Function at 0x100f9919
Capabilities:
Check for time delay via gettickcount
Encode data using xor
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x358
mov eax, dword [0x10170640]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x208], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20c], eax
mov eax, dword [ebx + 0x164]
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x1d4], esi
mov eax, dword [eax + 0x14]
mov dword [ebx + 0x168], eax
push edi
mov edi, dword [ebp + 0x18]
mov dword [ebp - 0x1b8], edi
test esi, esi
jne 0x100f9981
mov esi, dword [ebx + 0x10c]
mov dword [ebp - 0x1d4], esi
test esi, esi
jne 0x100f9981
push 0xfffffffffffffff8
pop eax
jmp 0x100fb8dd
mov eax, dword [ebx]
push 1
push 0
push 0x7d9
push ebx
call dword [eax + 0x1c]
mov dword [esi + 0x68], eax
mov eax, dword [ebp - 0x20c]
test eax, eax
jne 0x100f99c7
and dword [ebp - 0x94], eax
and dword [ebp - 0x90], eax
mov eax, dword [esi + 0x78]
mov dword [ebp - 0x88], eax
mov eax, dword [esi + 0x74]
mov dword [ebp - 0x90], eax
lea eax, [ebp - 0x94]
mov dword [ebp - 0x20c], eax
cmp dword [ebx + 0x13c], 0
je 0x100f99f2
test byte [ebp + 0x1c], 1
jne 0x100f99f2
or dword [ebx + 0x158], 0x20000
mov ecx, ebx
push eax
push dword [ebp - 0x208]
call fcn.100f7649
push 0xfffffffffffffffe
jmp 0x100f997b
mov ecx, dword [ebp + 0x1c]
xor eax, eax
or dword [ebx + 0x158], 0x40000000
inc eax
shr ecx, 3
and ecx, eax
mov dword [ebp - 0x1bc], eax
mov eax, dword [ebx + 0x164]
mov dword [eax + 0xa4], ecx
call sub.KERNEL32.dll_GetTickCount
mov dword [ebp - 0x298], eax
xor eax, eax
cmp dword [esi + 0x14], eax
je 0x100fb88d
cmp dword [0x1017014c], eax
jne 0x100f9a64
mov ecx, 0x1017014c
mov dword [0x1017014c], eax
mov dword [0x1017015c], eax
mov dword [0x10170150], eax
mov dword [0x10170158], 0x3e8
mov dword [0x10170160], eax
mov byte [0x10170164], al
call fcn.100fbe51
mov eax, dword [esi + 0x14]
mov dword [eax + 0x1c], edi
mov eax, dword [esi + 0x1c]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x10]
mov cl, al
mov eax, dword [ebx + 0x164]
movzx edx, byte [eax + 0x11]
xor eax, eax
test cl, cl
sete al
and edx, eax
mov eax, dword [ebx + 0x164]
shl edx, 0x19
xor edx, dword [ebx + 0x158]
and edx, 0x2000000
xor dword [ebx + 0x158], edx
cmp dword [ebx + 0x2a8], 0
je 0x100f9aba
test dword [eax + 0x28], 0x80000
je 0x100f9aba
push 2
pop ecx
jmp 0x100f9abd
xor ecx, ecx
inc ecx
movss xmm0, dword [eax + 0x9c]
mov dl, 1
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x228], eax
xor eax, eax
mov dword [ebp - 0x214], ecx
movss dword [ebp - 0x238], xmm0
mov byte [ebp - 0x1c5], dl
mov dword [ebp - 0x1c0], eax
test ecx, ecx
jle 0x100fb8a0
cmp ecx, 1
jle 0x100f9b2a
test eax, eax
jle 0x100f9b2a
mov eax, dword [ebx + 0x164]
push ebx
mov dword [eax + 0x14], 9
call fcn.100fc313
pop ecx
mov ecx, ebx
call fcn.100ab92a
test al, al
jne 0x100f9b2a
or dword [ebx + 0x15c], 1
and dword [esi + 0x84], 0xfffffffe
mov eax, dword [ebx]
push edi
push esi
push ebx
call dword [eax + 0x34c]
cmp dword [ebp - 0x1c0], 1
jge 0x100f9b53
mov eax, dword [esi + 0x14]
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov dl, al
mov byte [ebp - 0x1c5], dl
jmp 0x100f9b59
mov dl, byte [ebp - 0x1c5]
test dl, dl
je 0x100fb85c
mov eax, dword [ebx + 0x154]
test eax, eax
je 0x100f9b72
mov dword [eax + 0x4c], 1
mov ecx, ebx
call fcn.100ab92a
mov edx, dword [ebx + 0x158]
movzx ecx, al
mov eax, edx
shr eax, 8
and eax, 1
cmp eax, ecx
je 0x100f9c08
mov eax, dword [ebx + 0xf4]
and dword [ebp - 0x1b0], 0
shl ecx, 8
xor ecx, edx
and ecx, 0x100
xor ecx, edx
mov dword [ebx + 0x158], ecx
cmp dword [eax + 0x24], 0
jle 0x100f9bf3
mov edi, dword [ebp - 0x1b0]
mov eax, dword [ebx + 0xf4]
push edi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x10]
mov ecx, eax
mov eax, dword [ebx + 0x158]
shr eax, 6
xor eax, dword [ecx + 0x84]
and eax, 4
xor dword [ecx + 0x84], eax
inc edi
mov eax, dword [ebx + 0xf4]
cmp edi, dword [eax + 0x24]
jl 0x100f9bba
mov edi, dword [ebp - 0x1b8]
or dword [esi + 0x80], 3
mov eax, dword [ebx]
push 0x3da6
push ebx
call dword [eax + 0xcc]
test byte [esi + 0x84], 2
je 0x100f9c3a
mov eax, dword [esi + 0x14]
push dword [esi + 0x78]
push dword [esi + 0x74]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x5c]
mov eax, dword [esi + 0x14]
and dword [esi + 0x84], 0xfffffffd
push 0xb
push eax
mov ecx, dword [eax]
call dword [ecx + 0x34]
test eax, eax
jne 0x100fb879
mov eax, dword [esi + 0x14]
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x34]
test eax, eax
je 0x100f9c50
or dword [esi + 0x80], 4
test dword [ebx + 0x158], 0x18000000
je 0x100f9c67
mov eax, dword [ebx]
push 1
push ebx
call dword [eax + 0x344]
test byte [esi + 0x80], 3
jne 0x100f9c81
mov eax, dword [ebx + 0x158]
test al, 0x40
jne 0x100f9c81
test eax, 0x18000000
je 0x100f9c8b
mov eax, dword [ebx]
push esi
push ebx
call dword [eax + 0x340]
test byte [ebx + 0x15c], 4
je 0x100f9cb5
test dword [ebx + 0x158], 0x100
jne 0x100f9cae
mov eax, dword [ebx]
push 0x186
push ebx
call dword [eax + 0xcc]
or dword [ebx + 0x15c], 4
test byte [esi + 0x80], 3
je 0x100f9cdd
push edi
mov ecx, ebx
call fcn.100b06c2
test byte [ebp + 0x1c], 0x20
jne 0x100f9cd6
push edi
push 1
mov ecx, ebx
call fcn.100b3536
and dword [esi + 0x80], 0xfffffffd
and dword [esi + 0x80], 0xffffffef
mov eax, dword [ebx]
push edi
push ebx
call dword [eax + 0x350]
mov eax, dword [ebx]
push 3
push ebx
call dword [eax + 0x19c]
test dword [ebx + 0x158], 0x100
mov dword [ebp - 0x290], eax
jne 0x100f9d1b
cmp dword [ebp - 0x1c0], 0
jle 0x100f9d1b
or dword [esi + 0x80], 1
test byte [esi + 0x80], 5
jne 0x100f9d2e
test byte [ebp + 0x1c], 0x10
je 0x100fb7c7
mov eax, dword [esi + 0x40]
mov dword [ebp - 0x1d0], eax
test eax, eax
jns 0x100f9d4a
mov eax, dword [ebx + 0x164]
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x1d0], eax
mov eax, dword [esi + 0x14]
push 6
push eax
mov byte [ebp - 0x19d], 1
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov eax, dword [ebp + 0x1c]
and eax, 0x10
mov dword [ebp - 0x294], eax
je 0x100f9d88
mov eax, dword [esi + 0x14]
push 4
push eax
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov eax, dword [esi + 0x14]
push 0xb
push eax
mov ecx, dword [eax]
call dword [ecx + 0x34]
test eax, eax
jne 0x100fb5a4
cmp dword [ebp - 0x1c0], 1
jge 0x100f9da2
mov ecx, dword [esi + 0x14]
mov eax, dword [ebx + 0x16c]
mov edx, dword [ecx]
push dword [eax]
push ecx
call dword [edx + 0x60]
mov eax, dword [esi + 0x14]
push 2
push eax
mov ecx, dword [eax]
call dword [ecx + 0x54]
test al, al
je 0x100fb5a4
mov eax, dword [ebx]
and dword [ebx + 0x148], 0
push edi
push 0
push esi
push ebx
call dword [eax + 0xc4]
mov dword [ebp - 0x1bc], eax
test eax, eax
js 0x100fb5a4
test edi, edi
je 0x100f9df0
push 2
mov ecx, edi
call fcn.100c0d55
test al, al
jne 0x100f9df0
or eax, 0xffffffff
jmp 0x100f9f03
cmp dword [ebp - 0x1c0], 0
jne 0x100f9e0f
mov eax, dword [ebx]
push esi
push ebx
call dword [eax + 0x3d4]
test al, al
je 0x100f9e0f
push esi
mov ecx, ebx
call fcn.100af4a7
mov eax, dword [ebx + 0x164]
mov edx, 0x800
mov ecx, 0x20000000
test dword [eax + 0x28], edx
mov edx, 0x28000000
cmovne ecx, edx
test dword [eax + 0x28], 0x400
mov dword [ebp - 0x1b4], ecx
je 0x100f9e45
or ecx, 0x40000000
mov dword [ebp - 0x1b4], ecx
test byte [eax + 0x28], 8
je 0x100f9e57
or ecx, 0x10000000
mov dword [ebp - 0x1b4], ecx
test dword [ebx + 0x158], 0x100
je 0x100f9e6f
or ecx, 0x80000000
mov dword [ebp - 0x1b4], ecx
push 0x2e
lea eax, [ebp - 0x204]
push 0
push eax
call sub.MSVCR120.dll_memset
mov eax, dword [ebx + 0x154]
add esp, 0xc
test eax, eax
je 0x100f9e90
and dword [eax + 4], 0
and dword [ebp - 0x1c4], 0
mov byte [0x10170164], 0
mov eax, dword [ebx + 0x164]
cmp dword [eax + 0x30], 0
je 0x100f9f0e
cmp byte [0x10170148], 0
je 0x100f9f0e
cmp dword [ebx + 0x148], 0
jle 0x100f9f0e
xor ecx, ecx
inc ecx
cmp dword [eax + 0x34], ecx
jge 0x100f9ec7
mov dword [eax + 0x34], ecx
mov ecx, dword [ebx + 0x164]
mov eax, 0x3e8
cdq
idiv dword [ecx + 0x34]
mov dword [0x10170154], eax
push dword [ebx + 0x148]
push dword [ebx + 0x144]
call fcn.100fc395
mov dword [ebp - 0x1c4], eax
pop ecx
pop ecx
test eax, eax
jne 0x100f9f14
cmp dword [ebx + 0x148], eax
jle 0x100f9f14
push 0xfffffffffffffff4
pop eax
mov dword [ebp - 0x1bc], eax
jmp 0x100fb5a4
mov eax, dword [ebp - 0x1c4]
xor ecx, ecx
mov dword [ebp - 0x1cc], ecx
cmp dword [ebx + 0x148], ecx
jle 0x100fa9d9
xor edx, edx
mov dword [ebp - 0x1b0], edx
test eax, eax
je 0x100f9f39
mov eax, dword [eax + ecx*8]
jmp 0x100f9f41
mov eax, dword [ebx + 0x144]
add eax, edx
mov byte [eax + 0xa0], 0
mov dword [ebp - 0x19c], eax
mov dword [0x10170160], ecx
test edi, edi
je 0x100f9f86
mov ecx, dword [ebx + 0x164]
cmp dword [ecx + 0x30], 0
je 0x100f9f75
cmp byte [0x10170148], 0
je 0x100f9f75
push ecx
push 0x100fc2d4
jmp 0x100f9f79
push 0
push 0
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x78]
mov eax, dword [ebp - 0x19c]
cmp dword [ebx + 0x33c], 2
je 0x100fab85
and dword [ebp - 0x200], 0
xor edx, edx
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x100f9fb1
mov ecx, dword [ecx + 0x44]
shr ecx, 9
and ecx, 0xffffff01
jmp 0x100f9fb3
xor cl, cl
mov eax, dword [ebx + 0x164]
mov dword [ebp - 0x1a4], ecx
cmp dword [eax + 0x30], edx
je 0x100fa004
cmp byte [0x10170148], dl
je 0x100fa004
cmp byte [0x10170164], dl
je 0x100fa004
test cl, cl
jne 0x100fa004
cmp dword [eax + 0x30], 2
je 0x100fa991
mov eax, dword [ebx]
push 0x3f3a38
push 3
push ebx
call dword [eax + 0x198]
mov eax, dword [ebp - 0x19c]
mov ecx, ebx
push dword [eax + 8]
call fcn.100f9075
mov edx, eax
and dword [ebp - 0x200], 0
mov eax, dword [ebx]
mov dword [ebp - 0x204], edx
mov edx, dword [ebp - 0x19c]
push dword [edx + 8]
push esi
push ebx
call dword [eax + 0x3e8]
mov ecx, dword [ebp - 0x1ea]
movzx eax, al
shl eax, 2
xor eax, ecx
and eax, 4
xor ecx, eax
mov eax, dword [ebx + 0x164]
mov dword [ebp - 0x1ea], ecx
and ecx, 0xfffffff4
mov edx, dword [eax + 0x28]
shr edx, 7
and edx, 8
mov dword [ebp - 0x1da], 1
or edx, ecx
mov ecx, dword [ebp - 0x19c]
mov dword [ebp - 0x1ea], edx
mov ax, word [ecx + 0x8c]
and dword [ebp - 0x1e2], 0
mov word [ebp - 0x1ec], ax
mov dword [ebp - 0x1de], 0x3f800000
mov eax, dword [ecx + 8]
test dword [eax + 0x44], 0x200
je 0x100fa0ae
mov eax, dword [ebx + 0x164]
mov edi, 0x800
test word [eax + 0x2c], di
mov edi, dword [ebp - 0x1b8]
je 0x100fa0ae
xor eax, eax
inc eax
jmp 0x100fa0b0
xor eax, eax
shl eax, 7
xor eax, edx
and eax, 0x80
xor edx, eax
cmp dword [ebx + 0x2a8], 0
mov dword [ebp - 0x1ea], edx
je 0x100fa0db
push ecx
mov ecx, ebx
call fcn.100f91b6
test al, al
je 0x100fa0db
mov cl, 1
jmp 0x100fa0dd
xor cl, cl
cmp byte [ebp - 0x1a4], 0
mov byte [ebp - 0x195], cl
je 0x100fa108
mov eax, dword [ebx + 0x164]
push 0
test dword [eax + 0x28], 0x40000
movzx eax, cl
pop ecx
cmovne eax, ecx
mov byte [ebp - 0x195], al
lea eax, [ebp - 0x195]
push eax
mov eax, dword [ebp - 0x19c]
push dword [esi + 0x14]
push dword [eax + 8]
call fcn.100fc4c0
add esp, 0xc
cmp byte [ebp - 0x195], 0
je 0x100fa13e
mov eax, dword [esi + 0x14]
push 1
push 1
push 0x3ea
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov edx, dword [ebp - 0x19c]
push edi
lea edi, [ebp - 0x204]
push edi
mov ecx, dword [edx]
lea eax, [edx + 0xc]
mov dword [ebp - 0x1a4], eax
push dword [ebp - 0x1a4]
push dword [edx + 8]
mov eax, dword [ecx]
push esi
push ecx
call dword [eax + 0xa0]
cmp byte [ebp - 0x195], 0
mov edi, dword [ebp - 0x1b8]
mov dword [ebp - 0x210], eax
je 0x100fa197
mov ecx, dword [esi + 0x14]
push 1
push 0
push 0x3ea
mov edx, dword [ecx]
push ecx
call dword [edx + 0x18]
mov eax, dword [ebp - 0x210]
cmp eax, 1
jne 0x100fa8e3
mov eax, dword [ebp - 0x1e2]
test eax, eax
je 0x100fa7e0
mov ecx, dword [ebp - 0x19c]
lea edx, [ebp - 0x2b0]
push edi
push 0
push edx
mov dword [ecx + 0x94], eax
mov eax, dword [ebp - 0x1f0]
mov dword [ecx + 0x90], eax
mov eax, dword [ecx]
movss xmm0, dword [ebp - 0x1de]
movss dword [ecx + 0x9c], xmm0
push eax
mov ecx, dword [eax]
call dword [ecx + 0xb4]
test al, al
je 0x100fa72e
lea esi, [ebp - 0x2b0]
movss xmm0, dword [ebp - 0x2a4]
lea edi, [ebp - 0x28c]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x328]
push eax
movsd dword es:[edi], dword [esi]
push dword [ebp - 0x1a4]
movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x2a4]
lea edi, [ebp - 0x268]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x2b0]
lea edi, [ebp - 0x224]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movss dword [ebp - 0x224], xmm0
lea esi, [ebp - 0x224]
lea edi, [ebp - 0x274]
movss xmm0, dword [ebp - 0x2a0]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x2b0]
movss dword [ebp - 0x270], xmm0
lea edi, [ebp - 0x234]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x2b0]
movss dword [ebp - 0x230], xmm0
lea edi, [ebp - 0x25c]
movss xmm0, dword [ebp - 0x29c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x224]
movss dword [ebp - 0x254], xmm0
lea edi, [ebp - 0x244]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x234]
movss dword [ebp - 0x23c], xmm0
lea edi, [ebp - 0x280]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movss dword [ebp - 0x278], xmm0
call sym.rt3d.dll_public:_struct_POINT3D___stdcall_MATRIX3D::PointTransform_struct_POINT3D_const__
mov esi, eax
lea edi, [ebp - 0x28c]
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x31c]
movsd dword es:[edi], dword [esi]
push eax
push dword [ebp - 0x1a4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call sym.rt3d.dll_public:_struct_POINT3D___stdcall_MATRIX3D::PointTransform_struct_POINT3D_const__
mov esi, eax
lea edi, [ebp - 0x268]
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x2d4]
movsd dword es:[edi], dword [esi]
push eax
push dword [ebp - 0x1a4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call sym.rt3d.dll_public:_struct_POINT3D___stdcall_MATRIX3D::PointTransform_struct_POINT3D_const__
mov esi, eax
lea edi, [ebp - 0x224]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x274]
movsd dword es:[edi], dword [esi]
push eax
lea eax, [ebp - 0x310]
push eax
push dword [ebp - 0x1a4]
call sym.rt3d.dll_public:_struct_POINT3D___stdcall_MATRIX3D::PointTransform_struct_POINT3D_const__
mov esi, eax
lea edi, [ebp - 0x274]
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x2c8]
movsd dword es:[edi], dword [esi]
push eax
push dword [ebp - 0x1a4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call sym.rt3d.dll_public:_struct_POINT3D___stdcall_MATRIX3D::PointTransform_struct_POINT3D_const__
mov esi, eax
lea edi, [ebp - 0x234]
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x340]
movsd dword es:[edi], dword [esi]
push eax
push dword [ebp - 0x1a4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call sym.rt3d.dll_public:_struct_POINT3D___stdcall_MATRIX3D::PointTransform_struct_POINT3D_const__
mov esi, eax
lea edi, [ebp - 0x25c]
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x358]
movsd dword es:[edi], dword [esi]
push eax
push dword [ebp - 0x1a4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call sym.rt3d.dll_public:_struct_POINT3D___stdcall_MATRIX3D::PointTransform_struct_POINT3D_const__
mov esi, eax
lea edi, [ebp - 0x244]
lea eax, [ebp - 0x280]
push eax
lea eax, [ebp - 0x2e0]
movsd dword es:[edi], dword [esi]
push eax
push dword [ebp - 0x1a4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call sym.rt3d.dll_public:_struct_POINT3D___stdcall_MATRIX3D::PointTransform_struct_POINT3D_const__
movss xmm1, dword [ebp - 0x28c]
lea edi, [ebp - 0x280]
movss xmm0, dword [ebp - 0x288]
mov esi, eax
cvtps2pd xmm0, xmm0
movsd dword es:[edi], dword [esi]
cvtps2pd xmm1, xmm1
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x1d4]
mov eax, dword [esi + 0x1c]
mulsd xmm0, qword [eax + 0x13c]
mulsd xmm1, qword [eax + 0x11c]
addsd xmm1, xmm0
movss xmm0, dword [ebp - 0x284]
cvtps2pd xmm0, xmm0
mulsd xmm0, qword [eax + 0x15c]
addsd xmm1, xmm0
movss xmm0, dword [ebp - 0x264]
cvtps2pd xmm0, xmm0
addsd xmm1, qword [eax + 0x17c]
cvtpd2ps xmm7, xmm1
movss xmm1, dword [ebp - 0x268]
cvtps2pd xmm1, xmm1
movss dword [ebp - 0x284], xmm7
mulsd xmm0, qword [eax + 0x13c]
mulsd xmm1, qword [eax + 0x11c]
addsd xmm1, xmm0
movss xmm0, dword [ebp - 0x260]
cvtps2pd xmm0, xmm0
mulsd xmm0, qword [eax + 0x15c]
addsd xmm1, xmm0
addsd xmm1, qword [eax + 0x17c]
cvtpd2ps xmm0, xmm1
movss xmm1, dword [ebp - 0x224]
movss dword [ebp - 0x260], xmm0
movss xmm0, dword [ebp - 0x220]
cvtps2pd xmm1, xmm1
cvtps2pd xmm0, xmm0
mulsd xmm1, qword [eax + 0x11c]
mulsd xmm0, qword [eax + 0x13c]
addsd xmm1, xmm0
movss xmm0, dword [ebp - 0x21c]
cvtps2pd xmm0, xmm0
mulsd xmm0, qword [eax + 0x15c]
addsd xmm1, xmm0
movss xmm0, dword [ebp - 0x274]
cvtps2pd xmm0, xmm0
addsd xmm1, qword [eax + 0x17c]
cvtpd2ps xmm2, xmm1
movss xmm1, dword [ebp - 0x270]
cvtps2pd xmm1, xmm1
movss dword [ebp - 0x21c], xmm2
mulsd xmm0, qword [eax + 0x11c]
mulsd xmm1, qword [eax + 0x13c]
addsd xmm1, xmm0
movss xmm0, dword [ebp - 0x26c]
cvtps2pd xmm0, xmm0
mulsd xmm0, qword [eax + 0x15c]
addsd xmm1, xmm0
movss xmm0, dword [ebp - 0x234]
cvtps2pd xmm0, xmm0
addsd xmm1, qword [eax + 0x17c]
cvtpd2ps xmm3, xmm1
movss xmm1, dword [ebp - 0x230]
cvtps2pd xmm1, xmm1
movss dword [ebp - 0x26c], xmm3
mulsd xmm0, qword [eax + 0x11c]
mulsd xmm1, qword [eax + 0x13c]
addsd xmm1, xmm0
movss xmm0, dword [ebp - 0x22c]
cvtps2pd xmm0, xmm0
mulsd xmm0, qword [eax + 0x15c]
addsd xmm1, xmm0
movss xmm0, dword [ebp - 0x25c]
cvtps2pd xmm0, xmm0
addsd xmm1, qword [eax + 0x17c]
cvtpd2ps xmm4, xmm1
movss xmm1, dword [ebp - 0x258]
cvtps2pd xmm1, xmm1
movss dword [ebp - 0x22c], xmm4
mulsd xmm0, qword [eax + 0x11c]
mulsd xmm1, qword [eax + 0x13c]
addsd xmm1, xmm0
movss xmm0, dword [ebp - 0x254]
cvtps2pd xmm0, xmm0
mulsd xmm0, qword [eax + 0x15c]
addsd xmm1, xmm0
movss xmm0, dword [ebp - 0x244]
cvtps2pd xmm0, xmm0
addsd xmm1, qword [eax + 0x17c]
cvtpd2ps xmm5, xmm1
movss xmm1, dword [ebp - 0x240]
cvtps2pd xmm1, xmm1
movss dword [ebp - 0x254], xmm5
mulsd xmm0, qword [eax + 0x11c]
mulsd xmm1, qword [eax + 0x13c]
addsd xmm1, xmm0
movss xmm0, dword [ebp - 0x23c]
cvtps2pd xmm0, xmm0
mulsd xmm0, qword [eax + 0x15c]
addsd xmm1, xmm0
movss xmm0, dword [ebp - 0x280]
cvtps2pd xmm0, xmm0
addsd xmm1, qword [eax + 0x17c]
cvtpd2ps xmm6, xmm1
movss xmm1, dword [ebp - 0x27c]
cvtps2pd xmm1, xmm1
movss dword [ebp - 0x23c], xmm6
mulsd xmm1, qword [eax + 0x13c]
mulsd xmm0, qword [eax + 0x11c]
addsd xmm1, xmm0
movss xmm0, dword [ebp - 0x278]
cvtps2pd xmm0, xmm0
mulsd xmm0, qword [eax + 0x15c]
addsd xmm1, xmm0
movss xmm0, dword [ebp - 0x260]
comiss xmm0, xmm7
addsd xmm1, qword [eax + 0x17c]
mov eax, dword [ebp - 0x19c]
cvtpd2ps xmm1, xmm1
jbe 0x100fa699
movss dword [eax + 0x98], xmm7
jmp 0x100fa6a1
movss dword [eax + 0x98], xmm0
movss xmm0, dword [eax + 0x98]
comiss xmm0, xmm2
jbe 0x100fa6b6
movss dword [eax + 0x98], xmm2
movss xmm0, dword [eax + 0x98]
comiss xmm0, xmm3
jbe 0x100fa6cb
movss dword [eax + 0x98], xmm3
movss xmm0, dword [eax + 0x98]
comiss xmm0, xmm4
jbe 0x100fa6e0
movss dword [eax + 0x98], xmm4
movss xmm0, dword [eax + 0x98]
comiss xmm0, xmm5
jbe 0x100fa6f5
movss dword [eax + 0x98], xmm5
movss xmm0, dword [eax + 0x98]
comiss xmm0, xmm6
jbe 0x100fa70a
movss dword [eax + 0x98], xmm6
movss xmm0, dword [eax + 0x98]
comiss xmm0, xmm1
mov edi, dword [ebp - 0x1b8]
jbe 0x100fa7cd
movss dword [eax + 0x98], xmm1
jmp 0x100fa7cd
mov eax, dword [ebp - 0x1a4]
lea edx, [ebp - 0x34c]
push edx
movsd xmm0, qword [eax + 0x60]
cvtpd2ps xmm0, xmm0
movss dword [ebp - 0x1ac], xmm0
movsd xmm0, qword [eax + 0x68]
cvtpd2ps xmm0, xmm0
movss dword [ebp - 0x210], xmm0
movsd xmm0, qword [eax + 0x70]
mov eax, dword [esi + 0x1c]
cvtpd2ps xmm0, xmm0
push eax
mov ecx, dword [eax]
movss dword [ebp - 0x218], xmm0
call dword [ecx + 0x74]
movss xmm1, dword [ebp - 0x210]
movss xmm0, dword [ebp - 0x218]
movss xmm2, dword [ebp - 0x1ac]
subss xmm1, dword [eax + 4]
subss xmm0, dword [eax + 8]
subss xmm2, dword [eax]
lea eax, [ebp - 0x2bc]
push eax
movss dword [ebp - 0x2b8], xmm1
movss dword [ebp - 0x2b4], xmm0
movss dword [ebp - 0x2bc], xmm2
call sym.rt3d.dll_public:_float___stdcall_POINT3D::Length_void_const
mov eax, dword [ebp - 0x19c]
fstp dword [eax + 0x98]
mov eax, dword [ebx + 0x2c0]
mov edx, dword [ebp - 0x19c]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x30]
lea eax, [ebp - 0x195]
push eax
mov eax, dword [ebp - 0x19c]
push dword [esi + 0x14]
push dword [eax + 8]
call fcn.100fc4c0
add esp, 0xc
cmp byte [ebp - 0x195], 0
je 0x100fa816
mov eax, dword [esi + 0x14]
push 1
push 1
push 0x3ea
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov edx, dword [ebp - 0x19c]
mov dword [ebp - 0x200], 1
mov eax, dword [edx + 8]
mov eax, dword [eax + 0xa4]
mov dword [ebp - 0x1ac], eax
test eax, eax
je 0x100fa84e
mov eax, dword [esi + 0x14]
push dword [ebp - 0x1ac]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov edx, dword [ebp - 0x19c]
mov eax, dword [edx]
push edi
lea edi, [ebp - 0x204]
push edi
push dword [ebp - 0x1a4]
mov ecx, dword [eax]
push dword [edx + 8]
push esi
push eax
call dword [ecx + 0xa4]
mov edi, dword [ebp - 0x1b8]
mov ecx, eax
mov eax, dword [ebp - 0x19c]
mov byte [eax + 0xa0], 1
cmp ecx, 0xfffffff4
je 0x100fa9c3
or edx, 0xffffffff
cmp ecx, edx
jne 0x100fa8ad
push edi
lea ecx, [ebp - 0x204]
push ecx
push eax
push esi
mov ecx, ebx
call fcn.100f8fec
mov dword [ebp - 0x1bc], eax
mov eax, dword [ebp - 0x19c]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0xa4]
test edx, edx
je 0x100fa8c6
mov eax, dword [esi + 0x14]
neg edx
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
cmp byte [ebp - 0x195], 0
je 0x100fa926
mov eax, dword [esi + 0x14]
push 1
push 0
push 0x3ea
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
jmp 0x100fa926
cmp eax, 0xfffffff4
je 0x100fa9c3
or ecx, 0xffffffff
cmp eax, ecx
jne 0x100fa926
mov dword [ebp - 0x1bc], ecx
mov ecx, edi
push 2
call fcn.100c0d55
test al, al
je 0x100fb57f
push edi
lea eax, [ebp - 0x204]
mov ecx, ebx
push eax
push dword [ebp - 0x19c]
push esi
call fcn.100f8fec
mov dword [ebp - 0x1bc], eax
test edi, edi
je 0x100fa94d
mov eax, dword [ebx + 0x164]
cmp dword [eax + 0xa4], 0
je 0x100fa94d
mov eax, dword [edi]
push 0
push dword [ebx + 0x148]
push dword [ebp - 0x1cc]
push edi
call dword [eax + 0xc]
mov eax, dword [ebx + 0x164]
cmp dword [eax + 0x30], 0
je 0x100fa982
cmp byte [0x10170148], 0
je 0x100fa982
mov ecx, 0x1017014c
call fcn.100fbe7b
test al, al
je 0x100fa991
mov eax, dword [ebx]
push 0x3f3a38
push 3
push ebx
call dword [eax + 0x198]
jmp 0x100fa991
test edi, edi
je 0x100fa991
mov eax, dword [edi]
mov ecx, edi
push 0
push 0
call dword [eax + 0x78]
mov ecx, dword [ebp - 0x1cc]
mov edx, dword [ebp - 0x1b0]
inc ecx
add edx, 0xa4
mov dword [ebp - 0x1cc], ecx
mov dword [ebp - 0x1b0], edx
cmp ecx, dword [ebx + 0x148]
jge 0x100fa9d9
mov eax, dword [ebp - 0x1c4]
jmp 0x100f9f30
push 0xfffffffffffffff4
pop eax
mov dword [ebp - 0x1bc], eax
mov eax, dword [edi]
push 4
push edi
call dword [eax + 0x20]
jmp 0x100fb57f
cmp dword [ebx + 0x33c], 2
je 0x100fab85
cmp dword [ebp - 0x1c0], 0
jne 0x100fab85
mov eax, dword [ebx]
push esi
push ebx
call dword [eax + 0x3e4]
test al, al
je 0x100faa22
test byte [ebx + 0x15b], 1
jne 0x100faa22
mov eax, dword [ebx + 0x16c]
mov ecx, esi
push 2
push dword [eax + 4]
lea eax, [ebx + 0x74]
push eax
push 0
call fcn.100e9f24
mov eax, dword [ebp - 0x1d0]
test eax, eax
je 0x100faa41
cmp eax, 3
je 0x100faa41
push eax
push esi
mov ecx, ebx
call fcn.100f9312
mov byte [ebp - 0x19d], 0
cmp dword [ebx + 0x2a8], 0
je 0x100fab85
test edi, edi
je 0x100faa6b
mov ecx, edi
call fcn.100addd6
test al, al
jne 0x100faa6b
or eax, 0xffffffff
mov dword [ebp - 0x1bc], eax
jmp 0x100fab85
cmp dword [ebx + 0x2ac], 0
jne 0x100faa7b
mov ecx, ebx
call fcn.100d2107
mov ecx, dword [ebx + 0x2ac]
test ecx, ecx
je 0x100fab85
mov eax, dword [ecx]
lea edx, [ebp - 0x2f8]
push edi
push 0
push edx
push ecx
call dword [eax + 0xb4]
test al, al
je 0x100fab85
mov eax, dword [esi + 0x1c]
lea edx, [ebp - 0x2f8]
push 1
push edx
push 0
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov ecx, dword [ebx + 0x2ac]
mov word [ecx + 0x138], ax
mov eax, 0x4000
mov ecx, dword [ebx + 0x2ac]
test word [ecx + 0x138], ax
jne 0x100fab85
push dword [ebp - 0x1b4]
mov eax, dword [ecx]
push 6
push ecx
call dword [eax + 0x98]
or eax, dword [ebp - 0x1b4]
mov dword [ebp - 0x1ac], eax
lea eax, [ebp - 0x114]
push eax
call sym.rt3d.dll_public:_void___stdcall_MATRIX3D::IdentityMatrix_void_
test dword [ebx + 0x158], 0x100
jne 0x100fab25
mov ecx, dword [ebx + 0x2ac]
lea eax, [ebp - 0x114]
push eax
push esi
call fcn.1010e987
mov eax, dword [ebx + 0x2ac]
lea edx, [ebp - 0x114]
push 0
push edi
push esi
mov ecx, dword [eax]
push edx
push dword [ebp - 0x1ac]
push eax
call dword [ecx + 0x8c]
mov dword [ebp - 0x1ac], eax
test eax, eax
jns 0x100fab76
mov ecx, dword [ebx + 0x28]
push eax
push ecx
mov edx, dword [ecx]
call dword [edx + 0x338]
cmp dword [ebp - 0x1ac], 0xfffffff4
jne 0x100fab76
push 0xfffffffffffffff4
pop eax
mov dword [ebp - 0x1bc], eax
mov eax, dword [edi]
push 4
push edi
call dword [eax + 0x20]
mov eax, dword [esi + 0x14]
push dword [ebx + 0x2ac]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x58]
test edi, edi
je 0x100fab94
mov eax, dword [edi]
mov ecx, edi
push 0
push 0
call dword [eax + 0x78]
cmp dword [ebx + 0x33c], 1
je 0x100fac31
cmp dword [ebp - 0x1c0], 0
jne 0x100fac31
cmp dword [ebx + 0x2c4], 0
je 0x100fac31
mov eax, dword [ebx]
push esi
push ebx
call dword [eax + 0x3d0]
test al, al
je 0x100fac31
mov eax, dword [ebx + 0x2c4]
xor edx, edx
mov dword [ebp - 0x1b0], edx
cmp dword [eax + 0x24], edx
jle 0x100fac31
mov eax, dword [ebx + 0x2c4]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x10]
push 7
push eax
mov dword [ebp - 0x1ac], eax
mov ecx, dword [eax]
call dword [ecx + 0xf0]
mov edx, eax
mov eax, dword [ebp - 0x1ac]
test byte [eax + 0x44], 1
jne 0x100fac19
test dword [edx + 0x50], 0x200
jne 0x100fac19
mov ecx, dword [edx]
push edi
push eax
push esi
push edx
call dword [ecx + 0x124]
mov edx, dword [ebp - 0x1b0]
mov eax, dword [ebx + 0x2c4]
inc edx
mov dword [ebp - 0x1b0], edx
cmp edx, dword [eax + 0x24]
jl 0x100fabd8
mov eax, dword [ebx + 0x2c0]
cmp dword [eax + 0x24], 0
je 0x100fb084
cmp dword [ebx + 0x33c], 2
je 0x100fb084
mov ecx, ebx
call fcn.100fbde2
cmp dword [ebp - 0x1c0], 0
jne 0x100fad98
mov eax, dword [ebp - 0x1d0]
test eax, eax
je 0x100fad98
cmp byte [ebp - 0x19d], 0
je 0x100fad98
cmp dword [ebx + 0x2a8], 0
je 0x100fac9b
push eax
push esi
mov ecx, ebx
call fcn.100f9312
mov byte [ebp - 0x19d], 0
jmp 0x100fad98
mov eax, dword [esi + 0xc]
lea edx, [ebp - 0x194]
push 1
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x9c]
mov eax, dword [esi + 0xc]
push 4
push eax
mov ecx, dword [eax]
call dword [ecx + 0xf0]
test eax, eax
je 0x100facd4
mov ecx, dword [eax]
lea edx, [ebp - 0x250]
push edx
push eax
call dword [ecx + 0xe4]
jmp 0x100facef
mov eax, dword [esi + 0x1c]
lea edx, [ebp - 0x304]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x74]
mov esi, eax
lea edi, [ebp - 0x250]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x334]
push eax
lea eax, [ebp - 0x194]
push eax
call sym.rt3d.dll_public:_struct_POINT3D___stdcall_MATRIX3D::PointTransform_struct_POINT3D_const__
mov esi, eax
lea edi, [ebp - 0x250]
movzx eax, byte [ebx + 0x349]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
sub eax, 0
je 0x100fad5b
dec eax
je 0x100fad4a
sub eax, 3
je 0x100fad3c
dec eax
jne 0x100fad8c
movss xmm0, dword [ebx + 0x84]
comiss xmm0, dword [ebp - 0x24c]
jmp 0x100fad67
movss xmm0, dword [ebp - 0x24c]
comiss xmm0, dword [ebx + 0x78]
jmp 0x100fad67
movss xmm0, dword [ebx + 0x88]
comiss xmm0, dword [ebp - 0x248]
jmp 0x100fad67
movss xmm0, dword [ebp - 0x248]
comiss xmm0, dword [ebx + 0x7c]
mov esi, dword [ebp - 0x1d4]
seta al
test al, al
je 0x100fad92
mov eax, dword [ebp - 0x1d0]
mov ecx, ebx
push eax
push esi
call fcn.100f9312
mov byte [ebp - 0x19d], 0
jmp 0x100fad92
mov esi, dword [ebp - 0x1d4]
mov edi, dword [ebp - 0x1b8]
push 0x2e
lea eax, [ebp - 0x204]
push 0
push eax
call sub.MSVCR120.dll_memset
mov eax, dword [ebx + 0x2c0]
xor edx, edx
add esp, 0xc
mov dword [ebp - 0x1cc], edx
cmp dword [eax + 0x24], edx
jle 0x100fb078
mov eax, dword [ebx + 0x2c0]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x10]
push 2
pop edx
mov dword [ebp - 0x200], edx
mov ecx, dword [eax + 0x90]
or dword [ebp - 0x1ea], edx
mov dword [ebp - 0x1f0], ecx
movss xmm0, dword [eax + 0x9c]
mov ecx, dword [ebx]
movss dword [ebp - 0x1f4], xmm0
push dword [eax + 8]
mov dword [ebp - 0x19c], eax
push esi
push ebx
call dword [ecx + 0x3e8]
mov ecx, dword [ebp - 0x1ea]
movzx eax, al
shl eax, 2
xor eax, ecx
and eax, 4
xor ecx, eax
mov eax, dword [ebx + 0x164]
mov dword [ebp - 0x1ea], ecx
mov edx, dword [eax + 0x28]
shr edx, 7
xor edx, ecx
and edx, 8
xor edx, ecx
mov ecx, dword [ebp - 0x19c]
or edx, 1
mov dword [ebp - 0x1ea], edx
mov eax, dword [ecx + 0x94]
mov dword [ebp - 0x204], eax
mov eax, dword [ecx + 8]
test dword [eax + 0x44], 0x200
je 0x100fae7c
mov eax, dword [ebx + 0x164]
mov esi, 0x800
test word [eax + 0x2c], si
mov esi, dword [ebp - 0x1d4]
je 0x100fae7c
xor eax, eax
inc eax
jmp 0x100fae7e
xor eax, eax
shl eax, 7
xor eax, edx
and eax, 0x80
xor edx, eax
mov dword [ebp - 0x1ea], edx
mov eax, dword [ecx + 8]
cmp eax, dword [ebx + 0x2a8]
jne 0x100faea8
cmp dword [ebp - 0x1c0], 0
jg 0x100fb05c
test edi, edi
je 0x100faed2
mov ecx, dword [ebx + 0x164]
xor edx, edx
cmp dword [ecx + 0x30], edx
je 0x100faec9
cmp byte [0x10170148], dl
je 0x100faec9
push ecx
push 0x100fc2d4
jmp 0x100faecb
push edx
push edx
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x78]
mov eax, dword [ebx + 0x164]
cmp dword [eax + 0x30], 0
je 0x100faf65
cmp byte [0x10170148], 0
je 0x100faf65
mov eax, dword [ebx + 0x148]
mov ecx, 0x1017014c
add eax, dword [ebp - 0x1cc]
mov dword [0x10170160], eax
call fcn.100fbe7b
test al, al
je 0x100faf65
mov eax, dword [ebx]
push 0x3f3a38
push 3
push ebx
call dword [eax + 0x198]
mov eax, dword [ebp - 0x19c]
cmp dword [eax + 0x94], 2
je 0x100faf6b
mov ecx, dword [eax + 8]
cmp ecx, dword [ebx + 0x2a8]
je 0x100faf6b
mov eax, dword [ebx + 0x164]
cmp dword [eax + 0x30], 2
je 0x100fb05c
push ecx
mov ecx, ebx
call fcn.100f9075
mov ecx, dword [ebp - 0x19c]
mov dword [ebp - 0x204], eax
mov dword [ecx + 0x94], eax
and dword [ebp - 0x1ea], 0xfffffffe
mov eax, dword [ebp - 0x19c]
cmp dword [ebx + 0x2a8], 0
je 0x100faf87
push eax
mov ecx, ebx
call fcn.100f91b6
mov byte [ebp - 0x1a5], 1
test al, al
jne 0x100faf8e
mov byte [ebp - 0x1a5], 0
mov ecx, dword [ebp - 0x19c]
lea eax, [ebp - 0x1a5]
push eax
push dword [esi + 0x14]
push dword [ecx + 8]
call fcn.100fc4c0
add esp, 0xc
cmp byte [ebp - 0x1a5], 0
je 0x100fafc4
mov eax, dword [esi + 0x14]
push 1
push 1
push 0x3ea
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov eax, dword [ebp - 0x19c]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0xa4]
test edx, edx
je 0x100fafe1
mov eax, dword [esi + 0x14]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov eax, dword [ebp - 0x19c]
push edi
lea edi, [ebp - 0x204]
push edi
mov ecx, dword [eax]
add eax, 0xc
push eax
mov eax, dword [ebp - 0x19c]
mov edx, dword [ecx]
push dword [eax + 8]
push esi
push ecx
call dword [edx + 0xa4]
mov ecx, dword [ebp - 0x1bc]
or edx, 0xffffffff
mov edi, dword [ebp - 0x1b8]
cmp eax, edx
mov eax, dword [ebp - 0x19c]
cmove ecx, edx
mov dword [ebp - 0x1bc], ecx
mov eax, dword [eax + 8]
mov edx, dword [eax + 0xa4]
test edx, edx
je 0x100fb041
mov eax, dword [esi + 0x14]
neg edx
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
cmp byte [ebp - 0x1a5], 0
je 0x100fb05c
mov eax, dword [esi + 0x14]
push 1
push 0
push 0x3ea
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov edx, dword [ebp - 0x1cc]
mov eax, dword [ebx + 0x2c0]
inc edx
mov dword [ebp - 0x1cc], edx
cmp edx, dword [eax + 0x24]
jl 0x100fadc2
mov eax, dword [ebx + 0x2c0]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x28]
test edi, edi
je 0x100fb093
mov eax, dword [edi]
mov ecx, edi
push 0
push 0
call dword [eax + 0x78]
cmp dword [ebp - 0x1c0], 0
jle 0x100fb0a3
push ebx
call fcn.100fc313
pop ecx
cmp dword [ebx + 0x33c], 1
je 0x100fb133
cmp dword [ebx + 0x2c4], 0
je 0x100fb133
mov eax, dword [ebx]
push esi
push ebx
call dword [eax + 0x3d0]
test al, al
je 0x100fb133
mov eax, dword [ebx + 0x2c4]
xor edx, edx
mov dword [ebp - 0x1b0], edx
cmp dword [eax + 0x24], edx
jle 0x100fb133
mov eax, dword [ebx + 0x2c4]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x10]
push 7
push eax
mov dword [ebp - 0x1ac], eax
mov ecx, dword [eax]
call dword [ecx + 0xf0]
mov edx, eax
mov eax, dword [ebp - 0x1ac]
test byte [eax + 0x44], 1
jne 0x100fb11b
test dword [edx + 0x50], 0x200
je 0x100fb11b
mov ecx, dword [edx]
push edi
push eax
push esi
push edx
call dword [ecx + 0x124]
mov edx, dword [ebp - 0x1b0]
mov eax, dword [ebx + 0x2c4]
inc edx
mov dword [ebp - 0x1b0], edx
cmp edx, dword [eax + 0x24]
jl 0x100fb0da
mov eax, dword [ebx + 0x164]
test dword [eax + 0x28], 0x200000
je 0x100fb305
mov eax, dword [ebp - 0x200]
mov dword [ebp - 0x1ac], eax
mov eax, dword [esi + 0x14]
push 1
push 0
push 0x3e9
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
xor eax, eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebx + 0x148], eax
jle 0x100fb2e7
mov ecx, dword [ebp - 0x1c4]
xor edx, edx
mov dword [ebp - 0x1b4], edx
test ecx, ecx
je 0x100fb18f
mov eax, dword [ecx + eax*8]
jmp 0x100fb197
mov eax, dword [ebx + 0x144]
add eax, edx
mov dword [ebp - 0x1a4], eax
test eax, eax
je 0x100fb2c2
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x100fb2bc
mov ecx, dword [ecx + 0x70]
test ecx, ecx
je 0x100fb2bc
mov eax, dword [ecx]
push ecx
call dword [eax + 0x40]
cmp eax, 1
jne 0x100fb2b6
mov eax, dword [ebp - 0x1a4]
push 1
push 0
push 0x12d
mov eax, dword [eax + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
push 4
pop edx
cmp eax, edx
jne 0x100fb2b6
mov ecx, dword [ebp - 0x1a4]
mov dword [ebp - 0x200], 3
mov eax, dword [ecx + 0x90]
or dword [ebp - 0x1ea], 2
mov dword [ebp - 0x1f0], eax
mov eax, dword [ebx]
mov dword [ebp - 0x204], edx
movss xmm0, dword [ecx + 0x9c]
movss dword [ebp - 0x1f4], xmm0
push dword [ecx + 8]
push esi
push ebx
call dword [eax + 0x3e8]
movzx ecx, al
mov eax, dword [ebp - 0x1ea]
and ecx, 1
and eax, 0xfffffff2
shl ecx, 2
or ecx, eax
mov eax, dword [ebp - 0x1a4]
mov dword [ebp - 0x1ea], ecx
mov eax, dword [eax + 8]
test dword [eax + 0x44], 0x200
je 0x100fb275
mov eax, dword [ebx + 0x164]
mov edx, 0x800
test word [eax + 0x2c], dx
je 0x100fb275
xor eax, eax
inc eax
jmp 0x100fb277
xor eax, eax
shl eax, 7
xor eax, ecx
and eax, 0x80
xor ecx, eax
mov eax, dword [ebp - 0x1a4]
push edi
mov dword [ebp - 0x1ea], ecx
lea edi, [ebp - 0x204]
push edi
mov ecx, dword [eax]
add eax, 0xc
push eax
mov eax, dword [ebp - 0x1a4]
mov edx, dword [ecx]
push dword [eax + 8]
push esi
push ecx
call dword [edx + 0xa4]
mov edi, dword [ebp - 0x1b8]
mov edx, dword [ebp - 0x1b4]
mov ecx, dword [ebp - 0x1c4]
mov eax, dword [ebp - 0x1b0]
add edx, 0xa4
inc eax
mov dword [ebp - 0x1b4], edx
mov dword [ebp - 0x1b0], eax
cmp eax, dword [ebx + 0x148]
jl 0x100fb186
mov eax, dword [esi + 0x14]
push 1
push 1
push 0x3e9
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov eax, dword [ebp - 0x1ac]
mov dword [ebp - 0x200], eax
mov eax, dword [ebp - 0x200]
mov dword [ebp - 0x218], eax
mov eax, dword [esi + 0x14]
push 1
push 0
push 0x3e9
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
cmp dword [ebx + 0x33c], 2
je 0x100fb4b5
xor eax, eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebx + 0x148], eax
jle 0x100fb4b5
xor edx, edx
mov dword [ebp - 0x1cc], edx
mov ecx, dword [ebp - 0x1c4]
test ecx, ecx
je 0x100fb35b
mov ecx, dword [ecx + eax*8]
jmp 0x100fb363
mov ecx, dword [ebx + 0x144]
add ecx, edx
cmp byte [ecx + 0xa0], 0
mov dword [ebp - 0x1b4], ecx
je 0x100fb4b5
cmp dword [ecx + 8], 0
mov edi, dword [ebp - 0x1b8]
je 0x100fb496
mov edi, dword [ecx + 8]
mov edi, dword [edi + 0xa8]
test edi, 0x4000
mov dword [ebp - 0x1ac], edi
mov edi, dword [ebp - 0x1b8]
je 0x100fb3a9
cmp dword [esi + 0x68], 0xffffffff
je 0x100fb3c3
test dword [ebp - 0x1ac], 0x10000000
je 0x100fb496
cmp dword [esi + 0x68], 1
jne 0x100fb496
mov dword [ebp - 0x200], 4
mov eax, dword [ecx + 0x90]
or dword [ebp - 0x1ea], 2
mov dword [ebp - 0x1f0], eax
mov eax, dword [ebx]
mov dword [ebp - 0x204], 8
movss xmm0, dword [ecx + 0x9c]
movss dword [ebp - 0x1f4], xmm0
push dword [ecx + 8]
push esi
push ebx
call dword [eax + 0x3e8]
movzx ecx, al
mov eax, dword [ebp - 0x1ea]
and ecx, 1
and eax, 0xfffffff2
shl ecx, 2
or ecx, eax
mov eax, dword [ebp - 0x1b4]
mov dword [ebp - 0x1ea], ecx
mov eax, dword [eax + 8]
test dword [eax + 0x44], 0x200
je 0x100fb449
mov eax, dword [ebx + 0x164]
mov edx, 0x800
test word [eax + 0x2c], dx
je 0x100fb449
xor eax, eax
inc eax
jmp 0x100fb44b
xor eax, eax
shl eax, 7
xor eax, ecx
and eax, 0x80
xor ecx, eax
mov eax, dword [ebp - 0x1b4]
push edi
mov dword [ebp - 0x1ea], ecx
lea edi, [ebp - 0x204]
push edi
mov ecx, dword [eax]
add eax, 0xc
push eax
mov eax, dword [ebp - 0x1b4]
mov edx, dword [ecx]
push dword [eax + 8]
push esi
push ecx
call dword [edx + 0xa4]
mov edi, dword [ebp - 0x1b8]
mov eax, dword [ebp - 0x1b0]
mov edx, dword [ebp - 0x1cc]
inc eax
add edx, 0xa4
mov dword [ebp - 0x1b0], eax
mov dword [ebp - 0x1cc], edx
cmp eax, dword [ebx + 0x148]
jl 0x100fb34c
mov eax, dword [esi + 0x14]
push 1
push 1
push 0x3e9
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov eax, dword [ebp - 0x218]
mov dword [ebp - 0x200], eax
mov eax, dword [ebp - 0x1d0]
test eax, eax
je 0x100fb4ff
cmp byte [ebp - 0x19d], 0
je 0x100fb4ff
cmp dword [ebx + 0x33c], 2
je 0x100fb4ff
push eax
push esi
mov ecx, ebx
call fcn.100f9312
mov byte [ebp - 0x19d], 0
mov eax, dword [ebx + 0x114]
test eax, eax
je 0x100fb57f
cmp dword [eax], 0
je 0x100fb57f
push esi
mov ecx, ebx
call fcn.100efc66
mov eax, dword [ebx + 0x2b8]
test eax, eax
je 0x100fb57f
mov eax, dword [eax + 0x24]
test eax, eax
je 0x100fb57f
and dword [ebp - 0x1ac], 0
test eax, eax
jle 0x100fb57f
mov edi, dword [ebp - 0x1ac]
mov eax, dword [ebx + 0x114]
mov ecx, dword [ebx + 0x2b8]
push dword [eax]
mov eax, dword [ecx]
push edi
push ecx
call dword [eax + 0x10]
push eax
push esi
mov ecx, ebx
call fcn.100ef661
mov eax, dword [ebx + 0x2b8]
cmp dword [eax + 0x24], 1
jle 0x100fb56d
mov ecx, ebx
call fcn.100ee626
test al, al
jne 0x100fb579
mov eax, dword [ebx + 0x2b8]
inc edi
cmp edi, dword [eax + 0x24]
jl 0x100fb538
mov edi, dword [ebp - 0x1b8]
mov eax, dword [ebp - 0x1d0]
test eax, eax
je 0x100fb5a4
cmp byte [ebp - 0x19d], 0
je 0x100fb5a4
cmp dword [ebx + 0x33c], 2
je 0x100fb5a4
push eax
push esi
mov ecx, ebx
call fcn.100f9312
cmp byte [0x107ad710], 0
je 0x100fb5b4
push ebx
call fcn.100fc313
pop ecx
mov eax, dword [ebx + 0x164]
mov ecx, dword [ebp - 0x228]
movss xmm0, dword [ebp - 0x238]
mov dword [eax + 0x14], ecx
mov eax, dword [ebx + 0x164]
movss dword [eax + 0x9c], xmm0
test edi, edi
je 0x100fb5e8
mov eax, dword [edi]
mov ecx, edi
push 0
push 0
call dword [eax + 0x78]
push dword [ebp - 0x290]
mov eax, dword [ebx]
push 3
push ebx
call dword [eax + 0x198]
test byte [ebp + 0x1c], 0x20
jne 0x100fb74d
push edi
push 0
mov ecx, ebx
call fcn.100b3536
test byte [ebx + 0x158], 0x10
jne 0x100fb74d
call sub.KERNEL32.dll_GetTickCount
sub eax, dword [ebp - 0x298]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10132340]
mov eax, dword [ebx + 0x328]
cvtpd2ps xmm0, xmm0
movss dword [ebx + eax*4 + 0x2d8], xmm0
inc dword [ebx + 0x328]
mov eax, dword [ebx + 0x32c]
cmp eax, 0x14
jge 0x100fb664
inc eax
mov dword [ebx + 0x32c], eax
cmp dword [ebx + 0x328], 0x14
jne 0x100fb674
and dword [ebx + 0x328], 0
and dword [ebx + 0x198], 0
mov ecx, dword [ebx + 0x32c]
test ecx, ecx
jle 0x100fb6a7
lea eax, [ebx + 0x2d8]
mov edx, ecx
movss xmm0, dword [eax]
add eax, 4
addss xmm0, dword [ebx + 0x198]
movss dword [ebx + 0x198], xmm0
dec edx
jne 0x100fb68d
movss xmm1, dword [ebx + 0x198]
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [0x1013225c]
movss dword [ebx + 0x198], xmm1
jbe 0x100fb6e1
movss xmm0, dword [0x1013c444]
divss xmm0, xmm1
movss dword [ebx + 0x198], xmm0
jmp 0x100fb6eb
mov dword [ebx + 0x198], 0x42c80000
movss xmm0, dword [ebx + 0x198]
cvtps2pd xmm0, xmm0
push ecx
push ecx
mulsd xmm0, qword [0x101322b8]
addsd xmm0, qword [0x10132280]
cvttsd2si eax, xmm0
movd xmm0, eax
lea eax, [ebp - 0x84]
cvtdq2ps xmm0, xmm0
divss xmm0, dword [0x1013b714]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
push 0x90e
push eax
call fcn.100e2d8e
add esp, 0x10
test edi, edi
je 0x100fb74d
mov eax, dword [edi]
lea ecx, [ebp - 0x84]
push ecx
push 1
push edi
call dword [eax + 0x18]
add esp, 0xc
and dword [esi + 0x80], 0xfffffffa
cmp dword [ebp - 0x294], 0
je 0x100fb768
mov eax, dword [esi + 0x14]
push 5
push eax
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov eax, dword [ebp - 0x1bc]
cmp eax, 0xfffffff4
je 0x100fb7bc
cmp dword [ebx + 0x33c], 2
je 0x100fb7bc
test byte [ebp + 0x1c], 0x80
jne 0x100fb78b
push eax
push esi
mov ecx, ebx
call fcn.100fb8f0
mov edx, dword [ebx + 0x338]
test edx, edx
jle 0x100fb7a9
mov eax, dword [esi + 0x14]
push 0xff000000
push edx
push 0
mov ecx, dword [eax]
push eax
call dword [ecx + 0x84]
mov ecx, ebx
call fcn.1001a01b
test eax, eax
je 0x100fb7bc
push esi
mov ecx, ebx
call fcn.100af45e
mov eax, dword [esi + 0x14]
push 3
push eax
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov eax, dword [ebx + 0x164]
mov ecx, dword [ebp - 0x228]
movss xmm0, dword [ebp - 0x238]
mov dword [eax + 0x14], ecx
mov eax, dword [ebx + 0x164]
movss dword [eax + 0x9c], xmm0
mov eax, dword [ebp - 0x214]
dec eax
cmp dword [ebp - 0x1c0], eax
jne 0x100fb85c
cmp dword [ebp - 0x208], 0
je 0x100fb82a
test edi, edi
je 0x100fb815
push 2
mov ecx, edi
call fcn.100c0d55
test al, al
je 0x100fb82a
mov eax, dword [esi + 0x14]
push dword [ebp - 0x20c]
push dword [ebp - 0x208]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x64]
mov eax, dword [esi + 0x14]
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov eax, dword [esi + 0x14]
and dword [eax + 0x1c], 0
test edi, edi
je 0x100fb85c
mov eax, dword [ebx + 0x164]
cmp dword [eax + 0xa4], 0
je 0x100fb85c
mov eax, dword [edi]
or ecx, 0xffffffff
push 0
push ecx
push ecx
push edi
call dword [eax + 0xc]
mov eax, dword [ebp - 0x1c0]
mov ecx, dword [ebp - 0x214]
inc eax
mov dword [ebp - 0x1c0], eax
cmp eax, ecx
jl 0x100f9af4
jmp 0x100fb8a0
mov ecx, dword [ebx]
push 0
push 8
push ebx
call dword [ecx + 0x15c]
push 0xfffffffffffffffd
jmp 0x100f997b
push dword [ebp - 0x20c]
mov ecx, ebx
push dword [ebp - 0x208]
call fcn.100f7649
test edi, edi
je 0x100fb8af
mov eax, dword [edi]
mov ecx, edi
push 0
push 0
call dword [eax + 0x78]
and dword [0x1017014c], 0
mov ebx, dword [ebp - 0x1bc]
mov byte [0x10170164], 0
cmp ebx, 0xfffffff4
je 0x100fb8db
test edi, edi
je 0x100fb8db
mov ecx, edi
call fcn.100addd6
test al, al
push 0xffffffffffffffff
pop eax
cmove ebx, eax
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10123bfc
mov esp, ebp
pop ebp
ret 0x18