Function at 0x9e470
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x164
push ebx
mov ebx, dword [0x4e73e0]
test byte [ebx + 0x23b1], 1
push ebp
mov ebp, dword [esp + 0x170]
push esi
mov esi, dword [esp + 0x178]
je 0x9e4a7
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x164
ret 0x18
mov eax, dword [esi + 0xdc]
mov ecx, dword [eax + 0x44]
mov edx, dword [eax + 0x60]
mov dword [esp + 0x18], ecx
mov ecx, dword [edx + 0x10]
mov dword [esp + 0x114], ecx
push edi
mov edi, dword [edx + 0x14]
or ecx, edi
je 0x9e4d9
mov ecx, dword [esp + 0x118]
mov dword [esp + 0x11c], edi
jmp 0x9e4e8
mov edx, dword [edx]
mov ecx, dword [edx + 0x68]
mov edx, dword [edx + 0x6c]
mov dword [esp + 0x11c], edx
mov eax, dword [eax + 0x5c]
add eax, ecx
mov dword [esp + 0x90], eax
mov eax, dword [esi + 0xdc]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [eax + 8]
mov dword [esp + 0x20], eax
mov eax, esi
mov dword [esp + 0x108], ecx
mov dword [esp + 0x18], edx
call fcn.00069d30
mov ecx, dword [esi + 0xdc]
mov edx, dword [ecx + 0x60]
xor edi, edi
mov dword [esp + 0x114], eax
mov eax, dword [edx + 0x88]
and eax, 0xff
mov dword [esp + 0x34], eax
xor eax, eax
mov dword [esp + 0xfc], edi
cmp dword [ebx + 0x209c], edi
mov dword [esp + 0xe0], edi
setne al
mov dword [esp + 0xb8], edi
mov dword [esp + 0xbc], edi
mov dword [esp + 0x98], edi
mov dword [esp + 0x138], edi
mov dword [esp + 0x134], edi
mov dword [esp + 0x130], edi
mov esi, eax
cmp esi, edi
mov dword [esp + 0x12c], esi
mov dword [esp + 0x128], edi
je 0x9e5a1
push edi
push edi
push edi
push 1
push edi
call fcn.0008dca0
mov ebx, dword [0x4e73e0]
test byte [ebp + 0x887], 0x80
jne 0xa1e92
cmp dword [ebp + 0xe8], edi
je 0xa1e92
cmp dword [ebp + 0xe4], edi
je 0xa1e92
mov ecx, dword [ebx + 0x2520]
mov edx, dword [ecx]
call dword [edx + 0x124]
push eax
call fcn.00109a20
mov ecx, dword [0x4e73e0]
mov ebx, dword [esp + 0x180]
mov dword [esp + 0x7c], eax
mov eax, dword [ecx + 0x20a0]
test al, 4
je 0x9e5ff
and ebx, 0xfffffff0
mov dword [esp + 0x180], ebx
cmp eax, edi
je 0x9e60a
or byte [ecx + 0x20ae], 0x20
mov eax, dword [esp + 0x90]
mov dword [ebp + 0x164], eax
mov eax, 0x22222222
mov ecx, ebx
lea edx, [esp + 0x100]
or ecx, 0x80000000
push edx
mov dword [ebp + 0x160], ebx
mov dword [esp + 0x11c], edi
mov dword [esp + 0x120], edi
mov dword [ebp + 0x380], 0x11111111
mov dword [ebp + 0x450], eax
mov dword [ebp + 0x454], eax
mov dword [ebp + 0x378], ecx
call sub.WIN32K.SYS_EngQueryPerformanceCounter
mov eax, dword [ebp + 0x388]
or eax, dword [ebp + 0x38c]
je 0x9e71c
mov ecx, dword [esp + 0x100]
sub ecx, dword [ebp + 0x390]
mov eax, dword [esp + 0x104]
sbb eax, dword [ebp + 0x394]
mov edx, dword [ebp + 0x3ac]
cmp eax, edx
mov esi, dword [ebp + 0x3a8]
jl 0x9e6ad
jg 0x9e6a3
cmp ecx, esi
jbe 0x9e6ad
mov ebx, ecx
sub ebx, esi
mov esi, eax
sbb esi, edx
jmp 0x9e6b5
sub esi, ecx
sbb edx, eax
mov ebx, esi
mov esi, edx
add dword [ebp + 0x3b0], ebx
adc dword [ebp + 0x3b4], esi
cmp esi, dword [ebp + 0x3bc]
jl 0x9e6df
jg 0x9e6d3
cmp ebx, dword [ebp + 0x3b8]
jbe 0x9e6df
mov dword [ebp + 0x3b8], ebx
mov dword [ebp + 0x3bc], esi
add dword [ebp + 0x398], ecx
adc dword [ebp + 0x39c], eax
cmp eax, dword [ebp + 0x3a4]
jl 0x9e709
jg 0x9e6fd
cmp ecx, dword [ebp + 0x3a0]
jbe 0x9e709
mov dword [ebp + 0x3a0], ecx
mov dword [ebp + 0x3a4], eax
mov ebx, dword [esp + 0x180]
mov dword [ebp + 0x3a8], ecx
mov dword [ebp + 0x3ac], eax
mov ecx, dword [esp + 0x100]
mov eax, dword [ebp + 0x884]
mov edx, dword [esp + 0x104]
not eax
and ebx, eax
mov eax, dword [0x527294]
cmp eax, edi
mov dword [esp + 0x5c], ecx
movzx ecx, word [ebp + 0x154]
mov dword [esp + 0x60], edx
mov dword [esp + 0x180], ebx
mov dword [esp + 0xa4], ecx
jne 0x9e760
call dword [fcn.00527200]
mov ecx, dword [0x4e73e0]
lea edi, [ecx + 0x5d8]
xor esi, esi
cmp dword [edi], esi
mov dword [esp + 0xa8], eax
jne 0x9e782
mov esi, ecx
call fcn.000b39d0
xor esi, esi
test bl, 0xc
mov eax, dword [edi]
mov dword [esp + 0x58], eax
je 0x9e91e
test bl, 3
je 0x9e91e
mov ecx, dword [ebp + 0x368]
cmp ecx, 6
mov edx, 1
mov dword [esp + 0xd4], edx
jae 0x9e7d3
mov edi, dword [esp + 0x100]
mov dword [ebp + ecx*8 + 0x330], edi
mov edi, dword [esp + 0x104]
mov dword [ebp + ecx*8 + 0x334], edi
add dword [ebp + 0x368], edx
cmp eax, esi
je 0x9e7e1
cmp dword [eax + 0x1c], esi
je 0x9e7e1
cmp dword [eax + 0x24], esi
jne 0x9e808
mov edi, dword [esp + 0xa8]
mov esi, dword [0x4e73e0]
mov eax, edi
call fcn.000b39d0
mov ecx, dword [0x4e73e0]
mov eax, edi
call fcn.000b39b0
mov dword [esp + 0x58], eax
xor esi, esi
cmp eax, esi
je 0x9f7e0
mov edx, dword [esp + 0x20]
push edx
mov edx, dword [esp + 0x1c]
mov ecx, ebp
call fcn.00096440
mov eax, dword [ebp + 0x98]
cmp eax, 3
lea ecx, [eax + 1]
mov dword [ebp + 0x98], ecx
ja 0x9e83d
test byte [ebp + 0x87b], 1
jne 0x9e85c
mov eax, dword [0x4e73e0]
cmp dword [eax + 0x2488], esi
jne 0x9e85c
test byte [eax + 0x5fdc], 0x80
jne 0x9e85c
mov esi, ebp
call fcn.00096400
xor esi, esi
mov edx, dword [0x5271fc]
cmp dword [edx + 0xbe4], esi
je 0x9e881
cmp dword [ebp + 0x784], esi
jbe 0x9e881
call fcn.00096600
test eax, eax
je 0x9e881
push ebp
call fcn.000981c0
mov eax, dword [esp + 0x90]
mov ebx, dword [ebp + 0x3c]
cmp ebx, 2
mov ecx, dword [esp + 0x108]
mov edx, dword [ebp + 0x120]
mov edi, 0x100000
mov dword [esp + 0x14], eax
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0x114]
mov dword [esp + 0x13c], ebx
mov dword [esp + 0x40], esi
mov dword [esp + 0x3c], esi
mov dword [esp + 0xf4], edi
mov dword [esp + 0xf8], edi
mov dword [esp + 0x10], eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x124], edx
jb 0x9e92a
mov eax, dword [ebp + 0x40]
lea esi, [ebp + eax*4 + 0x14]
mov eax, dword [esi]
call fcn.00069fd0
mov esi, dword [esi]
mov ecx, dword [esi + 0x108]
add ecx, eax
mov dword [esp + 0x2c], ecx
mov ecx, dword [esi + 0xdc]
mov edx, dword [ecx + 0x60]
mov dword [esp + 0x64], eax
mov eax, dword [edx + 0x88]
and eax, 0xff
mov dword [esp + 0x28], eax
mov eax, dword [ebp + 0x60]
mov dword [esp + 0x30], eax
jmp 0x9e93a
mov dword [esp + 0xd4], esi
jmp 0x9e7d3
mov dword [esp + 0x64], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x28], esi
cmp ebx, 3
jb 0x9e9a1
mov esi, dword [ebp + 0x40]
add ebx, 0xffffffff
cmp esi, ebx
jae 0x9e94e
add esi, 1
jmp 0x9e950
xor esi, esi
mov eax, dword [ebp + esi*4 + 0x14]
mov dword [esp + 0x120], esi
call fcn.00069fd0
mov edx, dword [ebp + esi*4 + 0x14]
mov ecx, dword [edx + 0x108]
add ecx, eax
mov dword [esp + 0x48], ecx
mov ecx, dword [edx + 0xdc]
mov edx, dword [ecx + 0x60]
mov dword [esp + 0x4c], eax
mov eax, dword [edx + 0x88]
and eax, 0xff
test dword [ebp], edi
mov dword [esp + 0x50], eax
je 0x9e99a
mov eax, dword [ebp + 0x64]
mov dword [esp + 0x38], eax
jmp 0x9e9a1
mov ecx, dword [ebp + 0x60]
mov dword [esp + 0x38], ecx
mov esi, dword [esp + 0x90]
push 0
push esi
call fcn.00110450
mov ebx, eax
test ebx, ebx
mov dword [esp + 0xe8], 0
je 0x9ea5e
test byte [ebx + 0x290], 1
je 0x9e9ea
mov edx, dword [ebx + 0x298]
mov dword [ebp + 0x3f8], edx
mov eax, dword [ebx + 0x29c]
mov dword [esp + 0x40], edi
mov dword [ebp + 0x3fc], eax
test byte [ebx + 0x290], 2
je 0x9ea0b
mov ecx, dword [ebx + 0x2a0]
mov dword [ebp + 0x418], ecx
mov edx, dword [ebx + 0x2a4]
mov dword [ebp + 0x41c], edx
mov edi, dword [ebx + 0x2bc]
mov esi, dword [ebx + 0x2c0]
and dword [ebx + 0x290], 0xfffffffc
push 0x3231564e
mov dword [esp + 0x1c], edi
mov dword [esp + 0x24], esi
call fcn.000a2c40
mov eax, dword [esp + 0x1c]
push eax
mov ecx, esi
mov edx, edi
mov eax, ebp
call fcn.000a2cd0
mov eax, ebx
call fcn.00106470
test eax, eax
je 0x9eae6
mov ecx, dword [eax + 0x68]
mov dword [esp + 0xe8], ecx
jmp 0x9eae6
call fcn.0015a570
mov ebx, eax
test ebx, ebx
je 0x9eabf
mov eax, dword [ebx + 0x80]
test eax, eax
mov esi, dword [ebx + 0x84]
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], esi
je 0x9f7e0
test esi, esi
je 0x9f7e0
mov edx, dword [esp + 0x1c]
push edx
mov edi, eax
call fcn.000a2c40
mov eax, dword [esp + 0x1c]
push eax
mov ecx, esi
mov edx, edi
mov eax, ebp
call fcn.000a2cd0
mov eax, dword [ebx + 0x88]
test eax, eax
je 0x9eae6
mov ecx, dword [eax + 0x68]
mov dword [esp + 0xe8], ecx
jmp 0x9eae6
cmp dword [ebp + 0xc4], 0
jne 0x9eae6
mov ebx, dword [esp + 0x1c]
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x18]
push ebx
call fcn.000a2c40
push ebx
mov ecx, esi
mov edx, edi
mov eax, ebp
call fcn.000a2cd0
mov edx, dword [0x4e73e0]
mov ecx, dword [edx + 0x2520]
mov eax, dword [ecx]
mov edi, dword [esp + 0x1c]
call dword [eax + 0x124]
mov dword [esp + 0xb0], eax
mov eax, dword [esp + 0xe8]
xor ebx, ebx
cmp eax, ebx
je 0x9eb1b
add eax, 0x1c
mov dword [esp + 0x54], eax
jmp 0x9eb1f
mov dword [esp + 0x54], ebx
cmp edi, 0x39304649
je 0x9eb46
cmp edi, 0x39555659
je 0x9eb46
cmp edi, 0x32335649
je 0x9eb46
cmp edi, 0x31335649
mov dword [esp + 0xc8], ebx
jne 0x9eb51
mov dword [esp + 0xc8], 1
cmp edi, 0x32315659
je 0x9eb68
cmp edi, 0x69303234
mov dword [esp + 0x9c], ebx
jne 0x9eb73
mov dword [esp + 0x9c], 1
cmp edi, 0x32595559
je 0x9eb83
cmp edi, 0x59565955
jne 0x9eb88
mov ebx, 1
mov edx, dword [0x4e73e0]
xor ecx, ecx
cmp edi, 0x3231564e
sete cl
test byte [edx + 0x23b0], 0x10
mov dword [esp + 0xcc], ebx
mov esi, ecx
je 0x9eca4
test edi, edi
jne 0x9eca4
mov ecx, dword [esp + 0x17c]
mov eax, dword [ecx + 0xdc]
mov eax, dword [eax + 0x3c]
and eax, 0xff
cmp eax, 4
je 0x9ebe7
test byte [edx + 0x2485], 0x40
je 0x9eca4
cmp eax, 3
jne 0x9eca4
cmp eax, 3
mov edi, 1
mov dword [esp + 0xf0], edi
jne 0x9ebff
push edi
push ecx
call fcn.000ba5d0
xor ecx, ecx
cmp esi, ecx
jne 0x9ec0d
cmp edi, ecx
mov dword [esp + 0x44], ecx
je 0x9ec15
mov dword [esp + 0x44], 1
cmp dword [esp + 0xc8], ecx
jne 0x9ec39
cmp dword [esp + 0x9c], ecx
jne 0x9ec39
cmp ebx, ecx
jne 0x9ec39
cmp dword [esp + 0x44], ecx
jne 0x9ec39
cmp edi, ecx
je 0x9f7e0
cmp dword [esp + 0xd4], ecx
mov dword [esp + 0xe8], ecx
jne 0x9ec73
test byte [ebp + 3], 1
je 0x9ec73
mov eax, dword [ebp + 0x17c]
test al, 0x20
je 0x9ec64
mov dword [esp + 0xe8], 1
test al, 0x10
je 0x9ec73
mov dword [esp + 0xe8], 2
cmp dword [ebp + 0x7e4], ecx
mov ebx, dword [esp + 0x180]
je 0x9ecb2
test bl, 8
je 0x9ecb2
mov eax, dword [ebp + 0x78c]
sub eax, dword [ebp + 0x7bc]
cdq
xor eax, edx
sub eax, edx
cmp eax, 8
jg 0x9ecb2
mov ecx, 1
jmp 0x9ecb4
xor edi, edi
mov dword [esp + 0xf0], edi
jmp 0x9ebff
xor ecx, ecx
cmp dword [ebp + 0xec], 0
mov dword [esp + 0xe4], ecx
mov dword [ebp + 0x7e8], ecx
je 0x9ecfa
test bl, 8
je 0x9ecfa
mov eax, dword [ebp + 0xe8]
mov edx, dword [0x5271fc]
cmp eax, dword [edx + 0x16c]
jne 0x9ecfa
sub eax, dword [ebp + 0xb8]
cdq
xor eax, edx
sub eax, edx
cmp eax, 8
jg 0x9ecfa
mov eax, 1
jmp 0x9ecfc
xor eax, eax
test ebx, 0x40000000
mov esi, dword [0x4e73e0]
mov dword [esp + 0x94], eax
mov dword [ebp + 0xf4], eax
je 0x9ed53
mov eax, dword [esi + 0x1404]
test eax, 0x300000
je 0x9ed53
cmp dword [esp + 0x1c], 0x3231564e
je 0x9ed37
cmp dword [esi + 0xbc4], 4
jb 0x9ed53
test eax, str.Xqv
mov edx, 1
mov dword [esp + 0xd0], edx
jne 0x9ed6b
mov dword [esp + 0xa0], edx
jmp 0x9ed76
xor edx, edx
test ecx, ecx
mov dword [esp + 0xd0], edx
mov dword [esp + 0xa0], 1
jne 0x9ed76
mov dword [esp + 0xa0], 0
xor eax, eax
cmp dword [esp + 0x1c], 0x59565955
mov dword [esp + 0x68], eax
jne 0x9edaa
cmp edx, eax
je 0x9ed94
mov dword [esp + 0x68], 1
jmp 0x9edaa
test dword [esi + 0x23bc], 0xf500000
je 0x9edaa
and bh, 0xfe
mov dword [esp + 0x180], ebx
test bh, 1
je 0x9edd8
cmp edx, eax
jne 0x9edcf
cmp dword [esp + 0xc8], eax
jne 0x9edcf
cmp dword [esp + 0x9c], eax
jne 0x9edcf
cmp dword [esp + 0x44], eax
jne 0x9edcf
cmp edi, eax
je 0x9edea
cmp dword [ebp + 0x5c], 0x32595559
je 0x9ee00
cmp dword [esp + 0xc8], eax
jne 0x9edf3
cmp dword [esp + 0x9c], eax
jne 0x9edf3
cmp dword [esp + 0xcc], eax
je 0x9ee0d
cmp edx, eax
jne 0x9ee0d
cmp dword [ebp + 0x5c], 0x3231564e
jne 0x9ee0d
mov dword [esp + 0xb4], 1
jmp 0x9ee14
mov dword [esp + 0xb4], eax
mov ecx, dword [esp + 0x54]
cmp ecx, eax
je 0x9ee65
test bh, 2
je 0x9ee58
mov eax, dword [ecx + 4]
test ah, 0x40
je 0x9ee58
cmp dword [ecx], 3
je 0x9ee58
cmp dword [ecx + 0x58], 0
je 0x9ee58
test al, 4
je 0x9ee3d
test bl, 1
jne 0x9ee4b
test al, 8
je 0x9ee46
test bl, 2
jne 0x9ee4b
test bl, 3
jne 0x9ee58
mov dword [esp + 0x88], 1
jmp 0x9ee6c
mov dword [esp + 0x88], 0
jmp 0x9ee6c
mov dword [esp + 0x88], eax
cmp dword [esp + 0x44], 0
je 0x9ee90
test ecx, ecx
je 0x9ee90
mov eax, dword [ecx]
cmp eax, 0xb
je 0x9ee83
cmp eax, 0x1c
jne 0x9ee90
mov dword [esp + 0xc8], 1
jmp 0x9ee9b
mov dword [esp + 0xc8], 0
mov eax, dword [esi + 0x1404]
and eax, 0x300000
je 0x9ef2e
cmp dword [esp + 0x1c], 0x3231564e
je 0x9eebf
cmp dword [esi + 0xbc4], 4
jb 0x9ef2e
cmp eax, 0x100000
je 0x9eecd
cmp eax, 0x300000
jne 0x9ef2e
mov ecx, dword [ebp + 0xe4]
mov edx, dword [ebp + 0x84]
mov eax, dword [ebp + 0xb8]
imul edx, ecx
cmp eax, edx
mov dword [esp + 0xcc], ecx
jae 0x9ef02
mov edx, dword [ebp + 0x8c]
imul edx, eax
cmp edx, ecx
mov dword [esp + 0x78], 0
jae 0x9ef0a
mov dword [esp + 0x78], 1
mov ebx, dword [ebp + 0xe8]
mov eax, dword [ebp + 0x88]
mov edi, dword [ebp + 0xb4]
imul eax, ebx
cmp edi, eax
jae 0x9ef95
mov ecx, dword [ebp + 0x90]
imul ecx, edi
jmp 0x9ef8d
mov eax, dword [ebp + 0xe4]
mov edx, dword [ebp + 0x84]
mov edi, dword [ebp + 0xb4]
imul edx, eax
cmp edi, edx
mov dword [esp + 0xcc], eax
jae 0x9ef63
mov ecx, dword [ebp + 0x8c]
imul ecx, edi
cmp ecx, eax
mov dword [esp + 0x78], 0
jae 0x9ef6b
mov dword [esp + 0x78], 1
mov ebx, dword [ebp + 0xe8]
mov edx, dword [ebp + 0x88]
mov eax, dword [ebp + 0xb8]
imul edx, ebx
cmp eax, edx
jae 0x9ef95
mov ecx, dword [ebp + 0x90]
imul ecx, eax
cmp ecx, ebx
jb 0x9ef95
xor esi, esi
jmp 0x9ef9a
mov esi, 1
mov eax, dword [ebp + 0x74]
mov ecx, dword [0x5271fc]
cmp dword [ecx + 0xb50], eax
jne 0x9efb4
test byte [ecx + 0xaf6], 1
jne 0x9efc5
cmp dword [ecx + 0xb54], eax
jne 0x9efcc
test byte [ecx + 0xaf7], 1
je 0x9efcc
mov ecx, 1
jmp 0x9efce
xor ecx, ecx
mov eax, dword [ebp + 0x228]
cmp eax, 2
je 0x9efe9
cmp eax, 3
mov dword [esp + 0x9c], 0
jne 0x9eff4
mov dword [esp + 0x9c], 1
cmp dword [esp + 0xd4], 0
je 0x9f01b
test ecx, ecx
je 0x9f011
mov edx, dword [0x4e73e0]
test byte [edx + 0x2382], 0x10
jne 0x9f032
cmp eax, 2
je 0x9f032
cmp eax, 3
je 0x9f032
cmp eax, 2
je 0x9f025
cmp eax, 3
jne 0x9f02e
test byte [ebp + 0x22c], 2
jne 0x9f032
xor eax, eax
jmp 0x9f037
mov eax, 1
cmp dword [esp + 0x94], 0
mov dword [esp + 0x8c], eax
je 0x9f055
mov dword [esp + 0x8c], 0
jmp 0x9f05e
test eax, eax
je 0x9f05e
mov esi, 1
mov eax, dword [0x4e73e0]
mov dl, 0x70
test byte [eax + 0x23b0], dl
je 0x9f093
mov ecx, dword [esp + 0x7c]
cmp dword [ecx + 0xc], 0
jne 0x9f08c
mov eax, 0x2710
cmp dword [ecx + 0x10], eax
jne 0x9f08c
cmp dword [ecx + 0x18], eax
jne 0x9f08c
cmp dword [ecx + 0x14], 0
je 0x9f093
mov ecx, 1
jmp 0x9f095
xor ecx, ecx
mov eax, dword [ebp + 0x87c]
test ah, 0xf
mov dword [esp + 0xfc], ecx
je 0x9f0b9
test eax, 0xff000
mov dword [esp + 0xdc], 1
jne 0x9f0c4
mov dword [esp + 0xdc], 0
test byte [esp + 0x181], 4
je 0x9f134
cmp dword [esp + 0x78], 0
jne 0x9f12d
test esi, esi
jne 0x9f12d
test ecx, ecx
jne 0x9f12d
cmp dword [esp + 0x34], 1
je 0x9f0f3
mov ecx, dword [0x4e73e0]
test byte [ecx + 0x2386], 4
je 0x9f12d
mov eax, dword [esp + 0x30]
cmp dword [esp + 0x108], eax
je 0x9f10e
mov ecx, dword [0x4e73e0]
test byte [ecx + 0x23b0], dl
jne 0x9f12d
cmp dword [esp + 0xdc], 0
je 0x9f134
mov eax, 2
cmp dword [ebp + 0x8c], eax
jb 0x9f12d
cmp dword [ebp + 0x90], eax
jae 0x9f134
mov eax, 1
jmp 0x9f136
xor eax, eax
test eax, eax
mov dword [esp + 0x84], eax
mov dword [esp + 0xd8], 0
je 0x9f181
mov cl, byte [esp + 0x180]
test cl, 3
mov eax, dword [ebp + 0xb8]
je 0x9f165
test cl, 8
je 0x9f165
shr eax, 1
imul edi, eax
mov eax, dword [esp + 0xcc]
imul eax, ebx
cmp edi, eax
jbe 0x9f181
mov dword [esp + 0xd8], 1
xor esi, esi
cmp dword [esp + 0xd4], esi
je 0x9f1c3
test byte [esp + 0x180], 8
je 0x9f1c3
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov edi, dword [esp + 0x18]
push edx
shr eax, 1
push eax
call fcn.0012eec0
test eax, eax
je 0x9f1c3
cmp dword [esp + 0x184], esi
mov dword [esp + 0x80], 1
ja 0x9f1ca
mov dword [esp + 0x80], esi
cmp dword [esp + 0x94], esi
je 0x9f1da
mov dword [esp + 0x80], esi
mov ecx, dword [0x4e73e0]
mov edx, dword [ecx + 0x1308]
lea esi, [ecx + 0x1308]
xor edi, edi
cmp edx, dword [esp + 0xa8]
jne 0x9f22d
cmp dword [ebp + 0x7b8], edi
jne 0x9f22d
mov eax, dword [ebp + 0xbc]
mov ecx, dword [esp + 0x1c]
mov edx, dword [ebp + 0xc4]
mov ebx, dword [ebp + 0xc0]
push eax
push edi
mov edi, dword [ebp + 0xc8]
push ecx
mov eax, ebp
call fcn.0009b4a0
mov ecx, dword [0x4e73e0]
xor edi, edi
cmp dword [esi], edi
jne 0x9f244
lea esi, [ecx + 0x1308]
call fcn.00074390
mov ecx, dword [0x4e73e0]
mov dword [esi], eax
test byte [esp + 0x181], 0x80
je 0x9f288
cmp dword [ebp + 0x784], edi
jbe 0x9f288
cmp dword [ebp + 0x7b8], edi
jbe 0x9f288
cmp dword [ebp + 0x7bc], edi
jbe 0x9f288
mov edx, dword [esp + 0xa8]
cmp dword [esi], edx
jne 0x9f288
test byte [ebp + 0x878], 0xf
je 0x9f288
mov esi, 1
mov dword [esp + 0xc4], esi
jmp 0x9f294
mov dword [esp + 0xc4], edi
mov esi, 1
mov ebx, dword [esp + 0x7c]
test byte [ebx + 4], 0x20
je 0x9f314
cmp dword [esp + 0x44], edi
je 0x9f314
test dword [ecx + 0x23bc], 0xf5f0000
je 0x9f314
mov eax, dword [ebx + 0x24]
cmp eax, edi
je 0x9f2bc
cmp eax, 0x10
jne 0x9f314
mov edi, dword [esp + 0xb0]
lea esi, [esp + 0x148]
mov eax, edi
call fcn.0010c270
mov eax, dword [esp + 0x164]
mov ecx, dword [esp + 0x168]
mov edx, dword [esp + 0x16c]
mov dword [edi + 0x4c50], eax
mov eax, 1
mov dword [edi + 0x4c54], ecx
mov ecx, dword [0x4e73e0]
mov dword [edi + 0x4c58], edx
mov dword [edi + 0x4c18], eax
mov dword [esp + 0xe0], eax
mov esi, eax
xor edi, edi
test byte [ecx + 0x23b8], 0x80
je 0x9f331
mov ecx, dword [ecx + 0x2520]
mov eax, dword [ecx]
call dword [eax + 0x124]
mov dword [eax + 0x4c18], edi
mov ecx, dword [esp + 0x80]
mov edx, dword [esp + 0xd4]
push ecx
push edx
mov eax, ebp
call fcn.000a2e20
test eax, eax
je 0x9f35e
cmp dword [esp + 0x184], edi
jbe 0x9f35e
mov dword [esp + 0xc0], esi
jmp 0x9f36b
mov dword [esp + 0xc0], edi
mov dword [ebx + 0x744], esi
cmp dword [ebx + 0x758], edi
je 0x9f389
cmp dword [esp + 0x44], edi
je 0x9f389
cmp dword [esp + 0x184], edi
jbe 0x9f389
mov dword [esp + 0xb8], esi
mov eax, dword [0x4e73e0]
mov ecx, dword [eax + 0x2520]
mov edx, dword [ecx]
call dword [edx + 0x124]
cmp dword [eax + 0x4ba0], 8
jb 0x9f3c4
mov eax, dword [0x4e73e0]
mov ecx, dword [eax + 0x2520]
mov edx, dword [ecx]
call dword [edx + 0x124]
cmp dword [eax + 0x4ba4], 0xc7
jae 0x9f3ff
mov eax, dword [0x4e73e0]
mov ecx, dword [eax + 0x2520]
mov edx, dword [ecx]
call dword [edx + 0x124]
cmp dword [eax + 0x4ba0], 4
jb 0x9f403
mov eax, dword [0x4e73e0]
mov ecx, dword [eax + 0x2520]
mov edx, dword [ecx]
call dword [edx + 0x124]
cmp dword [eax + 0x4ba4], 0x12b
jb 0x9f403
mov eax, esi
jmp 0x9f40a
mov eax, dword [esp + 0x98]
cmp dword [ebx + 0x638], edi
je 0x9f42c
cmp dword [esp + 0xc4], edi
jne 0x9f42c
cmp dword [esp + 0x44], edi
je 0x9f42c
cmp eax, esi
jne 0x9f42c
mov dword [esp + 0xbc], esi
mov eax, dword [ebp]
test eax, 0x200000
jne 0x9f43f
test byte [ebp + 0x17f], 0x80
je 0x9f454
mov dword [esp + 0xbc], edi
mov dword [esp + 0xb8], edi
mov dword [esp + 0xc0], edi
mov esi, dword [esp + 0x18]
cmp esi, 0x400
ja 0x9f46a
cmp dword [esp + 0x20], 0x258
jbe 0x9f47f
mov dword [esp + 0xbc], edi
mov dword [esp + 0xb8], edi
mov dword [esp + 0xc0], edi
mov ecx, dword [esp + 0x13c]
cmp ecx, 2
jae 0x9f4a9
mov dword [esp + 0xb4], edi
mov dword [esp + 0x88], edi
mov dword [esp + 0x84], edi
mov dword [esp + 0xd0], edi
jmp 0x9f512
and eax, 0x100000
je 0x9f4b5
cmp ecx, 4
jb 0x9f4be
cmp eax, edi
jne 0x9f52e
cmp ecx, 3
jae 0x9f52e
cmp dword [esp + 0xb4], edi
je 0x9f4de
mov dword [esp + 0xd0], edi
mov dword [esp + 0x84], edi
mov dword [esp + 0x88], edi
jmp 0x9f512
cmp dword [esp + 0xd0], edi
je 0x9f4f7
mov dword [esp + 0x84], edi
mov dword [esp + 0x88], edi
jmp 0x9f512
cmp dword [esp + 0x84], edi
je 0x9f509
mov dword [esp + 0x88], edi
jmp 0x9f512
cmp dword [esp + 0x88], edi
je 0x9f519
mov dword [esp + 0x80], edi
mov dword [esp + 0xe0], edi
mov dword [esp + 0xb8], edi
mov dword [esp + 0xbc], edi
mov eax, dword [ebp + 0x874]
mov ecx, dword [ebp + 0xb0]
and eax, 0x10
mov dword [esp + 0x114], eax
mov eax, dword [ebp + 0xb8]
lea edx, [eax + ecx + 1]
mov ecx, dword [esp + 0x20]
shr edx, 1
shr ecx, 1
call fcn.0012ef50
mov ecx, dword [0x4e73e0]
mov eax, dword [ecx + 0x27fe8]
test al, 2
mov ebx, dword [esp + 0x180]
mov dword [esp + 0x98], edi
mov dword [esp + 0xec], edi
je 0x9f585
test bl, 2
jne 0x9f58e
test al, 1
je 0x9f59b
test bl, 1
je 0x9f59b
mov dword [esp + 0x98], 1
jmp 0x9f5c2
test bl, 0xc
je 0x9f5b8
test bl, 3
je 0x9f5b8
test al, 0xc
je 0x9f5ad
test al, 3
jne 0x9f5c2
mov dword [esp + 0xec], 1
mov dword [ecx + 0x27fec], 0
mov dword [ecx + 0x27fe8], ebx
cmp word [ebp + 0x45a], 0x177a
mov dword [esp + 0xcc], 0
jne 0x9f5e9
mov dword [esp + 0xcc], 1
test byte [ecx + 0x2484], 0x20
je 0x9f603
lea esi, [ecx + 8]
mov eax, esi
call fcn.0006a180
mov eax, esi
call fcn.000b6430
cmp dword [esp + 0xb4], 0
jne 0x9f688
cmp dword [esp + 0xb8], 0
jne 0x9f688
cmp dword [esp + 0x88], 0
jne 0x9f688
cmp dword [esp + 0xc0], 0
jne 0x9f688
cmp dword [esp + 0xbc], 0
jne 0x9f688
cmp dword [esp + 0x84], 0
jne 0x9f688
cmp dword [esp + 0xc4], 0
jne 0x9f688
cmp dword [esp + 0x80], 0
jne 0x9f688
cmp dword [esp + 0xd0], 0
jne 0x9f688
cmp dword [esp + 0xdc], 0
jne 0x9f688
cmp dword [esp + 0xe0], 0
jne 0x9f688
cmp dword [esp + 0xf0], 0
jne 0x9f688
mov edx, dword [esp + 0x7c]
test byte [edx + 0x743], 0x10
je 0x9f694
test ebx, 0x10000000
je 0x9f900
test ebx, 0x10000000
je 0x9f6c8
mov eax, dword [ebp + 0x9c]
mov ecx, dword [ebp + 0xa4]
mov edx, dword [ebp + 0xa8]
mov dword [esp + 0x14], eax
mov dword [esp + 0x6c], eax
mov eax, dword [ebp + 0xa0]
mov dword [esp + 0x10], eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x1c], edx
mov esi, dword [esp + 0x17c]
mov eax, dword [esi + 0xdc]
mov eax, dword [eax + 0x60]
mov ebx, dword [eax]
call fcn.000aaed0
test eax, eax
je 0x9f71e
cmp dword [esp + 0xcc], 0
jne 0x9f70c
mov ecx, dword [0x4e73e0]
mov ecx, dword [ecx + 0x2520]
mov edx, dword [ecx]
call dword [edx + 0x124]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x10]
test eax, eax
jne 0x9f71e
mov eax, dword [esi + 0xdc]
mov ecx, dword [eax + 0x60]
mov ecx, dword [ecx]
push 0x32
call fcn.000ab220
mov eax, dword [ebp + 0x158]
mov ecx, eax
and ecx, 0xffff
cmp ecx, 0x10
mov dword [esp + 0x18], ecx
ja 0x9f73d
mov dword [esp + 0x18], 0x10
mov ecx, dword [esp + 0x24]
shr eax, 0x10
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0xb0]
mov edx, eax
shr eax, 1
imul edx, ecx
add dword [esp + 0x14], edx
imul eax, ecx
add dword [esp + 0x10], eax
cmp dword [esp + 0x9c], 0
jne 0x9f78b
cmp dword [ebp + 0x5c], 0x3231564e
mov eax, dword [ebp + 0xac]
jne 0x9f781
add dword [esp + 0x14], eax
and al, 0xfe
jmp 0x9f787
add eax, eax
add dword [esp + 0x14], eax
add dword [esp + 0x10], eax
mov eax, dword [0x4e73e0]
test byte [eax + 0x2484], 0x20
je 0x9f7a3
add eax, 8
xor ecx, ecx
call fcn.000b6350
cmp dword [ebp + 0x94], 0
je 0x9f7fb
mov ebx, dword [esp + 0x180]
test bl, 0xc
je 0x9f7c4
test bl, 3
je 0x9f7c4
mov eax, 1
jmp 0x9f7c6
xor eax, eax
mov edi, dword [esp + 0xa4]
mov esi, dword [esp + 0x58]
push eax
push 0
push edi
push esi
push ebp
call fcn.0009def0
test eax, eax
jne 0x9f838
lea eax, [esp + 0x128]
call fcn.00095b90
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x164
ret 0x18
mov ecx, dword [esp + 0x180]
test cl, 0xc
je 0x9f813
test cl, 3
je 0x9f813
mov eax, 1
jmp 0x9f815
xor eax, eax
mov edi, dword [esp + 0xa4]
mov esi, dword [esp + 0x58]
push eax
and ecx, 0x20
push ecx
push edi
push esi
push ebp
call fcn.0009def0
test eax, eax
je 0x9f7e0
mov ebx, dword [esp + 0x180]
mov eax, dword [esp + 0x18c]
mov ecx, dword [esp + 0x188]
mov edx, dword [ebp + 0xac]
push eax
mov eax, dword [esp + 0xa0]
push ecx
mov ecx, dword [esp + 0x94]
push 0x100000
push 0x100000
push edx
mov edx, dword [esp + 0xfc]
push eax
mov eax, dword [esp + 0x34]
push ecx
mov ecx, dword [esp + 0x3c]
or edx, ebx
push edx
mov edx, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x48]
push edi
push ecx
mov ecx, dword [esp + 0x3c]
push edx
mov edx, dword [esp + 0x44]
push eax
mov eax, dword [esp + 0xa0]
push ecx
push edx
push eax
push esi
push ebp
call fcn.0009cab0
test eax, eax
mov eax, dword [0x4e73e0]
je 0x9f8e8
mov esi, 1
add dword [ebp + 0x150], esi
xor word [ebp + 0x154], si
test byte [eax + 0x2484], 0x20
je 0x9f8cd
add eax, 8
call fcn.0006a0c0
lea eax, [esp + 0x128]
call fcn.00095b90
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x164
ret 0x18
test byte [eax + 0x2484], 0x20
je 0x9f8f9
add eax, 8
call fcn.000b6430
mov ebx, dword [esp + 0x180]
lea ecx, [esp + 0x70]
push ecx
call sub.WIN32K.SYS_EngQueryPerformanceCounter
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x74]
mov edx, eax
sub edx, dword [esp + 0x5c]
mov esi, ecx
sbb esi, dword [esp + 0x60]
cmp dword [esp + 0x114], 0
mov dword [ebp + 0x3e8], edx
mov dword [ebp + 0x3ec], esi
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], ecx
jne 0x9f987
mov ecx, dword [ebp + 0x228]
cmp ecx, 3
mov eax, dword [esp + 0xa4]
je 0x9f953
cmp ecx, 2
jne 0x9f956
xor eax, 1
test bl, 0xc
je 0x9f967
test bl, 3
je 0x9f967
mov ecx, 1
jmp 0x9f969
xor ecx, ecx
push ecx
and ebx, 0x20
push ebx
push eax
mov eax, dword [esp + 0x64]
push eax
push ebp
call fcn.0009def0
test eax, eax
je 0x9f7e0
or byte [esp + 0x42], 4
mov esi, dword [esp + 0xb4]
test esi, esi
jne 0x9f9f9
cmp dword [esp + 0xb8], esi
jne 0x9f9f9
cmp dword [esp + 0x88], esi
jne 0x9f9f9
cmp dword [esp + 0xc0], esi
jne 0x9f9f9
cmp dword [esp + 0xbc], esi
jne 0x9f9f9
cmp dword [esp + 0x84], esi
jne 0x9f9f9
cmp dword [esp + 0xc4], esi
jne 0x9f9f9
cmp dword [esp + 0x80], esi
jne 0x9f9f9
cmp dword [esp + 0xd0], esi
jne 0x9f9f9
cmp dword [esp + 0xdc], esi
jne 0x9f9f9
cmp dword [esp + 0xe0], esi
jne 0x9f9f9
cmp dword [esp + 0xf0], esi
je 0x9fac8
mov eax, dword [0x4e73e0]
test dword [eax + 0x23bc], 0x30c0
je 0x9fa14
push 0
add eax, 8
call fcn.000b5a20
call fcn.000951c0
lea ecx, [esp + 0x70]
push ecx
call sub.WIN32K.SYS_EngQueryPerformanceCounter
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x74]
mov edx, eax
sub edx, dword [esp + 0x5c]
mov edi, ecx
sbb edi, dword [esp + 0x60]
or byte [esp + 0x43], 1
mov dword [esp + 0x60], ecx
mov ecx, dword [0x4e73e0]
mov dword [ebp + 0x3f0], edx
mov dword [ebp + 0x3f4], edi
mov dword [esp + 0x5c], eax
test byte [ecx + 0x2484], 0x20
je 0x9fa6d
lea eax, [ecx + 8]
call fcn.000b6430
mov ecx, dword [0x4e73e0]
cmp dword [esp + 0xc4], 0
je 0x9face
mov eax, dword [ecx + 0x1404]
and eax, 0x300000
cmp eax, 0x100000
je 0x9faac
cmp eax, 0x300000
je 0x9faac
mov eax, dword [ebp + 0x7b8]
mov edx, dword [ebp + 0x7bc]
mov dword [esp + 0x94], eax
mov dword [esp + 0x110], edx
jmp 0x9face
mov eax, dword [ebp + 0x7bc]
mov edx, dword [ebp + 0x7b8]
mov dword [esp + 0x94], eax
mov dword [esp + 0x110], edx
jmp 0x9face
mov ecx, dword [0x4e73e0]
test byte [ebp + 2], 0x10
je 0x9fbef
cmp dword [esp + 0xd8], 0
jne 0x9fbef
cmp dword [esp + 0x84], 0
je 0x9fbef
xor eax, eax
cmp dword [esp + 0xf0], eax
je 0x9fb04
mov eax, 1
cmp dword [esp + 0xb8], 0
je 0x9fb11
add eax, 1
cmp dword [esp + 0xe0], 0
je 0x9fb1e
add eax, 1
mov edx, dword [esp + 0x80]
test edx, edx
je 0x9fb2c
add eax, 1
cmp dword [esp + 0x88], 0
je 0x9fb53
cmp dword [esp + 0xc8], 0
je 0x9fb53
add eax, 1
test edx, edx
jne 0x9fb53
cmp dword [esp + 0x8c], edx
je 0x9fb53
add eax, 1
cmp dword [esp + 0xbc], 0
je 0x9fb60
add eax, 1
cmp dword [esp + 0xd0], 0
je 0x9fb76
add eax, 1
cmp dword [esp + 0x44], 0
jne 0x9fb90
jmp 0x9fb8d
test esi, esi
je 0x9fb90
test byte [ecx + 0x23b2], 0xe0
je 0x9fb8d
cmp dword [esp + 0x1c], 0x3231564e
je 0x9fb90
add eax, 1
add eax, 0xffffffff
test al, 1
jne 0x9fbef
mov esi, dword [esp + 0x28]
mov eax, dword [esp + 0x64]
mov edi, dword [esp + 0x48]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov ebx, dword [esp + 0x50]
mov dword [esp + 0xa8], esi
mov esi, dword [esp + 0x4c]
mov dword [esp + 0x2c], edi
mov edi, dword [esp + 0x38]
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0xa8]
mov dword [esp + 0x64], esi
mov dword [esp + 0x30], edi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x48], ecx
mov dword [esp + 0x38], edx
mov dword [esp + 0x50], eax
mov dword [esp + 0x3c], 1
jmp 0x9fbf7
mov esi, dword [esp + 0x64]
mov edi, dword [esp + 0x30]
cmp dword [esp + 0xf0], 0
je 0x9fd73
mov ecx, dword [ebp + 0x40]
mov ecx, dword [ebp + ecx*4 + 0x14]
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x140], 0
mov edx, dword [ecx + 0xdc]
mov eax, dword [edx + 4]
cmp ebx, eax
mov dword [esp + 0x78], ebx
jb 0x9fc30
mov dword [esp + 0x78], eax
mov eax, dword [esp + 0x20]
mov edx, dword [edx + 8]
cmp eax, edx
mov dword [esp + 0xa8], eax
jb 0x9fc49
mov dword [esp + 0xa8], edx
cmp dword [ebp + 0x5c], 0x3231564e
je 0x9fc54
shr edi, 1
mov edx, dword [esp + 0xb0]
mov ebx, dword [edx]
mov eax, dword [ecx + 0xdc]
lea edx, [esp + 0x140]
push edx
movzx edx, byte [eax + 0x3e]
movzx eax, byte [eax + 0x3d]
push ecx
mov ecx, dword [esp + 0x184]
push ecx
mov ecx, dword [esp + 0xb4]
push 0
push edx
mov edx, dword [esp + 0x8c]
push eax
mov eax, dword [esp + 0x44]
push 0
push 0x3231564e
push ecx
push edx
push 0
push 0
push edi
push eax
mov eax, dword [esp + 0x60]
push esi
call fcn.00074240
mov ecx, dword [esp + 0x1b8]
mov edx, dword [ecx + 0xdc]
mov ecx, dword [esp + 0x5c]
push eax
mov eax, dword [edx + 0x3c]
mov edx, dword [esp + 0x58]
and eax, 0xff
push eax
mov eax, dword [esp + 0x14c]
push ecx
mov ecx, dword [esp + 0xd8]
push edx
mov edx, dword [esp + 0x80]
push 0
push 0
push eax
push 0
push ecx
mov ecx, dword [esp + 0x110]
push edx
call dword [ebx + 0x1c]
test eax, eax
je 0x9f7e0
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x48]
mov ebx, dword [esp + 0x28]
mov ecx, esi
mov dword [esp + 0x10], eax
mov dword [esp + 0x6c], esi
mov esi, dword [esp + 0x4c]
mov dword [esp + 0x2c], edx
mov edx, dword [esp + 0x50]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x4c], ecx
mov ecx, dword [esp + 0x10]
mov eax, edi
mov edi, dword [esp + 0x38]
mov dword [esp + 0x28], edx
mov dword [esp + 0x48], ecx
mov edx, 1
add dword [esp + 0x3c], edx
mov ecx, 0x3231564e
cmp dword [ebp + 0x5c], ecx
mov dword [esp + 0x24], eax
mov dword [esp + 0x34], ebx
mov dword [esp + 0x64], esi
mov dword [esp + 0x30], edi
mov dword [esp + 0x38], eax
mov dword [esp + 0x50], ebx
je 0x9fd69
add eax, eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x44], edx
jmp 0x9fd77
mov ebx, dword [esp + 0x34]
cmp dword [esp + 0xe0], 0
je 0x9fe44
mov ecx, dword [0x4e73e0]
mov ecx, dword [ecx + 0x2520]
mov edx, dword [ecx]
call dword [edx + 0x124]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x30]
push edx
mov dword [esp + 0xb8], eax
mov eax, dword [eax]
push edi
push ecx
mov dword [esp + 0x118], eax
mov eax, dword [esp + 0x38]
push esi
call fcn.00074240
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x28]
mov ebx, dword [esp + 0x48]
push eax
mov eax, dword [esp + 0x28]
push edx
push eax
mov eax, dword [esp + 0x128]
push ecx
mov ecx, dword [esp + 0xd4]
push ebx
call dword [eax + 0x5c]
test eax, eax
je 0x9fe44
mov edx, dword [esp + 0x48]
mov ecx, dword [esp + 0x2c]
mov ebx, dword [esp + 0x28]
add dword [esp + 0x3c], 1
mov eax, esi
mov dword [esp + 0x24], edi
mov edi, dword [esp + 0x38]
mov dword [esp + 0x6c], esi
mov esi, dword [esp + 0x4c]
mov dword [esp + 0x14], eax
mov dword [esp + 0x2c], edx
mov edx, dword [esp + 0x50]
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x64], esi
mov dword [esp + 0x30], edi
mov dword [esp + 0x28], edx
mov dword [esp + 0x48], ecx
mov dword [esp + 0x38], eax
mov dword [esp + 0x50], ebx
cmp dword [esp + 0xb4], 0
jne 0x9fe58
cmp dword [esp + 0x84], 0
je 0x9fea5
mov ecx, dword [0x4e73e0]
mov ecx, dword [ecx + 0x2520]
mov edx, dword [ecx]
call dword [edx + 0x124]
mov ecx, dword [ebp + 0x5c]
mov edx, dword [eax]
push ecx
mov ecx, dword [ebp + 0xb8]
push ecx
mov ecx, dword [ebp + 0xb4]
push ecx
mov ecx, dword [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x2c]
push ecx
push 1
mov ecx, eax
call dword [edx + 0x78]
test eax, eax
mov dword [esp + 0xb0], 1
jne 0x9feb0
mov dword [esp + 0xb0], 0
mov eax, dword [0x4e73e0]
cmp dword [eax + 0x20a0], 0
je 0x9fecf
cmp dword [esp + 0xb4], 0
je 0x9fecf
or byte [eax + 0x20af], 2
cmp dword [esp + 0xc4], 0
je 0x9fff1
cmp dword [esp + 0xa0], 0
je 0x9fff1
cmp dword [esp + 0xe4], 0
je 0x9fff1
mov edx, dword [ebp + 0xbc]
mov eax, dword [esp + 0x1c]
mov edi, dword [ebp + 0xc8]
mov ebx, dword [ebp + 0xc0]
push edx
mov edx, dword [ebp + 0xc4]
push 0
push eax
mov eax, ebp
call fcn.0009b4a0
mov eax, dword [ebp + 0x784]
cmp eax, 2
je 0x9ff30
cmp eax, 3
jne 0x9ff46
mov ebx, dword [esp + 0xa4]
mov eax, dword [esp + 0x58]
push 1
xor ebx, 1
push ebp
call fcn.0009e380
mov ecx, dword [esp + 0x180]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov edi, dword [esp + 0x34]
push 0x100000
push 0x100000
push ecx
mov ecx, dword [esp + 0x11c]
push 0
push 0
push edx
mov edx, dword [esp + 0xac]
push eax
mov eax, dword [esp + 0x40]
push ecx
mov ecx, dword [esp + 0x30]
push edx
mov edx, dword [esp + 0x38]
push eax
push ecx
push edx
mov eax, edi
call fcn.00074240
push eax
mov eax, dword [esp + 0x8c]
push edi
push eax
push ebp
call fcn.0009b650
test eax, eax
je 0x9ffe9
and byte [ebp + 2], 0xfb
or byte [esp + 0x41], 0x80
lea ecx, [esp + 0x70]
push ecx
mov dword [ebp + 0x83c], 0
call sub.WIN32K.SYS_EngQueryPerformanceCounter
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x74]
mov edx, eax
sub edx, dword [esp + 0x5c]
mov edi, ecx
sbb edi, dword [esp + 0x60]
mov dword [ebp + 0x430], edx
mov dword [ebp + 0x434], edi
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], ecx
mov edi, dword [esp + 0x30]
mov ebx, dword [esp + 0x34]
mov eax, dword [0x4e73e0]
xor ecx, ecx
cmp dword [eax + 0x20a0], ecx
je 0xa0010
cmp dword [esp + 0xd4], ecx
jne 0xa0010
or dword [eax + 0x20ac], 0x40
cmp dword [esp + 0x80], ecx
je 0xa01b4
mov eax, dword [esp + 0x44]
cmp eax, ecx
je 0xa0034
cmp dword [ebp + 0x5c], 0x32595559
jne 0xa0034
shr edi, 1
mov dword [esp + 0x30], edi
mov dword [esp + 0x108], ecx
mov dword [esp + 0x10c], ecx
mov dword [esp + 0xa8], ecx
mov dword [esp + 0xac], ecx
cmp eax, ecx
mov ecx, 0x3231564e
jne 0xa005d
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0xa8]
push eax
mov eax, dword [esp + 0x30]
lea edx, [esp + 0x10c]
push edx
mov edx, dword [esp + 0x2c]
push edi
push eax
mov eax, dword [esp + 0x20]
push esi
push edx
mov edx, dword [esp + 0x2c]
push eax
mov eax, dword [esp + 0x108]
push edx
mov edx, dword [esp + 0xb8]
push ebx
push eax
mov eax, dword [esp + 0x1a8]
push edx
mov edx, dword [esp + 0x44]
and eax, 1
push eax
mov eax, dword [esp + 0x58]
push edx
call fcn.0012ef90
test eax, eax
je 0xa019e
mov eax, dword [esp + 0x108]
mov ecx, dword [esp + 0x10c]
mov edx, eax
or edx, ecx
je 0xa00da
or byte [esp + 0x41], 0x40
mov dword [ebp + 0x410], eax
mov dword [ebp + 0x414], ecx
mov eax, dword [esp + 0xa8]
mov ecx, dword [esp + 0xac]
mov edx, eax
or edx, ecx
je 0xa00ff
or byte [esp + 0x42], 0x80
mov dword [ebp + 0x418], eax
mov dword [ebp + 0x41c], ecx
lea eax, [esp + 0x5c]
push eax
call sub.WIN32K.SYS_EngQueryPerformanceCounter
test byte [ebp + 2], 0x80
je 0xa0119
and dword [esp + 0x180], 0xfffffffb
jmp 0xa0121
and dword [esp + 0x180], 0xfffffff8
mov edx, dword [esp + 0x48]
mov ecx, dword [esp + 0x2c]
mov ebx, dword [esp + 0x28]
add dword [esp + 0x3c], 1
cmp dword [esp + 0x44], 0
mov eax, esi
mov dword [esp + 0x24], edi
mov edi, dword [esp + 0x38]
mov dword [esp + 0x6c], esi
mov esi, dword [esp + 0x4c]
mov dword [esp + 0x14], eax
mov dword [esp + 0x2c], edx
mov edx, dword [esp + 0x50]
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x8c], 0
mov dword [esp + 0x10], ecx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x64], esi
mov dword [esp + 0x30], edi
mov dword [esp + 0x28], edx
mov dword [esp + 0x48], ecx
mov dword [esp + 0x38], eax
mov dword [esp + 0x50], ebx
je 0xa01b4
cmp dword [ebp + 0x5c], 0x32595559
jne 0xa01b4
mov ecx, eax
lea edx, [ecx + ecx]
mov dword [esp + 0x38], edx
jmp 0xa01b4
cmp dword [esp + 0x44], 0
je 0xa01b4
cmp dword [ebp + 0x5c], 0x32595559
jne 0xa01b4
add edi, edi
mov dword [esp + 0x30], edi
mov eax, dword [0x4e73e0]
cmp dword [eax + 0x20a0], 0
je 0xa01d3
cmp dword [esp + 0x8c], 0
je 0xa01d3
or dword [eax + 0x20ac], 1
cmp dword [esp + 0xb8], 0
je 0xa02cb
cmp dword [esp + 0x44], 0
je 0xa01f7
cmp dword [ebp + 0x5c], 0x32595559
jne 0xa01f7
shr edi, 1
mov dword [esp + 0x30], edi
mov ecx, dword [esp + 0x7c]
mov edx, dword [esp + 0x1c]
push edx
mov edx, dword [esp + 0x1c]
mov dword [ecx + 0x760], 0
mov ecx, dword [eax + 0x2520]
mov eax, dword [esp + 0x24]
push eax
mov eax, dword [esp + 0x34]
push edx
mov edx, dword [esp + 0x30]
push edi
push eax
mov eax, dword [esp + 0x24]
push esi
push ebx
push edx
mov edx, dword [esp + 0x34]
push eax
mov eax, dword [ecx]
push edx
push ebx
call dword [eax + 0x124]
call fcn.0010aac0
test eax, eax
je 0xa02b5
mov edx, dword [esp + 0x2c]
mov ebx, dword [esp + 0x28]
add dword [esp + 0x3c], 1
cmp dword [esp + 0x44], 0
mov ecx, esi
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0x48]
mov eax, edi
mov edi, dword [esp + 0x38]
mov dword [esp + 0x6c], esi
mov esi, dword [esp + 0x4c]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x2c], edx
mov edx, dword [esp + 0x50]
mov dword [esp + 0x4c], ecx
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x24], eax
mov dword [esp + 0x34], ebx
mov dword [esp + 0x64], esi
mov dword [esp + 0x30], edi
mov dword [esp + 0x28], edx
mov dword [esp + 0x48], ecx
mov dword [esp + 0x38], eax
mov dword [esp + 0x50], ebx
je 0xa02cb
cmp dword [ebp + 0x5c], 0x32595559
jne 0xa02cb
lea edx, [eax + eax]
mov dword [esp + 0x38], edx
jmp 0xa02cb
cmp dword [esp + 0x44], 0
je 0xa02cb
cmp dword [ebp + 0x5c], 0x32595559
jne 0xa02cb
add edi, edi
mov dword [esp + 0x30], edi
cmp dword [esp + 0x88], 0
je 0xa0502
cmp dword [esp + 0xc8], 0
je 0xa0502
cmp dword [esp + 0x8c], 0
je 0xa03f1
cmp dword [ebp + 0x784], 4
jb 0xa03f1
mov eax, dword [esp + 0x180]
mov ecx, dword [esp + 0x8c]
push 0
push 0
mov dword [esp + 0xa0], eax
and ah, 0xfe
lea edx, [esp + 0x104]
mov dword [esp + 0x188], eax
lea eax, [esp + 0xf4]
push eax
push 0
push ecx
push edx
mov edx, dword [esp + 0x38]
lea eax, [esp + 0x198]
push eax
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0x38]
push ecx
push edx
push eax
mov eax, dword [esp + 0x54]
lea ecx, [esp + 0x48]
push ecx
mov ecx, dword [esp + 0x54]
lea edx, [esp + 0x44]
push edx
mov edx, dword [esp + 0x54]
push edi
push eax
mov eax, dword [esp + 0x48]
push esi
push ecx
mov ecx, dword [esp + 0x54]
push edx
mov edx, dword [esp + 0x9c]
push eax
push ecx
push ebx
push edx
push ebp
call fcn.0009a810
test eax, eax
je 0xa03e3
mov edx, dword [esp + 0x48]
mov ecx, dword [esp + 0x2c]
mov ebx, dword [esp + 0x28]
add dword [esp + 0x3c], 1
or byte [esp + 0x41], 4
mov eax, esi
mov dword [esp + 0x24], edi
mov edi, dword [esp + 0x38]
mov dword [esp + 0x6c], esi
mov esi, dword [esp + 0x4c]
mov dword [esp + 0x14], eax
mov dword [esp + 0x2c], edx
mov edx, dword [esp + 0x50]
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x64], esi
mov dword [esp + 0x30], edi
mov dword [esp + 0x28], edx
mov dword [esp + 0x48], ecx
mov dword [esp + 0x38], eax
mov dword [esp + 0x50], ebx
mov ecx, dword [esp + 0x98]
mov dword [esp + 0x180], ecx
cmp dword [ebp + 0x5c], 0x32595559
jne 0xa0400
shr edi, 1
mov dword [esp + 0x30], edi
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
push edx
mov edx, dword [esp + 0x30]
push eax
mov eax, dword [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x30]
push edi
push edx
mov edx, dword [esp + 0x24]
push esi
push eax
mov eax, dword [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x78]
push edx
push eax
mov eax, dword [esp + 0x7c]
push ebx
push ecx
push ebp
call fcn.00099ef0
test eax, eax
je 0xa0502
mov edx, dword [esp + 0x54]
mov ecx, dword [ebp + 0x40]
mov ebx, dword [ebp + ecx*4 + 0x14]
add edx, 0x28
push edx
mov eax, 0x11
call fcn.00090c40
mov edx, dword [esp + 0x54]
add dword [esp + 0x3c], 1
test byte [edx + 4], 2
jne 0xa04c8
cmp dword [ebp + 0x5c], 0x32595559
mov ebx, dword [esp + 0x48]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov dword [esp + 0x2c], ebx
mov ebx, dword [esp + 0x38]
mov eax, esi
mov dword [esp + 0x6c], esi
mov esi, dword [esp + 0x4c]
mov dword [esp + 0x30], ebx
mov ebx, dword [esp + 0x50]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x24], edi
mov dword [esp + 0x34], edx
mov dword [esp + 0x64], esi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x4c], eax
mov dword [esp + 0x48], ecx
mov dword [esp + 0x38], edi
mov dword [esp + 0x50], edx
jne 0xa04c8
lea eax, [edi + edi]
mov dword [esp + 0x38], eax
lea ecx, [esp + 0x70]
push ecx
call sub.WIN32K.SYS_EngQueryPerformanceCounter
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x74]
mov edx, eax
sub edx, dword [esp + 0x5c]
mov edi, ecx
sbb edi, dword [esp + 0x60]
or dword [esp + 0x40], 0x200200
mov dword [ebp + 0x3f8], edx
mov dword [ebp + 0x3fc], edi
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], ecx
cmp dword [esp + 0xc4], 0
je 0xa061c
cmp dword [esp + 0xa0], 0
je 0xa061c
cmp dword [esp + 0xe4], 0
jne 0xa061c
mov eax, dword [ebp + 0xbc]
mov ecx, dword [esp + 0x1c]
mov edi, dword [ebp + 0xc8]
mov edx, dword [ebp + 0xc4]
mov ebx, dword [ebp + 0xc0]
push eax
push 0
push ecx
mov eax, ebp
call fcn.0009b4a0
mov eax, dword [ebp + 0x784]
cmp eax, 2
je 0xa0563
cmp eax, 3
jne 0xa0579
mov ebx, dword [esp + 0xa4]
mov eax, dword [esp + 0x58]
push 1
xor ebx, 1
push ebp
call fcn.0009e380
mov edx, dword [esp + 0x180]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
push 0x100000
mov edi, dword [esp + 0x38]
push 0x100000
push edx
mov edx, dword [esp + 0x11c]
push 0
push 0
push eax
mov eax, dword [esp + 0xac]
push ecx
mov ecx, dword [esp + 0x40]
push edx
mov edx, dword [esp + 0x30]
push eax
mov eax, dword [esp + 0x38]
push ecx
push edx
push eax
mov eax, edi
call fcn.00074240
mov ecx, dword [esp + 0x88]
push eax
push edi
push ecx
push ebp
call fcn.0009b650
test eax, eax
je 0xa061c
and byte [ebp + 2], 0xfb
or byte [esp + 0x41], 0x80
lea edx, [esp + 0x70]
push edx
mov dword [ebp + 0x83c], 0
call sub.WIN32K.SYS_EngQueryPerformanceCounter
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x74]
mov edx, eax
sub edx, dword [esp + 0x5c]
mov edi, ecx
sbb edi, dword [esp + 0x60]
mov dword [ebp + 0x430], edx
mov dword [ebp + 0x434], edi
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], ecx
mov eax, dword [ebp + 0xac]
mov ecx, dword [ebp + 0xb0]
mov dword [esp + 0x90], eax
mov eax, dword [ebp + 0x158]
mov dword [esp + 0xa8], ecx
mov ecx, eax
and ecx, 0xffff
shr eax, 0x10
cmp dword [esp + 0xd0], 0
mov dword [esp + 0x7c], ecx
mov dword [esp + 0x78], eax
je 0xa091e
cmp dword [esp + 0x44], 0
jne 0xa0741
cmp dword [ebp + 0x5c], 0x3231564e
mov edi, dword [esp + 0x30]
je 0xa067b
shr edi, 1
mov dword [esp + 0x30], edi
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov ebx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
push 0x3231564e
push edx
mov edx, dword [esp + 0x18]
push eax
push eax
mov eax, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x28]
push edi
push ebx
push esi
push ecx
mov ecx, dword [esp + 0x4c]
push edx
mov edx, dword [esp + 0x5c]
push eax
push ebp
call fcn.00093d20
test eax, eax
je 0xa0805
mov edx, dword [esp + 0x48]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x4c]
add dword [esp + 0x3c], 1
mov dword [esp + 0x2c], edx
mov edx, dword [esp + 0x50]
mov dword [esp + 0x34], eax
mov dword [esp + 0x50], eax
mov eax, dword [ebp + 0x5c]
cmp eax, 0x3231564e
mov dword [esp + 0x64], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
mov dword [esp + 0x24], edi
mov dword [esp + 0x6c], esi
mov dword [esp + 0x30], ecx
mov dword [esp + 0x28], edx
mov dword [esp + 0x4c], esi
mov dword [esp + 0x48], ebx
mov dword [esp + 0x38], edi
je 0xa071a
lea ecx, [edi + edi]
mov dword [esp + 0x38], ecx
cmp eax, 0x32595559
mov dword [esp + 0x1c], 0x3231564e
jne 0xa0741
mov edx, dword [ebp + 0x138]
and edx, 0xfff1ffff
or edx, 0x10000
mov dword [ebp + 0x138], edx
mov eax, dword [esp + 0x3c]
mov edx, dword [esp + 0x1c]
push eax
mov ebx, dword [esp + 0x68]
lea ecx, [esp + 0x184]
push ecx
push edx
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x60]
lea edx, [esp + 0x4c]
push edx
lea eax, [esp + 0x60]
push eax
mov eax, dword [esp + 0x44]
push ecx
mov ecx, dword [esp + 0x44]
lea edx, [esp + 0x4c]
push edx
mov edx, dword [esp + 0x34]
push ebx
push eax
mov eax, dword [esp + 0x40]
push ecx
mov ecx, dword [esp + 0x64]
push edx
mov edx, dword [esp + 0x8c]
push eax
push ecx
push edx
lea esi, [esp + 0x70]
mov edi, ebp
call fcn.0009a0b0
test eax, eax
je 0xa091a
mov eax, dword [0x4e73e0]
mov ecx, dword [eax + 0x1404]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
and ecx, 0x300000
cmp ecx, 0x100000
je 0xa0825
cmp ecx, 0x300000
je 0xa081d
cmp ecx, 0x200000
jne 0xa087d
sub eax, dword [esp + 0x7c]
sub eax, dword [ebp + 0xac]
mov dword [esp + 0x90], eax
mov eax, edx
sub eax, dword [esp + 0x78]
sub eax, dword [ebp + 0xb0]
mov dword [esp + 0xa8], eax
jmp 0xa087d
cmp dword [ebp + 0x5c], 0x3231564e
je 0xa0926
add edi, edi
mov dword [esp + 0x30], edi
jmp 0xa0926
cmp ecx, 0x100000
jne 0xa0847
mov ecx, dword [ebp + 0xb0]
mov eax, edx
sub eax, dword [esp + 0x7c]
mov dword [esp + 0x90], ecx
sub eax, dword [ebp + 0xac]
mov dword [esp + 0xa8], eax
jmp 0xa0865
sub eax, dword [esp + 0x78]
mov edx, dword [ebp + 0xac]
sub eax, dword [ebp + 0xb0]
mov dword [esp + 0xa8], edx
mov dword [esp + 0x90], eax
mov eax, dword [ebp + 0x158]
mov ecx, eax
shr ecx, 0x10
and eax, 0xffff
mov dword [esp + 0x7c], ecx
mov dword [esp + 0x78], eax
mov edi, dword [esp + 0x4c]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
mov esi, dword [esp + 0x28]
add dword [esp + 0x3c], 1
cmp dword [ebp + 0x5c], 0x3231564e
mov dword [esp + 0x64], edi
mov edi, dword [esp + 0x48]
mov dword [esp + 0x2c], edi
mov edi, dword [esp + 0x38]
mov ecx, ebx
mov dword [esp + 0x30], edi
mov edi, dword [esp + 0x50]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x34], esi
mov dword [esp + 0x28], edi
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x48], edx
mov dword [esp + 0x38], eax
mov dword [esp + 0x50], esi
je 0xa08e3
add eax, eax
mov dword [esp + 0x38], eax
or byte [esp + 0x43], 0x40
lea ecx, [esp + 0x70]
push ecx
call sub.WIN32K.SYS_EngQueryPerformanceCounter
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x74]
mov edx, eax
sub edx, dword [esp + 0x5c]
mov esi, ecx
sbb esi, dword [esp + 0x60]
mov dword [ebp + 0x400], edx
mov dword [ebp + 0x404], esi
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], ecx
mov esi, dword [esp + 0x64]
mov edi, dword [esp + 0x30]
mov ebx, dword [esp + 0x2c]
cmp dword [esp + 0x1c], 0x3231564e
jne 0xa0972
cmp dword [ebp + 0x5c], 0x32595559
jne 0xa0972
cmp dword [esp + 0x68], 0
jne 0xa0972
cmp dword [esp + 0x88], 0
je 0xa0954
cmp dword [esp + 0xc8], 0
je 0xa0972
mov eax, dword [0x4e73e0]
test byte [eax + 0x23b2], 0xe0
je 0xa0972
mov dword [esp + 0xb4], 0
jmp 0xa0ae9
cmp dword [esp + 0xb4], 0
je 0xa0ae9
mov ecx, dword [0x4e73e0]
mov ecx, dword [ecx + 0x2520]
mov edx, dword [ecx]
call dword [edx + 0x124]
mov ecx, dword [ebp + 0x5c]
mov edx, dword [esp + 0x20]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ecx
mov ecx, dword [esp + 0x38]
push edx
push ecx
push 0
push 0
mov dword [esp + 0x98], eax
mov eax, dword [eax]
push edi
push ebx
mov dword [esp + 0xd0], eax
mov eax, dword [esp + 0x60]
push esi
call fcn.00074240
mov edx, dword [esp + 0x58]
mov ecx, dword [esp + 0x54]
push eax
mov eax, dword [esp + 0x60]
push edx
mov edx, dword [esp + 0x68]
push eax
mov eax, dword [esp + 0x58]
push ecx
mov ecx, dword [esp + 0x60]
push 0
push 0
push edx
mov edx, dword [esp + 0x8c]
push eax
mov eax, dword [esp + 0xf4]
push ecx
mov ecx, dword [esp + 0xc8]
push edx
call dword [eax + 0x1c]
test eax, eax
mov ebx, dword [esp + 0x2c]
jne 0xa0a50
mov eax, dword [ebp + 0x5c]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x18]
push eax
push eax
mov eax, dword [esp + 0x34]
push edx
mov edx, dword [esp + 0x28]
push edi
push ebx
push esi
push eax
push ecx
mov ecx, dword [esp + 0x50]
push edx
mov edx, dword [esp + 0x60]
push ebp
call fcn.00093d20
test eax, eax
je 0xa0ae9
mov edx, dword [esp + 0x28]
add dword [esp + 0x3c], 1
or byte [esp + 0x41], 1
mov eax, esi
mov dword [esp + 0x14], eax
mov dword [esp + 0x24], edi
mov edi, dword [esp + 0x38]
mov dword [esp + 0x6c], esi
mov esi, dword [esp + 0x4c]
mov dword [esp + 0x34], edx
mov edx, dword [esp + 0x50]
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x24]
mov ecx, ebx
mov ebx, dword [esp + 0x48]
mov dword [esp + 0x38], eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x28], edx
mov edx, dword [ebp + 0x5c]
mov dword [esp + 0x48], ecx
mov ecx, dword [esp + 0x34]
lea eax, [esp + 0x70]
push eax
mov dword [esp + 0x68], esi
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], edi
mov dword [esp + 0x54], ecx
mov dword [esp + 0x20], edx
call sub.WIN32K.SYS_EngQueryPerformanceCounter
mov eax, dword [esp + 0x70]
mov edx, dword [esp + 0x74]
mov ecx, eax
sub ecx, dword [esp + 0x5c]
mov dword [esp + 0x5c], eax
sbb edx, dword [esp + 0x60]
mov eax, dword [esp + 0x74]
mov dword [ebp + 0x408], ecx
mov dword [ebp + 0x40c], edx
mov dword [esp + 0x60], eax
cmp dword [esp + 0x88], 0
je 0xa0c04
cmp dword [esp + 0xc8], 0
jne 0xa0c04
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x2c]
push edx
mov edx, dword [esp + 0x2c]
push eax
mov eax, dword [esp + 0x1c]
push edi
push ebx
push esi
push ecx
mov ecx, dword [esp + 0x30]
push edx
mov edx, dword [esp + 0x54]
push eax
mov eax, dword [esp + 0x7c]
push ecx
push edx
push eax
mov eax, dword [esp + 0x84]
push ebp
call fcn.00099ef0
test eax, eax
je 0xa0c04
mov ecx, dword [esp + 0x54]
mov edx, dword [ebp + 0x40]
mov ebx, dword [ebp + edx*4 + 0x14]
add ecx, 0x28
push ecx
mov eax, 0x11
call fcn.00090c40
mov eax, dword [esp + 0x54]
add dword [esp + 0x3c], 1
test byte [eax + 4], 2
jne 0xa0bc6
mov ecx, dword [esp + 0x2c]
mov ebx, dword [esp + 0x50]
mov eax, esi
mov edx, edi
mov edi, dword [esp + 0x48]
mov dword [esp + 0x6c], esi
mov esi, dword [esp + 0x28]
mov dword [esp + 0x34], esi
mov esi, dword [esp + 0x4c]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x2c], edi
mov edi, dword [esp + 0x38]
mov dword [esp + 0x48], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x14], eax
mov dword [esp + 0x24], edx
mov dword [esp + 0x64], esi
mov dword [esp + 0x30], edi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x4c], eax
mov dword [esp + 0x38], edx
mov dword [esp + 0x50], ecx
lea edx, [esp + 0x70]
push edx
call sub.WIN32K.SYS_EngQueryPerformanceCounter
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x74]
mov edx, eax
sub edx, dword [esp + 0x5c]
mov ebx, ecx
sbb ebx, dword [esp + 0x60]
or dword [esp + 0x40], 0x400200
mov dword [ebp + 0x3fc], ebx
mov ebx, dword [esp + 0x2c]
mov dword [ebp + 0x3f8], edx
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], ecx
mov eax, dword [ebp + 0xd4]
cmp eax, 0x10
mov dword [esp + 0x18], eax
ja 0xa0c1b
mov dword [esp + 0x18], 0x10
mov eax, dword [ebp + 0xd8]
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0xd0]
mov ecx, eax
imul ecx, dword [esp + 0x24]
add dword [esp + 0x14], ecx
shr eax, 1
imul eax, dword [esp + 0x24]
add dword [esp + 0x10], eax
mov eax, dword [ebp + 0xcc]
mov ecx, eax
xor cl, cl
cmp dword [ebp + 0x5c], 0x3231564e
jne 0xa0c5e
add dword [esp + 0x14], ecx
add dword [esp + 0x10], ecx
jmp 0xa0c70
mov dword [esp + 0x68], ecx
add ecx, ecx
add dword [esp + 0x14], ecx
add dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x68]
and eax, 0xff
cmp dword [esp + 0x84], 0
je 0xa0c8b
add eax, dword [esp + 0x18]
and al, 0xfe
mov dword [esp + 0x18], eax
jmp 0xa0c8f
add dword [esp + 0x18], eax
mov eax, dword [esp + 0x90]
sub eax, ecx
cmp dword [esp + 0xbc], 0
mov dword [esp + 0x54], eax
je 0xa0d70
cmp dword [esp + 0x44], 0
je 0xa0cc0
cmp dword [ebp + 0x5c], 0x32595559
jne 0xa0cc0
shr edi, 1
mov dword [esp + 0x30], edi
mov edx, dword [0x4e73e0]
mov ecx, dword [edx + 0x2520]
mov eax, dword [ecx]
call dword [eax + 0x124]
mov ecx, dword [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x28]
push edi
push ecx
mov ecx, dword [esp + 0x2c]
mov edx, dword [eax]
push ecx
mov ecx, dword [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x3c]
push ebx
push esi
push ecx
mov ecx, dword [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x38]
push ecx
mov ecx, dword [esp + 0x5c]
push ecx
mov ecx, eax
call dword [edx + 0x30]
test eax, eax
je 0xa0d70
mov edx, dword [esp + 0x48]
mov ecx, dword [esp + 0x28]
add dword [esp + 0x3c], 1
cmp dword [esp + 0x44], 0
mov dword [esp + 0x2c], edx
mov edx, dword [esp + 0x38]
mov eax, esi
mov dword [esp + 0x6c], esi
mov esi, dword [esp + 0x4c]
mov dword [esp + 0x30], edx
mov edx, dword [esp + 0x50]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ebx
mov dword [esp + 0x24], edi
mov dword [esp + 0x34], ecx
mov dword [esp + 0x64], esi
mov dword [esp + 0x28], edx
mov dword [esp + 0x4c], eax
mov dword [esp + 0x48], ebx
mov dword [esp + 0x38], edi
mov dword [esp + 0x50], ecx
je 0xa0d70
cmp dword [ebp + 0x5c], 0x32595559
jne 0xa0d70
lea eax, [edi + edi]
mov dword [esp + 0x38], eax
cmp dword [esp + 0xc4], 0
je 0xa0e7c
cmp dword [esp + 0xa0], 0
jne 0xa0e7c
mov ecx, dword [ebp + 0xbc]
mov edx, dword [esp + 0x1c]
mov edi, dword [ebp + 0xc8]
mov ebx, dword [ebp + 0xc0]
push ecx
push 0
push edx
mov edx, dword [ebp + 0xc4]
mov eax, ebp
call fcn.0009b4a0
mov eax, dword [ebp + 0x784]
cmp eax, 2
je 0xa0dc3
cmp eax, 3
jne 0xa0dd9
mov ebx, dword [esp + 0xa4]
mov eax, dword [esp + 0x58]
push 1
xor ebx, 1
push ebp
call fcn.0009e380
mov eax, dword [esp + 0x180]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
mov edi, dword [esp + 0x34]
push 0x100000
push 0x100000
push eax
mov eax, dword [esp + 0x11c]
push 0
push 0
push ecx
mov ecx, dword [esp + 0xac]
push edx
mov edx, dword [esp + 0x40]
push eax
mov eax, dword [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x38]
push edx
push eax
push ecx
mov eax, edi
call fcn.00074240
mov edx, dword [esp + 0x88]
push eax
push edi
push edx
push ebp
call fcn.0009b650
test eax, eax
je 0xa0e7c
and byte [ebp + 2], 0xfb
or byte [esp + 0x41], 0x80
lea eax, [esp + 0x70]
push eax
mov dword [ebp + 0x83c], 0
call sub.WIN32K.SYS_EngQueryPerformanceCounter
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x74]
mov edx, eax
sub edx, dword [esp + 0x5c]
mov edi, ecx
sbb edi, dword [esp + 0x60]
mov dword [ebp + 0x430], edx
mov dword [ebp + 0x434], edi
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], ecx
cmp dword [esp + 0xc0], 0
je 0xa0edf
cmp dword [esp + 0x44], 0
je 0xa0edf
mov eax, dword [0x4e73e0]
mov ecx, dword [eax + 0x2520]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
mov ebx, dword [esp + 0x20]
mov edi, dword [esp + 0x18]
push edx
mov edx, dword [esp + 0x14]
push eax
push eax
mov eax, dword [esp + 0x20]
push 0
push 0
push ebx
push edi
push ebx
push edi
push edx
push eax
push edx
mov edx, dword [ecx]
push eax
mov eax, dword [esp + 0x68]
push eax
call dword [edx + 0x124]
push eax
call fcn.0010ad60
mov dword [esp + 0xc0], 0
jmp 0xa0ee7
mov edi, dword [esp + 0x18]
mov ebx, dword [esp + 0x20]
cmp dword [esp + 0xd8], 0
je 0xa1594
cmp dword [esp + 0x84], 0
je 0xa13ea
mov esi, dword [ebp + 0xe4]
mov eax, esi
imul eax, edi
xor edx, edx
div dword [esp + 0x7c]
mov dword [esp + 0xd8], edi
mov edi, dword [ebp + 0xe8]
mov dword [esp + 0xe4], ebx
xor edx, edx
mov ecx, 1
mov dword [esp + 0xa0], eax
mov eax, edi
imul eax, ebx
mov ebx, dword [esp + 0x78]
div ebx
cmp dword [ebp + 0x8c], ecx
mov dword [esp + 0x94], eax
je 0xa0f58
cmp dword [ebp + 0x90], ecx
jne 0xa0fca
mov ecx, dword [0x4e73e0]
mov ecx, dword [ecx + 0x1404]
and ecx, 0x300000
cmp ecx, 0x100000
je 0xa0f82
cmp ecx, 0x300000
je 0xa0f82
mov edx, dword [ebp + 0x44]
mov ecx, dword [ebp + 0x60]
jmp 0xa0f88
mov edx, dword [ebp + 0x54]
mov ecx, dword [ebp + 0x4c]
cmp dword [ebp + 0x5c], 0x3231564e
je 0xa0f93
shr ecx, 1
cmp eax, edx
jbe 0xa0fab
mov eax, ebx
imul eax, edx
mov dword [esp + 0x94], edx
xor edx, edx
div edi
mov dword [esp + 0x20], eax
cmp dword [esp + 0xa0], ecx
jbe 0xa0fca
mov eax, dword [esp + 0x7c]
imul eax, ecx
xor edx, edx
div esi
mov dword [esp + 0xa0], ecx
mov dword [esp + 0x18], eax
mov edx, dword [0x4e73e0]
mov ecx, dword [edx + 0x2520]
mov eax, dword [ecx]
call dword [eax + 0x124]
cmp dword [esp + 0xb0], 0
mov ecx, dword [eax + 0x4c60]
mov dword [esp + 0xec], ecx
jne 0xa1013
mov edx, dword [0x4e73e0]
mov ecx, dword [edx + 0x2520]
mov eax, dword [ecx]
call dword [eax + 0x124]
mov dword [eax + 0x4c60], 1
mov ebx, dword [esp + 0x24]
mov esi, dword [esp + 0x64]
mov edi, dword [esp + 0x30]
nop
cmp dword [ebp + 0x5c], 0x3231564e
mov edx, dword [esp + 0xa0]
jne 0xa1036
mov dword [esp + 0x68], edx
jmp 0xa103d
lea ecx, [edx + edx]
mov dword [esp + 0x68], ecx
mov eax, dword [ebp + 0x84]
cmp eax, 2
ja 0xa104d
mov eax, 2
imul eax, edx
cmp dword [esp + 0x18], eax
mov ecx, 4
jb 0xa1063
cmp dword [ebp + 0xe4], ecx
ja 0xa1089
mov eax, dword [ebp + 0x88]
cmp eax, 2
ja 0xa1073
mov eax, 2
imul eax, dword [esp + 0x94]
cmp dword [esp + 0x20], eax
jb 0xa1095
cmp dword [ebp + 0xe8], ecx
jbe 0xa1095
cmp dword [ebp + 0x3c], ecx
jb 0xa1095
mov eax, 1
jmp 0xa1097
xor eax, eax
test byte [ebp + 2], 0x10
je 0xa11fc
cmp dword [esp + 0x18], edx
jb 0xa10be
mov edx, dword [esp + 0x94]
cmp dword [esp + 0x20], edx
jb 0xa10be
cmp edi, dword [esp + 0x68]
jae 0xa11fc
test byte [esp + 0x3c], 1
je 0xa11fc
test eax, eax
jne 0xa11fc
cmp dword [esp + 0x1c], 0x3231564e
jne 0xa10e6
cmp dword [ebp + 0x5c], 0x32595559
jne 0xa10e6
shr edi, 1
mov eax, dword [0x4e73e0]
mov ecx, dword [eax + 0x2520]
mov edx, dword [ecx]
call dword [edx + 0x124]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ecx
mov ecx, dword [esp + 0x38]
push edx
mov edx, dword [esp + 0x50]
push ecx
push 0
push 0
mov dword [esp + 0x98], eax
mov eax, dword [eax]
push edi
push edx
mov dword [esp + 0xd0], eax
mov eax, dword [esp + 0x60]
push esi
call fcn.00074240
mov ecx, dword [esp + 0x5c]
mov edx, dword [esp + 0x54]
mov ebx, dword [esp + 0x60]
push eax
mov eax, dword [esp + 0x5c]
push eax
mov eax, dword [esp + 0x54]
push ecx
mov ecx, dword [esp + 0x5c]
push edx
mov edx, dword [esp + 0x80]
push 0
push 0
push ebx
push eax
mov eax, dword [esp + 0xf4]
push ecx
mov ecx, dword [esp + 0xc8]
push edx
call dword [eax + 0x1c]
test eax, eax
je 0xa11e7
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
add dword [esp + 0x3c], 1
cmp dword [esp + 0x1c], 0x3231564e
mov eax, esi
mov dword [esp + 0x34], edx
mov edx, dword [esp + 0x48]
mov dword [esp + 0x6c], esi
mov esi, dword [esp + 0x4c]
mov ebx, edi
mov edi, dword [esp + 0x38]
mov dword [esp + 0x14], eax
mov dword [esp + 0x2c], edx
mov edx, dword [esp + 0x50]
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], edx
mov dword [esp + 0x48], ecx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x50], eax
jne 0xa11fc
cmp dword [esp + 0x1c], 0x3231564e
jne 0xa11fc
mov eax, dword [esp + 0x40]
push 0
push 0
and eax, 0x400
neg eax
sbb eax, eax
neg eax
sub eax, 1
and eax, dword [esp + 0x94]
lea edx, [esp + 0x70]
push edx
push 1
push eax
lea ecx, [esp + 0x110]
push ecx
mov ecx, dword [esp + 0xac]
lea edx, [esp + 0x198]
push edx
mov edx, dword [esp + 0xbc]
lea eax, [esp + 0x38]
push eax
push ecx
push edx
mov edx, dword [esp + 0x54]
lea eax, [esp + 0x48]
push eax
mov eax, dword [esp + 0x54]
lea ecx, [esp + 0x44]
push ecx
mov ecx, dword [esp + 0x40]
push edi
push edx
mov edx, dword [esp + 0x4c]
push esi
push eax
mov eax, dword [esp + 0x74]
push ebx
push ecx
mov ecx, dword [esp + 0xa0]
push edx
push eax
push ecx
push ebp
mov dword [esp + 0xc0], 0
call fcn.0009a810
test eax, eax
je 0xa12ea
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
add dword [esp + 0x3c], 1
or byte [esp + 0x41], 4
cmp dword [esp + 0x68], 0
mov eax, esi
mov dword [esp + 0x34], edx
mov edx, dword [esp + 0x48]
mov dword [esp + 0x6c], esi
mov esi, dword [esp + 0x4c]
mov ebx, edi
mov edi, dword [esp + 0x38]
mov dword [esp + 0x14], eax
mov dword [esp + 0x2c], edx
mov edx, dword [esp + 0x50]
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], edx
mov dword [esp + 0x48], ecx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x50], eax
jne 0xa1020
mov ecx, dword [0x4e73e0]
mov ecx, dword [ecx + 0x2520]
mov edx, dword [ecx]
call dword [edx + 0x124]
mov ecx, dword [esp + 0xec]
mov dword [eax + 0x4c60], ecx
mov ecx, dword [esp + 0xd8]
test ecx, ecx
je 0xa1342
mov edi, dword [esp + 0xe4]
test edi, edi
je 0xa1342
mov eax, dword [esp + 0x18]
shl eax, 0x14
xor edx, edx
div ecx
xor edx, edx
mov esi, eax
mov eax, dword [esp + 0x20]
shl eax, 0x14
div edi
mov dword [esp + 0xf8], eax
jmp 0xa134e
mov esi, 0x100000
mov dword [esp + 0xf8], esi
cmp dword [esp + 0xdc], 0
mov dword [esp + 0xf4], esi
je 0xa137c
mov eax, 2
cmp dword [ebp + 0x8c], eax
jb 0xa1374
cmp dword [ebp + 0x90], eax
jae 0xa137c
mov eax, dword [esp + 0x7c]
xor ecx, ecx
jmp 0xa139d
mov edx, dword [ebp + 0xcc]
mov edi, dword [esp + 0x90]
mov eax, dword [esp + 0x7c]
xor dl, dl
mov ecx, edi
sub ecx, edx
imul ecx, esi
sub eax, edx
shr ecx, 0x14
add eax, edi
imul eax, esi
mov edx, 1
shr eax, 0x14
cmp dword [ebp + 0x8c], edx
mov dword [esp + 0x54], ecx
jbe 0xa1585
sub eax, ecx
cmp eax, edx
ja 0xa13ca
cmp dword [ebp + 0xe4], edx
jbe 0xa1585
mov ecx, dword [ebp + 0xe4]
add eax, 0xffffffff
sub ecx, edx
shl eax, 0x14
xor edx, edx
div ecx
mov dword [ebp + 0x11c], eax
mov ebx, dword [esp + 0x20]
mov edi, dword [esp + 0x18]
mov esi, dword [esp + 0x54]
cmp dword [esp + 0xc0], 0
je 0xa1445
mov edx, dword [esp + 0x1c]
cmp edx, dword [ebp + 0x5c]
jne 0xa1445
mov eax, dword [0x4e73e0]
mov ecx, dword [eax + 0x2520]
mov eax, dword [esp + 0x24]
push edx
mov edx, dword [esp + 0x14]
push eax
push eax
mov eax, dword [esp + 0x20]
push 0
push 0
push ebx
push edi
push ebx
push edi
push edx
push eax
push edx
mov edx, dword [ecx]
push eax
mov eax, dword [esp + 0x68]
push eax
call dword [edx + 0x124]
push eax
call fcn.0010ad60
mov dword [esp + 0xc0], 0
test byte [esp + 0x41], 0xc
je 0xa1480
lea eax, [esp + 0x70]
push eax
call sub.WIN32K.SYS_EngQueryPerformanceCounter
mov eax, dword [esp + 0x70]
mov edx, dword [esp + 0x74]
mov ecx, eax
sub ecx, dword [esp + 0x5c]
mov dword [esp + 0x5c], eax
sbb edx, dword [esp + 0x60]
mov eax, dword [esp + 0x74]
mov dword [ebp + 0x428], ecx
mov dword [ebp + 0x42c], edx
mov dword [esp + 0x60], eax
cmp dword [esp + 0xb4], 0
jne 0xa14f8
cmp dword [esp + 0xb8], 0
jne 0xa14f8
cmp dword [esp + 0x88], 0
jne 0xa14f8
cmp dword [esp + 0xc0], 0
jne 0xa14f8
cmp dword [esp + 0xbc], 0
jne 0xa14f8
cmp dword [esp + 0x84], 0
jne 0xa14f8
cmp dword [esp + 0xc4], 0
jne 0xa14f8
cmp dword [esp + 0x80], 0
jne 0xa14f8
cmp dword [esp + 0xd0], 0
jne 0xa14f8
cmp dword [esp + 0xdc], 0
jne 0xa14f8
cmp dword [esp + 0xe0], 0
jne 0xa14f8
cmp dword [esp + 0xf0], 0
je 0xa14fd
call fcn.00095290
and dword [ebp + 0x874], 0xfffffffb
test byte [esp + 0x181], 0x20
je 0xa1519
cmp dword [esp + 0x3c], 0
je 0x9f7e0
cmp dword [esp + 0xdc], 0
jne 0xa19ff
mov ecx, dword [esp + 0xa8]
sub ecx, dword [ebp + 0xd0]
imul ecx, dword [esp + 0xf8]
shr ecx, 0x14
cmp dword [ebp + 0x5c], 0x3231564e
jne 0xa19ba
test ecx, ecx
je 0xa1556
add ecx, 0xffffffff
and ecx, 0xfffffffe
mov eax, ecx
shr eax, 1
imul eax, dword [esp + 0x24]
add dword [esp + 0x10], eax
mov edx, ecx
imul edx, dword [esp + 0x24]
add dword [esp + 0x14], edx
cmp dword [esp + 0x9c], 0
jne 0xa19e1
mov eax, esi
and al, 0xfe
jmp 0xa19d9
mov dword [ebp + 0x11c], 0x100000
jmp 0xa13e2
cmp dword [esp + 0x84], 0
je 0xa13ea
mov eax, dword [ebp + 0xe8]
imul eax, ebx
xor edx, edx
div dword [esp + 0x78]
mov ecx, dword [esp + 0x7c]
xor edx, edx
mov dword [esp + 0xd8], edi
mov dword [esp + 0xe4], ebx
mov dword [esp + 0x54], eax
mov eax, dword [ebp + 0xe4]
imul eax, edi
div ecx
mov dword [esp + 0x44], eax
mov eax, 1
cmp dword [ebp + 0x8c], eax
je 0xa1604
cmp dword [ebp + 0x90], eax
je 0xa1604
xor ecx, ecx
xor edi, edi
mov dword [esp + 0x98], ecx
mov dword [esp + 0xec], edi
jmp 0xa16d1
cmp edi, ecx
jbe 0xa160c
mov dword [esp + 0x18], ecx
mov eax, dword [esp + 0x78]
cmp ebx, eax
jbe 0xa161a
mov ebx, eax
mov dword [esp + 0x20], ebx
mov eax, dword [ebp + 0xe8]
mov edi, dword [esp + 0x90]
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0xa8]
mov dword [esp + 0x54], eax
mov eax, dword [ebp + 0xe4]
mov dword [esp + 0x44], eax
mov eax, dword [ebp + 0xcc]
xor al, al
mov dword [esp + 0xd8], edx
mov edx, dword [ebp + 0xd0]
sub ecx, edx
mov dword [esp + 0xe4], ebx
mov dword [esp + 0x98], ecx
mov dword [esp + 0xa8], edx
sub edi, eax
mov dword [esp + 0x90], eax
mov eax, dword [0x4e73e0]
mov eax, dword [eax + 0x1404]
and eax, 0x300000
cmp eax, 0x100000
mov dword [esp + 0xec], edi
je 0xa16ac
cmp eax, 0x300000
je 0xa16ac
mov eax, dword [ebp + 0x44]
cmp dword [esp + 0x54], eax
jb 0xa16a7
mov dword [esp + 0x54], eax
mov eax, dword [ebp + 0x60]
jmp 0xa16bc
mov eax, dword [ebp + 0x54]
cmp dword [esp + 0x54], eax
jb 0xa16b9
mov dword [esp + 0x54], eax
mov eax, dword [ebp + 0x4c]
cmp dword [ebp + 0x5c], 0x3231564e
je 0xa16c7
shr eax, 1
cmp dword [esp + 0x44], eax
jb 0xa16d1
mov dword [esp + 0x44], eax
cmp dword [ebp + 0x5c], 0x3231564e
mov eax, dword [esp + 0x44]
jne 0xa16e4
mov dword [esp + 0x68], eax
jmp 0xa16eb
lea edx, [eax + eax]
mov dword [esp + 0x68], edx
test byte [ebp + 2], 0x10
je 0xa1830
cmp dword [esp + 0x18], eax
jb 0xa170f
cmp ebx, dword [esp + 0x54]
jb 0xa170f
mov eax, dword [esp + 0x30]
cmp eax, dword [esp + 0x68]
jae 0xa1830
test byte [esp + 0x3c], 1
je 0xa1830
cmp dword [esp + 0x1c], 0x3231564e
jne 0xa1731
cmp dword [ebp + 0x5c], 0x32595559
jne 0xa1731
shr dword [esp + 0x30], 1
mov ecx, dword [0x4e73e0]
mov ecx, dword [ecx + 0x2520]
mov edx, dword [ecx]
call dword [edx + 0x124]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push edx
mov edx, dword [esp + 0x4c]
push ebx
lea edi, [edi + ecx + 3]
mov ecx, dword [esp + 0x54]
and edi, 0xfffffffc
push edi
push 0
push 0
mov dword [esp + 0x98], eax
mov eax, dword [eax]
push ecx
push edx
mov dword [esp + 0xe8], eax
mov eax, dword [esp + 0x60]
push esi
call fcn.00074240
mov ebx, dword [esp + 0x58]
mov ecx, dword [esp + 0xd4]
mov edx, dword [esp + 0x60]
push eax
mov eax, dword [esp + 0x60]
push ebx
push eax
mov eax, dword [esp + 0x58]
push edi
push ecx
mov ecx, dword [esp + 0x64]
push 0
push edx
mov edx, dword [esp + 0x8c]
push eax
mov eax, dword [esp + 0x10c]
push ecx
mov ecx, dword [esp + 0xc8]
push edx
call dword [eax + 0x1c]
test eax, eax
je 0xa1812
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x28]
add dword [esp + 0x3c], 1
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x34], edx
mov edx, dword [esp + 0x50]
mov dword [esp + 0x14], esi
mov dword [esp + 0x6c], esi
mov esi, dword [esp + 0x4c]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x28], edx
jmp 0xa1827
cmp ebx, 0x3231564e
jne 0xa1827
cmp dword [ebp + 0x5c], 0x32595559
jne 0xa1827
shl dword [esp + 0x30], 1
mov edi, dword [esp + 0xec]
xor ecx, ecx
push ecx
mov ecx, dword [esp + 0x44]
push edi
and ecx, 0x400
neg ecx
mov edi, dword [esp + 0x38]
sbb ecx, ecx
mov ebx, dword [esp + 0x34]
neg ecx
sub ecx, 1
and ecx, dword [esp + 0x94]
lea eax, [esp + 0x70]
push eax
push 0
push ecx
lea edx, [esp + 0x110]
push edx
mov edx, dword [esp + 0x6c]
lea eax, [esp + 0x198]
push eax
mov eax, dword [esp + 0x60]
lea ecx, [esp + 0x38]
push ecx
push edx
push eax
mov eax, dword [esp + 0x50]
lea ecx, [esp + 0x48]
push ecx
mov ecx, dword [esp + 0x50]
lea edx, [esp + 0x44]
push edx
mov edx, dword [esp + 0x40]
push edi
push ebx
push esi
push eax
mov eax, dword [esp + 0x54]
push ecx
mov ecx, dword [esp + 0x78]
push edx
mov edx, dword [esp + 0xa0]
push eax
push ecx
push edx
push ebp
call fcn.0009a810
test eax, eax
je 0xa18d5
mov eax, dword [esp + 0x28]
add dword [esp + 0x3c], 1
or byte [esp + 0x41], 4
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
mov dword [esp + 0x24], edi
mov dword [esp + 0x6c], esi
mov dword [esp + 0x34], eax
mov ecx, dword [esp + 0xd8]
test ecx, ecx
mov ebx, dword [esp + 0x20]
je 0xa190e
mov esi, dword [esp + 0xe4]
test esi, esi
je 0xa190e
mov eax, dword [esp + 0x18]
shl eax, 0x14
xor edx, edx
div ecx
xor edx, edx
mov edi, eax
mov eax, ebx
shl eax, 0x14
mov dword [esp + 0xf4], edi
div esi
jmp 0xa191c
mov eax, 0x100000
mov dword [esp + 0xf4], eax
mov edi, eax
cmp dword [esp + 0xdc], 0
mov dword [esp + 0xf8], eax
je 0xa194a
mov eax, 2
cmp dword [ebp + 0x8c], eax
jb 0xa1942
cmp dword [ebp + 0x90], eax
jae 0xa194a
mov eax, dword [esp + 0x7c]
xor esi, esi
jmp 0xa196b
mov ecx, dword [ebp + 0xcc]
mov edx, dword [esp + 0x90]
mov eax, dword [esp + 0x7c]
xor cl, cl
mov esi, edx
sub esi, ecx
imul esi, edi
sub eax, ecx
shr esi, 0x14
add eax, edx
imul eax, edi
shr eax, 0x14
sub eax, esi
cmp eax, 1
mov dword [esp + 0x54], esi
ja 0xa1998
cmp dword [ebp + 0xe4], 1
ja 0xa1998
mov edi, dword [esp + 0x18]
mov dword [ebp + 0x11c], 0x100000
jmp 0xa13ee
mov ecx, dword [ebp + 0xe4]
add eax, 0xffffffff
shl eax, 0x14
sub ecx, 1
xor edx, edx
div ecx
mov edi, dword [esp + 0x18]
mov dword [ebp + 0x11c], eax
jmp 0xa13ee
mov eax, ecx
imul eax, dword [esp + 0x24]
add dword [esp + 0x14], eax
add dword [esp + 0x10], eax
cmp dword [esp + 0x9c], 0
jne 0xa19e1
mov eax, esi
and al, 0xfe
add eax, eax
add dword [esp + 0x14], eax
add dword [esp + 0x10], eax
sub edi, esi
sub ebx, ecx
cmp dword [esp + 0x84], 0
mov dword [esp + 0x18], edi
mov dword [esp + 0x20], ebx
jne 0xa19ff
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x20], ecx
cmp dword [esp + 0xcc], 0
jne 0xa1a2c
mov edx, dword [0x4e73e0]
mov ecx, dword [edx + 0x2520]
mov eax, dword [ecx]
call dword [eax + 0x124]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x10]
test eax, eax
jne 0xa1abb
mov eax, dword [0x4e73e0]
mov ecx, dword [eax + 0x85c]
mov esi, dword [esp + 0x58]
mov edi, dword [esi + 0x14]
mov edx, dword [eax + 0x5ac]
push ecx
call fcn.00091f70
mov eax, dword [0x4e73e0]
test byte [eax + 0x2484], 0x20
je 0xa1a65
add eax, 8
call fcn.000b6430
mov eax, dword [0x4e73e0]
mov edx, dword [eax + 0x5ac]
mov eax, dword [esi + 0x14]
push edx
call fcn.00092050
mov eax, dword [0x4e73e0]
mov ecx, dword [eax + 0x2520]
mov edx, dword [ecx]
push 1
call dword [edx + 0xbc]
mov eax, dword [0x4e73e0]
mov ecx, dword [eax + 0x85c]
mov edi, dword [esi + 0x14]
mov edx, dword [eax + 0x5ac]
push ecx
call fcn.00091f70
mov eax, dword [0x4e73e0]
test byte [eax + 0x2484], 0x20
je 0xa1ad3
add eax, 8
xor ecx, ecx
call fcn.000b6350
mov eax, dword [0x4e73e0]
test byte [eax + 0x2484], 0x20
je 0xa1ad3
add eax, 8
xor ecx, ecx
call fcn.000b6350
cmp dword [esp + 0x114], 0
mov ebx, dword [esp + 0x180]
je 0xa1b54
test bl, 0xc
je 0xa1af5
test bl, 3
je 0xa1af5
mov eax, 1
jmp 0xa1af7
xor eax, eax
mov ecx, dword [esp + 0x58]
push eax
mov eax, dword [esp + 0xa8]
mov edx, ebx
and edx, 0x20
push edx
push eax
push ecx
push ebp
call fcn.0009def0
test eax, eax
jne 0xa1b4f
cmp dword [esp + 0x8c], eax
je 0xa1b34
cmp dword [esp + 0xd4], eax
jne 0xa1b34
mov edx, dword [esp + 0x124]
mov dword [ebp + 0x120], edx
lea eax, [esp + 0x128]
call fcn.00095b90
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x164
ret 0x18
or byte [esp + 0x42], 8
mov eax, dword [esp + 0x18c]
push eax
mov eax, dword [esp + 0x18c]
push eax
mov eax, dword [esp + 0x100]
push eax
mov eax, dword [esp + 0x100]
push eax
mov eax, dword [esp + 0x64]
mov edi, dword [esp + 0x2c]
and al, 0xfe
mov edx, dword [esp + 0x34]
mov esi, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov dword [ebp + 0xa8], edi
mov dword [ebp + 0x9c], ecx
mov dword [ebp + 0xa0], esi
push eax
mov eax, dword [esp + 0xb0]
push eax
mov eax, dword [esp + 0xa4]
push eax
mov eax, dword [esp + 0x104]
or eax, ebx
mov ebx, dword [esp + 0xc0]
push eax
mov eax, dword [esp + 0x40]
push edi
mov edi, dword [esp + 0x90]
push ebx
push eax
mov eax, dword [esp + 0x44]
push eax
push edx
push esi
push ecx
mov ecx, dword [esp + 0x94]
push edi
push ecx
push ebp
mov dword [ebp + 0xa4], edx
call fcn.0009cab0
test eax, eax
je 0xa1e56
cmp dword [esp + 0x8c], 0
je 0xa1c12
cmp dword [esp + 0xd4], 0
jne 0xa1c12
mov edx, dword [esp + 0x124]
mov dword [ebp + 0x120], edx
mov ecx, dword [esp + 0x13c]
mov edx, 1
add dword [ebp + 0x150], edx
xor word [ebp + 0x154], dx
test ecx, ecx
jne 0xa1c34
mov dword [ebp + 0x40], ecx
jmp 0xa1c7e
cmp ecx, 2
mov eax, dword [ebp + 0x40]
ja 0xa1c47
add eax, edx
xor edx, edx
div ecx
mov dword [ebp + 0x40], edx
jmp 0xa1c7e
test byte [ebp + 2], 0x10
je 0xa1c59
add eax, 2
xor edx, edx
div ecx
mov dword [ebp + 0x40], edx
jmp 0xa1c7e
lea esi, [ebp + eax*4 + 0x14]
mov eax, dword [esi]
call fcn.00069fd0
cmp edi, eax
mov eax, dword [esp + 0x120]
je 0xa1c7b
mov edx, dword [ebp + eax*4 + 0x14]
mov ecx, dword [esi]
mov dword [esi], edx
mov dword [ebp + eax*4 + 0x14], ecx
mov dword [ebp + 0x40], eax
lea eax, [esp + 0x70]
push eax
call sub.WIN32K.SYS_EngQueryPerformanceCounter
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x74]
mov edx, eax
sub edx, dword [esp + 0x5c]
mov esi, ecx
sbb esi, dword [esp + 0x60]
cmp dword [esp + 0xc4], 0
mov dword [ebp + 0x438], edx
mov dword [ebp + 0x43c], esi
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], ecx
je 0xa1cfc
cmp dword [ebp + 0x784], 3
jbe 0xa1ccf
mov eax, dword [esp + 0x58]
push 1
push ebp
call fcn.0009e380
mov edx, dword [esp + 0x58]
push ebx
push ebp
call fcn.0009dd60
mov ecx, dword [ebp + 0x784]
test ecx, ecx
je 0xa1cf7
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x100]
mov edx, dword [esp + 0x104]
mov dword [ebp + 0x37c], eax
lea eax, [esp + 0x118]
push eax
mov dword [ebp + 0x390], ecx
mov dword [ebp + 0x394], edx
call sub.WIN32K.SYS_EngQueryPerformanceCounter
mov ecx, dword [esp + 0x118]
mov eax, dword [esp + 0x11c]
mov ebx, dword [ebp + 0x388]
mov edx, ecx
sub edx, dword [esp + 0x5c]
mov esi, eax
sbb esi, dword [esp + 0x60]
sub ecx, dword [esp + 0x100]
mov dword [ebp + 0x44c], esi
sbb eax, dword [esp + 0x104]
mov dword [ebp + 0x448], edx
mov edx, dword [ebp + 0x38c]
mov esi, ebx
or esi, edx
mov dword [esp + 0x144], edx
je 0xa1dd3
mov edi, dword [ebp + 0x3d4]
cmp eax, edi
mov esi, dword [ebp + 0x3d0]
jl 0xa1d9a
add dword [ebp + 0x3c0], ecx
adc dword [ebp + 0x3c4], eax
cmp eax, dword [ebp + 0x3cc]
jl 0xa1dfd
cmp dword [esp + 0x8c], 0
je 0xa1e77
cmp dword [esp + 0xd4], 0
jne 0xa1e77
mov eax, dword [esp + 0x124]
mov dword [ebp + 0x120], eax
lea eax, [esp + 0x128]
call fcn.00095b90
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x164
ret 0x18
cmp esi, edi
je 0xa1ea1
push edi
push edi
push edi
push 2
push edi
call fcn.0008dca0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x164
ret 0x18