Function at 0x1002131e
Capabilities:
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1007286a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3e8
push ebx
push esi
push edi
mov dword [esp + 0x4c], ecx
mov esi, edx
xor ebx, ebx
mov dword [esp + 0xc], 0xffffffff
push 2
mov dword [esp + 0x120], esi
mov dword [esp + 0x10], ebx
pop ecx
jmp 0x10021375
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x19c], 0xcff0ea75
inc dword [esp + 0xc]
cmp dword [esp + 0xc], ecx
jl 0x10021362
mov dword [esp + 0xc], ebx
jmp 0x10021394
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x19c], 1
inc dword [esp + 0xc]
cmp dword [esp + 0xc], ecx
jl 0x10021381
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x100213af
push 0x2403
call dword [sym.imp.USER32.dll_GetKeyState]
mov eax, dword [0x118c2cb8]
test al, 1
jne 0x10021452
or eax, 1
mov dword [0x118c2cb8], eax
push ebx
mov dword [esp + 0x400], ebx
push ebx
mov dword [0x118c2cc0], ebx
mov dword [0x118c2cc4], ebx
call fcn.10023d52
mov dword [0x118c2cc0], eax
mov dword [0x118c2cc8], ebx
mov dword [0x118c2cd0], ebx
mov byte [esp + 0x3fc], 2
mov ecx, 0x118c2cc8
mov dword [esp + 0x110], eax
lea eax, [esp + 0x110]
push eax
push 0x10
push ebx
lea eax, [esp + 0x98]
mov dword [0x118c2cdc], 0x3f800000
push eax
mov dword [0x118c2ccc], ebx
call fcn.10023b2a
push 0x10073604
mov dword [0x118c2cd4], 7
mov dword [0x118c2cd8], 8
call fcn.100574fc
or dword [esp + 0x400], 0xffffffff
pop ecx
imul eax, dword [esp + 0x4c], 0x2710
add eax, esi
mov dword [esp + 0x78], eax
lea eax, [esp + 0x78]
push eax
call fcn.10022db8
mov edi, dword [eax]
test edi, edi
je 0x10021730
push dword [esp + 0x8c]
movdqa xmm0, xmmword [0x1000e2b0]
lea ecx, [esp + 0xf0]
mov eax, 0x469ad59e
mov dword [esp + 0xf0], ebx
mov dword [esp + 0x9c], eax
mov dword [esp + 0xa0], eax
mov dword [esp + 0xa4], eax
mov dword [esp + 0xa8], eax
lea eax, [esp + 0x21c]
push eax
lea eax, [esp + 0x210]
mov dword [esp + 0xf8], ebx
push eax
push ebx
movdqu xmmword [esp + 0x218], xmm0
mov dword [esp + 0x104], ebx
call fcn.10024590
push 3
mov dword [esp + 0x10], ebx
pop esi
jmp 0x100214f7
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x234], ebx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x100214e8
mov dword [esp + 0x9c], ebx
jmp 0x1002152b
mov dword [esp + 0x38], ebx
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x9c]
mov dword [esp + eax*4 + 0x234], ecx
sub ecx, dword [esp + 0x38]
mov dword [esp + 0x38], ecx
inc dword [esp + 0x9c]
cmp dword [esp + 0x9c], 2
jle 0x10021506
mov eax, dword [esp + 0xec]
lea ecx, [esp + 0xec]
mov eax, dword [eax + 4]
mov dword [esp + 0x9c], eax
call fcn.1001142d
push dword [esp + 0x8c]
lea eax, [esp + 0x22c]
mov dword [esp + 0xe4], edi
push eax
lea eax, [esp + 0x220]
mov dword [esp + 0x100], ebx
push eax
xorps xmm0, xmm0
mov dword [esp + 0x108], ebx
push ebx
lea ecx, [esp + 0x108]
mov dword [esp + 0x110], ebx
movdqu xmmword [esp + 0x228], xmm0
call fcn.10024590
mov dword [esp + 0x20], 0x1974
cmp dword [esp + 0x20], 0xe83
jge 0x100216c6
lea eax, [esp + 0x70]
push eax
lea eax, [esp + 0x118]
push eax
push 0x1000ddc8
call fcn.10058fc2
mov eax, dword [esp + 0x120]
add esp, 0xc
mov esi, dword [esp + 0x70]
test eax, eax
jne 0x100215e5
test esi, esi
je 0x100216c3
mov ecx, ebx
test eax, eax
jle 0x100215fa
mov edx, eax
mov dword [esp + ecx*4 + 0x260], edx
inc ecx
dec edx
cmp ecx, eax
jl 0x100215ed
mov dword [esp + 0x24], ebx
test esi, esi
jle 0x100216ab
lea eax, [esp + 0x94]
push eax
lea eax, [esp + 0x8c]
push eax
push 0x1000ddc8
call fcn.10058fc2
mov eax, dword [esp + 0x94]
add esp, 0xc
lea edx, [eax - 1]
test edx, edx
jle 0x1002164d
mov ecx, dword [esp + 0x94]
lea edi, [esp + 0x328]
lea esi, [esp + 0x260]
lea edi, [edi + ecx*4]
mov ecx, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x94]
dec ecx
add ecx, eax
mov dword [esp + 0x20], ecx
cmp edx, ecx
jge 0x10021684
mov eax, edx
lea esi, [esp + 0x260]
sub eax, dword [esp + 0x88]
lea edi, [esp + 0x32c]
sub ecx, edx
lea esi, [esi + edx*4]
lea edi, [edi + eax*4]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x20]
test ecx, ecx
jle 0x10021698
lea esi, [esp + 0x328]
lea edi, [esp + 0x260]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x24]
inc esi
mov dword [esp + 0x24], esi
cmp esi, dword [esp + 0x70]
jl 0x10021606
push dword [esp + 0x260]
push 0x1000ddd0
call fcn.10057526
pop ecx
pop ecx
jmp 0x100215b4
push 3
pop esi
mov dword [esp + 0xc], 0x84c506d4
mov dword [esp + 0xc], ebx
jmp 0x10021719
mov dword [esp + 0x14], ebx
jmp 0x100216ea
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x7c], 1
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x100216da
mov dword [esp + 0x7c], esi
cmp dword [esp + 0x7c], ebx
jl 0x10021715
mov ecx, dword [esp + 0x7c]
mov eax, dword [esp + 0xf8]
cmp dword [eax + ecx*4], ebx
jne 0x10021715
mov eax, dword [esp + 0xc]
dec dword [esp + 0x7c]
jns 0x100216fb
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jle 0x100216d4
lea ecx, [esp + 0xf8]
call fcn.1001142d
jmp 0x1002298b
mov eax, dword [0x118c2cb8]
push 3
pop esi
test al, 2
jne 0x100217d6
or eax, 2
mov dword [0x118c2cb8], eax
push ebx
mov dword [esp + 0x400], esi
push ebx
mov dword [0x118c2ce0], ebx
mov dword [0x118c2ce4], ebx
call fcn.10023d52
mov dword [0x118c2ce0], eax
mov dword [0x118c2ce8], ebx
mov dword [0x118c2cf0], ebx
mov byte [esp + 0x3fc], 5
mov ecx, 0x118c2ce8
mov dword [esp + 0x10c], eax
lea eax, [esp + 0x10c]
push eax
push 0x10
push ebx
lea eax, [esp + 0x1e4]
mov dword [0x118c2cfc], 0x3f800000
push eax
mov dword [0x118c2cec], ebx
call fcn.10023b2a
push 0x100735ff
mov dword [0x118c2cf4], 7
mov dword [0x118c2cf8], 8
call fcn.100574fc
or dword [esp + 0x400], 0xffffffff
pop ecx
push esi
lea ecx, [esp + 0x134]
call fcn.10010e51
mov dword [esp + 0x3fc], 6
mov dword [esp + 0x14], 0x9dada439
mov dword [esp + 0x24], 1
mov dword [esp + 0x38], 5
mov dword [esp + 0xc], 0xa9634d71
mov dword [esp + 0x20], 0xfffb
mov dword [esp + 0x28], 0x2e7dfe98
mov dword [esp + 0xc], ebx
jmp 0x1002183a
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x130]
mov dword [eax + ecx*4], 0xfffffffa
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x10021824
mov dword [esp + 0x14], 2
cmp dword [esp + 0x14], ebx
jl 0x1002190c
mov edi, dword [esp + 0x130]
push 2
lea ecx, [esp + 0x128]
call fcn.10010e51
mov dword [esp + 0xc], ebx
jmp 0x10021883
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x124]
mov dword [eax + ecx*4], 0xaae07ea4
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x1002186d
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1002189f
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x124]
mov dword [eax], ebx
mov eax, dword [esp + 0x24]
test eax, eax
setns cl
mov dword [esp + 0x38], ecx
xor ecx, ecx
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x124]
cmp dword [eax], 0xa7fe
setne cl
cmp ecx, dword [esp + 0x24]
jge 0x100218e7
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x124]
mov eax, dword [esp + 0x14]
mov eax, dword [edi + 4]
mov dword [esp + 0xc], eax
call fcn.1001142d
dec dword [esp + 0x14]
jns 0x10021859
mov dword [esp + 0xc], 0xe
cmp dword [esp + 0xc], 0xfffffff7
jg 0x100219bd
mov edi, dword [esp + 0x130]
push 2
lea ecx, [esp + 0x17c]
call fcn.10010e51
mov dword [esp + 0x3c], 0x97e65fb
mov dword [esp + 0x24], 6
mov dword [esp + 0x18], ebx
jmp 0x1002195d
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x178]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jl 0x1002194a
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x3c]
sub edx, dword [edi + 8]
mov eax, dword [esp + 0x14]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [esp + 0x178]
setle cl
xor edx, edx
cmp ecx, dword [eax + 4]
lea ecx, [esp + 0x178]
setge dl
sub edx, dword [edi + 4]
neg edx
sbb edx, edx
inc edx
mov dword [esp + 0x24], edx
mov dword [esp + 0x24], 8
call fcn.1001142d
dec dword [esp + 0xc]
cmp dword [esp + 0xc], 0xfffffff7
jle 0x10021926
or dword [esp + 0x3fc], 0xffffffff
lea ecx, [esp + 0x130]
call fcn.1001142d
xorps xmm0, xmm0
movdqu xmmword [esp + 0xd0], xmm0
mov dword [esp + 0xc], ebx
mov dword [esp + 0xc], ebx
jmp 0x10021a0d
mov dword [esp + 0x20], 0xb5a5
mov eax, dword [esp + 0xc]
mov dword [esp + 0x20], ebx
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10021a09
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileType]
dec dword [esp + 0xc]
cmp dword [esp + 0xc], 0xfffffff5
jge 0x100219e7
lea eax, [esp + 0x4c]
push eax
call fcn.10022e1a
push 1
lea ecx, [esp + 0x140]
mov edi, dword [eax]
mov eax, 0x469ad59e
mov dword [esp + 0xb4], eax
mov dword [esp + 0xb8], eax
mov dword [esp + 0xbc], eax
mov dword [esp + 0xc0], eax
mov dword [esp + 0x3c], edi
call fcn.10010e51
mov dword [esp + 0x3fc], 7
xor edx, edx
mov dword [esp + 0x28], 0xffffffff
inc edx
mov dword [esp + 0x28], 0xfffffff6
mov dword [esp + 0x14], ebx
jmp 0x10021a8a
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x118], 0xffffffff
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x10021a77
mov dword [esp + 0x14], ebx
jmp 0x10021aac
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x13c]
mov dword [eax + ecx*4], 0x8bea1220
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x10021a96
mov dword [esp + 0xb4], ebx
jmp 0x10021ad6
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10021acf
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
inc dword [esp + 0xb4]
cmp dword [esp + 0xb4], ebx
jle 0x10021abb
mov eax, dword [esp + 0x13c]
mov dword [eax], ebx
push esi
lea ecx, [esp + 0x1a8]
call fcn.10010e51
mov dword [esp + 0x18], 0x3c576436
mov dword [esp + 0x18], ebx
jmp 0x10021b19
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1a4]
mov dword [eax + ecx*4], 0xe3e45bbb
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jl 0x10021b03
cmp dword [esp + 0xb4], ebx
mov byte [esp + 0x13], bl
jne 0x10021b76
cmp byte [esp + 0x13], 0
je 0x10021b3e
push 0xace
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [esp + 0x18], ebx
cmp dword [esp + 0x18], ebx
jl 0x10021b8d
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10021b6e
push ebx
push 0xa0c
push 0x11d7
push 0x974
push 0x24dd
call dword [sym.imp.GDI32.dll_CreateBitmap]
dec dword [esp + 0x18]
jns 0x10021b48
jmp 0x10021b8d
cmp byte [esp + 0x13], 0
je 0x10021b8d
push 0x1d6b
push 0x232c
call dword [sym.imp.GDI32.dll_SetROP2]
lea ecx, [esp + 0x1a4]
call fcn.1001142d
mov eax, dword [esp + 0x13c]
inc dword [eax]
cmp dword [eax], esi
jle 0x10021ae8
or dword [esp + 0x3fc], 0xffffffff
lea ecx, [esp + 0x13c]
call fcn.1001142d
mov al, byte [ebp + 0xc]
test al, al
jne 0x10021bcd
test edi, edi
jne 0x100228a4
lea ecx, [esp + 0x250]
mov dl, al
push ecx
mov ecx, dword [esp + 0x50]
call fcn.10015944
cmp byte [ebp + 0xc], 0
lea edi, [esp + 0xd4]
mov esi, eax
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
je 0x10021c4a
cmp dword [esp + 0xd8], 0
je 0x10021c4a
mov dword [esp + 0x28], ebx
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10021c1a
push ebx
push 0x24c7
push ebx
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10021c2e
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov eax, dword [esp + 0xdc]
mov dword [esp + 0xe4], eax
mov eax, dword [esp + 0xd8]
mov dword [esp + 0xe8], eax
mov edi, dword [esp + 0x38]
test edi, edi
jne 0x100228a4
cmp dword [esp + 0xd0], edi
jle 0x100228a4
push 1
lea ecx, [esp + 0x1bc]
call fcn.10010e51
push 3
pop esi
mov dword [esp + 0x3fc], 8
lea ecx, [esp + 0x1e8]
mov dword [esp + 0xc], 0xfffffffa
push esi
call fcn.10010e51
mov byte [esp + 0x3fc], 9
lea eax, [esp + 0x208]
push dword [esp + 0x118]
movdqa xmm0, xmmword [0x1000e2d0]
lea ecx, [esp + 0x158]
push eax
lea eax, [esp + 0x200]
mov dword [esp + 0x30], 0x10aa43b2
push eax
push ebx
movdqu xmmword [esp + 0x208], xmm0
mov dword [esp + 0x164], ebx
mov dword [esp + 0x168], ebx
mov dword [esp + 0x16c], ebx
call fcn.10024590
mov byte [esp + 0x3fc], 0xa
mov dword [esp + 0x28], 0xa2e42846
mov dword [esp + 0x28], 0x4944c1a1
mov dword [esp + 0x28], 0x9052196d
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x14], ebx
jmp 0x10021d32
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1b8]
mov dword [eax + ecx*4], 0xb910
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 1
jl 0x10021d1c
mov dword [esp + 0x14], ebx
jmp 0x10021d55
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1e8]
mov dword [eax + ecx*4], 6
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x10021d3f
mov dword [esp + 0xc], ebx
cmp dword [esp + 0xc], ebx
jg 0x10021f40
mov dword [esp + 0x28], 0x88e1b61b
push 0xfffffffffffffff7
pop eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x28], 0x9d43467
mov dword [esp + 0x28], eax
mov dword [esp + 0x28], 2
mov dword [esp + 0x28], 0xfffffffe
mov dword [esp + 0x28], 0xe6bc044b
mov dword [esp + 0x28], 0x35fe
mov dword [esp + 0x20], 0x1962
cmp dword [esp + 0x20], 0xd4d
jge 0x10021ef7
lea eax, [esp + 0x60]
push eax
push 0x1000ddd4
call fcn.10058fc2
pop ecx
pop ecx
lea eax, [esp + 0x1b0]
mov dword [esp + 0x64], ebx
push eax
push dword [esp + 0x64]
xorps xmm0, xmm0
mov dword [esp + 0x70], ebx
lea ecx, [esp + 0x6c]
movlpd qword [esp + 0x1b8], xmm0
mov dword [esp + 0x74], ebx
call fcn.1002330a
mov eax, dword [esp + 0x60]
xorps xmm0, xmm0
movlpd qword [esp + 0x28], xmm0
mov esi, dword [esp + 0x2c]
movlpd qword [esp + 0xa8], xmm0
movlpd qword [esp + 0x40], xmm0
mov dword [esp + 0x20], ebx
test eax, eax
jle 0x10021e56
mov eax, dword [esp + 0x28]
mov edi, dword [esp + 0x64]
mov dword [esp + 0x18], eax
push edi
push 0x1000df54
call fcn.10058fc2
mov edx, dword [esp + 0x20]
add edx, dword [edi]
mov eax, dword [esp + 0x68]
adc esi, dword [edi + 4]
inc ebx
pop ecx
add edi, 8
mov dword [esp + 0x1c], edx
pop ecx
cmp ebx, eax
jl 0x10021e2c
xor ebx, ebx
jmp 0x10021e5e
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x18], ecx
mov edx, dword [esp + 0x44]
dec eax
mov edi, dword [esp + 0x40]
mov ecx, ebx
mov dword [esp + 0x20], eax
test eax, eax
jle 0x10021ecd
mov eax, dword [esp + 0xac]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0xa8]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x64]
mov ebx, dword [esp + 0x1c]
push 0
add ebx, dword [eax + ecx*8]
mov dword [esp + 0x20], ebx
mov ebx, dword [esp + 0x28]
adc ebx, dword [eax + ecx*8 + 4]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x38], ebx
shld dword [esp + 0x38], eax, 1
mov dword [esp + 0x28], ebx
add eax, eax
pop ebx
cmp eax, dword [esp + 0x18]
jne 0x10021ec6
cmp dword [esp + 0x34], esi
jne 0x10021ec6
add edi, 1
adc edx, ebx
inc ecx
cmp ecx, dword [esp + 0x20]
jl 0x10021e87
push edx
push edi
push 0x1000de1c
call fcn.10057526
mov eax, dword [esp + 0x70]
add esp, 0xc
test eax, eax
je 0x10021ef7
push eax
call fcn.10057697
pop ecx
mov dword [esp + 0x64], ebx
mov dword [esp + 0x68], ebx
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x24], 0x6851cc0d
mov dword [esp + 0x1c], 0xadf3
mov dword [esp + 0x18], ebx
jmp 0x10021f20
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x240], 1
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 4
jl 0x10021f0d
inc dword [esp + 0x24]
dec dword [esp + 0x1c]
inc dword [esp + 0xc]
cmp dword [esp + 0xc], ebx
jle 0x10021d69
push 3
pop esi
lea ecx, [esp + 0x154]
call fcn.1001142d
lea ecx, [esp + 0x1e8]
call fcn.1001142d
or dword [esp + 0x3fc], 0xffffffff
lea ecx, [esp + 0x1b8]
call fcn.1001142d
mov dword [esp + 0x14], 0x68ec0ae9
lea ecx, [esp + 0x1cc]
xor edi, edi
mov dword [esp + 0x24], 6
inc edi
mov dword [esp + 0xc], edi
mov dword [esp + 0x108], 9
mov dword [esp + 0x24], 0xf06702e6
mov dword [esp + 0x1c], 0xfffffff7
push 2
call fcn.10010e51
mov dword [esp + 0x3fc], 0xb
mov dword [esp + 0x28], 0xabee07f0
mov dword [esp + 0x28], 0x646d
mov dword [esp + 0x104], 7
mov dword [esp + 0x28], 0x3403
mov dword [esp + 0x18], ebx
jmp 0x10021ff6
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1cc]
mov dword [eax + ecx*4], 0xfffffff7
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jl 0x10021fe0
mov dword [esp + 0x14], 0x13
jmp 0x10022208
mov dword [esp + 0x1c], 0xffffffff
lea ecx, [esp + 0x16c]
mov dword [esp + 0x18], 0xeab3cf81
mov dword [esp + 0x3c], 0xfffffffe
mov dword [esp + 0x5c], esi
mov dword [esp + 0x40], 0xfffffff9
mov dword [esp + 0xa8], 0x2b783560
mov dword [esp + 0x40], 8
mov dword [esp + 0x20], 0x98ba832a
mov dword [esp + 0x40], 0x11140ae7
push esi
call fcn.10010e51
mov dword [esp + 0x34], 0xfa8e8b88
mov dword [esp + 0x40], ebx
mov dword [esp + 0xc], ebx
jmp 0x10022086
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x16c]
mov dword [eax + ecx*4], 0xfffffffc
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x10022070
mov dword [esp + 0xc], ebx
jmp 0x100220a5
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x228], 0x227f
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x10022092
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
add ecx, 7
mov dword [esp + 0x24], ecx
xor ecx, ecx
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x1c], 0xfff6
mov eax, dword [esp + 0x14]
add eax, dword [esp + 0x14]
cmp eax, 0x7c71
setle cl
xor edx, edx
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0xc]
cmp eax, ecx
mov eax, 0xffff
setl dl
sub edx, dword [esp + 0x108]
mov ecx, dword [esp + 0x1c]
neg edx
sbb edx, edx
inc edx
sub ecx, edx
neg ecx
sbb ecx, ecx
add ecx, 2
neg ecx
sbb ecx, ecx
inc ecx
sub eax, ecx
mov ecx, dword [esp + 0x14]
sub ecx, 0x5c7a
sub ecx, eax
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
mov dword [esp + 0x24], ecx
inc dword [esp + 0x34]
mov ecx, dword [esp + 0x5c]
mov eax, dword [esp + 0x18]
cmp eax, ecx
mov ecx, esi
setge dl
sub ecx, edx
xor edx, edx
imul ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x104]
cmp ecx, eax
mov eax, dword [esp + 0x16c]
setg dl
xor ecx, ecx
cmp edx, dword [eax]
mov eax, dword [esp + 0x1c]
setle cl
mov dword [esp + 0x5c], ecx
xor ecx, ecx
cmp dword [esp + 0x5c], eax
setg cl
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x34]
neg ecx
sbb ecx, ecx
add eax, 0x12
inc ecx
add eax, ecx
xor ecx, ecx
cmp eax, 0x7ccb
setne cl
cmp ecx, dword [esp + 0x20]
jne 0x100221b7
mov eax, edi
cmp dword [esp + 0x230], ebx
jne 0x100221b9
mov eax, ebx
mov ecx, dword [esp + 0x3c]
xor edx, edx
imul ecx, eax
mov eax, dword [esp + 0xa8]
cmp ecx, eax
setne dl
add edx, dword [esp + 0x24]
mov eax, dword [esp + 0x3c]
neg edx
sbb edx, edx
neg edx
add eax, edx
cmp eax, dword [esp + 0x40]
je 0x100221e8
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x16c]
mov eax, dword [esp + 0xc]
mov dword [esp + 0x20], 4
call fcn.1001142d
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0x16
jg 0x1002200a
xor eax, eax
mov dword [esp + 0xc], ebx
inc eax
jmp 0x1002222c
mov dword [esp + 0x28], 0xcbfbcc83
mov dword [esp + 0x24], eax
inc dword [esp + 0xc]
cmp dword [esp + 0xc], eax
jle 0x1002221c
or dword [esp + 0x3fc], 0xffffffff
lea ecx, [esp + 0x1cc]
call fcn.1001142d
mov dword [esp + 0x14], 0x420452a2
lea ecx, [esp + 0x160]
mov dword [esp + 0x34], 0xffffffff
push 1
call fcn.10010e51
mov dword [esp + 0x3fc], 0xc
mov dword [esp + 0xc], 0x1434a938
mov dword [esp + 0x20], 1
mov dword [esp + 0x1c], 8
mov dword [esp + 0x18], ebx
jmp 0x100222a3
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x160]
mov dword [eax + ecx*4], 0xbdae4f9d
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 1
jl 0x1002228d
mov dword [esp + 0x28], 0x202e
cmp dword [esp + 0x28], 0x874
jge 0x10022372
lea eax, [esp + 0x48]
push eax
push 0x1000ddc4
call fcn.10058fc2
mov eax, dword [esp + 0x50]
pop ecx
pop ecx
test eax, eax
je 0x1002236d
dec eax
mov dword [esp + 0x48], eax
lea eax, [esp + 0x74]
push eax
push 0x1000ddc4
call fcn.10058fc2
mov edx, dword [esp + 0x7c]
mov edi, ebx
pop ecx
pop ecx
xor ecx, ecx
mov esi, ebx
inc ecx
mov dword [esp + 0x24], ecx
test edx, edx
jle 0x10022349
mov ebx, ecx
lea eax, [esp + 0x84]
push eax
push 0x1000ddc4
call fcn.10058fc2
pop ecx
pop ecx
test edi, edi
jle 0x1002232f
xor eax, eax
movzx ebx, bl
cmp dword [esp + 0x84], edi
cmovne ebx, eax
mov edx, dword [esp + 0x74]
inc esi
mov edi, dword [esp + 0x84]
cmp esi, edx
jl 0x10022308
mov dword [esp + 0x24], ebx
xor ebx, ebx
mov ecx, dword [esp + 0x24]
xor eax, eax
inc eax
test cl, cl
cmovne eax, edx
push eax
push 0x1000ddd4
call fcn.10057526
mov eax, dword [esp + 0x50]
pop ecx
pop ecx
test eax, eax
jne 0x100222dd
push 3
pop esi
dec eax
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x14]
imul eax, dword [esp + 0x14], 0x7051
test eax, eax
je 0x10022391
mov eax, dword [esp + 0x34]
cmp dword [esp + 0x14], ebx
je 0x10022391
xor eax, eax
inc eax
jmp 0x10022393
mov eax, ebx
xor edx, edx
cmp eax, 0xd13
setg dl
sub edx, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
mov dword [esp + 0x14], ecx
xor ecx, ecx
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x160]
mov dword [eax], edx
mov eax, dword [esp + 0x34]
cmp edx, eax
setg cl
xor edx, edx
mov dword [esp + 0x34], ecx
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov dword [esp + 0xc], ebx
mov eax, dword [esp + 0xc]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
test eax, eax
setns dl
xor ecx, ecx
add edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
cmp edx, eax
setne cl
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], ebx
jmp 0x1002246e
push esi
lea ecx, [esp + 0x188]
call fcn.10010e51
mov dword [esp + 0x18], ebx
jmp 0x10022442
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x184]
mov dword [eax + ecx*4], 0x4f8d
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jl 0x1002242c
mov eax, dword [esp + 0x184]
lea ecx, [esp + 0x184]
mov eax, dword [eax + 4]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x1c], eax
call fcn.1001142d
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x10022419
or dword [esp + 0x3fc], 0xffffffff
lea ecx, [esp + 0x160]
call fcn.1001142d
cmp dword [esp + 0xd4], 0
je 0x100228a0
mov dword [esp + 0x1c], 0x83111738
lea ecx, [esp + 0x190]
push 4
call fcn.10010e51
mov dword [esp + 0x20], ebx
mov dword [esp + 0x34], 0x76acb8f2
mov dword [esp + 0x28], 0xa3062a4b
mov dword [esp + 0xc], ebx
jmp 0x100224dc
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x190]
mov dword [eax + ecx*4], 0x47bb7ab6
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 4
jl 0x100224c6
mov dword [esp + 0xc], ebx
jmp 0x100224fc
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x1c4], 0xfffffffa
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x100224e9
mov dword [esp + 0x20], 0xa9dade65
mov eax, dword [esp + 0x20]
mov dword [esp + 0x34], eax
cmp dword [esp + 0x34], ebx
je 0x10022524
cmp dword [esp + 0x1c], ebx
je 0x10022524
xor ecx, ecx
inc ecx
jmp 0x10022526
mov ecx, ebx
xor eax, eax
cmp ecx, 0xcae2fe81
lea ecx, [esp + 0x190]
setne al
mov dword [esp + 0x1c8], eax
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x34]
inc eax
mov dword [esp + 0x28], eax
call fcn.1001142d
mov ecx, dword [esp + 0xd4]
call fcn.100211fd
mov dword [esp + 0x28], 0x1b3b
cmp dword [esp + 0x28], 0xa94
mov dword [esp + 0x38], eax
jge 0x100225ec
lea eax, [esp + 0x90]
push eax
push 0x1000ddc0
call fcn.10058fc2
push 0xc51c
push 0xffffffffffffffff
push 0x10e0e650
call fcn.1002a7c8
xor edi, edi
add esp, 0x14
inc edi
cmp dword [esp + 0x90], edi
jl 0x100225ec
lea eax, [esp + 0x120]
push eax
push 0x1000ddc0
call fcn.10058fc2
mov ecx, dword [esp + 0x128]
xor edx, edx
push ebx
call fcn.10021262
add esp, 0xc
push eax
push 0x1000ddd0
call fcn.10057526
inc edi
pop ecx
pop ecx
cmp edi, dword [esp + 0x90]
jle 0x100225b1
mov eax, 0x469ad59e
lea ecx, [esp + 0x148]
mov dword [esp + 0xc0], eax
mov dword [esp + 0xc4], eax
mov dword [esp + 0xc8], eax
mov dword [esp + 0xcc], eax
push 1
call fcn.10010e51
mov dword [esp + 0x3fc], 0xd
xor edx, edx
mov dword [esp + 0x28], 0xffffffff
inc edx
mov dword [esp + 0x28], 0xfffffff6
mov dword [esp + 0xc], ebx
jmp 0x10022652
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x1f4], 0xffffffff
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jl 0x1002263f
mov dword [esp + 0xc], ebx
jmp 0x10022674
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x148]
mov dword [eax + ecx*4], 0x8bea1220
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jl 0x1002265e
mov dword [esp + 0xc4], ebx
jmp 0x1002269e
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10022697
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
inc dword [esp + 0xc4]
cmp dword [esp + 0xc4], ebx
jle 0x10022683
mov eax, dword [esp + 0x148]
mov dword [eax], ebx
push esi
lea ecx, [esp + 0x1e0]
call fcn.10010e51
mov byte [esp + 0x3fc], 0xe
mov dword [esp + 0x1c], 0x3c576436
mov dword [esp + 0x18], ebx
jmp 0x100226e9
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1dc]
mov dword [eax + ecx*4], 0xe3e45bbb
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jl 0x100226d3
cmp dword [esp + 0xc4], ebx
jne 0x1002274d
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1002270e
push 0xace
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [esp + 0x1c], ebx
cmp dword [esp + 0x1c], ebx
jl 0x10022830
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10022742
push ebx
push 0xa0c
push 0x11d7
push 0x974
push 0x24dd
call dword [sym.imp.GDI32.dll_CreateBitmap]
dec dword [esp + 0x1c]
jns 0x1002271c
jmp 0x10022830
mov dword [esp + 0x28], 0x19a5
cmp dword [esp + 0x28], 0x665
jge 0x10022815
lea eax, [esp + 0x50]
push eax
call fcn.100229ce
mov edx, dword [esp + 0x54]
mov ecx, dword [esp + 0x50]
push 2
pop edi
mov dword [esp + 0x1c], edi
call fcn.100720ff
push ecx
push ecx
movsd qword [esp], xmm0
call fcn.100577a4
fld1
faddp st(1)
fstp qword [esp + 0x30]
movsd xmm0, qword [esp + 0x30]
comisd xmm0, xmmword [0x1000e250]
jmp 0x100227f9
mov eax, edi
mov edi, dword [esp + 0x54]
cdq
push edx
push eax
push edi
push dword [esp + 0x5c]
call fcn.10071bf0
or eax, edx
mov ecx, dword [esp + 0x50]
je 0x1002287b
inc dword [esp + 0x1c]
mov edx, edi
call fcn.100720ff
push ecx
push ecx
movsd qword [esp], xmm0
call fcn.100577a4
mov edi, dword [esp + 0x24]
fld1
faddp st(1)
movd xmm1, edi
cvtdq2pd xmm1, xmm1
fstp qword [esp + 0x30]
movsd xmm0, qword [esp + 0x30]
comisd xmm0, xmm1
pop ecx
pop ecx
ja 0x100227a5
xor eax, eax
mov edx, ebx
inc eax
push edx
push eax
mov ecx, 0x10662c58
call fcn.10010d2f
push eax
call fcn.100145fe
pop ecx
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10022830
push 0x1d6b
push 0x232c
call dword [sym.imp.GDI32.dll_SetROP2]
lea ecx, [esp + 0x1dc]
mov byte [esp + 0x3fc], 0xd
call fcn.1001142d
mov eax, dword [esp + 0x148]
inc dword [eax]
cmp dword [eax], esi
jle 0x100226b0
or dword [esp + 0x3fc], 0xffffffff
lea ecx, [esp + 0x148]
call fcn.1001142d
lea eax, [esp + 0x4c]
push eax
call fcn.10022e1a
mov edi, dword [esp + 0x38]
mov dword [eax], edi
jmp 0x100228a4
mov eax, dword [esp + 0x1c]
cdq
sub ecx, eax
push ebx
sbb edi, edx
mov dword [esp + 0x54], ecx
push 2
push edi
push ecx
mov dword [esp + 0x64], edi
call fcn.10071b40
add eax, 1
adc edx, ebx
jmp 0x10022802
mov edi, dword [esp + 0x38]
mov dword [esp + 0xc], 0x62d5e48d
mov dword [esp + 0x28], 0x822e6e7f
mov dword [esp + 0xc], ebx
jmp 0x100228e7
mov dword [esp + 0x18], 0x665683c8
mov dword [esp + 0x18], ebx
jmp 0x100228dc
mov dword [esp + 0x28], 0xffffffff
mov eax, dword [esp + 0x28]
mov dword [esp + 0x28], eax
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0x16
jne 0x100228c8
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 0x14
jge 0x100228ba
lea ecx, [esp + 0xd0]
call fcn.1001cb10
mov dword [esp + 0xc], ebx
mov dword [esp + 0x20], ebx
mov eax, dword [esp + 0xc]
sub eax, dword [esp + 0xc]
add eax, dword [esp + 0xc]
mov dword [esp + 0x20], eax
mov dword [esp + 0xc], 0xfffffffa
jmp 0x1002295d
mov dword [esp + 0x28], 0x9edbda7f
xor ecx, ecx
mov dword [esp + 0x20], 1
mov dword [esp + 0x3c], 0x33582f80
mov eax, dword [esp + 0x28]
mov dword [esp + 0x20], eax
mov dword [esp + 0x3c], ebx
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x3c]
add edx, 0xfff7
cmp edx, eax
setl cl
mov dword [esp + 0x20], ecx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 7
je 0x1002291c
test edi, edi
je 0x1002298b
mov edx, dword [esp + 0x11c]
mov ecx, edi
call fcn.10021258
mov esi, eax
lea eax, [esp + 0x78]
push eax
mov dword [esp + 0xe4], esi
call fcn.10022db8
mov dword [eax], esi
mov eax, dword [ebp + 8]
lea esi, [esp + 0xe0]
mov ecx, dword [esp + 0x3f4]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret