Function at 0x1003fc20
Capabilities:
Check os version
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x1017f10e
mov eax, dword fs:[0]
push eax
sub esp, 0x240
mov eax, dword [0x101c6444]
xor eax, esp
mov dword [esp + 0x23c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x101c6444]
xor eax, esp
push eax
lea eax, [esp + 0x254]
mov dword fs:[0], eax
mov eax, dword [esp + 0x264]
xor ebx, ebx
mov esi, ecx
mov ecx, dword [esp + 0x270]
mov dword [esp + 0x30], ebx
cmp dword [esi + 0x150], ebx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x34], ecx
je 0x1003ff28
mov ecx, dword [esi + 0x148]
cmp ecx, ebx
je 0x1003ff28
mov edx, dword [ecx]
mov eax, dword [edx + 0xfc]
call eax
mov ecx, dword [esi + 0x150]
mov byte [esp + 0x274], al
call fcn.101335ef
mov ecx, dword [esi + 0x150]
mov dword [esp + 0xa0], eax
call fcn.1013447c
mov dword [esp + 0x48], eax
mov dword [esp + 0x38], ebx
mov dword [esp + 0x70], ebx
mov dword [esp + 0x74], ebx
mov dword [esp + 0x78], ebx
mov eax, dword [esi + 0xc]
cmp eax, ebx
lea edi, [esi + 8]
mov dword [esp + 0x25c], ebx
je 0x1003fcfc
mov ecx, dword [edi + 8]
sub ecx, eax
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
mov ebp, dword [edi + 4]
cmp ebp, dword [edi + 8]
mov dword [esp + 0x68], ebx
jbe 0x1003fd0d
call fcn.1015828d
mov eax, dword [edi + 8]
cmp dword [edi + 4], eax
mov dword [esp + 0x3c], eax
jbe 0x1003fd1e
call fcn.1015828d
mov dword [esp + 0x28], 0
cmp edi, edi
je 0x1003fd2f
call fcn.1015828d
cmp ebp, dword [esp + 0x3c]
je 0x1003fe38
cmp ebp, dword [edi + 8]
jb 0x1003fd43
call fcn.1015828d
cmp dword [ebp + 8], 0
je 0x1003fd82
cmp ebp, dword [edi + 8]
jb 0x1003fd53
call fcn.1015828d
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov edx, dword [edx + 0x3c]
lea eax, [esp + 0x1bc]
push eax
call edx
or dword [esp + 0x30], 1
push eax
lea ecx, [esi + 0x88]
mov byte [esp + 0x260], 1
call fcn.100fc1c4
test al, al
je 0x1003fdc2
cmp ebp, dword [edi + 8]
jb 0x1003fd8c
call fcn.1015828d
cmp dword [ebp + 8], 0
je 0x1003fdc2
cmp ebp, dword [edi + 8]
jb 0x1003fd9c
call fcn.1015828d
sub esp, 0x10
mov ebx, esp
mov dword [esp + 0x50], esp
push ebp
mov ecx, ebx
call fcn.100250d0
mov ecx, esi
mov dword [ebx], 0x101995c0
call fcn.10038ea0
test al, al
je 0x1003fdc2
xor bl, bl
jmp 0x1003fdc4
mov bl, 1
test byte [esp + 0x30], 1
mov dword [esp + 0x25c], 0
je 0x1003fde7
and dword [esp + 0x30], 0xfffffffe
lea ecx, [esp + 0x1bc]
call fcn.1001bf10
test bl, bl
je 0x1003fe1d
cmp ebp, dword [edi + 8]
jb 0x1003fdf5
call fcn.1015828d
mov eax, dword [esp + 0x26c]
mov ecx, dword [esp + 0x2c]
push eax
push ecx
push ebp
mov ecx, esi
call fcn.1003de90
add dword [esp + 0x38], 1
lea edx, [esp + 0x28]
push edx
lea ecx, [esp + 0x70]
call fcn.1003b120
cmp ebp, dword [edi + 8]
jb 0x1003fe27
call fcn.1015828d
mov ebx, dword [esp + 0x68]
add ebp, 0x18
add dword [esp + 0x28], 1
jmp 0x1003fd26
mov ecx, dword [esp + 0x70]
test ecx, ecx
jne 0x1003fe44
xor eax, eax
jmp 0x1003fe4d
mov eax, dword [esp + 0x74]
sub eax, ecx
sar eax, 2
mov ecx, dword [esi + 0x150]
sub ebx, eax
mov eax, dword [esi + 0x157c]
push eax
mov dword [esi + 0x1688], ebx
call fcn.10133e16
cmp byte [esp + 0x274], 0
mov byte [esp + 0x17], al
jne 0x1003fe99
cmp dword [esp + 0xa0], 4
je 0x1003fe99
mov ecx, dword [esi + 0x157c]
push ecx
mov ecx, dword [esi + 0x150]
call fcn.10133655
mov ebp, eax
mov dword [esp + 0x30], ebp
jmp 0x1003feb1
mov edx, dword [esi + 0x157c]
mov ecx, dword [esi + 0x150]
push edx
call fcn.10133dd6
mov ebp, eax
mov dword [esp + 0x30], eax
mov eax, dword [esi + 0x157c]
mov ecx, dword [esi + 0x150]
push eax
call fcn.10133dd6
cmp ebp, eax
mov ecx, dword [esi + 0x150]
jae 0x1003fedb
call fcn.1013447c
cmp eax, 1
je 0x1003fef1
push 1
jmp 0x1003fee6
call fcn.1013447c
test eax, eax
je 0x1003fef1
push 0
mov ecx, dword [esi + 0x150]
call fcn.10134440
mov ecx, dword [esi + 0x157c]
push ecx
mov ecx, dword [esi + 0x150]
call fcn.101340d6
mov ebx, eax
mov ecx, esi
mov dword [esp + 0x9c], ebx
call fcn.1003ac60
test ebp, ebp
jne 0x1003ff2f
mov eax, dword [esp + 0x70]
test eax, eax
je 0x1003ff28
push eax
call fcn.10157f3b
add esp, 4
xor al, al
jmp 0x10041421
lea ebp, [esi + 0x88]
mov ecx, ebp
call fcn.100fbaf7
cmp ebx, eax
ja 0x1003fff2
lea ecx, [esi + 0xe0]
call fcn.100fa00e
cmp eax, 2
jb 0x1003fff2
mov edx, dword [esp + 0x34]
xor eax, eax
mov byte [edx], 1
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], eax
mov dword [esp + 0x88], eax
mov ecx, dword [esi + 0x157c]
push 0xffffffffffffffff
lea eax, [esp + 0x80]
push eax
push ecx
mov ecx, dword [esi + 0x150]
mov byte [esp + 0x268], 2
call fcn.10133e56
mov ecx, ebp
mov ebx, eax
call fcn.100fba9f
mov ecx, eax
cmp ebx, ecx
jbe 0x1003ffb8
test ecx, ecx
jbe 0x1003ffb8
lea eax, [ecx + ebx - 1]
xor edx, edx
div ecx
push eax
jmp 0x1003ffba
push 1
mov ecx, ebp
call fcn.100fbc04
mov ecx, ebp
call fcn.100fbaf7
cmp eax, 1
jne 0x1003ffd6
push 2
mov ecx, ebp
call fcn.100fbc04
mov eax, dword [esp + 0x80]
test eax, eax
mov byte [esp + 0x25c], 0
je 0x1003fff2
push eax
call fcn.10157f3b
add esp, 4
mov ecx, ebp
call fcn.10117837
cmp byte [esp + 0x17], 0
mov ebx, dword [esp + 0x38]
je 0x10040450
cmp ebx, dword [esp + 0x68]
jne 0x10040450
test ebx, ebx
jle 0x10041406
cmp byte [esi + 0x28e], 1
je 0x10040450
mov ecx, ebp
call fcn.100fbaf7
xor ebp, ebp
cmp eax, ebp
je 0x100404b8
cmp ebx, eax
jbe 0x10040042
mov ebx, eax
mov dword [esp + 0x38], ebx
mov ecx, dword [esp + 0x30]
xor edx, edx
lea eax, [ecx + ebx - 1]
div ebx
cmp eax, 0xa
mov dword [esp + 0x48], eax
jge 0x1004005f
mov dword [esp + 0x48], 0xa
cmp ecx, ebp
mov dword [esp + 0x28], ebp
jbe 0x10041406
jmp 0x10040070
cmp ebp, dword [esp + 0x38]
je 0x10041406
push ebp
mov ecx, edi
call fcn.10036720
mov edx, dword [esp + 0x28]
push ebp
mov ecx, edi
mov dword [eax + 0x10], edx
call fcn.10036720
mov ecx, dword [esp + 0x30]
lea ebx, [esi + 0x1594]
push ebx
mov dword [eax + 0x14], ecx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dl, byte [esi + 0x15ac]
push ebx
mov byte [esp + 0x40], dl
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esp + 0x3c]
push eax
lea ecx, [esp + 0x1c0]
push ecx
lea ecx, [esi + 0x88]
call fcn.100fc770
lea edx, [esp + 0xac]
push edx
lea ecx, [esp + 0x1c0]
mov byte [esp + 0x260], 3
call fcn.1003c6a0
push ebp
mov ecx, edi
call fcn.10036720
push ebp
mov ecx, edi
call fcn.10036720
cmp dword [esp + 0xc4], 0x10
jb 0x10040114
mov eax, dword [esp + 0xb0]
push eax
call fcn.10157f3b
add esp, 4
xor ebx, ebx
cmp dword [esp + 0x1d0], ebx
jbe 0x1004043f
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x60], ebx
mov dword [esp + 0x64], ebx
lea eax, [esi + 0x15c0]
mov dword [esp + 0x44], eax
add eax, 4
push eax
mov dword [esp + 0x44], 0x101975f4
mov dword [esp + 0x38], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esi + 0x20], ebx
mov byte [esp + 0x25c], 5
sete al
test al, al
mov byte [esp + 0x17], al
jne 0x100401b4
mov eax, dword [esi + 0x1c]
mov eax, dword [eax]
cmp eax, dword [esi + 0x1c]
lea ebx, [esi + 0x18]
mov dword [esp + 0xa8], eax
jne 0x1004018a
call fcn.1015828d
mov ecx, dword [esp + 0xa8]
add ecx, 8
push ecx
lea ecx, [esp + 0x50]
call fcn.1003ada0
mov eax, dword [ebx + 4]
mov eax, dword [eax]
push eax
push ebx
lea edx, [esp + 0xe0]
push edx
mov ecx, ebx
call fcn.10039f40
mov eax, dword [esp + 0x34]
push eax
mov byte [esp + 0x260], 4
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp byte [esp + 0x17], 0
mov dword [esp + 0x40], 0x101975e0
je 0x100402f1
xor ebx, ebx
push ebx
push ebp
mov ecx, edi
call fcn.10036720
mov ecx, dword [eax + 0x10]
mov edx, dword [esi + 0x157c]
push ecx
mov ecx, dword [esi + 0x150]
push edx
call fcn.10133a93
mov dword [esp + 0x80], ebx
mov dword [esp + 0x84], ebx
mov dword [esp + 0x88], ebx
mov ebx, dword [esi]
push ebp
mov ecx, edi
mov byte [esp + 0x260], 6
add ebx, 4
call fcn.10036720
mov eax, dword [eax + 0x10]
push eax
lea ecx, [esp + 0x1c0]
push ecx
mov ecx, esi
call fcn.100380e0
mov edx, dword [esi + 0x1578]
push eax
mov eax, dword [esi + 0x1574]
push edx
push eax
lea ecx, [esp + 0x88]
push ecx
push 0
push ebp
mov ecx, edi
call fcn.10036720
mov edx, dword [eax + 0x14]
push edx
push ebp
mov ecx, edi
call fcn.10036720
mov eax, dword [eax + 0x10]
mov ecx, dword [esp + 0x280]
push eax
push ecx
lea edx, [esp + 0x1dc]
push edx
mov edx, dword [ebx]
lea eax, [esp + 0xb0]
push eax
mov ecx, esi
call edx
mov ebx, eax
push ebp
mov ecx, edi
mov byte [esp + 0x260], 7
call fcn.10036720
push ebx
mov ecx, eax
call fcn.10037e20
lea ecx, [esp + 0x90]
mov byte [esp + 0x25c], 6
mov dword [esp + 0x8c], 0x101995c0
mov dword [esp + 0x90], 0x10199578
call fcn.10006f60
lea ecx, [esp + 0x7c]
mov byte [esp + 0x25c], 4
call fcn.1001db20
push ebp
mov ecx, edi
call fcn.10036720
push ebp
mov ecx, edi
call fcn.10036720
jmp 0x10040399
mov eax, dword [esp + 0x5c]
mov ecx, dword [esi + 0x157c]
push 0
push eax
push ecx
mov ecx, dword [esi + 0x150]
call fcn.10133a93
mov edx, dword [esp + 0x5c]
mov ebx, dword [esi]
push edx
lea eax, [esp + 0x1c0]
push eax
mov ecx, esi
add ebx, 4
call fcn.100380e0
mov ecx, dword [esi + 0x1578]
mov edx, dword [esi + 0x1574]
push eax
push ecx
mov ecx, dword [esp + 0x68]
push edx
mov edx, dword [esp + 0x68]
lea eax, [esp + 0x58]
push eax
mov eax, dword [esp + 0x278]
push 0
push ecx
push edx
push eax
mov eax, dword [ebx]
lea ecx, [esp + 0x1dc]
push ecx
lea edx, [esp + 0x3c]
push edx
mov ecx, esi
call eax
mov ebx, eax
push ebp
mov ecx, edi
mov byte [esp + 0x260], 8
call fcn.10036720
push ebx
mov ecx, eax
call fcn.10037e20
lea ecx, [esp + 0x1c]
mov byte [esp + 0x25c], 4
mov dword [esp + 0x18], 0x101995c0
mov dword [esp + 0x1c], 0x10199578
call fcn.10006f60
lea ecx, [esp + 0x1bc]
push ecx
lea ecx, [esi + 0x88]
call fcn.100fbccc
push 0xffffffffffffffff
push 0
lea edx, [esp + 0x1c4]
push edx
lea ecx, [esp + 0xec]
mov dword [esp + 0x104], 0xf
mov dword [esp + 0x100], 0
mov byte [esp + 0xf0], 0
call fcn.10001a10
cmp dword [esp + 0xf8], 0x10
jb 0x100403fc
mov eax, dword [esp + 0xe4]
push eax
call fcn.10157f3b
add esp, 4
mov eax, dword [esp + 0x50]
test eax, eax
je 0x1004040d
push eax
call fcn.10157f3b
add esp, 4
mov ebx, dword [esp + 0x28]
add ebx, dword [esp + 0x48]
lea ecx, [esp + 0x1bc]
mov dword [esp + 0x28], ebx
add ebp, 1
mov byte [esp + 0x25c], 0
call fcn.1001bf10
cmp ebx, dword [esp + 0x30]
jb 0x10040070
jmp 0x10041406
lea ecx, [esp + 0x1bc]
call fcn.1001bf10
jmp 0x10041406
test ebx, ebx
jle 0x10041406
xor eax, eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
cmp byte [esp + 0x274], al
mov byte [esp + 0x25c], 9
jne 0x100404c8
cmp dword [esp + 0xa0], 4
je 0x100404c8
mov ecx, dword [esi + 0x157c]
push ecx
mov ecx, dword [esi + 0x150]
call fcn.10133655
push eax
mov eax, dword [esi + 0x157c]
lea edx, [esp + 0x1c]
push edx
push eax
mov ecx, dword [esi + 0x150]
call fcn.10133e56
test eax, eax
jne 0x100404d8
lea ecx, [esp + 0x18]
call fcn.1001db20
lea ecx, [esp + 0x6c]
call fcn.1001db20
mov al, 1
jmp 0x10041421
mov edx, dword [esi + 0x157c]
push 0xffffffffffffffff
lea ecx, [esp + 0x1c]
push ecx
push edx
jmp 0x100404a0
mov ecx, ebp
call fcn.100fbaf7
lea ecx, [esi + 0xe0]
call fcn.100fa00e
mov eax, dword [esi + 0x157c]
mov ecx, dword [esi + 0x150]
push eax
call fcn.101340d6
mov ebp, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
xor ebx, ebx
mov dword [esp + 0x2c], ebx
lea ebx, [ebx]
test ecx, ecx
je 0x10040644
mov edx, ebp
sub edx, ecx
mov eax, 0x2aaaaaab
imul edx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebx, eax
jae 0x10040644
mov edx, dword [esp + 0x2c]
mov eax, dword [edx + ecx]
test eax, eax
mov dword [esp + 0x28], eax
jbe 0x1004057b
sub eax, 1
test ecx, ecx
mov dword [esp + 0x28], eax
je 0x10040564
sub ebp, ecx
mov eax, 0x2aaaaaab
imul ebp
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebx, eax
jb 0x1004056d
call fcn.1015828d
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x2c]
lea ebp, [eax + ecx]
lea ecx, [esp + 0x28]
push ecx
jmp 0x100405aa
test ecx, ecx
je 0x10040595
sub ebp, ecx
mov eax, 0x2aaaaaab
imul ebp
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebx, eax
jb 0x1004059e
call fcn.1015828d
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x2c]
lea eax, [esp + 0x28]
lea ebp, [edx + ecx]
push eax
mov ecx, esi
call fcn.1003ae40
mov byte [ebp + 8], al
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x100405d8
mov ebp, dword [esp + 0x20]
mov edx, ebp
sub edx, ecx
mov eax, 0x2aaaaaab
imul edx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebx, eax
jb 0x100405e5
call fcn.1015828d
mov ebp, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x10040601
mov edx, ebp
sub edx, ecx
mov eax, 0x2aaaaaab
imul edx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebx, eax
jb 0x1004060e
call fcn.1015828d
mov ebp, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x1004062a
mov edx, ebp
sub edx, ecx
mov eax, 0x2aaaaaab
imul edx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebx, eax
jb 0x10040637
call fcn.1015828d
mov ebp, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
add ebx, 1
add dword [esp + 0x2c], 0xc
jmp 0x10040510
cmp ecx, ebp
mov dword [esp + 0x3c], ebp
jbe 0x10040659
call fcn.1015828d
mov ebp, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
cmp ecx, ebp
mov ebx, ecx
jbe 0x10040664
call fcn.1015828d
mov ebp, dword [esp + 0x3c]
mov ecx, ebp
sub ecx, ebx
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
push ecx
push ebp
push ebx
call fcn.100388d0
xor eax, eax
add esp, 0xc
mov dword [esp + 0x90], eax
mov dword [esp + 0x94], eax
mov dword [esp + 0x98], eax
mov edx, dword [esp + 0x34]
cmp byte [edx], al
mov byte [esp + 0x25c], 0xa
je 0x1004076f
mov ecx, dword [esp + 0x9c]
mov eax, dword [esp + 0x1c]
add ecx, 1
shr ecx, 1
test eax, eax
je 0x100406e3
mov edx, dword [esp + 0x20]
sub edx, eax
mov eax, 0x2aaaaaab
imul edx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ecx, eax
jae 0x100406e3
lea ecx, [eax + eax]
cmp ecx, 2
jae 0x100406ed
mov ecx, 2
push ecx
lea eax, [esp + 0x90]
push eax
lea ecx, [esi + 0xe0]
call fcn.100fb7aa
test eax, eax
jbe 0x1004076f
push 0
lea ecx, [esp + 0x90]
call fcn.10036790
lea ebp, [esi + 0x88]
push eax
mov ecx, ebp
call fcn.100fc247
cmp eax, dword [esi + 0x1cc]
jae 0x1004076f
cmp eax, 2
jae 0x1004076f
add eax, 1
push eax
push 0
lea ecx, [esp + 0x94]
call fcn.10036790
push eax
mov ecx, ebp
call fcn.100fbe5d
push 0
lea ecx, [esp + 0x90]
call fcn.10036790
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x5c], esp
push eax
call fcn.10001970
mov ecx, 0x101c7c6c
call fcn.100067f0
cmp dword [esp + 0x38], 0
mov dword [esp + 0x2c], 0
jle 0x100413e9
mov ebx, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
jmp 0x10040790
mov ecx, dword [esp + 0x70]
test ecx, ecx
je 0x100413e9
mov eax, dword [esp + 0x74]
sub eax, ecx
sar eax, 2
cmp dword [esp + 0x2c], eax
jae 0x100413e9
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x100407cf
mov ecx, dword [esp + 0x20]
sub ecx, ebp
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
jne 0x100407d8
call fcn.1015828d
mov ebp, dword [esp + 0x1c]
mov edx, dword [ebp]
lea ecx, [esp + 0x1bc]
mov dword [esp + 0x28], edx
call fcn.1001be80
mov eax, dword [esp + 0x90]
test eax, eax
mov byte [esp + 0x25c], 0xb
je 0x10040889
mov ecx, dword [esp + 0x94]
sub ecx, eax
mov eax, 0xdd67c8a7
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x10040889
lea ebp, [esi + 0x1594]
push ebp
call ebx
mov cl, byte [esi + 0x15ac]
push ebp
mov byte [esp + 0xa0], cl
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edx, dword [esp + 0x9c]
push edx
lea eax, [esp + 0x90]
push eax
lea ecx, [esp + 0x130]
push ecx
lea ecx, [esi + 0x88]
call fcn.100fc4ff
push eax
lea ecx, [esp + 0x1c0]
mov byte [esp + 0x260], 0xc
call fcn.1003c830
lea ecx, [esp + 0x128]
mov byte [esp + 0x25c], 0xb
call fcn.1001bf10
cmp dword [esp + 0x1d0], 0
jne 0x1004095f
lea ebp, [esi + 0x1594]
push ebp
call ebx
mov dl, byte [esi + 0x15ac]
push ebp
mov byte [esp + 0xcc], dl
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [esp + 0xc8]
push eax
lea ecx, [esp + 0x12c]
push ecx
lea ecx, [esi + 0x88]
call fcn.100fc770
push eax
lea ecx, [esp + 0x1c0]
mov byte [esp + 0x260], 0xd
call fcn.1003c830
lea ecx, [esp + 0x128]
mov byte [esp + 0x25c], 0xb
call fcn.1001bf10
push 0xffffffffffffffff
push 0
lea edx, [esp + 0x1c4]
push edx
lea ecx, [esp + 0x58]
mov dword [esp + 0x70], 0xf
mov dword [esp + 0x6c], 0
mov byte [esp + 0x5c], 0
call fcn.10001a10
cmp dword [esp + 0x64], 0x10
jb 0x10040936
mov eax, dword [esp + 0x50]
push eax
call fcn.10157f3b
add esp, 4
xor ebp, ebp
cmp dword [esp + 0x1d0], ebp
jne 0x10040961
add dword [esp + 0x2c], 1
lea ecx, [esp + 0x1bc]
mov byte [esp + 0x25c], 0xa
call fcn.1001bf10
jmp 0x1004130e
xor ebp, ebp
lea ecx, [esp + 0x18]
push ecx
mov ecx, esi
call fcn.100384c0
test al, al
je 0x10040abe
cmp dword [esp + 0x1d0], ebp
jbe 0x10040abe
cmp byte [esi + 0x1580], 0
mov ecx, dword [esp + 0x1c]
je 0x10040ab5
cmp ecx, ebp
mov byte [esi + 0x1580], 0
je 0x100409bb
mov ebp, dword [esp + 0x20]
mov edx, ebp
sub edx, ecx
mov eax, 0x2aaaaaab
imul edx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 1
ja 0x100409c8
call fcn.1015828d
mov ebp, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx + 0xc]
mov eax, dword [ecx + 0x10]
mov dword [esp + 0xcc], edx
mov edx, dword [ecx + 0x14]
mov dword [esp + 0xd4], edx
mov dword [esp + 0xd0], eax
mov edx, ebp
sub edx, ecx
mov eax, 0x2aaaaaab
imul edx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
jne 0x10040a09
call fcn.1015828d
mov ebp, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
test ecx, ecx
mov ebx, ecx
je 0x10040a26
sub ebp, ecx
mov eax, 0x2aaaaaab
imul ebp
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 1
ja 0x10040a2f
call fcn.1015828d
mov ecx, dword [esp + 0x1c]
mov edx, dword [ebx]
add ecx, 0xc
mov dword [ecx], edx
mov eax, dword [ebx + 4]
mov dword [ecx + 4], eax
mov edx, dword [ebx + 8]
mov dword [ecx + 8], edx
mov ecx, dword [esp + 0x20]
sub ecx, dword [esp + 0x1c]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
jne 0x10040a61
call fcn.1015828d
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0xcc]
mov edx, dword [esp + 0xd0]
mov dword [eax], ecx
mov ecx, dword [esp + 0xd4]
mov dword [eax + 4], edx
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x10040aa2
mov edx, dword [esp + 0x20]
sub edx, ecx
mov eax, 0x2aaaaaab
imul edx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
jne 0x10040aab
call fcn.1015828d
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx]
mov dword [esp + 0x28], edx
xor ebp, ebp
jmp 0x10040ac2
mov byte [esi + 0x1580], 1
jmp 0x10040ac2
mov ecx, dword [esp + 0x1c]
cmp ecx, ebp
je 0x10040ade
mov edx, dword [esp + 0x20]
sub edx, ecx
mov eax, 0x2aaaaaab
imul edx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
jne 0x10040ae7
call fcn.1015828d
mov ecx, dword [esp + 0x1c]
cmp ecx, ebp
je 0x10040b03
mov edx, dword [esp + 0x20]
sub edx, ecx
mov eax, 0x2aaaaaab
imul edx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
jne 0x10040b0c
call fcn.1015828d
mov ecx, dword [esp + 0x1c]
mov ebx, dword [esp + 0xa0]
cmp ebx, 2
mov dword [esp + 0x3c], ebp
je 0x10040b21
cmp ebx, 4
jne 0x10040b28
cmp dword [esp + 0x48], 3
je 0x10040b32
cmp byte [esp + 0x274], 0
je 0x10040b4e
lea ecx, [esp + 0x3c]
push ecx
mov ecx, dword [esi + 0x150]
call fcn.10134769
test al, al
je 0x10041321
mov ecx, dword [esp + 0x1c]
cmp ecx, ebp
je 0x10040b6a
mov edx, dword [esp + 0x20]
sub edx, ecx
mov eax, 0x2aaaaaab
imul edx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
jne 0x10040b73
call fcn.1015828d
mov ecx, dword [esp + 0x1c]
mov ecx, dword [ecx + 4]
push ecx
lea edx, [esp + 0x2c]
push edx
mov ecx, esi
call fcn.1003b5d0
mov dl, byte [esp + 0x274]
test dl, dl
jne 0x10040ba1
cmp ebx, 4
je 0x10040ba1
mov ecx, dword [esp + 0x28]
cmp ecx, dword [esp + 0x30]
ja 0x10041361
test al, al
jne 0x10040c76
cmp ebx, 2
je 0x10040bb3
cmp ebx, 4
jne 0x10040bbe
cmp dword [esp + 0x48], 3
je 0x10040c76
test dl, dl
jne 0x10040c76
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x100413dd
mov ebx, dword [esp + 0x20]
mov ecx, ebx
sub ecx, ebp
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 1
jbe 0x100413dd
cmp ebp, ebx
mov eax, ebp
mov dword [esp + 0x34], eax
jbe 0x10040c0e
call fcn.1015828d
mov ebx, dword [esp + 0x20]
mov ebp, dword [esp + 0x1c]
mov eax, dword [esp + 0x34]
cmp eax, ebx
jb 0x10040c23
call fcn.1015828d
mov ebx, dword [esp + 0x20]
mov ebp, dword [esp + 0x1c]
mov eax, dword [esp + 0x34]
cmp ebp, ebx
mov edx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [esp + 0xfc], edx
mov edx, dword [eax + 8]
mov dword [esp + 0x100], ecx
mov dword [esp + 0x104], edx
jbe 0x10040c49
call fcn.1015828d
push ebp
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x120]
push eax
lea ecx, [esp + 0x24]
call fcn.10037e80
lea ecx, [esp + 0xfc]
push ecx
lea ecx, [esp + 0x1c]
call fcn.1003b190
jmp 0x100412ef
mov ecx, dword [esp + 0x70]
cmp ecx, ebp
je 0x10040c8d
mov eax, dword [esp + 0x74]
sub eax, ecx
sar eax, 2
cmp dword [esp + 0x2c], eax
jb 0x10040c9d
call fcn.1015828d
mov ecx, dword [esp + 0x70]
mov dl, byte [esp + 0x274]
cmp ebx, 2
mov eax, dword [esp + 0x2c]
mov ebp, dword [ecx + eax*4]
je 0x10040cae
cmp ebx, 4
jne 0x10040cb5
cmp dword [esp + 0x48], 3
je 0x10040cf6
test dl, dl
jne 0x10040cf6
mov eax, dword [edi + 4]
test eax, eax
je 0x10040cda
mov ecx, dword [edi + 8]
sub ecx, eax
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebp, eax
jb 0x10040cdf
call fcn.1015828d
mov ecx, dword [edi + 4]
mov edx, dword [esp + 0x28]
lea ebx, [ebp + ebp*2]
add ebx, ebx
add ebx, ebx
add ebx, ebx
mov dword [ebx + ecx + 0x10], edx
jmp 0x10040d31
mov eax, dword [edi + 4]
test eax, eax
je 0x10040d17
mov ecx, dword [edi + 8]
sub ecx, eax
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebp, eax
jb 0x10040d1c
call fcn.1015828d
mov eax, dword [edi + 4]
mov ecx, dword [esp + 0x3c]
lea ebx, [ebp + ebp*2]
add ebx, ebx
add ebx, ebx
add ebx, ebx
mov dword [ebx + eax + 0x10], ecx
mov eax, dword [edi + 4]
test eax, eax
je 0x10040d52
mov ecx, dword [edi + 8]
sub ecx, eax
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebp, eax
jb 0x10040d57
call fcn.1015828d
mov eax, dword [esp + 0x30]
mov edx, dword [edi + 4]
mov dword [edx + ebx + 0x14], eax
mov eax, dword [edi + 4]
test eax, eax
je 0x10040d83
mov ecx, dword [edi + 8]
sub ecx, eax
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebp, eax
jb 0x10040d88
call fcn.1015828d
mov ecx, dword [edi + 4]
cmp dword [ebx + ecx + 8], 0
je 0x10040ea3
mov eax, ecx
test eax, eax
je 0x10040db6
mov ecx, dword [edi + 8]
sub ecx, eax
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebp, eax
jb 0x10040dbb
call fcn.1015828d
mov eax, dword [edi + 4]
add eax, ebx
mov eax, dword [eax + 8]
mov edx, dword [eax]
mov edx, dword [edx + 0x3c]
lea ecx, [esp + 0x128]
push ecx
mov ecx, eax
call edx
push eax
lea ecx, [esi + 0x88]
mov byte [esp + 0x260], 0xe
call fcn.100fbd8f
lea ecx, [esp + 0x128]
mov byte [esp + 0x25c], 0xb
call fcn.1001bf10
mov eax, dword [edi + 4]
test eax, eax
je 0x10040e1d
mov ecx, dword [edi + 8]
sub ecx, eax
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebp, eax
jb 0x10040e22
call fcn.1015828d
mov eax, dword [edi + 4]
add eax, ebx
mov eax, dword [eax + 8]
mov edx, dword [eax]
mov edx, dword [edx + 0x3c]
lea ecx, [esp + 0x128]
push ecx
mov ecx, eax
call edx
push 0xffffffffffffffff
push 0
push eax
lea ecx, [esp + 0x58]
mov byte [esp + 0x268], 0xf
mov dword [esp + 0x70], 0xf
mov dword [esp + 0x6c], 0
mov byte [esp + 0x5c], 0
call fcn.10001a10
cmp dword [esp + 0x64], 0x10
jb 0x10040e7a
mov eax, dword [esp + 0x50]
push eax
call fcn.10157f3b
add esp, 4
lea ecx, [esp + 0x128]
mov dword [esp + 0x64], 0xf
mov dword [esp + 0x60], 0
mov byte [esp + 0x50], 0
mov byte [esp + 0x25c], 0xb
call fcn.1001bf10
lea ecx, [esp + 0xac]
push ecx
lea ecx, [esp + 0x1c0]
call fcn.1003c6a0
mov eax, dword [edi + 4]
xor ebx, ebx
cmp eax, ebx
je 0x10040eda
mov ecx, dword [edi + 8]
sub ecx, eax
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebp, eax
jb 0x10040edf
call fcn.1015828d
mov eax, dword [edi + 4]
cmp eax, ebx
je 0x10040f00
mov ecx, dword [edi + 8]
sub ecx, eax
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebp, eax
jb 0x10040f05
call fcn.1015828d
cmp dword [esp + 0xc4], 0x10
jb 0x10040f1f
mov edx, dword [esp + 0xb0]
push edx
call fcn.10157f3b
add esp, 4
cmp dword [esp + 0x1d0], ebx
jbe 0x100413af
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x60], ebx
mov dword [esp + 0x64], ebx
lea eax, [esi + 0x15c0]
lea ebx, [eax + 4]
push ebx
mov dword [esp + 0xa8], 0x101975f4
mov dword [esp + 0xac], eax
mov dword [esp + 0x44], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esi + 0x20], 0
mov byte [esp + 0x25c], 0x11
sete al
test al, al
mov byte [esp + 0x17], al
jne 0x10040fe5
mov eax, dword [esi + 0x1c]
mov eax, dword [eax]
cmp eax, dword [esi + 0x1c]
lea ebx, [esi + 0x18]
mov dword [esp + 0xdc], eax
jne 0x10040f9a
call fcn.1015828d
mov eax, dword [esp + 0xdc]
add eax, 8
push eax
lea ecx, [esp + 0x50]
mov dword [esp + 0x38], eax
call fcn.1000d080
mov eax, dword [esp + 0x34]
mov ecx, dword [eax + 0x10]
mov dword [esp + 0x5c], ecx
mov edx, dword [eax + 0x14]
mov dword [esp + 0x60], edx
mov eax, dword [eax + 0x18]
mov dword [esp + 0x64], eax
mov eax, dword [ebx + 4]
mov eax, dword [eax]
push eax
push ebx
lea ecx, [esp + 0x128]
push ecx
mov ecx, ebx
call fcn.10039f40
mov ebx, dword [esp + 0x40]
push ebx
mov byte [esp + 0x260], 0x10
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp byte [esp + 0x17], 0
mov dword [esp + 0xa4], 0x101975e0
mov ecx, edi
je 0x10041153
xor ebx, ebx
push ebx
push ebp
call fcn.10036720
mov ecx, eax
call fcn.100386d0
push ebx
push ebp
mov ecx, edi
call fcn.10036720
mov edx, dword [eax + 0x10]
mov eax, dword [esi + 0x157c]
mov ecx, dword [esi + 0x150]
push edx
push eax
call fcn.10133a93
mov dword [esp + 0x80], ebx
mov dword [esp + 0x84], ebx
mov dword [esp + 0x88], ebx
mov ebx, dword [esi]
push ebp
mov ecx, edi
mov byte [esp + 0x260], 0x12
add ebx, 4
call fcn.10036720
mov ecx, dword [eax + 0x10]
push ecx
lea edx, [esp + 0x1c0]
push edx
mov ecx, esi
call fcn.100380e0
mov ecx, dword [esi + 0x1574]
push eax
mov eax, dword [esi + 0x1578]
push eax
push ecx
lea edx, [esp + 0x88]
push edx
push 0
push ebp
mov ecx, edi
call fcn.10036720
mov eax, dword [eax + 0x14]
push eax
push ebp
mov ecx, edi
call fcn.10036720
mov ecx, dword [eax + 0x10]
mov edx, dword [esp + 0x280]
push ecx
push edx
mov edx, dword [ebx]
lea eax, [esp + 0x1dc]
push eax
lea ecx, [esp + 0x12c]
push ecx
mov ecx, esi
call edx
mov ebx, eax
push ebp
mov ecx, edi
mov byte [esp + 0x260], 0x13
call fcn.10036720
push ebx
mov ecx, eax
call fcn.10037e20
lea ecx, [esp + 0x10c]
mov byte [esp + 0x25c], 0x12
mov dword [esp + 0x108], 0x101995c0
mov dword [esp + 0x10c], 0x10199578
call fcn.10006f60
mov eax, dword [esp + 0x80]
test eax, eax
mov byte [esp + 0x25c], 0x10
je 0x10041127
push eax
call fcn.10157f3b
add esp, 4
xor ebx, ebx
push ebp
mov ecx, edi
mov dword [esp + 0x84], ebx
mov dword [esp + 0x88], ebx
mov dword [esp + 0x8c], ebx
call fcn.10036720
push ebp
mov ecx, edi
call fcn.10036720
jmp 0x10041218
push 0
push ebp
call fcn.10036720
mov ecx, eax
call fcn.100386d0
mov eax, dword [esp + 0x5c]
mov ecx, dword [esi + 0x157c]
push 0
push eax
push ecx
mov ecx, dword [esi + 0x150]
call fcn.10133a93
mov edx, dword [esp + 0x5c]
mov ebx, dword [esi]
push edx
lea eax, [esp + 0x1c0]
push eax
mov ecx, esi
add ebx, 4
call fcn.100380e0
mov ecx, dword [esi + 0x1578]
mov edx, dword [esi + 0x1574]
push eax
push ecx
mov ecx, dword [esp + 0x68]
push edx
mov edx, dword [esp + 0x68]
lea eax, [esp + 0x58]
push eax
mov eax, dword [esp + 0x278]
push 0
push ecx
push edx
push eax
mov eax, dword [ebx]
lea ecx, [esp + 0x1dc]
push ecx
lea edx, [esp + 0x104]
push edx
mov ecx, esi
call eax
mov ebx, eax
push ebp
mov ecx, edi
mov byte [esp + 0x260], 0x14
call fcn.10036720
push ebx
mov ecx, eax
call fcn.10037e20
lea ecx, [esp + 0xe4]
mov byte [esp + 0x25c], 0x10
mov dword [esp + 0xe0], 0x101995c0
mov dword [esp + 0xe4], 0x10199578
call fcn.10006f60
xor ebx, ebx
lea ecx, [esp + 0x1bc]
push ecx
lea ecx, [esi + 0x88]
call fcn.100fbccc
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x1c4]
push edx
lea ecx, [esp + 0xb8]
mov dword [esp + 0xd0], 0xf
mov dword [esp + 0xcc], ebx
mov byte [esp + 0xbc], 0
call fcn.10001a10
cmp dword [esp + 0xc4], 0x10
jb 0x10041276
mov eax, dword [esp + 0xb0]
push eax
call fcn.10157f3b
add esp, 4
mov ebp, dword [esp + 0x1c]
cmp ebp, ebx
je 0x10041296
mov ecx, dword [esp + 0x20]
sub ecx, ebp
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
jne 0x1004129f
call fcn.1015828d
mov ebp, dword [esp + 0x1c]
mov byte [ebp + 8], 1
mov ecx, dword [esp + 0x20]
sub ecx, dword [esp + 0x1c]
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
jne 0x100412c2
call fcn.1015828d
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx + 4]
add edx, dword [esp + 0x28]
lea eax, [esp + 0x18]
shr edx, 1
push edx
push ebx
push eax
call fcn.10139a65
mov eax, dword [esp + 0x5c]
add esp, 0xc
cmp eax, ebx
je 0x100412ef
push eax
call fcn.10157f3b
add esp, 4
add dword [esp + 0x2c], 1
lea ecx, [esp + 0x1bc]
mov byte [esp + 0x25c], 0xa
call fcn.1001bf10
mov ebx, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [esp + 0x2c]
cmp ecx, dword [esp + 0x38]
jl 0x10040790
jmp 0x100413e9
lea ecx, [esp + 0x1bc]
call fcn.1001bf10
lea ecx, [esp + 0x8c]
call fcn.1003f430
mov eax, dword [esp + 0x1c]
cmp eax, ebp
je 0x1004134a
push eax
call fcn.10157f3b
add esp, 4
mov eax, dword [esp + 0x70]
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
cmp eax, ebp
jmp 0x1003ff1d
lea ecx, [esp + 0x1bc]
call fcn.1001bf10
lea ecx, [esp + 0x8c]
call fcn.1003f430
mov eax, dword [esp + 0x1c]
cmp eax, ebp
je 0x1004138a
push eax
call fcn.10157f3b
add esp, 4
mov eax, dword [esp + 0x70]
cmp eax, ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
je 0x100404c1
push eax
call fcn.10157f3b
add esp, 4
mov al, 1
jmp 0x10041421
lea edx, [esp + 0x1bc]
push edx
lea ecx, [esp + 0xb0]
call fcn.10001970
cmp dword [esp + 0xc4], 0x10
jb 0x100413dd
mov eax, dword [esp + 0xb0]
push eax
call fcn.10157f3b
add esp, 4
lea ecx, [esp + 0x1bc]
call fcn.1001bf10
lea ecx, [esp + 0x8c]
call fcn.1003f430
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x10041406
push eax
call fcn.10157f3b
add esp, 4
cmp dword [esp + 0x68], 0
mov eax, dword [esp + 0x70]
setne bl
test eax, eax
je 0x1004141f
push eax
call fcn.10157f3b
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x254]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x23c]
xor ecx, esp
call fcn.101586e7
add esp, 0x24c
ret 0x14