Function at 0x101e3479
Capabilities:
Check for time delay via gettickcount
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10274013
mov eax, dword fs:[0]
push eax
sub esp, 0x350
mov eax, dword [0x10285008]
xor eax, esp
mov dword [esp + 0x348], eax
push ebx
push esi
push edi
mov eax, dword [0x10285008]
xor eax, esp
push eax
lea eax, [esp + 0x360]
mov dword fs:[0], eax
mov dword [esp + 0x20], ecx
mov eax, dword [ebp + 8]
xor ebx, ebx
mov esi, dword [ebp + 0xc]
inc ebx
mov edi, dword [ebp + 0x10]
push ebx
push ecx
mov dword [esp + 0x64], eax
lea ecx, [esp + 0x2e4]
push 0x32
lea eax, [esp + 0x2fc]
mov dword [esp + 0x28], esi
push eax
mov dword [esp + 0x38], edi
call fcn.100b5e5f
mov dword [esp + 0x368], ebx
lea eax, [esp + 0x288]
push ebx
push ecx
push 0x28
push eax
lea ecx, [esp + 0x284]
call fcn.100b5e5f
mov byte [esp + 0x368], 3
xor ebx, ebx
mov eax, ebx
mov dword [esp + 0x68], ebx
mov dword [esp + 0x34], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x64], ebx
mov dword [esp + 0x48], ebx
test eax, eax
je 0x101e3554
cmp dword [eax + 8], 2
je 0x101e354a
cmp dword [eax + 8], 3
jne 0x101e3554
mov dword [esp + 0x30], 1
jmp 0x101e3558
mov dword [esp + 0x30], ebx
lea ecx, [esp + 0x74]
mov byte [esp + 0x46], 1
mov byte [esp + 0x1b], bl
mov byte [esp + 0x43], bl
mov byte [esp + 0x47], 1
mov byte [esp + 0x27], 1
mov byte [esp + 0x11], bl
mov byte [esp + 0x12], bl
mov byte [esp + 0x13], bl
mov byte [esp + 0x45], bl
mov byte [esp + 0x44], bl
mov byte [esp + 0x42], bl
mov byte [esp + 0x41], bl
mov byte [esp + 0x26], bl
mov dword [esp + 0x60], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x54], ebx
call fcn.100d4d67
mov byte [esp + 0x368], 4
mov eax, dword [esp + 0x20]
test eax, eax
je 0x101e4cc2
mov eax, dword [eax + 8]
cmp eax, 2
je 0x101e35ce
cmp eax, 3
je 0x101e35ce
cmp eax, 1
jne 0x101e4cc2
mov ecx, dword [esp + 0x5c]
test ecx, ecx
je 0x101e4cc2
mov ecx, dword [ecx]
mov dword [esp + 0x14], ecx
cmp eax, 2
je 0x101e35ea
cmp eax, 3
jne 0x101e360e
mov edi, dword [esp + 0x20]
test eax, eax
je 0x101e3604
cmp dword [edi + 0xc], 0x400
jb 0x101e3604
cmp dword [edi + 0xc], 0x405
jbe 0x101e360e
cmp eax, 2
jne 0x101e3614
cmp dword [edi + 0xc], eax
jne 0x101e3614
mov byte [esp + 0x10], bl
jmp 0x101e3619
mov byte [esp + 0x10], 1
push 0x20
pop ecx
movzx eax, word [esi]
test ax, ax
je 0x101e3638
cmp ax, cx
ja 0x101e3634
add esi, 2
movzx eax, word [esi]
test ax, ax
jne 0x101e3624
mov dword [esp + 0x1c], esi
movzx eax, word [esi]
cmp eax, 0x2f
je 0x101e3649
cmp eax, 0x2d
jne 0x101e37c3
add esi, 2
mov dword [esp + 0x1c], esi
jmp 0x101e37b2
cmp ax, 0x3b
je 0x101e361c
movzx eax, ax
add esi, 2
mov dword [esp + 0x1c], esi
cmp eax, 0x6c
jg 0x101e36d7
je 0x101e36cd
sub eax, 0x3f
je 0x101e4ba5
sub eax, 0xd
je 0x101e36c3
sub eax, 4
je 0x101e36b9
sub eax, 0x11
je 0x101e36af
sub eax, 3
je 0x101e36a5
dec eax
dec eax
je 0x101e369b
sub eax, 3
jne 0x101e4b94
or dword [esp + 0x48], 0x40
mov byte [esp + 0x11], 1
jmp 0x101e37b2
mov byte [esp + 0x10], 1
jmp 0x101e37b2
mov byte [esp + 0x13], 1
jmp 0x101e37b2
mov byte [esp + 0x45], 1
jmp 0x101e37b2
mov byte [esp + 0x41], 1
jmp 0x101e37b2
mov byte [esp + 0x12], 1
jmp 0x101e37b2
sub eax, 0x6e
je 0x101e37ae
dec eax
je 0x101e37a4
sub eax, 4
je 0x101e379e
dec eax
dec eax
je 0x101e3711
dec eax
je 0x101e3707
dec eax
jne 0x101e4b94
mov byte [esp + 0x46], bl
jmp 0x101e37b2
mov byte [esp + 0x43], 1
jmp 0x101e37b2
push 3
push 0x1007d774
push esi
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x101e3764
mov cx, word [esi + 6]
call fcn.100b5ec8
test eax, eax
je 0x101e3764
mov ecx, dword [esp + 0x20]
cmp dword [ecx + 8], 1
jne 0x101e4ca5
mov eax, dword [ecx + 0x580]
or eax, dword [ecx + 0x584]
mov dword [esp + 0x30], 1
mov byte [esp + 0x27], bl
je 0x101e4c88
add esi, 6
jmp 0x101e378e
push 2
push 0x1009ed34
push esi
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x101e3794
mov cx, word [esi + 4]
call fcn.100b5ec8
test eax, eax
je 0x101e3794
mov byte [esp + 0x44], 1
add esi, 4
mov dword [esp + 0x1c], esi
jmp 0x101e3799
mov byte [esp + 0x1b], 1
push 0x20
pop ecx
jmp 0x101e37b2
mov byte [esp + 0x10], bl
jmp 0x101e37b2
or dword [esp + 0x48], 0x100000
jmp 0x101e37b2
mov byte [esp + 0x47], bl
movzx eax, word [esi]
cmp ax, cx
ja 0x101e3655
jmp 0x101e361c
push ebx
push ebx
lea eax, [esp + 0x34]
push eax
push 0x31
pop edx
lea ecx, [esp + 0x28]
call fcn.101f3500
mov edx, dword [esp + 0x28]
mov ecx, eax
mov eax, dword [esp + 0x1c]
mov dword [edx], eax
test ecx, ecx
je 0x101e3b16
cmp dword [esp + 0x2c], 0
je 0x101e3b16
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x30]
push ecx
lea ecx, [esp + 0x2e8]
call fcn.100b5c1c
neg eax
sbb eax, eax
not eax
and dword [esp + 0x28], eax
jne 0x101e382c
push 0x1009f510
call fcn.100d3aab
pop ecx
mov edi, 0x8007000e
jmp 0x101e4ceb
cmp dword [esp + 0x2e4], 2
push 0x3d
sbb eax, eax
not eax
and eax, dword [esp + 0x2e0]
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x101e39d6
push ecx
push dword [0x102b9e48]
lea ecx, [esp + 0x30]
call fcn.100cd8dd
mov byte [esp + 0x368], 0x19
xor eax, eax
mov word [esi], ax
add esi, 2
push ebx
lea eax, [esp + 0x50]
mov dword [esp + 0x20], esi
mov esi, dword [esp + 0x2c]
mov ecx, esi
push eax
push ebx
push 0x10067880
lea eax, [esp + 0x2c]
push eax
call fcn.10143471
test eax, eax
je 0x101e38a2
push 0x1009f54c
jmp 0x101e3993
mov edi, dword [esp + 0x20]
mov eax, dword [edi + 0x538]
cmp byte [eax + 0x28], 0
jne 0x101e38bd
mov eax, dword [esp + 0x4c]
cdq
mov dword [esp + 0x3c], edx
jmp 0x101e38c9
mov eax, dword [esp + 0x50]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x4c]
push 0x2c
push dword [esp + 0x20]
mov dword [esp + 0x3c], eax
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
je 0x101e39bd
add eax, 2
mov dword [esp + 0x1c], eax
mov eax, dword [esi]
mov edi, dword [eax + 0xc]
mov ecx, edi
call dword [0x102dc578]
mov ecx, esi
call edi
push ebx
lea eax, [esp + 0x50]
mov ecx, esi
push eax
push ebx
push 0x1009f578
lea eax, [esp + 0x2c]
push eax
call fcn.10143471
test eax, eax
jne 0x101e398e
cmp dword [esp + 0x50], ebx
ja 0x101e398e
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x68], eax
jb 0x101e392c
cmp eax, 0xffffffff
ja 0x101e398e
push 0x2c
push dword [esp + 0x20]
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
je 0x101e39b9
add eax, 2
mov dword [esp + 0x1c], eax
mov eax, dword [esi]
mov edi, dword [eax + 0xc]
mov ecx, edi
call dword [0x102dc578]
mov ecx, esi
call edi
push ebx
lea eax, [esp + 0x50]
mov ecx, esi
push eax
push ebx
push 0x1009f5c4
lea eax, [esp + 0x2c]
push eax
call fcn.10143471
test eax, eax
jne 0x101e3987
cmp dword [esp + 0x50], ebx
ja 0x101e3987
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x64], eax
jb 0x101e39b9
cmp eax, 0xffffffff
jbe 0x101e39b9
push 0x1009f5f4
jmp 0x101e3993
push 0x1009f59c
call fcn.100d3aab
pop ecx
mov byte [esp + 0x368], 4
test esi, esi
je 0x101e3e98
mov ecx, esi
call fcn.10142d46
mov dword [esp + 0x28], ebx
jmp 0x101e3e98
mov edi, dword [esp + 0x20]
mov byte [esp + 0x368], 4
test esi, esi
je 0x101e39da
mov ecx, esi
call fcn.10142d46
mov dword [esp + 0x28], ebx
jmp 0x101e39da
mov edi, dword [esp + 0x20]
cmp byte [esp + 0x1b], 0
push 2
je 0x101e3a5f
cmp dword [esp + 0x2e8], 2
mov esi, dword [esp + 0x18]
mov ecx, esi
sbb eax, eax
not eax
and eax, dword [esp + 0x2e0]
push eax
call fcn.1017febb
test al, al
jne 0x101e3a48
cmp dword [esp + 0x2e4], 2
push 1
sbb ecx, ecx
not ecx
and ecx, dword [esp + 0x2e0]
call fcn.102111c7
push eax
mov ecx, esi
call fcn.1017febb
test al, al
jne 0x101e3a48
push dword [esp + 0x2dc]
push 0x100826d4
call fcn.100d3a67
pop ecx
mov ebx, 0x80004002
jmp 0x101e4b83
push dword [esp + 0x2dc]
push 0x1009f61c
call fcn.100d3a67
pop ecx
jmp 0x101e4b83
pop esi
cmp dword [esp + 0x2e4], esi
lea ecx, [esp + 0x2c]
push ecx
sbb eax, eax
lea ecx, [esp + 0x278]
not eax
and eax, dword [esp + 0x2e0]
push 0xffffffffffffffff
push eax
