Function at 0x1001b259
Capabilities:
Get graphical window text
Get keyboard layout
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1008c745
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x260
push ebx
xor ebx, ebx
mov dword [esp + 0x60], ecx
mov dword [esp + 8], ebx
mov eax, 0xcfbce008
mov dword [esp + 0x20], 7
mov dword [esp + 0x1d0], eax
mov dword [esp + 0x1d4], eax
mov dword [esp + 0x1d8], eax
mov dword [esp + 0x1dc], eax
mov eax, dword [esp + 8]
mov eax, dword [esp + 8]
mov eax, dword [esp + 8]
mov eax, dword [esp + 8]
neg eax
mov dword [esp + 0xb0], edx
push esi
sbb eax, eax
or ecx, 0xffffffff
neg eax
cmp ecx, eax
push edi
sbb eax, eax
xor esi, esi
inc eax
inc esi
imul eax, dword [esp + 0x10]
test eax, eax
je 0x1001b2e9
mov edx, esi
cmp dword [esp + 0x10], ebx
jne 0x1001b2eb
mov edx, ebx
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp edx, eax
setge cl
sub ecx, 0x45c6b9bd
mov dword [esp + 0x28], ecx
mov eax, dword [esp + 0x28]
mov dword [esp + 0x1d8], eax
cmp dword [esp + 0x10], ebx
je 0x1001b364
mov dword [esp + 0x10], 4
jmp 0x1001b35b
mov dword [esp + 0x28], 6
jmp 0x1001b350
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], bl
je 0x1001b34c
push 0x1119
push 0x245a
push ebx
push 0xc2d
push ebx
call dword [sym.imp.USER32.dll_GetMenuStringW]
dec dword [esp + 0x28]
cmp dword [esp + 0x28], 0xffffffe8
jge 0x1001b32b
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x2a
jg 0x1001b321
jmp 0x1001b37b
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], bl
je 0x1001b37b
push ebx
push ebx
call edi
push eax
push ebx
push ebx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
mov dword [esp + 0x20], 0xfffffff7
mov dword [esp + 0x3c], 0xfffffff8
mov dword [esp + 0x1c], 0x8f59172d
mov dword [esp + 0x10], 0xfffffffd
mov dword [esp + 0x2c], 0x989265
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], ebx
jmp 0x1001b3c0
mov eax, dword [esp + 0x28]
mov dword [esp + eax*4 + 0x1e8], 0x2c6eed1e
inc dword [esp + 0x28]
cmp dword [esp + 0x28], 3
jl 0x1001b3ad
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x1ec]
mov dword [esp + 0x20], eax
cmp dword [esp + 0x20], ebx
je 0x1001b406
mov dword [esp + 0x2c], 0x748a
mov eax, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
jmp 0x1001b482
mov dword [esp + 0x28], esi
mov dword [esp + 0x34], 0x69a4575f
mov dword [esp + 0x14], 0x299b
cmp dword [esp + 0x1c], ebx
je 0x1001b424
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x20]
xor edx, edx
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x24]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x20]
cmp eax, 0xa660
push 0xfffffffffffffff9
setl dl
xor ecx, ecx
add edx, dword [esp + 0x38]
imul edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x38]
add eax, dword [esp + 0x14]
cmp edx, eax
pop eax
setl cl
cmp eax, ecx
sbb edx, edx
xor ecx, ecx
inc edx
sub edx, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
add edx, 0x26d35df9
cmp edx, eax
setne cl
mov dword [esp + 0x1ec], ecx
mov eax, 0xf112
mov dword [esp + 0x10], 0x44bf8e16
mov dword [esp + 0x94], eax
lea ecx, [esp + 0x1a4]
mov dword [esp + 0x98], eax
mov dword [esp + 0x9c], eax
mov dword [esp + 0xa0], eax
mov dword [esp + 0x14], 0x29a3df60
push 4
call fcn.100191fb
mov dword [esp + 0x20], ebx
jmp 0x1001b4da
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x1a4]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 4
jl 0x1001b4c7
mov dword [esp + 0x14], 3
push 8
pop edx
cmp dword [esp + 0x14], ebx
jl 0x1001b67b
xor edi, edi
inc edi
mov dword [esp + 0x10], 0xc3ec3d4e
mov dword [esp + 0x28], edx
mov eax, dword [esp + 0x14]
cmp dword [esp + eax*4 + 0x94], ebx
je 0x1001b59d
mov eax, dword [esp + 0x9c]
neg eax
cmp dword [esp + 0x14], eax
jle 0x1001b52d
mov esi, ebx
cmp dword [esp + 0x10], ebx
je 0x1001b52f
mov esi, edi
cmp dword [esp + 0x10], 0xfffffff6
sbb eax, eax
xor edx, edx
inc eax
mov dword [esp + 0x28], eax
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x14]
cmp ecx, eax
setle dl
add edx, esi
je 0x1001b556
mov edx, edi
cmp dword [esp + 0x14], ebx
jne 0x1001b558
mov edx, ebx
mov eax, dword [esp + 0x94]
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x14]
setl cl
sub ecx, eax
je 0x1001b59a
mov dword [esp + 0x34], edi
mov dword [esp + 0x10], ebx
jmp 0x1001b58e
mov eax, dword [esp + 0x28]
mov dword [esp + 0x34], eax
cmp dword [esp + 0x34], ebx
jne 0x1001b665
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 7
je 0x1001b578
jmp 0x1001b665
push 8
pop edx
mov dword [esp + 0x20], 0x3876
cmp dword [esp + 0x20], ebx
jne 0x1001b672
mov dword [esp + 0x20], ebx
jmp 0x1001b65a
mov dword [esp + 0x28], 3
cmp dword [esp + 0x28], ebx
jl 0x1001b653
mov dword [esp + 0x34], 9
mov dword [esp + 0x34], ebx
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x10], 3
jg 0x1001b646
mov esi, dword [esp + 0x1a4]
mov dword [esp + 0x34], 2
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + eax*4 + 0x94]
add ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x14]
neg ecx
sbb ecx, ecx
neg ecx
cmp dword [esp + eax*4 + 0x94], edx
mov eax, dword [esp + 0x28]
sbb edx, edx
neg ecx
inc edx
sub edx, ecx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
mov dword [esp + 0x34], ecx
mov eax, dword [esp + 0x34]
mov dword [esi + 4], eax
cmp dword [esp + 0x20], ebx
jne 0x1001b646
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
push 8
pop edx
jle 0x1001b5e8
dec dword [esp + 0x28]
push 8
pop edx
jns 0x1001b5ca
inc dword [esp + 0x20]
push 8
pop edx
cmp dword [esp + 0x20], 3
jle 0x1001b5b8
dec dword [esp + 0x14]
push 8
pop edx
jns 0x1001b4f9
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
xor esi, esi
inc esi
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], bl
je 0x1001b695
push ebx
push ebx
push 0x2339
call edi
push eax
call dword [sym.imp.USER32.dll_DefWindowProcA]
lea ecx, [esp + 0x1a4]
call fcn.1001927d
mov dword [esp + 0x14], 0x73bf38c0
lea ecx, [esp + 0x1b0]
mov dword [esp + 0x34], 7
mov dword [esp + 0x24], 0xe2632c5
push 3
call fcn.100191fb
mov dword [esp + 0x274], ebx
lea ecx, [esp + 0x200]
push 0xfffffffffffffff9
pop eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x30], 0x7374489b
mov dword [esp + 0x30], 0xfffffff6
mov dword [esp + 0x30], ebx
mov dword [esp + 0x30], 0x5ec7e011
push 4
call fcn.100191fb
mov dword [esp + 0x1c], esi
mov dword [esp + 0x10], ebx
jmp 0x1001b71b
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x1b0]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x1001b709
mov dword [esp + 0x10], ebx
jmp 0x1001b73a
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x200]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x1001b728
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
cmp eax, esi
mov eax, dword [esp + 0x14]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x14]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x14]
setle cl
xor edx, edx
cmp ecx, eax
setge dl
sub edx, dword [esp + 0x14]
mov eax, dword [esp + 0x1b0]
neg edx
sbb edx, edx
inc edx
mov dword [eax + 8], edx
mov eax, dword [esp + 0x24]
mov dword [esp + 0x2c], edx
xor edx, edx
cmp dword [esp + 0x2c], eax
mov eax, dword [esp + 0x14]
setle dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0x200]
inc dword [esp + 0x1c]
call fcn.1001927d
or dword [esp + 0x274], 0xffffffff
lea ecx, [esp + 0x1b0]
call fcn.1001927d
mov dword [esp + 0x34], esi
mov dword [esp + 0x10], 0xe8cff0ea
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], 6
push 0xfffffffffffffff9
pop eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x14], 0x14f16367
push 0xfffffffffffffffd
pop eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x3c], 0x33d73c12
mov dword [esp + 0x2c], 0xfffffff7
mov dword [esp + 0x30], eax
mov dword [esp + 0x38], 0x49d95921
mov dword [esp + 0x10], 0x13
jmp 0x1001b871
mov dword [esp + 0x24], 8
mov eax, dword [esp + 0x10]
mov dword [esp + 0x24], eax
cmp dword [esp + 0x10], ebx
je 0x1001b852
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x24], ebx
jne 0x1001b860
mov eax, dword [esp + 0x24]
cmp dword [esp + 0x10], 2
sbb eax, eax
neg eax
mov dword [esp + 0x20], eax
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xffffffee
jle 0x1001b830
mov dword [esp + 0x10], 0x537c57f3
xor edx, edx
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
cmp ecx, eax
mov eax, dword [esp + 0x10]
setge dl
xor ecx, ecx
cmp eax, edx
setne cl
sub ecx, dword [esp + 0x20]
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [esp + 0x1c]
js 0x1001b8ad
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x20]
sub eax, 9
mov esi, dword [sym.imp.USER32.dll_GetDC]
neg eax
sbb eax, eax
xor edx, edx
inc eax
sub ecx, eax
mov eax, dword [esp + 0x28]
cmp ecx, eax
setg dl
imul edx, dword [esp + 0x20]
test edx, edx
je 0x1001b938
xor ecx, ecx
mov dword [esp + 0x30], 0x161e
inc ecx
mov dword [esp + 0x30], ecx
mov dword [esp + 0x10], ebx
jmp 0x1001b905
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x258], 0xeda781b5
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x1001b8f2
mov dword [esp + 0x10], ebx
jmp 0x1001b925
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x124], 0xe520c3d8
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1001b912
dec dword [esp + 0x124]
jmp 0x1001ba58
xor ecx, ecx
inc ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x1c], 0xfffffffc
mov dword [esp + 0x24], 0x9421a0e
mov dword [esp + 0x14], ebx
cmp dword [esp + 0x14], 0xb
jge 0x1001b986
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001b974
push ebx
push 0x12b5
call edi
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
mov eax, dword [esp + 0x3c]
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0xb
jl 0x1001b95a
xor ecx, ecx
inc ecx
push 0xfffffffffffffff9
mov dword [esp + 0x18], 0x19
pop eax
cmp dword [esp + 0x14], eax
jl 0x1001ba58
mov dword [esp + 0x24], 0x6751
mov dword [esp + 0x20], 0xf5756627
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001b9c4
push ecx
push ebx
call edi
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_SelectPalette]
mov eax, dword [esp + 0x2c]
xor ecx, ecx
test eax, eax
mov eax, dword [esp + 0x24]
setle cl
inc ecx
neg ecx
sbb ecx, ecx
inc ecx
sub eax, ecx
neg eax
sbb eax, eax
inc eax
cmp eax, 0x58b5
jge 0x1001b9f2
cmp dword [esp + 0x1c], ebx
je 0x1001b9f2
xor edx, edx
inc edx
jmp 0x1001b9f4
mov edx, ebx
mov eax, dword [esp + 0x3c]
xor ecx, ecx
cmp edx, eax
push 0xfffffffffffffff9
sete cl
xor eax, eax
inc eax
cmp eax, ecx
mov eax, dword [esp + 0x28]
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setle cl
xor edx, edx
mov dword [esp + 0x28], ecx
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x28], eax
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x3c]
cmp ecx, eax
mov eax, dword [esp + 0x28]
setg dl
xor ecx, ecx
cmp eax, edx
pop eax
setg cl
mov dword [esp + 0x20], ecx
dec dword [esp + 0x14]
push 1
pop ecx
cmp dword [esp + 0x14], eax
jge 0x1001b99b
mov dword [esp + 0x20], 0xe2db58e4
cmp dword [esp + 0x20], ebx
je 0x1001ba86
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001ba92
push ebx
push 0x20f
push ebx
call edi
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointA]
jmp 0x1001ba92
mov dword [esp + 0x38], ecx
mov eax, dword [esp + 0x38]
mov dword [esp + 0x20], eax
mov dword [esp + 0x20], ebx
jmp 0x1001bab2
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001baae
push 0xf6
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 0x16
je 0x1001ba98
mov dword [esp + 0x10], 0x64a53aa9
xor eax, eax
mov dword [esp + 0x10], 0x76820624
inc eax
mov dword [esp + 0x14], eax
push 2
mov dword [esp + 0x24], ebx
pop ecx
cmp dword [esp + 0x20], ecx
jge 0x1001baf2
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x48], ecx
inc dword [esp + 0x20]
cmp dword [esp + 0x20], ecx
jl 0x1001badd
xor eax, eax
inc eax
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x10], 0xfffffffd
je 0x1001be0c
jmp 0x1001bb06
push 2
pop ecx
mov dword [esp + 0x28], 0x79c4185a
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ebx
jmp 0x1001bb30
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x50], 0xfffffffd
inc dword [esp + 0x20]
cmp dword [esp + 0x20], ecx
jl 0x1001bb20
mov eax, dword [esp + 0x10]
xor edx, edx
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x54]
mov eax, dword [esp + 0x50]
mov eax, dword [esp + 0x28]
imul ecx, dword [esp + 0x10], 0xb300
mov eax, dword [esp + 0x10]
cmp ecx, eax
setg dl
xor ecx, ecx
imul edx, dword [esp + 0x28]
mov eax, dword [esp + 0x54]
cmp edx, eax
setge cl
xor edx, edx
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x54]
mov eax, dword [esp + 0x24]
cmp ecx, eax
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x10]
setle dl
imul ecx, edx
xor edx, edx
cmp ecx, eax
setle dl
dec edx
mov dword [esp + 0x1c], edx
mov eax, dword [esp + 0x1c]
sub eax, dword [esp + 0x28]
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
imul eax, dword [esp + 0x28]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x54]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x28]
cmp eax, 0xfffb
mov eax, dword [esp + 0x54]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x10]
setl dl
xor ecx, ecx
sub edx, eax
mov eax, dword [esp + 0x10]
cmp edx, eax
mov eax, dword [esp + 0x28]
setne cl
xor edx, edx
cmp eax, ecx
mov eax, dword [esp + 0x54]
setl dl
xor ecx, ecx
dec edx
cmp edx, eax
setg cl
add ecx, 0xe341
je 0x1001bd6b
mov dword [esp + 0x20], 0x774d2ad0
lea ecx, [esp + 0xe8]
push 2
call fcn.100191fb
mov dword [esp + 0x2c], 0xffffffff
xor ecx, ecx
inc ecx
mov dword [esp + 0x30], ecx
mov dword [esp + 0x38], 0x22f105ee
mov dword [esp + 0x3c], 0xffffffff
mov dword [esp + 0x1c], ebx
cmp dword [esp + 0x1c], 2
jge 0x1001bc66
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0xe8]
mov dword [eax + ecx*4], 0xeff85a04
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jl 0x1001bc46
xor ecx, ecx
inc ecx
mov eax, dword [esp + 0x20]
cmp dword [esp + 0x20], ebx
je 0x1001bcba
mov eax, dword [esp + 0x24]
mov edx, ecx
mov eax, dword [esp + 0x14]
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x20]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x20]
setge dl
dec edx
mov dword [esp + 0x38], edx
xor edx, edx
cmp dword [esp + 0x38], eax
mov eax, dword [esp + 0x10]
setg dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [esp + 0x2c], ecx
cmp dword [esp + 0x30], ebx
je 0x1001bcba
xor eax, eax
lea ecx, [eax + 1]
jmp 0x1001bcbc
mov ecx, ebx
mov eax, dword [esp + 0x14]
imul eax, ecx
mov ecx, 0xdaf140b3
imul eax, eax, 0x5755
add eax, 2
cmp ecx, eax
sbb eax, eax
neg eax
mov dword [esp + 0x38], eax
cmp dword [esp + 0x14], ebx
jne 0x1001bd36
mov eax, dword [esp + 0x10]
xor edx, edx
mov eax, dword [esp + 0x10]
cmp eax, 0xd9d0
mov eax, dword [esp + 0xe8]
setne dl
sub edx, dword [eax + 4]
mov eax, dword [esp + 0x10]
dec edx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
mov dword [esp + 0x3c], ecx
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x54]
cmp dword [esp + 0x24], ebx
je 0x1001bd32
cmp dword [esp + 0x2c], ebx
jne 0x1001bd36
mov edx, ebx
jmp 0x1001bd3b
xor eax, eax
lea edx, [eax + 1]
mov eax, dword [esp + 0x14]
xor ecx, ecx
cmp edx, eax
setg cl
cmp ecx, 0x22ff
jg 0x1001bd59
cmp dword [esp + 0x28], ebx
je 0x1001bd59
xor eax, eax
inc eax
jmp 0x1001bd5b
mov eax, ebx
mov dword [esp + 0x1c], eax
lea ecx, [esp + 0xe8]
jmp 0x1001bdf5
push dword [esp + 0x68]
movdqa xmm0, xmmword [0x10007f10]
lea eax, [esp + 0x244]
push eax
lea eax, [esp + 0x238]
mov dword [esp + 0x38], 0x870af1aa
push eax
push ebx
lea ecx, [esp + 0xcc]
mov dword [esp + 0xcc], ebx
movdqu xmmword [esp + 0x240], xmm0
mov dword [esp + 0xd0], ebx
mov dword [esp + 0xd4], ebx
call fcn.1001a8c5
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001bde1
push 0xd4
push ebx
push 0x15f3
push 0x251b
call edi
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_TextOutA]
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0xbc]
mov dword [eax], ecx
lea ecx, [esp + 0xbc]
call fcn.1001927d
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xfffffffd
push 1
pop eax
jne 0x1001bb03
xor esi, esi
mov dword [esp + 0x14], ebx
inc esi
jmp 0x1001bec9
mov dword [esp + 0x2c], 0xfcb6e431
mov dword [esp + 0x2c], 0x73e414ce
mov eax, dword [esp + 0x14]
cmp dword [esp + eax*4 + 0x48], ebx
jne 0x1001bea8
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov eax, dword [esp + 0x14]
mov eax, dword [esp + eax*4 + 0x48]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x48]
cmp eax, 0x6da1
mov edx, dword [esp + 0x4c]
mov eax, dword [esp + 0x14]
setl cl
add edx, ecx
xor ecx, ecx
mov esi, dword [esp + eax*4 + 0x48]
mov eax, dword [esp + 0x10]
cmp eax, edx
mov eax, dword [esp + 0x14]
setg cl
xor edx, edx
cmp ecx, esi
mov eax, dword [esp + eax*4 + 0x48]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x14]
setg cl
xor esi, esi
mov eax, dword [esp + eax*4 + 0x48]
sub eax, ecx
sub eax, dword [esp + 0x14]
inc esi
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + eax*4 + 0x48]
mov eax, dword [esp + 0x48]
mov eax, dword [esp + 0x48]
xor ecx, ecx
cmp eax, esi
mov eax, dword [esp + 0x14]
setge cl
sub ecx, eax
mov dword [esp + 0x2c], ecx
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x10], eax
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jle 0x1001be18
push 2
lea ecx, [esp + 0x190]
call fcn.100191fb
mov dword [esp + 0x1c], ebx
jmp 0x1001befd
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18c]
mov dword [eax + ecx*4], 0x57fd5464
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jl 0x1001bee7
mov eax, dword [esp + 0x18c]
lea ecx, [esp + 0x18c]
mov dword [eax], 6
call fcn.1001927d
mov dword [esp + 0x20], 7
lea ecx, [esp + 0xd0]
mov dword [esp + 0x1c], 0xda8ed40a
push 2
call fcn.100191fb
mov dword [esp + 0x274], esi
lea ecx, [esp + 0x198]
mov eax, 0xf213ed4
mov dword [esp + 0x30], 7
mov dword [esp + 0x84], eax
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], eax
mov dword [esp + 0x90], eax
push 4
call fcn.100191fb
push 3
lea ecx, [esp + 0x154]
mov byte [esp + 0x278], 2
call fcn.100191fb
push 2
mov dword [esp + 0x28], 0x75d1b300
mov dword [esp + 0x18], ebx
pop edx
jmp 0x1001bfb0
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x58], 0x44cf
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x1001bfa0
mov dword [esp + 0x14], ebx
jmp 0x1001bfd2
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xd0]
mov dword [eax + ecx*4], 0xfffffff6
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x1001bfbc
mov dword [esp + 0x14], ebx
jmp 0x1001bfee
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x74], 0x255d5800
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x1001bfde
mov dword [esp + 0x14], ebx
jmp 0x1001c010
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x198]
mov dword [eax + ecx*4], 0x212aeaf
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x1001bffa
mov dword [esp + 0x14], ebx
jmp 0x1001c02f
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x150]
mov dword [eax + ecx*4], esi
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x1001c01d
mov edx, dword [esp + 0x5c]
mov ecx, 0xe012d2c8
mov eax, dword [esp + 0x20]
neg edx
push 0xfffffffffffffff9
sbb edx, edx
sub ecx, eax
xor eax, eax
neg edx
cmp ecx, edx
setl al
mov dword [esp + 0x20], eax
pop eax
cmp dword [esp + 0x20], eax
mov eax, dword [esp + 0x5c]
sbb ecx, ecx
mov esi, dword [esp + 0xd0]
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [esp + 0x1c]
push 0xfffffffffffffff9
setge dl
mov dword [esi + 4], edx
lea ecx, [edx - 3]
xor edx, edx
cmp eax, ecx
setge dl
xor eax, eax
sub edx, dword [esp + 0x24]
cmp edx, 0x164
setle al
xor ecx, ecx
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x24]
cmp dword [esp + 0x34], eax
setl cl
xor edx, edx
cmp ecx, 0x47f5
setl dl
mov dword [esp + 0x78], edx
mov eax, dword [esp + 0x24]
imul eax, edx
xor edx, edx
mov dword [esp + 0x34], eax
mov ecx, dword [esp + 0x60]
mov eax, dword [esp + 0x60]
cmp ecx, eax
setl dl
mov dword [esp + 0x88], edx
xor edx, edx
mov eax, dword [esp + 0x8c]
mov eax, dword [esp + 0x5c]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x19c]
cmp dword [ecx + 8], eax
mov ecx, dword [esp + 0x88]
mov eax, dword [esp + 0x154]
setge dl
imul ecx, edx
mov dword [eax + 4], edx
xor edx, edx
mov eax, dword [esp + 0x90]
cmp ecx, eax
mov ecx, dword [esp + 0x28]
pop eax
setg dl
sub edx, eax
mov eax, dword [esp + 0xd0]
neg edx
sbb edx, edx
inc edx
sub edx, dword [eax]
mov eax, dword [esp + 0x24]
neg edx
sbb edx, edx
inc edx
add ecx, edx
imul ecx, dword [esi + 4]
imul eax, ecx
xor ecx, ecx
cmp eax, dword [esi + 4]
mov eax, dword [esp + 0x84]
setl cl
xor edx, edx
cmp ecx, eax
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
setge dl
add eax, edx
add ecx, eax
xor eax, eax
cmp ecx, 0xfffffff6
mov ecx, dword [esp + 0x74]
setne al
xor edx, edx
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x58]
cmp ecx, eax
lea ecx, [esp + 0x150]
mov dword [esi + 4], 0x7941993e
setl dl
xor eax, eax
cmp edx, dword [esp + 0x30]
setl al
mov dword [esp + 0x84], eax
call fcn.1001927d
lea ecx, [esp + 0x198]
call fcn.1001927d
or dword [esp + 0x274], 0xffffffff
lea ecx, [esp + 0xd0]
call fcn.1001927d
xor esi, esi
lea ecx, [esp + 0x100]
inc esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], 0x44b0bf2
push esi
call fcn.100191fb
push 2
lea ecx, [esp + 0x11c]
mov dword [esp + 0x278], 3
call fcn.100191fb
mov byte [esp + 0x274], 4
mov dword [esp + 0x2c], 0x9873
mov dword [esp + 0x38], esi
mov dword [esp + 0x10], ebx
jmp 0x1001c225
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x100]
mov dword [eax + ecx*4], 0xa421e0be
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x1001c20f
mov dword [esp + 0x10], ebx
jmp 0x1001c243
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x118]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1001c231
mov eax, dword [esp + 0x118]
push 0
pop ecx
push 8
inc dword [eax]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
setne cl
xor eax, eax
cmp ecx, esi
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
setge al
sub ecx, eax
mov eax, dword [esp + 0x104]
neg ecx
sbb ecx, ecx
inc ecx
neg edx
mov dword [eax], ecx
mov eax, dword [esp + 0x24]
sbb edx, edx
neg edx
xor ecx, ecx
cmp edx, eax
pop eax
setge cl
cmp eax, ecx
sbb eax, eax
neg eax
sub eax, 6
mov dword [esp + 0x24], eax
je 0x1001c2ab
mov ecx, esi
cmp dword [esp + 0x24], ebx
jne 0x1001c2ad
mov ecx, ebx
mov eax, dword [esp + 0x20]
imul eax, dword [esp + 0x20]
imul eax, ecx
add eax, dword [esp + 0x20]
cmp eax, 0x218f
jl 0x1001c2f0
mov dword [esp + 0x1c], ebx
jmp 0x1001c2d9
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x240], esi
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 3
jl 0x1001c2ca
mov eax, dword [esp + 0x244]
mov dword [esp + 0x2c], eax
jmp 0x1001c3c4
mov dword [esp + 0x20], 0xfffffffd
lea ecx, [esp + 0x168]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], 0xb016fefd
push esi
call fcn.100191fb
mov dword [esp + 0x1c], ebx
jmp 0x1001c32d
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x168]
mov dword [eax + ecx*4], 0x6851cc0d
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], esi
jl 0x1001c317
dec dword [esp + 0x20]
mov eax, dword [esp + 0x20]
cmp eax, dword [esp + 0x2c]
jl 0x1001c350
mov eax, 0xffff
mov dword [esp + 0x24], eax
cmp dword [esp + 0x24], ebx
jne 0x1001c358
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
inc eax
cmp eax, 0xfffe
mov eax, dword [esp + 0x100]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp dword [eax], ecx
mov eax, dword [esp + 0x28]
setl dl
mov dword [esp + 0x30], edx
xor edx, edx
cmp dword [esp + 0x30], eax
setg dl
xor ecx, ecx
imul edx, dword [esp + 0x38]
sub edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
cmp edx, 0xffffffff
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x118]
setne dl
xor ecx, ecx
cmp edx, dword [eax]
mov eax, dword [esp + 0x168]
setg cl
mov dword [eax], ecx
lea ecx, [esp + 0x168]
call fcn.1001927d
lea ecx, [esp + 0x118]
call fcn.1001927d
or dword [esp + 0x274], 0xffffffff
lea ecx, [esp + 0x100]
call fcn.1001927d
mov dword [esp + 0x1c], 0xffffffff
lea ecx, [esp + 0x180]
mov dword [esp + 0x2c], 0x3843046b
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], 0xa42b4837
push 2
call fcn.100191fb
push 5
pop edx
mov dword [esp + 0x274], edx
mov dword [esp + 0x30], 0xfffffffc
push 0xfffffffffffffff9
mov dword [esp + 0x40], 0xfffffffe
pop eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x24], 0xbd7a89a4
mov dword [esp + 0x10], ebx
jmp 0x1001c44f
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x180]
mov dword [eax + ecx*4], edx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1001c43d
mov dword [esp + 0x10], ebx
jmp 0x1001c46f
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x1f4], 0xfffffff6
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x1001c45c
mov dword [esp + 0x1c], ebx
cmp dword [esp + 0x1c], 0xfffffff2
jge 0x1001c631
mov dword [esp + 0x10], esi
lea ecx, [esp + 0x1bc]
mov dword [esp + 0x2c], 0x9dd952ea
push 3
call fcn.100191fb
mov byte [esp + 0x274], 6
lea ecx, [esp + 0x20c]
mov dword [esp + 0x38], 0xead
mov dword [esp + 0x30], 0xfffffffd
push 2
call fcn.100191fb
mov dword [esp + 0x10], ebx
jmp 0x1001c4e1
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x1bc]
mov dword [eax + ecx*4], 2
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x1001c4cb
mov dword [esp + 0x10], ebx
jmp 0x1001c504
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x20c]
mov dword [eax + ecx*4], 6
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1001c4ee
mov dword [esp + 0x10], 0xb457102d
mov eax, dword [esp + 0x24]
inc dword [esp + 0x24]
test eax, eax
je 0x1001c5f3
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x30]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x1fc]
mov esi, dword [esp + 0x1bc]
xor eax, eax
mov ecx, dword [esi]
cmp ecx, dword [esi + 8]
setne al
xor edx, edx
cmp eax, ecx
mov eax, dword [esp + 0x24]
setge dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [esp + 0x180]
setle cl
mov dword [esp + 0x2c], ecx
xor ecx, ecx
cmp dword [esi + 8], 0x127c80b1
setl cl
mov dword [eax], ecx
mov eax, dword [esp + 0x28]
sub ecx, eax
je 0x1001c5f3
mov dword [esp + 0x20], 0xfffffff8
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x38]
add eax, dword [esp + 0x10]
jne 0x1001c5b5
cmp dword [esp + 0x1f8], ebx
jne 0x1001c5b5
mov eax, ebx
jmp 0x1001c5b8
xor eax, eax
inc eax
cmp eax, dword [esp + 0x20]
jge 0x1001c5c2
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
mov ecx, 0x87a
sub ecx, eax
mov eax, 0xe52bdabf
cmp eax, ecx
mov eax, dword [esp + 0x20]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, 0xa76c1e80
setg dl
cmp eax, edx
sbb eax, eax
neg eax
mov dword [esp + 0x20], eax
jmp 0x1001c5ff
mov dword [esp + 0x2c], 9
inc dword [esp + 0x2c]
lea ecx, [esp + 0x20c]
call fcn.1001927d
lea ecx, [esp + 0x1bc]
mov byte [esp + 0x274], 5
call fcn.1001927d
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xfffffff2
push 1
pop esi
jl 0x1001c485
or dword [esp + 0x274], 0xffffffff
lea ecx, [esp + 0x180]
call fcn.1001927d
mov dword [esp + 0x14], 0x365653d4
mov dword [esp + 0x30], 0xe543
mov dword [esp + 0x1c], ebx
jmp 0x1001c66e
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0xdc], 0x47d228d5
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 3
jl 0x1001c65b
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
dec eax
dec eax
jne 0x1001c6a9
mov eax, ebx
cmp dword [esp + 0x14], ebx
je 0x1001c6ab
mov eax, esi
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0xe4]
jge 0x1001c6eb
mov dword [esp + 0x1c], ebx
jmp 0x1001c6d1
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x218], ebx
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jl 0x1001c6c2
mov eax, dword [esp + 0x21c]
mov dword [esp + 0xe4], eax
jmp 0x1001c7ac
push 0xfffffffffffffff7
mov dword [esp + 0x24], 0xff4caa5d
pop eax
mov dword [esp + 0x20], eax
cmp dword [esp + 0x20], ebx
je 0x1001c72a
mov dword [esp + 0x2c], eax
inc dword [esp + 0x2c]
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001c7ac
push 0x148e
call edi
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
jmp 0x1001c7ac
mov dword [esp + 0x14], 4
jmp 0x1001c76d
mov dword [esp + 0x24], 0x43ec3e1b
cmp dword [esp + 0x24], ebx
jne 0x1001c760
mov ecx, dword [esp + 0x24]
xor edx, edx
mov eax, dword [esp + 0xe0]
cmp ecx, eax
setge dl
mov dword [esp + 0x24], edx
mov eax, dword [esp + 0x24]
mov eax, ebx
jmp 0x1001c762
mov eax, esi
mov dword [esp + 0xdc], eax
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 7
jne 0x1001c734
mov dword [esp + 0x14], ebx
jmp 0x1001c7a5
mov dword [esp + 0x20], ebx
jmp 0x1001c79a
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001c796
push ebx
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_SetPropA]
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 2
jle 0x1001c780
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jle 0x1001c77a
mov dword [esp + 0x1c], ebx
jmp 0x1001c7c5
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0xa4], 0xfffffffb
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jl 0x1001c7b2
mov dword [esp + 0x24], 0x443250e6
mov dword [esp + 0x1c], 0x5d70512a
mov dword [esp + 0x30], 0x87e91c17
mov dword [esp + 0x38], 0xebe1552b
mov dword [esp + 0x1c], ebx
jmp 0x1001c802
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x60], 0xfffffff8
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jl 0x1001c7f2
cmp dword [esp + 0x64], 5
jbe 0x1001c818
cmp dword [esp + 0x24], ebx
jne 0x1001c818
mov esi, ebx
mov edx, dword [esp + 0x64]
mov eax, dword [esp + 0x24]
dec edx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [esp + 0x60]
setle cl
xor edx, edx
imul ecx, esi
cmp ecx, eax
mov eax, dword [esp + 0x24]
setne dl
xor ecx, ecx
cmp eax, edx
setg cl
imul ecx, dword [esp + 0x64]
cmp ecx, 0xba13b288
sbb eax, eax
neg eax
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x60]
dec eax
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
cmp dword [esp + 0x64], eax
jg 0x1001c875
mov eax, dword [esp + 0x60]
mov eax, dword [esp + 0x24]
xor esi, esi
mov eax, dword [esp + 0x30]
inc esi
mov ecx, esi
sub ecx, eax
mov dword [esp + 0x38], ecx
mov eax, dword [esp + 0x34]
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], ebx
je 0x1001cb65
mov eax, dword [esp + 0x10]
mov ecx, 0xffff
mov eax, dword [esp + 0x34]
cmp ecx, eax
sbb eax, eax
inc eax
imul eax, dword [esp + 0x34]
test eax, eax
jne 0x1001c8b9
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
xor edx, edx
mov eax, dword [esp + 0x34]
cmp ecx, eax
setge dl
xor eax, eax
sub edx, dword [esp + 0xa4]
cmp edx, 0xfffffff7
setge al
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
neg eax
sbb eax, eax
inc eax
imul eax, eax, 0xd816
test eax, eax
je 0x1001cb65
mov dword [esp + 0x10], ebx
jmp 0x1001c9ca
mov dword [esp + 0x20], 0xfffffffd
lea ecx, [esp + 0x138]
push 3
call fcn.100191fb
mov dword [esp + 0x1c], ebx
jmp 0x1001c92d
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x138]
mov dword [eax + ecx*4], 0x345fe46c
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 3
jl 0x1001c917
cmp dword [esp + 0x20], ebx
jne 0x1001c94f
mov ecx, dword [esp + 0x20]
xor edx, edx
mov eax, dword [esp + 0x20]
cmp ecx, eax
setl dl
cmp edx, dword [esp + 0x20]
jg 0x1001c965
mov eax, dword [esp + 0x20]
xor ecx, ecx
cmp eax, 0x1c97
mov edx, esi
setge cl
add ecx, dword [esp + 0x20]
jne 0x1001c967
mov edx, ebx
mov eax, dword [esp + 0x20]
xor ecx, ecx
cmp edx, eax
mov eax, 0xb7d8cf4c
setne cl
cmp eax, ecx
mov eax, dword [esp + 0x138]
sbb ecx, ecx
inc ecx
mov dword [eax + 4], ecx
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001c9ab
push 0x1a0a
push 0x1f2e
push 0x8e5
push 0x9a7
call dword [sym.imp.GDI32.dll_CreateRectRgn]
lea ecx, [esp + 0x138]
call fcn.1001927d
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0xa4], 0xde1fc657
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1001c8fb
mov eax, 0x647c2c9e
mov dword [esp + 0x1c8], eax
mov dword [esp + 0x1cc], eax
mov dword [esp + 0x1d0], eax
mov dword [esp + 0x1d4], eax
mov dword [esp + 0x2c], 0xfff7
mov dword [esp + 0x1c], ebx
jmp 0x1001ca17
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0xac], 0xec2e0cf5
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 3
jl 0x1001ca04
mov dword [esp + 0xac], 0x1a
jmp 0x1001cb32
push 2
lea ecx, [esp + 0xf8]
call fcn.100191fb
mov dword [esp + 0x274], 7
mov dword [esp + 0x28], 0xd86e52d8
mov dword [esp + 0x1c], ebx
jmp 0x1001ca67
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0xf4]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jl 0x1001ca55
mov dword [esp + 0x28], ebx
jmp 0x1001cb0d
mov dword [esp + 0x20], esi
lea ecx, [esp + 0x12c]
push 2
call fcn.100191fb
mov dword [esp + 0x1c], ebx
jmp 0x1001caa5
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x12c]
mov dword [eax + ecx*4], 0xb5131d8b
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jl 0x1001ca8f
mov dword [esp + 0x20], esi
cmp dword [esp + 0x20], ebx
jl 0x1001cafd
mov ecx, dword [esp + 0x20]
xor edx, edx
mov eax, dword [esp + 0xf4]
mov ecx, dword [eax + ecx*4]
mov eax, dword [esp + 0x12c]
mov dword [eax], ecx
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x20]
mov ecx, dword [esp + 0xf4]
mov eax, dword [ecx + eax*4]
cmp eax, dword [ecx + esi*4]
setl dl
imul eax, edx, 0x715c
mov dword [esp + 0x1d0], eax
dec dword [esp + 0x20]
jns 0x1001cab6
xor esi, esi
inc esi
lea ecx, [esp + 0x12c]
call fcn.1001927d
inc dword [esp + 0x28]
cmp dword [esp + 0x28], esi
jle 0x1001ca77
or dword [esp + 0x274], 0xffffffff
lea ecx, [esp + 0xf4]
call fcn.1001927d
dec dword [esp + 0xac]
cmp dword [esp + 0xac], esi
jne 0x1001ca2e
inc dword [esp + 0x2c]
mov dword [esp + 0x10], ebx
jmp 0x1001cb5c
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0xa4], 0x8bd85027
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1001cb49
jmp 0x1001cbc4
mov dword [esp + 0x30], 0xfffffffb
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001cb93
push ebx
push 0x25bb
push 0x22ff
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetSystemPaletteEntries]
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001cba8
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_MapDialogRect]
push 0x183d
push ebx
lea eax, [esp + 0x4b]
mov byte [esp + 0x4b], bl
push 0x163f
push eax
call fcn.1001f84e
add esp, 0x10
mov dword [esp + 0x30], ebx
lea ecx, [esp + 0x144]
mov dword [esp + 0x3c], 0x33c2251
mov dword [esp + 0x38], 0x1013923c
push 2
call fcn.100191fb
push 8
pop eax
mov dword [esp + 0x274], eax
mov dword [esp + 0x34], 0x69be541
mov dword [esp + 0x1c], ebx
jmp 0x1001cc14
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x144]
mov dword [eax + ecx*4], 0xb0bf2465
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jl 0x1001cbfe
cmp dword [esp + 0x30], ebx
je 0x1001ccdc
push dword [esp + 0x68]
movdqa xmm0, xmmword [0x10007f20]
lea eax, [esp + 0x234]
push eax
lea eax, [esp + 0x228]
mov dword [esp + 0x2c], 0xfffffff7
push eax
push ebx
lea ecx, [esp + 0x88]
mov dword [esp + 0x3c], ebx
movdqu xmmword [esp + 0x230], xmm0
mov dword [esp + 0x88], ebx
mov dword [esp + 0x8c], ebx
mov dword [esp + 0x90], ebx
call fcn.1001a8c5
mov eax, dword [esp + 0x78]
cmp dword [eax], ebx
je 0x1001cc8c
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x34]
xor edx, edx
inc dword [esp + 0x34]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x78]
cmp eax, dword [ecx + 8]
setge dl
xor eax, eax
test edx, edx
setle al
mov dword [esp + 0x2c], eax
mov ecx, dword [esp + 0x3c]
mov eax, dword [esp + 0x144]
imul ecx, dword [eax]
mov eax, dword [esp + 0x78]
add ecx, 0x7937
imul ecx, dword [eax]
mov dword [eax + 4], ecx
lea ecx, [esp + 0x78]
call fcn.1001927d
jmp 0x1001ccf6
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001ccf6
push 0x19e9
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
or dword [esp + 0x274], 0xffffffff
lea ecx, [esp + 0x144]
call fcn.1001927d
push 3
pop edi
push edi
lea ecx, [esp + 0x178]
call fcn.100191fb
mov dword [esp + 0x274], 9
lea ecx, [esp + 0x10c]
mov dword [esp + 0x38], 0xeb77278f
mov dword [esp + 0x30], ebx
mov dword [esp + 0x30], 0xfffffff7
mov dword [esp + 0x3c], ebx
push esi
call fcn.100191fb
mov byte [esp + 0x274], 0xa
lea ecx, [esp + 0x15c]
mov dword [esp + 0x34], ebx
mov dword [esp + 0x2c], esi
push edi
call fcn.100191fb
mov dword [esp + 0x2c], 0xcc8c9f13
mov dword [esp + 0x14], ebx
jmp 0x1001cd88
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x174]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x1001cd75
mov dword [esp + 0x14], ebx
jmp 0x1001cdaa
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10c]
mov dword [eax + ecx*4], 0xfffffffd
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x1001cd94
mov dword [esp + 0x14], ebx
jmp 0x1001cdc9
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0xc8], 0xe74b
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x1001cdb6
mov dword [esp + 0x14], ebx
jmp 0x1001cde8
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x15c]
mov dword [eax + ecx*4], esi
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x1001cdd6
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001ce00
push ebx
call dword [sym.imp.USER32.dll_RegisterClassW]
mov eax, dword [esp + 0xc8]
dec dword [esp + 0xc8]
test eax, eax
jne 0x1001ce2d
mov eax, dword [esp + 0x15c]
mov ecx, dword [eax + 8]
mov eax, dword [esp + 0x10c]
mov dword [eax], ecx
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x10c]
xor ecx, ecx
cmp dword [eax], ebx
mov eax, dword [esp + 0x34]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x34]
setge dl
sub edx, 0x160c6370
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setle cl
xor edx, edx
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x174]
mov eax, dword [ecx + 8]
cmp eax, dword [ecx + 4]
mov eax, dword [esp + 0x2c]
setg dl
mov dword [esp + 0x30], edx
xor edx, edx
cmp dword [esp + 0x30], eax
mov eax, dword [esp + 0x3c]
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
cmp ecx, 0xb22c
lea ecx, [esp + 0x15c]
setg al
mov dword [esp + 0x34], eax
call fcn.1001927d
lea ecx, [esp + 0x10c]
call fcn.1001927d
or dword [esp + 0x274], 0xffffffff
lea ecx, [esp + 0x174]
call fcn.1001927d
mov dword [esp + 0x20], 0x7f759609
mov dword [esp + 0x10], ebx
jmp 0x1001ceea
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x24c], 0xc93b4e1a
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x1001ced7
mov dword [esp + 0x10], ebx
jmp 0x1001cf06
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x44], 0x94643cdf
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x1001cef6
mov dword [esp + 0x44], ebx
jmp 0x1001cf25