Function at 0x1005b3d0
Capabilities:
Encrypt data using speck
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100fa860
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x60
mov eax, dword [0x1013c014]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x50], esi
mov eax, dword [ebx + 0x10]
shr eax, 0x10
shr eax, 0xd
and al, 1
movzx eax, al
push eax
call fcn.1005a750
mov al, byte [0x1014b62b]
mov ecx, dword [ebx + 0xc]
mov dh, byte [0x1014b4d1]
mov byte [ebp - 0x3d], al
mov byte [0x1014b62b], 0
cmp ecx, 9
jne 0x1005b6f8
test dh, dh
je 0x1005b6cc
cmp byte [esi + 0x108], 0
je 0x1005b6cc
cmp dword [0x1014b4d4], 2
je 0x1005ca10
cmp dword [esi + 0x1a4], 0
mov edi, 1
mov ecx, dword [sym.imp.USER32.dll_GetFocus]
je 0x1005b495
call ecx
cmp eax, dword [esi + 0x1a4]
jne 0x1005b48f
mov edi, 2
jmp 0x1005b4f0
mov ecx, dword [sym.imp.USER32.dll_GetFocus]
mov eax, dword [esi + 0x1b8]
test eax, eax
je 0x1005b4b6
cmp dword [eax + 8], 0
je 0x1005b4b6
call ecx
mov ecx, dword [esi + 0x1b8]
cmp dword [ecx + 8], eax
jne 0x1005b4b6
xor edi, edi
jmp 0x1005b4f0
mov eax, dword [esi + 0x54]
test eax, eax
js 0x1005b4f0
imul edi, eax, 0x54
add edi, dword [esi + 0xa0]
mov eax, dword [edi]
cmp eax, 9
jne 0x1005b4d2
lea edi, [eax - 8]
jmp 0x1005b4f0
cmp eax, 0x2f
jne 0x1005b4dc
lea edi, [eax - 0x2d]
jmp 0x1005b4f0
cmp eax, 0x26
jne 0x1005b4e6
lea edi, [eax - 0x22]
jmp 0x1005b4f0
mov edi, dword [edi + 0x18]
neg edi
sbb edi, edi
and edi, 3
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
xor edx, edx
lea ecx, [edx + 5]
test ax, ax
jns 0x1005b53e
lea eax, [edi + 4]
div ecx
mov eax, edx
mov dword [ebp - 0x2c], eax
cmp eax, 2
jne 0x1005b51f
cmp dword [esi + 0x198], 0xffffffff
jne 0x1005b57b
lea eax, [ecx - 4]
jmp 0x1005b57b
cmp eax, 4
jne 0x1005b57b
push str.ShutdownCommand
mov ecx, 0x1014e914
call fcn.100a5b80
test eax, eax
jne 0x1005b578
mov eax, 3
jmp 0x1005b57b
lea eax, [edi + 1]
div ecx
mov eax, edx
mov dword [ebp - 0x2c], eax
cmp eax, 2
jne 0x1005b55b
cmp dword [esi + 0x198], 0xffffffff
jne 0x1005b57b
lea eax, [edx + 1]
jmp 0x1005b57b
cmp eax, 4
jne 0x1005b57b
push str.ShutdownCommand
mov ecx, 0x1014e914
call fcn.100a5b80
neg eax
sbb eax, eax
and eax, dword [ebp - 0x2c]
jmp 0x1005b57b
mov eax, dword [ebp - 0x2c]
or edi, 0xffffffff
test eax, eax
je 0x1005b5f6
cmp eax, 3
je 0x1005b5f6
cmp eax, 1
jne 0x1005b597
mov edi, dword [esi + 0x1bc]
jmp 0x1005b6ac
cmp eax, 2
jne 0x1005b5a7
mov edi, dword [esi + 0x198]
jmp 0x1005b6ac
cmp eax, 4
jne 0x1005ca10
mov ecx, dword [esi + 0xa4]
mov eax, 0x30c30c31
sub ecx, dword [esi + 0xa0]
xor edi, edi
imul ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
test ecx, ecx
jle 0x1005ca10
mov eax, dword [esi + 0xa0]
nop dword [eax]
cmp dword [eax], 0x26
je 0x1005b6ac
inc edi
add eax, 0x54
cmp edi, ecx
jl 0x1005b5e0
jmp 0x1005ca10
xor ecx, ecx
mov dword [ebp - 0x50], 0x8000
test eax, eax
mov dword [ebp - 0x34], 0
mov eax, 0x30c30c31
setne cl
mov dword [ebp - 0x38], ecx
mov ecx, dword [esi + 0xa4]
sub ecx, dword [esi + 0xa0]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
test eax, eax
jle 0x1005ca10
xor eax, eax
mov dword [ebp - 0x30], eax
nop dword [eax + eax]
mov ecx, dword [esi + 0xa0]
mov edx, dword [ebp - 0x38]
cmp dword [ecx + eax + 0x18], edx
jne 0x1005b67e
mov edx, dword [ebp - 0x50]
cmp dword [ecx + eax + 0x24], edx
jge 0x1005b67e
push 1
push dword [ebp - 0x34]
mov ecx, esi
call fcn.1005b2c0
test al, al
je 0x1005b67b
mov eax, dword [esi + 0xa0]
mov ecx, dword [ebp - 0x30]
mov edi, dword [ebp - 0x34]
mov eax, dword [eax + ecx + 0x24]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [esi + 0xa4]
add eax, 0x54
sub ecx, dword [esi + 0xa0]
inc dword [ebp - 0x34]
mov dword [ebp - 0x30], eax
mov eax, 0x30c30c31
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
jl 0x1005b640
test edi, edi
js 0x1005ca10
mov edx, esi
mov ecx, 0x10
call fcn.1003e390
push 0
push 0
push 0
push edi
jmp 0x1005ca09
cmp dword [esi + 0x1a4], 0
je 0x1005b6f8
cmp dword [esi + 0x1b0], 0
jne 0x1005b6f8
mov edx, esi
xor ecx, ecx
call fcn.1003e390
push 0
push 0
push 0
push dword [esi + 0x198]
jmp 0x1005ca09
mov edi, dword [esi + 0x54]
mov dword [ebp - 0x34], edi
test edi, edi
js 0x1005b7b2
cmp dword [esi + 0x1b0], 0
jne 0x1005b7b2
cmp ecx, 0x71
jne 0x1005b776
mov eax, dword [esi + 0xa0]
imul ecx, edi, 0x54
cmp dword [ecx + eax], 0
jne 0x1005ca10
cmp dword [ecx + eax + 0x38], 0
je 0x1005ca10
cmp dword [ecx + eax + 0x3c], 0
jne 0x1005ca10
push 0
push 0
push 7
push edi
mov ecx, esi
call fcn.10040810
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1005ca10
push 0
push edi
push 0x40e
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x1005ca10
cmp ecx, 0x2e
jne 0x1005b7b2
mov eax, dword [esi + 0xa0]
imul ecx, edi, 0x54
mov edx, dword [ecx + eax]
test edx, edx
je 0x1005b794
cmp edx, 4
jne 0x1005ca10
cmp dword [ecx + eax + 0x38], 0
je 0x1005ca10
cmp dword [ecx + eax + 0x3c], 0
jne 0x1005ca10
push 0
push 0
push 8
jmp 0x1005b747
mov dl, byte [esi + 0x30]
test dl, dl
jne 0x1005b7e9
cmp dword [esi + 0x198], 0
jl 0x1005b7e9
cmp ecx, 0x46
jne 0x1005b7e9
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1005bbbb
push 0
push 0
push 0
push dword [esi + 0x198]
jmp 0x1005ca09
cmp ecx, 0x24
je 0x1005c8f9
cmp ecx, 0x23
je 0x1005c8f9
cmp ecx, 0x21
je 0x1005b809
cmp ecx, 0x22
jne 0x1005bb9d
xor eax, eax
test edi, edi
cmovns eax, edi
cmp dword [esi + 0x17c], 0
mov dword [ebp - 0x30], eax
jle 0x1005b8b4
cmp eax, dword [esi + 0x178]
jge 0x1005ca10
xor ecx, ecx
mov dword [ebp - 0x3c], 0
test dl, dl
mov eax, 0xa68
cmovne ecx, eax
mov eax, dword [esi + 0x17c]
cdq
idiv dword [ecx + 0x1014c288]
lea ecx, [eax - 1]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], ecx
mov edx, eax
mov dword [ebp - 0x28], edx
test ecx, ecx
jle 0x1005bb79
mov dword [ebp - 0x28], eax
mov ecx, dword [ebx + 0xc]
cmp ecx, 0x21
jne 0x1005b87b
sub eax, 1
mov dword [ebp - 0x30], eax
js 0x1005bb7c
jmp 0x1005b88b
inc eax
mov dword [ebp - 0x30], eax
cmp eax, dword [esi + 0x178]
jge 0x1005bb7c
push 1
push eax
mov ecx, esi
call fcn.1005b2c0
mov edx, dword [ebp - 0x28]
test al, al
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x30]
cmovne edx, eax
inc ecx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x3c], ecx
cmp ecx, dword [ebp - 0x38]
jl 0x1005b865
jmp 0x1005bb79
mov edi, dword [esi + 0x1d4]
cmp dword [esi + 0x1d0], edi
mov edi, dword [ebp - 0x34]
jle 0x1005b9db
cmp ecx, 0x21
jne 0x1005b8ef
mov ecx, dword [esi + 0x1c8]
cmp eax, ecx
jge 0x1005b8dc
mov edx, ecx
jmp 0x1005b92b
mov edx, eax
sub edx, dword [esi + 0x1d4]
mov dword [ebp - 0x28], edx
cmp edx, ecx
jge 0x1005b92e
mov edx, ecx
jmp 0x1005b92b
mov edx, dword [esi + 0x1c8]
mov dword [ebp - 0x28], edx
cmp eax, edx
jl 0x1005b939
mov ecx, dword [esi + 0xa4]
mov eax, 0x30c30c31
sub ecx, dword [esi + 0xa0]
imul ecx
sar edx, 4
mov eax, edx
dec edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esi + 0x1d4]
add edx, dword [ebp - 0x30]
cmp edx, eax
cmovg edx, eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x28], edx
mov ecx, dword [ebx + 0xc]
cmp eax, edx
je 0x1005ca10
imul eax, edx, 0x54
mov dword [ebp - 0x3c], eax
mov edi, eax
mov eax, dword [esi + 0xa0]
cmp dword [edi + eax + 0x10], 0
mov edi, dword [ebp - 0x34]
je 0x1005bb7c
mov dword [ebp - 4], 1
call fcn.100215d0
push eax
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0
call fcn.1001fd70
mov dword [ebp - 4], 2
push 0x1014be70
mov dword [ebp - 0x1c], 0x1014be70
mov byte [ebp - 0x18], 0
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockShared]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x58]
mov eax, dword [esi + 0xa0]
add eax, dword [ebp - 0x3c]
mov eax, dword [eax + 0x10]
add eax, 0x34
push eax
call fcn.10021ca0
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.100233f0
mov eax, dword [ebp - 0x58]
cmp dword [eax - 0xc], 0
je 0x1005b9c7
push eax
mov ecx, esi
call fcn.1004e510
mov eax, dword [ebp - 0x58]
lea ecx, [eax - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.10013920
jmp 0x1005bb76
test dl, dl
je 0x1005ca10
cmp ecx, 0x21
jne 0x1005ba97
imul ecx, eax, 0x54
mov eax, dword [esi + 0xa0]
mov eax, dword [ecx + eax + 0x18]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x30]
test eax, eax
jle 0x1005ba39
lea eax, [ebp - 0x6c]
push eax
lea ecx, [esi + 0xa0]
call fcn.10035120
mov eax, dword [eax]
cmp dword [eax - 0x3c], 0
jle 0x1005ba36
imul ecx, dword [ebp - 0x30], 0x54
mov eax, dword [esi + 0xa0]
mov edx, dword [ebp - 0x58]
cmp dword [ecx + eax - 0x3c], edx
mov eax, dword [ebp - 0x30]
je 0x1005ba39
dec edx
mov dword [ebp - 0x58], edx
jmp 0x1005ba39
mov eax, dword [ebp - 0x30]
xor ecx, ecx
mov edx, eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x28], edx
test eax, eax
jle 0x1005bb79
mov dword [ebp - 0x2c], ecx
nop
push 1
push ecx
mov ecx, esi
call fcn.1005b2c0
test al, al
je 0x1005ba70
mov eax, dword [esi + 0xa0]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x58]
cmp dword [eax + ecx + 0x18], edx
je 0x1005ba8c
mov ecx, dword [ebp - 0x44]
add dword [ebp - 0x2c], 0x54
inc ecx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x44], ecx
cmp ecx, eax
jl 0x1005ba50
mov edx, eax
mov dword [ebp - 0x28], edx
jmp 0x1005bb79
mov edx, dword [ebp - 0x44]
mov dword [ebp - 0x28], edx
jmp 0x1005bb79
imul edx, eax, 0x54
mov eax, dword [esi + 0xa0]
mov dword [ebp - 0x58], edx
mov ecx, dword [eax + edx + 0x18]
mov dword [ebp - 0x44], ecx
mov ecx, dword [esi + 0xa4]
sub ecx, eax
mov eax, 0x30c30c31
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
dec eax
add eax, edx
cmp dword [ebp - 0x30], eax
jge 0x1005baf7
lea eax, [ebp - 0x18]
push eax
lea ecx, [esi + 0xa0]
call fcn.10035120
mov eax, dword [eax]
cmp dword [eax - 0x3c], 0
jle 0x1005baf7
imul ecx, dword [ebp - 0x30], 0x54
mov eax, dword [esi + 0xa0]
mov edx, dword [ebp - 0x44]
cmp dword [ecx + eax + 0x6c], edx
je 0x1005baf7
inc edx
mov dword [ebp - 0x44], edx
mov ecx, dword [esi + 0xa4]
mov eax, 0x30c30c31
sub ecx, dword [esi + 0xa0]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x28], edx
cmp edx, eax
jge 0x1005bb79
mov edi, edx
mov dword [ebp - 0x28], edi
push 1
push edi
mov ecx, esi
call fcn.1005b2c0
test al, al
je 0x1005bb4d
mov eax, dword [esi + 0xa0]
mov edx, dword [ebp - 0x58]
mov esi, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x28]
cmp dword [eax + edx + 0x18], esi
mov esi, dword [ebp - 0x50]
cmove ecx, edi
mov dword [ebp - 0x28], ecx
mov ecx, dword [esi + 0xa4]
mov eax, 0x30c30c31
sub ecx, dword [esi + 0xa0]
inc edi
add dword [ebp - 0x58], 0x54
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jl 0x1005bb23
mov edi, dword [ebp - 0x34]
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebx + 0xc]
test edx, edx
js 0x1005bb9d
mov edx, esi
xor ecx, ecx
call fcn.1003e390
mov eax, dword [ebp - 0x28]
mov ecx, esi
push 0
push 0
push 0
push eax
call fcn.10040810
mov ecx, dword [ebx + 0xc]
cmp ecx, 0x26
je 0x1005bbc5
cmp ecx, 0x28
je 0x1005bbc5
cmp ecx, 0x25
je 0x1005bbc5
cmp ecx, 0x27
je 0x1005bbc5
cmp ecx, 0x1b
je 0x1005bbc5
cmp ecx, 0xd
je 0x1005bbc5
mov eax, 1
jmp 0x1005ca12
or eax, 0xffffffff
test edi, edi
jns 0x1005bbe3
cmp dword [esi + 0x1b0], 0
je 0x1005bbdb
mov edi, dword [esi + 0x198]
test edi, edi
cmovs edi, eax
mov dword [ebp - 0x34], edi
cmp byte [esi + 0x30], 0
jne 0x1005bc12
cmp dword [0x1014b4d4], 1
jne 0x1005bc12
call dword [sym.imp.USER32.dll_GetFocus]
mov ecx, dword [esi + 0x1b8]
cmp eax, dword [ecx + 8]
jne 0x1005bc12
mov edi, dword [esi + 0x1c0]
mov byte [ebp - 0x45], 1
mov dword [ebp - 0x34], edi
jmp 0x1005bc16
mov byte [ebp - 0x45], 0
mov ecx, dword [esi + 0xa4]
mov eax, 0x30c30c31
sub ecx, dword [esi + 0xa0]
imul ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [ebx + 0xc]
mov dword [ebp - 0x30], ecx
cmp edx, 0x26
jne 0x1005c01a
mov dword [ebp - 0x28], 0xffffffff
test edi, edi
jns 0x1005bcd7
xor eax, eax
cmp byte [esi + 0x108], al
setne al
xor ecx, ecx
xor edi, edi
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x2c], ecx
cmp dword [ebp - 0x30], ecx
jle 0x1005bcd1
xor edx, edx
mov dword [ebp - 0x44], edx
mov eax, dword [esi + 0xa0]
add eax, edx
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x54], eax
cmp dword [eax + 0x18], edx
jne 0x1005bcb2
push 1
push ecx
mov ecx, esi
call fcn.1005b2c0
test al, al
je 0x1005bcb2
mov eax, dword [ebp - 0x54]
mov cl, byte [eax + 0x30]
test cl, 0x20
je 0x1005bca4
test cl, 0x40
je 0x1005bcb2
cmp dword [0x1014b4d4], 2
jne 0x1005bccb
cmp dword [eax], 0x26
jne 0x1005bccb
mov eax, dword [ebp - 0x2c]
add dword [ebp - 0x44], 0x54
inc eax
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x2c], eax
cmp eax, ecx
jge 0x1005bcd4
mov edx, dword [ebp - 0x44]
mov ecx, eax
jmp 0x1005bc73
mov edi, dword [ebp - 0x2c]
mov dword [ebp - 0x34], edi
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x28], edi
mov edx, dword [esi + 0x1d0]
test edx, edx
jle 0x1005bd16
mov eax, dword [esi + 0x198]
sub eax, dword [esi + 0x1a0]
inc eax
cmp edi, eax
jne 0x1005bd03
mov eax, dword [esi + 0x1c8]
dec eax
add eax, edx
mov dword [ebp - 0x28], eax
jmp 0x1005be73
cmp edi, dword [esi + 0x1c8]
jle 0x1005bd16
lea eax, [edi - 1]
mov dword [ebp - 0x28], eax
jmp 0x1005be73
mov edx, dword [esi + 0xa0]
imul eax, edi, 0x54
mov dword [ebp - 0x44], 0
mov edi, dword [eax + edx + 0x18]
mov dword [ebp - 0x60], edi
mov edi, dword [eax + edx + 0x20]
mov eax, dword [eax + edx + 0x24]
mov edx, dword [esi + 0x178]
mov dword [ebp - 0x4c], edi
mov edi, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
test edx, edx
jle 0x1005bd6d
mov ecx, dword [esi + 0xa0]
lea eax, [edx - 1]
imul eax, eax, 0x54
mov eax, dword [eax + ecx + 0x2c]
sub eax, dword [esi + 0x17c]
sub eax, dword [esi + 0x120]
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x38]
mov esi, dword [ebp - 0x44]
mov dword [ebp - 0x2c], eax
sub dword [ebp - 0x2c], esi
cmp edi, edx
mov edx, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x50]
cmovge edx, eax
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x54], SysReAllocString
mov dword [ebp - 0x5c], 1
cmp ecx, 1
jle 0x1005be70
lea edx, [edi - 1]
add edx, ecx
mov dword [ebp - 0x3c], edx
mov eax, edx
cdq
idiv ecx
push 1
mov edi, edx
mov ecx, esi
push edi
mov dword [ebp - 0x38], edi
call fcn.1005b2c0
test al, al
je 0x1005be50
mov eax, dword [ebp - 0x38]
mov edx, SysReAllocString
imul ecx, edi, 0x54
add ecx, dword [esi + 0xa0]
mov edi, dword [ecx + 0x2c]
sub edi, dword [ebp - 0x44]
cmp eax, dword [esi + 0x178]
cmovge edi, dword [ecx + 0x2c]
test dword [esi + 0x3c], 0x400000
mov dword [ebp - 0x68], edi
jne 0x1005be40
cmp dword [esi + 0x1d0], 0
jle 0x1005be00
mov eax, dword [ebp - 0x5c]
cmp eax, dword [esi + 0x1c8]
jge 0x1005be50
mov eax, dword [ebp - 0x60]
cmp dword [ecx + 0x18], eax
jne 0x1005be27
mov edi, dword [ebp - 0x2c]
cmp dword [ebp - 0x68], edi
jg 0x1005be27
mov eax, dword [ecx + 0x20]
sub eax, dword [ebp - 0x4c]
cdq
xor eax, edx
sub eax, edx
mov edx, edi
sub edx, dword [ebp - 0x68]
shl edx, 0x10
add edx, eax
jmp 0x1005be40
mov al, byte [ecx + 0x30]
test al, 0x20
je 0x1005be32
test al, 0x40
je 0x1005be50
cmp dword [0x1014b4d4], 2
jne 0x1005be40
cmp dword [ecx], 0x26
je 0x1005be50
cmp edx, dword [ebp - 0x54]
jge 0x1005be50
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x28], eax
jmp 0x1005be53
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x5c]
dec dword [ebp - 0x3c]
inc edx
mov ecx, dword [ebp - 0x30]
cmp edx, ecx
mov dword [ebp - 0x5c], edx
mov edx, dword [ebp - 0x3c]
jl 0x1005bda3
mov edi, dword [ebp - 0x34]
jmp 0x1005be73
mov eax, dword [ebp - 0x28]
test eax, eax
js 0x1005bf64
push 0
push 0
push 0
push eax
mov ecx, esi
call fcn.10040810
mov ecx, dword [ebp - 0x28]
imul edx, ecx, 0x54
mov dword [ebp - 0x4c], edx
add edx, dword [esi + 0xa0]
mov eax, dword [edx + 0x48]
and eax, 0xf
cmp al, 7
jne 0x1005bf42
cmp dword [edx + 0x10], 0
je 0x1005bf42
mov dword [ebp - 4], 5
call fcn.100215d0
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 4
call fcn.1001fd70
mov dword [ebp - 4], 6
push 0x1014be70
mov dword [ebp - 0x64], 0x1014be70
mov byte [ebp - 0x60], 0
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockShared]
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x2c]
mov eax, dword [esi + 0xa0]
add eax, dword [ebp - 0x4c]
mov eax, dword [eax + 0x10]
add eax, 0x34
push eax
call fcn.10021ca0
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 6
call fcn.100233f0
mov eax, dword [ebp - 0x2c]
cmp dword [eax - 0xc], 0
je 0x1005bf30
test dword [esi + 0x3c], 0x400000
push eax
je 0x1005bf26
mov ecx, dword [esi + 0x44]
jmp 0x1005bf28
mov ecx, esi
call fcn.1004e510
mov eax, dword [ebp - 0x2c]
lea ecx, [eax - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.10013920
mov ecx, dword [ebp - 0x28]
cmp byte [esi + 0x30], 0
jne 0x1005bf64
cmp dword [0x1014b4d4], 1
jne 0x1005bf64
cmp ecx, dword [esi + 0x1c0]
jne 0x1005bf64
mov ecx, dword [esi + 0x1b8]
call fcn.10077b50
mov edx, dword [ebx + 0xc]
xor al, al
cmp edx, 0x1b
je 0x1005c566
test al, al
je 0x1005c5ef
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x1005bfaf
mov ecx, dword [0x1014c068]
mov eax, ecx
mov edx, dword [0x1014c064]
sub eax, edx
sar eax, 2
cmp eax, 1
ja 0x1005c572
jne 0x1005bfaf
cmp byte [esi + 0x30], 0
jne 0x1005c572
test edi, edi
js 0x1005c5ec
mov eax, dword [esi + 0xa0]
imul ecx, edi, 0x54
add eax, ecx
mov dword [ebp - 0x4c], eax
mov cl, byte [eax + 0x30]
test cl, 0x20
je 0x1005c37d
test cl, 0x40
jne 0x1005c37d
push 1
dec edi
mov ecx, esi
push edi
call fcn.1005b2c0
test al, al
jne 0x1005bfff
nop dword [eax]
push 1
dec edi
mov ecx, esi
push edi
call fcn.1005b2c0
test al, al
je 0x1005bff0
test edi, edi
js 0x1005c5ec
push 0
push 0
push 0
push edi
mov ecx, esi
call fcn.10040810
jmp 0x1005c5ec
cmp edx, 0x28
jne 0x1005c32b
cmp byte [ebp - 0x3d], 0
mov eax, 0xffffffff
mov dword [ebp - 0x28], eax
cmovne edi, eax
test edi, edi
jns 0x1005c0a6
lea eax, [ecx - 1]
xor edi, edi
mov dword [ebp - 0x3c], eax
test eax, eax
js 0x1005c0a3
imul edx, eax, 0x54
mov dword [ebp - 0x38], edx
nop dword [eax + eax]
mov ecx, dword [esi + 0xa0]
add ecx, edx
push 1
mov dword [ebp - 0x4c], ecx
mov ecx, esi
push eax
call fcn.1005b2c0
test al, al
je 0x1005c087
mov eax, dword [ebp - 0x4c]
mov cl, byte [eax + 0x30]
test cl, 0x20
je 0x1005c079
test cl, 0x40
je 0x1005c087
cmp dword [0x1014b4d4], 2
jne 0x1005c09d
cmp dword [eax], 0x26
jne 0x1005c09d
mov eax, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x38]
dec eax
sub edx, 0x54
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], edx
test eax, eax
jns 0x1005c050
jmp 0x1005c0a0
mov edi, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x28], edi
cmp dword [esi + 0x1d0], 0
jle 0x1005c0df
cmp edi, dword [esi + 0x198]
jne 0x1005c0c5
mov edx, dword [esi + 0x1c8]
mov dword [ebp - 0x28], edx
jmp 0x1005c229
cmp edi, dword [esi + 0x1c8]
jl 0x1005c0df
lea eax, [ecx - 1]
cmp edi, eax
jge 0x1005c0df
lea edx, [edi + 1]
mov dword [ebp - 0x28], edx
jmp 0x1005c229
mov edx, dword [esi + 0xa0]
imul eax, edi, 0x54
mov dword [ebp - 0x3c], 0
mov ecx, dword [eax + edx + 0x18]
mov dword [ebp - 0x4c], ecx
mov ecx, dword [eax + edx + 0x20]
mov eax, dword [eax + edx + 0x2c]
mov edx, dword [esi + 0x178]
mov dword [ebp - 0x60], ecx
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
test edx, edx
jle 0x1005c136
mov ecx, dword [esi + 0xa0]
lea eax, [edx - 1]
imul eax, eax, 0x54
mov eax, dword [eax + ecx + 0x2c]
sub eax, dword [esi + 0x17c]
sub eax, dword [esi + 0x120]
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0x3c]
cmp edi, edx
mov dword [ebp - 0x68], SysReAllocString
cmovge eax, dword [ebp - 0x38]
mov dword [ebp - 0x54], eax
mov eax, 1
mov dword [ebp - 0x44], eax
cmp ecx, eax
jle 0x1005c226
nop dword [eax]
add eax, edi
cdq
idiv ecx
push 1
mov eax, edx
mov ecx, esi
push eax
mov dword [ebp - 0x5c], eax
call fcn.1005b2c0
test al, al
je 0x1005c20f
imul ecx, dword [ebp - 0x5c], 0x54
mov eax, dword [ebp - 0x5c]
add ecx, dword [esi + 0xa0]
mov edx, dword [ecx + 0x24]
sub edx, dword [ebp - 0x3c]
cmp eax, dword [esi + 0x178]
cmovge edx, dword [ecx + 0x24]
test dword [esi + 0x3c], 0x400000
mov dword [ebp - 0x38], edx
mov edx, SysReAllocString
jne 0x1005c1ff
cmp dword [esi + 0x1d0], 0
jle 0x1005c1be
mov eax, dword [ebp - 0x44]
cmp eax, dword [esi + 0x1c8]
jge 0x1005c20f
mov eax, dword [ebp - 0x4c]
cmp dword [ecx + 0x18], eax
jne 0x1005c1e6
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x38], eax
jl 0x1005c1e6
mov eax, dword [ecx + 0x20]
sub eax, dword [ebp - 0x60]
cdq
xor eax, edx
sub eax, edx
mov edx, dword [ebp - 0x38]
sub edx, dword [ebp - 0x54]
shl edx, 0x10
add edx, eax
jmp 0x1005c1ff
mov al, byte [ecx + 0x30]
test al, 0x20
je 0x1005c1f1
test al, 0x40
je 0x1005c20f
cmp dword [0x1014b4d4], 2
jne 0x1005c1ff
cmp dword [ecx], 0x26
je 0x1005c20f
cmp edx, dword [ebp - 0x68]
jge 0x1005c20f
mov dword [ebp - 0x68], edx
mov edx, dword [ebp - 0x5c]
mov dword [ebp - 0x28], edx
jmp 0x1005c212
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x44], eax
cmp eax, ecx
jl 0x1005c160
jmp 0x1005c229
mov edx, dword [ebp - 0x28]
test edx, edx
js 0x1005bf64
push 0
push 0
push 0
push edx
mov ecx, esi
call fcn.10040810
mov ecx, dword [ebp - 0x28]
imul edx, ecx, 0x54
mov dword [ebp - 0x4c], edx
add edx, dword [esi + 0xa0]
mov eax, dword [edx + 0x48]
and eax, 0xf
cmp al, 7
jne 0x1005c2f8
cmp dword [edx + 0x10], 0
je 0x1005c2f8
mov dword [ebp - 4], 9
call fcn.100215d0
push eax
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 8
call fcn.1001fd70
mov dword [ebp - 4], 0xa
push 0x1014be70
mov dword [ebp - 0x64], 0x1014be70
mov byte [ebp - 0x60], 0
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockShared]
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x34]
mov eax, dword [esi + 0xa0]
add eax, dword [ebp - 0x4c]
mov eax, dword [eax + 0x10]
add eax, 0x34
push eax
call fcn.10021ca0
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0xa
call fcn.100233f0
mov eax, dword [ebp - 0x34]
cmp dword [eax - 0xc], 0
je 0x1005c2e6
test dword [esi + 0x3c], 0x400000
push eax
je 0x1005c2dc
mov ecx, dword [esi + 0x44]
jmp 0x1005c2de
mov ecx, esi
call fcn.1004e510
mov eax, dword [ebp - 0x34]
lea ecx, [eax - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.10013920
mov ecx, dword [ebp - 0x28]
cmp byte [esi + 0x30], 0
jne 0x1005bf64
cmp dword [0x1014b4d4], 1
jne 0x1005bf64
cmp ecx, dword [esi + 0x1c0]
jne 0x1005bf64
mov ecx, dword [esi + 0x1b8]
call fcn.10077b10
jmp 0x1005bf64
cmp edx, 0x1b
jne 0x1005c34d
cmp dword [0x1014b4d4], 3
jne 0x1005bf67
push 1
push 0
mov ecx, esi
call fcn.100603b0
jmp 0x1005ca10
cmp edx, 0x25
jne 0x1005c360
cmp byte [0x1014b4f3], 0
je 0x1005c376
jmp 0x1005bf67
cmp edx, 0x27
jne 0x1005bf67
cmp byte [0x1014b4f3], 0
je 0x1005bf67
mov al, 1
jmp 0x1005bf69
cmp dword [0x1014b4d4], 3
jne 0x1005c38c
cmp dword [eax + 0x50], 0
jge 0x1005c33d
mov eax, dword [eax + 0x18]
mov ecx, dword [esi + 0x98]
dec eax
sub ecx, dword [esi + 0x94]
sar ecx, 2
add eax, ecx
cdq
idiv ecx
mov ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x60], edx
mov eax, dword [ecx + 0x2c]
add eax, dword [ecx + 0x24]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0x2c], eax
cmp edi, dword [esi + 0x178]
jge 0x1005c3c9
sub eax, dword [esi + 0x180]
mov dword [ebp - 0x2c], eax
cmp byte [esi + 0x108], 0
je 0x1005c43c
cmp byte [ebp - 0x45], 0
je 0x1005c43c
mov eax, dword [esi + 0x1b8]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 9
push 0x110a
push dword [eax + 8]
call edi
xorps xmm0, xmm0
movups xmmword [ebp - 0x24], xmm0
test eax, eax
je 0x1005c416
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
mov eax, dword [esi + 0x1b8]
push 1
push 0x1104
push dword [eax + 8]
call edi
push 2
lea eax, [ebp - 0x24]
push eax
mov eax, dword [esi + 0x1b8]
push dword [esi + 0xc]
push dword [eax + 8]
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x20]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0x2c], eax
xor ecx, ecx
mov edx, SysReAllocString
or edi, 0xffffffff
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x34], ecx
cmp dword [ebp - 0x30], ecx
jle 0x1005c5ec
mov dword [ebp - 0x28], ecx
nop dword [eax + eax]
mov eax, dword [esi + 0xa0]
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x60]
cmp dword [eax + edx + 0x18], ecx
mov ecx, dword [ebp - 0x34]
jne 0x1005c4ee
push 1
push ecx
mov ecx, esi
call fcn.1005b2c0
test al, al
je 0x1005c4eb
mov eax, dword [esi + 0xa0]
mov edx, dword [ebp - 0x28]
add edx, eax
mov al, byte [edx + 0x30]
test al, 0x20
je 0x1005c499
test al, al
jns 0x1005c4eb
mov eax, dword [edx + 0x24]
mov edx, dword [edx + 0x2c]
inc eax
mov ecx, dword [ebp - 0x34]
dec edx
mov dword [ebp - 0x38], eax
cmp ecx, dword [esi + 0x178]
jge 0x1005c4bf
mov ecx, dword [esi + 0x180]
sub eax, ecx
sub edx, ecx
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x34]
sub edx, dword [ebp - 0x2c]
mov eax, edx
cdq
xor eax, edx
sub eax, edx
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0x2c]
cdq
xor eax, edx
sub eax, edx
mov edx, dword [ebp - 0x4c]
cmp eax, edx
cmovl edx, eax
cmp dword [ebp - 0x54], edx
jle 0x1005c4ee
mov edi, ecx
mov dword [ebp - 0x54], edx
jmp 0x1005c4ee
mov ecx, dword [ebp - 0x34]
add dword [ebp - 0x28], 0x54
inc ecx
mov dword [ebp - 0x34], ecx
cmp ecx, dword [ebp - 0x30]
jl 0x1005c460
test edi, edi
js 0x1005c5ec
push 0
push 0
push 0
push edi
mov ecx, esi
call fcn.10040810
cmp dword [0x1014b4d4], 1
jne 0x1005c5ec
cmp edi, dword [esi + 0x1c0]
jne 0x1005c5ec
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
push 1
push eax
mov eax, dword [esi + 0x1b8]
mov dword [ebp - 0x1c], 0
push dword [eax + 8]
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_MapWindowPoints]
push dword [ebp - 0x18]
mov ecx, dword [esi + 0x1b8]
call fcn.10077a10
jmp 0x1005c5ec
mov ecx, dword [0x1014c068]
mov edx, dword [0x1014c064]
mov eax, ecx
sub eax, edx
sar eax, 2
mov eax, dword [edx + eax*4 - 4]
cmp byte [eax + 0x31], 0
jne 0x1005c59e
push 0
push 0
push 0x10
push dword [eax + 0xc]
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [0x1014c068]
mov edx, dword [0x1014c064]
mov eax, ecx
sub eax, edx
sar eax, 2
cmp eax, 2
jb 0x1005c5c7
mov eax, dword [edx + eax*4 - 8]
cmp byte [eax + 0x31], 0
jne 0x1005c5c7
mov ecx, eax
call fcn.1005a870
mov ecx, dword [0x1014c068]
mov edx, dword [0x1014c064]
sub ecx, edx
and ecx, 0xfffffffc
cmp ecx, 4
jne 0x1005c5ec
cmp byte [esi + 0x30], 0
je 0x1005c5e5
push dword [0x1014b4a8]
call dword [sym.imp.USER32.dll_SetFocus]
jmp 0x1005c5ec
and dword [0x1014b504], 0xfffffffe
mov edx, dword [ebx + 0xc]
cmp edx, 0x27
jne 0x1005c65c
cmp byte [0x1014b4f3], 0
je 0x1005c66a
xor cl, cl
mov byte [ebp - 0x3d], cl
cmp edx, 0xd
je 0x1005c60f
test cl, cl
je 0x1005ca10
test edi, edi
js 0x1005c8a1
imul eax, edi, 0x54
mov dword [ebp - 0x2c], eax
mov eax, dword [esi + 0xa0]
mov esi, dword [ebp - 0x2c]
test byte [esi + eax + 0x30], 1
mov esi, dword [ebp - 0x50]
je 0x1005c671
test cl, cl
jne 0x1005c63e
mov ecx, dword [ebp - 0x2c]
test byte [ecx + eax + 0x31], 1
jne 0x1005c674
cmp edx, 0xd
je 0x1005c650
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x1005c66e
push 0
push 0
push 2
push edi
jmp 0x1005ca09
cmp edx, 0x25
jne 0x1005c5fd
cmp byte [0x1014b4f3], 0
je 0x1005c5fd
mov cl, 1
jmp 0x1005c5ff
mov edx, dword [ebx + 0xc]
mov ecx, dword [ebp - 0x2c]
cmp edx, 0xd
jne 0x1005c685
push 0
push 0
push 4
push edi
jmp 0x1005ca09
cmp byte [ebp - 0x3d], 0
je 0x1005ca10
mov eax, dword [esi + 0xa0]
add eax, ecx
mov dword [ebp - 0x4c], eax
mov cl, byte [eax + 0x30]
test cl, 0x20
je 0x1005c6d8
test cl, cl
js 0x1005c6d8
push 1
inc edi
mov ecx, esi
push edi
call fcn.1005b2c0
test al, al
jne 0x1005c6c4
push 1
inc edi
mov ecx, esi
push edi
call fcn.1005b2c0
test al, al
je 0x1005c6b5
test edi, edi
js 0x1005ca10
push 0
push 0
push 0
push edi
jmp 0x1005ca09
mov eax, dword [eax + 0x18]
mov ecx, dword [esi + 0x98]
inc eax
sub ecx, dword [esi + 0x94]
cdq
sar ecx, 2
idiv ecx
mov ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x60], edx
mov eax, dword [ecx + 0x2c]
add eax, dword [ecx + 0x24]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0x2c], eax
cmp edi, dword [esi + 0x178]
jge 0x1005c713
sub eax, dword [esi + 0x180]
mov dword [ebp - 0x2c], eax
cmp byte [esi + 0x108], 0
je 0x1005c786
cmp byte [ebp - 0x45], 0
je 0x1005c786
mov eax, dword [esi + 0x1b8]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 9
push 0x110a
push dword [eax + 8]
call edi
xorps xmm0, xmm0
movups xmmword [ebp - 0x24], xmm0
test eax, eax
je 0x1005c760
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
mov eax, dword [esi + 0x1b8]
push 1
push 0x1104
push dword [eax + 8]
call edi
push 2
lea eax, [ebp - 0x24]
push eax
mov eax, dword [esi + 0x1b8]
push dword [esi + 0xc]
push dword [eax + 8]
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x20]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0x2c], eax
or edx, 0xffffffff
xor edi, edi
mov ecx, SysReAllocString
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x54], ecx
cmp dword [ebp - 0x30], edi
jle 0x1005ca10
mov dword [ebp - 0x28], edi
mov eax, dword [esi + 0xa0]
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x60]
cmp dword [eax + ecx + 0x18], edx
mov edx, dword [ebp - 0x34]
jne 0x1005c829
push 1
push edi
mov ecx, esi
call fcn.1005b2c0
test al, al
je 0x1005c826
mov eax, dword [esi + 0xa0]
mov edx, dword [ebp - 0x28]
add edx, eax
mov al, byte [edx + 0x30]
test al, 0x20
je 0x1005c7db
test al, 0x40
je 0x1005c826
mov eax, dword [edx + 0x24]
mov edx, dword [edx + 0x2c]
inc eax
dec edx
mov dword [ebp - 0x38], eax
cmp edi, dword [esi + 0x178]
jge 0x1005c7fb
mov ecx, dword [esi + 0x180]
sub eax, ecx
mov dword [ebp - 0x38], eax
sub edx, ecx
sub edx, dword [ebp - 0x2c]
mov eax, edx
cdq
mov ecx, eax
mov eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0x2c]
xor ecx, edx
sub ecx, edx
cdq
xor eax, edx
sub eax, edx
cmp eax, ecx
cmovl ecx, eax
cmp dword [ebp - 0x54], ecx
jle 0x1005c826
mov edx, edi
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x34], edx
jmp 0x1005c829
mov edx, dword [ebp - 0x34]
add dword [ebp - 0x28], 0x54
inc edi
cmp edi, dword [ebp - 0x30]
jl 0x1005c7a2
test edx, edx
js 0x1005ca10
push 0
push 0
push 0
push edx
mov ecx, esi
call fcn.10040810
cmp dword [0x1014b4d4], 1
jne 0x1005ca10
mov eax, dword [ebp - 0x34]
cmp eax, dword [esi + 0x1c0]
jne 0x1005ca10
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x70]
push 1
push eax
mov eax, dword [esi + 0x1b8]
mov dword [ebp - 0x6c], 0
push dword [eax + 8]
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_MapWindowPoints]
push dword [ebp - 0x6c]
mov ecx, dword [esi + 0x1b8]
call fcn.10077a10
jmp 0x1005ca10
test cl, cl
je 0x1005ca10
mov edi, dword [ebp - 0x30]
sub edi, 1
js 0x1005ca10
imul eax, edi, 0x54
mov dword [ebp - 0x50], eax
nop dword [eax + eax]
push 1
push edi
mov ecx, esi
call fcn.1005b2c0
test al, al
je 0x1005c8eb
mov eax, dword [esi + 0xa0]
mov ecx, dword [ebp - 0x50]
mov al, byte [eax + ecx + 0x30]
test al, 0x20
je 0x1005b6c0
test al, 0x40
jne 0x1005b6c0
sub dword [ebp - 0x50], 0x54
sub edi, 1
jns 0x1005c8c0
jmp 0x1005ca10
or eax, 0xffffffff
mov dword [ebp - 0x38], eax
test dh, dh
je 0x1005c920
cmp byte [esi + 0x108], 0
je 0x1005c920
test edi, edi
js 0x1005c920
mov eax, dword [esi + 0xa0]
imul ecx, edi, 0x54
mov eax, dword [ecx + eax + 0x18]
mov dword [ebp - 0x38], eax
mov ecx, dword [esi + 0xa4]
or eax, 0xffffffff
mov dword [ebp - 0x3c], eax
xor edi, edi
mov eax, dword [esi + 0xa0]
sub ecx, eax
mov dword [ebp - 0x50], eax
mov eax, 0x30c30c31
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
test eax, eax
jle 0x1005ca10
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x38]
cmp edx, 0xffffffff
je 0x1005c968
mov eax, dword [ebp - 0x50]
cmp dword [eax + ecx + 0x18], edx
jne 0x1005c9ba
push 1
push edi
mov ecx, esi
call fcn.1005b2c0
test al, al
je 0x1005c9ba
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [eax + ecx]
cmp eax, 0x2f
je 0x1005c9ba
cmp byte [0x1014b4d1], 0
je 0x1005c9af
cmp byte [esi + 0x108], 0
je 0x1005c9af
cmp eax, 9
je 0x1005c9ba
cmp eax, 0x33
je 0x1005c9ba
cmp eax, 0x34
je 0x1005c9ba
cmp eax, 0x35
je 0x1005c9ba
cmp eax, 0x26
je 0x1005c9ba
cmp dword [ebx + 0xc], 0x24
mov eax, edi
mov dword [ebp - 0x3c], eax
je 0x1005c9ef
mov eax, dword [esi + 0xa0]
inc edi
mov ecx, dword [esi + 0xa4]
add dword [ebp - 0x2c], 0x54
sub ecx, eax
mov dword [ebp - 0x50], eax
mov eax, 0x30c30c31
imul ecx
mov ecx, dword [ebp - 0x2c]
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jl 0x1005c957
mov eax, dword [ebp - 0x3c]
test eax, eax
js 0x1005ca10
mov edx, esi
mov ecx, 0x10
call fcn.1003e390
mov eax, dword [ebp - 0x3c]
push 0
push 0
push 0
push eax
mov ecx, esi
call fcn.10040810
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100d4906
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x10