Function at 0x10074000
Capabilities:
Check for software breakpoints
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100ab100
push 0x10085f9a
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x100ae8c8]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x1cc], ebx
wait
mov dword [ebp - 4], 0
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov dword [0x1012d22c], eax
mov eax, dword [0x361f6dc]
mov dword [ebp - 0x1c8], eax
cmp byte [0x1012d408], 1
jne 0x1007410c
test eax, eax
jne 0x10074110
cmp dword [ebx + 4], 0x1b0014
jne 0x1007410c
push 0x7d
push eax
lea eax, [ebp - 0xb0]
push eax
call sub.MSVCR100.dll_memset
push 0x101a44fc
push 0x101a45cc
push 0x1009561c
lea ecx, [ebp - 0xb0]
push ecx
mov esi, dword [sym.imp.MSVCR100.dll_sprintf]
call esi
add esp, 0x1c
lea edx, [ebp - 0xb0]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x291
mov eax, dword [0x1011956c]
push eax
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
call edi
push 0x101a45cc
push 0x100a1824
lea ecx, [ebp - 0xb0]
push ecx
call esi
add esp, 0xc
lea edx, [ebp - 0xb0]
push edx
mov eax, dword [0x100eaf2c]
push eax
push 0x2712
mov ecx, dword [0x1011956c]
push ecx
call edi
wait
jmp 0x100767e6
test eax, eax
je 0x10074106
call edi
mov dword [0x1012d230], eax
mov edx, dword [ebp - 0x1c8]
movzx esi, word [edx + 0x14]
mov dword [ebp - 0x1c4], esi
push ebx
call fcn.10072910
push ebx
call fcn.1005c8a0
add esp, 8
movzx eax, word [ebx + 4]
cmp eax, 0x65
je 0x10074149
cmp eax, 0x2f
je 0x10074149
cmp eax, 0xa
jne 0x10074153
movzx eax, word [ebx]
mov byte [eax + 0x1011d208], 0
mov eax, dword [ebx + 4]
cmp eax, 0x40080
jne 0x10074169
mov dword [ebx + 8], 0
jmp 0x100742fd
cmp eax, 0xb80051
jne 0x100742fd
mov al, byte [ebx + 8]
cmp al, 0x15
jne 0x100741a9
call edi
sub eax, dword [0x1011cd8c]
push eax
push 0x100a180c
mov dword [0x1011cd88], eax
lea ecx, [ebp - 0xf8]
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
push 8
lea edx, [ebp - 0xf8]
push edx
jmp 0x100742f5
cmp al, 0x16
jne 0x100741db
call edi
sub eax, dword [0x1011cd8c]
push eax
push 0x100a17f4
mov dword [0x1011cd88], eax
lea eax, [ebp - 0xf8]
push eax
call dword [sym.imp.MSVCR100.dll_sprintf]
push 8
lea ecx, [ebp - 0xf8]
push ecx
jmp 0x100742f5
cmp al, 0x17
jne 0x100741f2
call edi
sub eax, dword [0x1011cd8c]
push eax
push 0x100a17e0
jmp 0x100742da
cmp al, 0xb
je 0x100742cc
cmp al, 0x29
je 0x100742cc
cmp al, 0xc
je 0x100742b9
cmp al, 0x2a
je 0x100742b9
cmp al, 0xd
je 0x100742a6
cmp al, 0x2b
je 0x100742a6
cmp al, 0x3d
jne 0x10074239
call edi
sub eax, dword [0x1011cd8c]
push eax
push 0x100a17cc
jmp 0x10074189
cmp al, 0x3e
jne 0x10074250
call edi
sub eax, dword [0x1011cd8c]
push eax
push 0x100a17b8
jmp 0x100741bb
cmp al, 0x3f
jne 0x10074264
call edi
sub eax, dword [0x1011cd8c]
push eax
push 0x100a17a4
jmp 0x100742da
cmp al, 0xc9
jne 0x1007427b
call edi
sub eax, dword [0x1011cd8c]
push eax
push 0x100a1790
jmp 0x10074189
cmp al, 0xca
jne 0x10074292
call edi
sub eax, dword [0x1011cd8c]
push eax
push 0x100a1778
jmp 0x100741bb
cmp al, 0xcb
jne 0x100742fd
call edi
sub eax, dword [0x1011cd8c]
push eax
push 0x100a1760
jmp 0x100742da
call edi
sub eax, dword [0x1011cd8c]
push eax
push 0x100a174c
jmp 0x10074189
call edi
sub eax, dword [0x1011cd8c]
push eax
push 0x100a1738
jmp 0x100741bb
call edi
sub eax, dword [0x1011cd8c]
push eax
push 0x100a1720
lea edx, [ebp - 0xf8]
push edx
mov dword [0x1011cd88], eax
call dword [sym.imp.MSVCR100.dll_sprintf]
push 8
lea eax, [ebp - 0xf8]
push eax
call fcn.1003a930
add esp, 0x14
movzx ecx, word [ebx]
mov eax, ecx
cmp eax, esi
jne 0x100743d8
cmp word [ebx + 4], 4
jne 0x10074322
cmp byte [ebx + 8], 1
mov byte [0x1012d410], 1
wait
jmp 0x100767e6
cmp eax, esi
jne 0x100743d8
cmp word [ebx + 4], 0x6a
jne 0x100743d8
mov eax, dword [ebx + 0x30]
mov ecx, dword [ebx + 0x34]
mov edx, eax
or edx, ecx
je 0x1007437c
mov edx, dword [0x33cf8b4]
mov esi, dword [0x33cf8b8]
sub eax, edx
sbb ecx, esi
mov edx, dword [0x1012d290]
add edx, eax
mov dword [0x1012d290], edx
mov eax, dword [0x1012d294]
adc eax, ecx
mov dword [0x1012d294], eax
mov dword [0x1012d2a0], edx
mov dword [0x1012d2a4], eax
wait
jmp 0x100767e6
mov eax, 0x69
cmp al, byte [0x33cbd84]
sbb eax, eax
and eax, 9
inc eax
cdq
push edx
push eax
mov ecx, dword [ebx + 0xc]
push ecx
mov edx, dword [ebx + 8]
push edx
call fcn.10086030
mov ecx, dword [0x33cbde8]
mov esi, dword [0x33cbdec]
sub ecx, eax
sbb esi, edx
mov eax, dword [0x1012d290]
add eax, ecx
mov dword [0x1012d290], eax
mov ecx, dword [0x1012d294]
adc ecx, esi
mov dword [0x1012d294], ecx
mov dword [0x1012d2a0], eax
mov dword [0x1012d2a4], ecx
wait
jmp 0x100767e6
movzx edx, word [ebx + 4]
cmp edx, 0x7b
jne 0x10074575
cmp dword [0x10191854], 1
jne 0x10074575
movzx eax, word [ebx + 0x10]
push eax
call fcn.10006f30
add esp, 4
mov edi, eax
test edi, edi
je 0x10074106
fld dword [ebx + 0x1e]
call fcn.10085e30
mov dword [ebp - 0x1cc], eax
fld dword [ebx + 0x26]
call fcn.10085e30
mov dword [ebp - 0x1c4], eax
push 0xaf2ae4
mov ecx, dword [ebp - 0x1c8]
mov edx, dword [ecx + 0x1d24]
push edx
call fcn.10006f00
add esp, 8
test eax, eax
jne 0x10074106
cmp dword [0x1011d1ac], eax
je 0x10074106
mov eax, 1
mov dword [ebp - 0x1d4], eax
cmp dword [0x10191868], eax
jne 0x100744c1
xor esi, esi
mov dword [ebp - 0x1d4], esi
mov dword [ebp - 0x230], esi
mov ecx, 0x1019b954
call fcn.10001240
cmp esi, eax
jge 0x100744bc
mov ecx, edi
mov eax, dword [0x1019b954]
mov eax, dword [eax + esi*4]
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100744b0
test dl, dl
je 0x100744ac
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100744b0
add eax, 2
add ecx, 2
test dl, dl
jne 0x10074490
xor eax, eax
jmp 0x100744b5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x100744cd
inc esi
jmp 0x1007446e
mov eax, 1
cmp dword [ebp - 0x1d4], eax
jne 0x10074831
fild dword [ebp - 0x1c4]
fstp dword [ebp - 0x1c4]
fild dword [ebp - 0x1cc]
fstp dword [ebp - 0x1cc]
sub esp, 0x10
fld dword [ebp - 0x1c4]
fstp dword [esp + 0xc]
fld dword [ebp - 0x1cc]
fstp dword [esp + 8]
fld dword [0x1012d2ac]
