Function at 0x10003990
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
mov eax, 0x1118
call fcn.1000a770
mov eax, dword [0x1003106c]
xor eax, esp
mov dword [esp + 0x1114], eax
mov eax, dword [ebp + 0x10]
lea ecx, [esp + 0xb0]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 0xd
mov dword [esp + 0x78], eax
mov eax, dword [ebp + 0x14]
push str.BWXClient.exe
mov dword [esp + 0x18], eax
mov dword [esp + 0xd0], 0
mov dword [esp + 0xd4], 0xf
mov byte [esp + 0xc0], 0
call fcn.10006590
lea ecx, [esp + 0xb8]
call fcn.10002d20
mov edx, dword [esp + 0xcc]
mov byte [esp + 0x2f], al
cmp edx, 0x10
jb 0x10003a45
mov ecx, dword [esp + 0xb8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10003a37
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000474e
push edx
push ecx
call fcn.10009871
mov al, byte [esp + 0x37]
add esp, 8
test al, al
je 0x10003a61
xor esi, esi
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0x1114]
xor ecx, esp
call fcn.1000959e
mov esp, ebp
pop ebp
ret
mov edx, esi
lea ecx, [esp + 0x100]
call fcn.10003890
mov edx, edi
lea ecx, [esp + 0xe8]
call fcn.10003890
mov edx, dword [esp + 0x74]
lea ecx, [esp + 0xd0]
call fcn.10003890
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0xb8]
call fcn.10003890
push 0
push 0x1002d8b4
lea ecx, [esp + 0x98]
mov dword [esp + 0xa8], 0
mov dword [esp + 0xac], 0xf
mov byte [esp + 0x98], 0
call fcn.10006590
lea eax, [esp + 0x118]
push eax
call sym.IMOP.dll_IsExistIM
add esp, 4
test eax, eax
je 0x10003c4b
mov edx, dword [esp + 0xa4]
mov esi, 0xfffffffe
cmp edx, 0x10
jb 0x10003b27
mov ecx, dword [esp + 0x90]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10003b1d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10004749
push edx
push ecx
call fcn.10009871
add esp, 8
mov edx, dword [esp + 0xcc]
mov dword [esp + 0xa0], 0
mov dword [esp + 0xa4], 0xf
mov byte [esp + 0x90], 0
cmp edx, 0x10
jb 0x10003b81
mov ecx, dword [esp + 0xb8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10003b77
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10004749
push edx
push ecx
call fcn.10009871
add esp, 8
mov edx, dword [esp + 0xe4]
cmp edx, 0x10
jb 0x10003bbd
mov ecx, dword [esp + 0xd0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10003bb3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10004749
push edx
push ecx
call fcn.10009871
add esp, 8
mov edx, dword [esp + 0xfc]
cmp edx, 0x10
jb 0x10003bf9
mov ecx, dword [esp + 0xe8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10003bef
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10004749
push edx
push ecx
call fcn.10009871
add esp, 8
mov edx, dword [esp + 0x114]
cmp edx, 0x10
jb 0x10003c35
mov ecx, dword [esp + 0x100]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10003c2b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10004749
push edx
push ecx
call fcn.10009871
add esp, 8
mov eax, esi
pop edi
pop esi
mov ecx, dword [esp + 0x1114]
xor ecx, esp
call fcn.1000959e
mov esp, ebp
pop ebp
ret
lea edx, [esp + 0x118]
lea ecx, [esp + 0x30]
call fcn.10003890
mov esi, eax
lea eax, [esp + 0x90]
cmp eax, esi
je 0x10003cf0
mov edx, dword [esp + 0xa4]
cmp edx, 0x10
jb 0x10003ca8
mov ecx, dword [esp + 0x90]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10003c9e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10004753
push edx
push ecx
call fcn.10009871
add esp, 8
mov dword [esp + 0xa0], 0
mov dword [esp + 0xa4], 0xf
mov byte [esp + 0x90], 0
movups xmm0, xmmword [esi]
movups xmmword [esp + 0x90], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [esp + 0xa0], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov edx, dword [esp + 0x44]
cmp edx, 0x10
jb 0x10003d26
mov ecx, dword [esp + 0x30]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10003d1c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10004753
push edx
push ecx
call fcn.10009871
add esp, 8
cmp dword [esp + 0xa0], 0
je 0x10003e53
lea eax, [esp + 0x90]
mov edx, 0x1002da34
push eax
lea ecx, [esp + 0x60]
call fcn.10007150
mov edi, eax
add esp, 4
mov edx, dword [edi + 0x14]
mov eax, edx
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp eax, 1
jb 0x10003d86
lea eax, [ecx + 1]
mov dword [edi + 0x10], eax
mov eax, edi
cmp edx, 0x10
jb 0x10003d6d
mov eax, dword [edi]
push 1
lea esi, [eax + ecx]
push 0x1002da34
push esi
call fcn.1000b330
add esp, 0xc
mov byte [esi + 1], 0
jmp 0x10003da1
push 1
push 0x1002da34
mov byte [esp + 0x18], 0
mov ecx, edi
push dword [esp + 0x18]
push 1
call fcn.100078d0
mov edi, eax
movups xmm0, xmmword [edi]
movq xmm1, qword [edi + 0x10]
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov edx, dword [esp + 0xa4]
movaps xmmword [esp + 0x30], xmm0
movq qword [esp + 0x10], xmm1
cmp edx, 0x10
jb 0x10003e0c
mov ecx, dword [esp + 0x90]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10003df7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10004758
push edx
push ecx
call fcn.10009871
movaps xmm0, xmmword [esp + 0x38]
add esp, 8
movq xmm1, qword [esp + 0x10]
mov edx, dword [esp + 0x70]
movaps xmmword [esp + 0x90], xmm0
movq qword [esp + 0xa0], xmm1
cmp edx, 0x10
jb 0x10003e53
mov ecx, dword [esp + 0x5c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10003e49
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10004758
push edx
push ecx
call fcn.10009871
add esp, 8
push 0
push 0x1002d8b4
lea ecx, [esp + 0x80]
mov dword [esp + 0x90], 0
mov dword [esp + 0x94], 0xf
mov byte [esp + 0x80], 0
call fcn.10006590
lea eax, [esp + 0x100]
mov edx, 0x1002da34
push eax
lea ecx, [esp + 0x60]
call fcn.10007150
mov edi, eax
add esp, 4
mov edx, dword [edi + 0x14]
mov eax, edx
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp eax, 1
jb 0x10003ed6
lea eax, [ecx + 1]
mov dword [edi + 0x10], eax
mov eax, edi
cmp edx, 0x10
jb 0x10003ebd
mov eax, dword [edi]
push 1
lea esi, [eax + ecx]
push 0x1002da34
push esi
call fcn.1000b330
add esp, 0xc
mov byte [esi + 1], 0
jmp 0x10003ef1
push 1
push 0x1002da34
mov byte [esp + 0x18], 0
mov ecx, edi
push dword [esp + 0x18]
push 1
call fcn.100078d0
mov edi, eax
movups xmm1, xmmword [edi]
lea edx, [esp + 0x30]
movq xmm0, qword [edi + 0x10]
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov eax, dword [esp + 0x8c]
mov esi, dword [esp + 0x88]
movq qword [esp + 0x40], xmm0
cmp dword [esp + 0x44], 0x10
mov ecx, dword [esp + 0x40]
movd edi, xmm1
push ecx
movaps xmmword [esp + 0x34], xmm1
cmovae edx, edi
sub eax, esi
push edx
cmp ecx, eax
ja 0x10003f75
cmp dword [esp + 0x94], 0x10
lea eax, [ecx + esi]
mov dword [esp + 0x90], eax
lea eax, [esp + 0x80]
cmovae eax, dword [esp + 0x80]
add esi, eax
push esi
call fcn.1000b330
mov eax, dword [esp + 0x4c]
add esp, 0xc
mov byte [eax + esi], 0
jmp 0x10003f8f
mov byte [esp + 0x18], 0
push dword [esp + 0x18]
push ecx
lea ecx, [esp + 0x88]
call fcn.100078d0
mov edi, dword [esp + 0x30]
mov eax, dword [esp + 0x44]
cmp eax, 0x10
jb 0x10003fc3
lea ecx, [eax + 1]
mov eax, edi
cmp ecx, 0x1000
jb 0x10003fb9
mov edi, dword [edi - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000475d
push ecx
push edi
call fcn.10009871
add esp, 8
mov edx, dword [esp + 0x70]
cmp edx, 0x10
jb 0x10003ff9
mov ecx, dword [esp + 0x5c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10003fef
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000475d
push edx
push ecx
call fcn.10009871
add esp, 8
lea eax, [esp + 0xe8]
mov edx, 0x1002da38
push eax
lea ecx, [esp + 0x60]
call fcn.10007150
mov edi, eax
add esp, 4
mov edx, dword [edi + 0x14]
mov eax, edx
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp eax, 1
jb 0x1000404b
lea eax, [ecx + 1]
mov dword [edi + 0x10], eax
mov eax, edi
cmp edx, 0x10
jb 0x10004032
mov eax, dword [edi]
push 1
lea esi, [eax + ecx]
push 0x1002da34
push esi
call fcn.1000b330
add esp, 0xc
mov byte [esi + 1], 0
jmp 0x10004066
push 1
push 0x1002da34
mov byte [esp + 0x18], 0
mov ecx, edi
push dword [esp + 0x18]
push 1
call fcn.100078d0
mov edi, eax
movups xmm1, xmmword [edi]
lea edx, [esp + 0x30]
movq xmm0, qword [edi + 0x10]
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov eax, dword [esp + 0x8c]
mov esi, dword [esp + 0x88]
movq qword [esp + 0x40], xmm0
cmp dword [esp + 0x44], 0x10
mov ecx, dword [esp + 0x40]
movd edi, xmm1
push ecx
movaps xmmword [esp + 0x34], xmm1
cmovae edx, edi
sub eax, esi
push edx
cmp ecx, eax
ja 0x100040ea
cmp dword [esp + 0x94], 0x10
lea eax, [ecx + esi]
mov dword [esp + 0x90], eax
lea eax, [esp + 0x80]
cmovae eax, dword [esp + 0x80]
add esi, eax
push esi
call fcn.1000b330
mov eax, dword [esp + 0x4c]
add esp, 0xc
mov byte [eax + esi], 0
jmp 0x10004104
mov byte [esp + 0x18], 0
push dword [esp + 0x18]
push ecx
lea ecx, [esp + 0x88]
call fcn.100078d0
mov edi, dword [esp + 0x30]
mov eax, dword [esp + 0x44]
cmp eax, 0x10
jb 0x10004138
lea ecx, [eax + 1]
mov eax, edi
cmp ecx, 0x1000
jb 0x1000412e
mov edi, dword [edi - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10004762
push ecx
push edi
call fcn.10009871
add esp, 8
mov edx, dword [esp + 0x70]
cmp edx, 0x10
jb 0x1000416e
mov ecx, dword [esp + 0x5c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10004164
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10004762
push edx
push ecx
call fcn.10009871
add esp, 8
lea eax, [esp + 0xd0]
mov edx, 0x1002da38
push eax
lea ecx, [esp + 0x60]
call fcn.10007150
mov edi, eax
add esp, 4
mov edx, dword [edi + 0x14]
mov eax, edx
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp eax, 1
jb 0x100041c0
lea eax, [ecx + 1]
mov dword [edi + 0x10], eax
mov eax, edi
cmp edx, 0x10
jb 0x100041a7
mov eax, dword [edi]
push 1
lea esi, [eax + ecx]
push 0x1002da34
push esi
call fcn.1000b330
add esp, 0xc
mov byte [esi + 1], 0
jmp 0x100041db
push 1
push 0x1002da34
mov byte [esp + 0x18], 0
mov ecx, edi
push dword [esp + 0x18]
push 1
call fcn.100078d0
mov edi, eax
movups xmm1, xmmword [edi]
lea edx, [esp + 0x30]
movq xmm0, qword [edi + 0x10]
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov eax, dword [esp + 0x8c]
mov esi, dword [esp + 0x88]
movq qword [esp + 0x40], xmm0
cmp dword [esp + 0x44], 0x10
mov ecx, dword [esp + 0x40]
movd edi, xmm1
push ecx
movaps xmmword [esp + 0x34], xmm1
cmovae edx, edi
sub eax, esi
push edx
cmp ecx, eax
ja 0x1000425f
cmp dword [esp + 0x94], 0x10
lea eax, [ecx + esi]
mov dword [esp + 0x90], eax
lea eax, [esp + 0x80]
cmovae eax, dword [esp + 0x80]
add esi, eax
push esi
call fcn.1000b330
mov eax, dword [esp + 0x4c]
add esp, 0xc
mov byte [eax + esi], 0
jmp 0x10004279
mov byte [esp + 0x18], 0
push dword [esp + 0x18]
push ecx
lea ecx, [esp + 0x88]
call fcn.100078d0
mov edi, dword [esp + 0x30]
mov eax, dword [esp + 0x44]
cmp eax, 0x10
jb 0x100042ad
lea ecx, [eax + 1]
mov eax, edi
cmp ecx, 0x1000
jb 0x100042a3
mov edi, dword [edi - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10004767
push ecx
push edi
call fcn.10009871
add esp, 8
mov edx, dword [esp + 0x70]
cmp edx, 0x10
jb 0x100042e3
mov ecx, dword [esp + 0x5c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100042d9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10004767
push edx
push ecx
call fcn.10009871
add esp, 8
lea eax, [esp + 0xb8]
mov edx, 0x1002da38
push eax
lea ecx, [esp + 0x60]
call fcn.10007150
mov edi, eax
add esp, 4
mov edx, dword [edi + 0x14]
mov eax, edx
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp eax, 1
jb 0x10004335
lea eax, [ecx + 1]
mov dword [edi + 0x10], eax
mov eax, edi
cmp edx, 0x10
jb 0x1000431c
mov eax, dword [edi]
push 1
lea esi, [eax + ecx]
push 0x1002da34
push esi
call fcn.1000b330
add esp, 0xc
mov byte [esi + 1], 0
jmp 0x10004350
push 1
push 0x1002da34
mov byte [esp + 0x18], 0
mov ecx, edi
push dword [esp + 0x18]
push 1
call fcn.100078d0
mov edi, eax
movups xmm1, xmmword [edi]
lea edx, [esp + 0x30]
movq xmm0, qword [edi + 0x10]
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov eax, dword [esp + 0x8c]
mov esi, dword [esp + 0x88]
movq qword [esp + 0x40], xmm0
cmp dword [esp + 0x44], 0x10
mov ecx, dword [esp + 0x40]
movd edi, xmm1
push ecx
movaps xmmword [esp + 0x34], xmm1
cmovae edx, edi
sub eax, esi
push edx
cmp ecx, eax
ja 0x100043d4
cmp dword [esp + 0x94], 0x10
lea eax, [ecx + esi]
mov dword [esp + 0x90], eax
lea eax, [esp + 0x80]
cmovae eax, dword [esp + 0x80]
add esi, eax
push esi
call fcn.1000b330
mov eax, dword [esp + 0x4c]
add esp, 0xc
mov byte [eax + esi], 0
jmp 0x100043ee
mov byte [esp + 0x18], 0
push dword [esp + 0x18]
push ecx
lea ecx, [esp + 0x88]
call fcn.100078d0
mov edi, dword [esp + 0x30]
mov eax, dword [esp + 0x44]
cmp eax, 0x10
jb 0x10004422
lea ecx, [eax + 1]
mov eax, edi
cmp ecx, 0x1000
jb 0x10004418
mov edi, dword [edi - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000476c
push ecx
push edi
call fcn.10009871
add esp, 8
mov edx, dword [esp + 0x70]
cmp edx, 0x10
jb 0x10004458
mov ecx, dword [esp + 0x5c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1000444e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000476c
push edx
push ecx
call fcn.10009871
add esp, 8
cmp dword [esp + 0x8c], 0x10
lea ecx, [esp + 0x78]
push 1
cmovae ecx, dword [esp + 0x7c]
lea eax, [esp + 0x94]
cmp dword [esp + 0xa8], 0x10
push 0
cmovae eax, dword [esp + 0x98]
push ecx
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov edx, dword [esp + 0x8c]
mov esi, eax
cmp esi, 0x20
jg 0x100045c2
cmp edx, 0x10
jb 0x100044d7
mov ecx, dword [esp + 0x78]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100044cd
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10004749
push edx
push ecx
call fcn.10009871
add esp, 8
mov edx, dword [esp + 0xa4]
mov dword [esp + 0x88], 0
mov dword [esp + 0x8c], 0xf
mov byte [esp + 0x78], 0
cmp edx, 0x10
jb 0x1000452e
mov ecx, dword [esp + 0x90]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10004524
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10004749
push edx
push ecx
call fcn.10009871
add esp, 8
mov edx, dword [esp + 0xcc]
mov dword [esp + 0xa0], 0
mov dword [esp + 0xa4], 0xf
mov byte [esp + 0x90], 0
cmp edx, 0x10
jb 0x10004588
mov ecx, dword [esp + 0xb8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1000457e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10004749
push edx
push ecx
call fcn.10009871
add esp, 8
lea ecx, [esp + 0xd0]
call fcn.10004cd0
lea ecx, [esp + 0xe8]
call fcn.10004cd0
lea ecx, [esp + 0x100]
call fcn.10004cd0
mov ecx, dword [esp + 0x111c]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.1000959e
mov esp, ebp
pop ebp
ret
xor esi, esi
cmp edx, 0x10
jb 0x100045f6
mov ecx, dword [esp + 0x78]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100045ec
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10004749
push edx
push ecx
call fcn.10009871
add esp, 8
mov edx, dword [esp + 0xa4]
mov dword [esp + 0x88], esi
mov dword [esp + 0x8c], 0xf
mov byte [esp + 0x78], 0
cmp edx, 0x10
jb 0x10004649
mov ecx, dword [esp + 0x90]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1000463f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10004749
push edx
push ecx
call fcn.10009871
add esp, 8
mov edx, dword [esp + 0xcc]
mov dword [esp + 0xa0], esi
mov dword [esp + 0xa4], 0xf
mov byte [esp + 0x90], 0
cmp edx, 0x10
jb 0x1000469f
mov ecx, dword [esp + 0xb8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10004695
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10004749
push edx
push ecx
call fcn.10009871
add esp, 8
mov edx, dword [esp + 0xe4]
cmp edx, 0x10
jb 0x100046d7
mov ecx, dword [esp + 0xd0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100046cd
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10004749
push edx
push ecx
call fcn.10009871
add esp, 8
mov edx, dword [esp + 0xfc]
cmp edx, 0x10
jb 0x1000470f
mov ecx, dword [esp + 0xe8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10004705
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10004749
push edx
push ecx
call fcn.10009871
add esp, 8
mov edx, dword [esp + 0x114]
cmp edx, 0x10
jb 0x10003c35
mov ecx, dword [esp + 0x100]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10003c2b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10003c2b
call fcn.1000e971
call fcn.1000e971
call fcn.1000e971
call fcn.1000e971
call fcn.1000e971
call fcn.1000e971
call fcn.1000e971
call fcn.1000e971
int3