Function at 0x100202ce
Capabilities:
Get graphical window text
Query environment variable
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1006bfb8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2b0
push ebx
push esi
mov dword [esp + 0x50], ecx
mov esi, edx
push edi
mov dword [esp + 0x1c], 0x5d6c05ba
xor ebx, ebx
mov dword [esp + 0x24], 0xab1943c6
push 3
mov dword [esp + 0x34], 0xfac5
mov dword [esp + 0x48], esi
mov dword [esp + 0x20], ebx
pop edi
jmp 0x100204b7
mov dword [esp + 0x20], 0xc553
mov dword [esp + 0x24], 0x245597e
mov dword [esp + 0x14], ebx
jmp 0x1002034b
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x238], 0x4c01
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x10020338
mov eax, dword [esp + 0x1c]
imul eax, dword [esp + 0x20], 0xffff
cmp dword [esp + 0x20], eax
jle 0x100204ab
mov dword [esp + 0x28], 0x79d62bf
lea ecx, [esp + 0x1ec]
push 1
call fcn.1000e5bc
mov dword [esp + 0x10], ebx
jmp 0x10020397
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x94], 0xfffffffb
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x10020384
mov dword [esp + 0x10], ebx
jmp 0x100203b6
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x19c], 0xfffffff6
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x100203a3
xor edx, edx
mov dword [esp + 0x10], ebx
inc edx
jmp 0x100203dc
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x1ec]
mov dword [eax + ecx*4], 0x790
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x100203c6
mov dword [esp + 0x10], ebx
jmp 0x100203fb
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x130], 0xc1731d49
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x100203e8
mov eax, dword [esp + 0x98]
mov ecx, 0xfffd
mov dword [esp + 0x24], eax
dec dword [esp + 0x98]
mov eax, dword [esp + 0x98]
mov eax, dword [esp + 0x98]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x98]
sub ecx, eax
jne 0x1002043c
mov eax, dword [esp + 0x94]
mov eax, dword [esp + 0x98]
xor ecx, ecx
mov eax, dword [esp + 0x98]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
mov dword [esp + 0x24], 0xd7f19125
mov eax, dword [esp + 0x24]
mov dword [esp + 0x19c], eax
mov eax, dword [esp + 0x28]
test eax, eax
setg cl
lea eax, [ecx - 0xbf6]
mov dword [esp + 0x130], eax
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x28]
cmp dword [esp + 0x24], eax
jne 0x1002048f
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x238], ebx
lea ecx, [esp + 0x1ec]
cmp dword [esp + 0x19c], ebx
call fcn.1000f0db
jmp 0x100204b3
mov dword [esp + 0x24], 0xfffffffb
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0x16
jge 0x10020322
mov eax, dword [0x11087430]
test al, 1
jne 0x10020567
or eax, 1
mov dword [0x11087430], eax
push ebx
mov dword [esp + 0x2c8], ebx
push ebx
mov dword [0x11087440], ebx
mov dword [0x11087444], ebx
call fcn.10012818
mov dword [0x11087440], eax
mov dword [0x11087448], ebx
mov dword [0x11087450], ebx
mov byte [esp + 0x2c4], 2
mov ecx, 0x11087448
mov dword [esp + 0x100], eax
lea eax, [esp + 0x100]
push eax
push 0x10
push ebx
lea eax, [esp + 0x140]
mov dword [0x1108745c], 0x3f800000
push eax
mov dword [0x1108744c], ebx
call fcn.100125bc
push 0x1006cd63
mov dword [0x11087454], 7
mov dword [0x11087458], 8
call fcn.10052adc
or edx, 0xffffffff
pop ecx
mov dword [esp + 0x2c4], edx
push 2
lea ecx, [esp + 0x20c]
call fcn.1000e5bc
mov dword [esp + 0x28], 0xc08901f2
mov dword [esp + 0x14], ebx
jmp 0x10020599
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x208]
mov dword [eax + ecx*4], 1
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x10020583
mov dword [esp + 0x28], 1
cmp dword [esp + 0x28], ebx
jl 0x10020613
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x100205c5
push ebx
push 0x1c7a
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1002060d
push 0x1af2
push 0x117e
push 0x7b5
push 0x9b2
push 0x1ae7
push 0x1665
push 0x2164
push 0x6dc
push 0x7d9
push 0x1c1b
push 0x9e2
call dword [sym.imp.GDI32.dll_StretchBlt]
dec dword [esp + 0x28]
jns 0x100205ae
lea ecx, [esp + 0x208]
call fcn.1000f0db
imul eax, dword [esp + 0x54], 0x2710
lea ecx, [esp + 0x22c]
push 1
add eax, esi
mov dword [esp + 0xb8], eax
call fcn.1000e5bc
mov dword [esp + 0x30], 0x4a12b57e
xor edx, edx
mov dword [esp + 0x30], 4
inc edx
mov dword [esp + 0x30], 0xffbe
mov dword [esp + 0x30], edx
mov dword [esp + 0x20], edi
mov dword [esp + 0x30], 0x3c3ae507
mov dword [esp + 0x10], ebx
jmp 0x10020685
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x22c]
mov dword [eax + ecx*4], 0xfffffffb
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x1002066f
mov dword [esp + 0x10], ebx
jmp 0x100206a4
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x268], 0xb7cefa9d
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x10020691
inc dword [esp + 0x20]
lea ecx, [esp + 0x22c]
call fcn.1000f0db
lea eax, [esp + 0xb4]
push eax
call fcn.10022e96
mov eax, dword [eax]
mov dword [esp + 0x34], eax
test eax, eax
je 0x10020b9b
mov dword [esp + 0x10], 0xb1a9565e
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], 0xf66b17b7
mov dword [esp + 0x14], 0x9a01
mov dword [esp + 0x2c], 0x1569
cmp dword [esp + 0x2c], 0x925
jge 0x100207fc
lea eax, [esp + 0x4c]
push eax
push 0x1000775c
call fcn.100528eb
mov eax, dword [esp + 0x54]
pop ecx
pop ecx
test eax, eax
je 0x100207f7
mov edi, 0x100078f0
dec eax
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x74]
push eax
push 0x1000775c
call fcn.100528eb
pop ecx
pop ecx
push dword [esp + 0x74]
lea ecx, [esp + 0x108]
call fcn.1000e5bc
mov ecx, dword [esp + 0x74]
mov esi, dword [esp + 0x104]
mov dword [esp + 0x2c], ebx
test ecx, ecx
jle 0x1002078e
push 4
mov edi, esi
pop esi
push edi
push 0x1000775c
call fcn.100528eb
pop ecx
pop ecx
mov ecx, dword [esp + 0x74]
inc ebx
add edi, esi
cmp ebx, ecx
jl 0x10020768
mov esi, dword [esp + 0x104]
xor ebx, ebx
mov edi, 0x100078f0
mov byte [esp + 0x1b], 1
mov edx, ebx
test ecx, ecx
jle 0x100207b7
mov eax, dword [esi]
sub eax, dword [esi + edx*4]
and eax, 0x80000001
jns 0x100207aa
dec eax
or eax, 0xfffffffe
inc eax
jne 0x100207b3
inc edx
cmp edx, ecx
jl 0x10020799
jmp 0x100207b7
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
mov eax, 0x100078ec
cmove eax, edi
push eax
call fcn.10052cc6
pop ecx
test esi, esi
je 0x100207eb
push esi
call fcn.10052c77
pop ecx
mov dword [esp + 0x104], ebx
mov dword [esp + 0x108], ebx
mov dword [esp + 0x10c], ebx
mov eax, dword [esp + 0x4c]
test eax, eax
jne 0x1002072a
dec eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x1c], ebx
or esi, 0xffffffff
cmp dword [esp + 0x1c], 2
jge 0x1002081b
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x270], esi
inc dword [esp + 0x1c]
jmp 0x10020803
mov eax, dword [esp + 0x24]
xor edx, edx
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
cmp ecx, eax
setg dl
mov dword [esp + 0x28], edx
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
sub edx, 0x2645a0d9
neg edx
sbb edx, edx
xor ecx, ecx
cmp edx, eax
setg cl
cmp ecx, 2
sbb eax, eax
inc eax
imul eax, dword [esp + 0x24]
neg eax
sbb eax, eax
neg eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x10], ebx
jmp 0x10020990
xor ecx, ecx
mov dword [esp + 0x14], ebx
inc ecx
jmp 0x10020891
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0xa4], ecx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ecx
jl 0x10020882
mov dword [esp + 0x2c], 0x1c1c
cmp dword [esp + 0x2c], 0x3f2
jge 0x10020949
lea eax, [esp + 0xf0]
push eax
lea eax, [esp + 0x7c]
push eax
push 0x100077d4
call fcn.100528eb
mov eax, dword [esp + 0x84]
add esp, 0xc
xor ecx, ecx
inc eax
push 4
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1004df8c
xor edi, edi
mov edx, eax
pop ecx
mov ecx, dword [esp + 0x78]
inc edi
mov dword [esp + 0x2c], edx
cmp ecx, edi
jl 0x10020919
push 4
lea esi, [edx + 4]
pop ebx
push esi
push 0x1000775c
call fcn.100528eb
pop ecx
pop ecx
mov ecx, dword [esp + 0x78]
inc edi
add esi, ebx
cmp edi, ecx
jle 0x100208fb
mov edx, dword [esp + 0x2c]
xor ebx, ebx
mov esi, dword [esp + 0xf0]
mov eax, ecx
mov edi, dword [edx + esi*4]
test ecx, ecx
jle 0x10020934
cmp dword [edx + eax*4], edi
jne 0x10020934
dec ecx
dec eax
test eax, eax
jg 0x10020929
push 0xffffffffffffffff
cmp ecx, esi
pop esi
cmovge ecx, esi
push ecx
push 0x100077ac
call fcn.10052b06
pop ecx
pop ecx
mov dword [esp + 0x14], ebx
cmp dword [esp + 0x14], ebx
jl 0x1002098c
mov dword [esp + 0x20], 0x258d
xor ecx, ecx
mov dword [esp + 0x20], 0x82f4e55
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + eax*4 + 0xa4]
test eax, eax
sets cl
mov dword [esp + 0x28], ecx
cmp dword [esp + 0xa4], ebx
jne 0x1002098c
dec dword [esp + 0x14]
jns 0x10020953
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x19
je 0x10020879
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0x1d4]
push 4
mov dword [esp + 0x128], eax
pop eax
mov dword [esp + 0x1c], 0xfffffff8
push eax
call fcn.1000e5bc
push 4
mov dword [esp + 0x38], 0xcaf1e2cd
pop edx
mov dword [esp + 0x24], edx
mov dword [esp + 0x10], ebx
jmp 0x100209e2
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0xd4], esi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x100209d3
mov dword [esp + 0x10], ebx
jmp 0x10020a05
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x1d4]
mov dword [eax + ecx*4], 1
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x100209ef
mov dword [esp + 0xd4], 0x61928c17
mov dword [esp + 0x1c], 0xfffffff4
jmp 0x10020b84
mov dword [esp + 0x2c], 0x9531defc
push 3
mov dword [esp + 0x24], 0xc102d1f7
mov dword [esp + 0x18], ebx
pop ecx
jmp 0x10020a4c
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x7c], 0x7b4b
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ecx
jl 0x10020a3c
cmp dword [esp + 0x80], ebx
je 0x10020a6d
mov eax, dword [esp + 0xd4]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x84]
mov eax, dword [esp + 0x84]
xor edx, edx
mov eax, dword [esp + 0xd4]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x7c]
mov eax, dword [esp + 0x84]
mov eax, dword [esp + 0x7c]
mov eax, dword [esp + 0xd8]
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x34]
cmp eax, ecx
mov eax, dword [esp + 0x24]
setne dl
xor ecx, ecx
cmp edx, eax
setl cl
xor edx, edx
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x84]
mov eax, dword [esp + 0x84]
cmp ecx, eax
mov eax, dword [esp + 0x84]
setle dl
xor ecx, ecx
cmp edx, dword [esp + 0x2c]
setge cl
imul eax, ecx
test eax, eax
je 0x10020b16
mov dword [esp + 0x14], 7
cmp dword [esp + 0x14], ebx
jne 0x10020b8f
mov dword [esp + 0x14], 0x12
jmp 0x10020b0d
mov dword [esp + 0x2c], 0x7dcc3592
cmp dword [esp + 0x2c], ebx
jne 0x10020b80
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0x34
jge 0x10020afb
jmp 0x10020b80
xor eax, eax
mov dword [esp + 0x14], ebx
inc eax
mov dword [esp + 0x20], eax
cmp dword [esp + 0x14], ebx
jne 0x10020b29
mov eax, ebx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x84]
cmp eax, dword [esp + 0x20]
jg 0x10020b3e
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
xor ecx, ecx
cmp eax, 0xfffffffd
mov eax, dword [esp + 0x7c]
setge cl
xor edx, edx
cmp eax, ecx
setle dl
xor eax, eax
cmp edx, 0x28c51f7e
setl al
xor ecx, ecx
cmp eax, 1
setge cl
xor eax, eax
test ecx, ecx
setle al
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x1d4]
mov dword [eax], ecx
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xfffffff6
jne 0x10020a23
lea ecx, [esp + 0x1d4]
jmp 0x10022527
push dword [esp + 0x134]
movdqa xmm0, xmmword [0x10007d60]
lea eax, [esp + 0x26c]
push eax
lea eax, [esp + 0x260]
mov dword [esp + 0xc0], ebx
push eax
push ebx
lea ecx, [esp + 0xc8]
mov dword [esp + 0xcc], ebx
movdqu xmmword [esp + 0x268], xmm0
mov dword [esp + 0xd0], ebx
call fcn.10013584
push 1
lea ecx, [esp + 0x1a8]
mov dword [esp + 0x2c8], edi
call fcn.1000e5bc
push 4
xor edx, edx
pop eax
mov byte [esp + 0x2c4], al
inc edx
mov dword [esp + 0x10], edx
mov dword [esp + 0x28], 0x6d6d
mov dword [esp + 0x34], 0xaa1dd5c0
mov dword [esp + 0x14], ebx
jmp 0x10020c33
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1a4]
mov dword [eax + ecx*4], edx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x10020c21
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
neg eax
sbb eax, eax
neg eax
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x28]
cmp eax, dword [esp + 0x28]
je 0x10020d02
mov dword [esp + 0x10], ebx
jmp 0x10020c77
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xb8]
cmp dword [eax + ecx*4], ebx
jne 0x10020c7d
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jle 0x10020c63
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10020e19
mov dword [esp + 0x2c], 0x2106
cmp dword [esp + 0x2c], 0xfb4
jge 0x10020cf0
push 0x10759038
push ecx
mov edx, 0x100715e4
mov ecx, 0x1065c150
call fcn.10024055
pop ecx
mov ecx, eax
call fcn.1000e075
call fcn.1002025c
call fcn.100201c6
imul eax, dword [0x10759038]
mov dword [0x1065d29c], eax
call fcn.1002028b
push dword [0x1065d29c]
mov ecx, 0x1065c098
call fcn.1000e270
push eax
call fcn.10012c7f
xor edx, edx
pop ecx
inc edx
push edx
push 0x1157
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
jmp 0x10020e19
mov dword [esp + 0x2c], 0x160f
cmp dword [esp + 0x2c], 0xe8b
jge 0x10020daa
lea eax, [esp + 0x48]
push eax
push 0x100077ac
call fcn.100528eb
mov eax, dword [esp + 0x50]
mov edi, ebx
mov esi, ebx
pop ecx
pop ecx
mov ecx, ebx
test eax, eax
je 0x10020d84
dec eax
mov dword [esp + 0x48], eax
lea eax, [esp + 0x120]
push eax
push 0x1000775c
call fcn.100528eb
mov eax, dword [esp + 0x128]
pop ecx
pop ecx
push 3
cdq
pop ecx
idiv ecx
test edx, edx
jne 0x10020d64
inc ebx
jmp 0x10020d72
cmp edx, 1
jne 0x10020d6c
inc edi
jmp 0x10020d72
cmp edx, 2
jne 0x10020d72
inc esi
mov eax, dword [esp + 0x48]
test eax, eax
jne 0x10020d37
mov dword [esp + 0x24], ebx
xor ebx, ebx
mov ecx, dword [esp + 0x24]
dec eax
cmp edi, esi
mov dword [esp + 0x48], eax
mov eax, ecx
cmovl esi, edi
cdq
sub eax, edx
sar eax, 1
add esi, eax
push esi
push 0x100077ac
call fcn.10052b06
pop ecx
pop ecx
xor edx, edx
push 3
inc edx
pop edi
mov eax, dword [esp + 0x1a4]
mov dword [esp + 0x14], 0xfffd
mov dword [esp + 0x20], edx
cmp dword [eax], ebx
jne 0x10020dde
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0xb8]
mov eax, dword [eax]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
imul ecx, dword [esp + 0x34]
add ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xb8]
imul ecx, dword [eax + 8]
test ecx, ecx
je 0x10020e0e
mov ecx, edx
cmp dword [esp + 0x10], ebx
jne 0x10020e10
mov ecx, ebx
mov eax, dword [esp + 0xb8]
mov dword [eax], ecx
lea ecx, [esp + 0x1a4]
mov dword [esp + 0x10], ebx
call fcn.1000f0db
or esi, 0xffffffff
lea ecx, [esp + 0xb8]
mov dword [esp + 0x2c4], esi
call fcn.1000f0db
mov eax, dword [0x11087430]
push 5
pop ecx
test al, 2
jne 0x10020ee4
or eax, 2
mov dword [0x11087430], eax
push ebx
mov dword [esp + 0x2c8], ecx
push ebx
mov dword [0x11087410], ebx
mov dword [0x11087414], ebx
call fcn.10012818
mov dword [0x11087410], eax
mov dword [0x11087418], ebx
mov dword [0x11087420], ebx
mov byte [esp + 0x2c4], 7
mov ecx, 0x11087418
mov dword [esp + 0x110], eax
lea eax, [esp + 0x110]
push eax
push 0x10
push ebx
lea eax, [esp + 0x254]
mov dword [0x1108742c], 0x3f800000
push eax
mov dword [0x1108741c], ebx
call fcn.100125bc
push 0x1006cd5e
mov dword [0x11087424], 7
mov dword [0x11087428], 8
call fcn.10052adc
pop ecx
mov dword [esp + 0x2c4], esi
mov dword [esp + 0x10], 0xb1a9565e
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], 0xf66b17b7
mov dword [esp + 0x14], 0x9a01
mov dword [esp + 0x1c], ebx
jmp 0x10020f15
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x2a0], esi
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jl 0x10020f06
mov eax, dword [esp + 0x24]
xor edx, edx
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
cmp ecx, eax
setg dl
mov dword [esp + 0x28], edx
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
sub edx, 0x2645a0d9
neg edx
sbb edx, edx
xor ecx, ecx
cmp edx, eax
setg cl
cmp ecx, 2
sbb eax, eax
inc eax
imul eax, dword [esp + 0x24]
neg eax
sbb eax, eax
neg eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x10], ebx
jmp 0x10020fde
mov dword [esp + 0x14], ebx
jmp 0x10020f90
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0xa0], 1
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 1
jl 0x10020f7d
mov dword [esp + 0x14], ebx
cmp dword [esp + 0x14], ebx
jl 0x10020fda
mov dword [esp + 0x20], 0x258d
xor ecx, ecx
mov dword [esp + 0x20], 0x82f4e55
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + eax*4 + 0xa0]
test eax, eax
sets cl
mov dword [esp + 0x28], ecx
cmp dword [esp + 0xa0], ebx
jne 0x10020fda
dec dword [esp + 0x14]
jns 0x10020fa1
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x19
je 0x10020f77
lea eax, [esp + 0x54]
xorps xmm0, xmm0
push eax
movdqu xmmword [esp + 0xe0], xmm0
call fcn.10022ef8
push edi
lea ecx, [esp + 0xcc]
mov esi, dword [eax]
mov dword [esp + 0x14], 0x60f57a7c
mov dword [esp + 0x2c], esi
call fcn.1000e5bc
push 5
mov dword [esp + 0x24], 0xc0c8fbfc
or edx, 0xffffffff
pop eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x34], edx
mov dword [esp + 0x10], ebx
jmp 0x10021048
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xc8]
mov dword [eax + ecx*4], 0xade2167
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x10021032
push 4
mov dword [esp + 0x14], ebx
pop ecx
jmp 0x1002106a
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x278], 0x80095520
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ecx
jl 0x10021057
mov dword [esp + 0x10], 0x477862fd
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x10], 2
jg 0x1002116d
mov esi, dword [esp + 0xc8]
or edi, 0xffffffff
mov dword [esp + 0x2c], 0xf3b06d9e
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xc8]
cmp dword [eax + ecx*4], ebx
jne 0x100210ad
mov eax, dword [esp + 0x10]
cmp dword [esi + 4], 0xffff000f
je 0x100210db
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xc8]
cmp dword [eax + ecx*4], ebx
je 0x100210db
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xc8]
cmp dword [eax + ecx*4], ebx
je 0x100210db
xor eax, eax
inc eax
jmp 0x100210dd
mov eax, ebx
cmp eax, dword [esp + 0x10]
jl 0x100210e7
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0xc8]
push 0
cmp eax, dword [ecx + edx*4]
mov eax, dword [esp + 0x14]
pop edx
setl dl
xor ecx, ecx
cmp eax, edx
setg cl
xor edx, edx
mov dword [esp + 0x278], ecx
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xc8]
cmp dword [eax + ecx*4], ebx
sete dl
mov dword [esp + 0x34], edx
mov eax, dword [esp + 0x34]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x2c], edi
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10021157
push ebx
push 0x998
call dword [sym.imp.USER32.dll_ClientToScreen]
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jle 0x10021091
mov esi, dword [esp + 0x28]
push 3
pop edi
lea ecx, [esp + 0xc8]
call fcn.1000f0db
mov al, byte [ebp + 0xc]
test al, al
jne 0x10021188
test esi, esi
jne 0x10021e6c
lea ecx, [esp + 0x2a8]
mov dl, al
push ecx
mov ecx, dword [esp + 0x58]
call fcn.100144d8
mov esi, eax
lea edi, [esp + 0xe0]
pop ecx
push 3
lea ecx, [esp + 0x1c0]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
or esi, 0xffffffff
pop edi
mov dword [esp + 0x34], esi
mov dword [esp + 0x2c], 0x105fa2ef
mov dword [esp + 0x20], 0x64361a6b
push edi
call fcn.1000e5bc
mov dword [esp + 0x10], ebx
jmp 0x100211e9
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0xc4], 0x57ad95e1
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 1
jl 0x100211d6
mov dword [esp + 0x10], ebx
jmp 0x10021208
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x1bc]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x100211f6
xor ecx, ecx
mov dword [esp + 0xc4], 0x4e2db58e
mov eax, dword [esp + 0x2c]
cmp eax, 1
setle cl
mov dword [esp + 0x20], ecx
cmp dword [esp + 0x20], 0xfffffff7
mov ecx, dword [esp + 0x1bc]
sbb eax, eax
inc eax
mov dword [ecx + 4], eax
je 0x10021279
mov dword [esp + 0x20], ebx
mov dword [esp + 0x2c], 0xfffffff6
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10021267
push 0x1af2
push 0x14a5
push 0x4f
push ebx
call dword [sym.imp.USER32.dll_GetMessageA]
mov eax, dword [esp + 0x34]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x2c], eax
jmp 0x10021283
mov eax, dword [esp + 0xc4]
mov dword [ecx + 4], eax
lea ecx, [esp + 0x1bc]
call fcn.1000f0db
cmp byte [ebp + 0xc], 0
je 0x100219e1
cmp dword [esp + 0xe4], 0
je 0x100219e1
mov dword [esp + 0x14], ebx
lea ecx, [esp + 0x15c]
push 1
call fcn.1000e5bc
mov dword [esp + 0x2c4], 8
mov dword [esp + 0x24], 0x33563700
mov dword [esp + 0x1c], 0xfffffffd
mov dword [esp + 0x20], 0xfffffff9
mov dword [esp + 0x34], 0xa832
mov dword [esp + 0x2c], 0x1eb8
cmp dword [esp + 0x2c], 0xdb4
jge 0x10021553
lea eax, [esp + 0x40]
push eax
push 0x1000775c
call fcn.100528eb
pop ecx
pop ecx
push dword [esp + 0x40]
lea ecx, [esp + 0x60]
call fcn.1000e5bc
mov byte [esp + 0x2c4], 9
lea ecx, [esp + 0x88]
push dword [esp + 0x40]
call fcn.1000e5bc
mov byte [esp + 0x2c4], 0xa
lea ecx, [esp + 0x68]
push dword [esp + 0x40]
call fcn.1000e5bc
mov ecx, dword [esp + 0x40]
mov edi, ebx
test ecx, ecx
jle 0x10021370
mov esi, dword [esp + 0x5c]
push 4
pop ebx
push esi
push 0x1000775c
call fcn.100528eb
pop ecx
pop ecx
mov ecx, dword [esp + 0x40]
inc edi
add esi, ebx
cmp edi, ecx
jl 0x10021356
xor ebx, ebx
mov edi, ebx
test ecx, ecx
jle 0x1002139a
mov esi, dword [esp + 0x88]
push 4
pop ebx
push esi
push 0x1000775c
call fcn.100528eb
pop ecx
pop ecx
mov ecx, dword [esp + 0x40]
inc edi
add esi, ebx
cmp edi, ecx
jl 0x10021380
xor ebx, ebx
mov edi, ebx
test ecx, ecx
jle 0x100213cb
mov eax, dword [esp + 0x5c]
mov edx, dword [esp + 0x88]
mov esi, dword [esp + 0x68]
sub edx, eax
push 4
sub esi, eax
pop ebx
sub ecx, dword [edx + eax]
sub ecx, dword [eax]
inc edi
mov dword [esi + eax], ecx
add eax, ebx
mov ecx, dword [esp + 0x40]
cmp edi, ecx
jl 0x100213b6
xor ebx, ebx
mov edx, ebx
mov dword [esp + 0x20], edx
test ecx, ecx
jle 0x10021482
mov eax, dword [esp + 0x68]
mov edi, eax
mov esi, dword [esp + 0x5c]
sub edi, esi
mov dword [esp + 0x2c], edi
mov edi, ebx
test edx, edx
jle 0x10021417
mov ebx, dword [esi]
mov edx, dword [esp + 0x2c]
xor ecx, ecx
mov eax, dword [eax + edi*4]
cmp eax, dword [esi + edx]
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x68]
setg cl
sub ebx, ecx
inc edi
mov dword [esi], ebx
cmp edi, edx
jl 0x100213f1
mov ecx, dword [esp + 0x40]
xor ebx, ebx
inc edx
add esi, 4
mov dword [esp + 0x20], edx
cmp edx, ecx
jl 0x100213e9
test ecx, ecx
jle 0x10021482
mov eax, dword [esp + 0x68]
xor edx, edx
mov esi, dword [esp + 0x88]
inc edx
sub eax, esi
mov dword [esp + 0x20], edx
mov dword [esp + 0x2c], eax
mov edi, edx
cmp edx, ecx
jge 0x1002146f
mov ebx, dword [esi]
mov edx, dword [esp + 0x68]
mov eax, dword [edx + edi*4]
xor ecx, ecx
mov edx, dword [esp + 0x2c]
cmp eax, dword [edx + esi]
mov edx, dword [esp + 0x68]
setg cl
sub ebx, ecx
inc edi
mov dword [esi], ebx
mov ecx, dword [esp + 0x40]
cmp edi, ecx
jl 0x1002144b
mov edx, dword [esp + 0x20]
inc edx
push 4
pop eax
add esi, eax
mov dword [esp + 0x20], edx
lea eax, [edx - 1]
cmp eax, ecx
jl 0x1002143f
xor ebx, ebx
mov esi, ebx
test ecx, ecx
jle 0x100214ae
mov edx, dword [esp + 0x5c]
mov eax, dword [esp + 0x88]
sub edx, eax
cmp dword [eax + edx], ebx
jne 0x1002155c
cmp dword [eax], ebx
jne 0x1002155c
inc esi
add eax, 4
cmp esi, ecx
jl 0x10021495
push 0x100078ec
call fcn.10052cc6
cmp dword [esp + 0x44], 0
mov esi, ebx
pop ecx
jle 0x100214de
mov ebx, dword [esp + 0x68]
push dword [ebx + esi*4]
push 0x100078cc
call fcn.10052b06
inc esi
pop ecx
pop ecx
cmp esi, dword [esp + 0x40]
jl 0x100214c6
xor ebx, ebx
push 0x100076c5
call fcn.10052cc6
mov eax, dword [esp + 0x6c]
pop ecx
test eax, eax
je 0x10021504
push eax
call fcn.10052c77
pop ecx
mov dword [esp + 0x68], ebx
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x70], ebx
cmp dword [esp + 0x88], 0
je 0x10021530
push dword [esp + 0x88]
call fcn.10052c77
pop ecx
mov dword [esp + 0x88], ebx
mov dword [esp + 0x8c], ebx
mov dword [esp + 0x90], ebx
cmp dword [esp + 0x5c], 0
je 0x1002154d
push dword [esp + 0x5c]
call fcn.10052c77
pop ecx
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x60], ebx
mov dword [esp + 0x64], ebx
push 3
or esi, 0xffffffff
pop edi
xor edx, edx
mov dword [esp + 0x10], ebx
inc edx
jmp 0x10021575
push 0x100078f0
jmp 0x100214e3
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x15c]
mov dword [eax + ecx*4], esi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x10021563
mov dword [esp + 0x10], ebx
jmp 0x10021591
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x58], 0x6f39
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x10021581
mov eax, dword [esp + 0x14]
mov ecx, 0xb000e2e4
mov eax, dword [esp + 0x14]
sub eax, 0xfffc
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x58]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x58]
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x15c]
mov dword [eax], esi
mov eax, dword [esp + 0x58]
cmp ecx, eax
mov eax, dword [esp + 0x1c]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
setge dl
xor eax, eax
cmp esi, 0xaa81
setge al
xor ecx, ecx
cmp eax, edx
setge cl
mov dword [esp + 0x20], ecx
cmp dword [esp + 0x20], 0xd4782549
jne 0x10021660
or esi, 0xffffffff
mov dword [esp + 0x14], esi
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x15c]
imul ecx, dword [eax]
test ecx, ecx
je 0x1002162f
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x14]
xor edx, edx
mov eax, dword [esp + 0x34]
cmp ecx, eax
mov eax, dword [esp + 0x58]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x14]
setne cl
mov dword [esp + 0x2c], ecx
xor ecx, ecx
cmp eax, dword [esp + 0x2c]
setle cl
mov dword [esp + 0x14], ecx
jmp 0x10021675
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10021672
push ebx
call dword [sym.imp.USER32.dll_CharNextW]
or esi, 0xffffffff
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10021687
push ebx
call dword [sym.imp.USER32.dll_IsRectEmpty]
lea ecx, [esp + 0x15c]
mov dword [esp + 0x2c4], esi
call fcn.1000f0db
mov eax, dword [esp + 0xe8]
lea ecx, [esp + 0xa8]
mov dword [esp + 0x30], 0x720e83c7
push 4
mov dword [esp + 0x12c], eax
mov dword [esp + 0x34], esi
pop eax
mov dword [esp + 0x38], 0xa43d9532
mov dword [esp + 0x10], 0xbad86e52
mov dword [esp + 0x34], esi
push eax
call fcn.1000e5bc
mov dword [esp + 0x2c4], 0xb
mov dword [esp + 0x24], 0x3a92bd42
mov dword [esp + 0x20], 0x3b37
mov dword [esp + 0x38], 1
mov dword [esp + 0x38], 0x45d4
push 4
mov dword [esp + 0x3c], 0x1ebdc590
mov dword [esp + 0x18], ebx
pop edx
jmp 0x1002172a
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xa8]
mov dword [eax + ecx*4], 0x65425a80
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x10021714
inc dword [esp + 0x20]
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x10], edi
jg 0x100219c0
mov edi, dword [esp + 0xa8]
push 3
mov dword [esp + 0x20], edi
pop edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x38], edi
mov dword [esp + 0x2c], 0xfffffffb
mov dword [esp + 0x2c], 5
mov dword [esp + 0x2c], 0xd6736fa
mov dword [esp + 0x2c], 0x4a037a76
mov dword [esp + 0x2c], 0x22c6
cmp dword [esp + 0x2c], 0x90f
jge 0x10021801
mov word [0x10664df0], 0x101
call fcn.1002029a
lea eax, [esp + 0xf8]
mov ecx, 0x1065c150
push eax
call fcn.1000e075
mov edx, dword [esp + 0xf8]
lea eax, [edx - 3]
cmp eax, 2
jle 0x10021801
mov ecx, edx
sub ecx, eax
add ecx, 0x10664df0
cmp byte [ecx], 0
je 0x100217d1
cmp byte [eax + 0x10664df0], 0
jne 0x100217da
dec eax
inc ecx
cmp eax, 2
jg 0x100217c3
jmp 0x10021801
sub edx, eax
push edx
push ecx
push eax
mov ecx, 0x1065c098
call fcn.1000e270
mov dl, 0x20
mov ecx, eax
call fcn.10012ac9
pop ecx
mov ecx, eax
call fcn.1000e270
push eax
call fcn.10012c7f
pop ecx
mov dword [esp + 0x2c], 0xfffffffa
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x2c], 5
mov dword [esp + 0x14], ebx
jmp 0x1002182a
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x214], esi
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x1002181b
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0xa8]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0xa8]
mov eax, dword [esp + 0x34]
mov ecx, dword [ecx + edx*4]
sub ecx, eax
jne 0x10021865
cmp dword [esp + 0x10], ebx
jne 0x10021865
mov edi, ebx
jmp 0x10021868
xor edi, edi
inc edi
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xa8]
push 5
mov eax, dword [eax + ecx*4]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x14]
mov edx, dword [esp + 0xac]
pop ecx
cmp ecx, dword [edx + eax*4]
sbb ecx, ecx
neg ecx
sub ecx, edi
mov edi, dword [esp + 0x1c]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp dword [edi + 0xc], ecx
setl al
add eax, dword [edx + esi*4]
xor edx, edx
mov dword [esp + 0x20], eax
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
cmp eax, ecx
mov eax, dword [esp + 0xa8]
setle dl
cmp edx, dword [eax + esi*4]
je 0x100218d7
cmp dword [esp + 0x24], ebx
je 0x100218d7
xor edx, edx
inc edx
jmp 0x100218d9
mov edx, ebx
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x30]
add eax, edx
mov dword [edi + 8], edx
add ecx, eax
xor eax, eax
cmp ecx, 0xfffffff8
setne al
sub eax, 0xd4d1
neg eax
sbb eax, eax
inc eax
cmp eax, 0xfffffffb
jl 0x10021945
push 2
lea ecx, [esp + 0x250]
call fcn.1000e5bc
mov dword [esp + 0x14], ebx
jmp 0x10021929
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x24c]
mov dword [eax + ecx*4], 8
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x10021913
lea ecx, [esp + 0x24c]
mov dword [esp + 0x34], ebx
call fcn.1000f0db
or esi, 0xffffffff
jmp 0x100219af
mov dword [esp + 0x38], 0xfffffffd
or esi, 0xffffffff
mov dword [esp + 0x38], esi
mov dword [esp + 0x38], 0xb416c011
mov dword [esp + 0x14], ebx
jmp 0x10021975
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x288], 0x3d38e20b
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x10021962
dec dword [esp + 0x214]
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x100219af
push ebx
push 0xee
push 0x12e9
push 0x1a7c
push 0x2128
push 0x19b6
push ebx
call dword [sym.imp.USER32.dll_TrackPopupMenu]
inc dword [esp + 0x10]
push 3
pop edi
cmp dword [esp + 0x10], edi
jle 0x10021750
lea ecx, [esp + 0xa8]
mov dword [esp + 0x2c4], esi
call fcn.1000f0db
mov eax, dword [esp + 0xe4]
mov dword [esp + 0x12c], eax
mov esi, dword [esp + 0x28]
test esi, esi
jne 0x10021e6c
cmp dword [esp + 0xdc], esi
jle 0x10021e6c
mov dword [esp + 0x10], 0xbb2c2135
lea ecx, [esp + 0x138]
push 2
call fcn.1000e5bc
push 2
mov dword [esp + 0x28], 0xfffffffc
mov dword [esp + 0x18], ebx
pop edx
jmp 0x10021a37
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x138]
mov dword [eax + ecx*4], 0xfff6
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x10021a21
mov dword [esp + 0x10], 0xfffffff4
cmp dword [esp + 0x10], 0xfffffffd
jle 0x10021a8b
push 4
pop eax
mov dword [esp + 0x1c], eax
inc dword [esp + 0x1c]
mov dword [esp + 0x1c], ebx
cmp dword [esp + 0x1c], edx
jge 0x10021a80
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x138]
mov dword [eax + ecx*4], 0xfffd
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edx
jl 0x10021a61
push 4
pop eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0xfffffffd
jg 0x10021a4f
mov eax, dword [esp + 0x24]
mov edi, dword [esp + 0x138]
mov eax, dword [edi + 4]
inc eax
je 0x10021aaf
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10021b19
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
jmp 0x10021b19
mov dword [esp + 0x14], ebx
cmp dword [esp + 0x10], ebx
je 0x10021ac4
cmp dword [esp + 0x24], ebx
je 0x10021ac4
xor edx, edx
inc edx
jmp 0x10021ac6
mov edx, ebx
mov eax, dword [esp + 0x10]
xor ecx, ecx
cmp edx, eax
setge cl
add ecx, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
sub esi, ecx
neg esi
sbb esi, esi
xor edx, edx
inc esi
sub esi, dword [esp + 0x24]
imul esi, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
cmp esi, eax
mov eax, dword [esp + 0x14]
setne dl
xor ecx, ecx
imul edx, dword [edi + 4]
cmp edx, eax
setg cl
xor eax, eax
cmp ecx, 1
mov ecx, 0xfffe
setge al
cmp ecx, eax
sbb eax, eax
inc eax
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x138]
call fcn.1000f0db
push 4
pop eax
push eax
lea ecx, [esp + 0x148]
call fcn.1000e5bc
mov dword [esp + 0x2c4], 0xc
mov dword [esp + 0x10], 0x5231fbf6
mov dword [esp + 0x1c], 7
push 4
mov dword [esp + 0x28], 0xffff
mov dword [esp + 0x18], ebx
pop edx
jmp 0x10021b77
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x144]
mov dword [eax + ecx*4], 0x81ced8f6
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x10021b61
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10021b99
push 0xf6d
push ebx
push 0x209c
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
cmp eax, 1
mov esi, dword [esp + 0x144]
setle cl
xor eax, eax
imul ecx, dword [esp + 0x1c]
cmp dword [esi + 4], ecx
mov ecx, dword [esp + 0x144]
setl al
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
cmp eax, dword [ecx + 8]
jle 0x10021bde
cmp dword [esi + 4], ebx
jne 0x10021bde
mov ecx, ebx
jmp 0x10021be1
xor ecx, ecx
inc ecx
mov eax, dword [esp + 0x24]
xor edx, edx
add eax, ecx
cmp eax, 0xa3eaa3e8
mov eax, dword [esp + 0x24]
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
cmp ecx, dword [esi + 4]
jle 0x10021c94
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10021c17
push ebx
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push 3
pop edi
or eax, 0xffffffff
lea ecx, [esp + 0x144]
mov dword [esp + 0x2c4], eax
call fcn.1000f0db
xor eax, eax
inc eax
mov dword [esp + 0x30], eax
push 0xfffffffffffffffe
pop esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x30], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x20], 0x9831
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10021c64
push 0x2625
call dword [sym.imp.USER32.dll_PostQuitMessage]
dec dword [esp + 0x20]
cmp dword [esp + 0xe0], 0
je 0x10021e68
push 2
lea ecx, [esp + 0x154]
call fcn.1000e5bc
or eax, 0xffffffff
mov dword [esp + 0x30], eax
mov dword [esp + 0x14], ebx
jmp 0x10021d45
push 3
pop edi
push edi
lea ecx, [esp + 0x224]
call fcn.1000e5bc
mov dword [esp + 0x14], ebx
cmp dword [esp + 0x14], edi
jge 0x10021cc9
or edx, 0xffffffff
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x220]
mov dword [eax + ecx*4], edx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x10021cb1
mov eax, dword [esp + 0x10]
xor edx, edx
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
cmp ecx, eax
setge dl
or eax, 0xffffffff
cmp eax, edx
sbb eax, eax
xor ecx, ecx
inc eax
test eax, eax
setle cl
mov dword [esp + 0x10], ecx
mov dword [esp + 0x10], 2
cmp dword [esp + 0x10], ebx
jl 0x10021d1e
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10021d18
push ebx
push ebx
call dword [sym.imp.GDI32.dll_GetNearestPaletteIndex]
dec dword [esp + 0x10]
jns 0x10021d05
lea ecx, [esp + 0x220]
call fcn.1000f0db
jmp 0x10021c1a
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x150]
mov dword [eax + ecx*4], 0x13b91020
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x10021d2f
mov eax, dword [esp + 0x150]
mov dword [eax], ebx
mov dword [esp + 0x30], esi
cmp dword [esp + 0x30], ebx
jne 0x10021d73
mov ecx, dword [esp + 0x150]
mov eax, dword [ecx]
inc dword [ecx]
cmp dword [ecx], 6
mov dword [esp + 0x30], eax
jl 0x10021d55
lea ecx, [esp + 0x150]
call fcn.1000f0db
mov ecx, dword [esp + 0xe0]
call fcn.10020186
mov dword [esp + 0x30], 0xbe39
lea ecx, [esp + 0x1c8]
push 5
mov esi, eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x3c], 0xb59008cf
pop eax
mov dword [esp + 0x38], 0xc6f1fdbd
mov dword [esp + 0x38], eax
or eax, 0xffffffff
mov dword [esp + 0x38], 0xfffffff9
mov dword [esp + 0x38], eax
push 2
call fcn.1000e5bc
mov dword [esp + 0x20], ebx
mov dword [esp + 0x10], ebx
jmp 0x10021ded
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x1c8]
mov dword [eax + ecx*4], 0x7f5aee0c
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x10021dd7
push 4
mov dword [esp + 0x14], ebx
pop ecx
jmp 0x10021e10
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x290], 0xfffffff7
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ecx
jl 0x10021dfd
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10021e28
push ebx
call dword [sym.imp.USER32.dll_ShowCursor]
mov eax, dword [esp + 0x1c8]
xor edx, edx
inc edx
xor ecx, ecx
mov dword [eax], edx
mov eax, dword [esp + 0x30]
cmp eax, edx
setle cl
mov dword [esp + 0x20], ecx
lea ecx, [esp + 0x1c8]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x294], eax
call fcn.1000f0db
lea eax, [esp + 0x54]
push eax
call fcn.10022ef8
mov dword [eax], esi
jmp 0x10021e6c
mov esi, dword [esp + 0x28]
mov dword [esp + 0x14], 0x2124f84b
mov dword [esp + 0x14], ebx
jmp 0x10021e8d
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0xec], 0xfe387fb0
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 1
jl 0x10021e7a
mov eax, dword [esp + 0xec]
mov dword [esp + 0x14], eax
mov dword [esp + 0x14], ebx
cmp dword [esp + 0x14], edi
jle 0x10021ec0
or eax, 0xffffffff
mov dword [esp + 0x30], eax
cmp dword [esp + 0x30], ebx
jne 0x10021ec0
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jg 0x10021eac
lea ecx, [esp + 0xdc]
call fcn.1001c55b
mov dword [esp + 0x10], 0x57ad95e1
mov dword [esp + 0x1f8], ebx
mov dword [esp + 0x1fc], ebx
mov dword [esp + 0x200], ebx
mov dword [esp + 0x204], ebx
mov dword [esp + 0x20], 0xbca0becc
mov dword [esp + 0x14], ebx
jmp 0x10021f0e
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x3c], 0x4e2db58
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 1
jl 0x10021efe
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x10], ebx
jg 0x1002201a
or edi, 0xffffffff
mov esi, 0xfffe
mov dword [esp + 0x20], 0xb5cf0adc
mov dword [esp + 0x30], edi
mov eax, dword [esp + 0x10]
mov eax, dword [esp + eax*4 + 0x3c]
mov eax, dword [esp + 0x10]
cmp dword [esp + eax*4 + 0x3c], ebx
je 0x10021f4d
mov eax, dword [esp + 0x3c]
cmp dword [esp + 0x3c], ebx
jne 0x10021f57
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x10]
xor edx, edx
mov eax, dword [esp + eax*4 + 0x3c]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + eax*4 + 0x3c]
mov eax, dword [esp + 0x10]
cmp ecx, eax
setl dl
imul edx, dword [esp + 0x20]
neg edx
sub edx, dword [esp + 0x10]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
mov dword [esp + 0x200], edx
mov eax, dword [esp + 0x10]
imul eax, dword [esp + 0x10]
cmp eax, edx
setge cl
xor edx, edx
add ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x20]
cmp ecx, eax
mov eax, dword [esp + 0x10]
setne dl
xor ecx, ecx
mov eax, dword [esp + eax*4 + 0x3c]
cmp edx, eax
mov eax, dword [esp + 0x10]
setl cl
mov dword [esp + 0x30], ecx
xor ecx, ecx
mov eax, dword [esp + eax*4 + 0x3c]
cmp dword [esp + 0x30], eax
mov eax, dword [esp + 0x3c]
setne cl
cmp ecx, esi
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
xor edx, edx
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + eax*4 + 0x3c]
mov eax, dword [esp + 0x3c]
cmp ecx, eax
setl dl
add edx, 0x4c7605e8
mov dword [esp + 0x30], edx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ebx
jle 0x10021f2b
mov esi, dword [esp + 0x28]
push 3
pop edi
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10022032
push 0x105c
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test esi, esi
je 0x10022175
mov dword [esp + 0x14], ebx
lea ecx, [esp + 0x1e0]
mov dword [esp + 0x20], 0x3e0566a9
mov dword [esp + 0x1c], 0x8bd85027
mov dword [esp + 0x20], 0x1f7d9671
push edi
call fcn.1000e5bc
mov dword [esp + 0x30], 8
mov dword [esp + 0x10], ebx
jmp 0x10022084
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x240], 0x17ab6dad
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x10022071
mov dword [esp + 0x10], ebx
jmp 0x100220a3
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x1e0]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x10022091
mov eax, dword [esp + 0x14]
mov dword [esp + 0x244], eax
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
or eax, 0xffffffff
cmp dword [esp + 0x20], eax
jbe 0x100220d1
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
neg eax
sbb eax, eax
neg eax
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
imul ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1e0]
sub ecx, dword [eax + 8]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [esp + 0x30], ecx
mov dword [esp + 0x1c], ebx
jmp 0x1002213f
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10022127
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileType]
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1002213b
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xffffffe3
jl 0x10022115
lea ecx, [esp + 0x1e0]
call fcn.1000f0db
mov edx, dword [esp + 0x44]
mov ecx, esi
call fcn.100201bc
mov esi, eax
lea eax, [esp + 0xb4]
push eax
mov dword [esp + 0x128], esi
call fcn.10022e96
mov dword [eax], esi
push 4
pop eax
mov dword [esp + 0x1c], 0x9fdf99ff
lea ecx, [esp + 0x114]
mov dword [esp + 0x20], eax
push 2
call fcn.1000e5bc
mov dword [esp + 0x2c4], 0xd
mov dword [esp + 0x2c], 0x1af02c1
mov dword [esp + 0x30], 7
mov dword [esp + 0x28], ebx
jmp 0x100221c9
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x114]
mov dword [eax + ecx*4], 0x377963f6
inc dword [esp + 0x28]
cmp dword [esp + 0x28], 2
jl 0x100221b3
mov dword [esp + 0x1c], ebx
cmp dword [esp + 0x1c], 0xfffffffa
jge 0x10022520
push 3
mov edi, 0x7e2bd63a
pop esi
mov dword [esp + 0x14], 0xfffffffc
lea ecx, [esp + 0x174]
mov dword [esp + 0x24], 0x88ad88ca
mov dword [esp + 0x34], 0xfffffffb
mov dword [esp + 0x18c], edi
mov dword [esp + 0x190], edi
mov dword [esp + 0x194], edi
mov dword [esp + 0x198], edi
push esi
call fcn.1000e5bc
mov byte [esp + 0x2c4], 0xe
mov dword [esp + 0x28], ebx
jmp 0x1002224c
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x174]
mov dword [eax + ecx*4], 0x33419813
inc dword [esp + 0x28]
cmp dword [esp + 0x28], esi
jl 0x10022236
cmp dword [esp + 0x14], ebx
je 0x10022550
xor eax, eax
lea ecx, [esp + 0x180]
inc eax
mov dword [esp + 0x28], eax
push eax
call fcn.1000e5bc
push 4
pop eax
push eax
lea ecx, [esp + 0x1b4]
mov byte [esp + 0x2c8], 0xf
call fcn.1000e5bc
mov byte [esp + 0x2c4], 0x10
mov dword [esp + 0x10], ebx
jmp 0x100222ac
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x180]
mov dword [eax + ecx*4], 0xdfc1f7b4
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 1
jl 0x10022296
push 4
mov dword [esp + 0x14], ebx
pop edx
jmp 0x100222d2
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x1b0]
mov dword [eax + ecx*4], 0x53d1edbc
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x100222bc
cmp dword [esp + 0x14], ebx
je 0x10022309
mov eax, dword [esp + 0x180]
xor ecx, ecx
mov edx, dword [eax]
mov eax, dword [esp + 0x20]
inc edx
cmp edx, eax
setl cl
add ecx, dword [esp + 0x1c]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x114]
mov dword [eax + 4], ecx
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x168]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x28]
dec dword [esp + 0x28]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x34]
push 2
call fcn.1000e5bc
mov byte [esp + 0x2c4], 0x11
mov dword [esp + 0x44], 0x201e
cmp dword [esp + 0x44], 0x55d
jge 0x100223bd
lea eax, [esp + 0xf4]
push eax
push ecx
lea eax, [esp + 0x104]
mov ecx, 0x1065c150
push eax
call fcn.1002259a
pop ecx
mov ecx, eax
call fcn.1002259a
mov ecx, dword [esp + 0xf4]
mov eax, ecx
and eax, 0x80000001
jns 0x10022395
dec eax
or eax, 0xfffffffe
inc eax
je 0x1002239c
lea eax, [ecx - 1]
jmp 0x100223a5
mov eax, dword [esp + 0xfc]
sub eax, ecx
cdq
mov ecx, 0x1065c098
sub eax, edx
sar eax, 1
inc eax
push eax
call fcn.100226af
push eax
call fcn.10012c7f
pop ecx
mov dword [esp + 0x10], ebx
jmp 0x100223d9
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x168]
mov dword [eax + ecx*4], 0x3dfe8e23
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x100223c3
mov dword [esp + 0x10], ebx
jmp 0x100223f6
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x50], 0xfffffffb
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 1
jl 0x100223e6
mov esi, dword [esp + 0x114]
xor ecx, ecx
mov eax, dword [esp + 0x2c]
cmp eax, dword [esi + 4]
setl cl
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x168]
mov dword [eax + 4], ecx
mov eax, dword [esp + 0x50]
inc dword [esp + 0x50]
test eax, eax
jne 0x10022438
cmp dword [esp + 0x50], ebx
jne 0x10022438
mov eax, ebx
jmp 0x1002243b
xor eax, eax
inc eax
cmp eax, 0xffff
mov eax, dword [esp + 0x180]
sbb edx, edx
xor ecx, ecx
neg edx
cmp dword [eax], ebx
mov eax, dword [esp + 0x2c]
sete cl
imul edx, ecx
xor ecx, ecx
test edx, edx
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x1b0]
lea ecx, [esp + 0x168]
setle dl
add edx, dword [eax]
mov eax, dword [esp + 0x168]
neg edx
mov dword [eax], edx
mov dword [esi + 4], edx
call fcn.1000f0db
lea ecx, [esp + 0x1b0]
call fcn.1000f0db
lea ecx, [esp + 0x180]
call fcn.1000f0db
mov eax, dword [esp + 0x174]
xor ecx, ecx
mov esi, dword [esp + 0x114]
cmp dword [eax], ecx
setne cl
xor edx, edx
cmp dword [eax], 0xd41738dc
mov dword [esp + 0x44], ecx
setne dl
xor ecx, ecx
mov dword [esp + 0x194], edx
sub edx, dword [esi + 4]
add edx, dword [esi]
cmp dword [esi + 4], edx
mov eax, dword [esp + 0x20]
setg cl
mov byte [esp + 0x2c4], 0xd
xor edx, edx
cmp eax, ecx
lea ecx, [esp + 0x174]
setg dl
sub edx, dword [esp + 0x30]
neg edx
sbb edx, edx
xor eax, eax
inc edx
cmp dword [esp + 0x44], edx
setne al
mov dword [esi + 4], eax
call fcn.1000f0db
push 3
pop esi
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xfffffffa
jl 0x100221e7
lea ecx, [esp + 0x114]
call fcn.1000f0db
mov eax, dword [ebp + 8]
lea esi, [esp + 0x124]
mov ecx, dword [esp + 0x2bc]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [esp + 0x194], 0xe8bcd064
cmp dword [esp + 0x34], ebx
je 0x100224a2
lea ecx, [esp + 0x174]
mov byte [esp + 0x2c4], 0xd
call fcn.1000f0db
jmp 0x10022511