fstp dword [esp + 4]
fld dword [0x1012d2a8]
fstp dword [esp]
call fcn.100081f0
add esp, 0x10
fild dword [0x1012d2cc]
fcompp
fnstsw ax
test ah, 0x41
jnp 0x10074106
sub esp, 8
fld dword [ebp - 0x1c4]
fstp dword [esp + 4]
fld dword [ebp - 0x1cc]
fstp dword [esp]
call fcn.10037870
fld dword [ebp - 0x1c4]
fstp dword [esp + 4]
fld dword [ebp - 0x1cc]
fstp dword [esp]
movzx ecx, word [ebx]
push ecx
push 0xffffffffffffffff
call fcn.100378c0
movzx edx, word [ebx]
push edx
call fcn.100377a0
add esp, 0x14
wait
jmp 0x100767e6
cmp eax, esi
jne 0x100745b9
mov edi, 0x84
cmp word [ebx + 2], di
jne 0x100745b3
movzx eax, word [ebx + 0xa]
cmp eax, 0xb
je 0x1007459b
mov ecx, 0x3f3
cmp ax, cx
jne 0x10074831
movzx edx, word [ebx + 0xc]
push edx
movzx eax, word [ebx + 8]
push eax
call fcn.10007a30
add esp, 8
wait
jmp 0x100767e6
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp edx, 0x65
jne 0x10074980
cmp esi, eax
jne 0x10074611
cmp byte [0x1012d418], 1
jne 0x1007461a
cmp dword [0x1012d3e4], 0
jne 0x1007461a
fld dword [ebx + 0xc]
call fcn.10085e30
mov esi, eax
fld dword [ebx + 0x14]
call fcn.10085e30
push eax
push esi
push 0x100a1710
lea ecx, [ebp - 0x94]
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
push 0xf
lea edx, [ebp - 0x94]
push edx
call fcn.1003a930
add esp, 0x18
jmp 0x1007461a
push eax
call fcn.1006ada0
add esp, 4
cmp dword [0x10198028], 1
jne 0x10074106
call edi
sub eax, dword [0x1012d260]
cmp eax, 0x1388
jb 0x10074106
cmp dword [0x33cbdd0], 0
jle 0x10074106
mov eax, 1
cmp dword [0x10197d80], eax
jne 0x10074106
cmp dword [0x1012d3e4], eax
jne 0x10074106
fld dword [ebx + 0xc]
call fcn.10085e30
mov dword [ebp - 0x1c4], eax
fld dword [ebx + 0x14]
call fcn.10085e30
mov dword [ebp - 0x1cc], eax
movzx eax, word [ebx]
push eax
lea ecx, [ebp - 0x94]
push ecx
call fcn.1003c3a0
add esp, 8
test al, al
je 0x10074106
movzx edx, word [ebx]
push edx
lea eax, [ebp - 0x1c0]
push eax
call fcn.1003c3e0
mov edi, dword [ebp - 0x1c8]
fld dword [edi + 0x1f6c]
fstp dword [esp + 4]
fld dword [edi + 0x1f64]
fstp dword [esp]
fild dword [ebp - 0x1cc]
sub esp, 8
fstp dword [esp + 4]
fild dword [ebp - 0x1c4]
fstp dword [esp]
call fcn.100081f0
add esp, 0x10
fild dword [0x10197d7c]
fcompp
fnstsw ax
test ah, 0x41
jne 0x10074831
xor esi, esi
lea ebx, [esi + 2]
mov dword [ebp - 0x218], esi
mov ecx, 0x101a2068
call fcn.10001240
cmp esi, eax
jge 0x1007483d
mov ecx, dword [0x101a2068]
mov ecx, dword [ecx + esi*4]
lea eax, [ebp - 0x94]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x1007473f
test dl, dl
je 0x1007473b
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x1007473f
add eax, ebx
add ecx, ebx
test dl, dl
jne 0x10074721
xor eax, eax
jmp 0x10074744
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x10074837
cmp dword [0x1011cd68], ebx
jne 0x100747a0
cmp dword [0x10198018], 1
jne 0x100747a0
sub esp, 0x10
fld dword [0x1012d2ac]
fstp dword [esp + 0xc]
fld dword [0x1012d2a8]
fstp dword [esp + 8]
fild dword [ebp - 0x1cc]
fstp dword [esp + 4]
fild dword [ebp - 0x1c4]
fstp dword [esp]
call fcn.100081f0
add esp, 0x10
fcomp dword [0x100a10dc]
fnstsw ax
test ah, 1
je 0x1007483d
mov edx, dword [ebp - 0x1cc]
push edx
mov eax, dword [ebp - 0x1c4]
push eax
call fcn.1003a750
add esp, 8
test al, al
je 0x1007483d
fld dword [edi + 0x1f6c]
call fcn.10085e30
push eax
fld dword [edi + 0x1f64]
call fcn.10085e30
push eax
call fcn.1003a750
add esp, 8
test al, al
je 0x1007483d
mov ecx, dword [0x101a2068]
mov edx, dword [ecx + esi*4]
push edx
push 0x100a10bc
lea eax, [ebp - 0xf8]
push eax
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
cmp dword [0x10197d88], 1
jne 0x10074820
push ebx
lea ecx, [ebp - 0xf8]
push ecx
call fcn.10069f30
add esp, 8
wait
jmp 0x100767e6
push 0
lea edx, [ebp - 0xf8]
push edx
call fcn.10069f30
add esp, 8
wait
jmp 0x100767e6
inc esi
jmp 0x100746fa
xor esi, esi
mov dword [ebp - 0x22c], esi
mov ecx, 0x101a2080
call fcn.10001240
cmp esi, eax
jge 0x10074831
mov eax, dword [0x101a2080]
mov ecx, dword [eax + esi*4]
lea eax, [ebp - 0x1c0]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x1007487f
test dl, dl
je 0x1007487b
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x1007487f
add eax, ebx
add ecx, ebx
test dl, dl
jne 0x10074861
xor eax, eax
jmp 0x10074884
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1007497a
cmp dword [0x1011cd68], ebx
jne 0x100748e0
cmp dword [0x10198018], 1
jne 0x100748e0
sub esp, 0x10
fld dword [0x1012d2ac]
fstp dword [esp + 0xc]
fld dword [0x1012d2a8]
fstp dword [esp + 8]
fild dword [ebp - 0x1cc]
fstp dword [esp + 4]
fild dword [ebp - 0x1c4]
fstp dword [esp]
call fcn.100081f0
add esp, 0x10
fcomp dword [0x100a10dc]
fnstsw ax
test ah, 1
je 0x10074831
mov ecx, dword [ebp - 0x1cc]
push ecx
mov edx, dword [ebp - 0x1c4]
push edx
call fcn.1003a750
add esp, 8
test al, al
je 0x10074831
fld dword [edi + 0x1f6c]
call fcn.10085e30
push eax
fld dword [edi + 0x1f64]
call fcn.10085e30
push eax
call fcn.1003a750
add esp, 8
test al, al
je 0x10074831
mov eax, dword [0x101a2080]
mov ecx, dword [eax + esi*4]
push ecx
push 0x100a1094
lea edx, [ebp - 0xf8]
push edx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
cmp dword [0x10197d88], 1
jne 0x10074963
push ebx
lea eax, [ebp - 0xf8]
push eax
call fcn.10069f30
add esp, 8
wait
jmp 0x100767e6
push 0
lea ecx, [ebp - 0xf8]
push ecx
call fcn.10069f30
add esp, 8
wait
jmp 0x100767e6
inc esi
jmp 0x1007483f
cmp esi, eax
je 0x100749a8
cmp dword [ebx + 6], 0x10070
jne 0x100749a4
mov edx, dword [ebx + 0x28]
mov dword [0x1011b6e0], edx
mov eax, dword [ebx + 0x2c]
mov dword [0x1011b6e4], eax
wait
jmp 0x100767e6
cmp esi, eax
jne 0x10074a09
cmp edx, 0x78
jne 0x100749f7
mov ecx, dword [0x12b4a90]
mov edx, dword [ecx + 0x4cc]
mov eax, dword [0x361f6dc]
mov ecx, dword [edx + 0x388]
cmp ecx, dword [eax + 0x14]
jne 0x10074831
mov eax, dword [0x101976ac]
test eax, eax
jle 0x10074831
movzx edx, word [ebx + 0x30]
inc edx
cmp eax, edx
je 0x10074831
dec eax
push eax
call fcn.1003b650
add esp, 4
wait
jmp 0x100767e6
cmp esi, eax
jne 0x10074a09
mov edi, 0x93
cmp dx, di
je 0x10074831
mov edi, 0x88
cmp dx, di
jne 0x10074b88
cmp eax, esi
jne 0x10074ac0
cmp word [ebx + 0x1c], 0
jne 0x10074ac0
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x101b8d1c]
cmp eax, 0x3e8
jbe 0x10074106
movzx eax, word [ebx + 6]
cmp eax, 0x1c
jne 0x10074aad
cmp word [ebx + 0xc], 2
jne 0x10074a73
mov byte [0x1012d404], 0
inc dword [0x1012d37c]
call esi
mov dword [0x101b8d1c], eax
inc dword [0x1012d384]
wait
jmp 0x100767e6
cmp eax, 0x1c
jne 0x10074aad
cmp word [ebx + 0xc], 0
jne 0x10074aad
mov byte [0x1012d404], 1
mov eax, dword [0x35ec500]
cmp eax, 0x321
je 0x10074aad
cmp eax, 0xfa1
je 0x10074aad
cmp eax, 0x1c85
je 0x10074aad
cmp eax, 0x9ca5
je 0x10074aad
inc dword [0x1012d380]
call esi
mov dword [0x101b8d1c], eax
inc dword [0x1012d384]
wait
jmp 0x100767e6
mov esi, dword [ebp - 0x1c8]
mov eax, dword [esi + 0x1d24]
push 0xaf2ae4
push eax
call fcn.10006f00
add esp, 8
test eax, eax
je 0x10074106
mov cx, word [ebx]
cmp cx, word [eax + 0x14]
jne 0x10074106
mov ecx, dword [0x35ec500]
cmp ecx, 0x515
je 0x10074b15
cmp ecx, 0x7594
je 0x10074b15
cmp ecx, 0x75f8
je 0x10074b15
cmp ecx, 0x765c
jne 0x10074b40
mov ecx, dword [eax + 0x10a4]
fld dword [ecx + 0x284]
fsub dword [esi + 0x1f68]
fcomp qword [0x100a1708]
fnstsw ax
test ah, 0x41
jne 0x10074b40
mov edx, dword [ecx + 0x284]
mov dword [esi + 0x1f68], edx
mov eax, 1
add dword [0x1012d3dc], eax
cmp dword [0x1011d1b4], 0
jle 0x10074b7b
cmp dword [0x10191854], eax
jne 0x10074b7b
cmp dword [0x1019185c], eax
jne 0x10074b76
call fcn.10073600
mov byte [0x1012d3f8], 0
wait
jmp 0x100767e6
call fcn.10073530
mov byte [0x1012d3f8], 0
wait
jmp 0x100767e6
mov edi, 0x1540
cmp dx, di
jne 0x10074c00
cmp eax, esi
jne 0x10074831
cmp word [ebx + 8], 0
jbe 0x10074831
movzx ecx, word [ebx + 0x10]
cmp ecx, 0x13
jne 0x10074bcb
cmp dword [0x1012d3e4], 1
jne 0x10074bcb
push eax
push 0x1009c994
call fcn.10006c10
add esp, 8
wait
jmp 0x100767e6
cmp dword [0x1019efa8], 1
jne 0x10074831
push ecx
call fcn.100803c0
add esp, 4
cmp al, 1
jne 0x10074831
movzx ecx, word [ebx]
push ecx
push 0x1009c994
call fcn.10006c10
add esp, 8
wait
jmp 0x100767e6
cmp edx, 0x72
jne 0x10074e1a
cmp dword [0x101956bc], 1
jne 0x10074e1a
cmp dword [0x1011cd68], 2
je 0x10074e1a
xor eax, eax
mov dword [ebp - 0x1e0], eax
lea esi, [ebx + 0xc]
mov dword [ebp - 0x1f8], esi
mov dword [ebp - 0x1dc], eax
lea ebx, [ebx]
movzx edx, byte [ebx + 8]
cmp dword [ebp - 0x1dc], edx
jge 0x10074831
fld dword [esi + 0x14]
call fcn.10085e30
mov dword [ebp - 0x1d4], eax
fld dword [esi + 0x1c]
call fcn.10085e30
mov dword [ebp - 0x1c4], eax
mov eax, dword [esi + 0x20]
mov dword [ebp - 0x20], eax
fild dword [ebp - 0x1c4]
sub esp, 0x10
fstp dword [esp + 0xc]
fild dword [ebp - 0x1d4]
fstp dword [esp + 8]
mov eax, dword [ebp - 0x1c8]
fld dword [eax + 0x1f6c]
fstp dword [esp + 4]
fld dword [eax + 0x1f64]
fstp dword [esp]
call fcn.100081f0
add esp, 0x10
call fcn.10085e30
mov edi, eax
xor ecx, ecx
xor eax, eax
mov edx, dword [0x1011aed4]
mov dword [ebp - 0x234], eax
cmp eax, edx
jge 0x10074cd3
mov ebx, dword [eax*4 + 0x10119570]
cmp ebx, dword [esi]
je 0x10074d28
inc eax
jmp 0x10074cbb
test ecx, ecx
jne 0x10074d28
cmp dword [0x1012d3e4], 1
jne 0x10074d28
cmp dword [0x101956d0], 1
jne 0x10074d28
mov ecx, dword [esi]
mov dword [edx*4 + 0x10119570], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [0x1011aed4]
mov dword [edx*4 + 0x10119d40], eax
mov eax, dword [0x1011aed4]
mov byte [eax + 0x1011a510], 0
mov ecx, dword [0x1011aed4]
mov dword [ecx*4 + 0x1011a704], 0
inc dword [0x1011aed4]
cmp edi, 0x96
jg 0x10074dea
cmp dword [0x101956dc], 1
jne 0x10074d80
fild dword [0x1012d3c4]
sub esp, 0x10
fstp dword [esp + 0xc]
fild dword [0x1012d3c0]
fstp dword [esp + 8]
fild dword [ebp - 0x1c4]
fstp dword [esp + 4]
fild dword [ebp - 0x1d4]
fstp dword [esp]
call fcn.100081f0
add esp, 0x10
fcomp dword [0x100a00a0]
fnstsw ax
test ah, 5
jnp 0x10074106
fild dword [0x100ae390]
sub esp, 0x10
fstp dword [esp + 0xc]
fild dword [0x100ae38c]
fstp dword [esp + 8]
fild dword [ebp - 0x1c4]
fstp dword [esp + 4]
fild dword [ebp - 0x1d4]
fstp dword [esp]
call fcn.100081f0
add esp, 0x10
fcomp dword [0x100a00a0]
fnstsw ax
test ah, 5
jnp 0x10074106
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [esi + 4]
push eax
lea ecx, [ebp - 0x94]
push ecx
mov edx, dword [esi + 8]
push edx
call fcn.1004a950
add esp, 8
push eax
mov eax, dword [esi]
push eax
call fcn.1004aa40
add esp, 0x10
add esi, 0x68
mov dword [ebp - 0x1f8], esi
mov eax, dword [ebp - 0x1e0]
inc eax
mov dword [ebp - 0x1e0], eax
cmp eax, 0x10
jg 0x10074831
inc dword [ebp - 0x1dc]
mov ebx, dword [ebp - 0x1cc]
jmp 0x10074c40
cmp edx, 0xc
jne 0x10074f3c
movzx esi, word [ebx + 8]
imul esi, esi, 0x1cc
xor edi, edi
mov dword [ebp - 0x1ec], edi
mov ecx, 0x101a2044
call fcn.10001240
cmp edi, eax
jge 0x10074e9e
lea ecx, [esi + 0xfb9e9a]
mov edx, dword [0x101a2020]
mov eax, dword [edx + edi*4]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10074e72
test dl, dl
je 0x10074e6e
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10074e72
add eax, 2
add ecx, 2
test dl, dl
jne 0x10074e52
xor eax, eax
jmp 0x10074e77
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x10074f0a
movzx eax, word [ebx]
mov ecx, dword [0x101a2044]
mov edx, dword [ecx + edi*4]
mov dword [edx], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x101a2038]
mov edx, dword [ecx + edi*4]
mov dword [edx], eax
mov esi, 1
cmp dword [0x10191928], esi
jne 0x10074831
movzx eax, word [ebx + 8]
cmp dword [ebp - 0x1c4], eax
jne 0x10074831
movzx ecx, word [ebx]
push ecx
call fcn.100462a0
add esp, 4
test eax, eax
jle 0x10074831
mov ecx, dword [eax*4 + 0x361f6e0]
cmp dword [ecx], 0xaf2ae4
jne 0x10074106
mov dword [ecx + 0x354], esi
xor ecx, ecx
mov dword [ebp - 0x200], ecx
cmp ecx, 0x1e
jge 0x10074f10
cmp dword [ecx*4 + 0x1012d2d8], eax
je 0x10074106
add ecx, esi
jmp 0x10074eee
inc edi
jmp 0x10074e2f
xor ecx, ecx
mov dword [ebp - 0x228], ecx
cmp ecx, 0x1e
jge 0x10074831
cmp dword [ecx*4 + 0x1012d2d8], 0
jne 0x10074f38
mov dword [ecx*4 + 0x1012d2d8], eax
wait
jmp 0x100767e6
add ecx, esi
jmp 0x10074f12
cmp edx, 0xa
jne 0x100752f1
cmp esi, eax
je 0x10074f58
cmp word [ebx + 8], cx
jne 0x10074f58
push eax
call fcn.1006ada0
add esp, 4
cmp dword [ebx + 0x10], 0
je 0x10074106
movzx edx, word [ebx]
cmp esi, edx
jne 0x10074831
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
add eax, 0x44c
mov dword [0x1011cd90], eax
call esi
mov dword [0x1012d234], eax
push 0xaf2ae4
mov eax, dword [0x361f6dc]
mov ecx, dword [eax + 0x1d24]
push ecx
call fcn.10006f00
add esp, 8
mov edi, eax
mov dword [ebp - 0x20], edi
mov byte [0x1012d3fb], 1
movzx esi, word [ebx + 8]
mov edx, dword [ebx + 0x3c]
mov dword [ebp - 0x1d4], edx
fld dword [ebx + 0x40]
call fcn.10085e30
mov dword [0x1011cd18], eax
fld dword [ebx + 0x44]
call fcn.10085e30
mov dword [0x1011cd14], eax
fld dword [ebx + 0x48]
call fcn.10085e30
mov dword [0x1011cd10], eax
movzx ecx, word [ebx + 0x8f]
mov dword [0x1012d3d0], ecx
cmp esi, 0xbb8
jl 0x1007500a
cmp byte [ebx + 0x53], 0
jne 0x1007500a
mov eax, dword [ebx + 0x10]
cdq
add dword [0x1012d900], eax
adc dword [0x1012d904], edx
cmp ecx, 5
je 0x10075014
cmp ecx, 1
jne 0x10075042
cmp dword [0x1019f3dc], 1
jne 0x1007502b
cmp byte [0x1012d412], 1
jne 0x1007502b
call fcn.1003c5e0
cmp dword [0x1011d1b4], 0
jle 0x10075042
cmp dword [0x10191854], 1
jne 0x10075042
call fcn.1003c5e0
cmp dword [0x1019f498], 1
jne 0x100750a6
cmp byte [0x1012d412], 1
jne 0x100750a6
push 0
call dword [sym.imp.MSVCR100.dll__time64]
push eax
call dword [sym.imp.MSVCR100.dll_srand]
mov eax, dword [ebp - 0x1c8]
fld dword [eax + 0x1f64]
call fcn.10085e30
mov dword [ebp - 0x1c4], eax
mov ecx, dword [ebp - 0x1c8]
fld dword [ecx + 0x1f6c]
call fcn.10085e30
mov dword [ebp - 0x20], eax
fild dword [ebp - 0x20]
fstp dword [esp + 4]
fild dword [ebp - 0x1c4]
fstp dword [esp]
call fcn.10037870
add esp, 8
test edi, edi
je 0x100750b9
movzx edx, word [edi + 0x14]
cmp edx, esi
jne 0x100750b9
mov byte [0x1012d3f7], 1
mov ecx, dword [ebp - 0x1d4]
cmp ecx, 0xc9
jne 0x10075138
cmp dword [ebx + 0x38], 0x7a5d3
jne 0x10075138
mov eax, dword [0x1011cd20]
inc eax
mov dword [0x1011cd20], eax
cmp eax, dword [0x10191de0]
jl 0x10075138
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1011cd84], eax
mov esi, dword [ebp - 0x1c8]
fld dword [esi + 0x1f64]
call fcn.10085e30
mov dword [ebp - 0x1c4], eax
fld dword [esi + 0x1f6c]
call fcn.10085e30
mov dword [ebp - 0x20], eax
fild dword [ebp - 0x20]
sub esp, 8
fstp dword [esp + 4]
fild dword [ebp - 0x1c4]
fstp dword [esp]
call fcn.10037870
add esp, 8
mov ecx, dword [ebp - 0x1d4]
cmp byte [0x1012d3fa], 1
jne 0x10075196
cmp ecx, 0xc9
je 0x10075166
cmp ecx, 0xcd
je 0x10075166
cmp ecx, 0xa6
je 0x10075166
cmp ecx, 0x7e
je 0x10075166
cmp ecx, 0xdc
jne case.default.0x10075b90
mov eax, dword [ebx + 0x38]
cmp eax, 0x7a5d1
je case.default.0x10075b90
cmp eax, 0x7a5d2
je case.default.0x10075b90
cmp eax, 0x7a5d3
je case.default.0x10075b90
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1011cd80], eax
mov byte [0x1012d3fc], 1
wait
jmp 0x100767e6
cmp dword [0x10197fe0], 1
jne 0x100751fa
cmp dword [0x1011cd68], 5
jne 0x100751fa
push 0
call dword [sym.imp.MSVCR100.dll__time64]
push eax
call dword [sym.imp.MSVCR100.dll_srand]
mov esi, dword [ebp - 0x1c8]
fld dword [esi + 0x1f64]
call fcn.10085e30
mov dword [ebp - 0x1c4], eax
fld dword [esi + 0x1f6c]
call fcn.10085e30
mov dword [ebp - 0x20], eax
fild dword [ebp - 0x20]
fstp dword [esp + 4]
fild dword [ebp - 0x1c4]
fstp dword [esp]
call fcn.10037870
add esp, 8
mov ecx, dword [ebp - 0x1d4]
mov eax, 1
cmp dword [0x10191860], eax
jne 0x1007522c
cmp byte [0x1012d405], al
jne 0x1007522c
cmp byte [0x1012d3f9], al
jne 0x1007522c
cmp dword [0x1012d3e4], eax
jne 0x1007522c
mov dword [ebx], 0
mov dword [ebx + 4], 0
cmp ecx, 0xd2
je 0x10075244
cmp ecx, 0xd3
je 0x10075244
cmp ecx, 0xd4
jne 0x10075291
mov eax, dword [0x101a46dc]
add eax, 0x47
push eax
mov ecx, dword [0x100eaf2c]
push ecx
call dword [sym.imp.USER32.dll_KillTimer]
mov al, byte [0x101b8978]
cmp al, 1
jne 0x10075285
push 0x1003c7c0
push 0x7d0
mov edx, dword [0x101a46dc]
add edx, 0x4e
push edx
mov eax, dword [0x100eaf2c]
push eax
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x10075291
mov byte [0x1012d405], al
mov byte [0x1012d3f8], 0
mov byte [0x1012d3fd], 1
mov byte [0x1012d3fe], 1
mov byte [0x1012d3ff], 1
mov byte [0x1012d400], 1
mov dword [0x1012d23c], 0
mov eax, 1
cmp dword [0x1019192c], eax
jne 0x10074831
cmp dword [0x1011d1b4], 0
jle 0x10074831
cmp dword [0x1018de68], eax
je 0x10074831
push 0
call fcn.10072150
add esp, 4
wait
jmp 0x100767e6
cmp edx, 0x2f
jne 0x1007551d
cmp esi, eax
jne 0x10074831
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1012d234], eax
mov byte [0x1012d3fb], 1
mov edi, dword [ebx + 0x16]
fld dword [ebx + 0x1a]
call fcn.10085e30
mov dword [0x1011cd18], eax
fld dword [ebx + 0x1e]
call fcn.10085e30
mov dword [0x1011cd14], eax
fld dword [ebx + 0x22]
call fcn.10085e30
mov dword [0x1011cd10], eax
cmp byte [ebx + 0x26], 0
jne 0x10075378
xor ecx, ecx
mov dword [ebp - 0x208], ecx
cmp ecx, 0x14
jge 0x10075378
movzx eax, word [ebx + ecx*2 + 0x52]
test eax, eax
je 0x10075378
cmp eax, 0xbb8
jl 0x10075375
mov eax, dword [ebx + ecx*4 + 0xa2]
cdq
add dword [0x1012d900], eax
adc dword [0x1012d904], edx
inc ecx
jmp 0x10075346
cmp dword [0x1019f498], 1
jne 0x100753d8
cmp byte [0x1012d412], 1
jne 0x100753d8
push 0
call dword [sym.imp.MSVCR100.dll__time64]
push eax
call dword [sym.imp.MSVCR100.dll_srand]
mov esi, dword [ebp - 0x1c8]
fld dword [esi + 0x1f64]
call fcn.10085e30
mov dword [ebp - 0x1d4], eax
fld dword [esi + 0x1f6c]
call fcn.10085e30
mov dword [ebp - 0x20], eax
fild dword [ebp - 0x20]
fstp dword [esp + 4]
fild dword [ebp - 0x1d4]
fstp dword [esp]
call fcn.10037870
add esp, 8
jmp 0x100753de
mov esi, dword [ebp - 0x1c8]
push 0xaf2ae4
mov ecx, dword [0x361f6dc]
mov edx, dword [ecx + 0x1d24]
push edx
call fcn.10006f00
add esp, 8
test eax, eax
je 0x1007540d
mov ax, word [eax + 0x14]
cmp ax, word [ebx + 8]
jne 0x1007540d
mov byte [0x1012d3f7], 1
cmp edi, 0xc9
jne 0x10075476
cmp dword [ebx + 0x12], 0x7a5d3
jne 0x10075476
mov eax, dword [0x1011cd20]
inc eax
mov dword [0x1011cd20], eax
cmp eax, dword [0x10191de0]
jl 0x10075476
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1011cd84], eax
fld dword [esi + 0x1f64]
call fcn.10085e30
mov dword [ebp - 0x1d4], eax
fld dword [esi + 0x1f6c]
call fcn.10085e30
mov dword [ebp - 0x20], eax
fild dword [ebp - 0x20]
sub esp, 8
fstp dword [esp + 4]
fild dword [ebp - 0x1d4]
fstp dword [esp]
call fcn.10037870
add esp, 8
cmp byte [0x1012d3fa], 1
jne 0x100754a3
cmp edi, 0xc9
je 0x1007549b
cmp edi, 0xcd
je 0x1007549b
cmp edi, 0xa6
jne case.default.0x10075b90
mov eax, dword [ebx + 0x12]
jmp 0x10075169
cmp dword [0x10197fe0], 1
jne 0x100754fb
cmp dword [0x1011cd68], 5
jne 0x100754fb
push 0
call dword [sym.imp.MSVCR100.dll__time64]
push eax
call dword [sym.imp.MSVCR100.dll_srand]
fld dword [esi + 0x1f64]
call fcn.10085e30
mov dword [ebp - 0x1d4], eax
fld dword [esi + 0x1f6c]
call fcn.10085e30
mov dword [ebp - 0x20], eax
fild dword [ebp - 0x20]
fstp dword [esp + 4]
fild dword [ebp - 0x1d4]
fstp dword [esp]
call fcn.10037870
add esp, 8
mov byte [0x1012d3fd], 1
mov byte [0x1012d3fe], 1
mov byte [0x1012d3ff], 1
mov byte [0x1012d400], 1
wait
jmp 0x100767e6
mov edi, 0x270f
cmp cx, di
jne 0x1007554d
cmp dword [ebx + 8], 3
jne 0x10074831
add ebx, 0x10
push ebx
call fcn.10039e00
push 0x100a16fc
call fcn.10008090
add esp, 8
wait
jmp 0x100767e6
cmp esi, eax
jne 0x10075595
cmp dword [ebx + 4], 0x38177a
jne 0x1007557b
cmp dword [ebx + 8], 0x13
jne 0x10074831
mov dword [0x1012d214], 0xfffff8f8
mov dword [ebx + 4], 0
wait
jmp 0x100767e6
cmp esi, eax
jne 0x10075595
mov ecx, 0xe1
cmp dx, cx
jne 0x10075595
mov dword [ebx], 0
wait
jmp 0x100767e6
cmp esi, dword [ebx + 0x10]
jne 0x1007563b
mov ecx, 0x98
cmp dx, cx
jne 0x1007563b
mov esi, 1
cmp dword [ebx + 8], esi
jne 0x100755cf
cmp dword [ebx + 0xc], esi
jne 0x100755cf
lea ecx, [ebx + 0x14]
mov edx, 0x1011c6d4
mov al, byte [ecx]
mov byte [edx], al
add ecx, esi
add edx, esi
test al, al
jne 0x100755c3
cmp byte [ebx + 8], 1
jne 0x10074831
cmp dword [0x10195258], esi
jne 0x10074831
push 0x1f4
call sub.mfc100.dll_Ordinal_265
mov esi, eax
push 0x1011c4d0
push 0x100a0468
push esi
mov edi, dword [sym.imp.MSVCR100.dll_sprintf]
call edi
add esp, 0x10
push 0x11
push 0
push esi
call dword [sym.imp.WINMM.dll_PlaySoundA]
push esi
call sub.mfc100.dll_Ordinal_1296
add ebx, 0x14
push ebx
push 0x100a16e8
push 0x1011c6e8
call edi
push 0x1011c6e8
call fcn.10008090
add esp, 0x14
wait
jmp 0x100767e6
cmp esi, eax
jne 0x1007588a
cmp edx, 0x35
jne 0x10075688
cmp word [ebx + 6], 4
je 0x10075688
mov eax, 1
cmp dword [0x10192fd0], eax
jne 0x10074831
cmp dword [0x1012d3e4], eax
jne 0x10074831
cmp dword [0x10192e8c], eax
jne 0x10074831
mov dword [0x1012d394], 0xffff8ad0
wait
jmp 0x100767e6
cmp esi, eax
jne 0x1007588a
cmp dword [ebx + 4], 0x1c0079
jne 0x1007588a
mov byte [0x1012d407], 1
mov ecx, dword [ebx + 0x18]
mov dword [0x1012d38c], ecx
cmp ecx, 0x321
jne 0x100756c2
mov dword [ebp - 0x24], 0x20ade9
mov byte [ebp - 0x20], 0
jmp 0x100756dd
cmp ecx, 0x4b1
jne 0x100756dd
mov dword [ebp - 0x1d4], 0x20ac8e0f
mov word [ebp - 0x1d0], 0
mov dl, byte [0x1012d406]
cmp dl, 1
jne 0x10075870
fld dword [0x101b8d18]
fld dword [ebx + 8]
fucompp
fnstsw ax
test ah, 0x44
jp 0x10075859
fld dword [0x101b8d14]
fld dword [ebx + 0x10]
fucompp
fnstsw ax
test ah, 0x44
jp 0x10075859
fld dword [0x1018e640]
fld qword [0x100a16e0]
fucompp
fnstsw ax
test ah, 0x44
jp 0x10075776
xor ecx, ecx
mov dword [ebp - 0x220], ecx
mov eax, dword [0x1018f5e0]
lea edx, [eax - 1]
cmp ecx, edx
jge 0x1007576e
fld dword [ecx*4 + 0x1018de74]
fstp dword [ecx*4 + 0x1018de70]
fld dword [ecx*4 + 0x1018e644]
fstp dword [ecx*4 + 0x1018e640]
fld dword [ecx*4 + 0x1018ee14]
fstp dword [ecx*4 + 0x1018ee10]
inc ecx
jmp 0x1007572f
dec eax
mov dword [0x1018f5e0], eax
jmp 0x1007577b
mov eax, dword [0x1018f5e0]
fldz
fst dword [0x101b8d18]
fstp dword [0x101b8d14]
xor ecx, ecx
mov dword [ebp - 0x210], ecx
cmp ecx, eax
jge 0x100757d9
sub eax, ecx
lea eax, [eax*4 + 0x1018de70]
fld dword [eax - 4]
fstp dword [eax]
mov eax, dword [0x1018f5e0]
sub eax, ecx
add eax, eax
add eax, eax
fld dword [eax + 0x1018e63c]
fstp dword [eax + 0x1018e640]
mov eax, dword [0x1018f5e0]
sub eax, ecx
add eax, eax
add eax, eax
fld dword [eax + 0x1018ee0c]
fstp dword [eax + 0x1018ee10]
inc ecx
mov eax, dword [0x1018f5e0]
jmp 0x1007578b
inc eax
mov dword [0x1018f5e0], eax
mov edi, dword [ebp - 0x1c8]
fld dword [edi + 0x1f64]
call fcn.10085e30
mov esi, eax
fld dword [edi + 0x1f6c]
call fcn.10085e30
mov edi, eax
push 0
call dword [sym.imp.MSVCR100.dll__time64]
push eax
call dword [sym.imp.MSVCR100.dll_srand]
add esp, 8
mov ebx, dword [sym.imp.MSVCR100.dll_rand]
call ebx
cdq
mov ecx, 0x3c
idiv ecx
add edx, esi
mov dword [ebp - 0x20], edx
fild dword [ebp - 0x20]
fstp dword [0x1018de70]
fld dword [0x100a16d8]
fstp dword [0x1018e640]
call ebx
cdq
mov ecx, 0x3c
idiv ecx
add edx, edi
mov dword [ebp - 0x20], edx
fild dword [ebp - 0x20]
fstp dword [0x1018ee10]
wait
jmp 0x100767e6
cmp dl, 1
jne 0x10075870
fld dword [ebx + 8]
fstp dword [0x101b8d18]
fld dword [ebx + 0x10]
fstp dword [0x101b8d14]
push ecx
call fcn.100082c0
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1012d238], eax
wait
jmp 0x100767e6
mov ecx, 0xd6
cmp dx, cx
jne 0x100758b6
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1011cd7c], eax
mov eax, dword [ebx + 0xd]
mov dword [0x1012d38c], eax
push eax
call fcn.100082c0
add esp, 4
wait
jmp 0x100767e6
cmp esi, eax
jne 0x10075a54
cmp dword [ebx + 4], 0x180031
jne 0x10075a54
cmp word [ebx + 0x10], 0
jne 0x10074831
mov edi, 1
cmp dword [0x10197260], edi
jne 0x10075915
movzx edx, word [ebx + 0xe]
push edx
push edi
call fcn.100396f0
add ebx, 0x12
push ebx
push 0x100a16c8
push 0x1011c6e8
call dword [sym.imp.MSVCR100.dll_sprintf]
push 0x1011c6e8
call fcn.10008090
add esp, 0x18
wait
jmp 0x100767e6
cmp dword [0x101976a8], edi
jne 0x100759a3
movzx esi, word [ebx + 0xe]
mov eax, esi
imul eax, eax, 0x1cc
add eax, 0xfb9ead
mov ecx, dword [ebp - 0x1c8]
add ecx, 0x1ff8
mov edi, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x10075960
test dl, dl
je 0x1007595c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x10075960
add ecx, 2
add eax, 2
test dl, dl
jne 0x10075940
xor eax, eax
jmp 0x10075965
sbb eax, eax
sbb eax, 0xffffffff
push esi
test eax, eax
jne 0x1007597b
push edi
call fcn.100396f0
lea eax, [ebx + 0x12]
push eax
push 0x100a16c8
jmp 0x1007598b
push 2
call fcn.100396f0
lea ecx, [ebx + 0x12]
push ecx
push 0x100a16b8
push 0x1011c6e8
call dword [sym.imp.MSVCR100.dll_sprintf]
push 0x1011c6e8
call fcn.10008090
add esp, 0x18
cmp dword [0x1019725c], edi
jne 0x10074831
xor edi, edi
mov dword [ebp - 0x1f0], edi
mov ecx, 0x10197270
call fcn.10001cb0
cmp edi, eax
jge 0x10075a21
lea edx, [ebp - 0x30]
push edx
push edi
push 0x189
mov eax, dword [0x10197290]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
lea esi, [ebx + 0x12]
mov ecx, esi
lea eax, [ebp - 0x30]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10075a03
test dl, dl
je 0x100759ff
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10075a03
add eax, 2
add ecx, 2
test dl, dl
jne 0x100759e3
xor eax, eax
jmp 0x10075a08
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x10075a1e
movzx ecx, word [ebx + 0xe]
push ecx
push 1
call fcn.100396f0
push esi
jmp 0x100758f2
inc edi
jmp 0x100759b1
movzx edx, word [ebx + 0xe]
push edx
push 2
call fcn.100396f0
add ebx, 0x12
push ebx
push 0x100a16b8
push 0x1011c6e8
call dword [sym.imp.MSVCR100.dll_sprintf]
push 0x1011c6e8
call fcn.10008090
add esp, 0x18
wait
jmp 0x100767e6
mov ecx, dword [ebx + 4]
cmp ecx, 0x5c3125
jne 0x10075a80
cmp dword [ebx + 0xc], 0xd
jne 0x10074831
cmp dword [ebx + 8], 1
jne 0x10074831
mov dword [ebx + 4], 0
wait
jmp 0x100767e6
cmp eax, esi
jne 0x10075bc1
cmp edx, 0x3d
jne 0x10075bc1
cmp dword [0x10192e88], 1
jne 0x10074831
movzx eax, word [ebx + 8]
mov ecx, 0x2c0d
cmp ax, cx
je 0x10075ad8
mov edx, 0x2c0e
cmp ax, dx
je 0x10075ad8
mov ecx, 0x2c0f
cmp ax, cx
je 0x10075ad8
mov edx, 0x468d
cmp ax, dx
je 0x10075ad8
mov ecx, 0x468e
cmp ax, cx
jne 0x10074831
cmp byte [ebx + 0xc], 1
jne 0x10074831
cmp byte [ebx + 0xd], 0
jne 0x10074831
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [0x1012d238]
cmp eax, 0x7d0
jb 0x10074831
mov eax, dword [0x10191a04]
cmp eax, 1
jne 0x10075b73
cmp dword [0x1011cd68], 2
jne 0x10075b73
call esi
mov dword [0x1012d210], eax
mov eax, dword [0x10192fcc]
cmp eax, 4
ja case.default.0x10075b90
jmp dword [eax*4 + 0x1007680c]
push 0
push 0x92c0d
call fcn.10039c90
add esp, 8
wait
jmp 0x100767e6
push 0
push 0x92c0f
call fcn.10039c90
add esp, 8
wait
jmp 0x100767e6
push 0
push 0xf468d
call fcn.10039c90
add esp, 8
wait
jmp 0x100767e6
test eax, eax
jne case.default.0x10075b90
call esi
mov dword [0x1012d210], eax
mov eax, dword [0x10192fcc]
cmp eax, 4
ja case.default.0x10075b90
jmp dword [eax*4 + 0x10076820]
push 0
push 0x92c0e
call fcn.10039c90
add esp, 8
wait
jmp 0x100767e6
push 0
push 0xf468e
call fcn.10039c90
add esp, 8
wait
jmp 0x100767e6
cmp ecx, 0xbc0066
jne 0x10076358
xor eax, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov word [ebp - 0x20], ax
lea esi, [ebx + 0x21]
push 4
push esi
lea edx, [ebp - 0x28]
push edx
call dword [sym.imp.MSVCR100.dll_memmove]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x1f4], edx
mov eax, esi
lea edi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10075c00
sub eax, edi
cmp edx, eax
jae 0x10075c1e
cmp byte [edx + ebx + 0x21], 0xff
jne 0x10075dee
xor eax, eax
mov word [ebx + 4], ax
cmp byte [ebx + 8], 5
ja 0x10075e34
movzx ecx, word [ebx]
cmp dword [ebp - 0x1c4], ecx
je 0x10075e34
push str.rxjhshenqi.com
push esi
mov edi, dword [sym.imp.MSVCR100.dll_strstr]
call edi
add esp, 8
test eax, eax
jne 0x10075e34
push 0x100a16a4
push esi
call edi
add esp, 8
test eax, eax
jne 0x10075c8c
push 0x100a16a0
push esi
call edi
add esp, 8
test eax, eax
jne 0x10075c8c
push 0x100a169c
push esi
call edi
add esp, 8
test eax, eax
jne 0x10075c8c
push 0x100a1698
push esi
call edi
add esp, 8
test eax, eax
je 0x10075c92
xor edx, edx
mov word [ebx + 4], dx
push 0x100a1694
push esi
call edi
add esp, 8
test eax, eax
je 0x10075cc5
push 0x100a1690
push esi
call edi
add esp, 8
test eax, eax
je 0x10075cc5
push 0x100a168c
push esi
call edi
add esp, 8
test eax, eax
je 0x10075cc5
xor eax, eax
mov word [ebx + 4], ax
push 0x100a1688
push esi
call edi
add esp, 8
test eax, eax
jne 0x10075cf6
push 0x100a1684
push esi
call edi
add esp, 8
test eax, eax
jne 0x10075cf6
push 0x100a1680
push esi
call edi
add esp, 8
test eax, eax
je 0x10075d83
push 0x100a167c
push esi
call edi
add esp, 8
test eax, eax
jne 0x10075d23
push 0x100a1678
push esi
call edi
add esp, 8
test eax, eax
jne 0x10075d23
push 0x100a1674
push esi
call edi
add esp, 8
test eax, eax
je 0x10075d83
push 0x100a1670
push esi
call edi
add esp, 8
test eax, eax
jne 0x10075d50
push 0x100a166c
push esi
call edi
add esp, 8
test eax, eax
jne 0x10075d50
push 0x100a1668
push esi
call edi
add esp, 8
test eax, eax
je 0x10075d83
push 0x100a1664
push esi
call edi
add esp, 8
test eax, eax
jne 0x10075d7d
push 0x100a1660
push esi
call edi
add esp, 8
test eax, eax
jne 0x10075d7d
push 0x100a165c
push esi
call edi
add esp, 8
test eax, eax
je 0x10075d83
xor ecx, ecx
mov word [ebx + 4], cx
xor ebx, ebx
mov dword [ebp - 0x204], ebx
mov ecx, 0x101a205c
call fcn.10001240
cmp ebx, eax
jge 0x10075e34
mov edx, dword [0x101a205c]
mov eax, dword [edx + ebx*4]
cmp byte [eax], 0x56
jne 0x10075e0a
xor esi, esi
mov dword [ebp - 0x1fc], esi
mov eax, dword [0x101a205c]
mov edx, dword [eax + ebx*4]
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10075dc0
sub eax, edi
dec eax
cmp esi, eax
jae 0x10075df4
movsx eax, byte [esi + edx + 1]
push eax
mov ecx, dword [ebp - 0x1cc]
add ecx, 0x21
push ecx
call dword [sym.imp.MSVCR100.dll_strchr]
add esp, 8
test eax, eax
je 0x10075e2e
inc esi
jmp 0x10075dad
inc edx
jmp 0x10075bee
xor eax, eax
jne 0x10075e2e
xor edx, edx
mov eax, dword [ebp - 0x1cc]
mov word [eax + 4], dx
wait
jmp 0x100767e6
push eax
mov esi, dword [ebp - 0x1cc]
lea ecx, [esi + 0x21]
push ecx
call dword [sym.imp.MSVCR100.dll_strstr]
add esp, 8
test eax, eax
je 0x10075e2e
xor edx, edx
mov word [esi + 4], dx
wait
jmp 0x100767e6
inc ebx
jmp 0x10075d85
mov ebx, dword [ebp - 0x1cc]
movzx esi, word [ebx]
mov edi, dword [ebp - 0x1c4]
cmp edi, esi
je 0x10076185
cmp byte [ebx + 8], 4
jne 0x10075ef4
mov ecx, 0x1009ffd8
lea eax, [ebx + 0x21]
lea ecx, [ecx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10075e80
test dl, dl
je 0x10075e7c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10075e80
add eax, 2
add ecx, 2
test dl, dl
jne 0x10075e60
xor eax, eax
jmp 0x10075e85
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x10075ef4
mov esi, dword [ebp - 0x1c8]
fld dword [esi + 0x1f6c]
call fcn.10085e30
push eax
fld dword [esi + 0x1f64]
call fcn.10085e30
push eax
mov eax, dword [0x35ec500]
push eax
push str._d._d._d
lea ecx, [ebp - 0x190]
push ecx
call dword [sym.imp.MSVCR100.dll_sprintf]
mov edx, dword [0x12b4a90]
mov eax, dword [edx + 0x444]
mov ecx, dword [eax + 0x334]
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x33c]
add eax, 0x344
lea edx, [ebp - 0x190]
push edx
push eax
call fcn.1003b150
add esp, 0x1c
jmp 0x10076185
cmp edi, esi
je 0x10076185
cmp byte [ebx + 8], 4
jne 0x10075f7f
lea eax, [ebx + 0x21]
cmp byte [eax], 0x23
jne 0x10075f7f
cmp byte [ebx + 0x22], 0x23
jne 0x10075f7f
push 0x1009e0d4
push eax
call dword [sym.imp.MSVCR100.dll_strstr]
add esp, 8
test eax, eax
jne 0x10074106
lea ecx, [ebx + 0x23]
cmp byte [ecx], 0x23
je 0x10075f47
mov edx, 0x101b88f0
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x10075f38
jmp 0x10076185
lea eax, [ebx + 0x24]
push eax
lea ecx, [ebx + 0xa]
push ecx
push str._s._s
lea edx, [ebp - 0x190]
push edx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0x10
lea ecx, [ebp - 0x190]
mov edx, 0x1012d4a4
nop
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x10075f70
jmp 0x10076185
cmp edi, esi
je 0x10076185
cmp byte [ebx + 8], 2
jne 0x100762a1
lea eax, [ebx + 0x21]
cmp byte [eax], 0x23
jne 0x10076185
cmp byte [ebx + 0x22], 0x23
jne 0x10076185
push 0x1009e0d4
push eax
call dword [sym.imp.MSVCR100.dll_strstr]
add esp, 8
test eax, eax
jne 0x10074106
push 0x32
push eax
lea eax, [ebp - 0x190]
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
or edi, 0xffffffff
mov dword [ebp - 0x1d4], edi
xor ecx, ecx
mov dword [ebp - 0x20c], ecx
lea eax, [ebx + 0x23]
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10075fe7
sub eax, esi
cmp ecx, eax
jae 0x1007601c
mov al, byte [ecx + ebx + 0x23]
cmp al, 0x2d
je 0x10076006
mov byte [ebp + ecx - 0x190], al
inc ecx
jmp 0x10075fdb
lea ecx, [ecx + ebx + 0x24]
push ecx
call dword [sym.imp.MSVCR100.dll_atoi]
add esp, 4
mov edi, eax
mov dword [ebp - 0x1d4], eax
test edi, edi
js 0x10074106
xor edi, edi
mov dword [ebp - 0x1d8], edi
mov ecx, 0x1019d494
call fcn.10009dd0
cmp edi, eax
jge 0x100760e2
push edi
mov ecx, 0x1019d494
call sub.mfc100.dll_Ordinal_4554
cmp eax, 1
jne 0x100760d0
push 0x64
push 0
lea edx, [ebp - 0x94]
push edx
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x64
lea eax, [ebp - 0x94]
push eax
push 0
push edi
mov ecx, 0x1019d494
call sub.mfc100.dll_Ordinal_5176
lea ecx, [ebp - 0x94]
push ecx
call fcn.100236f0
add esp, 4
mov esi, eax
cmp esi, 0xffffffff
je 0x100760d6
mov ecx, dword [esi + 0x54]
mov ebx, dword [esi + 0xd0]
sub ecx, dword [esi + 0x50]
mov eax, 0xb81702e1
imul ecx
add edx, ecx
sar edx, 8
mov edi, edx
shr edi, 0x1f
add edi, edx
lea edx, [ebp - 0x190]
push edx
call dword [sym.imp.MSVCR100.dll_atoi]
add esp, 4
cmp eax, dword [esi]
jne 0x100760d0
cmp edi, ebx
jle 0x100760d0
cmp ebx, dword [ebp - 0x1d4]
jle 0x100760f9
mov edi, dword [ebp - 0x1d8]
inc edi
mov ebx, dword [ebp - 0x1cc]
jmp 0x10076026
xor eax, eax
jne 0x100760f9
lea eax, [ebx + 0x21]
push eax
push 2
call fcn.100397c0
add esp, 8
jmp 0x10076185
mov byte [0x1011c6e8], 0
mov ebx, dword [ebp - 0x1cc]
lea ecx, [ebx + 0x21]
push ecx
lea edx, [ebx + 0xa]
push edx
push 0x100a11a4
push 0x1011c6e8
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0x10
xor edi, edi
xor esi, esi
mov dword [ebp - 0x214], esi
mov ecx, 0x101a21f4
call fcn.10001240
cmp esi, eax
jge 0x10076172
mov ecx, 0x1011c6e8
mov eax, dword [0x101a21f4]
mov eax, dword [eax + esi*4]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10076166
test dl, dl
je 0x10076162
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10076166
add eax, 2
add ecx, 2
test dl, dl
jne 0x10076146
xor eax, eax
jmp 0x1007616b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x10076185
inc esi
jmp 0x10076125
test edi, edi
jne 0x10076185
push 0x1011c6e8
mov ecx, 0x101a21f4
call fcn.10001160
cmp byte [ebx + 8], 2
jne 0x100762a1
cmp dword [0x10198000], 1
jne 0x100762a1
mov eax, dword [0x1011cd68]
cmp eax, 5
je 0x100762a1
cmp eax, 2
je 0x100762a1
lea ecx, [ebx + 0x25]
mov eax, 0x33cbd50
jmp 0x100761c0
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100761e0
test dl, dl
je 0x100761dc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100761e0
add eax, 2
add ecx, 2
test dl, dl
jne 0x100761c0
xor eax, eax
jmp 0x100761e5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x100762a1
mov ecx, 0x1009e420
lea eax, [ebp - 0x28]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10076215
test dl, dl
je 0x10076211
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10076215
add eax, 2
add ecx, 2
test dl, dl
jne 0x100761f5
xor eax, eax
jmp 0x1007621a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x100762a1
mov dword [ebp - 0x1e8], eax
mov esi, 0xfb9e98
mov dword [ebp - 0x21c], esi
cmp esi, 0x110ad38
jge 0x100762a1
cmp byte [esi], 0
je 0x1007631e
lea edi, [ebx + 0x25]
mov ecx, edi
lea eax, [esi + 2]
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10076270
test dl, dl
je 0x1007626c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10076270
add eax, 2
add ecx, 2
test dl, dl
jne 0x10076250
xor eax, eax
jmp 0x10076275
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1007631e
push edi
push 0x100a1634
push 0x1011c6e8
call dword [sym.imp.MSVCR100.dll_sprintf]
push 0x1011c6e8
call fcn.10008090
push esi
call fcn.100726a0
add esp, 0x14
mov al, byte [ebx + 8]
cmp al, 4
jne 0x1007632f
cmp dword [0x10195248], 1
jne 0x1007632f
movzx ecx, word [ebx]
cmp dword [ebp - 0x1c4], ecx
je 0x10074831
push 0x1f4
call sub.mfc100.dll_Ordinal_265
mov esi, eax
push 0x1011c4d0
push 0x100a0468
push esi
mov edi, dword [sym.imp.MSVCR100.dll_sprintf]
call edi
add esp, 0x10
push 0x11
push 0
push esi
call dword [sym.imp.WINMM.dll_PlaySoundA]
push esi
call sub.mfc100.dll_Ordinal_1296
lea edx, [ebx + 0x21]
push edx
add ebx, 0xa
push ebx
push 0x100a1628
push 0x1011c6e8
call edi
push 0x1011c6e8
call fcn.10008090
add esp, 0x18
wait
jmp 0x100767e6
inc dword [ebp - 0x1e8]
add esi, 0x1cc
jmp 0x1007622d
cmp al, 0xb
jne 0x10074831
push 0xa
add ebx, 0x21
push ebx
push 0x1011c6c4
call dword [sym.imp.MSVCR100.dll_memmove]
add esp, 0xc
mov byte [0x1011c6ce], 0
wait
jmp 0x100767e6
mov edi, 0xe51
cmp word [ebx + 5], di
jne 0x100764b6
push 0x12c
push 0
lea eax, [ebp - 0x15c]
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x1e4], eax
cmp eax, 0x32
jge 0x10076464
push 0x10
lea ecx, [ebp - 0x1c8]
push ecx
movzx edx, byte [ebx + eax]
push edx
call dword [sym.imp.MSVCR100D.dll__itoa]
add esp, 0xc
lea eax, [ebp - 0x1c8]
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100763b0
sub eax, edx
cmp eax, 1
jne 0x100763d7
mov byte [ebp - 0x1c6], cl
mov al, byte [ebp - 0x1c8]
mov byte [ebp - 0x1c7], al
mov byte [ebp - 0x1c8], 0x30
xor ecx, ecx
mov dword [ebp - 0x224], ecx
cmp ecx, 2
jge 0x10076403
mov al, byte [ebp + ecx - 0x1c8]
cmp al, 0x61
jl 0x10076400
cmp al, 0x7a
jg 0x10076400
movsx edx, al
sub edx, 0x20
mov byte [ebp + ecx - 0x1c8], dl
inc ecx
jmp 0x100763d9
lea edi, [ebp - 0x15c]
dec edi
lea ebx, [ebx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x10076410
mov ax, word [0x1009f114]
mov word [edi], ax
lea eax, [ebp - 0x1c8]
mov edx, eax
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10076430
sub eax, edx
lea edi, [ebp - 0x15c]
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10076440
mov ecx, eax
mov esi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x1e4]
inc eax
jmp 0x1007637f
lea ecx, [ebp - 0x15c]
push ecx
call fcn.10008090
add esp, 4
cmp dword [0x101a0724], 1
jne 0x10074831
mov eax, dword [ebx + 4]
cmp eax, 0xe5103
jne 0x1007648e
push 4
jmp 0x1007649b
cmp eax, 0xe5105
jne 0x10074831
push 6
mov edx, dword [ebx + 0x12]
push edx
movzx eax, word [ebx + 0x10]
push eax
mov ecx, dword [ebx + 0xc]
push ecx
call fcn.1003b910
add esp, 0x10
wait
jmp 0x100767e6
cmp dword [ebx], 0x2213270f
jne 0x1007663f
mov edi, 1
cmp word [ebx + 8], di
jne 0x10074831
movzx eax, word [ebx + 0x14]
cmp ax, di
jne 0x10076584
movzx edx, word [ebx + 0xc]
push edx
push 0x1009e8d4
push 0x1011c6e8
mov esi, dword [sym.imp.MSVCR100.dll_sprintf]
call esi
push 0x1011c6e8
call fcn.10008090
add esp, 0x10
cmp dword [0x1019ff2c], edi
jne 0x10076522
movzx eax, word [ebx + 0xc]
push eax
movzx ecx, word [ebx + 0xa]
push ecx
push edi
movzx edx, word [ebx + 0x14]
push edx
call fcn.1003b050
add esp, 0x10
movzx eax, word [ebx + 0xa]
mov dword [0x101b898c], eax
movzx ecx, word [ebx + 0xc]
mov dword [0x101b8988], ecx
push 0x7d
push 0
lea edx, [ebp - 0xb0]
push edx
call sub.MSVCR100.dll_memset
mov eax, dword [ebx + 0xa]
push eax
push 0x35f5760
push 0x1009ee0c
lea ecx, [ebp - 0xb0]
push ecx
call esi
add esp, 0x1c
lea edx, [ebp - 0xb0]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x271a
mov eax, dword [0x1011956c]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
wait
jmp 0x100767e6
cmp eax, 2
jne 0x10074831
cmp dword [0x1019ff2c], edi
jne 0x10074831
cmp dword [0x101b898c], 0
jne 0x1007660d
cmp dword [0x101b8988], 0
jne 0x1007660d
movzx ecx, word [ebx + 0xa]
mov dword [0x101b898c], ecx
movzx edx, word [ebx + 0xc]
mov dword [0x101b8988], edx
push 0x7d
push 0
lea eax, [ebp - 0xb0]
push eax
call sub.MSVCR100.dll_memset
mov ecx, dword [ebx + 0xa]
push ecx
push 0x35f5760
push 0x1009ee0c
lea edx, [ebp - 0xb0]
push edx
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0x1c
lea eax, [ebp - 0xb0]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x271a
mov ecx, dword [0x1011956c]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [0x1019ff30]
imul eax, eax, 0x3e8
add eax, edi
push 0x1003ba80
push eax
mov edx, dword [0x101a46dc]
add edx, 0x281c
push edx
mov eax, dword [0x100eaf2c]
push eax
call dword [sym.imp.USER32.dll_SetTimer]
wait
jmp 0x100767e6
cmp eax, esi
jne 0x10074831
cmp ecx, 0x180091
je 0x10074831
cmp eax, esi
jne 0x10074831
cmp edx, 0x69
jne 0x1007673f
cmp dword [0x33cbdd0], 0
jne 0x100766c4
cmp dword [ebx + 0xc], 0
jle 0x100766c4
mov edi, 1
cmp dword [0x1019efb4], edi
jne 0x1007668e
push esi
push 0x1009c994
call fcn.10006c10
add esp, 8
cmp dword [0x1019ff24], edi
jne 0x100766c9
push 0x3e8
push 0x3e8
cmp dword [0x1019ff28], 0
jne 0x100766b7
push 2
push 4
call fcn.1003b050
add esp, 0x10
jmp 0x100766c9
push edi
push 4
call fcn.1003b050
add esp, 0x10
jmp 0x100766c9
mov edi, 1
cmp dword [0x1012d3e4], edi
jne 0x10074831
cmp dword [0x10198030], edi
jne 0x10074831
mov eax, dword [ebx + 0xc]
test eax, eax
jle 0x10074831
mov ecx, dword [0x33cbdd0]
sub ecx, eax
cmp ecx, dword [0x1019802c]
jl 0x10074831
cmp dword [0x1011cd68], 2
je 0x10074831
cmp dword [0x10197d88], edi
jne 0x1007672a
push 2
push 0x100a1610
call fcn.10069f30
add esp, 8
wait
jmp 0x100767e6
push 0
push 0x100a1610
call fcn.10069f30
add esp, 8
wait
jmp 0x100767e6
cmp eax, esi
jne 0x10074831
cmp edx, 0x6b
jne 0x10074831
imul esi, esi, 0x1cc
mov dl, byte [ebx + 8]
mov byte [esi + 0xfb9ec0], dl
mov ecx, dword [ebx + 0x2c8]
mov dword [esi + 0xfb9f50], ecx
mov eax, 1
cmp dword [0x10190e84], eax
jne 0x10074831
cmp dword [0x1012d3e4], eax
jne 0x10074831
movzx edx, byte [ebx + 8]
cmp edx, dword [0x10190e88]
jne 0x10074831
push 0x100a15f4
call fcn.10008090
add esp, 4
mov ecx, dword [0x1011d1bc]
call fcn.1006e770
call fcn.10045aa0
wait
jmp 0x100767e6
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.10085dc6
mov esp, ebp
pop ebp
ret