Function at 0x1013d81
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
call fcn.010014d7
cwde
xchg ebp, eax
or byte [eax + 0x1008959c], dl
or cl, al
add al, al
jo 0x1013dc1
add byte [eax - 0x128c318], dh
call [eax - 0x63dff76b]
xchg ebp, eax
or byte [eax - 0x3fff3ef8], al
jo 0x1013dd6
add byte [eax - 0x74aa0075], ah
in al, dx
and esp, 0xfffffff8
sub esp, 0xd4
push ebx
push esi
add byte [eax], al
add byte [ebx + 0x56], dl
push edi
xor esi, esi
push esi
push esi
push 1
push esi
mov dword [esp + 0xe0], esi
add dword [esi - 0x77], edx
mov ah, 0x24
loopne 0x1013dc8
add byte [eax], al
mov dword [esp + 0xe4], esi
mov byte [esp + 0xec], 0
mov byte [esp + 0x37], 0
mov dword [esp + 0x2c], 0x8000000a
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
add byte [eax], al
add dh, al
inc esp
and al, 0x37
add bh, al
inc esp
and al, 0x2c
or al, byte [eax]
add byte [eax + 0x101415ff], al
add byte [ecx], al
call fcn.0106723b
rcl byte [ebp + 0x348008], 0
loopne 0x1013db6
xchg ebx, eax
add al, ah
pop esp
mov cs, word [eax]
inc eax
call fcn.01012c53
jo 0x1013e30
add byte [eax - 0x58], dh
xchg ebp, eax
or al, dh
cwde
cwde
add al, dh
movsb byte es:[edi], byte [esi]
xchg ebp, eax
or byte [eax], ah
mov ebx, 0x303c0d28
mov edi, 0x7fffffff
test eax, eax
jne 0x1013ec3
call fcn.01059e86
dec eax
test dword [eax], eax
invalid
xor eax, eax
mov dword [0x1089090], esi
mov dword [0x1089080], esi
mov byte [0x1089098], 1
mov byte [0x1089099], 0
mov word [0x108909a], ax
mov dword [0x108909c], esi
mov dword [0x10890a4], 0x100ef14
mov dword [0x1088e00], 0x1089080
call fcn.010137c7
mov eax, dword [0x1088e00]
cmp eax, 0x1088e00
je 0x1013f47
call fcn.0106723b
rcl byte [ebp + 0x343008], 0
push eax
mov esp, 0x5c900093
mov cs, word [eax]
nop
call fcn.01012c53
jo 0x1013f54
add al, dh
test al, 0x95
or al, ah
cwde
cwde
add al, dh
movsb byte es:[edi], byte [esi]
xchg ebp, eax
or byte [eax + 0x70ff0a6a], ah
adc al, 0xff
jo 0x1013f52
call fcn.010136d8
call fcn.0102df75
int3
add byte [eax - 0x7fff7a48], dh
enter 0x895, 0xfffffffffffffff0
mov eax, 0xc8800085
xchg ebp, eax
or al, dh
call fcn.010014d7
cwde
xchg ebp, eax
or byte [eax], al
pushfd
xchg ebp, eax
or byte [eax + 8], ah
rol dword [eax], 0x90
jo 0x1013f9c
add byte [eax], al
mov dword [esp + 0x1c], 0x1013f71
mov eax, dword [esp + 0x1c]
mov eax, dword [0x108940c]
test al, 4
jne 0x1013fa2
call fcn.0102df75
int3
leave
jmp 0x101522d
call fcn.0102df75
mov ah, 0x95
or byte [eax - 0x1ffffdb0], ah
dec eax
xchg esi, eax
add byte [eax - 0x50], dl
xchg ebp, eax
or byte [eax - 0x7d], dh
loopne 0x1013fbd
imul eax, eax, 0x18
add eax, 0x1088ea0
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call fcn.01059e86
test byte [ebp - 0x6a2bc000], al
or al, dl
fcom dword [ebp + 0x349008]
add al, al
mov dword [esp + 0x50], esi
cmp dword [0x108941c], esi
jne 0x101498f
mov eax, dword [0x1089408]
dec eax
cmp eax, esi
mov dword [esp + 0xa4], esi
mov dword [esp + 0xa8], esi
mov dword [esp + 0xac], esi
mov dword [esp + 0xb0], esi
mov dword [esp + 0xb4], esi
mov dword [esp + 0x2c], eax
jl 0x1014976
mov eax, dword [esp + 0x2c]
imul eax, eax, 0xc
lea esi, [eax + 0x1089420]
mov ecx, dword [esi]
mov dword [esp + 0x88], eax
mov eax, dword [eax + 0x1089428]
mov edx, 0xfffffff
and ecx, edx
shr eax, 1
add ecx, 0x1000000
and eax, edx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x38], eax
mov eax, 0xe506f8f3
mov eax, dword [esp + 0xa4]
mov esi, dword [esp + 0x18]
cmp esi, eax
jb 0x1014083
mov ecx, dword [esp + 0xa8]
mov edx, dword [esp + 0x38]
add ecx, eax
add edx, esi
cmp edx, ecx
jbe 0x1014144
cmp dword [esp + 0xb4], 0
je 0x10140b2
lea ecx, [esp + 0xac]
push ecx
push dword [esp + 0xb0]
push dword [esp + 0xb0]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
and dword [esp + 0xb4], 0
cmp dword [esp + 0xb0], 0
je 0x10140cf
and dword [esp + 0xb0], 0
push 0x10894a0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edx, dword [esp + 0x38]
and dword [esp + 0xac], 0
mov ecx, 0xfffff000
lea edx, [edx + esi + 0xfff]
mov eax, esi
and eax, ecx
and edx, ecx
sub edx, eax
push 0x10894a0
mov dword [esp + 0xa8], eax
mov dword [esp + 0xac], edx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [esp + 0xac]
push eax
push 0x40
push dword [esp + 0xb0]
mov dword [esp + 0xbc], 1
push dword [esp + 0xb0]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x10148ab
mov dword [esp + 0xb4], 1
test esi, esi
je 0x10148ab
mov eax, dword [esp + 0x88]
test byte [eax + 0x1089428], 1
je 0x101486c
cmp dword [esp + 0x38], 0
mov byte [esp + 0x13], 0
jbe 0x1014768
mov esi, 0x1089414
mov eax, 0x6a135e34
mov ecx, dword [0x1089418]
mov esi, dword [0x1089414]
mov edx, dword [0x100771c]
and dword [esp + 0x68], 0
and dword [esp + 0x6c], 0
mov eax, 0xfffffff
and ecx, eax
and esi, eax
mov eax, 0x1000000
add esi, 0x1000000
sub eax, edx
mov dword [esp + 0x28], ecx
mov dword [esp + 0xcc], eax
jne 0x101422b
and dword [esp + 0x14], 0
test ecx, ecx
jbe 0x10144e5
mov eax, dword [esp + 0x14]
movzx eax, byte [eax + esi]
add eax, ebx
add dword [esp + 0x68], eax
add eax, dword [esp + 0x6c]
mov edx, ebx
mul edx
lea edx, [eax + edx*2 - 0x7fffffff]
sar eax, 0x1f
and eax, edi
sub edx, eax
mov eax, edx
sar eax, 0x1f
and eax, edi
add eax, edx
mov edx, ebx
mul edx
add eax, edx
mov edx, ebx
mul edx
lea edx, [eax + edx*2 - 0x7fffffff]
sar eax, 0x1f
and eax, edi
sub edx, eax
mov eax, edx
sar eax, 0x1f
and eax, edi
add eax, edx
add dword [esp + 0x68], eax
inc dword [esp + 0x14]
mov dword [esp + 0x6c], eax
cmp dword [esp + 0x14], ecx
jb 0x10141c6
jmp 0x10144e5
lea eax, [esi + ecx]
