Function at 0x10170c6
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc8
mov eax, dword [0x1050d74]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ecx + 4]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov esi, dword [eax]
movzx eax, byte [eax + 4]
mov dword [ebp - 0xc0], ecx
lea ecx, [eax*8]
sub ecx, eax
lea edx, [ecx*4 + 0x104eee8]
and esi, 0xfffffff
push edi
add esi, 0x1000000
mov dword [ebp - 0x20], edx
call ebx
mov edi, eax
mov eax, dword [ebp - 0x20]
add eax, 4
push eax
mov dword [ebp - 0xbc], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetLastError]
call edi
mov eax, dword [ebp - 0x20]
add dword [eax], 0xffffffff
mov dword [ebp - 0xa4], 0
jne 0x1017ab8
xor eax, eax
lea ecx, [ebp - 0xa0]
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
call esi
cmp dword [ebp - 0x9c], 0
mov dword [ebp - 0x6c], 0
jbe 0x1017a68
mov edx, dword [ebp - 0xa0]
xor eax, eax
mov dword [ebp - 0x5c], eax
lea ebx, [ebx]
mov ecx, dword [eax + edx + 4]
mov eax, dword [eax + edx]
mov edx, dword [ebp - 0x58]
and ecx, 0xfffffff
add ecx, 0x1000000
and eax, 0xfffffff
cmp ecx, edx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x28], eax
jb 0x10171b6
mov esi, dword [ebp - 0x54]
add eax, ecx
add edx, esi
cmp eax, edx
jbe 0x1017280
call ebx
cmp dword [ebp - 0x48], 0
mov esi, eax
je 0x10171dd
mov ecx, dword [ebp - 0x50]
mov edx, dword [ebp - 0x54]
lea eax, [ebp - 0x50]
push eax
mov eax, dword [ebp - 0x58]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x48], 0
cmp dword [ebp - 0x4c], 0
je 0x1017200
mov dword [ebp - 0x4c], 0
call ebx
push 0x104eba4
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0x1c]
push ecx
call edi
xor eax, eax
push esi
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
call edi
mov ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 0x28]
mov eax, ecx
lea ecx, [edx + ecx + 0xfff]
and eax, 0xfffff000
and ecx, 0xfffff000
sub ecx, eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], ecx
call ebx
mov dword [ebp - 0x1c], eax
call ebx
push 0x104eba4
mov esi, eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
call edi
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x58]
lea edx, [ebp - 0x50]
push edx
push 0x40
push eax
push ecx
mov dword [ebp - 0x4c], 1
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, eax
test esi, esi
je 0x101726f
mov dword [ebp - 0x48], 1
mov edx, dword [ebp - 0x1c]
push edx
call edi
test esi, esi
je 0x1017a5e
mov ecx, dword [ebp - 0x38]
test ecx, ecx
mov eax, dword [ebp - 0x5c]
mov edx, dword [ebp - 0xa0]
je 0x1017a5e
test dword [eax + edx], 0x10000000
mov byte [ebp - 0x15], 0xa5
jne 0x1017a41
mov ebx, dword [eax + edx + 4]
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x2c], eax
mov eax, dword [0x1002900]
and ebx, 0xfffffff
sub eax, 0x1000000
mov dword [ebp - 0xc4], ebx
mov dword [ebp - 0x20], eax
je 0x1017371
mov edx, dword [ebp - 0x28]
mov esi, dword [0x101d0a8]
sub ecx, 0x1000000
lea eax, [ecx + edx]
xor edi, edi
add esi, 0xffffffff
mov dword [ebp - 0x1c], eax
js 0x1017315
lea eax, [esi + edi]
cdq
sub eax, edx
sar eax, 1
mov edx, dword [eax*4 + 0x101d0ac]
and edx, 0xfffffff
cmp ecx, edx
jae 0x1017308
lea esi, [eax - 1]
jmp 0x101730d
jbe 0x1017313
lea edi, [eax + 1]
cmp esi, edi
jge 0x10172ea
jmp 0x1017315
mov edi, eax
cmp edi, dword [0x101d0a8]
jae 0x1017371
mov eax, dword [edi*4 + 0x101d0ac]
mov esi, eax
and esi, 0xfffffff
cmp esi, dword [ebp - 0x1c]
jae 0x1017371
mov ecx, eax
add eax, eax
add eax, eax
sar eax, 0x1e
sar ecx, 0x1e
and eax, 3
and ecx, 3
xor edx, edx
sub eax, 1
je 0x1017358
sub eax, 1
je 0x1017430
sub eax, 1
jne 0x101735b
mov edx, dword [ebp - 0x20]
sub ecx, 2
jne 0x1017366
add dword [esi + 0x1000000], edx
add edi, 1
cmp edi, dword [0x101d0a8]
jb 0x101731d
mov eax, dword [ebp - 0x2c]
test byte [eax + 0x10], 3
jne 0x101765f
mov edx, dword [0x1002900]
mov dword [ebp - 0x94], ebx
mov dword [ebp - 0x90], ebx
mov esi, dword [eax + 0x10]
mov ecx, dword [eax]
mov edi, dword [eax + 4]
shr esi, 2
and ecx, 0xfffffff
shr edi, 8
and esi, 0xfffffff
add ecx, 0x1000000
mov eax, 0x1000000
and edi, 0x7f
sub eax, edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x40], eax
jne 0x1017437
mov eax, 0x8421085
mul edi
mov eax, edi
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 6
imul eax, eax, 0x7c
sub edi, eax
lea edx, [ebp - 0x84]
push edx
mov edx, dword [edi*4 + 0x1038b60]
lea eax, [ecx + esi]
push eax
push ecx
lea ecx, [ebp - 0x94]
push ecx
mov byte [ebp - 0x84], 0
mov byte [ebp - 0x83], 1
mov byte [ebp - 0x82], 2
mov byte [ebp - 0x81], 3
mov byte [ebp - 0x80], 4
mov byte [ebp - 0x7f], 5
call edx
mov edx, dword [ebp - 0x94]
mov edi, dword [ebp - 0x90]
mov dword [ebp - 0x34], edx
jmp 0x1017668
xor edx, edx
jmp 0x101735b
mov edx, dword [0x100003c]
mov eax, ecx
sub eax, 0x1000000
mov ecx, eax
mov ebx, eax
add eax, esi
mov esi, eax
and esi, 0xfffff000
sub eax, esi
mov dword [ebp - 0xb8], esi
mov esi, dword [edx + 0x10000a0]
mov dword [ebp - 0xb4], eax
mov eax, dword [edx + 0x10000a4]
add esi, 0x1000000
and ecx, 0xfffff000
add eax, esi
sub ebx, ecx
cmp esi, eax
mov dword [ebp - 0xb0], eax
je 0x1017494
lea esp, [esp]
cmp dword [esi], ecx
jae 0x1017494
add esi, dword [esi + 4]
cmp esi, eax
jne 0x1017489
xor edx, edx
cmp esi, eax
je 0x10174c2
cmp dword [esi], ecx
jne 0x10174c2
mov ecx, dword [esi + 4]
sub ecx, 8
shr ecx, 1
mov dword [ebp - 0x1c], ecx
je 0x10174c2
movzx ecx, word [esi + edx*2 + 8]
and ecx, 0xfff
cmp ecx, ebx
jae 0x10174c2
add edx, 1
cmp edx, dword [ebp - 0x1c]
jne 0x10174ab
mov ecx, dword [ebp - 0x2c]
jmp 0x10174cd
mov eax, dword [ebp - 0xb0]
cmp esi, eax
je 0x10175e6
mov ebx, dword [esi]
cmp ebx, dword [ebp - 0xb8]
ja 0x10175e6
lea esp, [esp]
mov ebx, dword [esi + 4]
add ebx, 0xfffffff8
shr ebx, 1
cmp edx, ebx
jne 0x101750f
add esi, dword [esi + 4]
cmp esi, eax
je 0x10175e6
mov edx, dword [ebp - 0xb8]
cmp dword [esi], edx
ja 0x10175e6
xor edx, edx
jmp 0x10174e6
mov ebx, dword [esi]
cmp ebx, dword [ebp - 0xb8]
jne 0x101752f
movzx eax, word [esi + edx*2 + 8]
and eax, 0xfff
cmp eax, dword [ebp - 0xb4]
jae 0x10175e6
mov eax, edx
movzx eax, word [esi + eax*2 + 8]
add edx, 1
test eax, 0xf000
mov dword [ebp - 0xa8], edx
je 0x10174c7
and eax, 0xfff
lea ebx, [eax + ebx + 0x1000000]
mov eax, 0x8421085
mul edi
mov eax, edi
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 6
imul eax, eax, 0x7c
mov edx, edi
sub edx, eax
lea eax, [edx*4 + 0x1038b60]
lea edx, [ebp - 0x74]
push edx
mov edx, dword [eax]
push ebx
push ecx
lea ecx, [ebp - 0x94]
push ecx
mov byte [ebp - 0x74], 0
mov byte [ebp - 0x73], 1
mov byte [ebp - 0x72], 2
mov byte [ebp - 0x71], 3
mov byte [ebp - 0x70], 4
mov byte [ebp - 0x6f], 5
mov dword [ebp - 0x1c], eax
call edx
mov eax, dword [ebx]
sub eax, dword [ebp - 0x40]
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x7c]
push eax
push ecx
mov ecx, dword [ebp - 0x1c]
lea edx, [ebp - 0x14]
push edx
mov edx, dword [ecx]
lea eax, [ebp - 0x94]
push eax
mov byte [ebp - 0x7c], 0
mov byte [ebp - 0x7b], 1
mov byte [ebp - 0x7a], 2
mov byte [ebp - 0x79], 3
mov byte [ebp - 0x78], 4
mov byte [ebp - 0x77], 5
call edx
mov edx, dword [ebp - 0xa8]
lea ecx, [ebx + 4]
jmp 0x10174c7
mov eax, 0x8421085
mul edi
mov eax, edi
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 6
imul eax, eax, 0x7c
sub edi, eax
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x8c]
push edx
mov edx, dword [ebp - 0x2c]
add edx, eax
push edx
push ecx
mov ecx, dword [edi*4 + 0x1038b60]
lea eax, [ebp - 0x94]
push eax
mov byte [ebp - 0x8c], 0
mov byte [ebp - 0x8b], 1
mov byte [ebp - 0x8a], 2
mov byte [ebp - 0x89], 3
mov byte [ebp - 0x88], 4
mov byte [ebp - 0x87], 5
call ecx
mov edx, dword [ebp - 0x94]
mov ebx, dword [ebp - 0xc4]
mov edi, dword [ebp - 0x90]
mov dword [ebp - 0x34], edx
jmp 0x1017668
mov ecx, dword [eax + 8]
mov edi, dword [eax + 0xc]
mov dword [ebp - 0x34], ecx
mov esi, dword [ebp - 0x38]
mov dword [ebp - 0x68], ebx
mov eax, ebx
mov ebx, dword [ebp - 0x28]
xor ecx, ecx
and ebx, 7
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x20], ebx
je 0x1017853
xor eax, eax
cmp ebx, ecx
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x24], eax
jle 0x10176d9
lea edx, [ecx + 0x38]
lea esp, [esp]
cmp eax, 4
mov al, byte [esi]
jge 0x10176b9
xor byte [ebp - 0x15], al
movzx eax, al
lea ecx, [edx - 0x20]
shl eax, cl
or dword [ebp - 0x64], eax
jmp 0x10176c6
xor byte [ebp - 0x15], al
movzx eax, al
mov ecx, edx
shl eax, cl
or dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x24]
add eax, 1
add esi, 1
sub edx, 8
cmp eax, ebx
mov dword [ebp - 0x24], eax
jl 0x10176a2
mov eax, dword [ebp - 0x34]
movzx ebx, word [ebp - 0x2e]
mov dword [ebp - 0x24], ebx
mov ecx, eax
xor ecx, edi
mov edx, ecx
xor edx, edi
sub eax, edx
xor eax, dword [ebp - 0xc4]
movzx edx, di
mov ebx, eax
ror ebx, 1
xor ebx, edx
imul ebx, dword [ebp - 0x24]
xor ecx, ebx
movzx edx, word [ebp - 0x32]
mov ebx, ecx
xor ebx, edi
ror ebx, 1
imul ebx, edx
mov edx, ecx
ror edx, 1
xor ebx, edx
movzx edx, word [ebp - 0x34]
xor eax, ebx
mov dword [ebp - 0x3c], edx
mov ebx, eax
xor ebx, edi
ror ebx, 1
imul ebx, edx
mov edx, eax
ror edx, 1
sub ebx, edx
xor ecx, ebx
mov edx, ecx
mov ebx, ecx
xor ebx, dword [ebp - 0x3c]
mov dword [ebp - 0x68], ecx
movzx ecx, word [ebp - 0x2e]
imul ebx, ecx
ror edx, 1
add edx, ebx
xor eax, edx
mov edx, eax
xor edx, ecx
movzx ecx, di
imul edx, ecx
mov ecx, eax
shr ecx, 1
add edx, ecx
mov ecx, dword [ebp - 0x68]
xor ecx, edx
movzx edx, word [ebp - 0x32]
mov ebx, ecx
sub ebx, edi
ror ebx, 1
imul ebx, edx
mov edx, ecx
ror edx, 1
add ebx, edx
movzx edx, word [ebp - 0x34]
xor eax, ebx
mov ebx, edi
sub ebx, eax
ror ebx, 1
imul ebx, edx
mov dword [ebp - 0x3c], edx
mov edx, eax
ror edx, 1
xor ebx, edx
xor ecx, ebx
mov edx, ecx
ror edx, 2
mov ebx, edx
movzx edx, word [ebp - 0x2e]
sub ebx, edx
mov edx, ebx
movzx ebx, di
imul edx, ebx
xor eax, edx
mov edx, eax
sub edx, ebx
xor edx, ecx
xor edx, dword [ebp - 0x34]
mov ecx, edx
xor ecx, ebx
mov ebx, ecx
movzx ecx, word [ebp - 0x32]
imul ebx, ecx
mov ecx, edx
shr ecx, 1
xor ebx, ecx
xor eax, ebx
mov ecx, edi
sub ecx, eax
ror ecx, 0xe
imul ecx, dword [ebp - 0x3c]
mov ebx, eax
xor eax, dword [ebp - 0x60]
ror ebx, 0x1b
add ecx, ebx
xor ecx, dword [ebp - 0x64]
mov ebx, dword [ebp - 0x20]
xor edx, ecx
xor ecx, ecx
test ebx, ebx
mov dword [ebp - 0x68], edx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], ecx
jle 0x1017822
lea ebx, [ebx]
cmp ecx, 4
mov ebx, dword [ebp - 0x40]
jge 0x1017801
mov ecx, dword [ebp - 0x38]
rol ecx, 8
mov dword [ebp - 0x38], ecx
jmp 0x101780a
mov ecx, dword [ebp - 0x2c]
rol ecx, 8
mov dword [ebp - 0x2c], ecx
mov byte [ebx], cl
mov ecx, dword [ebp - 0x24]
add ebx, 1
mov dword [ebp - 0x40], ebx
mov ebx, dword [ebp - 0x20]
add ecx, 1
cmp ecx, ebx
mov dword [ebp - 0x24], ecx
jl 0x10177ee
add ebx, 0xfffffffc
test ebx, ebx
jle 0x101783c
mov ecx, 4
sub ecx, ebx
add ecx, ecx
add ecx, ecx
add ecx, ecx
shr eax, cl
shl eax, cl
jmp 0x1017853
xor eax, eax
test ebx, ebx
jge 0x1017853
neg ebx
add ebx, ebx
add ebx, ebx
add ebx, ebx
mov ecx, ebx
shr edx, cl
shl edx, cl
mov dword [ebp - 0x68], edx
mov ecx, dword [ebp - 0x28]
shr ecx, 3
je 0x1017a12
movzx edx, word [ebp - 0x34]
mov dword [ebp - 0x3c], edx
movzx edx, word [ebp - 0x32]
mov dword [ebp - 0x20], edx
movzx edx, di
mov dword [ebp - 0x28], edx
movzx edx, word [ebp - 0x2e]
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x1c], ecx
nop
mov cl, byte [esi]
mov dl, byte [esi + 1]
xor ebx, ebx
mov bh, cl
add esi, 8
mov bl, dl
movzx edx, byte [esi - 6]
shl ebx, 8
or ebx, edx
movzx edx, byte [esi - 5]
shl ebx, 8
or ebx, edx
mov dl, byte [esi - 4]
mov dword [ebp - 0x38], ebx
xor ebx, ebx
mov bh, dl
movzx edx, byte [esi - 2]
mov bl, byte [esi - 3]
shl ebx, 8
or ebx, edx
mov dl, byte [esi - 1]
mov byte [ebp - 0x41], dl
xor cl, byte [ebp - 0x41]
movzx edx, dl
xor cl, byte [esi - 2]
shl ebx, 8
xor cl, byte [esi - 3]
or edx, ebx
xor cl, byte [esi - 4]
xor eax, edx
xor cl, byte [esi - 5]
mov dword [ebp - 0x2c], edx
xor cl, byte [esi - 6]
mov edx, eax
xor cl, byte [esi - 7]
xor byte [ebp - 0x15], cl
mov ecx, edi
sub ecx, eax
ror ecx, 0xe
imul ecx, dword [ebp - 0x3c]
ror edx, 0x1b
add ecx, edx
xor ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 0x68]
xor edx, ecx
mov ecx, edx
xor ecx, dword [ebp - 0x28]
mov ebx, edx
imul ecx, dword [ebp - 0x20]
shr ebx, 1
xor ecx, ebx
xor eax, ecx
mov ecx, eax
sub ecx, dword [ebp - 0x28]
xor ecx, edx
xor ecx, dword [ebp - 0x34]
mov edx, ecx
ror edx, 2
sub edx, dword [ebp - 0x24]
imul edx, dword [ebp - 0x28]
xor eax, edx
mov edx, edi
sub edx, eax
ror edx, 1
imul edx, dword [ebp - 0x3c]
mov ebx, eax
ror ebx, 1
xor edx, ebx
xor ecx, edx
mov edx, ecx
sub edx, edi
ror edx, 1
imul edx, dword [ebp - 0x20]
mov edi, ecx
ror edi, 1
add edx, edi
xor eax, edx
mov edx, eax
xor edx, dword [ebp - 0x24]
mov edi, eax
imul edx, dword [ebp - 0x28]
shr edi, 1
add edx, edi
xor ecx, edx
mov edi, ecx
xor edi, dword [ebp - 0x3c]
mov edx, ecx
imul edi, dword [ebp - 0x24]
ror edx, 1
add edx, edi
mov edi, dword [ebp - 0x30]
xor eax, edx
movzx edx, word [ebp - 0x34]
mov dword [ebp - 0x3c], edx
mov ebx, eax
xor ebx, edi
ror ebx, 1
imul ebx, edx
mov edx, eax
ror edx, 1
sub ebx, edx
xor ecx, ebx
mov edx, ecx
xor edx, edi
ror edx, 1
imul edx, dword [ebp - 0x20]
mov ebx, ecx
ror ebx, 1
xor edx, ebx
xor eax, edx
mov ebx, eax
ror ebx, 1
movzx edx, di
xor ebx, edx
imul ebx, dword [ebp - 0x24]
xor ecx, ebx
mov ebx, dword [ebp - 0x34]
mov dword [ebp - 0x28], edx
mov edx, ecx
xor edx, edi
sub ebx, edx
mov edx, dword [ebp - 0x64]
xor eax, ebx
xor edx, eax
xor eax, dword [ebp - 0x60]
xor edx, ecx
xor edx, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x40]
xor edx, edi
mov byte [ecx + 3], dl
ror edx, 8
mov byte [ecx + 7], al
mov byte [ecx + 2], dl
ror eax, 8
ror edx, 8
mov byte [ecx + 6], al
mov byte [ecx + 1], dl
ror eax, 8
ror edx, 8
mov byte [ecx + 5], al
mov byte [ecx], dl
ror eax, 8
ror edx, 8
mov dword [ebp - 0x68], edx
mov edx, dword [ebp - 0x38]
mov byte [ecx + 4], al
mov dword [ebp - 0x64], edx
mov edx, dword [ebp - 0x2c]
add ecx, 8
ror eax, 8
sub dword [ebp - 0x1c], 1
mov dword [ebp - 0x60], edx
mov dword [ebp - 0x40], ecx
jne 0x101787e
mov ecx, dword [ebp - 0xa0]
mov eax, dword [ebp - 0x5c]
or dword [eax + ecx], 0x10000000
mov dl, byte [ebp - 0x15]
mov ecx, dword [ebp - 0xa0]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [eax + ecx + 8], dl
mov edx, dword [ebp - 0xa0]
mov ecx, dword [ebp - 0x6c]
add ecx, 1
add eax, 0xc
cmp ecx, dword [ebp - 0x9c]
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x5c], eax
jb 0x1017182
jmp 0x1017a68
mov dword [ebp - 0xa4], 0x8007000e
call ebx
xor esi, esi
cmp dword [ebp - 0x48], esi
mov dword [ebp - 0x6c], eax
je 0x1017a8d
mov ecx, dword [ebp - 0x50]
mov edx, dword [ebp - 0x54]
lea eax, [ebp - 0x50]
push eax
mov eax, dword [ebp - 0x58]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x48], esi
cmp dword [ebp - 0x4c], esi
je 0x1017aa9
mov dword [ebp - 0x4c], esi
call ebx
push 0x104eba4
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push esi
call edi
xor esi, esi
mov ecx, dword [ebp - 0x6c]
push ecx
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x50], esi
call edi
call ebx
mov edx, dword [ebp - 0xbc]
push edx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push esi
call edi
mov eax, dword [ebp - 0xc0]
mov ecx, dword [ebp - 4]
add dword [eax + 4], 8
mov eax, dword [ebp - 0xa4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01035a40
mov esp, ebp
pop ebp
ret