Function at 0x10014e90
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100a900c]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [0x100b0514]
mov byte [0x100b0515], al
test al, al
je 0x1001632b
mov ecx, dword [0x100cab48]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push esi
lea eax, [ecx + 0x4a7e0]
mov dword [ebp - 0xc], 4
mov dword [0x100b9a38], eax
lea eax, [ecx + 0x34eb0]
push edi
mov dword [0x100b9a88], eax
add ecx, 0xe18c
lea eax, [ebp - 8]
mov dword [ebp - 0x10], ecx
push eax
push 0x40
push 4
push ecx
call ebx
mov eax, dword [ebp - 0x10]
mov ecx, 0x10050350
sub ecx, eax
sub ecx, 4
mov dword [eax], ecx
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call ebx
mov eax, dword [0x100cab48]
lea ecx, [ebp - 8]
push ecx
push 0x40
add eax, 0x6744
mov dword [ebp - 0xc], 0xea
push 0xea
push eax
mov dword [ebp - 0x10], eax
call ebx
mov eax, dword [ebp - 0x10]
mov edi, 0xe856
mov esi, 0x100503c0
mov ecx, esi
mov word [eax], di
mov eax, dword [ebp - 0x10]
sub ecx, eax
sub ecx, 6
mov dword [eax + 2], ecx
mov ecx, 0x100503f0
mov eax, dword [ebp - 0x10]
sub ecx, eax
sub ecx, 0xea
mov dword [eax + 0xe6], ecx
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call ebx
mov eax, dword [0x100cab48]
lea ecx, [ebp - 8]
push ecx
push 0x40
add eax, 0x9010d
mov dword [ebp - 0xc], 0x16e
push 0x16e
push eax
mov dword [ebp - 0x10], eax
call ebx
mov eax, dword [ebp - 0x10]
mov ecx, esi
mov word [eax], di
mov eax, dword [ebp - 0x10]
sub ecx, eax
sub ecx, 6
mov dword [eax + 2], ecx
mov ecx, 0x10050460
mov eax, dword [ebp - 0x10]
sub ecx, eax
sub ecx, 0xae
mov dword [eax + 0xaa], ecx
mov eax, dword [ebp - 0x10]
mov ecx, 0xe890
mov edi, 0x100504e0
mov dword [eax + 0x160], 0xe4868b50
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x164], 0x50000000
mov eax, dword [ebp - 0x10]
mov word [eax + 0x168], cx
mov ecx, edi
mov eax, dword [ebp - 0x10]
sub ecx, eax
sub ecx, 0x16e
mov dword [eax + 0x16a], ecx
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call ebx
mov eax, dword [0x100cab48]
lea ecx, [ebp - 8]
push ecx
push 0x40
add eax, 0x83bf6
mov dword [ebp - 0xc], 0x84
push 0x84
push eax
mov dword [ebp - 0x10], eax
call ebx
mov eax, dword [ebp - 0x10]
mov ecx, esi
mov dword [eax], 0xe85690
mov eax, dword [ebp - 0x10]
sub ecx, eax
sub ecx, 7
mov dword [eax + 3], ecx
mov ecx, 0x10050510
mov eax, dword [ebp - 0x10]
sub ecx, eax
sub ecx, 0x84
mov dword [eax + 0x80], ecx
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call ebx
mov eax, dword [0x100cab48]
lea ecx, [ebp - 8]
push ecx
push 0x40
add eax, 0x847da
mov dword [ebp - 0xc], 0xb5
push 0xb5
push eax
mov dword [ebp - 0x10], eax
call ebx
mov eax, dword [ebp - 0x10]
mov ecx, esi
mov dword [eax], 0xe85690
mov eax, dword [ebp - 0x10]
sub ecx, eax
sub ecx, 7
mov dword [eax + 3], ecx
mov ecx, 0x10050560
mov eax, dword [ebp - 0x10]
sub ecx, eax
sub ecx, 0x7b
mov dword [eax + 0x77], ecx
mov ecx, 0xe890
mov eax, dword [ebp - 0x10]
mov word [eax + 0xaf], cx
mov ecx, 0x100505c0
mov eax, dword [ebp - 0x10]
sub ecx, eax
sub ecx, 0xb5
mov dword [eax + 0xb1], ecx
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call ebx
mov eax, dword [0x100cab48]
lea ecx, [ebp - 8]
push ecx
push 0x40
add eax, 0x8f096
mov dword [ebp - 0xc], 0x16a
push 0x16a
push eax
mov dword [ebp - 0x10], eax
call ebx
mov eax, dword [ebp - 0x10]
mov ecx, 0xe990
mov word [eax], cx
mov ecx, dword [0x100b003c]
mov eax, dword [ebp - 0x10]
sub ecx, eax
sub ecx, 6
mov dword [eax + 2], ecx
mov eax, dword [0x100b003c]
mov dword [eax], 0xe4b6ff
mov eax, dword [0x100b003c]
add eax, 4
