Function at 0x1001b000
Capabilities:
Encode data using xor
Query environment variable
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1006a06f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xe48
push ebx
mov dword [esp + 0x68], ecx
mov dword [esp + 0x2c], 0x1cf3
cmp dword [esp + 0x2c], 0x84a
push esi
push edi
mov dword [esp + 0x50], edx
jge 0x1001b1b5
lea eax, [esp + 0x9c]
mov ecx, 0x1065bc70
push eax
call fcn.1000b74c
mov ebx, dword [esp + 0x9c]
test ebx, ebx
je 0x1001b1ad
mov esi, dword [esp + 0x80]
mov edi, dword [esp + 0x80]
lea eax, [esp + 0x74]
dec ebx
push eax
push ecx
lea eax, [esp + 0x80]
push eax
push ecx
lea eax, [esp + 0x74]
push eax
push ecx
lea eax, [esp + 0x84]
mov ecx, 0x1065bc70
push eax
call fcn.1000b74c
lea edx, [esp + 0x6e]
mov ecx, eax
call fcn.1001f2ab
pop ecx
mov ecx, eax
call fcn.1000b74c
lea edx, [esp + 0x67]
mov ecx, eax
call fcn.1001f2ab
pop ecx
mov ecx, eax
call fcn.1000b74c
lea edx, [esp + 0x5e]
mov ecx, eax
call fcn.1001f2ab
pop ecx
mov ecx, eax
call fcn.1000b74c
mov al, byte [esp + 0x57]
cmp al, 0x2b
jne 0x1001b0f2
mov edi, dword [esp + 0x74]
mov eax, edi
mov esi, dword [esp + 0x78]
imul esi, dword [esp + 0x64]
imul eax, dword [esp + 0x6c]
add esi, eax
jmp 0x1001b12d
cmp al, 0x2d
jne 0x1001b10e
mov edi, dword [esp + 0x74]
mov esi, edi
mov eax, dword [esp + 0x78]
imul eax, dword [esp + 0x64]
imul esi, dword [esp + 0x6c]
sub esi, eax
jmp 0x1001b12d
cmp al, 0x2a
jne 0x1001b11c
mov esi, dword [esp + 0x78]
mov edi, dword [esp + 0x74]
jmp 0x1001b128
cmp al, 0x2f
jne 0x1001b132
mov esi, dword [esp + 0x74]
mov edi, dword [esp + 0x78]
imul esi, dword [esp + 0x6c]
imul edi, dword [esp + 0x64]
push edi
push ecx
push esi
mov ecx, 0x1065bbb8
call fcn.1000b947
mov dl, 0x2f
mov ecx, eax
call fcn.1001f0a8
pop ecx
mov ecx, eax
call fcn.1000b947
mov edx, 0x10007b30
mov ecx, eax
call fcn.1000f059
mov edx, edi
mov ecx, esi
call fcn.1001adbc
push eax
call fcn.100533f2
pop ecx
mov ecx, eax
mov eax, esi
cdq
idiv ecx
mov esi, eax
mov eax, edi
cdq
idiv ecx
mov edi, eax
push edi
push ecx
push esi
mov ecx, 0x1065bbb8
call fcn.1000b947
mov dl, 0x2f
mov ecx, eax
call fcn.1001f0a8
pop ecx
mov ecx, eax
call fcn.1000b947
push 0x1065bbb8
call fcn.1000f027
pop ecx
test ebx, ebx
jne 0x1001b071
dec ebx
mov dword [esp + 0x9c], ebx
mov dword [esp + 0x24], 4
lea ecx, [esp + 0x13c]
push 3
call fcn.1000bb6e
xor ebx, ebx
mov dword [esp + 0x34], 0xbbbc
mov dword [esp + 0x38], ebx
mov dword [esp + 0x1c], ebx
jmp 0x1001b1f2
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x13c]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 3
jl 0x1001b1df
inc dword [esp + 0x24]
mov dword [esp + 0x24], 0x14
jmp 0x1001b3ad
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x1c], 0xf06e85fc
mov dword [esp + 0x2c], 0x42fa43de
mov dword [esp + 0x1c], ebx
jmp 0x1001b23b
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x290], 0x4e2b79dc
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 3
jl 0x1001b228
mov dword [esp + 0x30], ebx
jmp 0x1001b39e
mov dword [esp + 0x10], 0xfffffff9
mov dword [esp + 0x10], ebx
jmp 0x1001b31e
mov dword [esp + 0x18], 0x20bd2ab
mov dword [esp + 0x18], ebx
jmp 0x1001b2f1
mov edi, dword [esp + 0x18]
xor edx, edx
mov ecx, dword [esp + 0x18]
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x13c]
cmp dword [eax + ecx*4], 0x6c849023
mov eax, dword [eax]
setl dl
add eax, 6
imul edx, eax
mov eax, dword [esp + 0x30]
inc edx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
sete cl
imul ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x13c]
sub ecx, dword [eax + esi*4]
neg ecx
sbb ecx, ecx
inc ecx
imul ecx, dword [eax + edi*4]
mov eax, dword [esp + 0x10]
imul edx, ecx, 0xb4b5
sub edx, eax
sub edx, 3
sub edx, dword [esp + 0x298]
mov eax, dword [esp + 0x10]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
mov dword [esp + 0x1c], ecx
cmp dword [esp + 0x34], ebx
jne 0x1001b2fc
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jle 0x1001b26d
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], bl
je 0x1001b31a
push ebx
push 0xdcd
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetTimer]
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jle 0x1001b25c
mov dword [esp + 0x1c], 2
cmp dword [esp + 0x1c], ebx
jl 0x1001b39a
mov eax, dword [esp + 0x1c]
xor ecx, ecx
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x298]
mov eax, dword [esp + 0x10]
imul edx, dword [esp + 0x2c], 0x372
sub edx, dword [esp + 0x10]
mov eax, dword [esp + 0x30]
cmp eax, edx
setge cl
mov dword [esp + 0x38], ecx
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], bl
je 0x1001b394
push 0x16c3
push 0xe65
push 0x8be
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push ebx
call dword [sym.imp.USER32.dll_PeekMessageA]
dec dword [esp + 0x1c]
jns 0x1001b337
inc dword [esp + 0x30]
cmp dword [esp + 0x30], 2
jle 0x1001b24b
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 0x1f
jle 0x1001b20a
lea ecx, [esp + 0x13c]
call fcn.1000bbf0
push 2
lea ecx, [esp + 0xb8]
call fcn.1000bb6e
mov dword [esp + 0x10], 0x9bdba76a
mov dword [esp + 0x1c], ebx
jmp 0x1001b3f6
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0xb4]
mov dword [eax + ecx*4], 0xfffffffb
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jl 0x1001b3e0
xor eax, eax
inc eax
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], ebx
jl 0x1001b4fb
mov edx, dword [esp + 0xb4]
mov dword [esp + 0x48], edx
mov dword [esp + 0x38], 0xca7
mov dword [esp + 0x2c], eax
mov dword [esp + 0x34], 0xbc4433ac
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0xb4]
cmp dword [eax], ebx
jne 0x1001b440
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xb4]
push 0
mov eax, dword [eax + ecx*4]
xor ecx, ecx
mov dword [esp + 0x30], eax
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x30]
mov edx, dword [edx + 4]
cmp eax, edx
setle cl
sub ecx, edx
imul eax, ecx, 0xffff
xor ecx, ecx
cmp eax, 0x4aee5077
mov eax, dword [esp + 0x3c]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0xb8]
setge dl
xor ecx, ecx
cmp edx, dword [eax + esi*4]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x14]
setl cl
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x14]
mov dword [esp + 0x38], ecx
mov ecx, dword [esp + 0xb8]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x14]
cmp eax, dword [ecx + edx*4]
mov edx, dword [esp + 0xb8]
pop eax
setl al
xor ecx, ecx
push 1
sub eax, dword [edx]
sub eax, dword [esp + 0x38]
cmp eax, dword [edx + esi*4]
mov esi, dword [esp + 0x30]
setle cl
xor eax, eax
sub ecx, 0x1fcc1031
cmp dword [edx + esi*4], ecx
sete al
add eax, dword [edx + edi*4]
mov edx, dword [esp + 0x4c]
mov dword [esp + 0x38], eax
dec dword [esp + 0x14]
pop eax
jns 0x1001b419
lea ecx, [esp + 0xb4]
call fcn.1000bbf0
mov eax, dword [0x1076c100]
xor ecx, ecx
inc ecx
test cl, al
jne 0x1001b5ac
or eax, ecx
mov dword [0x1076c100], eax
push ebx
mov dword [esp + 0xe60], ebx
push ebx
mov dword [0x1076c0e0], ebx
mov dword [0x1076c0e4], ebx
call fcn.1001f032
mov dword [0x1076c0e0], eax
mov dword [0x1076c0e8], ebx
mov dword [0x1076c0f0], ebx
mov byte [esp + 0xe5c], 2
mov ecx, 0x1076c0e8
mov dword [esp + 0x11c], eax
lea eax, [esp + 0x11c]
push eax
push 0x10
push ebx
lea eax, [esp + 0x140]
mov dword [0x1076c0fc], 0x3f800000
push eax
mov dword [0x1076c0ec], ebx
call fcn.1001ee0a
push 0x1006aeb5
mov dword [0x1076c0f4], 7
mov dword [0x1076c0f8], 8
call fcn.10051162
or dword [esp + 0xe60], 0xffffffff
pop ecx
push dword [esp + 0x134]
movdqa xmm0, xmmword [0x10007fc0]
lea eax, [esp + 0x2c0]
push eax
lea eax, [esp + 0x2b4]
mov dword [esp + 0x1b0], ebx
push eax
push ebx
lea ecx, [esp + 0x1b8]
mov dword [esp + 0x1bc], ebx
movdqu xmmword [esp + 0x2bc], xmm0
mov dword [esp + 0x1c0], ebx
call fcn.1000f98f
push 3
mov dword [esp + 0x20], 0x32a27689
mov dword [esp + 0x20], ebx
pop esi
jmp 0x1001b61c
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001b618
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], esi
jle 0x1001b607
lea ecx, [esp + 0x1a8]
call fcn.1000bbf0
imul eax, dword [esp + 0x70], 0x2710
lea ecx, [esp + 0x154]
push esi
add eax, dword [esp + 0x54]
mov dword [esp + 0x9c], eax
mov dword [esp + 0x1c], 4
call fcn.1000bb6e
mov dword [esp + 0x34], 0xbbbc
mov dword [esp + 0x38], ebx
mov dword [esp + 0x1c], ebx
jmp 0x1001b67b
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x154]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], esi
jl 0x1001b668
inc dword [esp + 0x18]
mov dword [esp + 0x18], 0x14
jmp 0x1001b838
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x1c], 0xf06e85fc
mov dword [esp + 0x2c], 0x42fa43de
mov dword [esp + 0x1c], ebx
jmp 0x1001b6c3
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x22c], 0x4e2b79dc
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], esi
jl 0x1001b6b0
mov dword [esp + 0x30], ebx
jmp 0x1001b829
mov dword [esp + 0x10], 0xfffffff9
mov dword [esp + 0x10], ebx
jmp 0x1001b7a8
mov dword [esp + 0x24], 0x20bd2ab
mov dword [esp + 0x24], ebx
jmp 0x1001b77a
mov edi, dword [esp + 0x24]
xor edx, edx
mov ecx, dword [esp + 0x24]
mov esi, dword [esp + 0x24]
mov eax, dword [esp + 0x154]
push 3
cmp dword [eax + ecx*4], 0x6c849023
mov eax, dword [eax]
setl dl
add eax, 6
imul edx, eax
mov eax, dword [esp + 0x34]
inc edx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
sete cl
imul ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x158]
sub ecx, dword [eax + esi*4]
neg ecx
pop esi
sbb ecx, ecx
inc ecx
imul ecx, dword [eax + edi*4]
mov eax, dword [esp + 0x10]
imul edx, ecx, 0xb4b5
sub edx, eax
sub edx, esi
sub edx, dword [esp + 0x234]
mov eax, dword [esp + 0x10]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
mov dword [esp + 0x1c], ecx
cmp dword [esp + 0x34], ebx
jne 0x1001b785
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 2
jle 0x1001b6f4
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001b7a4
push ebx
push 0xdcd
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetTimer]
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jle 0x1001b6e3
mov dword [esp + 0x1c], 2
cmp dword [esp + 0x1c], ebx
jl 0x1001b825
mov eax, dword [esp + 0x1c]
xor ecx, ecx
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x234]
mov eax, dword [esp + 0x10]
imul edx, dword [esp + 0x2c], 0x372
sub edx, dword [esp + 0x10]
mov eax, dword [esp + 0x30]
cmp eax, edx
setge cl
mov dword [esp + 0x38], ecx
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001b81f
push 0x16c3
push 0xe65
push 0x8be
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push ebx
call dword [sym.imp.USER32.dll_PeekMessageA]
dec dword [esp + 0x1c]
jns 0x1001b7c1
inc dword [esp + 0x30]
cmp dword [esp + 0x30], 2
jle 0x1001b6d2
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0x1f
jle 0x1001b692
lea ecx, [esp + 0x154]
call fcn.1000bbf0
lea eax, [esp + 0x98]
push eax
call fcn.1001e320
mov edi, dword [eax]
mov dword [esp + 0x24], 0x42c70bb7
mov dword [esp + 0x18], 0x7bc75286
mov dword [esp + 0x1c], 0x8b9b
mov dword [esp + 0x28], 9
mov dword [esp + 0x30], ebx
jmp 0x1001b894
mov eax, dword [esp + 0x30]
mov dword [esp + eax*4 + 0x5c], 1
inc dword [esp + 0x30]
cmp dword [esp + 0x30], 2
jl 0x1001b884
mov eax, dword [esp + 0x24]
mov dword [esp + 0x18], eax
mov dword [esp + 0x18], ebx
jmp 0x1001baaa
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001b8bd
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov eax, dword [esp + 0x18]
cmp dword [esp + eax*4 + 0x5c], ebx
je 0x1001b8cb
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x18]
push 7
pop ecx
mov edx, dword [esp + eax*4 + 0x5c]
mov eax, dword [esp + 0x24]
sub ecx, eax
add ecx, dword [esp + 0x18]
xor eax, eax
cmp ecx, edx
setle al
cmp eax, dword [esp + 0x24]
jne 0x1001b8f1
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + eax*4 + 0x5c]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + eax*4 + 0x5c]
cmp dword [esp + 0x1c], 0xfffffff7
jne 0x1001b917
mov eax, dword [esp + 0x18]
cmp dword [esp + eax*4 + 0x5c], ebx
je 0x1001b917
xor ecx, ecx
inc ecx
jmp 0x1001b919
mov ecx, ebx
xor eax, eax
cmp ecx, esi
sete al
xor edx, edx
cmp eax, 0xe3cf9575
mov eax, dword [esp + 0x18]
setne dl
xor ecx, ecx
imul edx, dword [esp + eax*4 + 0x5c]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + eax*4 + 0x5c]
cmp edx, eax
setl cl
test ecx, ecx
je 0x1001b997
mov dword [esp + 0x1c], ebx
jmp 0x1001b98b
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001b97f
push 0x156
push 0x11cc
push 0x31f
push 0x4fa
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_IntersectClipRect]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + eax*4 + 0x5c]
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 1
jle 0x1001b94c
jmp 0x1001baa6
mov dword [esp + 0x10], 0x1c2a9118
mov dword [esp + 0x34], 0x8a5a2d53
mov eax, dword [esp + 0x10]
cmp eax, dword [esp + 0x10]
jne 0x1001ba17
mov eax, dword [esp + 0x18]
cmp dword [esp + eax*4 + 0x5c], ebx
je 0x1001b9d4
mov eax, dword [esp + 0x18]
mov eax, dword [esp + eax*4 + 0x5c]
cmp dword [esp + 0x10], eax
jg 0x1001b9d4
cmp dword [esp + 0x18], ebx
je 0x1001b9d4
xor ecx, ecx
inc ecx
jmp 0x1001b9d6
mov ecx, ebx
mov eax, dword [esp + 0x18]
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x10]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x10]
setle cl
xor edx, edx
imul ecx, ecx, 0x198f
cmp eax, ecx
setne dl
sub edx, dword [esp + 0x18]
je 0x1001ba07
mov eax, dword [esp + 0x60]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + eax*4 + 0x5c]
mov eax, dword [esp + 0x10]
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001ba44
push ebx
push ebx
push ebx
push 0x208
push 0x13bb
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentExPointA]
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
push 3
mov esi, dword [esp + eax*4 + 0x60]
mov eax, dword [esp + 0x28]
cmp eax, 0xfffffff7
mov eax, dword [esp + 0x14]
setne cl
xor edx, edx
cmp ecx, esi
pop esi
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x18]
setg cl
xor edx, edx
mov eax, dword [esp + eax*4 + 0x5c]
cmp ecx, eax
mov ecx, dword [esp + 0x10]
setl dl
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0x663b
setne al
add edx, eax
add edx, dword [esp + 0x34]
mov dword [esp + 0x10], edx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 1
jle 0x1001b8ac
test edi, edi
je 0x1001bef3
mov dword [esp + 0x24], 0xfffffffe
mov dword [esp + 0x38], 0xc42ff18c
mov dword [esp + 0x50], esi
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001baf1
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x24], 0xffffffec
jg 0x1001bc1f
mov esi, 0xffff
push 3
lea ecx, [esp + 0x1b8]
call fcn.1000bb6e
push 3
pop edx
mov dword [esp + 0xe5c], edx
mov dword [esp + 0x30], 0x7222631
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x1c], ebx
jmp 0x1001bb49
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x1b4]
mov dword [eax + ecx*4], 0xc69aed23
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edx
jl 0x1001bb33
mov eax, dword [esp + 0x1b4]
or dword [eax + 4], 0xffffffff
mov dword [esp + 0x30], ebx
jmp 0x1001bbee
push 1
lea ecx, [esp + 0x1cc]
call fcn.1000bb6e
xor edx, edx
mov dword [esp + 0x1c], ebx
inc edx
jmp 0x1001bb8d
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c8]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edx
jl 0x1001bb7a
mov eax, dword [esp + 0x1b4]
cmp dword [eax], ebx
je 0x1001bbab
mov eax, dword [esp + 0x1c8]
mov ecx, edx
cmp dword [eax], ebx
jne 0x1001bbad
mov ecx, ebx
mov eax, dword [esp + 0x24]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x38], ecx
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x24]
inc eax
cmp esi, eax
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, 0x1ec1
setge cl
mov dword [esp + 0x50], ecx
lea ecx, [esp + 0x1c8]
call fcn.1000bbf0
dec dword [esp + 0x30]
cmp dword [esp + 0x30], 0xffffffe4
jne 0x1001bb63
or dword [esp + 0xe5c], 0xffffffff
lea ecx, [esp + 0x1b4]
call fcn.1000bbf0
dec dword [esp + 0x24]
cmp dword [esp + 0x24], 0xffffffec
jle 0x1001bb05
push 3
pop esi
mov dword [esp + 0x1c], ebx
lea ecx, [esp + 0x1e0]
push esi
mov dword [esp + 0xcc], edi
call fcn.1000bb6e
mov dword [esp + 0xe5c], 4
lea ecx, [esp + 0x214]
mov dword [esp + 0x24], 1
mov dword [esp + 0x28], esi
push 2
call fcn.1000bb6e
mov byte [esp + 0xe5c], 5
mov dword [esp + 0x10], ebx
jmp 0x1001bc80
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x1e0]
mov dword [eax + ecx*4], 0xd16df251
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x1001bc6a
mov dword [esp + 0x10], ebx
jmp 0x1001bca2
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x214]
mov dword [eax + ecx*4], 0xfffffff9
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1001bc8c
dec dword [esp + 0x24]
mov dword [esp + 0x1c], 0xfffffff0
jmp 0x1001bed0
push esi
lea ecx, [esp + 0x248]
call fcn.1000bb6e
push 2
lea ecx, [esp + 0x170]
mov byte [esp + 0xe60], 6
call fcn.1000bb6e
mov byte [esp + 0xe5c], 7
mov dword [esp + 0x28], 0x3700
mov dword [esp + 0x20], 0x7290b1c5
mov dword [esp + 0x50], ebx
mov dword [esp + 0x10], ebx
jmp 0x1001bd15
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x244]
mov dword [eax + ecx*4], 0xa61f
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x1001bcff
mov dword [esp + 0x10], ebx
jmp 0x1001bd37
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x16c]
mov dword [eax + ecx*4], 0xb6968939
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1001bd21
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x24], 2
jg 0x1001beac
mov esi, dword [esp + 0x1e0]
push 3
pop edi
mov dword [esp + 0x2c], ebx
lea ecx, [esp + 0xec]
push edi
call fcn.1000bb6e
mov byte [esp + 0xe5c], 8
lea ecx, [esp + 0x270]
mov dword [esp + 0x38], 0xfffffffd
mov dword [esp + 0x28], 0xaeb382e5
push 4
call fcn.1000bb6e
mov dword [esp + 0x30], 2
mov dword [esp + 0x18], ebx
jmp 0x1001bdb2
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0xec]
mov dword [eax + ecx*4], 0x85613717
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x1001bd9c
mov dword [esp + 0x18], ebx
jmp 0x1001bdcd
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x2bc], ebx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x1001bdbe
mov dword [esp + 0x18], ebx
jmp 0x1001bdef
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x270]
mov dword [eax + ecx*4], 9
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 4
jl 0x1001bdd9
mov eax, dword [esp + 0xec]
inc dword [eax + 4]
mov eax, dword [esp + 0x16c]
cmp dword [eax], ebx
je 0x1001be32
mov eax, dword [esp + 0x38]
mov ecx, 0xc72fddd0
mov eax, dword [esp + 0xec]
mov eax, dword [eax]
inc eax
cmp ecx, eax
mov eax, dword [esp + 0x16c]
sbb ecx, ecx
neg ecx
mov dword [eax + 4], ecx
mov eax, dword [esp + 0x24]
dec dword [esp + 0x20]
xor ecx, ecx
mov eax, dword [esp + 0x20]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x38]
inc dword [esp + 0x30]
mov eax, dword [esp + 0x2c0]
cmp eax, 8
mov eax, dword [esp + 0x30]
setl cl
mov dword [esi + 4], ecx
add eax, ecx
jne 0x1001be73
mov eax, dword [esp + 0xec]
cmp dword [eax], ebx
jne 0x1001be73
mov eax, ebx
jmp 0x1001be76
xor eax, eax
inc eax
mov dword [esp + 0x50], eax
lea ecx, [esp + 0x270]
call fcn.1000bbf0
lea ecx, [esp + 0xec]
mov byte [esp + 0xe5c], 7
call fcn.1000bbf0
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 2
jle 0x1001bd57
push 3
pop esi
lea ecx, [esp + 0x16c]
call fcn.1000bbf0
lea ecx, [esp + 0x244]
mov byte [esp + 0xe5c], 5
call fcn.1000bbf0
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xfffffff2
jl 0x1001bcba
lea ecx, [esp + 0x214]
call fcn.1000bbf0
lea ecx, [esp + 0x1e0]
jmp 0x1001deb0
mov eax, dword [0x1076c100]
test al, 2
jne 0x1001bf9a
or eax, 2
mov dword [0x1076c100], eax
push ebx
mov dword [esp + 0xe60], 9
push ebx
mov dword [0x1076c110], ebx
mov dword [0x1076c114], ebx
call fcn.1001f032
mov dword [0x1076c110], eax
mov dword [0x1076c118], ebx
mov dword [0x1076c120], ebx
mov byte [esp + 0xe5c], 0xb
mov ecx, 0x1076c118
mov dword [esp + 0x12c], eax
lea eax, [esp + 0x12c]
push eax
push 0x10
push ebx
lea eax, [esp + 0xe0]
mov dword [0x1076c12c], 0x3f800000
push eax
mov dword [0x1076c11c], ebx
call fcn.1001ee0a
push 0x1006aeb0
mov dword [0x1076c124], 7
mov dword [0x1076c128], 8
call fcn.10051162
or dword [esp + 0xe60], 0xffffffff
pop ecx
mov dword [esp + 0x10], 0xffffffff
xor ecx, ecx
mov dword [esp + 0x3c], 0x6673e7ed
inc ecx
mov dword [esp + 0x34], 0xd9532955
mov dword [esp + 0x28], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x10], ebx
jmp 0x1001bfd6
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0xa4], 0x624039b
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ecx
jl 0x1001bfc3
push 2
mov dword [esp + 0x14], ebx
pop edx
jmp 0x1001bff4
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x1c0], edx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x1001bfe5
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001c019
push 0x68b
push 0x230f
push ebx
call dword [sym.imp.GDI32.dll_PtInRegion]
xor ecx, ecx
inc ecx
mov dword [esp + 0x10], ebx
mov edi, 0x100079f8
cmp dword [esp + 0x10], ebx
jl 0x1001c551
jmp 0x1001c031
xor ecx, ecx
inc ecx
mov dword [esp + 0x18], 0xaeb59008
mov dword [esp + 0x20], 0xd927f7b6
mov dword [esp + 0x1c], 0xe1a812c0
push 6
pop edx
mov dword [esp + 0x24], edx
mov dword [esp + 0x30], 0xfffffff8
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0xa4]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x3c]
cmp edx, eax
sbb eax, eax
neg eax
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
neg eax
sbb eax, eax
inc eax
imul eax, dword [esp + 0x24]
test eax, eax
je 0x1001c0ab
mov esi, ecx
cmp dword [esp + 0x30], ebx
jne 0x1001c0ad
mov esi, ebx
inc dword [esp + 0x18]
xor edx, edx
mov eax, dword [esp + 0x20]
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
cmp eax, ecx
mov eax, dword [esp + 0x24]
setge dl
xor ecx, ecx
cmp esi, eax
setge cl
imul edx, ecx
xor ecx, ecx
imul edx, dword [esp + 0x24]
imul eax, edx, 0x39ca6438
cmp eax, 0x437f
setl cl
cmp ecx, dword [esp + 0x10]
jg 0x1001c51d
mov dword [esp + 0x24], 1
mov dword [esp + 0x2c], 0x1ab5
cmp dword [esp + 0x2c], 0x1191
jge 0x1001c472
call fcn.10050f35
push eax
push 0x100076d8
push 0x100076dc
call fcn.100513cf
add esp, 0xc
call fcn.10050f35
add eax, 0x20
push eax
push 0x100076e4
push 0x100076e8
call fcn.100513cf
add esp, 0xc
mov byte [esp + 0x17], 1
jmp 0x1001c456
mov ecx, edx
lea esi, [edx - 1]
shl eax, cl
mov dword [esp + 0x20], eax
test esi, esi
js 0x1001c1b1
imul eax, esi, 0xe8
lea edx, [esp + 0x710]
add edx, eax
mov dword [esp + 0x2c], edx
xor eax, eax
mov ecx, esi
inc eax
shl eax, cl
mov dword [esp + 0x38], eax
test eax, eax
jle 0x1001c19e
mov edi, edx
mov ebx, eax
push edi
push 0x100079f8
call fcn.10050dfb
dec dword [edi]
add edi, 4
pop ecx
pop ecx
dec ebx
jne 0x1001c185
mov edx, dword [esp + 0x2c]
sub edx, 0xe8
dec esi
mov dword [esp + 0x2c], edx
jns 0x1001c172
mov edx, dword [esp + 0x68]
xor ebx, ebx
xor esi, esi
lea eax, [edx - 1]
inc esi
mov dword [esp + 0x40], eax
mov ecx, eax
shl esi, cl
test esi, esi
jle 0x1001c1ee
imul eax, edx, 0xe8
lea ecx, [esp + 0x714]
add ecx, eax
lea edi, [esp + eax + 0x628]
mov eax, dword [edi]
mov dword [ecx - 4], eax
mov eax, dword [edi]
lea edi, [edi + 4]
xor eax, 1
mov dword [ecx], eax
lea ecx, [ecx + 8]
dec esi
jne 0x1001c1d9
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x3f8]
mov esi, ecx
mov dword [esp + 0x2c], ecx
mov edi, ebx
mov ebx, esi
lea eax, [ecx + eax*4]
mov ecx, eax
sub ecx, ebx
xor ebx, ebx
add ecx, 3
shr ecx, 2
cmp esi, eax
cmova ecx, ebx
test ecx, ecx
je 0x1001c226
or dword [esi], 0xffffffff
inc edi
lea esi, [esi + 4]
cmp edi, ecx
jne 0x1001c21b
mov eax, dword [esp + 0x710]
lea ecx, [esp + 0x310]
mov esi, ecx
mov dword [esp + 0x2c], ecx
mov edi, ebx
mov ebx, esi
mov dword [esp + eax*4 + 0x3f8], 1
mov eax, dword [esp + 0x20]
lea eax, [ecx + eax*4]
mov ecx, eax
sub ecx, ebx
xor ebx, ebx
add ecx, 3
shr ecx, 2
cmp esi, eax
cmova ecx, ebx
test ecx, ecx
je 0x1001c270
or dword [esi], 0xffffffff
inc edi
lea esi, [esi + 4]
cmp edi, ecx
jne 0x1001c265
mov eax, dword [esp + 0x710]
mov dword [esp + eax*4 + 0x310], edx
xor eax, eax
inc eax
mov ecx, eax
mov dword [esp + 0x2c], ecx
cmp edx, eax
jl 0x1001c333
lea ebx, [esp + 0x7f8]
mov dword [esp + 0x38], ebx
shl eax, cl
test eax, eax
jle 0x1001c313
mov edx, dword [esp + 0x40]
lea ecx, [eax - 1]
shr ecx, 1
mov esi, ebx
inc ecx
mov edi, dword [esi]
mov eax, dword [esi + 4]
shl eax, 2
mov dword [esp + 0x58], eax
mov ebx, dword [esp + edi*4 + 0x3f8]
cmp ebx, 0xffffffff
je 0x1001c2d4
lea eax, [ebx + 1]
mov ebx, dword [esp + 0x58]
mov dword [esp + ebx + 0x3f8], eax
jmp 0x1001c2e3
mov eax, dword [esp + eax + 0x3f8]
inc eax
mov dword [esp + edi*4 + 0x3f8], eax
cmp dword [esp + edi*4 + 0x310], 0xffffffff
je 0x1001c2fa
mov eax, dword [esp + 0x58]
mov dword [esp + eax + 0x310], edx
jmp 0x1001c301
mov dword [esp + edi*4 + 0x310], edx
add esi, 8
dec ecx
jne 0x1001c2ac
mov edx, dword [esp + 0x68]
mov ecx, dword [esp + 0x2c]
mov ebx, dword [esp + 0x38]
inc ecx
add ebx, 0xe8
dec dword [esp + 0x40]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x38], ebx
push 1
pop eax
cmp ecx, edx
jle 0x1001c29a
xor ebx, ebx
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x4e0]
mov esi, ecx
mov dword [esp + 0x2c], ecx
mov edi, ebx
mov ebx, esi
lea eax, [ecx + eax*4]
mov ecx, eax
sub ecx, ebx
xor ebx, ebx
add ecx, 3
shr ecx, 2
cmp esi, eax
cmova ecx, ebx
test ecx, ecx
je 0x1001c36e
mov eax, dword [esp + 0x20]
inc edi
mov dword [esi], eax
lea esi, [esi + 4]
cmp edi, ecx
jne 0x1001c364
mov eax, ebx
mov dword [esp + 0x38], eax
test edx, edx
jle 0x1001c3e4
lea ebx, [esp + 0x7f8]
mov dword [esp + 0x48], ebx
xor esi, esi
mov ecx, eax
inc esi
shl esi, cl
test esi, esi
jle 0x1001c3cf
lea eax, [ebx - 0xe8]
mov dword [esp + 0x2c], eax
mov edi, dword [eax]
or eax, 0xffffffff
mov ecx, dword [ebx]
cmp ecx, edi
jne 0x1001c3a6
mov ecx, dword [ebx + 4]
mov ecx, dword [esp + ecx*4 + 0x310]
add ebx, 8
shl eax, cl
add dword [esp + edi*4 + 0x4e0], eax
mov eax, dword [esp + 0x2c]
add eax, 4
mov dword [esp + 0x2c], eax
dec esi
jne 0x1001c398
mov eax, dword [esp + 0x38]
mov ebx, dword [esp + 0x48]
inc eax
add ebx, 0xe8
mov dword [esp + 0x38], eax
mov dword [esp + 0x48], ebx
cmp eax, edx
jl 0x1001c383
xor ebx, ebx
cmp byte [esp + 0x17], 0
jne 0x1001c3f6
push 0x10007ab8
call fcn.1005118c
pop ecx
lea eax, [esp + 0x8c]
mov byte [esp + 0x17], bl
push eax
mov edi, 0x100079f8
push edi
call fcn.10050dfb
cmp dword [esp + 0x94], 0
mov esi, ebx
pop ecx
pop ecx
jle 0x1001c456
lea eax, [esp + 0x114]
push eax
push edi
call fcn.10050dfb
mov eax, dword [esp + 0x11c]
push dword [esp + eax*4 + 0x4e4]
push dword [esp + eax*4 + 0x400]
push eax
push 0x10007b34
call fcn.1005118c
add esp, 0x18
inc esi
cmp esi, dword [esp + 0x8c]
jl 0x1001c41b
lea eax, [esp + 0x68]
push eax
push edi
call fcn.10050dfb
mov edx, dword [esp + 0x70]
xor eax, eax
inc eax
pop ecx
pop ecx
cmp edx, eax
jge 0x1001c150
mov eax, dword [esp + 0x24]
xor edx, edx
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x3c]
cmp ecx, eax
mov eax, dword [esp + 0x24]
setne dl
cmp edx, 5
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
setge dl
sub edx, dword [esp + 0x24]
neg edx
sbb edx, edx
inc edx
mov dword [esp + 0x1c], edx
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x4c]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
cmp dword [esp + 0x30], ebx
je 0x1001c4c1
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x10]
push 0
mov dword [esp + eax*4 + 0xa8], ecx
lea eax, [ecx - 2]
xor ecx, ecx
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x34]
cmp eax, 0x32f
pop eax
setge cl
sub ecx, dword [esp + 0x1c0]
mov ecx, dword [esp + 0x24]
setns al
sub ecx, eax
mov eax, dword [esp + 0x24]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, 0xfffffffb
setle dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [esp + 0x1c4], ecx
jmp 0x1001c547
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001c547
push ebx
push 0x1252
push 0x264a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetDIBColorTable]
dec dword [esp + 0x10]
jns 0x1001c02e
xorps xmm0, xmm0
lea ecx, [esp + 0x25c]
push 4
movdqu xmmword [esp + 0xe0], xmm0
call fcn.1000bb6e
mov dword [esp + 0xe5c], 0xc
mov edi, 0xffff
mov dword [esp + 0x20], ebx
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x10], ebx
jmp 0x1001c59f
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x25c]
mov dword [eax + ecx*4], edi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x1001c58d
mov dword [esp + 0x10], ebx
jmp 0x1001c5bf
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0xc0], 0xffffffff
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1001c5ac
push 3
mov dword [esp + 0x24], ebx
pop esi
cmp dword [esp + 0x20], esi
jg 0x1001c785
xor edx, edx
inc edx
mov dword [esp + 0x24], 0x814b
mov dword [esp + 0x34], 0x3843046b
mov dword [esp + 0x1c], 7
mov dword [esp + 0x10], 9
dec dword [esp + 0x10]
mov dword [esp + 0x10], ebx
jmp 0x1001c76d
mov dword [esp + 0x1c], ebx
jmp 0x1001c620
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x90], 0xffffffff
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edx
jl 0x1001c60d
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x24], esi
jg 0x1001c763
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x28], 0x189a
cmp dword [esp + 0x28], 0x5e8
jge 0x1001c6a8
lea eax, [esp + 0xa0]
mov ecx, 0x1065bc70
push eax
call fcn.1000b74c
mov esi, dword [esp + 0xa0]
test esi, esi
je 0x1001c69a
lea eax, [esp + 0xfc]
mov ecx, 0x1065bc70
push eax
call fcn.1000b74c
mov eax, dword [esp + 0xfc]
mov ecx, 0x1065bbb8
cdq
sub eax, edx
sar eax, 1
push eax
call fcn.1000b947
push eax
call fcn.1000f027
pop ecx
dec esi
jne 0x1001c667
dec esi
xor edx, edx
push 3
mov dword [esp + 0xa4], esi
inc edx
pop esi
mov dword [esp + 0x1c], ebx
jmp 0x1001c6d5
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + eax*4 + 0xc0]
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0xc0], ecx
mov eax, dword [esp + 0x10]
cmp dword [esp + eax*4 + 0xc0], ebx
jne 0x1001c6db
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], esi
jle 0x1001c6ae
mov dword [esp + 0x18], ebx
jmp 0x1001c74c
mov dword [esp + 0x30], ebx
jmp 0x1001c6f6
mov eax, dword [esp + 0x30]
mov dword [esp + eax*4 + 0x268], edx
inc dword [esp + 0x30]
cmp dword [esp + 0x30], 2
jl 0x1001c6e7
mov eax, dword [esp + 0x90]
xor edx, edx
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0x90]
mov eax, dword [esp + 0x34]
inc ecx
cmp eax, ecx
mov eax, dword [esp + 0x26c]
push 1
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x20]
pop edx
setle cl
mov dword [esp + 0x28], ecx
xor ecx, ecx
cmp dword [esp + 0x28], eax
mov eax, dword [esp + 0x10]
setle cl
mov dword [esp + eax*4 + 0xc0], ecx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jle 0x1001c6e1
inc dword [esp + 0x24]
push 1
pop edx
cmp dword [esp + 0x24], esi
jle 0x1001c634
cmp dword [esp + 0x24], ebx
jne 0x1001c777
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jle 0x1001c607
inc dword [esp + 0x20]
cmp dword [esp + 0x20], esi
jle 0x1001c5da
or dword [esp + 0xe5c], 0xffffffff
lea ecx, [esp + 0x25c]
call fcn.1000bbf0
lea eax, [esp + 0x70]
push eax
call fcn.1001e382
push 3
pop ecx
mov esi, dword [eax]
mov dword [esp + 0x1c], 0xb7c7ce53
mov dword [esp + 0x30], esi
mov dword [esp + 0x20], ebx
jmp 0x1001c7cd
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x2d4], 7
inc dword [esp + 0x20]
cmp dword [esp + 0x20], ecx
jl 0x1001c7ba
mov dword [esp + 0x1c], 2
cmp dword [esp + 0x1c], ebx
jl 0x1001c834
mov dword [esp + 0x20], 0xd03248c6
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x20], ebx
jmp 0x1001c824
mov dword [esp + 0x3c], 0x7fbf2121
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x28], eax
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001c820
call dword [sym.imp.USER32.dll_CreateMenu]
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 2
jle 0x1001c7f7
dec dword [esp + 0x1c]
jns 0x1001c7e1
push 3
pop ecx
cmp byte [ebp + 0xc], 0
mov eax, dword [esp + 0x2d8]
mov dword [esp + 0x1c], eax
jne 0x1001c84d
test esi, esi
jne 0x1001ce04
xor eax, eax
inc eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x3c], 9
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x40], 0xc6d0
mov dword [esp + 0x34], eax
mov dword [esp + 0x18], ebx
jmp 0x1001c889
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x204], 0x82062403
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 4
jl 0x1001c876
mov dword [esp + 0x18], ebx
jmp 0x1001c8a9
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x2c8], 7
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ecx
jl 0x1001c896
mov dword [esp + 0x18], ebx
jmp 0x1001c8c8
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x2e0], 0x4cb44179
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ecx
jl 0x1001c8b5
mov dword [esp + 0x10], ebx
jmp 0x1001c925
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x20], ecx
cmp dword [esp + 0x20], ebx
jl 0x1001c921
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + eax*4 + 0x204]
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x204], ecx
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001c918
push 0x7fb
push 0xcf5
push ebx
call dword [sym.imp.USER32.dll_RemoveMenu]
dec dword [esp + 0x20]
jns 0x1001c8e6
push 3
pop ecx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ecx
jle 0x1001c8d4
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x204]
mov edx, dword [esp + 0x28]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
mov dword [esp + 0x2d0], edx
mov dword [esp + 0x2e0], edx
mov eax, dword [esp + 0x40]
cmp edx, eax
setg cl
cmp ecx, dword [esp + 0x3c]
jl 0x1001c96a
cmp dword [esp + 0x10], ebx
je 0x1001c96a
xor esi, esi
inc esi
jmp 0x1001c96c
mov esi, ebx
mov ecx, dword [esp + 0x3c]
xor edx, edx
mov eax, dword [esp + 0x20c]
cmp eax, ecx
mov eax, dword [esp + 0x40]
setle dl
xor ecx, ecx
cmp esi, eax
mov dword [esp + 0x28], edx
mov eax, dword [esp + 0x40]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x10]
setge dl
xor ecx, ecx
cmp eax, 0x51cf
mov dword [esp + 0x4c], edx
mov eax, dword [esp + 0x34]
setle cl
xor edx, edx
sub ecx, dword [esp + 0x28]
cmp ecx, dword [esp + 0x4c]
setne dl
xor ecx, ecx
cmp edx, eax
mov dl, byte [ebp + 0xc]
lea eax, [esp + 0x300]
setle cl
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x70]
push eax
call fcn.1000ff9e
mov esi, eax
lea edi, [esp + 0xe0]
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x48], 0x27439cb6
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x18], 0xfffffffd
mov dword [esp + 0x58], 1
mov dword [esp + 0x28], 0x1b7a
cmp dword [esp + 0x28], 0x6d4
jge 0x1001cbca
push 0x1a18
push ebx
push 0x10726f50
call fcn.1004a674
add esp, 0xc
mov dword [esp + 0x110], 1
lea eax, [esp + 0x110]
mov ecx, 0x1076a9d8
push eax
call fcn.1001e11b
xor eax, eax
mov edi, 0x1076a9e4
inc eax
push 0xa
pop edx
mov ecx, eax
mov dword [esp + 0x2c], edx
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], edx
mov esi, dword [edi - 8]
sub esi, dword [edi - 0xc]
sar esi, 2
mov dword [esp + 0x28], ebx
test esi, esi
jle 0x1001caa9
mov eax, dword [edi - 0xc]
mov eax, dword [eax + ebx*4]
imul eax, ecx
mov ecx, edi
mov dword [esp + 0x118], eax
lea eax, [esp + 0x118]
push eax
call fcn.1001e11b
mov ecx, dword [esp + 0x3c]
inc ebx
cmp ebx, esi
jl 0x1001ca7c
xor eax, eax
xor ebx, ebx
inc eax
cmp esi, eax
jle 0x1001cae2
mov dword [esp + 0x38], eax
mov dword [esp + 0x28], ebx
mov ecx, dword [edi]
mov eax, dword [ebx + ecx]
cdq
idiv dword [esp + 0x2c]
add dword [ebx + ecx + 4], eax
mov ecx, dword [edi]
mov eax, dword [ebx + ecx]
cdq
idiv dword [esp + 0x2c]
mov eax, dword [esp + 0x38]
inc eax
mov dword [ebx + ecx], edx
mov dword [esp + 0x38], eax
lea ebx, [ebx + 4]
cmp eax, esi
jl 0x1001cab5
xor ebx, ebx
mov eax, dword [edi]
mov eax, dword [eax + esi*4 - 4]
cmp eax, 9
jle 0x1001cb24
push 0xa
pop ebx
cdq
mov ecx, edi
idiv ebx
mov dword [esp + 0xd8], eax
lea eax, [esp + 0xd8]
push eax
call fcn.1001e11b
mov ecx, dword [edi]
mov eax, dword [ecx + esi*4 - 4]
cdq
idiv ebx
mov dword [ecx + esi*4 - 4], edx
inc esi
mov eax, dword [edi]
mov eax, dword [eax + esi*4 - 4]
cmp eax, 9
jg 0x1001caf0
xor ebx, ebx
test esi, esi
jle 0x1001cb3f
mov ecx, dword [edi]
mov edx, dword [esp + 0x40]
mov eax, dword [ecx]
lea ecx, [ecx + 4]
add eax, edx
inc dword [eax*4 + 0x10726f50]
dec esi
jne 0x1001cb2e
mov ecx, dword [esp + 0x3c]
add edi, 0xc
push 0xa
pop eax
add dword [esp + 0x40], eax
inc ecx
mov dword [esp + 0x3c], ecx
push 1
pop eax
cmp edi, 0x1076b1ac
jle 0x1001ca6b
lea eax, [esp + 0x94]
push eax
push 0x100079f8
call fcn.10050dfb
xor esi, esi
inc esi
pop ecx
pop ecx
cmp dword [esp + 0x94], esi
jl 0x1001cbca
lea eax, [esp + 0x120]
push eax
lea eax, [esp + 0x13c]
push eax
push 0x10007a00
call fcn.10050dfb
imul eax, dword [esp + 0x144], 0xa
add esp, 0xc
add eax, dword [esp + 0x120]
push dword [eax*4 + 0x10726f50]
push 0x100079ec
call fcn.1005118c
inc esi
pop ecx
pop ecx
cmp esi, dword [esp + 0x94]
jle 0x1001cb81
push 1
lea ecx, [esp + 0x1a0]
call fcn.1000bb6e
push 6
pop eax
mov dword [esp + 0x3c], eax
xor edx, edx
mov dword [esp + 0x48], ebx
inc edx
mov dword [esp + 0x38], 0xae45661c
mov dword [esp + 0x28], eax
mov dword [esp + 0x40], 0xffffffff
mov dword [esp + 0x2c], 0x5ab171c2
mov dword [esp + 0x34], 0xe74c
mov dword [esp + 0x1c], 0x410a
mov dword [esp + 0x28], edx
mov dword [esp + 0x20], 0xfffffffe
mov dword [esp + 0x28], edx
mov dword [esp + 0x20], ebx
jmp 0x1001cc3b
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x19c]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edx
jl 0x1001cc28
mov eax, dword [esp + 0x24]
xor edx, edx
mov eax, dword [esp + 0x58]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x24]
dec dword [esp + 0x3c]
mov eax, dword [esp + 0x18]
cmp eax, 1
setg dl
xor ecx, ecx
sub edx, dword [esp + 0x48]
mov eax, dword [esp + 0x38]
cmp edx, eax
mov eax, dword [esp + 0x19c]
setne cl
xor edx, edx
mov dword [eax], ecx
mov eax, dword [esp + 0x40]
mov dword [esp + 0x58], 1
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x48]
cmp ecx, eax
mov eax, dword [esp + 0x10]
setg dl
sub edx, 0xe7d51263
neg edx
sbb edx, edx
inc edx
mov dword [esp + 0x28], edx
xor edx, edx
cmp dword [esp + 0x28], eax
setge dl
xor ecx, ecx
sub edx, dword [esp + 0x24]
sub edx, dword [esp + 0x24]
mov eax, dword [esp + 0x18]
cmp edx, eax
setge cl
add ecx, dword [esp + 0x10]
jne 0x1001ccdb
cmp dword [esp + 0x24], ebx
jne 0x1001ccdb
mov eax, ebx
jmp 0x1001ccde
xor eax, eax
inc eax
xor edx, edx
cmp eax, 0xffffffff
mov eax, dword [esp + 0x40]
setne dl
xor ecx, ecx
cmp edx, eax
setg cl
sub ecx, dword [esp + 0x10]
mov dword [esp + 0x18], ecx
jne 0x1001ccff
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x34]
add eax, dword [esp + 0x40]
jne 0x1001cd13
cmp dword [esp + 0x48], ebx
jne 0x1001cd13
mov ecx, ebx
jmp 0x1001cd16
xor ecx, ecx
inc ecx
mov eax, dword [esp + 0x19c]
xor edx, edx
mov dword [eax], 0x525b78c6
mov dword [esp + 0x48], ecx
mov eax, dword [esp + 0x48]
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x24], 1
mov eax, dword [esp + 0x24]
mov dword [esp + 0x28], eax
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x24]
cmp eax, ecx
lea ecx, [esp + 0x19c]
setl dl
imul edx, dword [esp + 0x1c]
mov dword [esp + 0x20], edx
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x48]
mov eax, dword [esp + 0x2c]
dec dword [esp + 0x2c]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x28], ebx
call fcn.1000bbf0
cmp byte [ebp + 0xc], 0
je 0x1001cdfb
cmp dword [esp + 0xe4], 0
je 0x1001cdfb
mov dword [esp + 0x1c], 0x17571177
mov dword [esp + 0x1c], 0xffffffe6
jmp 0x1001cdd8
mov dword [esp + 0x20], ebx
mov dword [esp + 0x20], ebx
jmp 0x1001cdcd
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001cdc9
push ebx
call dword [sym.imp.USER32.dll_DestroyIcon]
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 0x13
jne 0x1001cdb7
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xfffffff0
jle 0x1001cdad
mov eax, dword [esp + 0xe8]
mov dword [esp + 0xcc], eax
mov eax, dword [esp + 0xe4]
mov dword [esp + 0xd0], eax
mov esi, dword [esp + 0x30]
mov edi, 0xffff
push dword [esp + 0xd4]
movdqa xmm0, xmmword [0x10007f90]
lea eax, [esp + 0x2b0]
push eax
lea eax, [esp + 0x2a4]
mov dword [esp + 0x18c], ebx
push eax
push ebx
lea ecx, [esp + 0x194]
mov dword [esp + 0x198], ebx
movdqu xmmword [esp + 0x2ac], xmm0
mov dword [esp + 0x19c], ebx
call fcn.1000f98f
mov dword [esp + 0x1c], 0xa35f394a
mov dword [esp + 0x28], 1
mov dword [esp + 0x1c], 3
cmp dword [esp + 0x1c], ebx
jl 0x1001ceba
mov dword [esp + 0x20], 0x7a3a11c1
mov dword [esp + 0x20], 3
cmp dword [esp + 0x20], ebx
jl 0x1001ceb4
mov dword [esp + 0x34], 0xfffe
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001ceaa
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectClipRgn]
dec dword [esp + 0x34]
dec dword [esp + 0x20]
jns 0x1001ce82
dec dword [esp + 0x1c]
jns 0x1001ce6c
lea ecx, [esp + 0x184]
call fcn.1000bbf0
test esi, esi
jne 0x1001d31a
cmp dword [esp + 0xdc], esi
jle 0x1001d31a
push 3
mov dword [esp + 0x2c], 1
mov dword [esp + 0x24], ebx
pop esi
jmp 0x1001cefb
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x2ec], edi
inc dword [esp + 0x20]
cmp dword [esp + 0x20], esi
jl 0x1001ceec
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001cf13
push ebx
call dword [sym.imp.GDI32.dll_CreateBrushIndirect]
mov eax, dword [esp + 0x2f0]
mov dword [esp + 0x28], eax
mov dword [esp + 0x1c], 0xc204e2db
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001cf4c
push 0x1e8d
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PolyPolygon]
mov dword [esp + 0x1c], 0xffffffe6
jmp 0x1001cf9f
mov dword [esp + 0x20], 0x29bf39
cmp dword [esp + 0x1c], ebx
jne 0x1001cfa6
mov dword [esp + 0x20], ebx
jmp 0x1001cf94
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001cf90
push 0x4ac
push 0x188d
push 0x1aa8
push 0x16fe
push ebx
call dword [sym.imp.USER32.dll_SetRect]
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 0xf
jne 0x1001cf6a
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xc
jg 0x1001cf56
mov dword [esp + 0x10], 1
lea ecx, [esp + 0x250]
push 4
call fcn.1000bb6e
mov dword [esp + 0xe5c], 0xd
mov dword [esp + 0x28], 0x280643b8
mov dword [esp + 0x20], ebx
jmp 0x1001cfeb
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x250]
mov dword [eax + ecx*4], 0xfffffffa
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 4
jl 0x1001cfd5
mov dword [esp + 0x10], ebx
jmp 0x1001d016
mov dword [esp + 0x34], 0xfffffffe
xor ecx, ecx
mov eax, dword [esp + 0x34]
cmp eax, 0xe1ca
setne cl
mov dword [esp + 0x34], ecx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x12
jg 0x1001cff8
mov dword [esp + 0x28], 0x1f5f
cmp dword [esp + 0x28], 0x5a3
jge 0x1001d0ee
lea eax, [esp + 0x128]
push eax
lea eax, [esp + 0x88]
push eax
push 0x10007a00
call fcn.10050dfb
mov eax, dword [esp + 0x90]
add esp, 0xc
mov edi, ebx
test eax, eax
jle 0x1001d080
lea esi, [esp + 0x5c8]
push esi
push 0x100079f8
call fcn.10050dfb
mov eax, dword [esp + 0x8c]
inc edi
pop ecx
add esi, 4
pop ecx
cmp edi, eax
jl 0x1001d064
lea edx, [esp + 0x5c8]
mov byte [esp + 0xf8], bl
push dword [esp + 0xf8]
lea edx, [edx + eax*4]
mov eax, edx
lea ecx, [esp + 0x5cc]
sub eax, ecx
sar eax, 2
push eax
call fcn.1001f90c
pop ecx
pop ecx
mov ecx, dword [esp + 0x84]
mov esi, ebx
dec ecx
mov edx, ebx
js 0x1001d0de
cmp edx, ecx
jge 0x1001d0d8
mov eax, dword [esp + ecx*4 + 0x5c8]
add eax, dword [esp + edx*4 + 0x5c8]
cmp eax, dword [esp + 0x128]
jg 0x1001d0d8
dec ecx
inc esi
cmp edx, ecx
jle 0x1001d0be
push esi
push 0x100079ec
call fcn.1005118c
pop ecx
pop ecx
push 3
pop esi
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x10], esi
jg 0x1001d2e4
xor eax, eax
inc eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x1c], esi
cmp dword [esp + 0x1c], ebx
jl 0x1001d2d6
push 0xfffffffffffffff8
pop ecx
mov dword [esp + 0x100], ecx
mov dword [esp + 0x104], ecx
mov dword [esp + 0x108], ecx
mov dword [esp + 0x10c], ecx
mov dword [esp + 0x28], 0x60d2f38d
mov dword [esp + 0x28], 0xb9193c1d
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001d155
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
xor eax, eax
inc eax
mov dword [esp + 0x10c], esi
cmp dword [esp + 0x10c], ebx
jl 0x1001d2c9
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jle 0x1001d0ff
or dword [esp + 0xe5c], 0xffffffff
lea ecx, [esp + 0x250]
call fcn.1000bbf0
mov ecx, dword [esp + 0xe0]
test ecx, ecx
je 0x1001d31a
call fcn.1001ad8b
mov esi, eax
lea eax, [esp + 0x70]
push eax
mov dword [esp + 0x34], esi
call fcn.1001e382
mov dword [eax], esi
xor edx, edx
mov dword [esp + 0x24], 0x1bc7dcd6
inc edx
mov dword [esp + 0x20], edx
mov dword [esp + 0x34], 0xd3e99730
mov dword [esp + 0x10], ebx
jmp 0x1001d343
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x7c], edx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x1001d337
mov dword [esp + 0x10], ebx
jmp 0x1001d362
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x27c], 0xffffffff
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1001d34f
mov eax, dword [esp + 0x7c]
xor ecx, ecx
mov eax, dword [esp + 0x20]
cmp eax, edx
setle cl
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x7c]
mov eax, dword [esp + 0x24]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp eax, edx
setle cl
mov dword [esp + 0x7c], ecx
mov eax, dword [esp + 0x20]
imul eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x24]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [esp + 0x34], ecx
lea ecx, [esp + 0xdc]
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x24]
add eax, 0x138b
mov dword [esp + 0x27c], eax
call fcn.10017453
mov dword [esp + 0x18], 0x4c7af5af
lea ecx, [esp + 0x148]
mov dword [esp + 0x10], 0x495e
mov dword [esp + 0x1c], 0x5d5f
push 1
call fcn.1000bb6e
mov dword [esp + 0xe5c], 0x10
mov dword [esp + 0x28], 0x1e93
cmp dword [esp + 0x28], 0xa37
jge 0x1001d4f1
push 0x10660934
push 0x1066b89c
push 0x10007ac8
call fcn.10050dfb
mov ecx, dword [0x1066b89c]
add esp, 0xc
mov eax, ebx
mov dword [esp + 0x2c], eax
test ecx, ecx
jle 0x1001d4b6
mov edx, dword [0x10660934]
mov esi, 0x10664660
mov dword [esp + 0x38], esi
mov edi, ebx
test edx, edx
jle 0x1001d4a3
mov ebx, dword [esp + 0x2c]
add esi, edi
push esi
push 0x10007b74
call fcn.10050dfb
cmp byte [esi], 0x53
pop ecx
pop ecx
jne 0x1001d488
mov dword [0x1066f4b0], ebx
mov dword [0x1065cd1c], edi
mov edx, dword [0x10660934]
inc edi
mov esi, dword [esp + 0x38]
cmp edi, edx
jl 0x1001d468
mov ecx, dword [0x1066b89c]
xor ebx, ebx
mov eax, dword [esp + 0x2c]
inc eax
add esi, 0xab
mov dword [esp + 0x2c], eax
mov dword [esp + 0x38], esi
cmp eax, ecx
jl 0x1001d45e
mov esi, ebx
push 0x55aac
push ebx
push 0x106d14a0
call fcn.1004a674
mov edx, dword [0x1065cd1c]
add esp, 0xc
mov ecx, dword [0x1066f4b0]
push esi
push ebx
call fcn.1001add9
inc esi
pop ecx
pop ecx
cmp esi, 4
jl 0x1001d4b8
push 0x10007a38
call fcn.1005329d
pop ecx
xor edx, edx
inc edx
mov dword [esp + 0x34], edx
mov dword [esp + 0x20], ebx
jmp 0x1001d514
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x148]
mov dword [eax + ecx*4], 0xc19583e3
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edx
jl 0x1001d4fe
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
inc dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
dec eax
imul eax, dword [esp + 0x10]
imul eax, dword [esp + 0x10]
cmp eax, dword [esp + 0x18]
jge 0x1001d543
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
add eax, 0xffff
add eax, ecx
cmp eax, 2
mov eax, dword [esp + 0x10]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
setl dl
xor eax, eax
inc eax
cmp eax, edx
mov eax, dword [esp + 0x18]
sbb ecx, ecx
neg ecx
sub ecx, eax
jne 0x1001d580
cmp dword [esp + 0x10], ebx
jne 0x1001d580
mov eax, ebx
inc ecx
jmp 0x1001d585
xor ecx, ecx
inc ecx
mov eax, ecx
add dword [esp + 0x18], eax
je 0x1001d5a5
mov dword [esp + 0x28], 2
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x148]
mov dword [eax], ecx
jmp 0x1001d66f
mov dword [esp + 0x20], ecx
mov dword [esp + 0x28], 0xfffffff6
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x10], 0x30
jne 0x1001d66f
jmp 0x1001d5c5
xor ecx, ecx
inc ecx
mov dword [esp + 0x2c], 0x52324067
xor edx, edx
mov dword [esp + 0x38], ecx
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x20]
cmp eax, ecx
mov eax, dword [esp + 0x20]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x28]
setge cl
xor edx, edx
cmp ecx, 8
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x20]
setge cl
mov dword [esp + 0x4c], ecx
mov ecx, 0x2536
sub ecx, eax
cmp ecx, dword [esp + 0x4c]
jg 0x1001d62d
cmp dword [esp + 0x34], ebx
jne 0x1001d62d
xor eax, eax
inc eax
xor edx, edx
test eax, eax
mov eax, dword [esp + 0x10]
setle dl
xor ecx, ecx
cmp eax, edx
setle cl
cmp ecx, dword [esp + 0x38]
jge 0x1001d652
cmp dword [esp + 0x38], ebx
jne 0x1001d652
mov ecx, ebx
jmp 0x1001d657
xor eax, eax
lea ecx, [eax + 1]
mov eax, dword [esp + 0x148]
mov dword [eax], ecx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x30
je 0x1001d5c2
mov dword [esp + 0x18], 0x14
jmp 0x1001d689
mov dword [esp + 0x34], 9
dec dword [esp + 0x34]
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 0xc
jle 0x1001d679
or dword [esp + 0xe5c], 0xffffffff
lea ecx, [esp + 0x148]
call fcn.1000bbf0
mov esi, dword [esp + 0x30]
test esi, esi
je 0x1001dce2
xor eax, eax
mov dword [esp + 0x18], 0xfffffffd
inc eax
mov dword [esp + 0x1c], 0xfad7494d
push eax
lea ecx, [esp + 0x1d8]
call fcn.1000bb6e
xor edx, edx
mov dword [esp + 0x10], ebx
inc edx
jmp 0x1001d6e9
cmp dword [esp + 0x10], edx
jl 0x1001d6d9
push 4
lea ecx, [esp + 0x194]
call fcn.1000bb6e
xor eax, eax
mov dword [esp + 0xe5c], 0x13
inc eax
lea ecx, [esp + 0xa8]
push eax
call fcn.1000bb6e
mov dword [esp + 0x4c], 0x6840eb44
xor edx, edx
mov dword [esp + 0x28], 5
inc edx
mov dword [esp + 0x50], 0xffffffff
mov dword [esp + 0x28], edx
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x34], 0xffffffff
mov dword [esp + 0x18], ebx
jmp 0x1001dd56
cmp dword [esp + 0x18], 4
jl 0x1001dd40
call fcn.1000bbf0
mov eax, dword [ebp + 8]
lea esi, [esp + 0xc8]
mov ecx, dword [esp + 0xe54]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret