Function at 0x1001a8c7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1008aa8d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x170
mov eax, ecx
mov dword [esp + 0x48], edx
push ebx
xor ebx, ebx
mov dword [esp + 0x48], eax
push esi
push edi
cmp dword [eax + 0x10], ebx
jne 0x1001a903
xor al, al
jmp 0x1001b594
mov dword [edx], ebx
cmp dword [eax + 0x14], 0x10
jb 0x1001a90d
mov ecx, dword [eax]
push 4
pop edi
xor edx, edx
mov dword [esp + 0x3c], ecx
inc edx
cmp dword [eax + 0x14], 0x10
jb 0x1001a921
mov esi, dword [eax]
jmp 0x1001a923
mov esi, eax
mov eax, dword [eax + 0x10]
add eax, esi
cmp ecx, eax
je 0x1001b592
mov dword [esp + 0x10], 0xfb871c7b
mov dword [esp + 0x20], 0x5610a143
mov dword [esp + 0x10], ebx
jmp 0x1001a959
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x15c], 0xfffffffd
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x1001a946
mov dword [esp + 0x10], 3
cmp dword [esp + 0x10], ebx
jl 0x1001a99f
mov dword [esp + 0x20], 0xba13b288
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001a98e
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
xor edx, edx
inc edx
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x15c], edx
dec dword [esp + 0x10]
jns 0x1001a96d
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001a9c1
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateEnhMetaFileW]
push dword [esp + 0x50]
lea eax, [esp + 0x124]
mov dword [esp + 0x2c], ebx
push eax
lea eax, [esp + 0x118]
mov dword [esp + 0xa8], ebx
push eax
xorps xmm0, xmm0
mov dword [esp + 0xb0], ebx
push ebx
lea ecx, [esp + 0xb0]
mov dword [esp + 0xb8], ebx
movdqu xmmword [esp + 0x120], xmm0
call fcn.10018555
mov dword [esp + 0x184], ebx
lea ecx, [esp + 0xdc]
mov dword [esp + 0x24], 0x35a23e86
mov dword [esp + 0x10], 0xffffffff
push edi
call fcn.1001704c
mov dword [esp + 0x20], 0xfffffffe
xor edx, edx
mov dword [esp + 0x20], 0xbd2e
inc edx
mov dword [esp + 0x20], 0xfffffff6
mov dword [esp + 0x20], edx
mov dword [esp + 0x18], ebx
jmp 0x1001aa66
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0xdc]
mov dword [eax + ecx*4], 9
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x1001aa50
mov dword [esp + 0x18], ebx
jmp 0x1001aa85
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x120], 0xe961cae4
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x1001aa72
mov eax, dword [esp + 0x28]
mov esi, dword [esp + 0xa0]
mov eax, dword [esi + 4]
mov dword [esp + 0x24], eax
cmp dword [esi + 0xc], ebx
je 0x1001aaa8
mov eax, edx
cmp dword [esi], ebx
jne 0x1001aaaa
mov eax, ebx
mov dword [esp + 0x24], eax
mov edi, edx
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0xdc]
mov dword [eax + 0xc], 0x9c27
mov eax, dword [esp + 0x24]
mov dword [esp + 0x20], eax
cmp dword [esp + 0x10], ebx
jne 0x1001aada
mov edi, ebx
mov eax, dword [esp + 0x28]
xor ecx, ecx
cmp eax, dword [esi + 0xc]
setl cl
cmp ecx, edi
jne 0x1001ab47
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], al
je 0x1001abb8
push 0xc49
push 0x1950
push 0x9ba
push 0xc5c
push 0x14b9
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov esi, dword [sym.imp.USER32.dll_GetDC]
push eax
call esi
push eax
push 0x4d5
push 0x960
push 0xf34
push 0x12d0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_StretchBlt]
jmp 0x1001abb8
mov dword [esp + 0x20], 0xdf04
mov dword [esp + 0x24], 0x40ee1d45
mov dword [esp + 0x24], edx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x10], ebx
jmp 0x1001ab78
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x16c], 0x47d17017
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x1001ab65
cmp dword [esp + 0x20], ebx
mov byte [esp + 0x17], bl
je 0x1001ab98
cmp byte [esp + 0x17], 0
je 0x1001abb1
call dword [sym.imp.KERNEL32.dll_GetConsoleCP]
jmp 0x1001abb1
cmp byte [esp + 0x17], 0
je 0x1001abb1
push 0x23e5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindow]
dec dword [esp + 0x128]
lea ecx, [esp + 0xdc]
call fcn.100170ce
or dword [esp + 0x184], 0xffffffff
lea ecx, [esp + 0xa0]
call fcn.100170ce
push 2
lea ecx, [esp + 0xec]
call fcn.1001704c
mov dword [esp + 0x10], 0x9bdba76a
mov dword [esp + 0x10], ebx
jmp 0x1001ac06
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xe8]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1001abf4
xor esi, esi
inc esi
mov dword [esp + 0x10], esi
cmp dword [esp + 0x10], ebx
jl 0x1001ac30
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0xe8]
mov eax, dword [ecx]
mov dword [ecx + edx*4], eax
dec dword [esp + 0x10]
jns 0x1001ac1a
lea ecx, [esp + 0xe8]
call fcn.100170ce
mov dword [esp + 0x18], 0x15252cb1
lea ecx, [esp + 0x78]
mov dword [esp + 0x18], 0xa3367f5e
push 2
call fcn.1001704c
mov dword [esp + 0x1c], 0xf7398071
mov dword [esp + 0x10], 0xba8a7e8b
mov dword [esp + 0x10], ebx
jmp 0x1001ac80
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x78]
mov dword [eax + ecx*4], 0x8fbdedbe
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1001ac6d
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x18], 0x38dc5336
cmp dword [esp + 0x18], ebx
je 0x1001aed9
mov dword [esp + 0x30], 0x9cb0
mov dword [esp + 0x28], 0xc245e320
mov dword [esp + 0x20], ebx
mov dword [esp + 0x10], ebx
jmp 0x1001acde
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x90], 0xffffffff
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x1001accb
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x28]
cmp dword [esp + 0x28], ebx
je 0x1001acfb
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x30]
xor ecx, ecx
mov dword [esp + 0x94], eax
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x78]
cmp dword [edx], ebx
lea edi, [edx + 4]
setl cl
xor eax, eax
cmp ecx, dword [edi]
setge al
cmp eax, 0x43a1
jge 0x1001ad39
cmp dword [esp + 0x94], ebx
mov edx, dword [esp + 0x78]
jne 0x1001ad39
mov esi, ebx
mov ecx, dword [esp + 0x1c]
xor eax, eax
cmp esi, 0x5bfe
sete al
add ecx, eax
mov dword [edx], eax
mov eax, dword [esp + 0x30]
xor edx, edx
neg ecx
cmp ecx, eax
setge dl
xor eax, eax
add edx, dword [esp + 0x28]
cmp edx, 0xc77e
setle al
cmp eax, dword [esp + 0x30]
jg 0x1001ad7e
cmp dword [esp + 0x94], ebx
jne 0x1001ad7e
xor edx, edx
mov eax, ebx
inc edx
jmp 0x1001ad83
xor edx, edx
inc edx
mov eax, edx
cmp eax, dword [esp + 0x30]
jne 0x1001ad93
mov eax, dword [esp + 0x78]
mov ecx, edx
cmp dword [eax], ebx
jne 0x1001ad95
mov ecx, ebx
mov eax, dword [esp + 0x30]
neg eax
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x1c], ecx
xor ecx, ecx
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x28]
cmp eax, 0x14efc71
setne cl
mov dword [esp + 0x28], ecx
mov dword [esp + 0x1c], 0xfffffff5
jmp 0x1001aea5
mov dword [esp + 0x28], 6
mov dword [esp + 0x24], ebx
cmp dword [edi], ebx
jne 0x1001ae13
mov dword [esp + 0x28], ebx
cmp dword [esp + 0x28], ebx
jne 0x1001ae13
mov eax, dword [esp + 0x10]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x94]
cmp dword [esp + 0x1c], ebx
jne 0x1001ae13
mov edx, ebx
mov eax, dword [esp + 0x30]
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x94]
mov edx, dword [esp + 0x28]
setg cl
mov eax, dword [esp + 0x78]
mov dword [edi], ecx
xor ecx, ecx
mov dword [eax], edx
mov eax, dword [esp + 0x24]
cmp edx, eax
mov edx, dword [esp + 0x30]
sete cl
sub edx, ecx
neg edx
sbb edx, edx
xor eax, eax
inc edx
cmp edx, 0xbbd8
setle al
xor ecx, ecx
cmp eax, 0x6f27
setl cl
imul ecx, dword [esp + 0x1c]
test ecx, ecx
jne 0x1001ae70
mov eax, dword [esp + 0x94]
mov eax, dword [esp + 0x18]
xor edx, edx
mov eax, dword [esp + 0x20]
inc edx
mov eax, dword [esp + 0x94]
mov eax, dword [esp + 0x94]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x24], edx
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xfffffff4
jg 0x1001add6
xor esi, esi
inc esi
lea ecx, [esp + 0x78]
call fcn.100170ce
push esi
lea ecx, [esp + 0xc8]
call fcn.1001704c
xor ecx, ecx
inc ecx
mov dword [esp + 0x184], ecx
mov dword [esp + 0x2c], ebx
jmp 0x1001af05
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001aeb3
push 0x564
push ebx
push ebx
push 0x1925
push ebx
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
jmp 0x1001aeb3
mov eax, dword [esp + 0x2c]
mov dword [esp + eax*4 + 0x58], ecx
inc dword [esp + 0x2c]
cmp dword [esp + 0x2c], 3
jl 0x1001aef9
mov dword [esp + 0x2c], ebx
jmp 0x1001af25
mov eax, dword [esp + 0x2c]
mov dword [esp + eax*4 + 0x10c], 0x3423637b
inc dword [esp + 0x2c]
cmp dword [esp + 0x2c], ecx
jl 0x1001af12
push 0x46fa
push 0x72f5
push 0x15e5
push 0x60a9
lea eax, [esp + 0xd4]
push eax
lea eax, [esp + 0x40]
push ebx
push eax
call fcn.10023342
add esp, 0x1c
mov dword [esp + 0x18], ebx
push 4
pop edi
cmp dword [esp + 0x18], 2
jg 0x1001b0b2
push edi
lea ecx, [esp + 0xd4]
call fcn.1001704c
xor esi, esi
mov byte [esp + 0x184], 2
inc esi
lea ecx, [esp + 0x100]
push esi
call fcn.1001704c
mov byte [esp + 0x184], 3
mov dword [esp + 0x38], ebx
jmp 0x1001afb0
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0xd0]
mov dword [eax + ecx*4], 0xbf118c84
inc dword [esp + 0x38]
cmp dword [esp + 0x38], edi
jl 0x1001af9a
lea eax, [esp + 0x100]
push eax
push 0x6a0c
push 0x589b
lea eax, [esp + 0x44]
push eax
push ebx
call fcn.1001df32
mov eax, dword [esp + 0x2c]
add esp, 0x14
cmp dword [esp + eax*4 + 0x58], ebx
jne 0x1001b047
mov eax, dword [esp + 0x18]
xor edx, edx
mov ecx, dword [esp + eax*4 + 0x58]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + eax*4 + 0x58]
cmp ecx, eax
mov eax, dword [esp + 0x18]
setge dl
xor ecx, ecx
mov eax, dword [esp + eax*4 + 0x58]
cmp eax, edx
mov eax, dword [esp + 0x18]
setg cl
sub ecx, dword [esp + eax*4 + 0x58]
mov eax, dword [esp + 0x18]
neg ecx
sbb ecx, ecx
mov edx, ecx
xor ecx, ecx
mov dword [esp + eax*4 + 0x58], edx
mov eax, dword [esp + 0x18]
cmp edx, eax
sete cl
cmp ecx, esi
ja 0x1001b039
cmp dword [esp + 0x18], ebx
jne 0x1001b039
mov eax, dword [esp + 0x18]
mov eax, dword [esp + eax*4 + 0x58]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x18], ebx
je 0x1001b04d
cmp dword [esp + 0x18], ebx
jne 0x1001b055
mov eax, dword [esp + 0x18]
mov eax, dword [esp + eax*4 + 0x58]
lea eax, [esp + 0xd0]
xor dl, dl
push 0x17d4
push eax
mov ecx, 0x7726
call fcn.1001a454
push ebx
lea eax, [esp + 0xd0]
push eax
push 0x63eb
push 0x5d20
call fcn.1001cb38
add esp, 0x18
lea ecx, [esp + 0x100]
call fcn.100170ce
lea ecx, [esp + 0xd0]
mov byte [esp + 0x184], 1
call fcn.100170ce
inc dword [esp + 0x18]
jmp 0x1001af5c
or dword [esp + 0x184], 0xffffffff
lea ecx, [esp + 0xc4]
call fcn.100170ce
mov dword [esp + 0x10], 0x824a8c6a
mov dword [esp + 0x20], ebx
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001b0e4
push ebx
call dword [sym.imp.USER32.dll_DestroyCursor]
mov dword [esp + 0x10], 0xfffffff5
jmp 0x1001b109
mov dword [esp + 0x20], ebx
xor edx, edx
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
cmp eax, ecx
setg dl
mov dword [esp + 0x20], edx
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xffffffeb
je 0x1001b0ee
mov eax, dword [esp + 0x3c]
mov al, byte [eax]
cmp al, 0x30
jl 0x1001b2de
cmp al, 0x39
jg 0x1001b2de
mov dword [esp + 0x24], 0xcf54c3c6
xor edx, edx
mov dword [esp + 0x34], 0xfffa
inc edx
mov dword [esp + 0x44], edx
mov dword [esp + 0x64], 0x8331c587
mov dword [esp + 0xb0], 0xfffffff7
mov dword [esp + 0xb8], 0xd2964071
mov dword [esp + 0x20], 9
mov dword [esp + 0x20], 0x495dd686
mov dword [esp + 0x20], 0xffff
mov eax, dword [esp + 0x24]
add eax, 8
jne 0x1001b188
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x34]
xor ecx, ecx
cmp eax, edx
setg cl
mov dword [esp + 0x44], ecx
mov eax, dword [esp + 0x44]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x64]
mov eax, dword [esp + 0x24]
neg eax
sbb eax, eax
inc eax
cmp eax, 2
jne 0x1001b20a
cmp dword [esp + 0x34], ebx
jne 0x1001b20a
mov dword [esp + 0x24], 0x828c040c
lea ecx, [esp + 0xf4]
push edx
call fcn.1001704c
lea eax, [esp + 0x74]
mov dword [esp + 0x184], edi
push eax
push 0x541
mov dl, 1
lea ecx, [esp + 0xfc]
call fcn.1001a454
inc dword [esp + 0x28]
or dword [esp + 0x18c], 0xffffffff
pop ecx
pop ecx
lea ecx, [esp + 0xf4]
call fcn.100170ce
jmp 0x1001b2a8
mov dword [esp + 0xac], 0xb705618d
mov dword [esp + 0x20], 0x1dc630de
mov dword [esp + 0x34], ebx
jmp 0x1001b29d
push 0x3a84
lea eax, [esp + 0xbc]
mov dword [esp + 0xc0], 0xffffffff
push eax
lea eax, [esp + 0xb8]
mov dword [esp + 0xc8], ebx
push eax
lea eax, [esp + 0xc8]
mov dword [esp + 0xc0], 0x81f6ed73
push eax
push 0x26c0
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x4c]
push eax
push ebx
lea eax, [esp + 0xe0]
push eax
lea eax, [esp + 0xd8]
push eax
lea eax, [esp + 0xd4]
push eax
lea eax, [esp + 0x90]
push eax
call fcn.1001ceb1
mov eax, dword [esp + 0x50]
add esp, 0x30
inc dword [esp + 0x34]
cmp dword [esp + 0x34], 0x24
jg 0x1001b223
push ebx
call fcn.1001d092
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x44]
push eax
push 0x7343
push 0x3eb7
push ebx
push 0x71c6
call fcn.100257f0
mov ecx, dword [esp + 0x58]
add esp, 0x1c
mov eax, dword [esp + 0x50]
inc ecx
jmp 0x1001a910
push dword [esp + 0x74]
movdqa xmm0, xmmword [0x10009780]
lea eax, [esp + 0x154]
push eax
lea eax, [esp + 0x148]
mov dword [esp + 0x24], 0xac204e2d
push eax
mov dword [esp + 0x1c], 0xdebf889e
lea ecx, [esp + 0x90]
push ebx
movdqu xmmword [esp + 0x150], xmm0
mov dword [esp + 0x94], ebx
mov dword [esp + 0x98], ebx
mov dword [esp + 0x9c], ebx
call fcn.10018555
mov dword [esp + 0x20], 0x338886a6
mov dword [esp + 0x28], 0xac06e326
mov dword [esp + 0x24], ebx
jmp 0x1001b35e
mov eax, dword [esp + 0x24]
mov dword [esp + eax*4 + 0x150], 0xbab72157
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 3
jl 0x1001b34b
mov dword [esp + 0x1c], ebx
jmp 0x1001b381
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001b37d
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantClear]
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 7
je 0x1001b36b
mov eax, dword [esp + 0x1c]
xor ecx, ecx
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
mov esi, dword [esp + 0x84]
cmp eax, dword [esi + 0xc]
setne cl
xor edx, edx
mov dword [esp + 0x20], ecx
mov ecx, 0xbf5cbf79
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x84]
sub ecx, dword [eax + 8]
mov eax, dword [esp + 0x1c]
cmp ecx, eax
mov eax, dword [esp + 0x1c]
setl dl
xor ecx, ecx
cmp eax, edx
setle cl
cmp ecx, dword [esp + 0x28]
jle 0x1001b3ed
cmp dword [esp + 0x28], ebx
je 0x1001b3ed
xor ecx, ecx
inc ecx
jmp 0x1001b3ef
mov ecx, ebx
mov eax, dword [esi + 0xc]
mov dword [esp + 0x154], ecx
add eax, ecx
mov dword [esp + 0x28], eax
lea ecx, [esp + 0x84]
call fcn.100170ce
mov eax, dword [esp + 0x54]
lea ecx, [esp + 0x68]
push dword [esp + 0x74]
movdqa xmm0, xmmword [0x10009740]
movdqu xmmword [esp + 0x134], xmm0
mov dword [eax], ebx
lea eax, [esp + 0x144]
push eax
lea eax, [esp + 0x138]
mov dword [esp + 0x24], 0xbea12209
push eax
push ebx
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], ebx
mov dword [esp + 0x80], ebx
call fcn.10018555
xor ecx, ecx
mov dword [esp + 0x20], 0xfffffff8
mov dword [esp + 0x18], ebx
inc ecx
jmp 0x1001b474
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x40], ebx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ecx
jl 0x1001b468
mov dword [esp + 0x18], ebx
jmp 0x1001b490
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x48], 0x6a6c65b0
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jl 0x1001b480
mov eax, dword [esp + 0x1c]
xor ecx, ecx
dec dword [esp + 0x40]
mov esi, dword [esp + 0x40]
mov eax, dword [esp + 0x1c]
cmp eax, 0x74a5
mov eax, dword [esp + 0x68]
setge cl
xor edx, edx
mov dword [eax], ecx
mov eax, dword [esp + 0x1c]
cmp eax, ecx
mov eax, dword [esp + 0x1c]
setne dl
xor ecx, ecx
neg edx
cmp edx, eax
mov eax, dword [esp + 0x1c]
setge cl
xor edx, edx
cmp ecx, 0xfffffffd
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
inc eax
cmp eax, ecx
mov ecx, 0xa0b8ee41
sbb eax, eax
xor edx, edx
neg eax
sub ecx, eax
mov eax, dword [esp + 0x1c]
cmp eax, ecx
setge dl
xor ecx, ecx
cmp esi, edx
setle cl
xor edx, edx
xor eax, eax
inc edx
cmp ecx, edx
setle al
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x48], ebx
je 0x1001b530
mov eax, dword [esp + 0x48]
mov esi, edx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x20], eax
cmp dword [esp + 0x20], ebx
jne 0x1001b532
mov esi, ebx
mov eax, dword [esp + 0x68]
xor ecx, ecx
sub esi, dword [eax]
mov eax, dword [esp + 0x48]
sub esi, eax
mov eax, dword [esp + 0x48]
cmp eax, esi
setg cl
cmp ecx, 5
jb 0x1001b556
mov esi, ebx
cmp dword [esp + 0x48], ebx
je 0x1001b558
mov esi, edx
mov eax, dword [esp + 0x68]
xor ecx, ecx
cmp esi, dword [eax + 0xc]
mov eax, 0x8726
setne cl
sub eax, ecx
je 0x1001b573
cmp dword [esp + 0x48], ebx
jne 0x1001b575
mov edx, ebx
mov ecx, dword [esp + 0x68]
xor eax, eax
cmp dword [ecx + 8], edx
setg al
mov dword [ecx + 8], eax
lea ecx, [esp + 0x68]
call fcn.100170ce
jmp 0x1001a8fc
mov al, dl
mov ecx, dword [esp + 0x17c]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret