Function at 0x10064a90
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x103189cf
mov eax, dword fs:[0]
push eax
sub esp, 0x1c0
mov eax, dword [0x1043900c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x164], 0
mov dword [ebp - 0x164], 0
mov dword [ebp - 0x164], 0
call fcn.1015ef90
call fcn.100ee640
lea ecx, [ebp - 0x165]
mov byte [ebp - 0x165], 0
call fcn.10067d70
mov esi, dword [0x1060b5e0]
push 0x100
push 0
lea eax, [esi + 0x7869]
push eax
call sub.VCRUNTIME140.dll_memset
push 0x100
lea eax, [esi + 0x7d6c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x400
lea eax, [esi + 0x796c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x24
mov byte [ebp - 0x165], 0
lea ecx, [ebp - 0x165]
call fcn.10067f90
mov eax, dword [0x1060b5e0]
mov eax, dword [eax + 0x80]
mov dword [ebp - 0x14c], eax
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 0
call fcn.10019ef0
push 0xe
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x164], 0x4000
call fcn.1001a120
mov byte [ebp - 0x18c], 0
lea eax, [ebp - 0x40]
push dword [ebp - 0x18c]
mov edx, 0x1036f5f8
lea ecx, [ebp - 0x16c]
push eax
push 0x1036f610
call fcn.1001a8c0
add esp, 0xc
lea ecx, [ebp - 0x40]
push 0
push 0
call fcn.1001a0e0
mov esi, eax
cmp esi, 0xffffffff
je 0x10064bf6
nop dword [eax + eax]
lea eax, [ebp - 0x160]
push eax
lea ecx, [ebp - 0x40]
call fcn.10019db0
lea ecx, [ebp - 0x40]
mov eax, dword [eax]
add eax, esi
push eax
lea eax, [ebp - 0x180]
push eax
call fcn.1001a390
push 0
push 0
lea ecx, [ebp - 0x40]
call fcn.1001a0e0
mov esi, eax
cmp esi, 0xffffffff
jne 0x10064bc0
lea ecx, [ebp - 0x40]
call fcn.10019da0
mov ecx, eax
call fcn.10032cb0
mov dword [ebp - 0x190], eax
mov ecx, 0x1060c1a0
lea eax, [ebp - 0x190]
push eax
call fcn.10068a60
lea ecx, [ebp - 0x70]
push ecx
mov ecx, eax
call fcn.10032d00
lea ecx, [ebp - 0x70]
call fcn.10019da0
mov edi, eax
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 2
call fcn.10019ef0
push 0xc
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x164], 0x1c000
call fcn.1001a120
mov byte [ebp - 0x18c], 0
lea eax, [ebp - 0x58]
push dword [ebp - 0x18c]
mov edx, 0x1036ee48
lea ecx, [ebp - 0x16c]
push eax
push 0x1036ee5c
call fcn.1001a8c0
add esp, 0xc
lea ecx, [ebp - 0x58]
push 0
push 0
call fcn.1001a0e0
mov esi, eax
cmp esi, 0xffffffff
je 0x10064cc6
nop dword [eax]
lea eax, [ebp - 0x160]
push eax
lea ecx, [ebp - 0x58]
call fcn.10019db0
lea ecx, [ebp - 0x58]
mov eax, dword [eax]
add eax, esi
push eax
lea eax, [ebp - 0x180]
push eax
call fcn.1001a390
push 0
push 0
lea ecx, [ebp - 0x58]
call fcn.1001a0e0
mov esi, eax
cmp esi, 0xffffffff
jne 0x10064c90
lea ecx, [ebp - 0x58]
call fcn.10019da0
mov ecx, eax
call fcn.10032cb0
mov dword [ebp - 0x174], eax
mov ecx, 0x1060c1b0
lea eax, [ebp - 0x174]
push eax
call fcn.10068a60
lea ecx, [ebp - 0x28]
push ecx
mov ecx, eax
call fcn.10032d00
mov dword [ebp - 0x164], 0x3c000
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 3
call fcn.10019da0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push edi
push eax
call dword [ebp - 0x14c]
add esp, 8
mov eax, dword [eax + 1]
mov ecx, dword [eax]
mov eax, dword [0x1060b5e0]
mov dword [eax + 0x6ef8], ecx
lea ecx, [ebp - 0x28]
call fcn.10019dd0
lea ecx, [ebp - 0x58]
call fcn.10019dd0
lea ecx, [ebp - 0x70]
call fcn.10019dd0
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 0xffffffff
call fcn.10019dd0
mov esi, dword [0x1060b5e0]
sub esp, 0x18
mov eax, esp
mov dword [ebp - 0x16c], esp
mov ecx, 0x10370268
push eax
call fcn.1006a950
sub esp, 0x18
mov dword [ebp - 4], 4
mov ecx, 0x1036f278
push esp
call fcn.10019bd0
lea ecx, [esi + 0x7c]
mov dword [ebp - 4], 0xffffffff
call fcn.1006c680
mov ecx, dword [0x1060b5e0]
sub esp, 0x18
mov dword [ebp - 0x16c], esp
mov dword [ecx + 0x7fa4], eax
lea esi, [ecx + 0x7c]
mov eax, esp
mov ecx, 0x1036fc38
push eax
call fcn.1006b280
sub esp, 0x18
mov dword [ebp - 4], 5
mov ecx, 0x1036f278
push esp
call fcn.10019bd0
mov ecx, esi
mov dword [ebp - 4], 0xffffffff
call fcn.1006c680
mov esi, dword [0x1060b5e0]
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x16c], esp
mov dword [ebp - 0x1c8], eax
push ecx
mov ecx, 0x1036e9a4
call fcn.1006b3d0
mov dword [ebp - 4], 6
sub esp, 0x18
mov ecx, 0x1036f278
push esp
call fcn.10019bd0
lea ecx, [esi + 0x7c]
mov dword [ebp - 4], 0xffffffff
call fcn.1006c680
mov dword [ebp - 0x1c4], eax
lea ecx, [ebp - 0x165]
mov eax, dword [0x1060b5e0]
add eax, 0x7c
mov byte [ebp - 0x165], 0
mov dword [ebp - 0x14c], eax
lea eax, [ebp - 0x70]
push eax
call fcn.10068170
mov ecx, eax
mov dword [ebp - 4], 7
call fcn.10019da0
sub esp, 0x18
mov edi, eax
mov esi, esp
mov dword [ebp - 0x16c], esp
mov dword [ebp - 0x160], esi
mov ecx, esi
push dword [ebp - 0x16c]
call fcn.1001a900
mov ecx, edi
mov byte [ebp - 4], 8
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10064e85
sub ecx, edx
push ecx
push edi
mov ecx, esi
call fcn.1001a920
sub esp, 0x18
mov byte [ebp - 4], 9
mov ecx, 0x1036f278
push esp
call fcn.10019bd0
mov ecx, dword [ebp - 0x14c]
mov byte [ebp - 4], 7
call fcn.1006c680
lea ecx, [ebp - 0x70]
mov dword [ebp - 4], 0xffffffff
call fcn.10019dd0
mov esi, dword [0x1060b5e0]
sub esp, 0x18
mov eax, esp
mov dword [ebp - 0x16c], esp
mov ecx, 0x1036f638
push eax
call fcn.1006b520
sub esp, 0x18
mov dword [ebp - 4], 0xa
mov ecx, 0x1036f278
push esp
call fcn.10019bd0
lea ecx, [esi + 0x7c]
mov dword [ebp - 4], 0xffffffff
call fcn.1006c680
mov esi, dword [0x1060b5e0]
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x16c], esp
mov dword [ebp - 0x1bc], eax
push ecx
mov ecx, 0x1036ff7c
call fcn.1006b280
sub esp, 0x18
mov dword [ebp - 4], 0xb
mov ecx, 0x1036f278
push esp
call fcn.10019bd0
lea ecx, [esi + 0x7c]
mov dword [ebp - 4], 0xffffffff
call fcn.1006c680
mov esi, dword [0x1060b5e0]
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x16c], esp
mov dword [ebp - 0x1c0], eax
push ecx
mov ecx, 0x1036f160
call fcn.1006a560
sub esp, 0x18
mov dword [ebp - 4], 0xc
mov ecx, 0x1036f278
push esp
call fcn.10019bd0
lea ecx, [esi + 0x7c]
mov dword [ebp - 4], 0xffffffff
call fcn.1006c680
mov esi, dword [0x1060b5e0]
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x16c], esp
mov dword [ebp - 0x19c], eax
push ecx
mov ecx, 0x1036efc4
call fcn.1006b910
sub esp, 0x18
mov dword [ebp - 4], 0xd
mov ecx, 0x1036f278
push esp
call fcn.10019bd0
lea ecx, [esi + 0x7c]
mov dword [ebp - 4], 0xffffffff
call fcn.1006c680
mov esi, dword [0x1060b5e0]
sub esp, 0x18
mov eax, esp
mov dword [ebp - 0x16c], esp
mov ecx, 0x1036ed38
push eax
call fcn.1006afe0
sub esp, 0x18
mov dword [ebp - 4], 0xe
mov ecx, 0x1036f278
push esp
call fcn.10019bd0
lea ecx, [esi + 0x7c]
mov dword [ebp - 4], 0xffffffff
call fcn.1006c680
mov esi, dword [0x1060b5e0]
sub esp, 0x18
mov eax, esp
mov dword [ebp - 0x16c], esp
mov ecx, 0x1036ec60
push eax
call fcn.1006a410
sub esp, 0x18
mov dword [ebp - 4], 0xf
mov ecx, 0x1036f278
push esp
call fcn.10019bd0
lea ecx, [esi + 0x7c]
mov dword [ebp - 4], 0xffffffff
call fcn.1006c680
mov esi, dword [0x1060b5e0]
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x16c], esp
mov dword [ebp - 0x1cc], eax
push ecx
mov ecx, 0x1036fbf8
call fcn.1006aaa0
sub esp, 0x18
mov dword [ebp - 4], 0x10
mov ecx, 0x1036f128
push esp
call fcn.1006b7c0
lea ecx, [esi + 0x7c]
mov dword [ebp - 4], 0xffffffff
call fcn.1006c680
mov dword [ebp - 0x1a0], eax
lea ecx, [ebp - 0x165]
mov eax, dword [0x1060b5e0]
add eax, 0x7c
mov byte [ebp - 0x165], 0
mov dword [ebp - 0x14c], eax
lea eax, [ebp - 0x70]
push eax
call fcn.100681f0
mov ecx, eax
mov dword [ebp - 4], 0x11
call fcn.10019da0
sub esp, 0x18
mov edi, eax
mov esi, esp
mov dword [ebp - 0x16c], esp
mov dword [ebp - 0x160], esi
mov ecx, esi
push dword [ebp - 0x16c]
call fcn.1001a900
mov ecx, edi
mov byte [ebp - 4], 0x12
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10065100
sub ecx, edx
push ecx
push edi
mov ecx, esi
call fcn.1001a920
sub esp, 0x18
mov byte [ebp - 4], 0x13
mov ecx, 0x1036f278
push esp
call fcn.10019bd0
mov ecx, dword [ebp - 0x14c]
mov byte [ebp - 4], 0x11
call fcn.1006c680
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x1b8], eax
mov dword [ebp - 4], 0xffffffff
call fcn.10019dd0
mov esi, dword [0x1060b5e0]
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x16c], esp
push ecx
mov ecx, 0x1036f6a8
call fcn.1006a2c0
sub esp, 0x18
mov dword [ebp - 4], 0x14
mov ecx, 0x1036ee48
push esp
call fcn.10019bd0
lea ecx, [esi + 0x7c]
mov dword [ebp - 4], 0xffffffff
call fcn.1006c680
mov dword [ebp - 0x1a4], eax
lea ecx, [ebp - 0x187]
mov eax, dword [0x1060b5e0]
add eax, 0x7c
mov byte [ebp - 0x187], 0
mov dword [ebp - 0x14c], eax
lea eax, [ebp - 0x148]
push eax
call fcn.10068270
mov ecx, eax
mov dword [ebp - 4], 0x15
call fcn.10019da0
sub esp, 0x18
mov edi, eax
mov esi, esp
mov dword [ebp - 0x16c], esp
mov dword [ebp - 0x160], esi
mov ecx, esi
push dword [ebp - 0x16c]
call fcn.1001a900
mov ecx, edi
mov byte [ebp - 4], 0x16
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100651f0
sub ecx, edx
push ecx
push edi
mov ecx, esi
call fcn.1001a920
sub esp, 0x18
mov byte [ebp - 4], 0x17
mov ecx, 0x1036f278
push esp
call fcn.10019bd0
mov ecx, dword [ebp - 0x14c]
mov byte [ebp - 4], 0x15
call fcn.1006c680
lea ecx, [ebp - 0x148]
mov dword [ebp - 0x1a8], eax
mov dword [ebp - 4], 0xffffffff
call fcn.10019dd0
mov eax, dword [0x1060b5e0]
lea ecx, [ebp - 0x186]
add eax, 0x7c
mov byte [ebp - 0x186], 0
mov dword [ebp - 0x14c], eax
lea eax, [ebp - 0x130]
push eax
call fcn.100682f0
mov ecx, eax
mov dword [ebp - 4], 0x18
call fcn.10019da0
sub esp, 0x18
mov edi, eax
mov esi, esp
mov dword [ebp - 0x16c], esp
mov dword [ebp - 0x160], esi
mov ecx, esi
push dword [ebp - 0x16c]
call fcn.1001a900
mov ecx, edi
mov byte [ebp - 4], 0x19
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100652a0
sub ecx, edx
push ecx
push edi
mov ecx, esi
call fcn.1001a920
sub esp, 0x18
mov byte [ebp - 4], 0x1a
mov ecx, 0x1036ee48
push esp
call fcn.10019bd0
mov ecx, dword [ebp - 0x14c]
mov byte [ebp - 4], 0x18
call fcn.1006c680
lea ecx, [ebp - 0x130]
mov dword [ebp - 0x1ac], eax
mov dword [ebp - 4], 0xffffffff
call fcn.10019dd0
mov eax, dword [0x1060b5e0]
lea ecx, [ebp - 0x185]
add eax, 0x7c
mov byte [ebp - 0x185], 0
mov dword [ebp - 0x14c], eax
lea eax, [ebp - 0x100]
push eax
call fcn.10068370
mov ecx, eax
mov dword [ebp - 4], 0x1b
call fcn.10019da0
sub esp, 0x18
mov edi, eax
mov esi, esp
mov dword [ebp - 0x16c], esp
mov dword [ebp - 0x160], esi
mov ecx, esi
push dword [ebp - 0x16c]
call fcn.1001a900
mov ecx, edi
mov byte [ebp - 4], 0x1c
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10065350
sub ecx, edx
push ecx
push edi
mov ecx, esi
call fcn.1001a920
sub esp, 0x18
mov byte [ebp - 4], 0x1d
mov ecx, 0x1036f594
push esp
call fcn.1006b670
mov ecx, dword [ebp - 0x14c]
mov byte [ebp - 4], 0x1b
call fcn.1006c680
lea ecx, [ebp - 0x100]
mov dword [ebp - 0x1b0], eax
mov dword [ebp - 4], 0xffffffff
call fcn.10019dd0
mov eax, dword [0x1060b5e0]
lea ecx, [ebp - 0x184]
add eax, 0x7c
mov byte [ebp - 0x184], 0
mov dword [ebp - 0x14c], eax
lea eax, [ebp - 0x118]
push eax
call fcn.100683f0
mov ecx, eax
mov dword [ebp - 4], 0x1e
call fcn.10019da0
sub esp, 0x18
mov edi, eax
mov esi, esp
mov dword [ebp - 0x16c], esp
mov dword [ebp - 0x160], esi
mov ecx, esi
push dword [ebp - 0x16c]
call fcn.1001a900
mov ecx, edi
mov byte [ebp - 4], 0x1f
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10065400
sub ecx, edx
push ecx
push edi
mov ecx, esi
call fcn.1001a920
sub esp, 0x18
mov byte [ebp - 4], 0x20
mov ecx, 0x1036f128
push esp
call fcn.1006b7c0
mov ecx, dword [ebp - 0x14c]
mov byte [ebp - 4], 0x1e
call fcn.1006c680
lea ecx, [ebp - 0x118]
mov dword [ebp - 0x1b4], eax
mov dword [ebp - 4], 0xffffffff
call fcn.10019dd0
mov eax, dword [0x1060b5e0]
lea ecx, [ebp - 0x183]
add eax, 0x7c
mov byte [ebp - 0x183], 0
mov dword [ebp - 0x14c], eax
lea eax, [ebp - 0xe8]
push eax
call fcn.10068470
mov ecx, eax
mov dword [ebp - 4], 0x21
call fcn.10019da0
sub esp, 0x18
mov edi, eax
mov esi, esp
mov dword [ebp - 0x16c], esp
mov dword [ebp - 0x160], esi
mov ecx, esi
push dword [ebp - 0x16c]
call fcn.1001a900
mov ecx, edi
mov byte [ebp - 4], 0x22
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100654b0
sub ecx, edx
push ecx
push edi
mov ecx, esi
call fcn.1001a920
sub esp, 0x18
mov byte [ebp - 4], 0x23
mov ecx, 0x1036ee48
push esp
call fcn.10019bd0
mov ecx, dword [ebp - 0x14c]
mov byte [ebp - 4], 0x21
call fcn.1006c680
lea ecx, [ebp - 0xe8]
mov dword [ebp - 0x16c], eax
mov dword [ebp - 4], 0xffffffff
call fcn.10019dd0
lea eax, [ebp - 0x40]
mov byte [ebp - 0x17a], 0
push eax
lea ecx, [ebp - 0x17a]
call fcn.10068570
mov ecx, eax
mov dword [ebp - 4], 0x24
call fcn.10019da0
mov esi, eax
mov byte [ebp - 0x179], 0
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x179]
call fcn.100684f0
mov ecx, eax
mov byte [ebp - 4], 0x25
call fcn.10019da0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0
push 0
mov edx, esi
mov ecx, eax
call fcn.1001ffc0
add esp, 8
lea ecx, [ebp - 0x28]
mov esi, eax
call fcn.10019dd0
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 0xffffffff
call fcn.10019dd0
test esi, esi
je 0x1006557b
mov eax, dword [esi + 0x38]
jmp 0x10065581
mov eax, dword [ebp - 0x16c]
mov esi, dword [0x1060b5e0]
sub esp, 0x18
mov dword [ebp - 0x18c], eax
mov ecx, 0x1036fcb8
mov eax, esp
mov dword [ebp - 0x160], esp
push eax
call fcn.1006ae90
sub esp, 0x18
mov dword [ebp - 4], 0x26
mov ecx, 0x1036f278
push esp
call fcn.10019bd0
lea ecx, [esi + 0x7c]
mov dword [ebp - 4], 0xffffffff
call fcn.1006cac0
mov esi, dword [0x1060b5e0]
sub esp, 0x18
mov eax, esp
mov dword [ebp - 0x160], esp
mov ecx, 0x1036ef38
push eax
call fcn.1006a170
sub esp, 0x18
mov dword [ebp - 4], 0x27
mov ecx, 0x1036f278
push esp
call fcn.10019bd0
lea ecx, [esi + 0x7c]
mov dword [ebp - 4], 0xffffffff
call fcn.1006c8a0
mov ecx, dword [eax]
mov dword [0x1060b258], ecx
lea ecx, [eax + 5]
call fcn.100685f0
mov esi, dword [0x1060b5e0]
sub esp, 0x18
mov dword [0x1060b254], eax
mov ecx, 0x1036f7b0
mov eax, esp
mov dword [ebp - 0x160], esp
push eax
call fcn.1006a020
sub esp, 0x18
mov dword [ebp - 4], 0x28
mov ecx, 0x1036ed20
push esp
call fcn.10019bd0
lea ecx, [esi + 0x7c]
mov dword [ebp - 4], 0xffffffff
call fcn.1006c680
mov edi, dword [0x1060b5e0]
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x179]
mov byte [ebp - 0x179], 0
call fcn.10068600
sub esp, 0x18
mov dword [ebp - 4], 0x29
mov ecx, eax
mov dword [ebp - 0x160], esp
mov esi, esp
call fcn.10019da0
push eax
mov ecx, esi
call fcn.10019eb0
sub esp, 0x18
mov byte [ebp - 4], 0x2a
mov ecx, 0x1036f278
push esp
call fcn.10019bd0
lea ecx, [edi + 0x7c]
mov byte [ebp - 4], 0x29
call fcn.1006c680
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10019dd0
mov edi, dword [0x1060b5e0]
lea eax, [ebp - 0xd0]
push eax
lea ecx, [ebp - 0x17a]
mov byte [ebp - 0x17a], 0
call fcn.10068680
sub esp, 0x18
mov dword [ebp - 4], 0x2b
mov ecx, eax
mov dword [ebp - 0x160], esp
mov esi, esp
call fcn.10019da0
push eax
mov ecx, esi
call fcn.10019eb0
sub esp, 0x18
mov byte [ebp - 4], 0x2c
mov ecx, 0x1036f278
push esp
call fcn.10019bd0
lea ecx, [edi + 0x7c]
mov byte [ebp - 4], 0x2b
call fcn.1006c680
lea ecx, [ebp - 0xd0]
mov dword [ebp - 0x180], eax
mov dword [ebp - 4], 0xffffffff
call fcn.10019dd0
mov edi, dword [0x1060b5e0]
lea eax, [ebp - 0xb8]
push eax
lea ecx, [ebp - 0x179]
mov byte [ebp - 0x179], 0
call fcn.10068700
sub esp, 0x18
mov dword [ebp - 4], 0x2d
mov ecx, eax
mov dword [ebp - 0x160], esp
mov esi, esp
call fcn.10019da0
push eax
mov ecx, esi
call fcn.10019eb0
sub esp, 0x18
mov byte [ebp - 4], 0x2e
mov ecx, 0x1036f278
push esp
call fcn.10019bd0
lea ecx, [edi + 0x7c]
mov byte [ebp - 4], 0x2d
call fcn.1006c680
lea ecx, [ebp - 0xb8]
mov dword [ebp - 0x160], eax
call fcn.10019dd0
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 0x2f
call fcn.10019ef0
push 0xb
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x164], 0x1000000
call fcn.1001a120
lea edx, [ebp - 0x40]
mov byte [ebp - 0x14c], 0
lea ecx, [ebp - 0x150]
call fcn.1001a8b0
push dword [ebp - 0x14c]
mov edx, 0x1036f9f0
lea ecx, [ebp - 0x15c]
push dword [eax]
push 0x1036fa02
call fcn.1001a8c0
add esp, 0xc
lea ecx, [ebp - 0x40]
push 0
push 0
call fcn.1001a0e0
mov esi, eax
cmp esi, 0xffffffff
je 0x10065858
lea eax, [ebp - 0x158]
push eax
lea ecx, [ebp - 0x40]
call fcn.10019db0
push esi
lea ecx, [ebp - 0x154]
push ecx
mov ecx, eax
call fcn.1001a0a0
lea ecx, [ebp - 0x40]
push dword [eax]
lea eax, [ebp - 0x170]
push eax
call fcn.1001a390
push 0
push 0
lea ecx, [ebp - 0x40]
call fcn.1001a0e0
mov esi, eax
cmp esi, 0xffffffff
jne 0x10065816
lea ecx, [ebp - 0x40]
call fcn.10019da0
mov ecx, dword [0x1060b27c]
push eax
call fcn.10014d40
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x150], eax
call fcn.10019dd0
lea ecx, [ebp - 0x58]
mov dword [ebp - 4], 0x30
call fcn.10019ef0
push 0x24
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x164], 0x2000000
call fcn.1001a120
lea edx, [ebp - 0x58]
mov byte [ebp - 0x14c], 0
lea ecx, [ebp - 0x15c]
call fcn.1001a8b0
push dword [ebp - 0x14c]
mov edx, 0x10370208
lea ecx, [ebp - 0x158]
push dword [eax]
push 0x1037024c
call fcn.1001a8c0
add esp, 0xc
lea ecx, [ebp - 0x58]
push 0
push 0
call fcn.1001a0e0
mov esi, eax
cmp esi, 0xffffffff
je 0x10065927
lea eax, [ebp - 0x154]
push eax
lea ecx, [ebp - 0x58]
call fcn.10019db0
push esi
lea ecx, [ebp - 0x170]
push ecx
mov ecx, eax
call fcn.1001a0a0
lea ecx, [ebp - 0x58]
push dword [eax]
lea eax, [ebp - 0x14c]
push eax
call fcn.1001a390
push 0
push 0
lea ecx, [ebp - 0x58]
call fcn.1001a0e0
mov esi, eax
cmp esi, 0xffffffff
jne 0x100658e5
lea ecx, [ebp - 0x58]
call fcn.10019da0
mov ecx, dword [0x1060b27c]
push eax
call fcn.10014d40
lea ecx, [ebp - 0x58]
mov edi, eax
call fcn.10019dd0
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0x31
call fcn.10019ef0
push 0x10
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x164], 0x4000000
call fcn.1001a120
lea edx, [ebp - 0x28]
mov byte [ebp - 0x14c], 0
lea ecx, [ebp - 0x15c]
call fcn.1001a8b0
push dword [ebp - 0x14c]
mov edx, 0x1036f2e0
lea ecx, [ebp - 0x158]
push dword [eax]
push 0x1036f2fc
call fcn.1001a8c0
add esp, 0xc
lea ecx, [ebp - 0x28]
push 0
push 0
call fcn.1001a0e0
mov esi, eax
cmp esi, 0xffffffff
je 0x100659f2
lea eax, [ebp - 0x154]
push eax
lea ecx, [ebp - 0x28]
call fcn.10019db0
push esi
lea ecx, [ebp - 0x170]
push ecx
mov ecx, eax
call fcn.1001a0a0
lea ecx, [ebp - 0x28]
push dword [eax]
lea eax, [ebp - 0x14c]
push eax
call fcn.1001a390
push 0
push 0
lea ecx, [ebp - 0x28]
call fcn.1001a0e0
mov esi, eax
cmp esi, 0xffffffff
jne 0x100659b0
lea ecx, [ebp - 0x28]
call fcn.10019da0
mov ecx, dword [0x1060b27c]
push eax
call fcn.10014d40
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0xffffffff
mov esi, eax
call fcn.10019dd0
lea ecx, [ebp - 0x14c]
call fcn.1006e520
push eax
mov ecx, 0x1060fee0
call fcn.1006c610
lea ecx, [ebp - 0x14c]
call fcn.10069f30
lea ecx, [ebp - 0x14c]
call fcn.1006e520
push eax
mov ecx, 0x1060ce4c
call fcn.1006c610
lea ecx, [ebp - 0x14c]
call fcn.10069f30
lea ecx, [ebp - 0x14c]
call fcn.1006e520
push eax
mov ecx, 0x1060c068
call fcn.1006c610
lea ecx, [ebp - 0x14c]
call fcn.10069f30
lea ecx, [ebp - 0x14c]
call fcn.1006e520
push eax
mov ecx, 0x1060fee8
call fcn.1006c610
lea ecx, [ebp - 0x14c]
call fcn.10069f30
lea ecx, [ebp - 0x14c]
call fcn.1006e520
push eax
mov ecx, 0x1060c158
call fcn.1006c610
lea ecx, [ebp - 0x14c]
call fcn.10069f30
lea ecx, [ebp - 0x14c]
call fcn.1006e520
push eax
mov ecx, 0x1060c06c
call fcn.1006c610
lea ecx, [ebp - 0x14c]
call fcn.10069f30
lea ecx, [ebp - 0x14c]
call fcn.1006e520
push eax
mov ecx, 0x1060c154
call fcn.1006c610
lea ecx, [ebp - 0x14c]
call fcn.10069f30
lea ecx, [ebp - 0x14c]
call fcn.1006e520
push eax
mov ecx, 0x1060ff34
call fcn.1006c610
lea ecx, [ebp - 0x14c]
call fcn.10069f30
lea ecx, [ebp - 0x14c]
call fcn.1006e520
push eax
mov ecx, 0x1060feec
call fcn.1006c610
lea ecx, [ebp - 0x14c]
call fcn.10069f30
lea ecx, [ebp - 0x14c]
call fcn.1006e520
push eax
mov ecx, 0x1060bf8c
call fcn.1006c610
lea ecx, [ebp - 0x14c]
call fcn.10069f30
lea ecx, [ebp - 0x14c]
call fcn.1006e520
push eax
mov ecx, 0x1060c11c
call fcn.1006c610
lea ecx, [ebp - 0x14c]
call fcn.10069f30
lea ecx, [ebp - 0x14c]
call fcn.1006e520
push eax
mov ecx, 0x1060fc5c
call fcn.1006c610
lea ecx, [ebp - 0x14c]
call fcn.10069f30
lea ecx, [ebp - 0x14c]
call fcn.1006e520
push eax
mov ecx, 0x1060ce6c
call fcn.1006c610
lea ecx, [ebp - 0x14c]
call fcn.10069f30
lea ecx, [ebp - 0x14c]
call fcn.1006e520
push eax
mov ecx, 0x1060c064
call fcn.1006c610
lea ecx, [ebp - 0x14c]
call fcn.10069f30
lea ecx, [ebp - 0x14c]
call fcn.1006e520
push eax
mov ecx, 0x1060c118
call fcn.1006c610
lea ecx, [ebp - 0x14c]
call fcn.10069f30
lea ecx, [ebp - 0x14c]
call fcn.1006e520
push eax
mov ecx, 0x1060bf88
call fcn.1006c610
lea ecx, [ebp - 0x14c]
call fcn.10069f30
lea ecx, [ebp - 0x14c]
call fcn.1006e520
push eax
mov ecx, 0x1060c20c
call fcn.1006c610
lea ecx, [ebp - 0x14c]
call fcn.10069f30
lea ecx, [ebp - 0x174]
call fcn.1006e520
push eax
mov ecx, 0x1060c15c
call fcn.1006c610
lea ecx, [ebp - 0x174]
call fcn.10069f30
lea ecx, [ebp - 0x190]
call fcn.1006e520
push eax
mov ecx, 0x1060fef4
call fcn.1006c610
lea ecx, [ebp - 0x190]
call fcn.10069f30
lea ecx, [ebp - 0x164]
call fcn.1006e520
push eax
mov ecx, 0x1060bf3c
call fcn.1006c610
lea ecx, [ebp - 0x164]
call fcn.10069f30
lea ecx, [ebp - 0x170]
call fcn.1006e520
push eax
mov ecx, 0x1060fee4
call fcn.1006c610
lea ecx, [ebp - 0x170]
call fcn.10069f30
lea ecx, [ebp - 0x154]
call fcn.1006e520
push eax
mov ecx, 0x1060c1bc
call fcn.1006c610
lea ecx, [ebp - 0x154]
call fcn.10069f30
lea ecx, [ebp - 0x158]
call fcn.1006e520
push eax
mov ecx, 0x1060c1b8
call fcn.1006c610
lea ecx, [ebp - 0x158]
call fcn.10069f30
lea ecx, [ebp - 0x15c]
call fcn.1006e520
push eax
mov ecx, 0x1060ce68
call fcn.1006c610
lea ecx, [ebp - 0x15c]
call fcn.10069f30
mov ecx, 0x1060ce4c
call fcn.10027a80
push dword [0x1060b288]
mov ecx, eax
call fcn.100740a0
mov ecx, 0x1060c068
call fcn.10027a80
push dword [0x1060b2d8]
mov ecx, eax
call fcn.100740a0
mov ecx, 0x1060fee8
call fcn.10027a80
push dword [0x1060b29c]
mov ecx, eax
call fcn.100740a0
mov ecx, 0x1060c20c
call fcn.10027a80
push dword [0x1060b26c]
mov ecx, eax
call fcn.100740a0
mov ecx, 0x1060c158
call fcn.10027a80
push dword [0x1060b270]
mov ecx, eax
call fcn.100740a0
mov ecx, 0x1060c06c
call fcn.10027a80
push esi
mov ecx, eax
call fcn.100740a0
mov ecx, 0x1060c154
call fcn.10027a80
push dword [0x1060b2bc]
mov ecx, eax
call fcn.100740a0
mov ecx, 0x1060ff34
call fcn.10027a80
push dword [0x1060b2a0]
mov ecx, eax
call fcn.100740a0
mov ecx, 0x1060feec
call fcn.10027a80
push dword [0x1060b2d0]
mov ecx, eax
call fcn.100740a0
mov ecx, 0x1060bf8c
call fcn.10027a80
push dword [0x1060b2cc]
mov ecx, eax
call fcn.100740a0
mov ecx, 0x1060c11c
call fcn.10027a80
mov ecx, dword [0x1060b288]
mov esi, eax
mov edx, dword [ecx]
mov edx, dword [edx + 0xac]
call edx
push eax
mov ecx, esi
call fcn.100740a0
mov ecx, 0x1060fc5c
call fcn.10027a80
push edi
mov ecx, eax
call fcn.100740a0
mov ecx, 0x1060ce6c
call fcn.10027a80
push dword [ebp - 0x150]
mov ecx, eax
call fcn.100740a0
mov ecx, 0x1060c118
call fcn.10027a80
push dword [0x1060b2ac]
mov ecx, eax
call fcn.100740a0
mov ecx, 0x1060bf88
call fcn.10027a80
push dword [0x1060b278]
mov ecx, eax
call fcn.100740a0
mov ecx, 0x1060c15c
call fcn.10027a80
push dword [0x1060b2a8]
mov ecx, eax
call fcn.100740a0
mov ecx, 0x1060fee0
call fcn.10027a80
mov ecx, dword [0x1060b5e0]
mov ecx, dword [ecx + 0x6ef8]
add ecx, 8
push ecx
mov ecx, eax
call fcn.100740a0
mov ecx, 0x1060fef4
call fcn.10027a80
push dword [0x1060b28c]
mov ecx, eax
call fcn.100740a0
mov ecx, 0x1060bf3c
call fcn.10027a80
push dword [0x1060b2e0]
mov ecx, eax
call fcn.100740a0
mov ecx, 0x1060fee4
call fcn.10027a80
push dword [0x1060b294]
mov ecx, eax
call fcn.100740a0
mov ecx, 0x1060c1bc
call fcn.10027a80
push dword [0x1060b2e8]
mov ecx, eax
call fcn.100740a0
mov ecx, 0x1060c1b8
call fcn.10027a80
push dword [0x1060b2f4]
mov ecx, eax
call fcn.100740a0
mov ecx, 0x1060ce68
call fcn.10027a80
push dword [0x1060b2f8]
mov ecx, eax
call fcn.100740a0
mov ecx, 0x1060c20c
call fcn.10027a80
mov edi, eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0x32
call fcn.10019ef0
push 0x19
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x164], 0x8000000
call fcn.1001a120
lea edx, [ebp - 0x28]
mov byte [ebp - 0x150], 0
lea ecx, [ebp - 0x178]
call fcn.1001a8b0
push dword [ebp - 0x150]
mov edx, 0x1036ec30
lea ecx, [ebp - 0x170]
push dword [eax]
push 0x1036ec5e
call fcn.1001a8c0
add esp, 0xc
push 0
push 0
lea ecx, [ebp - 0x28]
call fcn.1001a0e0
mov esi, eax
cmp esi, 0xffffffff
je 0x10066006
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp - 0x28]
call fcn.10019db0
push esi
lea ecx, [ebp - 0x14c]
push ecx
mov ecx, eax
call fcn.1001a0a0
lea ecx, [ebp - 0x28]
push dword [eax]
lea eax, [ebp - 0x174]
push eax
call fcn.1001a390
push 0
push 0
lea ecx, [ebp - 0x28]
call fcn.1001a0e0
mov esi, eax
cmp esi, 0xffffffff
jne 0x10065fc4
lea ecx, [ebp - 0x28]
call fcn.10019da0
push eax
lea ecx, [ebp - 0x15c]
call fcn.10032cf0
mov ecx, dword [ebp - 0x15c]
call fcn.10032cb0
lea ecx, [ebp - 0x158]
mov dword [ebp - 0x158], eax
call fcn.10027a80
mov dword [ebp - 0x154], eax
mov ecx, 0x1060c1a8
lea eax, [ebp - 0x154]
push eax
call fcn.10068970
push 0x1003ea90
mov ecx, edi
push dword [eax]
call fcn.100741b0
lea ecx, [ebp - 0x28]
call fcn.10019dd0
mov ecx, 0x1060c20c
call fcn.10027a80
push 0x1003e210
push 0x16
mov ecx, eax
call fcn.100741b0
mov ecx, 0x1060c20c
call fcn.10027a80
mov edi, eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0x33
call fcn.10019ef0
push 0x1c
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x164], 0x10000000
call fcn.1001a120
lea edx, [ebp - 0x28]
mov byte [ebp - 0x150], 0
lea ecx, [ebp - 0x178]
call fcn.1001a8b0
push dword [ebp - 0x150]
mov edx, 0x1036f04c
lea ecx, [ebp - 0x170]
push dword [eax]
push 0x1036f080
call fcn.1001a8c0
add esp, 0xc
lea ecx, [ebp - 0x28]
push 0
push 0
call fcn.1001a0e0
mov esi, eax
cmp esi, 0xffffffff
je 0x10066134
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp - 0x28]
call fcn.10019db0
push esi
lea ecx, [ebp - 0x14c]
push ecx
mov ecx, eax
call fcn.1001a0a0
lea ecx, [ebp - 0x28]
push dword [eax]
lea eax, [ebp - 0x174]
push eax
call fcn.1001a390
push 0
push 0
lea ecx, [ebp - 0x28]
call fcn.1001a0e0
mov esi, eax
cmp esi, 0xffffffff
jne 0x100660f2
lea ecx, [ebp - 0x28]
call fcn.10019da0
push eax
lea ecx, [ebp - 0x15c]
call fcn.10032cf0
mov ecx, dword [ebp - 0x15c]
call fcn.10032cb0
lea ecx, [ebp - 0x158]
mov dword [ebp - 0x158], eax
call fcn.10027a80
mov dword [ebp - 0x154], eax
mov ecx, 0x1060c1a8
lea eax, [ebp - 0x154]
push eax
call fcn.10068970
push 0x10054260
mov ecx, edi
push dword [eax]
call fcn.100741b0
lea ecx, [ebp - 0x28]
call fcn.10019dd0
mov ecx, 0x1060ce4c
call fcn.10027a80
mov edi, eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0x34
call fcn.10019ef0
push 0x11
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x164], 0x20000000
call fcn.1001a120
lea edx, [ebp - 0x28]
mov byte [ebp - 0x150], 0
lea ecx, [ebp - 0x178]
call fcn.1001a8b0
push dword [ebp - 0x150]
mov edx, 0x1036fce4
lea ecx, [ebp - 0x170]
push dword [eax]
push 0x1036fd02
call fcn.1001a8c0
add esp, 0xc
lea ecx, [ebp - 0x28]
push 0
push 0
call fcn.1001a0e0
mov esi, eax
cmp esi, 0xffffffff
je 0x10066252
nop dword [eax + eax]
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp - 0x28]
call fcn.10019db0
push esi
lea ecx, [ebp - 0x14c]
push ecx
mov ecx, eax
call fcn.1001a0a0
lea ecx, [ebp - 0x28]
push dword [eax]
lea eax, [ebp - 0x174]
push eax
call fcn.1001a390
push 0
push 0
lea ecx, [ebp - 0x28]
call fcn.1001a0e0
mov esi, eax
cmp esi, 0xffffffff
jne 0x10066210
lea ecx, [ebp - 0x28]
call fcn.10019da0
push eax
lea ecx, [ebp - 0x15c]
call fcn.10032cf0
mov ecx, dword [ebp - 0x15c]
call fcn.10032cb0
lea ecx, [ebp - 0x158]
mov dword [ebp - 0x158], eax
call fcn.10027a80
mov dword [ebp - 0x154], eax
mov ecx, 0x1060c1a8
lea eax, [ebp - 0x154]
push eax
call fcn.10068970
push 0x10053540
mov ecx, edi
push dword [eax]
call fcn.100741b0
lea ecx, [ebp - 0x28]
call fcn.10019dd0
mov ecx, 0x1060ce4c
call fcn.10027a80
mov edi, eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0x35
call fcn.10019ef0
push 0x15
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x164], 0x40000000
call fcn.1001a120
lea edx, [ebp - 0x28]
mov byte [ebp - 0x150], 0
lea ecx, [ebp - 0x178]
call fcn.1001a8b0
push dword [ebp - 0x150]
mov edx, 0x1036ead8
lea ecx, [ebp - 0x170]
push dword [eax]
push 0x1036eafe
call fcn.1001a8c0
add esp, 0xc
lea ecx, [ebp - 0x28]
push 0
push 0
call fcn.1001a0e0
mov esi, eax
cmp esi, 0xffffffff
je 0x10066368
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp - 0x28]
call fcn.10019db0
push esi
lea ecx, [ebp - 0x14c]
push ecx
mov ecx, eax
call fcn.1001a0a0
lea ecx, [ebp - 0x28]
push dword [eax]
lea eax, [ebp - 0x174]
push eax
call fcn.1001a390
push 0
push 0
lea ecx, [ebp - 0x28]
call fcn.1001a0e0
mov esi, eax
cmp esi, 0xffffffff
jne 0x10066326
lea ecx, [ebp - 0x28]
call fcn.10019da0
push eax
lea ecx, [ebp - 0x15c]
call fcn.10032cf0
mov ecx, dword [ebp - 0x15c]
call fcn.10032cb0
lea ecx, [ebp - 0x158]
mov dword [ebp - 0x158], eax
call fcn.10027a80
mov dword [ebp - 0x154], eax
mov ecx, 0x1060c1a8
lea eax, [ebp - 0x154]
push eax
call fcn.10068970
push 0x10053710
mov ecx, edi
push dword [eax]
call fcn.100741b0
lea ecx, [ebp - 0x28]
call fcn.10019dd0
mov ecx, 0x1060ce4c
call fcn.10027a80
mov edi, eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0x36
call fcn.10019ef0
push 0xf
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x164], VariantCopy
call fcn.1001a120
lea edx, [ebp - 0x28]
mov byte [ebp - 0x150], 0
lea ecx, [ebp - 0x178]
call fcn.1001a8b0
push dword [ebp - 0x150]
mov edx, 0x1036fcc8
lea ecx, [ebp - 0x170]
push dword [eax]
push 0x1036fce2
call fcn.1001a8c0
add esp, 0xc
lea ecx, [ebp - 0x28]
push 0
push 0
call fcn.1001a0e0
mov esi, eax
cmp esi, 0xffffffff
je 0x10066482
nop dword [eax]
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp - 0x28]
call fcn.10019db0
push esi
lea ecx, [ebp - 0x14c]
push ecx
mov ecx, eax
call fcn.1001a0a0
lea ecx, [ebp - 0x28]
push dword [eax]
lea eax, [ebp - 0x174]
push eax
call fcn.1001a390
push 0
push 0
lea ecx, [ebp - 0x28]
call fcn.1001a0e0
mov esi, eax
cmp esi, 0xffffffff
jne 0x10066440
lea ecx, [ebp - 0x28]
call fcn.10019da0
push eax
lea ecx, [ebp - 0x15c]
call fcn.10032cf0
mov ecx, dword [ebp - 0x15c]
call fcn.10032cb0
lea ecx, [ebp - 0x158]
mov dword [ebp - 0x158], eax
call fcn.10027a80
mov dword [ebp - 0x154], eax
mov ecx, 0x1060c1a8
lea eax, [ebp - 0x154]
push eax
call fcn.10068970
push 0x10053920
mov ecx, edi
push dword [eax]
call fcn.100741b0
lea ecx, [ebp - 0x28]
call fcn.10019dd0
mov ecx, 0x1060ce4c
call fcn.10027a80
push 0x100534c0
push 0x1b
mov ecx, eax
call fcn.100741b0
mov ecx, 0x1060ce4c
call fcn.10027a80
mov edi, eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0x37
call fcn.10019ef0
push 0x1d
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x164], 1
call fcn.1001a120
lea edx, [ebp - 0x28]
mov byte [ebp - 0x150], 0
lea ecx, [ebp - 0x178]
call fcn.1001a8b0
push dword [ebp - 0x150]
mov edx, 0x1036f538
lea ecx, [ebp - 0x170]
push dword [eax]
push 0x1036f56e
call fcn.1001a8c0
add esp, 0xc
lea ecx, [ebp - 0x28]
push 0
push 0
call fcn.1001a0e0
mov esi, eax
cmp esi, 0xffffffff
je 0x100665b2
nop
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp - 0x28]
call fcn.10019db0
push esi
lea ecx, [ebp - 0x14c]
push ecx
mov ecx, eax
call fcn.1001a0a0
lea ecx, [ebp - 0x28]
push dword [eax]
lea eax, [ebp - 0x174]
push eax
call fcn.1001a390
push 0
push 0
lea ecx, [ebp - 0x28]
call fcn.1001a0e0
mov esi, eax
cmp esi, 0xffffffff
jne 0x10066570
lea ecx, [ebp - 0x28]
call fcn.10019da0
push eax
lea ecx, [ebp - 0x15c]
call fcn.10032cf0
mov ecx, dword [ebp - 0x15c]
call fcn.10032cb0
lea ecx, [ebp - 0x158]
mov dword [ebp - 0x158], eax
call fcn.10027a80
mov dword [ebp - 0x154], eax
mov ecx, 0x1060c1a8
lea eax, [ebp - 0x154]
push eax
call fcn.10068970
push 0x10036ca0
mov ecx, edi
push dword [eax]
call fcn.100741b0
lea ecx, [ebp - 0x28]
call fcn.10019dd0
mov ecx, 0x1060c158
call fcn.10027a80
mov edi, eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0x38
call fcn.10019ef0
push 0x15
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x164], 2
call fcn.1001a120
lea edx, [ebp - 0x28]
mov byte [ebp - 0x150], 0
lea ecx, [ebp - 0x178]
call fcn.1001a8b0
push dword [ebp - 0x150]
mov edx, 0x1036f954
lea ecx, [ebp - 0x170]
push dword [eax]
push 0x1036f97a
call fcn.1001a8c0
add esp, 0xc
lea ecx, [ebp - 0x28]
push 0
push 0
call fcn.1001a0e0
mov esi, eax
cmp esi, 0xffffffff
je 0x100666c8
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp - 0x28]
call fcn.10019db0
push esi
lea ecx, [ebp - 0x14c]
push ecx
mov ecx, eax
call fcn.1001a0a0
lea ecx, [ebp - 0x28]
push dword [eax]
lea eax, [ebp - 0x174]
push eax
call fcn.1001a390
push 0
push 0
lea ecx, [ebp - 0x28]
call fcn.1001a0e0
mov esi, eax
cmp esi, 0xffffffff
jne 0x10066686
lea ecx, [ebp - 0x28]
call fcn.10019da0
push eax
lea ecx, [ebp - 0x15c]
call fcn.10032cf0
mov ecx, dword [ebp - 0x15c]
call fcn.10032cb0
lea ecx, [ebp - 0x158]
mov dword [ebp - 0x158], eax
call fcn.10027a80
mov dword [ebp - 0x154], eax
mov ecx, 0x1060c1a8
lea eax, [ebp - 0x154]
push eax
call fcn.10068970
push 0x10050640
mov ecx, edi
push dword [eax]
call fcn.100741b0
lea ecx, [ebp - 0x28]
call fcn.10019dd0
mov ecx, 0x1060c158
call fcn.10027a80
mov edi, eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0x39
call fcn.10019ef0
push 0x12
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x164], 4
call fcn.1001a120
lea edx, [ebp - 0x28]
mov byte [ebp - 0x150], 0
lea ecx, [ebp - 0x178]
call fcn.1001a8b0
push dword [ebp - 0x150]
mov edx, 0x103702bc
lea ecx, [ebp - 0x170]
push dword [eax]
push 0x103702dc
call fcn.1001a8c0
add esp, 0xc
lea ecx, [ebp - 0x28]
push 0
push 0
call fcn.1001a0e0
mov esi, eax
cmp esi, 0xffffffff
je 0x100667e2
nop dword [eax]
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp - 0x28]
call fcn.10019db0
push esi
lea ecx, [ebp - 0x14c]
push ecx
mov ecx, eax
call fcn.1001a0a0
lea ecx, [ebp - 0x28]
push dword [eax]
lea eax, [ebp - 0x174]
push eax
call fcn.1001a390
push 0
push 0
lea ecx, [ebp - 0x28]
call fcn.1001a0e0
mov esi, eax
cmp esi, 0xffffffff
jne 0x100667a0
lea ecx, [ebp - 0x28]
call fcn.10019da0
push eax
lea ecx, [ebp - 0x15c]
call fcn.10032cf0
mov ecx, dword [ebp - 0x15c]
call fcn.10032cb0
lea ecx, [ebp - 0x158]
mov dword [ebp - 0x158], eax
call fcn.10027a80
mov dword [ebp - 0x154], eax
mov ecx, 0x1060c1a8
lea eax, [ebp - 0x154]
push eax
call fcn.10068970
push 0x10050d80
mov ecx, edi
push dword [eax]
call fcn.100741b0
lea ecx, [ebp - 0x28]
call fcn.10019dd0
mov ecx, 0x1060c158
call fcn.10027a80
mov edi, eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0x3a
call fcn.10019ef0
push 0x1b
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x164], 8
call fcn.1001a120
lea edx, [ebp - 0x28]
mov byte [ebp - 0x150], 0
lea ecx, [ebp - 0x178]
call fcn.1001a8b0
push dword [ebp - 0x150]
mov edx, 0x1036fb3c
lea ecx, [ebp - 0x170]
push dword [eax]
push 0x1036fb6e
call fcn.1001a8c0
add esp, 0xc
lea ecx, [ebp - 0x28]
push 0
push 0
call fcn.1001a0e0
mov esi, eax
cmp esi, 0xffffffff
je 0x100668f8
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp - 0x28]
call fcn.10019db0
push esi
lea ecx, [ebp - 0x14c]
push ecx
mov ecx, eax
call fcn.1001a0a0
lea ecx, [ebp - 0x28]
push dword [eax]
lea eax, [ebp - 0x174]
push eax
call fcn.1001a390
push 0
push 0
lea ecx, [ebp - 0x28]
call fcn.1001a0e0
mov esi, eax
cmp esi, 0xffffffff
jne 0x100668b6
lea ecx, [ebp - 0x28]
call fcn.10019da0
push eax
lea ecx, [ebp - 0x15c]
call fcn.10032cf0
mov ecx, dword [ebp - 0x15c]
call fcn.10032cb0
lea ecx, [ebp - 0x158]
mov dword [ebp - 0x158], eax
call fcn.10027a80
mov dword [ebp - 0x154], eax
mov ecx, 0x1060c1a8
lea eax, [ebp - 0x154]
push eax
call fcn.10068970
push 0x10050e40
mov ecx, edi
push dword [eax]
call fcn.100741b0
lea ecx, [ebp - 0x28]
call fcn.10019dd0
mov ecx, 0x1060fee8
call fcn.10027a80
mov edi, eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0x3b
call fcn.10019ef0
push 0x16
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x164], 0x10
call fcn.1001a120
lea edx, [ebp - 0x28]
mov byte [ebp - 0x150], 0
lea ecx, [ebp - 0x178]
call fcn.1001a8b0
push dword [ebp - 0x150]
mov edx, 0x10370014
lea ecx, [ebp - 0x170]
push dword [eax]
push 0x1037003c
call fcn.1001a8c0
add esp, 0xc
lea ecx, [ebp - 0x28]
push 0
push 0
call fcn.1001a0e0
mov esi, eax
cmp esi, 0xffffffff
je 0x10066a12
nop dword [eax]
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp - 0x28]
call fcn.10019db0
push esi
lea ecx, [ebp - 0x14c]
push ecx
mov ecx, eax
call fcn.1001a0a0
lea ecx, [ebp - 0x28]
push dword [eax]
lea eax, [ebp - 0x174]
push eax
call fcn.1001a390
push 0
push 0
lea ecx, [ebp - 0x28]
call fcn.1001a0e0
mov esi, eax
cmp esi, 0xffffffff
jne 0x100669d0
lea ecx, [ebp - 0x28]
call fcn.10019da0
push eax
lea ecx, [ebp - 0x15c]
call fcn.10032cf0
mov ecx, dword [ebp - 0x15c]
call fcn.10032cb0
lea ecx, [ebp - 0x158]
mov dword [ebp - 0x158], eax
call fcn.10027a80
mov dword [ebp - 0x154], eax
mov ecx, 0x1060c1a8
lea eax, [ebp - 0x154]
push eax
call fcn.10068970
push 0x10036210
mov ecx, edi
push dword [eax]
call fcn.100741b0
lea ecx, [ebp - 0x28]
call fcn.10019dd0
mov ecx, 0x1060c154
call fcn.10027a80
mov edi, eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0x3c
call fcn.10019ef0
push 0x13
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x164], 0x20
call fcn.1001a120
lea edx, [ebp - 0x28]
mov byte [ebp - 0x150], 0
lea ecx, [ebp - 0x178]
call fcn.1001a8b0
push dword [ebp - 0x150]
mov edx, 0x1036ed64
lea ecx, [ebp - 0x170]
push dword [eax]
push 0x1036ed86
call fcn.1001a8c0
add esp, 0xc
lea ecx, [ebp - 0x28]
push 0
push 0
call fcn.1001a0e0
mov esi, eax
cmp esi, 0xffffffff
je 0x10066b28
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp - 0x28]
call fcn.10019db0
push esi
lea ecx, [ebp - 0x14c]
push ecx
mov ecx, eax
call fcn.1001a0a0
lea ecx, [ebp - 0x28]
push dword [eax]
lea eax, [ebp - 0x174]
push eax
call fcn.1001a390
push 0
push 0
lea ecx, [ebp - 0x28]
call fcn.1001a0e0
mov esi, eax
cmp esi, 0xffffffff
jne 0x10066ae6
lea ecx, [ebp - 0x28]
call fcn.10019da0
push eax
lea ecx, [ebp - 0x15c]
call fcn.10032cf0
mov ecx, dword [ebp - 0x15c]
call fcn.10032cb0
lea ecx, [ebp - 0x158]
mov dword [ebp - 0x158], eax
call fcn.10027a80
mov dword [ebp - 0x154], eax
mov ecx, 0x1060c1a8
lea eax, [ebp - 0x154]
push eax
call fcn.10068970
push 0x1004f750
mov ecx, edi
push dword [eax]
call fcn.100741b0
lea ecx, [ebp - 0x28]
call fcn.10019dd0
mov ecx, 0x1060fee0
call fcn.10027a80
mov edi, eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0x3d
call fcn.10019ef0
push 0x14
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x164], 0x40
call fcn.1001a120
lea edx, [ebp - 0x28]
mov byte [ebp - 0x150], 0
lea ecx, [ebp - 0x178]
call fcn.1001a8b0
push dword [ebp - 0x150]
mov edx, 0x1036fe54
lea ecx, [ebp - 0x170]
push dword [eax]
push 0x1036fe78
call fcn.1001a8c0
add esp, 0xc
lea ecx, [ebp - 0x28]
push 0
push 0
call fcn.1001a0e0
mov esi, eax
cmp esi, 0xffffffff
je 0x10066c42
nop dword [eax]
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp - 0x28]
call fcn.10019db0
push esi
lea ecx, [ebp - 0x14c]
push ecx
mov ecx, eax
call fcn.1001a0a0
lea ecx, [ebp - 0x28]
push dword [eax]
lea eax, [ebp - 0x174]
push eax
call fcn.1001a390
push 0
push 0
lea ecx, [ebp - 0x28]
call fcn.1001a0e0
mov esi, eax
cmp esi, 0xffffffff
jne 0x10066c00
lea ecx, [ebp - 0x28]
call fcn.10019da0
push eax
lea ecx, [ebp - 0x15c]
call fcn.10032cf0
mov ecx, dword [ebp - 0x15c]
call fcn.10032cb0
lea ecx, [ebp - 0x158]
mov dword [ebp - 0x158], eax
call fcn.10027a80
mov dword [ebp - 0x154], eax
mov ecx, 0x1060c1a8
lea eax, [ebp - 0x154]
push eax
call fcn.10068970
push 0x10038db0
mov ecx, edi
push dword [eax]
call fcn.100741b0
lea ecx, [ebp - 0x28]
call fcn.10019dd0
mov ecx, 0x1060fee0
call fcn.10027a80
mov edi, eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0x3e
call fcn.10019ef0
push 0x12
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x164], 0x80
call fcn.1001a120
lea edx, [ebp - 0x28]
mov byte [ebp - 0x150], 0
lea ecx, [ebp - 0x178]
call fcn.1001a8b0
push dword [ebp - 0x150]
mov edx, 0x1036fe7c
lea ecx, [ebp - 0x170]
push dword [eax]
push 0x1036fe9c
call fcn.1001a8c0
add esp, 0xc
lea ecx, [ebp - 0x28]
push 0
push 0
call fcn.1001a0e0
mov esi, eax
cmp esi, 0xffffffff
je 0x10066d58
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp - 0x28]
call fcn.10019db0
push esi
lea ecx, [ebp - 0x14c]
push ecx
mov ecx, eax
call fcn.1001a0a0
lea ecx, [ebp - 0x28]
push dword [eax]
lea eax, [ebp - 0x174]
push eax
call fcn.1001a390
push 0
push 0
lea ecx, [ebp - 0x28]
call fcn.1001a0e0
mov esi, eax
cmp esi, 0xffffffff
jne 0x10066d16
lea ecx, [ebp - 0x28]
call fcn.10019da0
push eax
lea ecx, [ebp - 0x15c]
call fcn.10032cf0
mov ecx, dword [ebp - 0x15c]
call fcn.10032cb0
lea ecx, [ebp - 0x158]
mov dword [ebp - 0x158], eax
call fcn.10027a80
mov dword [ebp - 0x154], eax
mov ecx, 0x1060c1a8
lea eax, [ebp - 0x154]
push eax
call fcn.10068970
push 0x10039050
mov ecx, edi
push dword [eax]
call fcn.100741b0
lea ecx, [ebp - 0x28]
call fcn.10019dd0
mov ecx, 0x1060c11c
call fcn.10027a80
mov edi, eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0x3f
call fcn.10019ef0
push 0x18
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x164], 0x100
call fcn.1001a120
lea edx, [ebp - 0x28]
mov byte [ebp - 0x150], 0
lea ecx, [ebp - 0x178]
call fcn.1001a8b0
push dword [ebp - 0x150]
mov edx, 0x103701d4
lea ecx, [ebp - 0x170]
push dword [eax]
push 0x10370200
call fcn.1001a8c0
add esp, 0xc
lea ecx, [ebp - 0x28]
push 0
push 0
call fcn.1001a0e0
mov esi, eax
cmp esi, 0xffffffff
je 0x10066e72
nop dword [eax]
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp - 0x28]
call fcn.10019db0
push esi
lea ecx, [ebp - 0x14c]
push ecx
mov ecx, eax
call fcn.1001a0a0
lea ecx, [ebp - 0x28]
push dword [eax]
lea eax, [ebp - 0x174]
push eax
call fcn.1001a390
push 0
push 0
lea ecx, [ebp - 0x28]
call fcn.1001a0e0
mov esi, eax
cmp esi, 0xffffffff
jne 0x10066e30
lea ecx, [ebp - 0x28]
call fcn.10019da0
push eax
lea ecx, [ebp - 0x15c]
call fcn.10032cf0
mov ecx, dword [ebp - 0x15c]
call fcn.10032cb0
lea ecx, [ebp - 0x158]
mov dword [ebp - 0x158], eax
call fcn.10027a80
mov dword [ebp - 0x154], eax
mov ecx, 0x1060c1a8
lea eax, [ebp - 0x154]
push eax
call fcn.10068970
push 0x10053270
mov ecx, edi
push dword [eax]
call fcn.100741b0
lea ecx, [ebp - 0x28]
call fcn.10019dd0
mov ecx, 0x1060ff34
call fcn.10027a80
mov edi, eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0x40
call fcn.10019ef0
push 0x19
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x164], 0x200
call fcn.1001a120
lea edx, [ebp - 0x28]
mov byte [ebp - 0x150], 0
lea ecx, [ebp - 0x178]
call fcn.1001a8b0
push dword [ebp - 0x150]
mov edx, 0x1036f84c
lea ecx, [ebp - 0x170]
push dword [eax]
push 0x1036f87a
call fcn.1001a8c0
add esp, 0xc
lea ecx, [ebp - 0x28]
push 0
push 0
call fcn.1001a0e0
mov esi, eax
cmp esi, 0xffffffff
je 0x10066f88
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp - 0x28]
call fcn.10019db0
push esi
lea ecx, [ebp - 0x14c]
push ecx
mov ecx, eax
call fcn.1001a0a0
lea ecx, [ebp - 0x28]
push dword [eax]
lea eax, [ebp - 0x174]
push eax
call fcn.1001a390
push 0
push 0
lea ecx, [ebp - 0x28]
call fcn.1001a0e0
mov esi, eax
cmp esi, 0xffffffff
jne 0x10066f46
lea ecx, [ebp - 0x28]
call fcn.10019da0
push eax
lea ecx, [ebp - 0x15c]
call fcn.10032cf0
mov ecx, dword [ebp - 0x15c]
call fcn.10032cb0
lea ecx, [ebp - 0x158]
mov dword [ebp - 0x158], eax
call fcn.10027a80
mov dword [ebp - 0x154], eax
mov ecx, 0x1060c1a8
lea eax, [ebp - 0x154]
push eax
call fcn.10068970
push 0x10052220
mov ecx, edi
push dword [eax]
call fcn.100741b0
lea ecx, [ebp - 0x28]
call fcn.10019dd0
mov ecx, 0x1060bf8c
call fcn.10027a80
mov edi, eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0x41
call fcn.10019ef0
push 0x18
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x164], 0x400
call fcn.1001a120
lea edx, [ebp - 0x28]
mov byte [ebp - 0x150], 0
lea ecx, [ebp - 0x178]
call fcn.1001a8b0
push dword [ebp - 0x150]
mov edx, 0x1036ffac
lea ecx, [ebp - 0x170]
push dword [eax]
push 0x1036ffd8
call fcn.1001a8c0
add esp, 0xc
lea ecx, [ebp - 0x28]
push 0
push 0
call fcn.1001a0e0
mov esi, eax
cmp esi, 0xffffffff
je 0x100670a2
nop dword [eax]
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp - 0x28]
call fcn.10019db0
push esi
lea ecx, [ebp - 0x14c]
push ecx
mov ecx, eax
call fcn.1001a0a0
lea ecx, [ebp - 0x28]
push dword [eax]
lea eax, [ebp - 0x174]
push eax
call fcn.1001a390
push 0
push 0
lea ecx, [ebp - 0x28]
call fcn.1001a0e0
mov esi, eax
cmp esi, 0xffffffff
jne 0x10067060
lea ecx, [ebp - 0x28]
call fcn.10019da0
push eax
lea ecx, [ebp - 0x15c]
call fcn.10032cf0
mov ecx, dword [ebp - 0x15c]
call fcn.10032cb0
lea ecx, [ebp - 0x158]
mov dword [ebp - 0x158], eax
call fcn.10027a80
mov dword [ebp - 0x154], eax
mov ecx, 0x1060c1a8
lea eax, [ebp - 0x154]
push eax
call fcn.10068970
push 0x10039d30
mov ecx, edi
push dword [eax]
call fcn.100741b0
lea ecx, [ebp - 0x28]
call fcn.10019dd0
mov ecx, 0x1060bf8c
call fcn.10027a80
push 0x10039d90
push 0x20
mov ecx, eax
call fcn.100741b0
mov ecx, 0x1060feec
call fcn.10027a80
mov edi, eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0x42
call fcn.10019ef0
push 0x13
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x164], 0x800
call fcn.1001a120
lea edx, [ebp - 0x28]
mov byte [ebp - 0x150], 0
lea ecx, [ebp - 0x178]
call fcn.1001a8b0
push dword [ebp - 0x150]
mov edx, 0x1036ffdc
lea ecx, [ebp - 0x170]
push dword [eax]
push 0x1036fffe
call fcn.1001a8c0
add esp, 0xc
lea ecx, [ebp - 0x28]
push 0
push 0
call fcn.1001a0e0
mov esi, eax
cmp esi, 0xffffffff
je 0x100671d2
nop
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp - 0x28]
call fcn.10019db0
push esi
lea ecx, [ebp - 0x14c]
push ecx
mov ecx, eax
call fcn.1001a0a0
lea ecx, [ebp - 0x28]
push dword [eax]
lea eax, [ebp - 0x174]
push eax
call fcn.1001a390
push 0
push 0
lea ecx, [ebp - 0x28]
call fcn.1001a0e0
mov esi, eax
cmp esi, 0xffffffff
jne 0x10067190
lea ecx, [ebp - 0x28]
call fcn.10019da0
push eax
lea ecx, [ebp - 0x15c]
call fcn.10032cf0
mov ecx, dword [ebp - 0x15c]
call fcn.10032cb0
lea ecx, [ebp - 0x158]
mov dword [ebp - 0x158], eax
call fcn.10027a80
mov dword [ebp - 0x154], eax
mov ecx, 0x1060c1a8
lea eax, [ebp - 0x154]
push eax
call fcn.10068970
push 0x10039a40
mov ecx, edi
push dword [eax]
call fcn.100741b0
lea ecx, [ebp - 0x28]
call fcn.10019dd0
mov ecx, 0x1060feec
call fcn.10027a80
mov edi, eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0x43
call fcn.10019ef0
push 0x15
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x164], 0x1000
call fcn.1001a120
lea edx, [ebp - 0x28]
mov byte [ebp - 0x150], 0
lea ecx, [ebp - 0x178]
call fcn.1001a8b0
push dword [ebp - 0x150]
mov edx, 0x1036f5d0
lea ecx, [ebp - 0x170]
push dword [eax]
push 0x1036f5f6
call fcn.1001a8c0
add esp, 0xc
lea ecx, [ebp - 0x28]
push 0
push 0
call fcn.1001a0e0
mov esi, eax
cmp esi, 0xffffffff
je 0x100672e8
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp - 0x28]
call fcn.10019db0
push esi
lea ecx, [ebp - 0x14c]
push ecx
mov ecx, eax
call fcn.1001a0a0
lea ecx, [ebp - 0x28]
push dword [eax]
lea eax, [ebp - 0x174]
push eax
call fcn.1001a390
push 0
push 0
lea ecx, [ebp - 0x28]
call fcn.1001a0e0
mov esi, eax
cmp esi, 0xffffffff
jne 0x100672a6
lea ecx, [ebp - 0x28]
call fcn.10019da0
push eax
lea ecx, [ebp - 0x15c]
call fcn.10032cf0
mov ecx, dword [ebp - 0x15c]
call fcn.10032cb0
lea ecx, [ebp - 0x158]
mov dword [ebp - 0x158], eax
call fcn.10027a80
mov dword [ebp - 0x154], eax
mov ecx, 0x1060c1a8
lea eax, [ebp - 0x154]
push eax
call fcn.10068970
push 0x10039bb0
mov ecx, edi
push dword [eax]
call fcn.100741b0
lea ecx, [ebp - 0x28]
call fcn.10019dd0
mov ecx, 0x1060ce6c
call fcn.10027a80
mov edi, eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0x44
call fcn.10019ef0
push 0x10
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x164], 0x2000
call fcn.1001a120
lea edx, [ebp - 0x28]
mov byte [ebp - 0x150], 0
lea ecx, [ebp - 0x178]
call fcn.1001a8b0
push dword [ebp - 0x150]
mov edx, 0x1036f9d0
lea ecx, [ebp - 0x170]
push dword [eax]
push 0x1036f9ec
call fcn.1001a8c0
add esp, 0xc
lea ecx, [ebp - 0x28]
push 0
push 0
call fcn.1001a0e0
mov esi, eax
cmp esi, 0xffffffff
je 0x10067402
nop dword [eax]
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp - 0x28]
call fcn.10019db0
push esi
lea ecx, [ebp - 0x14c]
push ecx
mov ecx, eax
call fcn.1001a0a0
lea ecx, [ebp - 0x28]
push dword [eax]
lea eax, [ebp - 0x174]
push eax
call fcn.1001a390
push 0
push 0
lea ecx, [ebp - 0x28]
call fcn.1001a0e0
mov esi, eax
cmp esi, 0xffffffff
jne 0x100673c0
lea ecx, [ebp - 0x28]
call fcn.10019da0
push eax
lea ecx, [ebp - 0x15c]
call fcn.10032cf0
mov ecx, dword [ebp - 0x15c]
call fcn.10032cb0
lea ecx, [ebp - 0x158]
mov dword [ebp - 0x158], eax
call fcn.10027a80
mov dword [ebp - 0x154], eax
mov ecx, 0x1060c1a8
lea eax, [ebp - 0x154]
push eax
call fcn.10068970
push 0x1003e7e0
mov ecx, edi
push dword [eax]
call fcn.100741b0
lea ecx, [ebp - 0x28]
call fcn.10019dd0
mov ecx, 0x1060c068
call fcn.10027a80
mov edi, eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0x45
call fcn.10019ef0
push 0x12
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x164], 0x4000
call fcn.1001a120
lea edx, [ebp - 0x28]
mov byte [ebp - 0x150], 0
lea ecx, [ebp - 0x178]
call fcn.1001a8b0
push dword [ebp - 0x150]
mov edx, 0x1036f450
lea ecx, [ebp - 0x170]
push dword [eax]
push 0x1036f470
call fcn.1001a8c0
add esp, 0xc
lea ecx, [ebp - 0x28]
push 0
push 0
call fcn.1001a0e0
mov esi, eax
cmp esi, 0xffffffff
je 0x10067518
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp - 0x28]
call fcn.10019db0
push esi
lea ecx, [ebp - 0x14c]
push ecx
mov ecx, eax
call fcn.1001a0a0
lea ecx, [ebp - 0x28]
push dword [eax]
lea eax, [ebp - 0x174]
push eax
call fcn.1001a390
push 0
push 0
lea ecx, [ebp - 0x28]
call fcn.1001a0e0
mov esi, eax
cmp esi, 0xffffffff
jne 0x100674d6
lea ecx, [ebp - 0x28]
call fcn.10019da0
push eax
lea ecx, [ebp - 0x15c]
call fcn.10032cf0
mov ecx, dword [ebp - 0x15c]
call fcn.10032cb0
lea ecx, [ebp - 0x158]
mov dword [ebp - 0x158], eax
call fcn.10027a80
mov dword [ebp - 0x154], eax
mov ecx, 0x1060c1a8
lea eax, [ebp - 0x154]
push eax
call fcn.10068970
push 0x10053a40
mov ecx, edi
push dword [eax]
call fcn.100741b0
lea ecx, [ebp - 0x28]
call fcn.10019dd0
mov ecx, 0x1060bf3c
call fcn.10027a80
mov edi, eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0x46
call fcn.10019ef0
push 0x20
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x164], 0x8000
call fcn.1001a120
lea edx, [ebp - 0x28]
mov byte [ebp - 0x150], 0
lea ecx, [ebp - 0x178]
call fcn.1001a8b0
push dword [ebp - 0x150]
mov edx, 0x1036fa04
lea ecx, [ebp - 0x170]
push dword [eax]
push 0x1036fa40
call fcn.1001a8c0
add esp, 0xc
lea ecx, [ebp - 0x28]
push 0
push 0
call fcn.1001a0e0
mov esi, eax
cmp esi, 0xffffffff
je 0x10067632
nop dword [eax]
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp - 0x28]
call fcn.10019db0
push esi
lea ecx, [ebp - 0x14c]
push ecx
mov ecx, eax
call fcn.1001a0a0
lea ecx, [ebp - 0x28]
push dword [eax]
lea eax, [ebp - 0x174]
push eax
call fcn.1001a390
push 0
push 0
lea ecx, [ebp - 0x28]
call fcn.1001a0e0
mov esi, eax
cmp esi, 0xffffffff
jne 0x100675f0
lea ecx, [ebp - 0x28]
call fcn.10019da0
push eax
lea ecx, [ebp - 0x15c]
call fcn.10032cf0
mov ecx, dword [ebp - 0x15c]
call fcn.10032cb0
lea ecx, [ebp - 0x158]
mov dword [ebp - 0x158], eax
call fcn.10027a80
mov dword [ebp - 0x154], eax
mov ecx, 0x1060c1a8
lea eax, [ebp - 0x154]
push eax
call fcn.10068970
push 0x10054090
mov ecx, edi
push dword [eax]
call fcn.100741b0
lea ecx, [ebp - 0x28]
call fcn.10019dd0
mov ecx, 0x1060bf3c
call fcn.10027a80
mov edi, eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0x47
call fcn.10019ef0
push 0x1f
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x164], 0x10000
call fcn.1001a120
lea edx, [ebp - 0x28]
mov byte [ebp - 0x150], 0
lea ecx, [ebp - 0x178]
call fcn.1001a8b0
push dword [ebp - 0x150]
mov edx, 0x1036f668
lea ecx, [ebp - 0x170]
push dword [eax]
push 0x1036f6a2
call fcn.1001a8c0
add esp, 0xc
lea ecx, [ebp - 0x28]
push 0
push 0
call fcn.1001a0e0
mov esi, eax
cmp esi, 0xffffffff
je 0x10067748
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp - 0x28]
call fcn.10019db0
push esi
lea ecx, [ebp - 0x14c]
push ecx
mov ecx, eax
call fcn.1001a0a0
lea ecx, [ebp - 0x28]
push dword [eax]
lea eax, [ebp - 0x174]
push eax
call fcn.1001a390
push 0
push 0
lea ecx, [ebp - 0x28]
call fcn.1001a0e0
mov esi, eax
cmp esi, 0xffffffff
jne 0x10067706
lea ecx, [ebp - 0x28]
call fcn.10019da0
push eax
lea ecx, [ebp - 0x15c]
call fcn.10032cf0
mov ecx, dword [ebp - 0x15c]
call fcn.10032cb0
lea ecx, [ebp - 0x158]
mov dword [ebp - 0x158], eax
call fcn.10027a80
mov dword [ebp - 0x154], eax
mov ecx, 0x1060c1a8
lea eax, [ebp - 0x154]
push eax
call fcn.10068970
push 0x10054110
mov ecx, edi
push dword [eax]
call fcn.100741b0
lea ecx, [ebp - 0x28]
call fcn.10019dd0
mov ecx, 0x1060fee4
call fcn.10027a80
mov edi, eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0x48
call fcn.10019ef0
push 0x1c
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x164], 0x20000
call fcn.1001a120
lea edx, [ebp - 0x28]
mov byte [ebp - 0x150], 0
lea ecx, [ebp - 0x178]
call fcn.1001a8b0
push dword [ebp - 0x150]
mov edx, 0x1036f4bc
lea ecx, [ebp - 0x170]
push dword [eax]
push 0x1036f4f0
call fcn.1001a8c0
add esp, 0xc
lea ecx, [ebp - 0x28]
push 0
push 0
call fcn.1001a0e0
mov esi, eax
cmp esi, 0xffffffff
je 0x10067862
nop dword [eax]
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp - 0x28]
call fcn.10019db0
push esi
lea ecx, [ebp - 0x14c]
push ecx
mov ecx, eax
call fcn.1001a0a0
lea ecx, [ebp - 0x28]
push dword [eax]
lea eax, [ebp - 0x174]
push eax
call fcn.1001a390
push 0
push 0
lea ecx, [ebp - 0x28]
call fcn.1001a0e0
mov esi, eax
cmp esi, 0xffffffff
jne 0x10067820
lea ecx, [ebp - 0x28]
call fcn.10019da0
push eax
lea ecx, [ebp - 0x15c]
call fcn.10032cf0
mov ecx, dword [ebp - 0x15c]
call fcn.10032cb0
lea ecx, [ebp - 0x158]
mov dword [ebp - 0x158], eax
call fcn.10027a80
mov dword [ebp - 0x154], eax
mov ecx, 0x1060c1a8
lea eax, [ebp - 0x154]
push eax
call fcn.10068970
push 0x10036d40
mov ecx, edi
push dword [eax]
call fcn.100741b0
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0xffffffff
call fcn.10019dd0
mov ecx, 0x1060c1bc
call fcn.10027a80
push 0x10054440
push 0xb
mov ecx, eax
call fcn.100741b0
mov eax, dword [0x1060b5e0]
mov ecx, 0x1060b564
push 0x1003e3d0
push dword [eax + 0x7fa4]
call fcn.10074160
push 0x1003e330
push dword [ebp - 0x1c8]
mov ecx, 0x1060b534
call fcn.10074160
push 0x1003e320
push dword [ebp - 0x1c4]
mov ecx, 0x1060b5b0
call fcn.10074160
push method.std::codecvt_utf8_wchar_t__1114111__0_.virtual_12
push dword [ebp - 0x1c0]
mov ecx, 0x1060b600
call fcn.10074160
push 0x1003e230
push dword [ebp - 0x1bc]
mov ecx, 0x1060b54c
call fcn.10074160
push 0x100539b0
push dword [ebp - 0x1cc]
mov ecx, 0x1060b5a4
call fcn.10074160
push 0x100397c0
push dword [ebp - 0x19c]
mov ecx, 0x1060b5bc
call fcn.10074160
push 0x10051070
push dword [ebp - 0x1a0]
mov ecx, 0x1060b594
call fcn.10074160
push 0x100521f0
push dword [ebp - 0x1a4]
mov ecx, 0x1060b5d4
call fcn.10074160
push 0x10054c10
push dword [ebp - 0x1a8]
mov ecx, 0x1060b510
call fcn.10074160
push 0x10054c10
push dword [ebp - 0x1ac]
mov ecx, 0x1060b51c
call fcn.10074160
push 0x10054c10
push dword [ebp - 0x1b0]
mov ecx, 0x1060b528
call fcn.10074160
push 0x10054c10
push dword [ebp - 0x1b4]
mov ecx, 0x1060b57c
call fcn.10074160
push 0x10054380
push dword [ebp - 0x1b8]
mov ecx, 0x1060b5f4
call fcn.10074160
push 0x10051060
push dword [ebp - 0x180]
mov ecx, 0x1060b540
call fcn.10074160
push 0x10054c20
push dword [ebp - 0x160]
mov ecx, 0x1060b588
call fcn.10074160
push 0x100392f0
push dword [ebp - 0x16c]
mov ecx, 0x1060b60c
call fcn.10074160
mov eax, dword [0x1060b5e0]
mov ecx, dword [ebp - 0x18c]
mov dword [eax + 0x7f8c], ecx
mov ecx, dword [0x104c14e0]
mov eax, dword fs:[0x2c]
mov esi, dword [eax + ecx*4]
mov ecx, dword [0x1061166c]
cmp ecx, dword [esi + 4]
jg 0x10067c59
mov eax, dword [0x10611578]
mov eax, dword [eax]
mov dword [0x1060b25c], eax
cmp ecx, dword [esi + 4]
jg 0x10067ca1
mov eax, dword [0x10611578]
mov dword [eax], 0x10041300
mov ecx, dword [0x1061166c]
cmp ecx, dword [esi + 4]
jg 0x10067ce1
mov eax, dword [0x10611574]
mov eax, dword [eax]
mov dword [0x1060b260], eax
cmp ecx, dword [esi + 4]
jg 0x10067d29
mov eax, dword [0x10611574]
mov dword [eax], 0x10042240
mov eax, dword [0x1060b5e0]
mov eax, dword [eax + 0x68]
test eax, eax
je 0x10067af5
push 0x100422d0
push 0xfffffffffffffffc
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov ecx, dword [0x1060b5e0]
mov dword [ecx + 0x6c], eax
lea eax, [ebp - 0x88]
mov dword [ebp - 0x198], 0
push eax
lea ecx, [ebp - 0x182]
mov byte [ebp - 0x182], 0
call fcn.10068800
mov ecx, eax
mov dword [ebp - 4], 0x49
call fcn.10019da0
mov esi, eax
mov byte [ebp - 0x181], 0
lea eax, [ebp - 0xa0]
push eax
lea ecx, [ebp - 0x181]
call fcn.10068780
mov ecx, eax
mov byte [ebp - 4], 0x4a
call fcn.10019da0
lea ecx, [ebp - 0x198]
push ecx
push esi
push eax
mov ecx, 0x1060b4f0
call fcn.10171b70
lea ecx, [ebp - 0xa0]
call fcn.10019dd0
lea ecx, [ebp - 0x88]
mov dword [ebp - 4], 0xffffffff
call fcn.10019dd0
cmp dword [ebp - 0x198], 0
je 0x10067bba
push 8
call fcn.102bb92a
add esp, 4
mov dword [ebp - 0x178], eax
push 0x101fc9d0
mov dword [ebp - 4], 0x4b
mov ecx, eax
push dword [ebp - 0x198]
call fcn.10054240
mov dword [ebp - 4], 0xffffffff
mov dword [0x106110b8], eax
mov esi, dword [0x1060b5e0]
sub esp, 0x18
mov eax, esp
mov dword [ebp - 0x178], esp
mov ecx, 0x1036ecd8
push eax
call fcn.1006ad40
sub esp, 0x18
mov dword [ebp - 4], 0x4c
mov ecx, 0x1036ee48
push esp
call fcn.10019bd0
lea ecx, [esi + 0x7c]
mov dword [ebp - 4], 0xffffffff
call fcn.1006c8a0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edi, eax
lea eax, [ebp - 0x194]
mov dword [ebp - 0x194], 0
push eax
push 0x40
push 4
push edi
call esi
lea eax, [ebp - 0x194]
mov dword [edi], 0x11
push eax
push dword [ebp - 0x194]
push 4
push edi
call esi
call fcn.1004e3b0
xor ecx, ecx
call fcn.1015f260
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.102bb91c
mov esp, ebp
pop ebp
ret
push 0x1061166c
call fcn.102bba07
mov ecx, dword [0x1061166c]
add esp, 4
cmp ecx, 0xffffffff
jne 0x10067a7a
xorps xmm0, xmm0
push 0x103305d0
movups xmmword [0x10611574], xmm0
call fcn.102bbda4
push 0x1061166c
call fcn.102bb9b6
mov ecx, dword [0x1061166c]
add esp, 8
jmp 0x10067a7a
push 0x1061166c
call fcn.102bba07
add esp, 4
cmp dword [0x1061166c], 0xffffffff
jne 0x10067a92
xorps xmm0, xmm0
push 0x103305d0
movups xmmword [0x10611574], xmm0
call fcn.102bbda4
push 0x1061166c
call fcn.102bb9b6
add esp, 8
jmp 0x10067a92
push 0x1061166c
call fcn.102bba07
mov ecx, dword [0x1061166c]
add esp, 4
cmp ecx, 0xffffffff
jne 0x10067aaf
xorps xmm0, xmm0
push 0x103305d0
movups xmmword [0x10611574], xmm0
call fcn.102bbda4
push 0x1061166c
call fcn.102bb9b6
mov ecx, dword [0x1061166c]
add esp, 8
jmp 0x10067aaf
push 0x1061166c
call fcn.102bba07
add esp, 4
cmp dword [0x1061166c], 0xffffffff
jne 0x10067ac7
xorps xmm0, xmm0
push 0x103305d0
movups xmmword [0x10611574], xmm0
call fcn.102bbda4
push 0x1061166c
call fcn.102bb9b6
add esp, 8
jmp 0x10067ac7