mov dword [0x100b003c], eax
mov dword [eax], 0xe8560000
mov eax, dword [0x100b003c]
add eax, 4
mov dword [0x100b003c], eax
sub esi, eax
sub esi, 4
mov dword [eax], esi
mov eax, dword [0x100b003c]
add eax, 4
mov dword [0x100b003c], eax
mov dword [eax], 0xf01f883
mov eax, dword [0x100b003c]
add eax, 4
mov dword [0x100b003c], eax
mov byte [eax], 0x85
mov ecx, dword [0x100b003c]
mov eax, dword [0x100cab48]
inc ecx
sub eax, ecx
mov dword [0x100b003c], ecx
add eax, 0x8f0e2
mov dword [ecx], eax
mov eax, dword [0x100b003c]
add eax, 4
mov dword [0x100b003c], eax
mov dword [eax], 0xf4968b
mov eax, dword [0x100b003c]
add eax, 4
mov dword [0x100b003c], eax
mov dword [eax], 0xe90000
mov ecx, dword [0x100b003c]
mov eax, dword [0x100cab48]
add ecx, 3
sub eax, ecx
mov dword [0x100b003c], ecx
add eax, 0x8f098
mov dword [ecx], eax
mov ecx, 0xe856
mov eax, dword [ebp - 0x10]
add dword [0x100b003c], 4
mov word [eax + 0x6b], cx
mov ecx, 0x100505f0
mov eax, dword [ebp - 0x10]
sub ecx, eax
sub ecx, 0x71
mov dword [eax + 0x6d], ecx
mov ecx, 0xe890
mov eax, dword [ebp - 0x10]
mov dword [eax + 0xa1], 0xe4868b50
mov eax, dword [ebp - 0x10]
mov dword [eax + 0xa5], 0x50000000
mov eax, dword [ebp - 0x10]
mov word [eax + 0xa9], cx
mov eax, dword [ebp - 0x10]
sub edi, eax
sub edi, 0xaf
mov dword [eax + 0xab], edi
xor ecx, ecx
mov eax, dword [ebp - 0x10]
mov dword [eax + 0xfd], 0x441f0f66
mov eax, dword [ebp - 0x10]
mov word [eax + 0x101], cx
mov ecx, 0x10050660
mov eax, dword [ebp - 0x10]
mov byte [eax + 0x165], 0xe8
mov eax, dword [ebp - 0x10]
sub ecx, eax
sub ecx, 0x16a
mov dword [eax + 0x166], ecx
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call ebx
mov eax, dword [0x100cab48]
lea ecx, [ebp - 8]
push ecx
push 0x40
add eax, 0x74562
mov dword [ebp - 0xc], 0xaf
push 0xaf
push eax
mov dword [ebp - 0x10], eax
call ebx
mov eax, dword [ebp - 0x10]
mov edx, 0x100506d0
mov ecx, edx
mov edi, 0x1004fe20
sub ecx, eax
sub ecx, 4
mov dword [eax], ecx
mov eax, dword [ebp - 0x10]
mov byte [eax + 0x96], 0xe9
mov ecx, dword [0x100b003c]
mov eax, dword [ebp - 0x10]
sub ecx, eax
sub ecx, 0x9b
mov dword [eax + 0x97], ecx
mov eax, dword [0x100b003c]
mov byte [eax], 0xe8
mov ecx, dword [0x100b003c]
mov eax, dword [0x100cab48]
inc ecx
sub eax, ecx
mov dword [0x100b003c], ecx
add eax, 0x208fc
mov dword [ecx], eax
mov eax, dword [0x100b003c]
add eax, 4
mov dword [0x100b003c], eax
mov dword [eax], 0x850fc085
mov ecx, dword [0x100b003c]
mov eax, dword [0x100cab48]
add ecx, 4
sub eax, ecx
mov dword [0x100b003c], ecx
add eax, 0x745f9
mov dword [ecx], eax
mov eax, dword [0x100b003c]
add eax, 4
mov dword [0x100b003c], eax
mov dword [eax], 0xe80cc483
mov eax, edi
mov ecx, dword [0x100b003c]
add ecx, 4
sub eax, ecx
mov dword [0x100b003c], ecx
sub eax, 4
mov dword [ecx], eax
mov eax, dword [0x100b003c]
add eax, 4
mov dword [0x100b003c], eax
mov byte [eax], 0xe9
mov ecx, dword [0x100b003c]
inc ecx
mov dword [0x100b003c], ecx
mov eax, dword [0x100cab48]
sub eax, ecx
add eax, 0x74610
mov dword [ecx], eax
mov eax, dword [ebp - 0x10]
sub edx, eax
add dword [0x100b003c], 4
sub edx, 0xaf
mov dword [eax + 0xab], edx
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call ebx
mov eax, dword [0x100cab48]
lea ecx, [ebp - 8]
push ecx
push 0x40
add eax, 0x23b94
mov dword [ebp - 0xc], 0x4b
push 0x4b
push eax
mov dword [ebp - 0x10], eax
call ebx
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov edx, 0x10050740
mov dword [eax], 0x441f0f66
mov eax, dword [ebp - 0x10]
mov word [eax + 4], cx
mov ecx, 0xe851
mov eax, dword [ebp - 0x10]
mov word [eax + 0x13], cx
mov ecx, edx
mov eax, dword [ebp - 0x10]
sub ecx, eax
sub ecx, 0x19
mov dword [eax + 0x15], ecx
mov ecx, 0xe850
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x2e], 0x441f0f
mov eax, dword [ebp - 0x10]
mov byte [eax + 0x32], 0
mov eax, dword [ebp - 0x10]
mov word [eax + 0x45], cx
mov eax, dword [ebp - 0x10]
sub edx, eax
sub edx, 0x4b
mov dword [eax + 0x47], edx
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call ebx
mov eax, dword [0x100cab48]
lea ecx, [ebp - 8]
push ecx
push 0x40
add eax, 0x22d54
mov dword [ebp - 0xc], 0xc
push 0xc
push eax
mov dword [ebp - 0x10], eax
call ebx
mov eax, dword [ebp - 0x10]
mov ecx, 0xe85b
mov word [eax], cx
mov ecx, 0x10050770
mov eax, dword [ebp - 0x10]
sub ecx, eax
sub ecx, 6
mov dword [eax + 2], ecx
mov ecx, 0xc300
mov eax, dword [ebp - 0x10]
mov dword [eax + 6], 0x1b8
mov eax, dword [ebp - 0x10]
mov word [eax + 0xa], cx
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call ebx
mov eax, dword [0x100cab48]
lea ecx, [ebp - 8]
push ecx
push 0x40
add eax, 0x3e0b
mov dword [ebp - 0xc], 0x107
push 0x107
push eax
mov dword [ebp - 0x10], eax
call ebx
mov eax, dword [ebp - 0x10]
mov edx, 0x100509b0
mov ecx, edx
sub ecx, eax
sub ecx, 5
mov dword [eax + 1], ecx
mov eax, dword [ebp - 0x10]
sub edx, eax
sub edx, 0x107
mov dword [eax + 0x103], edx
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call ebx
mov eax, dword [0x100cab48]
lea ecx, [ebp - 8]
push ecx
push 0x40
add eax, 0x870f7
mov dword [ebp - 0xc], 4
push 4
push eax
mov dword [ebp - 0x10], eax
call ebx
mov eax, dword [ebp - 0x10]
mov ecx, 0x10050a60
sub ecx, eax
sub ecx, 4
mov dword [eax], ecx
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call ebx
mov eax, dword [0x100cab48]
lea ecx, [ebp - 8]
push ecx
push 0x40
add eax, 0x3f56
mov dword [ebp - 0xc], 4
push 4
push eax
mov dword [ebp - 0x10], eax
call ebx
mov eax, dword [ebp - 0x10]
mov esi, 0x10050b00
mov ecx, esi
sub ecx, eax
sub ecx, 4
mov dword [eax], ecx
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call ebx
mov eax, dword [0x100cab48]
lea ecx, [ebp - 8]
push ecx
add eax, 0x87140
mov dword [ebp - 0xc], 4
push 0x40
mov dword [ebp - 0x10], eax
push 4
push eax
call ebx
mov eax, dword [ebp - 0x10]
sub esi, eax
sub esi, 4
mov dword [eax], esi
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call ebx
mov eax, dword [0x100cab48]
lea ecx, [ebp - 8]
push ecx
push 0x40
add eax, 0x3476
mov dword [ebp - 0xc], 5
push 5
push eax
mov dword [ebp - 0x10], eax
call ebx
mov eax, dword [ebp - 0x10]
mov byte [eax], 0xe9
mov ecx, dword [0x100b003c]
mov eax, dword [ebp - 0x10]
sub ecx, eax
sub ecx, 5
mov dword [eax + 1], ecx
mov eax, dword [0x100b003c]
mov byte [eax], 0xe8
mov ecx, dword [0x100b003c]
mov eax, dword [0x100cab48]
inc ecx
sub eax, ecx
mov dword [0x100b003c], ecx
add eax, 0x207fc
mov dword [ecx], eax
mov ecx, 0xd8f7
mov eax, dword [0x100b003c]
add eax, 4
mov dword [0x100b003c], eax
mov word [eax], cx
mov eax, dword [0x100b003c]
add eax, 2
mov dword [0x100b003c], eax
mov dword [eax], 0xa302c083
mov eax, dword [0x100b003c]
add eax, 4
mov dword [0x100b003c], eax
mov dword [eax], 0x100b9b20
mov eax, dword [0x100b003c]
add eax, 4
mov dword [0x100b003c], eax
mov byte [eax], 0xe9
mov ecx, dword [0x100b003c]
mov eax, dword [0x100cab48]
inc ecx
sub eax, ecx
mov dword [0x100b003c], ecx
add eax, 0x3477
mov dword [ecx], eax
lea eax, [ebp - 8]
add dword [0x100b003c], 4
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call ebx
mov eax, dword [0x100cab48]
lea ecx, [ebp - 8]
push ecx
push 0x40
add eax, 0x3188
mov dword [ebp - 0xc], 5
push 5
push eax
mov dword [ebp - 0x10], eax
call ebx
mov eax, dword [ebp - 0x10]
mov byte [eax], 0xe9
mov ecx, dword [0x100b003c]
mov eax, dword [ebp - 0x10]
sub ecx, eax
sub ecx, 5
mov dword [eax + 1], ecx
mov eax, dword [0x100b003c]
mov byte [eax], 0xe8
mov ecx, dword [0x100b003c]
mov eax, dword [0x100cab48]
inc ecx
sub eax, ecx
mov dword [0x100b003c], ecx
add eax, 0x4d29c
mov dword [ecx], eax
mov eax, dword [0x100b003c]
add eax, 4
mov dword [0x100b003c], eax
mov byte [eax], 0xa3
mov eax, dword [0x100b003c]
inc eax
mov dword [0x100b003c], eax
mov dword [eax], 0x100b9b20
mov eax, dword [0x100b003c]
add eax, 4
mov dword [0x100b003c], eax
mov byte [eax], 0xe9
mov ecx, dword [0x100b003c]
mov eax, dword [0x100cab48]
inc ecx
sub eax, ecx
mov dword [0x100b003c], ecx
add eax, 0x3189
mov dword [ecx], eax
lea eax, [ebp - 8]
add dword [0x100b003c], 4
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call ebx
mov eax, dword [0x100cab48]
lea ecx, [ebp - 8]
push ecx
push 0x40
add eax, 0x325e
mov dword [ebp - 0xc], 5
push 5
push eax
mov dword [ebp - 0x10], eax
call ebx
mov eax, dword [ebp - 0x10]
mov byte [eax], 0xe9
mov ecx, dword [0x100b003c]
mov eax, dword [ebp - 0x10]
sub ecx, eax
sub ecx, 5
mov dword [eax + 1], ecx
mov eax, dword [0x100b003c]
mov byte [eax], 0xe8
mov ecx, dword [0x100b003c]
mov eax, dword [0x100cab48]
inc ecx
sub eax, ecx
mov dword [0x100b003c], ecx
add eax, 0x208fc
mov dword [ecx], eax
mov eax, dword [0x100b003c]
add eax, 4
mov dword [0x100b003c], eax
mov byte [eax], 0xa3
mov eax, dword [0x100b003c]
inc eax
mov dword [0x100b003c], eax
mov dword [eax], 0x100b9b20
mov eax, dword [0x100b003c]
add eax, 4
mov dword [0x100b003c], eax
mov byte [eax], 0xe9
mov ecx, dword [0x100b003c]
inc ecx
mov dword [0x100b003c], ecx
mov eax, dword [0x100cab48]
sub eax, ecx
add eax, 0x325f
mov dword [ecx], eax
lea eax, [ebp - 8]
add dword [0x100b003c], 4
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call ebx
mov eax, dword [0x100cab48]
lea ecx, [ebp - 8]
push ecx
push 0x40
add eax, 0x1fa0
mov dword [ebp - 0xc], 0x52
push 0x52
push eax
mov dword [ebp - 0x10], eax
call ebx
mov eax, dword [ebp - 0x10]
mov byte [eax], 0xe9
mov ecx, dword [0x100b003c]
mov eax, dword [ebp - 0x10]
sub ecx, eax
sub ecx, 5
mov dword [eax + 1], ecx
mov eax, dword [0x100b003c]
mov byte [eax], 0xe8
mov ecx, dword [0x100b003c]
mov eax, dword [0x100cab48]
inc ecx
sub eax, ecx
mov dword [0x100b003c], ecx
add eax, 0x4d29c
mov dword [ecx], eax
mov eax, dword [0x100b003c]
add eax, 4
mov dword [0x100b003c], eax
mov byte [eax], 0xa3
mov eax, dword [0x100b003c]
inc eax
mov dword [0x100b003c], eax
mov dword [eax], 0x100b9b20
mov eax, dword [0x100b003c]
add eax, 4
mov dword [0x100b003c], eax
mov byte [eax], 0xe9
mov ecx, dword [0x100b003c]
mov eax, dword [0x100cab48]
inc ecx
sub eax, ecx
mov dword [0x100b003c], ecx
add eax, 0x1fa1
mov dword [ecx], eax
mov ecx, 0x10050c40
mov eax, dword [ebp - 0x10]
sub ecx, eax
add dword [0x100b003c], 4
sub ecx, 0x52
mov dword [eax + 0x4e], ecx
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call ebx
mov eax, dword [0x100cab48]
lea ecx, [ebp - 8]
push ecx
push 0x40
add eax, 0x40ea4
mov dword [ebp - 0xc], 0x276
push 0x276
push eax
mov dword [ebp - 0x10], eax
call ebx
mov eax, dword [ebp - 0x10]
mov edx, 0x10050d70
mov ecx, edx
sub ecx, eax
sub ecx, 4
mov dword [eax], ecx
mov ecx, edx
mov eax, dword [ebp - 0x10]
sub ecx, eax
sub ecx, 0x82
mov dword [eax + 0x7e], ecx
mov ecx, 0x10050ee0
mov eax, dword [ebp - 0x10]
sub edx, eax
sub edx, 0x108
mov dword [eax + 0x104], edx
mov eax, dword [ebp - 0x10]
sub ecx, eax
sub ecx, 0x276
mov dword [eax + 0x272], ecx
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call ebx
mov eax, dword [0x100cab48]
lea ecx, [ebp - 8]
push ecx
push 0x40
add eax, 0x69e7a
mov dword [ebp - 0xc], 0x85
push 0x85
push eax
mov dword [ebp - 0x10], eax
call ebx
mov eax, dword [ebp - 0x10]
mov byte [eax], 0xe9
mov ecx, dword [0x100b003c]
mov eax, dword [ebp - 0x10]
sub ecx, eax
sub ecx, 5
mov dword [eax + 1], ecx
mov eax, dword [0x100b003c]
mov byte [eax], 0xe8
mov ecx, dword [0x100b003c]
mov eax, dword [0x100cab48]
inc ecx
sub eax, ecx
mov dword [0x100b003c], ecx
add eax, 0x208fc
mov dword [ecx], eax
mov eax, dword [0x100b003c]
add eax, 4
mov dword [0x100b003c], eax
mov dword [eax], 0x850fc085
mov ecx, dword [0x100b003c]
mov eax, dword [0x100cab48]
add ecx, 4
sub eax, ecx
mov dword [0x100b003c], ecx
add eax, 0x69eef
mov dword [ecx], eax
mov eax, dword [0x100b003c]
add eax, 4
mov dword [0x100b003c], eax
mov byte [eax], 0xe8
mov eax, edi
mov ecx, dword [0x100b003c]
inc ecx
sub eax, ecx
mov dword [0x100b003c], ecx
sub eax, 4
mov dword [ecx], eax
mov eax, dword [0x100b003c]
add eax, 4
mov dword [0x100b003c], eax
mov byte [eax], 0xe9
mov ecx, dword [0x100b003c]
mov eax, dword [0x100cab48]
inc ecx
sub eax, ecx
mov dword [0x100b003c], ecx
add eax, 0x69efb
mov dword [ecx], eax
mov ecx, 0x10051050
mov eax, dword [ebp - 0x10]
sub ecx, eax
add dword [0x100b003c], 4
sub ecx, 0x85
mov dword [eax + 0x81], ecx
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call ebx
mov eax, dword [0x100cab48]
lea ecx, [ebp - 8]
push ecx
push 0x40
add eax, 0x6e2e3
mov dword [ebp - 0xc], 0x78
push 0x78
push eax
mov dword [ebp - 0x10], eax
call ebx
mov eax, dword [ebp - 0x10]
mov edx, 0x100510b0
mov ecx, edx
mov byte [eax], 0xe8
mov eax, dword [ebp - 0x10]
sub ecx, eax
sub ecx, 5
mov dword [eax + 1], ecx
mov ecx, edx
mov eax, dword [ebp - 0x10]
mov byte [eax + 0x39], 0xe8
mov eax, dword [ebp - 0x10]
sub ecx, eax
sub ecx, 0x3e
mov dword [eax + 0x3a], ecx
mov eax, dword [ebp - 0x10]
mov byte [eax + 0x73], 0xe8
mov eax, dword [ebp - 0x10]
sub edx, eax
sub edx, 0x78
mov dword [eax + 0x74], edx
mov eax, dword [ebp - 0x10]
mov byte [eax + 0x2b], 0xe9
mov ecx, dword [0x100b003c]
mov eax, dword [ebp - 0x10]
sub ecx, eax
sub ecx, 0x30
mov dword [eax + 0x2c], ecx
mov eax, dword [0x100b003c]
mov byte [eax], 0xe8
mov ecx, dword [0x100b003c]
mov eax, dword [0x100cab48]
inc ecx
sub eax, ecx
mov dword [0x100b003c], ecx
add eax, 0x208fc
mov dword [ecx], eax
mov eax, dword [0x100b003c]
add eax, 4
mov dword [0x100b003c], eax
mov dword [eax], 0x850fc085
mov ecx, dword [0x100b003c]
mov eax, dword [0x100cab48]
add ecx, 4
sub eax, ecx
mov dword [0x100b003c], ecx
add eax, 0x6e30f
mov dword [ecx], eax
mov eax, dword [0x100b003c]
add eax, 4
mov dword [0x100b003c], eax
mov dword [eax], 0xe80cc483
mov eax, edi
mov ecx, dword [0x100b003c]
add ecx, 4
sub eax, ecx
mov dword [0x100b003c], ecx
sub eax, 4
mov dword [ecx], eax
mov eax, dword [0x100b003c]
add eax, 4
mov dword [0x100b003c], eax
mov byte [eax], 0xe9
mov ecx, dword [0x100b003c]
mov eax, dword [0x100cab48]
inc ecx
sub eax, ecx
mov dword [0x100b003c], ecx
add eax, 0x6e2dc
mov dword [ecx], eax
lea eax, [ebp - 8]
add dword [0x100b003c], 4
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call ebx
mov eax, dword [0x100cab48]
lea ecx, [ebp - 8]
push ecx
push 0x40
add eax, 0x200f0
mov dword [ebp - 0xc], 0xc1
push 0xc1
push eax
mov dword [ebp - 0x10], eax
call ebx
mov eax, dword [ebp - 0x10]
mov edx, 0x10051120
mov byte [eax + 0x3c], 0xe9
mov ecx, dword [0x100b003c]
mov eax, dword [ebp - 0x10]
sub ecx, eax
sub ecx, 0x41
mov dword [eax + 0x3d], ecx
mov eax, dword [0x100b003c]
mov byte [eax], 0xe8
mov ecx, dword [0x100b003c]
mov eax, dword [0x100cab48]
inc ecx
sub eax, ecx
mov dword [0x100b003c], ecx
add eax, 0x208fc
mov dword [ecx], eax
mov eax, dword [0x100b003c]
add eax, 4
mov dword [0x100b003c], eax
mov dword [eax], 0x850fc085
mov ecx, dword [0x100b003c]
mov eax, dword [0x100cab48]
add ecx, 4
sub eax, ecx
mov dword [0x100b003c], ecx
add eax, 0x2019d
mov dword [ecx], eax
mov eax, dword [0x100b003c]
add eax, 4
mov dword [0x100b003c], eax
mov dword [eax], 0xe80cc483
mov eax, edi
mov ecx, dword [0x100b003c]
add ecx, 4
sub eax, ecx
mov dword [0x100b003c], ecx
sub eax, 4
mov dword [ecx], eax
mov eax, dword [0x100b003c]
add eax, 4
mov dword [0x100b003c], eax
mov byte [eax], 0xe9
mov ecx, dword [0x100b003c]
mov eax, dword [0x100cab48]
inc ecx
sub eax, ecx
mov dword [0x100b003c], ecx
add eax, 0x201b0
mov dword [ecx], eax
mov ecx, edx
add dword [0x100b003c], 4
mov eax, dword [ebp - 0x10]
sub ecx, eax
sub ecx, 4
mov dword [eax], ecx
mov eax, dword [ebp - 0x10]
sub edx, eax
sub edx, 0xc1
mov dword [eax + 0xbd], edx
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call ebx
mov eax, dword [0x100cab48]
lea ecx, [ebp - 8]
push ecx
push 0x40
add eax, 0x14429
mov dword [ebp - 0xc], 0x78
push 0x78
push eax
mov dword [ebp - 0x10], eax
call ebx
mov eax, dword [ebp - 0x10]
mov edx, 0x100507d0
mov ecx, edx
sub ecx, eax
sub ecx, 4
mov dword [eax], ecx
mov ecx, edx
mov eax, dword [ebp - 0x10]
sub ecx, eax
sub ecx, 0x1d
mov dword [eax + 0x19], ecx
mov eax, dword [ebp - 0x10]
sub edx, eax
sub edx, 0x78
mov dword [eax + 0x74], edx
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call ebx
mov eax, dword [0x100cab48]
lea ecx, [ebp - 8]
push ecx
push 0x40
add eax, 0x168a9
mov dword [ebp - 0xc], 0x78
push 0x78
push eax
mov dword [ebp - 0x10], eax
call ebx
mov eax, dword [ebp - 0x10]
mov edx, 0x10050840
mov ecx, edx
sub ecx, eax
sub ecx, 4
mov dword [eax], ecx
mov ecx, edx
mov eax, dword [ebp - 0x10]
sub ecx, eax
sub ecx, 0x1d
mov dword [eax + 0x19], ecx
mov eax, dword [ebp - 0x10]
sub edx, eax
sub edx, 0x78
mov dword [eax + 0x74], edx
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call ebx
mov eax, dword [0x100cab48]
lea ecx, [ebp - 8]
add eax, 0x16080
mov dword [ebp - 0xc], 0xde
mov dword [ebp - 0x10], eax
push ecx
push 0x40
push 0xde
push eax
call ebx
mov eax, dword [ebp - 0x10]
mov ecx, 0xe890
mov esi, 0xe857
mov edx, 0x100508b0
mov word [eax], cx
mov ecx, dword [0x100b003c]
mov eax, dword [ebp - 0x10]
sub ecx, eax
sub ecx, 6
mov dword [eax + 2], ecx
mov eax, dword [0x100b003c]
mov dword [eax], 0xe85750
mov eax, 0x10050930
mov ecx, dword [0x100b003c]
add ecx, 3
sub eax, ecx
mov dword [0x100b003c], ecx
sub eax, 4
mov dword [ecx], eax
mov ecx, 0xc358
mov eax, dword [0x100b003c]
add eax, 4
mov dword [0x100b003c], eax
mov word [eax], cx
mov ecx, 0x10050970
mov eax, dword [ebp - 0x10]
add dword [0x100b003c], 2
mov word [eax + 0x25], si
mov eax, dword [ebp - 0x10]
sub ecx, eax
sub ecx, 0x2b
mov dword [eax + 0x27], ecx
mov ecx, edx
mov eax, dword [ebp - 0x10]
mov word [eax + 0x42], si
mov eax, dword [ebp - 0x10]
sub ecx, eax
sub ecx, 0x48
mov dword [eax + 0x44], ecx
mov eax, dword [ebp - 0x10]
mov word [eax + 0xab], si
mov eax, dword [ebp - 0x10]
sub edx, eax
sub edx, 0xb1
mov dword [eax + 0xad], edx
mov edx, 0x100508f0
mov eax, dword [ebp - 0x10]
mov ecx, edx
mov word [eax + 0x4e], si
mov eax, dword [ebp - 0x10]
sub ecx, eax
sub ecx, 0x54
mov dword [eax + 0x50], ecx
mov eax, dword [ebp - 0x10]
mov word [eax + 0xd8], si
mov eax, dword [ebp - 0x10]
sub edx, eax
sub edx, 0xde
mov dword [eax + 0xda], edx
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call ebx
mov eax, dword [0x100cab48]
lea ecx, [ebp - 8]
push ecx
push 0x40
add eax, 0x180b8
mov dword [ebp - 0xc], 5
push 5
push eax
mov dword [ebp - 0x10], eax
call ebx
mov eax, dword [ebp - 0x10]
mov byte [eax], 0xe8
mov esi, 0x100512e0
mov eax, dword [ebp - 0x10]
mov ecx, esi
sub ecx, eax
sub ecx, 5
mov dword [eax + 1], ecx
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call ebx
mov eax, dword [0x100cab48]
lea ecx, [ebp - 8]
push ecx
push 0x40
add eax, 0x59b8d
mov dword [ebp - 0xc], 0x24
push 0x24
push eax
mov dword [ebp - 0x10], eax
call ebx
mov eax, dword [ebp - 0x10]
mov ecx, esi
mov byte [eax], 0xe8
mov eax, dword [ebp - 0x10]
sub ecx, eax
sub ecx, 5
mov dword [eax + 1], ecx
mov ecx, 0x10051370
mov eax, dword [ebp - 0x10]
mov byte [eax + 0x1f], 0xe8
mov eax, dword [ebp - 0x10]
sub ecx, eax
sub ecx, 0x24
mov dword [eax + 0x20], ecx
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call ebx
mov eax, dword [0x100cab48]
lea ecx, [ebp - 8]
push ecx
push 0x40
add eax, 0x4f437
mov dword [ebp - 0xc], 5
push 5
push eax
mov dword [ebp - 0x10], eax
call ebx
mov eax, dword [ebp - 0x10]
mov ecx, 0x100513a0
mov byte [eax], 0xe8
mov eax, dword [ebp - 0x10]
sub ecx, eax
sub ecx, 5
mov dword [eax + 1], ecx
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call ebx
mov eax, dword [0x100cab48]
lea ecx, [ebp - 8]
push ecx
push 0x40
add eax, 0x58ef5
mov dword [ebp - 0xc], 5
push 5
push eax
mov dword [ebp - 0x10], eax
call ebx
mov eax, dword [ebp - 0x10]
mov ecx, 0x10051340
mov byte [eax], 0xe8
mov eax, dword [ebp - 0x10]
sub ecx, eax
sub ecx, 5
mov dword [eax + 1], ecx
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call ebx
mov eax, dword [0x100cab48]
lea ecx, [ebp - 8]
push ecx
push 0x40
add eax, 0x91751
mov dword [ebp - 0xc], 0x3b
push 0x3b
push eax
mov dword [ebp - 0x10], eax
call ebx
mov eax, dword [ebp - 0x10]
mov edx, 0x100513d0
mov ecx, edx
mov byte [eax], 0xe8
mov eax, dword [ebp - 0x10]
sub ecx, eax
sub ecx, 5
mov dword [eax + 1], ecx
mov eax, dword [ebp - 0x10]
mov byte [eax + 0x36], 0xe8
mov eax, dword [ebp - 0x10]
sub edx, eax
sub edx, 0x3b
mov dword [eax + 0x37], edx
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call ebx
mov eax, dword [0x100cab48]
lea ecx, [ebp - 8]
push ecx
push 0x40
add eax, 0x88e2d
mov dword [ebp - 0xc], 0xe6
push 0xe6
push eax
mov dword [ebp - 0x10], eax
call ebx
mov eax, dword [ebp - 0x10]
mov edx, 0x100511e0
mov ecx, edx
sub ecx, eax
sub ecx, 4
mov dword [eax], ecx
mov eax, dword [ebp - 0x10]
sub edx, eax
sub edx, 0xe6
mov dword [eax + 0xe2], edx
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call ebx
mov eax, dword [0x100cab48]
lea ecx, [ebp - 8]
push ecx
push 0x40
add eax, 0x520fa
mov dword [ebp - 0xc], 0xe6
push 0xe6
push eax
mov dword [ebp - 0x10], eax
call ebx
mov eax, dword [ebp - 0x10]
mov edx, 0x10051230
mov ecx, edx
sub ecx, eax
sub ecx, 4
mov dword [eax], ecx
mov eax, dword [ebp - 0x10]
sub edx, eax
sub edx, 0xe6
mov dword [eax + 0xe2], edx
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call ebx
mov eax, dword [0x100cab48]
lea ecx, [ebp - 8]
push ecx
push 0x40
add eax, 0x6d73d
mov dword [ebp - 0xc], 0x14
push 0x14
push eax
mov dword [ebp - 0x10], eax
call ebx
mov eax, dword [ebp - 0x10]
mov ecx, 0x10051310
mov byte [eax], 0xe8
mov eax, dword [ebp - 0x10]
sub ecx, eax
sub ecx, 5
mov dword [eax + 1], ecx
mov eax, dword [ebp - 0x10]
mov byte [eax + 0xf], 0xe8
mov eax, dword [ebp - 0x10]
sub esi, eax
sub esi, 0x14
mov dword [eax + 0x10], esi
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call ebx
mov eax, dword [0x100cab48]
lea ecx, [ebp - 8]
push ecx
push 0x40
add eax, 0x688b
mov dword [ebp - 0xc], 0xc
push 0xc
push eax
mov dword [ebp - 0x10], eax
call ebx
mov eax, dword [ebp - 0x10]
mov ecx, 0x100512b0
mov dword [eax], 0x78c4815b
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0xe8000001
mov eax, dword [ebp - 0x10]
sub ecx, eax
sub ecx, 0xc
mov dword [eax + 8], ecx
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call ebx
mov eax, dword [0x100cab48]
lea ecx, [ebp - 8]
push ecx
push 0x40
add eax, 0xe1e4
mov dword [ebp - 0xc], 0xc
push 0xc
push eax
mov dword [ebp - 0x10], eax
call ebx
mov eax, dword [ebp - 0x10]
mov ecx, 0x10051280
mov dword [eax], 0xcc4815b
mov eax, dword [ebp - 0x10]
mov dword [eax + 4], 0xe8000001
mov eax, dword [ebp - 0x10]
sub ecx, eax
sub ecx, 0xc
mov dword [eax + 8], ecx
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call ebx
mov eax, dword [0x100cab48]
lea ecx, [ebp - 8]
push ecx
push 0x40
add eax, 0x43562
mov dword [ebp - 0xc], 0x65
push 0x65
push eax
mov dword [ebp - 0x10], eax
call ebx
mov eax, dword [ebp - 0x10]
mov ecx, 0x10051450
sub ecx, eax
sub ecx, 4
mov dword [eax], ecx
mov ecx, 0x10051410
mov eax, dword [ebp - 0x10]
sub ecx, eax
sub ecx, 0x65
mov dword [eax + 0x61], ecx
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call ebx
mov eax, dword [0x100cab48]
lea ecx, [ebp - 8]
push ecx
push 0x40
add eax, 0x41b44
mov dword [ebp - 0xc], 4
push 4
push eax
mov dword [ebp - 0x10], eax
call ebx
mov eax, dword [ebp - 0x10]
mov ecx, 0x10051490
sub ecx, eax
sub ecx, 4
mov dword [eax], ecx
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call ebx
mov eax, dword [0x100cab48]
lea ecx, [ebp - 8]
push ecx
push 0x40
add eax, 0x3bcbe
mov dword [ebp - 0xc], 4
push 4
push eax
mov dword [ebp - 0x10], eax
call ebx
mov eax, dword [ebp - 0x10]
sub edi, eax
sub edi, 4
mov dword [eax], edi
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call ebx
mov eax, dword [0x100cab48]
lea ecx, [ebp - 8]
add eax, 0x2cfbe
mov dword [ebp - 0xc], 5
push ecx
mov dword [ebp - 0x10], eax
push 0x40
push 5
push eax
call ebx
mov eax, dword [ebp - 0x10]
mov byte [eax], 0xe8
mov ecx, dword [0x100b003c]
mov eax, dword [ebp - 0x10]
sub ecx, eax
sub ecx, 5
mov dword [eax + 1], ecx
mov eax, dword [0x100b003c]
mov dword [eax], 0x1012d
mov eax, dword [0x100b003c]
add eax, 4
mov dword [0x100b003c], eax
mov dword [eax], 0x83037400
mov eax, dword [0x100b003c]
add eax, 3
mov dword [0x100b003c], eax
mov dword [eax], 0xc304f883
lea eax, [ebp - 8]
add dword [0x100b003c], 4
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call ebx
mov eax, dword [0x100cab48]
lea ecx, [ebp - 8]
push ecx
push 0x40
add eax, 0x3b7fa
mov dword [ebp - 0xc], 4
push 4
push eax
mov dword [ebp - 0x10], eax
call ebx
mov ecx, dword [0x100b003c]
mov eax, dword [ebp - 0x10]
sub ecx, eax
sub ecx, 4
mov dword [eax], ecx
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call ebx
mov eax, dword [0x100b003c]
pop edi
pop esi
pop ebx
mov byte [eax], 0xe8
mov eax, 0x1004fe40
mov ecx, dword [0x100b003c]
inc ecx
sub eax, ecx
mov dword [0x100b003c], ecx
sub eax, 4
mov dword [ecx], eax
mov eax, dword [0x100b003c]
add eax, 4
mov dword [0x100b003c], eax
mov byte [eax], 0xe9
mov ecx, dword [0x100b003c]
mov eax, dword [0x100cab48]
inc ecx
sub eax, ecx
mov dword [0x100b003c], ecx
add eax, 0x43b48
mov dword [ecx], eax
add dword [0x100b003c], 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007491a
mov esp, ebp
pop ebp
ret