Function at 0x6e7630
Capabilities:
Check os version
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 0x10]
sub esp, 0x284
xor ecx, ecx
test eax, eax
setne cl
test eax, eax
push ebx
push esi
push edi
mov dword [0x100ef814], ecx
je 0x6e766f
mov edx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [0x100ef818], edx
mov edx, dword [eax + 8]
mov dword [0x100ef81c], ecx
mov dword [0x100ef810], edx
jmp 0x6e7695
mov eax, dword [ebp + 8]
test eax, eax
mov ecx, dword [ebp + 0xc]
jne 0x6e767d
test ecx, ecx
je 0x6e7685
mov dword [0x100ef81c], ecx
jmp 0x6e7690
call fcn.006bb9c0
mov dword [0x100ef81c], edx
mov dword [0x100ef818], eax
call dword [0x100cf09c]
push 0
push 0
push 0
mov dword [0x100ef80c], eax
call dword [0x100cf1d4]
mov esi, dword [0x100cf1d8]
mov dword [0x100ef808], eax
call esi
mov dword [0x100e7a04], eax
call esi
mov dword [0x100ef804], eax
call esi
mov dword [0x100e7a08], eax
call esi
push 0x100e3420
push 0x100cf820
mov dword [0x100e7a10], eax
mov dword [0x100ef800], 0
call dword [0x100cf258]
mov esi, dword [0x100cf25c]
push eax
call esi
test eax, eax
mov dword [0x100ef7fc], eax
je 0x6e7711
push 0x100ef800
call dword [0x100cf22c]
push eax
call dword [0x100ef7fc]
mov eax, dword [0x100ef800]
mov ebx, dword [0x100cf254]
xor ecx, ecx
test eax, eax
setne cl
push 0x100cf3dc
mov dword [0x100ef7f8], eax
lea ecx, [ecx*4 + 4]
mov dword [0x100ef7f4], ecx
call ebx
mov edi, eax
push 0x100e3430
push edi
call esi
push 0x100cf3cc
push edi
mov dword [0x100ef7f0], eax
call esi
push 0x100e343c
push edi
mov dword [0x100ef7ec], eax
call esi
push 0x100e344c
push edi
mov dword [0x100ef7e8], eax
call esi
push 0x100da38c
push edi
mov dword [0x100ef7e4], eax
call esi
push 0x100e3460
push edi
mov dword [0x100ef7e0], eax
call esi
push 0x100d786c
push edi
mov dword [0x100ef7dc], eax
call esi
push 0x100d77cc
push edi
mov dword [0x100ef7d8], eax
call esi
push 0x100e3478
push edi
mov dword [0x100ef7d4], eax
call esi
push 0x100e3490
push edi
mov dword [0x100ef7d0], eax
call esi
push 0x100d79d0
push edi
mov dword [0x100ef7cc], eax
call esi
push 0x100e34a8
push edi
mov dword [0x100ef7c8], eax
call esi
push 0x100e34c0
push edi
mov dword [0x100ef7c4], eax
call esi
push 0x100e34dc
push edi
mov dword [0x100ef7c0], eax
call esi
push 0x100e34f8
push edi
mov dword [0x100ef7bc], eax
call esi
push 0x100e350c
push edi
mov dword [0x100ef7b8], eax
call esi
push 0x100e3528
push edi
mov dword [0x100ef7b4], eax
call esi
push 0x100d763c
mov dword [0x100ef7b0], eax
push edi
call esi
push 0x100d7678
push edi
mov dword [0x100ef7ac], eax
call esi
push 0x100e353c
push edi
mov dword [0x100ef7a8], eax
call esi
push 0x100e355c
push edi
mov dword [0x100ef7a4], eax
call esi
push 0x100e3574
push edi
mov dword [0x100ef7a0], eax
call esi
push 0x100e358c
push edi
mov dword [0x100ef79c], eax
call esi
push 0x100e35a4
push edi
mov dword [0x100ef798], eax
call esi
push 0x100e35b8
push edi
mov dword [0x100ef794], eax
call esi
push 0x100e35d0
push edi
mov dword [0x100ef790], eax
call esi
push 0x100e35dc
push edi
mov dword [0x100ef78c], eax
call esi
push 0x100e35ec
push edi
mov dword [0x100ef788], eax
call esi
push 0x100e3604
push edi
mov dword [0x100ef784], eax
call esi
push 0x100d7610
push edi
mov dword [0x100ef780], eax
call esi
push 0x100d75b8
push edi
mov dword [0x100ef77c], eax
call esi
push 0x100d7628
push edi
mov dword [0x100ef778], eax
call esi
push 0x100e3610
push edi
mov dword [0x100ef774], eax
call esi
push 0x100e355c
push edi
mov dword [0x100ef770], eax
call esi
push 0x100d77b4
push edi
mov dword [0x100ef7a0], eax
call esi
push 0x100d7550
push edi
mov dword [0x100ef76c], eax
call esi
push 0x100d7568
push edi
mov dword [0x100ef768], eax
call esi
push 0x100d75d8
push edi
mov dword [0x100ef764], eax
call esi
push 0x100d75d0
push edi
mov dword [0x100ef760], eax
call esi
push 0x100cf820
mov dword [0x100ef75c], eax
call ebx
mov edi, eax
push 0x100d7908
push edi
call esi
push 0x100e3628
push edi
mov dword [0x100ef758], eax
call esi
push 0x100e3638
push edi
mov dword [0x100ef754], eax
call esi
push 0x100e364c
push edi
mov dword [0x100ef750], eax
call esi
push 0x100e3660
push edi
mov dword [0x100ef74c], eax
call esi
push 0x100e366c
push edi
mov dword [0x100ef748], eax
call esi
push 0x100e368c
push edi
mov dword [0x100ef744], eax
call esi
push 0x100e36ac
push edi
mov dword [0x100ef740], eax
call esi
push 0x100e36c8
push edi
mov dword [0x100ef73c], eax
call esi
push 0x100e36d4
push edi
mov dword [0x100ef820], eax
call esi
push 0x100e36f4
push edi
mov dword [0x100ef738], eax
call esi
push 0x100e3710
push edi
mov dword [0x100ef734], eax
call esi
push 0x100e3730
push edi
mov dword [0x100ef730], eax
call esi
push 0x100cf954
mov dword [0x100ef72c], eax
call ebx
test eax, eax
mov dword [0x100ef728], eax
je 0x6e7a0a
push 0x100e3740
push eax
call esi
mov dword [0x100ef724], eax
jmp 0x6e7a14
mov dword [0x100ef724], 0
push 0x100be3d0
push 1
call dword [0x100ef734]
mov esi, dword [0x100cf160]
push 0x40
push 0x1000
push 0x25
xor ebx, ebx
push ebx
mov dword [0x100ef720], eax
call esi
push 0x25
push 0x100e3754
push eax
mov dword [0x100ef71c], eax
call dword [0x100ef7ec]
push ebx
push 0x100ef718
push 1
push 0x100e377c
call dword [0x100cf004]
test eax, eax
mov edi, dword [0x100cf040]
je 0x6e7ab9
mov ecx, dword [0x100ef718]
lea edx, [esp + 0x58]
push edx
push 0x100ef714
lea eax, [esp + 0x110]
push eax
push ecx
mov dword [esp + 0x118], ebx
mov dword [esp + 0x68], ebx
call dword [0x100cf03c]
test eax, eax
je 0x6e7ab9
push 1
push 0x100ef700
call edi
mov edx, dword [esp + 0x58]
mov eax, dword [0x100ef714]
push edx
push eax
push 1
push 0x100ef700
call dword [0x100cf044]
push 1
push 0x100ef6ec
call edi
push ebx
push ebx
push 1
push 0x100ef6ec
call dword [0x100cf048]
push 4
push 0x1000
push 0xa0000
push ebx
call esi
mov esi, eax
push 0xa0000
xor eax, eax
mov ecx, 0x400
mov dword [0x100ef6e8], esi
call fcn.006e9270
add esp, 4
test eax, eax
je 0x6e8ea6
push 0x100ef6c4
call dword [0x100cf15c]
push 0x100ef5a8
mov dword [0x100ef5a8], 0x11c
call dword [0x100cf1cc]
cmp dword [0x100ef5ac], 6
jb 0x6e7b3f
mov eax, 1
cmp dword [0x100ef5b0], eax
mov dword [0x100ef5a4], eax
jae 0x6e7b45
mov dword [0x100ef5a4], ebx
push 0x20000
call fcn.006eb370
add esp, 4
mov dword [0x100ef5a0], eax
xor esi, esi
lea esp, [esp]
push esi
call dword [0x100ef7d0]
mov ecx, dword [0x100ef5a0]
mov word [ecx + esi*2], ax
add esi, 1
cmp esi, 0x10000
jl 0x6e7b60
xor edx, edx
mov dword [esp + 0x11c], edx
mov ecx, 0x100ef4b4
mov eax, 0x100ef4b8
mov dword [esp + 0x124], edx
mov dword [esp + 0x128], edx
mov edx, dword [esp + 0x11c]
mov dword [esp + 0x138], ecx
lea ecx, [esp + 0x128]
mov dword [esp + 0x130], eax
mov eax, dword [esp + 0x124]
lea ebx, [esp + 0x1b]
mov edi, ecx
mov dword [esp + 0x12c], 0xffffffff
mov dword [esp + 0x134], edx
mov dword [esp + 0x13c], eax
mov dword [esp + 0x140], ecx
call fcn.006e5220
test al, al
jne 0x6e7bf3
xor ebx, ebx
jmp 0x6e7c01
mov eax, dword [esp + 0x138]
add dword [eax], 1
mov al, 1
xor ebx, ebx
mov edx, dword [0x100ef808]
push 0xc
push 1
push edx
mov byte [esp + 0x150], al
call dword [0x100cf14c]
cmp byte [esp + 0x144], 0
mov esi, eax
je 0x6e7c6b
mov eax, dword [esp + 0x140]
mov ecx, dword [eax + 0x10]
add dword [ecx], 0xffffffff
mov ecx, dword [eax + 0x10]
mov edi, eax
add eax, 0x10
cmp dword [ecx], ebx
jne 0x6e7c6b
mov edx, ecx
mov dword [edx], ebx
mov eax, dword [edi + 8]
push ebx
push eax
call dword [0x100cf084]
mov ecx, dword [edi + 0xc]
test ecx, ecx
lea eax, [edi + 0xc]
jle 0x6e7c6b
push eax
call dword [0x100cf080]
mov edx, dword [edi + 0x14]
push ebx
push 1
push edx
call dword [0x100cf088]
cmp esi, ebx
je 0x6e7c97
mov eax, 0x200
xor ecx, ecx
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], 0xff
call fcn.006eb3c0
mov dword [esi], eax
mov dword [esi + 4], ebx
mov word [eax], bx
mov dword [0x100ef824], esi
jmp 0x6e7c9d
mov dword [0x100ef824], ebx
lea eax, [esp + 0x14]
push eax
push 8
call dword [0x100cf22c]
push eax
call dword [0x100cf02c]
test eax, eax
je 0x6e7d7a
mov edx, dword [esp + 0x14]
mov ebx, dword [0x100cf000]
lea ecx, [esp + 0x10]
push ecx
push 0
push 0
push 1
push edx
mov dword [esp + 0x24], 0
call ebx
mov eax, dword [esp + 0x10]
test eax, eax
jbe 0x6e7d6d
push eax
mov edi, eax
call fcn.006eb370
mov ecx, dword [esp + 0x18]
add esp, 4
mov esi, eax
lea eax, [esp + 0x10]
push eax
push edi
push esi
push 1
push ecx
call ebx
test eax, eax
je 0x6e7d62
mov eax, dword [esi]
lea edx, [esp + 0x28]
push edx
push eax
call dword [0x100cf00c]
mov ebx, dword [esp + 0x28]
xor eax, eax
lea edi, [esp + 0x60]
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], eax
call fcn.00625be0
mov ebx, dword [esp + 0x60]
mov edi, dword [0x100ef824]
call fcn.00625be0
xor edi, edi
cmp ebx, edi
je 0x6e7d57
mov eax, ebx
call fcn.00622510
mov dword [esp + 0x60], edi
mov dword [esp + 0x64], edi
mov dword [esp + 0x68], edi
mov ecx, dword [esp + 0x28]
push ecx
call dword [0x100cf218]
test esi, esi
je 0x6e7d6d
mov eax, esi
call fcn.00622510
mov edx, dword [esp + 0x14]
push edx
call dword [0x100cf21c]
xor ebx, ebx
push 0x100d3bb4
push 0x100ef598
call dword [0x100ef7e0]
mov dword [0x100ef594], ebx
xor ecx, ecx
mov eax, 0x100e37a0
add eax, 2
add ecx, 1
cmp word [eax], bx
jne 0x6e7d97
lea eax, [ecx + ecx + 2]
push eax
push ebx
call dword [0x100cf140]
push eax
call dword [0x100cf14c]
mov dword [0x100ef590], eax
xor edx, edx
mov ecx, 0x100e37a0
add ecx, 2
add edx, 1
cmp word [ecx], bx
jne 0x6e7dc1
lea ecx, [edx + edx + 2]
push ecx
push 0x100e37a0
push eax
call dword [0x100ef7ec]
mov edi, dword [0x100cf254]
push 0x100e3918
call edi
cmp eax, ebx
mov dword [0x100ef58c], eax
je 0x6e804b
mov esi, dword [0x100cf25c]
push 0x100e3928
push eax
call esi
mov edx, dword [0x100ef58c]
push 0x100e3948
push edx
mov dword [0x100ef588], eax
call esi
mov dword [0x100ef584], eax
mov eax, dword [0x100ef58c]
push 0x100e3974
push eax
call esi
mov dword [0x100ef580], eax
mov eax, dword [0x100ef58c]
cmp eax, ebx
je 0x6e7e91
push 0x10
push 1
push eax
call dword [0x100cf158]
mov ecx, dword [0x100ef58c]
mov esi, eax
push esi
push ecx
call dword [0x100cf16c]
push eax
call dword [0x100cf170]
mov edx, dword [0x100ef58c]
push esi
push edx
mov ebx, eax
call dword [0x100cf174]
test ebx, ebx
je 0x6e7e91
cmp word [ebx + 0x26], 0
lea eax, [ebx + 0x26]
jne 0x6e7e89
jmp 0x6e7e80
add eax, 2
cmp word [eax], 0
je 0x6e7e80
mov eax, dword [eax + 0x10]
mov dword [0x100ef57c], eax
push 0x100e39a0
push 0x100cf3dc
call dword [0x100cf258]
mov esi, dword [0x100cf25c]
push eax
call esi
push 0x100e39bc
mov dword [0x100ef578], eax
call edi
push 0x100e3730
push eax
mov dword [0x100ef574], eax
call esi
push 0x100e39d8
mov dword [0x100ef72c], eax
call edi
push 0x100e39e8
push eax
mov dword [0x100ef570], eax
call esi
mov esi, dword [0x100cf140]
push 2
push 0
mov dword [0x100ef56c], eax
mov dword [esp + 0x14], 1
call esi
mov ebx, dword [0x100cf14c]
push eax
call ebx
mov edi, dword [0x100cf1d0]
lea ecx, [esp + 0xc]
push ecx
push eax
mov dword [0x100ef568], eax
mov word [eax], 0
call edi
test eax, eax
jne 0x6e7f52
call dword [0x100cf204]
cmp eax, 0x6f
jne 0x6e7f52
mov eax, dword [esp + 0xc]
add eax, 1
lea edx, [eax + eax]
mov dword [esp + 0xc], eax
mov eax, dword [0x100ef568]
push edx
push eax
push 0
call esi
push eax
call dword [0x100cf1dc]
lea ecx, [esp + 0xc]
push ecx
push eax
mov dword [0x100ef568], eax
call edi
call dword [0x100cf248]
mov dword [0x100ef564], eax
push 0x100ef4b8
mov edx, 0x100ef4b4
lea eax, [esp + 0x1f8]
call fcn.006e2c00
mov edx, dword [0x100ef808]
push 0x10000
push 1
push edx
call ebx
cmp byte [esp + 0x210], 0
mov esi, eax
je 0x6e7fdc
mov eax, dword [esp + 0x20c]
mov ecx, dword [eax + 0x10]
add dword [ecx], 0xffffffff
mov ecx, dword [eax + 0x10]
mov edi, eax
add eax, 0x10
cmp dword [ecx], 0
jne 0x6e7fdc
mov edx, ecx
mov dword [edx], 0
mov eax, dword [edi + 8]
push 0
push eax
call dword [0x100cf084]
mov ecx, dword [edi + 0xc]
test ecx, ecx
lea eax, [edi + 0xc]
jle 0x6e7fdc
push eax
call dword [0x100cf080]
mov edx, dword [edi + 0x14]
push 0
push 1
push edx
call dword [0x100cf088]
lea eax, [esp + 0x1c]
push eax
push 0x100e39fc
push 0x80000005
mov dword [0x100ef560], 1
call dword [0x100cf008]
test eax, eax
jne 0x6e806f
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x48]
push ecx
push 0x10000
push esi
push 7
push edx
call dword [0x100ef7d8]
mov ecx, dword [esp + 0x1c]
neg eax
sbb eax, eax
add eax, 1
mov dword [0x100ef560], eax
lea eax, [esp + 0x48]
push eax
push 0x10000
push esi
push 5
push ecx
call dword [0x100ef7d8]
test eax, eax
jne 0x6e8056
mov edx, dword [esp + 0x48]
mov dword [0x100ef55c], edx
jmp 0x6e8060
mov dword [0x100ef588], ebx
jmp 0x6e7e91
mov dword [0x100ef55c], 0xc
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x6e806f
push eax
call dword [0x100cf010]
test esi, esi
je 0x6e80b4
push 0x100ef4b8
mov edx, 0x100ef4b4
lea eax, [esp + 0x238]
call fcn.006e2c00
mov eax, dword [0x100ef808]
push esi
push 1
push eax
call dword [0x100cf260]
cmp byte [esp + 0x250], 0
je 0x6e80b4
mov esi, dword [esp + 0x24c]
call fcn.006c54d0
mov ebx, dword [0x100cf14c]
push 0x100ef4b8
mov edx, 0x100ef4b4
lea eax, [esp + 0x218]
call fcn.006e2c00
mov ecx, dword [0x100ef808]
push 0x10000
push 1
push ecx
call ebx
cmp byte [esp + 0x230], 0
mov esi, eax
je 0x6e8133
mov eax, dword [esp + 0x22c]
mov ecx, dword [eax + 0x10]
add dword [ecx], 0xffffffff
mov edx, dword [eax + 0x10]
mov edi, eax
add eax, 0x10
cmp dword [edx], 0
jne 0x6e8133
mov eax, edx
mov dword [eax], 0
mov ecx, dword [edi + 8]
push 0
push ecx
call dword [0x100cf084]
mov edx, dword [edi + 0xc]
test edx, edx
lea eax, [edi + 0xc]
jle 0x6e8133
push eax
call dword [0x100cf080]
mov eax, dword [edi + 0x14]
push 0
push 1
push eax
call dword [0x100cf088]
lea ecx, [esp + 0x30]
push ecx
push 0x100e39fc
push 0x80000005
mov dword [0x100ef558], 1
call dword [0x100cf008]
test eax, eax
jne 0x6e818c
mov eax, dword [esp + 0x30]
lea edx, [esp + 0x1a8]
push edx
push 0x10000
push esi
push 7
push eax
call dword [0x100ef7d8]
neg eax
sbb eax, eax
add eax, 1
mov dword [0x100ef558], eax
mov eax, dword [esp + 0x30]
test eax, eax
je 0x6e818c
push eax
call dword [0x100cf010]
test esi, esi
je 0x6e81cc
push 0x100ef4b8
mov edx, 0x100ef4b4
lea eax, [esp + 0x258]
call fcn.006e2c00
mov ecx, dword [0x100ef808]
push esi
push 1
push ecx
call dword [0x100cf260]
cmp byte [esp + 0x270], 0
je 0x6e81cc
mov esi, dword [esp + 0x26c]
call fcn.006c54d0
push 0x100e3a0c
lea edx, [esp + 0x1b4]
mov esi, 0xfefe
push edx
mov dword [esp + 0x5c], esi
call dword [0x100ef7e0]
xor edi, edi
lea ecx, [esp + 0x54]
push ecx
push edi
push edi
push edi
lea edx, [esp + 0x188]
lea eax, [esp + 0x1c0]
push edx
mov dword [esp + 0x194], eax
push 0x20019
lea eax, [esp + 0x1c4]
mov ebx, 0x40
push eax
mov dword [esp + 0x194], 0x18
mov dword [esp + 0x198], edi
mov dword [esp + 0x1a0], ebx
mov dword [esp + 0x1a4], edi
mov dword [esp + 0x1a8], edi
call dword [0x100ef7d4]
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
xor ecx, ecx
cmp dword [esp + 0x54], edi
push 0x100cf494
sete cl
lea edx, [esp + 0x1bc]
push edx
mov dword [0x100ef554], ecx
mov ecx, dword [eax + 0x10]
mov edi, dword [ecx + 0x2c]
mov eax, 0xfefefefe
mov dword [esp + 0x158], eax
mov dword [esp + 0x15c], eax
mov dword [esp + 0x160], eax
mov dword [esp + 0x164], eax
mov dword [esp + 0x168], eax
mov dword [esp + 0x16c], eax
mov dword [esp + 0x170], eax
mov dword [esp + 0x174], eax
mov dword [esp + 0x178], eax
mov dword [esp + 0x17c], eax
call dword [0x100ef7e0]
lea eax, [esp + 0x1b8]
lea ecx, [esp + 0x150]
mov dword [esp + 0x198], eax
xor eax, eax
push ecx
lea edx, [esp + 0x194]
push edx
mov dword [esp + 0x198], 0x18
mov dword [esp + 0x19c], edi
mov dword [esp + 0x1a4], ebx
mov dword [esp + 0x1a8], eax
mov dword [esp + 0x1ac], eax
call dword [0x100ef77c]
test eax, eax
jne 0x6e834e
mov eax, dword [esp + 0x150]
mov ecx, dword [esp + 0x154]
lea edx, [esp + 0x280]
mov dword [esp + 0x148], eax
push edx
lea eax, [esp + 0x14c]
push eax
mov dword [esp + 0x154], ecx
call dword [0x100cf1e0]
mov dword [0x100ef550], eax
jmp 0x6e8358
mov dword [0x100ef550], 1
push 0x100d7918
push 0x100da380
call dword [0x100cf258]
push eax
call dword [0x100cf25c]
lea ecx, [esp + 0x38]
push ecx
push 1
lea edx, [esp + 0x27c]
push edx
push 1
push edi
mov dword [esp + 0x4c], esi
call eax
xor eax, eax
xor ebx, ebx
cmp dword [esp + 0x38], ebx
push 0x13
push 8
setne al
lea ecx, [esp + 0x1f0]
push ecx
lea edx, [esp + 0x1ec]
push edx
push edi
mov dword [0x100ef54c], eax
call dword [0x100ef778]
cmp dword [0x100ef758], ebx
mov dword [0x100ef548], eax
je 0x6e8410
push 0x20
lea eax, [esp + 0x1c4]
push eax
call dword [0x100ef7e8]
push ebx
mov dword [esp + 0x1c4], 0x20
mov dword [esp + 0x1e0], 1
mov dword [esp + 0x1c8], 0x80
call dword [0x100cf210]
lea ecx, [esp + 0x1c0]
push ecx
call dword [0x100ef758]
call dword [0x100cf204]
mov dword [0x100ef544], eax
mov eax, 0x100ef4b8
mov dword [esp + 0x11c], ebx
mov edx, dword [esp + 0x11c]
mov ecx, 0x100ef4b4
mov dword [esp + 0x124], ebx
mov dword [esp + 0x74], eax
mov eax, dword [esp + 0x124]
mov dword [esp + 0x7c], ecx
lea ecx, [esp + 0x6c]
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x70], 0xffffffff
mov dword [esp + 0x78], edx
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], ecx
call fcn.006e5fe0
call dword [0x100cf08c]
mov edx, dword [esp + 0x74]
mov esi, eax
mov eax, dword [edx]
cmp esi, eax
je 0x6e84a5
mov ecx, dword [esp + 0x74]
mov edx, dword [ecx]
test edx, edx
jne 0x6e8ead
mov eax, dword [esp + 0x74]
push ebx
push esi
push eax
call dword [0x100cf090]
test eax, eax
sete al
test al, al
je 0x6e8ead
mov ecx, dword [esp + 0x7c]
mov dword [ecx], ebx
mov eax, dword [esp + 0x7c]
add dword [eax], 1
mov al, 1
mov edx, dword [0x100ef808]
push 0x38
push 1
push edx
mov byte [esp + 0x94], al
call dword [0x100cf14c]
cmp byte [esp + 0x88], bl
mov edi, eax
je 0x6e8517
mov eax, dword [esp + 0x84]
mov ecx, dword [eax + 0x10]
add dword [ecx], 0xffffffff
mov ecx, dword [eax + 0x10]
mov esi, eax
add eax, 0x10
cmp dword [ecx], ebx
jne 0x6e8517
mov edx, ecx
mov dword [edx], ebx
mov eax, dword [esi + 8]
push ebx
push eax
call dword [0x100cf084]
mov ecx, dword [esi + 0xc]
test ecx, ecx
lea eax, [esi + 0xc]
jle 0x6e8517
push eax
call dword [0x100cf080]
mov edx, dword [esi + 0x14]
push ebx
push 1
push edx
call dword [0x100cf088]
cmp edi, ebx
je 0x6e8ec4
call fcn.006bb720
mov esi, eax
cmp esi, ebx
je 0x6e8531
mov eax, dword [esi]
mov ecx, dword [eax]
push esi
call ecx
mov eax, dword [ebp + 0x10]
cmp eax, ebx
mov dword [0x100ef540], esi
je 0x6e854c
push 0x70
push eax
push 0x100ef4d0
call dword [0x100ef7ec]
call fcn.006e55b0
call fcn.006eac80
lea ebx, [esp + 0x20]
call fcn.0065d910
mov esi, dword [eax]
test esi, esi
mov edi, dword [0x100ef490]
mov dword [esp + 0x110], esi
je 0x6e857a
mov edx, dword [esi]
mov eax, dword [edx + 4]
push esi
call eax
lea ecx, [esp + 0x110]
push ecx
push 0x100cff38
mov eax, edi
call fcn.006e56a0
test esi, esi
je 0x6e859a
mov edx, dword [esi]
mov eax, dword [edx + 8]
push esi
call eax
mov eax, dword [esp + 0x20]
test eax, eax
je 0x6e85b2
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x20], 0
mov eax, dword [0x100ef828]
push 0x100cff38
push 0x100d009c
call fcn.006ead20
lea ebx, [esp + 0x40]
call fcn.0065da50
mov esi, dword [eax]
test esi, esi
mov edi, dword [0x100ef490]
mov dword [esp + 0x10c], esi
je 0x6e85ea
mov eax, dword [esi]
mov ecx, dword [eax + 4]
push esi
call ecx
lea edx, [esp + 0x10c]
push edx
push 0x100cff48
mov eax, edi
call fcn.006e56a0
test esi, esi
je 0x6e860a
mov eax, dword [esi]
mov ecx, dword [eax + 8]
push esi
call ecx
mov eax, dword [esp + 0x40]
test eax, eax
je 0x6e8622
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov dword [esp + 0x40], 0
mov ecx, dword [0x100ef540]
mov edx, dword [ecx]
mov eax, dword [edx + 0xbc]
call eax
lea ebx, [esp + 0x94]
mov esi, eax
call fcn.0065c230
mov eax, dword [eax]
mov edx, dword [esi]
mov edx, dword [edx + 0x10]
push eax
push 0x100cff58
mov ecx, esi
call edx
mov eax, dword [esp + 0x94]
test eax, eax
je 0x6e8664
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
lea ebx, [esp + 0x50]
call fcn.0065f9e0
mov esi, dword [eax]
test esi, esi
mov edi, dword [0x100ef490]
mov dword [esp + 0xc4], esi
je 0x6e8688
mov eax, dword [esi]
mov ecx, dword [eax + 4]
push esi
call ecx
lea edx, [esp + 0xc4]
push edx
push 0x100cff08
mov eax, edi
call fcn.006e56a0
test esi, esi
je 0x6e86a8
mov eax, dword [esi]
mov ecx, dword [eax + 8]
push esi
call ecx
mov eax, dword [esp + 0x50]
test eax, eax
je 0x6e86c0
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov dword [esp + 0x50], 0
mov eax, dword [0x100ef828]
push 0x100cff08
push 0x100d00ac
call fcn.006ead20
lea ebx, [esp + 0x24]
call fcn.0065faf0
mov esi, dword [eax]
test esi, esi
mov edi, dword [0x100ef490]
mov dword [esp + 0x9c], esi
je 0x6e86f8
mov ecx, dword [esi]
mov edx, dword [ecx + 4]
push esi
call edx
lea eax, [esp + 0x9c]
push eax
push 0x100cff18
mov eax, edi
call fcn.006e56a0
test esi, esi
je 0x6e8718
mov ecx, dword [esi]
mov edx, dword [ecx + 8]
push esi
call edx
mov eax, dword [esp + 0x24]
test eax, eax
je 0x6e8730
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x24], 0
mov ecx, dword [0x100ef540]
mov eax, dword [ecx]
mov edx, dword [eax + 0xbc]
call edx
lea ebx, [esp + 0xcc]
mov esi, eax
call fcn.0065e0f0
mov eax, dword [eax]
mov edx, dword [esi]
mov edx, dword [edx + 0x10]
push eax
push 0x100cff28
mov ecx, esi
call edx
mov eax, dword [esp + 0xcc]
test eax, eax
je 0x6e8772
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
lea ebx, [esp + 0x2c]
call fcn.00660730
mov esi, dword [eax]
test esi, esi
mov edi, dword [0x100ef490]
mov dword [esp + 0xa4], esi
je 0x6e8796
mov eax, dword [esi]
mov ecx, dword [eax + 4]
push esi
call ecx
lea edx, [esp + 0xa4]
push edx
push 0x100cfed8
mov eax, edi
call fcn.006e56a0
test esi, esi
je 0x6e87b6
mov eax, dword [esi]
mov ecx, dword [eax + 8]
push esi
call ecx
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x6e87ce
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov dword [esp + 0x2c], 0
mov eax, dword [0x100ef828]
push 0x100cfed8
push 0x100d00bc
call fcn.006ead20
lea ebx, [esp + 0x34]
call fcn.00660840
mov esi, dword [eax]
test esi, esi
mov edi, dword [0x100ef490]
mov dword [esp + 0xd4], esi
je 0x6e8806
mov ecx, dword [esi]
mov edx, dword [ecx + 4]
push esi
call edx
lea eax, [esp + 0xd4]
push eax
push 0x100cfee8
mov eax, edi
call fcn.006e56a0
test esi, esi
je 0x6e8826
mov ecx, dword [esi]
mov edx, dword [ecx + 8]
push esi
call edx
mov eax, dword [esp + 0x34]
test eax, eax
je 0x6e883e
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x34], 0
mov ecx, dword [0x100ef540]
mov eax, dword [ecx]
mov edx, dword [eax + 0xbc]
call edx
lea ebx, [esp + 0xac]
mov esi, eax
call fcn.0065fcc0
mov eax, dword [eax]
mov edx, dword [esi]
mov edx, dword [edx + 0x10]
push eax
push 0x100cfef8
mov ecx, esi
call edx
mov eax, dword [esp + 0xac]
test eax, eax
je 0x6e8880
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
lea ebx, [esp + 0x3c]
call fcn.00661560
mov esi, dword [eax]
test esi, esi
mov edi, dword [0x100ef490]
mov dword [esp + 0xdc], esi
je 0x6e88a4
mov eax, dword [esi]
mov ecx, dword [eax + 4]
push esi
call ecx
lea edx, [esp + 0xdc]
push edx
push 0x100cfea8
mov eax, edi
call fcn.006e56a0
test esi, esi
je 0x6e88c4
mov eax, dword [esi]
mov ecx, dword [eax + 8]
push esi
call ecx
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x6e88dc
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov dword [esp + 0x3c], 0
mov eax, dword [0x100ef828]
push 0x100cfea8
push 0x100d00fc
call fcn.006ead20
lea ebx, [esp + 0x44]
call fcn.00661670
mov esi, dword [eax]
test esi, esi
mov edi, dword [0x100ef490]
mov dword [esp + 0xb4], esi
je 0x6e8914
mov ecx, dword [esi]
mov edx, dword [ecx + 4]
push esi
call edx
lea eax, [esp + 0xb4]
push eax
push 0x100cfeb8
mov eax, edi
call fcn.006e56a0
test esi, esi
je 0x6e8934
mov ecx, dword [esi]
mov edx, dword [ecx + 8]
push esi
call edx
mov eax, dword [esp + 0x44]
test eax, eax
je 0x6e894c
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x44], 0
mov ecx, dword [0x100ef540]
mov eax, dword [ecx]
mov edx, dword [eax + 0xbc]
call edx
lea ebx, [esp + 0xe4]
mov esi, eax
call fcn.00660b00
mov eax, dword [eax]
mov edx, dword [esi]
mov edx, dword [edx + 0x10]
push eax
push 0x100cfec8
mov ecx, esi
call edx
mov eax, dword [esp + 0xe4]
test eax, eax
je 0x6e898e
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
lea ebx, [esp + 0x4c]
call fcn.006eaad0
mov esi, dword [eax]
test esi, esi
mov edi, dword [0x100ef490]
mov dword [esp + 0xbc], esi
je 0x6e89b2
mov eax, dword [esi]
mov ecx, dword [eax + 4]
push esi
call ecx
lea edx, [esp + 0xbc]
push edx
push 0x100cfb08
mov eax, edi
call fcn.006e56a0
test esi, esi
je 0x6e89d2
mov eax, dword [esi]
mov ecx, dword [eax + 8]
push esi
call ecx
mov eax, dword [esp + 0x4c]
test eax, eax
je 0x6e89ea
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov dword [esp + 0x4c], 0
mov eax, dword [0x100ef828]
push 0x100cfb08
push 0x100cf39c
call fcn.006ead20
lea ebx, [esp + 0x5c]
call fcn.006eabe0
mov esi, dword [eax]
test esi, esi
mov edi, dword [0x100ef490]
mov dword [esp + 0xec], esi
je 0x6e8a22
mov ecx, dword [esi]
mov edx, dword [ecx + 4]
push esi
call edx
lea eax, [esp + 0xec]
push eax
push 0x100cfb18
mov eax, edi
call fcn.006e56a0
test esi, esi
je 0x6e8a42
mov ecx, dword [esi]
mov edx, dword [ecx + 8]
push esi
call edx
mov eax, dword [esp + 0x5c]
test eax, eax
je 0x6e8a5a
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x5c], 0
mov ecx, dword [0x100ef540]
mov eax, dword [ecx]
mov edx, dword [eax + 0xbc]
call edx
lea ebx, [esp + 0xf4]
mov esi, eax
call fcn.006e98d0
mov eax, dword [eax]
mov edx, dword [esi]
mov edx, dword [edx + 0x10]
push eax
push 0x100cfb28
mov ecx, esi
call edx
mov eax, dword [esp + 0xf4]
test eax, eax
je 0x6e8a9c
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
lea ebx, [esp + 0x8c]
call fcn.006c9ba0
mov esi, dword [eax]
test esi, esi
mov edi, dword [0x100ef490]
mov dword [esp + 0xc8], esi
je 0x6e8ac3
mov eax, dword [esi]
mov ecx, dword [eax + 4]
push esi
call ecx
lea edx, [esp + 0xc8]
push edx
push 0x100cfb58
mov eax, edi
call fcn.006e56a0
test esi, esi
je 0x6e8ae3
mov eax, dword [esi]
mov ecx, dword [eax + 8]
push esi
call ecx
mov eax, dword [esp + 0x8c]
test eax, eax
je 0x6e8af6
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
lea ebx, [esp + 0x100]
call fcn.006c89e0
mov esi, dword [eax]
test esi, esi
mov edi, dword [0x100ef490]
mov dword [esp + 0xd0], esi
je 0x6e8b1d
mov ecx, dword [esi]
mov edx, dword [ecx + 4]
push esi
call edx
lea eax, [esp + 0xd0]
push eax
push 0x100cfb88
mov eax, edi
call fcn.006e56a0
test esi, esi
je 0x6e8b3d
mov ecx, dword [esi]
mov edx, dword [ecx + 8]
push esi
call edx
mov eax, dword [esp + 0x100]
test eax, eax
je 0x6e8b50
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
lea ebx, [esp + 0x104]
call fcn.006c8a60
mov esi, dword [eax]
test esi, esi
mov edi, dword [0x100ef490]
mov dword [esp + 0xd8], esi
je 0x6e8b77
mov eax, dword [esi]
mov ecx, dword [eax + 4]
push esi
call ecx
lea edx, [esp + 0xd8]
push edx
push 0x100cfb98
mov eax, edi
call fcn.006e56a0
test esi, esi
je 0x6e8b97
mov eax, dword [esi]
mov ecx, dword [eax + 8]
push esi
call ecx
mov eax, dword [esp + 0x104]
test eax, eax
je 0x6e8baa
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
lea ebx, [esp + 0x114]
call fcn.006c5280
mov esi, dword [eax]
test esi, esi
mov edi, dword [0x100ef490]
mov dword [esp + 0xe0], esi
je 0x6e8bd1
mov ecx, dword [esi]
mov edx, dword [ecx + 4]
push esi
call edx
lea eax, [esp + 0xe0]
push eax
push 0x100cfba8
mov eax, edi
call fcn.006e56a0
test esi, esi
je 0x6e8bf1
mov ecx, dword [esi]
mov edx, dword [ecx + 8]
push esi
call edx
mov eax, dword [esp + 0x114]
test eax, eax
je 0x6e8c04
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
lea ebx, [esp + 0xfc]
call fcn.006302f0
mov esi, dword [eax]
test esi, esi
mov edi, dword [0x100ef490]
mov dword [esp + 0xe8], esi
je 0x6e8c2b
mov eax, dword [esi]
mov ecx, dword [eax + 4]
push esi
call ecx
lea edx, [esp + 0xe8]
push edx
push 0x100d007c
mov eax, edi
call fcn.006e56a0
test esi, esi
je 0x6e8c4b
mov eax, dword [esi]
mov ecx, dword [eax + 8]
push esi
call ecx
mov eax, dword [esp + 0xfc]
test eax, eax
je 0x6e8c5e
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
lea ebx, [esp + 0xf8]
call fcn.00630370
mov esi, dword [eax]
test esi, esi
mov edi, dword [0x100ef490]
mov dword [esp + 0xf0], esi
je 0x6e8c85
mov ecx, dword [esi]
mov edx, dword [ecx + 4]
push esi
call edx
lea eax, [esp + 0xf0]
push eax
push 0x100d006c
mov eax, edi
call fcn.006e56a0
test esi, esi
je 0x6e8ca5
mov ecx, dword [esi]
mov edx, dword [ecx + 8]
push esi
call edx
mov eax, dword [esp + 0xf8]
test eax, eax
je 0x6e8cb8
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
lea ebx, [esp + 0x90]
call fcn.006303f0
mov esi, dword [eax]
test esi, esi
mov edi, dword [0x100ef490]
mov dword [esp + 0xc0], esi
je 0x6e8cdf
mov eax, dword [esi]
mov ecx, dword [eax + 4]
push esi
call ecx
lea edx, [esp + 0xc0]
push edx
push 0x100d008c
mov eax, edi
call fcn.006e56a0
test esi, esi
je 0x6e8cff
mov eax, dword [esi]
mov ecx, dword [eax + 8]
push esi
call ecx
mov eax, dword [esp + 0x90]
test eax, eax
je 0x6e8d12
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
lea ebx, [esp + 0xa0]
call fcn.0062c9f0
mov esi, dword [eax]
test esi, esi
mov edi, dword [0x100ef490]
mov dword [esp + 0x98], esi
je 0x6e8d39
mov ecx, dword [esi]
mov edx, dword [ecx + 4]
push esi
call edx
lea eax, [esp + 0x98]
push eax
push 0x100d00cc
mov eax, edi
call fcn.006e56a0
test esi, esi
je 0x6e8d59
mov ecx, dword [esi]
mov edx, dword [ecx + 8]
push esi
call edx
mov eax, dword [esp + 0xa0]
test eax, eax
je 0x6e8d6c
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
lea ebx, [esp + 0xb0]
call fcn.0062ca70
mov esi, dword [eax]
test esi, esi
mov edi, dword [0x100ef490]
mov dword [esp + 0xa8], esi
je 0x6e8d93
mov eax, dword [esi]
mov ecx, dword [eax + 4]
push esi
call ecx
lea edx, [esp + 0xa8]
push edx
push 0x100d00dc
mov eax, edi
call fcn.006e56a0
test esi, esi
je 0x6e8db3
mov eax, dword [esi]
mov ecx, dword [eax + 8]
push esi
call ecx
mov eax, dword [esp + 0xb0]
test eax, eax
je 0x6e8dc6
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
call fcn.00635320
call fcn.00635410
call fcn.00633d90
call fcn.00633e80
call fcn.00666d50
call fcn.00668b50
call fcn.0066b0a0
call fcn.006c1570
call fcn.006c1660
call fcn.0066a070
call fcn.0067a680
call fcn.0067a770
call fcn.0067a860
call fcn.0067a950
call fcn.0067aa40
call fcn.006aeca0
call fcn.006aed90
call fcn.006aee80
call fcn.006aef70
call fcn.006907e0
call fcn.006908d0
call fcn.006909c0
call fcn.00690ab0
call fcn.00690ba0
call fcn.00690c90
call fcn.00690d80
call fcn.00690e70
call fcn.00690f60
call fcn.00691050
call fcn.0065a3e0
call fcn.0065a4d0
call fcn.0065a5c0
call fcn.00628cc0
cmp dword [0x100ef488], 0
jne 0x6e8ea1
lea ebx, [esp + 0xb8]
call fcn.00661950
mov ecx, dword [eax]
mov dword [eax], 0
mov eax, dword [esp + 0xb8]
test eax, eax
mov dword [0x100ef488], ecx
je 0x6e8ea1
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
push eax
call edx
call fcn.00665d40
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
lea eax, [esp + 0x70]
call fcn.006e5290
test al, al
jne 0x6e84a5
jmp 0x6e84ae
xor esi, esi
jmp 0x6e8531