Function at 0x100bae80
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x144], ebx
mov dword [ebp - 0xcc], edi
mov dword [ebp - 0x110], 0
call fcn.100d05a0
push 0x24
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
je 0x100baedb
lea ecx, [edi + 0x12c]
push ecx
lea ecx, [edi + 0x124]
push ecx
mov ecx, eax
call fcn.10067c80
jmp 0x100baedd
xor eax, eax
push dword [ebp - 0x10c]
lea ecx, [ebp - 0x124]
mov dword [ebp - 0x124], 0
push eax
mov dword [ebp - 0x120], 0
call fcn.100b74f0
mov eax, dword [ebp - 0x124]
mov dword [edi + 0x11c], eax
mov esi, dword [edi + 0x120]
mov eax, dword [ebp - 0x120]
mov dword [edi + 0x120], eax
test esi, esi
je 0x100baf46
or eax, 0xffffffff
lock xadd dword [esi + 4], eax
jne 0x100baf46
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
jne 0x100baf46
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov dword [ebp - 0x140], 0
test ebx, ebx
je 0x100baf74
movzx eax, byte [edi + 0xf8]
mov ecx, edi
push 1
push eax
call fcn.100c2680
push eax
call fcn.100c4380
add esp, 0xc
mov dword [ebp - 0x140], eax
push 0x60
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
je 0x100baf9e
movzx ecx, byte [edi + 0xf8]
push 1
push dword [edi + 0xc4]
push ecx
push dword [edi + 4]
mov ecx, eax
call fcn.100b8ae0
jmp 0x100bafa0
xor eax, eax
push dword [ebp - 0x10c]
lea ecx, [ebp - 0x124]
mov dword [ebp - 0x124], 0
push eax
mov dword [ebp - 0x120], 0
call fcn.100b7310
mov eax, dword [ebp - 0x124]
mov dword [edi + 0xbc], eax
mov esi, dword [edi + 0xc0]
mov eax, dword [ebp - 0x120]
mov dword [edi + 0xc0], eax
test esi, esi
je 0x100bb009
or eax, 0xffffffff
lock xadd dword [esi + 4], eax
jne 0x100bb009
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
jne 0x100bb009
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
cmp dword [edi + 0xbc], 0
je 0x100bc5ff
push 8
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x100bb054
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov eax, dword [edi + 0xc0]
test eax, eax
je 0x100bb041
lock inc dword [eax + 4]
mov eax, dword [edi + 0xbc]
mov dword [ecx], eax
mov eax, dword [edi + 0xc0]
mov dword [ecx + 4], eax
jmp 0x100bb056
xor ecx, ecx
push 0
push 0
push ecx
push 0x100c3930
push 0
push 0
call sub.msvcrt.dll__beginthreadex
add esp, 0x18
mov dword [ebp - 0x148], eax
test eax, eax
je 0x100bc5ff
push 0x38
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
je 0x100bb098
lea ecx, [edi + 0x124]
push ecx
mov ecx, eax
call fcn.100b8f60
jmp 0x100bb09a
xor eax, eax
mov ecx, dword [edi + 0xbc]
push eax
add ecx, 0x54
call fcn.100b7bd0
push 8
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x100bb0e7
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov eax, dword [edi + 0xc0]
test eax, eax
je 0x100bb0d4
lock inc dword [eax + 4]
mov eax, dword [edi + 0xbc]
mov dword [ecx], eax
mov eax, dword [edi + 0xc0]
mov dword [ecx + 4], eax
jmp 0x100bb0e9
xor ecx, ecx
push 0
push 0
push ecx
push 0x100c39d0
push 0
push 0
call sub.msvcrt.dll__beginthreadex
mov ecx, dword [edi + 0xbc]
add esp, 0x18
mov dword [ebp - 0x14c], eax
push dword [ecx + 0x30]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0x14
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
je 0x100bb12e
push dword [edi + 4]
mov ecx, eax
call fcn.10154620
jmp 0x100bb130
xor eax, eax
push dword [ebp - 0x10c]
lea ecx, [ebp - 0x124]
mov dword [ebp - 0x124], 0
push eax
mov dword [ebp - 0x120], 0
call fcn.100b76d0
xor eax, eax
mov dword [ebp - 0x128], eax
mov edi, edi
mov edi, dword [edi + 0xbc]
lea esi, [edi + 0x10]
test esi, esi
je 0x100bb174
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [edi + 0xc], 0
jne 0x100bb1a0
xor ebx, ebx
mov dword [ebp - 0x134], 0
mov dword [ebp - 0xf0], ebx
test esi, esi
je 0x100bb23d
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x100bb23d
mov eax, dword [edi + 8]
mov eax, dword [eax]
mov ebx, dword [eax + 0xc]
mov dword [ebp - 0xf0], ebx
test ebx, ebx
je 0x100bb1bf
lock inc dword [ebx + 4]
mov ebx, dword [eax + 0xc]
mov dword [ebp - 0xf0], ebx
mov ecx, dword [eax + 8]
mov eax, dword [edi + 8]
mov dword [ebp - 0x114], ecx
mov ebx, dword [eax]
mov ecx, dword [ebx + 4]
mov eax, dword [ebx]
mov dword [ecx], eax
mov ecx, dword [ebx]
mov eax, dword [ebx + 4]
mov dword [ecx + 4], eax
dec dword [edi + 0xc]
mov edi, dword [ebx + 0xc]
test edi, edi
je 0x100bb207
or eax, 0xffffffff
lock xadd dword [edi + 4], eax
jne 0x100bb207
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
or eax, 0xffffffff
lock xadd dword [edi + 8], eax
jne 0x100bb207
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
push 0x10
push ebx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
mov edi, dword [ebp - 0x114]
add esp, 8
mov ebx, dword [ebp - 0xf0]
mov dword [ebp - 0x134], edi
mov dword [ebp - 0x130], ebx
test esi, esi
je 0x100bb235
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
jne 0x100bb2f6
push 0
push dword [ebp - 0x148]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x100bbd10
mov edx, dword [ebp - 0xcc]
mov edi, dword [edx + 0xbc]
lea esi, [edi + 0x10]
test esi, esi
je 0x100bb26d
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [edi + 0xc]
test esi, esi
je 0x100bb27b
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
jne 0x100bbd10
test ebx, ebx
je 0x100bb2a8
or eax, 0xffffffff
lock xadd dword [ebx + 4], eax
jne 0x100bb2a8
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax]
or eax, 0xffffffff
lock xadd dword [ebx + 8], eax
jne 0x100bb2a8
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 4]
mov ebx, dword [ebp - 0xcc]
mov eax, dword [ebx + 0xbc]
mov byte [eax + 0x34], 1
mov eax, dword [ebp - 0x14c]
test eax, eax
jne 0x100bbdd9
push dword [ebp - 0x148]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x124]
call fcn.10033270
mov eax, dword [ebp - 0x128]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 0xd4]
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x104], 0
mov dword [ebp - 0x100], 0
mov dword [ebp - 0xfc], 0
mov dword [ebp - 0xf8], 0
mov dword [ebp - 0xf4], 0
mov dword [ebp - 0xd4], 0
mov dword [ebp - 0xd0], 0
call fcn.100270a0
mov esi, dword [ebp - 0xcc]
mov dword [ebp - 0xd4], eax
lea eax, [ebp - 0xd4]
push eax
mov ecx, dword [esi + 0x11c]
call fcn.10067d70
call fcn.10002d70
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
add eax, 0x10
lea ecx, [ebp - 0xdc]
push 0x10202940
mov dword [ebp - 0xdc], eax
call fcn.10023e80
test al, al
jne 0x100bb3aa
push 0
push 0x10202940
lea ecx, [ebp - 0xdc]
call fcn.10003740
cmp byte [edi + 0xdd], 0
je 0x100bb516
push dword [edi + 0xe4]
lea eax, [ebp - 0x13c]
mov ecx, esi
push eax
call fcn.100c2a00
mov esi, dword [ebp - 0x13c]
test esi, esi
je 0x100bb46a
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
test eax, eax
je 0x100bb46a
mov eax, dword [esi + 0xc]
cmp eax, dword [esi + 0x10]
je 0x100bb40b
push dword [ebp - 0x10c]
lea ecx, [ebp - 0x108]
push dword [esi + 0x10]
push eax
push dword [ebp - 0x104]
call fcn.1009d270
mov eax, dword [esi + 0x18]
cmp eax, dword [esi + 0x1c]
je 0x100bb42e
push dword [ebp - 0x10c]
lea ecx, [ebp - 0xfc]
push dword [esi + 0x1c]
push eax
push dword [ebp - 0xf8]
call fcn.1009d270
mov esi, dword [ebp - 0x138]
test esi, esi
je 0x100bb855
or eax, 0xffffffff
lock xadd dword [esi + 4], eax
jne 0x100bb855
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
jne 0x100bb855
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
jmp 0x100bb855
mov esi, dword [ebp - 0x138]
test esi, esi
je 0x100bb495
or eax, 0xffffffff
lock xadd dword [esi + 4], eax
jne 0x100bb495
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
jne 0x100bb495
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov edx, dword [ebp - 0xdc]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100bb4b3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0xd4]
lea ecx, [ebp - 0xd4]
push dword [esi + 4]
call fcn.100c22d0
mov eax, dword [ebp - 0xd4]
push 0x1c
mov dword [eax + 4], esi
mov eax, dword [ebp - 0xd4]
mov dword [eax], esi
mov eax, dword [ebp - 0xd4]
mov dword [eax + 8], esi
push dword [ebp - 0xd4]
mov dword [ebp - 0xd0], 0
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 8
lea ecx, [ebp - 0xfc]
call fcn.1002a3c0
lea ecx, [ebp - 0x108]
call fcn.1002a3c0
jmp 0x100bbd16
push 0
push 0
lea ecx, [ebp - 0xec]
mov dword [ebp - 0xec], 0
mov dword [ebp - 0xe8], 0
call fcn.100273b0
push 0
push 0
lea ecx, [ebp - 0xe4]
mov dword [ebp - 0xec], eax
mov dword [ebp - 0xe4], 0
mov dword [ebp - 0xe0], 0
call fcn.100273b0
push 1
sub esp, 8
mov dword [ebp - 0xe4], eax
mov ecx, esp
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov eax, dword [esi + 0x120]
test eax, eax
je 0x100bb58a
lock inc dword [eax + 4]
mov eax, dword [esi + 0x11c]
mov dword [ecx], eax
mov eax, dword [esi + 0x120]
mov dword [ecx + 4], eax
lea eax, [ebp - 0xdc]
mov ecx, dword [ebp - 0x120]
push eax
lea eax, [ebp - 0xe4]
push eax
lea eax, [ebp - 0xec]
push eax
sub esp, 8
mov eax, esp
mov dword [eax], 0
mov dword [eax + 4], 0
test ecx, ecx
je 0x100bb5d0
lock inc dword [ecx + 4]
mov edx, dword [ebp - 0x124]
mov dword [eax + 4], ecx
mov ecx, edi
mov dword [eax], edx
call fcn.10037d30
test al, al
jne 0x100bb6b2
lea ecx, [ebp - 0xe4]
call fcn.1002a820
push 0x20
push dword [ebp - 0xe4]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 8
lea ecx, [ebp - 0xec]
call fcn.1002a820
push 0x20
push dword [ebp - 0xec]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
mov edx, dword [ebp - 0xdc]
add esp, 8
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100bb63e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0xd4]
lea ecx, [ebp - 0xd4]
push dword [esi + 4]
call fcn.100c22d0
mov eax, dword [ebp - 0xd4]
push 0x1c
mov dword [eax + 4], esi
mov eax, dword [ebp - 0xd4]
mov dword [eax], esi
mov eax, dword [ebp - 0xd4]
mov dword [eax + 8], esi
push dword [ebp - 0xd4]
mov dword [ebp - 0xd0], 0
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 8
lea ecx, [ebp - 0xfc]
call fcn.1002a3c0
lea ecx, [ebp - 0x108]
call fcn.1002a3c0
lea ecx, [ebp - 0x134]
call fcn.10033270
mov edi, dword [ebp - 0xcc]
jmp 0x100bb160
cmp byte [edi + 0xe0], 0
mov cl, byte [edi + 0xdf]
jne 0x100bbd52
test cl, cl
jne 0x100bbd52
mov eax, dword [ebp - 0xec]
mov esi, dword [eax]
cmp esi, eax
je 0x100bb75a
lea ecx, [ecx]
cmp dword [esi + 0x1c], 8
lea eax, [esi + 8]
jb 0x100bb6eb
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x12c]
call fcn.10002490
mov ebx, dword [ebp - 0x104]
mov edi, dword [ebp - 0x12c]
cmp dword [ebp - 0x100], ebx
je 0x100bb725
lea eax, [edi - 0x10]
push eax
call fcn.10002a60
add eax, 0x10
add esp, 4
mov dword [ebx], eax
add dword [ebp - 0x104], 4
jmp 0x100bb738
lea eax, [ebp - 0x12c]
push eax
push ebx
lea ecx, [ebp - 0x108]
call fcn.1001ddd0
add edi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x100bb750
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [esi]
cmp esi, dword [ebp - 0xec]
jne 0x100bb6e0
mov eax, dword [ebp - 0xe4]
mov esi, dword [eax]
cmp esi, eax
je 0x100bb813
lea ebx, [ebx]
cmp dword [esi + 0x1c], 8
lea edi, [esi + 8]
jb 0x100bb77b
mov edi, dword [edi]
call fcn.10002d70
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
add eax, 0x10
lea ecx, [ebp - 0xd8]
push edi
mov dword [ebp - 0xd8], eax
call fcn.10023e80
test al, al
jne 0x100bb7ac
push edi
lea ecx, [ebp - 0xd8]
call fcn.10008170
mov ebx, dword [ebp - 0xf8]
mov edi, dword [ebp - 0xd8]
cmp dword [ebp - 0xf4], ebx
je 0x100bb7da
lea eax, [edi - 0x10]
push eax
call fcn.10002a60
add eax, 0x10
add esp, 4
mov dword [ebx], eax
add dword [ebp - 0xf8], 4
jmp 0x100bb7ed
lea eax, [ebp - 0xd8]
push eax
push ebx
lea ecx, [ebp - 0xfc]
call fcn.1001ddd0
add edi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x100bb805
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [esi]
cmp esi, dword [ebp - 0xe4]
jne 0x100bb770
lea ecx, [ebp - 0xe4]
call fcn.1002a820
push 0x20
push dword [ebp - 0xe4]
call fcn.1001da10
add esp, 8
lea ecx, [ebp - 0xec]
call fcn.1002a820
push 0x20
push dword [ebp - 0xec]
call fcn.1001da10
mov ebx, dword [ebp - 0xf0]
add esp, 8
mov edi, dword [ebp - 0x114]
mov ecx, dword [edi + 0xe4]
mov edi, dword [ebp - 0xcc]
mov dword [ebp - 0x11c], ecx
mov edx, dword [edi + 0xc8]
mov esi, edx
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x100bb895
cmp dword [eax + 0x10], ecx
jae 0x100bb882
mov eax, dword [eax + 8]
jmp 0x100bb886
mov esi, eax
mov eax, dword [eax]
cmp byte [eax + 0xd], 0
je 0x100bb878
cmp esi, edx
je 0x100bb895
cmp ecx, dword [esi + 0x10]
jae 0x100bb8dd
lea eax, [ebp - 0x11c]
mov dword [ebp - 0xd8], eax
lea ecx, [edi + 0xc8]
lea eax, [ebp - 0x115]
push eax
lea eax, [ebp - 0xd8]
push eax
push 0x1020f724
call fcn.100b5a90
push eax
add eax, 0x10
lea ecx, [edi + 0xc8]
push eax
push esi
lea eax, [ebp - 0x10c]
push eax
call fcn.100b65d0
mov esi, dword [ebp - 0x10c]
test ebx, ebx
je 0x100bb8e5
lock inc dword [ebx + 4]
mov ecx, dword [ebp - 0x114]
mov dword [esi + 0x14], ecx
mov edi, dword [esi + 0x18]
mov dword [esi + 0x18], ebx
test edi, edi
je 0x100bb919
or eax, 0xffffffff
lock xadd dword [edi + 4], eax
jne 0x100bb919
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
or eax, 0xffffffff
lock xadd dword [edi + 8], eax
jne 0x100bb919
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
mov esi, dword [ebp - 0xd4]
lea ecx, [ebp - 0xd4]
push dword [esi + 4]
call fcn.100c22d0
mov eax, dword [ebp - 0xd4]
mov edi, dword [ebp - 0xcc]
mov ecx, edi
mov dword [eax + 4], esi
mov eax, dword [ebp - 0xd4]
mov dword [eax], esi
mov eax, dword [ebp - 0xd4]
mov dword [eax + 8], esi
mov eax, dword [edi]
push dword [ebp - 0x11c]
mov dword [ebp - 0xd0], 0
call dword [eax + 0x14]
test eax, eax
je 0x100bb9ed
mov edx, dword [ebp - 0xdc]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100bb98a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0xd4]
lea ecx, [ebp - 0xd4]
push dword [esi + 4]
call fcn.100c22d0
mov eax, dword [ebp - 0xd4]
push 0x1c
mov dword [eax + 4], esi
mov eax, dword [ebp - 0xd4]
mov dword [eax], esi
mov eax, dword [ebp - 0xd4]
mov dword [eax + 8], esi
push dword [ebp - 0xd4]
mov dword [ebp - 0xd0], 0
call fcn.1001da10
add esp, 8
lea ecx, [ebp - 0xfc]
call fcn.1002a3c0
lea ecx, [ebp - 0x108]
call fcn.1002a3c0
jmp 0x100bbd1c
xor eax, eax
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x18], 7
cmp eax, dword [ebp - 0x104]
je 0x100bba2f
mov edx, dword [eax]
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100bba16
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x2c]
call fcn.100070c0
mov eax, dword [ebp - 0xfc]
cmp eax, dword [ebp - 0xf8]
je 0x100bba5d
mov edx, dword [eax]
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100bba44
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x2c]
call fcn.10006d70
mov ebx, dword [ebp - 0x114]
cmp dword [ebx + 0x58], 8
lea edi, [ebx + 0x44]
mov eax, edi
jb 0x100bba70
mov eax, dword [edi]
push dword [edi + 0x10]
lea ecx, [ebp - 0x2c]
push eax
call fcn.10006d70
cmp dword [ebx + 0x88], 8
lea ecx, [ebx + 0x74]
jb 0x100bba8b
mov ecx, dword [ebx + 0x74]
push dword [ebx + 0x84]
push ecx
lea ecx, [ebp - 0x2c]
call fcn.10006d70
cmp dword [0x1023fe04], 0
je 0x100bbadc
or dword [ebp - 0x110], 1
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], 8
jb 0x100bbab6
mov eax, dword [ebp - 0x2c]
push dword [0x1023fe00]
lea ecx, [ebp - 0xc4]
mov dword [ebp - 0xc8], ecx
lea ecx, [ebp - 0xc8]
push eax
call fcn.100bcf60
mov eax, dword [ebp - 0xc8]
jmp 0x100bbae1
mov eax, 0x10202a60
lea ecx, [ebp - 0x14]
push ecx
push eax
call fcn.10006810
mov eax, dword [ebp - 0x110]
add esp, 8
test al, 1
je 0x100bbb1a
and eax, 0xfffffffe
lea ecx, [ebp - 0xc4]
mov dword [ebp - 0x110], eax
mov eax, dword [ebp - 0xc8]
cmp eax, ecx
je 0x100bbb1a
push eax
call sub.msvcrt.dll_free
add esp, 4
push 0x10
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.10005ff0
add esp, 0xc
cmp dword [ebx + 0x114], 0
je 0x100bbb3c
mov eax, 4
jmp 0x100bbb6c
mov dl, byte [ebx + 0xe8]
cmp dl, 1
jne 0x100bbb4e
mov eax, 1
jmp 0x100bbb6c
mov cl, byte [ebx + 0xf5]
xor eax, eax
test cl, cl
jne 0x100bbb62
cmp dl, 2
setne al
jmp 0x100bbb65
setle al
lea eax, [eax*2 + 2]
cmp dword [edi + 0x14], 8
mov esi, edi
jb 0x100bbb76
mov esi, dword [edi]
push eax
push ecx
mov ebx, esp
call fcn.10002d70
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
add eax, 0x10
mov ecx, ebx
push esi
mov dword [ebx], eax
call fcn.10023e80
test al, al
jne 0x100bbb9f
push esi
mov ecx, ebx
call fcn.10008170
cmp dword [ebp - 0x30], 0x10
lea ebx, [ebp - 0x44]
mov ecx, dword [ebp - 0x114]
movsx eax, byte [ecx + 0xf5]
mov dword [ebp - 0xd8], eax
jb 0x100bbbbe
mov ebx, dword [ebp - 0x44]
mov edx, dword [ebp - 0xcc]
mov esi, dword [ecx + 0xe4]
push ecx
push esp
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0x1c]
push dword [ebp - 0xd8]
push ebx
push esi
call fcn.101b6310
add esp, 0x18
test eax, eax
jne 0x100bbc95
mov ecx, dword [ebp - 0x114]
cmp byte [ecx + 0xdc], al
setne al
cmp byte [ecx + 0xdd], 0
je 0x100bbc05
or al, 2
cmp byte [ecx + 0xde], 0
jne 0x100bbc10
or al, 4
cmp byte [ecx + 0xdf], 0
je 0x100bbc1b
or al, 8
cmp byte [ecx + 0xe0], 0
je 0x100bbc26
or al, 0x20
cmp byte [ecx + 0xe1], 0
je 0x100bbc31
or al, 0x10
cmp byte [ecx + 0xf6], 0
je 0x100bbc3c
or al, 0x40
cmp byte [ecx + 0xf7], 0
je 0x100bbc47
or al, 0x80
test al, al
js 0x100bbc57
cmp dword [ebp - 0x11c], 0x11170
jb 0x100bbc95
lea ecx, [ebp - 0x44]
call fcn.1000c070
lea ecx, [ebp - 0x2c]
call fcn.10005250
mov edx, dword [ebp - 0xdc]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100bbc85
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0xd4]
call fcn.100b9360
jmp 0x100bb686
mov ecx, dword [ebp - 0x128]
mov edx, dword [ebp - 0x144]
inc ecx
mov dword [ebp - 0x128], ecx
test edx, edx
je 0x100bbcc1
cmp dword [edi + 0x14], 8
jb 0x100bbcb4
mov edi, dword [edi]
mov eax, dword [edx]
push edi
push dword [ebp - 0x140]
push ecx
push edx
call dword [eax]
lea ecx, [ebp - 0x44]
call fcn.1000c070
lea ecx, [ebp - 0x2c]
call fcn.10005250
mov edx, dword [ebp - 0xdc]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100bbcef
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0xd4]
call fcn.100b9360
lea ecx, [ebp - 0xfc]
call fcn.1002a3c0
lea ecx, [ebp - 0x108]
call fcn.1002a3c0
mov ebx, dword [ebp - 0xf0]
mov edi, dword [ebp - 0xcc]
test ebx, ebx
je 0x100bb160
or eax, 0xffffffff
lock xadd dword [ebx + 4], eax
jne 0x100bb160
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax]
or eax, 0xffffffff
lock xadd dword [ebx + 8], eax
jne 0x100bb160
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 4]
jmp 0x100bb160
lea ecx, [ebp - 0xe4]
call fcn.1002a820
push 0x20
push dword [ebp - 0xe4]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 8
lea ecx, [ebp - 0xec]
call fcn.1002a820
push 0x20
push dword [ebp - 0xec]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
mov edx, dword [ebp - 0xdc]
add esp, 8
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100bbda6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0xd4]
call fcn.100b9360
lea ecx, [ebp - 0xfc]
call fcn.1002a3c0
lea ecx, [ebp - 0x108]
call fcn.1002a3c0
lea ecx, [ebp - 0x134]
call fcn.10033270
mov edi, esi
jmp 0x100bb160
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x3e8
push eax
call edi
mov ecx, dword [ebx + 0x11c]
push 0
call fcn.10067d70
push 0xffffffffffffffff
push dword [ebp - 0x14c]
call edi
test eax, eax
jne 0x100bbe18
mov eax, dword [ebx + 0xbc]
mov ecx, dword [eax + 0x54]
call fcn.100c4600
test al, al
jne 0x100bc5c5
mov ecx, dword [ebx + 0xbc]
lea eax, [ebp - 0xe4]
push eax
mov ecx, dword [ecx + 0x54]
call fcn.100c7670
mov esi, dword [ebp - 0xe4]
test esi, esi
jne 0x100bbe64
mov esi, dword [ebp - 0xe0]
test esi, esi
je 0x100bbdf4
or eax, 0xffffffff
lock xadd dword [esi + 4], eax
jne 0x100bbdf4
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
jne 0x100bbdf4
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
jmp 0x100bbdf4
mov edi, dword [esi + 4]
mov dword [ebp - 0x12c], edi
test edi, edi
je 0x100bbe7e
lock inc dword [edi + 4]
mov edi, dword [esi + 4]
mov dword [ebp - 0x12c], edi
mov ebx, dword [esi]
mov dword [ebp - 0xf0], ebx
mov dword [ebp - 0x134], ebx
mov dword [ebp - 0x130], edi
test ebx, ebx
jne 0x100bbf03
test edi, edi
je 0x100bbebb
or eax, 0xffffffff
lock xadd dword [edi + 4], eax
jne 0x100bbebb
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
or eax, 0xffffffff
lock xadd dword [edi + 8], eax
jne 0x100bbebb
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
mov esi, dword [ebp - 0xe0]
mov ebx, dword [ebp - 0xcc]
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test esi, esi
je 0x100bbdf4
or eax, 0xffffffff
lock xadd dword [esi + 4], eax
jne 0x100bbdf4
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
jne 0x100bbdf4
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
jmp 0x100bbdf4
mov dword [ebp - 0xfc], 0
mov dword [ebp - 0xf8], 0
mov dword [ebp - 0xf4], 0
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x104], 0
mov dword [ebp - 0x100], 0
call fcn.10002d70
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
add eax, 0x10
lea ecx, [ebp - 0xdc]
push 0x10202940
mov dword [ebp - 0xdc], eax
call fcn.10023e80
test al, al
jne 0x100bbf7a
push 0
push 0x10202940
lea ecx, [ebp - 0xdc]
call fcn.10003740
cmp byte [ebx + 0xdd], 0
je 0x100bc0b1
mov esi, dword [ebp - 0xcc]
lea eax, [ebp - 0x10c]
mov ebx, dword [ebx + 0xe4]
push eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x10c], ebx
push eax
lea ecx, [esi + 0xd0]
call fcn.100c4630
mov eax, dword [ebp - 0x114]
cmp eax, dword [esi + 0xd0]
je 0x100bbfde
cmp ebx, dword [eax + 0x10]
jb 0x100bbfde
mov esi, dword [eax + 0x18]
test esi, esi
je 0x100bbfd3
lock inc dword [esi + 4]
mov esi, dword [eax + 0x18]
mov ebx, dword [eax + 0x14]
mov dword [ebp - 0x138], esi
jmp 0x100bbfe8
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0x138], ebx
mov dword [ebp - 0x13c], ebx
test ebx, ebx
je 0x100bc053
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 8]
test eax, eax
je 0x100bc053
mov eax, dword [ebx + 0xc]
cmp eax, dword [ebx + 0x10]
je 0x100bc020
push dword [ebp - 0x10c]
lea ecx, [ebp - 0xfc]
push dword [ebx + 0x10]
push eax
push dword [ebp - 0xf8]
call fcn.1009d270
mov eax, dword [ebx + 0x18]
cmp eax, dword [ebx + 0x1c]
je 0x100bc043
push dword [ebp - 0x10c]
lea ecx, [ebp - 0x108]
push dword [ebx + 0x1c]
push eax
push dword [ebp - 0x104]
call fcn.1009d270
lea ecx, [ebp - 0x13c]
call fcn.10033270
jmp 0x100bc333
test esi, esi
je 0x100bc078
or eax, 0xffffffff
lock xadd dword [esi + 4], eax
jne 0x100bc078
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
jne 0x100bc078
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov edx, dword [ebp - 0xdc]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100bc096
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x108]
call fcn.1002a3c0
lea ecx, [ebp - 0xfc]
call fcn.1002a3c0
jmp 0x100bbe96
push 0
push 0
lea ecx, [ebp - 0xec]
mov dword [ebp - 0xec], 0
mov dword [ebp - 0xe8], 0
call fcn.100273b0
push 0
mov ebx, eax
mov dword [ebp - 0xd4], 0
push 0
lea ecx, [ebp - 0xd4]
mov dword [ebp - 0xec], ebx
mov dword [ebp - 0xd0], 0
call fcn.100273b0
mov esi, dword [esi + 0xc]
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0xe4]
cmp esi, dword [eax + 0x10]
je 0x100bc13f
push esi
push dword [ebp - 0xec]
lea ecx, [ebp - 0xec]
call fcn.1002e820
mov eax, dword [ebp - 0xe4]
add esi, 0x18
cmp esi, dword [eax + 0x10]
jne 0x100bc113
mov edi, dword [ebp - 0x12c]
mov ebx, dword [ebp - 0xec]
mov esi, dword [eax + 0x18]
cmp esi, dword [eax + 0x1c]
je 0x100bc170
mov ebx, dword [ebp - 0xe4]
lea ecx, [ecx]
push esi
push dword [ebp - 0xd4]
lea ecx, [ebp - 0xd4]
call fcn.1002e820
add esi, 0x18
cmp esi, dword [ebx + 0x1c]
jne 0x100bc150
mov ebx, dword [ebp - 0xec]
mov ecx, dword [ebp - 0xf0]
cmp byte [ecx + 0xe0], 0
mov al, byte [ecx + 0xdf]
jne 0x100bc58a
test al, al
jne 0x100bc58a
mov esi, dword [ebx]
cmp esi, ebx
je 0x100bc243
jmp 0x100bc1a0
cmp dword [esi + 0x1c], 8
lea edi, [esi + 8]
jb 0x100bc1ab
mov edi, dword [edi]
call fcn.10002d70
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
add eax, 0x10
lea ecx, [ebp - 0xd8]
push edi
mov dword [ebp - 0xd8], eax
call fcn.10023e80
test al, al
jne 0x100bc1dc
push edi
lea ecx, [ebp - 0xd8]
call fcn.10008170
mov ebx, dword [ebp - 0xf8]
mov edi, dword [ebp - 0xd8]
cmp dword [ebp - 0xf4], ebx
je 0x100bc20a
lea eax, [edi - 0x10]
push eax
call fcn.10002a60
add eax, 0x10
add esp, 4
mov dword [ebx], eax
add dword [ebp - 0xf8], 4
jmp 0x100bc21d
lea eax, [ebp - 0xd8]
push eax
push ebx
lea ecx, [ebp - 0xfc]
call fcn.1001ddd0
add edi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x100bc235
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [esi]
cmp esi, dword [ebp - 0xec]
jne 0x100bc1a0
mov eax, dword [ebp - 0xd4]
mov esi, dword [eax]
cmp esi, eax
je 0x100bc2f6
cmp dword [esi + 0x1c], 8
lea edi, [esi + 8]
jb 0x100bc25e
mov edi, dword [edi]
call fcn.10002d70
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
add eax, 0x10
lea ecx, [ebp - 0xd8]
push edi
mov dword [ebp - 0xd8], eax
call fcn.10023e80
test al, al
jne 0x100bc28f
push edi
lea ecx, [ebp - 0xd8]
call fcn.10008170
mov ebx, dword [ebp - 0x104]
mov edi, dword [ebp - 0xd8]
cmp dword [ebp - 0x100], ebx
je 0x100bc2bd
lea eax, [edi - 0x10]
push eax
call fcn.10002a60
add eax, 0x10
add esp, 4
mov dword [ebx], eax
add dword [ebp - 0x104], 4
jmp 0x100bc2d0
lea eax, [ebp - 0xd8]
push eax
push ebx
lea ecx, [ebp - 0x108]
call fcn.1001ddd0
add edi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x100bc2e8
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [esi]
cmp esi, dword [ebp - 0xd4]
jne 0x100bc253
lea ecx, [ebp - 0xd4]
call fcn.1002a820
push 0x20
push dword [ebp - 0xd4]
call fcn.1001da10
add esp, 8
lea ecx, [ebp - 0xec]
call fcn.1002a820
push 1
push dword [ebp - 0xec]
lea eax, [ebp - 0x115]
push eax
call fcn.100c41c0
add esp, 0xc
mov esi, dword [ebp - 0xf0]
mov ebx, dword [ebp - 0xcc]
mov eax, dword [esi + 0xe4]
mov dword [ebp - 0x11c], eax
lea ecx, [ebx + 0xc8]
lea eax, [ebp - 0x134]
push eax
lea eax, [ebp - 0x11c]
push eax
call fcn.100b9fa0
mov ecx, eax
call fcn.10033dc0
mov ecx, dword [ebp - 0xe4]
lea ecx, [ecx + 0x24]
call fcn.100c3790
mov eax, dword [ebx]
mov ecx, ebx
push dword [ebp - 0x11c]
call dword [eax + 0x14]
test eax, eax
je 0x100bc3cc
lea ecx, [ebp - 0xdc]
call fcn.10007e10
lea ecx, [ebp - 0x108]
call fcn.1002a3c0
lea ecx, [ebp - 0xfc]
call fcn.1002a3c0
lea ecx, [ebp - 0x134]
call fcn.10033270
lea ecx, [ebp - 0xe4]
call fcn.10033270
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x100bbdf4
lea ecx, [ebp - 0x2c]
call fcn.100b8500
mov eax, dword [ebp - 0xfc]
cmp eax, dword [ebp - 0xf8]
je 0x100bc3ec
push dword [eax]
lea ecx, [ebp - 0x2c]
call fcn.10033d90
mov eax, dword [ebp - 0x108]
cmp eax, dword [ebp - 0x104]
je 0x100bc404
push dword [eax]
lea ecx, [ebp - 0x2c]
call fcn.100ba0d0
lea eax, [esi + 0x44]
push eax
lea ecx, [ebp - 0x2c]
call fcn.10061aa0
lea eax, [esi + 0x74]
push eax
lea ecx, [ebp - 0x2c]
call fcn.10061aa0
cmp dword [0x1023fe04], 0
mov ebx, dword [ebp - 0x110]
je 0x100bc452
push dword [0x1023fe00]
or ebx, 2
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x110], ebx
call fcn.100c40c0
push eax
lea ecx, [ebp - 0xc8]
call fcn.10098d30
mov eax, dword [eax]
jmp 0x100bc457
mov eax, 0x10202a60
lea ecx, [ebp - 0x14]
push ecx
push eax
call fcn.10006810
add esp, 8
test bl, 2
je 0x100bc47d
and ebx, 0xfffffffd
lea ecx, [ebp - 0xc8]
mov dword [ebp - 0x110], ebx
call fcn.100b9340
push 0x10
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.10005ff0
movsx edi, byte [esi + 0xf5]
add esp, 0xc
mov ebx, dword [esi + 0xe4]
mov ecx, esi
call fcn.10035860
push eax
push ecx
mov ecx, dword [ebp - 0xf0]
mov esi, esp
lea ecx, [ecx + 0x44]
call fcn.100c40c0
push eax
mov ecx, esi
call fcn.10002490
mov edx, dword [ebp - 0xcc]
push ecx
push esp
mov ecx, edx
mov eax, dword [edx]
call dword [eax + 0x1c]
push edi
lea ecx, [ebp - 0x44]
call fcn.1000f010
push eax
push ebx
call fcn.101b6310
mov ebx, dword [ebp - 0xf0]
add esp, 0x18
test eax, eax
jne 0x100bc500
mov ecx, ebx
call fcn.100bc830
test al, al
js 0x100bc532
cmp dword [ebp - 0x11c], 0x11170
jae 0x100bc532
mov edi, dword [ebp - 0x128]
mov eax, dword [ebp - 0x144]
inc edi
mov dword [ebp - 0x128], edi
test eax, eax
je 0x100bc532
mov esi, dword [eax]
lea ecx, [ebx + 0x44]
call fcn.100c40c0
mov ebx, dword [ebp - 0x144]
push eax
push dword [ebp - 0x140]
push edi
push ebx
call dword [esi]
lea ecx, [ebp - 0x44]
call fcn.1000c070
lea ecx, [ebp - 0x2c]
call fcn.10005250
lea ecx, [ebp - 0xdc]
call fcn.10007e10
lea ecx, [ebp - 0x108]
call fcn.1002a3c0
lea ecx, [ebp - 0xfc]
call fcn.1002a3c0
lea ecx, [ebp - 0x134]
call fcn.10033270
lea ecx, [ebp - 0xe4]
call fcn.10033270
mov ebx, dword [ebp - 0xcc]
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x100bbdf4
lea ecx, [ebp - 0xd4]
call fcn.1002a820
push 0x20
push dword [ebp - 0xd4]
call fcn.1001da10
add esp, 8
lea ecx, [ebp - 0xec]
call fcn.1002a820
push 0x20
push dword [ebp - 0xec]
call fcn.1001da10
add esp, 8
jmp 0x100bc078
push dword [ebp - 0x148]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x14c]
call esi
lea ecx, [ebp - 0x124]
call fcn.10033270
mov eax, dword [ebp - 0x128]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101f99c6
mov esp, ebp
pop ebp
ret 4