Function at 0x1000e2f0
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x10150d33
mov eax, dword fs:[0]
push eax
sub esp, 0xcb4
mov eax, dword [0x101a42b4]
xor eax, esp
mov dword [esp + 0xcb0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x101a42b4]
xor eax, esp
push eax
lea eax, [esp + 0xcc8]
mov dword fs:[0], eax
mov eax, dword [esp + 0xce0]
mov edi, ecx
mov dword [esp + 0x70], eax
mov dword [esp + 0x68], 1
test ah, ah
xor ebx, ebx
cmp dword [esp + 0xce4], ebx
mov esi, 2
je 0x1000e358
mov dword [esp + 0x68], esi
mov ecx, ecx
mov byte [esp + 0x49c], 0x65
mov byte [esp + 0x49d], 0x6d
mov byte [esp + 0x49e], 0x69
mov byte [esp + 0x49f], 0x74
mov byte [esp + 0x4a0], bl
test esi, esi
mov byte [esp + 0x494], 0x25
mov byte [esp + 0x495], 0x30
mov byte [esp + 0x496], 0x32
mov byte [esp + 0x497], 0x78
mov byte [esp + 0x498], bl
push edx
pop edx
mov ebp, ebp
mov ecx, eax
mov dword [esp + 0x5c], ecx
test cl, cl
lea ecx, [esp + 0x34]
call fcn.100e610c
mov dword [esp + 0xcd0], ebx
test edx, edx
push ebx
lea edx, [esp + 0x38]
push edx
push 0x101593b0
push edi
call fcn.100436a0
mov edi, eax
add esp, 0x10
mov dword [esp + 0x6c], edi
mov eax, eax
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov byte [esp + 0xcd0], 1
mov cl, cl
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov byte [esp + 0xcd0], 2
mov edi, edi
mov cl, 0xe3
mov al, 0x6a
mov dl, 0x7a
mov byte [esp + 0x24f], cl
mov byte [esp + 0x25e], cl
mov ecx, 1
mov ebp, 4
mov byte [esp + 0x238], al
mov byte [esp + 0x239], 0x6d
mov byte [esp + 0x23a], 0x70
mov byte [esp + 0x23b], bl
mov word [esp + 0x23c], bx
mov byte [esp + 0x23e], 0xe9
mov byte [esp + 0x23f], bl
mov dword [esp + 0x240], 1
mov dword [esp + 0x244], ebp
mov byte [esp + 0x248], al
mov byte [esp + 0x249], 0x63
mov byte [esp + 0x24a], 0x78
mov byte [esp + 0x24b], dl
mov byte [esp + 0x24c], bl
mov byte [esp + 0x24d], bl
mov byte [esp + 0x24e], 0x67
mov dword [esp + 0x250], esi
mov dword [esp + 0x254], 1
mov byte [esp + 0x258], al
mov byte [esp + 0x259], 0x65
mov byte [esp + 0x25a], 0x63
mov byte [esp + 0x25b], 0x78
mov byte [esp + 0x25c], dl
mov byte [esp + 0x25d], bl
mov byte [esp + 0x25f], bl
mov dword [esp + 0x260], ecx
mov dword [esp + 0x264], ecx
mov byte [esp + 0x268], al
mov byte [esp + 0x269], 0x65
mov byte [esp + 0x26a], bl
mov word [esp + 0x26b], bx
mov byte [esp + 0x26d], bl
mov byte [esp + 0x289], dl
xor edx, edx
mov dword [esp + 0x48], edx
mov word [esp + 0x28b], dx
movzx edx, dl
mov byte [esp + 0x28d], dl
xor edx, edx
mov dword [esp + 0x48], edx
mov word [esp + 0x2ab], dx
movzx edx, dl
mov byte [esp + 0x2ad], dl
mov dl, 0x86
mov cl, 0x6e
mov byte [esp + 0x2bf], dl
mov byte [esp + 0x2df], dl
xor edx, edx
mov byte [esp + 0x26e], 0xf
mov byte [esp + 0x26f], 0x84
mov dword [esp + 0x270], esi
mov dword [esp + 0x274], ebp
mov byte [esp + 0x278], al
mov byte [esp + 0x279], cl
mov byte [esp + 0x27a], 0x65
mov byte [esp + 0x27b], bl
mov word [esp + 0x27c], bx
mov byte [esp + 0x27e], 0xf
mov byte [esp + 0x27f], 0x85
mov dword [esp + 0x280], esi
mov dword [esp + 0x284], ebp
mov byte [esp + 0x288], al
mov byte [esp + 0x28a], bl
mov byte [esp + 0x28e], 0xf
mov byte [esp + 0x28f], 0x84
mov dword [esp + 0x290], esi
mov dword [esp + 0x294], ebp
mov byte [esp + 0x298], al
mov byte [esp + 0x299], cl
mov byte [esp + 0x29a], 0x7a
mov byte [esp + 0x29b], bl
mov word [esp + 0x29c], bx
mov byte [esp + 0x29e], 0xf
mov byte [esp + 0x29f], 0x85
mov dword [esp + 0x2a0], esi
mov dword [esp + 0x2a4], ebp
mov byte [esp + 0x2a8], al
mov byte [esp + 0x2a9], 0x61
mov byte [esp + 0x2aa], bl
mov byte [esp + 0x2ae], 0xf
mov byte [esp + 0x2af], 0x87
mov dword [esp + 0x2b0], esi
mov dword [esp + 0x2b4], ebp
mov byte [esp + 0x2b8], al
mov byte [esp + 0x2b9], cl
mov byte [esp + 0x2ba], 0x61
mov byte [esp + 0x2bb], bl
mov word [esp + 0x2bc], bx
mov byte [esp + 0x2be], 0xf
mov dword [esp + 0x2c0], esi
mov dword [esp + 0x2c4], ebp
mov byte [esp + 0x2c8], al
mov byte [esp + 0x2c9], cl
mov byte [esp + 0x2ca], 0x62
mov byte [esp + 0x2cb], 0x65
mov byte [esp + 0x2cc], bl
mov byte [esp + 0x2cd], bl
mov byte [esp + 0x2ce], 0xf
mov byte [esp + 0x2cf], 0x87
mov dword [esp + 0x2d0], esi
mov dword [esp + 0x2d4], ebp
mov byte [esp + 0x2d8], al
mov byte [esp + 0x2d9], 0x62
mov byte [esp + 0x2da], 0x65
mov byte [esp + 0x2db], bl
mov word [esp + 0x2dc], bx
mov byte [esp + 0x2de], 0xf
mov dword [esp + 0x2e0], esi
mov dword [esp + 0x2e4], ebp
mov byte [esp + 0x2e8], al
mov byte [esp + 0x2e9], 0x62
mov byte [esp + 0x2ea], bl
mov dword [esp + 0x48], edx
mov word [esp + 0x2eb], dx
movzx edx, dl
mov byte [esp + 0x2ed], dl
mov dl, 0x82
mov byte [esp + 0x2ef], dl
mov byte [esp + 0x30f], dl
xor edx, edx
mov dword [esp + 0x48], edx
mov word [esp + 0x32b], dx
movzx edx, dl
mov byte [esp + 0x32d], dl
mov dl, 0x8e
mov byte [esp + 0x33f], dl
mov byte [esp + 0x35f], dl
mov byte [esp + 0x2ee], 0xf
mov dword [esp + 0x2f0], esi
mov dword [esp + 0x2f4], ebp
mov byte [esp + 0x2f8], al
mov byte [esp + 0x2f9], cl
mov byte [esp + 0x2fa], 0x62
mov byte [esp + 0x2fb], bl
mov word [esp + 0x2fc], bx
mov byte [esp + 0x2fe], 0xf
mov byte [esp + 0x2ff], 0x83
mov dword [esp + 0x300], esi
mov dword [esp + 0x304], ebp
mov byte [esp + 0x308], al
mov byte [esp + 0x309], cl
mov byte [esp + 0x30a], 0x61
mov byte [esp + 0x30b], 0x65
mov byte [esp + 0x30c], bl
mov byte [esp + 0x30d], bl
mov byte [esp + 0x30e], 0xf
mov dword [esp + 0x310], esi
mov dword [esp + 0x314], ebp
mov byte [esp + 0x318], al
mov byte [esp + 0x319], 0x61
mov byte [esp + 0x31a], 0x65
mov byte [esp + 0x31b], bl
mov word [esp + 0x31c], bx
mov byte [esp + 0x31e], 0xf
mov byte [esp + 0x31f], 0x83
mov dword [esp + 0x320], esi
mov dword [esp + 0x324], ebp
mov byte [esp + 0x328], al
mov byte [esp + 0x329], 0x67
mov byte [esp + 0x32a], bl
mov byte [esp + 0x32e], 0xf
mov byte [esp + 0x32f], 0x8f
mov dword [esp + 0x330], esi
mov dword [esp + 0x334], ebp
mov byte [esp + 0x338], al
mov byte [esp + 0x339], cl
mov byte [esp + 0x33a], 0x67
mov byte [esp + 0x33b], bl
mov word [esp + 0x33c], bx
mov byte [esp + 0x33e], 0xf
mov dword [esp + 0x340], esi
mov dword [esp + 0x344], ebp
mov byte [esp + 0x348], al
mov byte [esp + 0x349], cl
mov byte [esp + 0x34a], 0x6c
mov byte [esp + 0x34b], 0x65
mov byte [esp + 0x34c], bl
mov byte [esp + 0x34d], bl
mov byte [esp + 0x34e], 0xf
mov byte [esp + 0x34f], 0x8f
mov dword [esp + 0x350], esi
mov dword [esp + 0x354], ebp
mov byte [esp + 0x358], al
mov byte [esp + 0x359], 0x6c
mov byte [esp + 0x35a], 0x65
mov byte [esp + 0x35b], bl
mov word [esp + 0x35c], bx
mov byte [esp + 0x35e], 0xf
mov dword [esp + 0x360], esi
mov dword [esp + 0x364], ebp
mov byte [esp + 0x368], al
mov byte [esp + 0x369], 0x6c
mov byte [esp + 0x36a], bl
xor edx, edx
mov dword [esp + 0x48], edx
mov word [esp + 0x36b], dx
movzx edx, dl
mov byte [esp + 0x36d], dl
mov dl, 0x8d
mov byte [esp + 0x37f], dl
mov byte [esp + 0x39f], dl
xor edx, edx
mov dword [esp + 0x48], edx
mov word [esp + 0x3ab], dx
movzx edx, dl
mov byte [esp + 0x3ad], dl
xor edx, edx
mov dword [esp + 0x48], edx
mov word [esp + 0x3cb], dx
movzx edx, dl
mov byte [esp + 0x36e], 0xf
mov byte [esp + 0x36f], 0x8c
mov dword [esp + 0x370], esi
mov dword [esp + 0x374], ebp
mov byte [esp + 0x378], al
mov byte [esp + 0x379], cl
mov byte [esp + 0x37a], 0x6c
mov byte [esp + 0x37b], bl
mov word [esp + 0x37c], bx
mov byte [esp + 0x37e], 0xf
mov dword [esp + 0x380], esi
mov dword [esp + 0x384], ebp
mov byte [esp + 0x388], al
mov byte [esp + 0x389], cl
mov byte [esp + 0x38a], 0x67
mov byte [esp + 0x38b], 0x65
mov byte [esp + 0x38c], bl
mov byte [esp + 0x38d], bl
mov byte [esp + 0x38e], 0xf
mov byte [esp + 0x38f], 0x8c
mov dword [esp + 0x390], esi
mov dword [esp + 0x394], ebp
mov byte [esp + 0x398], al
mov byte [esp + 0x399], 0x67
mov byte [esp + 0x39a], 0x65
mov byte [esp + 0x39b], bl
mov word [esp + 0x39c], bx
mov byte [esp + 0x39e], 0xf
mov dword [esp + 0x3a0], esi
mov dword [esp + 0x3a4], ebp
mov byte [esp + 0x3a8], al
mov byte [esp + 0x3a9], 0x73
mov byte [esp + 0x3aa], bl
mov byte [esp + 0x3ae], 0xf
mov byte [esp + 0x3af], 0x88
mov dword [esp + 0x3b0], esi
mov dword [esp + 0x3b4], ebp
mov byte [esp + 0x3b8], al
mov byte [esp + 0x3b9], cl
mov byte [esp + 0x3ba], 0x73
mov byte [esp + 0x3bb], bl
mov word [esp + 0x3bc], bx
mov byte [esp + 0x3be], 0xf
mov byte [esp + 0x3bf], 0x89
mov dword [esp + 0x3c0], esi
mov dword [esp + 0x3c4], ebp
mov byte [esp + 0x3c8], al
mov byte [esp + 0x3c9], 0x63
mov byte [esp + 0x3ca], bl
mov byte [esp + 0x3cd], dl
mov byte [esp + 0x3ce], 0xf
mov byte [esp + 0x3cf], 0x82
mov dword [esp + 0x3d0], esi
mov dword [esp + 0x3d4], ebp
mov byte [esp + 0x3d8], al
mov byte [esp + 0x3d9], cl
mov byte [esp + 0x3da], 0x63
mov byte [esp + 0x3db], bl
mov word [esp + 0x3dc], bx
mov byte [esp + 0x3de], 0xf
mov byte [esp + 0x3df], 0x83
mov dword [esp + 0x3e0], esi
mov dword [esp + 0x3e4], ebp
mov byte [esp + 0x3e8], al
mov byte [esp + 0x3e9], 0x6f
xor edx, edx
mov dword [esp + 0x48], edx
mov word [esp + 0x3eb], dx
movzx edx, dl
mov byte [esp + 0x3ed], dl
xor edx, edx
mov dword [esp + 0x48], edx
mov word [esp + 0x40b], dx
movzx edx, dl
mov byte [esp + 0x3f9], cl
mov byte [esp + 0x40d], dl
mov byte [esp + 0x419], cl
mov cl, 0x70
mov dl, 0x8b
mov byte [esp + 0x3ea], bl
mov byte [esp + 0x3ee], 0xf
mov byte [esp + 0x3ef], 0x80
mov dword [esp + 0x3f0], esi
mov dword [esp + 0x3f4], ebp
mov byte [esp + 0x3f8], al
mov byte [esp + 0x3fa], 0x6f
mov byte [esp + 0x3fb], bl
mov word [esp + 0x3fc], bx
mov byte [esp + 0x3fe], 0xf
mov byte [esp + 0x3ff], 0x81
mov dword [esp + 0x400], esi
mov dword [esp + 0x404], ebp
mov byte [esp + 0x408], al
mov byte [esp + 0x409], 0x70
mov byte [esp + 0x40a], bl
mov byte [esp + 0x40e], 0xf
mov byte [esp + 0x40f], 0x8a
mov dword [esp + 0x410], esi
mov dword [esp + 0x414], ebp
mov byte [esp + 0x418], al
mov byte [esp + 0x41a], cl
mov byte [esp + 0x41b], bl
mov word [esp + 0x41c], bx
mov byte [esp + 0x41e], 0xf
mov byte [esp + 0x41f], dl
mov dword [esp + 0x420], esi
mov dword [esp + 0x424], ebp
mov byte [esp + 0x428], al
mov byte [esp + 0x429], cl
mov byte [esp + 0x42a], 0x65
mov byte [esp + 0x42b], bl
mov word [esp + 0x42c], bx
mov byte [esp + 0x42e], 0xf
mov byte [esp + 0x42f], 0x8a
mov dword [esp + 0x430], esi
mov dword [esp + 0x434], ebp
mov byte [esp + 0x438], al
mov byte [esp + 0x439], cl
mov byte [esp + 0x43a], 0x6f
mov byte [esp + 0x43b], bl
mov word [esp + 0x43c], bx
mov byte [esp + 0x43e], 0xf
mov byte [esp + 0x43f], dl
mov dword [esp + 0x440], esi
mov dword [esp + 0x444], ebp
test eax, 0x7751
mov dword [esp + 0x48], ebx
mov ecx, ecx
mov dl, dl
cmp edi, ebx
mov dword [esp + 0x58], ebx
jle 0x1000efd4
mov ecx, dword [esp + 0x38]
mov eax, ebx
cmp eax, ebx
jl 0x1000f286
cmp eax, dword [esp + 0x3c]
jge 0x1000f286
mov edx, dword [ecx + eax*4]
cmp dword [edx - 0xc], esi
jl 0x1000efc3
cmp byte [edx], 0x3a
jne 0x1000efc3
mov edi, edx
add edi, 1
mov eax, edi
mov dword [esp + 0x218], 0xf
mov dword [esp + 0x214], ebx
mov byte [esp + 0x204], bl
lea ecx, [eax + 1]
mov dl, byte [eax]
add eax, 1
cmp dl, bl
jne 0x1000edb1
sub eax, ecx
push eax
push edi
lea ecx, [esp + 0x208]
call fcn.1000a1e0
mov byte [esp + 0xcd0], 3
mov ch, ch
mov edx, dword [esp + 0x218]
cmp edx, 0x10
mov eax, dword [esp + 0x204]
mov byte [esp + 0x4f], 0x20
jae 0x1000edf3
lea eax, [esp + 0x204]
mov edi, dword [esp + 0x214]
add eax, edi
cmp eax, ebx
mov dword [esp + 0x50], eax
je 0x1000ee34
cmp edx, 0x10
mov ecx, dword [esp + 0x204]
jae 0x1000ee17
lea ecx, [esp + 0x204]
cmp ecx, eax
ja 0x1000ee34
cmp edx, 0x10
mov ecx, dword [esp + 0x204]
jae 0x1000ee2e
lea ecx, [esp + 0x204]
add ecx, edi
cmp eax, ecx
jbe 0x1000ee40
call fcn.100f6196
mov edx, dword [esp + 0x218]
cmp edx, 0x10
mov edi, dword [esp + 0x204]
mov eax, edi
jae 0x1000ee55
lea eax, [esp + 0x204]
mov ecx, dword [esp + 0x214]
add eax, ecx
cmp eax, ebx
mov dword [esp + 0x60], eax
je 0x1000ee93
cmp edx, 0x10
mov ecx, edi
jae 0x1000ee74
lea ecx, [esp + 0x204]
cmp ecx, eax
ja 0x1000ee93
cmp edx, 0x10
mov ecx, edi
jae 0x1000ee86
lea ecx, [esp + 0x204]
mov edi, dword [esp + 0x214]
add ecx, edi
cmp eax, ecx
jbe 0x1000ee9f
call fcn.100f6196
mov edx, dword [esp + 0x218]
cmp edx, 0x10
mov ecx, dword [esp + 0x204]
jb 0x1000f27a
cmp ecx, ebx
mov edi, ecx
je 0x1000eee2
cmp edx, 0x10
mov eax, ecx
jae 0x1000eec3
lea eax, [esp + 0x204]
cmp eax, edi
ja 0x1000eee2
cmp edx, 0x10
mov eax, ecx
jae 0x1000eed5
lea eax, [esp + 0x204]
mov edx, dword [esp + 0x214]
add eax, edx
cmp edi, eax
jbe 0x1000eee7
call fcn.100f6196
mov edx, dword [esp + 0x60]
lea ecx, [esp + 0x4f]
push ecx
lea eax, [esp + 0x204]
push edx
mov ecx, eax
push ecx
push edi
push eax
lea eax, [esp + 0xa4]
push eax
call fcn.1000d490
mov ecx, dword [esp + 0x68]
mov edx, dword [eax + 4]
mov eax, dword [eax]
add esp, 0x18
push ecx
lea ecx, [esp + 0x204]
push ecx
push edx
push eax
lea ecx, [esp + 0x70]
push ecx
lea ecx, [esp + 0x214]
call fcn.1000d340
nop
test ch, ch
cmp dword [esp + 0x218], 0x10
mov ecx, dword [esp + 0x204]
jae 0x1000ef4d
lea ecx, [esp + 0x204]
lea edx, [esp + 0x448]
mov al, byte [ecx]
mov byte [edx], al
add ecx, 1
add edx, 1
cmp al, bl
jne 0x1000ef54
test ah, ah
mov dword [esp + 0x468], ebx
test ebx, ebx
lea edx, [esp + 0x448]
push edx
lea ecx, [esp + 0x28]
call fcn.1000e1b0
test al, al
mov byte [esp + 0xcd0], 2
cmp dword [esp + 0x218], 0x10
jb 0x1000efa2
mov eax, dword [esp + 0x204]
push eax
call fcn.100e2dad
add esp, 4
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x58]
mov dword [esp + 0x218], 0xf
mov dword [esp + 0x214], ebx
mov byte [esp + 0x204], bl
add eax, 1
cmp eax, dword [esp + 0x6c]
mov dword [esp + 0x58], eax
jl 0x1000ed67
cmp dword [esp + 0x6c], ebx
mov dword [esp + 0x58], ebx
jle 0x1000f787
mov dword [esp + 0x60], ebx
test eax, 0x7b99
mov ebp, dword [esp + 0x58]
cmp ebp, ebx
jl 0x1000f286
cmp ebp, dword [esp + 0x3c]
jge 0x1000f286
mov eax, dword [esp + 0x38]
lea edi, [ebp*4]
mov ecx, dword [edi + eax]
cmp dword [ecx - 0xc], 4
jl 0x1000f29b
push 4
lea edx, [esp + 0x4a0]
mov eax, ecx
push edx
push eax
call fcn.100fa627
add esp, 0xc
test eax, eax
jne 0x1000f297
cmp ebp, dword [esp + 0x3c]
jge 0x1000f286
mov eax, dword [esp + 0x38]
mov edi, dword [edi + eax]
add edi, 4
mov eax, edi
mov dword [esp + 0x234], 0xf
mov dword [esp + 0x230], ebx
mov byte [esp + 0x220], bl
lea ebp, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x1000f068
sub eax, ebp
push eax
push edi
lea ecx, [esp + 0x224]
call fcn.1000a1e0
mov byte [esp + 0xcd0], 4
test ebx, ebx
mov ecx, dword [esp + 0x234]
cmp ecx, 0x10
mov edx, dword [esp + 0x220]
mov byte [esp + 0x4f], 0x20
mov eax, edx
jae 0x1000f0ac
lea eax, [esp + 0x220]
mov ebp, dword [esp + 0x230]
lea edi, [eax + ebp]
cmp edi, ebx
mov dword [esp + 0x50], edi
je 0x1000f0e4
cmp ecx, 0x10
mov eax, edx
jae 0x1000f0cc
lea eax, [esp + 0x220]
cmp eax, edi
ja 0x1000f0e4
cmp ecx, 0x10
mov eax, edx
jae 0x1000f0de
lea eax, [esp + 0x220]
add eax, ebp
cmp edi, eax
jbe 0x1000f0fe
call fcn.100f6196
mov ecx, dword [esp + 0x234]
mov edx, dword [esp + 0x220]
mov ebp, dword [esp + 0x230]
cmp ecx, 0x10
mov eax, edx
jae 0x1000f10c
lea eax, [esp + 0x220]
add ebp, eax
cmp ebp, ebx
je 0x1000f13f
cmp ecx, 0x10
mov eax, edx
jae 0x1000f120
lea eax, [esp + 0x220]
cmp eax, ebp
ja 0x1000f13f
cmp ecx, 0x10
mov eax, edx
jae 0x1000f132
lea eax, [esp + 0x220]
mov edi, dword [esp + 0x230]
add eax, edi
cmp ebp, eax
jbe 0x1000f152
call fcn.100f6196
mov ecx, dword [esp + 0x234]
mov edx, dword [esp + 0x220]
cmp ecx, 0x10
jb 0x1000f28b
cmp edx, ebx
mov edi, edx
je 0x1000f18e
cmp ecx, 0x10
mov eax, edx
jae 0x1000f16f
lea eax, [esp + 0x220]
cmp eax, edi
ja 0x1000f18e
cmp ecx, 0x10
mov eax, edx
jae 0x1000f181
lea eax, [esp + 0x220]
mov ecx, dword [esp + 0x230]
add eax, ecx
cmp edi, eax
jbe 0x1000f193
call fcn.100f6196
lea edx, [esp + 0x4f]
push edx
lea eax, [esp + 0x220]
push ebp
mov ecx, eax
push ecx
push edi
push eax
lea eax, [esp + 0xa4]
push eax
call fcn.1000d490
mov ecx, dword [esp + 0x68]
mov edx, dword [eax + 4]
mov eax, dword [eax]
add esp, 0x18
push ecx
lea ecx, [esp + 0x220]
push ecx
push edx
push eax
lea ecx, [esp + 0x60]
push ecx
lea ecx, [esp + 0x230]
call fcn.1000d340
test dl, dl
cmp dword [esp + 0x234], 0x10
mov edi, dword [esp + 0x220]
jae 0x1000f1f4
lea edi, [esp + 0x220]
mov dl, dl
cmp byte [edi], bl
je 0x1000f23a
mov ebp, dword [esp + 0x5c]
mov edi, edi
mov dword [esp + 0x50], ebx
mov ah, ah
lea edx, [esp + 0x50]
push edx
lea eax, [esp + 0x498]
push eax
push edi
call fcn.100f6765
add esp, 0xc
push eax
pop eax
mov eax, dword [esp + 0x60]
mov cl, byte [esp + 0x50]
mov byte [eax + ebp], cl
add eax, 1
mov dword [esp + 0x60], eax
test bh, bh
add edi, esi
test ecx, ecx
cmp byte [edi], bl
jne 0x1000f200
mov byte [esp + 0xcd0], 2
cmp dword [esp + 0x234], 0x10
jb 0x1000f25c
mov edx, dword [esp + 0x220]
push edx
call fcn.100e2dad
add esp, 4
mov dword [esp + 0x234], 0xf
mov dword [esp + 0x230], ebx
mov byte [esp + 0x220], bl
jmp 0x1000f752
lea edi, [esp + 0x204]
jmp 0x1000eeb5
jmp fcn.100e2ea6
lea edi, [esp + 0x220]
jmp 0x1000f161
mov eax, dword [esp + 0x38]
cmp ebp, dword [esp + 0x3c]
jge 0x1000f286
mov ecx, dword [edi + eax]
cmp dword [ecx - 0xc], esi
jl 0x1000f555
cmp byte [ecx], 0x3a
jne 0x1000f555
mov eax, ecx
lea edi, [eax + 1]
mov eax, edi
mov dword [esp + 0x4bc], 0xf
mov dword [esp + 0x4b8], ebx
mov byte [esp + 0x4a8], bl
lea ebp, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x1000f2e0
sub eax, ebp
push eax
push edi
lea ecx, [esp + 0x4ac]
call fcn.1000a1e0
mov byte [esp + 0xcd0], 5
test esi, esi
mov edx, dword [esp + 0x4bc]
cmp edx, 0x10
mov ebp, dword [esp + 0x4a8]
mov byte [esp + 0x4f], 0x20
mov eax, ebp
jae 0x1000f324
lea eax, [esp + 0x4a8]
mov edi, dword [esp + 0x4b8]
lea ecx, [eax + edi]
cmp ecx, ebx
mov dword [esp + 0x50], ecx
je 0x1000f35c
cmp edx, 0x10
mov eax, ebp
jae 0x1000f344
lea eax, [esp + 0x4a8]
cmp eax, ecx
ja 0x1000f35c
cmp edx, 0x10
mov eax, ebp
jae 0x1000f356
lea eax, [esp + 0x4a8]
add eax, edi
cmp ecx, eax
jbe 0x1000f376
call fcn.100f6196
mov edx, dword [esp + 0x4bc]
mov edi, dword [esp + 0x4b8]
mov ebp, dword [esp + 0x4a8]
cmp edx, 0x10
mov eax, ebp
jae 0x1000f384
lea eax, [esp + 0x4a8]
lea ebp, [eax + edi]
cmp ebp, ebx
je 0x1000f3bb
cmp edx, 0x10
mov eax, dword [esp + 0x4a8]
jae 0x1000f39e
lea eax, [esp + 0x4a8]
cmp eax, ebp
ja 0x1000f3bb
cmp edx, 0x10
mov eax, dword [esp + 0x4a8]
jae 0x1000f3b5
lea eax, [esp + 0x4a8]
add eax, edi
cmp ebp, eax
jbe 0x1000f3c7
call fcn.100f6196
mov edx, dword [esp + 0x4bc]
cmp edx, 0x10
jb 0x1000f4c2
mov edi, dword [esp + 0x4a8]
mov ecx, edi
cmp ecx, ebx
je 0x1000f40a
cmp edx, 0x10
mov eax, ecx
jae 0x1000f3eb
lea eax, [esp + 0x4a8]
cmp eax, edi
ja 0x1000f40a
cmp edx, 0x10
mov eax, ecx
jae 0x1000f3fd
lea eax, [esp + 0x4a8]
mov edx, dword [esp + 0x4b8]
add eax, edx
cmp edi, eax
jbe 0x1000f40f
call fcn.100f6196
lea ecx, [esp + 0x4f]
push ecx
lea eax, [esp + 0x4a8]
push ebp
mov ecx, eax
push ecx
push edi
push eax
lea edx, [esp + 0x20c]
push edx
call fcn.1000d490
mov ecx, dword [esp + 0x68]
mov edx, dword [eax + 4]
mov eax, dword [eax]
add esp, 0x18
push ecx
lea ecx, [esp + 0x4a8]
push ecx
push edx
push eax
lea ecx, [esp + 0x60]
push ecx
lea ecx, [esp + 0x4b8]
call fcn.1000d340
mov edx, edx
nop
xor edi, edi
mov dword [esp + 0x50], ebx
nop
mov ebp, dword [esp + 0x28]
cmp ebp, ebx
je 0x1000f515
mov ecx, dword [esp + 0x2c]
sub ecx, ebp
mov eax, 0x38e38e39
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jae 0x1000f515
cmp dword [esp + 0x4bc], 0x10
mov edx, dword [esp + 0x50]
mov ecx, dword [esp + 0x4a8]
lea eax, [edx + ebp]
jae 0x1000f4aa
lea ecx, [esp + 0x4a8]
push eax
push ecx
call fcn.10107b61
add esp, 8
test eax, eax
je 0x1000f4d5
add edi, 1
add dword [esp + 0x50], 0x24
jmp 0x1000f460
mov ecx, dword [esp + 0x4a8]
lea edi, [esp + 0x4a8]
jmp 0x1000f3dd
mov ebp, dword [esp + 0x28]
cmp ebp, ebx
je 0x1000f4f8
mov ecx, dword [esp + 0x2c]
sub ecx, ebp
mov eax, 0x38e38e39
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x1000f501
call fcn.100f6196
mov ebp, dword [esp + 0x28]
mov eax, dword [esp + 0x5c]
sub eax, dword [esp + 0x70]
lea ecx, [edi + edi*8]
mov dword [ebp + ecx*4 + 0x20], eax
test eax, 0x2644
mov byte [esp + 0xcd0], 2
cmp dword [esp + 0x4bc], 0x10
jb 0x1000f537
mov edx, dword [esp + 0x4a8]
push edx
call fcn.100e2dad
add esp, 4
mov dword [esp + 0x4bc], 0xf
mov dword [esp + 0x4b8], ebx
mov byte [esp + 0x4a8], bl
jmp 0x1000f752
mov eax, dword [edi + eax]
lea ecx, [esp + 0x448]
push ecx
lea edx, [esp + 0x4c]
push edx
push 0x21
lea ecx, [esp + 0x244]
push ecx
push eax
lea edi, [esp + 0x38]
call fcn.1000cb90
add esp, 0x14
test eax, eax
je 0x1000f61e
mov edi, dword [esp + 0x48]
mov ecx, dword [esp + 0x5c]
shl edi, 4
mov edx, dword [esp + edi + 0x240]
lea ebp, [esp + edi + 0x240]
push edx
lea eax, [esp + edi + 0x242]
push eax
push ecx
call fcn.100f61f0
add esp, 0xc
mov cl, cl
mov eax, dword [esp + edi + 0x244]
add eax, dword [ebp]
lea edi, [esp + edi + 0x244]
mov dword [esp + 0x60], eax
test esi, esi
xchg ebx, eax
xchg ebx, eax
xor eax, eax
lea esp, [esp]
mov cl, byte [esp + eax + 0x448]
mov byte [esp + eax + 0x46c], cl
add eax, 1
cmp cl, bl
jne 0x1000f5d0
mov cl, cl
mov edx, dword [ebp]
sub edx, dword [esp + 0x70]
add edx, dword [esp + 0x5c]
mov dword [esp + 0x48c], edx
test al, al
mov eax, dword [edi]
mov dword [esp + 0x490], eax
mov esi, esi
lea ecx, [esp + 0x46c]
push ecx
lea ecx, [esp + 0x18]
call fcn.1000e250
mov ah, ah
jmp 0x1000f752
mov edx, dword [esp + 0x68]
push ebx
push edx
lea ecx, [esp + 0x208]
call fcn.100d9330
mov eax, dword [esp + 0xcd8]
mov ecx, dword [esp + 0xcdc]
mov dword [esp + 0x204], ebx
mov dword [esp + 0x208], eax
mov dword [esp + 0x20c], ecx
mov edx, edx
lea ecx, [esp + 0x138]
call fcn.100da110
mov byte [esp + 0xcd0], 6
mov ebp, ebp
lea edx, [esp + 0x200]
push edx
lea ecx, [esp + 0x13c]
call fcn.100da4d0
mov dh, dh
lea eax, [esp + 0x138]
push eax
lea ecx, [esp + 0x9c]
call fcn.100d3790
mov byte [esp + 0xcd0], 7
test ebx, ebx
lea ecx, [esp + 0x98]
push ecx
lea ecx, [esp + 0x78]
call fcn.100db9e0
mov byte [esp + 0xcd0], 8
test bl, bl
cmp ebp, dword [esp + 0x3c]
jge 0x1000f286
mov edx, dword [esp + 0x38]
mov eax, dword [edx + ebp*4]
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0x7c]
call fcn.100dcd50
mov edi, eax
test bl, bl
lea ecx, [esp + 0x138]
call fcn.100d9fe0
test bl, bl
cmp edi, ebx
jne 0x1000f864
mov eax, dword [esp + 0x1b8]
mov eax, dword [eax]
mov ebp, ebp
mov ecx, dword [eax + 0x38]
mov dword [esp + 0x60], ecx
test bh, bh
mov eax, dword [eax + 0x34]
push ecx
mov ecx, dword [esp + 0x60]
push eax
push ecx
call fcn.100f61f0
add esp, 0xc
mov al, al
mov byte [esp + 0xcd0], 7
lea ecx, [esp + 0x74]
call fcn.100db5d0
mov byte [esp + 0xcd0], 6
lea ecx, [esp + 0x98]
call fcn.100d3800
mov byte [esp + 0xcd0], 2
lea ecx, [esp + 0x138]
call fcn.100da430
mov eax, dword [esp + 0x60]
add dword [esp + 0x5c], eax
test bl, bl
cdq
add dword [esp + 0xcd8], eax
adc dword [esp + 0xcdc], edx
mov cl, cl
mov eax, dword [esp + 0x58]
add eax, 1
cmp eax, dword [esp + 0x6c]
mov dword [esp + 0x58], eax
jl 0x1000efe2
mov ebp, 4
mov esi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x58], ebx
mov dword [esp + 0x50], ebx
cmp ecx, ebx
je 0x1000fdcd
sub esi, ecx
mov eax, 0x66666667
imul esi
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [esp + 0x58], eax
jae 0x1000fdcd
test eax, 0x5ead
mov dword [esp + 0x60], ebx
mov dword [esp + 0x6c], ebx
lea esp, [esp]
mov edi, dword [esp + 0x28]
cmp edi, ebx
je 0x1000fca7
mov ecx, dword [esp + 0x2c]
sub ecx, edi
mov eax, 0x38e38e39
imul ecx
mov ecx, dword [esp + 0x60]
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ecx, eax
jae 0x1000fb5a
mov ecx, dword [esp + 0x6c]
mov esi, dword [esp + 0x18]
add ecx, edi
cmp esi, ebx
mov edi, dword [esp + 0x58]
mov dword [esp + 0x68], ecx
je 0x1000f830
mov ecx, dword [esp + 0x1c]
sub ecx, esi
mov eax, 0x66666667
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x1000f839
call fcn.100f6196
mov esi, dword [esp + 0x18]
mov edx, dword [esp + 0x50]
mov eax, dword [esp + 0x68]
add esi, edx
push eax
push esi
call fcn.10107b61
add esp, 8
test eax, eax
je 0x1000fa57
add dword [esp + 0x60], 1
add dword [esp + 0x6c], 0x24
jmp 0x1000f7d0
push ebx
push ebx
lea ecx, [esp + 0xa0]
call fcn.100d9df0
test eax, eax
cmp dword [0x1018f498], ebx
je 0x1000f9ba
mov bh, bh
mov al, 0xce
mov dl, 0xed
mov cl, 0xf3
mov byte [esp + 0x4a4], 0xd6
mov byte [esp + 0x4a5], 0xb8
mov byte [esp + 0x4a6], 0xc1
mov byte [esp + 0x4a7], 0xee
mov byte [esp + 0x4a8], 0x5b
mov byte [esp + 0x4a9], 0x25
mov byte [esp + 0x4aa], 0x73
mov byte [esp + 0x4ab], 0x5d
mov byte [esp + 0x4ac], 0xbd
mov byte [esp + 0x4ad], 0xe2
mov byte [esp + 0x4ae], al
mov byte [esp + 0x4af], 0xf6
mov byte [esp + 0x4b0], 0xb4
mov byte [esp + 0x4b1], dl
mov byte [esp + 0x4b2], al
mov byte [esp + 0x4b3], cl
mov byte [esp + 0x4b4], 0x2c
mov byte [esp + 0x4b5], 0xb4
mov byte [esp + 0x4b6], dl
mov byte [esp + 0x4b7], al
mov byte [esp + 0x4b8], cl
mov byte [esp + 0x4b9], 0xd0
mov byte [esp + 0x4ba], 0xc5
mov byte [esp + 0x4bb], 0xcf
mov byte [esp + 0x4bc], 0xa2
mov byte [esp + 0x4bd], 0x3d
mov byte [esp + 0x4be], 0x25
mov byte [esp + 0x4bf], 0x73
mov byte [esp + 0x4c0], bl
test bh, bh
cmp ebp, dword [esp + 0x3c]
jge 0x1000f286
mov edx, dword [esp + 0x38]
push edi
lea esi, [edx + ebp*4]
call fcn.100dab20
push eax
mov eax, dword [esi]
push eax
lea ecx, [esp + 0x4b0]
push ecx
lea edx, [esp + 0x4d4]
push edx
call fcn.100f5cb0
add esp, 0x14
mov dh, dh
push 0x10010
push 0x101597f0
lea eax, [esp + 0x4cc]
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
test ebx, ebx
mov byte [esp + 0xcd0], 7
lea ecx, [esp + 0x74]
call fcn.100db5d0
mov byte [esp + 0xcd0], 6
lea ecx, [esp + 0x98]
call fcn.100d3800
mov byte [esp + 0xcd0], 2
lea ecx, [esp + 0x138]
call fcn.100da430
mov byte [esp + 0xcd0], 1
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x1000fa0c
push eax
call fcn.100e2dad
add esp, 4
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov byte [esp + 0xcd0], bl
mov eax, dword [esp + 0x28]
cmp eax, ebx
je 0x1000fa30
push eax
call fcn.100e2dad
add esp, 4
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0xcd0], 0xffffffff
lea ecx, [esp + 0x34]
call fcn.100e6454
xor eax, eax
jmp 0x1000fe36
mov ecx, dword [esp + 0x18]
cmp ecx, ebx
je 0x1000fa7c
mov esi, dword [esp + 0x1c]
mov edx, esi
sub edx, ecx
mov eax, 0x66666667
imul edx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x1000fa89
call fcn.100f6196
mov esi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x50]
cmp dword [edx + ecx + 0x24], 1
jne 0x1000fba4
cmp dword [esp + 0x28], ebx
je 0x1000fabd
mov edx, dword [esp + 0x2c]
sub edx, dword [esp + 0x28]
mov eax, 0x38e38e39
imul edx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [esp + 0x60], eax
jb 0x1000faca
call fcn.100f6196
mov esi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
cmp ecx, ebx
mov eax, dword [esp + 0x60]
mov edx, dword [esp + 0x28]
lea eax, [eax + eax*8]
lea eax, [edx + eax*4]
mov dword [esp + 0x68], eax
je 0x1000faf9
mov edx, esi
sub edx, ecx
mov eax, 0x66666667
imul edx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x1000fb06
call fcn.100f6196
mov esi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x50]
add edx, ecx
cmp ecx, ebx
mov dword [esp + 0x48], edx
je 0x1000fb2b
sub esi, ecx
mov eax, 0x66666667
imul esi
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x1000fb34
call fcn.100f6196
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x68]
mov dl, byte [eax + 0x20]
mov eax, dword [esp + 0x48]
sub dl, byte [eax + 0x20]
mov eax, dword [esp + 0x50]
mov ecx, dword [eax + ecx + 0x20]
mov eax, dword [esp + 0x70]
sub dl, 1
mov byte [eax + ecx], dl
test edx, edx
mov edi, dword [esp + 0x28]
mov esi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
cmp edi, ebx
je 0x1000fcaf
mov eax, dword [esp + 0x2c]
sub eax, edi
mov edx, eax
mov eax, 0x38e38e39
imul edx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [esp + 0x60], eax
jne 0x1000fb95
cmp dword [0x1018f498], ebx
jne 0x1000fcb6
add dword [esp + 0x58], 1
add dword [esp + 0x50], 0x28
jmp 0x1000f797
cmp ecx, ebx
je 0x1000fbc1
mov edx, esi
sub edx, ecx
mov eax, 0x66666667
imul edx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x1000fbce
call fcn.100f6196
mov esi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x50]
cmp dword [edx + ecx + 0x24], ebp
jne 0x1000fc9e
cmp dword [esp + 0x28], ebx
je 0x1000fc01
mov edx, dword [esp + 0x2c]
sub edx, dword [esp + 0x28]
mov eax, 0x38e38e39
imul edx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [esp + 0x60], eax
jb 0x1000fc0e
call fcn.100f6196
mov esi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
cmp ecx, ebx
mov eax, dword [esp + 0x60]
mov edx, dword [esp + 0x28]
lea eax, [eax + eax*8]
lea eax, [edx + eax*4]
mov dword [esp + 0x68], eax
je 0x1000fc3d
mov edx, esi
sub edx, ecx
mov eax, 0x66666667
imul edx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x1000fc4a
call fcn.100f6196
mov esi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x50]
add edx, ecx
cmp ecx, ebx
mov dword [esp + 0x48], edx
je 0x1000fc6f
sub esi, ecx
mov eax, 0x66666667
imul esi
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x1000fc78
call fcn.100f6196
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x68]
mov edx, dword [eax + 0x20]
mov eax, dword [esp + 0x48]
sub edx, dword [eax + 0x20]
mov eax, dword [esp + 0x50]
mov ecx, dword [eax + ecx + 0x20]
mov eax, dword [esp + 0x70]
sub edx, ebp
mov dword [eax + ecx], edx
mov ebp, ebp
jmp 0x1000fb56
mov edi, dword [esp + 0x28]
jmp 0x1000fb62
mov esi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
xor eax, eax
jmp 0x1000fb83
test eax, 0x2258
mov byte [esp + 0x200], 0xce
mov byte [esp + 0x201], 0xde
mov byte [esp + 0x202], 0xd0
mov byte [esp + 0x203], 0xa7
mov byte [esp + 0x204], 0xb5
mov byte [esp + 0x205], 0xc4
mov byte [esp + 0x206], 0xcc
mov byte [esp + 0x207], 0xf8
mov byte [esp + 0x208], 0xd7
mov byte [esp + 0x209], 0xaa
mov byte [esp + 0x20a], 0x4c
mov byte [esp + 0x20b], 0x61
mov byte [esp + 0x20c], 0x62
mov byte [esp + 0x20d], 0x65
mov byte [esp + 0x20e], 0x6c
mov byte [esp + 0x20f], 0x5b
mov byte [esp + 0x210], 0x25
mov byte [esp + 0x211], 0x73
mov byte [esp + 0x212], 0x5d
mov byte [esp + 0x213], bl
test cl, cl
mov esi, dword [esp + 0x18]
cmp esi, ebx
mov edi, dword [esp + 0x58]
je 0x1000fd83
mov ecx, dword [esp + 0x1c]
sub ecx, esi
mov eax, 0x66666667
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jb 0x1000fd8c
call fcn.100f6196
mov esi, dword [esp + 0x18]
lea ecx, [edi + edi*4]
lea edx, [esi + ecx*8]
push edx
lea eax, [esp + 0x204]
push eax
lea ecx, [esp + 0x4cc]
push ecx
call fcn.100f5cb0
add esp, 0xc
test ch, ch
push 0x10010
push 0x101597f0
lea edx, [esp + 0x4cc]
push edx
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ah, ah
jmp 0x1000f9f3
mov eax, dword [esp + 0x5c]
sub eax, dword [esp + 0x70]
mov esi, eax
mov byte [esp + 0xcd0], 1
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x1000fdf0
push eax
call fcn.100e2dad
add esp, 4
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov byte [esp + 0xcd0], bl
mov eax, dword [esp + 0x28]
cmp eax, ebx
je 0x1000fe14
push eax
call fcn.100e2dad
add esp, 4
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0xcd0], 0xffffffff
lea ecx, [esp + 0x34]
call fcn.100e6454
mov eax, esi
mov ecx, dword [esp + 0xcc8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xcb0]
xor ecx, esp
call fcn.100f43d6
add esp, 0xcc0
ret