Function at 0x10002d57
Capabilities:
Contain obfuscated stackstrings
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x1008c3cc]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov eax, dword [ebx]
push edi
lea ecx, [ebp - 0x230]
push ecx
push ebx
call dword [eax + 0xc0]
push 0x225a8116
lea ecx, [ebp - 0x218]
call fcn.100020b0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp byte [0x10093ee5], 0
mov edi, eax
mov dword [0x10094300], edi
mov esi, dword [edi + 0x1c97f1c]
mov ecx, dword [edi + 0x1643d34]
mov dword [0x10093f38], esi
mov dword [0x10094304], ecx
jne 0x10002b52
sub esp, 8
push str.0_00____00____0
push 0x100783c8
push 0x400000
call fcn.10008660
sub esp, 8
mov dword [0x10093ed4], eax
push str.0000000000000000
push 0x100783ec
push 0x400000
call fcn.10008660
sub esp, 8
mov dword [0x1009431c], eax
push str.0000000000
push 0x1007840c
push 0x400000
call fcn.10008660
sub esp, 8
mov dword [0x10093edc], eax
push str.0000000000__0
push 0x10078428
push 0x400000
call fcn.10008660
sub esp, 8
mov dword [0x10093f2c], eax
push str.00____0000____
push 0x10078448
push edi
call fcn.10008660
mov dword [0x10094518], eax
test eax, eax
je 0x10002a01
mov eax, dword [eax + 2]
mov dword [0x10094518], eax
mov eax, dword [0x10093ed4]
test eax, eax
je 0x10002a31
lea esi, [eax + 0xa]
push 4
push esi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x10002a1e
mov eax, dword [esi]
jmp 0x10002a20
xor eax, eax
mov edi, dword [0x10094300]
mov esi, dword [0x10093f38]
mov dword [0x10093ed4], eax
xor ecx, ecx
mov eax, dword [ecx + 0x1008d908]
dec eax
imul eax, eax, 0x9c
add ecx, 0x14
mov eax, dword [eax + esi + 0x38]
mov dword [ecx + 0x10093f34], eax
mov eax, dword [ecx + 0x1008d8f8]
dec eax
imul eax, eax, 0x9c
mov eax, dword [eax + esi + 0x38]
mov dword [ecx + 0x10093f38], eax
mov eax, dword [ecx + 0x1008d8fc]
dec eax
imul eax, eax, 0x9c
mov eax, dword [eax + esi + 0x38]
mov dword [ecx + 0x10093f3c], eax
mov eax, dword [ecx + 0x1008d900]
dec eax
imul eax, eax, 0x9c
mov eax, dword [eax + esi + 0x38]
mov dword [ecx + 0x10093f40], eax
mov eax, dword [ecx + 0x1008d904]
dec eax
imul eax, eax, 0x9c
mov eax, dword [eax + esi + 0x38]
mov dword [ecx + 0x10093f44], eax
cmp ecx, 0x3ac
jl 0x10002a33
xor ecx, ecx
mov eax, dword [ecx + 0x1008dcb4]
dec eax
imul eax, eax, 0x9c
add ecx, 0x14
mov eax, dword [eax + esi + 0x38]
mov dword [ecx + 0x10093ed8], eax
mov eax, dword [ecx + 0x1008dca4]
dec eax
imul eax, eax, 0x9c
mov eax, dword [eax + esi + 0x38]
mov dword [ecx + 0x10093edc], eax
mov eax, dword [ecx + 0x1008dca8]
dec eax
imul eax, eax, 0x9c
mov eax, dword [eax + esi + 0x38]
mov dword [ecx + 0x10093ee0], eax
mov eax, dword [ecx + 0x1008dcac]
dec eax
imul eax, eax, 0x9c
mov eax, dword [eax + esi + 0x38]
mov dword [ecx + 0x10093ee4], eax
mov eax, dword [ecx + 0x1008dcb0]
dec eax
imul eax, eax, 0x9c
mov eax, dword [eax + esi + 0x38]
mov dword [ecx + 0x10093ee8], eax
cmp ecx, 0x3c
jl 0x10002ab3
movss xmm0, dword [esi + 0x38]
movss dword [0x10093f30], xmm0
movss xmm0, dword [esi + 0xd4]
movss dword [0x100942f8], xmm0
mov byte [0x10093ee5], 1
cmp dword [0x100944a4], 0
je 0x10002b8c
cmp byte [0x100905a8], 0
je 0x10002b8c
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov edi, dword [0x10094300]
test eax, eax
je 0x10002b8c
cmp dword [edi + 0x1643d34], 0xb
je 0x10002b8c
push ebx
call fcn.10002690
mov edi, dword [0x10094300]
add esp, 4
mov eax, dword [0x1009448c]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
neg eax
sbb al, al
and al, 0xc
mov byte [edi + 0xc95476], al
lea eax, [ebp - 0x218]
push eax
mov dword [ebp - 0x218], 0x65685343
mov dword [ebp - 0x214], 0x642e6c6c
mov word [ebp - 0x210], 0x6c6c
mov byte [ebp - 0x20e], 0
call esi
xorps xmm0, xmm0
movq qword [ebp - 0x218], xmm0
mov word [ebp - 0x210], 0
mov byte [ebp - 0x20e], 0
mov eax, dword [eax + 0x158f82c]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x12c]
cmp eax, 9
je 0x10002c68
cmp eax, 0x17
je 0x10002c68
cmp eax, 0x1f
je 0x10002c68
cmp eax, 0x2f
je 0x10002c68
cmp eax, 0x23
je 0x10002c68
cmp eax, 0x27
je 0x10002c68
cmp eax, 0xe
je 0x10002c68
cmp eax, 0x1e
je 0x10002c68
cmp eax, 0x19
je 0x10002c68
cmp eax, 0x1b
je 0x10002c68
cmp eax, 0x13
je 0x10002c68
cmp eax, 0x18
je 0x10002c68
cmp eax, 0x30
je 0x10002c68
cmp eax, 0x2e
je 0x10002c68
cmp eax, 0x29
je 0x10002c68
cmp eax, 0x10
je 0x10002c68
cmp eax, 0x15
je 0x10002c68
cmp eax, 0x26
je 0x10002c68
cmp eax, 0x21
je 0x10002c68
cmp eax, 0x20
je 0x10002c68
cmp eax, 0x1c
je 0x10002c68
cmp eax, 0x28
jne 0x10002c72
mov dword [0x10094418], 0
call fcn.10003710
call fcn.10003fe0
call fcn.10003810
cmp dword [0x100944b8], 0
setg cl
call fcn.10004320
cmp dword [0x10094400], 0
setg cl
call fcn.100038c0
cmp dword [0x10094334], 0
jle 0x10002cbb
mov eax, dword [0x10094300]
cmp dword [eax + 0x1643d34], 0xb
mov eax, 0x100
je 0x10002cc0
mov eax, 0x101
mov ecx, dword [0x10093ed4]
mov byte [ecx + 0xa7], al
cmp dword [0x10094338], 0
jle 0x10002ce8
mov eax, dword [0x10094300]
cmp dword [eax + 0x1643d34], 0xb
mov eax, 0xe
je 0x10002ced
mov eax, 5
mov byte [ecx + 0xb8], al
mov eax, dword [0x10094300]
cmp dword [eax + 0x1643d34], 0xb
je 0x10002d15
mov dword [0x10094308], 0
mov dword [0x10093ed0], 0
mov eax, dword [0x100943e8]
dec eax
cmp eax, 4
ja case.default.0x10002d20
jmp dword [eax*4 + 0x100036fc]
mov dword [0x10093f40], 0x17
jmp 0x10002d6d
mov dword [0x10093f40], 0x1e
jmp 0x10002d6d
mov dword [0x10093f40], 0x5a
jmp 0x10002d6d
mov dword [0x10093f40], 0x9d
jmp 0x10002d6d
mov dword [0x10093f40], 0xaa
jmp 0x10002d6d
mov dword [0x10093f40], 0x11
lea eax, [ebp - 0x218]
push eax
mov dword [ebp - 0x218], 0x65685343
mov dword [ebp - 0x214], 0x642e6c6c
mov word [ebp - 0x210], 0x6c6c
mov byte [ebp - 0x20e], 0
call esi
xorps xmm0, xmm0
movq qword [ebp - 0x218], xmm0
mov word [ebp - 0x210], 0
mov byte [ebp - 0x20e], 0
mov eax, dword [eax + 0x158f82c]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x12c]
cmp eax, 9
je 0x10002f82
cmp eax, 0x17
je 0x10002f82
cmp eax, 0x1f
je 0x10002f82
mov eax, dword [0x10094300]
mov edx, dword [0x10093f40]
cmp dword [eax + 0x1643d34], 0xb
mov ecx, dword [0x10094308]
jne 0x10002e17
cmp ecx, 9
ja 0x10002e17
cmp dword [0x100943ec], 0
je 0x10002e17
movd xmm0, edx
inc ecx
cvtdq2ps xmm0, xmm0
mov dword [0x10094308], ecx
jmp 0x10002e1f
movss xmm0, dword [0x10093f30]
mov esi, dword [0x10093f38]
movss dword [esi + 0x38], xmm0
movss dword [esi + 0x3c], xmm0
movss dword [esi + 0x40], xmm0
mov eax, dword [0x10094300]
cmp dword [eax + 0x1643d34], 0xb
jne 0x10002e60
cmp ecx, 9
ja 0x10002e60
cmp dword [0x100943ec], 0
jne 0x10002e60
movd xmm0, edx
inc ecx
cvtdq2ps xmm0, xmm0
mov dword [0x10094308], ecx
jmp 0x10002e68
movss xmm0, dword [0x100942f8]
movss dword [esi + 0xd4], xmm0
movss dword [esi + 0xd8], xmm0
movss dword [esi + 0xdc], xmm0
mov eax, dword [0x10094300]
xor edx, edx
cmp dword [eax + 0x1643d34], 0xb
jne 0x10002f30
jmp 0x10002ea0
mov ecx, dword [0x100943f0]
mov eax, dword [edx + 0x1008dcb4]
shl ecx, 4
sub ecx, dword [0x100943f0]
dec eax
add ecx, ecx
imul eax, eax, 0x9c
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
add edx, 4
addss xmm0, dword [edx + 0x10093ee8]
movss dword [eax + esi + 0x38], xmm0
mov ecx, dword [edx + 0x1008dcb0]
mov eax, dword [edx + 0x10093ee8]
dec ecx
imul ecx, ecx, 0x9c
mov dword [ecx + esi + 0x3c], eax
mov ecx, dword [0x100943f0]
mov eax, dword [edx + 0x1008dcb0]
shl ecx, 4
sub ecx, dword [0x100943f0]
dec eax
add ecx, ecx
imul eax, eax, 0x9c
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
addss xmm0, dword [edx + 0x10093ee8]
movss dword [eax + esi + 0x40], xmm0
cmp edx, 0x3c
jl 0x10002ea0
jmp 0x10003040
mov ecx, dword [edx + 0x1008dcb4]
mov eax, dword [edx + 0x10093eec]
dec ecx
imul ecx, ecx, 0x9c
add edx, 4
mov dword [ecx + esi + 0x38], eax
mov ecx, dword [edx + 0x1008dcb0]
mov eax, dword [edx + 0x10093ee8]
dec ecx
imul ecx, ecx, 0x9c
mov dword [ecx + esi + 0x3c], eax
mov ecx, dword [edx + 0x1008dcb0]
mov eax, dword [edx + 0x10093ee8]
dec ecx
imul ecx, ecx, 0x9c
mov dword [ecx + esi + 0x40], eax
cmp edx, 0x3c
jl 0x10002f30
jmp 0x10003040
mov eax, dword [0x10094300]
cmp dword [eax + 0x1643d34], 0xb
jne 0x10002fe6
cmp dword [0x100944d0], 0
je 0x10002fe6
mov edx, dword [0x10093f38]
mov ecx, 0x1008d908
mov eax, dword [ecx]
dec eax
imul eax, eax, 0x9c
add ecx, 4
mov dword [eax + edx + 0x38], 0x461c3c00
mov eax, dword [ecx - 4]
dec eax
imul eax, eax, 0x9c
mov dword [eax + edx + 0x3c], 0x43020000
mov eax, dword [ecx - 4]
dec eax
imul eax, eax, 0x9c
mov dword [eax + edx + 0x40], 0x461c3c00
cmp ecx, 0x1008dcb4
jl 0x10002fa4
jmp 0x10003040
mov esi, dword [0x10093f38]
xor edx, edx
mov edi, edi
mov ecx, dword [edx + 0x1008d908]
mov eax, dword [edx + 0x10093f48]
dec ecx
imul ecx, ecx, 0x9c
add edx, 4
mov dword [ecx + esi + 0x38], eax
mov ecx, dword [edx + 0x1008d904]
mov eax, dword [edx + 0x10093f44]
dec ecx
imul ecx, ecx, 0x9c
mov dword [ecx + esi + 0x3c], eax
mov ecx, dword [edx + 0x1008d904]
mov eax, dword [edx + 0x10093f44]
dec ecx
imul ecx, ecx, 0x9c
mov dword [ecx + esi + 0x40], eax
cmp edx, 0x3ac
jl 0x10002ff0
cmp dword [0x10094340], 0
mov eax, dword [0x10094300]
je 0x10003065
cmp dword [eax + 0x1643d34], 0xb
jne 0x10003065
lea ecx, [eax + 0x90660]
test ecx, ecx
je 0x10003078
push 1
jmp 0x10003071
lea ecx, [eax + 0x90660]
test ecx, ecx
je 0x10003078
push 0
call ecx
mov eax, dword [0x10094300]
mov esi, dword [eax + 0x15dd880]
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
test esi, esi
je 0x100031a4
cmp dword [0x1009433c], 0
je 0x100031a4
cmp dword [eax + 0x1643d34], 0xb
jne 0x10003296
push 0x56
call edi
test al, 1
je 0x100030b4
inc dword [0x10150550]
cmp dword [esi + 0x64], 1
jne 0x100030db
mov eax, dword [ebp - 0x228]
push 0x10078458
push 0xffff0000
push 0x91
add eax, 0xfffffefc
push eax
push ebx
call fcn.10001a60
cmp dword [esi + 0x64], 2
jne 0x10003102
mov eax, dword [ebp - 0x228]
push 0x10078488
push 0xff00ff51
push 0x91
add eax, 0xfffffefc
push eax
push ebx
call fcn.10001a60
cmp dword [esi + 0x64], 3
jne 0x10003129
mov eax, dword [ebp - 0x228]
push str.::_G
push 0xff00aeff
push 0x91
add eax, 0xfffffefc
push eax
push ebx
call fcn.10001a60
mov eax, dword [esi + 0x64]
cmp eax, 3
je 0x10003159
cmp eax, 2
je 0x10003159
cmp eax, 1
je 0x10003159
mov eax, dword [ebp - 0x228]
push str.::_Theo_d
push 0xffffffffffffffff
push 0x91
add eax, 0xffffff4c
push eax
push ebx
call fcn.10001a60
cmp dword [0x10150550], 1
jne 0x1000316f
mov dword [esi + 0x64], 3
inc dword [0x10150550]
cmp dword [0x10150550], 3
jne 0x10003185
mov dword [esi + 0x64], 2
inc dword [0x10150550]
cmp dword [0x10150550], 5
jne 0x1000319f
mov dword [esi + 0x64], 1
mov dword [0x10150550], 0
mov eax, dword [0x10094300]
cmp dword [eax + 0x1643d34], 0xb
jne 0x10003296
mov eax, dword [eax + 0x1592320]
test eax, eax
je 0x100031dc
mov eax, dword [eax + 0x1f0]
test eax, eax
je 0x100031dc
mov eax, dword [eax + 0x5718]
mov ecx, dword [0x100942fc]
test eax, eax
cmovne ecx, eax
mov dword [0x100942fc], ecx
push 0xe
call fcn.1000d49a
mov esi, dword [0x100942fc]
add esp, 4
test esi, esi
je 0x10003284
mov ecx, 0x1186ef0
lea eax, [esi + 0x2e]
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10003220
test dl, dl
je 0x1000321c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10003220
add eax, 2
add ecx, 2
test dl, dl
jne 0x10003200
xor eax, eax
jmp 0x10003225
sbb eax, eax
or eax, 1
test eax, eax
jne 0x10003284
cmp dword [0x10094440], eax
je 0x10003284
push 0x1fe
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.10040b90
add esp, 0xc
push dword [esi + 0x150]
lea eax, [ebp - 0x20c]
push dword [esi + 0x14c]
push 0x10078508
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
push 0xffff0000
push 1
push 1
push ebx
call fcn.10001a60
push 0x1186ef0
call fcn.1003d6f2
mov eax, dword [0x10094300]
add esp, 4
mov ecx, dword [eax + 0x15dd8c8]
mov dword [0x10093ed8], ecx
test ecx, ecx
je 0x100036ae
cmp dword [eax + 0x1643d34], 0xb
jne 0x100036ae
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ecx + 0x38], 0x100
mov dword [ecx + 0x874], 0x100
mov al, byte [0x100944c0]
mov byte [ecx + 0x9d4], al
mov al, byte [0x100944bc]
mov byte [ecx + 0x9a0], al
mov al, byte [0x100944bc]
mov byte [ecx + 0x8d4], al
cmp dword [0x10094428], 1
jne 0x1000334e
push 0x20
call edi
test ax, ax
je 0x10003348
mov eax, dword [0x10094300]
push 1
mov byte [eax + 0x161c2e0], 0
mov eax, dword [0x10093ed8]
mov byte [eax + 0x684], 3
mov byte [eax + 0x680], 1
mov byte [eax + 0xc52], 1
call esi
mov ecx, dword [0x10093ed8]
mov byte [ecx + 0x598], 3
mov byte [ecx + 0x590], 1
mov byte [ecx + 0xb72], 1
jmp 0x1000334e
mov ecx, dword [0x10093ed8]
cmp dword [0x10094428], 2
jne 0x100033ad
push 2
call edi
test ax, ax
je 0x100033a7
mov eax, dword [0x10094300]
push 1
mov byte [eax + 0x161c2e0], 0
mov eax, dword [0x10093ed8]
mov byte [eax + 0x684], 0xa
mov byte [eax + 0x680], 1
mov byte [eax + 0xc52], 0xa
call esi
mov ecx, dword [0x10093ed8]
mov byte [ecx + 0x598], 0x32
mov byte [ecx + 0x590], 1
mov byte [ecx + 0xb72], 0x32
jmp 0x100033ad
mov ecx, dword [0x10093ed8]
cmp dword [0x10094428], 0
jne 0x100033f2
push 0x20
call edi
test ax, ax
jne 0x100033d0
push 2
call edi
test ax, ax
jne 0x100033d0
mov ecx, dword [0x10093ed8]
jmp 0x100033f2
mov ecx, dword [0x10093ed8]
mov byte [ecx + 0xc52], 0
mov byte [ecx + 0x680], 0
mov byte [ecx + 0xb72], 0
mov byte [ecx + 0x590], 0
cmp dword [0x10094430], 0
je 0x100034ba
push 0x46
call edi
test al, 1
mov eax, dword [0x100942f4]
je 0x10003412
inc eax
mov dword [0x100942f4], eax
test eax, eax
jne 0x1000343c
mov eax, dword [ebp - 0x228]
push 0x10078588
push 0xffff0000
push 0xb4
add eax, 0xfffffefc
push eax
push ebx
call fcn.10001a60
mov eax, dword [0x100942f4]
cmp eax, 1
jne 0x10003466
mov eax, dword [0x10093ed8]
mov dword [0x100942f4], 2
mov dword [eax + 0x804], 0xffffffff
mov dword [eax + 0x8f4], 0xffffffff
jmp 0x1000346b
cmp eax, 2
jne 0x10003491
mov eax, dword [ebp - 0x228]
push 0x100785d8
push 0xff00ff51
push 0xb4
add eax, 0xfffffefc
push eax
push ebx
call fcn.10001a60
mov eax, dword [0x100942f4]
mov ecx, dword [0x10093ed8]
cmp eax, 3
jne 0x100034ba
mov dword [ecx + 0x804], 0
mov dword [ecx + 0x8f4], 0
mov dword [0x100942f4], 0
cmp dword [0x100944c4], 0
mov esi, 0xffff8001
je 0x1000358e
push 0x71
call edi
mov ecx, dword [0x10093ed8]
cmp ax, si
jne 0x100034ec
test ecx, ecx
je 0x100034ec
mov eax, dword [0x1009430c]
inc eax
mov dword [0x1009430c], eax
jmp 0x100034f1
mov eax, dword [0x1009430c]
test eax, eax
jne 0x10003521
mov eax, dword [ebp - 0x228]
push 0x10078620
push 0xffff0000
push 0xd7
add eax, 0xfffffefc
push eax
push ebx
call fcn.10001a60
mov ecx, dword [0x10093ed8]
mov eax, dword [0x1009430c]
cmp eax, 1
jne 0x10003540
mov byte [ecx + 0x878], 0x64
mov byte [ecx + 0x968], 0x64
mov dword [0x1009430c], 2
jmp 0x10003545
cmp eax, 2
jne 0x10003571
mov eax, dword [ebp - 0x228]
push 0x10078670
push 0xff00ff51
push 0xd7
add eax, 0xfffffefc
push eax
push ebx
call fcn.10001a60
mov ecx, dword [0x10093ed8]
mov eax, dword [0x1009430c]
cmp eax, 3
jne 0x1000358e
mov byte [ecx + 0x878], 0
mov byte [ecx + 0x968], 0
mov dword [0x1009430c], 0
cmp dword [0x100944c8], 0
je 0x1000363c
push 0x72
call edi
mov ecx, dword [0x10093ed8]
cmp ax, si
jne 0x100035bb
test ecx, ecx
je 0x100035bb
mov eax, dword [0x10093ee8]
inc eax
mov dword [0x10093ee8], eax
jmp 0x100035c0
mov eax, dword [0x10093ee8]
test eax, eax
jne 0x100035f0
mov eax, dword [ebp - 0x228]
push str.::_Nh
push 0xffff0000
push 0xfa
add eax, 0xfffffefc
push eax
push ebx
call fcn.10001a60
mov ecx, dword [0x10093ed8]
mov eax, dword [0x10093ee8]
cmp eax, 1
jne 0x1000362f
mov eax, dword [ebp - 0x228]
push 0x100786f8
push 0xff00ff51
push 0xfa
add eax, 0xfffffefc
push eax
push ebx
call fcn.10001a60
mov ecx, dword [0x10093ed8]
mov eax, dword [0x10093ee8]
mov byte [ecx + 0x650], 3
mov byte [ecx + 0x740], 3
xor edx, edx
cmp eax, 2
cmove eax, edx
mov dword [0x10093ee8], eax
mov eax, dword [0x10094424]
dec eax
je 0x10003671
dec eax
jne 0x100036ae
movss xmm1, dword [0x10079f30]
xor edx, edx
movss xmm0, dword [ecx + edx*4]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x10003666
mov dword [ecx + edx*4], 0xc2600000
inc edx
cmp edx, 0xfff
jl 0x10003651
jmp 0x100036ae
push 0x10
call edi
test ax, ax
jns 0x100036ae
mov edx, dword [0x10093ed8]
movss xmm1, dword [0x10079f30]
xor ecx, ecx
lea ebx, [ebx]
movss xmm0, dword [edx + ecx*4]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x100036a5
mov dword [edx + ecx*4], 0xc2600000
inc ecx
cmp ecx, 0xfff
jl 0x10003690
cmp dword [0x10094508], 0
jle 0x100036bc
call fcn.100086d0
cmp dword [0x1009450c], 0
jle 0x100036ca
call fcn.100089e0
cmp dword [0x10094514], 0
jle 0x100036d8
call fcn.10008c90
cmp dword [0x10094510], 0
jle 0x100036e6
call fcn.10008f40
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003cd0a
mov esp, ebp
pop ebp
ret 4