Function at 0x1011cbd9
Capabilities:
Check for time delay via gettickcount
Encode data using xor
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
push ebp
lea ebp, [esp - 0x60]
sub esp, 0x298
mov eax, dword [0x1019c828]
xor eax, ebp
mov dword [ebp + 0x5c], eax
mov eax, dword [ebp + 0x70]
push ebx
mov ebx, dword [ebp + 0x68]
push esi
mov esi, dword [ebp + 0x6c]
push edi
mov edi, dword [ebp + 0x78]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 0x74]
xor ecx, ecx
cmp esi, ecx
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x2c], edi
jne 0x1011cc1b
mov esi, dword [ebx + 0xe8]
mov dword [ebp - 0x44], esi
cmp eax, ecx
jne 0x1011cc46
mov dword [ebp - 0xc8], ecx
mov dword [ebp - 0xcc], ecx
mov eax, dword [esi + 0x70]
mov dword [ebp - 0xc0], eax
mov eax, dword [esi + 0x6c]
mov dword [ebp - 0xc8], eax
lea eax, [ebp - 0xcc]
mov dword [ebp - 0x58], eax
xor eax, eax
inc eax
cmp dword [ebx + 0x114], ecx
je 0x1011cc75
test byte [ebp + 0x7c], al
jne 0x1011cc75
push dword [ebp - 0x58]
or dword [ebx + 0x130], 0x20000
push dword [ebp - 0x50]
mov ecx, ebx
call fcn.1012049f
push 0xfffffffffffffffe
pop eax
jmp 0x1011db29
mov ecx, dword [ebp + 0x7c]
or dword [ebx + 0x130], 0x40000000
shr ecx, 3
and ecx, eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebx + 0x140]
mov dword [eax + 0x94], ecx
call sub.KERNEL32.dll_GetTickCount
push esi
mov ecx, ebx
mov dword [ebp - 0x3c], eax
call fcn.1011c233
mov eax, dword [esi + 0x14]
test eax, eax
je 0x1011db09
mov dword [eax + 0x1c], edi
mov eax, dword [esi + 0x1c]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
xor ecx, ecx
test al, al
mov eax, dword [ebx + 0x140]
movzx eax, byte [eax + 0x11]
sete cl
push edi
push esi
push ebx
and ecx, eax
mov eax, dword [ebx]
shl ecx, 0x19
xor ecx, dword [ebx + 0x130]
and ecx, 0x2000000
xor dword [ebx + 0x130], ecx
call dword [eax + 0x304]
mov eax, dword [esi + 0x14]
mov ecx, dword [eax]
push 0
push eax
call dword [ecx + 0x54]
test al, al
je 0x1011db14
mov eax, dword [ebx + 0x12c]
test eax, eax
je 0x1011cd14
mov dword [eax + 0x48], 1
mov ecx, ebx
call fcn.100ddc73
mov ecx, dword [ebx + 0x130]
mov edx, ecx
shr edx, 8
movzx eax, al
and edx, 1
cmp edx, eax
je 0x1011cd8c
shl eax, 8
xor eax, ecx
and eax, 0x100
xor eax, ecx
mov dword [ebx + 0x130], eax
mov eax, dword [ebx + 0xd4]
xor edi, edi
cmp dword [eax + 0x1c], edi
jle 0x1011cd7a
mov eax, dword [ebx + 0xd4]
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0x10]
mov ecx, dword [ebx + 0x130]
shr ecx, 6
xor ecx, dword [eax + 0x7c]
and ecx, 4
xor dword [eax + 0x7c], ecx
mov eax, dword [ebx + 0xd4]
inc edi
cmp edi, dword [eax + 0x1c]
jl 0x1011cd4f
or dword [esi + 0x78], 3
mov eax, dword [ebx]
push 0x3da6
push ebx
call dword [eax + 0xcc]
test byte [esi + 0x7c], 2
je 0x1011cdc8
push dword [esi + 0x70]
mov eax, dword [esi + 0x14]
push dword [esi + 0x6c]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x5c]
mov eax, dword [esi + 0x14]
and dword [esi + 0x7c], 0xfffffffd
mov ecx, dword [eax]
push 0xb
push eax
call dword [ecx + 0x34]
test eax, eax
je 0x1011cdc8
mov eax, dword [ebx]
push 0
push 8
push ebx
call dword [eax + 0x11c]
push 0xfffffffffffffffd
jmp 0x1011cc6f
mov eax, dword [esi + 0x14]
mov ecx, dword [eax]
push 1
push eax
call dword [ecx + 0x34]
test eax, eax
je 0x1011cddb
or dword [esi + 0x78], 4
mov eax, dword [ebx + 0x130]
mov edi, 0x18000000
test edi, eax
je 0x1011cdf5
mov eax, dword [ebx]
push 1
push ebx
call dword [eax + 0x2fc]
test byte [esi + 0x78], 3
jne 0x1011ce09
mov eax, dword [ebx + 0x130]
test al, 0x40
jne 0x1011ce09
test edi, eax
je 0x1011ce13
mov eax, dword [ebx]
push esi
push ebx
call dword [eax + 0x2f8]
lea edi, [ebx + 0x134]
test byte [edi], 4
je 0x1011ce3a
test word [ebx + 0x130], 0x100
jne 0x1011ce37
mov eax, dword [ebx]
push 0x186
push ebx
call dword [eax + 0xcc]
or dword [edi], 4
test byte [esi + 0x78], 3
je 0x1011ce60
push dword [ebp - 0x2c]
mov ecx, ebx
call fcn.100e33e4
test byte [ebp + 0x7c], 0x20
jne 0x1011ce5c
push dword [ebp - 0x2c]
mov ecx, ebx
push 1
call fcn.100dc7c3
and dword [esi + 0x78], 0xfffffffd
mov edi, dword [ebp - 0x2c]
and dword [esi + 0x78], 0xffffffef
mov eax, dword [ebx]
push edi
push ebx
call dword [eax + 0x308]
test byte [esi + 0x78], 5
jne 0x1011ce81
test byte [ebp + 0x7c], 0x10
je 0x1011dab1
mov eax, dword [esi + 0x3c]
xor edi, edi
cmp eax, edi
mov dword [ebp - 0x38], eax
jge 0x1011ce99
mov eax, dword [ebx + 0x140]
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x38], eax
mov eax, dword [esi + 0x14]
mov ecx, dword [eax]
push 6
push eax
mov byte [ebp - 0x26], 1
call dword [ecx + 0x54]
mov eax, dword [ebp + 0x7c]
and eax, 0x10
mov dword [ebp - 0x94], eax
je 0x1011ced4
mov eax, dword [esi + 0x14]
mov ecx, dword [eax]
push 4
push eax
call dword [ecx + 0x54]
mov eax, dword [esi + 0x14]
mov ecx, dword [eax]
push 0xb
push eax
call dword [ecx + 0x34]
test eax, eax
jne 0x1011d93b
mov edx, dword [ebx + 0x144]
mov eax, dword [esi + 0x14]
push dword [edx]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x60]
mov eax, dword [esi + 0x14]
mov ecx, dword [eax]
push 2
push eax
call dword [ecx + 0x54]
test al, al
je 0x1011d93b
push dword [ebp - 0x2c]
mov eax, dword [ebx]
push edi
push esi
push ebx
mov dword [ebx + 0x120], edi
call dword [eax + 0xc4]
cmp eax, edi
mov dword [ebp - 0x34], eax
jl 0x1011d93b
mov eax, dword [ebp - 0x2c]
cmp eax, edi
je 0x1011cf32
mov eax, dword [eax + 0xc]
shr eax, 1
not al
test al, 1
jne 0x1011cf32
or dword [ebp - 0x34], 0xffffffff
jmp 0x1011d93b
mov eax, dword [ebx]
push esi
push ebx
call dword [eax + 0x378]
test al, al
je 0x1011cf48
push esi
mov ecx, ebx
call fcn.100dbcee
mov eax, dword [ebx + 0x140]
mov eax, dword [eax + 0x28]
test ax, 0x800
mov dword [ebp - 0x40], 0x20000000
je 0x1011cf65
mov dword [ebp - 0x40], 0x28000000
test ax, 0x400
je 0x1011cf72
or dword [ebp - 0x40], 0x40000000
test al, 8
je 0x1011cf7d
or dword [ebp - 0x40], 0x10000000
test word [ebx + 0x130], 0x100
je 0x1011cf8f
or dword [ebp - 0x40], 0x80000000
push 0x2a
lea eax, [ebp - 0x84]
push edi
push eax
call sub.MSVCR80.dll_memset
mov eax, dword [ebx + 0x12c]
add esp, 0xc
cmp eax, edi
je 0x1011cfae
mov dword [eax + 4], edi
cmp dword [ebx + 0x120], edi
mov dword [ebp - 0x30], edi
jle 0x1011d33c
mov dword [ebp - 0x48], edi
mov edi, dword [ebx + 0x11c]
add edi, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x2c]
xor eax, eax
cmp ecx, eax
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x80], eax
je 0x1011cffc
mov edx, dword [ecx + 0xc]
test edx, edx
je 0x1011cffc
mov eax, dword [ecx + 0xc]
or dword [ebp - 0x34], 0xffffffff
shr eax, 1
not al
test al, 1
je 0x1011d924
push dword [edi + 8]
mov ecx, ebx
call sym.rt3d.dll_public_virtual:_void____stdcall_e3_STREAM::GetHANDLE_void_
and dword [ebp - 0x80], 0
mov dword [ebp - 0x84], eax
push dword [edi + 8]
mov eax, dword [ebx]
push esi
push ebx
call dword [eax + 0x38c]
fld1
mov ecx, dword [ebp - 0x6a]
mov edx, dword [ebx + 0x140]
movzx eax, al
shl eax, 2
xor eax, ecx
and eax, 4
xor ecx, eax
mov dword [ebp - 0x6a], ecx
mov eax, dword [edx + 0x28]
shr eax, 7
and ecx, 0xfffffff4
and eax, 8
or eax, ecx
mov dword [ebp - 0x6a], eax
mov dword [ebp - 0x5e], 1
mov cx, word [edi + 0x8c]
and dword [ebp - 0x66], 0
fstp dword [ebp - 0x62]
mov word [ebp - 0x6c], cx
mov ecx, dword [edi + 8]
test word [ecx + 0x3c], 0x200
je 0x1011d070
test word [edx + 0x2c], 0x800
je 0x1011d070
xor ecx, ecx
inc ecx
jmp 0x1011d072
xor ecx, ecx
shl ecx, 7
xor ecx, eax
and ecx, 0x80
xor eax, ecx
cmp dword [ebx + 0x270], 0
mov dword [ebp - 0x6a], eax
je 0x1011d15f
push edi
mov ecx, ebx
call fcn.1011bdcf
test al, al
je 0x1011d15f
mov eax, dword [esi + 0x14]
mov ecx, dword [eax]
push 1
push 1
push 0x3ea
push eax
mov byte [ebp - 0x25], 1
call dword [ecx + 0x18]
push dword [ebp - 0x2c]
mov eax, dword [edi]
mov edx, dword [eax]
lea ecx, [ebp - 0x84]
push ecx
lea ecx, [edi + 0xc]
push ecx
push dword [edi + 8]
push esi
push eax
call dword [edx + 0xa0]
cmp byte [ebp - 0x25], 0
mov dword [ebp - 0x4c], eax
je 0x1011d0ed
mov eax, dword [esi + 0x14]
mov ecx, dword [eax]
push 1
push 0
push 0x3ea
push eax
call dword [ecx + 0x18]
cmp dword [ebp - 0x4c], 1
jne 0x1011d2bb
mov eax, dword [ebp - 0x66]
test eax, eax
je 0x1011d211
push dword [ebp - 0x2c]
mov dword [edi + 0x94], eax
mov eax, dword [ebp - 0x70]
mov dword [edi + 0x90], eax
fld dword [ebp - 0x62]
push 0
fstp dword [edi + 0x9c]
mov edi, dword [edi]
mov eax, dword [edi]
lea ecx, [ebp - 0x120]
push ecx
push edi
call dword [eax + 0xb4]
test al, al
je 0x1011d168
lea eax, [ebp - 0x138]
push eax
lea ecx, [ebp - 0x120]
call fcn.100266f0
push eax
lea eax, [ebp - 0x108]
push eax
mov eax, dword [ebp - 0x54]
add eax, 0xc
push eax
call sym.rt3d.dll_public:_struct_POINT3D___stdcall_MATRIX3D::PointTransform_struct_POINT3D_const__
mov esi, eax
jmp 0x1011d18f
mov byte [ebp - 0x25], 0
jmp 0x1011d0b5
mov eax, dword [ebp - 0x54]
fld qword [eax + 0x6c]
add eax, 0xc
fstp dword [ebp - 0xb0]
lea esi, [ebp - 0xb0]
fld qword [eax + 0x68]
fstp dword [ebp - 0xac]
fld qword [eax + 0x70]
fstp dword [ebp - 0xa8]
mov eax, dword [ebp - 0x44]
mov eax, dword [eax + 0x1c]
mov ecx, dword [eax]
lea edi, [ebp - 0xa4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edx, [ebp - 0xfc]
push edx
push eax
movsd dword es:[edi], dword [esi]
call dword [ecx + 0x74]
fld dword [ebp - 0xa0]
fsub dword [eax + 4]
fstp dword [ebp - 0x4c]
fld dword [ebp - 0x9c]
fsub dword [eax + 8]
fstp dword [ebp - 0x98]
fld dword [ebp - 0xa4]
fsub dword [eax]
lea eax, [ebp - 0xbc]
push eax
fstp dword [ebp - 0xbc]
fld dword [ebp - 0x4c]
fstp dword [ebp - 0xb8]
fld dword [ebp - 0x98]
fstp dword [ebp - 0xb4]
call sym.rt3d.dll_public:_float___stdcall_POINT3D::Length_void_const
mov eax, dword [ebp - 0x54]
fstp dword [eax + 0x98]
mov ecx, dword [ebx + 0x288]
mov edx, dword [ecx]
push eax
push ecx
call dword [edx + 0x30]
mov edi, dword [ebp - 0x54]
mov esi, dword [ebp - 0x44]
cmp byte [ebp - 0x25], 0
je 0x1011d229
mov eax, dword [esi + 0x14]
mov ecx, dword [eax]
push 1
push 1
push 0x3ea
push eax
call dword [ecx + 0x18]
mov dword [ebp - 0x80], 1
mov eax, dword [edi + 8]
mov ecx, dword [eax + 0x90]
test ecx, ecx
je 0x1011d247
mov eax, dword [esi + 0x14]
mov edx, dword [eax]
push ecx
push eax
call dword [edx + 0x50]
push dword [ebp - 0x2c]
mov eax, dword [edi]
mov edx, dword [eax]
lea ecx, [ebp - 0x84]
push ecx
lea ecx, [edi + 0xc]
push ecx
push dword [edi + 8]
push esi
push eax
call dword [edx + 0xa4]
cmp eax, 0xfffffff4
je 0x1011d3a7
cmp eax, 0xffffffff
jne 0x1011d288
push dword [ebp - 0x2c]
lea eax, [ebp - 0x84]
push eax
push edi
push esi
mov ecx, ebx
call fcn.1011c596
mov dword [ebp - 0x34], eax
mov eax, dword [edi + 8]
mov eax, dword [eax + 0x90]
test eax, eax
je 0x1011d2a1
mov ecx, dword [esi + 0x14]
mov edx, dword [ecx]
neg eax
push eax
push ecx
call dword [edx + 0x50]
cmp byte [ebp - 0x25], 0
je 0x1011d2f7
mov eax, dword [esi + 0x14]
mov ecx, dword [eax]
push 1
push 0
push 0x3ea
push eax
call dword [ecx + 0x18]
jmp 0x1011d2f7
cmp dword [ebp - 0x4c], 0xfffffff4
je 0x1011d3a7
cmp dword [ebp - 0x4c], 0xffffffff
jne 0x1011d2f7
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0xc]
or dword [ebp - 0x34], 0xffffffff
shr eax, 1
not al
test al, 1
je 0x1011d924
push dword [ebp - 0x2c]
lea eax, [ebp - 0x84]
push eax
push edi
push esi
mov ecx, ebx
call fcn.1011c596
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x2c], 0
je 0x1011d321
mov eax, dword [ebx + 0x140]
mov eax, dword [eax + 0x94]
test eax, eax
je 0x1011d321
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax]
push 0
push dword [ebx + 0x120]
push dword [ebp - 0x30]
push eax
call dword [ecx + 0xc]
inc dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
add dword [ebp - 0x48], 0xa0
cmp eax, dword [ebx + 0x120]
jl 0x1011cfc0
xor edi, edi
mov eax, dword [ebx]
push esi
push ebx
call dword [eax + 0x388]
test al, al
je 0x1011d36a
test byte [ebx + 0x133], 1
jne 0x1011d36a
mov eax, dword [ebx + 0x144]
push 2
push dword [eax + 4]
lea eax, [ebx + 0x68]
push eax
push edi
mov ecx, esi
call fcn.101095d5
cmp dword [ebp - 0x38], edi
je 0x1011d384
cmp dword [ebp - 0x38], 3
je 0x1011d384
push dword [ebp - 0x38]
mov ecx, ebx
push esi
call fcn.1011c6b7
mov byte [ebp - 0x26], 0
cmp dword [ebx + 0x270], edi
je 0x1011d4bb
mov eax, dword [ebp - 0x2c]
cmp eax, edi
je 0x1011d3be
mov eax, dword [eax + 0xc]
test eax, eax
je 0x1011d3be
or dword [ebp - 0x34], 0xffffffff
jmp 0x1011d4bb
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax]
push 4
push eax
mov dword [ebp - 0x34], 0xfffffff4
call dword [ecx + 0x20]
jmp 0x1011d924
cmp dword [ebx + 0x274], edi
jne 0x1011d3cd
mov ecx, ebx
call fcn.100f24da
mov eax, dword [ebx + 0x274]
cmp eax, edi
je 0x1011d4bb
push dword [ebp - 0x2c]
mov ecx, dword [eax]
push edi
lea edx, [ebp - 0xf0]
push edx
push eax
call dword [ecx + 0xb4]
test al, al
je 0x1011d4bb
mov eax, dword [esi + 0x1c]
mov ecx, dword [eax]
lea edx, [ebp - 0xf0]
push edx
push edi
push eax
call dword [ecx + 0x14]
mov ecx, dword [ebx + 0x274]
mov word [ecx + 0x12c], ax
mov eax, dword [ebx + 0x274]
test word [eax + 0x12c], 0x4000
jne 0x1011d4bb
push dword [ebp - 0x40]
mov ecx, dword [eax]
push 6
push eax
call dword [ecx + 0x98]
mov edi, eax
or edi, dword [ebp - 0x40]
lea eax, [ebp - 0x1b8]
push eax
call sym.rt3d.dll_public:_void___stdcall_MATRIX3D::IdentityMatrix_void_
test word [ebx + 0x130], 0x100
jne 0x1011d467
mov ecx, dword [ebx + 0x274]
lea eax, [ebp - 0x1b8]
push eax
push esi
call fcn.10136ece
push dword [ebp - 0x2c]
mov eax, dword [ebx + 0x274]
mov ecx, dword [eax]
push esi
lea edx, [ebp - 0x1b8]
push edx
push edi
push eax
call dword [ecx + 0x8c]
mov edi, eax
test edi, edi
jge 0x1011d4aa
mov eax, dword [ebx + 0x20]
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0x2f0]
push 0xfffffffffffffff4
pop eax
cmp edi, eax
jne 0x1011d4aa
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax]
push 4
push eax
call dword [ecx + 0x20]
mov eax, dword [esi + 0x14]
push dword [ebx + 0x274]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x58]
xor edi, edi
cmp dword [ebx + 0x28c], edi
je 0x1011d52a
mov eax, dword [ebx]
push esi
push ebx
call dword [eax + 0x374]
test al, al
je 0x1011d52a
mov eax, dword [ebx + 0x28c]
and dword [ebp - 0x30], 0
cmp dword [eax + 0x1c], 0
jle 0x1011d52a
mov eax, dword [ebx + 0x28c]
push dword [ebp - 0x30]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
mov edi, eax
mov eax, dword [edi]
push 7
push edi
call dword [eax + 0xf0]
test byte [edi + 0x3c], 1
jne 0x1011d519
test word [eax + 0x48], 0x200
jne 0x1011d519
push dword [ebp - 0x2c]
mov ecx, dword [eax]
push edi
push esi
push eax
call dword [ecx + 0x11c]
inc dword [ebp - 0x30]
mov eax, dword [ebx + 0x28c]
mov ecx, dword [ebp - 0x30]
cmp ecx, dword [eax + 0x1c]
jl 0x1011d4e1
mov eax, dword [ebx + 0x288]
cmp dword [eax + 0x1c], 0
je 0x1011d82a
mov ecx, ebx
call fcn.1011bd60
cmp dword [ebp - 0x38], 0
je 0x1011d627
cmp byte [ebp - 0x26], 0
je 0x1011d627
cmp dword [ebx + 0x270], 0
jne 0x1011d616
mov esi, dword [ebp - 0x44]
mov eax, dword [esi + 0xc]
mov ecx, dword [eax]
push 1
lea edx, [ebp - 0x238]
push edx
push eax
call dword [ecx + 0x9c]
mov eax, dword [esi + 0xc]
mov ecx, dword [eax]
push 4
push eax
call dword [ecx + 0xf0]
test eax, eax
je 0x1011d59e
mov ecx, dword [eax]
lea edx, [ebp - 0x90]
push edx
push eax
call dword [ecx + 0xdc]
jmp 0x1011d5bc
mov eax, dword [ebp - 0x44]
mov eax, dword [eax + 0x1c]
mov ecx, dword [eax]
lea edx, [ebp - 0x12c]
push edx
push eax
call dword [ecx + 0x74]
mov esi, eax
lea edi, [ebp - 0x90]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0xd8]
push eax
lea eax, [ebp - 0x238]
push eax
call sym.rt3d.dll_public:_struct_POINT3D___stdcall_MATRIX3D::PointTransform_struct_POINT3D_const__
mov esi, eax
movzx eax, byte [ebx + 0x309]
sub eax, 0
lea edi, [ebp - 0x90]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
je 0x1011d700
dec eax
je 0x1011d6f2
sub eax, 3
je 0x1011d6d7
dec eax
jne 0x1011d627
fld dword [ebp - 0x8c]
fld dword [ebx + 0x78]
fcompp
fnstsw ax
test ah, 0x41
jne 0x1011d627
push dword [ebp - 0x38]
mov ecx, ebx
push dword [ebp - 0x44]
call fcn.1011c6b7
mov byte [ebp - 0x26], 0
push 0x2a
xor esi, esi
lea eax, [ebp - 0x84]
push esi
push eax
call sub.MSVCR80.dll_memset
mov eax, dword [ebx + 0x288]
add esp, 0xc
cmp dword [eax + 0x1c], esi
mov dword [ebp - 0x30], esi
jle 0x1011d81b
mov edi, dword [ebp - 0x44]
mov eax, dword [ebx + 0x288]
push dword [ebp - 0x30]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
mov esi, eax
push 2
pop eax
mov dword [ebp - 0x80], eax
mov ecx, dword [esi + 0x90]
or dword [ebp - 0x6a], eax
mov eax, dword [ebx]
mov dword [ebp - 0x70], ecx
fld dword [esi + 0x9c]
fstp dword [ebp - 0x74]
push dword [esi + 8]
push edi
push ebx
call dword [eax + 0x38c]
mov ecx, dword [ebx + 0x140]
movzx eax, al
shl eax, 2
xor eax, dword [ebp - 0x6a]
and eax, 4
xor dword [ebp - 0x6a], eax
mov eax, dword [ecx + 0x28]
shr eax, 7
xor eax, dword [ebp - 0x6a]
and eax, 8
xor eax, dword [ebp - 0x6a]
or eax, 1
mov dword [ebp - 0x6a], eax
mov edx, dword [esi + 0x94]
mov dword [ebp - 0x84], edx
mov edx, dword [esi + 8]
test word [edx + 0x3c], 0x200
je 0x1011d70b
test word [ecx + 0x2c], 0x800
je 0x1011d70b
xor ecx, ecx
inc ecx
jmp 0x1011d70d
fld dword [ebp - 0x8c]
fld dword [ebx + 0x6c]
fcompp
fnstsw ax
test ah, 5
jnp 0x1011d616
jmp 0x1011d627
fld dword [ebp - 0x88]
fld dword [ebx + 0x7c]
jmp 0x1011d60d
fld dword [ebp - 0x88]
fld dword [ebx + 0x70]
jmp 0x1011d6e0
xor ecx, ecx
shl ecx, 7
xor ecx, eax
and ecx, 0x80
xor eax, ecx
mov dword [ebp - 0x6a], eax
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x1011d766
mov ecx, dword [eax + 0xc]
shr ecx, 1
not cl
test cl, 1
jne 0x1011d766
mov eax, dword [eax + 0xc]
or dword [ebp - 0x34], 0xffffffff
shr eax, 2
not al
test al, 1
jne 0x1011d81b
cmp dword [esi + 0x94], 2
je 0x1011d766
mov eax, dword [esi + 8]
cmp eax, dword [ebx + 0x270]
je 0x1011d766
push eax
mov ecx, ebx
call sym.rt3d.dll_public_virtual:_void____stdcall_e3_STREAM::GetHANDLE_void_
mov dword [esi + 0x94], eax
cmp dword [ebx + 0x270], 0
je 0x1011da15
push esi
mov ecx, ebx
call fcn.1011bdcf
test al, al
je 0x1011da15
mov eax, dword [edi + 0x14]
mov ecx, dword [eax]
push 1
push 1
push 0x3ea
push eax
mov byte [ebp - 0x25], 1
call dword [ecx + 0x18]
mov eax, dword [esi + 8]
mov ecx, dword [eax + 0x90]
test ecx, ecx
je 0x1011d7b0
mov eax, dword [edi + 0x14]
mov edx, dword [eax]
push ecx
push eax
call dword [edx + 0x50]
push dword [ebp - 0x2c]
mov eax, dword [esi]
mov ecx, dword [eax]
lea edx, [ebp - 0x84]
push edx
lea edx, [esi + 0xc]
push edx
push dword [esi + 8]
push edi
push eax
call dword [ecx + 0xa4]
cmp eax, 0xffffffff
jne 0x1011d7d5
or dword [ebp - 0x34], eax
mov eax, dword [esi + 8]
mov eax, dword [eax + 0x90]
test eax, eax
je 0x1011d7ee
mov ecx, dword [edi + 0x14]
mov edx, dword [ecx]
neg eax
push eax
push ecx
call dword [edx + 0x50]
cmp byte [ebp - 0x25], 0
je 0x1011d806
mov eax, dword [edi + 0x14]
mov ecx, dword [eax]
push 1
push 0
push 0x3ea
push eax
call dword [ecx + 0x18]
inc dword [ebp - 0x30]
mov eax, dword [ebx + 0x288]
mov ecx, dword [ebp - 0x30]
cmp ecx, dword [eax + 0x1c]
jl 0x1011d650
mov eax, dword [ebx + 0x288]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x28]
mov esi, dword [ebp - 0x44]
cmp dword [ebx + 0x28c], 0
je 0x1011d89a
mov eax, dword [ebx]
push esi
push ebx
call dword [eax + 0x374]
test al, al
je 0x1011d89a
mov eax, dword [ebx + 0x28c]
and dword [ebp - 0x30], 0
cmp dword [eax + 0x1c], 0
jle 0x1011d89a
mov eax, dword [ebx + 0x28c]
push dword [ebp - 0x30]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
mov edi, eax
mov eax, dword [edi]
push 7
push edi
call dword [eax + 0xf0]
test byte [edi + 0x3c], 1
jne 0x1011d889
test word [eax + 0x48], 0x200
je 0x1011d889
push dword [ebp - 0x2c]
mov ecx, dword [eax]
push edi
push esi
push eax
call dword [ecx + 0x11c]
inc dword [ebp - 0x30]
mov eax, dword [ebx + 0x28c]
mov ecx, dword [ebp - 0x30]
cmp ecx, dword [eax + 0x1c]
jl 0x1011d851
cmp dword [ebp - 0x38], 0
je 0x1011d8b5
cmp byte [ebp - 0x26], 0
je 0x1011d8b5
push dword [ebp - 0x38]
mov ecx, ebx
push esi
call fcn.1011c6b7
mov byte [ebp - 0x26], 0
mov eax, dword [ebx + 0xf0]
test eax, eax
je 0x1011d924
cmp dword [eax], 0
je 0x1011d924
push esi
mov ecx, ebx
call fcn.10107c23
mov eax, dword [ebx + 0x280]
test eax, eax
je 0x1011d924
mov eax, dword [eax + 0x1c]
test eax, eax
je 0x1011d924
xor edi, edi
test eax, eax
jle 0x1011d924
mov ecx, dword [ebx + 0xf0]
push dword [ecx]
mov eax, dword [ebx + 0x280]
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0x10]
push eax
push esi
mov ecx, ebx
call fcn.10107ff6
mov eax, dword [ebx + 0x280]
cmp dword [eax + 0x1c], 1
jle 0x1011d918
mov ecx, ebx
call fcn.10106ede
test al, al
jne 0x1011d924
mov eax, dword [ebx + 0x280]
inc edi
cmp edi, dword [eax + 0x1c]
jl 0x1011d8e3
cmp dword [ebp - 0x38], 0
je 0x1011d93b
cmp byte [ebp - 0x26], 0
je 0x1011d93b
push dword [ebp - 0x38]
mov ecx, ebx
push esi
call fcn.1011c6b7
test byte [ebp + 0x7c], 0x20
jne 0x1011da7a
mov edi, dword [ebp - 0x2c]
push edi
push 0
mov ecx, ebx
call fcn.100dc7c3
test byte [ebx + 0x130], 0x10
jne 0x1011da7a
call sub.KERNEL32.dll_GetTickCount
sub eax, dword [ebp - 0x3c]
test eax, eax
mov dword [ebp - 0x3c], eax
fild dword [ebp - 0x3c]
jge 0x1011d977
fadd dword [0x10154dcc]
mov eax, dword [ebx + 0x2f0]
fstp dword [ebp - 0x3c]
fld dword [ebp - 0x3c]
fstp dword [ebx + eax*4 + 0x2a0]
inc dword [ebx + 0x2f0]
mov eax, dword [ebx + 0x2f4]
cmp eax, 0x14
mov ecx, dword [ebx + 0x2f0]
jge 0x1011d9a8
inc eax
mov dword [ebx + 0x2f4], eax
cmp ecx, 0x14
jne 0x1011d9b4
and dword [ebx + 0x2f0], 0
mov eax, dword [ebx + 0x2f4]
fldz
xor ecx, ecx
fst dword [ebx + 0x168]
test eax, eax
mov dword [ebp - 0x3c], eax
jle 0x1011d9eb
lea eax, [ebx + 0x2a0]
fld dword [eax]
inc ecx
fadd dword [ebx + 0x168]
add eax, 4
fstp dword [ebx + 0x168]
cmp ecx, dword [ebx + 0x2f4]
jl 0x1011d9d1
fld dword [ebx + 0x168]
fidiv dword [ebp - 0x3c]
fstp dword [ebp - 0x48]
fld dword [ebp - 0x48]
fstp dword [ebx + 0x168]
fcomp dword [ebp - 0x48]
fnstsw ax
test ah, 5
jp 0x1011da1e
fld dword [ebp - 0x48]
fdivr qword [0x1014e780]
jmp 0x1011da24
mov byte [ebp - 0x25], 0
jmp 0x1011d799
fld dword [0x10166800]
fstp dword [ebx + 0x168]
fld dword [ebx + 0x168]
fld qword [0x10152788]
fmul st(1), st(0)
fxch st(1)
fadd qword [0x1014e750]
call fcn.1013fe10
mov dword [ebp - 0x3c], eax
fidivr dword [ebp - 0x3c]
push ecx
push ecx
lea eax, [ebp - 0x24]
fstp dword [ebp - 0x3c]
fld dword [ebp - 0x3c]
fstp qword [esp]
push 0x90e
push eax
call fcn.100fe39e
add esp, 0x10
test edi, edi
je 0x1011da7a
mov eax, dword [edi]
lea ecx, [ebp - 0x24]
push ecx
push 1
push edi
call dword [eax + 0x18]
add esp, 0xc
and dword [esi + 0x78], 0xfffffffa
cmp dword [ebp - 0x94], 0
je 0x1011da92
mov eax, dword [esi + 0x14]
mov ecx, dword [eax]
push 5
push eax
call dword [ecx + 0x54]
test byte [ebp + 0x7c], 0x80
jne 0x1011daa3
push dword [ebp - 0x34]
mov ecx, ebx
push esi
call fcn.1011c24d
mov eax, dword [esi + 0x14]
mov ecx, dword [eax]
push 3
push eax
call dword [ecx + 0x54]
mov edi, dword [ebp - 0x2c]
cmp dword [ebp - 0x50], 0
je 0x1011dad5
test edi, edi
je 0x1011dac6
mov eax, dword [edi + 0xc]
shr eax, 1
not al
test al, 1
je 0x1011dad5
push dword [ebp - 0x58]
mov eax, dword [esi + 0x14]
push dword [ebp - 0x50]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x64]
mov eax, dword [esi + 0x14]
mov ecx, dword [eax]
push 1
push eax
call dword [ecx + 0x54]
mov eax, dword [esi + 0x14]
and dword [eax + 0x1c], 0
test edi, edi
je 0x1011db26
mov eax, dword [ebx + 0x140]
mov eax, dword [eax + 0x94]
test eax, eax
je 0x1011db14
mov eax, dword [edi]
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push edi
call dword [eax + 0xc]
jmp 0x1011db14
push dword [ebp - 0x58]
push dword [ebp - 0x50]
call fcn.1012049f
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x1011db26
mov eax, dword [eax + 0xc]
test eax, eax
je 0x1011db26
or dword [ebp - 0x34], 0xffffffff
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp + 0x5c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1013fce4
add ebp, 0x60
leave
ret 0x18