mov ecx, esi
sub ecx, 0x1000000
mov edx, ecx
and edx, 0xfffff000
mov dword [esp + 0x1c], ecx
sub ecx, edx
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x20], edx
mov edx, dword [esp + 0x28]
add ecx, edx
mov edx, ecx
and edx, 0xfffff000
sub ecx, edx
mov dword [esp + 0x54], eax
mov eax, dword [0x100003c]
mov dword [esp + 0x78], ecx
mov ecx, dword [eax + 0x10000a0]
mov eax, dword [eax + 0x10000a4]
add ecx, 0x1000000
add eax, ecx
mov dword [esp + 0x74], edx
mov dword [esp + 0x7c], eax
jmp 0x1014296
mov edx, dword [esp + 0x20]
cmp dword [ecx], edx
jae 0x101429a
add ecx, dword [ecx + 4]
cmp ecx, eax
jne 0x101428b
and dword [esp + 0x84], 0
cmp ecx, eax
je 0x10142ee
mov eax, dword [esp + 0x20]
cmp dword [ecx], eax
jne 0x10142ee
mov eax, dword [ecx + 4]
sub eax, 8
shr eax, 1
mov dword [esp + 0x1c], eax
je 0x10142ee
lea eax, [ecx + 8]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
movzx eax, word [eax]
and eax, 0xfff
cmp eax, dword [esp + 0x14]
jae 0x10142ee
inc dword [esp + 0x84]
mov eax, dword [esp + 0x84]
add dword [esp + 0x20], 2
cmp eax, dword [esp + 0x1c]
jne 0x10142c3
cmp ecx, dword [esp + 0x7c]
je 0x101447e
mov eax, dword [ecx]
cmp eax, dword [esp + 0x74]
ja 0x101447e
mov eax, dword [ecx + 4]
lea edx, [eax - 8]
mov eax, dword [esp + 0x84]
shr edx, 1
cmp eax, edx
jne 0x101433a
add ecx, dword [ecx + 4]
cmp ecx, dword [esp + 0x7c]
je 0x101447e
mov eax, dword [esp + 0x74]
cmp dword [ecx], eax
ja 0x101447e
and dword [esp + 0x84], 0
jmp 0x1014304
mov edx, dword [esp + 0x74]
cmp dword [ecx], edx
jne 0x1014356
movzx eax, word [ecx + eax*2 + 8]
and eax, 0xfff
cmp eax, dword [esp + 0x78]
jae 0x101447e
mov eax, dword [esp + 0x84]
inc dword [esp + 0x84]
mov edx, 0xf000
test word [ecx + eax*2 + 8], dx
je 0x10142ee
mov edx, dword [ecx]
and dword [esp + 0x14], 0
lea eax, [ecx + eax*2 + 8]
movzx eax, word [eax]
and eax, 0xfff
lea eax, [eax + edx + 0x1000000]
mov dword [esp + 0x20], eax
sub dword [esp + 0x20], esi
mov dword [esp + 0x28], eax
je 0x1014400
mov eax, dword [esp + 0x14]
movzx eax, byte [eax + esi]
add eax, ebx
add dword [esp + 0x68], eax
add eax, dword [esp + 0x6c]
mov edx, ebx
mul edx
lea edx, [eax + edx*2 - 0x7fffffff]
sar eax, 0x1f
and eax, edi
sub edx, eax
mov eax, edx
sar eax, 0x1f
and eax, edi
add eax, edx
mov edx, ebx
mul edx
add eax, edx
mov edx, ebx
mul edx
lea edx, [eax + edx*2 - 0x7fffffff]
sar eax, 0x1f
and eax, edi
sub edx, eax
mov eax, edx
sar eax, 0x1f
and eax, edi
add eax, edx
add dword [esp + 0x68], eax
inc dword [esp + 0x14]
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x20]
jb 0x101439c
mov eax, dword [esp + 0x28]
mov eax, dword [eax]
sub eax, dword [esp + 0xcc]
xor esi, esi
mov dword [esp + 0x8c], eax
movzx eax, byte [esp + esi + 0x8c]
add eax, ebx
add dword [esp + 0x68], eax
add eax, dword [esp + 0x6c]
mov edx, ebx
mul edx
lea edx, [eax + edx*2 - 0x7fffffff]
sar eax, 0x1f
and eax, edi
sub edx, eax
mov eax, edx
sar eax, 0x1f
and eax, edi
add eax, edx
mov edx, ebx
mul edx
add eax, edx
mov edx, ebx
mul edx
lea edx, [eax + edx*2 - 0x7fffffff]
sar eax, 0x1f
and eax, edi
sub edx, eax
mov eax, edx
sar eax, 0x1f
and eax, edi
add eax, edx
add dword [esp + 0x68], eax
inc esi
mov dword [esp + 0x6c], eax
cmp esi, 4
jb 0x1014416
mov esi, dword [esp + 0x28]
add esi, 4
jmp 0x10142ee
mov eax, dword [esp + 0x54]
xor ecx, ecx
sub eax, esi
mov dword [esp + 0x54], eax
je 0x10144e5
movzx eax, byte [ecx + esi]
add eax, ebx
add dword [esp + 0x68], eax
add eax, dword [esp + 0x6c]
mov edx, ebx
mul edx
lea edx, [eax + edx*2 - 0x7fffffff]
sar eax, 0x1f
and eax, edi
sub edx, eax
mov eax, edx
sar eax, 0x1f
and eax, edi
add eax, edx
mov edx, ebx
mul edx
add eax, edx
mov edx, ebx
mul edx
lea edx, [eax + edx*2 - 0x7fffffff]
sar eax, 0x1f
and eax, edi
sub edx, eax
mov eax, edx
sar eax, 0x1f
and eax, edi
add eax, edx
add dword [esp + 0x68], eax
inc ecx
mov dword [esp + 0x6c], eax
cmp ecx, dword [esp + 0x54]
jb 0x101448c
xor eax, eax
mov ecx, eax
and ecx, 7
mov cl, byte [esp + ecx + 0x68]
mov byte [esp + eax + 0x30], cl
inc eax
cmp eax, 6
jb 0x10144e7
mov eax, 0x5352feda
or byte [esp + 0x30], 1
or byte [esp + 0x32], 1
or byte [esp + 0x34], 1
or byte [esp + 0x35], 1
mov eax, dword [esp + 0x38]
mov esi, 0x100
dec eax
mov dword [esp + 0x28], eax
je 0x10146b9
mov ecx, dword [esp + 0x18]
test al, 1
je 0x10145dc
add eax, ecx
mov cl, byte [eax]
mov dword [esp + 0x1c], eax
mov al, cl
xor al, byte [esp + 0x33]
and al, 1
mov byte [esp + 0x12], al
movzx eax, byte [esp + 0x33]
je 0x101456e
movzx ecx, cl
mov dword [esp + 0x14], ecx
movzx ecx, byte [esp + 0x32]
mov edx, eax
shr edx, 1
shr ecx, 1
xor ecx, edx
mov edx, dword [esp + 0x14]
xor edx, esi
sar edx, 1
xor ecx, edx
jmp 0x101457b
movzx edx, cl
mov ecx, eax
xor ecx, edx
mov dword [esp + 0x14], edx
shr ecx, 1
mov edx, dword [esp + 0x18]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x28]
movzx edx, byte [ecx + edx - 1]
mov ecx, dword [esp + 0x20]
xor ecx, edx
test cl, 1
je 0x10145c7
cmp byte [esp + 0x12], 0
je 0x10145b5
movzx ecx, byte [esp + 0x32]
shr eax, 1
shr ecx, 1
xor ecx, eax
mov eax, dword [esp + 0x14]
xor eax, esi
sar eax, 1
xor ecx, eax
jmp 0x10145bd
xor eax, dword [esp + 0x14]
shr eax, 1
mov ecx, eax
movzx eax, byte [esp + 0x35]
jmp 0x101466b
cmp byte [esp + 0x12], 0
je 0x1014698
movzx ecx, byte [esp + 0x32]
jmp 0x1014686
add eax, ecx
mov cl, byte [eax]
mov dword [esp + 0x1c], eax
mov al, cl
xor al, byte [esp + 0x31]
and al, 1
mov byte [esp + 0x12], al
movzx eax, byte [esp + 0x31]
je 0x1014617
movzx ecx, cl
mov dword [esp + 0x14], ecx
movzx ecx, byte [esp + 0x30]
mov edx, eax
shr edx, 1
shr ecx, 1
xor ecx, edx
mov edx, dword [esp + 0x14]
xor edx, esi
sar edx, 1
xor ecx, edx
jmp 0x1014624
movzx edx, cl
mov ecx, eax
xor ecx, edx
mov dword [esp + 0x14], edx
shr ecx, 1
mov edx, dword [esp + 0x18]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x28]
movzx edx, byte [ecx + edx - 1]
mov ecx, dword [esp + 0x20]
xor ecx, edx
test cl, 1
je 0x101467a
cmp byte [esp + 0x12], 0
je 0x101465e
movzx ecx, byte [esp + 0x30]
shr eax, 1
shr ecx, 1
xor ecx, eax
mov eax, dword [esp + 0x14]
xor eax, esi
sar eax, 1
xor ecx, eax
jmp 0x1014666
xor eax, dword [esp + 0x14]
shr eax, 1
mov ecx, eax
movzx eax, byte [esp + 0x34]
shr eax, 1
xor ecx, edx
xor eax, 0x80
sar ecx, 1
xor eax, ecx
jmp 0x10146a6
cmp byte [esp + 0x12], 0
je 0x1014698
movzx ecx, byte [esp + 0x30]
shr eax, 1
shr ecx, 1
xor ecx, eax
mov eax, dword [esp + 0x14]
xor eax, esi
sar eax, 1
xor ecx, eax
jmp 0x10146a0
xor eax, dword [esp + 0x14]
shr eax, 1
mov ecx, eax
xor ecx, edx
sar ecx, 1
mov eax, ecx
mov ecx, dword [esp + 0x1c]
xor byte [esp + 0x13], al
mov byte [ecx], al
mov eax, dword [esp + 0x28]
jmp 0x101451c
mov eax, dword [esp + 0x18]
mov cl, byte [eax]
mov al, cl
xor al, byte [esp + 0x31]
and al, 1
mov byte [esp + 0x12], al
movzx eax, byte [esp + 0x31]
je 0x10146f6
movzx ecx, cl
mov dword [esp + 0x1c], ecx
movzx ecx, byte [esp + 0x30]
mov edx, eax
shr edx, 1
shr ecx, 1
xor ecx, edx
mov edx, dword [esp + 0x1c]
xor edx, esi
sar edx, 1
xor ecx, edx
mov edx, dword [esp + 0x1c]
jmp 0x10146ff
movzx edx, cl
mov ecx, eax
xor ecx, edx
shr ecx, 1
test cl, 1
je 0x1014731
cmp byte [esp + 0x12], 0
je 0x101471e
movzx ecx, byte [esp + 0x30]
shr ecx, 1
shr eax, 1
xor edx, esi
xor ecx, eax
sar edx, 1
xor ecx, edx
jmp 0x1014724
xor eax, edx
shr eax, 1
mov ecx, eax
movzx eax, byte [esp + 0x34]
xor eax, ecx
xor eax, esi
sar eax, 1
jmp 0x1014755
cmp byte [esp + 0x12], 0
je 0x101474b
movzx ecx, byte [esp + 0x30]
shr ecx, 1
shr eax, 1
xor edx, esi
xor ecx, eax
sar edx, 1
xor ecx, edx
jmp 0x1014751
xor eax, edx
shr eax, 1
mov ecx, eax
sar ecx, 1
mov eax, ecx
mov ecx, dword [esp + 0x18]
xor byte [esp + 0x13], al
mov byte [ecx], al
mov eax, dword [esp + 0x88]
mov esi, ecx
and dword [eax + 0x1089428], 0xfffffffe
mov ecx, dword [eax + 0x1089428]
mov al, byte [eax + 0x1089424]
xor al, byte [esp + 0x13]
jne 0x10148b5
test ecx, 0x20000000
jne 0x101486c
mov edx, dword [0x100771c]
mov ecx, 0x1000000
mov eax, ecx
sub eax, edx
mov dword [esp + 0x20], eax
je 0x101485b
mov eax, dword [esp + 0x38]
sub esi, ecx
mov ecx, esi
mov esi, dword [0x101c5b0]
add eax, ecx
mov dword [esp + 0x54], eax
xor eax, eax
dec esi
mov dword [esp + 0x1c], eax
js 0x10147f3
add eax, esi
cdq
sub eax, edx
sar eax, 1
mov edx, dword [eax*4 + 0x101c5b4]
and edx, 0xfffffff
cmp ecx, edx
jae 0x10147e8
lea esi, [eax - 1]
mov eax, dword [esp + 0x1c]
jmp 0x10147ef
jbe 0x10147f3
inc eax
mov dword [esp + 0x1c], eax
cmp esi, eax
jge 0x10147c7
mov dword [esp + 0x18], eax
jmp 0x101484f
mov eax, dword [esp + 0x18]
mov ecx, dword [eax*4 + 0x101c5b4]
mov eax, ecx
and eax, 0xfffffff
mov dword [esp + 0x8c], eax
cmp eax, dword [esp + 0x54]
jae 0x101485b
mov edx, ecx
shl edx, 2
mov esi, ecx
sar edx, 0x1e
sar esi, 0x1e
and edx, 3
and esi, 3
xor eax, eax
dec edx
je 0x1014836
dec edx
je 0x10148a7
dec edx
jne 0x101483a
mov eax, dword [esp + 0x20]
dec esi
dec esi
jne 0x101484b
mov ecx, dword [esp + 0x8c]
add dword [ecx + 0x1000000], eax
inc dword [esp + 0x18]
mov eax, dword [esp + 0x18]
cmp eax, dword [0x101c5b0]
jb 0x10147f9
mov eax, dword [esp + 0x88]
or dword [eax + 0x1089428], 0x20000000
mov eax, 0xd4bcbec6
dec dword [esp + 0x2c]
jns 0x1014023
call fcn.01059e86
dec eax
test dword [eax], eax
xor al, ah
xchg ebp, eax
or al, ah
in al, 0x95
or byte [eax], dl
cmp al, 0
add byte [eax], al
call fcn.0106561e
xchg ecx, eax
add al, 0
pushal
push esp
mov cs, word [eax]
add byte [eax], 0x94
add byte [eax - 0x44], dl
xchg ebp, eax
or byte [eax], ah
jmp 0x10148bd
xor eax, eax
jmp 0x101483a
mov dword [esp + 0x50], 0x8007000e
jmp 0x10148bd
mov dword [esp + 0x50], 0x80004005
call fcn.0102df75
int3
xor eax, eax
mov dword [esp + 0xa4], eax
mov dword [esp + 0xa8], eax
mov dword [esp + 0xac], eax
xor esi, esi
call fcn.0106561e
nop
add al, 0
and byte [esi + ecx*4 + 8], dl
lock add byte [eax + eax + 0x895bcd0], dl
adc bh, bh
add eax, 0x108941c
cmp dword [esp + 0x50], esi
jge 0x10151e3
call fcn.0106561e
xchg ecx, eax
add al, 0
loopne 0x1014a12
mov cs, word [eax]
and byte [eax], al
xchg esp, eax
add byte [eax], dl
mov esp, 0xff400895
or eax, 0x108941c
jne 0x10151e3
call fcn.0106723b
rcl byte [ebp + 0x34b008], 0
cmp byte [ebx + edx*4 - 0x71a3b000], 8
inc eax
call fcn.0106561e
nop
add al, 0
add byte [esi + ecx*4 + 8], dl
or byte [eax - 0x18], al
das
or al, 5
add byte [eax + 0x54000004], dl
mov cs, word [eax]
nop
add byte [eax + eax + 0x895bca0], dl
jo 0x10149e8
sbb cl, byte [eax + 0x49000]
rcl byte [esi + ecx*4 + 8], 0x30
add byte [eax + eax + 0x895bcd0], dl
sar byte [ecx], 0x35
or byte [eax + ecx + 0x24b48901], dl
mov eax, 0x89000000
mov ah, 0x24
mov esp, 0x89000000
mov ah, 0x24
rol byte [eax], 0
add byte [ecx + 0xc424b4], cl
add byte [eax], al
or al, al
cmp dword [0x1089408], esi
mov dword [esp + 0xb8], esi
mov dword [esp + 0xbc], esi
mov dword [esp + 0xc0], esi
mov dword [esp + 0xc4], esi
mov dword [esp + 0xc8], esi
mov dword [esp + 0x20], esi
jle 0x10151b5
mov eax, dword [esp + 0x20]
imul eax, eax, 0xc
lea esi, [eax + 0x1089420]
mov ecx, dword [esi]
mov dword [esp + 0x88], eax
mov eax, dword [eax + 0x1089428]
mov edx, 0xfffffff
and ecx, edx
shr eax, 1
add ecx, 0x1000000
and eax, edx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], eax
mov eax, 0x6b8d8946
mov eax, dword [esp + 0xb8]
mov ecx, dword [esp + 0xbc]
cmp dword [esp + 0x18], eax
jb 0x1014aaa
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
add esi, edx
lea edx, [ecx + eax]
cmp esi, edx
jbe 0x1014b61
xor esi, esi
cmp dword [esp + 0xc8], esi
je 0x1014ad3
lea edx, [esp + 0xc0]
push edx
push dword [esp + 0xc4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [esp + 0xc8], esi
cmp dword [esp + 0xc4], esi
je 0x1014aee
push 0x10894a0
mov dword [esp + 0xc8], esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edx, dword [esp + 0x18]
mov eax, edx
mov dword [esp + 0xc0], esi
mov esi, dword [esp + 0x14]
mov ecx, 0xfffff000
lea edx, [edx + esi + 0xfff]
and eax, ecx
and edx, ecx
sub edx, eax
push 0x10894a0
mov dword [esp + 0xbc], eax
mov dword [esp + 0xc0], edx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [esp + 0xc0]
push eax
push 0x40
push dword [esp + 0xc4]
xor esi, esi
push dword [esp + 0xc4]
inc esi
mov dword [esp + 0xd4], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x10150d2
mov dword [esp + 0xc8], esi
cmp dword [esp + 0x18], 0
je 0x10150d2
mov eax, dword [esp + 0x88]
test byte [eax + 0x1089428], 1
jne 0x10150b9
cmp dword [esp + 0x14], 0
mov byte [esp + 0x13], 0
jbe 0x10150a1
mov esi, 0x1089414
mov eax, 0x555d2740
mov ecx, dword [0x1089418]
mov esi, dword [0x1089414]
mov edx, dword [0x100771c]
and dword [esp + 0x60], 0
and dword [esp + 0x64], 0
mov eax, 0xfffffff
and ecx, eax
and esi, eax
mov eax, 0x1000000
add esi, 0x1000000
sub eax, edx
mov dword [esp + 0xcc], ecx
mov dword [esp + 0x38], eax
jne 0x1014c4b
and dword [esp + 0x28], 0
test ecx, ecx
jbe 0x1014f05
mov eax, dword [esp + 0x28]
movzx eax, byte [eax + esi]
add eax, ebx
add dword [esp + 0x60], eax
add eax, dword [esp + 0x64]
mov edx, ebx
mul edx
lea edx, [eax + edx*2 - 0x7fffffff]
sar eax, 0x1f
and eax, edi
sub edx, eax
mov eax, edx
sar eax, 0x1f
and eax, edi
add eax, edx
mov edx, ebx
mul edx
add eax, edx
mov edx, ebx
mul edx
lea edx, [eax + edx*2 - 0x7fffffff]
sar eax, 0x1f
and eax, edi
sub edx, eax
mov eax, edx
sar eax, 0x1f
and eax, edi
add eax, edx
add dword [esp + 0x60], eax
inc dword [esp + 0x28]
mov dword [esp + 0x64], eax
cmp dword [esp + 0x28], ecx
jb 0x1014be6
jmp 0x1014f05
lea eax, [esi + ecx]
mov ecx, esi
sub ecx, 0x1000000
mov edx, ecx
and edx, 0xfffff000
mov dword [esp + 0x54], ecx
sub ecx, edx
mov dword [esp + 0x8c], ecx
mov ecx, dword [esp + 0x54]
mov dword [esp + 0x1c], edx
mov edx, dword [esp + 0xcc]
add ecx, edx
mov edx, ecx
and edx, 0xfffff000
sub ecx, edx
mov dword [esp + 0x3c], eax
mov eax, dword [0x100003c]
mov dword [esp + 0x78], ecx
mov ecx, dword [eax + 0x10000a0]
mov eax, dword [eax + 0x10000a4]
add ecx, 0x1000000
add eax, ecx
mov dword [esp + 0x74], edx
mov dword [esp + 0x7c], eax
jmp 0x1014cbc
mov edx, dword [esp + 0x1c]
cmp dword [ecx], edx
jae 0x1014cc0
add ecx, dword [ecx + 4]
cmp ecx, eax
jne 0x1014cb1
and dword [esp + 0x84], 0
cmp ecx, eax
je 0x1014d17
mov eax, dword [esp + 0x1c]
cmp dword [ecx], eax
jne 0x1014d17
mov eax, dword [ecx + 4]
sub eax, 8
shr eax, 1
mov dword [esp + 0x54], eax
je 0x1014d17
lea eax, [ecx + 8]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
movzx eax, word [eax]
and eax, 0xfff
cmp eax, dword [esp + 0x8c]
jae 0x1014d17
inc dword [esp + 0x84]
mov eax, dword [esp + 0x84]
add dword [esp + 0x2c], 2
cmp eax, dword [esp + 0x54]
jne 0x1014ce9
cmp ecx, dword [esp + 0x7c]
je 0x1014e9e
mov eax, dword [ecx]
cmp eax, dword [esp + 0x74]
ja 0x1014e9e
mov eax, dword [ecx + 4]
lea edx, [eax - 8]
mov eax, dword [esp + 0x84]
shr edx, 1
cmp eax, edx
jne 0x1014d63
add ecx, dword [ecx + 4]
cmp ecx, dword [esp + 0x7c]
je 0x1014e9e
mov eax, dword [esp + 0x74]
cmp dword [ecx], eax
ja 0x1014e9e
and dword [esp + 0x84], 0
jmp 0x1014d2d
mov edx, dword [esp + 0x74]
cmp dword [ecx], edx
jne 0x1014d7f
movzx eax, word [ecx + eax*2 + 8]
and eax, 0xfff
cmp eax, dword [esp + 0x78]
jae 0x1014e9e
mov eax, dword [esp + 0x84]
inc dword [esp + 0x84]
mov edx, 0xf000
test word [ecx + eax*2 + 8], dx
je 0x1014d17
mov edx, dword [ecx]
and dword [esp + 0x28], 0
lea eax, [ecx + eax*2 + 8]
movzx eax, word [eax]
and eax, 0xfff
lea eax, [eax + edx + 0x1000000]
mov dword [esp + 0x2c], eax
sub dword [esp + 0x2c], esi
mov dword [esp + 0x1c], eax
je 0x1014e29
mov eax, dword [esp + 0x28]
movzx eax, byte [eax + esi]
add eax, ebx
add dword [esp + 0x60], eax
add eax, dword [esp + 0x64]
mov edx, ebx
mul edx
lea edx, [eax + edx*2 - 0x7fffffff]
sar eax, 0x1f
and eax, edi
sub edx, eax
mov eax, edx
sar eax, 0x1f
and eax, edi
add eax, edx
mov edx, ebx
mul edx
add eax, edx
mov edx, ebx
mul edx
lea edx, [eax + edx*2 - 0x7fffffff]
sar eax, 0x1f
and eax, edi
sub edx, eax
mov eax, edx
sar eax, 0x1f
and eax, edi
add eax, edx
add dword [esp + 0x60], eax
inc dword [esp + 0x28]
mov dword [esp + 0x64], eax
mov eax, dword [esp + 0x28]
cmp eax, dword [esp + 0x2c]
jb 0x1014dc5
mov eax, dword [esp + 0x1c]
mov eax, dword [eax]
sub eax, dword [esp + 0x38]
xor esi, esi
mov dword [esp + 0x54], eax
movzx eax, byte [esp + esi + 0x54]
add eax, ebx
add dword [esp + 0x60], eax
add eax, dword [esp + 0x64]
mov edx, ebx
mul edx
lea edx, [eax + edx*2 - 0x7fffffff]
sar eax, 0x1f
and eax, edi
sub edx, eax
mov eax, edx
sar eax, 0x1f
and eax, edi
add eax, edx
mov edx, ebx
mul edx
add eax, edx
mov edx, ebx
mul edx
lea edx, [eax + edx*2 - 0x7fffffff]
sar eax, 0x1f
and eax, edi
sub edx, eax
mov eax, edx
sar eax, 0x1f
and eax, edi
add eax, edx
add dword [esp + 0x60], eax
inc esi
mov dword [esp + 0x64], eax
cmp esi, 4
jb 0x1014e39
mov esi, dword [esp + 0x1c]
add esi, 4
jmp 0x1014d17
mov eax, dword [esp + 0x3c]
xor ecx, ecx
sub eax, esi
mov dword [esp + 0x3c], eax
je 0x1014f05
movzx eax, byte [ecx + esi]
add eax, ebx
add dword [esp + 0x60], eax
add eax, dword [esp + 0x64]
mov edx, ebx
mul edx
lea edx, [eax + edx*2 - 0x7fffffff]
sar eax, 0x1f
and eax, edi
sub edx, eax
mov eax, edx
sar eax, 0x1f
and eax, edi
add eax, edx
mov edx, ebx
mul edx
add eax, edx
mov edx, ebx
mul edx
lea edx, [eax + edx*2 - 0x7fffffff]
sar eax, 0x1f
and eax, edi
sub edx, eax
mov eax, edx
sar eax, 0x1f
and eax, edi
add eax, edx
add dword [esp + 0x60], eax
inc ecx
mov dword [esp + 0x64], eax
cmp ecx, dword [esp + 0x3c]
jb 0x1014eac
xor eax, eax
mov ecx, eax
and ecx, 7
mov cl, byte [esp + ecx + 0x60]
mov byte [esp + eax + 0x40], cl
inc eax
cmp eax, 6
jb 0x1014f07
mov eax, 0xf855f610
mov esi, dword [esp + 0x18]
mov al, byte [esi]
or byte [esp + 0x40], 1
or byte [esp + 0x42], 1
or byte [esp + 0x44], 1
or byte [esp + 0x45], 1
movzx ecx, al
mov dl, al
add ecx, ecx
and dl, 0x80
mov byte [esp + 0x13], al
je 0x1014f52
movzx eax, byte [esp + 0x44]
xor eax, ecx
jmp 0x1014f54
mov eax, ecx
test al, al
jns 0x1014f72
test dl, dl
je 0x1014f65
movzx eax, byte [esp + 0x44]
xor eax, ecx
jmp 0x1014f67
mov eax, ecx
movzx ecx, byte [esp + 0x40]
add eax, eax
xor eax, ecx
jmp 0x1014f83
test dl, dl
je 0x1014f7f
movzx eax, byte [esp + 0x44]
xor eax, ecx
jmp 0x1014f81
mov eax, ecx
add eax, eax
mov cl, byte [esp + 0x41]
xor cl, al
xor eax, eax
inc eax
mov byte [esi], cl
mov dword [esp + 0x38], eax
cmp dword [esp + 0x14], eax
jbe 0x10150a1
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x18]
add eax, ecx
mov dword [esp + 0x3c], eax
mov al, byte [eax]
xor byte [esp + 0x13], al
mov byte [esp + 0x12], al
test cl, 1
je 0x1015023
movzx edx, al
add edx, edx
and byte [esp + 0x12], 0x80
je 0x1014fce
movzx esi, byte [esp + 0x45]
xor esi, edx
jmp 0x1014fd0
mov esi, edx
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x38]
movzx eax, byte [eax + ecx - 1]
mov ecx, eax
xor ecx, esi
test cl, cl
jns 0x1015004
cmp byte [esp + 0x12], 0
je 0x1014ff5
movzx ecx, byte [esp + 0x45]
xor ecx, edx
jmp 0x1014ff7
mov ecx, edx
xor eax, ecx
movzx ecx, byte [esp + 0x42]
add eax, eax
xor eax, ecx
jmp 0x101501a
cmp byte [esp + 0x12], 0
je 0x1015014
movzx ecx, byte [esp + 0x45]
xor ecx, edx
jmp 0x1015016
mov ecx, edx
xor eax, ecx
add eax, eax
mov ecx, eax
movzx eax, byte [esp + 0x43]
jmp 0x1015087
movzx esi, al
add esi, esi
and byte [esp + 0x12], 0x80
je 0x1015038
movzx eax, byte [esp + 0x44]
xor eax, esi
jmp 0x101503a
mov eax, esi
mov edx, dword [esp + 0x18]
movzx ecx, byte [ecx + edx - 1]
mov edx, ecx
xor edx, eax
test dl, dl
jns 0x101506a
cmp byte [esp + 0x12], 0
je 0x101505b
movzx eax, byte [esp + 0x44]
xor eax, esi
jmp 0x101505d
mov eax, esi
xor eax, ecx
movzx ecx, byte [esp + 0x40]
add eax, eax
xor eax, ecx
jmp 0x1015080
cmp byte [esp + 0x12], 0
je 0x101507a
movzx eax, byte [esp + 0x44]
xor eax, esi
jmp 0x101507c
mov eax, esi
xor eax, ecx
add eax, eax
mov ecx, eax
movzx eax, byte [esp + 0x41]
xor eax, ecx
mov ecx, dword [esp + 0x3c]
inc dword [esp + 0x38]
mov byte [ecx], al
mov eax, dword [esp + 0x38]
cmp eax, dword [esp + 0x14]
jb 0x1014f9c
mov eax, dword [esp + 0x88]
mov cl, byte [esp + 0x13]
or dword [eax + 0x1089428], 1
mov byte [eax + 0x1089424], cl
mov eax, 0xb93237af
inc dword [esp + 0x20]
mov eax, dword [esp + 0x20]
cmp eax, dword [0x1089408]
jl 0x1014a47
call fcn.0102df75
mov ah, 0x95
or byte [eax - 0x1ffffdb0], dh
dec eax
xchg esi, eax
add byte [eax - 0x4ff76a50], ah
xor esi, esi
cmp dword [esp + 0xc8], esi
je 0x101515b
call fcn.01012c53
jo 0x1015121
add byte [eax], al
test al, 0x95
or al, ah
cwde
cwde
add byte [eax + 0x300895a4], al
lea eax, [esp + 0xc0]
push eax
push dword [esp + 0xc4]
push dword [esp + 0xc4]
push dword [esp + 0xc4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
add byte [eax], al
add bh, bh
adc eax, sym.imp.KERNEL32.dll_VirtualProtect
call fcn.01059e86
dec eax
test dword [eax], eax
invalid
call fcn.0106723b
rcl byte [ebp + 0x343008], 0
sar byte [ebx + edx*4 - 0x71a3f000], 1
or al, dh
call fcn.01012c53
jo 0x101519f
add byte [eax + 0x300895a8], dl
cwde
cwde
add byte [eax - 0x5c], dh
xchg ebp, eax
or byte [eax + 0x39], ah
mov ah, 0x24
les eax, [eax]
add byte [eax], al
je 0x10151b5
call fcn.01059e86
test byte [ebp - 0x6a2b5000], al
or byte [eax - 0x28], al
xchg ebp, eax
or byte [eax + 0x34], dl
add byte [eax], al
adc byte [eax - 0x60], ch
xchg esp, eax
or byte [ecx], al
xor al, 0
add byte [eax], dl
push 0x10894a0
mov dword [esp + 0xc8], esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.0102df75
int3
call fcn.01059e86
test byte [ebp - 0x6a2b2000], al
or al, dl
fcom dword [ebp + 0x34d008]
add byte [eax - 0x25a918], ah
push dword [eax + 0x28]
add byte [eax - 0x58], al
xchg ebp, eax
or byte [eax], dh
cwde
cwde
add byte [eax - 0x5c], ah
xchg ebp, eax
or al, dh
mov eax, dword [0x108940c]
and eax, 3
imul eax, eax, 0x18
add eax, 0x1088ea0
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x50]
mov eax, dword [0x108940c]
call fcn.01059e86
dec eax
test dword [eax], eax
and al, 0x95
or byte [eax + 0x400895e4], dl
cmp al, 0
add al, dl
call fcn.01059e86
test byte [ebp - 0x6a2b9000], al
or byte [eax - 0x1ff76a28], al
xor al, 0
add al, ah
call fcn.0106723b
rcl byte [ebp + 0x348008], 0
and byte [ebx + edx*4 - 0x71a37000], bh
or byte [eax], dh
call fcn.0102df75
mov ah, 0x95
or byte [eax], dl
push eax
add al, byte [eax]
add byte [eax - 0x6a], cl
add byte [eax - 0x50], dl
xchg ebp, eax
or byte [eax], dl
call fcn.010014d7
cwde
xchg ebp, eax
or byte [eax + 0x8959c], ah
or cl, al
add al, dl
jo 0x10152c1
add byte [eax + 0x4c89ce3b], dl
and al, 0x1c
mov dword [esp + 0x14], ecx
jl 0x10154bb
call fcn.0102df75
mov ah, 0x95
or byte [eax + 0x60000250], ah
dec eax
xchg esi, eax
add byte [eax + 0x500895b0], al
cmp dword [ebp + 8], 1
jle 0x101531b
mov eax, dword [ebp + 0xc]
push 0x100ef74
push dword [eax + 4]
call sub.msvcrt.dll__stricmp
call fcn.0106723b
rcl byte [ebp + 0x344008], 0
cmp byte [ebx + edx*4 - 0x71a3c000], 8
nop
pop ecx
pop ecx
test eax, eax
jne 0x101531b
call fcn.0102df75
int3
mov cl, byte [esp + 0x27]
lea edx, [esp + 0xd0]
call fcn.0107c654
lahf
add byte [eax], al
and byte [edx - 0x173ffec8], 3
pop ds
add eax, 0x895c000
mov al, byte [0x80000034]
mov esp, 0x5cd00093
mov cs, word [eax]
call fcn.0106723b
rcl byte [ebp + 0x34a008], 0
cmp byte [ebx + edx*4 - 0x71a33000], 8
pushal
call fcn.0102df75
mov ah, 0x95
or byte [eax + 0x40000250], ah
dec eax
xchg esi, eax
add byte [eax - 0x50], dl
xchg ebp, eax
or al, dl
cmp eax, esi
mov dword [esp + 0x14], eax
jl 0x10154b6
call fcn.01059e86
dec eax
test dword [eax], eax
add al, ah
xchg ebp, eax
or byte [eax - 0x7ff76a1c], dh
cmp al, 0
add al, dh
lea eax, [esp + 0xd0]
push eax
call fcn.0107c654
popfd
add byte [eax], al
sar byte [ebx - 0x77], 1
add dword [eax + 0x44aeee8], eax
add byte [eax - 0x7b], cl
add al, ah
loopne 0x1015333
or byte [eax - 0x1c], ah
xchg ebp, eax
or byte [eax - 0x5fffffc4], ah
mov dword [esp + 0x14], eax
test eax, eax
jl 0x10154b6
call fcn.0106723b
rcl byte [ebp + 0x345008], 0
nop
mov esp, 0x5cf00093
mov cs, word [eax]
xor al, ch
cmpsd dword [esi], dword es:[edi]
mov eax, dword [ecx]
add byte [ebp + edx*4 + 0x2505008], dh
add byte [eax + 0x30009648], dl
mov al, 0x95
or byte [eax - 0x73], al
pushfd
and al, 0xd0
add byte [eax], al
add al, ch
push 0x72
push es
add byte [edi], dh
add byte [eax - 0x1e], ah
xchg dword [ecx], eax
mov al, pe_nt_image_headers32
pop esp
fdivr st(7)
push dword [eax + 0x28]
add al, dh
test al, 0x95
or al, dl
cwde
cwde
add byte [eax + 0x895a4], dh
mov dword [esp + 0x14], eax
test eax, eax
jl 0x10154b6
call fcn.01012c53
jo 0x1015442
add byte [eax - 0x58], dh
xchg ebp, eax
or byte [eax - 0x68], al
cwde
add byte [eax + 0x400895a4], dh
call fcn.010014d7
cwde
xchg ebp, eax
or byte [eax], al
pushfd
xchg ebp, eax
or byte [eax - 0xfff3ef8], dl
jo 0x1015468
add al, al
call fcn.0107c654
pop edx
add byte [eax], al
adc byte [esp + edi + 0x44892001], bl
and al, 0x14
test eax, eax
jl 0x10154b6
mov eax, dword [0x1088e00]
cmp eax, 0x1088e00
je 0x1015495
call fcn.0102df75
int3
push cs
add byte [eax - 0x48], ah
test dword [eax], eax
mov al, 0xc8
xchg ebp, eax
or byte [eax + 0x501a6e8], dl
add byte [ecx + 0x54200004], dl
mov cs, word [eax]
nop
add byte [eax + eax + 0x895bcb0], dl
shr byte [edx + 0xb], 1
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010136d8
call fcn.01059e86
test byte [ebp - 0x6a2b3000], al
or byte [eax], al
fcom dword [ebp + 0x345008]
add byte [eax], dh
xor esi, esi
cmp dword [esp + 0x14], esi
jge 0x1015865
mov eax, dword [0x108940c]
call fcn.01012c53
jo 0x10154ea
add byte [eax - 0x58], ah
xchg ebp, eax
or byte [eax - 0x2fff6768], ah
movsb byte es:[edi], byte [esi]
xchg ebp, eax
or byte [eax - 0x71fff275], dl
or byte [ecx], al
cmp ecx, 0x1088e00
je 0x101555b
add byte [esi - 0x67efef8], cl
add byte [esi + 0x7d740108], cl
call fcn.01059e86
dec eax
test dword [eax], eax
and al, ah
xchg ebp, eax
or byte [eax], dl
in al, 0x95
adc ah, ah
xchg ebp, eax
or al, dl
cmp al, 0
add byte [eax + 0x18a7de8], dh
add ah, cl
xchg ebp, eax
or byte [eax + 0xe04], ah
mov eax, 0xc8600085
xchg ebp, eax
or byte [eax], ah
call fcn.0106723b
rcl byte [ebp + 0x343008], 0
loopne 0x10154d2
xchg ebx, eax
add byte [eax + 0x5c], ah
mov cs, word [eax]
pushal
push dword [esp + 0x14]
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.010136fb
call fcn.01059e86
test byte [ebp - 0x6a2b6000], al
or byte [eax - 0x6ff76a28], al
xor al, 0
add al, al
call fcn.0102df75
mov ah, 0x95
or al, al
push eax
add al, byte [eax]
pushal
dec eax
xchg esi, eax
add al, dl
mov al, 0x95
or byte [eax + 0x8940ca1], al
add eax, ebp
dec ecx
add al, 0
call fcn.01059e86
dec eax
test dword [eax], eax
adc al, ah
xchg ebp, eax
or byte [eax + 0x895e4], ah
cmp al, 0
add byte [eax - 0x1409d18], ah
call [eax - 0x630ff76b]
xchg ebp, eax
or byte [eax], dh
or cl, al
add byte [eax + 0x70], dl
sub eax, 0xf6336000
call fcn.01059e86
dec eax
test dword [eax], eax
pushal
loopne 0x1015527
or byte [eax + 0x300895e4], al
cmp al, 0
add al, dl
cmp dword [esp + 0x1c], esi
jl 0x1015dc3
test al, 4
je 0x1015dc3
call fcn.01059e86
test byte [ebp - 0x6a2b2000], al
or byte [eax], dl
fcom dword [ebp + 0x34d008]
add al, dl
call fcn.0106561e
xchg ecx, eax
add al, 0
mov al, byte [0x70088e54]
add byte [eax + eax + 0x895bc00], dl
xor byte [ebx - 0x3f94fc20], al
sbb byte [0x1088ea0], al
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call fcn.0106561e
nop
add al, 0
pushal
push esp
mov cs, word [eax]
inc eax
add byte [eax + eax + 0x895bc90], dl
nop
dec dword [0x108941c]
jne 0x1015dac
call fcn.01012c53
jo 0x101563a
add byte [eax], ah
test al, 0x95
or byte [eax - 0x68], al
cwde
add byte [eax], dl
movsb byte es:[edi], byte [esi]
xchg ebp, eax
or byte [eax - 0x6bf7cac7], al
or byte [ecx], al
mov dword [esp + 0x90], esi
mov dword [esp + 0x94], esi
mov dword [esp + 0x98], esi
mov dword [esp + 0x9c], esi
add byte [ecx + 0x9c24b4], cl
add byte [eax], al
mov dword [esp + 0xa0], esi
mov dword [esp + 0x20], esi
jle 0x1015d80
mov ebx, 0x303c0d28
mov eax, dword [esp + 0x20]
imul eax, eax, 0xc
lea esi, [eax + 0x1089420]
mov ecx, dword [esi]
mov dword [esp + 0x88], eax
mov eax, dword [eax + 0x1089428]
mov edx, 0xfffffff
and ecx, edx
shr eax, 1
add ecx, 0x1000000
and eax, edx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x38], eax
mov eax, 0xf0956039
mov eax, dword [esp + 0x90]
cmp dword [esp + 0x18], eax
jb 0x10156ba
mov ecx, dword [esp + 0x94]
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x38]
add ecx, eax
add esi, edx
cmp esi, ecx
jbe 0x1015777
xor esi, esi
cmp dword [esp + 0xa0], esi
je 0x10156e9
lea ecx, [esp + 0x98]
push ecx
push dword [esp + 0x9c]
push dword [esp + 0x9c]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [esp + 0xa0], esi
cmp dword [esp + 0x9c], esi
je 0x1015704
push 0x10894a0
mov dword [esp + 0xa0], esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edx, dword [esp + 0x18]
mov eax, edx
mov dword [esp + 0x98], esi
mov esi, dword [esp + 0x38]
mov ecx, 0xfffff000
lea edx, [edx + esi + 0xfff]
and eax, ecx
and edx, ecx
sub edx, eax
push 0x10894a0
mov dword [esp + 0x94], eax
mov dword [esp + 0x98], edx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [esp + 0x98]
push eax
push 0x40
push dword [esp + 0x9c]
xor esi, esi
push dword [esp + 0x9c]
inc esi
mov dword [esp + 0xac], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1015d06
mov dword [esp + 0xa0], esi
cmp dword [esp + 0x18], 0
je 0x1015d06
mov eax, dword [esp + 0x88]
test byte [eax + 0x1089428], 1
jne 0x1015ced
xor dl, dl
cmp dword [esp + 0x38], 0
jbe 0x1015cd9
mov esi, 0x1089414
mov eax, 0x8f470fcb
mov ecx, dword [0x1089418]
mov esi, dword [0x1089414]
mov edx, dword [0x100771c]
and dword [esp + 0x58], 0
and dword [esp + 0x5c], 0
mov eax, 0xfffffff
and ecx, eax
and esi, eax
mov eax, 0x1000000
add esi, 0x1000000
sub eax, edx
mov dword [esp + 0xcc], ecx
mov dword [esp + 0x8c], eax
jne 0x1015884
and dword [esp + 0x50], 0
test ecx, ecx
jbe 0x1015b3b
mov eax, dword [esp + 0x50]
movzx eax, byte [eax + esi]
add eax, ebx
add dword [esp + 0x58], eax
add eax, dword [esp + 0x5c]
mov edx, ebx
mul edx
lea edx, [eax + edx*2 - 0x7fffffff]
sar eax, 0x1f
and eax, edi
sub edx, eax
mov eax, edx
sar eax, 0x1f
and eax, edi
add eax, edx
mov edx, ebx
mul edx
add eax, edx
mov edx, ebx
mul edx
lea edx, [eax + edx*2 - 0x7fffffff]
sar eax, 0x1f
and eax, edi
sub edx, eax
mov eax, edx
sar eax, 0x1f
and eax, edi
add eax, edx
add dword [esp + 0x58], eax
inc dword [esp + 0x50]
mov dword [esp + 0x5c], eax
cmp dword [esp + 0x50], ecx
jb 0x1015800
jmp 0x1015b3b
call fcn.0102df75
mov ah, 0x95
or byte [eax + 0x50], ah
add al, byte [eax]
jo 0x10158bb
xchg esi, eax
add byte [eax], dl
mov al, 0x95
or byte [eax - 0x5f], dh
or al, 0x94
or byte [ecx], al
jmp 0x1015587
lea eax, [esi + ecx]
mov ecx, esi
sub ecx, 0x1000000
mov edx, ecx
and edx, 0xfffff000
mov dword [esp + 0x3c], ecx
sub ecx, edx
mov dword [esp + 0x54], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x1c], edx
mov edx, dword [esp + 0xcc]
add ecx, edx
mov edx, ecx
and edx, 0xfffff000
sub ecx, edx
mov dword [esp + 0x28], eax
mov eax, dword [0x100003c]
mov dword [esp + 0x78], ecx
mov ecx, dword [eax + 0x10000a0]
mov eax, dword [eax + 0x10000a4]
add ecx, 0x1000000
add eax, ecx
mov dword [esp + 0x74], edx
mov dword [esp + 0x7c], eax
jmp 0x10158f2
retf 0x4489
mov edx, dword [esp + 0x1c]
cmp dword [ecx], edx
jae 0x10158f6
add ecx, dword [ecx + 4]
cmp ecx, eax
jne 0x10158e7
and dword [esp + 0x84], 0
cmp ecx, eax
je 0x101594a
mov eax, dword [esp + 0x1c]
cmp dword [ecx], eax
jne 0x101594a
mov eax, dword [ecx + 4]
sub eax, 8
shr eax, 1
mov dword [esp + 0x3c], eax
je 0x101594a
lea eax, [ecx + 8]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
movzx eax, word [eax]
and eax, 0xfff
cmp eax, dword [esp + 0x54]
jae 0x101594a
inc dword [esp + 0x84]
mov eax, dword [esp + 0x84]
add dword [esp + 0x2c], 2
cmp eax, dword [esp + 0x3c]
jne 0x101591f
cmp ecx, dword [esp + 0x7c]
je 0x1015ad4
mov eax, dword [ecx]
cmp eax, dword [esp + 0x74]
ja 0x1015ad4
mov eax, dword [ecx + 4]
lea edx, [eax - 8]
mov eax, dword [esp + 0x84]
shr edx, 1
cmp eax, edx
jne 0x1015996
add ecx, dword [ecx + 4]
cmp ecx, dword [esp + 0x7c]
je 0x1015ad4
mov eax, dword [esp + 0x74]
cmp dword [ecx], eax
ja 0x1015ad4
and dword [esp + 0x84], 0
jmp 0x1015960
mov edx, dword [esp + 0x74]
cmp dword [ecx], edx
jne 0x10159b2
movzx eax, word [ecx + eax*2 + 8]
and eax, 0xfff
cmp eax, dword [esp + 0x78]
jae 0x1015ad4
mov eax, dword [esp + 0x84]
inc dword [esp + 0x84]
mov edx, 0xf000
test word [ecx + eax*2 + 8], dx
je 0x101594a
mov edx, dword [ecx]
and dword [esp + 0x50], 0
lea eax, [ecx + eax*2 + 8]
movzx eax, word [eax]
and eax, 0xfff
lea eax, [eax + edx + 0x1000000]
mov dword [esp + 0x2c], eax
sub dword [esp + 0x2c], esi
mov dword [esp + 0x1c], eax
je 0x1015a5c
mov eax, dword [esp + 0x50]
movzx eax, byte [eax + esi]
add eax, ebx
add dword [esp + 0x58], eax
add eax, dword [esp + 0x5c]
mov edx, ebx
mul edx
lea edx, [eax + edx*2 - 0x7fffffff]
sar eax, 0x1f
and eax, edi
sub edx, eax
mov eax, edx
sar eax, 0x1f
and eax, edi
add eax, edx
mov edx, ebx
mul edx
add eax, edx
mov edx, ebx
mul edx
lea edx, [eax + edx*2 - 0x7fffffff]
sar eax, 0x1f
and eax, edi
sub edx, eax
mov eax, edx
sar eax, 0x1f
and eax, edi
add eax, edx
add dword [esp + 0x58], eax
inc dword [esp + 0x50]
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x50]
cmp eax, dword [esp + 0x2c]
jb 0x10159f8
mov eax, dword [esp + 0x1c]
mov eax, dword [eax]
sub eax, dword [esp + 0x8c]
xor esi, esi
mov dword [esp + 0x3c], eax
movzx eax, byte [esp + esi + 0x3c]
add eax, ebx
add dword [esp + 0x58], eax
add eax, dword [esp + 0x5c]
mov edx, ebx
mul edx
lea edx, [eax + edx*2 - 0x7fffffff]
sar eax, 0x1f
and eax, edi
sub edx, eax
mov eax, edx
sar eax, 0x1f
and eax, edi
add eax, edx
mov edx, ebx
mul edx
add eax, edx
mov edx, ebx
mul edx
lea edx, [eax + edx*2 - 0x7fffffff]
sar eax, 0x1f
and eax, edi
sub edx, eax
mov eax, edx
sar eax, 0x1f
and eax, edi
add eax, edx
add dword [esp + 0x58], eax
inc esi
mov dword [esp + 0x5c], eax
cmp esi, 4
jb 0x1015a6f
mov esi, dword [esp + 0x1c]
add esi, 4
jmp 0x101594a
mov eax, dword [esp + 0x28]
xor ecx, ecx
sub eax, esi
mov dword [esp + 0x3c], eax
je 0x1015b3b
movzx eax, byte [ecx + esi]
add eax, ebx
add dword [esp + 0x58], eax
add eax, dword [esp + 0x5c]
mov edx, ebx
mul edx
lea edx, [eax + edx*2 - 0x7fffffff]
sar eax, 0x1f
and eax, edi
sub edx, eax
mov eax, edx
sar eax, 0x1f
and eax, edi
add eax, edx
mov edx, ebx
mul edx
add eax, edx
mov edx, ebx
mul edx
lea edx, [eax + edx*2 - 0x7fffffff]
sar eax, 0x1f
and eax, edi
sub edx, eax
mov eax, edx
sar eax, 0x1f
and eax, edi
add eax, edx
add dword [esp + 0x58], eax
inc ecx
mov dword [esp + 0x5c], eax
cmp ecx, dword [esp + 0x3c]
jb 0x1015ae2
xor eax, eax
mov ecx, eax
and ecx, 7
mov cl, byte [esp + ecx + 0x58]
mov byte [esp + eax + 0x48], cl
inc eax
cmp eax, 6
jb 0x1015b3d
mov eax, 0xdbafde5e
mov eax, dword [esp + 0x18]
mov dl, byte [eax]
or byte [esp + 0x48], 1
or byte [esp + 0x4a], 1
or byte [esp + 0x4c], 1
or byte [esp + 0x4d], 1
movzx ecx, dl
mov byte [esp + 0x13], dl
add ecx, ecx
and byte [esp + 0x13], 0x80
je 0x1015b88
movzx eax, byte [esp + 0x4c]
xor eax, ecx
jmp 0x1015b8a
mov eax, ecx
test al, al
jns 0x1015bab
cmp byte [esp + 0x13], 0
je 0x1015b9e
movzx eax, byte [esp + 0x4c]
xor eax, ecx
jmp 0x1015ba0
mov eax, ecx
movzx ecx, byte [esp + 0x48]
add eax, eax
xor eax, ecx
jmp 0x1015bbf
cmp byte [esp + 0x13], 0
je 0x1015bbb
movzx eax, byte [esp + 0x4c]
xor eax, ecx
jmp 0x1015bbd
mov eax, ecx
add eax, eax
mov cl, byte [esp + 0x49]
xor cl, al
mov eax, dword [esp + 0x18]
mov byte [eax], cl
xor ecx, ecx
inc ecx
mov dword [esp + 0x1c], ecx
cmp dword [esp + 0x38], ecx
jbe 0x1015cd9
mov eax, dword [esp + 0x18]
add eax, ecx
mov dword [esp + 0x3c], eax
mov al, byte [eax]
movzx esi, al
xor dl, al
add esi, esi
mov byte [esp + 0x27], dl
mov byte [esp + 0x12], al
test cl, 1
je 0x1015c61
and byte [esp + 0x12], 0x80
je 0x1015c0c
movzx eax, byte [esp + 0x4d]
xor eax, esi
jmp 0x1015c0e
mov eax, esi
mov edx, dword [esp + 0x18]
movzx ecx, byte [ecx + edx - 1]
xor eax, ecx
test al, al
jns 0x1015c3c
cmp byte [esp + 0x12], 0
je 0x1015c2d
movzx eax, byte [esp + 0x4d]
xor eax, esi
jmp 0x1015c2f
mov eax, esi
xor eax, ecx
movzx ecx, byte [esp + 0x4a]
add eax, eax
xor eax, ecx
jmp 0x1015c52
cmp byte [esp + 0x12], 0
je 0x1015c4c
movzx eax, byte [esp + 0x4d]
xor eax, esi
jmp 0x1015c4e
mov eax, esi
xor eax, ecx
add eax, eax
mov ecx, eax
movzx eax, byte [esp + 0x4b]
xor eax, ecx
mov ecx, dword [esp + 0x1c]
jmp 0x1015cc0
and byte [esp + 0x12], 0x80
je 0x1015c71
movzx eax, byte [esp + 0x4c]
xor eax, esi
jmp 0x1015c73
mov eax, esi
mov edx, dword [esp + 0x18]
movzx edx, byte [ecx + edx - 1]
xor eax, edx
test al, al
jns 0x1015ca1
cmp byte [esp + 0x12], 0
je 0x1015c92
movzx eax, byte [esp + 0x4c]
xor eax, esi
jmp 0x1015c94
mov eax, esi
xor eax, edx
movzx edx, byte [esp + 0x48]
add eax, eax
xor eax, edx
jmp 0x1015cb7
cmp byte [esp + 0x12], 0
je 0x1015cb1
movzx eax, byte [esp + 0x4c]
xor eax, esi
jmp 0x1015cb3
mov eax, esi
xor eax, edx
add eax, eax
mov edx, eax
movzx eax, byte [esp + 0x49]
xor eax, edx
mov esi, dword [esp + 0x3c]
mov dl, byte [esp + 0x27]
inc ecx
mov byte [esi], al
mov dword [esp + 0x1c], ecx
cmp ecx, dword [esp + 0x38]
jb 0x1015bdc
mov eax, dword [esp + 0x88]
or dword [eax + 0x1089428], 1
mov byte [eax + 0x1089424], dl
mov eax, 0xe9153b00
inc dword [esp + 0x20]
mov eax, dword [esp + 0x20]
cmp eax, dword [0x1089408]
jl 0x1015658
xor esi, esi
cmp dword [esp + 0xa0], esi
je 0x1015d50
lea eax, [esp + 0x98]
push eax
push dword [esp + 0x9c]
push dword [esp + 0x9c]
push dword [esp + 0x9c]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
call fcn.01012c53
jo 0x1015d63
add byte [eax - 0x58], dl
xchg ebp, eax
or byte [eax - 0x68], al
cwde
add byte [eax], al
movsb byte es:[edi], byte [esi]
xchg ebp, eax
or al, al
mov dword [esp + 0xa0], esi
call fcn.01059e86
test byte [ebp - 0x6a2bc000], al
or byte [eax + 0x400895d8], dl
xor al, 0
add byte [eax - 0x63db4bc7], ah
add byte [eax], al
add byte [edx + edx + 0x68], dh
mov al, byte [0x89010894]
mov ah, 0x24
mov al, byte [0xff000000]
adc eax, sym.imp.KERNEL32.dll_LeaveCriticalSection
call fcn.0102df75
mov ah, 0x95
or al, dh
push eax
add al, byte [eax]
mov al, 0x48
xchg esi, eax
add al, dl
mov al, 0x95
or byte [eax - 0x7b763fcd], al
and al, 0x90
add byte [eax], al
add byte [ecx + 0x942484], cl
add byte [eax], al
mov dword [esp + 0x98], eax
mov eax, dword [0x108940c]
and eax, 3
imul eax, eax, 0x18
add eax, 0x1088ea0
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.01059e86
dec eax
test dword [eax], eax
push eax
loopne 0x1015d63
or al, dh
in al, 0x95
or byte [eax], al
cmp al, 0
add byte [eax - 0x18], dl
cwde
add dword [ecx], 0x895cc00
pushal
add al, 0xe
add al, dh
mov eax, 0xc8600085
xchg ebp, eax
or byte [eax - 0x25e318], ah
invalid