Function at 0x10165280
Capabilities:
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x10202f23
mov eax, dword fs:[0]
push eax
sub esp, 0x2a8
mov eax, dword [0x10293044]
xor eax, esp
mov dword [esp + 0x2a0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10293044]
xor eax, esp
push eax
lea eax, [esp + 0x2bc]
mov dword fs:[0], eax
mov eax, dword [esp + 0x2cc]
xor ebx, ebx
mov dword [esp + 0x74], ebx
mov esi, dword [eax + 0x230]
cmp esi, ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], esi
je 0x101652e2
mov eax, dword [esi]
mov edx, dword [eax]
mov ecx, esi
call edx
mov dword [esp + 0x2c4], ebx
cmp esi, ebx
je 0x101653a3
lea eax, [esi - 0x40]
cmp eax, ebx
mov dword [esp + 0x68], eax
je 0x1016530b
mov eax, dword [eax + 0x194]
cmp eax, ebx
je 0x1016530b
call fcn.10004550
call dword [sym.imp.USER32.dll_GetCapture]
test eax, eax
jne 0x10165382
call fcn.101a7380
mov ebp, dword [eax + 0x24]
cmp ebp, ebx
mov dword [esp + 0x7c], ebp
mov dword [esp + 0xa4], ebp
je 0x10165335
mov eax, dword [ebp]
mov edx, dword [eax]
mov ecx, ebp
call edx
mov byte [esp + 0x2c4], 1
cmp ebp, ebx
je 0x10165382
mov eax, dword [ebp]
mov edx, dword [eax + 0x28]
mov ecx, ebp
call edx
mov edi, eax
cmp edi, ebx
mov dword [esp + 0x50], edi
mov dword [esp + 0x84], edi
je 0x10165364
mov eax, dword [edi]
mov edx, dword [eax]
mov ecx, edi
call edx
mov byte [esp + 0x2c4], 2
cmp edi, ebx
jne 0x101653ac
mov byte [esp + 0x2c4], 0
mov eax, dword [ebp]
mov edx, dword [eax + 4]
mov ecx, ebp
call edx
mov dword [esp + 0x2c4], 0xffffffff
cmp esi, ebx
je 0x10166e53
mov eax, dword [esi]
mov edx, dword [eax + 4]
mov ecx, esi
call edx
jmp 0x10166e53
mov dword [esp + 0x68], ebx
jmp 0x1016530b
mov eax, dword [edi]
mov edx, dword [eax + 0x24]
mov ecx, edi
call edx
mov ebx, eax
test ebx, ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0xa8], ebx
je 0x101653ce
mov eax, dword [ebx]
mov edx, dword [eax]
mov ecx, ebx
call edx
mov byte [esp + 0x2c4], 3
test ebx, ebx
jne 0x1016541d
mov byte [esp + 0x2c4], 1
mov eax, dword [edi]
mov edx, dword [eax + 4]
mov ecx, edi
call edx
mov byte [esp + 0x2c4], bl
mov eax, dword [ebp]
mov edx, dword [eax + 4]
mov ecx, ebp
call edx
mov dword [esp + 0x2c4], 0xffffffff
test esi, esi
je 0x10166e53
mov eax, dword [esi]
mov edx, dword [eax + 4]
mov ecx, esi
call edx
jmp 0x10166e53
mov eax, dword [esp + 0x14]
add eax, 0x24
push eax
lea eax, [esp + 0x2d4]
call fcn.101725c0
xor ecx, ecx
mov dword [esp + 0x54], eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], ecx
mov byte [esp + 0x2c4], 4
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], ecx
mov byte [esp + 0x2c4], 5
mov ecx, eax
and ecx, 0x200
mov dword [esp + 0x70], 0xffffffff
mov dword [esp + 0x78], ecx
jne 0x101655cb
test eax, 0x400
jne 0x101655cb
test eax, 0x2000
je 0x101655b4
call fcn.101a7380
mov esi, dword [eax + 0x20]
test esi, esi
mov dword [esp + 0x7c], esi
je 0x101654a7
mov edx, dword [esi]
mov eax, dword [edx]
mov ecx, esi
call eax
mov byte [esp + 0x2c4], 9
test esi, esi
je 0x10165515
mov edx, 0x1023ea94
lea eax, [esp + 0x27c]
call fcn.10007690
mov bl, 0xa
mov byte [esp + 0x2c4], bl
lea ecx, [esp + 0x27c]
push ecx
push ecx
mov eax, esp
mov dword [eax], esi
mov edx, dword [esi]
mov eax, dword [edx]
mov ecx, esi
mov dword [esp + 0x64], esp
call eax
mov byte [esp + 0x2cc], 0xb
mov byte [esp + 0x2cc], bl
call fcn.1001aeb0
add esp, 8
mov byte [esp + 0x2c4], 9
lea ecx, [esp + 0x27c]
call fcn.10001dd0
mov ebx, dword [esp + 0x4c]
mov byte [esp + 0x2c4], 5
test esi, esi
je 0x1016552a
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
mov ecx, dword [esp + 0x14]
mov ecx, dword [ecx + 0x1bc]
test ecx, ecx
je 0x1016553f
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
call eax
mov byte [esp + 0x2c4], 4
lea esi, [esp + 0x3c]
call fcn.100a0ee0
mov byte [esp + 0x2c4], 3
lea esi, [esp + 0x20]
call fcn.100a0ee0
mov byte [esp + 0x2c4], 2
mov edx, dword [ebx]
mov eax, dword [edx + 4]
mov ecx, ebx
call eax
mov byte [esp + 0x2c4], 1
mov edx, dword [edi]
mov eax, dword [edx + 4]
mov ecx, edi
call eax
mov byte [esp + 0x2c4], 0
mov edx, dword [ebp]
mov eax, dword [edx + 4]
mov ecx, ebp
call eax
mov dword [esp + 0x2c4], 0xffffffff
cmp dword [esp + 0x1c], 0
je 0x10166e53
mov ecx, dword [esp + 0x1c]
jmp 0x10166e4c
test eax, 0x8000
jne 0x1016553f
test eax, 0x10000
je 0x1016568f
jmp 0x1016553f
call fcn.101a7380
mov esi, dword [eax + 0x20]
test esi, esi
mov dword [esp + 0x5c], esi
je 0x101655e3
mov edx, dword [esi]
mov eax, dword [edx]
mov ecx, esi
call eax
mov byte [esp + 0x2c4], 6
test esi, esi
je 0x1016564d
mov edx, 0x1023eacc
lea eax, [esp + 0x27c]
call fcn.10007690
mov bl, 7
mov byte [esp + 0x2c4], bl
lea ecx, [esp + 0x27c]
push ecx
push ecx
mov eax, esp
mov dword [eax], esi
mov edx, dword [esi]
mov eax, dword [edx]
mov ecx, esi
mov dword [esp + 0x60], esp
call eax
mov byte [esp + 0x2cc], 8
mov byte [esp + 0x2cc], bl
call fcn.1001aeb0
add esp, 8
mov byte [esp + 0x2c4], 6
lea ecx, [esp + 0x27c]
call fcn.10001dd0
mov byte [esp + 0x2c4], 5
test esi, esi
je 0x10165662
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
movzx ecx, byte [esp + 0x54]
mov edx, dword [esp + 0x14]
mov dword [esp + 0x70], ecx
mov ecx, dword [edx + 0x1bc]
test ecx, ecx
je 0x10165682
mov eax, dword [ecx]
mov edx, dword [eax + 0x38]
push 0
call edx
lea ebx, [esp + 0x70]
lea esi, [esp + 0x20]
call fcn.10029280
mov ecx, dword [esp + 0x14]
xor ebx, ebx
xor edi, edi
add ecx, 0x88
mov dword [esp + 0x6c], ecx
mov eax, dword [ecx + 4]
cmp eax, ebx
mov dword [esp + 0x38], edi
je 0x101656e0
mov ecx, dword [ecx + 8]
sub ecx, eax
mov eax, 0xa0a0a0a1
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jae 0x101656e0
lea ebx, [esp + 0x38]
lea esi, [esp + 0x3c]
call fcn.10029280
mov ecx, dword [esp + 0x6c]
add edi, 1
xor ebx, ebx
jmp 0x101656a1
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0x1ec]
cmp ecx, ebx
jne 0x1016578a
mov byte [esp + 0x2c4], 4
mov eax, dword [esp + 0x40]
cmp eax, ebx
je 0x1016570b
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov byte [esp + 0x2c4], 3
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x10165730
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x2c4], 2
mov ecx, dword [esp + 0x4c]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x2c4], 1
mov ecx, dword [esp + 0x50]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x2c4], 0
mov edx, dword [ebp]
mov eax, dword [edx + 4]
mov ecx, ebp
call eax
mov dword [esp + 0x2c4], 0xffffffff
mov ecx, dword [esp + 0x1c]
cmp ecx, ebx
jmp 0x10166e4a
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
push 0x204
call eax
push eax
call dword [sym.imp.USER32.dll_LoadMenuW]
mov esi, eax
cmp esi, ebx
mov dword [esp + 0x64], esi
jne 0x10165817
mov byte [esp + 0x2c4], 4
lea esi, [esp + 0x3c]
call fcn.100a0ee0
mov byte [esp + 0x2c4], 3
lea esi, [esp + 0x20]
call fcn.100a0ee0
mov byte [esp + 0x2c4], 2
mov ecx, dword [esp + 0x4c]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x2c4], 1
mov ecx, dword [esp + 0x50]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x2c4], 0
mov edx, dword [ebp]
mov eax, dword [edx + 4]
mov ecx, ebp
call eax
mov dword [esp + 0x2c4], 0xffffffff
mov ecx, dword [esp + 0x1c]
cmp ecx, ebx
jmp 0x10166e4a
push ebx
push esi
call dword [sym.imp.USER32.dll_GetSubMenu]
cmp eax, ebx
mov dword [esp + 0x5c], eax
jne 0x10165833
push esi
call dword [sym.imp.USER32.dll_DestroyMenu]
jmp 0x101657a7
mov ecx, dword [esp + 0x24]
cmp ecx, ebx
mov dword [esp + 0x38], ebx
je 0x10165b22
mov eax, dword [esp + 0x28]
sub eax, ecx
sar eax, 2
cmp eax, 1
jne 0x10165b22
cmp eax, ebx
ja 0x10165863
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x14]
mov ecx, dword [ecx]
mov edx, dword [eax + 0x1d8]
mov edx, dword [edx + 0x8c]
add eax, 0x1d8
push ecx
mov ecx, eax
mov dword [esp + 0x64], eax
call edx
mov esi, eax
cmp esi, ebx
mov dword [esp + 0x58], esi
mov dword [esp + 0x80], esi
je 0x1016589c
mov eax, dword [esi]
mov edx, dword [eax]
mov ecx, esi
call edx
mov byte [esp + 0x2c4], 0xc
cmp esi, ebx
jne 0x101658b5
mov byte [esp + 0x2c4], 5
jmp 0x10165b22
mov esi, dword [esp + 0x58]
mov eax, dword [esi]
mov edx, dword [eax + 0x28]
lea ecx, [esp + 0x298]
push ecx
mov ecx, esi
call edx
mov bl, 0xd
mov byte [esp + 0x2c4], bl
cmp dword [esp + 0x2ac], 0
jne 0x10165907
mov byte [esp + 0x2c4], 0xc
lea ecx, [esp + 0x298]
call fcn.10001dd0
mov byte [esp + 0x2c4], 5
mov eax, dword [esi]
mov edx, dword [eax + 4]
mov ecx, esi
call edx
jmp 0x10165b22
lea eax, [esp + 0x88]
push eax
lea ecx, [esp + 0x29c]
call fcn.101aaec0
add esp, 4
mov byte [esp + 0x2c4], 0xe
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0x2a0]
call fcn.10007880
mov byte [esp + 0x2c4], bl
lea ecx, [esp + 0x88]
call fcn.10001dd0
mov dword [esp + 0x38], 1
xor edi, edi
mov ecx, dword [esp + 0x6c]
mov eax, dword [ecx + 4]
test eax, eax
je 0x10165ad3
mov ecx, dword [ecx + 8]
sub ecx, eax
mov eax, 0xa0a0a0a1
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jae 0x10165ad3
mov eax, dword [esp + 0x24]
test eax, eax
je 0x10165995
mov ecx, dword [esp + 0x28]
sub ecx, eax
sar ecx, 2
jne 0x1016599b
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov edx, dword [esp + 0x24]
cmp edi, dword [edx]
je 0x10165ac7
mov ecx, dword [esp + 0x60]
mov eax, dword [ecx]
mov edx, dword [eax + 0x8c]
push edi
call edx
mov esi, eax
test esi, esi
mov dword [esp + 0x30], esi
je 0x101659c8
mov eax, dword [esi]
mov edx, dword [eax]
mov ecx, esi
call edx
mov byte [esp + 0x2c4], 0xf
test esi, esi
jne 0x101659e7
mov byte [esp + 0x2c4], bl
mov esi, dword [esp + 0x58]
add edi, 1
jmp 0x10165953
mov eax, dword [esi]
mov edx, dword [eax + 0x28]
lea ecx, [esp + 0x27c]
push ecx
mov ecx, esi
call edx
mov byte [esp + 0x2c4], 0x10
cmp dword [esp + 0x290], 0
jne 0x10165a3a
mov byte [esp + 0x2c4], 0xf
lea ecx, [esp + 0x27c]
call fcn.10001dd0
mov byte [esp + 0x2c4], bl
mov eax, dword [esi]
mov edx, dword [eax + 4]
mov ecx, esi
call edx
mov esi, dword [esp + 0x58]
add edi, 1
jmp 0x10165953
lea eax, [esp + 0x88]
push eax
lea ecx, [esp + 0x280]
call fcn.101aaec0
add esp, 4
mov byte [esp + 0x2c4], 0x11
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0x284]
call fcn.10007880
mov byte [esp + 0x2c4], 0x10
lea ecx, [esp + 0x88]
call fcn.10001dd0
cmp dword [esp + 0x290], 0
je 0x10165aa3
lea eax, [esp + 0x27c]
lea ecx, [esp + 0x298]
call fcn.1019c570
test al, al
je 0x10165aa3
add dword [esp + 0x38], 1
mov byte [esp + 0x2c4], 0xf
lea ecx, [esp + 0x27c]
call fcn.10001dd0
mov byte [esp + 0x2c4], bl
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
mov esi, dword [esp + 0x58]
add edi, 1
jmp 0x10165953
mov byte [esp + 0x2c4], 0xc
cmp dword [esp + 0x2b0], 8
jb 0x10165af5
mov ecx, dword [esp + 0x29c]
push ecx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
xor eax, eax
mov dword [esp + 0x2b0], 7
mov dword [esp + 0x2ac], eax
mov word [esp + 0x29c], ax
mov byte [esp + 0x2c4], 5
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
mov ebx, dword [esp + 0x4c]
mov edx, dword [ebx]
mov eax, dword [edx + 0x64]
mov ecx, ebx
call eax
test al, al
je 0x10165bdb
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test al, al
js 0x10165bdb
cmp dword [esp + 0x78], 0
jne 0x10165b5c
test dword [esp + 0x54], 0x400
je 0x10165bdb
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 0x1d8]
mov edx, dword [edx + 0x48]
add ecx, 0x1d8
push 1
lea eax, [esp + 0x24]
push eax
call edx
mov eax, dword [esp + 0x64]
push eax
call dword [sym.imp.USER32.dll_DestroyMenu]
mov byte [esp + 0x2c4], 4
lea esi, [esp + 0x3c]
call fcn.100a0ee0
mov byte [esp + 0x2c4], 3
lea esi, [esp + 0x20]
call fcn.100a0ee0
mov byte [esp + 0x2c4], 2
mov edx, dword [ebx]
mov eax, dword [edx + 4]
mov ecx, ebx
call eax
mov byte [esp + 0x2c4], 1
mov ecx, dword [esp + 0x50]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x2c4], 0
mov edx, dword [ebp]
mov ecx, ebp
jmp 0x10166e34
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x70]
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x64]
push ecx
push edx
push esi
call fcn.10167720
mov ecx, dword [esi + 4]
lea eax, [esp + 0x2d0]
push eax
push ecx
call dword [sym.imp.USER32.dll_ClientToScreen]
call fcn.101a7380
mov esi, dword [eax + 0x1c]
test esi, esi
mov dword [esp + 0x58], esi
je 0x10165c2c
mov edx, dword [esi]
mov eax, dword [edx + 0x10]
mov ecx, esi
call eax
mov ebx, eax
test ebx, ebx
mov dword [esp + 0x54], ebx
jne 0x10165cd1
mov ecx, dword [esp + 0x64]
push ecx
call dword [sym.imp.USER32.dll_DestroyMenu]
mov byte [esp + 0x2c4], 4
mov eax, dword [esp + 0x40]
xor esi, esi
cmp eax, esi
je 0x10165c52
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], esi
mov dword [esp + 0x48], esi
mov byte [esp + 0x2c4], 3
mov eax, dword [esp + 0x24]
cmp eax, esi
je 0x10165c77
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], esi
mov byte [esp + 0x2c4], 2
mov ecx, dword [esp + 0x4c]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x2c4], 1
mov ecx, dword [esp + 0x50]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x2c4], 0
mov edx, dword [ebp]
mov eax, dword [edx + 4]
mov ecx, ebp
call eax
mov dword [esp + 0x2c4], 0xffffffff
mov ecx, dword [esp + 0x1c]
cmp ecx, esi
jmp 0x10166e4a
mov edx, dword [ebx]
mov eax, dword [esp + 0x5c]
mov edx, dword [edx]
push eax
mov ecx, ebx
call edx
test al, al
jne 0x10165d51
mov eax, dword [esi]
mov edx, dword [eax + 0x14]
push ebx
mov ecx, esi
call edx
mov eax, dword [esp + 0x64]
push eax
call dword [sym.imp.USER32.dll_DestroyMenu]
mov byte [esp + 0x2c4], 4
lea esi, [esp + 0x3c]
call fcn.100a0ee0
mov byte [esp + 0x2c4], 3
lea esi, [esp + 0x20]
call fcn.100a0ee0
mov byte [esp + 0x2c4], 2
mov ecx, dword [esp + 0x4c]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x2c4], 1
mov ecx, dword [esp + 0x50]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x2c4], 0
mov edx, dword [ebp]
mov ecx, ebp
jmp 0x10166e34
mov ecx, dword [esp + 0x14]
mov ebp, dword [ecx + 0x21c]
test ebp, ebp
mov dword [esp + 0x38], ebp
je 0x10165d6c
mov edx, dword [ebp]
mov eax, dword [edx]
mov ecx, ebp
call eax
mov byte [esp + 0x2c4], 0x12
xor esi, esi
xor edi, edi
test ebp, ebp
je 0x10165dc0
mov edx, dword [ebp]
mov eax, dword [edx + 0x18]
push 0x2d
mov ecx, ebp
call eax
mov edx, dword [ebp]
mov esi, eax
mov eax, dword [edx + 0x1c]
push 0x3b
mov ecx, ebp
call eax
mov edx, dword [ebx]
push esi
push 0
mov edi, eax
mov eax, dword [edx + 0xa4]
push 0x9cab
mov ecx, ebx
call eax
mov edx, dword [ebx]
mov eax, dword [edx + 0xac]
push edi
push 0
push 0x9cab
mov ecx, ebx
call eax
mov ebx, dword [esp + 0x54]
push ebx
call fcn.10169540
mov eax, dword [esp + 0x2d4]
mov ecx, dword [esp + 0x2d0]
mov edx, dword [ebx]
mov edx, dword [edx + 0x10]
push 0
push 5
push eax
mov eax, dword [esp + 0x20]
push ecx
mov ecx, dword [eax + 4]
push ecx
mov ecx, ebx
call edx
test esi, esi
mov ebp, dword [sym.imp.USER32.dll_DestroyIcon]
mov ebx, eax
je 0x10165dfe
push esi
call ebp
test edi, edi
je 0x10165e05
push edi
call ebp
cmp ebx, 0x9d53
jg 0x101668f7
je 0x10166871
add ebx, 0xffff63bd
cmp ebx, 0xbc
ja case.0x10165e30.40004
movzx eax, byte [ebx + 0x10166eb0]
jmp dword [eax*4 + 0x10166e80]
call fcn.101a7380
mov esi, dword [eax + 0x20]
test esi, esi
mov dword [esp + 0x30], esi
je 0x10165e4f
mov edx, dword [esi]
mov eax, dword [edx]
mov ecx, esi
call eax
mov byte [esp + 0x2c4], 0x13
test esi, esi
je 0x10165eb9
mov edx, 0x1023ead4
lea eax, [esp + 0x12c]
call fcn.10007690
mov bl, 0x14
mov byte [esp + 0x2c4], bl
lea ecx, [esp + 0x12c]
push ecx
push ecx
mov eax, esp
mov dword [eax], esi
mov edx, dword [esi]
mov eax, dword [edx]
mov ecx, esi
mov dword [esp + 0x20], esp
call eax
mov byte [esp + 0x2cc], 0x15
mov byte [esp + 0x2cc], bl
call fcn.1001aeb0
add esp, 8
mov byte [esp + 0x2c4], 0x13
lea ecx, [esp + 0x12c]
call fcn.10001dd0
mov byte [esp + 0x2c4], 0x12
test esi, esi
je 0x10165ece
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
mov ecx, dword [esp + 0x68]
test ecx, ecx
je 0x10165eff
mov edx, dword [ecx + 0x40]
mov edx, dword [edx + 0x10]
add ecx, 0x40
lea eax, [esp + 0x5c]
push eax
call edx
mov byte [esp + 0x2c4], 0x16
cmp dword [eax], 0
mov dword [esp + 0x74], 1
je 0x10165eff
mov bl, 1
jmp 0x10165f01
xor bl, bl
mov dword [esp + 0x2c4], 0x12
test byte [esp + 0x74], 1
je 0x10165f27
mov ecx, dword [esp + 0x5c]
and dword [esp + 0x74], 0xfffffffe
test ecx, ecx
je 0x10165f27
mov eax, dword [ecx]
mov edx, dword [eax + 4]
call edx
test bl, bl
je case.0x10165e30.40004
mov ecx, dword [esp + 0x68]
mov eax, dword [ecx + 0x40]
mov eax, dword [eax + 0x10]
add ecx, 0x40
lea edx, [esp + 0x78]
push edx
call eax
mov byte [esp + 0x2c4], 0x17
mov ecx, dword [eax]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
push 0
push 0x9c43
push 0x111
call eax
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov byte [esp + 0x2c4], 0x12
mov ecx, dword [esp + 0x78]
test ecx, ecx
je case.0x10165e30.40004
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
jmp case.0x10165e30.40004
call fcn.101a7380
mov esi, dword [eax + 0x20]
test esi, esi
mov dword [esp + 0x30], esi
je 0x10165f9f
mov edx, dword [esi]
mov eax, dword [edx]
mov ecx, esi
call eax
mov byte [esp + 0x2c4], 0x18
test esi, esi
je 0x10166009
mov edx, 0x1023eadc
lea eax, [esp + 0x180]
call fcn.10007690
mov bl, 0x19
mov byte [esp + 0x2c4], bl
lea ecx, [esp + 0x180]
push ecx
push ecx
mov eax, esp
mov dword [eax], esi
mov edx, dword [esi]
mov eax, dword [edx]
mov ecx, esi
mov dword [esp + 0x20], esp
call eax
mov byte [esp + 0x2cc], 0x1a
mov byte [esp + 0x2cc], bl
call fcn.1001aeb0
add esp, 8
mov byte [esp + 0x2c4], 0x18
lea ecx, [esp + 0x180]
call fcn.10001dd0
mov byte [esp + 0x2c4], 0x12
test esi, esi
je 0x1016601e
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
lea eax, [esp + 0x20]
jmp 0x10166d94
call fcn.101a7380
mov esi, dword [eax + 0x20]
test esi, esi
mov dword [esp + 0x30], esi
je 0x1016603f
mov eax, dword [esi]
mov edx, dword [eax]
mov ecx, esi
call edx
mov byte [esp + 0x2c4], 0x1b
test esi, esi
je 0x101660a9
mov edx, 0x1023eae4
lea eax, [esp + 0xf4]
call fcn.10007690
mov bl, 0x1c
mov byte [esp + 0x2c4], bl
lea eax, [esp + 0xf4]
push eax
push ecx
mov eax, esp
mov dword [eax], esi
mov edx, dword [esi]
mov eax, dword [edx]
mov ecx, esi
mov dword [esp + 0x20], esp
call eax
mov byte [esp + 0x2cc], 0x1d
mov byte [esp + 0x2cc], bl
call fcn.1001aeb0
add esp, 8
mov byte [esp + 0x2c4], 0x1b
lea ecx, [esp + 0xf4]
call fcn.10001dd0
mov byte [esp + 0x2c4], 0x12
test esi, esi
je 0x101660be
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x10166d90
mov eax, dword [esp + 0x28]
sub eax, ecx
sar eax, 2
cmp eax, 1
jne 0x10166d90
xor edi, edi
lea esi, [esp + 0x20]
call fcn.100ead40
mov ecx, dword [eax]
push ecx
lea esi, [esp + 0xe0]
lea edi, [esp + 0x40]
call fcn.100b6850
lea ebx, [esp + 0xd0]
call fcn.10029850
mov edx, dword [eax + 4]
mov eax, dword [eax]
push edx
push eax
lea ebx, [esp + 0x38]
call fcn.1016d8f0
jmp 0x10166d90
call fcn.101a7380
mov esi, dword [eax + 0x20]
test esi, esi
mov dword [esp + 0x30], esi
je 0x10166133
mov eax, dword [esi]
mov edx, dword [eax]
mov ecx, esi
call edx
mov byte [esp + 0x2c4], 0x2a
test esi, esi
je 0x1016619d
mov edx, 0x1023eafc
lea eax, [esp + 0x164]
call fcn.10007690
mov bl, 0x2b
mov byte [esp + 0x2c4], bl
lea eax, [esp + 0x164]
push eax
push ecx
mov eax, esp
mov dword [eax], esi
mov edx, dword [esi]
mov eax, dword [edx]
mov ecx, esi
mov dword [esp + 0x20], esp
call eax
mov byte [esp + 0x2cc], 0x2c
mov byte [esp + 0x2cc], bl
call fcn.1001aeb0
add esp, 8
mov byte [esp + 0x2c4], 0x2a
lea ecx, [esp + 0x164]
call fcn.10001dd0
mov byte [esp + 0x2c4], 0x12
test esi, esi
je 0x101661b2
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
mov ecx, dword [esp + 0x14]
mov esi, dword [ecx + 0x1bc]
test esi, esi
mov dword [esp + 0x30], esi
je 0x101661cc
mov edx, dword [esi]
mov eax, dword [edx]
mov ecx, esi
call eax
mov byte [esp + 0x2c4], 0x2d
test esi, esi
je 0x101661e1
mov edx, dword [esi]
mov eax, dword [edx + 0x28]
mov ecx, esi
call eax
mov byte [esp + 0x2c4], 0x12
test esi, esi
je case.0x10165e30.40004
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
jmp case.0x10165e30.40004
call fcn.101a7380
mov esi, dword [eax + 0x20]
xor ebp, ebp
cmp esi, ebp
mov dword [esp + 0x30], esi
je 0x10166219
mov edx, dword [esi]
mov eax, dword [edx]
mov ecx, esi
call eax
mov byte [esp + 0x2c4], 0x2e
cmp esi, ebp
je 0x10166283
mov edx, 0x1023eb04
lea eax, [esp + 0x1b8]
call fcn.10007690
mov bl, 0x2f
mov byte [esp + 0x2c4], bl
lea ecx, [esp + 0x1b8]
push ecx
push ecx
mov eax, esp
mov dword [eax], esi
mov edx, dword [esi]
mov eax, dword [edx]
mov ecx, esi
mov dword [esp + 0x20], esp
call eax
mov byte [esp + 0x2cc], 0x30
mov byte [esp + 0x2cc], bl
call fcn.1001aeb0
add esp, 8
mov byte [esp + 0x2c4], 0x2e
lea ecx, [esp + 0x1b8]
call fcn.10001dd0
mov byte [esp + 0x2c4], 0x12
cmp esi, ebp
je 0x10166298
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
mov dword [esp + 0x294], 7
mov dword [esp + 0x290], ebp
mov word [esp + 0x280], bp
mov byte [esp + 0x2c4], 0x31
mov ebx, dword [esp + 0x14]
push ebx
lea ecx, [esp + 0x280]
call fcn.1016a740
mov ecx, dword [esp + 0x70]
sub esp, 0x1c
lea edx, [esp + 0x298]
mov esi, esp
mov dword [esp + 0x4c], esp
push edx
mov dword [ebx + 0x228], ecx
lea edi, [ebx + 0x1d8]
call fcn.100076d0
mov byte [esp + 0x2e0], 0x32
push ebp
push ebp
push ebp
push ecx
mov ecx, dword [ebx + 0x234]
cmp ecx, ebp
mov eax, esp
mov dword [esp + 0x44], esp
mov dword [eax], ecx
je 0x10166315
mov eax, dword [ecx]
mov edx, dword [eax]
call edx
mov byte [esp + 0x2f0], 0x33
cmp edi, ebp
push ecx
mov eax, esp
mov dword [esp + 0xb0], esp
mov dword [eax], edi
je 0x10166335
mov eax, dword [edi]
mov edx, dword [eax]
mov ecx, edi
call edx
mov byte [esp + 0x2f4], 0x34
push ecx
mov ecx, dword [ebx + 0x21c]
cmp ecx, ebp
mov eax, esp
mov dword [esp + 0x9c], esp
mov dword [eax], ecx
je 0x10166359
mov eax, dword [ecx]
mov edx, dword [eax]
call edx
mov byte [esp + 0x2f8], 0x35
mov eax, dword [ebx + 0x224]
push eax
mov byte [esp + 0x2fc], 0x31
call fcn.100ee890
add esp, 0x38
test al, al
je 0x10166391
mov ecx, dword [ebx + 0x224]
push ebp
push 0xb
push 0x815
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
mov dword [ebx + 0x228], 0xffffffff
mov byte [esp + 0x2c4], 0x12
lea ecx, [esp + 0x27c]
call fcn.10001dd0
jmp case.0x10165e30.40004
call fcn.101a7380
mov esi, dword [eax + 0x20]
test esi, esi
mov dword [esp + 0x30], esi
je 0x101663cc
mov edx, dword [esi]
mov eax, dword [edx]
mov ecx, esi
call eax
mov byte [esp + 0x2c4], 0x36
test esi, esi
je 0x10166436
mov edx, 0x1023eb0c
lea eax, [esp + 0x20c]
call fcn.10007690
mov bl, 0x37
mov byte [esp + 0x2c4], bl
lea ecx, [esp + 0x20c]
push ecx
push ecx
mov eax, esp
mov dword [eax], esi
mov edx, dword [esi]
mov eax, dword [edx]
mov ecx, esi
mov dword [esp + 0x20], esp
call eax
mov byte [esp + 0x2cc], 0x38
mov byte [esp + 0x2cc], bl
call fcn.1001aeb0
add esp, 8
mov byte [esp + 0x2c4], 0x36
lea ecx, [esp + 0x20c]
call fcn.10001dd0
mov byte [esp + 0x2c4], 0x12
test esi, esi
je 0x1016644b
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
mov esi, dword [esp + 0x14]
mov edi, dword [esi + 0x230]
test edi, edi
mov dword [esp + 0x30], edi
je 0x10166465
mov edx, dword [edi]
mov eax, dword [edx]
mov ecx, edi
call eax
mov bl, 0x39
mov byte [esp + 0x2c4], bl
mov esi, dword [esi + 0x234]
test esi, esi
mov dword [esp + 0x18], esi
je 0x10166484
mov edx, dword [esi]
mov eax, dword [edx]
mov ecx, esi
call eax
mov byte [esp + 0x2c4], 0x3a
test edi, edi
je 0x101664a2
test esi, esi
je 0x101664a2
push 0
push 0x2d
mov edx, dword [esi]
mov eax, dword [edx + 0x28]
push edi
mov ecx, esi
call eax
mov byte [esp + 0x2c4], bl
test esi, esi
je 0x101664b6
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
mov byte [esp + 0x2c4], 0x12
test edi, edi
je case.0x10165e30.40004
mov edx, dword [edi]
mov eax, dword [edx + 4]
mov ecx, edi
call eax
jmp case.0x10165e30.40004
call fcn.101a7380
mov esi, dword [eax + 0x20]
test esi, esi
mov dword [esp + 0x30], esi
je 0x101664ec
mov edx, dword [esi]
mov eax, dword [edx]
mov ecx, esi
call eax
mov byte [esp + 0x2c4], 0x3b
test esi, esi
je 0x10166556
mov edx, 0x1023eb14
lea eax, [esp + 0x1d4]
call fcn.10007690
mov bl, 0x3c
mov byte [esp + 0x2c4], bl
lea ecx, [esp + 0x1d4]
push ecx
push ecx
mov eax, esp
mov dword [eax], esi
mov edx, dword [esi]
mov eax, dword [edx]
mov ecx, esi
mov dword [esp + 0x20], esp
call eax
mov byte [esp + 0x2cc], 0x3d
mov byte [esp + 0x2cc], bl
call fcn.1001aeb0
add esp, 8
mov byte [esp + 0x2c4], 0x3b
lea ecx, [esp + 0x1d4]
call fcn.10001dd0
mov byte [esp + 0x2c4], 0x12
test esi, esi
je 0x1016656b
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x20]
push ecx
push edx
call fcn.10167fc0
jmp case.0x10165e30.40004
call fcn.101a7380
mov esi, dword [eax + 0x20]
test esi, esi
mov dword [esp + 0x30], esi
je 0x10166597
mov eax, dword [esi]
mov edx, dword [eax]
mov ecx, esi
call edx
mov byte [esp + 0x2c4], 0x3e
test esi, esi
je 0x10166601
mov edx, 0x1023eb1c
lea eax, [esp + 0x110]
call fcn.10007690
mov bl, 0x3f
mov byte [esp + 0x2c4], bl
lea eax, [esp + 0x110]
push eax
push ecx
mov eax, esp
mov dword [eax], esi
mov edx, dword [esi]
mov eax, dword [edx]
mov ecx, esi
mov dword [esp + 0x20], esp
call eax
mov byte [esp + 0x2cc], 0x40
mov byte [esp + 0x2cc], bl
call fcn.1001aeb0
add esp, 8
mov byte [esp + 0x2c4], 0x3e
lea ecx, [esp + 0x110]
call fcn.10001dd0
mov byte [esp + 0x2c4], 0x12
test esi, esi
je 0x10166616
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x3c]
push ecx
push edx
call fcn.10167fc0
jmp case.0x10165e30.40004
call fcn.101a7380
mov esi, dword [eax + 0x20]
test esi, esi
mov dword [esp + 0x30], esi
je 0x10166642
mov eax, dword [esi]
mov edx, dword [eax]
mov ecx, esi
call edx
mov byte [esp + 0x2c4], 0x41
test esi, esi
je 0x101666ac
mov edx, 0x1023eb24
lea eax, [esp + 0x148]
call fcn.10007690
mov bl, 0x42
mov byte [esp + 0x2c4], bl
lea eax, [esp + 0x148]
push eax
push ecx
mov eax, esp
mov dword [eax], esi
mov edx, dword [esi]
mov eax, dword [edx]
mov ecx, esi
mov dword [esp + 0x20], esp
call eax
mov byte [esp + 0x2cc], 0x43
mov byte [esp + 0x2cc], bl
call fcn.1001aeb0
add esp, 8
mov byte [esp + 0x2c4], 0x41
lea ecx, [esp + 0x148]
call fcn.10001dd0
mov byte [esp + 0x2c4], 0x12
test esi, esi
je 0x101666c1
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x20]
push ecx
push edx
call fcn.101680f0
jmp case.0x10165e30.40004
call fcn.101a7380
mov esi, dword [eax + 0x20]
test esi, esi
mov dword [esp + 0x30], esi
je 0x101666ed
mov eax, dword [esi]
mov edx, dword [eax]
mov ecx, esi
call edx
mov byte [esp + 0x2c4], 0x44
test esi, esi
je 0x10166757
mov edx, 0x1023eb2c
lea eax, [esp + 0x1f0]
call fcn.10007690
mov bl, 0x45
mov byte [esp + 0x2c4], bl
lea eax, [esp + 0x1f0]
push eax
push ecx
mov eax, esp
mov dword [eax], esi
mov edx, dword [esi]
mov eax, dword [edx]
mov ecx, esi
mov dword [esp + 0x20], esp
call eax
mov byte [esp + 0x2cc], 0x46
mov byte [esp + 0x2cc], bl
call fcn.1001aeb0
add esp, 8
mov byte [esp + 0x2c4], 0x44
lea ecx, [esp + 0x1f0]
call fcn.10001dd0
mov byte [esp + 0x2c4], 0x12
test esi, esi
je 0x1016676c
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x3c]
push ecx
push edx
call fcn.101680f0
jmp case.0x10165e30.40004
call fcn.101a7380
mov esi, dword [eax + 0x20]
test esi, esi
mov dword [esp + 0x30], esi
je 0x10166798
mov eax, dword [esi]
mov edx, dword [eax]
mov ecx, esi
call edx
mov byte [esp + 0x2c4], 0x47
test esi, esi
je 0x10166802
mov edx, 0x1023eb34
lea eax, [esp + 0x228]
call fcn.10007690
mov bl, 0x48
mov byte [esp + 0x2c4], bl
lea eax, [esp + 0x228]
push eax
push ecx
mov eax, esp
mov dword [eax], esi
mov edx, dword [esi]
mov eax, dword [edx]
mov ecx, esi
mov dword [esp + 0x20], esp
call eax
mov byte [esp + 0x2cc], 0x49
mov byte [esp + 0x2cc], bl
call fcn.1001aeb0
add esp, 8
mov byte [esp + 0x2c4], 0x47
lea ecx, [esp + 0x228]
call fcn.10001dd0
mov byte [esp + 0x2c4], 0x12
test esi, esi
je 0x10166817
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
mov esi, dword [esp + 0x14]
mov edi, dword [esi + 0x230]
test edi, edi
mov dword [esp + 0x30], edi
je 0x10166831
mov edx, dword [edi]
mov eax, dword [edx]
mov ecx, edi
call eax
mov bl, 0x4a
mov byte [esp + 0x2c4], bl
mov esi, dword [esi + 0x234]
test esi, esi
mov dword [esp + 0x18], esi
je 0x10166850
mov edx, dword [esi]
mov eax, dword [edx]
mov ecx, esi
call eax
mov byte [esp + 0x2c4], 0x4b
test edi, edi
je 0x101664a2
test esi, esi
je 0x101664a2
push 0
push 9
jmp 0x10166498
mov ecx, dword [esp + 0x24]
test ecx, ecx
je case.0x10165e30.40004
mov eax, dword [esp + 0x28]
sub eax, ecx
sar eax, 2
cmp eax, 1
jne case.0x10165e30.40004
xor edi, edi
lea esi, [esp + 0x20]
call fcn.100ead40
cmp dword [eax], edi
je case.0x10165e30.40004
lea esi, [esp + 0xac]
lea edi, [esp + 0x3c]
call fcn.10050d50
xor edi, edi
lea esi, [esp + 0x20]
mov ebp, eax
call fcn.100ead40
mov ecx, dword [eax]
push ecx
lea esi, [esp + 0xd8]
lea edi, [esp + 0x40]
call fcn.100b6850
lea ebx, [esp + 0xf0]
call fcn.10029850
mov edx, dword [ebp + 4]
mov ecx, dword [ebp]
push edx
mov edx, dword [eax + 4]
mov eax, dword [eax]
push ecx
push edx
push eax
lea ecx, [esp + 0x40]
push ecx
jmp 0x10166d87
sub ebx, 0x9d54
je 0x10166c4e
sub ebx, 1
jne case.0x10165e30.40004
call fcn.101a7380
mov esi, dword [eax + 0x20]
test esi, esi
mov dword [esp + 0x30], esi
je 0x10166924
mov eax, dword [esi]
mov edx, dword [eax]
mov ecx, esi
call edx
mov byte [esp + 0x2c4], 0x21
test esi, esi
je 0x1016698e
mov edx, 0x1023eaf4
lea eax, [esp + 0x19c]
call fcn.10007690
mov bl, 0x22
mov byte [esp + 0x2c4], bl
lea eax, [esp + 0x19c]
push eax
push ecx
mov eax, esp
mov dword [eax], esi
mov edx, dword [esi]
mov eax, dword [edx]
mov ecx, esi
mov dword [esp + 0x20], esp
call eax
mov byte [esp + 0x2cc], 0x23
mov byte [esp + 0x2cc], bl
call fcn.1001aeb0
add esp, 8
mov byte [esp + 0x2c4], 0x21
lea ecx, [esp + 0x19c]
call fcn.10001dd0
mov byte [esp + 0x2c4], 0x12
test esi, esi
je 0x101669a3
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
mov ecx, dword [esp + 0x24]
test ecx, ecx
je case.0x10165e30.40004
mov eax, dword [esp + 0x28]
sub eax, ecx
sar eax, 2
cmp eax, 1
jne case.0x10165e30.40004
mov ebp, dword [esp + 0x14]
mov ebx, dword [ebp + 0x1d8]
add ebp, 0x1d8
xor edi, edi
lea esi, [esp + 0x20]
mov dword [esp + 0x60], ebp
add ebx, 0x8c
call fcn.100ead40
mov ecx, dword [eax]
mov edx, dword [ebx]
push ecx
mov ecx, ebp
call edx
mov ebp, eax
test ebp, ebp
mov dword [esp + 0x30], ebp
je 0x10166a02
mov eax, dword [ebp]
mov edx, dword [eax]
mov ecx, ebp
call edx
mov byte [esp + 0x2c4], 0x24
test ebp, ebp
jne 0x10166a1b
mov byte [esp + 0x2c4], 0x12
jmp case.0x10165e30.40004
mov eax, dword [ebp]
mov edx, dword [eax + 0x28]
lea ecx, [esp + 0x298]
push ecx
mov ecx, ebp
call edx
mov bl, 0x25
mov byte [esp + 0x2c4], bl
cmp dword [esp + 0x2ac], 0
jne 0x10166a6b
mov byte [esp + 0x2c4], 0x24
lea ecx, [esp + 0x298]
call fcn.10001dd0
mov byte [esp + 0x2c4], 0x12
mov eax, dword [ebp]
mov edx, dword [eax + 4]
mov ecx, ebp
call edx
jmp case.0x10165e30.40004
lea eax, [esp + 0x260]
push eax
lea ecx, [esp + 0x29c]
call fcn.101aaec0
add esp, 4
mov byte [esp + 0x2c4], 0x26
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0x2a0]
call fcn.10007880
mov byte [esp + 0x2c4], bl
lea ecx, [esp + 0x260]
call fcn.10001dd0
lea eax, [esp + 0x3c]
call fcn.1001fad0
xor edi, edi
lea esi, [esp + 0x20]
call fcn.100ead40
mov ebx, eax
lea esi, [esp + 0x3c]
call fcn.10029280
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x14], edi
call fcn.1016d4a0
test eax, eax
mov ebx, dword [esp + 0x60]
jbe 0x10166c39
xor edi, edi
lea esi, [esp + 0x20]
call fcn.100ead40
mov ecx, dword [esp + 0x14]
cmp ecx, dword [eax]
je 0x10166c1d
mov edx, dword [ebx]
mov edx, dword [edx + 0x8c]
mov eax, ecx
push eax
mov ecx, ebx
call edx
mov edi, eax
test edi, edi
mov dword [esp + 0x18], edi
je 0x10166b1d
mov eax, dword [edi]
mov edx, dword [eax]
mov ecx, edi
call edx
mov byte [esp + 0x2c4], 0x27
test edi, edi
jne 0x10166b36
mov byte [esp + 0x2c4], 0x25
jmp 0x10166c1d
mov eax, dword [edi]
mov edx, dword [eax + 0x28]
lea ecx, [esp + 0x27c]
push ecx
mov ecx, edi
call edx
mov byte [esp + 0x2c4], 0x28
cmp dword [esp + 0x290], 0
jne 0x10166b83
mov byte [esp + 0x2c4], 0x27
lea ecx, [esp + 0x27c]
call fcn.10001dd0
mov byte [esp + 0x2c4], 0x25
mov eax, dword [edi]
mov edx, dword [eax + 4]
mov ecx, edi
call edx
jmp 0x10166c1d
lea eax, [esp + 0x244]
push eax
lea ecx, [esp + 0x280]
call fcn.101aaec0
add esp, 4
mov byte [esp + 0x2c4], 0x29
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0x284]
call fcn.10007880
mov byte [esp + 0x2c4], 0x28
lea ecx, [esp + 0x244]
call fcn.10001dd0
cmp dword [esp + 0x290], 0
je 0x10166bf8
lea eax, [esp + 0x27c]
lea ecx, [esp + 0x298]
call fcn.1019c570
test al, al
je 0x10166bf8
lea ebx, [esp + 0x14]
lea esi, [esp + 0x3c]
call fcn.10029280
mov ebx, dword [esp + 0x60]
mov byte [esp + 0x2c4], 0x27
lea ecx, [esp + 0x27c]
call fcn.10001dd0
mov byte [esp + 0x2c4], 0x25
mov edx, dword [edi]
mov eax, dword [edx + 4]
mov ecx, edi
call eax
mov esi, dword [esp + 0x14]
mov ecx, dword [esp + 0x6c]
add esi, 1
mov dword [esp + 0x14], esi
call fcn.1016d4a0
cmp esi, eax
jb 0x10166ae5
mov edx, dword [ebx]
mov edx, dword [edx + 0x48]
push 1
lea eax, [esp + 0x40]
push eax
mov ecx, ebx
call edx
jmp 0x10166a40
call fcn.101a7380
mov esi, dword [eax + 0x20]
test esi, esi
mov dword [esp + 0x30], esi
je 0x10166c66
mov eax, dword [esi]
mov edx, dword [eax]
mov ecx, esi
call edx
mov byte [esp + 0x2c4], 0x1e
test esi, esi
je 0x10166cd0
mov edx, 0x1023eaec
lea eax, [esp + 0x88]
call fcn.10007690
mov bl, 0x1f
mov byte [esp + 0x2c4], bl
lea eax, [esp + 0x88]
push eax
push ecx
mov eax, esp
mov dword [eax], esi
mov edx, dword [esi]
mov eax, dword [edx]
mov ecx, esi
mov dword [esp + 0x20], esp
call eax
mov byte [esp + 0x2cc], 0x20
mov byte [esp + 0x2cc], bl
call fcn.1001aeb0
add esp, 8
mov byte [esp + 0x2c4], 0x1e
lea ecx, [esp + 0x88]
call fcn.10001dd0
mov byte [esp + 0x2c4], 0x12
test esi, esi
je 0x10166ce5
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
mov ecx, dword [esp + 0x24]
test ecx, ecx
je case.0x10165e30.40004
mov eax, dword [esp + 0x28]
sub eax, ecx
sar eax, 2
cmp eax, 1
jne case.0x10165e30.40004
mov eax, dword [esp + 0x40]
test eax, eax
jne 0x10166d0f
xor ebx, ebx
jmp 0x10166d18
mov ebx, dword [esp + 0x44]
sub ebx, eax
sar ebx, 2
xor edi, edi
lea esi, [esp + 0x20]
call fcn.100ead40
mov ecx, dword [eax]
add ecx, 1
cmp ecx, ebx
je case.0x10165e30.40004
call fcn.100ead40
mov edx, dword [eax]
push 1
push ecx
push edx
lea esi, [esp + 0xd0]
lea edi, [esp + 0x48]
call fcn.100b6850
lea ebx, [esp + 0xf0]
call fcn.10029850
add esp, 4
lea ebx, [esp + 0xb8]
call fcn.10029850
lea esi, [esp + 0xbc]
mov ebx, eax
call fcn.100b6850
mov ecx, dword [ebx + 4]
mov edx, dword [ebx]
push ecx
mov ecx, dword [eax + 4]
push edx
mov edx, dword [eax]
push ecx
push edx
lea eax, [esp + 0x40]
push eax
lea ebx, [esp + 0x50]
call fcn.10192a90
lea eax, [esp + 0x3c]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 0x1d8]
mov edx, dword [edx + 0x48]
add ecx, 0x1d8
push 1
push eax
call edx
mov ecx, dword [esp + 0x58]
mov eax, dword [ecx]
mov edx, dword [esp + 0x54]
mov eax, dword [eax + 0x14]
push edx
call eax
mov ecx, dword [esp + 0x64]
push ecx
call dword [sym.imp.USER32.dll_DestroyMenu]
mov byte [esp + 0x2c4], 5
mov ecx, dword [esp + 0x38]
test ecx, ecx
je 0x10166dde
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x2c4], 4
lea esi, [esp + 0x3c]
call fcn.100a0ee0
mov byte [esp + 0x2c4], 3
lea esi, [esp + 0x20]
call fcn.100a0ee0
mov byte [esp + 0x2c4], 2
mov ecx, dword [esp + 0x4c]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x2c4], 1
mov ecx, dword [esp + 0x50]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x2c4], 0
mov ecx, dword [esp + 0x7c]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x2c4], 0xffffffff
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x10166e53
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x2bc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2a0]
xor ecx, esp
call fcn.101d19cc
add esp, 0x2b4
ret 0xc