Function at 0x1000d512
Capabilities:
Extract resource via kernel32 functions
Log keystrokes via polling
Resolve function by parsing pe exports
Resume thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100710ec
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xf8
push ebx
mov eax, 0xad72
mov dword [esp + 0xac], ecx
mov dword [esp + 0x50], eax
xor ebx, ebx
mov dword [esp + 0x54], eax
push esi
mov dword [esp + 0x5c], eax
push edi
mov dword [esp + 0x64], eax
mov edi, edx
mov dword [esp + 0x1c], 0xe730
mov dword [esp + 0x10], 2
push 1
mov dword [esp + 0x58], edi
pop esi
cmp dword [esp + 0x58], ebx
jne 0x1000d5d2
mov eax, dword [esp + 0x64]
cmp eax, dword [esp + 0x58]
jge 0x1000d58b
cmp dword [esp + 0x58], ebx
jne 0x1000d58b
mov ecx, ebx
cmp dword [esp + 0x60], ebx
je 0x1000d58d
mov ecx, esi
mov eax, dword [esp + 0x58]
xor edx, edx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x60]
cmp ecx, eax
mov eax, dword [esp + 0x58]
setle dl
xor ecx, ecx
cmp edx, eax
setle cl
xor edx, edx
imul eax, ecx, 0xf157
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
cmp eax, ecx
mov eax, dword [esp + 0x58]
setle dl
sub edx, eax
cmp edx, dword [esp + 0x5c]
mov edx, ebx
jne 0x1000d5d4
mov edx, esi
mov eax, dword [esp + 0x64]
xor ecx, ecx
cmp edx, eax
setg cl
lea eax, [ecx - 0x55073046]
cmp eax, dword [esp + 0x60]
je 0x1000d5f3
mov edx, ebx
cmp dword [esp + 0x58], ebx
je 0x1000d5f5
mov edx, esi
mov eax, dword [esp + 0x58]
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x58]
setge cl
sub ecx, eax
cmp ecx, dword [esp + 0x58]
mov byte [esp + 0x17], bl
jle 0x1000db15
cmp byte [esp + 0x17], bl
je 0x1000d62f
push 0x3cd
push 0x2104
push 0x2438
call dword [sym.imp.USER32.dll_CheckDlgButton]
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x10], 0xfffffff5
jne 0x1000db2e
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1000d650
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [esp + 0x24], 0x1526
cmp dword [esp + 0x24], 0x761
jge 0x1000daef
call fcn.100586a5
push eax
push 0x1000b204
push 0x1000b208
call fcn.10058e0f
add esp, 0xc
call fcn.100586a5
add eax, 0x20
push eax
push 0x1000b210
push 0x1000b214
call fcn.10058e0f
add esp, 0xc
mov dword [esp + 0x3c], 0xf
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
mov dword [esp + 0x10c], ebx
mov word [esp + 0x91], 0x100
mov byte [esp + 0x90], 1
mov word [esp + 0x94], 0
mov byte [esp + 0x93], bl
mov word [esp + 0x97], 0x101
mov byte [esp + 0x96], 1
mov word [esp + 0x9a], 0x101
mov byte [esp + 0x99], 1
mov word [esp + 0x9d], 1
mov byte [esp + 0x9c], bl
mov word [esp + 0xa0], 0x101
mov byte [esp + 0x9f], 1
mov dword [esp + 0xa3], 0x10101
mov byte [esp + 0xa2], 1
mov dword [esp + 0xa7], 0x1010100
mov word [esp + 0xac], 0x101
mov byte [esp + 0xab], 1
mov dword [esp + 0x68], 0x1010101
mov dword [esp + 0x6c], 0x1000100
mov dword [esp + 0x70], 0x10100
mov dword [esp + 0x74], 0x1000100
mov dword [esp + 0x78], 0x1000101
mov dword [esp + 0x7c], 0x1000001
mov dword [esp + 0x80], 0x1010001
mov dword [esp + 0x84], 0x1000100
mov dword [esp + 0x88], 0x1010101
mov dword [esp + 0x8c], 0x1000101
jmp 0x1000daaf
cmp dword [esp + 0x38], 0
mov edi, ebx
jbe 0x1000d833
test edi, edi
je 0x1000d7c4
mov dl, 0x20
mov ecx, 0x106635f8
call fcn.10016429
mov dl, 0x20
mov ecx, 0x106635f8
call fcn.10016429
cmp dword [esp + 0x3c], 0x10
lea eax, [esp + 0x28]
cmovae eax, dword [esp + 0x28]
movsx eax, byte [eax + edi]
sub eax, 0x30
imul eax, eax, 3
cmp byte [esp + eax + 0x90], 0
je 0x1000d809
test esi, esi
jle 0x1000d81e
mov ebx, esi
mov dl, 0x2d
mov ecx, 0x106635f8
call fcn.10016429
dec ebx
jne 0x1000d7f8
jmp 0x1000d81e
test esi, esi
jle 0x1000d81e
mov ebx, esi
mov dl, 0x20
mov ecx, 0x106635f8
call fcn.10016429
dec ebx
jne 0x1000d80f
mov dl, 0x20
mov ecx, 0x106635f8
call fcn.10016429
inc edi
cmp edi, dword [esp + 0x38]
jb 0x1000d7b4
xor ebx, ebx
push 0x106635f8
call fcn.100165df
pop ecx
test esi, esi
jle 0x1000d8e0
mov dword [esp + 0x18], esi
cmp dword [esp + 0x38], 0
mov edi, ebx
jbe 0x1000d8cb
mov ebx, 0x106635f8
test edi, edi
je 0x1000d865
mov dl, 0x20
mov ecx, ebx
call fcn.10016429
cmp dword [esp + 0x3c], 0x10
lea eax, [esp + 0x28]
mov ecx, ebx
mov dl, 0x7c
cmovae eax, dword [esp + 0x28]
movsx eax, byte [eax + edi]
cmp byte [esp + eax*4 - 0x58], 0
jne 0x1000d885
add dl, 0xa4
call fcn.10016429
mov ebx, esi
mov dl, 0x20
mov ecx, 0x106635f8
call fcn.10016429
dec ebx
jne 0x1000d88c
cmp dword [esp + 0x3c], 0x10
lea eax, [esp + 0x28]
mov ecx, 0x106635f8
mov dl, 0x7c
cmovae eax, dword [esp + 0x28]
movsx eax, byte [eax + edi]
cmp byte [esp + eax*4 - 0x57], bl
jne 0x1000d8bd
add dl, 0xa4
call fcn.10016429
inc edi
cmp edi, dword [esp + 0x38]
jb 0x1000d853
xor ebx, ebx
push 0x106635f8
call fcn.100165df
dec dword [esp + 0x1c]
pop ecx
jne 0x1000d84a
cmp dword [esp + 0x38], 0
mov edi, ebx
jbe 0x1000d968
test edi, edi
je 0x1000d8f9
mov dl, 0x20
mov ecx, 0x106635f8
call fcn.10016429
mov dl, 0x20
mov ecx, 0x106635f8
call fcn.10016429
cmp dword [esp + 0x3c], 0x10
lea eax, [esp + 0x28]
cmovae eax, dword [esp + 0x28]
movsx eax, byte [eax + edi]
sub eax, 0x30
imul eax, eax, 3
cmp byte [esp + eax + 0x91], 0
je 0x1000d93e
test esi, esi
jle 0x1000d953
mov ebx, esi
mov dl, 0x2d
mov ecx, 0x106635f8
call fcn.10016429
dec ebx
jne 0x1000d92d
jmp 0x1000d953
test esi, esi
jle 0x1000d953
mov ebx, esi
mov dl, 0x20
mov ecx, 0x106635f8
call fcn.10016429
dec ebx
jne 0x1000d944
mov dl, 0x20
mov ecx, 0x106635f8
call fcn.10016429
inc edi
cmp edi, dword [esp + 0x38]
jb 0x1000d8e9
xor ebx, ebx
push 0x106635f8
call fcn.100165df
pop ecx
test esi, esi
jle 0x1000da15
mov dword [esp + 0x18], esi
cmp dword [esp + 0x38], 0
mov edi, ebx
jbe 0x1000da00
mov ebx, 0x106635f8
test edi, edi
je 0x1000d99a
mov dl, 0x20
mov ecx, ebx
call fcn.10016429
cmp dword [esp + 0x3c], 0x10
lea eax, [esp + 0x28]
mov ecx, ebx
mov dl, 0x7c
cmovae eax, dword [esp + 0x28]
movsx eax, byte [eax + edi]
cmp byte [esp + eax*4 - 0x56], 0
jne 0x1000d9ba
add dl, 0xa4
call fcn.10016429
mov ebx, esi
mov dl, 0x20
mov ecx, 0x106635f8
call fcn.10016429
dec ebx
jne 0x1000d9c1
cmp dword [esp + 0x3c], 0x10
lea eax, [esp + 0x28]
mov ecx, 0x106635f8
mov dl, 0x7c
cmovae eax, dword [esp + 0x28]
movsx eax, byte [eax + edi]
cmp byte [esp + eax*4 - 0x55], bl
jne 0x1000d9f2
add dl, 0xa4
call fcn.10016429
inc edi
cmp edi, dword [esp + 0x38]
jb 0x1000d988
xor ebx, ebx
push 0x106635f8
call fcn.100165df
dec dword [esp + 0x1c]
pop ecx
jne 0x1000d97f
cmp dword [esp + 0x38], 0
mov edi, ebx
jbe 0x1000da9d
test edi, edi
je 0x1000da2e
mov dl, 0x20
mov ecx, 0x106635f8
call fcn.10016429
mov dl, 0x20
mov ecx, 0x106635f8
call fcn.10016429
cmp dword [esp + 0x3c], 0x10
lea eax, [esp + 0x28]
cmovae eax, dword [esp + 0x28]
movsx eax, byte [edi + eax]
sub eax, 0x30
imul eax, eax, 3
cmp byte [esp + eax + 0x92], 0
je 0x1000da73
test esi, esi
jle 0x1000da88
mov ebx, esi
mov dl, 0x2d
mov ecx, 0x106635f8
call fcn.10016429
dec ebx
jne 0x1000da62
jmp 0x1000da88
test esi, esi
jle 0x1000da88
mov ebx, esi
mov dl, 0x20
mov ecx, 0x106635f8
call fcn.10016429
dec ebx
jne 0x1000da79
mov dl, 0x20
mov ecx, 0x106635f8
call fcn.10016429
inc edi
cmp edi, dword [esp + 0x38]
jb 0x1000da1e
xor ebx, ebx
push 0x106635f8
call fcn.100165df
pop ecx
push eax
call fcn.100165df
pop ecx
lea eax, [esp + 0xb0]
mov ecx, 0x106636b0
push eax
call fcn.100117e1
lea edx, [esp + 0x28]
mov ecx, eax
call fcn.10017334
mov esi, dword [esp + 0xb0]
test esi, esi
jne 0x1000d7ab
or dword [esp + 0x10c], 0xffffffff
lea ecx, [esp + 0x28]
push ebx
inc esi
push esi
call fcn.10012648
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1000db00
call dword [sym.imp.KERNEL32.dll_GetACP]
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xfffffff5
je 0x1000d63e
mov edi, dword [esp + 0x54]
jmp 0x1000db2e
cmp byte [esp + 0x17], bl
je 0x1000db26
push 0xf2
call dword [sym.imp.USER32.dll_GetMenu]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x10], eax
mov dword [esp + 0x10], 5
mov dword [esp + 0x50], 0x4e79
mov dword [esp + 0x10], 0xffffffe3
jmp 0x1000db62
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1000db5e
push 0x363
call dword [sym.imp.USER32.dll_GetKeyState]
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0xfffffff3
je 0x1000db48
mov dword [esp + 0x40], 0x17571177
lea ecx, [esp + 0xd4]
mov dword [esp + 0xb8], 0xe2c0d37a
mov dword [esp + 0x10], 0xe0cf5720
mov dword [esp + 0x50], 0xffffffff
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x24], ebx
push 3
call fcn.10011f61
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x20], esi
mov dword [esp + 0x10], ebx
jmp 0x1000dbce
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xd4]
mov dword [eax + ecx*4], 0xccbad86e
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x1000dbb8
inc dword [esp + 0x18]
mov dword [esp + 0x10], 2
cmp dword [esp + 0x10], ebx
jl 0x1000dc41
mov dword [esp + 0x18], 0x7223b16a
xor ecx, ecx
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x24]
neg eax
cmp eax, 0x475ee4c2
mov eax, dword [esp + 0xd4]
setne cl
mov dword [eax + edx*4], ecx
xor edx, edx
mov dword [esp + 0x20], 0xffff
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
cmp eax, ecx
mov eax, dword [esp + 0x20]
setne dl
xor ecx, ecx
cmp eax, edx
setg cl
mov dword [esp + 0x18], ecx
dec dword [esp + 0x10]
jns 0x1000dbe7
cmp dword [esp + 0xd4], 0
je 0x1000dc6d
push dword [esp + 0xd4]
call fcn.10058d37
pop ecx
mov dword [esp + 0xd4], ebx
mov dword [esp + 0xd8], ebx
mov dword [esp + 0xdc], ebx
mov dword [esp + 0xe0], 0xffffffff
mov dword [esp + 0x10], ebx
mov dword [esp + 0x24], 4
mov dword [esp + 0x50], 0xfffffff8
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1000dc9e
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp dword [esp + 0x10], ebx
jne 0x1000dcec
mov eax, dword [esp + 0x10]
cmp eax, dword [esp + 0x10]
jg 0x1000dcb6
mov eax, esi
cmp dword [esp + 0x10], ebx
jne 0x1000dcb8
mov eax, ebx
cmp eax, dword [esp + 0x10]
jne 0x1000dcc2
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
or ecx, 0xffffffff
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
sub ecx, eax
imul ecx, dword [esp + 0x10]
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x24]
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x10], ebx
jmp 0x1000dd14
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1000dd10
push ebx
call dword [sym.imp.KERNEL32.dll_SetCommBreak]
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xfffffffe
jne 0x1000dcfe
mov dword [esp + 0x24], 0xeab3ae5d
mov dword [esp + 0x40], ebx
jmp 0x1000e144
push dword [esp + 0xb4]
movdqa xmm0, xmmword [0x1000b970]
lea eax, [esp + 0x104]
push eax
mov dword [esp + 0x18], 0xe60f
lea eax, [esp + 0xf8]
mov dword [esp + 0x28], 0x9729cf30
lea ecx, [esp + 0xc4]
push eax
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x30], 0xffffffff
push ebx
movdqu xmmword [esp + 0x100], xmm0
mov dword [esp + 0xcc], ebx
mov dword [esp + 0xd0], ebx
mov dword [esp + 0xd4], ebx
call fcn.1001775d
cmp dword [esp + 0x10], ebx
jne 0x1000de30
mov esi, dword [esp + 0x10]
neg esi
sbb esi, esi
inc esi
cmp dword [esp + 0x10], ebx
jle 0x1000ddb4
xor edx, edx
inc edx
jmp 0x1000ddb6
mov edx, ebx
mov eax, dword [esp + 0x10]
add edx, 2
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
sub edx, eax
mov eax, dword [esp + 0x10]
cmp edx, eax
setne cl
dec ecx
jne 0x1000dddd
cmp dword [esp + 0x1c], ebx
jne 0x1000dddd
mov ecx, ebx
jmp 0x1000dde0
xor ecx, ecx
inc ecx
xor eax, eax
mov dword [esp + 0x20], 0x164c
cmp esi, ecx
setge al
xor ecx, ecx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
cmp eax, 0x96e6
mov eax, dword [esp + 0x20]
setg cl
xor edx, edx
cmp eax, ecx
mov eax, dword [esp + 0x10]
setl dl
inc edx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, ebx
setg cl
xor esi, esi
inc esi
cmp ecx, dword [esp + 0x24]
jl 0x1000de32
mov eax, esi
mov ecx, dword [esp + 0x10]
imul ecx, eax
mov eax, dword [esp + 0xbc]
mov dword [eax + 8], ecx
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1000de69
push 0x1eb6
push 0x26c7
push 0x132d
push 0x1bfd
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push dword [esp + 0xbc]
call fcn.10058d37
mov dword [esp + 0xc0], ebx
mov dword [esp + 0xc4], ebx
mov dword [esp + 0xc8], ebx
mov dword [esp + 0xe8], 0x6efba1a4
mov dword [esp + 0x48], 0xf73838a1
mov dword [esp + 0x28], ebx
mov dword [esp + 0x4c], 0xffffffff
mov dword [esp + 0x20], 0x849f845
mov dword [esp + 0x58], 0x7b4bc66
mov dword [esp + 0x1c], 0xb7bededb
mov dword [esp + 0x50], 0xc3938dd4
mov dword [esp + 0x24], ebx
pop ecx
mov dword [esp + 0x10], ebx
jmp 0x1000dee7
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0xe8], 0xfffffff8
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1000ded4
inc dword [esp + 0x44]
xor edx, edx
inc dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
cmp ecx, eax
mov eax, dword [esp + 0x44]
setne dl
xor ecx, ecx
cmp edx, 0xb608
setl cl
xor edx, edx
cmp eax, ecx
mov eax, dword [esp + 0x18]
setge dl
sub eax, 0xf7c2f5a2
neg eax
sbb eax, eax
inc eax
sub eax, edx
add eax, dword [esp + 0x20]
je 0x1000dfaf
mov dword [esp + 0x10], 0xf1e2
mov dword [esp + 0x20], esi
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x4c], ebx
jne 0x1000df4d
mov esi, ebx
mov eax, dword [esp + 0x24]
xor edx, edx
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x44]
cmp eax, ecx
setle dl
imul edx, esi
cmp edx, 0xa9d707d8
sbb eax, eax
neg eax
sub eax, 0x7bfbc35c
je 0x1000df83
cmp dword [esp + 0x20], ebx
je 0x1000df83
xor edx, edx
inc edx
jmp 0x1000df85
mov edx, ebx
mov eax, dword [esp + 0x1c]
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x10]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x10]
setg dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [esp + 0x54], ecx
jmp 0x1000e115
push 2
lea ecx, [esp + 0xcc]
call fcn.10011f61
mov dword [esp + 0x10], 0x8a24e228
mov dword [esp + 0x50], 0xfffffff8
mov dword [esp + 0x10], esi
mov dword [esp + 0x10], ebx
jmp 0x1000dfed
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xc8]
mov dword [eax + ecx*4], 0xb2235412
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1000dfd7
mov eax, dword [esp + 0xe8]
xor edx, edx
mov eax, dword [esp + 0x4c]
mov eax, dword [esp + 0x54]
mov eax, dword [esp + 0x24]
mov esi, dword [esp + 0xc8]
add eax, dword [esi + 4]
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x48]
cmp ecx, eax
mov eax, dword [esp + 0x18]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x18]
setle cl
xor edx, edx
cmp ecx, 0xd68e
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x44]
setle cl
mov dword [esp + 0x48], ecx
xor ecx, ecx
cmp dword [esp + 0x48], eax
setne cl
xor eax, eax
cmp ecx, 0xfffffffe
setle al
cmp dword [esi + 4], eax
jg 0x1000e089
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1000e0f3
push 0x22f8
push 0x2505
push 0x1569
call dword [sym.imp.USER32.dll_SetClassLongA]
jmp 0x1000e0f3
mov dword [esp + 0x48], 0xfffffff8
xor edx, edx
mov dword [esp + 0x18], 9
mov ecx, dword [esp + 0x50]
mov eax, dword [esp + 0x10]
cmp ecx, eax
setle dl
mov dword [esp + 0x10], edx
mov ecx, dword [esp + 0x4c]
mov eax, dword [esp + 0xc8]
mov edx, dword [eax]
mov eax, dword [esp + 0x10]
sub edx, ecx
add eax, edx
xor edx, edx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x10], eax
mov dword [esp + 0x10], 0xa6f2
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
cmp eax, ecx
mov eax, dword [esp + 0x10]
setl dl
xor ecx, ecx
cmp eax, edx
setge cl
mov dword [esp + 0x18], ecx
push dword [esp + 0xc8]
call fcn.10058d37
pop ecx
mov dword [esp + 0xc8], ebx
mov dword [esp + 0xcc], ebx
mov dword [esp + 0xd0], ebx
lea ecx, [esp + 0xb8]
call fcn.1000d10a
lea eax, [esp + 0xe4]
push eax
lea edx, [esp + 0xe4]
lea ecx, [esp + 0xbc]
call fcn.1000d22b
dec dword [esp + 0x44]
pop ecx
push 1
pop esi
cmp dword [esp + 0x40], 0xfffffffe
je 0x1000dd2c
mov eax, edi
mov ecx, 0x3e8
cdq
idiv ecx
mov ecx, dword [esp + 0xb4]
mov edi, edx
mov esi, eax
call fcn.1000d098
mov ecx, dword [esp + 0x104]
add eax, esi
add eax, edi
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret