Function at 0x103c6ac
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xb0
mov eax, dword [0x10431dc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ecx + 4]
movzx edx, byte [eax]
push ebx
xor ebx, ebx
mov dword [ebp - 0x78], ecx
add ecx, 8
push esi
mov dword [ebp - 0x90], ecx
mov ecx, dword [ecx]
and edx, 0xf
lea esi, [eax + 1]
cmp esi, ebx
push edi
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0xac], edx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x40], ebx
je 0x103c899
mov eax, dword [0x104c8e0]
lea edi, [esi - 1]
and edi, 0xfffff000
cmp eax, ebx
mov dword [ebp - 0x4c], edi
je 0x103c80d
cmp edi, 0x1031000
jb 0x103c80d
shl eax, 0xc
add eax, 0x1031000
cmp edi, eax
ja 0x103c80d
mov eax, edi
and eax, 0xfffff000
cmp eax, ebx
mov dword [ebp - 0x18], eax
je 0x103c80d
lea eax, [edi + 0x1000]
test eax, eax
jbe 0x103c7ca
cmp dword [ebp - 0x20], ebx
je 0x103c76c
lea ecx, [ebp - 0x28]
push ecx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x24], ebx
je 0x103c77f
push 0x104c8a0
mov dword [ebp - 0x24], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 0x18]
lea edx, [edi + 0x1fff]
and edx, 0xfffff000
sub edx, eax
push 0x104c8a0
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x30]
lea eax, [ebp - 0x28]
push eax
push 0x40
push ecx
push edx
mov dword [ebp - 0x24], 1
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, ebx
je 0x103c7ce
mov dword [ebp - 0x20], 1
cmp edi, ebx
jne 0x103c80d
cmp dword [ebp - 0x20], ebx
je 0x103c7ec
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x30]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x24], ebx
je 0x103c7ff
push 0x104c8a0
mov dword [ebp - 0x24], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
jmp 0x103c74d
mov edx, dword [0x100003c]
sub esi, edi
xor ecx, ecx
lea eax, [esi - 0x40]
cmp eax, ebx
setl cl
mov dword [ebp - 0x40], edi
sub ecx, 1
and ecx, eax
mov dword [ebp - 0x18], ecx
mov ecx, dword [edx + 0x1000050]
sub ecx, 0x3f
mov eax, ebx
mov esi, ecx
je 0x103c86d
mov edx, dword [0x104c8dc]
jmp 0x103c84c
imul edx, edx, 0x343fd
add edx, 0x269ec3
mov ebx, edx
shr ebx, 0x10
shl eax, 0x10
or eax, ebx
shr esi, 0x10
jne 0x103c84c
mov dword [0x104c8dc], edx
xor edx, edx
div ecx
mov eax, dword [ebp - 0x18]
lea eax, [eax + edi + 3]
and eax, 0xfffffffc
mov ecx, 0x10
add edx, 0x1000003
and edx, 0xfffffffc
sub edx, eax
nop
mov esi, dword [edx + eax]
mov dword [eax], esi
add eax, 4
sub ecx, 1
jne 0x103c88c
mov eax, dword [0x104cddc]
mov esi, dword [ebp - 0x6c]
xor ebx, ebx
add eax, 0xffffffff
xor edi, edi
cmp esi, 0x1000000
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x50], eax
jb 0x103c983
mov ecx, dword [0x100003c]
mov edx, dword [ecx + 0x1000050]
add edx, 0x1000000
cmp esi, edx
jae 0x103c983
mov ecx, esi
sub ecx, 0x1000000
cmp eax, edi
mov dword [ebp - 0x68], ecx
jl 0x103c972
jmp 0x103c8ec
add eax, ebx
cdq
sub eax, edx
sar eax, 1
lea ecx, [eax + eax*4]
mov esi, dword [ecx*4 + 0x104cb48]
lea ecx, [ecx*4 + 0x104cb48]
mov edx, esi
xor edx, edi
cmp dword [ebp - 0x68], edx
mov edi, dword [ecx + 0xc]
jae 0x103c91a
add eax, 0xffffffff
mov dword [ebp - 0x50], eax
add edi, esi
jmp 0x103c936
mov ebx, edi
and ebx, 0xfff
add ebx, edx
cmp dword [ebp - 0x68], ebx
jb 0x103c93c
lea ebx, [eax + 1]
mov eax, dword [ebp - 0x50]
sub esi, edi
mov dword [ebp - 0x5c], ebx
mov edi, esi
cmp eax, ebx
jge 0x103c8ec
jmp 0x103c96d
mov ebx, dword [ebp - 0x5c]
mov dword [ebp - 0x8c], edx
mov edx, dword [ecx + 4]
mov eax, esi
add edx, eax
mov dword [ebp - 0x88], edx
mov edx, dword [ecx + 8]
mov ecx, dword [ecx + 0x10]
sub edx, eax
mov eax, edi
add ecx, eax
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x84], edx
mov dword [ebp - 0x7c], ecx
mov esi, dword [ebp - 0x6c]
xor edi, edi
xor ecx, ecx
cmp ebx, eax
setle cl
mov eax, ecx
cmp eax, edi
jne 0x103ca5d
mov ebx, dword [ebp - 0x4c]
cmp ebx, edi
je 0x103ca56
mov ecx, dword [0x104c8e0]
cmp ecx, edi
je 0x103ca49
cmp ebx, 0x1031000
jb 0x103ca04
mov edx, ecx
shl edx, 0xc
add edx, 0x1031000
cmp ebx, edx
ja 0x103ca04
mov eax, ebx
and eax, 0xfffff000
cmp eax, edi
je 0x103ca04
cmp dword [ebp - 0x20], edi
je 0x103c9e2
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x30]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [0x104c8e0]
mov dword [ebp - 0x20], edi
cmp dword [ebp - 0x24], edi
je 0x103c9fb
push 0x104c8a0
mov dword [ebp - 0x24], edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [0x104c8e0]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
cmp ecx, edi
je 0x103ca49
cmp ebx, 0x1031000
jb 0x103ca49
shl ecx, 0xc
add ecx, 0x1031000
cmp ebx, ecx
ja 0x103ca49
mov eax, ebx
and eax, 0xfffff000
cmp eax, edi
je 0x103ca49
mov eax, ebx
sub eax, 0x1031000
cdq
and edx, 0xfff
add eax, edx
sar eax, 0xc
mov dword [eax*4 + 0x104cb20], edi
mov eax, esi
jmp 0x103d839
push 0x8000
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, esi
jmp 0x103d839
mov edx, dword [ebp - 0x80]
mov eax, edx
and eax, 0xfff
mov dword [ebp - 0x68], eax
mov ecx, eax
mov eax, edx
shr eax, 0xc
mov dword [ebp - 0xa8], eax
and eax, 0x7f
mov dword [ebp - 0xb0], eax
add eax, 0xfffffff5
cmp eax, 0x69
ja case.0x103ca8f.12
movzx edx, byte [eax + 0x103d8f0]
jmp dword [edx*4 + 0x103d95c]
add ecx, 0xd
jmp 0x103caa3
add ecx, 6
jmp 0x103caa3
add ecx, 0x11
cmp dword [ebp - 0x4c], edi
mov dword [ebp - 0x34], ecx
jne 0x103cd0e
add ecx, 0xfff
and ecx, 0xfffff000
mov dword [ebp - 0x18], ecx
xor edi, edi
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
xor esi, esi
lea esp, [esp]
mov eax, dword [ebp - 0x18]
push 0x40
push 0x1000
push eax
push edi
add esi, 1
call ebx
cmp eax, edi
jne 0x103cb7e
push edi
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, 0x11
jb 0x103cacb
mov ebx, dword [0x104c8e0]
cmp ebx, edi
je 0x103cac0
xor esi, esi
xor eax, eax
cmp ebx, edi
mov edx, ebx
je 0x103cb2e
mov ecx, dword [0x104c8dc]
nop
imul ecx, ecx, 0x343fd
add ecx, 0x269ec3
mov edi, ecx
shr edi, 0x10
shl eax, 0x10
or eax, edi
shr edx, 0x10
jne 0x103cb0b
mov dword [0x104c8dc], ecx
xor edi, edi
xor edx, edx
div ebx
jmp 0x103cb3b
add esi, 1
mov ecx, 0x3cea0
lea ebx, [edx*4 + 0x104cb20]
xor eax, eax
lock cmpxchg dword [ebx], ecx
cmp eax, edi
je 0x103cb69
lea eax, [edx + 1]
xor edx, edx
div dword [0x104c8e0]
cmp esi, 9
jb 0x103cb3b
jmp 0x103cac0
shl edx, 0xc
add edx, 0x1031000
mov esi, edx
cmp esi, edi
je 0x103cac0
jmp 0x103cb80
mov esi, eax
mov eax, dword [0x104c8e0]
cmp eax, edi
mov dword [ebp - 0x4c], esi
je 0x103cc93
cmp esi, 0x1031000
jb 0x103cc93
shl eax, 0xc
add eax, 0x1031000
cmp esi, eax
ja 0x103cc93
mov eax, esi
and eax, 0xfffff000
cmp eax, edi
mov dword [ebp - 0x18], eax
je 0x103cc93
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
nop
cmp esi, eax
jb 0x103cbde
lea edx, [eax + ecx]
lea edi, [esi + 0x1000]
cmp edi, edx
jbe 0x103cc54
xor edi, edi
cmp dword [ebp - 0x20], edi
je 0x103cbf2
lea edx, [ebp - 0x28]
push edx
mov edx, dword [ebp - 0x28]
push edx
push ecx
push eax
call ebx
mov dword [ebp - 0x20], edi
cmp dword [ebp - 0x24], edi
je 0x103cc05
push 0x104c8a0
mov dword [ebp - 0x24], edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 0x18]
lea ecx, [esi + 0x1fff]
and ecx, 0xfffff000
sub ecx, eax
push 0x104c8a0
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x30]
lea edx, [ebp - 0x28]
push edx
push 0x40
push eax
push ecx
mov dword [ebp - 0x24], 1
call ebx
mov ecx, dword [ebp - 0x2c]
cmp eax, edi
mov eax, dword [ebp - 0x30]
je 0x103cc5a
mov dword [ebp - 0x20], 1
jmp 0x103cc56
xor edi, edi
cmp esi, edi
jne 0x103cc93
cmp dword [ebp - 0x20], edi
je 0x103cc6e
lea edx, [ebp - 0x28]
push edx
mov edx, dword [ebp - 0x28]
push edx
push ecx
push eax
call ebx
mov dword [ebp - 0x20], edi
cmp dword [ebp - 0x24], edi
je 0x103cc81
push 0x104c8a0
mov dword [ebp - 0x24], edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], edi
jmp 0x103cbcb
mov eax, dword [0x100003c]
mov ecx, dword [eax + 0x1000050]
sub ecx, 0xfff
mov eax, edi
mov dword [ebp - 0x40], esi
mov edi, ecx
je 0x103ccdd
mov edx, dword [0x104c8dc]
jmp 0x103ccbc
imul edx, edx, 0x343fd
add edx, 0x269ec3
mov ebx, edx
shr ebx, 0x10
shl eax, 0x10
or eax, ebx
shr edi, 0x10
jne 0x103ccbc
mov dword [0x104c8dc], edx
xor edx, edx
div ecx
lea eax, [esi + 3]
and eax, 0xfffffffc
mov ecx, 0x400
add edx, 0x1000003
and edx, 0xfffffffc
sub edx, eax
jmp 0x103ccfc
mov esi, dword [edx + eax]
mov dword [eax], esi
add eax, 4
sub ecx, 1
jne 0x103ccfc
jmp 0x103d049
cmp ecx, 0x1000
jbe 0x103d049
mov ecx, dword [0x104c8e0]
mov esi, dword [ebp - 0x4c]
xor edi, edi
cmp ecx, edi
je 0x103cdd5
cmp esi, 0x1031000
jb 0x103cd95
mov edx, ecx
shl edx, 0xc
add edx, 0x1031000
cmp esi, edx
ja 0x103cd95
mov eax, esi
and eax, 0xfffff000
cmp eax, edi
je 0x103cd95
cmp dword [ebp - 0x20], edi
je 0x103cd73
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x30]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [0x104c8e0]
mov dword [ebp - 0x20], edi
cmp dword [ebp - 0x24], edi
je 0x103cd8c
push 0x104c8a0
mov dword [ebp - 0x24], edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [0x104c8e0]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
cmp ecx, edi
je 0x103cdd5
cmp esi, 0x1031000
jb 0x103cdd5
shl ecx, 0xc
add ecx, 0x1031000
cmp esi, ecx
ja 0x103cdd5
mov eax, esi
and eax, 0xfffff000
cmp eax, edi
je 0x103cdd5
mov eax, esi
sub eax, 0x1031000
cdq
and edx, 0xfff
add eax, edx
sar eax, 0xc
mov dword [eax*4 + 0x104cb20], edi
jmp 0x103cde2
push 0x8000
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, dword [ebp - 0x34]
add eax, 0xfff
and eax, 0xfffff000
mov dword [ebp - 0x18], eax
xor edi, edi
jmp 0x103cdfc
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
xor esi, esi
jmp 0x103ce0c
mov ecx, dword [ebp - 0x18]
push 0x40
push 0x1000
push ecx
push edi
add esi, 1
call ebx
cmp eax, edi
jne 0x103cebf
push edi
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, 0x11
jb 0x103ce0c
mov ebx, dword [0x104c8e0]
cmp ebx, edi
je 0x103cdfc
xor esi, esi
xor eax, eax
cmp ebx, edi
mov edx, ebx
je 0x103ce6f
mov ecx, dword [0x104c8dc]
nop
imul ecx, ecx, 0x343fd
add ecx, 0x269ec3
mov edi, ecx
shr edi, 0x10
shl eax, 0x10
or eax, edi
shr edx, 0x10
jne 0x103ce4c
mov dword [0x104c8dc], ecx
xor edi, edi
xor edx, edx
div ebx
jmp 0x103ce7c
add esi, 1
mov ecx, 0x3cea0
lea ebx, [edx*4 + 0x104cb20]
xor eax, eax
lock cmpxchg dword [ebx], ecx
cmp eax, edi
je 0x103ceaa
lea eax, [edx + 1]
xor edx, edx
div dword [0x104c8e0]
cmp esi, 9
jb 0x103ce7c
jmp 0x103cdfc
shl edx, 0xc
add edx, 0x1031000
mov esi, edx
cmp esi, edi
je 0x103cdfc
jmp 0x103cec1
mov esi, eax
mov eax, dword [0x104c8e0]
cmp eax, edi
mov dword [ebp - 0x4c], esi
je 0x103cfd4
cmp esi, 0x1031000
jb 0x103cfd4
shl eax, 0xc
add eax, 0x1031000
cmp esi, eax
ja 0x103cfd4
mov eax, esi
and eax, 0xfffff000
cmp eax, edi
mov dword [ebp - 0x18], eax
je 0x103cfd4
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
nop
cmp esi, eax
jb 0x103cf1f
lea edx, [eax + ecx]
lea edi, [esi + 0x1000]
cmp edi, edx
jbe 0x103cf95
xor edi, edi
cmp dword [ebp - 0x20], edi
je 0x103cf33
lea edx, [ebp - 0x28]
push edx
mov edx, dword [ebp - 0x28]
push edx
push ecx
push eax
call ebx
mov dword [ebp - 0x20], edi
cmp dword [ebp - 0x24], edi
je 0x103cf46
push 0x104c8a0
mov dword [ebp - 0x24], edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 0x18]
lea ecx, [esi + 0x1fff]
and ecx, 0xfffff000
sub ecx, eax
push 0x104c8a0
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x30]
lea edx, [ebp - 0x28]
push edx
push 0x40
push eax
push ecx
mov dword [ebp - 0x24], 1
call ebx
mov ecx, dword [ebp - 0x2c]
cmp eax, edi
mov eax, dword [ebp - 0x30]
je 0x103cf9b
mov dword [ebp - 0x20], 1
jmp 0x103cf97
xor edi, edi
cmp esi, edi
jne 0x103cfd4
cmp dword [ebp - 0x20], edi
je 0x103cfaf
lea edx, [ebp - 0x28]
push edx
mov edx, dword [ebp - 0x28]
push edx
push ecx
push eax
call ebx
mov dword [ebp - 0x20], edi
cmp dword [ebp - 0x24], edi
je 0x103cfc2
push 0x104c8a0
mov dword [ebp - 0x24], edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], edi
jmp 0x103cf0c
mov eax, dword [0x100003c]
mov ecx, dword [eax + 0x1000050]
sub ecx, 0xfff
mov dword [ebp - 0x40], esi
mov eax, edi
mov ebx, ecx
je 0x103d01d
mov edx, dword [0x104c8dc]
jmp 0x103cffc
imul edx, edx, 0x343fd
add edx, 0x269ec3
mov edi, edx
shr edi, 0x10
shl eax, 0x10
or eax, edi
shr ebx, 0x10
jne 0x103cffc
mov dword [0x104c8dc], edx
xor edx, edx
div ecx
lea eax, [esi + 3]
and eax, 0xfffffffc
mov ecx, 0x400
add edx, 0x1000003
and edx, 0xfffffffc
sub edx, eax
jmp 0x103d03c
mov esi, dword [edx + eax]
mov dword [eax], esi
add eax, 4
sub ecx, 1
jne 0x103d03c
mov ebx, dword [ebp - 0x8c]
mov ecx, 0x1001
sub ecx, dword [ebp - 0x34]
lea ebx, [ebx + 0x1000000]
mov dword [ebp - 0x50], ebx
mov eax, 0
mov esi, ecx
je 0x103d09d
mov edx, dword [0x104c8dc]
jmp 0x103d07c
imul edx, edx, 0x343fd
add edx, 0x269ec3
mov edi, edx
shr edi, 0x10
shl eax, 0x10
or eax, edi
shr esi, 0x10
jne 0x103d07c
mov dword [0x104c8dc], edx
xor edx, edx
div ecx
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x8c]
mov byte [ebp - 0x19], 0xa5
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x60], 0
add eax, edx
sub ebx, eax
mov dword [ebp - 0x40], eax
mov al, byte [ebp - 0x81]
test al, 1
mov dword [ebp - 0x5c], ebx
je 0x103d0d7
lea eax, [ebp - 0x88]
jmp 0x103d369
movzx edi, word [ebp - 0x84]
mov ecx, dword [ebp - 0x88]
movzx esi, al
mov eax, 0x1000000
shr esi, 1
sub eax, dword [0x104c928]
lea ecx, [ecx + 0x1000000]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x58], eax
jne 0x103d14f
mov eax, 0x8421085
mul esi
mov eax, esi
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 6
imul eax, eax, 0x7c
sub esi, eax
lea edx, [ebp - 0x58]
push edx
mov edx, dword [esi*4 + 0x104c930]
lea eax, [edi + ecx]
push eax
push ecx
lea ecx, [ebp - 0x64]
push ecx
mov byte [ebp - 0x58], 0
mov byte [ebp - 0x57], 1
mov byte [ebp - 0x56], 2
mov byte [ebp - 0x55], 3
mov byte [ebp - 0x54], 4
mov byte [ebp - 0x53], 5
call edx
jmp 0x103d353
mov eax, ecx
sub eax, 0x1000000
mov ecx, eax
mov ebx, eax
mov edx, edi
add eax, edx
mov edx, eax
and edx, 0xfffff000
sub eax, edx
mov dword [ebp - 0xa0], eax
mov eax, dword [0x100003c]
mov edi, dword [eax + 0x10000a0]
mov eax, dword [eax + 0x10000a4]
add edi, 0x1000000
and ecx, 0xfffff000
add eax, edi
sub ebx, ecx
cmp edi, eax
mov dword [ebp - 0xa4], edx
mov dword [ebp - 0x9c], eax
je 0x103d1aa
cmp dword [edi], ecx
jae 0x103d1aa
add edi, dword [edi + 4]
cmp edi, eax
jne 0x103d19f
xor edx, edx
cmp edi, eax
je 0x103d1e3
cmp dword [edi], ecx
jne 0x103d1e3
mov ecx, dword [edi + 4]
sub ecx, 8
shr ecx, 1
mov dword [ebp - 0x3c], ecx
je 0x103d1e3
jmp 0x103d1cc
movzx ecx, word [edi + edx*2 + 8]
and ecx, 0xfff
cmp ecx, ebx
jae 0x103d1e3
add edx, 1
cmp edx, dword [ebp - 0x3c]
jne 0x103d1cc
mov ecx, dword [ebp - 0x34]
jmp 0x103d1ec
cmp edi, eax
je 0x103d306
mov ebx, dword [edi]
cmp ebx, dword [ebp - 0xa4]
ja 0x103d306
lea esp, [esp]
mov ebx, dword [edi + 4]
add ebx, 0xfffffff8
shr ebx, 1
cmp edx, ebx
jne 0x103d22e
add edi, dword [edi + 4]
cmp edi, eax
je 0x103d306
mov edx, dword [ebp - 0xa4]
cmp dword [edi], edx
ja 0x103d306
xor edx, edx
jmp 0x103d205
mov ebx, dword [edi]
cmp ebx, dword [ebp - 0xa4]
jne 0x103d24e
movzx eax, word [edi + edx*2 + 8]
and eax, 0xfff
cmp eax, dword [ebp - 0xa0]
jae 0x103d306
mov eax, edx
movzx eax, word [edi + eax*2 + 8]
add edx, 1
test eax, 0xf000
mov dword [ebp - 0x94], edx
je 0x103d8e0
and eax, 0xfff
lea ebx, [eax + ebx + 0x1000000]
mov eax, 0x8421085
mul esi
mov eax, esi
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 6
imul eax, eax, 0x7c
mov edx, esi
sub edx, eax
lea eax, [edx*4 + 0x104c930]
lea edx, [ebp - 0x74]
push edx
mov edx, dword [eax]
push ebx
push ecx
lea ecx, [ebp - 0x64]
push ecx
mov byte [ebp - 0x74], 0
mov byte [ebp - 0x73], 1
mov byte [ebp - 0x72], 2
mov byte [ebp - 0x71], 3
mov byte [ebp - 0x70], 4
mov byte [ebp - 0x6f], 5
mov dword [ebp - 0x3c], eax
call edx
mov eax, dword [ebx]
sub eax, dword [ebp - 0x58]
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x48]
push eax
push ecx
mov ecx, dword [ebp - 0x3c]
lea edx, [ebp - 0x14]
push edx
mov edx, dword [ecx]
lea eax, [ebp - 0x64]
push eax
mov byte [ebp - 0x48], 0
mov byte [ebp - 0x47], 1
mov byte [ebp - 0x46], 2
mov byte [ebp - 0x45], 3
mov byte [ebp - 0x44], 4
mov byte [ebp - 0x43], 5
call edx
mov edx, dword [ebp - 0x94]
add esp, 0x20
lea ecx, [ebx + 4]
jmp 0x103d8e0
mov eax, 0x8421085
mul esi
mov eax, esi
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 6
imul eax, eax, 0x7c
sub esi, eax
mov eax, dword [ebp - 0x34]
lea edx, [ebp - 0x48]
push edx
mov edx, dword [ebp - 0x18]
add eax, edx
push eax
push ecx
mov ecx, dword [esi*4 + 0x104c930]
lea eax, [ebp - 0x64]
push eax
mov byte [ebp - 0x48], 0
mov byte [ebp - 0x47], 1
mov byte [ebp - 0x46], 2
mov byte [ebp - 0x45], 3
mov byte [ebp - 0x44], 4
mov byte [ebp - 0x43], 5
call ecx
mov ebx, dword [ebp - 0x5c]
or byte [ebp - 0x64], 1
or byte [ebp - 0x62], 1
or byte [ebp - 0x60], 1
add esp, 0x10
or byte [ebp - 0x5f], 1
lea eax, [ebp - 0x64]
mov edx, dword [eax]
mov ax, word [eax + 4]
mov word [ebp - 0x38], ax
mov eax, dword [ebp - 0x68]
test eax, eax
mov dword [ebp - 0x3c], edx
jbe 0x103d583
mov bl, byte [ebp - 0x3b]
lea edx, [eax - 1]
test edx, edx
mov dword [ebp - 0x18], edx
jbe 0x103d4fd
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x40]
lea edi, [ecx + edx]
sub eax, ecx
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x58], eax
lea ebx, [ebx]
test dl, 1
mov cl, byte [ebp - 0x39]
mov al, byte [edi]
je 0x103d444
mov dl, cl
xor dl, al
and dl, 1
movzx esi, cl
movzx eax, al
je 0x103d3dc
movzx ecx, byte [ebp - 0x3a]
mov ebx, esi
shr ebx, 1
shr ecx, 1
xor ecx, ebx
mov ebx, eax
xor ebx, 0x100
sar ebx, 1
xor ecx, ebx
jmp 0x103d3e2
mov ecx, eax
xor ecx, esi
shr ecx, 1
movzx edi, byte [edi - 1]
mov ebx, edi
xor ebx, ecx
test bl, 1
je 0x103d424
test dl, dl
je 0x103d408
movzx ecx, byte [ebp - 0x3a]
shr ecx, 1
shr esi, 1
xor eax, 0x100
xor ecx, esi
sar eax, 1
xor ecx, eax
jmp 0x103d40e
xor eax, esi
shr eax, 1
mov ecx, eax
movzx eax, byte [ebp - 0x37]
shr eax, 1
xor edi, ecx
xor eax, 0x80
sar edi, 1
xor eax, edi
jmp 0x103d4d7
test dl, dl
je 0x103d4cb
movzx ecx, byte [ebp - 0x3a]
shr ecx, 1
shr esi, 1
xor eax, 0x100
xor ecx, esi
sar eax, 1
xor ecx, eax
jmp 0x103d4d1
mov dl, bl
xor dl, al
and dl, 1
movzx esi, bl
movzx eax, al
je 0x103d46d
movzx ecx, byte [ebp - 0x3c]
mov ebx, esi
shr ebx, 1
shr ecx, 1
xor ecx, ebx
mov ebx, eax
xor ebx, 0x100
sar ebx, 1
xor ecx, ebx
jmp 0x103d473
mov ecx, eax
xor ecx, esi
shr ecx, 1
movzx edi, byte [edi - 1]
mov ebx, edi
xor ebx, ecx
test bl, 1
je 0x103d4b2
test dl, dl
je 0x103d499
movzx ecx, byte [ebp - 0x3c]
shr ecx, 1
shr esi, 1
xor eax, 0x100
xor ecx, esi
sar eax, 1
xor ecx, eax
jmp 0x103d49f
xor eax, esi
shr eax, 1
mov ecx, eax
movzx eax, byte [ebp - 0x38]
shr eax, 1
xor edi, ecx
xor eax, 0x80
sar edi, 1
xor eax, edi
jmp 0x103d4d7
test dl, dl
je 0x103d4cb
movzx ecx, byte [ebp - 0x3c]
shr ecx, 1
shr esi, 1
xor eax, 0x100
xor ecx, esi
sar eax, 1
xor ecx, eax
jmp 0x103d4d1
xor eax, esi
shr eax, 1
mov ecx, eax
xor edi, ecx
sar edi, 1
mov eax, edi
mov edi, dword [ebp - 0x34]
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x58]
xor byte [ebp - 0x19], al
mov bl, byte [ebp - 0x3b]
sub edx, 1
mov byte [ecx + edi], al
sub edi, 1
test edx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x34], edi
ja 0x103d3a5
mov edx, dword [ebp - 0x50]
mov cl, byte [edx]
mov dl, bl
xor dl, cl
movzx eax, bl
mov bl, byte [ebp - 0x3c]
movzx ecx, cl
xor eax, ecx
shr eax, 1
and dl, 1
je 0x103d527
movzx ecx, bl
xor ecx, 0x100
sar ecx, 1
xor ecx, eax
jmp 0x103d529
mov ecx, eax
test cl, 1
je 0x103d55f
test dl, dl
je 0x103d54e
movzx ecx, bl
xor ecx, 0x100
sar ecx, 1
xor ecx, eax
movzx eax, byte [ebp - 0x38]
xor eax, ecx
xor eax, 0x100
sar eax, 1
jmp 0x103d578
mov ecx, eax
movzx eax, byte [ebp - 0x38]
xor eax, ecx
xor eax, 0x100
sar eax, 1
jmp 0x103d578
test dl, dl
je 0x103d572
movzx ecx, bl
xor ecx, 0x100
sar ecx, 1
xor ecx, eax
jmp 0x103d574
mov ecx, eax
sar ecx, 1
mov eax, ecx
mov edx, dword [ebp - 0x40]
xor byte [ebp - 0x19], al
mov ebx, dword [ebp - 0x5c]
mov byte [edx], al
mov eax, 0x1000000
sub eax, dword [0x104c928]
mov dword [ebp - 0x18], eax
jne 0x103d59b
test ebx, ebx
je 0x103d65f
mov ecx, dword [ebp - 0x50]
mov ebx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x68]
mov esi, dword [0x103edac]
sub ebx, ecx
sub ecx, 0x1000000
lea edx, [eax + ecx]
xor edi, edi
add esi, 0xffffffff
mov dword [ebp - 0x58], edx
js 0x103d5ec
lea ebx, [ebx]
lea eax, [esi + edi]
cdq
sub eax, edx
sar eax, 1
mov edx, dword [eax*4 + 0x103edb0]
and edx, 0xfffffff
cmp ecx, edx
jae 0x103d5df
lea esi, [eax - 1]
jmp 0x103d5e4
jbe 0x103d5ea
lea edi, [eax + 1]
cmp esi, edi
jge 0x103d5c1
jmp 0x103d5ec
mov edi, eax
cmp edi, dword [0x103edac]
jae 0x103d65f
jmp 0x103d601
mov eax, dword [edi*4 + 0x103edb0]
mov esi, eax
and esi, 0xfffffff
cmp esi, dword [ebp - 0x58]
jae 0x103d65f
mov ecx, eax
add eax, eax
add eax, eax
sar eax, 0x1e
sar ecx, 0x1e
and eax, 3
and ecx, 3
xor edx, edx
sub eax, 1
je 0x103d642
sub eax, 1
je 0x103d63d
sub eax, 1
jne 0x103d648
mov edx, dword [ebp - 0x18]
jmp 0x103d648
mov edx, dword [ebp - 0x5c]
jmp 0x103d648
mov edx, dword [ebp - 0x18]
sub edx, dword [ebp - 0x5c]
sub ecx, 2
jne 0x103d654
add dword [ebx + esi + 0x1000000], edx
add edi, 1
cmp edi, dword [0x103edac]
jb 0x103d601
mov al, byte [ebp - 0x82]
xor al, byte [ebp - 0x19]
je 0x103d706
call fcn.0103ed9c
mov edi, dword [ebp - 0x90]
mov edx, dword [ebp - 0x78]
and edi, 0xfffffffc
mov esi, eax
lea ecx, [edi + 0xfff]
and esi, 0xfffff000
and ecx, 0xfffff000
mov dword [edx + 4], 0x1030fd8
mov edx, dword [0x104c8dc]
xor eax, eax
mov dword [ebp - 0x18], 0xffff
jmp 0x103d6b2
imul edx, edx, 0x343fd
add edx, 0x269ec3
mov ebx, edx
shr ebx, 0x10
shl eax, 0x10
or eax, ebx
shr dword [ebp - 0x18], 0x10
jne 0x103d6b2
mov dword [0x104c8dc], edx
xor edx, edx
mov ebx, 0xffff
div ebx
mov eax, dword [ebp - 0x78]
mov dword [eax - 8], esi
add edx, 1
cmp edi, ecx
mov dword [eax - 0x1c], edx
jae 0x103d6fc
sub ecx, edi
sub ecx, 1
shr ecx, 2
add ecx, 1
xor eax, eax
rep stosd dword es:[edi], eax
mov eax, 0x1030fd8
jmp 0x103d839
mov esi, dword [ebp - 0xb0]
mov edx, dword [ebp - 0x68]
mov edi, dword [ebp - 0x40]
lea ecx, [esi - 0xb]
cmp ecx, 0x69
lea eax, [edx + edi]
ja case.0x103d728.12
movzx ecx, byte [ecx + 0x103d868]
jmp dword [ecx*4 + 0x103d8d4]
mov edx, dword [ebp - 0x80]
mov edi, edx
shr edi, 5
mov ebx, edx
and edi, 0x100000
mov ecx, edx
and edx, 0x100000
and ebx, 0x1e00000
or edi, ebx
shr edi, 5
or edi, edx
mov edx, dword [eax + 5]
and edx, 0xffffff80
or edx, esi
and edx, 0xfff0007f
shr edi, 1
or edi, edx
mov edx, dword [ebp - 0xa8]
shr ecx, 0x12
and edx, 0x80
or edi, edx
and ecx, 0x3f00
or edi, ecx
mov ecx, dword [ebp - 0x7c]
mov dword [eax + 5], edi
mov edi, dword [ebp - 0x40]
mov dword [eax + 9], ecx
mov edx, 0x103d996
jmp 0x103d7c9
mov ecx, dword [ebp - 0x80]
shr ecx, 0x15
xor cl, byte [eax + 5]
mov edx, 0x103c658
and cl, 0xf
xor byte [eax + 5], cl
jmp 0x103d7c9
mov ecx, dword [ebp - 0x8c]
add edx, ecx
mov ecx, dword [eax + 0xd]
mov dword [eax + 5], edx
mov edx, dword [ebp - 0x7c]
and ecx, 0xffffff80
or ecx, esi
mov dword [eax + 9], edx
mov dword [eax + 0xd], ecx
mov edx, 0x103b000
sub edx, eax
sub edx, 5
mov byte [eax], 0xe8
mov dword [eax + 1], edx
mov ecx, dword [0x104c8e0]
xor esi, esi
cmp ecx, esi
je 0x103d831
mov eax, dword [ebp - 0x4c]
cmp eax, 0x1031000
jb 0x103d831
shl ecx, 0xc
add ecx, 0x1031000
cmp eax, ecx
ja 0x103d831
and eax, 0xfffff000
cmp eax, esi
je 0x103d831
cmp dword [ebp - 0x20], esi
je 0x103d81e
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x30]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x24], esi
je 0x103d831
push 0x104c8a0
mov dword [ebp - 0x24], esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub edi, dword [ebp - 0x50]
add edi, dword [ebp - 0x6c]
mov eax, edi
mov ecx, dword [ebp - 0xac]
mov edx, dword [ecx*4 + 0x104c8e8]
mov ecx, dword [ebp - 0x78]
mov dword [ecx + 4], edx
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x90]
pop edi
pop esi
xor ecx, ebp
mov dword [edx], eax
pop ebx
call fcn.0100d61a
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x9c]
jmp 0x103d1ec