Function at 0x1000af80
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd0
mov eax, dword [0x1006a2a8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
mov dword [ebp - 0xd0], eax
call esi
mov edi, eax
mov dword [ebp - 0xcc], edi
call esi
mov ecx, eax
sub ecx, edi
lea esi, [ebp - 0x3c]
call fcn.10009d40
push eax
mov eax, str.Start:
lea ecx, [ebp - 0x58]
call fcn.1000bd10
add esp, 4
mov edi, eax
mov esi, 0x1006c940
call fcn.10003890
mov ebx, 0x10
cmp dword [ebp - 0x44], ebx
jb 0x1000aff0
mov ecx, dword [ebp - 0x58]
push ecx
call fcn.100281c4
add esp, 4
xor edi, edi
mov esi, 0xf
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x48], edi
mov byte [ebp - 0x58], 0
cmp dword [ebp - 0x28], ebx
jb 0x1000b012
mov edx, dword [ebp - 0x3c]
push edx
call fcn.100281c4
add esp, 4
mov dword [ebp - 0x28], esi
mov esi, dword [0x1006d940]
mov dword [ebp - 0x2c], edi
mov byte [ebp - 0x3c], 0
cmp esi, edi
jne 0x1000b046
push 0x78
call fcn.100288de
add esp, 4
cmp eax, edi
je 0x1000b03c
push eax
call fcn.100015d0
jmp 0x1000b03e
xor eax, eax
mov esi, eax
mov dword [0x1006d940], esi
call fcn.10001720
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, dword [ebp - 0xcc]
lea esi, [ebp - 0x20]
call fcn.10009d40
push str.init_wmi_return:
mov esi, eax
lea eax, [ebp - 0x58]
push 0x1006c940
push eax
call fcn.1000bd60
lea edx, [ebp - 0x3c]
mov ecx, eax
push edx
mov eax, esi
call fcn.1000be40
add esp, 0x10
mov edi, eax
mov esi, 0x1006c940
call fcn.10003890
cmp dword [ebp - 0x28], ebx
jb 0x1000b0a3
mov eax, dword [ebp - 0x3c]
push eax
call fcn.100281c4
add esp, 4
xor esi, esi
mov edi, 0xf
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x2c], esi
mov byte [ebp - 0x3c], 0
cmp dword [ebp - 0x44], ebx
jb 0x1000b0c5
mov ecx, dword [ebp - 0x58]
push ecx
call fcn.100281c4
add esp, 4
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x48], esi
mov byte [ebp - 0x58], 0
cmp dword [ebp - 0xc], ebx
jb 0x1000b0e0
mov edx, dword [ebp - 0x20]
push edx
call fcn.100281c4
add esp, 4
mov ecx, dword [0x1006d940]
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x10], esi
mov byte [ebp - 0x20], 0
cmp ecx, esi
jne 0x1000b114
push 0x78
call fcn.100288de
add esp, 4
cmp eax, esi
je 0x1000b10a
push eax
call fcn.100015d0
jmp 0x1000b10c
xor eax, eax
mov ecx, eax
mov dword [0x1006d940], ecx
lea edx, [ebp - 0x74]
call fcn.10001dc0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, dword [ebp - 0xcc]
lea esi, [ebp - 0x58]
call fcn.10009d40
push str.get_mac_return:
mov esi, eax
lea eax, [ebp - 0x3c]
push 0x1006c940
push eax
call fcn.1000bd60
lea edx, [ebp - 0x20]
mov ecx, eax
push edx
mov eax, esi
call fcn.1000be40
add esp, 0x10
mov edi, eax
mov esi, 0x1006c940
call fcn.10003890
cmp dword [ebp - 0xc], ebx
jb 0x1000b174
mov eax, dword [ebp - 0x20]
push eax
call fcn.100281c4
add esp, 4
xor edi, edi
mov esi, 0xf
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], edi
mov byte [ebp - 0x20], 0
cmp dword [ebp - 0x28], ebx
jb 0x1000b196
mov ecx, dword [ebp - 0x3c]
push ecx
call fcn.100281c4
add esp, 4
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x2c], edi
mov byte [ebp - 0x3c], 0
cmp dword [ebp - 0x44], ebx
jb 0x1000b1b1
mov edx, dword [ebp - 0x58]
push edx
call fcn.100281c4
add esp, 4
mov edi, dword [ebp - 0x64]
mov esi, dword [ebp - 0x74]
cmp dword [ebp - 0x60], ebx
jae 0x1000b1bf
lea esi, [ebp - 0x74]
cmp dword [0x1006d944], 0
jne 0x1000b1e5
push 0x64
call fcn.100288de
add esp, 4
test eax, eax
je 0x1000b1de
push eax
call fcn.100063b0
jmp 0x1000b1e0
xor eax, eax
mov dword [0x1006d944], eax
push edi
mov ecx, esi
call fcn.10006670
test al, al
jne 0x1000b311
mov ecx, dword [0x1006d940]
test ecx, ecx
jne 0x1000b21f
push 0x78
call fcn.100288de
add esp, 4
test eax, eax
je 0x1000b215
push eax
call fcn.100015d0
jmp 0x1000b217
xor eax, eax
mov ecx, eax
mov dword [0x1006d940], ecx
lea edx, [ebp - 0x20]
call fcn.10002dc0
mov edi, eax
lea esi, [ebp - 0x74]
call fcn.10003890
cmp dword [ebp - 0xc], ebx
jb 0x1000b242
mov eax, dword [ebp - 0x20]
push eax
call fcn.100281c4
add esp, 4
cmp dword [ebp - 0x64], 0xc
je 0x1000b270
call fcn.100064d0
lea esi, [ebp - 0x20]
call fcn.10007d20
mov edi, eax
lea esi, [ebp - 0x74]
call fcn.10003890
cmp dword [ebp - 0xc], ebx
jb 0x1000b270
mov ecx, dword [ebp - 0x20]
push ecx
call fcn.100281c4
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, dword [ebp - 0xcc]
lea esi, [ebp - 0x58]
call fcn.10009d40
push str.fake_mac_return:
lea edx, [ebp - 0x3c]
push 0x1006c940
push edx
mov esi, eax
call fcn.1000bd60
mov ecx, eax
lea eax, [ebp - 0x20]
push eax
mov eax, esi
call fcn.1000be40
add esp, 0x10
mov edi, eax
mov esi, 0x1006c940
call fcn.10003890
cmp dword [ebp - 0xc], ebx
jb 0x1000b2c8
mov ecx, dword [ebp - 0x20]
push ecx
call fcn.100281c4
add esp, 4
xor esi, esi
mov edi, 0xf
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x10], esi
mov byte [ebp - 0x20], 0
cmp dword [ebp - 0x28], ebx
jb 0x1000b2ea
mov edx, dword [ebp - 0x3c]
push edx
call fcn.100281c4
add esp, 4
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x2c], esi
mov byte [ebp - 0x3c], 0
cmp dword [ebp - 0x44], ebx
jb 0x1000b305
mov eax, dword [ebp - 0x58]
push eax
call fcn.100281c4
add esp, 4
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x48], esi
mov byte [ebp - 0x58], 0
jmp 0x1000b313
xor esi, esi
mov eax, dword [0x1006d944]
cmp eax, esi
jne 0x1000b339
push 0x64
call fcn.100288de
add esp, 4
cmp eax, esi
je 0x1000b332
push eax
call fcn.100063b0
jmp 0x1000b334
xor eax, eax
mov dword [0x1006d944], eax
push eax
lea ecx, [ebp - 0xac]
call fcn.10007870
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, dword [ebp - 0xcc]
lea esi, [ebp - 0x58]
call fcn.10009d40
push str.read_file_return:
lea ecx, [ebp - 0x3c]
push 0x1006c940
push ecx
mov esi, eax
call fcn.1000bd60
lea edx, [ebp - 0x20]
mov ecx, eax
push edx
mov eax, esi
call fcn.1000be40
add esp, 0x10
mov edi, eax
mov esi, 0x1006c940
call fcn.10003890
cmp dword [ebp - 0xc], ebx
jb 0x1000b39d
mov eax, dword [ebp - 0x20]
push eax
call fcn.100281c4
add esp, 4
xor esi, esi
mov edi, 0xf
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x10], esi
mov byte [ebp - 0x20], 0
cmp dword [ebp - 0x28], ebx
jb 0x1000b3bf
mov ecx, dword [ebp - 0x3c]
push ecx
call fcn.100281c4
add esp, 4
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x2c], esi
mov byte [ebp - 0x3c], 0
cmp dword [ebp - 0x44], ebx
jb 0x1000b3da
mov edx, dword [ebp - 0x58]
push edx
call fcn.100281c4
add esp, 4
mov ecx, dword [ebp - 0xd0]
xor eax, eax
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov byte [ecx + 0xc], al
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0x60], ebx
jae 0x1000b3f8
lea eax, [ebp - 0x74]
mov edx, dword [eax]
mov ebx, dword [ebp - 0x64]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov eax, dword [eax + 8]
mov edi, 0xc
mov dword [ecx + 8], eax
cmp ebx, edi
jae 0x1000b416
mov edi, ebx
mov ecx, dword [ebp - 0x74]
mov edx, 0x10
cmp dword [ebp - 0x60], edx
jae 0x1000b426
lea ecx, [ebp - 0x74]
mov eax, dword [ebp - 0x9c]
mov esi, 0xc
cmp eax, esi
jae 0x1000b437
mov esi, eax
mov eax, esi
cmp esi, edi
jb 0x1000b43f
mov eax, edi
cmp dword [ebp - 0x98], edx
mov edx, dword [ebp - 0xac]
jae 0x1000b453
lea edx, [ebp - 0xac]
call fcn.10005da0
test eax, eax
jne 0x1000b475
cmp esi, edi
jb 0x1000b475
cmp esi, edi
setne al
test eax, eax
jne 0x1000b475
mov byte [0x1006d954], 1
jmp 0x1000b843
cmp dword [ebp - 0x60], 0x10
mov edi, dword [ebp - 0x74]
mov byte [0x1006d954], 0
mov esi, ebx
jae 0x1000b48a
lea edi, [ebp - 0x74]
cmp dword [0x1006d944], 0
jne 0x1000b4b0
push 0x64
call fcn.100288de
add esp, 4
test eax, eax
je 0x1000b4a9
push eax
call fcn.100063b0
jmp 0x1000b4ab
xor eax, eax
mov dword [0x1006d944], eax
push esi
mov ecx, edi
call fcn.10006670
test al, al
je 0x1000b4c8
call fcn.10001550
mov ecx, eax
call fcn.10002920
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, dword [ebp - 0xcc]
lea esi, [ebp - 0x58]
call fcn.10009d40
push str.write_file_return:
lea ecx, [ebp - 0x3c]
push 0x1006c940
push ecx
mov esi, eax
call fcn.1000bd60
lea edx, [ebp - 0x20]
mov ecx, eax
push edx
mov eax, esi
call fcn.1000be40
add esp, 0x10
mov edi, eax
mov esi, 0x1006c940
call fcn.10003890
mov ebx, 0x10
cmp dword [ebp - 0xc], ebx
jb 0x1000b525
mov eax, dword [ebp - 0x20]
push eax
call fcn.100281c4
add esp, 4
xor edi, edi
mov esi, 0xf
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], edi
mov byte [ebp - 0x20], 0
cmp dword [ebp - 0x28], ebx
jb 0x1000b547
mov ecx, dword [ebp - 0x3c]
push ecx
call fcn.100281c4
add esp, 4
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x2c], edi
mov byte [ebp - 0x3c], 0
cmp dword [ebp - 0x44], ebx
jb 0x1000b562
mov edx, dword [ebp - 0x58]
push edx
call fcn.100281c4
add esp, 4
cmp dword [0x1006d940], edi
jne 0x1000b587
push 0x78
call fcn.100288de
add esp, 4
cmp eax, edi
je 0x1000b580
push eax
call fcn.100015d0
jmp 0x1000b582
xor eax, eax
mov dword [0x1006d940], eax
lea ecx, [ebp - 0x20]
call fcn.10002c40
mov edi, eax
mov esi, 0x1006c908
call fcn.10003e10
cmp dword [ebp - 0xc], 8
jb 0x1000b5ad
mov eax, dword [ebp - 0x20]
push eax
call fcn.100281c4
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, dword [ebp - 0xcc]
lea esi, [ebp - 0x58]
call fcn.10009d40
push str.read_nic_return:
lea ecx, [ebp - 0x3c]
push 0x1006c940
push ecx
mov esi, eax
call fcn.1000bd60
lea edx, [ebp - 0x20]
mov ecx, eax
push edx
mov eax, esi
call fcn.1000be40
add esp, 0x10
mov edi, eax
mov esi, 0x1006c940
call fcn.10003890
cmp dword [ebp - 0xc], ebx
jb 0x1000b605
mov eax, dword [ebp - 0x20]
push eax
call fcn.100281c4
add esp, 4
xor edi, edi
mov esi, 0xf
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], edi
mov byte [ebp - 0x20], 0
cmp dword [ebp - 0x28], ebx
jb 0x1000b627
mov ecx, dword [ebp - 0x3c]
push ecx
call fcn.100281c4
add esp, 4
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x2c], edi
mov byte [ebp - 0x3c], 0
cmp dword [ebp - 0x44], ebx
jb 0x1000b642
mov edx, dword [ebp - 0x58]
push edx
call fcn.100281c4
add esp, 4
mov eax, dword [0x1006d940]
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x48], edi
mov byte [ebp - 0x58], 0
cmp eax, edi
jne 0x1000b672
push 0x78
call fcn.100288de
add esp, 4
cmp eax, edi
je 0x1000b66b
push eax
call fcn.100015d0
jmp 0x1000b66d
xor eax, eax
mov dword [0x1006d940], eax
lea edi, [ebp - 0x90]
call fcn.10001da0
mov edi, eax
mov esi, 0x1006c924
call fcn.10003890
cmp dword [ebp - 0x7c], ebx
jb 0x1000b69d
mov eax, dword [ebp - 0x90]
push eax
call fcn.100281c4
add esp, 4
cmp dword [0x1006d940], 0
jne 0x1000b6c3
push 0x78
call fcn.100288de
add esp, 4
test eax, eax
je 0x1000b6bc
push eax
call fcn.100015d0
jmp 0x1000b6be
xor eax, eax
mov dword [0x1006d940], eax
call fcn.10002d10
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, dword [ebp - 0xcc]
lea esi, [ebp - 0x90]
call fcn.10009d40
push str.write_nic_return:
lea ecx, [ebp - 0x3c]
push 0x1006c940
push ecx
mov esi, eax
call fcn.1000bd60
lea edx, [ebp - 0x20]
mov ecx, eax
push edx
mov eax, esi
call fcn.1000be40
add esp, 0x10
mov edi, eax
mov esi, 0x1006c940
call fcn.10003890
cmp dword [ebp - 0xc], ebx
jb 0x1000b723
mov eax, dword [ebp - 0x20]
push eax
call fcn.100281c4
add esp, 4
xor edi, edi
mov esi, 0xf
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], edi
mov byte [ebp - 0x20], 0
cmp dword [ebp - 0x28], ebx
jb 0x1000b745
mov ecx, dword [ebp - 0x3c]
push ecx
call fcn.100281c4
add esp, 4
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x2c], edi
mov byte [ebp - 0x3c], 0
cmp dword [ebp - 0x7c], ebx
jb 0x1000b763
mov edx, dword [ebp - 0x90]
push edx
call fcn.100281c4
add esp, 4
mov esi, dword [ebp - 0x64]
lea eax, [ebp - 0x74]
push eax
lea ecx, [ebp - 0x90]
push ecx
call fcn.10057600
mov edi, 8
add esp, 8
cmp dword [eax + 0x14], edi
jb 0x1000b785
mov eax, dword [eax]
push esi
mov ecx, eax
call fcn.100083b0
add esp, 4
cmp dword [ebp - 0x7c], edi
jb 0x1000b7a4
mov edx, dword [ebp - 0x90]
push edx
call fcn.100281c4
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, dword [ebp - 0xcc]
lea esi, [ebp - 0x58]
call fcn.10009d40
push str.write_hist_return:
mov esi, eax
lea eax, [ebp - 0x3c]
push 0x1006c940
push eax
call fcn.1000bd60
lea edx, [ebp - 0x20]
mov ecx, eax
push edx
mov eax, esi
call fcn.1000be40
add esp, 0x10
mov edi, eax
mov esi, 0x1006c940
call fcn.10003890
cmp dword [ebp - 0xc], ebx
jb 0x1000b7fc
mov eax, dword [ebp - 0x20]
push eax
call fcn.100281c4
add esp, 4
xor edi, edi
mov esi, 0xf
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], edi
mov byte [ebp - 0x20], 0
cmp dword [ebp - 0x28], ebx
jb 0x1000b81e
mov ecx, dword [ebp - 0x3c]
push ecx
call fcn.100281c4
add esp, 4
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x2c], edi
mov byte [ebp - 0x3c], 0
cmp dword [ebp - 0x44], ebx
jb 0x1000b839
mov edx, dword [ebp - 0x58]
push edx
call fcn.100281c4
add esp, 4
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x48], edi
mov byte [ebp - 0x58], 0
mov eax, dword [0x1006d940]
test eax, eax
jne 0x1000b869
push 0x78
call fcn.100288de
add esp, 4
test eax, eax
je 0x1000b862
push eax
call fcn.100015d0
jmp 0x1000b864
xor eax, eax
mov dword [0x1006d940], eax
mov ecx, dword [eax + 0x58]
mov edx, dword [eax + 0x54]
lea edi, [ebp - 0xc8]
mov ebx, eax
mov dword [0x1006d94c], ecx
mov dword [0x1006d948], edx
call fcn.10002680
mov esi, dword [0x1006d940]
test esi, esi
jne 0x1000b8b2
push 0x78
call fcn.100288de
add esp, 4
test eax, eax
je 0x1000b8a8
push eax
call fcn.100015d0
jmp 0x1000b8aa
xor eax, eax
mov esi, eax
mov dword [0x1006d940], esi
mov eax, dword [esi + 0x40]
mov ebx, esi
test eax, eax
je 0x1000b8d0
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esi + 0x40], 0
mov esi, dword [0x1006d940]
mov eax, dword [ebx + 0x44]
test eax, eax
je 0x1000b8ec
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov esi, dword [0x1006d940]
mov dword [ebx + 0x44], 0
test esi, esi
je 0x1000b90a
mov edi, esi
call fcn.10001670
push edi
call fcn.100281c4
add esp, 4
mov dword [0x1006d940], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, dword [ebp - 0xcc]
lea esi, [ebp - 0x90]
call fcn.10009d40
push str.release_return:
mov esi, eax
lea eax, [ebp - 0x3c]
push 0x1006c940
push eax
call fcn.1000bd60
lea edx, [ebp - 0x20]
mov ecx, eax
push edx
mov eax, esi
call fcn.1000be40
add esp, 0x10
mov edi, eax
mov esi, 0x1006c940
call fcn.10003890
mov ebx, 0x10
cmp dword [ebp - 0xc], ebx
jb 0x1000b96a
mov eax, dword [ebp - 0x20]
push eax
call fcn.100281c4
add esp, 4
xor esi, esi
mov edi, 0xf
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x10], esi
mov byte [ebp - 0x20], 0
cmp dword [ebp - 0x28], ebx
jb 0x1000b98c
mov ecx, dword [ebp - 0x3c]
push ecx
call fcn.100281c4
add esp, 4
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x2c], esi
mov byte [ebp - 0x3c], 0
cmp dword [ebp - 0x7c], ebx
jb 0x1000b9aa
mov edx, dword [ebp - 0x90]
push edx
call fcn.100281c4
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0xcc]
lea ecx, [ebp - 0x90]
mov dword [0x1006d950], eax
lea eax, [ebp - 0xc8]
push eax
push ecx
call fcn.10057600
mov edi, 8
add esp, 8
cmp dword [eax + 0x14], edi
jb 0x1000b9dd
mov eax, dword [eax]
mov esi, eax
call fcn.10008640
cmp dword [ebp - 0x7c], edi
jb 0x1000b9f8
mov edx, dword [ebp - 0x90]
push edx
call fcn.100281c4
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, dword [ebp - 0xcc]
lea esi, [ebp - 0x90]
call fcn.10009d40
push str.write_hard_return:
mov esi, eax
lea eax, [ebp - 0x3c]
push 0x1006c940
push eax
call fcn.1000bd60
lea edx, [ebp - 0x20]
mov ecx, eax
push edx
mov eax, esi
call fcn.1000be40
add esp, 0x10
mov edi, eax
mov esi, 0x1006c940
call fcn.10003890
cmp dword [ebp - 0xc], ebx
jb 0x1000ba53
mov eax, dword [ebp - 0x20]
push eax
call fcn.100281c4
add esp, 4
xor esi, esi
mov edi, 0xf
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x10], esi
mov byte [ebp - 0x20], 0
cmp dword [ebp - 0x28], ebx
jb 0x1000ba75
mov ecx, dword [ebp - 0x3c]
push ecx
call fcn.100281c4
add esp, 4
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x2c], esi
mov byte [ebp - 0x3c], 0
cmp dword [ebp - 0x7c], ebx
jb 0x1000ba93
mov edx, dword [ebp - 0x90]
push edx
call fcn.100281c4
add esp, 4
cmp dword [ebp - 0xb4], ebx
jb 0x1000baaa
mov eax, dword [ebp - 0xc8]
push eax
call fcn.100281c4
add esp, 4
mov dword [ebp - 0xb4], edi
mov dword [ebp - 0xb8], esi
mov byte [ebp - 0xc8], 0
cmp dword [ebp - 0x98], ebx
jb 0x1000bad4
mov ecx, dword [ebp - 0xac]
push ecx
call fcn.100281c4
add esp, 4
cmp dword [ebp - 0x60], ebx
mov dword [ebp - 0x98], edi
pop edi
mov dword [ebp - 0x9c], esi
pop esi
mov byte [ebp - 0xac], 0
pop ebx
jb 0x1000bafb
mov edx, dword [ebp - 0x74]
push edx
call fcn.100281c4
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100281cf
mov esp, ebp
pop ebp
ret