Function at 0x10006720
Capabilities:
Check for software breakpoints
Execute shellcode via indirect call

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100acfbc
mov eax, dword fs:[0]
push eax
push ecx
push ebx
sub esp, 0x660
mov eax, dword [0x100d4cc0]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x628], edi
mov eax, dword fs:[0x2c]
mov edx, dword [0x10c4ee44]
mov dword [ebp - 0x634], 0
mov edx, dword [eax + edx*4]
mov eax, dword [0x10c4a9c4]
cmp eax, dword [edx + 4]
jg 0x100073f3
push 0x10c4a994
mov dword [ebp - 0x674], 0x10c4a994
call fcn.10085f24
add esp, 4
test eax, eax
jne 0x10007435
mov eax, dword [0x10c4a9c0]
cmp eax, 0x7fffffff
je 0x1000743c
mov eax, dword [ebp - 0x628]
mov esi, 0x100d4080
mov dword [0x100d4345], 0x10007ad0
xorps xmm0, xmm0
cmp dword [edi + 0x28], 0
mov ecx, 0xa0
mov dword [ebp - 4], 0
cmovne esi, edi
sub esp, 8
mov edi, 0x100d8c78
rep movsd dword es:[edi], dword [esi]
mov eax, dword [eax + 0x38]
movsd qword [esp], xmm0
push str.initializing_hook_search___f___
mov dword [0x100d8cb0], eax
call fcn.100039b0
mov edi, dword [0x100d8cac]
add esp, 0xc
mov edx, 0x208
xor ecx, ecx
mov byte [ebp - 4], 1
mov eax, edi
mov dword [0x100d8efc], edi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
mov dword [ebp - 0x628], ecx
call fcn.1009cfce
mov esi, eax
add esp, 4
mov dword [ebp - 0x63c], esi
test esi, esi
je 0x100068a8
push dword [ebp - 0x628]
push 0
push esi
call sub.msvcrt.dll_memset
add esp, 0xc
mov eax, edi
dec edi
test eax, eax
je 0x100068a0
push 0x1f4
lea eax, [esi + 0x10]
mov dword [esi], 0
push 0
push eax
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
call sub.msvcrt.dll_memset
add esp, 0xc
add esi, 0x208
jmp 0x10006863
mov eax, dword [ebp - 0x63c]
jmp 0x100068aa
xor eax, eax
mov ecx, dword [0x100d8ef8]
or dword [ebp - 0x634], 1
mov dword [0x100d8ef8], eax
test ecx, ecx
je 0x100068f4
push ecx
call fcn.1009cfd7
add esp, 4
jmp 0x100068f4
cmp dword [0x100d8ef8], 0
mov edx, 0x208
mov dword [ebp - 4], 0
jne 0x10006917
mov edi, dword [0x100d8cac]
test edi, edi
jne 0x10006820
xor esi, esi
xor edi, edi
mov dword [ebp - 0x620], esi
mov dword [ebp - 0x648], esi
mov dword [ebp - 0x644], edi
mov dword [ebp - 0x650], esi
mov dword [ebp - 0x640], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov byte [ebp - 4], 3
cmp word [0x100d8cd0], di
je 0x10006a3c
push 0x10
push 0x1000
push 0x100d8cd0
call esi
push eax
lea eax, [ebp - 0x62c]
push eax
call fcn.1007ed50
mov eax, dword [0x100d8c98]
add esp, 0x10
test eax, eax
jne 0x100069ed
mov esi, dword [0x100d8cc0]
mov eax, esi
mov ecx, dword [ebp - 0x62c]
cmp ecx, esi
mov edx, dword [ebp - 0x628]
cmova eax, ecx
mov dword [ebp - 0x61c], esi
cmp eax, edx
jae 0x100069a2
cmp ecx, esi
jbe 0x100069b0
mov esi, ecx
jmp 0x100069a4
mov esi, edx
mov dword [0x100d8cc0], esi
mov dword [ebp - 0x61c], esi
mov esi, dword [0x100d8cc8]
cmp edx, esi
mov eax, esi
cmovb eax, edx
cmp eax, ecx
jbe 0x100069d9
mov ecx, dword [ebp - 0x61c]
cmp edx, esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
jae 0x10006a42
mov dword [0x100d8cc8], edx
jmp 0x10006a42
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [0x100d8cc8], ecx
mov ecx, dword [ebp - 0x61c]
jmp 0x10006a42
cmp eax, 1
jne 0x10006a3c
mov ecx, dword [ebp - 0x62c]
mov edx, dword [ebp - 0x628]
sub edx, ecx
cmp dword [0x100d8cc0], edx
mov esi, edx
cmovb esi, dword [0x100d8cc0]
add esi, ecx
cmp dword [0x100d8cc8], edx
mov dword [ebp - 0x61c], esi
cmovb edx, dword [0x100d8cc8]
add edx, ecx
mov dword [0x100d8cc0], esi
mov ecx, esi
mov dword [0x100d8cc8], edx
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
jmp 0x10006a42
mov ecx, dword [0x100d8cc0]
cmp word [0x100d8dc0], 0
je 0x10006aba
push 0x100d8dc0
call esi
push eax
lea eax, [ebp - 0x668]
push eax
call fcn.100075b0
mov ecx, eax
add esp, 8
lea eax, [ebp - 0x648]
cmp eax, ecx
je 0x10006aa9
mov eax, dword [ecx]
mov edi, dword [ecx + 4]
mov dword [ebp - 0x620], eax
mov dword [ebp - 0x648], eax
mov eax, dword [ecx + 8]
mov dword [ebp - 0x644], edi
mov dword [ebp - 0x650], eax
mov dword [ebp - 0x640], eax
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
lea ecx, [ebp - 0x668]
call fcn.100066a0
mov ecx, dword [0x100d8cc0]
cmp word [0x100d8cd0], 0
je 0x10006b21
push 0x100d8cd0
call esi
push eax
lea eax, [ebp - 0x668]
push eax
call fcn.100075b0
lea eax, [ebp - 0x668]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0x648]
push eax
call fcn.10007e20
add esp, 0x10
lea ecx, [ebp - 0x668]
call fcn.100066a0
mov eax, dword [ebp - 0x640]
mov edi, dword [ebp - 0x644]
mov ecx, dword [0x100d8cc0]
mov dword [ebp - 0x650], eax
mov eax, dword [ebp - 0x648]
mov dword [ebp - 0x620], eax
xor eax, eax
xor esi, esi
mov dword [ebp - 0x61c], eax
mov dword [ebp - 0x65c], eax
mov dword [ebp - 0x658], esi
mov dword [ebp - 0x64c], eax
mov dword [ebp - 0x654], eax
mov edx, dword [0x100d8c9c]
mov byte [ebp - 4], 5
test edx, edx
jne 0x10006da8
push dword [0x100d8cc8]
movzx eax, word [0x100d8ca0]
push ecx
push 0x10
push eax
lea eax, [ebp - 0x668]
push 0x100d8c78
push eax
call fcn.1007f010
mov ecx, eax
add esp, 0x18
lea eax, [ebp - 0x65c]
cmp eax, ecx
jne 0x10006d40
lea ecx, [ebp - 0x668]
call fcn.100066a0
xor edx, edx
mov ecx, edx
mov dword [ebp - 0x634], edx
cmp ecx, esi
je 0x10006c00
mov eax, dword [ebp - 0x620]
nop dword [eax]
mov ecx, dword [ecx]
push ecx
push edi
push eax
mov dword [ebp - 0x628], ecx
mov dword [ebp - 0x63c], ecx
call fcn.10085d50
cmp eax, edi
jne 0x10006be7
cmp edi, dword [ebp - 0x650]
je 0x10006f2a
mov eax, dword [ebp - 0x628]
mov dword [edi], eax
add edi, 4
mov dword [ebp - 0x644], edi
mov eax, dword [ebp - 0x620]
mov ecx, dword [ebp - 0x634]
add ecx, 4
mov dword [ebp - 0x634], ecx
cmp ecx, esi
jne 0x10006bb0
push 0x10
push 0x1000
push str.LunaHook32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
lea eax, [ebp - 0x670]
push eax
call fcn.1007ed50
mov ecx, dword [ebp - 0x620]
add esp, 0x10
mov eax, ecx
cmp eax, edi
je 0x10006c74
mov edx, dword [ebp - 0x670]
mov esi, dword [eax]
cmp esi, edx
jbe 0x10006c42
cmp esi, dword [ebp - 0x66c]
jb 0x10006c49
add eax, 4
cmp eax, edi
jne 0x10006c34
cmp eax, edi
je 0x10006c74
lea edx, [eax + 4]
cmp edx, edi
je 0x10006c72
mov esi, dword [edx]
cmp esi, dword [ebp - 0x670]
jbe 0x10006c66
cmp esi, dword [ebp - 0x66c]
jb 0x10006c6b
mov dword [eax], esi
add eax, 4
add edx, 4
cmp edx, edi
jne 0x10006c54
cmp eax, edi
cmovne edi, eax
mov eax, edi
mov dword [ebp - 0x644], edi
sub eax, ecx
sar eax, 2
mov esi, eax
mov dword [ebp - 0x630], eax
shl esi, 4
push 4
sub esi, eax
push 0x1000
add esi, esi
push esi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0x100d8c00
push 0x40
push esi
push eax
mov dword [ebp - 0x63c], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
xor ecx, ecx
xor eax, eax
xor esi, esi
mov dword [ebp - 0x628], ecx
mov dword [ebp - 0x668], ecx
mov dword [ebp - 0x664], esi
mov dword [ebp - 0x634], eax
mov dword [ebp - 0x660], eax
mov byte [ebp - 4], 6
cmp dword [ebp - 0x630], eax
jbe 0x1000706d
mov eax, dword [ebp - 0x63c]
xor edi, edi
mov dword [ebp - 0x624], eax
nop word [eax + eax]
lea ecx, [ebp - 0x638]
push ecx
push eax
mov eax, dword [ebp - 0x620]
push dword [eax + edi*4]
call fcn.1007a7c0
test eax, eax
je 0x10006f85
mov dword [ebp - 0x628], edi
cmp esi, dword [ebp - 0x634]
je 0x10006f60
mov dword [esi], edi
add esi, 4
mov dword [ebp - 0x664], esi
jmp 0x10006f85
mov eax, dword [ecx]
mov esi, dword [ecx + 4]
mov dword [ebp - 0x61c], eax
mov dword [ebp - 0x65c], eax
mov eax, dword [ecx + 8]
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
lea ecx, [ebp - 0x668]
mov dword [ebp - 0x658], esi
mov dword [ebp - 0x64c], eax
mov dword [ebp - 0x654], eax
call fcn.100066a0
mov edx, dword [ebp - 0x61c]
mov ecx, edx
cmp edx, esi
je 0x10006b97
mov eax, dword [0x100d8ca4]
add dword [ecx], eax
add ecx, 4
cmp ecx, esi
jne 0x10006d95
jmp 0x10006b97
cmp edx, 1
jne 0x10006e5a
cmp ecx, dword [0x100d8cc8]
jae 0x10006b95
lea edi, [ecx + 4]
jmp 0x10006dd6
mov eax, dword [ebp - 0x64c]
mov ecx, dword [edi - 4]
cmp ecx, 0xcccccccc
je 0x10006de9
cmp ecx, 0x90909090
jne 0x10006e31
mov cl, byte [edi]
cmp cl, 0xcc
je 0x10006e31
cmp cl, 0x90
je 0x10006e31
mov dword [ebp - 0x628], edi
cmp esi, eax
je 0x10006e0c
mov dword [esi], edi
add esi, 4
mov dword [ebp - 0x658], esi
jmp 0x10006e31
lea eax, [ebp - 0x628]
push eax
push esi
lea ecx, [ebp - 0x65c]
call fcn.10006480
mov eax, dword [ebp - 0x654]
mov esi, dword [ebp - 0x658]
mov dword [ebp - 0x64c], eax
inc edi
lea eax, [edi - 4]
cmp eax, dword [0x100d8cc8]
jb 0x10006dd0
mov edi, dword [ebp - 0x65c]
mov dword [ebp - 0x61c], edi
mov edi, dword [ebp - 0x644]
mov edx, dword [ebp - 0x61c]
jmp 0x10006b97
cmp edx, 2
jne 0x10006b95
mov edx, ecx
mov dword [ebp - 0x624], ecx
cmp edx, dword [0x100d8cc8]
jae 0x10006b95
xor edi, edi
nop dword [eax]
cmp byte [edx], 0xe8
jne 0x10006f00
mov eax, dword [edx + 1]
add eax, 5
add eax, edx
mov dword [ebp - 0x628], eax
cmp ecx, eax
jae 0x10006f00
cmp dword [0x100d8cc8], eax
jbe 0x10006f00
push eax
push esi
push dword [ebp - 0x61c]
call fcn.10085d50
mov eax, dword [ebp - 0x628]
mov dword [ebp - 0x628], eax
cmp esi, edi
je 0x10006ec9
mov dword [esi], eax
add esi, 4
mov dword [ebp - 0x658], esi
jmp 0x10006ef4
lea eax, [ebp - 0x628]
push eax
push esi
lea ecx, [ebp - 0x65c]
call fcn.10006480
mov ecx, dword [ebp - 0x65c]
mov edi, dword [ebp - 0x654]
mov esi, dword [ebp - 0x658]
mov dword [ebp - 0x61c], ecx
mov edx, dword [ebp - 0x624]
mov ecx, dword [0x100d8cc0]
inc edx
mov dword [ebp - 0x624], edx
cmp edx, dword [0x100d8cc8]
jb 0x10006e80
mov edx, dword [ebp - 0x61c]
mov dword [ebp - 0x64c], edi
mov edi, dword [ebp - 0x644]
jmp 0x10006b97
lea eax, [ebp - 0x63c]
push eax
push edi
lea ecx, [ebp - 0x648]
call fcn.10006480
mov eax, dword [ebp - 0x640]
mov edi, dword [ebp - 0x644]
mov dword [ebp - 0x650], eax
mov eax, dword [ebp - 0x648]
mov dword [ebp - 0x620], eax
jmp 0x10006bed
lea eax, [ebp - 0x628]
push eax
push esi
lea ecx, [ebp - 0x668]
call fcn.10006480
mov eax, dword [ebp - 0x660]
mov esi, dword [ebp - 0x664]
mov dword [ebp - 0x634], eax
mov eax, dword [ebp - 0x620]
push dword [eax + edi*4]
call fcn.1007aa80
mov ecx, dword [ebp - 0x624]
movups xmm0, xmmword [0x100d4338]
movups xmmword [ecx], xmm0
movq xmm0, qword [0x100d4348]
movq qword [ecx + 0x10], xmm0
mov eax, dword [0x100d4350]
mov dword [ecx + 0x18], eax
mov ax, word [0x100d4354]
mov word [ecx + 0x1c], ax
mov eax, dword [ebp - 0x620]
mov eax, dword [eax + edi*4]
mov dword [ecx + 3], eax
mov eax, dword [ebp - 0x638]
mov dword [ecx + 0x19], eax
mov eax, 0x68db8bad
imul edi
mov ecx, edi
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
imul eax, eax, 0x9c4
sub ecx, eax
jne 0x1000703f
mov eax, dword [ebp - 0x630]
sub esp, 8
movd xmm1, edi
cvtdq2pd xmm1, xmm1
movd xmm0, eax
mulsd xmm1, qword [0x100b8b70]
shr eax, 0x1f
cvtdq2pd xmm0, xmm0
addsd xmm0, qword [eax*8 + 0x100b8b80]
divsd xmm1, xmm0
addsd xmm1, qword [0x100b8b68]
movsd qword [esp], xmm1
push str.initializing_hook_search___f___
call fcn.100039b0
add esp, 0xc
mov eax, dword [ebp - 0x624]
inc edi
add eax, 0x1e
mov dword [ebp - 0x624], eax
cmp edi, dword [ebp - 0x630]
jb 0x10006d00
mov ecx, dword [ebp - 0x668]
mov edi, dword [ebp - 0x644]
mov dword [ebp - 0x628], ecx
sub esi, ecx
sar esi, 2
test esi, esi
je 0x100070bc
lea eax, [esi - 1]
lea eax, [ecx + eax*4]
mov dword [ebp - 0x630], eax
mov eax, dword [eax]
mov ecx, dword [ebp - 0x620]
lea edx, [ecx + eax*4]
mov eax, edi
lea ecx, [edx + 4]
sub eax, ecx
push eax
push ecx
push edx
call sub.msvcrt.dll_memmove
mov eax, dword [ebp - 0x630]
add esp, 0xc
sub eax, 4
sub edi, 4
mov dword [ebp - 0x630], eax
sub esi, 1
jne 0x10007082
mov dword [ebp - 0x644], edi
mov esi, dword [ebp - 0x620]
mov eax, edi
sub eax, esi
sar eax, 2
push eax
push str.initialized_hook_search_with__zd_hooks
call fcn.100039b0
add esp, 8
call fcn.1007a6f0
push str.starting_hook_search
call fcn.100039b0
mov eax, 0x10624dd3
imul dword [0x100d8ca8]
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
push str.please_click_around_in_the_game_to_force_it_to_process_text_during_the_next__d_seconds
call fcn.100039b0
add esp, 0xc
push dword [0x100d8ca8]
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, esi
mov dword [ebp - 0x638], eax
cmp eax, edi
je 0x10007135
push dword [esi]
call fcn.1007aa60
add esi, 4
cmp esi, edi
jne 0x10007121
mov esi, dword [ebp - 0x620]
call fcn.1007a6f0
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, edi
je 0x1000715e
nop dword [eax]
push dword [esi]
call fcn.1007aaa0
add esi, 4
cmp esi, edi
jne 0x10007150
mov eax, dword [0x100d8cac]
sub eax, dword [0x100d8efc]
push eax
push str.hook_search_finished___d_results_found
call fcn.100039b0
mov esi, dword [0x100d8ef8]
xor edx, edx
xor ecx, ecx
mov dword [ebp - 0x624], edx
add esp, 8
cmp dword [0x100d8cac], ecx
jle 0x100072bc
xor edi, edi
mov dword [ebp - 0x638], edi
nop dword [eax + eax]
mov eax, dword [edi + esi]
or eax, dword [edi + esi + 4]
je 0x1000729d
inc ecx
mov eax, 0x14f8b589
imul ecx
mov dword [ebp - 0x630], ecx
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
imul eax, eax, 0x186a0
sub ecx, eax
jne 0x100071e8
push dword [ebp - 0x630]
push str._d_results_processed
call fcn.100039b0
mov esi, dword [0x100d8ef8]
add esp, 8
push 0x5f8
lea eax, [ebp - 0x618]
push 0
push eax
call sub.msvcrt.dll_memset
mov eax, dword [edi + esi + 0xc]
add esp, 0xc
mov dword [ebp - 0x610], eax
mov dword [ebp - 0x498], 3
mov dword [ebp - 0x494], 0
mov eax, dword [edi + esi]
mov ecx, dword [edi + esi + 4]
mov dword [ebp - 0x618], eax
mov dword [ebp - 0x614], ecx
mov eax, dword [edi + esi + 8]
mov dword [ebp - 0x488], eax
mov eax, dword [0x100d8cb0]
mov dword [ebp - 0x490], eax
mov eax, dword [0x100d8ef0]
test eax, eax
je 0x1000725f
lea ecx, [ebp - 0x618]
push ecx
call eax
mov esi, dword [0x100d8ef8]
add esp, 4
lea eax, [esi + 0x10]
mov ecx, 0x17e
add eax, edi
lea esi, [ebp - 0x618]
push eax
sub esp, 0x5f8
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.10003df0
mov esi, dword [0x100d8ef8]
add esp, 0x5fc
mov edi, dword [ebp - 0x638]
mov ecx, dword [ebp - 0x630]
mov edx, dword [ebp - 0x624]
inc edx
add edi, 0x208
mov dword [ebp - 0x624], edx
mov dword [ebp - 0x638], edi
cmp edx, dword [0x100d8cac]
jl 0x100071a0
mov dword [0x100d8ef8], 0
test esi, esi
je 0x100072d3
push esi
call fcn.1009cfd7
add esp, 4
push 0x8000
push 0
push dword [ebp - 0x63c]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [ebp - 0x628]
xor eax, eax
mov ecx, 0xb71a9
mov edi, 0x10691c48
xorps xmm0, xmm0
mov esi, 0x100d8f00
movlpd qword [0x100d8f00], xmm0
rep stosd dword es:[edi], eax
mov ecx, 0x16e350
mov edi, 0x100d8f08
rep movsd dword es:[edi], dword [esi]
test edx, edx
je 0x1000734d
mov ecx, dword [ebp - 0x634]
mov eax, edx
sub ecx, edx
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x10007343
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10007449
push ecx
push edx
call fcn.1009cf8f
add esp, 8
mov edx, dword [ebp - 0x61c]
test edx, edx
je 0x1000738a
mov ecx, dword [ebp - 0x64c]
mov eax, edx
sub ecx, edx
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x10007380
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10007449
push ecx
push edx
call fcn.1009cf8f
add esp, 8
mov ecx, dword [ebp - 0x620]
test ecx, ecx
je 0x100073c7
mov edx, dword [ebp - 0x650]
mov eax, ecx
sub edx, ecx
and edx, 0xfffffffc
cmp edx, 0x1000
jb 0x100073bd
mov ecx, dword [eax - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10007449
push edx
push ecx
call fcn.1009cf8f
add esp, 8
push dword [ebp - 0x674]
call fcn.10085f35
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1009cf9d
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push 0x10c4a9c4
call fcn.1009d058
add esp, 4
cmp dword [0x10c4a9c4], 0xffffffff
jne 0x10006797
push 2
push 0x10c4a994
call fcn.10085f08
push 0x100b33c0
call fcn.1009ce09
push 0x10c4a9c4
call fcn.1009d007
add esp, 0x10
jmp 0x10006797
push 5
call fcn.10086305
dec eax
push 6
mov dword [0x10c4a9c0], eax
call fcn.10086305
call fcn.1009e480
int3