Function at 0x100ff1f0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb6c
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
or eax, 0xf003f
mov dword [ebp - 0xa8c], ecx
mov ecx, dword [ebp + 8]
push eax
push str.SOFTWAREMicrosoftInternet_ExplorerSearchScopes_
mov dword [ebp - 0xa98], ecx
push ecx
lea ecx, [ebp - 0xaac]
mov dword [ebp - 0xaac], 0
mov dword [ebp - 0xaa8], 0
mov dword [ebp - 0xaa4], 0xffffffff
call fcn.10058810
test eax, eax
jne 0x1010009b
mov word [ebp - 0x804], ax
lea eax, [ebp - 0xaac]
push str.DefaultScope
push eax
lea eax, [ebp - 0xb38]
mov dword [ebp - 0xa88], 0x400
push eax
call fcn.10060900
mov eax, dword [ebp - 0xa88]
add esp, 0xc
xor esi, esi
or ebx, 0xffffffff
mov ecx, dword [ebp - 0xaa4]
mov edx, dword [ebp - 0xaac]
mov dword [ebp - 0xa84], eax
mov dword [ebp - 0xa9c], esi
cmp ecx, 0xffffffff
je 0x100ff2de
cmp esi, ecx
jb 0x100ff2de
test edx, edx
je 0x100ff2de
lea eax, [ebp - 0xaec]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0xa88]
push eax
lea eax, [ebp - 0x804]
push eax
mov eax, esi
sub eax, ecx
push eax
push edx
call fcn.10023d70
mov edi, eax
jmp 0x100ff438
cmp dword [ebp - 0xaa8], 0
mov edi, 0x103
mov dword [ebp - 0xaa4], 0xffffffff
je 0x100ff3a1
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x100ff310
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x3d
call fcn.10003680
add esp, 4
test eax, eax
je 0x100ff349
lea ecx, [ebp - 0xaec]
push ecx
push 0
push 0
push 0
lea ecx, [ebp - 0xa88]
push ecx
lea ecx, [ebp - 0x804]
push ecx
push dword [ebp - 0xa9c]
push dword [ebp - 0xaa8]
call eax
jmp 0x100ff376
lea eax, [ebp - 0xaec]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0xa88]
push eax
lea eax, [ebp - 0x804]
push eax
push dword [ebp - 0xa9c]
push dword [ebp - 0xaa8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov edi, eax
test esi, esi
je 0x100ff383
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp edi, 0x103
jne 0x100ff438
mov eax, dword [ebp - 0xa84]
mov edx, dword [ebp - 0xaac]
mov esi, dword [ebp - 0xa9c]
test edx, edx
je 0x100ff438
mov dword [ebp - 0xaa4], esi
mov dword [ebp - 0xa88], eax
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x100ff3cb
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x3d
call fcn.10003680
add esp, 4
test eax, eax
je 0x100ff401
lea ecx, [ebp - 0xaec]
push ecx
push 0
push 0
push 0
lea ecx, [ebp - 0xa88]
push ecx
lea ecx, [ebp - 0x804]
push ecx
mov ecx, dword [ebp - 0xaac]
push 0
push ecx
call eax
jmp 0x100ff42b
mov ecx, dword [ebp - 0xaac]
lea eax, [ebp - 0xaec]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0xa88]
push eax
lea eax, [ebp - 0x804]
push eax
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov edi, eax
test esi, esi
je 0x100ff438
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
jne 0x10100080
lea ecx, [ebp - 0xae4]
mov dword [ebp - 0xae4], edi
mov dword [ebp - 0xae0], edi
mov dword [ebp - 0xadc], 0xffffffff
call fcn.10008220
mov eax, dword [ebp - 0xaac]
mov esi, 2
mov edi, esi
test eax, eax
je 0x100ff490
push dword [ebp - 0xaa0]
lea ecx, [ebp - 0x804]
push ecx
push eax
lea eax, [ebp - 0xae4]
push eax
mov ecx, eax
call fcn.1000a260
mov esi, eax
mov eax, dword [ebp - 0xaa8]
test eax, eax
je 0x100ff4bc
push dword [ebp - 0xaa0]
lea ecx, [ebp - 0x804]
push ecx
push eax
lea eax, [ebp - 0xae0]
push eax
lea ecx, [ebp - 0xae4]
call fcn.1000a260
mov edi, eax
test esi, esi
je 0x100ff4c8
test edi, edi
jne 0x10100055
push 0x102145f0
lea eax, [ebp - 0xae4]
push eax
lea eax, [ebp - 0xab4]
push eax
call fcn.10060900
mov edi, dword [ebp - 0xab4]
add esp, 0xc
cmp dword [edi - 0xc], 0
je 0x1010003e
push str.SOFTWAREMicrosoftInternet_ExplorerSearchScopes_
lea ecx, [ebp - 0xab0]
call fcn.10002490
lea ecx, [ebp - 0x804]
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100ff510
mov esi, dword [ebp - 0xab0]
lea eax, [ebp - 0x804]
mov dword [ebp - 0xa94], eax
sub ecx, edx
sub eax, esi
sar ecx, 1
sar eax, 1
mov dword [ebp - 0xa80], eax
mov eax, dword [esi - 0xc]
mov dword [ebp - 0xa90], eax
lea eax, [ebp - 0x804]
push ecx
push eax
call fcn.101e6fd0
mov edx, dword [ebp - 0xa90]
mov ecx, 1
sub ecx, dword [esi - 4]
add edx, eax
mov dword [ebp - 0xa84], eax
add esp, 8
mov eax, dword [esi - 8]
sub eax, edx
or eax, ecx
jge 0x100ff585
push edx
lea ecx, [ebp - 0xab0]
call fcn.10003310
mov esi, dword [ebp - 0xab0]
mov eax, dword [ebp - 0xa80]
mov ecx, dword [ebp - 0xa90]
cmp eax, ecx
ja 0x100ff59e
lea eax, [esi + eax*2]
mov dword [ebp - 0xa94], eax
mov eax, dword [ebp - 0xa84]
add eax, eax
push eax
push dword [ebp - 0xa94]
push eax
lea eax, [esi + ecx*2]
push eax
call fcn.10004510
mov eax, dword [ebp - 0xa90]
lea edx, [ebp - 0xaf0]
add eax, dword [ebp - 0xa84]
xor ecx, ecx
mov dword [esi - 0xc], eax
add esp, 0x10
mov word [esi + eax*2], cx
mov ecx, dword [ebp - 0xa8c]
push edx
mov eax, dword [ecx]
call dword [eax + 0x1c]
push 0x102145f0
push esi
push dword [ebp - 0xa98]
mov eax, dword [eax]
mov dword [ebp - 0xa80], eax
lea eax, [ebp - 0x854]
push eax
call fcn.1001baf0
mov edx, dword [ebp - 0xa80]
add esp, 0x10
mov dword [ebp - 0xa84], eax
mov ecx, edx
xor eax, eax
mov dword [ebp - 0x83c], 1
mov word [ebp - 0x834], ax
mov dword [ebp - 0x838], 0
lea eax, [ecx + 2]
mov dword [ebp - 0x824], 0
mov dword [ebp - 0x820], 7
mov dword [ebp - 0xa80], eax
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100ff650
sub ecx, dword [ebp - 0xa80]
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x834]
call fcn.100070c0
push dword [ebp - 0xa84]
lea ecx, [ebp - 0x81c]
call fcn.10005170
mov edx, dword [ebp - 0xaf0]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100ff69e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x840]
cmp edx, 8
jb 0x100ff6de
mov ecx, dword [ebp - 0x854]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100ff6d4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x101000be
push edx
push ecx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 8
push 0
lea ecx, [ebp - 0xa7c]
call fcn.1005b320
push 0
lea eax, [ebp - 0xa84]
mov dword [ebp - 0xa84], 3
push eax
push edi
lea eax, [ebp - 0x83c]
push eax
push 0
push 0x1025adb8
call fcn.100a7350
add esp, 0x18
cmp dword [ebp - 0xa84], 3
jne 0x100ffb3f
push 0x20019
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0xb48], 0
push 0x102145f0
mov dword [ebp - 0xb44], 0
mov dword [ebp - 0xb40], 0
call fcn.10002490
push ecx
lea eax, [esi - 0x10]
mov dword [ebp - 0xa80], esp
push eax
call fcn.10002a60
mov ecx, dword [ebp - 0xa80]
add esp, 4
add eax, 0x10
push dword [ebp - 0xa98]
mov dword [ecx], eax
lea eax, [ebp - 0xb48]
push eax
lea eax, [ebp - 0xaf4]
push eax
call fcn.100da240
mov edx, dword [ebp - 0xaf4]
add esp, 0x1c
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100ff7ab
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.10002d70
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
add eax, 0x10
lea ecx, [ebp - 0xb3c]
push 0x10202940
mov dword [ebp - 0xac8], eax
call fcn.10002490
push eax
lea eax, [ebp - 0xb58]
push 0x281a
push eax
call fcn.100053d0
add esp, 0xc
lea ecx, [ebp - 0xb64]
mov eax, dword [eax]
push 0x2807
mov dword [ebp - 0xa80], eax
call fcn.10002490
push 0x10202940
lea ecx, [ebp - 0xb68]
mov eax, dword [eax]
mov dword [ebp - 0xa84], eax
call fcn.10002490
push eax
lea eax, [ebp - 0xb6c]
push 0x9cb0
push eax
call fcn.100053d0
add esp, 0xc
lea ecx, [ebp - 0xb0c]
push eax
lea eax, [ebp - 0xab4]
push eax
push 0x10202940
call fcn.10002490
push eax
lea eax, [ebp - 0xb08]
push 0x9c55
push eax
call fcn.100053d0
add esp, 0xc
push eax
lea eax, [ebp - 0xb04]
push eax
call fcn.10007e90
add esp, 0xc
push eax
lea eax, [ebp - 0xb00]
push eax
call fcn.10007e90
add esp, 0xc
lea ecx, [ebp - 0xafc]
mov eax, dword [eax]
push 0x10202940
mov dword [ebp - 0xa94], eax
call fcn.10002490
push eax
lea eax, [ebp - 0xaf8]
push 0x9c57
push eax
call fcn.100053d0
add esp, 0xc
mov eax, dword [eax]
push 1
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0xa90], eax
push 0x10202940
call fcn.10002490
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push ecx
mov ecx, esp
push 0x10202940
call fcn.10002490
push ecx
mov ecx, esp
push 0x10202940
call fcn.10002490
push ecx
mov ecx, esp
push 0x10202940
call fcn.10002490
mov ecx, dword [ebp - 0xa8c]
lea eax, [ebp - 0xb48]
push 0
push 0xffffffffffffffff
push 2
push eax
push 0
push 1
push dword [ebp - 0xa80]
push dword [ebp - 0xa84]
push dword [ebp - 0xa94]
push dword [ebp - 0xa90]
call fcn.100cd930
mov edx, dword [ebp - 0xaf8]
mov dword [ebp - 0xad4], eax
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100ff941
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xafc]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100ff95e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xb00]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100ff97b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xb04]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100ff998
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xb08]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100ff9b5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xb0c]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100ff9d2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xb6c]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100ff9ef
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xb68]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100ffa0c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xb64]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100ffa29
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xb58]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100ffa46
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xb3c]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100ffa63
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0xa98]
lea ecx, [ebp - 0x804]
mov dword [ebp - 0xad0], eax
lea edx, [ecx + 2]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xacc], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100ffa81
sub ecx, edx
lea eax, [ebp - 0x804]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0xac8]
call fcn.10003740
mov eax, dword [ebp - 0xa8c]
mov ecx, dword [eax + 0xc4]
mov dword [ebp - 0xa80], ecx
cmp dword [eax + 0xc8], ecx
je 0x100ffb04
mov eax, dword [ebp - 0xad4]
mov dword [ecx], eax
mov eax, dword [ebp - 0xad0]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0xacc]
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0xac8]
add eax, 0xfffffff0
push eax
call fcn.10002a60
mov ecx, dword [ebp - 0xa80]
add eax, 0x10
add esp, 4
mov dword [ecx + 0xc], eax
mov eax, dword [ebp - 0xa8c]
add dword [eax + 0xc4], 0x10
jmp 0x100ffb17
lea edx, [ebp - 0xad4]
push edx
push ecx
lea ecx, [eax + 0xc0]
call fcn.100f9b10
mov edx, dword [ebp - 0xac8]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100ffb34
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0xb48]
jmp 0x100fff5d
jle 0x100fff62
push 0x20019
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0xb54], 0
push 0x102145f0
mov dword [ebp - 0xb50], 0
mov dword [ebp - 0xb4c], 0
call fcn.10002490
push ecx
lea eax, [esi - 0x10]
mov dword [ebp - 0xa80], esp
push eax
call fcn.10002a60
mov ecx, dword [ebp - 0xa80]
add esp, 4
add eax, 0x10
push dword [ebp - 0xa98]
mov dword [ecx], eax
lea eax, [ebp - 0xb54]
push eax
lea eax, [ebp - 0xb60]
push eax
call fcn.100da240
mov edx, dword [ebp - 0xb60]
add esp, 0x1c
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100ffbce
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.10002d70
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
add eax, 0x10
lea ecx, [ebp - 0xb34]
push 0x10202940
mov dword [ebp - 0xab8], eax
call fcn.10002490
push eax
lea eax, [ebp - 0xb30]
push 0x281a
push eax
call fcn.100053d0
add esp, 0xc
lea ecx, [ebp - 0xb2c]
mov eax, dword [eax]
push 0x2807
mov dword [ebp - 0xa80], eax
call fcn.10002490
push 0x10202940
lea ecx, [ebp - 0xb28]
mov eax, dword [eax]
mov dword [ebp - 0xa84], eax
call fcn.10002490
push eax
lea eax, [ebp - 0xb24]
push 0x9cb0
push eax
call fcn.100053d0
add esp, 0xc
lea ecx, [ebp - 0xb20]
push eax
lea eax, [ebp - 0xab4]
push eax
push 0x10202940
call fcn.10002490
push eax
lea eax, [ebp - 0xb1c]
push 0x9c55
push eax
call fcn.100053d0
add esp, 0xc
push eax
lea eax, [ebp - 0xb18]
push eax
call fcn.10007e90
add esp, 0xc
push eax
lea eax, [ebp - 0xb14]
push eax
call fcn.10007e90
add esp, 0xc
lea ecx, [ebp - 0xb10]
mov eax, dword [eax]
push 0x10202940
mov dword [ebp - 0xa94], eax
call fcn.10002490
push eax
lea eax, [ebp - 0xb5c]
push 0x9c56
push eax
call fcn.100053d0
add esp, 0xc
mov eax, dword [eax]
push 1
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0xa90], eax
push 0x10202940
call fcn.10002490
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push ecx
mov ecx, esp
push 0x10202940
call fcn.10002490
push ecx
mov ecx, esp
push 0x10202940
call fcn.10002490
push ecx
mov ecx, esp
push 0x10202940
call fcn.10002490
mov ecx, dword [ebp - 0xa8c]
lea eax, [ebp - 0xb54]
push 0
push 0xffffffffffffffff
push 4
push eax
push 0
push 1
push dword [ebp - 0xa80]
push dword [ebp - 0xa84]
push dword [ebp - 0xa94]
push dword [ebp - 0xa90]
call fcn.100cd930
mov edx, dword [ebp - 0xb5c]
mov dword [ebp - 0xac4], eax
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100ffd64
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xb10]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100ffd81
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xb14]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100ffd9e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xb18]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100ffdbb
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xb1c]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100ffdd8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xb20]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100ffdf5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xb24]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100ffe12
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xb28]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100ffe2f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xb2c]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100ffe4c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xb30]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100ffe69
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xb34]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100ffe86
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0xa98]
lea ecx, [ebp - 0x804]
mov dword [ebp - 0xac0], eax
lea edx, [ecx + 2]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xabc], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100ffea4
sub ecx, edx
lea eax, [ebp - 0x804]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0xab8]
call fcn.10003740
mov eax, dword [ebp - 0xa8c]
mov ecx, dword [eax + 0xc4]
mov dword [ebp - 0xa80], ecx
cmp dword [eax + 0xc8], ecx
je 0x100fff27
mov eax, dword [ebp - 0xac4]
mov dword [ecx], eax
mov eax, dword [ebp - 0xac0]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0xabc]
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0xab8]
add eax, 0xfffffff0
push eax
call fcn.10002a60
mov ecx, dword [ebp - 0xa80]
add eax, 0x10
add esp, 4
mov dword [ecx + 0xc], eax
mov eax, dword [ebp - 0xa8c]
add dword [eax + 0xc4], 0x10
jmp 0x100fff3a
lea edx, [ebp - 0xac4]
push edx
push ecx
lea ecx, [eax + 0xc0]
call fcn.100f9b10
mov edx, dword [ebp - 0xab8]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100fff57
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0xb54]
call fcn.1002a3c0
lea ecx, [ebp - 0xa7c]
call fcn.1005b6b0
mov edx, dword [ebp - 0x808]
cmp edx, 8
jb 0x100fffad
mov ecx, dword [ebp - 0x81c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100fffa3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x101000be
push edx
push ecx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 8
mov edx, dword [ebp - 0x820]
xor eax, eax
mov dword [ebp - 0x80c], 0
mov dword [ebp - 0x808], 7
mov word [ebp - 0x81c], ax
cmp edx, 8
jb 0x1010000a
mov ecx, dword [ebp - 0x834]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10100000
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x101000be
push edx
push ecx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 8
xor eax, eax
mov dword [ebp - 0x824], 0
mov word [ebp - 0x834], ax
add esi, 0xfffffff0
mov dword [ebp - 0x820], 7
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x1010003e
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 0xfffffff0
mov eax, ebx
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x10100055
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0xae4]
call fcn.10008220
mov esi, dword [ebp - 0xa9c]
inc esi
xor eax, eax
mov word [ebp - 0x804], ax
mov eax, 0x400
mov dword [ebp - 0xa88], eax
jmp 0x100ff28c
mov eax, dword [ebp - 0xb38]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x1010009b
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
lea ecx, [ebp - 0xaac]
call fcn.10008220
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101f99c6
mov esp, ebp
pop ebp
ret 8
call fcn.101e6c40
int3