Function at 0x10006d00
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10021490
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x1002d018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, 0x29
xor eax, eax
mov dl, byte [eax + str.jBNMYlC_RYVFetVK_]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x24], dl
jns 0x10006d4f
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x11
jl 0x10006d32
mov byte [ebp - 0x13], 0
mov dword [ebp - 4], 0
mov eax, dword [0x10032c4c]
mov esi, dword [eax]
push str.__CB_L___YGHPAIPAUCB_X_DATA_CHEAT_BLOCKER___Z
push 0x10025284
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [esi + 0x24]
push eax
lea ecx, [ebp - 0x24]
push ecx
mov ecx, dword [0x10032c4c]
call edx
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov word [ebp - 0x14], ax
mov ecx, 0x49
mov dl, byte [eax + 0x10026f08]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x38], dl
jns 0x10006dc2
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x11
jl 0x10006da5
mov byte [ebp - 0x27], 0
mov dword [ebp - 4], 1
mov ecx, 0x6c
xor eax, eax
lea ebx, [ebx]
mov dl, byte [eax + 0x10026f1c]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x58], dl
jns 0x10006dfd
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x1e
jl 0x10006de0
mov byte [ebp - 0x3a], 0
mov byte [ebp - 4], 2
mov ecx, dword [0x10032c4c]
mov esi, dword [ecx]
mov eax, dword [esi + 0x40]
lea edx, [ebp - 0x38]
push edx
call eax
mov edx, dword [esi + 0x20]
push eax
push 4
push 0xbd
push 8
lea ecx, [ebp - 0x58]
push ecx
mov ecx, dword [0x10032c4c]
call edx
xor eax, eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov word [ebp - 0x3c], ax
mov byte [ebp - 0x3a], al
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov word [ebp - 0x28], ax
mov ecx, 0x87
jmp 0x10006e70
mov dl, byte [eax + 0x10026f3c]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x24], dl
jns 0x10006e8d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x11
jl 0x10006e70
mov byte [ebp - 0x13], 0
mov dword [ebp - 4], 3
mov ecx, 0xeb
xor eax, eax
mov dl, byte [eax + 0x10026f50]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x78], dl
jns 0x10006ec2
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x1e
jl 0x10006ea5
mov byte [ebp - 0x5a], 0
mov byte [ebp - 4], 4
mov ecx, dword [0x10032c4c]
mov esi, dword [ecx]
mov eax, dword [esi + 0x40]
lea edx, [ebp - 0x24]
push edx
call eax
mov edx, dword [esi + 0x20]
push eax
push 4
push 0xc6
push 8
lea ecx, [ebp - 0x78]
push ecx
mov ecx, dword [0x10032c4c]
call edx
xor eax, eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov word [ebp - 0x5c], ax
mov byte [ebp - 0x5a], al
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov word [ebp - 0x14], ax
mov ecx, 0x47
lea ecx, [ecx]
mov dl, byte [eax + 0x10026f70]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x38], dl
jns 0x10006f4d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x11
jl 0x10006f30
mov byte [ebp - 0x27], 0
mov dword [ebp - 4], 5
mov ecx, 0x5e
xor eax, eax
mov dl, byte [eax + 0x10026f84]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x58], dl
jns 0x10006f82
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x1e
jl 0x10006f65
mov byte [ebp - 0x3a], 0
mov byte [ebp - 4], 6
mov ecx, dword [0x10032c4c]
mov esi, dword [ecx]
mov eax, dword [esi + 0x40]
lea edx, [ebp - 0x38]
push edx
call eax
mov edx, dword [esi + 0x20]
push eax
push 4
push 0xce
push 8
lea ecx, [ebp - 0x58]
push ecx
mov ecx, dword [0x10032c4c]
call edx
xor eax, eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov word [ebp - 0x3c], ax
mov byte [ebp - 0x3a], al
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov word [ebp - 0x28], ax
mov ecx, 0x1f
lea ecx, [ecx]
mov dl, byte [eax + 0x10026fa4]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x24], dl
jns 0x1000700d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x11
jl 0x10006ff0
mov byte [ebp - 0x13], 0
mov dword [ebp - 4], 7
mov ecx, 0xc8
xor eax, eax
mov dl, byte [eax + 0x10026fb8]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x78], dl
jns 0x10007042
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x1e
jl 0x10007025
mov byte [ebp - 0x5a], 0
mov byte [ebp - 4], 8
mov ecx, dword [0x10032c4c]
mov esi, dword [ecx]
mov eax, dword [esi + 0x40]
lea edx, [ebp - 0x24]
push edx
call eax
mov edx, dword [esi + 0x20]
push eax
push 4
push 0xd8
push 8
lea ecx, [ebp - 0x78]
push ecx
mov ecx, dword [0x10032c4c]
call edx
xor eax, eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov word [ebp - 0x5c], ax
mov byte [ebp - 0x5a], al
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov word [ebp - 0x14], ax
mov ecx, 0xcb
lea ecx, [ecx]
mov dl, byte [eax + 0x10026fd8]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x38], dl
jns 0x100070cd
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x11
jl 0x100070b0
mov byte [ebp - 0x27], 0
mov dword [ebp - 4], 9
mov ecx, 0x38
xor eax, eax
mov dl, byte [eax + str.Q_ZH]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x58], dl
jns 0x10007102
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x1e
jl 0x100070e5
mov byte [ebp - 0x3a], 0
mov byte [ebp - 4], 0xa
mov ecx, dword [0x10032c4c]
mov esi, dword [ecx]
mov eax, dword [esi + 0x40]
lea edx, [ebp - 0x38]
push edx
call eax
mov edx, dword [esi + 0x20]
push eax
push 4
push 0xe2
push 8
lea ecx, [ebp - 0x58]
push ecx
mov ecx, dword [0x10032c4c]
call edx
xor eax, eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov word [ebp - 0x3c], ax
mov byte [ebp - 0x3a], al
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov word [ebp - 0x28], ax
mov ecx, 0x1c
lea ecx, [ecx]
mov dl, byte [eax + str._uTcNLGNCU]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x24], dl
jns 0x1000718d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x11
jl 0x10007170
mov byte [ebp - 0x13], 0
mov dword [ebp - 4], 0xb
mov ecx, 0x3b
xor eax, eax
mov dl, byte [eax + str.xTX_K]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x78], dl
jns 0x100071c2
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x1e
jl 0x100071a5
mov byte [ebp - 0x5a], 0
mov byte [ebp - 4], 0xc
mov ecx, dword [0x10032c4c]
mov esi, dword [ecx]
mov eax, dword [esi + 0x40]
lea edx, [ebp - 0x24]
push edx
call eax
mov edx, dword [esi + 0x20]
push eax
push 4
push 0xec
push 8
lea ecx, [ebp - 0x78]
push ecx
mov ecx, dword [0x10032c4c]
call edx
xor eax, eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov word [ebp - 0x5c], ax
mov byte [ebp - 0x5a], al
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov word [ebp - 0x14], ax
mov ecx, 0x36
lea ecx, [ecx]
mov dl, byte [eax + 0x10027040]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x38], dl
jns 0x1000724d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x11
jl 0x10007230
mov byte [ebp - 0x27], 0
mov dword [ebp - 4], 0xd
mov ecx, 0x9a
xor eax, eax
mov dl, byte [eax + 0x10027054]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x58], dl
jns 0x10007282
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x1e
jl 0x10007265
mov byte [ebp - 0x3a], 0
mov byte [ebp - 4], 0xe
mov ecx, dword [0x10032c4c]
mov esi, dword [ecx]
mov eax, dword [esi + 0x40]
lea edx, [ebp - 0x38]
push edx
call eax
mov edx, dword [esi + 0x20]
push eax
push 4
push 0xf6
push 8
lea ecx, [ebp - 0x58]
push ecx
mov ecx, dword [0x10032c4c]
call edx
xor eax, eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov word [ebp - 0x3c], ax
mov byte [ebp - 0x3a], al
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov word [ebp - 0x28], ax
mov ecx, 0xad
lea ecx, [ecx]
mov dl, byte [eax + 0x10027074]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x24], dl
jns 0x1000730d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x11
jl 0x100072f0
mov byte [ebp - 0x13], 0
mov dword [ebp - 4], 0xf
mov ecx, 0xf6
xor eax, eax
mov dl, byte [eax + 0x10027088]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x78], dl
jns 0x10007342
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x1e
jl 0x10007325
mov byte [ebp - 0x5a], 0
mov byte [ebp - 4], 0x10
mov ecx, dword [0x10032c4c]
mov esi, dword [ecx]
mov eax, dword [esi + 0x40]
lea edx, [ebp - 0x24]
push edx
call eax
mov edx, dword [esi + 0x20]
push eax
push 4
push 0x102
push 8
lea ecx, [ebp - 0x78]
push ecx
mov ecx, dword [0x10032c4c]
call edx
xor eax, eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov word [ebp - 0x5c], ax
mov byte [ebp - 0x5a], al
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov word [ebp - 0x14], ax
mov ecx, 0x30
lea ecx, [ecx]
mov dl, byte [eax + str.sYWR_wZX_R_I]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x38], dl
jns 0x100073cd
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x11
jl 0x100073b0
mov byte [ebp - 0x27], 0
mov dword [ebp - 4], 0x11
mov ecx, 0x40
xor eax, eax
mov dl, byte [eax + 0x100270bc]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x58], dl
jns 0x10007402
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x1e
jl 0x100073e5
mov byte [ebp - 0x3a], 0
mov byte [ebp - 4], 0x12
mov ecx, dword [0x10032c4c]
mov esi, dword [ecx]
mov eax, dword [esi + 0x40]
lea edx, [ebp - 0x38]
push edx
call eax
mov edx, dword [esi + 0x20]
push eax
push 4
push 0x10c
push 8
lea ecx, [ebp - 0x58]
push ecx
mov ecx, dword [0x10032c4c]
call edx
xor eax, eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov word [ebp - 0x3c], ax
mov byte [ebp - 0x3a], al
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov word [ebp - 0x28], ax
mov ecx, 0xe1
lea ecx, [ecx]
mov dl, byte [eax + 0x100270dc]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x24], dl
jns 0x1000748d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x11
jl 0x10007470
mov byte [ebp - 0x13], 0
mov dword [ebp - 4], 0x13
mov ecx, 0x22
xor eax, eax
mov dl, byte [eax + str.aKADReDFI_I_]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x78], dl
jns 0x100074c2
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x1f
jl 0x100074a5
mov byte [ebp - 0x59], 0
mov byte [ebp - 4], 0x14
mov ecx, dword [0x10032c4c]
mov esi, dword [ecx]
mov eax, dword [esi + 0x40]
lea edx, [ebp - 0x24]
push edx
call eax
mov edx, dword [esi + 0x20]
push eax
push 4
push 0x116
push 8
lea ecx, [ebp - 0x78]
push ecx
mov ecx, dword [0x10032c4c]
call edx
xor eax, eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov word [ebp - 0x14], ax
mov ecx, 0xe1
lea esp, [esp]
mov dl, byte [eax + 0x100270dc]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x38], dl
jns 0x1000754d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x11
jl 0x10007530
mov byte [ebp - 0x27], 0
mov dword [ebp - 4], 0x15
mov ecx, 0x29
xor eax, eax
mov dl, byte [eax + str.jBNMYlC_RYVFepBVZNRSS]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x58], dl
jns 0x10007582
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x1f
jl 0x10007565
mov byte [ebp - 0x39], 0
mov byte [ebp - 4], 0x16
mov ecx, dword [0x10032c4c]
mov esi, dword [ecx]
mov eax, dword [esi + 0x40]
lea edx, [ebp - 0x38]
push edx
call eax
mov edx, dword [esi + 0x20]
push eax
push 4
push 0x120
push 8
lea ecx, [ebp - 0x58]
push ecx
mov ecx, dword [0x10032c4c]
call edx
xor eax, eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov word [ebp - 0x28], ax
mov ecx, 0xe1
lea esp, [esp]
mov dl, byte [eax + 0x100270dc]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x24], dl
jns 0x1000760d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x11
jl 0x100075f0
mov byte [ebp - 0x13], 0
mov dword [ebp - 4], 0x17
mov ecx, 0x6c
xor eax, eax
mov dl, byte [eax + 0x10027130]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x78], dl
jns 0x10007642
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x1f
jl 0x10007625
mov byte [ebp - 0x59], 0
mov byte [ebp - 4], 0x18
mov ecx, dword [0x10032c4c]
mov esi, dword [ecx]
mov eax, dword [esi + 0x40]
lea edx, [ebp - 0x24]
push edx
call eax
mov edx, dword [esi + 0x20]
push eax
push 4
push 0x12a
push 8
lea ecx, [ebp - 0x78]
push ecx
mov ecx, dword [0x10032c4c]
call edx
xor eax, eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov word [ebp - 0x14], ax
mov ecx, 0xe1
lea esp, [esp]
mov dl, byte [eax + 0x100270dc]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x38], dl
jns 0x100076cd
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x11
jl 0x100076b0
mov byte [ebp - 0x27], 0
mov dword [ebp - 4], 0x19
mov ecx, 0x49
xor eax, eax
mov dl, byte [eax + str._n_._9_f_296]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x58], dl
jns 0x10007702
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x1f
jl 0x100076e5
mov byte [ebp - 0x39], 0
mov byte [ebp - 4], 0x1a
mov ecx, dword [0x10032c4c]
mov esi, dword [ecx]
mov eax, dword [esi + 0x40]
lea edx, [ebp - 0x38]
push edx
call eax
mov edx, dword [esi + 0x20]
push eax
push 4
push 0x134
push 8
lea ecx, [ebp - 0x58]
push ecx
mov ecx, dword [0x10032c4c]
call edx
xor eax, eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov word [ebp - 0x28], ax
mov ecx, 0xe1
lea esp, [esp]
mov dl, byte [eax + 0x100270dc]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x24], dl
jns 0x1000778d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x11
jl 0x10007770
mov byte [ebp - 0x13], 0
mov dword [ebp - 4], 0x1b
mov ecx, 0xeb
xor eax, eax
mov dl, byte [eax + 0x10027170]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x78], dl
jns 0x100077c2
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x1f
jl 0x100077a5
mov byte [ebp - 0x59], 0
mov byte [ebp - 4], 0x1c
mov ecx, dword [0x10032c4c]
mov esi, dword [ecx]
mov eax, dword [esi + 0x40]
lea edx, [ebp - 0x24]
push edx
call eax
mov edx, dword [esi + 0x20]
push eax
push 4
push 0x13e
push 8
lea ecx, [ebp - 0x78]
push ecx
mov ecx, dword [0x10032c4c]
call edx
xor eax, eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov word [ebp - 0x14], ax
mov ecx, 0xe1
lea esp, [esp]
mov dl, byte [eax + 0x100270dc]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x38], dl
jns 0x1000784d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x11
jl 0x10007830
mov byte [ebp - 0x27], 0
mov dword [ebp - 4], 0x1d
mov ecx, 0x87
xor eax, eax
mov dl, byte [eax + 0x10027190]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x58], dl
jns 0x10007882
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x1f
jl 0x10007865
mov byte [ebp - 0x39], 0
mov byte [ebp - 4], 0x1e
mov ecx, dword [0x10032c4c]
mov esi, dword [ecx]
mov eax, dword [esi + 0x40]
lea edx, [ebp - 0x38]
push edx
call eax
mov edx, dword [esi + 0x20]
push eax
push 4
push 0x146
push 8
lea ecx, [ebp - 0x58]
push ecx
mov ecx, dword [0x10032c4c]
call edx
xor eax, eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov word [ebp - 0x28], ax
mov ecx, 0xe1
lea esp, [esp]
mov dl, byte [eax + 0x100270dc]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x24], dl
jns 0x1000790d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x11
jl 0x100078f0
mov byte [ebp - 0x13], 0
mov dword [ebp - 4], 0x1f
mov ecx, 0x5e
xor eax, eax
mov dl, byte [eax + 0x100271b0]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x78], dl
jns 0x10007942
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x1f
jl 0x10007925
mov byte [ebp - 0x59], 0
mov byte [ebp - 4], 0x20
mov ecx, dword [0x10032c4c]
mov esi, dword [ecx]
mov eax, dword [esi + 0x40]
lea edx, [ebp - 0x24]
push edx
call eax
mov edx, dword [esi + 0x20]
push eax
push 4
push 0x150
push 8
lea ecx, [ebp - 0x78]
push ecx
mov ecx, dword [0x10032c4c]
call edx
xor eax, eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov word [ebp - 0x14], ax
mov ecx, 0xe1
lea esp, [esp]
mov dl, byte [eax + 0x100270dc]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x38], dl
jns 0x100079cd
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x11
jl 0x100079b0
mov byte [ebp - 0x27], 0
mov dword [ebp - 4], 0x21
mov ecx, 0x47
xor eax, eax
mov dl, byte [eax + 0x100271d0]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x58], dl
jns 0x10007a02
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x1f
jl 0x100079e5
mov byte [ebp - 0x39], 0
mov byte [ebp - 4], 0x22
mov ecx, dword [0x10032c4c]
mov esi, dword [ecx]
mov eax, dword [esi + 0x40]
lea edx, [ebp - 0x38]
push edx
call eax
mov edx, dword [esi + 0x20]
push eax
push 4
push 0x15a
push 8
lea ecx, [ebp - 0x58]
push ecx
mov ecx, dword [0x10032c4c]
call edx
xor eax, eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov word [ebp - 0x28], ax
mov ecx, 0xe1
lea esp, [esp]
mov dl, byte [eax + 0x100270dc]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x24], dl
jns 0x10007a8d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x11
jl 0x10007a70
mov byte [ebp - 0x13], 0
mov dword [ebp - 4], 0x23
mov ecx, 0xc8
xor eax, eax
mov dl, byte [eax + 0x100271f0]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x78], dl
jns 0x10007ac2
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x1f
jl 0x10007aa5
mov byte [ebp - 0x59], 0
mov byte [ebp - 4], 0x24
mov ecx, dword [0x10032c4c]
mov esi, dword [ecx]
mov eax, dword [esi + 0x40]
lea edx, [ebp - 0x24]
push edx
call eax
mov edx, dword [esi + 0x20]
push eax
push 4
push 0x166
push 8
lea ecx, [ebp - 0x78]
push ecx
mov ecx, dword [0x10032c4c]
call edx
xor eax, eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov word [ebp - 0x14], ax
mov ecx, 0xe1
lea esp, [esp]
mov dl, byte [eax + 0x100270dc]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x38], dl
jns 0x10007b4d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x11
jl 0x10007b30
mov byte [ebp - 0x27], 0
mov dword [ebp - 4], 0x25
mov ecx, 0x1f
xor eax, eax
mov dl, byte [eax + str.HDCWfIIDCLX]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x58], dl
jns 0x10007b82
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x1f
jl 0x10007b65
mov byte [ebp - 0x39], 0
mov byte [ebp - 4], 0x26
mov ecx, dword [0x10032c4c]
mov esi, dword [ecx]
mov eax, dword [esi + 0x40]
lea edx, [ebp - 0x38]
push edx
call eax
mov edx, dword [esi + 0x20]
push eax
push 4
push 0x170
push 8
lea ecx, [ebp - 0x58]
push ecx
mov ecx, dword [0x10032c4c]
call edx
xor eax, eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov word [ebp - 0x28], ax
mov ecx, 0xbf
lea esp, [esp]
mov dl, byte [eax + 0x10027234]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x78], dl
jns 0x10007c0d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x1e
jl 0x10007bf0
mov byte [ebp - 0x5a], 0
mov dword [ebp - 4], 0x27
mov ecx, dword [0x10032c4c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x40]
lea edx, [ebp - 0x78]
push edx
call eax
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [ebp - 0x7c]
push ecx
push 0x40
mov edi, eax
push 1
push edi
call esi
mov ebx, dword [sym.imp.MSVCR100.dll_memmove]
push 1
push 0x10027230
push edi
call ebx
mov eax, dword [ebp - 0x7c]
add esp, 0xc
lea edx, [ebp - 0x80]
push edx
push eax
push 1
push edi
call esi
push 0x10
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
xor eax, eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov word [ebp - 0x5c], ax
mov byte [ebp - 0x5a], al
mov eax, 0x9a
xor edi, edi
mov cl, byte [edi + 0x10027254]
xor cl, al
inc eax
and eax, 0x800000ff
mov byte [ebp + edi - 0x58], cl
jns 0x10007cb2
dec eax
or eax, 0xffffff00
inc eax
inc edi
cmp edi, 0x1f
jl 0x10007c97
mov byte [ebp - 0x39], 0
mov dword [ebp - 4], 0x28
mov ecx, dword [0x10032c4c]
mov edx, dword [ecx]
mov edx, dword [edx + 0x40]
lea eax, [ebp - 0x58]
push eax
call edx
mov edi, eax
lea eax, [ebp - 0x7c]
push eax
push 0x40
push 1
push edi
call esi
push 1
push 0x10027230
push edi
call ebx
mov edx, dword [ebp - 0x7c]
add esp, 0xc
lea ecx, [ebp - 0x80]
push ecx
push edx
push 1
push edi
call esi
push 0x10
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
xor eax, eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov eax, 0x36
xor edi, edi
lea esp, [esp]
mov cl, byte [edi + str.u__XNyPR_T_3l]
xor cl, al
inc eax
and eax, 0x800000ff
mov byte [ebp + edi - 0x78], cl
jns 0x10007d4b
dec eax
or eax, 0xffffff00
inc eax
inc edi
cmp edi, 0x1f
jl 0x10007d30
mov byte [ebp - 0x59], 0
mov dword [ebp - 4], 0x29
mov ecx, dword [0x10032c4c]
mov edx, dword [ecx]
mov edx, dword [edx + 0x40]
lea eax, [ebp - 0x78]
push eax
call edx
mov edi, eax
lea eax, [ebp - 0x7c]
push eax
push 0x40
push 1
push edi
call esi
push 1
push 0x10027230
push edi
call ebx
mov edx, dword [ebp - 0x7c]
add esp, 0xc
lea ecx, [ebp - 0x80]
push ecx
push edx
push 1
push edi
call esi
push 0x10
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
xor eax, eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov eax, 0xf6
xor edi, edi
mov cl, byte [edi + 0x10027294]
xor cl, al
inc eax
and eax, 0x800000ff
mov byte [ebp + edi - 0x58], cl
jns 0x10007de0
dec eax
or eax, 0xffffff00
inc eax
inc edi
cmp edi, 0x1f
jl 0x10007dc5
mov byte [ebp - 0x39], 0
mov dword [ebp - 4], 0x2a
mov ecx, dword [0x10032c4c]
mov edx, dword [ecx]
mov edx, dword [edx + 0x40]
lea eax, [ebp - 0x58]
push eax
call edx
mov edi, eax
lea eax, [ebp - 0x7c]
push eax
push 0x40
push 1
push edi
call esi
push 1
push 0x10027230
push edi
call ebx
mov edx, dword [ebp - 0x7c]
add esp, 0xc
lea ecx, [ebp - 0x80]
push ecx
push edx
push 1
push edi
call esi
push 0x10
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
xor eax, eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov eax, 0xad
xor edi, edi
lea ebx, [ebx]
mov cl, byte [edi + 0x100272b4]
xor cl, al
inc eax
and eax, 0x800000ff
mov byte [ebp + edi - 0x78], cl
jns 0x10007e7b
dec eax
or eax, 0xffffff00
inc eax
inc edi
cmp edi, 0x1f
jl 0x10007e60
mov byte [ebp - 0x59], 0
mov dword [ebp - 4], 0x2b
mov ecx, dword [0x10032c4c]
mov edx, dword [ecx]
mov edx, dword [edx + 0x40]
lea eax, [ebp - 0x78]
push eax
call edx
mov edi, eax
lea eax, [ebp - 0x7c]
push eax
push 0x40
push 1
push edi
call esi
push 1
push 0x10027230
push edi
call ebx
mov edx, dword [ebp - 0x7c]
add esp, 0xc
lea ecx, [ebp - 0x80]
push ecx
push edx
push 1
push edi
call esi
push 0x10
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001fd05
mov esp, ebp
pop ebp
ret