Function at 0x100d3350
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10189209
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x101c6444]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x18], esi
mov dword [esi], 0x10199ac0
mov dword [esi + 4], 0x10199a00
mov dword [esi + 8], 0x10199950
mov dword [esi + 0xc], 0x1019994c
mov dword [esi + 0x10], 0x10199948
mov dword [esi + 0x14], 0x10199924
mov dword [esi + 0x18], 0x10199920
mov edi, dword [esi + 0x5a18]
xor ebx, ebx
cmp edi, ebx
mov dword [esp + 0x30], 0x5b
je 0x100d33d7
mov ecx, edi
call fcn.100e00a0
push edi
call fcn.10157f3b
add esp, 4
mov ecx, dword [esi + 0x4ca0]
cmp ecx, ebx
je 0x100d33e9
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
call fcn.10001960
lea ecx, [esi + 0x5a00]
call fcn.100c66c0
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea eax, [esi + 0x59dc]
push eax
mov dword [esi + 0x59d8], 0x101975e4
call ebp
lea edi, [esi + 0x59cc]
mov dword [esi + 0x59d8], 0x101975e0
mov eax, dword [edi + 4]
mov ecx, dword [eax]
push eax
push edi
push ecx
push edi
lea ecx, [esp + 0x2c]
push ecx
mov ecx, edi
mov byte [esp + 0x44], 0x58
call fcn.1000b9d0
mov eax, dword [edi + 4]
push eax
call fcn.10157f3b
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov eax, dword [esi + 0x59ac]
mov ecx, dword [eax]
add esp, 4
lea edi, [esi + 0x59a8]
push eax
push edi
push ecx
push edi
lea edx, [esp + 0x2c]
push edx
mov ecx, edi
mov byte [esp + 0x44], 0x57
call fcn.1000b9d0
mov eax, dword [edi + 4]
push eax
call fcn.10157f3b
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov eax, dword [esi + 0x5938]
mov ecx, dword [eax]
add esp, 4
lea edi, [esi + 0x5934]
push eax
push edi
push ecx
push edi
lea eax, [esp + 0x2c]
push eax
mov ecx, edi
mov byte [esp + 0x44], 0x56
call fcn.100570c0
mov eax, dword [edi + 4]
push eax
call fcn.10157f3b
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov eax, dword [esi + 0x592c]
mov ecx, dword [eax]
add esp, 4
lea edi, [esi + 0x5928]
push eax
push edi
push ecx
push edi
lea ecx, [esp + 0x2c]
push ecx
mov ecx, edi
mov byte [esp + 0x44], 0x55
call fcn.1000b9d0
mov eax, dword [edi + 4]
push eax
call fcn.10157f3b
add esp, 4
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov eax, dword [esi + 0x5920]
mov ecx, dword [eax]
lea edi, [esi + 0x591c]
push eax
push edi
push ecx
push edi
lea edx, [esp + 0x2c]
push edx
mov ecx, edi
mov byte [esp + 0x44], 0x54
call fcn.1000b9d0
mov eax, dword [edi + 4]
push eax
call fcn.10157f3b
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov eax, dword [esi + 0x5914]
mov ecx, dword [eax]
add esp, 4
lea edi, [esi + 0x5910]
push eax
push edi
push ecx
push edi
lea eax, [esp + 0x2c]
push eax
mov ecx, edi
mov byte [esp + 0x44], 0x53
call fcn.1000b9d0
mov eax, dword [edi + 4]
push eax
call fcn.10157f3b
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov eax, dword [esi + 0x5908]
mov ecx, dword [eax]
add esp, 4
lea edi, [esi + 0x5904]
push eax
push edi
push ecx
push edi
lea ecx, [esp + 0x2c]
push ecx
mov ecx, edi
mov byte [esp + 0x44], 0x52
call fcn.10060510
mov eax, dword [edi + 4]
push eax
call fcn.10157f3b
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov eax, dword [esi + 0x58fc]
mov ecx, dword [eax]
add esp, 4
lea edi, [esi + 0x58f8]
push eax
push edi
push ecx
push edi
lea edx, [esp + 0x2c]
push edx
mov ecx, edi
mov byte [esp + 0x44], 0x51
call fcn.1000b9d0
mov eax, dword [edi + 4]
push eax
call fcn.10157f3b
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov eax, dword [esi + 0x58ec]
lea edi, [esi + 0x58e8]
add esp, 4
cmp eax, ebx
je 0x100d35ed
mov edx, dword [esp + 0x18]
mov ecx, dword [edi + 8]
push edx
push edi
push ecx
push eax
call fcn.100b2ad0
mov eax, dword [edi + 4]
push eax
call fcn.10157f3b
add esp, 0x14
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov eax, dword [esi + 0x58e0]
mov ecx, dword [eax]
lea edi, [esi + 0x58dc]
push eax
push edi
push ecx
push edi
lea eax, [esp + 0x2c]
push eax
mov ecx, edi
mov byte [esp + 0x44], 0x4f
call fcn.100254f0
mov eax, dword [edi + 4]
push eax
call fcn.10157f3b
add esp, 4
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
cmp dword [esi + 0x58d8], 0x10
jb 0x100d3643
mov eax, dword [esi + 0x58c4]
push eax
call fcn.10157f3b
add esp, 4
mov edi, 0xf
mov dword [esi + 0x58d8], edi
mov dword [esi + 0x58d4], ebx
mov byte [esi + 0x58c4], bl
cmp dword [esi + 0x58bc], 0x10
jb 0x100d3672
mov eax, dword [esi + 0x58a8]
push eax
call fcn.10157f3b
add esp, 4
mov dword [esi + 0x58bc], edi
mov dword [esi + 0x58b8], ebx
mov byte [esi + 0x58a8], bl
cmp dword [esi + 0x58a0], 0x10
jb 0x100d369c
mov eax, dword [esi + 0x588c]
push eax
call fcn.10157f3b
add esp, 4
mov dword [esi + 0x58a0], edi
mov dword [esi + 0x589c], ebx
mov byte [esi + 0x588c], bl
cmp dword [esi + 0x5884], 0x10
jb 0x100d36c6
mov eax, dword [esi + 0x5870]
push eax
call fcn.10157f3b
add esp, 4
mov dword [esi + 0x5884], edi
mov dword [esi + 0x5880], ebx
lea edi, [esi + 0x5860]
mov byte [esi + 0x5870], bl
mov eax, dword [edi + 4]
mov ecx, dword [eax]
push eax
push edi
push ecx
push edi
lea ecx, [esp + 0x2c]
push ecx
mov ecx, edi
mov byte [esp + 0x44], 0x4a
call fcn.1000bf50
mov eax, dword [edi + 4]
push eax
call fcn.10157f3b
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov eax, dword [esi + 0x584c]
mov ecx, dword [eax]
add esp, 4
lea edi, [esi + 0x5848]
push eax
push edi
push ecx
push edi
lea edx, [esp + 0x2c]
push edx
mov ecx, edi
mov byte [esp + 0x44], 0x49
call fcn.1002def0
mov eax, dword [edi + 4]
push eax
call fcn.10157f3b
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov eax, dword [esi + 0x5830]
lea edi, [esi + 0x582c]
add esp, 4
cmp eax, ebx
je 0x100d376b
mov edx, dword [esp + 0x18]
mov ecx, dword [edi + 8]
push edx
push edi
push ecx
push eax
call fcn.1002d100
mov eax, dword [edi + 4]
push eax
call fcn.10157f3b
add esp, 0x14
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov eax, dword [esi + 0x5820]
cmp eax, ebx
lea edi, [esi + 0x581c]
je 0x100d37a0
mov edx, dword [esp + 0x18]
mov ecx, dword [edi + 8]
push edx
push edi
push ecx
push eax
call fcn.1002d100
mov eax, dword [edi + 4]
push eax
call fcn.10157f3b
add esp, 0x14
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov eax, dword [esi + 0x5810]
cmp eax, ebx
lea edi, [esi + 0x580c]
je 0x100d37d5
mov edx, dword [esp + 0x18]
mov ecx, dword [edi + 8]
push edx
push edi
push ecx
push eax
call fcn.1002d100
mov eax, dword [edi + 4]
push eax
call fcn.10157f3b
add esp, 0x14
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov eax, dword [esi + 0x57f8]
mov ecx, dword [eax]
lea edi, [esi + 0x57f4]
push eax
push edi
push ecx
push edi
lea eax, [esp + 0x2c]
push eax
mov ecx, edi
mov byte [esp + 0x44], 0x45
call fcn.1000bf50
mov eax, dword [edi + 4]
push eax
call fcn.10157f3b
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov eax, dword [esi + 0x57d8]
mov ecx, dword [eax]
add esp, 4
lea edi, [esi + 0x57d4]
push eax
push edi
push ecx
push edi
lea ecx, [esp + 0x2c]
push ecx
mov ecx, edi
mov byte [esp + 0x44], 0x44
call fcn.100c3040
mov eax, dword [edi + 4]
push eax
call fcn.10157f3b
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
lea edi, [esi + 0x5760]
add esp, 4
lea edx, [edi + 0x4c]
push edx
mov dword [edi + 0x48], 0x101975e4
call ebp
mov ecx, edi
mov dword [edi + 0x48], 0x101975e0
call fcn.100376d0
lea edi, [esi + 0x56f8]
lea eax, [edi + 0x4c]
push eax
mov dword [edi + 0x48], 0x101975e4
call ebp
mov ecx, edi
mov dword [edi + 0x48], 0x101975e0
call fcn.100376d0
lea ecx, [esi + 0x56bc]
mov byte [esp + 0x30], 0x41
call fcn.1013d5cc
lea ecx, [esi + 0x5578]
mov byte [esp + 0x30], 0x40
call fcn.100e3550
lea ecx, [esi + 0x5550]
mov byte [esp + 0x30], 0x3f
call fcn.101025c4
mov eax, dword [esi + 0x5540]
mov ecx, dword [eax]
lea edi, [esi + 0x553c]
push eax
push edi
push ecx
push edi
lea ecx, [esp + 0x2c]
push ecx
mov ecx, edi
mov byte [esp + 0x44], 0x3e
call fcn.100dfce0
mov eax, dword [edi + 4]
push eax
call fcn.10157f3b
add esp, 4
mov dword [edi + 4], ebx
lea ecx, [esi + 0x5508]
mov dword [edi + 8], ebx
mov byte [esp + 0x30], 0x3d
call fcn.10043700
mov eax, dword [esi + 0x54f8]
mov ecx, dword [eax]
lea edi, [esi + 0x54f4]
push eax
push edi
push ecx
push edi
lea edx, [esp + 0x2c]
push edx
mov ecx, edi
mov byte [esp + 0x44], 0x3c
call fcn.100b8b00
mov eax, dword [edi + 4]
push eax
call fcn.10157f3b
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov eax, dword [esi + 0x54ec]
mov ecx, dword [eax]
add esp, 4
lea edi, [esi + 0x54e8]
push eax
push edi
push ecx
push edi
lea eax, [esp + 0x2c]
push eax
mov ecx, edi
mov byte [esp + 0x44], 0x3b
call fcn.100cfd60
mov eax, dword [edi + 4]
push eax
call fcn.10157f3b
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov eax, dword [esi + 0x54e0]
mov ecx, dword [eax]
add esp, 4
lea edi, [esi + 0x54dc]
push eax
push edi
push ecx
push edi
lea ecx, [esp + 0x2c]
push ecx
mov ecx, edi
mov byte [esp + 0x44], 0x3a
call fcn.100c84b0
mov eax, dword [edi + 4]
push eax
call fcn.10157f3b
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
add esp, 4
lea edx, [esi + 0x54c4]
mov edi, 0x101975e4
push edx
mov dword [esi + 0x54c0], edi
call ebp
mov dword [esi + 0x54c0], 0x101975e0
cmp dword [esi + 0x54b4], 0x10
jb 0x100d39d4
mov eax, dword [esi + 0x54a0]
push eax
call fcn.10157f3b
add esp, 4
mov dword [esi + 0x54b4], 0xf
mov dword [esi + 0x54b0], ebx
mov byte [esi + 0x54a0], bl
mov eax, dword [esi + 0x5474]
cmp eax, ebx
je 0x100d39fd
push eax
call fcn.10157f3b
add esp, 4
lea eax, [esi + 0x5458]
mov dword [esi + 0x5474], ebx
mov dword [esi + 0x5478], ebx
mov dword [esi + 0x547c], ebx
push eax
mov dword [esi + 0x5454], edi
call ebp
mov dword [esi + 0x5454], 0x101975e0
mov eax, dword [esi + 0x5448]
cmp eax, ebx
je 0x100d3a3b
push eax
call fcn.10157f3b
add esp, 4
lea ecx, [esi + 0x542c]
mov dword [esi + 0x5448], ebx
mov dword [esi + 0x544c], ebx
mov dword [esi + 0x5450], ebx
push ecx
mov dword [esi + 0x5428], edi
call ebp
lea ecx, [esi + 0x53e8]
mov dword [esi + 0x5428], 0x101975e0
mov byte [esp + 0x30], 0x33
call fcn.100ded20
cmp dword [esi + 0x53d8], 0x10
jb 0x100d3a8e
mov eax, dword [esi + 0x53c4]
push eax
call fcn.10157f3b
add esp, 4
mov dword [esi + 0x53d8], 0xf
mov dword [esi + 0x53d4], ebx
mov byte [esi + 0x53c4], bl
mov eax, dword [esi + 0x53b4]
cmp eax, ebx
je 0x100d3ab7
push eax
call fcn.10157f3b
add esp, 4
lea ecx, [esi + 0x5380]
mov dword [esi + 0x53b4], ebx
mov dword [esi + 0x53b8], ebx
mov dword [esi + 0x53bc], ebx
mov byte [esp + 0x30], 0x30
call fcn.100a8080
mov eax, dword [esi + 0x5374]
cmp eax, ebx
je 0x100d3aec
push eax
call fcn.10157f3b
add esp, 4
lea ecx, [esi + 0x5344]
mov dword [esi + 0x5374], ebx
mov dword [esi + 0x5378], ebx
mov dword [esi + 0x537c], ebx
mov byte [esp + 0x30], 0x2e
call fcn.100b90c0
lea edx, [esi + 0x532c]
push edx
mov dword [esi + 0x5328], edi
call ebp
lea eax, [esi + 0x530c]
mov dword [esi + 0x5328], 0x101975e0
push eax
mov dword [esi + 0x5308], edi
call ebp
lea edi, [esi + 0x52fc]
mov dword [esi + 0x5308], 0x101975e0
mov eax, dword [edi + 4]
mov ecx, dword [eax]
push eax
push edi
push ecx
push edi
lea ecx, [esp + 0x2c]
push ecx
mov ecx, edi
mov byte [esp + 0x44], 0x2b
call fcn.100b8a30
mov eax, dword [edi + 4]
push eax
call fcn.10157f3b
add esp, 4
lea ecx, [esi + 0x52f8]
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov byte [esp + 0x30], 0x2a
call fcn.100e2570
lea ecx, [esi + 0x5260]
mov byte [esp + 0x30], 0x29
call fcn.1002e8a0
lea ecx, [esi + 0x5234]
mov byte [esp + 0x30], 0x28
call fcn.100a7e80
lea edx, [esi + 0x5214]
mov edi, 0x101975e4
push edx
mov dword [esi + 0x5210], edi
call ebp
lea ecx, [esi + 0x51ec]
mov dword [esi + 0x5210], 0x101975e0
call fcn.100bd010
lea ecx, [esi + 0x5198]
call fcn.100c13c0
lea eax, [esi + 0x5174]
push eax
mov dword [esi + 0x5170], edi
call ebp
mov dword [esi + 0x5170], 0x101975e0
mov eax, dword [esi + 0x5150]
cmp eax, ebx
je 0x100d3c02
push eax
call fcn.10157f3b
add esp, 4
lea ecx, [esi + 0x50f8]
mov dword [esi + 0x5150], ebx
mov dword [esi + 0x5154], ebx
mov dword [esi + 0x5158], ebx
mov byte [esp + 0x30], 0x24
call fcn.100d32f0
lea ecx, [esi + 0x50a8]
call fcn.100c1360
lea ecx, [esi + 0x5058]
call fcn.100d0150
lea ecx, [esi + 0x5010]
call fcn.100c5e30
lea ecx, [esi + 0x4ff4]
push ecx
mov dword [esi + 0x4ff0], edi
call ebp
lea ecx, [esi + 0x4fcc]
mov dword [esi + 0x4ff0], 0x101975e0
call fcn.100c0240
lea edx, [esi + 0x4fac]
push edx
mov dword [esi + 0x4fa8], edi
call ebp
lea ecx, [esi + 0x4f84]
mov dword [esi + 0x4fa8], 0x101975e0
call fcn.100cafe0
lea eax, [esi + 0x4f64]
push eax
mov dword [esi + 0x4f60], edi
call ebp
lea edi, [esi + 0x4f54]
mov dword [esi + 0x4f60], 0x101975e0
mov eax, dword [edi + 4]
mov ecx, dword [eax]
push eax
push edi
push ecx
push edi
lea ecx, [esp + 0x2c]
push ecx
mov ecx, edi
mov byte [esp + 0x44], 0x1d
call fcn.100bd3c0
mov eax, dword [edi + 4]
push eax
call fcn.10157f3b
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov edi, 0x10
add esp, 4
cmp dword [esi + 0x4f20], edi
jb 0x100d3cf4
mov eax, dword [esi + 0x4f0c]
push eax
call fcn.10157f3b
add esp, 4
mov dword [esi + 0x4f20], 0xf
mov dword [esi + 0x4f1c], ebx
mov byte [esi + 0x4f0c], bl
cmp dword [esi + 0x4efc], edi
jb 0x100d3d21
mov eax, dword [esi + 0x4ee8]
push eax
call fcn.10157f3b
add esp, 4
mov dword [esi + 0x4efc], 0xf
mov dword [esi + 0x4ef8], ebx
mov byte [esi + 0x4ee8], bl
cmp dword [esi + 0x4ed8], edi
jb 0x100d3d4e
mov eax, dword [esi + 0x4ec4]
push eax
call fcn.10157f3b
add esp, 4
mov dword [esi + 0x4ed8], 0xf
mov dword [esi + 0x4ed4], ebx
mov byte [esi + 0x4ec4], bl
cmp dword [esi + 0x4ebc], edi
jb 0x100d3d7b
mov eax, dword [esi + 0x4ea8]
push eax
call fcn.10157f3b
add esp, 4
mov dword [esi + 0x4ebc], 0xf
mov dword [esi + 0x4eb8], ebx
mov byte [esi + 0x4ea8], bl
cmp dword [esi + 0x4ea0], edi
jb 0x100d3da8
mov eax, dword [esi + 0x4e8c]
push eax
call fcn.10157f3b
add esp, 4
mov dword [esi + 0x4ea0], 0xf
mov dword [esi + 0x4e9c], ebx
mov byte [esi + 0x4e8c], bl
cmp dword [esi + 0x4e7c], edi
jb 0x100d3dd5
mov eax, dword [esi + 0x4e68]
push eax
call fcn.10157f3b
add esp, 4
mov dword [esi + 0x4e7c], 0xf
mov dword [esi + 0x4e78], ebx
mov byte [esi + 0x4e68], bl
cmp dword [esi + 0x4e58], edi
jb 0x100d3e02
mov eax, dword [esi + 0x4e44]
push eax
call fcn.10157f3b
add esp, 4
mov dword [esi + 0x4e58], 0xf
mov dword [esi + 0x4e54], ebx
mov byte [esi + 0x4e44], bl
cmp dword [esi + 0x4e34], edi
jb 0x100d3e2f
mov eax, dword [esi + 0x4e20]
push eax
call fcn.10157f3b
add esp, 4
mov dword [esi + 0x4e34], 0xf
mov dword [esi + 0x4e30], ebx
lea ecx, [esi + 0x4e04]
mov byte [esi + 0x4e20], bl
call fcn.1002e220
cmp dword [esi + 0x4df8], edi
jb 0x100d3e67
mov eax, dword [esi + 0x4de4]
push eax
call fcn.10157f3b
add esp, 4
mov dword [esi + 0x4df8], 0xf
mov dword [esi + 0x4df4], ebx
mov byte [esi + 0x4de4], bl
cmp dword [esi + 0x4dd4], edi
jb 0x100d3e94
mov eax, dword [esi + 0x4dc0]
push eax
call fcn.10157f3b
add esp, 4
mov dword [esi + 0x4dd4], 0xf
mov dword [esi + 0x4dd0], ebx
mov byte [esi + 0x4dc0], bl
cmp dword [esi + 0x4db0], edi
jb 0x100d3ec1
mov eax, dword [esi + 0x4d9c]
push eax
call fcn.10157f3b
add esp, 4
mov dword [esi + 0x4db0], 0xf
mov dword [esi + 0x4dac], ebx
lea ecx, [esi + 0x4d6c]
mov byte [esi + 0x4d9c], bl
call fcn.10030700
mov edx, dword [esi + 0x4d68]
push edx
mov dword [esi + 0x4d64], 0x10198180
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, 0x101975e0
lea ecx, [esi + 0x4d38]
mov dword [esi + 0x4d64], edi
mov byte [esp + 0x30], 0xe
call fcn.100b90c0
lea ecx, [esi + 0x4cf0]
call fcn.10008040
lea ecx, [esi + 0x4ca4]
call fcn.100d7e90
lea ecx, [esi + 0x4c68]
mov byte [esp + 0x30], 0xb
call fcn.100db480
lea ecx, [esi + 0x4c38]
mov byte [esp + 0x30], 0xa
call fcn.100e1910
lea ecx, [esi + 0x4bf0]
mov byte [esp + 0x30], 9
call fcn.100595d0
lea ecx, [esi + 0x4ba8]
mov byte [esp + 0x30], 8
call fcn.100595d0
lea ecx, [esi + 0x4b60]
mov byte [esp + 0x30], 7
call fcn.100595d0
lea ecx, [esi + 0x60]
mov byte [esp + 0x30], 6
call fcn.100c5df0
lea eax, [esi + 0x48]
push eax
mov dword [esi + 0x44], 0x101975e4
call ebp
mov dword [esi + 0x44], edi
lea ecx, [esi + 0x34]
mov dword [esi + 0x40], 0x10199cb8
mov byte [esp + 0x30], 3
call fcn.10025ee0
lea ecx, [esi + 0x28]
mov byte [esp + 0x30], 2
call fcn.10025ee0
lea ecx, [esi + 0x1c]
mov byte [esp + 0x30], 1
call fcn.10025ee0
lea ecx, [esi + 4]
mov byte [esp + 0x30], bl
call fcn.1002acd0
mov dword [esi], 0x101993f0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret