Function at 0x104005c
Capabilities:
Allocate or change rwx memory
Encode data using xor
Encrypt data using chaskey

Disassembly:
push edi
pushfd
push ebp
mov ebp, esp
sub esp, 0x90
mov dword [ebp - 0x8c], eax
lea eax, [ebp + 4]
mov dword [ebp - 0x84], ecx
mov ecx, 0xfffffff
mov dword [ebp - 0x7c], edx
mov dword [ebp - 0x80], ebx
sub eax, 4
lea ebx, [eax + 0xc]
mov dword [ebp - 0x90], esi
mov dword [ebp - 0x88], edi
mov dword [ebp - 0x68], eax
mov eax, dword [ebx]
mov esi, dword [eax + 4]
mov dword [ebp - 0x2c], eax
mov eax, dword [eax]
and eax, ecx
and esi, ecx
mov ecx, dword [0x100aa54]
xor edx, edx
mov dword [ebp - 0x3c], ecx
lea ecx, [eax + ecx - 1]
mov eax, ecx
div dword [ebp - 0x3c]
mov edi, 0x1000000
mov eax, dword [0x100aa54]
add esi, edi
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x50], esi
sub ecx, edx
mov dword [ebp - 0x18], ecx
mov eax, dword [0x10055a0]
mov dword [ebp - 0x30], eax
mov eax, dword [0x100aa54]
mov eax, dword [0x10055a0]
test eax, eax
je 0x104017e
and dword [ebp - 0x40], 0
mov eax, dword [0x10055a0]
dec eax
lea ecx, [eax + 1]
mov dword [ebp - 0x1c], ecx
xor eax, eax
test ecx, ecx
je 0x1040127
mov edx, dword [0x104d00c]
shr dword [ebp - 0x1c], 0x10
imul edx, edx, 0x343fd
add edx, 0x269ec3
mov dword [0x104d00c], edx
shr edx, 0x10
shl eax, 0x10
or eax, edx
cmp dword [ebp - 0x1c], 0
jne 0x10400fd
xor edx, edx
div ecx
cmp dword [ebp - 0x30], 0
mov dword [ebp - 0x1c], edx
jbe 0x1040170
inc dword [ebp - 0x40]
lea edx, [edx*4 + 0x104d078]
mov ecx, 0xffff3b59
mov eax, 0xc4a6
lock cmpxchg dword [edx], ecx
cmp eax, 0xc4a6
je 0x1040300
mov ecx, dword [0x10055a0]
mov eax, dword [ebp - 0x1c]
inc eax
xor edx, edx
div ecx
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x1c], edx
cmp eax, dword [ebp - 0x30]
jb 0x1040134
and dword [ebp - 0x14], 0
cmp dword [ebp - 0x14], 0
jne 0x1040209
call dword [sym.imp.KERNEL32.dll_GetLastError]
and dword [ebp - 0x1c], 0
mov dword [ebp - 0x3c], eax
inc dword [ebp - 0x1c]
push 0x40
push 0x1000
push dword [ebp - 0x18]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x1040317
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x1c], 0x11
jb 0x104018b
and dword [ebp - 0x14], 0
cmp dword [ebp - 0x14], 0x10000
jb 0x10401cb
test dword [ebp - 0x14], 3
je 0x10401e5
cmp dword [ebp - 0x14], 0
je 0x10401e1
push 0x8000
push 0
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
and dword [ebp - 0x14], 0
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [ebp - 0x14], 0
je 0x10400cd
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x1040209
mov byte [eax], 0
inc eax
dec ecx
jne 0x1040202
mov eax, 0x2ad03611
add dword [ebx], 8
mov eax, dword [ebp - 0x2c]
mov ebx, dword [eax]
and ebx, 0xfffffff
lea eax, [esi + ebx]
mov dword [ebp - 0x3c], eax
mov eax, dword [0x100aa54]
mov dword [ebp - 0x34], esi
sub eax, ebx
lea ecx, [eax + 1]
sub dword [ebp - 0x34], edi
mov edx, ecx
xor eax, eax
mov dword [ebp - 0x40], ebx
test ecx, ecx
je 0x1040264
mov esi, dword [0x104d00c]
imul esi, esi, 0x343fd
add esi, 0x269ec3
mov dword [0x104d00c], esi
shr esi, 0x10
shl eax, 0x10
shr edx, 0x10
or eax, esi
test edx, edx
jne 0x104023d
xor edx, edx
div ecx
mov eax, dword [ebp - 0x14]
add eax, edx
push ebx
push dword [ebp - 0x34]
mov dword [ebp - 0x1c], eax
mov eax, 0xb4b030ab
mov eax, dword [ebp - 0x3c]
lea esi, [ebp - 0x70]
pop ecx
pop ecx
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0xd], 0
mov eax, 0x28d1868e
mov eax, dword [ebp - 0x70]
mov edx, 0xfffffff
mov ecx, dword [ebp - 0x6c]
and dword [ebp - 0x28], 0
and dword [ebp - 0x24], 0
and eax, edx
and ecx, edx
mov edx, dword [0x1034d40]
add eax, edi
sub edi, edx
mov dword [ebp - 0x4c], edi
jne 0x104031f
and dword [ebp - 0x18], 0
test ecx, ecx
jbe 0x1040504
mov edi, 0x6e0a9da6
mov edx, dword [ebp - 0x18]
movzx edx, byte [edx + eax]
add edx, edi
add dword [ebp - 0x28], edx
add edx, dword [ebp - 0x24]
imul edx, edx, 0x6e0a9da6
ror edx, 9
imul edx, edx, 0x6e0a9da6
ror edx, 9
add dword [ebp - 0x28], edx
inc dword [ebp - 0x18]
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x18], ecx
jb 0x10402cc
jmp 0x1040504
mov eax, dword [0x100aa54]
imul eax, dword [ebp - 0x1c]
lea eax, [eax + 0x1044008]
mov dword [ebp - 0x14], eax
jmp 0x1040174
mov dword [ebp - 0x14], eax
jmp 0x10401b9
lea edx, [eax + ecx]
mov esi, eax
mov edi, dword [0x100003c]
lea edi, [edi + 0x10000a0]
mov dword [ebp - 0x20], edx
mov edx, dword [edi]
sub esi, 0x1000000
mov edi, dword [edi + 4]
mov dword [ebp - 0x2c], edi
mov edi, esi
and edi, 0xfffff000
add ecx, esi
mov dword [ebp - 0x18], edi
mov edi, esi
sub edi, dword [ebp - 0x18]
mov esi, ecx
and esi, 0xfffff000
sub ecx, esi
mov dword [ebp - 0x60], ecx
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x64], esi
add edx, 0x1000000
add ecx, edx
mov dword [ebp - 0x5c], ecx
cmp edx, ecx
je 0x1040384
mov ecx, dword [edx]
cmp ecx, dword [ebp - 0x18]
jae 0x1040384
add edx, dword [edx + 4]
cmp edx, dword [ebp - 0x5c]
jne 0x1040375
and dword [ebp - 0x54], 0
cmp edx, dword [ebp - 0x5c]
je 0x10403c6
mov ecx, dword [ebp - 0x18]
cmp dword [edx], ecx
jne 0x10403c6
mov ecx, dword [edx + 4]
sub ecx, 8
shr ecx, 1
mov dword [ebp - 0x2c], ecx
je 0x10403c6
lea ecx, [edx + 8]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x18]
movzx ecx, word [ecx]
and ecx, 0xfff
cmp ecx, edi
jae 0x10403c6
inc dword [ebp - 0x54]
mov ecx, dword [ebp - 0x2c]
add dword [ebp - 0x18], 2
cmp dword [ebp - 0x54], ecx
jne 0x10403a7
mov edi, 0x6e0a9da6
jmp 0x10403d0
mov esi, dword [ebp - 0x64]
cmp edx, dword [ebp - 0x5c]
je 0x10404ce
cmp dword [edx], esi
ja 0x10404ce
mov ecx, dword [edx + 4]
add ecx, 0xfffffff8
shr ecx, 1
cmp dword [ebp - 0x54], ecx
jne 0x1040408
add edx, dword [edx + 4]
cmp edx, dword [ebp - 0x5c]
je 0x10404ce
cmp dword [edx], esi
ja 0x10404ce
and dword [ebp - 0x54], 0
jmp 0x10403e1
cmp dword [edx], esi
jne 0x1040423
mov ecx, dword [ebp - 0x54]
movzx ecx, word [edx + ecx*2 + 8]
and ecx, 0xfff
cmp ecx, dword [ebp - 0x60]
jae 0x10404ce
mov esi, 0xf000
mov ecx, dword [ebp - 0x54]
inc dword [ebp - 0x54]
test word [edx + ecx*2 + 8], si
je 0x10403cd
movzx esi, word [edx + ecx*2 + 8]
mov ecx, dword [edx]
and esi, 0xfff
lea esi, [esi + ecx + 0x1000000]
xor ecx, ecx
mov dword [ebp - 0x18], esi
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x30], ecx
je 0x104048b
movzx esi, byte [ecx + eax]
add esi, edi
add dword [ebp - 0x28], esi
add esi, dword [ebp - 0x24]
imul esi, esi, 0x6e0a9da6
ror esi, 9
imul esi, esi, 0x6e0a9da6
ror esi, 9
mov ecx, esi
add dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x24], esi
inc ecx
mov dword [ebp - 0x30], ecx
cmp ecx, dword [ebp - 0x18]
jb 0x1040459
mov eax, dword [ebp - 0x38]
mov eax, dword [eax]
sub eax, dword [ebp - 0x4c]
xor ecx, ecx
mov dword [ebp - 0x74], eax
movzx eax, byte [ebp + ecx - 0x74]
add eax, edi
add dword [ebp - 0x28], eax
add eax, dword [ebp - 0x24]
imul eax, eax, 0x6e0a9da6
ror eax, 9
imul eax, eax, 0x6e0a9da6
ror eax, 9
add dword [ebp - 0x28], eax
inc ecx
mov dword [ebp - 0x24], eax
cmp ecx, 4
jb 0x1040498
mov eax, dword [ebp - 0x38]
add eax, 4
jmp 0x10403cd
xor edx, edx
mov ecx, dword [ebp - 0x20]
sub ecx, eax
mov dword [ebp - 0x2c], ecx
je 0x1040504
movzx ecx, byte [eax + edx]
add ecx, edi
add dword [ebp - 0x28], ecx
add ecx, dword [ebp - 0x24]
imul ecx, ecx, 0x6e0a9da6
ror ecx, 9
imul ecx, ecx, 0x6e0a9da6
ror ecx, 9
add dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
inc edx
cmp edx, dword [ebp - 0x2c]
jb 0x10404da
xor eax, eax
mov ecx, eax
and ecx, 7
mov cl, byte [ebp + ecx - 0x28]
mov byte [ebp + eax - 0xc], cl
inc eax
cmp eax, 8
jb 0x1040506
mov eax, 0x2563dfc1
mov eax, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x50]
mov dword [ebp - 0x44], eax
mov eax, ebx
and eax, 7
mov dword [ebp - 0x30], eax
je 0x10408b0
xor ecx, ecx
mov edi, dword [ebp - 0x34]
mov dword [ebp - 0x18], ecx
not edi
cmp eax, ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x14], ecx
jle 0x1040572
push 0x38
pop edx
cmp dword [ebp - 0x14], 4
movzx ebx, byte [esi]
jge 0x104055f
lea ecx, [edx - 0x20]
shl ebx, cl
or dword [ebp - 0x38], ebx
jmp 0x1040566
mov ecx, edx
shl ebx, cl
or dword [ebp - 0x18], ebx
inc esi
inc dword [ebp - 0x14]
sub edx, 8
cmp dword [ebp - 0x14], eax
jl 0x104054c
mov ecx, edi
movzx edx, word [ebp - 0xa]
movzx ebx, word [ebp - 8]
mov eax, edi
xor ecx, edx
rol ecx, 6
imul ebx, ecx
rol eax, 0xd
xor eax, ebx
mov ebx, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
xor eax, dword [ebp - 0x34]
xor ecx, eax
sub ebx, ecx
xor edi, ebx
mov ecx, edi
sub ecx, edx
mov edx, edi
movzx ebx, word [ebp - 0xc]
imul ecx, ebx
shr edx, 0xe
sub ecx, edx
movzx edx, word [ebp - 6]
xor eax, ecx
mov ecx, dword [ebp - 0xc]
add ecx, eax
rol ecx, 4
imul ecx, edx
movzx edx, word [ebp - 8]
mov dword [ebp - 0x20], ebx
mov ebx, eax
ror ebx, 2
add ebx, ecx
xor edi, ebx
mov ebx, edi
mov ecx, edi
xor ecx, dword [ebp - 0x20]
rol ecx, 3
imul edx, ecx
rol ebx, 7
add ebx, edx
movzx edx, word [ebp - 8]
xor eax, ebx
mov ecx, eax
sub ecx, edx
rol ecx, 5
movzx edx, word [ebp - 0xa]
imul ecx, edx
mov edx, eax
shr edx, 1
xor ecx, edx
xor edi, ecx
mov edx, edi
mov ecx, dword [ebp - 8]
xor ecx, edi
rol ecx, 3
imul ecx, dword [ebp - 0x20]
ror edx, 0xc
add edx, ecx
xor eax, edx
mov ecx, eax
movzx edx, word [ebp - 6]
mov ebx, eax
sub ecx, dword [ebp - 0xc]
rol ecx, 7
imul ecx, edx
ror ebx, 0xc
sub ecx, ebx
xor edi, ecx
mov edx, edi
movzx ecx, word [ebp - 8]
ror edx, 3
sub edx, ecx
imul edx, dword [ebp - 0x20]
xor eax, edx
movzx edx, word [ebp - 0xa]
mov ebx, eax
mov ecx, eax
sub ecx, dword [ebp - 8]
ror ecx, 6
rol ebx, 0xc
imul ecx, edx
xor ebx, ecx
and dword [ebp - 0x14], 0
xor edi, ebx
mov ebx, dword [ebp - 0x30]
mov ecx, edi
xor ecx, edx
rol ecx, 7
imul ecx, dword [ebp - 0x20]
mov edx, edi
xor edi, dword [ebp - 0x18]
ror edx, 2
sub ecx, edx
xor ecx, dword [ebp - 0x38]
xor eax, ecx
test ebx, ebx
mov dword [ebp - 0x20], eax
mov ecx, edi
jle 0x10406ae
cmp dword [ebp - 0x14], 4
jge 0x1040695
rol dword [ebp - 0x20], 8
mov dl, byte [ebp - 0x20]
mov ebx, dword [ebp - 0x44]
inc dword [ebp - 0x44]
xor byte [ebp - 0xd], dl
mov byte [ebx], dl
jmp 0x10406a3
mov edx, dword [ebp - 0x44]
inc dword [ebp - 0x44]
rol ecx, 8
xor byte [ebp - 0xd], cl
mov byte [edx], cl
inc dword [ebp - 0x14]
mov ebx, dword [ebp - 0x30]
cmp dword [ebp - 0x14], ebx
jl 0x104067b
add ebx, 0xfffffffc
test ebx, ebx
jle 0x1040896
push 4
pop ecx
sub ecx, ebx
shl ecx, 3
shr edi, cl
shl edi, cl
mov edx, edi
mov ebx, dword [ebp - 0x40]
mov edi, ebx
shr edi, 3
test edi, edi
jbe 0x10408c4
movzx ecx, word [ebp - 8]
mov dword [ebp - 0x30], ecx
movzx ecx, word [ebp - 6]
neg dword [ebp - 0x30]
mov dword [ebp - 0x4c], ecx
movzx ecx, word [ebp - 0xa]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x2c], edi
movzx ecx, byte [esi + 1]
movzx edi, byte [esi]
shl edi, 8
or ecx, edi
shl ecx, 8
movzx edi, byte [esi + 2]
or ecx, edi
movzx edi, byte [esi + 3]
shl ecx, 8
or ecx, edi
movzx edi, byte [esi + 5]
mov dword [ebp - 0x20], ecx
movzx ecx, byte [esi + 4]
shl ecx, 8
or ecx, edi
shl ecx, 8
movzx edi, byte [esi + 6]
or ecx, edi
movzx edi, byte [esi + 7]
shl ecx, 8
or ecx, edi
xor edx, ecx
movzx edi, word [ebp - 8]
mov ebx, edx
mov dword [ebp - 0x78], ecx
mov ecx, edx
add esi, 8
xor ecx, dword [ebp - 0x14]
rol ecx, 6
imul edi, ecx
rol ebx, 0xd
xor ebx, edi
mov ecx, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
xor ebx, dword [ebp - 0x20]
xor eax, ebx
xor edi, eax
mov ebx, ecx
sub ebx, edi
movzx edi, cx
xor edx, ebx
mov ebx, edx
sub ebx, dword [ebp - 0x14]
imul ebx, edi
mov edi, edx
shr edi, 0xe
sub ebx, edi
xor eax, ebx
add ecx, eax
mov edi, eax
rol ecx, 4
imul ecx, dword [ebp - 0x4c]
ror edi, 2
add edi, ecx
xor edx, edi
mov ebx, edx
mov ecx, edx
movzx edi, word [ebp - 0xc]
xor ecx, edi
movzx edi, word [ebp - 8]
rol ecx, 3
imul edi, ecx
rol ebx, 7
add ebx, edi
xor eax, ebx
mov ecx, dword [ebp - 0x30]
add ecx, eax
rol ecx, 5
mov edi, eax
imul ecx, dword [ebp - 0x14]
shr edi, 1
xor ecx, edi
movzx edi, word [ebp - 0xc]
xor edx, ecx
mov ebx, edx
mov ecx, dword [ebp - 8]
xor ecx, edx
rol ecx, 3
imul ecx, edi
ror ebx, 0xc
add ebx, ecx
xor eax, ebx
mov edi, eax
mov ecx, eax
sub ecx, dword [ebp - 0xc]
rol ecx, 7
imul ecx, dword [ebp - 0x4c]
ror edi, 0xc
sub ecx, edi
xor edx, ecx
mov edi, edx
ror edi, 3
movzx ecx, word [ebp - 8]
sub edi, ecx
movzx ecx, word [ebp - 0xc]
imul edi, ecx
xor eax, edi
mov edi, eax
mov ecx, eax
sub ecx, dword [ebp - 8]
ror ecx, 6
imul ecx, dword [ebp - 0x14]
rol edi, 0xc
xor edi, ecx
xor edx, edi
mov ebx, edx
mov ecx, edx
movzx edi, word [ebp - 0xc]
xor ecx, dword [ebp - 0x14]
xor edx, dword [ebp - 0x18]
rol ecx, 7
imul ecx, edi
mov edi, dword [ebp - 0x44]
ror ebx, 2
sub ecx, ebx
xor ecx, dword [ebp - 0x38]
mov byte [edi + 7], dl
xor eax, ecx
mov cl, byte [ebp - 0xd]
mov byte [edi + 3], al
xor cl, al
xor cl, dl
ror eax, 8
xor cl, al
ror edx, 8
xor cl, dl
mov byte [edi + 2], al
ror eax, 8
mov byte [edi + 6], dl
mov byte [edi + 1], al
xor cl, al
ror edx, 8
mov byte [edi + 5], dl
xor cl, dl
ror eax, 8
ror edx, 8
mov bl, dl
xor bl, al
xor cl, bl
mov ebx, dword [ebp - 0x20]
mov byte [edi], al
mov byte [edi + 4], dl
add edi, 8
mov dword [ebp - 0x38], ebx
mov ebx, dword [ebp - 0x78]
dec dword [ebp - 0x2c]
mov byte [ebp - 0xd], cl
ror eax, 8
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x44], edi
ror edx, 8
jne 0x10406f2
mov ebx, dword [ebp - 0x40]
jmp 0x10408c7
xor edx, edx
test ebx, ebx
jge 0x10406c7
neg ebx
shl ebx, 3
mov ecx, ebx
shr eax, cl
shl eax, cl
jmp 0x10406c7
xor edx, edx
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
not eax
mov dword [ebp - 0x18], eax
xor eax, eax
jmp 0x10406ca
mov cl, byte [ebp - 0xd]
mov eax, dword [ebp - 0x3c]
cmp cl, byte [eax + 8]
je 0x104095d
call fcn.010259c0
mov esi, eax
mov edx, 0xffff
mov ecx, dword [ebp - 0x48]
and ecx, 0xfffffffc
mov eax, 0xfffff000
and esi, eax
mov edi, ecx
lea ecx, [edi + 0xfff]
and ecx, eax
mov eax, dword [ebp - 0x68]
mov dword [eax + 8], 0x103e45c
xor eax, eax
mov ebx, dword [0x104d00c]
imul ebx, ebx, 0x343fd
add ebx, 0x269ec3
mov dword [0x104d00c], ebx
shr ebx, 0x10
shl eax, 0x10
shr edx, 0x10
or eax, ebx
test edx, edx
jne 0x1040902
mov ebx, 0xffff
div ebx
inc edx
cmp edi, ecx
mov eax, edi
mov dword [ebp - 0x7c], esi
mov dword [ebp - 0x84], edx
mov dword [ebp - 0x48], 0
jae 0x1040953
mov edx, dword [ebp - 0x48]
mov dword [eax], edx
add eax, 4
cmp eax, ecx
jb 0x1040947
mov eax, 0x103e45c
jmp 0x1040a2c
mov eax, dword [ebp - 0x50]
mov edx, dword [0x1034d40]
mov ecx, 0x1000000
sub eax, dword [ebp - 0x1c]
sub ecx, edx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], ecx
jne 0x1040980
test eax, eax
je 0x1040a1f
mov esi, dword [ebp - 0x1c]
sub esi, dword [ebp - 0x50]
mov eax, dword [ebp - 0x34]
mov ecx, dword [0x1006098]
add eax, ebx
xor ebx, ebx
mov dword [ebp - 0x48], eax
dec ecx
js 0x10409c1
lea eax, [ecx + ebx]
cdq
sub eax, edx
sar eax, 1
mov edx, dword [eax*4 + 0x100609c]
and edx, 0xfffffff
cmp dword [ebp - 0x34], edx
jae 0x10409b8
lea ecx, [eax - 1]
jmp 0x10409bd
jbe 0x10409c5
lea ebx, [eax + 1]
cmp ecx, ebx
jge 0x1040999
mov edi, ebx
jmp 0x1040a17
mov edi, eax
jmp 0x1040a17
mov eax, dword [edi*4 + 0x100609c]
mov ecx, eax
and ecx, 0xfffffff
cmp ecx, dword [ebp - 0x48]
jae 0x1040a1f
lea ebx, [ecx + esi + 0x1000000]
mov ecx, eax
shl ecx, 2
sar ecx, 0x1e
sar eax, 0x1e
and ecx, 3
and eax, 3
xor edx, edx
dec ecx
je 0x1040a0a
dec ecx
je 0x1040a05
dec ecx
jne 0x1040a10
mov edx, dword [ebp - 0x3c]
jmp 0x1040a10
mov edx, dword [ebp - 0x2c]
jmp 0x1040a10
mov edx, dword [ebp - 0x3c]
sub edx, dword [ebp - 0x2c]
dec eax
dec eax
jne 0x1040a16
add dword [ebx], edx
inc edi
cmp edi, dword [0x1006098]
jb 0x10409c9
mov eax, dword [0x100aa54]
mov eax, 0xc2dcbd3
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x68]
mov dword [ecx + 8], eax
mov ecx, dword [ebp - 0x84]
mov edx, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x8c]
mov edi, dword [ebp - 0x88]
mov esi, dword [ebp - 0x90]
mov ebx, dword [ebp - 0x80]
mov esp, ebp
pop ebp
popfd
ret