Function at 0x1001dffd
Capabilities:
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1006f6fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x268
push ebx
xor ebx, ebx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0xc], ebx
push esi
mov dword [esp + 0x1c], 0xfffffffb
mov esi, edx
mov eax, dword [esp + 0x10]
push edi
mov dword [esp + 0x44], esi
cmp dword [esp + 0x14], ebx
je 0x1001e047
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x14], 1
je 0x1001e0a0
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], al
je 0x1001e077
push ebx
call dword [sym.imp.USER32.dll_ShowCursor]
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], bl
je 0x1001e0ac
push ebx
push 0x257a
push 0x2596
push ebx
push 0x1ff3
push 0x17bf
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x1001e0ac
mov dword [esp + 0x20], 0x7ee3
inc dword [esp + 0x20]
push 4
pop edi
push edi
lea ecx, [esp + 0x150]
call fcn.1000f096
push edi
lea ecx, [esp + 0x144]
mov dword [esp + 0x280], ebx
call fcn.1000f096
mov dword [esp + 0x3c], 9
mov eax, 0x66bc657e
mov dword [esp + 0x28], 0xedb5cabf
mov dword [esp + 0x10], 1
mov dword [esp + 0x194], eax
mov dword [esp + 0x198], eax
mov dword [esp + 0x19c], eax
mov dword [esp + 0x1a0], eax
mov dword [esp + 0x1c], ebx
jmp 0x1001e125
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14c]
mov dword [eax + ecx*4], 0x482
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edi
jl 0x1001e10f
mov dword [esp + 0x1c], ebx
jmp 0x1001e147
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x140]
mov dword [eax + ecx*4], 0x845d811f
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edi
jl 0x1001e131
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001e176
push 0x210a
push 0x1c89
push 0x136d
call edi
push eax
call dword [sym.imp.USER32.dll_CheckRadioButton]
mov ecx, dword [esp + 0x14c]
mov eax, dword [esp + 0x140]
push 5
pop edx
mov dword [ecx + 4], edx
mov dword [eax + 0xc], edx
mov dword [esp + 0x3c], edx
xor edx, edx
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x3c]
cmp dword [ecx + 4], eax
mov eax, dword [esp + 0x10]
setge dl
xor ecx, ecx
cmp eax, 0xfffffff7
setne cl
xor eax, eax
cmp edx, ecx
lea ecx, [esp + 0x140]
sete al
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x198], eax
call fcn.1000f6c9
or dword [esp + 0x27c], 0xffffffff
lea ecx, [esp + 0x14c]
call fcn.1000f6c9
mov eax, dword [0x11232960]
test al, 1
jne 0x1001e294
xor ecx, ecx
inc ecx
or eax, ecx
mov dword [0x11232960], eax
push ebx
mov dword [esp + 0x280], ecx
push ebx
mov dword [0x11232940], ebx
mov dword [0x11232944], ebx
call fcn.10020a54
mov dword [0x11232940], eax
mov dword [0x11232948], ebx
mov dword [0x11232950], ebx
mov byte [esp + 0x27c], 3
mov ecx, 0x11232948
mov dword [esp + 0x110], eax
lea eax, [esp + 0x110]
push eax
push 0x10
push ebx
lea eax, [esp + 0x1d8]
mov dword [0x1123295c], 0x3f800000
push eax
mov dword [0x1123294c], ebx
call fcn.1002082c
push 0x100706be
mov dword [0x11232954], 7
mov dword [0x11232958], 8
call fcn.10054da2
or dword [esp + 0x280], 0xffffffff
pop ecx
imul eax, dword [esp + 0x54], 0x2710
add eax, esi
mov dword [esp + 0x74], eax
lea eax, [esp + 0x74]
push eax
call fcn.10020001
mov eax, dword [eax]
test eax, eax
je 0x1001e2be
mov dword [esp + 0xd4], eax
jmp 0x1001fa17
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x2c], 0x68c0aa39
mov dword [esp + 0x24], 0x8eb98764
mov dword [esp + 0x1c], 0xa7ef5d87
mov dword [esp + 0x3c], 0x8af8716b
mov dword [esp + 0x10], ebx
jmp 0x1001e2fc
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x78], 0xfffffff7
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 1
jl 0x1001e2ec
mov eax, dword [esp + 0x14]
xor edx, edx
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
cmp ecx, eax
setle dl
mov dword [esp + 0x3c], edx
xor edx, edx
mov ecx, dword [esp + 0x3c]
mov eax, dword [esp + 0x1c]
cmp eax, ecx
mov eax, dword [esp + 0x24]
setl dl
xor ecx, ecx
cmp edx, 0x47d2
setne cl
sub eax, ecx
je 0x1001e354
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
xor edx, edx
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x14]
cmp eax, 1
mov eax, dword [esp + 0x14]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x2c]
setl cl
sub eax, ecx
mov ecx, 0x8aab5641
cmp ecx, eax
sbb eax, eax
neg eax
imul eax, dword [esp + 0x14]
test eax, eax
je 0x1001e51f
mov dword [esp + 0x10], ebx
jmp 0x1001e3a3
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x64], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 1
jl 0x1001e397
mov dword [esp + 0x2c], 0xffffffe2
jmp 0x1001e4fb
push 4
lea ecx, [esp + 0xa4]
call fcn.1000f096
mov dword [esp + 0x3c], 0xa35e06c0
mov dword [esp + 0x10], ebx
jmp 0x1001e3e9
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xa0]
mov dword [eax + ecx*4], 0xa7d2ae85
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x1001e3d3
mov dword [esp + 0x24], ebx
jmp 0x1001e4e0
mov dword [esp + 0x28], 4
mov dword [esp + 0xc], 1
mov dword [esp + 0x20], 5
mov dword [esp + 0x3c], 0x5372a718
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001e42a
call dword [sym.imp.USER32.dll_DestroyCaret]
mov dword [esp + 0x1c], 3
cmp dword [esp + 0x1c], ebx
jl 0x1001e4dc
mov eax, dword [esp + 0x2c]
xor edx, edx
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x78]
cmp ecx, eax
setge dl
neg edx
mov dword [esp + 0xc], edx
mov eax, dword [esp + 0xc]
mov dword [esp + 0x3c], ebx
mov esi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0xa0]
mov edx, dword [esp + 0xa0]
imul ecx, dword [eax]
sub ecx, dword [edx + esi*4]
jne 0x1001e48b
mov eax, dword [esp + 0x64]
mov eax, dword [esp + 0x1c]
mov esi, dword [esp + 0x1c]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0xa0]
mov eax, dword [esp + 0x64]
push 0
cmp eax, dword [ecx + edx*4]
mov eax, dword [esp + 0xa4]
pop ecx
setle cl
xor edx, edx
cmp dword [eax + esi*4], ecx
setg dl
sub edx, 0x3b8f
mov dword [esp + 0x3c], edx
je 0x1001e4ca
mov eax, dword [esp + 0x64]
mov eax, dword [esp + 0xc]
mov dword [esp + 0x3c], eax
dec dword [esp + 0x1c]
jns 0x1001e43c
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 3
jle 0x1001e3f9
lea ecx, [esp + 0xa0]
call fcn.1000f6c9
inc dword [esp + 0x2c]
cmp dword [esp + 0x2c], 0xfffffff6
jl 0x1001e3b7
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001e535
push ebx
push 0x1874
call dword [sym.imp.GDI32.dll_CreateHatchBrush]
jmp 0x1001e535
mov dword [esp + 0x1c], ebx
cmp dword [esp + 0x1c], ebx
jl 0x1001e535
cmp dword [esp + 0x78], ebx
jne 0x1001e535
dec dword [esp + 0x1c]
jns 0x1001e529
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001e57b
push 0xa4
push 0xd9b
push 0x1b08
call edi
mov esi, dword [sym.imp.USER32.dll_GetDC]
push eax
call esi
push eax
push 0x543
push 0x2599
push 0x1219
push 0x9b7
call edi
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [0x11232960]
push 2
pop esi
test al, 2
jne 0x1001e624
or eax, esi
mov dword [0x11232960], eax
push ebx
mov dword [esp + 0x280], 4
push ebx
mov dword [0x11232920], ebx
mov dword [0x11232924], ebx
call fcn.10020a54
mov dword [0x11232920], eax
mov dword [0x11232928], ebx
mov dword [0x11232930], ebx
mov byte [esp + 0x27c], 6
mov ecx, 0x11232928
mov dword [esp + 0x114], eax
lea eax, [esp + 0x114]
push eax
push 0x10
push ebx
lea eax, [esp + 0xec]
mov dword [0x1123293c], 0x3f800000
push eax
mov dword [0x1123292c], ebx
call fcn.1002082c
push 0x100706b9
mov dword [0x11232934], 7
mov dword [0x11232938], 8
call fcn.10054da2
or dword [esp + 0x280], 0xffffffff
pop ecx
mov dword [esp + 0x30], ebx
lea ecx, [esp + 0x1dc]
mov dword [esp + 0x30], 0x532fe223
mov dword [esp + 0x30], ebx
mov dword [esp + 0x30], 0x20002526
mov dword [esp + 0x30], 0x18795010
mov dword [esp + 0x30], 0x2d672a83
mov dword [esp + 0x30], 0xfbd6c3f0
mov dword [esp + 0x30], 1
mov dword [esp + 0x30], 0x81a7ecc2
mov dword [esp + 0x30], 0xfffffff7
push esi
call fcn.1000f096
mov dword [esp + 0x20], 0x5f34bdac
mov dword [esp + 0x10], ebx
jmp 0x1001e69d
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x1dc]
mov dword [eax + ecx*4], 0x2d0da0bd
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x1001e687
dec dword [esp + 0x20]
lea ecx, [esp + 0x1dc]
call fcn.1000f6c9
lea eax, [esp + 0x54]
xorps xmm0, xmm0
push eax
movdqu xmmword [esp + 0xf8], xmm0
call fcn.10020063
cmp byte [ebp + 0xc], 0
mov esi, dword [eax]
mov dword [esp + 0x3c], esi
jne 0x1001e6dd
test esi, esi
jne 0x1001f4da
push 1
lea ecx, [esp + 0x12c]
call fcn.1000f096
mov dword [esp + 0x27c], 7
mov dword [esp + 0x30], 0x94d2b5f7
mov dword [esp + 0x20], 0x1932e3ca
mov dword [esp + 0x10], ebx
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x30], 0xf5e4d8d9
mov dword [esp + 0x30], ebx
mov dword [esp + 0x30], 1
mov dword [esp + 0x2c], 0xd872
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x24], 0xfffffff8
mov dword [esp + 0x1c], ebx
jmp 0x1001e75f
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x128]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 1
jl 0x1001e74c
mov dword [esp + 0x1c], ebx
jmp 0x1001e77c
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x5c], 0xf4f46db5
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jl 0x1001e76c
mov dword [esp + 0x1c], ebx
jmp 0x1001e798
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x254], ebx
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 3
jl 0x1001e789
mov dword [esp + 0x5c], ebx
cmp dword [esp + 0x5c], ebx
jl 0x1001e8ec
mov dword [esp + 0x24], 0xfffffffe
lea ecx, [esp + 0x164]
mov dword [esp + 0x30], 1
mov dword [esp + 0x30], 0xf3d47941
mov dword [esp + 0x14], 0x5af9f7c8
mov dword [esp + 0x20], 0xf49c23ed
push 3
call fcn.1000f096
mov dword [esp + 0xc], 0x86bdae89
mov dword [esp + 0x10], ebx
jmp 0x1001e807
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x164]
mov dword [eax + ecx*4], 0x3dd972c4
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x1001e7f1
cmp dword [esp + 0x24], ebx
je 0x1001e890
dec dword [esp + 0xc]
xor ecx, ecx
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x5c]
mov esi, dword [esp + 0x164]
neg eax
cmp eax, 0x82bc
setge cl
xor edx, edx
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x20]
cmp eax, ecx
mov eax, dword [esi + 4]
setle dl
dec eax
add edx, eax
mov eax, dword [esp + 0x28]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setge cl
xor eax, eax
cmp ecx, dword [esi + 4]
setle al
xor edx, edx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x24]
cmp eax, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
setl dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [esp + 0x20], ecx
cmp dword [esp + 0x20], ebx
je 0x1001e890
xor edi, edi
inc edi
jmp 0x1001e892
mov edi, ebx
mov esi, dword [esp + 0x5c]
mov ecx, dword [esp + 0x5c]
mov edx, dword [esp + 0x128]
mov eax, dword [esp + 0x128]
push 4
mov eax, dword [eax + ecx*4]
xor ecx, ecx
mov dword [edx + esi*4], eax
mov eax, dword [esp + 0x18]
cmp edi, eax
setge cl
xor eax, eax
cmp dword [edx + esi*4], ecx
pop ecx
setg al
sub ecx, eax
mov eax, dword [esp + 0x2c]
sub ecx, eax
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0x164]
call fcn.1000f6c9
dec dword [esp + 0x5c]
jns 0x1001e7ad
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [esp + 0x10], ebx
jmp 0x1001e92c
mov dword [esp + 0x28], 0xfffffff9
mov dword [esp + 0x24], ebx
jmp 0x1001e91d
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001e919
push 0x2262
call edi
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 1
jle 0x1001e900
mov eax, dword [esp + 0x28]
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x14
jle 0x1001e8f2
or dword [esp + 0x27c], 0xffffffff
lea ecx, [esp + 0x128]
call fcn.1000f6c9
mov dl, byte [ebp + 0xc]
lea eax, [esp + 0x260]
mov ecx, dword [esp + 0x54]
push eax
call fcn.100136ba
mov esi, eax
lea edi, [esp + 0xf8]
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x24], 0x63530054
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x30], 0xd57638ff
mov dword [esp + 0x30], 0xea65
mov dword [esp + 0x10], ebx
jmp 0x1001e9a6
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x118], 0xfebaeef2
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x1001e993
cmp dword [esp + 0x120], ebx
je 0x1001e9d9
mov eax, dword [esp + 0x11c]
mov dword [esp + 0xc], eax
cmp dword [esp + 0xc], ebx
jne 0x1001e9cb
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x120]
mov eax, dword [esp + 0x120]
mov dword [esp + 0x24], ebx
jmp 0x1001e9f9
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + eax*4 + 0x118]
mov eax, dword [esp + 0x24]
mov dword [esp + eax*4 + 0x118], ecx
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 3
jle 0x1001e9df
cmp byte [ebp + 0xc], 0
je 0x1001efa3
cmp dword [esp + 0xfc], 0
je 0x1001efa3
mov eax, dword [esp + 0x100]
mov dword [esp + 0x1c], 1
mov dword [esp + 0x24], 0xbe9fb1c0
push 8
mov dword [esp + 0x30], 0xffff
pop esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x28], 0x1918
cmp dword [esp + 0x28], 0x113d
mov dword [esp + 0xd8], eax
jge 0x1001ec2e
call fcn.10054b75
push eax
push 0x1000cb54
push 0x1000ccdc
call fcn.1005512d
add esp, 0xc
call fcn.10054b75
add eax, 0x20
push eax
push 0x1000cb58
push 0x1000cce4
call fcn.1005512d
add esp, 0xc
mov dword [esp + 0x7c], ebx
mov dword [esp + 0x80], ebx
mov dword [esp + 0x84], ebx
push 0x35
mov dword [esp + 0x280], esi
lea eax, [esp + 0x214]
pop esi
push esi
push 1
push eax
call fcn.10025de5
add esp, 0xc
lea eax, [esp + 0xe4]
lea ecx, [esp + 0x7c]
push 2
pop edi
push eax
mov dword [esp + 0xe8], edi
call fcn.1001fe25
push 3
pop eax
mov word [esp + 0x210], bx
mov byte [esp + 0x212], 1
mov dword [esp + 0x58], eax
cmp byte [esp + eax + 0x210], 0
je 0x1001eb26
lea eax, [esp + 0x58]
push eax
lea ecx, [esp + 0x80]
call fcn.1001fe25
mov eax, dword [esp + 0x58]
mov edx, edi
lea ecx, [eax + eax]
jmp 0x1001eb22
inc edx
mov byte [esp + ecx + 0x210], bl
mov ecx, edx
imul ecx, eax
cmp ecx, esi
jl 0x1001eb15
add eax, edi
mov dword [esp + 0x58], eax
cmp eax, esi
jl 0x1001eaef
jmp 0x1001ec02
movd xmm0, esi
mov ecx, ebx
cvtdq2pd xmm0, xmm0
push ecx
push ecx
mov edi, ebx
mov dword [esp + 0x30], esi
mov dword [esp + 0x14], ecx
movsd qword [esp], xmm0
call fcn.10053e04
mov eax, dword [esp + 0x84]
fstp qword [esp + 0x38]
movsd xmm0, qword [esp + 0x38]
pop ecx
movd xmm1, dword [eax]
cvtdq2pd xmm1, xmm1
pop ecx
comisd xmm0, xmm1
jb 0x1001ebd1
mov ebx, eax
mov ecx, dword [eax]
mov eax, esi
cdq
idiv ecx
test edx, edx
jne 0x1001eb96
mov eax, esi
cdq
idiv ecx
mov esi, eax
cdq
idiv ecx
test edx, edx
je 0x1001eb83
mov dword [esp + 0x50], esi
inc edi
inc dword [esp + 0xc]
movd xmm0, esi
cvtdq2pd xmm0, xmm0
push ecx
push ecx
movsd qword [esp], xmm0
call fcn.10053e04
pop ecx
pop ecx
mov ecx, dword [esp + 0xc]
fstp qword [esp + 0x30]
movsd xmm0, qword [esp + 0x30]
lea eax, [ebx + ecx*4]
movd xmm1, dword [eax]
cvtdq2pd xmm1, xmm1
comisd xmm0, xmm1
jae 0x1001eb78
xor ebx, ebx
cmp esi, 1
je 0x1001ebd7
inc edi
push edi
push ecx
push dword [esp + 0x30]
mov ecx, 0x10663d98
call fcn.1000ef84
mov edx, 0x1000cd20
mov ecx, eax
call fcn.10012900
pop ecx
mov ecx, eax
call fcn.1000ef84
push eax
call fcn.10012ad7
pop ecx
lea eax, [esp + 0x50]
mov ecx, 0x10663e50
push eax
call fcn.1000ed89
mov esi, dword [esp + 0x50]
test esi, esi
jne 0x1001eb35
or dword [esp + 0x27c], 0xffffffff
lea ecx, [esp + 0x7c]
call fcn.1000f6c9
mov dword [esp + 0x10], 0xd3d47825
lea ecx, [esp + 0x17c]
mov dword [esp + 0x28], 0x1e8
mov dword [esp + 0x4c], 0x29ac934c
push 1
call fcn.1000f096
mov dword [esp + 0x27c], 9
mov dword [esp + 0xc], ebx
jmp 0x1001ec77
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x17c]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 1
jl 0x1001ec65
cmp dword [esp + 0x1c], ebx
je 0x1001ecc7
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x24], 0xfffffff8
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
sub eax, dword [esp + 0x1c]
sub eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x2c]
je 0x1001ecc7
xor edx, edx
inc edx
jmp 0x1001ecc9
mov edx, ebx
mov eax, dword [esp + 0x2c]
xor ecx, ecx
cmp edx, eax
setg cl
cmp ecx, 0xfa1a
jge 0x1001ece9
cmp dword [esp + 0x24], ebx
jne 0x1001ece9
xor ecx, ecx
mov eax, ebx
inc ecx
jmp 0x1001ecee
xor ecx, ecx
inc ecx
mov eax, ecx
cmp eax, dword [esp + 0x10]
jge 0x1001ee38
cmp dword [esp + 0x1c], ebx
je 0x1001ee38
mov dword [esp + 0x14], 0x1bab
mov dword [esp + 0x20], ecx
mov dword [esp + 0xc], ebx
jmp 0x1001ed24
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x68], 0x2397bde5
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x1001ed14
mov eax, dword [esp + 0x24]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
neg eax
push 0
sbb eax, eax
neg eax
mov eax, dword [esp + 0x20]
pop ecx
sets cl
xor edx, edx
cmp eax, ecx
mov eax, dword [esp + 0x2c]
setg dl
xor ecx, ecx
cmp edx, eax
setne cl
inc ecx
neg ecx
sbb ecx, ecx
imul ecx, dword [esp + 0x68]
add ecx, 0x511f0b9f
mov dword [esp + 0x68], ecx
mov eax, dword [esp + 0x2c]
sub ecx, eax
mov eax, dword [esp + 0x20]
neg ecx
sbb ecx, ecx
neg ecx
sub ecx, eax
imul ecx, dword [esp + 0x10]
test ecx, ecx
je 0x1001edaa
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001ef4c
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndDialog]
jmp 0x1001ef4c
mov dword [esp + 0xc], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], 0x1e83513
cmp dword [esp + 0x10], 1
je 0x1001edc5
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x10]
xor edx, edx
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x68]
mov eax, dword [esp + 0xc]
cmp ecx, eax
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0xc]
setne dl
imul ecx, edx
xor edx, edx
cmp eax, ecx
setne dl
sub edx, dword [esp + 0xc]
add edx, 0x5a80
jne 0x1001ee02
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x68]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x6c]
imul eax, dword [esp + 0x20]
mov ecx, dword [esp + 0xc]
imul eax, eax, 0xfff7
sub ecx, eax
sub ecx, dword [esp + 0x68]
neg ecx
sbb ecx, ecx
inc ecx
imul eax, ecx, 0xfffffff7
mov dword [esp + 0x2c], eax
jmp 0x1001ef4c
push dword [esp + 0xe0]
movdqa xmm0, xmmword [0x1000d4b0]
lea eax, [esp + 0x1fc]
push eax
mov dword [esp + 0x34], 0xf870a655
lea eax, [esp + 0x1f0]
mov dword [esp + 0x14], 0xd49a337b
mov dword [esp + 0x28], ecx
lea ecx, [esp + 0x13c]
push eax
mov dword [esp + 0x4c], 0xfffffff8
push ebx
movdqu xmmword [esp + 0x1f8], xmm0
mov dword [esp + 0x144], ebx
mov dword [esp + 0x148], ebx
mov dword [esp + 0x14c], ebx
call fcn.10013268
mov dword [esp + 0x30], 0xc530
mov dword [esp + 0xc], ebx
jmp 0x1001eebf
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x104], 0xfffffff7
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x1001eeac
mov eax, dword [esp + 0x2c]
mov dword [esp + 0xc], eax
cmp dword [esp + 0x20], ebx
je 0x1001eef3
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
cmp dword [esp + 0xc], ebx
je 0x1001eef3
xor eax, eax
inc eax
jmp 0x1001eef5
mov eax, ebx
mov dword [esp + 0x20], eax
lea ecx, [esp + 0x134]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x108]
mov eax, dword [esp + 0x104]
mov eax, dword [esp + 0x4c]
mov eax, dword [esp + 0x40]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x108]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x104]
mov dword [esp + 0x108], ebx
mov dword [esp + 0xc], ebx
call fcn.1000f6c9
mov dword [esp + 0x14], ebx
jmp 0x1001ef7b
mov dword [esp + 0x1c], ebx
jmp 0x1001ef71
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x17c]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], ebx
jle 0x1001ef58
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ebx
jle 0x1001ef52
or dword [esp + 0x27c], 0xffffffff
lea ecx, [esp + 0x17c]
call fcn.1000f6c9
mov eax, dword [esp + 0xfc]
mov dword [esp + 0xdc], eax
mov esi, dword [esp + 0x3c]
test esi, esi
jne 0x1001f4da
cmp dword [esp + 0xf4], esi
jle 0x1001f4da
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], ebx
jmp 0x1001efd9
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x248], 0x7117
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x1001efc6
push 2
pop edi
mov dword [esp + 0x10], edi
cmp dword [esp + 0x10], ebx
jl 0x1001f01c
mov dword [esp + 0xc], ebx
jmp 0x1001f006
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0xc4], 0xffffffff
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 1
jl 0x1001eff3
cmp dword [esp + 0xc4], ebx
jne 0x1001f01c
dec dword [esp + 0x10]
jns 0x1001efed
mov dword [esp + 0x10], 0xfffffffd
lea ecx, [esp + 0xe8]
mov dword [esp + 0x20], 0xca0029bf
push edi
call fcn.1000f096
mov dword [esp + 0x27c], 0xa
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], 0x19d87263
mov dword [esp + 0x30], 0x1c13
cmp dword [esp + 0x30], 0x1168
jge 0x1001f1dc
push 0xf
pop eax
mov dword [esp + 0x9c], eax
mov dword [esp + 0x98], ebx
mov byte [esp + 0x88], bl
mov dword [esp + 0xc0], eax
mov dword [esp + 0xbc], ebx
mov byte [esp + 0xac], bl
lea edx, [esp + 0x88]
mov byte [esp + 0x27c], 0xc
mov ecx, 0x10663e50
call fcn.10021180
lea edx, [esp + 0xac]
mov ecx, eax
call fcn.10021180
mov edi, dword [esp + 0x98]
cmp edi, dword [esp + 0xbc]
jae 0x1001f0d1
mov edx, 0x1000cd24
jmp 0x1001f0d8
jbe 0x1001f0ee
mov edx, 0x1000cd2c
mov ecx, 0x10663d98
call fcn.10012900
push eax
call fcn.10012ad7
pop ecx
jmp 0x1001f1a5
mov esi, ebx
test edi, edi
je 0x1001f1a5
cmp dword [esp + 0x9c], 0x10
lea edx, [esp + 0x88]
lea eax, [esp + 0xac]
cmovae edx, dword [esp + 0x88]
cmp dword [esp + 0xc0], 0x10
cmovae eax, dword [esp + 0xac]
movsx ecx, byte [eax + esi]
movsx eax, byte [edx + esi]
sub ecx, 0x30
sub eax, 0x30
cmp eax, ecx
jle 0x1001f13f
mov edx, 0x1000cd2c
jmp 0x1001f184
cmp dword [esp + 0x9c], 0x10
lea edx, [esp + 0x88]
lea eax, [esp + 0xac]
cmovae edx, dword [esp + 0x88]
cmp dword [esp + 0xc0], 0x10
cmovae eax, dword [esp + 0xac]
movsx ecx, byte [eax + esi]
movsx eax, byte [edx + esi]
sub ecx, 0x30
sub eax, 0x30
cmp eax, ecx
jge 0x1001f19c
mov edx, 0x1000cd24
mov ecx, 0x10663d98
call fcn.10012900
push eax
call fcn.10012ad7
mov edi, dword [esp + 0x9c]
pop ecx
inc esi
cmp esi, edi
jb 0x1001f0f8
mov edx, 0x1000cd34
mov ecx, 0x10663d98
call fcn.10012900
push eax
call fcn.10012ad7
pop ecx
push ebx
push 1
lea ecx, [esp + 0xb4]
call fcn.1000f4cb
push ebx
push 1
lea ecx, [esp + 0x90]
call fcn.1000f4cb
push 2
pop edi
mov dword [esp + 0x30], 0x38886a6c
mov dword [esp + 0x40], 0xa5b5cf0a
mov dword [esp + 0xc], ebx
jmp 0x1001f208
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0xe8]
mov dword [eax + ecx*4], 0x111d0188
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x1001f1f2
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x10]
mov esi, dword [esp + 0xe8]
mov eax, dword [esi + 4]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x10]
cmp eax, dword [esi + 4]
mov eax, dword [esp + 0x20]
setge cl
xor edx, edx
cmp eax, ecx
mov eax, dword [esp + 0xe8]
setge dl
sub edx, dword [eax]
neg edx
sbb edx, edx
inc edx
mov dword [esp + 0x28], edx
xor edx, edx
mov eax, dword [esp + 0x28]
inc edx
mov ecx, dword [esi + 4]
mov dword [esp + 0x20], edx
mov eax, dword [esp + 0x20]
sub eax, ecx
jne 0x1001f26d
test ecx, ecx
jne 0x1001f26d
mov edx, ebx
mov eax, dword [esp + 0xe8]
xor ecx, ecx
cmp edx, dword [eax]
setne cl
xor eax, eax
cmp ecx, 0x1af9
setne al
xor edx, edx
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x30]
cmp dword [esp + 0x40], eax
mov eax, dword [esp + 0x10]
setle dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
add ecx, dword [esi + 4]
cmp dword [esi + 4], ebx
mov dword [esp + 0x40], ecx
lea ecx, [esp + 0xe8]
setne al
imul eax, eax, 0xffff
mov dword [esp + 0x20], eax
or dword [esp + 0x27c], 0xffffffff
call fcn.1000f6c9
mov dword [esp + 0x30], 0xb4e1a362
lea ecx, [esp + 0x1d0]
mov dword [esp + 0x30], 0xfffffff6
xor eax, eax
inc eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x30], 0x3efc07e1
mov dword [esp + 0x30], 0x9c3fbb4e
mov dword [esp + 0x30], 0xce3e63e3
mov dword [esp + 0x30], ebx
mov dword [esp + 0x30], 6
push eax
call fcn.1000f096
mov dword [esp + 0x30], 0xfffffffd
mov dword [esp + 0x28], ebx
mov dword [esp + 0xc], ebx
jmp 0x1001f33b
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x1d0]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 1
jl 0x1001f329
inc dword [esp + 0x28]
lea ecx, [esp + 0x1d0]
call fcn.1000f6c9
mov ecx, dword [esp + 0xf8]
test ecx, ecx
je 0x1001f4d4
call fcn.1001dfa7
mov esi, eax
mov dword [esp + 0x10], 0xfffffffb
push 1
lea ecx, [esp + 0x1c0]
mov dword [esp + 0x40], esi
call fcn.1000f096
xor edx, edx
mov dword [esp + 0x14], ebx
inc edx
jmp 0x1001f3a1
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1bc]
mov dword [eax + ecx*4], 0x9a80bfb3
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x1001f38b
mov dword [esp + 0x14], ebx
jmp 0x1001f3c0
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x1f8], 0x15a60915
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x1001f3ad
mov dword [esp + 0x10], 0xfffffff3
jmp 0x1001f4af
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], 0xffffffff
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001f3fc
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
xor edx, edx
inc edx
mov dword [esp + 0x2c], 0xffffffe9
jmp 0x1001f4a0
mov dword [esp + 0x24], edx
mov dword [esp + 0x30], 0xc5eb2006
mov dword [esp + 0xc], ebx
jmp 0x1001f42e
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x208], 7
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x1001f41b
mov dword [esp + 0x24], 0xa
jmp 0x1001f495
mov dword [esp + 0x30], edx
mov dword [esp + 0x30], edx
mov dword [esp + 0x20], 0x62395e2d
mov dword [esp + 0xc], ebx
jmp 0x1001f463
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x1c8], ebx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jl 0x1001f454
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
inc dword [esp + 0x20]
cmp eax, ecx
mov eax, dword [esp + 0x204]
mov ecx, edx
cmovne ecx, ebx
imul eax, dword [esp + 0x200]
sub ecx, eax
mov dword [esp + 0x30], ecx
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 0x13
jne 0x1001f43e
inc dword [esp + 0x2c]
cmp dword [esp + 0x2c], 4
je 0x1001f409
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xffffffe5
jge 0x1001f3d4
lea ecx, [esp + 0x1bc]
call fcn.1000f6c9
lea eax, [esp + 0x54]
push eax
call fcn.10020063
mov dword [eax], esi
jmp 0x1001f4dd
mov esi, dword [esp + 0x3c]
jmp 0x1001f4dd
push 2
pop edi
mov dword [esp + 0x24], 0xfffffffe
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x14], ebx
jmp 0x1001f503
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x70], 0x1d925b0e
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 1
jl 0x1001f4f3
mov dword [esp + 0x14], ebx
jmp 0x1001f523
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x1ac], 0xc59cdc34
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x1001f510
mov dword [esp + 0x24], ebx
jmp 0x1001f6e1
mov dword [esp + 0x10], ebx
mov dword [esp + 0x30], 0xb1b6fd43
mov dword [esp + 0x30], 0xf12f3ccd
mov dword [esp + 0x30], 0x623b4709
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x30], 0x72737ae9
mov dword [esp + 0x30], ebx
mov dword [esp + 0x10], ebx
jmp 0x1001f6cc
mov dword [esp + 0xc], 0x2e5664dc
lea ecx, [esp + 0x188]
push 1
call fcn.1000f096
mov dword [esp + 0x27c], 0xd
lea ecx, [esp + 0x158]
mov dword [esp + 0x28], 0xb8e9646b
push 1
call fcn.1000f096
mov dword [esp + 0x14], ebx
jmp 0x1001f5c7
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x188]
mov dword [eax + ecx*4], 0xcc895931
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 1
jl 0x1001f5b1
mov dword [esp + 0x14], ebx
jmp 0x1001f5e7
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x158]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 1
jl 0x1001f5d4
mov dword [esp + 0xc], ebx
cmp dword [esp + 0xc], ebx
jl 0x1001f6a8
mov dword [esp + 0x40], 1
xor edx, edx
mov dword [esp + 0x4c], 0xffffffff
mov dword [esp + 0x4c], 0xa14c5530
mov dword [esp + 0x4c], 0xe13f5e3d
mov dword [esp + 0x4c], 0xb6d64bda
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x1b4]
cmp ecx, eax
mov eax, 0x1ff88011
setge dl
sub eax, edx
shl eax, 2
cmp eax, dword [esp + 0x40]
jg 0x1001f654
cmp dword [esp + 0x1b4], ebx
je 0x1001f654
xor edx, edx
inc edx
jmp 0x1001f656
mov edx, ebx
mov eax, dword [esp + 0x10]
mov eax, dword [esp + eax*4 + 0x70]
mov ecx, dword [esp + 0x20]
sub ecx, eax
mov eax, dword [esp + 0x188]
mov dword [esp + 0x28], ecx
mov dword [eax], edx
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + eax*4 + 0x70]
xor eax, eax
test edx, edx
setns al
sub ecx, eax
mov eax, dword [esp + 0x28]
dec dword [esp + 0x20]
cmp eax, ecx
jne 0x1001f693
xor ecx, ecx
inc ecx
jmp 0x1001f695
mov ecx, ebx
mov eax, dword [esp + 0x158]
mov dword [eax], ecx
dec dword [esp + 0xc]
jns 0x1001f5fc
lea ecx, [esp + 0x158]
call fcn.1000f6c9
or dword [esp + 0x27c], 0xffffffff
lea ecx, [esp + 0x188]
call fcn.1000f6c9
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ebx
jle 0x1001f574
mov eax, dword [esp + 0x1b0]
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 0x1a
jg 0x1001f533
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001f6fe
push ebx
call dword [sym.imp.USER32.dll_GetKeyboardState]
lea ecx, [esp + 0xf4]
call fcn.1001aac6
test esi, esi
je 0x1001f967
mov dword [esp + 0x10], 0xfffffffd
lea ecx, [esp + 0xc8]
mov dword [esp + 0x20], 0xca0029bf
push edi
call fcn.1000f096
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], 0x19d87263
mov dword [esp + 0x30], 0x38886a6c
mov dword [esp + 0x40], 0xa5b5cf0a
mov dword [esp + 0xc], ebx
jmp 0x1001f767
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0xc8]
mov dword [eax + ecx*4], 0x111d0188
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x1001f751
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x10]
mov esi, dword [esp + 0xc8]
mov eax, dword [esi + 4]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x10]
cmp eax, dword [esi + 4]
mov eax, dword [esp + 0x20]
setge cl
xor edx, edx
cmp eax, ecx
mov eax, dword [esp + 0xc8]
setge dl
sub edx, dword [eax]
neg edx
sbb edx, edx
inc edx
mov dword [esp + 0x28], edx
xor edx, edx
mov eax, dword [esp + 0x28]
inc edx
mov ecx, dword [esi + 4]
mov dword [esp + 0x20], edx
mov eax, dword [esp + 0x20]
sub eax, ecx
jne 0x1001f7cc
test ecx, ecx
jne 0x1001f7cc
mov edx, ebx
mov eax, dword [esp + 0xc8]
xor ecx, ecx
cmp edx, dword [eax]
setne cl
xor eax, eax
cmp ecx, 0x1af9
setne al
xor edx, edx
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x30]
cmp dword [esp + 0x40], eax
mov eax, dword [esp + 0x10]
setle dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
add ecx, dword [esi + 4]
cmp dword [esi + 4], ebx
mov dword [esp + 0x40], ecx
lea ecx, [esp + 0xc8]
setne al
imul eax, eax, 0xffff
mov dword [esp + 0x20], eax
call fcn.1000f6c9
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x3c]
call fcn.1001dff3
mov esi, eax
mov dword [esp + 0xc], 0x5f1dbecc
mov dword [esp + 0x20], 0x57e71f09
lea ecx, [esp + 0x170]
push edi
mov dword [esp + 0xd8], esi
call fcn.1000f096
mov dword [esp + 0x3c], 0x8a07c694
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0x28], 0x489f7a9d
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x14], ebx
jmp 0x1001f891
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x170]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x1001f87f
mov dword [esp + 0x14], ebx
jmp 0x1001f8b0
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x1a4], 6
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x1001f89d
mov ecx, dword [esp + 0x20]
xor edx, edx
mov eax, dword [esp + 0xc]
cmp ecx, eax
mov eax, dword [esp + 0x170]
setle dl
mov dword [esp + 0x44], edx
mov dword [eax], edx
xor edx, edx
mov eax, dword [esp + 0x3c]
cmp dword [esp + 0x44], eax
mov eax, dword [esp + 0x20]
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [esp + 0x1a8], ecx
xor ecx, ecx
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x10]
imul eax, dword [esp + 0x3c]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x24]
cmp eax, 0xbb35
mov eax, dword [esp + 0x3c]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0xc]
setle dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [esp + 0x10]
setg cl
mov dword [esp + 0x44], ecx
xor ecx, ecx
cmp dword [esp + 0x44], eax
setg cl
mov dword [esp + 0xc], ecx
lea ecx, [esp + 0x170]
call fcn.1000f6c9
lea eax, [esp + 0x74]
push eax
call fcn.10020001
mov dword [eax], esi
mov dword [esp + 0x1c], 0x8ade19d2
xor edx, edx
mov dword [esp + 0x3c], 0x5b1b6fd4
inc edx
mov dword [esp + 0x28], ebx
mov dword [esp + 0xc], ebx
jmp 0x1001f990
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x48], ebx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jl 0x1001f984
mov dword [esp + 0x1c], ebx
cmp dword [esp + 0x1c], ebx
jl 0x1001fa0f
mov dword [esp + 0x44], edx
mov dword [esp + 0x44], 0xa12afd77
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + eax*4 + 0x48]
mov dword [esp + 0x3c], eax
cmp dword [esp + 0x3c], ebx
je 0x1001f9c2
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x1c]
xor ecx, ecx
mov eax, dword [esp + eax*4 + 0x48]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + eax*4 + 0x48]
mov eax, dword [esp + 0x48]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + eax*4 + 0x48]
cmp eax, edx
sete cl
add ecx, dword [esp + 0x1c]
mov dword [esp + 0x44], ecx
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + eax*4 + 0x48]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + eax*4 + 0x48]
mov dword [esp + 0x44], eax
dec dword [esp + 0x1c]
jns 0x1001f9a0
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x3c], eax
mov eax, dword [ebp + 8]
lea esi, [esp + 0xd4]
mov ecx, dword [esp + 0x274]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret