Function at 0x100209bf
Capabilities:
Access peb ldr_data
Check os version
Get common file path
Query service status
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10069bd6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1e8
push ebx
mov dword [esp + 0x30], ecx
xor ebx, ebx
push esi
mov dword [esp + 0x20], 0xdb58e469
push edi
mov dword [esp + 0x24], 0x7ad95e17
xor edi, edi
mov dword [esp + 0x20], 0xfffffffe
inc edi
mov dword [esp + 0x3c], edx
mov dword [esp + 0xc], ebx
jmp 0x10020a21
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x174], 0xbf390197
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x10020a0e
inc dword [esp + 0x20]
mov esi, dword [sym.imp.GDI32.dll_Arc]
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x10020a70
push 0xfcf
push 0x3a
push 0x1d9b
push 0x481
push 0x25c0
push 0x18e4
push 0x248c
push 0x257e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call esi
mov dword [esp + 0x24], 0xdb58e469
mov dword [esp + 0x24], 0x7ad95e17
mov dword [esp + 0x20], 0xfffffffe
mov dword [esp + 0xc], ebx
jmp 0x10020aa1
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x178], 0xbf390197
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x10020a8e
inc dword [esp + 0x20]
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x10020aea
push 0xfcf
push 0x3a
push 0x1d9b
push 0x481
push 0x25c0
push 0x18e4
push 0x248c
push 0x257e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call esi
mov eax, dword [0x113822c0]
test al, 1
jne 0x10020b8c
or eax, edi
mov dword [0x113822c0], eax
push ebx
mov dword [esp + 0x200], ebx
push ebx
mov dword [0x113822a0], ebx
mov dword [0x113822a4], ebx
call fcn.100136e4
mov dword [0x113822a0], eax
mov dword [0x113822a8], ebx
mov dword [0x113822b0], ebx
mov byte [esp + 0x1fc], 2
mov ecx, 0x113822a8
mov dword [esp + 0x120], eax
lea eax, [esp + 0x120]
push eax
push 0x10
push ebx
lea eax, [esp + 0x138]
mov dword [0x113822bc], 0x3f800000
push eax
mov dword [0x113822ac], ebx
call fcn.100134bc
push 0x1006a957
mov dword [0x113822b4], 7
mov dword [0x113822b8], 8
call fcn.10050162
or dword [esp + 0x200], 0xffffffff
pop ecx
push edi
lea ecx, [esp + 0x108]
call fcn.1000f19e
mov dword [esp + 0x1fc], 3
lea eax, [esp + 0x18c]
push dword [esp + 0x12c]
movdqa xmm0, xmmword [0x10008050]
lea ecx, [esp + 0xa4]
push eax
lea eax, [esp + 0x184]
mov dword [esp + 0xa8], ebx
push eax
push ebx
movdqu xmmword [esp + 0x18c], xmm0
mov dword [esp + 0xb4], ebx
mov dword [esp + 0xb8], ebx
call fcn.1002341c
push 4
pop eax
push eax
lea ecx, [esp + 0xfc]
mov byte [esp + 0x200], al
call fcn.1000f19e
mov dword [esp + 0x24], 0xa8fe2430
mov dword [esp + 0x14], ebx
jmp 0x10020c29
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x104]
mov dword [eax + ecx*4], 0xb26bdde0
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x10020c13
push 4
mov dword [esp + 0x18], ebx
pop edx
jmp 0x10020c4e
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xf8]
mov dword [eax + ecx*4], 0xfffffff7
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x10020c38
mov esi, dword [esp + 0xa0]
mov ecx, dword [esp + 0x104]
mov dword [esi + 4], ebx
mov eax, dword [esi + 4]
mov dword [ecx + eax*4], 0x6210b999
inc dword [esi + 4]
cmp dword [esi + 4], edi
jl 0x10020c65
cmp dword [esi + 4], 0
jne 0x10020c87
mov dword [esi + 4], edi
mov eax, dword [ecx]
inc eax
mov eax, ebx
je 0x10020c89
mov eax, edi
neg eax
cmp dword [esp + 0xf8], 0
mov dword [ecx], eax
je 0x10020cb9
push dword [esp + 0xf8]
call fcn.10050764
pop ecx
mov dword [esp + 0xf8], ebx
mov dword [esp + 0xfc], ebx
mov dword [esp + 0x100], ebx
push esi
call fcn.10050764
or dword [esp + 0x200], 0xffffffff
pop ecx
push dword [esp + 0x104]
mov dword [esp + 0xa4], ebx
mov dword [esp + 0xa8], ebx
mov dword [esp + 0xac], ebx
call fcn.10050764
imul eax, dword [esp + 0x3c], 0x2710
mov dword [esp + 0x108], ebx
mov dword [esp + 0x10c], ebx
mov dword [esp + 0x110], ebx
pop ecx
add eax, dword [esp + 0x3c]
mov dword [esp + 0x9c], eax
mov dword [esp + 0x24], 0xfffffffe
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10020d2d
