Function at 0x1006db20
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100981bd
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x100aa040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x100ce634]
mov ecx, dword [0x100b9f3c]
push 0x1008e980
push 0xfffffffffffffffc
push dword [eax + 8]
call ecx
mov edi, dword [0x100ce5d0]
mov dword [0x100cf09c], eax
mov dword [0x100cea20], edi
mov eax, dword [edi]
mov dword [0x100cea24], eax
test eax, eax
je 0x1006dc93
xor esi, esi
mov eax, dword [0x100cea24]
mov ecx, dword [eax + esi*4]
test ecx, ecx
je 0x1006dbb3
mov eax, dword [0x100b9f38]
lea edx, [ebp - 0x38]
push 0x1c
push edx
push ecx
call eax
test eax, eax
je 0x1006dbb3
mov eax, dword [ebp - 0x24]
test al, 1
jne 0x1006dbb3
test eax, 0x100
jne 0x1006dbb3
inc esi
jmp 0x1006db84
mov dword [ebp - 0x14], esi
mov dword [0x100cea2c], esi
test esi, esi
je 0x1006dc93
inc esi
xor ecx, ecx
mov eax, esi
mov dword [ebp - 0x18], esi
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
xor eax, eax
add ecx, 4
setb al
neg eax
or eax, ecx
push eax
call fcn.1008f4bc
add esp, 4
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
mov dword [eax], esi
lea esi, [eax + 4]
mov eax, dword [ebp - 0x14]
push fcn.10018010
push 0x10018000
inc eax
push eax
push 4
push esi
call fcn.1008f448
mov dword [ebp - 4], 0xffffffff
mov eax, dword [0x100cea28]
mov dword [0x100cea28], esi
test eax, eax
je 0x1006dc64
push fcn.10018010
lea esi, [eax - 4]
mov dword [ebp - 4], 1
push dword [esi]
push 4
push eax
call fcn.1008efe8
mov eax, dword [esi]
lea eax, [eax*4 + 4]
push eax
push esi
call fcn.1008efaa
mov dword [ebp - 4], 0xffffffff
add esp, 8
mov esi, dword [0x100cea28]
test esi, esi
je 0x1006dc99
mov eax, dword [0x100cea2c]
lea eax, [eax*4 + 4]
push eax
mov eax, dword [0x100cea24]
add eax, 0xfffffffc
push eax
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
add esi, 4
mov dword [edi], esi
mov byte [0x100cea30], 1
mov esi, dword [0x100cea28]
xor eax, eax
cmp byte [0x100cea30], al
setne al
add eax, 0x29
cmp dword [0x100cea24], 0
je 0x1006dcc3
test esi, esi
je 0x1006dcc3
cmp eax, dword [0x100cea2c]
ja 0x1006dcc3
mov dword [esi + eax*4], 0x1007f5f0
mov edi, dword [0x100ce5b8]
mov dword [0x100cea48], edi
mov eax, dword [edi]
mov dword [0x100cea4c], eax
test eax, eax
je 0x1006ddef
xor esi, esi
mov eax, dword [0x100cea4c]
mov ecx, dword [eax + esi*4]
test ecx, ecx
je 0x1006dd0f
mov eax, dword [0x100b9f38]
lea edx, [ebp - 0x38]
push 0x1c
push edx
push ecx
call eax
test eax, eax
je 0x1006dd0f
mov eax, dword [ebp - 0x24]
test al, 1
jne 0x1006dd0f
test eax, 0x100
jne 0x1006dd0f
inc esi
jmp 0x1006dce0
mov dword [ebp - 0x14], esi
mov dword [0x100cea54], esi
test esi, esi
je 0x1006ddef
inc esi
xor ecx, ecx
mov eax, esi
mov dword [ebp - 0x18], esi
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
xor eax, eax
add ecx, 4
setb al
neg eax
or eax, ecx
push eax
call fcn.1008f4bc
add esp, 4
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 3
mov dword [eax], esi
lea esi, [eax + 4]
mov eax, dword [ebp - 0x14]
push fcn.10018010
push 0x10018000
inc eax
push eax
push 4
push esi
call fcn.1008f448
mov dword [ebp - 4], 0xffffffff
mov eax, dword [0x100cea50]
mov dword [0x100cea50], esi
test eax, eax
je 0x1006ddc0
push fcn.10018010
lea esi, [eax - 4]
mov dword [ebp - 4], 4
push dword [esi]
push 4
push eax
call fcn.1008efe8
mov eax, dword [esi]
lea eax, [eax*4 + 4]
push eax
push esi
call fcn.1008efaa
mov dword [ebp - 4], 0xffffffff
add esp, 8
mov esi, dword [0x100cea50]
test esi, esi
je 0x1006ddf5
mov eax, dword [0x100cea54]
lea eax, [eax*4 + 4]
push eax
mov eax, dword [0x100cea4c]
add eax, 0xfffffffc
push eax
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
add esi, 4
mov dword [edi], esi
mov byte [0x100cea58], 1
mov esi, dword [0x100cea50]
xor eax, eax
cmp byte [0x100cea58], al
setne al
add eax, 5
cmp dword [0x100cea4c], 0
je 0x1006de25
test esi, esi
je 0x1006de25
cmp eax, dword [0x100cea54]
ja 0x1006de25
mov dword [esi + eax*4], 0x10074bb0
mov esi, dword [0x100cea50]
xor eax, eax
cmp byte [0x100cea58], al
setne al
add eax, 6
cmp dword [0x100cea4c], 0
je 0x1006de55
test esi, esi
je 0x1006de55
cmp eax, dword [0x100cea54]
ja 0x1006de55
mov dword [esi + eax*4], 0x10074c50
mov esi, dword [0x100cea50]
xor eax, eax
cmp byte [0x100cea58], al
setne al
add eax, 7
cmp dword [0x100cea4c], 0
je 0x1006de85
test esi, esi
je 0x1006de85
cmp eax, dword [0x100cea54]
ja 0x1006de85
mov dword [esi + eax*4], 0x10074ca0
mov esi, dword [0x100cea50]
xor eax, eax
cmp byte [0x100cea58], al
setne al
add eax, 0x24
cmp dword [0x100cea4c], 0
je 0x1006deaf
test esi, esi
je 0x1006deaf
cmp eax, dword [0x100cea54]
ja 0x1006deaf
mov dword [esi + eax*4], 0x10074d10
mov edi, dword [0x100ce5c0]
mov dword [0x100cea70], edi
mov eax, dword [edi]
mov dword [0x100cea74], eax
test eax, eax
je 0x1006dfdf
xor esi, esi
nop dword [eax]
mov eax, dword [0x100cea74]
mov ecx, dword [eax + esi*4]
test ecx, ecx
je 0x1006deff
mov eax, dword [0x100b9f38]
lea edx, [ebp - 0x38]
push 0x1c
push edx
push ecx
call eax
test eax, eax
je 0x1006deff
mov eax, dword [ebp - 0x24]
test al, 1
jne 0x1006deff
test eax, 0x100
jne 0x1006deff
inc esi
jmp 0x1006ded0
mov dword [ebp - 0x14], esi
mov dword [0x100cea7c], esi
test esi, esi
je 0x1006dfdf
inc esi
xor ecx, ecx
mov eax, esi
mov dword [ebp - 0x18], esi
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
xor eax, eax
add ecx, 4
setb al
neg eax
or eax, ecx
push eax
call fcn.1008f4bc
add esp, 4
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 6
mov dword [eax], esi
lea esi, [eax + 4]
mov eax, dword [ebp - 0x14]
push fcn.10018010
push 0x10018000
inc eax
push eax
push 4
push esi
call fcn.1008f448
mov dword [ebp - 4], 0xffffffff
mov eax, dword [0x100cea78]
mov dword [0x100cea78], esi
test eax, eax
je 0x1006dfb0
push fcn.10018010
lea esi, [eax - 4]
mov dword [ebp - 4], 7
push dword [esi]
push 4
push eax
call fcn.1008efe8
mov eax, dword [esi]
lea eax, [eax*4 + 4]
push eax
push esi
call fcn.1008efaa
mov dword [ebp - 4], 0xffffffff
add esp, 8
mov esi, dword [0x100cea78]
test esi, esi
je 0x1006dfe5
mov eax, dword [0x100cea7c]
lea eax, [eax*4 + 4]
push eax
mov eax, dword [0x100cea74]
add eax, 0xfffffffc
push eax
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
add esi, 4
mov dword [edi], esi
mov byte [0x100cea80], 1
mov esi, dword [0x100cea78]
xor eax, eax
cmp byte [0x100cea80], al
setne al
add eax, 0x1b
cmp dword [0x100cea74], 0
je 0x1006e015
test esi, esi
je 0x1006e015
cmp eax, dword [0x100cea7c]
ja 0x1006e015
mov dword [esi + eax*4], 0x10072880
mov esi, dword [0x100cea78]
xor eax, eax
cmp byte [0x100cea80], al
setne al
add eax, 0x5d
cmp dword [0x100cea74], 0
je 0x1006e03f
test esi, esi
je 0x1006e03f
cmp eax, dword [0x100cea7c]
ja 0x1006e03f
mov dword [esi + eax*4], 0x100729c0
mov edi, dword [0x100ce614]
mov dword [0x100cea84], edi
mov eax, dword [edi]
mov dword [0x100cea88], eax
test eax, eax
je 0x1006e16f
xor esi, esi
nop dword [eax]
mov eax, dword [0x100cea88]
mov ecx, dword [eax + esi*4]
test ecx, ecx
je 0x1006e08f
mov eax, dword [0x100b9f38]
lea edx, [ebp - 0x38]
push 0x1c
push edx
push ecx
call eax
test eax, eax
je 0x1006e08f
mov eax, dword [ebp - 0x24]
test al, 1
jne 0x1006e08f
test eax, 0x100
jne 0x1006e08f
inc esi
jmp 0x1006e060
mov dword [ebp - 0x14], esi
mov dword [0x100cea90], esi
test esi, esi
je 0x1006e16f
inc esi
xor ecx, ecx
mov eax, esi
mov dword [ebp - 0x18], esi
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
xor eax, eax
add ecx, 4
setb al
neg eax
or eax, ecx
push eax
call fcn.1008f4bc
add esp, 4
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 9
mov dword [eax], esi
lea esi, [eax + 4]
mov eax, dword [ebp - 0x14]
push fcn.10018010
push 0x10018000
inc eax
push eax
push 4
push esi
call fcn.1008f448
mov dword [ebp - 4], 0xffffffff
mov eax, dword [0x100cea8c]
mov dword [0x100cea8c], esi
test eax, eax
je 0x1006e140
push fcn.10018010
lea esi, [eax - 4]
mov dword [ebp - 4], 0xa
push dword [esi]
push 4
push eax
call fcn.1008efe8
mov eax, dword [esi]
lea eax, [eax*4 + 4]
push eax
push esi
call fcn.1008efaa
mov dword [ebp - 4], 0xffffffff
add esp, 8
mov esi, dword [0x100cea8c]
test esi, esi
je 0x1006e175
mov eax, dword [0x100cea90]
lea eax, [eax*4 + 4]
push eax
mov eax, dword [0x100cea88]
add eax, 0xfffffffc
push eax
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
add esi, 4
mov dword [edi], esi
mov byte [0x100cea94], 1
mov esi, dword [0x100cea8c]
xor eax, eax
cmp byte [0x100cea94], al
setne al
add eax, 5
cmp dword [0x100cea88], 0
je 0x1006e19f
test esi, esi
je 0x1006e19f
cmp eax, dword [0x100cea90]
ja 0x1006e19f
mov dword [esi + eax*4], 0x10072b10
mov edi, dword [0x100ce5d8]
mov dword [0x100cea98], edi
mov eax, dword [edi]
mov dword [0x100cea9c], eax
test eax, eax
je 0x1006e2cf
xor esi, esi
nop dword [eax]
mov eax, dword [0x100cea9c]
mov ecx, dword [eax + esi*4]
test ecx, ecx
je 0x1006e1ef
mov eax, dword [0x100b9f38]
lea edx, [ebp - 0x38]
push 0x1c
push edx
push ecx
call eax
test eax, eax
je 0x1006e1ef
mov eax, dword [ebp - 0x24]
test al, 1
jne 0x1006e1ef
test eax, 0x100
jne 0x1006e1ef
inc esi
jmp 0x1006e1c0
mov dword [ebp - 0x14], esi
mov dword [0x100ceaa4], esi
test esi, esi
je 0x1006e2cf
inc esi
xor ecx, ecx
mov eax, esi
mov dword [ebp - 0x18], esi
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
xor eax, eax
add ecx, 4
setb al
neg eax
or eax, ecx
push eax
call fcn.1008f4bc
add esp, 4
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xc
mov dword [eax], esi
lea esi, [eax + 4]
mov eax, dword [ebp - 0x14]
push fcn.10018010
push 0x10018000
inc eax
push eax
push 4
push esi
call fcn.1008f448
mov dword [ebp - 4], 0xffffffff
mov eax, dword [0x100ceaa0]
mov dword [0x100ceaa0], esi
test eax, eax
je 0x1006e2a0
push fcn.10018010
lea esi, [eax - 4]
mov dword [ebp - 4], 0xd
push dword [esi]
push 4
push eax
call fcn.1008efe8
mov eax, dword [esi]
lea eax, [eax*4 + 4]
push eax
push esi
call fcn.1008efaa
mov dword [ebp - 4], 0xffffffff
add esp, 8
mov esi, dword [0x100ceaa0]
test esi, esi
je 0x1006e2d5
mov eax, dword [0x100ceaa4]
lea eax, [eax*4 + 4]
push eax
mov eax, dword [0x100cea9c]
add eax, 0xfffffffc
push eax
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
add esi, 4
mov dword [edi], esi
mov byte [0x100ceaa8], 1
mov esi, dword [0x100ceaa0]
xor eax, eax
cmp byte [0x100ceaa8], al
setne al
add eax, 0xe
cmp dword [0x100cea9c], 0
je 0x1006e305
test esi, esi
je 0x1006e305
cmp eax, dword [0x100ceaa4]
ja 0x1006e305
mov dword [esi + eax*4], 0x10085020
mov esi, dword [0x100ceaa0]
xor eax, eax
cmp byte [0x100ceaa8], al
setne al
add eax, 0x13
cmp dword [0x100cea9c], 0
je 0x1006e32f
test esi, esi
je 0x1006e32f
cmp eax, dword [0x100ceaa4]
ja 0x1006e32f
mov dword [esi + eax*4], 0x10085350
mov edi, dword [0x100ce618]
mov dword [0x100cea34], edi
mov eax, dword [edi]
mov dword [0x100cea38], eax
test eax, eax
je 0x1006e45f
xor esi, esi
nop dword [eax]
mov eax, dword [0x100cea38]
mov ecx, dword [eax + esi*4]
test ecx, ecx
je 0x1006e37f
mov eax, dword [0x100b9f38]
lea edx, [ebp - 0x38]
push 0x1c
push edx
push ecx
call eax
test eax, eax
je 0x1006e37f
mov eax, dword [ebp - 0x24]
test al, 1
jne 0x1006e37f
test eax, 0x100
jne 0x1006e37f
inc esi
jmp 0x1006e350
mov dword [ebp - 0x14], esi
mov dword [0x100cea40], esi
test esi, esi
je 0x1006e45f
inc esi
xor ecx, ecx
mov eax, esi
mov dword [ebp - 0x18], esi
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
xor eax, eax
add ecx, 4
setb al
neg eax
or eax, ecx
push eax
call fcn.1008f4bc
add esp, 4
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xf
mov dword [eax], esi
lea esi, [eax + 4]
mov eax, dword [ebp - 0x14]
push fcn.10018010
push 0x10018000
inc eax
push eax
push 4
push esi
call fcn.1008f448
mov dword [ebp - 4], 0xffffffff
mov eax, dword [0x100cea3c]
mov dword [0x100cea3c], esi
test eax, eax
je 0x1006e430
push fcn.10018010
lea esi, [eax - 4]
mov dword [ebp - 4], 0x10
push dword [esi]
push 4
push eax
call fcn.1008efe8
mov eax, dword [esi]
lea eax, [eax*4 + 4]
push eax
push esi
call fcn.1008efaa
mov dword [ebp - 4], 0xffffffff
add esp, 8
mov esi, dword [0x100cea3c]
test esi, esi
je 0x1006e465
mov eax, dword [0x100cea40]
lea eax, [eax*4 + 4]
push eax
mov eax, dword [0x100cea38]
add eax, 0xfffffffc
push eax
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
add esi, 4
mov dword [edi], esi
mov byte [0x100cea44], 1
mov esi, dword [0x100cea3c]
xor eax, eax
cmp byte [0x100cea44], al
setne al
add eax, 0x10
cmp dword [0x100cea38], 0
je 0x1006e495
test esi, esi
je 0x1006e495
cmp eax, dword [0x100cea40]
ja 0x1006e495
mov dword [esi + eax*4], 0x1007f240
mov esi, dword [0x100cea3c]
xor eax, eax
cmp byte [0x100cea44], al
setne al
add eax, 0x11
cmp dword [0x100cea38], 0
je 0x1006e4c5
test esi, esi
je 0x1006e4c5
cmp eax, dword [0x100cea40]
ja 0x1006e4c5
mov dword [esi + eax*4], 0x1007f250
mov esi, dword [0x100cea3c]
xor eax, eax
cmp byte [0x100cea44], al
setne al
add eax, 0x12
cmp dword [0x100cea38], 0
je 0x1006e4f5
test esi, esi
je 0x1006e4f5
cmp eax, dword [0x100cea40]
ja 0x1006e4f5
mov dword [esi + eax*4], 0x1007f280
mov esi, dword [0x100cea3c]
xor eax, eax
cmp byte [0x100cea44], al
setne al
add eax, 0x18
cmp dword [0x100cea38], 0
je 0x1006e525
test esi, esi
je 0x1006e525
cmp eax, dword [0x100cea40]
ja 0x1006e525
mov dword [esi + eax*4], 0x1007f310
mov esi, dword [0x100cea3c]
xor eax, eax
cmp byte [0x100cea44], al
setne al
add eax, 0x2c
cmp dword [0x100cea38], 0
je 0x1006e54f
test esi, esi
je 0x1006e54f
cmp eax, dword [0x100cea40]
ja 0x1006e54f
mov dword [esi + eax*4], 0x1007f440
mov edi, dword [0x100ce5cc]
mov dword [0x100ceaac], edi
mov eax, dword [edi]
mov dword [0x100ceab0], eax
test eax, eax
je 0x1006e67f
xor esi, esi
nop dword [eax]
mov eax, dword [0x100ceab0]
mov ecx, dword [eax + esi*4]
test ecx, ecx
je 0x1006e59f
mov eax, dword [0x100b9f38]
lea edx, [ebp - 0x38]
push 0x1c
push edx
push ecx
call eax
test eax, eax
je 0x1006e59f
mov eax, dword [ebp - 0x24]
test al, 1
jne 0x1006e59f
test eax, 0x100
jne 0x1006e59f
inc esi
jmp 0x1006e570
mov dword [ebp - 0x14], esi
mov dword [0x100ceab8], esi
test esi, esi
je 0x1006e67f
inc esi
xor ecx, ecx
mov eax, esi
mov dword [ebp - 0x18], esi
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
xor eax, eax
add ecx, 4
setb al
neg eax
or eax, ecx
push eax
call fcn.1008f4bc
add esp, 4
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0x12
mov dword [eax], esi
lea esi, [eax + 4]
mov eax, dword [ebp - 0x14]
push fcn.10018010
push 0x10018000
inc eax
push eax
push 4
push esi
call fcn.1008f448
mov dword [ebp - 4], 0xffffffff
mov eax, dword [0x100ceab4]
mov dword [0x100ceab4], esi
test eax, eax
je 0x1006e650
push fcn.10018010
lea esi, [eax - 4]
mov dword [ebp - 4], 0x13
push dword [esi]
push 4
push eax
call fcn.1008efe8
mov eax, dword [esi]
lea eax, [eax*4 + 4]
push eax
push esi
call fcn.1008efaa
mov dword [ebp - 4], 0xffffffff
add esp, 8
mov esi, dword [0x100ceab4]
test esi, esi
je 0x1006e685
mov eax, dword [0x100ceab8]
lea eax, [eax*4 + 4]
push eax
mov eax, dword [0x100ceab0]
add eax, 0xfffffffc
push eax
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
add esi, 4
mov dword [edi], esi
mov byte [0x100ceabc], 1
mov esi, dword [0x100ceab4]
xor eax, eax
cmp byte [0x100ceabc], al
setne al
add eax, 0x43
cmp dword [0x100ceab0], 0
je 0x1006e6b5
test esi, esi
je 0x1006e6b5
cmp eax, dword [0x100ceab8]
ja 0x1006e6b5
mov dword [esi + eax*4], 0x1007c030
mov esi, dword [0x100ceab4]
xor eax, eax
cmp byte [0x100ceabc], al
setne al
add eax, 0x52
cmp dword [0x100ceab0], 0
je 0x1006e6e5
test esi, esi
je 0x1006e6e5
cmp eax, dword [0x100ceab8]
ja 0x1006e6e5
mov dword [esi + eax*4], 0x1007c080
mov esi, dword [0x100ceab4]
xor eax, eax
cmp byte [0x100ceabc], al
setne al
add eax, 0x74
cmp dword [0x100ceab0], 0
je 0x1006e70f
test esi, esi
je 0x1006e70f
cmp eax, dword [0x100ceab8]
ja 0x1006e70f
mov dword [esi + eax*4], 0x1007c110
mov edi, dword [0x100ce5ec]
mov dword [0x100ceafc], edi
mov eax, dword [edi]
mov dword [0x100ceb00], eax
test eax, eax
je 0x1006e83f
xor esi, esi
nop dword [eax]
mov eax, dword [0x100ceb00]
mov ecx, dword [eax + esi*4]
test ecx, ecx
je 0x1006e75f
mov eax, dword [0x100b9f38]
lea edx, [ebp - 0x38]
push 0x1c
push edx
push ecx
call eax
test eax, eax
je 0x1006e75f
mov eax, dword [ebp - 0x24]
test al, 1
jne 0x1006e75f
test eax, 0x100
jne 0x1006e75f
inc esi
jmp 0x1006e730
mov dword [ebp - 0x14], esi
mov dword [0x100ceb08], esi
test esi, esi
je 0x1006e83f
inc esi
xor ecx, ecx
mov eax, esi
mov dword [ebp - 0x18], esi
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
xor eax, eax
add ecx, 4
setb al
neg eax
or eax, ecx
push eax
call fcn.1008f4bc
add esp, 4
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0x15
mov dword [eax], esi
lea esi, [eax + 4]
mov eax, dword [ebp - 0x14]
push fcn.10018010
push 0x10018000
inc eax
push eax
push 4
push esi
call fcn.1008f448
mov dword [ebp - 4], 0xffffffff
mov eax, dword [0x100ceb04]
mov dword [0x100ceb04], esi
test eax, eax
je 0x1006e810
push fcn.10018010
lea esi, [eax - 4]
mov dword [ebp - 4], 0x16
push dword [esi]
push 4
push eax
call fcn.1008efe8
mov eax, dword [esi]
lea eax, [eax*4 + 4]
push eax
push esi
call fcn.1008efaa
mov dword [ebp - 4], 0xffffffff
add esp, 8
mov esi, dword [0x100ceb04]
test esi, esi
je 0x1006e845
mov eax, dword [0x100ceb08]
lea eax, [eax*4 + 4]
push eax
mov eax, dword [0x100ceb00]
add eax, 0xfffffffc
push eax
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
add esi, 4
mov dword [edi], esi
mov byte [0x100ceb0c], 1
mov esi, dword [0x100ceb04]
xor eax, eax
cmp byte [0x100ceb0c], al
setne al
add eax, 0x15
cmp dword [0x100ceb00], 0
je 0x1006e86f
test esi, esi
je 0x1006e86f
cmp eax, dword [0x100ceb08]
ja 0x1006e86f
mov dword [esi + eax*4], 0x10068fb0
mov edi, dword [0x100ce5e4]
mov dword [0x100ceae8], edi
mov eax, dword [edi]
mov dword [0x100ceaec], eax
test eax, eax
je 0x1006e99f
xor esi, esi
nop dword [eax]
mov eax, dword [0x100ceaec]
mov ecx, dword [eax + esi*4]
test ecx, ecx
je 0x1006e8bf
mov eax, dword [0x100b9f38]
lea edx, [ebp - 0x38]
push 0x1c
push edx
push ecx
call eax
test eax, eax
je 0x1006e8bf
mov eax, dword [ebp - 0x24]
test al, 1
jne 0x1006e8bf
test eax, 0x100
jne 0x1006e8bf
inc esi
jmp 0x1006e890
mov dword [ebp - 0x14], esi
mov dword [0x100ceaf4], esi
test esi, esi
je 0x1006e99f
inc esi
xor ecx, ecx
mov eax, esi
mov dword [ebp - 0x18], esi
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
xor eax, eax
add ecx, 4
setb al
neg eax
or eax, ecx
push eax
call fcn.1008f4bc
add esp, 4
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0x18
mov dword [eax], esi
lea esi, [eax + 4]
mov eax, dword [ebp - 0x14]
push fcn.10018010
push 0x10018000
inc eax
push eax
push 4
push esi
call fcn.1008f448
mov dword [ebp - 4], 0xffffffff
mov eax, dword [0x100ceaf0]
mov dword [0x100ceaf0], esi
test eax, eax
je 0x1006e970
push fcn.10018010
lea esi, [eax - 4]
mov dword [ebp - 4], 0x19
push dword [esi]
push 4
push eax
call fcn.1008efe8
mov eax, dword [esi]
lea eax, [eax*4 + 4]
push eax
push esi
call fcn.1008efaa
mov dword [ebp - 4], 0xffffffff
add esp, 8
mov esi, dword [0x100ceaf0]
test esi, esi
je 0x1006e9a5
mov eax, dword [0x100ceaf4]
lea eax, [eax*4 + 4]
push eax
mov eax, dword [0x100ceaec]
add eax, 0xfffffffc
push eax
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
add esi, 4
mov dword [edi], esi
mov byte [0x100ceaf8], 1
mov esi, dword [0x100ceaf0]
xor eax, eax
cmp byte [0x100ceaf8], al
setne al
add eax, 9
cmp dword [0x100ceaec], 0
je 0x1006e9cf
test esi, esi
je 0x1006e9cf
cmp eax, dword [0x100ceaf4]
ja 0x1006e9cf
mov dword [esi + eax*4], 0x10085490
mov edi, dword [0x100ce640]
mov dword [0x100ceb10], edi
mov eax, dword [edi]
mov dword [0x100ceb14], eax
test eax, eax
je 0x1006eaff
xor esi, esi
nop dword [eax]
mov eax, dword [0x100ceb14]
mov ecx, dword [eax + esi*4]
test ecx, ecx
je 0x1006ea1f
mov eax, dword [0x100b9f38]
lea edx, [ebp - 0x38]
push 0x1c
push edx
push ecx
call eax
test eax, eax
je 0x1006ea1f
mov eax, dword [ebp - 0x24]
test al, 1
jne 0x1006ea1f
test eax, 0x100
jne 0x1006ea1f
inc esi
jmp 0x1006e9f0
mov dword [ebp - 0x14], esi
mov dword [0x100ceb1c], esi
test esi, esi
je 0x1006eaff
inc esi
xor ecx, ecx
mov eax, esi
mov dword [ebp - 0x18], esi
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
xor eax, eax
add ecx, 4
setb al
neg eax
or eax, ecx
push eax
call fcn.1008f4bc
add esp, 4
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0x1b
mov dword [eax], esi
lea esi, [eax + 4]
mov eax, dword [ebp - 0x14]
push fcn.10018010
push 0x10018000
inc eax
push eax
push 4
push esi
call fcn.1008f448
mov dword [ebp - 4], 0xffffffff
mov eax, dword [0x100ceb18]
mov dword [0x100ceb18], esi
test eax, eax
je 0x1006ead0
push fcn.10018010
lea esi, [eax - 4]
mov dword [ebp - 4], 0x1c
push dword [esi]
push 4
push eax
call fcn.1008efe8
mov eax, dword [esi]
lea eax, [eax*4 + 4]
push eax
push esi
call fcn.1008efaa
mov dword [ebp - 4], 0xffffffff
add esp, 8
mov esi, dword [0x100ceb18]
test esi, esi
je 0x1006eb05
mov eax, dword [0x100ceb1c]
lea eax, [eax*4 + 4]
push eax
mov eax, dword [0x100ceb14]
add eax, 0xfffffffc
push eax
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
add esi, 4
mov dword [edi], esi
mov byte [0x100ceb20], 1
mov esi, dword [0x100ceb18]
xor eax, eax
cmp byte [0x100ceb20], al
setne al
add eax, 0x2b
cmp dword [0x100ceb14], 0
je 0x1006eb2f
test esi, esi
je 0x1006eb2f
cmp eax, dword [0x100ceb1c]
ja 0x1006eb2f
mov dword [esi + eax*4], 0x1003cf40
mov edi, dword [0x100ce5e8]
mov dword [0x100ceb24], edi
mov eax, dword [edi]
mov dword [0x100ceb28], eax
test eax, eax
je 0x1006ec5f
xor esi, esi
nop dword [eax]
mov eax, dword [0x100ceb28]
mov ecx, dword [eax + esi*4]
test ecx, ecx
je 0x1006eb7f
mov eax, dword [0x100b9f38]
lea edx, [ebp - 0x38]
push 0x1c
push edx
push ecx
call eax
test eax, eax
je 0x1006eb7f
mov eax, dword [ebp - 0x24]
test al, 1
jne 0x1006eb7f
test eax, 0x100
jne 0x1006eb7f
inc esi
jmp 0x1006eb50
mov dword [ebp - 0x14], esi
mov dword [0x100ceb30], esi
test esi, esi
je 0x1006ec5f
inc esi
xor ecx, ecx
mov eax, esi
mov dword [ebp - 0x18], esi
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
xor eax, eax
add ecx, 4
setb al
neg eax
or eax, ecx
push eax
call fcn.1008f4bc
add esp, 4
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0x1e
mov dword [eax], esi
lea esi, [eax + 4]
mov eax, dword [ebp - 0x14]
push fcn.10018010
push 0x10018000
inc eax
push eax
push 4
push esi
call fcn.1008f448
mov dword [ebp - 4], 0xffffffff
mov eax, dword [0x100ceb2c]
mov dword [0x100ceb2c], esi
test eax, eax
je 0x1006ec30
push fcn.10018010
lea esi, [eax - 4]
mov dword [ebp - 4], 0x1f
push dword [esi]
push 4
push eax
call fcn.1008efe8
mov eax, dword [esi]
lea eax, [eax*4 + 4]
push eax
push esi
call fcn.1008efaa
mov dword [ebp - 4], 0xffffffff
add esp, 8
mov esi, dword [0x100ceb2c]
test esi, esi
je 0x1006ec65
mov eax, dword [0x100ceb30]
lea eax, [eax*4 + 4]
push eax
mov eax, dword [0x100ceb28]
add eax, 0xfffffffc
push eax
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
add esi, 4
mov dword [edi], esi
mov byte [0x100ceb34], 1
mov esi, dword [0x100ceb2c]
xor eax, eax
cmp byte [0x100ceb34], al
setne al
add eax, 4
cmp dword [0x100ceb28], 0
je 0x1006ec95
test esi, esi
je 0x1006ec95
cmp eax, dword [0x100ceb30]
ja 0x1006ec95
mov dword [esi + eax*4], 0x100839e0
mov esi, dword [0x100ceb2c]
xor eax, eax
cmp byte [0x100ceb34], al
setne al
add eax, 6
cmp dword [0x100ceb28], 0
je 0x1006ecc5
test esi, esi
je 0x1006ecc5
cmp eax, dword [0x100ceb30]
ja 0x1006ecc5
mov dword [esi + eax*4], 0x10083ab0
mov esi, dword [0x100ceb2c]
xor eax, eax
cmp byte [0x100ceb34], al
setne al
add eax, 0x27
cmp dword [0x100ceb28], 0
je 0x1006ecf5
test esi, esi
je 0x1006ecf5
cmp eax, dword [0x100ceb30]
ja 0x1006ecf5
mov dword [esi + eax*4], 0x10083ac0
mov esi, dword [0x100ceb2c]
xor eax, eax
cmp byte [0x100ceb34], al
setne al
add eax, 0x28
cmp dword [0x100ceb28], 0
je 0x1006ed1f
test esi, esi
je 0x1006ed1f
cmp eax, dword [0x100ceb30]
ja 0x1006ed1f
mov dword [esi + eax*4], 0x10083b00
mov edi, dword [0x100ce608]
mov dword [0x100ceb38], edi
mov eax, dword [edi]
mov dword [0x100ceb3c], eax
test eax, eax
je 0x1006ee4f
xor esi, esi
nop dword [eax]
mov eax, dword [0x100ceb3c]
mov ecx, dword [eax + esi*4]
test ecx, ecx
je 0x1006ed6f
mov eax, dword [0x100b9f38]
lea edx, [ebp - 0x38]
push 0x1c
push edx
push ecx
call eax
test eax, eax
je 0x1006ed6f
mov eax, dword [ebp - 0x24]
test al, 1
jne 0x1006ed6f
test eax, 0x100
jne 0x1006ed6f
inc esi
jmp 0x1006ed40
mov dword [ebp - 0x14], esi
mov dword [0x100ceb44], esi
test esi, esi
je 0x1006ee4f
inc esi
xor ecx, ecx
mov eax, esi
mov dword [ebp - 0x18], esi
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
xor eax, eax
add ecx, 4
setb al
neg eax
or eax, ecx
push eax
call fcn.1008f4bc
add esp, 4
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0x21
mov dword [eax], esi
lea esi, [eax + 4]
mov eax, dword [ebp - 0x14]
push fcn.10018010
push 0x10018000
inc eax
push eax
push 4
push esi
call fcn.1008f448
mov dword [ebp - 4], 0xffffffff
mov eax, dword [0x100ceb40]
mov dword [0x100ceb40], esi
test eax, eax
je 0x1006ee20
push fcn.10018010
lea esi, [eax - 4]
mov dword [ebp - 4], 0x22
push dword [esi]
push 4
push eax
call fcn.1008efe8
mov eax, dword [esi]
lea eax, [eax*4 + 4]
push eax
push esi
call fcn.1008efaa
mov dword [ebp - 4], 0xffffffff
add esp, 8
mov esi, dword [0x100ceb40]
test esi, esi
je 0x1006ee55
mov eax, dword [0x100ceb44]
lea eax, [eax*4 + 4]
push eax
mov eax, dword [0x100ceb3c]
add eax, 0xfffffffc
push eax
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
add esi, 4
mov dword [edi], esi
mov byte [0x100ceb48], 1
mov esi, dword [0x100ceb40]
xor eax, eax
cmp byte [0x100ceb48], al
setne al
add eax, 0xd
cmp dword [0x100ceb3c], 0
je 0x1006ee7f
test esi, esi
je 0x1006ee7f
cmp eax, dword [0x100ceb44]
ja 0x1006ee7f
mov dword [esi + eax*4], 0x1003cbf0
mov edi, dword [0x100ce5f0]
mov dword [0x100ceb4c], edi
mov eax, dword [edi]
mov dword [0x100ceb50], eax
test eax, eax
je 0x1006efaf
xor esi, esi
nop dword [eax]
mov eax, dword [0x100ceb50]
mov ecx, dword [eax + esi*4]
test ecx, ecx
je 0x1006eecf
mov eax, dword [0x100b9f38]
lea edx, [ebp - 0x38]
push 0x1c
push edx
push ecx
call eax
test eax, eax
je 0x1006eecf
mov eax, dword [ebp - 0x24]
test al, 1
jne 0x1006eecf
test eax, 0x100
jne 0x1006eecf
inc esi
jmp 0x1006eea0
mov dword [ebp - 0x14], esi
mov dword [0x100ceb58], esi
test esi, esi
je 0x1006efaf
inc esi
xor ecx, ecx
mov eax, esi
mov dword [ebp - 0x18], esi
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
xor eax, eax
add ecx, 4
setb al
neg eax
or eax, ecx
push eax
call fcn.1008f4bc
add esp, 4
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0x24
mov dword [eax], esi
lea esi, [eax + 4]
mov eax, dword [ebp - 0x14]
push fcn.10018010
push 0x10018000
inc eax
push eax
push 4
push esi
call fcn.1008f448
mov dword [ebp - 4], 0xffffffff
mov eax, dword [0x100ceb54]
mov dword [0x100ceb54], esi
test eax, eax
je 0x1006ef80
push fcn.10018010
lea esi, [eax - 4]
mov dword [ebp - 4], 0x25
push dword [esi]
push 4
push eax
call fcn.1008efe8
mov eax, dword [esi]
lea eax, [eax*4 + 4]
push eax
push esi
call fcn.1008efaa
mov dword [ebp - 4], 0xffffffff
add esp, 8
mov esi, dword [0x100ceb54]
test esi, esi
je 0x1006efb5
mov eax, dword [0x100ceb58]
lea eax, [eax*4 + 4]
push eax
mov eax, dword [0x100ceb50]
add eax, 0xfffffffc
push eax
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
add esi, 4
mov dword [edi], esi
mov byte [0x100ceb5c], 1
mov esi, dword [0x100ceb54]
xor eax, eax
cmp byte [0x100ceb5c], al
setne al
add eax, 0x15
cmp dword [0x100ceb50], 0
je 0x1006efdf
test esi, esi
je 0x1006efdf
cmp eax, dword [0x100ceb58]
ja 0x1006efdf
mov dword [esi + eax*4], 0x1003cf10
mov edi, dword [0x100ce738]
mov dword [0x100ceb60], edi
mov eax, dword [edi]
mov dword [0x100ceb64], eax
test eax, eax
je 0x1006f10f
xor esi, esi
nop dword [eax]
mov eax, dword [0x100ceb64]
mov ecx, dword [eax + esi*4]
test ecx, ecx
je 0x1006f02f
mov eax, dword [0x100b9f38]
lea edx, [ebp - 0x38]
push 0x1c
push edx
push ecx
call eax
test eax, eax
je 0x1006f02f
mov eax, dword [ebp - 0x24]
test al, 1
jne 0x1006f02f
test eax, 0x100
jne 0x1006f02f
inc esi
jmp 0x1006f000
mov dword [ebp - 0x14], esi
mov dword [0x100ceb6c], esi
test esi, esi
je 0x1006f10f
inc esi
xor ecx, ecx
mov eax, esi
mov dword [ebp - 0x18], esi
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
xor eax, eax
add ecx, 4
setb al
neg eax
or eax, ecx
push eax
call fcn.1008f4bc
add esp, 4
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0x27
mov dword [eax], esi
lea esi, [eax + 4]
mov eax, dword [ebp - 0x14]
push fcn.10018010
push 0x10018000
inc eax
push eax
push 4
push esi
call fcn.1008f448
mov dword [ebp - 4], 0xffffffff
mov eax, dword [0x100ceb68]
mov dword [0x100ceb68], esi
test eax, eax
je 0x1006f0e0
push fcn.10018010
lea esi, [eax - 4]
mov dword [ebp - 4], 0x28
push dword [esi]
push 4
push eax
call fcn.1008efe8
mov eax, dword [esi]
lea eax, [eax*4 + 4]
push eax
push esi
call fcn.1008efaa
mov dword [ebp - 4], 0xffffffff
add esp, 8
mov esi, dword [0x100ceb68]
test esi, esi
je 0x1006f115
mov eax, dword [0x100ceb6c]
lea eax, [eax*4 + 4]
push eax
mov eax, dword [0x100ceb64]
add eax, 0xfffffffc
push eax
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
add esi, 4
mov dword [edi], esi
mov byte [0x100ceb70], 1
mov esi, dword [0x100ceb68]
xor eax, eax
cmp byte [0x100ceb70], al
setne al
add eax, 7
cmp dword [0x100ceb64], 0
je 0x1006f13f
test esi, esi
je 0x1006f13f
cmp eax, dword [0x100ceb6c]
ja 0x1006f13f
mov dword [esi + eax*4], 0x1003c420
push 0x100aa098
call dword [0x100ce748]
mov edi, dword [0x100ce698]
mov dword [0x100cf088], edi
mov eax, dword [edi]
mov dword [0x100cf08c], eax
test eax, eax
je 0x1006f27f
xor esi, esi
nop word [eax + eax]
mov eax, dword [0x100cf08c]
mov ecx, dword [eax + esi*4]
test ecx, ecx
je 0x1006f19f
mov eax, dword [0x100b9f38]
lea edx, [ebp - 0x38]
push 0x1c
push edx
push ecx
call eax
test eax, eax
je 0x1006f19f
mov eax, dword [ebp - 0x24]
test al, 1
jne 0x1006f19f
test eax, 0x100
jne 0x1006f19f
inc esi
jmp 0x1006f170
mov dword [ebp - 0x14], esi
mov dword [0x100cf094], esi
test esi, esi
je 0x1006f27f
inc esi
xor ecx, ecx
mov eax, esi
mov dword [ebp - 0x18], esi
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
xor eax, eax
add ecx, 4
setb al
neg eax
or eax, ecx
push eax
call fcn.1008f4bc
add esp, 4
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0x2a
mov dword [eax], esi
lea esi, [eax + 4]
mov eax, dword [ebp - 0x14]
push fcn.10018010
push 0x10018000
inc eax
push eax
push 4
push esi
call fcn.1008f448
mov dword [ebp - 4], 0xffffffff
mov eax, dword [0x100cf090]
mov dword [0x100cf090], esi
test eax, eax
je 0x1006f250
push fcn.10018010
lea esi, [eax - 4]
mov dword [ebp - 4], 0x2b
push dword [esi]
push 4
push eax
call fcn.1008efe8
mov eax, dword [esi]
lea eax, [eax*4 + 4]
push eax
push esi
call fcn.1008efaa
mov dword [ebp - 4], 0xffffffff
add esp, 8
mov esi, dword [0x100cf090]
test esi, esi
je 0x1006f285
mov eax, dword [0x100cf094]
lea eax, [eax*4 + 4]
push eax
mov eax, dword [0x100cf08c]
add eax, 0xfffffffc
push eax
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
add esi, 4
mov dword [edi], esi
mov byte [0x100cf098], 1
mov esi, dword [0x100cf090]
xor eax, eax
cmp byte [0x100cf098], al
setne al
add eax, 0xd
cmp dword [0x100cf08c], 0
je 0x1006f2af
test esi, esi
je 0x1006f2af
cmp eax, dword [0x100cf094]
ja 0x1006f2af
mov dword [esi + eax*4], 0x10068c30
mov edi, dword [0x100ce69c]
mov dword [0x100ceb74], edi
mov eax, dword [edi]
mov dword [0x100ceb78], eax
test eax, eax
je 0x1006f3df
xor esi, esi
nop dword [eax]
mov eax, dword [0x100ceb78]
mov ecx, dword [eax + esi*4]
test ecx, ecx
je 0x1006f2ff
mov eax, dword [0x100b9f38]
lea edx, [ebp - 0x38]
push 0x1c
push edx
push ecx
call eax
test eax, eax
je 0x1006f2ff
mov eax, dword [ebp - 0x24]
test al, 1
jne 0x1006f2ff
test eax, 0x100
jne 0x1006f2ff
inc esi
jmp 0x1006f2d0
mov dword [ebp - 0x14], esi
mov dword [0x100ceb80], esi
test esi, esi
je 0x1006f3df
inc esi
xor ecx, ecx
mov eax, esi
mov dword [ebp - 0x18], esi
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
xor eax, eax
add ecx, 4
setb al
neg eax
or eax, ecx
push eax
call fcn.1008f4bc
add esp, 4
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0x2d
mov dword [eax], esi
lea esi, [eax + 4]
mov eax, dword [ebp - 0x14]
push fcn.10018010
push 0x10018000
inc eax
push eax
push 4
push esi
call fcn.1008f448
mov dword [ebp - 4], 0xffffffff
mov eax, dword [0x100ceb7c]
mov dword [0x100ceb7c], esi
test eax, eax
je 0x1006f3b0
push fcn.10018010
lea esi, [eax - 4]
mov dword [ebp - 4], 0x2e
push dword [esi]
push 4
push eax
call fcn.1008efe8
mov eax, dword [esi]
lea eax, [eax*4 + 4]
push eax
push esi
call fcn.1008efaa
mov dword [ebp - 4], 0xffffffff
add esp, 8
mov esi, dword [0x100ceb7c]
test esi, esi
je 0x1006f3e5
mov eax, dword [0x100ceb80]
lea eax, [eax*4 + 4]
push eax
mov eax, dword [0x100ceb78]
add eax, 0xfffffffc
push eax
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
add esi, 4
mov dword [edi], esi
mov byte [0x100ceb84], 1
mov esi, dword [0x100ceb7c]
xor eax, eax
cmp byte [0x100ceb84], al
setne al
add eax, 0xd
cmp dword [0x100ceb78], 0
je 0x1006f40f
test esi, esi
je 0x1006f40f
cmp eax, dword [0x100ceb80]
ja 0x1006f40f
mov dword [esi + eax*4], 0x10068d80
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x18], 0xf3c2c786
push eax
mov ecx, 0x100d3818
mov dword [ebp - 0x1c], 0x72e242a1
call fcn.100348b0
lea ecx, [ebp - 0x18]
push ecx
mov ecx, eax
call fcn.10034890
movq xmm0, qword [eax]
mov eax, dword [eax + 8]
movq qword [ebp - 0x28], xmm0
cmp byte [ebp - 0x28], 0
mov dword [ebp - 0x20], eax
jne 0x1006f45d
mov ecx, dword [ebp - 0x24]
mov eax, dword [ecx + 0x20]
mov dword [0x100cf0b4], eax
mov dword [ecx + 0x20], 0x1006d7f0
lea eax, [ebp - 0x18]
mov dword [ebp - 0x1c], 0x9ef0d03e
push eax
mov ecx, 0x100d3818
mov dword [ebp - 0x18], 0x72e242a1
call fcn.100348b0
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, eax
call fcn.10034890
movq xmm0, qword [eax]
mov eax, dword [eax + 8]
movq qword [ebp - 0x28], xmm0
cmp byte [ebp - 0x28], 0
mov dword [ebp - 0x20], eax
jne 0x1006f4ab
mov ecx, dword [ebp - 0x24]
mov eax, dword [ecx + 0x20]
mov dword [0x100cf0b8], eax
mov dword [ecx + 0x20], 0x1006d850
lea eax, [ebp - 0x18]
mov dword [ebp - 0x1c], 0x566bd764
push eax
mov ecx, 0x100d3818
mov dword [ebp - 0x18], 0x2aafa737
call fcn.100348b0
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, eax
call fcn.10034890
movq xmm0, qword [eax]
mov eax, dword [eax + 8]
movq qword [ebp - 0x28], xmm0
cmp byte [ebp - 0x28], 0
mov dword [ebp - 0x20], eax
jne 0x1006f4f9
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 0x20]
mov dword [0x100cf0bc], eax
mov dword [edx + 0x20], 0x1006da00
lea eax, [ebp - 0x18]
mov dword [ebp - 0x1c], 0x781aa1a4
push eax
mov ecx, 0x100d3818
mov dword [ebp - 0x18], 0x2aafa737
call fcn.100348b0
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, eax
call fcn.10034890
movq xmm0, qword [eax]
mov eax, dword [eax + 8]
movq qword [ebp - 0x28], xmm0
cmp byte [ebp - 0x28], 0
mov dword [ebp - 0x20], eax
jne 0x1006f547
mov ecx, dword [ebp - 0x24]
mov eax, dword [ecx + 0x20]
mov dword [0x100cf0c0], eax
mov dword [ecx + 0x20], 0x1006d9e0
cmp byte [0x100d38a0], 0
jne 0x1006f619
push 0x29
xorps xmm0, xmm0
mov dword [ebp - 0x24], 0
push str.55_8B_EC_53_8B_5D_08_56_57_FF_75_18_8B_F1
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x20], 0
movups xmmword [ebp - 0x34], xmm0
call fcn.1001dff0
mov dword [ebp - 4], 0x30
mov eax, dword [0x100ce584]
test eax, eax
je 0x1006f58d
mov edx, dword [eax + 0x50]
jmp 0x1006f58f
xor edx, edx
mov eax, dword [0x100ce57c]
test eax, eax
je 0x1006f59d
mov eax, dword [eax + 0x18]
jmp 0x1006f59f
xor eax, eax
lea ecx, [ebp - 0x34]
push ecx
push eax
lea ecx, [ebp - 0x18]
call fcn.1003d5d0
mov edi, dword [ebp - 0x18]
add esp, 8
mov ecx, dword [ebp - 0x20]
add edi, 0x7e
cmp ecx, 0xf
jbe 0x1006f5eb
mov edx, dword [ebp - 0x34]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1006f5e1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1006f5e1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.1008f417
add esp, 8
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x14]
push eax
push 0x40
push 1
push edi
mov dword [ebp - 0x14], 0
call esi
lea eax, [ebp - 0x14]
mov byte [edi], 0x3f
push eax
push dword [ebp - 0x14]
push 1
push edi
call esi
mov byte [0x100d38a0], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1008ef9c
mov esp, ebp
pop ebp
ret