xor eax, eax
cmp ebx, ecx
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x2c], eax
jle 0x1012b6e
lea edx, [ecx + 0x38]
lea ecx, [ecx]
cmp eax, 4
mov al, byte [esi]
jge 0x1012b4e
xor byte [ebp - 0x26], al
movzx eax, al
lea ecx, [edx - 0x20]
shl eax, cl
or dword [ebp - 0x58], eax
jmp 0x1012b5b
xor byte [ebp - 0x26], al
movzx eax, al
mov ecx, edx
shl eax, cl
or dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x2c]
add eax, 1
add esi, 1
sub edx, 8
cmp eax, ebx
mov dword [ebp - 0x2c], eax
jl 0x1012b37
mov edx, dword [ebp - 0x40]
movzx ebx, word [ebp - 0x3a]
mov ecx, edi
mov dword [ebp - 0x38], ebx
mov eax, edx
xor eax, edi
xor ecx, eax
sub edx, ecx
xor edx, dword [ebp - 0x64]
movzx ecx, di
mov ebx, edx
ror ebx, 1
xor ebx, ecx
imul ebx, dword [ebp - 0x38]
xor eax, ebx
mov ebx, edi
xor ebx, eax
ror ebx, 1
mov dword [ebp - 0x34], ecx
movzx ecx, word [ebp - 0x3e]
imul ebx, ecx
mov ecx, eax
ror ecx, 1
xor ebx, ecx
movzx ecx, word [ebp - 0x40]
xor edx, ebx
xor edi, edx
ror edi, 1
imul edi, ecx
mov ebx, edx
ror ebx, 1
sub edi, ebx
xor eax, edi
mov ebx, eax
xor ebx, ecx
movzx ecx, word [ebp - 0x3a]
imul ebx, ecx
mov edi, eax
ror edi, 1
add edi, ebx
xor edx, edi
mov edi, ecx
xor edi, edx
mov dword [ebp - 0x38], ecx
mov ecx, dword [ebp - 0x34]
imul edi, ecx
mov ebx, edx
shr ebx, 1
add edi, ebx
xor eax, edi
movzx edi, word [ebp - 0x3e]
mov ebx, eax
sub ebx, dword [ebp - 0x3c]
mov dword [ebp - 0x2c], edi
ror ebx, 1
imul ebx, edi
mov edi, eax
ror edi, 1
add ebx, edi
movzx edi, word [ebp - 0x40]
xor edx, ebx
mov ebx, dword [ebp - 0x3c]
sub ebx, edx
ror ebx, 1
imul ebx, edi
mov dword [ebp - 0x48], edi
mov edi, edx
ror edi, 1
xor ebx, edi
xor eax, ebx
mov edi, eax
ror edi, 2
sub edi, dword [ebp - 0x38]
imul edi, ecx
xor edx, edi
mov edi, edx
sub edi, ecx
xor edi, dword [ebp - 0x40]
xor eax, edi
xor ecx, eax
imul ecx, dword [ebp - 0x2c]
mov edi, eax
shr edi, 1
xor ecx, edi
mov edi, dword [ebp - 0x3c]
xor edx, ecx
mov ecx, edi
sub ecx, edx
ror ecx, 0xe
imul ecx, dword [ebp - 0x48]
mov ebx, edx
xor edx, dword [ebp - 0x54]
ror ebx, 0x1b
add ecx, ebx
xor ecx, dword [ebp - 0x58]
xor ebx, ebx
xor eax, ecx
mov ecx, dword [ebp - 0x4c]
test ecx, ecx
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], ebx
jle 0x1012ca0
cmp ebx, 4
mov ecx, dword [ebp - 0x50]
jge 0x1012c7f
mov ebx, dword [ebp - 0x44]
rol ebx, 8
mov dword [ebp - 0x44], ebx
jmp 0x1012c88
mov ebx, dword [ebp - 0x30]
rol ebx, 8
mov dword [ebp - 0x30], ebx
mov byte [ecx], bl
mov ebx, dword [ebp - 0x2c]
add ecx, 1
mov dword [ebp - 0x50], ecx
mov ecx, dword [ebp - 0x4c]
add ebx, 1
cmp ebx, ecx
mov dword [ebp - 0x2c], ebx
jl 0x1012c6c
lea ebx, [ecx - 4]
test ebx, ebx
jle 0x1012cba
mov ecx, 4
sub ecx, ebx
add ecx, ecx
add ecx, ecx
add ecx, ecx
shr edx, cl
shl edx, cl
jmp 0x1012cce
xor edx, edx
test ebx, ebx
jge 0x1012cce
neg ebx
add ebx, ebx
add ebx, ebx
add ebx, ebx
mov ecx, ebx
shr eax, cl
shl eax, cl
mov ebx, dword [ebp - 0x74]
shr ebx, 3
je 0x1012e8c
movzx ecx, word [ebp - 0x3e]
mov dword [ebp - 0x2c], ecx
movzx ecx, word [ebp - 0x3a]
mov dword [ebp - 0x38], ecx
mov ecx, dword [ebp - 0x40]
xor ecx, edi
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x4c], ebx
lea esp, [esp]
mov cl, byte [esi]
xor ebx, ebx
mov bh, cl
movzx ecx, byte [esi + 2]
add esi, 8
mov bl, byte [esi - 7]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [esi - 5]
shl ebx, 8
or ebx, ecx
mov cl, byte [esi - 4]
mov dword [ebp - 0x44], ebx
movzx ebx, byte [esi - 1]
mov byte [ebp - 0x25], bl
xor ebx, ebx
mov bh, cl
movzx ecx, byte [esi - 2]
mov bl, byte [esi - 3]
shl ebx, 8
or ebx, ecx
mov cl, byte [ebp - 0x25]
movzx edi, cl
xor cl, byte [esi - 2]
shl ebx, 8
xor cl, byte [esi - 3]
or edi, ebx
xor cl, byte [esi - 4]
xor edx, edi
xor cl, byte [esi - 5]
mov dword [ebp - 0x30], edi
xor cl, byte [esi - 6]
mov edi, dword [ebp - 0x3c]
xor cl, byte [esi - 7]
mov ebx, edi
xor cl, byte [esi - 8]
sub ebx, edx
mov byte [ebp - 0x25], cl
movzx ecx, cl
xor byte [ebp - 0x26], cl
movzx ecx, word [ebp - 0x40]
ror ebx, 0xe
imul ebx, ecx
mov dword [ebp - 0x48], ecx
mov ecx, edx
ror ecx, 0x1b
add ebx, ecx
xor ebx, dword [ebp - 0x44]
movzx ecx, di
xor eax, ebx
mov edi, ecx
xor edi, eax
imul edi, dword [ebp - 0x2c]
mov ebx, eax
shr ebx, 1
xor edi, ebx
xor edx, edi
mov edi, edx
sub edi, ecx
xor edi, dword [ebp - 0x40]
xor eax, edi
mov edi, eax
ror edi, 2
sub edi, dword [ebp - 0x38]
imul edi, ecx
xor edx, edi
mov edi, dword [ebp - 0x3c]
sub edi, edx
ror edi, 1
imul edi, dword [ebp - 0x48]
mov ebx, edx
ror ebx, 1
xor edi, ebx
xor eax, edi
mov edi, eax
sub edi, dword [ebp - 0x3c]
mov ebx, eax
ror edi, 1
imul edi, dword [ebp - 0x2c]
ror ebx, 1
add edi, ebx
xor edx, edi
mov edi, dword [ebp - 0x38]
xor edi, edx
imul edi, ecx
mov ecx, edx
shr ecx, 1
add edi, ecx
xor eax, edi
mov edi, eax
xor edi, dword [ebp - 0x48]
mov ecx, eax
imul edi, dword [ebp - 0x38]
ror ecx, 1
add ecx, edi
movzx edi, word [ebp - 0x40]
xor edx, ecx
mov ecx, dword [ebp - 0x3c]
mov ebx, ecx
xor ebx, edx
ror ebx, 1
imul ebx, edi
mov edi, edx
ror edi, 1
sub ebx, edi
xor eax, ebx
mov edi, ecx
xor edi, eax
ror edi, 1
imul edi, dword [ebp - 0x2c]
mov ebx, eax
ror ebx, 1
xor edi, ebx
xor edx, edi
movzx edi, cx
mov ebx, edx
ror ebx, 1
xor ebx, edi
imul ebx, dword [ebp - 0x38]
mov edi, dword [ebp - 0x40]
xor eax, ebx
xor ecx, eax
sub edi, ecx
mov ecx, dword [ebp - 0x34]
xor ecx, dword [ebp - 0x58]
xor edx, edi
mov edi, dword [ebp - 0x44]
xor ecx, edx
xor edx, dword [ebp - 0x54]
xor eax, ecx
mov ecx, dword [ebp - 0x50]
mov byte [ecx + 3], al
mov byte [ecx + 7], dl
ror eax, 8
ror edx, 8
mov byte [ecx + 2], al
mov byte [ecx + 6], dl
ror eax, 8
ror edx, 8
mov byte [ecx + 1], al
ror eax, 8
mov byte [ecx + 5], dl
ror edx, 8
mov byte [ecx], al
mov byte [ecx + 4], dl
ror eax, 8
mov dword [ebp - 0x58], edi
mov edi, dword [ebp - 0x30]
add ecx, 8
ror edx, 8
sub dword [ebp - 0x4c], 1
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x50], ecx
jne 0x1012cf6
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x118]
or dword [eax + ecx], 0x10000000
mov edx, dword [ebp - 0x118]
add edx, eax
push edx
lea ecx, [ebp - 0x26]
call fcn.010132ce
mov edx, dword [ebp - 0x118]
mov esi, dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [ebp - 0x70]
add dword [ebp - 0x5c], 0xc
add eax, 1
cmp eax, dword [ebp - 0x114]
mov dword [ebp - 0x70], eax
jb 0x10125b7
call edi
xor ebx, ebx
cmp dword [ebp - 0x90], ebx
mov dword [ebp - 0x78], eax
je 0x1012f0f
mov ecx, dword [ebp - 0x98]
mov edx, dword [ebp - 0x9c]
lea eax, [ebp - 0x98]
push eax
mov eax, dword [ebp - 0xa0]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x90], ebx
cmp dword [ebp - 0x94], ebx
je 0x1012f33
mov dword [ebp - 0x94], ebx
call edi
push 0x104eba4
mov dword [ebp - 0x34], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0x34]
push ecx
call esi
mov edx, dword [ebp - 0x78]
push edx
mov dword [ebp - 0xa0], ebx
mov dword [ebp - 0x9c], ebx
mov dword [ebp - 0x98], ebx
call esi
call edi
mov edi, eax
mov eax, dword [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push edi
call esi
mov eax, dword [ebp - 0x12c]
mov ecx, dword [ebp - 4]
add dword [eax + 4], 8
mov eax, dword [ebp - 0xa8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01035a40
mov esp, ebp
pop ebp
ret