Function at 0x100b9bf0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xdc
mov eax, dword [0x10166004]
xor eax, esp
mov dword [esp + 0xd4], eax
push ebx
mov ebx, dword [esp + 0xe4]
push ebp
mov ebp, ecx
mov dword [esp + 0x28], edx
push esi
xor edx, edx
mov dword [esp + 0x3c], ebp
push edi
mov eax, dword [ebp]
mov esi, dword [ebp + 8]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], 0
mov eax, dword [eax]
mov dword [esp + 0x54], eax
mov dword [esp + 0x38], edx
mov dword [esp + 0x6c], esi
mov ecx, dword [eax]
mov dword [esp + 0x2c], ecx
xor ecx, ecx
mov dword [esp + 0x24], ecx
cmp dword [eax + 0x24], ecx
je 0x100b9c54
mov eax, dword [eax + 0xc]
jmp 0x100ba687
mov eax, dword [esi + 0x2c]
mov edx, 0x18
movzx ecx, word [esi + 0x18]
test al, 0x20
mov dword [esp + 0x50], eax
mov eax, 0x1bf
cmove edx, eax
mov dword [esp + 0x48], ecx
movzx eax, word [esi + 0x1a]
mov dword [esp + 0x60], eax
movzx eax, word [esi + 0x1c]
mov dword [esp + 0x64], eax
movzx eax, word [esi + 0x32]
mov dword [esp + 0x68], eax
movzx eax, word [esi + 0x30]
mov dword [esp + 0x44], eax
mov eax, dword [esi]
mov dword [esp + 0x58], eax
mov eax, dword [esi + 4]
mov dword [esp + 0x5c], eax
movzx eax, word [esi + 0x16]
mov edi, eax
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x78], edi
movzx edi, cx
mov ecx, edx
and ecx, 0xffffffc3
mov dword [esp + 0x1c], edi
test byte [ebx + 0x38], 4
push ebx
cmove ecx, edx
mov edx, dword [ebp + 4]
push ecx
push edi
push dword [eax + 0x2c]
lea ecx, [esp + 0x90]
call fcn.100b7170
mov ebp, eax
add esp, 0x10
xor eax, eax
mov word [esi + 0x12], ax
mov ecx, dword [ebx + 8]
movzx ecx, word [ecx]
mov eax, ecx
mov dword [esp + 0x74], eax
cmp ax, 0xa
jg 0x100b9cfa
xor eax, eax
jmp 0x100b9d0f
movsx eax, cx
cdq
push edx
push eax
call fcn.10023a30
add esp, 8
sub ax, 0x21
movzx eax, ax
mov dword [esp + 0x28], eax
mov ecx, 0x100
movzx eax, ax
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0xf4]
mov dword [esp + 0x3c], eax
nop word [eax + eax]
test ebp, ebp
je 0x100ba505
movzx edx, word [ebp + 0xc]
mov eax, edx
mov dword [esp + 0x20], 0
mov dword [esp + 0x34], eax
cmp ax, cx
je 0x100b9d55
test byte [ebp + 0xa], 0x80
je 0x100b9d81
mov eax, dword [ebx + 4]
movsx ecx, word [eax + edi*2]
test ecx, ecx
js 0x100b9d78
mov eax, dword [ebx + 0xc]
add ecx, ecx
mov eax, dword [eax + 4]
test dword [eax + ecx*8 + 4], 0xf
jne 0x100ba4e7
jmp 0x100b9d81
cmp ecx, 0xffffffff
je 0x100ba4e7
mov ecx, dword [esi + 8]
mov eax, dword [esi + 0xc]
and ecx, dword [ebp + 0x20]
and eax, dword [ebp + 0x24]
or ecx, eax
jne 0x100ba4e7
mov eax, 0x100
test word [ebp + 0xa], ax
je 0x100b9da9
cmp edx, 0x10
je 0x100ba4e7
mov eax, dword [esp + 0x30]
mov cl, byte [eax + 0x24]
test cl, 0x58
je 0x100b9de6
mov eax, dword [ebp]
mov edx, dword [eax + 4]
test dl, 3
je 0x100ba4e7
mov edi, dword [esp + 0x30]
mov eax, dword [eax + 0x24]
cmp eax, dword [edi + 0x2c]
mov edi, dword [esp + 0x1c]
jne 0x100ba4e7
test cl, 0x18
je 0x100b9de6
test dl, 2
jne 0x100ba4e7
cmp byte [ebx + 0x36], 0
je 0x100b9dff
movzx eax, word [ebx + 0x32]
dec eax
cmp edi, eax
jne 0x100b9dff
mov eax, dword [esp + 0x40]
or byte [eax + 0x10], 2
jmp 0x100b9e07
mov eax, dword [esp + 0x40]
or byte [eax + 0x10], 1
mov eax, dword [esp + 0x50]
mov edx, dword [esp + 0x44]
movzx ecx, word [esi + 0x34]
mov dword [esi + 0x2c], eax
mov eax, dword [esp + 0x48]
mov word [esi + 0x18], ax
mov eax, dword [esp + 0x60]
mov word [esi + 0x1a], ax
mov eax, dword [esp + 0x64]
mov word [esi + 0x1c], ax
movzx eax, dx
mov word [esi + 0x30], dx
cmp ax, cx
jb 0x100b9e95
lea edi, [eax + 1]
cmp ecx, edi
jae 0x100b9e95
mov ecx, dword [esp + 0x2c]
add edi, 7
and edi, 0xfffffff8
push 0
lea eax, [edi*4]
push eax
call fcn.1001ec50
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x100ba505
movzx ecx, word [esi + 0x34]
shl ecx, 2
push ecx
push dword [esi + 0x38]
push ebx
call fcn.1012bff0
mov edx, dword [esi + 0x38]
lea eax, [esi + 0x40]
add esp, 0xc
cmp edx, eax
je 0x100b9e8e
mov ecx, dword [esp + 0x2c]
call fcn.1001e7b0
mov dword [esi + 0x38], ebx
mov word [esi + 0x34], di
movzx ecx, word [esi + 0x30]
mov eax, dword [esi + 0x38]
mov edi, dword [esp + 0x58]
mov dword [eax + ecx*4], ebp
mov ax, word [esi + 0x30]
mov ecx, dword [esi + 8]
inc ax
mov word [esi + 0x30], ax
not ecx
mov edx, dword [ebp + 0x24]
or edi, dword [ebp + 0x20]
or edx, dword [esp + 0x5c]
and edi, ecx
movzx ebx, ax
mov eax, dword [esi + 0xc]
not eax
mov dword [esi], edi
and edx, eax
mov eax, dword [esp + 0x34]
mov dword [esi + 4], edx
test al, 1
je 0x100b9fdb
mov edx, dword [ebp]
test dword [edx + 4], 0x1000
je 0x100b9f5a
lea edi, [ebx - 1]
mov dword [esp + 0x20], 0x2e
xor ecx, ecx
test edi, edi
jle 0x100b9f7b
mov ebx, dword [esi + 0x38]
mov esi, dword [esp + 0x20]
mov eax, dword [ebx + ecx*4]
test eax, eax
je 0x100b9f17
cmp dword [eax], edx
mov dword [esp + 0x20], 0
cmove esi, dword [esp + 0x20]
inc ecx
cmp ecx, edi
jl 0x100b9f01
mov dword [esp + 0x20], esi
mov esi, dword [esp + 0x6c]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
test byte [eax + 0x38], 0x80
je 0x100b9fcb
cmp word [esp + 0x28], 0xa
jl 0x100b9fcb
mov eax, dword [eax + 8]
mov edx, dword [esp + 0x1c]
movzx edi, cx
movzx ebx, word [eax + edx*2]
cmp di, 0xa
jg 0x100b9f82
xor eax, eax
jmp 0x100b9f97
mov eax, dword [edx + 0x14]
test eax, eax
je 0x100b9f24
mov eax, dword [eax]
test eax, eax
je 0x100b9f24
cdq
push edx
push eax
call fcn.10023a30
movsx ecx, ax
add esp, 8
mov dword [esp + 0x20], ecx
jmp 0x100b9f28
mov ecx, 0x2e
jmp 0x100b9f28
movsx eax, di
cdq
push edx
push eax
call fcn.10023a30
add esp, 8
sub ax, 0x21
movzx eax, ax
sub eax, edi
sub eax, dword [esp + 0x28]
add eax, 0xa
add eax, ebx
test ax, ax
jns 0x100b9fcb
cmp word [esp + 0x3c], 2
jge 0x100ba4df
mov eax, dword [esp + 0x2c]
test dword [eax + 0x50], 0x20000
jne 0x100ba4df
or dword [esi + 0x2c], 0x100000
or dword [esi + 0x2c], 4
mov ebx, dword [esi + 0x2c]
mov edx, dword [esp + 0x24]
jmp 0x100ba18a
test al, 0x82
je 0x100ba06f
mov edi, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov eax, dword [edi + 4]
movsx eax, word [eax + ecx*2]
mov ecx, dword [esi + 0x2c]
or ecx, 1
mov dword [esi + 0x2c], ecx
cmp eax, 0xffffffff
je 0x100ba044
mov edx, ecx
mov ebx, ecx
test eax, eax
js 0x100ba051
cmp word [esp + 0x3c], 0
jne 0x100ba051
movzx eax, word [edi + 0x32]
mov edi, eax
dec eax
cmp dword [esp + 0x1c], eax
jne 0x100ba051
mov eax, dword [esp + 0x18]
test byte [eax + 0x38], 8
jne 0x100ba044
cmp edi, 1
jne 0x100ba03a
cmp byte [eax + 0x36], 0
je 0x100ba03a
cmp word [esp + 0x34], 2
je 0x100ba044
mov ebx, ecx
or ebx, 0x10000
jmp 0x100ba04c
mov ebx, ecx
or ebx, 0x1000
mov edx, ebx
mov dword [esi + 0x2c], ebx
cmp byte [esp + 0x99], 1
jbe 0x100ba066
mov ebx, edx
or ebx, 0x200000
mov dword [esi + 0x2c], ebx
mov edx, dword [esp + 0x24]
jmp 0x100ba18a
test eax, 0x100
je 0x100ba088
mov ebx, dword [esi + 0x2c]
mov edx, dword [esp + 0x24]
or ebx, 8
mov dword [esi + 0x2c], ebx
jmp 0x100ba18a
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x54]
push ebp
push dword [esp + 0x20]
mov edx, dword [eax + 0x2c]
push dword [esp + 0x20]
call fcn.100b99d0
mov ebx, dword [esi + 0x2c]
add esp, 0xc
test byte [esp + 0x34], 0x24
je 0x100ba164
or ebx, 0x22
mov word [esi + 0x1a], ax
xor edx, edx
mov dword [esi + 0x2c], ebx
mov eax, 0x100
mov dword [esp + 0x24], ebp
mov dword [esp + 0x38], edx
test word [ebp + 0xa], ax
je 0x100ba15e
movzx edi, word [esi + 0x30]
lea eax, [ebp + 0x30]
mov dword [esp + 0x38], eax
inc edi
movzx eax, word [esi + 0x34]
cmp eax, edi
jae 0x100ba13c
mov ecx, dword [esp + 0x2c]
add edi, 7
and edi, 0xfffffff8
push edx
lea eax, [edi*4]
push eax
call fcn.1001ec50
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x100ba505
movzx ecx, word [esi + 0x34]
shl ecx, 2
push ecx
push dword [esi + 0x38]
push ebx
call fcn.1012bff0
mov edx, dword [esi + 0x38]
lea eax, [esi + 0x40]
add esp, 0xc
cmp edx, eax
je 0x100ba135
mov ecx, dword [esp + 0x2c]
call fcn.1001e7b0
mov dword [esi + 0x38], ebx
mov word [esi + 0x34], di
movzx ecx, word [esi + 0x30]
mov eax, dword [esi + 0x38]
mov edx, dword [esp + 0x38]
mov dword [eax + ecx*4], edx
mov eax, 1
inc word [esi + 0x30]
or dword [esi + 0x2c], 0x10
mov ebx, dword [esi + 0x2c]
mov word [esi + 0x1c], ax
mov edx, dword [esp + 0x24]
jmp 0x100ba18a
or ebx, 0x12
mov word [esi + 0x1c], ax
mov dword [esi + 0x2c], ebx
mov dword [esp + 0x38], ebp
test bl, 0x20
je 0x100ba184
movzx ecx, word [esi + 0x30]
mov eax, dword [esi + 0x38]
mov edx, dword [eax + ecx*4 - 8]
jmp 0x100ba186
xor edx, edx
mov dword [esp + 0x24], edx
test bl, 2
je 0x100ba22f
movzx eax, word [esi + 0x16]
movsx edi, ax
test edx, edx
je 0x100ba1b4
movzx ecx, word [edx + 8]
test cx, cx
jg 0x100ba1ab
add eax, ecx
jmp 0x100ba1b4
test byte [edx + 0xa], 0x80
jne 0x100ba1b4
sub eax, 0x14
mov ebp, dword [esp + 0x38]
movzx ecx, ax
test ebp, ebp
je 0x100ba1d8
movzx edx, word [ebp + 8]
test dx, dx
jg 0x100ba1cc
add eax, edx
jmp 0x100ba1d5
test byte [ebp + 0xa], 0x80
jne 0x100ba1d8
add eax, 0xffffffec
movzx ecx, ax
mov eax, dword [esp + 0x24]
movzx edx, cx
test eax, eax
je 0x100ba1fb
cmp word [eax + 8], 0
jle 0x100ba1fb
test ebp, ebp
je 0x100ba1fb
cmp word [ebp + 8], 0
jle 0x100ba1fb
lea eax, [ecx - 0x14]
movzx edx, ax
xor eax, eax
cmp dword [esp + 0x24], eax
setne al
sub edi, eax
xor eax, eax
test ebp, ebp
setne al
sub edi, eax
cmp dx, 0xa
mov eax, 0xa
cmovl edx, eax
movzx eax, dx
cmp eax, edi
mov edx, eax
movzx eax, di
cmovge edx, eax
movzx eax, dx
mov edi, eax
jmp 0x100ba294
inc word [esi + 0x18]
movzx ecx, word [ebp + 8]
movzx edx, word [esi + 0x18]
test cx, cx
jg 0x100ba261
mov eax, dword [esp + 0x18]
mov ebp, dword [esp + 0x1c]
mov eax, dword [eax + 4]
cmp word [eax + ebp*2], 0
jl 0x100ba261
sub ecx, dword [esp + 0x20]
add cx, word [esi + 0x16]
movzx eax, cx
mov edi, eax
jmp 0x100ba294
mov eax, dword [esp + 0x18]
mov cx, word [esi + 0x16]
mov eax, dword [eax + 8]
sub cx, word [eax + edx*2 - 2]
add cx, word [eax + edx*2]
test dword [esp + 0x34], 0x100
movzx eax, cx
mov edi, eax
mov word [esi + 0x16], ax
mov ecx, eax
mov dword [esp + 0x14], edi
je 0x100ba29c
lea eax, [ecx + 0xa]
movzx edi, ax
mov word [esi + 0x16], ax
mov dword [esp + 0x14], edi
mov ecx, dword [esp + 0x18]
movzx eax, di
mov dword [esp + 0x34], eax
lea eax, [edi + 0x10]
movzx ebp, ax
mov eax, dword [ecx + 0x38]
and eax, 3
cmp al, 3
jne 0x100ba2bb
mov edi, ebp
jmp 0x100ba2da
movsx ecx, word [ecx + 0x30]
mov eax, ecx
shl eax, 4
sub eax, ecx
mov ecx, dword [esp + 0x30]
cdq
mov ecx, dword [ecx + 0x10]
movsx ecx, word [ecx + 0x28]
idiv ecx
inc eax
add eax, edi
movzx edi, ax
mov eax, ebp
movsx edx, di
movzx ebp, ax
mov eax, dword [esp + 0x70]
movsx ecx, ax
cmp word [esp + 0x28], di
jl 0x100ba31b
lea eax, [edx + 0x31]
cmp ecx, eax
jle 0x100ba2fd
mov eax, dword [esp + 0x28]
jmp 0x100ba33f
lea eax, [edx + 0x1f]
cmp ecx, eax
jle 0x100ba30b
mov eax, dword [esp + 0x28]
inc eax
jmp 0x100ba33f
sub ecx, edx
movzx eax, byte [ecx + str._n_n_t_t_b_b_a_a_a]
add ax, word [esp + 0x28]
jmp 0x100ba33f
lea eax, [ecx + 0x31]
cmp edx, eax
jle 0x100ba327
movzx ecx, di
jmp 0x100ba342
lea eax, [ecx + 0x1f]
cmp edx, eax
jle 0x100ba333
lea eax, [edi + 1]
jmp 0x100ba33f
sub edx, ecx
movzx eax, byte [edx + str._n_n_t_t_b_b_a_a_a]
add ax, di
movzx ecx, ax
movzx eax, cx
test ebx, 0x4000140
jne 0x100ba3ce
mov ebx, ebp
movsx edx, cx
mov ebp, dword [esp + 0x14]
movsx edi, bp
add edi, 0x10
cmp cx, bx
jl 0x100ba39a
lea eax, [edi + 0x31]
cmp edx, eax
jle 0x100ba374
movzx eax, cx
movzx eax, ax
jmp 0x100ba3d2
lea eax, [edi + 0x1f]
cmp edx, eax
jle 0x100ba386
lea eax, [ecx + 1]
movzx eax, ax
movzx eax, ax
jmp 0x100ba3d2
sub edx, edi
movzx eax, byte [edx + str._n_n_t_t_b_b_a_a_a]
add ax, cx
movzx eax, ax
movzx eax, ax
jmp 0x100ba3d2
lea eax, [edx + 0x31]
cmp edi, eax
jle 0x100ba3a8
mov eax, ebx
movzx eax, ax
jmp 0x100ba3d2
lea eax, [edx + 0x1f]
cmp edi, eax
jle 0x100ba3ba
lea eax, [ebx + 1]
movzx eax, ax
movzx eax, ax
jmp 0x100ba3d2
sub edi, edx
movzx eax, byte [edi + str._n_n_t_t_b_b_a_a_a]
add ax, bx
movzx eax, ax
movzx eax, ax
jmp 0x100ba3d2
mov ebp, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
mov edx, esi
mov ebx, dword [esp + 0x40]
push dword [esp + 0x74]
movzx edi, cx
add eax, edi
add eax, dword [esp + 0x40]
mov word [esi + 0x14], ax
lea eax, [edi + ebp]
add eax, dword [esp + 0x40]
mov word [esi + 0x16], ax
mov ecx, dword [ebx + 4]
call fcn.100b9780
add esp, 4
mov edx, esi
mov ecx, ebx
call fcn.100b94c0
mov ecx, dword [esp + 0x78]
mov ebx, dword [esp + 0x18]
movzx edx, cx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0x2c]
test al, 2
movzx ecx, cx
cmove edx, ecx
mov word [esi + 0x16], dx
test al, 0x10
jne 0x100ba4d5
movzx ecx, word [esi + 0x18]
cmp cx, word [ebx + 0x34]
jae 0x100ba4d5
cmp cx, word [ebx + 0x32]
jb 0x100ba457
mov eax, dword [ebx + 0x38]
and al, 3
cmp al, 2
je 0x100ba4d5
cmp ecx, 3
jbe 0x100ba4bd
mov ebp, dword [esp + 0x54]
mov ecx, dword [ebp]
cmp dword [ecx + 0x128], 0
je 0x100ba476
inc dword [ebp + 0x24]
mov dword [ebp + 0xc], 9
cmp dword [ecx + 0x174], 0
je 0x100ba4bd
mov eax, dword [ebp + 0x98]
inc eax
mov dword [ebp + 0x98], eax
cmp eax, dword [ecx + 0x17c]
jb 0x100ba4bd
push dword [ecx + 0x178]
mov eax, dword [ecx + 0x174]
call eax
add esp, 4
test eax, eax
je 0x100ba4b3
inc dword [ebp + 0x24]
mov dword [ebp + 0xc], 9
mov dword [ebp + 0x98], 0
mov eax, dword [esp + 0x3c]
mov edx, dword [esp + 0x30]
add eax, edi
mov ecx, dword [esp + 0x40]
push eax
push ebx
call fcn.100b9bf0
add esp, 8
mov eax, dword [esp + 0x4c]
mov word [esi + 0x16], ax
jmp 0x100ba4e3
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
lea ecx, [esp + 0x80]
call fcn.100b6e50
cmp dword [esp + 0x14], 0
mov ebp, eax
mov ecx, 0x100
je 0x100b9d30
mov eax, dword [esp + 0x58]
mov ebx, dword [esp + 0x48]
mov ecx, dword [esp + 0x68]
mov dword [esi], eax
mov eax, dword [esp + 0x5c]
mov dword [esi + 4], eax
mov eax, dword [esp + 0x60]
mov word [esi + 0x1a], ax
mov eax, dword [esp + 0x64]
mov word [esi + 0x1c], ax
mov eax, dword [esp + 0x50]
mov dword [esi + 0x2c], eax
mov eax, dword [esp + 0x4c]
mov word [esi + 0x16], ax
mov eax, dword [esp + 0x44]
mov word [esi + 0x18], bx
mov word [esi + 0x32], cx
mov word [esi + 0x30], ax
cmp bx, cx
jne 0x100ba683
mov ebp, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
movzx ecx, word [ebp + 0x32]
lea eax, [edx + 1]
cmp eax, ecx
jae 0x100ba683
mov eax, dword [esp + 0x44]
movzx edi, ax
cmp bx, di
jne 0x100ba683
mov eax, dword [ebp + 0x38]
test al, 0x40
jne 0x100ba683
test al, al
jns 0x100ba683
mov ecx, dword [esp + 0x2c]
test dword [ecx + 0x50], 0x4000
jne 0x100ba683
mov eax, dword [ebp + 8]
cmp word [eax + edx*2 + 2], 0x2a
jl 0x100ba683
movzx eax, word [esi + 0x34]
inc edi
cmp eax, edi
jae 0x100ba611
add edi, 7
and edi, 0xfffffff8
push 0
lea eax, [edi*4]
push eax
call fcn.1001ec50
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x100ba5db
lea eax, [ebx + 7]
jmp 0x100ba687
movzx eax, word [esi + 0x34]
shl eax, 2
push eax
push dword [esi + 0x38]
push ebx
call fcn.1012bff0
mov edx, dword [esi + 0x38]
lea eax, [esi + 0x40]
add esp, 0xc
cmp edx, eax
je 0x100ba602
mov ecx, dword [esp + 0x2c]
call fcn.1001e7b0
mov edx, dword [esp + 0x1c]
mov dword [esi + 0x38], ebx
mov ebx, dword [esp + 0x48]
mov word [esi + 0x34], di
movzx ecx, word [esi + 0x30]
mov eax, dword [esi + 0x38]
inc word [esi + 0x18]
inc word [esi + 0x32]
mov dword [esp + 0x14], 0
mov dword [eax + ecx*4], 0
inc word [esi + 0x30]
or dword [esi + 0x2c], 0x8000
mov eax, dword [ebp + 8]
mov ecx, dword [esp + 0x3c]
add ecx, 5
mov di, word [eax + edx*2]
sub di, word [eax + edx*2 + 2]
mov edx, dword [esp + 0x30]
movzx eax, di
sub word [esi + 0x16], ax
add eax, ecx
mov ecx, dword [esp + 0x40]
push eax
push ebp
call fcn.100b9bf0
mov eax, dword [esp + 0x54]
add esp, 8
mov word [esi + 0x16], ax
mov eax, dword [esp + 0x68]
mov word [esi + 0x32], ax
mov eax, dword [esp + 0x50]
mov word [esi + 0x18], bx
mov dword [esi + 0x2c], eax
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0xe4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10129271
add esp, 0xdc
ret