Function at 0x1001bb94
Capabilities:
Access peb ldr_data
Check os version
Get graphical window text
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100887c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c8
push ebx
push esi
push edi
mov dword [esp + 0x30], 0xf606
or edi, 0xffffffff
mov dword [esp + 0x30], 0x2667a876
mov dword [esp + 0x58], ecx
lea ecx, [esp + 0x14c]
mov dword [esp + 0x30], edi
mov dword [esp + 0x30], 0x696a485b
mov dword [esp + 0x30], 0xbeb7161a
push 1
mov dword [esp + 0xc4], edx
call fcn.10019b25
xor ebx, ebx
lea ecx, [esp + 0x114]
push 1
mov dword [esp + 0x1e0], ebx
call fcn.10019b25
xor edx, edx
mov dword [esp + 0xc], ebx
inc edx
jmp 0x1001bc2e
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x14c]
mov dword [eax + ecx*4], 0x813f1a07
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jl 0x1001bc18
mov dword [esp + 0xc], ebx
jmp 0x1001bc50
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x114]
mov dword [eax + ecx*4], 0x5aa96141
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jl 0x1001bc3a
mov eax, dword [esp + 0x114]
lea ecx, [esp + 0x114]
inc dword [eax]
call fcn.1001a431
lea ecx, [esp + 0x14c]
mov dword [esp + 0x1dc], edi
call fcn.1001a431
push dword [esp + 0x58]
lea eax, [esp + 0x184]
mov dword [esp + 0x10], 0xf6c74aa0
push eax
lea eax, [esp + 0x178]
mov dword [esp + 0xac], ebx
push eax
xorps xmm0, xmm0
mov dword [esp + 0xb4], ebx
push ebx
lea ecx, [esp + 0xb4]
mov dword [esp + 0xbc], ebx
movdqu xmmword [esp + 0x180], xmm0
call fcn.1001b28b
mov esi, dword [esp + 0xa4]
mov dword [esp + 0x2c], 0x7d7c869b
mov dword [esp + 0x28], edi
mov dword [esp + 0x14], 0xec352115
mov eax, dword [esp + 0xc]
add eax, 0xd32f
mov dword [esi + 0xc], 9
cmp dword [esp + 0xc], eax
jne 0x1001bd03
cmp dword [esp + 0xc], ebx
jne 0x1001bd03
mov edx, ebx
jmp 0x1001bd06
xor edx, edx
inc edx
mov eax, dword [esp + 0xc]
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0xc]
setle cl
sub eax, ecx
neg eax
sbb eax, eax
inc eax
sub eax, dword [esp + 0xc]
neg eax
sbb eax, eax
inc eax
cmp eax, dword [esp + 0xc]
jg 0x1001bd34
cmp dword [esi + 0xc], ebx
jne 0x1001bd34
mov ecx, ebx
jmp 0x1001bd37
xor ecx, ecx
inc ecx
mov eax, dword [esp + 0xc]
xor edx, edx
imul eax, ecx
cmp eax, 9
mov eax, dword [esp + 0xc]
setge dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [esp + 0x2c], ecx
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
xor eax, eax
inc eax
cmp dword [esp + 0xc], eax
jle 0x1001bd72
cmp dword [esp + 0x28], ebx
jne 0x1001bd72
mov eax, ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0x14], ebx
jmp 0x1001bda4
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x1001bda0
push 0x1185
push 0x2640
push 0x1870
push 0xec7
call dword [sym.imp.GDI32.dll_CreateRectRgn]
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jle 0x1001bd7c
lea ecx, [esp + 0xa4]
call fcn.1001a431
xor esi, esi
mov dword [esp + 0x18], 0x3ae35568
inc esi
mov dword [esp + 0x24], 8
mov dword [esp + 0x1c], esi
lea ecx, [esp + 0x120]
mov dword [esp + 0x14], edi
push 4
call fcn.10019b25
push 4
mov dword [esp + 0x1c], 0x20b28787
mov dword [esp + 0x10], ebx
pop edx
jmp 0x1001be04
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x180], 0xdc85
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jl 0x1001bdf1
mov dword [esp + 0xc], ebx
jmp 0x1001be26
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x120]
mov dword [eax + ecx*4], 0xc7008b15
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jl 0x1001be10
mov dword [esp + 0x1c], ebx
cmp dword [esp + 0x1c], 3
jg 0x1001bf3b
mov edi, dword [esp + 0x120]
mov dword [esp + 0x28], 0xfffffff6
mov dword [esp + 0xc], 0x9642e40
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + eax*4 + 0x180]
mov eax, dword [esp + 0x18]
dec dword [esp + 0x18]
test eax, eax
je 0x1001be71
mov edx, esi
cmp dword [esp + 0x18], ebx
jne 0x1001be73
mov edx, ebx
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov eax, dword [esp + 0xc]
cmp eax, 0xffffffff
setge cl
xor eax, eax
cmp ecx, 0x40ee
setge al
xor ecx, ecx
mov dword [edi + 8], eax
mov dword [esp + 0x28], edx
mov eax, dword [esp + 0x14]
cmp dword [edi + 8], eax
mov eax, dword [esp + 0xc]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x28]
setg dl
xor ecx, ecx
cmp eax, edx
setle cl
cmp ecx, 0xcc09
jne 0x1001bec7
mov eax, esi
cmp dword [esp + 0x28], ebx
jne 0x1001bec9
mov eax, ebx
xor ecx, ecx
cmp eax, 0xffff
mov eax, dword [esp + 0x14]
sete cl
xor edx, edx
cmp ecx, eax
setl dl
xor ecx, ecx
imul edx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + eax*4 + 0x180]
inc edx
cmp edx, eax
setl cl
mov dword [esp + 0x14], ecx
mov eax, dword [esp + 0x14]
sub eax, 0x50e8f7cf
cmp eax, dword [esp + 0x1c]
jge 0x1001bf11
mov eax, ebx
cmp dword [esp + 0x14], ebx
je 0x1001bf13
mov eax, esi
mov dword [esp + 0xc], eax
mov ecx, 0x88acc167
mov eax, dword [esp + 0x1c]
cmp ecx, eax
sbb eax, eax
neg eax
mov dword [edi + 4], eax
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 3
jle 0x1001be42
or edi, 0xffffffff
lea ecx, [esp + 0x120]
call fcn.1001a431
mov dword [esp + 0x14], 0x2c03342e
mov dword [esp + 0x14], ebx
jmp 0x1001bf67
mov dword [esp + 0x20], 0xf54c3c69
cmp dword [esp + 0x20], ebx
jne 0x1001bf6e
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0x13
je 0x1001bf55
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x1001bf84
push 0x48d
push ebx
call dword [sym.imp.USER32.dll_GetSubMenu]
mov dword [esp + 0x14], ebx
jmp 0x1001bf9d
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x1bc], 0xb905d09e
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x1001bf8a
mov dword [esp + 0x1c], esi
lea ecx, [esp + 0x138]
mov dword [esp + 0x14], edi
push 4
call fcn.10019b25
push 4
mov dword [esp + 0x1c], 0x20b28787
mov dword [esp + 0x10], ebx
pop edx
jmp 0x1001bfde
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x1a0], 0xdc85
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jl 0x1001bfcb
mov dword [esp + 0xc], ebx
jmp 0x1001c000
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x138]
mov dword [eax + ecx*4], 0xc7008b15
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jl 0x1001bfea
mov dword [esp + 0x1c], ebx
cmp dword [esp + 0x1c], 3
jg 0x1001c115
mov edi, dword [esp + 0x138]
mov dword [esp + 0x28], 0xfffffff6
mov dword [esp + 0xc], 0x9642e40
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + eax*4 + 0x1a0]
mov eax, dword [esp + 0x18]
dec dword [esp + 0x18]
test eax, eax
je 0x1001c04b
mov edx, esi
cmp dword [esp + 0x18], ebx
jne 0x1001c04d
mov edx, ebx
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov eax, dword [esp + 0xc]
cmp eax, 0xffffffff
setge cl
xor eax, eax
cmp ecx, 0x40ee
setge al
xor ecx, ecx
mov dword [edi + 8], eax
mov dword [esp + 0x28], edx
mov eax, dword [esp + 0x14]
cmp dword [edi + 8], eax
mov eax, dword [esp + 0xc]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x28]
setg dl
xor ecx, ecx
cmp eax, edx
setle cl
cmp ecx, 0xcc09
jne 0x1001c0a1
mov eax, esi
cmp dword [esp + 0x28], ebx
jne 0x1001c0a3
mov eax, ebx
xor ecx, ecx
cmp eax, 0xffff
mov eax, dword [esp + 0x14]
sete cl
xor edx, edx
cmp ecx, eax
setl dl
xor ecx, ecx
imul edx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + eax*4 + 0x1a0]
inc edx
cmp edx, eax
setl cl
mov dword [esp + 0x14], ecx
mov eax, dword [esp + 0x14]
sub eax, 0x50e8f7cf
cmp eax, dword [esp + 0x1c]
jge 0x1001c0eb
mov eax, ebx
cmp dword [esp + 0x14], ebx
je 0x1001c0ed
mov eax, esi
mov dword [esp + 0xc], eax
mov ecx, 0x88acc167
mov eax, dword [esp + 0x1c]
cmp ecx, eax
sbb eax, eax
neg eax
mov dword [edi + 4], eax
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 3
jle 0x1001c01c
or edi, 0xffffffff
lea ecx, [esp + 0x138]
call fcn.1001a431
xor ecx, ecx
mov dword [esp + 0x18], 0x12
inc ecx
cmp dword [esp + 0x18], 0xffffffe3
jge 0x1001c7b3
push ecx
lea ecx, [esp + 0x100]
call fcn.10019b25
xor edx, edx
mov dword [esp + 0x1c], 0x960f57a7
mov dword [esp + 0x14], ebx
inc edx
jmp 0x1001c16b
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xfc]
mov dword [eax + ecx*4], 0x862f
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x1001c155
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001c193
push 0x1b04
push 0x25bf
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov dword [esp + 0x1c], ebx
push 2
pop esi
cmp dword [esp + 0x1c], ebx
jl 0x1001c1e3
mov dword [esp + 0x14], esi
mov dword [esp + 0x14], ebx
jmp 0x1001c1c7
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001c1c3
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_KillTimer]
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ebx
jle 0x1001c1aa
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0xfc]
cmp dword [eax + ecx*4], ebx
jne 0x1001c1e3
dec dword [esp + 0x1c]
jns 0x1001c1a0
lea ecx, [esp + 0xfc]
call fcn.1001a431
mov dword [esp + 0x28], 1
mov dword [esp + 0xc], ebx
jmp 0x1001c20c
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0xec], ebx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 4
jl 0x1001c1fd
mov dword [esp + 0xc], ebx
jmp 0x1001c22c
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x1c4], 0xdbeccce1
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x1001c219
mov dword [esp + 0xf4], ebx
jmp 0x1001c274
mov dword [esp + 0x14], 1
mov dword [esp + 0x14], esi
cmp dword [esp + 0x14], ebx
jl 0x1001c26d
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001c267
push ebx
push 0x1abf
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
dec dword [esp + 0x14]
jns 0x1001c24e
dec dword [esp + 0xf4]
cmp dword [esp + 0xf4], 0xfffffff1
jne 0x1001c23c
push esi
lea ecx, [esp + 0x60]
call fcn.10019b25
mov dword [esp + 0xc], 0x905c8094
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], ebx
jmp 0x1001c2ad
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x5c]
mov dword [eax + ecx*4], 1
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x1001c29a
mov dword [esp + 0xc], 1
cmp dword [esp + 0xc], ebx
jl 0x1001c3ff
mov dword [esp + 0x14], edi
mov dword [esp + 0x2c], 7
mov dword [esp + 0x20], 0xd10fbf2b
mov dword [esp + 0x14], 1
cmp dword [esp + 0x14], ebx
jl 0x1001c3f5
mov edx, dword [esp + 0x5c]
mov dword [esp + 0x34], edx
mov dword [esp + 0x38], 0xfffffffa
xor ecx, ecx
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
cmp eax, dword [edx + 4]
mov eax, dword [esp + 0x1c]
setg cl
sub ecx, eax
cmp ecx, 8
je 0x1001c31a
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
xor ecx, ecx
mov edi, dword [esp + 0xc]
mov esi, dword [esp + 0x5c]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0xc]
cmp eax, 0xffffffff
mov eax, dword [esp + 0x1c]
setg cl
xor edx, edx
cmp ecx, dword [esi + edi*4]
mov esi, dword [esp + 0x20]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x5c]
setl cl
xor edx, edx
cmp dword [eax + esi*4], ecx
mov eax, dword [esp + 0x14]
setl dl
sub edx, eax
add edx, 0xdcef
je 0x1001c379
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x5c]
cmp dword [eax + ecx*4], ebx
je 0x1001c379
xor esi, esi
inc esi
jmp 0x1001c37b
mov esi, ebx
mov ecx, dword [esp + 0xc]
xor edx, edx
mov eax, dword [esp + 0x5c]
cmp esi, dword [eax + ecx*4]
sete dl
mov dword [esp + 0x1c], edx
xor edx, edx
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x5c]
mov eax, dword [eax + ecx*4]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0xc]
mov esi, dword [esp + 0x14]
mov ecx, dword [esp + 0x5c]
cmp dword [ecx + eax*4], 1
setl dl
xor eax, eax
cmp edx, dword [ecx + esi*4]
mov edx, dword [esp + 0x34]
setne al
xor ecx, ecx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x38]
cmp dword [esp + 0x20], eax
setl cl
mov dword [esp + 0x20], ecx
mov dword [esp + 0x38], 0x85b3d925
dec dword [esp + 0x14]
jns 0x1001c2f3
or edi, 0xffffffff
dec dword [esp + 0xc]
jns 0x1001c2c5
lea ecx, [esp + 0x5c]
call fcn.1001a431
mov dword [esp + 0x14], ebx
jmp 0x1001c421
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0xe4], 0x26d2e858
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x1001c40e
dec dword [esp + 0x24]
xor ecx, ecx
mov dword [esp + 0x24], ebx
inc ecx
jmp 0x1001c7a0
mov dword [esp + 0x28], ecx
cmp dword [esp + 0x28], ebx
jl 0x1001c79c
mov dword [esp + 0x1c], 8
lea ecx, [esp + 0xd8]
mov dword [esp + 0x20], 0x2db8e964
mov dword [esp + 0x34], 0x9725245f
mov dword [esp + 0x14], 4
mov dword [esp + 0x14], edi
mov dword [esp + 0x14], 0x3acb
mov dword [esp + 0x38], 0xfff8
push 2
call fcn.10019b25
xor ecx, ecx
inc ecx
mov dword [esp + 0x1dc], ecx
mov dword [esp + 0xc], ebx
jmp 0x1001c4a4
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x3c], ebx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], ecx
jl 0x1001c498
mov dword [esp + 0xc], ebx
jmp 0x1001c4bf
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x9c], edi
inc dword [esp + 0xc]
cmp dword [esp + 0xc], ecx
jl 0x1001c4b0
mov dword [esp + 0xc], ebx
jmp 0x1001c4db
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x44], 0x142c
inc dword [esp + 0xc]
cmp dword [esp + 0xc], ecx
jl 0x1001c4cb
mov dword [esp + 0xc], ebx
jmp 0x1001c4fd
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0xd8]
mov dword [eax + ecx*4], 0xfffffffe
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x1001c4e7
mov dword [esp + 0x1c], ebx
cmp dword [esp + 0x1c], ebx
jg 0x1001c6d8
mov esi, dword [esp + 0xd8]
mov dword [esp + 0x30], 0xfffffff6
lea ecx, [esp + 0x164]
mov dword [esp + 0x2c], 0xc345fe46
mov dword [esp + 0x30], edi
mov dword [esp + 0xc], 3
push 2
call fcn.10019b25
push 2
lea ecx, [esp + 0x15c]
mov byte [esp + 0x1e0], 2
call fcn.10019b25
push 2
mov dword [esp + 0x10], ebx
pop edx
jmp 0x1001c574
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x164]
mov dword [eax + ecx*4], edi
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jl 0x1001c562
mov dword [esp + 0xc], ebx
jmp 0x1001c596
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x158]
mov dword [eax + ecx*4], 1
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jl 0x1001c580
inc dword [esp + 0x44]
xor edx, edx
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x14]
cmp eax, ecx
setge dl
cmp dword [esp + 0x3c], edx
jne 0x1001c5c0
cmp dword [esp + 0x44], ebx
je 0x1001c5c0
xor edx, edx
inc edx
jmp 0x1001c5c2
mov edx, ebx
dec dword [esp + 0x38]
xor ecx, ecx
mov eax, dword [esp + 0x38]
cmp eax, edx
setle cl
cmp ecx, 0x31a2
jle 0x1001c5e4
cmp dword [esp + 0x2c], ebx
je 0x1001c5e4
xor edx, edx
inc edx
jmp 0x1001c5e6
mov edx, ebx
mov eax, dword [esp + 0x44]
xor ecx, ecx
cmp edx, eax
mov edx, 0xffff
setne cl
mov dword [esp + 0x14], ecx
xor ecx, ecx
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + eax*4 + 0x3c]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + eax*4 + 0x3c]
mov eax, dword [esp + 0x34]
mov dword [esp + 0x9c], edx
mov eax, dword [esp + 0x1c]
cmp eax, edx
setle cl
mov dword [esp + 0x14], ecx
mov eax, dword [esp + 0x3c]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x34]
sub edx, eax
mov eax, dword [esp + 0xd8]
add ecx, edx
cmp ecx, dword [eax]
jge 0x1001c64f
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + eax*4 + 0x3c]
mov eax, dword [esp + 0x2c]
xor ecx, ecx
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + eax*4 + 0x3c]
mov eax, dword [esp + 0x30]
cmp dword [esi + 4], eax
setle cl
mov dword [esp + 0x20], ecx
mov dword [esp + 0x14], ebx
jmp 0x1001c6a4
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], 3
mov eax, dword [esp + 0x30]
mov dword [esp + 0x2c], eax
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], al
je 0x1001c6a0
push ebx
push 0x22c8
push 0x20ec
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ebx
jle 0x1001c671
lea ecx, [esp + 0x158]
call fcn.1001a431
lea ecx, [esp + 0x164]
mov byte [esp + 0x1dc], 1
call fcn.1001a431
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], ebx
jle 0x1001c519
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001c6f6
push ebx
push ebx
push 0xb43
push 0x254a
push ebx
call dword [sym.imp.USER32.dll_InsertMenuW]
lea ecx, [esp + 0xd8]
mov dword [esp + 0x1dc], edi
call fcn.1001a431
xor ecx, ecx
mov dword [esp + 0xc], 0x746a1c17
mov dword [esp + 0xc], ebx
inc ecx
jmp 0x1001c78c
mov dword [esp + 0x14], 0x3e763161
mov eax, dword [esp + 0x24]
cmp dword [esp + eax*4 + 0xe4], ebx
jne 0x1001c792
mov dword [esp + 0x14], ecx
cmp dword [esp + 0x14], ebx
jl 0x1001c788
mov dword [esp + 0x1c], 0xc9fa8bc0
mov dword [esp + 0x1c], ebx
jmp 0x1001c77c
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001c766
push 0x546
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_RedrawWindow]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0xe4], ecx
xor ecx, ecx
inc dword [esp + 0x1c]
inc ecx
cmp dword [esp + 0x1c], ecx
jle 0x1001c747
dec dword [esp + 0x14]
jns 0x1001c739
inc dword [esp + 0xc]
cmp dword [esp + 0xc], ecx
jle 0x1001c71a
dec dword [esp + 0x28]
jns 0x1001c446
inc dword [esp + 0x24]
cmp dword [esp + 0x24], ecx
jle 0x1001c438
dec dword [esp + 0x18]
jmp 0x1001c12c
mov dword [esp + 0x30], 0xc05baf43
mov dword [esp + 0x34], 0x53d8da8e
mov dword [esp + 0x20], edi
mov dword [esp + 0x2c], 0xfffffffe
push 4
pop esi
mov dword [esp + 0x38], esi
mov dword [esp + 0x20], 0xfffffff8
mov dword [esp + 0x28], edi
mov dword [esp + 0x18], ebx
jmp 0x1001c7f8
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x40], 0x8c66f5a9
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ecx
jl 0x1001c7e8
dec dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
cmp dword [esp + 0x34], ebx
je 0x1001c810
mov eax, dword [esp + 0x40]
mov eax, dword [esp + 0x40]
xor edx, edx
mov eax, dword [esp + 0x38]
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x20]
sub ecx, eax
mov eax, dword [esp + 0x2c]
cmp ecx, eax
mov ecx, 0x91c84132
push 3
setl dl
xor eax, eax
cmp edx, edi
setne al
cmp ecx, eax
mov eax, dword [esp + 0x44]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [esp + 0x44]
setle dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [esp + 0x44], ecx
lea ecx, [esp + 0x6c]
mov dword [esp + 0xd4], edi
call fcn.10019b25
mov dword [esp + 0x28], 0xa012e1df
mov dword [esp + 0x18], ebx
jmp 0x1001c88c
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x68]
mov dword [eax + ecx*4], esi
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jl 0x1001c87d
mov esi, dword [esp + 0x68]
xor eax, eax
mov edi, dword [sym.imp.USER32.dll_GetDC]
inc eax
cmp dword [esi], eax
jl 0x1001ca58
mov esi, dword [esi]
xor ecx, ecx
mov dword [esp + 0x14], 2
mov dword [esp + 0x2c], eax
mov dword [esp + 0x2c], 0xe607d19f
mov dword [esp + 0x20], 0xc2f92e6c
mov dword [esp + 0x20], 0xc013cef3
mov dword [esp + 0x34], 0xc0a9
mov dword [esp + 0x18], 0x9c328129
mov eax, dword [esp + 0x14]
cmp esi, eax
mov eax, dword [esp + 0x68]
setg cl
xor edx, edx
cmp ecx, esi
setge dl
xor ecx, ecx
cmp dword [eax + 4], edx
sete cl
mov dword [esp + 0x2c], ecx
xor ecx, ecx
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x68]
mov edx, dword [eax]
mov eax, dword [esp + 0x20]
cmp eax, edx
setl cl
xor eax, eax
cmp ecx, edx
setle al
xor ecx, ecx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x68]
cmp dword [eax], ebx
mov eax, dword [esp + 0x14]
mov dword [esp + 0x2c], eax
setne cl
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 0x18], ecx
mov edx, dword [esp + 0x18]
mov ecx, dword [eax]
mov eax, dword [esp + 0x14]
add ecx, ecx
add eax, ecx
add edx, eax
mov eax, dword [esp + 0x14]
imul eax, dword [esp + 0x28]
cmp eax, edx
je 0x1001ca23
mov dword [esp + 0x24], 0xf9f41adf
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x68]
dec edx
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, dword [eax]
mov edx, dword [esp + 0x24]
setg cl
sub edx, ecx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
sub edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, 0x25dbf607
setl al
cmp eax, dword [esp + 0x24]
jne 0x1001c9cb
cmp dword [esp + 0x28], ebx
jne 0x1001c9cb
mov edx, ebx
jmp 0x1001c9ce
xor edx, edx
inc edx
mov eax, dword [esp + 0x24]
xor ecx, ecx
cmp edx, eax
setne cl
cmp ecx, dword [esp + 0x24]
jge 0x1001c9e9
cmp dword [esp + 0x34], ebx
jne 0x1001c9e9
mov esi, ebx
jmp 0x1001c9ec
xor esi, esi
inc esi
mov eax, dword [esp + 0x24]
xor ecx, ecx
mov edx, dword [esp + 0x68]
cmp eax, dword [edx]
setle cl
xor eax, eax
cmp ecx, esi
setl al
imul eax, dword [edx + 8]
neg eax
sbb eax, eax
xor ecx, ecx
neg eax
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x24]
cmp dword [esp + 0x30], eax
setne cl
mov dword [esp + 0x2c], ecx
jmp 0x1001ca92
mov dword [esp + 0x20], 0x11ebc848
xor edx, edx
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
cmp ecx, eax
setle dl
mov dword [esp + 0x20], edx
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001ca92
push ebx
push 0x1ce1
push ebx
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetLBound]
jmp 0x1001ca92
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001ca76
push 0x119a
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001ca92
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_GetWindowOrgEx]
lea ecx, [esp + 0x68]
call fcn.1001a431
push 2
mov dword [esp + 0xb4], 0x9a7b445a
lea ecx, [esp + 0x130]
mov dword [esp + 0xa4], 9
pop esi
mov dword [esp + 0x28], 0xe2fde2bb
mov dword [esp + 0x24], 0x4888999d
push esi
call fcn.10019b25
mov dword [esp + 0x20], 1
mov dword [esp + 0x20], 0x2f37fc03
mov dword [esp + 0x30], 0x49cff29c
mov dword [esp + 0x18], ebx
jmp 0x1001cb02
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x12c]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jl 0x1001caef
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x28]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
add eax, dword [esp + 0x24]
cmp eax, dword [esp + 0x28]
jle 0x1001cb26
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x24]
imul eax, dword [esp + 0x24]
test eax, eax
je 0x1001cb37
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x24]
xor edx, edx
mov eax, dword [esp + 0x28]
cmp ecx, eax
mov eax, dword [esp + 0x12c]
setg dl
xor ecx, ecx
mov dword [eax], edx
mov dword [esp + 0x20], 1
mov eax, dword [esp + 0x20]
cmp edx, eax
mov eax, dword [esp + 0x24]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x24]
setg dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [esp + 0x30], ecx
lea ecx, [esp + 0x12c]
call fcn.1001a431
mov dword [esp + 0xd4], 0x585fafe4
mov dword [esp + 0x28], 0x98a8f939
mov dword [esp + 0x20], 0x921b0ae2
mov dword [esp + 0x30], 0x99ea
cmp dword [esp + 0x28], ebx
je 0x1001cbcc
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001cc5f
push ebx
call dword [sym.imp.GDI32.dll_CreatePenIndirect]
jmp 0x1001cc5f
mov dword [esp + 0x24], ebx
mov dword [esp + 0x30], 0xa42bbd4a
mov dword [esp + 0x18], ebx
jmp 0x1001cbf1
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x144], 0xfffffff6
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jl 0x1001cbde
mov eax, dword [esp + 0x24]
add eax, dword [esp + 0x28]
neg eax
sbb eax, eax
neg eax
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x24]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x144], eax
mov ecx, dword [esp + 0x24]
sub ecx, dword [esp + 0x28]
neg ecx
sbb ecx, ecx
imul eax, eax, 0x65de
xor edx, edx
inc ecx
cmp ecx, eax
setle dl
add edx, dword [esp + 0x24]
mov eax, dword [esp + 0x24]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp eax, edx
setl cl
mov dword [esp + 0x30], ecx
push 0x74ae
push 0x592a
push ebx
call fcn.100208d7
mov dword [esp + 0x24], 3
add esp, 0xc
mov dword [esp + 0x30], 0xfffffff6
mov dword [esp + 0x34], 0x136dc992
mov dword [esp + 0x2c], 0x2bbd4aa4
mov dword [esp + 0x20], 0x5e09b704
mov dword [esp + 0x18], ebx
jmp 0x1001ccb0
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x74], 5
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jl 0x1001cca0
xor ecx, ecx
mov dword [esp + 0x18], ebx
inc ecx
jmp 0x1001ce7d
mov dword [esp + 0xc], 0x6e60b0c
mov dword [esp + 0x20], 0x8b26de0d
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001ccf9
push ebx
push ebx
push 0x14a2
push 0x1918
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
xor ecx, ecx
inc ecx
mov dword [esp + 0xc], ecx
cmp dword [esp + 0xc], ebx
jl 0x1001ce79
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x20], 9
mov eax, dword [esp + 0xc]
cmp dword [esp + eax*4 + 0x74], ebx
jne 0x1001ce79
mov dword [esp + 0x14], ebx
jmp 0x1001ce65
push dword [esp + 0x58]
movdqa xmm0, xmmword [0x10007dd0]
lea eax, [esp + 0x1a4]
push eax
lea eax, [esp + 0x198]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x28], ecx
lea ecx, [esp + 0xbc]
push eax
mov dword [esp + 0x2c], ebx
push ebx
movdqu xmmword [esp + 0x1a0], xmm0
mov dword [esp + 0xc4], ebx
mov dword [esp + 0xc8], ebx
mov dword [esp + 0xcc], ebx
call fcn.1001b28b
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + eax*4 + 0x74]
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x74], ecx
cmp dword [esp + 0x14], ebx
je 0x1001ce04
cmp dword [esp + 0x30], ebx
jne 0x1001cdfb
mov eax, dword [esp + 0xc]
mov eax, dword [esp + eax*4 + 0x74]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
sub eax, 0x5b1510af
cmp eax, 0xffffffff
je 0x1001cdc6
mov eax, dword [esp + 0xc]
cmp dword [esp + eax*4 + 0x74], ebx
je 0x1001cdc6
xor edx, edx
inc edx
jmp 0x1001cdc8
mov edx, ebx
mov eax, dword [esp + 0x34]
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0xc]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x14]
setle dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0x20]
cmp dword [esp + 0xc], eax
jg 0x1001cdfb
mov eax, ebx
jmp 0x1001cdfe
xor eax, eax
inc eax
mov dword [esp + 0x2c], eax
jmp 0x1001ce52
mov dword [esp + 0x2c], 0x7d6a5839
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001ce29
push 0x1bcf
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
mov eax, dword [esp + 0xb4]
xor edx, edx
mov eax, dword [eax + 0xc]
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x20]
cmp eax, ecx
setne dl
mov dword [esp + 0x2c], edx
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x20], eax
lea ecx, [esp + 0xb4]
call fcn.1001a431
inc dword [esp + 0x14]
xor ecx, ecx
inc ecx
cmp dword [esp + 0x14], ecx
jle 0x1001cd2e
dec dword [esp + 0xc]
jns 0x1001cd07
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ecx
jle 0x1001ccc2
lea eax, [esp + 0xd4]
push eax
lea eax, [esp + 0xb4]
push eax
push 0x289f
lea eax, [esp + 0xdc]
push eax
lea eax, [esp + 0xb0]
push ebx
push eax
call fcn.1001fb5c
add esp, 0x18
mov dword [esp + 0x30], 7
mov dword [esp + 0x18], ebx
push 3
pop edx
jmp 0x1001ced9
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x1b0], 0x960f57a7
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edx
jl 0x1001cec6
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001cefd
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_EndPage]
push 3
pop edx
mov eax, dword [esp + 0x30]
xor ecx, ecx
mov dword [esp + 0x1b8], eax
inc ecx
mov dword [esp + 0xc], ecx
mov eax, 0x2d149fe
mov dword [esp + 0x7c], eax
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], eax
mov dword [esp + 0x88], eax
mov dword [esp + 0x34], 7
mov dword [esp + 0x38], 0x4bfcc0c2
mov dword [esp + 0xc], 0xffffffee
jmp 0x1001d165
push 4
pop eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x20], 0x3c5ebb4e
mov dword [esp + 0x18], ebx
cmp dword [esp + 0x18], eax
jge 0x1001cf7a
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x48], 0x733c6338
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 4
jl 0x1001cf63
cmp dword [esp + 0xc], ebx
jne 0x1001d170
mov dword [esp + 0x50], edx
cmp dword [esp + 0x50], ebx
jl 0x1001d161
mov dword [esp + 0x1c], 0x4f16efa4
mov dword [esp + 0x1c], edx
cmp dword [esp + 0x1c], ebx
jl 0x1001d157
mov dword [esp + 0x24], ecx
mov dword [esp + 0x2c], 0x534a
mov dword [esp + 0x20], 0xade45a91
mov dword [esp + 0x30], 0x111919b1
mov dword [esp + 0x30], 0x900a
mov dword [esp + 0x24], edx
cmp dword [esp + 0x24], ebx
jl 0x1001d14d
mov dword [esp + 0x28], ecx
mov dword [esp + 0x18], 0x20a73bc0
mov eax, dword [esp + 0x50]
mov eax, dword [esp + eax*4 + 0x7c]
inc dword [esp + 0x2c]
je 0x1001d029
mov eax, dword [esp + 0x50]
xor edx, edx
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x48]
cmp ecx, eax
setne dl
cmp edx, 0xfffffffa
jge 0x1001d019
cmp dword [esp + 0x1c], ebx
je 0x1001d019
xor ecx, ecx
inc ecx
mov eax, ecx
jmp 0x1001d01e
xor ecx, ecx
mov eax, ebx
inc ecx
mov dword [esp + 0x20], eax
cmp dword [esp + 0x20], 6
jb 0x1001d031
mov eax, ebx
cmp dword [esp + 0x4c], ebx
je 0x1001d033
mov eax, ecx
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
cmp eax, dword [esp + 0x24]
jg 0x1001d047
cmp dword [esp + 0x2c], ebx
jne 0x1001d049
mov ecx, ebx
mov eax, dword [esp + 0x50]
xor edx, edx
imul eax, ecx
mov ecx, dword [esp + 0xc]
add ecx, eax
mov eax, dword [esp + 0x24]
cmp ecx, eax
mov eax, dword [esp + 0x50]
setg dl
xor ecx, ecx
mov eax, dword [esp + eax*4 + 0x7c]
cmp edx, eax
setg cl
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + eax*4 + 0x7c]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x50]
mov eax, dword [esp + 0x50]
mov eax, dword [esp + 0x50]
mov eax, dword [esp + eax*4 + 0x7c]
mov eax, dword [esp + 0xc]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
sub eax, dword [esp + 0x7c]
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x50]
mov dword [esp + eax*4 + 0x7c], 4
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x50]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x48]
sub ecx, eax
mov dword [esp + 0x20], ecx
je 0x1001d0dc
mov eax, dword [esp + 0x84]
mov eax, dword [esp + 0x1c]
xor ecx, ecx
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x38]
cmp eax, 1
mov eax, dword [esp + 0x38]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x18]
setle dl
xor ecx, ecx
cmp edx, eax
setge cl
cmp ecx, dword [esp + 0x1c]
jle 0x1001d124
cmp dword [esp + 0xc], ebx
jne 0x1001d124
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x30], eax
jmp 0x1001d13a
cmp dword [esp + 0x1c], ebx
je 0x1001d134
mov dword [esp + 0x28], 0x102f310e
jmp 0x1001d13a
cmp dword [esp + 0x54], ebx
jne 0x1001d147
dec dword [esp + 0x24]
push 1
pop ecx
jns 0x1001cfda
xor ecx, ecx
push 3
inc ecx
pop edx
dec dword [esp + 0x1c]
jns 0x1001cfa8
dec dword [esp + 0x50]
jns 0x1001cf92
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 0xe
jne 0x1001cf4a
mov dword [esp + 0xc], 0xfffffff7
xor edx, edx
mov dword [esp + 0x1c], 0x923607a9
mov dword [esp + 0x14], 0x93dda37b
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
cmp eax, ecx
setl dl
xor ecx, ecx
add edx, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
cmp edx, 1
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x14]
setg dl
xor ecx, ecx
cmp edx, eax
setle cl
cmp ecx, dword [esp + 0xc]
je 0x1001d1cb
mov eax, dword [esp + 0xc]
cmp dword [esp + 0x1c], ebx
je 0x1001d385
mov dword [esp + 0x24], 8
mov dword [esp + 0x34], 0xd2c643d4
mov dword [esp + 0x1c], 0xffffffec
jmp 0x1001d378
mov dword [esp + 0x20], 0xfc02
lea ecx, [esp + 0x108]
push 1
call fcn.10019b25
xor edx, edx
mov dword [esp + 0x2c], 0x4d4a788a
mov dword [esp + 0x18], ebx
inc edx
jmp 0x1001d22f
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x108]
mov dword [eax + ecx*4], 0x26de0d61
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edx
jl 0x1001d219
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001d24e
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetSystemMenu]
cmp dword [esp + 0x20], ebx
jne 0x1001d2be
cmp dword [esp + 0x1c], 0xffffffff
je 0x1001d25f
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x20]
xor edx, edx
mov eax, dword [esp + 0x14]
cmp ecx, eax
setg dl
cmp edx, dword [esp + 0x14]
jne 0x1001d27e
cmp dword [esp + 0x1c], ebx
jne 0x1001d27e
mov edx, ebx
jmp 0x1001d281
xor edx, edx
inc edx
mov eax, dword [esp + 0x1c]
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x108]
sete cl
mov dword [eax], ecx
xor eax, eax
cmp ecx, 0xffffffff
setge al
xor edx, edx
cmp eax, 0x2b0a
mov eax, dword [esp + 0x24]
setge dl
xor ecx, ecx
cmp eax, edx
setle cl
mov dword [esp + 0x2c], ecx
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
neg eax
sbb eax, eax
xor edx, edx
neg eax
cmp eax, 0x629bad2c
setl dl
xor ecx, ecx
sub edx, dword [esp + 0x24]
mov eax, dword [esp + 0x34]
cmp edx, eax
setg cl
cmp ecx, 0x3632cac2
je 0x1001d321
mov dword [esp + 0x24], ebx
jmp 0x1001d319
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001d315
push ebx
push 0x2194
push 0x12c8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_GetCharABCWidthsFloatA]
inc dword [esp + 0x24]
cmp dword [esp + 0x24], ebx
jle 0x1001d2ef
jmp 0x1001d368
xor ecx, ecx
mov dword [esp + 0x20], 0x5dae
mov dword [esp + 0x18], ebx
inc ecx
jmp 0x1001d345
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x8c], 0xfffd
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ecx
jl 0x1001d332
mov eax, dword [esp + 0x2c]
cmp eax, dword [esp + 0x24]
jle 0x1001d35b
cmp dword [esp + 0x34], ebx
jne 0x1001d35d
mov ecx, ebx
mov dword [esp + 0x8c], ecx
dec dword [esp + 0x20]
lea ecx, [esp + 0x108]
call fcn.1001a431
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0x1b
jg 0x1001d1f2
jmp 0x1001d3f1
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0xc], 0xc
jmp 0x1001d3e3
push esi
lea ecx, [esp + 0xc8]
call fcn.10019b25
mov dword [esp + 0x18], ebx
jmp 0x1001d3c0
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0xc4]
mov dword [eax + ecx*4], 0xdcf746b3
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jl 0x1001d3aa
lea ecx, [esp + 0xc4]
cmp dword [esp + 0x30], ebx
jne 0x1001d3ec
mov eax, dword [esp + 0xc4]
call fcn.1001a431
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 0x3c
jle 0x1001d397
jmp 0x1001d3f1
call fcn.1001a431
push 3
lea ecx, [esp + 0x94]
call fcn.10019b25
mov dword [esp + 0x20], 0xffffffff
xor edx, edx
inc edx
mov dword [esp + 0x34], edx
mov dword [esp + 0x28], 0x34e401d9
mov dword [esp + 0x30], ebx
mov dword [esp + 0x30], 0x888ad88c
mov dword [esp + 0x18], ebx
jmp 0x1001d43e
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x90]
mov dword [eax + ecx*4], 0xa11015aa
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jl 0x1001d428
mov edi, dword [esp + 0x90]
xor ecx, ecx
mov dword [esp + 0x20], edx
mov eax, dword [esp + 0x20]
cmp eax, dword [edi + 4]
mov esi, dword [edi + 8]
setle cl
xor eax, eax
cmp esi, ecx
setne al
cmp edx, eax
sbb eax, eax
xor edx, edx
inc eax
cmp eax, 0x43af7806
mov eax, dword [esp + 0x90]
setne dl
xor ecx, ecx
cmp edx, dword [eax]
setl cl
cmp ecx, esi
je 0x1001d494
cmp dword [esp + 0x34], ebx
je 0x1001d494
xor edx, edx
inc edx
mov esi, edx
jmp 0x1001d499
xor edx, edx
mov esi, ebx
inc edx
mov eax, dword [esp + 0x90]
xor ecx, ecx
cmp dword [eax], esi
mov eax, dword [edi + 8]
setge cl
sub eax, ecx
jne 0x1001d4b5
cmp dword [edi + 8], eax
mov eax, ebx
je 0x1001d4b7
mov eax, edx
mov dword [esp + 0x28], eax
imul eax, dword [esp + 0x28], 0x48116
push 8
pop ecx
sub ecx, eax
mov dword [esp + 0x30], ecx
cmp dword [esp + 0x28], ebx
jne 0x1001d4d9
mov esi, ebx
cmp dword [edi + 8], ebx
je 0x1001d4db
mov esi, edx
mov eax, dword [esp + 0x34]
mov ecx, dword [edi + 8]
imul eax, esi
add eax, ecx
cmp eax, ecx
jne 0x1001d4f1
cmp dword [esp + 0x28], ebx
jne 0x1001d4f3
mov edx, ebx
lea ecx, [esp + 0x90]
mov dword [esp + 0x30], edx
call fcn.1001a431
mov eax, dword [esp + 0xc0]
mov ecx, 0x3e8
cdq
idiv ecx
mov ecx, dword [esp + 0x58]
mov esi, edx
mov edi, eax
call fcn.1001bb22
mov ecx, dword [esp + 0x1d4]
add eax, esi
add eax, edi
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret