Function at 0x10071020
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
push 0xffffffffffffffff
push 0x1009c64a
mov eax, dword fs:[0]
push eax
sub esp, 0xa4
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100b8070]
xor eax, esp
push eax
lea eax, [esp + 0xb8]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebx + 0x14]
mov ecx, dword [eax + 0x597c4]
cmp ecx, 2
je 0x1007107c
xor eax, eax
mov dword [ebx + 0x98], eax
mov dword [ebx + 0xa0], eax
mov dword [ebx + 0xa4], eax
jmp 0x100724f6
mov edi, dword [eax + 0x5975c]
mov eax, dword [eax + 0x597c8]
cmp eax, 4
mov dword [esp + 0x3c], edi
jne 0x100710ab
mov ecx, dword [0x100bb2cc]
mov eax, dword [ecx]
mov edx, dword [eax + 0x18]
call edx
mov ecx, dword [0x100bb2cc]
mov eax, dword [ecx]
mov edx, dword [eax + 0x1c]
call edx
mov eax, dword [ebx + 0x14]
push eax
call fcn.1001ad10
push ebx
call fcn.10003bc0
mov edx, dword [edi]
mov eax, dword [edx + 8]
mov ecx, edi
call eax
cmp dword [edi + 0x94], 0
jne 0x100724f1
cmp dword [edi + 0x98], 0
jne 0x100724f1
mov ecx, dword [ebx + 0x14]
cmp dword [ecx + 0x59798], 0
ja 0x10071136
push edi
call fcn.10021900
mov ebx, dword [ebx + 0x14]
lea eax, [ebx + 0x597d0]
lea ebx, [esp + 0x50]
mov dword [esp + 0x50], 2
call fcn.1001d970
mov dword [eax], 0
mov eax, edi
call fcn.100503d0
cmp eax, 0x32
jae 0x100724f1
mov ecx, dword [0x100bb2cc]
mov edx, dword [ecx]
mov eax, dword [edx + 0x94]
push 6
call eax
jmp 0x100724f1
mov eax, ebx
call fcn.100015c0
mov esi, dword [ebx + 0x14]
add esi, 0x59790
cmp dword [esi + 8], 0
mov dword [esp + 0x4c], esi
jne 0x1007115b
push edi
call fcn.10021900
jmp 0x100724f1
push ebx
call fcn.10072510
fld dword [edi + 0x34]
test eax, eax
fstp dword [esp + 0x60]
fld dword [edi + 0x30]
fstp dword [esp + 0x5c]
fld dword [edi + 0x38]
fstp dword [esp + 0x64]
fld dword [edi + 0x3c]
fstp dword [esp + 0x68]
je 0x10071189
push eax
mov eax, ebx
call fcn.10004780
mov eax, esi
call fcn.10004a40
mov esi, eax
mov dword [esp + 0x38], eax
call fcn.1006f5f0
lea ecx, [esp + 0x34]
push ecx
mov ecx, str.Fear
call fcn.10003700
lea edx, [esp + 0x34]
lea ebp, [ebx + 0x68]
push edx
mov ecx, ebp
mov dword [esp + 0xc4], 0
call fcn.100048e0
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x54], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov ecx, ebx
mov dword [esi], eax
call fcn.10001420
mov esi, eax
lea eax, [esp + 0x34]
mov dword [esp + 0xc0], 0xffffffff
call fcn.10001660
test esi, esi
je 0x1007121b
mov esi, dword [esi]
mov eax, dword [esp + 0x38]
call fcn.1006f6d0
test eax, eax
je 0x1007121b
mov eax, dword [esp + 0x38]
push eax
mov eax, ebx
call fcn.10004800
jmp 0x100724f1
lea ecx, [esp + 0x40]
push ecx
mov ecx, str.SoulBurn
call fcn.10003700
lea edx, [esp + 0x40]
push edx
mov ecx, ebp
mov dword [esp + 0xc4], 1
call fcn.100048e0
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x54], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov ecx, ebx
mov dword [esi], eax
call fcn.10001420
mov esi, eax
lea eax, [esp + 0x40]
mov dword [esp + 0x34], esi
mov dword [esp + 0xc0], 0xffffffff
call fcn.10001660
test esi, esi
je 0x100712c5
mov eax, esi
cmp dword [eax + 0x10], 0
jne 0x100712c5
mov ecx, esi
mov esi, dword [ecx]
call fcn.1007e040
test eax, eax
je 0x100712c5
cmp dword [edi + 0x58], 1
jb 0x100712c5
cmp dword [edi + 0x18c], 0
je 0x100712a9
cmp dword [edi + 0x134], 0
jne 0x100712c5
mov esi, dword [esp + 0x34]
mov eax, esi
call fcn.1006e760
mov edx, dword [edi]
mov eax, dword [esi]
mov edx, dword [edx + 0x14]
push eax
mov ecx, edi
call edx
jmp 0x100724f1
lea eax, [esp + 0x44]
push eax
mov ecx, str.SoulBurn
call fcn.10003700
lea ecx, [esp + 0x44]
push ecx
mov ecx, ebp
mov dword [esp + 0xc4], 2
call fcn.100048e0
mov eax, dword [eax]
sub eax, 0x10
call fcn.10001820
add eax, 0x10
mov dword [esp + 0x50], eax
lea eax, [esp + 0x44]
mov byte [esp + 0xc0], 4
call fcn.10001660
cmp dword [esp + 0x34], 0
je 0x10071629
mov edx, dword [esp + 0x34]
mov esi, dword [edx]
mov eax, edi
call fcn.10056f10
test eax, eax
je 0x10071629
cmp dword [edi + 0x18c], 0
je 0x10071350
cmp dword [edi + 0x134], 0
jne 0x10071629
call fcn.1007fb40
test eax, eax
je 0x10071629
mov eax, dword [ebx + 0x14]
cmp dword [eax + 0x28c], 1
jne 0x10071443
lea ecx, [esp + 0x48]
push ecx
mov ecx, str.AllRank
call fcn.10003700
lea edx, [esp + 0x40]
push edx
mov ecx, str.SummonVoidwalker
mov byte [esp + 0xc4], 5
call fcn.10003700
lea eax, [esp + 0x48]
push eax
mov ecx, ebp
mov byte [esp + 0xc4], 6
call fcn.100048e0
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x38], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov dword [esi], eax
lea ecx, [esp + 0x44]
push ecx
mov ecx, ebp
mov byte [esp + 0xc8], 7
call fcn.100048e0
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x5c], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov dword [esi], eax
mov ecx, edi
mov byte [esp + 0xc8], 6
call fcn.10056d40
mov esi, eax
lea eax, [esp + 0x40]
mov dword [esp + 0x34], esi
call fcn.10001660
lea eax, [esp + 0x48]
mov byte [esp + 0xc0], 4
call fcn.10001660
test esi, esi
je 0x10071443
mov eax, esi
call fcn.1006e760
mov esi, dword [esi]
call fcn.1007e040
test eax, eax
je 0x10071443
call fcn.10023ff0
mov eax, dword [esp + 0x34]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov edx, dword [edi]
push ecx
push eax
mov eax, dword [edx + 0x18]
mov ecx, edi
call eax
push 0x320
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebx + 0x14]
cmp dword [ecx + 0x28c], 2
jne 0x10071536
lea edx, [esp + 0x40]
push edx
mov ecx, str.AllRank
call fcn.10003700
lea eax, [esp + 0x48]
push eax
mov ecx, str.SummonFelguard
mov byte [esp + 0xc4], 8
call fcn.10003700
lea ecx, [esp + 0x40]
push ecx
mov ecx, ebp
mov byte [esp + 0xc4], 9
call fcn.100048e0
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x58], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov dword [esi], eax
lea edx, [esp + 0x4c]
push edx
mov ecx, ebp
mov byte [esp + 0xc8], 0xa
call fcn.100048e0
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x3c], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov dword [esi], eax
mov ecx, edi
mov byte [esp + 0xc8], 9
call fcn.10056d40
mov esi, eax
lea eax, [esp + 0x48]
mov dword [esp + 0x34], esi
call fcn.10001660
lea eax, [esp + 0x40]
mov byte [esp + 0xc0], 4
call fcn.10001660
test esi, esi
je 0x10071536
mov eax, esi
call fcn.1006e760
mov esi, dword [esi]
call fcn.1007e040
test eax, eax
je 0x10071536
call fcn.10023ff0
mov eax, dword [esp + 0x34]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov edx, dword [edi]
push ecx
push eax
mov eax, dword [edx + 0x18]
mov ecx, edi
call eax
push 0x320
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebx + 0x14]
cmp dword [ecx + 0x28c], 0
jne 0x10071629
lea edx, [esp + 0x40]
push edx
mov ecx, str.AllRank
call fcn.10003700
lea eax, [esp + 0x48]
push eax
mov ecx, str.SummonImp
mov byte [esp + 0xc4], 0xb
call fcn.10003700
lea ecx, [esp + 0x40]
push ecx
mov ecx, ebp
mov byte [esp + 0xc4], 0xc
call fcn.100048e0
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x58], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov dword [esi], eax
lea edx, [esp + 0x4c]
push edx
mov ecx, ebp
mov byte [esp + 0xc8], 0xd
call fcn.100048e0
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x3c], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov dword [esi], eax
mov ecx, edi
mov byte [esp + 0xc8], 0xc
call fcn.10056d40
mov esi, eax
lea eax, [esp + 0x48]
mov dword [esp + 0x34], esi
call fcn.10001660
lea eax, [esp + 0x40]
mov byte [esp + 0xc0], 4
call fcn.10001660
test esi, esi
je 0x10071629
mov eax, esi
call fcn.1006e760
mov esi, dword [esi]
call fcn.1007e040
test eax, eax
je 0x10071629
call fcn.10023ff0
mov ecx, dword [esp + 0x34]
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
mov edx, dword [edi]
push eax
mov eax, dword [edx + 0x18]
push ecx
mov ecx, edi
call eax
push 0x320
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0x38]
fld dword [eax + 0xc]
lea ecx, [esp + 0x70]
fstp dword [esp + 0x74]
fld dword [eax + 8]
fstp dword [esp + 0x70]
fld dword [eax + 0x10]
fstp dword [esp + 0x78]
fld dword [eax + 0x14]
lea eax, [esp + 0x5c]
fstp dword [esp + 0x7c]
call fcn.10003a50
fst qword [esp + 0x54]
fcomp qword [0x100a9868]
fnstsw ax
test ah, 5
jp 0x100716fc
fld dword [esp + 0x70]
sub esp, 0x10
fsub dword [esp + 0x6c]
fstp qword [esp + 8]
fld dword [esp + 0x84]
fsub dword [esp + 0x70]
fstp qword [esp]
call fcn.1006ddc0
fstp dword [esp + 0x58]
add esp, 4
fld dword [0x100a982c]
fstp dword [esp + 8]
fld dword [esp + 0x74]
fstp dword [esp + 4]
fld dword [esp + 0x54]
fstp dword [esp]
call fcn.100218b0
add esp, 0xc
test eax, eax
jne 0x100716c6
fld dword [esp + 0x48]
push ecx
fstp dword [esp]
call fcn.10021920
mov edi, dword [esp + 0x38]
call fcn.10055280
test eax, eax
jne 0x100716fc
mov eax, edi
call fcn.10003b20
cmp eax, 0x64
jne 0x100724e8
mov ecx, dword [ebx + 0x14]
push ecx
mov eax, edi
call fcn.1001b910
mov eax, dword [esp + 0x4c]
call fcn.10004a60
jmp 0x100724e8
call fcn.1007ec20
test eax, eax
je 0x10071716
mov al, 0
mov ecx, dword [0x100bb500]
mov byte [ecx], al
add dword [ebx + 0x9c], 1
cmp dword [ebx + 0x9c], 1
jle 0x1007172e
call fcn.10024010
mov dword [ebx + 0x9c], 0
push str.target
call fcn.1007e0e0
mov esi, dword [esp + 0x3c]
add esp, 4
push edx
push eax
mov eax, esi
call fcn.1006f910
test eax, eax
mov edi, dword [esp + 0x3c]
je 0x10071779
mov ecx, dword [edi + 0x170]
mov eax, dword [edi + 0x16c]
push ecx
push eax
mov eax, esi
call fcn.10038030
test eax, eax
je 0x10071779
mov ecx, dword [0x100bb2cc]
mov edx, dword [ecx]
mov eax, dword [edx + 0x8c]
call eax
fld dword [edi + 0x34]
lea esi, [ebx + 0x24]
fstp dword [esi + 4]
mov edx, 0x211
fld dword [edi + 0x30]
fstp dword [esi]
fld dword [edi + 0x38]
fstp dword [esi + 8]
mov dword [ebx + 0x34], edx
fld qword [0x100a9950]
fld qword [esp + 0x54]
fcom st(1)
fnstsw ax
fstp st(1)
test ah, 0x41
jne 0x100717e0
fld dword [esp + 0x74]
mov dword [ebx + 0x34], edx
fld dword [esp + 0x60]
fsubr st(1)
fld qword [0x100a9968]
fmul st(1), st(0)
fxch st(1)
fdiv st(3)
fsubp st(2)
fxch st(1)
fstp dword [ebx + 0x28]
fld dword [esp + 0x70]
fld dword [esp + 0x5c]
fsubr st(1)
fmulp st(2)
fxch st(1)
fdivrp st(2)
fsubrp st(1)
fstp dword [esi]
jmp 0x100717e2
fstp st(0)
mov edi, dword [esp + 0x3c]
mov eax, esi
mov ecx, 2
mov esi, edi
call fcn.10056b10
cmp eax, 2
jne 0x1007180f
mov ecx, dword [ebx + 0x14]
mov eax, dword [esp + 0x38]
push ecx
call fcn.1001b910
mov eax, dword [esp + 0x4c]
call fcn.10004a60
fld dword [esp + 0x70]
sub esp, 0x10
fsub dword [esp + 0x6c]
fstp qword [esp + 8]
fld dword [esp + 0x84]
fsub dword [esp + 0x70]
fstp qword [esp]
call fcn.1006ddc0
fstp dword [esp + 0x5c]
add esp, 4
fld dword [0x100a982c]
fstp dword [esp + 8]
fld dword [esp + 0x74]
fstp dword [esp + 4]
fld dword [esp + 0x58]
fstp dword [esp]
call fcn.100218b0
add esp, 0xc
test eax, eax
jne 0x1007186a
fld dword [esp + 0x4c]
push ecx
fstp dword [esp]
call fcn.10021920
fld qword [0x100a9950]
fcomp qword [esp + 0x54]
fnstsw ax
test ah, 1
jne 0x100723c4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebx + 0x3c]
cmp eax, 0x2bc
jbe 0x100723c4
cmp dword [edi + 0x94], 0
jne 0x100723c4
cmp dword [edi + 0x98], 0
jne 0x100723c4
lea edx, [esp + 0x4c]
push edx
mov ecx, str.HowlOfTerror
call fcn.10003700
lea eax, [esp + 0x4c]
push eax
mov ecx, ebp
mov byte [esp + 0xc4], 0xe
call fcn.100048e0
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x58], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov ecx, ebx
mov dword [esi], eax
call fcn.10001420
mov esi, eax
lea eax, [esp + 0x4c]
mov dword [esp + 0x34], esi
mov byte [esp + 0xc0], 4
call fcn.10001660
test esi, esi
je 0x1007193f
mov ecx, esi
mov esi, dword [ecx]
call fcn.1007e040
test eax, eax
je 0x1007193f
mov eax, edi
call fcn.10003b60
cmp eax, 0x1e
jae 0x1007193f
push 5
mov eax, ebx
call fcn.10004680
cmp eax, 5
jbe 0x1007193f
mov eax, dword [esp + 0x34]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
push ecx
push eax
jmp 0x100723b2
lea eax, [esp + 0x4c]
push eax
mov ecx, str.DeathCoil
call fcn.10003700
lea ecx, [esp + 0x4c]
push ecx
mov ecx, ebp
mov byte [esp + 0xc4], 0xf
call fcn.100048e0
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x58], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov ecx, ebx
mov dword [esi], eax
call fcn.10001420
mov esi, eax
lea eax, [esp + 0x4c]
mov dword [esp + 0x34], esi
mov byte [esp + 0xc0], 4
call fcn.10001660
test esi, esi
je 0x100719d5
mov eax, esi
call fcn.1006e760
cmp dword [esi + 0x10], 0
jne 0x100719d5
mov edx, esi
mov esi, dword [edx]
call fcn.1007e040
test eax, eax
je 0x100719d5
mov eax, edi
call fcn.10003b60
cmp eax, 0x3c
jae 0x100719d5
mov ecx, dword [esp + 0x34]
mov edx, dword [ecx]
mov eax, dword [edi]
mov eax, dword [eax + 0x14]
push edx
mov ecx, edi
call eax
jmp 0x100723bb
mov eax, edi
call fcn.10003b60
cmp eax, 0x3c
jae 0x10071a8c
push 5
mov eax, ebx
call fcn.10004680
cmp eax, 3
jbe 0x10071a8c
lea ecx, [esp + 0x4c]
push ecx
mov ecx, str.Soulshatter
call fcn.10003700
lea edx, [esp + 0x4c]
push edx
mov ecx, ebp
mov byte [esp + 0xc4], 0x10
call fcn.100048e0
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x58], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov ecx, ebx
mov dword [esi], eax
call fcn.10001420
mov esi, eax
lea eax, [esp + 0x4c]
mov dword [esp + 0x34], esi
mov byte [esp + 0xc0], 4
call fcn.10001660
test esi, esi
je 0x10071a8c
mov eax, esi
mov esi, dword [eax]
call fcn.1007e040
test eax, eax
je 0x10071a8c
mov eax, edi
call fcn.10003b60
cmp eax, 0x14
jae 0x10071a8c
mov eax, edi
call fcn.1002ec10
cmp eax, 0xa
jbe 0x10071a8c
mov eax, dword [esp + 0x34]
mov ecx, dword [eax]
mov edx, dword [edi]
mov edx, dword [edx + 0x14]
push ecx
mov ecx, edi
call edx
jmp 0x100723bb
lea eax, [esp + 0x4c]
push eax
mov ecx, str.SummonDoomguard
call fcn.10003700
lea ecx, [esp + 0x4c]
push ecx
mov ecx, ebp
mov byte [esp + 0xc4], 0x11
call fcn.100048e0
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x58], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov ecx, ebx
mov dword [esi], eax
call fcn.10001420
mov esi, eax
lea eax, [esp + 0x4c]
mov dword [esp + 0x34], esi
mov byte [esp + 0xc0], 4
call fcn.10001660
test esi, esi
je 0x10071b1f
mov edx, esi
mov esi, dword [edx]
call fcn.1007e040
test eax, eax
je 0x10071b1f
mov eax, dword [esp + 0x34]
cmp dword [eax + 0x10], 0
jne 0x10071b1f
mov eax, edi
call fcn.1002ec10
cmp eax, 0x14
jbe 0x10071b1f
mov eax, dword [esp + 0x34]
mov ecx, dword [eax]
mov edx, dword [edi]
mov edx, dword [edx + 0x14]
push ecx
mov ecx, edi
call edx
jmp 0x100723bb
lea eax, [esp + 0x4c]
push eax
mov ecx, str.DrainLife
call fcn.10003700
lea ecx, [esp + 0x4c]
push ecx
mov ecx, ebp
mov byte [esp + 0xc4], 0x12
call fcn.100048e0
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x58], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov ecx, ebx
mov dword [esi], eax
call fcn.10001420
mov esi, eax
lea eax, [esp + 0x4c]
mov dword [esp + 0x34], esi
mov byte [esp + 0xc0], 4
call fcn.10001660
test esi, esi
je 0x10071bb4
mov edx, esi
mov esi, dword [edx]
call fcn.1007e040
test eax, eax
je 0x10071bb4
mov eax, edi
call fcn.10003b60
cmp eax, 0x3c
jae 0x10071bb4
mov eax, edi
call fcn.1002ec10
cmp eax, 0xa
jbe 0x10071bb4
mov ecx, dword [esp + 0x34]
mov edx, dword [ecx]
mov eax, dword [edi]
mov eax, dword [eax + 0x14]
push edx
mov ecx, edi
call eax
jmp 0x100723bb
lea ecx, [esp + 0x4c]
push ecx
mov ecx, str.HealthFunnel
call fcn.10003700
lea edx, [esp + 0x4c]
push edx
mov ecx, ebp
mov byte [esp + 0xc4], 0x13
call fcn.100048e0
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x58], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov ecx, ebx
mov dword [esi], eax
call fcn.10001420
mov esi, eax
lea eax, [esp + 0x4c]
mov dword [esp + 0x34], esi
mov byte [esp + 0xc0], 4
call fcn.10001660
test esi, esi
je 0x10071c52
mov eax, esi
mov esi, dword [eax]
call fcn.1007e040
test eax, eax
je 0x10071c52
mov esi, dword [ebx + 0x14]
mov eax, edi
call fcn.10003b60
cmp eax, dword [esi + 0x290]
jbe 0x10071c52
mov eax, edi
call fcn.100503d0
cmp eax, dword [esi + 0x294]
jae 0x10071c52
mov eax, dword [esp + 0x34]
mov ecx, dword [eax]
mov edx, dword [edi]
mov edx, dword [edx + 0x14]
push ecx
mov ecx, edi
call edx
jmp 0x100723bb
lea eax, [esp + 0x4c]
push eax
mov ecx, str.DemonicEmpowerment
call fcn.10003700
lea ecx, [esp + 0x4c]
push ecx
mov ecx, ebp
mov byte [esp + 0xc4], 0x14
call fcn.100048e0
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x58], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov ecx, ebx
mov dword [esi], eax
call fcn.10001420
mov esi, eax
lea eax, [esp + 0x4c]
mov dword [esp + 0x34], esi
mov byte [esp + 0xc0], 4
call fcn.10001660
test esi, esi
je 0x10071cfb
mov eax, esi
call fcn.1006e760
call fcn.1007f280
test eax, eax
jne 0x10071cfb
call fcn.1007f200
test eax, eax
jne 0x10071cfb
mov edx, dword [edi]
mov eax, dword [edx + 0x74]
mov ecx, edi
call eax
test eax, eax
je 0x10071cfb
cmp dword [esi + 0x10], 0
jne 0x10071cfb
mov ecx, esi
mov esi, dword [ecx]
call fcn.1007e040
test eax, eax
je 0x10071cfb
mov eax, dword [esp + 0x34]
mov ecx, dword [eax]
mov edx, dword [edi]
mov edx, dword [edx + 0x14]
push ecx
mov ecx, edi
call edx
jmp 0x100723bb
lea eax, [esp + 0x4c]
push eax
mov ecx, str.Metamorphosis
call fcn.10003700
lea ecx, [esp + 0x4c]
push ecx
mov ecx, ebp
mov byte [esp + 0xc4], 0x15
call fcn.100048e0
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x58], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov ecx, ebx
mov dword [esi], eax
call fcn.10001420
mov esi, eax
lea eax, [esp + 0x4c]
mov dword [esp + 0x34], esi
mov byte [esp + 0xc0], 4
call fcn.10001660
test esi, esi
je 0x10071e3d
mov eax, esi
call fcn.1006e760
cmp dword [esi + 0x10], 0
jne 0x10071da3
mov edx, esi
mov esi, dword [edx]
call fcn.1007e040
test eax, eax
je 0x10071da3
mov eax, edi
call fcn.10003b60
cmp eax, 0x3c
jb 0x10071d8e
push 7
mov eax, ebx
call fcn.10004680
cmp eax, 2
jbe 0x10071da3
mov ecx, dword [esp + 0x34]
mov edx, dword [ecx]
mov eax, dword [edi]
mov eax, dword [eax + 0x14]
push edx
mov ecx, edi
call eax
jmp 0x100723bb
mov ecx, dword [esp + 0x34]
mov esi, dword [ecx]
mov eax, edi
call fcn.10056f10
test eax, eax
je 0x10071e3d
lea edx, [esp + 0x4c]
push edx
mov ecx, str.ImmolationAura
call fcn.10003700
lea eax, [esp + 0x4c]
push eax
mov ecx, ebp
mov byte [esp + 0xc4], 0x16
call fcn.100048e0
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x58], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov ecx, ebx
mov dword [esi], eax
call fcn.10001420
mov esi, eax
lea eax, [esp + 0x4c]
mov dword [esp + 0x34], esi
mov byte [esp + 0xc0], 4
call fcn.10001660
test esi, esi
je 0x10071e3d
mov ecx, esi
mov esi, dword [ecx]
call fcn.1007e040
test eax, eax
je 0x10071e3d
mov edx, dword [esp + 0x34]
cmp dword [edx + 0x10], 0
jne 0x10071e3d
mov eax, dword [edi]
mov eax, dword [eax + 0x14]
mov ecx, edx
mov edx, dword [ecx]
push edx
mov ecx, edi
call eax
jmp 0x100723bb
lea ecx, [esp + 0x4c]
push ecx
mov ecx, str.Seed_of_Corruption
call fcn.10003700
lea edx, [esp + 0x4c]
push edx
mov ecx, ebp
mov byte [esp + 0xc4], 0x17
call fcn.100048e0
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x58], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov ecx, ebx
mov dword [esi], eax
call fcn.10001420
mov esi, eax
lea eax, [esp + 0x4c]
mov dword [esp + 0x34], esi
mov byte [esp + 0xc0], 4
call fcn.10001660
test esi, esi
je 0x10071f27
push 0x19
mov eax, ebx
call fcn.10004680
cmp eax, 1
jbe 0x10071f27
mov eax, esi
mov esi, dword [eax]
call fcn.1007e040
test eax, eax
je 0x10071fc5
mov ecx, dword [esp + 0x34]
mov esi, dword [ecx]
mov eax, dword [esp + 0x38]
call fcn.1006f6d0
test eax, eax
jne 0x10071fc5
mov eax, edi
call fcn.1002ec10
cmp eax, 0x28
jbe 0x10071fc5
mov eax, dword [esp + 0x38]
call fcn.10003b20
cmp eax, 0x3c
jbe 0x10071fc5
mov eax, edi
call fcn.10003b60
cmp eax, 0x32
jbe 0x10071fc5
mov esi, dword [esp + 0x34]
mov eax, esi
call fcn.1006e760
cmp dword [esi + 0x10], 0
jne 0x100723c4
mov eax, esi
mov ecx, dword [eax]
mov eax, dword [eax + 4]
push ecx
push eax
jmp 0x100723b2
lea eax, [esp + 0x4c]
push eax
mov ecx, str.Corruption
call fcn.10003700
lea ecx, [esp + 0x4c]
push ecx
mov ecx, ebp
mov byte [esp + 0xc4], 0x18
call fcn.100048e0
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x58], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov ecx, ebx
mov dword [esi], eax
call fcn.10001420
mov esi, eax
lea eax, [esp + 0x4c]
mov dword [esp + 0x34], esi
mov byte [esp + 0xc0], 4
call fcn.10001660
test esi, esi
je 0x10071fc5
mov edx, esi
mov esi, dword [edx]
call fcn.1007e040
test eax, eax
je 0x10071fc5
mov eax, dword [esp + 0x34]
mov esi, dword [eax]
mov eax, dword [esp + 0x38]
call fcn.1006f6d0
test eax, eax
jne 0x10071fc5
mov esi, dword [esp + 0x34]
mov eax, esi
call fcn.1006e760
cmp dword [esi + 0x10], 0
jne 0x100723c4
mov eax, esi
mov ecx, dword [eax]
mov eax, dword [eax + 4]
push ecx
push eax
jmp 0x100723b2
lea eax, [esp + 0x4c]
push eax
mov ecx, str.BaneofAgony
call fcn.10003700
lea ecx, [esp + 0x4c]
push ecx
mov ecx, ebp
mov byte [esp + 0xc4], 0x19
call fcn.100048e0
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x58], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov ecx, ebx
mov dword [esi], eax
call fcn.10001420
mov esi, eax
lea eax, [esp + 0x4c]
mov dword [esp + 0x34], esi
mov byte [esp + 0xc0], 4
call fcn.10001660
test esi, esi
je 0x10072062
mov edx, esi
mov esi, dword [edx]
call fcn.1007e040
test eax, eax
je 0x10072062
mov eax, dword [esp + 0x34]
mov esi, dword [eax]
mov eax, dword [esp + 0x38]
call fcn.1006f6d0
test eax, eax
jne 0x10072062
mov esi, dword [esp + 0x34]
mov eax, esi
call fcn.1006e760
cmp dword [esi + 0x10], 0
jne 0x10072062
mov edx, dword [edi]
mov eax, dword [esi]
mov edx, dword [edx + 0x14]
push eax
mov ecx, edi
call edx
jmp 0x100723bb
lea eax, [esp + 0x4c]
push eax
mov ecx, str.HandofGuldan
call fcn.10003700
lea ecx, [esp + 0x4c]
push ecx
mov ecx, ebp
mov byte [esp + 0xc4], 0x1a
call fcn.100048e0
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x58], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov ecx, ebx
mov dword [esi], eax
call fcn.10001420
mov esi, eax
lea eax, [esp + 0x4c]
mov dword [esp + 0x34], esi
mov byte [esp + 0xc0], 4
call fcn.10001660
test esi, esi
je 0x100720e0
mov edx, esi
mov esi, dword [edx]
call fcn.1007e040
test eax, eax
je 0x100720e0
mov eax, dword [esp + 0x34]
cmp dword [eax + 0x10], 0
jne 0x100720e0
mov ecx, dword [eax]
mov eax, dword [eax + 4]
push ecx
push eax
jmp 0x100723b2
lea eax, [esp + 0x4c]
push eax
mov ecx, str.Immolate
call fcn.10003700
lea ecx, [esp + 0x4c]
push ecx
mov ecx, ebp
mov byte [esp + 0xc4], 0x1b
call fcn.100048e0
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x58], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov ecx, ebx
mov dword [esi], eax
call fcn.10001420
mov esi, eax
lea eax, [esp + 0x4c]
mov dword [esp + 0x34], esi
mov byte [esp + 0xc0], 4
call fcn.10001660
test esi, esi
je 0x1007217e
mov edx, esi
mov esi, dword [edx]
call fcn.1007e040
test eax, eax
je 0x1007217e
mov eax, dword [esp + 0x34]
mov esi, dword [eax]
mov eax, dword [esp + 0x38]
call fcn.1006f6d0
test eax, eax
jne 0x1007217e
mov esi, dword [esp + 0x34]
mov eax, esi
call fcn.1006e760
cmp dword [esi + 0x10], 0
jne 0x100723c4
mov eax, esi
mov ecx, dword [eax]
mov eax, dword [eax + 4]
push ecx
push eax
jmp 0x100723b2
lea eax, [esp + 0x4c]
push eax
mov ecx, str.LifeTap
call fcn.10003700
lea ecx, [esp + 0x4c]
push ecx
mov ecx, ebp
mov byte [esp + 0xc4], 0x1c
call fcn.100048e0
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x58], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov ecx, ebx
mov dword [esi], eax
call fcn.10001420
mov esi, eax
lea eax, [esp + 0x4c]
mov dword [esp + 0x34], esi
mov byte [esp + 0xc0], 4
call fcn.10001660
test esi, esi
je 0x1007221e
mov eax, esi
call fcn.1006e760
mov esi, dword [esi]
call fcn.1007e040
test eax, eax
je 0x1007221e
mov eax, edi
call fcn.1002ec10
mov esi, eax
cmp esi, 0x5a
jae 0x1007221e
mov eax, edi
call fcn.10003b60
cmp eax, 0x46
jbe 0x1007221e
cmp eax, esi
jbe 0x1007221e
mov eax, dword [esp + 0x34]
mov ecx, dword [eax]
mov edx, dword [edi]
mov edx, dword [edx + 0x14]
push ecx
mov ecx, edi
call edx
jmp 0x100723bb
lea eax, [esp + 0x4c]
push eax
mov ecx, str.DrainMana
call fcn.10003700
lea ecx, [esp + 0x4c]
push ecx
mov ecx, ebp
mov byte [esp + 0xc4], 0x1d
call fcn.100048e0
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x58], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov ecx, ebx
mov dword [esi], eax
call fcn.10001420
mov esi, eax
lea eax, [esp + 0x4c]
mov dword [esp + 0x34], esi
mov byte [esp + 0xc0], 4
call fcn.10001660
test esi, esi
je 0x100722ac
mov edx, esi
mov esi, dword [edx]
call fcn.1007e040
test eax, eax
je 0x100722ac
mov eax, dword [esp + 0x38]
cmp dword [eax + 0x1c], 0xa
jbe 0x100722ac
mov eax, edi
call fcn.1002ec10
cmp eax, 0x3c
jae 0x100722ac
mov eax, dword [esp + 0x34]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
push ecx
push eax
jmp 0x100723b2
lea eax, [esp + 0x4c]
push eax
mov ecx, str.DrainLife
call fcn.10003700
lea ecx, [esp + 0x4c]
push ecx
mov ecx, ebp
mov byte [esp + 0xc4], 0x1e
call fcn.100048e0
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x58], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov ecx, ebx
mov dword [esi], eax
call fcn.10001420
mov esi, eax
lea eax, [esp + 0x4c]
mov dword [esp + 0x34], esi
mov byte [esp + 0xc0], 4
call fcn.10001660
test esi, esi
je 0x10072335
mov edx, esi
mov esi, dword [edx]
call fcn.1007e040
test eax, eax
je 0x10072335
mov eax, edi
call fcn.1002ec10
cmp eax, 0xa
jbe 0x10072335
mov ecx, dword [esp + 0x34]
mov edx, dword [ecx]
mov eax, dword [edi]
mov eax, dword [eax + 0x14]
push edx
mov ecx, edi
call eax
jmp 0x100723bb
lea ecx, [esp + 0x4c]
push ecx
mov ecx, str.ShadowBolt
call fcn.10003700
lea edx, [esp + 0x4c]
push edx
mov ecx, ebp
mov byte [esp + 0xc4], 0x1f
call fcn.100048e0
mov eax, dword [eax]
push ecx
sub eax, 0x10
mov dword [esp + 0x58], esp
mov esi, esp
call fcn.10001820
add eax, 0x10
mov ecx, ebx
mov dword [esi], eax
call fcn.10001420
mov ebp, eax
lea eax, [esp + 0x4c]
mov byte [esp + 0xc0], 4
call fcn.10001660
mov eax, dword [ebx + 0x14]
cmp dword [eax + 0x2a0], 0
je 0x100723c4
test ebp, ebp
je 0x100723c4
mov esi, dword [ebp]
call fcn.1007e040
test eax, eax
je 0x100723c4
cmp dword [ebp + 0x10], 0
jne 0x100723c4
mov eax, dword [ebp]
mov ecx, dword [ebp + 4]
push eax
push ecx
mov edx, dword [edi]
mov edx, dword [edx + 0x18]
mov ecx, edi
call edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebx + 0x3c], eax
mov eax, edi
call fcn.10003b60
cmp eax, 0x1e
ja 0x100723f6
call fcn.1006fb70
test eax, eax
je 0x100723f6
push 0x13
call fcn.100579d0
test eax, eax
je 0x100723f6
mov ecx, dword [0x100bb2cc]
mov eax, dword [ecx]
mov edx, dword [eax + 0xa8]
push 0x12
call edx
push 0x11
call fcn.100579d0
test eax, eax
je 0x1007242b
mov eax, dword [ebx + 0x14]
mov edx, dword [edi]
add eax, 0xc
push eax
mov eax, dword [edx + 0x38]
mov ecx, edi
call eax
test eax, eax
je 0x1007242b
mov edx, dword [edi]
mov eax, dword [edx + 0x4c]
mov ecx, edi
call eax
test eax, eax
jle 0x1007242b
mov edx, dword [edi]
mov eax, dword [edx + 0x58]
mov ecx, edi
call eax
push 0x12
call fcn.100579d0
test eax, eax
je 0x10072460
mov ebx, dword [ebx + 0x14]
mov edx, dword [edi]
mov eax, dword [edx + 0x3c]
add ebx, 0xc
push ebx
mov ecx, edi
call eax
test eax, eax
je 0x10072460
mov edx, dword [edi]
mov eax, dword [edx + 0x50]
mov ecx, edi
call eax
test eax, eax
jle 0x10072460
mov edx, dword [edi]
mov eax, dword [edx + 0x5c]
mov ecx, edi
call eax
push 0x19
call fcn.100579d0
test eax, eax
je 0x10072485
mov edx, dword [edi]
mov eax, dword [edx + 0x54]
push 0x19
mov ecx, edi
call eax
test eax, eax
jle 0x10072485
mov edx, dword [edi]
mov eax, dword [edx + 0x64]
push 0x19
mov ecx, edi
call eax
push 0x1a
call fcn.100579d0
test eax, eax
je 0x100724aa
mov edx, dword [edi]
mov eax, dword [edx + 0x54]
push 0x1a
mov ecx, edi
call eax
test eax, eax
jle 0x100724aa
mov edx, dword [edi]
mov eax, dword [edx + 0x64]
push 0x1a
mov ecx, edi
call eax
call fcn.1007e120
test eax, eax
je 0x100724e8
mov ecx, dword [esp + 0x38]
mov eax, dword [ecx + 0x44]
mov ecx, dword [ecx + 0x48]
mov edx, dword [edi]
push ecx
push eax
mov eax, dword [edx + 0x78]
mov ecx, edi
call eax
test eax, eax
je 0x100724e8
mov ecx, dword [0x100bb2cc]
mov edx, dword [ecx]
mov eax, dword [edx + 0x90]
push 0
call eax
mov al, 0
mov ecx, dword [0x100bb500]
mov byte [ecx], al
lea eax, [esp + 0x50]
call fcn.10001660
mov eax, 1
mov ecx, dword [esp + 0xb8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret 4