Function at 0x100c2d4
Capabilities:
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x1031ff4]
sub esp, 0x30
push edi
test eax, 0xffffffe0
jne 0x100c0fa
and dword [0x1031ff0], 0
and eax, 0x1f
or eax, 0x800
and eax, 0xffffffe0
mov dword [0x1031ff4], eax
mov edi, 0x1032000
mov eax, 0x1031ff0
push 0x40
or eax, 1
pop ecx
mov dword [0x1031ff8], edi
rep stosd dword es:[edi], eax
jmp 0x100c32b
push ebx
push esi
mov esi, dword [0x1031ff8]
mov edi, esi
mov dword [ebp - 0x1c], edi
mov ebx, 0x80000002
test edi, edi
je 0x100c132
mov ecx, dword [edi]
and ecx, ebx
cmp ecx, ebx
jne 0x100c12b
mov eax, dword [Sleep]
mov edi, dword [ebp - 0x1c]
mov esi, dword [0x1031ff8]
mov eax, dword [0x1031ff4]
mov ecx, dword [edi]
test cl, 1
je 0x100c14d
mov edx, eax
shr edx, 5
lea ecx, [edi + 4]
lea edx, [esi + edx*4]
jmp 0x100c147
test byte [ecx], 1
je 0x100c159
add ecx, 4
cmp ecx, edx
jb 0x100c13f
xor ecx, ecx
mov edi, ecx
test ecx, ecx
je 0x100c329
jmp 0x100c170
mov ecx, dword [ecx]
jmp 0x100c14d
mov esi, dword [0x1031ff8]
mov eax, dword [0x1031ff4]
mov edi, dword [ebp - 0xc]
mov ebx, 0x80000002
test edi, edi
je 0x100c1c0
or edx, 0xffffffff
mov ecx, eax
and ecx, 0x1f
shl edx, cl
mov ebx, eax
shr ebx, 5
mov dword [ebp - 0x14], edi
and edx, dword [edi + 4]
movzx ecx, dl
add ecx, 0xb15dcb
imul ecx, ecx, 0x25
mov dword [ebp - 4], edx
movzx edx, dh
add ecx, edx
movzx edx, byte [ebp - 2]
imul ecx, ecx, 0x25
add ecx, edx
movzx edx, byte [ebp - 1]
imul ecx, ecx, 0x25
add ecx, edx
mov edx, ecx
lea ecx, [ebx - 1]
and ecx, edx
lea ecx, [esi + ecx*4]
mov ebx, 0x80000002
jmp 0x100c1c5
mov ecx, esi
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], ecx
test edx, edx
je 0x100c1f9
mov ecx, dword [edx]
and ecx, ebx
cmp ecx, ebx
jne 0x100c1e7
mov eax, dword [Sleep]
mov esi, dword [0x1031ff8]
mov eax, dword [0x1031ff4]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx]
test cl, 1
jne 0x100c1f6
mov dword [ebp - 4], ecx
jmp 0x100c216
mov ecx, dword [ebp - 0x10]
mov edx, eax
add ecx, 4
shr edx, 5
lea edx, [esi + edx*4]
jmp 0x100c20e
test byte [ecx], 1
je 0x100c26d
add ecx, 4
cmp ecx, edx
jb 0x100c206
and dword [ebp - 4], 0
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
mov ecx, eax
and ecx, 0x1f
or edx, 0xffffffff
shl edx, cl
shr eax, 5
and edx, dword [edi + 4]
movzx ecx, dl
add ecx, 0xb15dcb
imul ecx, ecx, 0x25
mov dword [ebp - 8], edx
movzx edx, dh
add ecx, edx
movzx edx, byte [ebp - 6]
imul ecx, ecx, 0x25
add ecx, edx
movzx edx, byte [ebp - 5]
imul ecx, ecx, 0x25
add ecx, edx
dec eax
and eax, ecx
mov ecx, dword [edi]
and ecx, ebx
lea eax, [esi + eax*4]
mov dword [ebp - 0x28], eax
cmp ecx, ebx
jne 0x100c279
mov eax, dword [Sleep]
mov eax, dword [ebp - 0x28]
jmp 0x100c279
mov ecx, dword [ecx]
jmp 0x100c1f1
mov ecx, dword [eax]
cmp ecx, edi
je 0x100c2a4
mov eax, ecx
test byte [eax], 1
je 0x100c271
mov eax, dword [Sleep]
mov eax, dword [edi + 8]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
test eax, eax
je 0x100c2b2
push eax
push 0
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
push eax
call esi
and dword [edi + 8], 0
jmp 0x100c2b8
mov ecx, dword [edi]
mov dword [eax], ecx
dec dword [0x1031ff0]
or dword [edi], ebx
jmp 0x100c283
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [edi + 0xc]
test eax, eax
je 0x100c2cb
push eax
push 0
call ebx
push eax
call esi
and dword [edi + 0xc], 0
mov eax, dword [edi + 0x10]
test eax, eax
je 0x100c2de
push eax
push 0
call ebx
push eax
call esi
and dword [edi + 0x10], 0
mov eax, dword [edi + 0x14]
test eax, eax
je 0x100c2f1
push eax
push 0
call ebx
push eax
call esi
and dword [edi + 0x14], 0
mov eax, dword [edi + 0x18]
test eax, eax
je 0x100c304
push eax
push 0
call ebx
push eax
call esi
and dword [edi + 0x18], 0
mov eax, dword [edi + 0x1c]
test eax, eax
je 0x100c317
push eax
push 0
call ebx
push eax
call esi
and dword [edi + 0x1c], 0
push edi
push 0
call ebx
push eax
call esi
cmp dword [ebp - 4], 0
jne 0x100c15d
pop esi
pop ebx
pop edi
leave
ret