Function at 0x103b054
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa8
mov eax, dword [0x10431dc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ecx + 4]
mov eax, dword [esi + 8]
and eax, 0x7f
xor edx, edx
cmp eax, 0x7f
push edi
mov dword [ebp - 0x6c], ecx
ja case.0x103b086.4
movzx eax, byte [eax + 0x103c560]
jmp dword [eax*4 + 0x103c5e0]
mov ecx, dword [ecx]
test cl, 1
jne case.0x103b086.2
test cl, 4
jne case.0x103b086.4
mov eax, dword [esi + 4]
jmp 0x103b0b7
mov ecx, dword [ecx]
test cl, 0x40
jne case.0x103b086.4
test ecx, 0x800
jne case.0x103b086.2
mov eax, dword [esi]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add eax, 0x1000000
add esi, 0xc
xor edi, edi
cmp esi, edx
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x68], edi
mov dword [ebp - 0x40], edx
je 0x103b46e
mov eax, dword [0x104c8e0]
lea edi, [esi - 1]
and edi, 0xfffff000
cmp eax, edx
mov dword [ebp - 0x68], edi
je 0x103b3eb
cmp edi, 0x1031000
jb 0x103b3eb
shl eax, 0xc
add eax, 0x1031000
cmp edi, eax
ja 0x103b3eb
mov eax, edi
and eax, 0xfffff000
cmp eax, edx
mov dword [ebp - 0x18], eax
je 0x103b3eb
lea ebx, [ebx]
lea edx, [edi + 0x1000]
test edx, edx
jbe 0x103b1b6
cmp dword [ebp - 0x20], 0
je 0x103b153
lea eax, [ebp - 0x28]
push eax
push 0
push 0
push 0
call ebx
mov dword [ebp - 0x20], 0
cmp dword [ebp - 0x24], 0
je 0x103b16b
push 0x104c8a0
mov dword [ebp - 0x24], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 0x18]
lea ecx, [edi + 0x1fff]
and ecx, 0xfffff000
sub ecx, eax
push 0x104c8a0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x30]
lea edx, [ebp - 0x28]
push edx
push 0x40
push eax
push ecx
mov dword [ebp - 0x24], 1
call ebx
test eax, eax
je 0x103b1be
mov dword [ebp - 0x20], 1
test edi, edi
jne 0x103b3eb
cmp dword [ebp - 0x20], 0
je 0x103b1dd
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
push edx
mov edx, dword [ebp - 0x30]
push eax
push ecx
push edx
call ebx
mov dword [ebp - 0x20], 0
cmp dword [ebp - 0x24], 0
je 0x103b1f5
push 0x104c8a0
mov dword [ebp - 0x24], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
jmp 0x103b130
mov ecx, dword [ecx]
test cl, 0x40
jne case.0x103b086.4
mov eax, ecx
shr eax, 4
xor eax, ecx
test al, al
js case.0x103b086.2
jmp case.0x103b086.4
mov eax, dword [ecx]
and al, 1
sub al, 1
neg al
sbb eax, eax
add eax, 1
jmp 0x103b3db
mov ecx, dword [ecx]
test cl, 4
je case.0x103b086.2
mov eax, ecx
shr eax, 5
xor eax, ecx
test al, 0x40
jmp 0x103b3dd
mov ecx, dword [ecx]
test cl, 1
jne case.0x103b086.2
test cl, 0x40
jmp 0x103b3dd
mov ecx, dword [ecx]
test cl, 1
jne case.0x103b086.4
test cl, 0x40
je case.0x103b086.2
jmp case.0x103b086.4
mov eax, dword [ecx]
not eax
and eax, 1
jmp 0x103b3db
mov ecx, dword [ecx]
test cl, 0x40
je case.0x103b086.4
test cl, 4
je case.0x103b086.2
jmp case.0x103b086.4
mov ecx, dword [ecx]
mov eax, ecx
shr eax, 4
xor eax, ecx
shr eax, 7
and eax, 1
jmp 0x103b3db
mov eax, dword [ecx]
shr eax, 4
and eax, 1
jmp 0x103b3db
mov ecx, dword [ecx]
test cl, 0x40
jne case.0x103b086.2
mov eax, ecx
shr eax, 4
xor eax, ecx
test al, al
jns case.0x103b086.4
mov eax, dword [esi + 4]
jmp 0x103b0b7
mov ecx, dword [ecx]
test cl, 0x40
jne case.0x103b086.4
mov eax, ecx
shr eax, 4
xor eax, ecx
test al, al
jns case.0x103b086.2
jmp case.0x103b086.4
mov ecx, dword [ecx]
mov eax, ecx
shr eax, 4
xor eax, ecx
shr eax, 7
not eax
and eax, 1
jmp 0x103b3db
mov ecx, dword [ecx]
test cl, cl
js case.0x103b086.4
jmp 0x103b0a9
mov ecx, dword [ecx]
test cl, 1
jne case.0x103b086.2
test ecx, 0x800
jmp 0x103b3dd
mov ecx, dword [ecx]
and ecx, 0x800
xor eax, eax
cmp ecx, 0x800
jmp 0x103b3d8
mov eax, dword [ecx]
shr eax, 0xb
not eax
and eax, 1
jmp 0x103b3db
mov ecx, dword [ecx]
test cl, 0x40
jne case.0x103b086.4
mov eax, ecx
shr eax, 2
xor eax, ecx
test al, 1
je case.0x103b086.2
jmp case.0x103b086.4
mov ecx, dword [ecx]
and cl, 4
xor eax, eax
cmp cl, 4
jmp 0x103b3d8
mov eax, dword [ecx]
shr eax, 2
not eax
and eax, 1
jmp 0x103b3db
mov eax, dword [ecx]
and al, 0x80
xor ecx, ecx
cmp al, 0x80
sete cl
mov eax, ecx
jmp 0x103b3db
mov eax, dword [ecx]
shr eax, 7
not eax
and eax, 1
jmp 0x103b3db
mov eax, dword [ecx]
shr eax, 0xa
not eax
and eax, 1
jmp 0x103b3db
mov eax, dword [ecx]
and al, 0x40
xor ecx, ecx
cmp al, 0x40
sete cl
mov eax, ecx
jmp 0x103b3db
mov eax, dword [ecx]
shr eax, 6
not eax
and eax, 1
jmp 0x103b3db
xor eax, eax
cmp dword [ecx - 0x1c], edx
sete al
cmp eax, edx
je case.0x103b086.4
mov eax, dword [esi + 4]
jmp 0x103b0b7
mov edx, dword [0x100003c]
sub esi, edi
xor ecx, ecx
mov eax, esi
add eax, 0xffffffc0
test eax, eax
setl cl
mov dword [ebp - 0x40], edi
sub ecx, 1
and ecx, eax
mov dword [ebp - 0x18], ecx
mov ecx, dword [edx + 0x1000050]
sub ecx, 0x3f
mov eax, 0
mov esi, ecx
je 0x103b443
mov edx, dword [0x104c8dc]
imul edx, edx, 0x343fd
add edx, 0x269ec3
mov ebx, edx
shr ebx, 0x10
shl eax, 0x10
or eax, ebx
shr esi, 0x10
jne 0x103b422
mov dword [0x104c8dc], edx
xor edx, edx
div ecx
mov eax, dword [ebp - 0x18]
lea eax, [eax + edi + 3]
and eax, 0xfffffffc
mov ecx, 0x10
add edx, 0x1000003
and edx, 0xfffffffc
sub edx, eax
mov esi, dword [edx + eax]
mov dword [eax], esi
add eax, 4
sub ecx, 1
jne 0x103b461
mov eax, dword [0x104cddc]
mov ecx, dword [ebp - 0x70]
xor ebx, ebx
add eax, 0xffffffff
xor esi, esi
cmp ecx, 0x1000000
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], eax
jb 0x103b553
mov edx, dword [0x100003c]
mov edx, dword [edx + 0x1000050]
add edx, 0x1000000
cmp ecx, edx
jae 0x103b553
sub ecx, 0x1000000
test eax, eax
mov dword [ebp - 0x64], ecx
jl 0x103b542
lea ebx, [ebx]
add eax, ebx
cdq
sub eax, edx
sar eax, 1
lea ecx, [eax + eax*4]
mov edx, dword [ecx*4 + 0x104cb48]
lea ecx, [ecx*4 + 0x104cb48]
xor esi, edx
cmp dword [ebp - 0x64], esi
jae 0x103b4e8
mov esi, dword [ecx + 0xc]
add eax, 0xffffffff
mov dword [ebp - 0x4c], eax
add esi, edx
jmp 0x103b50a
mov edi, dword [ecx + 0xc]
mov ebx, edi
and ebx, 0xfff
add ebx, esi
cmp dword [ebp - 0x64], ebx
jb 0x103b510
lea ebx, [eax + 1]
mov eax, dword [ebp - 0x4c]
sub edx, edi
mov edi, dword [ebp - 0x68]
mov dword [ebp - 0x50], ebx
mov esi, edx
cmp eax, ebx
jge 0x103b4bc
jmp 0x103b542
mov eax, dword [ecx + 4]
mov ebx, dword [ebp - 0x50]
add eax, edx
mov dword [ebp - 0x88], eax
mov eax, dword [ecx + 8]
mov ecx, dword [ecx + 0x10]
sub eax, edx
mov dword [ebp - 0x84], eax
mov eax, edi
mov edi, dword [ebp - 0x68]
add ecx, eax
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x8c], esi
mov dword [ebp - 0x7c], ecx
xor ecx, ecx
cmp ebx, eax
setle cl
mov eax, ecx
test eax, eax
jne 0x103b661
xor edx, edx
cmp edi, edx
je 0x103b647
mov ecx, dword [0x104c8e0]
cmp ecx, edx
je 0x103b639
cmp edi, 0x1031000
jb 0x103b5dd
mov eax, ecx
shl eax, 0xc
add eax, 0x1031000
cmp edi, eax
ja 0x103b5dd
mov eax, edi
and eax, 0xfffff000
cmp eax, edx
je 0x103b5dd
cmp dword [ebp - 0x20], edx
je 0x103b5b4
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x28]
push ecx
mov ecx, dword [ebp - 0x30]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [0x104c8e0]
mov dword [ebp - 0x20], 0
cmp dword [ebp - 0x24], 0
je 0x103b5d2
push 0x104c8a0
mov dword [ebp - 0x24], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [0x104c8e0]
xor edx, edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], edx
cmp ecx, edx
je 0x103b639
cmp edi, 0x1031000
jb 0x103b639
shl ecx, 0xc
add ecx, 0x1031000
cmp edi, ecx
ja 0x103b639
mov eax, edi
and eax, 0xfffff000
cmp eax, edx
je 0x103b639
mov eax, edi
sub eax, 0x1031000
cdq
and edx, 0xfff
add eax, edx
mov edx, dword [ebp - 0x6c]
sar eax, 0xc
pop edi
mov dword [eax*4 + 0x104cb20], 0
mov eax, dword [ebp - 0x70]
pop esi
mov dword [edx + 4], eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0100d61a
mov esp, ebp
pop ebp
ret
push 0x8000
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x70]
pop edi
pop esi
mov dword [edx + 4], eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0100d61a
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x80]
mov eax, edx
and eax, 0xfff
mov dword [ebp - 0x64], eax
mov ecx, eax
mov eax, edx
shr eax, 0xc
mov dword [ebp - 0xa8], eax
and eax, 0x7f
mov dword [ebp - 0xa4], eax
add eax, 0xfffffff5
cmp eax, 0x69
ja case.0x103b693.12
movzx edx, byte [eax + 0x103c4e0]
jmp dword [edx*4 + 0x103c550]
add ecx, 0xd
jmp 0x103b6a7
add ecx, 6
jmp 0x103b6a7
add ecx, 0x11
test edi, edi
mov dword [ebp - 0x3c], ecx
jne 0x103b908
lea ebx, [ecx + 0xfff]
and ebx, 0xfffff000
mov dword [ebp - 0x18], ebx
mov edi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
xor esi, esi
lea ecx, [ecx]
push 0x40
push 0x1000
push ebx
push 0
add esi, 1
call edi
test eax, eax
jne 0x103b77b
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, 0x11
jb 0x103b6cb
mov edi, dword [0x104c8e0]
test edi, edi
je 0x103b6c1
xor esi, esi
xor eax, eax
test edi, edi
mov edx, edi
je 0x103b72e
mov ecx, dword [0x104c8dc]
lea ecx, [ecx]
imul ecx, ecx, 0x343fd
add ecx, 0x269ec3
mov ebx, ecx
shr ebx, 0x10
shl eax, 0x10
or eax, ebx
shr edx, 0x10
jne 0x103b70a
mov ebx, dword [ebp - 0x18]
mov dword [0x104c8dc], ecx
xor edx, edx
div edi
jmp 0x103b73a
add esi, 1
mov ecx, 0x3cea0
lea edi, [edx*4 + 0x104cb20]
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
je 0x103b768
lea eax, [edx + 1]
xor edx, edx
div dword [0x104c8e0]
cmp esi, 9
jb 0x103b73a
jmp 0x103b6c1
shl edx, 0xc
add edx, 0x1031000
mov esi, edx
je 0x103b6c1
jmp 0x103b77d
mov esi, eax
mov eax, dword [0x104c8e0]
test eax, eax
mov dword [ebp - 0x68], esi
je 0x103b890
cmp esi, 0x1031000
jb 0x103b890
shl eax, 0xc
add eax, 0x1031000
cmp esi, eax
ja 0x103b890
mov eax, esi
and eax, 0xfffff000
mov dword [ebp - 0x18], eax
je 0x103b890
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x103b7ca
cmp esi, eax
jb 0x103b7db
lea edx, [eax + ecx]
lea ebx, [esi + 0x1000]
cmp ebx, edx
jbe 0x103b851
xor ebx, ebx
cmp dword [ebp - 0x20], ebx
je 0x103b7f1
lea edx, [ebp - 0x28]
push edx
mov edx, dword [ebp - 0x28]
push edx
push ecx
push eax
call edi
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x24], ebx
je 0x103b804
push 0x104c8a0
mov dword [ebp - 0x24], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 0x18]
lea ecx, [esi + 0x1fff]
and ecx, 0xfffff000
sub ecx, eax
push 0x104c8a0
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x30]
lea edx, [ebp - 0x28]
push edx
push 0x40
push eax
push ecx
mov dword [ebp - 0x24], 1
call edi
mov ecx, dword [ebp - 0x2c]
cmp eax, ebx
mov eax, dword [ebp - 0x30]
je 0x103b855
mov dword [ebp - 0x20], 1
test esi, esi
jne 0x103b890
xor ebx, ebx
cmp dword [ebp - 0x20], ebx
je 0x103b86b
lea edx, [ebp - 0x28]
push edx
mov edx, dword [ebp - 0x28]
push edx
push ecx
push eax
call edi
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x24], ebx
je 0x103b87e
push 0x104c8a0
mov dword [ebp - 0x24], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ebx
jmp 0x103b7ca
mov eax, dword [0x100003c]
mov ecx, dword [eax + 0x1000050]
sub ecx, 0xfff
mov dword [ebp - 0x40], esi
mov eax, 0
mov edi, ecx
je 0x103b8d7
mov edx, dword [0x104c8dc]
lea esp, [esp]
imul edx, edx, 0x343fd
add edx, 0x269ec3
mov ebx, edx
shr ebx, 0x10
shl eax, 0x10
or eax, ebx
shr edi, 0x10
jne 0x103b8b6
mov dword [0x104c8dc], edx
xor edx, edx
div ecx
lea eax, [esi + 3]
and eax, 0xfffffffc
mov ecx, 0x400
add edx, 0x1000003
and edx, 0xfffffffc
sub edx, eax
jmp 0x103b8f6
mov esi, dword [edx + eax]
mov dword [eax], esi
add eax, 4
sub ecx, 1
jne 0x103b8f6
jmp 0x103bc3f
cmp ecx, 0x1000
jbe 0x103bc3f
mov ecx, dword [0x104c8e0]
xor esi, esi
cmp ecx, esi
je 0x103b9d2
cmp edi, 0x1031000
jb 0x103b992
mov edx, ecx
shl edx, 0xc
add edx, 0x1031000
cmp edi, edx
ja 0x103b992
mov eax, edi
and eax, 0xfffff000
cmp eax, esi
je 0x103b992
cmp dword [ebp - 0x20], esi
je 0x103b96a
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x30]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [0x104c8e0]
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x24], esi
je 0x103b989
push 0x104c8a0
mov dword [ebp - 0x24], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [0x104c8e0]
xor esi, esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
cmp ecx, esi
je 0x103b9d2
cmp edi, 0x1031000
jb 0x103b9d2
shl ecx, 0xc
add ecx, 0x1031000
cmp edi, ecx
ja 0x103b9d2
mov eax, edi
and eax, 0xfffff000
cmp eax, esi
je 0x103b9d2
mov eax, edi
sub eax, 0x1031000
cdq
and edx, 0xfff
add eax, edx
sar eax, 0xc
mov dword [eax*4 + 0x104cb20], esi
jmp 0x103b9e0
push 0x8000
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov ebx, dword [ebp - 0x3c]
add ebx, 0xfff
and ebx, 0xfffff000
mov dword [ebp - 0x18], ebx
lea esp, [esp]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
xor esi, esi
push 0x40
push 0x1000
push ebx
push 0
add esi, 1
call edi
test eax, eax
jne 0x103bab7
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, 0x11
jb 0x103b9fd
mov edi, dword [0x104c8e0]
test edi, edi
je 0x103b9f5
xor esi, esi
xor eax, eax
test edi, edi
mov edx, edi
je 0x103ba69
mov ecx, dword [0x104c8dc]
jmp 0x103ba45
imul ecx, ecx, 0x343fd
add ecx, 0x269ec3
mov ebx, ecx
shr ebx, 0x10
shl eax, 0x10
or eax, ebx
shr edx, 0x10
jne 0x103ba45
mov ebx, dword [ebp - 0x18]
mov dword [0x104c8dc], ecx
xor edx, edx
div edi
jmp 0x103ba76
add esi, 1
mov ecx, 0x3cea0
lea edi, [edx*4 + 0x104cb20]
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
je 0x103baa4
lea eax, [edx + 1]
xor edx, edx
div dword [0x104c8e0]
cmp esi, 9
jb 0x103ba76
jmp 0x103b9f5
shl edx, 0xc
add edx, 0x1031000
mov esi, edx
je 0x103b9f5
jmp 0x103bab9
mov esi, eax
mov eax, dword [0x104c8e0]
test eax, eax
mov dword [ebp - 0x68], esi
je 0x103bbcc
cmp esi, 0x1031000
jb 0x103bbcc
shl eax, 0xc
add eax, 0x1031000
cmp esi, eax
ja 0x103bbcc
mov eax, esi
and eax, 0xfffff000
mov dword [ebp - 0x18], eax
je 0x103bbcc
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x103bb06
cmp esi, eax
jb 0x103bb17
lea edx, [eax + ecx]
lea ebx, [esi + 0x1000]
cmp ebx, edx
jbe 0x103bb8d
xor ebx, ebx
cmp dword [ebp - 0x20], ebx
je 0x103bb2d
lea edx, [ebp - 0x28]
push edx
mov edx, dword [ebp - 0x28]
push edx
push ecx
push eax
call edi
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x24], ebx
je 0x103bb40
push 0x104c8a0
mov dword [ebp - 0x24], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 0x18]
lea ecx, [esi + 0x1fff]
and ecx, 0xfffff000
sub ecx, eax
push 0x104c8a0
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x30]
lea edx, [ebp - 0x28]
push edx
push 0x40
push eax
push ecx
mov dword [ebp - 0x24], 1
call edi
mov ecx, dword [ebp - 0x2c]
cmp eax, ebx
mov eax, dword [ebp - 0x30]
je 0x103bb91
mov dword [ebp - 0x20], 1
test esi, esi
jne 0x103bbcc
xor ebx, ebx
cmp dword [ebp - 0x20], ebx
je 0x103bba7
lea edx, [ebp - 0x28]
push edx
mov edx, dword [ebp - 0x28]
push edx
push ecx
push eax
call edi
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x24], ebx
je 0x103bbba
push 0x104c8a0
mov dword [ebp - 0x24], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ebx
jmp 0x103bb06
mov eax, dword [0x100003c]
mov ecx, dword [eax + 0x1000050]
sub ecx, 0xfff
mov dword [ebp - 0x40], esi
mov eax, 0
mov edi, ecx
je 0x103bc13
mov edx, dword [0x104c8dc]
lea esp, [esp]
imul edx, edx, 0x343fd
add edx, 0x269ec3
mov ebx, edx
shr ebx, 0x10
shl eax, 0x10
or eax, ebx
shr edi, 0x10
jne 0x103bbf2
mov dword [0x104c8dc], edx
xor edx, edx
div ecx
lea eax, [esi + 3]
and eax, 0xfffffffc
mov ecx, 0x400
add edx, 0x1000003
and edx, 0xfffffffc
sub edx, eax
jmp 0x103bc32
mov esi, dword [edx + eax]
mov dword [eax], esi
add eax, 4
sub ecx, 1
jne 0x103bc32
mov edi, dword [ebp - 0x8c]
lea ecx, [edi + 0x1000000]
mov dword [ebp - 0x50], ecx
mov ecx, 0x1001
sub ecx, dword [ebp - 0x3c]
mov eax, 0
mov esi, ecx
je 0x103bc93
mov edx, dword [0x104c8dc]
jmp 0x103bc72
imul edx, edx, 0x343fd
add edx, 0x269ec3
mov ebx, edx
shr ebx, 0x10
shl eax, 0x10
or eax, ebx
shr esi, 0x10
jne 0x103bc72
mov dword [0x104c8dc], edx
xor edx, edx
div ecx
mov eax, dword [ebp - 0x40]
mov ebx, dword [ebp - 0x50]
mov byte [ebp - 0x19], 0xa5
mov dword [ebp - 0x60], edi
mov dword [ebp - 0x5c], 0
add eax, edx
sub ebx, eax
mov dword [ebp - 0x40], eax
mov al, byte [ebp - 0x81]
test al, 1
mov dword [ebp - 0x4c], ebx
je 0x103bcca
lea eax, [ebp - 0x88]
jmp 0x103bf4f
movzx edi, word [ebp - 0x84]
mov ecx, dword [ebp - 0x88]
movzx esi, al
mov eax, 0x1000000
shr esi, 1
sub eax, dword [0x104c928]
lea ecx, [ecx + 0x1000000]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x58], eax
jne 0x103bd42
mov eax, 0x8421085
mul esi
mov eax, esi
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 6
imul eax, eax, 0x7c
sub esi, eax
lea edx, [ebp - 0x58]
push edx
mov edx, dword [esi*4 + 0x104c930]
lea eax, [edi + ecx]
push eax
push ecx
lea ecx, [ebp - 0x60]
push ecx
mov byte [ebp - 0x58], 0
mov byte [ebp - 0x57], 1
mov byte [ebp - 0x56], 2
mov byte [ebp - 0x55], 3
mov byte [ebp - 0x54], 4
mov byte [ebp - 0x53], 5
call edx
jmp 0x103bf39
mov eax, ecx
sub eax, 0x1000000
mov ecx, eax
mov ebx, eax
mov edx, edi
add eax, edx
mov edx, eax
and edx, 0xfffff000
sub eax, edx
mov dword [ebp - 0x9c], eax
mov eax, dword [0x100003c]
mov edi, dword [eax + 0x10000a0]
mov eax, dword [eax + 0x10000a4]
add edi, 0x1000000
and ecx, 0xfffff000
add eax, edi
sub ebx, ecx
cmp edi, eax
mov dword [ebp - 0xa0], edx
mov dword [ebp - 0x98], eax
je 0x103bd9d
cmp dword [edi], ecx
jae 0x103bd9d
add edi, dword [edi + 4]
cmp edi, eax
jne 0x103bd92
xor edx, edx
cmp edi, eax
je 0x103bdcb
cmp dword [edi], ecx
jne 0x103bdcb
mov ecx, dword [edi + 4]
sub ecx, 8
shr ecx, 1
mov dword [ebp - 0x38], ecx
je 0x103bdcb
movzx ecx, word [edi + edx*2 + 8]
and ecx, 0xfff
cmp ecx, ebx
jae 0x103bdcb
add edx, 1
cmp edx, dword [ebp - 0x38]
jne 0x103bdb4
mov ecx, dword [ebp - 0x3c]
jmp 0x103bdd2
cmp edi, eax
je 0x103beec
mov ebx, dword [edi]
cmp ebx, dword [ebp - 0xa0]
ja 0x103beec
lea esp, [esp]
mov ebx, dword [edi + 4]
add ebx, 0xfffffff8
shr ebx, 1
cmp edx, ebx
jne 0x103be14
add edi, dword [edi + 4]
cmp edi, eax
je 0x103beec
mov edx, dword [ebp - 0xa0]
cmp dword [edi], edx
ja 0x103beec
xor edx, edx
jmp 0x103bdeb
mov ebx, dword [edi]
cmp ebx, dword [ebp - 0xa0]
jne 0x103be34
movzx eax, word [edi + edx*2 + 8]
and eax, 0xfff
cmp eax, dword [ebp - 0x9c]
jae 0x103beec
mov eax, edx
movzx eax, word [edi + eax*2 + 8]
add edx, 1
test eax, 0xf000
mov dword [ebp - 0x90], edx
je 0x103c4d4
and eax, 0xfff
lea ebx, [eax + ebx + 0x1000000]
mov eax, 0x8421085
mul esi
mov eax, esi
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 6
imul eax, eax, 0x7c
mov edx, esi
sub edx, eax
lea eax, [edx*4 + 0x104c930]
lea edx, [ebp - 0x78]
push edx
mov edx, dword [eax]
push ebx
push ecx
lea ecx, [ebp - 0x60]
push ecx
mov byte [ebp - 0x78], 0
mov byte [ebp - 0x77], 1
mov byte [ebp - 0x76], 2
mov byte [ebp - 0x75], 3
mov byte [ebp - 0x74], 4
mov byte [ebp - 0x73], 5
mov dword [ebp - 0x38], eax
call edx
mov eax, dword [ebx]
sub eax, dword [ebp - 0x58]
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x48]
push eax
push ecx
mov ecx, dword [ebp - 0x38]
lea edx, [ebp - 0x14]
push edx
mov edx, dword [ecx]
lea eax, [ebp - 0x60]
push eax
mov byte [ebp - 0x48], 0
mov byte [ebp - 0x47], 1
mov byte [ebp - 0x46], 2
mov byte [ebp - 0x45], 3
mov byte [ebp - 0x44], 4
mov byte [ebp - 0x43], 5
call edx
mov edx, dword [ebp - 0x90]
add esp, 0x20
lea ecx, [ebx + 4]
jmp 0x103c4d4
mov eax, 0x8421085
mul esi
mov eax, esi
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 6
imul eax, eax, 0x7c
sub esi, eax
mov eax, dword [ebp - 0x3c]
lea edx, [ebp - 0x48]
push edx
mov edx, dword [ebp - 0x18]
add eax, edx
push eax
push ecx
mov ecx, dword [esi*4 + 0x104c930]
lea eax, [ebp - 0x60]
push eax
mov byte [ebp - 0x48], 0
mov byte [ebp - 0x47], 1
mov byte [ebp - 0x46], 2
mov byte [ebp - 0x45], 3
mov byte [ebp - 0x44], 4
mov byte [ebp - 0x43], 5
call ecx
mov ebx, dword [ebp - 0x4c]
or byte [ebp - 0x60], 1
or byte [ebp - 0x5e], 1
or byte [ebp - 0x5c], 1
add esp, 0x10
or byte [ebp - 0x5b], 1
lea eax, [ebp - 0x60]
mov edx, dword [eax]
mov ax, word [eax + 4]
mov word [ebp - 0x34], ax
mov eax, dword [ebp - 0x64]
test eax, eax
mov dword [ebp - 0x38], edx
jbe 0x103c181
mov cl, byte [ebp - 0x37]
lea edx, [eax - 1]
test edx, edx
mov dword [ebp - 0x18], edx
jbe 0x103c0e3
mov esi, dword [ebp - 0x50]
mov eax, dword [ebp - 0x40]
lea edi, [edx + esi]
sub eax, esi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x58], eax
lea ebx, [ebx]
test dl, 1
mov bl, byte [ebp - 0x35]
mov al, byte [edi]
je 0x103c02a
mov dl, bl
xor dl, al
and dl, 1
movzx esi, bl
movzx eax, al
je 0x103bfc2
movzx ecx, byte [ebp - 0x36]
mov ebx, esi
shr ebx, 1
shr ecx, 1
xor ecx, ebx
mov ebx, eax
xor ebx, 0x100
sar ebx, 1
xor ecx, ebx
jmp 0x103bfc8
mov ecx, eax
xor ecx, esi
shr ecx, 1
movzx edi, byte [edi - 1]
mov ebx, edi
xor ebx, ecx
test bl, 1
je 0x103c00a
test dl, dl
je 0x103bfee
movzx ecx, byte [ebp - 0x36]
shr ecx, 1
shr esi, 1
xor eax, 0x100
xor ecx, esi
sar eax, 1
xor ecx, eax
jmp 0x103bff4
xor eax, esi
shr eax, 1
mov ecx, eax
movzx eax, byte [ebp - 0x33]
shr eax, 1
xor edi, ecx
xor eax, 0x80
sar edi, 1
xor eax, edi
jmp 0x103c0bd
test dl, dl
je 0x103c0b1
movzx ecx, byte [ebp - 0x36]
shr ecx, 1
shr esi, 1
xor eax, 0x100
xor ecx, esi
sar eax, 1
xor ecx, eax
jmp 0x103c0b7
mov dl, cl
xor dl, al
and dl, 1
movzx esi, cl
movzx eax, al
je 0x103c053
movzx ecx, byte [ebp - 0x38]
mov ebx, esi
shr ebx, 1
shr ecx, 1
xor ecx, ebx
mov ebx, eax
xor ebx, 0x100
sar ebx, 1
xor ecx, ebx
jmp 0x103c059
mov ecx, eax
xor ecx, esi
shr ecx, 1
movzx edi, byte [edi - 1]
mov ebx, edi
xor ebx, ecx
test bl, 1
je 0x103c098
test dl, dl
je 0x103c07f
movzx ecx, byte [ebp - 0x38]
shr ecx, 1
shr esi, 1
xor eax, 0x100
xor ecx, esi
sar eax, 1
xor ecx, eax
jmp 0x103c085
xor eax, esi
shr eax, 1
mov ecx, eax
movzx eax, byte [ebp - 0x34]
shr eax, 1
xor edi, ecx
xor eax, 0x80
sar edi, 1
xor eax, edi
jmp 0x103c0bd
test dl, dl
je 0x103c0b1
movzx ecx, byte [ebp - 0x38]
shr ecx, 1
shr esi, 1
xor eax, 0x100
xor ecx, esi
sar eax, 1
xor ecx, eax
jmp 0x103c0b7
xor eax, esi
shr eax, 1
mov ecx, eax
xor edi, ecx
sar edi, 1
mov eax, edi
mov edi, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x58]
mov edx, dword [ebp - 0x18]
xor byte [ebp - 0x19], al
mov byte [ecx + edi], al
mov cl, byte [ebp - 0x37]
sub edx, 1
sub edi, 1
test edx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x3c], edi
ja 0x103bf8b
mov edx, dword [ebp - 0x50]
mov al, byte [edx]
mov bl, cl
xor bl, al
and bl, 1
movzx ecx, cl
movzx eax, al
je 0x103c111
movzx edx, byte [ebp - 0x38]
mov esi, ecx
shr esi, 1
shr edx, 1
xor edx, esi
mov esi, eax
xor esi, 0x100
sar esi, 1
xor edx, esi
jmp 0x103c117
mov edx, eax
xor edx, ecx
shr edx, 1
test dl, 1
je 0x103c155
test bl, bl
je 0x103c141
movzx esi, byte [ebp - 0x38]
movzx edx, byte [ebp - 0x34]
shr esi, 1
shr ecx, 1
xor eax, 0x100
xor esi, ecx
sar eax, 1
xor esi, eax
xor edx, esi
xor edx, 0x100
jmp 0x103c174
movzx edx, byte [ebp - 0x34]
xor eax, ecx
shr eax, 1
mov esi, eax
xor edx, esi
xor edx, 0x100
jmp 0x103c174
test bl, bl
je 0x103c16e
movzx edx, byte [ebp - 0x38]
shr edx, 1
shr ecx, 1
xor eax, 0x100
xor edx, ecx
sar eax, 1
xor edx, eax
jmp 0x103c174
xor eax, ecx
shr eax, 1
mov edx, eax
mov eax, dword [ebp - 0x40]
mov ebx, dword [ebp - 0x4c]
sar edx, 1
xor byte [ebp - 0x19], dl
mov byte [eax], dl
mov eax, 0x1000000
sub eax, dword [0x104c928]
mov dword [ebp - 0x18], eax
jne 0x103c199
test ebx, ebx
je 0x103c259
mov ecx, dword [ebp - 0x50]
mov ebx, dword [ebp - 0x40]
mov edx, dword [ebp - 0x64]
mov esi, dword [0x103edac]
sub ebx, ecx
sub ecx, 0x1000000
lea eax, [ecx + edx]
xor edi, edi
add esi, 0xffffffff
mov dword [ebp - 0x58], eax
js 0x103c1e8
lea eax, [esi + edi]
cdq
sub eax, edx
sar eax, 1
mov edx, dword [eax*4 + 0x103edb0]
and edx, 0xfffffff
cmp ecx, edx
jae 0x103c1db
lea esi, [eax - 1]
jmp 0x103c1e0
jbe 0x103c1e6
lea edi, [eax + 1]
cmp esi, edi
jge 0x103c1bd
jmp 0x103c1e8
mov edi, eax
cmp edi, dword [0x103edac]
jae 0x103c259
jmp 0x103c1fb
mov eax, dword [edi*4 + 0x103edb0]
mov esi, eax
and esi, 0xfffffff
cmp esi, dword [ebp - 0x58]
jae 0x103c259
mov ecx, eax
add eax, eax
add eax, eax
sar eax, 0x1e
sar ecx, 0x1e
and eax, 3
and ecx, 3
xor edx, edx
sub eax, 1
je 0x103c23c
sub eax, 1
je 0x103c237
sub eax, 1
jne 0x103c242
mov edx, dword [ebp - 0x18]
jmp 0x103c242
mov edx, dword [ebp - 0x4c]
jmp 0x103c242
mov edx, dword [ebp - 0x18]
sub edx, dword [ebp - 0x4c]
sub ecx, 2
jne 0x103c24e
add dword [ebx + esi + 0x1000000], edx
add edi, 1
cmp edi, dword [0x103edac]
jb 0x103c1fb
mov cl, byte [ebp - 0x82]
xor cl, byte [ebp - 0x19]
je 0x103c310
call fcn.0103ed9c
mov esi, eax
mov eax, dword [ebp - 0x6c]
lea edi, [eax + 8]
and edi, 0xfffffffc
lea ecx, [edi + 0xfff]
mov dword [eax + 4], 0x1030fd8
mov edx, dword [0x104c8dc]
and esi, 0xfffff000
and ecx, 0xfffff000
xor eax, eax
mov dword [ebp - 0x18], 0xffff
jmp 0x103c2ab
imul edx, edx, 0x343fd
add edx, 0x269ec3
mov ebx, edx
shr ebx, 0x10
shl eax, 0x10
or eax, ebx
shr dword [ebp - 0x18], 0x10
jne 0x103c2ab
mov dword [0x104c8dc], edx
xor edx, edx
mov ebx, 0xffff
div ebx
mov eax, edx
mov edx, dword [ebp - 0x6c]
add eax, 1
cmp edi, ecx
mov dword [edx - 0x1c], eax
mov dword [edx - 8], esi
jae 0x103c2f7
sub ecx, edi
sub ecx, 1
shr ecx, 2
add ecx, 1
xor eax, eax
rep stosd dword es:[edi], eax
pop edi
mov eax, 0x1030fd8
pop esi
mov dword [edx + 4], eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0100d61a
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0xa4]
mov edx, dword [ebp - 0x64]
mov edi, dword [ebp - 0x40]
lea ecx, [esi - 0xb]
cmp ecx, 0x69
lea eax, [edx + edi]
ja case.0x103c332.12
movzx ecx, byte [ecx + 0x103c45c]
jmp dword [ecx*4 + 0x103c4c8]
mov edx, dword [ebp - 0x80]
mov edi, edx
shr edi, 5
mov ebx, edx
and edi, 0x100000
mov ecx, edx
and edx, 0x100000
and ebx, 0x1e00000
or edi, ebx
shr edi, 5
or edi, edx
mov edx, dword [eax + 5]
and edx, 0xffffff80
or edx, esi
and edx, 0xfff0007f
shr edi, 1
or edi, edx
mov edx, dword [ebp - 0xa8]
shr ecx, 0x12
and edx, 0x80
or edi, edx
and ecx, 0x3f00
or edi, ecx
mov ecx, dword [ebp - 0x7c]
mov dword [eax + 5], edi
mov edi, dword [ebp - 0x40]
mov dword [eax + 9], ecx
mov edx, 0x103d996
jmp 0x103c3d3
mov ecx, dword [ebp - 0x80]
shr ecx, 0x15
xor cl, byte [eax + 5]
mov edx, 0x103c658
and cl, 0xf
xor byte [eax + 5], cl
jmp 0x103c3d3
mov ecx, dword [ebp - 0x8c]
add edx, ecx
mov ecx, dword [eax + 0xd]
mov dword [eax + 5], edx
mov edx, dword [ebp - 0x7c]
and ecx, 0xffffff80
or ecx, esi
mov dword [eax + 9], edx
mov dword [eax + 0xd], ecx
mov edx, 0x103b000
sub edx, eax
sub edx, 5
mov byte [eax], 0xe8
mov dword [eax + 1], edx
mov ecx, dword [0x104c8e0]
xor esi, esi
cmp ecx, esi
je 0x103c43b
mov eax, dword [ebp - 0x68]
cmp eax, 0x1031000
jb 0x103c43b
shl ecx, 0xc
add ecx, 0x1031000
cmp eax, ecx
ja 0x103c43b
and eax, 0xfffff000
cmp eax, esi
je 0x103c43b
cmp dword [ebp - 0x20], esi
je 0x103c428
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x30]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x24], esi
je 0x103c43b
push 0x104c8a0
mov dword [ebp - 0x24], esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub edi, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x6c]
add edi, dword [ebp - 0x70]
mov eax, edi
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100d61a
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x98]
jmp 0x103bdd2