Function at 0x10009060
Capabilities:
Check mutex on windows
Check os version
Enumerate processes
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10086cb9
mov eax, dword fs:[0]
push eax
sub esp, 0x808
mov eax, dword [0x100ab06c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x110
lea eax, [ebp - 0x358]
push 0
push eax
call fcn.10060f70
add esp, 0xc
mov dword [ebp - 0x35c], 0x114
lea eax, [ebp - 0x35c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x10009184
cmp dword [ebp - 0x358], 5
jne 0x10009184
cmp dword [ebp - 0x354], 0
jne 0x10009184
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x100090fd
call edi
mov esi, eax
jmp 0x10009316
push 0x228
lea eax, [ebp - 0x7b0]
mov dword [ebp - 0x7b8], 0
push 0
push eax
mov esi, 0x490
call fcn.10060f70
add esp, 0xc
mov dword [ebp - 0x7b4], 0x22c
lea eax, [ebp - 0x7b4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x100092cc
lea eax, [ebp - 0x790]
push str.explorer.exe
push eax
call fcn.100636d3
add esp, 8
test eax, eax
je 0x10009171
lea eax, [ebp - 0x7b4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x10009142
jmp 0x100092d0
mov eax, dword [ebp - 0x7ac]
xor esi, esi
mov dword [ebp - 0x7b8], eax
jmp 0x100092d0
lea eax, [ebp - 0x7d4]
xor ebx, ebx
push eax
lea eax, [ebp - 0x7d0]
mov dword [ebp - 0x7b8], ebx
push eax
push 1
push ebx
push ebx
mov dword [ebp - 0x7d0], ebx
mov dword [ebp - 0x7d4], ebx
call dword [sym.imp.WTSAPI32.dll_WTSEnumerateSessionsW]
test eax, eax
je 0x100091fe
mov edx, dword [ebp - 0x7d4]
xor eax, eax
mov ebx, dword [ebp - 0x7d0]
mov esi, 0x490
test edx, edx
je 0x100091ed
lea ecx, [ebx + 8]
nop
cmp dword [ecx], 0
je 0x100091df
inc eax
add ecx, 0xc
cmp eax, edx
jb 0x100091d0
jmp 0x100091ed
lea eax, [eax + eax*2]
xor esi, esi
mov eax, dword [ebx + eax*4]
mov dword [ebp - 0x7b8], eax
push ebx
call dword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
test esi, esi
jne 0x10009235
mov ebx, dword [ebp - 0x7b8]
push str.wtsapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.WTSQueryUserToken
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10009229
push 0x100adcd0
push ebx
call eax
test eax, eax
jne 0x1000931f
call edi
mov esi, eax
test esi, esi
je 0x1000931f
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x1000924f
call edi
mov esi, eax
jmp 0x10009316
push 0x228
lea eax, [ebp - 0x584]
mov dword [ebp - 0x7b8], 0
push 0
push eax
mov esi, 0x490
call fcn.10060f70
add esp, 0xc
mov dword [ebp - 0x588], 0x22c
lea eax, [ebp - 0x588]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x100092cc
lea eax, [ebp - 0x564]
push str.explorer.exe
push eax
call fcn.100636d3
add esp, 8
test eax, eax
je 0x100092bc
lea eax, [ebp - 0x588]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x10009290
jmp 0x100092d0
mov eax, dword [ebp - 0x580]
xor esi, esi
mov dword [ebp - 0x7b8], eax
jmp 0x100092d0
call edi
mov esi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x7b8]
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
jne 0x100092f6
call edi
mov esi, eax
jmp 0x10009316
push 0x100adcd0
push 0xf01ff
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x1000930f
call edi
mov esi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 0xffffffff
je 0x10009f62
push 1
lea eax, [ebp - 0x814]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push 0
push 1
lea eax, [ebp - 0x814]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
cmp dword [0x100aeb34], 8
lea eax, [ebp - 0x814]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, 0x100aeb20
mov dword [ebp - 0x7fc], eax
mov eax, esi
cmovae eax, dword [0x100aeb20]
push eax
push 0
lea eax, [ebp - 0x800]
mov dword [ebp - 0x800], 0xc
push eax
call ebx
cmp dword [0x100aeb34], 8
push 0x10003de0
cmovae esi, dword [0x100aeb20]
push esi
call dword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerW]
mov dword [0x100aeb88], eax
test eax, eax
je 0x10009f62
call dword [sym.imp.KERNEL32.dll_FreeConsole]
mov esi, dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
lea eax, [ebp - 0x21c]
push eax
push dword [0x100aeb88]
mov dword [ebp - 0x21c], 0x20
mov dword [0x100aeb8c], 2
mov dword [ebp - 0x218], 2
mov dword [ebp - 0x214], 7
mov dword [ebp - 0x210], 0
mov dword [ebp - 0x20c], 0
mov dword [ebp - 0x208], 1
mov dword [ebp - 0x204], 0xbb8
call esi
lea eax, [ebp - 0x238]
mov dword [ebp - 0x238], 0x20
push eax
push dword [0x100aeb88]
mov dword [0x100aeb8c], 4
mov dword [ebp - 0x234], 4
mov dword [ebp - 0x230], 7
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 0xbb8
call esi
push 0x25
mov edx, 0x100a4954
lea ecx, [ebp - 0x200]
call fcn.10002350
add esp, 4
mov dword [ebp - 4], 0
cmp dword [eax + 0x14], 8
jb 0x10009493
mov eax, dword [eax]
push eax
push 0
push 0
call ebx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1ec]
cmp eax, 8
jb 0x100094bf
inc eax
lea ecx, [ebp - 0x200]
push eax
push dword [ebp - 0x200]
call fcn.1000b4f0
xor eax, eax
mov dword [ebp - 0x1ec], 7
mov dword [ebp - 0x1f0], 0
mov word [ebp - 0x200], ax
call edi
cmp eax, 0xb7
jne 0x100094f6
push 1
push 0x100a48b8
mov ecx, 0x100aeb08
call fcn.1000aac0
xor eax, eax
mov dword [ebp - 0xe8], 0
mov dword [ebp - 0xe4], 0
mov dword [ebp - 0xe4], 7
mov dword [ebp - 0xe8], 0
mov word [ebp - 0xf8], ax
lea eax, [ebp - 0xf8]
mov dword [ebp - 4], 1
push eax
push 3
call fcn.10013550
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 8
push 0x57e40
call ebx
call fcn.10007510
push 0
call fcn.100662bf
movsd xmm0, qword [0x100a58f8]
mov esi, eax
mov edi, edx
mov dword [ebp - 0x7b8], esi
add esp, 4
mov dword [ebp - 0x7cc], edi
movsd qword [ebp - 0x7e4], xmm0
nop dword [eax + eax]
push 0
call fcn.100662bf
push edi
push esi
push edx
push eax
call fcn.100635f7
fstp qword [ebp - 0x7c0]
movsd xmm0, qword [ebp - 0x7c0]
add esp, 0x14
comisd xmm0, xmmword [ebp - 0x7e4]
jbe 0x100095cc
push 0
call fcn.100662bf
xorps xmm0, xmm0
mov dword [ebp - 0x7b8], eax
add esp, 4
mov dword [ebp - 0x7cc], edx
movlpd qword [0x100adcd8], xmm0
sub esp, 0x18
xor eax, eax
mov ecx, esp
mov dword [ebp - 0x7bc], esp
push 0xffffffffffffffff
push eax
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x100aea68
mov word [ecx], ax
call fcn.1000abc0
mov byte [ebp - 4], 2
mov eax, dword [0x100aea00]
test eax, 0xfffffffe
jne 0x1000963f
mov ecx, 1
xor eax, eax
mov edx, 0x100aea00
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x10009635
mov eax, dword [0x100aea00]
cmp eax, 1
jne 0x1000963f
push 0
call ebx
mov eax, dword [0x100aea00]
cmp eax, 1
je 0x10009625
jmp 0x1000963f
mov dword [0x100aea00], 0x100aea04
mov eax, dword [0x100aea00]
mov byte [ebp - 4], 1
call fcn.1001b630
xor edx, edx
mov ecx, 0x100aea68
call fcn.10011520
xor eax, eax
mov dword [ebp - 0xd0], 0
mov dword [ebp - 0xcc], 0
mov dword [ebp - 0xcc], 7
mov dword [ebp - 0xd0], 0
mov word [ebp - 0xe0], ax
mov byte [ebp - 4], 4
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x6c], 7
mov dword [ebp - 0x70], eax
mov word [ebp - 0x80], ax
mov byte [ebp - 4], 5
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x9c], 7
mov dword [ebp - 0xa0], eax
mov word [ebp - 0xb0], ax
xorps xmm0, xmm0
mov byte [ebp - 4], 6
movlpd qword [ebp - 0x7c8], xmm0
jmp 0x100096ec
nop
nop
nop
cmp byte [0x100adce8], 0
jne 0x10009e49
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp - 0x7c8]
push eax
lea edx, [ebp - 0x80]
lea ecx, [ebp - 0xe0]
call fcn.10008570
add esp, 8
test al, al
je 0x10009e49
push dword [ebp - 0x7c4]
lea ecx, [ebp - 0x1a0]
push dword [ebp - 0x7c8]
call fcn.1000e440
add esp, 8
mov byte [ebp - 4], 7
cmp dword [eax + 0x14], 0x10
jb 0x1000974b
mov ecx, dword [eax]
jmp 0x1000974d
mov ecx, eax
mov eax, dword [eax + 0x10]
mov edx, 0x100a4a04
mov dword [ebp - 0x7dc], ecx
lea ecx, [ebp - 0x1b8]
push 0x18
mov dword [ebp - 0x7d8], eax
call fcn.10002350
mov esi, eax
push 0
lea edx, [ebp - 0x7dc]
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x170]
call fcn.100118f0
lea eax, [ebp - 0x80]
mov byte [ebp - 4], 9
push eax
lea edx, [ebp - 0xe0]
lea ecx, [ebp - 0x1d0]
call fcn.1000bc30
lea ecx, [ebp - 0x170]
mov byte [ebp - 4], 0xa
push ecx
mov edx, eax
lea ecx, [ebp - 0x1e8]
call fcn.1000bb80
push esi
mov edx, eax
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x158]
call fcn.1000bb80
add esp, 0x14
mov byte [ebp - 4], 0xd
mov eax, dword [ebp - 0x1d4]
cmp eax, 8
jb 0x100097ef
inc eax
lea ecx, [ebp - 0x1e8]
push eax
push dword [ebp - 0x1e8]
call fcn.1000b4f0
xor eax, eax
mov dword [ebp - 0x1d4], 7
mov dword [ebp - 0x1d8], 0
mov word [ebp - 0x1e8], ax
mov byte [ebp - 4], 0xe
mov eax, dword [ebp - 0x1bc]
cmp eax, 8
jb 0x1000982e
inc eax
lea ecx, [ebp - 0x1d0]
push eax
push dword [ebp - 0x1d0]
call fcn.1000b4f0
xor eax, eax
mov dword [ebp - 0x1bc], 7
mov dword [ebp - 0x1c0], 0
mov word [ebp - 0x1d0], ax
mov byte [ebp - 4], 0xf
mov eax, dword [ebp - 0x15c]
cmp eax, 8
jb 0x1000986d
inc eax
lea ecx, [ebp - 0x170]
push eax
push dword [ebp - 0x170]
call fcn.1000b4f0
xor eax, eax
mov dword [ebp - 0x15c], 7
mov dword [ebp - 0x160], 0
mov word [ebp - 0x170], ax
mov byte [ebp - 4], 0x10
mov eax, dword [ebp - 0x1a4]
cmp eax, 8
jb 0x100098ac
inc eax
lea ecx, [ebp - 0x1b8]
push eax
push dword [ebp - 0x1b8]
call fcn.1000b4f0
xor eax, eax
mov dword [ebp - 0x1a4], 7
mov dword [ebp - 0x1a8], 0
mov word [ebp - 0x1b8], ax
mov byte [ebp - 4], 0x11
mov eax, dword [ebp - 0x18c]
cmp eax, 0x10
jb 0x100098eb
inc eax
lea ecx, [ebp - 0x1a0]
push eax
push dword [ebp - 0x1a0]
call fcn.1000b3e0
push ecx
lea edx, [ebp - 0x158]
mov dword [ebp - 0x18c], 0xf
lea ecx, [ebp - 0x110]
mov dword [ebp - 0x190], 0
mov byte [ebp - 0x1a0], 0
call fcn.100119d0
mov byte [ebp - 4], 0x12
lea eax, [ebp - 0x110]
cmp dword [ebp - 0xfc], 0x10
lea edx, [ebp - 0x7f4]
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x68], 0x67452301
cmovae eax, dword [ebp - 0x110]
mov dword [ebp - 0x7f4], eax
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x64], 0xefcdab89
mov dword [ebp - 0x60], 0x98badcfe
mov dword [ebp - 0x5c], 0x10325476
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x7f0], eax
call fcn.1000fd80
lea edx, [ebp - 0x68]
lea ecx, [ebp - 0x248]
call fcn.1000fea0
lea edx, [ebp - 0x248]
lea ecx, [ebp - 0x128]
call fcn.1000ffb0
mov byte [ebp - 4], 0x13
lea eax, [ebp - 0x128]
cmp dword [ebp - 0x114], 0x10
lea edx, [ebp - 0x7ec]
push 0
cmovae eax, dword [ebp - 0x128]
lea ecx, [ebp - 0x140]
mov dword [ebp - 0x7ec], eax
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0x7e8], eax
call fcn.100118f0
add esp, 8
mov byte [ebp - 4], 0x14
lea edx, [ebp - 0x140]
cmp dword [ebp - 0x12c], 8
mov dword [ebp - 0x88], 0
cmovae edx, dword [ebp - 0x140]
xor eax, eax
mov dword [ebp - 0x84], 0
mov dword [ebp - 0x84], 7
mov dword [ebp - 0x88], 0
mov word [ebp - 0x98], ax
cmp word [edx], ax
jne 0x10009a2b
xor ecx, ecx
jmp 0x10009a3f
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10009a30
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x98]
call fcn.1000aac0
mov byte [ebp - 4], 0x16
mov eax, dword [ebp - 0x12c]
cmp eax, 8
jb 0x10009a6e
inc eax
lea ecx, [ebp - 0x140]
push eax
push dword [ebp - 0x140]
call fcn.1000b4f0
xor eax, eax
mov dword [ebp - 0x12c], 7
mov dword [ebp - 0x130], 0
mov word [ebp - 0x140], ax
mov byte [ebp - 4], 0x17
mov eax, dword [ebp - 0x114]
cmp eax, 0x10
jb 0x10009aad
inc eax
lea ecx, [ebp - 0x128]
push eax
push dword [ebp - 0x128]
call fcn.1000b3e0
mov dword [ebp - 0x114], 0xf
mov dword [ebp - 0x118], 0
mov byte [ebp - 0x128], 0
mov byte [ebp - 4], 0x18
mov eax, dword [ebp - 0xfc]
cmp eax, 0x10
jb 0x10009aea
inc eax
lea ecx, [ebp - 0x110]
push eax
push dword [ebp - 0x110]
call fcn.1000b3e0
mov dword [ebp - 0xfc], 0xf
mov dword [ebp - 0x100], 0
mov byte [ebp - 0x110], 0
jmp 0x10009b19
nop
nop
nop
cmp dword [ebp - 0x84], 8
lea ecx, [ebp - 0x98]
lea eax, [ebp - 0xb0]
push dword [ebp - 0x88]
cmovae ecx, dword [ebp - 0x98]
cmp dword [ebp - 0x9c], 8
push ecx
cmovae eax, dword [ebp - 0xb0]
push dword [ebp - 0xa0]
push eax
call fcn.1000bf40
add esp, 0x10
test eax, eax
jne 0x10009d94
mov edi, dword [ebp - 0x7c8]
mov eax, edi
mov esi, dword [ebp - 0x7c4]
or eax, esi
je 0x10009ba3
push 0
call fcn.100662bf
push esi
push edi
push edx
push eax
call fcn.100635f7
fstp qword [ebp - 0x7c0]
movsd xmm0, qword [ebp - 0x7c0]
add esp, 0x14
comisd xmm0, xmmword [ebp - 0x7e4]
jbe 0x10009dcb
push 0x100a48bc
lea eax, [ebp - 0xe0]
push eax
lea eax, [ebp - 0x188]
push eax
call fcn.1000bd60
add esp, 0xc
mov esi, eax
mov byte [ebp - 4], 0x19
cmp esi, 0x100aea88
je 0x10009c0f
mov eax, dword [0x100aea9c]
cmp eax, 8
jb 0x10009be8
inc eax
mov ecx, 0x100aea88
push eax
push dword [0x100aea88]
call fcn.1000b4f0
xor eax, eax
mov dword [0x100aea9c], 7
push esi
mov ecx, 0x100aea88
mov dword [0x100aea98], 0
mov word [0x100aea88], ax
call fcn.1000ace0
mov byte [ebp - 4], 0x18
mov eax, dword [ebp - 0x174]
cmp eax, 8
jb 0x10009c31
inc eax
lea ecx, [ebp - 0x188]
push eax
push dword [ebp - 0x188]
call fcn.1000b4f0
xor eax, eax
mov dword [ebp - 0x174], 7
cmp dword [ebp - 0x6c], 8
lea ecx, [ebp - 0x80]
mov word [ebp - 0x188], ax
cmovae ecx, dword [ebp - 0x80]
mov eax, dword [ebp - 0x70]
push 0x100aba58
mov dword [ebp - 0x178], 0
lea edx, [ecx + eax*2]
call fcn.1000ef60
mov dword [ebp - 0xb8], 0
add esp, 4
mov dword [ebp - 0xb4], 0
mov dword [ebp - 0xb4], 0xf
mov dword [ebp - 0xb8], 0
mov byte [ebp - 0xc8], 0
mov byte [ebp - 4], 0x1a
jmp 0x10009cb6
lea ecx, [ebp - 0xc8]
call fcn.100025c0
cmp dword [ebp - 0xb8], 0
je 0x10009d55
jmp 0x10009ce2
nop
nop
nop
lea ecx, [ebp - 0xc8]
call fcn.10003e90
mov ecx, dword [0x100aba58]
mov eax, dword [0x100aba5c]
add ecx, 1
mov dword [0x100aba58], ecx
adc eax, 0
push eax
push ecx
sub esp, 0x18
mov dword [0x100aba5c], eax
mov ecx, esp
mov dword [ebp - 0x7bc], esp
xor eax, eax
push 0xffffffffffffffff
push eax
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x100aea88
mov word [ecx], ax
call fcn.1000abc0
push 0
mov byte [ebp - 4], 0x1b
call fcn.100662bf
add esp, 4
mov byte [ebp - 4], 0x1a
push edx
push eax
call fcn.10008860
add esp, 0x28
mov byte [ebp - 4], 0x18
mov eax, dword [ebp - 0xb4]
cmp eax, 0x10
jb 0x10009d77
inc eax
lea ecx, [ebp - 0xc8]
push eax
push dword [ebp - 0xc8]
call fcn.1000b3e0
mov dword [ebp - 0xb4], 0xf
mov dword [ebp - 0xb8], 0
mov byte [ebp - 0xc8], 0
jmp 0x10009dcb
push 0
push 1
sub esp, 0x18
mov edx, 0x100a4920
mov ecx, esp
mov dword [ebp - 0x7bc], esp
push 4
call fcn.10002350
push 0
mov byte [ebp - 4], 0x1c
call fcn.100662bf
add esp, 8
mov byte [ebp - 4], 0x18
push edx
push eax
call fcn.10008860
add esp, 0x28
mov byte [ebp - 4], 0x11
mov eax, dword [ebp - 0x84]
cmp eax, 8
jb 0x10009ded
inc eax
lea ecx, [ebp - 0x98]
push eax
push dword [ebp - 0x98]
call fcn.1000b4f0
xor eax, eax
mov dword [ebp - 0x84], 7
mov word [ebp - 0x98], ax
mov dword [ebp - 0x88], 0
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x144]
cmp eax, 8
jb 0x10009e2c
inc eax
lea ecx, [ebp - 0x158]
push eax
push dword [ebp - 0x158]
call fcn.1000b4f0
xor eax, eax
mov dword [ebp - 0x144], 7
mov dword [ebp - 0x148], 0
mov word [ebp - 0x158], ax
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x927c0
call ebx
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x9c]
cmp eax, 8
jb 0x10009e78
inc eax
lea ecx, [ebp - 0xb0]
push eax
push dword [ebp - 0xb0]
call fcn.1000b4f0
xor eax, eax
mov dword [ebp - 0x9c], 7
mov word [ebp - 0xb0], ax
mov dword [ebp - 0xa0], 0
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x6c]
cmp eax, 8
jb 0x10009eae
inc eax
lea ecx, [ebp - 0x80]
push eax
push dword [ebp - 0x80]
call fcn.1000b4f0
xor eax, eax
mov dword [ebp - 0x6c], 7
mov word [ebp - 0x80], ax
mov dword [ebp - 0x70], 0
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0xcc]
cmp eax, 8
jb 0x10009ee4
inc eax
lea ecx, [ebp - 0xe0]
push eax
push dword [ebp - 0xe0]
call fcn.1000b4f0
xor eax, eax
mov dword [ebp - 0xcc], 7
mov word [ebp - 0xe0], ax
mov eax, dword [0x100aeb8c]
mov dword [ebp - 0xd0], 0
cmp eax, 3
je 0x10009f20
mov esi, dword [ebp - 0x7b8]
mov edi, dword [ebp - 0x7cc]
cmp eax, 1
jne 0x10009580
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0xe4]
cmp eax, 8
jb 0x10009f45
inc eax
lea ecx, [ebp - 0xf8]
push eax
push dword [ebp - 0xf8]
call fcn.1000b4f0
xor eax, eax
mov dword [ebp - 0xe4], 7
mov dword [ebp - 0xe8], 0
mov word [ebp - 0xf8], ax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001ecda
mov esp, ebp
pop ebp
ret 8