Function at 0x1001c728
Capabilities:
Access peb ldr_data
Check os version
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10088d46
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x178
push ebx
mov dword [esp + 0x38], edx
xor ebx, ebx
mov dword [esp + 8], 0xfffffffa
mov dword [esp + 0x18], 0xfb5d1cb6
push esi
mov dword [esp + 0xc], ebx
mov esi, ecx
cmp dword [esp + 0xc], 0xe
push edi
mov edi, dword [sym.imp.GDI32.dll_RectInRegion]
mov dword [esp + 0x30], esi
jle 0x1001c96a
push 2
lea ecx, [esp + 0x70]
call fcn.10019cd8
mov dword [esp + 0x18c], ebx
lea eax, [esp + 0x150]
push dword [esp + 0x44]
movdqa xmm0, xmmword [0x1000a900]
lea ecx, [esp + 0x64]
push eax
lea eax, [esp + 0x148]
mov dword [esp + 0x14], ebx
push eax
push ebx
movdqu xmmword [esp + 0x150], xmm0
mov dword [esp + 0x70], ebx
mov dword [esp + 0x74], ebx
mov dword [esp + 0x78], ebx
call fcn.1001b412
mov byte [esp + 0x18c], 1
mov dword [esp + 0x14], 0xffff
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0xc], ebx
jmp 0x1001c7fb
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x6c]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x1001c7ec
mov dword [esp + 0xc], ebx
jmp 0x1001c817
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x104], ebx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x1001c808
mov dword [esp + 0xc], ebx
cmp dword [esp + 0xc], 1
jg 0x1001c93d
mov esi, dword [esp + 0x60]
mov dword [esp + 0x2c], esi
push dword [esp + 0x44]
movdqa xmm0, xmmword [0x1000a8f0]
lea eax, [esp + 0x174]
push eax
lea eax, [esp + 0x168]
mov dword [esp + 0x2c], 0xb4709ba8
push eax
push ebx
lea ecx, [esp + 0x64]
mov dword [esp + 0x64], ebx
movdqu xmmword [esp + 0x170], xmm0
mov dword [esp + 0x68], ebx
mov dword [esp + 0x6c], ebx
call fcn.1001b412
dec dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x20]
imul ecx, dword [esi + 0xc]
mov eax, dword [esp + 0x54]
add ecx, 0xffff
mov dword [eax + 8], ecx
mov eax, dword [esp + 0xc]
mov esi, dword [esp + 0xc]
xor eax, eax
cmp ecx, 0xf4d4e20
setl al
xor edx, edx
test eax, eax
setg dl
neg edx
sub edx, dword [esp + 0x108]
mov eax, dword [esp + 0x6c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp dword [eax + esi*4], edx
setge cl
cmp ecx, dword [esp + 0x108]
je 0x1001c8f0
cmp dword [esp + 0x24], ebx
jne 0x1001c8f0
mov esi, ebx
jmp 0x1001c8f3
xor esi, esi
inc esi
mov ecx, dword [esp + 0xc]
xor edx, edx
mov eax, dword [esp + 0x6c]
cmp esi, dword [eax + ecx*4]
setne dl
imul eax, edx, 0x6658
sub eax, 0x25e9e388
mov dword [esp + 0x24], eax
mov byte [esp + 0x1f], bl
cmp byte [esp + 0x1f], 0
je 0x1001c921
push ebx
push ebx
call edi
lea ecx, [esp + 0x54]
call fcn.1001a5b6
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 1
mov esi, dword [esp + 0x2c]
jle 0x1001c835
lea ecx, [esp + 0x60]
call fcn.1001a5b6
or dword [esp + 0x18c], 0xffffffff
lea ecx, [esp + 0x6c]
call fcn.1001a5b6
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0xe
jg 0x1001c77d
mov esi, dword [esp + 0x30]
mov byte [esp + 0x1f], bl
cmp byte [esp + 0x1f], 0
je 0x1001c979
push ebx
push ebx
call edi
cmp dword [esi + 0x10], ebx
jne 0x1001c985
xor al, al
jmp 0x1001d480
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0xc], 0xfffffffa
mov dword [esp + 0x10], 0xfffffffe
mov dword [esp + 0x20], 0xfff9
mov dword [esp + 0x2c], 1
mov dword [esp + 0x14], 0xffffffe8
jmp 0x1001ca5b
mov dword [esp + 0x20], 0x6d03
cmp dword [esp + 0x14], ebx
je 0x1001c9cc
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0xc]
xor edx, edx
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
cmp ecx, eax
setg dl
imul eax, edx, 0xc7eb
cmp eax, 0x589d3895
jg 0x1001c9fa
cmp dword [esp + 0x20], ebx
jne 0x1001ca04
cmp dword [esp + 0xc], ebx
jne 0x1001ca04
mov edx, ebx
jmp 0x1001ca07
xor edx, edx
inc edx
mov eax, dword [esp + 0x10]
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0xc]
setle cl
xor edx, edx
cmp ecx, eax
setg dl
sub edx, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
add ecx, dword [esp + 0x20]
cmp ecx, 1
ja 0x1001ca4a
cmp dword [esp + 0x14], ebx
jne 0x1001ca4a
cmp dword [esp + 0xc], ebx
jne 0x1001ca4a
mov ecx, ebx
jmp 0x1001ca4d
xor ecx, ecx
inc ecx
mov eax, dword [esp + 0x20]
add eax, ecx
mov dword [esp + 0x20], eax
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0xa
jg 0x1001c9ba
mov dword [esp + 0xc], 0xf
jmp 0x1001cb26
push 3
lea ecx, [esp + 0xa0]
call fcn.10019cd8
mov dword [esp + 0x10], ebx
jmp 0x1001ca99
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x9c]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x1001ca87
mov dword [esp + 0x20], ebx
jmp 0x1001cb0f
mov dword [esp + 0x24], 0xe188a746
mov dword [esp + 0x10], 2
cmp dword [esp + 0x10], ebx
jl 0x1001cb0b
mov dword [esp + 0x18], 0xafeddd8d
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x9c]
cmp dword [eax + ecx*4], 0x9f0
je 0x1001caff
cmp dword [esp + 0x2c], ebx
je 0x1001caff
xor eax, eax
inc eax
jmp 0x1001cb01
mov eax, ebx
mov dword [esp + 0x18], eax
dec dword [esp + 0x10]
jns 0x1001cabc
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 0x23
je 0x1001caa6
lea ecx, [esp + 0x9c]
call fcn.1001a5b6
dec dword [esp + 0xc]
cmp dword [esp + 0xc], 7
jne 0x1001ca73
mov dword [esp + 0x10], 0x5baf43b
push 4
mov dword [esp + 0x1c], 0xfffffff6
mov dword [esp + 0x18], ebx
pop edi
jmp 0x1001cb59
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x170], ebx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x1001cb4a
inc dword [esp + 0x10]
xor ecx, ecx
push 3
mov dword [esp + 0x14], ebx
inc ecx
pop eax
cmp dword [esp + 0x10], eax
jg 0x1001cb7d
mov dword [esp + 0x18], ecx
inc dword [esp + 0x10]
jmp 0x1001cb6d
mov dword [esp + 0x14], ecx
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x24], eax
mov eax, 0x9efededc
mov dword [esp + 0x18], ebx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0xcc], eax
mov dword [esp + 0xd0], eax
mov dword [esp + 0xd4], eax
mov dword [esp + 0xd8], eax
mov dword [esp + 0x2c], 0x688cdf2a
mov dword [esp + 0x10], ebx
jmp 0x1001cbd4
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x34], 0xa42b4837
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ecx
jl 0x1001cbc4
cmp dword [esp + 0x14], 6
je 0x1001cc41
cmp dword [esp + 0x14], ebx
je 0x1001cc13
mov ecx, dword [esp + 0x34]
xor edx, edx
mov eax, dword [esp + 0x14]
cmp eax, ecx
setl dl
cmp edx, dword [esp + 0x34]
jl 0x1001cc00
mov eax, dword [esp + 0x34]
xor ecx, ecx
inc ecx
cmp dword [esp + 0x14], ecx
je 0x1001cc0f
cmp dword [esp + 0x34], ebx
je 0x1001cc13
mov edx, ecx
jmp 0x1001cc15
mov edx, ebx
mov eax, dword [esp + 0x34]
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x20]
setne cl
imul eax, ecx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x18]
imul eax, dword [esp + 0x24]
dec dword [esp + 0x20]
test eax, eax
je 0x1001cc41
xor ecx, ecx
inc ecx
jmp 0x1001cc43
mov ecx, ebx
mov dword [esp + 0x34], ecx
mov eax, dword [esp + 0x14]
imul eax, ecx
xor ecx, ecx
push 1
cmp eax, 0xfff0698
setl cl
mov dword [esp + 0x30], ecx
lea ecx, [esp + 0xe0]
mov eax, dword [esp + 0x38]
mov dword [esp + 0xd0], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x14], 0xf6af1124
mov dword [esp + 0x1c], 0xfddd3f46
call fcn.10019cd8
xor edx, edx
mov dword [esp + 0x18c], 2
mov dword [esp + 0x10], ebx
inc edx
jmp 0x1001ccaf
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xdc]
mov dword [eax + ecx*4], edx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x1001cc9d
mov dword [esp + 0x10], ebx
jmp 0x1001cdc5
mov dword [esp + 0x18], 0xfffffff7
lea ecx, [esp + 0x128]
mov dword [esp + 0x18], 0xfffffff6
mov dword [esp + 0x18], 0x4800fa7
mov dword [esp + 0x18], edx
mov dword [esp + 0x18], edx
mov dword [esp + 0x18], 0x3773672
mov dword [esp + 0x18], 0x1a4e6659
mov dword [esp + 0x18], 0x5b6478c3
mov dword [esp + 0x18], 0xfffffffe
mov dword [esp + 0x18], 0xffffffff
push edi
call fcn.10019cd8
push 2
lea ecx, [esp + 0xac]
mov byte [esp + 0x190], 3
call fcn.10019cd8
mov dword [esp + 0xc], ebx
jmp 0x1001cd45
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x128]
mov dword [eax + ecx*4], 0x68cd546
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x1001cd2f
mov dword [esp + 0xc], ebx
jmp 0x1001cd67
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0xa8]
mov dword [eax + ecx*4], 0x47cd
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x1001cd51
mov dword [esp + 0xc], ebx
jmp 0x1001cd87
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x150], 0x92e6c0b3
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x1001cd74
mov eax, dword [esp + 0xa8]
lea ecx, [esp + 0xa8]
dec dword [eax + 4]
inc dword [esp + 0x158]
call fcn.1001a5b6
lea ecx, [esp + 0x128]
mov byte [esp + 0x18c], 2
call fcn.1001a5b6
dec dword [esp + 0x10]
push 1
pop edx
cmp dword [esp + 0x10], 0xfffffff6
jne 0x1001ccbe
or dword [esp + 0x18c], 0xffffffff
lea ecx, [esp + 0xdc]
call fcn.1001a5b6
mov eax, dword [esp + 0x40]
lea ecx, [esp + 0x11c]
push 1
mov dword [eax], ebx
mov dword [esp + 0x18], 0xffffffff
call fcn.10019cd8
mov dword [esp + 0x10], ebx
jmp 0x1001ce1c
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x11c]
mov dword [eax + ecx*4], 0x9b2cfb63
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 1
jl 0x1001ce06
mov dword [esp + 0x14], ebx
jmp 0x1001ce5e
mov dword [esp + 0x10], 0x10b999fb
mov dword [esp + 0x10], ebx
jmp 0x1001ce54
mov byte [esp + 0x1f], bl
cmp byte [esp + 0x1f], 0
je 0x1001ce50
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ValidateRect]
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ebx
jle 0x1001ce37
dec dword [esp + 0x14]
cmp dword [esp + 0x14], 0xffffffe8
jle 0x1001ce29
lea ecx, [esp + 0x11c]
call fcn.1001a5b6
xor eax, eax
mov dword [esp + 0x18], 0xfffffffb
inc eax
mov dword [esp + 0x18], 0xe1e87df2
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x134]
mov dword [esp + 0x18], ebx
push eax
call fcn.10019cd8
push 3
lea ecx, [esp + 0x114]
mov dword [esp + 0x190], edi
call fcn.10019cd8
mov byte [esp + 0x18c], 5
xor edx, edx
mov dword [esp + 0x24], 0x57f39cee
inc edx
mov dword [esp + 0x18], 0x4af7
mov dword [esp + 0x28], ebx
jmp 0x1001cee2
mov eax, dword [esp + 0x28]
mov dword [esp + eax*4 + 0x100], 0xfffffff6
inc dword [esp + 0x28]
cmp dword [esp + 0x28], edx
jl 0x1001cecf
mov dword [esp + 0x28], ebx
jmp 0x1001cf00
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x134]
mov dword [eax + ecx*4], edx
inc dword [esp + 0x28]
cmp dword [esp + 0x28], edx
jl 0x1001ceee
lea eax, [esp + 0x28]
push eax
push 0x6020
lea eax, [esp + 0x118]
push ebx
push eax
call fcn.1001fc0b
push 0x5bdd
lea eax, [esp + 0x4f]
mov byte [esp + 0x4f], bl
push eax
push 0x76ee
push ebx
call fcn.1001d64c
add esp, 0x20
lea ecx, [esp + 0x110]
dec dword [esp + 0x24]
call fcn.1001a5b6
or dword [esp + 0x18c], 0xffffffff
lea ecx, [esp + 0x134]
call fcn.1001a5b6
mov dword [esp + 0x14], ebx
lea ecx, [esp + 0xb4]
xor eax, eax
mov dword [esp + 0x18], ebx
inc eax
mov dword [esp + 0x18], 3
mov dword [esp + 0x18], ebx
mov dword [esp + 0x18], eax
push eax
call fcn.10019cd8
mov dword [esp + 0x18c], 6
mov dword [esp + 0x10], ebx
jmp 0x1001cfa9
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xb4]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 1
jl 0x1001cf97
mov dword [esp + 0x14], ebx
jmp 0x1001d03f
mov dword [esp + 0x20], 1
lea ecx, [esp + 0xe8]
mov dword [esp + 0x18], 0x289a695
mov dword [esp + 0x18], 0x50b5f0b1
push 1
call fcn.10019cd8
mov dword [esp + 0x10], ebx
jmp 0x1001cffb
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xe8]
mov dword [eax + ecx*4], 0x4b64b5c6
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 1
jl 0x1001cfe5
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp eax, ecx
mov eax, dword [esp + 0x20]
setg dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [esp + 0xb4]
setg cl
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0xe8]
inc dword [eax]
call fcn.1001a5b6
dec dword [esp + 0x14]
cmp dword [esp + 0x14], 0xfffffff7
jge 0x1001cfb9
or dword [esp + 0x18c], 0xffffffff
lea ecx, [esp + 0xb4]
call fcn.1001a5b6
cmp dword [esi + 0x14], 0x10
jb 0x1001d068
mov ecx, dword [esi]
jmp 0x1001d06a
mov ecx, esi
cmp dword [esi + 0x14], 0x10
mov dword [esp + 0x3c], ecx
jb 0x1001d078
mov edx, dword [esi]
jmp 0x1001d07a
mov edx, esi
mov eax, dword [esi + 0x10]
add eax, edx
cmp ecx, eax
je 0x1001d47e
xor eax, eax
mov dword [esp + 0x18], 0x76b0f738
inc eax
lea ecx, [esp + 0xf4]
mov dword [esp + 0x18], eax
mov dword [esp + 0x18], eax
push 3
call fcn.10019cd8
mov dword [esp + 0x18c], 7
xor edi, edi
mov dword [esp + 0x18], 0xfffffffd
inc edi
mov dword [esp + 0x44], edi
mov dword [esp + 0x10], ebx
jmp 0x1001d0de
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xf4]
mov dword [eax + ecx*4], 0xfe04822b
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x1001d0c8
mov byte [esp + 0x1f], bl
cmp byte [esp + 0x1f], 0
je 0x1001d103
push 0x5a62
push 0x178e
push ebx
call fcn.10020b85
add esp, 0xc
lea eax, [esp + 0x44]
push ebx
push eax
call fcn.10020aae
or dword [esp + 0x194], 0xffffffff
pop ecx
pop ecx
lea ecx, [esp + 0xf4]
call fcn.1001a5b6
mov eax, dword [esp + 0x3c]
mov al, byte [eax]
cmp al, 0x30
jl 0x1001d272
cmp al, 0x39
jg 0x1001d272
mov dword [esp + 0xc], 0xa76aabec
lea ecx, [esp + 0xc0]
mov dword [esp + 0x24], 8
push 2
call fcn.10019cd8
mov dword [esp + 0xc], ebx
jmp 0x1001d16e
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x48], 0x3dd3
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x1001d15e
push 2
mov dword [esp + 0x10], ebx
pop edx
jmp 0x1001d194
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0xc0]
mov dword [eax + ecx*4], 0xb3659ea4
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jl 0x1001d17e
mov dword [esp + 0xc], edx
cmp dword [esp + 0xc], ebx
jl 0x1001d249
mov edi, dword [esp + 0xc0]
xor edx, edx
inc edx
mov dword [esp + 0x24], 0xca70051
xor ecx, ecx
mov dword [esp + 0x24], 0xa67d9261
mov eax, dword [esp + 0xc]
mov eax, dword [esp + eax*4 + 0x48]
mov eax, dword [esp + 0xc]
mov dword [esp + 0x24], edx
mov eax, dword [esp + 0xc]
mov esi, dword [esp + eax*4 + 0x48]
mov eax, dword [esp + 0x24]
cmp eax, 0xa0246c38
mov eax, dword [esp + 0xc]
setne cl
sub esi, ecx
sub esi, dword [esp + eax*4 + 0x48]
mov eax, dword [esp + 0xc]
neg esi
sbb esi, esi
xor ecx, ecx
inc esi
mov edx, dword [esp + eax*4 + 0x48]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + eax*4 + 0x48]
cmp edx, eax
sete cl
xor edx, edx
imul esi, ecx
inc edx
mov dword [esp + 0x24], esi
mov eax, dword [esp + 0x24]
mov dword [esp + 0x24], edx
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 0x24]
sub ecx, eax
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
neg ecx
cmp ecx, edx
setge al
mov dword [edi + 4], eax
dec dword [esp + 0xc]
jns 0x1001d1b2
mov esi, dword [esp + 0x30]
lea ecx, [esp + 0xc0]
call fcn.1001a5b6
push ebx
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x48]
push eax
call fcn.1001fe43
mov ecx, dword [esp + 0x48]
add esp, 0xc
inc ecx
jmp 0x1001d06a
mov dword [esp + 0xc], 0x42c70bb7
lea ecx, [esp + 0x90]
mov dword [esp + 0x10], 0xf38d927f
push 2
call fcn.10019cd8
mov dword [esp + 0x30], 0x5d9c
mov dword [esp + 0x2c], 0xfffffff7
mov dword [esp + 0x24], 0xffff
mov dword [esp + 0xc], ebx
jmp 0x1001d2c1
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x84], 0xffffffff
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x1001d2ae
push 2
mov dword [esp + 0x10], ebx
pop edx
jmp 0x1001d2e7
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x90]
mov dword [eax + ecx*4], 0x6d39c7c6
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jl 0x1001d2d1
mov dword [esp + 0xc], edx
cmp dword [esp + 0xc], ebx
jl 0x1001d380
mov esi, dword [esp + 0x90]
mov dword [esp + 0x18], 0x4dde9ab
xor edx, edx
mov eax, dword [esp + 0xc]
mov eax, dword [esp + eax*4 + 0x84]
cmp eax, edi
mov eax, dword [esp + 0xc]
setl dl
xor ecx, ecx
cmp edx, eax
setg cl
xor edx, edx
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + eax*4 + 0x84]
mov eax, dword [esp + 0x10]
cmp ecx, eax
mov eax, dword [esp + 0xc]
sete dl
xor ecx, ecx
cmp edx, eax
mov dword [esi + 4], edx
mov eax, dword [esp + 0x88]
setle cl
xor edx, edx
dec ecx
cmp ecx, eax
mov eax, dword [esp + 0xc]
setge dl
mov eax, dword [esp + eax*4 + 0x84]
add eax, edx
je 0x1001d374
mov eax, edi
cmp dword [esi + 4], ebx
jne 0x1001d376
mov eax, ebx
mov dword [esp + 0x18], eax
dec dword [esp + 0xc]
jns 0x1001d302
mov esi, dword [esp + 0x90]
mov eax, edi
sub eax, dword [esi + 4]
je 0x1001d392
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0xc]
sub eax, 0xb782
sub edx, eax
mov eax, dword [esp + 0xc]
neg edx
sbb edx, edx
inc edx
sub edx, dword [esi + 4]
neg edx
sbb edx, edx
add eax, dword [esi + 4]
inc edx
xor ecx, ecx
cmp eax, edx
setg cl
xor edx, edx
mov dword [esp + 0x24], ecx
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
cmp ecx, eax
lea ecx, [esp + 0x90]
setne dl
imul edx, dword [esp + 0xc]
mov dword [esi + 4], edx
call fcn.1001a5b6
lea eax, [esp + 0x40]
push eax
push ebx
call fcn.1001f19c
pop ecx
pop ecx
push edi
lea ecx, [esp + 0x7c]
call fcn.10019cd8
mov dword [esp + 0x10], 0x81c2900
mov dword [esp + 0x18], 2
mov dword [esp + 0x10], ebx
jmp 0x1001d433
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x78]
mov dword [eax + ecx*4], 0x1713b910
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 1
jl 0x1001d420
mov dword [esp + 0x10], ebx
jmp 0x1001d46a
mov dword [esp + 0x30], 1
mov eax, dword [esp + 0x10]
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x78]
mov edx, dword [esp + 0x78]
mov eax, dword [eax + ecx*4]
mov dword [edx + esi*4], eax
add dword [esp + 0x30], eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ebx
jle 0x1001d440
lea ecx, [esp + 0x78]
call fcn.1001a5b6
jmp 0x1001c97e
mov al, 1
mov ecx, dword [esp + 0x184]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret