Function at 0x100354ca
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1007c44e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x160
push ebx
push esi
push edi
mov dword [esp + 0x88], ecx
lea ecx, [esp + 0x100]
mov dword [esp + 0x18], 0xb9f9b319
push 2
mov dword [esp + 0x68], edx
call fcn.10012997
mov dword [esp + 0x18], 0xabecba2a
xor ebx, ebx
mov dword [esp + 0x40], 0xb57a67d9
push 2
mov dword [esp + 0x14], 0x46cd5fec
mov dword [esp + 0x1c], ebx
pop edx
jmp 0x10035548
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x100]
mov dword [eax + ecx*4], 0xdd33a4a9
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edx
jl 0x10035532
mov dword [esp + 0x18], ebx
jmp 0x1003556a
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x100]
mov dword [eax + ecx*4], 7
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edx
jl 0x10035554
inc dword [esp + 0x10]
lea ecx, [esp + 0x100]
call fcn.10012a1c
push 0xfffffffffffffff8
pop edi
mov dword [esp + 0x60], edi
lea ecx, [esp + 0x118]
mov dword [esp + 0x40], 0xffffffff
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x24], 0xceafd94f
mov dword [esp + 0x24], 0x6dd8d130
mov dword [esp + 0x24], 0x93e9323d
mov dword [esp + 0x24], 0x6923607a
push 1
call fcn.10012997
xor edx, edx
mov dword [esp + 0x1c], ebx
inc edx
jmp 0x100355e0
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x118]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edx
jl 0x100355ce
mov dword [esp + 0x1c], ebx
jmp 0x100355ff
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x8c], 0x82ca9683
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edx
jl 0x100355ec
mov eax, dword [esp + 0x40]
lea ecx, [esp + 0x118]
mov dword [esp + 0x24], eax
inc dword [esp + 0x8c]
call fcn.10012a1c
mov dword [esp + 0x40], 0x704dcf74
mov dword [esp + 0x10], 0xaa9320af
mov dword [esp + 0x28], 0xe033c22
mov dword [esp + 0x18], ebx
jmp 0x10035651
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0xa8], 0x31713b91
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jl 0x1003563e
mov dword [esp + 0xb0], ebx
jmp 0x10035734
mov dword [esp + 0x10], 0xffff
mov dword [esp + 0x24], 0xcbed562b
mov dword [esp + 0x3c], 0x2ca3
mov dword [esp + 0x18], ebx
jmp 0x10035692
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x34], 0x7d8e6e83
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 1
jl 0x10035682
mov dword [esp + 0x34], 0xf
jmp 0x10035722
mov dword [esp + 0x18], 1
mov dword [esp + 0x24], 0xe2bf35dd
cmp dword [esp + 0x34], ebx
jne 0x100356c3
cmp dword [esp + 0x10], ebx
jne 0x100356c3
mov esi, ebx
jmp 0x100356c6
xor esi, esi
inc esi
mov eax, dword [esp + 0x34]
xor edx, edx
mov dword [esp + 0x28], eax
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x28]
cmp eax, ecx
mov eax, dword [esp + 0x34]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x34]
setne cl
imul eax, esi
neg ecx
imul eax, eax, 0xbec0
sub ecx, eax
mov eax, dword [esp + 0x18]
sub ecx, eax
sub ecx, dword [esp + 0x10]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [esp + 0x24], ecx
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x24], eax
cmp dword [esp + 0x28], ebx
jne 0x1003572d
dec dword [esp + 0x34]
cmp dword [esp + 0x34], 0xfffffffb
je 0x100356a3
inc dword [esp + 0xb0]
cmp dword [esp + 0xb0], 7
je 0x10035664
push dword [esp + 0x74]
movdqa xmm0, xmmword [0x10007c30]
lea eax, [esp + 0x160]
push eax
lea eax, [esp + 0x154]
mov dword [esp + 0x34], 1
push eax
mov dword [esp + 0x24], 0x98ba832a
lea ecx, [esp + 0xdc]
mov dword [esp + 0x1c], edi
push ebx
movdqu xmmword [esp + 0x15c], xmm0
mov dword [esp + 0xe0], ebx
mov dword [esp + 0xe4], ebx
mov dword [esp + 0xe8], ebx
call fcn.10012eed
mov dword [esp + 0x174], ebx
mov dword [esp + 0x2c], ebx
jmp 0x10035a04
push 3
lea ecx, [esp + 0x94]
call fcn.10012997
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x20], ebx
jmp 0x100357df
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x90]
mov dword [eax + ecx*4], 0x3695
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 3
jl 0x100357c9
push 2
mov dword [esp + 0x2c], ebx
pop ecx
jmp 0x100359e3
mov dword [esp + 0x30], ebx
mov dword [esp + 0x3c], 0xe2499e68
mov dword [esp + 0x30], ebx
jmp 0x100359d5
mov dword [esp + 0x1c], 0xd72276b
mov dword [esp + 0x3c], 1
mov dword [esp + 0x1c], ebx
jmp 0x1003584c
mov dword [esp + 0x20], ebx
jmp 0x10035836
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0xc8], 0xfffffffe
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 1
jl 0x10035823
mov dword [esp + 0xc8], 3
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], ecx
jle 0x1003581d
mov dword [esp + 0x1c], ecx
cmp dword [esp + 0x1c], ebx
jl 0x100359d1
mov esi, dword [esp + 0x90]
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x20], ebx
cmp dword [esp + 0x20], ecx
jg 0x10035982
mov dword [esp + 0x10], 9
mov dword [esp + 0x10], ecx
cmp dword [esp + 0x10], ebx
jl 0x100358a8
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x100358a2
push ebx
push ebx
call dword [sym.imp.GDI32.dll_GetRgnBox]
dec dword [esp + 0x10]
jns 0x1003588f
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x90]
cmp dword [eax + ecx*4], ebx
je 0x100358fa
mov ecx, dword [esp + 0x20]
xor edx, edx
mov eax, dword [esp + 0x1c]
cmp eax, ecx
setg dl
xor ecx, ecx
cmp edx, 0x7b187b35
setl cl
sub ecx, dword [esp + 0x30]
sub ecx, 0xfffffff6
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0xfffffffc
setg al
imul eax, dword [esp + 0x20]
mov dword [esp + 0x3c], eax
cmp dword [esp + 0x3c], ebx
je 0x100358fa
xor edi, edi
inc edi
jmp 0x100358fc
mov edi, ebx
mov eax, dword [esp + 0x30]
xor edx, edx
mov esi, dword [esp + 0x30]
mov ecx, dword [esp + 0x90]
cmp dword [ecx + eax*4], edi
setl dl
xor eax, eax
cmp edx, dword [ecx + esi*4]
setge al
cmp eax, 0x88ff7673
mov eax, dword [esp + 0x24]
sbb ecx, ecx
xor edx, edx
neg ecx
mov esi, dword [eax + 4]
mov eax, dword [esp + 0x2c]
add eax, ecx
cmp eax, 0x2d6273d5
mov eax, dword [esp + 0x2c]
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
cmp ecx, esi
setg al
cmp eax, 0xfffffffd
jbe 0x1003595c
test esi, esi
jne 0x1003595c
cmp dword [esp + 0x1c], ebx
je 0x10035967
cmp dword [esp + 0x30], ebx
je 0x10035967
xor eax, eax
inc eax
jmp 0x10035969
mov eax, ebx
mov dword [esp + 0x3c], eax
inc dword [esp + 0x20]
push 2
pop ecx
cmp dword [esp + 0x20], ecx
jle 0x1003587d
mov esi, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov edx, dword [esp + 0x2c]
sub edx, dword [esi + 4]
mov eax, dword [esp + 0x18]
cmp edx, eax
mov eax, dword [esp + 0x1c]
setne cl
xor edx, edx
cmp dword [esi + 8], ecx
setle dl
xor ecx, ecx
cmp edx, eax
setg cl
add ecx, 0xd230
je 0x100359be
cmp dword [esp + 0x20], ebx
je 0x100359be
xor eax, eax
inc eax
jmp 0x100359c0
mov eax, ebx
mov dword [esp + 0x10], eax
dec dword [esp + 0x1c]
push 2
pop ecx
jns 0x1003586b
inc dword [esp + 0x30]
cmp dword [esp + 0x30], ecx
jle 0x10035807
inc dword [esp + 0x28]
cmp dword [esp + 0x28], ecx
jle 0x100357f2
mov eax, dword [esp + 0x90]
lea ecx, [esp + 0x90]
call fcn.10012a1c
dec dword [esp + 0x2c]
cmp dword [esp + 0x2c], 0xffffffee
je 0x100357ad
cmp dword [esp + 0x18], ebx
jne 0x10035a4c
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
sub edx, dword [esp + 0x18]
neg edx
sbb edx, edx
inc edx
sub edx, dword [esp + 0x10]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
sub edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x18]
cmp edx, eax
setne cl
cmp ecx, dword [esp + 0x10]
jl 0x10035a4c
mov edx, ebx
jmp 0x10035a4f
xor edx, edx
inc edx
mov eax, dword [esp + 0x2c]
xor ecx, ecx
cmp edx, eax
mov edx, dword [esp + 0x2c]
setle cl
sub edx, ecx
neg edx
sbb edx, edx
inc edx
imul edx, dword [esp + 0x2c]
sub edx, 0x5b3a
add edx, dword [esp + 0x18]
mov eax, dword [esp + 0x2c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0xd0]
or dword [esp + 0x174], 0xffffffff
call fcn.10012a1c
push 3
mov dword [esp + 0x14], ebx
pop ecx
jmp 0x10035ab8
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x15c], 0x30c1abdd
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ecx
jl 0x10035aa5
mov dword [esp + 0x1c], 0xfffffff6
mov dword [esp + 0x24], 8
mov dword [esp + 0x10], ebx
jmp 0x10035ae7
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x124], 0x64a6847d
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ecx
jl 0x10035ad4
mov dword [esp + 0x1c], ebx
jmp 0x10035b1d
mov dword [esp + 0x10], 9
mov dword [esp + 0x10], ebx
jmp 0x10035b12
mov eax, dword [esp + 0x1c]
cmp dword [esp + eax*4 + 0x124], ebx
jne 0x10035b19
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jle 0x10035b01
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jle 0x10035af3
mov dword [esp + 0x1c], 0xffffffed
jmp 0x10035bb4
mov dword [esp + 0x18], 0x7d2703d9
mov dword [esp + 0x18], 0x85c9e53
cmp dword [esp + 0x1c], ebx
jne 0x10035b51
cmp dword [esp + 0x18], ebx
jne 0x10035b51
mov edx, ebx
jmp 0x10035b54
xor edx, edx
inc edx
cmp dword [esp + 0x18], ebx
je 0x10035b6b
mov eax, dword [esp + 0x18]
neg eax
cmp eax, dword [esp + 0x18]
jg 0x10035b6b
xor ecx, ecx
inc ecx
jmp 0x10035b6d
mov ecx, ebx
xor eax, eax
cmp ecx, 0x30a4ccfd
setne al
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x12c]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x18]
setg dl
xor ecx, ecx
cmp edx, eax
setne cl
sub ecx, dword [esp + 0x18]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0xb72b
setl al
mov dword [esp + 0x24], eax
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0x10
jle 0x10035b31
mov dword [esp + 0x18], ebx
jmp 0x10035ed7
mov dword [esp + 0x20], 0xf1bf506e
lea ecx, [esp + 0x9c]
push 2
call fcn.10012997
mov dword [esp + 0x174], 1
lea eax, [esp + 0x14c]
push dword [esp + 0x74]
xorps xmm0, xmm0
mov dword [esp + 0x80], ebx
push eax
lea eax, [esp + 0x144]
mov dword [esp + 0x88], ebx
push eax
push ebx
lea ecx, [esp + 0x8c]
mov dword [esp + 0x94], ebx
movdqu xmmword [esp + 0x14c], xmm0
call fcn.10012eed
mov byte [esp + 0x174], 2
mov dword [esp + 0x28], 0xfffffffe
mov dword [esp + 0x10], ebx
jmp 0x10035c54
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x9c]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x10035c41
mov dword [esp + 0x20], ebx
cmp dword [esp + 0x20], 0x1a
je 0x10035e2b
mov eax, dword [esp + 0x9c]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x30], eax
push 2
lea ecx, [esp + 0x6c]
call fcn.10012997
mov byte [esp + 0x174], 3
mov dword [esp + 0x10], 0xfffffffe
mov dword [esp + 0x24], 0x820b275c
mov dword [esp + 0x10], ebx
jmp 0x10035cb9
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x68]
mov dword [eax + ecx*4], 0x693e9323
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x10035ca6
mov edi, dword [esp + 0x68]
mov dword [esp + 0x1c], edi
mov dword [edi], ebx
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10035cf4
push ebx
push 0x22b5
push 0x1b00
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharABCWidthsW]
mov eax, dword [esp + 0x68]
xor ecx, ecx
mov eax, dword [eax]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
cmp eax, 0xffffffff
setne cl
mov dword [esp + 0x24], ecx
mov ecx, 0xc51938d1
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x68]
xor eax, eax
mov edx, dword [esi]
cmp dword [edi + 4], edx
mov edi, dword [esp + 0x9c]
setle al
cmp ecx, eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, dword [edi + edx*4]
setne cl
xor eax, eax
cmp ecx, 1
mov ecx, dword [esp + 0x3c]
setge al
xor edx, edx
cmp eax, dword [ecx + 4]
mov eax, dword [esp + 0x30]
setne dl
mov dword [eax + 8], edx
xor eax, eax
mov ecx, dword [esi]
cmp edx, 0xfe905687
setne al
cmp eax, dword [edi + ecx*4]
jle 0x10035d7f
cmp dword [esp + 0x10], ebx
mov edi, dword [esp + 0x9c]
mov esi, dword [esp + 0x68]
jne 0x10035d7f
mov eax, ebx
jmp 0x10035d82
xor eax, eax
inc eax
mov dword [esp + 0x28], eax
xor ecx, ecx
mov eax, dword [esi]
mov esi, dword [edi + eax*4]
mov eax, dword [esp + 0x28]
inc eax
cmp eax, esi
mov eax, dword [esp + 0x68]
setge cl
xor edx, edx
add ecx, dword [eax]
mov eax, dword [esp + 0x18]
cmp ecx, esi
mov byte [esp + 0x17], bl
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
cmp ecx, 7
jl 0x10035dd8
cmp byte [esp + 0x17], 0
je 0x10035dd2
push 0x1e34
push ebx
push 0x7e94
call fcn.100387c6
add esp, 0xc
mov edx, dword [esp + 0x68]
jmp 0x10035df8
cmp byte [esp + 0x17], 0
je 0x10035de6
push ebx
call fcn.10039271
pop ecx
mov edx, dword [esp + 0x68]
mov eax, dword [esp + 0x9c]
mov ecx, dword [edx]
cmp dword [eax + ecx*4], ebx
jne 0x10035e07
inc dword [edx]
cmp dword [edx], 1
mov edi, dword [esp + 0x1c]
jle 0x10035cca
dec dword [esp + 0x60]
lea ecx, [esp + 0x68]
mov byte [esp + 0x174], 2
call fcn.10012a1c
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 0x1a
jne 0x10035c7d
mov eax, dword [esp + 0x28]
xor ecx, ecx
mov edx, dword [esp + 0x7c]
mov eax, dword [esp + 0x40]
cmp eax, dword [edx + 4]
setl cl
imul eax, ecx, 0xfffc
test eax, eax
je 0x10035e57
mov eax, dword [esp + 0x7c]
cmp dword [eax + 0xc], ebx
je 0x10035e57
xor edx, edx
inc edx
jmp 0x10035e59
mov edx, ebx
mov eax, dword [esp + 0x40]
xor ecx, ecx
sub edx, eax
mov eax, dword [esp + 0x28]
cmp edx, eax
setne cl
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x10], ebx
jne 0x10035e82
cmp dword [esp + 0x18], ebx
jne 0x10035e82
mov eax, ebx
jmp 0x10035e85
xor eax, eax
inc eax
xor ecx, ecx
cmp eax, 0x7d86
sete cl
xor eax, eax
cmp ecx, 0xffffffff
setne al
cmp eax, 0x7718da91
jne 0x10035ea2
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x7c]
xor ecx, ecx
cmp dword [eax + 8], 1
setle cl
mov dword [esp + 0x160], ecx
lea ecx, [esp + 0x7c]
call fcn.10012a1c
or dword [esp + 0x174], 0xffffffff
lea ecx, [esp + 0x9c]
call fcn.10012a1c
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0xc
jl 0x10035bc8
mov dword [esp + 0x40], 7
mov dword [esp + 0x10], ebx
jmp 0x10035f00
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x58], 0xffffffff
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 1
jl 0x10035ef0
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10035f2c
push 0xe08
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polygon]
mov dword [esp + 0x58], ebx
jmp 0x10035f47
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10035f43
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
inc dword [esp + 0x58]
cmp dword [esp + 0x58], 0xe
jle 0x10035f32
mov edx, dword [esp + 0x88]
cmp dword [edx + 0x10], ebx
jne 0x10035f61
xor al, al
jmp 0x10036412
mov dword [esp + 0x1c], 0xb9b55bb2
mov dword [esp + 0x1c], ebx
jmp 0x10035feb
mov dword [esp + 0x40], 0xfe5e81a7
mov dword [esp + 0x60], 0xf3ac9d73
mov dword [esp + 0x10], ebx
jmp 0x10035f98
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x10c], 1
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x10035f85
cmp dword [esp + 0x1c], ebx
jne 0x10035fe0
cmp dword [esp + 0x40], ebx
jne 0x10035fd6
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x10c]
mov ecx, dword [esp + 0x10c]
mov eax, dword [esp + 0x1c]
sub ecx, eax
mov eax, dword [esp + 0x10c]
add eax, ecx
cmp eax, dword [esp + 0x1c]
jl 0x10035fd6
mov eax, dword [esp + 0x1c]
cmp dword [esp + 0x1c], ebx
jne 0x10035fe0
mov eax, ebx
jmp 0x10035fe3
xor eax, eax
inc eax
mov dword [esp + 0x60], eax
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xffffffe8
jne 0x10035f6f
mov edi, dword [esp + 0x64]
mov dword [edi], ebx
cmp dword [edx + 0x14], 0x10
jb 0x10036006
mov esi, dword [edx]
jmp 0x10036008
mov esi, edx
cmp dword [edx + 0x14], 0x10
jb 0x10036012
mov ecx, dword [edx]
jmp 0x10036014
mov ecx, edx
mov eax, dword [edx + 0x10]
add eax, ecx
cmp esi, eax
je 0x10036410
mov dword [esp + 0x44], 0xe1757117
lea ecx, [esp + 0xdc]
push 2
call fcn.10012997
push ebx
push 0x1cad
lea eax, [esp + 0x138]
mov dword [esp + 0x17c], 4
push eax
lea eax, [esp + 0xe8]
mov dword [esp + 0xc8], 1
push eax
push 0x2261
call fcn.10037e2c
add esp, 0x14
mov dword [esp + 0x44], ebx
jmp 0x10036197
mov dword [esp + 0x38], 0xe1e2c0d3
xor eax, eax
inc eax
mov dword [esp + 0x54], 0xffff
mov dword [esp + 0x78], eax
mov dword [esp + 0x38], eax
cmp dword [esp + 0x38], ebx
jl 0x10036178
lea eax, [esp + 0x5c]
mov dword [esp + 0x5c], 0x23e64f14
push eax
lea eax, [esp + 0x3c]
push eax
push ebx
lea eax, [esp + 0xe8]
push eax
push 0x52e1
call fcn.10037cb3
add esp, 0x14
cmp dword [esp + 0x54], ebx
jne 0x100360d6
cmp dword [esp + 0x38], ebx
jne 0x100360d6
mov edx, ebx
jmp 0x100360d9
xor edx, edx
inc edx
mov dword [esp + 0x78], 0x7f08
xor ecx, ecx
mov eax, dword [esp + 0x78]
add eax, 0xfff6
cmp eax, 0x6c064155
mov eax, dword [esp + 0x54]
setne cl
add ecx, edx
sub ecx, eax
mov eax, dword [esp + 0x54]
sub ecx, eax
sub ecx, 0x819d
jne 0x10036114
cmp dword [esp + 0x44], ebx
jne 0x10036114
mov ecx, ebx
jmp 0x10036117
xor ecx, ecx
inc ecx
mov eax, dword [esp + 0x38]
sub ecx, eax
je 0x10036123
mov eax, dword [esp + 0x5c]
mov eax, dword [esp + 0x54]
cmp dword [esp + 0x5c], ebx
je 0x1003614b
push 0x3287
push 0x775c
lea eax, [esp + 0x52]
mov byte [esp + 0x52], bl
push eax
push ebx
call fcn.10039527
add esp, 0x10
jmp 0x1003616e
lea eax, [esp + 0xdc]
xor cl, cl
push eax
lea eax, [esp + 0x60]
push eax
lea eax, [esp + 0x80]
push eax
lea edx, [esp + 0x44]
call fcn.10034e3d
add esp, 0xc
dec dword [esp + 0x38]
jns 0x1003609e
lea eax, [esp + 0xbc]
push eax
push ebx
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0x60]
push eax
call fcn.10038be2
add esp, 0x10
dec dword [esp + 0x44]
cmp dword [esp + 0x44], 0xffffffe8
jg 0x10036079
or dword [esp + 0x174], 0xffffffff
lea ecx, [esp + 0xdc]
call fcn.10012a1c
mov al, byte [esi]
cmp al, 0x30
jl 0x10036373
cmp al, 0x39
jg 0x10036373
push 2
lea ecx, [esp + 0xec]
call fcn.10012997
lea eax, [esp + 0xe8]
mov dword [esp + 0x174], 5
push eax
push 0x274
mov dword [esp + 0x54], 0x56915a13
lea eax, [esp + 0x13c]
mov dword [esp + 0xc8], 0xffffffff
push 0x6057
mov dword [esp + 0x70], 1
push ebx
mov dword [esp + 0x74], 0xfffffffb
mov dword [esp + 0xd4], 0xe5fef407
push eax
call fcn.10038d4c
add esp, 0x14
mov dword [esp + 0x4c], 1
cmp dword [esp + 0x4c], ebx
jl 0x1003632f
mov dword [esp + 0x50], 0xfffffff6
lea ecx, [esp + 0xf4]
push 1
call fcn.10012997
push 0x5582
lea eax, [esp + 0xf8]
mov byte [esp + 0x178], 6
push eax
push 0x2df1
lea eax, [esp + 0x144]
mov dword [esp + 0xd8], 0x6b59229a
push eax
push ebx
call fcn.1003928e
mov ecx, dword [esp + 0x60]
add esp, 0x14
mov eax, dword [esp + 0xe8]
cmp dword [eax + ecx*4], ebx
jne 0x1003631b
mov dword [esp + 0x50], 0x10
jmp 0x100362f4
push ebx
lea eax, [esp + 0xec]
mov dword [esp + 0xb8], 8
push eax
lea eax, [esp + 0xc8]
push eax
lea eax, [esp + 0x100]
push eax
lea eax, [esp + 0xc4]
push eax
lea eax, [esp + 0xe0]
push eax
lea eax, [esp + 0x68]
push eax
lea eax, [esp + 0x68]
push eax
call fcn.10038228
add esp, 0x20
dec dword [esp + 0x50]
cmp dword [esp + 0x50], 7
jl 0x100362aa
lea ecx, [esp + 0xf4]
mov byte [esp + 0x174], 5
call fcn.10012a1c
dec dword [esp + 0x4c]
jns 0x10036244
jmp 0x1003632f
lea ecx, [esp + 0xf4]
mov byte [esp + 0x174], 5
call fcn.10012a1c
push ebx
lea eax, [esp + 0xc8]
push 0x4604
push eax
call fcn.10037a8a
or dword [esp + 0x180], 0xffffffff
lea ecx, [esp + 0xf4]
add esp, 0xc
call fcn.10012a1c
imul ecx, dword [edi], 0xa
movsx eax, byte [esi]
mov edx, dword [esp + 0x88]
add ecx, 0xffffffd0
add eax, ecx
inc esi
mov dword [edi], eax
jmp 0x10036008
lea eax, [esp + 0x4b]
mov dword [esp + 0x10], 0x48bbca63
push eax
push ebx
mov dword [esp + 0xc0], 1
mov byte [esp + 0x53], bl
push 0x4936
call fcn.10040a2f
add esp, 0xc
mov dword [esp + 0x10], 0xe
jmp 0x10036402
push ebx
push 0x7e88
push 0x74c2
lea eax, [esp + 0xc4]
mov dword [esp + 0x80], 0x1265ab3e
push eax
lea eax, [esp + 0x84]
push eax
call fcn.10037c35
mov byte [esp + 0x2b], bl
add esp, 0x14
cmp byte [esp + 0x17], 0
je 0x100363fe
push 0x35f1
push 0x214c
push 0x718a
mov edx, 0x4448
mov cl, 1
call fcn.10034e3d
add esp, 0xc
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xfffffff3
jg 0x100363a7
mov dword [edi], ebx
jmp 0x10035f5a
mov al, 1
mov ecx, dword [esp + 0x16c]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret