Function at 0x10019079
Capabilities:
Create process on windows
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1007b6df
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x230
push ebx
push esi
mov dword [esp + 0x64], edx
xor ebx, ebx
push edi
mov dword [esp + 0x2c], 9
mov dword [esp + 0x28], ebx
push 4
mov dword [esp + 0x2c], 0xfffffffe
pop edi
mov dword [esp + 0x34], ecx
lea ecx, [esp + 0x140]
mov dword [esp + 0x24], 0x3b372ba2
mov dword [esp + 0x24], 0x2bdb979c
mov dword [esp + 0x1c], 0xd0e75d
push edi
call fcn.100172b6
xor edx, edx
mov dword [esp + 0x18], ebx
inc edx
jmp 0x100190f8
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x60], ebx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edx
jl 0x100190ec
mov dword [esp + 0x18], ebx
jmp 0x10019116
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x140]
mov dword [eax + ecx*4], edx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x10019104
mov eax, dword [esp + 0x2c]
xor ecx, ecx
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
mov esi, dword [esp + 0x140]
neg eax
dec dword [esi + 0xc]
cmp eax, 0x6aac8953
setl cl
xor eax, eax
cmp dword [esi + 0xc], 0xffffffff
setge al
xor edx, edx
cmp eax, ecx
mov eax, dword [esp + 0x1c]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x60]
setg cl
xor edx, edx
cmp ecx, eax
setle dl
xor eax, eax
cmp edx, 0xda2a
setge al
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x60]
mov eax, dword [esp + 0x1c]
xor eax, eax
cmp dword [esi + 0xc], 9
setge al
add eax, 0xfffb
mov dword [esp + 0x60], eax
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], bl
je 0x100191a2
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea ecx, [esp + 0x140]
call fcn.10017ad3
xor eax, eax
mov dword [esp + 0x20], ebx
inc eax
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x24], eax
lea ecx, [esp + 0x1c0]
mov dword [esp + 0x10], 0x55261fc4
push edi
call fcn.100172b6
push 2
mov dword [esp + 0x1c], ebx
pop esi
jmp 0x100191eb
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x6c], 0x3342eb9
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jl 0x100191db
mov dword [esp + 0x18], ebx
jmp 0x1001920d
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c0]
mov dword [eax + ecx*4], 0x23637b30
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x100191f7
xor edx, edx
inc edx
mov dword [esp + 0x20], edx
push 5
pop edi
cmp dword [esp + 0x20], ebx
jl 0x1001935f
mov dword [esp + 0x14], 0x9aed23b6
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], 0x7c295a52
mov dword [esp + 0x14], ebx
jmp 0x1001934b
mov dword [esp + 0x18], edi
xor ecx, ecx
mov eax, dword [esp + 0x14]
mov eax, dword [esp + eax*4 + 0x6c]
cmp eax, 0x8cccddd
mov eax, dword [esp + 0x20]
setge cl
cmp ecx, dword [esp + eax*4 + 0x6c]
jg 0x1001930d
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], 0xbbd0
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
sub edx, edi
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [esp + 0x30]
setle cl
xor edx, edx
cmp ecx, eax
setg dl
xor ecx, ecx
imul edx, dword [esp + 0x24]
mov eax, dword [esp + 0x70]
cmp eax, edx
mov edx, dword [esp + 0x14]
setg cl
add edx, ecx
xor ecx, ecx
imul edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
cmp eax, edx
setg cl
xor edx, edx
mov dword [esp + 0x10], ecx
inc edx
mov dword [esp + 0x30], ebx
jmp 0x10019305
mov dword [esp + 0x10], ebx
jmp 0x100192f3
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], bl
je 0x100192ef
push ebx
push ebx
push ebx
push ebx
push 0x1fbd
push edx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
xor edx, edx
inc edx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jle 0x100192ce
mov eax, dword [esp + 0x30]
mov eax, dword [esp + eax*4 + 0x6c]
inc dword [esp + 0x30]
cmp dword [esp + 0x30], edx
jle 0x100192c8
jmp 0x10019347
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x14]
add ecx, 0x28ea
mov dword [esp + eax*4 + 0x6c], ecx
je 0x10019329
mov eax, edx
cmp dword [esp + 0x28], ebx
jne 0x1001932b
mov eax, ebx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x18], ebx
jmp 0x10019341
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x6c], edx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jl 0x10019335
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jle 0x10019244
dec dword [esp + 0x20]
jns 0x10019227
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], bl
je 0x10019378
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
lea ecx, [esp + 0x1c0]
call fcn.10017ad3
xor eax, eax
lea ecx, [esp + 0x94]
inc eax
push eax
call fcn.100172b6
xor edx, edx
inc edx
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], 0x2ba167c2
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x30], 0xfffffff8
push 3
mov dword [esp + 0x30], 0xf6a1c3d0
mov dword [esp + 0x14], ebx
pop esi
jmp 0x100193d6
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x94]
mov dword [eax + ecx*4], esi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x100193c4
mov dword [esp + 0x18], ebx
push 8
pop edi
cmp dword [esp + 0x18], ebx
jl 0x10019509
mov dword [esp + 0x1c], 0x7006986d
mov dword [esp + 0x10], edi
mov eax, dword [esp + 0x18]
mov dword [esp + 0x1c], ebx
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x24]
cmp eax, edi
mov ecx, dword [esp + 0x94]
push 0
pop eax
setne al
imul eax, dword [ecx + edx*4]
neg eax
sbb eax, eax
neg eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x94]
mov ecx, dword [eax + ecx*4]
sub ecx, dword [eax + edx*4]
je 0x1001945c
cmp dword [esp + 0x30], ebx
je 0x1001945c
xor eax, eax
inc eax
jmp 0x1001945e
mov eax, ebx
mov dword [esp + 0x10], eax
xor edx, edx
mov esi, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x30]
cmp ecx, eax
mov eax, dword [esp + 0x94]
setge dl
sub edx, dword [eax + esi*4]
sub edx, dword [eax]
je 0x100194b1
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x94]
cmp dword [eax + ecx*4], ebx
je 0x100194b1
mov dword [esp + 0x28], 0xed09
mov dword [esp + 0x14], ebx
jmp 0x100194a9
dec dword [esp + 0x2c]
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ebx
jle 0x100194a1
jmp 0x100194e5
mov dword [esp + 0x20], ebx
xor ecx, ecx
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
cmp eax, 0xfffffffc
setne cl
xor eax, eax
cmp ecx, 0xfffffffe
setge al
mov dword [esp + 0x10], eax
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], bl
je 0x100194fc
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
dec dword [esp + 0x18]
jns 0x100193ed
push 3
pop esi
mov edi, dword [sym.imp.KERNEL32.dll_GetFileType]
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], bl
je 0x1001951c
push ebx
call edi
lea ecx, [esp + 0x94]
call fcn.10017ad3
mov dword [esp + 0x2c], 8
xor ecx, ecx
mov dword [esp + 0x14], esi
inc ecx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x24], 0x1a93
mov dword [esp + 0x28], 0xfc35327
mov dword [esp + 0x28], 0xb5cb1beb
mov dword [esp + 0x28], ecx
mov dword [esp + 0x28], 0x5227
mov dword [esp + 0x28], 6
mov dword [esp + 0x10], ebx
jmp 0x10019579
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x78], ecx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ecx
jl 0x1001956d
mov eax, dword [esp + 0x14]
xor edx, edx
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
cmp ecx, eax
setl dl
xor ecx, ecx
imul edx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
cmp eax, edx
mov eax, dword [esp + 0x14]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x14]
setg dl
xor ecx, ecx
cmp edx, eax
setle cl
cmp dword [esp + 0x14], ecx
jl 0x10019637
mov dword [esp + 0x10], 0x2f63069b
xor edx, edx
mov dword [esp + 0x28], 0xcd021aa2
inc edx
mov dword [esp + 0x10], ebx
jmp 0x100195eb
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x7c], 0x335c22c9
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x100195db
dec dword [esp + 0x24]
xor ecx, ecx
mov eax, dword [esp + 0x24]
cmp eax, 0x1d981
setne cl
xor eax, eax
cmp ecx, 0x4dbf0cf
setle al
cmp eax, edx
sbb eax, eax
neg eax
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x7c]
mov eax, dword [esp + 0x1c]
neg eax
sbb eax, eax
neg eax
mov dword [esp + 0x7c], eax
mov dword [esp + 0x28], eax
jmp 0x10019716
mov dword [esp + 0x28], ebx
lea ecx, [esp + 0x18c]
mov dword [esp + 0x28], 8
mov dword [esp + 0x28], 0xfffffffb
push 2
call fcn.100172b6
mov dword [esp + 0x244], ebx
lea ecx, [esp + 0x1a4]
mov dword [esp + 0x28], 0xc2f00273
mov dword [esp + 0x28], 0xd777
mov dword [esp + 0x28], 0x5a46e494
push 4
call fcn.100172b6
xor eax, eax
inc eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x18], ebx
jmp 0x100196a9
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x18c]
mov dword [eax + ecx*4], 0xfffffff6
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jl 0x10019693
mov dword [esp + 0x18], ebx
jmp 0x100196cc
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1a4]
mov dword [eax + ecx*4], 0x827cf573
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 4
jl 0x100196b6
inc dword [esp + 0x24]
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x100196f3
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push ebx
push ebx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
lea ecx, [esp + 0x1a4]
call fcn.10017ad3
or dword [esp + 0x244], 0xffffffff
lea ecx, [esp + 0x18c]
call fcn.10017ad3
xor edx, edx
inc edx
mov dword [esp + 0x28], ebx
xor ecx, ecx
mov dword [esp + 0x30], 9
mov dword [esp + 0x18], 0x57b5bf2d
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x20], 0xfe21dabe
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x18]
imul eax, dword [esp + 0x30]
cmp eax, edx
setg cl
mov dword [esp + 0x14], ecx
cmp dword [esp + 0x14], ebx
jne 0x10019764
cmp dword [esp + 0x18], ebx
jne 0x10019764
mov edx, ebx
mov eax, dword [esp + 0x30]
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, 0x1b6e
setl al
add eax, 6
jne 0x10019783
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x30]
xor edx, edx
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
sub ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x30]
cmp ecx, eax
setne dl
sub edx, 0x75ff4442
je 0x100197b7
cmp dword [esp + 0x18], ebx
je 0x100197b7
xor eax, eax
lea ecx, [eax + 1]
jmp 0x100197b9
mov ecx, ebx
mov eax, dword [esp + 0x18]
add eax, ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x10], 0x18
jmp 0x100198e0
mov dword [esp + 0x28], 0xf2c0e848
lea ecx, [esp + 0x16c]
call fcn.100172b6
xor edx, edx
mov dword [esp + 0x1c], 0xe98c5348
mov dword [esp + 0x20], ebx
inc edx
jmp 0x10019808
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0xa8], 0xfdfd
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edx
jl 0x100197f5
mov dword [esp + 0x20], ebx
jmp 0x1001982a
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x168]
mov dword [eax + ecx*4], 6
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 4
jl 0x10019814
mov dword [esp + 0x20], ebx
jmp 0x1001984a
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0xac], 0xfb6c7178
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edx
jl 0x10019837
mov eax, dword [esp + 0x30]
mov eax, 0x694
mov dword [esp + 0xa8], eax
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x14], ebx
mov eax, dword [esp + 0xac]
mov ecx, dword [esp + 0x14]
sub ecx, eax
mov dword [esp + 0x20], ecx
mov dword [esp + 0x20], ebx
cmp dword [esp + 0x20], ebx
jl 0x100198d0
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x100198ca
push ebx
push ebx
push 0x1ec2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollInfo]
dec dword [esp + 0x20]
jns 0x100198ab
lea ecx, [esp + 0x168]
call fcn.10017ad3
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xffffffe3
push 4
jge 0x100197d0
mov dword [esp + 0x28], 0x470ed99e
lea ecx, [esp + 0x138]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x34], 0x22a1
call fcn.100172b6
xor ecx, ecx
inc ecx
mov dword [esp + 0x244], ecx
mov dword [esp + 0x24], 0xbfedaacd
mov dword [esp + 0x20], 0xda115252
mov dword [esp + 0x24], 4
mov dword [esp + 0x1c], 0xdf8e3bf1
mov dword [esp + 0x10], ebx
jmp 0x10019949
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x38], ecx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ecx
jl 0x1001993d
mov dword [esp + 0x20], ebx
cmp dword [esp + 0x20], ebx
jg 0x100199ce
xor edi, edi
inc edi
mov eax, dword [esp + 0x20]
cmp dword [esp + eax*4 + 0x38], ebx
jne 0x100199ae
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov eax, dword [esp + eax*4 + 0x38]
cmp eax, 0x1139da47
mov eax, dword [esp + 0x20]
setge cl
xor edx, edx
add ecx, dword [esp + eax*4 + 0x38]
mov eax, dword [esp + 0x38]
cmp ecx, edi
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [esp + 0x24], ecx
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + eax*4 + 0x38]
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + eax*4 + 0x38]
mov eax, dword [esp + 0x20]
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x1c], eax
inc dword [esp + 0x20]
cmp dword [esp + 0x20], ebx
jle 0x1001995c
mov edi, dword [sym.imp.KERNEL32.dll_GetFileType]
xor ecx, ecx
inc ecx
mov dword [esp + 0x20], ebx
jmp 0x10019a81
mov dword [esp + 0x10], ecx
xor ecx, ecx
mov dword [esp + 0x1c], 0x84edb553
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
cmp eax, 0xfffffffe
mov eax, dword [esp + 0x10]
setl cl
or edx, 0xffffffff
sub edx, ecx
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x24]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x1c]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x38]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x38]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x38]
setne cl
mov dword [esp + 0x1c], ecx
xor ecx, ecx
cmp dword [esp + 0x1c], eax
sete cl
mov dword [esp + 0x10], ecx
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10019a7a
push ebx
push ebx
push 0x2706
push 0x59e
push ebx
call dword [sym.imp.USER32.dll_InsertMenuA]
inc dword [esp + 0x20]
push 1
pop ecx
cmp dword [esp + 0x20], 0x15
jle 0x100199d7
mov dword [esp + 0x24], 0x51938d10
lea ecx, [esp + 0xb0]
mov dword [esp + 0x24], ebx
push 4
call fcn.100172b6
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x10], ebx
jmp 0x10019ac6
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xb0]
mov dword [eax + ecx*4], esi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x10019ab4
mov dword [esp + 0x14], ebx
jmp 0x10019bdd
mov dword [esp + 0x24], 0xffffffff
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xb0]
cmp dword [eax + ecx*4], ebx
je 0x10019b4b
mov dword [esp + 0x10], 0x7a888ada
mov dword [esp + 0x10], esi
cmp dword [esp + 0x10], ebx
jl 0x10019bd9
mov dword [esp + 0x1c], 5
mov dword [esp + 0x1c], esi
cmp dword [esp + 0x1c], ebx
jl 0x10019b40
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10019b3a
push 0x12df
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetROP2]
dec dword [esp + 0x1c]
jns 0x10019b16
dec dword [esp + 0x10]
jns 0x10019b04
jmp 0x10019bd9
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x10], 2
jge 0x10019b6f
xor ecx, ecx
inc ecx
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x80], ecx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x10019b59
mov dword [esp + 0x80], esi
cmp dword [esp + 0x80], ebx
jl 0x10019bbb
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10019bb2
push 0x11d5
push 0xc56
push 0x10eb
push 0x234b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_IntersectClipRect]
dec dword [esp + 0x80]
jns 0x10019b7f
mov esi, dword [esp + 0x14]
xor ecx, ecx
mov edx, dword [esp + 0xb0]
mov eax, dword [esp + 0x14]
push 3
cmp dword [edx + esi*4], eax
pop esi
setl cl
mov dword [esp + 0x24], ecx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jle 0x10019ad6
lea ecx, [esp + 0xb0]
call fcn.10017ad3
mov eax, 0x95b676b
mov dword [esp + 0x158], eax
mov dword [esp + 0x15c], eax
mov dword [esp + 0x160], eax
mov dword [esp + 0x164], eax
mov dword [esp + 0x10], 0x25b9b55b
mov dword [esp + 0x24], 0x9351f200
mov dword [esp + 0x10], ebx
jmp 0x10019c48
mov dword [esp + 0x24], 0xbe18
dec dword [esp + 0x24]
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10019c44
push ebx
call edi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 8
jl 0x10019c2a
xor ecx, ecx
mov dword [esp + 0x40], ebx
inc ecx
jmp 0x10019c68
mov eax, dword [esp + 0x40]
mov dword [esp + eax*4 + 0x48], 0x815c
inc dword [esp + 0x40]
cmp dword [esp + 0x40], ecx
jl 0x10019c58
mov dword [esp + 0x1c], 0x5ccc90a3
mov dword [esp + 0x24], 6
mov dword [esp + 0x24], esi
mov dword [esp + 0x14], 0xad67a4be
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x11c]
mov dword [esp + 0x10], ebx
push 4
call fcn.100172b6
mov dword [esp + 0x10], 0xc12a7b09
mov dword [esp + 0x18], ebx
jmp 0x10019cc4
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x11c]
mov dword [eax + ecx*4], 0xfffffffc
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 4
jl 0x10019cae
mov dword [esp + 0x18], ebx
jmp 0x10019ce4
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0xbc], 0xacff
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jl 0x10019cd1
cmp dword [esp + 0x24], ebx
je 0x10019cf4
mov eax, dword [esp + 0x1c]
cmp dword [esp + 0x10], ebx
jne 0x10019d07
cmp dword [esp + 0x14], ebx
jne 0x10019d07
xor esi, esi
mov edx, ebx
inc esi
jmp 0x10019d0c
xor esi, esi
inc esi
mov edx, esi
mov eax, dword [esp + 0x24]
xor ecx, ecx
cmp eax, edx
mov eax, dword [esp + 0xc0]
setge cl
dec dword [esp + 0xc0]
cmp eax, ecx
jg 0x10019d30
mov eax, dword [esp + 0xc0]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x11c]
neg ecx
sbb ecx, ecx
inc ecx
neg ecx
mov dword [eax + 0xc], ecx
lea ecx, [esp + 0x11c]
call fcn.10017ad3
lea eax, [esp + 0x134]
push eax
lea eax, [esp + 0x44]
push eax
push ebx
call fcn.1001d125
mov dword [esp + 0x28], 0x2fe22364
add esp, 0xc
mov dword [esp + 0x10], ebx
jmp 0x10019d88
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x208], 0xb55b
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x10019d75
push 2
pop edi
mov dword [esp + 0x1c], edi
cmp dword [esp + 0x1c], ebx
jl 0x10019e09
mov dword [esp + 0x10], edi
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10019ddd
push 0xb79
push 0x25bc
push 0x174e
push 0xc5b
push 0x1501
push 0x1e25
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RoundRect]
mov dword [esp + 0x10], ebx
jmp 0x10019dfd
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10019df9
push 0xc17
call dword [sym.imp.GDI32.dll_GetStockObject]
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jle 0x10019de3
dec dword [esp + 0x1c]
jns 0x10019d9c
mov eax, dword [esp + 0x48]
xor edx, edx
mov eax, dword [esp + 0x48]
imul eax, dword [esp + 0x28]
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x48]
mov eax, dword [esp + 0x24]
cmp eax, ecx
setl dl
mov dword [esp + 0x1c], edx
cmp dword [esp + 0x1c], ebx
jne 0x10019e3b
mov eax, ebx
cmp dword [esp + 0x24], ebx
je 0x10019e3d
mov eax, esi
add eax, 0xfffffffb
je 0x10019e46
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x2c]
sub eax, 0xca9d
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x48]
mov eax, dword [esp + 0x48]
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x134]
mov dword [eax + 0xc], edx
mov eax, dword [esp + 0x30]
cmp edx, eax
setl cl
mov dword [esp + 0x24], ecx
mov eax, dword [esp + 0x24]
sub eax, dword [esp + 0x28]
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
cmp eax, 0xffffffff
setge cl
cmp ecx, 0xfffffff9
lea ecx, [esp + 0x134]
sbb eax, eax
inc eax
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x160], eax
or dword [esp + 0x244], 0xffffffff
call fcn.10017ad3
push 3
lea ecx, [esp + 0xcc]
call fcn.100172b6
mov dword [esp + 0x28], 0xd37ad435
mov dword [esp + 0x18], ebx
jmp 0x10019efa
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x214], 0x7117
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jl 0x10019ee7
mov dword [esp + 0x18], ebx
jmp 0x10019f1d
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0xc8]
mov dword [eax + ecx*4], 8
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jl 0x10019f07
mov eax, dword [esp + 0xc8]
push 2
pop esi
mov dword [eax], esi
mov dword [esp + 0x28], 0xffff
dec dword [esp + 0x28]
mov eax, dword [esp + 0xc8]
dec dword [eax]
jns 0x10019f30
lea ecx, [esp + 0xc8]
call fcn.10017ad3
mov edi, dword [esp + 0x34]
cmp dword [edi + 0x10], ebx
jne 0x10019f63
xor al, al
jmp 0x1001aae7
mov dword [esp + 0x10], 0x48bbca63
xor ecx, ecx
mov dword [esp + 0x28], 0xfffffff8
inc ecx
mov dword [esp + 0x28], 0x624cdb8f
mov dword [esp + 0x28], ecx
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x28], 7
mov dword [esp + 0x10], ebx
jmp 0x10019fa7
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x1f8], ecx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x10019f98
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x10], esi
jg 0x1001a033
mov dword [esp + 0x28], 0x45559507
lea ecx, [esp + 0x104]
push esi
call fcn.100172b6
mov dword [esp + 0xf4], ebx
mov dword [esp + 0xf8], ebx
mov dword [esp + 0xfc], ebx
mov dword [esp + 0x100], ebx
mov dword [esp + 0x14], ebx
jmp 0x1001a000
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x104]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x10019fee
lea ecx, [esp + 0x104]
cmp dword [esp + 0x10], ebx
jne 0x1001a02b
inc dword [esp + 0x100]
call fcn.10017ad3
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jle 0x10019fb7
jmp 0x1001a030
call fcn.10017ad3
xor ecx, ecx
inc ecx
mov dword [esp + 0x20], 0xf3c34eea
mov dword [esp + 0x14], 0xdee21afa
mov dword [esp + 0x18], 0xaa5d732a
mov dword [esp + 0x30], 8
mov eax, dword [esp + 0x20]
sub eax, dword [esp + 0x20]
sub eax, dword [esp + 0x20]
cmp ecx, eax
sbb eax, eax
inc eax
sub eax, dword [esp + 0x20]
je 0x1001a072
mov eax, ecx
cmp dword [esp + 0x20], ebx
jne 0x1001a074
mov eax, ebx
mov ecx, 0xf1a969ac
cmp ecx, eax
mov eax, dword [esp + 0x20]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x20]
setg dl
xor ecx, ecx
cmp edx, eax
setle cl
cmp dword [esp + 0x14], ecx
jl 0x1001a0b0
cmp dword [esp + 0x20], ebx
jne 0x1001a0b0
xor edx, edx
mov ecx, ebx
inc edx
jmp 0x1001a0b5
xor edx, edx
inc edx
mov ecx, edx
xor eax, eax
cmp ecx, 0x4237
setne al
cmp dword [esp + 0x20], eax
jg 0x1001a0ca
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x30], eax
mov dword [esp + 0x14], 0xfffffff4
cmp dword [esp + 0x14], 4
jge 0x1001a2b2
mov dword [esp + 0x10], 0xabdc9a81
mov dword [esp + 0x18], ebx
jmp 0x1001a200
mov dword [esp + 0x24], 0xb398ef54
mov dword [esp + 0x2c], 0x8d0d
mov dword [esp + 0x30], ebx
jmp 0x1001a1ee
mov dword [esp + 0x28], edx
mov dword [esp + 0x1c], ebx
jmp 0x1001a13c
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x1ec], 0xb817bb5c
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 3
jl 0x1001a129
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x28]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
sub edx, eax
mov eax, dword [esp + 0x24]
cmp edx, eax
mov eax, dword [esp + 0x24]
setge cl
xor edx, edx
cmp eax, ecx
setge dl
xor ecx, ecx
imul edx, dword [esp + 0x10]
mov eax, dword [esp + 0x20]
cmp edx, 0xde63
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x10]
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [esp + 0x24], ecx
xor ecx, ecx
mov eax, dword [esp + 0x24]
cmp eax, 0xb34e
mov eax, dword [esp + 0x14]
setge cl
xor esi, esi
inc esi
cmp esi, eax
push esi
sbb eax, eax
inc eax
add ecx, eax
mov eax, dword [esp + 0x2c]
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [esp + 0x30]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x30]
setg cl
xor edx, edx
cmp ecx, 0xa3e0
setg dl
xor ecx, ecx
cmp edx, eax
pop edx
setge cl
mov dword [esp + 0x1ec], ecx
dec dword [esp + 0x30]
cmp dword [esp + 0x30], 0xfffffff8
jg 0x1001a11f
inc dword [esp + 0x18]
push 1
pop edx
cmp dword [esp + 0x18], 0xc
jle 0x1001a106
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x10], 0xffffffeb
jl 0x1001a29d
xor ecx, ecx
inc ecx
mov dword [esp + 0x1c], ebx
jmp 0x1001a236
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0xa4], 0xffffffff
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], ecx
jl 0x1001a223
mov dword [esp + 0x18], ebx
jmp 0x1001a271
mov dword [esp + 0x30], ebx
jmp 0x1001a267
mov dword [esp + 0x20], ebx
cmp dword [esp + 0x20], ebx
jl 0x1001a263
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0xa4], ecx
dec dword [esp + 0x20]
jns 0x1001a252
inc dword [esp + 0x30]
cmp dword [esp + 0x30], ebx
jle 0x1001a248
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ebx
jle 0x1001a242
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1001a292
push 0x2171
push ebx
call fcn.1001d53d
pop ecx
pop ecx
xor ecx, ecx
inc ecx
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xffffffeb
jge 0x1001a21d
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
push 1
pop edx
jl 0x1001a0f5
push 2
pop esi
lea eax, [esp + 0x68]
push eax
push ebx
call fcn.1001d4f5
mov dword [esp + 0x30], 0xfffffff6
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
pop ecx
pop ecx
je 0x1001a2d9
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1001a2f2
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MapDialogRect]
mov dword [esp + 0x28], 0x3c69aed2
lea ecx, [esp + 0x110]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x24], ebx
push esi
call fcn.100172b6
push 0xfffffffffffffffd
pop esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x2c], 0x68f6
mov dword [esp + 0x1c], ebx
jmp 0x1001a346
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x110]
mov dword [eax + ecx*4], 0xec7516a2
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jl 0x1001a330
mov eax, dword [esp + 0x2c]
inc dword [esp + 0x2c]
test eax, eax
jne 0x1001a36f
mov eax, dword [esp + 0x110]
mov dword [eax + 4], 0x637b
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x110]
mov eax, dword [esp + 0x28]
sub eax, 0xfffffff9
neg eax
sbb eax, eax
inc eax
imul eax, dword [esp + 0x24]
mov dword [esp + 0x2c], eax
call fcn.10017ad3
mov dword [esp + 0x74], 0xffffffff
xor eax, eax
inc eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x5c], esi
mov dword [esp + 0x28], 0xcc73
mov dword [esp + 0x2c], 0xdf115cd6
mov dword [esp + 0x2c], 0xa113d7af
mov dword [esp + 0x2c], 0xfffffffa
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x2c], 0x2a6a8e49
push 2
mov dword [esp + 0x30], ebx
mov dword [esp + 0x20], ebx
pop esi
jmp 0x1001a403
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x200], 0xfffffffb
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], esi
jl 0x1001a3f0
lea eax, [esp + 0x74]
push eax
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x60]
push eax
push 0x1112
lea eax, [esp + 0x6c]
push eax
push ebx
lea eax, [esp + 0x78]
push 0x140d
push eax
call fcn.1001cc35
add esp, 0x24
cmp dword [esp + 0x54], ebx
jne 0x1001a57a
push 0xfffffffffffffffc
pop eax
mov dword [esp + 0x24], eax
lea ecx, [esp + 0x198]
mov dword [esp + 0x2c], eax
push esi
call fcn.100172b6
mov dword [esp + 0x244], esi
mov dword [esp + 0x2c], 0xbda2dd44
mov dword [esp + 0x44], ebx
jmp 0x1001a484
mov eax, dword [esp + 0x44]
mov dword [esp + eax*4 + 0x1b0], 0xfffffffc
inc dword [esp + 0x44]
cmp dword [esp + 0x44], 4
jl 0x1001a471
push 0x4734
lea eax, [esp + 0x48]
push eax
lea eax, [esp + 0x1a0]
push eax
push ebx
call fcn.1001ce32
mov ecx, dword [esp + 0x64]
xor edx, edx
mov eax, dword [esp + 0x64]
add esp, 0x10
cmp ecx, eax
mov eax, dword [esp + 0x28]
setle dl
xor ecx, ecx
cmp edx, eax
setg cl
cmp ecx, dword [esp + 0x50]
jg 0x1001a4d3
cmp dword [esp + 0x50], ebx
jne 0x1001a4d3
xor esi, esi
mov ecx, ebx
inc esi
jmp 0x1001a4d8
xor esi, esi
inc esi
mov ecx, esi
mov eax, dword [esp + 0x1bc]
xor edx, edx
sub ecx, eax
mov eax, dword [esp + 0x4c]
cmp ecx, eax
mov eax, dword [esp + 0x58]
setle dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [esp + 0x5c], ecx
xor ecx, ecx
mov eax, dword [esp + 0x1bc]
mov eax, dword [esp + 0x5c]
mov eax, dword [esp + 0x4c]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x58]
mov eax, dword [esp + 0x1bc]
cmp eax, 0x5dbf6070
setne cl
imul eax, ecx, 0xda4a
mov ecx, dword [esp + 0x50]
sub ecx, eax
mov dword [esp + 0x24], ecx
mov ecx, esi
mov eax, dword [esp + 0x24]
add eax, dword [esp + 0x4c]
sub eax, 9
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x2c]
inc dword [esp + 0x2c]
cmp eax, 0x5bb7
mov eax, dword [esp + 0x24]
cmovle ecx, ebx
imul eax, ecx
lea ecx, [esp + 0x198]
mov dword [esp + 0x2c], eax
or dword [esp + 0x244], 0xffffffff
call fcn.10017ad3
jmp 0x1001a58a
mov dword [esp + 0x28], 0xd60280e4
mov eax, dword [esp + 0x28]
mov dword [esp + 0x74], eax
push 3
pop esi
push esi
lea ecx, [esp + 0x184]
call fcn.100172b6
push esi
lea ecx, [esp + 0x12c]
mov dword [esp + 0x248], esi
call fcn.100172b6
mov dword [esp + 0x14], ebx
jmp 0x1001a5ca
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x180]
mov dword [eax + ecx*4], 0xb9b55bb2
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x1001a5b4
mov dword [esp + 0x14], ebx
jmp 0x1001a5ec
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x128]
mov dword [eax + ecx*4], 0xe2236432
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x1001a5d6
mov esi, dword [esp + 0x128]
mov dword [esi + 8], 2
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x24], 2
cmp dword [esp + 0x24], ebx
jl 0x1001a63b
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1001a635
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetBkColor]
dec dword [esp + 0x24]
jns 0x1001a616
dec dword [esi + 8]
jns 0x1001a600
lea ecx, [esp + 0x128]
call fcn.10017ad3
or dword [esp + 0x244], 0xffffffff
lea ecx, [esp + 0x180]
call fcn.10017ad3
cmp dword [edi + 0x14], 0x10
jb 0x1001a66a
mov esi, dword [edi]
jmp 0x1001a66c
mov esi, edi
cmp dword [edi + 0x14], 0x10
jb 0x1001a676
mov ecx, dword [edi]
jmp 0x1001a678
mov ecx, edi
mov eax, dword [edi + 0x10]
add eax, ecx
cmp esi, eax
je 0x1001a76e
mov al, byte [esi]
cmp al, 0x30
jl 0x1001a756
cmp al, 0x39
jg 0x1001a756
push 3
pop edi
push edi
lea ecx, [esp + 0x150]
call fcn.100172b6
mov dword [esp + 0x244], 4
mov dword [esp + 0x28], 0xd37ad435
mov dword [esp + 0x14], ebx
jmp 0x1001a6d3
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x22c], 0x7117
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x1001a6c0
mov dword [esp + 0x14], ebx
jmp 0x1001a6f5
push 0x2370
lea eax, [esp + 0x6c]
push ebx
push eax
call fcn.1001cf96
add esp, 0xc
jmp 0x10019f5c
push dword [esp + 0x78]
lea eax, [esp + 0x1f0]
mov dword [esp + 0x8c], ebx
push eax
lea eax, [esp + 0x1e4]
mov dword [esp + 0x94], ebx
push eax
xorps xmm0, xmm0
mov dword [esp + 0x9c], ebx
push ebx
lea ecx, [esp + 0x98]
movdqu xmmword [esp + 0x1ec], xmm0
call fcn.100187bd
mov dword [esp + 0x14], 0x8094a188
mov dword [esp + 0x34], 0x51938d10
mov dword [esp + 0x1c], ebx
jmp 0x1001a7d9
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0xec], 6
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jl 0x1001a7c6
push 3
mov dword [esp + 0x18], ebx
pop edi
cmp dword [esp + 0x14], edi
jg 0x1001a86c
xor esi, esi
inc esi
mov dword [esp + 0x2c], 0xfffffff6
xor edx, edx
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x88]
cmp dword [eax + ecx*4], ebx
mov dword [esp + 0x2c], ebx
mov eax, dword [esp + 0x2c]
setne dl
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x88]
mov dword [esp + 0x34], edx
xor edx, edx
cmp dword [eax + ecx*4], esi
setge dl
xor ecx, ecx
add edx, 0x2bbd
cmp dword [esp + 0x34], 0xcef9
setg cl
xor eax, eax
cmp ecx, edx
setne al
mov dword [esp + 0xec], eax
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0xf0]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], ebx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jle 0x1001a7f0
lea ecx, [esp + 0x88]
call fcn.10017ad3
push 9
pop esi
mov dword [esp + 0x34], esi
lea ecx, [esp + 0xe0]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], 0xfffffffe
mov dword [esp + 0x28], 0x3b372ba2
mov dword [esp + 0x28], 0x2bdb979c
mov dword [esp + 0x2c], 0xd0e75d
push 4
call fcn.100172b6
xor ecx, ecx
mov dword [esp + 0x244], 5
mov dword [esp + 0x3c], ebx
inc ecx
jmp 0x1001a8d1
cmp dword [esp + 0x3c], ecx
jl 0x1001a8c5
mov ecx, dword [esp + 0x23c]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret