Function at 0x1001a509
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1007e31b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x278
push ebx
push esi
push edi
mov dword [esp + 0x60], ecx
lea ecx, [esp + 0x170]
mov dword [esp + 0x20], 0xfffffff9
mov dword [esp + 0x18], 0xffff
push 4
mov dword [esp + 0xec], edx
call fcn.10018602
xor ebx, ebx
mov dword [esp + 0x2c], 0xfffffffc
mov dword [esp + 0x10], ebx
jmp 0x1001a576
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x64], 0xd8ef068c
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1001a566
mov dword [esp + 0x10], ebx
jmp 0x1001a599
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x170]
mov dword [eax + ecx*4], 0xee676845
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x1001a583
push 0xffffffffffffffff
mov dword [esp + 0x14], ebx
pop edi
jmp 0x1001a5b8
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x240], edi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x1001a5a9
push 1
pop esi
cmp dword [esp + 0x20], ebx
jne 0x1001a5fe
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
cmp ecx, eax
sbb eax, eax
neg eax
cmp dword [esp + 0x20], eax
jg 0x1001a5ea
mov eax, dword [esp + 0x68]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x64]
mov eax, dword [esp + 0x68]
mov eax, ebx
cmp dword [esp + 0x64], ebx
je 0x1001a600
mov eax, esi
mov ecx, dword [esp + 0x20]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
add ecx, dword [esp + 0x64]
mov eax, dword [esp + 0x170]
mov dword [eax + 8], ecx
mov dword [esp + 0x18], 0xffffffe4
jmp 0x1001a701
mov dword [esp + 0x24], 6
mov dword [esp + 0x10], edi
mov dword [esp + 0x28], edi
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x24], ebx
jne 0x1001a663
imul eax, dword [esp + 0x240], 0x2aec
test eax, eax
je 0x1001a657
mov eax, esi
cmp dword [esp + 0x24], ebx
jne 0x1001a659
mov eax, ebx
cmp eax, dword [esp + 0x10]
jl 0x1001a663
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x68]
xor edx, edx
mov eax, dword [esp + 0x10]
cmp eax, ecx
setl dl
mov dword [esp + 0x24], edx
cmp dword [esp + 0x24], ebx
je 0x1001a684
mov ecx, esi
cmp dword [esp + 0x20], ebx
jne 0x1001a686
mov ecx, ebx
mov eax, dword [esp + 0x170]
cmp ecx, 0x99e60473
mov dword [eax], ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [esp + 0x10]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
sub ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x68]
cmp ecx, eax
mov eax, dword [esp + 0x10]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x10]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x10]
setle dl
xor ecx, ecx
cmp edx, eax
setge cl
xor edx, edx
add ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
cmp ecx, eax
mov eax, dword [esp + 0x64]
setne dl
sub edx, eax
mov eax, dword [esp + 0x10]
imul eax, edx
neg eax
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
neg eax
mov dword [esp + 0x2c], eax
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0x3c
jne 0x1001a626
lea ecx, [esp + 0x170]
call fcn.10018684
mov dword [esp + 0x18], ebx
mov dword [esp + 0x3c], 9
push 3
mov dword [esp + 0x38], edi
pop ecx
mov dword [esp + 0x30], ecx
mov dword [esp + 0x38], 0xb108
mov dword [esp + 0x24], ebx
jmp 0x1001a74c
mov eax, dword [esp + 0x24]
mov dword [esp + eax*4 + 0x110], ebx
inc dword [esp + 0x24]
cmp dword [esp + 0x24], ecx
jl 0x1001a73d
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
push 0xfffffffffffffffe
pop eax
mov dword [esp + 0x18], eax
cmp dword [esp + 0x18], eax
jg 0x1001a94f
mov dword [esp + 0x24], 0x9c1464f1
mov dword [esp + 0x14], esi
mov dword [esp + 0x28], 0xffffffff
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x24]
dec edx
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setge cl
xor edx, edx
imul ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
cmp ecx, eax
mov eax, dword [esp + 0x18]
setle dl
xor ecx, ecx
cmp edx, eax
setl cl
imul ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x2c], ecx
xor ecx, ecx
cmp dword [esp + 0x2c], eax
setge cl
cmp ecx, 0x3cd3
jg 0x1001a7d4
mov edx, ebx
cmp dword [esp + 0x30], ebx
je 0x1001a7d6
mov edx, esi
mov eax, dword [esp + 0x30]
xor ecx, ecx
cmp edx, eax
sete cl
mov dword [esp + 0x24], ecx
cmp dword [esp + 0x24], ebx
jne 0x1001a876
cmp dword [esp + 0x18], ebx
je 0x1001a7fb
cmp dword [esp + 0x14], ebx
jne 0x1001a7fd
mov esi, ebx
mov eax, dword [esp + 0x114]
xor edx, edx
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
cmp ecx, eax
setg dl
xor eax, eax
cmp edx, 0x46ac1dea
setne al
neg eax
cmp eax, 0xffffffff
mov eax, dword [esp + 0x114]
sbb ecx, ecx
xor edx, edx
inc ecx
imul ecx, eax
mov eax, dword [esp + 0x118]
cmp ecx, eax
mov eax, dword [esp + 0x28]
setg dl
sub edx, eax
xor eax, eax
test edx, edx
setle al
xor ecx, ecx
sub esi, eax
mov eax, dword [esp + 0x38]
cmp esi, eax
setg cl
xor edx, edx
mov dword [esp + 0x34], ecx
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
cmp eax, ecx
setl dl
xor esi, esi
inc esi
cmp edx, dword [esp + 0x28]
mov edx, ebx
jg 0x1001a878
mov edx, esi
mov eax, dword [esp + 0x24]
xor ecx, ecx
cmp edx, eax
setg cl
cmp ecx, dword [esp + 0x3c]
jge 0x1001a8ef
mov dword [esp + 0x28], 0xffffffff
mov ecx, 0x14707e7b
mov dword [esp + 0x24], 0xe6d7
mov dword [esp + 0x2c], 0xaa0e6852
mov eax, dword [esp + 0x114]
sub ecx, eax
mov eax, dword [esp + 0x28]
add eax, ecx
cmp eax, dword [esp + 0x24]
jg 0x1001a8c3
mov eax, ebx
cmp dword [esp + 0x34], ebx
je 0x1001a8c5
mov eax, esi
xor ecx, ecx
test eax, eax
mov eax, dword [esp + 0x28]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x24]
setge dl
xor ecx, ecx
neg edx
cmp edx, eax
setge cl
imul ecx, dword [esp + 0x14]
mov dword [esp + 0x2c], ecx
jmp 0x1001a940
mov byte [esp + 0x1f], bl
cmp byte [esp + 0x1f], bl
je 0x1001a940
push 0x257
push 0xb7
push 0x8f6
push 0x1ec7
push 0x1d0
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x21c6
push 0x8f0
push 0x6b4
push 0x1c96
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_StretchBlt]
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0xfffffffe
jle 0x1001a769
push 2
lea ecx, [esp + 0x12c]
call fcn.10018602
push 2
lea ecx, [esp + 0xfc]
mov dword [esp + 0x290], ebx
call fcn.10018602
push 2
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x14], ebx
pop edx
jmp 0x1001a995
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x128]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x1001a983
mov dword [esp + 0x10], ebx
jmp 0x1001a9b1
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x44], 3
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x1001a9a1
mov dword [esp + 0x10], ebx
jmp 0x1001a9d3
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xf8]
mov dword [eax + ecx*4], 0xfffffff8
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x1001a9bd
mov dword [esp + 0x44], esi
cmp dword [esp + 0x44], ebx
jl 0x1001aaa5
mov dword [esp + 0x10], 4
mov dword [esp + 0x28], 3
mov dword [esp + 0x10], ebx
jmp 0x1001aa16
mov eax, dword [esp + 0x44]
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x128]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jle 0x1001a9fd
mov dword [esp + 0x10], ebx
jmp 0x1001aa95
mov dword [esp + 0x24], 0xfffffffc
mov eax, dword [esp + 0x24]
cmp eax, dword [esp + 0x24]
jne 0x1001aa3c
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
neg edx
mov eax, dword [esp + 0x128]
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, dword [eax]
setle cl
xor edx, edx
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
cmp eax, ecx
mov eax, dword [esp + 0xf8]
setge dl
mov dword [eax], edx
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x44]
mov eax, dword [esp + 0xf8]
add ecx, dword [eax]
mov dword [esp + 0x2c], ecx
mov eax, dword [esp + 0x10]
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jle 0x1001aa22
dec dword [esp + 0x44]
jns 0x1001a9e7
lea ecx, [esp + 0xf8]
call fcn.10018684
or dword [esp + 0x28c], 0xffffffff
lea ecx, [esp + 0x128]
call fcn.10018684
push dword [esp + 0x60]
movdqa xmm0, xmmword [0x10008320]
lea eax, [esp + 0x228]
push eax
lea eax, [esp + 0x21c]
mov dword [esp + 0x160], ebx
push eax
push ebx
lea ecx, [esp + 0x168]
mov dword [esp + 0x16c], ebx
movdqu xmmword [esp + 0x224], xmm0
mov dword [esp + 0x170], ebx
call fcn.10019cc2
mov dword [esp + 0x24], 0xfffffff7
mov dword [esp + 0x24], ebx
jmp 0x1001ab37
mov byte [esp + 0x1f], bl
cmp byte [esp + 0x1f], 0
je 0x1001ab33
push 0x19cd
call edi
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 3
jle 0x1001ab1a
lea ecx, [esp + 0x158]
call fcn.10018684
push 2
lea ecx, [esp + 0x180]
call fcn.10018602
mov dword [esp + 0x28c], esi
lea ecx, [esp + 0x188]
mov dword [esp + 0x24], 0x9bdba76a
mov eax, 0x4039b642
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], eax
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], eax
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x28], 3
mov dword [esp + 0x34], 0xfffffff6
mov dword [esp + 0x30], 0x80643b8a
push 2
call fcn.10018602
mov dword [esp + 0x2c], 0x6e3f0e26
mov dword [esp + 0x24], ebx
jmp 0x1001abcc
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x188]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 2
jl 0x1001abba
dec dword [esp + 0x3c]
mov eax, dword [esp + 0x7c]
inc dword [esp + 0x30]
je 0x1001ac4d
mov eax, dword [esp + 0x7c]
xor ecx, ecx
mov edx, dword [esp + 0x188]
cmp eax, 0x7279
setge cl
cmp ecx, dword [edx + 4]
je 0x1001ac03
mov eax, esi
cmp dword [esp + 0x3c], ebx
jne 0x1001ac05
mov eax, ebx
xor ecx, ecx
cmp eax, 8
sete cl
xor eax, eax
cmp ecx, dword [edx + 4]
setl al
imul eax, eax, 0xffff
test eax, eax
jne 0x1001ac23
mov eax, dword [esp + 0x78]
mov eax, dword [esp + 0x78]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x78]
dec eax
add eax, dword [edx + 4]
mov edx, esi
neg eax
sbb eax, eax
neg eax
mov dword [esp + 0x78], eax
jne 0x1001ac4f
mov edx, ebx
mov eax, dword [esp + 0x28]
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
cmp ecx, 9
lea ecx, [esp + 0x188]
setg al
imul eax, dword [esp + 0x34]
mov dword [esp + 0x2c], eax
call fcn.10018684
mov dword [esp + 0x3c], 0xffffffff
lea ecx, [esp + 0x1ac]
mov eax, 0x4039b642
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], eax
mov dword [esp + 0x90], eax
mov dword [esp + 0x94], eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x28], 3
mov dword [esp + 0x34], 0xfffffff6
mov dword [esp + 0x30], 0x80643b8a
push 2
call fcn.10018602
mov dword [esp + 0x2c], 0x6e3f0e26
mov dword [esp + 0x24], ebx
jmp 0x1001acea
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x1ac]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 2
jl 0x1001acd8
dec dword [esp + 0x14]
mov eax, dword [esp + 0x8c]
inc dword [esp + 0x30]
je 0x1001ad7d
mov eax, dword [esp + 0x8c]
xor ecx, ecx
mov edx, dword [esp + 0x1ac]
cmp eax, 0x7279
setge cl
cmp ecx, dword [edx + 4]
je 0x1001ad27
mov eax, esi
cmp dword [esp + 0x14], ebx
jne 0x1001ad29
mov eax, ebx
xor ecx, ecx
cmp eax, 8
sete cl
xor eax, eax
cmp ecx, dword [edx + 4]
setl al
imul eax, eax, 0xffff
test eax, eax
jne 0x1001ad4a
mov eax, dword [esp + 0x88]
mov eax, dword [esp + 0x88]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x88]
dec eax
add eax, dword [edx + 4]
mov edx, esi
neg eax
sbb eax, eax
neg eax
mov dword [esp + 0x88], eax
jne 0x1001ad7f
mov edx, ebx
mov eax, dword [esp + 0x28]
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
cmp ecx, 9
lea ecx, [esp + 0x1ac]
setg al
imul eax, dword [esp + 0x34]
mov dword [esp + 0x2c], eax
call fcn.10018684
push 3
lea ecx, [esp + 0x1bc]
call fcn.10018602
mov byte [esp + 0x28c], 2
mov dword [esp + 0x10], 0xd453
mov dword [esp + 0x18], 0x207182b4
mov dword [esp + 0x14], 7
mov dword [esp + 0x28], 0x2e71cc54
mov dword [esp + 0x28], 0xd4fe9304
mov dword [esp + 0x30], 0x4f86fc33
mov dword [esp + 0x24], ebx
jmp 0x1001ae06
mov eax, dword [esp + 0x24]
mov dword [esp + eax*4 + 0xcc], 0x461d0ee3
inc dword [esp + 0x24]
cmp dword [esp + 0x24], esi
jl 0x1001adf3
cmp dword [esp + 0x10], ebx
jne 0x1001ae4f
mov eax, dword [esp + 0x10]
sub eax, dword [esp + 0x10]
je 0x1001ae20
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
add eax, 0x6bd2
jne 0x1001ae37
mov ecx, ebx
cmp dword [esp + 0x10], ebx
je 0x1001ae39
mov ecx, esi
xor eax, eax
cmp ecx, 0xffffffff
setl al
add eax, dword [esp + 0x10]
jne 0x1001ae4f
mov eax, ebx
cmp dword [esp + 0x14], ebx
je 0x1001ae51
mov eax, esi
mov dword [esp + 0x14], eax
xor edx, edx
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
cmp ecx, eax
setge dl
mov dword [esp + 0x28], edx
xor edx, edx
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x10]
cmp ecx, eax
mov eax, dword [esp + 0x18]
setne dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [esp + 0x10]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x10]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x10]
setge cl
xor edx, edx
cmp ecx, 0xca6d786f
setne dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [esp + 0x10]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x10]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x10]
setg cl
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [esp + 0x10]
setge dl
xor ecx, ecx
cmp edx, eax
setne cl
xor edx, edx
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x28]
cmp eax, ecx
setge dl
add edx, dword [esp + 0x10]
mov dword [esp + 0x30], edx
mov dword [esp + 0x18], ebx
jmp 0x1001af1c
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0xcc], esi
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jl 0x1001af0d
push dword [esp + 0x60]
movdqa xmm0, xmmword [0x100082b0]
lea eax, [esp + 0x218]
push eax
lea eax, [esp + 0x20c]
mov dword [esp + 0xf4], ebx
push eax
push ebx
lea ecx, [esp + 0xfc]
mov dword [esp + 0x100], ebx
movdqu xmmword [esp + 0x214], xmm0
mov dword [esp + 0x104], ebx
call fcn.10019cc2
mov byte [esp + 0x28c], 3
lea eax, [esp + 0x234]
push dword [esp + 0x60]
movdqa xmm0, xmmword [0x10008310]
lea ecx, [esp + 0xd4]
push eax
lea eax, [esp + 0x22c]
mov dword [esp + 0xd8], ebx
push eax
push ebx
movdqu xmmword [esp + 0x234], xmm0
mov dword [esp + 0xe4], ebx
mov dword [esp + 0xe8], ebx
call fcn.10019cc2
mov eax, dword [esp + 0xd0]
lea ecx, [esp + 0xd0]
mov dword [esp + 0x2c], 0xfffffffc
mov dword [esp + 0x2c], 4
mov dword [esp + 0x2c], esi
mov dword [eax], 0xfffffff9
mov byte [esp + 0x28c], 3
call fcn.10018684
push 2
lea ecx, [esp + 0x1d4]
call fcn.10018602
mov byte [esp + 0x28c], 7
mov dword [esp + 0x14], 0xbecba2af
mov dword [esp + 0x24], ebx
jmp 0x1001b027
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x1d0]
mov dword [eax + ecx*4], 0xdd33a4a9
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 2
jl 0x1001b011
mov dword [esp + 0x14], ebx
jmp 0x1001b08b
push esi
lea ecx, [esp + 0x144]
call fcn.10018602
mov dword [esp + 0x24], ebx
jmp 0x1001b05d
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x140]
mov dword [eax + ecx*4], 0xfffffffa
inc dword [esp + 0x24]
cmp dword [esp + 0x24], esi
jl 0x1001b047
mov byte [esp + 0x1f], bl
cmp byte [esp + 0x1f], 0
je 0x1001b074
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov eax, dword [esp + 0x140]
lea ecx, [esp + 0x140]
call fcn.10018684
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jle 0x1001b034
lea ecx, [esp + 0x1d0]
mov byte [esp + 0x28c], 3
call fcn.10018684
push ebx
lea eax, [esp + 0x180]
push eax
lea eax, [esp + 0x60]
push eax
push 0x5882
call fcn.1001e9e6
add esp, 0x10
mov dword [esp + 0x58], ebx
jmp 0x1001b0d9
mov ecx, dword [esp + 0x58]
mov eax, dword [esp + 0x1b8]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x58]
cmp dword [esp + 0x58], 3
jl 0x1001b0c6
mov dword [esp + 0x24], ebx
jmp 0x1001c33d
push 2
lea ecx, [esp + 0x1a4]
call fcn.10018602
mov byte [esp + 0x28c], 8
mov dword [esp + 0x10], ebx
jmp 0x1001b115
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x40], 0x7a888ada
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x1001b105
push 2
mov dword [esp + 0x14], ebx
pop edx
jmp 0x1001b13a
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x1a0]
mov dword [eax + ecx*4], 0x25bb5a27
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x1001b124
mov dword [esp + 0x10], 6
mov dword [esp + 0x28], 5
mov dword [esp + 0x30], 0x48abb75d
mov dword [esp + 0x14], 0xffff
mov dword [esp + 0x2c], 3
mov dword [esp + 0x18], ebx
jmp 0x1001b181
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x260], 0xfffffff8
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edx
jl 0x1001b16e
cmp dword [esp + 0x10], ebx
jne 0x1001b1a1
mov dword [esp + 0x30], esi
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
add eax, 0xfffd
je 0x1001b1b0
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x30]
cmp dword [esp + 0x10], ebx
jne 0x1001b1c2
mov ecx, ebx
cmp dword [esp + 0x14], ebx
je 0x1001b1c4
mov ecx, esi
mov eax, dword [esp + 0x10]
imul eax, ecx
test eax, eax
je 0x1001b1d3
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
xor edx, edx
sub eax, 0x2751
mov dword [esp + 0x28], eax
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
cmp ecx, eax
setg dl
sub edx, dword [esp + 0x14]
neg edx
sbb edx, edx
inc edx
sub edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
add ecx, dword [esp + 0x28]
sub ecx, dword [esp + 0x14]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x40], esi
cmp dword [esp + 0x40], ebx
jl 0x1001c325
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], ebx
jmp 0x1001b248
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x268], 0x648261f9
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x1001b235
mov dword [esp + 0x18], 2
cmp dword [esp + 0x18], ebx
jl 0x1001b2bf
mov dword [esp + 0x14], ebx
jmp 0x1001b276
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0xbc], 0x37d45db3
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x1001b263
mov dword [esp + 0xc4], ebx
jmp 0x1001b2af
mov byte [esp + 0x1f], bl
cmp byte [esp + 0x1f], 0
je 0x1001b2a8
push 0x895
push 0x6fd
push ebx
push ebx
push 0x1047
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
inc dword [esp + 0xc4]
cmp dword [esp + 0xc4], 2
jle 0x1001b286
dec dword [esp + 0x18]
jns 0x1001b25d
mov byte [esp + 0x1f], bl
cmp byte [esp + 0x1f], 0
je 0x1001b2d8
push 0x26b0
push ebx
push ebx
push ebx
call dword [sym.imp.GDI32.dll_CombineRgn]
push 4
lea ecx, [esp + 0x9c]
call fcn.10018602
mov byte [esp + 0x28c], 9
mov dword [esp + 0x10], 6
mov dword [esp + 0x28], 5
mov dword [esp + 0x30], 0x48abb75d
mov dword [esp + 0x14], 0xffff
mov dword [esp + 0x2c], 3
mov dword [esp + 0x18], ebx
jmp 0x1001b32f
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x258], 0xfffffff8
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jl 0x1001b31c
cmp dword [esp + 0x10], ebx
jne 0x1001b350
mov dword [esp + 0x30], esi
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
add eax, 0xfffd
je 0x1001b35f
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x30]
cmp dword [esp + 0x10], ebx
jne 0x1001b371
mov ecx, ebx
cmp dword [esp + 0x14], ebx
je 0x1001b373
mov ecx, esi
mov eax, dword [esp + 0x10]
imul eax, ecx
test eax, eax
je 0x1001b382
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
xor edx, edx
sub eax, 0x2751
mov dword [esp + 0x28], eax
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
cmp ecx, eax
setg dl
sub edx, dword [esp + 0x14]
neg edx
sbb edx, edx
inc edx
sub edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
add ecx, dword [esp + 0x28]
sub ecx, dword [esp + 0x14]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x2c], 0xf8278b7
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x28], 0xf8393131
mov dword [esp + 0x2c], 0xf3af71e1
mov dword [esp + 0x14], ebx
jmp 0x1001b402
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x48], 8
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x1001b3f2
mov dword [esp + 0x20], ebx
cmp dword [esp + 0x20], ebx
jl 0x1001b5f2
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], 0xa1220985
mov dword [esp + 0x34], 0x8530de9b
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x10], ebx
jl 0x1001b466
mov dword [esp + 0x2c], esi
mov eax, dword [esp + 0x20]
mov eax, dword [esp + eax*4 + 0x48]
mov dword [esp + 0x14], eax
mov dword [esp + 0x14], ebx
cmp dword [esp + 0x14], ebx
jl 0x1001b460
mov dword [esp + 0x30], 0xfffffff7
dec dword [esp + 0x30]
dec dword [esp + 0x14]
jns 0x1001b44e
dec dword [esp + 0x10]
jns 0x1001b434
mov dword [esp + 0x34], ebx
cmp dword [esp + 0x34], ebx
jl 0x1001b5e8
mov dword [esp + 0x18], 0x5764
mov dword [esp + 0x10], ebx
jmp 0x1001b5d4
mov dword [esp + 0x30], ebx
mov dword [esp + 0x38], 8
mov dword [esp + 0x14], ebx
jmp 0x1001b4a7
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x74], 0xc76e8d2c
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x1001b497
mov eax, dword [esp + 0x48]
cmp dword [esp + 0x10], 0xfffffffb
sbb eax, eax
xor edx, edx
neg eax
cmp eax, esi
mov eax, dword [esp + 0x18]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x18]
setg cl
xor edx, edx
cmp ecx, 0xffffffff
setle dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [esp + 0x10]
setne cl
xor edx, edx
imul ecx, ecx, 0x3f36
mov eax, dword [esp + eax*4 + 0x48]
cmp ecx, eax
mov eax, dword [esp + 0x10]
setl dl
xor ecx, ecx
mov eax, dword [esp + eax*4 + 0x48]
cmp eax, edx
mov eax, dword [esp + 0x18]
setle cl
xor edx, edx
cmp ecx, 0xfffffff7
setne dl
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, 0x7b69
setle al
mov dword [esp + 0x30], eax
cmp dword [esp + 0x30], ebx
jne 0x1001b533
mov edx, ebx
cmp dword [esp + 0x18], ebx
je 0x1001b535
mov edx, esi
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov eax, dword [esp + eax*4 + 0x48]
cmp edx, eax
setl cl
mov dword [esp + 0x14], ecx
xor ecx, ecx
mov eax, dword [esp + 0x30]
cmp eax, 5
setne cl
sub ecx, dword [esp + 0x28]
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, dword [esp + 0x18]
jge 0x1001b56b
mov ecx, esi
cmp dword [esp + 0x28], ebx
jne 0x1001b56d
mov ecx, ebx
mov eax, dword [esp + 0x38]
xor edx, edx
cmp eax, ecx
setl dl
sub edx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
sub edx, 0x218a
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [esp + 0x10]
setle cl
xor edx, edx
cmp ecx, 2
setne dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [esp + 0x74]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x74]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x38]
setne cl
mov dword [esp + 0x2c], ecx
xor ecx, ecx
cmp eax, dword [esp + 0x2c]
setne cl
mov dword [esp + 0x28], ecx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ebx
jle 0x1001b485
dec dword [esp + 0x34]
jns 0x1001b474
dec dword [esp + 0x20]
jns 0x1001b416
mov dword [esp + 0x20], ebx
jmp 0x1001b65d
mov dword [esp + 0x18], 0x764457c1
mov dword [esp + 0x28], 0xfccff5f9
mov dword [esp + 0x2c], 0xf82eddaa
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x48]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x48]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x48]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x28]
sub eax, dword [esp + 0x18]
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x2c], eax
dec dword [esp + 0x20]
cmp dword [esp + 0x20], 0xffffffe5
je 0x1001b5f8
mov dword [esp + 0x2c], 0x29efec1a
lea ecx, [esp + 0x1c4]
push 2
call fcn.10018602
mov byte [esp + 0x28c], 0xa
mov dword [esp + 0x18], 0xbecba2af
mov dword [esp + 0x14], ebx
jmp 0x1001b6a6
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c4]
mov dword [eax + ecx*4], 0xdd33a4a9
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x1001b690
mov dword [esp + 0x18], ebx
jmp 0x1001b70a
push esi
lea ecx, [esp + 0x108]
call fcn.10018602
mov dword [esp + 0x14], ebx
jmp 0x1001b6dc
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x104]
mov dword [eax + ecx*4], 0xfffffffa
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x1001b6c6
mov byte [esp + 0x1f], bl
cmp byte [esp + 0x1f], 0
je 0x1001b6f3
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov eax, dword [esp + 0x104]
lea ecx, [esp + 0x104]
call fcn.10018684
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jle 0x1001b6b3
lea ecx, [esp + 0x1c4]
mov byte [esp + 0x28c], 9
call fcn.10018684
lea eax, [esp + 0xc8]
push eax
push 0x10aa
push ebx
lea eax, [esp + 0xa4]
push 0x46b7
push eax
call fcn.1001e2a8
add esp, 0x14
lea ecx, [esp + 0x1e8]
push 3
call fcn.10018602
mov byte [esp + 0x28c], 0xb
lea ecx, [esp + 0x1dc]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x2c], ebx
push 2
call fcn.10018602
mov dword [esp + 0x20], ebx
jmp 0x1001b78f
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x1e8]
mov dword [eax + ecx*4], 0xfdf99ff6
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 3
jl 0x1001b779
push 2
mov dword [esp + 0x24], ebx
pop edx
jmp 0x1001b7b5
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x1dc]
mov dword [eax + ecx*4], 0x87e08a11
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edx
jl 0x1001b79f
mov dword [esp + 0x14], ebx
jmp 0x1001b857
mov dword [esp + 0x18], 0x44696a48
mov dword [esp + 0x2c], 0x73292c5e
mov dword [esp + 0x2c], 0xb01d91e6
mov dword [esp + 0x2c], 0xbfb3a4d
mov dword [esp + 0x2c], 0xfffffffe
mov dword [esp + 0x18], ebx
jmp 0x1001b831
mov byte [esp + 0x1f], bl
cmp byte [esp + 0x1f], 0
je 0x1001b82d
push 0xfb2
push 0x12dc
push 0x1b18
push 0x111b
push 0x102a
push ebx
push ebx
push ebx
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawStateW]
push 2
pop edx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edx
jle 0x1001b7f2
mov dword [esp + 0x18], edx
cmp dword [esp + 0x18], ebx
jl 0x1001b853
mov dword [esp + 0x38], 0xc32b96ce
inc dword [esp + 0x38]
dec dword [esp + 0x18]
jns 0x1001b841
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jle 0x1001b7c4
lea ecx, [esp + 0x1dc]
call fcn.10018684
lea ecx, [esp + 0x1e8]
mov byte [esp + 0x28c], 9
call fcn.10018684
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x17c]
cmp dword [eax + ecx*4], ebx
je 0x1001b895
mov eax, dword [esp + 0x40]
mov eax, dword [esp + 0x98]
cmp dword [eax], ebx
jne 0x1001b8a4
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x24]
xor ecx, ecx
mov esi, dword [esp + 0x40]
mov eax, dword [esp + 0x98]
cmp dword [eax], 0x5a83d87e
mov eax, dword [esp + 0x40]
setle cl
xor edx, edx
cmp ecx, eax
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x17c]
setne dl
add ecx, edx
xor edx, edx
cmp dword [eax + esi*4], ecx
setle dl
xor esi, esi
inc esi
cmp edx, 0x446c
jle 0x1001bee3
mov dword [esp + 0x18], 9
mov dword [esp + 0x2c], esi
mov dword [esp + 0x14], ebx
jmp 0x1001b912
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x234], 0xffffffff
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x1001b8ff
mov dword [esp + 0x18], ebx
jmp 0x1001b97f
mov dword [esp + 0x34], 0xadae8c9f
mov dword [esp + 0x38], ebx
mov byte [esp + 0x1f], bl
cmp byte [esp + 0x1f], 0
je 0x1001b93e
cmp dword [esp + 0x18], 0xffffffeb
jle 0x1001b91f
push dword [esp + 0xc8]
lea eax, [esp + 0x208]
mov dword [esp + 0xa8], ebx
push eax
lea eax, [esp + 0x1fc]
mov dword [esp + 0xb0], ebx
push eax
xorps xmm0, xmm0
mov dword [esp + 0xb8], ebx
push ebx
lea ecx, [esp + 0xb4]
movdqu xmmword [esp + 0x204], xmm0
call fcn.10019cc2
mov byte [esp + 0x28c], 0xc
lea ecx, [esp + 0xdc]
mov dword [esp + 0x10], ebx
push 4
call fcn.10018602
push esi
lea ecx, [esp + 0xb4]
mov byte [esp + 0x290], 0xd
call fcn.10018602
push 0xfffffffffffffffc
pop eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], 0x90ae7359
mov dword [esp + 0x14], esi
mov dword [esp + 0x38], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x20], ebx
jmp 0x1001ba35
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x28], 0x82966b91
mov dword [esp + 0x3c], ebx
jmp 0x1001c297
mov dword [esp + 0x30], esi
mov dword [esp + 0x30], 3
cmp dword [esp + 0x30], ebx
jl 0x1001c293
mov dword [esp + 0x18], 0xfffffff9
lea ecx, [esp + 0x134]
mov dword [esp + 0x14], 0xffff
push 4
call fcn.10018602
mov dword [esp + 0x38], 0xfffffffc
mov dword [esp + 0x10], ebx
jmp 0x1001bf4e
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x6c], 0xd8ef068c
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1001bf3e
mov dword [esp + 0x10], ebx
jmp 0x1001bf71
inc dword [esp + 0x3c]
cmp dword [esp + 0x3c], esi
jle 0x1001befc
mov eax, dword [esp + 0xec]
xor ecx, ecx
inc dword [eax]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x28], 0xffff
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x40]
mov eax, dword [esp + 0x1a0]
cmp dword [eax + 4], 8
mov eax, dword [esp + 0x2c]
setl cl
imul eax, ecx
mov ecx, 0xff40b36f
cmp ecx, eax
mov eax, dword [esp + 0x1b8]
sbb ecx, ecx
neg ecx
mov dword [eax], ecx
lea ecx, [esp + 0x98]
mov byte [esp + 0x28c], 8
call fcn.10018684
dec dword [esp + 0x40]
jns 0x1001b22b
jmp 0x1001c325
lea ecx, [esp + 0x1a0]
mov byte [esp + 0x28c], 3
call fcn.10018684
inc dword [esp + 0x24]
cmp dword [esp + 0x24], esi
jle 0x1001b0e9
lea ecx, [esp + 0xec]
call fcn.10018684
lea ecx, [esp + 0x1b8]
call fcn.10018684
or dword [esp + 0x28c], 0xffffffff
lea ecx, [esp + 0x17c]
call fcn.10018684
mov eax, dword [esp + 0xe8]
mov ecx, 0x3e8
cdq
idiv ecx
mov ecx, dword [esp + 0x60]
mov edi, edx
mov esi, eax
call fcn.1001a497
mov ecx, dword [esp + 0x284]
add eax, esi
add eax, edi
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret