Function at 0x100620d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov eax, dword [0x1013e00c]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push esi
push edi
push 0x10062010
push 0x4830ae
push 0xe9
mov dword [esp + 0x38], 0
call fcn.100c88d0
add esp, 0xc
cmp dword [0x101eb060], 1
jne 0x1006214e
push 0x10050520
push 0x95e1ab
push 0xe9
call fcn.100c88d0
push 0x10050590
push 0x95e1c4
push 0xe9
call fcn.100c88d0
push 0x100504e0
push 0x95f9b0
push 0xe9
call fcn.100c88d0
add esp, 0x24
cmp dword [0x101eb06c], 1
jne 0x1006216e
push 0x10061ff0
push 0x66271f
push 0xe9
call fcn.100c88d0
add esp, 0xc
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 0x30]
push eax
push 0x40
push 1
push 0x8553d0
call esi
lea eax, [esp + 0x30]
mov byte [0x8553d0], 0xc3
push eax
push dword [esp + 0x34]
push 1
push 0x8553d0
call esi
lea eax, [esp + 0x30]
push eax
push 0x40
push 1
push 0x59a8d0
call esi
lea eax, [esp + 0x30]
mov byte [0x59a8d0], 0xeb
push eax
push dword [esp + 0x34]
push 1
push 0x59a8d0
call esi
lea eax, [esp + 0x30]
push eax
push 0x40
push 5
push 0x792b7f
call esi
mov eax, 0x792b7f
mov dword [eax], 0x90909090
mov byte [eax + 4], 0x90
lea eax, [esp + 0x30]
push eax
push dword [esp + 0x34]
push 5
push 0x792b7f
call esi
mov ecx, 0x101eadc3
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10062200
sub ecx, edx
je 0x1006227a
push ecx
push 0x101eadc3
lea ecx, [esp + 0x1c]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0xf
mov byte [esp + 0x1c], al
call fcn.1000b650
mov dword [esp + 0x2c], 1
lea edx, [esp + 0x14]
mov ebx, dword [esp + 0x28]
cmp ebx, 0x10
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
cmovae edx, ecx
test eax, eax
je 0x10062282
lea edi, [eax + edx]
mov eax, edx
cmp edx, edi
jae 0x10062282
nop dword [eax]
cmp byte [eax], 0x20
jne 0x1006226c
inc eax
cmp eax, edi
jb 0x10062260
jmp 0x10062282
sub eax, edx
cmp eax, 0xffffffff
je 0x10062282
mov byte [esp + 0x13], 0
jmp 0x10062287
mov ebx, dword [esp + 0x28]
mov ecx, dword [esp + 0x14]
mov byte [esp + 0x13], 1
test byte [esp + 0x2c], 1
je 0x100622be
cmp ebx, 0x10
jb 0x100622be
lea edx, [ebx + 1]
mov eax, ecx
cmp edx, 0x1000
jb 0x100622b4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100628ad
push edx
push ecx
call fcn.100d7723
add esp, 8
cmp byte [esp + 0x13], 0
je 0x100622e5
cmp byte [0x101eb18f], 0
jne 0x100622e5
push 0x1002d080
push 0x63764c
push 0xe9
call fcn.100c88d0
add esp, 0xc
push 0x82a9f3
push 0x82a983
push 0xe9
call fcn.100c88d0
push 0x82a9f3
push 0x82a983
push 0xe9
call fcn.100c88d0
add esp, 0x18
cmp dword [0x101eb074], 1
jne 0x10062330
push 0x10061fb0
push 0x78f56e
push 0xe9
call fcn.100c88d0
add esp, 0xc
push 0x1004b320
push 0x4d92e2
push 0xe8
call fcn.100c88d0
push fcn.1004b8d0
push 0x95e310
push 0xe8
call fcn.100c88d0
push fcn.1004b8d0
push 0x95e6eb
push 0xe8
call fcn.100c88d0
add esp, 0x24
lea eax, [esp + 0x2c]
push eax
push 0x40
push 1
push 0x649e27
call esi
lea eax, [esp + 0x2c]
mov byte [0x649e27], 0xe
push eax
push dword [esp + 0x30]
push 1
push 0x649e27
call esi
lea eax, [esp + 0x2c]
push eax
push 0x40
push 1
push 0x556c38
call esi
lea eax, [esp + 0x2c]
mov byte [0x556c38], 2
push eax
push dword [esp + 0x30]
push 1
push 0x556c38
call esi
push 0x18
call fcn.100d7d9e
movaps xmm0, xmmword [0x101365a0]
add esp, 4
mov edi, eax
mov dword [esp + 0x2c], 0
lea eax, [esp + 0x2c]
push eax
push 0x40
push 0x18
movups xmmword [edi], xmm0
push 0x77eecd
movq qword [edi + 0x10], xmm0
call esi
test eax, eax
je 0x10062439
mov eax, dword [edi]
mov ecx, 0x77eecd
mov dword [ecx], eax
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
mov eax, dword [edi + 8]
mov dword [ecx + 8], eax
mov eax, dword [edi + 0xc]
mov dword [ecx + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [ecx + 0x10], eax
mov eax, dword [edi + 0x14]
mov dword [ecx + 0x14], eax
lea eax, [esp + 0x30]
push eax
push dword [esp + 0x30]
mov dword [esp + 0x38], 0
push 0x18
push ecx
call esi
test eax, eax
jne 0x1006243f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x5db408
push 0x5db322
push 0xe9
call fcn.100c88d0
push 0x58811f
push 0x5880f0
push 0xe9
call fcn.100c88d0
add esp, 0x18
lea eax, [esp + 0x2c]
push eax
push 0x40
push 4
push 0x588447
call esi
lea eax, [esp + 0x2c]
mov dword [0x588447], 0xfff
push eax
push dword [esp + 0x30]
push 4
push 0x588447
call esi
push 0x59b00e
push 0x59affa
push 0xe8
call fcn.100c88d0
push 0x95dfd3
push 0x95dfbe
push 0xe9
call fcn.100c88d0
push 0x720894
push 0x71ae92
push 0xe9
call fcn.100c88d0
push 0x720894
push 0x71b1a3
push 0xe9
call fcn.100c88d0
push 0x644537
push 0x64452a
push 0xe9
call fcn.100c88d0
add esp, 0x3c
lea eax, [esp + 0x2c]
push eax
push 0x40
push 1
push 0x4d128f
call esi
lea eax, [esp + 0x2c]
mov byte [0x4d128f], 0x1d
push eax
push dword [esp + 0x30]
push 1
push 0x4d128f
call esi
movzx edi, word [0x101eb008]
lea eax, [esp + 0x2c]
push eax
push 0x40
push 2
push 0x405b7c
call esi
lea eax, [esp + 0x2c]
mov word [0x405b7c], di
push eax
push dword [esp + 0x30]
push 2
push 0x405b7c
call esi
movzx edi, word [0x101eb008]
lea eax, [esp + 0x2c]
push eax
push 0x40
push 2
push 0x40cc40
call esi
lea eax, [esp + 0x2c]
mov word [0x40cc40], di
push eax
push dword [esp + 0x30]
push 2
push 0x40cc40
call esi
lea eax, [esp + 0x2c]
push eax
push 0x40
push 4
push 0x5b57ed
call esi
lea eax, [esp + 0x2c]
mov dword [0x5b57ed], 0x400
push eax
push dword [esp + 0x30]
push 4
push 0x5b57ed
call esi
lea eax, [esp + 0x2c]
push eax
push 0x40
push 4
push 0x589dbe
call esi
lea eax, [esp + 0x2c]
mov dword [0x589dbe], 0x400
push eax
push dword [esp + 0x30]
push 4
push 0x589dbe
call esi
lea eax, [esp + 0x2c]
push eax
push 0x40
push 4
push 0x4d2cb2
call esi
lea eax, [esp + 0x2c]
mov dword [0x4d2cb2], 0x3800
push eax
push dword [esp + 0x30]
push 4
push 0x4d2cb2
call esi
lea eax, [esp + 0x2c]
push eax
push 0x40
push 4
push 0x4d2d9c
call esi
lea eax, [esp + 0x2c]
mov dword [0x4d2d9c], 0x3800
push eax
push dword [esp + 0x30]
push 4
push 0x4d2d9c
call esi
mov eax, dword [0x101eb104]
dec eax
cmp eax, 3
ja case.default.0x10062645
jmp dword [eax*4 + 0x100630f0]
push 3
push 0x10132d14
lea ecx, [esp + 0x1c]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0xf
mov byte [esp + 0x1c], 0
call fcn.1000b650
cmp dword [esp + 0x28], 0x10
lea ecx, [esp + 0x14]
mov edi, dword [esp + 0x14]
mov edx, dword [esp + 0x24]
cmovae ecx, edi
push 3
push 0x10132d10
call fcn.10063130
add esp, 8
test eax, eax
jne 0x1006269f
mov ebx, 0x35c
jmp 0x100626ab
lea ecx, [esp + 0x14]
call fcn.10061f10
movzx ebx, ax
mov eax, dword [esp + 0x28]
cmp eax, 0x10
jb 0x100628b7
lea ecx, [eax + 1]
mov eax, edi
cmp ecx, 0x1000
jb 0x100626d9
mov edi, dword [edi - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100628ad
push ecx
push edi
call fcn.100d7723
add esp, 8
jmp 0x100628b7
push 3
push 0x10132d18
lea ecx, [esp + 0x1c]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0xf
mov byte [esp + 0x1c], 0
call fcn.1000b650
cmp dword [esp + 0x28], 0x10
lea ecx, [esp + 0x14]
mov edi, dword [esp + 0x14]
mov edx, dword [esp + 0x24]
cmovae ecx, edi
push 3
push 0x10132d10
call fcn.10063130
add esp, 8
test eax, eax
jne 0x1006273b
mov ebx, 0x35c
jmp 0x10062747
lea ecx, [esp + 0x14]
call fcn.10061f10
movzx ebx, ax
mov eax, dword [esp + 0x28]
cmp eax, 0x10
jb 0x100628b7
lea ecx, [eax + 1]
mov eax, edi
cmp ecx, 0x1000
jb 0x10062775
mov edi, dword [edi - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100628ad
push ecx
push edi
call fcn.100d7723
add esp, 8
jmp 0x100628b7
push 3
push 0x10132d1c
lea ecx, [esp + 0x1c]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0xf
mov byte [esp + 0x1c], 0
call fcn.1000b650
cmp dword [esp + 0x28], 0x10
lea ecx, [esp + 0x14]
mov edi, dword [esp + 0x14]
mov edx, dword [esp + 0x24]
cmovae ecx, edi
push 3
push 0x10132d10
call fcn.10063130
add esp, 8
test eax, eax
jne 0x100627d7
mov ebx, 0x35c
jmp 0x100627e3
lea ecx, [esp + 0x14]
call fcn.10061f10
movzx ebx, ax
mov eax, dword [esp + 0x28]
cmp eax, 0x10
jb 0x100628b7
lea ecx, [eax + 1]
mov eax, edi
cmp ecx, 0x1000
jb 0x10062811
mov edi, dword [edi - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100628ad
push ecx
push edi
call fcn.100d7723
add esp, 8
jmp 0x100628b7
push 3
push 0x10132d20
lea ecx, [esp + 0x1c]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0xf
mov byte [esp + 0x1c], 0
call fcn.1000b650
cmp dword [esp + 0x28], 0x10
lea ecx, [esp + 0x14]
mov edi, dword [esp + 0x14]
mov edx, dword [esp + 0x24]
cmovae ecx, edi
push 3
push 0x10132d10
call fcn.10063130
add esp, 8
test eax, eax
jne 0x10062873
mov ebx, 0x35c
jmp 0x1006287f
lea ecx, [esp + 0x14]
call fcn.10061f10
movzx ebx, ax
mov eax, dword [esp + 0x28]
cmp eax, 0x10
jb 0x100628b7
lea ecx, [eax + 1]
mov eax, edi
cmp ecx, 0x1000
jb 0x100626d9
mov edi, dword [edi - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x100626d9
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
mov ebx, dword [esp + 0x2c]
cmp dword [0x101eb104], 1
jb 0x10062e34
lea eax, [esp + 0x2c]
push eax
push 0x40
push 1
push 0x958d4f
call esi
lea eax, [esp + 0x2c]
mov byte [0x958d4f], bl
push eax
push dword [esp + 0x30]
push 1
push 0x958d4f
call esi
lea eax, [esp + 0x2c]
push eax
push 0x40
push 1
push 0x958d50
call esi
lea eax, [esp + 0x2c]
mov byte [0x958d50], 3
push eax
push dword [esp + 0x30]
push 1
push 0x958d50
call esi
lea eax, [esp + 0x2c]
push eax
push 0x40
push 1
push 0x959036
call esi
lea eax, [esp + 0x2c]
mov byte [0x959036], 0
push eax
push dword [esp + 0x30]
push 1
push 0x959036
call esi
lea eax, [esp + 0x2c]
push eax
push 0x40
push 1
push 0x95903a
call esi
lea eax, [esp + 0x2c]
mov byte [0x95903a], bl
push eax
push dword [esp + 0x30]
push 1
push 0x95903a
call esi
lea eax, [esp + 0x2c]
push eax
push 0x40
push 1
push 0x95903b
call esi
lea eax, [esp + 0x2c]
mov byte [0x95903b], 3
push eax
push dword [esp + 0x30]
push 1
push 0x95903b
call esi
lea eax, [esp + 0x2c]
push eax
push 0x40
push 1
push 0x787041
call esi
lea eax, [esp + 0x2c]
mov byte [0x787041], bl
push eax
push dword [esp + 0x30]
push 1
push 0x787041
call esi
lea eax, [esp + 0x2c]
push eax
push 0x40
push 1
push 0x787042
call esi
lea eax, [esp + 0x2c]
mov byte [0x787042], 3
push eax
push dword [esp + 0x30]
push 1
push 0x787042
call esi
lea eax, [esp + 0x2c]
push eax
push 0x40
push 1
push 0x4215c2
call esi
lea eax, [esp + 0x2c]
mov byte [0x4215c2], 0
push eax
push dword [esp + 0x30]
push 1
push 0x4215c2
call esi
lea eax, [esp + 0x2c]
push eax
push 0x40
push 1
push 0x78b410
call esi
lea eax, [esp + 0x2c]
mov byte [0x78b410], bl
push eax
push dword [esp + 0x30]
push 1
push 0x78b410
call esi
lea eax, [esp + 0x2c]
push eax
push 0x40
push 1
push 0x78b411
call esi
lea eax, [esp + 0x2c]
mov byte [0x78b411], 3
push eax
push dword [esp + 0x30]
push 1
push 0x78b411
call esi
lea eax, [esp + 0x2c]
push eax
push 0x40
push 1
push 0x78b46b
call esi
lea eax, [esp + 0x2c]
mov byte [0x78b46b], bl
push eax
push dword [esp + 0x30]
push 1
push 0x78b46b
call esi
lea eax, [esp + 0x2c]
push eax
push 0x40
push 1
push 0x78b46c
call esi
lea eax, [esp + 0x2c]
mov byte [0x78b46c], 3
push eax
push dword [esp + 0x30]
push 1
push 0x78b46c
call esi
lea eax, [esp + 0x2c]
push eax
push 0x40
push 1
push 0x48d621
call esi
lea eax, [esp + 0x2c]
mov byte [0x48d621], bl
push eax
push dword [esp + 0x30]
push 1
push 0x48d621
call esi
lea eax, [esp + 0x2c]
push eax
push 0x40
push 1
push 0x48d622
call esi
lea eax, [esp + 0x2c]
mov byte [0x48d622], 3
push eax
push dword [esp + 0x30]
push 1
push 0x48d622
call esi
lea eax, [esp + 0x2c]
push eax
push 0x40
push 1
push 0x4918c9
call esi
lea eax, [esp + 0x2c]
mov byte [0x4918c9], bl
push eax
push dword [esp + 0x30]
push 1
push 0x4918c9
call esi
lea eax, [esp + 0x2c]
push eax
push 0x40
push 1
push 0x4918ca
call esi
lea eax, [esp + 0x2c]
mov byte [0x4918ca], 3
push eax
push dword [esp + 0x30]
push 1
push 0x4918ca
call esi
lea eax, [esp + 0x2c]
push eax
push 0x40
push 1
push 0x4918ea
call esi
lea eax, [esp + 0x2c]
mov byte [0x4918ea], bl
push eax
push dword [esp + 0x30]
push 1
push 0x4918ea
call esi
lea eax, [esp + 0x2c]
push eax
push 0x40
push 1
push 0x4918eb
call esi
lea eax, [esp + 0x2c]
mov byte [0x4918eb], 3
push eax
push dword [esp + 0x30]
push 1
push 0x4918eb
call esi
lea eax, [esp + 0x2c]
push eax
push 0x40
push 1
push 0x786d31
call esi
lea eax, [esp + 0x2c]
mov byte [0x786d31], bl
push eax
push dword [esp + 0x30]
push 1
push 0x786d31
call esi
lea eax, [esp + 0x2c]
push eax
push 0x40
push 1
push 0x786d32
call esi
lea eax, [esp + 0x2c]
mov byte [0x786d32], 3
push eax
push dword [esp + 0x30]
push 1
push 0x786d32
call esi
lea eax, [esp + 0x2c]
push eax
push 0x40
push 1
push 0x786d31
call esi
lea eax, [esp + 0x2c]
mov byte [0x786d31], bl
push eax
push dword [esp + 0x30]
push 1
push 0x786d31
call esi
lea eax, [esp + 0x2c]
push eax
push 0x40
push 1
push 0x786d32
call esi
lea eax, [esp + 0x2c]
mov byte [0x786d32], 3
push eax
push dword [esp + 0x30]
push 1
push 0x786d32
call esi
lea eax, [esp + 0x2c]
push eax
push 0x40
push 1
push 0x787041
call esi
lea eax, [esp + 0x2c]
mov byte [0x787041], bl
push eax
push dword [esp + 0x30]
push 1
push 0x787041
call esi
lea eax, [esp + 0x2c]
push eax
push 0x40
push 1
push 0x787042
call esi
lea eax, [esp + 0x2c]
mov byte [0x787042], 3
push eax
push dword [esp + 0x30]
push 1
push 0x787042
call esi
lea eax, [esp + 0x2c]
push eax
push 0x40
push 1
push 0x78b410
call esi
lea eax, [esp + 0x2c]
mov byte [0x78b410], bl
push eax
push dword [esp + 0x30]
push 1
push 0x78b410
call esi
lea eax, [esp + 0x2c]
push eax
push 0x40
push 1
push 0x78b411
call esi
lea eax, [esp + 0x2c]
mov byte [0x78b411], 3
push eax
push dword [esp + 0x30]
push 1
push 0x78b411
call esi
lea eax, [esp + 0x2c]
push eax
push 0x40
push 1
push 0x78b46b
call esi
lea eax, [esp + 0x2c]
mov byte [0x78b46b], bl
push eax
push dword [esp + 0x30]
push 1
push 0x78b46b
call esi
lea eax, [esp + 0x2c]
push eax
push 0x40
push 1
push 0x78b46c
call esi
lea eax, [esp + 0x2c]
mov byte [0x78b46c], 3
push eax
push dword [esp + 0x30]
push 1
push 0x78b46c
call esi
lea eax, [esp + 0x2c]
push eax
push 0x40
push 1
push 0x840e76
call esi
lea eax, [esp + 0x2c]
mov byte [0x840e76], bl
push eax
push dword [esp + 0x30]
push 1
push 0x840e76
call esi
lea eax, [esp + 0x2c]
push eax
push 0x40
push 1
push 0x840e77
call esi
lea eax, [esp + 0x2c]
mov byte [0x840e77], 3
push eax
push dword [esp + 0x30]
push 1
push 0x840e77
call esi
cmp dword [0x101eb03c], 1
jne 0x10062e34
lea eax, [esp + 0x2c]
push eax
push 0x40
push 1
push 0x9591d3
call esi
lea eax, [esp + 0x2c]
mov byte [0x9591d3], 0x58
push eax
push dword [esp + 0x30]
push 1
push 0x9591d3
call esi
lea eax, [esp + 0x2c]
push eax
push 0x40
push 1
push 0x9591d4
call esi
lea eax, [esp + 0x2c]
mov byte [0x9591d4], 0xfc
push eax
push dword [esp + 0x30]
push 1
push 0x9591d4
call esi
lea eax, [esp + 0x2c]
push eax
push 0x40
push 1
push 0x9591d8
call esi
lea eax, [esp + 0x2c]
mov byte [0x9591d8], bl
push eax
push dword [esp + 0x30]
push 1
push 0x9591d8
call esi
lea eax, [esp + 0x2c]
push eax
push 0x40
push 1
push 0x9591d9
call esi
lea eax, [esp + 0x2c]
mov byte [0x9591d9], 3
push eax
push dword [esp + 0x30]
push 1
push 0x9591d9
call esi
cmp dword [0x101eb038], 1
jne 0x10062e66
lea eax, [esp + 0x2c]
push eax
push 0x40
push 1
push 0x4215a7
call esi
lea eax, [esp + 0x2c]
mov byte [0x4215a7], 0xeb
push eax
push dword [esp + 0x30]
push 1
push 0x4215a7
call esi
cmp dword [0x101eb03c], 1
jne 0x10062e98
lea eax, [esp + 0x2c]
push eax
push 0x40
push 1
push 0x507aeb
call esi
lea eax, [esp + 0x2c]
mov byte [0x507aeb], 0x72
push eax
push dword [esp + 0x30]
push 1
push 0x507aeb
call esi
cmp dword [0x101eb040], 1
jne 0x10062eca
lea eax, [esp + 0x2c]
push eax
push 0x40
push 1
push 0x507afd
call esi
lea eax, [esp + 0x2c]
mov byte [0x507afd], 0xeb
push eax
push dword [esp + 0x30]
push 1
push 0x507afd
call esi
cmp dword [0x101eb068], 1
jne 0x100630b0
lea eax, [esp + 0x2c]
push eax
push 0x40
push 1
push 0x501957
call esi
lea eax, [esp + 0x2c]
mov byte [0x501957], 0
push eax
push dword [esp + 0x30]
push 1
push 0x501957
call esi
lea eax, [esp + 0x2c]
push eax
push 0x40
push 6
push 0x54eae1
call esi
mov eax, 0x54eae1
mov ecx, 0x90909090
mov dword [eax], ecx
mov word [eax + 4], cx
lea eax, [esp + 0x2c]
push eax
push dword [esp + 0x30]
push 6
push 0x54eae1
call esi
lea eax, [esp + 0x2c]
push eax
push 0x40
push 6
push 0x54fc92
call esi
mov eax, 0x54fc92
mov ecx, 0x90909090
mov dword [eax], ecx
mov word [eax + 4], cx
lea eax, [esp + 0x2c]
push eax
push dword [esp + 0x30]
push 6
push 0x54fc92
call esi
lea eax, [esp + 0x2c]
push eax
push 0x40
push 1
push 0x50226b
call esi
lea eax, [esp + 0x2c]
mov byte [0x50226b], 0
push eax
push dword [esp + 0x30]
push 1
push 0x50226b
call esi
lea eax, [esp + 0x2c]
push eax
push 0x40
push 6
push 0x54eca3
call esi
mov eax, 0x54eca3
mov ecx, 0x90909090
mov dword [eax], ecx
mov word [eax + 4], cx
lea eax, [esp + 0x2c]
push eax
push dword [esp + 0x30]
push 6
push 0x54eca3
call esi
lea eax, [esp + 0x2c]
push eax
push 0x40
push 6
push 0x54fcec
call esi
mov ecx, 0x90909090
mov eax, 0x54fcec
mov dword [eax], ecx
mov word [eax + 4], cx
lea eax, [esp + 0x2c]
push eax
push dword [esp + 0x30]
push 6
push 0x54fcec
call esi
lea eax, [esp + 0x2c]
push eax
push 0x40
push 1
push 0x502c4d
call esi
lea eax, [esp + 0x2c]
mov byte [0x502c4d], 0
push eax
push dword [esp + 0x30]
push 1
push 0x502c4d
call esi
lea eax, [esp + 0x2c]
push eax
push 0x40
push 6
push 0x54ed6d
call esi
mov eax, 0x54ed6d
mov ecx, 0x90909090
mov dword [eax], ecx
mov word [eax + 4], cx
lea eax, [esp + 0x2c]
push eax
push dword [esp + 0x30]
push 6
push 0x54ed6d
call esi
lea eax, [esp + 0x2c]
push eax
push 0x40
push 6
push 0x54fd5f
call esi
mov eax, 0x54fd5f
mov ecx, 0x90909090
mov dword [eax], ecx
mov word [eax + 4], cx
lea eax, [esp + 0x2c]
push eax
push dword [esp + 0x30]
push 6
push 0x54fd5f
call esi
lea eax, [esp + 0x2c]
push eax
push 0x40
push 6
push 0x54fe3e
call esi
mov eax, 0x54fe3e
mov ecx, 0x90909090
mov dword [eax], ecx
mov word [eax + 4], cx
lea eax, [esp + 0x2c]
push eax
push dword [esp + 0x30]
push 6
push 0x54fe3e
call esi
push 0x10063100
push 0x614aef
push 0xe8
call fcn.100c88d0
push 0x10063100
push 0x772460
push 0xe8
call fcn.100c88d0
mov ecx, dword [esp + 0x4c]
add esp, 0x18
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100d7712
mov esp, ebp
pop ebp
ret