Function at 0x10097bb0
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x10184e79
mov eax, dword fs:[0]
push eax
sub esp, 0x2f8
mov eax, dword [0x101c6444]
xor eax, esp
mov dword [esp + 0x2f4], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x101c6444]
xor eax, esp
push eax
lea eax, [esp + 0x30c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x31c]
mov edx, dword [esp + 0x32c]
mov esi, dword [esp + 0x334]
mov ebp, ecx
mov ecx, dword [esp + 0x324]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x330]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x338]
mov dword [esp + 0x24], edx
mov edx, dword [esp + 0x33c]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x344]
mov dword [esp + 0x28], ecx
xor ebx, ebx
mov ecx, ebp
mov dword [esp + 0x7c], ebp
mov dword [esp + 0x38], esi
mov dword [esp + 0x2c], edx
mov dword [esp + 0x30], eax
mov dword [esp + 0x18], ebx
call fcn.1002acb0
lea edi, [ebp + 8]
mov ecx, edi
mov dword [esp + 0x314], ebx
call fcn.100a7400
mov dword [ebp + 0x30], 0x10198d3c
mov dword [ebp + 0x34], 0x10198d44
mov dword [ebp + 0x38], 0x10198d4c
mov dword [ebp + 0x3c], 0x10198d74
mov dword [edi], 0x10198f70
mov dword [ebp], 0x10198ea8
mov dword [ebp + 0x30], 0x10198e9c
mov dword [ebp + 0x34], 0x10198e94
mov dword [ebp + 0x38], 0x10198e6c
mov dword [ebp + 0x3c], 0x10198e58
lea edi, [ebp + 0x40]
mov ecx, 0x2da
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x28]
push 0x114a
lea eax, [ebp + 0xba8]
push ecx
push eax
call fcn.10158c60
mov esi, dword [esp + 0x38]
lea edi, [ebp + 0x1cf2]
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
add esp, 0xc
lea edx, [ebp + 0x1d2c]
mov edi, 0x101975e4
push edx
mov dword [ebp + 0x1d28], edi
call esi
lea ecx, [ebp + 0x1d44]
mov byte [esp + 0x314], 2
call fcn.100f6e88
mov dword [ebp + 0x1d70], 1
mov byte [ebp + 0x1d74], bl
mov word [ebp + 0x1d78], 3
mov dword [ebp + 0x1d7a], ebx
mov dword [ebp + 0x1d7e], ebx
mov word [ebp + 0x1d82], bx
mov dword [ebp + 0x1d84], ebx
mov byte [ebp + 0x1d75], 0x54
mov byte [ebp + 0x1d76], 0x50
mov byte [ebp + 0x1d77], 0x54
mov dword [ebp + 0x1d88], ebx
mov dword [ebp + 0x1d8c], ebx
mov dword [ebp + 0x1d90], ebx
mov dword [ebp + 0x1d94], ebx
mov dword [ebp + 0x1d98], ebx
mov dword [ebp + 0x1d9c], ebx
mov dword [ebp + 0x1da0], ebx
mov dword [ebp + 0x1da4], ebx
mov dword [ebp + 0x1da8], ebx
lea eax, [ebp + 0x1db4]
mov dword [ebp + 0x1dac], 0x10198870
push eax
mov dword [ebp + 0x1db0], edi
call esi
mov byte [ebp + 0x1dcc], bl
lea ecx, [ebp + 0x1dd8]
mov dword [ebp + 0x1dd0], 0x10198870
push ecx
mov dword [ebp + 0x1dd4], edi
call esi
mov byte [ebp + 0x1df0], bl
lea edx, [ebp + 0x1dfc]
mov dword [ebp + 0x1df4], 0x10198870
push edx
mov dword [ebp + 0x1df8], edi
call esi
mov byte [ebp + 0x1e14], bl
or eax, 0xffffffff
mov byte [ebp + 0x1e18], bl
mov dword [ebp + 0x1e20], eax
mov dword [ebp + 0x1e24], eax
mov dword [ebp + 0x1e28], ebx
mov dword [ebp + 0x1e2c], ebx
mov dword [ebp + 0x1e34], ebx
mov dword [ebp + 0x1e38], ebx
mov dword [ebp + 0x1e3c], ebx
mov dword [ebp + 0x1e44], ebx
mov dword [ebp + 0x1e48], ebx
mov dword [ebp + 0x1e4c], ebx
lea eax, [ebp + 0x1e5c]
mov dword [ebp + 0x1e50], 0x1019767c
push eax
mov dword [ebp + 0x1e58], edi
call esi
mov dword [ebp + 0x1e78], ebx
mov dword [ebp + 0x1e7c], ebx
mov ecx, dword [esp + 0x320]
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x328]
mov dword [ebp + 0x1e80], ecx
lea ecx, [ebp + 0x1e90]
mov byte [esp + 0x314], 9
mov dword [ebp + 0x1e84], edx
mov dword [ebp + 0x1e88], eax
call fcn.101266b0
lea ecx, [ebp + 0x20f8]
mov byte [esp + 0x314], 0xa
call fcn.10125e61
mov dword [ebp + 0x21b0], ebx
mov dword [ebp + 0x21b4], ebx
lea ecx, [ebp + 0x21c0]
mov dword [ebp + 0x21b8], 0x10198870
push ecx
mov dword [ebp + 0x21bc], edi
call esi
mov byte [ebp + 0x21d8], bl
lea edx, [ebp + 0x21e4]
mov dword [ebp + 0x21dc], 0x10198870
push edx
mov dword [ebp + 0x21e0], edi
call esi
mov byte [ebp + 0x21fc], bl
lea eax, [ebp + 0x2208]
mov dword [ebp + 0x2200], 0x10198870
push eax
mov dword [ebp + 0x2204], edi
call esi
mov byte [ebp + 0x2220], bl
lea ecx, [ebp + 0x222c]
mov dword [ebp + 0x2224], 0x10198870
push ecx
mov dword [ebp + 0x2228], edi
call esi
mov byte [ebp + 0x2244], 1
mov byte [ebp + 0x2248], bl
mov byte [ebp + 0x2249], bl
mov dl, byte [ebp + 0x224e]
mov dword [ebp + 0x224a], ebx
mov byte [ebp + 0x224f], bl
mov dword [ebp + 0x2250], ebx
mov word [ebp + 0x2254], bx
mov dword [ebp + 0x2256], ebx
mov word [ebp + 0x225a], bx
mov dword [ebp + 0x225c], ebx
mov word [ebp + 0x2260], bx
and dl, 0xf1
or dl, 0x11
mov byte [ebp + 0x224e], dl
mov dword [ebp + 0x2268], ebx
mov word [ebp + 0x226c], bx
mov dword [ebp + 0x226e], ebx
mov word [ebp + 0x2272], bx
mov eax, 0xf
mov dword [ebp + 0x228c], eax
mov dword [ebp + 0x2288], ebx
mov byte [ebp + 0x2278], bl
mov dword [ebp + 0x22a8], eax
mov dword [ebp + 0x22a4], ebx
mov byte [ebp + 0x2294], bl
mov dword [ebp + 0x22ac], ebx
mov dword [ebp + 0x22b0], ebx
lea eax, [ebp + 0x22c4]
mov dword [ebp + 0x22b8], 0x1019767c
push eax
mov dword [ebp + 0x22c0], edi
call esi
mov dword [ebp + 0x22e0], ebx
mov dword [ebp + 0x22e4], ebx
lea ecx, [ebp + 0x22f0]
mov dword [ebp + 0x22e8], 0x10198870
push ecx
mov dword [ebp + 0x22ec], edi
call esi
lea edx, [ebp + 0x2314]
mov dword [ebp + 0x230c], 0x10198870
push edx
mov dword [ebp + 0x2310], edi
call esi
mov dword [ebp + 0x232c], ebx
mov dword [ebp + 0x2330], ebx
mov dword [ebp + 0x2338], ebx
lea eax, [ebp + 0x2344]
mov dword [ebp + 0x233c], 0x10198870
push eax
mov dword [ebp + 0x2340], edi
call esi
mov byte [ebp + 0x235c], bl
mov dword [ebp + 0x2360], ebx
mov dword [ebp + 0x2364], ebx
mov dword [ebp + 0x2368], ebx
mov dword [ebp + 0x236c], ebx
mov dword [ebp + 0x2370], ebx
mov dword [ebp + 0x2374], ebx
mov dword [ebp + 0x2378], ebx
mov dword [ebp + 0x237c], ebx
mov dword [ebp + 0x2380], ebx
mov dword [ebp + 0x2384], ebx
mov dword [ebp + 0x2388], ebx
mov dword [ebp + 0x238c], ebx
mov dword [ebp + 0x2390], ebx
mov dword [ebp + 0x2394], ebx
mov dword [ebp + 0x2398], 0x10198870
lea ecx, [ebp + 0x23a0]
push ecx
mov dword [ebp + 0x239c], edi
call esi
mov dword [ebp + 0x23bc], ebx
mov dword [ebp + 0x23c0], ebx
lea edx, [ebp + 0x23cc]
mov dword [ebp + 0x23c4], 0x10198870
push edx
mov dword [ebp + 0x23c8], edi
call esi
lea eax, [ebp + 0x23f0]
mov dword [ebp + 0x23e8], 0x10198870
push eax
mov dword [ebp + 0x23ec], edi
call esi
mov cl, byte [esp + 0x340]
mov edx, dword [esp + 0x34]
mov byte [ebp + 0x2420], cl
lea ecx, [ebp + 0x2426]
push edx
mov byte [esp + 0x318], 0x18
mov byte [ebp + 0x240c], 1
mov dword [ebp + 0x2410], ebx
mov dword [ebp + 0x2418], ebx
mov dword [ebp + 0x241c], ebx
mov byte [ebp + 0x2421], bl
mov byte [ebp + 0x2422], bl
mov byte [ebp + 0x2423], bl
mov byte [ebp + 0x2424], bl
mov byte [ebp + 0x2425], bl
call fcn.1003a960
mov byte [ebp + 0x256c], bl
lea eax, [ebp + 0x2578]
mov dword [ebp + 0x2570], 0x10198870
push eax
mov dword [ebp + 0x2574], edi
call esi
mov byte [ebp + 0x2590], bl
mov dword [ebp + 0x2598], ebx
mov dword [ebp + 0x25b4], 0xf
mov dword [ebp + 0x25b0], ebx
mov byte [ebp + 0x25a0], bl
lea ecx, [ebp + 0x25c0]
mov dword [ebp + 0x25b8], 0x10198870
push ecx
mov dword [ebp + 0x25bc], edi
call esi
lea ecx, [ebp + 0x25e0]
mov byte [esp + 0x314], 0x1c
mov byte [ebp + 0x25dc], bl
call fcn.10093490
mov byte [ebp + 0x2650], bl
mov byte [ebp + 0x2651], bl
mov dword [ebp + 0x2654], ebx
mov byte [ebp + 0x265c], bl
lea edx, [ebp + 0x266c]
mov dword [ebp + 0x2660], 0x1019767c
push edx
mov dword [ebp + 0x2668], edi
call esi
mov dword [ebp + 0x2688], ebx
mov dword [ebp + 0x268c], ebx
lea eax, [ebp + 0x30]
push eax
lea ecx, [ebp + 0x2690]
mov byte [esp + 0x318], 0x1e
call fcn.1002bc40
mov dword [ebp + 0x26b0], 0x10198870
mov dword [ebp + 0x26b4], edi
lea eax, [ebp + 0x26b8]
push eax
call esi
mov byte [ebp + 0x26d0], bl
mov byte [ebp + 0x26d4], bl
mov byte [ebp + 0x26e0], bl
mov byte [ebp + 0x26e1], bl
mov byte [ebp + 0x26e2], 1
mov byte [ebp + 0x26e3], 1
mov byte [ebp + 0x26e4], bl
mov byte [ebp + 0x26e5], bl
mov byte [ebp + 0x26e6], bl
mov byte [ebp + 0x26e7], bl
mov dword [ebp + 0x26e8], ebx
mov byte [ebp + 0x26ec], bl
mov byte [ebp + 0x26ed], bl
mov byte [ebp + 0x26ee], bl
lea ecx, [ebp + 0x26f0]
mov byte [esp + 0x314], 0x20
call fcn.100fe2fb
mov dword [ebp + 0x271c], ebx
mov byte [ebp + 0x2720], 1
mov byte [ebp + 0x2721], bl
mov dword [ebp + 0x2724], ebx
mov byte [ebp + 0x2728], 1
mov byte [ebp + 0x2734], bl
mov dword [ebp + 0x2738], ebx
mov byte [ebp + 0x273c], bl
mov dword [ebp + 0x2740], ebx
mov dword [ebp + 0x2744], ebx
lea ecx, [ebp + 0x2754]
mov dword [ebp + 0x2748], 0x1019767c
push ecx
mov dword [ebp + 0x2750], edi
call esi
mov dword [ebp + 0x2770], ebx
mov dword [ebp + 0x2774], ebx
lea edx, [ebp + 0x2784]
mov dword [ebp + 0x2778], 0x1019767c
push edx
mov dword [ebp + 0x2780], edi
call esi
mov dword [ebp + 0x27a0], ebx
mov dword [ebp + 0x27a4], ebx
lea eax, [ebp + 0x27b4]
mov dword [ebp + 0x27a8], 0x1019767c
push eax
mov dword [ebp + 0x27b0], edi
call esi
mov dword [ebp + 0x27d0], ebx
mov dword [ebp + 0x27d4], ebx
lea ecx, [ebp + 0x27e0]
mov dword [ebp + 0x27d8], 0x10198870
push ecx
mov dword [ebp + 0x27dc], edi
call esi
mov byte [ebp + 0x27f8], bl
mov byte [ebp + 0x27fc], 0x7f
lea edx, [ebp + 0x2808]
mov dword [ebp + 0x2800], 0x10198870
push edx
mov dword [ebp + 0x2804], edi
call esi
mov dword [ebp + 0x2820], ebx
lea eax, [ebp + 0x282c]
mov dword [ebp + 0x2824], 0x10198870
push eax
mov dword [ebp + 0x2828], edi
call esi
mov dword [ebp + 0x2844], ebx
lea ecx, [ebp + 0x2850]
mov dword [ebp + 0x2848], 0x10198870
mov dword [ebp + 0x284c], edi
push ecx
call esi
mov dword [ebp + 0x2868], ebx
lea edx, [ebp + 0x2874]
mov dword [ebp + 0x286c], 0x10198870
push edx
mov dword [ebp + 0x2870], edi
call esi
mov dword [ebp + 0x288c], ebx
lea eax, [ebp + 0x2898]
mov dword [ebp + 0x2890], 0x10198870
push eax
mov dword [ebp + 0x2894], edi
call esi
mov dword [ebp + 0x28b0], ebx
lea ecx, [ebp + 0x28bc]
mov dword [ebp + 0x28b4], 0x10198870
push ecx
mov dword [ebp + 0x28b8], edi
call esi
mov byte [ebp + 0x28d4], bl
lea edx, [ebp + 0x28e0]
mov dword [ebp + 0x28d8], 0x10198870
push edx
mov dword [ebp + 0x28dc], edi
call esi
mov word [ebp + 0x28f8], bx
lea eax, [ebp + 0x2904]
mov dword [ebp + 0x28fc], 0x10198870
push eax
mov dword [ebp + 0x2900], edi
call esi
mov byte [ebp + 0x291c], bl
lea ecx, [ebp + 0x2928]
mov dword [ebp + 0x2920], 0x10198870
push ecx
mov dword [ebp + 0x2924], edi
call esi
mov byte [ebp + 0x2940], bl
lea edx, [ebp + 0x294c]
mov dword [ebp + 0x2944], 0x10198870
push edx
mov dword [ebp + 0x2948], edi
call esi
mov dword [ebp + 0x2964], ebx
lea eax, [ebp + 0x2970]
mov dword [ebp + 0x2968], 0x10198870
push eax
mov dword [ebp + 0x296c], edi
call esi
mov byte [ebp + 0x2988], bl
lea ecx, [ebp + 0x2994]
mov dword [ebp + 0x298c], 0x10198870
push ecx
mov dword [ebp + 0x2990], edi
call esi
mov byte [ebp + 0x29ac], bl
lea edx, [ebp + 0x29bc]
mov dword [ebp + 0x29b0], 0x1019767c
push edx
mov dword [ebp + 0x29b8], edi
call esi
mov dword [ebp + 0x29d8], ebx
mov dword [ebp + 0x29dc], ebx
lea eax, [ebp + 0x29e8]
mov dword [ebp + 0x29e0], 0x10198870
push eax
mov dword [ebp + 0x29e4], edi
call esi
mov word [ebp + 0x2a00], bx
lea ecx, [ebp + 0x2a0c]
mov dword [ebp + 0x2a04], 0x10198870
push ecx
mov dword [ebp + 0x2a08], edi
call esi
mov word [ebp + 0x2a24], bx
lea edx, [ebp + 0x2a30]
mov dword [ebp + 0x2a28], 0x10198870
push edx
mov dword [ebp + 0x2a2c], edi
call esi
mov word [ebp + 0x2a48], bx
lea eax, [ebp + 0x2a54]
mov dword [ebp + 0x2a4c], 0x10198870
push eax
mov dword [ebp + 0x2a50], edi
call esi
mov word [ebp + 0x2a6c], bx
lea ecx, [ebp + 0x2a78]
mov dword [ebp + 0x2a70], 0x10198870
push ecx
mov dword [ebp + 0x2a74], edi
call esi
mov dword [ebp + 0x2a90], ebx
lea edx, [ebp + 0x2a9c]
mov dword [ebp + 0x2a94], 0x10198870
push edx
mov dword [ebp + 0x2a98], edi
call esi
mov dword [ebp + 0x2ab4], ebx
lea eax, [ebp + 0x2ac0]
mov dword [ebp + 0x2ab8], 0x10198870
push eax
mov dword [ebp + 0x2abc], edi
call esi
mov dword [ebp + 0x2ad8], ebx
lea ecx, [ebp + 0x2ae4]
mov dword [ebp + 0x2adc], 0x10198870
push ecx
mov dword [ebp + 0x2ae0], edi
call esi
mov dword [ebp + 0x2afc], ebx
lea edx, [ebp + 0x2b08]
mov dword [ebp + 0x2b00], 0x10198870
push edx
mov dword [ebp + 0x2b04], edi
call esi
mov dword [ebp + 0x2b20], ebx
lea eax, [ebp + 0x2b2c]
mov dword [ebp + 0x2b24], 0x10198870
push eax
mov dword [ebp + 0x2b28], edi
call esi
mov dword [ebp + 0x2b44], ebx
lea ecx, [ebp + 0x2b50]
mov dword [ebp + 0x2b48], 0x10198870
push ecx
mov dword [ebp + 0x2b4c], edi
call esi
mov dword [ebp + 0x2b68], ebx
lea edx, [ebp + 0x2b74]
mov dword [ebp + 0x2b6c], 0x10198870
push edx
mov dword [ebp + 0x2b70], edi
call esi
mov dword [ebp + 0x2b8c], ebx
lea eax, [ebp + 0x2b98]
mov dword [ebp + 0x2b90], 0x10198870
mov dword [ebp + 0x2b94], edi
push eax
call esi
mov dword [ebp + 0x2bb0], ebx
lea ecx, [ebp + 0x2bbc]
mov dword [ebp + 0x2bb4], 0x10198870
push ecx
mov dword [ebp + 0x2bb8], edi
call esi
mov byte [ebp + 0x2bd4], bl
lea edx, [ebp + 0x2be0]
mov dword [ebp + 0x2bd8], 0x10198870
push edx
mov dword [ebp + 0x2bdc], edi
call esi
mov dword [ebp + 0x2bf8], ebx
lea eax, [ebp + 0x2c04]
mov dword [ebp + 0x2bfc], 0x10198870
push eax
mov dword [ebp + 0x2c00], edi
call esi
mov word [ebp + 0x2c1c], bx
lea ecx, [ebp + 0x2c28]
mov dword [ebp + 0x2c20], 0x10198870
push ecx
mov dword [ebp + 0x2c24], edi
call esi
mov word [ebp + 0x2c40], bx
lea edx, [ebp + 0x2c4c]
mov dword [ebp + 0x2c44], 0x10198870
push edx
mov dword [ebp + 0x2c48], edi
call esi
mov word [ebp + 0x2c64], bx
lea eax, [ebp + 0x2c70]
mov dword [ebp + 0x2c68], 0x10198870
push eax
mov dword [ebp + 0x2c6c], edi
call esi
mov word [ebp + 0x2c88], bx
lea ecx, [ebp + 0x2c94]
mov dword [ebp + 0x2c8c], 0x10198870
push ecx
mov dword [ebp + 0x2c90], edi
call esi
mov word [ebp + 0x2cac], bx
lea edx, [ebp + 0x2cb8]
mov dword [ebp + 0x2cb0], 0x10198870
push edx
mov dword [ebp + 0x2cb4], edi
call esi
mov word [ebp + 0x2cd0], bx
lea eax, [ebp + 0x2cdc]
mov dword [ebp + 0x2cd4], 0x10198870
push eax
mov dword [ebp + 0x2cd8], edi
call esi
mov word [ebp + 0x2cf4], bx
lea ecx, [ebp + 0x2d00]
mov dword [ebp + 0x2cf8], 0x10198870
push ecx
mov dword [ebp + 0x2cfc], edi
call esi
mov word [ebp + 0x2d18], bx
lea edx, [ebp + 0x2d24]
mov dword [ebp + 0x2d1c], 0x10198870
push edx
mov dword [ebp + 0x2d20], edi
call esi
mov word [ebp + 0x2d3c], bx
mov dword [ebp + 0x2d40], 0x10198870
lea eax, [ebp + 0x2d48]
push eax
mov dword [ebp + 0x2d44], edi
call esi
mov word [ebp + 0x2d60], bx
lea ecx, [ebp + 0x2d6c]
mov dword [ebp + 0x2d64], 0x10198870
push ecx
mov dword [ebp + 0x2d68], edi
call esi
mov word [ebp + 0x2d84], bx
lea edx, [ebp + 0x2d90]
mov dword [ebp + 0x2d88], 0x10198870
push edx
mov dword [ebp + 0x2d8c], edi
call esi
mov word [ebp + 0x2da8], bx
lea eax, [ebp + 0x2db4]
mov dword [ebp + 0x2dac], 0x10198870
push eax
mov dword [ebp + 0x2db0], edi
call esi
mov word [ebp + 0x2dcc], bx
lea ecx, [ebp + 0x2dd8]
mov dword [ebp + 0x2dd0], 0x10198870
push ecx
mov dword [ebp + 0x2dd4], edi
call esi
mov word [ebp + 0x2df0], bx
lea edx, [ebp + 0x2dfc]
mov dword [ebp + 0x2df4], 0x10198870
push edx
mov dword [ebp + 0x2df8], edi
call esi
mov word [ebp + 0x2e14], bx
lea eax, [ebp + 0x2e20]
mov dword [ebp + 0x2e18], 0x10198870
push eax
mov dword [ebp + 0x2e1c], edi
call esi
mov word [ebp + 0x2e38], bx
lea ecx, [ebp + 0x2e44]
mov dword [ebp + 0x2e3c], 0x10198870
push ecx
mov dword [ebp + 0x2e40], edi
call esi
mov word [ebp + 0x2e5c], bx
lea edx, [ebp + 0x2e68]
mov dword [ebp + 0x2e60], 0x10198870
push edx
mov dword [ebp + 0x2e64], edi
call esi
mov word [ebp + 0x2e80], bx
lea eax, [ebp + 0x2e8c]
mov dword [ebp + 0x2e84], 0x10198870
push eax
mov dword [ebp + 0x2e88], edi
call esi
mov word [ebp + 0x2ea4], bx
lea ecx, [ebp + 0x2eb0]
mov dword [ebp + 0x2ea8], 0x10198870
push ecx
mov dword [ebp + 0x2eac], edi
call esi
mov word [ebp + 0x2ec8], bx
lea edx, [ebp + 0x2ed4]
mov dword [ebp + 0x2ecc], ebx
push edx
mov dword [ebp + 0x2ed0], edi
call esi
lea eax, [ebp + 0x2ef0]
push eax
mov dword [ebp + 0x2eec], edi
call esi
lea ecx, [ebp + 0x2f08]
mov byte [esp + 0x314], 0x57
call fcn.10093490
mov dword [ebp + 0x2f90], 0xf
mov dword [ebp + 0x2f8c], ebx
mov byte [ebp + 0x2f7c], bl
lea ecx, [ebp + 0x2f9c]
mov dword [ebp + 0x2f94], 0x10198da0
push ecx
mov dword [ebp + 0x2f98], edi
call esi
mov dword [ebp + 0x2fcc], 0xf
mov dword [ebp + 0x2fc8], ebx
mov byte [ebp + 0x2fb8], bl
mov dword [ebp + 0x2fd0], ebx
mov byte [ebp + 0x2fd4], bl
mov byte [ebp + 0x2fd5], bl
mov byte [ebp + 0x2fd6], bl
lea edx, [ebp + 0x2fe0]
mov dword [ebp + 0x2fd8], 0x10198870
push edx
mov dword [ebp + 0x2fdc], edi
call esi
mov byte [ebp + 0x2ff8], bl
lea eax, [ebp + 0x3004]
mov dword [ebp + 0x2ffc], 0x10198870
push eax
mov dword [ebp + 0x3000], edi
call esi
mov byte [ebp + 0x301c], bl
mov byte [ebp + 0x3020], bl
mov byte [ebp + 0x3021], bl
mov dword [ebp + 0x3028], ebx
mov dword [ebp + 0x302c], ebx
lea ecx, [ebp + 0x3038]
mov dword [ebp + 0x3030], 0x10198870
push ecx
mov dword [ebp + 0x3034], edi
call esi
mov byte [ebp + 0x3050], bl
lea edx, [ebp + 0x305c]
mov dword [ebp + 0x3054], 0x10198870
push edx
mov dword [ebp + 0x3058], edi
call esi
mov byte [ebp + 0x3074], bl
lea eax, [ebp + 0x3080]
mov dword [ebp + 0x3078], 0x10198870
push eax
mov dword [ebp + 0x307c], edi
call esi
mov byte [ebp + 0x3098], bl
lea ecx, [ebp + 0x30a0]
push ecx
mov dword [ebp + 0x309c], edi
call esi
lea edx, [ebp + 0x30bc]
push edx
mov dword [ebp + 0x30b8], edi
call esi
mov dword [ebp + 0x30d4], ebx
mov dword [ebp + 0x30d8], ebx
mov dword [ebp + 0x30dc], ebx
mov byte [esp + 0x314], 0x61
mov dword [ebp + 0x30e0], ebx
mov dword [ebp + 0x30e4], ebx
or esi, 0xffffffff
mov dword [ebp + 0x30e8], esi
mov dword [ebp + 0x30f0], ebx
mov dword [ebp + 0x30f4], ebx
mov dword [ebp + 0x30f8], ebx
mov dword [ebp + 0x3100], ebx
mov dword [ebp + 0x3104], ebx
mov dword [ebp + 0x3108], ebx
mov dword [ebp + 0x310c], ebx
mov dword [ebp + 0x3110], ebx
mov dword [ebp + 0x3114], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [ebp + 0x3178]
mov dword [ebp + 0x3118], eax
mov byte [ebp + 0x312c], bl
mov dword [ebp + 0x3130], ebx
mov dword [ebp + 0x3134], ebx
mov dword [ebp + 0x3138], ebx
mov dword [ebp + 0x313c], ebx
mov dword [ebp + 0x3140], ebx
mov dword [ebp + 0x3148], ebx
mov dword [ebp + 0x314c], ebx
mov dword [ebp + 0x3150], ebx
mov dword [ebp + 0x3154], ebx
mov dword [ebp + 0x3158], ebx
mov dword [ebp + 0x315c], ebx
mov dword [ebp + 0x3160], ebx
mov dword [ebp + 0x3164], ebx
mov dword [ebp + 0x3168], ebx
mov dword [ebp + 0x316c], ebx
mov dword [ebp + 0x3170], ebx
mov dword [ebp + 0x3174], ebx
call fcn.10043d20
mov dword [ebp + 0x3250], ebx
mov dword [ebp + 0x3254], ebx
mov byte [ebp + 0x3258], bl
mov dword [ebp + 0x325c], ebx
mov dword [ebp + 0x3260], ebx
mov dword [ebp + 0x3264], ebx
mov dword [ebp + 0x3268], ebx
mov dword [ebp + 0x326c], ebx
mov dword [ebp + 0x3270], ebx
mov dword [ebp + 0x3274], ebx
push 0x3e8
mov dword [ebp + 0x3278], esi
push 3
lea ecx, [ebp + 0x3280]
mov byte [esp + 0x31c], 0x62
mov byte [ebp + 0x327c], bl
mov byte [ebp + 0x327d], bl
call fcn.100fe4d4
push 0x3e8
push 3
lea ecx, [ebp + 0x32b0]
mov byte [esp + 0x31c], 0x63
call fcn.100fe4d4
push 0x3e8
push 3
lea ecx, [ebp + 0x32e0]
mov byte [esp + 0x31c], 0x64
call fcn.100fe4d4
mov byte [ebp + 0x3314], bl
mov byte [ebp + 0x3315], 1
mov dword [ebp + 0x3318], ebx
mov dword [ebp + 0x331c], ebx
mov dword [ebp + 0x3320], ebx
mov dword [ebp + 0x3324], ebx
mov dword [ebp + 0x3328], ebx
mov dword [ebp + 0x332c], ebx
mov dword [ebp + 0x3330], ebx
mov dword [ebp + 0x3334], ebx
mov dword [ebp + 0x3338], ebx
mov dword [ebp + 0x333c], ebx
lea edi, [ebp + 0x3350]
mov byte [ebp + 0x3340], bl
mov dword [edi + 0x18], 0xf
mov dword [edi + 0x14], ebx
mov byte [edi + 4], bl
mov dword [ebp + 0x3370], ebx
mov dword [ebp + 0x3374], ebx
mov dword [ebp + 0x3378], ebx
lea esi, [ebp + 0x3380]
mov ecx, esi
mov byte [esp + 0x314], 0x67
call fcn.10005fd0
mov dword [esi + 4], eax
mov byte [eax + 0x11], 1
mov eax, dword [esi + 4]
mov dword [eax + 4], eax
mov eax, dword [esi + 4]
mov dword [eax], eax
mov eax, dword [esi + 4]
mov dword [eax + 8], eax
mov dword [esi + 8], ebx
mov dword [ebp + 0x33a4], 0xf
mov dword [ebp + 0x33a0], ebx
mov byte [ebp + 0x3390], bl
mov byte [ebp + 0x33a8], bl
mov byte [ebp + 0x33a9], bl
mov word [ebp + 0x33aa], 0x1e
mov word [ebp + 0x33ac], 0x3c
mov byte [ebp + 0x33ae], bl
mov byte [ebp + 0x33af], bl
mov dword [ebp + 0x33b0], ebx
push ebx
mov byte [esp + 0x318], 0x69
mov dword [ebp + 0x33b4], ebx
call fcn.1015812a
lea esi, [ebp + 0x33bc]
add esp, 4
mov ecx, esi
mov dword [ebp + 0x33b8], eax
call fcn.10005fd0
mov dword [esi + 4], eax
mov byte [eax + 0x11], 1
mov eax, dword [esi + 4]
mov dword [eax + 4], eax
mov eax, dword [esi + 4]
mov dword [eax], eax
mov eax, dword [esi + 4]
mov dword [eax + 8], eax
mov dword [esi + 8], ebx
mov byte [ebp + 0x33c8], bl
mov dword [ebp + 0x33cc], ebx
mov dword [ebp + 0x33d4], ebx
mov dword [ebp + 0x33d8], ebx
mov dword [ebp + 0x33dc], ebx
push 1
push 3
lea ecx, [esp + 0x26c]
mov byte [esp + 0x31c], 0x6b
call fcn.10013620
mov ecx, dword [ebp + 0x2552]
push ecx
lea eax, [ebp + 0x242a]
push eax
lea edx, [esp + 0x274]
push edx
mov byte [esp + 0x320], 0x6c
call fcn.10027c70
add esp, 8
mov ecx, eax
call fcn.100133a0
lea eax, [esp + 0x184]
push eax
lea ecx, [esp + 0x268]
call fcn.1000abd0
mov byte [esp + 0x314], 0x6d
push eax
call fcn.100f28b0
add esp, 4
cmp dword [esp + 0x19c], 0x10
mov dword [ebp + 0x26d8], eax
mov byte [esp + 0x314], 0x6c
jb 0x10098e26
mov ecx, dword [esp + 0x188]
push ecx
call fcn.10157f3b
add esp, 4
push 0x12a8
call fcn.101582b6
add esp, 4
mov dword [esp + 0x34], eax
cmp eax, ebx
mov byte [esp + 0x314], 0x6e
je 0x10098e6b
mov edx, dword [ebp + 0x26d8]
mov ecx, dword [esp + 0x20]
push edx
mov edx, dword [esp + 0x30]
push ecx
lea ecx, [ebp + 0x38]
push ecx
mov ecx, dword [esp + 0x34]
push edx
mov edx, dword [esp + 0x2c]
push ecx
push edx
mov ecx, eax
call fcn.100d7f40
jmp 0x10098e6d
xor eax, eax
lea ecx, [esp + 0x2b8]
mov dword [ebp + 0x26dc], eax
mov byte [esp + 0x314], 0x6b
call fcn.10004960
lea eax, [esp + 0x2b8]
push eax
mov dword [esp + 0x2bc], 0x101975f8
call fcn.101575fb
add esp, 4
lea esi, [ebp + 0x27e0]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
mov byte [ebp + 0x27f8], 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
movzx ecx, word [ebp + 0x2563]
movzx edx, word [ebp + 0x2561]
push ecx
push edx
lea esi, [ebp + 0x2517]
lea eax, [esp + 0x1e0]
push esi
push eax
call fcn.100f39eb
add esp, 0x10
push 0xffffffffffffffff
push ebx
push eax
mov ecx, edi
mov byte [esp + 0x320], 0x6f
call fcn.10001a10
cmp dword [esp + 0x1f0], 0x10
mov byte [esp + 0x314], 0x6b
jb 0x10098f19
mov ecx, dword [esp + 0x1dc]
push ecx
call fcn.10157f3b
add esp, 4
lea edi, [ebp + 0x1bb2]
mov eax, edi
mov dword [esp + 0xa0], 0xf
mov dword [esp + 0x9c], ebx
mov byte [esp + 0x8c], bl
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x10098f40
sub eax, edx
push eax
push edi
lea ecx, [esp + 0x90]
call fcn.10001b80
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x90]
push edx
lea ecx, [ebp + 0x2274]
mov byte [esp + 0x320], 0x70
call fcn.10001a10
cmp dword [esp + 0xa0], 0x10
mov byte [esp + 0x314], 0x6b
jb 0x10098f99
mov eax, dword [esp + 0x8c]
push eax
call fcn.10157f3b
add esp, 4
lea edi, [ebp + 0x1bd2]
mov eax, edi
mov dword [esp + 0xc4], 0xf
mov dword [esp + 0xc0], ebx
mov byte [esp + 0xb0], bl
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x10098fc0
sub eax, edx
push eax
push edi
lea ecx, [esp + 0xb4]
call fcn.10001b80
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0xb4]
push ecx
lea ecx, [ebp + 0x2290]
mov byte [esp + 0x320], 0x71
call fcn.10001a10
cmp dword [esp + 0xc4], 0x10
mov byte [esp + 0x314], 0x6b
jb 0x10099019
mov edx, dword [esp + 0xb0]
push edx
call fcn.10157f3b
add esp, 4
lea edi, [ebp + 0x885]
mov eax, edi
mov dword [esp + 0xe8], 0xf
mov dword [esp + 0xe4], ebx
mov byte [esp + 0xd4], bl
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x10099040
sub eax, edx
push eax
push edi
lea ecx, [esp + 0xd8]
call fcn.10001b80
movzx eax, word [ebp + 0x985]
push eax
lea ecx, [esp + 0xd4]
push ecx
lea ecx, [esp + 0x180]
call fcn.100248e0
cmp dword [esp + 0xe8], 0x10
mov edx, dword [eax]
mov dword [ebp + 0x2268], edx
movzx eax, word [eax + 4]
mov word [ebp + 0x226c], ax
jb 0x100990a2
mov ecx, dword [esp + 0xd4]
push ecx
call fcn.10157f3b
add esp, 4
lea edi, [ebp + 0xbac]
mov eax, edi
mov dword [esp + 0x78], 0xf
mov dword [esp + 0x74], ebx
mov byte [esp + 0x64], bl
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x100990c0
sub eax, edx
push eax
push edi
lea ecx, [esp + 0x68]
call fcn.10001b80
movzx edx, word [ebp + 0x1bb0]
push edx
lea eax, [esp + 0x64]
push eax
lea ecx, [esp + 0x186]
call fcn.100248e0
cmp dword [esp + 0x78], 0x10
mov ecx, dword [eax]
mov dword [ebp + 0x226e], ecx
movzx edx, word [eax + 4]
mov word [ebp + 0x2272], dx
jb 0x10099116
mov eax, dword [esp + 0x64]
push eax
call fcn.10157f3b
add esp, 4
mov eax, dword [ebp + 0xba8]
cmp eax, 3
ja case.0x10099121.0
jmp dword [eax*4 + 0x10099bd4]
mov dword [ebp + 0x2264], 6
jmp 0x10099156
mov dword [ebp + 0x2264], 4
jmp 0x10099156
mov dword [ebp + 0x2264], 3
jmp 0x10099156
mov dword [ebp + 0x2264], 1
lea edi, [ebp + 0x23a0]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push edi
mov byte [ebp + 0x23b8], bl
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push ebx
call fcn.1015812a
add esp, 4
lea edi, [ebp + 0x22f0]
push edi
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [esp + 0x1c]
push edi
mov dword [ebp + 0x2308], ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea edi, [ebp + 0x2446]
push edi
call fcn.100feeaf
add esp, 4
cmp byte [esp + 0x340], 2
jne 0x1009929e
mov eax, dword [esp + 0x30]
mov edx, dword [eax]
mov dword [ebp + 0x2370], edx
mov ecx, dword [eax + 4]
mov dword [ebp + 0x2374], ecx
mov edx, dword [eax + 8]
mov dword [ebp + 0x2378], edx
mov ecx, dword [eax + 0xc]
mov dword [ebp + 0x237c], ecx
mov edx, dword [eax + 0x10]
lea eax, [ebp + 0x30b8]
lea esi, [eax + 4]
push esi
mov dword [ebp + 0x2380], edx
mov dword [esp + 0xa8], 0x101975f4
mov dword [esp + 0xac], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp word [ebp + 0x2548], 0x64
mov byte [esp + 0x314], 0x72
jae 0x1009926e
cmp byte [ebp + 0x2560], 1
je 0x1009926e
push 0x10198050
lea eax, [esp + 0x1f8]
push edi
push eax
call fcn.1002ced0
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp + 0x259c]
mov byte [esp + 0x320], 0x73
call fcn.10001a10
cmp dword [esp + 0x20c], 0x10
jb 0x1009927d
mov ecx, dword [esp + 0x1f8]
push ecx
call fcn.10157f3b
add esp, 4
jmp 0x1009927d
push 0xffffffffffffffff
push ebx
push edi
lea ecx, [ebp + 0x259c]
call fcn.10001a10
push esi
mov byte [esp + 0x318], 0x6b
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edx, dword [esp + 0x348]
mov dword [ebp + 0x2ecc], edx
jmp 0x100993eb
lea eax, [ebp + 0x30b8]
mov dword [esp + 0x84], eax
add eax, 4
push eax
mov dword [esp + 0x84], 0x101975f4
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp byte [ebp + 0x2560], 1
mov byte [esp + 0x314], 0x74
jne 0x100992e6
push 0xffffffffffffffff
push ebx
push edi
lea ecx, [ebp + 0x259c]
call fcn.10001a10
jmp 0x1009932d
push 0x10198050
lea eax, [esp + 0x1a4]
push edi
push eax
call fcn.1002ced0
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp + 0x259c]
mov byte [esp + 0x320], 0x75
call fcn.10001a10
cmp dword [esp + 0x1b8], 0x10
jb 0x1009932d
mov ecx, dword [esp + 0x1a4]
push ecx
call fcn.10157f3b
add esp, 4
mov edx, dword [esp + 0x1c]
push edx
mov byte [esp + 0x318], 0x6b
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
cmp byte [eax + esi], bl
jne 0x10099354
add eax, 1
cmp eax, 0x14
jb 0x10099342
jmp 0x100993eb
mov eax, dword [ebp + 0x250f]
or eax, dword [ebp + 0x2513]
je 0x100993eb
mov ecx, dword [esi]
mov dword [ebp + 0x2370], ecx
mov edx, dword [esi + 4]
mov dword [ebp + 0x2374], edx
mov eax, dword [esi + 8]
mov dword [ebp + 0x2378], eax
mov ecx, dword [esi + 0xc]
mov dword [ebp + 0x237c], ecx
mov edx, dword [esi + 0x10]
mov dword [ebp + 0x2380], edx
mov eax, dword [esi]
mov dword [ebp + 0x2f08], eax
mov ecx, dword [esi + 4]
mov dword [ebp + 0x2f0c], ecx
mov edx, dword [esi + 8]
mov dword [ebp + 0x2f10], edx
mov eax, dword [esi + 0xc]
mov dword [ebp + 0x2f14], eax
mov ecx, dword [esi + 0x10]
mov dword [ebp + 0x2f18], ecx
mov edx, dword [ebp + 0x250f]
mov dword [ebp + 0x2f30], edx
mov eax, dword [ebp + 0x2513]
push 0xffffffffffffffff
mov dword [ebp + 0x2f34], eax
push ebx
lea eax, [ebp + 0x242a]
push eax
lea ecx, [ebp + 0x2f78]
call fcn.10001a10
cmp dword [edi + 0x18], 0x10
jb 0x100993f6
mov eax, dword [edi + 4]
jmp 0x100993f9
lea eax, [edi + 4]
push eax
call fcn.1002d140
add esp, 4
test al, al
je 0x10099550
cmp byte [esp + 0x340], 2
je 0x1009952f
push edi
call fcn.100f6ecb
add esp, 4
test al, al
je 0x10099518
cmp byte [ebp + 0x2560], 1
je 0x10099550
lea ecx, [esp + 0x210]
push ecx
mov ecx, ebp
call fcn.1008d270
mov esi, 0x10
cmp dword [eax + 0x18], esi
mov byte [esp + 0x314], 0x76
jb 0x1009945c
mov eax, dword [eax + 4]
jmp 0x1009945f
add eax, 4
push eax
call fcn.10031d60
add esp, 4
lea ecx, [esp + 0x210]
mov byte [esp + 0x314], 0x6b
call fcn.100019e0
lea edx, [esp + 0x22c]
push edx
mov ecx, ebp
call fcn.1008d270
cmp dword [eax + 0x18], esi
mov byte [esp + 0x314], 0x77
jb 0x1009949d
mov eax, dword [eax + 4]
jmp 0x100994a0
add eax, 4
cmp dword [edi + 0x18], esi
jb 0x100994aa
mov ecx, dword [edi + 4]
jmp 0x100994ad
lea ecx, [edi + 4]
push eax
push ecx
call fcn.1008d830
add esp, 8
test al, al
lea ecx, [esp + 0x22c]
sete byte [esp + 0x17]
mov byte [esp + 0x314], 0x6b
call fcn.100019e0
cmp byte [esp + 0x17], bl
je 0x10099550
lea eax, [ebp + 0x30b8]
push eax
lea ecx, [esp + 0xcc]
call fcn.100035d0
push 0xffffffffffffffff
push ebx
push edi
lea ecx, [ebp + 0x259c]
mov byte [esp + 0x320], 0x78
call fcn.10001a10
lea ecx, [esp + 0xc8]
mov byte [esp + 0x314], 0x6b
call fcn.100035f0
jmp 0x10099550
lea eax, [esp + 0x17]
push eax
lea ecx, [ebp + 0x2398]
mov byte [esp + 0x1b], 1
call fcn.10036c40
jmp 0x10099550
cmp dword [edi + 0x18], 0x10
jb 0x1009953a
mov eax, dword [edi + 4]
jmp 0x1009953d
lea eax, [edi + 4]
push eax
call fcn.1008da20
add esp, 4
test al, al
jne 0x10099550
mov byte [ebp + 0x3315], bl
lea esi, [ebp + 0x23a0]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov cl, byte [ebp + 0x23b8]
push esi
mov byte [esp + 0x1b], cl
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp byte [esp + 0x17], bl
jne 0x100995bb
lea edx, [esp + 0x1bc]
push edx
mov ecx, ebp
call fcn.1008d270
cmp dword [edi + 0x18], 0x10
mov ecx, dword [edi + 0x14]
mov byte [esp + 0x314], 0x79
mov dword [esp + 0x18], 1
jb 0x100995a1
mov edx, dword [edi + 4]
jmp 0x100995a4
lea edx, [edi + 4]
push ecx
mov ecx, dword [eax + 0x14]
push edx
push ecx
push ebx
mov ecx, eax
call fcn.1002c420
test eax, eax
mov byte [esp + 0x17], 1
jne 0x100995bf
mov byte [esp + 0x17], bl
test byte [esp + 0x18], 1
mov dword [esp + 0x314], 0x6b
mov esi, 0x10
je 0x100995f4
and dword [esp + 0x18], 0xfffffffe
cmp dword [esp + 0x1d4], esi
jb 0x100995f4
mov edx, dword [esp + 0x1c0]
push edx
call fcn.10157f3b
add esp, 4
cmp byte [esp + 0x17], bl
je 0x10099715
lea eax, [esp + 0x248]
push eax
mov ecx, ebp
call fcn.1008d270
or dword [esp + 0x18], 2
cmp dword [eax + 0x18], esi
mov byte [esp + 0x314], 0x7a
jb 0x10099624
mov eax, dword [eax + 4]
jmp 0x10099627
add eax, 4
push eax
call fcn.1002d140
add esp, 4
test al, al
je 0x10099665
lea ecx, [esp + 0xec]
push ecx
mov ecx, ebp
call fcn.1008d270
or dword [esp + 0x18], 4
push eax
mov dword [esp + 0x318], 0x7b
call fcn.100f6ecb
add esp, 4
test al, al
mov byte [esp + 0x17], 1
je 0x10099669
mov byte [esp + 0x17], bl
test byte [esp + 0x18], 4
je 0x100996aa
and dword [esp + 0x18], 0xfffffffb
cmp dword [esp + 0x104], esi
jb 0x1009968e
mov edx, dword [esp + 0xf0]
push edx
call fcn.10157f3b
add esp, 4
mov esi, 0xf
mov dword [esp + 0x104], esi
mov dword [esp + 0x100], ebx
mov byte [esp + 0xf0], bl
jmp 0x100996af
mov esi, 0xf
test byte [esp + 0x18], 2
mov dword [esp + 0x314], 0x6b
je 0x100996cd
lea ecx, [esp + 0x248]
call fcn.100019e0
cmp byte [esp + 0x17], bl
je 0x1009971a
lea esi, [ebp + 0x30b8]
mov dword [esp + 0x5c], esi
add esi, 4
push esi
mov dword [esp + 0x5c], 0x101975f4
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0xffffffffffffffff
push ebx
push edi
lea ecx, [ebp + 0x259c]
mov byte [esp + 0x320], 0x7c
call fcn.10001a10
push esi
mov byte [esp + 0x318], 0x6b
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, 0xf
push 0xffffffffffffffff
push ebx
lea eax, [ebp + 0x259c]
push eax
lea ecx, [esp + 0x168]
mov dword [esp + 0x180], esi
mov dword [esp + 0x17c], ebx
mov byte [esp + 0x16c], bl
call fcn.10001a10
lea eax, [esp + 0x124]
push eax
mov ecx, ebp
mov byte [esp + 0x318], 0x7d
call fcn.1008d1e0
push 0xffffffffffffffff
push ebx
lea eax, [ebp + 0x242a]
push eax
lea ecx, [esp + 0x48]
mov byte [esp + 0x320], 0x7e
mov dword [esp + 0x60], esi
mov dword [esp + 0x5c], ebx
mov byte [esp + 0x4c], bl
call fcn.10001a10
mov edi, 0x10
cmp dword [esp + 0x54], edi
jb 0x1009979b
mov ecx, dword [esp + 0x40]
push ecx
call fcn.10157f3b
add esp, 4
cmp dword [esp + 0x13c], edi
mov dword [esp + 0x54], esi
mov dword [esp + 0x50], ebx
mov byte [esp + 0x40], bl
jb 0x100997c0
mov edx, dword [esp + 0x128]
push edx
call fcn.10157f3b
add esp, 4
cmp dword [esp + 0x174], edi
mov dword [esp + 0x13c], esi
mov dword [esp + 0x138], ebx
mov byte [esp + 0x128], bl
mov byte [esp + 0x314], 0x6b
jb 0x100997f6
mov eax, dword [esp + 0x160]
push eax
call fcn.10157f3b
add esp, 4
push 0x37
lea eax, [ebp + 0x1d75]
push ebx
push eax
call fcn.101580b0
mov esi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, 0x8000
add esp, 0xc
lea edi, [ebp + 0x23cc]
mov word [ebp + 0x1d82], ax
push edi
mov dword [ebp + 0x1d84], eax
call esi
push edi
mov dword [ebp + 0x23e4], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea edi, [ebp + 0x23f0]
push edi
call esi
push edi
mov dword [ebp + 0x2408], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea edi, [ebp + 0x25c0]
push edi
call esi
push edi
mov dword [ebp + 0x25d8], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp + 0x250b], ebx
je 0x10099881
lea edi, [ebp + 0x3004]
push edi
call esi
push edi
mov byte [ebp + 0x301c], 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov byte [ebp + 0x3124], bl
mov cx, word [ebp + 0x2548]
mov word [ebp + 0x3126], cx
mov dx, word [ebp + 0x2548]
lea esi, [ebp + 0x24ee]
mov word [ebp + 0x3128], dx
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x100999dd
mov ecx, dword [esi + 8]
sub ecx, eax
je 0x100999dd
lea edx, [esp + 0x140]
push edx
mov ecx, ebp
mov byte [ebp + 0x312b], 1
call fcn.1008d1e0
push eax
lea eax, [esp + 0x2f0]
push eax
mov byte [esp + 0x31c], 0x7f
call fcn.100f364e
add esp, 8
mov edi, 0x10
cmp dword [esp + 0x158], edi
mov byte [esp + 0x314], 0x81
jb 0x10099914
mov ecx, dword [esp + 0x144]
push ecx
call fcn.10157f3b
add esp, 4
cmp dword [esp + 0x304], edi
mov eax, dword [esp + 0x2f0]
mov dword [esp + 0x158], 0xf
mov dword [esp + 0x154], ebx
mov byte [esp + 0x144], bl
jae 0x10099944
lea eax, [esp + 0x2f0]
push eax
call fcn.1002d140
add esp, 4
test al, al
jne 0x100999b3
lea edx, [esp + 0x2ec]
push esi
push edx
mov byte [ebp + 0x312a], bl
call fcn.100ff0c9
add esp, 8
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x2f4]
push eax
lea ecx, [esp + 0x114]
mov dword [esp + 0x12c], 0xf
mov dword [esp + 0x128], ebx
mov byte [esp + 0x118], bl
call fcn.10001a10
cmp dword [esp + 0x120], edi
jb 0x100999ba
mov ecx, dword [esp + 0x10c]
push ecx
call fcn.10157f3b
add esp, 4
jmp 0x100999ba
mov byte [ebp + 0x312a], 1
cmp dword [esp + 0x304], edi
mov byte [esp + 0x314], 0x6b
jb 0x100999e3
mov edx, dword [esp + 0x2f0]
push edx
call fcn.10157f3b
add esp, 4
jmp 0x100999e3
mov byte [ebp + 0x312b], bl
push 0x240
mov byte [ebp + 0x2610], 1
call fcn.101582b6
add esp, 4
mov dword [esp + 0x1c], eax
cmp eax, ebx
mov byte [esp + 0x314], 0x82
je 0x10099a11
push ebp
mov ecx, eax
call fcn.101365eb
jmp 0x10099a13
xor eax, eax
cmp eax, ebx
mov byte [esp + 0x314], 0x6b
mov dword [ebp + 0x2730], eax
je 0x10099a47
mov ecx, dword [esp + 0x24]
push ecx
mov ecx, eax
call fcn.101335e2
cmp byte [ebp + 0x2560], 1
jne 0x10099a47
mov ecx, dword [ebp + 0x2730]
push 4
call fcn.10133809
mov edx, dword [ebp + 0x3328]
mov dword [ebp + 0x254a], edx
mov eax, dword [ebp + 0x3324]
push 0x1690
mov dword [ebp + 0x254e], eax
call fcn.101582b6
add esp, 4
mov dword [esp + 0x24], eax
cmp eax, ebx
mov byte [esp + 0x314], 0x83
je 0x10099ac0
mov ecx, dword [ebp + 0x26d8]
push ebx
lea edx, [ebp + 0x1e18]
push edx
push ecx
mov ecx, dword [ebp + 0x2730]
lea edx, [ebp + 0x1cf2]
push edx
lea edx, [ebp + 0xba8]
push edx
lea edx, [ebp + 0x2426]
push edx
mov edx, dword [ebp + 0x26dc]
push edx
push ecx
lea edx, [ebp + 8]
push edx
mov edx, dword [esp + 0x44]
push edx
mov ecx, eax
call fcn.10042310
jmp 0x10099ac2
xor eax, eax
mov dword [ebp + 0x272c], eax
mov cl, byte [ebp + 0x255f]
cmp cl, 1
mov byte [esp + 0x314], 0x6b
je 0x10099ae0
cmp cl, 3
jne 0x10099af0
cmp eax, ebx
je 0x10099af0
push 0x2800
mov ecx, eax
call fcn.10038620
cmp dword [ebp + 0x243e], ebx
je 0x10099b16
cmp byte [ebp + 0x2560], 1
mov ecx, dword [ebp + 0x2730]
lea eax, [ebp + 0x34]
jne 0x10099b0e
push 4
jmp 0x10099b10
push 2
push eax
call fcn.101337cb
push 0x1268
call fcn.101582b6
add esp, 4
mov dword [esp + 0x24], eax
cmp eax, ebx
mov byte [esp + 0x314], 0x84
je 0x10099b71
mov ecx, dword [esp + 0x30]
push ebx
push 1
push ebx
lea edx, [ebp + 0x1cf2]
push edx
lea edx, [ebp + 0x2426]
push edx
mov edx, dword [esp + 0x4c]
push ecx
mov ecx, dword [ebp + 0x2730]
push edx
lea edx, [ebp + 0x3c]
push edx
mov edx, dword [ebp + 0x1e80]
push ecx
mov ecx, dword [ebp + 0x1e84]
push edx
push ecx
mov ecx, eax
call fcn.100739b0
jmp 0x10099b73
xor eax, eax
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0x242a]
push eax
lea ecx, [ebp + 0x3178]
mov byte [esp + 0x318], 0x6b
call fcn.100447f0
mov edx, dword [ebp + 0x3118]
mov dword [ebp + 0x311c], edx
mov dword [ebp + 0x3120], 0xffffffff
mov eax, ebp
mov ecx, dword [esp + 0x30c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2f4]
xor ecx, esp
call fcn.101586e7
add esp, 0x304
ret 0x30