Function at 0x1001a2ff
Capabilities:
Enumerate gui resources
Resolve function by parsing pe exports
Suspend thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10065b7b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2a8
push ebx
push esi
xor ebx, ebx
mov dword [esp + 0x58], ecx
push edi
mov dword [esp + 0x10], ebx
mov esi, edx
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x10], 0xffffffee
push 1
mov dword [esp + 0xe0], esi
pop edi
jge 0x1001a549
mov esi, 0x100081a0
mov dword [esp + 0x20], 0x1519
cmp dword [esp + 0x20], 0xa00
jge 0x1001a455
lea eax, [esp + 0x1f8]
push eax
lea eax, [esp + 0x1f8]
push eax
lea eax, [esp + 0x1f8]
push eax
push esi
call fcn.1004bcab
lea eax, [esp + 0x130]
push eax
lea eax, [esp + 0x130]
push eax
lea eax, [esp + 0x130]
push eax
push esi
call fcn.1004bcab
lea eax, [esp + 0x164]
push eax
lea eax, [esp + 0x164]
push eax
lea eax, [esp + 0x164]
push eax
push esi
call fcn.1004bcab
mov edi, dword [esp + 0x224]
mov esi, dword [esp + 0x228]
mov eax, dword [esp + 0x150]
add eax, dword [esp + 0x148]
mov ecx, dword [esp + 0x170]
add ecx, dword [esp + 0x16c]
lea edx, [edi + esi]
mov dword [esp + 0x5c], eax
add eax, ecx
add eax, edx
mov dword [esp + 0x70], ecx
cdq
sub eax, edx
lea edx, [edi + esi]
sar eax, 1
push esi
mov ecx, eax
mov dword [esp + 0x54], eax
push edi
sub ecx, edx
mov edi, 0x100084a8
push ecx
push edi
call fcn.1004c43c
mov esi, dword [esp + 0x60]
add esp, 0x40
mov eax, esi
sub eax, dword [esp + 0x2c]
push dword [esp + 0x120]
push eax
push dword [esp + 0x120]
push edi
call fcn.1004c43c
sub esi, dword [esp + 0x50]
push esi
push dword [esp + 0x154]
push dword [esp + 0x154]
push edi
call fcn.1004c43c
xor edi, edi
add esp, 0x20
inc edi
mov byte [esp + 0x1b], bl
mov dword [esp + 0x20], 0x15bd
cmp dword [esp + 0x20], 0x92d
jge 0x1001a4ff
push 0x1065983c
push 0x1065a55c
push 0x10659ca0
push 0x10659ca8
push 0x1065a558
push 0x100084b8
call fcn.1004bcab
mov ecx, edi
add esp, 0x18
mov edi, dword [0x1065983c]
mov esi, ebx
mov dword [0x10659838], esi
cmp edi, 1
jl 0x1001a4f2
mov eax, ecx
cdq
idiv dword [0x1065a558]
test edx, edx
je 0x1001a4e2
mov eax, ecx
cdq
idiv dword [0x10659ca8]
test edx, edx
je 0x1001a4e2
mov eax, ecx
cdq
idiv dword [0x10659ca0]
test edx, edx
je 0x1001a4e2
mov eax, ecx
cdq
idiv dword [0x1065a55c]
test edx, edx
je 0x1001a4e2
mov eax, ebx
jmp 0x1001a4e5
xor eax, eax
inc eax
add esi, eax
inc ecx
cmp ecx, edi
jle 0x1001a4aa
mov dword [0x10659838], esi
push esi
push 0x10008460
call fcn.1004c43c
pop ecx
pop ecx
cmp byte [esp + 0x1b], bl
je 0x1001a519
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RealizePalette]
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], bl
je 0x1001a52b
push ebx
push ebx
call dword [sym.imp.USER32.dll_LoadCursorA]
dec dword [esp + 0x10]
mov esi, 0x100081a0
cmp dword [esp + 0x10], 0xffffffee
push 1
pop edi
jl 0x1001a34d
mov esi, dword [esp + 0xdc]
mov dword [esp + 0x10], 0x13a473eb
lea ecx, [esp + 0x1a8]
mov dword [esp + 0x20], 0x6986d6d
push 3
call fcn.1000a859
mov dword [esp + 0x20], ebx
mov dword [esp + 0x14], ebx
jmp 0x1001a581
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x70], 0x3072c02a
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x1001a571
mov dword [esp + 0x14], ebx
jmp 0x1001a5a3
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1a8]
mov dword [eax + ecx*4], 0x2377d64
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x1001a58d
mov eax, dword [esp + 0x10]
xor edx, edx
mov dword [esp + 0x20], 7
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x70], ecx
mov eax, dword [esp + 0x10]
cmp ecx, eax
setge dl
sub edx, 0x63d62a04
neg edx
sbb edx, edx
inc edx
cmp edx, dword [esp + 0x10]
jle 0x1001a5ea
mov eax, dword [esp + 0x70]
mov eax, dword [esp + 0x10]
xor edx, edx
mov ecx, dword [esp + 0x70]
mov eax, dword [esp + 0x10]
cmp eax, ecx
setle dl
xor eax, eax
cmp edx, 0xffffffff
setle al
mov dword [esp + 0x20], eax
cmp dword [esp + 0x1a8], ebx
je 0x1001a634
push dword [esp + 0x1a8]
call fcn.1004c0e7
pop ecx
mov dword [esp + 0x1a8], ebx
mov dword [esp + 0x1ac], ebx
mov dword [esp + 0x1b0], ebx
mov eax, dword [0x1076b800]
test al, 1
jne 0x1001a6d6
or eax, edi
mov dword [0x1076b800], eax
push ebx
mov dword [esp + 0x2c0], ebx
push ebx
mov dword [0x1076b7c0], ebx
mov dword [0x1076b7c4], ebx
call fcn.1001d67c
mov dword [0x1076b7c0], eax
mov dword [0x1076b7c8], ebx
mov dword [0x1076b7d0], ebx
mov byte [esp + 0x2bc], 2
mov ecx, 0x1076b7c8
mov dword [esp + 0x1d4], eax
lea eax, [esp + 0x1d4]
push eax
push 0x10
push ebx
lea eax, [esp + 0x1e8]
mov dword [0x1076b7dc], 0x3f800000
push eax
mov dword [0x1076b7cc], ebx
call fcn.1001d454
push 0x100667dd
mov dword [0x1076b7d4], 7
mov dword [0x1076b7d8], 8
call fcn.1004c012
or dword [esp + 0x2c0], 0xffffffff
pop ecx
push dword [esp + 0x1dc]
movdqa xmm0, xmmword [0x100087a0]
lea eax, [esp + 0x260]
push eax
lea eax, [esp + 0x254]
mov dword [esp + 0xd4], ebx
push eax
push ebx
lea ecx, [esp + 0xdc]
mov dword [esp + 0xe0], ebx
movdqu xmmword [esp + 0x25c], xmm0
mov dword [esp + 0xe4], ebx
call fcn.1000ea01
mov dword [esp + 0x2c], 0x30a4ccfd
mov dword [esp + 0x2c], 0xfffffffd
mov dword [esp + 0x38], 0xfffd
mov dword [esp + 0x20], 0xae4f9dbc
mov dword [esp + 0x10], ebx
jmp 0x1001a759
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x244], 0x2f144811
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1001a746
mov edx, dword [esp + 0xcc]
xor eax, eax
cmp dword [edx + 0xc], edi
setg al
xor ecx, ecx
cmp eax, 0x3b28
setg cl
xor eax, eax
cmp ecx, 0xd5d7
setle al
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
add eax, 0x5c9e
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x248], eax
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x38]
mov ecx, dword [edx + 0xc]
push dword [esp + 0xcc]
sub ecx, eax
mov dword [esp + 0x24], ecx
call fcn.1004c0e7
imul eax, dword [esp + 0x60], 0x2710
mov dword [esp + 0xd0], ebx
mov dword [esp + 0xd4], ebx
mov dword [esp + 0xd8], ebx
pop ecx
add eax, esi
mov dword [esp + 0xe0], eax
mov dword [esp + 0x10], 0xfffffffc
mov dword [esp + 0x20], 6
mov dword [esp + 0x10], ebx
jmp 0x1001a80d
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x218], 0x6579763
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x1001a7fa
push 2
mov dword [esp + 0x14], ebx
pop edx
jmp 0x1001a85e
mov dword [esp + 0x30], ebx
mov dword [esp + 0x30], edx
cmp dword [esp + 0x30], ebx
jl 0x1001a844
mov dword [esp + 0x20], edi
mov eax, dword [esp + 0x10]
mov eax, dword [esp + eax*4 + 0x218]
mov dword [esp + 0x20], eax
dec dword [esp + 0x30]
jns 0x1001a82b
mov eax, dword [esp + 0x10]
mov ecx, 0x3292c5eb
mov eax, dword [esp + eax*4 + 0x218]
sub ecx, eax
mov dword [esp + 0x20], ecx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jle 0x1001a81d
lea eax, [esp + 0xe0]
push eax
call fcn.1001c5b2
mov eax, dword [eax]
test eax, eax
je 0x1001a8c5
mov dword [esp + 0x10], 0x4e2
inc dword [esp + 0x10]
mov dword [esp + 0x108], eax
mov dword [esp + 0x10], 0x17
jmp 0x1001a8b9
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001a8b1
push 0x1d17
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov eax, dword [esp + 0x10]
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xb
jle 0x1001a894
jmp 0x1001c1be
mov dword [esp + 0x14], 0x477862f
lea ecx, [esp + 0x160]
push 4
call fcn.1000a859
push 4
lea ecx, [esp + 0x94]
mov dword [esp + 0x2c0], 3
call fcn.1000a859
mov dword [esp + 0x14], ebx
jmp 0x1001a910
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x160]
mov dword [eax + ecx*4], 0x8974b666
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x1001a8fa
mov dword [esp + 0x14], ebx
jmp 0x1001a933
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x90]
mov dword [eax + ecx*4], 0xdf9c
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x1001a91d
mov dword [esp + 0x14], 0xffffffee
cmp dword [esp + 0x14], 0x17
jge 0x1001aa53
mov esi, dword [esp + 0x90]
mov dword [esp + 0x1c], 0xade2167f
mov dword [esp + 0x1c], 0x11151
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x30], 0x49f6d4a0
mov dword [esp + 0x10], 0xf14eb4c8
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], 0x1f3a
cmp dword [esp + 0x20], 0xc29
jge 0x1001a9e1
lea eax, [esp + 0x1ec]
push eax
lea eax, [esp + 0x1ec]
push eax
lea eax, [esp + 0xa4]
push eax
push 0x100084a8
call fcn.1004bcab
mov eax, dword [esp + 0x1f8]
add esp, 0x10
mov ecx, ebx
jmp 0x1001a9cb
imul eax, dword [esp + 0x1ec]
inc ecx
cmp eax, dword [esp + 0x9c]
jl 0x1001a9c2
push ecx
push 0x10008434
call fcn.1004c43c
pop ecx
pop ecx
inc dword [esi + 4]
mov dword [esp + 0x1c], 0x36de0184
mov dword [esp + 0x20], 0x5c2dd78f
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], 3
cmp dword [esp + 0x10], ebx
jl 0x1001aa44
mov dword [esp + 0x30], 3
cmp dword [esp + 0x30], ebx
jl 0x1001aa2c
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001aa26
push ebx
call dword [sym.imp.USER32.dll_SetCursor]
dec dword [esp + 0x30]
jns 0x1001aa14
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x90]
mov eax, dword [eax + ecx*4]
mov dword [esp + 0x20], eax
dec dword [esp + 0x10]
jns 0x1001aa06
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0x17
jl 0x1001a954
cmp dword [esp + 0x90], 0
je 0x1001aa7f
push dword [esp + 0x90]
call fcn.1004c0e7
pop ecx
mov dword [esp + 0x90], ebx
mov dword [esp + 0x94], ebx
mov dword [esp + 0x98], ebx
or dword [esp + 0x2bc], 0xffffffff
cmp dword [esp + 0x160], 0
je 0x1001aab3
push dword [esp + 0x160]
call fcn.1004c0e7
pop ecx
mov dword [esp + 0x160], ebx
mov dword [esp + 0x164], ebx
mov dword [esp + 0x168], ebx
mov eax, dword [0x1076b800]
test al, 2
jne 0x1001ab5a
or eax, 2
mov dword [0x1076b800], eax
push ebx
mov dword [esp + 0x2c0], 4
push ebx
mov dword [0x1076b7e0], ebx
mov dword [0x1076b7e4], ebx
call fcn.1001d67c
mov dword [0x1076b7e0], eax
mov dword [0x1076b7e8], ebx
mov dword [0x1076b7f0], ebx
mov byte [esp + 0x2bc], 6
mov ecx, 0x1076b7e8
mov dword [esp + 0x1e0], eax
lea eax, [esp + 0x1e0]
push eax
push 0x10
push ebx
lea eax, [esp + 0xe4]
mov dword [0x1076b7fc], 0x3f800000
push eax
mov dword [0x1076b7ec], ebx
call fcn.1001d454
push 0x100667d8
mov dword [0x1076b7f4], 7
mov dword [0x1076b7f8], 8
call fcn.1004c012
or dword [esp + 0x2c0], 0xffffffff
pop ecx
mov dword [esp + 0x14], edi
lea ecx, [esp + 0x190]
push 2
call fcn.1000a859
mov dword [esp + 0x2bc], 7
mov dword [esp + 0x10], ebx
jmp 0x1001ab93
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x190]
mov dword [eax + ecx*4], 0x7689
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1001ab7d
mov dword [esp + 0x14], ebx
jmp 0x1001ac86
push edi
lea ecx, [esp + 0xe8]
call fcn.1000a859
mov dword [esp + 0x10], edi
mov dword [esp + 0x10], ebx
jmp 0x1001abcc
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xe4]
mov dword [eax + ecx*4], edi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x1001abba
mov eax, dword [esp + 0xe4]
mov dword [eax], ebx
mov dword [esp + 0x10], ebx
jmp 0x1001abf0
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x1fc], edi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x1001abe1
mov dword [esp + 0x200], edi
cmp dword [esp + 0x200], ebx
jl 0x1001ac21
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001ac18
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
dec dword [esp + 0x200]
jns 0x1001ac07
mov eax, dword [esp + 0xe4]
inc dword [eax]
cmp dword [eax], edi
jle 0x1001abdb
mov dword [esp + 0x10], ebx
jmp 0x1001ac5a
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001ac52
push 0x1e2a
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetClassNameW]
mov eax, dword [esp + 0x10]
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jle 0x1001ac34
push dword [esp + 0xe4]
call fcn.1004c0e7
mov dword [esp + 0xe8], ebx
mov dword [esp + 0xec], ebx
mov dword [esp + 0xf0], ebx
inc dword [esp + 0x18]
pop ecx
cmp dword [esp + 0x14], 4
je 0x1001aba3
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001acb7
push ebx
push 0xafa
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointA]
or dword [esp + 0x2bc], 0xffffffff
cmp dword [esp + 0x190], 0
je 0x1001aceb
push dword [esp + 0x190]
call fcn.1004c0e7
pop ecx
mov dword [esp + 0x190], ebx
mov dword [esp + 0x194], ebx
mov dword [esp + 0x198], ebx
lea eax, [esp + 0x5c]
xorps xmm0, xmm0
push eax
movdqu xmmword [esp + 0x1c4], xmm0
call fcn.1001c614
push dword [esp + 0xd8]
xorps xmm0, xmm0
mov dword [esp + 0x88], ebx
lea ecx, [esp + 0x88]
mov dword [esp + 0x8c], ebx
mov edi, dword [eax]
mov eax, 0xa5c62e08
mov dword [esp + 0x14], 2
mov dword [esp + 0x10c], eax
mov dword [esp + 0x110], eax
mov dword [esp + 0x114], eax
mov dword [esp + 0x118], eax
lea eax, [esp + 0x280]
push eax
lea eax, [esp + 0x274]
mov dword [esp + 0x38], edi
push eax
push ebx
movdqu xmmword [esp + 0x27c], xmm0
mov dword [esp + 0x9c], ebx
call fcn.1000ea01
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], ebx
jmp 0x1001ada7
mov dword [esp + 0x20], 0x398070ad
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001ad9d
push 0xd9e
call dword [sym.imp.GDI32.dll_GetStockObject]
cmp dword [esp + 0x20], ebx
jne 0x1001adae
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x11
jge 0x1001ad7f
mov dword [esp + 0x10], 3
cmp dword [esp + 0x10], ebx
jl 0x1001add7
mov dword [esp + 0x20], 0x9ba095a9
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x84]
mov dword [eax], ecx
dec dword [esp + 0x10]
jns 0x1001adbc
cmp dword [esp + 0x84], 0
je 0x1001ae03
push dword [esp + 0x84]
call fcn.1004c0e7
pop ecx
mov dword [esp + 0x84], ebx
mov dword [esp + 0x88], ebx
mov dword [esp + 0x8c], ebx
mov al, byte [ebp + 0xc]
test al, al
jne 0x1001ae12
test edi, edi
jne 0x1001b131
lea ecx, [esp + 0x2a0]
mov dl, al
push ecx
mov ecx, dword [esp + 0x60]
call fcn.10010558
mov esi, eax
lea edi, [esp + 0x1c4]
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [esp + 0x14], 0xea5d6c05
mov dword [esp + 0x14], 0x14
jmp 0x1001ae7a
mov dword [esp + 0x10], 0xeede0b40
mov dword [esp + 0x10], 0x12
jmp 0x1001ae6f
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001ae6b
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xffffffff
jne 0x1001ae57
dec dword [esp + 0x14]
cmp dword [esp + 0x14], 0x11
jg 0x1001ae45
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001ae92
call dword [sym.imp.GDI32.dll_GdiFlush]
cmp byte [ebp + 0xc], 0
je 0x1001b12d
cmp dword [esp + 0x1c8], 0
je 0x1001b12d
mov dword [esp + 0x20], 0x2474
cmp dword [esp + 0x20], 0x102d
jge 0x1001af20
lea eax, [esp + 0x80]
push eax
push 0x10008430
call fcn.1004bcab
mov eax, dword [esp + 0x88]
pop ecx
pop ecx
test al, 1
je 0x1001aeed
push 0x1000848c
call fcn.1004c236
mov eax, dword [esp + 0x84]
pop ecx
test eax, eax
jle 0x1001af15
push 2
pop esi
lea eax, [esi - 1]
push eax
push esi
push 0x100084c8
call fcn.1004c43c
add esi, 2
add esp, 0xc
lea eax, [esi - 2]
cmp eax, dword [esp + 0x80]
jl 0x1001aef4
push 0x100080ed
call fcn.1004c236
pop ecx
push 1
lea ecx, [esp + 0x78]
call fcn.1000a859
push 2
lea ecx, [esp + 0x134]
mov dword [esp + 0x2c0], 8
call fcn.1000a859
mov dword [esp + 0x2c], 0xbc0d133f
mov dword [esp + 0x20], 0x6dabac8e
mov dword [esp + 0x14], ebx
jmp 0x1001af69
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x178], ebx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x1001af5a
mov dword [esp + 0x14], ebx
jmp 0x1001af86
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x74]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 1
jl 0x1001af76
push 2
mov dword [esp + 0x18], ebx
pop edx
jmp 0x1001afac
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x130]
mov dword [eax + ecx*4], 0xffff
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x1001af96
mov eax, dword [esp + 0x74]
mov edi, dword [esp + 0x130]
mov dword [eax], edx
mov dword [esp + 0x34], 0xc9b780f8
mov dword [esp + 0x2c], 0x5604491d
mov dword [esp + 0x10], ebx
jmp 0x1001afe8
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x288], 4
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x1001afd5
xor eax, eax
cmp dword [edi + 4], 0xfffffff6
setg al
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x74]
mov eax, dword [eax]
mov eax, dword [esp + eax*4 + 0x178]
mov ecx, dword [esp + 0x178]
add eax, 0xc8dd
imul ecx, eax
test ecx, ecx
je 0x1001b027
cmp dword [esp + 0x34], ebx
je 0x1001b027
xor edx, edx
inc edx
jmp 0x1001b029
mov edx, ebx
mov eax, dword [esp + 0x74]
xor ecx, ecx
mov eax, dword [eax]
mov eax, dword [esp + eax*4 + 0x178]
cmp edx, eax
setne cl
add ecx, 0xa
jne 0x1001b04b
cmp dword [edi + 4], ebx
jne 0x1001b04b
mov ecx, ebx
jmp 0x1001b04e
xor ecx, ecx
inc ecx
mov eax, dword [esp + 0x34]
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x28c]
setl dl
xor ecx, ecx
imul edx, eax
mov eax, dword [esp + 0x74]
mov eax, dword [eax]
mov eax, dword [esp + eax*4 + 0x178]
cmp eax, edx
sete cl
xor eax, eax
cmp ecx, 0xbefa
setle al
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x74]
mov eax, dword [eax]
mov eax, dword [esp + eax*4 + 0x178]
mov ecx, dword [esp + 0x2c]
sub eax, dword [edi + 4]
add ecx, eax
mov eax, dword [esp + 0x74]
mov eax, dword [eax]
mov dword [esp + eax*4 + 0x178], ecx
mov eax, dword [esp + 0x34]
mov esi, dword [esp + 0x74]
mov dword [esp + 0x20], 0xff57440e
dec dword [esi]
jns 0x1001afbf
push dword [esp + 0x130]
xor ecx, ecx
cmp dword [edi + 4], ebx
setne cl
xor eax, eax
cmp ecx, dword [esi]
setg al
mov dword [esp + 0x30], eax
call fcn.1004c0e7
or dword [esp + 0x2c0], 0xffffffff
pop ecx
push esi
mov dword [esp + 0x134], ebx
mov dword [esp + 0x138], ebx
mov dword [esp + 0x13c], ebx
call fcn.1004c0e7
mov eax, dword [esp + 0x1d0]
mov dword [esp + 0x110], eax
mov eax, dword [esp + 0x1cc]
pop ecx
mov dword [esp + 0x74], ebx
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], ebx
mov dword [esp + 0x110], eax
mov edi, dword [esp + 0x30]
mov dword [esp + 0x10], 0x25b9b55b
mov dword [esp + 0x10], ebx
jmp 0x1001b152
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x294], 0xfff7
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x1001b13f
mov dword [esp + 0x10], 0x18
jmp 0x1001b196
mov dword [esp + 0x14], 0x417be187
mov dword [esp + 0x20], 0xfffffffa
cmp dword [esp + 0x10], ebx
jne 0x1001b19d
mov dword [esp + 0x14], ebx
jmp 0x1001b18b
mov dword [esp + 0x20], 0x358bd4df
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jle 0x1001b17f
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xffffffe6
je 0x1001b163
test edi, edi
jne 0x1001bd24
cmp dword [esp + 0x1c0], edi
jle 0x1001bd24
push dword [esp + 0xd8]
movdqa xmm0, xmmword [0x10008800]
lea eax, [esp + 0x270]
push eax
lea eax, [esp + 0x264]
mov dword [esp + 0xa8], ebx
push eax
push ebx
lea ecx, [esp + 0xb0]
mov dword [esp + 0xb4], ebx
movdqu xmmword [esp + 0x26c], xmm0
mov dword [esp + 0xb8], ebx
call fcn.1000ea01
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001b20e
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esp + 0xa0]
mov dword [eax], ebx
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001b235
push ebx
push ebx
push 0x265d
push 0x1d8f
push ebx
call dword [sym.imp.USER32.dll_InsertMenuA]
mov eax, dword [esp + 0xa0]
dec dword [eax]
cmp dword [eax], 0xffffffe5
jg 0x1001b217
push eax
call fcn.1004c0e7
pop ecx
mov dword [esp + 0xa0], ebx
lea ecx, [esp + 0xb0]
mov dword [esp + 0xa4], ebx
mov dword [esp + 0xa8], ebx
mov dword [esp + 0x3c], 0xfffffffc
mov dword [esp + 0x28], 0xe57bf5cd
mov dword [esp + 0x10], 0x166941fc
push 2
call fcn.1000a859
mov dword [esp + 0x2bc], 9
lea ecx, [esp + 0x184]
mov dword [esp + 0x34], 0xb8f3be
mov dword [esp + 0x38], 0xfffffff9
push 3
call fcn.1000a859
mov byte [esp + 0x2bc], 0xa
lea ecx, [esp + 0x16c]
mov dword [esp + 0x2c], 0x979e
mov dword [esp + 0x20], 6
push 3
call fcn.1000a859
mov byte [esp + 0x2bc], 0xb
mov dword [esp + 0x24], 0x37fb3419
mov dword [esp + 0x1c], 0x5446388d
mov dword [esp + 0x14], ebx
jmp 0x1001b308
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xb0]
mov dword [eax + ecx*4], 0xfffffff6
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x1001b2f2
mov dword [esp + 0x14], ebx
jmp 0x1001b327
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x184]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x1001b315
mov dword [esp + 0x14], ebx
jmp 0x1001b346
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x16c]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x1001b334
cmp dword [esp + 0x3c], ebx
je 0x1001b367
cmp dword [esp + 0x3c], 0xfff8
sbb eax, eax
inc eax
mov dword [esp + 0x28], eax
jmp 0x1001b4c6
mov dword [esp + 0x3c], 0x7a6deec5
lea ecx, [esp + 0x154]
mov dword [esp + 0x44], 4
xor esi, esi
mov dword [esp + 0x40], ebx
inc esi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], 6
mov dword [esp + 0x24], 0x3e75cb55
mov dword [esp + 0x1c], esi
mov dword [esp + 0x4c], esi
push 2
call fcn.1000a859
mov dword [esp + 0x1c], 0xfff8
mov dword [esp + 0x14], ebx
jmp 0x1001b3c9
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x234], 0xfffffff6
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x1001b3b6
mov dword [esp + 0x14], ebx
jmp 0x1001b3e9
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x154]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x1001b3d6
dec dword [esp + 0x24]
mov eax, dword [esp + 0xb0]
cmp dword [eax + 4], ebx
je 0x1001b429
mov eax, dword [esp + 0x234]
mov eax, dword [esp + 0x40]
mov eax, dword [esp + 0x23c]
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x23c]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov edx, dword [esp + 0x4c]
mov eax, dword [esp + 0x3c]
neg edx
cmp edx, eax
setl cl
cmp ecx, dword [esp + 0x44]
jge 0x1001b44c
mov edx, ebx
cmp dword [esp + 0x24], ebx
je 0x1001b44e
mov edx, esi
inc dword [esp + 0x38]
xor ecx, ecx
mov eax, dword [esp + 0x154]
mov dword [eax + 4], edx
mov eax, dword [esp + 0x40]
cmp edx, eax
mov eax, dword [esp + 0xb0]
setl cl
cmp ecx, 0xffffffff
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, dword [eax]
mov eax, dword [esp + 0x24]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x38]
setl cl
xor edx, edx
cmp eax, ecx
setl dl
imul edx, dword [esp + 0x1c]
sub edx, dword [esp + 0x10]
push dword [esp + 0x154]
neg edx
sbb edx, edx
inc edx
mov dword [esp + 0x24], edx
call fcn.1004c0e7
pop ecx
mov dword [esp + 0x154], ebx
mov dword [esp + 0x158], ebx
mov dword [esp + 0x15c], ebx
mov edi, dword [esp + 0xb0]
xor ecx, ecx
mov eax, dword [edi + 4]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x34]
sub edx, 0x4337ce8c
imul edx, dword [edi + 4]
cmp edx, eax
setle cl
xor edx, edx
cmp ecx, dword [edi + 4]
mov dword [esp + 0x10], 0x4896
mov esi, dword [esp + 0x10]
sete dl
mov eax, dword [esp + 0x184]
xor ecx, ecx
mov dword [eax + 8], esi
mov eax, dword [esp + 0x2c]
cmp edx, eax
setge cl
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x16c]
imul ecx, esi
mov dword [eax + 8], ecx
xor eax, eax
cmp ecx, 0xc562
setne al
xor edx, edx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
cmp eax, 3
mov eax, dword [esp + 0x34]
setle dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [esp + 0x34]
setle cl
cmp ecx, 1
sbb ecx, ecx
neg ecx
imul ecx, dword [edi + 4]
imul eax, ecx
mov dword [edi + 4], eax
test eax, eax
jne 0x1001b580
cmp dword [esp + 0x24], ebx
jne 0x1001b580
mov eax, ebx
jmp 0x1001b583
xor eax, eax
inc eax
push dword [esp + 0x16c]
mov dword [esp + 0x20], eax
call fcn.1004c0e7
pop ecx
push dword [esp + 0x184]
mov dword [esp + 0x170], ebx
mov dword [esp + 0x174], ebx
mov dword [esp + 0x178], ebx
call fcn.1004c0e7
or dword [esp + 0x2c0], 0xffffffff
pop ecx
push dword [esp + 0xb0]
mov dword [esp + 0x188], ebx
mov dword [esp + 0x18c], ebx
mov dword [esp + 0x190], ebx
call fcn.1004c0e7
mov dword [esp + 0xb4], ebx
mov dword [esp + 0xb8], ebx
mov dword [esp + 0xbc], ebx
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x2c], 8
mov dword [esp + 0x20], 0xffffffff
pop ecx
mov dword [esp + 0x10], ebx
jmp 0x1001b623
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x50], 0xfff6
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x1001b613
mov dword [esp + 0x10], ebx
jmp 0x1001b727
mov dword [esp + 0x14], 0xfffffffb
mov dword [esp + 0x14], 2
cmp dword [esp + 0x14], ebx
jl 0x1001b723
mov dword [esp + 0x1c], 0xffffffff
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001b67b
push ebx
push 0xafa
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointA]
mov eax, dword [esp + 0x14]
cmp dword [esp + eax*4 + 0x50], ebx
je 0x1001b6ff
mov eax, dword [esp + 0x14]
xor edx, edx
mov eax, dword [esp + eax*4 + 0x50]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + eax*4 + 0x50]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + eax*4 + 0x50]
mov eax, dword [esp + 0x50]
cmp eax, ecx
mov eax, dword [esp + 0x14]
mov ecx, 0xc556123d
setge dl
mov esi, dword [esp + eax*4 + 0x50]
mov eax, dword [esp + 0x10]
sub eax, edx
cmp ecx, eax
sbb eax, eax
xor ecx, ecx
neg eax
cmp esi, eax
mov eax, dword [esp + 0x50]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x14]
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
add ecx, 0xfffb
jne 0x1001b6ee
mov eax, dword [esp + 0x14]
mov eax, dword [esp + eax*4 + 0x50]
cmp dword [esp + 0x50], 1
sbb eax, eax
inc eax
neg eax
je 0x1001b6ff
xor edx, edx
inc edx
jmp 0x1001b701
mov edx, ebx
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov eax, dword [esp + eax*4 + 0x50]
cmp edx, eax
setne cl
imul ecx, dword [esp + 0x14]
mov dword [esp + 0x1c], ecx
dec dword [esp + 0x14]
jns 0x1001b64d
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jle 0x1001b633
mov eax, dword [esp + 0x54]
mov eax, dword [esp + 0x10]
sub eax, dword [esp + 0x10]
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x10], eax
je 0x1001b759
cmp dword [esp + 0x54], ebx
je 0x1001b759
cmp dword [esp + 0x10], ebx
je 0x1001b759
mov ecx, ebx
jmp 0x1001b75c
xor ecx, ecx
inc ecx
mov eax, dword [esp + 0x50]
xor edx, edx
imul eax, ecx
mov ecx, dword [esp + 0x50]
cmp eax, 0xb56bf5ee
mov eax, dword [esp + 0x28]
setne dl
imul ecx, edx
imul eax, ecx
imul eax, eax, 0x1efe
cmp eax, dword [esp + 0x58]
jle 0x1001b78b
mov eax, dword [esp + 0x50]
cmp dword [esp + 0x10], ebx
jne 0x1001b79b
cmp dword [esp + 0x28], ebx
jne 0x1001b79b
mov ecx, ebx
jmp 0x1001b79e
xor ecx, ecx
inc ecx
xor eax, eax
cmp ecx, 0x8360
sete al
xor edx, edx
cmp eax, 0x979f
mov eax, dword [esp + 0x28]
setge dl
xor ecx, ecx
cmp edx, eax
setge cl
neg ecx
mov dword [esp + 0x28], ecx
mov eax, dword [esp + 0x28]
cmp dword [esp + 0x1c4], 0
mov dword [esp + 0x1c], eax
je 0x1001bd24
mov dword [esp + 0x1c], 0x197f
cmp dword [esp + 0x1c], 0xd04
jge 0x1001b872
lea eax, [esp + 0x60]
push eax
push 0x10008180
call fcn.1004bcab
jmp 0x1001b863
dec eax
mov dword [esp + 0x60], eax
lea eax, [esp + 0xac]
push eax
push 0x10008180
call fcn.1004bcab
pop ecx
pop ecx
mov ecx, dword [esp + 0xac]
mov edi, ebx
mov esi, ebx
test ecx, ecx
jle 0x1001b850
lea eax, [esp + 0x1d8]
push eax
push 0x10008180
call fcn.1004bcab
add edi, dword [esp + 0x1e0]
inc esi
pop ecx
pop ecx
mov ecx, dword [esp + 0xac]
cmp esi, ecx
jl 0x1001b829
lea eax, [ecx - 1]
add eax, edi
cdq
idiv ecx
push eax
push 0x10008434
call fcn.1004c43c
mov eax, dword [esp + 0x68]
pop ecx
pop ecx
test eax, eax
jne 0x1001b801
dec eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x10], 6
xor esi, esi
mov dword [esp + 0x1c], 0xfffffff7
inc esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x1c], 0xfffffff9
mov dword [esp + 0x1c], 0xfffffffb
mov dword [esp + 0x1c], esi
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x10], 0xf
jmp 0x1001b948
mov dword [esp + 0x1c], 0x3fbb4ebb
lea ecx, [esp + 0x124]
mov dword [esp + 0x1c], 0x3e63e315
push 4
call fcn.1000a859
mov dword [esp + 0x28], ebx
jmp 0x1001b8e8
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x124]
mov dword [eax + ecx*4], esi
inc dword [esp + 0x28]
cmp dword [esp + 0x28], 4
jl 0x1001b8d6
mov eax, dword [esp + 0x124]
dec dword [eax + 4]
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001b922
push 0xc25
push 0xd1b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
push dword [esp + 0x124]
call fcn.1004c0e7
mov dword [esp + 0x128], ebx
mov dword [esp + 0x12c], ebx
mov dword [esp + 0x130], ebx
inc dword [esp + 0x14]
pop ecx
cmp dword [esp + 0x10], 0x1d
jle 0x1001b8b2
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001b977
push ebx
push ebx
push 0x2603
push 0x1dbf
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ScrollWindow]
mov ecx, dword [esp + 0x1c4]
call fcn.1001a2b3
mov edi, eax
lea ecx, [esp + 0x1b4]
push 4
mov dword [esp + 0x34], edi
call fcn.1000a859
mov dword [esp + 0x2bc], 0xc
lea ecx, [esp + 0xfc]
mov dword [esp + 0x14], 0x1febaeef
mov dword [esp + 0x1c], 0xf6efba1a
push 3
call fcn.1000a859
mov byte [esp + 0x2bc], 0xd
mov dword [esp + 0x1c], 2
mov dword [esp + 0x28], 0xd55be984
mov dword [esp + 0x20], 0xf5b
mov dword [esp + 0x24], 0x56cf
mov dword [esp + 0x1c], esi
mov dword [esp + 0x10], ebx
jmp 0x1001ba08
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x1b4]
mov dword [eax + ecx*4], 0x7571
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x1001b9f2
mov dword [esp + 0x10], ebx
jmp 0x1001ba2b
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xfc]
mov dword [eax + ecx*4], 0x29989d22
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x1001ba15
mov dword [esp + 0x1c], 0x23f5
cmp dword [esp + 0x1c], 0xdaa
jge 0x1001baa7
lea eax, [esp + 0xbc]
push eax
push 0x10008180
call fcn.1004bcab
mov esi, ebx
pop ecx
pop ecx
cmp dword [esp + 0xbc], esi
jle 0x1001ba9c
mov ecx, esi
and ecx, 0x80000003
jns 0x1001ba72
dec ecx
or ecx, 0xfffffffc
inc ecx
inc ecx
and ecx, 0x80000003
jns 0x1001ba80
dec ecx
or ecx, 0xfffffffc
inc ecx
xor eax, eax
cmp ecx, 1
setg al
add eax, 0x61
push eax
call fcn.1004e00c
inc esi
pop ecx
cmp esi, dword [esp + 0xbc]
jl 0x1001ba63
push 0x100080ed
call fcn.1004c236
pop ecx
mov dword [esp + 0x14], 3
cmp dword [esp + 0x14], ebx
jl 0x1001bcb8
mov esi, dword [esp + 0xfc]
push 1
lea ecx, [esp + 0x1a0]
call fcn.1000a859
mov dword [esp + 0x40], 4
xor edx, edx
inc edx
mov dword [esp + 0x38], edx
mov dword [esp + 0x3c], 8
mov dword [esp + 0x1c], 0xc57e71f0
mov dword [esp + 0x1c], edx
mov dword [esp + 0x4c], 0x68a07c69
mov dword [esp + 0x34], 2
mov dword [esp + 0x44], ebx
mov dword [esp + 0x44], 0xfffffffd
mov dword [esp + 0x2c], 7
mov dword [esp + 0x10], ebx
jmp 0x1001bb2d
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x19c]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x1001bb1b
mov dword [esp + 0x10], ebx
jmp 0x1001bb4c
cmp dword [esp + 0xfc], 0
je 0x1001bce4
push dword [esp + 0xfc]
call fcn.1004c0e7
pop ecx
mov dword [esp + 0xfc], ebx
mov dword [esp + 0x100], ebx
mov dword [esp + 0x104], ebx
or dword [esp + 0x2bc], 0xffffffff
cmp dword [esp + 0x1b4], 0
je 0x1001bd18
push dword [esp + 0x1b4]
call fcn.1004c0e7
pop ecx
mov dword [esp + 0x1b4], ebx
mov dword [esp + 0x1b8], ebx
mov dword [esp + 0x1bc], ebx
lea eax, [esp + 0x5c]
push eax
call fcn.1001c614
mov dword [eax], edi
mov dword [esp + 0x28], 0xf0b101aa
lea ecx, [esp + 0xc0]
mov dword [esp + 0x44], 9
push 4
call fcn.1000a859
mov dword [esp + 0x10], ebx
jmp 0x1001bd58
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x64], 0xffffffff
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x1001bd48
mov dword [esp + 0x10], ebx
jmp 0x1001bd7b
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xc0]
mov dword [eax + ecx*4], 6
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x1001bd65
mov dword [esp + 0x64], ebx
cmp dword [esp + 0x64], 0xffffffe8
jge 0x1001bf97
mov edi, dword [esp + 0xc0]
mov dword [esp + 0x14], ebx
xor esi, esi
mov dword [esp + 0x2c], 0x40c09c4f
inc esi
mov dword [esp + 0x4c], 0xc132d45a
mov dword [esp + 0x24], ebx
jmp 0x1001bdc4
mov eax, dword [esp + 0x24]
mov dword [esp + eax*4 + 0x1d0], ebx
inc dword [esp + 0x24]
cmp dword [esp + 0x24], esi
jl 0x1001bdb5
mov dword [esp + 0x14], ebx
jmp 0x1001beb9
mov dword [esp + 0x10], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], 0x4e62b500
mov dword [esp + 0x10], 0xffffffe5
jmp 0x1001beaa
mov dword [esp + 0x24], ebx
jmp 0x1001be09
mov eax, dword [esp + 0x24]
mov dword [esp + eax*4 + 0x228], 0xefe0cd1b
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 3
jl 0x1001bdf6
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x28], ebx
je 0x1001be22
mov eax, dword [esp + 0x6c]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x64], 0xffffffff
jl 0x1001be39
mov edx, ebx
cmp dword [esp + 0x10], ebx
je 0x1001be3b
mov edx, esi
mov eax, dword [esp + 0x230]
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [esp + 0x20], ecx
mov ecx, 0x9b467bb1
mov eax, dword [esp + 0x20]
cmp ecx, eax
mov eax, dword [esp + 0x10]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [esp + 0x10]
setg dl
xor ecx, ecx
cmp edx, eax
setg cl
add ecx, dword [esp + 0x230]
je 0x1001be7f
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x28]
dec ecx
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0xffffffff
setl al
cmp eax, 0xfffffffd
mov eax, dword [esp + 0x64]
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
mov dword [esp + 0x1c], ecx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x11
jg 0x1001bdf0
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 9
je 0x1001bdd3
mov eax, dword [esp + 0x14]
mov ecx, esi
mov dword [esp + 0x1d0], eax
mov eax, dword [esp + 0x64]
mov eax, dword [esp + 0x28]
mov dword [esp + 0x2c], 0xc515
cmp dword [esp + 0x2c], ebx
jne 0x1001bee9
mov ecx, ebx
xor eax, eax
cmp ecx, 0xd326
setg al
cmp eax, dword [esp + 0x14]
je 0x1001bf02
mov edx, esi
cmp dword [esp + 0x28], ebx
jne 0x1001bf04
mov edx, ebx
mov eax, dword [esp + 0x44]
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x14]
setl cl
imul ecx, eax
mov dword [edi + 8], ecx
test ecx, ecx
je 0x1001bf23
cmp dword [esp + 0x14], ebx
jne 0x1001bf31
mov eax, dword [esp + 0xc0]
cmp dword [eax + 0xc], ebx
jne 0x1001bf31
mov esi, ebx
mov eax, dword [esp + 0x14]
xor edx, edx
add eax, dword [esp + 0x28]
cmp eax, 6
mov eax, dword [esp + 0x4c]
setl dl
xor ecx, ecx
cmp esi, eax
setge cl
sub ecx, dword [esp + 0x64]
mov eax, dword [esp + 0x64]
imul edx, ecx
mov dword [esp + 0x1c], edx
xor edx, edx
cmp dword [esp + 0x1c], eax
mov eax, dword [esp + 0x14]
sete dl
xor ecx, ecx
cmp edx, eax
mov eax, 0xffff
setne cl
cmp eax, ecx
mov eax, dword [esp + 0x14]
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setle cl
mov dword [esp + 0x14], ecx
dec dword [esp + 0x64]
cmp dword [esp + 0x64], 0xffffffe8
jl 0x1001bd98
cmp dword [esp + 0xc0], 0
je 0x1001bfc3
push dword [esp + 0xc0]
call fcn.1004c0e7
pop ecx
mov dword [esp + 0xc0], ebx
mov dword [esp + 0xc4], ebx
mov dword [esp + 0xc8], ebx
lea ecx, [esp + 0x1c0]
call fcn.1001727f
push 3
lea ecx, [esp + 0xf4]
call fcn.1000a859
mov dword [esp + 0x2bc], 0xe
mov dword [esp + 0x10], 0xe57ad95e
mov dword [esp + 0x10], ebx
jmp 0x1001c00c
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xf0]
mov dword [eax + ecx*4], 0x4e2db58e
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x1001bff6
xor edi, edi
mov dword [esp + 0x10], ebx
inc edi
jmp 0x1001c02f
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x1e4], 0x1ba028ea
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x1001c01c
mov dword [esp + 0x10], ebx
jmp 0x1001c051
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xf0]
mov dword [eax + ecx*4], 0xca0029bf
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x1001c03b
mov dword [esp + 0x10], 0xfffffff6
cmp dword [esp + 0x10], 0x13
jg 0x1001c11e
mov esi, 0xfffc
mov dword [esp + 0x208], esi
lea ecx, [esp + 0x148]
mov dword [esp + 0x20c], esi
mov dword [esp + 0x210], esi
mov dword [esp + 0x214], esi
push 2
call fcn.1000a859
mov dword [esp + 0x20], 0xfffffffb
mov dword [esp + 0x1c], edi
mov dword [esp + 0x24], ebx
jmp 0x1001c0c2
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x148]
mov dword [eax + ecx*4], 0xde9bf9f3
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 2
jl 0x1001c0ac
mov eax, dword [esp + 0x210]
mov eax, dword [esp + 0x148]
mov dword [eax + 4], edi
mov dword [esp + 0x20], edi
mov eax, dword [esp + 0x20]
push dword [esp + 0x148]
mov dword [esp + 0x1e8], eax
mov dword [esp + 0x20], eax
call fcn.1004c0e7
mov dword [esp + 0x14c], ebx
mov dword [esp + 0x150], ebx
mov dword [esp + 0x154], ebx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0x13
pop ecx
jle 0x1001c070
or dword [esp + 0x2bc], 0xffffffff
cmp dword [esp + 0xf0], 0
je 0x1001c152
push dword [esp + 0xf0]
call fcn.1004c0e7
pop ecx
mov dword [esp + 0xf0], ebx
mov dword [esp + 0xf4], ebx
mov dword [esp + 0xf8], ebx
mov ecx, dword [esp + 0x30]
test ecx, ecx
je 0x1001c17e
mov edx, dword [esp + 0xdc]
call fcn.1001a2f5
mov esi, eax
lea eax, [esp + 0xe0]
push eax
mov dword [esp + 0x10c], esi
call fcn.1001c5b2
mov dword [eax], esi
mov dword [esp + 0x30], ebx
jmp 0x1001c194
mov eax, dword [esp + 0x30]
mov dword [esp + eax*4 + 0x48], 0x1cecb457
inc dword [esp + 0x30]
cmp dword [esp + 0x30], edi
jl 0x1001c184
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x48]
mov eax, dword [esp + 0x48]
add eax, ecx
add dword [esp + 0x48], eax
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001c1be
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov eax, dword [ebp + 8]
lea esi, [esp + 0x108]
mov ecx, dword [esp + 0x2b4]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret