Function at 0x100d113
Capabilities:
Compare security identifiers

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [ebp + 0x1c]
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0xc], esi
mov ebx, 0x1002214
mov ecx, 0x10150c0
cmp dword [ebp + 0x10], esi
je 0x100d17c
test al, 2
je 0x100d17c
push 0x57
pop esi
mov eax, dword [0x10150c0]
cmp eax, ecx
je 0x100dc60
test byte [eax + 0x1c], 8
je 0x100dc3e
cmp byte [eax + 0x19], 2
jb 0x100dc3e
push ebx
push 0x29
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010015b6
jmp 0x100dbfe
test al, al
jns 0x100d1ad
test al, 0x18
je 0x100d1ad
push 0x57
pop esi
mov eax, dword [0x10150c0]
cmp eax, ecx
je 0x100dc60
test byte [eax + 0x1c], 8
je 0x100dc3e
cmp byte [eax + 0x19], 2
jb 0x100dc3e
push ebx
push 0x2a
jmp 0x100d16c
cmp dword [ebp + 0x10], esi
jne 0x100d455
cmp dword [ebp + 0xc], esi
jne 0x100d1f2
mov eax, dword [0x10150c0]
cmp eax, 0x10150c0
je 0x100d426
test byte [eax + 0x1c], 8
je 0x100d426
cmp byte [eax + 0x19], 4
jb 0x100d426
push ebx
push 0x2b
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010015b6
jmp 0x100d426
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call sub.WTSAPI32.dll_WTSQueryUserToken
test eax, eax
jne 0x100d27c
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x3f0
je 0x100d24d
call esi
mov esi, eax
mov eax, dword [0x10150c0]
cmp eax, 0x10150c0
je 0x100dc03
test byte [eax + 0x1c], 8
je 0x100dc03
cmp byte [eax + 0x19], 2
jb 0x100dc03
push esi
push ebx
push 0x2c
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01002f89
jmp 0x100dbfe
mov eax, dword [0x10150c0]
cmp eax, 0x10150c0
je 0x100d426
test byte [eax + 0x1c], 8
je 0x100d426
cmp byte [eax + 0x19], 4
jb 0x100d426
push dword [ebp + 8]
push ebx
push 0x2d
jmp 0x100d41b
mov esi, dword [sym.imp.ntdll.dll_NtQueryInformationToken]
lea eax, [ebp - 8]
push eax
push 0
push 0
push 1
push dword [ebp - 0xc]
call esi
mov edi, 0xc0000023
mov dword [ebp - 4], eax
cmp eax, edi
je 0x100d2d5
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov esi, eax
mov eax, dword [0x10150c0]
cmp eax, 0x10150c0
je 0x100dc03
test byte [eax + 0x1c], 8
je 0x100dc03
cmp byte [eax + 0x19], 2
jb 0x100dc03
push dword [ebp - 4]
push ebx
push 0x2e
jmp 0x100d23d
push dword [ebp - 8]
call fcn.01006a60
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x100d2ec
push 0xe
pop esi
jmp 0x100dbfe
lea ecx, [ebp - 8]
push ecx
push dword [ebp - 8]
push eax
push 1
push dword [ebp - 0xc]
call esi
mov dword [ebp - 4], eax
test eax, eax
jge 0x100d33a
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov esi, eax
mov eax, dword [0x10150c0]
cmp eax, 0x10150c0
je 0x100dc03
test byte [eax + 0x1c], 8
je 0x100dc03
cmp byte [eax + 0x19], 2
jb 0x100dc03
push dword [ebp - 4]
push ebx
push 0x2f
jmp 0x100d23d
lea eax, [ebp - 8]
push eax
push 0
push 0
push 1
push dword [ebp + 0xc]
call esi
mov dword [ebp - 4], eax
cmp eax, edi
je 0x100d388
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov esi, eax
mov eax, dword [0x10150c0]
cmp eax, 0x10150c0
je 0x100dc03
test byte [eax + 0x1c], 8
je 0x100dc03
cmp byte [eax + 0x19], 2
jb 0x100dc03
push dword [ebp - 4]
push ebx
push 0x30
jmp 0x100d23d
push dword [ebp - 8]
call fcn.01006a60
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100d2e4
lea ecx, [ebp - 8]
push ecx
push dword [ebp - 8]
push eax
push 1
push dword [ebp + 0xc]
call esi
mov dword [ebp - 4], eax
test eax, eax
jge 0x100d3e9
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov esi, eax
mov eax, dword [0x10150c0]
cmp eax, 0x10150c0
je 0x100dc03
test byte [eax + 0x1c], 8
je 0x100dc03
cmp byte [eax + 0x19], 2
jb 0x100dc03
push dword [ebp - 4]
push ebx
push 0x31
jmp 0x100d23d
mov eax, dword [ebp - 0x10]
push dword [eax]
mov eax, dword [ebp - 0x14]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x100d42c
mov eax, dword [0x10150c0]
cmp eax, 0x10150c0
je 0x100d426
test byte [eax + 0x1c], 8
je 0x100d426
cmp byte [eax + 0x19], 4
jb 0x100d426
push dword [ebp + 8]
push ebx
push 0x32
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01002f89
or dword [ebp + 0x1c], 2
jmp 0x100d455
mov eax, dword [0x10150c0]
cmp eax, 0x10150c0
je 0x100d455
test byte [eax + 0x1c], 8
je 0x100d455
cmp byte [eax + 0x19], 4
jb 0x100d455
push dword [ebp + 8]
push ebx
push 0x33
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01002f89
push 0x1015184
call dword [sym.imp.ntdll.dll_RtlEnterCriticalSection]
mov dword [ebp - 4], eax
test eax, eax
jge 0x100d475
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov esi, eax
jmp 0x100dbfe
cmp dword [0x10158a4], 2
jl 0x100d48a
mov dword [ebp + 0x28], 0x45b
jmp 0x100dbe8
mov eax, dword [0x1015218]
mov ecx, dword [0x101521c]
mov edi, dword [ebp + 0x14]
mov edx, eax
or edx, ecx
je 0x100d572
mov esi, 0x100dc70
push esi
push ecx
push eax
call dword [sym.imp.ntdll.dll_EtwEventEnabled]
test al, al
je 0x100d572
xor edx, edx
mov ecx, 0x100369c
cmp edi, edx
je 0x100d4d1
mov eax, dword [edi + 4]
cmp eax, edx
je 0x100d4d1
cmp word [edi], dx
jbe 0x100d4d1
mov ecx, eax
lea edi, [ebp + 0x10]
mov dword [ebp - 0x88], edi
lea eax, [ebp + 8]
lea edi, [ebp + 0x18]
mov dword [ebp - 0x98], eax
push 4
pop eax
mov dword [ebp - 0x78], edi
lea edi, [ebp + 0x1c]
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x68], edi
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x50], eax
lea edi, [ebp + 0x20]
mov eax, ecx
mov dword [ebp - 0x94], edx
mov dword [ebp - 0x8c], edx
mov dword [ebp - 0x84], edx
mov dword [ebp - 0x7c], edx
mov dword [ebp - 0x74], edx
mov dword [ebp - 0x6c], edx
mov dword [ebp - 0x64], edx
mov dword [ebp - 0x5c], edx
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x58], edi
lea edx, [eax + 2]
mov di, word [eax]
inc eax
inc eax
test di, di
jne 0x100d536
and dword [ebp - 0x44], 0
and dword [ebp - 0x3c], 0
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x98]
push eax
push 6
push esi
push dword [0x101521c]
mov dword [ebp - 0x48], ecx
push dword [0x1015218]
call dword [sym.imp.ntdll.dll_EtwEventWrite]
test byte [ebp + 0x1c], 1
jne 0x100d5bc
push dword [ebp + 8]
call fcn.0100bf5f
test eax, eax
je 0x100d5bc
mov ecx, dword [0x10150c0]
cmp ecx, 0x10150c0
je 0x100d5b0
test byte [ecx + 0x1c], 8
je 0x100d5b0
cmp byte [ecx + 0x19], 4
jb 0x100d5b0
push eax
push dword [ebp + 8]
push ebx
push 0x34
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.0100b8d6
mov dword [ebp + 0x28], 0x4a7
jmp 0x100dbe8
cmp dword [ebp + 8], 0
jne 0x100d5f3
mov eax, dword [0x10150c0]
cmp eax, 0x10150c0
je 0x100d5ed
test byte [eax + 0x1c], 8
je 0x100d5ed
cmp byte [eax + 0x19], 3
jb 0x100d5ed
push ebx
push 0x35
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010015b6
mov eax, dword [0x10150c0]
or dword [ebp + 0x1c], 2
jmp 0x100d5f8
mov eax, dword [0x10150c0]
cmp dword [ebp + 0x18], 0
jbe 0x100d62b
cmp eax, 0x10150c0
je 0x100d627
test byte [eax + 0x1c], 8
je 0x100d627
cmp byte [eax + 0x19], 3
jb 0x100d627
push dword [ebp + 0x18]
push ebx
push 0x36
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01002f89
mov eax, dword [0x10150c0]
or dword [ebp + 0x1c], 2
test dword [ebp + 0x1c], 0x1c
jne 0x100d638
or dword [ebp + 0x1c], 8
mov esi, dword [ebp + 0x28]
mov edi, dword [ebp + 0x24]
cmp eax, 0x10150c0
je 0x100d666
test byte [eax + 0x1c], 8
je 0x100d666
cmp byte [eax + 0x19], 5
jb 0x100d666
push esi
push edi
push ebx
push 0x37
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100b908
mov eax, dword [0x10150c0]
cmp dword [ebp + 0x14], 0
mov edx, dword [ebp + 0x1c]
push 0x20
mov dword [ebp - 0x34], edx
mov edx, dword [ebp + 0x20]
pop ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], 1
je 0x100d690
mov edx, dword [ebp + 0x14]
mov edx, dword [edx + 4]
mov dword [ebp - 0x24], edx
jmp 0x100d694
and dword [ebp - 0x24], 0
mov edx, dword [ebp + 0x1c]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], edi
test dl, 2
jne 0x100d842
cmp dword [ebp + 0x10], 0
jne 0x100d842
test edx, edx
js 0x100d6d0
test dl, 0xc
je 0x100d6d0
push edx
push 0x100a6e0
push 0x100a680
push 1
call fcn.0100c5c3
mov eax, dword [0x10150c0]
cmp eax, 0x10150c0
je 0x100d6f4
test byte [eax + 0x1c], 8
je 0x100d6f4
cmp byte [eax + 0x19], 5
jb 0x100d6f4
push dword [ebp + 8]
push ebx
push 0x38
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01002f89
mov al, byte [ebp + 0x1c]
xor edi, edi
inc edi
test al, 4
je 0x100d702
push 3
jmp 0x100d708
test al, 8
je 0x100d709
push 9
pop edi
test al, al
jns 0x100d710
or edi, 0x40
test al, 0x40
je 0x100d71a
or edi, 0x100000
mov esi, edi
or esi, 0x2000
push esi
push dword [ebp + 8]
push 0x100a670
call fcn.0100c554
lea eax, [ebp - 4]
push eax
push esi
push 1
push dword [ebp + 8]
call fcn.010117f9
mov dword [ebp + 0x28], eax
test eax, eax
jne 0x100d750
mov eax, dword [ebp - 4]
test eax, eax
je 0x100d78d
mov dword [ebp + 0x28], eax
mov eax, dword [0x10150c0]
cmp eax, 0x10150c0
je 0x100dbe8
test byte [eax + 0x1c], 8
je 0x100dbe8
cmp byte [eax + 0x19], 2
jb 0x100dbe8
push dword [ebp + 0x28]
push dword [ebp + 8]
push ebx
push 0x3b
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100b8d6
jmp 0x100dbe8
cmp dword [ebp + 0xc], 0
je 0x100d7e3
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
jne 0x100d7e3
mov eax, dword [0x10150c0]
cmp eax, 0x10150c0
je 0x100dbe8
test byte [eax + 0x1c], 8
je 0x100dbe8
cmp byte [eax + 0x19], 2
jb 0x100dbe8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x10150c0]
push ebx
push 0x3a
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01002f89
jmp 0x100dbe8
lea eax, [ebp - 0x38]
push eax
mov dword [ebp - 0x34], edi
call dword [sym.imp.USER32.dll_RecordShutdownReason]
mov ecx, dword [0x10150c0]
cmp ecx, 0x10150c0
je 0x100d82d
test byte [ecx + 0x1c], 8
je 0x100d82d
cmp byte [ecx + 0x19], 5
jb 0x100d82d
test eax, eax
mov eax, 0x100dc88
jne 0x100d818
mov eax, 0x100dc80
push dword [ebp - 0x30]
push dword [ebp - 0x34]
push eax
push ebx
push 0x39
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.0100b9cf
cmp dword [ebp + 0xc], 0
je 0x100dbe8
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
jmp 0x100dbe8
cmp dword [0x10158a4], 1
jne 0x100d8e0
test cl, dl
jne 0x100d85f
mov dword [ebp + 0x28], 0x4a6
jmp 0x100dbe8
mov esi, dword [sym.imp.KERNEL32.dll_DeleteTimerQueueTimer]
xor edi, edi
push edi
push dword [0x101589c]
push edi
call esi
cmp eax, 1
jne 0x100d8a2
mov eax, dword [0x10150c0]
cmp eax, 0x10150c0
je 0x100d89c
test byte [eax + 0x1c], 8
je 0x100d89c
cmp byte [eax + 0x19], 5
jb 0x100d89c
push ebx
push 0x3c
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010015b6
mov dword [0x10158a4], edi
mov eax, dword [0x10158a0]
cmp eax, edi
je 0x100d8e0
push edi
push eax
push edi
call esi
test eax, eax
jne 0x100d8da
mov eax, dword [0x10150c0]
cmp eax, 0x10150c0
je 0x100d8da
test byte [eax + 0x1c], 8
je 0x100d8da
cmp byte [eax + 0x19], 2
jb 0x100d8da
push ebx
push 0x3d
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010015b6
mov dword [0x10158a0], edi
xor esi, esi
test dword [ebp + 0x1c], 0x80000000
jne 0x100d9b6
cmp dword [ebp + 0xc], esi
je 0x100d941
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
jne 0x100d941
mov eax, dword [0x10150c0]
cmp eax, 0x10150c0
je 0x100d9b6
test byte [eax + 0x1c], 8
je 0x100d9b6
cmp byte [eax + 0x19], 2
jb 0x100d9b6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x10150c0]
push ebx
push 0x3f
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01002f89
jmp 0x100d9b6
test byte [ebp + 0x1c], 4
mov dword [ebp - 0x34], 1
je 0x100d957
mov dword [ebp - 0x34], 3
jmp 0x100d964
test byte [ebp + 0x1c], 8
je 0x100d964
mov dword [ebp - 0x34], 9
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.USER32.dll_RecordShutdownReason]
mov ecx, dword [0x10150c0]
cmp ecx, 0x10150c0
je 0x100d9ab
test byte [ecx + 0x1c], 8
je 0x100d9ab
cmp byte [ecx + 0x19], 5
jb 0x100d9ab
cmp eax, esi
mov eax, 0x100dc88
jne 0x100d996
mov eax, 0x100dc80
push dword [ebp - 0x30]
push dword [ebp - 0x34]
push eax
push ebx
push 0x3e
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.0100b9cf
cmp dword [ebp + 0xc], esi
je 0x100d9b6
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
cmp dword [ebp + 0x18], esi
jbe 0x100dbdc
mov edi, dword [sym.imp.KERNEL32.dll_CreateTimerQueueTimer]
push 0xa
xor ebx, ebx
pop esi
mov eax, dword [ebp + 0x18]
imul eax, eax, 0x3e8
push 0x10
push 0
push eax
push dword [ebp - 0x18]
push fcn.0100c93e
push 0
push 0x101589c
call edi
test eax, eax
jne 0x100da3d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0x28], eax
mov eax, dword [0x10150c0]
cmp eax, 0x10150c0
je 0x100da23
test byte [eax + 0x1c], 8
je 0x100da23
cmp byte [eax + 0x19], 2
jb 0x100da23
push dword [ebp + 0x28]
push 0x1002214
push 0x40
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01002f89
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
inc ebx
cmp ebx, esi
jl 0x100d9ca
mov eax, dword [0x10150c0]
jmp 0x100db24
mov eax, dword [ebp + 0x18]
push 0x3c
xor edx, edx
pop ecx
div ecx
cmp eax, esi
ja 0x100da54
push 2
pop ecx
cmp ecx, eax
sbb esi, esi
and esi, ecx
mov eax, dword [0x10150c0]
cmp eax, 0x10150c0
je 0x100da81
test byte [eax + 0x1c], 8
je 0x100da81
cmp byte [eax + 0x19], 4
jb 0x100da81
mov ebx, 0x1002214
push ebx
push 0x41
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010015b6
jmp 0x100da86
mov ebx, 0x1002214
push 0
push dword [ebp + 0x18]
call fcn.0100cd51
test esi, esi
je 0x100db1b
mov ecx, dword [ebp + 0x18]
mov eax, esi
imul eax, eax, 0x3c
sub ecx, eax
imul ecx, ecx, 0x3e8
push 0x10
push 0
push ecx
push eax
push fcn.0100cd51
push 0
push 0x10158a0
call edi
test eax, eax
jne 0x100daf4
mov eax, dword [0x10150c0]
cmp eax, 0x10150c0
je 0x100db20
test byte [eax + 0x1c], 8
je 0x100db20
cmp byte [eax + 0x19], 2
jb 0x100db20
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x10150c0]
push ebx
push 0x42
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01002f89
jmp 0x100db1b
mov eax, dword [0x10150c0]
cmp eax, 0x10150c0
je 0x100db20
test byte [eax + 0x1c], 8
je 0x100db20
cmp byte [eax + 0x19], 4
jb 0x100db20
push esi
push ebx
push 0x43
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01002f89
mov eax, dword [0x10150c0]
and dword [ebp + 0x28], 0
xor ebx, ebx
cmp dword [ebp + 0x28], ebx
je 0x100db61
cmp eax, 0x10150c0
je 0x100dbe8
test byte [eax + 0x1c], 8
je 0x100dbe8
cmp byte [eax + 0x19], 2
jb 0x100dbe8
push 0x1002214
push 0x44
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010015b6
jmp 0x100dbe8
mov edi, 0x10150c0
cmp eax, edi
je 0x100db8d
test byte [eax + 0x1c], 8
je 0x100db8d
cmp byte [eax + 0x19], 5
jb 0x100db8d
push 0x1002214
push 0x45
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010015b6
mov eax, dword [0x10150c0]
mov esi, dword [ebp + 0x14]
mov dword [0x10158a4], 1
cmp esi, ebx
je 0x100dbd7
cmp dword [esi + 4], ebx
je 0x100dbd7
cmp eax, edi
je 0x100dbc5
test byte [eax + 0x1c], 8
je 0x100dbc5
cmp byte [eax + 0x19], 5
jb 0x100dbc5
push 0x1002214
push 0x46
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010015b6
lea eax, [ebp + 0xc]
push eax
push ebx
push dword [esi + 4]
push dword [ebp + 0x18]
push 2
call fcn.0100f873
mov dword [ebp + 0x28], ebx
jmp 0x100dbe8
push esi
push dword [ebp - 0x18]
call fcn.0100c93e
mov dword [ebp + 0x28], esi
push 0x1015184
call dword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
mov esi, dword [ebp + 0x28]
mov dword [ebp - 4], eax
mov ebx, 0x1002214
mov eax, dword [0x10150c0]
xor edi, edi
cmp dword [ebp - 0x10], edi
je 0x100dc18
lea eax, [ebp - 0x10]
push eax
call fcn.0100575d
mov eax, dword [0x10150c0]
cmp dword [ebp - 0x14], edi
je 0x100dc2b
lea eax, [ebp - 0x14]
push eax
call fcn.0100575d
mov eax, dword [0x10150c0]
cmp dword [ebp - 0xc], edi
je 0x100dc3e
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x10150c0]
cmp eax, 0x10150c0
je 0x100dc60
test byte [eax + 0x1c], 8
je 0x100dc60
cmp byte [eax + 0x19], 5
jb 0x100dc60
push esi
push ebx
push 0x47
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01002f89
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x24