Function at 0x1001e670
Capabilities:
Get domain information
Get hostname
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005d3d1
mov eax, dword fs:[0]
push eax
sub esp, 0x948
mov eax, dword [0x10073068]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x824], edi
mov dword [ebp - 0x6cc], edi
mov dword [ebp - 4], 0
mov edx, str.DDd
mov dword [ebp - 0x828], edi
push 7
mov dword [ebp - 0x820], 0
call fcn.10002170
add esp, 4
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x2c]
mov edx, esi
mov dword [ebp - 0x820], 1
call fcn.100104c0
push eax
mov ecx, edi
mov dword [ebp - 4], 1
call fcn.1000eda0
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
cmp ecx, 8
jb 0x1001e73b
mov edx, dword [ebp - 0x2c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1001e731
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001f41a
push ecx
push edx
call fcn.10036bea
add esp, 8
push 0x1c
mov edx, 0x10073de4
lea ecx, [ebp - 0x2c]
call fcn.10002170
add esp, 4
push eax
mov ecx, edi
mov dword [ebp - 4], 2
call fcn.1000eda0
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
cmp ecx, 8
jb 0x1001e79a
mov edx, dword [ebp - 0x2c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1001e790
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001f41f
push ecx
push edx
call fcn.10036bea
add esp, 8
cmp dword [ebp + 8], 0
je 0x1001f3a6
push 0xc
mov edx, str.DDv
lea ecx, [ebp - 0x2c]
call fcn.10002170
add esp, 4
push eax
mov ecx, edi
mov dword [ebp - 4], 3
call fcn.1000eda0
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
cmp ecx, 8
jb 0x1001e803
mov edx, dword [ebp - 0x2c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1001e7f9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001f424
push ecx
push edx
call fcn.10036bea
add esp, 8
push 0
xorps xmm0, xmm0
mov dword [ebp - 0x81c], 0
push 0x1006b324
lea ecx, [ebp - 0x6c8]
mov dword [ebp - 0x6b8], 0
movups xmmword [ebp - 0x6c8], xmm0
mov dword [ebp - 0x6b4], 0
call fcn.1000b7f0
lea eax, [ebp - 0x81c]
mov dword [ebp - 4], 4
push eax
push 1
push 0
mov dword [ebp - 0x820], 3
call dword [sym.imp.NETAPI32.dll_DsRoleGetPrimaryDomainInformation]
test eax, eax
jne 0x1001e8f7
mov eax, dword [ebp - 0x81c]
mov edx, dword [eax + 0xc]
test edx, edx
jne 0x1001e88d
mov edx, dword [eax + 8]
mov ecx, edx
lea esi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001e880
jmp 0x1001e89d
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001e892
mov eax, dword [ebp - 0x6b4]
sub ecx, esi
sar ecx, 1
cmp ecx, eax
ja 0x1001e8dd
lea esi, [ecx + ecx]
mov dword [ebp - 0x6b8], ecx
cmp eax, 8
lea edi, [ebp - 0x6c8]
push esi
cmovae edi, dword [ebp - 0x6c8]
push edx
push edi
call fcn.100383a0
add esp, 0xc
xor eax, eax
mov word [esi + edi], ax
mov edi, dword [ebp - 0x824]
jmp 0x1001e8f7
push edx
mov byte [ebp - 0x818], 0
push dword [ebp - 0x818]
push ecx
lea ecx, [ebp - 0x6c8]
call fcn.1000bbf0
mov dword [ebp - 0x820], 0
mov dword [ebp - 4], 5
lea edx, [ebp - 0x6c8]
cmp dword [ebp - 0x6b4], 8
mov ecx, dword [edi + 0x10]
cmovae edx, dword [ebp - 0x6c8]
mov eax, dword [edi + 0x14]
mov esi, dword [ebp - 0x6b8]
sub eax, ecx
mov dword [ebp - 0x698], ecx
cmp esi, eax
ja 0x1001e977
cmp dword [edi + 0x14], 8
lea eax, [ecx + esi]
mov dword [edi + 0x10], eax
mov eax, edi
mov dword [ebp - 0x818], edi
jb 0x1001e950
mov eax, dword [edi]
mov dword [ebp - 0x818], eax
lea ecx, [eax + ecx*2]
lea eax, [esi + esi]
push eax
push edx
push ecx
call fcn.100383a0
mov eax, dword [ebp - 0x698]
add esp, 0xc
mov ecx, dword [ebp - 0x818]
add eax, esi
xor edx, edx
mov word [ecx + eax*2], dx
jmp 0x1001e98e
push esi
push edx
mov byte [ebp - 0x698], 0
mov ecx, edi
push dword [ebp - 0x698]
push esi
call fcn.1000cea0
push 0xf
mov edx, 0x10073e5c
lea ecx, [ebp - 0x2c]
call fcn.10002170
add esp, 4
push eax
mov ecx, edi
mov byte [ebp - 4], 6
call fcn.1000eda0
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x18]
cmp ecx, 8
jb 0x1001e9ea
mov edx, dword [ebp - 0x2c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1001e9e0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001f429
push ecx
push edx
call fcn.10036bea
add esp, 8
mov esi, dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea eax, [ebp - 0x6d0]
push eax
lea eax, [ebp - 0x494]
mov dword [ebp - 0x6d0], 0x100
push eax
call esi
test eax, eax
je 0x1001eb03
xorps xmm0, xmm0
mov dword [ebp - 0x6a0], 0
lea ecx, [ebp - 0x494]
mov dword [ebp - 0x69c], 0
movups xmmword [ebp - 0x6b0], xmm0
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001ea40
sub ecx, edx
lea eax, [ebp - 0x494]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x6b0]
call fcn.1000b7f0
lea eax, [ebp - 0x6b0]
mov byte [ebp - 4], 7
push eax
lea ecx, [ebp - 0x2c]
call fcn.10007e60
push eax
mov ecx, edi
mov byte [ebp - 4], 8
call fcn.1000eda0
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x18]
cmp ecx, 8
jb 0x1001eabf
mov edx, dword [ebp - 0x2c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1001eab5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001f42e
push ecx
push edx
call fcn.10036bea
add esp, 8
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x69c]
cmp ecx, 8
jb 0x1001eb03
mov edx, dword [ebp - 0x6b0]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1001eaf9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001f45b
push ecx
push edx
call fcn.10036bea
add esp, 8
push 0x13
mov edx, 0x10073dd0
lea ecx, [ebp - 0x2c]
call fcn.10002170
add esp, 4
push eax
mov ecx, edi
mov byte [ebp - 4], 9
call fcn.1000eda0
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x18]
cmp ecx, 8
jb 0x1001eb5f
mov edx, dword [ebp - 0x2c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1001eb55
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001f433
push ecx
push edx
call fcn.10036bea
add esp, 8
lea eax, [ebp - 0x6cc]
mov dword [ebp - 0x6cc], 0x100
push eax
lea eax, [ebp - 0x694]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x1001ec73
xorps xmm0, xmm0
mov dword [ebp - 0x6a0], 0
lea ecx, [ebp - 0x694]
mov dword [ebp - 0x69c], 0
movups xmmword [ebp - 0x6b0], xmm0
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001ebb0
sub ecx, edx
lea eax, [ebp - 0x694]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x6b0]
call fcn.1000b7f0
lea eax, [ebp - 0x6b0]
mov byte [ebp - 4], 0xa
push eax
lea ecx, [ebp - 0x2c]
call fcn.10007e60
push eax
mov ecx, edi
mov byte [ebp - 4], 0xb
call fcn.1000eda0
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x18]
cmp ecx, 8
jb 0x1001ec2f
mov edx, dword [ebp - 0x2c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1001ec25
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001f438
push ecx
push edx
call fcn.10036bea
add esp, 8
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x69c]
cmp ecx, 8
jb 0x1001ec73
mov edx, dword [ebp - 0x6b0]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1001ec69
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001f45b
push ecx
push edx
call fcn.10036bea
add esp, 8
push 0xf
mov edx, 0x10073e4c
lea ecx, [ebp - 0x2c]
call fcn.10002170
add esp, 4
push eax
mov ecx, edi
mov byte [ebp - 4], 0xc
call fcn.1000eda0
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x18]
cmp ecx, 8
jb 0x1001eccf
mov edx, dword [ebp - 0x2c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1001ecc5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001f43d
push ecx
push edx
call fcn.10036bea
add esp, 8
lea eax, [ebp - 0x698]
mov dword [ebp - 0x698], 0x100
push eax
lea eax, [ebp - 0x294]
push eax
call esi
lea eax, [ebp - 0x818]
xor esi, esi
push eax
push 1
lea eax, [ebp - 0x294]
mov dword [ebp - 0x818], esi
push eax
push esi
call dword [sym.imp.NETAPI32.dll_NetUserGetInfo]
test eax, eax
mov eax, dword [ebp - 0x818]
jne 0x1001ed15
mov esi, dword [eax + 0xc]
test eax, eax
je 0x1001ed20
push eax
call dword [sym.imp.NETAPI32.dll_NetApiBufferFree]
lea ecx, [ebp - 0x12]
mov eax, 0xcccccccd
sub ecx, 2
mul esi
shr edx, 3
lea eax, [edx + edx*4]
add eax, eax
sub esi, eax
add esi, 0x30
mov word [ecx], si
mov esi, edx
test esi, esi
jne 0x1001ed23
push ecx
lea eax, [ebp - 0x12]
push eax
push ecx
lea ecx, [ebp - 0x840]
call fcn.10010090
mov dword [ebp - 0x820], 0x30
lea eax, [ebp - 0x840]
mov byte [ebp - 4], 0xd
push eax
mov ecx, edi
call fcn.1000eda0
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x82c]
cmp ecx, 8
jb 0x1001edb4
mov edx, dword [ebp - 0x840]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1001edaa
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001f45b
push ecx
push edx
call fcn.10036bea
add esp, 8
push 8
mov edx, 0x10073e30
lea ecx, [ebp - 0x2c]
call fcn.10002170
add esp, 4
push eax
mov ecx, edi
mov byte [ebp - 4], 0xe
call fcn.1000eda0
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x18]
cmp ecx, 8
jb 0x1001ee10
mov edx, dword [ebp - 0x2c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1001ee06
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001f442
push ecx
push edx
call fcn.10036bea
add esp, 8
push 0x1006b880
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1001ee66
push str.RtlGetVersion
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x1001ee66
push 0x110
lea eax, [ebp - 0x810]
push 0
push eax
call fcn.10038920
add esp, 0xc
mov dword [ebp - 0x814], 0x114
lea eax, [ebp - 0x814]
push eax
call esi
test eax, eax
jne 0x1001ee66
lea esi, [ebp - 0x814]
jmp 0x1001ee82
push 0x114
lea eax, [ebp - 0x1a8]
push 0
push eax
call fcn.10038920
add esp, 0xc
lea esi, [ebp - 0x1a8]
mov ecx, 0x45
lea edi, [ebp - 0x954]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x94c]
lea esi, [ebp - 0x6a]
nop dword [eax + eax]
mov eax, 0xcccccccd
sub esi, 2
mul ecx
shr edx, 3
lea eax, [edx + edx*4]
add eax, eax
sub ecx, eax
add ecx, 0x30
mov word [esi], cx
mov ecx, edx
test ecx, ecx
jne 0x1001eea0
push ecx
lea eax, [ebp - 0x6a]
push eax
push esi
lea ecx, [ebp - 0x2c]
call fcn.10010090
mov dword [ebp - 0x820], 0x3c
mov byte [ebp - 4], 0xf
lea esi, [ebp - 0x3e]
mov ecx, dword [ebp - 0x950]
mov eax, 0xcccccccd
sub esi, 2
mul ecx
shr edx, 3
lea eax, [edx + edx*4]
add eax, eax
sub ecx, eax
add ecx, 0x30
mov word [esi], cx
mov ecx, edx
test ecx, ecx
jne 0x1001eee5
push ecx
lea eax, [ebp - 0x3e]
push eax
push esi
lea ecx, [ebp - 0x6b0]
call fcn.10010090
mov dword [ebp - 0x820], 0xfc
push 0x1006b87c
lea edx, [ebp - 0x6b0]
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x840]
call fcn.1000b280
add esp, 4
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x11
push ecx
push eax
push dword [ebp - 0x828]
lea ecx, [ebp - 0x700]
call fcn.1000c5f0
mov dword [ebp - 0x820], 0x1fc
mov byte [ebp - 4], 0x13
mov ecx, dword [ebp - 0x82c]
cmp ecx, 8
jb 0x1001efa5
mov edx, dword [ebp - 0x840]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1001ef9b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001f447
push ecx
push edx
call fcn.10036bea
add esp, 8
xor eax, eax
mov dword [ebp - 0x830], 0
mov dword [ebp - 0x82c], 7
mov word [ebp - 0x840], ax
mov byte [ebp - 4], 0x14
mov ecx, dword [ebp - 0x69c]
cmp ecx, 8
jb 0x1001f006
mov edx, dword [ebp - 0x6b0]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1001effc
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001f447
push ecx
push edx
call fcn.10036bea
add esp, 8
xor eax, eax
mov dword [ebp - 0x6a0], 0
mov dword [ebp - 0x69c], 7
mov word [ebp - 0x6b0], ax
mov byte [ebp - 4], 0x15
mov ecx, dword [ebp - 0x18]
cmp ecx, 8
jb 0x1001f061
mov edx, dword [ebp - 0x2c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1001f057
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001f447
push ecx
push edx
call fcn.10036bea
add esp, 8
mov edi, dword [ebp - 0x824]
lea esi, [ebp - 0x700]
cmp dword [ebp - 0x6ec], 8
mov edx, dword [ebp - 0x6f0]
cmovae esi, dword [ebp - 0x700]
mov eax, dword [edi + 0x14]
mov ecx, dword [edi + 0x10]
sub eax, ecx
cmp edx, eax
ja 0x1001f0d4
cmp dword [edi + 0x14], 8
lea eax, [ecx + edx]
mov dword [ebp - 0x698], eax
mov dword [edi + 0x10], eax
mov eax, edi
mov dword [ebp - 0x818], edi
jb 0x1001f0af
mov eax, dword [edi]
mov dword [ebp - 0x818], eax
lea ecx, [eax + ecx*2]
lea eax, [edx + edx]
push eax
push esi
push ecx
call fcn.100383a0
mov eax, dword [ebp - 0x818]
add esp, 0xc
mov ecx, dword [ebp - 0x698]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x1001f0eb
push edx
push esi
mov byte [ebp - 0x698], 0
mov ecx, edi
push dword [ebp - 0x698]
push edx
call fcn.1000cea0
push 0xe
mov edx, str.DD6
lea ecx, [ebp - 0x2c]
call fcn.10002170
add esp, 4
push eax
mov ecx, edi
mov byte [ebp - 4], 0x16
call fcn.1000eda0
mov byte [ebp - 4], 0x15
mov ecx, dword [ebp - 0x18]
cmp ecx, 8
jb 0x1001f147
mov edx, dword [ebp - 0x2c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1001f13d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001f44c
push ecx
push edx
call fcn.10036bea
add esp, 8
mov ecx, dword [ebp - 0x948]
lea esi, [ebp - 0x3e]
mov eax, 0xcccccccd
sub esi, 2
mul ecx
shr edx, 3
lea eax, [edx + edx*4]
add eax, eax
sub ecx, eax
add ecx, 0x30
mov word [esi], cx
mov ecx, edx
test ecx, ecx
jne 0x1001f150
push ecx
lea eax, [ebp - 0x3e]
push eax
push esi
lea ecx, [ebp - 0x6e8]
call fcn.10010090
mov dword [ebp - 0x820], 0x7fc
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x6e8]
cmp dword [ebp - 0x6d4], 8
mov edx, dword [edi + 0x10]
mov esi, dword [ebp - 0x6e8]
cmovae ecx, esi
mov eax, dword [edi + 0x14]
sub eax, edx
mov dword [ebp - 0x698], edx
mov edx, dword [ebp - 0x6d8]
mov dword [ebp - 0x81c], ecx
cmp edx, eax
ja 0x1001f215
cmp dword [edi + 0x14], 8
mov ecx, dword [ebp - 0x698]
mov dword [ebp - 0x818], edi
lea eax, [ecx + edx]
mov dword [ebp - 0x698], eax
mov dword [edi + 0x10], eax
mov eax, edi
jb 0x1001f1eb
mov eax, dword [edi]
mov dword [ebp - 0x818], eax
lea ecx, [eax + ecx*2]
lea eax, [edx + edx]
push eax
push dword [ebp - 0x81c]
push ecx
call fcn.100383a0
mov eax, dword [ebp - 0x818]
add esp, 0xc
mov ecx, dword [ebp - 0x698]
xor edx, edx
mov word [eax + ecx*2], dx
jmp 0x1001f232
push edx
push ecx
mov byte [ebp - 0x698], 0
mov ecx, edi
push dword [ebp - 0x698]
push edx
call fcn.1000cea0
mov esi, dword [ebp - 0x6e8]
push 0xe
mov edx, 0x10073e20
lea ecx, [ebp - 0x2c]
call fcn.10002170
add esp, 4
push eax
mov ecx, edi
mov byte [ebp - 4], 0x18
call fcn.1000eda0
mov byte [ebp - 4], 0x17
mov ecx, dword [ebp - 0x18]
cmp ecx, 8
jb 0x1001f28e
mov edx, dword [ebp - 0x2c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1001f284
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001f451
push ecx
push edx
call fcn.10036bea
add esp, 8
lea ecx, [ebp - 0x2c]
call fcn.100101c0
push eax
mov ecx, edi
mov byte [ebp - 4], 0x19
call fcn.1000eda0
mov byte [ebp - 4], 0x17
mov ecx, dword [ebp - 0x18]
cmp ecx, 8
jb 0x1001f2e0
mov edx, dword [ebp - 0x2c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1001f2d6
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001f456
push ecx
push edx
call fcn.10036bea
add esp, 8
mov byte [ebp - 4], 0x15
mov eax, dword [ebp - 0x6d4]
cmp eax, 8
jb 0x1001f31e
lea ecx, [eax*2 + 2]
mov eax, esi
cmp ecx, 0x1000
jb 0x1001f314
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001f45b
push ecx
push esi
call fcn.10036bea
add esp, 8
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x6ec]
cmp eax, 8
jb 0x1001f362
mov edx, dword [ebp - 0x700]
lea ecx, [eax*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1001f358
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001f45b
push ecx
push edx
call fcn.10036bea
add esp, 8
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x6b4]
cmp ecx, 8
jb 0x1001f3a6
mov edx, dword [ebp - 0x6c8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1001f39c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001f45b
push ecx
push edx
call fcn.10036bea
add esp, 8
push 2
mov edx, 0x10073e14
lea ecx, [ebp - 0x2c]
call fcn.10002170
add esp, 4
push eax
mov ecx, edi
mov dword [ebp - 4], 0x1a
call fcn.1000eda0
mov ecx, dword [ebp - 0x18]
cmp ecx, 8
jb 0x1001f3fd
mov edx, dword [ebp - 0x2c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1001f3f3
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001f460
push ecx
push edx
call fcn.10036bea
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10036bdc
mov esp, ebp
pop ebp
ret
call fcn.1003da55
call fcn.1003da55
call fcn.1003da55
call fcn.1003da55
call fcn.1003da55
call fcn.1003da55
call fcn.1003da55
call fcn.1003da55
call fcn.1003da55
call fcn.1003da55
call fcn.1003da55
call fcn.1003da55
call fcn.1003da55
call fcn.1003da55
call fcn.1003da55
int3