Function at 0x10011981
Capabilities:
Compare security identifiers
Log keystrokes
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10059e4a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2f8
mov dword [esp + 0x44], ecx
mov dword [esp + 0x1c], 0x4e1a3622
mov dword [esp + 0x1c], 0x3cdf98a5
mov dword [esp + 0x1c], 0x3efc07e1
push ebx
mov dword [esp + 0x20], 0x9c3fbb4
xor ebx, ebx
mov dword [esp + 0x20], 0x8ce3e63e
push esi
mov dword [esp + 0x20], 0xffffffff
push edi
mov dword [esp + 0x38], edx
mov dword [esp + 0x10], ebx
jmp 0x100119f8
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x2a0], 0xfffffffa
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x100119e5
dec dword [esp + 0x24]
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], bl
je 0x10011a19
push ebx
push 0xe4
call dword [sym.imp.USER32.dll_GetWindowInfo]
mov dword [esp + 0x14], 1
lea ecx, [esp + 0x158]
mov dword [esp + 0x24], 0x5196ee4e
push 3
call fcn.10013d69
mov dword [esp + 0x10], ebx
jmp 0x10011a50
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x158]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x10011a3d
imul ecx, dword [esp + 0x14], 0x9d22
xor edx, edx
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x158]
cmp ecx, eax
setge dl
xor ecx, ecx
mov dword [esp + 0x24], edx
mov eax, dword [esp + 0x24]
cmp eax, 0xb2c5
mov eax, dword [esp + 0x14]
setge cl
xor edx, edx
cmp eax, ecx
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x14]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x14]
setg cl
sub esi, ecx
neg esi
sbb esi, esi
xor edx, edx
inc esi
cmp esi, eax
setl dl
xor ecx, ecx
sub edx, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
cmp eax, edx
setg cl
cmp ecx, dword [edi + 8]
jne 0x10011acc
mov eax, dword [esp + 0x14]
mov dword [edi + 8], eax
jmp 0x10011ae8
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], bl
je 0x10011ae8
push ebx
push 0x266b
push ebx
push 0x8ad
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
push dword [esp + 0x158]
call fcn.10040fec
mov eax, dword [0x108051f0]
mov dword [esp + 0x15c], ebx
mov dword [esp + 0x160], ebx
mov dword [esp + 0x164], ebx
pop ecx
test al, 1
jne 0x10011bad
or eax, 1
mov dword [0x108051f0], eax
push ebx
mov dword [esp + 0x310], ebx
push ebx
mov dword [0x108051a0], ebx
mov dword [0x108051a4], ebx
call fcn.100180a1
mov dword [0x108051a0], eax
mov dword [0x108051a8], ebx
mov dword [0x108051b0], ebx
mov byte [esp + 0x30c], 2
mov ecx, 0x108051a8
mov dword [esp + 0x1b4], eax
lea eax, [esp + 0x1b4]
push eax
push 0x10
push ebx
lea eax, [esp + 0xf0]
mov dword [0x108051bc], 0x3f800000
push eax
mov dword [0x108051ac], ebx
call fcn.10017e79
push 0x1005ad3f
mov dword [0x108051b4], 7
mov dword [0x108051b8], 8
call fcn.10040bd9
or dword [esp + 0x310], 0xffffffff
pop ecx
push dword [esp + 0xe4]
movdqa xmm0, xmmword [0x10008030]
lea eax, [esp + 0x254]
push eax
lea eax, [esp + 0x248]
mov dword [esp + 0x5c], ebx
push eax
push ebx
lea ecx, [esp + 0x64]
mov dword [esp + 0x68], ebx
movdqu xmmword [esp + 0x250], xmm0
mov dword [esp + 0x6c], ebx
call fcn.10019201
mov dword [esp + 0x2c], 0xd444182b
mov dword [esp + 0x24], 0x17ca4e86
mov dword [esp + 0x28], ebx
push 3
mov dword [esp + 0x30], ebx
pop edi
cmp dword [esp + 0x2c], edi
jg 0x10011cc8
mov edi, dword [esp + 0x54]
xor ecx, ecx
inc ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x10], ebx
jmp 0x10011c30
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0xb8], ecx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ecx
jl 0x10011c21
mov eax, dword [esp + 0x2c]
mov edx, 0xf0488f4f
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x54]
push 0
cmp edx, dword [eax + ecx*4]
sbb eax, eax
neg eax
mov dword [esp + 0x28], eax
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x58]
cmp dword [ecx + edx*4], eax
pop eax
setg al
mov dword [esp + 0xb8], eax
mov dword [esp + 0x24], eax
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x54]
mov eax, dword [esp + 0x24]
add eax, dword [ecx + edx*4]
cmp eax, dword [edi + 0xc]
jle 0x10011c98
cmp dword [esp + 0xb8], ebx
je 0x10011c98
xor esi, esi
inc esi
jmp 0x10011c9a
mov esi, ebx
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x54]
push 0
cmp esi, dword [eax + ecx*4]
pop ecx
sete cl
sub ecx, dword [eax + edx*4]
mov dword [esp + 0x28], ecx
inc dword [esp + 0x2c]
cmp dword [esp + 0x2c], 3
jle 0x10011c14
push 3
pop edi
cmp dword [esp + 0x54], 0
je 0x10011ce5
push dword [esp + 0x54]
call fcn.10040fec
pop ecx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x5c], ebx
imul eax, dword [esp + 0x50], 0x2710
lea ecx, [esp + 0xd0]
push 1
add eax, dword [esp + 0x3c]
mov dword [esp + 0xcc], eax
call fcn.10013d69
mov dword [esp + 0x30c], edi
lea ecx, [esp + 0x1f0]
mov dword [esp + 0x30], ebx
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x24], 0x9f21c9b6
push 2
call fcn.10013d69
mov dword [esp + 0x28], 0x481d3efe
mov dword [esp + 0x1c], ebx
jmp 0x10011d53
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0xd0]
mov dword [eax + ecx*4], 0xfffffffb
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 1
jl 0x10011d3d
mov dword [esp + 0x1c], ebx
jmp 0x10011d76
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x1f0]
mov dword [eax + ecx*4], 0xa30b9130
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jl 0x10011d60
mov eax, dword [esp + 0xd0]
xor edx, edx
mov eax, dword [eax]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x30]
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0xd0]
cmp ecx, dword [eax]
setle dl
mov dword [esp + 0x24], edx
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0xd0]
cmp dword [eax], ebx
jne 0x10011dc9
cmp dword [esp + 0x20], ebx
jne 0x10011dc9
mov ecx, ebx
jmp 0x10011dcc
xor ecx, ecx
inc ecx
mov eax, dword [esp + 0x1f0]
push eax
mov dword [eax + 4], ecx
mov dword [esp + 0x2c], ecx
call fcn.10040fec
or dword [esp + 0x310], 0xffffffff
pop ecx
push dword [esp + 0xd0]
mov dword [esp + 0x1f4], ebx
mov dword [esp + 0x1f8], ebx
mov dword [esp + 0x1fc], ebx
call fcn.10040fec
pop ecx
lea eax, [esp + 0xc8]
mov dword [esp + 0xd0], ebx
push eax
mov dword [esp + 0xd8], ebx
mov dword [esp + 0xdc], ebx
call fcn.10013f9e
push 2
lea ecx, [esp + 0x144]
mov esi, dword [eax]
mov dword [esp + 0x18], 0x399841b3
mov dword [esp + 0x2c], 7
mov dword [esp + 0x2c], 0x16efa42b
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x2c], 0xb49d585e
mov dword [esp + 0x2c], 0xd5a519d8
call fcn.10013d69
mov dword [esp + 0x28], 1
mov dword [esp + 0x10], ebx
jmp 0x10011e91
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x140]
mov dword [eax + ecx*4], 0x7383cc4
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x10011e7b
mov dword [esp + 0x14], 0xffffffe8
jmp 0x10011edd
mov dword [esp + 0x28], 0x69f7
mov dword [esp + 0x28], ebx
mov dword [esp + 0x28], 0x3843046b
mov dword [esp + 0x24], edi
mov dword [esp + 0x10], ebx
jmp 0x10011ecf
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x294], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x10011ec0
dec dword [esp + 0x24]
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0xf
jg 0x10011ea2
cmp dword [esp + 0x140], 0
je 0x10011f10
push dword [esp + 0x140]
call fcn.10040fec
pop ecx
mov dword [esp + 0x140], ebx
mov dword [esp + 0x144], ebx
mov dword [esp + 0x148], ebx
test esi, esi
je 0x10012037
push 2
lea ecx, [esp + 0x1ac]
call fcn.10013d69
mov dword [esp + 0x1c], ebx
jmp 0x10011f3f
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x1c4], 0xfffffffe
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 1
jl 0x10011f2c
mov dword [esp + 0x1c], ebx
jmp 0x10011f62
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x1a8]
mov dword [eax + ecx*4], 0xb58e469a
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jl 0x10011f4c
mov ecx, dword [esp + 0x1a8]
mov dword [ecx + 4], ebx
mov eax, dword [ecx + 4]
inc dword [ecx + 4]
cmp dword [ecx + 4], 1
mov dword [esp + eax*4 + 0x1c4], 0xd95e17ca
jl 0x10011f73
push ecx
call fcn.10040fec
mov dword [esp + 0x1ac], ebx
mov dword [esp + 0x1b0], ebx
mov dword [esp + 0x1b4], ebx
mov dword [esp + 0x20], 0x1c76
mov dword [esp + 0x14], 0xfffe
pop ecx
mov dword [esp + 0x200], esi
mov dword [esp + 0x14], ebx
jmp 0x10011fd3
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x6c], 0x923ccde6
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 1
jl 0x10011fc3
cmp dword [esp + 0x1c], 0xbe7e5505
ja 0x10011ff0
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x1c], ebx
jmp 0x1001202c
mov eax, dword [esp + 0x1c]
cmp dword [esp + eax*4 + 0x6c], ebx
jne 0x1001370a
mov dword [esp + 0x10], ebx
jmp 0x10012022
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + eax*4 + 0x6c]
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x6c], ecx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ebx
jle 0x1001200e
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], ebx
jle 0x10011ffa
jmp 0x1001370a
push 1
lea ecx, [esp + 0x64]
call fcn.10013d69
mov dword [esp + 0x30c], 4
lea eax, [esp + 0x260]
push dword [esp + 0xe4]
movdqa xmm0, xmmword [0x10008030]
lea ecx, [esp + 0xa4]
push eax
lea eax, [esp + 0x258]
mov dword [esp + 0x18], 0xffffffff
push eax
push ebx
movdqu xmmword [esp + 0x260], xmm0
mov dword [esp + 0xb0], ebx
mov dword [esp + 0xb4], ebx
mov dword [esp + 0xb8], ebx
call fcn.10019201
mov byte [esp + 0x30c], 5
mov dword [esp + 0x1c], ebx
jmp 0x100120c0
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x60]
mov dword [eax + ecx*4], 0xfffb
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 1
jl 0x100120ad
mov dword [esp + 0x1c], ebx
jmp 0x100120dd
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x3c], 0xffffffff
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edi
jl 0x100120cd
mov dword [esp + 0x40], ebx
jmp 0x10012300
push 1
lea ecx, [esp + 0x8c]
call fcn.10013d69
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x1c], ebx
jmp 0x10012126
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x88]
mov dword [eax + ecx*4], 0xfffffffc
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 1
jl 0x10012110
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x60]
cmp dword [eax + ecx*4], ebx
jne 0x1001214b
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x60]
cmp dword [eax + ecx*4], ebx
jne 0x1001214b
mov ecx, ebx
jmp 0x1001214e
xor ecx, ecx
inc ecx
mov eax, dword [esp + 0x88]
neg ecx
mov dword [eax], ecx
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x60]
mov eax, dword [edx + eax*4]
mov dword [edx + ecx*4], eax
cmp dword [edx], ebx
je 0x1001219a
mov eax, dword [esp + 0x10]
xor edx, edx
mov eax, dword [esp + 0x88]
mov ecx, dword [esp + 0x40]
mov esi, dword [esp + 0x40]
mov dword [eax], ebx
mov eax, dword [esp + 0x60]
cmp dword [eax + ecx*4], ebx
setg dl
cmp edx, dword [eax + esi*4]
jg 0x1001219a
xor eax, eax
inc eax
jmp 0x1001219c
mov eax, ebx
add eax, 0x4562
cmp eax, dword [esp + 0x40]
jle 0x10012221
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x10], ebx
jl 0x100122da
mov dword [esp + 0x14], 0x234ac019
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x88]
cmp dword [eax + ecx*4], ebx
jne 0x100122da
mov dword [esp + 0x14], ebx
jmp 0x10012210
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x60]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001220c
push 0x190e
push ebx
push ebx
push 0xeb4
push ebx
push 0x1fed
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ebx
jle 0x100121d7
dec dword [esp + 0x10]
jns 0x100121b5
jmp 0x100122da
mov dword [esp + 0x20], 0xffffffff
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x40]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x40]
mov eax, dword [esp + 0x40]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x40]
dec ecx
neg ecx
sbb ecx, ecx
xor eax, eax
neg ecx
cmp ecx, 8
setne al
xor ecx, ecx
cmp eax, 7
setle cl
xor eax, eax
cmp ecx, 8
setg al
mov dword [esp + 0x10], eax
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x10], ebx
jg 0x100122da
mov edx, dword [esp + 0xa0]
mov dword [esp + 0x24], 0xfffffffd
mov eax, dword [esp + 0x40]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x40]
mov eax, dword [esp + 0x40]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x88]
mov dword [eax], ebx
mov dword [edx + 8], ebx
mov dword [esp + 0x14], ebx
jmp 0x100122c9
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x88]
mov dword [eax + ecx*4], 8
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 1
jl 0x100122b3
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ebx
jle 0x1001227d
push dword [esp + 0x88]
call fcn.10040fec
mov dword [esp + 0x8c], ebx
mov dword [esp + 0x90], ebx
mov dword [esp + 0x94], ebx
inc dword [esp + 0x44]
pop ecx
cmp dword [esp + 0x40], ebx
jle 0x100120ec
cmp dword [esp + 0xa0], 0
je 0x10012336
push dword [esp + 0xa0]
call fcn.10040fec
pop ecx
mov dword [esp + 0xa0], ebx
mov dword [esp + 0xa4], ebx
mov dword [esp + 0xa8], ebx
or dword [esp + 0x30c], 0xffffffff
cmp dword [esp + 0x60], 0
je 0x1001235b
push dword [esp + 0x60]
call fcn.10040fec
pop ecx
mov dword [esp + 0x60], ebx
mov dword [esp + 0x64], ebx
mov dword [esp + 0x68], ebx
mov eax, dword [0x108051f0]
test al, 2
jne 0x10012402
or eax, 2
mov dword [0x108051f0], eax
push ebx
mov dword [esp + 0x310], 6
push ebx
mov dword [0x108051c0], ebx
mov dword [0x108051c4], ebx
call fcn.100180a1
mov dword [0x108051c0], eax
mov dword [0x108051c8], ebx
mov dword [0x108051d0], ebx
mov byte [esp + 0x30c], 8
mov ecx, 0x108051c8
mov dword [esp + 0x1fc], eax
lea eax, [esp + 0x1fc]
push eax
push 0x10
push ebx
lea eax, [esp + 0x1ac]
mov dword [0x108051dc], 0x3f800000
push eax
mov dword [0x108051cc], ebx
call fcn.10017e79
push 0x1005ad3a
mov dword [0x108051d4], 7
mov dword [0x108051d8], 8
call fcn.10040bd9
or dword [esp + 0x310], 0xffffffff
pop ecx
mov edi, 0xf7e2799a
mov dword [esp + 0x124], edi
mov dword [esp + 0x128], edi
mov dword [esp + 0x12c], edi
mov dword [esp + 0x130], edi
mov dword [esp + 0x14], 0x4bae0fc3
mov dword [esp + 0x10], ebx
jmp 0x10012444
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x2c0], 9
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x10012431
mov dword [esp + 0x12c], 8
jmp 0x100124c9
push 2
lea ecx, [esp + 0x1d8]
call fcn.10013d69
mov dword [esp + 0x28], 0xfffffff8
mov dword [esp + 0x28], 0xfffffff9
mov dword [esp + 0x10], ebx
jmp 0x10012492
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x1d4]
mov dword [eax + ecx*4], 0x5b7cefa9
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1001247c
mov eax, dword [esp + 0x1d4]
push eax
mov dword [eax], 0xffffffef
call fcn.10040fec
mov dword [esp + 0x1d8], ebx
mov dword [esp + 0x1dc], ebx
mov dword [esp + 0x1e0], ebx
dec dword [esp + 0x130]
pop ecx
cmp dword [esp + 0x12c], 0xffffffed
jne 0x10012458
push 3
xor esi, esi
mov dword [esp + 0x18], ebx
pop ecx
inc esi
cmp dword [esp + 0x14], ecx
jg 0x1001256b
mov dword [esp + 0x10], esi
mov dword [esp + 0x10], ecx
cmp dword [esp + 0x10], ebx
jl 0x10012562
mov dword [esp + 0x20], 0xfbde283b
mov dword [esp + 0x20], ecx
cmp dword [esp + 0x20], ebx
jl 0x1001255c
push 0xfffffffffffffffb
pop eax
mov dword [esp + 0x164], eax
mov dword [esp + 0x168], eax
mov dword [esp + 0x16c], eax
mov dword [esp + 0x170], eax
mov dword [esp + 0x164], ebx
cmp dword [esp + 0x164], ecx
jg 0x10012556
mov eax, dword [esp + 0x10]
cmp dword [esp + eax*4 + 0x124], ebx
jne 0x10012553
inc dword [esp + 0x164]
cmp dword [esp + 0x164], ecx
jle 0x10012536
push 0xfffffffffffffffb
pop eax
dec dword [esp + 0x20]
jns 0x1001250a
dec dword [esp + 0x10]
jns 0x100124f5
inc dword [esp + 0x14]
jmp 0x100124dd
xorps xmm0, xmm0
movdqu xmmword [esp + 0x174], xmm0
mov dword [esp + 0x114], edi
mov dword [esp + 0x118], edi
mov dword [esp + 0x11c], edi
mov dword [esp + 0x120], edi
mov dword [esp + 0x14], 0x4bae0fc3
mov dword [esp + 0x10], ebx
jmp 0x100125b4
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x2e0], 9
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x100125a1
mov dword [esp + 0x11c], 8
jmp 0x10012639
push 2
lea ecx, [esp + 0x1bc]
call fcn.10013d69
mov dword [esp + 0x28], 0xfffffff8
mov dword [esp + 0x28], 0xfffffff9
mov dword [esp + 0x10], ebx
jmp 0x10012602
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x1b8]
mov dword [eax + ecx*4], 0x5b7cefa9
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x100125ec
mov eax, dword [esp + 0x1b8]
push eax
mov dword [eax], 0xffffffef
call fcn.10040fec
mov dword [esp + 0x1bc], ebx
mov dword [esp + 0x1c0], ebx
mov dword [esp + 0x1c4], ebx
dec dword [esp + 0x120]
pop ecx
cmp dword [esp + 0x11c], 0xffffffed
jne 0x100125c8
push 3
mov dword [esp + 0x18], ebx
pop edi
jmp 0x100126cb
mov dword [esp + 0x10], esi
mov dword [esp + 0x10], edi
cmp dword [esp + 0x10], ebx
jl 0x100126c7
mov dword [esp + 0x20], 0xfbde283b
mov dword [esp + 0x20], edi
cmp dword [esp + 0x20], ebx
jl 0x100126c1
push 0xfffffffffffffffb
pop eax
mov dword [esp + 0x184], eax
mov dword [esp + 0x188], eax
mov dword [esp + 0x18c], eax
mov dword [esp + 0x190], eax
mov dword [esp + 0x184], ebx
cmp dword [esp + 0x184], edi
jg 0x100126bb
mov eax, dword [esp + 0x10]
cmp dword [esp + eax*4 + 0x114], ebx
jne 0x100126b8
inc dword [esp + 0x184]
cmp dword [esp + 0x184], edi
jle 0x1001269b
push 0xfffffffffffffffb
pop eax
dec dword [esp + 0x20]
jns 0x1001266f
dec dword [esp + 0x10]
jns 0x1001265a
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jle 0x1001264c
lea eax, [esp + 0x50]
push eax
call fcn.10014000
cmp byte [ebp + 0xc], 0
mov eax, dword [eax]
mov dword [esp + 0x28], eax
jne 0x100126f3
test eax, eax
jne 0x10012ae8
mov dword [esp + 0x20], 0x256
lea ecx, [esp + 0x108]
mov dword [esp + 0x24], 0x6951ad38
push esi
call fcn.10013d69
mov dword [esp + 0x10], 0x1d1b
mov dword [esp + 0x14], ebx
jmp 0x10012731
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x108]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 1
jl 0x1001271e
dec dword [esp + 0x10]
mov dword [esp + 0x20], 0xc
cmp dword [esp + 0x20], ebx
jge 0x100127a9
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001276f
push 0x1d96
push 0x1340
push 0x1d6
push 0x17a
call dword [sym.imp.USER32.dll_CheckRadioButton]
mov dword [esp + 0x10], 0xfffffff7
jmp 0x1001279c
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001278b
push ebx
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
mov eax, dword [esp + 0x108]
mov dword [eax], 4
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x22
jle 0x10012779
dec dword [esp + 0x20]
js 0x1001274a
cmp dword [esp + 0x108], 0
je 0x100127d5
push dword [esp + 0x108]
call fcn.10040fec
pop ecx
mov dword [esp + 0x108], ebx
mov dword [esp + 0x10c], ebx
mov dword [esp + 0x110], ebx
mov dl, byte [ebp + 0xc]
lea eax, [esp + 0x2b0]
mov ecx, dword [esp + 0x50]
push eax
call fcn.100098a8
mov esi, eax
lea edi, [esp + 0x178]
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [esp + 0x24], 0x4e1a3622
mov dword [esp + 0x24], 0x3cdf98a5
mov dword [esp + 0x24], 0x3efc07e1
mov dword [esp + 0x24], 0x9c3fbb4
mov dword [esp + 0x24], 0x21b2
cmp dword [esp + 0x24], 0x1205
jge 0x10012956
lea eax, [esp + 0x4c]
push eax
push 0x10007800
call fcn.100405bb
mov esi, dword [esp + 0x54]
xor edi, edi
inc edi
pop ecx
pop ecx
cmp esi, edi
jle 0x100128a5
lea eax, [esp + 0x104]
push eax
lea eax, [esp + 0xc4]
push eax
push 0x10007848
call fcn.100405bb
imul ecx, dword [esp + 0xcc], 0xc
lea eax, [esp + 0x110]
add esp, 0xc
push eax
add ecx, 0x10804878
call fcn.10013e87
imul ecx, dword [esp + 0x104], 0xc
lea eax, [esp + 0xc0]
push eax
add ecx, 0x10804878
call fcn.10013e87
mov esi, dword [esp + 0x4c]
inc edi
cmp edi, esi
jl 0x10012849
xor ecx, ecx
mov dword [0x1064ca60], ebx
xor edx, edx
inc ecx
call fcn.10011850
mov dword [esp + 0x24], ebx
test esi, esi
jle 0x10012956
lea eax, [esp + 0xcc]
push eax
push 0x10007800
call fcn.100405bb
mov eax, dword [esp + 0xd4]
xor edx, edx
xor ecx, ecx
push dword [eax*4 + 0x1064caa0]
mov eax, dword [esp + 0x58]
push ebx
lea eax, [eax*2 - 1]
push eax
call fcn.100118b6
add esp, 0x14
push eax
push 0x10007850
call fcn.10040c03
mov edi, dword [esp + 0xd4]
xor edx, edx
mov esi, dword [esp + 0x54]
xor ecx, ecx
push 1
push dword [edi*4 + 0x1064caa0]
lea esi, [esi*2 - 1]
push esi
call fcn.10011928
add esp, 0x14
xor edx, edx
xor ecx, ecx
push 0xffffffffffffffff
push dword [edi*4 + 0x1064d550]
push esi
call fcn.10011928
mov eax, dword [esp + 0x30]
add esp, 0xc
inc eax
mov dword [esp + 0x24], eax
cmp eax, dword [esp + 0x4c]
jl 0x100128c1
mov dword [esp + 0x24], 0x8ce3e63e
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x10], ebx
jmp 0x1001297f
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x2d0], 0xfffffffa
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x1001296c
dec dword [esp + 0x24]
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x100129a1
push ebx
push 0xe4
call dword [sym.imp.USER32.dll_GetWindowInfo]
cmp byte [ebp + 0xc], 0
push 3
pop edi
je 0x10012ae8
cmp dword [esp + 0x17c], 0
je 0x10012ae8
mov eax, dword [esp + 0x180]
mov dword [esp + 0x14], 0xe1757117
mov dword [esp + 0x24], 0x147909b7
mov dword [esp + 0x24], 0xc781ced8
mov dword [esp + 0x24], 1
mov dword [esp + 0x30], 0x819d3388
mov dword [esp + 0x20], 0xd21b1857
mov dword [esp + 0x24], 0x6c34f1d4
mov dword [esp + 0x204], eax
mov dword [esp + 0x10], ebx
jmp 0x10012a1b
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x26c], 0x4a61bf07
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x10012a08
mov dword [esp + 0x14], 0xc
jmp 0x10012acf
mov dword [esp + 0x24], ebx
lea ecx, [esp + 0x70]
mov dword [esp + 0x20], 0x1a4d63a8
mov dword [esp + 0x20], 1
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x10], 0x3895196e
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0x10], 9
push edi
call fcn.10013d69
mov dword [esp + 0x10], ebx
jmp 0x10012a85
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x70]
mov dword [eax + ecx*4], 0xa2b441a6
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x10012a72
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x30]
inc dword [esp + 0x30]
mov eax, dword [esp + 0x274]
mov dword [esp + 0x20], 1
cmp dword [esp + 0x24], ebx
cmp dword [esp + 0x70], 0
je 0x10012acb
push dword [esp + 0x70]
call fcn.10040fec
mov dword [esp + 0x7c], ebx
mov dword [esp + 0x78], ebx
mov dword [esp + 0x74], ebx
pop ecx
dec dword [esp + 0x14]
cmp dword [esp + 0x14], 0xfffffffa
jl 0x10012a2e
mov eax, dword [esp + 0x17c]
mov dword [esp + 0x208], eax
push dword [esp + 0x1a0]
movdqa xmm0, xmmword [0x10008050]
lea eax, [esp + 0x244]
push eax
lea eax, [esp + 0x238]
mov dword [esp + 0x18], 0x57976326
push eax
push ebx
lea ecx, [esp + 0xf8]
mov dword [esp + 0xf8], ebx
movdqu xmmword [esp + 0x240], xmm0
mov dword [esp + 0xfc], ebx
mov dword [esp + 0x100], ebx
call fcn.10019201
cmp dword [esp + 0x10], ebx
je 0x10012b52
mov dword [esp + 0x24], 1
mov eax, dword [esp + 0x10]
mov dword [esp + 0x24], eax
jmp 0x10012b7a
mov dword [esp + 0x10], ebx
jmp 0x10012b74
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10012b70
push ebx
push 0x1a1c
push ebx
call dword [sym.imp.GDI32.dll_GetMetaFileBitsEx]
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jle 0x10012b58
cmp dword [esp + 0xe8], 0
je 0x10012ba6
push dword [esp + 0xe8]
call fcn.10040fec
pop ecx
mov dword [esp + 0xe8], ebx
mov dword [esp + 0xec], ebx
mov dword [esp + 0xf0], ebx
mov dword [esp + 0x24], 0x24dc
cmp dword [esp + 0x24], 0xaac
jge 0x10012c9f
lea eax, [esp + 0xdc]
push eax
lea eax, [esp + 0x4c]
push eax
push 0x10007840
call fcn.100405bb
add esp, 0xc
lea ecx, [esp + 0x14c]
push dword [esp + 0x48]
call fcn.10013d69
mov edi, ebx
mov dword [esp + 0x30c], 9
cmp dword [esp + 0x48], edi
jle 0x10012c17
mov esi, dword [esp + 0x14c]
push esi
push 0x10007804
call fcn.100405bb
inc edi
add esi, 4
pop ecx
pop ecx
cmp edi, dword [esp + 0x48]
jl 0x10012c00
push dword [esp + 0x150]
mov esi, dword [esp + 0x150]
push esi
call fcn.100186df
mov edi, dword [esi]
pop ecx
pop ecx
mov ecx, ebx
mov byte [esp + 0x1b], 1
cmp dword [esp + 0x48], ecx
jle 0x10012c6e
mov eax, dword [esi + ecx*4]
cdq
idiv edi
cmp edx, dword [esp + 0xdc]
jle 0x10012c5f
mov byte [esp + 0x1b], bl
mov eax, dword [esi + ecx*4]
dec edi
cdq
idiv edi
cmp edx, dword [esp + 0xdc]
jg 0x10012c4f
inc ecx
cmp ecx, dword [esp + 0x48]
jl 0x10012c3c
mov al, byte [esp + 0x1b]
test al, al
je 0x10012c2f
push edi
push 0x10007838
call fcn.10040c03
or dword [esp + 0x314], 0xffffffff
push esi
call fcn.10040fec
add esp, 0xc
mov dword [esp + 0x14c], ebx
mov dword [esp + 0x150], ebx
mov dword [esp + 0x154], ebx
mov esi, dword [esp + 0x28]
test esi, esi
jne 0x10013354
cmp dword [esp + 0x174], esi
jle 0x10013354
mov dword [esp + 0x1c], 1
lea ecx, [esp + 0x7c]
mov dword [esp + 0x2c], 0x4e5a945c
push 2
call fcn.10013d69
mov dword [esp + 0x30c], 0xa
mov dword [esp + 0x10], ebx
jmp 0x10012cf7
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x7c]
mov dword [eax + ecx*4], 0xd2a6f9a4
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x10012ce4
mov dword [esp + 0x1c], ebx
jmp 0x10012f4d
mov dword [esp + 0x14], 0xab60e704
mov dword [esp + 0x10], 0xc86992f1
mov dword [esp + 0x24], 0xfffffff7
mov eax, dword [esp + 0x14]
cmp eax, 0xb9c2
setne cl
mov dword [esp + 0x2c], ecx
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x10], 0x9c44d4e2
mov dword [esp + 0x14], 1
cmp dword [esp + 0x14], ebx
jl 0x10012f49
push 2
lea ecx, [esp + 0xfc]
call fcn.10013d69
mov byte [esp + 0x30c], 0xb
mov dword [esp + 0x10], ebx
jmp 0x10012da7
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xf8]
mov dword [eax + ecx*4], 0x37280dda
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x10012d91
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10012dca
push ebx
push 0x7da
push 0x433
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov dword [esp + 0x2c], ebx
jmp 0x10012f00
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10012deb
push 0xfb
push ebx
push ebx
call dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
mov dword [esp + 0x10], 1
cmp dword [esp + 0x10], ebx
jl 0x10012efc
mov dword [esp + 0x30], 0x89be67e7
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x7c]
cmp dword [eax + ecx*4], ebx
jne 0x10012efc
mov dword [esp + 0x30], 1
cmp dword [esp + 0x30], ebx
jl 0x10012ef2
push 3
lea ecx, [esp + 0x1cc]
call fcn.10013d69
mov dword [esp + 0x20], ebx
jmp 0x10012e4f
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c8]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 3
jl 0x10012e3c
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x7c]
cmp dword [eax + ecx*4], ebx
je 0x10012ea7
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0xf8]
push 0
mov ecx, dword [eax]
mov eax, dword [esp + 0x80]
cmp ecx, dword [eax + edx*4]
mov eax, dword [esp + 0x30]
pop ecx
setge cl
imul eax, ecx
xor ecx, ecx
cmp eax, 0x4f6f4846
setg cl
mov dword [esp + 0x24], ecx
mov eax, dword [esp + 0x24]
cmp dword [esp + 0x2c], ebx
je 0x10012ea7
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xf8]
mov ecx, dword [eax]
mov eax, dword [esp + 0x7c]
mov dword [eax + edx*4], ecx
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c8]
push ecx
mov dword [ecx], eax
call fcn.10040fec
mov dword [esp + 0x1cc], ebx
mov dword [esp + 0x1d0], ebx
mov dword [esp + 0x1d4], ebx
dec dword [esp + 0x34]
pop ecx
jns 0x10012e28
dec dword [esp + 0x10]
jns 0x10012dfd
inc dword [esp + 0x2c]
cmp dword [esp + 0x2c], 1
jle 0x10012dd3
mov byte [esp + 0x30c], 0xa
cmp dword [esp + 0xf8], 0
je 0x10012f3f
push dword [esp + 0xf8]
call fcn.10040fec
pop ecx
mov dword [esp + 0xf8], ebx
mov dword [esp + 0xfc], ebx
mov dword [esp + 0x100], ebx
dec dword [esp + 0x14]
jns 0x10012d75
dec dword [esp + 0x1c]
xor ecx, ecx
cmp dword [esp + 0x1c], 0xfffffff9
jg 0x10012d07
mov dword [esp + 0x1c], ebx
mov eax, dword [esp + 0x1c]
cmp eax, 0xeb1ed309
setne cl
mov dword [esp + 0x2c], ecx
or dword [esp + 0x30c], 0xffffffff
cmp dword [esp + 0x7c], eax
je 0x10012f98
push dword [esp + 0x7c]
call fcn.10040fec
pop ecx
mov dword [esp + 0x7c], ebx
mov dword [esp + 0x80], ebx
mov dword [esp + 0x84], ebx
mov dword [esp + 0x2c], 0x73838a1f
mov eax, 0x63e91cb6
mov dword [esp + 0x10], 0xfffffffd
mov dword [esp + 0x218], eax
mov dword [esp + 0x21c], eax
mov dword [esp + 0x220], eax
mov dword [esp + 0x224], eax
mov dword [esp + 0x20], ebx
jmp 0x10012fe2
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x94], 0xffff
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 3
jl 0x10012fcf
mov dword [esp + 0x2c], ebx
jmp 0x100130d0
mov dword [esp + 0x24], 7
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], ebx
jmp 0x10013017
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x278], 2
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 3
jl 0x10013004
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + eax*4 + 0x94]
mov ecx, dword [esp + 0x10]
mov eax, 0xd816f93b
neg ecx
sbb ecx, ecx
neg ecx
sub eax, ecx
cmp eax, 4
je 0x10013046
mov eax, dword [esp + 0x94]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + eax*4 + 0x94]
mov eax, dword [esp + 0x2c]
cmp dword [esp + eax*4 + 0x94], 1
je 0x10013066
mov eax, dword [esp + 0x94]
mov eax, dword [esp + 0x2c]
xor edx, edx
mov eax, dword [esp + 0x98]
mov eax, dword [esp + 0x2c]
imul ecx, dword [esp + eax*4 + 0x94], 0x83d0a5e
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + eax*4 + 0x94]
cmp eax, ecx
setle dl
sub edx, 6
je 0x100130a9
mov eax, dword [esp + 0x2c]
cmp dword [esp + eax*4 + 0x94], ebx
je 0x100130a9
xor ecx, ecx
inc ecx
jmp 0x100130ab
mov ecx, ebx
mov eax, dword [esp + 0x2c]
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x2c]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [esp + 0x280], ecx
inc dword [esp + 0x24]
inc dword [esp + 0x2c]
cmp dword [esp + 0x2c], 2
jle 0x10012ff2
mov dword [esp + 0x10], 0xfffffff8
cmp dword [esp + 0x10], 0x21
jge 0x100131d7
mov dword [esp + 0x24], 0x18b4
cmp dword [esp + 0x24], 0x6b3
jge 0x10013178
mov byte [esp + 0xac], bl
mov esi, ebx
mov dword [esp + 0xad], ebx
mov dword [esp + 0xb1], ebx
lea eax, [esp + 0x37]
push eax
push 0x10007860
call fcn.100405bb
mov al, byte [esp + 0x3f]
pop ecx
pop ecx
cmp al, 0x58
jne 0x1001313a
mov byte [esp + esi + 0xac], 1
jmp 0x10013145
cmp al, 0x2e
jne 0x10013146
mov byte [esp + esi + 0xac], bl
inc esi
cmp esi, 9
jl 0x10013117
mov ecx, ebx
lea edx, [esp + 0xb4]
mov al, byte [esp + ecx + 0xac]
cmp al, byte [edx]
jne 0x1001316d
inc ecx
dec edx
cmp ecx, 9
jl 0x10013154
push 0x10007824
jmp 0x10013172
push 0x10007828
call fcn.10041046
pop ecx
mov dword [esp + 0x20], ebx
jmp 0x10013191
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x228], 0x7756eb3e
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 2
jl 0x1001317e
mov dword [esp + 0x2c], 1
mov eax, dword [esp + 0x2c]
add eax, dword [esp + 0x22c]
mov dword [esp + 0x220], eax
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x100131c4
push ebx
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x21
jl 0x100130ee
mov esi, dword [esp + 0x28]
mov dword [esp + 0x28], 5
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x100131f1
push ebx
call dword [sym.imp.KERNEL32.dll_InitializeSListHead]
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10013207
push 0x91c
call dword [sym.imp.USER32.dll_BeginDeferWindowPos]
cmp dword [esp + 0x178], 0
je 0x10013354
mov dword [esp + 0x28], 0xe48d327c
mov dword [esp + 0x14], ebx
jmp 0x10013236
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x2f0], 0xdb505206
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x10013223
mov dword [esp + 0x14], ebx
jmp 0x10013256
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0xbc], 0xffffffff
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 1
jl 0x10013243
dec dword [esp + 0xbc]
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001333a
mov dword [esp + 0x28], 0x21cc
cmp dword [esp + 0x28], 0x1167
jge 0x10013333
lea eax, [esp + 0xe0]
push eax
lea eax, [esp + 0x1a8]
push eax
push 0x10007840
call fcn.100405bb
add esp, 0xc
lea eax, [esp + 0xc4]
push eax
push 0x10007804
call fcn.100405bb
mov edx, ebx
mov esi, ebx
mov edi, ebx
pop ecx
pop ecx
cmp dword [esp + 0xc4], edx
jle 0x10013311
lea eax, [esp + 0xf4]
push eax
push 0x10007804
call fcn.100405bb
mov eax, dword [esp + 0xfc]
inc esi
sub eax, ebx
mov ebx, dword [esp + 0xfc]
dec eax
pop ecx
pop ecx
mov ecx, dword [esp + 0xe0]
cdq
idiv ecx
add esi, eax
inc edi
cmp edi, dword [esp + 0xc4]
jl 0x100132c9
mov dword [esp + 0x24], ebx
xor ebx, ebx
mov edx, dword [esp + 0x24]
jmp 0x10013318
mov ecx, dword [esp + 0xe0]
mov eax, dword [esp + 0x1a4]
sub eax, edx
cdq
idiv ecx
add esi, eax
push esi
push 0x10007838
call fcn.10040c03
pop ecx
pop ecx
push ebx
call dword [sym.imp.USER32.dll_SetCursor]
mov ecx, dword [esp + 0x178]
call fcn.10011821
mov esi, eax
lea eax, [esp + 0x50]
push eax
call fcn.10014000
mov dword [eax], esi
mov dword [esp + 0x30], 0xffff
lea ecx, [esp + 0x134]
mov dword [esp + 0x28], 0xeab1d6a5
push 2
call fcn.10013d69
mov dword [esp + 0x24], ebx
mov dword [esp + 0x14], ebx
jmp 0x1001338f
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x284], 7
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x1001337c
mov dword [esp + 0x14], ebx
jmp 0x100133b2
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x134]
mov dword [eax + ecx*4], 0xf7a9d2e8
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x1001339c
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x30]
mov dword [esp + 0x284], eax
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x30]
cmp dword [esp + 0x134], 0
mov dword [esp + 0x24], ebx
je 0x10013404
push dword [esp + 0x134]
call fcn.10040fec
pop ecx
mov dword [esp + 0x134], ebx
mov dword [esp + 0x138], ebx
mov dword [esp + 0x13c], ebx
lea ecx, [esp + 0x174]
call fcn.1000e8ab
push 0xfffffffffffffff8
pop eax
mov dword [esp + 0x1e0], eax
mov dword [esp + 0x1e4], eax
mov dword [esp + 0x1e8], eax
mov dword [esp + 0x1ec], eax
mov dword [esp + 0x14], 0xbc6e5c7a
mov dword [esp + 0x28], 7
mov dword [esp + 0x28], ebx
mov dword [esp + 0x28], 0xfffffffc
push 3
mov dword [esp + 0x1ec], 0xec0ae971
mov dword [esp + 0x18], ebx
pop edi
jmp 0x100134e4
mov dword [esp + 0x28], 0x47c4d145
xor edx, edx
mov eax, dword [esp + 0x14]
mov eax, dword [esp + eax*4 + 0x1e0]
test eax, eax
mov eax, dword [esp + 0x14]
setne dl
xor ecx, ecx
mov eax, dword [esp + eax*4 + 0x1e0]
cmp eax, edx
setg cl
mov dword [esp + 0x28], ecx
cmp dword [esp + 0x28], ebx
jne 0x100134d9
mov dword [esp + 0x28], 0x431f
mov eax, dword [esp + 0x14]
mov edx, dword [esp + eax*4 + 0x1e0]
mov ecx, dword [esp + 0x28]
sub ecx, dword [esp + 0x14]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, edx
setge al
xor ecx, ecx
test eax, eax
sets cl
imul ecx, dword [esp + 0x14]
mov dword [esp + 0x28], ecx
cmp dword [esp + 0x28], ebx
jne 0x100134d9
mov eax, ebx
jmp 0x100134dc
xor eax, eax
inc eax
mov dword [esp + 0x28], eax
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jle 0x10013462
test esi, esi
je 0x100135aa
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], 0x3a23fe5e
mov dword [esp + 0x20], ebx
jmp 0x1001351b
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x260], 0xfffffffa
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edi
jl 0x10013508
mov dword [esp + 0x20], ebx
jmp 0x10013580
mov dword [esp + 0x10], 0x51f20002
mov dword [esp + 0x28], 0xf0bc
mov dword [esp + 0x10], 2
cmp dword [esp + 0x10], ebx
jl 0x10013569
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10013558
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + eax*4 + 0x260]
dec dword [esp + 0x10]
jns 0x10013545
mov ecx, dword [esp + 0x28]
xor edx, edx
mov eax, dword [esp + 0x10]
cmp eax, ecx
setle dl
mov dword [esp + 0x28], edx
dec dword [esp + 0x20]
cmp dword [esp + 0x20], 0xfffffff7
jle 0x10013527
mov edx, dword [esp + 0x38]
mov ecx, esi
call fcn.10011846
mov esi, eax
lea eax, [esp + 0xc8]
push eax
mov dword [esp + 0x204], esi
call fcn.10013f9e
mov dword [eax], esi
push 2
lea ecx, [esp + 0x198]
call fcn.10013d69
mov dword [esp + 0x30c], 0xc
lea ecx, [esp + 0x20c]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], 0x7e17f75
mov dword [esp + 0x28], 0x1a82e77e
mov dword [esp + 0x38], 0xffffffff
push 1
call fcn.10013d69
xor edx, edx
mov dword [esp + 0x14], ebx
inc edx
cmp dword [esp + 0x14], 2
jge 0x1001360f
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x194]
mov dword [eax + ecx*4], edx
inc dword [esp + 0x14]
jmp 0x100135f4
mov dword [esp + 0x14], ebx
jmp 0x1001362b
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x20c]
mov dword [eax + ecx*4], 0x7f59
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x10013615
mov dword [esp + 0x10], edx
cmp dword [esp + 0x10], ebx
jl 0x100136dc
mov dword [esp + 0x38], 0x4ebb0cb8
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x194]
push 0
mov eax, dword [eax + ecx*4]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x198]
mov eax, dword [esp + 0x18]
cmp dword [ecx + edx*4], eax
mov eax, dword [esp + 0x2c]
pop ecx
setle cl
xor edx, edx
cmp ecx, eax
setne dl
xor ecx, ecx
sub edx, dword [esp + 0x38]
mov eax, dword [esp + 0x14]
cmp ecx, eax
sbb eax, eax
neg eax
cmp eax, edx
setge cl
xor eax, eax
cmp ecx, 0x5ebd
setg al
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], ebx
jne 0x100136c0
cmp dword [esp + 0x28], ebx
jne 0x100136c0
mov ecx, ebx
jmp 0x100136c3
xor ecx, ecx
inc ecx
xor eax, eax
cmp ecx, 0x8a60
setge al
mov dword [esp + 0x38], eax
dec dword [esp + 0x10]
jns 0x1001363f
cmp dword [esp + 0x20c], 0
je 0x100136f3
push dword [esp + 0x20c]
call fcn.10040fec
pop ecx
cmp dword [esp + 0x194], 0
je 0x1001370a
push dword [esp + 0x194]
call fcn.10040fec
pop ecx
mov eax, dword [ebp + 8]
lea esi, [esp + 0x200]
mov ecx, dword [esp + 0x304]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret