Function at 0x10cdfb6
Capabilities:
Allocate or change rwx memory

Disassembly:
pushfd
push ebp
mov ebp, esp
sub esp, 0x90
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x84], edx
mov dword [ebp - 0x8c], ebx
mov dword [ebp - 0x88], esi
lea eax, [ebp + 4]
mov dword [ebp - 0x80], edi
mov esi, dword [0x1116588]
mov edi, dword [eax + 4]
sub eax, 4
mov dword [ebp - 0x64], eax
mov eax, dword [edi]
shr eax, 4
xor edx, edx
lea ecx, [esi + eax - 1]
mov eax, ecx
div esi
sub ecx, edx
mov eax, dword [0x1116588]
mov dword [ebp - 0x44], ecx
mov eax, dword [0x1011bb0]
mov dword [ebp - 0x40], eax
mov eax, dword [0x1116588]
mov eax, dword [0x1011bb0]
test eax, eax
je 0x10ce0a3
mov eax, dword [0x1011bb0]
xor esi, esi
dec eax
lea ecx, [eax + 1]
xor eax, eax
mov edx, ecx
test ecx, ecx
je 0x10ce05c
mov ebx, dword [0x12d47a4]
imul ebx, ebx, 0x343fd
add ebx, 0x269ec3
mov dword [0x12d47a4], ebx
shr ebx, 0x10
shl eax, 0x10
shr edx, 0x10
or eax, ebx
test edx, edx
jne 0x10ce035
xor edx, edx
div ecx
cmp dword [ebp - 0x40], 0
jbe 0x10ce099
mov eax, 0xcb65
mov ecx, 0xffff349a
lea ebx, [edx*4 + 0x12d4c14]
inc esi
lock cmpxchg dword [ebx], ecx
cmp eax, 0xcb65
je 0x10ce15c
lea eax, [edx + 1]
mov ecx, dword [0x1011bb0]
xor edx, edx
div ecx
cmp esi, dword [ebp - 0x40]
jb 0x10ce066
and dword [ebp - 0x14], 0
cmp dword [ebp - 0x14], 0
jne 0x10ce11d
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
mov ebx, eax
push 0x40
inc esi
push 0x1000
push dword [ebp - 0x44]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x10ce172
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, 0x11
jb 0x10ce0ad
xor esi, esi
mov dword [ebp - 0x14], esi
cmp dword [0x12ef80c], esi
ja 0x10ce0e9
test esi, 3
je 0x10ce100
test esi, esi
je 0x10ce0fb
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
xor esi, esi
mov dword [ebp - 0x14], esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
je 0x10ce008
mov eax, dword [ebp - 0x44]
test eax, eax
je 0x10ce11d
mov byte [esi], 0
inc esi
dec eax
jne 0x10ce116
mov eax, 0x750cd0fc
mov eax, dword [edi]
mov ecx, eax
shr ecx, 1
shr eax, 4
and ecx, 7
mov esi, eax
mov eax, dword [0x1116588]
lea ecx, [ecx + edi + 8]
sub eax, esi
mov dword [ebp - 0x3c], ecx
mov edi, 0x1000000
mov dword [ebp - 0x44], ecx
sub dword [ebp - 0x3c], edi
mov dword [ebp - 0x40], esi
lea ebx, [esi + ecx]
mov dword [ebp - 0x48], ebx
lea ecx, [eax + 1]
mov dword [ebp - 0x2c], ecx
xor eax, eax
jmp 0x10ce19f
mov eax, dword [0x1116588]
imul eax, edx
lea eax, [eax + section..data]
mov dword [ebp - 0x14], eax
jmp 0x10ce09d
mov esi, eax
mov dword [ebp - 0x14], eax
jmp 0x10ce0d9
mov edx, dword [0x12d47a4]
imul edx, edx, 0x343fd
add edx, 0x269ec3
mov dword [0x12d47a4], edx
shr edx, 0x10
shl eax, 0x10
or eax, edx
shr ecx, 0x10
test ecx, ecx
jne 0x10ce17c
xor edx, edx
div dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
add eax, edx
push eax
push esi
push dword [ebp - 0x3c]
mov dword [ebp - 0x4c], eax
mov eax, 0x34d7c2b2
lea eax, [ebp - 0x78]
mov esi, dword [ebx]
mov ebx, dword [ebx + 4]
push eax
mov dword [ebp - 0x78], esi
mov dword [ebp - 0x74], ebx
mov byte [ebp - 0xd], 0
mov eax, 0xcd4bc864
mov ecx, dword [0x11e47bc]
and dword [ebp - 0x28], 0
mov eax, 0xfffffff
and dword [ebp - 0x24], 0
and ebx, eax
and esi, eax
add esi, edi
mov eax, edi
mov edx, 0xfffff000
add esp, 0x10
mov dword [ebp - 0x30], ebx
mov ebx, esi
sub eax, ecx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x34], eax
jne 0x10ce289
and dword [ebp - 0x18], 0
cmp dword [ebp - 0x30], 0
jbe 0x10ce4f8
mov esi, 0xed08cdd6
mov ecx, 0x7fffffff
mov edi, 0x12f7322a
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax + ebx]
sub eax, edi
mov edx, esi
add dword [ebp - 0x28], eax
add eax, dword [ebp - 0x24]
mul edx
lea edx, [eax + edx*2 - 0x7fffffff]
sar eax, 0x1f
and eax, ecx
sub edx, eax
mov eax, edx
sar eax, 0x1f
and eax, ecx
add eax, edx
imul eax, eax, 0xed08cdd6
ror eax, 0xf
mov edx, esi
mul edx
lea edx, [eax + edx*2 - 0x7fffffff]
sar eax, 0x1f
and eax, ecx
sub edx, eax
mov eax, edx
sar eax, 0x1f
and eax, ecx
add eax, edx
add dword [ebp - 0x28], eax
inc dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x30]
jb 0x10ce225
jmp 0x10ce4f8
mov ecx, ebx
mov esi, dword [0x100003c]
mov eax, dword [ebp - 0x30]
add eax, ebx
mov dword [ebp - 0x14], eax
lea esi, [esi + 0x10000a0]
mov eax, dword [esi]
add eax, edi
sub ecx, edi
mov esi, dword [esi + 4]
mov edi, ecx
and edi, edx
mov dword [ebp - 0x2c], esi
mov esi, ecx
sub esi, edi
mov dword [ebp - 0x20], esi
mov esi, dword [ebp - 0x30]
add ecx, esi
mov esi, ecx
and esi, edx
sub ecx, esi
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x60], esi
add edx, eax
mov ecx, eax
cmp eax, edx
mov dword [ebp - 0x58], edx
jmp 0x10ce2de
cmp dword [ecx], edi
jae 0x10ce2e3
add ecx, dword [ecx + 4]
cmp ecx, edx
mov dword [ebp - 0x54], ecx
jne 0x10ce2d5
and dword [ebp - 0x50], 0
cmp ecx, edx
je 0x10ce314
cmp dword [ecx], edi
jne 0x10ce314
mov eax, dword [ecx + 4]
sub eax, 8
shr eax, 1
je 0x10ce314
add ecx, 8
movzx edx, word [ecx]
and edx, 0xfff
cmp edx, dword [ebp - 0x20]
jae 0x10ce314
inc dword [ebp - 0x50]
inc ecx
inc ecx
cmp dword [ebp - 0x50], eax
jne 0x10ce2fc
mov edi, 0x12f7322a
mov esi, 0xed08cdd6
mov ecx, 0x7fffffff
mov edx, dword [ebp - 0x54]
jmp 0x10ce32b
mov ebx, dword [ebp - 0x18]
cmp edx, dword [ebp - 0x58]
je 0x10ce48b
mov eax, dword [ebp - 0x60]
cmp dword [edx], eax
ja 0x10ce48b
mov edx, dword [edx + 4]
add edx, 0xfffffff8
shr edx, 1
cmp dword [ebp - 0x50], edx
mov edx, dword [ebp - 0x54]
jne 0x10ce36f
add edx, dword [edx + 4]
mov dword [ebp - 0x54], edx
cmp edx, dword [ebp - 0x58]
je 0x10ce48b
mov eax, dword [ebp - 0x60]
cmp dword [edx], eax
ja 0x10ce48b
and dword [ebp - 0x50], 0
jmp 0x10ce33f
mov eax, dword [ebp - 0x60]
cmp dword [edx], eax
jne 0x10ce38c
mov eax, dword [ebp - 0x50]
movzx eax, word [edx + eax*2 + 8]
and eax, 0xfff
cmp eax, dword [ebp - 0x5c]
jae 0x10ce48b
mov eax, dword [ebp - 0x50]
inc dword [ebp - 0x50]
mov ebx, 0xf000
test word [edx + eax*2 + 8], bx
je 0x10ce328
movzx eax, word [edx + eax*2 + 8]
and eax, 0xfff
mov edx, dword [edx]
xor ebx, ebx
lea eax, [eax + edx + 0x1000000]
mov dword [ebp - 0x20], eax
sub eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
je 0x10ce418
mov edx, esi
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax + ebx]
sub eax, edi
add dword [ebp - 0x28], eax
add eax, dword [ebp - 0x24]
mul edx
lea edx, [eax + edx*2 - 0x7fffffff]
sar eax, 0x1f
and eax, ecx
sub edx, eax
mov eax, edx
sar eax, 0x1f
and eax, ecx
add eax, edx
mov edx, esi
imul eax, eax, 0xed08cdd6
ror eax, 0xf
mul edx
lea edx, [eax + edx*2 - 0x7fffffff]
sar eax, 0x1f
and eax, ecx
sub edx, eax
mov eax, edx
sar eax, 0x1f
and eax, ecx
add eax, edx
add dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
inc ebx
cmp ebx, dword [ebp - 0x2c]
jb 0x10ce3be
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
sub eax, dword [ebp - 0x34]
mov dword [ebp - 0x68], eax
xor ebx, ebx
movzx eax, byte [ebp + ebx - 0x68]
mov edx, esi
sub eax, edi
add dword [ebp - 0x28], eax
add eax, dword [ebp - 0x24]
mul edx
lea edx, [eax + edx*2 - 0x7fffffff]
sar eax, 0x1f
and eax, ecx
sub edx, eax
mov eax, edx
sar eax, 0x1f
and eax, ecx
add eax, edx
imul eax, eax, 0xed08cdd6
mov edx, esi
ror eax, 0xf
mul edx
lea edx, [eax + edx*2 - 0x7fffffff]
sar eax, 0x1f
and eax, ecx
sub edx, eax
mov eax, edx
sar eax, 0x1f
and eax, ecx
add eax, edx
add dword [ebp - 0x28], eax
inc ebx
mov dword [ebp - 0x24], eax
cmp ebx, 4
jb 0x10ce425
mov ebx, dword [ebp - 0x20]
add ebx, 4
mov dword [ebp - 0x18], ebx
jmp 0x10ce323
mov eax, dword [ebp - 0x14]
and dword [ebp - 0x18], 0
sub eax, ebx
mov dword [ebp - 0x2c], eax
je 0x10ce4f8
mov edx, esi
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax + ebx]
sub eax, edi
add dword [ebp - 0x28], eax
add eax, dword [ebp - 0x24]
mul edx
lea edx, [eax + edx*2 - 0x7fffffff]
sar eax, 0x1f
and eax, ecx
sub edx, eax
mov eax, edx
sar eax, 0x1f
and eax, ecx
add eax, edx
imul eax, eax, 0xed08cdd6
mov edx, esi
ror eax, 0xf
mul edx
lea edx, [eax + edx*2 - 0x7fffffff]
sar eax, 0x1f
and eax, ecx
sub edx, eax
mov eax, edx
sar eax, 0x1f
and eax, ecx
add eax, edx
add dword [ebp - 0x28], eax
inc dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x2c]
jb 0x10ce499
xor eax, eax
mov ecx, eax
and ecx, 7
mov cl, byte [ebp + ecx - 0x28]
mov byte [ebp + eax - 0xc], cl
inc eax
cmp eax, 8
jb 0x10ce4fa
mov eax, 0x7b0c05c0
mov esi, dword [ebp - 0x44]
mov eax, dword [ebp - 0x4c]
mov ebx, dword [ebp - 8]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x40]
and eax, 7
mov dword [ebp - 0x34], eax
je 0x10ce6d9
mov edi, dword [ebp - 0x3c]
xor ecx, ecx
cmp eax, ecx
mov dword [ebp - 0x18], ecx
not edi
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x1c], ecx
jle 0x10ce570
mov dword [ebp - 0x14], 0x38
mov ecx, dword [ebp - 0x14]
movzx edx, byte [esi]
cmp dword [ebp - 0x1c], 4
jge 0x10ce55e
add ecx, 0xffffffe0
shl edx, cl
or dword [ebp - 0x30], edx
jmp 0x10ce563
shl edx, cl
or dword [ebp - 0x18], edx
sub dword [ebp - 0x14], 8
inc esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jl 0x10ce548
movzx edx, bx
mov ecx, dword [ebp - 0xc]
mov eax, edi
xor ecx, edi
ror ecx, 1
imul edx, ecx
ror eax, 8
xor eax, edx
xor eax, dword [ebp - 0x3c]
lea ecx, [ebx + eax]
mov ebx, eax
ror ecx, 0xc
movzx edx, word [ebp - 0xa]
imul edx, ecx
movzx ecx, word [ebp - 6]
ror ebx, 0xa
add ebx, edx
xor edi, ebx
xor ecx, edi
rol ecx, 2
movzx edx, word [ebp - 0xc]
mov ebx, edi
mov dword [ebp - 0x20], edx
imul edx, ecx
mov ecx, dword [ebp - 0xc]
ror ebx, 0x10
xor ebx, edx
movzx edx, word [ebp - 6]
xor eax, ebx
mov ebx, eax
xor ecx, eax
rol ecx, 8
imul edx, ecx
rol ebx, 6
add ebx, edx
movzx ecx, word [ebp - 0xa]
xor edi, ebx
mov ebx, ecx
mov edx, edi
xor ebx, edi
movzx ecx, word [ebp - 8]
imul ebx, ecx
ror edx, 6
add edx, ebx
xor eax, edx
mov ebx, eax
mov ecx, eax
movzx edx, word [ebp - 0xa]
sub ecx, dword [ebp - 8]
ror ecx, 5
imul edx, ecx
ror ebx, 0xb
xor ebx, edx
xor edi, ebx
movzx edx, word [ebp - 8]
mov ebx, edi
mov ecx, edx
xor ecx, edi
imul ecx, dword [ebp - 0x20]
shr ebx, 0xf
add ecx, ebx
xor eax, ecx
movzx ecx, word [ebp - 6]
mov ebx, eax
sub ebx, ecx
sub ebx, dword [ebp - 0xc]
xor edi, ebx
mov ebx, edi
mov ecx, edi
sub ecx, dword [ebp - 0xc]
ror ecx, 0xe
imul edx, ecx
rol ebx, 1
add ebx, edx
movzx ecx, word [ebp - 0xa]
xor eax, ebx
mov edx, eax
not edx
mov ebx, dword [ebp - 0x34]
ror edx, 0xd
add edx, ecx
movzx ecx, word [ebp - 8]
imul edx, ecx
movzx ecx, word [ebp - 6]
and dword [ebp - 0x1c], 0
xor edi, edx
mov edx, edi
sub edx, ecx
rol edx, 4
mov ecx, dword [ebp - 0x20]
imul ecx, edx
mov edx, edi
xor edi, dword [ebp - 0x18]
shr edx, 0xc
xor ecx, edx
xor ecx, dword [ebp - 0x30]
xor eax, ecx
mov dword [ebp - 0x14], eax
test ebx, ebx
mov ecx, edi
jle 0x10ce6af
cmp dword [ebp - 0x1c], 4
jge 0x10ce696
rol dword [ebp - 0x14], 8
mov ebx, dword [ebp - 0x38]
mov dl, byte [ebp - 0x14]
inc dword [ebp - 0x38]
xor byte [ebp - 0xd], dl
mov byte [ebx], dl
jmp 0x10ce6a4
mov edx, dword [ebp - 0x38]
inc dword [ebp - 0x38]
rol ecx, 8
xor byte [ebp - 0xd], cl
mov byte [edx], cl
inc dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x34]
cmp dword [ebp - 0x1c], ebx
jl 0x10ce67c
add ebx, 0xfffffffc
test ebx, ebx
jle 0x10ce6c6
push 4
pop ecx
sub ecx, ebx
shl ecx, 3
shr edi, cl
shl edi, cl
mov edx, edi
jmp 0x10ce6e8
xor edx, edx
test ebx, ebx
jge 0x10ce6e8
neg ebx
shl ebx, 3
mov ecx, ebx
shr eax, cl
shl eax, cl
jmp 0x10ce6e8
xor edx, edx
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x30], eax
not eax
mov dword [ebp - 0x18], eax
xor eax, eax
mov ebx, dword [ebp - 0x40]
shr ebx, 3
test ebx, ebx
jbe 0x10ce8b4
movzx ecx, word [ebp - 0xa]
movzx edi, word [ebp - 8]
mov dword [ebp - 0x1c], ecx
movzx ecx, word [ebp - 6]
mov dword [ebp - 0x20], ecx
neg dword [ebp - 0x20]
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x2c], ebx
jmp 0x10ce716
mov edi, dword [ebp - 0x6c]
movzx ebx, byte [esi + 1]
movzx ecx, byte [esi]
shl ecx, 8
or ecx, ebx
shl ecx, 8
movzx ebx, byte [esi + 2]
or ecx, ebx
shl ecx, 8
movzx ebx, byte [esi + 3]
or ecx, ebx
movzx ebx, byte [esi + 5]
mov dword [ebp - 0x14], ecx
movzx ecx, byte [esi + 4]
shl ecx, 8
or ecx, ebx
shl ecx, 8
movzx ebx, byte [esi + 6]
or ecx, ebx
shl ecx, 8
movzx ebx, byte [esi + 7]
or ecx, ebx
mov dword [ebp - 0x70], ecx
xor edx, ecx
mov ebx, edx
mov ecx, dword [ebp - 0xc]
xor ecx, edx
add esi, 8
ror ecx, 1
imul edi, ecx
mov ecx, dword [ebp - 8]
ror ebx, 8
xor ebx, edi
xor ebx, dword [ebp - 0x14]
xor eax, ebx
mov ebx, dword [ebp - 0x1c]
mov edi, eax
add ecx, eax
ror ecx, 0xc
imul ebx, ecx
mov ecx, dword [ebp - 0x34]
ror edi, 0xa
add edi, ebx
xor edx, edi
movzx edi, word [ebp - 0xc]
xor ecx, edx
rol ecx, 2
mov ebx, edx
imul edi, ecx
ror ebx, 0x10
xor ebx, edi
xor eax, ebx
mov ebx, dword [ebp - 0x34]
mov edi, eax
mov ecx, dword [ebp - 0xc]
xor ecx, eax
rol ecx, 8
imul ebx, ecx
movzx ecx, word [ebp - 8]
rol edi, 6
add edi, ebx
xor edx, edi
mov ebx, dword [ebp - 0x1c]
xor ebx, edx
imul ebx, ecx
mov edi, edx
ror edi, 6
add edi, ebx
xor eax, edi
mov edi, eax
mov ebx, dword [ebp - 0x1c]
mov ecx, eax
sub ecx, dword [ebp - 8]
ror ecx, 5
imul ebx, ecx
movzx ecx, word [ebp - 0xc]
ror edi, 0xb
xor edi, ebx
xor edx, edi
movzx edi, word [ebp - 8]
mov ebx, edi
xor ebx, edx
imul ebx, ecx
mov ecx, edx
shr ecx, 0xf
add ebx, ecx
xor eax, ebx
mov ecx, eax
sub ecx, dword [ebp - 0x34]
sub ecx, dword [ebp - 0xc]
xor edx, ecx
mov ebx, edx
mov ecx, edx
sub ecx, dword [ebp - 0xc]
ror ecx, 0xe
imul edi, ecx
movzx ecx, word [ebp - 8]
rol ebx, 1
add ebx, edi
xor eax, ebx
mov edi, eax
not edi
ror edi, 0xd
add edi, dword [ebp - 0x1c]
imul edi, ecx
mov dword [ebp - 0x6c], ecx
xor edx, edi
movzx edi, word [ebp - 0xc]
mov ecx, dword [ebp - 0x20]
add ecx, edx
rol ecx, 4
imul edi, ecx
mov ecx, edx
xor edx, dword [ebp - 0x18]
shr ecx, 0xc
xor edi, ecx
xor edi, dword [ebp - 0x30]
mov cl, byte [ebp - 0xd]
xor eax, edi
xor cl, al
xor cl, dl
mov edi, dword [ebp - 0x38]
mov byte [edi + 3], al
ror eax, 8
mov byte [edi + 7], dl
xor cl, al
mov byte [edi + 2], al
ror edx, 8
xor cl, dl
mov byte [edi + 6], dl
ror eax, 8
mov byte [edi + 1], al
xor cl, al
ror edx, 8
xor cl, dl
ror eax, 8
mov byte [edi + 5], dl
ror edx, 8
mov bl, dl
xor bl, al
xor cl, bl
mov byte [ebp - 0xd], cl
mov ecx, dword [ebp - 0x14]
mov byte [edi], al
mov byte [edi + 4], dl
mov dword [ebp - 0x30], ecx
add edi, 8
mov ecx, dword [ebp - 0x70]
dec dword [ebp - 0x2c]
mov dword [ebp - 0x18], ecx
ror eax, 8
mov dword [ebp - 0x38], edi
ror edx, 8
jne 0x10ce713
movzx ecx, byte [ebp - 0xd]
mov eax, dword [ebp - 0x48]
movzx eax, byte [eax + 8]
sub ecx, eax
je 0x10ce94f
call fcn.01244f80
mov edx, dword [ebp - 0x64]
mov edi, eax
mov dword [edx + 8], 0x10d8814
mov eax, 0xfffff000
lea ecx, [edx + 0xc]
mov edx, 0xffff
and ecx, 0xfffffffc
and edi, eax
lea esi, [ecx + 0xfff]
and esi, eax
xor eax, eax
mov ebx, dword [0x12d47a4]
imul ebx, ebx, 0x343fd
add ebx, 0x269ec3
mov dword [0x12d47a4], ebx
shr ebx, 0x10
shl eax, 0x10
shr edx, 0x10
or eax, ebx
test edx, edx
jne 0x10ce8f4
mov ebx, 0xffff
div ebx
inc edx
cmp ecx, esi
mov eax, ecx
mov dword [ebp - 0x84], edi
mov dword [ebp - 0x7c], edx
mov dword [ebp - 0x48], 0
jae 0x10ce945
mov ecx, dword [ebp - 0x48]
mov dword [eax], ecx
add eax, 4
cmp eax, esi
jb 0x10ce939
mov eax, 0x10d8814
jmp 0x10cea20
mov ecx, 0x1000000
mov edx, dword [0x11e47bc]
mov eax, dword [ebp - 0x44]
sub eax, dword [ebp - 0x4c]
sub ecx, edx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x2c], ecx
jne 0x10ce972
test eax, eax
je 0x10cea13
mov esi, dword [ebp - 0x4c]
mov ecx, dword [0x11efd70]
mov ebx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x40]
sub esi, dword [ebp - 0x44]
add eax, ebx
xor edi, edi
dec ecx
mov dword [ebp - 0x48], eax
js 0x10ce9b5
lea eax, [edi + ecx]
cdq
sub eax, edx
sar eax, 1
mov edx, dword [eax*4 + 0x11efd74]
and edx, 0xfffffff
cmp ebx, edx
jae 0x10ce9ac
lea ecx, [eax - 1]
jmp 0x10ce9b1
jbe 0x10ce9b9
lea edi, [eax + 1]
cmp ecx, edi
jge 0x10ce98e
mov ebx, edi
jmp 0x10cea0b
mov ebx, eax
jmp 0x10cea0b
mov eax, dword [ebx*4 + 0x11efd74]
mov ecx, eax
and ecx, 0xfffffff
cmp ecx, dword [ebp - 0x48]
jae 0x10cea13
lea edi, [ecx + esi + 0x1000000]
mov ecx, eax
shl ecx, 2
sar ecx, 0x1e
sar eax, 0x1e
and ecx, 3
and eax, 3
xor edx, edx
dec ecx
je 0x10ce9fe
dec ecx
je 0x10ce9f9
dec ecx
jne 0x10cea04
mov edx, dword [ebp - 0x2c]
jmp 0x10cea04
mov edx, dword [ebp - 0x20]
jmp 0x10cea04
mov edx, dword [ebp - 0x2c]
sub edx, dword [ebp - 0x20]
dec eax
dec eax
jne 0x10cea0a
add dword [edi], edx
inc ebx
cmp ebx, dword [0x11efd70]
jb 0x10ce9bd
mov eax, dword [0x1116588]
mov eax, 0xbd999a04
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x64]
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x7c]
mov edx, dword [ebp - 0x84]
mov edi, dword [ebp - 0x80]
mov ebx, dword [ebp - 0x8c]
mov esi, dword [ebp - 0x88]
mov esp, ebp
pop ebp
popfd
ret