Function at 0x10008952
Capabilities:
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100109cd
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x10016040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x10016888]
mov edi, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
cmp dword [eax], 0
jbe 0x100087f3
call fcn.10005490
call fcn.10005490
mov ecx, dword [0x10016b8c]
mov ecx, dword [ecx + 0x10]
push ecx
mov ecx, dword [eax + ecx]
call fcn.100058c0
mov ecx, eax
call fcn.10005780
comiss xmm0, dword [0x100128bc]
jbe 0x100087f3
mov eax, dword [0x10016b8c]
mov esi, dword [0x10016888]
push 4
push esi
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x50], eax
call edi
test eax, eax
jne 0x100086ff
mov ecx, dword [ebp - 0x50]
mov esi, dword [esi]
add ecx, 0x10
add esi, ecx
push 4
push esi
call edi
test eax, eax
jne 0x100086ff
test esi, esi
jne 0x10008701
xor esi, esi
push 4
push esi
call edi
test eax, eax
jne 0x100087f3
xor ecx, ecx
mov dword [ebp - 0x50], ecx
mov eax, dword [0x10016b8c]
mov esi, dword [0x10016888]
push 4
push esi
mov eax, dword [eax + 0x14]
add eax, ecx
mov dword [ebp - 0x58], eax
call edi
test eax, eax
jne 0x10008741
mov esi, dword [esi]
add esi, dword [ebp - 0x58]
push 4
push esi
call edi
test eax, eax
jne 0x10008741
test esi, esi
jne 0x10008743
xor esi, esi
mov eax, dword [0x10016954]
test eax, eax
jle 0x1000879e
sub eax, 1
je 0x10008774
sub eax, 1
je 0x1000876a
sub eax, 1
je 0x10008760
xorps xmm0, xmm0
jmp 0x1000877c
movss xmm0, dword [0x100128d0]
jmp 0x1000877c
movss xmm0, dword [0x100128cc]
jmp 0x1000877c
movss xmm0, dword [0x100128c8]
push 4
push esi
movss dword [ebp - 0x58], xmm0
call edi
test eax, eax
jne 0x100087e1
push 4
push esi
call edi
test eax, eax
jne 0x100087e1
movss xmm0, dword [ebp - 0x58]
movss dword [esi], xmm0
jmp 0x100087e1
movss xmm0, dword [esi]
ucomiss xmm0, dword [0x100128c8]
lahf
test ah, 0x44
jnp 0x100087c9
ucomiss xmm0, dword [0x100128cc]
lahf
test ah, 0x44
jnp 0x100087c9
ucomiss xmm0, dword [0x100128d0]
lahf
test ah, 0x44
jp 0x100087e1
push 4
push esi
call edi
test eax, eax
jne 0x100087e1
push 4
push esi
call edi
test eax, eax
jne 0x100087e1
mov dword [esi], 0xb7a7c5ac
mov ecx, dword [ebp - 0x50]
add ecx, 4
mov dword [ebp - 0x50], ecx
cmp ecx, 0x1c
jle 0x10008713
cmp dword [0x10016968], 0
je 0x1000886e
push 0x74
mov dword [0x10016974], 0x10001bb0
call fcn.10001bb0
cwde
shr eax, 0x10
test eax, eax
je 0x10008867
cmp byte [0x10016f60], 0
je 0x10008835
cmp dword [0x10016f64], 0
je 0x1000886e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x10016f64], eax
ja 0x1000886e
mov eax, dword [0x10016b8c]
mov byte [0x10016f60], 1
push 4
mov esi, dword [eax + 0x44]
push esi
call edi
test eax, eax
jne 0x1000886e
mov esi, dword [esi]
push 4
add esi, 0x3c
push esi
call edi
test eax, eax
jne 0x1000886e
test esi, esi
je 0x1000886e
mov dword [esi], 4
jmp 0x1000886e
mov byte [0x10016f60], 0
mov eax, dword [0x100169b0]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x100088cb
mov eax, dword [0x10016b8c]
mov ecx, 0x100121f4
mov esi, 0x100121ec
cmove esi, ecx
mov edi, dword [eax + 0x40]
lea eax, [ebp - 0x50]
push eax
push 0x40
push 4
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [esi]
mov dword [edi], eax
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x50]
push 4
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 4
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [0x10016b9c], 1
mov eax, dword [0x10016b8c]
jne 0x100088ea
push 6
push 0x100051f0
push dword [eax + 0x1c]
call fcn.10001830
jmp 0x10008924
mov esi, dword [eax + 0x1c]
lea eax, [ebp - 0x50]
push eax
push 0x40
push 6
push esi
call edi
push 6
push 0x100121fc
push esi
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x50]
push 6
push esi
call edi
push 6
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov eax, dword [0x1001687c]
test eax, eax
je 0x1000898a
dec eax
cmp eax, 4
ja case.default.0x10008933
jmp dword [eax*4 + 0x100092f8]
mov dword [0x100168e0], 0x41f00000
jmp case.default.0x10008933
mov dword [0x100168e0], 0x42200000
jmp case.default.0x10008933
mov dword [0x100168e0], 0x42480000
jmp case.default.0x10008933
mov dword [0x100168e0], 0x42700000
jmp case.default.0x10008933
mov dword [0x100168e0], 0x428c0000
mov eax, dword [0x10016b8c]
push 5
push 0x10005200
push dword [eax + 0x24]
call fcn.10001830
jmp 0x100089c9
mov eax, dword [0x10016b8c]
mov esi, dword [eax + 0x24]
lea eax, [ebp - 0x50]
push eax
push 0x40
push 5
push esi
call edi
push 5
push 0x10012204
push esi
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x50]
push 5
push esi
call edi
push 5
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov eax, dword [0x100168d4]
test eax, eax
je 0x10008a02
cmp eax, 1
jne 0x100089e1
movss xmm0, dword [0x10012948]
jmp 0x100089e4
xorps xmm0, xmm0
mov eax, dword [0x10016b8c]
push 5
push 0x10005210
movss dword [0x10016b7c], xmm0
push dword [eax + 0x2c]
call fcn.10001830
jmp 0x10008a41
mov eax, dword [0x10016b8c]
mov esi, dword [eax + 0x2c]
lea eax, [ebp - 0x50]
push eax
push 0x40
push 5
push esi
call edi
push 5
push 0x10012204
push esi
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
lea eax, [ebp - 0x64]
push eax
push dword [ebp - 0x50]
push 5
push esi
call edi
push 5
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
cmp dword [0x100168d4], 1
jne 0x10008ad1
push str.Tekan_V_Untuk_Meledakan_Bomb
push 0xffffff00
push 0xbc
push 0x17c
push dword [0x10016b68]
call fcn.10005f90
add esp, 0x14
mov dword [0x10016974], 0x10001bb0
push 0x56
call fcn.10001bb0
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
cwde
shr eax, 0x10
test eax, eax
je 0x10008ac8
cmp byte [0x10016e70], 0
je 0x10008aae
cmp dword [0x10016e74], 0
je 0x10008ad7
call esi
mov ecx, dword [0x10016e74]
inc ecx
cmp ecx, eax
ja 0x10008ad7
mov byte [0x10016e70], 1
call esi
mov dword [0x10016e74], eax
mov dword [0x10016b7c], 0
jmp 0x10008ad7
mov byte [0x10016e70], 0
jmp 0x10008ad7
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x100168c0], 0
je 0x10008b8c
push 0x20
mov dword [0x10016974], 0x10001bb0
call fcn.10001bb0
cwde
shr eax, 0x10
test eax, eax
je 0x10008b31
cmp byte [0x10016cc0], 0
je 0x10008b1c
cmp dword [0x10016cc4], 0
je 0x10008b38
call esi
mov ecx, dword [0x10016cc4]
inc ecx
cmp ecx, eax
ja 0x10008b38
mov byte [0x10016cc0], 1
call esi
mov dword [0x10016cc4], eax
mov eax, 1
jmp 0x10008b3a
mov byte [0x10016cc0], 0
xor eax, eax
test eax, eax
mov ecx, 0x10012230
mov eax, dword [0x10016b8c]
mov esi, 0x1001222c
cmove esi, ecx
mov edi, dword [eax + 0x30]
lea eax, [ebp - 0x58]
push eax
push 0x40
push 3
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 3
push esi
push edi
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
lea eax, [ebp - 0x68]
push eax
push dword [ebp - 0x58]
push 3
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 3
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov ecx, dword [0x10016998]
mov eax, 0x10012234
mov edx, 0x10012238
test ecx, ecx
je 0x10008c4d
cmove eax, edx
mov ecx, 0x29
mov dword [ebp - 0x5c], eax
xor edx, edx
mov al, byte [edx + str._lco]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x4c], al
and ecx, 0x800000ff
jns 0x10008bce
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x19
jl 0x10008bb1
mov byte [ebp - 0x33], 0
mov dword [ebp - 4], 0
lea edx, [ebp - 0x4c]
mov ecx, dword [0x10016904]
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
call eax
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, eax
lea eax, [ebp - 0x54]
push eax
push 0x40
push 2
push esi
call edi
mov eax, dword [ebp - 0x5c]
mov cx, word [eax]
lea eax, [ebp - 0x60]
push eax
push dword [ebp - 0x54]
mov word [esi], cx
push 2
push esi
call edi
push 2
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov dword [ebp - 4], 0xffffffff
xorps xmm0, xmm0
movups xmmword [ebp - 0x4c], xmm0
mov eax, 0x10012234
mov word [ebp - 0x34], 0
movq qword [ebp - 0x3c], xmm0
mov edx, 0x10012238
jmp 0x10008c53
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [0x10016b78]
test ecx, ecx
je 0x10008ce8
cmove eax, edx
mov ecx, 0x6c
mov dword [ebp - 0x5c], eax
xor edx, edx
nop
mov al, byte [edx + str.__2_4]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x30], al
and ecx, 0x800000ff
jns 0x10008c8d
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x19
jl 0x10008c70
mov byte [ebp - 0x17], 0
mov dword [ebp - 4], 1
lea edx, [ebp - 0x30]
mov ecx, dword [0x10016904]
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
call eax
mov esi, eax
lea eax, [ebp - 0x54]
push eax
push 0x40
push 2
push esi
call edi
mov eax, dword [ebp - 0x5c]
mov cx, word [eax]
lea eax, [ebp - 0x60]
push eax
push dword [ebp - 0x54]
mov word [esi], cx
push 2
push esi
call edi
push 2
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov dword [ebp - 4], 0xffffffff
push 0x454ce1c6
push 0x3fc28f5b
push 0x3f4ce1c6
push ecx
mov ecx, dword [0x10016b70]
mov edx, 3
call fcn.10008530
add esp, 0x10
mov edx, 4
push 0x454ce1c6
push 0x3fc28f5b
push 0x3f4ce1c6
push ecx
mov ecx, dword [0x10016858]
call fcn.10008530
mov eax, dword [0x100168dc]
add esp, 0x10
cmp dword [0x100173c4], 0
jne 0x10008d6c
call fcn.10005490
mov ecx, dword [0x10016b8c]
mov ecx, dword [ecx + 0x10]
mov esi, dword [eax + ecx]
call fcn.10005490
imul ecx, esi, 0x4c
add ecx, eax
mov eax, dword [0x10016b8c]
mov eax, dword [eax]
mov eax, dword [ecx + eax + 0xc]
mov dword [0x100173c4], eax
jmp 0x10008dfb
test eax, eax
jne 0x10008dbb
cmp byte [0x100173c0], al
jne 0x10008dfb
call fcn.10005490
mov ecx, dword [0x10016b8c]
mov edi, dword [0x100173c4]
mov ecx, dword [ecx + 0x10]
mov esi, dword [eax + ecx]
call fcn.10005490
imul ecx, esi, 0x4c
add ecx, eax
mov eax, dword [0x10016b8c]
mov eax, dword [eax]
test edi, edi
je 0x10008db2
cmp dword [ecx + eax + 0xc], edi
je 0x10008db2
mov dword [ecx + eax + 0xc], edi
mov byte [0x100173c0], 1
jmp 0x10008dfb
cmp eax, 1
jne 0x10008dfb
call fcn.10005490
mov ecx, dword [0x10016b8c]
mov ecx, dword [ecx + 0x10]
mov esi, dword [eax + ecx]
call fcn.10005490
imul ecx, esi, 0x4c
add ecx, eax
mov eax, dword [0x10016b8c]
mov eax, dword [eax]
cmp dword [ecx + eax + 0xc], 0x454ce1c6
je 0x10008df4
mov dword [ecx + eax + 0xc], 0x454ce1c6
mov byte [0x100173c0], 0
cmp dword [0x100173c4], 0
mov eax, dword [0x100168f0]
jne 0x10008e39
call fcn.10005490
mov ecx, dword [0x10016b8c]
mov ecx, dword [ecx + 0x10]
mov esi, dword [eax + ecx]
call fcn.10005490
imul ecx, esi, 0x4c
add ecx, eax
mov eax, dword [0x10016b8c]
mov eax, dword [eax]
mov eax, dword [ecx + eax + 0x10]
mov dword [0x100173c4], eax
jmp 0x10008ec8
test eax, eax
jne 0x10008e88
cmp byte [0x100173c0], al
jne 0x10008ec8
call fcn.10005490
mov ecx, dword [0x10016b8c]
mov edi, dword [0x100173c4]
mov ecx, dword [ecx + 0x10]
mov esi, dword [eax + ecx]
call fcn.10005490
imul ecx, esi, 0x4c
add ecx, eax
mov eax, dword [0x10016b8c]
mov eax, dword [eax]
test edi, edi
je 0x10008e7f
cmp dword [ecx + eax + 0x10], edi
je 0x10008e7f
mov dword [ecx + eax + 0x10], edi
mov byte [0x100173c0], 1
jmp 0x10008ec8
cmp eax, 1
jne 0x10008ec8
call fcn.10005490
mov ecx, dword [0x10016b8c]
mov ecx, dword [ecx + 0x10]
mov esi, dword [eax + ecx]
call fcn.10005490
imul ecx, esi, 0x4c
add ecx, eax
mov eax, dword [0x10016b8c]
mov eax, dword [eax]
cmp dword [ecx + eax + 0x10], 0x4a651874
je 0x10008ec1
mov dword [ecx + eax + 0x10], 0x4a651874
mov byte [0x100173c0], 0
cmp dword [0x100173c4], 0
mov eax, dword [0x10016b88]
jne 0x10008f0a
call fcn.10005490
mov ecx, dword [0x10016b8c]
mov ecx, dword [ecx + 0x10]
mov esi, dword [eax + ecx]
call fcn.10005490
mov ecx, dword [0x10016b8c]
mov edx, eax
imul eax, esi, 0x4c
add eax, dword [ecx]
mov eax, dword [eax + edx + 0x88]
mov dword [0x100173c4], eax
jmp 0x10008fa3
test eax, eax
jne 0x10008f5e
cmp byte [0x100173c0], al
jne 0x10008fa3
call fcn.10005490
mov ecx, dword [0x10016b8c]
mov edi, dword [0x100173c4]
mov ecx, dword [ecx + 0x10]
mov esi, dword [eax + ecx]
call fcn.10005490
mov ecx, dword [0x10016b8c]
imul edx, esi, 0x4c
add edx, dword [ecx]
test edi, edi
je 0x10008f55
cmp dword [edx + eax + 0x88], edi
je 0x10008f55
mov dword [edx + eax + 0x88], edi
mov byte [0x100173c0], 1
jmp 0x10008fa3
cmp eax, 1
jne 0x10008fa3
call fcn.10005490
mov ecx, dword [0x10016b8c]
mov ecx, dword [ecx + 0x10]
mov esi, dword [eax + ecx]
call fcn.10005490
mov ecx, dword [0x10016b8c]
imul edx, esi, 0x4c
add edx, dword [ecx]
cmp dword [edx + eax + 0x88], 0x454ce1c6
je 0x10008f9c
mov dword [edx + eax + 0x88], 0x454ce1c6
mov byte [0x100173c0], 0
cmp dword [0x10016864], 0
je 0x1000910c
push 1
mov dword [0x10016974], 0x10001bb0
call fcn.10001bb0
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
cwde
shr eax, 0x10
test eax, eax
je 0x10009005
cmp byte [0x10016bc8], 0
je 0x10008feb
cmp dword [0x10016bcc], 0
je 0x1000900c
call edi
cmp dword [0x10016bcc], eax
ja 0x1000900c
mov byte [0x10016bc8], 1
call edi
mov dword [0x100173d0], eax
mov dword [0x100173c8], 1
jmp 0x1000900c
mov byte [0x10016bc8], 0
call edi
mov ecx, dword [0x100173d0]
add ecx, 0x32
cmp eax, ecx
jbe 0x1000904c
cmp dword [0x100173c8], 1
jne 0x1000904c
push 0
push 1
push 4
push 0x33
mov dword [0x10016844], 0x10001ba0
call fcn.10001ba0
call edi
mov dword [0x100173d4], eax
mov dword [0x100173c8], 2
call edi
mov ecx, dword [0x100173d4]
add ecx, 0x32
cmp eax, ecx
jbe 0x100090ba
cmp dword [0x100173c8], 2
jne 0x100090ba
push 0
push 3
push 4
push 0x33
mov dword [0x10016844], 0x10001ba0
call fcn.10001ba0
push 0
push 3
push 0x21
push 0x46
mov dword [0x10016844], 0x10001ba0
call fcn.10001ba0
push 0
push 1
push 2
push 0x31
mov dword [0x10016844], 0x10001ba0
call fcn.10001ba0
call edi
mov dword [0x100173d8], eax
mov dword [0x100173c8], 3
call edi
mov ecx, dword [0x100173d8]
add ecx, 0x23
cmp eax, ecx
jbe 0x10009112
cmp dword [0x100173c8], 3
jne 0x10009112
push 0
push 3
push 2
push 0x31
mov dword [0x10016844], 0x10001ba0
call fcn.10001ba0
push 0
push 3
push 0x21
push 0x46
mov dword [0x10016844], 0x10001ba0
call fcn.10001ba0
mov dword [0x100173c8], 0
jmp 0x10009112
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x100169bc], 0
je 0x10009120
call fcn.10008440
cmp dword [0x10016950], 0
je 0x100091cc
call fcn.10005490
mov ecx, dword [0x10016b8c]
mov ecx, dword [ecx + 0x10]
mov eax, dword [eax + ecx]
mov dword [ebp - 0x54], eax
call fcn.10005490
mov dword [ebp - 0x5c], eax
mov edx, 0x49
xor esi, esi
mov cl, byte [esi + 0x10011b30]
xor cl, dl
inc edx
mov byte [ebp + esi - 0x30], cl
and edx, 0x800000ff
jns 0x1000916d
dec edx
or edx, 0xffffff00
inc edx
inc esi
cmp esi, 0x1c
jl 0x10009150
mov byte [ebp - 0x14], 0
mov dword [ebp - 4], 2
lea edx, [ebp - 0x30]
mov ecx, dword [0x10016904]
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
call eax
mov dword [ebp - 4], 0xffffffff
xorps xmm0, xmm0
mov ecx, dword [ebp - 0x54]
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x18], 0
movq qword [ebp - 0x20], xmm0
lea eax, [eax + ecx*4]
mov byte [ebp - 0x14], 0
mov ecx, dword [ebp - 0x5c]
mov eax, dword [eax + ecx]
add eax, 8
cmp byte [eax], 0
je 0x100091cc
mov byte [eax], 0
lea eax, [eax + 1]
cmp byte [eax], 0
jne 0x100091c1
cmp dword [0x100169bc], 0
je 0x100091da
call fcn.10008440
cmp dword [0x10016914], 0
je 0x10009210
mov ecx, dword [0x10016904]
push str.GameState.Base
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
call eax
cmp eax, 5
jne 0x10009210
mov eax, dword [0x10016b8c]
push 6
push 0x10005220
push dword [eax + 0x3c]
call fcn.10001830
jmp 0x10009257
mov eax, dword [0x10016b8c]
mov esi, dword [eax + 0x3c]
lea eax, [ebp - 0x5c]
push eax
push 0x40
push 6
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 6
push 0x1001224c
push esi
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
lea eax, [ebp - 0x60]
push eax
push dword [ebp - 0x5c]
push 6
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 6
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
cmp dword [0x1001696c], 0
je 0x100092dc
call fcn.10005f00
test al, al
je 0x100092dc
cmp dword [0x100168b8], 0
setne byte [ebp - 0x54]
call fcn.10005ac0
push dword [ebp - 0x54]
mov ecx, eax
call fcn.10005240
push 0x10
mov dword [0x10016974], 0x10001bb0
call fcn.10001bb0
cwde
shr eax, 0x10
test eax, eax
je 0x100092d5
cmp byte [0x10016c40], 0
je 0x100092bc
cmp dword [0x10016c44], 0
je 0x100092dc
call edi
cmp dword [0x10016c44], eax
ja 0x100092dc
xor eax, eax
mov byte [0x10016c40], 1
cmp dword [0x100168b8], eax
sete al
mov dword [0x100168b8], eax
jmp 0x100092dc
mov byte [0x10016c40], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000f0bd
mov esp, ebp
pop ebp
ret