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10020d3f
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea eax, [esp + 0x9c]
push eax
call fcn.1002276a
mov esi, dword [eax]
mov eax, 0x177e8edf
mov dword [esp + 0xd0], eax
mov dword [esp + 0xd4], eax
mov dword [esp + 0xd8], eax
mov dword [esp + 0xdc], eax
mov dword [esp + 0xc], 0xfffffffc
mov dword [esp + 0x24], 0xfffffffe
mov dword [esp + 0xc], 3
mov dword [esp + 0x28], esi
cmp dword [esp + 0xc], ebx
jl 0x10020dbe
mov dword [esp + 0x20], 6
mov eax, dword [esp + 0x20]
mov dword [esp + 0x20], eax
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10020db8
push 0xe36
push ebx
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
dec dword [esp + 0xc]
jns 0x10020d91
test esi, esi
je 0x10020efc
push 3
lea ecx, [esp + 0x140]
call fcn.1000f19e
mov dword [esp + 0x14], 0x4a71a6e4
mov dword [esp + 0x20], 5
mov dword [esp + 0xc], ebx
jmp 0x10020e00
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x13c]
mov dword [eax + ecx*4], 0xffff
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x10020dea
mov esi, dword [esp + 0x13c]
xor eax, eax
mov ecx, dword [esi + 8]
cmp ecx, dword [esi]
setge al
cmp eax, ecx
jne 0x10020e24
mov ecx, ebx
cmp dword [esp + 0x14], ebx
je 0x10020e26
mov ecx, edi
xor eax, eax
cmp dword [esi + 8], ecx
setle al
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x13c]
mov esi, dword [esi + 8]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x3c], ecx
lea eax, [ecx + 0x7312]
xor ecx, ecx
cmp eax, esi
setl cl
xor edx, edx
cmp ecx, esi
setg dl
xor eax, eax
cmp edx, dword [esp + 0xc]
setne al
imul eax, eax, 0x5009
test eax, eax
je 0x10020e78
test esi, esi
jne 0x10020e7a
mov edi, ebx
xor eax, eax
cmp edi, esi
sete al
xor ecx, ecx
cmp eax, esi
setg cl
xor eax, eax
cmp ecx, dword [esp + 0xc]
setl al
xor ecx, ecx
cmp eax, dword [esp + 0xc]
setg cl
sub ecx, 3
imul ecx, dword [esp + 0x3c]
imul ecx, esi
mov dword [esp + 0x20], ecx
mov dword [esp + 0x20], ebx
jmp 0x10020ed9
mov dword [esp + 0x14], 0xfffffff0
jmp 0x10020ece
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10020eca
call dword [sym.imp.KERNEL32.dll_GetVersion]
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0x11
jg 0x10020eb9
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 0x16
je 0x10020eaf
push dword [esp + 0x13c]
call fcn.10050764
mov eax, dword [esp + 0x2c]
mov dword [esp + 0xd4], eax
jmp 0x100221fd
mov dword [esp + 0x14], 0xfffffffa
mov dword [esp + 0x20], 0xb9c279a2
mov dword [esp + 0xc], 0x712c5197
mov dword [esp + 0xc], 0x7cf8fb6f
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0xc], ebx
jmp 0x10020f3d
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x158], 0x85f70ad6
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x10020f2a
mov dword [esp + 0x14], 2
cmp dword [esp + 0x14], ebx
jl 0x10021011
mov dword [esp + 0x18], 0x6d058a83
mov dword [esp + 0x28], 0x197cbb4
cmp dword [esp + 0x20], ebx
je 0x10020f91
mov eax, dword [esp + 0x14]
xor edx, edx
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
cmp ecx, eax
mov ecx, edi
setl dl
sub edx, dword [esp + 0x18]
cmp edx, 0x64d6
jne 0x10020f93
mov ecx, ebx
mov eax, dword [esp + 0x18]
add ecx, eax
mov eax, dword [esp + 0x14]
cmp ecx, 0xfff6
mov dword [esp + eax*4 + 0x158], ecx
sbb eax, eax
inc eax
xor edx, edx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x160]
mov eax, dword [esp + 0x18]
cmp ecx, eax
mov eax, dword [esp + 0x20]
setg dl
xor ecx, ecx
imul eax, edx
mov dword [esp + 0xc], eax
mov edx, dword [esp + 0x18]
sub edx, dword [esp + 0xc]
mov eax, dword [esp + 0x14]
cmp edx, eax
setne cl
mov dword [esp + 0x28], ecx
cmp dword [esp + 0x20], ebx
jne 0x10021011
dec dword [esp + 0x14]
jns 0x10020f56
mov eax, dword [0x113822c0]
test al, 2
jne 0x100210b5
or eax, 2
mov dword [0x113822c0], eax
push ebx
mov dword [esp + 0x200], 5
push ebx
mov dword [0x113822d0], ebx
mov dword [0x113822d4], ebx
call fcn.100136e4
mov dword [0x113822d0], eax
mov dword [0x113822d8], ebx
mov dword [0x113822e0], ebx
mov byte [esp + 0x1fc], 7
mov ecx, 0x113822d8
mov dword [esp + 0x128], eax
lea eax, [esp + 0x128]
push eax
push 0x10
push ebx
lea eax, [esp + 0x58]
mov dword [0x113822ec], 0x3f800000
push eax
mov dword [0x113822dc], ebx
call fcn.100134bc
push 0x1006a952
mov dword [0x113822e4], 7
mov dword [0x113822e8], 8
call fcn.10050162
or dword [esp + 0x200], 0xffffffff
pop ecx
mov dword [esp + 0x20], 0xe0648261
mov dword [esp + 0x28], 0x167d3d8e
mov dword [esp + 0x20], ebx
jmp 0x10021129
push 2
lea ecx, [esp + 0x134]
call fcn.1000f19e
mov dword [esp + 0xc], ebx
jmp 0x100210f5
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x130]
mov dword [eax + ecx*4], 0xfffffffb
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x100210df
mov eax, dword [esp + 0x130]
push eax
mov dword [eax], 0x16
call fcn.10050764
mov dword [esp + 0x134], ebx
mov dword [esp + 0x138], ebx
mov dword [esp + 0x13c], ebx
dec dword [esp + 0x24]
pop ecx
cmp dword [esp + 0x20], 0xffffffeb
je 0x100210cb
mov eax, dword [esp + 0x28]
xorps xmm0, xmm0
mov dword [esp + 0x20], eax
lea eax, [esp + 0x38]
push eax
movdqu xmmword [esp + 0x114], xmm0
call fcn.100227cc
mov esi, dword [eax]
mov dword [esp + 0x28], 0x238a
cmp dword [esp + 0x28], 0x60c
mov dword [esp + 0x20], esi
jge 0x1002138d
lea eax, [esp + 0x34]
mov dword [esp + 0x34], ebx
push eax
push 0x1000785c
call fcn.1004fe8b
mov eax, dword [esp + 0x3c]
xor ecx, ecx
push 4
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1004b53a
mov ecx, dword [esp + 0x40]
add esp, 0xc
mov dword [esp + 0x28], ebx
mov esi, eax
mov dword [esp + 0x1c], esi
test ecx, ecx
jle 0x100211ce
push 4
pop edi
push esi
push 0x10007858
call fcn.1004fe8b
pop ecx
pop ecx
mov ecx, dword [esp + 0x34]
inc ebx
add esi, edi
cmp ebx, ecx
jl 0x100211ad
mov esi, dword [esp + 0x1c]
xor edi, edi
xor ebx, ebx
inc edi
lea edx, [esi + ecx*4]
mov byte [esp + 0x124], bl
push dword [esp + 0x124]
mov eax, edx
mov ecx, esi
sub eax, esi
sar eax, 2
push eax
call fcn.10023631
mov edx, ebx
mov dword [esp + 0x58], ebx
pop ecx
pop ecx
mov dword [esp + 0xc], edx
mov dword [esp + 0x54], edx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x1fc], 8
mov ecx, ebx
mov esi, ebx
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], esi
mov dword [esp + 0x48], ebx
mov byte [esp + 0x1fc], 9
cmp dword [esp + 0x34], 0
mov dword [esp + 0x28], ebx
jle 0x10021297
mov ebx, dword [esp + 0x1c]
mov edi, esi
mov eax, edx
sub eax, dword [esp + 0x50]
test eax, 0xfffffffc
je 0x10021270
mov eax, dword [ebx]
cmp dword [edx - 4], eax
jl 0x10021270
mov eax, esi
sub eax, ecx
test eax, 0xfffffffc
je 0x1002125c
mov eax, dword [ebx]
cmp dword [esi - 4], eax
jge 0x10021286
push ebx
lea ecx, [esp + 0x44]
call fcn.1000f1da
mov esi, dword [esp + 0x44]
mov edx, dword [esp + 0xc]
jmp 0x10021282
push ebx
lea ecx, [esp + 0x54]
call fcn.1000f1da
mov edx, dword [esp + 0x54]
mov dword [esp + 0xc], edx
mov ecx, dword [esp + 0x40]
push 4
pop eax
inc edi
add ebx, eax
cmp edi, dword [esp + 0x34]
jl 0x10021236
xor edi, edi
xor ebx, ebx
inc edi
mov eax, esi
sub eax, ecx
sar eax, 2
test eax, eax
je 0x100212b5
lea ecx, [esi - 4]
mov eax, dword [ecx]
cmp eax, dword [edx - 4]
cmove esi, ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x44], esi
sub edx, dword [esp + 0x50]
sub esi, ecx
sar edx, 2
sar esi, 2
mov dword [esp + 0x14], esi
mov dword [esp + 0xc], edx
lea eax, [esi + edx]
push eax
push 0x10007888
call fcn.1005018c
cmp dword [esp + 0x14], 0
pop ecx
pop ecx
mov dword [esp + 0x28], ebx
jbe 0x1002130d
mov ebx, dword [esp + 0xc]
mov edi, dword [esp + 0x28]
mov esi, dword [esp + 0x50]
push dword [esi + edi*4]
push 0x10007a40
call fcn.1005018c
inc edi
pop ecx
pop ecx
cmp edi, ebx
jb 0x100212f0
mov esi, dword [esp + 0x14]
xor edi, edi
xor ebx, ebx
inc edi
test esi, esi
je 0x10021336
mov ebx, dword [esp + 0x40]
add ebx, 0xfffffffc
push 4
pop edi
lea ebx, [ebx + esi*4]
push dword [ebx]
push 0x10007a40
call fcn.1005018c
pop ecx
sub ebx, edi
pop ecx
dec esi
jne 0x1002131e
xor edi, edi
xor ebx, ebx
inc edi
push 0x100077c5
call fcn.100507b6
pop ecx
push dword [esp + 0x1c]
call fcn.1005073d
mov eax, dword [esp + 0x44]
pop ecx
test eax, eax
je 0x10021366
push eax
call fcn.10050764
pop ecx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
or dword [esp + 0x1fc], 0xffffffff
mov eax, dword [esp + 0x50]
test eax, eax
je 0x10021389
push eax
call fcn.10050764
pop ecx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], ebx
mov esi, dword [esp + 0x20]
mov dword [esp + 0xc], ebx
xor edx, edx
mov dword [esp + 0x148], ebx
mov dword [esp + 0x14c], ebx
mov dword [esp + 0x150], ebx
mov dword [esp + 0x154], ebx
mov dword [esp + 0x24], 0x3c633843
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
cmp ecx, eax
setge dl
mov dword [esp + 0x14c], edx
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x100213e4
push 0x154d
push ebx
push ebx
push ebx
call dword [sym.imp.GDI32.dll_CombineRgn]
cmp byte [ebp + 0xc], 0
jne 0x100213f2
test esi, esi
jne 0x10021790
mov dword [esp + 0x18], 0xdebf889e
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x24], 0xcdab
mov dword [esp + 0xc], ebx
jmp 0x10021420
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x2c], 0xfffffffe
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x10021410
mov dword [esp + 0x2c], ebx
cmp dword [esp + 0x2c], 0x1b
je 0x1002150e
push 4
pop esi
mov dword [esp + 0x14], 0xbf390197
mov dword [esp + 0xc], edi
mov dword [esp + 0xc], ebx
jmp 0x10021459
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x164], ebx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x1002144a
mov dword [esp + 0x14], ebx
jmp 0x100214d9
mov dword [esp + 0xc], 0xb90f9986
xor ecx, ecx
mov dword [esp + 0x28], edi
mov edx, dword [esp + 0xc]
sub edx, dword [esp + 0xc]
mov eax, dword [esp + 0x168]
cmp eax, edx
setg cl
mov dword [esp + 0x18], ecx
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0xc]
sub edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x2c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
mov dword [esp + 0xc], ecx
xor ecx, ecx
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x168]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x2c]
cmp eax, edi
setge cl
mov dword [esp + 0x28], ecx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jle 0x10021465
mov dword [esp + 0x14], ebx
jmp 0x100214f9
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x164], 0x86a6c65b
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x100214e6
inc dword [esp + 0x2c]
cmp dword [esp + 0x2c], 0x1b
jne 0x10021438
mov dword [esp + 0x18], ebx
cmp dword [esp + 0x18], ebx
jl 0x10021659
mov dword [esp + 0xc], 0xd385e397
lea ecx, [esp + 0x6c]
push edi
call fcn.1000f19e
mov dword [esp + 0xc], ebx
jmp 0x10021543
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x6c]
mov dword [eax + ecx*4], edi
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x10021534
mov eax, dword [esp + 0x18]
cmp dword [esp + eax*4 + 0x2c], ebx
jne 0x1002163c
mov eax, dword [esp + 0x18]
mov eax, dword [esp + eax*4 + 0x2c]
mov eax, dword [esp + 0x18]
cmp dword [esp + eax*4 + 0x2c], 0x8394
jg 0x10021575
mov edx, ebx
cmp dword [esp + 0x18], ebx
je 0x10021577
mov edx, edi
mov eax, dword [esp + 0x18]
xor ecx, ecx
mov eax, dword [esp + eax*4 + 0x2c]
cmp eax, edx
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x2c]
setg cl
sub edx, ecx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
mov eax, dword [esp + 0x2c]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x18]
sete dl
xor ecx, ecx
mov esi, dword [esp + eax*4 + 0x2c]
mov eax, dword [esp + 0x1c]
cmp edx, eax
mov eax, dword [esp + 0x18]
setl cl
add esi, ecx
xor ecx, ecx
mov eax, dword [esp + eax*4 + 0x2c]
cmp eax, esi
sete cl
cmp ecx, 2
je 0x100215dc
mov eax, dword [esp + 0x18]
mov esi, ebx
cmp dword [esp + eax*4 + 0x2c], ebx
je 0x100215de
mov esi, edi
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + eax*4 + 0x2c]
mov eax, dword [esp + 0x2c]
sub esi, eax
mov eax, dword [esp + 0x1c]
sub esi, ecx
neg esi
sbb esi, esi
xor edx, edx
inc esi
cmp esi, eax
mov eax, dword [esp + 0x24]
setl dl
xor ecx, ecx
cmp edx, eax
setl cl
cmp ecx, 7
sbb eax, eax
inc eax
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x6c]
push ecx
mov dword [ecx], eax
call fcn.10050764
mov dword [esp + 0x70], ebx
mov dword [esp + 0x74], ebx
mov dword [esp + 0x78], ebx
dec dword [esp + 0x1c]
pop ecx
jns 0x1002151c
jmp 0x10021659
cmp dword [esp + 0x6c], 0
je 0x10021659
push dword [esp + 0x6c]
call fcn.10050764
pop ecx
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x70], ebx
mov dword [esp + 0x74], ebx
mov dl, byte [ebp + 0xc]
lea eax, [esp + 0x1e0]
mov ecx, dword [esp + 0x38]
push eax
call fcn.1001509d
cmp byte [ebp + 0xc], 0
lea edi, [esp + 0x114]
mov esi, eax
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
je 0x10021789
cmp dword [esp + 0x118], 0
je 0x10021789
push dword [esp + 0x4c]
movdqa xmm0, xmmword [0x10008030]
lea eax, [esp + 0x1a0]
push eax
lea eax, [esp + 0x194]
mov dword [esp + 0x98], ebx
push eax
push ebx
lea ecx, [esp + 0xa0]
mov dword [esp + 0xa4], ebx
movdqu xmmword [esp + 0x19c], xmm0
mov dword [esp + 0xa8], ebx
call fcn.1002341c
xor edi, edi
inc edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x24], 0xba1bf2b
mov dword [esp + 0x24], 0xcf09cc25
mov dword [esp + 0x24], 0xd1878abc
mov dword [esp + 0x24], 0xe54ee87f
mov dword [esp + 0x1c], ebx
jmp 0x10021738
mov dword [esp + 0x24], 0xfffffff9
mov dword [esp + 0x24], edi
mov dword [esp + 0xc], 0xfffc
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x90]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
dec dword [esp + 0xc]
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 3
jle 0x10021707
cmp dword [esp + 0x90], 0
je 0x1002176b
push dword [esp + 0x90]
call fcn.10050764
pop ecx
mov dword [esp + 0x90], ebx
mov dword [esp + 0x94], ebx
mov dword [esp + 0x98], ebx
mov eax, dword [esp + 0x11c]
mov dword [esp + 0xd4], eax
mov eax, dword [esp + 0x118]
mov dword [esp + 0xd8], eax
jmp 0x1002178c
xor edi, edi
inc edi
mov esi, dword [esp + 0x20]
mov dword [esp + 0x14], 0xe0a8eac8
mov dword [esp + 0x28], 0x2aff6358
mov dword [esp + 0xc], ebx
jmp 0x100217b5
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x1bc], edi
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x100217a6
mov dword [esp + 0x14], ebx
jmp 0x10021857
mov dword [esp + 0x1c], edi
push 7
pop eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x24], 0xe74e8003
mov dword [esp + 0x18], ebx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ebx
jmp 0x100217f9
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x1c8], 0xfffffff7
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x100217e6
mov dword [esp + 0x1c], 0xffffffef
jmp 0x1002184c
mov eax, dword [esp + 0x14]
mov ecx, edi
sub ecx, eax
add ecx, dword [esp + 0x1c]
jne 0x1002181c
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x1c4], eax
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
neg eax
sbb eax, eax
neg eax
mov dword [esp + 0x1cc], eax
mov dword [esp + 0x24], eax
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xfffffff9
jg 0x1002180a
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0xf
jge 0x100217c5
mov eax, dword [esp + 0x28]
mov dword [esp + 0x28], eax
test esi, esi
jne 0x10021edd
cmp dword [esp + 0x110], esi
jle 0x10021edd
mov dword [esp + 0x1c], edi
mov dword [esp + 0xc], 0xad94e8fe
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], 0x62c5d177
mov dword [esp + 0x24], 9
mov dword [esp + 0x14], ebx
jmp 0x100218b5
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x5c], 0x1ae9a07b
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x100218a5
push 3
mov dword [esp + 0x18], ebx
pop esi
jmp 0x100218d7
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x1d4], 0xffffffff
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x100218c4
mov eax, dword [esp + 0x1c]
add eax, 0x23fe
jne 0x10021950
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x28], eax
cmp dword [esp + 0x28], ebx
jne 0x100218fe
mov edx, ebx
cmp dword [esp + 0xc], ebx
je 0x10021900
mov edx, edi
mov eax, dword [esp + 0xc]
xor ecx, ecx
cmp eax, edx
mov eax, 0xd96753f3
setle cl
cmp eax, ecx
sbb eax, eax
xor ecx, ecx
inc eax
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x5c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
cmp eax, 0x764c
setg cl
mov dword [esp + 0x1d8], ecx
mov eax, dword [esp + 0x18]
add eax, 0xfffffffe
add eax, ecx
cmp eax, 0x94be3d0e
mov eax, ebx
jae 0x10021952
mov eax, edi
imul eax, eax, 0x34cc
test eax, eax
jne 0x10021960
mov eax, dword [esp + 0x5c]
mov eax, dword [esp + 0x18]
mov ecx, 0xfddf34ff
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
sub ecx, eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0xc], 0xec56
mov dword [esp + 0x14], ebx
mov dword [esp + 0x24], 0x1c17854c
mov dword [esp + 0x28], 0x1364f2ca
mov dword [esp + 0x24], 0xb5b06a83
mov dword [esp + 0xc], ebx
jmp 0x100219b1
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x30], ebx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x100219a5
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x30]
mov dword [esp + 0xc], edi
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x30]
neg eax
sbb eax, eax
xor edx, edx
neg eax
imul ecx, eax
mov eax, dword [esp + 0x14]
cmp ecx, eax
setne dl
mov dword [esp + 0x30], edx
mov eax, dword [esp + 0x14]
imul eax, edx
xor edx, edx
imul eax, eax, 0xf8d3
sub eax, dword [esp + 0x14]
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
cmp eax, ecx
setg dl
sub edx, 0xb1aa
je 0x10021a2f
mov eax, edi
cmp dword [esp + 0x14], ebx
jne 0x10021a31
mov eax, ebx
xor edx, edx
cmp eax, 5
setge dl
xor ecx, ecx
sub edx, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
cmp edx, eax
setne cl
cmp ecx, dword [esp + 0x14]
jg 0x10021a56
mov ecx, ebx
cmp dword [esp + 0x30], ebx
je 0x10021a58
mov ecx, edi
mov eax, dword [esp + 0x28]
imul eax, ecx
mov dword [esp + 0x24], eax
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10021a75
push ebx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov dword [esp + 0x24], 0xeac8b13e
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10021a94
push 0x20b1
push ebx
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10021aa6
push ebx
call dword [sym.imp.KERNEL32.dll_RtlCaptureContext]
cmp dword [esp + 0x114], 0
je 0x10021ee0
push esi
lea ecx, [esp + 0xb0]
call fcn.1000f19e
push esi
lea ecx, [esp + 0xe4]
mov dword [esp + 0x200], 0xa
call fcn.1000f19e
mov dword [esp + 0x14], ebx
jmp 0x10021af5
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xac]
mov dword [eax + ecx*4], 0x3342eb90
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x10021adf
mov dword [esp + 0x14], ebx
jmp 0x10021b17
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xe0]
mov dword [eax + ecx*4], 0xfffffff7
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x10021b01
mov eax, dword [esp + 0xe0]
mov dword [eax], ebx
mov dword [esp + 0x18], 0xfffffffa
mov dword [esp + 0x18], 2
cmp dword [esp + 0x18], ebx
jl 0x10021b7d
mov dword [esp + 0x20], 0x1a9565e0
mov dword [esp + 0x20], ebx
jmp 0x10021b5e
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0xac]
cmp dword [eax + ecx*4], ebx
jne 0x10021b65
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 2
jle 0x10021b4a
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10021b77
push ebx
call dword [sym.imp.USER32.dll_DestroyAcceleratorTable]
dec dword [esp + 0x18]
jns 0x10021b3c
mov dword [esp + 0x18], ebx
jmp 0x10021b9e
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10021b9a
push 0xe36
push ebx
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jle 0x10021b83
mov dword [esp + 0x18], ebx
jmp 0x10021bd6
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10021bd2
push 0xc76
push ebx
push 0x1026
push ebx
push 0x25f3
push 0xc27
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jle 0x10021bab
mov eax, dword [esp + 0xe0]
inc dword [eax]
cmp dword [eax], 2
jle 0x10021b26
push eax
call fcn.10050764
or dword [esp + 0x200], 0xffffffff
cmp dword [esp + 0xb0], 0
pop ecx
mov dword [esp + 0xe0], ebx
mov dword [esp + 0xe4], ebx
mov dword [esp + 0xe8], ebx
je 0x10021c3f
push dword [esp + 0xac]
call fcn.10050764
pop ecx
mov dword [esp + 0xac], ebx
mov dword [esp + 0xb0], ebx
mov dword [esp + 0xb4], ebx
mov ecx, dword [esp + 0x114]
call fcn.1002096e
push dword [esp + 0x4c]
movdqa xmm0, xmmword [0x10008070]
lea ecx, [esp + 0x7c]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1c0]
push eax
lea eax, [esp + 0x1b4]
mov dword [esp + 0x1c], 0x73ff82ff
push eax
mov dword [esp + 0x24], 0x244c
mov dword [esp + 0x28], 0xa52b4b5a
push ebx
movdqu xmmword [esp + 0x1bc], xmm0
mov dword [esp + 0x88], ebx
mov dword [esp + 0x8c], ebx
mov dword [esp + 0x90], ebx
call fcn.1002341c
mov dword [esp + 0x1fc], 0xb
mov dword [esp + 0xc], ebx
jmp 0x10021ccc
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x60], 0x951e
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x10021cbc
cmp dword [esp + 0x64], ebx
jne 0x10021d11
cmp dword [esp + 0x18], ebx
je 0x10021ce2
mov eax, dword [esp + 0x68]
mov ecx, dword [esp + 0x60]
xor edx, edx
mov eax, dword [esp + 0x68]
cmp eax, ecx
mov ecx, dword [esp + 0x18]
setge dl
lea eax, [edx + 0x1eca6c84]
mov edx, ebx
imul ecx, eax
sub ecx, dword [esp + 0x60]
mov eax, dword [esp + 0x64]
neg ecx
sbb ecx, ecx
inc ecx
add eax, ecx
je 0x10021d13
mov edx, edi
mov dword [esp + 0x14], ebx
xor ecx, ecx
mov eax, dword [esp + 0x18]
cmp edx, eax
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x60]
setle cl
mov edx, dword [esp + 0x60]
sub esi, ecx
sub esi, eax
xor ecx, ecx
mov eax, dword [esp + 0x64]
imul edx, esi
cmp edx, eax
setne cl
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ebx
jmp 0x10021e9a
push 2
lea ecx, [esp + 0xbc]
call fcn.1000f19e
mov dword [esp + 0x28], edi
mov dword [esp + 0x28], 6
push 2
mov dword [esp + 0x28], ebx
mov dword [esp + 0x10], ebx
pop edx
jmp 0x10021d8a
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0xb8]
mov dword [eax + ecx*4], 0x3728
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jl 0x10021d74
mov dword [esp + 0x1c], ebx
jmp 0x10021dcb
mov eax, dword [esp + 0x18]
cmp dword [esp + eax*4 + 0x60], ebx
jne 0x10021dd1
mov dword [esp + 0x14], edx
cmp dword [esp + 0x14], ebx
jl 0x10021dc7
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x24], 3
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x14]
mov dword [ecx + 8], eax
dec dword [esp + 0x14]
jns 0x10021dae
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edx
jle 0x10021d96
mov dword [esp + 0x14], edx
cmp dword [esp + 0x14], ebx
jl 0x10021e6a
mov esi, dword [esp + 0x78]
mov eax, dword [esp + 0xb8]
mov dword [esp + 0xc], 0x4707
cmp dword [eax], ebx
jne 0x10021dfa
mov eax, dword [esp + 0x60]
mov dword [esp + 0x28], 0xe9f81a77
mov eax, dword [esp + 0x28]
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x1c], ebx
je 0x10021e14
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
xor edx, edx
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x14]
cmp ecx, eax
setle dl
cmp edx, dword [esp + 0x18]
jle 0x10021e35
mov eax, ebx
cmp dword [esp + 0xc], ebx
je 0x10021e37
mov eax, edi
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
mov dword [esi + 8], eax
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov dword [esp + 0x24], edi
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10021e60
push ebx
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
dec dword [esp + 0x14]
jns 0x10021de3
cmp dword [esp + 0xb8], 0
je 0x10021e96
push dword [esp + 0xb8]
call fcn.10050764
pop ecx
mov dword [esp + 0xb8], ebx
mov dword [esp + 0xbc], ebx
mov dword [esp + 0xc0], ebx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jle 0x10021d4d
or dword [esp + 0x1fc], 0xffffffff
cmp dword [esp + 0x78], 0
je 0x10021ecd
push dword [esp + 0x78]
call fcn.10050764
pop ecx
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], ebx
mov dword [esp + 0x80], ebx
lea eax, [esp + 0x38]
push eax
call fcn.100227cc
mov ecx, dword [esp + 0x20]
mov dword [eax], ecx
push 3
pop esi
push esi
lea ecx, [esp + 0xc8]
call fcn.1000f19e
mov dword [esp + 0x1c], 0x4a71a6e4
mov dword [esp + 0xc], 5
mov dword [esp + 0xc], ebx
jmp 0x10021f19
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0xc4]
mov dword [eax + ecx*4], 0xffff
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x10021f03
mov esi, dword [esp + 0xc4]
xor eax, eax
mov ecx, dword [esi + 8]
cmp ecx, dword [esi]
setge al
cmp eax, ecx
jne 0x10021f3c
mov ecx, ebx
cmp dword [esp + 0x1c], ebx
je 0x10021f3e
mov ecx, edi
xor eax, eax
cmp dword [esi + 8], ecx
setle al
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0xc4]
mov esi, dword [esi + 8]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], ecx
lea eax, [ecx + 0x7312]
xor ecx, ecx
cmp eax, esi
setl cl
xor edx, edx
cmp ecx, esi
setg dl
xor eax, eax
cmp edx, dword [esp + 0x28]
setne al
imul eax, eax, 0x5009
test eax, eax
je 0x10021f92
mov ecx, edi
test esi, esi
jne 0x10021f94
mov ecx, ebx
xor eax, eax
cmp ecx, esi
sete al
xor ecx, ecx
cmp eax, esi
setg cl
xor eax, eax
cmp ecx, dword [esp + 0x28]
setl al
xor ecx, ecx
cmp eax, dword [esp + 0x28]
setg cl
sub ecx, 3
imul ecx, dword [esp + 0x24]
imul ecx, esi
mov dword [esp + 0xc], ecx
mov dword [esp + 0xc], ebx
jmp 0x10021ff3
mov dword [esp + 0x1c], 0xfffffff0
jmp 0x10021fe8
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10021fe4
call dword [sym.imp.KERNEL32.dll_GetVersion]
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0x11
jg 0x10021fd3
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 0x16
je 0x10021fc9
push dword [esp + 0xc4]
call fcn.10050764
pop ecx
lea ecx, [esp + 0x110]
mov dword [esp + 0xc4], ebx
mov dword [esp + 0xc8], ebx
mov dword [esp + 0xcc], ebx
call fcn.1001c5ac
push 2
lea ecx, [esp + 0xf0]
call fcn.1000f19e
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 0xc], ebx
jmp 0x10022056
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0xec]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x10022044
mov dword [esp + 0xc], edi
cmp dword [esp + 0xc], ebx
jl 0x10022084
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1002207e
push 0x13d2
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
dec dword [esp + 0xc]
jns 0x10022067
cmp dword [esp + 0xec], 0
je 0x100220b0
push dword [esp + 0xec]
call fcn.10050764
pop ecx
mov dword [esp + 0xec], ebx
mov dword [esp + 0xf0], ebx
mov dword [esp + 0xf4], ebx
mov eax, dword [esp + 0x20]
test eax, eax
je 0x100220db
mov edx, dword [esp + 0x3c]
mov ecx, eax
call fcn.100209b5
mov esi, eax
lea eax, [esp + 0x9c]
push eax
mov dword [esp + 0xd4], esi
call fcn.1002276a
mov dword [eax], esi
push dword [esp + 0x4c]
lea eax, [esp + 0x1b0]
mov dword [esp + 0x88], ebx
push eax
lea eax, [esp + 0x1a4]
mov dword [esp + 0x90], ebx
push eax
xorps xmm0, xmm0
mov dword [esp + 0x98], ebx
push ebx
lea ecx, [esp + 0x94]
movdqu xmmword [esp + 0x1ac], xmm0
call fcn.1002341c
mov dword [esp + 0xc], 0x184c506d
mov dword [esp + 0xc], 3
cmp dword [esp + 0xc], ebx
jl 0x100221e7
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x20], 0x544d1878
mov dword [esp + 0x14], 3
cmp dword [esp + 0x14], ebx
jl 0x100221dd
mov esi, dword [esp + 0x84]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x24], ebx
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x84]
mov eax, dword [eax + ecx*4]
neg eax
jne 0x10022181
mov eax, ebx
cmp dword [esi + 4], ebx
je 0x10022183
mov eax, edi
mov dword [esp + 0x20], eax
xor edx, edx
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x84]
cmp dword [eax + ecx*4], edi
sete dl
mov dword [esp + 0x1c], edx
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
cmp dword [esp + 0x20], edi
jle 0x100221c0
mov edx, ebx
cmp dword [esp + 0x1c], ebx
je 0x100221c2
mov edx, edi
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x84]
sub edx, dword [esi + 4]
mov dword [eax + ecx*4], edx
mov dword [esp + 0x24], edx
dec dword [esp + 0x14]
jns 0x10022160
dec dword [esp + 0xc]
jns 0x10022137
cmp dword [esp + 0x84], 0
je 0x100221fe
push dword [esp + 0x84]
call fcn.10050764
pop ecx
mov eax, dword [ebp + 8]
lea esi, [esp + 0xd0]
mov ecx, dword [esp + 0x1f4]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret