Function at 0x100942e3
Capabilities:
Check os version
Compare security identifiers
Get keyboard layout
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1014522b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa70
movdqa xmm0, xmmword [0x1000eac0]
lea eax, [esp + 0x6ec]
push ebx
push esi
push edi
push dword [esp + 0x2c]
xor ebx, ebx
mov esi, ecx
push eax
lea eax, [esp + 0x6f0]
mov dword [esp + 0x48], esi
push eax
push ebx
lea ecx, [esp + 0x448]
mov dword [esp + 0x448], ebx
movdqu xmmword [esp + 0x6f8], xmm0
mov dword [esp + 0x44c], ebx
mov dword [esp + 0x450], ebx
call fcn.10014f3b
mov dword [esp + 0xa84], ebx
lea ecx, [esp + 0x608]
mov dword [esp + 0x2c], 0xd4e7937d
or edi, 0xffffffff
mov dword [esp + 0x2c], 0x8462751c
mov dword [esp + 0x2c], 2
mov dword [esp + 0x2c], 4
mov dword [esp + 0x2c], 0xfffffffc
mov dword [esp + 0x2c], 0x9d4346
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x2c], 0xb2b74c38
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x2c], 0x67101392
mov dword [esp + 0x2c], 0xfffffff9
mov dword [esp + 0x2c], edi
mov dword [esp + 0x2c], 0x421e0bec
mov dword [esp + 0x2c], 0x826a056e
push 3
call fcn.10013ee8
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x2c], 0x1aa84cbe
push 3
mov dword [esp + 0x30], 0xc22c9208
pop edx
mov dword [esp + 0x20], edx
mov dword [esp + 0x10], ebx
jmp 0x1009440d
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x608]
mov dword [eax + ecx*4], edi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x100943fb
dec dword [esp + 0x20]
lea ecx, [esp + 0x608]
call fcn.100144eb
lea ecx, [esp + 0x438]
mov dword [esp + 0xa84], edi
call fcn.100144eb
mov ecx, dword [esi + 0x50]
cmp dword [ecx + 0xa8], 1
jne 0x10094494
push ecx
add ecx, 0xac
call fcn.1002cb7a
lea ecx, [esp + 0xa04]
mov dword [esp], 0x1000cfc0
call fcn.1001c44c
xor edi, edi
inc edi
mov dword [esp + 0xa84], edi
mov edx, dword [esi + 0x50]
mov ecx, dword [esi + 0x54]
add edx, 0xac
push eax
call fcn.1002d38b
or dword [esp + 0xa88], 0xffffffff
pop ecx
push ebx
push edi
lea ecx, [esp + 0xa08]
call fcn.100170c9
mov edx, dword [esi + 0x50]
push ecx
lea ecx, [esp + 0x404]
call fcn.10072f29
pop ecx
mov dword [esp + 0xa84], 2
lea eax, [esp + 0x738]
push dword [esp + 0x2c]
movdqa xmm0, xmmword [0x1000ea70]
lea ecx, [esp + 0x424]
push eax
lea eax, [esp + 0x730]
mov dword [esp + 0x24], 0xdb5cabfc
push eax
mov dword [esp + 0x34], 0x6f93bd5d
mov dword [esp + 0x1c], 5
push ebx
movdqu xmmword [esp + 0x738], xmm0
mov dword [esp + 0x430], ebx
mov dword [esp + 0x434], ebx
mov dword [esp + 0x438], ebx
call fcn.10014f3b
push 2
lea ecx, [esp + 0x4ac]
mov byte [esp + 0xa88], 3
call fcn.10013ee8
mov dword [esp + 0x38], 0xf39281c1
mov dword [esp + 0x20], 0x1f199e1f
mov dword [esp + 0x10], ebx
jmp 0x10094551
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x4a8]
mov dword [eax + ecx*4], 0xdc0223de
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1009453b
mov eax, dword [esp + 0x1c]
xor edx, edx
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
mov dword [esp + 0x10], eax
imul ecx, dword [esp + 0x10], 0x4006
mov eax, dword [esp + 0x1c]
cmp ecx, eax
mov eax, dword [esp + 0x1c]
mov esi, dword [esp + 0x420]
mov edi, dword [esp + 0x4a8]
setge dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
cmp ecx, 0x53a3
setle al
xor ecx, ecx
mov dword [esi + 4], eax
mov dword [edi + 4], eax
mov eax, dword [esp + 0x28]
cmp dword [esi + 4], eax
mov eax, dword [esp + 0x1c]
setg cl
xor edx, edx
cmp ecx, eax
setge dl
sub edx, dword [esp + 0x28]
neg edx
sbb edx, edx
xor eax, eax
inc edx
cmp edx, 0xb0f7
setle al
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x20]
cmp eax, dword [esi + 4]
jle 0x10094607
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x20], 0x5d1cc0c7
jg 0x10094607
mov eax, ebx
jmp 0x1009460a
xor eax, eax
inc eax
mov dword [edi + 4], eax
mov ecx, 0x4043ca31
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x420]
mov eax, dword [esp + 0x10]
sub ecx, dword [edx + 8]
add eax, ecx
je 0x10094632
cmp dword [esi + 4], ebx
je 0x10094632
xor ecx, ecx
inc ecx
jmp 0x10094634
mov ecx, ebx
xor eax, eax
cmp ecx, dword [edx + 8]
lea ecx, [esp + 0x4a8]
setne al
mov dword [esp + 0x38], eax
call fcn.100144eb
lea ecx, [esp + 0x420]
mov byte [esp + 0xa84], 2
call fcn.100144eb
mov esi, dword [esp + 0x40]
push ecx
lea ecx, [esp + 0x83c]
mov edx, dword [esi + 0x50]
add edx, 0x30
call fcn.10072f29
pop ecx
mov byte [esp + 0xa84], 4
lea ecx, [esp + 0x42c]
mov dword [esp + 0x1c], 7
push 1
call fcn.10013ee8
mov dword [esp + 0x28], 0xc7f05f43
xor edx, edx
mov dword [esp + 0x38], 0xa2b8ea2c
inc edx
mov dword [esp + 0x10], 0xfaa23240
push 0xfffffffffffffff7
mov dword [esp + 0x24], 0xef7e2919
mov dword [esp + 0x18], ebx
pop edi
jmp 0x100946d4
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x42c]
mov dword [eax + ecx*4], edi
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x100946c2
mov dword [esp + 0x14], ebx
jmp 0x100946f3
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x7a0], 4
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x100946e0
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x42c]
mov dword [eax], edx
xor edx, edx
mov dword [esp + 0x28], ebx
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x28]
cmp eax, ecx
setge dl
add edx, dword [esp + 0x38]
je 0x10094734
mov eax, dword [esp + 0x42c]
cmp dword [eax], ebx
je 0x10094734
xor eax, eax
inc eax
jmp 0x10094736
mov eax, ebx
mov ecx, dword [esp + 0x1c]
xor edx, edx
imul ecx, eax
mov eax, 0xffff0008
sub eax, ecx
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
cmp ecx, eax
mov eax, dword [esp + 0x1c]
setg dl
xor ecx, ecx
cmp edx, eax
setne cl
xor edx, edx
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x42c]
cmp dword [eax], ecx
mov eax, dword [esp + 0x1c]
setle dl
xor ecx, ecx
sub edx, eax
mov eax, dword [esp + 0x38]
cmp edx, eax
mov eax, dword [esp + 0x1c]
setne cl
sub eax, ecx
mov dword [esp + 0x7a4], eax
mov dword [esp + 0x10], ebx
jmp 0x100947db
mov dword [esp + 0x20], 0x82a7
mov dword [esp + 0x38], 0xb5b0d69b
mov eax, dword [esp + 0x20]
imul eax, dword [esp + 0x28]
mov dword [esp + 0x38], eax
mov byte [esp + 0x27], bl
cmp byte [esp + 0x27], 0
je 0x100947d7
push ebx
push 1
push 0x717
push ebx
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
dec dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x100947a0
lea ecx, [esp + 0x42c]
call fcn.100144eb
lea eax, [esi + 0x4c]
cmp dword [eax], 2
lea ecx, [esp + 0x450]
mov dword [esp + 0x3c], 0x5e3edfa8
mov dword [esp + 0x2c], 0x391cb4e7
sete byte [esp + 0x27]
mov dword [esp + 0x28], 0x5a9864ba
mov dword [esp + 0x10], 0xade0980d
mov dword [esp + 0x20], 0x5c1d1022
push 2
mov dword [esp + 0x3c], eax
call fcn.10013ee8
mov byte [esp + 0xa84], 5
lea ecx, [esp + 0x444]
mov dword [esp + 0x1c], 0xca3691f6
mov dword [esp + 0x30], 0x32e26595
push 1
call fcn.10013ee8
mov byte [esp + 0xa84], 6
mov dword [esp + 0x20], 0xcd85
mov dword [esp + 0x14], ebx
jmp 0x10094884
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x450]
mov dword [eax + ecx*4], 0xaf72b572
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x1009486e
mov dword [esp + 0x14], ebx
jmp 0x100948a4
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x444]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 1
jl 0x10094891
mov esi, dword [sym.imp.USER32.dll_GetDC]
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10094902
push 0x7d0
push 0x1a45
push 0x1f12
push ebx
push 0x144f
push 0xe65
call edi
push eax
call esi
push eax
push 0x370
push 0xdd2
push 0x26f7
push 0x1da5
call edi
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_MaskBlt]
mov edx, dword [esp + 0x450]
mov eax, dword [esp + 0x10]
mov dword [edx + 4], eax
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x444]
mov ecx, dword [eax]
lea eax, [ecx + 1]
cmp eax, 1
ja 0x10094931
test ecx, ecx
jne 0x10094931
mov eax, ebx
jmp 0x10094934
xor eax, eax
inc eax
mov ecx, dword [esp + 0x30]
imul ecx, eax
mov eax, dword [esp + 0x1c]
inc dword [esp + 0x30]
cmp ecx, eax
jge 0x1009494c
xor ecx, ecx
inc ecx
jmp 0x1009494e
mov ecx, ebx
xor eax, eax
cmp ecx, 0x3b91
setg al
xor ecx, ecx
inc ecx
cmp eax, ecx
jbe 0x1009496a
cmp dword [esp + 0x10], ebx
je 0x1009496a
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x444]
cmp dword [eax], ebx
je 0x10094adf
mov dword [esp + 0x14], 0xce724d25
mov dword [esp + 0x30], ebx
jmp 0x10094ac7
mov dword [esp + 0x20], 0xffffffff
lea ecx, [esp + 0x4d8]
push 4
call fcn.10013ee8
mov byte [esp + 0xa84], 7
mov dword [esp + 0x28], ebx
jmp 0x100949c8
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x4d8]
mov dword [eax + ecx*4], 0x7874d2d
inc dword [esp + 0x28]
cmp dword [esp + 0x28], 4
jl 0x100949b2
mov dword [esp + 0x28], ebx
cmp dword [esp + 0x28], 0x1c
jne 0x10094aaf
mov esi, dword [esp + 0x4d8]
mov dword [esp + 0x3c], esi
push 3
lea ecx, [esp + 0x4a0]
call fcn.10013ee8
mov dword [esp + 0x1c], ebx
jmp 0x10094a13
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x49c]
mov dword [eax + ecx*4], 0xeb613644
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 3
jl 0x100949fd
cmp dword [esp + 0x14], ebx
jne 0x10094a29
mov dword [esp + 0x1c], ebx
cmp dword [esi + 8], ebx
je 0x10094a31
mov dword [esp + 0x1c], 1
mov esi, dword [esi + 8]
xor edx, edx
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov edi, dword [esp + 0x49c]
sub esi, dword [edi + 8]
cmp ecx, eax
setl dl
sub esi, edx
sub esi, dword [esp + 0x1c]
sub esi, dword [esp + 0x28]
mov eax, dword [esp + 0x14]
sub esi, 9
neg esi
sbb esi, esi
xor ecx, ecx
neg esi
cmp eax, esi
mov esi, dword [esp + 0x3c]
setg cl
sub ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
sub edx, ecx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, dword [esi + 8]
lea ecx, [esp + 0x49c]
setle al
mov dword [edi + 8], eax
call fcn.100144eb
inc dword [esp + 0x28]
cmp dword [esp + 0x28], 0x1c
je 0x100949e9
lea ecx, [esp + 0x4d8]
mov byte [esp + 0xa84], 6
call fcn.100144eb
inc dword [esp + 0x30]
cmp dword [esp + 0x30], 0x15
jne 0x1009498e
mov eax, dword [esp + 0x14]
mov dword [esp + 0x28], eax
jmp 0x10094b98
mov dword [esp + 0x28], 0xfd11e6ac
mov eax, 0x9fb0e7fb
mov dword [esp + 0x524], eax
mov dword [esp + 0x528], eax
mov dword [esp + 0x52c], eax
mov dword [esp + 0x530], eax
mov dword [esp + 0x1c], ecx
cmp dword [esp + 0x1c], ebx
jl 0x10094b5e
mov dword [esp + 0x28], ebx
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x10]
push 2
pop ecx
sub ecx, eax
jne 0x10094b39
mov eax, dword [esp + 0x10]
mov dword [esp + 0x28], 4
xor ecx, ecx
mov eax, dword [esp + 0x1c]
inc ecx
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x28], ecx
dec dword [esp + 0x1c]
jns 0x10094b12
imul eax, dword [esp + 0x28], 0xc6b9
test eax, eax
je 0x10094b84
cmp dword [edx + 4], ebx
jne 0x10094b80
cmp dword [esp + 0x1c], ebx
jne 0x10094b80
mov eax, dword [esp + 0x450]
cmp dword [eax], ebx
je 0x10094b84
mov edx, ecx
jmp 0x10094b86
mov edx, ebx
mov eax, dword [esp + 0x20]
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [esp + 0x528], ecx
lea ecx, [esp + 0x444]
call fcn.100144eb
lea ecx, [esp + 0x450]
mov byte [esp + 0xa84], 4
call fcn.100144eb
mov dword [esp + 0x190], 0x7b016f08
mov ecx, ebx
mov dword [esp + 0x194], 0x7b027304
mov esi, ebx
mov dword [esp + 0x198], 0x7e097c05
mov dword [esp + 0x19c], 0x74037606
mov dword [esp + 0x1a0], 0xc60b8007
mov dword [esp + 0x1a4], 0xcdee5f0b
mov dword [esp + 0x1a8], 0x2fcbabff
mov word [esp + 0x1ac], 0x28
mov byte [esp + 0x1ae], 0x78
cmp ecx, 0x12
jne 0x10094c28
push 0xb
pop esi
push 0x1b
pop ecx
jmp 0x10094c5a
movzx eax, byte [esp + ecx + 0x191]
lea edx, [esi - 1]
sub eax, ecx
add edx, eax
jns 0x10094c4b
or eax, 0xffffffff
sub eax, edx
add edx, 0x100
and eax, 0xffffff00
add edx, eax
movzx eax, byte [esp + ecx + 0x190]
mov byte [esp + eax + 0x490], dl
add ecx, 2
cmp ecx, 0x1f
jb 0x10094c1b
mov byte [esp + 0x49a], bl
xor edx, edx
mov dword [esp + 0x14], 0xfffffff6
inc edx
mov dword [esp + 0x20], 0xfffffffa
mov dword [esp + 0x30], 0x5cc7
mov dword [esp + 0x20], edx
mov dword [esp + 0x2c], 0xdc4b
mov dword [esp + 0x10], ebx
jmp 0x10094ca6
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x64], 0x8bbca631
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x10094c96
mov dword [esp + 0x14], ebx
jmp 0x10094e02
mov dword [esp + 0x28], 0x94ff5452
mov dword [esp + 0x1c], 0x3799040c
mov dword [esp + 0x20], 0xde90
mov dword [esp + 0x10], ebx
jmp 0x10094ce7
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x794], 0xfffffff8
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x10094cd4
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + eax*4 + 0x64]
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x64], ecx
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0x20]
neg eax
sbb eax, eax
neg eax
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
cmp dword [esp + 0x28], eax
jge 0x10094d1e
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov eax, dword [esp + eax*4 + 0x64]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + eax*4 + 0x64]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + eax*4 + 0x64]
cmp eax, edx
setge cl
neg ecx
je 0x10094d49
mov ecx, edx
cmp dword [esp + 0x20], ebx
jne 0x10094d4b
mov ecx, ebx
mov eax, dword [esp + 0x14]
cmp ecx, dword [esp + eax*4 + 0x64]
je 0x10094d61
mov eax, dword [esp + 0x14]
mov ecx, ebx
cmp dword [esp + eax*4 + 0x64], ebx
je 0x10094d63
mov ecx, edx
xor eax, eax
cmp ecx, 0xd3ed
setge al
cmp eax, 0x5ad058bb
jle 0x10094d7d
mov eax, dword [esp + 0x14]
mov eax, dword [esp + eax*4 + 0x64]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x28]
imul eax, dword [esp + 0x1c], 0xfe64
mov ecx, dword [esp + 0x14]
sub ecx, eax
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x28]
mov dword [esp + 0x20], edx
mov eax, dword [esp + 0x20]
cmp eax, dword [esp + 0x30]
jne 0x10094dce
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10094dfe
push ebx
push 0x1a9b
push ebx
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetLBound]
xor edx, edx
inc edx
jmp 0x10094dfe
mov dword [esp + 0x1c], ebx
jmp 0x10094df8
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10094de9
push ebx
call dword [sym.imp.GDI32.dll_CreateBrushIndirect]
xor edx, edx
inc edx
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x79c], edx
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edx
jle 0x10094dd4
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jle 0x10094cb6
mov eax, dword [esp + 0x14]
xor ecx, ecx
cmp eax, 0x209f
lea eax, [esp + 0x490]
push eax
setl cl
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x560]
call fcn.1001c44c
mov byte [esp + 0xa84], 8
lea edi, [esp + 0x490]
xor eax, eax
lea ecx, [esp + 0x4e4]
stosd dword es:[edi], eax
push 2
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.10013ee8
mov dword [esp + 0x10], 7
mov dword [esp + 0x2c], 0x2c40a98c
mov dword [esp + 0x10], ebx
jmp 0x10094e7e
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x4e4]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x10094e6c
mov eax, dword [esp + 0x4e4]
mov dword [eax], ebx
mov dword [esp + 0x10], 0x18
jmp 0x10094ec1
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10094eaa
push ebx
call dword [sym.imp.USER32.dll_SetCursor]
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10094ebd
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x1d
jg 0x10094e98
lea ecx, [esp + 0x4e4]
mov byte [esp + 0xa84], 8
call fcn.100144eb
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x74c]
mov edx, dword [eax]
call fcn.10034022
mov byte [esp + 0xa84], 0xa
mov eax, 0x643b8a2
mov dword [esp + 0x10], 0xb743d837
xor ecx, ecx
mov dword [esp + 0x20], 0xfa147b80
mov dword [esp + 0x4f0], eax
mov dword [esp + 0x4f4], eax
mov dword [esp + 0x4f8], eax
mov dword [esp + 0x4fc], eax
mov dword [esp + 0x20], 0xfbe58499
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x4f0], 0x6088
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
sub eax, 0x279c
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
sets cl
mov dword [esp + 0x20], ecx
xor edx, edx
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
cmp ecx, eax
setg dl
sub dword [esp + 0x10], edx
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10094f96
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SaveDC]
mov dword [esp + 0x10], 3
mov dword [esp + 0x20], 0x19ac196a
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 5
mov dword [esp + 0x3c], 0xfffffff9
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10095019
push 0x7d0
push 0x1a45
push 0x1f12
push ebx
push 0x144f
push 0xe65
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x370
push 0xdd2
push 0x26f7
push 0x1da5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_MaskBlt]
mov dword [esp + 0x20], ebx
xor edx, edx
mov ecx, dword [esp + 0x10]
mov esi, ebx
mov eax, dword [esp + 0x10]
cmp ecx, eax
setg dl
xor eax, eax
add edx, dword [esp + 0x10]
cmp edx, 0x4ad744d0
setl al
xor ecx, ecx
cmp eax, 0xb9a7
mov eax, dword [esp + 0x20]
setne cl
sub eax, ecx
neg eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x20]
cmp eax, ecx
mov eax, dword [esp + 0x10]
setg dl
mov dword [esp + 0x114], 0x81136e00
xor ecx, ecx
mov dword [esp + 0x118], 0xeb6886fc
cmp eax, edx
mov dword [esp + 0x11c], 0x89d8dcd9
mov dword [esp + 0x120], 0xf8eec97a
setge cl
mov dword [esp + 0x124], 0x9db9e15a
mov dword [esp + 0x3c], ecx
mov ecx, ebx
mov dword [esp + 0x128], 0x276039a
mov word [esp + 0x12c], 0x168
mov byte [esp + 0x12e], 0x68
cmp ecx, 2
jne 0x100950d6
push 0x13
pop esi
push esi
pop ecx
jmp 0x10095108
movzx eax, byte [esp + ecx + 0x115]
lea edx, [esi - 1]
sub eax, ecx
add edx, eax
jns 0x100950f9
or eax, 0xffffffff
sub eax, edx
add edx, 0x100
and eax, 0xffffff00
add edx, eax
movzx eax, byte [esp + ecx + 0x114]
mov byte [esp + eax + 0x3d4], dl
add ecx, 2
cmp ecx, 0x1b
jb 0x100950ca
lea eax, [esp + 0x3d4]
mov byte [esp + 0x3d8], bl
push eax
lea ecx, [esp + 0x768]
call fcn.1001c44c
mov byte [esp + 0xa84], 0xb
mov dword [esp + 0x3d4], ebx
mov byte [esp + 0x3d8], bl
mov dword [esp + 0x14], 0x5a136951
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x10], ebx
jmp 0x10095163
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x48], 0x8ec0ae97
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 1
jl 0x10095153
mov dword [esp + 0x14], ebx
cmp dword [esp + 0x14], ebx
jl 0x10095202
mov dword [esp + 0x20], 0xbf0ddd9c
mov dword [esp + 0x10], 1
mov eax, dword [esp + 0x14]
cmp dword [esp + eax*4 + 0x48], ebx
jne 0x100951aa
mov eax, dword [esp + 0x14]
cmp dword [esp + eax*4 + 0x48], ebx
jne 0x100951aa
mov eax, dword [esp + 0x14]
cmp dword [esp + eax*4 + 0x48], ebx
jne 0x100951aa
mov esi, ebx
jmp 0x100951ad
xor esi, esi
inc esi
mov ecx, dword [esp + 0x2c]
xor edx, edx
mov eax, dword [esp + 0x14]
cmp ecx, eax
mov eax, dword [esp + 0x14]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
add eax, 9
add ecx, eax
mov eax, dword [esp + 0x14]
neg ecx
sbb ecx, ecx
neg ecx
mov dword [esp + eax*4 + 0x48], esi
mov eax, dword [esp + 0x10]
imul eax, ecx
xor ecx, ecx
cmp esi, eax
sete cl
mov dword [esp + 0x10], ecx
dec dword [esp + 0x14]
jns 0x10095178
mov eax, dword [esp + 0x14]
mov ecx, ebx
mov dword [esp + 0x48], eax
mov esi, ebx
mov dword [esp + 0x130], 0xd1097100
mov dword [esp + 0x134], 0x2d9ed457
mov dword [esp + 0x138], 0x794e4aa
mov dword [esp + 0x13c], 0x96a046c
mov dword [esp + 0x140], 0x1780875
mov dword [esp + 0x144], 0x37c027d
mov dword [esp + 0x148], 0x6740583
mov byte [esp + 0x14c], 0x87
cmp ecx, 2
jne 0x1009526f
push 9
pop esi
push esi
pop ecx
jmp 0x100952a1
movzx eax, byte [esp + ecx + 0x131]
lea edx, [esi - 1]
sub eax, ecx
add edx, eax
jns 0x10095292
or eax, 0xffffffff
sub eax, edx
add edx, 0x100
and eax, 0xffffff00
add edx, eax
movzx eax, byte [esp + ecx + 0x130]
mov byte [esp + eax + 0x478], dl
add ecx, 2
cmp ecx, 0x1d
jb 0x10095263
lea eax, [esp + 0x478]
mov byte [esp + 0x482], bl
push eax
lea ecx, [esp + 0x670]
call fcn.1001c44c
mov byte [esp + 0xa84], 0xc
lea edi, [esp + 0x478]
xor eax, eax
mov byte [esp + 0x54], bl
stosd dword es:[edi], eax
lea ecx, [esp + 0x5f0]
push 4
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [esp + 0x18], 1
mov dword [esp + 0x34], 3
call fcn.10013ee8
push 1
lea ecx, [esp + 0x4d0]
mov byte [esp + 0xa88], 0xd
call fcn.10013ee8
mov byte [esp + 0xa84], 0xe
mov dword [esp + 0x1c], ebx
jmp 0x10095332
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x5f0]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 4
jl 0x10095320
xor edx, edx
mov dword [esp + 0x1c], ebx
inc edx
jmp 0x10095354
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x4cc]
mov dword [eax + ecx*4], edx
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edx
jl 0x10095342
mov eax, dword [esp + 0x14]
mov ecx, 0xe3cf9575
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
add eax, 0x39f7747
cmp ecx, eax
sbb eax, eax
neg eax
add eax, dword [esp + 0x14]
mov dword [esp + 0x14], eax
jne 0x10095390
mov ecx, ebx
cmp dword [esp + 0x14], ebx
je 0x10095392
mov ecx, edx
mov eax, dword [esp + 0x30]
imul eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x30], 0xfffffff0
cmp dword [esp + 0x30], 0xffffffef
jge 0x100955b2
push 0xfffffffffffffffd
pop esi
mov edi, 0xffff
jmp 0x100953bd
xor edx, edx
inc edx
mov dword [esp + 0x28], 0xfff6
lea ecx, [esp + 0x584]
push edx
call fcn.10013ee8
mov byte [esp + 0xa84], 0xf
mov dword [esp + 0x468], esi
mov dword [esp + 0x46c], esi
mov dword [esp + 0x470], esi
mov dword [esp + 0x474], esi
mov dword [esp + 0x10], ebx
jmp 0x10095412
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x584]
mov dword [eax + ecx*4], 0xe1c2a91
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 1
jl 0x100953fc
mov dword [esp + 0x14], 0xffffffe2
jmp 0x1009557d
mov dword [esp + 0x10], 5
lea ecx, [esp + 0x4c0]
push 4
call fcn.10013ee8
mov dword [esp + 0x1c], ebx
jmp 0x10095458
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x4c0]
mov dword [eax + ecx*4], 0xfffffff8
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 4
jl 0x10095442
mov eax, dword [esp + 0x14]
cmp edi, eax
sbb eax, eax
neg eax
cmp eax, edi
mov eax, dword [esp + 0x28]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
setne dl
add edx, dword [esp + 0x10]
neg edx
sub edx, dword [esp + 0x10]
mov eax, dword [esp + 0x28]
neg edx
sbb edx, edx
sub eax, 8
inc edx
cmp eax, edx
je 0x100954ea
mov dword [esp + 0x28], ebx
jmp 0x100954d9
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x100954bf
push 0x1e31
push 0x5c1
push 0xbfd
push 0xfa1
call dword [sym.imp.GDI32.dll_CreateRectRgn]
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x100954d5
push 0x206
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
inc dword [esp + 0x28]
cmp dword [esp + 0x28], ebx
jle 0x1009549a
cmp dword [esp + 0x10], ebx
je 0x10095564
jmp 0x1009556d
mov dword [esp + 0x1c], 0x20be
xor edx, edx
mov dword [esp + 0x2c], 0xfffffff6
mov dword [esp + 0x20], 0xc894628a
mov dword [esp + 0x1c], 0xbf7d
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
cmp eax, ecx
setge dl
add edx, 0x7ba6da08
je 0x1009553f
cmp dword [esp + 0x10], 0xd983a5c2
sbb eax, eax
neg eax
cmp eax, dword [esp + 0x10]
jl 0x1009553f
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x30]
xor edx, edx
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
cmp ecx, eax
mov eax, dword [esp + 0x28]
setl dl
xor ecx, ecx
cmp eax, edx
setge cl
mov dword [esp + 0x470], ecx
mov eax, dword [esp + 0x4cc]
dec dword [eax]
lea ecx, [esp + 0x4c0]
call fcn.100144eb
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0x11
je 0x10095426
mov dword [esp + 0x468], ebx
lea ecx, [esp + 0x584]
mov byte [esp + 0xa84], 0xe
call fcn.100144eb
dec dword [esp + 0x30]
cmp dword [esp + 0x30], 0xffffffef
jl 0x100953ba
lea ecx, [esp + 0x4cc]
call fcn.100144eb
lea ecx, [esp + 0x5f0]
mov byte [esp + 0xa84], 0xc
call fcn.100144eb
mov eax, dword [esp + 0x40]
cmp byte [eax + 0x48], 0
je 0x10095657
lea ecx, [eax + 0x4c]
push ecx
push dword [ebp + 0x10]
lea ecx, [esp + 0x5c]
push ecx
lea edx, [eax + 0x30]
lea ecx, [eax + 0x18]
call fcn.10034ac3
add esp, 0xc
test al, al
jne 0x10095603
mov byte [esp + 0x27], bl
jmp 0x100974b2
lea eax, [esp + 0x764]
push eax
push ecx
mov ecx, dword [ebp + 0x10]
lea eax, [esp + 0x674]
push eax
call fcn.1001d839
pop ecx
mov ecx, eax
call fcn.1001d839
mov esi, eax
lea edx, [esp + 0x55c]
push ebx
mov ecx, esi
call fcn.1001dc23
pop ecx
push ebx
push ecx
lea eax, [esp + 0x564]
mov ecx, esi
push eax
call fcn.1001d839
pop ecx
lea edx, [esp + 0x750]
mov ecx, eax
call fcn.1001dc23
pop ecx
mov ecx, dword [ebp + 0x10]
lea edx, [esp + 0x55c]
push ebx
call fcn.1001dc23
pop ecx
push ebx
lea edx, [esp + 0x750]
mov dword [esp + 0x40], eax
mov ecx, eax
call fcn.1001dc23
pop ecx
push 7
lea ecx, [esp + 0x70c]
mov edi, eax
call fcn.1001cd23
lea edx, [esp + 0x400]
mov byte [esp + 0xa84], 0x10
mov ecx, edi
call fcn.1002a2ba
test al, al
je 0x100956b9
lea eax, [esp + 0x400]
mov ecx, edi
push eax
call fcn.1001d839
mov esi, eax
jmp 0x100956c0
lea esi, [esp + 0x708]
sub esp, 0x18
lea eax, [esp + 0x850]
mov ecx, esp
mov dword [esp + 0x44], esp
push eax
call fcn.10019e3f
sub esp, 0x18
mov byte [esp + 0xab4], 0x11
lea eax, [esp + 0x430]
mov dword [esp + 0x50], esp
mov ecx, esp
push eax
call fcn.10019e3f
mov eax, dword [esp + 0x68]
lea ecx, [esp + 0x9b8]
mov byte [esp + 0xab4], 0x12
push 0xb
mov edx, dword [eax]
call fcn.1009b093
pop ecx
mov byte [esp + 0xab4], 0x13
cmp dword [eax + 0x10], ebx
sete byte [esp + 0x5c]
mov edx, dword [esp + 0x70]
mov ecx, dword [edx + 0x50]
lea eax, [ecx + 0x90]
push eax
push ebx
push dword [esp + 0x64]
push dword [ecx + 0xa8]
mov ecx, esi
push dword [edx + 0x54]
mov byte [esp + 0xac8], 0x14
mov edx, dword [edx + 0x4c]
call fcn.1009eb91
add esp, 0x44
mov byte [esp + 0xa84], 0x10
lea ecx, [esp + 0x988]
push ebx
push 1
call fcn.10014448
push esi
push ecx
lea eax, [esp + 0x408]
mov ecx, edi
push eax
call fcn.1001d839
pop ecx
mov ecx, eax
call fcn.1001cfb5
mov edi, dword [esp + 0x40]
cmp byte [edi + 0x48], 0
je 0x100957b8
sub esp, 0x18
lea eax, [esp + 0x418]
mov ecx, esp
push eax
call fcn.10019e3f
push dword [edi + 0x4c]
mov ecx, dword [ebp + 0x10]
lea eax, [edi + 0x30]
push esi
push dword [esp + 0x74]
lea edx, [edi + 0x18]
push eax
call fcn.1002f72b
add esp, 0x28
mov dword [esp + 0x2ec], 0x680c6d0b
mov ecx, ebx
mov dword [esp + 0x2f0], 0x6809670a
mov esi, ebx
mov dword [esp + 0x2f4], 0x74076d06
mov dword [esp + 0x2f8], 0x7a008403
mov dword [esp + 0x2fc], 0x72057f01
mov dword [esp + 0x300], 0x85048808
mov dword [esp + 0x304], 0x5bf02010
mov dword [esp + 0x308], 0x153e3478
mov dword [esp + 0x30c], 0xe147019f
mov dword [esp + 0x310], 0xc7855bf
mov dword [esp + 0x314], 0x8a027d0d
cmp ecx, 0x18
jne 0x10095842
push 0x10
pop esi
push 0x26
pop ecx
jmp 0x10095874
movzx eax, byte [esp + ecx + 0x2ed]
lea edx, [esi - 1]
sub eax, ecx
add edx, eax
jns 0x10095865
or eax, 0xffffffff
sub eax, edx
add edx, 0x100
and eax, 0xffffff00
add edx, eax
movzx eax, byte [esp + ecx + 0x2ec]
mov byte [esp + eax + 0x574], dl
add ecx, 2
cmp ecx, 0x2c
jb 0x10095835
lea eax, [esp + 0x574]
mov byte [esp + 0x582], bl
push eax
lea ecx, [esp + 0x5ac]
call fcn.1001c44c
mov esi, dword [esp + 0x40]
lea edi, [esp + 0x574]
mov byte [esp + 0xa84], 0x15
xor eax, eax
stosd dword es:[edi], eax
cmp byte [esi + 0x48], 0
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
je 0x10095b23
mov edi, dword [esp + 0x3c]
lea edx, [esp + 0x5a8]
mov ecx, edi
call fcn.10094254
test al, al
je 0x10095b0b
lea eax, [esp + 0x5a8]
mov ecx, edi
push eax
call fcn.1001d839
lea edx, [esp + 0x400]
mov ecx, eax
call fcn.1001dcc3
test al, al
je 0x10095b0b
mov dword [esp + 0x388], 0x310a6518
mov ecx, ebx
mov dword [esp + 0x38c], 0x75087407
mov esi, ebx
mov dword [esp + 0x390], 0x820e7d02
mov dword [esp + 0x394], 0x78127111
mov dword [esp + 0x398], 0x86057617
mov dword [esp + 0x39c], 0x8a138304
mov dword [esp + 0x3a0], 0x7d159101
mov dword [esp + 0x3a4], 0x8d0f7e14
mov dword [esp + 0x3a8], 0x88038010
mov dword [esp + 0x3ac], 0x960d9809
mov dword [esp + 0x3b0], 0x9406940b
mov dword [esp + 0x3b4], 0x9d0c9200
mov dword [esp + 0x3b8], 0x3c0e9d16
mov dword [esp + 0x3bc], 0x84288869
mov dword [esp + 0x3c0], 0x446fbc29
mov dword [esp + 0x3c4], 0x6ab8ab6c
cmp ecx, 0x32
jne 0x100959bc
push 0xe
pop esi
push 0x3e
pop ecx
jmp 0x100959ee
movzx eax, byte [esp + ecx + 0x389]
lea edx, [esi - 1]
sub eax, ecx
add edx, eax
jns 0x100959df
or eax, 0xffffffff
sub eax, edx
add edx, 0x100
and eax, 0xffffff00
add edx, eax
movzx eax, byte [esp + ecx + 0x388]
mov byte [esp + eax + 0x7ec], dl
add ecx, 2
cmp ecx, 0x40
jb 0x100959af
lea eax, [esp + 0x7ec]
mov byte [esp + 0x805], bl
push eax
lea ecx, [esp + 0x8cc]
call fcn.1001c44c
mov esi, eax
push ecx
push ecx
lea eax, [esp + 0x5b0]
mov byte [esp + 0xa8c], 0x16
push eax
mov ecx, edi
call fcn.1001d839
pop ecx
push eax
push esi
mov esi, dword [esp + 0x4c]
lea ecx, [esp + 0x85c]
lea eax, [esi + 0x30]
push eax
lea edx, [esi + 0x18]
call fcn.1003475e
add esp, 0x10
push ebx
push 1
lea ecx, [esp + 0x8d0]
mov byte [esp + 0xa8c], 0x18
call fcn.100170c9
push 6
pop ecx
xor eax, eax
lea edi, [esp + 0x7ec]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x6c8]
stosw word es:[edi], ax
lea eax, [esp + 0x850]
push eax
call fcn.1001cdd8
lea eax, [esp + 0x6c8]
mov byte [esp + 0xa84], 0x19
push eax
push ecx
lea eax, [esp + 0x5b0]
push eax
push ecx
lea eax, [esp + 0x56c]
push eax
push ecx
lea eax, [esp + 0x77c]
push eax
push ecx
mov ecx, dword [ebp + 0x10]
lea eax, [esp + 0x68c]
push eax
call fcn.1001d839
pop ecx
mov ecx, eax
call fcn.1001d839
pop ecx
mov ecx, eax
call fcn.1001d839
pop ecx
mov ecx, eax
call fcn.1001d839
pop ecx
mov ecx, eax
call fcn.1001cfb5
lea ecx, [esp + 0x6c8]
mov byte [esp + 0xa84], 0x18
call fcn.1001cf38
push ebx
push 1
lea ecx, [esp + 0x858]
mov byte [esp + 0xa8c], 0x15
call fcn.100170c9
cmp byte [esi + 0x48], 0
je 0x10095b23
push ecx
mov ecx, dword [ebp + 0x10]
lea eax, [esi + 0x30]
push eax
lea edx, [esi + 0x18]
call fcn.100343ce
pop ecx
pop ecx
mov edi, dword [ebp + 0xc]
mov ecx, edi
call fcn.100331cb
push ebx
lea edx, [esp + 0x560]
mov ecx, edi
call fcn.1001dc23
pop ecx
xor ecx, ecx
mov dword [esp + 0x20], eax
cmp byte [esp + 0x27], cl
mov edx, eax
setne cl
push ecx
lea ecx, [esp + 0x404]
call fcn.1009e5b5
mov edx, dword [esi + 0x4c]
pop ecx
push 0x13
lea ecx, [esp + 0x7c8]
call fcn.1009b734
pop ecx
mov byte [esp + 0xa84], 0x1a
mov edx, edi
push dword [esi + 0x4c]
mov ecx, eax
call fcn.100a4ffd
pop ecx
lea ecx, [esp + 0x7c4]
mov byte [esp + 0xa84], 0x15
call fcn.10029f2c
cmp byte [esp + 0x27], 0
je 0x10096b98
cmp byte [esi + 0x48], 0
je 0x10095bb4
lea edx, [esp + 0x66c]
mov ecx, edi
call fcn.1001dcc3
mov dword [esp + 0x26c], 0x66036202
mov ecx, ebx
mov dword [esp + 0x270], 0x5d0a7105
mov esi, ebx
mov dword [esp + 0x274], 0xfa8c062d
mov dword [esp + 0x278], 0x3178f824
mov dword [esp + 0x27c], 0x74046c0e
mov dword [esp + 0x280], 0x76067e07
mov dword [esp + 0x284], 0x8508730b
mov dword [esp + 0x288], 0x760c7500
mov dword [esp + 0x28c], 0x8e09870a
mov dword [esp + 0x290], 0x910d8701
cmp ecx, 6
jne 0x10095c33
push 0xa
pop esi
push 0xe
pop ecx
jmp 0x10095c65
movzx eax, byte [esp + ecx + 0x26d]
lea edx, [esi - 1]
sub eax, ecx
add edx, eax
jns 0x10095c56
or eax, 0xffffffff
sub eax, edx
add edx, 0x100
and eax, 0xffffff00
add edx, eax
movzx eax, byte [esp + ecx + 0x26c]
mov byte [esp + eax + 0x5e0], dl
add ecx, 2
cmp ecx, 0x28
jb 0x10095c26
lea eax, [esp + 0x5e0]
mov byte [esp + 0x5ef], bl
push eax
lea ecx, [esp + 0x914]
call fcn.1001c44c
mov byte [esp + 0xa84], 0x1b
lea edi, [esp + 0x5e0]
xor eax, eax
mov dword [esp + 0x244], 0x6f016a06
stosd dword es:[edi], eax
mov ecx, ebx
mov dword [esp + 0x248], 0x6802690b
mov esi, ebx
mov dword [esp + 0x24c], 0x6d006e0e
mov dword [esp + 0x250], 0x3f086e0c
stosd dword es:[edi], eax
mov dword [esp + 0x254], 0xf3574625
mov dword [esp + 0x258], 0x72033d23
mov dword [esp + 0x25c], 0x7f057c04
stosd dword es:[edi], eax
mov dword [esp + 0x260], 0x8a078908
mov dword [esp + 0x264], 0x8b0a8e09
mov word [esp + 0x268], 0x910d
stosd dword es:[edi], eax
cmp ecx, 0xe
jne 0x10095d1b
push 8
pop esi
push 0x14
pop ecx
jmp 0x10095d4d
movzx eax, byte [esp + ecx + 0x245]
lea edx, [esi - 1]
sub eax, ecx
add edx, eax
jns 0x10095d3e
or eax, 0xffffffff
sub eax, edx
add edx, 0x100
and eax, 0xffffff00
add edx, eax
movzx eax, byte [esp + ecx + 0x244]
mov byte [esp + eax + 0x5d0], dl
add ecx, 2
cmp ecx, 0x26
jb 0x10095d0e
push 7
lea ecx, [esp + 0x82c]
mov byte [esp + 0x5e3], bl
call fcn.1001cd23
mov esi, eax
lea eax, [esp + 0x5d0]
mov byte [esp + 0xa84], 0x1c
push eax
lea ecx, [esp + 0xa4c]
call fcn.1001c44c
push esi
push ecx
mov byte [esp + 0xa8c], 0x1d
mov ecx, dword [esp + 0x28]
push eax
call fcn.1001d839
pop ecx
mov ecx, eax
call fcn.1001cfb5
push ebx
push 1
lea ecx, [esp + 0xa50]
call fcn.100170c9
lea ecx, [esp + 0x828]
mov byte [esp + 0xa84], 0x1b
call fcn.1001cf38
xor eax, eax
mov dword [esp + 0x1f8], 0x6e04660e
lea edi, [esp + 0x5d0]
mov dword [esp + 0x1fc], 0x770a790d
stosd dword es:[edi], eax
mov ecx, ebx
mov dword [esp + 0x200], 0x74066b00
mov esi, ebx
mov dword [esp + 0x204], 0x83086e02
mov dword [esp + 0x208], 0x770b7d01
stosd dword es:[edi], eax
mov dword [esp + 0x20c], 0x8c097803
mov dword [esp + 0x210], 0x7c0c8c07
mov dword [esp + 0x214], 0xe7068905
stosd dword es:[edi], eax
mov dword [esp + 0x218], 0xababa1e9
stosd dword es:[edi], eax
cmp ecx, 0x1e
jne 0x10095e48
push 6
pop esi
push 0x22
pop ecx
jmp 0x10095e7a
movzx eax, byte [esp + ecx + 0x1f9]
lea edx, [esi - 1]
sub eax, ecx
add edx, eax
jns 0x10095e6b
or eax, 0xffffffff
sub eax, edx
add edx, 0x100
and eax, 0xffffff00
add edx, eax
movzx eax, byte [esp + ecx + 0x1f8]
mov byte [esp + eax + 0x5c0], dl
add ecx, 2
cmp ecx, 0x24
jb 0x10095e3b
mov byte [esp + 0x5cf], bl
mov ecx, ebx
mov dword [esp + 0x150], 0x71067005
mov esi, ebx
mov dword [esp + 0x154], 0x6c017803
mov dword [esp + 0x158], 0x7d027204
mov dword [esp + 0x15c], 0xb1ef3e11
mov dword [esp + 0x160], 0x39a14d58
mov dword [esp + 0x164], 0x1df3e828
mov dword [esp + 0x168], 0x3b4c062d
mov word [esp + 0x16c], 0x9a
mov byte [esp + 0x16e], 0x83
cmp ecx, 0xc
jne 0x10095ef9
push 0x11
pop esi
push 0x1b
pop ecx
jmp 0x10095f2b
movzx eax, byte [esp + ecx + 0x151]
lea edx, [esi - 1]
sub eax, ecx
add edx, eax
jns 0x10095f1c
or eax, 0xffffffff
sub eax, edx
add edx, 0x100
and eax, 0xffffff00
add edx, eax
movzx eax, byte [esp + ecx + 0x150]
mov byte [esp + eax + 0x3f8], dl
add ecx, 2
cmp ecx, 0x1f
jb 0x10095eec
mov byte [esp + 0x3ff], bl
mov ecx, ebx
mov dword [esp + 0x294], 0x37113609
mov esi, ebx
mov dword [esp + 0x298], 0x35083600
mov dword [esp + 0x29c], 0x3d023b04
mov dword [esp + 0x2a0], 0x40063f01
mov dword [esp + 0x2a4], 0x430e4607
mov dword [esp + 0x2a8], 0xa19e503
mov dword [esp + 0x2ac], 0x10480346
mov dword [esp + 0x2b0], 0x54d1247
