Function at 0x1001fe7f
Capabilities:
Get graphical window text
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1006fa07
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2d0
push ebx
push esi
push edi
mov dword [esp + 0x50], ecx
xor ebx, ebx
push 3
mov dword [esp + 0x20], ebx
mov edi, edx
mov dword [esp + 0x40], 0xffffffff
pop eax
mov dword [esp + 0x1c], 0xfffffffb
cmp dword [esp + 0x1c], 0xfffffff9
push 1
mov dword [esp + 0x48], edi
pop esi
mov dword [esp + 0x28], 9
mov dword [esp + 0x38], 0xa
jl 0x10020047
mov dword [esp + 0x10], 0xfffffffc
mov dword [esp + 0x20], 0x7716e311
mov dword [esp + 0x2c], 0x73f5cfeb
mov dword [esp + 0x2c], 0xcb4e3473
dec dword [esp + 0x10]
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x10], 0x2a
je 0x10020034
mov dword [esp + 0x2c], 0x1362395e
lea ecx, [esp + 0x1d4]
push eax
call fcn.1000ecc9
push 3
mov dword [esp + 0x28], 0xe4bc795c
mov dword [esp + 0x1c], ebx
pop edx
jmp 0x1001ff53
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1d4]
mov dword [eax + ecx*4], 0xf27142b6
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edx
jl 0x1001ff3d
mov eax, dword [esp + 0x10]
mov dword [esp + 0x3c], eax
cmp dword [esp + 0x1c], ebx
je 0x1001ff73
cmp dword [esp + 0x2c], 0xe4bf
mov edi, esi
jg 0x1001ff75
mov edi, ebx
mov eax, dword [esp + 0x10]
or edx, 0xffffffff
sub edx, eax
xor ecx, ecx
add edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
cmp edx, eax
mov eax, dword [esp + 0x1d4]
setge cl
push 9
lea edx, [ecx + 0x18ebdb8]
xor ecx, ecx
mov dword [eax + 8], edx
mov eax, dword [esp + 0x14]
sub edx, eax
mov eax, dword [esp + 0x14]
imul edx, edi
cmp edx, eax
pop eax
setne cl
imul ecx, dword [esp + 0x10]
sub ecx, 0xfff7
cmp ecx, eax
jne 0x1001ffcb
mov edx, ebx
cmp dword [esp + 0x24], ebx
je 0x1001ffcd
mov edx, esi
mov eax, dword [esp + 0x10]
xor ecx, ecx
cmp edx, eax
push 0xa
sete cl
add ecx, dword [esp + 0x14]
neg ecx
sbb ecx, ecx
neg ecx
mov dword [esp + 0x24], ecx
cmp dword [esp + 0x24], 0xf314d41b
mov eax, dword [esp + 0x14]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp eax, ecx
pop eax
setne dl
add edx, eax
mov dword [esp + 0x2c], edx
je 0x10020010
mov eax, esi
cmp dword [esp + 0x3c], ebx
jne 0x10020012
mov eax, ebx
mov dword [esp + 0x2c], eax
lea ecx, [esp + 0x1d4]
call fcn.1000f79f
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x2a
push 3
pop eax
jne 0x1001ff17
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xfffffff9
jge 0x1001fee4
mov edi, dword [esp + 0x44]
mov eax, dword [0x12674330]
test al, 1
jne 0x100200e9
or eax, esi
mov dword [0x12674330], eax
push ebx
mov dword [esp + 0x2e8], ebx
push ebx
mov dword [0x126742f0], ebx
mov dword [0x126742f4], ebx
call fcn.1001317c
mov dword [0x126742f0], eax
mov dword [0x126742f8], ebx
mov dword [0x12674300], ebx
mov byte [esp + 0x2e4], 2
mov ecx, 0x126742f8
mov dword [esp + 0x138], eax
lea eax, [esp + 0x138]
push eax
push 0x10
push ebx
lea eax, [esp + 0x240]
mov dword [0x1267430c], 0x3f800000
push eax
mov dword [0x126742fc], ebx
call fcn.10012f54
push 0x1007069f
mov dword [0x12674304], 7
mov dword [0x12674308], 8
call fcn.10058175
or dword [esp + 0x2e8], 0xffffffff
pop ecx
mov dword [esp + 0x10], 0xf7e2799a
push 4
pop eax
mov dword [esp + 0x110], eax
mov dword [esp + 0x114], eax
mov dword [esp + 0x118], eax
mov dword [esp + 0x11c], eax
mov dword [esp + 0x1c], 0xd5ec7e01
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x2c], 0x307758a8
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x10], ebx
jmp 0x100201f5
mov dword [esp + 0x30], 0xc7555b7c
mov dword [esp + 0x18], 0xffffffff
mov eax, dword [esp + 0x30]
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x30]
jne 0x10020168
mov ecx, ebx
cmp dword [esp + 0x30], ebx
je 0x10020170
mov ecx, esi
cmp dword [esp + 0x30], ebx
jne 0x10020174
mov eax, dword [esp + 0x30]
mov dword [esp + 0x118], ecx
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x18], ebx
jne 0x100201a0
mov eax, dword [esp + 0x118]
mov eax, dword [esp + 0x118]
xor edx, edx
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
cmp ecx, eax
mov eax, dword [esp + 0x2c]
setne dl
xor ecx, ecx
cmp edx, 0x183
setg cl
xor edx, edx
add ecx, 0xaee5
cmp ecx, eax
mov eax, dword [esp + 0x1c]
setg dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [esp + 0x24], ecx
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xfffffff5
jg 0x10020139
push 3
mov dword [esp + 0x14], ebx
pop eax
cmp dword [esp + 0x10], eax
jg 0x10020277
push eax
pop edi
mov dword [esp + 0x20], ebx
xor edx, edx
mov dword [esp + 0x2c], 0xfffffff9
mov dword [esp + 0x24], 0xfffffffe
mov dword [esp + 0x2c], 6
mov eax, dword [esp + 0x20]
test eax, eax
mov dword [esp + 0x114], eax
sets dl
sub edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setl cl
sub ecx, dword [esp + 0x1c]
add ecx, dword [esp + 0x14]
mov dword [esp + 0x2c], ecx
mov eax, dword [esp + 0x24]
mov dword [esp + 0x2c], 0xc4f4fcf4
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jle 0x1002020f
mov edi, dword [esp + 0x44]
imul eax, dword [esp + 0x50], 0x2710
add eax, edi
mov dword [esp + 0xb0], eax
lea eax, [esp + 0xb0]
push eax
call fcn.10022732
mov edi, dword [eax]
mov dword [esp + 0x10], 0xde2167fa
mov dword [esp + 0x2c], 0x19fa
cmp dword [esp + 0x2c], 0x1279
mov dword [esp + 0x34], edi
jge 0x10020497
lea eax, [esp + 0x48]
push eax
push 0x10007768
call fcn.10057f6b
mov eax, dword [esp + 0x50]
mov edi, esi
pop ecx
pop ecx
mov ecx, dword [esp + 0x4c]
shld ecx, eax, 3
push 9
shl eax, 3
pop edx
add eax, edx
mov dword [esp + 0x18], edi
mov dword [esp + 0x40], eax
adc ecx, ebx
mov dword [esp + 0x20], eax
mov eax, ebx
mov dword [esp + 0x94], ecx
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x4c], ebx
jl 0x10020479
jg 0x10020315
cmp dword [esp + 0x48], esi
jb 0x10020479
push eax
push edi
push dword [esp + 0x54]
push dword [esp + 0x54]
call fcn.1006a360
or ecx, ebx
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x24], edx
jne 0x10020433
xor ebx, ebx
mov dword [esp + 0x14], esi
mov dword [esp + 0x30], ebx
cmp eax, dword [esp + 0x4c]
jg 0x10020435
jl 0x10020358
cmp edi, dword [esp + 0x48]
ja 0x10020435
push dword [esp + 0x30]
push dword [esp + 0x18]
push edx
push dword [esp + 0x38]
call fcn.1006a360
or ecx, ebx
mov dword [esp + 0x134], eax
mov dword [esp + 0xfc], edx
jne 0x1002042f
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x30]
add edi, 2
mov eax, dword [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x1c]
pop ebx
adc esi, ebx
add ecx, 1
adc eax, ebx
push eax
push ecx
push esi
push edi
call fcn.1005c170
mov ecx, dword [esp + 0x134]
mov esi, dword [esp + 0xfc]
add ecx, 2
adc esi, ebx
push esi
push ecx
push edx
push eax
call fcn.1005c170
sub eax, dword [esp + 0x48]
sbb edx, dword [esp + 0x4c]
cmp edx, dword [esp + 0x3c]
jg 0x100203df
jl 0x100203d7
cmp eax, dword [esp + 0x20]
jae 0x100203df
mov dword [esp + 0x20], eax
mov dword [esp + 0x3c], edx
mov edi, dword [esp + 0x18]
xor esi, esi
inc esi
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x30]
add eax, esi
mov dword [esp + 0x14], eax
adc ecx, ebx
push ecx
push eax
push ecx
push eax
mov dword [esp + 0x40], ecx
call fcn.1005c170
push dword [esp + 0x1c]
push edi
push edx
push eax
call fcn.1005c170
cmp edx, dword [esp + 0x4c]
mov edx, dword [esp + 0x24]
jl 0x10020358
jg 0x10020429
cmp eax, dword [esp + 0x48]
jbe 0x10020358
mov eax, dword [esp + 0x1c]
jmp 0x10020435
xor ebx, ebx
jmp 0x100203e6
xor ebx, ebx
add edi, esi
mov dword [esp + 0x18], edi
adc eax, ebx
push eax
push edi
push eax
push edi
mov dword [esp + 0x2c], eax
call fcn.1005c170
push dword [esp + 0x1c]
push edi
push edx
push eax
call fcn.1005c170
mov ecx, eax
mov eax, dword [esp + 0x1c]
cmp edx, dword [esp + 0x4c]
jl 0x10020315
jg 0x10020472
cmp ecx, dword [esp + 0x48]
jbe 0x10020315
mov ecx, dword [esp + 0x94]
push ecx
push dword [esp + 0x44]
push dword [esp + 0x44]
push dword [esp + 0x2c]
push 0x10007928
call fcn.1005819f
mov edi, dword [esp + 0x48]
add esp, 0x14
mov dword [esp + 0x1c], 0x13c27f35
mov dword [esp + 0x18], ebx
jmp 0x100204b8
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0xc8], 0xc0de450b
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jl 0x100204a5
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
add eax, 0x3aaf
add eax, ecx
je 0x100204e6
cmp dword [esp + 0x10], ebx
je 0x100204e6
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
xor edx, edx
mov eax, dword [esp + 0x10]
cmp ecx, eax
mov eax, dword [esp + 0x10]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x10]
setne cl
xor edx, edx
cmp eax, ecx
mov eax, dword [esp + 0x10]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x10]
setne cl
mov dword [esp + 0x34], ecx
xor ecx, ecx
cmp dword [esp + 0x34], eax
mov eax, dword [esp + 0x10]
setl cl
sub edx, ecx
neg edx
sbb edx, edx
add edx, 0xfffffffa
neg edx
sbb edx, edx
inc edx
imul edx, eax
mov dword [esp + 0xc8], edx
test edx, edx
je 0x10020708
mov dword [esp + 0x24], 0x7b1466ac
mov dword [esp + 0x20], 0xa7bf748b
mov eax, dword [esp + 0x24]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], 0x15
jmp 0x100206f9
mov dword [esp + 0x18], ebx
jmp 0x10020589
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x1a0], ebx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 4
jl 0x1002057a
mov eax, dword [esp + 0x24]
mov dword [esp + 0x20], eax
cmp dword [esp + 0x1a0], ebx
je 0x100206a8
push esi
lea ecx, [esp + 0x140]
call fcn.1000ecc9
mov dword [esp + 0x204], esi
mov dword [esp + 0x208], esi
mov dword [esp + 0x20c], esi
mov dword [esp + 0x210], esi
mov dword [esp + 0x34], 0x192fe2cc
mov dword [esp + 0x18], ebx
jmp 0x100205f2
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x13c]
mov dword [eax + ecx*4], 0xbe2ff5ff
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jl 0x100205dc
mov eax, dword [esp + 0x1a8]
xor edx, edx
mov ecx, dword [esp + 0xcc]
mov eax, dword [esp + 0x13c]
cmp dword [eax], ecx
setg dl
xor ecx, ecx
imul eax, edx, 0xbb1d
add eax, 0x44e8d8e8
cmp eax, 0xffffffff
mov eax, dword [esp + 0xc8]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x20]
setge dl
xor ecx, ecx
cmp edx, eax
sete cl
sub ecx, dword [esp + 0x1ac]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [esp + 0x34], ecx
mov ecx, dword [esp + 0x1a4]
mov eax, dword [esp + 0x13c]
add ecx, dword [eax]
cmp ecx, dword [esp + 0x34]
jne 0x10020671
mov ecx, esi
cmp dword [esp + 0xc8], ebx
jne 0x10020673
mov ecx, ebx
mov eax, dword [esp + 0x1a8]
sub ecx, eax
jne 0x10020689
mov edx, ebx
cmp dword [esp + 0x208], ebx
je 0x1002068b
mov edx, esi
mov eax, dword [esp + 0x1c]
xor ecx, ecx
cmp eax, edx
setl cl
mov dword [esp + 0x34], ecx
lea ecx, [esp + 0x13c]
call fcn.1000f79f
jmp 0x100206f5
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x100206d1
push 0x3f5
push 0xf38
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_LineTo]
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x100206f5
push 0x10a2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetMapMode]
dec dword [esp + 0x10]
push 9
pop eax
cmp dword [esp + 0x10], eax
je 0x10020574
jmp 0x10020748
mov dword [esp + 0x14], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x1c], ebx
jmp 0x10020739
mov eax, dword [esp + 0x10]
dec dword [esp + 0x14]
mov eax, dword [esp + 0x14]
neg eax
jne 0x1002072d
mov eax, dword [esp + 0xc8]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], eax
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xffffffe8
mov eax, dword [esp + 0x1c]
jl 0x10020716
mov dword [esp + 0x1c], eax
push 3
test edi, edi
je 0x10020960
pop eax
mov dword [esp + 0x1c], 0xf75dcec3
lea ecx, [esp + 0x1b0]
mov dword [esp + 0x24], 0x6ffa942f
mov dword [esp + 0x14], 0xfe1602a0
push eax
call fcn.1000ecc9
push 3
mov dword [esp + 0x28], ebx
mov dword [esp + 0x1c], ebx
pop edx
jmp 0x1002079b
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1b0]
mov dword [eax + ecx*4], 0x6db9e588
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edx
jl 0x10020785
cmp dword [esp + 0x1c], ebx
je 0x100207ff
mov dword [esp + 0x24], 2
mov dword [esp + 0x34], 0xe26c12a7
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xd711e7bf
jae 0x100207cd
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
mov dword [esp + 0x34], esi
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10020948
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
jmp 0x10020948
mov dword [esp + 0x20], esi
mov eax, 0xd66e5dc6
mov dword [esp + 0x190], eax
mov dword [esp + 0x194], eax
mov dword [esp + 0x198], eax
mov dword [esp + 0x19c], eax
mov dword [esp + 0x34], 0xfffffffa
mov dword [esp + 0x24], 0x970979b5
mov dword [esp + 0x40], 0x7fd5d1af
mov dword [esp + 0x18], ebx
jmp 0x10020851
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x104], esi
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edx
jl 0x10020842
mov eax, dword [esp + 0x10c]
xor edx, edx
mov ecx, dword [esp + 0x104]
mov eax, dword [esp + 0x1c]
cmp eax, ecx
setl dl
mov dword [esp + 0x20], edx
mov eax, dword [esp + 0x20]
mov dword [esp + 0x190], eax
test eax, eax
jne 0x1002090b
mov eax, dword [esp + 0x1c]
xor edx, edx
mov eax, dword [esp + 0x20]
cmp eax, esi
mov eax, dword [esp + 0x1c]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, 0xb818ebcc
setle cl
cmp eax, ecx
sbb eax, eax
xor edx, edx
inc eax
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x190]
mov eax, dword [esp + 0x24]
add ecx, eax
mov eax, dword [esp + 0x14]
cmp ecx, eax
mov eax, dword [esp + 0x1b0]
sete dl
xor ecx, ecx
mov dword [eax + 8], edx
mov eax, dword [esp + 0x34]
cmp edx, eax
setge cl
sub ecx, dword [esp + 0x14]
neg ecx
sbb ecx, ecx
add ecx, 0x5c1ed52a
cmp esi, ecx
sbb eax, eax
inc eax
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x24]
sub ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x104]
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, eax
je 0x1002090d
mov ebx, esi
xor eax, eax
cmp ebx, 5
setne al
xor edx, edx
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x14]
cmp ecx, eax
setge dl
sub edx, dword [esp + 0x10c]
mov eax, dword [esp + 0x104]
neg edx
sbb edx, edx
lea ecx, [edx + 2]
xor edx, edx
cmp eax, ecx
setg dl
mov dword [esp + 0x40], edx
lea ecx, [esp + 0x1b0]
call fcn.1000f79f
mov dword [esp + 0xdc], edi
jmp 0x100223a0
pop edi
push edi
lea ecx, [esp + 0x17c]
call fcn.1000ecc9
push edi
lea ecx, [esp + 0x1f0]
mov dword [esp + 0x2e8], edi
call fcn.1000ecc9
mov dword [esp + 0x20], ebx
mov dword [esp + 0x34], 0x89e1
mov dword [esp + 0x40], 0x9c8c74c3
mov dword [esp + 0x40], esi
mov dword [esp + 0x10], ebx
jmp 0x100209b3
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x178]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x100209a0
mov dword [esp + 0x10], ebx
jmp 0x100209d2
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x1ec]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x100209bf
mov edx, dword [esp + 0x1ec]
xor ecx, ecx
mov edi, dword [esp + 0x178]
mov eax, dword [edi + 4]
cmp eax, dword [edx + 8]
sete cl
add ecx, dword [edx + 4]
sub ecx, eax
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, dword [edx + 4]
mov ecx, 0xfff9
setge al
cmp eax, ecx
sbb eax, eax
neg eax
imul eax, dword [edx]
mov dword [edx], eax
xor edx, edx
mov eax, dword [esp + 0x20]
mov esi, dword [edi + 8]
cmp eax, esi
mov eax, dword [esp + 0x178]
setl dl
xor ecx, ecx
sub edx, esi
cmp edx, dword [eax]
mov eax, dword [esp + 0x20]
setg cl
xor edx, edx
cmp ecx, esi
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, 0xfff9
setle cl
cmp eax, ecx
mov eax, dword [esp + 0x34]
sbb edx, edx
xor ecx, ecx
neg edx
add edx, dword [edi + 4]
neg edx
cmp edx, eax
setg cl
sub ecx, dword [edi + 8]
mov dword [esp + 0x40], ecx
lea ecx, [esp + 0x1ec]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x40], eax
call fcn.1000f79f
or dword [esp + 0x2e4], 0xffffffff
lea ecx, [esp + 0x178]
call fcn.1000f79f
mov eax, dword [0x12674330]
test al, 2
jne 0x10020b34
or eax, 2
mov dword [0x12674330], eax
push ebx
mov dword [esp + 0x2e8], 4
push ebx
mov dword [0x12674310], ebx
mov dword [0x12674314], ebx
call fcn.1001317c
mov dword [0x12674310], eax
mov dword [0x12674318], ebx
mov dword [0x12674320], ebx
mov byte [esp + 0x2e4], 6
mov ecx, 0x12674318
mov dword [esp + 0x130], eax
lea eax, [esp + 0x130]
push eax
push 0x10
push ebx
lea eax, [esp + 0xcc]
mov dword [0x1267432c], 0x3f800000
push eax
mov dword [0x1267431c], ebx
call fcn.10012f54
push 0x1007069a
mov dword [0x12674324], 7
mov dword [0x12674328], 8
call fcn.10058175
or dword [esp + 0x2e8], 0xffffffff
pop ecx
xorps xmm0, xmm0
movdqu xmmword [esp + 0xe8], xmm0
mov dword [esp + 0x18], 8
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10020b59
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
mov dword [esp + 0x18], 0xffffffeb
inc esi
cmp dword [esp + 0x18], 0xffffffe4
jle 0x10020c10
push 3
pop edi
push edi
lea ecx, [esp + 0x1cc]
call fcn.1000ecc9
push esi
lea ecx, [esp + 0x218]
mov dword [esp + 0x2e8], 7
call fcn.1000ecc9
mov dword [esp + 0x10], ebx
jmp 0x10020bb3
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x1c8]
mov dword [eax + ecx*4], 0xfffffff9
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x10020b9d
mov dword [esp + 0x10], ebx
jmp 0x10020bd1
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x214]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x10020bbf
mov eax, dword [esp + 0x1c8]
lea ecx, [esp + 0x214]
mov dword [eax + 8], esi
call fcn.1000f79f
or dword [esp + 0x2e4], 0xffffffff
lea ecx, [esp + 0x1c8]
call fcn.1000f79f
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 0xffffffe4
jg 0x10020b72
lea eax, [esp + 0x50]
push eax
call fcn.10022794
mov edi, dword [eax]
mov dword [esp + 0x40], 0xfffffff9
mov dword [esp + 0x2c], edi
mov dword [esp + 0x18], ebx
jmp 0x10020c41
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x29c], 0xeef20fe6
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 4
jl 0x10020c2e
mov byte [esp + 0xf], bl
mov dword [esp + 0x34], 0x20bb
cmp dword [esp + 0x34], 0xd89
jge 0x10020cb6
jmp 0x10020ca1
mov eax, dword [esp + 0x58]
mov cl, bl
cmp eax, esi
jle 0x10020c96
test cl, cl
jne 0x10020c78
add eax, 8
cdq
idiv dword [esp + 0x28]
jmp 0x10020c7e
inc eax
cdq
sub eax, edx
sar eax, 1
test cl, cl
mov dword [esp + 0x58], eax
sete cl
cmp eax, esi
jg 0x10020c6a
test cl, cl
je 0x10020c96
push 0x10007950
jmp 0x10020c9b
push 0x1000795c
call fcn.10058aba
pop ecx
lea eax, [esp + 0x58]
push eax
push 0x10007758
call fcn.10057f6b
pop ecx
pop ecx
cmp eax, esi
je 0x10020c60
cmp byte [esp + 0xf], 0
je 0x10020cc4
push ebx
call dword [sym.imp.GDI32.dll_CreatePenIndirect]
mov eax, dword [esp + 0x40]
mov dword [esp + 0x2a0], eax
mov al, byte [ebp + 0xc]
test al, al
jne 0x10020cde
test edi, edi
jne 0x1002162b
mov dword [esp + 0x30], 0x91a049fe
mov dword [esp + 0x28], ebx
mov dword [esp + 0x30], 6
jmp 0x10020d19
mov dword [esp + 0x18], ebx
mov dword [esp + 0x18], 0x18
jmp 0x10020d0e
mov dword [esp + 0x28], 0xfffffffa
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 0xffffffea
jge 0x10020d02
dec dword [esp + 0x30]
cmp dword [esp + 0x30], 5
jle 0x10020cf4
lea ecx, [esp + 0x2c8]
mov dl, al
push ecx
mov ecx, dword [esp + 0x54]
call fcn.10014770
mov esi, eax
lea edi, [esp + 0xec]
pop ecx
push 8
lea ecx, [esp + 0x164]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor esi, esi
pop edi
inc esi
mov dword [esp + 0x10], edi
mov dword [esp + 0x20], 0xfffffff9
push esi
call fcn.1000ecc9
mov dword [esp + 0x18], ebx
jmp 0x10020d7c
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x160]
mov dword [eax + ecx*4], 0xb314b812
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jl 0x10020d66
mov dword [esp + 0x10], ebx
jmp 0x10020f18
mov dword [esp + 0x14], 0xfffffff6
xor ecx, ecx
mov dword [esp + 0x24], 0x2522abf7
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x20]
cmp eax, esi
mov eax, dword [esp + 0x14]
setle cl
cmp esi, ecx
sbb edx, edx
xor ecx, ecx
neg edx
cmp eax, edx
mov eax, dword [esp + 0x14]
setge cl
imul edx, ecx, 0xffff
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setle cl
neg ecx
je 0x10020e66
mov dword [esp + 0x18], 0x70e7ad53
cmp dword [esp + 0x18], ebx
je 0x10020df4
cmp dword [esp + 0x14], 0xfffffff7
mov edx, esi
jne 0x10020df6
mov edx, ebx
mov eax, dword [esp + 0x18]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
xor eax, eax
cmp edx, ecx
setne al
imul eax, dword [esp + 0x10]
sub eax, 0x626a9d9e
neg eax
sbb eax, eax
inc eax
sub eax, dword [esp + 0x10]
neg eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x24]
cmp eax, ecx
setne dl
xor ecx, ecx
imul edx, dword [esp + 0x10]
mov eax, dword [esp + 0x20]
cmp edx, eax
setge cl
add ecx, dword [esp + 0x14]
cmp ecx, dword [esp + 0x10]
jg 0x10020e56
mov ecx, esi
cmp dword [esp + 0x18], ebx
jne 0x10020e58
mov ecx, ebx
mov eax, dword [esp + 0x160]
mov dword [eax], ecx
jmp 0x10020f14
mov dword [esp + 0x28], 0x867f5d1c
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10020e8b
push ebx
push 0x1674
push 0xfd6
push ebx
call dword [sym.imp.GDI32.dll_GetPaletteEntries]
mov eax, dword [esp + 0x160]
xor ecx, ecx
push 9
mov dword [eax], 0xefce
mov eax, dword [esp + 0x2c]
cmp eax, esi
mov eax, 0xfff9
setg cl
imul ecx, dword [esp + 0x24]
cmp ecx, eax
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, 0xfffffffc
pop eax
setle cl
cmp ecx, eax
jae 0x10020eef
push 3
mov dword [esp + 0x1c], ebx
pop ecx
jmp 0x10020ede
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x27c], 0xcc3592e7
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ecx
jl 0x10020ecb
cmp dword [esp + 0x27c], ebx
jne 0x10020f23
jmp 0x10020f14
mov dword [esp + 0x24], 0xfffffffd
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10020f10
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
dec dword [esp + 0x24]
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 7
jg 0x10020d8b
lea ecx, [esp + 0x160]
call fcn.1000f79f
cmp byte [ebp + 0xc], 0
je 0x1002162b
cmp dword [esp + 0xf0], 0
je 0x1002162b
push 4
lea ecx, [esp + 0xa8]
call fcn.1000ecc9
mov dword [esp + 0x2e4], edi
mov dword [esp + 0x10], 0xe1e87df2
mov dword [esp + 0x30], 0x77fc7df3
mov dword [esp + 0x40], 0x35242359
mov dword [esp + 0x18], ebx
jmp 0x10020f90
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0xa4]
mov dword [eax + ecx*4], 0xff0e
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 4
jl 0x10020f7a
mov dword [esp + 0x10], ebx
jmp 0x100215ee
mov dword [esp + 0x1c], 0x846b51f0
mov dword [esp + 0x20], 0x6ae3
mov dword [esp + 0x18], 0x242039ce
mov dword [esp + 0x24], ebx
mov dword [esp + 0x24], 0x5b60aa07
mov dword [esp + 0x28], 0x22d7
cmp dword [esp + 0x28], 0xb08
jge 0x1002120b
lea eax, [esp + 0x8c]
mov dword [esp + 0x8c], ebx
push eax
push 0x1000775c
call fcn.10057f6b
pop ecx
pop ecx
push 9
pop eax
mov ecx, eax
mov dword [esp + 0x64], ebx
xor eax, eax
lea edi, [esp + 0x68]
mov esi, ebx
rep stosd dword es:[edi], eax
mov edi, ebx
mov dword [esp + 0x24], edi
cmp dword [esp + 0x8c], eax
jle 0x10021055
lea eax, [esp + 0xb4]
mov dword [esp + 0xb4], ebx
push eax
push 0x10007758
call fcn.10057f6b
mov eax, dword [esp + 0xbc]
pop ecx
pop ecx
push 3
inc dword [esp + eax*4 + 0x68]
add eax, edi
cdq
pop ecx
idiv ecx
inc esi
mov edi, edx
cmp esi, dword [esp + 0x8c]
jl 0x10021017
mov dword [esp + 0x24], edx
xor eax, eax
inc eax
cmp dword [esp + 0x64], 0
mov byte [esp + 0xf], al
jne 0x1002106a
mov cl, bl
jmp 0x10021122
mov edx, dword [esp + 0x84]
cmp edi, eax
mov ecx, dword [esp + 0x78]
mov edi, dword [esp + 0x74]
mov esi, dword [esp + 0x6c]
jne 0x1002110e
cmp dword [esp + 0x68], 0
jle 0x10021097
dec dword [esp + 0x68]
mov cl, al
jmp 0x10021122
test edi, edi
jle 0x100210a2
dec edi
mov dword [esp + 0x74], edi
jmp 0x10021090
cmp dword [esp + 0x80], 0
jle 0x100210b5
dec dword [esp + 0x80]
jmp 0x10021090
cmp esi, eax
jle 0x100210c2
sub esi, 2
mov dword [esp + 0x6c], esi
jmp 0x10021090
test esi, esi
jle 0x100210e9
test ecx, ecx
jle 0x100210d6
dec esi
dec ecx
mov dword [esp + 0x6c], esi
mov dword [esp + 0x78], ecx
jmp 0x10021090
test edx, edx
jle 0x100210e9
dec esi
mov dword [esp + 0x6c], esi
dec edx
mov dword [esp + 0x84], edx
jmp 0x10021090
cmp ecx, eax
jle 0x100210f2
sub ecx, 2
jmp 0x100210d0
test ecx, ecx
jle 0x10021101
test edx, edx
jle 0x10021101
dec ecx
mov dword [esp + 0x78], ecx
jmp 0x100210df
cmp edx, eax
jle 0x1002110a
sub edx, 2
jmp 0x100210e0
mov byte [esp + 0xf], bl
cmp dword [esp + 0x24], 2
jne 0x1002111e
test esi, esi
jle 0x1002113e
dec esi
mov dword [esp + 0x6c], esi
mov cl, byte [esp + 0xf]
push 9
pop edx
cmp dword [esp + eax*4 + 0x64], ebx
jg 0x100211c2
inc eax
cmp eax, edx
jle 0x10021125
push 0x100078c8
jmp 0x10021202
test ecx, ecx
jle 0x10021149
dec ecx
mov dword [esp + 0x78], ecx
jmp 0x1002111e
test edx, edx
jle 0x10021157
dec edx
mov dword [esp + 0x84], edx
jmp 0x1002111e
mov edx, dword [esp + 0x68]
cmp edx, eax
jle 0x10021168
sub edx, 2
mov dword [esp + 0x68], edx
jmp 0x1002111e
test edx, edx
jle 0x10021196
test edi, edi
jle 0x1002117c
dec edx
dec edi
mov dword [esp + 0x68], edx
mov dword [esp + 0x74], edi
jmp 0x1002111e
mov ecx, dword [esp + 0x80]
test ecx, ecx
jle 0x1002119d
dec edx
mov dword [esp + 0x68], edx
dec ecx
mov dword [esp + 0x80], ecx
jmp 0x1002111e
mov ecx, dword [esp + 0x80]
cmp edi, eax
jle 0x100211a6
sub edi, 2
jmp 0x10021176
test edi, edi
jle 0x100211b5
test ecx, ecx
jle 0x100211b5
dec edi
mov dword [esp + 0x74], edi
jmp 0x1002118c
cmp ecx, eax
jle 0x10021063
sub ecx, 2
jmp 0x1002118d
test cl, cl
je 0x100211fd
mov ebx, edx
lea esi, [esp + 0x88]
mov edi, dword [esi]
test edi, edi
je 0x100211e7
push ebx
push 0x10007758
call fcn.1005819f
pop ecx
pop ecx
dec edi
jne 0x100211d5
mov dword [esi], edi
dec dword [esi]
sub esi, 4
dec ebx
jns 0x100211cf
push 0x100076c5
call fcn.10058aba
xor ebx, ebx
jmp 0x10021207
push 0x10007968
call fcn.10058aba
xor esi, esi
pop ecx
inc esi
mov dword [esp + 0x94], esi
mov dword [esp + 0x28], 0x1b71
cmp dword [esp + 0x28], 0x6a3
jge 0x10021302
lea eax, [esp + 0x90]
push eax
push 0x10007888
call fcn.10057f6b
pop ecx
pop ecx
lea eax, [esp + 0x100]
mov dword [esp + 0x100], ebx
push eax
push ecx
lea ecx, [esp + 0x128]
mov dword [esp + 0x128], ebx
mov dword [esp + 0x12c], ebx
mov dword [esp + 0x130], ebx
call fcn.10022926
mov edi, dword [esp + 0x120]
mov ecx, ebx
mov eax, dword [esp + 0x90]
cdq
idiv dword [esp + 0x38]
mov dword [edi + ecx*4], edx
mov eax, dword [esp + 0x90]
cdq
idiv dword [esp + 0x38]
inc ecx
mov dword [esp + 0x90], eax
cmp ecx, 5
jl 0x1002127d
mov eax, dword [edi + 0x10]
add eax, dword [edi + 8]
add eax, dword [edi]
imul ecx, dword [edi + 4], 0xa
imul eax, eax, 0xba
push 5
add eax, ecx
add eax, dword [edi + 0xc]
cdq
mov ecx, eax
mov dword [esp + 0x2c], edx
mov dword [esp + 0x38], ecx
mov eax, esi
mov edx, ebx
pop edi
push dword [esp + 0x28]
push ecx
push edx
push eax
call fcn.1005c170
push ebx
push 0xba
push edx
push eax
call fcn.1006ed50
mov ecx, dword [esp + 0x34]
dec edi
jne 0x100212c7
push edx
push eax
push 0x1000796c
call fcn.1005819f
add esp, 0xc
lea ecx, [esp + 0x120]
call fcn.1000f79f
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xa4]
cmp dword [eax + ecx*4], ebx
je 0x1002138e
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xa4]
mov ecx, dword [eax + 4]
mov dword [eax + edx*4], ecx
test ecx, ecx
je 0x1002137a
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
test eax, eax
mov eax, dword [esp + 0xa4]
setns cl
add ecx, dword [eax + edx*4]
jne 0x10021370
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xa4]
cmp dword [eax + ecx*4], ebx
jne 0x10021370
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xa4]
cmp dword [eax + ecx*4], ebx
mov eax, ebx
je 0x10021372
mov eax, esi
cmp eax, dword [esp + 0x10]
mov eax, esi
je 0x1002137c
mov eax, ebx
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x1c], ebx
je 0x1002138e
mov eax, esi
cmp dword [esp + 0x20], ebx
jne 0x10021390
mov eax, ebx
add eax, 0xe4a6
jne 0x100213a9
mov ecx, dword [esp + 0x10]
mov edx, ebx
mov eax, dword [esp + 0xa4]
cmp dword [eax + ecx*4], ebx
je 0x100213ab
mov edx, esi
mov eax, dword [esp + 0x20]
xor ecx, ecx
cmp edx, eax
setle cl
test ecx, ecx
je 0x10021495
mov dword [esp + 0x14], 0xa0d7c8a3
lea ecx, [esp + 0x1f8]
push esi
call fcn.1000ecc9
mov dword [esp + 0x24], 0xe7fb108f
mov dword [esp + 0x18], ebx
jmp 0x100213f7
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1f8]
mov dword [eax + ecx*4], 0x95cc9e52
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jl 0x100213e1
mov eax, dword [esp + 0x14]
xor edx, edx
mov ecx, 0x6f63
sub ecx, eax
mov eax, dword [esp + 0xa4]
cmp dword [eax + 0xc], ecx
sete dl
xor ecx, ecx
mov dword [esp + 0x30], edx
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x1f8]
mov dword [eax], edx
mov eax, dword [esp + 0xa4]
cmp dword [eax + 4], 0xffffffff
mov eax, dword [esp + 0x14]
setg cl
sub edx, ecx
sub edx, eax
mov dword [esp + 0x1c], edx
xor edx, edx
imul eax, dword [esp + 0x1c], 0x451
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x30]
cmp eax, ecx
setl dl
xor eax, eax
cmp edx, 0xaf8e
setg al
xor ecx, ecx
sub eax, dword [esp + 0x14]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x28], eax
setg cl
add ecx, dword [esp + 0x20]
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x1f8]
call fcn.1000f79f
jmp 0x100214ae
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x100214ae
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndPaint]
mov dword [esp + 0x18], 0xfffffffd
cmp dword [esp + 0x18], 0xf
jg 0x100215ea
push 3
pop edi
push edi
lea ecx, [esp + 0x188]
call fcn.1000ecc9
mov dword [esp + 0x14], ebx
jmp 0x100214ed
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x184]
mov dword [eax + ecx*4], 0x9f139888
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x100214d7
mov dword [esp + 0x1c], ebx
cmp dword [esp + 0x1c], 2
jge 0x100215c8
mov edi, dword [esp + 0x184]
mov dword [esp + 0x20], 5
mov dword [esp + 0x28], 0x8a60b10f
mov dword [esp + 0x14], ebx
jmp 0x10021532
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x12c], 8
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x1002151f
cmp dword [esp + 0x10], ebx
je 0x100215a6
mov ecx, dword [esp + 0x30]
xor edx, edx
mov eax, dword [esp + 0x30]
cmp ecx, eax
setle dl
mov dword [esp + 0x24], edx
xor edx, edx
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
cmp ecx, eax
setl dl
xor ecx, ecx
cmp edx, 0xa768
setne cl
xor eax, eax
imul ecx, dword [esp + 0x10]
cmp ecx, dword [edi + 4]
setl al
cmp eax, 0xffffffff
sbb eax, eax
inc eax
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x1c]
imul eax, dword [esp + 0x30]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x12c], eax
mov eax, dword [esp + 0x40]
mov eax, dword [esp + 0x20]
xor ecx, ecx
cmp eax, dword [edi + 4]
setne cl
mov dword [esp + 0x28], ecx
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jl 0x10021509
push 3
pop edi
cmp dword [esp + 0x94], ebx
lea ecx, [esp + 0x184]
call fcn.1000f79f
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0xf
jle 0x100214c4
inc dword [esp + 0x10]
push 3
pop eax
cmp dword [esp + 0x10], eax
jle 0x10020fa0
or dword [esp + 0x2e4], 0xffffffff
lea ecx, [esp + 0xa4]
call fcn.1000f79f
mov eax, dword [esp + 0xf4]
mov dword [esp + 0xe0], eax
mov eax, dword [esp + 0xf0]
mov dword [esp + 0xe4], eax
mov dword [esp + 0x1c], 0xffffffff
lea ecx, [esp + 0x98]
push 2
call fcn.1000ecc9
push 9
mov dword [esp + 0x3c], 0x2bb2c593
pop eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x14], ebx
jmp 0x10021668
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x98]
mov dword [eax + ecx*4], esi
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x10021656
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x98]
mov dword [eax], ecx
mov dword [esp + 0x1c], 0xf
cmp dword [esp + 0x1c], 0x39
jl 0x100217a6
mov eax, dword [esp + 0x98]
mov dword [esp + 0x30], eax
mov dword [esp + 0x18], esi
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x20], 0x39d20578
mov dword [esp + 0x14], esi
cmp dword [esp + 0x18], ebx
je 0x10021709
mov ecx, dword [esp + 0x1c]
xor edx, edx
mov eax, dword [esp + 0x98]
cmp ecx, dword [eax]
mov eax, dword [esp + 0x38]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x98]
mov edx, esi
setge cl
sub ecx, dword [eax]
mov dword [esp + 0x3c], ecx
mov ecx, dword [esp + 0x3c]
mov eax, dword [esp + 0x98]
sub ecx, dword [eax]
mov eax, dword [esp + 0x20]
neg ecx
sbb ecx, ecx
inc ecx
imul eax, ecx
sub eax, dword [esp + 0x20]
imul eax, dword [esp + 0x18]
cmp eax, 0xb79dc866
ja 0x1002170b
mov edx, ebx
mov eax, dword [esp + 0x18]
xor ecx, ecx
sub edx, eax
mov eax, dword [esp + 0x18]
cmp eax, edx
setge cl
add ecx, dword [esp + 0x18]
jne 0x1002172a
mov eax, ebx
cmp dword [esp + 0x18], ebx
je 0x1002172c
mov eax, esi
cmp eax, 0xa7275995
mov eax, dword [esp + 0x98]
sbb ecx, ecx
inc ecx
mov dword [eax], ecx
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x98]
cmp dword [eax], ecx
je 0x10021754
mov edi, esi
cmp dword [esp + 0x20], ebx
jne 0x10021756
mov edi, ebx
mov eax, dword [esp + 0x24]
xor edx, edx
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x30]
cmp dword [ecx + 4], eax
mov eax, dword [esp + 0x98]
setl dl
xor ecx, ecx
add edx, dword [eax]
mov eax, dword [esp + 0x14]
cmp edx, eax
mov eax, dword [esp + 0x24]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x30]
setge dl
sub edx, dword [esp + 0x14]
imul edx, edi
mov dword [eax + 4], edx
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0x39
jge 0x1002169a
lea ecx, [esp + 0x98]
call fcn.1000f79f
mov edi, dword [esp + 0x2c]
test edi, edi
jne 0x10021d97
cmp dword [esp + 0xe8], edi
jle 0x10021d97
push 3
pop eax
push eax
lea ecx, [esp + 0x22c]
call fcn.1000ecc9
push 3
mov dword [esp + 0x18], 7
mov dword [esp + 0x18], ebx
pop edx
jmp 0x10021802
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x228]
mov dword [eax + ecx*4], 2
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x100217ec
mov dword [esp + 0x14], 2
cmp dword [esp + 0x14], ebx
jl 0x10021835
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1002182f
push esi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ShowOwnedPopups]
dec dword [esp + 0x14]
jns 0x10021816
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1002185f
push ebx
push 0x825
push 0x830
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_MoveToEx]
lea ecx, [esp + 0x228]
call fcn.1000f79f
mov dword [esp + 0x10], 8
lea ecx, [esp + 0x148]
mov dword [esp + 0x20], 0xfffffff9
push esi
call fcn.1000ecc9
mov dword [esp + 0x14], ebx
jmp 0x100218a4
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x148]
mov dword [eax + ecx*4], 0xb314b812
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x1002188e
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x10], 7
jle 0x10021a55
mov edi, 0xfff9
mov dword [esp + 0x14], 0xfffffff6
xor ecx, ecx
mov dword [esp + 0x38], 0x2522abf7
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x20]
cmp eax, esi
mov eax, dword [esp + 0x14]
setle cl
cmp esi, ecx
sbb edx, edx
xor ecx, ecx
neg edx
cmp eax, edx
mov eax, dword [esp + 0x14]
setge cl
imul edx, ecx, 0xffff
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setle cl
neg ecx
je 0x10021999
mov dword [esp + 0x18], 0x70e7ad53
cmp dword [esp + 0x18], ebx
je 0x10021927
cmp dword [esp + 0x14], 0xfffffff7
mov edx, esi
jne 0x10021929
mov edx, ebx
mov eax, dword [esp + 0x18]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
xor eax, eax
cmp edx, ecx
setne al
imul eax, dword [esp + 0x10]
sub eax, 0x626a9d9e
neg eax
sbb eax, eax
inc eax
sub eax, dword [esp + 0x10]
neg eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [esp + 0x38], eax
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x38]
cmp eax, ecx
setne dl
xor ecx, ecx
imul edx, dword [esp + 0x10]
mov eax, dword [esp + 0x20]
cmp edx, eax
setge cl
add ecx, dword [esp + 0x14]
cmp ecx, dword [esp + 0x10]
jg 0x10021989
mov ecx, esi
cmp dword [esp + 0x18], ebx
jne 0x1002198b
mov ecx, ebx
mov eax, dword [esp + 0x148]
mov dword [eax], ecx
jmp 0x10021a42
mov dword [esp + 0x28], 0x867f5d1c
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x100219be
push ebx
push 0x1674
push 0xfd6
push ebx
call dword [sym.imp.GDI32.dll_GetPaletteEntries]
mov eax, dword [esp + 0x148]
xor ecx, ecx
push 9
mov dword [eax], 0xefce
mov eax, dword [esp + 0x2c]
cmp eax, esi
setg cl
imul ecx, dword [esp + 0x24]
cmp ecx, edi
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, 0xfffffffc
pop eax
setle cl
cmp ecx, eax
jae 0x10021a1d
push 3
mov dword [esp + 0x18], ebx
pop ecx
jmp 0x10021a0c
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x288], 0xcc3592e7
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ecx
jl 0x100219f9
cmp dword [esp + 0x288], ebx
jne 0x10021a51
jmp 0x10021a42
mov dword [esp + 0x38], 0xfffffffd
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10021a3e
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
dec dword [esp + 0x38]
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 7
jg 0x100218be
mov edi, dword [esp + 0x2c]
lea ecx, [esp + 0x148]
call fcn.1000f79f
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x18], ebx
jmp 0x10021aaa
mov dword [esp + 0x14], 7
mov dword [esp + 0x14], ebx
jmp 0x10021a9f
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10021a9b
push 0x260e
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
dec dword [esp + 0x14]
cmp dword [esp + 0x14], 0xfffffffd
jle 0x10021a7d
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0xc
je 0x10021a6f
mov dword [esp + 0x1c], 0xbb11accb
mov dword [esp + 0x20], 8
mov dword [esp + 0x20], 0x3580d416
mov dword [esp + 0x3c], 0x374c7af5
mov dword [esp + 0x14], ebx
jmp 0x10021aea
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0xf8], 2
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x10021ad7
cmp dword [esp + 0x1c], 0xfffffff9
jne 0x10021afb
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x20], esi
xor edx, edx
mov eax, dword [esp + 0x20]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x3c], eax
mov ecx, dword [esp + 0x3c]
imul ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
cmp eax, ecx
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
setg dl
mov dword [esp + 0x28], edx
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x1c]
setl dl
xor ecx, ecx
cmp edx, eax
setge cl
cmp dword [esp + 0x28], ecx
jne 0x10021b4d
cmp dword [esp + 0x20], ebx
jne 0x10021b55
mov eax, ebx
cmp dword [esp + 0x3c], ebx
je 0x10021b57
mov eax, esi
xor ecx, ecx
mov dword [esp + 0xf8], eax
mov eax, dword [esp + 0x1c]
cmp eax, esi
setge cl
cmp dword [esp + 0xec], 0
mov dword [esp + 0x20], ecx
je 0x10021d97
mov dword [esp + 0x10], 0xfffffffd
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x1c], 0x9141a9c2
push 3
mov dword [esp + 0x2c], 0x2d621ec2
mov dword [esp + 0x18], ebx
pop ecx
jmp 0x10021bb3
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x264], 0x45cb81ec
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ecx
jl 0x10021ba0
cmp dword [esp + 0x10], ebx
jne 0x10021bd6
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov eax, dword [esp + 0x10]
test eax, eax
setns cl
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
xor edx, edx
mov eax, dword [esp + 0x10]
cmp ecx, eax
setne dl
imul edx, dword [esp + 0x2c]
cmp dword [esp + 0x10], 0xfffb
sbb ecx, ecx
xor eax, eax
neg ecx
add ecx, dword [esp + 0x2c]
cmp edx, ecx
setl al
cmp eax, dword [esp + 0x10]
jl 0x10021c7a
mov dword [esp + 0x28], 0x18d303f
lea ecx, [esp + 0x238]
mov dword [esp + 0x28], ebx
push 4
call fcn.1000ecc9
mov dword [esp + 0x2c], 0x92f1
mov dword [esp + 0x14], ebx
jmp 0x10021c45
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x238]
mov dword [eax + ecx*4], 0xebec5ec6
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x10021c2f
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10021c6a
push ebx
push 0x177a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
dec dword [esp + 0x2c]
lea ecx, [esp + 0x238]
jmp 0x10021d30
push esi
lea ecx, [esp + 0x1e4]
call fcn.1000ecc9
mov dword [esp + 0x14], ebx
jmp 0x10021ca3
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1e0]
mov dword [eax + ecx*4], 0xf13bcf59
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x10021c8d
cmp dword [esp + 0x264], ebx
jne 0x10021d10
mov dword [esp + 0x10], ebx
jmp 0x10021d07
mov dword [esp + 0x14], ebx
jmp 0x10021cd1
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x220], 0x5fcb4448
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x10021cbe
mov dword [esp + 0x1c], ebx
jmp 0x10021cfc
mov eax, dword [esp + 0x224]
xor ecx, ecx
cmp eax, 0x2a6f
mov eax, dword [esp + 0x1e0]
setge cl
mov dword [eax], ecx
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0x1c
jg 0x10021cde
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0xf
jge 0x10021cb8
jmp 0x10021d29
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10021d29
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_KillTimer]
lea ecx, [esp + 0x1e0]
call fcn.1000f79f
mov ecx, dword [esp + 0xec]
call fcn.1001fe38
mov dword [esp + 0x28], 0xffffffff
mov edi, eax
mov dword [esp + 0x28], esi
mov dword [esp + 0x28], 0x7689351f
mov dword [esp + 0x28], 0x60417be1
mov dword [esp + 0x2c], 0xa6ed
mov dword [esp + 0x14], ebx
jmp 0x10021d80
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x294], 0xffffffff
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x10021d6d
inc dword [esp + 0x2c]
lea eax, [esp + 0x50]
push eax
call fcn.10022794
mov dword [eax], edi
mov dword [esp + 0x18], 0x95031536
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x2c], 0x33f2
mov dword [esp + 0x38], 0xfffffff6
mov dword [esp + 0x28], ebx
mov dword [esp + 0x14], ebx
jmp 0x10021dd1
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x5c], 0xfffffffe
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x10021dc1
mov eax, dword [esp + 0x5c]
xor ecx, ecx
cmp eax, 0x586f
setg cl
cmp ecx, dword [esp + 0x24]
jle 0x10021df0
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x5c]
mov eax, dword [esp + 0x2c]
cmp dword [esp + 0x5c], 0xab39e224
sbb eax, eax
xor edx, edx
lea ecx, [eax + 2]
mov eax, dword [esp + 0x60]
cmp ecx, eax
mov ecx, dword [esp + 0x38]
setne dl
imul ecx, edx
add ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x60]
imul ecx, eax
mov eax, dword [esp + 0x5c]
sub eax, ecx
xor ecx, ecx
cmp eax, 0x8486
mov eax, dword [esp + 0x2c]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x60]
setle dl
xor ecx, ecx
cmp edx, eax
setl cl
cmp ecx, dword [esp + 0x38]
jl 0x10021e56
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x5c]
lea ecx, [esp + 0xe8]
mov dword [esp + 0x24], eax
call fcn.1001c111
test edi, edi
je 0x1002210c
push 2
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], ebx
pop ecx
jmp 0x10021e92
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x2ac], 0xb57f
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ecx
jl 0x10021e7f
mov dword [esp + 0x10], ebx
jmp 0x10021eb1
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x2b4], 0x2c7c8a6b
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ecx
jl 0x10021e9e
mov dword [esp + 0x14], ebx
jmp 0x10021ed2
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10021ece
call dword [sym.imp.USER32.dll_DestroyCaret]
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jle 0x10021ebd
mov edx, dword [esp + 0x44]
mov ecx, edi
call fcn.1001fe75
push 2
lea ecx, [esp + 0x158]
mov dword [esp + 0xe0], eax
call fcn.1000ecc9
push 9
pop eax
mov dword [esp + 0x2e4], eax
mov dword [esp + 0x1c], 0xfffffffb
mov dword [esp + 0x28], ebx
mov dword [esp + 0x14], ebx
jmp 0x10021f2a
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x154]
mov dword [eax + ecx*4], 0xe469ad59
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x10021f14
mov edi, dword [esp + 0x154]
xor ecx, ecx
mov eax, dword [edi + 4]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov edx, dword [edi + 4]
test edx, edx
mov eax, edx
sete cl
sub eax, ecx
dec eax
cmp edx, eax
je 0x1002208a
mov dword [esp + 0x38], 0xffffffff
mov dword [esp + 0x28], 6
mov dword [esp + 0x1c], ebx
jmp 0x1002207d
push dword [esp + 0xc0]
movdqa xmm0, xmmword [0x10007f60]
lea eax, [esp + 0x268]
push eax
lea eax, [esp + 0x25c]
mov dword [esp + 0xd8], ebx
push eax
push ebx
lea ecx, [esp + 0xe0]
mov dword [esp + 0xe4], ebx
movdqu xmmword [esp + 0x264], xmm0
mov dword [esp + 0xe8], ebx
call fcn.100140d9
mov dword [esp + 0x2c], esi
push 3
mov dword [esp + 0x30], 0xd2570d97
mov dword [esp + 0x18], ebx
pop ecx
jmp 0x10021fe5
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x270], 0xc93e
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ecx
jl 0x10021fd2
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10021fff
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
mov ecx, dword [esp + 0xd0]
cmp dword [ecx + 0xc], ebx
jne 0x1002203e
mov eax, dword [esp + 0x154]
mov eax, dword [eax]
mov dword [esp + 0x274], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0xd0]
cmp dword [eax], esi
jne 0x1002203e
cmp dword [ecx + 0xc], ebx
jne 0x1002203e
mov ecx, ebx
cmp dword [eax + 4], ebx
je 0x10022040
mov ecx, esi
xor eax, eax
cmp ecx, 0x89fa
setge al
xor edx, edx
mov dword [esp + 0x2c], eax
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x38]
cmp ecx, eax
lea ecx, [esp + 0xd0]
setle dl
sub edx, 0x384b6d70
neg edx
sbb edx, edx
inc edx
mov dword [esp + 0x28], edx
call fcn.1000f79f
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xfffffff4
je 0x10021f73
jmp 0x100220db
mov dword [esp + 0x28], 7
mov dword [esp + 0x18], 0x218ad385
mov dword [esp + 0x44], ebx
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x28]
mov dword [esp + 0x1c], eax
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setle cl
sub ecx, dword [esp + 0x44]
imul ecx, dword [esp + 0x1c]
mov dword [esp + 0x44], ecx
mov eax, dword [esp + 0x44]
sub eax, dword [esp + 0x18]
mov dword [esp + 0x18], eax
mov eax, dword [edi + 4]
lea ecx, [esp + 0x154]
mov dword [esp + 0x1c], eax
or dword [esp + 0x2e4], 0xffffffff
call fcn.1000f79f
lea eax, [esp + 0xb0]
push eax
call fcn.10022732
mov ecx, dword [esp + 0xdc]
mov dword [eax], ecx
push dword [esp + 0xc0]
lea eax, [esp + 0x258]
mov dword [esp + 0x1c], 0xa75c19c5
push eax
lea eax, [esp + 0x24c]
mov dword [esp + 0x38], ebx
push eax
xorps xmm0, xmm0
mov dword [esp + 0x178], ebx
push ebx
lea ecx, [esp + 0x17c]
mov dword [esp + 0x180], ebx
movdqu xmmword [esp + 0x254], xmm0
mov dword [esp + 0x184], ebx
call fcn.100140d9
push 0xa
pop eax
mov dword [esp + 0x2e4], eax
mov dword [esp + 0x28], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x28], 0xfffffff6
mov dword [esp + 0x28], 0x186a
cmp dword [esp + 0x28], 0xc10
jge 0x100222ae
lea eax, [esp + 0x54]
push eax
push 0x1000775c
call fcn.10057f6b
mov eax, dword [esp + 0x5c]
pop ecx
pop ecx
test eax, eax
je 0x100222a9
dec eax
mov dword [esp + 0x54], eax
lea eax, [esp + 0xbc]
push eax
lea eax, [esp + 0xbc]
push eax
push 0x1000786c
call fcn.10057f6b
add esp, 0xc
mov dword [esp + 0x2c], ebx
cmp dword [esp + 0xb8], 0
mov edi, ebx
jle 0x1002229a
cmp dword [esp + 0xbc], 0
mov dword [esp + 0x28], ebx
jle 0x1002227d
mov eax, edi
and eax, 0x80000001
jns 0x10022200
dec eax
or eax, 0xfffffffe
inc eax
mov ebx, dword [esp + 0x28]
mov edi, eax
mov dword [esp + 0x34], eax
lea eax, [esp + 0xc4]
push eax
push 0x1000775c
call fcn.10057f6b
mov esi, ebx
and esi, 0x80000001
jns 0x1002222b
dec esi
or esi, 0xfffffffe
inc esi
xor esi, edi
and esi, 0x80000001
jns 0x1002223a
dec esi
or esi, 0xfffffffe
inc esi
mov edx, dword [esp + 0xcc]
mov eax, edx
and eax, 0x80000001
jns 0x1002224f
dec eax
or eax, 0xfffffffe
inc eax
xor ecx, ecx
cmp eax, esi
setne cl
add edx, ecx
push edx
push 0x100078f8
mov dword [esp + 0xd4], edx
call fcn.1005819f
add esp, 0x10
inc ebx
cmp ebx, dword [esp + 0xbc]
jl 0x1002220a
mov edi, dword [esp + 0x2c]
xor ebx, ebx
push 0x100076c5
call fcn.10058aba
inc edi
pop ecx
mov dword [esp + 0x2c], edi
cmp edi, dword [esp + 0xb8]
jl 0x100221e0
mov eax, dword [esp + 0x54]
test eax, eax
jne 0x100221aa
xor esi, esi
inc esi
dec eax
mov dword [esp + 0x54], eax
mov eax, dword [esp + 0x18]
add eax, dword [esp + 0x18]
neg eax
sbb eax, eax
xor edx, edx
neg eax
cmp eax, 0x3d78
mov eax, dword [esp + 0x18]
sete dl
xor ecx, ecx
cmp eax, edx
setl cl
imul ecx, dword [esp + 0x18]
test ecx, ecx
jne 0x100222e2
cmp dword [esp + 0x18], ebx
jne 0x100222e2
mov esi, ebx
mov eax, dword [esp + 0x18]
xor ecx, ecx
cmp eax, esi
push 3
setl cl
xor eax, eax
cmp ecx, 0x6bc3
pop esi
setg al
mov dword [esp + 0x30], eax
mov dword [esp + 0x30], ebx
jmp 0x1002238a
push esi
lea ecx, [esp + 0x1c0]
call fcn.1000ecc9
mov dword [esp + 0x10], ebx
jmp 0x1002232e
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x2bc], 0x4be76d23
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x1002231b
mov dword [esp + 0x10], ebx
jmp 0x10022350
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x1bc]
mov dword [eax + ecx*4], 0xc93c
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x1002233a
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10022370
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnumChildWindows]
mov eax, dword [esp + 0x1bc]
lea ecx, [esp + 0x1bc]
inc dword [eax + 8]
call fcn.1000f79f
inc dword [esp + 0x30]
cmp dword [esp + 0x30], esi
jle 0x10022308
lea ecx, [esp + 0x16c]
call fcn.1000f79f
mov eax, dword [ebp + 8]
lea esi, [esp + 0xdc]
mov ecx, dword [esp + 0x2dc]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret