Function at 0x10016dc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100cc866
push eax
mov dword fs:[0], esp
sub esp, 0x27c
push ebx
mov ebx, dword [esp + 0x290]
push ebp
push esi
push edi
mov esi, ecx
push ebx
call fcn.10005730
test al, al
je 0x10016df9
xor al, al
jmp 0x10017451
mov ecx, esi
call fcn.10004a20
mov cx, word [esi + 0x16]
mov dword [esp + 0x30], eax
cmp cx, 8
ja 0x10016e19
test eax, eax
jne 0x10016e19
xor al, al
jmp 0x10017451
mov eax, dword [esi + 0xc]
and ecx, 0xffff
add eax, 0x1f
mov ebp, ecx
cdq
and edx, 0x1f
mov ecx, esi
add eax, edx
sar eax, 5
shl eax, 2
mov dword [esp + 0x44], eax
imul eax, dword [esi + 0x10]
mov dword [esp + 0x3c], eax
mov eax, dword [esi + 0x1c]
mov dword [esp + 0x18], eax
call fcn.10009f10
test al, al
je 0x10016e6b
mov eax, dword [esi + 0x28]
test eax, eax
jne 0x10016e6b
mov eax, dword [esi + 0xc]
mov ebp, 0x20
imul eax, dword [esi + 0x10]
shl eax, 2
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x2a4]
mov ecx, 1
cmp eax, ecx
jge 0x10016e7d
mov eax, ecx
mov dl, byte [esp + 0x2a0]
mov word [esp + 0x34], 0
test dl, dl
mov word [esp + 0x36], cx
mov word [esp + 0x38], ax
jne 0x10016ea5
shl eax, 4
add eax, 6
mov dword [esi + 0x1fc], eax
mov edx, dword [esi + 0x28]
mov eax, dword [esp + 0x18]
push ecx
mov word [esp + 0x2a], bp
lea edi, [eax + edx*4 + 0x28]
mov dl, byte [esi + 0xc]
mov eax, dword [esp + 0x40]
mov byte [esp + 0x24], dl
mov dl, byte [esi + 0x28]
add edi, eax
mov al, byte [esi + 0x10]
mov byte [esp + 0x26], dl
mov edx, dword [esi + 0x1fc]
mov byte [esp + 0x25], al
mov dword [esp + 0x30], edx
mov edx, dword [esi + 0xc]
mov dword [esp + 0x50], edx
mov edx, dword [esi + 0x10]
mov word [esp + 0x5a], bp
mov ebp, dword [esp + 0x1c]
push ecx
xor eax, eax
shl edx, 1
mov word [esp + 0x5c], cx
push ecx
push esi
lea ecx, [esp + 0xa0]
mov byte [esp + 0x33], 0
mov word [esp + 0x34], ax
mov dword [esp + 0x38], edi
mov dword [esp + 0x58], 0x28
mov dword [esp + 0x60], edx
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], ebp
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], eax
call fcn.100037a0
push 0
push 0
lea ecx, [esp + 0x78]
mov dword [esp + 0x29c], 0
call fcn.10003180
mov ecx, dword [esi + 0xc]
mov eax, 0xff
cmp ecx, eax
mov byte [esp + 0x294], 1
jg 0x10016f69
cmp dword [esi + 0x10], eax
jle 0x10016f9e
lea ecx, [esp + 0x70]
mov byte [esp + 0x21], 0
mov byte [esp + 0x20], 0
call fcn.10003230
lea eax, [esp + 0x70]
push 4
push eax
lea ecx, [esp + 0x98]
call fcn.10005880
lea ecx, [esp + 0x70]
call fcn.10003400
mov edi, eax
mov dword [esp + 0x28], edi
mov al, byte [esp + 0x2a0]
test al, al
jne 0x10017117
mov ecx, dword [esp + 0x36]
push ecx
mov ecx, esi
call fcn.10004840
mov edx, dword [esp + 0x38]
mov ecx, esi
push edx
mov word [esp + 0x3a], ax
call fcn.10004840
push 1
lea ecx, [esp + 0x38]
mov word [esp + 0x3c], ax
mov eax, dword [ebx]
push 6
push ecx
mov ecx, ebx
call dword [eax + 0xc]
mov edx, dword [esp + 0x36]
mov ecx, esi
push edx
call fcn.10004840
mov word [esp + 0x36], ax
mov eax, dword [esp + 0x38]
push eax
mov ecx, esi
call fcn.10004840
mov word [esp + 0x38], ax
mov eax, dword [esp + 0x2a4]
test eax, eax
jne 0x10017410
mov edx, dword [esp + 0x24]
mov ecx, esi
push edx
call fcn.10004840
mov word [esp + 0x24], ax
mov eax, dword [esp + 0x26]
push eax
mov ecx, esi
call fcn.10004840
mov ecx, dword [esp + 0x28]
mov word [esp + 0x26], ax
push ecx
mov ecx, esi
call fcn.10004870
mov edx, dword [esp + 0x2c]
mov ecx, esi
push edx
mov dword [esp + 0x2c], eax
call fcn.10004870
push 1
lea ecx, [esp + 0x24]
mov dword [esp + 0x30], eax
mov eax, dword [ebx]
push 0x10
push ecx
mov ecx, ebx
call dword [eax + 0xc]
mov edx, dword [esp + 0x24]
mov ecx, esi
push edx
call fcn.10004840
mov word [esp + 0x24], ax
mov eax, dword [esp + 0x26]
push eax
mov ecx, esi
call fcn.10004840
mov ecx, dword [esp + 0x28]
mov word [esp + 0x26], ax
push ecx
mov ecx, esi
call fcn.10004870
mov edx, dword [esp + 0x2c]
mov ecx, esi
push edx
mov dword [esp + 0x2c], eax
call fcn.10004870
mov ecx, dword [esi + 0x1fc]
mov dword [esp + 0x2c], eax
mov al, byte [esp + 0x2a0]
add ecx, edi
test al, al
mov dword [esi + 0x1fc], ecx
je 0x100170dd
mov eax, dword [esp + 0x2a4]
mov ecx, dword [esi + 0x160]
cmp eax, ecx
jl 0x100170ec
mov al, byte [esp + 0x2a0]
test al, al
jne 0x10017410
mov eax, dword [esp + 0x2a4]
test eax, eax
jne 0x10017410
mov al, byte [esp + 0x20]
test al, al
jne 0x1001712e
mov al, byte [esp + 0x21]
test al, al
jne 0x1001712e
mov esi, dword [ebx]
push 1
push edi
push 0
lea ecx, [esp + 0x7c]
call fcn.10003270
push eax
mov ecx, ebx
call dword [esi + 0xc]
jmp 0x10017410
mov ecx, dword [esp + 0x2a4]
mov eax, dword [esi + 0x160]
cmp ecx, eax
je 0x10017010
jmp 0x100170bd
lea ecx, [esp + 0x48]
push ecx
mov ecx, esi
call fcn.100048b0
mov edx, dword [ebx]
push 1
lea eax, [esp + 0x4c]
push 0x28
push eax
mov ecx, ebx
call dword [edx + 0xc]
lea ecx, [esp + 0x48]
push ecx
mov ecx, esi
call fcn.100048b0
mov edx, dword [esi + 0x14c]
mov ecx, esi
test edx, edx
lea edx, [esp + 0x40]
push edx
setge byte [esp + 0x17]
call fcn.10004070
mov edi, dword [esp + 0x30]
test edi, edi
je 0x100171c1
mov al, byte [esp + 0x13]
test al, al
je 0x10017195
mov al, byte [esi + 0x14c]
push 0
push 0
push 0
push 0
push eax
mov ecx, esi
call fcn.10004980
mov eax, dword [esi + 0x28]
mov edx, dword [ebx]
shl eax, 2
push 1
push eax
push edi
mov ecx, ebx
call dword [edx + 0xc]
mov al, byte [esp + 0x13]
test al, al
je 0x100171c1
mov ecx, dword [esp + 0x40]
mov dl, byte [esi + 0x14c]
push ecx
push edx
mov ecx, esi
call fcn.100049d0
mov ecx, esi
call fcn.10009f10
test al, al
je 0x10017274
mov eax, dword [esi + 0x28]
test eax, eax
jne 0x10017274
push ebp
call dword [sym.imp.MSVCRT.dll_malloc]
mov edi, eax
mov eax, dword [esi + 0x10]
add esp, 4
mov dword [esp + 0x30], edi
test eax, eax
mov dword [esp + 0x14], 0
jle 0x1001725d
mov eax, dword [esp + 0x14]
mov ecx, esi
push eax
call fcn.10003b10
mov ebp, eax
mov eax, dword [esi + 0xc]
xor ebx, ebx
test eax, eax
jle 0x1001723e
mov cl, byte [ebp]
mov byte [edi], cl
mov dl, byte [ebp + 1]
inc edi
inc ebp
mov ecx, dword [esp + 0x14]
mov byte [edi], dl
mov al, byte [ebp + 1]
inc edi
inc ebp
push ecx
push ebx
mov byte [edi], al
inc edi
mov ecx, esi
inc ebp
call fcn.1000a170
mov byte [edi], al
mov eax, dword [esi + 0xc]
inc edi
inc ebx
cmp ebx, eax
jl 0x10017211
mov eax, dword [esp + 0x14]
mov ecx, dword [esi + 0x10]
inc eax
cmp eax, ecx
mov dword [esp + 0x14], eax
jl 0x100171fa
mov ebx, dword [esp + 0x29c]
mov edi, dword [esp + 0x30]
mov ebp, dword [esp + 0x18]
mov edx, dword [ebx]
push 1
push ebp
push edi
mov ecx, ebx
call dword [edx + 0xc]
push edi
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
jmp 0x10017282
mov ecx, dword [esi + 0x34]
mov eax, dword [ebx]
push 1
push ebp
push ecx
mov ecx, ebx
call dword [eax + 0xc]
mov edx, dword [esp + 0x3c]
push 1
push edx
call dword [sym.imp.MSVCRT.dll_calloc]
mov ebp, eax
add esp, 8
test ebp, ebp
mov dword [esp + 0x30], ebp
jne 0x100172e1
lea ecx, [esp + 0x70]
mov byte [esp + 0x294], al
call fcn.100031b0
lea ecx, [esp + 0x90]
mov dword [esp + 0x294], 0xffffffff
mov dword [esp + 0x90], sym.BuildBG.dll_const_CxImage::vftable
call fcn.100036f0
lea ecx, [esp + 0x90]
call fcn.10003640
xor al, al
jmp 0x10017451
mov ecx, esi
call fcn.1000a220
mov ecx, esi
mov byte [esp + 0x1e], al
call fcn.10009f10
mov byte [esp + 0x1f], al
mov eax, dword [esi + 0x10]
xor edi, edi
test eax, eax
mov dword [esp + 0x18], edi
jle 0x100173f7
mov dword [esp + 0x14], edi
mov eax, dword [esi + 0xc]
xor ebp, ebp
test eax, eax
jle 0x100173d5
mov al, byte [esp + 0x1f]
xor ebx, ebx
test al, al
je 0x10017335
push edi
push ebp
mov ecx, esi
call fcn.1000a170
test al, al
jne 0x10017335
mov ebx, 1
mov al, byte [esp + 0x1e]
test al, al
je 0x1001735c
push 1
push edi
lea eax, [esp + 0x90]
push ebp
push eax
mov ecx, esi
call fcn.10004d90
mov cl, byte [eax + 3]
test cl, cl
jne 0x1001735c
mov ebx, 1
push 0
push edi
lea ecx, [esp + 0x94]
push ebp
push ecx
mov ecx, esi
call fcn.10004c80
mov cl, byte [esp + 0x13]
mov eax, dword [eax]
test cl, cl
je 0x10017384
cmp eax, dword [esp + 0x40]
jne 0x10017384
mov ebx, 1
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x30]
mov edi, ebp
sar edi, 3
add edi, edx
mov edx, ebp
add edi, ecx
and edx, 0x80000007
jns 0x100173a4
dec edx
or edx, 0xfffffff8
inc edx
mov ecx, 7
mov al, 1
sub ecx, edx
mov dl, byte [edi]
shl al, cl
and bl, 1
shl bl, cl
not al
and al, dl
or al, bl
inc ebp
mov byte [edi], al
mov eax, dword [esi + 0xc]
mov edi, dword [esp + 0x18]
cmp ebp, eax
jl 0x10017319
mov ebx, dword [esp + 0x29c]
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x14]
mov eax, dword [esi + 0x10]
inc edi
add edx, ecx
cmp edi, eax
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], edx
jl 0x1001730c
mov ebp, dword [esp + 0x30]
mov eax, dword [esp + 0x3c]
mov edx, dword [ebx]
push 1
push eax
push ebp
mov ecx, ebx
call dword [edx + 0xc]
push ebp
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
lea ecx, [esp + 0x70]
mov byte [esp + 0x294], 0
call fcn.100031b0
lea ecx, [esp + 0x90]
mov dword [esp + 0x294], 0xffffffff
mov dword [esp + 0x90], sym.BuildBG.dll_const_CxImage::vftable
call fcn.100036f0
lea ecx, [esp + 0x90]
call fcn.10003640
mov al, 1
mov ecx, dword [esp + 0x28c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x288
ret 0xc