Function at 0x100854c1
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100924b0
push 0x100633c0
mov eax, dword fs:[0]
push eax
push ecx
push ecx
mov eax, 0x2011c
call fcn.10062090
mov eax, dword [0x1009a008]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, ecx
mov dword [ebp - 0x20090], esi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x200dc], eax
mov dword [ebp - 0x20078], 0x80004021
xor ebx, ebx
mov dword [ebp - 0x20094], ebx
mov dword [ebp - 0x200c4], ebx
mov dword [ebp - 0x200a8], ebx
mov dword [ebp - 0x200b0], ebx
mov dword [ebp - 0x2008c], ebx
mov dword [ebp - 0x2009c], ebx
mov dword [ebp - 0x200a0], ebx
mov dword [ebp - 0x20084], ebx
mov dword [ebp - 0x20080], ebx
mov dword [ebp - 0x20098], ebx
mov dword [ebp - 0x200ec], ebx
mov dword [ebp - 0x200e0], ebx
mov dword [ebp - 0x200d0], ebx
mov dword [ebp - 0x200c0], ebx
mov dword [ebp - 0x200b4], ebx
mov dword [ebp - 0x200e8], ebx
mov dword [ebp - 0x200d4], ebx
mov dword [ebp - 0x200bc], ebx
mov dword [ebp - 0x200f0], ebx
mov dword [ebp - 0x200d8], ebx
mov dword [ebp - 0x200e4], ebx
mov dword [ebp - 0x200cc], ebx
mov dword [ebp - 0x200a4], ebx
mov edi, 0x90000
mov dword [ebp - 0x200b8], edi
lea eax, [esi + 8]
push eax
lea ecx, [ebp - 0x200c8]
call fcn.10086bf0
lea ecx, [ebp - 0x200c8]
call fcn.10086c10
mov dword [ebp - 4], ebx
mov dword [ebp - 4], 1
mov ecx, esi
call fcn.1008544d
lea eax, [esi + 0x24]
mov dword [ebp - 0x200c8], eax
push 0x104
push eax
push 0xffffffffffffffff
push dword [ebp - 0x200dc]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x10085617
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x20078], 0x80004021
jmp 0x100862c8
cmp dword [ebp + 0xc], ebx
jne 0x100856b1
mov byte [esi + 0x22c], 1
push ebx
push 0x80
push 1
push ebx
push 1
push 0x40000000
push dword [ebp - 0x200dc]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
mov dword [esi + 0x244], edi
cmp edi, 0xffffffff
jne 0x1008566f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x10085664
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x20078], eax
jmp 0x100862c8
push 0x2c
push ebx
lea eax, [ebp - 0x20134]
push eax
call fcn.100620c0
add esp, 0xc
push ebx
lea eax, [ebp - 0x200e0]
push eax
push 0x2c
lea eax, [ebp - 0x20134]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10085650
mov eax, dword [ebp - 0x200e0]
sub eax, 0x2c
neg eax
sbb eax, eax
and eax, 0x800703e4
jmp 0x10085664
cmp dword [esi + 0x248], ebx
jne 0x100856ca
push 0x10024638
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [esi + 0x248], eax
mov eax, dword [esi + 0x248]
cmp eax, ebx
je 0x10085650
push 0x10024a68
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x10085650
add esi, 0x20
push esi
push ebx
call eax
mov dword [ebp - 0x20078], eax
cmp eax, ebx
jl 0x100862c8
mov eax, dword [esi]
mov ecx, dword [eax]
push dword [ebp - 0x200c8]
push eax
call dword [ecx + 0x14]
mov dword [ebp - 0x20078], eax
cmp eax, ebx
jl 0x100862c8
push 0x10024a50
mov eax, dword [ebp - 0x20090]
push dword [eax + 0x248]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x10085650
lea ecx, [ebp - 0x200b0]
push ecx
call eax
mov dword [ebp - 0x20078], eax
cmp eax, ebx
jl 0x100862c8
mov eax, dword [ebp - 0x200b0]
mov ecx, dword [eax]
lea edx, [ebp - 0x2008c]
push edx
push 0x100244f8
push eax
call dword [ecx]
mov dword [ebp - 0x20078], eax
cmp eax, ebx
jl 0x100862c8
mov eax, dword [ebp - 0x2008c]
mov ecx, dword [eax]
lea edx, [ebp - 0x200b8]
push edx
push eax
call dword [ecx + 0x24]
mov dword [ebp - 0x20078], eax
cmp eax, ebx
jl 0x100862c8
mov dword [ebp - 0x200b8], edi
mov eax, dword [ebp - 0x2008c]
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0x28]
mov dword [ebp - 0x20078], eax
cmp eax, ebx
jl 0x100862c8
mov eax, dword [ebp - 0x2008c]
mov ecx, dword [eax]
lea edx, [ebp - 0x200b8]
push edx
push eax
call dword [ecx + 0x24]
mov dword [ebp - 0x20078], eax
cmp eax, ebx
jl 0x100862c8
mov dword [ebp - 0x200b8], edi
mov eax, dword [ebp - 0x2008c]
mov ecx, dword [eax]
lea edx, [ebp - 0x2009c]
push edx
push edi
push eax
call dword [ecx + 0xc]
mov dword [ebp - 0x20078], eax
cmp eax, ebx
jl 0x100862c8
mov eax, dword [ebp - 0x2009c]
mov ecx, dword [eax]
lea edx, [ebp - 0x200a0]
push edx
push 0x100244b8
push eax
call dword [ecx + 0x3c]
mov dword [ebp - 0x20078], eax
cmp eax, ebx
jl 0x100862c8
mov eax, dword [ebp - 0x200a0]
mov ecx, dword [eax]
lea edx, [ebp - 0x200c4]
push edx
push 0x100244e8
push eax
call dword [ecx]
mov dword [ebp - 0x20078], eax
cmp eax, ebx
jl 0x100862c8
mov eax, dword [ebp - 0x2008c]
mov ecx, dword [eax]
lea edx, [ebp - 0x20080]
push edx
push 0x10024508
push eax
call dword [ecx]
mov dword [ebp - 0x20078], eax
cmp eax, ebx
jl 0x100862c8
mov eax, dword [ebp - 0x20080]
mov ecx, dword [eax]
lea edx, [ebp - 0x200d0]
push edx
push 0x100244b8
push eax
call dword [ecx + 0xc]
mov dword [ebp - 0x20078], eax
cmp eax, ebx
jl 0x100862c8
mov dword [ebp - 0x2007c], ebx
mov esi, 0x8000
mov eax, dword [ebp - 0x2007c]
cmp eax, dword [ebp - 0x200d0]
jae 0x10085908
push esi
push ebx
lea eax, [ebp - 0x1001c]
push eax
call fcn.100620c0
add esp, 0xc
mov dword [ebp - 0x200c0], 0x4000
mov eax, dword [ebp - 0x20080]
mov ecx, dword [eax]
lea edx, [ebp - 0x200c0]
push edx
lea edx, [ebp - 0x1001c]
push edx
push dword [ebp - 0x2007c]
push 0x100244b8
push eax
call dword [ecx + 0x18]
mov dword [ebp - 0x20078], eax
cmp eax, ebx
jl 0x100862c8
inc dword [ebp - 0x2007c]
jmp 0x100858a4
mov dword [ebp - 0x2007c], ebx
mov eax, dword [ebp - 0x200d0]
cmp dword [ebp - 0x2007c], eax
jae 0x10085c96
push esi
push ebx
lea eax, [ebp - 0x1001c]
push eax
call fcn.100620c0
add esp, 0xc
mov dword [ebp - 0x200c0], 0x4000
mov eax, dword [ebp - 0x20080]
mov ecx, dword [eax]
lea edx, [ebp - 0x200c0]
push edx
lea edx, [ebp - 0x1001c]
push edx
push dword [ebp - 0x2007c]
push 0x100244b8
push eax
call dword [ecx + 0x18]
mov dword [ebp - 0x20078], eax
cmp eax, ebx
jl 0x100862c8
push esi
push ebx
lea eax, [ebp - 0x2001c]
push eax
call fcn.100620c0
add esp, 0xc
lea eax, [ebp - 0x2001c]
cmp dword [ebp + 0xc], 1
jne 0x10085992
push 0x10024a10
jmp 0x10085997
push 0x100249e4
push eax
call fcn.1006420a
pop ecx
pop ecx
lea eax, [ebp - 0x2001c]
push eax
lea eax, [ebp - 0x1001c]
push eax
call fcn.10086c1e
pop ecx
pop ecx
test eax, eax
je 0x100859f7
lea eax, [ebp - 0x1001c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x100859c1
sub eax, edx
sar eax, 1
mov edi, eax
lea eax, [ebp - 0x2001c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x100859da
sub eax, edx
sar eax, 1
cmp edi, eax
jne 0x100859f7
mov dword [ebp - 0x20078], ebx
jmp 0x10085ca2
push esi
push ebx
lea eax, [ebp - 0x2001c]
push eax
call fcn.100620c0
add esp, 0xc
lea eax, [ebp - 0x2001c]
cmp dword [ebp + 0xc], 1
jne 0x10085a1b
push 0x100249a0
jmp 0x10085a20
push 0x1002496c
push eax
call fcn.1006420a
pop ecx
pop ecx
lea eax, [ebp - 0x2001c]
push eax
lea eax, [ebp - 0x1001c]
push eax
call fcn.10086c1e
pop ecx
pop ecx
test eax, eax
je 0x10085a79
lea eax, [ebp - 0x1001c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x10085a4a
sub eax, edx
sar eax, 1
mov edi, eax
lea eax, [ebp - 0x2001c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x10085a63
sub eax, edx
sar eax, 1
cmp edi, eax
je 0x100859ec
push esi
push ebx
lea eax, [ebp - 0x2001c]
push eax
call fcn.100620c0
add esp, 0xc
lea eax, [ebp - 0x2001c]
cmp dword [ebp + 0xc], 1
jne 0x10085a9d
push 0x10024928
jmp 0x10085aa2
push 0x100248f4
push eax
call fcn.1006420a
pop ecx
pop ecx
lea eax, [ebp - 0x2001c]
push eax
lea eax, [ebp - 0x1001c]
push eax
call fcn.10086c1e
pop ecx
pop ecx
test eax, eax
je 0x10085afb
lea eax, [ebp - 0x1001c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x10085acc
sub eax, edx
sar eax, 1
mov edi, eax
lea eax, [ebp - 0x2001c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x10085ae5
sub eax, edx
sar eax, 1
cmp edi, eax
je 0x100859ec
push esi
push ebx
lea eax, [ebp - 0x2001c]
push eax
call fcn.100620c0
add esp, 0xc
lea eax, [ebp - 0x2001c]
cmp dword [ebp + 0xc], 1
jne 0x10085b1f
push 0x100248b0
jmp 0x10085b24
push 0x10024880
push eax
call fcn.1006420a
pop ecx
pop ecx
lea eax, [ebp - 0x2001c]
push eax
lea eax, [ebp - 0x1001c]
push eax
call fcn.10086c1e
pop ecx
pop ecx
test eax, eax
je 0x10085b7d
lea eax, [ebp - 0x1001c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x10085b4e
sub eax, edx
sar eax, 1
mov edi, eax
lea eax, [ebp - 0x2001c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x10085b67
sub eax, edx
sar eax, 1
cmp edi, eax
je 0x100859ec
push esi
push ebx
lea eax, [ebp - 0x2001c]
push eax
call fcn.100620c0
add esp, 0xc
lea eax, [ebp - 0x2001c]
cmp dword [ebp + 0xc], 1
jne 0x10085ba1
push 0x10024840
jmp 0x10085ba6
push 0x10024810
push eax
call fcn.1006420a
pop ecx
pop ecx
lea eax, [ebp - 0x2001c]
push eax
lea eax, [ebp - 0x1001c]
push eax
call fcn.10086c1e
pop ecx
pop ecx
test eax, eax
je 0x10085bff
lea eax, [ebp - 0x1001c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x10085bd0
sub eax, edx
sar eax, 1
mov edi, eax
lea eax, [ebp - 0x2001c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x10085be9
sub eax, edx
sar eax, 1
cmp edi, eax
je 0x100859ec
push esi
push ebx
lea eax, [ebp - 0x2001c]
push eax
call fcn.100620c0
add esp, 0xc
lea eax, [ebp - 0x2001c]
cmp dword [ebp + 0xc], 1
jne 0x10085c23
push 0x100247d0
jmp 0x10085c28
push 0x100247a0
push eax
call fcn.1006420a
pop ecx
pop ecx
lea eax, [ebp - 0x2001c]
push eax
lea eax, [ebp - 0x1001c]
push eax
call fcn.10086c1e
pop ecx
pop ecx
test eax, eax
je 0x10085c81
lea eax, [ebp - 0x1001c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x10085c52
sub eax, edx
sar eax, 1
mov edi, eax
lea eax, [ebp - 0x2001c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x10085c6b
sub eax, edx
sar eax, 1
cmp edi, eax
je 0x100859ec
mov dword [ebp - 0x20078], 0x80070490
inc dword [ebp - 0x2007c]
jmp 0x1008590e
cmp dword [ebp - 0x20078], ebx
jl 0x100862c8
mov dword [ebp - 0x200a4], ebx
cmp dword [ebp + 0xc], 0x62
jg 0x10085cb8
mov dword [ebp - 0x200a4], 1
mov eax, dword [ebp - 0x20080]
mov ecx, dword [eax]
push 4
lea edx, [ebp - 0x200a4]
push edx
push 3
push 0x1002465c
push dword [ebp - 0x2007c]
mov edi, 0x100244b8
push edi
push eax
call dword [ecx + 0x28]
mov dword [ebp - 0x20078], eax
cmp eax, ebx
jl 0x10085d1c
mov dword [ebp - 0x200e8], 1
mov eax, dword [ebp - 0x20080]
mov ecx, dword [eax]
push 4
lea edx, [ebp - 0x200e8]
push edx
push ebx
push 0x100246a4
push dword [ebp - 0x2007c]
push edi
push eax
call dword [ecx + 0x28]
mov dword [ebp - 0x20078], eax
mov eax, dword [ebp - 0x20080]
mov ecx, dword [eax]
lea edx, [ebp - 0x200d4]
push edx
push dword [ebp - 0x2007c]
push edi
push eax
call dword [ecx + 0x10]
mov dword [ebp - 0x20078], eax
cmp eax, ebx
jl 0x100862c8
mov dword [ebp - 0x20088], ebx
mov edi, 0x4000
mov eax, dword [ebp - 0x20088]
cmp eax, dword [ebp - 0x200d4]
jae 0x10085dd5
push esi
push ebx
lea eax, [ebp - 0x1801c]
push eax
call fcn.100620c0
add esp, 0xc
mov dword [ebp - 0x200b4], edi
mov eax, dword [ebp - 0x20080]
mov ecx, dword [eax]
lea edx, [ebp - 0x200b4]
push edx
lea edx, [ebp - 0x1801c]
push edx
lea edx, [ebp - 0x20084]
push edx
push dword [ebp - 0x20088]
push dword [ebp - 0x2007c]
push 0x100244b8
push eax
call dword [ecx + 0x1c]
mov dword [ebp - 0x20078], eax
cmp eax, ebx
jl 0x100862c8
mov eax, dword [ebp - 0x20084]
cmp eax, ebx
je 0x10085dca
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 0x20084], ebx
inc dword [ebp - 0x20088]
jmp 0x10085d4f
mov dword [ebp - 0x20088], ebx
mov eax, dword [ebp - 0x200d4]
cmp dword [ebp - 0x20088], eax
jae 0x10085f04
push esi
push ebx
lea eax, [ebp - 0x1801c]
push eax
call fcn.100620c0
add esp, 0xc
mov dword [ebp - 0x200b4], edi
mov eax, dword [ebp - 0x20080]
mov ecx, dword [eax]
lea edx, [ebp - 0x200b4]
push edx
lea edx, [ebp - 0x1801c]
push edx
lea edx, [ebp - 0x20084]
push edx
push dword [ebp - 0x20088]
push dword [ebp - 0x2007c]
push 0x100244b8
push eax
call dword [ecx + 0x1c]
mov dword [ebp - 0x20078], eax
cmp eax, ebx
jl 0x100862c8
push esi
push ebx
lea eax, [ebp - 0x801c]
push eax
call fcn.100620c0
add esp, 0xc
mov eax, dword [ebp + 0xc]
dec eax
je 0x10085ea5
sub eax, 9
je 0x10085e8c
sub eax, 0xf
je 0x10085e8c
sub eax, 0x19
je 0x10085e8c
sub eax, 0x19
je 0x10085e8c
sub eax, 0xf
je 0x10085e8c
sub eax, 8
je 0x10085e8c
mov eax, dword [ebp + 0xc]
cdq
mov ecx, 0x3e8
idiv ecx
push eax
push 0x10024768
jmp 0x10085e94
push dword [ebp + 0xc]
push 0x10024720
lea eax, [ebp - 0x801c]
push eax
call fcn.1006420a
add esp, 0xc
jmp 0x10085eb8
push 0x100246c0
lea eax, [ebp - 0x801c]
push eax
call fcn.1006420a
pop ecx
pop ecx
lea eax, [ebp - 0x801c]
push eax
lea eax, [ebp - 0x1801c]
push eax
call fcn.10086c1e
pop ecx
pop ecx
test eax, eax
je 0x10085ed9
mov dword [ebp - 0x20078], ebx
jmp 0x10085f10
mov dword [ebp - 0x20078], 0x80070490
mov eax, dword [ebp - 0x20084]
cmp eax, ebx
je 0x10085ef9
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 0x20084], ebx
inc dword [ebp - 0x20088]
jmp 0x10085ddb
cmp dword [ebp - 0x20078], ebx
jl 0x100862c8
mov eax, dword [ebp - 0x20084]
mov ecx, dword [eax]
lea edx, [ebp - 0x200a8]
push edx
push 0x100244e8
push eax
call dword [ecx]
mov dword [ebp - 0x20078], eax
cmp eax, ebx
jl 0x100862c8
mov dword [ebp - 0x200bc], ebx
mov eax, dword [ebp - 0x200a8]
mov ecx, dword [eax]
lea edx, [ebp - 0x200bc]
push edx
push ebx
push eax
call dword [ecx + 0x10]
mov dword [ebp - 0x20078], eax
cmp eax, ebx
jl 0x100862c8
push dword [ebp - 0x200bc]
call fcn.10062b5c
pop ecx
mov esi, eax
mov dword [ebp - 0x200cc], esi
cmp esi, ebx
jne 0x10085f84
mov dword [ebp - 0x20078], 0x8007000e
jmp 0x100862c8
mov eax, dword [ebp - 0x200a8]
mov ecx, dword [eax]
lea edx, [ebp - 0x200bc]
push edx
push esi
push eax
call dword [ecx + 0x10]
mov dword [ebp - 0x20078], eax
cmp eax, ebx
jl 0x100862c8
mov eax, dword [ebp - 0x200c4]
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 0x14]
mov dword [ebp - 0x20078], eax
cmp eax, ebx
jl 0x100862c8
cmp dword [ebp - 0x200a4], 1
jne 0x1008608d
mov eax, dword [ebp - 0x20084]
mov ecx, dword [eax]
lea edx, [ebp - 0x20098]
push edx
push 0x10024518
push eax
call dword [ecx]
mov dword [ebp - 0x20078], eax
cmp eax, ebx
jl 0x1008608d
mov eax, dword [ebp - 0x20098]
mov ecx, dword [eax]
push 4
pop esi
push esi
lea edx, [ebp - 0x200a4]
push edx
push 3
push 0x1002465c
push eax
call dword [ecx + 0x14]
mov dword [ebp - 0x20078], eax
mov dword [ebp - 0x200f0], 0x64
mov eax, dword [ebp - 0x20098]
mov ecx, dword [eax]
push esi
lea edx, [ebp - 0x200f0]
push edx
push ebx
push 0x10024674
push eax
call dword [ecx + 0x14]
mov dword [ebp - 0x20078], eax
mov dword [ebp - 0x200d8], ebx
mov eax, dword [ebp - 0x20098]
mov ecx, dword [eax]
push esi
lea edx, [ebp - 0x200d8]
push edx
push ebx
push 0x1002468c
push eax
call dword [ecx + 0x14]
mov dword [ebp - 0x20078], eax
mov dword [ebp - 0x200e4], ebx
mov eax, dword [ebp - 0x20098]
mov ecx, dword [eax]
push esi
lea edx, [ebp - 0x200e4]
push edx
push ebx
push 0x10024698
push eax
call dword [ecx + 0x14]
mov dword [ebp - 0x20078], eax
mov eax, dword [ebp - 0x2009c]
mov ecx, dword [eax]
push dword [ebp - 0x200a0]
push eax
call dword [ecx + 0x34]
mov dword [ebp - 0x20078], eax
cmp eax, ebx
jl 0x100862c8
mov eax, dword [ebp - 0x20090]
mov eax, dword [eax + 0x20]
mov ecx, dword [eax]
push dword [ebp - 0x2009c]
push eax
call dword [ecx + 0x10]
mov dword [ebp - 0x20078], eax
cmp eax, ebx
jl 0x100862c8
mov eax, dword [ebp - 0x20090]
mov eax, dword [eax + 0x20]
mov ecx, dword [eax]
lea edx, [ebp - 0x200ec]
push edx
push eax
call dword [ecx + 0x18]
mov dword [ebp - 0x20078], eax
cmp eax, ebx
jl 0x100862c8
xor eax, eax
lea edi, [ebp - 0x20104]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
inc eax
mov word [ebp - 0x20104], ax
push 2
pop eax
mov word [ebp - 0x20102], ax
mov dword [ebp - 0x20100], 0xac44
mov dword [ebp - 0x200fc], 0x2b110
push 4
pop eax
mov word [ebp - 0x200f8], ax
push 0x10
pop eax
mov word [ebp - 0x200f6], ax
xor eax, eax
mov word [ebp - 0x200f4], ax
push 0x48
push ebx
lea eax, [ebp - 0x20064]
push eax
call fcn.100620c0
add esp, 0xc
mov esi, 0x100244b8
lea edi, [ebp - 0x20064]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, 0x100244c8
lea edi, [ebp - 0x20054]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x20044], 1
mov dword [ebp - 0x20040], ebx
mov dword [ebp - 0x2003c], 4
mov esi, 0x100244d8
lea edi, [ebp - 0x20038]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x20028], ebx
mov dword [ebp - 0x20024], 0x12
lea eax, [ebp - 0x20104]
mov dword [ebp - 0x20020], eax
mov dword [ebp - 0x200ac], ebx
mov ecx, dword [ebp - 0x200ac]
mov eax, dword [ebp - 0x20090]
mov eax, dword [eax + 0x20]
cmp ecx, dword [ebp - 0x200ec]
jae 0x100862b2
mov edx, dword [eax]
lea esi, [ebp - 0x20094]
push esi
push ecx
push eax
call dword [edx + 0x1c]
mov dword [ebp - 0x20078], eax
cmp eax, ebx
jl 0x100862c8
mov eax, dword [ebp - 0x20094]
mov ecx, dword [eax]
lea edx, [ebp - 0x20074]
push edx
push eax
call dword [ecx + 0xc]
mov dword [ebp - 0x20078], eax
cmp eax, ebx
jl 0x100862c8
push 4
pop ecx
mov edi, 0x100244b8
lea esi, [ebp - 0x20074]
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
je 0x1008623d
mov dword [ebp - 0x20078], 0x80070057
jmp 0x100862c8
mov eax, dword [ebp - 0x20094]
mov ecx, dword [eax]
lea edx, [ebp - 0x20064]
push edx
push eax
call dword [ecx + 0x14]
mov dword [ebp - 0x20078], eax
cmp eax, ebx
jl 0x100862c8
mov eax, dword [ebp - 0x20090]
mov eax, dword [eax + 0x20]
mov ecx, dword [eax]
push dword [ebp - 0x20094]
push dword [ebp - 0x200ac]
push eax
call dword [ecx + 0x20]
mov dword [ebp - 0x20078], eax
cmp eax, ebx
jl 0x100862c8
mov eax, dword [ebp - 0x20090]
mov ecx, dword [ebp - 0x200ac]
mov dword [eax + 0x230], ecx
mov eax, dword [ebp - 0x20094]
cmp eax, ebx
je 0x100862a7
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 0x20094], ebx
inc dword [ebp - 0x200ac]
jmp 0x100861c2
mov ecx, dword [eax]
push eax
call dword [ecx + 0x2c]
mov dword [ebp - 0x20078], eax
cmp eax, ebx
jl 0x100862c8
mov dword [ebp - 0x20078], ebx
mov dword [ebp - 4], ebx
call fcn.100862d7
jmp 0x1008640b
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20078]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.10062074
leave
ret 8