Function at 0x1001b71f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10089199
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2a8
push ebx
push esi
push edi
mov dword [esp + 0x14], 0x43cdf98a
xor ebx, ebx
mov dword [esp + 0xc], 0x4225189d
push 3
mov dword [esp + 0x2c], 0x31e34f9a
mov dword [esp + 0x108], edx
mov dword [esp + 0x58], ecx
mov dword [esp + 0x18], ebx
pop esi
jmp 0x1001b784
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x10c], 0x93b4e1a3
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x1001b771
xor edi, edi
mov dword [esp + 0x14], ebx
inc edi
jmp 0x1001b7a6
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x108], 0x9fcf
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x1001b793
mov dword [esp + 0x14], ebx
jmp 0x1001b868
mov dword [esp + 0x1c], 0xfffffffb
mov byte [esp + 0x23], bl
cmp byte [esp + 0x23], bl
je 0x1001b7ce
push ebx
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov eax, dword [esp + 0x14]
cmp dword [esp + eax*4 + 0x10c], ebx
jne 0x1001b848
mov eax, dword [esp + 0x14]
xor edx, edx
mov ecx, dword [esp + eax*4 + 0x10c]
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x10c], ecx
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + eax*4 + 0x10c]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
cmp ecx, eax
mov eax, dword [esp + 0x1c]
setle dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
sub ecx, 0x712bf5ea
cmp ecx, 0x5bea
setg al
cmp dword [esp + 0x108], eax
jle 0x1001b844
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + eax*4 + 0x10c]
mov eax, dword [esp + 0xc]
inc eax
mov dword [esp + 0x28], eax
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jle 0x1001b7b5
mov dword [esp + 0x10], 0x9d29be1d
mov dword [esp + 0x18], 0xef8a6ebb
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x14], ebx
jmp 0x1001b89d
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x40], ebx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x1001b891
mov dword [esp + 0x14], ebx
jmp 0x1001b8bc
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x20c], 0x6ffea1e1
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x1001b8a9
mov dword [esp + 0x10], ebx
jmp 0x1001ba01
mov dword [esp + 0x1c], 6
mov dword [esp + 0x14], 0xdf3d
mov dword [esp + 0x28], 0x21dd
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
inc dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x40]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x40]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x40]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + eax*4 + 0x40]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x40], ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x18], ebx
jmp 0x1001b9f3
mov dword [esp + 0xc], ebx
jmp 0x1001b956
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x24c], 0x7fefb659
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x1001b943
mov dword [esp + 0x14], ebx
jmp 0x1001b9e5
mov dword [esp + 0x34], 0xffffffff
xor ecx, ecx
mov eax, dword [esp + 0x28]
cmp eax, 0xfffffff9
setge cl
xor edx, edx
add ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x10]
cmp eax, ecx
mov eax, dword [esp + 0x14]
setl dl
xor ecx, ecx
mov dword [esp + eax*4 + 0x40], edx
mov dword [esp + 0x2c], edx
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x250], 0x4f0e
mov eax, dword [esp + 0x10]
cmp eax, edi
setg cl
xor eax, eax
cmp ecx, 0xfffe
setne al
imul eax, eax, 0x4f0e
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x34]
add eax, dword [esp + 0x1c]
mov dword [esp + 0x214], eax
mov eax, dword [esp + 0x10]
mov eax, dword [esp + eax*4 + 0x40]
mov dword [esp + 0x214], eax
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ebx
jle 0x1001b965
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ebx
jle 0x1001b93d
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ebx
jle 0x1001b8cc
mov byte [esp + 0x23], bl
cmp byte [esp + 0x23], bl
je 0x1001ba1c
push ebx
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov dword [esp + 0x14], 0x43cdf98a
mov dword [esp + 0x10], 0x5596960f
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x18], 0x8fbfc75d
mov dword [esp + 0x2c], edi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x24], 0x67d
mov dword [esp + 0x14], ebx
jmp 0x1001ba66
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x58], edi
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x1001ba5a
mov dword [esp + 0x14], ebx
jmp 0x1001ba82
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x4c], 0xfffffff7
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x1001ba72
push 2
pop ecx
mov dword [esp + 0x10], ecx
cmp dword [esp + 0x10], ebx
jl 0x1001bade
mov dword [esp + 0xc], 0xe08974b6
mov dword [esp + 0x28], ebx
mov eax, dword [esp + 0x10]
cmp dword [esp + eax*4 + 0x58], ebx
jne 0x1001bade
mov dword [esp + 0xc], ecx
cmp dword [esp + 0xc], ebx
jl 0x1001bad8
mov eax, dword [esp + 0x10]
cmp dword [esp + eax*4 + 0x58], 7
jae 0x1001bacc
mov eax, dword [esp + 0xc]
cmp dword [esp + eax*4 + 0x58], ebx
mov eax, ebx
je 0x1001bace
mov eax, edi
mov dword [esp + 0x28], eax
dec dword [esp + 0xc]
jns 0x1001bab5
dec dword [esp + 0x10]
jns 0x1001ba95
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x10], ecx
jg 0x1001bc0b
mov dword [esp + 0xc], ecx
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x24], 0xda6c2e3a
mov dword [esp + 0x34], 0xfffffffb
mov eax, dword [esp + 0x10]
mov eax, dword [esp + eax*4 + 0x58]
mov eax, dword [esp + 0xc]
inc dword [esp + 0x2c]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + eax*4 + 0x58]
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x30], ebx
mov eax, dword [esp + 0x5c]
mov ecx, dword [esp + 0x30]
sub ecx, eax
mov eax, dword [esp + 0x10]
neg ecx
sbb ecx, ecx
xor edx, edx
add ecx, 0xfffffffd
cmp ecx, eax
mov eax, dword [esp + 0x10]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x10]
setne cl
xor edx, edx
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + eax*4 + 0x58]
sub ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x4c]
cmp ecx, eax
mov eax, dword [esp + 0x10]
setge dl
xor ecx, ecx
mov eax, dword [esp + eax*4 + 0x58]
cmp eax, edx
mov edx, dword [esp + 0x4c]
mov eax, dword [esp + 0x10]
setl cl
add edx, ecx
xor ecx, ecx
mov esi, dword [esp + eax*4 + 0x58]
mov eax, dword [esp + 0x34]
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, esi
mov ecx, edi
setg al
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0xc]
sub ecx, eax
add ecx, dword [esp + 0x60]
je 0x1001bbdb
mov dword [esp + 0xc], ebx
jmp 0x1001bbcc
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x88], 0xeb1ec6c0
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x1001bbb9
inc dword [esp + 0x88]
jmp 0x1001bbf7
mov dword [esp + 0x1c], ebx
jmp 0x1001bbf1
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x4c], 0xfffffffd
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edi
jl 0x1001bbe1
inc dword [esp + 0x10]
push 2
pop ecx
cmp dword [esp + 0x10], ecx
jle 0x1001baec
push 3
pop esi
mov dword [esp + 0x30], 0x4225189d
mov dword [esp + 0x14], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x34], 8
mov dword [esp + 0x24], 7
mov dword [esp + 0x14], 0xfffffff5
jmp 0x1001be71
mov dword [esp + 0x10], 0xac488899
mov dword [esp + 0x18], 0xffffffff
mov byte [esp + 0x23], bl
cmp byte [esp + 0x23], bl
je 0x1001bc5f
push 0x1a61
push ebx
push ebx
call dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
mov eax, dword [esp + 0x10]
xor edx, edx
mov eax, dword [esp + 0x14]
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
cmp eax, ecx
setle dl
xor eax, eax
cmp edx, 0xd373
setl al
xor edx, edx
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
cmp ecx, eax
setl dl
xor ecx, ecx
imul edx, dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
cmp eax, edx
setl cl
xor eax, eax
cmp ecx, 0x14ff
mov ecx, dword [esp + 0x10]
setl al
xor edx, edx
sub ecx, eax
add ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
cmp eax, ecx
mov eax, dword [esp + 0x10]
setge dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x10]
cmp eax, dword [esp + 0x14]
jne 0x1001bce9
mov ecx, ebx
cmp dword [esp + 0x1c], ebx
je 0x1001bceb
mov ecx, edi
mov eax, dword [esp + 0x14]
sub ecx, eax
je 0x1001bd9d
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0xc], esi
mov dword [esp + 0x18], ebx
jmp 0x1001bd8d
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x1c], 0xfffffff2
jmp 0x1001bd82
mov dword [esp + 0x38], 0xd3cc
mov eax, dword [esp + 0x14]
sub eax, 0x422b7bf9
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x18]
neg eax
sbb eax, eax
xor edx, edx
neg eax
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x18]
cmp eax, ecx
setl dl
cmp dword [esp + 0x14], edx
je 0x1001bd62
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x10], ebx
xor edx, edx
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x10]
cmp eax, ecx
setl dl
imul edx, dword [esp + 0x1c]
mov dword [esp + 0xc], edx
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0x1b
je 0x1001bd1e
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 0xffffffe6
je 0x1001bd0c
jmp 0x1001be6d
mov dword [esp + 0x2c], edi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x10], ebx
jmp 0x1001be62
mov dword [esp + 0x28], 0x7f1a9f13
mov dword [esp + 0x24], 0x1f15f1d3
mov dword [esp + 0xc], ebx
jmp 0x1001bdd3
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x17c], edi
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x1001bdc4
mov eax, dword [esp + 0x10]
mov dword [esp + 0x184], eax
test eax, eax
jne 0x1001be04
mov eax, dword [esp + 0x17c]
mov ecx, ebx
add eax, dword [esp + 0x2c]
imul eax, eax, 0x67b3
cmp eax, dword [esp + 0x184]
jg 0x1001be06
mov ecx, edi
mov eax, dword [esp + 0x34]
xor edx, edx
mov eax, dword [esp + 0x10]
imul ecx, ecx, 6
cmp ecx, eax
mov eax, dword [esp + 0x18]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x14]
setg cl
mov dword [esp + 0x38], ecx
xor ecx, ecx
cmp dword [esp + 0x38], eax
setl cl
mov dword [esp + 0x2c], ecx
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x34], eax
cmp dword [esp + 0x34], ebx
je 0x1001be56
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
mov dword [esp + 0x24], eax
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xffffffe9
jne 0x1001bdae
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0xfffffffa
jg 0x1001bc38
mov dword [esp + 0x24], 0x31e34f9a
lea ecx, [esp + 0x9c]
mov dword [esp + 0x14], 0xc4b4
mov dword [esp + 0x10], 0xdb8faaae
mov dword [esp + 0x18], 0xbb94d0f
mov dword [esp + 0x1c], 0xffffffff
push esi
call fcn.10019553
mov dword [esp + 0x28], 5
mov dword [esp + 0xc], ebx
jmp 0x1001bed5
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x9c]
mov dword [eax + ecx*4], 0x4c57
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x1001bebf
mov byte [esp + 0x23], bl
cmp byte [esp + 0x23], bl
je 0x1001beec
push ebx
call dword [sym.imp.GDI32.dll_GetObjectType]
cmp dword [esp + 0x10], ebx
jne 0x1001bf3e
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x10]
sub edx, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
neg edx
sbb edx, edx
xor ecx, ecx
add edx, 0xffffcd0e
cmp eax, edx
setge cl
cmp ecx, dword [esp + 0x18]
jl 0x1001bf21
mov edx, ebx
cmp dword [esp + 0x10], ebx
je 0x1001bf23
mov edx, edi
mov eax, dword [esp + 0x18]
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x14], ebx
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x10], 0x11f3813b
je 0x1001c0f3
mov dword [esp + 0x34], 0xfffffffc
mov dword [esp + 0x28], 8
mov dword [esp + 0x28], 0x545435d7
mov dword [esp + 0xc], ebx
jmp 0x1001bf85
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x80], ebx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x1001bf76
mov dword [esp + 0x10], 2
cmp dword [esp + 0x10], ebx
jl 0x1001c0c2
mov edi, dword [esp + 0x9c]
mov dword [esp + 0x2c], 8
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 0xc], ebx
jmp 0x1001bfcd
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x118], 0xd55e0ecf
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 1
jl 0x1001bfba
mov eax, dword [esp + 0x34]
xor ecx, ecx
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x34]
mov dword [esp + 0x80], edx
mov eax, dword [esp + 0x18]
cmp edx, eax
setg cl
cmp dword [esp + 0x34], ecx
jg 0x1001c00d
cmp dword [esp + 0x80], ebx
jne 0x1001c00d
mov edx, ebx
jmp 0x1001c010
xor edx, edx
inc edx
mov eax, dword [esp + 0x14]
xor ecx, ecx
cmp eax, edx
setg cl
xor edx, edx
mov dword [esp + 0x118], ecx
mov dword [esp + 0x28], ecx
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x10]
cmp ecx, eax
mov eax, dword [esp + 0x9c]
setl dl
sub edx, dword [eax + esi*4]
mov dword [esp + 0xc], edx
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x2c]
neg ecx
sbb ecx, ecx
neg ecx
imul eax, ecx
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
xor edx, edx
mov dword [esp + 0x28], ecx
mov eax, dword [esp + 0x28]
mov dword [esp + 0x28], eax
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x1c]
cmp ecx, eax
setge dl
neg edx
cmp edx, dword [esp + 0x1c]
jg 0x1001c087
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x2c]
cmp dword [esp + 0x18], ebx
je 0x1001c0a1
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x9c]
mov ecx, dword [edi + 8]
mov dword [eax + edx*4], ecx
dec dword [esp + 0x10]
jns 0x1001bfa4
xor edi, edi
push 3
inc edi
pop esi
mov byte [esp + 0x23], bl
cmp byte [esp + 0x23], bl
je 0x1001c18e
push 0x1bfa
push 0x13af
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
jmp 0x1001c18e
mov eax, dword [esp + 0x9c]
mov dword [esp + 0x1c], 0xefab
mov dword [esp + 0x28], 0x80bfd780
mov dword [esp + 0x24], 0x949e3b93
cmp dword [eax], ebx
je 0x1001c173
cmp dword [esp + 0x1c], ebx
jne 0x1001c16b
mov eax, dword [esp + 0x1c]
xor ecx, ecx
cmp eax, 0x35d
setne cl
sub ecx, dword [esp + 0x1c]
sub ecx, dword [esp + 0x1c]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x1c]
cmp ecx, eax
setl dl
xor ecx, ecx
imul edx, dword [esp + 0x1c]
add edx, dword [esp + 0x18]
imul eax, edx, 0xffff
cmp eax, 0xccc4
mov eax, dword [esp + 0x1c]
setge cl
sub eax, ecx
je 0x1001c16f
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x1c]
xor edx, edx
mov eax, dword [esp + 0x18]
cmp eax, ecx
setl dl
mov dword [esp + 0x10], edx
mov eax, dword [esp + 0x10]
mov dword [esp + 0x24], eax
lea ecx, [esp + 0x9c]
call fcn.10019e13
mov dword [esp + 0x18], ebx
jmp 0x1001c1b3
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0xc0], 0x93b4e1a3
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jl 0x1001c1a0
mov dword [esp + 0x1c], 0xfffffff9
lea ecx, [esp + 0x1ac]
push edi
call fcn.10019553
mov dword [esp + 0x2bc], ebx
mov dword [esp + 0xc], ebx
jmp 0x1001c1ee
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x1ac]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x1001c1db
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x1c], 0xf
jmp 0x1001c2c1
mov dword [esp + 0xc], ebx
jmp 0x1001c21f
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x48], 0xbf390197
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x1001c20f
mov dword [esp + 0x48], ebx
cmp dword [esp + 0x48], 6
jl 0x1001c2b9
push esi
lea ecx, [esp + 0x1ec]
call fcn.10019553
mov dword [esp + 0xc], ebx
jmp 0x1001c259
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x1e8]
mov dword [eax + ecx*4], edi
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x1001c247
mov esi, dword [esp + 0x1e8]
mov dword [esi + 8], ebx
mov byte [esp + 0x23], bl
cmp byte [esp + 0x23], 0
je 0x1001c282
push edi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetSystemMenu]
mov ecx, dword [esi + 8]
mov eax, dword [esp + 0x1ac]
cmp dword [eax + ecx*4], ebx
jne 0x1001c29b
lea eax, [ecx - 1]
mov dword [esi + 8], eax
test eax, eax
jns 0x1001c269
lea ecx, [esp + 0x1e8]
call fcn.10019e13
inc dword [esp + 0x48]
cmp dword [esp + 0x48], 6
push 3
pop esi
jge 0x1001c234
mov eax, dword [esp + 0x48]
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xffffffef
jge 0x1001c209
or dword [esp + 0x2bc], 0xffffffff
lea ecx, [esp + 0x1ac]
call fcn.10019e13
mov dword [esp + 0x18], ebx
jmp 0x1001c2f9
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x120], 0x9fcf
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x1001c2e6
push dword [esp + 0x54]
movdqa xmm0, xmmword [0x100098c0]
lea eax, [esp + 0x230]
push eax
lea eax, [esp + 0x224]
mov dword [esp + 0x18], 0x38e8
push eax
mov dword [esp + 0x20], 0xfffffffe
lea ecx, [esp + 0xc0]
mov dword [esp + 0x28], edi
push ebx
movdqu xmmword [esp + 0x22c], xmm0
mov dword [esp + 0xc4], ebx
mov dword [esp + 0xc8], ebx
mov dword [esp + 0xcc], ebx
call fcn.1001ac0b
mov dword [esp + 0x2bc], edi
mov dword [esp + 0x24], 0xfffffff6
mov byte [esp + 0x23], bl
cmp byte [esp + 0x23], 0
je 0x1001c37b
push ebx
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], ebx
je 0x1001c399
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
xor edx, edx
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
test eax, eax
mov eax, dword [esp + 0x10]
sets dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x10]
setg cl
add eax, 0x3c17
add eax, ecx
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x1c], ebx
je 0x1001c456
mov dword [esp + 0x1c], ebx
jmp 0x1001c434
mov dword [esp + 0x14], 9
jmp 0x1001c429
mov dword [esp + 0x10], ebx
jmp 0x1001c41e
mov dword [esp + 0x18], 0x17530975
mov dword [esp + 0x18], ebx
jmp 0x1001c413
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0xb4]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 4
jl 0x1001c400
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 7
jl 0x1001c3f2
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0x10
jge 0x1001c3ec
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0x16
jle 0x1001c3e2
mov byte [esp + 0x23], bl
cmp byte [esp + 0x23], 0
je 0x1001c4c2
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_TranslateMDISysAccel]
jmp 0x1001c4c2
push edi
lea ecx, [esp + 0x1f8]
call fcn.10019553
mov dword [esp + 0x24], 8
mov dword [esp + 0xc], ebx
jmp 0x1001c487
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x1f4]
mov dword [eax + ecx*4], 0xc97de2e5
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x1001c471
mov eax, dword [esp + 0x1f4]
xor ecx, ecx
mov eax, dword [eax]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
cmp eax, 0xa026
setne cl
add ecx, esi
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0x1f4]
call fcn.10019e13
or dword [esp + 0x2bc], 0xffffffff
lea ecx, [esp + 0xb4]
call fcn.10019e13
mov dword [esp + 0x14], ebx
cmp dword [esp + 0x14], 2
jg 0x1001c81f
push 2
pop edi
push 4
lea ecx, [esp + 0x128]
call fcn.10019553
mov dword [esp + 0x24], 0xc4888999
mov dword [esp + 0x24], 6
mov dword [esp + 0x2c], 0x9c25b054
mov dword [esp + 0x38], 0xfffb
mov dword [esp + 0x18], ebx
jmp 0x1001c532
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x124]
mov dword [eax + ecx*4], 0x3eee2fde
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 4
jl 0x1001c51c
mov dword [esp + 0x18], ebx
jmp 0x1001c552
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x15c], 0x13281d21
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x1001c53f
mov byte [esp + 0x23], bl
cmp byte [esp + 0x23], 0
je 0x1001c569
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
mov edi, dword [esp + 0x124]
mov ecx, dword [esp + 0x2c]
mov eax, dword [edi + 0xc]
inc dword [esp + 0x2c]
cmp eax, ecx
jle 0x1001c58a
mov eax, dword [esp + 0x124]
cmp dword [eax], ebx
je 0x1001c594
cmp dword [edi + 0xc], ebx
je 0x1001c594
xor esi, esi
inc esi
jmp 0x1001c596
mov esi, ebx
mov edx, dword [esp + 0x24]
sub edx, dword [edi + 0xc]
mov eax, dword [esp + 0x38]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setle cl
xor eax, eax
cmp esi, ecx
lea ecx, [esp + 0x124]
sete al
imul eax, dword [esp + 0x160]
mov dword [esp + 0x15c], eax
call fcn.10019e13
mov dword [esp + 0x1c], 0xfffffffb
push 3
mov dword [esp + 0x1c], 0xfffffffc
mov dword [esp + 0x10], ebx
pop esi
jmp 0x1001c5fb
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x270], 0xfc88eb98
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x1001c5e8
mov dword [esp + 0x18], 0xffffffe6
jmp 0x1001c63b
mov dword [esp + 0xc], 8
mov dword [esp + 0x24], 0x34eea2a3
mov dword [esp + 0xc], ebx
jmp 0x1001c630
mov eax, dword [esp + 0x24]
mov dword [esp + 0x274], eax
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 0x14
jg 0x1001c621
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jle 0x1001c60b
mov byte [esp + 0x22], bl
push 2
mov dword [esp + 0x10], 0xc75b57fd
pop edi
mov dword [esp + 0xc], edi
cmp dword [esp + 0xc], 0x1c
jge 0x1001c6d2
mov byte [esp + 0x23], bl
cmp byte [esp + 0x23], 0
je 0x1001c6a7
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
push 0x2fa
push 0xa07
push 0x607
call esi
mov edi, dword [sym.imp.USER32.dll_GetDC]
push eax
call edi
push eax
push 0x570
push 0x49b
push 0x1158
push 0x1b52
call esi
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
mov byte [esp + 0x23], bl
cmp byte [esp + 0x23], 0
je 0x1001c6c1
push ebx
push 0x1872
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 0x1c
jl 0x1001c65b
push 3
pop esi
push 2
pop edi
cmp byte [esp + 0x22], 0
je 0x1001c778
mov dword [esp + 0x24], 6
mov dword [esp + 0x24], ebx
mov dword [esp + 0x24], 0xfffffff8
mov dword [esp + 0x24], 0x2b5f7919
mov dword [esp + 0x24], 0x6e2c9bf5
mov dword [esp + 0x28], 0xab8a87ea
mov dword [esp + 0x10], ebx
jmp 0x1001c722
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x29c], 0x52061f6
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x1001c70f
mov dword [esp + 0x10], ebx
jmp 0x1001c741
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x154], 1
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x1001c72e
mov dword [esp + 0x10], ebx
jmp 0x1001c760
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x294], 1
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x1001c74d
inc dword [esp + 0x158]
inc dword [esp + 0x28]
push ebx
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov eax, dword [esp + 0x14]
cmp dword [esp + eax*4 + 0xc0], ebx
jne 0x1001c7f2
mov eax, dword [esp + 0x14]
xor edx, edx
mov ecx, dword [esp + eax*4 + 0xc0]
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0xc0], ecx
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + eax*4 + 0xc0]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
cmp ecx, eax
mov eax, dword [esp + 0x1c]
setle dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
sub ecx, 0x712bf5ea
cmp ecx, 0x5bea
setg al
cmp dword [esp + 0x120], eax
jle 0x1001c7ee
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + eax*4 + 0xc0]
mov eax, dword [esp + 0x30]
inc eax
mov dword [esp + 0x24], eax
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jle 0x1001c4e8
xor edi, edi
inc edi
mov dword [esp + 0x14], 0xb26bdde0
mov dword [esp + 0x14], ebx
jmp 0x1001c998
push esi
lea ecx, [esp + 0xd4]
call fcn.10019553
mov dword [esp + 0x18], ebx
jmp 0x1001c859
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0xd0]
mov dword [eax + ecx*4], 0x6318d581
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jl 0x1001c843
push 2
mov dword [esp + 0x1c], ebx
pop ecx
jmp 0x1001c878
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x70], 0xfb023ed1
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ecx
jl 0x1001c868
mov dword [esp + 0x74], ecx
cmp dword [esp + 0x74], ebx
jl 0x1001c912
mov dword [esp + 0xc], ebx
jmp 0x1001c8a5
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x13c], 0x46cdead9
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x1001c892
mov dword [esp + 0x140], ecx
cmp dword [esp + 0x140], ebx
jl 0x1001c904
mov dword [esp + 0xc], 0x8fdeb772
mov dword [esp + 0xc], ebx
jmp 0x1001c8f5
mov byte [esp + 0x22], bl
cmp byte [esp + 0x22], 0
je 0x1001c8f1
push 0x197c
push 0x168d
push 0x252
push 0x8fa
call dword [sym.imp.GDI32.dll_CreateRectRgn]
push 2
pop ecx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], ecx
jle 0x1001c8c9
dec dword [esp + 0x140]
jns 0x1001c8bb
mov eax, dword [esp + 0x74]
dec dword [esp + 0x74]
jns 0x1001c88c
cmp dword [esp + 0x14], ebx
je 0x1001c971
mov eax, dword [esp + 0x14]
xor ecx, ecx
cmp eax, 0x23f1
mov eax, dword [esp + 0x14]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x14]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0xd0]
setle cl
xor edx, edx
cmp dword [eax + 8], ecx
mov eax, dword [esp + 0x14]
setne dl
xor ecx, ecx
imul eax, edx
mov edx, edi
cmp eax, 0x8a2b8ea2
mov eax, dword [esp + 0xd0]
setne cl
mov dword [esp + 0x74], ecx
sub ecx, dword [eax]
cmp ecx, dword [esp + 0x14]
jg 0x1001c973
mov edx, ebx
mov eax, dword [esp + 0x14]
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0xd0]
setge cl
mov dword [eax + 4], ecx
lea ecx, [esp + 0xd0]
call fcn.10019e13
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jne 0x1001c830
mov dword [esp + 0x18], 0x31713b91
mov dword [esp + 0x30], 2
mov dword [esp + 0x28], 0x9be5411a
mov dword [esp + 0x2c], 0xfffffff7
mov dword [esp + 0x34], 0xffffffff
mov dword [esp + 0x24], 6
mov dword [esp + 0x18], ebx
jmp 0x1001ca98
mov dword [esp + 0x1c], 0x7be7e550
mov dword [esp + 0xc], 0x7582ba8d
mov dword [esp + 0x2c], 8
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x30]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
sub eax, dword [esp + 0x28]
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x28]
sub ecx, eax
mov dword [esp + 0xc], ecx
xor ecx, ecx
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x1c]
cmp eax, 0xcd02
setg cl
imul eax, ecx, 0x3afd
test eax, eax
je 0x1001ca3f
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x1c]
xor ecx, ecx
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x1c]
imul edx, dword [esp + 0x34]
add edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
cmp edx, eax
setne cl
xor eax, eax
cmp ecx, 0xfffffff7
setle al
xor ecx, ecx
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
test eax, eax
setle cl
mov dword [esp + 0x24], ecx
cmp dword [esp + 0x2c], ebx
jne 0x1001caa3
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 0xfffffff4
jl 0x1001c9dc
mov dword [esp + 0x164], ebx
lea ecx, [esp + 0x200]
mov dword [esp + 0x168], ebx
mov dword [esp + 0x16c], ebx
mov dword [esp + 0x170], ebx
push 2
call fcn.10019553
mov dword [esp + 0x2bc], 2
lea ecx, [esp + 0x1c4]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x24], 0x1920
push edi
call fcn.10019553
mov dword [esp + 0x24], 0xfffffffb
mov dword [esp + 0x10], ebx
jmp 0x1001cb11
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x200]
mov dword [eax + ecx*4], esi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1001caff
mov dword [esp + 0x10], ebx
jmp 0x1001cb2d
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x2a4], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x1001cb1e
mov dword [esp + 0x10], ebx
jmp 0x1001cb4c
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0xcc], 0x2b7b88cd
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x1001cb39
mov dword [esp + 0x10], ebx
jmp 0x1001cb6a
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x1c4]
mov dword [eax + ecx*4], edi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x1001cb58
mov esi, dword [esp + 0x168]
xor edx, edx
mov eax, dword [esp + 0x200]
mov dword [eax], esi
mov eax, dword [esp + 0x164]
test eax, eax
mov eax, dword [esp + 0x1c4]
setle dl
xor ecx, ecx
cmp edx, dword [eax]
setge cl
lea eax, [ecx + esi]
mov dword [esp + 0xcc], eax
lea ecx, [esp + 0x1c4]
mov dword [esp + 0x24], eax
call fcn.10019e13
or dword [esp + 0x2bc], 0xffffffff
lea ecx, [esp + 0x200]
call fcn.10019e13
mov dword [esp + 0x14], 0x9d29be1d
mov dword [esp + 0x10], 0xef8a6ebb
mov dword [esp + 0x38], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x18], ebx
jmp 0x1001cbf4
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x3c], ebx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x1001cbe8
mov dword [esp + 0x18], ebx
jmp 0x1001cc13
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x23c], 0x6ffea1e1
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 4
jl 0x1001cc00
mov dword [esp + 0x14], ebx
jmp 0x1001cd59
mov dword [esp + 0x1c], 6
mov dword [esp + 0x18], 0xdf3d
mov dword [esp + 0x24], 0x21dd
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
inc dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + eax*4 + 0x3c]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x3c], ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x10], ebx
jmp 0x1001cd4b
mov dword [esp + 0xc], ebx
jmp 0x1001ccad
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x288], 0x7fefb659
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x1001cc9a
mov dword [esp + 0x18], ebx
jmp 0x1001cd3d
mov dword [esp + 0x2c], 0xffffffff
xor ecx, ecx
mov eax, dword [esp + 0x24]
cmp eax, 0xfffffff9
setge cl
xor edx, edx
add ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x14]
cmp eax, ecx
mov eax, dword [esp + 0x18]
setl dl
xor ecx, ecx
mov dword [esp + eax*4 + 0x3c], edx
mov dword [esp + 0x28], edx
mov eax, dword [esp + 0x28]
mov dword [esp + 0x28c], 0x4f0e
mov eax, dword [esp + 0x14]
cmp eax, edi
setg cl
xor eax, eax
cmp ecx, 0xfffe
setne al
imul eax, eax, 0x4f0e
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x2c]
add eax, dword [esp + 0x1c]
mov dword [esp + 0x244], eax
mov eax, dword [esp + 0x14]
mov eax, dword [esp + eax*4 + 0x3c]
mov dword [esp + 0x244], eax
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ebx
jle 0x1001ccbd
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ebx
jle 0x1001cc94
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ebx
jle 0x1001cc23
mov byte [esp + 0x22], bl
cmp byte [esp + 0x22], 0
je 0x1001cd75
push ebx
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push 3
mov dword [esp + 0x10], ebx
pop esi
jmp 0x1001cd91