Function at 0x100ce640
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1018b469
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x101cd7b4]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x18], esi
mov dword [esi], 0x1019ba70
mov dword [esi + 4], 0x1019b9b0
mov dword [esi + 8], 0x1019b900
mov dword [esi + 0xc], 0x1019b8f8
mov dword [esi + 0x10], 0x1019b8f4
mov dword [esi + 0x14], 0x1019b8d0
mov dword [esi + 0x18], 0x1019b8cc
mov edi, dword [esi + 0x5a18]
xor ebx, ebx
cmp edi, ebx
mov dword [esp + 0x30], 0x5b
je 0x100ce6c7
mov ecx, edi
call fcn.100db8a0
push edi
call fcn.10159534
add esp, 4
mov ecx, dword [esi + 0x4ca0]
cmp ecx, ebx
je 0x100ce6d9
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
lea ecx, [esi + 0x5a00]
call fcn.100c2860
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
lea eax, [esi + 0x59dc]
push eax
mov dword [esi + 0x59d8], 0x10199604
call ebp
lea edi, [esi + 0x59cc]
mov dword [esi + 0x59d8], 0x10199600
mov eax, dword [edi + 4]
mov ecx, dword [eax]
push eax
push edi
push ecx
push edi
lea ecx, [esp + 0x2c]
push ecx
mov ecx, edi
mov byte [esp + 0x44], 0x58
call fcn.10009920
mov eax, dword [edi + 4]
push eax
call fcn.10159534
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov eax, dword [esi + 0x59ac]
mov ecx, dword [eax]
add esp, 4
lea edi, [esi + 0x59a8]
push eax
push edi
push ecx
push edi
lea edx, [esp + 0x2c]
push edx
mov ecx, edi
mov byte [esp + 0x44], 0x57
call fcn.10009920
mov eax, dword [edi + 4]
push eax
call fcn.10159534
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov eax, dword [esi + 0x5938]
mov ecx, dword [eax]
add esp, 4
lea edi, [esi + 0x5934]
push eax
push edi
push ecx
push edi
lea eax, [esp + 0x2c]
push eax
mov ecx, edi
mov byte [esp + 0x44], 0x56
call fcn.10052f70
mov eax, dword [edi + 4]
push eax
call fcn.10159534
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov eax, dword [esi + 0x592c]
mov ecx, dword [eax]
add esp, 4
lea edi, [esi + 0x5928]
push eax
push edi
push ecx
push edi
lea ecx, [esp + 0x2c]
push ecx
mov ecx, edi
mov byte [esp + 0x44], 0x55
call fcn.10009920
mov eax, dword [edi + 4]
push eax
call fcn.10159534
add esp, 4
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov byte [esp + 0x30], 0x54
mov eax, dword [esi + 0x5920]
mov ecx, dword [eax]
lea edi, [esi + 0x591c]
push eax
push edi
push ecx
push edi
lea edx, [esp + 0x2c]
push edx
mov ecx, edi
call fcn.10009920
mov eax, dword [edi + 4]
push eax
call fcn.10159534
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov eax, dword [esi + 0x5914]
mov ecx, dword [eax]
add esp, 4
lea edi, [esi + 0x5910]
push eax
push edi
push ecx
push edi
lea eax, [esp + 0x2c]
push eax
mov ecx, edi
mov byte [esp + 0x44], 0x53
call fcn.10009920
mov eax, dword [edi + 4]
push eax
call fcn.10159534
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov eax, dword [esi + 0x5908]
mov ecx, dword [eax]
add esp, 4
lea edi, [esi + 0x5904]
push eax
push edi
push ecx
push edi
lea ecx, [esp + 0x2c]
push ecx
mov ecx, edi
mov byte [esp + 0x44], 0x52
call fcn.1005c0d0
mov eax, dword [edi + 4]
push eax
call fcn.10159534
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov eax, dword [esi + 0x58fc]
mov ecx, dword [eax]
add esp, 4
lea edi, [esi + 0x58f8]
push eax
push edi
push ecx
push edi
lea edx, [esp + 0x2c]
push edx
mov ecx, edi
mov byte [esp + 0x44], 0x51
call fcn.10009920
mov eax, dword [edi + 4]
push eax
call fcn.10159534
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov eax, dword [esi + 0x58ec]
lea edi, [esi + 0x58e8]
add esp, 4
cmp eax, ebx
je 0x100ce8d8
mov edx, dword [esp + 0x18]
mov ecx, dword [edi + 8]
push edx
push edi
push ecx
push eax
call fcn.100af1a0
mov eax, dword [edi + 4]
push eax
call fcn.10159534
add esp, 0x14
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov eax, dword [esi + 0x58e0]
mov ecx, dword [eax]
lea edi, [esi + 0x58dc]
push eax
push edi
push ecx
push edi
lea eax, [esp + 0x2c]
push eax
mov ecx, edi
mov byte [esp + 0x44], 0x4f
call fcn.100d91d0
mov eax, dword [edi + 4]
push eax
call fcn.10159534
add esp, 4
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
cmp dword [esi + 0x58d8], 0x10
jb 0x100ce92e
mov eax, dword [esi + 0x58c4]
push eax
call fcn.10159534
add esp, 4
mov edi, 0xf
mov dword [esi + 0x58d8], edi
mov dword [esi + 0x58d4], ebx
mov byte [esi + 0x58c4], bl
cmp dword [esi + 0x58bc], 0x10
jb 0x100ce95d
mov eax, dword [esi + 0x58a8]
push eax
call fcn.10159534
add esp, 4
mov dword [esi + 0x58bc], edi
mov dword [esi + 0x58b8], ebx
mov byte [esi + 0x58a8], bl
cmp dword [esi + 0x58a0], 0x10
jb 0x100ce987
mov eax, dword [esi + 0x588c]
push eax
call fcn.10159534
add esp, 4
mov dword [esi + 0x58a0], edi
mov dword [esi + 0x589c], ebx
mov byte [esi + 0x588c], bl
cmp dword [esi + 0x5884], 0x10
jb 0x100ce9b1
mov eax, dword [esi + 0x5870]
push eax
call fcn.10159534
add esp, 4
mov dword [esi + 0x5884], edi
mov dword [esi + 0x5880], ebx
lea edi, [esi + 0x5860]
mov byte [esi + 0x5870], bl
mov eax, dword [edi + 4]
mov ecx, dword [eax]
push eax
push edi
push ecx
push edi
lea ecx, [esp + 0x2c]
push ecx
mov ecx, edi
mov byte [esp + 0x44], 0x4a
call fcn.10009ea0
mov eax, dword [edi + 4]
push eax
call fcn.10159534
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov eax, dword [esi + 0x584c]
mov ecx, dword [eax]
add esp, 4
lea edi, [esi + 0x5848]
push eax
push edi
push ecx
push edi
lea edx, [esp + 0x2c]
push edx
mov ecx, edi
mov byte [esp + 0x44], 0x49
call fcn.1002bbc0
mov eax, dword [edi + 4]
push eax
call fcn.10159534
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov eax, dword [esi + 0x5830]
lea edi, [esi + 0x582c]
add esp, 4
cmp eax, ebx
je 0x100cea56
mov edx, dword [esp + 0x18]
mov ecx, dword [edi + 8]
push edx
push edi
push ecx
push eax
call fcn.1002ab30
mov eax, dword [edi + 4]
push eax
call fcn.10159534
add esp, 0x14
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov eax, dword [esi + 0x5820]
cmp eax, ebx
lea edi, [esi + 0x581c]
je 0x100cea8b
mov edx, dword [esp + 0x18]
mov ecx, dword [edi + 8]
push edx
push edi
push ecx
push eax
call fcn.1002ab30
mov eax, dword [edi + 4]
push eax
call fcn.10159534
add esp, 0x14
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov eax, dword [esi + 0x5810]
cmp eax, ebx
lea edi, [esi + 0x580c]
je 0x100ceac0
mov edx, dword [esp + 0x18]
mov ecx, dword [edi + 8]
push edx
push edi
push ecx
push eax
call fcn.1002ab30
mov eax, dword [edi + 4]
push eax
call fcn.10159534
add esp, 0x14
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov eax, dword [esi + 0x57f8]
mov ecx, dword [eax]
lea edi, [esi + 0x57f4]
push eax
push edi
push ecx
push edi
lea eax, [esp + 0x2c]
push eax
mov ecx, edi
mov byte [esp + 0x44], 0x45
call fcn.10009ea0
mov eax, dword [edi + 4]
push eax
call fcn.10159534
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov eax, dword [esi + 0x57d8]
mov ecx, dword [eax]
add esp, 4
lea edi, [esi + 0x57d4]
push eax
push edi
push ecx
push edi
lea ecx, [esp + 0x2c]
push ecx
mov ecx, edi
mov byte [esp + 0x44], 0x44
call fcn.100bff10
mov eax, dword [edi + 4]
push eax
call fcn.10159534
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
lea edi, [esi + 0x5760]
add esp, 4
lea edx, [edi + 0x4c]
push edx
mov dword [edi + 0x48], 0x10199604
call ebp
mov ecx, edi
mov dword [edi + 0x48], 0x10199600
call fcn.1005ab80
lea edi, [esi + 0x56f8]
lea eax, [edi + 0x4c]
push eax
mov dword [edi + 0x48], 0x10199604
call ebp
mov ecx, edi
mov dword [edi + 0x48], 0x10199600
call fcn.1005ab80
lea ecx, [esi + 0x56bc]
mov byte [esp + 0x30], 0x41
call fcn.1013e751
lea ecx, [esi + 0x5578]
mov byte [esp + 0x30], 0x40
call fcn.100dee50
lea ecx, [esi + 0x5550]
mov byte [esp + 0x30], 0x3f
call fcn.100fc71c
mov eax, dword [esi + 0x5540]
mov ecx, dword [eax]
lea edi, [esi + 0x553c]
push eax
push edi
push ecx
push edi
lea ecx, [esp + 0x2c]
push ecx
mov ecx, edi
mov byte [esp + 0x44], 0x3e
call fcn.100db4e0
mov eax, dword [edi + 4]
push eax
call fcn.10159534
add esp, 4
mov dword [edi + 4], ebx
lea ecx, [esi + 0x5508]
mov dword [edi + 8], ebx
mov byte [esp + 0x30], 0x3d
call fcn.10041840
mov eax, dword [esi + 0x54f8]
mov ecx, dword [eax]
lea edi, [esi + 0x54f4]
push eax
push edi
push ecx
push edi
lea edx, [esp + 0x2c]
push edx
mov ecx, edi
mov byte [esp + 0x44], 0x3c
call fcn.100b50a0
mov eax, dword [edi + 4]
push eax
call fcn.10159534
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov eax, dword [esi + 0x54ec]
mov ecx, dword [eax]
add esp, 4
lea edi, [esi + 0x54e8]
push eax
push edi
push ecx
push edi
lea eax, [esp + 0x2c]
push eax
mov ecx, edi
mov byte [esp + 0x44], 0x3b
call fcn.100cb210
mov eax, dword [edi + 4]
push eax
call fcn.10159534
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov eax, dword [esi + 0x54e0]
mov ecx, dword [eax]
add esp, 4
lea edi, [esi + 0x54dc]
push eax
push edi
push ecx
push edi
lea ecx, [esp + 0x2c]
push ecx
mov ecx, edi
mov byte [esp + 0x44], 0x3a
call fcn.100c48a0
mov eax, dword [edi + 4]
push eax
call fcn.10159534
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
add esp, 4
lea edx, [esi + 0x54c4]
mov edi, 0x10199604
push edx
mov dword [esi + 0x54c0], edi
call ebp
mov dword [esi + 0x54c0], 0x10199600
cmp dword [esi + 0x54b4], 0x10
jb 0x100cecbf
mov eax, dword [esi + 0x54a0]
push eax
call fcn.10159534
add esp, 4
mov dword [esi + 0x54b4], 0xf
mov dword [esi + 0x54b0], ebx
mov byte [esi + 0x54a0], bl
mov eax, dword [esi + 0x5474]
cmp eax, ebx
je 0x100cece8
push eax
call fcn.10159534
add esp, 4
lea eax, [esi + 0x5458]
mov dword [esi + 0x5474], ebx
mov dword [esi + 0x5478], ebx
mov dword [esi + 0x547c], ebx
push eax
mov dword [esi + 0x5454], edi
call ebp
mov dword [esi + 0x5454], 0x10199600
mov eax, dword [esi + 0x5448]
cmp eax, ebx
je 0x100ced26
push eax
call fcn.10159534
add esp, 4
lea ecx, [esi + 0x542c]
mov dword [esi + 0x5448], ebx
mov dword [esi + 0x544c], ebx
mov dword [esi + 0x5450], ebx
push ecx
mov dword [esi + 0x5428], edi
call ebp
lea ecx, [esi + 0x53e8]
mov dword [esi + 0x5428], 0x10199600
mov byte [esp + 0x30], 0x33
call fcn.100da490
cmp dword [esi + 0x53d8], 0x10
jb 0x100ced79
mov eax, dword [esi + 0x53c4]
push eax
call fcn.10159534
add esp, 4
mov dword [esi + 0x53d8], 0xf
mov dword [esi + 0x53d4], ebx
mov byte [esi + 0x53c4], bl
mov eax, dword [esi + 0x53b4]
cmp eax, ebx
je 0x100ceda2
push eax
call fcn.10159534
add esp, 4
lea ecx, [esi + 0x5380]
mov dword [esi + 0x53b4], ebx
mov dword [esi + 0x53b8], ebx
mov dword [esi + 0x53bc], ebx
mov byte [esp + 0x30], 0x30
call fcn.100a40f0
mov eax, dword [esi + 0x5374]
cmp eax, ebx
je 0x100cedd7
push eax
call fcn.10159534
add esp, 4
lea ecx, [esi + 0x5344]
mov dword [esi + 0x5374], ebx
mov dword [esi + 0x5378], ebx
mov dword [esi + 0x537c], ebx
mov byte [esp + 0x30], 0x2e
call fcn.100b5660
lea edx, [esi + 0x532c]
push edx
mov dword [esi + 0x5328], edi
call ebp
lea eax, [esi + 0x530c]
mov dword [esi + 0x5328], 0x10199600
push eax
mov dword [esi + 0x5308], edi
call ebp
lea edi, [esi + 0x52fc]
mov dword [esi + 0x5308], 0x10199600
mov eax, dword [edi + 4]
mov ecx, dword [eax]
push eax
push edi
push ecx
push edi
lea ecx, [esp + 0x2c]
push ecx
mov ecx, edi
mov byte [esp + 0x44], 0x2b
call fcn.100b4fd0
mov eax, dword [edi + 4]
push eax
call fcn.10159534
add esp, 4
lea ecx, [esi + 0x52f8]
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov byte [esp + 0x30], 0x2a
call fcn.100dde10
lea ecx, [esi + 0x5260]
mov byte [esp + 0x30], 0x29
call fcn.1002c570
lea ecx, [esi + 0x5234]
mov byte [esp + 0x30], 0x28
call fcn.100a3db0
lea edx, [esi + 0x5214]
mov edi, 0x10199604
push edx
mov dword [esi + 0x5210], edi
call ebp
lea ecx, [esi + 0x51ec]
mov dword [esi + 0x5210], 0x10199600
call fcn.100ba0b0
lea ecx, [esi + 0x5198]
call fcn.100bd6f0
lea eax, [esi + 0x5174]
push eax
mov dword [esi + 0x5170], edi
call ebp
mov dword [esi + 0x5170], 0x10199600
mov eax, dword [esi + 0x5150]
cmp eax, ebx
je 0x100ceeed
push eax
call fcn.10159534
add esp, 4
lea ecx, [esi + 0x50f8]
mov dword [esi + 0x5150], ebx
mov dword [esi + 0x5154], ebx
mov dword [esi + 0x5158], ebx
mov byte [esp + 0x30], 0x24
call fcn.100ce5e0
lea ecx, [esi + 0x50d4]
push ecx
mov dword [esi + 0x50d0], edi
call ebp
lea ecx, [esi + 0x50ac]
mov dword [esi + 0x50d0], 0x10199600
call fcn.100b9f90
lea ecx, [esi + 0x5058]
call fcn.100cb600
lea ecx, [esi + 0x5010]
call fcn.100c1fd0
lea edx, [esi + 0x4ff4]
push edx
mov dword [esi + 0x4ff0], edi
call ebp
lea ecx, [esi + 0x4fcc]
mov dword [esi + 0x4ff0], 0x10199600
call fcn.100bc580
lea eax, [esi + 0x4fac]
push eax
mov dword [esi + 0x4fa8], edi
call ebp
lea ecx, [esi + 0x4f84]
mov dword [esi + 0x4fa8], 0x10199600
call fcn.100c64d0
lea ecx, [esi + 0x4f64]
push ecx
mov dword [esi + 0x4f60], edi
call ebp
lea edi, [esi + 0x4f54]
mov dword [esi + 0x4f60], 0x10199600
mov eax, dword [edi + 4]
mov ecx, dword [eax]
push eax
push edi
push ecx
push edi
lea edx, [esp + 0x2c]
push edx
mov ecx, edi
mov byte [esp + 0x44], 0x1d
call fcn.100ba460
mov eax, dword [edi + 4]
push eax
call fcn.10159534
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov edi, 0x10
add esp, 4
cmp dword [esi + 0x4f20], edi
jb 0x100ceff8
mov eax, dword [esi + 0x4f0c]
push eax
call fcn.10159534
add esp, 4
mov dword [esi + 0x4f20], 0xf
mov dword [esi + 0x4f1c], ebx
mov byte [esi + 0x4f0c], bl
cmp dword [esi + 0x4efc], edi
jb 0x100cf025
mov eax, dword [esi + 0x4ee8]
push eax
call fcn.10159534
add esp, 4
mov dword [esi + 0x4efc], 0xf
mov dword [esi + 0x4ef8], ebx
mov byte [esi + 0x4ee8], bl
cmp dword [esi + 0x4ed8], edi
jb 0x100cf052
mov eax, dword [esi + 0x4ec4]
push eax
call fcn.10159534
add esp, 4
mov dword [esi + 0x4ed8], 0xf
mov dword [esi + 0x4ed4], ebx
mov byte [esi + 0x4ec4], bl
cmp dword [esi + 0x4ebc], edi
jb 0x100cf07f
mov eax, dword [esi + 0x4ea8]
push eax
call fcn.10159534
add esp, 4
mov dword [esi + 0x4ebc], 0xf
mov dword [esi + 0x4eb8], ebx
mov byte [esi + 0x4ea8], bl
cmp dword [esi + 0x4ea0], edi
jb 0x100cf0ac
mov eax, dword [esi + 0x4e8c]
push eax
call fcn.10159534
add esp, 4
mov dword [esi + 0x4ea0], 0xf
mov dword [esi + 0x4e9c], ebx
mov byte [esi + 0x4e8c], bl
cmp dword [esi + 0x4e7c], edi
jb 0x100cf0d9
mov eax, dword [esi + 0x4e68]
push eax
call fcn.10159534
add esp, 4
mov dword [esi + 0x4e7c], 0xf
mov dword [esi + 0x4e78], ebx
mov byte [esi + 0x4e68], bl
cmp dword [esi + 0x4e58], edi
jb 0x100cf106
mov eax, dword [esi + 0x4e44]
push eax
call fcn.10159534
add esp, 4
mov dword [esi + 0x4e58], 0xf
mov dword [esi + 0x4e54], ebx
mov byte [esi + 0x4e44], bl
cmp dword [esi + 0x4e34], edi
jb 0x100cf133
mov eax, dword [esi + 0x4e20]
push eax
call fcn.10159534
add esp, 4
mov dword [esi + 0x4e34], 0xf
mov dword [esi + 0x4e30], ebx
lea ecx, [esi + 0x4e04]
mov byte [esi + 0x4e20], bl
call fcn.1002bf30
cmp dword [esi + 0x4df8], edi
jb 0x100cf16b
mov eax, dword [esi + 0x4de4]
push eax
call fcn.10159534
add esp, 4
mov dword [esi + 0x4df8], 0xf
mov dword [esi + 0x4df4], ebx
mov byte [esi + 0x4de4], bl
cmp dword [esi + 0x4dd4], edi
jb 0x100cf198
mov eax, dword [esi + 0x4dc0]
push eax
call fcn.10159534
add esp, 4
mov dword [esi + 0x4dd4], 0xf
mov dword [esi + 0x4dd0], ebx
mov byte [esi + 0x4dc0], bl
cmp dword [esi + 0x4db0], edi
jb 0x100cf1c5
mov eax, dword [esi + 0x4d9c]
push eax
call fcn.10159534
add esp, 4
mov dword [esi + 0x4db0], 0xf
mov dword [esi + 0x4dac], ebx
lea ecx, [esi + 0x4d6c]
mov byte [esi + 0x4d9c], bl
call fcn.1002e3d0
mov eax, dword [esi + 0x4d68]
push eax
mov dword [esi + 0x4d64], 0x1019a1a0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, 0x10199600
lea ecx, [esi + 0x4d38]
mov dword [esi + 0x4d64], edi
mov byte [esp + 0x30], 0xe
call fcn.100b5660
lea ecx, [esi + 0x4cf0]
call fcn.100a8630
lea ecx, [esi + 0x4ca4]
call fcn.100b9d80
lea ecx, [esi + 0x4c68]
mov byte [esp + 0x30], 0xb
call fcn.100d67a0
lea ecx, [esi + 0x4c38]
mov byte [esp + 0x30], 0xa
call fcn.100dd090
lea ecx, [esi + 0x4bf0]
mov byte [esp + 0x30], 9
call fcn.10055480
lea ecx, [esi + 0x4ba8]
mov byte [esp + 0x30], 8
call fcn.10055480
lea ecx, [esi + 0x4b60]
mov byte [esp + 0x30], 7
call fcn.10055480
lea ecx, [esi + 0x60]
mov byte [esp + 0x30], 6
call fcn.100c1f90
lea ecx, [esi + 0x48]
push ecx
mov dword [esi + 0x44], 0x10199604
call ebp
mov dword [esi + 0x44], edi
lea ecx, [esi + 0x34]
mov dword [esi + 0x40], 0x1019b380
mov byte [esp + 0x30], 3
call fcn.100d95a0
lea ecx, [esi + 0x28]
mov byte [esp + 0x30], 2
call fcn.100d95a0
lea ecx, [esi + 0x1c]
mov byte [esp + 0x30], 1
call fcn.100d95a0
lea ecx, [esi + 4]
mov byte [esp + 0x30], bl
call fcn.10028820
mov dword [esi], 0x1019b2e0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret