Function at 0x100935e6
Capabilities:
Query environment variable
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1014a5b6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x9f8
push ebx
push esi
push edi
mov esi, ecx
mov dword [esp + 0x10], 0xfffffff7
mov dword [esp + 0x20], 0xffffffff
lea ecx, [esp + 0x444]
mov dword [esp + 0x20], 2
push 1
mov dword [esp + 0x48], esi
call fcn.100141a5
xor ebx, ebx
mov dword [esp + 0x34], 0x283bc1b0
push 3
mov dword [esp + 0x10], ebx
pop edx
jmp 0x10093658
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x598], edx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jl 0x10093649
mov dword [esp + 0xc], ebx
jmp 0x10093676
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x444]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 1
jl 0x10093664
push 2
mov dword [esp + 0x14], ebx
pop ecx
jmp 0x100936e8
mov dword [esp + 0xc], 0xfd4914d2
mov dword [esp + 0xc], ebx
jmp 0x100936a7
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x598], 0xc7555b7c
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jl 0x10093694
mov dword [esp + 0xc], ebx
jmp 0x100936de
mov dword [esp + 0x18], 0x14173bf3
mov dword [esp + 0x18], ebx
jmp 0x100936d4
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x598], 0x8872fa4
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edx
jl 0x100936c1
inc dword [esp + 0xc]
cmp dword [esp + 0xc], ecx
jle 0x100936b3
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ecx
jle 0x10093686
inc dword [esp + 0x34]
cmp dword [esp + 0x444], ebx
je 0x1009371d
push dword [esp + 0x444]
call fcn.10123626
pop ecx
mov dword [esp + 0x444], ebx
mov dword [esp + 0x448], ebx
mov dword [esp + 0x44c], ebx
mov ecx, dword [esi + 0x50]
cmp dword [ecx + 0xa8], 1
jne 0x10093779
push ecx
add ecx, 0xac
call fcn.1002b31a
lea ecx, [esp + 0x9ec]
mov dword [esp], 0x1000d650
call fcn.1001b5bd
mov dword [esp + 0xa0c], ebx
mov edx, dword [esi + 0x50]
mov ecx, dword [esi + 0x54]
add edx, 0xac
push eax
call fcn.1002bb63
or dword [esp + 0xa10], 0xffffffff
pop ecx
push ebx
push 1
lea ecx, [esp + 0x9f0]
call fcn.10016cae
mov edx, dword [esi + 0x50]
push ecx
lea ecx, [esp + 0x428]
call fcn.10071973
pop ecx
xor ecx, ecx
push 8
pop edx
inc ecx
mov dword [esp + 0xa0c], ecx
mov dword [esp + 0x74], edx
mov dword [esp + 0x78], edx
mov dword [esp + 0x7c], edx
mov dword [esp + 0x80], edx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x10], ebx
jmp 0x100937c4
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x40], 0x4a8c6a53
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ecx
jl 0x100937b4
mov dword [esp + 0x78], ebx
cmp dword [esp + 0x78], ebx
jl 0x10093833
mov dword [esp + 0x24], 0xbe92e3f9
mov eax, dword [esp + 0x78]
cmp dword [esp + eax*4 + 0x40], ebx
je 0x100937ee
mov eax, dword [esp + 0x78]
mov eax, dword [esp + eax*4 + 0x40]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x78]
mov eax, dword [esp + eax*4 + 0x40]
mov eax, dword [esp + 0x80]
mov eax, dword [esp + 0x78]
mov eax, dword [esp + eax*4 + 0x40]
mov eax, dword [esp + 0x78]
mov eax, dword [esp + eax*4 + 0x40]
mov eax, dword [esp + 0x7c]
cmp dword [esp + 0x78], ecx
jne 0x10093827
mov eax, dword [esp + 0x78]
cmp dword [esp + eax*4 + 0x40], ebx
mov eax, ecx
jne 0x10093829
mov eax, ebx
mov dword [esp + 0x24], eax
dec dword [esp + 0x78]
jns 0x100937d4
mov dword [esp + 0x18], 0xfffffff1
cmp dword [esp + 0x18], edx
jle 0x10093875
mov dword [esp + 0x34], 0xbb000e2e
xor edx, edx
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x18]
cmp ecx, eax
mov eax, dword [esp + 0x34]
setl dl
xor ecx, ecx
cmp eax, edx
setg cl
mov dword [esp + 0x80], ecx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 8
jg 0x10093841
mov edx, dword [esi + 0x50]
push ecx
add edx, 0x30
lea ecx, [esp + 0x794]
call fcn.10071973
pop ecx
lea eax, [esi + 0x4c]
mov byte [esp + 0xa0c], 2
cmp dword [eax], 2
lea ecx, [esp + 0x3ec]
mov dword [esp + 0x18], 0x42eb90da
push 4
mov dword [esp + 0x38], eax
sete byte [esp + 0x23]
call fcn.100141a5
mov byte [esp + 0xa0c], 3
lea eax, [esp + 0x6a8]
push dword [esp + 0x30]
xorps xmm0, xmm0
mov dword [esp + 0x24], 0xa7221ebc
push eax
lea eax, [esp + 0x6a0]
mov dword [esp + 0x3c8], ebx
push eax
push ebx
lea ecx, [esp + 0x3d0]
mov dword [esp + 0x3d4], ebx
movdqu xmmword [esp + 0x6a8], xmm0
mov dword [esp + 0x3d8], ebx
call fcn.10015178
mov byte [esp + 0xa0c], 4
mov dword [esp + 0x28], 0x7736
mov dword [esp + 0x10], ebx
jmp 0x10093930
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x3ec]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x1009391e
mov dword [esp + 0x18], ebx
cmp dword [esp + 0x18], 0xfffffffb
jg 0x10093b61
mov edi, dword [esp + 0x3c0]
push 3
lea ecx, [esp + 0x3e4]
call fcn.100141a5
push 4
lea ecx, [esp + 0x3fc]
mov byte [esp + 0xa10], 5
call fcn.100141a5
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], ebx
jmp 0x10093995
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x3e0]
mov dword [eax + ecx*4], 9
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x1009397f
mov dword [esp + 0xc], ebx
jmp 0x100939b8
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x3f8]
mov dword [eax + ecx*4], 0x5261fc42
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 4
jl 0x100939a2
mov esi, dword [esp + 0x3e0]
mov dword [esi + 4], 0x18
mov dword [esp + 0xc], 0x8cccddd1
mov dword [esp + 0xc], ebx
jmp 0x10093a7a
mov eax, dword [esp + 0x3e0]
mov dword [esp + 0x3d0], 0xd68f985
mov dword [esp + 0x48], 5
mov dword [esp + 0x24], 0x79d44f4c
mov ecx, dword [eax]
mov eax, dword [esp + 0x3f8]
push 0
mov dword [eax], ecx
xor ecx, ecx
mov dword [esp + 0x3d4], 1
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x4c]
cmp eax, 0x97b0
mov eax, dword [esp + 0x3f0]
setg cl
cmp dword [eax + edx*4], ecx
mov eax, dword [esp + 0x3d4]
pop edx
setg dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [esp + 0x18]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x24]
setle dl
xor ecx, ecx
cmp edx, 0x84b7
sete cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x18]
setne dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [esp + 0x24], ecx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jle 0x100939de
dec dword [esi + 4]
cmp dword [esi + 4], 9
jge 0x100939cd
mov eax, dword [esp + 0x18]
xor ecx, ecx
imul eax, dword [esp + 0x10], 0xfffffff6
cmp eax, dword [edi + 0xc]
mov eax, dword [esp + 0x3f8]
setge cl
xor edx, edx
cmp ecx, dword [eax]
setge dl
sub edx, 0xe82b
neg edx
sbb edx, edx
xor eax, eax
inc edx
cmp edx, 5
setl al
cmp eax, 0xe3c2
jge 0x10093ad7
mov eax, dword [esp + 0x3c0]
cmp dword [eax + 4], ebx
je 0x10093ae1
cmp dword [esi + 4], ebx
je 0x10093ae1
xor ecx, ecx
inc ecx
jmp 0x10093ae3
mov ecx, ebx
dec dword [esp + 0x28]
mov eax, dword [esp + 0x10]
add eax, dword [esp + 0x28]
cmp eax, ecx
jge 0x10093af7
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x3f8]
push eax
mov dword [eax], 0x6f576105
call fcn.10123626
pop ecx
mov byte [esp + 0xa0c], 4
push dword [esp + 0x3e0]
mov dword [esp + 0x3fc], ebx
mov dword [esp + 0x400], ebx
mov dword [esp + 0x404], ebx
call fcn.10123626
mov dword [esp + 0x3e4], ebx
mov dword [esp + 0x3e8], ebx
mov dword [esp + 0x3ec], ebx
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xfffffffb
pop ecx
jle 0x1009394d
cmp dword [esp + 0x3c0], 0
je 0x10093b8d
push dword [esp + 0x3c0]
call fcn.10123626
pop ecx
mov dword [esp + 0x3c0], ebx
mov dword [esp + 0x3c4], ebx
mov dword [esp + 0x3c8], ebx
mov byte [esp + 0xa0c], 2
cmp dword [esp + 0x3ec], 0
je 0x10093bc1
push dword [esp + 0x3ec]
call fcn.10123626
pop ecx
mov dword [esp + 0x3ec], ebx
mov dword [esp + 0x3f0], ebx
mov dword [esp + 0x3f4], ebx
mov dword [esp + 0xfc], 0x71046f08
mov ecx, ebx
mov dword [esp + 0x100], 0x7b027809
mov esi, ebx
mov dword [esp + 0x104], 0x70038101
mov dword [esp + 0x108], 0x82057606
mov dword [esp + 0x10c], 0x8047600
mov dword [esp + 0x110], 0x8207346c
cmp ecx, 0x12
jne 0x10093c14
push 4
pop esi
push 0x14
pop ecx
jmp 0x10093c46
movzx eax, byte [esp + ecx + 0xfd]
lea edx, [esi - 1]
sub eax, ecx
add edx, eax
jns 0x10093c37
or eax, 0xffffffff
sub eax, edx
add edx, 0x100
and eax, 0xffffff00
add edx, eax
movzx eax, byte [esp + ecx + 0xfc]
mov byte [esp + eax + 0x4a4], dl
add ecx, 2
cmp ecx, 0x18
jb 0x10093c07
lea eax, [esp + 0x4a4]
mov byte [esp + 0x4ae], bl
push eax
lea ecx, [esp + 0x500]
call fcn.1001b5bd
mov byte [esp + 0xa0c], 6
lea edi, [esp + 0x4a4]
xor eax, eax
lea ecx, [esp + 0x724]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x34]
mov edx, dword [eax]
call fcn.10032641
mov byte [esp + 0xa0c], 7
lea ecx, [esp + 0x468]
mov dword [esp + 0xc], 0x3248c66
mov dword [esp + 0x24], 0xba6b42be
mov dword [esp + 0x24], 0x551fa4c8
push 4
call fcn.100141a5
mov dword [esp + 0x24], 0x91c84132
or edi, 0xffffffff
mov dword [esp + 0x24], 0x72d50fa8
mov dword [esp + 0x20], edi
mov dword [esp + 0x20], 0x914a
mov dword [esp + 0x10], ebx
jmp 0x10093cfa
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x468]
mov dword [eax + ecx*4], 0x5bb08661
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x10093ce4
mov eax, dword [esp + 0xc]
xor edx, edx
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
inc ecx
cmp ecx, eax
setge dl
sub edx, dword [esp + 0xc]
sub edx, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov dword [esp + 0x20], edx
xor edx, edx
cmp dword [esp + 0x20], 0x2717
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [esp + 0x24], ecx
xor ecx, ecx
mov edx, dword [esp + 0x24]
add edx, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
cmp edx, eax
mov edx, 0x1215
setge cl
mov dword [esp + 0x24], ecx
xor ecx, ecx
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
cmp eax, edx
mov esi, dword [esp + 0x468]
setl cl
add ecx, dword [esp + 0xc]
mov dword [esi + 8], edx
mov dword [esp + 0x24], ecx
cmp dword [esp + 0x24], 3
sbb edx, edx
xor ecx, ecx
inc edx
add edx, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
cmp eax, edi
setg cl
cmp ecx, edx
je 0x10093da2
cmp dword [esi + 8], ebx
jne 0x10093da2
mov eax, ebx
jmp 0x10093da5
xor eax, eax
inc eax
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x20], eax
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10093dc2
call dword [sym.imp.USER32.dll_WaitMessage]
push dword [esp + 0x468]
call fcn.10123626
mov dword [esp + 0x46c], ebx
mov dword [esp + 0x470], ebx
mov dword [esp + 0x474], ebx
mov dword [esp + 0x10], 0x68ec0ae9
mov dword [esp + 0x24], 0xbf2d3f50
pop ecx
mov dword [esp + 0xc], 0x1b
jmp 0x10093e5d
mov dword [esp + 0x18], 3
mov dword [esp + 0x10], ebx
jmp 0x10093e1f
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x814], 1
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x10093e0c
mov dword [esp + 0x18], ebx
jmp 0x10093e36
cmp dword [esp + 0x18], ebx
jne 0x10093e3d
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jle 0x10093e2c
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10093e59
push 0x1769
push 0xe14
push ebx
call dword [sym.imp.USER32.dll_RemoveMenu]
dec dword [esp + 0xc]
cmp dword [esp + 0xc], 0xfffffffa
jg 0x10093dfe
mov dword [esp + 0x20], 1
mov ecx, ebx
mov dword [esp + 0x64], 0xb066e00
mov esi, ebx
mov dword [esp + 0x68], 0x25c9eea1
mov dword [esp + 0x6c], 0x66017603
mov word [esp + 0x70], 0x6a02
cmp ecx, 2
jne 0x10093e9b
push 6
pop esi
push esi
pop ecx
jmp 0x10093ec6
movzx eax, byte [esp + ecx + 0x65]
lea edx, [esi - 1]
sub eax, ecx
add edx, eax
jns 0x10093eba
mov eax, edi
sub eax, edx
add edx, 0x100
and eax, 0xffffff00
add edx, eax
movzx eax, byte [esp + ecx + 0x64]
mov byte [esp + eax + 0x3a8], dl
add ecx, 2
cmp ecx, 0xe
jb 0x10093e8f
lea eax, [esp + 0x3a8]
mov byte [esp + 0x3ac], bl
push eax
lea ecx, [esp + 0x710]
call fcn.1001b5bd
mov byte [esp + 0xa0c], 8
lea ecx, [esp + 0x3d4]
push 2
mov dword [esp + 0x3ac], ebx
mov byte [esp + 0x3b0], bl
call fcn.100141a5
mov byte [esp + 0xa0c], 9
mov dword [esp + 0x28], 0xfffffff6
mov dword [esp + 0x10], ebx
jmp 0x10093f39
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x3d4]
mov dword [eax + ecx*4], 1
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x10093f23
mov dword [esp + 0x28], 1
cmp dword [esp + 0x28], ebx
jl 0x100940a6
push 1
lea ecx, [esp + 0x460]
call fcn.100141a5
xor edx, edx
mov dword [esp + 0x10], ebx
inc edx
jmp 0x10093f7b
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x45c]
mov dword [eax + ecx*4], edx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x10093f69
mov eax, dword [esp + 0x45c]
mov dword [eax], ebx
mov dword [esp + 0xc], edi
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10093faa
push ebx
push ebx
push 0x1cd2
push ebx
call dword [sym.imp.USER32.dll_AppendMenuA]
xor edx, edx
inc edx
mov dword [esp + 0xc], edx
cmp dword [esp + 0xc], ebx
jl 0x1009406f
mov dword [esp + 0x18], 0x5f0ed1ad
mov dword [esp + 0x18], edx
cmp dword [esp + 0x18], ebx
jl 0x1009403a
mov dword [esp + 0x10], 0x498e64e6
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10093ff9
push 0x1ef3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextAlign]
xor edx, edx
inc edx
mov dword [esp + 0x10], edx
cmp dword [esp + 0x10], ebx
jl 0x10094034
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1009401b
push ebx
push 0x7fa
push ebx
call dword [sym.imp.GDI32.dll_GetObjectW]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x3d4]
cmp dword [eax + ecx*4], ebx
jne 0x10094031
dec dword [esp + 0x10]
jns 0x10094003
xor edx, edx
inc edx
dec dword [esp + 0x18]
jns 0x10093fca
mov dword [esp + 0x18], ebx
jmp 0x1009405f
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1009405b
push 0x1aad
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
xor edx, edx
inc edx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edx
jle 0x10094040
dec dword [esp + 0xc]
jns 0x10093fb8
mov eax, dword [esp + 0x45c]
inc dword [eax]
cmp dword [eax], edx
jle 0x10093f8a
push eax
call fcn.10123626
mov dword [esp + 0x460], ebx
mov dword [esp + 0x464], ebx
mov dword [esp + 0x468], ebx
dec dword [esp + 0x2c]
pop ecx
jns 0x10093f52
mov byte [esp + 0xa0c], 8
cmp dword [esp + 0x3d4], 0
je 0x100940da
push dword [esp + 0x3d4]
call fcn.10123626
pop ecx
mov dword [esp + 0x3d4], ebx
mov dword [esp + 0x3d8], ebx
mov dword [esp + 0x3dc], ebx
push 3
lea ecx, [esp + 0x454]
call fcn.100141a5
push 3
pop edx
mov dword [esp + 0x20], edx
mov dword [esp + 0xc], ebx
jmp 0x10094108
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x474], 0xae35
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jl 0x100940f5
mov dword [esp + 0xc], ebx
jmp 0x1009412a
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x450]
mov dword [eax + ecx*4], 0xcd453606
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jl 0x10094114
mov edi, dword [esp + 0x450]
mov dword [edi + 8], 2
mov dword [esp + 0x20], 5
mov dword [esp + 0x24], 0x2aa9dade
cmp dword [edi + 8], ebx
je 0x1009415e
cmp dword [esp + 0x24], ebx
je 0x1009415e
xor ecx, ecx
inc ecx
jmp 0x10094160
mov ecx, ebx
mov eax, dword [esp + 0x474]
sub ecx, eax
cmp ecx, dword [esp + 0x478]
jge 0x1009417c
cmp dword [edi + 8], ebx
je 0x1009417c
xor ecx, ecx
inc ecx
jmp 0x1009417e
mov ecx, ebx
mov eax, dword [edi + 8]
mov esi, 0x693009c
sub eax, ecx
mov ecx, dword [esp + 0x20]
dec ecx
add ecx, eax
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
sub esi, ecx
mov ecx, dword [esp + 0x478]
mov eax, dword [esp + 0x474]
cmp ecx, eax
setg dl
xor eax, eax
cmp edx, esi
setl al
dec dword [edi + 8]
mov dword [esp + 0x24], eax
jns 0x1009413e
mov edx, dword [esp + 0x450]
xor ecx, ecx
push edx
mov eax, dword [edx + 4]
add eax, 0xab79
cmp eax, 0x2c02
setle cl
mov dword [esp + 0x24], ecx
call fcn.10123626
pop ecx
mov dword [esp + 0x450], ebx
mov ecx, ebx
mov dword [esp + 0x454], ebx
mov esi, ebx
mov dword [esp + 0x458], ebx
mov dword [esp + 0x1f4], 0x71097506
mov dword [esp + 0x1f8], 0x79017408
mov dword [esp + 0x1fc], 0x7b007d03
mov dword [esp + 0x200], 0x8107204
mov dword [esp + 0x204], 0x8b2c3891
mov dword [esp + 0x208], 0x855baeef
mov dword [esp + 0x20c], 0xbfd1eea2
mov dword [esp + 0x210], 0x78079d63
mov dword [esp + 0x214], 0x76058002
cmp ecx, 0xe
jne 0x10094269
push 0x10
pop esi
push 0x1c
pop ecx
jmp 0x1009429b
movzx eax, byte [esp + ecx + 0x1f5]
lea edx, [esi - 1]
sub eax, ecx
add edx, eax
jns 0x1009428c
or eax, 0xffffffff
sub eax, edx
add edx, 0x100
and eax, 0xffffff00
add edx, eax
movzx eax, byte [esp + ecx + 0x1f4]
mov byte [esp + eax + 0x498], dl
add ecx, 2
cmp ecx, 0x24
jb 0x1009425c
lea eax, [esp + 0x498]
mov byte [esp + 0x4a2], bl
push eax
lea ecx, [esp + 0x610]
call fcn.1001b5bd
mov byte [esp + 0xa0c], 0xa
lea edi, [esp + 0x498]
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [esp + 0x10], 1
mov dword [esp + 0x10], 0xfffffff0
jmp 0x10094321
mov dword [esp + 0x20], 0x8b10
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10094317
push 1
push 0x1191
push 0x1e5
push 0x157e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollRange]
cmp dword [esp + 0x20], ebx
jne 0x10094328
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xffffffe8
jne 0x100942e6
mov eax, dword [esp + 0x44]
mov byte [esp + 0x3cc], bl
cmp byte [eax + 0x48], 0
je 0x100943b7
lea ecx, [eax + 0x4c]
push ecx
push dword [ebp + 0x10]
lea ecx, [esp + 0x3d4]
push ecx
lea edx, [eax + 0x30]
lea ecx, [eax + 0x18]
call fcn.10033124
add esp, 0xc
test al, al
jne 0x10094363
mov byte [esp + 0x1f], bl
jmp 0x1009633f
lea eax, [esp + 0x70c]
push eax
push ecx
mov ecx, dword [ebp + 0x10]
lea eax, [esp + 0x614]
push eax
call fcn.1001c95a
pop ecx
mov ecx, eax
call fcn.1001c95a
mov esi, eax
lea edx, [esp + 0x4fc]
push ebx
mov ecx, esi
call fcn.1001cd44
pop ecx
push ebx
push ecx
lea eax, [esp + 0x504]
mov ecx, esi
push eax
call fcn.1001c95a
pop ecx
lea edx, [esp + 0x728]
mov ecx, eax
call fcn.1001cd44
pop ecx
mov dword [esp + 0x20], 0xff18ee85
mov dword [esp + 0x10], ebx
jmp 0x100943d5
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x38], 0x4fd3df75
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 1
jl 0x100943c5
mov dword [esp + 0x38], 0xffffffe3
jmp 0x10094464
mov dword [esp + 0x18], 0xfffffff6
cmp dword [esp + 0x18], ebx
je 0x10094410
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
dec ecx
neg ecx
sbb ecx, ecx
neg ecx
sub eax, ecx
je 0x10094410
xor ecx, ecx
inc ecx
jmp 0x10094412
mov ecx, ebx
mov eax, dword [esp + 0x18]
imul eax, ecx
neg eax
sbb eax, eax
neg eax
add eax, 0xffff
je 0x10094431
cmp dword [esp + 0x38], ebx
je 0x10094431
xor eax, eax
inc eax
jmp 0x10094433
mov eax, ebx
push 0xfffffffffffffffe
pop ecx
cmp ecx, eax
sbb eax, eax
inc eax
sub eax, dword [esp + 0x38]
cmp eax, 0xfffffffb
jg 0x1009444f
cmp dword [esp + 0x18], ebx
je 0x1009444f
xor edx, edx
inc edx
jmp 0x10094451
mov edx, ebx
mov eax, dword [esp + 0x18]
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [esp + 0x20], ecx
inc dword [esp + 0x38]
cmp dword [esp + 0x38], 0xffffffed
jne 0x100943e6
mov ecx, dword [ebp + 0x10]
lea edx, [esp + 0x4fc]
push ebx
call fcn.1001cd44
pop ecx
push ebx
lea edx, [esp + 0x728]
mov dword [esp + 0x4c], eax
mov ecx, eax
call fcn.1001cd44
pop ecx
mov dword [esp + 0x10], 0x8e5c
lea ecx, [esp + 0x4bc]
push 4
mov edi, eax
call fcn.100141a5
mov dword [esp + 0x24], 0xd711e7bf
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x20], 9
mov dword [esp + 0xc], ebx
jmp 0x100944e0
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x4bc]
mov dword [eax + ecx*4], 0xfffffffb
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 4
jl 0x100944ca
mov dword [esp + 0xc], ebx
jmp 0x100944fd
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x30], 0xc60edac7
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 1
jl 0x100944ed
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x4bc]
mov dword [ecx + 8], eax
test eax, eax
je 0x10094553
mov dword [esp + 0x24], 0x7308f472
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov dword [ecx + 8], edx
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [esp + 0x30], ecx
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x28], ebx
je 0x10094553
xor eax, eax
inc eax
jmp 0x10094555
mov eax, ebx
push dword [esp + 0x4bc]
mov dword [esp + 0x24], eax
call fcn.10123626
pop ecx
push 7
lea ecx, [esp + 0x6cc]
call fcn.1001be44
lea edx, [esp + 0x424]
mov byte [esp + 0xa0c], 0xb
mov ecx, edi
call fcn.10028d0a
test al, al
je 0x100945a1
lea eax, [esp + 0x424]
mov ecx, edi
push eax
call fcn.1001c95a
mov esi, eax
jmp 0x100945a8
lea esi, [esp + 0x6c8]
sub esp, 0x18
lea eax, [esp + 0x7a8]
mov ecx, esp
mov dword [esp + 0x48], esp
push eax
call fcn.10018f9d
sub esp, 0x18
mov byte [esp + 0xa3c], 0xc
lea eax, [esp + 0x454]
mov dword [esp + 0x50], esp
mov ecx, esp
push eax
call fcn.10018f9d
mov eax, dword [esp + 0x64]
lea ecx, [esp + 0xa00]
mov byte [esp + 0xa3c], 0xd
push 0xb
mov edx, dword [eax]
call fcn.10099e70
pop ecx
mov byte [esp + 0xa3c], 0xe
cmp dword [eax + 0x10], ebx
sete byte [esp + 0x60]
mov edx, dword [esp + 0x74]
mov ecx, dword [edx + 0x50]
lea eax, [ecx + 0x90]
push eax
push ebx
push dword [esp + 0x68]
push dword [ecx + 0xa8]
mov ecx, esi
push dword [edx + 0x54]
mov byte [esp + 0xa50], 0xf
mov edx, dword [edx + 0x4c]
call fcn.1009da01
add esp, 0x44
mov byte [esp + 0xa0c], 0xb
lea ecx, [esp + 0x9d0]
push ebx
push 1
call fcn.10014706
push esi
push ecx
lea eax, [esp + 0x42c]
mov ecx, edi
push eax
call fcn.1001c95a
pop ecx
mov ecx, eax
call fcn.1001c0d6
mov edi, dword [esp + 0x44]
cmp byte [edi + 0x48], 0
je 0x100946a3
sub esp, 0x18
lea eax, [esp + 0x43c]
mov ecx, esp
push eax
call fcn.10018f9d
push dword [edi + 0x4c]
mov ecx, dword [ebp + 0x10]
lea eax, [edi + 0x30]
push esi
push dword [esp + 0x3ec]
lea edx, [edi + 0x18]
push eax
call fcn.1002de67
add esp, 0x28
mov dword [esp + 0x270], 0x6e00650d
mov ecx, ebx
mov dword [esp + 0x274], 0x690a7301
mov esi, ebx
mov dword [esp + 0x278], 0x770b6e0c
mov dword [esp + 0x27c], 0x7d048403
mov dword [esp + 0x280], 0x72057209
mov dword [esp + 0x284], 0x7b068402
mov dword [esp + 0x288], 0x84078c08
mov dword [esp + 0x28c], 0x5b039a11
mov dword [esp + 0x290], 0xf96a848b
mov dword [esp + 0x294], 0xe060b176
mov dword [esp + 0x298], 0x6c4b9aab
mov byte [esp + 0x29c], 0x60
cmp ecx, 0x1c
jne 0x10094735
push 0x11
pop esi
push 0x2b
pop ecx
jmp 0x10094767
movzx eax, byte [esp + ecx + 0x271]
lea edx, [esi - 1]
sub eax, ecx
add edx, eax
jns 0x10094758
or eax, 0xffffffff
sub eax, edx
add edx, 0x100
and eax, 0xffffff00
add edx, eax
movzx eax, byte [esp + ecx + 0x270]
mov byte [esp + eax + 0x52c], dl
add ecx, 2
cmp ecx, 0x2d
jb 0x10094728
lea eax, [esp + 0x52c]
mov byte [esp + 0x53a], bl
push eax
lea ecx, [esp + 0x568]
call fcn.1001b5bd
mov esi, dword [esp + 0x44]
lea edi, [esp + 0x52c]
mov byte [esp + 0xa0c], 0x10
xor eax, eax
stosd dword es:[edi], eax
cmp byte [esi + 0x48], 0
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
je 0x10094a0a
mov edi, dword [esp + 0x48]
lea edx, [esp + 0x564]
mov ecx, edi
call fcn.10093557
test al, al
je 0x100949f2
lea eax, [esp + 0x564]
mov ecx, edi
push eax
call fcn.1001c95a
lea edx, [esp + 0x424]
mov ecx, eax
call fcn.1001cde4
test al, al
je 0x100949f2
mov dword [esp + 0x36c], 0x72076617
mov ecx, ebx
mov dword [esp + 0x370], 0x7a056e12
mov esi, ebx
mov dword [esp + 0x374], 0x7e098101
mov dword [esp + 0x378], 0x6e10780b
mov dword [esp + 0x37c], 0x77187600
mov dword [esp + 0x380], 0x850c430a
mov dword [esp + 0x384], 0x7d157e03
mov dword [esp + 0x388], 0x8d088111
mov dword [esp + 0x38c], 0x96138214
mov dword [esp + 0x390], 0x950f940d
mov dword [esp + 0x394], 0x97169206
mov dword [esp + 0x398], 0xa302a40e
mov dword [esp + 0x39c], 0x336fff08
mov dword [esp + 0x3a0], 0x53d769de
mov word [esp + 0x3a4], 0x9f04
cmp ecx, 0x30
jne 0x100948a3
push 8
pop esi
push 0x36
pop ecx
jmp 0x100948d5
movzx eax, byte [esp + ecx + 0x36d]
lea edx, [esi - 1]
sub eax, ecx
add edx, eax
jns 0x100948c6
or eax, 0xffffffff
sub eax, edx
add edx, 0x100
and eax, 0xffffff00
add edx, eax
movzx eax, byte [esp + ecx + 0x36c]
mov byte [esp + eax + 0x764], dl
add ecx, 2
cmp ecx, 0x3a
jb 0x10094896
lea eax, [esp + 0x764]
mov byte [esp + 0x77d], bl
push eax
lea ecx, [esp + 0x884]
call fcn.1001b5bd
mov esi, eax
push ecx
push ecx
lea eax, [esp + 0x56c]
mov byte [esp + 0xa14], 0x11
push eax
mov ecx, edi
call fcn.1001c95a
pop ecx
push eax
push esi
mov esi, dword [esp + 0x50]
lea ecx, [esp + 0x7b4]
lea eax, [esi + 0x30]
push eax
lea edx, [esi + 0x18]
call fcn.10032db0
add esp, 0x10
push ebx
push 1
lea ecx, [esp + 0x888]
mov byte [esp + 0xa14], 0x13
call fcn.10016cae
push 6
pop ecx
xor eax, eax
lea edi, [esp + 0x764]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x678]
stosw word es:[edi], ax
lea eax, [esp + 0x7a8]
push eax
call fcn.1001bef9
lea eax, [esp + 0x678]
mov byte [esp + 0xa0c], 0x14
push eax
push ecx
lea eax, [esp + 0x56c]
push eax
push ecx
lea eax, [esp + 0x50c]
push eax
push ecx
lea eax, [esp + 0x724]
push eax
push ecx
mov ecx, dword [ebp + 0x10]
lea eax, [esp + 0x62c]
push eax
call fcn.1001c95a
pop ecx
mov ecx, eax
call fcn.1001c95a
pop ecx
mov ecx, eax
call fcn.1001c95a
pop ecx
mov ecx, eax
call fcn.1001c95a
pop ecx
mov ecx, eax
call fcn.1001c0d6
lea ecx, [esp + 0x678]
mov byte [esp + 0xa0c], 0x13
call fcn.1001c059
push ebx
push 1
lea ecx, [esp + 0x7b0]
mov byte [esp + 0xa14], 0x10
call fcn.10016cae
cmp byte [esi + 0x48], 0
je 0x10094a0a
push ecx
mov ecx, dword [ebp + 0x10]
lea eax, [esi + 0x30]
push eax
lea edx, [esi + 0x18]
call fcn.100329ee
pop ecx
pop ecx
mov edi, dword [ebp + 0xc]
mov ecx, edi
call fcn.100317d4
push ebx
lea edx, [esp + 0x500]
mov ecx, edi
call fcn.1001cd44
pop ecx
xor ecx, ecx
mov dword [esp + 0x28], eax
cmp byte [esp + 0x1f], cl
mov edx, eax
setne cl
push ecx
lea ecx, [esp + 0x428]
call fcn.1009d437
mov edx, dword [esi + 0x4c]
pop ecx
push 0x13
lea ecx, [esp + 0x740]
call fcn.1009a511
pop ecx
mov byte [esp + 0xa0c], 0x15
mov edx, edi
push dword [esi + 0x4c]
mov ecx, eax
call fcn.100a3cef
pop ecx
lea ecx, [esp + 0x73c]
mov byte [esp + 0xa0c], 0x10
call fcn.1002897c
cmp byte [esp + 0x1f], 0
je 0x10095a04
cmp byte [esi + 0x48], 0
je 0x10094a9b
lea edx, [esp + 0x60c]
mov ecx, edi
call fcn.1001cde4
mov dword [esp + 0x244], 0x6f05620c
mov ecx, ebx
mov dword [esp + 0x248], 0x770a6602
mov esi, ebx
mov dword [esp + 0x24c], 0x7e077d08
mov dword [esp + 0x250], 0x84097901
mov dword [esp + 0x254], 0x780e7300
mov dword [esp + 0x258], 0x8006790b
mov dword [esp + 0x25c], 0x8f0e8d0d
mov dword [esp + 0x260], 0xe3a6c764
mov dword [esp + 0x264], 0x15c17ed2
mov dword [esp + 0x268], 0xc6a72df5
mov dword [esp + 0x26c], 0x80038604
cmp ecx, 0x1a
jne 0x10094b25
push 0xe
pop esi
push 0x26
pop ecx
jmp 0x10094b57
movzx eax, byte [esp + ecx + 0x245]
lea edx, [esi - 1]
sub eax, ecx
add edx, eax
jns 0x10094b48
or eax, 0xffffffff
sub eax, edx
add edx, 0x100
and eax, 0xffffff00
add edx, eax
movzx eax, byte [esp + ecx + 0x244]
mov byte [esp + eax + 0x588], dl
add ecx, 2
cmp ecx, 0x2c
jb 0x10094b18
lea eax, [esp + 0x588]
mov byte [esp + 0x597], bl
push eax
lea ecx, [esp + 0x92c]
call fcn.1001b5bd
mov byte [esp + 0xa0c], 0x16
lea edi, [esp + 0x588]
xor eax, eax
mov dword [esp + 0x2a0], 0x77087609
stosd dword es:[edi], eax
mov ecx, ebx
mov dword [esp + 0x2a4], 0x7204750a
mov esi, ebx
mov dword [esp + 0x2a8], 0x6e036a02
mov dword [esp + 0x2ac], 0x730b6f00
stosd dword es:[edi], eax
mov dword [esp + 0x2b0], 0x780e720c
mov dword [esp + 0x2b4], 0x3c93bf10
mov dword [esp + 0x2b8], 0x6e64e082
stosd dword es:[edi], eax
mov dword [esp + 0x2bc], 0xa4b033c
mov dword [esp + 0x2c0], 0xff91c0bd
mov dword [esp + 0x2c4], 0x8a078101
stosd dword es:[edi], eax
mov dword [esp + 0x2c8], 0x84068505
mov word [esp + 0x2cc], 0x910d
cmp ecx, 0x14
jne 0x10094c23
push 0x10
pop esi
push 0x22
pop ecx
jmp 0x10094c55
movzx eax, byte [esp + ecx + 0x2a1]
lea edx, [esi - 1]
sub eax, ecx
add edx, eax
jns 0x10094c46
or eax, 0xffffffff
sub eax, edx
add edx, 0x100
and eax, 0xffffff00
add edx, eax
movzx eax, byte [esp + ecx + 0x2a0]
mov byte [esp + eax + 0x5a4], dl
add ecx, 2
cmp ecx, 0x2e
jb 0x10094c16
push 7
lea ecx, [esp + 0x784]
mov byte [esp + 0x5b7], bl
call fcn.1001be44
mov esi, eax
lea eax, [esp + 0x5a4]
mov byte [esp + 0xa0c], 0x17
push eax
lea ecx, [esp + 0x944]
call fcn.1001b5bd
push esi
push ecx
mov ecx, dword [esp + 0x30]
push eax
mov byte [esp + 0xa18], 0x18
call fcn.1001c95a
pop ecx
mov ecx, eax
call fcn.1001c0d6
push ebx
push 1
lea ecx, [esp + 0x948]
call fcn.10016cae
lea ecx, [esp + 0x780]
mov byte [esp + 0xa0c], 0x16
call fcn.1001c059
xor eax, eax
mov dword [esp + 0x300], 0x640c660e
lea edi, [esp + 0x5a4]
mov dword [esp + 0x304], 0x7c09750a
stosd dword es:[edi], eax
mov ecx, ebx
mov dword [esp + 0x308], 0x74067d08
mov esi, ebx
mov dword [esp + 0x30c], 0x7b058007
mov dword [esp + 0x310], 0x75007403
stosd dword es:[edi], eax
mov dword [esp + 0x314], 0x7802890d
mov dword [esp + 0x318], 0x87017d0b
mov dword [esp + 0x31c], 0x82138804
stosd dword es:[edi], eax
mov dword [esp + 0x320], 0xd42d026
mov dword [esp + 0x324], 0xed3e4ff5
mov dword [esp + 0x328], 0x8a53c51d
stosd dword es:[edi], eax
mov dword [esp + 0x32c], 0x7c9486f2
mov byte [esp + 0x330], 0x39
cmp ecx, 0x1e
jne 0x10094d79
push 0x13
pop esi
push 0x2f
pop ecx
jmp 0x10094dab
movzx eax, byte [esp + ecx + 0x301]
lea edx, [esi - 1]
sub eax, ecx
add edx, eax
jns 0x10094d9c
or eax, 0xffffffff
sub eax, edx
add edx, 0x100
and eax, 0xffffff00
add edx, eax
movzx eax, byte [esp + ecx + 0x300]
mov byte [esp + eax + 0x554], dl
add ecx, 2
cmp ecx, 0x31
jb 0x10094d6c
mov byte [esp + 0x563], bl
mov ecx, ebx
mov dword [esp + 0xe4], 0x6c046601
mov esi, ebx
mov dword [esp + 0xe8], 0x839e9509
mov dword [esp + 0xec], 0x82c66644
mov dword [esp + 0xf0], 0x3730626
mov dword [esp + 0xf4], 0x78057a
mov word [esp + 0xf8], 0x281
mov byte [esp + 0xfa], 0x7f
cmp ecx, 4
jne 0x10094e14
push 9
pop esi
push 0xb
pop ecx
jmp 0x10094e46
movzx eax, byte [esp + ecx + 0xe5]
lea edx, [esi - 1]
sub eax, ecx
add edx, eax
jns 0x10094e37
or eax, 0xffffffff
sub eax, edx
add edx, 0x100
and eax, 0xffffff00
add edx, eax
movzx eax, byte [esp + ecx + 0xe4]
mov byte [esp + eax + 0x414], dl
add ecx, 2
cmp ecx, 0x17
jb 0x10094e07
mov byte [esp + 0x41b], bl
mov ecx, ebx
mov dword [esp + 0x334], 0xf70f3200
mov esi, ebx
mov dword [esp + 0x338], 0x6575c82d
mov dword [esp + 0x33c], 0x40fdea63
mov dword [esp + 0x340], 0x3f978bb5
mov dword [esp + 0x344], 0x103a0f8f
mov dword [esp + 0x348], 0x12380633
mov dword [esp + 0x34c], 0x13b0e3b
mov dword [esp + 0x350], 0xb3d083f
mov dword [esp + 0x354], 0x5440a49
mov dword [esp + 0x358], 0x9450c45
mov dword [esp + 0x35c], 0x11540d4e
mov dword [esp + 0x360], 0x3510251
mov dword [esp + 0x364], 0x4580752
mov byte [esp + 0x368], 0x57
cmp ecx, 2
jne 0x10094efc
push 0xf
pop esi
push esi
pop ecx
jmp 0x10094f2e
movzx eax, byte [esp + ecx + 0x335]
lea edx, [esi - 1]
sub eax, ecx
add edx, eax
jns 0x10094f1f
or eax, 0xffffffff
sub eax, edx
add edx, 0x100
and eax, 0xffffff00
add edx, eax
movzx eax, byte [esp + ecx + 0x334]
mov byte [esp + eax + 0x624], dl
add ecx, 2
cmp ecx, 0x35
jb 0x10094ef0
lea eax, [esp + 0x624]
mov byte [esp + 0x637], bl
push eax
lea ecx, [esp + 0x8e4]
call fcn.1001b5bd
push eax
lea ecx, [esp + 0x6bc]
mov byte [esp + 0xa10], 0x19
call fcn.1001bef9
lea eax, [esp + 0x414]
mov byte [esp + 0xa0c], 0x1a
push eax
lea ecx, [esp + 0x9a4]
call fcn.1001b5bd
mov esi, eax
lea eax, [esp + 0x554]
mov byte [esp + 0xa0c], 0x1b
push eax
lea ecx, [esp + 0x8b4]
call fcn.1001b5bd
lea ecx, [esp + 0x6b8]
mov byte [esp + 0xa0c], 0x1c
push ecx
push ecx
push esi
push ecx
mov ecx, dword [esp + 0x38]
push eax
call fcn.1001c95a
pop ecx
mov ecx, eax
call fcn.1001c95a
pop ecx
mov ecx, eax
call fcn.1001c0d6
push ebx
push 1
lea ecx, [esp + 0x8b8]
call fcn.10016cae
push ebx
push 1
lea ecx, [esp + 0x9a8]
call fcn.10016cae
lea ecx, [esp + 0x6b8]
mov byte [esp + 0xa0c], 0x19
call fcn.1001c059
push ebx
push 1
lea ecx, [esp + 0x8e8]
mov byte [esp + 0xa14], 0x16
call fcn.10016cae
xor eax, eax
mov dword [esp + 0x414], ebx
lea edi, [esp + 0x554]
mov dword [esp + 0x418], ebx
stosd dword es:[edi], eax
mov ecx, ebx
mov dword [esp + 0x130], 0x72046302
mov esi, ebx
mov dword [esp + 0x134], 0xbf0a6805
mov dword [esp + 0x138], 0x6c38aab4
stosd dword es:[edi], eax
mov dword [esp + 0x13c], 0x50d033a4
mov dword [esp + 0x140], 0x6d017206
mov dword [esp + 0x144], 0x6e007d08
stosd dword es:[edi], eax
mov dword [esp + 0x148], 0x76077b03
stosd dword es:[edi], eax
xor eax, eax
lea edi, [esp + 0x624]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
cmp ecx, 6
jne 0x1009509d
push 0xa
pop esi
push 0xe
pop ecx
jmp 0x100950cf
movzx eax, byte [esp + ecx + 0x131]
lea edx, [esi - 1]
sub eax, ecx
add edx, eax
jns 0x100950c0
or eax, 0xffffffff
sub eax, edx
add edx, 0x100
and eax, 0xffffff00
add edx, eax
movzx eax, byte [esp + ecx + 0x130]
mov byte [esp + eax + 0x480], dl
add ecx, 2
cmp ecx, 0x1c
jb 0x10095090
lea eax, [esp + 0x480]
mov byte [esp + 0x489], bl
push eax
lea ecx, [esp + 0x800]
call fcn.1001b5bd
mov ecx, dword [ebp + 0xc]
mov edx, eax
mov byte [esp + 0xa0c], 0x1d
call fcn.1001cde4
push ebx
push 1
lea ecx, [esp + 0x804]
call fcn.10016cae
xor eax, eax
mov dword [esp + 0x114], 0x68057002
lea edi, [esp + 0x480]
mov dword [esp + 0x118], 0x160b7701
stosd dword es:[edi], eax
mov ecx, ebx
mov dword [esp + 0x11c], 0xca5446ad
mov esi, ebx
mov dword [esp + 0x120], 0x475494f1
mov dword [esp + 0x124], 0x67a0444
stosd dword es:[edi], eax
mov dword [esp + 0x128], 0x82037b
mov byte [esp + 0x12c], 0x6f
stosw word es:[edi], ax
cmp ecx, 6
jne 0x1009517b
push 0xb
pop esi
push 0xf
pop ecx
jmp 0x100951ad
movzx eax, byte [esp + ecx + 0x115]
lea edx, [esi - 1]
sub eax, ecx
add edx, eax
jns 0x1009519e
or eax, 0xffffffff
sub eax, edx
add edx, 0x100
and eax, 0xffffff00
add edx, eax
movzx eax, byte [esp + ecx + 0x114]
mov byte [esp + eax + 0x40c], dl
add ecx, 2
cmp ecx, 0x19
jb 0x1009516e
mov byte [esp + 0x413], bl
mov edx, ebx
mov dword [esp + 0x2d0], 0x62106616
mov dword [esp + 0x2d4], 0x68136405
mov dword [esp + 0x2d8], 0x7a086e0a
mov dword [esp + 0x2dc], 0x7d127211
mov dword [esp + 0x2e0], 0x79007504
mov dword [esp + 0x2e4], 0x7b178506
mov dword [esp + 0x2e8], 0x8d078d0c
mov dword [esp + 0x2ec], 0x93097e02
mov dword [esp + 0x2f0], 0x98038a0d
mov dword [esp + 0x2f4], 0x950f880b
mov dword [esp + 0x2f8], 0x97159b01
mov dword [esp + 0x2fc], 0x9e0e8f14
movzx ecx, byte [esp + edx + 0x2d1]
sub ecx, edx
dec ecx
jns 0x10095261
or eax, 0xffffffff
sub eax, ecx
add ecx, 0x100
and eax, 0xffffff00
add ecx, eax
movzx eax, byte [esp + edx + 0x2d0]
add edx, 2
mov byte [esp + eax + 0x748], cl
cmp edx, 0x30
jb 0x10095242
push ebx
lea ecx, [esp + 0x65c]
mov byte [esp + 0x764], bl
call fcn.1001bf35
lea eax, [esp + 0x748]
mov byte [esp + 0xa0c], 0x1e
push eax
lea ecx, [esp + 0x86c]
call fcn.1001b5bd
mov esi, eax
lea eax, [esp + 0x40c]
mov byte [esp + 0xa0c], 0x1f
push eax
lea ecx, [esp + 0x83c]
call fcn.1001b5bd
lea ecx, [esp + 0x658]
mov byte [esp + 0xa0c], 0x20
push ecx
push ecx
push esi
push ecx
mov ecx, dword [ebp + 0xc]
push eax
call fcn.1001c95a
pop ecx
mov ecx, eax
call fcn.1001c95a
pop ecx
mov ecx, eax
call fcn.1001c0d6
push ebx
push 1
lea ecx, [esp + 0x840]
call fcn.10016cae
push ebx
push 1
lea ecx, [esp + 0x870]
call fcn.10016cae
lea ecx, [esp + 0x658]
mov byte [esp + 0xa0c], 0x16
call fcn.1001c059
push 6
pop ecx
xor eax, eax
mov dword [esp + 0x40c], ebx
lea edi, [esp + 0x748]
mov dword [esp + 0x410], ebx
rep stosd dword es:[edi], eax
mov dword [esp + 0x188], 0x73006606
mov ecx, ebx
mov dword [esp + 0x18c], 0x73057402
mov esi, ebx
mov dword [esp + 0x190], 0x74046f03
stosb byte es:[edi], al
mov dword [esp + 0x194], 0xdc137f01
mov dword [esp + 0x198], 0x12c5f125
mov dword [esp + 0x19c], 0x6e1c427b
mov dword [esp + 0x1a0], 0xbb80fe88
mov dword [esp + 0x1a4], 0x4c71ff73
mov byte [esp + 0x1a8], 0xda
cmp ecx, 0xe
jne 0x100953b2
push 0x13
pop esi
push 0x1f
pop ecx
jmp 0x100953e4
movzx eax, byte [esp + ecx + 0x189]
lea edx, [esi - 1]
sub eax, ecx
add edx, eax
jns 0x100953d5
or eax, 0xffffffff
sub eax, edx
add edx, 0x100
and eax, 0xffffff00
add edx, eax
movzx eax, byte [esp + ecx + 0x188]
mov byte [esp + eax + 0x41c], dl
add ecx, 2
cmp ecx, 0x21
jb 0x100953a5
lea eax, [esp + 0x41c]
mov byte [esp + 0x423], bl
push eax
lea ecx, [esp + 0x518]
call fcn.1001b5bd
mov byte [esp + 0xa0c], 0x21
mov ecx, ebx
mov dword [esp + 0x41c], ebx
mov esi, ebx
mov dword [esp + 0x420], ebx
mov dword [esp + 0x1d0], 0x6600740f
mov dword [esp + 0x1d4], 0x6c04790b
mov dword [esp + 0x1d8], 0x6a077c08
mov dword [esp + 0x1dc], 0x83067b02
mov dword [esp + 0x1e0], 0x82017f0d
mov dword [esp + 0x1e4], 0x800c890a
mov dword [esp + 0x1e8], 0x80098d03
mov dword [esp + 0x1ec], 0x860e8b05
mov dword [esp + 0x1f0], 0x8c3f8404
cmp ecx, 0x20
jne 0x10095491
push 4
pop esi
push 0x22
pop ecx
jmp 0x100954c3
movzx eax, byte [esp + ecx + 0x1d1]
lea edx, [esi - 1]
sub eax, ecx
add edx, eax
jns 0x100954b4
or eax, 0xffffffff
sub eax, edx
add edx, 0x100
and eax, 0xffffff00
add edx, eax
movzx eax, byte [esp + ecx + 0x1d0]
mov byte [esp + eax + 0x5b4], dl
add ecx, 2
cmp ecx, 0x24
jb 0x10095484
lea eax, [esp + 0x5b4]
mov byte [esp + 0x5c4], bl
push eax
lea ecx, [esp + 0x540]
call fcn.1001b5bd
mov byte [esp + 0xa0c], 0x22
lea edi, [esp + 0x5b4]
xor eax, eax
mov dword [esp + 0xa4], 0x7b017505
stosd dword es:[edi], eax
mov edx, ebx
mov dword [esp + 0xa8], 0x6c036a00
mov dword [esp + 0xac], 0x79087206
mov dword [esp + 0xb0], 0x72028009
stosd dword es:[edi], eax
mov dword [esp + 0xb4], 0x83048007
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosb byte es:[edi], al
movzx ecx, byte [esp + edx + 0xa5]
sub ecx, edx
dec ecx
jns 0x10095554
or eax, 0xffffffff
sub eax, ecx
add ecx, 0x100
and eax, 0xffffff00
add ecx, eax
movzx eax, byte [esp + edx + 0xa4]
add edx, 2
mov byte [esp + eax + 0x48c], cl
cmp edx, 0x14
jb 0x10095535
mov dword [esp + 0x14c], 0x75057807
mov ecx, ebx
mov dword [esp + 0x150], 0x69046c0b
mov esi, ebx
mov dword [esp + 0x154], 0x790a7806
mov dword [esp + 0x158], 0x70017609
mov dword [esp + 0x15c], 0xb7f6a104
mov dword [esp + 0x160], 0x78038400
mov dword [esp + 0x164], 0x8a087b02
cmp ecx, 0x10
jne 0x10095a62
push 4
pop esi
push 0x12
pop ecx
jmp 0x10095a94
movzx eax, byte [esp + ecx + 0x14d]
lea edx, [esi - 1]
sub eax, ecx
add edx, eax
jns 0x10095a85
or eax, 0xffffffff
sub eax, edx
add edx, 0x100
and eax, 0xffffff00
add edx, eax
movzx eax, byte [esp + ecx + 0x14c]
mov byte [esp + eax + 0x4ec], dl
add ecx, 2
cmp ecx, 0x1c
jb 0x10095a55
lea eax, [esp + 0x4ec]
mov byte [esp + 0x4f8], bl
push eax
lea ecx, [esp + 0x95c]
call fcn.1001b5bd
push ebx
mov edx, eax
mov byte [esp + 0xa10], 0x2d
mov ecx, edi
call fcn.1001cd44
pop ecx
push ebx
push 1
lea ecx, [esp + 0x960]
mov dword [esp + 0x38], eax
call fcn.10016cae
xor eax, eax
mov dword [esp + 0x168], 0x68056202
lea edi, [esp + 0x4ec]
mov dword [esp + 0x16c], 0x23107301
stosd dword es:[edi], eax
mov ecx, ebx
mov dword [esp + 0x170], 0x85a31e67
mov esi, ebx
mov dword [esp + 0x174], 0xc81e0538
mov dword [esp + 0x178], 0xe373989b
stosd dword es:[edi], eax
mov dword [esp + 0x17c], 0x7304233c
mov dword [esp + 0x180], 0x70006d06
mov word [esp + 0x184], 0x6f03
stosd dword es:[edi], eax
stosb byte es:[edi], al
cmp ecx, 6
jne 0x10095b52
push 0x10
pop esi
push 0x14
pop ecx
jmp 0x10095b84
movzx eax, byte [esp + ecx + 0x169]
lea edx, [esi - 1]
sub eax, ecx
add edx, eax
jns 0x10095b75
or eax, 0xffffffff
sub eax, edx
add edx, 0x100
and eax, 0xffffff00
add edx, eax
movzx eax, byte [esp + ecx + 0x168]
mov byte [esp + eax + 0x404], dl
add ecx, 2
cmp ecx, 0x1e
jb 0x10095b45
push ebx
lea ecx, [esp + 0x63c]
mov byte [esp + 0x40f], bl
call fcn.1001bf35
lea eax, [esp + 0x404]
mov byte [esp + 0xa0c], 0x2e
push eax
lea ecx, [esp + 0x98c]
call fcn.1001b5bd
lea ecx, [esp + 0x638]
mov byte [esp + 0xa0c], 0x2f
push ecx
push ecx
mov ecx, dword [esp + 0x38]
push eax
call fcn.1001c95a
pop ecx
mov ecx, eax
call fcn.1001c0d6
push ebx
push 1
lea ecx, [esp + 0x990]
call fcn.10016cae
lea ecx, [esp + 0x638]
mov byte [esp + 0xa0c], 0x10
call fcn.1001c059
mov dword [esp + 0x404], ebx
mov ecx, ebx
mov dword [esp + 0x408], ebx
mov esi, ebx
mov dword [esp + 0x218], 0x710b730f
mov dword [esp + 0x21c], 0x7b036e09
mov dword [esp + 0x220], 0x77057c08
mov dword [esp + 0x224], 0x700c6e04
mov dword [esp + 0x228], 0x880e8402
mov dword [esp + 0x22c], 0x7607890d
mov dword [esp + 0x230], 0x80108506
mov dword [esp + 0x234], 0x8800840a
mov dword [esp + 0x238], 0xe28cca07
mov dword [esp + 0x23c], 0x1a67141
mov byte [esp + 0x240], 0x8f
cmp ecx, 0x20
jne 0x10095c97
push 7
pop esi
push 0x25
pop ecx
jmp 0x10095cc9
movzx eax, byte [esp + ecx + 0x219]
lea edx, [esi - 1]
sub eax, ecx
add edx, eax
jns 0x10095cba
or eax, 0xffffffff
sub eax, edx
add edx, 0x100
and eax, 0xffffff00
add edx, eax
movzx eax, byte [esp + ecx + 0x218]
mov byte [esp + eax + 0x5c8], dl
add ecx, 2
cmp ecx, 0x29
jb 0x10095c8a
lea eax, [esp + 0x5c8]
mov byte [esp + 0x5d9], bl
push eax
lea ecx, [esp + 0x9bc]
call fcn.1001b5bd
mov ecx, dword [esp + 0x28]
mov edx, eax
push ebx
mov byte [esp + 0xa10], 0x30
call fcn.1001cd44
pop ecx
push ebx
push 1
lea ecx, [esp + 0x9c0]
mov dword [esp + 0x38], eax
mov byte [esp + 0xa14], 0x10
call fcn.10016cae
xor eax, eax
mov dword [esp + 0x4c], 0x27046a00
lea edi, [esp + 0x5c8]
mov dword [esp + 0x50], 0x76026573
stosd dword es:[edi], eax
mov ecx, ebx
mov word [esp + 0x54], 0x6901
mov esi, ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
cmp ecx, 2
jne 0x10095d52
push 4
pop esi
push esi
pop ecx
jmp 0x10095d7e
movzx eax, byte [esp + ecx + 0x4d]
lea edx, [esi - 1]
sub eax, ecx
add edx, eax
jns 0x10095d72
or eax, 0xffffffff
sub eax, edx
add edx, 0x100
and eax, 0xffffff00
add edx, eax
movzx eax, byte [esp + ecx + 0x4c]
mov byte [esp + eax + 0x3b0], dl
add ecx, 2
cmp ecx, 0xa
jb 0x10095d46
lea eax, [esp + 0x3b0]
mov byte [esp + 0x3b3], bl
push eax
lea ecx, [esp + 0x7e8]
call fcn.1001b5bd
mov byte [esp + 0xa0c], 0x31
mov edi, dword [esp + 0x30]
mov ecx, edi
push eax
call fcn.1001cac0
neg al
mov byte [esp + 0xa0c], 0x10
push ebx
sbb al, al
lea ecx, [esp + 0x7e8]
inc al
push 1
mov byte [esp + 0x37], al
call fcn.10016cae
cmp byte [esp + 0x2f], 0
je 0x10095ebe
mov dword [esp + 0x84], 0x7f0a6a00
mov ecx, ebx
mov dword [esp + 0x88], 0xbfb3486f
mov esi, ebx
mov dword [esp + 0x8c], 0xad250524
mov dword [esp + 0x90], 0x78026701
cmp ecx, 2
jne 0x10095e1d
push 0xa
pop esi
push esi
pop ecx
jmp 0x10095e4c
movzx eax, byte [esp + ecx + 0x85]
lea edx, [esi - 1]
sub eax, ecx
add edx, eax
jns 0x10095e40
or eax, 0xffffffff
sub eax, edx
add edx, 0x100
and eax, 0xffffff00
add edx, eax
movzx eax, byte [esp + ecx + 0x84]
mov byte [esp + eax + 0x3c], dl
add ecx, 2
cmp ecx, 0x10
jb 0x10095e11
push 6
lea ecx, [esp + 0x7c4]
mov byte [esp + 0x43], bl
call fcn.1001be44
mov esi, eax
lea eax, [esp + 0x3c]
mov byte [esp + 0xa0c], 0x32
push eax
lea ecx, [esp + 0x974]
call fcn.1001b5bd
push esi
push ecx
push eax
mov ecx, edi
mov byte [esp + 0xa18], 0x33
call fcn.1001c95a
pop ecx
mov ecx, eax
call fcn.1001c0d6
push ebx
push 1
lea ecx, [esp + 0x978]
call fcn.10016cae
lea ecx, [esp + 0x7c0]
mov byte [esp + 0xa0c], 0x10
call fcn.1001c059
mov dword [esp + 0x3b0], ebx
mov ecx, ebx
mov dword [esp + 0xb8], 0x67017402
mov esi, ebx
mov dword [esp + 0xbc], 0x780e6e00
mov dword [esp + 0xc0], 0x27a7bdf0
mov dword [esp + 0xc4], 0xb785595a
mov dword [esp + 0xc8], 0xac5c286a
cmp ecx, 6
jne 0x10095f0d
push 0xe
pop esi
push 0x12
pop ecx
jmp 0x10095f3f
movzx eax, byte [esp + ecx + 0xb9]
lea edx, [esi - 1]
sub eax, ecx
add edx, eax
jns 0x10095f30
or eax, 0xffffffff
sub eax, edx
add edx, 0x100
and eax, 0xffffff00
add edx, eax
movzx eax, byte [esp + ecx + 0xb8]
mov byte [esp + eax + 0x3b4], dl
add ecx, 2
cmp ecx, 0x14
jb 0x10095f00
lea eax, [esp + 0x3b4]
mov byte [esp + 0x3b7], bl
push eax
lea ecx, [esp + 0x824]
call fcn.1001b5bd
push eax
mov ecx, edi
mov byte [esp + 0xa10], 0x34
call fcn.1001c95a
push ebx
push 1
lea ecx, [esp + 0x828]
mov dword [esp + 0x44], eax
mov byte [esp + 0xa14], 0x10
call fcn.10016cae
push 6
lea ecx, [esp + 0x4cc]
mov dword [esp + 0x3b8], ebx
call fcn.1001be44
push ebx
lea ecx, [esp + 0x6ac]
mov byte [esp + 0xa10], 0x35
call fcn.1001be44
mov byte [esp + 0xa0c], 0x36
mov esi, ebx
mov ecx, dword [esp + 0x3c]
mov byte [esp + 0x1f], 1
call fcn.1001c595
mov dword [esp + 0x30], eax
test eax, eax
jle 0x100960b6
cmp byte [esp + 0x1f], 0
je 0x100961d6
mov ecx, dword [esp + 0x3c]
lea eax, [esp + 0x6a8]
push eax
push esi
lea eax, [esp + 0x4e0]
push eax
call fcn.1001c8c8
lea ecx, [esp + 0x4d8]
mov byte [esp + 0xa0c], 0x37
call fcn.1001cbc6
test al, al
je 0x1009608c
mov eax, ecx
lea ecx, [esp + 0x4c8]
push eax
call fcn.1001c98c
lea eax, [esp + 0x6dc]
push eax
lea ecx, [esp + 0x4dc]
call fcn.1001c228
mov byte [esp + 0xa0c], 0x38
lea eax, [esp + 0x424]
cmp dword [esp + 0x438], 0x10
lea ecx, [esp + 0x6dc]
push dword [esp + 0x434]
cmovae eax, dword [esp + 0x428]
push eax
push dword [esp + 0x6f4]
push ebx
call fcn.100347ff
test eax, eax
lea ecx, [esp + 0x6dc]
push ebx
push 1
setne byte [esp + 0x27]
call fcn.10016cae
lea ecx, [esp + 0x4d8]
mov byte [esp + 0xa0c], 0x36
call fcn.1001c059
inc esi
cmp esi, dword [esp + 0x30]
jl 0x10095fdb
cmp byte [esp + 0x1f], 0
je 0x100961d6
lea eax, [esp + 0x424]
push eax
lea ecx, [esp + 0x68c]
call fcn.1001bef9
lea eax, [esp + 0x688]
mov byte [esp + 0xa0c], 0x39
push eax
lea ecx, [esp + 0x4cc]
call fcn.1001c98c
mov dword [esp + 0xcc], 0x6c006501
mov ecx, ebx
mov dword [esp + 0xd0], 0xa03c60f
mov esi, ebx
mov dword [esp + 0xd4], 0xd0f5c1b0
mov dword [esp + 0xd8], 0x68386eca
mov dword [esp + 0xdc], 0x2e6601d
mov byte [esp + 0xe0], 0x78
cmp ecx, 4
jne 0x10096136
push 0xf
pop esi
push 0x11
pop ecx
jmp 0x10096168
movzx eax, byte [esp + ecx + 0xcd]
lea edx, [esi - 1]
sub eax, ecx
add edx, eax
jns 0x10096159
or eax, 0xffffffff
sub eax, edx
add edx, 0x100
and eax, 0xffffff00
add edx, eax
movzx eax, byte [esp + ecx + 0xcc]
mov byte [esp + eax + 0x3bc], dl
add ecx, 2
cmp ecx, 0x15
jb 0x10096129
lea eax, [esp + 0x3bc]
mov byte [esp + 0x3bf], bl
push eax
lea ecx, [esp + 0x914]
call fcn.1001b5bd
lea ecx, [esp + 0x4c8]
mov byte [esp + 0xa0c], 0x3a
push ecx
push ecx
push eax
mov ecx, edi
call fcn.1001c95a
pop ecx
mov ecx, eax
call fcn.1001c0d6
push ebx
push 1
lea ecx, [esp + 0x918]
call fcn.10016cae
lea ecx, [esp + 0x688]
mov dword [esp + 0x3bc], ebx
mov byte [esp + 0xa0c], 0x36
call fcn.1001c059
lea ecx, [esp + 0x6a8]
mov byte [esp + 0xa0c], 0x35
call fcn.1001c059
lea ecx, [esp + 0x4c8]
mov byte [esp + 0xa0c], 0x10
call fcn.1001c059
mov dword [esp + 0x1ac], 0x610d6a00
mov ecx, ebx
mov dword [esp + 0x1b0], 0x3ff8d8cc
mov esi, ebx
mov dword [esp + 0x1b4], 0x7e6a1a29
mov dword [esp + 0x1b8], 0x9aca6e8
mov dword [esp + 0x1bc], 0x5660367
mov dword [esp + 0x1c0], 0x4770170
mov dword [esp + 0x1c4], 0x8830277
mov dword [esp + 0x1c8], 0xa750678
mov word [esp + 0x1cc], 0x786
mov byte [esp + 0x1ce], 0x74
cmp ecx, 2
jne 0x10096278
push 0xd
pop esi
push esi
pop ecx
jmp 0x100962aa
movzx eax, byte [esp + ecx + 0x1ad]
lea edx, [esi - 1]
sub eax, ecx
add edx, eax
jns 0x1009629b
or eax, 0xffffffff
sub eax, edx
add edx, 0x100
and eax, 0xffffff00
add edx, eax
movzx eax, byte [esp + ecx + 0x1ac]
mov byte [esp + eax + 0x57c], dl
add ecx, 2
cmp ecx, 0x23
jb 0x1009626c
lea eax, [esp + 0x57c]
mov byte [esp + 0x587], bl
push eax
lea ecx, [esp + 0x854]
call fcn.1001b5bd
push eax
mov ecx, edi
mov byte [esp + 0xa10], 0x3b
call fcn.1001c95a
lea edx, [esp + 0x424]
mov ecx, eax
call fcn.1001cde4
lea ecx, [esp + 0x850]
push ebx
push 1
mov byte [esp + 0xa14], 0x10
call fcn.10016cae
mov eax, dword [esp + 0x34]
cmp dword [eax], 1
jne 0x10096317
mov edx, dword [ebp + 0xc]
mov ecx, dword [esp + 0x44]
call fcn.1009b03b
push ebx
push 1
lea ecx, [esp + 0x56c]
mov byte [esp + 0x27], 1
call fcn.10016cae
lea ecx, [esp + 0x6c8]
mov byte [esp + 0xa0c], 0xa
call fcn.1001c059
push ebx
push 1
lea ecx, [esp + 0x614]
call fcn.10016cae
push ebx
push 1
lea ecx, [esp + 0x714]
call fcn.10016cae
push ebx
push 1
lea ecx, [esp + 0x72c]
call fcn.10016cae
push ebx
push 1
lea ecx, [esp + 0x504]
call fcn.10016cae
push ebx
push 1
lea ecx, [esp + 0x798]
call fcn.10016cae
push ebx
push 1
lea ecx, [esp + 0x42c]
call fcn.10016cae
mov ecx, dword [esp + 0xa04]
mov al, byte [esp + 0x1f]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc