Function at 0x10017510
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10051c6d
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x100e8018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov ebx, ecx
push str._______________________________________________________
mov byte [ebp - 0x41], 0
mov byte [ebp - 0x44], 0
mov byte [ebp - 0x43], 0
mov byte [ebp - 0x42], 0
mov byte [ebp - 0x45], 0
mov dword [ebp - 0x60], 0
call fcn.1003af20
push str.Bitdefender_Anti_Exploit_Detection_Test_v2.0__INTERNAL_
call fcn.1003af20
push str._______________________________________________________
call fcn.1003af20
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.PID:_0x_08x_n
push dword [0x100ee8a4]
call fcn.1000f610
add esp, 0xc
cmp ebx, 2
jge 0x100175df
push str.Usage:_exploit_detection_test.exe__test_name___options__n_nOptions:_n__log__logfile____write_output_to_log_file_instead_of_stdout_n__remoteprocess__PID__name__n__remoteurl__URL__n__sih___skip_checking_installed_hooks_before_running_test_n__break___debug_break_before_running_test_n__twice___run_test_twice__in_the_same_process_n__wait____waits_for_enter_key_before_test_n__waitafter___waits_for_enter_key_after_running_test_n__threshold____runs_the_test_multiple_times_until_feedback_threshold_is_exceeded_n__osmitflags__flags____enables_OS_mitigations_described_on_Confluence:_Testing___EDT_mitigation_compatibility_n__crash___crashes_the_executable__will_not_run_any_test_n_nTests:_n
call fcn.10010e30
add esp, 4
xor esi, esi
nop dword [eax]
push dword [esi + 0x100cd440]
push dword [esi + 0x100cd43c]
push str.____40s__s_n
push dword [0x100ee8a4]
call fcn.1000f610
add esi, 0x10
add esp, 0x10
cmp esi, 0xb40
jb 0x100175b0
jmp 0x10017fff
call fcn.10017310
test al, al
jne 0x10017600
push str.Error:_init___failed_inside_EDT_main____before_running_any_test__n
push dword [0x100ee8a4]
call fcn.1000f610
add esp, 8
jmp 0x10017fff
push str.crash
push dword [edi + 4]
call fcn.10039a44
add esp, 8
test eax, eax
jne 0x10017643
push str.Creating_invalid_function_n
push dword [0x100ee8a4]
call fcn.1000f610
push str.Calling_invalid_function_to_crash_application_n
push dword [0x100ee8a4]
xor esi, esi
call fcn.1000f610
add esp, 0x10
mov byte [esi], 1
xor eax, eax
jmp 0x10018002
mov eax, 0x100cd438
xor esi, esi
mov dword [ebp - 0x54], eax
nop dword [eax]
push dword [eax + 4]
push dword [edi + 4]
call fcn.10039a44
add esp, 8
test eax, eax
je 0x10017744
push str.runall
push dword [edi + 4]
call fcn.10039a44
add esp, 8
test eax, eax
je 0x10017693
mov eax, dword [ebp - 0x54]
add esi, 0x10
add eax, 0x10
mov dword [ebp - 0x54], eax
cmp esi, 0xb40
jb 0x10017650
jmp 0x1001774a
xor ebx, ebx
xor edi, edi
nop word [eax + eax]
push dword [edi + 0x100cd43c]
push str.Running__s_.._n
push dword [0x100ee8a4]
call fcn.1000f610
mov ecx, dword [edi + 0x100cd438]
call fcn.100170d0
push dword [edi + 0x100cd43c]
movzx esi, al
push str.Finished__s_.._n
push dword [0x100ee8a4]
call fcn.1000f610
add esp, 0x18
test esi, esi
je 0x100176f6
push str._tSUCCESS_n
push dword [0x100ee8a4]
call fcn.1000f610
add esp, 8
jmp 0x10017711
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._tFAILED._Last_Error__d_n
push dword [0x100ee8a4]
call fcn.1000f610
add esp, 0xc
inc ebx
add edi, 0x10
cmp edi, 0xb40
jb 0x100176a0
push ebx
push 0xb4
push str.Total_tests__d._Failed_Tests__d_n
push dword [0x100ee8a4]
call fcn.1000f610
add esp, 0x10
test ebx, ebx
jne 0x10017fff
xor eax, eax
jmp 0x10018002
cmp dword [ebp - 0x54], 0
jne 0x10017765
push dword [edi + 4]
push str.Invalid_specified_test:__s_n
push dword [0x100ee8a4]
call fcn.1000f610
add esp, 0xc
jmp 0x10017fff
mov esi, 2
cmp ebx, esi
jle 0x100179e2
push 0x100d813c
push dword [edi + esi*4]
call fcn.10039a44
add esp, 8
test eax, eax
jne 0x100177d4
inc esi
cmp esi, ebx
jge 0x10017a3f
push 0x100d8164
push dword [edi + esi*4]
push 0x100ee8a4
call fcn.1003b337
add esp, 0xc
mov dword [ebp - 0x4c], eax
test eax, eax
je 0x100179d9
push 1
call fcn.10039bee
mov esi, dword [ebp - 0x4c]
push esi
push str.Error__d_opening_LogFile__n
push eax
mov dword [0x100ee8a4], eax
call fcn.1000f610
add esp, 0x10
mov eax, esi
jmp 0x10018002
push str.remoteprocess
push dword [edi + esi*4]
call fcn.10039a44
add esp, 8
test eax, eax
jne 0x10017838
inc esi
cmp esi, ebx
jge 0x10017a6f
mov ecx, dword [edi + esi*4]
call fcn.1002f1d0
mov dword [0x100ee8a8], eax
test eax, eax
je 0x10017a57
cmp eax, 0xffff
jae 0x10017a57
mov ecx, eax
call fcn.1002d1f0
test eax, eax
jne 0x100179d9
push str.Remote_process_does_not_match_architecture_of_exploit_detection_test.exe_n
push dword [0x100ee8a4]
call fcn.1000f610
add esp, 8
jmp 0x10017fff
push str.remoteprocessid
push dword [edi + esi*4]
call fcn.10039a44
add esp, 8
test eax, eax
je 0x10017bb4
push str.remoteprocessname
push dword [edi + esi*4]
call fcn.10039a44
add esp, 8
test eax, eax
je 0x10017b5b
push str.remoteprocesspath
push dword [edi + esi*4]
call fcn.10039a44
add esp, 8
test eax, eax
je 0x10017b02
push str.remoteurl
push dword [edi + esi*4]
call fcn.10039a44
add esp, 8
test eax, eax
jne 0x100178c4
inc esi
cmp esi, ebx
jge 0x10017a9f
push 4
push str.http
push dword [edi + esi*4]
call fcn.1003b00e
add esp, 0xc
test eax, eax
jne 0x10017a87
mov eax, dword [edi + esi*4]
mov dword [0x100ee8b4], eax
jmp 0x100179d9
push str.break
push dword [edi + esi*4]
call fcn.10039a44
add esp, 8
test eax, eax
jne 0x100178e1
mov byte [ebp - 0x41], 1
jmp 0x100179d9
push str.twice
push dword [edi + esi*4]
call fcn.10039a44
add esp, 8
test eax, eax
jne 0x100178fe
mov byte [ebp - 0x44], 1
jmp 0x100179d9
push str.wait
push dword [edi + esi*4]
call fcn.10039a44
add esp, 8
test eax, eax
jne 0x1001791b
mov byte [ebp - 0x43], 1
jmp 0x100179d9
push str.waitafter
push dword [edi + esi*4]
call fcn.10039a44
add esp, 8
test eax, eax
jne 0x10017938
mov byte [ebp - 0x42], 1
jmp 0x100179d9
push str.threshold
push dword [edi + esi*4]
call fcn.10039a44
add esp, 8
test eax, eax
jne 0x10017955
mov byte [ebp - 0x45], 1
jmp 0x100179d9
push str.osmitflags
push dword [edi + esi*4]
call fcn.10039a44
add esp, 8
test eax, eax
jne 0x100179bc
inc esi
cmp esi, ebx
jge 0x10017acf
push 2
push 0x100d8400
push dword [edi + esi*4]
call fcn.1003b00e
add esp, 0xc
test eax, eax
jne 0x10017ab7
push 0x10
push eax
push dword [edi + esi*4]
call fcn.1003adbe
add esp, 0xc
mov dword [ebp - 0x60], eax
cmp eax, 0x3f
jbe 0x100179d9
push 0x3f
push str.Flags_exceed_the_max_possible_value__which_is__x._n
push dword [0x100ee8a4]
call fcn.1000f610
add esp, 0xc
jmp 0x10017fff
push 0x100d845c
push dword [edi + esi*4]
call fcn.10039a44
add esp, 8
test eax, eax
jne 0x10017ae7
mov byte [0x100ee8b8], al
inc esi
cmp esi, ebx
jl 0x10017772
cmp byte [0x100ee8b8], 0
je 0x10017cf0
push 0x34
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x58], 0
call fcn.100313da
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [ebp - 0x5c], eax
lea ecx, [ebp - 0x5c]
mov dword [ebp - 4], 0
call fcn.1000f810
test al, al
jne 0x10017c20
lea eax, [ebp - 0x5c]
push eax
mov ecx, eax
call fcn.10010120
jmp 0x10017fff
push str.Log_file_name_was_not_specified_
push dword [0x100ee8a4]
call fcn.1000f610
add esp, 8
jmp 0x10017fff
push str.Remote_process_ID_is_not_correct__n
push dword [0x100ee8a4]
call fcn.1000f610
add esp, 8
jmp 0x10017fff
push str.Remote_process_ID_was_not_specified__n
push dword [0x100ee8a4]
call fcn.1000f610
add esp, 8
jmp 0x10017fff
push str.Please_specify_remote_url_including_http:_____n
push dword [0x100ee8a4]
call fcn.1000f610
add esp, 8
jmp 0x10017fff
push str.Remote_URL_not_specified__n
push dword [0x100ee8a4]
call fcn.1000f610
add esp, 8
jmp 0x10017fff
push str.Flags_should_be_preceded_by_0x._n
push dword [0x100ee8a4]
call fcn.1000f610
add esp, 8
jmp 0x10017fff
push str.Flags_not_specified__n
push dword [0x100ee8a4]
call fcn.1000f610
add esp, 8
jmp 0x10017fff
push dword [edi + esi*4]
push str.Invalid_parameter:__s_n
push dword [0x100ee8a4]
call fcn.1000f610
add esp, 0xc
jmp 0x10017fff
inc esi
cmp esi, ebx
jl 0x10017b1f
push str.Remote_process_path_not_specified__n
push dword [0x100ee8a4]
call fcn.1000f610
add esp, 8
jmp 0x10017fff
mov eax, dword [edi + esi*4]
mov edx, edi
push 0
mov ecx, ebx
mov dword [0x100ee8b0], eax
call fcn.1001ca60
add esp, 4
test eax, eax
jne 0x1001763c
push dword [0x100ee8b0]
push str.Failed_to_inject_EDT_in_remote_process_with_path__s
push dword [0x100ee8a4]
call fcn.1000f610
add esp, 0xc
jmp 0x10017fff
inc esi
cmp esi, ebx
jl 0x10017b78
push str.Remote_process_name_not_specified__n
push dword [0x100ee8a4]
call fcn.1000f610
add esp, 8
jmp 0x10017fff
mov eax, dword [edi + esi*4]
mov edx, edi
push 2
mov ecx, ebx
mov dword [0x100ee8ac], eax
call fcn.1001ca60
add esp, 4
test eax, eax
jne 0x1001763c
push dword [0x100ee8ac]
push str.Failed_to_inject_EDT_in_remote_process_with_name__s
push dword [0x100ee8a4]
call fcn.1000f610
add esp, 0xc
jmp 0x10017fff
inc esi
cmp esi, ebx
jge 0x10017a6f
mov ecx, dword [edi + esi*4]
call fcn.1002f1d0
mov dword [0x100ee8a8], eax
test eax, eax
je 0x10017a57
cmp eax, 0xffff
jae 0x10017a57
mov ecx, eax
call fcn.1002d1f0
test eax, eax
je 0x10017820
push 1
mov edx, edi
mov ecx, ebx
call fcn.1001ca60
add esp, 4
test eax, eax
jne 0x1001763c
push dword [0x100ee8a8]
push str.Failed_to_inject_EDT_in_remote_process_with_id__d
push dword [0x100ee8a4]
call fcn.1000f610
add esp, 0xc
jmp 0x10017fff
sub esp, 8
mov esi, esp
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x50], esi
push 0x34
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [ebp - 0x4c], esi
call fcn.100313da
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov byte [ebp - 4], 1
mov ecx, esi
push dword [ebp - 0x4c]
push eax
mov eax, dword [ebp - 0x5c]
push dword [eax + 4]
call fcn.1001c4e0
mov ecx, dword [esi]
mov dword [ecx + 4], eax
mov edi, dword [esi]
mov eax, dword [ebp - 0x58]
mov dword [esi + 4], eax
mov edx, dword [edi + 4]
cmp byte [edx + 0xd], 0
jne 0x10017cb4
mov ecx, dword [edx]
cmp byte [ecx + 0xd], 0
jne 0x10017c94
mov eax, dword [ecx]
mov edx, ecx
mov ecx, eax
cmp byte [eax + 0xd], 0
je 0x10017c88
mov dword [edi], edx
mov edx, dword [esi]
mov ecx, dword [edx + 4]
mov eax, dword [ecx + 8]
cmp byte [eax + 0xd], 0
jne 0x10017caf
mov ecx, eax
mov eax, dword [ecx + 8]
cmp byte [eax + 0xd], 0
je 0x10017ca4
mov dword [edx + 8], ecx
jmp 0x10017cbb
mov dword [edi], edi
mov eax, dword [esi]
mov dword [eax + 8], eax
mov dword [ebp - 0x4c], 0
mov byte [ebp - 4], 0
call fcn.1000fa60
push 0x100d2d20
push dword [0x100ee8a4]
call fcn.1000f610
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x5c]
mov ecx, eax
push eax
call fcn.10010120
mov ebx, dword [ebp - 0x54]
mov eax, dword [0x100ee8a8]
mov ecx, dword [ebx + 0xc]
mov edx, ecx
and edx, 2
je 0x10017d21
test eax, eax
jne 0x10017d21
push dword [ebx + 4]
push str.Test__s_requires_remote_Process_ID_n
push dword [0x100ee8a4]
call fcn.1000f610
add esp, 0xc
jmp 0x10017fff
test edx, edx
jne 0x10017d48
test eax, eax
je 0x10017d48
push eax
push dword [ebx + 4]
push str.WARNING:_Test__s_received_remote_Process_ID:__d_but_it_doesnt_support_remote_functionality._Process_ID_Will_be_ignored_n
push dword [0x100ee8a4]
call fcn.1000f610
mov ecx, dword [ebx + 0xc]
add esp, 0x10
mov eax, dword [0x100ee8a8]
test cl, 4
je 0x10017d71
cmp dword [0x100ee8b4], 0
jne 0x10017d97
push dword [ebx + 4]
push str.Test__s_requires_remote_URL__n
push dword [0x100ee8a4]
call fcn.1000f610
add esp, 0xc
jmp 0x10017fff
mov ecx, dword [0x100ee8b4]
test ecx, ecx
je 0x10017d97
push ecx
push dword [ebx + 4]
push str.WARNING:_Test__s_received_remote_URL:__s_but_it_doesnt_support_this_functionality._URL_is_going_to_be_ignored_n
push dword [0x100ee8a4]
call fcn.1000f610
mov eax, dword [0x100ee8a8]
add esp, 0x10
mov ecx, dword [ebp - 0x60]
test ecx, ecx
je 0x10017dc4
call fcn.1002f600
test eax, eax
jne 0x10017dbf
push str.Enabling_of_mitigations_failed__n
push dword [0x100ee8a4]
call fcn.1000f610
add esp, 8
jmp 0x10017fff
mov eax, dword [0x100ee8a8]
mov ecx, dword [ebx + 4]
test eax, eax
je 0x10017de3
push eax
push eax
push ecx
push str.Running__s_in_process_with_PID__d__0x_X_..._n
push dword [0x100ee8a4]
call fcn.1000f610
add esp, 0x14
jmp 0x10017df7
push ecx
push str.Running__s..._n
push dword [0x100ee8a4]
call fcn.1000f610
add esp, 0xc
push dword [0x100ee8a4]
call fcn.10039f65
add esp, 4
cmp byte [ebp - 0x43], 0
je 0x10017e23
push str.Press_enter_key_to_run_test...
push dword [0x100ee8a4]
call fcn.1000f610
add esp, 8
call fcn.1003a249
cmp byte [ebp - 0x41], 0
je 0x10017e2a
int3
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebx]
call fcn.100170d0
movzx edi, al
mov ecx, str.FAILED
test edi, edi
mov dword [ebp - 0x4c], edi
mov eax, str.SUCCESS
cmove eax, ecx
push eax
push str.Result:__s_n
push dword [0x100ee8a4]
call fcn.1000f610
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 0xc
test edi, edi
jne 0x10017f61
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
mov dword [ebp - 4], 2
call esi
mov edi, eax
test edi, edi
je 0x10017f11
mov edx, edi
lea ecx, [ebp - 0x40]
call fcn.1002dfc0
push eax
lea ecx, [ebp - 0x28]
call fcn.100043c0
mov edx, dword [ebp - 0x2c]
cmp edx, 0x10
jb 0x10017edf
mov ecx, dword [ebp - 0x40]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10017ed5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10018194
push edx
push ecx
call fcn.1003140a
add esp, 8
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
mov dword [ebp - 0x30], 0
cmovae eax, dword [ebp - 0x28]
push eax
push edi
push str.Last_Error:__d_____s_n
push dword [0x100ee8a4]
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
call fcn.1000f610
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x10017f4c
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10017f42
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10018199
push edx
push ecx
call fcn.1003140a
add esp, 8
mov edi, dword [ebp - 0x4c]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
cmp byte [ebp - 0x42], 0
je 0x10017f7f
push str.Press_enter_key_to_continue...
push dword [0x100ee8a4]
call fcn.1000f610
add esp, 8
call fcn.1003a249
test edi, edi
je 0x10017fff
cmp byte [ebp - 0x44], 0
je 0x10018133
push 1
lea eax, [ebp - 0x24]
mov dword [ebp - 0x34], 0xc
xorps xmm0, xmm0
push eax
movq qword [ebp - 0x30], xmm0
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push 0
push 1
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
lea eax, [ebp - 0x24]
mov dword [ebp - 0x30], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edx, eax
mov ecx, 0x100d2d44
call fcn.100104b0
mov edi, eax
lea eax, [ebp - 0x34]
push edi
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0x4c], eax
test eax, eax
jne 0x1001801e
call esi
push eax
push edi
push str.ERROR:_Couldnt_create_second_run_ready_event:__S_nLastError:__d_n
push dword [0x100ee8a4]
call fcn.1000f610
add esp, 0x10
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100313c7
mov esp, ebp
pop ebp
ret
call esi
push edi
cmp eax, 0xb7
jne 0x1001803d
push str.ERROR:_Event_already_exists:__S_nThis_happens_when_tests_with_identical_command_lines_are_ran_at_the_same_time.
push dword [0x100ee8a4]
call fcn.1000f610
add esp, 0xc
jmp 0x10017fff
push str.Event_created:__S_n
push dword [0x100ee8a4]
call fcn.1000f610
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edx, eax
mov ecx, str.SecondRun
call fcn.100104b0
mov edi, eax
push edi
push 0
push 2
call dword [sym.imp.KERNEL32.dll_OpenEventW]
test eax, eax
jne 0x10018081
call esi
push eax
push edi
push str.ERROR:_Couldnt_open_second_run_event:__S_nLastError:__d_n
jmp 0x10017ff1
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
jne 0x100180a7
call esi
push eax
push str.SetEvent___failed_for_second_run_event__nLastError:__d_n
push dword [0x100ee8a4]
call fcn.1000f610
add esp, 0xc
jmp 0x10017fff
push 0x1388
push dword [ebp - 0x4c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x100180d1
push str.Wait_fail_timeout_for_second_run_ready_event__n
push dword [0x100ee8a4]
call fcn.1000f610
add esp, 8
jmp 0x10017fff
cmp byte [ebp - 0x41], 0
je 0x100180d8
int3
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebx]
call fcn.100170d0
movzx esi, al
mov ecx, str.FAILED
test esi, esi
mov eax, str.SUCCESS
cmove eax, ecx
push eax
push str.Result2:__s_n
push dword [0x100ee8a4]
call fcn.1000f610
add esp, 0xc
cmp byte [ebp - 0x42], 0
je 0x1001812b
push str.Press_enter_key_to_continue...
push dword [0x100ee8a4]
call fcn.1000f610
add esp, 8
call fcn.1003a249
test esi, esi
je 0x10017fff
cmp byte [ebp - 0x45], 0
je 0x1001817f
xor edi, edi
nop dword [eax + eax]
mov ecx, dword [ebx]
call fcn.100170d0
movzx esi, al
mov ecx, str.FAILED
test esi, esi
mov eax, str.SUCCESS
cmove eax, ecx
push eax
lea eax, [edi + 2]
push eax
push str.Result__d:__s_n
push dword [0x100ee8a4]
call fcn.1000f610
add esp, 0x10
test esi, esi
je 0x10017fff
inc edi
cmp edi, 5
jl 0x10018140
push dword [0x100ee8a4]
call fcn.1003a031
add esp, 4
xor eax, eax
jmp 0x10018002
call fcn.100397bd
call fcn.100397bd
int3