Function at 0x1003c4bb
Capabilities:
Get graphical window text
Query environment variable
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1006b6cd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x490
movdqa xmm0, xmmword [0x1000b9c0]
lea eax, [esp + 0x210]
push ebx
push esi
push edi
push dword [esp + 0xb0]
xor ebx, ebx
mov dword [esp + 0x5c], ecx
push eax
lea eax, [esp + 0x214]
mov dword [esp + 0x44], edx
push eax
push ebx
lea ecx, [esp + 0x108]
mov dword [esp + 0x108], ebx
movdqu xmmword [esp + 0x21c], xmm0
mov dword [esp + 0x10c], ebx
mov dword [esp + 0x110], ebx
call fcn.1001135b
mov dword [esp + 0x34], ebx
push 5
pop eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x28], 0xaebb1bb3
mov dword [esp + 0x18], ebx
jmp 0x1003c563
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0xb4], 0x342e
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jl 0x1003c550
mov esi, dword [esp + 0xf8]
xor ecx, ecx
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
inc ecx
mov dword [esi + 0xc], ebx
mov dword [esp + 0x20], 0x66c4779d
mov dword [esp + 0x28], ecx
cmp dword [esi + 0xc], ebx
je 0x1003c5b4
mov eax, dword [esp + 0x34]
mov eax, dword [esi + 0xc]
mov eax, dword [esp + eax*4 + 0xb4]
cmp dword [esp + 0x24], ebx
jne 0x1003c5a6
mov eax, dword [esp + 0x20]
mov eax, dword [esi + 0xc]
mov eax, dword [esp + eax*4 + 0xb4]
mov eax, dword [esp + 0x20]
mov eax, dword [esi + 0xc]
mov eax, dword [esp + eax*4 + 0xb4]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
mov eax, dword [esi + 0xc]
mov eax, dword [esp + eax*4 + 0xb4]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x34]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x34]
je 0x1003c5fd
mov eax, ecx
cmp dword [esp + 0xb8], ebx
jne 0x1003c5ff
mov eax, ebx
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], ebx
jmp 0x1003c647
mov dword [esp + 0x28], 0x771b7056
mov dword [esp + 0x14], ebx
jmp 0x1003c637
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x1003c633
push 0xe7e
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
xor ecx, ecx
inc ecx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ecx
jle 0x1003c617
cmp dword [esp + 0x28], ebx
jne 0x1003c64d
inc dword [esp + 0x24]
cmp dword [esp + 0x24], ecx
jle 0x1003c609
inc dword [esi + 0xc]
cmp dword [esi + 0xc], ecx
jle 0x1003c57d
lea ecx, [esp + 0xf8]
call fcn.1000d97d
mov eax, dword [0x108d8160]
test al, 1
jne 0x1003c708
or eax, 1
mov dword [0x108d8160], eax
push ebx
mov dword [esp + 0x4a8], ebx
push ebx
mov dword [0x108d8120], ebx
mov dword [0x108d8124], ebx
call fcn.1003efcf
mov dword [0x108d8120], eax
mov dword [0x108d8128], ebx
mov dword [0x108d8130], ebx
mov byte [esp + 0x4a4], 2
mov ecx, 0x108d8128
mov dword [esp + 0xf4], eax
lea eax, [esp + 0xf4]
push eax
push 0x10
push ebx
lea eax, [esp + 0xa4]
mov dword [0x108d813c], 0x3f800000
push eax
mov dword [0x108d812c], ebx
call fcn.1003eda7
push 0x1006bdcc
mov dword [0x108d8134], 7
mov dword [0x108d8138], 8
call fcn.10050b3c
or dword [esp + 0x4a8], 0xffffffff
pop ecx
imul eax, dword [esp + 0x58], 0x2710
add eax, dword [esp + 0x3c]
mov dword [esp + 0x9c], eax
lea eax, [esp + 0x9c]
push eax
call fcn.1003e546
push dword [esp + 0x98]
movdqa xmm0, xmmword [0x1000b940]
lea ecx, [esp + 0x120]
movdqu xmmword [esp + 0x1f0], xmm0
mov esi, dword [eax]
lea eax, [esp + 0x200]
push eax
lea eax, [esp + 0x1f4]
mov dword [esp + 0x1c], 0xe469ad59
push eax
push ebx
mov dword [esp + 0x38], esi
mov dword [esp + 0x12c], ebx
mov dword [esp + 0x130], ebx
mov dword [esp + 0x134], ebx
call fcn.1001135b
inc dword [esp + 0x14]
mov dword [esp + 0x14], ebx
jmp 0x1003c7a1
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1003c79d
push ebx
push ebx
call dword [sym.imp.USER32.dll_LoadIconA]
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jle 0x1003c78a
lea ecx, [esp + 0x11c]
call fcn.1000d97d
test esi, esi
je 0x1003c996
push dword [esp + 0x98]
movdqa xmm0, xmmword [0x1000b9b0]
lea eax, [esp + 0x230]
push eax
lea eax, [esp + 0x224]
mov dword [esp + 0xac], ebx
push eax
push ebx
lea ecx, [esp + 0xb4]
mov dword [esp + 0xb8], ebx
movdqu xmmword [esp + 0x22c], xmm0
mov dword [esp + 0xbc], ebx
call fcn.1001135b
mov dword [esp + 0x1c], 0x5ccc90a3
mov dword [esp + 0x1c], ebx
cmp dword [esp + 0x1c], 3
jg 0x1003c97e
mov dword [esp + 0x24], ebx
mov dword [esp + 0x18], 0xcb8f1fe3
mov dword [esp + 0x14], ebx
jmp 0x1003c842
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x1dc], 0xee01e6e8
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x1003c82f
mov eax, dword [esp + 0x1c]
xor edx, edx
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
cmp eax, ecx
setl dl
mov dword [esp + 0x24], edx
mov eax, dword [esp + 0x24]
mov edi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x1c]
mov esi, dword [esp + 0xa4]
mov eax, dword [esp + 0xa4]
mov eax, dword [eax + ecx*4]
xor ecx, ecx
mov dword [esi + edi*4], eax
mov eax, dword [esp + 0x1c]
cmp eax, 0xed85
setge cl
xor edx, edx
imul ecx, dword [esp + 0x1c]
add ecx, dword [esp + 0x18]
cmp dword [esi + edi*4], ecx
mov eax, dword [esp + 0x18]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x18]
setne cl
imul ecx, eax
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x1e0], ecx
xor ecx, ecx
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x3c], eax
setle cl
sub ecx, dword [esp + 0x1c]
sub ecx, dword [esp + 0x18]
jne 0x1003c92c
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0xa4]
cmp dword [eax + ecx*4], ebx
jne 0x1003c92c
mov dword [esp + 0x18], ebx
jmp 0x1003c923
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1003c90f
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0xa4]
cmp dword [eax + ecx*4], ebx
jne 0x1003c96b
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jle 0x1003c8fd
jmp 0x1003c96b
mov dword [esp + 0x3c], 0x532d49ac
mov dword [esp + 0x18], ebx
jmp 0x1003c964
cmp dword [esp + 0x3c], ebx
jne 0x1003c96b
mov dword [esp + 0x24], ebx
jmp 0x1003c959
mov eax, dword [esp + 0x24]
mov dword [esp + eax*4 + 0x1dc], 0x31cf6a12
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 3
jl 0x1003c946
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0x25
jg 0x1003c93a
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 3
jle 0x1003c81d
mov esi, dword [esp + 0x28]
lea ecx, [esp + 0xa4]
call fcn.1000d97d
mov dword [esp + 0xd0], esi
jmp 0x1003e39e
mov eax, dword [0x108d8160]
test al, 2
jne 0x1003ca3d
or eax, 2
mov dword [0x108d8160], eax
push ebx
mov dword [esp + 0x4a8], 3
push ebx
mov dword [0x108d8140], ebx
mov dword [0x108d8144], ebx
call fcn.1003efcf
mov dword [0x108d8140], eax
mov dword [0x108d8148], ebx
mov dword [0x108d8150], ebx
mov byte [esp + 0x4a4], 5
mov ecx, 0x108d8148
mov dword [esp + 0x114], eax
lea eax, [esp + 0x114]
push eax
push 0x10
push ebx
lea eax, [esp + 0xe8]
mov dword [0x108d815c], 0x3f800000
push eax
mov dword [0x108d814c], ebx
call fcn.1003eda7
push 0x1006bdc7
mov dword [0x108d8154], 7
mov dword [0x108d8158], 8
call fcn.10050b3c
or dword [esp + 0x4a8], 0xffffffff
pop ecx
mov dword [esp + 0x14], ebx
lea ecx, [esp + 0x190]
push 3
call fcn.1000d3e3
mov dword [esp + 0x14], ebx
jmp 0x1003ca6b
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x190]
mov dword [eax + ecx*4], 0xbf8f0aa6
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x1003ca55
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1003ca87
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov dword [esp + 0x14], ebx
cmp dword [esp + 0x14], 0xfffffff7
jle 0x1003cabd
mov ecx, dword [esp + 0x190]
mov dword [esp + 0x28], 0xf5a9c4c8
mov eax, dword [esp + 0x28]
sub eax, 0xfff6
neg eax
sbb eax, eax
inc eax
mov dword [ecx + 8], eax
dec dword [esp + 0x14]
cmp dword [esp + 0x14], 0xfffffff7
jg 0x1003ca99
lea ecx, [esp + 0x190]
call fcn.1000d97d
lea eax, [esp + 0x58]
xorps xmm0, xmm0
push eax
movdqu xmmword [esp + 0xe4], xmm0
call fcn.1003e5a8
push dword [esp + 0xdc]
movdqa xmm0, xmmword [0x1000b910]
lea ecx, [esp + 0x78]
movdqu xmmword [esp + 0x200], xmm0
mov edi, dword [eax]
lea eax, [esp + 0x210]
push eax
lea eax, [esp + 0x204]
mov dword [esp + 0x3c], edi
push eax
push ebx
mov dword [esp + 0x84], ebx
mov dword [esp + 0x88], ebx
mov dword [esp + 0x8c], ebx
call fcn.1001135b
mov dword [esp + 0x4a4], 6
xor esi, esi
inc esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x24], 0xfffffff6
mov dword [esp + 0x18], 0x341f56a6
mov dword [esp + 0x1c], ebx
jmp 0x1003ccd0
mov dword [esp + 0x20], 0x44142b91
mov dword [esp + 0x28], 0xa0b59785
mov dword [esp + 0x40], 0xfffffff6
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x74]
mov dword [eax + ecx*4], 2
mov eax, dword [esp + 0x1c]
sub eax, 0x6d39c7c6
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x20], eax
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setle cl
add ecx, dword [esp + 0x1c]
mov dword [esp + 0x24], ecx
mov eax, dword [esp + 0x24]
cmp dword [esp + 0x1c], 4
sbb eax, eax
inc eax
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x40]
cmp dword [esp + 0x28], eax
jle 0x1003cc64
mov eax, dword [esp + 0x74]
mov dword [esp + 0x40], 0xf181e21
mov dword [esp + 0x28], 0x4628aea3
cmp dword [eax], ebx
jne 0x1003cc02
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x74]
cmp dword [eax + ecx*4], ebx
je 0x1003cbfe
cmp dword [esp + 0x20], ebx
jne 0x1003cc02
mov ecx, ebx
jmp 0x1003cc04
mov ecx, esi
xor eax, eax
cmp ecx, 0xfb41
setl al
cmp eax, 8
sbb eax, eax
neg eax
add eax, dword [esp + 0x1c]
jne 0x1003cc20
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x1c]
mov esi, dword [esp + 0x1c]
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x74]
sub edx, dword [eax + ecx*4]
mov eax, dword [esp + 0x74]
neg edx
mov ecx, dword [esp + 0x20]
sbb edx, edx
inc edx
imul ecx, dword [eax + esi*4]
xor eax, eax
cmp edx, ecx
setg al
xor esi, esi
mov dword [esp + 0x28], eax
inc esi
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x18], eax
jmp 0x1003cccc
push esi
lea ecx, [esp + 0x10c]
call fcn.1000d3e3
mov dword [esp + 0x14], ebx
jmp 0x1003cc8d
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x108]
mov dword [eax + ecx*4], 0x8a064f57
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x1003cc77
mov eax, dword [esp + 0x108]
cmp dword [eax], ebx
jne 0x1003ccdd
mov dword [esp + 0x18], ebx
jmp 0x1003ccba
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x108]
mov dword [eax + ecx*4], 0xb6ac8918
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jl 0x1003cca4
lea ecx, [esp + 0x108]
call fcn.1000d97d
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 3
jle 0x1003cb57
jmp 0x1003cce9
lea ecx, [esp + 0x108]
call fcn.1000d97d
mov dword [esp + 0x24], ebx
jmp 0x1003cd8c
push 3
lea ecx, [esp + 0x1a0]
call fcn.1000d3e3
push 3
mov dword [esp + 0x18], ebx
pop edx
jmp 0x1003cd1b
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x19c]
mov dword [eax + ecx*4], edx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x1003cd09
mov dword [esp + 0x18], esi
cmp dword [esp + 0x18], 0xffffffe9
je 0x1003cd60
mov esi, dword [esp + 0x19c]
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1003cd4d
push ebx
push ebx
push 0x1e32
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp dword [esi + 4], ebx
jne 0x1003cd5d
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 0xffffffe9
jne 0x1003cd33
xor esi, esi
inc esi
mov dword [esp + 0x1c], ebx
jmp 0x1003cd75
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x74]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 4
jl 0x1003cd66
lea ecx, [esp + 0x19c]
call fcn.1000d97d
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 0xf
je 0x1003ccf2
or dword [esp + 0x4a4], 0xffffffff
lea ecx, [esp + 0x74]
call fcn.1000d97d
cmp byte [ebp + 0xc], 0
jne 0x1003cdb6
test edi, edi
jne 0x1003d481
mov dword [esp + 0x14], 0xfffffffc
lea ecx, [esp + 0x1b4]
push 3
mov dword [esp + 0x28], 0x3dec995f
pop edi
mov dword [esp + 0x1c], 2
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x38], 0xe2e4bcb8
push edi
call fcn.1000d3e3
mov dword [esp + 0x4a4], 7
mov dword [esp + 0x14], ebx
jmp 0x1003ce12
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1b4]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x1003cdff
mov dword [esp + 0x14], ebx
jmp 0x1003d017
mov dword [esp + 0x28], 0xf845
mov dword [esp + 0x28], 0x142a
cmp dword [esp + 0x28], 0x10be
jge 0x1003cf53
lea eax, [esp + 0x68]
push eax
lea eax, [esp + 0x68]
push eax
lea eax, [esp + 0x74]
push eax
push 0x1000b5c0
call fcn.100527da
mov eax, dword [esp + 0x7c]
add esp, 8
mov ecx, dword [esp + 0x6c]
imul eax, dword [esp + 0x70]
imul ecx, ecx
shl eax, 2
sub ecx, eax
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.10050d24
mov ecx, dword [esp + 0x6c]
mov eax, ecx
neg eax
imul ecx, ecx
fstp qword [esp + 0x30]
movd xmm1, eax
mov eax, dword [esp + 0x74]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
subsd xmm1, qword [esp + 0x30]
cvtdq2pd xmm0, xmm0
mulsd xmm1, qword [0x1000b8e0]
imul eax, dword [esp + 0x70]
divsd xmm1, xmm0
shl eax, 2
sub ecx, eax
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
movsd qword [esp + 0x30], xmm1
movsd qword [esp], xmm0
call fcn.10050d24
mov eax, dword [esp + 0x74]
pop ecx
pop ecx
mov ecx, dword [esp + 0x64]
fstp qword [esp + 0x40]
movsd xmm1, qword [esp + 0x40]
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
imul ecx, ecx
subsd xmm1, xmm0
movd xmm0, eax
imul eax, dword [esp + 0x68]
cvtdq2pd xmm0, xmm0
shl eax, 2
mulsd xmm1, qword [0x1000b8e0]
divsd xmm1, xmm0
movsd xmm0, qword [esp + 0x28]
cmp ecx, eax
jne 0x1003cf38
push ecx
push ecx
movsd qword [esp], xmm0
push 0x1000b5cc
call fcn.10052b7f
add esp, 0xc
jmp 0x1003cf53
sub esp, 0x10
movsd qword [esp + 8], xmm1
movsd qword [esp], xmm0
push 0x1000b5d4
call fcn.10052b7f
add esp, 0x14
mov dword [esp + 0x40], 0x5aa05d76
lea ecx, [esp + 0x164]
mov dword [esp + 0x28], 0xc422d5fb
mov dword [esp + 0x28], ebx
mov dword [esp + 0x28], 0x81230b63
push edi
call fcn.1000d3e3
mov dword [esp + 0x18], ebx
jmp 0x1003cf98
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x164]
mov dword [eax + ecx*4], 0x385d06f
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x1003cf82
mov eax, dword [esp + 0x24]
xor edx, edx
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x14]
cmp eax, ecx
setge dl
mov dword [esp + 0x28], edx
cmp dword [esp + 0x28], ebx
jne 0x1003cfc8
mov eax, dword [esp + 0x164]
mov edx, ebx
cmp dword [eax], ebx
je 0x1003cfca
mov edx, esi
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x164]
cmp edx, dword [eax]
setl cl
mov dword [esp + 0x1c], ecx
cmp dword [esp + 0x1c], 0xec6f0d4a
sbb eax, eax
xor edx, edx
neg eax
cmp eax, 0xffffffff
mov eax, dword [esp + 0x28]
setg dl
xor ecx, ecx
cmp eax, edx
setne cl
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x164]
call fcn.1000d97d
dec dword [esp + 0x14]
cmp dword [esp + 0x14], 0xffffffe7
jge 0x1003ce21
mov dword [esp + 0x1c], 0xe6b87c26
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x24]
sub ecx, eax
mov dword [esp + 0x38], ecx
jne 0x1003d056
mov eax, ebx
cmp dword [esp + 0x18], ebx
je 0x1003d058
mov eax, esi
add eax, 0xdb5f4f57
jne 0x1003d065
cmp dword [esp + 0x24], ebx
je 0x1003d069
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x18]
xor edx, edx
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x24]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x24]
cmp eax, esi
mov eax, dword [esp + 0x14]
setg dl
xor ecx, ecx
cmp eax, edx
setg cl
add ecx, dword [esp + 0x18]
je 0x1003d09d
mov eax, esi
cmp dword [esp + 0x38], ebx
jne 0x1003d09f
mov eax, ebx
xor edx, edx
cmp eax, 0x94ae
mov eax, dword [esp + 0x24]
setl dl
xor ecx, ecx
cmp edx, eax
setl cl
cmp ecx, dword [esp + 0x24]
jge 0x1003d35b
push 2
lea ecx, [esp + 0x15c]
call fcn.1000d3e3
mov byte [esp + 0x4a4], 8
mov dword [esp + 0x28], 0xfffffffe
mov dword [esp + 0x14], ebx
jmp 0x1003d0f8
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x158]
mov dword [eax + ecx*4], 0xbf288841
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x1003d0e2
xor edx, edx
mov dword [esp + 0x1c], ebx
inc edx
jmp 0x1003d343
mov dword [esp + 0x28], 0x74ed7b97
mov dword [esp + 0x28], 0x2aba01c9
mov dword [esp + 0x28], 0x1949
cmp dword [esp + 0x28], 0x1276
jge 0x1003d2e3
mov byte [0x108d7fa0], dl
mov byte [0x108d7fa1], dl
call fcn.1003c48a
lea eax, [esp + 0xa0]
mov dword [esp + 0x28], ebx
push eax
mov ecx, 0x1065b710
call fcn.1000d0c9
push 0xf
pop eax
mov dword [esp + 0x148], eax
mov dword [esp + 0x144], ebx
mov byte [esp + 0x134], bl
mov dword [esp + 0x184], eax
mov dword [esp + 0x180], ebx
mov byte [esp + 0x170], bl
mov byte [esp + 0x4a4], 0xa
mov esi, dword [esp + 0xa0]
test esi, esi
je 0x1003d2b1
lea edx, [esp + 0x134]
mov ecx, 0x1065b710
dec esi
call fcn.10030caf
push ebx
push 0x1000b0d9
lea ecx, [esp + 0x178]
call fcn.1000eaca
push 0x248
lea eax, [esp + 0x254]
push ebx
push eax
call fcn.100480ec
mov ecx, ebx
add esp, 0xc
cmp dword [esp + 0x144], ecx
jbe 0x1003d20d
cmp dword [esp + 0x148], 0x10
lea eax, [esp + 0x134]
cmovae eax, dword [esp + 0x134]
movsx eax, byte [ecx + eax]
inc dword [esp + eax*4 + 0x250]
inc ecx
cmp ecx, dword [esp + 0x144]
jb 0x1003d1e1
mov edi, ebx
mov eax, dword [esp + edi*4 + 0x250]
cmp byte [eax + 0x108d7fa0], 0
jne 0x1003d22e
push edi
push 1
lea ecx, [esp + 0x178]
call fcn.100100ca
inc edi
cmp edi, 0x92
jl 0x1003d20f
mov edi, dword [esp + 0x28]
mov edx, 0x1000b3f4
inc edi
push edi
mov dword [esp + 0x2c], edi
mov edi, 0x1065b658
push ecx
mov ecx, edi
call fcn.10030864
pop ecx
mov ecx, eax
call fcn.1000d2c4
mov edx, 0x1000b0dc
mov ecx, eax
call fcn.10030864
push ebx
push 0x1000b0d9
push dword [esp + 0x188]
push ecx
lea ecx, [esp + 0x180]
call fcn.1003008b
mov ecx, edi
test eax, eax
jne 0x1003d293
mov edx, 0x1000b5e4
call fcn.10030864
jmp 0x1003d29f
lea edx, [esp + 0x170]
call fcn.1003067a
push eax
call fcn.10010bca
pop ecx
test esi, esi
jne 0x1003d19c
push 3
pop edi
dec esi
lea ecx, [esp + 0x170]
mov dword [esp + 0xa0], esi
xor esi, esi
push ebx
inc esi
push esi
call fcn.1000d739
push ebx
push esi
lea ecx, [esp + 0x13c]
mov byte [esp + 0x4ac], 8
call fcn.1000d739
xor edx, edx
inc edx
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x158]
cmp dword [eax + ecx*4], ebx
jne 0x1003d339
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x158]
mov ecx, dword [esp + 0x1c]
add ecx, dword [eax + edx*4]
xor eax, eax
cmp ecx, 0xb847
setle al
sub eax, edi
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 6
setne cl
xor edx, edx
xor eax, eax
inc edx
cmp ecx, 0x12b1
mov dword [esp + 0x28], edx
setne al
cmp dword [esp + 0x28], eax
mov eax, ebx
jl 0x1003d33b
mov eax, edx
mov dword [esp + 0x28], eax
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edx
jle 0x1003d10b
lea ecx, [esp + 0x158]
call fcn.1000d97d
jmp 0x1003d395
mov dword [esp + 0x28], 0xfffffff6
mov dword [esp + 0x18], ebx
jmp 0x1003d38e
mov dword [esp + 0x28], 0xa031
dec dword [esp + 0x28]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x1b4]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jle 0x1003d369
or dword [esp + 0x4a4], 0xffffffff
lea ecx, [esp + 0x1b4]
call fcn.1000d97d
mov dl, byte [ebp + 0xc]
lea eax, [esp + 0x240]
mov ecx, dword [esp + 0x58]
push eax
call fcn.10031ca5
mov esi, eax
lea edi, [esp + 0xe4]
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [esp + 0x28], 0x210e
cmp dword [esp + 0x28], 0x1104
jge 0x1003d45b
push 0x1068decc
push 0x1000b21c
call fcn.100527da
pop ecx
pop ecx
mov ecx, dword [0x1068decc]
mov edi, ebx
test ecx, ecx
jle 0x1003d41a
mov esi, 0x108d7e00
push esi
push 0x1000b21c
call fcn.100527da
pop ecx
pop ecx
mov ecx, dword [0x1068decc]
inc edi
add esi, 4
cmp edi, ecx
jl 0x1003d3ff
xor esi, esi
mov edx, ebx
inc esi
dec ecx
mov eax, esi
cmp ecx, esi
jle 0x1003d44e
cmp dword [eax*4 + 0x108d7e00], ebx
jne 0x1003d449
cmp dword [eax*4 + 0x108d7dfc], esi
jne 0x1003d449
cmp dword [eax*4 + 0x108d7e04], esi
jne 0x1003d449
mov dword [eax*4 + 0x108d7e04], ebx
inc edx
inc eax
cmp eax, ecx
jl 0x1003d426
push edx
push 0x1000b250
call fcn.10052b7f
pop ecx
pop ecx
cmp byte [ebp + 0xc], 0
je 0x1003d481
mov ecx, dword [esp + 0xe8]
test ecx, ecx
je 0x1003d481
mov eax, dword [esp + 0xec]
mov dword [esp + 0xd4], eax
mov dword [esp + 0xd8], ecx
push 2
lea ecx, [esp + 0x84]
call fcn.1000d3e3
mov dword [esp + 0x4a4], 0xb
xor edx, edx
mov dword [esp + 0x18], 0x19d29be1
inc edx
mov dword [esp + 0x1c], 0xa6eb
mov dword [esp + 0x38], ebx
mov dword [esp + 0x28], 0xb883eb99
mov dword [esp + 0x28], 0x1734826a
mov dword [esp + 0x28], edx
mov dword [esp + 0x28], edx
mov dword [esp + 0x14], ebx
jmp 0x1003d4e5
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x80]
mov dword [eax + ecx*4], 0x6482
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x1003d4cf
mov dword [esp + 0x18], ebx
jmp 0x1003d6d1
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x28], 6
mov dword [esp + 0x24], ebx
jmp 0x1003d699
mov dword [esp + 0x20], 0x2e5664dc
mov dword [esp + 0x38], ebx
mov dword [esp + 0x20], edx
cmp dword [esp + 0x20], ebx
jl 0x1003d695
mov dword [esp + 0x14], edx
mov dword [esp + 0x28], 0x1ebe
cmp dword [esp + 0x28], 0xe7f
jge 0x1003d588
lea eax, [esp + 0x60]
push eax
push 0x1000b220
call fcn.100527da
xor edi, edi
mov esi, ebx
pop ecx
inc edi
mov edx, edi
pop ecx
mov ecx, ebx
cmp dword [esp + 0x60], edi
jle 0x1003d570
mov eax, edx
mov esi, ecx
add edx, ecx
mov ecx, eax
cmp edx, dword [esp + 0x60]
jl 0x1003d55e
cmp dword [esp + 0x60], edi
push esi
cmove ecx, edi
push esi
sub ecx, esi
push ecx
push 0x1000b42c
call fcn.10052b7f
xor edx, edx
add esp, 0x10
inc edx
mov dword [esp + 0x28], edx
mov dword [esp + 0x14], ebx
jmp 0x1003d681
mov dword [esp + 0x28], 0xd7276cc7
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x80]
mov eax, dword [eax + ecx*4]
mov dword [esp + 0x38], eax
cmp dword [esp + 0x38], ebx
je 0x1003d653
cmp dword [esp + 0x24], ebx
je 0x1003d5c7
mov eax, edx
cmp dword [esp + 0x14], ebx
jne 0x1003d5c9
mov eax, ebx
mov dword [esp + 0x28], eax
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x80]
mov eax, dword [esp + 0x28]
add eax, dword [ecx + edx*4]
je 0x1003d5ee
cmp dword [esp + 0x24], ebx
je 0x1003d5ee
xor esi, esi
inc esi
mov eax, esi
jmp 0x1003d5f3
xor esi, esi
mov eax, ebx
inc esi
mov ecx, 0xb6d64bda
cmp ecx, eax
sbb edx, edx
xor ecx, ecx
neg edx
imul edx, dword [esp + 0x24]
add edx, dword [esp + 0x38]
mov eax, dword [esp + 0x80]
imul edx, dword [eax]
mov eax, dword [esp + 0x24]
cmp eax, 0xff12
setle cl
cmp ecx, edx
je 0x1003d62b
mov eax, esi
cmp dword [esp + 0x1c], ebx
jne 0x1003d62d
mov eax, ebx
mov ecx, dword [esp + 0x80]
xor edx, edx
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
push 5
cmp eax, dword [ecx + 4]
pop eax
setg dl
cmp eax, edx
sbb eax, eax
neg eax
mov dword [esp + 0x28], eax
jne 0x1003d655
mov esi, ebx
mov ecx, dword [esp + 0x24]
xor edx, edx
mov eax, dword [esp + 0x80]
cmp dword [eax + ecx*4], esi
setl dl
mov dword [esp + 0x28], edx
mov eax, dword [esp + 0x28]
neg eax
sbb eax, eax
xor edx, edx
neg eax
mov dword [esp + 0x38], eax
inc dword [esp + 0x14]
inc edx
cmp dword [esp + 0x14], edx
jle 0x1003d595
dec dword [esp + 0x20]
jns 0x1003d528
inc dword [esp + 0x24]
cmp dword [esp + 0x24], edx
jle 0x1003d50e
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1003d6cd
push 0x2256
push ebx
push 0x1d1f
push ebx
push 0x603
push 0x16d6
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor edx, edx
inc edx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edx
jle 0x1003d4f5
mov eax, dword [esp + 0x1c]
xor ecx, ecx
mov edx, dword [esp + 0x80]
cmp dword [edx + 4], eax
setle cl
add ecx, 0xf45d821e
neg ecx
sbb ecx, ecx
inc ecx
mov dword [esp + 0x28], ecx
mov eax, dword [esp + 0x28]
mov eax, dword [edx + 4]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x18], ebx
mov eax, dword [esp + 0x18]
mov eax, dword [edx + 4]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x80]
mov eax, dword [eax]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x1c], ebx
je 0x1003d9b0
mov dword [esp + 0x28], 0x1628
cmp dword [esp + 0x28], 0xf88
jge 0x1003d987
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0x1ec]
push eax
push 0x1000b23c
call fcn.100527da
add esp, 0xc
mov dword [esp + 0xf0], ebx
lea eax, [esp + 0xf0]
mov dword [esp + 0x8c], ebx
lea ecx, [esp + 0x8c]
mov dword [esp + 0x90], ebx
mov dword [esp + 0x94], ebx
push eax
push 2
call fcn.100300db
mov byte [esp + 0x4a4], 0xc
lea eax, [esp + 0x8c]
push eax
push dword [esp + 0x50]
lea ecx, [esp + 0xc8]
mov dword [esp + 0xc8], ebx
mov dword [esp + 0xcc], ebx
mov dword [esp + 0xd0], ebx
call fcn.1003ea04
mov byte [esp + 0x4a4], 0xe
cmp dword [esp + 0x8c], 0
je 0x1003d80d
push dword [esp + 0x8c]
call fcn.10050c17
pop ecx
mov dword [esp + 0x8c], ebx
mov dword [esp + 0x90], ebx
mov dword [esp + 0x94], ebx
mov edi, ebx
cmp dword [esp + 0x4c], edi
jle 0x1003d83a
mov esi, dword [esp + 0xc0]
mov ecx, dword [esi]
lea eax, [ecx + 4]
push eax
push ecx
push 0x1000b23c
call fcn.100527da
add esp, 0xc
lea esi, [esi + 0xc]
inc edi
cmp edi, dword [esp + 0x4c]
jl 0x1003d81c
mov esi, ebx
mov dword [esp + 0x28], ebx
mov eax, dword [esp + 0xc0]
mov edi, ebx
mov eax, dword [eax]
mov eax, dword [esi + eax]
or dword [esp + 0x70], 0xffffffff
mov dword [esp + 0x20], eax
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
call fcn.1003064f
mov dword [esp + 0x50], eax
xor eax, eax
mov byte [esp + 0x4a4], 0xf
inc eax
cmp dword [esp + 0x4c], eax
jle 0x1003d91f
mov esi, dword [esp + 0xc0]
mov ebx, eax
mov ecx, dword [esp + 0x20]
add esi, 0xc
mov eax, dword [esi]
cmp dword [eax], ecx
je 0x1003d90b
cmp dword [eax + 4], ecx
je 0x1003d90b
push eax
lea ecx, [esp + 0x54]
inc edi
call fcn.1002fd70
lea ecx, [esp + 0x50]
inc dword [eax]
mov eax, dword [esi]
add eax, 4
push eax
call fcn.1002fd70
lea ecx, [esp + 0x50]
inc dword [eax]
push dword [esi]
call fcn.1002fd70
cmp dword [eax], edi
jge 0x1003d8d8
mov eax, dword [esi]
lea ecx, [esp + 0x50]
add eax, 4
push eax
call fcn.1002fd70
cmp dword [eax], edi
jl 0x1003d919
push dword [esi]
lea ecx, [esp + 0x54]
call fcn.1002fd70
cmp dword [eax], edi
mov eax, dword [esi]
jne 0x1003d8ed
mov eax, dword [eax]
jmp 0x1003d903
add eax, 4
lea ecx, [esp + 0x50]
push eax
call fcn.1002fd70
cmp dword [eax], edi
jne 0x1003d907
mov eax, dword [esi]
mov eax, dword [eax + 4]
mov dword [esp + 0x70], eax
mov ecx, dword [esp + 0x20]
inc ebx
add esi, 0xc
cmp ebx, dword [esp + 0x4c]
jl 0x1003d88d
mov esi, dword [esp + 0x28]
xor ebx, ebx
lea eax, [esp + 0x70]
push eax
lea ecx, [esp + 0x54]
call fcn.1002fd70
lea ecx, [esp + 0x50]
cmp dword [eax], edi
sete al
mov byte [esp + 0x13], al
test al, al
jne 0x1003d95d
mov byte [esp + 0x4a4], 0xe
call fcn.10013627
add esi, 4
mov dword [esp + 0x28], esi
cmp esi, 4
jle 0x1003d840
jmp 0x1003d962
call fcn.10013627
cmp byte [esp + 0x13], 0
mov ecx, 0x1000b2b0
mov eax, 0x1000b2ac
cmove eax, ecx
push eax
call fcn.10052df3
pop ecx
lea ecx, [esp + 0xc0]
call fcn.10030117
xor esi, esi
inc esi
mov dword [esp + 0x28], esi
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1003d9a6
push 0xf5f
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov eax, dword [esp + 0x28]
mov dword [esp + 0x28], eax
jmp 0x1003d9d2
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], al
je 0x1003d9cf
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RectVisible]
xor esi, esi
inc esi
or dword [esp + 0x4a4], 0xffffffff
lea ecx, [esp + 0x80]
call fcn.1000d97d
mov edi, dword [esp + 0x34]
test edi, edi
jne 0x1003e14f
cmp dword [esp + 0xe0], edi
jle 0x1003e14f
mov dword [esp + 0x28], 0xfffffffb
lea ecx, [esp + 0x1a8]
mov dword [esp + 0x34], esi
mov dword [esp + 0x20], 0x266d
mov dword [esp + 0x40], 0x9bca7b5c
mov dword [esp + 0x40], 0xffffffff
push 3
call fcn.1000d3e3
mov dword [esp + 0x40], esi
mov dword [esp + 0x14], ebx
jmp 0x1003da4d
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1a8]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x1003da3b
cmp dword [esp + 0x28], ebx
jne 0x1003da8d
mov dword [esp + 0x34], 0x8f0a
cmp dword [esp + 0x34], ebx
je 0x1003da83
cmp dword [esp + 0x28], ebx
je 0x1003da83
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x34]
inc eax
mov eax, esi
jne 0x1003da85
mov eax, ebx
cmp eax, dword [esp + 0x20]
mov eax, ebx
jg 0x1003da8f
mov eax, esi
mov dword [esp + 0x40], eax
mov ecx, dword [esp + 0x40]
sub ecx, 0xfffffffc
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0xffffffff
setge al
mov dword [esp + 0x40], eax
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x1a8]
mov dword [eax + 4], ecx
mov dword [esp + 0x40], ecx
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1003dadb
push ebx
push 0xd2d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetScrollInfo]
lea ecx, [esp + 0x1a8]
call fcn.1000d97d
mov dword [esp + 0x28], 0xb3c692be
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1003db0f
push 0x1312
push 0x96f
push 0x9ca
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1003db20
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov dword [esp + 0x28], 0x42a4
lea ecx, [esp + 0x128]
mov dword [esp + 0x20], 0xcbad86e5
mov dword [esp + 0x34], 0xfffffffd
push esi
call fcn.1000d3e3
mov dword [esp + 0x40], 0xa56718e5
mov dword [esp + 0x40], esi
mov dword [esp + 0x14], ebx
jmp 0x1003db69
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x128]
mov dword [eax + ecx*4], esi
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x1003db57
mov eax, dword [esp + 0x20]
xor edx, edx
mov dword [esp + 0x34], 0xffffe275
mov ecx, dword [esp + 0x20]
add ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x128]
cmp ecx, dword [eax]
mov eax, dword [esp + 0x34]
setne dl
add eax, edx
cmp eax, dword [esp + 0x20]
jne 0x1003dba3
cmp dword [esp + 0x34], ebx
je 0x1003dbab
mov edx, esi
cmp dword [esp + 0x28], ebx
jne 0x1003dbad
mov edx, ebx
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x128]
sub ecx, edx
neg ecx
sbb ecx, ecx
mov eax, dword [eax]
inc ecx
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
add ecx, eax
mov dword [esp + 0x40], ecx
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1003dbf0
push 0x19b7
push 0xab9
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CheckDlgButton]
lea ecx, [esp + 0x128]
call fcn.1000d97d
cmp dword [esp + 0xe4], 0
je 0x1003e14f
mov dword [esp + 0x18], 0xfffffffb
mov dword [esp + 0x34], 2
mov dword [esp + 0x14], ebx
jmp 0x1003dc30
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x48], 0x57fd
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x1003dc20
mov dword [esp + 0x18], ebx
cmp dword [esp + 0x18], ebx
jl 0x1003ddb0
mov dword [esp + 0x14], esi
mov dword [esp + 0x28], 0x7bc41bbb
mov dword [esp + 0x28], 0x1f15
cmp dword [esp + 0x28], 0x5fc
jge 0x1003dce8
lea eax, [esp + 0x5c]
push eax
push 0x1000b220
call fcn.100527da
jmp 0x1003dcd9
dec eax
mov dword [esp + 0x5c], eax
lea eax, [esp + 0x118]
push eax
lea eax, [esp + 0xd0]
push eax
push 0x1000b23c
call fcn.100527da
mov eax, dword [esp + 0x124]
add esp, 0xc
mov ecx, dword [esp + 0xcc]
cmp eax, ecx
jle 0x1003dcaf
sub eax, ecx
jmp 0x1003dcce
sub ecx, eax
mov eax, ecx
and eax, 0x80000001
jns 0x1003dcbf
dec eax
or eax, 0xfffffffe
inc eax
add eax, 2
and eax, 0x80000001
jns 0x1003dcce
dec eax
or eax, 0xfffffffe
inc eax
push eax
push 0x1000b248
call fcn.10052b7f
mov eax, dword [esp + 0x64]
pop ecx
pop ecx
test eax, eax
jne 0x1003dc77
dec eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x14], ebx
jmp 0x1003dd01
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x188], 0xffffffff
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x1003dcee
mov eax, dword [esp + 0x18]
cmp dword [esp + eax*4 + 0x48], ebx
je 0x1003dd90
mov eax, dword [esp + 0x18]
xor edx, edx
mov eax, dword [esp + eax*4 + 0x48]
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
cmp ecx, eax
setl dl
mov dword [esp + 0x14], edx
cmp dword [esp + 0x14], ebx
je 0x1003dd3b
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x18c]
mov eax, dword [esp + 0x48]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
cmp eax, dword [esp + 0x18]
jg 0x1003dd5c
mov eax, dword [esp + 0x18]
mov eax, dword [esp + eax*4 + 0x48]
mov eax, dword [esp + 0x48]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x18c]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + eax*4 + 0x48]
neg eax
cmp eax, 0x3279329b
jle 0x1003dd86
cmp dword [esp + 0x48], ebx
je 0x1003dd90
cmp dword [esp + 0x14], ebx
je 0x1003dd90
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x18]
xor ecx, ecx
mov eax, dword [esp + eax*4 + 0x48]
cmp eax, esi
sete cl
sub ecx, 8
mov dword [esp + 0x28], ecx
dec dword [esp + 0x18]
jns 0x1003dc44
mov ecx, dword [esp + 0xe4]
call fcn.1003c43e
push 3
pop esi
mov edi, eax
mov dword [esp + 0x18], 0x34fd
mov dword [esp + 0x24], 2
lea ecx, [esp + 0x14c]
mov dword [esp + 0x14], 0xa1e94870
push esi
mov dword [esp + 0x38], edi
call fcn.1000d3e3
mov dword [esp + 0x4a4], 0x10
mov dword [esp + 0x1c], ebx
jmp 0x1003de11
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14c]
mov dword [eax + ecx*4], 7
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], esi
jl 0x1003ddfb
mov dword [esp + 0x1c], ebx
jmp 0x1003de30
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x22c], 0xfffffffa
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], esi
jl 0x1003de1d
mov dword [esp + 0x1c], ebx
jmp 0x1003de4f
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x238], 0xfffffff7
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jl 0x1003de3c
mov dword [esp + 0x18], 0xeca4f833
xor edx, edx
mov dword [esp + 0x24], 0xfffffffd
mov eax, dword [esp + 0x24]
mov esi, dword [esp + 0x14c]
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
cmp eax, ecx
mov dword [esp + 0x40], esi
setle dl
mov dword [esi + 4], edx
mov dword [esp + 0x28], 0x180e
cmp dword [esp + 0x28], 0x121e
jge 0x1003df7b
lea eax, [esp + 0xb0]
push eax
push ecx
lea eax, [esp + 0x10c]
mov ecx, 0x1065b710
push eax
call fcn.1000d0c9
pop ecx
mov ecx, eax
call fcn.1000d0c9
mov esi, dword [esp + 0x104]
mov ecx, 0x108d80dc
push esi
call fcn.1000d467
mov edi, ebx
test esi, esi
jle 0x1003def4
mov eax, dword [0x108d80dc]
mov ecx, 0x1065b710
lea eax, [eax + edi*4]
push eax
call fcn.1000d0c9
inc edi
cmp edi, esi
jl 0x1003dedc
push dword [0x108d80e0]
push dword [0x108d80dc]
call fcn.100109f0
pop ecx
pop ecx
lea eax, [esp + 0xbc]
mov ecx, 0x1065b710
push eax
call fcn.1000d0c9
mov eax, dword [esp + 0xbc]
mov ecx, ebx
mov edx, ebx
cmp eax, esi
jg 0x1003df3c
test eax, eax
jle 0x1003df61
mov esi, dword [0x108d80dc]
add ecx, dword [esi + edx*4]
inc edx
cmp edx, eax
jl 0x1003df32
jmp 0x1003df61
test esi, esi
jle 0x1003df57
mov edi, dword [0x108d80dc]
sub eax, esi
mov dword [esp + 0xbc], eax
add ecx, dword [edi + edx*4]
inc edx
cmp edx, esi
jl 0x1003df4f
imul eax, dword [esp + 0xb0]
sub ecx, eax
push ecx
mov ecx, 0x1065b658
call fcn.1000d2c4
push eax
call fcn.10010bca
mov esi, dword [esp + 0x44]
mov edi, dword [esp + 0x38]
pop ecx
xor eax, eax
inc eax
mov dword [esp + 0x24], eax
cmp dword [esp + 0x24], 0xfffffff3
jle 0x1003e12f
xor edi, edi
inc edi
mov dword [esp + 0x20], 0x31e13ca4
mov dword [esp + 0x28], edi
mov dword [esp + 0x38], 0xffffffff
mov dword [esp + 0x18], ebx
jmp 0x1003e0e9
mov dword [esp + 0x1c], 0xb051af7f
xor ecx, ecx
mov dword [esp + 0x40], 3
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
sub edx, eax
mov eax, dword [esp + 0x1c]
cmp edx, eax
mov dword [esi + 4], edx
setle cl
add ecx, dword [esp + 0x14]
je 0x1003dfe7
mov edx, edi
cmp dword [esp + 0x24], ebx
jne 0x1003dfe9
mov edx, ebx
mov eax, dword [esp + 0x14]
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [esp + 0x40], ecx
mov eax, dword [esp + 0x40]
add eax, 0x4faf
je 0x1003e007
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
sub eax, dword [esp + 0x20]
sub eax, dword [esp + 0x14]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x20]
add eax, dword [esp + 0x14]
neg eax
sbb eax, eax
neg eax
add eax, dword [esp + 0x1c]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x38]
je 0x1003e0d5
mov dword [esp + 0x14], 0xffffffff
cmp dword [esp + 0x1c], ebx
je 0x1003e07c
mov eax, dword [esp + 0x18]
xor ecx, ecx
mov eax, dword [esp + 0x14]
mov edx, ebx
mov eax, dword [esp + 0x18]
cmp eax, edi
setl cl
mov dword [esp + 0x38], ecx
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x40]
jmp 0x1003e07e
mov edx, edi
mov eax, dword [esp + 0x14]
xor ecx, ecx
cmp eax, edx
mov eax, dword [esp + 0x28]
setne cl
cmp ecx, 0xfff8
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [esp + 0x14c]
setle dl
xor ecx, ecx
mov dword [eax + 8], edx
mov eax, dword [esp + 0x230]
sub eax, edx
cmp eax, 0x230b56bf
setl cl
xor edx, edx
cmp ecx, 0xfffffffb
setne dl
xor eax, eax
inc edx
cmp edx, 0x3e85184b
setl al
mov dword [esp + 0x14], eax
jmp 0x1003e0e5
mov dword [esp + 0x28], edi
mov dword [esp + 0x28], 4
inc dword [esp + 0x28]
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0x29
jle 0x1003dfad
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1003e11c
push 0x13fc
push 0xf8c
push 0x1f02
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push ebx
call dword [sym.imp.USER32.dll_PeekMessageA]
dec dword [esp + 0x24]
cmp dword [esp + 0x24], 0xfffffff3
jg 0x1003df90
mov edi, dword [esp + 0x34]
or dword [esp + 0x4a4], 0xffffffff
lea ecx, [esp + 0x14c]
call fcn.1000d97d
lea eax, [esp + 0x58]
push eax
call fcn.1003e5a8
mov dword [eax], edi
lea ecx, [esp + 0xe0]
call fcn.10038842
xor esi, esi
lea ecx, [esp + 0x1d0]
inc esi
mov dword [esp + 0x18], esi
push 2
call fcn.1000d3e3
push 2
mov dword [esp + 0x24], ebx
pop edx
jmp 0x1003e18b
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x1d0]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edx
jl 0x1003e179
mov dword [esp + 0x18], ebx
jmp 0x1003e1a1
cmp dword [esp + 0x18], ebx
jne 0x1003e1a7
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edx
je 0x1003e197
mov dword [esp + 0x18], ebx
jmp 0x1003e204
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1003e200
push ebx
push 0x600
push 0x26e6
push 0xaaa
push 0x633
push 0xdb6
push 0xb0b
push 0x1ee7
push 0x1f2f
push 0x1372
push 0x43f
push 0x235f
push 0x229
push 0x26da
call dword [sym.imp.GDI32.dll_CreateFontA]
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jle 0x1003e1ad
lea ecx, [esp + 0x1d0]
call fcn.1000d97d
test edi, edi
je 0x1003e331
mov dword [esp + 0x14], 0x13dd33a4
mov dword [esp + 0x20], ebx
jmp 0x1003e23b
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x1c0], esi
inc dword [esp + 0x20]
cmp dword [esp + 0x20], esi
jl 0x1003e22c
mov dword [esp + 0x14], 0xffffffef
jmp 0x1003e287
mov dword [esp + 0x20], 0x8c9f3690
mov dword [esp + 0x20], ebx
jmp 0x1003e27d
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1003e279
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
inc dword [esp + 0x20]
cmp dword [esp + 0x20], ebx
jle 0x1003e259
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0x19
jne 0x1003e24b
mov edx, dword [esp + 0x3c]
mov ecx, edi
call fcn.1003c480
xor edi, edi
mov dword [esp + 0x20], 0xfffffffa
inc edi
mov dword [esp + 0x3c], ebx
mov esi, eax
mov dword [esp + 0x3c], edi
push edi
lea ecx, [esp + 0x1c8]
mov dword [esp + 0xd4], esi
call fcn.1000d3e3
mov dword [esp + 0x3c], 0x12f3ccd2
mov dword [esp + 0x20], ebx
jmp 0x1003e2e6
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c4]
mov dword [eax + ecx*4], 0xfffffff8
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edi
jl 0x1003e2d0
mov dword [esp + 0x20], ebx
jmp 0x1003e308
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1003e304
push ebx
call dword [sym.imp.GDI32.dll_DeleteObject]
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 0x1a
jg 0x1003e2f2
inc dword [esp + 0x3c]
lea ecx, [esp + 0x1c4]
call fcn.1000d97d
lea eax, [esp + 0x9c]
push eax
call fcn.1003e546
mov dword [eax], esi
xor esi, esi
inc esi
mov dword [esp + 0x28], 0xe871
mov dword [esp + 0x40], 0xe7ed6f18
mov dword [esp + 0x34], esi
mov dword [esp + 0x3c], 0x60d2f38
mov dword [esp + 0x3c], esi
mov eax, dword [esp + 0x40]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x28]
cmp dword [esp + 0x28], 0xffffffff
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, esi
setge cl
sub ecx, dword [esp + 0x34]
mov dword [esp + 0x3c], ecx
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x40]
mov eax, dword [esp + 0x40]
mov dword [esp + 0x3c], esi
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1003e39e
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndDialog]
mov eax, dword [ebp + 8]
lea esi, [esp + 0xd0]
mov ecx, dword [esp + 0x49c]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret