Function at 0x1016c020
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa0
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
test byte [ebx + 0x7fd3], 8
mov dword [ebp - 0x74], 0xffffffff
mov dword [ebp - 0x88], edi
mov dword [ebp - 0x7c], edi
je 0x1016c09f
test byte [ebx + 0x7fd0], 4
jne 0x1016c09f
mov ecx, dword [ebx + 0x803c]
mov eax, dword [ebx]
mov edx, dword [eax + 0x34]
push ecx
push edi
push 0x8622410
push edi
push 0x20
mov ecx, ebx
call edx
mov esi, eax
cmp esi, edi
jl 0x1016d58a
mov ecx, dword [ebx + 0x8038]
mov eax, dword [ebx]
mov edx, dword [eax + 0x34]
push ecx
push 0x180
push 0xcc732628
push edi
push 0x10
mov ecx, ebx
call edx
mov esi, eax
cmp esi, edi
jl 0x1016d58a
test byte [ebx + 0x7fd3], 0x10
je 0x1016c1a0
push ebx
call fcn.1016bf70
mov eax, dword [ebx + 4]
cmp eax, edi
jbe 0x1016c0c1
mov ecx, dword [ebx + 0x7f24]
mov edi, dword [ecx]
mov dword [ebp - 0x10], 0
test eax, eax
jbe 0x1016c1a0
mov eax, dword [edi + 0x10]
and eax, 1
xor ecx, ecx
or eax, ecx
je 0x1016c178
cmp dword [edi + 0x28], ecx
jbe 0x1016c178
mov eax, dword [ebx + 0x8028]
lea edx, [ebp - 0x30]
push edx
push eax
call fcn.10169fd0
mov esi, eax
test esi, esi
jl 0x1016d58a
mov edx, dword [ebx + 0x8028]
lea ecx, [ebp - 0x50]
push ecx
push edx
call fcn.10169fd0
mov esi, eax
test esi, esi
jl 0x1016d58a
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x50]
push edi
push eax
push 0x2060
mov dword [eax + 0x18], edi
push 0x2822580
mov dword [ecx + 0x18], edi
mov edx, dword [ebx]
mov eax, dword [edx + 0x38]
push 0
push 0x200
mov ecx, ebx
call eax
mov esi, eax
test esi, esi
jl 0x1016d58a
mov eax, dword [ebp - 0x50]
mov edx, dword [ebx]
mov edx, dword [edx + 0x38]
push edi
push eax
push 0x2060
push 0x2822180
push 0
push 0x600
mov ecx, ebx
call edx
mov esi, eax
test esi, esi
jl 0x1016d58a
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebx + 4]
inc eax
mov dword [ebp - 0x10], eax
cmp eax, ecx
jb 0x1016c18f
mov eax, ecx
xor edi, edi
mov dword [ebp - 0x10], eax
jmp 0x1016c198
mov edx, dword [ebx + 0x7f24]
mov edi, dword [edx + eax*4]
cmp eax, ecx
jb 0x1016c0d0
push ebx
call fcn.10175ad0
mov eax, dword [ebx + 0x8040]
mov eax, dword [eax + 0x24]
xor edx, edx
test eax, eax
je 0x1016c1c5
mov ecx, dword [eax + 0x60]
cmp ecx, edx
jb 0x1016c1bf
lea edx, [ecx + 1]
mov eax, dword [eax]
test eax, eax
jne 0x1016c1b5
mov eax, dword [ebx + 0x807c]
mov eax, dword [eax + 0x24]
xor ecx, ecx
mov dword [ebp - 0x2c], edx
test eax, eax
je 0x1016c1e7
mov esi, dword [eax + 0x60]
cmp esi, ecx
jb 0x1016c1e1
lea ecx, [esi + 1]
mov eax, dword [eax]
test eax, eax
jne 0x1016c1d7
mov eax, dword [ebx + 0x10]
lea eax, [edx + eax*8]
mov dword [ebp - 0x60], ecx
cmp eax, 0x3ffffffd
jbe 0x1016c1fe
mov eax, 0x80070216
jmp 0x1016c264
add eax, eax
add eax, eax
jne 0x1016c209
mov eax, 4
mov dword [ebp - 0x7c], eax
mov edi, eax
lea esi, [ebx + 0x814c]
test eax, eax
ja 0x1016c21d
mov edi, 1
mov eax, dword [esi]
test eax, eax
je 0x1016c22d
mov ecx, dword [eax + 0xc]
sub ecx, dword [eax + 8]
cmp edi, ecx
jbe 0x1016c23c
mov ecx, edi
call fcn.100daf50
test eax, eax
je 0x1016c23c
xor eax, eax
jmp 0x1016c250
mov ecx, dword [esi]
test ecx, ecx
je 0x1016c24b
mov edx, dword [ecx + 8]
lea eax, [edx + ecx + 0x10]
jmp 0x1016c24d
xor eax, eax
add dword [ecx + 8], edi
mov dword [ebp - 0x88], eax
neg eax
sbb eax, eax
and eax, 0x7ff8fff2
add eax, 0x8007000e
mov edi, dword [ebp - 0x88]
mov esi, eax
test eax, eax
jl 0x1016d58a
mov eax, dword [ebp - 0x7c]
push eax
push 0
push edi
call sub.msvcrt.dll_memset
mov eax, dword [ebx + 0x8040]
mov eax, dword [eax + 0x24]
add esp, 0xc
test eax, eax
je 0x1016c2ab
mov ecx, dword [eax + 0x60]
mov edx, dword [eax + 0x64]
cmp dword [edi + ecx*4], edx
lea ecx, [edi + ecx*4]
ja 0x1016c2a1
inc edx
mov dword [ecx], edx
mov byte [eax + 0x28], 0
mov eax, dword [eax]
test eax, eax
jne 0x1016c290
mov ecx, dword [ebx + 0x10]
mov dword [ebp - 0x50], ecx
test ecx, ecx
jbe 0x1016c2bc
mov edx, dword [ebx + 0x14]
mov eax, dword [edx]
jmp 0x1016c2be
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0
test ecx, ecx
jbe 0x1016d3f2
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [eax + 0x10]
jae 0x1016d3f2
mov ebx, dword [ebp - 0x14]
mov eax, dword [ebx + 0x3c]
test eax, 0xf0000000
je 0x1016d3c1
and eax, 0xfff00000
cmp eax, 0x21d00000
ja 0x1016c334
je 0x1016c362
cmp eax, 0x20500000
ja 0x1016c321
je 0x1016c362
cmp eax, 0x20000000
je 0x1016c362
cmp eax, 0x20100000
je 0x1016c362
cmp eax, 0x20400000
je 0x1016c362
jmp 0x1016c521
cmp eax, 0x21b00000
je 0x1016c362
cmp eax, 0x21c00000
je 0x1016c362
jmp 0x1016c521
cmp eax, 0x22200000
ja 0x1016c350
je 0x1016c362
cmp eax, 0x21e00000
je 0x1016c362
cmp eax, 0x22100000
je 0x1016c362
jmp 0x1016c521
cmp eax, 0x22300000
je 0x1016c362
cmp eax, 0x50000000
jne 0x1016c521
push 0
lea esi, [ebp - 0x6c]
mov edx, ebx
call fcn.10172d80
push 1
lea esi, [ebp - 0x64]
mov edx, ebx
mov edi, eax
call fcn.10172d80
cmp edi, 1
jbe 0x1016c521
mov eax, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x6c]
sub ecx, eax
dec edi
lea ebx, [eax + 4]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x40], edi
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + ebx]
cmp eax, dword [ebx]
je 0x1016c511
mov ecx, dword [ebp - 0x6c]
mov edx, dword [ecx]
or esi, 0xffffffff
mov dword [ebp - 0x30], edx
cmp edx, esi
je 0x1016c3df
mov eax, dword [edx + 0x50]
mov eax, dword [eax + 8]
and eax, 0x100
xor ecx, ecx
or eax, ecx
je 0x1016c3df
mov eax, dword [edx + 0x40]
and eax, 0x800000
or eax, ecx
je 0x1016c3df
cmp dword [edx + 0x5c], esi
jne 0x1016c3df
mov byte [ebp - 0x1d], 1
cmp dword [edx + 0x58], esi
je 0x1016c3e3
mov byte [ebp - 0x1d], 0
mov edx, dword [ebp - 0x64]
mov ecx, dword [edx]
cmp ecx, esi
je 0x1016c417
mov eax, dword [ecx + 0x50]
mov eax, dword [eax + 8]
and eax, 0x100
xor edx, edx
or eax, edx
je 0x1016c417
mov eax, dword [ecx + 0x40]
and eax, 0x800000
or eax, edx
je 0x1016c417
cmp dword [ecx + 0x5c], esi
jne 0x1016c417
mov byte [ebp - 5], 1
cmp dword [ecx + 0x58], esi
je 0x1016c41b
mov byte [ebp - 5], 0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + ebx]
cmp ecx, esi
je 0x1016c450
mov eax, dword [ecx + 0x50]
mov eax, dword [eax + 8]
and eax, 0x100
xor edx, edx
or eax, edx
je 0x1016c450
mov eax, dword [ecx + 0x40]
and eax, 0x800000
or eax, edx
je 0x1016c450
cmp dword [ecx + 0x5c], esi
jne 0x1016c450
cmp dword [ecx + 0x58], esi
jne 0x1016c450
mov dl, 1
jmp 0x1016c452
xor dl, dl
mov esi, dword [ebx]
or edi, 0xffffffff
cmp esi, edi
je 0x1016c486
mov eax, dword [esi + 0x50]
mov eax, dword [eax + 8]
and eax, 0x100
xor ecx, ecx
or eax, ecx
je 0x1016c486
mov eax, dword [esi + 0x40]
and eax, 0x800000
or eax, ecx
je 0x1016c486
cmp dword [esi + 0x5c], edi
jne 0x1016c486
cmp dword [esi + 0x58], edi
jne 0x1016c486
mov al, 1
jmp 0x1016c488
xor al, al
test dl, dl
je 0x1016c494
test al, al
jne 0x1016c511
cmp byte [ebp - 0x1d], 0
je 0x1016c4a2
test dl, dl
jne 0x1016c4a2
test al, al
jne 0x1016c504
cmp byte [ebp - 5], 0
je 0x1016c4b0
test dl, dl
je 0x1016c4b0
test al, al
je 0x1016c504
mov ecx, dword [ebp + 8]
mov edi, dword [ebp - 0x30]
push ecx
call fcn.101b3de0
test al, al
je 0x1016c511
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x6c]
mov esi, dword [eax + ebx]
mov edi, dword [ecx]
push edx
call fcn.101b3de0
test al, al
jne 0x1016c511
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x64]
mov esi, dword [eax + ebx]
mov edi, dword [ecx]
push edx
call fcn.101b3de0
test al, al
je 0x1016c511
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x64]
mov esi, dword [ebx]
mov edi, dword [eax]
push edx
call fcn.101b3de0
test al, al
jne 0x1016c511
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebx]
mov eax, dword [ecx + ebx]
mov dword [ecx + ebx], edx
mov dword [ebx], eax
add ebx, 4
sub dword [ebp - 0x40], 1
jne 0x1016c397
mov ebx, dword [ebp - 0x14]
mov eax, dword [ebx + 0x3c]
and eax, 0xfff00000
mov byte [ebp - 5], 1
cmp eax, 0x50600000
ja 0x1016c54c
je 0x1016c637
cmp eax, 0x50400000
je 0x1016c637
cmp eax, 0x50500000
jmp 0x1016c55c
cmp eax, 0x50800000
je 0x1016c637
cmp eax, 0x50900000
je 0x1016c637
cmp eax, 0x80000000
je 0x1016c637
cmp eax, 0x90200000
je 0x1016c637
cmp eax, 0x90100000
je 0x1016c637
xor edi, edi
push edi
lea esi, [ebp - 0x78]
mov edx, ebx
call fcn.10172d80
test eax, eax
je 0x1016c5e2
mov ebx, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x14]
push 0xffffffffffffffff
push ebx
push 0
push ecx
mov ecx, dword [ebp - 0x88]
lea edx, [ebp - 0x2c]
push edx
mov edx, dword [ebp - 0x78]
push ecx
push eax
mov eax, dword [ebp + 8]
push edx
push eax
call fcn.101b40d0
test al, al
jne 0x1016c5c0
mov byte [ebp - 5], al
mov edx, dword [ebp - 0x14]
inc edi
push edi
lea esi, [ebp - 0x78]
call fcn.10172d80
test eax, eax
jne 0x1016c597
cmp byte [ebp - 5], al
jne 0x1016c5e2
mov eax, dword [ebp - 0x14]
call fcn.101733c0
test al, al
je 0x1016c634
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x8c]
push ecx
push edx
push eax
call fcn.1016a100
mov esi, eax
test esi, esi
jl 0x1016d58a
mov eax, dword [ebp - 0x8c]
mov edx, dword [eax + 0x10]
xor ecx, ecx
cmp dword [eax + 8], ecx
jbe 0x1016d3c1
mov esi, dword [eax + 0xc]
mov esi, dword [esi + ecx*4]
mov dword [esi + 0x88], eax
mov esi, dword [eax + 0xc]
mov esi, dword [esi + ecx*4]
inc ecx
mov dword [esi + 0xc], edx
cmp ecx, dword [eax + 8]
jb 0x1016c614
jmp 0x1016d3c1
mov ebx, dword [ebp - 0x14]
mov esi, dword [ebx + 0x3c]
mov ecx, esi
xor edx, edx
and ecx, 0xf0000000
mov dword [ebp - 0x24], edx
cmp ecx, 0xb0000000
jne 0x1016c654
lea ecx, [edx + 1]
jmp 0x1016c675
mov eax, esi
and eax, 0xfff00000
cmp eax, 0x68700000
je 0x1016c669
cmp eax, 0x68800000
jne 0x1016c66d
mov ecx, dword [ebx]
jmp 0x1016c675
mov ecx, esi
and ecx, 0xfffff
mov eax, dword [ebx]
cmp ecx, eax
jbe 0x1016c6bd
xor edi, edi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x34], edx
mov edx, dword [ebx + 0xc]
xor eax, eax
mov word [ebp - 0x57], ax
mov byte [ebp - 0x55], al
mov eax, dword [edx]
mov dword [ebp - 0x54], eax
mov eax, esi
and eax, 0xfff00000
mov byte [ebp - 0x58], 0
mov dword [ebp - 0x3c], 0xffffffff
cmp eax, 0x50600000
ja 0x1016c6cf
je 0x1016c6f5
cmp eax, 0x50400000
je 0x1016c6f5
cmp eax, 0x50500000
jmp 0x1016c6db
mov dword [ebp - 0x38], ecx
mov edi, ecx
cmp ecx, edx
je 0x1016c680
xor edx, edx
div ecx
mov dword [ebp - 0x34], eax
jmp 0x1016c683
cmp eax, 0x50800000
je 0x1016c6f5
cmp eax, 0x50900000
je 0x1016c6f5
cmp eax, 0x80000000
je 0x1016c6f5
cmp eax, 0x90200000
jne 0x1016c6fe
mov ecx, dword [ebx + 4]
mov edx, dword [ecx]
mov dword [ebp - 0x3c], edx
jmp 0x1016c6fe
mov eax, dword [ebx + 4]
mov ecx, dword [eax + edi*8]
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x68], edi
mov dword [ebp - 0x1c], 0
test edi, edi
jbe 0x1016d3c1
mov ecx, dword [ebp - 0x1c]
cmp byte [ebp + ecx - 0x58], 0
jne 0x1016d088
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x48], ecx
cmp ecx, edi
jae 0x1016c7b8
cmp byte [ebp + ecx - 0x58], 0
jne 0x1016c7a9
cmp dword [ebp - 0x34], 0
mov dword [ebp - 0x28], 0
jbe 0x1016c796
mov edx, dword [ebp - 0x38]
lea eax, [edx*4]
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x5c], eax
jmp 0x1016c763
mov ecx, dword [ebp - 0x48]
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 4]
add eax, dword [ebp - 0xc]
mov ebx, dword [ebp + 8]
mov esi, dword [eax + ecx*4]
mov ecx, dword [ebp - 0x1c]
mov edi, dword [eax + ecx*4]
call fcn.101acd60
test al, al
je 0x1016c793
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x5c]
add dword [ebp - 0xc], edx
inc eax
mov dword [ebp - 0x28], eax
cmp eax, dword [ebp - 0x34]
jb 0x1016c760
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x34]
jne 0x1016c7a9
mov eax, 1
sub dword [ebp - 0x68], eax
add dword [ebp - 0x44], eax
mov edi, dword [ebp - 0x38]
inc ecx
mov dword [ebp - 0x48], ecx
cmp ecx, edi
jb 0x1016c730
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx + 0x3c]
mov ecx, dword [ebp + 8]
and eax, 0xfff00000
mov edx, eax
xor edx, dword [ebp - 0x44]
push 0xffffffffffffffff
push 0xffffffffffffffff
and edx, 0xfffff
xor edx, eax
push edx
lea eax, [ebp - 0x18]
push eax
push ecx
call fcn.10169e20
mov esi, eax
test esi, esi
jl 0x1016d58a
mov eax, dword [ebp - 0x14]
mov edx, dword [eax + 0x34]
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 0x34], edx
mov eax, dword [eax + 0x38]
mov dword [ecx + 0x38], eax
cmp edi, dword [ebp - 0x1c]
jbe 0x1016c999
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x44]
add eax, eax
add eax, eax
lea edx, [edx*4 - 4]
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x28], eax
sub dword [ebp - 0x28], 4
dec edi
cmp byte [ebp + edi - 0x58], 0
lea eax, [ebp + edi - 0x58]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x70], eax
jne 0x1016c990
xor eax, eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x34], eax
jbe 0x1016c8d3
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx + 4]
add eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x1c]
mov esi, dword [edx + eax]
mov edi, dword [eax + ecx*4]
mov ebx, dword [ebp + 8]
call fcn.101acd60
test al, al
je 0x1016c881
mov eax, dword [ebp - 0x40]
mov edx, dword [ebp - 0x5c]
add dword [ebp - 0x48], edx
inc eax
mov dword [ebp - 0x40], eax
cmp eax, dword [ebp - 0x34]
jb 0x1016c84c
jmp 0x1016c88d
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x40], eax
jb 0x1016c98a
mov ecx, dword [ebp - 0x44]
mov edi, dword [ebp - 0x34]
lea eax, [ecx*4]
xor esi, esi
xor edx, edx
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx + 4]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx + 4]
mov ebx, dword [ebp - 0x28]
add eax, edx
mov eax, dword [ebx + eax]
mov ebx, dword [ebp - 0xc]
add edx, dword [ebp - 0x5c]
add ecx, esi
add esi, dword [ebp - 0x40]
sub edi, 1
mov dword [ebx + ecx], eax
jne 0x1016c8a1
mov ecx, dword [ebp - 0x70]
mov edi, dword [ebp - 0x30]
mov byte [ecx], 1
mov edx, ebx
mov esi, dword [ebp - 0x14]
mov ecx, dword [esi + 0x3c]
mov eax, ecx
and eax, 0xfff00000
cmp eax, 0x90200000
jne 0x1016c8fe
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 4]
mov ecx, dword [ebp - 0x3c]
mov dword [edx + eax], ecx
sub edx, 4
mov dword [ebp - 0xc], edx
jmp 0x1016c990
cmp eax, 0x50600000
ja 0x1016c915
je 0x1016c970
cmp eax, 0x50400000
je 0x1016c970
cmp eax, 0x50500000
jmp 0x1016c921
cmp eax, 0x50800000
je 0x1016c970
cmp eax, 0x50900000
je 0x1016c970
cmp eax, 0x80000000
je 0x1016c970
shr ecx, 0x1c
cmp ecx, 1
jb 0x1016c937
cmp ecx, 4
jbe 0x1016c93e
cmp eax, 0x90100000
jne 0x1016c982
mov ecx, dword [esi + 0xc]
mov eax, dword [ebp - 0x18]
mov esi, dword [eax + 0xc]
mov ebx, dword [ebp - 0x28]
mov ecx, dword [ebx + ecx]
mov dword [edx + esi], ecx
mov ecx, dword [eax + 0xc]
mov ecx, dword [edx + ecx]
mov esi, dword [eax + 0x10]
mov dword [ecx + 0xc], esi
mov ecx, dword [eax + 0xc]
mov ecx, dword [edx + ecx]
sub edx, 4
mov dword [ecx + 0x88], eax
mov dword [ebp - 0xc], edx
jmp 0x1016c990
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 4]
mov eax, dword [ebp - 0x44]
lea eax, [ecx + eax*8]
mov ecx, dword [ebp - 0x3c]
mov dword [edx + eax], ecx
sub edx, 4
mov dword [ebp - 0xc], edx
jmp 0x1016c990
mov edx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x30]
cmp edi, dword [ebp - 0x1c]
ja 0x1016c821
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x3c]
and eax, 0xfff00000
cmp eax, 0x90200000
jne 0x1016cc0d
xor ebx, ebx
cmp dword [ebp - 0x68], ebx
je 0x1016cc00
mov eax, dword [ebp - 0x54]
mov edi, dword [eax + 0x50]
mov eax, dword [0x101e316c]
cmp eax, ebx
jge 0x1016c9cd
xor eax, eax
jmp 0x1016c9d4
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [eax + 0xc], ebx
je 0x1016c9fc
mov ecx, dword [eax + 0xc]
cmp ecx, ebx
jne 0x1016c9e6
xor ecx, ecx
mov esi, ecx
jmp 0x1016ca0d
mov edx, dword [ecx]
mov dword [eax + 0xc], edx
cmp edx, ebx
jne 0x1016c9f2
mov dword [eax + 0x10], ebx
mov dword [ecx], 0xfefefefe
mov esi, ecx
jmp 0x1016ca0d
mov ecx, dword [eax + 8]
push 0x10
push pe_nt_image_headers32
call fcn.101d8457
mov esi, eax
cmp esi, ebx
je 0x1016ca5f
or eax, 0xffffffff
push ebx
push ebx
mov dword [esi + 0x50], eax
mov dword [esi + 0x48], eax
push edi
mov eax, esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 0x94], ebx
mov dword [esi + 0x98], ebx
mov dword [esi + 0x24], ebx
call fcn.10165570
cmp eax, ebx
mov dword [ebp - 0xc], eax
jl 0x1016ca69
mov edi, dword [ebp + 8]
push 0
mov ebx, esi
call fcn.10169830
xor ebx, ebx
mov dword [ebp - 0xc], eax
test eax, eax
jl 0x1016ca69
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x3c], esi
jmp 0x1016cb7d
mov esi, 0x8007000e
jmp 0x1016cb80
mov ecx, dword [esi + 0x50]
cmp ecx, ebx
je 0x1016ca9b
cmp ecx, 0xffffffff
je 0x1016ca9b
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x1016ca82
mov edx, dword [esi]
mov dword [eax], edx
jmp 0x1016ca87
mov eax, dword [esi]
mov dword [ecx + 0x24], eax
mov eax, dword [esi]
cmp eax, ebx
je 0x1016ca95
mov ecx, dword [esi + 4]
mov dword [eax + 4], ecx
jmp 0x1016ca9b
mov edx, dword [esi + 4]
mov dword [ecx + 0x28], edx
mov edi, dword [esi + 0x94]
cmp edi, ebx
je 0x1016cae8
cmp byte [edi + 0xc], 0
mov dword [edi + 8], ebx
je 0x1016cada
mov ebx, dword [edi]
test ebx, ebx
je 0x1016cad4
mov eax, dword [0x101e316c]
test eax, eax
jge 0x1016cac1
xor eax, eax
jmp 0x1016cac8
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [eax]
push ebx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov byte [edi + 0xc], 0
xor ebx, ebx
push edi
mov dword [edi], ebx
mov dword [edi + 4], ebx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 4
mov edi, dword [esi + 0x98]
mov dword [esi + 0x94], ebx
cmp edi, ebx
je 0x1016cb3b
cmp byte [edi + 0xc], 0
mov dword [edi + 8], ebx
je 0x1016cb2d
mov ebx, dword [edi]
test ebx, ebx
je 0x1016cb27
mov eax, dword [0x101e316c]
test eax, eax
jge 0x1016cb14
xor eax, eax
jmp 0x1016cb1b
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax]
push ebx
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov byte [edi + 0xc], 0
xor ebx, ebx
push edi
mov dword [edi], ebx
mov dword [edi + 4], ebx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esi + 0x98], ebx
mov eax, dword [0x101e316c]
cmp eax, ebx
jge 0x1016cb4e
xor edi, edi
jmp 0x1016cb57
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
push pe_nt_image_headers32
push 0xfe
push esi
call sub.msvcrt.dll_memset
mov dword [esi], ebx
mov eax, dword [edi + 0x10]
add esp, 0xc
cmp eax, ebx
je 0x1016cb77
mov dword [eax], esi
jmp 0x1016cb7a
mov dword [edi + 0xc], esi
mov dword [edi + 0x10], esi
mov esi, dword [ebp - 0xc]
cmp esi, ebx
jl 0x1016d58a
mov edx, dword [ebp - 0x18]
mov ecx, dword [edx + 0xc]
mov eax, dword [ebp - 0x3c]
mov dword [ecx], eax
mov ecx, dword [ebp - 0x54]
mov edx, dword [ecx + 0x68]
mov dword [eax + 0x68], edx
mov cl, byte [ecx + 0x6c]
mov byte [eax + 0x6c], cl
mov eax, dword [ebp - 0x18]
xor ebx, ebx
mov edx, dword [ebp - 0x14]
mov ecx, dword [edx + 0x3c]
and ecx, 0xfff00000
cmp ecx, 0x50000000
je 0x1016cbcc
cmp ecx, 0x70800000
jne 0x1016d088
mov eax, dword [ebp - 0x18]
xor ebx, ebx
mov ecx, dword [ebp - 0x38]
cmp dword [ebp - 0x44], ecx
jne 0x1016ce2c
mov edx, dword [ebp - 0x14]
mov ecx, dword [edx + 0xc]
mov ecx, dword [ecx]
mov edx, dword [eax + 0xc]
mov dword [edx], ecx
mov edx, dword [eax + 0xc]
mov ecx, dword [edx]
mov edx, dword [eax + 0x10]
mov dword [ecx + 0xc], edx
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov dword [edx + 0x88], eax
jmp 0x1016d088
mov eax, dword [ebp - 0x18]
mov edx, dword [eax + 0xc]
mov ecx, dword [ebp - 0x54]
mov dword [edx], ecx
jmp 0x1016cba7
cmp eax, 0x50600000
ja 0x1016cc24
je 0x1016cc3d
cmp eax, 0x50400000
je 0x1016cc3d
cmp eax, 0x50500000
jmp 0x1016cc30
cmp eax, 0x50800000
je 0x1016cc3d
cmp eax, 0x50900000
je 0x1016cc3d
cmp eax, 0x80000000
jne 0x1016cba2
xor ebx, ebx
cmp dword [ebp - 0x68], ebx
je 0x1016cc00
mov eax, dword [0x101e316c]
cmp eax, ebx
mov edx, dword [ebp + 8]
mov edi, dword [edx + 0x807c]
jge 0x1016cc5a
xor eax, eax
jmp 0x1016cc61
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [eax + 0xc], ebx
je 0x1016cc89
mov ecx, dword [eax + 0xc]
cmp ecx, ebx
jne 0x1016cc73
xor ecx, ecx
mov esi, ecx
jmp 0x1016cc9a
mov edx, dword [ecx]
mov dword [eax + 0xc], edx
cmp edx, ebx
jne 0x1016cc7f
mov dword [eax + 0x10], ebx
mov dword [ecx], 0xfefefefe
mov esi, ecx
jmp 0x1016cc9a
mov ecx, dword [eax + 8]
push 0x10
push pe_nt_image_headers32
call fcn.101d8457
mov esi, eax
cmp esi, ebx
je 0x1016ccf4
or eax, 0xffffffff
mov dword [esi + 0x50], eax
mov dword [esi + 0x48], eax
mov eax, dword [ebp - 0x60]
push ebx
push eax
push edi
mov eax, esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 0x94], ebx
mov dword [esi + 0x98], ebx
mov dword [esi + 0x24], ebx
call fcn.10165570
cmp eax, ebx
mov dword [ebp - 0xc], eax
jl 0x1016cd01
mov edi, dword [ebp + 8]
push 0
mov ebx, esi
call fcn.10169830
xor ebx, ebx
mov dword [ebp - 0xc], eax
test eax, eax
jl 0x1016cd01
inc dword [ebp - 0x60]
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0xc], ebx
mov esi, ebx
jmp 0x1016cb80
inc dword [ebp - 0x60]
mov esi, 0x8007000e
jmp 0x1016cb80
mov ecx, dword [esi + 0x50]
cmp ecx, ebx
je 0x1016cd33
cmp ecx, 0xffffffff
je 0x1016cd33
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x1016cd1a
mov edx, dword [esi]
mov dword [eax], edx
jmp 0x1016cd1f
mov eax, dword [esi]
mov dword [ecx + 0x24], eax
mov eax, dword [esi]
cmp eax, ebx
je 0x1016cd2d
mov ecx, dword [esi + 4]
mov dword [eax + 4], ecx
jmp 0x1016cd33
mov edx, dword [esi + 4]
mov dword [ecx + 0x28], edx
mov edi, dword [esi + 0x94]
cmp edi, ebx
je 0x1016cd80
cmp byte [edi + 0xc], 0
mov dword [edi + 8], ebx
je 0x1016cd72
mov ebx, dword [edi]
test ebx, ebx
je 0x1016cd6c
mov eax, dword [0x101e316c]
test eax, eax
jge 0x1016cd59
xor eax, eax
jmp 0x1016cd60
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [eax]
push ebx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov byte [edi + 0xc], 0
xor ebx, ebx
push edi
mov dword [edi], ebx
mov dword [edi + 4], ebx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 4
mov edi, dword [esi + 0x98]
mov dword [esi + 0x94], ebx
cmp edi, ebx
je 0x1016cdd3
cmp byte [edi + 0xc], 0
mov dword [edi + 8], ebx
je 0x1016cdc5
mov ebx, dword [edi]
test ebx, ebx
je 0x1016cdbf
mov eax, dword [0x101e316c]
test eax, eax
jge 0x1016cdac
xor eax, eax
jmp 0x1016cdb3
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax]
push ebx
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov byte [edi + 0xc], 0
xor ebx, ebx
push edi
mov dword [edi], ebx
mov dword [edi + 4], ebx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esi + 0x98], ebx
mov eax, dword [0x101e316c]
cmp eax, ebx
jge 0x1016cde6
xor edi, edi
jmp 0x1016cdef
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
push pe_nt_image_headers32
push 0xfe
push esi
call sub.msvcrt.dll_memset
mov dword [esi], ebx
mov eax, dword [edi + 0x10]
add esp, 0xc
cmp eax, ebx
je 0x1016ce1b
inc dword [ebp - 0x60]
mov dword [eax], esi
mov dword [edi + 0x10], esi
mov esi, dword [ebp - 0xc]
jmp 0x1016cb80
inc dword [ebp - 0x60]
mov dword [edi + 0xc], esi
mov dword [edi + 0x10], esi
mov esi, dword [ebp - 0xc]
jmp 0x1016cb80
mov eax, dword [ebp + 8]
mov edi, dword [eax + 0x8040]
mov eax, dword [0x101e316c]
cmp eax, ebx
jge 0x1016ce42
xor eax, eax
jmp 0x1016ce49
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [eax + 0xc], ebx
je 0x1016ce71
mov ecx, dword [eax + 0xc]
cmp ecx, ebx
jne 0x1016ce5b
xor ecx, ecx
mov esi, ecx
jmp 0x1016ce82
mov edx, dword [ecx]
mov dword [eax + 0xc], edx
cmp edx, ebx
jne 0x1016ce67
mov dword [eax + 0x10], ebx
mov dword [ecx], 0xfefefefe
mov esi, ecx
jmp 0x1016ce82
mov ecx, dword [eax + 8]
push 0x10
push pe_nt_image_headers32
call fcn.101d8457
mov esi, eax
cmp esi, ebx
je 0x1016cee1
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x2c]
or eax, 0xffffffff
push ecx
push edx
mov dword [esi + 0x50], eax
mov dword [esi + 0x48], eax
push edi
mov eax, esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 0x94], ebx
mov dword [esi + 0x98], ebx
mov dword [esi + 0x24], ebx
call fcn.10165570
cmp eax, ebx
mov dword [ebp - 0xc], eax
jl 0x1016ceeb
mov edi, dword [ebp + 8]
push 0
mov ebx, esi
call fcn.10169830
xor ebx, ebx
mov dword [ebp - 0xc], eax
test eax, eax
jl 0x1016ceeb
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xc], ebx
mov dword [ebp + eax*4 - 0x9c], esi
jmp 0x1016cfff
mov esi, 0x8007000e
jmp 0x1016d002
mov ecx, dword [esi + 0x50]
cmp ecx, ebx
je 0x1016cf1d
cmp ecx, 0xffffffff
je 0x1016cf1d
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x1016cf04
mov edx, dword [esi]
mov dword [eax], edx
jmp 0x1016cf09
mov eax, dword [esi]
mov dword [ecx + 0x24], eax
mov eax, dword [esi]
cmp eax, ebx
je 0x1016cf17
mov ecx, dword [esi + 4]
mov dword [eax + 4], ecx
jmp 0x1016cf1d
mov edx, dword [esi + 4]
mov dword [ecx + 0x28], edx
mov edi, dword [esi + 0x94]
cmp edi, ebx
je 0x1016cf6a
cmp byte [edi + 0xc], 0
mov dword [edi + 8], ebx
je 0x1016cf5c
mov ebx, dword [edi]
test ebx, ebx
je 0x1016cf56
mov eax, dword [0x101e316c]
test eax, eax
jge 0x1016cf43
xor eax, eax
jmp 0x1016cf4a
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [eax]
push ebx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov byte [edi + 0xc], 0
xor ebx, ebx
push edi
mov dword [edi], ebx
mov dword [edi + 4], ebx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 4
mov edi, dword [esi + 0x98]
mov dword [esi + 0x94], ebx
cmp edi, ebx
je 0x1016cfbd
cmp byte [edi + 0xc], 0
mov dword [edi + 8], ebx
je 0x1016cfaf
mov ebx, dword [edi]
test ebx, ebx
je 0x1016cfa9
mov eax, dword [0x101e316c]
test eax, eax
jge 0x1016cf96
xor eax, eax
jmp 0x1016cf9d
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [eax]
push ebx
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov byte [edi + 0xc], 0
xor ebx, ebx
push edi
mov dword [edi], ebx
mov dword [edi + 4], ebx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esi + 0x98], ebx
mov eax, dword [0x101e316c]
cmp eax, ebx
jge 0x1016cfd0
xor edi, edi
jmp 0x1016cfd9
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
push pe_nt_image_headers32
push 0xfe
push esi
call sub.msvcrt.dll_memset
mov dword [esi], ebx
mov eax, dword [edi + 0x10]
add esp, 0xc
cmp eax, ebx
je 0x1016cff9
mov dword [eax], esi
jmp 0x1016cffc
mov dword [edi + 0xc], esi
mov dword [edi + 0x10], esi
mov esi, dword [ebp - 0xc]
cmp esi, ebx
jl 0x1016d58a
mov edi, dword [ebp - 0x18]
mov edx, dword [edi + 0xc]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + eax*4 - 0x9c]
mov dword [edx], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0xc]
mov eax, dword [eax]
mov ecx, dword [edi + 0xc]
mov ecx, dword [ecx]
mov edx, dword [eax + 0x68]
mov dword [ecx + 0x68], edx
mov al, byte [eax + 0x6c]
push 0
mov byte [ecx + 0x6c], al
mov ecx, dword [ebp + 8]
push edi
push ecx
call fcn.1019fb10
mov esi, eax
test esi, esi
jl 0x1016d58a
mov eax, dword [edi + 0x3c]
mov edx, eax
and edx, 0xfff00000
cmp edx, 0x50000000
jne 0x1016d06f
and eax, 0xfffff
cmp eax, 1
jne 0x1016d06f
mov dword [edi + 0x3c], 0x20500001
mov eax, dword [edi + 0xc]
mov ecx, dword [eax]
mov edx, dword [edi + 0x10]
inc dword [ebp - 0x24]
mov dword [ecx + 0xc], edx
mov eax, dword [edi + 0xc]
mov ecx, dword [eax]
mov dword [ecx + 0x88], edi
mov ecx, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x38]
inc ecx
mov dword [ebp - 0x1c], ecx
cmp ecx, edi
jb 0x1016c713
cmp dword [ebp - 0x24], 0
je 0x1016d3c1
mov eax, dword [ebp - 0x24]
cmp eax, 2
jne 0x1016d111
mov eax, dword [ebp + 8]
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x20400001
lea edx, [ebp - 0x4c]
push edx
push eax
call fcn.10169e20
mov esi, eax
test esi, esi
jl 0x1016d58a
xor edx, edx
mov edi, edi
mov ecx, dword [ebp + edx*4 - 0x9c]
mov ecx, dword [ecx + 0x88]
mov eax, dword [ecx + 0x3c]
mov esi, eax
and esi, 0xfff00000
cmp esi, 0x10000000
jne 0x1016d106
and eax, 0xfffff
cmp eax, 1
jne 0x1016d106
mov eax, dword [ecx + 4]
mov ecx, dword [eax]
mov dword [ebp + edx*4 - 0x9c], ecx
inc edx
cmp edx, 2
jb 0x1016d0d0
jmp 0x1016d313
jbe 0x1016d2ed
mov edx, dword [ebp + 8]
test byte [edx + 0x7fcc], 2
je 0x1016d2ed
mov ebx, 1
cmp eax, ebx
jbe 0x1016d3c1
mov ecx, dword [ebp + 8]
inc dword [ebp - 0x2c]
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x20400001
lea eax, [ebp - 0x4c]
push eax
push ecx
call fcn.10169e20
mov esi, eax
test esi, esi
jl 0x1016d58a
mov eax, dword [ebp - 0x14]
mov edx, dword [eax + 0x34]
mov edi, dword [ebp - 0x4c]
mov dword [edi + 0x34], edx
mov ecx, dword [eax + 0x38]
mov dword [edi + 0x38], ecx
mov edx, dword [edi + 4]
mov ecx, dword [ebp + ebx*4 - 0xa0]
mov dword [edx], ecx
mov edx, dword [edi + 4]
lea ecx, [ebp + ebx*4 - 0x9c]
inc ebx
mov dword [ebp - 0x30], ecx
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
mov dword [ebp - 0x70], ebx
cmp ebx, dword [ebp - 0x24]
jae 0x1016d2a6
mov eax, dword [0x101e316c]
mov edx, dword [ebp + 8]
mov ebx, dword [edx + 0x8040]
test eax, eax
jge 0x1016d1aa
xor eax, eax
jmp 0x1016d1b1
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [eax + 0xc], 0
je 0x1016d1d8
mov ecx, dword [eax + 0xc]
test ecx, ecx
jne 0x1016d1c2
mov esi, ecx
jmp 0x1016d1e9
mov edx, dword [ecx]
mov dword [eax + 0xc], edx
test edx, edx
jne 0x1016d1ce
mov dword [eax + 0x10], edx
mov dword [ecx], 0xfefefefe
mov esi, ecx
jmp 0x1016d1e9
mov ecx, dword [eax + 8]
push 0x10
push pe_nt_image_headers32
call fcn.101d8457
mov esi, eax
xor eax, eax
cmp esi, eax
je 0x1016d23a
push eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 0x94], eax
mov dword [esi + 0x98], eax
mov dword [esi + 0x24], eax
mov eax, dword [ebp - 0x2c]
push eax
or ecx, 0xffffffff
push ebx
mov eax, esi
mov dword [esi + 0x50], ecx
mov dword [esi + 0x48], ecx
call fcn.10165570
mov ebx, eax
test ebx, ebx
jl 0x1016d241
mov edi, dword [ebp + 8]
push 0
mov ebx, esi
call fcn.10169830
mov ebx, eax
test ebx, ebx
jl 0x1016d241
mov ecx, dword [ebp - 0x30]
xor ebx, ebx
mov dword [ecx], esi
jmp 0x1016d288
mov ebx, 0x8007000e
jmp 0x1016d28d
mov edi, esi
call fcn.101654a0
mov eax, dword [0x101e316c]
test eax, eax
jge 0x1016d255
xor edi, edi
jmp 0x1016d25e
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
push pe_nt_image_headers32
push 0xfe
push esi
call sub.msvcrt.dll_memset
mov dword [esi], 0
mov eax, dword [edi + 0x10]
add esp, 0xc
test eax, eax
je 0x1016d282
mov dword [eax], esi
jmp 0x1016d285
mov dword [edi + 0xc], esi
mov dword [edi + 0x10], esi
mov edi, dword [ebp - 0x4c]
xor eax, eax
cmp ebx, eax
mov esi, ebx
jl 0x1016d58a
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax]
mov edx, dword [edi + 0xc]
mov eax, dword [ebp - 0x14]
mov dword [edx], ecx
jmp 0x1016d2b0
mov edx, dword [eax + 0xc]
mov ecx, dword [edi + 0xc]
mov edx, dword [edx]
mov dword [ecx], edx
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ecx, dword [edi + 0xc]
mov edx, dword [eax + 0x68]
mov ecx, dword [ecx]
mov ebx, dword [ebp - 0x70]
mov dword [ecx + 0x68], edx
mov al, byte [eax + 0x6c]
mov byte [ecx + 0x6c], al
mov ecx, dword [edi + 0xc]
mov edx, dword [ecx]
mov eax, dword [edi + 0x10]
mov dword [edx + 0xc], eax
mov ecx, dword [edi + 0xc]
mov edx, dword [ecx]
mov dword [edx + 0x88], edi
cmp ebx, dword [ebp - 0x24]
jb 0x1016d134
jmp 0x1016d3c1
mov ecx, dword [ebp + 8]
push 0xffffffffffffffff
and eax, 0xfffff
push 0xffffffffffffffff
or eax, 0x50000000
push eax
lea eax, [ebp - 0x4c]
push eax
push ecx
call fcn.10169e20
mov esi, eax
test esi, esi
jl 0x1016d58a
mov edi, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x14]
mov edx, dword [eax + 0x34]
mov esi, dword [ebp - 0x24]
mov dword [edi + 0x34], edx
mov ecx, dword [eax + 0x38]
mov dword [edi + 0x38], ecx
mov edx, dword [eax + 0xc]
mov ecx, dword [edx]
mov eax, dword [edi + 0xc]
mov dword [eax], ecx
mov edx, dword [edi + 0xc]
mov eax, dword [edx]
mov ecx, dword [edi + 0x10]
mov dword [eax + 0xc], ecx
mov edx, dword [edi + 0xc]
mov eax, dword [edx]
lea ebx, [esi*4]
push ebx
lea ecx, [ebp - 0x9c]
mov dword [eax + 0x88], edi
mov edx, dword [edi + 4]
push ecx
push edx
call sub.msvcrt.dll_memcpy
add esp, 0xc
cmp esi, 2
je 0x1016d3be
mov edx, dword [ebp - 0x74]
cmp edx, 0xffffffff
jne 0x1016d3a1
mov eax, dword [ebp + 8]
fld1
mov ecx, dword [eax + 0x8024]
sub esp, 8
fstp qword [esp]
push ecx
lea edx, [ebp - 0x74]
push edx
push eax
mov eax, 4
call fcn.10169cc0
mov esi, eax
test esi, esi
jl 0x1016d58a
mov edx, dword [ebp - 0x74]
mov esi, dword [ebp - 0x24]
test esi, esi
jbe 0x1016d3be
mov eax, ebx
mov ecx, esi
lea esp, [esp]
mov esi, dword [edi + 4]
mov dword [eax + esi], edx
add eax, 4
sub ecx, 1
jne 0x1016d3b0
inc dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x10]
inc ecx
mov dword [ebp - 0x10], ecx
cmp ecx, eax
jb 0x1016d3e0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], eax
mov ecx, eax
jmp 0x1016d3e9
mov eax, dword [edx + 0x14]
mov edx, dword [eax + ecx*4]
mov dword [ebp - 0x14], edx
cmp ecx, dword [ebp - 0x50]
jb 0x1016c2d0
mov edi, dword [ebp + 8]
mov edx, dword [edi + 0x10]
xor ebx, ebx
cmp edx, ebx
jbe 0x1016d405
mov eax, dword [edi + 0x14]
mov eax, dword [eax]
jmp 0x1016d407
xor eax, eax
mov esi, dword [ebp - 0x50]
xor ecx, ecx
cmp esi, ebx
jbe 0x1016d434
cmp ecx, edx
jae 0x1016d434
mov dword [eax + 0x3c], ebx
mov dword [eax], ebx
mov dword [eax + 8], ebx
mov edx, dword [edi + 0x10]
inc ecx
cmp ecx, edx
jb 0x1016d42a
xor eax, eax
mov ecx, edx
jmp 0x1016d430
mov eax, dword [edi + 0x14]
mov eax, dword [eax + ecx*4]
cmp ecx, esi
jb 0x1016d410
mov eax, dword [edi + 0x10]
cmp eax, ebx
jbe 0x1016d442
mov ecx, dword [edi + 0x14]
mov edi, dword [ecx]
jmp 0x1016d444
xor edi, edi
mov dword [ebp - 0x10], ebx
cmp eax, ebx
jbe 0x1016d518
nop
test dword [edi + 0x3c], 0xf0000000
je 0x1016d4f0
xor ebx, ebx
nop
mov ecx, dword [edi + 0x3c]
mov edx, ecx
and edx, 0xf0000000
cmp edx, 0xb0000000
jne 0x1016d47a
mov ecx, 1
jmp 0x1016d499
mov eax, ecx
and eax, 0xfff00000
cmp eax, 0x68700000
je 0x1016d48f
cmp eax, 0x68800000
jne 0x1016d493
mov ecx, dword [edi]
jmp 0x1016d499
and ecx, 0xfffff
mov eax, ecx
imul eax, ebx
lea edx, [ecx + eax]
cmp edx, dword [edi]
ja 0x1016d4cf
mov edx, dword [edi + 4]
lea edx, [edx + eax*4]
test ecx, ecx
je 0x1016d4cf
xor eax, eax
test ecx, ecx
jbe 0x1016d4cc
mov esi, dword [edx]
cmp dword [edx + eax*4], esi
je 0x1016d4c7
mov byte [esi + 0x28], 1
mov esi, dword [edx + eax*4]
mov byte [esi + 0x28], 1
inc eax
cmp eax, ecx
jb 0x1016d4b5
inc ebx
jmp 0x1016d460
mov ecx, dword [edi + 8]
cmp ecx, 1
jbe 0x1016d4f0
xor eax, eax
test ecx, ecx
jbe 0x1016d4f0
lea ecx, [ecx]
mov ecx, dword [edi + 0xc]
mov edx, dword [ecx + eax*4]
inc eax
mov byte [edx + 0x28], 1
cmp eax, dword [edi + 8]
jb 0x1016d4e0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x10]
inc ecx
mov dword [ebp - 0x10], ecx
cmp ecx, eax
jb 0x1016d50a
mov ecx, eax
xor edi, edi
mov dword [ebp - 0x10], ecx
jmp 0x1016d510
mov edx, dword [edx + 0x14]
mov edi, dword [edx + ecx*4]
cmp ecx, eax
jb 0x1016d450
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x8040]
mov eax, dword [eax + 0x24]
mov ecx, dword [ebp - 0x2c]
test eax, eax
je 0x1016d54a
mov edx, dword [ebp - 0x88]
mov esi, dword [eax + 0x60]
cmp dword [edx + esi*4], 1
jbe 0x1016d544
cmp byte [eax + 0x28], 0
jne 0x1016d544
mov dword [eax + 0x60], ecx
inc ecx
mov eax, dword [eax]
test eax, eax
jne 0x1016d531
mov edi, dword [ebp + 8]
mov edx, dword [edi + 0x807c]
mov eax, dword [ebp - 0x60]
mov dword [edx + 0x10], eax
mov edx, dword [edi + 0x8040]
push edi
mov dword [edx + 0x10], ecx
call fcn.101772a0
mov esi, eax
test esi, esi
jl 0x1016d58a
push edi
call fcn.1016a7f0
mov esi, eax
test esi, esi
jl 0x1016d58a
push edi
call fcn.10178610
test eax, eax
je 0x1016d588
mov esi, eax
jl 0x1016d58a
xor esi, esi
mov edi, dword [ebp + 8]
mov eax, dword [ebp - 0x7c]
add edi, 0x814c
cmp dword [ebp - 0x88], 0
je 0x1016d5c6
test eax, eax
ja 0x1016d5a8
mov eax, 1
mov ebx, dword [edi]
cmp eax, dword [ebx + 8]
jae 0x1016d5bd
sub dword [ebx + 8], eax
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebx]
mov dword [edi], eax
call fcn.100daed0
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4