Function at 0x1006de70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10082050
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x10091040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x8c], edi
mov dword [ebp - 0x44], 1
mov esi, dword [edi + 0x54]
mov edx, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test esi, esi
je 0x1006ded5
push 4
push esi
call edx
test eax, eax
jne 0x1006decf
lea ecx, [esi + 0xd0]
mov dl, 2
call fcn.10014ea0
mov edx, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
mov eax, dword [0x100933d4]
test eax, eax
je 0x1006df15
mov ecx, dword [edi + 0x68]
cmp ecx, 1
jne 0x1006deeb
mov eax, dword [eax + 0x44]
jmp 0x1006def3
cmp ecx, 2
jne 0x1006df15
mov eax, dword [eax + 0x48]
cmp eax, dword [edi + 0x64]
jae 0x1006df15
mov esi, dword [edi + 0x54]
test esi, esi
je 0x1006df15
push 4
push esi
call edx
test eax, eax
jne 0x1006df15
mov dl, 7
lea ecx, [esi + 0xd0]
call fcn.10014ea0
mov ecx, dword [edi + 0x60]
test ecx, ecx
jne 0x1006df20
xor eax, eax
jmp 0x1006df45
mov esi, dword [0x10088ac8]
mov eax, 0x10624dd3
mul ecx
mov ecx, 0xd78ae8
shr edx, 6
imul eax, edx, 0x3e8
push eax
call fcn.10014f70
mov ecx, eax
call esi
mov ecx, dword [edi + 0x60]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x4c], ecx
test eax, eax
je 0x1006e5fb
xorps xmm0, xmm0
mov dword [ebp - 0x2c], 0xf
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 4], 0
mov al, byte [eax + 4]
mov dword [ebp - 0x30], 0
mov byte [ebp - 0x40], 0
mov byte [ebp - 0x45], al
test ecx, ecx
je 0x1006e055
mov eax, 0x12e0be83
mul ecx
mov eax, ecx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 0x1d
mov dword [ebp - 0x58], eax
cmp eax, 4
jae 0x1006e055
cmp byte [ebp - 0x45], 0x2d
jae 0x1006e055
push 4
push 0xd78af0
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1006e055
movzx ecx, byte [ebp - 0x45]
mov eax, 0x10624dd3
mul dword [ebp - 0x4c]
mov eax, dword [ebp - 0x58]
mov ecx, dword [ecx*4 + 0xd78af0]
mov esi, dword [0x10088acc]
shr edx, 6
sub eax, edx
imul eax, eax, 0x3e8
add eax, dword [ebp - 0x4c]
push eax
call esi
mov esi, eax
mov dword [ebp - 0x50], esi
test esi, esi
je 0x1006e05c
cmp dword [esi + 0x48], 0
mov dword [ebp - 0x50], esi
je 0x1006e05c
push dword [edi + 0x60]
xor edx, edx
lea ecx, [ebp - 0x70]
push esi
call fcn.100082f0
add esp, 8
lea ecx, [ebp - 0x40]
push eax
call fcn.1000b490
mov ecx, dword [ebp - 0x5c]
cmp ecx, 0xf
jbe 0x1006e050
mov edx, dword [ebp - 0x70]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1006e046
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1006e046
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.1007d105
add esp, 8
mov dword [ebp - 0x50], esi
jmp 0x1006e0b1
xor esi, esi
mov dword [ebp - 0x50], esi
jmp 0x1006e05f
mov esi, dword [ebp - 0x50]
push dword [edi + 0x60]
mov edx, dword [ebp - 0x54]
lea ecx, [ebp - 0x70]
push 0
call fcn.100082f0
add esp, 8
lea ecx, [ebp - 0x40]
push eax
call fcn.1000b490
mov ecx, dword [ebp - 0x5c]
cmp ecx, 0xf
jbe 0x1006e0b1
mov edx, dword [ebp - 0x70]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1006e0a7
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1006e0a7
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.1007d105
add esp, 8
mov edx, dword [ebp - 0x54]
lea ecx, [ebp - 0x70]
push esi
call fcn.100086b0
add esp, 4
mov byte [ebp - 4], 1
mov edx, eax
mov ecx, dword [edi + 0x40]
call fcn.10014db0
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x5c]
cmp ecx, 0xf
jbe 0x1006e108
mov edx, dword [ebp - 0x70]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1006e0fe
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1006e0fe
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.1007d105
add esp, 8
mov eax, dword [edi + 0x68]
cmp eax, 1
jne 0x1006e2b9
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x88]
mov edx, dword [edi + 0x64]
call fcn.100107d0
mov edx, dword [ebp - 0x78]
mov esi, 3
mov eax, edx
mov dword [ebp - 0x44], 5
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x58], esi
cmp eax, esi
jle 0x1006e1b2
mov ecx, eax
sub ecx, esi
cmp edx, ecx
jb 0x1006ed4c
mov eax, dword [ebp - 0x74]
sub eax, edx
cmp eax, 1
jb 0x1006e189
cmp dword [ebp - 0x74], 0xf
lea eax, [edx + 1]
lea esi, [ebp - 0x88]
mov dword [ebp - 0x78], eax
cmova esi, dword [ebp - 0x88]
sub edx, ecx
add esi, ecx
inc edx
push edx
push esi
lea eax, [esi + 1]
push eax
call sub.VCRUNTIME140.dll_memmove
mov byte [esi], 0x2e
add esp, 0xc
mov esi, dword [ebp - 0x58]
jmp 0x1006e19c
push 0x2e
push ecx
push ecx
push dword [ebp - 0x44]
push ecx
lea ecx, [ebp - 0x88]
call fcn.10010530
mov eax, dword [ebp - 0x4c]
add esi, 4
inc eax
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x4c], eax
cmp eax, esi
jle 0x1006e1b2
mov edx, dword [ebp - 0x78]
jmp 0x1006e141
cmp dword [ebp - 0x74], 0xf
lea eax, [ebp - 0x88]
movaps xmm0, xmmword [0x1008a160]
cmova eax, dword [ebp - 0x88]
xor ecx, ecx
push eax
movups xmmword [ebp - 0x24], xmm0
mov byte [ebp - 0x14], 0
mov al, byte [ebp - 0x24]
xor byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0xf
jb 0x1006e1d5
sub esp, 0x18
mov byte [ebp - 0x14], 0
mov edx, esp
lea ecx, [ebp - 0x23]
xorps xmm0, xmm0
lea esi, [ecx + 1]
movups xmmword [edx], xmm0
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1006e205
sub ecx, esi
lea eax, [ebp - 0x23]
push ecx
push eax
mov ecx, edx
call fcn.100024a0
lea eax, [ebp - 0x70]
push eax
call fcn.10006910
add esp, 0x20
mov byte [ebp - 4], 3
mov edx, eax
mov ecx, dword [edi + 0x44]
call fcn.10014db0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x5c]
cmp ecx, 0xf
jbe 0x1006e268
mov edx, dword [ebp - 0x70]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1006e25e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1006e2b3
push ecx
push edx
call fcn.1007d105
add esp, 8
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x74]
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0xf
mov byte [ebp - 0x70], 0
cmp ecx, 0xf
jbe 0x1006e397
mov edx, dword [ebp - 0x88]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1006e38d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1006e38d
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
cmp eax, 2
jne 0x1006e397
mov edx, dword [edi + 0x64]
lea ecx, [ebp - 0x88]
push 0x2e
call fcn.1000fd80
add esp, 4
mov byte [ebp - 4], 4
cmp dword [eax + 0x14], 0xf
jbe 0x1006e2e1
mov eax, dword [eax]
movaps xmm0, xmmword [0x100899d0]
xor ecx, ecx
push eax
movups xmmword [ebp - 0x24], xmm0
mov byte [ebp - 0x14], 0
mov al, byte [ebp - 0x24]
xor byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0xf
jb 0x1006e2f3
sub esp, 0x18
mov byte [ebp - 0x14], 0
mov edx, esp
lea ecx, [ebp - 0x23]
xorps xmm0, xmm0
lea esi, [ecx + 1]
movups xmmword [edx], xmm0
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1006e323
sub ecx, esi
lea eax, [ebp - 0x23]
push ecx
push eax
mov ecx, edx
call fcn.100024a0
lea eax, [ebp - 0x70]
push eax
call fcn.10006910
add esp, 0x20
mov byte [ebp - 4], 5
mov edx, eax
mov ecx, dword [edi + 0x44]
call fcn.10014db0
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x5c]
cmp ecx, 0xf
jbe 0x1006e268
mov edx, dword [ebp - 0x70]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1006e25e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1006e2b3
jmp 0x1006e25e
push ecx
push edx
call fcn.1007d105
add esp, 8
mov edx, dword [edi + 0x6c]
lea ecx, [ebp - 0x88]
push 0x2e
call fcn.1000fd80
add esp, 4
mov byte [ebp - 4], 6
cmp dword [eax + 0x14], 0xf
jbe 0x1006e3b6
mov eax, dword [eax]
movaps xmm0, xmmword [0x10089a60]
xor ecx, ecx
push eax
movups xmmword [ebp - 0x24], xmm0
mov word [ebp - 0x14], 0x15
nop word [eax + eax]
mov al, byte [ebp - 0x24]
xor byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0x10
jb 0x1006e3d0
sub esp, 0x18
mov byte [ebp - 0x13], 0
mov edx, esp
lea ecx, [ebp - 0x23]
xorps xmm0, xmm0
lea esi, [ecx + 1]
movups xmmword [edx], xmm0
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1006e400
sub ecx, esi
lea eax, [ebp - 0x23]
push ecx
push eax
mov ecx, edx
call fcn.100024a0
lea eax, [ebp - 0x70]
push eax
call fcn.10006910
add esp, 0x20
mov byte [ebp - 4], 7
mov edx, eax
mov ecx, dword [edi + 0x48]
call fcn.10014db0
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x5c]
cmp ecx, 0xf
jbe 0x1006e467
mov edx, dword [ebp - 0x70]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1006e45d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1006e2b3
push ecx
push edx
call fcn.1007d105
add esp, 8
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x74]
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0xf
mov byte [ebp - 0x70], 0
cmp ecx, 0xf
jbe 0x1006e4b4
mov edx, dword [ebp - 0x88]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1006e4aa
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1006e2b3
push ecx
push edx
call fcn.1007d105
add esp, 8
mov ecx, dword [edi + 0x50]
test ecx, ecx
je 0x1006e5bd
add ecx, 4
lea edx, [ebp - 0x40]
call fcn.1000edf0
mov eax, dword [edi + 0x50]
mov edx, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x50]
mov dword [eax + 0x50], edx
mov eax, dword [edi + 0x50]
mov dword [eax + 0x54], ecx
mov eax, dword [edi + 0x50]
mov dword [eax + 0x58], 1
test ecx, ecx
je 0x1006e4f6
movsx ecx, word [ecx + 0x56]
movsx eax, word [edx + 0x66]
add ecx, eax
jmp 0x1006e4fa
movsx ecx, word [edx + 0x66]
mov eax, dword [edi + 0x50]
mov dword [eax + 0x5c], ecx
mov eax, dword [edi + 0x50]
mov eax, dword [eax]
mov dword [ebp - 0x44], eax
test eax, eax
je 0x1006e5bd
push 4
push eax
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
mov esi, dword [ebp - 0x40]
test eax, eax
jne 0x1006e597
cmp dword [ebp - 0x2c], 0xf
lea ecx, [ebp - 0x40]
cmova ecx, esi
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1006e530
sub ecx, edx
mov dword [ebp - 0x4c], ecx
lea esi, [ecx + 0x21]
push esi
call fcn.1007d113
push esi
mov edi, eax
push 0
push edi
call sub.VCRUNTIME140.dll_memset
cmp dword [ebp - 0x2c], 0xf
lea edx, [ebp - 0x40]
push dword [ebp - 0x4c]
cmova edx, dword [ebp - 0x40]
lea esi, [edi + 0x20]
push edx
push esi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp - 0x4c]
add esp, 0x1c
mov ecx, dword [ebp - 0x44]
mov dword [edi + 4], esi
mov dword [edi + 0x14], eax
push edi
mov dword [edi + 0x18], 0x1f
call dword [0x10088b50]
push edi
call fcn.1007d11c
mov edi, dword [ebp - 0x8c]
add esp, 4
mov esi, dword [ebp - 0x40]
mov eax, dword [edi + 0x50]
mov eax, dword [eax]
mov dword [ebp - 0x44], eax
test eax, eax
je 0x1006e5c0
push 4
push eax
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1006e5c0
mov ecx, dword [ebp - 0x44]
push 1
call dword [0x10088b1c]
jmp 0x1006e5c0
mov esi, dword [ebp - 0x40]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x2c]
cmp eax, 0xf
jbe 0x1006ed05
lea ecx, [eax + 1]
mov eax, esi
cmp ecx, 0x1000
jb 0x1006e5f4
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1006e040
push ecx
push esi
jmp 0x1006ecfd
test ecx, ecx
je 0x1006ed05
cmp ecx, 0x5f5e100
jae 0x1006ed05
mov edx, dword [edi + 0x74]
sub edx, dword [edi + 0x70]
sar edx, 2
call fcn.1000f7f0
mov ecx, dword [edi + 0x70]
mov eax, dword [ecx + eax*4 - 4]
mov dword [ebp - 0x50], eax
test eax, eax
je 0x1006ed05
mov eax, dword [edi + 0x68]
cmp eax, 1
jne 0x1006e75a
mov edx, dword [edi + 0x64]
lea ecx, [ebp - 0x88]
push 0x2e
call fcn.1000fd80
add esp, 4
mov dword [ebp - 4], 8
cmp dword [eax + 0x14], 0xf
jbe 0x1006e65d
mov eax, dword [eax]
movaps xmm0, xmmword [0x10089b90]
xor ecx, ecx
push eax
movups xmmword [ebp - 0x24], xmm0
mov byte [ebp - 0x14], 0
nop
mov al, byte [ebp - 0x24]
xor byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0xf
jb 0x1006e670
sub esp, 0x18
mov byte [ebp - 0x14], 0
mov edx, esp
lea ecx, [ebp - 0x23]
xorps xmm0, xmm0
lea esi, [ecx + 1]
movups xmmword [edx], xmm0
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1006e6a0
sub ecx, esi
lea eax, [ebp - 0x23]
push ecx
push eax
mov ecx, edx
call fcn.100024a0
lea eax, [ebp - 0x70]
push eax
call fcn.10006910
add esp, 0x20
mov byte [ebp - 4], 9
mov edx, eax
mov ecx, dword [edi + 0x44]
call fcn.10014db0
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x5c]
cmp ecx, 0xf
jbe 0x1006e707
mov edx, dword [ebp - 0x70]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1006e6fd
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1006e2b3
push ecx
push edx
call fcn.1007d105
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x74]
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0xf
mov byte [ebp - 0x70], 0
cmp ecx, 0xf
jbe 0x1006e87e
mov edx, dword [ebp - 0x88]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1006e874
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1006e874
jmp 0x1006e2b3
cmp eax, 2
jne 0x1006e87e
mov edx, dword [edi + 0x64]
lea ecx, [ebp - 0x88]
push 0x2e
call fcn.1000fd80
add esp, 4
mov dword [ebp - 4], 0xa
cmp dword [eax + 0x14], 0xf
jbe 0x1006e785
mov eax, dword [eax]
movaps xmm0, xmmword [str.fFKF2F6]
xor ecx, ecx
push eax
movups xmmword [ebp - 0x24], xmm0
mov byte [ebp - 0x14], 0
mov al, byte [ebp - 0x24]
xor byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0xf
jb 0x1006e797
sub esp, 0x18
mov byte [ebp - 0x14], 0
mov edx, esp
lea ecx, [ebp - 0x23]
xorps xmm0, xmm0
lea esi, [ecx + 1]
movups xmmword [edx], xmm0
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1006e7c7
sub ecx, esi
lea eax, [ebp - 0x23]
push ecx
push eax
mov ecx, edx
call fcn.100024a0
lea eax, [ebp - 0x70]
push eax
call fcn.10006910
add esp, 0x20
mov byte [ebp - 4], 0xb
mov edx, eax
mov ecx, dword [edi + 0x44]
call fcn.10014db0
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x5c]
cmp ecx, 0xf
jbe 0x1006e82e
mov edx, dword [ebp - 0x70]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1006e824
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1006e2b3
push ecx
push edx
call fcn.1007d105
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x74]
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0xf
mov byte [ebp - 0x70], 0
cmp ecx, 0xf
jbe 0x1006e87e
mov edx, dword [ebp - 0x88]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1006e874
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1006e2b3
push ecx
push edx
call fcn.1007d105
add esp, 8
mov edx, dword [edi + 0x6c]
lea ecx, [ebp - 0x88]
push 0x2e
call fcn.1000fd80
add esp, 4
mov dword [ebp - 4], 0xc
cmp dword [eax + 0x14], 0xf
jbe 0x1006e8a0
mov eax, dword [eax]
movaps xmm0, xmmword [0x10089330]
xor ecx, ecx
push eax
movups xmmword [ebp - 0x24], xmm0
mov word [ebp - 0x14], 0x5c
mov al, byte [ebp - 0x24]
xor byte [ebp + ecx - 0x23], al
inc ecx
cmp ecx, 0x10
jb 0x1006e8b4
sub esp, 0x18
mov byte [ebp - 0x13], 0
mov edx, esp
lea ecx, [ebp - 0x23]
xorps xmm0, xmm0
lea esi, [ecx + 1]
movups xmmword [edx], xmm0
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1006e8e4
sub ecx, esi
lea eax, [ebp - 0x23]
push ecx
push eax
mov ecx, edx
call fcn.100024a0
lea eax, [ebp - 0x70]
push eax
call fcn.10006910
add esp, 0x20
mov byte [ebp - 4], 0xd
mov edx, eax
mov ecx, dword [edi + 0x48]
call fcn.10014db0
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x5c]
cmp ecx, 0xf
jbe 0x1006e94b
mov edx, dword [ebp - 0x70]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1006e941
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1006e2b3
push ecx
push edx
call fcn.1007d105
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x74]
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0xf
mov byte [ebp - 0x70], 0
cmp ecx, 0xf
jbe 0x1006e99b
mov edx, dword [ebp - 0x88]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1006e991
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1006e2b3
push ecx
push edx
call fcn.1007d105
add esp, 8
mov esi, dword [0x10088ac8]
mov eax, 0x10624dd3
mul dword [ebp - 0x50]
mov ecx, 0xd78ae8
mov dword [ebp - 0x78], 0
mov eax, edx
mov dword [ebp - 0x74], 0xf
shr eax, 6
mov dword [ebp - 0x44], eax
imul eax, eax, 0x3e8
mov byte [ebp - 0x88], 0
push eax
call fcn.10014f70
mov ecx, eax
call esi
mov dword [ebp - 0x58], eax
test eax, eax
je 0x1006ed05
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0xf
movups xmmword [ebp - 0x28], xmm0
mov esi, dword [ebp - 0x50]
mov dword [ebp - 4], 0xe
mov cl, byte [eax + 4]
mov eax, 0x12e0be83
mul esi
mov dword [ebp - 0x18], 0
sub esi, edx
mov byte [ebp - 0x28], 0
shr esi, 1
add esi, edx
mov byte [ebp - 0x45], cl
shr esi, 0x1d
cmp esi, 4
jae 0x1006ead1
cmp cl, 0x2d
jae 0x1006ead1
push 4
push 0xd78af0
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1006ead1
sub esi, dword [ebp - 0x44]
movzx ecx, byte [ebp - 0x45]
mov edx, dword [0x10088acc]
imul eax, esi, 0x3e8
mov ecx, dword [ecx*4 + 0xd78af0]
add eax, dword [ebp - 0x50]
push eax
call edx
mov dword [ebp - 0x44], eax
mov esi, eax
mov dword [ebp - 0x54], esi
test eax, eax
je 0x1006ead6
cmp dword [eax + 0x48], 0
mov dword [ebp - 0x54], esi
je 0x1006ead6
push dword [ebp - 0x50]
xor edx, edx
lea ecx, [ebp - 0x70]
push eax
call fcn.100082f0
add esp, 8
lea ecx, [ebp - 0x28]
push eax
call fcn.1000b490
mov ecx, dword [ebp - 0x5c]
cmp ecx, 0xf
jbe 0x1006eac9
mov edx, dword [ebp - 0x70]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1006eabf
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1006e2b3
push ecx
push edx
call fcn.1007d105
add esp, 8
mov esi, dword [ebp - 0x44]
mov dword [ebp - 0x54], esi
jmp 0x1006eb38
xor esi, esi
mov dword [ebp - 0x54], esi
push dword [ebp - 0x50]
mov edx, dword [ebp - 0x58]
lea ecx, [ebp - 0x40]
push 0
call fcn.100082f0
add esp, 8
lea ecx, [ebp - 0x28]
push eax
call fcn.1000b490
mov ecx, dword [ebp - 0x2c]
cmp ecx, 0xf
jbe 0x1006eb26
mov edx, dword [ebp - 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1006eb1c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1006e2b3
push ecx
push edx
call fcn.1007d105
add esp, 8
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
mov ecx, dword [edi + 0x50]
mov eax, dword [ebp - 0x28]
test ecx, ecx
je 0x1006ecc7
lea eax, [ecx + 4]
mov dword [ebp - 0x44], eax
test eax, eax
je 0x1006ebdb
push 4
push eax
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1006ebdb
cmp dword [ebp - 0x14], 0xf
lea ecx, [ebp - 0x28]
cmova ecx, dword [ebp - 0x28]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1006eb70
sub ecx, edx
mov dword [ebp - 0x4c], ecx
lea esi, [ecx + 0x21]
push esi
call fcn.1007d113
push esi
mov edi, eax
push 0
push edi
call sub.VCRUNTIME140.dll_memset
cmp dword [ebp - 0x14], 0xf
lea ecx, [ebp - 0x28]
push dword [ebp - 0x4c]
cmova ecx, dword [ebp - 0x28]
lea esi, [edi + 0x20]
push ecx
push esi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp - 0x4c]
add esp, 0x1c
mov ecx, dword [ebp - 0x44]
mov dword [edi + 4], esi
mov dword [edi + 0x14], eax
push 0xffffffffffffffff
push 0
push edi
mov dword [edi + 0x18], 0x1f
call dword [0x10088ae0]
push edi
call fcn.1007d11c
mov edi, dword [ebp - 0x8c]
add esp, 4
mov esi, dword [ebp - 0x54]
mov eax, dword [edi + 0x50]
mov edx, dword [ebp - 0x58]
mov dword [eax + 0x50], edx
mov eax, dword [edi + 0x50]
mov dword [eax + 0x54], esi
mov eax, dword [edi + 0x50]
mov dword [eax + 0x58], 1
test esi, esi
je 0x1006ec04
movsx ecx, word [esi + 0x56]
movsx eax, word [edx + 0x66]
add ecx, eax
jmp 0x1006ec08
movsx ecx, word [edx + 0x66]
mov eax, dword [edi + 0x50]
mov dword [eax + 0x5c], ecx
mov eax, dword [edi + 0x50]
mov eax, dword [eax]
mov dword [ebp - 0x44], eax
test eax, eax
je 0x1006ecc4
push 4
push eax
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1006eca4
cmp dword [ebp - 0x14], 0xf
lea ecx, [ebp - 0x28]
cmova ecx, dword [ebp - 0x28]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1006ec40
sub ecx, edx
mov dword [ebp - 0x4c], ecx
lea esi, [ecx + 0x21]
push esi
call fcn.1007d113
push esi
mov edi, eax
push 0
push edi
call sub.VCRUNTIME140.dll_memset
cmp dword [ebp - 0x14], 0xf
lea edx, [ebp - 0x28]
push dword [ebp - 0x4c]
cmova edx, dword [ebp - 0x28]
lea esi, [edi + 0x20]
push edx
push esi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp - 0x4c]
add esp, 0x1c
mov ecx, dword [ebp - 0x44]
mov dword [edi + 4], esi
mov dword [edi + 0x14], eax
push edi
mov dword [edi + 0x18], 0x1f
call dword [0x10088b50]
push edi
call fcn.1007d11c
mov edi, dword [ebp - 0x8c]
add esp, 4
mov eax, dword [edi + 0x50]
mov esi, dword [eax]
test esi, esi
je 0x1006ecc4
push 4
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1006ecc4
push 1
mov ecx, esi
call dword [0x10088b1c]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x14]
cmp ecx, 0xf
jbe 0x1006ed05
inc ecx
mov edx, eax
cmp ecx, 0x1000
jb 0x1006ecfb
mov eax, dword [edx - 4]
add ecx, 0x23
sub edx, eax
mov dword [ebp - 0x44], eax
lea eax, [edx - 4]
cmp eax, 0x1f
ja 0x1006e040
mov eax, dword [ebp - 0x44]
push ecx
push eax
call fcn.1007d105
add esp, 8
mov ecx, edi
call fcn.1006d3e0
mov ecx, edi
call fcn.1006ed60
mov esi, dword [edi + 0x1c]
test esi, esi
je 0x1006ed31
push 4
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1006ed31
push 1
mov ecx, esi
call dword [0x10088b1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1007d0a4
mov esp, ebp
pop ebp
ret
call fcn.1000fb60
int3