Function at 0x10021db4
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10064576
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34c
push ebx
push esi
push edi
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10021e23
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x204], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x224], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x1fc], eax
push 1
push dword [ebp - 0x224]
push dword [ebp - 0x1fc]
push 0xee4
push dword [ebp - 0x204]
push 0x7688
call fcn.100238a4
add esp, 0x18
jmp 0x10023893
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x1ec], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1e4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1dc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x258], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x248], eax
mov eax, dword [ebp - 0x248]
movzx eax, byte [eax]
test eax, eax
je 0x100237f0
mov eax, dword [ebp - 0x258]
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp - 0xa0]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xa0]
mov ecx, dword [ecx]
movzx ecx, word [ecx + 0x14]
lea eax, [eax + ecx + 0x18]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xac], 0x928c176b
mov dword [ebp - 0xac], 0
jmp 0x10021eab
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 9
je 0x10022048
mov dword [ebp - 0x1b8], 6
mov dword [ebp - 0x88], 0
jmp 0x10021edb
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 1
jge 0x10021ef7
mov eax, dword [ebp - 0x88]
mov dword [ebp + eax*4 - 0x208], 0
jmp 0x10021ece
mov dword [ebp - 0x260], 0x139d
cmp dword [ebp - 0x260], 0x6b6
jge 0x10022030
lea ecx, [ebp - 0x340]
call fcn.1000d232
and dword [ebp - 4], 0
lea ecx, [ebp - 0x328]
call fcn.1000d232
mov byte [ebp - 4], 1
lea eax, [ebp - 0x1f4]
push eax
push 0x10008670
call fcn.1004a47b
pop ecx
pop ecx
mov dword [ebp - 0xcc], 1
jmp 0x10021f5b
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
mov eax, dword [ebp - 0xcc]
cmp eax, dword [ebp - 0x1f4]
jg 0x10022012
lea eax, [ebp - 0x26c]
push eax
push 0x1000876c
call fcn.1004a47b
pop ecx
pop ecx
lea eax, [ebp - 0x26c]
push eax
lea ecx, [ebp - 0x340]
call fcn.10037491
lea eax, [ebp - 0x26c]
push eax
push 0x1000876c
call fcn.1004a47b
pop ecx
pop ecx
lea eax, [ebp - 0x26c]
push eax
lea ecx, [ebp - 0x328]
call fcn.10037491
lea eax, [ebp - 0x340]
push eax
call fcn.10021bc5
pop ecx
mov esi, eax
lea eax, [ebp - 0x328]
push eax
call fcn.10021bc5
pop ecx
add esi, eax
push esi
lea eax, [ebp - 0x358]
push eax
call fcn.10021c79
pop ecx
pop ecx
mov dword [ebp - 0x1b0], eax
mov ecx, dword [ebp - 0x1b0]
call fcn.1000d29f
push eax
push 0x10008770
call fcn.1004a80c
pop ecx
pop ecx
lea ecx, [ebp - 0x358]
call fcn.1000d295
jmp 0x10021f4e
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x328]
call fcn.1000d295
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x340]
call fcn.1000d295
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x208]
mov dword [ebp - 0x1b8], eax
jmp 0x10021e9e
and dword [ebp - 0xbc], 0
jmp 0x10022067
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp - 0x1c]
add eax, 0x28
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xa0]
mov eax, dword [eax]
movzx eax, word [eax + 6]
cmp dword [ebp - 0xbc], eax
jge 0x100237eb
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x24]
and eax, 0x20000000
je 0x10022098
mov dword [ebp - 0x130], 1
jmp 0x1002209f
and dword [ebp - 0x130], 0
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x1e8], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x24]
and eax, 0x40000000
je 0x100220c4
mov dword [ebp - 0x180], 1
jmp 0x100220cb
and dword [ebp - 0x180], 0
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x40], 0xb9f9b31
mov dword [ebp - 0x68], 0x3034d006
push 2
lea ecx, [ebp - 0x254]
call fcn.1000d8e5
mov dword [ebp - 4], 2
mov dword [ebp - 0x240], 0
push 0x581f
push 0x6e12
lea eax, [ebp - 0x254]
push eax
push 0
push 0x2b8c
push 0x1129
lea eax, [ebp - 0x2c0]
push eax
call fcn.100247c4
add esp, 0x1c
mov dword [ebp - 0x40], 0
jmp 0x1002213f
mov eax, dword [ebp - 0x40]
dec eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0xffffffee
jne 0x100223d8
mov dword [ebp - 0x30], 0xf36f
mov dword [ebp - 0x144], 0x3e458c45
mov dword [ebp - 0x214], 0xfbf2b831
cmp dword [ebp - 0x40], 0xa9d6
jl 0x10022179
mov dword [ebp - 0x194], 1
jmp 0x10022180
and dword [ebp - 0x194], 0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x68]
cmp eax, dword [ebp - 0x194]
jge 0x1002219d
mov dword [ebp - 0xec], 1
jmp 0x100221a4
and dword [ebp - 0xec], 0
push 1
lea ecx, [ebp - 0x254]
call fcn.1000d926
mov dword [eax], 1
mov eax, dword [ebp - 0x240]
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0xec], 0
jl 0x1002222f
mov byte [ebp - 0x25], 0
movzx eax, byte [ebp - 0x25]
test eax, eax
je 0x10022202
push 0x2dbf
push 0x54e1
push 0x64c9
push 1
push 0x6c8e
push 0x5945
push 0x70a5
push 1
call fcn.1001ffb3
add esp, 0x20
mov byte [ebp - 0x3b], 0
push 0x5921
push 0x543f
lea eax, [ebp - 0x3b]
push eax
push 0x7c0c
push 0x5272
push 1
push 1
call fcn.100200fa
add esp, 0x1c
jmp 0x100223d3
mov dword [ebp - 0x30], 0
jmp 0x1002223f
mov eax, dword [ebp - 0x30]
dec eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xfffffff4
jl 0x100223d3
mov dword [ebp - 0x1c0], 8
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x2ec], eax
push 0
lea ecx, [ebp - 0x254]
call fcn.1000d926
mov dword [ebp - 0x178], eax
push 1
lea ecx, [ebp - 0x254]
call fcn.1000d926
mov ecx, dword [ebp - 0x178]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x178]
cmp dword [eax], 1
ja 0x1002229d
mov dword [ebp - 0xe8], 1
jmp 0x100222a4
and dword [ebp - 0xe8], 0
cmp dword [ebp - 0x1c0], 0
je 0x100222bf
cmp dword [ebp - 0x30], 0
je 0x100222bf
mov dword [ebp - 0x17c], 1
jmp 0x100222c6
and dword [ebp - 0x17c], 0
mov eax, dword [ebp - 0xe8]
cmp eax, dword [ebp - 0x17c]
jne 0x100222e0
mov dword [ebp - 0xf4], 1
jmp 0x100222e7
and dword [ebp - 0xf4], 0
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 0
jne 0x1002230c
push 7
pop eax
test eax, eax
jne 0x1002230c
and dword [ebp - 0xfc], 0
jmp 0x10022316
mov dword [ebp - 0xfc], 1
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0
jne 0x10022334
cmp dword [ebp - 0x40], 0
jne 0x10022334
and dword [ebp - 0x16c], 0
jmp 0x1002233e
mov dword [ebp - 0x16c], 1
cmp dword [ebp - 0x16c], 0xda2a4f2a
ja 0x10022356
mov dword [ebp - 0x104], 1
jmp 0x1002235d
and dword [ebp - 0x104], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x104], eax
je 0x10022374
mov dword [ebp - 0x14c], 1
jmp 0x1002237b
and dword [ebp - 0x14c], 0
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x214], eax
mov byte [ebp - 0x31], 0
movzx eax, byte [ebp - 0x31]
test eax, eax
je 0x100223ce
push 0
push 0x1d92
push 0x2347
push 0x618
push 0x644f
push 0x7354
push 1
push 0x17c4
push 1
push 0x67e8
push 0x301d
push 0x2309
call fcn.10024aa7
add esp, 0x30
jmp 0x10022238
jmp 0x10022138
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x254]
call fcn.1000d921
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x24]
and eax, 0x80000000
je 0x10022400
mov dword [ebp - 0x10c], 1
jmp 0x10022407
and dword [ebp - 0x10c], 0
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x1e0], eax
mov dword [ebp - 0x24], 0x68206240
push 3
lea ecx, [ebp - 0x280]
call fcn.1000d8e5
mov dword [ebp - 4], 3
push 4
lea ecx, [ebp - 0x2e8]
call fcn.1000d8e5
mov byte [ebp - 4], 4
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x280]
push eax
push 1
push 0x1e2d
push 0x4b6f
push 0x607d
push 1
call fcn.10020366
add esp, 0x1c
mov dword [ebp - 0x6c], 0
jmp 0x10022475
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 4
jge 0x10022491
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x2e8]
call fcn.1000d926
mov dword [eax], 0xaeb59008
jmp 0x1002246e
mov dword [ebp - 0x24], 0
jmp 0x100224a1
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xf
je 0x10022723
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0x220], 4
mov dword [ebp - 0xa4], 0
jmp 0x100224d8
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 2
jg 0x1002271e
mov dword [ebp - 0x20], 0xb5ca9869
mov dword [ebp - 0x20], 0
jmp 0x100224fc
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jg 0x1002252d
mov byte [ebp - 0x3a], 0
movzx eax, byte [ebp - 0x3a]
test eax, eax
je 0x10022516
push 0
call fcn.100313cd
pop ecx
push dword [ebp - 0x20]
lea ecx, [ebp - 0x280]
call fcn.1000d926
cmp dword [eax], 0
je 0x1002252b
jmp 0x100224f5
jmp 0x100224f5
mov dword [ebp - 0x20], 0
jmp 0x1002253d
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jg 0x10022719
mov byte [ebp - 0x26], 0
movzx eax, byte [ebp - 0x26]
test eax, eax
je 0x10022701
mov dword [ebp - 0x1c8], 0x224e
cmp dword [ebp - 0x1c8], 0xbfa
jge 0x100226f3
lea eax, [ebp - 0xd4]
push eax
mov ecx, 0x10654250
call fcn.10017fa7
mov dword [ebp - 0xd0], 1
jmp 0x1002259b
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0x244], eax
mov eax, dword [ebp - 0xd4]
dec eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0x244], 0
je 0x100226f3
and dword [ebp - 0x44], 0
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0xdc]
push eax
mov ecx, 0x10654250
call fcn.10017fa7
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0x1d0], eax
mov eax, dword [ebp - 0xdc]
dec eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0x1d0], 0
je 0x10022643
lea eax, [ebp - 0x190]
push eax
mov ecx, 0x10654250
call fcn.10017fa7
mov eax, dword [ebp - 0x190]
cdq
push 0x1e
pop ecx
idiv ecx
imul eax, eax, 0xa
mov ecx, dword [ebp - 0x48]
lea eax, [ecx + eax + 0xa]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x190]
cdq
push 0x3c
pop ecx
idiv ecx
imul eax, eax, 0xf
mov ecx, dword [ebp - 0x44]
lea eax, [ecx + eax + 0xf]
mov dword [ebp - 0x44], eax
jmp 0x100225dc
push dword [ebp - 0xd0]
mov edx, 0x10008774
mov ecx, 0x10654198
call fcn.10011df5
mov ecx, eax
call fcn.100180e7
mov edx, 0x10008118
mov ecx, eax
call fcn.10011df5
mov eax, dword [ebp - 0x48]
cmp eax, dword [ebp - 0x44]
jne 0x1002269a
push fcn.10011fcc
push dword [ebp - 0x48]
mov edx, 0x1000877c
mov ecx, 0x10654198
call fcn.10011df5
mov ecx, eax
call fcn.100180e7
mov ecx, eax
call fcn.1000d598
jmp 0x100226ee
mov eax, dword [ebp - 0x48]
cmp eax, dword [ebp - 0x44]
jge 0x100226c9
push fcn.10011fcc
push dword [ebp - 0x48]
mov edx, 0x10008788
mov ecx, 0x10654198
call fcn.10011df5
mov ecx, eax
call fcn.100180e7
mov ecx, eax
call fcn.1000d598
jmp 0x100226ee
push fcn.10011fcc
push dword [ebp - 0x44]
mov edx, 0x10008790
mov ecx, 0x10654198
call fcn.10011df5
mov ecx, eax
call fcn.100180e7
mov ecx, eax
call fcn.1000d598
jmp 0x1002258e
push 1
push 0
push 1
call fcn.10031289
add esp, 0xc
lea eax, [ebp - 0x220]
push eax
push 1
push 1
call fcn.1002044b
add esp, 0xc
jmp 0x10022536
jmp 0x100224cb
jmp 0x1002249a
mov dword [ebp - 0x24], 0x1b
jmp 0x10022733
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xffffffec
jg 0x1002276c
mov byte [ebp - 0x27], 0
movzx eax, byte [ebp - 0x27]
test eax, eax
je 0x1002276a
push 1
push 0x201d
push 0x5643
push 0
push 0x15aa
push 0x1c2f
push 0x696f
call fcn.100242b8
add esp, 0x1c
jmp 0x1002272c
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2e8]
call fcn.1000d921
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x280]
call fcn.1000d921
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x24]
and eax, 0x2000000
je 0x1002293c
push 0x4000
mov eax, dword [ebp - 0x1c]
push dword [eax + 0x10]
mov eax, dword [ebp - 0x1c]
push dword [eax + 8]
push 0x8043
push 0x593e
call fcn.1001791d
pop ecx
pop ecx
call eax
push 2
lea ecx, [ebp - 0x1a0]
call fcn.1000d8e5
mov dword [ebp - 4], 5
mov dword [ebp - 0xa8], 0x44ad3740
mov dword [ebp - 0x1a4], 0x3b6f9b69
push 1
push 0x660e
lea eax, [ebp - 0x2a0]
push eax
lea eax, [ebp - 0x1a0]
push eax
push 0x5bb
push 1
push 0x1ca7
call fcn.100205de
add esp, 0x1c
mov byte [ebp - 0x29], 0
movzx eax, byte [ebp - 0x29]
test eax, eax
je 0x10022830
push 0x6c67
push 0x59a7
push 0
call fcn.10030622
add esp, 0xc
cmp dword [ebp - 0xa8], 0
je 0x1002284c
push 7
pop eax
test eax, eax
je 0x1002284c
mov dword [ebp - 0x1d8], 1
jmp 0x10022853
and dword [ebp - 0x1d8], 0
push 0
lea ecx, [ebp - 0x1a0]
call fcn.1000d926
mov esi, dword [ebp - 0xa8]
inc esi
push 1
lea ecx, [ebp - 0x1a0]
call fcn.1000d926
cmp esi, dword [eax]
jne 0x10022893
push 1
lea ecx, [ebp - 0x1a0]
call fcn.1000d926
cmp dword [eax], 0
jne 0x10022893
and dword [ebp - 0x114], 0
jmp 0x1002289d
mov dword [ebp - 0x114], 1
push 1
lea ecx, [ebp - 0x1a0]
call fcn.1000d926
mov eax, dword [eax]
cmp eax, dword [ebp - 0x114]
je 0x100228c0
mov dword [ebp - 0x154], 1
jmp 0x100228c7
and dword [ebp - 0x154], 0
push 1
lea ecx, [ebp - 0x1a0]
call fcn.1000d926
mov ecx, dword [ebp - 0x154]
cmp ecx, dword [eax]
jl 0x100228ea
mov dword [ebp - 0x11c], 1
jmp 0x100228f1
and dword [ebp - 0x11c], 0
cmp dword [ebp - 0x11c], 0xe124dc41
je 0x10022909
mov dword [ebp - 0x174], 1
jmp 0x10022910
and dword [ebp - 0x174], 0
mov eax, dword [ebp - 0xa8]
add eax, dword [ebp - 0x174]
sub eax, dword [ebp - 0xa8]
mov dword [ebp - 0x1a4], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1a0]
call fcn.1000d921
jmp 0x10022051
lea eax, [ebp - 0x1e0]
push eax
push 0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x1e8]
push eax
push 0x57b7
push 1
lea eax, [ebp - 0x1d4]
push eax
push 0x3190
call fcn.100208da
add esp, 0x24
push 1
lea ecx, [ebp - 0xb8]
call fcn.1000d8e5
mov dword [ebp - 4], 6
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x50], 0xfffffffe
mov dword [ebp - 0x23c], 0xaf833954
lea eax, [ebp - 0xb8]
push eax
push 1
push 1
lea eax, [ebp - 0x5c]
push eax
call fcn.10020a4c
add esp, 0x10
mov dword [ebp - 0x5c], 0
jmp 0x100229c5
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 2
jge 0x100229db
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x210], 0x21ec2184
jmp 0x100229be
push 0
lea ecx, [ebp - 0xb8]
call fcn.1000d926
and dword [eax], 0
jmp 0x10022a11
push 0
lea ecx, [ebp - 0xb8]
call fcn.1000d926
mov dword [ebp - 0x124], eax
mov eax, dword [ebp - 0x124]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x124]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xb8]
call fcn.1000d926
cmp dword [eax], 0xffffffe2
jle 0x10022a5d
mov byte [ebp - 0x39], 0
movzx eax, byte [ebp - 0x39]
test eax, eax
je 0x10022a5b
push 0x4cd0
push 0x5467
push 0x2d03
push 0x39c0
push 0
push 1
push 1
push 0x592a
push 0x36bb
call fcn.100244f5
add esp, 0x24
jmp 0x100229ed
mov dword [ebp - 0x10], 0
jmp 0x10022a6d
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jg 0x10022e6c
push 4
lea ecx, [ebp - 0x84]
call fcn.1000d8e5
mov byte [ebp - 4], 7
mov dword [ebp - 0x4c], 0xffffffff
mov dword [ebp - 0x1f0], 0xfffffff7
mov dword [ebp - 0x29c], 1
mov dword [ebp - 0x298], 1
mov dword [ebp - 0x294], 1
mov dword [ebp - 0x290], 1
mov dword [ebp - 0x90], 0
jmp 0x10022ada
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 4
jge 0x10022afc
push dword [ebp - 0x90]
lea ecx, [ebp - 0x84]
call fcn.1000d926
mov dword [eax], 1
jmp 0x10022acd
push 0
lea ecx, [ebp - 0x84]
call fcn.1000d926
and dword [eax], 0
jmp 0x10022b32
push 0
lea ecx, [ebp - 0x84]
call fcn.1000d926
mov dword [ebp - 0x15c], eax
mov eax, dword [ebp - 0x15c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x15c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x84]
call fcn.1000d926
cmp dword [eax], 0
jl 0x10022c84
push 0
lea ecx, [ebp - 0x84]
call fcn.1000d926
push dword [eax]
lea ecx, [ebp - 0xb8]
call fcn.1000d926
push 0
lea ecx, [ebp - 0x84]
call fcn.1000d926
push dword [eax]
lea ecx, [ebp - 0xb8]
call fcn.1000d926
cmp dword [eax], 0
jne 0x10022b8f
xor eax, eax
inc eax
jne 0x10022b8f
and dword [ebp - 0x12c], 0
jmp 0x10022b99
mov dword [ebp - 0x12c], 1
push 0
lea ecx, [ebp - 0xb8]
call fcn.1000d926
mov eax, dword [eax]
sub eax, dword [ebp - 0x12c]
cmp eax, 2
jge 0x10022bbf
mov dword [ebp - 0x184], 1
jmp 0x10022bc6
and dword [ebp - 0x184], 0
mov eax, dword [ebp - 0x184]
mov dword [ebp - 0x50], eax
mov esi, dword [ebp - 0x50]
push 0
lea ecx, [ebp - 0x84]
call fcn.1000d926
push dword [eax]
lea ecx, [ebp - 0xb8]
call fcn.1000d926
cmp esi, dword [eax]
jne 0x10022bfc
mov dword [ebp - 0x134], 1
jmp 0x10022c03
and dword [ebp - 0x134], 0
push 0
lea ecx, [ebp - 0x84]
call fcn.1000d926
push dword [eax]
lea ecx, [ebp - 0xb8]
call fcn.1000d926
mov ecx, dword [ebp - 0x134]
mov dword [eax], ecx
mov dword [ebp - 0x4c], 0xffffffef
jmp 0x10022c35
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 3
jge 0x10022c7f
mov byte [ebp - 0x28], 0
movzx eax, byte [ebp - 0x28]
test eax, eax
je 0x10022c5b
push 0
push 0x1d30
push 0x2752
call fcn.1002fa29
add esp, 0xc
mov byte [ebp - 0x3c], 0
movzx eax, byte [ebp - 0x3c]
test eax, eax
je 0x10022c7d
push 0x2174
push 0x10ce
push 1
push 1
call fcn.10020af4
add esp, 0x10
jmp 0x10022c2e
jmp 0x10022b0e
cmp dword [ebp - 0x10], 0
je 0x10022d60
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x210]
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0x210]
test eax, eax
jne 0x10022cb1
cmp dword [ebp - 0x50], 0
push 0
lea ecx, [ebp - 0x84]
call fcn.1000d926
cmp dword [eax], 0xfff6
ja 0x10022cd2
mov dword [ebp - 0x164], 1
jmp 0x10022cd9
and dword [ebp - 0x164], 0
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x164]
jg 0x10022cf0
mov dword [ebp - 0x25c], 1
jmp 0x10022cf7
and dword [ebp - 0x25c], 0
push 0
lea ecx, [ebp - 0x84]
call fcn.1000d926
mov esi, eax
push 0
lea ecx, [ebp - 0x84]
call fcn.1000d926
mov ecx, dword [esi]
cmp ecx, dword [eax]
jne 0x10022d25
mov dword [ebp - 0xc8], 1
jmp 0x10022d2c
and dword [ebp - 0xc8], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xc8]
mov dword [ebp + eax - 0x210], ecx
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
je 0x10022d60
cmp dword [ebp - 0x4c], 0
je 0x10022d60
mov dword [ebp - 0xe4], 1
jmp 0x10022d67
and dword [ebp - 0xe4], 0
mov eax, dword [ebp - 0x1f0]
mov dword [ebp - 0x13c], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x13c]
mov dword [ebp + eax - 0x29c], ecx
mov eax, dword [ebp - 0x13c]
cmp eax, dword [ebp - 0xe4]
jne 0x10022d9f
mov dword [ebp - 0xf0], 1
jmp 0x10022da6
and dword [ebp - 0xf0], 0
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0xf0], eax
jl 0x10022dbd
mov dword [ebp - 0xf8], 1
jmp 0x10022dc4
and dword [ebp - 0xf8], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0xf8], eax
jne 0x10022ddb
mov dword [ebp - 0x100], 1
jmp 0x10022de2
and dword [ebp - 0x100], 0
push 2
lea ecx, [ebp - 0x84]
call fcn.1000d926
mov esi, dword [ebp - 0x100]
imul esi, dword [eax]
push 0
lea ecx, [ebp - 0x84]
call fcn.1000d926
sub esi, dword [eax]
sub esi, dword [ebp - 0x10]
cmp esi, dword [ebp - 0x10]
je 0x10022e1b
mov dword [ebp - 0x238], 1
jmp 0x10022e22
and dword [ebp - 0x238], 0
push dword [ebp - 0x10]
lea ecx, [ebp - 0xb8]
call fcn.1000d926
mov dword [ebp - 0x1f8], eax
push dword [ebp - 0x10]
lea ecx, [ebp - 0xb8]
call fcn.1000d926
mov ecx, dword [ebp - 0x1f8]
mov eax, dword [eax]
mov dword [ecx], eax
mov dword [ebp - 0x23c], 0xfffffff8
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x84]
call fcn.1000d921
jmp 0x10022a66
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb8]
call fcn.1000d921
lea eax, [ebp - 0x1c]
push eax
push 0
lea eax, [ebp - 0xa0]
push eax
push 0x76e
lea eax, [ebp - 0x168]
push eax
call fcn.100243ef
add esp, 0x14
mov dword [ebp - 0xc0], 0xfffffffc
push 2
lea ecx, [ebp - 0x230]
call fcn.1000d8e5
mov dword [ebp - 4], 8
mov dword [ebp - 0x1ac], 0xfffffff8
mov dword [ebp - 0x64], 0
jmp 0x10022ed4
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 1
jge 0x10022ee7
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0x18], 0xfffffffa
jmp 0x10022ecd
push 0x4c0c
push 0x3202
push 0
push 0x3af6
push 0x4614
push 0x5b0c
push 0x3faf
push 0x41ee
push 0x1d9
lea eax, [ebp - 0x64]
push eax
push 0x5e2e
push 0x7534
push 0x254
push 1
push 0x5e56
push 0x1775
push 0x5e96
push 1
push 0x1359
push 0x7f75
push 0x62f2
push 0x5eda
push 0x6dd5
push 0x66b
lea eax, [ebp - 0x230]
push eax
push 0xd3
push 0x38bb
call fcn.1002d706
add esp, 0x6c
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x18], 0xfffffffb
jmp 0x10022f93
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x18]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x18], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x18], 0xfffffffd
jl 0x100230c8
mov dword [ebp - 0xd8], 7
mov dword [ebp - 0x1a8], 0xfffffffa
cmp dword [ebp - 0xd8], 0xffffffff
jb 0x10022fcd
mov dword [ebp - 0x200], 1
jmp 0x10022fd4
and dword [ebp - 0x200], 0
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0x310], eax
mov dword [ebp - 0xc0], 0xf44401d1
cmp dword [ebp - 0xc0], 9
jbe 0x10023008
mov eax, 0xe617
test eax, eax
je 0x10023008
mov dword [ebp - 0x108], 1
jmp 0x1002300f
and dword [ebp - 0x108], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x18]
cmp dword [ebp - 0x108], eax
jg 0x1002302d
mov dword [ebp - 0x110], 1
jmp 0x10023034
and dword [ebp - 0x110], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x18]
cmp eax, dword [ebp - 0x110]
jge 0x10023052
mov dword [ebp - 0x118], 1
jmp 0x10023059
and dword [ebp - 0x118], 0
mov eax, dword [ebp - 0xd8]
cmp dword [ebp - 0x118], eax
jle 0x10023073
mov dword [ebp - 0x120], 1
jmp 0x1002307a
and dword [ebp - 0x120], 0
cmp dword [ebp - 0x120], 0xfffffff8
jne 0x1002309c
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x18], 0
jne 0x1002309c
mov dword [ebp - 0x128], 1
jmp 0x100230a3
and dword [ebp - 0x128], 0
imul esi, dword [ebp - 0x128], 0xfffc
imul esi, dword [ebp - 0x1a8]
push 0
lea ecx, [ebp - 0x230]
call fcn.1000d926
mov dword [eax], esi
jmp 0x10022f7e
push 7
pop eax
test eax, eax
je 0x100230e8
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x18], 0
je 0x100230e8
mov dword [ebp - 0xe0], 1
jmp 0x100230ef
and dword [ebp - 0xe0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x18]
cmp dword [ebp - 0xe0], eax
jle 0x1002310d
mov dword [ebp - 0x150], 1
jmp 0x10023114
and dword [ebp - 0x150], 0
push 0
lea ecx, [ebp - 0x230]
call fcn.1000d926
cmp dword [eax], 0
je 0x1002313b
mov eax, 0xa3fd
test eax, eax
je 0x1002313b
mov dword [ebp - 0x138], 1
jmp 0x10023142
and dword [ebp - 0x138], 0
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0x138], eax
je 0x1002315c
mov dword [ebp - 0x140], 1
jmp 0x10023163
and dword [ebp - 0x140], 0
mov eax, dword [ebp - 0x140]
add eax, 0x655af779
je 0x10023185
cmp dword [ebp - 0x1ac], 0
je 0x10023185
mov dword [ebp - 0x148], 1
jmp 0x1002318c
and dword [ebp - 0x148], 0
push 0
lea ecx, [ebp - 0x230]
call fcn.1000d926
mov ecx, dword [ebp - 0x148]
sub ecx, dword [eax]
cmp dword [ebp - 0x150], ecx
jg 0x100231b5
mov dword [ebp - 0x158], 1
jmp 0x100231bc
and dword [ebp - 0x158], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x18]
cmp eax, dword [ebp - 0x158]
jl 0x100231da
mov dword [ebp - 0x160], 1
jmp 0x100231e1
and dword [ebp - 0x160], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x160]
mov dword [ebp + eax - 0x18], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.1000d921
cmp dword [ebp - 0x168], 0
jbe 0x100237e6
mov dword [ebp - 0x8c], 0x1824a8c6
mov dword [ebp - 0x2c8], 1
push 4
lea ecx, [ebp - 0x28c]
call fcn.1000d8e5
mov dword [ebp - 4], 9
mov dword [ebp - 0x1b4], 0x1853
cmp dword [ebp - 0x1b4], 0x3f6
jge 0x100236a4
push 8
pop eax
imul eax, eax, 0
mov dword [eax + 0x10e0f1b8], 1
and dword [eax + 0x10e0f1bc], 0
mov dword [ebp - 0x54], 1
jmp 0x10023276
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0xb
jge 0x100232a9
mov eax, dword [ebp - 0x54]
push 0
push 0xa
push dword [eax*8 + 0x10e0f1b4]
push dword [eax*8 + 0x10e0f1b0]
call fcn.10050090
mov ecx, dword [ebp - 0x54]
mov dword [ecx*8 + 0x10e0f1b8], eax
mov dword [ecx*8 + 0x10e0f1bc], edx
jmp 0x1002326f
push 0x10730ebc
push 0x10655300
push 0x100086cc
call fcn.1004a47b
add esp, 0xc
and dword [ebp - 0x98], 0
jmp 0x100232d6
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x98]
cmp eax, dword [0x10655300]
jge 0x10023300
mov eax, dword [ebp - 0x98]
lea eax, [eax*4 + 0x1066d9b8]
push eax
push 0x10008670
call fcn.1004a47b
pop ecx
pop ecx
jmp 0x100232c9
and dword [ebp - 0x58], 0
jmp 0x1002330d
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
cmp eax, dword [0x10655300]
jge 0x10023386
mov eax, dword [ebp - 0x58]
mov eax, dword [eax*4 + 0x1066d9b8]
cdq
idiv dword [0x10730ebc]
mov eax, edx
cdq
mov dword [ebp - 0x274], eax
mov dword [ebp - 0x270], edx
lea eax, [ebp - 0x274]
push eax
mov eax, dword [ebp - 0x58]
mov ecx, dword [eax*4 + 0x1066d9b8]
call fcn.10038208
push ecx
push ecx
movsd qword [esp], xmm0
call fcn.1004c830
pop ecx
pop ecx
fstp qword [ebp - 0x300]
movsd xmm0, qword [ebp - 0x300]
addsd xmm0, qword [0x100088d0]
cvttsd2si eax, xmm0
imul ecx, eax, 0xc
add ecx, 0x11134d90
call fcn.10037821
jmp 0x10023306
mov dword [ebp - 0x60], 1
jmp 0x10023396
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0xa
jg 0x100233d5
lea eax, [ebp - 0x30c]
push eax
imul ecx, dword [ebp - 0x60], 0xc
add ecx, 0x11134d90
call fcn.1000dc55
push dword [eax]
lea eax, [ebp - 0x2a4]
push eax
imul ecx, dword [ebp - 0x60], 0xc
add ecx, 0x11134d90
call fcn.1000d9ec
push dword [eax]
call fcn.10038156
pop ecx
pop ecx
jmp 0x1002338f
xorpd xmm0, xmm0
movlpd qword [ebp - 0x74], xmm0
and dword [ebp - 0x38], 0
jmp 0x100233eb
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
cmp eax, dword [0x10655300]
jge 0x10023691
mov dword [ebp - 0x14], 1
jmp 0x1002340a
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xa
jg 0x100235b8
imul ecx, dword [ebp - 0x14], 0xc
add ecx, 0x11134d90
call fcn.10037883
movzx eax, al
test eax, eax
je 0x1002342c
jmp 0x10023403
mov eax, dword [0x10730ebc]
cdq
mov esi, eax
mov edi, edx
mov eax, dword [ebp - 0x38]
mov eax, dword [eax*4 + 0x1066d9b8]
cdq
idiv dword [0x10730ebc]
mov eax, edx
cdq
mov ebx, eax
mov eax, edx
mov dword [ebp - 0x1bc], eax
mov eax, dword [0x10730ebc]
cdq
mov ecx, dword [ebp - 0x14]
push edx
push eax
push dword [ecx*8 + 0x10e0f1bc]
push dword [ecx*8 + 0x10e0f1b8]
call fcn.10063760
push edx
push eax
mov eax, dword [ebp - 0x1bc]
push eax
push ebx
call fcn.10050090
mov ecx, eax
mov ebx, edx
mov eax, dword [0x10730ebc]
cdq
push edx
push eax
push ebx
push ecx
call fcn.10063760
sub esi, eax
sbb edi, edx
mov eax, dword [0x10730ebc]
cdq
push edx
push eax
push edi
push esi
call fcn.10063760
mov dword [ebp - 0x18c], eax
mov dword [ebp - 0x188], edx
cmp dword [ebp - 0x188], 0
jg 0x100234cc
jl 0x100234c7
cmp dword [ebp - 0x18c], 0
jae 0x100234cc
jmp 0x10023403
lea eax, [ebp - 0x2ac]
push eax
imul ecx, dword [ebp - 0x14], 0xc
add ecx, 0x11134d90
call fcn.1000d9ec
push eax
lea eax, [ebp - 0x2b4]
push eax
imul ecx, dword [ebp - 0x14], 0xc
add ecx, 0x11134d90
call fcn.1000dc55
push dword [eax]
lea eax, [ebp - 0x2bc]
push eax
imul ecx, dword [ebp - 0x14], 0xc
add ecx, 0x11134d90
call fcn.1000d9ec
push dword [eax]
lea edx, [ebp - 0x18c]
lea ecx, [ebp - 0x2c4]
call fcn.1003817a
pop ecx
pop ecx
mov ecx, eax
call fcn.100378e2
mov dword [ebp - 0x1cc], eax
lea eax, [ebp - 0x2cc]
push eax
imul ecx, dword [ebp - 0x14], 0xc
add ecx, 0x11134d90
call fcn.1000d9ec
push eax
lea eax, [ebp - 0x2d8]
push eax
imul ecx, dword [ebp - 0x14], 0xc
add ecx, 0x11134d90
call fcn.1000dc55
push dword [eax]
lea eax, [ebp - 0x304]
push eax
imul ecx, dword [ebp - 0x14], 0xc
add ecx, 0x11134d90
call fcn.1000d9ec
push dword [eax]
lea edx, [ebp - 0x18c]
lea ecx, [ebp - 0x2a8]
call fcn.1003822f
pop ecx
pop ecx
mov ecx, eax
call fcn.100378e2
mov dword [ebp - 0x1c4], eax
mov eax, dword [ebp - 0x1c4]
sub eax, dword [ebp - 0x1cc]
cdq
add eax, dword [ebp - 0x74]
adc edx, dword [ebp - 0x70]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], edx
jmp 0x10023403
mov eax, dword [ebp - 0x38]
mov eax, dword [eax*4 + 0x1066d9b8]
cdq
idiv dword [0x10730ebc]
mov eax, edx
cdq
mov esi, eax
mov edi, edx
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax*4 + 0x1066d9b8]
call fcn.10038208
push ecx
push ecx
movsd qword [esp], xmm0
call fcn.1004c830
pop ecx
pop ecx
fstp qword [ebp - 0x2d4]
movsd xmm0, qword [ebp - 0x2d4]
addsd xmm0, qword [0x100088d0]
cvttsd2si ecx, xmm0
mov eax, dword [0x10730ebc]
cdq
push edx
push eax
push dword [ecx*8 + 0x10e0f1bc]
push dword [ecx*8 + 0x10e0f1b8]
call fcn.10063760
push edx
push eax
push edi
push esi
call fcn.10050090
mov ecx, eax
mov esi, edx
mov eax, dword [0x10730ebc]
cdq
push edx
push eax
push esi
push ecx
call fcn.10063760
mov ecx, eax
mov esi, edx
mov eax, dword [ebp - 0x38]
mov eax, dword [eax*4 + 0x1066d9b8]
cdq
add ecx, eax
adc esi, edx
mov eax, dword [0x10730ebc]
cdq
push edx
push eax
push esi
push ecx
call fcn.10063760
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x218], edx
mov eax, dword [ebp - 0x21c]
or eax, dword [ebp - 0x218]
jne 0x1002368c
mov eax, dword [ebp - 0x74]
sub eax, 1
mov ecx, dword [ebp - 0x70]
sbb ecx, 0
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], ecx
jmp 0x100233e4
push dword [ebp - 0x70]
push dword [ebp - 0x74]
push 0x100086a8
call fcn.1004a80c
add esp, 0xc
mov dword [ebp - 0x78], 0
jmp 0x100236b4
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 4
jge 0x100236d0
push dword [ebp - 0x78]
lea ecx, [ebp - 0x28c]
call fcn.1000d926
mov dword [eax], 1
jmp 0x100236ad
mov dword [ebp - 0x8c], 0xffffffe3
jmp 0x100236e9
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0xffffffe5
je 0x10023782
mov dword [ebp - 0x2dc], 0x288a137b
mov dword [ebp - 0x2b0], 1
push 3
lea ecx, [ebp - 0x2f8]
call fcn.1000d8e5
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x94], 0
jmp 0x10023734
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 3
jge 0x10023756
push dword [ebp - 0x94]
lea ecx, [ebp - 0x2f8]
call fcn.1000d926
mov dword [eax], 0xfffffffa
jmp 0x10023727
push 0x4184
lea eax, [ebp - 0x28c]
push eax
push 1
push 1
call fcn.10020cce
add esp, 0x10
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x2f8]
call fcn.1000d921
jmp 0x100236dc
mov byte [ebp - 0x2a], 0
movzx eax, byte [ebp - 0x2a]
test eax, eax
je 0x100237ab
push 0
push 1
push 1
push 0x70d9
push 0x7857
push 0x51c3
call fcn.10031d9f
add esp, 0x18
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28c]
call fcn.1000d921
lea eax, [ebp - 0x308]
push eax
push dword [ebp - 0x1d4]
push dword [ebp - 0x168]
mov eax, dword [ebp - 0x1c]
push dword [eax + 8]
push 0x8043
push 0x4e18
call fcn.1001791d
pop ecx
pop ecx
call eax
jmp 0x10022051
jmp 0x10023893
mov eax, dword [ebp - 0x1dc]
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp - 0x1e4]
mov dword [ebp - 0x170], eax
mov eax, dword [ebp - 0x1ec]
mov dword [ebp - 0x9c], eax
push 0x2f54
push 0x606b
push 0
lea eax, [ebp - 0xc4]
push eax
push 0x17c2
lea eax, [ebp - 0x9c]
push eax
push 1
call fcn.10020366
add esp, 0x1c
mov eax, dword [ebp - 0x9c]
cmp dword [eax], 0
jne 0x10023893
mov eax, dword [ebp - 0xc4]
mov eax, dword [eax + 0x24]
and eax, 0x40
je 0x1002386b
mov eax, dword [ebp - 0x170]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x9c]
mov eax, dword [eax + 0x20]
mov dword [ecx], eax
jmp 0x10023893
mov eax, dword [ebp - 0xc4]
mov eax, dword [eax + 0x24]
and eax, 0x80
je 0x10023893
push 0
lea eax, [ebp - 0x170]
push eax
lea eax, [ebp - 0x9c]
push eax
call fcn.1002d52b
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret