Function at 0x1008ab70
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b7675
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x100d99c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x5c], esi
xor edx, edx
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x64], edx
mov eax, dword [0x100f6a14]
mov edx, dword [0x100f68f4]
push 0x100ad840
push 0xfffffffffffffffc
push dword [eax + 8]
call edx
mov dword [esi + 0x67c], eax
mov edi, dword [0x100f69ac]
mov dword [esi], edi
mov eax, dword [edi]
mov dword [esi + 4], eax
test eax, eax
je 0x1008acb3
xor ecx, ecx
mov eax, dword [esi + 4]
mov dword [ebp - 0x14], ecx
mov edx, dword [eax + ecx*4]
test edx, edx
je 0x1008ac12
mov eax, dword [0x100f68f0]
lea ecx, [ebp - 0x3c]
push 0x1c
push ecx
push edx
call eax
mov ecx, dword [ebp - 0x14]
test eax, eax
je 0x1008ac12
mov eax, dword [ebp - 0x28]
test al, 1
jne 0x1008ac12
test eax, 0x100
jne 0x1008ac12
inc ecx
jmp 0x1008abdf
mov dword [esi + 0xc], ecx
test ecx, ecx
je 0x1008acb3
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.1002ed50
add esp, 8
lea ecx, [esi + 8]
mov dword [ebp - 0x1c], ecx
push eax
call fcn.1002ebe0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x1008ac7b
push 0x1001fbd0
push dword [eax - 4]
lea esi, [eax - 4]
mov dword [ebp - 4], 0
push 4
push eax
call fcn.100adebc
mov ecx, dword [ebp - 0x18]
mov eax, dword [ecx - 4]
lea eax, [eax*4 + 4]
push eax
push esi
call fcn.100ae00f
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x1c]
mov esi, dword [esi]
test esi, esi
je 0x1008acb0
mov ecx, dword [ebp - 0x5c]
mov eax, dword [ecx + 0xc]
lea eax, [eax*4 + 4]
push eax
mov eax, dword [ecx + 4]
sub eax, 4
push eax
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
add esi, 4
mov dword [edi], esi
mov esi, dword [ebp - 0x5c]
mov byte [esi + 0x10], 1
jmp 0x1008acb3
mov esi, dword [ebp - 0x5c]
xor eax, eax
cmp byte [esi + 0x10], al
setne al
add eax, 0x29
cmp dword [esi + 4], 0
je 0x1008acfe
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x1008acfe
cmp eax, dword [esi + 0xc]
ja 0x1008acfe
mov dword [ecx + eax*4], 0x1009ba10
mov eax, dword [esi + 4]
mov eax, dword [eax + 0xa4]
neg eax
sbb eax, eax
add eax, 2
mov dword [ebp - 0x58], eax
test al, 2
je 0x1008acf4
and eax, 0xfffffffd
mov dword [ebp - 0x58], eax
test al, 1
je 0x1008acfe
and eax, 0xfffffffe
mov dword [ebp - 0x58], eax
mov edi, dword [0x100f6994]
mov dword [esi + 0x28], edi
mov eax, dword [edi]
mov dword [esi + 0x2c], eax
test eax, eax
je 0x1008adea
xor ecx, ecx
mov eax, dword [esi + 0x2c]
mov dword [ebp - 0x14], ecx
mov edx, dword [eax + ecx*4]
test edx, edx
je 0x1008ad49
mov eax, dword [0x100f68f0]
lea ecx, [ebp - 0x3c]
push 0x1c
push ecx
push edx
call eax
mov ecx, dword [ebp - 0x14]
test eax, eax
je 0x1008ad49
mov eax, dword [ebp - 0x28]
test al, 1
jne 0x1008ad49
test eax, 0x100
jne 0x1008ad49
inc ecx
jmp 0x1008ad16
mov dword [esi + 0x34], ecx
test ecx, ecx
je 0x1008adea
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.1002ed50
add esp, 8
lea ecx, [esi + 0x30]
mov dword [ebp - 0x14], ecx
push eax
call fcn.1002ebe0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x1008adb2
push 0x1001fbd0
push dword [eax - 4]
lea esi, [eax - 4]
mov dword [ebp - 4], 1
push 4
push eax
call fcn.100adebc
mov ecx, dword [ebp - 0x18]
mov eax, dword [ecx - 4]
lea eax, [eax*4 + 4]
push eax
push esi
call fcn.100ae00f
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x14]
mov esi, dword [esi]
test esi, esi
je 0x1008ade7
mov ecx, dword [ebp - 0x5c]
mov eax, dword [ecx + 0x34]
lea eax, [eax*4 + 4]
push eax
mov eax, dword [ecx + 0x2c]
sub eax, 4
push eax
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
add esi, 4
mov dword [edi], esi
mov esi, dword [ebp - 0x5c]
mov byte [esi + 0x38], 1
jmp 0x1008adea
mov esi, dword [ebp - 0x5c]
mov edx, dword [esi + 0x2c]
xor ecx, ecx
cmp byte [esi + 0x38], cl
mov eax, edx
setne cl
add ecx, 5
test edx, edx
je 0x1008ae44
mov edi, dword [esi + 0x30]
test edi, edi
je 0x1008ae44
cmp ecx, dword [esi + 0x34]
ja 0x1008ae44
mov dword [edi + ecx*4], 0x10090e60
xor ecx, ecx
mov eax, dword [esi + 0x2c]
mov dword [ebp - 0x1c], eax
cmp dword [eax + 0x14], ecx
sete cl
lea ecx, [ecx*4 + 4]
or ecx, dword [ebp - 0x58]
mov edx, ecx
and edx, 0xfffffff7
test cl, 8
cmove edx, ecx
mov dword [ebp - 0x58], edx
test dl, 4
je 0x1008ae47
and edx, 0xfffffffb
mov dword [ebp - 0x58], edx
jmp 0x1008ae47
mov edx, dword [ebp - 0x58]
xor ecx, ecx
mov edi, eax
cmp byte [esi + 0x38], cl
setne cl
add ecx, 6
test eax, eax
je 0x1008aea1
mov edi, dword [esi + 0x30]
mov dword [ebp - 0x18], edi
mov edi, eax
cmp dword [ebp - 0x18], 0
je 0x1008aea1
cmp ecx, dword [esi + 0x34]
ja 0x1008aea1
mov eax, dword [ebp - 0x18]
mov dword [eax + ecx*4], 0x10090e00
mov edi, dword [esi + 0x2c]
cmp dword [edi + 0x18], 0
je 0x1008ae83
or edx, 0x10
jmp 0x1008ae86
or edx, 0x20
mov ecx, edx
and ecx, 0xffffffdf
test dl, 0x20
cmove ecx, edx
mov edx, ecx
mov dword [ebp - 0x58], edx
test dl, 0x10
je 0x1008aea1
and edx, 0xffffffef
mov dword [ebp - 0x58], edx
xor ecx, ecx
mov eax, edi
cmp byte [esi + 0x38], cl
setne cl
add ecx, 7
test edi, edi
je 0x1008af07
mov eax, dword [esi + 0x30]
mov dword [ebp - 0x18], eax
mov eax, edi
cmp dword [ebp - 0x18], 0
je 0x1008af07
cmp ecx, dword [esi + 0x34]
ja 0x1008af07
mov eax, dword [ebp - 0x18]
mov dword [eax + ecx*4], 0x10091080
mov eax, dword [esi + 0x2c]
mov dword [ebp - 0x18], eax
cmp dword [eax + 0x1c], 0
je 0x1008aee0
or edx, 0x40
jmp 0x1008aee6
or edx, 0x80
mov eax, dword [ebp - 0x18]
mov ecx, edx
and ecx, 0xffffff7f
test dl, 0x80
cmove ecx, edx
mov edx, ecx
mov dword [ebp - 0x58], edx
test dl, 0x40
je 0x1008af07
and edx, 0xffffffbf
mov dword [ebp - 0x58], edx
xor ecx, ecx
cmp byte [esi + 0x38], cl
setne cl
add ecx, 0x24
test eax, eax
je 0x1008af6a
mov eax, dword [esi + 0x30]
test eax, eax
je 0x1008af6a
cmp ecx, dword [esi + 0x34]
ja 0x1008af6a
mov dword [eax + ecx*4], 0x10090c20
mov eax, dword [esi + 0x2c]
cmp dword [eax + 0x90], 0
je 0x1008af3d
or edx, 0x100
jmp 0x1008af43
or edx, 0x200
mov ecx, edx
and ecx, 0xfffffdff
test edx, 0x200
cmove ecx, edx
mov edx, ecx
mov dword [ebp - 0x58], edx
test edx, 0x100
je 0x1008af6a
and edx, 0xfffffeff
mov dword [ebp - 0x58], edx
mov edi, dword [0x100f699c]
mov dword [esi + 0x50], edi
mov eax, dword [edi]
mov dword [esi + 0x54], eax
test eax, eax
je 0x1008b056
xor ecx, ecx
mov eax, dword [esi + 0x54]
mov dword [ebp - 0x14], ecx
mov edx, dword [eax + ecx*4]
test edx, edx
je 0x1008afb5
mov eax, dword [0x100f68f0]
lea ecx, [ebp - 0x3c]
push 0x1c
push ecx
push edx
call eax
mov ecx, dword [ebp - 0x14]
test eax, eax
je 0x1008afb5
mov eax, dword [ebp - 0x28]
test al, 1
jne 0x1008afb5
test eax, 0x100
jne 0x1008afb5
inc ecx
jmp 0x1008af82
mov dword [esi + 0x5c], ecx
test ecx, ecx
je 0x1008b056
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.1002ed50
add esp, 8
lea ecx, [esi + 0x58]
mov dword [ebp - 0x14], ecx
push eax
call fcn.1002ebe0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x1008b01e
push 0x1001fbd0
push dword [eax - 4]
lea esi, [eax - 4]
mov dword [ebp - 4], 2
push 4
push eax
call fcn.100adebc
mov ecx, dword [ebp - 0x18]
mov eax, dword [ecx - 4]
lea eax, [eax*4 + 4]
push eax
push esi
call fcn.100ae00f
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x14]
mov esi, dword [esi]
test esi, esi
je 0x1008b053
mov ecx, dword [ebp - 0x5c]
mov eax, dword [ecx + 0x5c]
lea eax, [eax*4 + 4]
push eax
mov eax, dword [ecx + 0x54]
sub eax, 4
push eax
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
add esi, 4
mov dword [edi], esi
mov esi, dword [ebp - 0x5c]
mov byte [esi + 0x60], 1
jmp 0x1008b056
mov esi, dword [ebp - 0x5c]
mov ecx, dword [esi + 0x54]
xor eax, eax
cmp byte [esi + 0x60], al
mov edi, ecx
setne al
add eax, 0x1b
test ecx, ecx
je 0x1008b0c0
mov edx, dword [esi + 0x58]
test edx, edx
je 0x1008b0c0
cmp eax, dword [esi + 0x5c]
ja 0x1008b0c0
mov dword [edx + eax*4], 0x1008fbb0
mov edi, dword [esi + 0x54]
mov edx, dword [ebp - 0x58]
cmp dword [edi + 0x6c], 0
je 0x1008b091
or edx, 0x400
jmp 0x1008b097
or edx, 0x800
mov ecx, edx
and ecx, 0xfffff7ff
test edx, 0x800
cmove ecx, edx
mov edx, ecx
mov dword [ebp - 0x58], edx
test edx, 0x400
je 0x1008b0c3
and edx, 0xfffffbff
mov dword [ebp - 0x58], edx
jmp 0x1008b0c3
mov edx, dword [ebp - 0x58]
xor eax, eax
cmp byte [esi + 0x60], al
setne al
add eax, 0x5d
test edi, edi
je 0x1008b126
mov ecx, dword [esi + 0x58]
test ecx, ecx
je 0x1008b126
cmp eax, dword [esi + 0x5c]
ja 0x1008b126
mov dword [ecx + eax*4], 0x1008fd30
mov eax, dword [esi + 0x54]
cmp dword [eax + 0x174], 0
je 0x1008b0f9
or edx, 0x1000
jmp 0x1008b0ff
or edx, 0x2000
mov ecx, edx
and ecx, 0xffffdfff
test edx, 0x2000
cmove ecx, edx
mov edx, ecx
mov dword [ebp - 0x58], edx
test edx, 0x1000
je 0x1008b126
and edx, 0xffffefff
mov dword [ebp - 0x58], edx
mov edi, dword [0x100f69f0]
mov dword [esi + 0x64], edi
mov eax, dword [edi]
mov dword [esi + 0x68], eax
test eax, eax
je 0x1008b212
xor ecx, ecx
mov eax, dword [esi + 0x68]
mov dword [ebp - 0x14], ecx
mov edx, dword [eax + ecx*4]
test edx, edx
je 0x1008b171
mov eax, dword [0x100f68f0]
lea ecx, [ebp - 0x3c]
push 0x1c
push ecx
push edx
call eax
mov ecx, dword [ebp - 0x14]
test eax, eax
je 0x1008b171
mov eax, dword [ebp - 0x28]
test al, 1
jne 0x1008b171
test eax, 0x100
jne 0x1008b171
inc ecx
jmp 0x1008b13e
mov dword [esi + 0x70], ecx
test ecx, ecx
je 0x1008b212
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.1002ed50
add esp, 8
lea ecx, [esi + 0x6c]
mov dword [ebp - 0x14], ecx
push eax
call fcn.1002ebe0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x1008b1da
push 0x1001fbd0
push dword [eax - 4]
lea esi, [eax - 4]
mov dword [ebp - 4], 3
push 4
push eax
call fcn.100adebc
mov ecx, dword [ebp - 0x18]
mov eax, dword [ecx - 4]
lea eax, [eax*4 + 4]
push eax
push esi
call fcn.100ae00f
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x14]
mov esi, dword [esi]
test esi, esi
je 0x1008b20f
mov ecx, dword [ebp - 0x5c]
mov eax, dword [ecx + 0x70]
lea eax, [eax*4 + 4]
push eax
mov eax, dword [ecx + 0x68]
sub eax, 4
push eax
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
add esi, 4
mov dword [edi], esi
mov esi, dword [ebp - 0x5c]
mov byte [esi + 0x74], 1
jmp 0x1008b212
mov esi, dword [ebp - 0x5c]
xor eax, eax
cmp byte [esi + 0x74], al
setne al
add eax, 5
cmp dword [esi + 0x68], 0
je 0x1008b272
mov ecx, dword [esi + 0x6c]
test ecx, ecx
je 0x1008b272
cmp eax, dword [esi + 0x70]
ja 0x1008b272
mov edx, dword [ebp - 0x58]
mov dword [ecx + eax*4], 0x1008fb30
mov eax, dword [esi + 0x68]
cmp dword [eax + 0x14], 0
je 0x1008b24a
or edx, 0x4000
jmp 0x1008b250
or edx, 0x8000
mov eax, edx
and eax, 0xffff7fff
test edx, 0x8000
cmove eax, edx
mov dword [ebp - 0x58], eax
test eax, 0x4000
je 0x1008b272
and eax, 0xffffbfff
mov dword [ebp - 0x58], eax
mov edi, dword [0x100f69b4]
mov dword [esi + 0x78], edi
mov eax, dword [edi]
mov dword [esi + 0x7c], eax
test eax, eax
je 0x1008b36a
xor ecx, ecx
mov eax, dword [esi + 0x7c]
mov dword [ebp - 0x14], ecx
mov edx, dword [eax + ecx*4]
test edx, edx
je 0x1008b2bd
mov eax, dword [0x100f68f0]
lea ecx, [ebp - 0x3c]
push 0x1c
push ecx
push edx
call eax
mov ecx, dword [ebp - 0x14]
test eax, eax
je 0x1008b2bd
mov eax, dword [ebp - 0x28]
test al, 1
jne 0x1008b2bd
test eax, 0x100
jne 0x1008b2bd
inc ecx
jmp 0x1008b28a
mov dword [esi + 0x84], ecx
test ecx, ecx
je 0x1008b36a
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.1002ed50
add esp, 8
lea ecx, [esi + 0x80]
mov dword [ebp - 0x14], ecx
push eax
call fcn.1002ebe0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x1008b32c
push 0x1001fbd0
push dword [eax - 4]
lea esi, [eax - 4]
mov dword [ebp - 4], 4
push 4
push eax
call fcn.100adebc
mov ecx, dword [ebp - 0x18]
mov eax, dword [ecx - 4]
lea eax, [eax*4 + 4]
push eax
push esi
call fcn.100ae00f
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x14]
mov esi, dword [esi]
test esi, esi
je 0x1008b367
mov ecx, dword [ebp - 0x5c]
mov eax, dword [ecx + 0x84]
lea eax, [eax*4 + 4]
push eax
mov eax, dword [ecx + 0x7c]
sub eax, 4
push eax
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
add esi, 4
mov dword [edi], esi
mov esi, dword [ebp - 0x5c]
mov byte [esi + 0x88], 1
jmp 0x1008b36a
mov esi, dword [ebp - 0x5c]
mov ecx, dword [esi + 0x7c]
xor eax, eax
cmp byte [esi + 0x88], al
mov edi, ecx
setne al
add eax, 0xe
test ecx, ecx
je 0x1008b3dd
mov edx, dword [esi + 0x80]
test edx, edx
je 0x1008b3dd
cmp eax, dword [esi + 0x84]
ja 0x1008b3dd
mov dword [edx + eax*4], 0x100a4040
mov edi, dword [esi + 0x7c]
mov edx, dword [ebp - 0x58]
cmp dword [edi + 0x38], 0
je 0x1008b3ae
or edx, 0x10000
jmp 0x1008b3b4
or edx, 0x20000
mov ecx, edx
and ecx, 0xfffdffff
test edx, 0x20000
cmove ecx, edx
mov edx, ecx
mov dword [ebp - 0x58], edx
test edx, 0x10000
je 0x1008b3e0
and edx, 0xfffeffff
mov dword [ebp - 0x58], edx
jmp 0x1008b3e0
mov edx, dword [ebp - 0x58]
xor eax, eax
cmp byte [esi + 0x88], al
setne al
add eax, 0x13
test edi, edi
je 0x1008b449
mov ecx, dword [esi + 0x80]
test ecx, ecx
je 0x1008b449
cmp eax, dword [esi + 0x84]
ja 0x1008b449
mov dword [ecx + eax*4], 0x100a4450
mov eax, dword [esi + 0x7c]
cmp dword [eax + 0x4c], 0
je 0x1008b41c
or edx, 0x40000
jmp 0x1008b422
or edx, 0x80000
mov ecx, edx
and ecx, 0xfff7ffff
test edx, 0x80000
cmove ecx, edx
mov edx, ecx
mov dword [ebp - 0x58], edx
test edx, 0x40000
je 0x1008b449
and edx, 0xfffbffff
mov dword [ebp - 0x58], edx
mov edi, dword [0x100f69f8]
mov dword [esi + 0x14], edi
mov eax, dword [edi]
mov dword [esi + 0x18], eax
test eax, eax
je 0x1008b535
xor ecx, ecx
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x14], ecx
mov edx, dword [eax + ecx*4]
test edx, edx
je 0x1008b494
mov eax, dword [0x100f68f0]
lea ecx, [ebp - 0x3c]
push 0x1c
push ecx
push edx
call eax
mov ecx, dword [ebp - 0x14]
test eax, eax
je 0x1008b494
mov eax, dword [ebp - 0x28]
test al, 1
jne 0x1008b494
test eax, 0x100
jne 0x1008b494
inc ecx
jmp 0x1008b461
mov dword [esi + 0x20], ecx
test ecx, ecx
je 0x1008b535
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.1002ed50
add esp, 8
lea ecx, [esi + 0x1c]
mov dword [ebp - 0x14], ecx
push eax
call fcn.1002ebe0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x1008b4fd
push 0x1001fbd0
push dword [eax - 4]
lea esi, [eax - 4]
mov dword [ebp - 4], 5
push 4
push eax
call fcn.100adebc
mov ecx, dword [ebp - 0x18]
mov eax, dword [ecx - 4]
lea eax, [eax*4 + 4]
push eax
push esi
call fcn.100ae00f
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x14]
mov esi, dword [esi]
test esi, esi
je 0x1008b532
mov ecx, dword [ebp - 0x5c]
mov eax, dword [ecx + 0x20]
lea eax, [eax*4 + 4]
push eax
mov eax, dword [ecx + 0x18]
sub eax, 4
push eax
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
add esi, 4
mov dword [edi], esi
mov esi, dword [ebp - 0x5c]
mov byte [esi + 0x24], 1
jmp 0x1008b535
mov esi, dword [ebp - 0x5c]
mov edx, dword [esi + 0x18]
xor ecx, ecx
cmp byte [esi + 0x24], cl
mov eax, edx
setne cl
add ecx, 0x10
test edx, edx
je 0x1008b5a5
mov edi, dword [esi + 0x1c]
test edi, edi
je 0x1008b5a5
mov edx, dword [ebp - 0x58]
cmp ecx, dword [esi + 0x20]
ja 0x1008b5a8
mov dword [edi + ecx*4], 0x1009ba00
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x18], eax
cmp dword [eax + 0x40], 0
je 0x1008b573
or edx, 0x100000
jmp 0x1008b579
or edx, 0x200000
mov eax, dword [ebp - 0x18]
mov ecx, edx
and ecx, 0xffdfffff
test edx, 0x200000
cmove ecx, edx
mov edx, ecx
mov dword [ebp - 0x58], edx
test edx, 0x100000
je 0x1008b5a8
and edx, 0xffefffff
mov dword [ebp - 0x58], edx
jmp 0x1008b5a8
mov edx, dword [ebp - 0x58]
xor ecx, ecx
mov edi, eax
cmp byte [esi + 0x24], cl
setne cl
add ecx, 0x11
test eax, eax
je 0x1008b614
mov edi, dword [esi + 0x1c]
mov dword [ebp - 0x18], edi
mov edi, eax
cmp dword [ebp - 0x18], 0
je 0x1008b614
cmp ecx, dword [esi + 0x20]
ja 0x1008b614
mov eax, dword [ebp - 0x18]
mov dword [eax + ecx*4], 0x1009b9e0
mov edi, dword [esi + 0x18]
cmp dword [edi + 0x44], 0
je 0x1008b5e7
or edx, 0x400000
jmp 0x1008b5ed
or edx, 0x800000
mov ecx, edx
and ecx, 0xff7fffff
test edx, 0x800000
cmove ecx, edx
mov edx, ecx
mov dword [ebp - 0x58], edx
test edx, 0x400000
je 0x1008b614
and edx, 0xffbfffff
mov dword [ebp - 0x58], edx
xor ecx, ecx
mov dword [ebp - 0x14], edi
cmp byte [esi + 0x24], cl
setne cl
add ecx, 0x12
test edi, edi
je 0x1008b67c
mov eax, dword [esi + 0x1c]
mov dword [ebp - 0x14], edi
test eax, eax
je 0x1008b67c
cmp ecx, dword [esi + 0x20]
ja 0x1008b67f
mov dword [eax + ecx*4], 0x1009b960
mov edi, dword [esi + 0x18]
cmp dword [edi + 0x48], 0
je 0x1008b64d
or edx, 0x1000000
jmp 0x1008b653
or edx, 0x2000000
mov ecx, edx
and ecx, 0xfdffffff
test edx, 0x2000000
cmove ecx, edx
mov edx, ecx
mov dword [ebp - 0x58], edx
test edx, 0x1000000
je 0x1008b67f
and edx, 0xfeffffff
mov dword [ebp - 0x58], edx
jmp 0x1008b67f
mov edi, dword [ebp - 0x14]
xor ecx, ecx
mov eax, edi
cmp byte [esi + 0x24], cl
setne cl
add ecx, 0x18
test edi, edi
je 0x1008b6f1
mov eax, dword [esi + 0x1c]
mov dword [ebp - 0x18], eax
mov eax, edi
cmp dword [ebp - 0x18], 0
je 0x1008b6f1
cmp ecx, dword [esi + 0x20]
ja 0x1008b6f1
mov eax, dword [ebp - 0x18]
mov dword [eax + ecx*4], 0x1009b8b0
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x18], eax
cmp dword [eax + 0x60], 0
je 0x1008b6c1
or edx, 0x4000000
jmp 0x1008b6c7
or edx, 0x8000000
mov eax, dword [ebp - 0x18]
mov ecx, edx
and ecx, 0xf7ffffff
test edx, 0x8000000
cmove ecx, edx
mov edx, ecx
mov dword [ebp - 0x58], edx
test edx, 0x4000000
je 0x1008b6f1
and edx, 0xfbffffff
mov dword [ebp - 0x58], edx
xor ecx, ecx
cmp byte [esi + 0x24], cl
setne cl
add ecx, 0x2c
test eax, eax
je 0x1008b754
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x1008b754
cmp ecx, dword [esi + 0x20]
ja 0x1008b754
mov dword [eax + ecx*4], 0x1009b930
mov eax, dword [esi + 0x18]
cmp dword [eax + 0xb0], 0
je 0x1008b727
or edx, 0x10000000
jmp 0x1008b72d
or edx, 0x20000000
mov ecx, edx
and ecx, 0xdfffffff
test edx, 0x20000000
cmove ecx, edx
mov edx, ecx
mov dword [ebp - 0x58], edx
test edx, 0x10000000
je 0x1008b754
and edx, 0xefffffff
mov dword [ebp - 0x58], edx
mov edi, dword [0x100f69a8]
mov dword [esi + 0x8c], edi
mov eax, dword [edi]
mov dword [esi + 0x90], eax
test eax, eax
je 0x1008b858
xor ecx, ecx
mov eax, dword [esi + 0x90]
mov dword [ebp - 0x14], ecx
mov edx, dword [eax + ecx*4]
test edx, edx
je 0x1008b7a8
mov eax, dword [0x100f68f0]
lea ecx, [ebp - 0x3c]
push 0x1c
push ecx
push edx
call eax
mov ecx, dword [ebp - 0x14]
test eax, eax
je 0x1008b7a8
mov eax, dword [ebp - 0x28]
test al, 1
jne 0x1008b7a8
test eax, 0x100
jne 0x1008b7a8
inc ecx
jmp 0x1008b772
mov dword [esi + 0x98], ecx
test ecx, ecx
je 0x1008b858
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.1002ed50
add esp, 8
lea ecx, [esi + 0x94]
mov dword [ebp - 0x14], ecx
push eax
call fcn.1002ebe0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x1008b817
push 0x1001fbd0
push dword [eax - 4]
lea esi, [eax - 4]
mov dword [ebp - 4], 6
push 4
push eax
call fcn.100adebc
mov ecx, dword [ebp - 0x18]
mov eax, dword [ecx - 4]
lea eax, [eax*4 + 4]
push eax
push esi
call fcn.100ae00f
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x14]
mov esi, dword [esi]
test esi, esi
je 0x1008b855
mov ecx, dword [ebp - 0x5c]
mov eax, dword [ecx + 0x98]
lea eax, [eax*4 + 4]
push eax
mov eax, dword [ecx + 0x90]
sub eax, 4
push eax
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
add esi, 4
mov dword [edi], esi
mov esi, dword [ebp - 0x5c]
mov byte [esi + 0x9c], 1
jmp 0x1008b858
mov esi, dword [ebp - 0x5c]
mov edx, dword [esi + 0x90]
xor eax, eax
cmp byte [esi + 0x9c], al
mov ecx, edx
setne al
add eax, 0x43
test edx, edx
je 0x1008b8ae
mov edi, dword [esi + 0x94]
test edi, edi
je 0x1008b8ae
cmp eax, dword [esi + 0x98]
ja 0x1008b8ae
mov dword [edi + eax*4], 0x10096c60
mov ecx, dword [esi + 0x90]
mov eax, dword [ebp - 0x58]
cmp dword [ecx + 0x10c], 0
je 0x1008b8a4
or eax, 0x40000000
jmp 0x1008b8a9
or eax, 0x80000000
test eax, eax
cmovs ecx, ecx
xor edx, edx
mov eax, ecx
cmp byte [esi + 0x9c], dl
setne dl
add edx, 0x52
test ecx, ecx
je 0x1008b909
mov edi, dword [esi + 0x94]
test edi, edi
je 0x1008b909
cmp edx, dword [esi + 0x98]
ja 0x1008b909
mov dword [edi + edx*4], 0x10096ce0
mov eax, dword [esi + 0x90]
mov edx, dword [eax + 0x148]
neg edx
sbb edx, edx
add edx, 2
mov dword [ebp - 0x64], edx
test dl, 2
je 0x1008b8fc
and edx, 0xfffffffd
mov dword [ebp - 0x64], edx
test dl, 1
je 0x1008b90c
and edx, 0xfffffffe
mov dword [ebp - 0x64], edx
jmp 0x1008b90c
mov edx, dword [ebp - 0x64]
xor ecx, ecx
cmp byte [esi + 0x9c], cl
setne cl
add ecx, 0x74
test eax, eax
je 0x1008b969
mov eax, dword [esi + 0x94]
test eax, eax
je 0x1008b969
cmp ecx, dword [esi + 0x98]
ja 0x1008b969
mov dword [eax + ecx*4], 0x10096cb0
mov eax, dword [esi + 0x90]
cmp dword [eax + 0x1d0], 0
je 0x1008b94b
or edx, 4
jmp 0x1008b94e
or edx, 8
mov ecx, edx
and ecx, 0xfffffff7
test dl, 8
cmove ecx, edx
mov edx, ecx
mov dword [ebp - 0x64], edx
test dl, 4
je 0x1008b969
and edx, 0xfffffffb
mov dword [ebp - 0x64], edx
mov edi, dword [0x100f69c8]
mov dword [esi + 0xdc], edi
mov eax, dword [edi]
mov dword [esi + 0xe0], eax
test eax, eax
je 0x1008ba6d
xor ecx, ecx
mov eax, dword [esi + 0xe0]
mov dword [ebp - 0x14], ecx
mov edx, dword [eax + ecx*4]
test edx, edx
je 0x1008b9bd
mov eax, dword [0x100f68f0]
lea ecx, [ebp - 0x3c]
push 0x1c
push ecx
push edx
call eax
mov ecx, dword [ebp - 0x14]
test eax, eax
je 0x1008b9bd
mov eax, dword [ebp - 0x28]
test al, 1
jne 0x1008b9bd
test eax, 0x100
jne 0x1008b9bd
inc ecx
jmp 0x1008b987
mov dword [esi + 0xe8], ecx
test ecx, ecx
je 0x1008ba6d
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.1002ed50
add esp, 8
lea ecx, [esi + 0xe4]
mov dword [ebp - 0x14], ecx
push eax
call fcn.1002ebe0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x1008ba2c
push 0x1001fbd0
push dword [eax - 4]
lea esi, [eax - 4]
mov dword [ebp - 4], 7
push 4
push eax
call fcn.100adebc
mov ecx, dword [ebp - 0x18]
mov eax, dword [ecx - 4]
lea eax, [eax*4 + 4]
push eax
push esi
call fcn.100ae00f
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x14]
mov esi, dword [esi]
test esi, esi
je 0x1008ba6a
mov ecx, dword [ebp - 0x5c]
mov eax, dword [ecx + 0xe8]
lea eax, [eax*4 + 4]
push eax
mov eax, dword [ecx + 0xe0]
sub eax, 4
push eax
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
add esi, 4
mov dword [edi], esi
mov esi, dword [ebp - 0x5c]
mov byte [esi + 0xec], 1
jmp 0x1008ba6d
mov esi, dword [ebp - 0x5c]
xor eax, eax
cmp byte [esi + 0xec], al
setne al
add eax, 0x15
cmp dword [esi + 0xe0], 0
je 0x1008bacc
mov ecx, dword [esi + 0xe4]
test ecx, ecx
je 0x1008bacc
cmp eax, dword [esi + 0xe8]
ja 0x1008bacc
mov edx, dword [ebp - 0x64]
mov dword [ecx + eax*4], 0x10085f60
mov eax, dword [esi + 0xe0]
cmp dword [eax + 0x54], 0
je 0x1008bab1
or edx, 0x10
jmp 0x1008bab4
or edx, 0x20
mov eax, edx
and eax, 0xffffffdf
test dl, 0x20
cmove eax, edx
mov dword [ebp - 0x64], eax
test al, 0x10
je 0x1008bacc
and eax, 0xffffffef
mov dword [ebp - 0x64], eax
mov edi, dword [0x100f69c0]
mov dword [esi + 0xc8], edi
mov eax, dword [edi]
mov dword [esi + 0xcc], eax
test eax, eax
je 0x1008bbd0
xor ecx, ecx
mov eax, dword [esi + 0xcc]
mov dword [ebp - 0x14], ecx
mov edx, dword [eax + ecx*4]
test edx, edx
je 0x1008bb20
mov eax, dword [0x100f68f0]
lea ecx, [ebp - 0x3c]
push 0x1c
push ecx
push edx
call eax
mov ecx, dword [ebp - 0x14]
test eax, eax
je 0x1008bb20
mov eax, dword [ebp - 0x28]
test al, 1
jne 0x1008bb20
test eax, 0x100
jne 0x1008bb20
inc ecx
jmp 0x1008baea
mov dword [esi + 0xd4], ecx
test ecx, ecx
je 0x1008bbd0
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.1002ed50
add esp, 8
lea ecx, [esi + 0xd0]
mov dword [ebp - 0x14], ecx
push eax
call fcn.1002ebe0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x1008bb8f
push 0x1001fbd0
push dword [eax - 4]
lea esi, [eax - 4]
mov dword [ebp - 4], 8
push 4
push eax
call fcn.100adebc
mov ecx, dword [ebp - 0x18]
mov eax, dword [ecx - 4]
lea eax, [eax*4 + 4]
push eax
push esi
call fcn.100ae00f
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x14]
mov esi, dword [esi]
test esi, esi
je 0x1008bbcd
mov ecx, dword [ebp - 0x5c]
mov eax, dword [ecx + 0xd4]
lea eax, [eax*4 + 4]
push eax
mov eax, dword [ecx + 0xcc]
sub eax, 4
push eax
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
add esi, 4
mov dword [edi], esi
mov esi, dword [ebp - 0x5c]
mov byte [esi + 0xd8], 1
jmp 0x1008bbd0
mov esi, dword [ebp - 0x5c]
xor eax, eax
cmp byte [esi + 0xd8], al
setne al
add eax, 9
cmp dword [esi + 0xcc], 0
je 0x1008bc34
mov ecx, dword [esi + 0xd0]
test ecx, ecx
je 0x1008bc34
cmp eax, dword [esi + 0xd4]
ja 0x1008bc34
mov edx, dword [ebp - 0x64]
mov dword [ecx + eax*4], 0x100a44a0
mov eax, dword [esi + 0xcc]
cmp dword [eax + 0x24], 0
je 0x1008bc14
or edx, 0x40
jmp 0x1008bc1a
or edx, 0x80
mov eax, edx
and eax, 0xffffff7f
test dl, 0x80
cmove eax, edx
mov dword [ebp - 0x64], eax
test al, 0x40
je 0x1008bc34
and eax, 0xffffffbf
mov dword [ebp - 0x64], eax
mov edi, dword [0x100f6a20]
mov dword [esi + 0xf0], edi
mov eax, dword [edi]
mov dword [esi + 0xf4], eax
test eax, eax
je 0x1008bd38
xor ecx, ecx
mov eax, dword [esi + 0xf4]
mov dword [ebp - 0x14], ecx
mov edx, dword [eax + ecx*4]
test edx, edx
je 0x1008bc88
mov eax, dword [0x100f68f0]
lea ecx, [ebp - 0x3c]
push 0x1c
push ecx
push edx
call eax
mov ecx, dword [ebp - 0x14]
test eax, eax
je 0x1008bc88
mov eax, dword [ebp - 0x28]
test al, 1
jne 0x1008bc88
test eax, 0x100
jne 0x1008bc88
inc ecx
jmp 0x1008bc52
mov dword [esi + 0xfc], ecx
test ecx, ecx
je 0x1008bd38
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.1002ed50
add esp, 8
lea ecx, [esi + 0xf8]
mov dword [ebp - 0x14], ecx
push eax
call fcn.1002ebe0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x1008bcf7
push 0x1001fbd0
push dword [eax - 4]
lea esi, [eax - 4]
mov dword [ebp - 4], 9
push 4
push eax
call fcn.100adebc
mov ecx, dword [ebp - 0x18]
mov eax, dword [ecx - 4]
lea eax, [eax*4 + 4]
push eax
push esi
call fcn.100ae00f
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x14]
mov esi, dword [esi]
test esi, esi
je 0x1008bd35
mov ecx, dword [ebp - 0x5c]
mov eax, dword [ecx + 0xfc]
lea eax, [eax*4 + 4]
push eax
mov eax, dword [ecx + 0xf4]
sub eax, 4
push eax
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
add esi, 4
mov dword [edi], esi
mov esi, dword [ebp - 0x5c]
mov byte [esi + 0x100], 1
jmp 0x1008bd38
mov esi, dword [ebp - 0x5c]
xor eax, eax
cmp byte [esi + 0x100], al
setne al
add eax, 0x2b
cmp dword [esi + 0xf4], 0
je 0x1008bdaa
mov ecx, dword [esi + 0xf8]
test ecx, ecx
je 0x1008bdaa
cmp eax, dword [esi + 0xfc]
ja 0x1008bdaa
mov edx, dword [ebp - 0x64]
mov dword [ecx + eax*4], 0x1004bca0
mov eax, dword [esi + 0xf4]
cmp dword [eax + 0xac], 0
je 0x1008bd82
or edx, 0x100
jmp 0x1008bd88
or edx, 0x200
mov eax, edx
and eax, 0xfffffdff
test edx, 0x200
cmove eax, edx
mov dword [ebp - 0x64], eax
test eax, 0x100
je 0x1008bdaa
and eax, 0xfffffeff
mov dword [ebp - 0x64], eax
mov edi, dword [0x100f69c4]
mov dword [esi + 0x104], edi
mov eax, dword [edi]
mov dword [esi + 0x108], eax
test eax, eax
je 0x1008beae
xor ecx, ecx
mov eax, dword [esi + 0x108]
mov dword [ebp - 0x14], ecx
mov edx, dword [eax + ecx*4]
test edx, edx
je 0x1008bdfe
mov eax, dword [0x100f68f0]
lea ecx, [ebp - 0x3c]
push 0x1c
push ecx
push edx
call eax
mov ecx, dword [ebp - 0x14]
test eax, eax
je 0x1008bdfe
mov eax, dword [ebp - 0x28]
test al, 1
jne 0x1008bdfe
test eax, 0x100
jne 0x1008bdfe
inc ecx
jmp 0x1008bdc8
mov dword [esi + 0x110], ecx
test ecx, ecx
je 0x1008beae
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.1002ed50
add esp, 8
lea ecx, [esi + 0x10c]
mov dword [ebp - 0x14], ecx
push eax
call fcn.1002ebe0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x1008be6d
push 0x1001fbd0
push dword [eax - 4]
lea esi, [eax - 4]
mov dword [ebp - 4], 0xa
push 4
push eax
call fcn.100adebc
mov ecx, dword [ebp - 0x18]
mov eax, dword [ecx - 4]
lea eax, [eax*4 + 4]
push eax
push esi
call fcn.100ae00f
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x14]
mov esi, dword [esi]
test esi, esi
je 0x1008beab
mov ecx, dword [ebp - 0x5c]
mov eax, dword [ecx + 0x110]
lea eax, [eax*4 + 4]
push eax
mov eax, dword [ecx + 0x108]
sub eax, 4
push eax
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
add esi, 4
mov dword [edi], esi
mov esi, dword [ebp - 0x5c]
mov byte [esi + 0x114], 1
jmp 0x1008beae
mov esi, dword [ebp - 0x5c]
mov edx, dword [esi + 0x108]
xor ecx, ecx
cmp byte [esi + 0x114], cl
mov eax, edx
setne cl
add ecx, 4
test edx, edx
je 0x1008bf27
mov edi, dword [esi + 0x10c]
test edi, edi
je 0x1008bf27
mov edx, dword [ebp - 0x64]
cmp ecx, dword [esi + 0x110]
ja 0x1008bf2a
mov dword [edi + ecx*4], 0x100a1550
mov eax, dword [esi + 0x108]
mov dword [ebp - 0x18], eax
cmp dword [eax + 0x10], 0
je 0x1008befb
or edx, 0x400
jmp 0x1008bf01
or edx, 0x800
mov eax, dword [ebp - 0x18]
mov ecx, edx
and ecx, 0xfffff7ff
test edx, 0x800
cmove ecx, edx
mov edx, ecx
test edx, 0x400
je 0x1008bf2a
and edx, 0xfffffbff
jmp 0x1008bf2a
mov edx, dword [ebp - 0x64]
xor ecx, ecx
mov edi, eax
cmp byte [esi + 0x114], cl
setne cl
add ecx, 6
test eax, eax
je 0x1008bf9c
mov edi, dword [esi + 0x10c]
mov dword [ebp - 0x18], edi
mov edi, eax
cmp dword [ebp - 0x18], 0
je 0x1008bf9c
cmp ecx, dword [esi + 0x110]
ja 0x1008bf9c
mov eax, dword [ebp - 0x18]
mov dword [eax + ecx*4], 0x100a1640
mov edi, dword [esi + 0x108]
cmp dword [edi + 0x18], 0
je 0x1008bf75
or edx, 0x1000
jmp 0x1008bf7b
or edx, 0x2000
mov ecx, edx
and ecx, 0xffffdfff
test edx, 0x2000
cmove ecx, edx
mov edx, ecx
test edx, 0x1000
je 0x1008bf9c
and edx, 0xffffefff
xor ecx, ecx
mov dword [ebp - 0x14], edi
cmp byte [esi + 0x114], cl
setne cl
add ecx, 0x27
test edi, edi
je 0x1008c006
mov eax, dword [esi + 0x10c]
mov dword [ebp - 0x14], edi
test eax, eax
je 0x1008c006
cmp ecx, dword [esi + 0x110]
ja 0x1008c009
mov dword [eax + ecx*4], 0x100a1600
mov edi, dword [esi + 0x108]
cmp dword [edi + 0x9c], 0
je 0x1008bfe4
or edx, 0x4000
jmp 0x1008bfea
or edx, 0x8000
mov ecx, edx
and ecx, 0xffff7fff
test edx, 0x8000
cmove ecx, edx
test ecx, 0x4000
cmovne edi, edi
jmp 0x1008c009
mov edi, dword [ebp - 0x14]
xor eax, eax
cmp byte [esi + 0x114], al
setne al
add eax, 0x28
test edi, edi
je 0x1008c034
mov ecx, dword [esi + 0x10c]
test ecx, ecx
je 0x1008c034
cmp eax, dword [esi + 0x110]
ja 0x1008c034
mov dword [ecx + eax*4], 0x100a1620
mov edi, dword [0x100f69e4]
mov dword [esi + 0x118], edi
mov eax, dword [edi]
mov dword [esi + 0x11c], eax
test eax, eax
je 0x1008c138
xor ecx, ecx
mov eax, dword [esi + 0x11c]
mov dword [ebp - 0x14], ecx
mov edx, dword [eax + ecx*4]
test edx, edx
je 0x1008c088
mov eax, dword [0x100f68f0]
lea ecx, [ebp - 0x3c]
push 0x1c
push ecx
push edx
call eax
mov ecx, dword [ebp - 0x14]
test eax, eax
je 0x1008c088
mov eax, dword [ebp - 0x28]
test al, 1
jne 0x1008c088
test eax, 0x100
jne 0x1008c088
inc ecx
jmp 0x1008c052
mov dword [esi + 0x124], ecx
test ecx, ecx
je 0x1008c138
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.1002ed50
add esp, 8
lea ecx, [esi + 0x120]
mov dword [ebp - 0x14], ecx
push eax
call fcn.1002ebe0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x1008c0f7
push 0x1001fbd0
push dword [eax - 4]
lea esi, [eax - 4]
mov dword [ebp - 4], 0xb
push 4
push eax
call fcn.100adebc
mov ecx, dword [ebp - 0x18]
mov eax, dword [ecx - 4]
lea eax, [eax*4 + 4]
push eax
push esi
call fcn.100ae00f
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x14]
mov esi, dword [esi]
test esi, esi
je 0x1008c135
mov ecx, dword [ebp - 0x5c]
mov eax, dword [ecx + 0x124]
lea eax, [eax*4 + 4]
push eax
mov eax, dword [ecx + 0x11c]
sub eax, 4
push eax
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
add esi, 4
mov dword [edi], esi
mov esi, dword [ebp - 0x5c]
mov byte [esi + 0x128], 1
jmp 0x1008c138
mov esi, dword [ebp - 0x5c]
xor eax, eax
cmp byte [esi + 0x128], al
setne al
add eax, 0xd
cmp dword [esi + 0x11c], 0
je 0x1008c168
mov ecx, dword [esi + 0x120]
test ecx, ecx
je 0x1008c168
cmp eax, dword [esi + 0x124]
ja 0x1008c168
mov dword [ecx + eax*4], 0x1004b6a0
mov edi, dword [0x100f69cc]
mov dword [esi + 0x12c], edi
mov eax, dword [edi]
mov dword [esi + 0x130], eax
test eax, eax
je 0x1008c26c
xor ecx, ecx
mov eax, dword [esi + 0x130]
mov dword [ebp - 0x14], ecx
mov edx, dword [eax + ecx*4]
test edx, edx
je 0x1008c1bc
mov eax, dword [0x100f68f0]
lea ecx, [ebp - 0x3c]
push 0x1c
push ecx
push edx
call eax
mov ecx, dword [ebp - 0x14]
test eax, eax
je 0x1008c1bc
mov eax, dword [ebp - 0x28]
test al, 1
jne 0x1008c1bc
test eax, 0x100
jne 0x1008c1bc
inc ecx
jmp 0x1008c186
mov dword [esi + 0x138], ecx
test ecx, ecx
je 0x1008c26c
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.1002ed50
add esp, 8
lea ecx, [esi + 0x134]
mov dword [ebp - 0x14], ecx
push eax
call fcn.1002ebe0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x1008c22b
push 0x1001fbd0
push dword [eax - 4]
lea esi, [eax - 4]
mov dword [ebp - 4], 0xc
push 4
push eax
call fcn.100adebc
mov ecx, dword [ebp - 0x18]
mov eax, dword [ecx - 4]
lea eax, [eax*4 + 4]
push eax
push esi
call fcn.100ae00f
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x14]
mov esi, dword [esi]
test esi, esi
je 0x1008c269
mov ecx, dword [ebp - 0x5c]
mov eax, dword [ecx + 0x138]
lea eax, [eax*4 + 4]
push eax
mov eax, dword [ecx + 0x130]
sub eax, 4
push eax
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
add esi, 4
mov dword [edi], esi
mov esi, dword [ebp - 0x5c]
mov byte [esi + 0x13c], 1
jmp 0x1008c26c
mov esi, dword [ebp - 0x5c]
xor eax, eax
cmp byte [esi + 0x13c], al
setne al
add eax, 0x15
cmp dword [esi + 0x130], 0
je 0x1008c29c
mov ecx, dword [esi + 0x134]
test ecx, ecx
je 0x1008c29c
cmp eax, dword [esi + 0x138]
ja 0x1008c29c
mov dword [ecx + eax*4], 0x1004bc70
mov edi, dword [0x100f6b38]
mov dword [esi + 0x140], edi
mov eax, dword [edi]
mov dword [esi + 0x144], eax
test eax, eax
je 0x1008c3a0
xor ecx, ecx
mov eax, dword [esi + 0x144]
mov dword [ebp - 0x14], ecx
mov edx, dword [eax + ecx*4]
test edx, edx
je 0x1008c2f0
mov eax, dword [0x100f68f0]
lea ecx, [ebp - 0x3c]
push 0x1c
push ecx
push edx
call eax
mov ecx, dword [ebp - 0x14]
test eax, eax
je 0x1008c2f0
mov eax, dword [ebp - 0x28]
test al, 1
jne 0x1008c2f0
test eax, 0x100
jne 0x1008c2f0
inc ecx
jmp 0x1008c2ba
mov dword [esi + 0x14c], ecx
test ecx, ecx
je 0x1008c3a0
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.1002ed50
add esp, 8
lea ecx, [esi + 0x148]
mov dword [ebp - 0x14], ecx
push eax
call fcn.1002ebe0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x1008c35f
push 0x1001fbd0
push dword [eax - 4]
lea esi, [eax - 4]
mov dword [ebp - 4], 0xd
push 4
push eax
call fcn.100adebc
mov ecx, dword [ebp - 0x18]
mov eax, dword [ecx - 4]
lea eax, [eax*4 + 4]
push eax
push esi
call fcn.100ae00f
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x14]
mov esi, dword [esi]
test esi, esi
je 0x1008c39d
mov ecx, dword [ebp - 0x5c]
mov eax, dword [ecx + 0x14c]
lea eax, [eax*4 + 4]
push eax
mov eax, dword [ecx + 0x144]
sub eax, 4
push eax
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
add esi, 4
mov dword [edi], esi
mov esi, dword [ebp - 0x5c]
mov byte [esi + 0x150], 1
jmp 0x1008c3a0
mov esi, dword [ebp - 0x5c]
xor eax, eax
cmp byte [esi + 0x150], al
setne al
add eax, 7
cmp dword [esi + 0x144], 0
je 0x1008c3d0
mov ecx, dword [esi + 0x148]
test ecx, ecx
je 0x1008c3d0
cmp eax, dword [esi + 0x14c]
ja 0x1008c3d0
mov dword [ecx + eax*4], 0x10047340
mov edi, dword [0x100f6a34]
mov dword [esi + 0x3c], edi
mov eax, dword [edi]
mov dword [esi + 0x40], eax
test eax, eax
je 0x1008c479
xor ecx, ecx
mov eax, dword [esi + 0x40]
mov dword [ebp - 0x14], ecx
mov edx, dword [eax + ecx*4]
test edx, edx
je 0x1008c41b
mov eax, dword [0x100f68f0]
lea ecx, [ebp - 0x3c]
push 0x1c
push ecx
push edx
call eax
mov ecx, dword [ebp - 0x14]
test eax, eax
je 0x1008c41b
mov eax, dword [ebp - 0x28]
test al, 1
jne 0x1008c41b
test eax, 0x100
jne 0x1008c41b
inc ecx
jmp 0x1008c3e8
mov dword [esi + 0x48], ecx
test ecx, ecx
je 0x1008c479
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.1002ed50
add esp, 8
lea ecx, [esi + 0x44]
push eax
call fcn.1002ebe0
lea ecx, [ebp - 0x1c]
call fcn.1008a260
mov esi, dword [esi + 0x44]
test esi, esi
je 0x1008c476
mov ecx, dword [ebp - 0x5c]
mov eax, dword [ecx + 0x48]
lea eax, [eax*4 + 4]
push eax
mov eax, dword [ecx + 0x40]
sub eax, 4
push eax
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
add esi, 4
mov dword [edi], esi
mov esi, dword [ebp - 0x5c]
mov byte [esi + 0x4c], 1
jmp 0x1008c479
mov esi, dword [ebp - 0x5c]
push 0x100d9588
call dword [0x100f6b48]
mov edi, dword [0x100f6a80]
mov dword [esi + 0x668], edi
mov eax, dword [edi]
mov dword [esi + 0x66c], eax
test eax, eax
je 0x1008c548
xor ecx, ecx
mov eax, dword [esi + 0x66c]
mov dword [ebp - 0x14], ecx
mov edx, dword [eax + ecx*4]
test edx, edx
je 0x1008c4d8
mov eax, dword [0x100f68f0]
lea ecx, [ebp - 0x3c]
push 0x1c
push ecx
push edx
call eax
mov ecx, dword [ebp - 0x14]
test eax, eax
je 0x1008c4d8
mov eax, dword [ebp - 0x28]
test al, 1
jne 0x1008c4d8
test eax, 0x100
jne 0x1008c4d8
inc ecx
jmp 0x1008c4a2
mov dword [esi + 0x674], ecx
test ecx, ecx
je 0x1008c548
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.1002ed50
add esp, 8
lea ecx, [esi + 0x670]
push eax
call fcn.1002ebe0
lea ecx, [ebp - 0x1c]
call fcn.1008a260
mov esi, dword [esi + 0x670]
test esi, esi
je 0x1008c545
mov ecx, dword [ebp - 0x5c]
mov eax, dword [ecx + 0x674]
lea eax, [eax*4 + 4]
push eax
mov eax, dword [ecx + 0x66c]
sub eax, 4
push eax
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
add esi, 4
mov dword [edi], esi
mov esi, dword [ebp - 0x5c]
mov byte [esi + 0x678], 1
jmp 0x1008c548
mov esi, dword [ebp - 0x5c]
xor eax, eax
cmp byte [esi + 0x678], al
setne al
add eax, 0xd
cmp dword [esi + 0x66c], 0
je 0x1008c578
mov ecx, dword [esi + 0x670]
test ecx, ecx
je 0x1008c578
cmp eax, dword [esi + 0x674]
ja 0x1008c578
mov dword [ecx + eax*4], 0x10085d90
mov edi, dword [0x100f6a84]
mov dword [esi + 0x154], edi
mov eax, dword [edi]
mov dword [esi + 0x158], eax
test eax, eax
je 0x1008c63c
xor ecx, ecx
mov eax, dword [esi + 0x158]
mov dword [ebp - 0x14], ecx
mov edx, dword [eax + ecx*4]
test edx, edx
je 0x1008c5cc
mov eax, dword [0x100f68f0]
lea ecx, [ebp - 0x3c]
push 0x1c
push ecx
push edx
call eax
mov ecx, dword [ebp - 0x14]
test eax, eax
je 0x1008c5cc
mov eax, dword [ebp - 0x28]
test al, 1
jne 0x1008c5cc
test eax, 0x100
jne 0x1008c5cc
inc ecx
jmp 0x1008c596
mov dword [esi + 0x160], ecx
test ecx, ecx
je 0x1008c63c
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.1002ed50
add esp, 8
lea ecx, [esi + 0x15c]
push eax
call fcn.1002ebe0
lea ecx, [ebp - 0x1c]
call fcn.1008a260
mov esi, dword [esi + 0x15c]
test esi, esi
je 0x1008c639
mov ecx, dword [ebp - 0x5c]
mov eax, dword [ecx + 0x160]
lea eax, [eax*4 + 4]
push eax
mov eax, dword [ecx + 0x158]
sub eax, 4
push eax
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
add esi, 4
mov dword [edi], esi
mov esi, dword [ebp - 0x5c]
mov byte [esi + 0x164], 1
jmp 0x1008c63c
mov esi, dword [ebp - 0x5c]
xor eax, eax
cmp byte [esi + 0x164], al
setne al
add eax, 0xd
cmp dword [esi + 0x158], 0
je 0x1008c66c
mov ecx, dword [esi + 0x15c]
test ecx, ecx
je 0x1008c66c
cmp eax, dword [esi + 0x160]
ja 0x1008c66c
mov dword [ecx + eax*4], 0x10085f20
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x14], 0xf3c2c786
push eax
lea eax, [ebp - 0x68]
mov dword [ebp - 0x1c], 0x72e242a1
push eax
mov ecx, 0x100f6da0
call fcn.1004c3e0
mov ecx, dword [eax]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x60]
add ecx, 0xc
push eax
call fcn.1004c1e0
mov eax, dword [eax]
movq xmm0, qword [eax + 0xc]
mov eax, dword [eax + 0x14]
movq qword [ebp - 0x6c], xmm0
cmp byte [ebp - 0x6c], 0
mov dword [ebp - 0x64], eax
jne 0x1008c6c9
mov ecx, dword [ebp - 0x68]
mov eax, dword [ecx + 0x20]
mov dword [esi + 0x698], eax
mov dword [ecx + 0x20], 0x1008ab10
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x14], 0x9ef0d03e
push eax
lea eax, [ebp - 0x68]
mov dword [ebp - 0x1c], 0x72e242a1
push eax
mov ecx, 0x100f6da0
call fcn.1004c3e0
mov ecx, dword [eax]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x60]
add ecx, 0xc
push eax
call fcn.1004c1e0
mov eax, dword [eax]
movq xmm0, qword [eax + 0xc]
mov eax, dword [eax + 0x14]
movq qword [ebp - 0x6c], xmm0
cmp byte [ebp - 0x6c], 0
mov dword [ebp - 0x64], eax
jne 0x1008c726
mov ecx, dword [ebp - 0x68]
mov eax, dword [ecx + 0x20]
mov dword [esi + 0x69c], eax
mov dword [ecx + 0x20], 0x1008a840
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x14], 0x566bd764
push eax
lea eax, [ebp - 0x68]
mov dword [ebp - 0x1c], 0x2aafa737
push eax
mov ecx, 0x100f6da0
call fcn.1004c3e0
mov ecx, dword [eax]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x60]
add ecx, 0xc
push eax
call fcn.1004c1e0
mov eax, dword [eax]
movq xmm0, qword [eax + 0xc]
mov eax, dword [eax + 0x14]
movq qword [ebp - 0x6c], xmm0
cmp byte [ebp - 0x6c], 0
mov dword [ebp - 0x64], eax
jne 0x1008c783
mov edx, dword [ebp - 0x68]
mov eax, dword [edx + 0x20]
mov dword [esi + 0x6a0], eax
mov dword [edx + 0x20], 0x1008a9f0
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x14], 0x781aa1a4
push eax
lea eax, [ebp - 0x68]
mov dword [ebp - 0x1c], 0x2aafa737
push eax
mov ecx, 0x100f6da0
call fcn.1004c3e0
mov ecx, dword [eax]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x60]
add ecx, 0xc
push eax
call fcn.1004c1e0
mov eax, dword [eax]
movq xmm0, qword [eax + 0xc]
mov eax, dword [eax + 0x14]
movq qword [ebp - 0x6c], xmm0
cmp byte [ebp - 0x6c], 0
mov dword [ebp - 0x64], eax
jne 0x1008c7e0
mov ecx, dword [ebp - 0x68]
mov eax, dword [ecx + 0x20]
mov dword [esi + 0x6a4], eax
mov dword [ecx + 0x20], 0x1008a820
cmp byte [0x100f75d0], 0
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
jne 0x1008c903
movaps xmm0, xmmword [0x100bd590]
xor eax, eax
movaps xmm2, xmmword [0x100bb620]
movups xmmword [ebp - 0x4c], xmm0
mov dword [ebp - 0x2c], 0x8c949d8c
movaps xmm0, xmmword [0x100bd5a0]
movups xmmword [ebp - 0x3c], xmm0
mov dword [ebp - 0x28], 0xea8cee94
mov word [ebp - 0x24], 0xac9d
nop word [eax + eax]
movups xmm0, xmmword [ebp + eax - 0x4c]
movaps xmm1, xmm2
pxor xmm1, xmm0
movups xmmword [ebp + eax - 0x4c], xmm1
add eax, 0x10
cmp eax, 0x20
jb 0x1008c830
cmp eax, 0x2a
jae 0x1008c85b
nop
xor byte [ebp + eax - 0x4c], 0xac
inc eax
cmp eax, 0x2a
jb 0x1008c850
xorps xmm0, xmm0
mov dword [ebp - 0x68], 0
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x64], 0
movups xmmword [ebp - 0x78], xmm0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1008c876
sub ecx, edx
lea eax, [ebp - 0x4c]
push ecx
push eax
lea ecx, [ebp - 0x78]
call fcn.1001d5b0
mov ecx, dword [0x100f6954]
mov dword [ebp - 4], 0xe
test ecx, ecx
je 0x1008c8a2
mov ecx, dword [ecx + 0x50]
jmp 0x1008c8a4
xor ecx, ecx
mov eax, dword [0x100f694c]
test eax, eax
je 0x1008c8b2
mov eax, dword [eax + 0x18]
jmp 0x1008c8b4
xor eax, eax
lea edx, [ebp - 0x78]
push edx
push ecx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.10025d70
mov esi, dword [ebp - 0x1c]
lea ecx, [ebp - 0x78]
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
add esi, 0x7e
call fcn.1001f960
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push 0x40
push 1
push esi
call edi
lea eax, [ebp - 0x14]
mov byte [esi], 0x3f
push eax
push dword [ebp - 0x14]
push 1
push esi
call edi
mov byte [0x100f75d0], 1
cmp byte [0x100f75d1], 0
jne 0x1008ca1c
movaps xmm0, xmmword [0x100bd5c0]
xor eax, eax
movaps xmm2, xmmword [0x100bb620]
movups xmmword [ebp - 0x54], xmm0
mov dword [ebp - 0x24], 0x938c938c
movaps xmm0, xmmword [0x100bd5b0]
movups xmmword [ebp - 0x44], xmm0
mov byte [ebp - 0x20], 0xac
movaps xmm0, xmmword [0x100bd580]
movups xmmword [ebp - 0x34], xmm0
nop word [eax + eax]
movups xmm0, xmmword [ebp + eax - 0x54]
movaps xmm1, xmm2
pxor xmm1, xmm0
movups xmmword [ebp + eax - 0x54], xmm1
add eax, 0x10
cmp eax, 0x30
jb 0x1008c950
cmp eax, 0x35
jae 0x1008c97b
nop
xor byte [ebp + eax - 0x54], 0xac
inc eax
cmp eax, 0x35
jb 0x1008c970
xorps xmm0, xmm0
mov dword [ebp - 0x68], 0
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x64], 0
movups xmmword [ebp - 0x78], xmm0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1008c996
sub ecx, edx
lea eax, [ebp - 0x54]
push ecx
push eax
lea ecx, [ebp - 0x78]
call fcn.1001d5b0
mov ecx, dword [0x100f6954]
mov dword [ebp - 4], 0xf
test ecx, ecx
je 0x1008c9c2
mov ecx, dword [ecx + 0x50]
jmp 0x1008c9c4
xor ecx, ecx
mov eax, dword [0x100f694c]
test eax, eax
je 0x1008c9d2
mov eax, dword [eax + 0x18]
jmp 0x1008c9d4
xor eax, eax
lea edx, [ebp - 0x78]
push edx
push ecx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.10025d70
mov esi, dword [ebp - 0x1c]
lea ecx, [ebp - 0x78]
add esp, 0x10
add esi, 0x24
call fcn.1001f960
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0
push eax
push 0x40
push 1
push esi
call edi
lea eax, [ebp - 0x18]
mov byte [esi], 0x75
push eax
push dword [ebp - 0x18]
push 1
push esi
call edi
mov byte [0x100f75d1], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100ae337
mov esp, ebp
pop ebp
ret