Function at 0x100a1500
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd04
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push dword [ebp + 0x10]
mov dword [ebp - 0xc28], ecx
mov ecx, dword [ebp + 0xc]
push ecx
mov dword [ebp - 0xc54], ecx
lea ecx, [ebp - 0xc44]
push eax
mov dword [ebp - 0xc50], eax
mov dword [ebp - 0xc44], 0
mov dword [ebp - 0xc40], 0
mov dword [ebp - 0xc3c], 0xffffffff
call fcn.10058810
test eax, eax
jne 0x100a25a4
mov dword [ebp - 0xc2c], 0x400
call fcn.100dd880
mov ebx, dword [ebp - 0xc2c]
xor ecx, ecx
mov dword [ebp - 0xc74], eax
mov edx, dword [ebp - 0xc3c]
mov eax, dword [ebp - 0xc44]
mov dword [ebp - 0xc48], ecx
cmp edx, 0xffffffff
je 0x100a1601
cmp ecx, edx
jb 0x100a1601
test eax, eax
je 0x100a1601
mov edi, ecx
sub edi, edx
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x100a15ba
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x3f
call fcn.10003680
add esp, 4
push 0
push 0
push 0
push 0
test eax, eax
je 0x100a15ed
lea ecx, [ebp - 0xc2c]
push ecx
lea ecx, [ebp - 0x804]
push ecx
mov ecx, dword [ebp - 0xc44]
push edi
push ecx
call eax
jmp 0x100a171c
lea eax, [ebp - 0xc2c]
push eax
lea eax, [ebp - 0x804]
push eax
push edi
jmp 0x100a170f
cmp dword [ebp - 0xc40], 0
mov edi, 0x103
mov dword [ebp - 0xc3c], 0xffffffff
je 0x100a16a8
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x100a1633
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x3f
call fcn.10003680
mov edx, dword [ebp - 0xc40]
add esp, 4
push 0
push 0
push 0
push 0
test eax, eax
je 0x100a1668
lea ecx, [ebp - 0xc2c]
push ecx
lea ecx, [ebp - 0x804]
push ecx
push dword [ebp - 0xc48]
push edx
call eax
jmp 0x100a1683
lea eax, [ebp - 0xc2c]
push eax
lea eax, [ebp - 0x804]
push eax
push dword [ebp - 0xc48]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov edi, eax
test esi, esi
je 0x100a1690
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp edi, 0x103
jne 0x100a1729
mov eax, dword [ebp - 0xc44]
mov ecx, dword [ebp - 0xc48]
test eax, eax
je 0x100a1729
mov dword [ebp - 0xc3c], ecx
mov dword [ebp - 0xc2c], ebx
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x100a16ce
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x3f
call fcn.10003680
add esp, 4
push 0
push 0
push 0
push 0
test eax, eax
je 0x100a16ff
lea ecx, [ebp - 0xc2c]
push ecx
lea ecx, [ebp - 0x804]
push ecx
mov ecx, dword [ebp - 0xc44]
push 0
push ecx
call eax
jmp 0x100a171c
lea eax, [ebp - 0xc2c]
push eax
lea eax, [ebp - 0x804]
push eax
push 0
mov ecx, dword [ebp - 0xc44]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov edi, eax
test esi, esi
je 0x100a1729
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
jne 0x100a25a4
mov eax, dword [ebp - 0xc28]
lea ecx, [ebp - 0x804]
add eax, 0xc4
push ecx
mov ecx, eax
mov dword [ebp - 0xcbc], eax
call fcn.100d2aa0
test eax, eax
jne 0x100a258d
mov eax, dword [ebp - 0xc40]
lea edi, [ebp - 0xc14]
xor ebx, ebx
mov dword [ebp - 0xc1c], 0x104
test eax, eax
je 0x100a1793
lea ecx, [ebp - 0xc1c]
push ecx
push ebx
lea ecx, [ebp - 0x804]
push ecx
push eax
lea ecx, [ebp - 0xc44]
call fcn.1000a410
test eax, eax
je 0x100a17c3
mov eax, dword [ebp - 0xc44]
test eax, eax
je 0x100a17c3
lea ecx, [ebp - 0xc1c]
mov dword [ebp - 0xc1c], 0x104
push ecx
push 0
lea ecx, [ebp - 0x804]
push ecx
push eax
lea ecx, [ebp - 0xc44]
call fcn.1000a410
cmp dword [ebp - 0xc1c], 0x104
jb 0x100a17fb
mov eax, dword [ebp - 0xc1c]
xor ecx, ecx
add eax, 2
mov edx, 2
mov dword [ebp - 0xc1c], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.msvcrt.dll_void____cdecl_operator_new___unsigned_int_
mov edi, eax
add esp, 4
mov ebx, edi
call fcn.10002d70
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
mov edx, dword [ebp - 0xc40]
mov ecx, dword [ebp - 0xc1c]
mov dword [ebp - 0xc18], ecx
lea esi, [eax + 0x10]
or eax, 0xffffffff
mov dword [ebp - 0xc24], esi
test edx, edx
je 0x100a184e
lea eax, [ebp - 0xc1c]
push eax
push edi
lea eax, [ebp - 0x804]
push eax
push edx
lea ecx, [ebp - 0xc44]
call fcn.1000a410
test eax, eax
je 0x100a187d
mov ecx, dword [ebp - 0xc18]
mov edx, dword [ebp - 0xc44]
test edx, edx
je 0x100a1879
lea eax, [ebp - 0xc1c]
mov dword [ebp - 0xc1c], ecx
push eax
push edi
lea eax, [ebp - 0x804]
push eax
push edx
lea ecx, [ebp - 0xc44]
call fcn.1000a410
test eax, eax
jne 0x100a18b8
mov eax, dword [ebp - 0xc1c]
xor ecx, ecx
mov word [edi + eax*2], cx
test edi, edi
jne 0x100a1891
xor eax, eax
jmp 0x100a18a5
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100a1896
sub eax, edx
sar eax, 1
push eax
push edi
lea ecx, [ebp - 0xc24]
call fcn.10003740
mov esi, dword [ebp - 0xc24]
test ebx, ebx
je 0x100a18c5
push ebx
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
add esp, 4
call fcn.10002d70
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
lea edi, [eax + 0x10]
lea eax, [ebp - 0x804]
mov dword [ebp - 0xc30], edi
test eax, 0xffff0000
jne 0x100a1a0b
push 0
mov ecx, 0x1025bea0
call fcn.101beff4
mov ebx, eax
mov dword [ebp - 0xc20], 1
test ebx, ebx
je 0x100a1a3c
lea ecx, [ebp - 0x804]
movzx eax, cx
shr eax, 4
inc eax
mov dword [ebp - 0xc18], eax
mov edi, edi
push 0
push eax
push 6
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x100a1948
lea edx, [ebp - 0x804]
movzx ecx, dx
push ecx
push eax
push ebx
call fcn.10003980
add esp, 0xc
test eax, eax
jne 0x100a1970
push dword [ebp - 0xc20]
mov ecx, 0x1025bea0
call fcn.101beff4
inc dword [ebp - 0xc20]
mov ebx, eax
test ebx, ebx
je 0x100a1a3c
mov eax, dword [ebp - 0xc18]
jmp 0x100a1920
test ebx, ebx
je 0x100a1a3c
push 6
push dword [ebp - 0xc18]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ecx, eax
test ecx, ecx
je 0x100a1a3c
lea edx, [ebp - 0x804]
movzx eax, dx
push eax
push ecx
push ebx
call fcn.10003980
add esp, 0xc
mov dword [ebp - 0xc18], eax
test eax, eax
je 0x100a1a3c
movzx ecx, word [eax]
mov eax, dword [edi - 8]
mov ebx, ecx
mov edx, ecx
sub eax, ebx
mov ecx, 1
sub ecx, dword [edi - 4]
or ecx, eax
jge 0x100a19e8
push ebx
lea ecx, [ebp - 0xc30]
call fcn.10003310
mov eax, dword [ebp - 0xc18]
mov edi, dword [ebp - 0xc30]
movzx edx, word [eax]
jmp 0x100a19ee
mov eax, dword [ebp - 0xc18]
movzx ecx, dx
add eax, 2
push ecx
push eax
push ebx
push edi
call fcn.101eb860
add esp, 0x10
mov dword [edi - 0xc], ebx
xor eax, eax
mov word [edi + ebx*2], ax
jmp 0x100a1a3c
lea ecx, [ebp - 0x804]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100a1a14
sub ecx, edx
lea eax, [ebp - 0x804]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0xc30]
call fcn.10003740
mov edi, dword [ebp - 0xc30]
mov ecx, dword [ebp + 0x14]
lea eax, [ebp - 0xc30]
push eax
call fcn.10079900
mov ebx, eax
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
mov dword [ebp - 0xc18], eax
cmp ebx, eax
je 0x100a1a96
mov edx, dword [ebx + 0x10]
mov ecx, edi
mov ax, word [ecx]
cmp ax, word [edx]
jne 0x100a1a87
test ax, ax
je 0x100a1a83
mov ax, word [ecx + 2]
cmp ax, word [edx + 2]
jne 0x100a1a87
add ecx, 4
add edx, 4
test ax, ax
jne 0x100a1a61
xor eax, eax
jmp 0x100a1a8c
sbb eax, eax
or eax, 1
test eax, eax
jns 0x100a1a98
mov eax, dword [ebp - 0xc18]
mov ebx, eax
add edi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x100a1ab0
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp + 0x14]
cmp ebx, dword [eax]
je 0x100a1e09
push dword [ebx + 0x1c]
push esi
call sub.msvcrt.dll__wcsicmp
add esp, 8
test eax, eax
je 0x100a2575
push 0x20019
push 1
push ecx
lea eax, [ebp - 0x804]
mov dword [ebp - 0xce4], 0
mov ecx, esp
mov dword [ebp - 0xce0], 0
push eax
mov dword [ebp - 0xcdc], 0
call fcn.10002490
push ecx
mov ecx, esp
push dword [ebp - 0xc54]
call fcn.10002490
push dword [ebp - 0xc50]
lea eax, [ebp - 0xce4]
push eax
lea eax, [ebp - 0xc68]
push eax
call fcn.100da240
mov edi, dword [ebp - 0xc28]
add esp, 0x1c
mov ecx, edi
push dword [ebp - 0xc68]
call fcn.100d06f0
test eax, eax
jne 0x100a1ddb
lea eax, [ebp - 0x804]
push eax
lea ecx, [ebp - 0xc94]
call fcn.10002490
lea eax, [ebp - 0xc94]
lea ecx, [edi + 0xbc]
push eax
call fcn.100a0c00
mov ecx, dword [ebx + 0x14]
mov edi, eax
mov dword [edi], ecx
mov ecx, dword [ebx + 0x18]
mov dword [edi + 4], ecx
lea ecx, [ebx + 0x1c]
push ecx
lea ecx, [edi + 8]
call fcn.10002790
mov eax, dword [ebx + 0x20]
lea ecx, [edi + 0x10]
mov dword [edi + 0xc], eax
lea eax, [ebx + 0x24]
push eax
call fcn.10002790
lea eax, [ebx + 0x28]
push eax
lea ecx, [edi + 0x14]
call fcn.10002790
mov eax, dword [ebx + 0x2c]
mov dword [edi + 0x18], eax
mov eax, dword [ebx + 0x30]
mov dword [edi + 0x1c], eax
or eax, 0xffffffff
mov edx, dword [ebp - 0xc94]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100a1bcd
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0xc74]
cmp eax, 8
je 0x100a1ddb
cmp eax, 7
je 0x100a1ddb
lea eax, [ebp - 0x804]
push eax
lea ecx, [ebp - 0xc98]
call fcn.10002490
mov edi, dword [ebp - 0xc28]
lea eax, [ebp - 0xc98]
add edi, 0xbc
push eax
mov ecx, edi
call fcn.100a0c00
mov ecx, dword [ebp - 0xc50]
mov dword [eax], ecx
lea ecx, [ebp - 0xc98]
call fcn.10007e10
lea eax, [ebp - 0x804]
push eax
lea ecx, [ebp - 0xc9c]
call fcn.10002490
lea eax, [ebp - 0xc9c]
mov ecx, edi
push eax
call fcn.100a0c00
mov ecx, dword [ebp - 0xc54]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0xc9c]
call fcn.10007e10
lea eax, [ebp - 0x804]
push eax
lea ecx, [ebp - 0xca0]
call fcn.10002490
lea eax, [ebp - 0xca0]
mov ecx, edi
push eax
call fcn.100a0c00
mov ecx, dword [ebp + 0x10]
mov dword [eax + 0xc], ecx
lea ecx, [ebp - 0xca0]
call fcn.10007e10
lea eax, [ebp - 0x804]
push eax
lea ecx, [ebp - 0xc64]
call fcn.10002490
lea eax, [ebp - 0x804]
push eax
lea ecx, [ebp - 0xc60]
call fcn.10002490
lea eax, [ebp - 0x804]
push eax
lea ecx, [ebp - 0xc5c]
call fcn.10002490
push 0x2734
lea ecx, [ebp - 0xcd0]
call fcn.10002490
push 0x2807
lea ecx, [ebp - 0xca8]
mov eax, dword [eax]
mov dword [ebp - 0xc18], eax
call fcn.10002490
mov ecx, edi
mov eax, dword [eax]
mov dword [ebp - 0xc20], eax
lea eax, [ebp - 0xc64]
push eax
call fcn.100a0c00
mov ecx, edi
mov ebx, dword [eax + 0x14]
lea eax, [ebp - 0xc60]
push eax
call fcn.100a0c00
push 1
push 0
push ecx
mov edi, dword [eax + 0x10]
mov ecx, esp
push 0x10202940
call fcn.10002490
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push ecx
mov ecx, esp
push 0x10202940
call fcn.10002490
push ecx
mov ecx, esp
push 0x10202940
call fcn.10002490
push ecx
mov ecx, esp
push 0x10202940
call fcn.10002490
push 0
push 0xffffffffffffffff
push 4
lea eax, [ebp - 0xce4]
push eax
push 0
push 1
push dword [ebp - 0xc18]
push dword [ebp - 0xc20]
push ebx
mov ebx, dword [ebp - 0xc28]
mov ecx, ebx
push edi
call fcn.100cd930
mov edi, eax
lea ecx, [ebx + 0xbc]
lea eax, [ebp - 0xc5c]
push eax
call fcn.100a0c00
lea ecx, [ebp - 0xca8]
mov dword [eax + 0x18], edi
call fcn.10007e10
lea ecx, [ebp - 0xcd0]
call fcn.10007e10
lea ecx, [ebp - 0xc5c]
call fcn.10007e10
lea ecx, [ebp - 0xc60]
call fcn.10007e10
lea ecx, [ebp - 0xc64]
call fcn.10007e10
lea eax, [ebp - 0x804]
push eax
lea ecx, [ebx + 0xc4]
call fcn.100d2a40
mov edx, dword [ebp - 0xc68]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100a1df9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0xce4]
call fcn.1002a3c0
jmp 0x100a2575
lea eax, [ebp - 0x804]
push eax
lea ecx, [ebp - 0xc4c]
call fcn.10002490
mov edi, dword [ebp - 0xc4c]
mov ecx, 1
mov eax, dword [edi - 8]
mov ebx, dword [edi - 0xc]
sub eax, ebx
sub ecx, dword [edi - 4]
or ecx, eax
jge 0x100a1e47
push ebx
lea ecx, [ebp - 0xc4c]
call fcn.10003310
mov edi, dword [ebp - 0xc4c]
lea eax, [ebx + 1]
push eax
push edi
call fcn.101e7180
xor eax, eax
mov dword [edi - 0xc], ebx
mov word [edi + ebx*2], ax
mov ecx, 1
mov eax, dword [esi - 8]
add esp, 8
mov ebx, dword [esi - 0xc]
sub eax, ebx
sub ecx, dword [esi - 4]
or ecx, eax
jge 0x100a1e83
push ebx
lea ecx, [ebp - 0xc24]
call fcn.10003310
mov esi, dword [ebp - 0xc24]
lea eax, [ebx + 1]
push eax
push esi
call fcn.101e7180
xor eax, eax
mov dword [esi - 0xc], ebx
add esp, 8
mov word [esi + ebx*2], ax
lea eax, [ebp - 0xc4c]
mov ecx, 0x1025ad84
push eax
lea eax, [ebp - 0xcd4]
push eax
call fcn.1005e9c0
mov eax, dword [ebp - 0xcd4]
cmp eax, dword [0x1025ad84]
je 0x100a1f18
mov edx, dword [eax + 0x10]
mov ecx, edi
mov bx, word [ecx]
cmp bx, word [edx]
jne 0x100a1eea
test bx, bx
je 0x100a1ee6
mov bx, word [ecx + 2]
cmp bx, word [edx + 2]
jne 0x100a1eea
add ecx, 4
add edx, 4
test bx, bx
jne 0x100a1ec4
xor ecx, ecx
jmp 0x100a1eef
sbb ecx, ecx
or ecx, 1
test ecx, ecx
js 0x100a1f18
mov eax, dword [eax + 0x14]
test eax, eax
je 0x100a1f18
cmp dword [esi - 0xc], 0
jl 0x100a1f18
push eax
push esi
call sub.msvcrt.dll_wcsstr
add esp, 8
test eax, eax
je 0x100a1f18
sub eax, esi
sar eax, 1
je 0x100a255d
push str.safemonwdres.dll
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x100a203d
push 0x208
lea eax, [ebp - 0xc14]
push 0
push eax
call sub.msvcrt.dll_memset
push str.safemonwdres.dll
push 0x104
lea eax, [ebp - 0xc14]
push eax
push dword [0x10257d10]
call fcn.100da6a0
push 0x208
lea eax, [ebp - 0xa0c]
push 0
push eax
call sub.msvcrt.dll_memset
lea eax, [ebp - 0xc14]
push eax
push str.res:__
push 0x10205358
lea eax, [ebp - 0xa0c]
push 0x104
push eax
call fcn.1000aa70
add esp, 0x3c
lea eax, [ebp - 0xa0c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
lea eax, [ebp - 0xa0c]
push eax
push esi
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
je 0x100a255d
mov ebx, dword [ebp - 0xc28]
lea eax, [ebp - 0xc58]
push eax
mov ecx, ebx
call fcn.100a0f80
mov eax, dword [ebp - 0xc58]
mov ecx, dword [eax - 0xc]
test ecx, ecx
je 0x100a2023
push ecx
push eax
push esi
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x100a201d
lea ecx, [ebp - 0xc58]
call fcn.10007e10
lea ecx, [ebp - 0xc4c]
call fcn.10007e10
lea ecx, [ebp - 0xc24]
call fcn.10007e10
mov ecx, dword [ebp - 0xc48]
mov ebx, 0x400
inc ecx
mov dword [ebp - 0xc2c], ebx
jmp 0x100a1581
mov eax, dword [ebp - 0xc58]
lea edx, [eax - 0x10]
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100a2043
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x100a2043
mov ebx, dword [ebp - 0xc28]
push 0x11
lea eax, [ebp - 0xcd8]
push eax
lea ecx, [ebp - 0xc24]
call fcn.10009ca0
push eax
lea ecx, [ebp - 0xc24]
call fcn.10002790
mov edx, dword [ebp - 0xcd8]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100a2081
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0xc24]
cmp dword [esi - 0xc], 0
je 0x100a255d
push str.res:__shdoclc.dll
push esi
call sub.msvcrt.dll__wcsicmp
add esp, 8
test eax, eax
je 0x100a255d
push str.res:__mshtml.dll_
push esi
call sub.msvcrt.dll__wcsicmp
add esp, 8
test eax, eax
je 0x100a255d
push str.res:__ieframe.dll
push esi
call sub.msvcrt.dll__wcsicmp
add esp, 8
test eax, eax
je 0x100a255d
push 0x20019
push 1
push ecx
lea eax, [ebp - 0x804]
mov dword [ebp - 0xccc], 0
mov ecx, esp
mov dword [ebp - 0xcc8], 0
push eax
mov dword [ebp - 0xcc4], 0
call fcn.10002490
push ecx
mov ecx, esp
push dword [ebp - 0xc54]
call fcn.10002490
push dword [ebp - 0xc50]
lea eax, [ebp - 0xccc]
push eax
lea eax, [ebp - 0xc90]
push eax
call fcn.100da240
add esp, 0x1c
mov ecx, ebx
push dword [ebp - 0xc90]
call fcn.100d06f0
test eax, eax
jne 0x100a2547
push str.about:
lea ecx, [ebp - 0xc34]
call fcn.10002490
lea ecx, [ebp - 0x804]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100a2160
lea eax, [ebp - 0x804]
sub ecx, edx
mov ebx, eax
mov dword [ebp - 0xc30], eax
mov eax, dword [ebp - 0xc34]
sub ebx, eax
sar ecx, 1
push ecx
sar ebx, 1
mov eax, dword [eax - 0xc]
mov dword [ebp - 0xc18], eax
lea eax, [ebp - 0x804]
push eax
call fcn.101e6fd0
mov dword [ebp - 0xc24], eax
mov edx, 1
add eax, dword [ebp - 0xc18]
add esp, 8
mov dword [ebp - 0xc20], eax
mov eax, dword [ebp - 0xc34]
mov ecx, dword [eax - 8]
sub edx, dword [eax - 4]
sub ecx, dword [ebp - 0xc20]
or edx, ecx
jge 0x100a21e4
push dword [ebp - 0xc20]
lea ecx, [ebp - 0xc34]
call fcn.10003310
mov eax, dword [ebp - 0xc34]
mov edx, dword [ebp - 0xc18]
cmp ebx, edx
lea ebx, [eax + ebx*2]
jbe 0x100a21f7
mov ebx, dword [ebp - 0xc30]
mov ecx, dword [ebp - 0xc24]
lea eax, [eax + edx*2]
add ecx, ecx
push ecx
push ebx
push ecx
push eax
call fcn.10004510
mov eax, dword [ebp - 0xc34]
add esp, 0x10
mov ecx, dword [ebp - 0xc20]
xor edx, edx
mov dword [eax - 0xc], ecx
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0xcc0]
push 0x10202940
call fcn.10002490
push eax
lea eax, [ebp - 0xca4]
push 0x9c9f
push eax
call fcn.100053d0
add esp, 0xc
lea ecx, [ebp - 0xc34]
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
call fcn.10002970
lea ecx, [ebp - 0xca4]
call fcn.10007e10
lea ecx, [ebp - 0xcc0]
call fcn.10007e10
push 0x10202940
lea ecx, [ebp - 0xc70]
call fcn.10002490
lea eax, [ebp - 0x804]
push eax
lea ecx, [ebp - 0xc6c]
call fcn.10002490
mov ebx, dword [ebp - 0xc28]
lea eax, [ebp - 0xc34]
push 2
push eax
push 0x10202940
lea ecx, [ebp - 0xcb0]
add ebx, 0xbc
call fcn.10002490
push eax
lea eax, [ebp - 0xcac]
push 0x27ba
push eax
call fcn.100053d0
add esp, 0xc
lea ecx, [ebp - 0xd04]
push eax
lea eax, [ebp - 0xc70]
push eax
call fcn.100a0980
push eax
lea eax, [ebp - 0xc6c]
mov ecx, ebx
push eax
call fcn.100a0c00
mov ecx, eax
call fcn.100a0ba0
lea ecx, [ebp - 0xd04]
call fcn.100a0b40
lea ecx, [ebp - 0xcac]
call fcn.10007e10
lea ecx, [ebp - 0xcb0]
call fcn.10007e10
lea ecx, [ebp - 0xc6c]
call fcn.10007e10
lea ecx, [ebp - 0xc70]
call fcn.10007e10
mov eax, dword [ebp - 0xc74]
cmp eax, 8
je 0x100a253c
cmp eax, 7
je 0x100a253c
lea eax, [ebp - 0x804]
push eax
lea ecx, [ebp - 0xc78]
call fcn.10002490
lea eax, [ebp - 0xc78]
mov ecx, ebx
push eax
call fcn.100a0c00
mov ecx, dword [ebp - 0xc50]
mov dword [eax], ecx
lea ecx, [ebp - 0xc78]
call fcn.10007e10
lea eax, [ebp - 0x804]
push eax
lea ecx, [ebp - 0xc7c]
call fcn.10002490
lea eax, [ebp - 0xc7c]
mov ecx, ebx
push eax
call fcn.100a0c00
mov ecx, dword [ebp - 0xc54]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0xc7c]
call fcn.10007e10
lea eax, [ebp - 0x804]
push eax
lea ecx, [ebp - 0xc80]
call fcn.10002490
lea eax, [ebp - 0xc80]
mov ecx, ebx
push eax
call fcn.100a0c00
mov ecx, dword [ebp + 0x10]
mov dword [eax + 0xc], ecx
lea ecx, [ebp - 0xc80]
call fcn.10007e10
lea eax, [ebp - 0x804]
push eax
lea ecx, [ebp - 0xc8c]
call fcn.10002490
lea eax, [ebp - 0x804]
push eax
lea ecx, [ebp - 0xc88]
call fcn.10002490
lea eax, [ebp - 0x804]
push eax
lea ecx, [ebp - 0xc84]
call fcn.10002490
push 0x2734
lea ecx, [ebp - 0xcb8]
call fcn.10002490
push 0x2807
lea ecx, [ebp - 0xcb4]
mov eax, dword [eax]
mov dword [ebp - 0xc18], eax
call fcn.10002490
mov ecx, ebx
mov eax, dword [eax]
mov dword [ebp - 0xc20], eax
lea eax, [ebp - 0xc8c]
push eax
call fcn.100a0c00
mov ecx, ebx
mov eax, dword [eax + 0x14]
mov dword [ebp - 0xc30], eax
lea eax, [ebp - 0xc88]
push eax
call fcn.100a0c00
push 1
push 0
push ecx
mov ebx, dword [eax + 0x10]
mov ecx, esp
push 0x10202940
call fcn.10002490
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push ecx
mov ecx, esp
push 0x10202940
call fcn.10002490
push ecx
mov ecx, esp
push 0x10202940
call fcn.10002490
push ecx
mov ecx, esp
push 0x10202940
call fcn.10002490
mov ecx, dword [ebp - 0xc28]
lea eax, [ebp - 0xccc]
push 0
push 0xffffffffffffffff
push 4
push eax
push 0
push 1
push dword [ebp - 0xc18]
push dword [ebp - 0xc20]
push dword [ebp - 0xc30]
push ebx
call fcn.100cd930
mov ecx, dword [ebp - 0xc28]
mov ebx, eax
lea eax, [ebp - 0xc84]
push eax
lea ecx, [ecx + 0xbc]
call fcn.100a0c00
lea ecx, [ebp - 0xcb4]
mov dword [eax + 0x18], ebx
call fcn.10007e10
lea ecx, [ebp - 0xcb8]
call fcn.10007e10
lea ecx, [ebp - 0xc84]
call fcn.10007e10
lea ecx, [ebp - 0xc88]
call fcn.10007e10
lea ecx, [ebp - 0xc8c]
call fcn.10007e10
mov ecx, dword [ebp - 0xcbc]
lea eax, [ebp - 0x804]
push eax
call fcn.100d2a40
lea ecx, [ebp - 0xc34]
call fcn.10007e10
lea ecx, [ebp - 0xc90]
call fcn.10007e10
lea ecx, [ebp - 0xccc]
call fcn.1002a3c0
add edi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x100a2575
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x100a258d
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc48]
mov ebx, 0x400
inc ecx
mov dword [ebp - 0xc2c], ebx
jmp 0x100a1581
lea ecx, [ebp - 0xc44]
call fcn.10008220
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101f99c6
mov esp, ebp
pop ebp
ret 0x10