Function at 0x106ed99
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
pushfd
push ebp
mov ebp, esp
sub esp, 0x94
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x80], ecx
lea eax, [ebp + 4]
sub eax, 4
mov dword [ebp - 0x88], edx
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x8c], esi
mov dword [ebp - 0x84], edi
mov ecx, dword [0x1116588]
mov ebx, 0xfffffff
mov dword [ebp - 0x6c], eax
add eax, 0xc
mov dword [ebp - 0x4c], eax
mov eax, dword [eax]
mov esi, dword [eax + 4]
mov dword [ebp - 0x28], eax
mov eax, dword [eax]
mov dword [ebp - 0x1c], ecx
and eax, ebx
xor edx, edx
lea ecx, [ecx + eax - 1]
mov eax, ecx
div dword [ebp - 0x1c]
mov eax, dword [0x1116588]
mov edi, 0x1000000
and esi, ebx
add esi, edi
sub ecx, edx
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x48], ecx
mov eax, dword [0x1011bb0]
mov dword [ebp - 0x44], eax
mov eax, dword [0x1116588]
mov eax, dword [0x1011bb0]
test eax, eax
je 0x106eec0
and dword [ebp - 0x14], 0
mov eax, dword [0x1011bb0]
dec eax
lea ecx, [eax + 1]
mov dword [ebp - 0x20], ecx
xor eax, eax
test ecx, ecx
je 0x106ee69
mov edx, dword [0x12d47a4]
shr dword [ebp - 0x20], 0x10
imul edx, edx, 0x343fd
add edx, 0x269ec3
mov dword [0x12d47a4], edx
shr edx, 0x10
shl eax, 0x10
or eax, edx
cmp dword [ebp - 0x20], 0
jne 0x106ee3f
xor edx, edx
div ecx
cmp dword [ebp - 0x44], 0
mov dword [ebp - 0x20], edx
jbe 0x106eeb2
mov eax, 0xcb65
lea edx, [edx*4 + 0x12d4c14]
inc dword [ebp - 0x14]
mov ecx, 0xffff349a
lock cmpxchg dword [edx], ecx
cmp eax, 0xcb65
je 0x106ef78
mov ecx, dword [0x1011bb0]
mov eax, dword [ebp - 0x20]
inc eax
xor edx, edx
div ecx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], edx
cmp eax, dword [ebp - 0x44]
jb 0x106ee76
and dword [ebp - 0x18], 0
cmp dword [ebp - 0x18], 0
jne 0x106ef46
call dword [sym.imp.KERNEL32.dll_GetLastError]
and dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], eax
inc dword [ebp - 0x20]
push 0x40
push 0x1000
push dword [ebp - 0x48]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x106ef8f
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x20], 0x11
jb 0x106eecd
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x18]
cmp dword [0x12ef80c], eax
ja 0x106ef0a
test al, 3
je 0x106ef22
test eax, eax
je 0x106ef1e
push 0x8000
push 0
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
and dword [ebp - 0x18], 0
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [ebp - 0x18], 0
je 0x106ee0f
mov ecx, dword [ebp - 0x48]
test ecx, ecx
mov eax, dword [ebp - 0x18]
je 0x106ef46
mov byte [eax], 0
inc eax
dec ecx
jne 0x106ef3f
mov eax, 0x4ece15fb
mov eax, dword [ebp - 0x4c]
add dword [eax], 8
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
and ecx, ebx
lea eax, [esi + ecx]
mov dword [ebp - 0x48], eax
mov eax, dword [0x1116588]
sub eax, ecx
lea edx, [eax + 1]
mov dword [ebp - 0x40], esi
sub dword [ebp - 0x40], edi
