Function at 0x10be04
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x38
push 0
push 0
dec ecx
jne 0x10be0d
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00014218
xor eax, eax
push ebp
push 0x10d637
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x149c70]
mov eax, dword [eax]
mov edx, 0x10d650
call fcn.00065094
xor edx, edx
push ebp
push 0x10d45c
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea eax, [ebp - 0x24]
mov ecx, 1
mov edx, dword [0x1048c0]
call fcn.00016730
add esp, 4
mov eax, dword [ebp - 0x24]
mov edx, 0x10d67c
call fcn.00013e38
mov eax, dword [ebp - 0x24]
mov word [eax + 4], 0x41d
mov eax, dword [ebp - 0x24]
add eax, 0xc
mov edx, 0x10d694
call fcn.00013e38
mov eax, dword [ebp - 0x24]
mov word [eax + 0x10], 0x41f
mov eax, dword [ebp - 0x24]
add eax, 0x18
mov edx, 0x10d6ac
call fcn.00013e38
mov eax, dword [ebp - 0x24]
mov word [eax + 0x1c], 0x421
mov eax, dword [ebp - 0x24]
add eax, 0x24
mov edx, 0x10d6c4
call fcn.00013e38
mov eax, dword [ebp - 0x24]
mov word [eax + 0x28], 0x4ee
mov eax, dword [ebp - 0x24]
add eax, 0x30
mov edx, 0x10d6dc
call fcn.00013e38
mov eax, dword [ebp - 0x24]
mov word [eax + 0x34], 0x538
mov eax, dword [ebp - 0x24]
add eax, 0x3c
mov edx, 0x10d6f4
call fcn.00013e38
mov eax, dword [ebp - 0x24]
mov word [eax + 0x40], 0x571
mov eax, dword [ebp - 0x24]
add eax, 0x48
mov edx, 0x10d70c
call fcn.00013e38
mov eax, dword [ebp - 0x24]
mov word [eax + 0x4c], 0x581
mov eax, dword [ebp - 0x24]
call fcn.00016574
mov edi, eax
dec edi
test edi, edi
jl 0x10d435
inc edi
xor esi, esi
xor ebx, ebx
lea eax, [ebp - 0x14]
call fcn.00013de4
lea eax, [ebp - 0x18]
call fcn.00013de4
lea eax, [esi + esi*2]
mov edx, dword [ebp - 0x24]
mov ecx, dword [edx + eax*4]
lea eax, [ebp - 0x28]
mov edx, 0x10d724
call fcn.000140b0
mov edx, dword [ebp - 0x28]
mov eax, dword [0x149c20]
mov eax, dword [eax]
call fcn.00064894
lea eax, [esi + esi*2]
mov edx, dword [ebp - 0x24]
movzx eax, word [edx + eax*4 + 4]
cmp eax, 0x4ee
jg 0x10bf9f
je 0x10c75e
sub eax, 0x41d
je 0x10bfc1
sub eax, 2
je 0x10c21d
sub eax, 2
je 0x10c48b
jmp 0x10d3c1
sub eax, 0x538
je 0x10ca39
sub eax, 0x39
je 0x10cd14
sub eax, 0x10
je 0x10d0f1
jmp 0x10d3c1
push 0
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x10d738
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.000cf054
lea eax, [ebp - 0x2c]
mov ecx, dword [ebp - 0x14]
mov edx, 0x10d790
call fcn.000140b0
mov edx, dword [ebp - 0x2c]
mov eax, dword [0x149c20]
mov eax, dword [eax]
call fcn.00064894
mov eax, dword [ebp - 0x14]
mov edx, 0x10d7f8
call fcn.00014174
jne 0x10c0af
push 0x10d804
push 0
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x10d738
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.000cf438
mov eax, dword [ebp - 0x18]
mov edx, 0x10d7f8
call fcn.00014174
jne 0x10c04e
push 0x10d804
push 0
lea eax, [ebp - 0x20]
push eax
mov ecx, 0x10d738
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.000cf65c
mov eax, dword [ebp - 0x20]
call fcn.00016574
test eax, eax
je 0x10c09e
lea edx, [ebp - 0x34]
mov eax, dword [ebp - 0x20]
add eax, 8
call fcn.00015e9c
mov ecx, dword [ebp - 0x34]
lea eax, [ebp - 0x30]
mov edx, 0x10d81c
call fcn.000140b0
mov edx, dword [ebp - 0x30]
mov eax, dword [0x149c20]
mov eax, dword [eax]
call fcn.00064894
lea eax, [esi + esi*2]
mov edx, dword [ebp - 0x24]
lea eax, [edx + eax*4 + 8]
mov edx, dword [ebp - 0x20]
add edx, 8
call fcn.00015408
jmp 0x10c0af
mov eax, dword [0x149c20]
mov eax, dword [eax]
mov edx, 0x10d81c
call fcn.00064894
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x44]
mov edx, 0x10d880
call fcn.00015650
lea eax, [ebp - 0x44]
push eax
push 4
push 0
mov ecx, 0x10d804
mov edx, 0x10d738
mov eax, dword [ebp - 4]
call fcn.0010640c
cmp al, 0x30
jne 0x10c0e2
xor ebx, ebx
jmp 0x10c0e4
mov bl, 1
mov eax, dword [0x149c7c]
cmp byte [eax], 0
je 0x10d3c1
push 0xffffffffffffffff
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x10d890
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.000cf054
lea eax, [ebp - 0x48]
mov ecx, dword [ebp - 0x14]
mov edx, 0x10d8f4
call fcn.000140b0
mov edx, dword [ebp - 0x48]
mov eax, dword [0x149c20]
mov eax, dword [eax]
call fcn.00064894
mov eax, dword [ebp - 0x14]
mov edx, 0x10d7f8
call fcn.00014174
jne 0x10c1e0
push 0x10d804
push 0
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x10d890
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.000cf438
mov eax, dword [ebp - 0x18]
mov edx, 0x10d7f8
call fcn.00014174
jne 0x10c17f
push 0x10d804
push 0
lea eax, [ebp - 0x20]
push eax
mov ecx, 0x10d890
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.000cf65c
mov eax, dword [ebp - 0x20]
call fcn.00016574
test eax, eax
je 0x10c1cf
lea edx, [ebp - 0x50]
mov eax, dword [ebp - 0x20]
add eax, 8
call fcn.00015e9c
mov ecx, dword [ebp - 0x50]
lea eax, [ebp - 0x4c]
mov edx, 0x10d968
call fcn.000140b0
mov edx, dword [ebp - 0x4c]
mov eax, dword [0x149c20]
mov eax, dword [eax]
call fcn.00064894
lea eax, [esi + esi*2]
mov edx, dword [ebp - 0x24]
lea eax, [edx + eax*4 + 8]
mov edx, dword [ebp - 0x20]
add edx, 8
call fcn.00015408
jmp 0x10c1e0
mov eax, dword [0x149c20]
mov eax, dword [eax]
mov edx, 0x10d968
call fcn.00064894
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x60]
mov edx, 0x10d880
call fcn.00015650
lea eax, [ebp - 0x60]
push eax
push 4
push 0
mov ecx, 0x10d804
mov edx, 0x10d9d8
mov eax, dword [ebp - 4]
call fcn.0010640c
cmp al, 0x30
jne 0x10c216
xor ebx, ebx
jmp 0x10d3c1
mov bl, 1
jmp 0x10d3c1
push 0
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x10d738
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.000cf054
lea eax, [ebp - 0x64]
mov ecx, dword [ebp - 0x14]
mov edx, 0x10d790
call fcn.000140b0
mov edx, dword [ebp - 0x64]
mov eax, dword [0x149c20]
mov eax, dword [eax]
call fcn.00064894
mov eax, dword [ebp - 0x14]
mov edx, 0x10d7f8
call fcn.00014174
jne 0x10c30b
push 0x10d804
push 0
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x10d738
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.000cf438
mov eax, dword [ebp - 0x18]
mov edx, 0x10d7f8
call fcn.00014174
jne 0x10c2aa
push 0x10d804
push 0
lea eax, [ebp - 0x20]
push eax
mov ecx, 0x10d738
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.000cf65c
mov eax, dword [ebp - 0x20]
call fcn.00016574
test eax, eax
je 0x10c2fa
lea edx, [ebp - 0x6c]
mov eax, dword [ebp - 0x20]
add eax, 8
call fcn.00015e9c
mov ecx, dword [ebp - 0x6c]
lea eax, [ebp - 0x68]
mov edx, 0x10d81c
call fcn.000140b0
mov edx, dword [ebp - 0x68]
mov eax, dword [0x149c20]
mov eax, dword [eax]
call fcn.00064894
lea eax, [esi + esi*2]
mov edx, dword [ebp - 0x24]
lea eax, [edx + eax*4 + 8]
mov edx, dword [ebp - 0x20]
add edx, 8
call fcn.00015408
jmp 0x10c30b
mov eax, dword [0x149c20]
mov eax, dword [eax]
mov edx, 0x10d81c
call fcn.00064894
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x7c]
mov edx, 0x10da3c
call fcn.00015650
lea eax, [ebp - 0x7c]
push eax
push 4
push 0
mov ecx, 0x10d804
mov edx, 0x10d738
mov eax, dword [ebp - 4]
call fcn.0010640c
cmp al, 0x30
jne 0x10c33e
xor ebx, ebx
jmp 0x10c340
mov bl, 1
mov eax, dword [0x149c7c]
cmp byte [eax], 0
je 0x10d3c1
push 0xffffffffffffffff
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x10d890
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.000cf054
lea eax, [ebp - 0x80]
mov ecx, dword [ebp - 0x14]
mov edx, 0x10d8f4
call fcn.000140b0
mov edx, dword [ebp - 0x80]
mov eax, dword [0x149c20]
mov eax, dword [eax]
call fcn.00064894
mov eax, dword [ebp - 0x14]
mov edx, 0x10d7f8
call fcn.00014174
jne 0x10c448
push 0x10d804
push 0
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x10d890
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.000cf438
mov eax, dword [ebp - 0x18]
mov edx, 0x10d7f8
call fcn.00014174
jne 0x10c3db
push 0x10d804
push 0
lea eax, [ebp - 0x20]
push eax
mov ecx, 0x10d890
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.000cf65c
mov eax, dword [ebp - 0x20]
call fcn.00016574
test eax, eax
je 0x10c437
lea edx, [ebp - 0x88]
mov eax, dword [ebp - 0x20]
add eax, 8
call fcn.00015e9c
mov ecx, dword [ebp - 0x88]
lea eax, [ebp - 0x84]
mov edx, 0x10d968
call fcn.000140b0
mov edx, dword [ebp - 0x84]
mov eax, dword [0x149c20]
mov eax, dword [eax]
call fcn.00064894
lea eax, [esi + esi*2]
mov edx, dword [ebp - 0x24]
lea eax, [edx + eax*4 + 8]
mov edx, dword [ebp - 0x20]
add edx, 8
call fcn.00015408
jmp 0x10c448
mov eax, dword [0x149c20]
mov eax, dword [eax]
mov edx, 0x10d968
call fcn.00064894
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x98]
mov edx, 0x10da3c
call fcn.00015650
lea eax, [ebp - 0x98]
push eax
push 4
push 0
mov ecx, 0x10d804
mov edx, 0x10d9d8
mov eax, dword [ebp - 4]
call fcn.0010640c
cmp al, 0x30
jne 0x10c484
xor ebx, ebx
jmp 0x10d3c1
mov bl, 1
jmp 0x10d3c1
push 0
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x10d738
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.000cf054
lea eax, [ebp - 0x9c]
mov ecx, dword [ebp - 0x14]
mov edx, 0x10d790
call fcn.000140b0
mov edx, dword [ebp - 0x9c]
mov eax, dword [0x149c20]
mov eax, dword [eax]
call fcn.00064894
mov eax, dword [ebp - 0x14]
mov edx, 0x10d7f8
call fcn.00014174
jne 0x10c58b
push 0x10d804
push 0
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x10d738
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.000cf438
mov eax, dword [ebp - 0x18]
mov edx, 0x10d7f8
call fcn.00014174
jne 0x10c51e
push 0x10d804
push 0
lea eax, [ebp - 0x20]
push eax
mov ecx, 0x10d738
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.000cf65c
mov eax, dword [ebp - 0x20]
call fcn.00016574
test eax, eax
je 0x10c57a
lea edx, [ebp - 0xa4]
mov eax, dword [ebp - 0x20]
add eax, 8
call fcn.00015e9c
mov ecx, dword [ebp - 0xa4]
lea eax, [ebp - 0xa0]
mov edx, 0x10d81c
call fcn.000140b0
mov edx, dword [ebp - 0xa0]
mov eax, dword [0x149c20]
mov eax, dword [eax]
call fcn.00064894
lea eax, [esi + esi*2]
mov edx, dword [ebp - 0x24]
lea eax, [edx + eax*4 + 8]
mov edx, dword [ebp - 0x20]
add edx, 8
call fcn.00015408
jmp 0x10c58b
mov eax, dword [0x149c20]
mov eax, dword [eax]
mov edx, 0x10d81c
call fcn.00064894
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0xb4]
mov edx, 0x10da4c
call fcn.00015650
lea eax, [ebp - 0xb4]
push eax
push 4
push 0
mov ecx, 0x10d804
mov edx, 0x10d738
mov eax, dword [ebp - 4]
call fcn.0010640c
cmp al, 0x30
jne 0x10c5e6
mov eax, dword [ebp - 0x1c]
push eax
lea eax, [esi + esi*2]
mov edx, dword [ebp - 0x24]
movzx ecx, word [edx + eax*4 + 4]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00108dd4
cmp al, 0x30
jne 0x10c5e2
xor ebx, ebx
jmp 0x10c5e8
mov bl, 1
jmp 0x10c5e8
mov bl, 1
mov eax, dword [0x149c7c]
cmp byte [eax], 0
je 0x10d3c1
push 0xffffffffffffffff
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x10d890
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.000cf054
lea eax, [ebp - 0xb8]
mov ecx, dword [ebp - 0x14]
mov edx, 0x10d8f4
call fcn.000140b0
mov edx, dword [ebp - 0xb8]
mov eax, dword [0x149c20]
mov eax, dword [eax]
call fcn.00064894
mov eax, dword [ebp - 0x14]
mov edx, 0x10d7f8
call fcn.00014174
jne 0x10c6f6
push 0x10d804
push 0
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x10d890
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.000cf438
mov eax, dword [ebp - 0x18]
mov edx, 0x10d7f8
call fcn.00014174
jne 0x10c689
push 0x10d804
push 0
lea eax, [ebp - 0x20]
push eax
mov ecx, 0x10d890
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.000cf65c
mov eax, dword [ebp - 0x20]
call fcn.00016574
test eax, eax
je 0x10c6e5
lea edx, [ebp - 0xc0]
mov eax, dword [ebp - 0x20]
add eax, 8
call fcn.00015e9c
mov ecx, dword [ebp - 0xc0]
lea eax, [ebp - 0xbc]
mov edx, 0x10d968
call fcn.000140b0
mov edx, dword [ebp - 0xbc]
mov eax, dword [0x149c20]
mov eax, dword [eax]
call fcn.00064894
lea eax, [esi + esi*2]
mov edx, dword [ebp - 0x24]
lea eax, [edx + eax*4 + 8]
mov edx, dword [ebp - 0x20]
add edx, 8
call fcn.00015408
jmp 0x10c6f6
mov eax, dword [0x149c20]
mov eax, dword [eax]
mov edx, 0x10d968
call fcn.00064894
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0xd0]
mov edx, 0x10da4c
call fcn.00015650
lea eax, [ebp - 0xd0]
push eax
push 4
push 0
mov ecx, 0x10d804
mov edx, 0x10d890
mov eax, dword [ebp - 4]
call fcn.0010640c
cmp al, 0x30
jne 0x10c757
mov eax, dword [ebp - 0x1c]
push eax
lea eax, [esi + esi*2]
mov edx, dword [ebp - 0x24]
movzx ecx, word [edx + eax*4 + 4]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00109e6c
cmp al, 0x30
jne 0x10c750
xor ebx, ebx
jmp 0x10d3c1
mov bl, 1
jmp 0x10d3c1
mov bl, 1
jmp 0x10d3c1
push 0
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x10d738
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.000cf054
lea eax, [ebp - 0xd4]
mov ecx, dword [ebp - 0x14]
mov edx, 0x10d790
call fcn.000140b0
mov edx, dword [ebp - 0xd4]
mov eax, dword [0x149c20]
mov eax, dword [eax]
call fcn.00064894
mov eax, dword [ebp - 0x14]
mov edx, 0x10d7f8
call fcn.00014174
jne 0x10c85e
push 0x10d804
push 0
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x10d738
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.000cf438
mov eax, dword [ebp - 0x18]
mov edx, 0x10d7f8
call fcn.00014174
jne 0x10c7f1
push 0x10d804
push 0
lea eax, [ebp - 0x20]
push eax
mov ecx, 0x10d738
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.000cf65c
mov eax, dword [ebp - 0x20]
call fcn.00016574
test eax, eax
je 0x10c84d
lea edx, [ebp - 0xdc]
mov eax, dword [ebp - 0x20]
add eax, 8
call fcn.00015e9c
mov ecx, dword [ebp - 0xdc]
lea eax, [ebp - 0xd8]
mov edx, 0x10d81c
call fcn.000140b0
mov edx, dword [ebp - 0xd8]
mov eax, dword [0x149c20]
mov eax, dword [eax]
call fcn.00064894
lea eax, [esi + esi*2]
mov edx, dword [ebp - 0x24]
lea eax, [edx + eax*4 + 8]
mov edx, dword [ebp - 0x20]
add edx, 8
call fcn.00015408
jmp 0x10c85e
mov eax, dword [0x149c20]
mov eax, dword [eax]
mov edx, 0x10d81c
call fcn.00064894
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0xec]
mov edx, 0x10da5c
call fcn.00015650
lea eax, [ebp - 0xec]
push eax
push 4
push 0
mov ecx, 0x10d804
mov edx, 0x10d738
mov eax, dword [ebp - 4]
call fcn.0010640c
cmp al, 0x30
jne 0x10c8b9
mov eax, dword [ebp - 0x1c]
push eax
lea eax, [esi + esi*2]
mov edx, dword [ebp - 0x24]
movzx ecx, word [edx + eax*4 + 4]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00108dd4
cmp al, 0x30
jne 0x10c8b5
xor ebx, ebx
jmp 0x10c8bb
mov bl, 1
jmp 0x10c8bb
mov bl, 1
mov eax, dword [0x149c7c]
cmp byte [eax], 0
je 0x10d3c1
test bl, bl
jne 0x10d3c1
push 0xffffffffffffffff
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x10d890
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.000cf054
lea eax, [ebp - 0xf0]
mov ecx, dword [ebp - 0x14]
mov edx, 0x10d8f4
call fcn.000140b0
mov edx, dword [ebp - 0xf0]
mov eax, dword [0x149c20]
mov eax, dword [eax]
call fcn.00064894
mov eax, dword [ebp - 0x14]
mov edx, 0x10d7f8
call fcn.00014174
jne 0x10c9d1
push 0x10d804
push 0
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x10d890
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.000cf438
mov eax, dword [ebp - 0x18]
mov edx, 0x10d7f8
call fcn.00014174
jne 0x10c964
push 0x10d804
push 0
lea eax, [ebp - 0x20]
push eax
mov ecx, 0x10d890
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.000cf65c
mov eax, dword [ebp - 0x20]
call fcn.00016574
test eax, eax
je 0x10c9c0
lea edx, [ebp - 0xf8]
mov eax, dword [ebp - 0x20]
add eax, 8
call fcn.00015e9c
mov ecx, dword [ebp - 0xf8]
lea eax, [ebp - 0xf4]
mov edx, 0x10d968
call fcn.000140b0
mov edx, dword [ebp - 0xf4]
mov eax, dword [0x149c20]
mov eax, dword [eax]
call fcn.00064894
lea eax, [esi + esi*2]
mov edx, dword [ebp - 0x24]
lea eax, [edx + eax*4 + 8]
mov edx, dword [ebp - 0x20]
add edx, 8
call fcn.00015408
jmp 0x10c9d1
mov eax, dword [0x149c20]
mov eax, dword [eax]
mov edx, 0x10d968
call fcn.00064894
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x108]
mov edx, 0x10da5c
call fcn.00015650
lea eax, [ebp - 0x108]
push eax
push 4
push 0
mov ecx, 0x10d804
mov edx, 0x10d890
mov eax, dword [ebp - 4]
call fcn.0010640c
cmp al, 0x30
jne 0x10ca32
mov eax, dword [ebp - 0x1c]
push eax
lea eax, [esi + esi*2]
mov edx, dword [ebp - 0x24]
movzx ecx, word [edx + eax*4 + 4]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00109e6c
cmp al, 0x30
jne 0x10ca2b
xor ebx, ebx
jmp 0x10d3c1
mov bl, 1
jmp 0x10d3c1
mov bl, 1
jmp 0x10d3c1
push 0
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x10d738
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.000cf054
lea eax, [ebp - 0x10c]
mov ecx, dword [ebp - 0x14]
mov edx, 0x10d790
call fcn.000140b0
mov edx, dword [ebp - 0x10c]
mov eax, dword [0x149c20]
mov eax, dword [eax]
call fcn.00064894
mov eax, dword [ebp - 0x14]
mov edx, 0x10d7f8
call fcn.00014174
jne 0x10cb39
push 0x10d804
push 0
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x10d738
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.000cf438
mov eax, dword [ebp - 0x18]
mov edx, 0x10d7f8
call fcn.00014174
jne 0x10cacc
push 0x10d804
push 0
lea eax, [ebp - 0x20]
push eax
mov ecx, 0x10d738
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.000cf65c
mov eax, dword [ebp - 0x20]
call fcn.00016574
test eax, eax
je 0x10cb28
lea edx, [ebp - 0x114]
mov eax, dword [ebp - 0x20]
add eax, 8
call fcn.00015e9c
mov ecx, dword [ebp - 0x114]
lea eax, [ebp - 0x110]
mov edx, 0x10d81c
call fcn.000140b0
mov edx, dword [ebp - 0x110]
mov eax, dword [0x149c20]
mov eax, dword [eax]
call fcn.00064894
lea eax, [esi + esi*2]
mov edx, dword [ebp - 0x24]
lea eax, [edx + eax*4 + 8]
mov edx, dword [ebp - 0x20]
add edx, 8
call fcn.00015408
jmp 0x10cb39
mov eax, dword [0x149c20]
mov eax, dword [eax]
mov edx, 0x10d81c
call fcn.00064894
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x124]
mov edx, 0x10da6c
call fcn.00015650
lea eax, [ebp - 0x124]
push eax
push 4
push 0
mov ecx, 0x10d804
mov edx, 0x10d738
mov eax, dword [ebp - 4]
call fcn.0010640c
cmp al, 0x30
jne 0x10cb94
mov eax, dword [ebp - 0x1c]
push eax
lea eax, [esi + esi*2]
mov edx, dword [ebp - 0x24]
movzx ecx, word [edx + eax*4 + 4]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00108dd4
cmp al, 0x30
jne 0x10cb90
xor ebx, ebx
jmp 0x10cb96
mov bl, 1
jmp 0x10cb96
mov bl, 1
mov eax, dword [0x149c7c]
cmp byte [eax], 0
je 0x10d3c1
test bl, bl
jne 0x10d3c1
push 0xffffffffffffffff
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x10d890
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.000cf054
lea eax, [ebp - 0x128]
mov ecx, dword [ebp - 0x14]
mov edx, 0x10d8f4
call fcn.000140b0
mov edx, dword [ebp - 0x128]
mov eax, dword [0x149c20]
mov eax, dword [eax]
call fcn.00064894
mov eax, dword [ebp - 0x14]
mov edx, 0x10d7f8
call fcn.00014174
jne 0x10ccac
push 0x10d804
push 0
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x10d890
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.000cf438
mov eax, dword [ebp - 0x18]
mov edx, 0x10d7f8
call fcn.00014174
jne 0x10cc3f
push 0x10d804
push 0
lea eax, [ebp - 0x20]
push eax
mov ecx, 0x10d890
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.000cf65c
mov eax, dword [ebp - 0x20]
call fcn.00016574
test eax, eax
je 0x10cc9b
lea edx, [ebp - 0x130]
mov eax, dword [ebp - 0x20]
add eax, 8
call fcn.00015e9c
mov ecx, dword [ebp - 0x130]
lea eax, [ebp - 0x12c]
mov edx, 0x10d968
call fcn.000140b0
mov edx, dword [ebp - 0x12c]
mov eax, dword [0x149c20]
mov eax, dword [eax]
call fcn.00064894
lea eax, [esi + esi*2]
mov edx, dword [ebp - 0x24]
lea eax, [edx + eax*4 + 8]
mov edx, dword [ebp - 0x20]
add edx, 8
call fcn.00015408
jmp 0x10ccac
mov eax, dword [0x149c20]
mov eax, dword [eax]
mov edx, 0x10d968
call fcn.00064894
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x140]
mov edx, 0x10da6c
call fcn.00015650
lea eax, [ebp - 0x140]
push eax
push 4
push 0
mov ecx, 0x10d804
mov edx, 0x10d890
mov eax, dword [ebp - 4]
call fcn.0010640c
cmp al, 0x30
jne 0x10cd0d
mov eax, dword [ebp - 0x1c]
push eax
lea eax, [esi + esi*2]
mov edx, dword [ebp - 0x24]
movzx ecx, word [edx + eax*4 + 4]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00109e6c
cmp al, 0x30
jne 0x10cd06
xor ebx, ebx
jmp 0x10d3c1
mov bl, 1
jmp 0x10d3c1
mov bl, 1
jmp 0x10d3c1
push 0
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x10d738
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.000cf054
lea eax, [ebp - 0x144]
mov ecx, dword [ebp - 0x14]
mov edx, 0x10d790
call fcn.000140b0
mov edx, dword [ebp - 0x144]
mov eax, dword [0x149c20]
mov eax, dword [eax]
call fcn.00064894
mov eax, dword [ebp - 0x14]
mov edx, 0x10d7f8
call fcn.00014174
jne 0x10ce14
push 0x10d804
push 0
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x10d738
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.000cf438
mov eax, dword [ebp - 0x18]
mov edx, 0x10d7f8
call fcn.00014174
jne 0x10cda7
push 0x10d804
push 0
lea eax, [ebp - 0x20]
push eax
mov ecx, 0x10d738
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.000cf65c
mov eax, dword [ebp - 0x20]
call fcn.00016574
test eax, eax
je 0x10ce03
lea edx, [ebp - 0x14c]
mov eax, dword [ebp - 0x20]
add eax, 8
call fcn.00015e9c
mov ecx, dword [ebp - 0x14c]
lea eax, [ebp - 0x148]
mov edx, 0x10d81c
call fcn.000140b0
mov edx, dword [ebp - 0x148]
mov eax, dword [0x149c20]
mov eax, dword [eax]
call fcn.00064894
lea eax, [esi + esi*2]
mov edx, dword [ebp - 0x24]
lea eax, [edx + eax*4 + 8]
mov edx, dword [ebp - 0x20]
add edx, 8
call fcn.00015408
jmp 0x10ce14
mov eax, dword [0x149c20]
mov eax, dword [eax]
mov edx, 0x10d81c
call fcn.00064894
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x15c]
mov edx, 0x10da78
call fcn.00015650
lea eax, [ebp - 0x15c]
push eax
push 4
push 0
mov ecx, 0x10d804
mov edx, 0x10d738
mov eax, dword [ebp - 4]
call fcn.0010640c
cmp al, 0x30
jne 0x10ce6f
mov eax, dword [ebp - 0x1c]
push eax
lea eax, [esi + esi*2]
mov edx, dword [ebp - 0x24]
movzx ecx, word [edx + eax*4 + 4]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00108dd4
cmp al, 0x30
jne 0x10ce6b
xor ebx, ebx
jmp 0x10ce71
mov bl, 1
jmp 0x10ce71
mov bl, 1
mov eax, dword [0x149c7c]
cmp byte [eax], 0
je 0x10cfe4
test bl, bl
jne 0x10cfe4
push 0xffffffffffffffff
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x10d890
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.000cf054
lea eax, [ebp - 0x160]
mov ecx, dword [ebp - 0x14]
mov edx, 0x10d8f4
call fcn.000140b0
mov edx, dword [ebp - 0x160]
mov eax, dword [0x149c20]
mov eax, dword [eax]
call fcn.00064894
mov eax, dword [ebp - 0x14]
mov edx, 0x10d7f8
call fcn.00014174
jne 0x10cf87
push 0x10d804
push 0
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x10d890
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.000cf438
mov eax, dword [ebp - 0x18]
mov edx, 0x10d7f8
call fcn.00014174
jne 0x10cf1a
push 0x10d804
push 0
lea eax, [ebp - 0x20]
push eax
mov ecx, 0x10d890
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.000cf65c
mov eax, dword [ebp - 0x20]
call fcn.00016574
test eax, eax
je 0x10cf76
lea edx, [ebp - 0x168]
mov eax, dword [ebp - 0x20]
add eax, 8
call fcn.00015e9c
mov ecx, dword [ebp - 0x168]
lea eax, [ebp - 0x164]
mov edx, 0x10d968
call fcn.000140b0
mov edx, dword [ebp - 0x164]
mov eax, dword [0x149c20]
mov eax, dword [eax]
call fcn.00064894
lea eax, [esi + esi*2]
mov edx, dword [ebp - 0x24]
lea eax, [edx + eax*4 + 8]
mov edx, dword [ebp - 0x20]
add edx, 8
call fcn.00015408
jmp 0x10cf87
mov eax, dword [0x149c20]
mov eax, dword [eax]
mov edx, 0x10d968
call fcn.00064894
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x178]
mov edx, 0x10da78
call fcn.00015650
lea eax, [ebp - 0x178]
push eax
push 4
push 0
mov ecx, 0x10d804
mov edx, 0x10d890
mov eax, dword [ebp - 4]
call fcn.0010640c
cmp al, 0x30
jne 0x10cfe2
mov eax, dword [ebp - 0x1c]
push eax
lea eax, [esi + esi*2]
mov edx, dword [ebp - 0x24]
movzx ecx, word [edx + eax*4 + 4]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00109e6c
cmp al, 0x30
jne 0x10cfde
xor ebx, ebx
jmp 0x10cfe4
mov bl, 1
jmp 0x10cfe4
mov bl, 1
test bl, bl
jne 0x10d3c1
mov eax, dword [0x149c20]
mov eax, dword [eax]
mov edx, 0x10da84
call fcn.00064894
push 0
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x10da9c
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.000cf054
lea eax, [ebp - 0x17c]
mov ecx, dword [ebp - 0x14]
mov edx, 0x10db08
call fcn.000140b0
mov edx, dword [ebp - 0x17c]
mov eax, dword [0x149c20]
mov eax, dword [eax]
call fcn.00064894
mov eax, dword [ebp - 0x14]
mov edx, 0x10d7f8
call fcn.00014174
jne 0x10d3c1
push 0x10d804
push 0
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x10da9c
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.000cf438
mov eax, dword [ebp - 0x18]
mov edx, 0x10d7f8
call fcn.00014174
jne 0x10d090
push 0x10d804
push 0
lea eax, [ebp - 0x20]
push eax
mov ecx, 0x10da9c
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.000cf65c
mov eax, dword [ebp - 0x20]
call fcn.00016574
test eax, eax
je 0x10d0ea
lea edx, [ebp - 0x184]
mov eax, dword [ebp - 0x20]
add eax, 8
call fcn.00015e9c
mov ecx, dword [ebp - 0x184]
lea eax, [ebp - 0x180]
mov edx, 0x10db84
call fcn.000140b0
mov edx, dword [ebp - 0x180]
mov eax, dword [0x149c20]
mov eax, dword [eax]
call fcn.00064894
lea eax, [esi + esi*2]
mov edx, dword [ebp - 0x24]
lea eax, [edx + eax*4 + 8]
mov edx, dword [ebp - 0x20]
add edx, 8
call fcn.00015408
mov bl, 1
jmp 0x10d3c1
push 0
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x10d738
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.000cf054
lea eax, [ebp - 0x188]
mov ecx, dword [ebp - 0x14]
mov edx, 0x10d790
call fcn.000140b0
mov edx, dword [ebp - 0x188]
mov eax, dword [0x149c20]
mov eax, dword [eax]
call fcn.00064894
mov eax, dword [ebp - 0x14]
mov edx, 0x10d7f8
call fcn.00014174
jne 0x10d1f1
push 0x10d804
push 0
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x10d738
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.000cf438
mov eax, dword [ebp - 0x18]
mov edx, 0x10d7f8
call fcn.00014174
jne 0x10d184
push 0x10d804
push 0
lea eax, [ebp - 0x20]
push eax
mov ecx, 0x10d738
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.000cf65c
mov eax, dword [ebp - 0x20]
call fcn.00016574
test eax, eax
je 0x10d1e0
lea edx, [ebp - 0x190]
mov eax, dword [ebp - 0x20]
add eax, 8
call fcn.00015e9c
mov ecx, dword [ebp - 0x190]
lea eax, [ebp - 0x18c]
mov edx, 0x10d81c
call fcn.000140b0
mov edx, dword [ebp - 0x18c]
mov eax, dword [0x149c20]
mov eax, dword [eax]
call fcn.00064894
lea eax, [esi + esi*2]
mov edx, dword [ebp - 0x24]
lea eax, [edx + eax*4 + 8]
mov edx, dword [ebp - 0x20]
add edx, 8
call fcn.00015408
jmp 0x10d1f1
mov eax, dword [0x149c20]
mov eax, dword [eax]
mov edx, 0x10d81c
call fcn.00064894
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x1a0]
mov edx, 0x10dc00
call fcn.00015650
lea eax, [ebp - 0x1a0]
push eax
push 4
push 0
mov ecx, 0x10d804
mov edx, 0x10d738
mov eax, dword [ebp - 4]
call fcn.0010640c
cmp al, 0x30
jne 0x10d24c
mov eax, dword [ebp - 0x1c]
push eax
lea eax, [esi + esi*2]
mov edx, dword [ebp - 0x24]
movzx ecx, word [edx + eax*4 + 4]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00108dd4
cmp al, 0x30
jne 0x10d248
xor ebx, ebx
jmp 0x10d24e
mov bl, 1
jmp 0x10d24e
mov bl, 1
mov eax, dword [0x149c7c]
cmp byte [eax], 0
je 0x10d3c1
test bl, bl
jne 0x10d3c1
push 0xffffffffffffffff
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x10d890
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.000cf054
lea eax, [ebp - 0x1a4]
mov ecx, dword [ebp - 0x14]
mov edx, 0x10d8f4
call fcn.000140b0
mov edx, dword [ebp - 0x1a4]
mov eax, dword [0x149c20]
mov eax, dword [eax]
call fcn.00064894
mov eax, dword [ebp - 0x14]
mov edx, 0x10d7f8
call fcn.00014174
jne 0x10d364
push 0x10d804
push 0
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x10d890
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.000cf438
mov eax, dword [ebp - 0x18]
mov edx, 0x10d7f8
call fcn.00014174
jne 0x10d2f7
push 0x10d804
push 0
lea eax, [ebp - 0x20]
push eax
mov ecx, 0x10d890
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
call fcn.000cf65c
mov eax, dword [ebp - 0x20]
call fcn.00016574
test eax, eax
je 0x10d353
lea edx, [ebp - 0x1ac]
mov eax, dword [ebp - 0x20]
add eax, 8
call fcn.00015e9c
mov ecx, dword [ebp - 0x1ac]
lea eax, [ebp - 0x1a8]
mov edx, 0x10d968
call fcn.000140b0
mov edx, dword [ebp - 0x1a8]
mov eax, dword [0x149c20]
mov eax, dword [eax]
call fcn.00064894
lea eax, [esi + esi*2]
mov edx, dword [ebp - 0x24]
lea eax, [edx + eax*4 + 8]
mov edx, dword [ebp - 0x20]
add edx, 8
call fcn.00015408
jmp 0x10d364
mov eax, dword [0x149c20]
mov eax, dword [eax]
mov edx, 0x10d968
call fcn.00064894
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x1bc]
mov edx, 0x10dc00
call fcn.00015650
lea eax, [ebp - 0x1bc]
push eax
push 4
push 0
mov ecx, 0x10d804
mov edx, 0x10d890
mov eax, dword [ebp - 4]
call fcn.0010640c
cmp al, 0x30
jne 0x10d3bf
mov eax, dword [ebp - 0x1c]
push eax
lea eax, [esi + esi*2]
mov edx, dword [ebp - 0x24]
movzx ecx, word [edx + eax*4 + 4]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00109e6c
cmp al, 0x30
jne 0x10d3bb
xor ebx, ebx
jmp 0x10d3c1
mov bl, 1
jmp 0x10d3c1
mov bl, 1
test bl, bl
je 0x10d3fa
lea ebx, [esi + esi*2]
mov eax, dword [ebp - 0x24]
mov byte [eax + ebx*4 + 6], 1
mov eax, dword [ebp - 0x24]
mov edx, dword [eax + ebx*4]
lea eax, [ebp - 0x1c0]
mov ecx, 0x10dc0c
call fcn.000140b0
mov edx, dword [ebp - 0x1c0]
mov eax, dword [0x149c20]
mov eax, dword [eax]
call fcn.00064894
jmp 0x10d42d
lea ebx, [esi + esi*2]
mov eax, dword [ebp - 0x24]
mov byte [eax + ebx*4 + 6], 0
mov eax, dword [ebp - 0x24]
mov edx, dword [eax + ebx*4]
lea eax, [ebp - 0x1c4]
mov ecx, 0x10dc28
call fcn.000140b0
mov edx, dword [ebp - 0x1c4]
mov eax, dword [0x149c20]
mov eax, dword [eax]
call fcn.00064894
inc esi
dec edi
jne 0x10bf32
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x24]
mov ecx, dword [0x1048c0]
call fcn.00016884
mov eax, dword [0x149c70]
mov eax, dword [eax]
call fcn.000650e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x10d480
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x10d641
lea eax, [ebp - 0x1c4]
mov edx, 2
call fcn.00013e08
lea eax, [ebp - 0x1bc]
call fcn.00015e34
lea eax, [ebp - 0x1ac]
mov edx, 3
call fcn.00013e08
lea eax, [ebp - 0x1a0]
call fcn.00015e34
lea eax, [ebp - 0x190]
mov edx, 6
call fcn.00013e08
lea eax, [ebp - 0x178]
call fcn.00015e34
lea eax, [ebp - 0x168]
mov edx, 3
call fcn.00013e08
lea eax, [ebp - 0x15c]
call fcn.00015e34
lea eax, [ebp - 0x14c]
mov edx, 3
call fcn.00013e08
lea eax, [ebp - 0x140]
call fcn.00015e34
lea eax, [ebp - 0x130]
mov edx, 3
call fcn.00013e08
lea eax, [ebp - 0x124]
call fcn.00015e34
lea eax, [ebp - 0x114]
mov edx, 3
call fcn.00013e08
lea eax, [ebp - 0x108]
call fcn.00015e34
lea eax, [ebp - 0xf8]
mov edx, 3
call fcn.00013e08
lea eax, [ebp - 0xec]
call fcn.00015e34
lea eax, [ebp - 0xdc]
mov edx, 3
call fcn.00013e08
lea eax, [ebp - 0xd0]
call fcn.00015e34
lea eax, [ebp - 0xc0]
mov edx, 3
call fcn.00013e08
lea eax, [ebp - 0xb4]
call fcn.00015e34
lea eax, [ebp - 0xa4]
mov edx, 3
call fcn.00013e08
lea eax, [ebp - 0x98]
call fcn.00015e34
lea eax, [ebp - 0x88]
mov edx, 3
call fcn.00013e08
lea eax, [ebp - 0x7c]
call fcn.00015e34
lea eax, [ebp - 0x6c]
mov edx, 3
call fcn.00013e08
lea eax, [ebp - 0x60]
call fcn.00015e34
lea eax, [ebp - 0x50]
mov edx, 3
call fcn.00013e08
lea eax, [ebp - 0x44]
call fcn.00015e34
lea eax, [ebp - 0x34]
mov edx, 4
call fcn.00013e08
lea eax, [ebp - 0x24]
mov edx, dword [0x1048c0]
call fcn.00016848
lea eax, [ebp - 0x20]
mov edx, dword [0xcef14]
call fcn.00016848
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00013e08
lea eax, [ebp - 8]
call fcn.00013de4
ret