Function at 0x1000c690
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100319a5
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x30
push esi
push edi
mov eax, dword [0x1004200c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], ecx
mov eax, dword [0x10047e9c]
mov edi, dword [eax]
mov eax, 0x4bc120
mov dword [ebp - 0x14], edi
call eax
mov edx, dword [0x10047ec4]
mov dword [edx + 4], eax
test eax, eax
je 0x100084ee
mov edx, 0x531d40
mov ecx, eax
call edx
mov esi, dword [0x10047ec4]
mov edx, eax
mov dword [ebp - 0x1c], edx
test esi, esi
je 0x1000765b
xorps xmm1, xmm1
test edx, edx
je 0x100075b0
mov ecx, dword [edx + 0xc8]
test ecx, ecx
je 0x100075b0
movss xmm0, dword [ecx + 0x354]
xor eax, eax
comiss xmm0, xmm1
cmova eax, ecx
mov dword [esi + 8], eax
mov ecx, dword [esi]
test ecx, ecx
je 0x1000765b
comiss xmm1, dword [ecx + 0x354]
mov eax, 0x4ff740
jb 0x100075e8
cmp dword [ecx + 0x244], 0x36
jne 0x100075e8
cmp byte [ecx + 0x504], 0
je 0x100075e8
call eax
mov esi, dword [0x10047ec4]
xorps xmm1, xmm1
mov edx, dword [ebp - 0x1c]
mov eax, dword [esi]
comiss xmm1, dword [eax + 0x354]
jb 0x1000765b
cmp dword [eax + 0x244], 0x37
jne 0x1000765b
cmp byte [eax + 0x160], 1
je 0x1000765b
mov byte [eax + 0x160], 1
mov eax, 0x4ff740
mov ecx, dword [esi]
call eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [0x10047ec4]
test eax, eax
je 0x10007642
mov edx, dword [ecx + 8]
test edx, edx
je 0x10007642
cmp edx, dword [ecx]
jne 0x10007642
or byte [ecx + 0x14], 4
mov dword [ecx + 8], 0
mov dword [eax + 0xc8], 0
call fcn.10016ab0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
test edx, edx
je 0x100084ee
test esi, esi
je 0x10007694
mov eax, dword [esi + 8]
test eax, eax
je 0x10007694
mov ecx, dword [esi]
test ecx, ecx
je 0x10007694
cmp eax, ecx
jne 0x10007694
mov ecx, dword [esi + 4]
mov eax, 0x531d40
call eax
mov esi, dword [0x10047ec4]
lea ecx, [edi + 0x3e8]
mov dword [eax + 0xc0], ecx
mov ecx, dword [ebp - 0x18]
mov eax, edi
mov edx, dword [ecx]
sub eax, dword [edx]
cmp eax, 0x1f4
jbe 0x10007adb
mov cl, byte [str._jok]
call fcn.10017c30
test al, al
je 0x10007ad8
mov dword [edx], edi
test esi, esi
je 0x100084ee
mov edi, dword [0x100428e0]
mov esi, dword [esi + 4]
push 0
push edi
mov dword [ebp - 0x20], edi
call dword [0x10047eac]
push 0
call dword [0x10047eb0]
mov eax, dword [0x10047eb4]
lea ecx, [edi + edi*4]
add esp, 0xc
cmp byte [eax + ecx*4 + 8], 1
je 0x100076fb
xor edi, edi
jmp 0x10007846
push 0x10042918
lea eax, [esi + 4]
push eax
lea eax, [ebp - 0x3c]
push eax
mov eax, 0x4dff20
call eax
push 0x648
mov eax, 0x50da60
call eax
mov edi, eax
add esp, 0x10
mov dword [ebp - 0x2c], edi
mov dword [ebp - 4], 0
test edi, edi
je 0x10007784
mov dword [edi + 0x194], 0
mov dword [edi + 0x198], 0
mov dword [edi + 0x1fc], 0
mov dword [edi + 0x200], 0
mov dword [edi + 0x238], 0
mov dword [edi + 0x23c], 0
mov byte [ebp - 4], 1
mov eax, 0x4eae00
push dword [ebp - 0x20]
mov ecx, edi
mov dword [edi], vtable.CCivilianPed.0
push 0x14
call eax
jmp 0x10007786
xor edi, edi
mov eax, 0x509df0
mov dword [ebp - 4], 0xffffffff
mov ecx, edi
call eax
mov eax, 0x521720
mov ecx, edi
call eax
mov eax, dword [edi + 0x3d8]
and byte [edi + 0x152], 0xfd
or byte [edi + 0x14e], 2
or byte [edi + 0x154], 2
mov byte [edi + 0x160], 2
mov byte [edi + 0x506], 0x64
mov byte [eax + 0x24], 0
mov eax, dword [edi + 0x3d8]
mov byte [eax + 0x25], 0x64
mov eax, dword [edi + 0x3d8]
mov byte [eax + 0x27], 0x64
mov dword [edi + 0x18c], 0
call fcn.10017210
and byte [edi + 0x157], 0xee
or byte [edi + 0x156], 0x10
xor eax, eax
movss dword [edi + 0x354], xmm0
mov dword [edi + 0x59c], 0
mov word [edi + 0x596], ax
mov dword [edi + 0x15c], 0xffffffbf
mov dword [edi + 0x190], eax
movss xmm1, dword [ebp - 0x38]
movss xmm2, dword [ebp - 0x34]
movss xmm0, dword [ebp - 0x3c]
movss dword [edi + 0x34], xmm0
movss dword [edi + 0x38], xmm1
movss dword [edi + 0x3c], xmm2
mov esi, dword [0x10047ec8]
mov al, byte [esi + 0xd4]
test al, 4
jne 0x10007865
or al, 4
mov dword [esi + 0x78], 0x1869f
mov byte [esi + 0xd4], al
mov ecx, dword [esi]
mov edx, dword [ecx + 8]
mov cl, al
test edx, edx
je 0x10007898
cmp edx, edi
je 0x10007898
movss xmm0, dword [edx + 0x354]
comiss xmm0, dword [0x1003c18c]
mov edx, dword [esi]
jbe 0x1000789a
or cl, 2
mov byte [esi + 0xd4], cl
mov eax, dword [edx + 8]
mov dword [esi + 0x10], eax
jmp 0x1000789a
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov eax, dword [eax + 0x5f4]
cmp dword [eax + 0x20], 2
jae 0x100078b2
test cl, 2
jne 0x100078b2
xor dl, dl
jmp 0x100078b4
mov dl, 1
push edi
mov ecx, esi
call fcn.10005de0
mov esi, dword [0x10047ec4]
add esp, 4
test edi, edi
je 0x10007976
mov eax, dword [edi]
mov ecx, edi
mov eax, dword [eax + 0x48]
call eax
mov ecx, dword [esi + 4]
mov eax, 0x531d40
call eax
mov ecx, dword [esi]
mov edx, eax
test ecx, ecx
je 0x10007949
cmp byte [ecx + 0x3ac], 0
jne 0x100084ee
movss xmm0, dword [ecx + 0x354]
comiss xmm0, dword [0x1003c18c]
jbe 0x1000791e
movss dword [edi + 0x354], xmm0
mov eax, dword [esi]
mov al, byte [eax + 0x506]
mov byte [edi + 0x506], al
mov ecx, dword [esi]
cmp dword [edx + 0xc8], ecx
jne 0x10007932
mov dword [edx + 0xc8], 0
mov ecx, dword [esi]
cmp dword [esi + 8], ecx
jne 0x1000793e
mov dword [esi + 8], 0
push ecx
mov eax, 0x53b160
call eax
add esp, 4
push edi
mov eax, 0x4db3f0
call eax
add esp, 4
mov eax, 0x511840
mov ecx, edi
call eax
mov dword [esi], edi
mov eax, dword [edi + 0x354]
mov edi, dword [ebp - 0x14]
mov dword [esi + 0x18], eax
mov dword [esi + 0xc], edi
mov esi, dword [0x10047ec4]
jmp 0x10007979
mov edi, dword [ebp - 0x14]
test esi, esi
je 0x100084ee
cmp dword [esi], 0
je 0x10007ad8
mov edi, dword [0x10047ec8]
test byte [edi + 0xd4], 2
je 0x10007ad5
mov eax, dword [edi]
mov eax, dword [eax + 8]
movss xmm0, dword [eax + 0x354]
comiss xmm0, dword [0x1003c18c]
jbe 0x10007ad5
cmp byte [eax + 0x3ac], 0
je 0x10007aac
mov ecx, dword [eax + 0x3a8]
test ecx, ecx
je 0x10007aac
cmp dword [ecx + 0x1a8], eax
je 0x100079ea
push eax
mov eax, 0x5b86d0
call eax
test al, al
je 0x10007aac
mov edx, dword [edi]
mov esi, dword [edx + 8]
mov ecx, dword [edx + 4]
mov eax, dword [esi + 0x3a8]
cmp eax, dword [ecx + 0x3a8]
jne 0x10007aae
mov eax, dword [edx]
mov dword [ebp - 0x1c], eax
movss xmm1, dword [eax + 0x34]
movss xmm2, dword [eax + 0x38]
subss xmm2, dword [esi + 0x38]
subss xmm1, dword [esi + 0x34]
movss xmm0, dword [eax + 0x3c]
subss xmm0, dword [esi + 0x3c]
mulss xmm2, xmm2
mulss xmm1, xmm1
mulss xmm0, xmm0
addss xmm2, xmm1
xorps xmm1, xmm1
addss xmm2, xmm0
cvtps2pd xmm0, xmm2
ucomisd xmm1, xmm0
ja 0x10007a4d
sqrtsd xmm0, xmm0
jmp 0x10007a52
call fcn.10031780
mov ecx, dword [ebp - 0x1c]
mov eax, 0x521f10
cvtsd2ss xmm0, xmm0
push esi
andps xmm0, xmmword [0x1003c200]
comiss xmm0, dword [0x1003c1bc]
jbe 0x10007a7c
push 0xc
call eax
mov ecx, dword [edi]
mov ecx, dword [ecx]
jmp 0x100084e2
push 0x2e
call eax
mov ecx, dword [edi]
mov eax, 0x522660
push 0x7fffffff
mov ecx, dword [ecx]
call eax
mov eax, dword [edi]
mov eax, dword [eax + 8]
mov dword [edi + 0x10], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
mov edx, dword [edi]
mov eax, dword [ebp - 0x14]
mov ecx, edi
mov edx, dword [edx + 8]
push eax
push 0
call fcn.10005ed0
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
mov edi, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
test esi, esi
je 0x100084ee
mov eax, dword [esi]
mov dword [ebp - 0x2c], eax
test eax, eax
je 0x100084ee
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0xc8]
mov dword [ebp - 0x28], eax
test eax, eax
je 0x10007c07
mov eax, dword [ecx]
mov ecx, 0x1003b2f8
mov dword [ebp - 0x1c], eax
mov eax, 0xa14000
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10007b33
test dl, dl
je 0x10007b2f
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10007b33
add eax, 2
add ecx, 2
test dl, dl
jne 0x10007b13
xor eax, eax
jmp 0x10007b38
sbb eax, eax
or eax, 1
test eax, eax
jne 0x10007c07
mov al, byte [0x10047ec0]
mov edx, 1
mov esi, dword [ebp - 0x1c]
test al, al
movzx ecx, al
cmove ecx, edx
mov byte [0x10047ec0], cl
cmp word [esi + 8], 0
jne 0x10007bd4
mov ecx, 0xa14004
call fcn.100183f0
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x20]
lea eax, [ebp - 0x30]
push eax
call fcn.10008800
mov dword [ebp - 0x3c], 2
mov esi, dword [eax]
lea eax, [ebp - 0x38]
push eax
push 0x40
push 2
push esi
mov dword [ebp - 0x40], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 0x34]
movzx ecx, word [esi]
mov dword [ebp - 0x24], ecx
test eax, eax
je 0x10007bc0
mov eax, dword [ebp - 0x38]
lea ecx, [ebp - 0x20]
push ecx
push eax
push dword [ebp - 0x3c]
mov dword [ebp - 0x20], eax
push dword [ebp - 0x40]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 0x24]
mov esi, dword [ebp - 0x1c]
mov word [esi + 8], cx
mov ecx, 0xa14006
call fcn.100182c0
mov byte [esi + 0xa], al
mov eax, dword [ebp - 0x28]
push ecx
cmp dword [ebp - 0x2c], eax
jne 0x10007be8
xor edx, edx
call fcn.10018250
xor dl, dl
jmp 0x10007bf4
mov dx, word [esi + 8]
call fcn.10018250
mov dl, byte [esi + 0xa]
mov ecx, 0xa14006
call fcn.100181e0
mov esi, dword [0x10047ec4]
add esp, 4
mov eax, dword [esi]
movss xmm0, dword [esi + 0x18]
movss xmm1, dword [eax + 0x354]
comiss xmm0, xmm1
jbe 0x10007c26
mov dword [esi + 0x10], edi
movss xmm1, dword [eax + 0x354]
mov edi, dword [0x10047ec8]
mov edx, 0x5b86d0
movss dword [esi + 0x18], xmm1
mov esi, dword [0x100428e8]
mov dword [ebp - 0x1c], edx
mov eax, dword [edi]
test byte [eax + 0x14], 1
jne 0x10007d0a
mov eax, dword [eax]
cmp byte [eax + 0x3ac], 0
je 0x10007c77
mov ecx, dword [eax + 0x3a8]
test ecx, ecx
je 0x10007c77
cmp dword [ecx + 0x1a8], eax
je 0x10007d0a
push eax
call edx
test al, al
jne 0x10007d0a
mov eax, dword [ebp - 0x14]
sub eax, dword [edi + 4]
cmp eax, esi
ja 0x10007d03
mov eax, dword [edi]
mov esi, dword [eax]
mov eax, dword [esi + 0x164]
sub eax, 8
je 0x10007c9e
sub eax, 1
je 0x10007c9e
sub eax, 0x29
jne 0x10007d0a
mov esi, dword [esi + 0x16c]
test esi, esi
je 0x10007cf6
mov al, byte [esi + 0x50]
and al, 7
cmp al, 3
jne 0x10007cf6
mov eax, 0x4f4930
mov ecx, esi
call eax
test al, al
je 0x10007cea
mov eax, dword [edi]
mov eax, dword [eax]
mov dword [eax + 0x164], 0
mov eax, dword [edi]
mov eax, dword [eax]
mov dword [eax + 0x16c], 0
mov eax, dword [edi]
mov eax, dword [eax]
mov dword [eax + 0x550], 0
jmp 0x10007d03
xorps xmm0, xmm0
comiss xmm0, dword [esi + 0x354]
jae 0x10007d03
mov eax, dword [edi]
mov eax, dword [eax]
cmp byte [eax + 0x14f], 0
jge 0x10007d0a
mov dword [edi + 0x10], 0
mov esi, dword [0x10047ec8]
call fcn.10023fa4
movzx eax, ax
movd xmm0, eax
mov eax, dword [esi]
cvtdq2ps xmm0, xmm0
mov eax, dword [eax]
mulss xmm0, dword [0x1003c190]
mov eax, dword [eax + 0x3d8]
mulss xmm0, dword [0x1003c1b4]
addss xmm0, dword [0x1003c19c]
movss dword [eax + 0x28], xmm0
call fcn.10023fa4
mov edi, dword [0x10047ec4]
movzx eax, ax
mov edx, dword [ebp - 0x14]
movd xmm0, eax
mov eax, dword [esi]
cvtdq2ps xmm0, xmm0
mov eax, dword [eax]
mulss xmm0, dword [0x1003c190]
mov eax, dword [eax + 0x3d8]
mulss xmm0, dword [0x1003c1a0]
addss xmm0, dword [0x1003c194]
movss dword [eax + 0x2c], xmm0
mov ecx, dword [edi]
test ecx, ecx
je 0x10007dbb
test byte [0x100428f4], 2
je 0x10007dbb
mov eax, edx
sub eax, dword [edi + 0xc]
cmp eax, 0x7530
jbe 0x10007dbb
dec byte [ecx + 0x506]
mov eax, dword [edi]
cmp byte [eax + 0x506], 0x3c
jae 0x10007db8
mov byte [eax + 0x506], 0x3c
mov dword [edi + 0xc], edx
mov esi, dword [0x10047ec8]
test byte [esi + 0xd4], 2
je 0x10007f3a
mov ecx, dword [esi]
mov eax, dword [ecx + 4]
movss xmm0, dword [eax + 0x354]
comiss xmm0, dword [0x1003c1cc]
jbe 0x10007ee2
mov eax, dword [ecx]
mov dword [eax + 0x3d4], 0x15
mov eax, dword [esi]
mov eax, dword [eax]
mov dword [eax + 0x184], 0
mov eax, dword [esi]
mov eax, dword [eax + 4]
cmp byte [eax + 0x3ac], 0
je 0x10007e43
mov ecx, dword [eax + 0x3a8]
test ecx, ecx
je 0x10007e43
cmp dword [ecx + 0x1a8], eax
je 0x10007e2a
push eax
call dword [ebp - 0x1c]
test al, al
je 0x10007e43
mov ecx, dword [esi]
mov eax, 0x521f10
push dword [ecx + 4]
mov ecx, dword [ecx]
push 0x2e
call eax
mov ecx, dword [esi]
mov ecx, dword [ecx]
jmp 0x100084e2
mov ecx, dword [esi]
mov eax, dword [esi + 0x10]
mov edi, dword [ecx + 4]
test eax, eax
je 0x10007e7a
xorps xmm0, xmm0
comiss xmm0, dword [eax + 0x354]
jb 0x100084ee
mov dword [esi + 0x10], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
test edi, edi
je 0x100084ee
mov ecx, dword [ecx]
mov eax, 0x50d360
push 0
push edi
call eax
test al, al
je 0x100084ee
mov ecx, dword [esi]
mov eax, dword [ecx]
cmp edi, eax
je 0x100084ee
movss xmm0, dword [edi + 0x354]
comiss xmm0, dword [0x1003c18c]
jbe 0x100084ee
cmp dword [eax + 0x164], 8
je 0x100084ee
mov eax, dword [ebp - 0x14]
mov dword [esi + 4], eax
mov eax, 0x521f10
push edi
mov dword [esi + 0x10], edi
mov ecx, dword [ecx]
push 8
call eax
mov ecx, dword [esi]
mov ecx, dword [ecx]
jmp 0x100084e2
mov dword [esi + 4], 0
mov dword [esi + 0x10], 0
mov eax, dword [ecx]
mov dword [eax + 0x164], 0
mov eax, dword [esi]
mov eax, dword [eax]
mov dword [eax + 0x16c], 0
mov eax, dword [esi]
mov eax, dword [eax]
mov dword [eax + 0x550], 0
mov eax, dword [esi]
and byte [esi + 0xd4], 0xfd
mov eax, dword [eax]
mov dword [eax + 0x3d4], 0x15
mov eax, dword [esi]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ecx + 0x184], eax
mov cl, byte [0x100428e5]
call fcn.10017c30
test al, al
je 0x10007f75
mov ecx, dword [ebp - 0x18]
mov eax, edx
mov ecx, dword [ecx]
sub eax, dword [ecx]
cmp eax, 0x1f4
jbe 0x10007f75
mov dword [ecx], edx
mov al, byte [esi + 0xd4]
mov cl, al
mov dword [esi + 8], edx
not cl
xor cl, al
and cl, 1
xor cl, al
mov byte [esi + 0xd4], cl
mov cl, byte [0x100428e6]
call fcn.10017c30
test al, al
je 0x10007fa7
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
mov eax, edx
sub eax, dword [ecx]
cmp eax, 0x1f4
jbe 0x10007fa7
mov dword [ecx], edx
test byte [esi + 0xd4], 2
jne 0x100084ee
or byte [edi + 0x14], 1
mov cl, byte [0x100428e7]
call fcn.10017c30
xorps xmm0, xmm0
test al, al
je 0x1000806c
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
mov eax, edx
sub eax, dword [ecx]
cmp eax, 0x1f4
jbe 0x1000806c
mov eax, dword [edi]
comiss xmm0, dword [eax + 0x354]
jb 0x1000806c
mov esi, dword [edi + 4]
movss xmm1, dword [esi + 0x34]
movss xmm2, dword [esi + 0x38]
subss xmm2, dword [eax + 0x38]
subss xmm1, dword [eax + 0x34]
movss xmm0, dword [esi + 0x3c]
subss xmm0, dword [eax + 0x3c]
mulss xmm2, xmm2
mulss xmm1, xmm1
mulss xmm0, xmm0
addss xmm2, xmm1
xorps xmm1, xmm1
addss xmm2, xmm0
cvtps2pd xmm0, xmm2
ucomisd xmm1, xmm0
ja 0x10008027
sqrtsd xmm0, xmm0
jmp 0x1000802c
call fcn.10031780
movss xmm1, dword [0x1003c1a8]
cvtsd2ss xmm0, xmm0
andps xmm0, xmmword [0x1003c200]
comiss xmm1, xmm0
xorps xmm0, xmm0
jbe 0x1000806c
cmp byte [esi + 0x3ac], 0
jne 0x1000806c
test byte [esi + 0x150], 0x10
mov esi, dword [ebp - 0x14]
je 0x1000806f
mov ecx, dword [ebp - 0x18]
mov eax, dword [ecx]
mov dword [eax], esi
mov dword [eax + 4], esi
or byte [edi + 0x14], 0x10
jmp 0x1000806f
mov esi, dword [ebp - 0x14]
mov ecx, dword [edi]
comiss xmm0, dword [ecx + 0x354]
jb 0x100081db
mov eax, dword [edi + 4]
movss xmm1, dword [eax + 0x34]
movss xmm2, dword [eax + 0x38]
subss xmm2, dword [ecx + 0x38]
subss xmm1, dword [ecx + 0x34]
movss xmm0, dword [eax + 0x3c]
subss xmm0, dword [ecx + 0x3c]
mulss xmm2, xmm2
mulss xmm1, xmm1
mulss xmm0, xmm0
addss xmm2, xmm1
xorps xmm1, xmm1
addss xmm2, xmm0
cvtps2pd xmm0, xmm2
ucomisd xmm1, xmm0
ja 0x100080c5
sqrtsd xmm0, xmm0
jmp 0x100080ca
call fcn.10031780
movss xmm1, dword [0x1003c1a8]
cvtsd2ss xmm0, xmm0
andps xmm0, xmmword [0x1003c200]
comiss xmm1, xmm0
jbe 0x100081db
mov eax, dword [edi + 4]
cmp byte [eax + 0x3ac], 0
jne 0x100081db
test byte [eax + 0x150], 0x10
je 0x100081db
mov dl, byte [edi + 0x14]
test dl, 0x10
je 0x100081df
mov eax, dword [ebp - 0x18]
mov ecx, esi
mov eax, dword [eax]
sub ecx, dword [eax + 4]
cmp ecx, 0xbb8
jbe 0x100081df
and dl, 0xef
mov byte [edi + 0x14], dl
call fcn.10017210
mov eax, dword [edi]
movss dword [eax + 0x354], xmm0
mov eax, dword [edi]
mov dword [eax + 0x244], 0
mov eax, dword [edi]
mov dword [eax + 0x248], 0
mov eax, 0x4fcf60
mov ecx, dword [edi]
call eax
mov eax, dword [edi]
push 2
or byte [eax + 0x51], 1
mov eax, 0x50d110
mov ecx, dword [edi]
call eax
mov ecx, dword [edi]
mov eax, 0x50ccf0
call eax
mov eax, dword [edi]
push 0x7d
and byte [eax + 0x14f], 0xef
mov eax, dword [edi]
and byte [eax + 0x156], 0xdf
mov eax, dword [edi]
mov dword [eax + 0x3f8], 0
mov eax, dword [edi]
and byte [eax + 0x158], 0xfb
mov eax, 0x5226b0
mov ecx, dword [edi]
call eax
mov eax, dword [edi]
mov dword [eax + 0x164], 0xc
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 0x16c], eax
mov eax, dword [edi]
mov dword [eax + 0x550], 0x7fffffff
mov eax, dword [edi]
mov edi, dword [0x10047ec4]
mov byte [eax + 0x160], 2
jmp 0x100081df
and byte [edi + 0x14], 0xef
mov eax, dword [edi]
mov edx, edi
mov dword [ebp - 0x18], edx
cmp byte [eax + 0x3ac], 0
je 0x10008211
mov ecx, dword [eax + 0x3a8]
test ecx, ecx
je 0x10008211
cmp dword [ecx + 0x1a8], eax
je 0x1000822a
push eax
call dword [ebp - 0x1c]
mov edx, edi
mov edi, dword [0x10047ec4]
test al, al
jne 0x10008228
mov eax, dword [edx]
mov dword [eax + 0x3d4], 0x15
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov dword [ecx + 0x184], eax
mov eax, dword [edx]
or byte [eax + 0x14e], 2
mov eax, dword [edx]
or byte [eax + 0x154], 2
mov eax, dword [edx]
mov eax, dword [eax + 0x3d8]
mov byte [eax + 0x24], 0
mov eax, dword [edx]
mov eax, dword [eax + 0x3d8]
mov byte [eax + 0x25], 0x64
mov eax, dword [edx]
mov eax, dword [eax + 0x3d8]
mov byte [eax + 0x27], 0x64
mov eax, dword [edx]
mov dword [eax + 0x18c], 0
mov eax, dword [edx]
mov dword [eax + 0x18c], 0
mov eax, 0x531d40
mov ecx, dword [edi + 4]
call eax
mov edx, dword [edi + 4]
mov dword [ebp - 0x2c], eax
cmp byte [edx + 0x3ac], 0
je 0x10008312
mov ecx, dword [edx + 0x3a8]
test ecx, ecx
je 0x10008312
cmp dword [ecx + 0x1a8], edx
je 0x100082ad
push edx
call dword [ebp - 0x1c]
test al, al
je 0x10008312
mov eax, dword [edi + 4]
mov edx, 0x5baa80
mov ecx, dword [eax + 0x3a8]
call edx
cmp eax, 1
je 0x10008312
mov eax, dword [ebp - 0x2c]
mov ecx, dword [edi]
cmp dword [eax + 0xc8], ecx
jne 0x10008312
call fcn.10017f60
test al, al
je 0x10008312
mov ecx, dword [edi + 4]
mov eax, 0x531d40
call eax
mov ecx, dword [ebp - 0x14]
mov esi, eax
add ecx, 0xbb8
mov dword [esi + 0xbc], ecx
call fcn.100171a0
mov dword [esi + 0xc4], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
mov al, byte [0x100428f4]
and al, 1
push esi
movzx eax, al
push eax
call fcn.10016860
test al, al
jne 0x100084ee
mov al, byte [0x100428f4]
and al, 1
push esi
movzx eax, al
push eax
call fcn.10016f10
test al, al
jne 0x100084ee
mov edx, dword [0x10047ec4]
xor esi, esi
mov dword [ebp - 0x18], edx
mov eax, dword [edx]
mov dword [eax + 0x3e4], 0
mov eax, dword [0x10047e94]
mov ecx, dword [eax]
mov dword [ebp - 0x1c], ecx
mov edi, dword [ecx + 8]
test edi, edi
jle 0x1000837b
mov eax, dword [ecx + 4]
nop
cmp byte [esi + eax], 0
jge 0x100083d5
inc esi
cmp esi, edi
jl 0x10008370
call fcn.10016d70
test al, al
jne 0x100084ee
mov eax, dword [ebp - 0x14]
push eax
call fcn.10006530
test al, al
jne 0x100084ee
mov esi, dword [0x10047ec4]
mov ecx, dword [esi]
mov edx, dword [ecx + 0x164]
mov eax, edx
sub eax, 8
je 0x100084cb
sub eax, 1
je 0x100084cb
sub eax, 0x29
je 0x100084cb
cmp edx, 0xc
je 0x100084ee
push dword [esi + 4]
jmp 0x100084d7
imul eax, esi, 0x5dc
add eax, dword [ecx]
mov dword [ebp - 0x2c], eax
je 0x10008472
mov ecx, dword [edx]
movss xmm1, dword [ecx + 0x34]
movss xmm2, dword [ecx + 0x38]
subss xmm2, dword [eax + 0x38]
subss xmm1, dword [eax + 0x34]
movss xmm0, dword [ecx + 0x3c]
subss xmm0, dword [eax + 0x3c]
mulss xmm2, xmm2
mulss xmm1, xmm1
mulss xmm0, xmm0
addss xmm2, xmm1
xorps xmm1, xmm1
addss xmm2, xmm0
cvtps2pd xmm0, xmm2
ucomisd xmm1, xmm0
ja 0x1000842c
sqrtsd xmm0, xmm0
jmp 0x10008431
call fcn.10031780
mov edx, dword [ebp - 0x18]
cvtsd2ss xmm0, xmm0
andps xmm0, xmmword [0x1003c200]
comiss xmm0, dword [0x1003c1c4]
ja 0x1000846f
mov eax, dword [ebp - 0x2c]
movss xmm0, dword [eax + 0x204]
comiss xmm0, dword [0x1003c1e4]
jae 0x1000846f
xorps xmm1, xmm1
comiss xmm1, xmm0
jae 0x1000846f
mov ecx, dword [edx]
cmp dword [ecx + 0x3e4], 0
je 0x1000849e
mov ecx, dword [ebp - 0x1c]
inc esi
cmp esi, edi
jge 0x1000837b
mov eax, dword [ecx + 4]
nop
cmp byte [eax + esi], 0
jge 0x10008490
inc esi
cmp esi, edi
jl 0x10008480
jmp 0x1000837b
cmp esi, 0xffffffff
jne 0x100083d5
jmp 0x1000837b
push 0x2710
push eax
mov eax, 0x4fb820
call eax
mov ecx, dword [ebp - 0x18]
mov eax, 0x4fb130
mov ecx, dword [ecx]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
mov eax, dword [esi + 4]
cmp dword [ecx + 0x16c], eax
jne 0x100084ee
push eax
push 0xc
mov eax, 0x521f10
call eax
mov ecx, dword [esi]
push 0x7fffffff
mov eax, 0x522660
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
add ecx, 4
jmp 0x10007510