Function at 0x10116810
Capabilities:
Check for time delay via gettickcount
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x101975e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x110], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10c], eax
mov eax, dword [ebx + 0x164]
push esi
mov esi, dword [ebp + 0x18]
push edi
mov edi, dword [ebp + 0xc]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x188], ebx
mov dword [ebp - 0xc8], edi
mov dword [ebp - 0x98], esi
mov dword [ebx + 0x168], eax
test edi, edi
jne 0x1011687e
mov edi, dword [ebx + 0x10c]
mov dword [ebp - 0xc8], edi
test edi, edi
jne 0x1011687e
push 0xfffffffffffffff8
pop eax
jmp 0x10118bc5
mov ecx, ebx
call fcn.10040d3e
mov dword [edi + 0x68], eax
mov eax, dword [ebp - 0x10c]
test eax, eax
jne 0x101168b6
and dword [ebp - 0x94], eax
mov eax, dword [edi + 0x78]
mov dword [ebp - 0x88], eax
mov eax, dword [edi + 0x74]
mov dword [ebp - 0x90], eax
lea eax, [ebp - 0x94]
mov dword [ebp - 0x10c], eax
cmp dword [ebx + 0x13c], 0
mov ecx, dword [ebp + 0x1c]
mov dword [ebp - 0xd0], ecx
je 0x101168e9
test cl, 1
jne 0x101168e9
or dword [ebx + 0x158], 0x20000
mov ecx, ebx
push eax
push dword [ebp - 0x110]
call fcn.1005d353
push 0xfffffffffffffffe
jmp 0x10116878
or dword [ebx + 0x158], 0x40000000
xor eax, eax
inc eax
shr ecx, 3
and ecx, eax
mov dword [ebp - 0xb0], eax
mov eax, dword [ebx + 0x164]
mov dword [eax + 0xa4], ecx
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 0x190], eax
xor eax, eax
cmp dword [edi + 0x14], eax
je 0x10118b61
cmp dword [0x101970e8], eax
jne 0x10116975
mov dword [0x101970e8], eax
mov dword [0x101970f8], eax
mov dword [0x101970ec], eax
mov dword [0x101970f4], 0x3e8
mov dword [0x101970fc], eax
mov byte [0x10197100], al
call dword [sym.imp.WINMM.dll_timeGetTime]
cmp dword [0x101970ec], 0
mov dword [0x101970e8], eax
mov byte [0x10197100], 0
jne 0x10116975
and dword [0x101970f8], 0
mov dword [0x101970ec], eax
mov eax, dword [edi + 0x14]
mov dword [eax + 0x1c], esi
mov eax, dword [edi + 0x1c]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x10]
mov ecx, esi
call dword [0x10155aa8]
call esi
mov esi, dword [ebx + 0x164]
mov cl, al
xor eax, eax
test cl, cl
sete al
movzx edx, byte [esi + 0x11]
and edx, eax
mov eax, dword [ebx + 0x158]
shl edx, 0x19
and eax, 0xfdffffff
or edx, eax
cmp dword [ebx + 0x2a8], 0
mov dword [ebx + 0x158], edx
je 0x101169d5
test dword [esi + 0x28], 0x80000
mov dword [ebp - 0x108], 2
jne 0x101169df
mov dword [ebp - 0x108], 1
movss xmm0, dword [esi + 0x9c]
mov eax, dword [esi + 0x14]
mov ecx, dword [ebp - 0x108]
movss dword [ebp - 0x124], xmm0
movsd xmm0, qword [0x10159c70]
mov dword [ebp - 0x120], eax
xor eax, eax
movsd qword [ebp - 0x1c8], xmm0
movsd xmm0, qword [0x10159c38]
mov byte [ebp - 0xb5], 1
mov dword [ebp - 0xac], eax
movsd qword [ebp - 0x1d8], xmm0
cmp ecx, 1
jbe 0x10116a63
test eax, eax
jle 0x10116a63
mov eax, dword [ebx + 0x164]
push ebx
mov dword [eax + 0x14], 9
call fcn.1005d353
pop ecx
mov ecx, ebx
call fcn.100bfa12
test al, al
jne 0x10116a63
or dword [ebx + 0x15c], 1
and dword [edi + 0x84], 0xfffffffe
mov eax, dword [ebx]
push dword [ebp - 0x98]
push edi
mov esi, dword [eax + 0x34c]
mov ecx, esi
push ebx
call dword [0x10155aa8]
call esi
cmp dword [ebp - 0xac], 1
jge 0x10116aa5
mov eax, dword [edi + 0x14]
push 0
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x54]
mov ecx, esi
call dword [0x10155aa8]
call esi
mov dl, al
mov byte [ebp - 0xb5], dl
jmp 0x10116aab
mov dl, byte [ebp - 0xb5]
test dl, dl
je 0x10118b20
mov eax, dword [ebx + 0x154]
test eax, eax
je 0x10116ac4
mov dword [eax + 0x4c], 1
mov ecx, ebx
call fcn.100bfa12
mov edx, dword [ebx + 0x158]
movzx ecx, al
mov eax, edx
shr eax, 8
and eax, 1
cmp eax, ecx
je 0x10116b70
mov eax, dword [ebx + 0xf4]
and edx, 0xfffffeff
and dword [ebp - 0xa4], 0
shl ecx, 8
or ecx, edx
mov dword [ebx + 0x158], ecx
cmp dword [eax + 0x24], 0
jle 0x10116b51
mov edi, dword [ebp - 0xa4]
mov eax, dword [ebx + 0xf4]
push edi
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x10]
mov ecx, esi
call dword [0x10155aa8]
call esi
mov ecx, eax
mov eax, dword [ebx + 0x158]
shr eax, 6
xor eax, dword [ecx + 0x84]
and eax, 4
xor dword [ecx + 0x84], eax
inc edi
mov eax, dword [ebx + 0xf4]
cmp edi, dword [eax + 0x24]
jl 0x10116b0e
mov edi, dword [ebp - 0xc8]
or dword [edi + 0x80], 3
mov eax, dword [ebx]
push 0x3da6
push ebx
mov esi, dword [eax + 0xcc]
mov ecx, esi
call dword [0x10155aa8]
call esi
test byte [edi + 0x84], 2
je 0x10116bb6
mov eax, dword [edi + 0x14]
push dword [edi + 0x78]
push dword [edi + 0x74]
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 0x5c]
mov ecx, esi
call dword [0x10155aa8]
call esi
mov eax, dword [edi + 0x14]
and dword [edi + 0x84], 0xfffffffd
push 0xb
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x34]
mov ecx, esi
call dword [0x10155aa8]
call esi
test eax, eax
jne 0x10118b43
mov eax, dword [edi + 0x14]
push 1
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x34]
mov ecx, esi
call dword [0x10155aa8]
call esi
test eax, eax
je 0x10116bd6
or dword [edi + 0x80], 4
mov ecx, dword [ebx + 0x158]
test ecx, 0x18000000
je 0x10116bff
mov eax, dword [ebx]
push 1
push ebx
mov esi, dword [eax + 0x344]
mov ecx, esi
call dword [0x10155aa8]
call esi
mov ecx, dword [ebx + 0x158]
test byte [edi + 0x80], 3
jne 0x10116c10
test ecx, 0x18000040
je 0x10116c2a
mov eax, dword [ebx]
push edi
push ebx
mov esi, dword [eax + 0x340]
mov ecx, esi
call dword [0x10155aa8]
call esi
mov ecx, dword [ebx + 0x158]
mov eax, dword [ebx + 0x15c]
test al, 4
je 0x10116c63
test ecx, 0x100
jne 0x10116c5a
mov eax, dword [ebx]
push 0x186
push ebx
mov esi, dword [eax + 0xcc]
mov ecx, esi
call dword [0x10155aa8]
call esi
mov eax, dword [ebx + 0x15c]
or eax, 4
mov dword [ebx + 0x15c], eax
mov eax, dword [edi + 0x80]
mov esi, dword [ebp - 0x98]
test al, 3
je 0x10116c97
push esi
mov ecx, ebx
call fcn.1005d353
test byte [ebp - 0xd0], 0x20
jne 0x10116c8e
push esi
push 1
mov ecx, ebx
call fcn.1005d353
mov eax, dword [edi + 0x80]
and eax, 0xfffffffd
and eax, 0xffffffef
mov dword [edi + 0x80], eax
mov eax, dword [ebx]
push esi
push ebx
mov esi, dword [eax + 0x350]
mov ecx, esi
call dword [0x10155aa8]
call esi
mov eax, dword [ebx]
push 3
push ebx
mov esi, dword [eax + 0x19c]
mov ecx, esi
call dword [0x10155aa8]
call esi
test dword [ebx + 0x158], 0x100
mov dword [ebp - 0x194], eax
jne 0x10116ceb
cmp dword [ebp - 0xac], 0
jle 0x10116ceb
or dword [edi + 0x80], 1
test byte [edi + 0x80], 5
jne 0x10116d01
test byte [ebp - 0xd0], 0x10
je 0x10118a5e
mov eax, dword [edi + 0x40]
mov dword [ebp - 0xcc], eax
test eax, eax
jns 0x10116d1d
mov eax, dword [ebx + 0x164]
mov eax, dword [eax + 0x20]
mov dword [ebp - 0xcc], eax
mov eax, dword [edi + 0x14]
push 6
push eax
mov byte [ebp - 0x9a], 1
mov ecx, dword [eax]
mov esi, dword [ecx + 0x54]
mov ecx, esi
call dword [0x10155aa8]
call esi
mov eax, dword [ebp - 0xd0]
and eax, 0x10
mov dword [ebp - 0x18c], eax
je 0x10116d7c
mov eax, dword [edi + 0x14]
push 4
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x54]
mov ecx, esi
call dword [0x10155aa8]
call esi
mov eax, dword [edi + 0x14]
push 0xb
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x34]
mov ecx, esi
call dword [0x10155aa8]
call esi
test eax, eax
jne 0x101187f4
cmp dword [ebp - 0xac], 1
jge 0x10116da0
mov ecx, dword [edi + 0x14]
mov eax, dword [ebx + 0x16c]
mov edx, dword [ecx]
push dword [eax]
push ecx
mov esi, dword [edx + 0x60]
mov ecx, esi
call dword [0x10155aa8]
call esi
mov eax, dword [edi + 0x14]
push 2
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x54]
mov ecx, esi
call dword [0x10155aa8]
call esi
test al, al
je 0x101187f4
push dword [ebp - 0x98]
mov esi, dword [ebx]
and dword [ebx + 0x148], 0
push 0
push edi
mov esi, dword [esi + 0xc4]
mov ecx, esi
push ebx
call dword [0x10155aa8]
call esi
mov dword [ebp - 0xb0], eax
test eax, eax
js 0x101187f4
mov esi, dword [ebp - 0x98]
test esi, esi
je 0x10116e13
push 2
mov ecx, esi
call fcn.1005d353
test al, al
jne 0x10116e13
or eax, 0xffffffff
mov dword [ebp - 0xb0], eax
jmp 0x101187f4
cmp dword [ebp - 0xac], 0
jne 0x10116e42
mov eax, dword [ebx]
push edi
push ebx
mov esi, dword [eax + 0x3d4]
mov ecx, esi
call dword [0x10155aa8]
call esi
test al, al
je 0x10116e3c
push edi
mov ecx, ebx
call fcn.1005d353
mov esi, dword [ebp - 0x98]
mov eax, dword [ebx + 0x164]
push 0x2e
push 0
mov ebx, dword [eax + 0x28]
mov ecx, ebx
mov eax, 0x800
and ecx, eax
mov eax, ebx
or ecx, 0x2000
shl ecx, 0x10
mov edx, ecx
or edx, 0x40000000
and eax, 0x400
cmove edx, ecx
mov ecx, edx
or ecx, 0x10000000
and bl, 8
mov ebx, dword [ebp - 0x188]
cmove ecx, edx
mov edx, ecx
or edx, 0x80000000
mov eax, dword [ebx + 0x158]
and eax, 0x100
lea eax, [ebp - 0x104]
cmove edx, ecx
push eax
mov dword [ebp - 0xa4], edx
call sub.VCRUNTIME140.dll_memset
mov eax, dword [ebx + 0x154]
add esp, 0xc
test eax, eax
je 0x10116ec0
and dword [eax + 4], 0
mov byte [0x10197100], 0
xor eax, eax
mov ecx, dword [ebx + 0x164]
mov dword [ebp - 0xbc], eax
cmp dword [ecx + 0x30], eax
je 0x10116f34
cmp byte [0x10197104], al
je 0x10116f34
cmp dword [ebx + 0x148], eax
jle 0x10116f34
inc eax
cmp dword [ecx + 0x34], eax
jge 0x10116ef9
mov dword [ecx + 0x34], eax
mov ecx, dword [ebx + 0x164]
mov eax, 0x3e8
cdq
idiv dword [ecx + 0x34]
mov dword [0x101970f0], eax
push dword [ebx + 0x148]
push dword [ebx + 0x144]
call fcn.101197e2
mov dword [ebp - 0xbc], eax
pop ecx
pop ecx
test eax, eax
jne 0x10116f34
cmp dword [ebx + 0x148], eax
jle 0x10116f34
push 0xfffffffffffffff4
pop eax
jmp 0x10116e08
xor ecx, ecx
mov dword [ebp - 0xb4], ecx
cmp dword [ebx + 0x148], ecx
jle 0x10117a8c
xor edx, edx
mov dword [ebp - 0xd4], edx
test eax, eax
je 0x10116f59
mov eax, dword [eax + ecx*8]
jmp 0x10116f61
mov eax, dword [ebx + 0x144]
add eax, edx
mov byte [eax + 0xa0], 0
mov dword [ebp - 0xa8], eax
mov dword [0x101970fc], ecx
test esi, esi
je 0x10116fb4
mov ecx, dword [ebx + 0x164]
cmp dword [ecx + 0x30], 0
je 0x10116f95
cmp byte [0x10197104], 0
je 0x10116f95
push ecx
push 0x10119710
jmp 0x10116f99
push 0
push 0
mov eax, dword [esi]
mov esi, dword [eax + 0x78]
mov ecx, esi
call dword [0x10155aa8]
mov ecx, dword [ebp - 0x98]
call esi
mov eax, dword [ebp - 0xa8]
cmp dword [ebx + 0x33c], 2
je 0x10117cbd
and dword [ebp - 0x100], 0
xor edx, edx
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x10116fdf
mov ecx, dword [ecx + 0x44]
shr ecx, 9
and ecx, 0xffffff01
jmp 0x10116fe1
xor cl, cl
mov eax, dword [ebx + 0x164]
mov dword [ebp - 0xa0], ecx
cmp dword [eax + 0x30], edx
je 0x1011703c
cmp byte [0x10197104], dl
je 0x1011703c
cmp byte [0x10197100], dl
je 0x1011703c
test cl, cl
jne 0x1011703c
cmp dword [eax + 0x30], 2
je 0x10117a2e
mov eax, dword [ebx]
push 0x3f3a38
push 3
push ebx
mov esi, dword [eax + 0x198]
mov ecx, esi
call dword [0x10155aa8]
call esi
mov eax, dword [ebp - 0xa8]
mov ecx, ebx
push dword [eax + 8]
call fcn.1005d353
mov edx, eax
mov ecx, dword [ebp - 0xa8]
mov eax, dword [ebx]
and dword [ebp - 0x100], 0
mov dword [ebp - 0x104], edx
push dword [ecx + 8]
mov esi, dword [eax + 0x3e8]
mov ecx, esi
push edi
push ebx
call dword [0x10155aa8]
call esi
mov ecx, dword [ebp - 0xea]
mov esi, dword [ebp - 0xa8]
movzx eax, al
shl eax, 2
xor eax, ecx
and eax, 4
xor ecx, eax
mov eax, dword [ebx + 0x164]
mov dword [ebp - 0xea], ecx
and ecx, 0xfffffff4
mov edx, dword [eax + 0x28]
shr edx, 7
and edx, 8
mov dword [ebp - 0xda], 1
or edx, ecx
mov dword [ebp - 0xea], edx
mov ax, word [esi + 0x8c]
and dword [ebp - 0xe2], 0
mov word [ebp - 0xec], ax
mov dword [ebp - 0xde], 0x3f800000
mov eax, dword [esi + 8]
test dword [eax + 0x44], 0x200
je 0x101170ec
mov eax, dword [ebx + 0x164]
mov ecx, 0x800
test word [eax + 0x2c], cx
je 0x101170ec
mov eax, 0x80
jmp 0x101170ee
xor eax, eax
and edx, 0xffffff7f
or edx, eax
cmp dword [ebx + 0x2a8], 0
mov dword [ebp - 0xea], edx
je 0x10117115
push esi
mov ecx, ebx
call fcn.1005d353
test al, al
je 0x10117115
mov cl, 1
jmp 0x10117117
xor cl, cl
cmp byte [ebp - 0xa0], 0
mov byte [ebp - 0x99], cl
je 0x10117142
mov eax, dword [ebx + 0x164]
push 0
test dword [eax + 0x28], 0x40000
movzx eax, cl
pop ecx
cmovne eax, ecx
mov byte [ebp - 0x99], al
lea eax, [ebp - 0x99]
push eax
push dword [edi + 0x14]
push dword [esi + 8]
call fcn.1005d353
add esp, 0xc
cmp byte [ebp - 0x99], 0
je 0x10117181
mov eax, dword [edi + 0x14]
push 1
push 1
push 0x3ea
mov esi, dword [eax]
push eax
mov ecx, dword [esi + 0x18]
call dword [0x10155aa8]
call dword [esi + 0x18]
mov esi, dword [ebp - 0xa8]
push dword [ebp - 0x98]
mov eax, dword [esi]
lea ecx, [esi + 0xc]
lea edx, [ebp - 0x104]
mov dword [ebp - 0xa0], ecx
push edx
push ecx
mov ecx, dword [ebp - 0xa8]
mov esi, dword [eax]
push dword [ecx + 8]
mov esi, dword [esi + 0xa0]
mov ecx, esi
push edi
push eax
call dword [0x10155aa8]
call esi
cmp byte [ebp - 0x99], 0
mov dword [ebp - 0xc0], eax
je 0x101171e7
mov ecx, dword [edi + 0x14]
push 1
push 0
push 0x3ea
mov esi, dword [ecx]
push ecx
mov ecx, dword [esi + 0x18]
call dword [0x10155aa8]
call dword [esi + 0x18]
mov eax, dword [ebp - 0xc0]
cmp eax, 1
jne 0x1011794d
mov eax, dword [ebp - 0xe2]
test eax, eax
je 0x10117829
mov ecx, dword [ebp - 0xa8]
push dword [ebp - 0x98]
push 0
mov dword [ecx + 0x94], eax
mov eax, dword [ebp - 0xf0]
mov dword [ecx + 0x90], eax
mov eax, dword [ecx]
movss xmm0, dword [ebp - 0xde]
movss dword [ecx + 0x9c], xmm0
lea ecx, [ebp - 0x1ac]
push ecx
mov esi, dword [eax]
push eax
mov esi, dword [esi + 0xb4]
mov ecx, esi
call dword [0x10155aa8]
call esi
test al, al
je 0x10117769
lea esi, [ebp - 0x1ac]
movss xmm0, dword [ebp - 0x1a0]
lea edi, [ebp - 0x178]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x178]
push eax
lea eax, [ebp - 0x1e4]
push eax
movsd dword es:[edi], dword [esi]
push dword [ebp - 0xa0]
movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x1a0]
lea edi, [ebp - 0x16c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x1ac]
lea edi, [ebp - 0x11c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movss dword [ebp - 0x11c], xmm0
lea esi, [ebp - 0x11c]
lea edi, [ebp - 0x154]
movss xmm0, dword [ebp - 0x19c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x1ac]
movss dword [ebp - 0x150], xmm0
lea edi, [ebp - 0x130]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x1ac]
movss dword [ebp - 0x12c], xmm0
lea edi, [ebp - 0x160]
movss xmm0, dword [ebp - 0x198]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x11c]
movss dword [ebp - 0x158], xmm0
lea edi, [ebp - 0x148]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x130]
movss dword [ebp - 0x140], xmm0
lea edi, [ebp - 0x184]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movss dword [ebp - 0x17c], xmm0
call fcn.1005d353
mov esi, eax
lea edi, [ebp - 0x178]
lea eax, [ebp - 0x16c]
push eax
lea eax, [ebp - 0x1f0]
movsd dword es:[edi], dword [esi]
push eax
push dword [ebp - 0xa0]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.1005d353
mov esi, eax
lea edi, [ebp - 0x16c]
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x238]
movsd dword es:[edi], dword [esi]
push eax
push dword [ebp - 0xa0]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.1005d353
mov esi, eax
lea edi, [ebp - 0x11c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x154]
movsd dword es:[edi], dword [esi]
push eax
lea eax, [ebp - 0x1fc]
push eax
push dword [ebp - 0xa0]
call fcn.1005d353
mov esi, eax
lea edi, [ebp - 0x154]
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x208]
movsd dword es:[edi], dword [esi]
push eax
push dword [ebp - 0xa0]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.1005d353
mov esi, eax
lea edi, [ebp - 0x130]
lea eax, [ebp - 0x160]
push eax
lea eax, [ebp - 0x214]
movsd dword es:[edi], dword [esi]
push eax
push dword [ebp - 0xa0]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.1005d353
mov esi, eax
lea edi, [ebp - 0x160]
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x220]
movsd dword es:[edi], dword [esi]
push eax
push dword [ebp - 0xa0]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.1005d353
mov esi, eax
lea edi, [ebp - 0x148]
lea eax, [ebp - 0x184]
push eax
lea eax, [ebp - 0x22c]
movsd dword es:[edi], dword [esi]
push eax
push dword [ebp - 0xa0]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.1005d353
movss xmm1, dword [ebp - 0x178]
lea edi, [ebp - 0x184]
movss xmm0, dword [ebp - 0x174]
mov esi, eax
cvtps2pd xmm0, xmm0
movsd dword es:[edi], dword [esi]
cvtps2pd xmm1, xmm1
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0xc8]
mov eax, dword [edi + 0x1c]
mulsd xmm0, qword [eax + 0x13c]
mulsd xmm1, qword [eax + 0x11c]
addsd xmm1, xmm0
movss xmm0, dword [ebp - 0x170]
cvtps2pd xmm0, xmm0
mulsd xmm0, qword [eax + 0x15c]
addsd xmm1, xmm0
movss xmm0, dword [ebp - 0x168]
cvtps2pd xmm0, xmm0
addsd xmm1, qword [eax + 0x17c]
cvtpd2ps xmm2, xmm1
movss xmm1, dword [ebp - 0x16c]
cvtps2pd xmm1, xmm1
movss dword [ebp - 0x170], xmm2
mulsd xmm0, qword [eax + 0x13c]
mulsd xmm1, qword [eax + 0x11c]
addsd xmm1, xmm0
movss xmm0, dword [ebp - 0x164]
cvtps2pd xmm0, xmm0
mulsd xmm0, qword [eax + 0x15c]
addsd xmm1, xmm0
addsd xmm1, qword [eax + 0x17c]
cvtpd2ps xmm0, xmm1
movss xmm1, dword [ebp - 0x11c]
movss dword [ebp - 0x164], xmm0
movss xmm0, dword [ebp - 0x118]
cvtps2pd xmm1, xmm1
cvtps2pd xmm0, xmm0
mulsd xmm1, qword [eax + 0x11c]
mulsd xmm0, qword [eax + 0x13c]
addsd xmm1, xmm0
movss xmm0, dword [ebp - 0x114]
cvtps2pd xmm0, xmm0
mulsd xmm0, qword [eax + 0x15c]
addsd xmm1, xmm0
movss xmm0, dword [ebp - 0x154]
cvtps2pd xmm0, xmm0
addsd xmm1, qword [eax + 0x17c]
cvtpd2ps xmm3, xmm1
movss xmm1, dword [ebp - 0x150]
cvtps2pd xmm1, xmm1
movss dword [ebp - 0x114], xmm3
mulsd xmm0, qword [eax + 0x11c]
mulsd xmm1, qword [eax + 0x13c]
addsd xmm1, xmm0
movss xmm0, dword [ebp - 0x14c]
cvtps2pd xmm0, xmm0
mulsd xmm0, qword [eax + 0x15c]
addsd xmm1, xmm0
movss xmm0, dword [ebp - 0x130]
cvtps2pd xmm0, xmm0
addsd xmm1, qword [eax + 0x17c]
cvtpd2ps xmm4, xmm1
movss xmm1, dword [ebp - 0x12c]
cvtps2pd xmm1, xmm1
movss dword [ebp - 0x14c], xmm4
mulsd xmm0, qword [eax + 0x11c]
mulsd xmm1, qword [eax + 0x13c]
addsd xmm1, xmm0
movss xmm0, dword [ebp - 0x128]
cvtps2pd xmm0, xmm0
mulsd xmm0, qword [eax + 0x15c]
addsd xmm1, xmm0
movss xmm0, dword [ebp - 0x160]
cvtps2pd xmm0, xmm0
addsd xmm1, qword [eax + 0x17c]
cvtpd2ps xmm5, xmm1
movss xmm1, dword [ebp - 0x15c]
cvtps2pd xmm1, xmm1
movss dword [ebp - 0x128], xmm5
mulsd xmm0, qword [eax + 0x11c]
mulsd xmm1, qword [eax + 0x13c]
addsd xmm1, xmm0
movss xmm0, dword [ebp - 0x158]
cvtps2pd xmm0, xmm0
mulsd xmm0, qword [eax + 0x15c]
addsd xmm1, xmm0
movss xmm0, dword [ebp - 0x148]
cvtps2pd xmm0, xmm0
addsd xmm1, qword [eax + 0x17c]
cvtpd2ps xmm6, xmm1
movss xmm1, dword [ebp - 0x144]
cvtps2pd xmm1, xmm1
movss dword [ebp - 0x158], xmm6
mulsd xmm0, qword [eax + 0x11c]
mulsd xmm1, qword [eax + 0x13c]
addsd xmm1, xmm0
movss xmm0, dword [ebp - 0x140]
cvtps2pd xmm0, xmm0
mulsd xmm0, qword [eax + 0x15c]
addsd xmm1, xmm0
movss xmm0, dword [ebp - 0x184]
cvtps2pd xmm0, xmm0
addsd xmm1, qword [eax + 0x17c]
cvtpd2ps xmm7, xmm1
movss xmm1, dword [ebp - 0x180]
cvtps2pd xmm1, xmm1
movss dword [ebp - 0x140], xmm7
mulsd xmm1, qword [eax + 0x13c]
mulsd xmm0, qword [eax + 0x11c]
addsd xmm1, xmm0
mov edx, dword [ebp - 0xa8]
movss xmm0, dword [ebp - 0x17c]
cvtps2pd xmm0, xmm0
mulsd xmm0, qword [eax + 0x15c]
addsd xmm1, xmm0
movss xmm0, dword [ebp - 0x164]
comiss xmm0, xmm2
addsd xmm1, qword [eax + 0x17c]
cvtpd2ps xmm1, xmm1
jbe 0x101176f8
movss dword [edx + 0x98], xmm2
jmp 0x10117703
movss dword [edx + 0x98], xmm0
movaps xmm2, xmm0
comiss xmm2, xmm3
jbe 0x10117713
movss dword [edx + 0x98], xmm3
movaps xmm2, xmm3
comiss xmm2, xmm4
jbe 0x10117723
movss dword [edx + 0x98], xmm4
movaps xmm2, xmm4
comiss xmm2, xmm5
jbe 0x10117733
movss dword [edx + 0x98], xmm5
movaps xmm2, xmm5
comiss xmm2, xmm6
jbe 0x10117743
movss dword [edx + 0x98], xmm6
movaps xmm2, xmm6
comiss xmm2, xmm7
jbe 0x10117753
movss dword [edx + 0x98], xmm7
movaps xmm2, xmm7
comiss xmm2, xmm1
jbe 0x10117812
movss dword [edx + 0x98], xmm1
jmp 0x10117812
mov eax, dword [ebp - 0xa8]
lea edx, [ebp - 0x25c]
push edx
movsd xmm0, qword [eax + 0x6c]
movsd qword [ebp - 0x1c0], xmm0
movsd xmm0, qword [eax + 0x74]
movsd qword [ebp - 0xc4], xmm0
movsd xmm0, qword [eax + 0x7c]
mov eax, dword [edi + 0x1c]
push eax
movsd qword [ebp - 0x1d0], xmm0
mov ecx, dword [eax]
mov esi, dword [ecx + 0x74]
mov ecx, esi
call dword [0x10155aa8]
call esi
movsd xmm2, qword [ebp - 0xc4]
movsd xmm1, qword [ebp - 0x1d0]
movsd xmm0, qword [ebp - 0x1c0]
cvtpd2ps xmm2, xmm2
cvtpd2ps xmm1, xmm1
subss xmm2, dword [eax + 4]
subss xmm1, dword [eax + 8]
cvtpd2ps xmm0, xmm0
subss xmm0, dword [eax]
lea eax, [ebp - 0x1b8]
movss dword [ebp - 0x1b4], xmm2
push eax
movss dword [ebp - 0x1b0], xmm1
movss dword [ebp - 0x1b8], xmm0
call fcn.1005d353
mov edx, dword [ebp - 0xa8]
fstp dword [edx + 0x98]
mov eax, dword [ebx + 0x2c0]
push edx
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x30]
mov ecx, esi
call dword [0x10155aa8]
call esi
lea eax, [ebp - 0x99]
push eax
mov eax, dword [ebp - 0xa8]
push dword [edi + 0x14]
push dword [eax + 8]
call fcn.1005d353
add esp, 0xc
cmp byte [ebp - 0x99], 0
je 0x10117868
mov eax, dword [edi + 0x14]
push 1
push 1
push 0x3ea
mov esi, dword [eax]
push eax
mov ecx, dword [esi + 0x18]
call dword [0x10155aa8]
call dword [esi + 0x18]
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x100], 1
mov ecx, dword [eax + 8]
mov edx, dword [ecx + 0xa4]
test edx, edx
je 0x101178a2
mov eax, dword [edi + 0x14]
push edx
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x50]
mov ecx, esi
call dword [0x10155aa8]
call esi
mov eax, dword [ebp - 0xa8]
mov ecx, dword [eax + 8]
push dword [ebp - 0x98]
mov eax, dword [eax]
lea edx, [ebp - 0x104]
push edx
push dword [ebp - 0xa0]
mov esi, dword [eax]
push ecx
push edi
push eax
mov esi, dword [esi + 0xa4]
mov ecx, esi
call dword [0x10155aa8]
call esi
mov esi, dword [ebp - 0xa8]
mov byte [esi + 0xa0], 1
cmp eax, 0xfffffff4
je 0x10117a66
or ecx, 0xffffffff
cmp eax, ecx
jne 0x10117905
push dword [ebp - 0x98]
lea eax, [ebp - 0x104]
mov ecx, ebx
push eax
push esi
push edi
call fcn.1005d353
mov dword [ebp - 0xb0], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 0xa4]
test ecx, ecx
je 0x10117927
mov eax, dword [edi + 0x14]
neg ecx
push ecx
push eax
mov esi, dword [eax]
mov ecx, dword [esi + 0x50]
call dword [0x10155aa8]
call dword [esi + 0x50]
cmp byte [ebp - 0x99], 0
je 0x10117996
mov eax, dword [edi + 0x14]
push 1
push 0
push 0x3ea
mov esi, dword [eax]
push eax
mov ecx, dword [esi + 0x18]
call dword [0x10155aa8]
call dword [esi + 0x18]
jmp 0x10117996
cmp eax, 0xfffffff4
je 0x10117a66
or ecx, 0xffffffff
cmp eax, ecx
jne 0x10117996
mov esi, dword [ebp - 0x98]
mov dword [ebp - 0xb0], ecx
mov ecx, esi
push 2
call fcn.1005d353
test al, al
je 0x101187cf
push esi
lea eax, [ebp - 0x104]
mov ecx, ebx
push eax
push dword [ebp - 0xa8]
push edi
call fcn.1005d353
mov dword [ebp - 0xb0], eax
mov ecx, dword [ebp - 0x98]
test ecx, ecx
je 0x101179d2
mov eax, dword [ebx + 0x164]
cmp dword [eax + 0xa4], 0
je 0x101179d2
mov esi, dword [ecx]
push 0
push dword [ebx + 0x148]
push dword [ebp - 0xb4]
push ecx
mov ecx, dword [esi + 0xc]
call dword [0x10155aa8]
call dword [esi + 0xc]
mov ecx, dword [ebp - 0x98]
mov eax, dword [ebx + 0x164]
cmp dword [eax + 0x30], 0
je 0x10117a11
cmp byte [0x10197104], 0
je 0x10117a11
mov ecx, 0x101970e8
call fcn.101191dd
test al, al
je 0x10117a2e
mov eax, dword [ebx]
push 0x3f3a38
push 3
push ebx
mov esi, dword [eax + 0x198]
mov ecx, esi
call dword [0x10155aa8]
call esi
jmp 0x10117a2e
test ecx, ecx
je 0x10117a2e
mov eax, dword [ecx]
push 0
push 0
mov esi, dword [eax + 0x78]
mov ecx, esi
call dword [0x10155aa8]
mov ecx, dword [ebp - 0x98]
call esi
mov ecx, dword [ebp - 0xb4]
mov edx, dword [ebp - 0xd4]
inc ecx
add edx, 0xa4
mov dword [ebp - 0xb4], ecx
mov dword [ebp - 0xd4], edx
cmp ecx, dword [ebx + 0x148]
jge 0x10117a8c
mov esi, dword [ebp - 0x98]
mov eax, dword [ebp - 0xbc]
jmp 0x10116f50
mov ecx, dword [ebp - 0x98]
push 0xfffffffffffffff4
pop eax
mov dword [ebp - 0xb0], eax
mov eax, dword [ecx]
push 4
push ecx
mov esi, dword [eax + 0x20]
mov ecx, esi
call dword [0x10155aa8]
call esi
jmp 0x101187cf
cmp dword [ebx + 0x33c], 2
je 0x10117cbd
cmp dword [ebp - 0xac], 0
jne 0x10117cbd
mov eax, dword [ebx]
push edi
push ebx
mov esi, dword [eax + 0x3e4]
mov ecx, esi
call dword [0x10155aa8]
call esi
test al, al
je 0x10117ae2
test dword [ebx + 0x158], 0x1000000
jne 0x10117ae2
mov eax, dword [ebx + 0x16c]
mov ecx, edi
push 2
push dword [eax + 4]
lea eax, [ebx + 0x74]
push eax
push 0
call fcn.1005d353
mov eax, dword [ebp - 0xcc]
test eax, eax
je 0x10117b01
cmp eax, 3
je 0x10117b01
push eax
push edi
mov ecx, ebx
call fcn.101161fe
mov byte [ebp - 0x9a], 0
cmp dword [ebx + 0x2a8], 0
je 0x10117cbd
mov eax, dword [ebp - 0x98]
test eax, eax
je 0x10117b37
mov ecx, eax
call fcn.100c21be
test al, al
jne 0x10117b37
or eax, 0xffffffff
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0x98]
jmp 0x10117cc7
mov eax, dword [ebx + 0x2ac]
test eax, eax
jne 0x10117b56
mov ecx, ebx
call fcn.100ea79d
mov eax, dword [ebx + 0x2ac]
test eax, eax
je 0x10117cbd
push dword [ebp - 0x98]
mov esi, dword [eax]
lea ecx, [ebp - 0x1ac]
push 0
push ecx
push eax
mov esi, dword [esi + 0xb4]
mov ecx, esi
call dword [0x10155aa8]
call esi
test al, al
je 0x10117cbd
mov eax, dword [edi + 0x1c]
lea ecx, [ebp - 0x1ac]
push 1
push ecx
push 0
mov esi, dword [eax]
push eax
mov ecx, dword [esi + 0x14]
call dword [0x10155aa8]
call dword [esi + 0x14]
mov ecx, dword [ebx + 0x2ac]
mov word [ecx + 0x138], ax
mov eax, 0x4000
mov ecx, dword [ebx + 0x2ac]
test word [ecx + 0x138], ax
jne 0x10117cbd
mov eax, dword [ecx]
push dword [ebp - 0xa4]
push 6
mov esi, dword [eax + 0x98]
push ecx
mov ecx, esi
call dword [0x10155aa8]
call esi
or eax, dword [ebp - 0xa4]
push 0x80
mov dword [ebp - 0xc0], eax
lea eax, [ebp - 0x84]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x84]
push eax
call fcn.1005d353
test dword [ebx + 0x158], 0x100
jne 0x10117c2a
mov ecx, dword [ebx + 0x2ac]
lea eax, [ebp - 0x84]
push eax
push edi
call fcn.1005d353
mov eax, dword [ebx + 0x2ac]
lea ecx, [ebp - 0x84]
push 0
push dword [ebp - 0x98]
mov esi, dword [eax]
push edi
push ecx
push dword [ebp - 0xc0]
mov esi, dword [esi + 0x8c]
mov ecx, esi
push eax
call dword [0x10155aa8]
call esi
mov dword [ebp - 0xc0], eax
test eax, eax
jns 0x10117ca4
mov ecx, dword [ebx + 0x28]
push eax
push ecx
mov edx, dword [ecx]
mov esi, dword [edx + 0x338]
mov ecx, esi
call dword [0x10155aa8]
call esi
cmp dword [ebp - 0xc0], 0xfffffff4
jne 0x10117ca4
mov ecx, dword [ebp - 0x98]
push 0xfffffffffffffff4
pop eax
mov dword [ebp - 0xb0], eax
mov eax, dword [ecx]
push 4
push ecx
mov esi, dword [eax + 0x20]
mov ecx, esi
call dword [0x10155aa8]
call esi
mov eax, dword [edi + 0x14]
push dword [ebx + 0x2ac]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x58]
mov ecx, esi
call dword [0x10155aa8]
call esi
mov eax, dword [ebp - 0x98]
test eax, eax
je 0x10117ce0
mov eax, dword [eax]
push 0
push 0
mov esi, dword [eax + 0x78]
mov ecx, esi
call dword [0x10155aa8]
mov ecx, dword [ebp - 0x98]
call esi
cmp dword [ebx + 0x33c], 1
mov esi, dword [ebp - 0xac]
je 0x10117db2
test esi, esi
jne 0x10117db2
cmp dword [ebx + 0x2c4], esi
je 0x10117db2
mov eax, dword [ebx]
push edi
push ebx
mov esi, dword [eax + 0x3d0]
mov ecx, esi
call dword [0x10155aa8]
call esi
test al, al
je 0x10117dac
mov ecx, dword [ebx + 0x2c4]
xor edx, edx
mov dword [ebp - 0xa4], edx
cmp dword [ecx + 0x24], edx
jle 0x10117dac
mov eax, dword [ecx]
push edx
push ecx
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [0x10155aa8]
call esi
push 7
push eax
mov dword [ebp - 0xc0], eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0xf0]
mov ecx, esi
call dword [0x10155aa8]
call esi
mov ecx, eax
mov eax, dword [ebp - 0xc0]
test byte [eax + 0x44], 1
jne 0x10117d94
test dword [ecx + 0x50], 0x200
jne 0x10117d94
push dword [ebp - 0x98]
mov esi, dword [ecx]
push eax
push edi
push ecx
mov esi, dword [esi + 0x124]
mov ecx, esi
call dword [0x10155aa8]
call esi
mov edx, dword [ebp - 0xa4]
mov ecx, dword [ebx + 0x2c4]
inc edx
mov dword [ebp - 0xa4], edx
cmp edx, dword [ecx + 0x24]
jl 0x10117d36
mov esi, dword [ebp - 0xac]
mov eax, dword [ebx + 0x2c0]
cmp dword [eax + 0x24], 0
je 0x1011827c
cmp dword [ebx + 0x33c], 2
je 0x1011827c
mov ecx, ebx
call fcn.1005d353
test esi, esi
jne 0x10117f42
mov eax, dword [ebp - 0xcc]
test eax, eax
je 0x10117f42
cmp byte [ebp - 0x9a], 0
je 0x10117f42
cmp dword [ebx + 0x2a8], esi
je 0x10117e16
push eax
push edi
mov ecx, ebx
call fcn.101161fe
mov byte [ebp - 0x9a], 0
jmp 0x10117f42
push 0x80
lea eax, [ebp - 0x84]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov eax, dword [edi + 0xc]
lea ecx, [ebp - 0x84]
add esp, 0xc
mov esi, dword [eax]
push 1
push ecx
push eax
mov esi, dword [esi + 0x9c]
mov ecx, esi
call dword [0x10155aa8]
call esi
mov eax, dword [edi + 0xc]
push 4
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0xf0]
mov ecx, esi
call dword [0x10155aa8]
call esi
test eax, eax
je 0x10117e83
mov ecx, dword [eax]
lea edx, [ebp - 0x13c]
push edx
push eax
mov esi, dword [ecx + 0xe4]
mov ecx, esi
call dword [0x10155aa8]
call esi
jmp 0x10117ea8
mov eax, dword [edi + 0x1c]
lea edx, [ebp - 0x244]
push edx
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x74]
mov ecx, esi
call dword [0x10155aa8]
call esi
mov esi, eax
lea edi, [ebp - 0x13c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x13c]
push eax
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.1005d353
mov esi, eax
lea edi, [ebp - 0x13c]
movzx eax, byte [ebx + 0x349]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
sub eax, 0
je 0x10117f18
sub eax, 1
je 0x10117f07
sub eax, 3
je 0x10117ef9
sub eax, 1
jne 0x10117f3c
movss xmm0, dword [ebx + 0x84]
comiss xmm0, dword [ebp - 0x138]
jmp 0x10117f24
movss xmm0, dword [ebp - 0x138]
comiss xmm0, dword [ebx + 0x78]
jmp 0x10117f24
movss xmm0, dword [ebx + 0x88]
comiss xmm0, dword [ebp - 0x134]
jmp 0x10117f24
movss xmm0, dword [ebp - 0x134]
comiss xmm0, dword [ebx + 0x7c]
mov edi, dword [ebp - 0xc8]
seta al
test al, al
je 0x10117f42
mov eax, dword [ebp - 0xcc]
jmp 0x10117e01
mov edi, dword [ebp - 0xc8]
push 0x2e
lea eax, [ebp - 0x104]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov ecx, dword [ebx + 0x2c0]
xor edx, edx
add esp, 0xc
mov dword [ebp - 0xb4], edx
cmp dword [ecx + 0x24], edx
jle 0x1011826c
mov eax, dword [ecx]
push edx
push ecx
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [0x10155aa8]
call esi
push 2
pop edx
mov dword [ebp - 0x100], edx
mov ecx, dword [eax + 0x90]
or dword [ebp - 0xea], edx
mov dword [ebp - 0xf0], ecx
movss xmm0, dword [eax + 0x9c]
mov ecx, dword [ebx]
movss dword [ebp - 0xf4], xmm0
push dword [eax + 8]
mov dword [ebp - 0xa0], eax
mov esi, dword [ecx + 0x3e8]
mov ecx, esi
push edi
push ebx
call dword [0x10155aa8]
call esi
mov ecx, dword [ebp - 0xea]
mov esi, dword [ebp - 0xa0]
movzx eax, al
shl eax, 2
xor eax, ecx
and eax, 4
xor ecx, eax
mov eax, dword [ebx + 0x164]
mov dword [ebp - 0xea], ecx
mov edx, dword [eax + 0x28]
shr edx, 7
xor edx, ecx
and edx, 8
xor edx, ecx
mov ecx, dword [ebx + 0x164]
or edx, 1
mov dword [ebp - 0xea], edx
mov eax, dword [esi + 0x94]
mov dword [ebp - 0x104], eax
mov eax, dword [esi + 8]
test dword [eax + 0x44], 0x200
je 0x10118030
mov eax, 0x800
test word [ecx + 0x2c], ax
je 0x10118030
mov eax, 0x80
jmp 0x10118032
xor eax, eax
and edx, 0xffffff7f
or edx, eax
mov dword [ebp - 0xea], edx
mov eax, dword [esi + 8]
cmp eax, dword [ebx + 0x2a8]
jne 0x10118058
cmp dword [ebp - 0xac], 0
jg 0x10118250
mov eax, dword [ebp - 0x98]
test eax, eax
je 0x10118096
xor edx, edx
cmp dword [ecx + 0x30], edx
je 0x10118079
cmp byte [0x10197104], dl
je 0x10118079
push ecx
push 0x10119710
jmp 0x1011807b
push edx
push edx
mov eax, dword [eax]
mov esi, dword [eax + 0x78]
mov ecx, esi
call dword [0x10155aa8]
mov ecx, dword [ebp - 0x98]
call esi
mov esi, dword [ebp - 0xa0]
mov eax, dword [ebx + 0x164]
cmp dword [eax + 0x30], 0
je 0x1011812d
cmp byte [0x10197104], 0
je 0x1011812d
mov eax, dword [ebx + 0x148]
mov ecx, 0x101970e8
add eax, dword [ebp - 0xb4]
mov dword [0x101970fc], eax
call fcn.101191dd
test al, al
je 0x1011812d
mov eax, dword [ebx]
push 0x3f3a38
push 3
push ebx
mov esi, dword [eax + 0x198]
mov ecx, esi
call dword [0x10155aa8]
call esi
mov esi, dword [ebp - 0xa0]
cmp dword [esi + 0x94], 2
je 0x1011812d
mov ecx, dword [esi + 8]
cmp ecx, dword [ebx + 0x2a8]
je 0x1011812d
mov eax, dword [ebx + 0x164]
cmp dword [eax + 0x30], 2
je 0x10118250
push ecx
mov ecx, ebx
call fcn.1005d353
mov dword [ebp - 0x104], eax
mov dword [esi + 0x94], eax
and dword [ebp - 0xea], 0xfffffffe
cmp dword [ebx + 0x2a8], 0
je 0x10118146
push esi
mov ecx, ebx
call fcn.1005d353
test al, al
je 0x10118146
mov al, 1
jmp 0x10118148
xor al, al
mov byte [ebp - 0x99], al
lea eax, [ebp - 0x99]
push eax
push dword [edi + 0x14]
push dword [esi + 8]
call fcn.1005d353
add esp, 0xc
cmp byte [ebp - 0x99], 0
je 0x1011818d
mov eax, dword [edi + 0x14]
push 1
push 1
push 0x3ea
mov esi, dword [eax]
push eax
mov ecx, dword [esi + 0x18]
call dword [0x10155aa8]
call dword [esi + 0x18]
mov esi, dword [ebp - 0xa0]
mov edx, dword [esi + 8]
mov eax, dword [edx + 0xa4]
mov dword [ebp - 0xc0], eax
test eax, eax
je 0x101181c2
mov eax, dword [edi + 0x14]
push dword [ebp - 0xc0]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x50]
mov ecx, esi
call dword [0x10155aa8]
call esi
mov esi, dword [ebp - 0xa0]
mov edx, dword [esi + 8]
push dword [ebp - 0x98]
mov ecx, dword [esi]
lea eax, [ebp - 0x104]
push eax
mov eax, dword [ebp - 0xa0]
add eax, 0xc
mov esi, dword [ecx]
push eax
push edx
push edi
mov esi, dword [esi + 0xa4]
push ecx
mov ecx, esi
call dword [0x10155aa8]
call esi
mov ecx, dword [ebp - 0xb0]
or edx, 0xffffffff
cmp eax, edx
mov eax, dword [ebp - 0xa0]
cmove ecx, edx
mov dword [ebp - 0xb0], ecx
mov eax, dword [eax + 8]
mov ecx, dword [eax + 0xa4]
test ecx, ecx
je 0x1011822c
mov eax, dword [edi + 0x14]
neg ecx
push ecx
push eax
mov esi, dword [eax]
mov ecx, dword [esi + 0x50]
call dword [0x10155aa8]
call dword [esi + 0x50]
cmp byte [ebp - 0x99], 0
je 0x10118250
mov eax, dword [edi + 0x14]
push 1
push 0
push 0x3ea
mov esi, dword [eax]
push eax
mov ecx, dword [esi + 0x18]
call dword [0x10155aa8]
call dword [esi + 0x18]
mov edx, dword [ebp - 0xb4]
mov ecx, dword [ebx + 0x2c0]
inc edx
mov dword [ebp - 0xb4], edx
cmp edx, dword [ecx + 0x24]
jl 0x10117f6c
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 0x28]
mov ecx, esi
call dword [0x10155aa8]
call esi
mov eax, dword [ebp - 0x98]
test eax, eax
je 0x1011829f
mov eax, dword [eax]
push 0
push 0
mov esi, dword [eax + 0x78]
mov ecx, esi
call dword [0x10155aa8]
mov ecx, dword [ebp - 0x98]
call esi
cmp dword [ebp - 0xac], 0
jle 0x101182af
push ebx
call fcn.1005d353
pop ecx
cmp dword [ebx + 0x33c], 1
je 0x1011836e
cmp dword [ebx + 0x2c4], 0
je 0x1011836e
mov eax, dword [ebx]
push edi
push ebx
mov esi, dword [eax + 0x3d0]
mov ecx, esi
call dword [0x10155aa8]
call esi
test al, al
je 0x1011836e
mov ecx, dword [ebx + 0x2c4]
xor edx, edx
mov dword [ebp - 0xa4], edx
cmp dword [ecx + 0x24], edx
jle 0x1011836e
mov eax, dword [ecx]
push edx
push ecx
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [0x10155aa8]
call esi
push 7
push eax
mov dword [ebp - 0xc0], eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0xf0]
mov ecx, esi
call dword [0x10155aa8]
call esi
mov ecx, eax
mov eax, dword [ebp - 0xc0]
test byte [eax + 0x44], 1
jne 0x10118356
test dword [ecx + 0x50], 0x200
je 0x10118356
push dword [ebp - 0x98]
mov esi, dword [ecx]
push eax
push edi
push ecx
mov esi, dword [esi + 0x124]
mov ecx, esi
call dword [0x10155aa8]
call esi
mov edx, dword [ebp - 0xa4]
mov ecx, dword [ebx + 0x2c4]
inc edx
mov dword [ebp - 0xa4], edx
cmp edx, dword [ecx + 0x24]
jl 0x101182f8
mov eax, dword [ebx + 0x164]
test dword [eax + 0x28], 0x200000
je 0x10118551
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0xc0], eax
mov eax, dword [edi + 0x14]
push 1
push 0
push 0x3e9
mov esi, dword [eax]
push eax
mov ecx, dword [esi + 0x18]
call dword [0x10155aa8]
call dword [esi + 0x18]
xor eax, eax
mov dword [ebp - 0xa4], eax
cmp dword [ebx + 0x148], eax
jle 0x1011852a
mov ecx, dword [ebp - 0xbc]
xor edx, edx
mov dword [ebp - 0xa0], edx
test ecx, ecx
je 0x101183d3
mov eax, dword [ecx + eax*8]
jmp 0x101183db
mov eax, dword [ebx + 0x144]
add eax, edx
mov dword [ebp - 0xb4], eax
test eax, eax
je 0x10118505
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x101184ff
mov ecx, dword [ecx + 0x70]
test ecx, ecx
je 0x101184ff
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 0x40]
mov ecx, esi
call dword [0x10155aa8]
call esi
cmp eax, 1
jne 0x101184f9
mov esi, dword [ebp - 0xb4]
mov ecx, dword [esi + 8]
call fcn.10015e98
push 4
pop ecx
cmp eax, ecx
jne 0x101184f9
mov dword [ebp - 0x100], 3
mov eax, dword [esi + 0x90]
or dword [ebp - 0xea], 2
mov dword [ebp - 0xf0], eax
mov eax, dword [ebx]
mov dword [ebp - 0x104], ecx
movss xmm0, dword [esi + 0x9c]
movss dword [ebp - 0xf4], xmm0
push dword [esi + 8]
mov esi, dword [eax + 0x3e8]
mov ecx, esi
push edi
push ebx
call dword [0x10155aa8]
call esi
mov edx, dword [ebp - 0xb4]
movzx ecx, al
mov eax, dword [ebp - 0xea]
and ecx, 1
and eax, 0xfffffff2
shl ecx, 2
or ecx, eax
mov dword [ebp - 0xea], ecx
mov eax, dword [edx + 8]
test dword [eax + 0x44], 0x200
je 0x101184bf
mov eax, dword [ebx + 0x164]
mov esi, 0x800
test word [eax + 0x2c], si
je 0x101184bf
mov eax, 0x80
jmp 0x101184c1
xor eax, eax
push dword [ebp - 0x98]
and ecx, 0xffffff7f
or ecx, eax
lea eax, [ebp - 0x104]
mov dword [ebp - 0xea], ecx
mov ecx, dword [edx]
push eax
lea eax, [edx + 0xc]
push eax
mov esi, dword [ecx]
push dword [edx + 8]
push edi
mov esi, dword [esi + 0xa4]
push ecx
mov ecx, esi
call dword [0x10155aa8]
call esi
mov edx, dword [ebp - 0xa0]
mov ecx, dword [ebp - 0xbc]
mov eax, dword [ebp - 0xa4]
add edx, 0xa4
inc eax
mov dword [ebp - 0xa0], edx
mov dword [ebp - 0xa4], eax
cmp eax, dword [ebx + 0x148]
jl 0x101183ca
mov eax, dword [edi + 0x14]
push 1
push 1
push 0x3e9
mov esi, dword [eax]
push eax
mov ecx, dword [esi + 0x18]
call dword [0x10155aa8]
call dword [esi + 0x18]
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x100], eax
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0xc0], eax
mov eax, dword [edi + 0x14]
push 1
push 0
push 0x3e9
mov esi, dword [eax]
push eax
mov ecx, dword [esi + 0x18]
call dword [0x10155aa8]
call dword [esi + 0x18]
cmp dword [ebx + 0x33c], 2
je 0x101186f7
xor eax, eax
mov dword [ebp - 0xd4], eax
cmp dword [ebx + 0x148], eax
jle 0x101186f7
xor edx, edx
mov dword [ebp - 0xb4], edx
mov ecx, dword [ebp - 0xbc]
test ecx, ecx
je 0x101185b0
mov ecx, dword [ecx + eax*8]
jmp 0x101185b8
mov ecx, dword [ebx + 0x144]
add ecx, edx
cmp byte [ecx + 0xa0], 0
mov dword [ebp - 0xa4], ecx
je 0x101186f7
mov esi, dword [ecx + 8]
test esi, esi
je 0x101186d8
mov esi, dword [esi + 0xa8]
test esi, 0x4000
je 0x101185ea
cmp dword [edi + 0x68], 0xffffffff
je 0x10118600
test esi, 0x10000000
je 0x101186d8
cmp dword [edi + 0x68], 1
jne 0x101186d8
mov dword [ebp - 0x100], 4
mov eax, dword [ecx + 0x90]
or dword [ebp - 0xea], 2
mov dword [ebp - 0xf0], eax
mov eax, dword [ebx]
mov dword [ebp - 0x104], 8
movss xmm0, dword [ecx + 0x9c]
movss dword [ebp - 0xf4], xmm0
push dword [ecx + 8]
mov esi, dword [eax + 0x3e8]
mov ecx, esi
push edi
push ebx
call dword [0x10155aa8]
call esi
mov edx, dword [ebp - 0xa4]
movzx ecx, al
mov eax, dword [ebp - 0xea]
and ecx, 1
and eax, 0xfffffff2
shl ecx, 2
or ecx, eax
mov dword [ebp - 0xea], ecx
mov eax, dword [edx + 8]
test dword [eax + 0x44], 0x200
je 0x10118692
mov eax, dword [ebx + 0x164]
mov esi, 0x800
test word [eax + 0x2c], si
je 0x10118692
mov eax, 0x80
jmp 0x10118694
xor eax, eax
push dword [ebp - 0x98]
and ecx, 0xffffff7f
or ecx, eax
lea eax, [ebp - 0x104]
mov dword [ebp - 0xea], ecx
mov ecx, dword [edx]
push eax
lea eax, [edx + 0xc]
push eax
mov esi, dword [ecx]
push dword [edx + 8]
push edi
mov esi, dword [esi + 0xa4]
push ecx
mov ecx, esi
call dword [0x10155aa8]
call esi
mov eax, dword [ebp - 0xd4]
mov edx, dword [ebp - 0xb4]
inc eax
add edx, 0xa4
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0xb4], edx
cmp eax, dword [ebx + 0x148]
jl 0x101185a1
mov eax, dword [edi + 0x14]
push 1
push 1
push 0x3e9
mov esi, dword [eax]
push eax
mov ecx, dword [esi + 0x18]
call dword [0x10155aa8]
call dword [esi + 0x18]
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x100], eax
mov eax, dword [ebp - 0xcc]
test eax, eax
je 0x1011874a
cmp byte [ebp - 0x9a], 0
je 0x1011874a
cmp dword [ebx + 0x33c], 2
je 0x1011874a
push eax
push edi
mov ecx, ebx
call fcn.101161fe
mov byte [ebp - 0x9a], 0
mov eax, dword [ebx + 0x114]
test eax, eax
je 0x101187cf
cmp dword [eax], 0
je 0x101187cf
push edi
mov ecx, ebx
call fcn.1005d353
mov ecx, dword [ebx + 0x2b8]
test ecx, ecx
je 0x101187cf
mov eax, dword [ecx + 0x24]
test eax, eax
je 0x101187cf
xor edx, edx
mov dword [ebp - 0xa4], edx
test eax, eax
jle 0x101187cf
mov eax, dword [ebx + 0x114]
push dword [eax]
mov eax, dword [ecx]
push edx
push ecx
mov esi, dword [eax + 0x10]
mov ecx, esi
call dword [0x10155aa8]
call esi
push eax
push edi
mov ecx, ebx
call fcn.1005d353
mov eax, dword [ebx + 0x2b8]
cmp dword [eax + 0x24], 1
jle 0x101187b7
mov ecx, ebx
call fcn.10109ff0
test al, al
jne 0x101187cf
mov edx, dword [ebp - 0xa4]
mov ecx, dword [ebx + 0x2b8]
inc edx
mov dword [ebp - 0xa4], edx
cmp edx, dword [ecx + 0x24]
jl 0x1011877e
mov eax, dword [ebp - 0xcc]
test eax, eax
je 0x101187f4
cmp byte [ebp - 0x9a], 0
je 0x101187f4
cmp dword [ebx + 0x33c], 2
je 0x101187f4
push eax
push edi
mov ecx, ebx
call fcn.101161fe
cmp byte [0x107d4580], 0
je 0x10118804
push ebx
call fcn.1005d353
pop ecx
mov eax, dword [ebx + 0x164]
mov ecx, dword [ebp - 0x120]
movss xmm0, dword [ebp - 0x124]
mov dword [eax + 0x14], ecx
mov eax, dword [ebx + 0x164]
movss dword [eax + 0x9c], xmm0
mov eax, dword [ebp - 0x98]
test eax, eax
je 0x1011884c
mov eax, dword [eax]
push 0
push 0
mov esi, dword [eax + 0x78]
mov ecx, esi
call dword [0x10155aa8]
mov ecx, dword [ebp - 0x98]
call esi
mov eax, dword [ebx]
push dword [ebp - 0x194]
push 3
mov esi, dword [eax + 0x198]
mov ecx, esi
push ebx
call dword [0x10155aa8]
call esi
test byte [ebp - 0xd0], 0x20
jne 0x101189c3
push dword [ebp - 0x98]
mov ecx, ebx
push 0
call fcn.1005d353
test byte [ebx + 0x158], 0x10
jne 0x101189c3
call sub.kernel32.dll_GetTickCount
sub eax, dword [ebp - 0x190]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10159cf0]
mov eax, dword [ebx + 0x328]
cvtpd2ps xmm0, xmm0
movss dword [ebx + eax*4 + 0x2d8], xmm0
mov ecx, dword [ebx + 0x328]
mov eax, dword [ebx + 0x32c]
inc ecx
mov dword [ebx + 0x328], ecx
mov edx, eax
cmp eax, 0x14
jge 0x101188e5
inc eax
mov dword [ebx + 0x32c], eax
mov edx, eax
cmp ecx, 0x14
jne 0x101188f1
and dword [ebx + 0x328], 0
lea ecx, [ebx + 0x198]
xorps xmm2, xmm2
and dword [ecx], 0
xorps xmm1, xmm1
test eax, eax
jle 0x10118924
lea eax, [ebx + 0x2d8]
movss xmm1, dword [eax]
add eax, 4
addss xmm1, dword [ecx]
movss dword [ecx], xmm1
sub edx, 1
jne 0x1011890a
mov edx, dword [ebx + 0x32c]
movd xmm0, edx
cvtdq2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, xmm2
jbe 0x10118945
movss xmm0, dword [0x10163980]
divss xmm0, xmm1
movaps xmm1, xmm0
jmp 0x10118956
movss xmm1, dword [0x1016397c]
lea ecx, [ebx + 0x198]
movaps xmm0, xmm1
cvtps2pd xmm0, xmm0
push ecx
push ecx
movss dword [ecx], xmm1
mulsd xmm0, qword [ebp - 0x1c8]
addsd xmm0, qword [ebp - 0x1d8]
cvttsd2si eax, xmm0
movd xmm0, eax
lea eax, [ebp - 0x84]
cvtdq2ps xmm0, xmm0
divss xmm0, dword [0x1016397c]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
push 0x90e
push eax
call fcn.1005d353
mov eax, dword [ebp - 0x98]
add esp, 0x10
test eax, eax
je 0x101189c3
mov esi, dword [eax]
lea ecx, [ebp - 0x84]
push ecx
push 1
push eax
mov ecx, dword [esi + 0x18]
call dword [0x10155aa8]
call dword [esi + 0x18]
add esp, 0xc
and dword [edi + 0x80], 0xfffffffa
cmp dword [ebp - 0x18c], 0
je 0x101189e8
mov eax, dword [edi + 0x14]
push 5
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x54]
mov ecx, esi
call dword [0x10155aa8]
call esi
mov eax, dword [ebp - 0xb0]
cmp eax, 0xfffffff4
je 0x10118a49
cmp dword [ebx + 0x33c], 2
je 0x10118a49
test byte [ebp - 0xd0], 0x80
jne 0x10118a0e
push eax
push edi
mov ecx, ebx
call fcn.1005d353
mov ecx, dword [ebx + 0x338]
test ecx, ecx
jle 0x10118a36
mov eax, dword [edi + 0x14]
push 0xff000000
push ecx
push 0
mov esi, dword [eax]
push eax
mov esi, dword [esi + 0x84]
mov ecx, esi
call dword [0x10155aa8]
call esi
mov ecx, ebx
call fcn.1001efd9
test eax, eax
je 0x10118a49
push edi
mov ecx, ebx
call fcn.1005d353
mov eax, dword [edi + 0x14]
push 3
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x54]
mov ecx, esi
call dword [0x10155aa8]
call esi
mov eax, dword [ebx + 0x164]
mov ecx, dword [ebp - 0x120]
movss xmm0, dword [ebp - 0x124]
mov dword [eax + 0x14], ecx
mov eax, dword [ebx + 0x164]
movss dword [eax + 0x9c], xmm0
mov eax, dword [ebp - 0x108]
dec eax
cmp dword [ebp - 0xac], eax
jne 0x10118b20
mov esi, dword [ebp - 0x110]
test esi, esi
je 0x10118ad1
mov eax, dword [ebp - 0x98]
test eax, eax
je 0x10118ab7
push 2
mov ecx, eax
call fcn.1005d353
test al, al
je 0x10118ad1
mov eax, dword [edi + 0x14]
push dword [ebp - 0x10c]
push esi
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 0x64]
mov ecx, esi
call dword [0x10155aa8]
call esi
mov eax, dword [edi + 0x14]
push 1
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x54]
mov ecx, esi
call dword [0x10155aa8]
call esi
mov eax, dword [edi + 0x14]
xor ecx, ecx
mov esi, dword [ebp - 0x98]
mov dword [eax + 0x1c], ecx
test esi, esi
je 0x10118b26
mov eax, dword [ebx + 0x164]
cmp dword [eax + 0xa4], ecx
je 0x10118b26
mov esi, dword [esi]
or eax, 0xffffffff
push ecx
push eax
push eax
push dword [ebp - 0x98]
mov ecx, dword [esi + 0xc]
call dword [0x10155aa8]
call dword [esi + 0xc]
mov esi, dword [ebp - 0x98]
mov eax, dword [ebp - 0xac]
mov ecx, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0xac], eax
cmp eax, ecx
jl 0x10116a2d
jmp 0x10118b74
mov ecx, dword [ebx]
push 0
push 8
push ebx
mov esi, dword [ecx + 0x15c]
mov ecx, esi
call dword [0x10155aa8]
call esi
push 0xfffffffffffffffd
jmp 0x10116878
push dword [ebp - 0x10c]
mov ecx, ebx
push dword [ebp - 0x110]
call fcn.1005d353
test esi, esi
je 0x10118b97
mov eax, dword [esi]
push 0
push 0
mov esi, dword [eax + 0x78]
mov ecx, esi
call dword [0x10155aa8]
mov ecx, dword [ebp - 0x98]
call esi
mov esi, dword [ebp - 0x98]
and dword [0x101970e8], 0
mov ebx, dword [ebp - 0xb0]
mov byte [0x10197100], 0
cmp ebx, 0xfffffff4
je 0x10118bc3
test esi, esi
je 0x10118bc3
mov ecx, esi
call fcn.100c21be
test al, al
push 0xffffffffffffffff
pop eax
cmove ebx, eax
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10147db0
leave
ret 0x18