Function at 0x100cdb80
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1018a7a9
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x101cd7b4]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x18], esi
mov dword [esi], 0x1019ba38
mov dword [esi + 4], 0x1019b978
mov dword [esi + 8], 0x1019b8c8
mov dword [esi + 0xc], 0x1019b8c0
mov dword [esi + 0x10], 0x1019b8bc
mov dword [esi + 0x14], 0x1019b898
mov dword [esi + 0x18], 0x1019b894
mov edi, dword [esi + 0x5a18]
xor ebx, ebx
cmp edi, ebx
mov dword [esp + 0x30], 0x5b
je 0x100cdc07
mov ecx, edi
call fcn.100daea0
push edi
call fcn.10158c57
add esp, 4
mov ecx, dword [esi + 0x4ca0]
cmp ecx, ebx
je 0x100cdc19
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
lea ecx, [esi + 0x5a00]
call fcn.100c1da0
mov ebp, dword [0x1019906c]
lea eax, [esi + 0x59dc]
push eax
mov dword [esi + 0x59d8], 0x101995f8
call ebp
lea edi, [esi + 0x59cc]
mov dword [esi + 0x59d8], 0x101995f4
mov eax, dword [edi + 4]
mov ecx, dword [eax]
push eax
push edi
push ecx
push edi
lea ecx, [esp + 0x2c]
push ecx
mov ecx, edi
mov byte [esp + 0x44], 0x58
call fcn.10009910
mov eax, dword [edi + 4]
push eax
call fcn.10158c57
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov eax, dword [esi + 0x59ac]
mov ecx, dword [eax]
add esp, 4
lea edi, [esi + 0x59a8]
push eax
push edi
push ecx
push edi
lea edx, [esp + 0x2c]
push edx
mov ecx, edi
mov byte [esp + 0x44], 0x57
call fcn.10009910
mov eax, dword [edi + 4]
push eax
call fcn.10158c57
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov eax, dword [esi + 0x5938]
mov ecx, dword [eax]
add esp, 4
lea edi, [esi + 0x5934]
push eax
push edi
push ecx
push edi
lea eax, [esp + 0x2c]
push eax
mov ecx, edi
mov byte [esp + 0x44], 0x56
call fcn.10054370
mov eax, dword [edi + 4]
push eax
call fcn.10158c57
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov eax, dword [esi + 0x592c]
mov ecx, dword [eax]
add esp, 4
lea edi, [esi + 0x5928]
push eax
push edi
push ecx
push edi
lea ecx, [esp + 0x2c]
push ecx
mov ecx, edi
mov byte [esp + 0x44], 0x55
call fcn.10009910
mov eax, dword [edi + 4]
push eax
call fcn.10158c57
add esp, 4
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov byte [esp + 0x30], 0x54
mov eax, dword [esi + 0x5920]
mov ecx, dword [eax]
lea edi, [esi + 0x591c]
push eax
push edi
push ecx
push edi
lea edx, [esp + 0x2c]
push edx
mov ecx, edi
call fcn.10009910
mov eax, dword [edi + 4]
push eax
call fcn.10158c57
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov eax, dword [esi + 0x5914]
mov ecx, dword [eax]
add esp, 4
lea edi, [esi + 0x5910]
push eax
push edi
push ecx
push edi
lea eax, [esp + 0x2c]
push eax
mov ecx, edi
mov byte [esp + 0x44], 0x53
call fcn.10009910
mov eax, dword [edi + 4]
push eax
call fcn.10158c57
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov eax, dword [esi + 0x5908]
mov ecx, dword [eax]
add esp, 4
lea edi, [esi + 0x5904]
push eax
push edi
push ecx
push edi
lea ecx, [esp + 0x2c]
push ecx
mov ecx, edi
mov byte [esp + 0x44], 0x52
call fcn.1005d380
mov eax, dword [edi + 4]
push eax
call fcn.10158c57
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov eax, dword [esi + 0x58fc]
mov ecx, dword [eax]
add esp, 4
lea edi, [esi + 0x58f8]
push eax
push edi
push ecx
push edi
lea edx, [esp + 0x2c]
push edx
mov ecx, edi
mov byte [esp + 0x44], 0x51
call fcn.10009910
mov eax, dword [edi + 4]
push eax
call fcn.10158c57
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov eax, dword [esi + 0x58ec]
lea edi, [esi + 0x58e8]
add esp, 4
cmp eax, ebx
je 0x100cde18
mov edx, dword [esp + 0x18]
mov ecx, dword [edi + 8]
push edx
push edi
push ecx
push eax
call fcn.100aec40
mov eax, dword [edi + 4]
push eax
call fcn.10158c57
add esp, 0x14
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov eax, dword [esi + 0x58e0]
mov ecx, dword [eax]
lea edi, [esi + 0x58dc]
push eax
push edi
push ecx
push edi
lea eax, [esp + 0x2c]
push eax
mov ecx, edi
mov byte [esp + 0x44], 0x4f
call fcn.100233a0
mov eax, dword [edi + 4]
push eax
call fcn.10158c57
add esp, 4
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
cmp dword [esi + 0x58d8], 0x10
jb 0x100cde6e
mov eax, dword [esi + 0x58c4]
push eax
call fcn.10158c57
add esp, 4
mov edi, 0xf
mov dword [esi + 0x58d8], edi
mov dword [esi + 0x58d4], ebx
mov byte [esi + 0x58c4], bl
cmp dword [esi + 0x58bc], 0x10
jb 0x100cde9d
mov eax, dword [esi + 0x58a8]
push eax
call fcn.10158c57
add esp, 4
mov dword [esi + 0x58bc], edi
mov dword [esi + 0x58b8], ebx
mov byte [esi + 0x58a8], bl
cmp dword [esi + 0x58a0], 0x10
jb 0x100cdec7
mov eax, dword [esi + 0x588c]
push eax
call fcn.10158c57
add esp, 4
mov dword [esi + 0x58a0], edi
mov dword [esi + 0x589c], ebx
mov byte [esi + 0x588c], bl
cmp dword [esi + 0x5884], 0x10
jb 0x100cdef1
mov eax, dword [esi + 0x5870]
push eax
call fcn.10158c57
add esp, 4
mov dword [esi + 0x5884], edi
mov dword [esi + 0x5880], ebx
lea edi, [esi + 0x5860]
mov byte [esi + 0x5870], bl
mov eax, dword [edi + 4]
mov ecx, dword [eax]
push eax
push edi
push ecx
push edi
lea ecx, [esp + 0x2c]
push ecx
mov ecx, edi
mov byte [esp + 0x44], 0x4a
call fcn.10046390
mov eax, dword [edi + 4]
push eax
call fcn.10158c57
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov eax, dword [esi + 0x584c]
mov ecx, dword [eax]
add esp, 4
lea edi, [esi + 0x5848]
push eax
push edi
push ecx
push edi
lea edx, [esp + 0x2c]
push edx
mov ecx, edi
mov byte [esp + 0x44], 0x49
call fcn.1002bcc0
mov eax, dword [edi + 4]
push eax
call fcn.10158c57
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov eax, dword [esi + 0x5830]
lea edi, [esi + 0x582c]
add esp, 4
cmp eax, ebx
je 0x100cdf96
mov edx, dword [esp + 0x18]
mov ecx, dword [edi + 8]
push edx
push edi
push ecx
push eax
call fcn.1002ae30
mov eax, dword [edi + 4]
push eax
call fcn.10158c57
add esp, 0x14
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov eax, dword [esi + 0x5820]
cmp eax, ebx
lea edi, [esi + 0x581c]
je 0x100cdfcb
mov edx, dword [esp + 0x18]
mov ecx, dword [edi + 8]
push edx
push edi
push ecx
push eax
call fcn.1002ae30
mov eax, dword [edi + 4]
push eax
call fcn.10158c57
add esp, 0x14
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov eax, dword [esi + 0x5810]
cmp eax, ebx
lea edi, [esi + 0x580c]
je 0x100ce000
mov edx, dword [esp + 0x18]
mov ecx, dword [edi + 8]
push edx
push edi
push ecx
push eax
call fcn.1002ae30
mov eax, dword [edi + 4]
push eax
call fcn.10158c57
add esp, 0x14
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov eax, dword [esi + 0x57f8]
mov ecx, dword [eax]
lea edi, [esi + 0x57f4]
push eax
push edi
push ecx
push edi
lea eax, [esp + 0x2c]
push eax
mov ecx, edi
mov byte [esp + 0x44], 0x45
call fcn.10046390
mov eax, dword [edi + 4]
push eax
call fcn.10158c57
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov eax, dword [esi + 0x57d8]
mov ecx, dword [eax]
add esp, 4
lea edi, [esi + 0x57d4]
push eax
push edi
push ecx
push edi
lea ecx, [esp + 0x2c]
push ecx
mov ecx, edi
mov byte [esp + 0x44], 0x44
call fcn.100bf450
mov eax, dword [edi + 4]
push eax
call fcn.10158c57
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
lea edi, [esi + 0x5760]
add esp, 4
lea edx, [edi + 0x4c]
push edx
mov dword [edi + 0x48], 0x101995f8
call ebp
mov ecx, edi
mov dword [edi + 0x48], 0x101995f4
call fcn.10035c20
lea edi, [esi + 0x56f8]
lea eax, [edi + 0x4c]
push eax
mov dword [edi + 0x48], 0x101995f8
call ebp
mov ecx, edi
mov dword [edi + 0x48], 0x101995f4
call fcn.10035c20
lea ecx, [esi + 0x56bc]
mov byte [esp + 0x30], 0x41
call fcn.1013dfcf
lea ecx, [esi + 0x5578]
mov byte [esp + 0x30], 0x40
call fcn.100de4a0
lea ecx, [esi + 0x5550]
mov byte [esp + 0x30], 0x3f
call fcn.100fbf89
mov eax, dword [esi + 0x5540]
mov ecx, dword [eax]
lea edi, [esi + 0x553c]
push eax
push edi
push ecx
push edi
lea ecx, [esp + 0x2c]
push ecx
mov ecx, edi
mov byte [esp + 0x44], 0x3e
call fcn.100da980
mov eax, dword [edi + 4]
push eax
call fcn.10158c57
add esp, 4
mov dword [edi + 4], ebx
lea ecx, [esi + 0x5508]
mov dword [edi + 8], ebx
mov byte [esp + 0x30], 0x3d
call fcn.10041e00
mov eax, dword [esi + 0x54f8]
mov ecx, dword [eax]
lea edi, [esi + 0x54f4]
push eax
push edi
push ecx
push edi
lea edx, [esp + 0x2c]
push edx
mov ecx, edi
mov byte [esp + 0x44], 0x3c
call fcn.100b45d0
mov eax, dword [edi + 4]
push eax
call fcn.10158c57
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov eax, dword [esi + 0x54ec]
mov ecx, dword [eax]
add esp, 4
lea edi, [esi + 0x54e8]
push eax
push edi
push ecx
push edi
lea eax, [esp + 0x2c]
push eax
mov ecx, edi
mov byte [esp + 0x44], 0x3b
call fcn.100ca750
mov eax, dword [edi + 4]
push eax
call fcn.10158c57
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov eax, dword [esi + 0x54e0]
mov ecx, dword [eax]
add esp, 4
lea edi, [esi + 0x54dc]
push eax
push edi
push ecx
push edi
lea ecx, [esp + 0x2c]
push ecx
mov ecx, edi
mov byte [esp + 0x44], 0x3a
call fcn.100c3de0
mov eax, dword [edi + 4]
push eax
call fcn.10158c57
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
add esp, 4
lea edx, [esi + 0x54c4]
mov edi, 0x101995f8
push edx
mov dword [esi + 0x54c0], edi
call ebp
mov dword [esi + 0x54c0], 0x101995f4
cmp dword [esi + 0x54b4], 0x10
jb 0x100ce1ff
mov eax, dword [esi + 0x54a0]
push eax
call fcn.10158c57
add esp, 4
mov dword [esi + 0x54b4], 0xf
mov dword [esi + 0x54b0], ebx
mov byte [esi + 0x54a0], bl
mov eax, dword [esi + 0x5474]
cmp eax, ebx
je 0x100ce228
push eax
call fcn.10158c57
add esp, 4
lea eax, [esi + 0x5458]
mov dword [esi + 0x5474], ebx
mov dword [esi + 0x5478], ebx
mov dword [esi + 0x547c], ebx
push eax
mov dword [esi + 0x5454], edi
call ebp
mov dword [esi + 0x5454], 0x101995f4
mov eax, dword [esi + 0x5448]
cmp eax, ebx
je 0x100ce266
push eax
call fcn.10158c57
add esp, 4
lea ecx, [esi + 0x542c]
mov dword [esi + 0x5448], ebx
mov dword [esi + 0x544c], ebx
mov dword [esi + 0x5450], ebx
push ecx
mov dword [esi + 0x5428], edi
call ebp
lea ecx, [esi + 0x53e8]
mov dword [esi + 0x5428], 0x101995f4
mov byte [esp + 0x30], 0x33
call fcn.100d9580
cmp dword [esi + 0x53d8], 0x10
jb 0x100ce2b9
mov eax, dword [esi + 0x53c4]
push eax
call fcn.10158c57
add esp, 4
mov dword [esi + 0x53d8], 0xf
mov dword [esi + 0x53d4], ebx
mov byte [esi + 0x53c4], bl
mov eax, dword [esi + 0x53b4]
cmp eax, ebx
je 0x100ce2e2
push eax
call fcn.10158c57
add esp, 4
lea ecx, [esi + 0x5380]
mov dword [esi + 0x53b4], ebx
mov dword [esi + 0x53b8], ebx
mov dword [esi + 0x53bc], ebx
mov byte [esp + 0x30], 0x30
call fcn.100a3960
mov eax, dword [esi + 0x5374]
cmp eax, ebx
je 0x100ce317
push eax
call fcn.10158c57
add esp, 4
lea ecx, [esi + 0x5344]
mov dword [esi + 0x5374], ebx
mov dword [esi + 0x5378], ebx
mov dword [esi + 0x537c], ebx
mov byte [esp + 0x30], 0x2e
call fcn.100b4b90
lea edx, [esi + 0x532c]
push edx
mov dword [esi + 0x5328], edi
call ebp
lea eax, [esi + 0x530c]
mov dword [esi + 0x5328], 0x101995f4
push eax
mov dword [esi + 0x5308], edi
call ebp
lea edi, [esi + 0x52fc]
mov dword [esi + 0x5308], 0x101995f4
mov eax, dword [edi + 4]
mov ecx, dword [eax]
push eax
push edi
push ecx
push edi
lea ecx, [esp + 0x2c]
push ecx
mov ecx, edi
mov byte [esp + 0x44], 0x2b
call fcn.100b4500
mov eax, dword [edi + 4]
push eax
call fcn.10158c57
add esp, 4
lea ecx, [esi + 0x52f8]
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov byte [esp + 0x30], 0x2a
call fcn.100dd410
lea ecx, [esi + 0x5260]
mov byte [esp + 0x30], 0x29
call fcn.1002c670
lea ecx, [esi + 0x5234]
mov byte [esp + 0x30], 0x28
call fcn.100a3660
lea edx, [esi + 0x5214]
mov edi, 0x101995f8
push edx
mov dword [esi + 0x5210], edi
call ebp
lea ecx, [esi + 0x51ec]
mov dword [esi + 0x5210], 0x101995f4
call fcn.100b95f0
lea ecx, [esi + 0x5198]
call fcn.100bcc30
lea eax, [esi + 0x5174]
push eax
mov dword [esi + 0x5170], edi
call ebp
mov dword [esi + 0x5170], 0x101995f4
mov eax, dword [esi + 0x5150]
cmp eax, ebx
je 0x100ce42d
push eax
call fcn.10158c57
add esp, 4
lea ecx, [esi + 0x50f8]
mov dword [esi + 0x5150], ebx
mov dword [esi + 0x5154], ebx
mov dword [esi + 0x5158], ebx
mov byte [esp + 0x30], 0x24
call fcn.100cdb20
lea ecx, [esi + 0x50d4]
push ecx
mov dword [esi + 0x50d0], edi
call ebp
lea ecx, [esi + 0x50ac]
mov dword [esi + 0x50d0], 0x101995f4
call fcn.100b94d0
lea ecx, [esi + 0x5058]
call fcn.100cab40
lea ecx, [esi + 0x5010]
call fcn.100c1510
lea edx, [esi + 0x4ff4]
push edx
mov dword [esi + 0x4ff0], edi
call ebp
lea ecx, [esi + 0x4fcc]
mov dword [esi + 0x4ff0], 0x101995f4
call fcn.100bbac0
lea eax, [esi + 0x4fac]
push eax
mov dword [esi + 0x4fa8], edi
call ebp
lea ecx, [esi + 0x4f84]
mov dword [esi + 0x4fa8], 0x101995f4
call fcn.100c5a10
lea ecx, [esi + 0x4f64]
push ecx
mov dword [esi + 0x4f60], edi
call ebp
lea edi, [esi + 0x4f54]
mov dword [esi + 0x4f60], 0x101995f4
mov eax, dword [edi + 4]
mov ecx, dword [eax]
push eax
push edi
push ecx
push edi
lea edx, [esp + 0x2c]
push edx
mov ecx, edi
mov byte [esp + 0x44], 0x1d
call fcn.100b99a0
mov eax, dword [edi + 4]
push eax
call fcn.10158c57
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov edi, 0x10
add esp, 4
cmp dword [esi + 0x4f20], edi
jb 0x100ce538
mov eax, dword [esi + 0x4f0c]
push eax
call fcn.10158c57
add esp, 4
mov dword [esi + 0x4f20], 0xf
mov dword [esi + 0x4f1c], ebx
mov byte [esi + 0x4f0c], bl
cmp dword [esi + 0x4efc], edi
jb 0x100ce565
mov eax, dword [esi + 0x4ee8]
push eax
call fcn.10158c57
add esp, 4
mov dword [esi + 0x4efc], 0xf
mov dword [esi + 0x4ef8], ebx
mov byte [esi + 0x4ee8], bl
cmp dword [esi + 0x4ed8], edi
jb 0x100ce592
mov eax, dword [esi + 0x4ec4]
push eax
call fcn.10158c57
add esp, 4
mov dword [esi + 0x4ed8], 0xf
mov dword [esi + 0x4ed4], ebx
mov byte [esi + 0x4ec4], bl
cmp dword [esi + 0x4ebc], edi
jb 0x100ce5bf
mov eax, dword [esi + 0x4ea8]
push eax
call fcn.10158c57
add esp, 4
mov dword [esi + 0x4ebc], 0xf
mov dword [esi + 0x4eb8], ebx
mov byte [esi + 0x4ea8], bl
cmp dword [esi + 0x4ea0], edi
jb 0x100ce5ec
mov eax, dword [esi + 0x4e8c]
push eax
call fcn.10158c57
add esp, 4
mov dword [esi + 0x4ea0], 0xf
mov dword [esi + 0x4e9c], ebx
mov byte [esi + 0x4e8c], bl
cmp dword [esi + 0x4e7c], edi
jb 0x100ce619
mov eax, dword [esi + 0x4e68]
push eax
call fcn.10158c57
add esp, 4
mov dword [esi + 0x4e7c], 0xf
mov dword [esi + 0x4e78], ebx
mov byte [esi + 0x4e68], bl
cmp dword [esi + 0x4e58], edi
jb 0x100ce646
mov eax, dword [esi + 0x4e44]
push eax
call fcn.10158c57
add esp, 4
mov dword [esi + 0x4e58], 0xf
mov dword [esi + 0x4e54], ebx
mov byte [esi + 0x4e44], bl
cmp dword [esi + 0x4e34], edi
jb 0x100ce673
mov eax, dword [esi + 0x4e20]
push eax
call fcn.10158c57
add esp, 4
mov dword [esi + 0x4e34], 0xf
mov dword [esi + 0x4e30], ebx
lea ecx, [esi + 0x4e04]
mov byte [esi + 0x4e20], bl
call fcn.1002c030
cmp dword [esi + 0x4df8], edi
jb 0x100ce6ab
mov eax, dword [esi + 0x4de4]
push eax
call fcn.10158c57
add esp, 4
mov dword [esi + 0x4df8], 0xf
mov dword [esi + 0x4df4], ebx
mov byte [esi + 0x4de4], bl
cmp dword [esi + 0x4dd4], edi
jb 0x100ce6d8
mov eax, dword [esi + 0x4dc0]
push eax
call fcn.10158c57
add esp, 4
mov dword [esi + 0x4dd4], 0xf
mov dword [esi + 0x4dd0], ebx
mov byte [esi + 0x4dc0], bl
cmp dword [esi + 0x4db0], edi
jb 0x100ce705
mov eax, dword [esi + 0x4d9c]
push eax
call fcn.10158c57
add esp, 4
mov dword [esi + 0x4db0], 0xf
mov dword [esi + 0x4dac], ebx
lea ecx, [esi + 0x4d6c]
mov byte [esi + 0x4d9c], bl
call fcn.1002e4d0
mov eax, dword [esi + 0x4d68]
push eax
mov dword [esi + 0x4d64], 0x1019a188
call dword [0x10199080]
mov edi, 0x101995f4
lea ecx, [esi + 0x4d38]
mov dword [esi + 0x4d64], edi
mov byte [esp + 0x30], 0xe
call fcn.100b4b90
lea ecx, [esi + 0x4cf0]
call fcn.100066c0
lea ecx, [esi + 0x4ca4]
call fcn.100b9280
lea ecx, [esi + 0x4c68]
mov byte [esp + 0x30], 0xb
call fcn.100d5cf0
lea ecx, [esi + 0x4c38]
mov byte [esp + 0x30], 0xa
call fcn.100dc690
lea ecx, [esi + 0x4bf0]
mov byte [esp + 0x30], 9
call fcn.10056880
lea ecx, [esi + 0x4ba8]
mov byte [esp + 0x30], 8
call fcn.10056880
lea ecx, [esi + 0x4b60]
mov byte [esp + 0x30], 7
call fcn.10056880
lea ecx, [esi + 0x60]
mov byte [esp + 0x30], 6
call fcn.100c14d0
lea ecx, [esi + 0x48]
push ecx
mov dword [esi + 0x44], 0x101995f8
call ebp
mov dword [esi + 0x44], edi
lea ecx, [esi + 0x34]
mov dword [esi + 0x40], 0x1019b358
mov byte [esp + 0x30], 3
call fcn.10023f00
lea ecx, [esi + 0x28]
mov byte [esp + 0x30], 2
call fcn.10023f00
lea ecx, [esi + 0x1c]
mov byte [esp + 0x30], 1
call fcn.10023f00
lea ecx, [esi + 4]
mov byte [esp + 0x30], bl
call fcn.10028b70
mov dword [esi], 0x1019b2b8
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret