Function at 0x1009d66d
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f33ed
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x80
mov eax, dword [0x101383dc]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebx + 8]
xorps xmm0, xmm0
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], 0
push 8
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
call fcn.100c30f1
lea ecx, [ebp - 0x28]
add esp, 4
mov dword [eax + 4], 0
mov dword [ebp - 0x28], eax
mov dword [eax], ecx
mov dword [ebp - 4], 0
mov eax, dword [0x10183254]
cmp eax, 4
ja case.default.0x1009d026
jmp dword [eax*4 + 0x1009dfdc]
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x18]
mov edx, dword [ebp - 0x20]
lea eax, [ecx + esi]
test al, 3
jne 0x1009d059
lea eax, [esi + 4]
shr eax, 2
cmp edx, eax
ja 0x1009d059
push ecx
lea ecx, [ebp - 0x28]
call fcn.1000c000
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
lea eax, [edx*4 - 1]
and ecx, eax
lea eax, [edx - 1]
mov dword [ebp - 0x1c], ecx
lea edi, [ecx + esi]
mov esi, edi
shr esi, 2
and esi, eax
mov eax, dword [ebp - 0x24]
cmp dword [eax + esi*4], 0
jne 0x1009d08e
push 0x10
call fcn.100c30f1
mov ecx, dword [ebp - 0x24]
add esp, 4
mov dword [ecx + esi*4], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + esi*4]
and edi, 3
mov dword [eax + edi*4], 0xb
jmp 0x1009d915
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x18]
mov edx, dword [ebp - 0x20]
lea eax, [ecx + esi]
test al, 3
jne 0x1009d0cc
lea eax, [esi + 4]
shr eax, 2
cmp edx, eax
ja 0x1009d0cc
push ecx
lea ecx, [ebp - 0x28]
call fcn.1000c000
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
lea eax, [edx*4 - 1]
and ecx, eax
lea eax, [edx - 1]
mov dword [ebp - 0x1c], ecx
lea edi, [ecx + esi]
mov esi, edi
shr esi, 2
and esi, eax
mov eax, dword [ebp - 0x24]
cmp dword [eax + esi*4], 0
jne 0x1009d101
push 0x10
call fcn.100c30f1
mov ecx, dword [ebp - 0x24]
add esp, 4
mov dword [ecx + esi*4], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + esi*4]
and edi, 3
mov dword [eax + edi*4], 7
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
inc esi
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x18], esi
lea eax, [esi + ecx]
test al, 3
jne 0x1009d13e
lea eax, [esi + 4]
shr eax, 2
cmp edx, eax
ja 0x1009d13e
push ecx
lea ecx, [ebp - 0x28]
call fcn.1000c000
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
lea eax, [edx*4 - 1]
and ecx, eax
lea eax, [edx - 1]
mov dword [ebp - 0x1c], ecx
lea edi, [ecx + esi]
mov esi, edi
shr esi, 2
and esi, eax
mov eax, dword [ebp - 0x24]
cmp dword [eax + esi*4], 0
jne 0x1009d173
push 0x10
call fcn.100c30f1
mov ecx, dword [ebp - 0x24]
add esp, 4
mov dword [ecx + esi*4], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + esi*4]
and edi, 3
mov dword [eax + edi*4], 8
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
inc esi
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x18], esi
lea eax, [esi + ecx]
test al, 3
jne 0x1009d1b0
lea eax, [esi + 4]
shr eax, 2
cmp edx, eax
ja 0x1009d1b0
push ecx
lea ecx, [ebp - 0x28]
call fcn.1000c000
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
lea eax, [edx*4 - 1]
and ecx, eax
lea eax, [edx - 1]
mov dword [ebp - 0x1c], ecx
lea edi, [ecx + esi]
mov esi, edi
shr esi, 2
and esi, eax
mov eax, dword [ebp - 0x24]
cmp dword [eax + esi*4], 0
jne 0x1009d1e5
push 0x10
call fcn.100c30f1
mov ecx, dword [ebp - 0x24]
add esp, 4
mov dword [ecx + esi*4], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + esi*4]
and edi, 3
mov dword [eax + edi*4], 9
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
inc esi
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x18], esi
lea eax, [esi + ecx]
test al, 3
jne 0x1009d222
lea eax, [esi + 4]
shr eax, 2
cmp edx, eax
ja 0x1009d222
push ecx
lea ecx, [ebp - 0x28]
call fcn.1000c000
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
lea eax, [edx*4 - 1]
and ecx, eax
lea eax, [edx - 1]
mov dword [ebp - 0x1c], ecx
lea edi, [ecx + esi]
mov esi, edi
shr esi, 2
and esi, eax
mov eax, dword [ebp - 0x24]
cmp dword [eax + esi*4], 0
jne 0x1009d257
push 0x10
call fcn.100c30f1
mov ecx, dword [ebp - 0x24]
add esp, 4
mov dword [ecx + esi*4], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + esi*4]
and edi, 3
mov dword [eax + edi*4], 0xa
jmp 0x1009d915
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x18]
mov edx, dword [ebp - 0x20]
lea eax, [ecx + esi]
test al, 3
jne 0x1009d295
lea eax, [esi + 4]
shr eax, 2
cmp edx, eax
ja 0x1009d295
push ecx
lea ecx, [ebp - 0x28]
call fcn.1000c000
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
lea eax, [edx*4 - 1]
and ecx, eax
lea eax, [edx - 1]
mov dword [ebp - 0x1c], ecx
lea edi, [ecx + esi]
mov esi, edi
shr esi, 2
and esi, eax
mov eax, dword [ebp - 0x24]
cmp dword [eax + esi*4], 0
jne 0x1009d2ca
push 0x10
call fcn.100c30f1
mov ecx, dword [ebp - 0x24]
add esp, 4
mov dword [ecx + esi*4], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + esi*4]
and edi, 3
mov dword [eax + edi*4], 0
jmp 0x1009d915
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x18]
mov edx, dword [ebp - 0x20]
lea eax, [ecx + esi]
test al, 3
jne 0x1009d308
lea eax, [esi + 4]
shr eax, 2
cmp edx, eax
ja 0x1009d308
push ecx
lea ecx, [ebp - 0x28]
call fcn.1000c000
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
lea eax, [edx*4 - 1]
and ecx, eax
lea eax, [edx - 1]
mov dword [ebp - 0x1c], ecx
lea edi, [ecx + esi]
mov esi, edi
shr esi, 2
and esi, eax
mov eax, dword [ebp - 0x24]
cmp dword [eax + esi*4], 0
jne 0x1009d33d
push 0x10
call fcn.100c30f1
mov ecx, dword [ebp - 0x24]
add esp, 4
mov dword [ecx + esi*4], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + esi*4]
and edi, 3
mov dword [eax + edi*4], 0xc
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
inc esi
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x18], esi
lea eax, [esi + ecx]
test al, 3
jne 0x1009d37a
lea eax, [esi + 4]
shr eax, 2
cmp edx, eax
ja 0x1009d37a
push ecx
lea ecx, [ebp - 0x28]
call fcn.1000c000
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
lea eax, [edx*4 - 1]
and ecx, eax
lea eax, [edx - 1]
mov dword [ebp - 0x1c], ecx
lea edi, [ecx + esi]
mov esi, edi
shr esi, 2
and esi, eax
mov eax, dword [ebp - 0x24]
cmp dword [eax + esi*4], 0
jne 0x1009d3af
push 0x10
call fcn.100c30f1
mov ecx, dword [ebp - 0x24]
add esp, 4
mov dword [ecx + esi*4], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + esi*4]
and edi, 3
mov dword [eax + edi*4], 0xd
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
inc esi
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x18], esi
lea eax, [ecx + esi]
test al, 3
jne 0x1009d3ec
lea eax, [esi + 4]
shr eax, 2
cmp edx, eax
ja 0x1009d3ec
push ecx
lea ecx, [ebp - 0x28]
call fcn.1000c000
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
lea eax, [edx*4 - 1]
and ecx, eax
lea eax, [edx - 1]
mov dword [ebp - 0x1c], ecx
lea edi, [ecx + esi]
mov esi, edi
shr esi, 2
and esi, eax
mov eax, dword [ebp - 0x24]
cmp dword [eax + esi*4], 0
jne 0x1009d421
push 0x10
call fcn.100c30f1
mov ecx, dword [ebp - 0x24]
add esp, 4
mov dword [ecx + esi*4], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + esi*4]
and edi, 3
mov dword [eax + edi*4], 0xe
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
inc esi
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x18], esi
lea eax, [ecx + esi]
test al, 3
jne 0x1009d45e
lea eax, [esi + 4]
shr eax, 2
cmp edx, eax
ja 0x1009d45e
push ecx
lea ecx, [ebp - 0x28]
call fcn.1000c000
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
lea eax, [edx*4 - 1]
and ecx, eax
lea eax, [edx - 1]
mov dword [ebp - 0x1c], ecx
lea edi, [ecx + esi]
mov esi, edi
shr esi, 2
and esi, eax
mov eax, dword [ebp - 0x24]
cmp dword [eax + esi*4], 0
jne 0x1009d493
push 0x10
call fcn.100c30f1
mov ecx, dword [ebp - 0x24]
add esp, 4
mov dword [ecx + esi*4], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + esi*4]
and edi, 3
mov dword [eax + edi*4], 0xf
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
inc esi
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x18], esi
lea eax, [ecx + esi]
test al, 3
jne 0x1009d4d0
lea eax, [esi + 4]
shr eax, 2
cmp edx, eax
ja 0x1009d4d0
push ecx
lea ecx, [ebp - 0x28]
call fcn.1000c000
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
lea eax, [edx*4 - 1]
and ecx, eax
lea eax, [edx - 1]
mov dword [ebp - 0x1c], ecx
lea edi, [ecx + esi]
mov esi, edi
shr esi, 2
and esi, eax
mov eax, dword [ebp - 0x24]
cmp dword [eax + esi*4], 0
jne 0x1009d505
push 0x10
call fcn.100c30f1
mov ecx, dword [ebp - 0x24]
add esp, 4
mov dword [ecx + esi*4], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + esi*4]
and edi, 3
mov dword [eax + edi*4], 0x10
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
inc esi
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x18], esi
lea eax, [ecx + esi]
test al, 3
jne 0x1009d542
lea eax, [esi + 4]
shr eax, 2
cmp edx, eax
ja 0x1009d542
push ecx
lea ecx, [ebp - 0x28]
call fcn.1000c000
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
lea eax, [edx*4 - 1]
and ecx, eax
lea eax, [edx - 1]
mov dword [ebp - 0x1c], ecx
lea edi, [ecx + esi]
mov esi, edi
shr esi, 2
and esi, eax
mov eax, dword [ebp - 0x24]
cmp dword [eax + esi*4], 0
jne 0x1009d577
push 0x10
call fcn.100c30f1
mov ecx, dword [ebp - 0x24]
add esp, 4
mov dword [ecx + esi*4], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + esi*4]
and edi, 3
mov dword [eax + edi*4], 0x11
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
inc esi
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x18], esi
lea eax, [ecx + esi]
test al, 3
jne 0x1009d5b4
lea eax, [esi + 4]
shr eax, 2
cmp edx, eax
ja 0x1009d5b4
push ecx
lea ecx, [ebp - 0x28]
call fcn.1000c000
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
lea eax, [edx*4 - 1]
and ecx, eax
lea eax, [edx - 1]
mov dword [ebp - 0x1c], ecx
lea edi, [ecx + esi]
mov esi, edi
shr esi, 2
and esi, eax
mov eax, dword [ebp - 0x24]
cmp dword [eax + esi*4], 0
jne 0x1009d5e9
push 0x10
call fcn.100c30f1
mov ecx, dword [ebp - 0x24]
add esp, 4
mov dword [ecx + esi*4], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + esi*4]
and edi, 3
mov dword [eax + edi*4], 0x12
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
inc esi
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x18], esi
lea eax, [ecx + esi]
test al, 3
jne 0x1009d626
lea eax, [esi + 4]
shr eax, 2
cmp edx, eax
ja 0x1009d626
push ecx
lea ecx, [ebp - 0x28]
call fcn.1000c000
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
lea eax, [edx*4 - 1]
and ecx, eax
lea eax, [edx - 1]
mov dword [ebp - 0x1c], ecx
lea edi, [ecx + esi]
mov esi, edi
shr esi, 2
and esi, eax
mov eax, dword [ebp - 0x24]
cmp dword [eax + esi*4], 0
jne 0x1009d65b
push 0x10
call fcn.100c30f1
mov ecx, dword [ebp - 0x24]
add esp, 4
mov dword [ecx + esi*4], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + esi*4]
and edi, 3
mov dword [eax + edi*4], 0x13
jmp 0x1009d915
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x18]
mov edx, dword [ebp - 0x20]
lea eax, [ecx + esi]
test al, 3
jne 0x1009d699
lea eax, [esi + 4]
shr eax, 2
cmp edx, eax
ja 0x1009d699
push ecx
lea ecx, [ebp - 0x28]
call fcn.1000c000
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
lea eax, [edx*4 - 1]
and ecx, eax
lea eax, [edx - 1]
mov dword [ebp - 0x1c], ecx
lea edi, [ecx + esi]
mov esi, edi
shr esi, 2
and esi, eax
mov eax, dword [ebp - 0x24]
cmp dword [eax + esi*4], 0
jne 0x1009d6ce
push 0x10
call fcn.100c30f1
mov ecx, dword [ebp - 0x24]
add esp, 4
mov dword [ecx + esi*4], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + esi*4]
and edi, 3
mov dword [eax + edi*4], 1
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
inc esi
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x18], esi
lea eax, [ecx + esi]
test al, 3
jne 0x1009d70b
lea eax, [esi + 4]
shr eax, 2
cmp edx, eax
ja 0x1009d70b
push ecx
lea ecx, [ebp - 0x28]
call fcn.1000c000
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
lea eax, [edx*4 - 1]
and ecx, eax
lea eax, [edx - 1]
mov dword [ebp - 0x1c], ecx
lea edi, [ecx + esi]
mov esi, edi
shr esi, 2
and esi, eax
mov eax, dword [ebp - 0x24]
cmp dword [eax + esi*4], 0
jne 0x1009d740
push 0x10
call fcn.100c30f1
mov ecx, dword [ebp - 0x24]
add esp, 4
mov dword [ecx + esi*4], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + esi*4]
and edi, 3
mov dword [eax + edi*4], 2
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
inc esi
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x18], esi
lea eax, [ecx + esi]
test al, 3
jne 0x1009d77d
lea eax, [esi + 4]
shr eax, 2
cmp edx, eax
ja 0x1009d77d
push ecx
lea ecx, [ebp - 0x28]
call fcn.1000c000
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
lea eax, [edx*4 - 1]
and ecx, eax
lea eax, [edx - 1]
mov dword [ebp - 0x1c], ecx
lea edi, [ecx + esi]
mov esi, edi
shr esi, 2
and esi, eax
mov eax, dword [ebp - 0x24]
cmp dword [eax + esi*4], 0
jne 0x1009d7b2
push 0x10
call fcn.100c30f1
mov ecx, dword [ebp - 0x24]
add esp, 4
mov dword [ecx + esi*4], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + esi*4]
and edi, 3
mov dword [eax + edi*4], 3
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
inc esi
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x18], esi
lea eax, [ecx + esi]
test al, 3
jne 0x1009d7ef
lea eax, [esi + 4]
shr eax, 2
cmp edx, eax
ja 0x1009d7ef
push ecx
lea ecx, [ebp - 0x28]
call fcn.1000c000
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
lea eax, [edx*4 - 1]
and ecx, eax
lea eax, [edx - 1]
mov dword [ebp - 0x1c], ecx
lea edi, [ecx + esi]
mov esi, edi
shr esi, 2
and esi, eax
mov eax, dword [ebp - 0x24]
cmp dword [eax + esi*4], 0
jne 0x1009d824
push 0x10
call fcn.100c30f1
mov ecx, dword [ebp - 0x24]
add esp, 4
mov dword [ecx + esi*4], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + esi*4]
and edi, 3
mov dword [eax + edi*4], 4
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
inc esi
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x18], esi
lea eax, [esi + ecx]
test al, 3
jne 0x1009d861
lea eax, [esi + 4]
shr eax, 2
cmp edx, eax
ja 0x1009d861
push ecx
lea ecx, [ebp - 0x28]
call fcn.1000c000
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
lea eax, [edx*4 - 1]
and ecx, eax
lea eax, [edx - 1]
mov dword [ebp - 0x1c], ecx
lea edi, [ecx + esi]
mov esi, edi
shr esi, 2
and esi, eax
mov eax, dword [ebp - 0x24]
cmp dword [eax + esi*4], 0
jne 0x1009d896
push 0x10
call fcn.100c30f1
mov ecx, dword [ebp - 0x24]
add esp, 4
mov dword [ecx + esi*4], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + esi*4]
and edi, 3
mov dword [eax + edi*4], 5
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
inc esi
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x18], esi
lea eax, [esi + ecx]
test al, 3
jne 0x1009d8d3
lea eax, [esi + 4]
shr eax, 2
cmp edx, eax
ja 0x1009d8d3
push ecx
lea ecx, [ebp - 0x28]
call fcn.1000c000
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
lea eax, [edx*4 - 1]
and ecx, eax
lea eax, [edx - 1]
mov dword [ebp - 0x1c], ecx
lea edi, [ecx + esi]
mov esi, edi
shr esi, 2
and esi, eax
mov eax, dword [ebp - 0x24]
cmp dword [eax + esi*4], 0
jne 0x1009d908
push 0x10
call fcn.100c30f1
mov ecx, dword [ebp - 0x24]
add esp, 4
mov dword [ecx + esi*4], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + esi*4]
and edi, 3
mov dword [eax + edi*4], 6
inc dword [ebp - 0x18]
mov esi, dword [ebp - 0x4c]
cmp byte [0x1018323c], 0
jne 0x1009d92e
call fcn.1009cdb0
jmp 0x1009dfb2
cmp dword [0x10183240], 0
je 0x1009d940
cmp byte [0x10189f97], 0
je 0x1009d924
cmp byte [0x101da118], 0
jne 0x1009d924
cmp byte [0x101da11c], 0
jne 0x1009d967
call fcn.1009e200
movd xmm1, dword [0x101da100]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x1009d924
cmp byte [0x1018324c], 0
mov ecx, 1
movzx eax, byte [0x101855a8]
cmovne eax, ecx
mov byte [0x10189f86], 1
cmp byte [0x10183259], 0
mov byte [0x101855a8], al
je 0x1009d9a4
cmp dword [0x1018d7d8], 0x1d
je 0x1009d9a4
mov word [0x101854a1], 0x101
lea eax, [esi + 4]
xorps xmm0, xmm0
movss dword [ebp - 0x74], xmm0
test eax, eax
je 0x1009d9c3
movss xmm2, dword [eax + 8]
movss xmm3, dword [eax]
movss xmm1, dword [eax + 4]
jmp 0x1009d9cc
xorps xmm2, xmm2
xorps xmm3, xmm3
xorps xmm1, xmm1
mov eax, dword [0x10188204]
movss xmm5, dword [0x1012a734]
movss xmm4, dword [0x1012a8c4]
movss dword [ebp - 0x30], xmm2
movss xmm0, dword [eax + 0x2abf0]
addss xmm0, xmm0
addss xmm3, xmm0
movss xmm0, dword [eax + 0x2abf4]
addss xmm0, xmm0
comiss xmm3, xmm5
addss xmm1, xmm0
movss dword [ebp - 0x38], xmm3
movss xmm0, dword [0x1012a7d0]
movss dword [ebp - 0x34], xmm1
jbe 0x1009da23
subss xmm3, xmm0
jmp 0x1009da2c
comiss xmm4, xmm3
jbe 0x1009da31
addss xmm3, xmm0
movss dword [ebp - 0x38], xmm3
comiss xmm1, xmm5
jbe 0x1009da3c
subss xmm1, xmm0
jmp 0x1009da45
comiss xmm4, xmm1
jbe 0x1009da4a
addss xmm1, xmm0
movss dword [ebp - 0x34], xmm1
comiss xmm2, xmm5
jbe 0x1009da55
subss xmm2, xmm0
jmp 0x1009da5e
comiss xmm4, xmm2
jbe 0x1009da63
addss xmm2, xmm0
movss dword [ebp - 0x30], xmm2
push 0
push 0
lea eax, [ebp - 0x90]
push eax
lea ecx, [ebp - 0x38]
call fcn.100858e0
movss xmm4, dword [0x1012a870]
or esi, 0xffffffff
xorps xmm5, xmm5
mov dword [ebp - 0x48], esi
xorps xmm6, xmm6
movss dword [ebp - 0x64], xmm5
xorps xmm7, xmm7
movss dword [ebp - 0x68], xmm6
movss dword [ebp - 0x6c], xmm7
xor edi, edi
movss dword [ebp - 0x58], xmm4
mov esi, 1
push 1
push esi
call fcn.100a3f50
inc esi
cmp esi, 0x20
jle 0x1009daa8
mov eax, dword [0x101da0f8]
mov edx, 1
movss xmm2, dword [0x10186aac]
mov dword [ebp - 0x54], edx
nop dword [eax + eax]
cmp edx, eax
je 0x1009dcae
jge 0x1009dae8
imul eax, edx, 0xc50
lea esi, [eax + 0x10191724]
jmp 0x1009daf7
lea eax, [edx - 2]
imul esi, eax, 0xc50
add esi, 0x10192374
test esi, esi
je 0x1009dca9
cmp byte [0x1018324c], 0
jne 0x1009db16
mov eax, dword [0x101da0fc]
cmp dword [esi + 4], eax
je 0x1009dca9
cmp byte [esi + 0x1a], 0
jne 0x1009dca9
cmp byte [0x101854be], 0
je 0x1009db33
cmp dword [esi + 0x10], 1
je 0x1009dca9
mov ecx, dword [ebp - 0x1c]
movaps xmm0, xmm2
mulss xmm0, dword [esi + 0x50]
movaps xmm1, xmm2
mov eax, dword [ebp - 0x18]
mulss xmm1, dword [esi + 0x54]
add eax, ecx
mov dword [ebp - 0x70], ecx
mulss xmm2, dword [esi + 0x58]
mov dword [ebp - 0x84], eax
addss xmm0, dword [esi + 0x5c]
addss xmm1, dword [esi + 0x60]
addss xmm2, dword [esi + 0x64]
movss dword [ebp - 0x50], xmm0
movss dword [ebp - 0x5c], xmm1
movss dword [ebp - 0x60], xmm2
cmp ecx, eax
je 0x1009dca1
mov edx, dword [ebp - 0x20]
dec edx
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x48]
movaps xmm3, xmm2
mov dword [ebp - 0x78], eax
mov eax, ecx
shr eax, 2
and ecx, 3
movss xmm2, dword [0x101da14c]
and eax, edx
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x80], edi
movss dword [ebp - 0x48], xmm4
movss dword [ebp - 0x7c], xmm4
mov eax, dword [edx + eax*4]
mov edi, dword [eax + ecx*4]
lea eax, [edi + edi*2]
addss xmm0, dword [esi + eax*4 + 0x80]
addss xmm1, dword [esi + eax*4 + 0x84]
addss xmm3, dword [esi + eax*4 + 0x88]
subss xmm0, dword [esi + 0x5c]
subss xmm1, dword [esi + 0x60]
subss xmm3, dword [esi + 0x64]
subss xmm2, xmm0
movss xmm0, dword [0x101da150]
subss xmm0, xmm1
movss xmm1, dword [0x101da154]
subss xmm1, xmm3
mulss xmm2, xmm2
mulss xmm0, xmm0
mulss xmm1, xmm1
addss xmm0, xmm2
addss xmm0, xmm1
call fcn.10002f20
movss xmm4, dword [ebp - 0x58]
comiss xmm4, xmm0
movss xmm1, dword [ebp - 0x5c]
movss xmm2, dword [ebp - 0x60]
jbe 0x1009dc51
movss xmm5, dword [ebp - 0x50]
movaps xmm4, xmm0
movaps xmm6, xmm1
movss dword [ebp - 0x58], xmm4
movaps xmm7, xmm2
movss dword [ebp - 0x64], xmm5
movss dword [ebp - 0x68], xmm6
movss dword [ebp - 0x6c], xmm7
jmp 0x1009dc60
movss xmm5, dword [ebp - 0x64]
movss xmm6, dword [ebp - 0x68]
movss xmm7, dword [ebp - 0x6c]
movss xmm3, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x70]
mov edx, dword [ebp - 0x30]
comiss xmm3, xmm0
movss xmm3, dword [ebp - 0x7c]
cmovbe edi, dword [ebp - 0x78]
comiss xmm3, xmm0
mov dword [ebp - 0x48], edi
mov edi, esi
movss xmm0, dword [ebp - 0x50]
cmovbe edi, dword [ebp - 0x80]
inc ecx
mov dword [ebp - 0x70], ecx
cmp ecx, dword [ebp - 0x84]
jne 0x1009db86
mov esi, dword [ebp - 0x48]
mov edx, dword [ebp - 0x54]
mov dword [ebp - 0x48], esi
movss xmm2, dword [0x10186aac]
mov eax, dword [0x101da0f8]
inc edx
mov dword [ebp - 0x54], edx
cmp edx, 0x20
jle 0x1009dad0
mov esi, 1
push 0
push esi
call fcn.100a3f50
inc esi
cmp esi, 0x20
jle 0x1009dcc0
mov esi, dword [ebp - 0x48]
test edi, edi
je 0x1009dfab
mov ecx, dword [ebp - 0x4c]
lea eax, [ecx + 4]
test eax, eax
je 0x1009dcfd
movss xmm0, dword [eax]
movss dword [ebp - 0x74], xmm0
movss xmm0, dword [eax + 4]
movss dword [ebp - 0x54], xmm0
movss xmm0, dword [eax + 8]
jmp 0x1009dd05
xorps xmm0, xmm0
movss dword [ebp - 0x54], xmm0
movss xmm2, dword [0x10186aac]
lea eax, [esi + esi*2]
movss dword [ebp - 0x50], xmm0
movaps xmm1, xmm2
mov dword [ebp - 0x44], 0
movaps xmm0, xmm2
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mulss xmm1, dword [edi + 0x50]
mov dword [ebp - 0x38], 0
mulss xmm0, dword [edi + 0x54]
mov dword [ebp - 0x34], 0
mulss xmm2, dword [edi + 0x58]
addss xmm1, xmm5
mov dword [ebp - 0x30], 0
addss xmm0, xmm6
addss xmm2, xmm7
addss xmm1, dword [edi + eax*4 + 0x80]
addss xmm0, dword [edi + eax*4 + 0x84]
addss xmm2, dword [edi + eax*4 + 0x88]
subss xmm1, dword [edi + 0x5c]
lea eax, [ebp - 0x38]
subss xmm0, dword [edi + 0x60]
push eax
subss xmm2, dword [edi + 0x64]
subss xmm1, dword [0x101da14c]
lea eax, [ebp - 0x90]
subss xmm0, dword [0x101da150]
push eax
subss xmm2, dword [0x101da154]
movss dword [ebp - 0x90], xmm1
movss dword [ebp - 0x8c], xmm0
movss dword [ebp - 0x88], xmm2
call fcn.100a35d0
movss xmm2, dword [ebp - 0x38]
movss xmm5, dword [0x1012a734]
comiss xmm2, xmm5
movss xmm1, dword [ebp - 0x34]
movss xmm0, dword [ebp - 0x30]
movss xmm4, dword [0x1012a8c4]
movss xmm3, dword [0x1012a7d0]
jbe 0x1009ddfc
subss xmm2, xmm3
jmp 0x1009de05
comiss xmm4, xmm2
jbe 0x1009de05
addss xmm2, xmm3
comiss xmm1, xmm5
jbe 0x1009de10
subss xmm1, xmm3
jmp 0x1009de19
comiss xmm4, xmm1
jbe 0x1009de19
addss xmm1, xmm3
comiss xmm0, xmm5
jbe 0x1009de24
subss xmm0, xmm3
jmp 0x1009de2d
comiss xmm4, xmm0
jbe 0x1009de2d
addss xmm0, xmm3
push ecx
mov dword [esp], 0
lea eax, [ebp - 0x44]
push eax
sub esp, 0xc
mov eax, esp
sub esp, 0xc
movss dword [eax + 8], xmm0
movss xmm0, dword [ebp - 0x74]
movss dword [eax], xmm2
movss dword [eax + 4], xmm1
mov eax, esp
movss dword [eax], xmm0
movss xmm0, dword [ebp - 0x54]
movss dword [eax + 4], xmm0
movss xmm0, dword [ebp - 0x50]
movss dword [eax + 8], xmm0
call fcn.1000b740
mov esi, dword [ebp - 0x4c]
push esi
call fcn.100a3c40
movss xmm0, dword [ebp - 0x44]
movss dword [esi + 4], xmm0
movss xmm0, dword [ebp - 0x40]
movss dword [esi + 8], xmm0
movss xmm0, dword [ebp - 0x3c]
push esi
movss dword [esi + 0xc], xmm0
call fcn.100a3d20
lea eax, [ebp - 0x44]
push eax
call dword [0x10188294]
movss xmm0, dword [0x10183248]
add esp, 4
divss xmm0, dword [0x1012a700]
mulss xmm0, dword [0x1012a5c8]
cvtps2pd xmm1, xmm0
movsd xmm0, qword [0x10186c58]
addsd xmm1, qword [0x1012a500]
ucomisd xmm0, xmm1
movsd qword [ebp - 0x38], xmm1
lahf
test ah, 0x44
jnp 0x1009df47
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0x1018db28
push 0x40
push 8
push dword [0x10189758]
call edi
movsd xmm0, qword [ebp - 0x38]
mulsd xmm0, qword [0x1012a5b8]
mov eax, dword [0x10189758]
push 0x1018db28
movsd qword [eax], xmm0
push dword [0x1018db28]
mov esi, dword [0x10189758]
push 8
push esi
call edi
push 8
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
movsd xmm0, qword [ebp - 0x38]
movsd qword [0x10186c58], xmm0
mov al, byte [0x101da7ab]
movzx ecx, al
test al, al
mov eax, 1
cmove ecx, eax
push str.forward
mov byte [0x101da7ab], cl
call dword [0x10188258]
add esp, 4
cmp byte [0x10183258], 0
je 0x1009df84
push str.duck
call dword [0x10188258]
add esp, 4
cmp byte [0x10183259], 0
je 0x1009dfab
cmp dword [0x1018d7d8], 0x1d
jne 0x1009df9d
push 0x10102164
jmp 0x1009dfa2
push str.attack
call dword [0x10188258]
add esp, 4
mov byte [0x101da7ab], 1
lea ecx, [ebp - 0x28]
call fcn.1000b960
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100c2ed5
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4