xor eax, eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x1c], edx
jmp 0x106efba
mov eax, dword [0x1116588]
imul eax, dword [ebp - 0x20]
lea eax, [eax + section..data]
mov dword [ebp - 0x18], eax
jmp 0x106eeb6
mov dword [ebp - 0x18], eax
jmp 0x106eefb
mov esi, dword [0x12d47a4]
imul esi, esi, 0x343fd
add esi, 0x269ec3
mov dword [0x12d47a4], esi
shr esi, 0x10
shl eax, 0x10
or eax, esi
shr edx, 0x10
test edx, edx
jne 0x106ef97
div dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
add eax, edx
push eax
push ecx
push dword [ebp - 0x40]
mov dword [ebp - 0x20], eax
mov eax, 0x7d45eeef
mov eax, dword [ebp - 0x48]
mov esi, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x74]
push eax
mov dword [ebp - 0x74], esi
mov byte [ebp - 0xd], 0
mov eax, 0xb6c44a1b
mov ecx, dword [0x11e47bc]
mov eax, dword [ebp - 0x70]
mov edx, 0xfffff000
and dword [ebp - 0x30], 0
and dword [ebp - 0x2c], 0
and eax, ebx
mov dword [ebp - 0x34], eax
and esi, ebx
mov eax, edi
add esi, edi
mov ebx, esi
add esp, 0x10
mov dword [ebp - 0x14], ebx
sub eax, ecx
mov dword [ebp - 0x38], eax
jne 0x106f0a3
and dword [ebp - 0x14], 0
cmp dword [ebp - 0x34], 0
jbe 0x106f312
mov edi, 0x12f7322a
mov ecx, 0x7fffffff
mov esi, 0xed08cdd6
mov edx, esi
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax + ebx]
sub eax, edi
add dword [ebp - 0x30], eax
add eax, dword [ebp - 0x2c]
mul edx
lea edx, [eax + edx*2 - 0x7fffffff]
sar eax, 0x1f
and eax, ecx
sub edx, eax
mov eax, edx
sar eax, 0x1f
and eax, ecx
add eax, edx
imul eax, eax, 0xed08cdd6
mov edx, esi
ror eax, 0xf
mul edx
lea edx, [eax + edx*2 - 0x7fffffff]
sar eax, 0x1f
and eax, ecx
sub edx, eax
mov eax, edx
sar eax, 0x1f
and eax, ecx
add eax, edx
add dword [ebp - 0x30], eax
inc dword [ebp - 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x34]
jb 0x106f03f
jmp 0x106f312
mov ecx, ebx
mov eax, dword [ebp - 0x34]
mov esi, dword [0x100003c]
add eax, ebx
mov dword [ebp - 0x24], eax
lea esi, [esi + 0x10000a0]
mov eax, dword [esi]
add eax, edi
mov esi, dword [esi + 4]
sub ecx, edi
mov edi, ecx
mov dword [ebp - 0x1c], esi
and edi, edx
mov esi, ecx
sub esi, edi
mov dword [ebp - 0x28], esi
mov esi, dword [ebp - 0x34]
add ecx, esi
mov esi, ecx
and esi, edx
mov edx, dword [ebp - 0x1c]
sub ecx, esi
mov dword [ebp - 0x60], ecx
add edx, eax
mov ecx, eax
mov dword [ebp - 0x64], esi
cmp eax, edx
mov dword [ebp - 0x5c], edx
jmp 0x106f0f8
cmp dword [ecx], edi
jae 0x106f0fd
add ecx, dword [ecx + 4]
cmp ecx, edx
mov dword [ebp - 0x58], ecx
jne 0x106f0ef
and dword [ebp - 0x54], 0
cmp ecx, edx
je 0x106f12e
cmp dword [ecx], edi
jne 0x106f12e
mov eax, dword [ecx + 4]
sub eax, 8
shr eax, 1
je 0x106f12e
add ecx, 8
movzx edx, word [ecx]
and edx, 0xfff
cmp edx, dword [ebp - 0x28]
jae 0x106f12e
inc dword [ebp - 0x54]
inc ecx
inc ecx
cmp dword [ebp - 0x54], eax
jne 0x106f116
mov ecx, 0x7fffffff
mov edi, 0x12f7322a
mov esi, 0xed08cdd6
mov edx, dword [ebp - 0x58]
jmp 0x106f145
mov ebx, dword [ebp - 0x14]
cmp edx, dword [ebp - 0x5c]
je 0x106f2a5
mov eax, dword [ebp - 0x64]
cmp dword [edx], eax
ja 0x106f2a5
mov edx, dword [edx + 4]
add edx, 0xfffffff8
shr edx, 1
cmp dword [ebp - 0x54], edx
mov edx, dword [ebp - 0x58]
jne 0x106f189
add edx, dword [edx + 4]
mov dword [ebp - 0x58], edx
cmp edx, dword [ebp - 0x5c]
je 0x106f2a5
mov eax, dword [ebp - 0x64]
cmp dword [edx], eax
ja 0x106f2a5
and dword [ebp - 0x54], 0
jmp 0x106f159
mov eax, dword [ebp - 0x64]
cmp dword [edx], eax
jne 0x106f1a6
mov eax, dword [ebp - 0x54]
movzx eax, word [edx + eax*2 + 8]
and eax, 0xfff
cmp eax, dword [ebp - 0x60]
jae 0x106f2a5
mov eax, dword [ebp - 0x54]
mov ebx, 0xf000
inc dword [ebp - 0x54]
test word [edx + eax*2 + 8], bx
je 0x106f142
movzx eax, word [edx + eax*2 + 8]
and eax, 0xfff
xor ebx, ebx
mov edx, dword [edx]
lea eax, [eax + edx + 0x1000000]
mov dword [ebp - 0x28], eax
sub eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
je 0x106f232
mov edx, esi
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax + ebx]
sub eax, edi
add dword [ebp - 0x30], eax
add eax, dword [ebp - 0x2c]
mul edx
lea edx, [eax + edx*2 - 0x7fffffff]
sar eax, 0x1f
and eax, ecx
sub edx, eax
mov eax, edx
sar eax, 0x1f
and eax, ecx
add eax, edx
imul eax, eax, 0xed08cdd6
mov edx, esi
ror eax, 0xf
mul edx
lea edx, [eax + edx*2 - 0x7fffffff]
sar eax, 0x1f
and eax, ecx
sub edx, eax
mov eax, edx
sar eax, 0x1f
and eax, ecx
add eax, edx
add dword [ebp - 0x30], eax
inc ebx
mov dword [ebp - 0x2c], eax
cmp ebx, dword [ebp - 0x1c]
jb 0x106f1d8
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
sub eax, dword [ebp - 0x38]
mov dword [ebp - 0x7c], eax
xor ebx, ebx
mov edx, esi
movzx eax, byte [ebp + ebx - 0x7c]
sub eax, edi
add dword [ebp - 0x30], eax
add eax, dword [ebp - 0x2c]
mul edx
lea edx, [eax + edx*2 - 0x7fffffff]
sar eax, 0x1f
and eax, ecx
sub edx, eax
mov eax, edx
sar eax, 0x1f
and eax, ecx
add eax, edx
imul eax, eax, 0xed08cdd6
ror eax, 0xf
mov edx, esi
mul edx
lea edx, [eax + edx*2 - 0x7fffffff]
sar eax, 0x1f
and eax, ecx
sub edx, eax
mov eax, edx
sar eax, 0x1f
and eax, ecx
add eax, edx
add dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
inc ebx
cmp ebx, 4
jb 0x106f23f
mov ebx, dword [ebp - 0x28]
add ebx, 4
mov dword [ebp - 0x14], ebx
jmp 0x106f13d
mov eax, dword [ebp - 0x24]
and dword [ebp - 0x14], 0
sub eax, ebx
mov dword [ebp - 0x1c], eax
je 0x106f312
mov edx, esi
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax + ebx]
sub eax, edi
add dword [ebp - 0x30], eax
add eax, dword [ebp - 0x2c]
mul edx
lea edx, [eax + edx*2 - 0x7fffffff]
sar eax, 0x1f
and eax, ecx
sub edx, eax
mov eax, edx
sar eax, 0x1f
and eax, ecx
add eax, edx
mov edx, esi
imul eax, eax, 0xed08cdd6
ror eax, 0xf
mul edx
lea edx, [eax + edx*2 - 0x7fffffff]
sar eax, 0x1f
and eax, ecx
sub edx, eax
mov eax, edx
sar eax, 0x1f
and eax, ecx
add eax, edx
add dword [ebp - 0x30], eax
inc dword [ebp - 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x1c]
jb 0x106f2b3
xor eax, eax
mov ecx, eax
and ecx, 7
mov cl, byte [ebp + ecx - 0x30]
mov byte [ebp + eax - 0xc], cl
inc eax
cmp eax, 8
jb 0x106f314
mov eax, 0xf958005f
mov esi, dword [ebp - 0x68]
mov eax, dword [ebp - 0x20]
mov ebx, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x44]
and eax, 7
mov dword [ebp - 0x38], eax
je 0x106f4f3
xor ecx, ecx
mov edi, dword [ebp - 0x40]
mov dword [ebp - 0x14], ecx
not edi
mov dword [ebp - 0x34], ecx
cmp eax, ecx
mov dword [ebp - 0x18], ecx
jle 0x106f38a
mov dword [ebp - 0x24], 0x38
cmp dword [ebp - 0x18], 4
movzx edx, byte [esi]
mov ecx, dword [ebp - 0x24]
jge 0x106f378
add ecx, 0xffffffe0
shl edx, cl
or dword [ebp - 0x34], edx
jmp 0x106f37d
shl edx, cl
or dword [ebp - 0x14], edx
sub dword [ebp - 0x24], 8
inc esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], eax
jl 0x106f362
mov eax, edi
movzx edx, bx
mov ecx, dword [ebp - 0xc]
xor ecx, edi
ror ecx, 1
imul edx, ecx
ror eax, 8
xor eax, edx
movzx edx, word [ebp - 0xa]
xor eax, dword [ebp - 0x40]
lea ecx, [ebx + eax]
mov ebx, eax
ror ecx, 0xc
imul edx, ecx
ror ebx, 0xa
movzx ecx, word [ebp - 6]
add ebx, edx
xor edi, ebx
mov ebx, edi
xor ecx, edi
movzx edx, word [ebp - 0xc]
rol ecx, 2
mov dword [ebp - 0x28], edx
imul edx, ecx
ror ebx, 0x10
mov ecx, dword [ebp - 0xc]
xor ebx, edx
xor eax, ebx
mov ebx, eax
movzx edx, word [ebp - 6]
xor ecx, eax
rol ecx, 8
imul edx, ecx
rol ebx, 6
add ebx, edx
movzx ecx, word [ebp - 0xa]
xor edi, ebx
mov edx, edi
mov ebx, ecx
movzx ecx, word [ebp - 8]
xor ebx, edi
imul ebx, ecx
ror edx, 6
add edx, ebx
xor eax, edx
movzx edx, word [ebp - 0xa]
mov ebx, eax
mov ecx, eax
sub ecx, dword [ebp - 8]
ror ecx, 5
imul edx, ecx
ror ebx, 0xb
xor ebx, edx
movzx edx, word [ebp - 8]
mov ecx, edx
xor edi, ebx
xor ecx, edi
imul ecx, dword [ebp - 0x28]
mov ebx, edi
shr ebx, 0xf
add ecx, ebx
xor eax, ecx
mov ebx, eax
movzx ecx, word [ebp - 6]
sub ebx, ecx
sub ebx, dword [ebp - 0xc]
xor edi, ebx
mov ebx, edi
mov ecx, edi
sub ecx, dword [ebp - 0xc]
ror ecx, 0xe
imul edx, ecx
rol ebx, 1
movzx ecx, word [ebp - 0xa]
add ebx, edx
xor eax, ebx
mov edx, eax
not edx
mov ebx, dword [ebp - 0x38]
ror edx, 0xd
add edx, ecx
movzx ecx, word [ebp - 8]
imul edx, ecx
movzx ecx, word [ebp - 6]
and dword [ebp - 0x18], 0
xor edi, edx
mov edx, edi
sub edx, ecx
rol edx, 4
mov ecx, dword [ebp - 0x28]
imul ecx, edx
mov edx, edi
xor edi, dword [ebp - 0x14]
shr edx, 0xc
xor ecx, edx
xor ecx, dword [ebp - 0x34]
xor eax, ecx
test ebx, ebx
mov dword [ebp - 0x24], eax
mov ecx, edi
jle 0x106f4c9
cmp dword [ebp - 0x18], 4
jge 0x106f4b0
rol dword [ebp - 0x24], 8
mov ebx, dword [ebp - 0x3c]
mov dl, byte [ebp - 0x24]
inc dword [ebp - 0x3c]
xor byte [ebp - 0xd], dl
mov byte [ebx], dl
jmp 0x106f4be
mov edx, dword [ebp - 0x3c]
inc dword [ebp - 0x3c]
rol ecx, 8
xor byte [ebp - 0xd], cl
mov byte [edx], cl
inc dword [ebp - 0x18]
mov ebx, dword [ebp - 0x38]
cmp dword [ebp - 0x18], ebx
jl 0x106f496
add ebx, 0xfffffffc
test ebx, ebx
jle 0x106f4e0
push 4
pop ecx
sub ecx, ebx
shl ecx, 3
shr edi, cl
shl edi, cl
mov edx, edi
jmp 0x106f502
xor edx, edx
test ebx, ebx
jge 0x106f502
neg ebx
shl ebx, 3
mov ecx, ebx
shr eax, cl
shl eax, cl
jmp 0x106f502
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x34], eax
not eax
mov dword [ebp - 0x14], eax
xor edx, edx
xor eax, eax
mov ebx, dword [ebp - 0x44]
shr ebx, 3
test ebx, ebx
jbe 0x106f6ce
movzx edi, word [ebp - 8]
movzx ecx, word [ebp - 0xa]
mov dword [ebp - 0x18], ecx
movzx ecx, word [ebp - 6]
mov dword [ebp - 0x28], ecx
neg dword [ebp - 0x28]
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x1c], ebx
jmp 0x106f530
mov edi, dword [ebp - 0x78]
movzx ecx, byte [esi + 1]
movzx ebx, byte [esi]
shl ebx, 8
or ecx, ebx
shl ecx, 8
movzx ebx, byte [esi + 2]
or ecx, ebx
movzx ebx, byte [esi + 3]
shl ecx, 8
or ecx, ebx
movzx ebx, byte [esi + 5]
mov dword [ebp - 0x24], ecx
movzx ecx, byte [esi + 4]
shl ecx, 8
or ecx, ebx
movzx ebx, byte [esi + 6]
shl ecx, 8
or ecx, ebx
movzx ebx, byte [esi + 7]
shl ecx, 8
or ecx, ebx
xor edx, ecx
mov dword [ebp - 0x50], ecx
mov ecx, dword [ebp - 0xc]
xor ecx, edx
add esi, 8
mov ebx, edx
ror ecx, 1
imul edi, ecx
mov ecx, dword [ebp - 8]
ror ebx, 8
xor ebx, edi
xor ebx, dword [ebp - 0x24]
xor eax, ebx
mov ebx, dword [ebp - 0x18]
add ecx, eax
mov edi, eax
ror ecx, 0xc
imul ebx, ecx
mov ecx, dword [ebp - 0x38]
ror edi, 0xa
add edi, ebx
xor edx, edi
mov ebx, edx
movzx edi, word [ebp - 0xc]
xor ecx, edx
rol ecx, 2
imul edi, ecx
mov ecx, dword [ebp - 0xc]
ror ebx, 0x10
xor ebx, edi
xor eax, ebx
mov ebx, dword [ebp - 0x38]
xor ecx, eax
rol ecx, 8
imul ebx, ecx
movzx ecx, word [ebp - 8]
mov edi, eax
rol edi, 6
add edi, ebx
mov ebx, dword [ebp - 0x18]
xor edx, edi
xor ebx, edx
imul ebx, ecx
mov edi, edx
ror edi, 6
add edi, ebx
mov ebx, dword [ebp - 0x18]
xor eax, edi
mov edi, eax
mov ecx, eax
sub ecx, dword [ebp - 8]
ror ecx, 5
imul ebx, ecx
movzx ecx, word [ebp - 0xc]
ror edi, 0xb
xor edi, ebx
xor edx, edi
movzx edi, word [ebp - 8]
mov ebx, edi
xor ebx, edx
imul ebx, ecx
mov ecx, edx
shr ecx, 0xf
add ebx, ecx
xor eax, ebx
mov ecx, eax
sub ecx, dword [ebp - 0x38]
sub ecx, dword [ebp - 0xc]
xor edx, ecx
mov ebx, edx
mov ecx, edx
sub ecx, dword [ebp - 0xc]
ror ecx, 0xe
imul edi, ecx
rol ebx, 1
movzx ecx, word [ebp - 8]
add ebx, edi
xor eax, ebx
mov edi, eax
not edi
ror edi, 0xd
add edi, dword [ebp - 0x18]
imul edi, ecx
xor edx, edi
mov dword [ebp - 0x78], ecx
movzx edi, word [ebp - 0xc]
mov ecx, dword [ebp - 0x28]
add ecx, edx
rol ecx, 4
imul edi, ecx
mov ecx, edx
xor edx, dword [ebp - 0x14]
shr ecx, 0xc
xor edi, ecx
mov cl, byte [ebp - 0xd]
xor edi, dword [ebp - 0x34]
xor eax, edi
xor cl, al
mov edi, dword [ebp - 0x3c]
xor cl, dl
mov byte [edi + 3], al
mov byte [edi + 7], dl
ror eax, 8
xor cl, al
mov byte [edi + 2], al
ror edx, 8
mov byte [edi + 6], dl
xor cl, dl
ror eax, 8
mov byte [edi + 1], al
xor cl, al
ror edx, 8
mov byte [edi + 5], dl
xor cl, dl
ror eax, 8
ror edx, 8
mov bl, dl
xor bl, al
xor cl, bl
mov byte [ebp - 0xd], cl
mov ecx, dword [ebp - 0x24]
mov byte [edi], al
mov byte [edi + 4], dl
add edi, 8
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x50]
dec dword [ebp - 0x1c]
ror eax, 8
ror edx, 8
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x3c], edi
jne 0x106f52d
movzx ecx, byte [ebp - 0xd]
mov eax, dword [ebp - 0x48]
movzx eax, byte [eax + 8]
sub ecx, eax
je 0x106f76b
call fcn.01244f80
mov ecx, dword [ebp - 0x4c]
mov esi, eax
mov edx, 0xffff
mov eax, 0xfffff000
and ecx, 0xfffffffc
mov edi, ecx
lea ecx, [edi + 0xfff]
and esi, eax
and ecx, eax
mov eax, dword [ebp - 0x6c]
mov dword [eax + 8], 0x10d8814
xor eax, eax
mov ebx, dword [0x12d47a4]
imul ebx, ebx, 0x343fd
add ebx, 0x269ec3
mov dword [0x12d47a4], ebx
shr ebx, 0x10
shl eax, 0x10
shr edx, 0x10
or eax, ebx
test edx, edx
jne 0x106f710
mov ebx, 0xffff
div ebx
mov eax, edi
inc edx
mov dword [ebp - 0x88], esi
cmp edi, ecx
mov dword [ebp - 0x80], edx
mov dword [ebp - 0x50], 0
jae 0x106f761
mov edx, dword [ebp - 0x50]
mov dword [eax], edx
add eax, 4
cmp eax, ecx
jb 0x106f755
mov eax, 0x10d8814
jmp 0x106f83c
mov edx, dword [0x11e47bc]
mov ecx, 0x1000000
mov eax, dword [ebp - 0x68]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
sub ecx, edx
mov dword [ebp - 0x4c], ecx
jne 0x106f78e
test eax, eax
je 0x106f82f
mov ecx, dword [0x11efd70]
mov eax, dword [ebp - 0x44]
mov esi, dword [ebp - 0x20]
sub esi, dword [ebp - 0x68]
mov ebx, dword [ebp - 0x40]
add eax, ebx
xor edi, edi
dec ecx
mov dword [ebp - 0x50], eax
js 0x106f7d1
lea eax, [edi + ecx]
cdq
sub eax, edx
sar eax, 1
mov edx, dword [eax*4 + 0x11efd74]
and edx, 0xfffffff
cmp ebx, edx
jae 0x106f7c8
lea ecx, [eax - 1]
jmp 0x106f7cd
jbe 0x106f7d5
lea edi, [eax + 1]
cmp ecx, edi
jge 0x106f7aa
mov ebx, edi
jmp 0x106f827
mov ebx, eax
jmp 0x106f827
mov eax, dword [ebx*4 + 0x11efd74]
mov ecx, eax
and ecx, 0xfffffff
cmp ecx, dword [ebp - 0x50]
jae 0x106f82f
lea edi, [ecx + esi + 0x1000000]
mov ecx, eax
shl ecx, 2
sar ecx, 0x1e
sar eax, 0x1e
and ecx, 3
and eax, 3
xor edx, edx
dec ecx
je 0x106f81a
dec ecx
je 0x106f815
dec ecx
jne 0x106f820
mov edx, dword [ebp - 0x4c]
jmp 0x106f820
mov edx, dword [ebp - 0x1c]
jmp 0x106f820
mov edx, dword [ebp - 0x4c]
sub edx, dword [ebp - 0x1c]
dec eax
dec eax
jne 0x106f826
add dword [edi], edx
inc ebx
cmp ebx, dword [0x11efd70]
jb 0x106f7d9
mov eax, dword [0x1116588]
mov eax, 0xfef90464
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x6c]
mov dword [ecx + 8], eax
mov ecx, dword [ebp - 0x80]
mov edx, dword [ebp - 0x88]
mov esi, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x94]
mov edi, dword [ebp - 0x84]
mov ebx, dword [ebp - 0x90]
mov esp, ebp
pop ebp
popfd
ret