Function at 0x1009fcdd
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f5b9d
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x80
mov eax, dword [0x1013b3dc]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebx + 8]
xorps xmm0, xmm0
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], 0
push 8
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
call fcn.100c57d1
lea ecx, [ebp - 0x28]
add esp, 4
mov dword [eax + 4], 0
mov dword [ebp - 0x28], eax
mov dword [eax], ecx
mov dword [ebp - 4], 0
mov eax, dword [0x1018625c]
cmp eax, 4
ja case.default.0x1009f696
jmp dword [eax*4 + 0x100a064c]
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x18]
mov edx, dword [ebp - 0x20]
lea eax, [ecx + esi]
test al, 3
jne 0x1009f6c9
lea eax, [esi + 4]
shr eax, 2
cmp edx, eax
ja 0x1009f6c9
push ecx
lea ecx, [ebp - 0x28]
call fcn.1000c060
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
lea eax, [edx*4 - 1]
and ecx, eax
lea eax, [edx - 1]
mov dword [ebp - 0x1c], ecx
lea edi, [ecx + esi]
mov esi, edi
shr esi, 2
and esi, eax
mov eax, dword [ebp - 0x24]
cmp dword [eax + esi*4], 0
jne 0x1009f6fe
push 0x10
call fcn.100c57d1
mov ecx, dword [ebp - 0x24]
add esp, 4
mov dword [ecx + esi*4], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + esi*4]
and edi, 3
mov dword [eax + edi*4], 0xb
jmp 0x1009ff85
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x18]
mov edx, dword [ebp - 0x20]
lea eax, [ecx + esi]
test al, 3
jne 0x1009f73c
lea eax, [esi + 4]
shr eax, 2
cmp edx, eax
ja 0x1009f73c
push ecx
lea ecx, [ebp - 0x28]
call fcn.1000c060
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
lea eax, [edx*4 - 1]
and ecx, eax
lea eax, [edx - 1]
mov dword [ebp - 0x1c], ecx
lea edi, [ecx + esi]
mov esi, edi
shr esi, 2
and esi, eax
mov eax, dword [ebp - 0x24]
cmp dword [eax + esi*4], 0
jne 0x1009f771
push 0x10
call fcn.100c57d1
mov ecx, dword [ebp - 0x24]
add esp, 4
mov dword [ecx + esi*4], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + esi*4]
and edi, 3
mov dword [eax + edi*4], 7
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
inc esi
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x18], esi
lea eax, [esi + ecx]
test al, 3
jne 0x1009f7ae
lea eax, [esi + 4]
shr eax, 2
cmp edx, eax
ja 0x1009f7ae
push ecx
lea ecx, [ebp - 0x28]
call fcn.1000c060
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
lea eax, [edx*4 - 1]
and ecx, eax
lea eax, [edx - 1]
mov dword [ebp - 0x1c], ecx
lea edi, [ecx + esi]
mov esi, edi
shr esi, 2
and esi, eax
mov eax, dword [ebp - 0x24]
cmp dword [eax + esi*4], 0
jne 0x1009f7e3
push 0x10
call fcn.100c57d1
mov ecx, dword [ebp - 0x24]
add esp, 4
mov dword [ecx + esi*4], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + esi*4]
and edi, 3
mov dword [eax + edi*4], 8
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
inc esi
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x18], esi
lea eax, [esi + ecx]
test al, 3
jne 0x1009f820
lea eax, [esi + 4]
shr eax, 2
cmp edx, eax
ja 0x1009f820
push ecx
lea ecx, [ebp - 0x28]
call fcn.1000c060
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
lea eax, [edx*4 - 1]
and ecx, eax
lea eax, [edx - 1]
mov dword [ebp - 0x1c], ecx
lea edi, [ecx + esi]
mov esi, edi
shr esi, 2
and esi, eax
mov eax, dword [ebp - 0x24]
cmp dword [eax + esi*4], 0
jne 0x1009f855
push 0x10
call fcn.100c57d1
mov ecx, dword [ebp - 0x24]
add esp, 4
mov dword [ecx + esi*4], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + esi*4]
and edi, 3
mov dword [eax + edi*4], 9
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
inc esi
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x18], esi
lea eax, [esi + ecx]
test al, 3
jne 0x1009f892
lea eax, [esi + 4]
shr eax, 2
cmp edx, eax
ja 0x1009f892
push ecx
lea ecx, [ebp - 0x28]
call fcn.1000c060
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
lea eax, [edx*4 - 1]
and ecx, eax
lea eax, [edx - 1]
mov dword [ebp - 0x1c], ecx
lea edi, [ecx + esi]
mov esi, edi
shr esi, 2
and esi, eax
mov eax, dword [ebp - 0x24]
cmp dword [eax + esi*4], 0
jne 0x1009f8c7
push 0x10
call fcn.100c57d1
mov ecx, dword [ebp - 0x24]
add esp, 4
mov dword [ecx + esi*4], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + esi*4]
and edi, 3
mov dword [eax + edi*4], 0xa
jmp 0x1009ff85
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x18]
mov edx, dword [ebp - 0x20]
lea eax, [ecx + esi]
test al, 3
jne 0x1009f905
lea eax, [esi + 4]
shr eax, 2
cmp edx, eax
ja 0x1009f905
push ecx
lea ecx, [ebp - 0x28]
call fcn.1000c060
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
lea eax, [edx*4 - 1]
and ecx, eax
lea eax, [edx - 1]
mov dword [ebp - 0x1c], ecx
lea edi, [ecx + esi]
mov esi, edi
shr esi, 2
and esi, eax
mov eax, dword [ebp - 0x24]
cmp dword [eax + esi*4], 0
jne 0x1009f93a
push 0x10
call fcn.100c57d1
mov ecx, dword [ebp - 0x24]
add esp, 4
mov dword [ecx + esi*4], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + esi*4]
and edi, 3
mov dword [eax + edi*4], 0
jmp 0x1009ff85
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x18]
mov edx, dword [ebp - 0x20]
lea eax, [ecx + esi]
test al, 3
jne 0x1009f978
lea eax, [esi + 4]
shr eax, 2
cmp edx, eax
ja 0x1009f978
push ecx
lea ecx, [ebp - 0x28]
call fcn.1000c060
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
lea eax, [edx*4 - 1]
and ecx, eax
lea eax, [edx - 1]
mov dword [ebp - 0x1c], ecx
lea edi, [ecx + esi]
mov esi, edi
shr esi, 2
and esi, eax
mov eax, dword [ebp - 0x24]
cmp dword [eax + esi*4], 0
jne 0x1009f9ad
push 0x10
call fcn.100c57d1
mov ecx, dword [ebp - 0x24]
add esp, 4
mov dword [ecx + esi*4], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + esi*4]
and edi, 3
mov dword [eax + edi*4], 0xc
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
inc esi
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x18], esi
lea eax, [esi + ecx]
test al, 3
jne 0x1009f9ea
lea eax, [esi + 4]
shr eax, 2
cmp edx, eax
ja 0x1009f9ea
push ecx
lea ecx, [ebp - 0x28]
call fcn.1000c060
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
lea eax, [edx*4 - 1]
and ecx, eax
lea eax, [edx - 1]
mov dword [ebp - 0x1c], ecx
lea edi, [ecx + esi]
mov esi, edi
shr esi, 2
and esi, eax
mov eax, dword [ebp - 0x24]
cmp dword [eax + esi*4], 0
jne 0x1009fa1f
push 0x10
call fcn.100c57d1
mov ecx, dword [ebp - 0x24]
add esp, 4
mov dword [ecx + esi*4], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + esi*4]
and edi, 3
mov dword [eax + edi*4], 0xd
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
inc esi
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x18], esi
lea eax, [ecx + esi]
test al, 3
jne 0x1009fa5c
lea eax, [esi + 4]
shr eax, 2
cmp edx, eax
ja 0x1009fa5c
push ecx
lea ecx, [ebp - 0x28]
call fcn.1000c060
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
lea eax, [edx*4 - 1]
and ecx, eax
lea eax, [edx - 1]
mov dword [ebp - 0x1c], ecx
lea edi, [ecx + esi]
mov esi, edi
shr esi, 2
and esi, eax
mov eax, dword [ebp - 0x24]
cmp dword [eax + esi*4], 0
jne 0x1009fa91
push 0x10
call fcn.100c57d1
mov ecx, dword [ebp - 0x24]
add esp, 4
mov dword [ecx + esi*4], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + esi*4]
and edi, 3
mov dword [eax + edi*4], 0xe
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
inc esi
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x18], esi
lea eax, [ecx + esi]
test al, 3
jne 0x1009face
lea eax, [esi + 4]
shr eax, 2
cmp edx, eax
ja 0x1009face
push ecx
lea ecx, [ebp - 0x28]
call fcn.1000c060
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
lea eax, [edx*4 - 1]
and ecx, eax
lea eax, [edx - 1]
mov dword [ebp - 0x1c], ecx
lea edi, [ecx + esi]
mov esi, edi
shr esi, 2
and esi, eax
mov eax, dword [ebp - 0x24]
cmp dword [eax + esi*4], 0
jne 0x1009fb03
push 0x10
call fcn.100c57d1
mov ecx, dword [ebp - 0x24]
add esp, 4
mov dword [ecx + esi*4], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + esi*4]
and edi, 3
mov dword [eax + edi*4], 0xf
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
inc esi
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x18], esi
lea eax, [ecx + esi]
test al, 3
jne 0x1009fb40
lea eax, [esi + 4]
shr eax, 2
cmp edx, eax
ja 0x1009fb40
push ecx
lea ecx, [ebp - 0x28]
call fcn.1000c060
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
lea eax, [edx*4 - 1]
and ecx, eax
lea eax, [edx - 1]
mov dword [ebp - 0x1c], ecx
lea edi, [ecx + esi]
mov esi, edi
shr esi, 2
and esi, eax
mov eax, dword [ebp - 0x24]
cmp dword [eax + esi*4], 0
jne 0x1009fb75
push 0x10
call fcn.100c57d1
mov ecx, dword [ebp - 0x24]
add esp, 4
mov dword [ecx + esi*4], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + esi*4]
and edi, 3
mov dword [eax + edi*4], 0x10
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
inc esi
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x18], esi
lea eax, [ecx + esi]
test al, 3
jne 0x1009fbb2
lea eax, [esi + 4]
shr eax, 2
cmp edx, eax
ja 0x1009fbb2
push ecx
lea ecx, [ebp - 0x28]
call fcn.1000c060
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
lea eax, [edx*4 - 1]
and ecx, eax
lea eax, [edx - 1]
mov dword [ebp - 0x1c], ecx
lea edi, [ecx + esi]
mov esi, edi
shr esi, 2
and esi, eax
mov eax, dword [ebp - 0x24]
cmp dword [eax + esi*4], 0
jne 0x1009fbe7
push 0x10
call fcn.100c57d1
mov ecx, dword [ebp - 0x24]
add esp, 4
mov dword [ecx + esi*4], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + esi*4]
and edi, 3
mov dword [eax + edi*4], 0x11
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
inc esi
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x18], esi
lea eax, [ecx + esi]
test al, 3
jne 0x1009fc24
lea eax, [esi + 4]
shr eax, 2
cmp edx, eax
ja 0x1009fc24
push ecx
lea ecx, [ebp - 0x28]
call fcn.1000c060
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
lea eax, [edx*4 - 1]
and ecx, eax
lea eax, [edx - 1]
mov dword [ebp - 0x1c], ecx
lea edi, [ecx + esi]
mov esi, edi
shr esi, 2
and esi, eax
mov eax, dword [ebp - 0x24]
cmp dword [eax + esi*4], 0
jne 0x1009fc59
push 0x10
call fcn.100c57d1
mov ecx, dword [ebp - 0x24]
add esp, 4
mov dword [ecx + esi*4], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + esi*4]
and edi, 3
mov dword [eax + edi*4], 0x12
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
inc esi
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x18], esi
lea eax, [ecx + esi]
test al, 3
jne 0x1009fc96
lea eax, [esi + 4]
shr eax, 2
cmp edx, eax
ja 0x1009fc96
push ecx
lea ecx, [ebp - 0x28]
call fcn.1000c060
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
lea eax, [edx*4 - 1]
and ecx, eax
lea eax, [edx - 1]
mov dword [ebp - 0x1c], ecx
lea edi, [ecx + esi]
mov esi, edi
shr esi, 2
and esi, eax
mov eax, dword [ebp - 0x24]
cmp dword [eax + esi*4], 0
jne 0x1009fccb
push 0x10
call fcn.100c57d1
mov ecx, dword [ebp - 0x24]
add esp, 4
mov dword [ecx + esi*4], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + esi*4]
and edi, 3
mov dword [eax + edi*4], 0x13
jmp 0x1009ff85
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x18]
mov edx, dword [ebp - 0x20]
lea eax, [ecx + esi]
test al, 3
jne 0x1009fd09
lea eax, [esi + 4]
shr eax, 2
cmp edx, eax
ja 0x1009fd09
push ecx
lea ecx, [ebp - 0x28]
call fcn.1000c060
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
lea eax, [edx*4 - 1]
and ecx, eax
lea eax, [edx - 1]
mov dword [ebp - 0x1c], ecx
lea edi, [ecx + esi]
mov esi, edi
shr esi, 2
and esi, eax
mov eax, dword [ebp - 0x24]
cmp dword [eax + esi*4], 0
jne 0x1009fd3e
push 0x10
call fcn.100c57d1
mov ecx, dword [ebp - 0x24]
add esp, 4
mov dword [ecx + esi*4], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + esi*4]
and edi, 3
mov dword [eax + edi*4], 1
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
inc esi
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x18], esi
lea eax, [ecx + esi]
test al, 3
jne 0x1009fd7b
lea eax, [esi + 4]
shr eax, 2
cmp edx, eax
ja 0x1009fd7b
push ecx
lea ecx, [ebp - 0x28]
call fcn.1000c060
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
lea eax, [edx*4 - 1]
and ecx, eax
lea eax, [edx - 1]
mov dword [ebp - 0x1c], ecx
lea edi, [ecx + esi]
mov esi, edi
shr esi, 2
and esi, eax
mov eax, dword [ebp - 0x24]
cmp dword [eax + esi*4], 0
jne 0x1009fdb0
push 0x10
call fcn.100c57d1
mov ecx, dword [ebp - 0x24]
add esp, 4
mov dword [ecx + esi*4], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + esi*4]
and edi, 3
mov dword [eax + edi*4], 2
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
inc esi
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x18], esi
lea eax, [ecx + esi]
test al, 3
jne 0x1009fded
lea eax, [esi + 4]
shr eax, 2
cmp edx, eax
ja 0x1009fded
push ecx
lea ecx, [ebp - 0x28]
call fcn.1000c060
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
lea eax, [edx*4 - 1]
and ecx, eax
lea eax, [edx - 1]
mov dword [ebp - 0x1c], ecx
lea edi, [ecx + esi]
mov esi, edi
shr esi, 2
and esi, eax
mov eax, dword [ebp - 0x24]
cmp dword [eax + esi*4], 0
jne 0x1009fe22
push 0x10
call fcn.100c57d1
mov ecx, dword [ebp - 0x24]
add esp, 4
mov dword [ecx + esi*4], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + esi*4]
and edi, 3
mov dword [eax + edi*4], 3
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
inc esi
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x18], esi
lea eax, [ecx + esi]
test al, 3
jne 0x1009fe5f
lea eax, [esi + 4]
shr eax, 2
cmp edx, eax
ja 0x1009fe5f
push ecx
lea ecx, [ebp - 0x28]
call fcn.1000c060
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
lea eax, [edx*4 - 1]
and ecx, eax
lea eax, [edx - 1]
mov dword [ebp - 0x1c], ecx
lea edi, [ecx + esi]
mov esi, edi
shr esi, 2
and esi, eax
mov eax, dword [ebp - 0x24]
cmp dword [eax + esi*4], 0
jne 0x1009fe94
push 0x10
call fcn.100c57d1
mov ecx, dword [ebp - 0x24]
add esp, 4
mov dword [ecx + esi*4], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + esi*4]
and edi, 3
mov dword [eax + edi*4], 4
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
inc esi
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x18], esi
lea eax, [esi + ecx]
test al, 3
jne 0x1009fed1
lea eax, [esi + 4]
shr eax, 2
cmp edx, eax
ja 0x1009fed1
push ecx
lea ecx, [ebp - 0x28]
call fcn.1000c060
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
lea eax, [edx*4 - 1]
and ecx, eax
lea eax, [edx - 1]
mov dword [ebp - 0x1c], ecx
lea edi, [ecx + esi]
mov esi, edi
shr esi, 2
and esi, eax
mov eax, dword [ebp - 0x24]
cmp dword [eax + esi*4], 0
jne 0x1009ff06
push 0x10
call fcn.100c57d1
mov ecx, dword [ebp - 0x24]
add esp, 4
mov dword [ecx + esi*4], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + esi*4]
and edi, 3
mov dword [eax + edi*4], 5
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
inc esi
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x18], esi
lea eax, [esi + ecx]
test al, 3
jne 0x1009ff43
lea eax, [esi + 4]
shr eax, 2
cmp edx, eax
ja 0x1009ff43
push ecx
lea ecx, [ebp - 0x28]
call fcn.1000c060
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
lea eax, [edx*4 - 1]
and ecx, eax
lea eax, [edx - 1]
mov dword [ebp - 0x1c], ecx
lea edi, [ecx + esi]
mov esi, edi
shr esi, 2
and esi, eax
mov eax, dword [ebp - 0x24]
cmp dword [eax + esi*4], 0
jne 0x1009ff78
push 0x10
call fcn.100c57d1
mov ecx, dword [ebp - 0x24]
add esp, 4
mov dword [ecx + esi*4], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + esi*4]
and edi, 3
mov dword [eax + edi*4], 6
inc dword [ebp - 0x18]
mov esi, dword [ebp - 0x4c]
cmp byte [0x10186244], 0
jne 0x1009ff9e
call fcn.1009f420
jmp 0x100a0622
cmp dword [0x10186248], 0
je 0x1009ffb0
cmp byte [0x1018d2af], 0
je 0x1009ff94
cmp byte [0x101dd450], 0
jne 0x1009ff94
cmp byte [0x101dd454], 0
jne 0x1009ffd7
call fcn.100a0870
movd xmm1, dword [0x101dd438]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
ja 0x1009ff94
cmp byte [0x10186254], 0
mov ecx, 1
movzx eax, byte [0x10188658]
cmovne eax, ecx
mov byte [0x1018d29e], 1
cmp byte [0x10186261], 0
mov byte [0x10188658], al
je 0x100a0014
cmp dword [0x10190b10], 0x1d
je 0x100a0014
mov word [0x101884a9], 0x101
lea eax, [esi + 4]
xorps xmm0, xmm0
movss dword [ebp - 0x74], xmm0
test eax, eax
je 0x100a0033
movss xmm2, dword [eax + 8]
movss xmm3, dword [eax]
movss xmm1, dword [eax + 4]
jmp 0x100a003c
xorps xmm2, xmm2
xorps xmm3, xmm3
xorps xmm1, xmm1
mov eax, dword [0x1018b4c4]
movss xmm5, dword [0x1012d0dc]
movss xmm4, dword [0x1012d254]
movss dword [ebp - 0x30], xmm2
movss xmm0, dword [eax + 0x2abf0]
addss xmm0, xmm0
addss xmm3, xmm0
movss xmm0, dword [eax + 0x2abf4]
addss xmm0, xmm0
comiss xmm3, xmm5
addss xmm1, xmm0
movss dword [ebp - 0x38], xmm3
movss xmm0, dword [0x1012d170]
movss dword [ebp - 0x34], xmm1
jbe 0x100a0093
subss xmm3, xmm0
jmp 0x100a009c
comiss xmm4, xmm3
jbe 0x100a00a1
addss xmm3, xmm0
movss dword [ebp - 0x38], xmm3
comiss xmm1, xmm5
jbe 0x100a00ac
subss xmm1, xmm0
jmp 0x100a00b5
comiss xmm4, xmm1
jbe 0x100a00ba
addss xmm1, xmm0
movss dword [ebp - 0x34], xmm1
comiss xmm2, xmm5
jbe 0x100a00c5
subss xmm2, xmm0
jmp 0x100a00ce
comiss xmm4, xmm2
jbe 0x100a00d3
addss xmm2, xmm0
movss dword [ebp - 0x30], xmm2
push 0
push 0
lea eax, [ebp - 0x90]
push eax
lea ecx, [ebp - 0x38]
call fcn.10087d30
movss xmm4, dword [0x1012d1fc]
or esi, 0xffffffff
xorps xmm5, xmm5
mov dword [ebp - 0x48], esi
xorps xmm6, xmm6
movss dword [ebp - 0x64], xmm5
xorps xmm7, xmm7
movss dword [ebp - 0x68], xmm6
movss dword [ebp - 0x6c], xmm7
xor edi, edi
movss dword [ebp - 0x58], xmm4
mov esi, 1
push 1
push esi
call fcn.100a65d0
inc esi
cmp esi, 0x20
jle 0x100a0118
mov eax, dword [0x101dd430]
mov edx, 1
movss xmm2, dword [0x10189d7c]
mov dword [ebp - 0x54], edx
nop dword [eax + eax]
cmp edx, eax
je 0x100a031e
jge 0x100a0158
imul eax, edx, 0xc50
lea esi, [eax + 0x10194a5c]
jmp 0x100a0167
lea eax, [edx - 2]
imul esi, eax, 0xc50
add esi, 0x101956ac
test esi, esi
je 0x100a0319
cmp byte [0x10186254], 0
jne 0x100a0186
mov eax, dword [0x101dd434]
cmp dword [esi + 4], eax
je 0x100a0319
cmp byte [esi + 0x1a], 0
jne 0x100a0319
cmp byte [0x101884c6], 0
je 0x100a01a3
cmp dword [esi + 0x10], 1
je 0x100a0319
mov ecx, dword [ebp - 0x1c]
movaps xmm0, xmm2
mulss xmm0, dword [esi + 0x50]
movaps xmm1, xmm2
mov eax, dword [ebp - 0x18]
mulss xmm1, dword [esi + 0x54]
add eax, ecx
mov dword [ebp - 0x70], ecx
mulss xmm2, dword [esi + 0x58]
mov dword [ebp - 0x84], eax
addss xmm0, dword [esi + 0x5c]
addss xmm1, dword [esi + 0x60]
addss xmm2, dword [esi + 0x64]
movss dword [ebp - 0x50], xmm0
movss dword [ebp - 0x5c], xmm1
movss dword [ebp - 0x60], xmm2
cmp ecx, eax
je 0x100a0311
mov edx, dword [ebp - 0x20]
dec edx
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x48]
movaps xmm3, xmm2
mov dword [ebp - 0x78], eax
mov eax, ecx
shr eax, 2
and ecx, 3
movss xmm2, dword [0x101dd484]
and eax, edx
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x80], edi
movss dword [ebp - 0x48], xmm4
movss dword [ebp - 0x7c], xmm4
mov eax, dword [edx + eax*4]
mov edi, dword [eax + ecx*4]
lea eax, [edi + edi*2]
addss xmm0, dword [esi + eax*4 + 0x80]
addss xmm1, dword [esi + eax*4 + 0x84]
addss xmm3, dword [esi + eax*4 + 0x88]
subss xmm0, dword [esi + 0x5c]
subss xmm1, dword [esi + 0x60]
subss xmm3, dword [esi + 0x64]
subss xmm2, xmm0
movss xmm0, dword [0x101dd488]
subss xmm0, xmm1
movss xmm1, dword [0x101dd48c]
subss xmm1, xmm3
mulss xmm2, xmm2
mulss xmm0, xmm0
mulss xmm1, xmm1
addss xmm0, xmm2
addss xmm0, xmm1
call fcn.10002f50
movss xmm4, dword [ebp - 0x58]
comiss xmm4, xmm0
movss xmm1, dword [ebp - 0x5c]
movss xmm2, dword [ebp - 0x60]
jbe 0x100a02c1
movss xmm5, dword [ebp - 0x50]
movaps xmm4, xmm0
movaps xmm6, xmm1
movss dword [ebp - 0x58], xmm4
movaps xmm7, xmm2
movss dword [ebp - 0x64], xmm5
movss dword [ebp - 0x68], xmm6
movss dword [ebp - 0x6c], xmm7
jmp 0x100a02d0
movss xmm5, dword [ebp - 0x64]
movss xmm6, dword [ebp - 0x68]
movss xmm7, dword [ebp - 0x6c]
movss xmm3, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x70]
mov edx, dword [ebp - 0x30]
comiss xmm3, xmm0
movss xmm3, dword [ebp - 0x7c]
cmovbe edi, dword [ebp - 0x78]
comiss xmm3, xmm0
mov dword [ebp - 0x48], edi
mov edi, esi
movss xmm0, dword [ebp - 0x50]
cmovbe edi, dword [ebp - 0x80]
inc ecx
mov dword [ebp - 0x70], ecx
cmp ecx, dword [ebp - 0x84]
jne 0x100a01f6
mov esi, dword [ebp - 0x48]
mov edx, dword [ebp - 0x54]
mov dword [ebp - 0x48], esi
movss xmm2, dword [0x10189d7c]
mov eax, dword [0x101dd430]
inc edx
mov dword [ebp - 0x54], edx
cmp edx, 0x20
jle 0x100a0140
mov esi, 1
push 0
push esi
call fcn.100a65d0
inc esi
cmp esi, 0x20
jle 0x100a0330
mov esi, dword [ebp - 0x48]
test edi, edi
je 0x100a061b
mov ecx, dword [ebp - 0x4c]
lea eax, [ecx + 4]
test eax, eax
je 0x100a036d
movss xmm0, dword [eax]
movss dword [ebp - 0x74], xmm0
movss xmm0, dword [eax + 4]
movss dword [ebp - 0x54], xmm0
movss xmm0, dword [eax + 8]
jmp 0x100a0375
xorps xmm0, xmm0
movss dword [ebp - 0x54], xmm0
movss xmm2, dword [0x10189d7c]
lea eax, [esi + esi*2]
movss dword [ebp - 0x50], xmm0
movaps xmm1, xmm2
mov dword [ebp - 0x44], 0
movaps xmm0, xmm2
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mulss xmm1, dword [edi + 0x50]
mov dword [ebp - 0x38], 0
mulss xmm0, dword [edi + 0x54]
mov dword [ebp - 0x34], 0
mulss xmm2, dword [edi + 0x58]
addss xmm1, xmm5
mov dword [ebp - 0x30], 0
addss xmm0, xmm6
addss xmm2, xmm7
addss xmm1, dword [edi + eax*4 + 0x80]
addss xmm0, dword [edi + eax*4 + 0x84]
addss xmm2, dword [edi + eax*4 + 0x88]
subss xmm1, dword [edi + 0x5c]
lea eax, [ebp - 0x38]
subss xmm0, dword [edi + 0x60]
push eax
subss xmm2, dword [edi + 0x64]
subss xmm1, dword [0x101dd484]
lea eax, [ebp - 0x90]
subss xmm0, dword [0x101dd488]
push eax
subss xmm2, dword [0x101dd48c]
movss dword [ebp - 0x90], xmm1
movss dword [ebp - 0x8c], xmm0
movss dword [ebp - 0x88], xmm2
call fcn.100a5c50
movss xmm2, dword [ebp - 0x38]
movss xmm5, dword [0x1012d0dc]
comiss xmm2, xmm5
movss xmm1, dword [ebp - 0x34]
movss xmm0, dword [ebp - 0x30]
movss xmm4, dword [0x1012d254]
movss xmm3, dword [0x1012d170]
jbe 0x100a046c
subss xmm2, xmm3
jmp 0x100a0475
comiss xmm4, xmm2
jbe 0x100a0475
addss xmm2, xmm3
comiss xmm1, xmm5
jbe 0x100a0480
subss xmm1, xmm3
jmp 0x100a0489
comiss xmm4, xmm1
jbe 0x100a0489
addss xmm1, xmm3
comiss xmm0, xmm5
jbe 0x100a0494
subss xmm0, xmm3
jmp 0x100a049d
comiss xmm4, xmm0
jbe 0x100a049d
addss xmm0, xmm3
push ecx
mov dword [esp], 0
lea eax, [ebp - 0x44]
push eax
sub esp, 0xc
mov eax, esp
sub esp, 0xc
movss dword [eax + 8], xmm0
movss xmm0, dword [ebp - 0x74]
movss dword [eax], xmm2
movss dword [eax + 4], xmm1
mov eax, esp
movss dword [eax], xmm0
movss xmm0, dword [ebp - 0x54]
movss dword [eax + 4], xmm0
movss xmm0, dword [ebp - 0x50]
movss dword [eax + 8], xmm0
call fcn.1000b760
mov esi, dword [ebp - 0x4c]
push esi
call fcn.100a62c0
movss xmm0, dword [ebp - 0x44]
movss dword [esi + 4], xmm0
movss xmm0, dword [ebp - 0x40]
movss dword [esi + 8], xmm0
movss xmm0, dword [ebp - 0x3c]
push esi
movss dword [esi + 0xc], xmm0
call fcn.100a63a0
lea eax, [ebp - 0x44]
push eax
call dword [0x1018b554]
movss xmm0, dword [0x10186250]
add esp, 4
divss xmm0, dword [0x1012d0b4]
mulss xmm0, dword [0x1012cf80]
cvtps2pd xmm1, xmm0
movsd xmm0, qword [0x10189f20]
addsd xmm1, qword [0x1012ceb8]
ucomisd xmm0, xmm1
movsd qword [ebp - 0x38], xmm1
lahf
test ah, 0x44
jnp 0x100a05b7
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0x10190e60
push 0x40
push 8
push dword [0x1018ca5c]
call edi
movsd xmm0, qword [ebp - 0x38]
mulsd xmm0, qword [0x1012cf70]
mov eax, dword [0x1018ca5c]
push 0x10190e60
movsd qword [eax], xmm0
push dword [0x10190e60]
mov esi, dword [0x1018ca5c]
push 8
push esi
call edi
push 8
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
movsd xmm0, qword [ebp - 0x38]
movsd qword [0x10189f20], xmm0
mov al, byte [0x101ddabb]
movzx ecx, al
test al, al
mov eax, 1
cmove ecx, eax
push str.forward
mov byte [0x101ddabb], cl
call dword [0x1018b518]
add esp, 4
cmp byte [0x10186260], 0
je 0x100a05f4
push str.duck
call dword [0x1018b518]
add esp, 4
cmp byte [0x10186261], 0
je 0x100a061b
cmp dword [0x10190b10], 0x1d
jne 0x100a060d
push 0x101041dc
jmp 0x100a0612
push str.attack
call dword [0x1018b518]
add esp, 4
mov byte [0x101ddabb], 1
lea ecx, [ebp - 0x28]
call fcn.1000b980
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100c55b5
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4