Function at 0x10022806
Capabilities:
Enumerate gui resources
Log keystrokes
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10067b20
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1f8
push ebx
push esi
push edi
xor edi, edi
mov dword [esp + 0x54], ecx
inc edi
mov dword [esp + 0x44], edx
push edi
lea ecx, [esp + 0x70]
call fcn.1000db36
push 3
xor ebx, ebx
lea ecx, [esp + 0x17c]
mov dword [esp + 0x210], ebx
pop eax
mov dword [esp + 0x34], 9
mov dword [esp + 0x1c], 0x49e864ad
mov dword [esp + 0x28], 0x7762969f
push eax
call fcn.1000db36
mov dword [esp + 0x24], 0xfffffff6
mov dword [esp + 0x30], 0xfffffffc
mov dword [esp + 0x18], ebx
jmp 0x10022896
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x6c]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x10022886
push 3
mov dword [esp + 0x1c], ebx
pop edx
jmp 0x100228b8
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x178]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edx
jl 0x100228a5
mov dword [esp + 0x18], ebx
jmp 0x100228d7
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x158], 0x98a8
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jl 0x100228c4
mov eax, dword [esp + 0x6c]
cmp dword [eax], ebx
jne 0x100229bd
mov dword [esp + 0x34], 0xe44f
mov eax, dword [esp + 0x34]
mov edi, dword [esp + 0x6c]
mov esi, dword [edi]
imul eax, esi, 0xbec7
cmp eax, esi
jg 0x1002290e
test esi, esi
jne 0x1002290e
mov ecx, ebx
jmp 0x10022911
xor ecx, ecx
inc ecx
xor eax, eax
cmp ecx, esi
setl al
xor ecx, ecx
cmp eax, esi
setne cl
xor edx, edx
cmp ecx, 0x5fdfda84
setge dl
xor eax, eax
cmp edx, esi
setge al
cmp eax, esi
jle 0x10022943
cmp dword [esp + 0x34], ebx
mov edi, dword [esp + 0x6c]
jne 0x10022943
mov eax, ebx
jmp 0x10022946
xor eax, eax
inc eax
mov ecx, dword [esp + 0x1c]
xor edx, edx
imul eax, eax, 0x7ed4
mov esi, dword [edi]
cmp eax, dword [edi]
mov eax, dword [esp + 0x28]
setge dl
imul ecx, edx
xor edx, edx
cmp ecx, eax
setne dl
xor eax, eax
cmp edx, 0xae2
setne al
xor ecx, ecx
cmp eax, esi
setg cl
xor eax, eax
cmp ecx, esi
setl al
xor ecx, ecx
cmp eax, esi
setle cl
xor eax, eax
sub ecx, 0xfff8
cmp ecx, 0x499e98c5
setge al
xor edx, edx
cmp eax, 0xfffffffd
mov eax, dword [esp + 0x178]
sete dl
xor ecx, ecx
cmp edx, dword [eax]
mov edx, ebx
setl cl
xor edi, edi
mov dword [esp + 0x1c], ecx
inc edi
cmp dword [esp + 0x1c], ebx
je 0x100229bf
mov edx, edi
mov eax, dword [esp + 0x15c]
xor ecx, ecx
cmp edx, eax
sete cl
cmp ecx, 0x1dab
je 0x100229dc
mov eax, dword [esp + 0x15c]
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x24], 0x18
jmp 0x10022a68
mov dword [esp + 0x20], 0x9a040d4f
mov dword [esp + 0x14], ebx
jmp 0x10022a0c
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x40], 9
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x100229fc
dec dword [esp + 0x40]
xor edx, edx
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x40]
mov eax, dword [esp + 0x40]
mov eax, dword [esp + 0x40]
mov eax, dword [esp + 0x40]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x28]
cmp eax, ecx
setg dl
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], ebx
jmp 0x10022a5e
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x6c]
mov dword [eax + ecx*4], 0xc2a7322e
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edi
jl 0x10022a4b
dec dword [esp + 0x24]
cmp dword [esp + 0x24], 0xffffffef
jne 0x100229ee
lea ecx, [esp + 0x178]
call fcn.1000dbb8
or dword [esp + 0x20c], 0xffffffff
lea ecx, [esp + 0x6c]
call fcn.1000dbb8
mov eax, dword [0x10b085cc]
mov dword [esp + 0x2c], 7
push 8
pop esi
test al, 1
jne 0x10022b37
or eax, edi
mov dword [0x10b085cc], eax
push ebx
mov dword [esp + 0x210], edi
push ebx
mov dword [0x10b085f0], ebx
mov dword [0x10b085f4], ebx
call fcn.100172aa
mov dword [0x10b085f0], eax
mov dword [0x10b085f8], ebx
mov dword [0x10b08600], ebx
mov byte [esp + 0x20c], 3
mov ecx, 0x10b085f8
mov dword [esp + 0xf4], eax
lea eax, [esp + 0xf4]
push eax
push 0x10
push ebx
lea eax, [esp + 0x190]
mov dword [0x10b0860c], 0x3f800000
push eax
mov dword [0x10b085fc], ebx
call fcn.10017082
push 7
pop eax
push 0x10068566
mov dword [0x10b08604], eax
mov dword [0x10b08608], esi
call fcn.1004d04c
or dword [esp + 0x210], 0xffffffff
pop ecx
imul eax, dword [esp + 0x54], 0x2710
add eax, dword [esp + 0x44]
mov dword [esp + 0x68], eax
mov dword [esp + 0x38], 0xb3c692be
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10022b99
push 0x19ed
push 0x17a3
push ebx
push ebx
push 0x111b
push 0x1c48
push 0x602
push 0xf57
push 0x855
push 0x24a
push 0x6ba
push 0x163a
push 0x187a
call dword [sym.imp.GDI32.dll_StretchDIBits]
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10022bac
push ebx
push ebx
call dword [sym.imp.USER32.dll_EnumWindows]
lea eax, [esp + 0x68]
push eax
call fcn.100244b1
mov esi, dword [eax]
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], 0xfffffffb
mov dword [esp + 0x38], 0x275ff444
mov dword [esp + 0x38], 0x18bc698d
mov dword [esp + 0x1c], 0xfffffff8
mov dword [esp + 0x3c], esi
mov dword [esp + 0x14], ebx
jmp 0x10022bf5
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x188], edi
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x10022be6
mov dword [esp + 0x24], 0xe
cmp dword [esp + 0x24], 0xfffffff4
jne 0x10022d71
push 2
lea ecx, [esp + 0xa4]
call fcn.1000db36
push 3
pop eax
mov dword [esp + 0x20c], 4
lea ecx, [esp + 0x16c]
mov dword [esp + 0x20], 2
push eax
call fcn.1000db36
mov dword [esp + 0x14], 0xffff
mov dword [esp + 0x30], 0x20f2d627
mov dword [esp + 0x18], ebx
jmp 0x10022c68
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0xa0]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jl 0x10022c55
push 3
mov dword [esp + 0x1c], ebx
pop edx
jmp 0x10022c8e
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x16c]
mov dword [eax + ecx*4], 0xe75cb554
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edx
jl 0x10022c78
mov dword [esp + 0x20], edi
cmp dword [esp + 0x20], ebx
jl 0x10022d3e
mov edi, dword [esp + 0xa0]
mov esi, dword [esp + 0x16c]
mov dword [esp + 0x34], 1
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0xa0]
push 0
mov eax, dword [ecx + eax*4]
imul eax, dword [ecx + edx*4]
xor ecx, ecx
cmp eax, dword [edi + 4]
setle cl
mov dword [esi + 8], ecx
mov dword [esp + 0x2c], 0xd72276b
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0xa4]
mov eax, dword [eax + ecx*4]
add eax, 0x2d3f
mov dword [esp + 0x38], eax
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x2c]
cmp eax, ecx
mov eax, dword [esp + 0xa4]
pop ecx
setg cl
mov eax, dword [eax + edx*4]
xor edx, edx
dec eax
cmp ecx, eax
mov eax, dword [esp + 0x14]
setle dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [esp + 0x30], ecx
dec dword [esp + 0x20]
jns 0x10022cb0
xor edi, edi
inc edi
lea ecx, [esp + 0x16c]
call fcn.1000dbb8
or dword [esp + 0x20c], 0xffffffff
lea ecx, [esp + 0xa0]
call fcn.1000dbb8
dec dword [esp + 0x24]
cmp dword [esp + 0x24], 0xfffffff4
je 0x10022c0e
mov esi, dword [esp + 0x3c]
dec dword [esp + 0x1c]
test esi, esi
je 0x10022ed1
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x3c], 0xffffffff
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10022da4
push ebx
push 0x554
call dword [sym.imp.GDI32.dll_RectVisible]
mov dword [esp + 0x14], 0xffffffef
jmp 0x10022db8
cmp dword [esp + 0x3c], ebx
jne 0x10022dbf
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0x17
jl 0x10022dae
mov dword [esp + 0x20], 0x3245f1db
lea ecx, [esp + 0x160]
push 2
mov dword [esp + 0xfc], esi
call fcn.1000db36
mov dword [esp + 0x1c], 9
mov dword [esp + 0x34], edi
mov dword [esp + 0x34], 0xff1eb7e5
mov dword [esp + 0x34], 0xfffffff8
mov dword [esp + 0x3c], 0xc935cb51
mov dword [esp + 0x14], ebx
jmp 0x10022e1c
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x160]
mov dword [eax + ecx*4], 0xf680
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x10022e06
mov esi, dword [esp + 0x160]
cmp dword [esi + 4], ebx
jne 0x10022e52
mov ecx, dword [esp + 0x1c]
xor edx, edx
mov eax, dword [esp + 0x20]
inc ecx
cmp ecx, eax
setl dl
sub edx, 0x8a01
neg edx
sbb edx, edx
inc edx
cmp edx, 0xb7a7bc6c
je 0x10022e54
mov ebx, edi
mov dword [esp + 0x34], ebx
xor edx, edx
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
cmp ecx, eax
mov eax, dword [esp + 0x1c]
setle dl
xor ecx, ecx
cmp edx, eax
setl cl
xor edx, edx
dec ecx
mov dword [esp + 0x34], ecx
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x20]
cmp eax, ecx
mov eax, dword [esp + 0x20]
setg dl
xor ecx, ecx
imul edx, dword [esi + 4]
cmp eax, edx
setg cl
xor eax, eax
test ecx, ecx
lea ecx, [esp + 0x160]
setg al
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x3c], eax
call fcn.1000dbb8
jmp 0x10024113
or esi, 0xffffffff
mov dword [esp + 0x38], esi
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10022ef9
push ebx
push 0x11ff
push 0x172
push 0x1845
call dword [sym.imp.GDI32.dll_MoveToEx]
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10022f0b
push ebx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov eax, dword [0x10b085cc]
test al, 2
jne 0x10022faf
or eax, 2
mov dword [0x10b085cc], eax
push ebx
mov dword [esp + 0x210], 5
push ebx
mov dword [0x10b085d0], ebx
mov dword [0x10b085d4], ebx
call fcn.100172aa
mov dword [0x10b085d0], eax
mov dword [0x10b085d8], ebx
mov dword [0x10b085e0], ebx
push 7
pop ecx
mov byte [esp + 0x20c], cl
mov ecx, 0x10b085d8
mov dword [esp + 0xe4], eax
lea eax, [esp + 0xe4]
push eax
push 0x10
push ebx
lea eax, [esp + 0xd0]
mov dword [0x10b085ec], 0x3f800000
push eax
mov dword [0x10b085dc], ebx
call fcn.10017082
push 7
pop eax
push 8
mov dword [0x10b085e4], eax
pop eax
push 0x10068561
mov dword [0x10b085e8], eax
call fcn.1004d04c
pop ecx
mov dword [esp + 0x20c], esi
mov dword [esp + 0x20], 0xfffffffa
lea ecx, [esp + 0x11c]
push 7
pop eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], edi
mov dword [esp + 0x34], ebx
mov dword [esp + 0x18], esi
mov dword [esp + 0x24], 0xc44d4e2b
mov dword [esp + 0x14], esi
mov dword [esp + 0x38], 0xfffffffd
push edi
call fcn.1000db36
mov dword [esp + 0x3c], edi
mov dword [esp + 0x14], 0x158e
mov dword [esp + 0x30], 0xa65c8bb6
mov dword [esp + 0x14], ebx
jmp 0x1002301b
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x11c]
mov dword [eax + ecx*4], 0x3e8ea471
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x10023005
mov eax, dword [esp + 0x20]
xor ecx, ecx
cmp eax, 0xa0d0
push 8
setle cl
xor edx, edx
cmp ecx, 0x69161d59
setg dl
sub edx, dword [esp + 0x24]
sub edx, dword [esp + 0x24]
sub edx, dword [esp + 0x20]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
sub edx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
cmp edx, eax
setge cl
imul ecx, dword [esp + 0x20]
mov dword [esp + 0x2c], ecx
xor ecx, ecx
mov eax, dword [esp + 0x2c]
cmp eax, edi
setg cl
mov dword [esp + 0x38], ecx
mov eax, dword [esp + 0x38]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
pop ecx
cmp ecx, eax
sbb eax, eax
inc eax
mov dword [esp + 0x3c], eax
cmp dword [esp + 0x14], ebx
je 0x100230b4
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x11c]
xor ecx, ecx
cmp dword [eax], ebx
sete cl
mov dword [esp + 0x14], ecx
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x38], eax
jg 0x100230d4
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
xor ecx, ecx
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x28]
test eax, eax
setg cl
cmp ecx, 0xfffffff7
sbb ecx, ecx
xor edx, edx
neg ecx
sub ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
cmp ecx, eax
mov eax, dword [esp + 0x11c]
lea ecx, [esp + 0x11c]
setge dl
sub edx, dword [eax]
neg edx
sbb edx, edx
inc edx
mov dword [esp + 0x24], edx
call fcn.1000dbb8
lea eax, [esp + 0x54]
xorps xmm0, xmm0
push eax
movdqu xmmword [esp + 0xb0], xmm0
call fcn.10024513
push dword [esp + 0xc4]
movdqa xmm0, xmmword [0x1000a540]
lea ecx, [esp + 0x8c]
movdqu xmmword [esp + 0x19c], xmm0
mov edi, dword [eax]
lea eax, [esp + 0x1ac]
push eax
lea eax, [esp + 0x1a0]
mov dword [esp + 0x3c], edi
push eax
push ebx
mov dword [esp + 0x98], ebx
mov dword [esp + 0x9c], ebx
mov dword [esp + 0xa0], ebx
call fcn.1000fa10
mov esi, dword [esp + 0x88]
xor ecx, ecx
mov dword [esp + 0x24], 0x925ef2c3
mov dword [esp + 0x28], ebx
mov dword [esp + 0x1c], 0x37c2b42d
mov eax, dword [esi + 8]
push 0xfffffffffffffffb
pop edx
mov dword [esp + 0x30], edx
mov dword [esp + 0x38], 0xb64d
mov dword [esp + 0x3c], 1
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
test eax, eax
setg cl
xor eax, eax
cmp dword [esi + 8], ecx
mov ecx, edx
setg al
sub ecx, dword [esi + 8]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
add eax, dword [esi + 8]
cmp ecx, eax
jle 0x100232f4
mov dword [esp + 0x20], 0x403ca955
push 3
mov dword [esp + 0x2c], 0x68e0133d
mov dword [esp + 0x18], ebx
pop ecx
jmp 0x10023215
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x1c8], 4
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ecx
jl 0x10023202
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
mov edx, dword [esi + 8]
mov ecx, edx
mov eax, dword [esp + 0x24]
sub ecx, eax
imul ecx, edx
test ecx, ecx
jne 0x1002325f
cmp dword [esp + 0x20], ebx
jne 0x1002325f
mov eax, ebx
jmp 0x10023262
xor eax, eax
inc eax
mov dword [esp + 0x28], eax
cmp dword [esi + 8], ebx
jne 0x100232ae
mov eax, dword [esp + 0x1c]
cmp dword [esi + 8], ebx
je 0x10023283
cmp dword [esp + 0x30], 0x1289665f
jle 0x10023283
xor eax, eax
inc eax
jmp 0x10023285
mov eax, ebx
add eax, 0xffff0005
xor ecx, ecx
cmp eax, 0xc8da536b
setge cl
mov dword [esp + 0x28], ecx
mov eax, dword [esp + 0x28]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x38]
cmp dword [esp + 0x28], eax
jge 0x100232ae
mov edx, ebx
jmp 0x100232b1
xor edx, edx
inc edx
mov eax, dword [esp + 0x30]
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x88]
sete cl
xor edx, edx
imul ecx, dword [eax + 0xc]
mov eax, dword [esp + 0x20]
imul eax, ecx
cmp eax, dword [esi + 8]
mov eax, dword [esp + 0x1d0]
setg dl
xor ecx, ecx
cmp edx, eax
sete cl
neg ecx
mov dword [esp + 0x24], ecx
mov eax, dword [esp + 0x24]
mov dword [esp + 0x1c], eax
jmp 0x1002330d
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1002330d
push 0x140c
push ebx
push ebx
push ebx
call dword [sym.imp.GDI32.dll_CombineRgn]
lea ecx, [esp + 0x88]
call fcn.1000dbb8
cmp byte [ebp + 0xc], 0
jne 0x10023327
test edi, edi
jne 0x10023685
mov dword [esp + 0x18], 0xe8cff0ea
mov dword [esp + 0x30], 0x24b54114
mov dword [esp + 0x38], 0x172d
cmp dword [esp + 0x38], 0x10e1
jge 0x100234d6
push 7
pop eax
push eax
lea ecx, [esp + 0x98]
call fcn.10024396
push 8
pop eax
mov dword [esp + 0x20c], eax
xor ecx, ecx
mov eax, dword [esp + 0x94]
inc ecx
push 2
mov dword [eax + 0x18], ebx
mov dword [eax + 0xc], ebx
mov dword [eax], ebx
mov dword [eax + 0x14], ecx
mov dword [eax + 4], ecx
pop ecx
mov dword [eax + 0x10], ecx
mov dword [eax + 8], ecx
lea eax, [esp + 0x60]
push eax
lea eax, [esp + 0x60]
push eax
lea eax, [esp + 0x6c]
push eax
push 0x1000a1ec
call fcn.1004d4be
mov edi, dword [esp + 0x74]
add esp, 0x10
mov eax, edi
mov esi, dword [esp + 0x5c]
cdq
mov dword [esp + 0x30], ebx
push 3
pop ecx
idiv ecx
mov dword [esp + 0x28], ebx
mov ecx, eax
mov eax, esi
cdq
sub eax, edx
sar eax, 1
cmp ecx, eax
cmovl eax, ecx
mov ecx, dword [esp + 0x60]
mov dword [esp + 0x1c], eax
mov eax, ecx
cdq
sub eax, edx
mov edx, dword [esp + 0x1c]
sar eax, 1
cmp edx, eax
cmovge edx, eax
imul eax, edx, 0xfffffffd
mov dword [esp + 0x1c], edx
add edi, eax
lea eax, [edx + edx]
sub esi, eax
mov dword [esp + 0x64], edi
sub ecx, eax
mov dword [esp + 0x5c], esi
mov dword [esp + 0x60], ecx
push 3
pop eax
push eax
lea ecx, [esp + 0x12c]
call fcn.10024396
mov esi, dword [esp + 0x128]
mov ecx, ebx
mov eax, dword [esp + 0x64]
mov edi, dword [esp + 0x28]
mov dword [esp + 0x38], ebx
mov dword [esi], eax
mov eax, dword [esp + 0x5c]
mov dword [esi + 4], eax
mov eax, dword [esp + 0x60]
mov dword [esi + 8], eax
lea eax, [ebx + edi]
cdq
idiv dword [esp + 0x2c]
mov eax, dword [esp + 0x94]
mov edx, dword [eax + edx*4]
mov eax, dword [esi + edx*4]
test eax, eax
jle 0x10023457
dec eax
inc ecx
inc ebx
mov dword [esi + edx*4], eax
cmp ebx, 0xe
jl 0x10023433
cmp dword [esp + 0x30], ecx
push esi
cmovg ecx, dword [esp + 0x34]
mov edi, ecx
mov dword [esp + 0x34], edi
call fcn.1004d1e7
mov eax, dword [esp + 0x2c]
xor ebx, ebx
pop ecx
push 7
inc eax
mov dword [esp + 0x12c], ebx
pop ecx
mov dword [esp + 0x12c], ebx
mov dword [esp + 0x130], ebx
mov dword [esp + 0x28], eax
cmp eax, ecx
jl 0x100233fe
imul eax, dword [esp + 0x1c], 7
add edi, eax
push edi
push 0x1000a0cc
call fcn.1004d076
or dword [esp + 0x214], 0xffffffff
push dword [esp + 0x9c]
call fcn.1004d1e7
add esp, 0xc
mov dword [esp + 0x94], ebx
mov dword [esp + 0x98], ebx
mov dword [esp + 0x9c], ebx
mov dword [esp + 0x2c], 0xf39cee24
mov dword [esp + 0x18], 0xffffffe7
cmp dword [esp + 0x18], 0xffffffe6
je 0x10023578
xor edx, edx
mov esi, 0x888999d9
inc edx
mov dword [esp + 0x78], esi
mov dword [esp + 0x7c], esi
mov dword [esp + 0x80], esi
mov dword [esp + 0x84], esi
cmp dword [esp + 0x78], ebx
jne 0x10023553
mov eax, dword [esp + 0x18]
mov ecx, 0xfffa
cmp ecx, eax
sbb eax, eax
neg eax
cmp dword [esp + 0x18], eax
jle 0x10023544
mov eax, dword [esp + 0x84]
mov eax, dword [esp + 0x80]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x30], 0xfff9
mov eax, dword [esp + 0x84]
mov ecx, edx
sub ecx, eax
mov eax, ebx
je 0x10023555
mov eax, edx
mov dword [esp + 0x78], eax
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x2c], edx
mov eax, dword [esp + 0x78]
mov dword [esp + 0x30], eax
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 0xffffffe6
jne 0x100234f9
mov dword [esp + 0x18], 0x11
jmp 0x1002359e
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1002359a
push ebx
push 0x568
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0x1b
jge 0x10023582
mov dl, byte [ebp + 0xc]
lea eax, [esp + 0x1e0]
mov ecx, dword [esp + 0x54]
push eax
call fcn.1001856a
cmp byte [ebp + 0xc], 0
lea edi, [esp + 0xb0]
mov esi, eax
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
je 0x10023681
xor esi, esi
inc esi
cmp dword [esp + 0xb4], 0
je 0x1002367b
mov dword [esp + 0x20], 0xfffffff8
mov dword [esp + 0x2c], 0x51fe77dd
mov dword [esp + 0x2c], 0xef6b8f3d
mov dword [esp + 0x2c], esi
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x2c], 0x588c
mov dword [esp + 0x2c], 0xd1f0dfbc
mov dword [esp + 0x2c], 0x9a54e587
mov dword [esp + 0x30], 0xfffb
mov dword [esp + 0x14], ebx
jmp 0x10023637
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x1f0], esi
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x10023628
mov dword [esp + 0x20], 0x18
jmp 0x10023654
mov eax, dword [esp + 0x20]
mov dword [esp + 0x2c], eax
dec dword [esp + 0x20]
cmp dword [esp + 0x20], 0xffffffea
jg 0x10023648
inc dword [esp + 0x30]
mov eax, dword [esp + 0xb8]
mov dword [esp + 0xfc], eax
mov eax, dword [esp + 0xb4]
mov dword [esp + 0x100], eax
mov edi, dword [esp + 0x34]
jmp 0x10023688
mov edi, dword [esp + 0x34]
xor esi, esi
inc esi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x14], ebx
jmp 0x100236ad
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0xbc], 0x624039b
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x1002369a
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x100236c9
push 0x25c9
call dword [sym.imp.KERNEL32.dll_ExitThread]
mov dword [esp + 0x28], ebx
cmp dword [esp + 0x28], ebx
jl 0x100236f5
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x100236ef
push ebx
push 0x1ade
push 0xa3d
call dword [sym.imp.USER32.dll_AttachThreadInput]
dec dword [esp + 0x28]
jns 0x100236d3
test edi, edi
jne 0x10023e0c
cmp dword [esp + 0xac], edi
jle 0x10023e0c
mov dword [esp + 0x2c], 0xffffffff
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10023733
push ebx
push 0x11ff
push 0x172
push 0x1845
call dword [sym.imp.GDI32.dll_MoveToEx]
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10023745
push ebx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
push 2
lea ecx, [esp + 0x108]
call fcn.1000db36
mov dword [esp + 0x20c], 9
mov dword [esp + 0x28], 0xfffffffd
mov dword [esp + 0x18], ebx
jmp 0x10023782
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x104]
mov dword [eax + ecx*4], 0xdf99ff60
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jl 0x1002376c
push 3
mov dword [esp + 0x1c], ebx
pop ecx
jmp 0x100237a1
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x18c], ebx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ecx
jl 0x10023792
mov edi, dword [esp + 0x104]
mov dword [edi + 4], 0x15
mov dword [esp + 0x24], ebx
mov dword [esp + 0x30], 0xb400765e
mov dword [esp + 0x14], ebx
mov dword [esp + 0x38], ecx
mov dword [esp + 0x20], ebx
jmp 0x100237df
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x48], 0x36444696
inc dword [esp + 0x20]
cmp dword [esp + 0x20], esi
jl 0x100237cf
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x24], ebx
jg 0x100239ad
push dword [esp + 0xbc]
movdqa xmm0, xmmword [0x1000a530]
lea eax, [esp + 0x1bc]
push eax
lea eax, [esp + 0x1b0]
mov dword [esp + 0xe0], ebx
push eax
push ebx
lea ecx, [esp + 0xe8]
mov dword [esp + 0xec], ebx
movdqu xmmword [esp + 0x1b8], xmm0
mov dword [esp + 0xf0], ebx
call fcn.1000fa10
mov byte [esp + 0x20c], 0xa
mov esi, dword [esp + 0xd8]
mov dword [esi + 8], ebx
mov dword [esp + 0x18], 0x6887e08a
mov dword [esp + 0x2c], 0xfffffff7
mov dword [esp + 0x18], ebx
jmp 0x10023975
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x20], ebx
cmp dword [esp + 0x20], ebx
jl 0x10023966
push 1
lea ecx, [esp + 0x114]
call fcn.1000db36
xor edx, edx
mov dword [esp + 0x30], 0x48968f25
mov dword [esp + 0x1c], ebx
inc edx
jmp 0x100238b3
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x110]
mov dword [eax + ecx*4], 9
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edx
jl 0x1002389d
mov eax, dword [esp + 0x110]
mov dword [eax], ebx
mov dword [esp + 0x1c], ebx
jmp 0x100238db
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0xd4], 0xffff
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edx
jl 0x100238c8
mov eax, dword [esp + 0x110]
mov dword [esp + 0xd4], 0xd82c32b9
dec dword [eax]
jns 0x100238c2
mov eax, dword [esp + 0x24]
cmp dword [esp + eax*4 + 0x48], ebx
jne 0x10023932
mov eax, dword [esp + 0x20]
cmp dword [esp + eax*4 + 0x48], ebx
jne 0x10023926
mov eax, dword [esi + 8]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + eax*4 + 0x48]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + eax*4 + 0x48]
mov dword [esp + 0x30], ebx
xor edx, edx
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x24]
cmp ecx, eax
lea ecx, [esp + 0x110]
setge dl
xor eax, eax
cmp eax, edx
sbb eax, eax
inc eax
mov dword [esp + 0x2c], eax
call fcn.1000dbb8
dec dword [esp + 0x20]
jns 0x1002387e
mov dword [esp + 0x194], 0xb8a442f2
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ebx
jle 0x10023868
dec dword [esi + 8]
jns 0x1002384f
lea ecx, [esp + 0xd8]
mov byte [esp + 0x20c], 9
call fcn.1000dbb8
inc dword [esp + 0x24]
cmp dword [esp + 0x24], ebx
jle 0x100237f3
xor esi, esi
inc esi
mov ecx, dword [esp + 0x38]
xor edx, edx
mov eax, dword [esp + 0x28]
cmp ecx, eax
mov eax, dword [esp + 0x104]
setle dl
push 3
sub edx, dword [eax]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
mov dword [esp + 0x28], edx
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x4c]
cmp eax, dword [edi + 4]
mov dword [esp + 0x198], eax
mov eax, 0xfff8
setne cl
cmp eax, ecx
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, dword [edi + 4]
setle cl
xor eax, eax
cmp ecx, dword [edi + 4]
pop ecx
setle al
dec dword [edi + 4]
cmp dword [edi + 4], 0xffffffe4
mov dword [esp + 0x14], eax
jg 0x100237b5
or dword [esp + 0x20c], 0xffffffff
lea ecx, [esp + 0x104]
call fcn.1000dbb8
push 2
lea ecx, [esp + 0x138]
call fcn.1000db36
mov dword [esp + 0x14], 0xfffffffa
mov dword [esp + 0x30], 0x17c
mov dword [esp + 0x1c], ebx
jmp 0x10023a71
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x134]
mov dword [eax + ecx*4], 0x57fd5464
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jl 0x10023a5b
mov dword [esp + 0x14], esi
cmp dword [esp + 0x14], ebx
jl 0x10023b01
mov dword [esp + 0x24], 0xfffffffd
mov dword [esp + 0x2c], 0xb8ceffb9
mov dword [esp + 0x24], ebx
jmp 0x10023af5
mov dword [esp + 0x2c], 0xadf29855
mov eax, dword [esp + 0x24]
cmp dword [esp + 0x14], ebx
je 0x10023ab2
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x30]
xor edx, edx
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x134]
push 7
cmp dword [eax + ecx*4], 0x8659
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x138]
setl dl
mov dword [eax + ecx*4], edx
xor ecx, ecx
mov eax, dword [esp + 0x28]
cmp edx, eax
pop eax
setne cl
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x2c], eax
inc dword [esp + 0x24]
cmp dword [esp + 0x24], esi
jle 0x10023a98
dec dword [esp + 0x14]
jns 0x10023a82
lea ecx, [esp + 0x134]
call fcn.1000dbb8
push 4
lea ecx, [esp + 0x144]
call fcn.1000db36
mov dword [esp + 0x14], 0x6182eac4
mov dword [esp + 0x1c], ebx
jmp 0x10023b3b
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x140]
mov dword [eax + ecx*4], esi
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 4
jl 0x10023b29
mov eax, dword [esp + 0x140]
push 3
pop edx
mov dword [eax + 8], 0xfffffffd
mov dword [esp + 0x14], ebx
jmp 0x10023c25
mov dword [esp + 0x1c], ebx
jmp 0x10023b71
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x14c], esi
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edx
jl 0x10023b62
mov dword [esp + 0x14c], edx
cmp dword [esp + 0x14c], ebx
jl 0x10023c21
mov dword [esp + 0x28], 0xc7516a20
mov dword [esp + 0x28], edx
cmp dword [esp + 0x28], ebx
jl 0x10023be9
mov dword [esp + 0x20], ebx
mov dword [esp + 0x20], ebx
cmp dword [esp + 0x20], edx
jg 0x10023be3
push 7
pop eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x1c], ebx
cmp dword [esp + 0x1c], edx
jg 0x10023bd9
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x140]
cmp dword [eax + ecx*4], ebx
jne 0x10023bd6
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edx
jle 0x10023bbc
push 7
pop eax
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edx
jle 0x10023bae
dec dword [esp + 0x28]
jns 0x10023b9d
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10023c14
push ebx
push 0x13af
push 0x167c
push ebx
push 0xf7
push 0x1fbe
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 3
pop edx
dec dword [esp + 0x14c]
jns 0x10023b8b
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jle 0x10023b5c
lea ecx, [esp + 0x140]
call fcn.1000dbb8
mov dword [esp + 0x2c], 0x2372
cmp dword [esp + 0x2c], 0x94a
jge 0x10023cde
lea eax, [esp + 0xd0]
push eax
lea eax, [esp + 0xcc]
push eax
lea eax, [esp + 0xd4]
push eax
push 0x1000a1ec
call fcn.1004d4be
lea eax, [esp + 0x68]
mov edi, 0x1000a0c8
push eax
push edi
call fcn.1004d4be
add esp, 0x18
mov esi, ebx
jmp 0x10023cc1
dec eax
mov dword [esp + 0x58], eax
lea eax, [esp + 0xc0]
push eax
push edi
call fcn.1004d4be
mov eax, dword [esp + 0xc8]
pop ecx
pop ecx
cmp dword [esp + 0xc8], eax
jge 0x10023cbd
cmp eax, dword [esp + 0xd0]
jge 0x10023cbd
xor eax, eax
inc eax
jmp 0x10023cbf
mov eax, ebx
add esi, eax
mov eax, dword [esp + 0x58]
test eax, eax
jne 0x10023c8a
dec eax
push esi
push 0x1000a0cc
mov dword [esp + 0x60], eax
call fcn.1004d076
pop ecx
xor esi, esi
pop ecx
inc esi
push 8
pop eax
mov dword [esp + 0x14], 0x69fdf99f
mov dword [esp + 0x14], eax
jmp 0x10023d31
mov dword [esp + 0x1c], esi
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10023d0a
push 0x22e7
push ebx
call dword [sym.imp.USER32.dll_GetSubMenu]
mov dword [esp + 0x1c], 0xffffffe6
jmp 0x10023d26
mov dword [esp + 0x2c], 0xd94543be
cmp dword [esp + 0x2c], ebx
jne 0x10023d2d
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xfffffff3
jne 0x10023d14
dec dword [esp + 0x14]
cmp dword [esp + 0x14], 0xffffffee
jl 0x10023cef
cmp dword [esp + 0xb0], 0
je 0x10023e08
mov dword [esp + 0x24], ebx
mov dword [esp + 0x24], 0x14
jmp 0x10023d7b
mov dword [esp + 0x2c], 0xe57bf5cd
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10023d73
push 0x207a
push ebx
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
mov eax, dword [esp + 0x2c]
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 0x16
jg 0x10023d54
mov dword [esp + 0x24], 0x11
jmp 0x10023da2
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10023d9e
push ebx
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
dec dword [esp + 0x24]
cmp dword [esp + 0x24], 0xfffffffa
jg 0x10023d8c
mov ecx, dword [esp + 0xb0]
call fcn.100227a4
push 3
mov edi, eax
pop eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x14], ebx
jmp 0x10023df3
mov dword [esp + 0x1c], 0x432a2768
mov dword [esp + 0x2c], 0x7a73d2d6
cmp dword [esp + 0x14], ebx
jne 0x10023dfa
mov dword [esp + 0x1c], ebx
jmp 0x10023de8
mov dword [esp + 0x2c], esi
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xffffffe9
jne 0x10023de0
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0x1b
jle 0x10023dc4
lea eax, [esp + 0x54]
push eax
call fcn.10024513
mov dword [eax], edi
jmp 0x10023e0c
mov edi, dword [esp + 0x34]
mov dword [esp + 0x18], 0x3532fe22
cmp dword [esp + 0x18], ebx
jne 0x10023ea6
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x18], 0xe7528ace
sbb eax, eax
xor ecx, ecx
inc eax
test eax, eax
setle cl
test ecx, ecx
js 0x10023e3c
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
sub eax, 0xa07b
mov eax, ebx
je 0x10023e53
mov eax, esi
mov ecx, dword [esp + 0x18]
xor edx, edx
imul ecx, eax
mov eax, dword [esp + 0x18]
cmp ecx, eax
mov eax, dword [esp + 0x18]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x18]
setl cl
cmp ecx, 0xd162c5d1
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, 0xf0a0cd95
setle dl
cmp eax, edx
sbb eax, eax
neg eax
cmp eax, dword [esp + 0x18]
jne 0x10023ea6
mov dword [esp + 0x2c], 0x4ccf97a2
mov dword [esp + 0x2c], esi
jmp 0x10024025
mov dword [esp + 0x20], 5
mov dword [esp + 0x34], ebx
mov dword [esp + 0x28], 0x77c83be7
mov dword [esp + 0x30], 0x4870e7c
mov dword [esp + 0x1c], ebx
jmp 0x10023ed4
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x4c], ebx
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jl 0x10023ec8
mov dword [esp + 0x18], ebx
jmp 0x1002401a
mov dword [esp + 0x24], esi
mov dword [esp + 0x24], 0xfffffffd
jmp 0x10023f8b
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10023f30
push 0x19f3
push 0xc5c
push 0x1692
push 0x275
push 0x1a52
push 0x892
push 0x1603
push 0x4c
push 0x1e42
call dword [sym.imp.GDI32.dll_Arc]
mov eax, dword [esp + 0x24]
mov ecx, 0x804524be
cmp ecx, eax
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, 0x3fb18ba7
mov eax, dword [esp + 0x24]
setle cl
xor edx, edx
cmp ecx, eax
setle dl
sub edx, dword [esp + 0x24]
sub edx, dword [esp + 0x18]
mov eax, dword [esp + 0x50]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
sub edx, eax
mov eax, dword [esp + 0x24]
cmp eax, edx
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x50]
setl cl
sub edx, ecx
xor ecx, ecx
cmp eax, edx
setge cl
mov dword [esp + 0x20], ecx
dec dword [esp + 0x24]
cmp dword [esp + 0x24], 0xffffffec
je 0x10023ef5
mov dword [esp + 0x20], esi
cmp dword [esp + 0x20], ebx
jl 0x10024016
mov dword [esp + 0x2c], esi
mov eax, dword [esp + 0x34]
inc dword [esp + 0x34]
test eax, eax
je 0x10023fb8
mov edx, esi
cmp dword [esp + 0x28], ebx
jne 0x10023fba
mov edx, ebx
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov eax, dword [esp + eax*4 + 0x4c]
cmp eax, edx
mov eax, dword [esp + 0x20]
setle cl
add ecx, dword [esp + eax*4 + 0x4c]
mov dword [esp + 0x28], ecx
xor ecx, ecx
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x50]
mov dword [esp + 0x24], ebx
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x50]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + eax*4 + 0x4c]
test eax, eax
mov eax, dword [esp + 0x20]
setne cl
mov eax, dword [esp + eax*4 + 0x4c]
mov dword [esp + 0x30], ecx
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x2c], eax
dec dword [esp + 0x20]
jns 0x10023fa0
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0x1a
jle 0x10023ee4
lea ecx, [esp + 0xac]
call fcn.1001e351
test edi, edi
je 0x10024113
mov edx, dword [esp + 0x44]
mov ecx, edi
call fcn.100227fc
push dword [esp + 0xcc]
movdqa xmm0, xmmword [0x1000a4e0]
lea ecx, [esp + 0xec]
mov esi, eax
mov dword [esp + 0x18], 0xfffffffb
lea eax, [esp + 0x1cc]
mov dword [esp + 0xfc], esi
push eax
lea eax, [esp + 0x1c0]
mov dword [esp + 0xf0], ebx
push eax
push ebx
movdqu xmmword [esp + 0x1c8], xmm0
mov dword [esp + 0xfc], ebx
mov dword [esp + 0x100], ebx
call fcn.1000fa10
mov dword [esp + 0x44], 0xffff
mov dword [esp + 0x14], 0xe
jmp 0x100240f4
mov dword [esp + 0x2c], 0xffffffff
push 3
mov dword [esp + 0x3c], 0xffffffff
mov dword [esp + 0x20], ebx
pop ecx
jmp 0x100240d9
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x1d4], ebx
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], ecx
jl 0x100240ca
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0xe8]
mov dword [eax], ecx
dec dword [esp + 0x44]
dec dword [esp + 0x14]
cmp dword [esp + 0x14], 0xffffffe6
jle 0x100240b1
lea ecx, [esp + 0xe8]
call fcn.1000dbb8
lea eax, [esp + 0x68]
push eax
call fcn.100244b1
mov dword [eax], esi
mov eax, dword [ebp + 8]
lea esi, [esp + 0xf8]
mov ecx, dword [esp + 0x204]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret