Function at 0x100c3070
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x10176f03
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x101b01e4]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x101b01e4]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x28], esi
mov dword [esi], 0x10186fd8
lea edi, [esi + 4]
xor ebx, ebx
mov ecx, edi
mov dword [esp + 0x48], ebx
call fcn.10033b60
mov dword [esi + 8], 0x10184590
mov dword [esi + 0xc], 0x101870e8
mov dword [esi + 0x10], 0x101870ec
mov dword [esi + 0x14], 0x101870f0
mov dword [esi], 0x10187408
mov dword [edi], 0x10187360
mov dword [esi + 8], 0x101872b8
mov dword [esi + 0xc], 0x101872b4
mov dword [esi + 0x10], 0x101872b0
mov dword [esi + 0x14], 0x10187298
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], 0x10187110
mov edi, dword [sym.imp.KERNEL32.DLL_InitializeCriticalSection]
lea eax, [esi + 0x34]
mov ebp, 0x1018458c
push eax
mov dword [esi + 0x30], ebp
call edi
lea ecx, [esi + 0x4c]
mov byte [esp + 0x48], 4
call fcn.100a2e90
mov dword [esi + 0x50], eax
mov byte [eax + 0x1a1], 1
mov eax, dword [esi + 0x50]
mov dword [eax + 4], eax
mov eax, dword [esi + 0x50]
mov dword [eax], eax
mov eax, dword [esi + 0x50]
mov dword [eax + 8], eax
mov dword [esi + 0x54], ebx
push 0xb68
lea eax, [esi + 0x64]
push ebx
push eax
mov byte [esp + 0x54], 5
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
call fcn.10149460
mov eax, 0x10
push 0xb68
mov dword [esi + 0xbc4], eax
mov dword [esi + 0xbc0], eax
lea eax, [esi + 0xbcc]
push ebx
push eax
mov dword [esi + 0x6a], 0xa
mov dword [esi + 0x6e], 0x7d0
mov dword [esi + 0x72], 4
mov byte [esi + 0xbcb], bl
mov dword [esi + 0x7a], 0x1000
call fcn.10149460
mov eax, 0x10
push 0x114a
mov dword [esi + 0x172c], eax
mov dword [esi + 0x1728], eax
lea eax, [esi + 0x1734]
push ebx
mov dword [esi + 0xbd2], 0xa
mov dword [esi + 0xbd6], 0x7d0
mov dword [esi + 0xbda], 4
mov byte [esi + 0x1733], bl
mov dword [esi + 0xbe2], 0x1000
push eax
call fcn.10149460
push 0x34
lea eax, [esi + 0x287e]
push ebx
push eax
mov dword [esi + 0x1734], ebx
call fcn.10149460
add esp, 0x30
push ebx
mov dword [esi + 0x287e], 0xa
mov dword [esi + 0x2882], 0x4e20
mov dword [esi + 0x2886], 5
mov dword [esi + 0x288a], 0x1e
mov byte [esi + 0x288e], bl
mov byte [esi + 0x288f], bl
mov byte [esi + 0x2890], bl
push ebx
lea ecx, [esi + 0x28b8]
mov dword [esi + 0x28b4], 0x80000000
call fcn.100637b0
push ebx
push ebx
lea ecx, [esi + 0x2900]
mov byte [esp + 0x50], 6
call fcn.100637b0
push ebx
push ebx
lea ecx, [esi + 0x2948]
mov byte [esp + 0x50], 7
call fcn.100637b0
lea ecx, [esi + 0x2990]
mov byte [esp + 0x48], 8
call fcn.100d89a0
mov dword [esi + 0x29c4], ebx
mov dword [esi + 0x29c8], ebx
mov dword [esi + 0x29cc], ebx
mov cl, byte [esi + 0x29d4]
mov dword [esi + 0x29d0], ebx
and cl, 0xf1
mov byte [esi + 0x29d5], bl
mov dword [esi + 0x29d6], ebx
mov word [esi + 0x29da], bx
mov dword [esi + 0x29dc], ebx
mov word [esi + 0x29e0], bx
mov dword [esi + 0x29e2], ebx
mov word [esi + 0x29e6], bx
or cl, 0x11
mov byte [esi + 0x29d4], cl
mov byte [esi + 0x29e8], bl
mov dword [esi + 0x29e9], ebx
mov word [esi + 0x29ed], bx
mov byte [esi + 0x29ef], bl
lea ecx, [esi + 0x2a04]
mov byte [esp + 0x48], 0xa
mov dword [esi + 0x29f8], 0x10187560
mov dword [esi + 0x29fc], ebx
call fcn.100ab540
lea ecx, [esi + 0x2a4c]
mov byte [esp + 0x48], 0xb
mov dword [esi + 0x2a48], ebx
call fcn.100af280
push str._p2pdownload_tencent_dr
lea ecx, [esi + 0x2a78]
mov byte [esp + 0x4c], 0xc
call fcn.100a0440
push 0x40
mov byte [esp + 0x4c], 0xd
call fcn.1014979e
add esp, 4
mov dword [esp + 0x24], eax
mov byte [esp + 0x48], 0xe
cmp eax, ebx
je 0x100c338c
lea edx, [esi + 0x2a84]
push edx
push esi
mov ecx, eax
call fcn.10016b50
jmp 0x100c338e
xor eax, eax
lea ecx, [esi + 0x2a84]
mov byte [esp + 0x48], 0xd
mov dword [esi + 0x2a80], eax
call fcn.1002b6f0
lea ecx, [esi + 0x2ab0]
push 0xc
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push str.fs_bt.qq.com
mov byte [esp + 0x50], 0xf
mov byte [ecx + 4], bl
call fcn.10001fe0
lea ecx, [esi + 0x2ad4]
mov dword [esi + 0x2acc], ebx
mov word [esi + 0x2ad0], bx
push 0xc
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push str.fs_rc.qq.com
mov byte [esp + 0x50], 0x10
mov byte [ecx + 4], bl
call fcn.10001fe0
lea ecx, [esi + 0x2af8]
mov dword [esi + 0x2af0], ebx
mov word [esi + 0x2af4], bx
push 0xe
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push str.xf.stat.qq.com
mov byte [esp + 0x50], 0x11
mov byte [ecx + 4], bl
call fcn.10001fe0
lea ecx, [esi + 0x2b1c]
mov dword [esi + 0x2b14], ebx
mov word [esi + 0x2b18], bx
push 0x11
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push str.xf_bt.stat.qq.com
mov byte [esp + 0x50], 0x12
mov byte [ecx + 4], bl
call fcn.10001fe0
lea ecx, [esi + 0x2b40]
mov dword [esi + 0x2b38], ebx
mov word [esi + 0x2b3c], bx
push 0x11
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push str.xf_em.stat.qq.com
mov byte [esp + 0x50], 0x13
mov byte [ecx + 4], bl
call fcn.10001fe0
mov dword [esi + 0x2b5c], ebx
mov word [esi + 0x2b60], bx
mov dword [esi + 0x2b64], ebx
mov byte [esi + 0x2b68], bl
mov dword [esi + 0x2b69], ebx
mov word [esi + 0x2b6d], bx
mov dword [esi + 0x2b6f], ebx
mov word [esi + 0x2b73], bx
lea ecx, [esi + 0x2ba0]
mov byte [esp + 0x48], 0x14
mov byte [esi + 0x2b75], bl
mov dword [esi + 0x2b78], ebx
mov dword [esi + 0x2b7c], ebx
mov dword [esi + 0x2b80], ebx
mov dword [esi + 0x2b84], ebx
mov dword [esi + 0x2b88], ebx
mov dword [esi + 0x2b8c], ebx
mov dword [esi + 0x2b90], ebx
mov dword [esi + 0x2b94], ebx
mov dword [esi + 0x2b98], ebx
mov dword [esi + 0x2b9c], ebx
call fcn.10086d60
mov dword [esi + 0x2ba4], eax
mov byte [eax + 0xd1], 1
mov eax, dword [esi + 0x2ba4]
mov dword [eax + 4], eax
mov eax, dword [esi + 0x2ba4]
mov dword [eax], eax
mov eax, dword [esi + 0x2ba4]
mov dword [eax + 8], eax
mov dword [esi + 0x2ba8], ebx
lea eax, [esi + 0x2bb0]
push eax
mov dword [esi + 0x2bac], ebp
call edi
lea ecx, [esi + 0x2bc8]
mov byte [esp + 0x48], 0x16
call fcn.100a2ed0
mov dword [esi + 0x2bcc], eax
mov byte [eax + 0xf1], 1
mov eax, dword [esi + 0x2bcc]
mov dword [eax + 4], eax
mov eax, dword [esi + 0x2bcc]
mov dword [eax], eax
mov eax, dword [esi + 0x2bcc]
mov dword [eax + 8], eax
mov dword [esi + 0x2bd0], ebx
lea ecx, [esi + 0x2bd8]
push ecx
mov dword [esi + 0x2bd4], ebp
call edi
mov dword [esi + 0x2bf4], ebx
mov dword [esi + 0x2bf8], ebx
mov dword [esi + 0x2bfc], ebx
lea edx, [esi + 0x2c04]
push edx
mov dword [esi + 0x2c00], ebp
call edi
mov edx, dword [esp + 0x18]
mov byte [esi + 0x2c20], 1
mov byte [esi + 0x2c21], bl
mov dword [esi + 0x2c28], ebx
mov dword [esi + 0x2c2c], ebx
mov dword [esi + 0x2c30], ebx
mov dword [esi + 0x2c38], esi
mov dword [esi + 0x2c3c], edx
mov eax, 0x100b6bc0
mov dword [esi + 0x2c40], eax
mov ecx, ebx
lea eax, [esi + 0x2c4c]
mov dword [esi + 0x2c44], ecx
push eax
mov dword [esi + 0x2c48], ebp
call edi
mov edx, dword [esp + 0x18]
mov byte [esi + 0x2c68], 1
mov byte [esi + 0x2c69], bl
mov dword [esi + 0x2c70], ebx
mov dword [esi + 0x2c74], ebx
mov dword [esi + 0x2c78], ebx
mov dword [esi + 0x2c80], esi
mov dword [esi + 0x2c84], edx
mov eax, 0x100ac390
mov dword [esi + 0x2c88], eax
mov ecx, ebx
lea eax, [esi + 0x2c94]
mov dword [esi + 0x2c8c], ecx
push eax
mov dword [esi + 0x2c90], ebp
call edi
mov byte [esi + 0x2cb0], 1
mov byte [esi + 0x2cb1], bl
mov eax, 0x100ac400
mov ecx, ebx
mov dword [esi + 0x2cb8], ebx
mov dword [esi + 0x2cbc], ebx
mov edx, dword [esp + 0x18]
mov dword [esi + 0x2cc0], ebx
mov dword [esi + 0x2cc8], esi
mov dword [esi + 0x2ccc], edx
mov dword [esi + 0x2cd0], eax
lea eax, [esi + 0x2cdc]
mov dword [esi + 0x2cd4], ecx
push eax
mov dword [esi + 0x2cd8], ebp
call edi
mov edx, dword [esp + 0x18]
mov byte [esi + 0x2cf8], 1
mov byte [esi + 0x2cf9], bl
mov dword [esi + 0x2d00], ebx
mov dword [esi + 0x2d04], ebx
mov dword [esi + 0x2d08], ebx
mov dword [esi + 0x2d10], esi
mov dword [esi + 0x2d14], edx
mov eax, 0x100b52e0
mov dword [esi + 0x2d18], eax
mov ecx, ebx
lea eax, [esi + 0x2d24]
mov dword [esi + 0x2d1c], ecx
push eax
mov dword [esi + 0x2d20], ebp
call edi
mov edx, dword [esp + 0x18]
mov byte [esi + 0x2d40], 1
mov byte [esi + 0x2d41], bl
mov dword [esi + 0x2d48], ebx
mov dword [esi + 0x2d4c], ebx
mov dword [esi + 0x2d50], ebx
mov dword [esi + 0x2d58], esi
mov dword [esi + 0x2d5c], edx
mov eax, 0x100a6f60
mov dword [esi + 0x2d60], eax
mov ecx, ebx
lea eax, [esi + 0x2d6c]
mov dword [esi + 0x2d64], ecx
push eax
mov dword [esi + 0x2d68], ebp
call edi
mov edx, dword [esp + 0x18]
mov byte [esi + 0x2d88], 1
mov byte [esi + 0x2d89], bl
mov dword [esi + 0x2d90], ebx
mov dword [esi + 0x2d94], ebx
mov dword [esi + 0x2d98], ebx
mov dword [esi + 0x2da0], esi
mov dword [esi + 0x2da4], edx
mov eax, 0x100af860
mov dword [esi + 0x2da8], eax
mov ecx, ebx
lea eax, [esi + 0x2db4]
mov dword [esi + 0x2dac], ecx
push eax
mov dword [esi + 0x2db0], ebp
call edi
mov edx, dword [esp + 0x18]
mov byte [esi + 0x2dd0], 1
mov byte [esi + 0x2dd1], bl
mov dword [esi + 0x2dd8], ebx
mov dword [esi + 0x2ddc], ebx
mov dword [esi + 0x2de0], ebx
mov dword [esi + 0x2de8], esi
mov dword [esi + 0x2dec], edx
mov eax, 0x100a7020
mov dword [esi + 0x2df0], eax
mov ecx, ebx
lea eax, [esi + 0x2dfc]
mov dword [esi + 0x2df4], ecx
push eax
mov dword [esi + 0x2df8], ebp
call edi
mov eax, 0x100a7080
mov ecx, ebx
mov edx, dword [esp + 0x18]
mov byte [esi + 0x2e18], 1
mov byte [esi + 0x2e19], bl
mov dword [esi + 0x2e20], ebx
mov dword [esi + 0x2e24], ebx
mov dword [esi + 0x2e28], ebx
mov dword [esi + 0x2e30], esi
mov dword [esi + 0x2e34], edx
mov dword [esi + 0x2e38], eax
lea eax, [esi + 0x2e44]
mov dword [esi + 0x2e3c], ecx
push eax
mov dword [esi + 0x2e40], ebp
call edi
mov edx, dword [esp + 0x18]
mov byte [esi + 0x2e60], 1
mov byte [esi + 0x2e61], bl
mov dword [esi + 0x2e68], ebx
mov dword [esi + 0x2e6c], ebx
mov dword [esi + 0x2e70], ebx
mov dword [esi + 0x2e78], esi
mov dword [esi + 0x2e7c], edx
mov eax, 0x100a9800
mov dword [esi + 0x2e80], eax
mov ecx, ebx
lea eax, [esi + 0x2e8c]
mov dword [esi + 0x2e84], ecx
push eax
mov dword [esi + 0x2e88], ebp
call edi
mov edx, dword [esp + 0x18]
mov byte [esi + 0x2ea8], 1
mov byte [esi + 0x2ea9], bl
mov dword [esi + 0x2eb0], ebx
mov dword [esi + 0x2eb4], ebx
mov dword [esi + 0x2eb8], ebx
mov dword [esi + 0x2ec0], esi
mov dword [esi + 0x2ec4], edx
mov eax, 0x100ad280
mov dword [esi + 0x2ec8], eax
mov ecx, ebx
lea eax, [esi + 0x2ed4]
mov dword [esi + 0x2ecc], ecx
push eax
mov dword [esi + 0x2ed0], ebp
call edi
mov edx, dword [esp + 0x18]
mov dword [esi + 0x2ef0], ebx
mov byte [esi + 0x2ef8], 1
mov byte [esi + 0x2ef9], bl
mov dword [esi + 0x2f00], ebx
mov dword [esi + 0x2f04], ebx
mov dword [esi + 0x2f08], ebx
mov dword [esi + 0x2f10], esi
mov dword [esi + 0x2f14], edx
mov eax, 0x100a6a40
mov dword [esi + 0x2f18], eax
mov ecx, ebx
lea eax, [esi + 0x2f24]
mov dword [esi + 0x2f1c], ecx
push eax
mov dword [esi + 0x2f20], ebp
call edi
mov edx, dword [esp + 0x18]
mov dword [esi + 0x2f40], ebx
mov byte [esi + 0x2f48], 1
mov byte [esi + 0x2f49], bl
mov dword [esi + 0x2f50], ebx
mov dword [esi + 0x2f54], ebx
mov dword [esi + 0x2f58], ebx
mov dword [esi + 0x2f60], esi
mov dword [esi + 0x2f64], edx
mov eax, 0x100a6c80
mov ecx, ebx
mov dword [esi + 0x2f68], eax
mov dword [esi + 0x2f6c], ecx
mov dword [esi + 0x2f70], ebp
lea eax, [esi + 0x2f74]
push eax
call edi
lea ecx, [esi + 0x2f94]
mov byte [esp + 0x48], 0x26
mov dword [esi + 0x2f90], ebx
call fcn.100a0390
lea eax, [esi + 0x2f94]
push eax
lea ecx, [esi + 0x2fc0]
mov byte [esp + 0x4c], 0x27
call fcn.1003d3c0
lea ecx, [esi + 0x3058]
mov byte [esp + 0x48], 0x28
call fcn.100d8b00
lea ecx, [esi + 0x305c]
mov byte [esp + 0x48], 0x29
call fcn.100d20b0
mov dword [esi + 0x3060], eax
mov byte [eax + 0x39], 1
mov eax, dword [esi + 0x3060]
mov dword [eax + 4], eax
mov eax, dword [esi + 0x3060]
mov dword [eax], eax
mov eax, dword [esi + 0x3060]
mov dword [eax + 8], eax
mov dword [esi + 0x3064], ebx
lea ecx, [esi + 0x306c]
push ecx
mov dword [esi + 0x3068], ebp
call edi
lea edx, [esi + 0x308c]
mov dword [esi + 0x3084], ebx
push edx
mov dword [esi + 0x3088], ebp
call edi
lea ecx, [esi + 0x30a4]
mov byte [esp + 0x48], 0x2c
call fcn.1002dcc0
mov dword [esi + 0x30a8], eax
mov byte [eax + 0x21], 1
mov eax, dword [esi + 0x30a8]
mov dword [eax + 4], eax
mov eax, dword [esi + 0x30a8]
mov dword [eax], eax
mov eax, dword [esi + 0x30a8]
mov dword [eax + 8], eax
mov dword [esi + 0x30ac], ebx
lea ecx, [esi + 0x30b0]
mov byte [esp + 0x48], 0x2d
call fcn.100af280
mov dword [esi + 0x30dc], ebx
mov dword [esi + 0x30e4], ebx
mov dword [esi + 0x30e8], ebx
mov dword [esi + 0x30ec], ebx
lea ecx, [esi + 0x30f0]
mov byte [esp + 0x48], 0x2f
call fcn.100a2e50
mov dword [esi + 0x30f4], eax
mov byte [eax + 0x65], 1
mov eax, dword [esi + 0x30f4]
mov dword [eax + 4], eax
mov eax, dword [esi + 0x30f4]
mov dword [eax], eax
mov eax, dword [esi + 0x30f4]
mov dword [eax + 8], eax
lea eax, [esi + 0x3100]
mov dword [esi + 0x30f8], ebx
push eax
mov dword [esi + 0x30fc], ebp
call edi
lea ecx, [esi + 0x3118]
mov byte [esp + 0x48], 0x30
call fcn.1007e570
mov dword [esi + 0x314c], ebx
mov dword [esi + 0x3150], ebx
mov dword [esi + 0x3154], ebx
lea ecx, [esi + 0x3158]
push 0xd
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push str.xfstat.qq.com
mov byte [esp + 0x50], 0x32
mov byte [ecx + 4], bl
call fcn.10001fe0
mov dword [esi + 0x3174], ebx
mov word [esi + 0x3178], bx
lea ecx, [esi + 0x3180]
mov byte [esp + 0x48], 0x33
mov dword [esi + 0x317c], ebx
call fcn.100d0780
lea ecx, [esi + 0x31c4]
push ecx
mov dword [esi + 0x31c0], ebp
call edi
mov dword [esi + 0x31e0], ebx
mov dword [esi + 0x31e4], ebx
mov dword [esi + 0x31e8], ebx
lea edx, [esi + 0x31f0]
push edx
mov dword [esi + 0x31ec], ebp
call edi
mov dword [esi + 0x320c], ebx
mov dword [esi + 0x3210], ebx
mov dword [esi + 0x3214], ebx
mov byte [esi + 0x3218], 0x64
mov dword [esi + 0x3219], ebx
mov dword [esi + 0x321d], ebx
mov dword [esi + 0x3221], ebx
mov dword [esi + 0x3225], ebx
mov dword [esi + 0x3229], ebx
mov dword [esi + 0x322d], ebx
lea eax, [esi + 0x3240]
mov byte [esi + 0x3231], bl
mov dword [esi + 0x3234], ebx
mov dword [esi + 0x3238], ebx
push eax
mov dword [esi + 0x323c], ebp
call edi
lea ecx, [esi + 0x3258]
mov byte [esp + 0x48], 0x39
call fcn.1002dcc0
mov dword [esi + 0x325c], eax
mov byte [eax + 0x21], 1
mov eax, dword [esi + 0x325c]
mov dword [eax + 4], eax
mov eax, dword [esi + 0x325c]
mov dword [eax], eax
mov eax, dword [esi + 0x325c]
mov dword [eax + 8], eax
mov dword [esi + 0x3260], ebx
lea ecx, [esi + 0x3264]
mov byte [esp + 0x48], 0x3a
call fcn.100af280
lea ecx, [esi + 0x3298]
mov dword [esi + 0x3290], ebx
mov dword [esi + 0x3294], ebx
mov byte [esp + 0x48], 0x3b
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push 0xf
push str.fs_emule.qq.com
mov byte [ecx + 4], bl
call fcn.10001fe0
push esi
lea ecx, [esi + 0x32bc]
mov byte [esp + 0x4c], 0x3c
mov dword [esi + 0x32b4], ebx
mov word [esi + 0x32b8], bx
call fcn.1002bb70
lea ecx, [esi + 0x3348]
push ecx
mov dword [esi + 0x3344], ebp
call edi
lea edi, [esi + 0x3360]
mov ecx, edi
mov byte [esp + 0x48], 0x3e
call fcn.100a2f10
mov dword [edi + 4], eax
mov byte [eax + 0x2a1], 1
mov eax, dword [edi + 4]
mov dword [eax + 4], eax
mov eax, dword [edi + 4]
mov dword [eax], eax
mov eax, dword [edi + 4]
mov dword [eax + 8], eax
mov dword [edi + 8], ebx
lea ecx, [esi + 0x3374]
mov byte [esp + 0x48], 0x3f
mov byte [esi + 0x336c], bl
mov byte [esi + 0x336d], 0xf
mov byte [esi + 0x336e], bl
mov byte [esi + 0x336f], 0x40
mov byte [esi + 0x3370], 1
call fcn.1004d430
lea edi, [esi + 0x33a4]
mov ecx, edi
mov byte [esp + 0x48], 0x40
mov dword [esi + 0x33a0], ebx
call fcn.100a2f50
mov dword [edi + 4], eax
mov byte [eax + 0x2d], 1
mov eax, dword [edi + 4]
mov dword [eax + 4], eax
mov eax, dword [edi + 4]
mov dword [eax], eax
mov eax, dword [edi + 4]
mov dword [eax + 8], eax
mov dword [edi + 8], ebx
lea ecx, [esi + 0x33b0]
mov byte [esp + 0x48], 0x41
call fcn.100f8753
lea ecx, [esi + 0x33d8]
mov byte [esp + 0x48], 0x42
call fcn.100da620
mov dword [esi + 0x3468], ebx
mov dword [esi + 0x346c], ebx
mov dword [esi + 0x3470], ebx
push 0x30
mov byte [esp + 0x4c], 0x43
mov dword [esi + 0x3474], ebx
mov dword [esi + 0x3478], ebx
call fcn.1014979e
add esp, 4
mov dword [esp + 0x24], eax
cmp eax, ebx
mov byte [esp + 0x48], 0x44
je 0x100c3d6e
push esi
mov ecx, eax
call fcn.1002d260
jmp 0x100c3d70
xor eax, eax
lea edx, [esp + 0x2c]
push edx
mov byte [esp + 0x4c], 0x43
mov dword [esi + 0x29bc], eax
mov dword [esi + 0x2a00], ebx
mov dword [esi + 0x29f0], ebx
mov dword [esi + 0x29f4], ebx
call fcn.100e94a5
add esp, 4
test al, al
je 0x100c3ddc
mov eax, dword [esp + 0x24]
push eax
lea ecx, [esp + 0x40]
push ecx
lea edx, [esp + 0x34]
push edx
lea ecx, [esp + 0x20]
call fcn.100254c0
lea eax, [esp + 0x14]
push eax
lea ecx, [esi + 0x3148]
mov byte [esp + 0x4c], 0x45
call fcn.1001cdc0
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x100c3ddc
push eax
call fcn.10149646
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.10149c5e
add esp, 0x38
ret