Function at 0x100498e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1006e434
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x258
push ebx
mov dword [esp + 0x58], ecx
xor ebx, ebx
mov dword [esp + 8], 0xffffffff
push esi
mov dword [esp + 0x10], 0xffffffff
mov esi, edx
push edi
mov dword [esp + 0x20], 0xffffffff
xor edi, edi
mov dword [esp + 0x38], 0xdb22
inc edi
mov dword [esp + 0xd4], esi
mov dword [esp + 0x14], ebx
jmp 0x1004994c
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x74], 0xffffffff
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x1004993c
mov dword [esp + 0x10], ebx
push 3
pop eax
cmp dword [esp + 0x10], ebx
jg 0x10049bae
mov dword [esp + 0x1c], eax
mov dword [esp + 0x30], 0x25c1
cmp dword [esp + 0x30], 0xaa0
jge 0x10049b3a
lea eax, [esp + 0x84]
push eax
lea eax, [esp + 0x48]
push eax
push 0x10007770
call fcn.10055feb
add esp, 0xc
lea ecx, [esp + 0x19c]
push dword [esp + 0x44]
call fcn.1002b6f7
mov dword [esp + 0x26c], ebx
cmp dword [esp + 0x44], 0
mov esi, dword [esp + 0x19c]
mov dword [esp + 0x30], ebx
jle 0x100499de
mov edi, esi
push edi
push 0x10007744
call fcn.10055feb
inc ebx
add edi, 4
pop ecx
pop ecx
cmp ebx, dword [esp + 0x44]
jl 0x100499c2
xor edi, edi
xor ebx, ebx
inc edi
push dword [esp + 0x1a0]
push esi
call fcn.1002fee9
pop ecx
pop ecx
lea eax, [esp + 0x18c]
mov dword [esp + 0x18c], edi
push eax
push dword [esp + 0x48]
lea ecx, [esp + 0xa8]
mov dword [esp + 0xa8], ebx
mov dword [esp + 0xac], ebx
mov dword [esp + 0xb0], ebx
call fcn.1002c200
mov eax, dword [esp + 0x44]
mov edi, ebx
mov dword [esp + 0x28], ebx
test eax, eax
jle 0x10049ac4
mov ecx, dword [esi]
mov eax, esi
mov edx, ebx
mov dword [esp + 0x14], eax
jmp 0x10049a65
mov eax, dword [esp + 0x84]
add eax, ecx
cmp dword [esp + 0x20], eax
jg 0x10049a74
mov eax, dword [esp + 0xa0]
inc edi
mov dword [eax + edx], ebx
mov edx, edi
shl edx, 2
mov ecx, dword [esi + edx]
mov eax, dword [esp + 0x14]
mov ebx, dword [eax]
cmp ecx, ebx
push 0
mov dword [esp + 0x24], ebx
pop ebx
jl 0x10049a3f
jmp 0x10049a78
mov eax, dword [esp + 0x14]
mov ebx, dword [eax]
mov edx, edi
mov eax, dword [esp + 0x84]
shl edx, 2
push 0
mov dword [esp + 0x34], ebx
mov ecx, dword [esi + edx]
add eax, ecx
cmp eax, ebx
pop ebx
jge 0x10049ab1
mov ebx, dword [esp + 0x84]
inc edi
mov edx, edi
shl edx, 2
mov ecx, dword [esi + edx]
lea eax, [ecx + ebx]
cmp eax, dword [esp + 0x30]
jl 0x10049a9d
xor ebx, ebx
inc dword [esp + 0x28]
add dword [esp + 0x14], 4
mov eax, dword [esp + 0x44]
cmp dword [esp + 0x28], eax
jl 0x10049a61
mov edi, ebx
mov ecx, ebx
test eax, eax
jle 0x10049adb
mov edx, dword [esp + 0xa0]
add edi, dword [edx + ecx*4]
inc ecx
cmp ecx, eax
jl 0x10049ad3
push edi
push 0x10007778
call fcn.10056438
mov eax, dword [esp + 0xa8]
pop ecx
pop ecx
test eax, eax
je 0x10049b0f
push eax
call fcn.100565a7
pop ecx
mov dword [esp + 0xa0], ebx
mov dword [esp + 0xa4], ebx
mov dword [esp + 0xa8], ebx
or dword [esp + 0x26c], 0xffffffff
test esi, esi
je 0x10049b37
push esi
call fcn.100565a7
pop ecx
mov dword [esp + 0x19c], ebx
mov dword [esp + 0x1a0], ebx
mov dword [esp + 0x1a4], ebx
xor edi, edi
inc edi
mov dword [esp + 0x30], 0xb68dee21
mov dword [esp + 0x1c], ebx
cmp dword [esp + 0x1c], ebx
jl 0x10049b96
mov dword [esp + 0x2c], 6
mov dword [esp + 0x2c], ebx
jmp 0x10049b8a
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x30], 0x4eea2a3b
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + eax*4 + 0x74]
mov eax, dword [esp + 0x2c]
mov dword [esp + eax*4 + 0x74], ecx
mov dword [esp + 0x14], ecx
mov eax, dword [esp + 0x14]
mov dword [esp + 0x30], eax
inc dword [esp + 0x2c]
cmp dword [esp + 0x2c], ebx
jle 0x10049b5a
dec dword [esp + 0x1c]
jns 0x10049b4c
inc dword [esp + 0x10]
push 3
pop eax
cmp dword [esp + 0x10], ebx
jle 0x10049963
mov esi, dword [esp + 0xd4]
mov dword [esp + 0x14], 0x10
jmp 0x10049c61
mov dword [esp + 0x2c], 0xfffffffc
mov dword [esp + 0x24], 0xf4923579
mov dword [esp + 0x28], 0xfffd
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x10], eax
cmp dword [esp + 0x2c], ebx
je 0x10049c45
mov eax, dword [esp + 0x2c]
sub eax, 0x7b8b
neg eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
sub ecx, eax
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x2c]
cmp eax, ecx
setl dl
xor eax, eax
cmp edx, 0x5674
mov edx, edi
setne al
xor ecx, ecx
sub edx, eax
add edx, dword [esp + 0x28]
mov eax, dword [esp + 0x28]
cmp edx, eax
setge cl
add ecx, 7
mov dword [esp + 0x2c], ecx
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x74]
mov eax, edi
cmp dword [esp + 0x20], ebx
jne 0x10049c47
mov eax, ebx
cmp eax, dword [esp + 0x28]
je 0x10049c51
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x24]
mov dword [esp + 0x10], eax
dec dword [esp + 0x14]
cmp dword [esp + 0x14], 0xfffffff6
jge 0x10049bbb
mov eax, dword [0x108ad3a0]
test al, 1
jne 0x10049d0e
or eax, edi
mov dword [0x108ad3a0], eax
push ebx
mov dword [esp + 0x270], edi
push ebx
mov dword [0x108ad3b0], ebx
mov dword [0x108ad3b4], ebx
call fcn.1003847b
mov dword [0x108ad3b0], eax
mov dword [0x108ad3b8], ebx
mov dword [0x108ad3c0], ebx
mov byte [esp + 0x26c], 3
mov ecx, 0x108ad3b8
mov dword [esp + 0x194], eax
lea eax, [esp + 0x194]
push eax
push 0x10
push ebx
lea eax, [esp + 0x1f8]
mov dword [0x108ad3cc], 0x3f800000
push eax
mov dword [0x108ad3bc], ebx
call fcn.10038253
push 0x1006e7c4
mov dword [0x108ad3c4], 7
mov dword [0x108ad3c8], 8
call fcn.1005640e
or dword [esp + 0x270], 0xffffffff
pop ecx
mov dword [esp + 0x1c], 0x76b87d0f
push 3
pop eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x28], ebx
mov dword [esp + 0x38], 0x786c7a88
mov dword [esp + 0x1dc], edi
mov dword [esp + 0x1e0], edi
mov dword [esp + 0x1e4], edi
mov dword [esp + 0x1e8], edi
mov dword [esp + 0x20], 0x13c9534c
mov dword [esp + 0x24], 0xed469f41
mov dword [esp + 0x38], ebx
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10049d70
push ebx
push 0x127b
call dword [sym.imp.GDI32.dll_RectVisible]
cmp dword [esp + 0x1c], ebx
je 0x10049e08
mov eax, dword [esp + 0x1c]
xor edx, edx
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x28], edi
mov eax, dword [esp + 0x28]
add eax, dword [esp + 0x10]
mov dword [esp + 0x38], eax
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x1c]
cmp eax, ecx
mov eax, dword [esp + 0x1c]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x10]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x1c]
setge dl
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
cmp ecx, 0xb927
setle al
mov dword [esp + 0x1dc], eax
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
sub eax, 0xffff
cmp eax, dword [esp + 0x1c]
je 0x10049e1f
mov ecx, edi
cmp dword [esp + 0x28], ebx
jne 0x10049e21
mov ecx, ebx
mov eax, dword [esp + 0x10]
imul eax, ecx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x10]
imul eax, dword [esp + 0x60], 0x2710
mov dword [esp + 0x38], 0xb6311140
add eax, esi
mov dword [esp + 0xdc], eax
lea eax, [esp + 0xdc]
push eax
call fcn.1004bdd1
xor ecx, ecx
inc ecx
mov edi, dword [eax]
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x20], 0xffff
mov dword [esp + 0x38], 0xfffffff9
mov dword [esp + 0x14], ebx
jmp 0x10049e90
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x198], 0x86e52d8c
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ecx
jl 0x10049e7d
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x28]
mov esi, dword [esp + 0x28]
neg esi
mov dword [esp + 0x198], esi
mov eax, dword [esp + 0x20]
cmp ecx, eax
push 2
sbb eax, eax
neg eax
cmp eax, 4
mov eax, dword [esp + 0x24]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [esp + 0x2c]
setle dl
xor ecx, ecx
cmp esi, eax
pop esi
setl cl
xor eax, eax
cmp ecx, edx
setne al
mov dword [esp + 0x38], eax
mov dword [esp + 0x38], 0x1878
cmp dword [esp + 0x38], 0x75f
jge 0x10049f8d
lea eax, [esp + 0x54]
push eax
push 0x10007744
call fcn.10055feb
mov eax, dword [esp + 0x5c]
pop ecx
pop ecx
test eax, eax
je 0x10049f88
push 0xa
pop ebx
dec eax
mov dword [esp + 0x54], eax
lea eax, [esp + 0x58]
push eax
push 0x10007744
call fcn.10055feb
mov eax, dword [esp + 0x60]
pop ecx
pop ecx
cmp eax, 1
jl 0x10049f3f
push 0x10007b98
call fcn.10056438
mov eax, dword [esp + 0x5c]
pop ecx
cmp eax, esi
jl 0x10049f73
push 0x10007b9c
call fcn.10056438
mov eax, dword [esp + 0x5c]
pop ecx
cmp eax, esi
jle 0x10049f73
lea eax, [esi + 7]
cdq
idiv ebx
push edx
push 0x10007744
call fcn.10056438
inc esi
pop ecx
pop ecx
cmp esi, dword [esp + 0x58]
jl 0x10049f56
push 2
pop esi
push 0x100076ad
call fcn.100567a1
mov eax, dword [esp + 0x58]
pop ecx
test eax, eax
jne 0x10049f11
xor ebx, ebx
dec eax
mov dword [esp + 0x54], eax
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10049fa9
push 0x3a0
push 0xd75
push ebx
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
test edi, edi
je 0x1004a12d
mov dword [esp + 0x10], 4
mov dword [esp + 0x14], esi
mov dword [esp + 0x38], 0xffffffff
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x10], 0x1a
jne 0x1004a121
xor esi, esi
inc esi
mov dword [esp + 0x24], 8
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x28], 0xfffffff9
mov dword [esp + 0x20], 0xaea0a9f4
mov dword [esp + 0x2c], 0x7ae9f903
mov dword [esp + 0x20], 0x6ebbfad0
mov dword [esp + 0x28], 0xf4d4e2
mov dword [esp + 0x20], 0x31af6658
mov dword [esp + 0x20], 7
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1004a03b
push 0xbd6
push 0x1ab7
push ebx
call dword [sym.imp.USER32.dll_EnableMenuItem]
mov eax, dword [esp + 0x24]
xor ecx, ecx
mov eax, dword [esp + 0x14]
cmp eax, esi
setg cl
sub ecx, 0xfffffff7
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0x13f5
setle al
xor edx, edx
imul ecx, eax, 0xfffc
mov eax, dword [esp + 0x24]
cmp ecx, eax
setle dl
mov dword [esp + 0x20], edx
cmp dword [esp + 0x20], 0xfffa
jne 0x1004a080
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x14]
xor edx, edx
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x10]
cmp ecx, eax
setne dl
sub edx, dword [esp + 0x28]
je 0x1004a0c1
mov ecx, esi
cmp dword [esp + 0x20], ebx
jne 0x1004a0c3
mov ecx, ebx
mov eax, dword [esp + 0x24]
xor edx, edx
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
cmp eax, ecx
mov eax, dword [esp + 0x10]
setl dl
xor ecx, ecx
cmp edx, eax
setg cl
xor edx, edx
imul eax, ecx, 0xc0a
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
sub eax, dword [esp + 0x14]
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
cmp ecx, eax
setle dl
mov dword [esp + 0x38], edx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x1a
je 0x10049fd7
mov dword [esp + 0x168], edi
jmp 0x1004ba76
mov dword [esp + 0x28], 0x6e871d97
push 4
mov dword [esp + 0x3c], 0xffffffff
mov dword [esp + 0x18], ebx
pop ecx
jmp 0x1004a159
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x200], 0x2403
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ecx
jl 0x1004a146
dec dword [esp + 0x208]
push 3
pop eax
mov dword [esp + 0x28], eax
cmp dword [esp + 0x28], ebx
jl 0x1004a181
mov dword [esp + 0x38], 0x8067e307
dec dword [esp + 0x28]
jns 0x1004a173
mov eax, dword [0x108ad3a0]
test al, 2
jne 0x1004a223
or eax, esi
mov dword [0x108ad3a0], eax
push ebx
mov dword [esp + 0x270], ecx
push ebx
mov dword [0x108ad380], ebx
mov dword [0x108ad384], ebx
call fcn.1003847b
mov dword [0x108ad380], eax
mov dword [0x108ad388], ebx
mov dword [0x108ad390], ebx
mov byte [esp + 0x26c], 6
mov ecx, 0x108ad388
mov dword [esp + 0x190], eax
lea eax, [esp + 0x190]
push eax
push 0x10
push ebx
lea eax, [esp + 0x1fc]
mov dword [0x108ad39c], 0x3f800000
push eax
mov dword [0x108ad38c], ebx
call fcn.10038253
push 0x1006e7bf
mov dword [0x108ad394], 7
mov dword [0x108ad398], 8
call fcn.1005640e
or dword [esp + 0x270], 0xffffffff
pop ecx
mov dword [esp + 0x38], 0x24d1
cmp dword [esp + 0x38], 0xb7a
jge 0x1004a397
xor cl, cl
call fcn.10009521
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x70], ebx
call fcn.1002fbc6
mov dword [esp + 0x6c], eax
lea eax, [esp + 0x50]
mov dword [esp + 0x26c], 7
push eax
mov ecx, 0x1065eb30
call fcn.1002aea5
or ecx, 0xffffffff
or dword [esp + 0x28], ecx
mov dword [esp + 0x20], ecx
jmp 0x1004a363
dec eax
mov ecx, 0x1065eb30
mov dword [esp + 0x50], eax
lea eax, [esp + 0x48]
push eax
call fcn.1002aea5
mov edx, dword [esp + 0x6c]
mov esi, edx
mov edi, dword [esp + 0x48]
mov eax, dword [edx + 4]
mov ecx, eax
jmp 0x1004a2ba
cmp dword [ecx + 0x10], edi
jge 0x1004a2aa
mov ecx, dword [ecx + 8]
jmp 0x1004a2ba
cmp byte [esi + 0xd], 0
je 0x1004a2b6
cmp edi, dword [ecx + 0x10]
cmovl esi, ecx
mov edx, ecx
mov ecx, dword [ecx]
cmp byte [ecx + 0xd], 0
je 0x1004a2a0
cmp byte [esi + 0xd], 0
jne 0x1004a2d8
mov eax, dword [esi]
jmp 0x1004a2d8
cmp edi, dword [eax + 0x10]
jge 0x1004a2d5
mov esi, eax
mov eax, dword [eax]
jmp 0x1004a2d8
mov eax, dword [eax + 8]
cmp byte [eax + 0xd], 0
je 0x1004a2ca
mov dword [esp + 0xbc], edx
mov edi, ebx
cmp edx, esi
je 0x1004a317
lea ecx, [esp + 0xbc]
inc edi
call fcn.1002fb46
cmp dword [esp + 0xbc], esi
jne 0x1004a2eb
test edi, edi
je 0x1004a317
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x70]
call fcn.1004be95
inc dword [eax]
jmp 0x1004a32b
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x70]
call fcn.1004be95
mov dword [eax], 1
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x70]
call fcn.1004be95
mov ecx, dword [esp + 0x28]
cmp dword [eax], ecx
jle 0x1004a35f
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x70]
call fcn.1004be95
mov ecx, dword [esp + 0x48]
mov dword [esp + 0x20], ecx
mov eax, dword [eax]
mov dword [esp + 0x28], eax
jmp 0x1004a363
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x50]
test eax, eax
jne 0x1004a27b
dec eax
push ecx
mov ecx, 0x1065ea78
mov dword [esp + 0x54], eax
call fcn.1002b4c3
push eax
call fcn.1002fce0
or dword [esp + 0x270], 0xffffffff
pop ecx
lea ecx, [esp + 0x6c]
call fcn.1002b9e2
xor esi, esi
lea ecx, [esp + 0x140]
inc esi
push esi
call fcn.1002b6f7
push 3
pop eax
push eax
lea ecx, [esp + 0xe4]
mov dword [esp + 0x270], 8
call fcn.1002b6f7
mov dword [esp + 0x20], 0xa7609fa8
mov dword [esp + 0x10], ebx
jmp 0x1004a3e6
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x140]
mov dword [eax + ecx*4], 0xdde0bcd8
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x1004a3d0
push 3
mov dword [esp + 0x14], ebx
pop edx
jmp 0x1004a40b
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xe0]
mov dword [eax + ecx*4], 0x56f9b2cf
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x1004a3f5
mov edi, dword [esp + 0xe0]
mov dword [edi + 8], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x38], 0x8a2b8ea2
mov dword [esp + 0x14], ebx
jmp 0x1004a461
mov dword [esp + 0x28], 0xb7f37c04
mov dword [esp + 0x28], ebx
cmp dword [esp + 0x28], ebx
jl 0x1004a45d
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1004a457
push ebx
push 0x399
push ebx
call dword [sym.imp.GDI32.dll_GetMetaFileBitsEx]
dec dword [esp + 0x28]
jns 0x1004a43f
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ebx
jle 0x1004a42d
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0xe0]
imul ecx, dword [eax]
mov dword [esp + 0x14], ecx
mov esi, dword [esp + 0x14]
mov ecx, dword [esp + 0x140]
mov eax, dword [edi + 8]
imul esi, dword [ecx]
mov edx, dword [ecx + eax*4]
xor ecx, ecx
mov eax, dword [esp + 0x20]
add eax, esi
imul eax, eax, 0x6c7f
lea eax, [eax + edx*2]
dec eax
cmp eax, edx
setl cl
inc dword [edi + 8]
cmp dword [edi + 8], 0
mov dword [esp + 0x38], ecx
jle 0x1004a41b
push dword [esp + 0xe0]
call fcn.100565a7
or dword [esp + 0x270], 0xffffffff
pop ecx
push dword [esp + 0x140]
mov dword [esp + 0xe4], ebx
mov dword [esp + 0xe8], ebx
mov dword [esp + 0xec], ebx
call fcn.100565a7
pop ecx
lea eax, [esp + 0x60]
mov dword [esp + 0x140], ebx
xorps xmm0, xmm0
mov dword [esp + 0x144], ebx
push eax
mov dword [esp + 0x14c], ebx
movdqu xmmword [esp + 0x180], xmm0
call fcn.1004be33
xor edi, edi
lea ecx, [esp + 0xf8]
inc edi
push 4
mov eax, dword [eax]
mov dword [esp + 0x20], 0x6ce4a6f4
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x14], 0x43e2f7c6
mov dword [esp + 0x18], edi
mov dword [esp + 0x2c], eax
call fcn.1002b6f7
mov dword [esp + 0x26c], 9
push 5
pop eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x20], 0xef5b5069
mov dword [esp + 0x14], 0xba832a49
mov dword [esp + 0x30], 0x907f7a79
mov dword [esp + 0x34], 0x1854
mov dword [esp + 0x14], ebx
jmp 0x1004a594
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xf8]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x1004a582
mov dword [esp + 0x38], 0x1486
cmp dword [esp + 0x38], 0xdaf
jge 0x1004a71e
lea eax, [esp + 0x68]
push eax
push 0x10007744
call fcn.10055feb
mov eax, dword [esp + 0x70]
pop ecx
pop ecx
test eax, eax
je 0x1004a719
dec eax
mov dword [esp + 0x68], eax
lea eax, [esp + 0x4c]
push eax
push 0x10007744
call fcn.10055feb
pop ecx
pop ecx
push dword [esp + 0x4c]
lea ecx, [esp + 0x1b4]
call fcn.1002b6f7
push 0xa
pop eax
mov byte [esp + 0x26c], al
cmp dword [esp + 0x4c], 0
mov edi, dword [esp + 0x1b0]
mov dword [esp + 0x38], ebx
jle 0x1004a62b
mov esi, edi
push esi
push 0x10007744
call fcn.10055feb
inc ebx
add esi, 4
pop ecx
pop ecx
cmp ebx, dword [esp + 0x4c]
jl 0x1004a612
xor ebx, ebx
mov dword [esp + 0xcc], ebx
mov dword [esp + 0xd0], ebx
call fcn.1002fbf1
mov dword [esp + 0xcc], eax
mov byte [esp + 0x26c], 0xb
mov ecx, dword [esp + 0x4c]
test ecx, ecx
jle 0x1004a6c3
xor esi, esi
mov dword [esp + 0x20], edi
inc esi
mov edx, edi
mov dword [esp + 0x14], esi
mov ebx, esi
cmp esi, ecx
jge 0x1004a6ae
mov esi, dword [esp + 0x20]
mov eax, dword [edi + ebx*4]
sub eax, dword [esi]
mov dword [esp + 0x1a8], eax
movzx eax, byte [0x108ad210]
push eax
lea eax, [esp + 0x1ac]
push eax
push ecx
lea eax, [esp + 0x238]
push eax
lea ecx, [esp + 0xdc]
call fcn.1003066d
mov ecx, dword [esp + 0x4c]
inc ebx
cmp ebx, ecx
jl 0x1004a66c
mov esi, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
inc esi
add edx, 4
mov dword [esp + 0x14], esi
mov dword [esp + 0x20], edx
lea eax, [esi - 1]
cmp eax, ecx
jl 0x1004a662
xor ebx, ebx
push dword [esp + 0xd0]
push 0x10007778
call fcn.10056438
pop ecx
pop ecx
lea ecx, [esp + 0xcc]
call fcn.1002b9e2
mov byte [esp + 0x26c], 9
test edi, edi
je 0x1004a70a
push edi
call fcn.100565a7
pop ecx
mov dword [esp + 0x1b0], ebx
mov dword [esp + 0x1b4], ebx
mov dword [esp + 0x1b8], ebx
mov eax, dword [esp + 0x68]
test eax, eax
jne 0x1004a5ce
xor edi, edi
inc edi
dec eax
mov dword [esp + 0x68], eax
cmp dword [esp + 0x1c], ebx
jne 0x1004a749
mov dword [esp + 0x24], 0xffff2533
xor edx, edx
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
cmp eax, ecx
mov ecx, ebx
setle dl
imul eax, edx, 0xfffa
cmp eax, dword [esp + 0x1c]
jne 0x1004a74b
mov ecx, edi
xor eax, eax
cmp ecx, 0x1fc9a57b
sete al
xor ecx, ecx
cmp eax, 7
setge cl
add ecx, dword [esp + 0x1c]
je 0x1004a768
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
xor ecx, ecx
mov eax, dword [esp + 0x24]
add eax, dword [esp + 0x1c]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x10]
sub edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
cmp edx, eax
setge cl
xor edx, edx
mov dword [esp + 0x14], ecx
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0xf8]
mov dword [esi + 4], eax
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
cmp eax, 0xf3bec767
mov eax, dword [esp + 0x14]
setne dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [esp + 0x24]
setl cl
add eax, 0xa88ff767
add eax, ecx
jne 0x1004a7d7
mov eax, ebx
cmp dword [esp + 0x1c], ebx
je 0x1004a7d9
mov eax, edi
mov dword [esp + 0x20], eax
xor edx, edx
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
cmp ecx, eax
mov eax, dword [esp + 0x1c]
setle dl
xor ecx, ecx
cmp edx, dword [esi + 4]
push 5
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x18]
setge dl
xor ecx, ecx
imul edx, dword [esi + 4]
cmp edx, eax
pop eax
setne cl
cmp eax, ecx
sbb eax, eax
neg eax
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], 0xc509
jg 0x1004ab1e
mov dword [esp + 0x14], 0x11
cmp dword [esp + 0x14], 0xffffffeb
jl 0x1004abc4
push 3
pop eax
jmp 0x1004a844
xor edi, edi
inc edi
mov dword [esp + 0x38], 0x175b
cmp dword [esp + 0x38], 0x1289
jge 0x1004aa47
lea eax, [esp + 0x40]
push eax
push 0x10007744
call fcn.10055feb
mov eax, dword [esp + 0x48]
pop ecx
pop ecx
lea ecx, [esp + 0x178]
mov dword [esp + 0x178], ebx
push ecx
inc eax
mov dword [esp + 0x8c], ebx
push eax
lea ecx, [esp + 0x90]
mov dword [esp + 0x94], ebx
mov dword [esp + 0x98], ebx
call fcn.1002c200
mov byte [esp + 0x26c], 0xc
mov eax, dword [esp + 0x40]
cmp eax, 1
jl 0x1004a8d5
mov esi, dword [esp + 0x88]
add esi, 4
push esi
push 0x10007744
call fcn.10055feb
mov eax, dword [esp + 0x48]
inc edi
pop ecx
add esi, 4
pop ecx
cmp edi, eax
jle 0x1004a8bc
lea ecx, [esp + 0x158]
mov dword [esp + 0x158], ebx
push ecx
inc eax
mov dword [esp + 0xb0], ebx
push eax
lea ecx, [esp + 0xb4]
mov dword [esp + 0xb8], ebx
mov dword [esp + 0xbc], ebx
call fcn.1002c200
mov byte [esp + 0x26c], 0xd
lea ecx, [esp + 0xac]
mov eax, dword [esp + 0x40]
push ecx
inc eax
mov dword [esp + 0x108], ebx
push eax
lea ecx, [esp + 0x10c]
mov dword [esp + 0x110], ebx
mov dword [esp + 0x114], ebx
call fcn.1002c4ca
cmp dword [esp + 0xac], 0
je 0x1004a96a
push dword [esp + 0xac]
call fcn.100565a7
pop ecx
mov dword [esp + 0xac], ebx
mov dword [esp + 0xb0], ebx
mov dword [esp + 0xb4], ebx
mov eax, dword [esp + 0x40]
xor ecx, ecx
inc ecx
or esi, 0xffffffff
mov dword [esp + 0x24], esi
mov edx, ecx
cmp eax, ecx
jl 0x1004a9fc
mov ecx, ebx
mov dword [esp + 0x20], ecx
test edx, edx
jle 0x1004a9f3
mov esi, ebx
mov edi, ebx
mov ebx, dword [esp + 0x88]
mov eax, dword [esp + 0x104]
mov eax, dword [eax + edi]
mov ecx, dword [eax + ecx*4]
mov eax, dword [esp + 0x104]
inc ecx
mov eax, dword [eax + esi]
mov dword [eax + edx*4], ecx
mov ecx, dword [esp + 0x20]
mov eax, dword [ebx + edx*4]
cmp eax, dword [ebx + ecx*4]
mov eax, dword [esp + 0x104]
mov ebx, dword [esp + 0x24]
cmove edi, esi
mov eax, dword [eax + esi]
cmp ebx, dword [eax + edx*4]
cmovle ebx, dword [eax + edx*4]
inc ecx
mov eax, ebx
mov dword [esp + 0x24], ebx
mov ebx, dword [esp + 0x88]
add esi, 0xc
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], ecx
cmp ecx, edx
jl 0x1004a993
mov eax, dword [esp + 0x40]
xor ebx, ebx
inc edx
cmp edx, eax
jle 0x1004a97e
mov esi, dword [esp + 0x24]
push esi
push 0x10007778
call fcn.10056438
pop ecx
pop ecx
lea ecx, [esp + 0x104]
call fcn.1002c56c
mov byte [esp + 0x26c], 9
mov eax, dword [esp + 0x88]
test eax, eax
je 0x1004aa44
push eax
call fcn.100565a7
pop ecx
mov dword [esp + 0x88], ebx
mov dword [esp + 0x8c], ebx
mov dword [esp + 0x90], ebx
push 3
pop eax
mov dword [esp + 0x2c], ebx
jmp 0x1004ab00
mov dword [esp + 0x1c], ebx
jmp 0x1004aaa5
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1004aaa1
push 0x2441
push 0x1049
push 0x20e7
push 0x1e7c
push 0x854
push 0xd46
push 0x4fe
push 0x1d24
push 0x484
push 0xb53
push 0xaa2
call dword [sym.imp.GDI32.dll_StretchBlt]
push 3
pop eax
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], eax
jle 0x1004aa56
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x1c], ebx
jl 0x1004aafc
mov dword [esp + 0x38], 0x146bfe21
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x10], eax
jg 0x1004aaf6
push 3
pop ebx
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0xf8]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x38], eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ebx
jle 0x1004aaca
push 3
xor ebx, ebx
pop eax
dec dword [esp + 0x1c]
jns 0x1004aab5
inc dword [esp + 0x2c]
cmp dword [esp + 0x2c], eax
jle 0x1004aa50
dec dword [esp + 0x14]
cmp dword [esp + 0x14], 0xffffffeb
jge 0x1004a841
jmp 0x1004abc4
mov dword [esp + 0x10], 0xd9140931
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x38], 9
mov dword [esp + 0x24], ebx
jmp 0x1004ab4f
mov eax, dword [esp + 0x24]
mov dword [esp + eax*4 + 0x21c], 0xffffffff
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 4
jl 0x1004ab3c
dec dword [esp + 0x10]
cmp dword [esp + 0x30], ebx
je 0x1004ab8c
mov eax, dword [esp + 0x2c]
xor edx, edx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
cmp eax, dword [esi + 4]
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x30]
setl dl
sub edx, 0xfffffffb
neg edx
sbb edx, edx
inc edx
add eax, edx
add ecx, eax
mov ecx, edi
jne 0x1004ab8e
mov ecx, ebx
mov eax, dword [esp + 0x20]
imul eax, ecx
cmp eax, dword [esp + 0x1c]
jle 0x1004aba3
mov eax, ebx
cmp dword [esp + 0x14], ebx
je 0x1004aba5
mov eax, edi
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x34]
imul eax, dword [esp + 0x20]
cmp eax, edi
sbb eax, eax
neg eax
sub eax, 0x6196c9a5
mov dword [esp + 0x228], eax
or dword [esp + 0x26c], 0xffffffff
push dword [esp + 0xf8]
call fcn.100565a7
mov al, byte [ebp + 0xc]
mov dword [esp + 0xfc], ebx
mov dword [esp + 0x100], ebx
mov dword [esp + 0x104], ebx
pop ecx
test al, al
jne 0x1004ac01
mov esi, dword [esp + 0x28]
test esi, esi
jne 0x1004ae73
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x20], 1
mov dword [esp + 0x30], 5
mov dword [esp + 0x1c], 0xffffffff
cmp dword [esp + 0x1c], 0xfffffffb
jg 0x1004acc8
mov dword [esp + 0x14], 0xdfbd6c3f
xor edx, edx
mov dword [esp + 0x34], 9
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
cmp ecx, eax
mov eax, dword [esp + 0x14]
setge dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [esp + 0x20], ecx
cmp dword [esp + 0x20], ebx
jne 0x1004ac68
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 0xffffffff
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1004acb6
push ebx
call dword [sym.imp.USER32.dll_CharNextW]
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xfffffffb
jle 0x1004ac2c
mov al, byte [ebp + 0xc]
lea ecx, [esp + 0x240]
mov dl, al
push ecx
mov ecx, dword [esp + 0x64]
call fcn.1003dc79
cmp byte [ebp + 0xc], 0
lea edi, [esp + 0x180]
mov esi, eax
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
je 0x1004ae6f
cmp dword [esp + 0x184], 0
je 0x1004ae6f
mov dword [esp + 0x20], 0x6fe7d8a8
mov dword [esp + 0x34], 0x5b3b9da4
mov dword [esp + 0x24], ebx
jmp 0x1004ad2a
mov eax, dword [esp + 0x24]
mov dword [esp + eax*4 + 0x250], 0x540d
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 4
jl 0x1004ad17
push 3
pop eax
mov dword [esp + 0x20], eax
cmp dword [esp + 0x20], ebx
jl 0x1004ae53
mov edi, 0x10007740
mov byte [esp + 0x1b], bl
mov dword [esp + 0x34], 0x1872
cmp dword [esp + 0x34], 0x1223
jge 0x1004ae10
lea eax, [esp + 0xb8]
push eax
push edi
call fcn.10055feb
cmp dword [esp + 0xc0], 0
mov eax, ebx
pop ecx
pop ecx
mov ecx, ebx
mov dword [esp + 0x128], eax
mov edx, ebx
mov dword [esp + 0x12c], ecx
mov dword [esp + 0x130], edx
mov esi, ebx
mov dword [esp + 0xc4], ebx
jle 0x1004adeb
push 3
pop ebx
lea eax, [esp + 0xc4]
push eax
push edi
call fcn.10055feb
mov eax, esi
cdq
idiv ebx
mov eax, dword [esp + 0xcc]
pop ecx
pop ecx
lea ecx, [esp + 0x128]
lea ecx, [ecx + edx*4]
add dword [ecx], eax
inc esi
cmp esi, dword [esp + 0xb8]
jl 0x1004ada2
mov edx, dword [esp + 0x130]
xor ebx, ebx
mov ecx, dword [esp + 0x12c]
mov eax, dword [esp + 0x128]
cmp eax, ecx
jle 0x1004adfa
cmp eax, edx
jle 0x1004adfa
push 0x10007ba0
jmp 0x1004ae0a
cmp ecx, edx
jle 0x1004ae05
push 0x10007ba8
jmp 0x1004ae0a
push 0x10007bb0
call fcn.10056438
pop ecx
cmp byte [esp + 0x1b], 0
je 0x1004ae28
push 0xb38
push 0x1461
push ebx
call dword [sym.imp.USER32.dll_OffsetRect]
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1004ae49
push 0x25ca
push ebx
push 0x2565
push 0x15d5
call dword [sym.imp.USER32.dll_GetDlgItemTextW]
dec dword [esp + 0x20]
jns 0x1004ad47
mov eax, dword [esp + 0x188]
mov dword [esp + 0x16c], eax
mov eax, dword [esp + 0x184]
mov dword [esp + 0x170], eax
mov esi, dword [esp + 0x28]
push 2
lea ecx, [esp + 0x138]
call fcn.1002b6f7
mov dword [esp + 0x24], ebx
jmp 0x1004ae99
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x134]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 2
jl 0x1004ae87
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1004aeb8
push ebx
push 0x881
push ebx
call dword [sym.imp.OLEAUT32.dll_SafeArrayLock]
mov eax, dword [esp + 0x134]
push 3
pop ecx
mov dword [eax], ebx
mov dword [esp + 0x1cc], 0xffffffff
mov dword [esp + 0x1d0], 0xffffffff
mov dword [esp + 0x1d4], 0xffffffff
mov dword [esp + 0x1d8], 0xffffffff
mov dword [esp + 0x24], ebx
jmp 0x1004af09
mov eax, dword [esp + 0x24]
mov dword [esp + eax*4 + 0x210], 6
inc dword [esp + 0x24]
cmp dword [esp + 0x24], ecx
jl 0x1004aef6
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1004af24
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
push 3
pop ecx
mov eax, dword [esp + 0x214]
mov dword [esp + 0x1d0], eax
mov eax, dword [esp + 0x134]
dec dword [eax]
cmp dword [eax], 0xfffffff1
jge 0x1004aec4
push eax
call fcn.100565a7
mov dword [esp + 0x138], ebx
mov dword [esp + 0x13c], ebx
mov dword [esp + 0x140], ebx
pop ecx
test esi, esi
jne 0x1004b9c6
cmp dword [esp + 0x17c], esi
jle 0x1004b9c6
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x2c], 0x13
jmp 0x1004b20a
mov dword [esp + 0x24], 0xfffffff8
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1004afa5
push ebx
push 0x127b
call dword [sym.imp.GDI32.dll_RectVisible]
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x24], 0xffffffe9
jge 0x1004b206
xor esi, esi
inc esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x34], 6
mov dword [esp + 0x14], ebx
jmp 0x1004b1ec
mov dword [esp + 0x34], 0x21ee
cmp dword [esp + 0x34], 0xb5d
jge 0x1004b1e0
lea eax, [esp + 0x1ac]
mov dword [esp + 0x1ac], ebx
push eax
push 2
lea ecx, [esp + 0x9c]
mov dword [esp + 0x9c], ebx
mov dword [esp + 0xa0], ebx
mov dword [esp + 0xa4], ebx
call fcn.1002c200
lea eax, [esp + 0x94]
mov dword [esp + 0x26c], 0xe
push eax
push 0x3b
lea ecx, [esp + 0x118]
mov dword [esp + 0x118], ebx
mov dword [esp + 0x11c], ebx
mov dword [esp + 0x120], ebx
call fcn.1002c4ca
or dword [esp + 0x26c], 0xffffffff
cmp dword [esp + 0x94], 0
je 0x1004b07e
push dword [esp + 0x94]
call fcn.100565a7
pop ecx
mov dword [esp + 0x94], ebx
mov dword [esp + 0x98], ebx
mov dword [esp + 0x9c], ebx
push 2
mov al, bl
mov dword [esp + 0x24], esi
pop esi
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc0]
push eax
push 0x10007744
mov dword [esp + 0x38], esi
call fcn.10055feb
cmp dword [esp + 0xc8], 0
mov edi, ebx
pop ecx
pop ecx
mov dword [esp + 0x1c], ebx
jl 0x1004b1c6
lea eax, [esp + 0xd8]
push eax
push 0x10007744
call fcn.10055feb
pop ecx
pop ecx
test edi, edi
je 0x1004b13c
mov eax, dword [esp + 0xd8]
xor edx, edx
mov edi, esi
inc edx
sub edi, dword [esp + 0x20]
cmp edi, edx
jle 0x1004b0f3
mov ecx, dword [esp + 0x10]
cmp eax, edx
movzx ecx, cl
cmovg ecx, edx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x34], ebx
test eax, eax
jle 0x1004b12e
imul ecx, esi, 0xc
mov esi, dword [esp + 0x20]
add ecx, dword [esp + 0x110]
mov eax, dword [ecx]
mov dword [eax], esi
mov eax, ebx
cdq
idiv edi
mov eax, dword [ecx]
lea ecx, [ecx + 0xc]
add edx, esi
inc ebx
mov dword [eax + 4], edx
mov eax, dword [esp + 0xd8]
cmp ebx, eax
jl 0x1004b109
mov esi, dword [esp + 0x30]
xor ebx, ebx
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x20], esi
add esi, eax
mov dword [esp + 0x30], esi
inc edi
mov dword [esp + 0x1c], edi
cmp edi, dword [esp + 0xc0]
jle 0x1004b0b7
mov eax, dword [esp + 0x10]
test al, al
je 0x1004b1c6
push 0x10007bb8
call fcn.100567a1
xor eax, eax
inc eax
pop ecx
cmp esi, eax
jle 0x1004b18b
mov edi, dword [esp + 0x110]
lea ebx, [esi - 1]
add edi, 0xc
mov eax, dword [edi]
push dword [eax]
push 0x10007760
call fcn.10056438
lea edi, [edi + 0xc]
pop ecx
pop ecx
dec ebx
jne 0x1004b175
push 0x100076ad
call fcn.100567a1
xor eax, eax
inc eax
pop ecx
cmp esi, eax
jle 0x1004b1bf
mov edi, dword [esp + 0x110]
add edi, 0xc
dec esi
mov eax, dword [edi]
push dword [eax + 4]
push 0x10007760
call fcn.10056438
lea edi, [edi + 0xc]
pop ecx
pop ecx
dec esi
jne 0x1004b1a8
push 0x100076ad
jmp 0x1004b1cb
push 0x10007bc4
call fcn.100567a1
pop ecx
lea ecx, [esp + 0x110]
call fcn.1002c56c
xor esi, esi
inc esi
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], eax
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 6
jge 0x1004afcc
dec dword [esp + 0x24]
cmp dword [esp + 0x24], 0xffffffe9
jl 0x1004afb7
inc dword [esp + 0x2c]
cmp dword [esp + 0x2c], 0x15
jle 0x1004af86
push 5
pop eax
xor edi, edi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x24], eax
inc edi
cmp dword [esp + 0x24], 0x17
je 0x1004b252
mov dword [esp + 0x14], edi
mov dword [esp + 0x14], ebx
jmp 0x1004b242
mov dword [esp + 0x34], edi
cmp dword [esp + 0x34], ebx
jne 0x1004b248
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x1004b234
mov eax, dword [esp + 0x14]
inc dword [esp + 0x24]
jmp 0x1004b223
push 4
lea ecx, [esp + 0x7c]
call fcn.1002b6f7
mov dword [esp + 0x10], 0x2ba39464
mov dword [esp + 0x1bc], ebx
mov dword [esp + 0x1c0], ebx
mov dword [esp + 0x1c4], ebx
mov dword [esp + 0x1c8], ebx
mov dword [esp + 0x20], 0xfffffff6
mov dword [esp + 0x24], ebx
jmp 0x1004b29e
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x78]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 4
jl 0x1004b28f
push 3
mov dword [esp + 0x14], ebx
pop eax
jmp 0x1004b4d3
mov dword [esp + 0x1c], 0x17f75960
mov dword [esp + 0x34], 7
mov dword [esp + 0x1c], ebx
jmp 0x1004b468
mov dword [esp + 0x2c], 0x622a149c
mov dword [esp + 0x38], 0xffffffff
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1004b2f3
push 0xb10
call dword [sym.imp.USER32.dll_HideCaret]
push 3
pop eax
mov dword [esp + 0x2c], eax
cmp dword [esp + 0x2c], ebx
jl 0x1004b464
mov dword [esp + 0x14], 0xfffffff7
mov dword [esp + 0x24], 0xe45db0ff
mov dword [esp + 0x14], ebx
jmp 0x1004b44b
mov dword [esp + 0x30], 0xd3b05e26
mov dword [esp + 0x38], ebx
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x78]
cmp dword [eax + ecx*4], ebx
jne 0x1004b3b0
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x1c]
imul ecx, dword [eax + edx*4]
mov dword [esp + 0x1bc], ecx
test ecx, ecx
jne 0x1004b36a
mov esi, ebx
cmp dword [esp + 0x2c], ebx
je 0x1004b36c
mov esi, edi
mov ecx, dword [esp + 0x1c]
xor edx, edx
mov eax, dword [esp + 0x78]
cmp dword [eax + ecx*4], esi
mov eax, dword [esp + 0x14]
setg dl
xor ecx, ecx
cmp edx, eax
setle cl
cmp ecx, 9
jbe 0x1004b394
mov eax, edi
cmp dword [esp + 0x1c], ebx
jne 0x1004b396
mov eax, ebx
imul eax, eax, 0xffff
mov edx, ebx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x78]
mov eax, dword [eax]
add eax, eax
je 0x1004b3b2
mov edx, edi
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x78]
cmp edx, dword [eax + ecx*4]
jne 0x1004b3c7
mov edx, edi
cmp dword [esp + 0x2c], ebx
jne 0x1004b3c9
mov edx, ebx
mov eax, dword [esp + 0x14]
xor ecx, ecx
cmp edx, eax
push 0xfffffffffffffff6
sete cl
cmp ecx, edi
pop ecx
sbb eax, eax
inc eax
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x1c4]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
sub eax, ecx
neg eax
sbb eax, eax
inc eax
inc eax
je 0x1004b401
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x30]
sub eax, dword [esp + 0x24]
neg eax
sbb eax, eax
inc eax
cmp eax, dword [esp + 0x34]
jne 0x1004b440
mov dword [esp + 0x38], 0x3b579419
cmp dword [esp + 0x38], ebx
jne 0x1004b457
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x38], eax
jmp 0x1004b444
mov dword [esp + 0x38], ecx
inc dword [esp + 0x14]
push 3
pop eax
cmp dword [esp + 0x14], eax
jle 0x1004b31a
jmp 0x1004b45a
push 3
pop eax
dec dword [esp + 0x2c]
jns 0x1004b301
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], eax
jle 0x1004b2ca
mov dword [esp + 0x20], eax
cmp dword [esp + 0x20], ebx
jl 0x1004b4cf
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1004b4c6
push 0x1898
push 0x1210
push ebx
push ebx
push 0x1f6e
push 0x1b11
push 0x2178
push 0x119d
push 0x4ee
push 0x2010
push 0x239d
push 0x2596
push 0x10b4
call dword [sym.imp.GDI32.dll_StretchDIBits]
dec dword [esp + 0x20]
jns 0x1004b47c
push 3
pop eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], eax
jle 0x1004b2b1
cmp dword [esp + 0x78], 0
je 0x1004b4fd
push dword [esp + 0x78]
call fcn.100565a7
pop ecx
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], ebx
mov dword [esp + 0x80], ebx
mov dword [esp + 0x1c], 0xa9ef72d4
lea ecx, [esp + 0xec]
mov dword [esp + 0x10], 0xffff
push 4
call fcn.1002b6f7
mov dword [esp + 0x26c], 0xf
mov dword [esp + 0x30], 0xfffffffb
push 2
mov dword [esp + 0x28], 0x36717b38
pop esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], 0x6173b00c
mov dword [esp + 0x20], ebx
jmp 0x1004b561
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0xec]
mov dword [eax + ecx*4], 0x41145714
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 4
jl 0x1004b54b
mov eax, dword [esp + 0x1c]
cmp eax, dword [esp + 0x1c]
jle 0x1004b580
cmp dword [esp + 0x1c], ebx
je 0x1004b580
mov ecx, edi
cmp dword [esp + 0x10], ebx
jne 0x1004b582
mov ecx, ebx
mov eax, dword [esp + 0x10]
add eax, ecx
je 0x1004b592
mov eax, edi
cmp dword [esp + 0x1c], ebx
jne 0x1004b594
mov eax, ebx
cmp eax, dword [esp + 0x10]
jle 0x1004b59e
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0xec]
sub eax, 0x27d373ee
neg eax
sbb eax, eax
inc eax
mov dword [ecx + 4], eax
mov dword [esp + 0x30], eax
cmp dword [esp + 0x1c], ebx
jne 0x1004b5db
cmp dword [ecx + 4], ebx
je 0x1004b5d1
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
mov eax, edi
jmp 0x1004b5d3
mov eax, ebx
mov edx, ebx
cmp dword [esp + 0x30], eax
jge 0x1004b5dd
mov edx, edi
mov eax, dword [esp + 0x1c]
xor ecx, ecx
cmp edx, eax
setne cl
add ecx, dword [esp + 0x24]
je 0x1004b61f
mov dword [esp + 0x10], ebx
jmp 0x1004b613
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1004b60f
push 0xfa8
push 0x7e4
call dword [sym.imp.GDI32.dll_RestoreDC]
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x3a
jg 0x1004b5f4
jmp 0x1004b72c
mov dword [esp + 0x38], 0xc5533f2a
lea ecx, [esp + 0x14c]
mov dword [esp + 0x38], 0xfffffff9
mov dword [esp + 0x38], 0x38140a97
push 5
mov dword [esp + 0x34], 0xdb2a93f0
pop eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x38], 0x49d95921
mov dword [esp + 0x38], 0xc9e520c3
mov dword [esp + 0x20], 0x945cb296
mov dword [esp + 0x20], 9
push esi
call fcn.1002b6f7
mov dword [esp + 0x20], 9
push 3
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], ebx
pop ecx
jmp 0x1004b697
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x234], edi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ecx
jl 0x1004b688
mov dword [esp + 0x10], ebx
jmp 0x1004b6b5
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x14c]
mov dword [eax + ecx*4], edi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x1004b6a3
mov eax, dword [esp + 0x30]
mov ecx, 0xf82577c8
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
sub ecx, eax
jne 0x1004b6d8
mov ecx, ebx
cmp dword [esp + 0x14], ebx
je 0x1004b6da
mov ecx, edi
mov eax, dword [esp + 0x20]
inc dword [esp + 0x20]
cmp eax, ecx
jge 0x1004b6f2
mov eax, dword [esp + 0xec]
cmp dword [eax + 0xc], ebx
je 0x1004b6fa
mov eax, edi
cmp dword [esp + 0x24], ebx
jne 0x1004b6fc
mov eax, ebx
cmp dword [esp + 0x14c], 0
mov dword [esp + 0x30], eax
je 0x1004b72c
push dword [esp + 0x14c]
call fcn.100565a7
pop ecx
mov dword [esp + 0x14c], ebx
mov dword [esp + 0x150], ebx
mov dword [esp + 0x154], ebx
or dword [esp + 0x26c], 0xffffffff
push dword [esp + 0xec]
call fcn.100565a7
pop ecx
push 5
pop eax
push 3
mov dword [esp + 0xf0], ebx
lea ecx, [esp + 0x120]
mov dword [esp + 0xf4], ebx
mov dword [esp + 0xf8], ebx
mov dword [esp + 0x18], eax
pop eax
push eax
call fcn.1002b6f7
mov dword [esp + 0x26c], 0x10
lea ecx, [esp + 0x15c]
mov dword [esp + 0x20], esi
push 4
call fcn.1002b6f7
mov byte [esp + 0x26c], 0x11
mov dword [esp + 0x34], 0x1956
cmp dword [esp + 0x34], 0xd55
jge 0x1004b8d5
mov ebx, edi
mov ecx, ebx
mov eax, edi
imul ecx, ebx
mov dword [esp + 0x20], eax
mov dword [esp + 0x34], ecx
mov esi, eax
imul esi, eax
push ecx
push ecx
add esi, ecx
movd xmm0, esi
cvtdq2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.10053ed4
fstp qword [esp + 0x40]
cvttsd2si edi, qword [esp + 0x40]
pop ecx
pop ecx
mov eax, edi
imul eax, edi
cmp esi, eax
jne 0x1004b83c
mov ecx, dword [esp + 0x20]
lea eax, [edi + ecx]
imul edi, ecx
add eax, ebx
mov dword [esp + 0x5c], eax
lea eax, [esp + 0x5c]
push eax
imul edi, ebx
call fcn.1004bd4f
test eax, eax
je 0x1004b82b
lea eax, [esp + 0x5c]
push eax
call fcn.1004bd4f
test eax, eax
je 0x1004b83c
lea eax, [esp + 0x5c]
mov ecx, 0x108ad1f8
push eax
call fcn.1002b991
cmp dword [eax], edi
jge 0x1004b83c
lea eax, [esp + 0x5c]
mov ecx, 0x108ad1f8
push eax
call fcn.1002b991
mov dword [eax], edi
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x34]
inc eax
mov dword [esp + 0x20], eax
cmp eax, 0x17
jl 0x1004b7b9
inc ebx
push 1
pop edi
cmp ebx, 0x17
jl 0x1004b7aa
lea eax, [esp + 0x64]
mov esi, 0x10007740
push eax
push esi
call fcn.10055feb
pop ecx
pop ecx
push 0
pop ebx
jmp 0x1004b8c8
dec eax
mov dword [esp + 0x64], eax
lea eax, [esp + 0xc8]
push eax
push esi
call fcn.10055feb
pop ecx
pop ecx
lea eax, [esp + 0xc8]
push eax
call fcn.1004bd4f
test eax, eax
je 0x1004b8bd
lea eax, [esp + 0xc8]
mov ecx, 0x108ad1f8
push eax
call fcn.1002b991
push dword [eax]
push 0x10007768
call fcn.10056438
pop ecx
jmp 0x1004b8c7
push 0x10007794
call fcn.100567a1
pop ecx
mov eax, dword [esp + 0x64]
test eax, eax
jne 0x1004b876
dec eax
mov dword [esp + 0x64], eax
push 3
mov dword [esp + 0x14], ebx
pop edx
jmp 0x1004b8f4
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x11c]
mov dword [eax + ecx*4], 0xe665969a
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x1004b8de
mov dword [esp + 0x10], ebx
jmp 0x1004b916
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x15c]
mov dword [eax + ecx*4], 0xfffffffe
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x1004b900
mov edx, dword [esp + 0x11c]
mov eax, dword [edx + 4]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
mov esi, dword [esp + 0x11c]
sub ecx, dword [edx + 4]
mov eax, dword [esp + 0x15c]
push eax
imul ecx, dword [esi]
mov dword [eax + 4], ecx
call fcn.100565a7
or dword [esp + 0x270], 0xffffffff
pop ecx
push esi
mov dword [esp + 0x160], ebx
mov dword [esp + 0x164], ebx
mov dword [esp + 0x168], ebx
call fcn.100565a7
pop ecx
mov ecx, dword [esp + 0x180]
mov dword [esp + 0x11c], ebx
mov dword [esp + 0x120], ebx
mov dword [esp + 0x124], ebx
test ecx, ecx
je 0x1004b9c2
call fcn.100498a5
mov esi, eax
lea eax, [esp + 0x60]
push eax
call fcn.1004be33
mov dword [eax], esi
jmp 0x1004b9c6
mov esi, dword [esp + 0x28]
lea ecx, [esp + 0x17c]
call fcn.10045192
test esi, esi
je 0x1004ba76
push 2
lea ecx, [esp + 0x1f8]
call fcn.1002b6f7
xor edx, edx
mov dword [esp + 0x10], ebx
inc edx
jmp 0x1004ba04
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x174], 0xfffffffb
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x1004b9f1
mov dword [esp + 0x10], ebx
jmp 0x1004ba26
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x1f4]
mov dword [eax + ecx*4], 0x7cb3f4f4
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1004ba10
mov ecx, dword [esp + 0x1f4]
mov dword [ecx], ebx
mov eax, dword [ecx]
inc dword [ecx]
mov dword [esp + eax*4 + 0x174], 8
cmp dword [ecx], edx
jl 0x1004ba36
push ecx
call fcn.100565a7
mov edx, dword [esp + 0xd8]
pop ecx
mov ecx, esi
call fcn.100498d6
mov esi, eax
lea eax, [esp + 0xdc]
push eax
mov dword [esp + 0x16c], esi
call fcn.1004bdd1
mov dword [eax], esi
mov eax, dword [ebp + 8]
lea esi, [esp + 0x168]
mov ecx, dword [esp + 0x264]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret