Function at 0x1000a070
Capabilities:
Check for time delay via gettickcount
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x8bc
mov eax, dword [0x1006a2a8]
xor eax, esp
mov dword [esp + 0x8b8], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
lea eax, [esp + 0x18]
xor ebx, ebx
push eax
mov dword [esp + 0x14], esi
mov dword [esp + 0x1c], 0x1006d960
mov byte [esp + 0x20], bl
call fcn.10008b00
mov ecx, dword [str.F0E1D2C3B4A5]
mov dword [esi], ecx
mov edx, dword [0x10061394]
mov dword [esi + 4], edx
mov eax, dword [0x10061398]
mov dword [esi + 8], eax
mov cl, byte [0x1006139c]
mov byte [esi + 0xc], cl
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov edi, eax
xor eax, eax
xor edx, edx
mov dword [esp + 0xc], edi
mov dword [esp + 0x88], 0xf
mov dword [esp + 0x84], ebx
mov byte [esp + 0x74], bl
mov dword [esp + 0x14], ebx
mov word [esp + 0xac], dx
mov dword [esp + 0xae], eax
mov dword [esp + 0xb2], eax
mov dword [esp + 0xb6], eax
mov dword [esp + 0xba], eax
mov word [esp + 0xbe], ax
call esi
mov ecx, eax
sub ecx, edi
lea esi, [esp + 0x3c]
call fcn.10009d40
push eax
mov eax, str.start:
lea ecx, [esp + 0x94]
call fcn.1000bd10
add esp, 4
mov edi, eax
mov esi, 0x1006c95c
call fcn.10003890
cmp dword [esp + 0xa4], 0x10
jb 0x1000a170
mov eax, dword [esp + 0x90]
push eax
call fcn.100281c4
add esp, 4
cmp dword [esp + 0x50], 0x10
mov dword [esp + 0xa4], 0xf
mov dword [esp + 0xa0], ebx
mov byte [esp + 0x90], bl
jb 0x1000a19d
mov ecx, dword [esp + 0x3c]
push ecx
call fcn.100281c4
add esp, 4
lea edi, [esp + 0x14]
lea ecx, [esp + 0xac]
call fcn.10008270
cmp eax, 1
jne 0x1000a1e1
lea eax, [esp + 0xac]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x1000a1c0
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0xb0]
mov esi, 0x1006c8ec
call fcn.100041a0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, dword [esp + 0xc]
lea esi, [esp + 0x20]
call fcn.10009d40
push str.read_src_return:
lea edx, [esp + 0x5c]
push 0x1006c95c
push edx
mov esi, eax
call fcn.1000bd60
mov ecx, eax
lea eax, [esp + 0x9c]
add esp, 0xc
push eax
mov eax, esi
call fcn.1000be40
add esp, 4
mov edi, eax
mov esi, 0x1006c95c
call fcn.10003890
cmp dword [esp + 0xa4], 0x10
jb 0x1000a249
mov ecx, dword [esp + 0x90]
push ecx
call fcn.100281c4
add esp, 4
mov edi, 0x10
mov esi, 0xf
mov dword [esp + 0xa4], esi
mov dword [esp + 0xa0], ebx
mov byte [esp + 0x90], bl
cmp dword [esp + 0x6c], edi
jb 0x1000a27b
mov edx, dword [esp + 0x58]
push edx
call fcn.100281c4
add esp, 4
mov dword [esp + 0x6c], esi
mov dword [esp + 0x68], ebx
mov byte [esp + 0x58], bl
cmp dword [esp + 0x34], edi
jb 0x1000a29a
mov eax, dword [esp + 0x20]
push eax
call fcn.100281c4
add esp, 4
mov edi, dword [0x1006d944]
mov dword [esp + 0x34], esi
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
cmp edi, ebx
jne 0x1000a2d0
push 0x64
call fcn.100288de
add esp, 4
cmp eax, ebx
je 0x1000a2c6
push eax
call fcn.100063b0
jmp 0x1000a2c8
xor eax, eax
mov edi, eax
mov dword [0x1006d944], edi
mov ecx, dword [esp + 0x10]
call fcn.10007430
test al, al
je 0x1000a51f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, dword [esp + 0xc]
lea esi, [esp + 0x90]
call fcn.10009d40
push str.read_file_mac1_return:
lea ecx, [esp + 0x5c]
push 0x1006c95c
push ecx
mov esi, eax
call fcn.1000bd60
lea edx, [esp + 0x2c]
add esp, 0xc
mov ecx, eax
push edx
mov eax, esi
call fcn.1000be40
add esp, 4
mov edi, eax
mov esi, 0x1006c95c
call fcn.10003890
cmp dword [esp + 0x34], 0x10
jb 0x1000a343
mov eax, dword [esp + 0x20]
push eax
call fcn.100281c4
add esp, 4
mov edi, 0x10
mov esi, 0xf
mov dword [esp + 0x34], esi
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
cmp dword [esp + 0x6c], edi
jb 0x1000a36c
mov ecx, dword [esp + 0x58]
push ecx
call fcn.100281c4
add esp, 4
mov dword [esp + 0x6c], esi
mov dword [esp + 0x68], ebx
mov byte [esp + 0x58], bl
cmp dword [esp + 0xa4], edi
jb 0x1000a391
mov edx, dword [esp + 0x90]
push edx
call fcn.100281c4
add esp, 4
mov eax, dword [0x1006d944]
mov dword [esp + 0xa4], esi
mov dword [esp + 0xa0], ebx
mov byte [esp + 0x90], bl
cmp eax, ebx
jne 0x1000a3cc
push 0x64
call fcn.100288de
add esp, 4
cmp eax, ebx
je 0x1000a3c5
push eax
call fcn.100063b0
jmp 0x1000a3c7
xor eax, eax
mov dword [0x1006d944], eax
push eax
lea esi, [esp + 0x40]
call fcn.10009d10
mov edi, eax
mov esi, 0x1006c8b4
call fcn.10003890
cmp dword [esp + 0x50], 0x10
jb 0x1000a3f6
mov eax, dword [esp + 0x3c]
push eax
call fcn.100281c4
add esp, 4
mov eax, dword [0x1006d944]
mov dword [esp + 0x50], 0xf
mov dword [esp + 0x4c], ebx
mov byte [esp + 0x3c], bl
cmp eax, ebx
jne 0x1000a42c
push 0x64
call fcn.100288de
add esp, 4
cmp eax, ebx
je 0x1000a425
push eax
call fcn.100063b0
jmp 0x1000a427
xor eax, eax
mov dword [0x1006d944], eax
push eax
lea ecx, [esp + 0x24]
call fcn.10007870
mov edi, eax
mov esi, 0x1006c8d0
call fcn.10003890
cmp dword [esp + 0x34], 0x10
jb 0x1000a456
mov ecx, dword [esp + 0x20]
push ecx
call fcn.100281c4
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, dword [esp + 0xc]
lea esi, [esp + 0x58]
call fcn.10009d40
push str.read_file_mac2_return:
lea edx, [esp + 0x24]
push 0x1006c95c
push edx
mov esi, eax
call fcn.1000bd60
mov ecx, eax
lea eax, [esp + 0x48]
add esp, 0xc
push eax
mov eax, esi
call fcn.1000be40
add esp, 4
mov edi, eax
mov esi, 0x1006c95c
call fcn.10003890
cmp dword [esp + 0x50], 0x10
jb 0x1000a4b5
mov ecx, dword [esp + 0x3c]
push ecx
call fcn.100281c4
add esp, 4
mov esi, 0x10
mov edi, 0xf
mov dword [esp + 0x50], edi
mov dword [esp + 0x4c], ebx
mov byte [esp + 0x3c], bl
cmp dword [esp + 0x34], esi
jb 0x1000a4de
mov edx, dword [esp + 0x20]
push edx
call fcn.100281c4
add esp, 4
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
cmp dword [esp + 0x6c], esi
jb 0x1000a4fd
mov eax, dword [esp + 0x58]
push eax
call fcn.100281c4
add esp, 4
cmp dword [esp + 0x88], esi
jb 0x1000a513
mov ecx, dword [esp + 0x74]
push ecx
call fcn.100281c4
add esp, 4
mov dword [esp + 0x88], edi
jmp 0x1000ad5e
push 3
push 0x100613ec
mov ecx, 0x1006c8b4
call fcn.10004550
push 0x7fe
lea eax, [esp + 0xc6]
xor edx, edx
push ebx
push eax
mov word [esp + 0xcc], dx
call fcn.10029f30
add esp, 0xc
push 0x400
lea ecx, [esp + 0xc4]
push ecx
push str._USERPROFILE_FunShion.ini
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea edx, [esp + 0xc0]
push edx
push 0x100613f0
push 0x100612bc
push str.FunShion_Player
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, dword [esp + 0xc]
lea esi, [esp + 0x58]
call fcn.10009d40
push str.write_file_return:
mov esi, eax
lea eax, [esp + 0x24]
push 0x1006c95c
push eax
call fcn.1000bd60
lea edx, [esp + 0x48]
add esp, 0xc
mov ecx, eax
push edx
mov eax, esi
call fcn.1000be40
add esp, 4
mov edi, eax
mov esi, 0x1006c95c
call fcn.10003890
cmp dword [esp + 0x50], 0x10
jb 0x1000a5e4
mov eax, dword [esp + 0x3c]
push eax
call fcn.100281c4
add esp, 4
mov esi, 0x10
mov edi, 0xf
mov dword [esp + 0x50], edi
mov dword [esp + 0x4c], ebx
mov byte [esp + 0x3c], bl
cmp dword [esp + 0x34], esi
jb 0x1000a60d
mov ecx, dword [esp + 0x20]
push ecx
call fcn.100281c4
add esp, 4
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
cmp dword [esp + 0x6c], esi
jb 0x1000a62c
mov edx, dword [esp + 0x58]
push edx
call fcn.100281c4
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [0x1006d940]
mov dword [esp + 0x14], eax
cmp esi, ebx
jne 0x1000a660
push 0x78
call fcn.100288de
add esp, 4
cmp eax, ebx
je 0x1000a656
push eax
call fcn.100015d0
jmp 0x1000a658
xor eax, eax
mov esi, eax
mov dword [0x1006d940], esi
call fcn.10001720
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, dword [esp + 0xc]
lea esi, [esp + 0x58]
call fcn.10009d40
push str.wmi_init_return:
mov esi, eax
lea eax, [esp + 0x24]
push 0x1006c95c
push eax
call fcn.1000bd60
lea edx, [esp + 0x48]
add esp, 0xc
mov ecx, eax
push edx
mov eax, esi
call fcn.1000be40
add esp, 4
mov edi, eax
mov esi, 0x1006c95c
call fcn.10003890
cmp dword [esp + 0x50], 0x10
jb 0x1000a6c4
mov eax, dword [esp + 0x3c]
push eax
call fcn.100281c4
add esp, 4
mov edi, 0x10
mov esi, 0xf
mov dword [esp + 0x50], esi
mov dword [esp + 0x4c], ebx
mov byte [esp + 0x3c], bl
cmp dword [esp + 0x34], edi
jb 0x1000a6ed
mov ecx, dword [esp + 0x20]
push ecx
call fcn.100281c4
add esp, 4
mov dword [esp + 0x34], esi
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
cmp dword [esp + 0x6c], edi
jb 0x1000a70c
mov edx, dword [esp + 0x58]
push edx
call fcn.100281c4
add esp, 4
mov ecx, dword [0x1006d940]
mov dword [esp + 0x6c], esi
mov dword [esp + 0x68], ebx
mov byte [esp + 0x58], bl
cmp ecx, ebx
jne 0x1000a742
push 0x78
call fcn.100288de
add esp, 4
cmp eax, ebx
je 0x1000a738
push eax
call fcn.100015d0
jmp 0x1000a73a
xor eax, eax
mov ecx, eax
mov dword [0x1006d940], ecx
lea edx, [esp + 0x90]
call fcn.10001dc0
mov edi, eax
lea esi, [esp + 0x74]
call fcn.10003890
cmp dword [esp + 0xa4], 0x10
jb 0x1000a773
mov eax, dword [esp + 0x90]
push eax
call fcn.100281c4
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, dword [esp + 0xc]
lea esi, [esp + 0x58]
call fcn.10009d40
push str.wmi_get_mac_return:
lea ecx, [esp + 0x24]
push 0x1006c95c
push ecx
mov esi, eax
call fcn.1000bd60
lea edx, [esp + 0x48]
add esp, 0xc
mov ecx, eax
push edx
mov eax, esi
call fcn.1000be40
add esp, 4
mov edi, eax
mov esi, 0x1006c95c
call fcn.10003890
cmp dword [esp + 0x50], 0x10
jb 0x1000a7d2
mov eax, dword [esp + 0x3c]
push eax
call fcn.100281c4
add esp, 4
mov edi, 0x10
mov esi, 0xf
mov dword [esp + 0x50], esi
mov dword [esp + 0x4c], ebx
mov byte [esp + 0x3c], bl
cmp dword [esp + 0x34], edi
jb 0x1000a7fb
mov ecx, dword [esp + 0x20]
push ecx
call fcn.100281c4
add esp, 4
mov dword [esp + 0x34], esi
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
cmp dword [esp + 0x6c], edi
jb 0x1000a81a
mov edx, dword [esp + 0x58]
push edx
call fcn.100281c4
add esp, 4
mov eax, dword [0x1006d940]
mov dword [esp + 0x6c], esi
mov dword [esp + 0x68], ebx
mov byte [esp + 0x58], bl
cmp eax, ebx
jne 0x1000a84c
push 0x78
call fcn.100288de
add esp, 4
cmp eax, ebx
je 0x1000a845
push eax
call fcn.100015d0
jmp 0x1000a847
xor eax, eax
mov dword [0x1006d940], eax
lea edi, [esp + 0x90]
call fcn.10001da0
mov edi, eax
mov esi, 0x1006c898
call fcn.10003890
cmp dword [esp + 0xa4], 0x10
jb 0x1000a87e
mov eax, dword [esp + 0x90]
push eax
call fcn.100281c4
add esp, 4
cmp dword [esp + 0x88], 0x10
mov edi, dword [esp + 0x84]
mov esi, dword [esp + 0x74]
jae 0x1000a897
lea esi, [esp + 0x74]
cmp dword [0x1006d944], ebx
jne 0x1000a8bc
push 0x64
call fcn.100288de
add esp, 4
cmp eax, ebx
je 0x1000a8b5
push eax
call fcn.100063b0
jmp 0x1000a8b7
xor eax, eax
mov dword [0x1006d944], eax
push edi
mov ecx, esi
call fcn.10006670
test al, al
jne 0x1000ab8e
call fcn.10001550
lea edx, [esp + 0x3c]
mov ecx, eax
call fcn.10002dc0
mov edi, eax
lea esi, [esp + 0x74]
call fcn.10003890
cmp dword [esp + 0x50], 0x10
jb 0x1000a8fb
mov ecx, dword [esp + 0x3c]
push ecx
call fcn.100281c4
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, dword [esp + 0xc]
lea esi, [esp + 0x58]
call fcn.10009d40
push str.fake_mac_return:
lea edx, [esp + 0x24]
push 0x1006c95c
push edx
mov esi, eax
call fcn.1000bd60
mov ecx, eax
lea eax, [esp + 0x48]
add esp, 0xc
push eax
mov eax, esi
call fcn.1000be40
add esp, 4
mov edi, eax
mov esi, 0x1006c95c
call fcn.10003890
cmp dword [esp + 0x50], 0x10
jb 0x1000a95a
mov ecx, dword [esp + 0x3c]
push ecx
call fcn.100281c4
add esp, 4
mov esi, 0x10
mov edi, 0xf
mov dword [esp + 0x50], edi
mov dword [esp + 0x4c], ebx
mov byte [esp + 0x3c], bl
cmp dword [esp + 0x34], esi
jb 0x1000a983
mov edx, dword [esp + 0x20]
push edx
call fcn.100281c4
add esp, 4
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
cmp dword [esp + 0x6c], esi
jb 0x1000a9a2
mov eax, dword [esp + 0x58]
push eax
call fcn.100281c4
add esp, 4
cmp dword [esp + 0x84], 0xc
jne 0x1000aa72
push 4
push 0x1006144c
mov ecx, 0x1006c8b4
call fcn.10004550
mov esi, str.fake
call fcn.10008160
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, dword [esp + 0xc]
lea esi, [esp + 0x58]
call fcn.10009d40
push str.write_fake_return:
lea ecx, [esp + 0x24]
push 0x1006c95c
push ecx
mov esi, eax
call fcn.1000bd60
lea edx, [esp + 0x48]
add esp, 0xc
mov ecx, eax
push edx
mov eax, esi
call fcn.1000be40
add esp, 4
mov edi, eax
mov esi, 0x1006c95c
call fcn.10003890
cmp dword [esp + 0x50], 0x10
jb 0x1000aa2a
mov eax, dword [esp + 0x3c]
push eax
call fcn.100281c4
add esp, 4
mov edi, 0x10
mov esi, 0xf
mov dword [esp + 0x50], esi
mov dword [esp + 0x4c], ebx
mov byte [esp + 0x3c], bl
cmp dword [esp + 0x34], edi
jb 0x1000aa53
mov ecx, dword [esp + 0x20]
push ecx
call fcn.100281c4
add esp, 4
mov dword [esp + 0x34], esi
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
cmp dword [esp + 0x6c], edi
jb 0x1000aa72
mov edx, dword [esp + 0x58]
push edx
call fcn.100281c4
add esp, 4
call fcn.10001550
cmp dword [esp + 0x84], 0xc
jb 0x1000aa93
lea eax, [esp + 0x74]
push eax
call fcn.10002b00
cmp al, bl
je 0x1000ab8e
push 4
push 0x10061474
mov ecx, 0x1006c8b4
call fcn.10004550
call fcn.100064d0
lea esi, [esp + 0x3c]
call fcn.10007d20
mov edi, eax
lea esi, [esp + 0x74]
call fcn.10003890
cmp dword [esp + 0x50], 0x10
jb 0x1000aad1
mov ecx, dword [esp + 0x3c]
push ecx
call fcn.100281c4
add esp, 4
mov esi, str.time
call fcn.10008160
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, dword [esp + 0xc]
lea esi, [esp + 0x58]
call fcn.10009d40
push str.write_time_mac_return:
lea edx, [esp + 0x24]
push 0x1006c95c
push edx
mov esi, eax
call fcn.1000bd60
mov ecx, eax
lea eax, [esp + 0x48]
add esp, 0xc
push eax
mov eax, esi
call fcn.1000be40
add esp, 4
mov edi, eax
mov esi, 0x1006c95c
call fcn.10003890
cmp dword [esp + 0x50], 0x10
jb 0x1000ab3a
mov ecx, dword [esp + 0x3c]
push ecx
call fcn.100281c4
add esp, 4
mov edi, 0x10
mov esi, 0xf
mov dword [esp + 0x50], esi
mov dword [esp + 0x4c], ebx
mov byte [esp + 0x3c], bl
cmp dword [esp + 0x34], edi
jb 0x1000ab63
mov edx, dword [esp + 0x20]
push edx
call fcn.100281c4
add esp, 4
mov dword [esp + 0x34], esi
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
cmp dword [esp + 0x6c], edi
jb 0x1000ab82
mov eax, dword [esp + 0x58]
push eax
call fcn.100281c4
add esp, 4
mov dword [esp + 0x6c], esi
mov dword [esp + 0x68], ebx
mov byte [esp + 0x58], bl
cmp dword [esp + 0x88], 0x10
mov eax, dword [esp + 0x74]
jae 0x1000aba0
lea eax, [esp + 0x74]
mov edx, dword [eax]
mov ecx, dword [esp + 0x10]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov al, byte [eax + 0xc]
mov byte [ecx + 0xc], al
mov ecx, dword [0x1006d940]
cmp ecx, ebx
jne 0x1000abe4
push 0x78
call fcn.100288de
add esp, 4
cmp eax, ebx
je 0x1000abda
push eax
call fcn.100015d0
jmp 0x1000abdc
xor eax, eax
mov ecx, eax
mov dword [0x1006d940], ecx
mov edx, dword [ecx + 0x58]
mov eax, dword [ecx + 0x54]
mov dword [0x1006d94c], edx
mov dword [0x1006d948], eax
call fcn.10002920
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, dword [esp + 0xc]
lea esi, [esp + 0x58]
call fcn.10009d40
push str.write_result_return:
lea ecx, [esp + 0x24]
push 0x1006c95c
push ecx
mov esi, eax
call fcn.1000bd60
lea edx, [esp + 0x48]
add esp, 0xc
mov ecx, eax
push edx
mov eax, esi
call fcn.1000be40
add esp, 4
mov edi, eax
mov esi, 0x1006c95c
call fcn.10003890
cmp dword [esp + 0x50], 0x10
jb 0x1000ac59
mov eax, dword [esp + 0x3c]
push eax
call fcn.100281c4
add esp, 4
mov edi, 0x10
mov esi, 0xf
mov dword [esp + 0x50], esi
mov dword [esp + 0x4c], ebx
mov byte [esp + 0x3c], bl
cmp dword [esp + 0x34], edi
jb 0x1000ac82
mov ecx, dword [esp + 0x20]
push ecx
call fcn.100281c4
add esp, 4
mov dword [esp + 0x34], esi
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
cmp dword [esp + 0x6c], edi
jb 0x1000aca1
mov edx, dword [esp + 0x58]
push edx
call fcn.100281c4
add esp, 4
mov dword [esp + 0x6c], esi
mov esi, dword [0x1006d940]
mov dword [esp + 0x68], ebx
mov byte [esp + 0x58], bl
cmp esi, ebx
jne 0x1000acd7
push 0x78
call fcn.100288de
add esp, 4
cmp eax, ebx
je 0x1000accd
push eax
call fcn.100015d0
jmp 0x1000accf
xor eax, eax
mov esi, eax
mov dword [0x1006d940], esi
mov eax, dword [esi + 0x40]
mov dword [esp + 0x10], esi
cmp eax, ebx
je 0x1000acf3
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esi + 0x40], ebx
mov esi, dword [0x1006d940]
mov eax, dword [esp + 0x10]
mov eax, dword [eax + 0x44]
cmp eax, ebx
je 0x1000ad13
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x10]
mov esi, dword [0x1006d940]
mov dword [eax + 0x44], ebx
cmp esi, ebx
je 0x1000ad2d
mov edi, esi
call fcn.10001670
push edi
call fcn.100281c4
add esp, 4
mov dword [0x1006d940], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esp + 0x14]
cmp dword [esp + 0x88], 0x10
mov dword [0x1006d950], eax
jb 0x1000ad53
mov ecx, dword [esp + 0x74]
push ecx
call fcn.100281c4
add esp, 4
mov dword [esp + 0x88], 0xf
mov byte [esp + 0x74], bl
mov dword [esp + 0x84], ebx
cmp byte [esp + 0x1c], bl
je 0x1000adb1
mov eax, dword [esp + 0x18]
dec dword [eax]
jne 0x1000adb1
lea ecx, [eax + 4]
xor edx, edx
xchg dword [ecx], edx
add eax, 8
mov edx, eax
mov ecx, SysReAllocString
lock xadd dword [edx], ecx
test ecx, 0x40000000
jne 0x1000adb1
cmp ecx, 0x80000000
jle 0x1000adb1
mov ecx, eax
lock bts dword [ecx], 0x1e
jb 0x1000adb1
call fcn.10006340
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [esp + 0x8c4]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100281cf
mov esp, ebp
pop ebp
ret