mov dword [esp + 0x2b4], 0xd4d0c4d
mov dword [esp + 0x2b8], 0xf5b0b5a
mov byte [esp + 0x2bc], 0x5c
cmp ecx, 0x14
jne 0x10095fc1
push 3
pop esi
push 0x15
pop ecx
jmp 0x10095ff3
movzx eax, byte [esp + ecx + 0x295]
lea edx, [esi - 1]
sub eax, ecx
add edx, eax
jns 0x10095fe4
or eax, 0xffffffff
sub eax, edx
add edx, 0x100
and eax, 0xffffff00
add edx, eax
movzx eax, byte [esp + ecx + 0x294]
mov byte [esp + eax + 0x684], dl
add ecx, 2
cmp ecx, 0x29
jb 0x10095fb4
lea eax, [esp + 0x684]
mov byte [esp + 0x697], bl
push eax
lea ecx, [esp + 0x92c]
call fcn.1001c44c
push eax
lea ecx, [esp + 0x6ac]
mov byte [esp + 0xa88], 0x1e
call fcn.1001cdd8
lea eax, [esp + 0x3f8]
mov byte [esp + 0xa84], 0x1f
push eax
lea ecx, [esp + 0x9bc]
call fcn.1001c44c
mov esi, eax
lea eax, [esp + 0x5c0]
mov byte [esp + 0xa84], 0x20
push eax
lea ecx, [esp + 0x8fc]
call fcn.1001c44c
lea ecx, [esp + 0x6a8]
mov byte [esp + 0xa84], 0x21
push ecx
push ecx
push esi
push ecx
mov ecx, dword [esp + 0x30]
push eax
call fcn.1001d839
pop ecx
mov ecx, eax
call fcn.1001d839
pop ecx
mov ecx, eax
call fcn.1001cfb5
push ebx
push 1
lea ecx, [esp + 0x900]
call fcn.100170c9
push ebx
push 1
lea ecx, [esp + 0x9c0]
call fcn.100170c9
lea ecx, [esp + 0x6a8]
mov byte [esp + 0xa84], 0x1e
call fcn.1001cf38
push ebx
push 1
lea ecx, [esp + 0x930]
mov byte [esp + 0xa8c], 0x1b
call fcn.100170c9
xor eax, eax
mov dword [esp + 0x3f8], ebx
lea edi, [esp + 0x5c0]
mov dword [esp + 0x3fc], ebx
stosd dword es:[edi], eax
mov ecx, ebx
mov dword [esp + 0xf8], 0x64006405
mov esi, ebx
mov dword [esp + 0xfc], 0x6c077708
mov dword [esp + 0x100], 0x77036d01
stosd dword es:[edi], eax
mov dword [esp + 0x104], 0xbbc1ad08
mov dword [esp + 0x108], 0x46cc2c1f
mov dword [esp + 0x10c], 0x71027c04
stosd dword es:[edi], eax
mov word [esp + 0x110], 0x7c06
stosd dword es:[edi], eax
xor eax, eax
lea edi, [esp + 0x684]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
cmp ecx, 0xc
jne 0x10096161
push 8
pop esi
push 0x12
pop ecx
jmp 0x10096193
movzx eax, byte [esp + ecx + 0xf9]
lea edx, [esi - 1]
sub eax, ecx
add edx, eax
jns 0x10096184
or eax, 0xffffffff
sub eax, edx
add edx, 0x100
and eax, 0xffffff00
add edx, eax
movzx eax, byte [esp + ecx + 0xf8]
mov byte [esp + eax + 0x45c], dl
add ecx, 2
cmp ecx, 0x1a
jb 0x10096154
lea eax, [esp + 0x45c]
mov byte [esp + 0x465], bl
push eax
lea ecx, [esp + 0xa1c]
call fcn.1001c44c
mov ecx, dword [ebp + 0xc]
mov edx, eax
mov byte [esp + 0xa84], 0x22
call fcn.1001dcc3
push ebx
push 1
lea ecx, [esp + 0xa20]
call fcn.100170c9
xor eax, eax
mov dword [esp + 0xb0], 0x65007301
lea edi, [esp + 0x45c]
mov dword [esp + 0xb4], 0x7ab75409
stosd dword es:[edi], eax
mov ecx, ebx
mov dword [esp + 0xb8], 0x28fb53df
mov esi, ebx
mov dword [esp + 0xbc], 0x46a05a4
mov dword [esp + 0xc0], 0x678027a
stosd dword es:[edi], eax
mov word [esp + 0xc4], 0x37d
mov byte [esp + 0xc6], 0x84
stosw word es:[edi], ax
cmp ecx, 4
jne 0x1009623e
push 9
pop esi
push 0xb
pop ecx
jmp 0x10096270
movzx eax, byte [esp + ecx + 0xb1]
lea edx, [esi - 1]
sub eax, ecx
add edx, eax
jns 0x10096261
or eax, 0xffffffff
sub eax, edx
add edx, 0x100
and eax, 0xffffff00
add edx, eax
movzx eax, byte [esp + ecx + 0xb0]
mov byte [esp + eax + 0x418], dl
add ecx, 2
cmp ecx, 0x17
jb 0x10096231
mov byte [esp + 0x41f], bl
mov ecx, ebx
mov dword [esp + 0x348], 0x62106f12
mov esi, ebx
mov dword [esp + 0x34c], 0x68027506
mov dword [esp + 0x350], 0x740d6b14
mov dword [esp + 0x354], 0x740a7117
mov dword [esp + 0x358], 0x87097504
mov dword [esp + 0x35c], 0x8901840e
mov dword [esp + 0x360], 0x8715870f
mov dword [esp + 0x364], 0x8e08800b
mov dword [esp + 0x368], 0x89008213
mov dword [esp + 0x36c], 0xfa0d8a11
mov dword [esp + 0x370], 0x67fc73aa
mov dword [esp + 0x374], 0xfa17c903
mov dword [esp + 0x378], 0x79bd0da
mov dword [esp + 0x37c], 0x169e0399
mov dword [esp + 0x380], 0x5a10c90
mov byte [esp + 0x384], 0x8e
cmp ecx, 0x26
jne 0x1009633d
push 0xd
pop esi
push 0x31
pop ecx
jmp 0x1009636f
movzx eax, byte [esp + ecx + 0x349]
lea edx, [esi - 1]
sub eax, ecx
add edx, eax
jns 0x10096360
or eax, 0xffffffff
sub eax, edx
add edx, 0x100
and eax, 0xffffff00
add edx, eax
movzx eax, byte [esp + ecx + 0x348]
mov byte [esp + eax + 0x7d0], dl
add ecx, 2
cmp ecx, 0x3d
jb 0x10096330
push ebx
lea ecx, [esp + 0x6bc]
mov byte [esp + 0x7ec], bl
call fcn.1001ce14
lea eax, [esp + 0x7d0]
mov byte [esp + 0xa84], 0x23
push eax
lea ecx, [esp + 0x9ec]
call fcn.1001c44c
mov esi, eax
lea eax, [esp + 0x418]
mov byte [esp + 0xa84], 0x24
push eax
lea ecx, [esp + 0x95c]
call fcn.1001c44c
lea ecx, [esp + 0x6b8]
mov byte [esp + 0xa84], 0x25
push ecx
push ecx
push esi
push ecx
mov ecx, dword [ebp + 0xc]
push eax
call fcn.1001d839
pop ecx
mov ecx, eax
call fcn.1001d839
pop ecx
mov ecx, eax
call fcn.1001cfb5
push ebx
push 1
lea ecx, [esp + 0x960]
call fcn.100170c9
push ebx
push 1
lea ecx, [esp + 0x9f0]
call fcn.100170c9
lea ecx, [esp + 0x6b8]
mov byte [esp + 0xa84], 0x1b
call fcn.1001cf38
push 6
pop ecx
xor eax, eax
mov dword [esp + 0x418], ebx
lea edi, [esp + 0x7d0]
mov dword [esp + 0x41c], ebx
rep stosd dword es:[edi], eax
mov dword [esp + 0x80], 0x6f056a04
mov ecx, ebx
mov dword [esp + 0x84], 0x79017500
mov esi, ebx
mov dword [esp + 0x88], 0x6d087802
stosb byte es:[edi], al
mov dword [esp + 0x8c], 0xafaba2b9
mov dword [esp + 0x90], 0x71030cf9
mov word [esp + 0x94], 0x7206
cmp ecx, 0xa
jne 0x10096492
push 8
pop esi
push 0x10
pop ecx
jmp 0x100964c4
movzx eax, byte [esp + ecx + 0x81]
lea edx, [esi - 1]
sub eax, ecx
add edx, eax
jns 0x100964b5
or eax, 0xffffffff
sub eax, edx
add edx, 0x100
and eax, 0xffffff00
add edx, eax
movzx eax, byte [esp + ecx + 0x80]
mov byte [esp + eax + 0x3e8], dl
add ecx, 2
cmp ecx, 0x16
jb 0x10096485
lea eax, [esp + 0x3e8]
mov byte [esp + 0x3ef], bl
push eax
lea ecx, [esp + 0x548]
call fcn.1001c44c
mov byte [esp + 0xa84], 0x26
mov ecx, ebx
mov dword [esp + 0x3e8], ebx
mov esi, ebx
mov dword [esp + 0x3ec], ebx
mov dword [esp + 0x318], 0x68047001
mov dword [esp + 0x31c], 0x89675210
mov dword [esp + 0x320], 0x525a68f5
mov dword [esp + 0x324], 0xb915aef1
mov dword [esp + 0x328], 0x6191c233
mov dword [esp + 0x32c], 0x6c09780f
mov dword [esp + 0x330], 0x7f03770d
mov dword [esp + 0x334], 0x760e8008
mov dword [esp + 0x338], 0x870a7a0c
mov dword [esp + 0x33c], 0x85028906
mov dword [esp + 0x340], 0x7a078705
mov dword [esp + 0x344], 0x930b8000
cmp ecx, 4
jne 0x10096592
push 0x10
pop esi
push 0x12
pop ecx
jmp 0x100965c4
movzx eax, byte [esp + ecx + 0x319]
lea edx, [esi - 1]
sub eax, ecx
add edx, eax
jns 0x100965b5
or eax, 0xffffffff
sub eax, edx
add edx, 0x100
and eax, 0xffffff00
add edx, eax
movzx eax, byte [esp + ecx + 0x318]
mov byte [esp + eax + 0x614], dl
add ecx, 2
cmp ecx, 0x30
jb 0x10096585
lea eax, [esp + 0x614]
mov byte [esp + 0x624], bl
push eax
lea ecx, [esp + 0x594]
call fcn.1001c44c
mov byte [esp + 0xa84], 0x27
lea edi, [esp + 0x614]
xor eax, eax
mov dword [esp + 0x21c], 0x12126600
stosd dword es:[edi], eax
mov ecx, ebx
mov dword [esp + 0x220], 0x436ba017
mov esi, ebx
mov dword [esp + 0x224], 0xa0aa1ec3
mov dword [esp + 0x228], 0xc349ef9e
stosd dword es:[edi], eax
mov dword [esp + 0x22c], 0x4c5a156e
mov dword [esp + 0x230], 0x74077705
mov dword [esp + 0x234], 0x79047f01
stosd dword es:[edi], eax
mov dword [esp + 0x238], 0x80097908
mov dword [esp + 0x23c], 0x76037202
mov word [esp + 0x240], 0x7c06
stosd dword es:[edi], eax
stosb byte es:[edi], al
cmp ecx, 2
jne 0x1009667a
push 0x12
pop esi
push esi
pop ecx
jmp 0x100966ac
movzx eax, byte [esp + ecx + 0x21d]
lea edx, [esi - 1]
sub eax, ecx
add edx, eax
jns 0x1009669d
or eax, 0xffffffff
sub eax, edx
add edx, 0x100
and eax, 0xffffff00
add edx, eax
movzx eax, byte [esp + ecx + 0x21c]
mov byte [esp + eax + 0x484], dl
add ecx, 2
cmp ecx, 0x26
jb 0x1009666e
lea eax, [esp + 0x484]
mov byte [esp + 0x48e], bl
push eax
lea ecx, [esp + 0x658]
call fcn.1001c44c
mov byte [esp + 0xa84], 0x28
lea edi, [esp + 0x484]
xor eax, eax
mov dword [esp + 0xe0], 0xdf126200
stosd dword es:[edi], eax
mov ecx, ebx
mov dword [esp + 0xe4], 0xa9062716
mov esi, ebx
mov dword [esp + 0xe8], 0x137bb7b0
mov dword [esp + 0xec], 0xe418944b
stosd dword es:[edi], eax
mov dword [esp + 0xf0], 0x924d482a
mov dword [esp + 0xf4], 0x69017602
stosw word es:[edi], ax
stosb byte es:[edi], al
cmp ecx, 2
jne 0x10096737
push 0x12
pop esi
push esi
pop ecx
jmp 0x10096769
movzx eax, byte [esp + ecx + 0xe1]
lea edx, [esi - 1]
sub eax, ecx
add edx, eax
jns 0x1009675a
or eax, 0xffffffff
sub eax, edx
add edx, 0x100
and eax, 0xffffff00
add edx, eax
movzx eax, byte [esp + ecx + 0xe0]
mov byte [esp + eax + 0x3d0], dl
add ecx, 2
cmp ecx, 0x18
jb 0x1009672b
lea eax, [esp + 0x3d0]
mov byte [esp + 0x3d3], bl
push eax
lea ecx, [esp + 0x7b0]
call fcn.1001c44c
mov esi, dword [ebp + 0xc]
lea edx, [esp + 0x544]
mov byte [esp + 0xa84], 0x29
mov ecx, esi
push ebx
mov dword [esp + 0x3d4], ebx
call fcn.1001dc23
pop ecx
push ebx
push ecx
lea eax, [esp + 0x54c]
mov ecx, esi
push eax
call fcn.1001d839
pop ecx
lea edx, [esp + 0x594]
mov ecx, eax
call fcn.1001dc23
pop ecx
push ebx
push ecx
lea eax, [esp + 0x598]
push eax
push ecx
lea eax, [esp + 0x554]
mov ecx, esi
push eax
call fcn.1001d839
pop ecx
mov ecx, eax
call fcn.1001d839
pop ecx
lea edx, [esp + 0x658]
mov ecx, eax
call fcn.1001dc23
pop ecx
push ebx
push ecx
lea eax, [esp + 0x65c]
push eax
push ecx
lea eax, [esp + 0x5a0]
push eax
push ecx
lea eax, [esp + 0x55c]
mov ecx, esi
push eax
call fcn.1001d839
pop ecx
mov ecx, eax
call fcn.1001d839
pop ecx
mov ecx, eax
call fcn.1001d839
pop ecx
lea edx, [esp + 0x7b0]
mov ecx, eax
call fcn.1001dc23
mov eax, dword [esp + 0x3c]
pop ecx
push 0x12
lea ecx, [esp + 0x4b8]
mov edx, dword [eax]
call fcn.1009b734
pop ecx
lea eax, [esp + 0x7ac]
mov byte [esp + 0xa84], 0x2a
push eax
push ecx
lea eax, [esp + 0x65c]
push eax
push ecx
lea eax, [esp + 0x5a0]
push eax
push ecx
lea eax, [esp + 0x55c]
mov ecx, esi
push eax
call fcn.1001d839
pop ecx
mov ecx, eax
call fcn.1001d839
pop ecx
mov ecx, eax
call fcn.1001d839
pop ecx
mov ecx, eax
call fcn.1001d839
push 0x179b3
mov dword [esp + 0x48], eax
call fcn.10019cfd
movzx eax, ax
mov dword [esp + 0x30], eax
mov dword [esp], 0x6203
call fcn.10019cfd
mov esi, dword [esp + 0x4b8]
mov edi, dword [esp + 0x4bc]
movzx eax, ax
pop ecx
mov dword [esp + 0x3c], eax
jmp 0x10096b3c
cmp esi, edi
jne 0x100968df
mov dword [esp + 0x1b0], 0x75056a09
mov ecx, ebx
mov dword [esp + 0x1b4], 0x7a08730a
mov esi, ebx
mov dword [esp + 0x1b8], 0x70037c00
mov dword [esp + 0x1bc], 0x70018407
mov dword [esp + 0x1c0], 0x75047702
mov dword [esp + 0x1c4], 0xd8296209
mov dword [esp + 0x1c8], 0x5d39a6f1
mov dword [esp + 0x1cc], 0x67c0b85
mov byte [esp + 0x1d0], 0x86
cmp ecx, 0x14
jne 0x10096c09
push 9
pop esi
push 0x1b
pop ecx
jmp 0x10096c3b
movzx eax, byte [esp + ecx + 0x1b1]
lea edx, [esi - 1]
sub eax, ecx
add edx, eax
jns 0x10096c2c
or eax, 0xffffffff
sub eax, edx
add edx, 0x100
and eax, 0xffffff00
add edx, eax
movzx eax, byte [esp + ecx + 0x1b0]
mov byte [esp + eax + 0x534], dl
add ecx, 2
cmp ecx, 0x21
jb 0x10096bfc
lea eax, [esp + 0x534]
mov byte [esp + 0x540], bl
push eax
lea ecx, [esp + 0x944]
call fcn.1001c44c
push ebx
mov edx, eax
mov byte [esp + 0xa88], 0x32
mov ecx, edi
call fcn.1001dc23
pop ecx
push ebx
push 1
lea ecx, [esp + 0x948]
mov dword [esp + 0x34], eax
call fcn.100170c9
xor eax, eax
mov dword [esp + 0x170], 0x67066605
lea edi, [esp + 0x534]
mov dword [esp + 0x174], 0x68026703
stosd dword es:[edi], eax
mov ecx, ebx
mov dword [esp + 0x178], 0x77046e00
mov esi, ebx
mov dword [esp + 0x17c], 0xf3995e11
mov dword [esp + 0x180], 0x176015ba
stosd dword es:[edi], eax
mov dword [esp + 0x184], 0xe616c51b
mov dword [esp + 0x188], 0x8edaa81f
mov word [esp + 0x18c], 0x186
stosd dword es:[edi], eax
mov byte [esp + 0x18e], 0x7b
stosb byte es:[edi], al
cmp ecx, 0xc
jne 0x10096d01
push 0x11
pop esi
push 0x1b
pop ecx
jmp 0x10096d33
movzx eax, byte [esp + ecx + 0x171]
lea edx, [esi - 1]
sub eax, ecx
add edx, eax
jns 0x10096d24
or eax, 0xffffffff
sub eax, edx
add edx, 0x100
and eax, 0xffffff00
add edx, eax
movzx eax, byte [esp + ecx + 0x170]
mov byte [esp + eax + 0x3f0], dl
add ecx, 2
cmp ecx, 0x1f
jb 0x10096cf4
push ebx
lea ecx, [esp + 0x71c]
mov byte [esp + 0x3fb], bl
call fcn.1001ce14
lea eax, [esp + 0x3f0]
mov byte [esp + 0xa84], 0x33
push eax
lea ecx, [esp + 0x974]
call fcn.1001c44c
lea ecx, [esp + 0x718]
mov byte [esp + 0xa84], 0x34
push ecx
push ecx
mov ecx, dword [esp + 0x34]
push eax
call fcn.1001d839
pop ecx
mov ecx, eax
call fcn.1001cfb5
push ebx
push 1
lea ecx, [esp + 0x978]
call fcn.100170c9
lea ecx, [esp + 0x718]
mov byte [esp + 0xa84], 0x15
call fcn.1001cf38
mov dword [esp + 0x3f0], ebx
mov ecx, ebx
mov dword [esp + 0x3f4], ebx
mov esi, ebx
mov dword [esp + 0x2c0], 0x780e7503
mov dword [esp + 0x2c4], 0x68047301
mov dword [esp + 0x2c8], 0xbe5f2508
mov dword [esp + 0x2cc], 0x7c243eaa
mov dword [esp + 0x2d0], 0x720a7200
mov dword [esp + 0x2d4], 0x82086c07
mov dword [esp + 0x2d8], 0x7c097610
mov dword [esp + 0x2dc], 0x8a02890d
mov dword [esp + 0x2e0], 0x890b8505
mov dword [esp + 0x2e4], 0x910f7e0c
mov word [esp + 0x2e8], 0x8d06
cmp ecx, 8
jne 0x10096e47
push ecx
pop esi
push 0xe
pop ecx
jmp 0x10096e79
movzx eax, byte [esp + ecx + 0x2c1]
lea edx, [esi - 1]
sub eax, ecx
add edx, eax
jns 0x10096e6a
or eax, 0xffffffff
sub eax, edx
add edx, 0x100
and eax, 0xffffff00
add edx, eax
movzx eax, byte [esp + ecx + 0x2c0]
mov byte [esp + eax + 0x628], dl
add ecx, 2
cmp ecx, 0x2a
jb 0x10096e3b
lea eax, [esp + 0x628]
mov byte [esp + 0x639], bl
push eax
lea ecx, [esp + 0x9a4]
call fcn.1001c44c
mov byte [esp + 0xa84], 0x35
mov edx, eax
mov ecx, dword [esp + 0x20]
push ebx
call fcn.1001dc23
pop ecx
push ebx
push 1
lea ecx, [esp + 0x9a8]
mov dword [esp + 0x34], eax
mov byte [esp + 0xa8c], 0x15
call fcn.100170c9
xor eax, eax
mov dword [esp + 0x6c], 0x6c006501
lea edi, [esp + 0x628]
mov dword [esp + 0x70], 0x8d42de0b
stosd dword es:[edi], eax
mov ecx, ebx
mov dword [esp + 0x74], 0xd628d2f6
mov esi, ebx
mov dword [esp + 0x78], 0x260d467
mov byte [esp + 0x7c], 0x78
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
cmp ecx, 4
jne 0x10096f11
push 0xb
pop esi
push 0xd
pop ecx
jmp 0x10096f3d
movzx eax, byte [esp + ecx + 0x6d]
lea edx, [esi - 1]
sub eax, ecx
add edx, eax
jns 0x10096f31
or eax, 0xffffffff
sub eax, edx
add edx, 0x100
and eax, 0xffffff00
add edx, eax
movzx eax, byte [esp + ecx + 0x6c]
mov byte [esp + eax + 0x3cc], dl
add ecx, 2
cmp ecx, 0x11
jb 0x10096f04
lea eax, [esp + 0x3cc]
mov byte [esp + 0x3cf], bl
push eax
lea ecx, [esp + 0x9d4]
call fcn.1001c44c
mov byte [esp + 0xa84], 0x36
mov edi, dword [esp + 0x2c]
mov ecx, edi
push eax
call fcn.1001d99f
neg al
mov byte [esp + 0xa84], 0x15
push ebx
sbb al, al
lea ecx, [esp + 0x9d4]
inc al
push 1
mov byte [esp + 0x3f], al
call fcn.100170c9
cmp byte [esp + 0x37], 0
je 0x10097060
mov dword [esp + 0x58], 0xb0036a00
mov ecx, ebx
mov dword [esp + 0x5c], 0x176029e
mov esi, ebx
mov byte [esp + 0x60], 0x69
cmp ecx, 2
jne 0x10096fc5
push 3
pop esi
push esi
pop ecx
jmp 0x10096fee
movzx eax, byte [esp + ecx + 0x59]
lea edx, [esi - 1]
sub eax, ecx
add edx, eax
jns 0x10096fe5
or eax, 0xffffffff
sub eax, edx
add edx, 0x100
and eax, 0xffffff00
add edx, eax
movzx eax, byte [esp + ecx + 0x58]
mov byte [esp + eax + 0x44], dl
add ecx, 2
cmp ecx, 9
jb 0x10096fb9
push 6
lea ecx, [esp + 0x81c]
mov byte [esp + 0x4b], bl
call fcn.1001cd23
mov esi, eax
lea eax, [esp + 0x44]
mov byte [esp + 0xa84], 0x37
push eax
lea ecx, [esp + 0x86c]
call fcn.1001c44c
push esi
push ecx
push eax
mov ecx, edi
mov byte [esp + 0xa90], 0x38
call fcn.1001d839
pop ecx
mov ecx, eax
call fcn.1001cfb5
push ebx
push 1
lea ecx, [esp + 0x870]
call fcn.100170c9
lea ecx, [esp + 0x818]
mov byte [esp + 0xa84], 0x15
call fcn.1001cf38
mov dword [esp + 0x3cc], ebx
mov ecx, ebx
mov dword [esp + 0x98], 0x76026501
mov esi, ebx
mov dword [esp + 0x9c], 0x9dce0210
mov dword [esp + 0xa0], 0xbb11f6c7
mov dword [esp + 0xa4], 0x90b2ecfc
mov dword [esp + 0xa8], 0xd0e40399
mov word [esp + 0xac], 0x6e00
cmp ecx, 4
jne 0x100970b9
push 0x10
pop esi
push 0x12
pop ecx
jmp 0x100970eb
movzx eax, byte [esp + ecx + 0x99]
lea edx, [esi - 1]
sub eax, ecx
add edx, eax
jns 0x100970dc
or eax, 0xffffffff
sub eax, edx
add edx, 0x100
and eax, 0xffffff00
add edx, eax
movzx eax, byte [esp + ecx + 0x98]
mov byte [esp + eax + 0x3dc], dl
add ecx, 2
cmp ecx, 0x16
jb 0x100970ac
lea eax, [esp + 0x3dc]
mov byte [esp + 0x3df], bl
push eax
lea ecx, [esp + 0xa34]
call fcn.1001c44c
push eax
mov ecx, edi
mov byte [esp + 0xa88], 0x39
call fcn.1001d839
push ebx
push 1
lea ecx, [esp + 0xa38]
mov dword [esp + 0x4c], eax
mov byte [esp + 0xa8c], 0x15
call fcn.100170c9
push 6
lea ecx, [esp + 0x514]
mov dword [esp + 0x3e0], ebx
call fcn.1001cd23
push ebx
lea ecx, [esp + 0x73c]
mov byte [esp + 0xa88], 0x3a
call fcn.1001cd23
mov byte [esp + 0xa84], 0x3b
mov esi, ebx
mov ecx, dword [esp + 0x44]
mov byte [esp + 0x27], 1
call fcn.1001d474
mov dword [esp + 0x2c], eax
test eax, eax
jle 0x10097262
cmp byte [esp + 0x27], 0
je 0x10097351
mov ecx, dword [esp + 0x44]
lea eax, [esp + 0x738]
push eax
push esi
lea eax, [esp + 0x508]
push eax
call fcn.1001d7a7
lea ecx, [esp + 0x500]
mov byte [esp + 0xa84], 0x3c
call fcn.1001daa5
test al, al
je 0x10097238
mov eax, ecx
lea ecx, [esp + 0x510]
push eax
call fcn.1001d86b
lea eax, [esp + 0x77c]
push eax
lea ecx, [esp + 0x504]
call fcn.1001d107
mov byte [esp + 0xa84], 0x3d
lea eax, [esp + 0x400]
cmp dword [esp + 0x414], 0x10
lea ecx, [esp + 0x77c]
push dword [esp + 0x410]
cmovae eax, dword [esp + 0x404]
push eax
push dword [esp + 0x794]
push ebx
call fcn.1003612a
test eax, eax
lea ecx, [esp + 0x77c]
push ebx
push 1
setne byte [esp + 0x2f]
call fcn.100170c9
lea ecx, [esp + 0x500]
mov byte [esp + 0xa84], 0x3b
call fcn.1001cf38
inc esi
cmp esi, dword [esp + 0x2c]
jl 0x10097187
cmp byte [esp + 0x27], 0
je 0x10097351
lea eax, [esp + 0x400]
push eax
lea ecx, [esp + 0x69c]
call fcn.1001cdd8
lea eax, [esp + 0x698]
mov byte [esp + 0xa84], 0x3e
push eax
lea ecx, [esp + 0x514]
call fcn.1001d86b
mov dword [esp + 0x4c], 0x2016a00
mov ecx, ebx
mov word [esp + 0x50], 0x176
mov esi, ebx
mov byte [esp + 0x52], 0x69
cmp ecx, 2
jne 0x100972b7
xor esi, esi
xor ecx, ecx
inc esi
inc ecx
jmp 0x100972e3
movzx eax, byte [esp + ecx + 0x4d]
lea edx, [esi - 1]
sub eax, ecx
add edx, eax
jns 0x100972d7
or eax, 0xffffffff
sub eax, edx
add edx, 0x100
and eax, 0xffffff00
add edx, eax
movzx eax, byte [esp + ecx + 0x4c]
mov byte [esp + eax + 0x3c8], dl
add ecx, 2
cmp ecx, 7
jb 0x100972aa
lea eax, [esp + 0x3c8]
mov byte [esp + 0x3cb], bl
push eax
lea ecx, [esp + 0xa64]
call fcn.1001c44c
lea ecx, [esp + 0x510]
mov byte [esp + 0xa84], 0x3f
push ecx
push ecx
push eax
mov ecx, edi
call fcn.1001d839
pop ecx
mov ecx, eax
call fcn.1001cfb5
push ebx
push 1
lea ecx, [esp + 0xa68]
call fcn.100170c9
lea ecx, [esp + 0x698]
mov dword [esp + 0x3c8], ebx
mov byte [esp + 0xa84], 0x3b
call fcn.1001cf38
lea ecx, [esp + 0x738]
mov byte [esp + 0xa84], 0x3a
call fcn.1001cf38
lea ecx, [esp + 0x510]
mov byte [esp + 0xa84], 0x15
call fcn.1001cf38
mov dword [esp + 0x1d4], 0x760a6a05
mov ecx, ebx
mov dword [esp + 0x1d8], 0x68036909
mov esi, ebx
mov dword [esp + 0x1dc], 0x81027504
mov dword [esp + 0x1e0], 0x81d03b0c
mov dword [esp + 0x1e4], 0x1c2eb98e
mov dword [esp + 0x1e8], 0x90d9b4db
mov dword [esp + 0x1ec], 0x7d017600
mov dword [esp + 0x1f0], 0x7c087506
mov word [esp + 0x1f4], 0x7407
cmp ecx, 0xc
jne 0x100973eb
push ecx
pop esi
push 0x16
pop ecx
jmp 0x1009741d
movzx eax, byte [esp + ecx + 0x1d5]
lea edx, [esi - 1]
sub eax, ecx
add edx, eax
jns 0x1009740e
or eax, 0xffffffff
sub eax, edx
add edx, 0x100
and eax, 0xffffff00
add edx, eax
movzx eax, byte [esp + ecx + 0x1d4]
mov byte [esp + eax + 0x5fc], dl
add ecx, 2
cmp ecx, 0x22
jb 0x100973df
lea eax, [esp + 0x5fc]
mov byte [esp + 0x607], bl
push eax
lea ecx, [esp + 0x89c]
call fcn.1001c44c
push eax
mov ecx, edi
mov byte [esp + 0xa88], 0x40
call fcn.1001d839
lea edx, [esp + 0x400]
mov ecx, eax
call fcn.1001dcc3
lea ecx, [esp + 0x898]
push ebx
push 1
mov byte [esp + 0xa8c], 0x15
call fcn.100170c9
mov eax, dword [esp + 0x38]
cmp dword [eax], 1
jne 0x1009748a
mov edx, dword [ebp + 0xc]
mov ecx, dword [esp + 0x40]
call fcn.1009c27e
push ebx
push 1
lea ecx, [esp + 0x5b0]
mov byte [esp + 0x2f], 1
call fcn.100170c9
lea ecx, [esp + 0x708]
mov byte [esp + 0xa84], 0xc
call fcn.1001cf38
push ebx
push 1
lea ecx, [esp + 0x674]
call fcn.100170c9
push ebx
push 1
lea ecx, [esp + 0x76c]
call fcn.100170c9
push ebx
push 1
lea ecx, [esp + 0x754]
call fcn.100170c9
push ebx
push 1
lea ecx, [esp + 0x564]
call fcn.100170c9
push ebx
push 1
lea ecx, [esp + 0x840]
call fcn.100170c9
push ebx
push 1
lea ecx, [esp + 0x408]
call fcn.100170c9
mov ecx, dword [esp + 0xa7c]
mov al, byte [esp + 0x27]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc