Function at 0x1003446c
Capabilities:
Allocate thread local storage
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10061920
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x168
push ebx
push esi
push edi
mov edi, edx
mov esi, ecx
mov dword [esp + 0x38], edi
cmp byte [edi], 0x50
jne 0x1003527f
cmp byte [edi + 1], 0x4b
jne 0x1003527f
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov byte [esp + 0x23], bl
cmp byte [esp + 0x23], bl
je 0x100344d7
push 0x52f
push 0x23d5
push ebx
push ebx
push 0x19fe
push 0x253a
call dword [sym.imp.USER32.dll_ToUnicode]
mov dword [esp + 0x14], ebx
jmp 0x100344f6
mov byte [esp + 0x23], bl
cmp byte [esp + 0x23], bl
je 0x100344f2
push 0x1006
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
dec dword [esp + 0x14]
cmp dword [esp + 0x14], 0xffffffe2
jg 0x100344dd
movzx eax, byte [edi + 2]
mov cl, byte [edi + 3]
add eax, 4
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], 0xfafe44fa
mov byte [esp + 0x1b], cl
mov dword [esp + 0x30], eax
mov dword [esp + 0x1c], 0xfffffff6
jmp 0x100345ec
push 2
lea ecx, [esp + 0xc4]
call fcn.10004595
mov dword [esp + 0x10], ebx
jmp 0x10034552
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xc0]
mov dword [eax + ecx*4], 0xfffffffb
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1003453c
mov dword [esp + 0x10], ebx
jmp 0x10034572
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0xcc], 0x45acee61
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 1
jl 0x1003455f
mov edx, dword [esp + 0xc0]
mov dword [edx + 4], 0xb
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x1c], ebx
je 0x100345a4
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
cmp dword [esp + 0x24], ebx
je 0x100345a4
xor esi, esi
inc esi
jmp 0x100345a6
mov esi, ebx
mov eax, dword [esp + 0x24]
xor ecx, ecx
cmp esi, eax
mov eax, dword [esp + 0x24]
sete cl
add ecx, dword [edx + 4]
add eax, ecx
dec dword [edx + 4]
mov dword [esp + 0xcc], eax
jne 0x10034587
push dword [esp + 0xc0]
call fcn.100497d9
mov dword [esp + 0xc4], ebx
mov dword [esp + 0xc8], ebx
mov dword [esp + 0xcc], ebx
inc dword [esp + 0x20]
pop ecx
cmp dword [esp + 0x1c], 0x10
jl 0x10034528
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x1c], eax
push 3
pop edi
cmp dword [esp + 0x1c], ebx
je 0x100346c5
push edi
lea ecx, [esp + 0x90]
call fcn.10004595
mov dword [esp + 0x14], ebx
jmp 0x10034635
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x8c]
mov dword [eax + ecx*4], 0xd7c869b7
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x1003461f
mov dword [esp + 0x1c], ebx
cmp dword [esp + 0x1c], 0xfffffff9
jl 0x10034691
mov esi, dword [esp + 0x8c]
mov dword [esp + 0x2c], 2
mov dword [esp + 0x40], 1
mov edx, dword [esp + 0x40]
mov eax, dword [esi + 8]
neg edx
mov dword [esp + 0x2c], eax
mov eax, dword [esi + 8]
sbb edx, edx
add eax, dword [esi + 4]
xor ecx, ecx
neg edx
cmp edx, eax
mov eax, dword [esp + 0x2c]
setne cl
imul eax, ecx
mov dword [esp + 0x10], eax
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xfffffff9
jge 0x1003464d
cmp dword [esp + 0x8c], ebx
je 0x100347af
push dword [esp + 0x8c]
call fcn.100497d9
pop ecx
mov dword [esp + 0x8c], ebx
mov dword [esp + 0x90], ebx
mov dword [esp + 0x94], ebx
jmp 0x100347af
mov dword [esp + 0x24], 0xc5c6a81d
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x3c], 0xcbf698ba
mov dword [esp + 0x14], ebx
jmp 0x100346f6
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0xdc], 0x762969fb
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 1
jl 0x100346e3
mov dword [esp + 0x10], 0xffffffe9
cmp dword [esp + 0x10], 0xffffffe5
je 0x10034740
mov eax, 0x86c7a88f
mov dword [esp + 0x28], ebx
mov dword [esp + 0xfc], eax
mov dword [esp + 0x100], eax
mov dword [esp + 0x104], eax
mov dword [esp + 0x108], eax
dec dword [esp + 0x2c]
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xffffffe5
jne 0x10034711
mov eax, dword [esp + 0x1c]
xor edx, edx
mov eax, dword [esp + 0x1c]
cmp eax, 0xc0e8
mov eax, dword [esp + 0x1c]
setge dl
xor ecx, ecx
cmp edx, eax
setne cl
sub ecx, dword [esp + 0x24]
imul eax, ecx, 0xf41a
mov ecx, dword [esp + 0x24]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [esp + 0x3c], ecx
mov ecx, dword [esp + 0x3c]
mov eax, dword [esp + 0xdc]
sub ecx, 0x2a49e864
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
add eax, ecx
mov ecx, dword [esp + 0x10]
imul ecx, eax
mov eax, dword [esp + 0x24]
cmp eax, ecx
mov eax, dword [esp + 0x24]
setg dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0xb4]
add eax, dword [esp + 0x38]
push edi
mov dword [esp + 0x44], eax
call fcn.10004595
mov dword [esp + 0x17c], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x10], ebx
jmp 0x100347ec
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x10c], 1
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x100347d9
mov dword [esp + 0x10], ebx
jmp 0x1003480e
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xb4]
mov dword [eax + ecx*4], 0x9dada439
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x100347f8
mov esi, dword [esp + 0xb4]
mov dword [esp + 0x24], esi
mov dword [esi + 4], 2
mov dword [esp + 0xa4], 0xffffffff
mov dword [esp + 0xa8], 0xffffffff
mov dword [esp + 0xac], 0xffffffff
mov dword [esp + 0xb0], 0xffffffff
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x2c], 1
mov byte [esp + 0x23], bl
cmp byte [esp + 0x23], 0
je 0x10034871
push ebx
push ebx
call dword [sym.imp.GDI32.dll_RectInRegion]
mov dword [esp + 0xb0], ebx
jmp 0x10034adc
push dword [esp + 0x28]
movdqa xmm0, xmmword [0x1006f170]
lea eax, [esp + 0x12c]
push eax
lea eax, [esp + 0x120]
mov dword [esp + 0x24], 0xffffffff
push eax
push ebx
lea ecx, [esp + 0x60]
mov dword [esp + 0x60], ebx
movdqu xmmword [esp + 0x128], xmm0
mov dword [esp + 0x64], ebx
mov dword [esp + 0x68], ebx
call fcn.10006d4a
mov byte [esp + 0x17c], 1
mov dword [esp + 0x2c], 0xa7c6dd3e
mov dword [esp + 0x1c], ebx
jmp 0x10034aa6
mov dword [esp + 0x10], 1
mov dword [esp + 0x10], 2
cmp dword [esp + 0x10], ebx
jl 0x10034a9b
push dword [esp + 0x28]
movdqa xmm0, xmmword [0x1006f1e0]
lea eax, [esp + 0x13c]
push eax
lea eax, [esp + 0x130]
mov dword [esp + 0x4c], ebx
push eax
push ebx
lea ecx, [esp + 0x54]
mov dword [esp + 0x58], ebx
movdqu xmmword [esp + 0x138], xmm0
mov dword [esp + 0x5c], ebx
call fcn.10006d4a
mov byte [esp + 0x17c], 2
mov eax, dword [esp + 0xb0]
cmp dword [esp + eax*4 + 0x10c], ebx
jne 0x10034a72
mov esi, dword [esp + 0x44]
mov eax, dword [esp + 0x50]
mov edi, dword [esp + 0x24]
mov dword [esp + 0x3c], eax
mov dword [esi + 0xc], ebx
push 1
lea ecx, [esp + 0x9c]
call fcn.10004595
mov dword [esp + 0x14], ebx
jmp 0x10034987
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x98]
mov dword [eax + ecx*4], 0x13bf58aa
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 1
jl 0x10034971
mov eax, dword [esp + 0x10]
xor edx, edx
cmp dword [edi + 4], 0xffffffff
setl dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [esp + 0x3c]
setg cl
mov dword [eax + 0xc], ecx
xor ecx, ecx
mov eax, dword [esp + 0x98]
cmp dword [eax], 0x2fa8
setge cl
xor edx, edx
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x98]
cmp ecx, dword [eax]
setg dl
mov dword [esp + 0x2c], edx
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x10c]
neg ecx
sbb ecx, ecx
xor eax, eax
neg ecx
neg ecx
cmp ecx, 0x1ea0
setge al
mov dword [esp + 0x2c], eax
mov byte [esp + 0x23], bl
cmp byte [esp + 0x23], 0
je 0x10034a16
push 0x1ea7
push 0xeae
call dword [sym.imp.GDI32.dll_RestoreDC]
push dword [esp + 0x98]
call fcn.100497d9
inc dword [esi + 0xc]
cmp dword [esi + 0xc], 2
pop ecx
mov dword [esp + 0x98], ebx
mov dword [esp + 0x9c], ebx
mov dword [esp + 0xa0], ebx
jle 0x1003495d
mov byte [esp + 0x17c], 1
push dword [esp + 0x44]
call fcn.100497d9
pop ecx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
dec dword [esp + 0x10]
push 3
pop edi
jns 0x100348f3
jmp 0x10034a97
mov byte [esp + 0x17c], 1
cmp dword [esp + 0x44], 0
je 0x10034a97
push dword [esp + 0x44]
call fcn.100497d9
pop ecx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov esi, dword [esp + 0x24]
mov eax, dword [esi + 4]
mov dword [esp + 0x2c], eax
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jle 0x100348d9
mov byte [esp + 0x17c], bl
cmp dword [esp + 0x50], 0
je 0x10034ad5
push dword [esp + 0x50]
call fcn.100497d9
pop ecx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], ebx
inc dword [esp + 0xb0]
cmp dword [esp + 0xb0], 2
jle 0x1003487d
dec dword [esi + 4]
jns 0x10034826
or dword [esp + 0x17c], 0xffffffff
push dword [esp + 0xb4]
call fcn.100497d9
mov esi, dword [esp + 0x34]
pop ecx
push edi
lea ecx, [esp + 0x78]
mov dword [esp + 0xb8], ebx
mov dword [esp + 0xbc], ebx
add esi, 0x18
mov dword [esp + 0xc0], ebx
call fcn.10004595
mov dword [esp + 0x14], ebx
jmp 0x10034b47
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x74]
mov dword [eax + ecx*4], 0xea5d6c05
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x10034b34
mov eax, dword [esp + 0x74]
mov dword [eax + 4], ebx
mov dword [esp + 0x14], 0xeede0b40
mov dword [esp + 0x14], ebx
cmp dword [esp + 0x14], 0xa
je 0x10034b7b
mov ecx, dword [esp + 0x74]
cmp dword [ecx + 8], ebx
jne 0x10034b7b
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0xa
jne 0x10034b6b
inc dword [eax + 4]
cmp dword [eax + 4], 0x1d
jl 0x10034b54
push dword [esp + 0x74]
call fcn.100497d9
movzx eax, byte [esp + 0x1f]
mov dword [esp + 0x78], ebx
add esi, eax
mov dword [esp + 0x7c], ebx
mov dword [esp + 0x80], ebx
mov dword [esp + 0x14], 0xffffffff
pop ecx
mov dword [esp + 0x30], esi
mov dword [esp + 0x14], ebx
jmp 0x10034bc9
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x158], 0xa8eac8b1
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x10034bb6
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10034be7
push ebx
push ebx
push 0x685
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
mov dword [esp + 0x10], ebx
jmp 0x10034c00
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x158], 0xfffffff7
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x10034bed
mov eax, dword [esp + 0x40]
mov ecx, dword [eax + 0x14]
mov edx, dword [eax]
call fcn.10021365
mov dword [esp + 0x14], 1
mov esi, eax
mov dword [esp + 0x28], 0xfffffff8
mov dword [esp + 0x14], ebx
jmp 0x10034c3e
cmp byte [esp + 0x1b], 0
je 0x10034c3a
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
mov byte [esp + 0x1b], bl
jne 0x10034c2c
cmp byte [esp + 0x1b], 0
je 0x10034c56
call dword [sym.imp.KERNEL32.dll_GetACP]
mov eax, dword [esp + 0x30]
xor ecx, ecx
add eax, dword [esp + 0x38]
inc ecx
mov dword [esp + 0x3c], eax
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov dword [esp + 0x1c], 0x21f90ef3
mov dword [esp + 0x14], 0xfffffff8
mov dword [esp + 0x10], 0x51fa4c82
mov dword [esp + 0x30], ecx
mov dword [esp + 0x2c], 0xb1c2fbf3
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x28], 0xb8877e47
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
cmp dword [esp + 0x1c], ebx
je 0x10034cdc
mov eax, ecx
cmp dword [esp + 0x14], ebx
jne 0x10034cde
mov eax, ebx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x1c], ebx
je 0x10034cf0
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
neg edx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x30]
sbb edx, edx
neg edx
xor ecx, ecx
neg edx
cmp edx, eax
setle cl
cmp dword [esp + 0x10], ecx
jg 0x10034d1b
cmp dword [esp + 0x14], ebx
jne 0x10034d1f
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
xor edx, edx
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x1c]
cmp eax, ecx
mov eax, dword [esp + 0x1c]
setg dl
xor ecx, ecx
cmp eax, edx
setg cl
cmp ecx, 0xfffc
sbb eax, eax
inc eax
mov dword [esp + 0x2c], eax
je 0x10034d7b
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10034d5f
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10034f5c
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
jmp 0x10034f5c
mov dword [esp + 0x34], 0x6054615
lea ecx, [esp + 0x68]
mov dword [esp + 0x10], 0xafff74b7
mov dword [esp + 0x24], 0xe45104f3
push edi
call fcn.10004595
mov dword [esp + 0x17c], edi
lea eax, [esp + 0x158]
push dword [esp + 0x28]
movdqa xmm0, xmmword [0x1006f1a0]
lea ecx, [esp + 0x60]
push eax
lea eax, [esp + 0x150]
mov dword [esp + 0x64], ebx
push eax
push ebx
movdqu xmmword [esp + 0x158], xmm0
mov dword [esp + 0x70], ebx
mov dword [esp + 0x74], ebx
call fcn.10006d4a
mov dword [esp + 0x24], ebx
jmp 0x10034df5
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x68]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x24]
cmp dword [esp + 0x24], edi
jl 0x10034de5
imul eax, dword [esp + 0x34], 0x46b4
test eax, eax
je 0x10034e2d
mov eax, dword [esp + 0x10]
neg eax
sbb eax, eax
neg eax
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x34]
mov dword [esp + 0x24], 0xa6825d82
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
test eax, eax
setg cl
mov dword [esp + 0x10], ecx
mov ecx, 0xbb70
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x2c]
sub ecx, eax
je 0x10034e79
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x28], 0xe10b09ed
mov dword [esp + 0x28], 0x9b5f814d
mov dword [esp + 0x28], 0x3d3c4855
dec dword [eax + 8]
jmp 0x10034f18
mov dword [esp + 0x14], 0x45fe6ee0
mov dword [esp + 0x10], 0xfffffff4
jmp 0x10034eb2
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10034e9d
push ebx
call dword [sym.imp.KERNEL32.dll_ClearCommBreak]
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10034eae
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0xb
jle 0x10034e8b
cmp dword [esp + 0x30], ebx
jne 0x10034ec9
cmp dword [esp + 0x14], ebx
jne 0x10034ec9
mov ecx, ebx
jmp 0x10034ef2
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x68]
mov ecx, dword [eax + 8]
mov eax, dword [esp + 0x5c]
sub ecx, 0x5e26160d
cmp ecx, dword [eax + 4]
jle 0x10034eef
mov eax, dword [esp + 0x14]
xor ecx, ecx
inc ecx
mov eax, dword [esp + 0x68]
mov eax, dword [eax + 8]
imul eax, ecx
xor ecx, ecx
cmp eax, 6
setl cl
mov dword [esp + 0x14], ecx
mov eax, dword [esp + 0x14]
sub eax, dword [esp + 0x2c]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x34], 0x4c718fe3
test eax, eax
je 0x10034f37
push eax
call fcn.100497d9
pop ecx
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x60], ebx
mov dword [esp + 0x64], ebx
or dword [esp + 0x17c], 0xffffffff
cmp dword [esp + 0x68], 0
je 0x10034f5c
push dword [esp + 0x68]
call fcn.100497d9
pop ecx
mov dword [esp + 0x68], ebx
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x70], ebx
mov dword [esp + 0x10], ebx
xor ecx, ecx
shr esi, 2
mov dword [esp + 0x2c], 0xa2ae
inc esi
mov dword [esp + 0x34], 5
inc ecx
mov dword [esp + 0x30], ecx
mov dword [esp + 0x30], 0x153413f0
mov dword [esp + 0x28], 0x7fb
mov dword [esp + 0x24], esi
mov dword [esp + 0x10], ebx
jmp 0x10034fa4
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0xe0], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x10034f95
mov dword [esp + 0x10], ebx
jmp 0x10034fc3
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x164], 0x1d847576
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x10034fb0
mov dword [esp + 0x10], ebx
jmp 0x10034fe2
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0xe0], 0x83c7
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x10034fcf
cmp dword [esp + 0x2c], ebx
je 0x1003500c
mov eax, dword [esp + 0xe4]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0xe8]
mov eax, ebx
cmp dword [esp + 0x34], ebx
jne 0x1003500e
mov eax, ecx
mov dword [esp + 0x10], eax
mov edx, ecx
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov dword [esp + 0x30], ebx
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0xe0]
mov dword [esp + 0x30], 0x6aac8953
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
sub edx, eax
mov eax, dword [esp + 0x28]
cmp edx, eax
setge cl
mov dword [esp + 0x168], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x40], ebx
mov eax, dword [ecx]
mov dword [esp + 0xec], eax
mov eax, dword [ecx + 4]
mov dword [esp + 0xf0], eax
mov eax, dword [ecx + 8]
mov dword [esp + 0xf4], eax
mov eax, dword [ecx + 0xc]
mov dword [esp + 0xf8], eax
test esi, esi
je 0x100352dd
mov eax, dword [esp + 0x38]
sub eax, dword [esp + 0x3c]
mov dword [esp + 0x38], eax
mov dword [esp + 0x34], 0x80d416db
lea ecx, [esp + 0x80]
push edi
call fcn.10004595
mov dword [esp + 0x17c], 4
lea ecx, [esp + 0xd0]
mov dword [esp + 0x28], 0x6c715341
mov dword [esp + 0x28], ebx
mov dword [esp + 0x28], 0xfffffffb
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x28], ebx
mov dword [esp + 0x28], 0xd0d1d847
mov dword [esp + 0x28], 0xeb236728
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x28], 0x3585ca25
mov dword [esp + 0x28], 0x51fe511b
push 1
call fcn.10004595
xor edx, edx
mov dword [esp + 0x10], ebx
inc edx
cmp dword [esp + 0x10], edi
jge 0x10035129
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x80]
mov dword [eax + ecx*4], edx
inc dword [esp + 0x10]
jmp 0x1003510f
mov dword [esp + 0x10], ebx
jmp 0x10035141
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xd0]
mov dword [eax + ecx*4], edx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x1003512f
mov esi, dword [esp + 0x80]
xor edx, edx
mov eax, dword [esp + 0x34]
push 0
mov dword [esp + 0x30], esi
mov ecx, dword [esi + 8]
sub ecx, 0x3a00d0e7
mov esi, dword [esi + 8]
cmp ecx, eax
mov ecx, dword [esp + 0x84]
setge dl
xor eax, eax
cmp dword [ecx], 0xfffd
setne al
cmp eax, edx
mov eax, dword [ecx + 4]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x38]
pop edx
setg dl
xor ecx, ecx
cmp edx, eax
mov edx, dword [esp + 0x34]
setle cl
xor eax, eax
cmp ecx, esi
setne al
xor ecx, ecx
cmp esi, eax
mov esi, dword [esp + 0x28]
setne cl
sub edx, ecx
neg edx
sbb edx, edx
xor eax, eax
inc edx
cmp edx, esi
setg al
xor ecx, ecx
cmp eax, esi
setge cl
add ecx, 0x5a98e71b
je 0x100351d1
test esi, esi
je 0x100351d1
xor eax, eax
inc eax
jmp 0x100351d3
mov eax, ebx
mov ecx, dword [esp + 0x2c]
cmp eax, 6
sbb eax, eax
inc eax
cmp eax, dword [ecx + 8]
jge 0x100351ec
cmp dword [esp + 0x34], ebx
jne 0x100351ec
mov eax, ebx
jmp 0x100351ef
xor eax, eax
inc eax
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0xd0]
push eax
inc dword [eax]
call fcn.100497d9
or dword [esp + 0x180], 0xffffffff
push dword [esp + 0x84]
mov dword [esp + 0xd8], ebx
mov dword [esp + 0xdc], ebx
mov dword [esp + 0xe0], ebx
call fcn.100497d9
mov esi, dword [esp + 0x48]
mov edx, esi
mov eax, dword [esp + 0x44]
and edx, edi
pop ecx
pop ecx
mov dword [esp + 0x80], ebx
mov ecx, dword [eax]
mov edx, dword [esp + edx*4 + 0xec]
mov dword [esp + 0x84], ebx
mov dword [esp + 0x88], ebx
call fcn.10021365
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
mov dword [edx + ecx], eax
add ecx, 4
inc esi
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], esi
cmp esi, dword [esp + 0x24]
jb 0x10035092
jmp 0x100352dd
mov dword [esp + 0x14], 0x32fe2236
xor ebx, ebx
push 3
mov dword [esp + 0x2c], 0xf7a7
mov dword [esp + 0x3c], ebx
pop edi
jmp 0x100352a9
mov eax, dword [esp + 0x38]
mov dword [esp + eax*4 + 0x138], edi
inc dword [esp + 0x38]
cmp dword [esp + 0x38], 4
jl 0x1003529a
mov dword [esp + 0x14], edi
cmp dword [esp + 0x14], ebx
jl 0x100352d8
mov ecx, dword [esp + 0x138]
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x138], ecx
cmp dword [esp + 0x14], ebx
jne 0x100352d8
dec dword [esp + 0x14]
jns 0x100352ba
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov ecx, dword [esp + 0x174]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret