Function at 0x1006fe70
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007d844
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x1026500c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x10265568]
xor edx, edx
mov ecx, str.left
movss xmm0, dword [eax + 0x386c]
addss xmm0, xmm0
addss xmm0, dword [eax + 0x3c9c]
movss dword [ebp - 0x14], xmm0
push dword [ebp - 0x14]
movss dword [ebp - 0x18], xmm0
push dword [ebp - 0x18]
push 0
call fcn.1003f060
add esp, 0xc
test al, al
je 0x1006ff0e
mov eax, dword [0x10265974]
test eax, eax
je 0x1006fee5
dec eax
jmp 0x1006feea
mov eax, 5
mov dword [0x10265974], eax
cmp eax, 0xffffffff
jne 0x1006ff03
cmp eax, 5
jae 0x1006fefc
inc eax
jmp 0x1006fefe
xor eax, eax
mov dword [0x10265974], eax
cmp eax, 5
setne cl
call fcn.10066120
movss xmm1, dword [0x1025ce94]
xorps xmm0, xmm0
call fcn.100153e0
mov eax, dword [0x10265974]
push dword [eax*4 + 0x10265fa4]
call fcn.1003df10
mov eax, dword [0x10265568]
add esp, 4
cmp byte [eax + 0xdcc], 0
je 0x1006ffef
movss xmm1, dword [eax + 0x3738]
xorps xmm0, xmm0
comiss xmm0, xmm1
ja 0x1006ffef
ucomiss xmm1, xmm0
lahf
test ah, 0x44
jp 0x1006ffef
xor edx, edx
mov ecx, 0x281
call fcn.10014e60
test al, al
je 0x1006ffef
xor ecx, ecx
call fcn.10008720
test al, al
je 0x1006ffef
mov ebx, dword [0x10265568]
xor edx, edx
mov esi, dword [ebx + 0x3f34]
mov ecx, dword [esi + 0x11c]
mov eax, dword [esi + 0x124]
push dword [eax + ecx*4 - 4]
mov ecx, str.nSel
call fcn.10004780
mov ecx, dword [esi]
mov edi, eax
add esp, 4
cmp dword [ecx + 0x3f68], edi
jne 0x1006ffcc
push ecx
push str.nSel
mov edx, 0xb
mov ecx, edi
call fcn.10026b10
add esp, 8
test byte [ebx + 0x5c88], 4
je 0x1006ffe8
push edi
push str.nSel
push str._popup__OpenPopup___s_____0x_08X__n
call fcn.100267a0
add esp, 0xc
mov ecx, edi
call fcn.100160e0
movss xmm1, dword [0x1025ce94]
movss xmm0, dword [0x1025ce20]
call fcn.100153e0
mov eax, dword [0x10265568]
mov edx, 1
mov ecx, str.right
movss xmm0, dword [eax + 0x386c]
addss xmm0, xmm0
addss xmm0, dword [eax + 0x3c9c]
movss dword [ebp - 0x14], xmm0
push dword [ebp - 0x14]
movss dword [ebp - 0x18], xmm0
push dword [ebp - 0x18]
push 0
call fcn.1003f060
add esp, 0xc
test al, al
je 0x10070078
mov eax, dword [0x10265974]
cmp eax, 5
jae 0x10070052
inc eax
jmp 0x10070054
xor eax, eax
mov dword [0x10265974], eax
cmp eax, 0xffffffff
jne 0x1007006d
cmp eax, 5
jae 0x10070066
inc eax
jmp 0x10070068
xor eax, eax
mov dword [0x10265974], eax
cmp eax, 5
setne cl
call fcn.10066120
movss xmm1, dword [0x1025ce94]
xorps xmm0, xmm0
call fcn.100153e0
push dword [0x10265984]
call fcn.1003df10
add esp, 4
mov ecx, str.nSel
call fcn.10016630
test al, al
je 0x10070136
xor esi, esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
mov ecx, dword [esi*4 + 0x10265fa4]
lea eax, [ebp - 0x18]
push eax
push 0
xor dl, dl
call fcn.10048c40
add esp, 8
test al, al
je 0x100700dc
cmp esi, 5
mov dword [0x10265974], esi
setne cl
call fcn.10066120
inc esi
cmp esi, 6
jl 0x100700b0
mov esi, dword [0x10265568]
mov ecx, dword [esi + 0x3f34]
cmp dword [esi + 0x4934], ecx
jne 0x1007011a
cmp byte [esi + 0x49a1], 0
je 0x1007011a
cmp dword [esi + 0x4968], 0
jne 0x1007011a
mov eax, dword [esi + 0x49a4]
and eax, 0xfffffff2
or eax, 2
mov dword [esi + 0x49a4], eax
test dword [ecx + 0xc], 0x1000000
je 0x1007012a
mov byte [esi + 0x3ec2], 1
call fcn.10012190
mov byte [esi + 0x3ec2], 0
mov edx, 0x10265988
mov ecx, 0x1025c0ac
call fcn.100402d0
mov esi, dword [0x10265568]
mov edx, dword [esi + 0x3f34]
cmp byte [edx + 0xe4], 0
jne 0x100701a9
movss xmm0, dword [esi + 0x3878]
addss xmm0, dword [edx + 0x130]
mov eax, dword [edx + 0x134]
mov ecx, dword [edx + 0x15c]
mov dword [edx + 0x12c], eax
mov eax, dword [edx + 0x158]
mov dword [edx + 0x150], eax
mov eax, dword [edx + 0x164]
movss dword [edx + 0x128], xmm0
mov dword [edx + 0x154], ecx
mov dword [edx + 0x160], eax
mov byte [edx + 0x168], 1
or dword [esi + 0x4794], 1
lea eax, [ebp - 0x1c]
push ecx
push 0x1007fbc8
push eax
push 0
push 0x1026599c
mov ecx, 0x1025c0c4
mov dword [esi + 0x479c], 0x41a00000
mov dword [ebp - 0x1c], 0x64
call fcn.10042590
mov eax, dword [0x10265568]
add esp, 0x14
mov edx, dword [eax + 0x3f34]
cmp byte [edx + 0xe4], 0
jne 0x10070242
movss xmm0, dword [eax + 0x3878]
addss xmm0, dword [edx + 0x130]
mov eax, dword [edx + 0x134]
mov ecx, dword [edx + 0x15c]
mov dword [edx + 0x12c], eax
mov eax, dword [edx + 0x158]
mov dword [edx + 0x150], eax
mov eax, dword [edx + 0x164]
movss dword [edx + 0x128], xmm0
mov dword [edx + 0x154], ecx
mov dword [edx + 0x160], eax
mov byte [edx + 0x168], 1
cmp byte [0x1026598e], 0
je 0x10070266
push dword [0x102659a4]
push dword [0x102659a0]
push str.:__d__d_
call fcn.1003df10
add esp, 0xc
jmp 0x10070279
push dword [0x102659a0]
push str.:__d_
call fcn.1003df10
add esp, 8
mov edx, 0x10265989
mov ecx, 0x1025c0e8
call fcn.100402d0
mov eax, dword [0x10265568]
mov edx, dword [eax + 0x3f34]
cmp byte [edx + 0xe4], 0
jne 0x100702eb
movss xmm0, dword [eax + 0x3878]
addss xmm0, dword [edx + 0x130]
mov eax, dword [edx + 0x134]
mov ecx, dword [edx + 0x15c]
mov dword [edx + 0x12c], eax
mov eax, dword [edx + 0x158]
mov dword [edx + 0x150], eax
mov eax, dword [edx + 0x164]
movss dword [edx + 0x128], xmm0
mov dword [edx + 0x154], ecx
mov dword [edx + 0x160], eax
mov byte [edx + 0x168], 1
mov edx, 0x1026598a
mov ecx, 0x1025c0f8
call fcn.100402d0
mov eax, dword [0x10265568]
mov edx, dword [eax + 0x3f34]
cmp byte [edx + 0xe4], 0
jne 0x1007035d
movss xmm0, dword [eax + 0x3878]
addss xmm0, dword [edx + 0x130]
mov eax, dword [edx + 0x134]
mov ecx, dword [edx + 0x15c]
mov dword [edx + 0x12c], eax
mov eax, dword [edx + 0x158]
mov dword [edx + 0x150], eax
mov eax, dword [edx + 0x164]
movss dword [edx + 0x128], xmm0
mov dword [edx + 0x154], ecx
mov dword [edx + 0x160], eax
mov byte [edx + 0x168], 1
mov edx, 0x1026598b
mov ecx, 0x1025c108
call fcn.100402d0
mov edx, 0x1026598d
mov ecx, str._100__
call fcn.100402d0
mov ecx, str._100__100__
call fcn.100629b0
mov eax, dword [0x10265568]
mov edx, dword [eax + 0x3f34]
cmp byte [edx + 0xe4], 0
jne 0x100703e8
movss xmm0, dword [eax + 0x3878]
addss xmm0, dword [edx + 0x130]
mov eax, dword [edx + 0x134]
mov ecx, dword [edx + 0x15c]
mov dword [edx + 0x12c], eax
mov eax, dword [edx + 0x158]
mov dword [edx + 0x150], eax
mov eax, dword [edx + 0x164]
movss dword [edx + 0x128], xmm0
mov dword [edx + 0x154], ecx
mov dword [edx + 0x160], eax
mov byte [edx + 0x168], 1
mov edx, 0x1026598c
mov ecx, 0x1025c17c
call fcn.100402d0
cmp byte [0x1026598c], 0
je 0x1007040a
mov ecx, 0x1025c194
call fcn.100629b0
mov edx, 0x1026598f
mov ecx, 0x1025c1c0
call fcn.100402d0
mov eax, dword [0x10265568]
mov edx, dword [eax + 0x3f34]
cmp byte [edx + 0xe4], 0
jne 0x1007047c
movss xmm0, dword [eax + 0x3878]
addss xmm0, dword [edx + 0x130]
mov eax, dword [edx + 0x134]
mov ecx, dword [edx + 0x15c]
mov dword [edx + 0x12c], eax
mov eax, dword [edx + 0x158]
mov dword [edx + 0x150], eax
mov eax, dword [edx + 0x164]
movss dword [edx + 0x128], xmm0
mov dword [edx + 0x154], ecx
mov dword [edx + 0x160], eax
mov byte [edx + 0x168], 1
push 0
lea edx, [ebp - 0x18]
mov dword [ebp - 0x18], 0
mov ecx, 0x1025ab70
mov dword [ebp - 0x14], 0
call fcn.1003ec50
add esp, 4
test al, al
je 0x1007050f
mov ebx, dword [0x10265568]
xor edx, edx
mov esi, dword [ebx + 0x3f34]
mov ecx, dword [esi + 0x11c]
mov eax, dword [esi + 0x124]
push dword [eax + ecx*4 - 4]
mov ecx, str.Start_opt
call fcn.10004780
mov ecx, dword [esi]
mov edi, eax
add esp, 4
cmp dword [ecx + 0x3f68], edi
jne 0x100704ec
push ecx
push str.Start_opt
mov edx, 0xb
mov ecx, edi
call fcn.10026b10
add esp, 8
test byte [ebx + 0x5c88], 4
je 0x10070508
push edi
push str.Start_opt
push str._popup__OpenPopup___s_____0x_08X__n
call fcn.100267a0
add esp, 0xc
mov ecx, edi
call fcn.100160e0
mov esi, dword [0x10265568]
mov edx, dword [esi + 0x3f34]
cmp byte [edx + 0xe4], 0
jne 0x10070573
movss xmm0, dword [esi + 0x3878]
addss xmm0, dword [edx + 0x130]
mov eax, dword [edx + 0x134]
mov ecx, dword [edx + 0x15c]
mov dword [edx + 0x12c], eax
mov eax, dword [edx + 0x158]
mov dword [edx + 0x150], eax
mov eax, dword [edx + 0x164]
movss dword [edx + 0x128], xmm0
mov dword [edx + 0x154], ecx
mov dword [edx + 0x160], eax
mov byte [edx + 0x168], 1
mov eax, dword [esi + 0x48b8]
cmp eax, dword [esi + 0x48c4]
jg 0x10070590
mov dword [esi + 0x47e8], 0
jmp 0x10070680
mov esi, dword [esi + 0x3f34]
mov ecx, str.Start_opt
mov edx, dword [esi + 0x11c]
mov eax, dword [esi + 0x124]
push dword [eax + edx*4 - 4]
xor edx, edx
call fcn.10004780
mov ecx, dword [esi]
mov edi, eax
add esp, 4
cmp dword [ecx + 0x3f68], edi
jne 0x100705d6
push ecx
push str.Start_opt
mov edx, 0xb
mov ecx, edi
call fcn.10026b10
add esp, 8
mov ecx, edi
call fcn.100165a0
test al, al
je 0x10070680
xor edi, edi
nop word [eax + eax]
lea esi, [edi + 0x102659b8]
test esi, esi
je 0x100705fe
mov al, byte [esi]
jmp 0x10070600
xor al, al
push ecx
mov ecx, dword [edi*4 + 0x10259a48]
push eax
push 0x1007e542
call fcn.10049ed0
add esp, 0xc
test al, al
je 0x10070626
test esi, esi
je 0x10070626
cmp byte [esi], 0
sete al
mov byte [esi], al
inc edi
cmp edi, 3
jl 0x100705f0
mov esi, dword [0x10265568]
mov ecx, dword [esi + 0x3f34]
cmp dword [esi + 0x4934], ecx
jne 0x10070664
cmp byte [esi + 0x49a1], 0
je 0x10070664
cmp dword [esi + 0x4968], 0
jne 0x10070664
mov eax, dword [esi + 0x49a4]
and eax, 0xfffffff2
or eax, 2
mov dword [esi + 0x49a4], eax
test dword [ecx + 0xc], 0x1000000
je 0x10070674
mov byte [esi + 0x3ec2], 1
call fcn.10012190
mov byte [esi + 0x3ec2], 0
mov edx, 0x10265995
mov ecx, 0x1025c1dc
call fcn.100402d0
call fcn.10048bb0
test al, al
je 0x10070add
cmp byte [0x10265bfc], 0
mov ecx, str.Copy_
jne 0x100706b9
mov edx, 0x10265990
call fcn.100402d0
jmp 0x100707b7
push 0
lea edx, [ebp - 0x18]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
call fcn.1003ec50
add esp, 4
test al, al
je 0x100707b7
call fcn.10066940
test al, al
je 0x100707a4
cmp dword [0x10266e20], 1
je 0x100707b7
mov dword [0x10266e20], 1
xor ecx, ecx
mov dword [0x1026557c], 0
mov dword [0x10265578], 0x10266e20
mov dword [0x10265580], 0
mov al, byte [ecx + 0x1025c210]
lea ecx, [ecx + 1]
mov byte [ecx + 0x10265587], al
test al, al
jne 0x10070720
mov ebx, dword [0x10265568]
xor edx, edx
mov esi, dword [ebx + 0x3f34]
mov ecx, dword [esi + 0x11c]
mov eax, dword [esi + 0x124]
push dword [eax + ecx*4 - 4]
mov ecx, 0x1025b644
call fcn.10004780
mov ecx, dword [esi]
mov edi, eax
add esp, 4
cmp dword [ecx + 0x3f68], edi
jne 0x1007077f
push ecx
push 0x1025b644
mov edx, 0xb
mov ecx, edi
call fcn.10026b10
add esp, 8
test byte [ebx + 0x5c88], 4
je 0x1007079b
push edi
push 0x1025b644
push str._popup__OpenPopup___s_____0x_08X__n
call fcn.100267a0
add esp, 0xc
mov ecx, edi
call fcn.100160e0
jmp 0x100707b7
push 0
push 0
mov edx, 0x1025c23c
xor ecx, ecx
call fcn.10062cc0
add esp, 8
mov ecx, str._Copy___
call fcn.100629b0
mov eax, dword [0x10265568]
mov edx, dword [eax + 0x3f34]
cmp byte [edx + 0xe4], 0
jne 0x10070824
movss xmm0, dword [eax + 0x3878]
addss xmm0, dword [edx + 0x130]
mov eax, dword [edx + 0x134]
mov ecx, dword [edx + 0x15c]
mov dword [edx + 0x12c], eax
mov eax, dword [edx + 0x158]
mov dword [edx + 0x150], eax
mov eax, dword [edx + 0x164]
movss dword [edx + 0x128], xmm0
mov dword [edx + 0x154], ecx
mov dword [edx + 0x160], eax
mov byte [edx + 0x168], 1
push 0
lea edx, [ebp - 0x18]
mov dword [ebp - 0x18], 0
mov ecx, 0x1025c2f8
mov dword [ebp - 0x14], 0
call fcn.1003ec50
add esp, 4
test al, al
je 0x10070864
push 0x10071060
push 0x10266e24
mov edx, 0x1025c308
mov ecx, 1
call fcn.10062cc0
add esp, 8
mov eax, dword [0x10265568]
mov edx, dword [eax + 0x3f34]
cmp byte [edx + 0xe4], 0
jne 0x100708c7
movss xmm0, dword [eax + 0x3878]
addss xmm0, dword [edx + 0x130]
mov eax, dword [edx + 0x134]
mov ecx, dword [edx + 0x15c]
mov dword [edx + 0x12c], eax
mov eax, dword [edx + 0x158]
mov dword [edx + 0x150], eax
mov eax, dword [edx + 0x164]
movss dword [edx + 0x128], xmm0
mov dword [edx + 0x154], ecx
mov dword [edx + 0x160], eax
mov byte [edx + 0x168], 1
mov edx, 0x10265991
mov ecx, str.Ctrl
call fcn.100402d0
mov edx, 0x1026598e
mov ecx, 0x1025c364
call fcn.100402d0
test al, al
je 0x100708fe
mov eax, dword [0x102659a0]
xor ecx, ecx
cmp byte [0x1026598e], cl
cmove eax, ecx
mov dword [0x102659a0], eax
mov edi, dword [0x10265568]
mov edx, dword [edi + 0x3f34]
cmp byte [edx + 0xe4], 0
jne 0x10070968
movss xmm0, dword [edi + 0x3878]
addss xmm0, dword [edx + 0x130]
mov eax, dword [edx + 0x134]
mov ecx, dword [edx + 0x15c]
mov dword [edx + 0x12c], eax
mov eax, dword [edx + 0x158]
mov dword [edx + 0x150], eax
mov eax, dword [edx + 0x164]
movss dword [edx + 0x128], xmm0
mov dword [edx + 0x154], ecx
mov dword [edx + 0x160], eax
mov byte [edx + 0x168], 1
mov edx, dword [edi + 0x3f34]
lea esi, [edx + 0x1d8]
push esi
lea ecx, [edx + 0x1e0]
call fcn.10026d20
push ecx
push 0x1007fbc8
lea eax, [ebp - 0x1c]
mov dword [esi], 0x41a00000
and dword [edi + 0x4794], 0xfffffffe
mov ecx, str.bRound
push eax
push 0
push 0x102659a4
mov dword [ebp - 0x1c], 0x64
call fcn.10042590
mov edi, dword [0x10265568]
add esp, 0x14
mov edx, dword [edi + 0x3f34]
cmp byte [edx + 0xe4], 0
jne 0x10070a16
movss xmm0, dword [edi + 0x3878]
addss xmm0, dword [edx + 0x130]
mov eax, dword [edx + 0x134]
mov ecx, dword [edx + 0x15c]
mov dword [edx + 0x12c], eax
mov eax, dword [edx + 0x158]
mov dword [edx + 0x150], eax
mov eax, dword [edx + 0x164]
movss dword [edx + 0x128], xmm0
mov dword [edx + 0x154], ecx
mov dword [edx + 0x160], eax
mov byte [edx + 0x168], 1
mov edx, dword [edi + 0x3f34]
mov byte [edx + 0xe1], 1
mov edx, dword [edi + 0x3f34]
mov ecx, dword [edx + 0x1e0]
mov eax, dword [edx + 0x1e8]
mov eax, dword [eax + ecx*4 - 4]
mov dword [edx + 0x1d8], eax
lea eax, [ecx - 1]
mov dword [edx + 0x1e0], eax
mov ecx, dword [edi + 0x3f34]
lea esi, [ecx + 0x1d8]
add ecx, 0x1e0
push esi
call fcn.10026d20
mov dword [esi], 0x42a00000
mov edx, 0x1025c384
and dword [edi + 0x4794], 0xfffffffe
xor esi, esi
nop
mov ecx, edx
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10070a75
sub ecx, edi
inc edx
add edx, ecx
inc esi
cmp byte [edx], al
jne 0x10070a70
push ecx
push esi
push 0x1025c384
push ecx
mov edx, 0x102659a8
mov ecx, str.combo_Round
call fcn.10041a40
mov ecx, dword [0x10265568]
add esp, 0x10
mov eax, dword [ecx + 0x3f34]
mov byte [eax + 0xe1], 1
mov edx, dword [ecx + 0x3f34]
mov ecx, dword [edx + 0x1e0]
mov eax, dword [edx + 0x1e8]
mov eax, dword [eax + ecx*4 - 4]
mov dword [edx + 0x1d8], eax
lea eax, [ecx - 1]
mov dword [edx + 0x1e0], eax
jmp 0x10070e54
mov edx, 0x102656e5
mov ecx, 0x1025c3bc
call fcn.100402d0
test al, al
je 0x10070bb3
cmp byte [0x102656e5], 0
je 0x10070ba4
cmp byte [0x10265567], 0
jne 0x10070bb3
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.kernelbase.dll
mov byte [0x10265567], 1
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10070b5f
push str.GetTickCount
push eax
call edi
mov dword [0x10266ddc], eax
call eax
mov ecx, dword [0x10266ddc]
mov edx, 0x10065320
push 5
mov dword [0x10265928], eax
mov dword [0x1026592c], eax
call fcn.10050fe0
add esp, 4
mov dword [0x102656c4], eax
push str.kernel32.dll
call esi
test eax, eax
je 0x10070b9d
push str.timeGetTime
push eax
call edi
mov dword [0x10266de0], eax
call eax
mov ecx, dword [0x10266de0]
mov edx, 0x10065340
push 9
mov dword [0x10265938], eax
mov dword [0x10265934], eax
call fcn.10050fe0
add esp, 4
mov dword [0x102656c8], eax
call fcn.100653e0
jmp 0x10070bb3
mov dword [0x10265068], 1
call fcn.10065450
mov edi, dword [0x10265568]
mov edx, dword [edi + 0x3f34]
cmp byte [edx + 0xe4], 0
jne 0x10070c1d
movss xmm0, dword [edi + 0x3878]
addss xmm0, dword [edx + 0x130]
mov eax, dword [edx + 0x134]
mov ecx, dword [edx + 0x15c]
mov dword [edx + 0x12c], eax
mov eax, dword [edx + 0x158]
mov dword [edx + 0x150], eax
mov eax, dword [edx + 0x164]
movss dword [edx + 0x128], xmm0
mov dword [edx + 0x154], ecx
mov dword [edx + 0x160], eax
mov byte [edx + 0x168], 1
mov edx, dword [edi + 0x3f34]
lea esi, [edx + 0x1d8]
push esi
lea ecx, [edx + 0x1e0]
call fcn.10026d20
sub esp, 8
mov dword [esi], 0x42480000
and dword [edi + 0x4794], 0xfffffffe
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x32
mov dword [ebp - 0x14], 1
push eax
lea eax, [ebp - 0x14]
push eax
push ecx
call fcn.10041cf0
mov esi, dword [0x10265568]
add esp, 0x14
mov eax, dword [esi + 0x3f34]
mov byte [eax + 0xe1], 1
mov edx, dword [esi + 0x3f34]
mov ecx, dword [edx + 0x1e0]
mov eax, dword [edx + 0x1e8]
mov eax, dword [eax + ecx*4 - 4]
mov dword [edx + 0x1d8], eax
lea eax, [ecx - 1]
mov dword [edx + 0x1e0], eax
mov edx, dword [esi + 0x3f34]
cmp byte [edx + 0xe4], 0
jne 0x10070cf4
movss xmm0, dword [esi + 0x3878]
addss xmm0, dword [edx + 0x130]
mov eax, dword [edx + 0x134]
mov ecx, dword [edx + 0x15c]
mov dword [edx + 0x12c], eax
mov eax, dword [edx + 0x158]
mov dword [edx + 0x150], eax
mov eax, dword [edx + 0x164]
movss dword [edx + 0x128], xmm0
mov dword [edx + 0x154], ecx
mov dword [edx + 0x160], eax
mov byte [edx + 0x168], 1
push 0
lea edx, [ebp - 0x18]
mov dword [ebp - 0x18], 0
mov ecx, 0x1025c3d0
mov dword [ebp - 0x14], 0
call fcn.1003ec50
add esp, 4
test al, al
je 0x10070d1d
call fcn.10065450
mov edx, 0x10265997
mov ecx, str.Miss__
call fcn.100402d0
mov eax, dword [0x10265568]
mov edx, dword [eax + 0x3f34]
cmp byte [edx + 0xe4], 0
jne 0x10070d8f
movss xmm0, dword [eax + 0x3878]
addss xmm0, dword [edx + 0x130]
mov eax, dword [edx + 0x134]
mov ecx, dword [edx + 0x15c]
mov dword [edx + 0x12c], eax
mov eax, dword [edx + 0x158]
mov dword [edx + 0x150], eax
mov eax, dword [edx + 0x164]
movss dword [edx + 0x128], xmm0
mov dword [edx + 0x154], ecx
mov dword [edx + 0x160], eax
mov byte [edx + 0x168], 1
mov edx, 0x10265996
mov ecx, 0x1025c3f8
call fcn.100402d0
test al, al
je 0x10070e54
cmp byte [0x10266df8], 0
jne 0x10070e54
cmp dword [0x10265570], 0
mov byte [0x10266df8], 1
jne 0x10070dd5
push 0x10051090
push 0
call dword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
mov dword [0x10265570], eax
push 0xc
call fcn.10078689
mov edi, eax
add esp, 4
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], 0
mov dword [edi], 0xa76a8a
mov dword [edi + 8], 0x10067e70
mov dword [ebp - 4], 0xffffffff
mov eax, dword [0x10265908]
mov dword [ebp - 0x14], edi
cmp eax, dword [0x1026590c]
je 0x10070e1a
mov dword [eax], edi
add dword [0x10265908], 4
jmp 0x10070e24
lea ecx, [ebp - 0x14]
push ecx
push eax
call fcn.100513c0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x1c]
push eax
push 0x40
push 1
push dword [edi]
mov dword [ebp - 0x14], 0x40
call esi
mov ecx, dword [edi]
mov al, byte [ecx]
mov byte [edi + 4], al
lea eax, [ebp - 0x14]
push eax
mov byte [ecx], 0xcc
push dword [ebp - 0x1c]
push 1
push dword [edi]
call esi
mov ecx, dword [0x10265568]
mov eax, dword [ecx + 0x3f34]
mov byte [eax + 0xe1], 1
mov eax, dword [ecx + 0x3f34]
mov ecx, dword [0x10265650]
movss xmm1, dword [eax + 0x44]
movss xmm0, dword [eax + 0x48]
subss xmm1, dword [eax + 0xac]
subss xmm0, dword [eax + 0xb0]
mov byte [eax + 0x169], 1
addss xmm1, dword [0x1025ce0c]
addss xmm0, dword [0x1025ce3c]
movss dword [eax + 0x128], xmm1
movss dword [eax + 0x12c], xmm0
call fcn.100128c0
push str.__F8:__F10:___
call fcn.1003e080
mov esi, dword [0x10265568]
add esp, 4
mov eax, dword [esi + 0x3f34]
mov ecx, dword [eax + 0x2a4]
mov edx, dword [ecx + 0x48]
sub edx, 1
mov dword [ecx + 0x48], edx
jne 0x10070ee7
xor eax, eax
jmp 0x10070eee
mov eax, dword [ecx + 0x50]
mov eax, dword [eax + edx*4 - 4]
mov dword [ecx + 0x70], eax
call fcn.100307f0
add dword [esi + 0x4888], 0xffffffff
jne 0x10070f15
mov eax, dword [0x10265568]
mov ecx, dword [eax + 0x38]
test ecx, ecx
jne 0x10070f25
mov eax, dword [eax + 0x2c]
mov eax, dword [eax + 0x44]
mov ecx, dword [eax]
jmp 0x10070f25
mov ecx, dword [esi + 0x4888]
mov eax, dword [esi + 0x4890]
mov ecx, dword [eax + ecx*4 - 4]
call fcn.10012810
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10077e95
mov esp, ebp
pop ebp
ret