The address we expects to access at that moment should be 0x0112fff0. Unfortunately, That address was null due that offset(0x7A50) from the address loaded at ebx is invalid in assembly loaded at this moment.  Offset should be 0x7050 from the address loaded at ebx in correct assembly.
On top of that, As a result that I make sure that these address on the heap will be related with this crash. They and their content  are fine, which are committed by proper size.
  0:000> r
eax=0108e7c8 ebx=0108e7c8 ecx=00000002 edx=01422ef0 esi=00000015 edi=00000000
eip=01418bcb esp=0012f42c ebp=00503818 iopl=0         nv up ei pl nz na po nc

cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=0021020201418bcb 817f08f4010000  cmp     dword ptr [edi+8],1F4h ds:0023:00000008=????????
the address was loaded assembly accessed
0:000> ?0108e7c8 +7A50
Evaluate expression: 17392152 = 01096218
0:000> dd 01096218 L1
01096218 00000000 <- this was null address
the address we expected to access.
0:000> ?0108e7c8 +7050
Evaluate expression: 17389592 = 01095818
0:000> dd 01095818 L1

01095818  0112ffe8

loaded assembly were quite different from cod file generated at the compile time and correct one I lived.
01418bb0 da8b5c240883    fimul   dword ptr [ebx-7CF7DBA4h]
01418bb6 bbd41f0000      mov     ebx,1FD4h
01418bbb 007506          add     byte ptr [ebp+6],dh
01418bbe 33c0            xor     eax,eax
01418bc0 dac2            fcmovb  st,st(2)
01418bc2 0400            add     al,0
01418bc4 57              push    edi
01418bc5 8bbb507a0000    mov     edi,dword ptr [ebx+7A50h] <- this offset(0x7A50) caused this crash

After applying !chimg extension to the above. it sounds good. here is 7 bytes from the bottom.

01418bc4 57              push    edi

01418bc5 8bbb50700000    mov     edi,dword ptr [ebx+7050h]