;
; +-------------------------------------------------------------------------+
; |	This file is generated by The Interactive Disassembler (IDA)	    |
; |	Copyright (c) 2007 by DataRescue sa/nv,	<ida@datarescue.com>	    |
; | Licensed to: 48-377D-7114-93 SRI International, 1 computer,	std, 11/2007 |
; +-------------------------------------------------------------------------+
;
;
; +-------------------------------------------------------------------------+
; |	This file is generated by The Interactive Disassembler (IDA)	    |
; |	Copyright (c) 2007 by DataRescue sa/nv,	<ida@datarescue.com>	    |
; | Licensed to: 48-377D-7114-93 SRI International, 1 computer,	std, 11/2007 |
; +-------------------------------------------------------------------------+
;
; Input	MD5   :	FC30B25C46930AF1C4957B97E886B42F

; File Name   :	u:\work\fc30b25c46930af1c4957b97e886b42f_orig.exe
; Format      :	Portable executable for	80386 (PE)
; Imagebase   :	1000000
; Section 1. (virtual address 00001000)
; Virtual size			: 00003310 (  13072.)
; Section size in file		: 00003400 (  13312.)
; Offset to raw	data for section: 00000600
; Flags	60000020: Text Executable Readable
; Alignment	: default

		include	uni.inc	; see unicode subdir of	ida for	info on	unicode

		.686p
		.mmx
		.model flat

; ===========================================================================

; Segment type:	Pure code
; Segment permissions: Read/Execute
_text		segment	para public 'CODE' use32
		assume cs:_text
		;org 1001000h
		assume es:nothing, ss:nothing, ds:_data, fs:nothing, gs:nothing
		dd 77D982ACh, 77D92985h, 77D9858Eh, 77D97D4Dh, 77D92C54h
					; DATA XREF: .text:0100164Br
dword_1001014	dd 77DA9694h						; sub_1001DEB+6Br ...
		dd 0
dword_100101C	dd 77E7B0BBh, 77E74CA6hdword_1001024	dd 77E7C37Ah	dword_1001028	dd 77F877E0h	dword_100102C	dd 77E7C4E4h	dword_1001030	dd 77E6670Dh	dword_1001034	dd 77E66F37h	dword_1001038	dd 77E6668Ch						; .text:loc_1001762r ...
dword_100103C	dd 77E68778h	dword_1001040	dd 77E6B217h						; sub_10018DB+B4r ...
dword_1001044	dd 77E68D0Fh						; sub_10019F0+14r
dword_1001048	dd 77E65304h	dword_100104C	dd 77F8AA7Dh						; .text:01001DC1r ...
dword_1001050	dd 77FC9C41h	dword_1001054	dd 77E6A6C8h						; sub_1001E73+9Er ...
dword_1001058	dd 77F8AA4Ch						; sub_1002219+13r ...
		dd 77E74A02h, 77E7E673h, 77FC976Bh, 77E7310Fh
dword_100106C	dd 77E64B74h						; sub_100205A+4Er
		dd 77F89789h
dword_1001074	dd 77E7CFC6h			dd 0
		dd 78001DEAh, 78003E70h, 7800B426h, 78014EE9h
dword_100108C	dd 78014DABh	dword_1001090	dd 7801D884h	dword_1001094	dd 78001000h						; sub_100205A+93r ...
dword_1001098	dd 78001EC9h	dword_100109C	dd 78012188h	dword_10010A0	dd 780010EDh						; sub_1001F54+47r ...
dword_10010A4	dd 7802A875h						; sub_1001DEB+8r
dword_10010A8	dd 78017A09h, 7800C9ACh, 78017E4Bh, 78022AA9h					; .text:0100180Cr ...
dword_10010B8	dd 7802A38Bh						; sub_1001DEB+19r
		dd 78003C1Eh, 7800F56Ah, 78003E5Ah, 78003E64h, 78003E6Ah
		dd 7803BB70h, 78025147h, 7800BB9Eh, 7800F7DCh, 7800B908h
		dd 7801D1CFh, 78014B25h, 7800269Eh, 0
dword_10010F4	dd 74FB1311h	dword_10010F8	dd 74FB2B3Ch						; sub_100205A:loc_100209Dr ...
dword_10010FC	dd 74FB4A6Ah	dword_1001100	dd 74FB5502h	dword_1001104	dd 74FB2B57h						; .text:01002406r ...
		dd 74FBD027h
dword_100110C	dd 74FB2B57h						; sub_1002B5E+2r ...
; ---------------------------------------------------------------------------
		retf
; ---------------------------------------------------------------------------
		db 0ACh, 0FBh, 74h
		dd 74FB125Ah
dword_1001118	dd 74FB894Bh	dword_100111C	dd 74FB3284h						; sub_100205A+E7r ...
dword_1001120	dd 74FB5413h						; .text:01002F95r
dword_1001124	dd 74FB3A14h	dword_1001128	dd 74FB90C0h			dd 74FB3832h
dword_1001130	dd 74FB306Fh						; .text:01002AA2r ...
		align 8
		dd 77307866h, 773025A3h, 0
dword_1001144	dd 77F82A70h			dd 77F8A557h, 77FB6307h
dword_1001150	dd 77F92A89h	dword_1001154	dd 77F97C81h						; sub_1002B5E+114r ...
dword_1001158	dd 77F816E4h						; .text:01002B3Ar ...
dword_100115C	dd 77F8F1D6h, 77F9431Dh, 77F936B1h					; .text:01002459r ...
dword_1001168	dd 77F912B1h						; sub_1002901+35r
		dd 77F8F73Ch
dword_1001170	dd 77F979C8h	dword_1001174	dd 77F8D7C7h						; sub_10018DB+D6r
dword_1001178	dd 77F975A5h			dd 2 dup(0)
		dd 37ECADD7h, 0
		dd 4, 110h, 0
		dd 4C00h, 0
		dd 37ECADD7h, 0
		dd 3, 310h, 0
		dd 4D10h, 0
		dd 37ECADD7h, 0
		dd 6, 2	dup(0)
		dd 5020h, 0
		dd 37ECADD7h, 0
		dd 2, 1Ah, 0
		db 90h
		db 0FEh, 0A7h, 0FFh
aDNtPrivateNetS	db 'D:\nt\private\net\sockets\tcpsvcs\tftpd\tftpd.c built Sep 24 1999'
		db ' 22:17:18',0Ah,0
aOWritableFiles	db ' o writable files keyname "%s"',0Ah,0 ; DATA XREF: .text:01001634o
aWritable	db 'writable',0         ; DATA XREF: .text:0100162Fo
		align 4
aOReadableFiles	db ' o Readable files keyname "%s"',0Ah,0 ; DATA XREF: .text:01001626o
aReadable	db 'readable',0         ; DATA XREF: .text:01001621o
		align 4
aOValidmastersK	db ' o ValidMasters   keyname "%s"',0Ah,0 ; DATA XREF: .text:01001618o
aMasters	db 'masters',0          ; DATA XREF: .text:01001613o
aOValidclientsK	db ' o ValidClients   keyname "%s"',0Ah,0 ; DATA XREF: .text:0100160Ao
aClients	db 'clients',0          ; DATA XREF: .text:01001605o
aTheseKeysAreSh	db 'These keys are shell patterns with * and ? (see examples above):',0Ah
					; DATA XREF: .text:010015FDo
		db 0
		align 4
aOStartdirector	db ' o StartDirectory keyname "%s"',0Ah,0 ; DATA XREF: .text:010015F4o
aDirectory	db 'directory',0        ; DATA XREF: .text:010015EFo
		align 4
aRegistryKeyNam	db 'Registry key names, all strings: HKEY_LOCAL_MACHINE %s',0Ah,0
					; DATA XREF: .text:010015E6o
aSystemCurrentc	db 'System\CurrentControlSet\Services\tftpd\parameters',0
					; DATA XREF: .text:010015E1o
		align 10h
aTftpd_logfileI	db ' TFTPD_LOGFILE     is %s',0Ah ; DATA XREF: .text:010015D8o
		db 0Ah,0
		align 4
aTftpd_log	db 'tftpd.log',0        ; DATA XREF: .text:010015D3o
					; .text:0100183Bo
		align 4
aTftpd_default_	db ' TFTPD_DEFAULT_DIR is %s',0Ah,0 ; DATA XREF: .text:010015CAo
		align 4
aTftpdroot	db '\tftpdroot\',0      ; DATA XREF: .text:010015C5o
a?		db '-?',0               ; DATA XREF: .text:01001580o
		align 4
aA		db 'a+',0               ; DATA XREF: .text:01001836o
		align 4
aTftp		db 'tftp',0             ; DATA XREF: sub_100205A+31o
		align 10h
aUdp		db 'udp',0              ; DATA XREF: sub_100205A+2Co
aOptionNegotiat	db 'Option negotiation failure',0
		align 10h
aNoSuchUser	db 'No such user',0
		align 10h
aFileAlreadyExi	db 'File already exists',0
aUnknownTransfe	db 'Unknown transfer ID',0
aIllegalTftpOpe	db 'Illegal TFTP operation',0
		align 10h
aDiskFullOrAllo	db 'Disk full or allocation exceeded',0
		align 4
aAccessViolatio	db 'Access violation',0
		align 4
aFileNotFound	db 'File not found',0
		align 4
aErrorUndefined	db 'Error undefined',0
aTsize		db 'tsize',0            ; DATA XREF: .text:loc_100251Ao
		align 10h
aTimeout_0	db 'timeout',0          ; DATA XREF: .text:loc_1002498o
aBlksize	db 'blksize',0          ; DATA XREF: .text:01002426o
aTimeout	db 'Timeout',0          ; DATA XREF: .text:01002B0Fo
aInsufficientRe	db 'Insufficient resources',0
		align 10h
aFileNameTooLon	db 'File name too long',0
		align 4
aMalformedFileN	db 'Malformed file name',0
aOctet		db 'octet',0
		align 10h
aNetascii	db 'netascii',0         ; DATA XREF: .text:01002FD0o
		align 4
		unicode	0, <\>,0
		dd 0FFFFFFFFh, 1003B5Eh, 1003B73h, 0
; ---------------------------------------------------------------------------
		cmp	dword ptr [esp+4], 1
		push	esi
		jle	loc_1001646
		mov	eax, [esp+0Ch]
		mov	esi, offset a?	; "-?"
		mov	eax, [eax+4]


loc_1001588:				; CODE XREF: .text:010015A4j
		mov	dl, [eax]
		mov	cl, dl
		cmp	dl, [esi]
		jnz	short loc_10015AA
		test	cl, cl
		jz	short loc_10015A6
		mov	dl, [eax+1]
		mov	cl, dl
		cmp	dl, [esi+1]
		jnz	short loc_10015AA
		inc	eax
		inc	eax
		inc	esi
		inc	esi
		test	cl, cl
		jnz	short loc_1001588


loc_10015A6:				; CODE XREF: .text:01001592j
		xor	eax, eax
		jmp	short loc_10015AF
; ---------------------------------------------------------------------------


loc_10015AA:				; CODE XREF: .text:0100158Ej
					; .text:0100159Cj
		sbb	eax, eax
		sbb	eax, 0FFFFFFFFh


loc_10015AF:				; CODE XREF: .text:010015A8j
		test	eax, eax
		jnz	loc_1001646
		mov	esi, ds:dword_10010BC+18h
		push	offset dword_1005010
		call	esi
		pop	ecx
		push	offset aTftpdroot ; "\\tftpdroot\\"
		push	offset aTftpd_default_ ; " TFTPD_DEFAULT_DIR is	%s\n"
		call	esi
		pop	ecx
		pop	ecx
		push	offset aTftpd_log ; "tftpd.log"
		push	offset aTftpd_logfileI ; " TFTPD_LOGFILE     is	%s\n\n"
		call	esi
		pop	ecx
		pop	ecx
		push	offset aSystemCurrentc ; "System\\CurrentControlSet\\Services\\tftpd"...
		push	offset aRegistryKeyNam ; "Registry key names, all strings: HKEY_L"...
		call	esi
		pop	ecx
		pop	ecx
		push	offset aDirectory ; "directory"
		push	offset aOStartdirector ; " o StartDirectory keyname \"%s\"\n"
		call	esi
		pop	ecx
		pop	ecx
		push	offset aTheseKeysAreSh ; "These	keys are shell patterns	with * an"...
		call	esi
		pop	ecx
		push	offset aClients	; "clients"
		push	offset aOValidclientsK ; " o ValidClients   keyname \"%s\"\n"
		call	esi
		pop	ecx
		pop	ecx
		push	offset aMasters	; "masters"
		push	offset aOValidmastersK ; " o ValidMasters   keyname \"%s\"\n"
		call	esi
		pop	ecx
		pop	ecx
		push	offset aReadable ; "readable"
		push	offset aOReadableFiles ; " o Readable files keyname \"%s\"\n"
		call	esi
		pop	ecx
		pop	ecx
		push	offset aWritable ; "writable"
		push	offset aOWritableFiles ; " o writable files keyname \"%s\"\n"
		call	esi
		pop	ecx
		pop	ecx
		push	0FFFFFFFFh
		call	ds:dword_10010BC+30h
		pop	ecx


loc_1001646:				; CODE XREF: .text:01001576j
					; .text:010015B1j
		push	offset dword_1005CB0
		call	ds:dword_1001000+4
		test	eax, eax
		jnz	short loc_100165B
		call	ds:dword_1001038


loc_100165B:				; CODE XREF: .text:01001653j
		push	0
		call	ds:dword_100101C
		pop	esi
		retn
; ---------------------------------------------------------------------------
		push	ebx
		push	ebp
		push	esi
		push	edi
		xor	ebp, ebp
		push	offset sub_1001DEB
		push	offset dword_1005CA8
		mov	dword_1006120, 30h
		mov	dword_1006124, 2
		mov	dword_1006128, ebp
		mov	dword_1006134, 1
		mov	dword_1006138, 4E20h
		mov	dword_100612C, ebp
		mov	dword_1006130, ebp
		call	ds:dword_1001000+10h
		cmp	eax, ebp
		mov	dword_1006044, eax
		jz	loc_1001762
		mov	esi, ds:dword_1001014
		mov	edi, offset dword_1006120
		push	edi
		push	eax
		call	esi ; dword_1001014
		cmp	eax, ebp
		jz	loc_1001762
		mov	ebx, ds:dword_1001040
		push	ebp
		push	ebp
		push	ebp
		push	ebp
		call	ebx ; dword_1001040
		push	ebp
		push	ebp
		push	ebp
		push	ebp
		mov	dword_1005DDC, eax
		call	ebx ; dword_1001040
		cmp	dword_1005DDC, ebp
		mov	dword_1005DE0, eax
		jz	short loc_100171C
		cmp	eax, ebp
		jz	short loc_100171C
		push	offset dword_1006140
		push	101h
		call	ds:dword_10010FC
		cmp	eax, 0FFFFFFFFh
		jnz	short loc_1001735
		call	ds:dword_10010F8


loc_100171C:				; CODE XREF: .text:010016FBj
					; .text:010016FFj ...
		push	1Fh
		call	sub_1001E73
		push	1
		call	ds:dword_10010BC+30h
		pop	ecx


loc_100172C:				; CODE XREF: .text:0100187Dj
					; .text:01001889j
		pop	edi
		pop	esi
		pop	ebp
		xor	eax, eax
		pop	ebx
		retn	8
; ---------------------------------------------------------------------------


loc_1001735:				; CODE XREF: .text:01001714j
		push	edi
		mov	dword_1006124, 4
		push	dword_1006044
		mov	dword_1006128, 7
		mov	dword_1006134, ebp
		mov	dword_1006138, ebp
		call	esi ; dword_1001014
		cmp	eax, ebp
		jnz	short loc_100176A


loc_1001762:				; CODE XREF: .text:010016BCj
					; .text:010016D3j
		call	ds:dword_1001038
		jmp	short loc_100171C
; ---------------------------------------------------------------------------


loc_100176A:				; CODE XREF: .text:01001760j
		push	9
		pop	ecx
		xor	eax, eax
		mov	edx, offset dword_10060C0
		mov	edi, edx
		rep stosd
		push	edx
		call	ds:dword_10010A4
		pop	ecx
		mov	edx, [esp+14h]
		dec	edx
		mov	ebx, offset dword_1005E08
		jz	short loc_10017F3
		mov	eax, [esp+18h]
		lea	eax, [eax+edx*4]
		mov	[esp+14h], eax


loc_1001797:				; CODE XREF: .text:010017F1j
		mov	eax, [esp+14h]
		mov	eax, [eax]
		cmp	byte ptr [eax],	2Dh
		jnz	short loc_10017F3
		movsx	ecx, byte ptr [eax+1]
		sub	ecx, 64h
		jz	short loc_10017C9
		dec	ecx
		jz	short loc_10017BD
		dec	ecx
		jnz	short loc_10017E9
		mov	dword_1005DD8, 1
		jmp	short loc_10017E9
; ---------------------------------------------------------------------------


loc_10017BD:				; CODE XREF: .text:010017ACj
		mov	dword_1005DD4, 1
		jmp	short loc_10017E9
; ---------------------------------------------------------------------------


loc_10017C9:				; CODE XREF: .text:010017A9j
		lea	edi, [eax+2]
		or	ecx, 0FFFFFFFFh
		xor	eax, eax
		repne scasb
		not	ecx
		sub	edi, ecx
		mov	eax, ecx
		mov	esi, edi
		mov	edi, ebx
		shr	ecx, 2
		rep movsd
		mov	ecx, eax
		and	ecx, 3
		rep movsb


loc_10017E9:				; CODE XREF: .text:010017AFj
					; .text:010017BBj ...
		sub	dword ptr [esp+14h], 4
		dec	edx
		cmp	edx, ebp
		ja	short loc_1001797


loc_10017F3:				; CODE XREF: .text:0100178Aj
					; .text:010017A0j
		call	near ptr byte_10037BF
		call	near ptr dword_1003910
		mov	esi, ds:dword_10010A8
		push	ebx
		call	esi ; dword_10010A8
		cmp	eax, 0FFFFFFFFh
		pop	ecx
		jnz	short loc_100182E
		call	ds:dword_10010A8+4
		push	ebx
		call	ds:dword_10010A8+8
		cmp	eax, ebp
		pop	ecx
		jnz	loc_100171C
		push	ebx
		call	esi ; dword_10010A8
		cmp	eax, ebp
		pop	ecx
		jnz	loc_100171C


loc_100182E:				; CODE XREF: .text:0100180Aj
		cmp	dword_1005DD8, ebp
		jz	short loc_1001857
		push	offset aA	; "a+"
		push	offset aTftpd_log ; "tftpd.log"
		call	ds:dword_10010A8+0Ch
		pop	ecx
		cmp	eax, ebp
		pop	ecx
		mov	dword_1005DD0, eax
		jnz	short loc_1001857
		mov	dword_1005DD8, ebp


loc_1001857:				; CODE XREF: .text:01001834j
					; .text:0100184Fj
		push	offset dword_10060C0
		call	ds:dword_10010B8
		pop	ecx
		call	sub_10018DB
		call	sub_10019F0
		push	0FFFFFFFFh
		push	dword_1005DDC
		call	ds:dword_100103C
		cmp	eax, ebp
		jz	loc_100172C
		call	ds:dword_1001038
		jmp	loc_100172C

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_100188E	proc near		; CODE XREF: sub_100205A+D5p

var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= byte ptr  10h

		push	ebp
		mov	ebp, esp
		push	ecx
		push	3
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		call	ds:dword_1001100
		test	eax, eax
		jz	short loc_10018AE
		call	ds:dword_1001038
		xor	eax, eax
		jmp	short locret_10018D7
; ---------------------------------------------------------------------------


loc_10018AE:				; CODE XREF: sub_100188E+14j
		test	[ebp+arg_8], 1
		push	0
		push	0FFFFFFFFh
		push	[ebp+arg_0]
		jz	short loc_10018C2
		push	offset dword_1001D74
		jmp	short loc_10018C7
; ---------------------------------------------------------------------------


loc_10018C2:				; CODE XREF: sub_100188E+2Bj
		push	offset byte_1001DDB


loc_10018C7:				; CODE XREF: sub_100188E+32j
		push	[ebp+arg_4]
		lea	eax, [ebp+var_4]
		push	eax
		call	ds:dword_1001174
		mov	eax, [ebp+var_4]

locret_10018D7:				; CODE XREF: sub_100188E+1Ej
		leave
		retn	0Ch
sub_100188E	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_10018DB	proc near		; CODE XREF: .text:01001863p

var_4		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		push	ecx
		push	ebx
		push	esi
		mov	esi, ds:dword_1001044
		push	edi
		push	offset dword_1006080
		call	esi ; dword_1001044
		push	offset dword_1006020
		call	esi ; dword_1001044
		mov	eax, offset dword_1006098
		mov	dword_100609C, eax
		mov	dword_1006098, eax
		mov	eax, offset dword_1006038
		mov	dword_100603C, eax
		mov	dword_1006038, eax
		lea	eax, [ebp+var_4]
		push	eax
		call	sub_1001FA6
		xor	esi, esi
		test	eax, eax
		jnz	short loc_1001957
		mov	eax, [ebp+var_4]
		xor	ebx, ebx
		cmp	[eax], esi
		jbe	short loc_100194F
		xor	edi, edi


loc_100192E:				; CODE XREF: sub_10018DB+72j
		mov	ecx, [eax+edi+4]
		cmp	ecx, esi
		jz	short loc_1001947
		cmp	ecx, 100007Fh
		jz	short loc_1001947
		push	ecx
		call	sub_100205A
		mov	eax, [ebp+var_4]


loc_1001947:				; CODE XREF: sub_10018DB+59j
					; sub_10018DB+61j
		inc	ebx
		add	edi, 18h
		cmp	ebx, [eax]
		jb	short loc_100192E


loc_100194F:				; CODE XREF: sub_10018DB+4Fj
		push	eax
		call	ds:dword_10010A0
		pop	ecx


loc_1001957:				; CODE XREF: sub_10018DB+46j
		push	offset dword_10060A0
		call	ds:dword_1001170
		cmp	eax, esi
		jnz	loc_10019EB
		mov	eax, 0EA60h
		push	esi
		push	eax
		push	eax
		push	esi
		push	offset sub_10029BA
		push	offset dword_1006048
		push	dword_10060A0
		call	ds:dword_1001178
		push	esi
		push	esi
		push	esi
		push	esi
		mov	edi, eax
		call	ds:dword_1001040
		cmp	eax, esi
		mov	dword_1005DF8, eax
		jnz	short loc_10019A2
		mov	eax, edi
		jmp	short loc_10019EB
; ---------------------------------------------------------------------------


loc_10019A2:				; CODE XREF: sub_10018DB+C1j
		push	esi
		push	0FFFFFFFFh
		push	esi
		push	offset sub_1002219
		push	eax
		push	offset dword_1005DFC
		call	ds:dword_1001174
		cmp	eax, esi
		jnz	short loc_10019EB
		mov	ecx, offset dword_1006100
		xor	eax, eax
		mov	edi, ecx
		push	ecx
		stosd
		stosd
		stosd
		stosd
		stosd
		mov	eax, dword_1005DF8
		push	offset dword_1005E00
		mov	dword_1006110, eax
		call	near ptr dword_1003A44
		cmp	eax, esi
		jz	short loc_10019E9
		cmp	eax, 3E5h
		jnz	short loc_10019EB


loc_10019E9:				; CODE XREF: sub_10018DB+105j
		xor	eax, eax


loc_10019EB:				; CODE XREF: sub_10018DB+89j
					; sub_10018DB+C5j ...
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_10018DB	endp


; =============== S U B	R O U T	I N E =======================================



sub_10019F0	proc near		; CODE XREF: .text:01001868p
		mov	eax, offset dword_1006078
		push	offset dword_1006060
		mov	dword_100607C, eax
		mov	dword_1006078, eax
		call	ds:dword_1001044
		push	0
		push	0EFD1Ch
		push	0
		call	ds:dword_1001048
		mov	dword_1005DEC, eax
		retn
sub_10019F0	endp


; =============== S U B	R O U T	I N E =======================================



sub_1001A1F	proc near		; CODE XREF: sub_10029BA+79p
		push	ebx
		push	esi
		mov	ebx, offset dword_1006060
		push	edi
		push	ebx
		xor	esi, esi
		call	ds:dword_1001058
		mov	eax, dword_1005DF0
		sub	eax, dword_1005DF4
		cmp	eax, 0Ah
		jbe	short loc_1001A46
		shr	eax, 1
		mov	esi, eax
		jmp	short loc_1001A4E
; ---------------------------------------------------------------------------


loc_1001A46:				; CODE XREF: sub_1001A1F+1Fj
		cmp	eax, 3
		jbe	short loc_1001A4E
		push	2
		pop	esi


loc_1001A4E:				; CODE XREF: sub_1001A1F+25j
					; sub_1001A1F+2Aj
		test	esi, esi
		jbe	short loc_1001A86
		mov	edi, esi


loc_1001A54:				; CODE XREF: sub_1001A1F+65j
		mov	eax, dword_1006078
		mov	esi, eax
		mov	ecx, [eax]
		mov	eax, [eax+4]
		mov	[eax], ecx
		mov	[ecx+4], eax
		push	dword ptr [esi+30h]
		call	ds:dword_1001054
		push	esi
		push	0
		push	dword_1005DEC
		call	ds:dword_1001050
		dec	dword_1005DF0
		dec	edi
		jnz	short loc_1001A54


loc_1001A86:				; CODE XREF: sub_1001A1F+31j
		push	ebx
		call	ds:dword_100104C
		pop	edi
		pop	esi
		pop	ebx
		retn
sub_1001A1F	endp

; ---------------------------------------------------------------------------
		db 0B8h, 4, 0
		dd 0A3E80001h, 5300001Fh, 56ED3355h, 246C8957h,	6060BB10h
		dd 448D0100h, 68501424h, 4004667Fh, 2024B4FFh, 0FF000100h
		dd 111415h, 0FC53B01h, 25E85h, 246C3900h, 92840F14h, 33000002h
		dd 247C8DC0h, 0ABABAB30h, 0FFAB53ABh, 105815h, 6078A101h
		dd 5FF0100h, 1005DF4h, 60783Dh,	8B1A7401h, 8BF08B08h, 8890440h
		dd 0FF044189h, 15FF3076h, 1001068h, 0EB30468Bh,	0F005FF30h
		dd 6801005Dh, 2FF6Ch, 35FF086Ah, 1005DECh, 106415FFh, 0F08B0100h
		dd 840FF53Bh, 22Ah, 55555555h, 104015FFh, 46890100h, 44895330h
		dd 15FF4424h, 100104Ch,	0B9346E8Dh, 3FEFh, 0FD8BC033h
		dd 8BAAABF3h, 1C2484h, 6C890001h, 44C72424h, 0FFBD2024h
		dd 44C70000h, 101824h, 46890000h, 24448D1Ch, 50006A30h
		dd 2024448Dh, 502C7E8Dh, 500C468Dh, 2024448Dh, 448D5750h
		dd 16A3824h, 24B4FF50h,	10038h,	111015FFh, 44890100h, 8B661C24h
		dd 0FF500E46h, 110C15h,	247C8301h, 7874001Ch, 10F815FFh
		dd 0E53D0100h, 0F000003h, 16285h, 5DDCA100h, 0FF6A0100h
		dd 2C244489h, 4424448Bh, 30244489h, 2C24448Dh, 6A50006Ah
		dd 6015FF02h, 83010010h, 840FFFF8h, 137h, 1023Dh, 2C840F00h
		dd 85000001h, 24840FC0h, 8D000001h, 50102444h, 448D006Ah
		dd 50573824h, 2824B4FFh, 0FF000100h, 110815h, 75C08501h
		dd 0F815FF0Bh, 0E9010010h, 0B6h, 35FF006Ah, 1005DDCh, 103C15FFh
		dd 0C0850100h, 0E5840Fh, 3F830000h, 978C0F02h, 33000000h
		dd 24BC39FFh, 1001Ch, 8B667C74h, 0FF500045h, 110415h, 0C8B70F01h
		dd 487EC985h, 7E02F983h, 4F9830Ch, 0F9833E74h, 0EB397505h
		dd 13D6669h, 0FF0D7500h, 60C405h, 2F31BF01h, 11EB0100h
		dd 23D66h, 5FF0B75h, 10060C8h, 333ABFh,	24848B01h, 10018h
		dd 4689FF85h, 56377408h, 32EBD7FFh, 46A006Ah, 2024B4FFh
		dd 0FF000100h, 60CC05h,	24448D01h, 448D5060h, 0E8505424h
		dd 632h, 848B10EBh, 1001824h, 46895600h, 11DEE808h, 0FF530000h
		dd 105815h, 6078A101h, 46C70100h, 607804h, 68068901h, 1005DE8h
		dd 89047089h, 607835h, 5C15FF01h, 0FF010010h, 5DF40Dh
		dd 15FF5301h, 100104Ch,	83E9ED33h, 0FFFFFFFDh, 10F815h
		dd 5336EB01h, 105815FFh, 78A10100h, 0C7010060h,	60780446h
		dd 6890100h, 5DE868h, 4708901h,	60783589h, 15FF0100h, 100105Ch
		dd 5DF40DFFh, 0FF530100h, 104C15h, 5D5E5F01h, 815BC033h
		dd 10004C4h, 8C200h
dword_1001D74	dd 56555351h, 6020BEh, 3D8B5701h, 1001070h, 33ED3356h
					; DATA XREF: sub_100188E+2Do
		db 0DBh, 0FFh, 0D7h
; ---------------------------------------------------------------------------


loc_1001D8B:				; CODE XREF: .text:01001DA1j
		test	eax, eax
		jnz	short loc_1001DA7
		push	0C8h
		call	ds:dword_100106C
		push	esi
		call	edi
		inc	ebx
		cmp	ebx, 7Dh
		jb	short loc_1001D8B
		test	eax, eax
		jz	short loc_1001DD1


loc_1001DA7:				; CODE XREF: .text:01001D8Dj
		lea	eax, [esp+10h]
		push	eax
		push	dword ptr [esp+1Ch]
		call	sub_10021E5
		test	eax, eax
		jnz	short loc_1001DC0
		mov	eax, [esp+10h]
		mov	ebp, [eax+0Ch]


loc_1001DC0:				; CODE XREF: .text:01001DB7j
		push	esi
		call	ds:dword_100104C
		push	ebp
		push	dword ptr [esp+1Ch]
; ---------------------------------------------------------------------------
		dd 0FFFCC0E8h
		db 0FFh
; ---------------------------------------------------------------------------


loc_1001DD1:				; CODE XREF: .text:01001DA5j
		pop	edi
		pop	esi
		pop	ebp
		xor	eax, eax
		pop	ebx
		pop	ecx
		retn	8
; ---------------------------------------------------------------------------
byte_1001DDB	db 6Ah			; DATA XREF: sub_100188E:loc_10018C2o
		dd 2474FF00h, 0FCABE808h, 0C033FFFFh
; ---------------------------------------------------------------------------
		retn	8

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_1001DEB	proc near		; DATA XREF: .text:0100166Bo

var_4		= byte ptr -4
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		push	ecx
		lea	eax, [ebp+var_4]
		push	eax
		call	ds:dword_10010A4
		inc	dword_1006134
		pop	ecx
		lea	eax, [ebp+var_4]
		push	eax
		call	ds:dword_10010B8
		mov	eax, [ebp+arg_0]
		pop	ecx
		dec	eax
		jz	short loc_1001E68
		dec	eax
		jz	short loc_1001E35
		dec	eax
		jz	short loc_1001E1D
		dec	eax
		dec	eax
		jz	short loc_1001E68
		jmp	short loc_1001E4B
; ---------------------------------------------------------------------------


loc_1001E1D:				; CODE XREF: sub_1001DEB+2Aj
		push	dword_1006040
		call	ds:dword_1001034
		mov	dword_1006124, 4
		jmp	short loc_1001E4B
; ---------------------------------------------------------------------------


loc_1001E35:				; CODE XREF: sub_1001DEB+27j
		push	dword_1006040
		call	ds:dword_1001074
		mov	dword_1006124, 7


loc_1001E4B:				; CODE XREF: sub_1001DEB+30j
					; sub_1001DEB+48j
		push	offset dword_1006120
		push	dword_1006044
		call	ds:dword_1001014
		test	eax, eax
		jnz	short locret_1001E6F
		call	ds:dword_1001038
		jmp	short locret_1001E6F
; ---------------------------------------------------------------------------


loc_1001E68:				; CODE XREF: sub_1001DEB+24j
					; sub_1001DEB+2Ej
		push	0
		call	sub_1001E73

locret_1001E6F:				; CODE XREF: sub_1001DEB+73j
					; sub_1001DEB+7Bj
		leave
		retn	4
sub_1001DEB	endp


; =============== S U B	R O U T	I N E =======================================



sub_1001E73	proc near		; CODE XREF: .text:0100171Ep
					; sub_1001DEB+7Fp

arg_0		= dword	ptr  4

		push	ebx
		push	ebp
		push	esi
		mov	esi, ds:dword_1001014
		push	edi
		mov	edi, offset dword_1006120
		push	edi
		mov	dword_1006124, 3
		push	dword_1006044
		call	esi ; dword_1001014
		mov	ebp, ds:dword_1001038
		xor	ebx, ebx
		cmp	eax, ebx
		jnz	short loc_1001EA3
		call	ebp ; dword_1001038


loc_1001EA3:				; CODE XREF: sub_1001E73+2Cj
		push	dword_1005DDC
		call	ds:dword_1001030
		mov	dword_1006124, 1
		mov	dword_1006134, ebx
		mov	eax, [esp+10h+arg_0]
		mov	dword_1006138, ebx
		cmp	eax, ebx
		jnz	short loc_1001EDB
		mov	dword_100612C, ebx
		mov	dword_1006130, ebx
		jmp	short loc_1001EFD
; ---------------------------------------------------------------------------


loc_1001EDB:				; CODE XREF: sub_1001E73+58j
		cmp	eax, 834h
		jb	short loc_1001EF3
		cmp	eax, 16A7h
		mov	dword_100612C, 42Ah
		jbe	short loc_1001EF8


loc_1001EF3:				; CODE XREF: sub_1001E73+6Dj
		mov	dword_100612C, eax


loc_1001EF8:				; CODE XREF: sub_1001E73+7Ej
		mov	dword_1006130, eax


loc_1001EFD:				; CODE XREF: sub_1001E73+66j
		push	edi
		push	dword_1006044
		call	esi ; dword_1001014
		cmp	eax, ebx
		jnz	short loc_1001F0C
		call	ebp ; dword_1001038


loc_1001F0C:				; CODE XREF: sub_1001E73+95j
		mov	eax, dword_1005DE0
		mov	esi, ds:dword_1001054
		cmp	eax, ebx
		jz	short loc_1001F24
		push	eax
		call	esi ; dword_1001054
		mov	dword_1005DE0, ebx


loc_1001F24:				; CODE XREF: sub_1001E73+A6j
		mov	eax, dword_1005DDC
		cmp	eax, ebx
		jz	short loc_1001F36
		push	eax
		call	esi ; dword_1001054
		mov	dword_1005DDC, ebx


loc_1001F36:				; CODE XREF: sub_1001E73+B8j
		mov	eax, dword_1005DD0
		cmp	eax, ebx
		jz	short loc_1001F4D
		push	eax
		call	ds:dword_100109C
		pop	ecx
		mov	dword_1005DD0, ebx


loc_1001F4D:				; CODE XREF: sub_1001E73+CAj
		pop	edi
		pop	esi
		pop	ebp
		pop	ebx
		retn	4
sub_1001E73	endp


; =============== S U B	R O U T	I N E =======================================



sub_1001F54	proc near		; CODE XREF: sub_1002182+1Cp
					; sub_1002219+B7p

arg_0		= dword	ptr  4

		push	esi
		mov	esi, [esp+4+arg_0]
		push	0FFFFFFFFh
		push	dword ptr [esi+10h]
		call	ds:dword_1001168
		push	dword ptr [esi+8]
		call	ds:dword_100111C
		push	dword ptr [esi+14h]
		call	ds:dword_1001118
		mov	eax, [esi]
		mov	ecx, [esi+4]
		cmp	eax, ecx
		jnz	short loc_1001F90
		mov	eax, dword_1006038
		mov	ecx, [eax]
		mov	eax, [eax+4]
		mov	[eax], ecx
		mov	[ecx+4], eax
		jmp	short loc_1001F9A
; ---------------------------------------------------------------------------


loc_1001F90:				; CODE XREF: sub_1001F54+29j
		mov	[ecx], eax
		mov	eax, [esi]
		mov	ecx, [esi+4]
		mov	[eax+4], ecx


loc_1001F9A:				; CODE XREF: sub_1001F54+3Aj
		push	esi
		call	ds:dword_10010A0
		pop	ecx
		pop	esi
		retn	4
sub_1001F54	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_1001FA6	proc near		; CODE XREF: sub_10018DB+3Dp
					; sub_1002219+1Dp

var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		push	ecx
		push	ecx
		push	ebx
		mov	ebx, [ebp+arg_0]
		push	esi
		push	edi
		xor	edi, edi
		lea	eax, [ebp+var_4]
		push	edi
		push	eax
		push	edi
		mov	[ebp+var_4], edi
		mov	[ebp+var_8], 0C0000017h
		mov	[ebx], edi
		call	near ptr word_1003A4A
		cmp	eax, edi
		jz	short loc_1001FD3
		cmp	eax, 7Ah
		jnz	short loc_100201A


loc_1001FD3:				; CODE XREF: sub_1001FA6+26j
		push	[ebp+var_4]
		call	ds:dword_1001094
		mov	esi, eax
		pop	ecx
		cmp	esi, edi
		jz	short loc_100201A


loc_1001FE3:				; CODE XREF: sub_1001FA6+63j
		lea	eax, [ebp+var_4]
		push	edi
		push	eax
		push	esi
		call	near ptr word_1003A4A
		cmp	eax, edi
		jz	short loc_1002015
		cmp	eax, 7Ah
		jnz	short loc_100201A
		push	[ebp+var_4]
		push	esi
		call	ds:dword_1001098
		pop	ecx
		cmp	eax, edi
		pop	ecx
		jz	short loc_100200B
		mov	esi, eax
		jmp	short loc_1001FE3
; ---------------------------------------------------------------------------


loc_100200B:				; CODE XREF: sub_1001FA6+5Fj
		push	esi
		call	ds:dword_10010A0
		pop	ecx
		jmp	short loc_100201A
; ---------------------------------------------------------------------------


loc_1002015:				; CODE XREF: sub_1001FA6+4Aj
		mov	[ebp+var_8], edi
		mov	[ebx], esi


loc_100201A:				; CODE XREF: sub_1001FA6+2Bj
					; sub_1001FA6+3Bj ...
		mov	eax, [ebp+var_8]
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn	4
sub_1001FA6	endp


; =============== S U B	R O U T	I N E =======================================



sub_1002024	proc near		; CODE XREF: sub_100205A+B7p

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		push	[esp+arg_0]
		call	ds:dword_1001120
		test	eax, eax
		jz	short locret_1002057
		push	edi
		mov	edi, eax
		or	ecx, 0FFFFFFFFh
		xor	eax, eax
		repne scasb
		not	ecx
		sub	edi, ecx
		push	esi
		mov	eax, ecx
		mov	esi, edi
		mov	edi, [esp+8+arg_4]
		shr	ecx, 2
		rep movsd
		mov	ecx, eax
		and	ecx, 3
		rep movsb
		pop	esi
		pop	edi

locret_1002057:				; CODE XREF: sub_1002024+Cj
		retn	8
sub_1002024	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_100205A	proc near		; CODE XREF: sub_10018DB+64p
					; sub_1002219+65p ...

var_28		= byte ptr -28h
var_14		= word ptr -14h
var_12		= word ptr -12h
var_10		= dword	ptr -10h
var_4		= dword	ptr -4
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		sub	esp, 28h
		push	ebx
		push	esi
		xor	esi, esi
		push	edi
		mov	[ebp+var_4], esi


loc_1002068:				; CODE XREF: sub_100205A+5Dj
		push	1
		push	esi
		push	esi
		push	esi
		push	2
		push	2
		call	ds:dword_10010F4
		mov	ebx, eax
		cmp	ebx, 0FFFFFFFFh
		jz	short loc_100209D
		xor	eax, eax
		lea	edi, [ebp+var_14]
		stosd
		stosd
		stosd
		push	offset aUdp	; "udp"
		push	offset aTftp	; "tftp"
		stosd
		call	ds:dword_1001128
		cmp	eax, esi
		jnz	short loc_10020B9
		jmp	short loc_10020B1
; ---------------------------------------------------------------------------


loc_100209D:				; CODE XREF: sub_100205A+22j
		call	ds:dword_10010F8
		push	2EEh
		call	ds:dword_100106C
		inc	[ebp+var_4]


loc_10020B1:				; CODE XREF: sub_100205A+41j
		cmp	[ebp+var_4], 0Ah
		jge	short loc_10020E6
		jmp	short loc_1002068
; ---------------------------------------------------------------------------


loc_10020B9:				; CODE XREF: sub_100205A+3Fj
		mov	[ebp+var_14], 2
		mov	ax, [eax+8]
		mov	[ebp+var_12], ax
		mov	eax, [ebp+arg_0]
		mov	[ebp+var_10], eax
		lea	eax, [ebp+var_14]
		push	10h
		push	eax
		push	ebx
		call	ds:dword_1001124
		test	eax, eax
		jz	short loc_10020E6
		call	ds:dword_1001038
		jmp	short loc_100215E
; ---------------------------------------------------------------------------


loc_10020E6:				; CODE XREF: sub_100205A+5Bj
					; sub_100205A+82j
		cmp	ebx, 0FFFFFFFFh
		jz	short loc_100215E
		push	20h
		call	ds:dword_1001094
		mov	esi, eax
		pop	ecx
		test	esi, esi
		jz	short loc_100213D
		push	8
		xor	eax, eax
		pop	ecx
		mov	edi, esi
		rep stosd
		mov	eax, [ebp+arg_0]
		lea	ecx, [ebp+var_28]
		push	ecx
		push	eax
		mov	[esi+8], ebx
		mov	[esi+0Ch], eax
		call	sub_1002024
		xor	eax, eax
		push	eax
		push	eax
		push	eax
		push	eax
		call	ds:dword_1001040
		mov	edi, eax
		test	edi, edi
		jz	short loc_1002140
		push	1
		push	edi
		push	ebx
		mov	[esi+14h], edi
		call	sub_100188E
		test	eax, eax
		mov	[esi+10h], eax
		jnz	short loc_1002162
		jmp	short loc_1002140
; ---------------------------------------------------------------------------


loc_100213D:				; CODE XREF: sub_100205A+9Ej
		mov	edi, [ebp+arg_0]


loc_1002140:				; CODE XREF: sub_100205A+CCj
					; sub_100205A+E1j
		push	ebx
		call	ds:dword_100111C
		test	edi, edi
		jz	short loc_1002152
		push	edi
		call	ds:dword_1001054


loc_1002152:				; CODE XREF: sub_100205A+EFj
		test	esi, esi
		jz	short loc_100215E
		push	esi
		call	ds:dword_10010A0
		pop	ecx


loc_100215E:				; CODE XREF: sub_100205A+8Aj
					; sub_100205A+8Fj ...
		xor	eax, eax
		jmp	short loc_100217B
; ---------------------------------------------------------------------------


loc_1002162:				; CODE XREF: sub_100205A+DFj
		mov	eax, dword_1006038
		mov	dword ptr [esi+4], offset dword_1006038
		mov	[esi], eax
		mov	[eax+4], esi
		mov	dword_1006038, esi
		mov	eax, esi


loc_100217B:				; CODE XREF: sub_100205A+106j
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn	4
sub_100205A	endp


; =============== S U B	R O U T	I N E =======================================



sub_1002182	proc near		; CODE XREF: sub_1002219:loc_1002298p
		mov	ecx, dword_1006038
		push	esi
		mov	esi, offset dword_1006038
		xor	eax, eax
		cmp	ecx, esi
		jz	short loc_10021B3
		push	edi


loc_1002195:				; CODE XREF: sub_1002182+2Ej
		cmp	dword ptr [ecx+18h], 0
		mov	edi, [ecx]
		jnz	short loc_10021A8
		push	ecx
		call	sub_1001F54
		push	1
		pop	eax
		jmp	short loc_10021AC
; ---------------------------------------------------------------------------


loc_10021A8:				; CODE XREF: sub_1002182+19j
		and	dword ptr [ecx+18h], 0


loc_10021AC:				; CODE XREF: sub_1002182+24j
		cmp	edi, esi
		mov	ecx, edi
		jnz	short loc_1002195
		pop	edi


loc_10021B3:				; CODE XREF: sub_1002182+10j
		pop	esi
		retn
sub_1002182	endp


; =============== S U B	R O U T	I N E =======================================



sub_10021B5	proc near		; CODE XREF: sub_1002219+43p

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		mov	edx, [esp+arg_4]
		push	esi
		mov	ecx, offset dword_1006038
		and	dword ptr [edx], 0
		mov	eax, dword_1006038


loc_10021C7:				; CODE XREF: sub_10021B5+21j
		cmp	eax, ecx
		jz	short loc_10021DF
		mov	esi, [eax+0Ch]
		cmp	esi, [esp+4+arg_0]
		jz	short loc_10021D8
		mov	eax, [eax]
		jmp	short loc_10021C7
; ---------------------------------------------------------------------------


loc_10021D8:				; CODE XREF: sub_10021B5+1Dj
		push	1
		mov	[edx], eax
		pop	eax
		jmp	short loc_10021E1
; ---------------------------------------------------------------------------


loc_10021DF:				; CODE XREF: sub_10021B5+14j
		xor	eax, eax


loc_10021E1:				; CODE XREF: sub_10021B5+28j
		pop	esi
		retn	8
sub_10021B5	endp


; =============== S U B	R O U T	I N E =======================================



sub_10021E5	proc near		; CODE XREF: .text:01001DB0p

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		mov	edx, [esp+arg_4]
		push	esi
		mov	ecx, offset dword_1006038
		and	dword ptr [edx], 0
		mov	eax, dword_1006038


loc_10021F7:				; CODE XREF: sub_10021E5+21j
		cmp	eax, ecx
		jz	short loc_100220A
		mov	esi, [eax+8]
		cmp	esi, [esp+4+arg_0]
		jz	short loc_1002208
		mov	eax, [eax]
		jmp	short loc_10021F7
; ---------------------------------------------------------------------------


loc_1002208:				; CODE XREF: sub_10021E5+1Dj
		mov	[edx], eax


loc_100220A:				; CODE XREF: sub_10021E5+14j
		mov	eax, [edx]
		pop	esi
		neg	eax
		sbb	eax, eax
		and	al, 0A9h
		add	eax, 57h
		retn	8
sub_10021E5	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_1002219	proc near		; DATA XREF: sub_10018DB+CBo

var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		sub	esp, 0Ch
		push	ebx
		push	esi
		push	edi
		xor	esi, esi
		push	offset dword_1006020
		mov	[ebp+var_C], esi
		call	ds:dword_1001058
		lea	eax, [ebp+var_4]
		push	eax
		call	sub_1001FA6
		test	eax, eax
		jnz	short loc_10022A9
		mov	eax, [ebp+var_4]
		xor	ebx, ebx
		cmp	[eax], esi
		jbe	short loc_1002298


loc_1002248:				; CODE XREF: sub_1002219+7Dj
		mov	eax, [eax+esi+4]
		test	eax, eax
		jz	short loc_100228D
		cmp	eax, 100007Fh
		jz	short loc_100228D
		lea	ecx, [ebp+var_8]
		push	ecx
		push	eax
		call	sub_10021B5
		test	eax, eax
		jz	short loc_1002271
		mov	eax, [ebp+var_8]
		mov	dword ptr [eax+18h], 1
		jmp	short loc_100228D
; ---------------------------------------------------------------------------


loc_1002271:				; CODE XREF: sub_1002219+4Aj
		mov	eax, [ebp+var_4]
		push	1
		pop	edi
		push	dword ptr [eax+esi+4]
		mov	[ebp+var_C], edi
		call	sub_100205A
		test	eax, eax
		mov	[ebp+var_8], eax
		jz	short loc_100228D
		mov	[eax+18h], edi


loc_100228D:				; CODE XREF: sub_1002219+35j
					; sub_1002219+3Cj ...
		mov	eax, [ebp+var_4]
		inc	ebx
		add	esi, 18h
		cmp	ebx, [eax]
		jb	short loc_1002248


loc_1002298:				; CODE XREF: sub_1002219+2Dj
		call	sub_1002182
		push	[ebp+var_4]
		mov	esi, eax
		call	ds:dword_10010A0
		pop	ecx


loc_10022A9:				; CODE XREF: sub_1002219+24j
		cmp	[ebp+var_C], 0
		jnz	short loc_10022E9
		test	esi, esi
		jnz	short loc_10022E9
		mov	eax, dword_1006038
		mov	edi, offset dword_1006038
		cmp	eax, edi
		jz	short loc_10022E9


loc_10022C1:				; CODE XREF: sub_1002219+CEj
		mov	[ebp+var_8], eax
		mov	ebx, [eax]
		test	byte ptr [eax+1Ch], 1
		jnz	short loc_10022E3
		mov	esi, [eax+0Ch]
		push	eax
		call	sub_1001F54
		push	esi
		call	sub_100205A
		test	eax, eax
		jz	short loc_10022E3
		or	dword ptr [eax+1Ch], 1


loc_10022E3:				; CODE XREF: sub_1002219+B1j
					; sub_1002219+C4j
		cmp	ebx, edi
		mov	eax, ebx
		jnz	short loc_10022C1


loc_10022E9:				; CODE XREF: sub_1002219+94j
					; sub_1002219+98j ...
		push	offset dword_1006100
		push	offset dword_1005E00
		call	near ptr dword_1003A44
		push	offset dword_1006020
		call	ds:dword_100104C
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn	8
sub_1002219	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_100230A	proc near		; CODE XREF: .text:01002614p
					; .text:01002B1Dp ...

var_FFBC	= word ptr -0FFBCh
var_FFBA	= word ptr -0FFBAh
var_FFB8	= byte ptr -0FFB8h
arg_0		= dword	ptr  8
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h
arg_10		= dword	ptr  18h

		push	ebp
		mov	ebp, esp
		mov	eax, 0FFBCh
		call	near ptr word_1003A3E
		push	ebx
		push	esi
		mov	esi, ds:dword_1001104
		push	edi
		push	5
		call	esi ; dword_1001104
		mov	edi, [ebp+arg_C]
		mov	[ebp+var_FFBC],	ax
		push	edi
		call	esi ; dword_1001104
		cmp	[ebp+arg_10], 0
		mov	[ebp+var_FFBA],	ax
		jz	short loc_1002369
		mov	edi, [ebp+arg_10]
		or	ecx, 0FFFFFFFFh
		xor	eax, eax
		lea	edx, [ebp+var_FFB8]
		repne scasb
		not	ecx
		sub	edi, ecx
		mov	eax, ecx
		mov	esi, edi
		mov	edi, edx
		shr	ecx, 2
		rep movsd
		mov	ecx, eax
		and	ecx, 3
		rep movsb
		mov	edi, [ebp+arg_10]
		jmp	short loc_10023A2
; ---------------------------------------------------------------------------


loc_1002369:				; CODE XREF: sub_100230A+32j
		cmp	di, 9
		jb	short loc_1002371
		xor	edi, edi


loc_1002371:				; CODE XREF: sub_100230A+63j
		movzx	eax, di
		or	ecx, 0FFFFFFFFh
		lea	ebx, [ebp+var_FFB8]
		mov	edx, dword_1005CC0[eax*4]
		xor	eax, eax
		mov	edi, edx
		repne scasb
		not	ecx
		sub	edi, ecx
		mov	eax, ecx
		mov	esi, edi
		mov	edi, ebx
		shr	ecx, 2
		rep movsd
		mov	ecx, eax
		and	ecx, 3
		rep movsb
		mov	edi, edx


loc_10023A2:				; CODE XREF: sub_100230A+5Dj
		or	ecx, 0FFFFFFFFh
		xor	eax, eax
		repne scasb
		push	10h
		push	[ebp+arg_0]
		not	ecx
		dec	ecx
		push	eax
		add	ecx, 5
		lea	eax, [ebp+var_FFBC]
		push	ecx
		push	eax
		push	[ebp+arg_8]
		call	ds:dword_1001130
		cmp	eax, 0FFFFFFFFh
		jnz	short loc_10023D1
		call	ds:dword_10010F8


loc_10023D1:				; CODE XREF: sub_100230A+BFj
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn	14h
sub_100230A	endp

; ---------------------------------------------------------------------------
		mov	eax, [esp+4]
		push	ebx
		push	ebp
		push	esi
		mov	esi, [esp+20h]
		mov	dword ptr [eax+20h], 200h
		mov	dword ptr [eax+28h], 0Ah
		mov	eax, [esp+24h]
		push	edi
		mov	ecx, 3FEFh
		and	dword ptr [eax], 0
		xor	eax, eax
		mov	edi, esi
		push	6
		rep stosd
		call	ds:dword_1001104
		mov	[esi], ax
		lea	ebx, [esi+2]
		mov	ebp, [esp+18h]
		cmp	byte ptr [ebp+0], 0
		jz	loc_10025E4


loc_1002420:				; CODE XREF: .text:010025DAj
		mov	esi, ds:dword_100115C
		push	offset aBlksize	; "blksize"
		push	ebp
		call	esi ; dword_100115C
		pop	ecx
		test	eax, eax
		pop	ecx
		jnz	short loc_1002498
		mov	edi, ebp
		or	ecx, 0FFFFFFFFh
		repne scasb
		not	ecx
		sub	edi, ecx
		push	8
		mov	eax, ecx
		mov	esi, edi
		mov	edi, ebx
		shr	ecx, 2
		rep movsd
		mov	ecx, eax
		and	ecx, 3
		rep movsb
		pop	esi
		add	ebp, esi
		add	ebx, esi
		push	ebp
		call	ds:dword_100115C+4
		pop	ecx
		cmp	eax, esi
		mov	ecx, [esp+14h]
		mov	[ecx+20h], eax
		jb	loc_10025FD
		cmp	eax, 0FFB8h
		ja	loc_10025FD
		cmp	eax, 5B0h
		jnz	short loc_100248F
		mov	dword ptr [ecx+20h], 200h
		sub	ebx, esi
		jmp	loc_10025C6
; ---------------------------------------------------------------------------


loc_100248F:				; CODE XREF: .text:0100247Fj
		push	0Ah
		push	ebx
		push	eax
		jmp	loc_1002597
; ---------------------------------------------------------------------------


loc_1002498:				; CODE XREF: .text:01002432j
		push	offset aTimeout_0 ; "timeout"
		push	ebp
		call	esi ; dword_100115C
		pop	ecx
		test	eax, eax
		pop	ecx
		jnz	short loc_100251A
		mov	edi, ebp
		or	ecx, 0FFFFFFFFh
		repne scasb
		not	ecx
		sub	edi, ecx
		add	ebp, 8
		mov	eax, ecx
		mov	esi, edi
		mov	edi, ebx
		push	ebp
		shr	ecx, 2
		rep movsd
		mov	ecx, eax
		add	ebx, 8
		and	ecx, 3
		rep movsb
		call	ds:dword_100115C+4
		pop	ecx
		mov	ecx, [esp+14h]
		push	1
		pop	edx
		cmp	eax, edx
		mov	[ecx+28h], eax
		jl	loc_1002602
		cmp	eax, 0FFh
		jg	loc_1002602
		mov	eax, [esp+28h]
		mov	edi, ebp
		or	ecx, 0FFFFFFFFh
		mov	[eax], edx
		xor	eax, eax
		repne scasb
		not	ecx
		sub	edi, ecx
		mov	eax, ecx
		mov	esi, edi
		mov	edi, ebx
		shr	ecx, 2
		rep movsd
		mov	ecx, eax
		and	ecx, 3
		rep movsb
		mov	edi, ebp
		jmp	loc_10025A2
; ---------------------------------------------------------------------------


loc_100251A:				; CODE XREF: .text:010024A4j
		push	offset aTsize	; "tsize"
		push	ebp
		call	esi ; dword_100115C
		pop	ecx
		mov	edi, ebp
		test	eax, eax
		pop	ecx
		jnz	loc_10025B2
		or	edx, 0FFFFFFFFh
		xor	eax, eax
		mov	ecx, edx
		add	ebp, 6
		repne scasb
		not	ecx
		sub	edi, ecx
		mov	eax, ecx
		mov	esi, edi
		mov	edi, ebx
		add	ebx, 6
		shr	ecx, 2
		rep movsd
		mov	ecx, eax
		and	ecx, 3
		cmp	dword ptr [esp+1Ch], 2
		rep movsb
		jnz	short loc_100258D
		mov	edi, ebp
		mov	ecx, edx
		xor	eax, eax
		repne scasb
		not	ecx
		sub	edi, ecx
		mov	eax, ecx
		mov	esi, edi
		mov	edi, ebx
		shr	ecx, 2
		rep movsd
		mov	ecx, eax
		xor	eax, eax
		and	ecx, 3
		rep movsb
		mov	edi, ebp
		mov	ecx, edx
		repne scasb
		not	ecx
		dec	ecx
		mov	edi, ebp
		lea	ebx, [ebx+ecx+1]
		mov	ecx, edx
		jmp	short loc_10025CB
; ---------------------------------------------------------------------------


loc_100258D:				; CODE XREF: .text:01002558j
		mov	eax, [esp+14h]
		push	0Ah
		push	ebx
		push	dword ptr [eax+24h]


loc_1002597:				; CODE XREF: .text:01002493j
		call	ds:dword_100115C+8
		add	esp, 0Ch
		mov	edi, ebx


loc_10025A2:				; CODE XREF: .text:01002515j
		or	ecx, 0FFFFFFFFh
		xor	eax, eax
		repne scasb
		not	ecx
		dec	ecx
		lea	ebx, [ebx+ecx+1]
		jmp	short loc_10025C6
; ---------------------------------------------------------------------------


loc_10025B2:				; CODE XREF: .text:01002528j
		or	ecx, 0FFFFFFFFh
		xor	eax, eax
		repne scasb
		not	ecx
		dec	ecx
		cmp	[ebp+ecx+1], al
		lea	ebp, [ebp+ecx+1]
		jz	short loc_10025E0


loc_10025C6:				; CODE XREF: .text:0100248Aj
					; .text:010025B0j
		mov	edi, ebp
		or	ecx, 0FFFFFFFFh


loc_10025CB:				; CODE XREF: .text:0100258Bj
		xor	eax, eax
		repne scasb
		not	ecx
		dec	ecx
		cmp	[ebp+ecx+1], al
		lea	ebp, [ebp+ecx+1]
		jnz	loc_1002420


loc_10025E0:				; CODE XREF: .text:010025C4j
		mov	esi, [esp+24h]


loc_10025E4:				; CODE XREF: .text:0100241Aj
		mov	eax, [esp+20h]
		sub	ebx, esi
		cmp	ebx, 2
		mov	[eax], ebx
		jnz	short loc_10025F4
		and	dword ptr [eax], 0


loc_10025F4:				; CODE XREF: .text:010025EFj
		xor	eax, eax


loc_10025F6:				; CODE XREF: .text:0100261Cj
		pop	edi
		pop	esi
		pop	ebp
		pop	ebx
		retn	18h
; ---------------------------------------------------------------------------


loc_10025FD:				; CODE XREF: .text:01002469j
					; .text:01002474j
		push	0
		push	esi
		jmp	short loc_1002606
; ---------------------------------------------------------------------------


loc_1002602:				; CODE XREF: .text:010024DDj
					; .text:010024E8j
		push	0
		push	8


loc_1002606:				; CODE XREF: .text:01002600j
		push	dword ptr [ecx+8]
		lea	eax, [ecx+0FFF1h]
		add	ecx, 0Ch
		push	eax
		push	ecx
		call	sub_100230A
		or	eax, 0FFFFFFFFh
		jmp	short loc_10025F6
; ---------------------------------------------------------------------------
		push	ebp
		mov	ebp, esp
		push	ebx
		mov	ebx, [ebp+8]
		push	esi
		push	edi
		mov	al, [ebx]
		mov	ecx, ebx
		mov	esi, ebx
		mov	[ebp+8], ebx


loc_1002630:				; CODE XREF: .text:01002640j
		test	al, al
		jz	short loc_1002642
		cmp	al, 5Ch
		jz	short loc_100263C
		cmp	al, 2Fh
		jnz	short loc_1002642


loc_100263C:				; CODE XREF: .text:01002636j
		mov	al, [ecx+1]
		inc	ecx
		jmp	short loc_1002630
; ---------------------------------------------------------------------------


loc_1002642:				; CODE XREF: .text:01002632j
					; .text:0100263Aj ...
		mov	al, [ecx]
		test	al, al
		jz	loc_10026E4
		cmp	al, 2Eh
		jnz	loc_100271C
		mov	dl, [ecx+1]
		lea	edi, [ecx+1]
		cmp	dl, 5Ch
		jz	loc_1002718
		cmp	dl, 2Fh
		jz	loc_1002718
		cmp	dl, al
		jnz	loc_1002703
		mov	dl, [ecx+2]
		lea	edi, [ecx+2]
		cmp	dl, 5Ch
		jz	short loc_1002684
		cmp	dl, 2Fh
		jnz	short loc_1002703


loc_1002684:				; CODE XREF: .text:0100267Dj
		dec	esi
		mov	ecx, edi
		dec	esi
		cmp	esi, ebx
		jbe	short loc_10026E0


loc_100268C:				; CODE XREF: .text:01002699j
		mov	al, [esi]
		cmp	al, 5Ch
		jz	short loc_100269B
		cmp	al, 2Fh
		jz	short loc_100269B
		dec	esi
		cmp	esi, ebx
		jnb	short loc_100268C


loc_100269B:				; CODE XREF: .text:01002690j
					; .text:01002694j
		inc	esi


loc_100269C:				; CODE XREF: .text:010026ACj
					; .text:0100270Cj ...
		cmp	esi, [ebp+8]
		jbe	short loc_10026AE
		cmp	byte ptr [esi-1], 20h
		lea	eax, [esi-1]
		jnz	short loc_10026AE
		mov	esi, eax
		jmp	short loc_100269C
; ---------------------------------------------------------------------------


loc_10026AE:				; CODE XREF: .text:0100269Fj
					; .text:010026A8j
		mov	al, [ecx]
		cmp	al, 5Ch
		jz	short loc_10026B8
		cmp	al, 2Fh
		jnz	short loc_1002642


loc_10026B8:				; CODE XREF: .text:010026B2j
		cmp	esi, ebx
		jz	short loc_10026CB
		mov	al, [esi-1]
		cmp	al, 5Ch
		jz	short loc_10026CB
		cmp	al, 2Fh
		jz	short loc_10026CB
		mov	byte ptr [esi],	5Ch
		inc	esi


loc_10026CB:				; CODE XREF: .text:010026BAj
					; .text:010026C1j ...
		inc	ecx
		jz	short loc_10026D8
		mov	al, [ecx]
		cmp	al, 5Ch
		jz	short loc_10026CB
		cmp	al, 2Fh
		jz	short loc_10026CB


loc_10026D8:				; CODE XREF: .text:010026CCj
		mov	[ebp+8], esi
		jmp	loc_1002642
; ---------------------------------------------------------------------------


loc_10026E0:				; CODE XREF: .text:0100268Aj
		xor	eax, eax
		jmp	short loc_10026FC
; ---------------------------------------------------------------------------


loc_10026E4:				; CODE XREF: .text:01002646j
		mov	cl, [esi-1]
		lea	eax, [esi-1]
		cmp	cl, 5Ch
		jz	short loc_10026F4
		cmp	cl, 2Fh
		jnz	short loc_10026F6


loc_10026F4:				; CODE XREF: .text:010026EDj
		mov	esi, eax


loc_10026F6:				; CODE XREF: .text:010026F2j
		and	byte ptr [esi],	0
		push	1
		pop	eax


loc_10026FC:				; CODE XREF: .text:010026E2j
		pop	edi
		pop	esi
		pop	ebx
		pop	ebp
		retn	4
; ---------------------------------------------------------------------------


loc_1002703:				; CODE XREF: .text:0100266Ej
					; .text:01002682j ...
		mov	[esi], al
		mov	al, [ecx+1]
		inc	esi
		inc	ecx
		test	al, al
		jz	short loc_100269C
		cmp	al, 5Ch
		jz	short loc_100269C
		cmp	al, 2Fh
		jnz	short loc_1002703
		jmp	short loc_100269C
; ---------------------------------------------------------------------------


loc_1002718:				; CODE XREF: .text:0100265Dj
					; .text:01002666j
		mov	ecx, edi
		jmp	short loc_100269C
; ---------------------------------------------------------------------------


loc_100271C:				; CODE XREF: .text:0100264Ej
					; .text:0100273Bj
		test	al, al
		jz	loc_100269C
		cmp	al, 5Ch
		jz	loc_100269C
		cmp	al, 2Fh
		jz	loc_100269C
		mov	[esi], al
		mov	al, [ecx+1]
		inc	esi
		inc	ecx
		jmp	short loc_100271C
; ---------------------------------------------------------------------------
		push	ebp
		mov	ebp, esp
		push	ebx
		push	esi
		mov	esi, [ebp+10h]
		push	edi
		mov	edi, esi
		or	ecx, 0FFFFFFFFh
		xor	eax, eax
		mov	edx, [ebp+8]
		repne scasb
		not	ecx
		dec	ecx
		mov	edi, edx
		mov	ebx, ecx
		or	ecx, 0FFFFFFFFh
		repne scasb
		not	ecx
		dec	ecx
		cmp	byte ptr [ebx+esi-1], 5Ch
		mov	edi, ecx
		setz	al
		xor	ecx, ecx
		cmp	byte ptr [edx],	5Ch
		setz	cl
		test	eax, eax
		jnz	short loc_1002784
		test	ecx, ecx
		jnz	short loc_1002784
		mov	dword ptr [ebp+10h], 1
		jmp	short loc_1002791
; ---------------------------------------------------------------------------


loc_1002784:				; CODE XREF: .text:01002775j
					; .text:01002779j
		and	dword ptr [ebp+10h], 0
		test	eax, eax
		jz	short loc_1002791
		test	ecx, ecx
		jz	short loc_1002791
		dec	ebx


loc_1002791:				; CODE XREF: .text:01002782j
					; .text:0100278Aj ...
		mov	eax, [ebp+10h]
		mov	ecx, [ebp+0Ch]
		add	eax, edi
		add	eax, ebx
		dec	ecx
		cmp	eax, ecx
		jbe	short loc_10027A4
		xor	eax, eax
		jmp	short loc_10027DA
; ---------------------------------------------------------------------------


loc_10027A4:				; CODE XREF: .text:0100279Ej
		mov	eax, [ebp+10h]
		inc	edi
		add	eax, ebx
		push	edi
		add	eax, edx
		push	edx
		push	eax
		call	ds:dword_1001144
		mov	eax, [ebp+8]
		mov	ecx, ebx
		mov	edx, ecx
		mov	edi, eax
		shr	ecx, 2
		rep movsd
		mov	ecx, edx
		add	esp, 0Ch
		and	ecx, 3
		cmp	dword ptr [ebp+10h], 0
		rep movsb
		jz	short loc_10027D7
		mov	byte ptr [ebx+eax], 5Ch


loc_10027D7:				; CODE XREF: .text:010027D1j
		push	1
		pop	eax


loc_10027DA:				; CODE XREF: .text:010027A2j
		pop	edi
		pop	esi
		pop	ebx
		pop	ebp
		retn	0Ch

; =============== S U B	R O U T	I N E =======================================



sub_10027E1	proc near		; CODE XREF: sub_1002B5E+C7p

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		push	esi
		mov	esi, [esp+4+arg_0]
		push	edi
		mov	ecx, [esi+10024h]
		lea	eax, [esi+10024h]
		test	ecx, ecx
		jz	short loc_1002817
		and	dword ptr [eax], 0
		mov	eax, [esp+8+arg_4]
		and	word ptr [esi+10014h], 0
		mov	[esi+10020h], ecx
		mov	eax, [eax+20h]
		mov	[esi+1001Ch], eax
		jmp	short loc_1002877
; ---------------------------------------------------------------------------


loc_1002817:				; CODE XREF: sub_10027E1+14j
		mov	edi, ds:dword_1001104
		push	3
		call	edi ; dword_1001104
		mov	[esi+38h], ax
		mov	ax, [esi+10014h]
		push	eax
		call	edi ; dword_1001104
		mov	[esi+3Ah], ax
		mov	eax, [esp+8+arg_4]
		push	dword ptr [eax+20h]
		lea	eax, [esi+3Ch]
		push	eax
		push	dword ptr [esi+1002Ch]
		call	ds:dword_1001090
		add	esp, 0Ch
		cmp	eax, 0FFFFFFFFh
		mov	[esi+1001Ch], eax
		jnz	short loc_100286E
		mov	esi, ds:dword_10010A8+4
		call	esi
		call	esi
		push	dword ptr [eax]
		call	ds:dword_100102C
		xor	eax, eax
		jmp	short loc_100287A
; ---------------------------------------------------------------------------


loc_100286E:				; CODE XREF: sub_10027E1+75j
		add	eax, 4
		mov	[esi+10020h], eax


loc_1002877:				; CODE XREF: sub_10027E1+34j
		push	1
		pop	eax


loc_100287A:				; CODE XREF: sub_10027E1+8Bj
		pop	edi
		pop	esi
		retn	8
sub_10027E1	endp

; ---------------------------------------------------------------------------
		push	esi
		mov	esi, offset dword_1006080
		push	esi
		call	ds:dword_1001058
		mov	ecx, dword_1006098
		push	esi
		mov	eax, [esp+0Ch]
		mov	[eax], ecx
		mov	dword ptr [eax+4], offset dword_1006098
		mov	[ecx+4], eax
		mov	dword_1006098, eax
		call	ds:dword_100104C
		push	1
		pop	eax
		pop	esi
		retn	4

; =============== S U B	R O U T	I N E =======================================



sub_10028B5	proc near		; CODE XREF: .text:01002A49p
					; .text:01002ED0p

arg_0		= dword	ptr  4

		push	ebx
		mov	ebx, ds:dword_1001058
		push	esi
		push	edi
		mov	edi, offset dword_1006080
		push	edi
		call	ebx ; dword_1001058
		mov	eax, dword_1006098
		mov	ecx, offset dword_1006098


loc_10028D0:				; CODE XREF: sub_10028B5+2Dj
		cmp	eax, ecx
		jz	short loc_10028F2
		mov	edx, [eax+8]
		lea	esi, [eax-18h]
		cmp	edx, [esp+0Ch+arg_0]
		jz	short loc_10028E4
		mov	eax, [eax]
		jmp	short loc_10028D0
; ---------------------------------------------------------------------------


loc_10028E4:				; CODE XREF: sub_10028B5+29j
		push	esi
		call	ebx ; dword_1001058
		push	edi
		call	ds:dword_100104C
		mov	eax, esi
		jmp	short loc_10028FB
; ---------------------------------------------------------------------------


loc_10028F2:				; CODE XREF: sub_10028B5+1Dj
		push	edi
		call	ds:dword_100104C
		xor	eax, eax


loc_10028FB:				; CODE XREF: sub_10028B5+3Bj
		pop	edi
		pop	esi
		pop	ebx
		retn	4
sub_10028B5	endp


; =============== S U B	R O U T	I N E =======================================



sub_1002901	proc near		; CODE XREF: sub_100297A+Ap

arg_0		= dword	ptr  4

		push	esi
		mov	esi, [esp+4+arg_0]
		mov	eax, [esi+20h]
		cmp	eax, 0FFFFFFFFh
		jz	short loc_1002915
		push	eax
		call	ds:dword_100111C


loc_1002915:				; CODE XREF: sub_1002901+Bj
		mov	eax, [esi+10004h]
		test	eax, eax
		jz	short loc_100292E
		push	0
		push	eax
		push	dword_10060A0
		call	ds:dword_1001158


loc_100292E:				; CODE XREF: sub_1002901+1Cj
		push	0
		push	dword ptr [esi+0FFFCh]
		call	ds:dword_1001168
		push	dword ptr [esi+0FFF8h]
		call	ds:dword_1001054
		push	esi
		call	ds:dword_1001028
		pop	esi
		retn	4
sub_1002901	endp


; =============== S U B	R O U T	I N E =======================================



sub_1002953	proc near		; CODE XREF: sub_100297A+2Fp
					; sub_100297A+37p

arg_0		= dword	ptr  4

		push	esi
		mov	esi, [esp+4+arg_0]
		mov	eax, [esi+1002Ch]
		cmp	eax, 0FFFFFFFFh
		jz	short loc_100296B
		push	eax
		call	ds:dword_100108C
		pop	ecx


loc_100296B:				; CODE XREF: sub_1002953+Ej
		push	esi
		call	ds:dword_10010A0
		pop	ecx
		pop	esi
		retn	4
sub_1002953	endp

; [00000003 BYTES: COLLAPSED FUNCTION nullsub_1. PRESS KEYPAD "+" TO EXPAND]

; =============== S U B	R O U T	I N E =======================================



sub_100297A	proc near		; CODE XREF: sub_10029BA+55p

arg_0		= dword	ptr  4

		push	esi
		mov	esi, [esp+4+arg_0]
		test	esi, esi
		jz	short loc_10029B6
		push	esi
		call	sub_1002901
		mov	eax, [esi+24h]
		dec	eax
		jz	short loc_10029B0
		dec	eax
		jz	short loc_10029A8
		dec	eax
		jz	short loc_10029A0
		dec	eax
		jnz	short loc_10029B6
		push	esi
		call	nullsub_1
		jmp	short loc_10029B6
; ---------------------------------------------------------------------------


loc_10029A0:				; CODE XREF: sub_100297A+19j
		push	esi
		call	nullsub_1
		jmp	short loc_10029B6
; ---------------------------------------------------------------------------


loc_10029A8:				; CODE XREF: sub_100297A+16j
		push	esi
		call	sub_1002953
		jmp	short loc_10029B6
; ---------------------------------------------------------------------------


loc_10029B0:				; CODE XREF: sub_100297A+13j
		push	esi
		call	sub_1002953


loc_10029B6:				; CODE XREF: sub_100297A+7j
					; sub_100297A+1Cj ...
		pop	esi
		retn	4
sub_100297A	endp


; =============== S U B	R O U T	I N E =======================================



sub_10029BA	proc near		; DATA XREF: sub_10018DB+98o
		push	ebx
		mov	ebx, ds:dword_1001058
		push	esi
		push	offset dword_1006080
		call	ebx ; dword_1001058
		mov	esi, dword_1006098
		cmp	esi, offset dword_1006098
		jz	short loc_1002A28
		push	edi
		push	ebp


loc_10029D9:				; CODE XREF: sub_10029BA+6Aj
		lea	edi, [esi-18h]
		push	edi
		call	ebx ; dword_1001058
		mov	ebp, [esi]
		inc	dword ptr [edi+10008h]
		cmp	dword ptr [edi+10008h],	4
		lea	eax, [edi+10008h]
		push	edi
		jb	short loc_1002A16
		call	ebx ; dword_1001058
		mov	eax, [esi]
		mov	esi, [esi+4]
		mov	[esi], eax
		mov	[eax+4], esi
		mov	ax, [edi+2Ah]
		push	eax
		call	ds:dword_1001104
		push	edi
		call	sub_100297A
		jmp	short loc_1002A1C
; ---------------------------------------------------------------------------


loc_1002A16:				; CODE XREF: sub_10029BA+3Bj
		call	ds:dword_100104C


loc_1002A1C:				; CODE XREF: sub_10029BA+5Aj
		cmp	ebp, offset dword_1006098
		mov	esi, ebp
		jnz	short loc_10029D9
		pop	ebp
		pop	edi


loc_1002A28:				; CODE XREF: sub_10029BA+1Bj
		push	offset dword_1006080
		call	ds:dword_100104C
		call	sub_1001A1F
		pop	esi
		pop	ebx
		retn	8
sub_10029BA	endp

; ---------------------------------------------------------------------------
		push	ebp
		mov	ebp, esp
		sub	esp, 10h
		push	ebx
		push	esi
		push	edi
		push	dword ptr [ebp+8]
		call	sub_10028B5
		mov	esi, eax
		xor	ebx, ebx
		cmp	esi, ebx
		jz	loc_1002B57
		mov	eax, [esi+1000Ch]
		cmp	eax, 0Ah
		jnb	loc_1002B0B
		cmp	eax, 5
		jbe	short loc_1002A8E
		lea	eax, [ebp-10h]
		push	eax
		call	ds:dword_1001024
		mov	ax, [esi+2Ah]
		push	eax
		call	ds:dword_100110C
		mov	ax, [esi+3Ah]
		push	eax
		call	ds:dword_1001104


loc_1002A8E:				; CODE XREF: .text:01002A6Cj
		lea	eax, [esi+28h]
		push	10h
		push	eax
		push	ebx
		push	dword ptr [esi+10020h]
		lea	eax, [esi+38h]
		push	eax
		push	dword ptr [esi+20h]
		call	ds:dword_1001130
		cmp	eax, 0FFFFFFFFh
		jnz	short loc_1002AB3
		call	ds:dword_10010F8


loc_1002AB3:				; CODE XREF: .text:01002AABj
		mov	edi, [esi+10004h]
		inc	dword ptr [esi+1000Ch]
		cmp	edi, ebx
		jz	loc_1002B4C
		cmp	[esi+10028h], ebx
		jnz	short loc_1002AEA
		mov	eax, [esi+10000h]
		lea	ecx, [esi+10000h]
		shl	eax, 1
		mov	edx, 2710h
		mov	[ecx], eax
		cmp	eax, edx
		jbe	short loc_1002AEA
		mov	[ecx], edx


loc_1002AEA:				; CODE XREF: .text:01002ACDj
					; .text:01002AE6j
		mov	eax, [esi+10000h]
		push	eax
		push	eax
		push	edi
		push	dword_10060A0
		call	ds:dword_1001154
		cmp	eax, ebx
		jz	short loc_1002B4C
		call	ds:dword_1001038
		jmp	short loc_1002B4C
; ---------------------------------------------------------------------------


loc_1002B0B:				; CODE XREF: .text:01002A63j
		cmp	esi, ebx
		jz	short loc_1002B57
		push	offset aTimeout	; "Timeout"
		push	ebx
		push	dword ptr [esi+20h]
		lea	eax, [esi+28h]
		push	ebx
		push	eax
		call	sub_100230A
		mov	eax, [esi+10004h]
		lea	edi, [esi+10004h]
		cmp	eax, ebx
		jz	short loc_1002B40
		push	ebx
		push	eax
		push	dword_10060A0
		call	ds:dword_1001158


loc_1002B40:				; CODE XREF: .text:01002B30j
		mov	[edi], ebx
		mov	dword ptr [esi+10008h],	4


loc_1002B4C:				; CODE XREF: .text:01002AC1j
					; .text:01002B01j ...
		cmp	esi, ebx
		jz	short loc_1002B57
		push	esi
		call	ds:dword_100104C


loc_1002B57:				; CODE XREF: .text:01002A54j
					; .text:01002B0Dj ...
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn	8

; =============== S U B	R O U T	I N E =======================================



sub_1002B5E	proc near		; CODE XREF: .text:01002F05p

var_4		= dword	ptr -4
arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		push	ecx
		push	ebx
		mov	ebx, ds:dword_100110C
		push	ebp
		push	esi
		mov	esi, [esp+10h+arg_0]
		push	edi
		mov	edi, [esp+14h+arg_4]
		xor	ebp, ebp
		mov	eax, [esi+10018h]
		push	4
		mov	[esp+18h+var_4], ebp
		mov	[edi+20h], eax
		call	ebx ; dword_100110C
		cmp	[edi+34h], ax
		jnz	short loc_1002BA6
		mov	ax, [esi+10014h]
		push	eax
		call	ebx ; dword_100110C
		cmp	[edi+36h], ax
		jnz	short loc_1002BA6
		and	dword ptr [esi+1000Ch],	0
		push	1
		pop	ebp
		jmp	short loc_1002BCE
; ---------------------------------------------------------------------------


loc_1002BA6:				; CODE XREF: sub_1002B5E+2Aj
					; sub_1002B5E+3Aj
		mov	ax, [edi+36h]
		push	eax
		call	ebx ; dword_100110C
		mov	ax, [edi+34h]
		push	eax
		call	ds:dword_1001104
		push	4
		call	ebx ; dword_100110C
		cmp	[edi+34h], ax
		jnz	short loc_1002BCE
		mov	ax, [esi+10014h]
		dec	ax
		push	eax
		call	ebx ; dword_100110C


loc_1002BCE:				; CODE XREF: sub_1002B5E+46j
					; sub_1002B5E+62j
		test	ebp, ebp
		jz	loc_1002C96
		cmp	dword ptr [esi+10030h],	0
		jz	short loc_1002C1C
		mov	eax, [esi+10004h]
		lea	edi, [esi+10004h]
		test	eax, eax
		jz	short loc_1002BFE
		push	0
		push	eax
		push	dword_10060A0
		call	ds:dword_1001158


loc_1002BFE:				; CODE XREF: sub_1002B5E+8Fj
		and	dword ptr [edi], 0
		mov	dword ptr [esi+10008h],	4


loc_1002C0B:				; CODE XREF: sub_1002B5E+DBj
					; sub_1002B5E+13Ej ...
		push	esi
		call	ds:dword_100104C
		xor	eax, eax


loc_1002C14:				; CODE XREF: sub_1002B5E+183j
		pop	edi
		pop	esi
		pop	ebp
		pop	ebx
		pop	ecx
		retn	8
; ---------------------------------------------------------------------------


loc_1002C1C:				; CODE XREF: sub_1002B5E+7Fj
		inc	word ptr [esi+10014h]
		push	edi
		push	esi
		call	sub_10027E1
		mov	ebp, eax
		xor	eax, eax
		cmp	ebp, eax
		jnz	short loc_1002C3B
		mov	ax, [edi+0Eh]
		push	eax
		call	ebx ; dword_100110C
		jmp	short loc_1002C0B
; ---------------------------------------------------------------------------


loc_1002C3B:				; CODE XREF: sub_1002B5E+D2j
		cmp	[esi+10028h], eax
		mov	[esi+1000Ch], eax
		mov	[esi+10008h], eax
		jnz	short loc_1002C59
		mov	dword ptr [esi+10000h],	3E8h


loc_1002C59:				; CODE XREF: sub_1002B5E+EFj
		mov	ecx, [esi+10004h]
		cmp	ecx, eax
		jz	short loc_1002C78
		mov	eax, [esi+10000h]
		push	eax
		push	eax
		push	ecx
		push	dword_10060A0
		call	ds:dword_1001154


loc_1002C78:				; CODE XREF: sub_1002B5E+103j
		mov	eax, [esi+1001Ch]
		cmp	eax, [edi+20h]
		jnb	short loc_1002C9A
		mov	ax, [edi+0Eh]
		push	eax
		call	ebx ; dword_100110C
		mov	dword ptr [esi+10030h],	1
		jmp	short loc_1002C9A
; ---------------------------------------------------------------------------


loc_1002C96:				; CODE XREF: sub_1002B5E+72j
		mov	ebp, [esp+14h+var_4]


loc_1002C9A:				; CODE XREF: sub_1002B5E+123j
					; sub_1002B5E+136j
		test	ebp, ebp
		jz	loc_1002C0B
		mov	ax, [edi+0Eh]
		push	eax
		call	ebx ; dword_100110C
		add	edi, 0Ch
		push	10h
		push	edi
		push	0
		push	dword ptr [esi+10020h]
		lea	eax, [esi+38h]
		push	eax
		push	dword ptr [esi+20h]
		call	ds:dword_1001130
		cmp	eax, 0FFFFFFFFh
		jnz	loc_1002C0B
		call	ds:dword_10010F8
		test	esi, esi
		jz	short loc_1002CDE
		push	esi
		call	ds:dword_100104C


loc_1002CDE:				; CODE XREF: sub_1002B5E+177j
		push	1
		pop	eax
		jmp	loc_1002C14
sub_1002B5E	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_1002CE6	proc near		; CODE XREF: .text:01002EFCp

var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		push	ecx
		and	[ebp+var_4], 0
		push	ebx
		mov	ebx, ds:dword_100110C
		push	esi
		mov	esi, [ebp+arg_0]
		push	edi
		mov	edi, [ebp+arg_4]
		push	3
		mov	eax, [esi+10018h]
		mov	[edi+20h], eax
		call	ebx ; dword_100110C
		cmp	[edi+34h], ax
		jnz	short loc_1002D3A
		mov	ax, [esi+10014h]
		inc	ax
		push	eax
		call	ebx ; dword_100110C
		cmp	[edi+36h], ax
		jnz	short loc_1002D3A
		inc	word ptr [esi+10014h]
		xor	ebx, ebx
		mov	[ebp+var_4], 1
		mov	[esi+10008h], ebx
		jmp	short loc_1002D9D
; ---------------------------------------------------------------------------


loc_1002D3A:				; CODE XREF: sub_1002CE6+28j
					; sub_1002CE6+3Aj
		push	3
		call	ebx ; dword_100110C
		cmp	[edi+34h], ax
		jnz	short loc_1002D9B
		mov	ax, [esi+10014h]
		push	eax
		call	ebx ; dword_100110C
		cmp	[edi+36h], ax
		jnz	short loc_1002D9B
		mov	ebx, ds:dword_1001104
		push	4
		call	ebx ; dword_1001104
		mov	[esi+38h], ax
		mov	ax, [esi+10014h]
		push	eax
		call	ebx ; dword_1001104
		add	edi, 0Ch
		push	10h
		mov	[esi+3Ah], ax
		push	edi
		push	0
		lea	eax, [esi+38h]
		push	4
		push	eax
		push	dword ptr [esi+20h]
		call	ds:dword_1001130
		cmp	eax, 0FFFFFFFFh
		jnz	loc_1002EB3
		call	ds:dword_10010F8
		jmp	loc_1002EB3
; ---------------------------------------------------------------------------


loc_1002D9B:				; CODE XREF: sub_1002CE6+5Cj
					; sub_1002CE6+6Cj
		xor	ebx, ebx


loc_1002D9D:				; CODE XREF: sub_1002CE6+52j
		cmp	[ebp+var_4], ebx
		jz	short loc_1002DE4
		lea	eax, [ebp+arg_4]
		push	eax
		mov	eax, [edi+2Ch]
		push	dword ptr [esi+10030h]
		sub	eax, 4
		push	eax
		lea	eax, [edi+38h]
		push	eax
		push	dword ptr [esi+1002Ch]
		call	near ptr word_100373A
		cmp	[ebp+var_4], ebx
		mov	[ebp+arg_0], eax
		jz	short loc_1002DE4
		cmp	eax, ebx
		jge	short loc_1002DF7
		push	ebx
		push	3
		push	dword ptr [edi+8]
		lea	eax, [edi+0FFF1h]
		add	edi, 0Ch
		push	eax
		push	edi
		call	sub_100230A


loc_1002DE4:				; CODE XREF: sub_1002CE6+BAj
					; sub_1002CE6+E2j
		cmp	esi, ebx
		jz	short loc_1002DEF
		push	esi
		call	ds:dword_100104C


loc_1002DEF:				; CODE XREF: sub_1002CE6+100j
		push	1
		pop	eax
		jmp	loc_1002EBC
; ---------------------------------------------------------------------------


loc_1002DF7:				; CODE XREF: sub_1002CE6+E6j
		mov	eax, [edi+2Ch]
		sub	eax, 4
		cmp	eax, [edi+20h]
		ja	loc_1002EB3
		mov	ebx, ds:dword_1001104
		push	4
		call	ebx ; dword_1001104
		mov	[esi+38h], ax
		mov	ax, [esi+10014h]
		push	eax
		call	ebx ; dword_1001104
		mov	[esi+3Ah], ax
		lea	eax, [edi+0Ch]
		push	10h
		xor	ebx, ebx
		push	eax
		push	ebx
		lea	eax, [esi+38h]
		push	4
		push	eax
		push	dword ptr [esi+20h]
		call	ds:dword_1001130
		mov	[ebp+arg_0], eax
		mov	eax, [esi+10004h]
		cmp	eax, ebx
		jz	short loc_1002E74
		cmp	[esi+10028h], ebx
		mov	[esi+1000Ch], ebx
		jnz	short loc_1002E5F
		mov	dword ptr [esi+10000h],	3E8h


loc_1002E5F:				; CODE XREF: sub_1002CE6+16Dj
		mov	ecx, [esi+10000h]
		push	ecx
		push	ecx
		push	eax
		push	dword_10060A0
		call	ds:dword_1001154


loc_1002E74:				; CODE XREF: sub_1002CE6+15Fj
		cmp	[ebp+arg_0], 0FFFFFFFFh
		jnz	short loc_1002E80
		call	ds:dword_10010F8


loc_1002E80:				; CODE XREF: sub_1002CE6+192j
		mov	eax, [edi+2Ch]
		sub	eax, 4
		cmp	eax, [edi+20h]
		jnb	short loc_1002EB3
		mov	eax, [esi+10004h]
		cmp	eax, ebx
		jz	short loc_1002EA3
		push	ebx
		push	eax
		push	dword_10060A0
		call	ds:dword_1001158


loc_1002EA3:				; CODE XREF: sub_1002CE6+1ADj
		mov	[esi+10004h], ebx
		mov	dword ptr [esi+10008h],	4


loc_1002EB3:				; CODE XREF: sub_1002CE6+A4j
					; sub_1002CE6+B0j ...
		push	esi
		call	ds:dword_100104C
		xor	eax, eax


loc_1002EBC:				; CODE XREF: sub_1002CE6+10Cj
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn	8
sub_1002CE6	endp


; =============== S U B	R O U T	I N E =======================================



sub_1002EC3	proc near		; CODE XREF: .text:01002EEAp
					; .text:01002EF3p
		xor	eax, eax
		retn	8
sub_1002EC3	endp

; ---------------------------------------------------------------------------
		push	esi
		mov	esi, [esp+8]
		push	dword ptr [esi+8]
		call	sub_10028B5
		test	eax, eax
		jz	short loc_1002F0A
		mov	ecx, [eax+24h]
		dec	ecx
		jz	short loc_1002F03
		dec	ecx
		jz	short loc_1002EFA
		dec	ecx
		jz	short loc_1002EF1
		dec	ecx
		jnz	short loc_1002F0A
		push	esi
		push	eax
		call	sub_1002EC3
		jmp	short loc_1002F0A
; ---------------------------------------------------------------------------


loc_1002EF1:				; CODE XREF: .text:01002EE3j
		push	esi
		push	eax
		call	sub_1002EC3
		jmp	short loc_1002F0A
; ---------------------------------------------------------------------------


loc_1002EFA:				; CODE XREF: .text:01002EE0j
		push	esi
		push	eax
		call	sub_1002CE6
		jmp	short loc_1002F0A
; ---------------------------------------------------------------------------


loc_1002F03:				; CODE XREF: .text:01002EDDj
		push	esi
		push	eax
		call	sub_1002B5E


loc_1002F0A:				; CODE XREF: .text:01002ED7j
					; .text:01002EE6j ...
		pop	esi
		retn	4

; =============== S U B	R O U T	I N E =======================================



sub_1002F0E	proc near		; CODE XREF: .text:01002F51p

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		xor	eax, eax
		cmp	[esp+arg_4], eax
		jbe	short loc_1002F27


loc_1002F16:				; CODE XREF: sub_1002F0E+17j
		mov	ecx, [esp+arg_0]
		cmp	byte ptr [eax+ecx], 0
		jz	short loc_1002F2C
		inc	eax
		cmp	eax, [esp+arg_4]
		jb	short loc_1002F16


loc_1002F27:				; CODE XREF: sub_1002F0E+6j
		xor	eax, eax

locret_1002F29:				; CODE XREF: sub_1002F0E+21j
		retn	8
; ---------------------------------------------------------------------------


loc_1002F2C:				; CODE XREF: sub_1002F0E+10j
		push	1
		pop	eax
		jmp	short locret_1002F29
sub_1002F0E	endp

; ---------------------------------------------------------------------------
		push	ebp
		mov	ebp, esp
		sub	esp, 28h
		push	ebx
		and	dword ptr [ebp-10h], 0
		and	dword ptr [ebp-14h], 0
		push	esi
		mov	esi, [ebp+8]
		push	edi
		push	0FFBAh
		lea	ebx, [esi+36h]
		push	ebx
		mov	[ebp-18h], ebx
		call	sub_1002F0E
		test	eax, eax
		jz	near ptr byte_100330F
		mov	edi, ebx
		or	ecx, 0FFFFFFFFh
		xor	eax, eax
		push	10034h
		repne scasb
		not	ecx
		dec	ecx
		lea	eax, [ecx+ebx+1]
		mov	[ebp-4], eax
		call	ds:dword_1001094
		mov	ebx, eax
		pop	ecx
		test	ebx, ebx
		jz	near ptr byte_1003331
		mov	ecx, 400Dh
		xor	eax, eax
		mov	edi, ebx
		rep stosd
		push	dword ptr [esi+10h]
		call	ds:dword_1001120
		mov	[ebp-8], eax
		mov	ax, [esi+0Eh]
		push	eax
		call	ds:dword_1001104
		mov	edi, [ebp-4]
		mov	[ebp-0Ch], edi
		mov	al, [edi]
		test	al, al
		jz	short loc_1002FCD


loc_1002FB5:				; CODE XREF: .text:01002FC8j
		movsx	eax, al
		push	eax
		call	ds:dword_1001150
		mov	[edi], al
		mov	al, [edi+1]
		inc	edi
		pop	ecx
		test	al, al
		jnz	short loc_1002FB5
		mov	[ebp-0Ch], edi


loc_1002FCD:				; CODE XREF: .text:01002FB3j
		mov	edi, [ebp-4]
		mov	eax, offset aNetascii ;	"netascii"


loc_1002FD5:				; CODE XREF: .text:01002FF1j
		mov	dl, [edi]
		mov	cl, dl
		cmp	dl, [eax]
		jnz	short loc_1002FF7
		test	cl, cl
		jz	short loc_1002FF3
		mov	dl, [edi+1]
		mov	cl, dl
		cmp	dl, [eax+1]
		jnz	short loc_1002FF7
		inc	edi
		inc	edi
		inc	eax
		inc	eax
		test	cl, cl
		jnz	short loc_1002FD5


loc_1002FF3:				; CODE XREF: .text:01002FDFj
		xor	eax, eax
		jmp	short loc_1002FFC
; ---------------------------------------------------------------------------


loc_1002FF7:				; CODE XREF: .text:01002FDBj
					; .text:01002FE9j
		sbb	eax, eax
		sbb	eax, 0FFFFFFFFh


loc_1002FFC:				; CODE XREF: .text:01002FF5j
		test	eax, eax
		jz	short near ptr byte_1003037
; ---------------------------------------------------------------------------
		dd 0Dh dup(?)
		db 3 dup(?)
byte_1003037	db ?			; CODE XREF: .text:01002FFEj
		dd 0B5h	dup(?)
		db 3 dup(?)
byte_100330F	db ?			; CODE XREF: .text:01002F58j
		dd 8 dup(?)
		db ?
byte_1003331	db 3 dup(?)		; CODE XREF: .text:01002F81j
		dd 101h	dup(?)
		db 2 dup(?)
word_100373A	dw ?			; CODE XREF: sub_1002CE6+D7p
		dd 20h dup(?)
		db 3 dup(?)
byte_10037BF	db ?			; CODE XREF: .text:loc_10017F3p
		dd 54h dup(?)
dword_1003910	dd 4Bh dup(?)			db 2 dup(?)
word_1003A3E	dw ?			; CODE XREF: sub_100230A+8p
		dd ?
dword_1003A44	dd ?							; sub_1002219+DAp
		db 2 dup(?)
word_1003A4A	dw ?			; CODE XREF: sub_1001FA6+1Fp
					; sub_1001FA6+43p
		dd 26Dh	dup(?)
_text		ends

; Section 2. (virtual address 00005000)
; Virtual size			: 000012DC (   4828.)
; Section size in file		: 00000E00 (   3584.)
; Offset to raw	data for section: 00003A00
; Flags	C0000040: Data Readable	Writable
; Alignment	: default
; ===========================================================================

; Segment type:	Pure data
; Segment permissions: Read/Write
_data		segment	para public 'DATA' use32
		assume cs:_data
		;org 1005000h
		dd 4 dup(?)
dword_1005010	dd 326h	dup(?)	dword_1005CA8	dd 2 dup(?)	dword_1005CB0	dd 4 dup(?)	dword_1005CC0	dd ?				dd 43h dup(?)
dword_1005DD0	dd ?							; sub_1001E73:loc_1001F36r ...
dword_1005DD4	dd ?		dword_1005DD8	dd ?							; .text:loc_100182Er ...
dword_1005DDC	dd ?							; .text:010016F0r ...
dword_1005DE0	dd ?							; sub_1001E73:loc_1001F0Cr ...
		dd 2 dup(?)
dword_1005DEC	dd ?							; sub_1001A1F+52r
dword_1005DF0	dd ?							; sub_1001A1F+5Ew
dword_1005DF4	dd ?		dword_1005DF8	dd ?							; sub_10018DB+EFr
dword_1005DFC	dd ?		dword_1005E00	dd 2 dup(?)						; sub_1002219+D5o
dword_1005E08	dd 86h dup(?)	dword_1006020	dd 6 dup(?)						; sub_1002219+Bo ...
dword_1006038	dd ?							; sub_10018DB+34w ...
dword_100603C	dd ?		dword_1006040	dd ?							; sub_1001DEB:loc_1001E35r
dword_1006044	dd ?							; .text:01001740r ...
dword_1006048	dd 6 dup(?)	dword_1006060	dd 6 dup(?)						; sub_1001A1F+2o
dword_1006078	dd ?							; sub_10019F0+Fw ...
dword_100607C	dd ?		dword_1006080	dd 6 dup(?)						; .text:01002880o ...
dword_1006098	dd ?							; sub_10018DB+25w ...
dword_100609C	dd ?		dword_10060A0	dd ?							; sub_10018DB+A2r ...
		dd 7 dup(?)
dword_10060C0	dd 10h dup(?)						; .text:loc_1001857o
dword_1006100	dd 4 dup(?)						; sub_1002219:loc_10022E9o
dword_1006110	dd ?				align 10h
dword_1006120	dd ?							; .text:010016C8o ...
dword_1006124	dd ?							; .text:01001736w ...
dword_1006128	dd ?							; .text:01001746w
dword_100612C	dd ?							; sub_1001E73+5Aw ...
dword_1006130	dd ?							; sub_1001E73+60w ...
dword_1006134	dd ?							; .text:01001750w ...
dword_1006138	dd ?							; .text:01001756w ...
		align 10h
dword_1006140	dd 0B0h	dup(?)	_data		ends

; Section 3. (virtual address 00007000)
; Virtual size			: 00007400 (  29696.)
; Section size in file		: 00002200 (   8704.)
; Offset to raw	data for section: 00004800
; Flags	E0000060: Text Data Executable Readable	Writable
; Alignment	: default
; ===========================================================================

; Segment type:	Pure code
; Segment permissions: Read/Write/Execute
_rsrc		segment	para public 'CODE' use32
		assume cs:_rsrc
		;org 1007000h
		assume es:nothing, ss:nothing, ds:nothing, fs:nothing, gs:nothing
		dd 100h	dup(?)
		assume ds:_data
		public start
start		dd 1C00h dup(?)
_rsrc		ends


		end start