Function at 0x100f94b3
Capabilities:
Check for time delay via gettickcount
Encode data using xor
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x358
mov eax, dword [0x1016f640]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x208], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20c], eax
mov eax, dword [ebx + 0x164]
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x1d4], esi
mov eax, dword [eax + 0x14]
mov dword [ebx + 0x168], eax
push edi
mov edi, dword [ebp + 0x18]
mov dword [ebp - 0x1b8], edi
test esi, esi
jne 0x100f951b
mov esi, dword [ebx + 0x10c]
mov dword [ebp - 0x1d4], esi
test esi, esi
jne 0x100f951b
push 0xfffffffffffffff8
pop eax
jmp 0x100fb477
mov eax, dword [ebx]
push 1
push 0
push 0x7d9
push ebx
call dword [eax + 0x1c]
mov dword [esi + 0x68], eax
mov eax, dword [ebp - 0x20c]
test eax, eax
jne 0x100f9561
and dword [ebp - 0x94], eax
and dword [ebp - 0x90], eax
mov eax, dword [esi + 0x78]
mov dword [ebp - 0x88], eax
mov eax, dword [esi + 0x74]
mov dword [ebp - 0x90], eax
lea eax, [ebp - 0x94]
mov dword [ebp - 0x20c], eax
cmp dword [ebx + 0x13c], 0
je 0x100f958c
test byte [ebp + 0x1c], 1
jne 0x100f958c
or dword [ebx + 0x158], 0x20000
mov ecx, ebx
push eax
push dword [ebp - 0x208]
call fcn.100b3c7b
push 0xfffffffffffffffe
jmp 0x100f9515
mov ecx, dword [ebp + 0x1c]
xor eax, eax
or dword [ebx + 0x158], 0x40000000
inc eax
shr ecx, 3
and ecx, eax
mov dword [ebp - 0x1bc], eax
mov eax, dword [ebx + 0x164]
mov dword [eax + 0xa4], ecx
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 0x298], eax
xor eax, eax
cmp dword [esi + 0x14], eax
je 0x100fb427
cmp dword [0x1016f14c], eax
jne 0x100f95fe
mov ecx, 0x1016f14c
mov dword [0x1016f14c], eax
mov dword [0x1016f15c], eax
mov dword [0x1016f150], eax
mov dword [0x1016f158], 0x3e8
mov dword [0x1016f160], eax
mov byte [0x1016f164], al
call fcn.100fb9eb
mov eax, dword [esi + 0x14]
mov dword [eax + 0x1c], edi
mov eax, dword [esi + 0x1c]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x10]
mov cl, al
mov eax, dword [ebx + 0x164]
movzx edx, byte [eax + 0x11]
xor eax, eax
test cl, cl
sete al
and edx, eax
mov eax, dword [ebx + 0x164]
shl edx, 0x19
xor edx, dword [ebx + 0x158]
and edx, 0x2000000
xor dword [ebx + 0x158], edx
cmp dword [ebx + 0x2a8], 0
je 0x100f9654
test dword [eax + 0x28], 0x80000
je 0x100f9654
push 2
pop ecx
jmp 0x100f9657
xor ecx, ecx
inc ecx
movss xmm0, dword [eax + 0x9c]
mov dl, 1
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x228], eax
xor eax, eax
mov dword [ebp - 0x214], ecx
movss dword [ebp - 0x238], xmm0
mov byte [ebp - 0x1c5], dl
mov dword [ebp - 0x1c0], eax
test ecx, ecx
jle 0x100fb43a
cmp ecx, 1
jle 0x100f96c4
test eax, eax
jle 0x100f96c4
mov eax, dword [ebx + 0x164]
push ebx
mov dword [eax + 0x14], 9
call fcn.100b3c7b
pop ecx
mov ecx, ebx
call fcn.100ab5b2
test al, al
jne 0x100f96c4
or dword [ebx + 0x15c], 1
and dword [esi + 0x84], 0xfffffffe
mov eax, dword [ebx]
push edi
push esi
push ebx
call dword [eax + 0x34c]
cmp dword [ebp - 0x1c0], 1
jge 0x100f96ed
mov eax, dword [esi + 0x14]
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov dl, al
mov byte [ebp - 0x1c5], dl
jmp 0x100f96f3
mov dl, byte [ebp - 0x1c5]
test dl, dl
je 0x100fb3f6
mov eax, dword [ebx + 0x154]
test eax, eax
je 0x100f970c
mov dword [eax + 0x4c], 1
mov ecx, ebx
call fcn.100ab5b2
mov edx, dword [ebx + 0x158]
movzx ecx, al
mov eax, edx
shr eax, 8
and eax, 1
cmp eax, ecx
je 0x100f97a2
mov eax, dword [ebx + 0xf4]
and dword [ebp - 0x1b0], 0
shl ecx, 8
xor ecx, edx
and ecx, 0x100
xor ecx, edx
mov dword [ebx + 0x158], ecx
cmp dword [eax + 0x24], 0
jle 0x100f978d
mov edi, dword [ebp - 0x1b0]
mov eax, dword [ebx + 0xf4]
push edi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x10]
mov ecx, eax
mov eax, dword [ebx + 0x158]
shr eax, 6
xor eax, dword [ecx + 0x84]
and eax, 4
xor dword [ecx + 0x84], eax
inc edi
mov eax, dword [ebx + 0xf4]
cmp edi, dword [eax + 0x24]
jl 0x100f9754
mov edi, dword [ebp - 0x1b8]
or dword [esi + 0x80], 3
mov eax, dword [ebx]
push 0x3da6
push ebx
call dword [eax + 0xcc]
test byte [esi + 0x84], 2
je 0x100f97d4
mov eax, dword [esi + 0x14]
push dword [esi + 0x78]
push dword [esi + 0x74]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x5c]
mov eax, dword [esi + 0x14]
and dword [esi + 0x84], 0xfffffffd
push 0xb
push eax
mov ecx, dword [eax]
call dword [ecx + 0x34]
test eax, eax
jne 0x100fb413
mov eax, dword [esi + 0x14]
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x34]
test eax, eax
je 0x100f97ea
or dword [esi + 0x80], 4
test dword [ebx + 0x158], 0x18000000
je 0x100f9801
mov eax, dword [ebx]
push 1
push ebx
call dword [eax + 0x344]
test byte [esi + 0x80], 3
jne 0x100f981b
mov eax, dword [ebx + 0x158]
test al, 0x40
jne 0x100f981b
test eax, 0x18000000
je 0x100f9825
mov eax, dword [ebx]
push esi
push ebx
call dword [eax + 0x340]
test byte [ebx + 0x15c], 4
je 0x100f984f
test dword [ebx + 0x158], 0x100
jne 0x100f9848
mov eax, dword [ebx]
push 0x186
push ebx
call dword [eax + 0xcc]
or dword [ebx + 0x15c], 4
test byte [esi + 0x80], 3
je 0x100f9877
push edi
mov ecx, ebx
call fcn.100b3c7b
test byte [ebp + 0x1c], 0x20
jne 0x100f9870
push edi
push 1
mov ecx, ebx
call fcn.100b3c7b
and dword [esi + 0x80], 0xfffffffd
and dword [esi + 0x80], 0xffffffef
mov eax, dword [ebx]
push edi
push ebx
call dword [eax + 0x350]
mov eax, dword [ebx]
push 3
push ebx
call dword [eax + 0x19c]
test dword [ebx + 0x158], 0x100
mov dword [ebp - 0x290], eax
jne 0x100f98b5
cmp dword [ebp - 0x1c0], 0
jle 0x100f98b5
or dword [esi + 0x80], 1
test byte [esi + 0x80], 5
jne 0x100f98c8
test byte [ebp + 0x1c], 0x10
je 0x100fb361
mov eax, dword [esi + 0x40]
mov dword [ebp - 0x1d0], eax
test eax, eax
jns 0x100f98e4
mov eax, dword [ebx + 0x164]
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x1d0], eax
mov eax, dword [esi + 0x14]
push 6
push eax
mov byte [ebp - 0x19d], 1
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov eax, dword [ebp + 0x1c]
and eax, 0x10
mov dword [ebp - 0x294], eax
je 0x100f9922
mov eax, dword [esi + 0x14]
push 4
push eax
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov eax, dword [esi + 0x14]
push 0xb
push eax
mov ecx, dword [eax]
call dword [ecx + 0x34]
test eax, eax
jne 0x100fb13e
cmp dword [ebp - 0x1c0], 1
jge 0x100f993c
mov ecx, dword [esi + 0x14]
mov eax, dword [ebx + 0x16c]
mov edx, dword [ecx]
push dword [eax]
push ecx
call dword [edx + 0x60]
mov eax, dword [esi + 0x14]
push 2
push eax
mov ecx, dword [eax]
call dword [ecx + 0x54]
test al, al
je 0x100fb13e
mov eax, dword [ebx]
and dword [ebx + 0x148], 0
push edi
push 0
push esi
push ebx
call dword [eax + 0xc4]
mov dword [ebp - 0x1bc], eax
test eax, eax
js 0x100fb13e
test edi, edi
je 0x100f998a
push 2
mov ecx, edi
call fcn.100b3c7b
test al, al
jne 0x100f998a
or eax, 0xffffffff
jmp 0x100f9a9d
cmp dword [ebp - 0x1c0], 0
jne 0x100f99a9
mov eax, dword [ebx]
push esi
push ebx
call dword [eax + 0x3d4]
test al, al
je 0x100f99a9
push esi
mov ecx, ebx
call fcn.100b3c7b
mov eax, dword [ebx + 0x164]
mov edx, 0x800
mov ecx, 0x20000000
test dword [eax + 0x28], edx
mov edx, 0x28000000
cmovne ecx, edx
test dword [eax + 0x28], 0x400
mov dword [ebp - 0x1b4], ecx
je 0x100f99df
or ecx, 0x40000000
mov dword [ebp - 0x1b4], ecx
test byte [eax + 0x28], 8
je 0x100f99f1
or ecx, 0x10000000
mov dword [ebp - 0x1b4], ecx
test dword [ebx + 0x158], 0x100
je 0x100f9a09
or ecx, 0x80000000
mov dword [ebp - 0x1b4], ecx
push 0x2e
lea eax, [ebp - 0x204]
push 0
push eax
call sub.MSVCR120.dll_memset
mov eax, dword [ebx + 0x154]
add esp, 0xc
test eax, eax
je 0x100f9a2a
and dword [eax + 4], 0
and dword [ebp - 0x1c4], 0
mov byte [0x1016f164], 0
mov eax, dword [ebx + 0x164]
cmp dword [eax + 0x30], 0
je 0x100f9aa8
cmp byte [0x1016f148], 0
je 0x100f9aa8
cmp dword [ebx + 0x148], 0
jle 0x100f9aa8
xor ecx, ecx
inc ecx
cmp dword [eax + 0x34], ecx
jge 0x100f9a61
mov dword [eax + 0x34], ecx
mov ecx, dword [ebx + 0x164]
mov eax, 0x3e8
cdq
idiv dword [ecx + 0x34]
mov dword [0x1016f154], eax
push dword [ebx + 0x148]
push dword [ebx + 0x144]
call fcn.100fbf32
mov dword [ebp - 0x1c4], eax
pop ecx
pop ecx
test eax, eax
jne 0x100f9aae
cmp dword [ebx + 0x148], eax
jle 0x100f9aae
push 0xfffffffffffffff4
pop eax
mov dword [ebp - 0x1bc], eax
jmp 0x100fb13e
mov eax, dword [ebp - 0x1c4]
xor ecx, ecx
mov dword [ebp - 0x1cc], ecx
cmp dword [ebx + 0x148], ecx
jle 0x100fa573
xor edx, edx
mov dword [ebp - 0x1b0], edx
test eax, eax
je 0x100f9ad3
mov eax, dword [eax + ecx*8]
jmp 0x100f9adb
mov eax, dword [ebx + 0x144]
add eax, edx
mov byte [eax + 0xa0], 0
mov dword [ebp - 0x19c], eax
mov dword [0x1016f160], ecx
test edi, edi
je 0x100f9b20
mov ecx, dword [ebx + 0x164]
cmp dword [ecx + 0x30], 0
je 0x100f9b0f
cmp byte [0x1016f148], 0
je 0x100f9b0f
push ecx
push 0x100fbe71
jmp 0x100f9b13
push 0
push 0
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x78]
mov eax, dword [ebp - 0x19c]
cmp dword [ebx + 0x33c], 2
je 0x100fa71f
and dword [ebp - 0x200], 0
xor edx, edx
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x100f9b4b
mov ecx, dword [ecx + 0x44]
shr ecx, 9
and ecx, 0xffffff01
jmp 0x100f9b4d
xor cl, cl
mov eax, dword [ebx + 0x164]
mov dword [ebp - 0x1a4], ecx
cmp dword [eax + 0x30], edx
je 0x100f9b9e
cmp byte [0x1016f148], dl
je 0x100f9b9e
cmp byte [0x1016f164], dl
je 0x100f9b9e
test cl, cl
jne 0x100f9b9e
cmp dword [eax + 0x30], 2
je 0x100fa52b
mov eax, dword [ebx]
push 0x3f3a38
push 3
push ebx
call dword [eax + 0x198]
mov eax, dword [ebp - 0x19c]
mov ecx, ebx
push dword [eax + 8]
call fcn.100b3c7b
mov edx, eax
and dword [ebp - 0x200], 0
mov eax, dword [ebx]
mov dword [ebp - 0x204], edx
mov edx, dword [ebp - 0x19c]
push dword [edx + 8]
push esi
push ebx
call dword [eax + 0x3e8]
mov ecx, dword [ebp - 0x1ea]
movzx eax, al
shl eax, 2
xor eax, ecx
and eax, 4
xor ecx, eax
mov eax, dword [ebx + 0x164]
mov dword [ebp - 0x1ea], ecx
and ecx, 0xfffffff4
mov edx, dword [eax + 0x28]
shr edx, 7
and edx, 8
mov dword [ebp - 0x1da], 1
or edx, ecx
mov ecx, dword [ebp - 0x19c]
mov dword [ebp - 0x1ea], edx
mov ax, word [ecx + 0x8c]
and dword [ebp - 0x1e2], 0
mov word [ebp - 0x1ec], ax
mov dword [ebp - 0x1de], 0x3f800000
mov eax, dword [ecx + 8]
test dword [eax + 0x44], 0x200
je 0x100f9c48
mov eax, dword [ebx + 0x164]
mov edi, 0x800
test word [eax + 0x2c], di
mov edi, dword [ebp - 0x1b8]
je 0x100f9c48
xor eax, eax
inc eax
jmp 0x100f9c4a
xor eax, eax
shl eax, 7
xor eax, edx
and eax, 0x80
xor edx, eax
cmp dword [ebx + 0x2a8], 0
mov dword [ebp - 0x1ea], edx
je 0x100f9c75
push ecx
mov ecx, ebx
call fcn.100b3c7b
test al, al
je 0x100f9c75
mov cl, 1
jmp 0x100f9c77
xor cl, cl
cmp byte [ebp - 0x1a4], 0
mov byte [ebp - 0x195], cl
je 0x100f9ca2
mov eax, dword [ebx + 0x164]
push 0
test dword [eax + 0x28], 0x40000
movzx eax, cl
pop ecx
cmovne eax, ecx
mov byte [ebp - 0x195], al
lea eax, [ebp - 0x195]
push eax
mov eax, dword [ebp - 0x19c]
push dword [esi + 0x14]
push dword [eax + 8]
call fcn.100b3c7b
add esp, 0xc
cmp byte [ebp - 0x195], 0
je 0x100f9cd8
mov eax, dword [esi + 0x14]
push 1
push 1
push 0x3ea
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov edx, dword [ebp - 0x19c]
push edi
lea edi, [ebp - 0x204]
push edi
mov ecx, dword [edx]
lea eax, [edx + 0xc]
mov dword [ebp - 0x1a4], eax
push dword [ebp - 0x1a4]
push dword [edx + 8]
mov eax, dword [ecx]
push esi
push ecx
call dword [eax + 0xa0]
cmp byte [ebp - 0x195], 0
mov edi, dword [ebp - 0x1b8]
mov dword [ebp - 0x210], eax
je 0x100f9d31
mov ecx, dword [esi + 0x14]
push 1
push 0
push 0x3ea
mov edx, dword [ecx]
push ecx
call dword [edx + 0x18]
mov eax, dword [ebp - 0x210]
cmp eax, 1
jne 0x100fa47d
mov eax, dword [ebp - 0x1e2]
test eax, eax
je 0x100fa37a
mov ecx, dword [ebp - 0x19c]
lea edx, [ebp - 0x2b0]
push edi
push 0
push edx
mov dword [ecx + 0x94], eax
mov eax, dword [ebp - 0x1f0]
mov dword [ecx + 0x90], eax
mov eax, dword [ecx]
movss xmm0, dword [ebp - 0x1de]
movss dword [ecx + 0x9c], xmm0
push eax
mov ecx, dword [eax]
call dword [ecx + 0xb4]
test al, al
je 0x100fa2c8
lea esi, [ebp - 0x2b0]
movss xmm0, dword [ebp - 0x2a4]
lea edi, [ebp - 0x28c]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x328]
push eax
movsd dword es:[edi], dword [esi]
push dword [ebp - 0x1a4]
movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x2a4]
lea edi, [ebp - 0x268]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x2b0]
lea edi, [ebp - 0x224]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movss dword [ebp - 0x224], xmm0
lea esi, [ebp - 0x224]
lea edi, [ebp - 0x274]
movss xmm0, dword [ebp - 0x2a0]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x2b0]
movss dword [ebp - 0x270], xmm0
lea edi, [ebp - 0x234]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x2b0]
movss dword [ebp - 0x230], xmm0
lea edi, [ebp - 0x25c]
movss xmm0, dword [ebp - 0x29c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x224]
movss dword [ebp - 0x254], xmm0
lea edi, [ebp - 0x244]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x234]
movss dword [ebp - 0x23c], xmm0
lea edi, [ebp - 0x280]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movss dword [ebp - 0x278], xmm0
call fcn.100b3c7b
mov esi, eax
lea edi, [ebp - 0x28c]
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x31c]
movsd dword es:[edi], dword [esi]
push eax
push dword [ebp - 0x1a4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.100b3c7b
mov esi, eax
lea edi, [ebp - 0x268]
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x2d4]
movsd dword es:[edi], dword [esi]
push eax
push dword [ebp - 0x1a4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.100b3c7b
mov esi, eax
lea edi, [ebp - 0x224]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x274]
movsd dword es:[edi], dword [esi]
push eax
lea eax, [ebp - 0x310]
push eax
push dword [ebp - 0x1a4]
call fcn.100b3c7b
mov esi, eax
lea edi, [ebp - 0x274]
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x2c8]
movsd dword es:[edi], dword [esi]
push eax
push dword [ebp - 0x1a4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.100b3c7b
mov esi, eax
lea edi, [ebp - 0x234]
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x340]
movsd dword es:[edi], dword [esi]
push eax
push dword [ebp - 0x1a4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.100b3c7b
mov esi, eax
lea edi, [ebp - 0x25c]
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x358]
movsd dword es:[edi], dword [esi]
push eax
push dword [ebp - 0x1a4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.100b3c7b
mov esi, eax
lea edi, [ebp - 0x244]
lea eax, [ebp - 0x280]
push eax
lea eax, [ebp - 0x2e0]
movsd dword es:[edi], dword [esi]
push eax
push dword [ebp - 0x1a4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.100b3c7b
movss xmm1, dword [ebp - 0x28c]
lea edi, [ebp - 0x280]
movss xmm0, dword [ebp - 0x288]
mov esi, eax
cvtps2pd xmm0, xmm0
movsd dword es:[edi], dword [esi]
cvtps2pd xmm1, xmm1
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x1d4]
mov eax, dword [esi + 0x1c]
mulsd xmm0, qword [eax + 0x13c]
mulsd xmm1, qword [eax + 0x11c]
addsd xmm1, xmm0
movss xmm0, dword [ebp - 0x284]
cvtps2pd xmm0, xmm0
mulsd xmm0, qword [eax + 0x15c]
addsd xmm1, xmm0
movss xmm0, dword [ebp - 0x264]
cvtps2pd xmm0, xmm0
addsd xmm1, qword [eax + 0x17c]
cvtpd2ps xmm7, xmm1
movss xmm1, dword [ebp - 0x268]
cvtps2pd xmm1, xmm1
movss dword [ebp - 0x284], xmm7
mulsd xmm0, qword [eax + 0x13c]
mulsd xmm1, qword [eax + 0x11c]
addsd xmm1, xmm0
movss xmm0, dword [ebp - 0x260]
cvtps2pd xmm0, xmm0
mulsd xmm0, qword [eax + 0x15c]
addsd xmm1, xmm0
addsd xmm1, qword [eax + 0x17c]
cvtpd2ps xmm0, xmm1
movss xmm1, dword [ebp - 0x224]
movss dword [ebp - 0x260], xmm0
movss xmm0, dword [ebp - 0x220]
cvtps2pd xmm1, xmm1
cvtps2pd xmm0, xmm0
mulsd xmm1, qword [eax + 0x11c]
mulsd xmm0, qword [eax + 0x13c]
addsd xmm1, xmm0
movss xmm0, dword [ebp - 0x21c]
cvtps2pd xmm0, xmm0
mulsd xmm0, qword [eax + 0x15c]
addsd xmm1, xmm0
movss xmm0, dword [ebp - 0x274]
cvtps2pd xmm0, xmm0
addsd xmm1, qword [eax + 0x17c]
cvtpd2ps xmm2, xmm1
movss xmm1, dword [ebp - 0x270]
cvtps2pd xmm1, xmm1
movss dword [ebp - 0x21c], xmm2
mulsd xmm0, qword [eax + 0x11c]
mulsd xmm1, qword [eax + 0x13c]
addsd xmm1, xmm0
movss xmm0, dword [ebp - 0x26c]
cvtps2pd xmm0, xmm0
mulsd xmm0, qword [eax + 0x15c]
addsd xmm1, xmm0
movss xmm0, dword [ebp - 0x234]
cvtps2pd xmm0, xmm0
addsd xmm1, qword [eax + 0x17c]
cvtpd2ps xmm3, xmm1
movss xmm1, dword [ebp - 0x230]
cvtps2pd xmm1, xmm1
movss dword [ebp - 0x26c], xmm3
mulsd xmm0, qword [eax + 0x11c]
mulsd xmm1, qword [eax + 0x13c]
addsd xmm1, xmm0
movss xmm0, dword [ebp - 0x22c]
cvtps2pd xmm0, xmm0
mulsd xmm0, qword [eax + 0x15c]
addsd xmm1, xmm0
movss xmm0, dword [ebp - 0x25c]
cvtps2pd xmm0, xmm0
addsd xmm1, qword [eax + 0x17c]
cvtpd2ps xmm4, xmm1
movss xmm1, dword [ebp - 0x258]
cvtps2pd xmm1, xmm1
movss dword [ebp - 0x22c], xmm4
mulsd xmm0, qword [eax + 0x11c]
mulsd xmm1, qword [eax + 0x13c]
addsd xmm1, xmm0
movss xmm0, dword [ebp - 0x254]
cvtps2pd xmm0, xmm0
mulsd xmm0, qword [eax + 0x15c]
addsd xmm1, xmm0
movss xmm0, dword [ebp - 0x244]
cvtps2pd xmm0, xmm0
addsd xmm1, qword [eax + 0x17c]
cvtpd2ps xmm5, xmm1
movss xmm1, dword [ebp - 0x240]
cvtps2pd xmm1, xmm1
movss dword [ebp - 0x254], xmm5
mulsd xmm0, qword [eax + 0x11c]
mulsd xmm1, qword [eax + 0x13c]
addsd xmm1, xmm0
movss xmm0, dword [ebp - 0x23c]
cvtps2pd xmm0, xmm0
mulsd xmm0, qword [eax + 0x15c]
addsd xmm1, xmm0
movss xmm0, dword [ebp - 0x280]
cvtps2pd xmm0, xmm0
addsd xmm1, qword [eax + 0x17c]
cvtpd2ps xmm6, xmm1
movss xmm1, dword [ebp - 0x27c]
cvtps2pd xmm1, xmm1
movss dword [ebp - 0x23c], xmm6
mulsd xmm1, qword [eax + 0x13c]
mulsd xmm0, qword [eax + 0x11c]
addsd xmm1, xmm0
movss xmm0, dword [ebp - 0x278]
cvtps2pd xmm0, xmm0
mulsd xmm0, qword [eax + 0x15c]
addsd xmm1, xmm0
movss xmm0, dword [ebp - 0x260]
comiss xmm0, xmm7
addsd xmm1, qword [eax + 0x17c]
mov eax, dword [ebp - 0x19c]
cvtpd2ps xmm1, xmm1
jbe 0x100fa233
movss dword [eax + 0x98], xmm7
jmp 0x100fa23b
movss dword [eax + 0x98], xmm0
movss xmm0, dword [eax + 0x98]
comiss xmm0, xmm2
jbe 0x100fa250
movss dword [eax + 0x98], xmm2
movss xmm0, dword [eax + 0x98]
comiss xmm0, xmm3
jbe 0x100fa265
movss dword [eax + 0x98], xmm3
movss xmm0, dword [eax + 0x98]
comiss xmm0, xmm4
jbe 0x100fa27a
movss dword [eax + 0x98], xmm4
movss xmm0, dword [eax + 0x98]
comiss xmm0, xmm5
jbe 0x100fa28f
movss dword [eax + 0x98], xmm5
movss xmm0, dword [eax + 0x98]
comiss xmm0, xmm6
jbe 0x100fa2a4
movss dword [eax + 0x98], xmm6
movss xmm0, dword [eax + 0x98]
comiss xmm0, xmm1
mov edi, dword [ebp - 0x1b8]
jbe 0x100fa367
movss dword [eax + 0x98], xmm1
jmp 0x100fa367
mov eax, dword [ebp - 0x1a4]
lea edx, [ebp - 0x34c]
push edx
movsd xmm0, qword [eax + 0x60]
cvtpd2ps xmm0, xmm0
movss dword [ebp - 0x1ac], xmm0
movsd xmm0, qword [eax + 0x68]
cvtpd2ps xmm0, xmm0
movss dword [ebp - 0x210], xmm0
movsd xmm0, qword [eax + 0x70]
mov eax, dword [esi + 0x1c]
cvtpd2ps xmm0, xmm0
push eax
mov ecx, dword [eax]
movss dword [ebp - 0x218], xmm0
call dword [ecx + 0x74]
movss xmm1, dword [ebp - 0x210]
movss xmm0, dword [ebp - 0x218]
movss xmm2, dword [ebp - 0x1ac]
subss xmm1, dword [eax + 4]
subss xmm0, dword [eax + 8]
subss xmm2, dword [eax]
lea eax, [ebp - 0x2bc]
push eax
movss dword [ebp - 0x2b8], xmm1
movss dword [ebp - 0x2b4], xmm0
movss dword [ebp - 0x2bc], xmm2
call fcn.100b3c7b
mov eax, dword [ebp - 0x19c]
fstp dword [eax + 0x98]
mov eax, dword [ebx + 0x2c0]
mov edx, dword [ebp - 0x19c]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x30]
lea eax, [ebp - 0x195]
push eax
mov eax, dword [ebp - 0x19c]
push dword [esi + 0x14]
push dword [eax + 8]
call fcn.100b3c7b
add esp, 0xc
cmp byte [ebp - 0x195], 0
je 0x100fa3b0
mov eax, dword [esi + 0x14]
push 1
push 1
push 0x3ea
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov edx, dword [ebp - 0x19c]
mov dword [ebp - 0x200], 1
mov eax, dword [edx + 8]
mov eax, dword [eax + 0xa4]
mov dword [ebp - 0x1ac], eax
test eax, eax
je 0x100fa3e8
mov eax, dword [esi + 0x14]
push dword [ebp - 0x1ac]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov edx, dword [ebp - 0x19c]
mov eax, dword [edx]
push edi
lea edi, [ebp - 0x204]
push edi
push dword [ebp - 0x1a4]
mov ecx, dword [eax]
push dword [edx + 8]
push esi
push eax
call dword [ecx + 0xa4]
mov edi, dword [ebp - 0x1b8]
mov ecx, eax
mov eax, dword [ebp - 0x19c]
mov byte [eax + 0xa0], 1
cmp ecx, 0xfffffff4
je 0x100fa55d
or edx, 0xffffffff
cmp ecx, edx
jne 0x100fa447
push edi
lea ecx, [ebp - 0x204]
push ecx
push eax
push esi
mov ecx, ebx
call fcn.100b3c7b
mov dword [ebp - 0x1bc], eax
mov eax, dword [ebp - 0x19c]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0xa4]
test edx, edx
je 0x100fa460
mov eax, dword [esi + 0x14]
neg edx
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
cmp byte [ebp - 0x195], 0
je 0x100fa4c0
mov eax, dword [esi + 0x14]
push 1
push 0
push 0x3ea
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
jmp 0x100fa4c0
cmp eax, 0xfffffff4
je 0x100fa55d
or ecx, 0xffffffff
cmp eax, ecx
jne 0x100fa4c0
mov dword [ebp - 0x1bc], ecx
mov ecx, edi
push 2
call fcn.100b3c7b
test al, al
je 0x100fb119
push edi
lea eax, [ebp - 0x204]
mov ecx, ebx
push eax
push dword [ebp - 0x19c]
push esi
call fcn.100b3c7b
mov dword [ebp - 0x1bc], eax
test edi, edi
je 0x100fa4e7
mov eax, dword [ebx + 0x164]
cmp dword [eax + 0xa4], 0
je 0x100fa4e7
mov eax, dword [edi]
push 0
push dword [ebx + 0x148]
push dword [ebp - 0x1cc]
push edi
call dword [eax + 0xc]
mov eax, dword [ebx + 0x164]
cmp dword [eax + 0x30], 0
je 0x100fa51c
cmp byte [0x1016f148], 0
je 0x100fa51c
mov ecx, 0x1016f14c
call fcn.100fba15
test al, al
je 0x100fa52b
mov eax, dword [ebx]
push 0x3f3a38
push 3
push ebx
call dword [eax + 0x198]
jmp 0x100fa52b
test edi, edi
je 0x100fa52b
mov eax, dword [edi]
mov ecx, edi
push 0
push 0
call dword [eax + 0x78]
mov ecx, dword [ebp - 0x1cc]
mov edx, dword [ebp - 0x1b0]
inc ecx
add edx, 0xa4
mov dword [ebp - 0x1cc], ecx
mov dword [ebp - 0x1b0], edx
cmp ecx, dword [ebx + 0x148]
jge 0x100fa573
mov eax, dword [ebp - 0x1c4]
jmp 0x100f9aca
push 0xfffffffffffffff4
pop eax
mov dword [ebp - 0x1bc], eax
mov eax, dword [edi]
push 4
push edi
call dword [eax + 0x20]
jmp 0x100fb119
cmp dword [ebx + 0x33c], 2
je 0x100fa71f
cmp dword [ebp - 0x1c0], 0
jne 0x100fa71f
mov eax, dword [ebx]
push esi
push ebx
call dword [eax + 0x3e4]
test al, al
je 0x100fa5bc
test byte [ebx + 0x15b], 1
jne 0x100fa5bc
mov eax, dword [ebx + 0x16c]
mov ecx, esi
push 2
push dword [eax + 4]
lea eax, [ebx + 0x74]
push eax
push 0
call fcn.100b3c7b
mov eax, dword [ebp - 0x1d0]
test eax, eax
je 0x100fa5db
cmp eax, 3
je 0x100fa5db
push eax
push esi
mov ecx, ebx
call fcn.100f8eac
mov byte [ebp - 0x19d], 0
cmp dword [ebx + 0x2a8], 0
je 0x100fa71f
test edi, edi
je 0x100fa605
mov ecx, edi
call fcn.100ada3d
test al, al
jne 0x100fa605
or eax, 0xffffffff
mov dword [ebp - 0x1bc], eax
jmp 0x100fa71f
cmp dword [ebx + 0x2ac], 0
jne 0x100fa615
mov ecx, ebx
call fcn.100d1ccf
mov ecx, dword [ebx + 0x2ac]
test ecx, ecx
je 0x100fa71f
mov eax, dword [ecx]
lea edx, [ebp - 0x2f8]
push edi
push 0
push edx
push ecx
call dword [eax + 0xb4]
test al, al
je 0x100fa71f
mov eax, dword [esi + 0x1c]
lea edx, [ebp - 0x2f8]
push 1
push edx
push 0
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov ecx, dword [ebx + 0x2ac]
mov word [ecx + 0x138], ax
mov eax, 0x4000
mov ecx, dword [ebx + 0x2ac]
test word [ecx + 0x138], ax
jne 0x100fa71f
push dword [ebp - 0x1b4]
mov eax, dword [ecx]
push 6
push ecx
call dword [eax + 0x98]
or eax, dword [ebp - 0x1b4]
mov dword [ebp - 0x1ac], eax
lea eax, [ebp - 0x114]
push eax
call fcn.100b3c7b
test dword [ebx + 0x158], 0x100
jne 0x100fa6bf
mov ecx, dword [ebx + 0x2ac]
lea eax, [ebp - 0x114]
push eax
push esi
call fcn.100b3c7b
mov eax, dword [ebx + 0x2ac]
lea edx, [ebp - 0x114]
push 0
push edi
push esi
mov ecx, dword [eax]
push edx
push dword [ebp - 0x1ac]
push eax
call dword [ecx + 0x8c]
mov dword [ebp - 0x1ac], eax
test eax, eax
jns 0x100fa710
mov ecx, dword [ebx + 0x28]
push eax
push ecx
mov edx, dword [ecx]
call dword [edx + 0x338]
cmp dword [ebp - 0x1ac], 0xfffffff4
jne 0x100fa710
push 0xfffffffffffffff4
pop eax
mov dword [ebp - 0x1bc], eax
mov eax, dword [edi]
push 4
push edi
call dword [eax + 0x20]
mov eax, dword [esi + 0x14]
push dword [ebx + 0x2ac]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x58]
test edi, edi
je 0x100fa72e
mov eax, dword [edi]
mov ecx, edi
push 0
push 0
call dword [eax + 0x78]
cmp dword [ebx + 0x33c], 1
je 0x100fa7cb
cmp dword [ebp - 0x1c0], 0
jne 0x100fa7cb
cmp dword [ebx + 0x2c4], 0
je 0x100fa7cb
mov eax, dword [ebx]
push esi
push ebx
call dword [eax + 0x3d0]
test al, al
je 0x100fa7cb
mov eax, dword [ebx + 0x2c4]
xor edx, edx
mov dword [ebp - 0x1b0], edx
cmp dword [eax + 0x24], edx
jle 0x100fa7cb
mov eax, dword [ebx + 0x2c4]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x10]
push 7
push eax
mov dword [ebp - 0x1ac], eax
mov ecx, dword [eax]
call dword [ecx + 0xf0]
mov edx, eax
mov eax, dword [ebp - 0x1ac]
test byte [eax + 0x44], 1
jne 0x100fa7b3
test dword [edx + 0x50], 0x200
jne 0x100fa7b3
mov ecx, dword [edx]
push edi
push eax
push esi
push edx
call dword [ecx + 0x124]
mov edx, dword [ebp - 0x1b0]
mov eax, dword [ebx + 0x2c4]
inc edx
mov dword [ebp - 0x1b0], edx
cmp edx, dword [eax + 0x24]
jl 0x100fa772
mov eax, dword [ebx + 0x2c0]
cmp dword [eax + 0x24], 0
je 0x100fac1e
cmp dword [ebx + 0x33c], 2
je 0x100fac1e
mov ecx, ebx
call fcn.100fb97c
cmp dword [ebp - 0x1c0], 0
jne 0x100fa932
mov eax, dword [ebp - 0x1d0]
test eax, eax
je 0x100fa932
cmp byte [ebp - 0x19d], 0
je 0x100fa932
cmp dword [ebx + 0x2a8], 0
je 0x100fa835
push eax
push esi
mov ecx, ebx
call fcn.100f8eac
mov byte [ebp - 0x19d], 0
jmp 0x100fa932
mov eax, dword [esi + 0xc]
lea edx, [ebp - 0x194]
push 1
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x9c]
mov eax, dword [esi + 0xc]
push 4
push eax
mov ecx, dword [eax]
call dword [ecx + 0xf0]
test eax, eax
je 0x100fa86e
mov ecx, dword [eax]
lea edx, [ebp - 0x250]
push edx
push eax
call dword [ecx + 0xe4]
jmp 0x100fa889
mov eax, dword [esi + 0x1c]
lea edx, [ebp - 0x304]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x74]
mov esi, eax
lea edi, [ebp - 0x250]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x334]
push eax
lea eax, [ebp - 0x194]
push eax
call fcn.100b3c7b
mov esi, eax
lea edi, [ebp - 0x250]
movzx eax, byte [ebx + 0x349]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
sub eax, 0
je 0x100fa8f5
dec eax
je 0x100fa8e4
sub eax, 3
je 0x100fa8d6
dec eax
jne 0x100fa926
movss xmm0, dword [ebx + 0x84]
comiss xmm0, dword [ebp - 0x24c]
jmp 0x100fa901
movss xmm0, dword [ebp - 0x24c]
comiss xmm0, dword [ebx + 0x78]
jmp 0x100fa901
movss xmm0, dword [ebx + 0x88]
comiss xmm0, dword [ebp - 0x248]
jmp 0x100fa901
movss xmm0, dword [ebp - 0x248]
comiss xmm0, dword [ebx + 0x7c]
mov esi, dword [ebp - 0x1d4]
seta al
test al, al
je 0x100fa92c
mov eax, dword [ebp - 0x1d0]
mov ecx, ebx
push eax
push esi
call fcn.100f8eac
mov byte [ebp - 0x19d], 0
jmp 0x100fa92c
mov esi, dword [ebp - 0x1d4]
mov edi, dword [ebp - 0x1b8]
push 0x2e
lea eax, [ebp - 0x204]
push 0
push eax
call sub.MSVCR120.dll_memset
mov eax, dword [ebx + 0x2c0]
xor edx, edx
add esp, 0xc
mov dword [ebp - 0x1cc], edx
cmp dword [eax + 0x24], edx
jle 0x100fac12
mov eax, dword [ebx + 0x2c0]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x10]
push 2
pop edx
mov dword [ebp - 0x200], edx
mov ecx, dword [eax + 0x90]
or dword [ebp - 0x1ea], edx
mov dword [ebp - 0x1f0], ecx
movss xmm0, dword [eax + 0x9c]
mov ecx, dword [ebx]
movss dword [ebp - 0x1f4], xmm0
push dword [eax + 8]
mov dword [ebp - 0x19c], eax
push esi
push ebx
call dword [ecx + 0x3e8]
mov ecx, dword [ebp - 0x1ea]
movzx eax, al
shl eax, 2
xor eax, ecx
and eax, 4
xor ecx, eax
mov eax, dword [ebx + 0x164]
mov dword [ebp - 0x1ea], ecx
mov edx, dword [eax + 0x28]
shr edx, 7
xor edx, ecx
and edx, 8
xor edx, ecx
mov ecx, dword [ebp - 0x19c]
or edx, 1
mov dword [ebp - 0x1ea], edx
mov eax, dword [ecx + 0x94]
mov dword [ebp - 0x204], eax
mov eax, dword [ecx + 8]
test dword [eax + 0x44], 0x200
je 0x100faa16
mov eax, dword [ebx + 0x164]
mov esi, 0x800
test word [eax + 0x2c], si
mov esi, dword [ebp - 0x1d4]
je 0x100faa16
xor eax, eax
inc eax
jmp 0x100faa18
xor eax, eax
shl eax, 7
xor eax, edx
and eax, 0x80
xor edx, eax
mov dword [ebp - 0x1ea], edx
mov eax, dword [ecx + 8]
cmp eax, dword [ebx + 0x2a8]
jne 0x100faa42
cmp dword [ebp - 0x1c0], 0
jg 0x100fabf6
test edi, edi
je 0x100faa6c
mov ecx, dword [ebx + 0x164]
xor edx, edx
cmp dword [ecx + 0x30], edx
je 0x100faa63
cmp byte [0x1016f148], dl
je 0x100faa63
push ecx
push 0x100fbe71
jmp 0x100faa65
push edx
push edx
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x78]
mov eax, dword [ebx + 0x164]
cmp dword [eax + 0x30], 0
je 0x100faaff
cmp byte [0x1016f148], 0
je 0x100faaff
mov eax, dword [ebx + 0x148]
mov ecx, 0x1016f14c
add eax, dword [ebp - 0x1cc]
mov dword [0x1016f160], eax
call fcn.100fba15
test al, al
je 0x100faaff
mov eax, dword [ebx]
push 0x3f3a38
push 3
push ebx
call dword [eax + 0x198]
mov eax, dword [ebp - 0x19c]
cmp dword [eax + 0x94], 2
je 0x100fab05
mov ecx, dword [eax + 8]
cmp ecx, dword [ebx + 0x2a8]
je 0x100fab05
mov eax, dword [ebx + 0x164]
cmp dword [eax + 0x30], 2
je 0x100fabf6
push ecx
mov ecx, ebx
call fcn.100b3c7b
mov ecx, dword [ebp - 0x19c]
mov dword [ebp - 0x204], eax
mov dword [ecx + 0x94], eax
and dword [ebp - 0x1ea], 0xfffffffe
mov eax, dword [ebp - 0x19c]
cmp dword [ebx + 0x2a8], 0
je 0x100fab21
push eax
mov ecx, ebx
call fcn.100b3c7b
mov byte [ebp - 0x1a5], 1
test al, al
jne 0x100fab28
mov byte [ebp - 0x1a5], 0
mov ecx, dword [ebp - 0x19c]
lea eax, [ebp - 0x1a5]
push eax
push dword [esi + 0x14]
push dword [ecx + 8]
call fcn.100b3c7b
add esp, 0xc
cmp byte [ebp - 0x1a5], 0
je 0x100fab5e
mov eax, dword [esi + 0x14]
push 1
push 1
push 0x3ea
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov eax, dword [ebp - 0x19c]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0xa4]
test edx, edx
je 0x100fab7b
mov eax, dword [esi + 0x14]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov eax, dword [ebp - 0x19c]
push edi
lea edi, [ebp - 0x204]
push edi
mov ecx, dword [eax]
add eax, 0xc
push eax
mov eax, dword [ebp - 0x19c]
mov edx, dword [ecx]
push dword [eax + 8]
push esi
push ecx
call dword [edx + 0xa4]
mov ecx, dword [ebp - 0x1bc]
or edx, 0xffffffff
mov edi, dword [ebp - 0x1b8]
cmp eax, edx
mov eax, dword [ebp - 0x19c]
cmove ecx, edx
mov dword [ebp - 0x1bc], ecx
mov eax, dword [eax + 8]
mov edx, dword [eax + 0xa4]
test edx, edx
je 0x100fabdb
mov eax, dword [esi + 0x14]
neg edx
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
cmp byte [ebp - 0x1a5], 0
je 0x100fabf6
mov eax, dword [esi + 0x14]
push 1
push 0
push 0x3ea
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov edx, dword [ebp - 0x1cc]
mov eax, dword [ebx + 0x2c0]
inc edx
mov dword [ebp - 0x1cc], edx
cmp edx, dword [eax + 0x24]
jl 0x100fa95c
mov eax, dword [ebx + 0x2c0]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x28]
test edi, edi
je 0x100fac2d
mov eax, dword [edi]
mov ecx, edi
push 0
push 0
call dword [eax + 0x78]
cmp dword [ebp - 0x1c0], 0
jle 0x100fac3d
push ebx
call fcn.100b3c7b
pop ecx
cmp dword [ebx + 0x33c], 1
je 0x100faccd
cmp dword [ebx + 0x2c4], 0
je 0x100faccd
mov eax, dword [ebx]
push esi
push ebx
call dword [eax + 0x3d0]
test al, al
je 0x100faccd
mov eax, dword [ebx + 0x2c4]
xor edx, edx
mov dword [ebp - 0x1b0], edx
cmp dword [eax + 0x24], edx
jle 0x100faccd
mov eax, dword [ebx + 0x2c4]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x10]
push 7
push eax
mov dword [ebp - 0x1ac], eax
mov ecx, dword [eax]
call dword [ecx + 0xf0]
mov edx, eax
mov eax, dword [ebp - 0x1ac]
test byte [eax + 0x44], 1
jne 0x100facb5
test dword [edx + 0x50], 0x200
je 0x100facb5
mov ecx, dword [edx]
push edi
push eax
push esi
push edx
call dword [ecx + 0x124]
mov edx, dword [ebp - 0x1b0]
mov eax, dword [ebx + 0x2c4]
inc edx
mov dword [ebp - 0x1b0], edx
cmp edx, dword [eax + 0x24]
jl 0x100fac74
mov eax, dword [ebx + 0x164]
test dword [eax + 0x28], 0x200000
je 0x100fae9f
mov eax, dword [ebp - 0x200]
mov dword [ebp - 0x1ac], eax
mov eax, dword [esi + 0x14]
push 1
push 0
push 0x3e9
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
xor eax, eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebx + 0x148], eax
jle 0x100fae81
mov ecx, dword [ebp - 0x1c4]
xor edx, edx
mov dword [ebp - 0x1b4], edx
test ecx, ecx
je 0x100fad29
mov eax, dword [ecx + eax*8]
jmp 0x100fad31
mov eax, dword [ebx + 0x144]
add eax, edx
mov dword [ebp - 0x1a4], eax
test eax, eax
je 0x100fae5c
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x100fae56
mov ecx, dword [ecx + 0x70]
test ecx, ecx
je 0x100fae56
mov eax, dword [ecx]
push ecx
call dword [eax + 0x40]
cmp eax, 1
jne 0x100fae50
mov eax, dword [ebp - 0x1a4]
push 1
push 0
push 0x12d
mov eax, dword [eax + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
push 4
pop edx
cmp eax, edx
jne 0x100fae50
mov ecx, dword [ebp - 0x1a4]
mov dword [ebp - 0x200], 3
mov eax, dword [ecx + 0x90]
or dword [ebp - 0x1ea], 2
mov dword [ebp - 0x1f0], eax
mov eax, dword [ebx]
mov dword [ebp - 0x204], edx
movss xmm0, dword [ecx + 0x9c]
movss dword [ebp - 0x1f4], xmm0
push dword [ecx + 8]
push esi
push ebx
call dword [eax + 0x3e8]
movzx ecx, al
mov eax, dword [ebp - 0x1ea]
and ecx, 1
and eax, 0xfffffff2
shl ecx, 2
or ecx, eax
mov eax, dword [ebp - 0x1a4]
mov dword [ebp - 0x1ea], ecx
mov eax, dword [eax + 8]
test dword [eax + 0x44], 0x200
je 0x100fae0f
mov eax, dword [ebx + 0x164]
mov edx, 0x800
test word [eax + 0x2c], dx
je 0x100fae0f
xor eax, eax
inc eax
jmp 0x100fae11
xor eax, eax
shl eax, 7
xor eax, ecx
and eax, 0x80
xor ecx, eax
mov eax, dword [ebp - 0x1a4]
push edi
mov dword [ebp - 0x1ea], ecx
lea edi, [ebp - 0x204]
push edi
mov ecx, dword [eax]
add eax, 0xc
push eax
mov eax, dword [ebp - 0x1a4]
mov edx, dword [ecx]
push dword [eax + 8]
push esi
push ecx
call dword [edx + 0xa4]
mov edi, dword [ebp - 0x1b8]
mov edx, dword [ebp - 0x1b4]
mov ecx, dword [ebp - 0x1c4]
mov eax, dword [ebp - 0x1b0]
add edx, 0xa4
inc eax
mov dword [ebp - 0x1b4], edx
mov dword [ebp - 0x1b0], eax
cmp eax, dword [ebx + 0x148]
jl 0x100fad20
mov eax, dword [esi + 0x14]
push 1
push 1
push 0x3e9
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov eax, dword [ebp - 0x1ac]
mov dword [ebp - 0x200], eax
mov eax, dword [ebp - 0x200]
mov dword [ebp - 0x218], eax
mov eax, dword [esi + 0x14]
push 1
push 0
push 0x3e9
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
cmp dword [ebx + 0x33c], 2
je 0x100fb04f
xor eax, eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebx + 0x148], eax
jle 0x100fb04f
xor edx, edx
mov dword [ebp - 0x1cc], edx
mov ecx, dword [ebp - 0x1c4]
test ecx, ecx
je 0x100faef5
mov ecx, dword [ecx + eax*8]
jmp 0x100faefd
mov ecx, dword [ebx + 0x144]
add ecx, edx
cmp byte [ecx + 0xa0], 0
mov dword [ebp - 0x1b4], ecx
je 0x100fb04f
cmp dword [ecx + 8], 0
mov edi, dword [ebp - 0x1b8]
je 0x100fb030
mov edi, dword [ecx + 8]
mov edi, dword [edi + 0xa8]
test edi, 0x4000
mov dword [ebp - 0x1ac], edi
mov edi, dword [ebp - 0x1b8]
je 0x100faf43
cmp dword [esi + 0x68], 0xffffffff
je 0x100faf5d
test dword [ebp - 0x1ac], 0x10000000
je 0x100fb030
cmp dword [esi + 0x68], 1
jne 0x100fb030
mov dword [ebp - 0x200], 4
mov eax, dword [ecx + 0x90]
or dword [ebp - 0x1ea], 2
mov dword [ebp - 0x1f0], eax
mov eax, dword [ebx]
mov dword [ebp - 0x204], 8
movss xmm0, dword [ecx + 0x9c]
movss dword [ebp - 0x1f4], xmm0
push dword [ecx + 8]
push esi
push ebx
call dword [eax + 0x3e8]
movzx ecx, al
mov eax, dword [ebp - 0x1ea]
and ecx, 1
and eax, 0xfffffff2
shl ecx, 2
or ecx, eax
mov eax, dword [ebp - 0x1b4]
mov dword [ebp - 0x1ea], ecx
mov eax, dword [eax + 8]
test dword [eax + 0x44], 0x200
je 0x100fafe3
mov eax, dword [ebx + 0x164]
mov edx, 0x800
test word [eax + 0x2c], dx
je 0x100fafe3
xor eax, eax
inc eax
jmp 0x100fafe5
xor eax, eax
shl eax, 7
xor eax, ecx
and eax, 0x80
xor ecx, eax
mov eax, dword [ebp - 0x1b4]
push edi
mov dword [ebp - 0x1ea], ecx
lea edi, [ebp - 0x204]
push edi
mov ecx, dword [eax]
add eax, 0xc
push eax
mov eax, dword [ebp - 0x1b4]
mov edx, dword [ecx]
push dword [eax + 8]
push esi
push ecx
call dword [edx + 0xa4]
mov edi, dword [ebp - 0x1b8]
mov eax, dword [ebp - 0x1b0]
mov edx, dword [ebp - 0x1cc]
inc eax
add edx, 0xa4
mov dword [ebp - 0x1b0], eax
mov dword [ebp - 0x1cc], edx
cmp eax, dword [ebx + 0x148]
jl 0x100faee6
mov eax, dword [esi + 0x14]
push 1
push 1
push 0x3e9
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov eax, dword [ebp - 0x218]
mov dword [ebp - 0x200], eax
mov eax, dword [ebp - 0x1d0]
test eax, eax
je 0x100fb099
cmp byte [ebp - 0x19d], 0
je 0x100fb099
cmp dword [ebx + 0x33c], 2
je 0x100fb099
push eax
push esi
mov ecx, ebx
call fcn.100f8eac
mov byte [ebp - 0x19d], 0
mov eax, dword [ebx + 0x114]
test eax, eax
je 0x100fb119
cmp dword [eax], 0
je 0x100fb119
push esi
mov ecx, ebx
call fcn.100b3c7b
mov eax, dword [ebx + 0x2b8]
test eax, eax
je 0x100fb119
mov eax, dword [eax + 0x24]
test eax, eax
je 0x100fb119
and dword [ebp - 0x1ac], 0
test eax, eax
jle 0x100fb119
mov edi, dword [ebp - 0x1ac]
mov eax, dword [ebx + 0x114]
mov ecx, dword [ebx + 0x2b8]
push dword [eax]
mov eax, dword [ecx]
push edi
push ecx
call dword [eax + 0x10]
push eax
push esi
mov ecx, ebx
call fcn.100b3c7b
mov eax, dword [ebx + 0x2b8]
cmp dword [eax + 0x24], 1
jle 0x100fb107
mov ecx, ebx
call fcn.100ee21a
test al, al
jne 0x100fb113
mov eax, dword [ebx + 0x2b8]
inc edi
cmp edi, dword [eax + 0x24]
jl 0x100fb0d2
mov edi, dword [ebp - 0x1b8]
mov eax, dword [ebp - 0x1d0]
test eax, eax
je 0x100fb13e
cmp byte [ebp - 0x19d], 0
je 0x100fb13e
cmp dword [ebx + 0x33c], 2
je 0x100fb13e
push eax
push esi
mov ecx, ebx
call fcn.100f8eac
cmp byte [0x107ac718], 0
je 0x100fb14e
push ebx
call fcn.100b3c7b
pop ecx
mov eax, dword [ebx + 0x164]
mov ecx, dword [ebp - 0x228]
movss xmm0, dword [ebp - 0x238]
mov dword [eax + 0x14], ecx
mov eax, dword [ebx + 0x164]
movss dword [eax + 0x9c], xmm0
test edi, edi
je 0x100fb182
mov eax, dword [edi]
mov ecx, edi
push 0
push 0
call dword [eax + 0x78]
push dword [ebp - 0x290]
mov eax, dword [ebx]
push 3
push ebx
call dword [eax + 0x198]
test byte [ebp + 0x1c], 0x20
jne 0x100fb2e7
push edi
push 0
mov ecx, ebx
call fcn.100b3c7b
test byte [ebx + 0x158], 0x10
jne 0x100fb2e7
call sub.kernel32.dll_GetTickCount
sub eax, dword [ebp - 0x298]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x10131340]
mov eax, dword [ebx + 0x328]
cvtpd2ps xmm0, xmm0
movss dword [ebx + eax*4 + 0x2d8], xmm0
inc dword [ebx + 0x328]
mov eax, dword [ebx + 0x32c]
cmp eax, 0x14
jge 0x100fb1fe
inc eax
mov dword [ebx + 0x32c], eax
cmp dword [ebx + 0x328], 0x14
jne 0x100fb20e
and dword [ebx + 0x328], 0
and dword [ebx + 0x198], 0
mov ecx, dword [ebx + 0x32c]
test ecx, ecx
jle 0x100fb241
lea eax, [ebx + 0x2d8]
mov edx, ecx
movss xmm0, dword [eax]
add eax, 4
addss xmm0, dword [ebx + 0x198]
movss dword [ebx + 0x198], xmm0
dec edx
jne 0x100fb227
movss xmm1, dword [ebx + 0x198]
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [0x1013125c]
movss dword [ebx + 0x198], xmm1
jbe 0x100fb27b
movss xmm0, dword [0x1013b00c]
divss xmm0, xmm1
movss dword [ebx + 0x198], xmm0
jmp 0x100fb285
mov dword [ebx + 0x198], 0x42c80000
movss xmm0, dword [ebx + 0x198]
cvtps2pd xmm0, xmm0
push ecx
push ecx
mulsd xmm0, qword [0x101312b8]
addsd xmm0, qword [0x10131280]
cvttsd2si eax, xmm0
movd xmm0, eax
lea eax, [ebp - 0x84]
cvtdq2ps xmm0, xmm0
divss xmm0, dword [0x1013a6e4]
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
push 0x90e
push eax
call fcn.100b3c7b
add esp, 0x10
test edi, edi
je 0x100fb2e7
mov eax, dword [edi]
lea ecx, [ebp - 0x84]
push ecx
push 1
push edi
call dword [eax + 0x18]
add esp, 0xc
and dword [esi + 0x80], 0xfffffffa
cmp dword [ebp - 0x294], 0
je 0x100fb302
mov eax, dword [esi + 0x14]
push 5
push eax
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov eax, dword [ebp - 0x1bc]
cmp eax, 0xfffffff4
je 0x100fb356
cmp dword [ebx + 0x33c], 2
je 0x100fb356
test byte [ebp + 0x1c], 0x80
jne 0x100fb325
push eax
push esi
mov ecx, ebx
call fcn.100b3c7b
mov edx, dword [ebx + 0x338]
test edx, edx
jle 0x100fb343
mov eax, dword [esi + 0x14]
push 0xff000000
push edx
push 0
mov ecx, dword [eax]
push eax
call dword [ecx + 0x84]
mov ecx, ebx
call fcn.1001a228
test eax, eax
je 0x100fb356
push esi
mov ecx, ebx
call fcn.100b3c7b
mov eax, dword [esi + 0x14]
push 3
push eax
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov eax, dword [ebx + 0x164]
mov ecx, dword [ebp - 0x228]
movss xmm0, dword [ebp - 0x238]
mov dword [eax + 0x14], ecx
mov eax, dword [ebx + 0x164]
movss dword [eax + 0x9c], xmm0
mov eax, dword [ebp - 0x214]
dec eax
cmp dword [ebp - 0x1c0], eax
jne 0x100fb3f6
cmp dword [ebp - 0x208], 0
je 0x100fb3c4
test edi, edi
je 0x100fb3af
push 2
mov ecx, edi
call fcn.100b3c7b
test al, al
je 0x100fb3c4
mov eax, dword [esi + 0x14]
push dword [ebp - 0x20c]
push dword [ebp - 0x208]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x64]
mov eax, dword [esi + 0x14]
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov eax, dword [esi + 0x14]
and dword [eax + 0x1c], 0
test edi, edi
je 0x100fb3f6
mov eax, dword [ebx + 0x164]
cmp dword [eax + 0xa4], 0
je 0x100fb3f6
mov eax, dword [edi]
or ecx, 0xffffffff
push 0
push ecx
push ecx
push edi
call dword [eax + 0xc]
mov eax, dword [ebp - 0x1c0]
mov ecx, dword [ebp - 0x214]
inc eax
mov dword [ebp - 0x1c0], eax
cmp eax, ecx
jl 0x100f968e
jmp 0x100fb43a
mov ecx, dword [ebx]
push 0
push 8
push ebx
call dword [ecx + 0x15c]
push 0xfffffffffffffffd
jmp 0x100f9515
push dword [ebp - 0x20c]
mov ecx, ebx
push dword [ebp - 0x208]
call fcn.100b3c7b
test edi, edi
je 0x100fb449
mov eax, dword [edi]
mov ecx, edi
push 0
push 0
call dword [eax + 0x78]
and dword [0x1016f14c], 0
mov ebx, dword [ebp - 0x1bc]
mov byte [0x1016f164], 0
cmp ebx, 0xfffffff4
je 0x100fb475
test edi, edi
je 0x100fb475
mov ecx, edi
call fcn.100ada3d
test al, al
push 0xffffffffffffffff
pop eax
cmove ebx, eax
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1012364c
mov esp, ebp
pop ebp
ret 0x18