call fcn.100b5c1c
neg eax
sbb eax, eax
not eax
and dword [esp + 0x2c], eax
je 0x101e3d74
push 0x2a
push dword [esp + 0x278]
call dword [sym.imp.msvcrt.dll_wcschr]
test eax, eax
pop ecx
setne byte [esp + 0x2a]
cmp dword [edi + 8], 1
pop ecx
jne 0x101e3adf
cmp dword [esp + 0x2e4], esi
push 0x1007f05c
sbb eax, eax
not eax
and eax, dword [esp + 0x2e0]
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x101e3adf
mov byte [esp + 0x11], 1
jmp 0x101e3b1e
cmp byte [esp + 0x13], 0
je 0x101e3b1e
mov ecx, ebx
mov dword [esp + 0x27c], ecx
cmp dword [esp + 0x278], esi
jb 0x101e3b25
mov eax, dword [esp + 0x274]
xor ecx, ecx
mov word [eax], cx
mov ecx, dword [esp + 0x27c]
add ecx, esi
mov dword [esp + 0x27c], ecx
jmp 0x101e3b25
mov edi, dword [esp + 0x20]
mov byte [esp + 0x13], bl
mov ecx, dword [esp + 0x27c]
mov dl, byte [esp + 0x12]
test dl, dl
jne 0x101e3ba2
mov al, byte [esp + 0x45]
test al, al
jne 0x101e3ba2
mov eax, dword [0x102d2d24]
test eax, eax
je 0x101e3b43
cmp word [eax], bx
jne 0x101e3ba2
mov esi, 0x1009f638
push esi
call fcn.100d3a67
mov dword [esp], 0x1009f6c8
call fcn.100d3a67
mov dword [esp], 0x1009f758
call fcn.100d3a67
mov dword [esp], 0x1009f7e8
call fcn.100d3a67
mov dword [esp], 0x1009f878
call fcn.100d3a67
mov dword [esp], 0x1009f908
call fcn.100d3a67
mov dword [esp], 0x1009f998
call fcn.100d3a67
pop ecx
push esi
call fcn.100d3a67
jmp 0x101e3e97
cmp ecx, 4
jb 0x101e3ccb
mov esi, dword [esp + 0x34]
mov eax, esi
or eax, dword [esp + 0x3c]
je 0x101e3ccb
cmp ecx, 2
lea ecx, [esp + 0x2c]
push ecx
sbb eax, eax
lea ecx, [esp + 0xa8]
not eax
and eax, dword [esp + 0x278]
push 0xffffffffffffffff
push eax
call fcn.100b5c1c
neg eax
sbb eax, eax
not eax
and eax, dword [esp + 0x2c]
mov dword [esp + 0x2c], eax
je 0x101e3d74
mov ecx, dword [esp + 0x248]
or ecx, 4
mov dword [esp + 0x248], ecx
cmp dword [edi + 8], 2
je 0x101e3c10
cmp dword [edi + 8], 3
mov al, bl
jne 0x101e3c12
mov al, 1
movzx eax, al
xor eax, ecx
and eax, 1
xor ecx, eax
mov eax, dword [esp + 0x68]
mov dword [esp + 0x248], ecx
mov edi, dword [esp + 0x3c]
mov ecx, dword [esp + 0x64]
mov dword [esp + 0x80], eax
mov eax, dword [esp + 0x74]
or eax, 4
mov dword [esp + 0x254], esi
mov dword [esp + 0x258], edi
mov dword [esp + 0x74], eax
test ecx, ecx
je 0x101e3c5e
or eax, 2
mov dword [esp + 0x7c], ecx
mov dword [esp + 0x74], eax
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push eax
movzx eax, byte [esp + 0x15]
push ebx
push dword [esp + 0x50]
push eax
lea eax, [esp + 0x84]
push eax
call fcn.10180052
mov esi, eax
test esi, esi
je 0x101e3cc4
mov ecx, dword [0x102c7ff4]
test ecx, ecx
je 0x101e3cab
cmp dword [ecx + 8], 2
je 0x101e3c9b
cmp dword [ecx + 8], 3
jne 0x101e3ca5
mov ebx, dword [ecx + 0x544]
test ebx, ebx
jne 0x101e3cab
mov ebx, dword [ecx + 0x538]
push edi
push dword [esp + 0x38]
mov ecx, ebx
call fcn.100b4821
push eax
push 0x1009fa28
call fcn.100d3aab
pop ecx
pop ecx
mov ebx, esi
jmp 0x101e4b84
mov al, byte [esp + 0x44]
test al, al
je 0x101e3ea2
cmp ecx, 4
jae 0x101e3ceb
push 0x1009fa60
call fcn.100d3aab
jmp 0x101e3e97
mov esi, dword [esp + 0x14]
push ecx
mov ecx, esi
call fcn.1018115d
cmp dword [esp + 0x27c], 2
mov eax, dword [esp + 0x274]
mov esi, dword [esi + 0x1c]
sbb edi, edi
not edi
and edi, eax
test esi, esi
je 0x101e3e8b
cmp dword [esi + 0x14], 2
jb 0x101e3d22
mov eax, dword [esi + 0xc]
jmp 0x101e3d24
mov eax, ebx
push eax
push edi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x101e3d39
mov esi, dword [esi + 4]
test esi, esi
jne 0x101e3d17
test esi, esi
je 0x101e3e84
cmp dword [esp + 0x27c], 2
lea ecx, [esp + 0x2c]
push ecx
sbb eax, eax
lea ecx, [esp + 0xa8]
not eax
and eax, dword [esp + 0x278]
push 0xffffffffffffffff
push eax
call fcn.100b5c1c
neg eax
sbb eax, eax
not eax
and dword [esp + 0x2c], eax
jne 0x101e3d88
push 0x1009f510
call fcn.100d3aab
mov ebx, 0x8007000e
jmp 0x101e4b83
mov ecx, dword [esp + 0x248]
mov eax, dword [esp + 0x20]
or ecx, 4
mov dword [esp + 0x248], ecx
cmp dword [eax + 8], 2
je 0x101e3dab
cmp dword [eax + 8], 3
mov al, bl
jne 0x101e3dad
mov al, 1
movzx eax, al
xor eax, ecx
and eax, 1
xor ecx, eax
mov dword [esp + 0x248], ecx
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x3c]
or eax, ecx
je 0x101e3dd0
mov eax, dword [esp + 0x34]
jmp 0x101e3dd6
mov eax, dword [esi + 0x70]
mov ecx, dword [esi + 0x74]
mov dword [esp + 0x254], eax
mov dword [esp + 0x258], ecx
mov eax, dword [esi + 0x78]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x80], eax
mov eax, dword [esi + 0x7c]
mov dword [esp + 0x7c], eax
mov eax, dword [esi + 0x80]
or dword [esp + 0x74], 7
mov dword [esp + 0x78], eax
lea eax, [esp + 0x1c]
push eax
movzx eax, byte [esp + 0x15]
push ebx
push dword [esp + 0x50]
push eax
lea eax, [esp + 0x84]
push eax
call fcn.10180052
mov edi, eax
test edi, edi
je 0x101e4ceb
mov eax, dword [0x102c7ff4]
test eax, eax
je 0x101e3e54
cmp dword [eax + 8], 2
je 0x101e3e44
cmp dword [eax + 8], 3
jne 0x101e3e4e
mov ebx, dword [eax + 0x544]
test ebx, ebx
jne 0x101e3e54
mov ebx, dword [eax + 0x538]
push dword [esp + 0x258]
mov esi, dword [esp + 0x278]
mov ecx, ebx
push dword [esp + 0x258]
call fcn.100b4821
push eax
push esi
push 0x1009fadc
call fcn.100d3aab
add esp, 0xc
jmp 0x101e4ceb
mov eax, dword [esp + 0x274]
push eax
push 0x1009fa9c
call fcn.100d3aab
pop ecx
pop ecx
mov ebx, 0x80070057
jmp 0x101e4b84
cmp ecx, 4
jae 0x101e4044
test dl, dl
jne 0x101e3f0d
mov al, byte [esp + 0x10]
test al, al
je 0x101e3ebd
cmp byte [esp + 0x1b], dl
je 0x101e3f27
cmp dword [edi + 8], 1
jne 0x101e3ee1
cmp dword [esp + 0x30], 1
jne 0x101e3ee1
push dword [edi + 0x584]
mov ecx, dword [esp + 0x18]
push dword [edi + 0x580]
call fcn.1017ff4b
jmp 0x101e3f0d
mov esi, dword [esp + 0x14]
inc dword [0x102aa194]
lea ecx, [esi + 0xc]
call fcn.101830b7
and dword [esi + 0x44], 0xfffffdff
mov edx, esi
dec dword [0x102aa194]
push ebx
push ebx
push ebx
push 2
pop ecx
call fcn.100d214d
cmp byte [esp + 0x1b], 0
je 0x101e3f23
push 0x1009fb0c
call fcn.100d3a67
jmp 0x101e4b83
mov al, byte [esp + 0x10]
test al, al
jne 0x101e3f80
cmp dword [esp + 0x30], 1
je 0x101e3f51
cmp dword [edi + 8], 1
jne 0x101e3f51
cmp dword [edi + 0xc], 0x400
jb 0x101e3f4a
cmp dword [edi + 0xc], 0x405
jbe 0x101e3f51
mov ecx, edi
call fcn.101e0e1e
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x102dc578]
mov ecx, edi
call esi
mov eax, dword [esp + 0x30]
cmp eax, 1
je 0x101e3f95
cmp dword [edi + 8], 1
jne 0x101e3f95
push 1
push dword [esp + 0x60]
mov ecx, edi
call fcn.101deafa
jmp 0x101e3f91
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x102dc578]
mov ecx, edi
call esi
mov eax, dword [esp + 0x30]
cmp byte [esp + 0x12], 0
je 0x101e400e
cmp byte [esp + 0x10], 0
je 0x101e3faf
push 0x1009fb38
call fcn.100d3a67
jmp 0x101e3fd1
cmp dword [edi + 8], 2
je 0x101e3fc0
cmp dword [edi + 8], 3
mov eax, 0x1009fb80
jne 0x101e3fc5
mov eax, 0x1009fb74
push eax
push 0x1009fba4
call fcn.100d3a67
pop ecx
pop ecx
push 0x1009fbcc
call fcn.100d3a67
mov eax, dword [edi + 0x538]
pop ecx
cmp byte [eax + 0x28], 0
je 0x101e3ff4
push 0x1005ff98
call fcn.100d3a67
pop ecx
cmp byte [esp + 0x10], 0
je 0x101e4007
push 0x1009fbe8
call fcn.100d3a67
jmp 0x101e4043
push 0x1009fc50
jmp 0x101e4000
cmp byte [esp + 0x10], 0
je 0x101e401c
push 0x1009fcd0
jmp 0x101e4000
cmp dword [edi + 8], 2
je 0x101e4056
cmp dword [edi + 8], 3
je 0x101e4056
cmp eax, 1
mov eax, 0x10063b9c
je 0x101e4037
mov eax, 0x10063c0c
push eax
push 0x1009fd08
call fcn.100d3a67
pop ecx
pop ecx
cmp byte [esp + 0x10], 0
je 0x101e4056
mov edi, 0x102a7100
mov dword [esp + 0x58], edi
jmp 0x101e4081
mov eax, dword [edi]
lea ecx, [esp + 0x58]
push ecx
push dword [esp + 0x34]
mov esi, dword [eax + 0x148]
mov ecx, esi
call dword [0x102dc578]
mov ecx, edi
call esi
mov edi, eax
test edi, edi
jne 0x101e4ceb
mov edi, dword [esp + 0x58]
mov eax, dword [edi]
push 3
push dword [esp + 0x60]
mov esi, dword [eax]
mov ecx, esi
call dword [0x102dc578]
mov ecx, edi
call esi
mov dword [esp + 0x4c], eax
test eax, eax
je 0x101e40aa
jns 0x101e40a3
mov ebx, eax
mov eax, ebx
jmp 0x101e4b75
inc dword [0x102aa194]
push fcn.101f2c80
call dword [sym.imp.dbghelp.dll_SetCheckUserInterruptShared]
mov eax, dword [esp + 0x14]
push dword [eax + 0x50]
call dword [sym.imp.dbghelp.dll_RemoveInvalidModuleList]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], edi
mov esi, ebx
test edi, edi
je 0x101e4108
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, 0x1388
jbe 0x101e4108
push 0x1009fd30
mov dword [esp + 0x30], ebx
call fcn.100d3a67
mov dword [esp], 0x1009fdf8
call fcn.100d3a67
pop ecx
call fcn.100d2d40
call fcn.101f2c80
test eax, eax
jne 0x101e4adc
cmp byte [esp + 0x41], al
jne 0x101e412d
mov eax, 0x2710
cmp esi, eax
ja 0x101e46e8
lea ecx, [esp + 0x74]
call fcn.10128a88
mov edi, dword [esp + 0x58]
lea ecx, [esp + 0x74]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x102dc578]
mov ecx, edi
call esi
mov esi, eax
mov dword [esp + 0x4c], esi
test esi, esi
jne 0x101e4703
cmp dword [esp + 0x80], eax
jne 0x101e41d5
mov eax, dword [0x102c7ff4]
test eax, eax
je 0x101e418e
cmp dword [eax + 8], 2
je 0x101e417c
cmp dword [eax + 8], 3
jne 0x101e4186
mov ecx, dword [eax + 0x544]
test ecx, ecx
jne 0x101e4190
mov ecx, dword [eax + 0x538]
jmp 0x101e4190
mov ecx, ebx
push ebx
push ecx
push dword [esp + 0x260]
push dword [esp + 0x260]
call fcn.100b4821
pop ecx
push eax
push 0x1009ff20
call fcn.100d3aea
mov edi, dword [esp + 0x2c]
add esp, 0xc
mov eax, dword [edi + 0x538]
mov eax, dword [eax + 0x14]
mov dword [esp + 0x80], eax
mov eax, dword [esp + 0x74]
or eax, 4
mov dword [esp + 0x74], eax
jmp 0x101e41dd
mov eax, dword [esp + 0x74]
mov edi, dword [esp + 0x20]
test al, 3
jne 0x101e422a
mov eax, dword [0x102c7ff4]
test eax, eax
je 0x101e4208
cmp dword [eax + 8], 2
je 0x101e41f6
cmp dword [eax + 8], 3
jne 0x101e4200
mov ecx, dword [eax + 0x544]
test ecx, ecx
jne 0x101e420a
mov ecx, dword [eax + 0x538]
jmp 0x101e420a
mov ecx, ebx
push dword [esp + 0x258]
push dword [esp + 0x258]
call fcn.100b4821
push eax
push 0x1009ff58
call fcn.100d3aea
pop ecx
pop ecx
cmp byte [esp + 0x13], 0
je 0x101e4278
mov edx, dword [esp + 0x258]
cmp dword [esp + 0x3c], edx
jb 0x101e46d6
mov esi, dword [esp + 0x254]
ja 0x101e4255
cmp dword [esp + 0x34], esi
jb 0x101e46d6
mov ecx, dword [esp + 0x80]
xor eax, eax
add ecx, esi
adc eax, edx
cmp dword [esp + 0x3c], eax
ja 0x101e46d6
jb 0x101e4278
cmp dword [esp + 0x34], ecx
jae 0x101e46d6
cmp dword [esp + 0x27c], 4
jb 0x101e4407
cmp dword [esp + 0x30], 1
je 0x101e436a
cmp dword [esp + 0x27c], 2
push 0x1007f05c
sbb eax, eax
not eax
and eax, dword [esp + 0x278]
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x101e436a
mov eax, dword [edi + 0x958]
or eax, dword [edi + 0x95c]
mov edx, dword [esp + 0x254]
mov ecx, dword [esp + 0x258]
jne 0x101e42e2
mov dword [edi + 0x958], edx
mov dword [edi + 0x95c], ecx
mov eax, dword [edi + 0x600]
or eax, dword [edi + 0x604]
jne 0x101e42fc
mov dword [edi + 0x600], edx
mov dword [edi + 0x604], ecx
cmp dword [edi + 0x2d0], 0x100
jne 0x101e4407
cmp dword [edi + 0xb8], 0xa28
jne 0x101e4407
cmp dword [esp + 0x7c], 0x3b7de38f
jne 0x101e433a
xor eax, eax
mov dword [edi + 0x2d0], ebx
mov word [edi + 0xc8], ax
jmp 0x101e4407
cmp dword [esp + 0x7c], 0x3c7ac994
je 0x101e4352
cmp dword [esp + 0x7c], 0x3c88ff41
jne 0x101e4407
mov eax, 0x250100
mov ecx, edi
push eax
mov dword [edi + 0x2d0], eax
call fcn.101df276
jmp 0x101e4407
cmp dword [esp + 0xac], 2
movzx esi, byte [esp + 0x46]
sbb edx, edx
not edx
and edx, dword [esp + 0xa4]
cmp dword [esp + 0x27c], 2
push esi
sbb ecx, ecx
not ecx
and ecx, dword [esp + 0x278]
call fcn.101f6959
test eax, eax
jne 0x101e4407
cmp dword [esp + 0xac], 2
sbb ecx, ecx
not ecx
and ecx, dword [esp + 0xa4]
call fcn.102111c7
xor edx, edx
mov ecx, eax
call fcn.101646c5
test eax, eax
je 0x101e46d6
cmp dword [esp + 0x27c], 2
mov edx, dword [eax + 8]
sbb ecx, ecx
not ecx
and ecx, dword [esp + 0x274]
push esi
call fcn.101f6959
test eax, eax
je 0x101e46d6
push dword [esp + 0x274]
push dword [esp + 0xa8]
push 0x1009ffa0
call fcn.100d3aea
add esp, 0xc
cmp dword [esp + 0xac], 2
mov esi, dword [esp + 0xa4]
sbb ecx, ecx
not ecx
and ecx, esi
call fcn.102111c7
cmp byte [esp + 0x12], 0
mov edi, eax
je 0x101e4549
mov eax, dword [esp + 0x20]
cmp dword [eax + 8], 1
jne 0x101e445c
cmp dword [eax + 0xc], 0x400
jne 0x101e445c
mov eax, dword [eax + 0xac]
cmp eax, 0x1000
jbe 0x101e445c
cmp eax, 0x1002
ja 0x101e445c
mov edx, 0x10058658
jmp 0x101e4467
mov ecx, dword [esp + 0x7c]
call fcn.101f68cc
mov edx, eax
cmp byte [esp + 0x10], 0
je 0x101e44d4
mov ecx, dword [0x102c7ff4]
test ecx, ecx
je 0x101e4496
cmp dword [ecx + 8], 2
je 0x101e4484
cmp dword [ecx + 8], 3
jne 0x101e448e
mov esi, dword [ecx + 0x544]
test esi, esi
jne 0x101e4498
mov esi, dword [ecx + 0x538]
jmp 0x101e4498
mov esi, ebx
push edx
mov edx, dword [esp + 0x84]
mov ecx, esi
push edi
lea eax, [edx + 0x3ff]
shr eax, 0xa
push eax
push edx
push dword [esp + 0x268]
push dword [esp + 0x268]
call fcn.100b4821
push eax
push 0x1009ffe4
call fcn.100d3a67
add esp, 0x18
jmp 0x101e46b2
mov eax, dword [0x102c7ff4]
test eax, eax
je 0x101e44fb
cmp dword [eax + 8], 2
je 0x101e44e9
cmp dword [eax + 8], 3
jne 0x101e44f3
mov ecx, dword [eax + 0x544]
test ecx, ecx
jne 0x101e44fd
mov ecx, dword [eax + 0x538]
jmp 0x101e44fd
mov ecx, ebx
push edx
mov edx, dword [esp + 0x98]
push edi
lea eax, [edx + 0x3ff]
shr eax, 0xa
push eax
push edx
mov edx, dword [esp + 0xa0]
lea eax, [edx + 0x3ff]
shr eax, 0xa
push eax
push edx
push dword [esp + 0x270]
push dword [esp + 0x270]
call fcn.100b4821
push eax
push 0x100a0020
call fcn.100d3a67
add esp, 0x20
jmp 0x101e46b2
cmp dword [esp + 0x27c], 4
mov edi, dword [esp + 0x254]
mov edx, dword [esp + 0x258]
jae 0x101e458d
cmp dword [esp + 0x30], 1
je 0x101e458d
mov eax, dword [esp + 0x20]
cmp dword [eax + 8], 1
jne 0x101e458d
cmp byte [esp + 0x10], 0
jne 0x101e458d
cmp dword [eax + 0x600], edi
jne 0x101e458d
cmp dword [eax + 0x604], edx
je 0x101e46d6
cmp byte [esp + 0x43], 0
je 0x101e45e6
mov eax, dword [0x102c7ff4]
test eax, eax
je 0x101e45bb
cmp dword [eax + 8], 2
je 0x101e45a9
cmp dword [eax + 8], 3
jne 0x101e45b3
mov ecx, dword [eax + 0x544]
test ecx, ecx
jne 0x101e45bd
mov ecx, dword [eax + 0x538]
jmp 0x101e45bd
mov ecx, ebx
push dword [esp + 0x7c]
push dword [esp + 0x7c]
push dword [esp + 0x88]
push ecx
push edx
push edi
call fcn.100b4821
pop ecx
push eax
push esi
push 0x100a0078
call fcn.100d3a67
add esp, 0x18
jmp 0x101e460f
cmp dword [esp + 0x27c], 4
jae 0x101e460f
push 0x10062c50
call fcn.100d3a67
mov eax, dword [esp + 0x2c]
inc eax
pop ecx
test al, 0x3f
jne 0x101e460f
push 0x100597b0
call fcn.100d3a67
pop ecx
mov ecx, dword [esp + 0x34]
mov eax, ecx
mov edx, dword [esp + 0x3c]
or eax, edx
je 0x101e462b
mov dword [esp + 0x254], ecx
mov dword [esp + 0x258], edx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push eax
movzx eax, byte [esp + 0x15]
push ebx
push dword [esp + 0x50]
push eax
lea eax, [esp + 0x84]
push eax
call fcn.10180052
mov esi, eax
mov dword [esp + 0x38], esi
test esi, esi
je 0x101e46b2
cmp esi, 0x3e3
je 0x101e4855
mov ecx, dword [0x102c7ff4]
test ecx, ecx
je 0x101e468a
cmp dword [ecx + 8], 2
je 0x101e4678
cmp dword [ecx + 8], 3
jne 0x101e4682
mov eax, dword [ecx + 0x544]
test eax, eax
jne 0x101e468c
mov eax, dword [ecx + 0x538]
jmp 0x101e468c
mov eax, ebx
push dword [esp + 0x258]
mov ecx, eax
push dword [esp + 0x258]
call fcn.100b4821
push eax
push 0x1009fa28
call fcn.100d3aab
pop ecx
pop ecx
mov dword [esp + 0x54], esi
cmp dword [esp + 0x27c], 4
jb 0x101e46cb
cmp byte [esp + 0x26], 0
je 0x101e4b8b
inc dword [esp + 0x60]
cmp byte [esp + 0x13], 0
jne 0x101e4b8b
mov esi, dword [esp + 0x28]
mov edi, dword [esp + 0x2c]
inc esi
mov dword [esp + 0x28], esi
jmp 0x101e40da
push eax
push 0x1009feb0
call fcn.100d3aab
mov esi, dword [esp + 0x54]
pop ecx
pop ecx
mov dword [esp + 0x54], 0x80070057
jmp 0x101e4707
mov dword [esp + 0x54], esi
mov al, byte [esp + 0x10]
mov edi, dword [esp + 0x20]
test al, al
jne 0x101e4720
cmp dword [edi + 8], 1
je 0x101e4720
cmp dword [esp + 0x30], 1
jne 0x101e4748
cmp dword [esp + 0x27c], 4
jae 0x101e4739
push 0x100597b0
call fcn.100d3a67
mov al, byte [esp + 0x14]
pop ecx
test al, al
jne 0x101e48b9
cmp dword [esp + 0x30], 1
je 0x101e47b6
cmp byte [esp + 0x47], 0
je 0x101e47b6
test esi, esi
js 0x101e47b6
cmp byte [esp + 0x13], 0
jne 0x101e476f
cmp dword [esp + 0x27c], 4
jae 0x101e476f
push 0x100a0188
call fcn.100d3a67
pop ecx
mov eax, dword [edi]
lea ecx, [esp + 0x58]
xor edx, edx
inc edx
push ecx
mov esi, dword [eax + 0x148]
mov ecx, esi
push edx
mov dword [esp + 0x38], edx
call dword [0x102dc578]
mov ecx, edi
call esi
test eax, eax
jne 0x101e47b6
mov edi, dword [esp + 0x58]
push 3
push dword [esp + 0x60]
mov eax, dword [edi]
mov esi, dword [eax]
mov ecx, esi
call dword [0x102dc578]
mov ecx, edi
call esi
test eax, eax
je 0x101e40c8
cmp byte [esp + 0x27], 0
je 0x101e4800
cmp dword [esp + 0x27c], 4
jae 0x101e48b9
mov cl, byte [esp + 0x12]
mov eax, 0x10058658
test cl, cl
jne 0x101e47dd
mov eax, 0x100a01b4
mov esi, dword [esp + 0x5c]
xor edx, edx
test cl, cl
mov ecx, esi
push eax
sete dl
push ebx
dec edx
push ebx
and edx, 0xfffffffd
push ebx
add edx, 4
call fcn.101cc59c
mov byte [esp + 0x27], bl
jmp 0x101e4804
mov esi, dword [esp + 0x5c]
cmp dword [esp + 0x27c], 4
jae 0x101e48b9
cmp byte [esp + 0x42], 0
jne 0x101e48b9
mov eax, dword [0x102a70d0]
mov edi, 0x102a70d0
push 3
push esi
mov dword [esp + 0x60], edi
mov esi, dword [eax]
mov ecx, esi
mov byte [esp + 0x4a], 1
call dword [0x102dc578]
mov ecx, edi
call esi
test eax, eax
jne 0x101e48b9
push 0x100a01f0
call fcn.100d3a67
pop ecx
jmp 0x101e40c8
mov eax, dword [0x102c7ff4]
test eax, eax
je 0x101e487c
cmp dword [eax + 8], 2
je 0x101e486a
cmp dword [eax + 8], 3
jne 0x101e4874
mov ecx, dword [eax + 0x544]
test ecx, ecx
jne 0x101e487e
mov ecx, dword [eax + 0x538]
jmp 0x101e487e
mov ecx, ebx
push dword [esp + 0x258]
push dword [esp + 0x258]
call fcn.100b4821
push eax
push 0x100a0128
call fcn.100d3aab
push 0x1009fe88
call fcn.100d3aca
mov eax, 0xd000013a
add esp, 0xc
mov esi, eax
mov dword [esp + 0x54], eax
jmp 0x101e49ed
mov eax, dword [esp + 0x14]
movzx edi, byte [esp + 0x11]
test dword [eax + 0x44], 0x200
je 0x101e48d3
test edi, edi
je 0x101e4af0
cmp byte [esp + 0x12], 0
mov esi, ebx
mov dword [esp + 0x38], esi
je 0x101e4904
mov edi, 0x100a0220
push edi
call fcn.100d3a67
mov dword [esp], 0x100674a0
call fcn.100d3a67
pop ecx
push edi
call fcn.100d3a67
pop ecx
jmp 0x101e49f1
cmp dword [esp + 0x27c], 4
jb 0x101e4af4
cmp byte [esp + 0x26], 0
je 0x101e4937
mov eax, dword [esp + 0x60]
mov edi, dword [esp + 0x14]
test eax, eax
jne 0x101e4af6
mov esi, 0x80004005
mov dword [esp + 0x38], esi
jmp 0x101e4af6
push dword [esp + 0x274]
push 0x100a02c0
call fcn.100d3aca
mov eax, dword [0x102c7ff4]
pop ecx
pop ecx
test eax, eax
je 0x101e4971
cmp dword [eax + 8], 2
je 0x101e495f
cmp dword [eax + 8], 3
jne 0x101e4969
mov ecx, dword [eax + 0x544]
test ecx, ecx
jne 0x101e4973
mov ecx, dword [eax + 0x538]
jmp 0x101e4973
mov ecx, ebx
push dword [esp + 0x3c]
mov esi, dword [esp + 0x278]
push dword [esp + 0x38]
call fcn.100b4821
push eax
push esi
push 0x100a0310
call fcn.100d3aca
add esp, 0xc
push 0x100a0380
call fcn.100d3aca
pop ecx
lea ecx, [esp + 0x74]
call fcn.10128a88
cmp dword [esp + 0x27c], 2
lea ecx, [esp + 0x4c]
push ecx
sbb eax, eax
lea ecx, [esp + 0xa8]
not eax
and eax, dword [esp + 0x278]
push 0xffffffffffffffff
push eax
call fcn.100b5c1c
neg eax
sbb eax, eax
not eax
and dword [esp + 0x4c], eax
jne 0x101e49fa
push 0x1009f510
call fcn.100d3aab
mov esi, 0x8007000e
pop ecx
mov dword [esp + 0x38], esi
mov edi, dword [esp + 0x14]
jmp 0x101e4af6
mov ecx, dword [esp + 0x248]
mov eax, dword [esp + 0x20]
or ecx, 4
mov dword [esp + 0x248], ecx
cmp dword [eax + 8], 2
je 0x101e4a1d
cmp dword [eax + 8], 3
mov al, bl
jne 0x101e4a1f
mov al, 1
movzx eax, al
xor eax, ecx
and eax, 1
xor ecx, eax
mov dword [esp + 0x248], ecx
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x64]
mov dword [esp + 0x254], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x258], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 0x80], eax
mov eax, dword [esp + 0x74]
or eax, 4
mov dword [esp + 0x74], eax
test ecx, ecx
je 0x101e4a6f
or eax, 2
mov dword [esp + 0x7c], ecx
mov dword [esp + 0x74], eax
lea eax, [esp + 0x1c]
push eax
push ebx
push dword [esp + 0x50]
lea eax, [esp + 0x80]
push edi
mov edi, dword [esp + 0x24]
mov ecx, edi
push eax
call fcn.10180052
mov esi, eax
mov dword [esp + 0x38], esi
test esi, esi
je 0x101e4af6
mov eax, dword [0x102c7ff4]
test eax, eax
je 0x101e4abe
cmp dword [eax + 8], 2
je 0x101e4aac
cmp dword [eax + 8], 3
jne 0x101e4ab6
mov ecx, dword [eax + 0x544]
test ecx, ecx
jne 0x101e4ac0
mov ecx, dword [eax + 0x538]
jmp 0x101e4ac0
mov ecx, ebx
push dword [esp + 0x3c]
push dword [esp + 0x38]
call fcn.100b4821
push eax
push 0x1009fa28
call fcn.100d3aab
pop ecx
pop ecx
jmp 0x101e4af6
push 0x1009fe88
call fcn.100d3aca
mov esi, 0xd000013a
jmp 0x101e49ec
mov esi, dword [esp + 0x38]
mov edi, eax
dec dword [0x102aa194]
test esi, esi
js 0x101e4b0d
push ebx
push ebx
push ebx
push 3
mov edx, edi
pop ecx
call fcn.100d214d
cmp dword [edi + 0x98], ebx
mov ebx, dword [esp + 0x38]
je 0x101e4b3d
cmp ebx, 0xd000013a
je 0x101e4b3d
cmp dword [0x102d0534], 0
mov esi, 0x102d0530
jne 0x101e4b36
mov ecx, esi
call fcn.101cdb79
mov ecx, esi
call fcn.101cdb79
lea eax, [esp + 0x6c]
mov dword [esp + 0x6c], 0x102c8450
push eax
push dword [esp + 0x2e0]
mov dword [esp + 0x78], 0x102c8240
push dword [edi + 0x50]
call dword [sym.imp.dbghelp.dll_ReportSymbolLoadSummary]
test eax, eax
jne 0x101e4b71
push 0x100a0500
call fcn.100d3aab
pop ecx
mov eax, dword [esp + 0x54]
test eax, eax
jns 0x101e4b84
push 0x100a0570
call fcn.100d3aab
pop ecx
mov edi, ebx
jmp 0x101e4ceb
mov esi, dword [esp + 0x38]
jmp 0x101e49f1
movzx eax, word [esi - 2]
push eax
push 0x1009ed3c
call fcn.100d3a67
pop ecx
pop ecx
push 0x1009ed78
call fcn.100d3a67
mov dword [esp], 0x1009ede8
call fcn.100d3a67
mov dword [esp], 0x1009ee48
call fcn.100d3a67
mov dword [esp], 0x1009eeb0
call fcn.100d3a67
mov dword [esp], 0x1009ef30
call fcn.100d3a67
mov dword [esp], 0x1009f008
call fcn.100d3a67
mov dword [esp], 0x1009f098
call fcn.100d3a67
mov dword [esp], 0x1009f120
call fcn.100d3a67
mov dword [esp], 0x1009f188
call fcn.100d3a67
mov dword [esp], 0x1009f1e8
call fcn.100d3a67
mov dword [esp], 0x1009f258
call fcn.100d3a67
mov dword [esp], 0x1009f2b0
call fcn.100d3a67
mov dword [esp], 0x1009f310
call fcn.100d3a67
mov dword [esp], 0x1009f390
call fcn.100d3a67
mov dword [esp], 0x1009f3c0
call fcn.100d3a67
mov dword [esp], 0x1009f428
call fcn.100d3a67
pop ecx
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x101e4c69
sub ecx, edx
mov edi, 0x80070057
mov edx, dword [esp + 0x28]
sar ecx, 1
lea eax, [esi + ecx*2]
mov dword [edx], eax
jmp 0x101e4ceb
push 0x1009ecb0
call fcn.100d3aab
pop ecx
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x101e4c98
jmp 0x101e4c74
push 0x1009ec74
call fcn.100d3aab
pop ecx
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x101e4cb5
jmp 0x101e4c74
push 0x1009ec08
call fcn.100d3aab
pop ecx
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x101e4cd2
sub ecx, edx
sar ecx, 1
lea eax, [esi + ecx*2]
mov dword [edi], eax
mov edi, 0x8000ffff
mov byte [esp + 0x368], 3
lea ecx, [esp + 0x74]
call fcn.100d4cd4
mov byte [esp + 0x368], 1
lea ecx, [esp + 0x274]
call fcn.100b5ef7
or dword [esp + 0x368], 0xffffffff
lea ecx, [esp + 0x2dc]
call fcn.100b5ef7
mov eax, edi
mov ecx, dword [esp + 0x360]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x348]
xor ecx, esp
call fcn.10236010
mov esp, ebp
pop ebp
ret 0xc