Function at 0x1001a85c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1008dc09
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x190
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0x34], edx
xor ecx, ecx
mov dword [esp + 0x28], edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x10], 0x33fd52a4
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x1c], ecx
cmp dword [esp + 0x1c], 0x15
push 1
pop ebx
jg 0x1001a9e2
mov edi, 0xffff
mov dword [esp + 0x14], ebx
mov dword [esp + 0x20], 0x3205f5a2
mov dword [esp + 0x30], edi
cmp dword [esp + 0x1c], ecx
jne 0x1001a8dd
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
xor edx, edx
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
cmp ecx, eax
mov eax, dword [esp + 0x14]
setne dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [esp + 0x20], ecx
xor ecx, ecx
cmp dword [esp + 0x20], ecx
jne 0x1001a913
cmp dword [esp + 0x14], ecx
jne 0x1001a913
mov eax, ecx
cmp eax, dword [esp + 0x1c]
jge 0x1001a928
cmp dword [esp + 0x20], ecx
jne 0x1001a9de
jmp 0x1001a9cb
mov dword [esp + 0x24], ecx
jmp 0x1001a941
mov eax, dword [esp + 0x24]
mov dword [esp + eax*4 + 0x90], 0x97d6a583
inc dword [esp + 0x24]
cmp dword [esp + 0x24], ebx
jl 0x1001a92e
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setg cl
xor edx, edx
cmp ecx, 0xffffffff
setne dl
xor ecx, ecx
sub edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
cmp edx, eax
mov eax, dword [esp + 0x1c]
setge cl
xor edx, edx
cmp eax, ecx
mov eax, dword [esp + 0x1c]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x14]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x10]
setg dl
xor ecx, ecx
cmp edx, eax
setg cl
imul ecx, dword [esp + 0x14]
add ecx, dword [esp + 0x20]
jne 0x1001a9b4
cmp dword [esp + 0x10], ecx
jne 0x1001a9b6
mov eax, ecx
jmp 0x1001a9b8
xor ecx, ecx
mov eax, ebx
cmp eax, 0xfff8
sbb eax, eax
inc eax
add eax, dword [esp + 0x20]
mov dword [esp + 0x90], eax
inc dword [esp + 0x30]
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0x15
jle 0x1001a8b7
mov edi, dword [esp + 0x28]
mov ebx, dword [sym.imp.USER32.dll_GetDC]
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [esp + 0x24], 7
mov dword [esp + 0x24], ecx
jmp 0x1001aa61
mov byte [esp + 0x1b], cl
cmp byte [esp + 0x1b], 0
je 0x1001aa11
push ecx
push ecx
call dword [sym.imp.GDI32.dll_GetRgnBox]
xor ecx, ecx
mov byte [esp + 0x1b], cl
cmp byte [esp + 0x1b], 0
je 0x1001aa5d
push 0x164a
push 0x1a93
push 0x1739
push 0xae1
push 0x1796
call esi
push eax
call ebx
push eax
push 0x1847
push 0x2625
push 0x254d
push 0x1d9f
call esi
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_StretchBlt]
xor ecx, ecx
dec dword [esp + 0x24]
cmp dword [esp + 0x24], 0xffffffe6
jl 0x1001a9fc
push 4
lea ecx, [esp + 0x6c]
call fcn.10018753
xor ebx, ebx
lea ecx, [esp + 0xd8]
mov dword [esp + 0x1a4], ebx
mov dword [esp + 0x1c], 0x37b1891f
push 1
call fcn.10018753
mov byte [esp + 0x1a4], 1
mov dword [esp + 0x20], 0x2c39d5b6
mov dword [esp + 0x30], 0xfffffff8
mov dword [esp + 0x24], ebx
jmp 0x1001aac6
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0xd8]
mov dword [eax + ecx*4], 0xb26bdde0
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 1
jl 0x1001aab0
mov eax, dword [esp + 0xd8]
mov dword [eax], 0xffffffe2
mov dword [esp + 0x20], 0xd
jmp 0x1001abad
mov dword [esp + 0x10], 0x7913da51
lea ecx, [esp + 0xa8]
push 1
call fcn.10018753
mov dword [esp + 0x14], 0x1ba05761
mov dword [esp + 0x28], 0x2ce4
mov dword [esp + 0x24], ebx
jmp 0x1001ab29
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0xa8]
mov dword [eax + ecx*4], 9
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 1
jl 0x1001ab13
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
cmp eax, 0xef6e
mov eax, dword [esp + 0xa8]
setl cl
xor edx, edx
cmp ecx, dword [eax]
setge dl
cmp edx, dword [esp + 0x14]
je 0x1001ab75
mov eax, dword [esp + 0xa8]
cmp dword [eax], ebx
jne 0x1001ab75
mov ecx, ebx
jmp 0x1001ab78
xor ecx, ecx
inc ecx
mov eax, dword [esp + 0xd8]
mov dword [eax], ecx
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0xa8]
add ecx, 0xea0d
imul ecx, dword [eax]
mov dword [esp + 0x28], ecx
lea ecx, [esp + 0xa8]
call fcn.100187d8
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 0x1d
jg 0x1001aae7
lea ecx, [esp + 0xd8]
mov byte [esp + 0x1a4], bl
call fcn.100187d8
push 3
lea ecx, [esp + 0x128]
call fcn.10018753
mov byte [esp + 0x1a4], 3
mov dword [esp + 0x2c], 0xfffffff6
mov dword [esp + 0x2c], 0xfffffffc
mov dword [esp + 0x9c], 0xffffffff
mov dword [esp + 0x2c], 0xd1d4
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x30], 0xdedfc3e8
mov dword [esp + 0x44], 0x9e56e623
mov dword [esp + 0x20], ebx
cmp dword [esp + 0x20], 0xffffffec
jge 0x1001ad48
push 0x1b
pop esi
mov dword [esp + 0x10], 7
mov dword [esp + 0x10], 9
jmp 0x1001ad2e
mov dword [esp + 0x14], 0xd3f46721
lea ecx, [esp + 0x104]
mov dword [esp + 0x28], 0x26d8d38
push 3
call fcn.10018753
mov dword [esp + 0x24], ebx
jmp 0x1001ac7d
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x104]
mov dword [eax + ecx*4], 0xfffffff9
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 3
jl 0x1001ac67
mov dword [esp + 0x14], esi
jmp 0x1001ad14
mov dword [esp + 0x28], 0xbb6b
mov dword [esp + 0x44], 0x7d19
mov dword [esp + 0x24], ebx
jmp 0x1001acb6
mov eax, dword [esp + 0x24]
mov dword [esp + eax*4 + 0x148], 0x3672d714
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 2
jl 0x1001aca3
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
neg eax
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x44]
mov eax, dword [esp + 0x28]
sub eax, dword [esp + 0x20]
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x148], eax
cmp eax, dword [esp + 0x14]
je 0x1001ad0a
mov eax, dword [esp + 0x104]
cmp dword [eax + 4], ebx
je 0x1001ad0a
xor eax, eax
inc eax
jmp 0x1001ad0c
mov eax, ebx
mov dword [esp + 0x44], eax
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x1001ac8d
lea ecx, [esp + 0x104]
call fcn.100187d8
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x17
jne 0x1001ac43
dec dword [esp + 0x20]
cmp dword [esp + 0x20], 0xffffffec
jl 0x1001ac2e
mov dword [esp + 0x2c], 0x847dfa86
mov dword [esp + 0x2c], 0x7bf0b96c
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x20], ebx
mov dword [esp + 0x2c], 0x5043c4ab
mov dword [esp + 0x4c], 0xedcad208
mov dword [esp + 0x44], 0xc9e53e58
mov dword [esp + 0x14], 0x21a3
mov dword [esp + 0x30], 0xd9935ff5
mov dword [esp + 0x2c], 0xd36fbc6a
mov dword [esp + 0x14], ebx
jmp 0x1001adad
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x150], 0xd2703d9b
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x1001ad9a
mov dword [esp + 0x14], ebx
jmp 0x1001adcd
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x158], 9
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x1001adba
dec dword [esp + 0x15c]
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
mov dword [esp + 0x20], ebx
jmp 0x1001aec6
mov dword [esp + 0x10], 0xb39e
mov dword [esp + 0x28], 0x2506ed55
mov dword [esp + 0x24], 6
mov dword [esp + 0x14], ebx
jmp 0x1001ae18
mov dword [esp + 0x28], 0x7fce
inc dword [esp + 0x28]
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jle 0x1001ae08
cmp dword [esp + 0x10], ebx
jne 0x1001ae42
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x154]
cmp dword [esp + 0x44], ebx
jne 0x1001ae42
mov eax, ebx
jmp 0x1001ae45
xor eax, eax
inc eax
mov dword [esp + 0x28], eax
xor ebx, ebx
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x4c]
cmp ecx, eax
setne bl
sub ebx, dword [esp + 0x2c]
mov eax, dword [esp + 0x10]
neg ebx
sbb ebx, ebx
xor edx, edx
inc ebx
cmp ebx, eax
setl dl
imul eax, dword [esp + 0x10], 0x3f29
xor ecx, ecx
cmp eax, edx
setl cl
xor ebx, ebx
mov dword [esp + 0x24], ecx
cmp dword [esp + 0x24], ebx
je 0x1001ae9f
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], bl
je 0x1001ae99
push 0x90a
push ebx
call esi
mov eax, dword [esp + 0x24]
jmp 0x1001aec2
mov dword [esp + 0x28], 4
mov dword [esp + 0x14], 0xfffffff8
jmp 0x1001aebb
cmp dword [esp + 0x28], ebx
jne 0x1001aec2
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0xfffffffd
jle 0x1001aeb1
inc dword [esp + 0x20]
cmp dword [esp + 0x20], ebx
jle 0x1001adea
lea eax, [esp + 0x68]
push eax
lea eax, [esp + 0x40]
push ebx
push eax
call fcn.1001c027
mov dword [esp + 0x1c], 0xf5540d7f
add esp, 0xc
mov dword [esp + 0x2c], 0xdce9d05b
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x10], ebx
jl 0x1001af21
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001af1b
push ebx
push ebx
push 0x17fd
push 0x7b3
push ebx
call dword [sym.imp.USER32.dll_InsertMenuA]
dec dword [esp + 0x10]
jns 0x1001aefd
mov dword [esp + 0x20], 0xfffffffd
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x10], ebx
jmp 0x1001af46
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x13c], 0x8948
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1001af33
mov dword [esp + 0x20], ebx
jmp 0x1001af76
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001af65
push ebx
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov eax, dword [esp + 0x20]
cmp dword [esp + eax*4 + 0x13c], ebx
jne 0x1001af7d
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 1
jle 0x1001af53
mov dword [esp + 0x20], 9
mov dword [esp + 0x3c], ebx
jmp 0x1001af9e
mov eax, dword [esp + 0x3c]
mov dword [esp + eax*4 + 0x84], 0x6ccb0362
inc dword [esp + 0x3c]
cmp dword [esp + 0x3c], 3
jl 0x1001af8b
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x128]
push ebx
push eax
call fcn.1001bf7a
mov dword [esp + 0x38], 0x847dfa86
add esp, 0xc
mov dword [esp + 0x2c], 0x7bf0b96c
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x20], ebx
mov dword [esp + 0x2c], 0x5043c4ab
mov dword [esp + 0x4c], 0xedcad208
mov dword [esp + 0x2c], 0xc9e53e58
mov dword [esp + 0x14], 0x21a3
mov dword [esp + 0x30], 0xd9935ff5
mov dword [esp + 0x44], 0xd36fbc6a
mov dword [esp + 0x14], ebx
jmp 0x1001b020
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x11c], 0xd2703d9b
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x1001b00d
mov dword [esp + 0x14], ebx
jmp 0x1001b040
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x178], 9
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x1001b02d
dec dword [esp + 0x17c]
mov dword [esp + 0x20], ebx
jmp 0x1001b133
mov dword [esp + 0x10], 0xb39e
mov dword [esp + 0x28], 0x2506ed55
mov dword [esp + 0x24], 6
mov dword [esp + 0x14], ebx
jmp 0x1001b085
mov dword [esp + 0x28], 0x7fce
inc dword [esp + 0x28]
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jle 0x1001b075
cmp dword [esp + 0x10], ebx
jne 0x1001b0af
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x120]
cmp dword [esp + 0x2c], ebx
jne 0x1001b0af
mov eax, ebx
jmp 0x1001b0b2
xor eax, eax
inc eax
mov dword [esp + 0x28], eax
xor ebx, ebx
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x4c]
cmp ecx, eax
setne bl
sub ebx, dword [esp + 0x44]
mov eax, dword [esp + 0x10]
neg ebx
sbb ebx, ebx
xor edx, edx
inc ebx
cmp ebx, eax
setl dl
imul eax, dword [esp + 0x10], 0x3f29
xor ecx, ecx
cmp eax, edx
setl cl
xor ebx, ebx
mov dword [esp + 0x24], ecx
cmp dword [esp + 0x24], ebx
je 0x1001b10c
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], bl
je 0x1001b106
push 0x90a
push ebx
call esi
mov eax, dword [esp + 0x24]
jmp 0x1001b12f
mov dword [esp + 0x28], 4
mov dword [esp + 0x14], 0xfffffff8
jmp 0x1001b128
cmp dword [esp + 0x28], ebx
jne 0x1001b12f
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0xfffffffd
jle 0x1001b11e
inc dword [esp + 0x20]
cmp dword [esp + 0x20], ebx
jle 0x1001b057
mov eax, dword [esp + 0x68]
mov dword [eax + 8], ebx
jmp 0x1001b2e0
push 2
lea ecx, [esp + 0xb8]
call fcn.10018753
mov byte [esp + 0x1a4], 4
mov dword [esp + 0x28], 0xa1a8
mov dword [esp + 0x30], 5
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x10], ebx
jmp 0x1001b193
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xb4]
mov dword [eax + ecx*4], 0xd225
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1001b17d
mov esi, dword [esp + 0xb4]
dec dword [esi + 4]
cmp dword [esi], ebx
je 0x1001b1b7
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x8c]
mov ecx, dword [esp + 0x88]
mov eax, dword [esp + 0x8c]
add eax, ecx
mov dword [esp + 0x88], eax
jne 0x1001b1d4
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x1c]
xor edx, edx
mov ecx, dword [esi + 4]
shl eax, 2
cmp eax, ecx
push 6
setg dl
sub edx, ecx
neg edx
sbb edx, edx
inc edx
mov dword [esp + 0x20], edx
xor edx, edx
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x6c]
mov eax, dword [esp + 0x90]
cmp eax, dword [ecx + 4]
pop ecx
setg dl
xor eax, eax
cmp edx, 0xfffffff9
setle al
cmp eax, ecx
jbe 0x1001b25f
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x68]
add ecx, dword [eax]
jne 0x1001b230
cmp dword [esp + 0x10], ebx
jne 0x1001b230
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xb4]
imul ecx, dword [eax]
mov dword [esp + 0x30], ecx
xor ecx, ecx
mov eax, dword [esp + 0x30]
cmp eax, dword [esi + 4]
setg cl
mov dword [esp + 0x30], ecx
mov eax, dword [esp + 0x30]
mov dword [esp + 0x8c], eax
jmp 0x1001b2c5
mov dword [esp + 0x1c], 0xfffffffc
jmp 0x1001b281
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001b27d
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xfffffff6
jg 0x1001b269
mov dword [esp + 0x1c], 0xb
jmp 0x1001b2be
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001b2ba
push 0x4d61
push 0x5aa3
push ebx
push 0x3f32
push 0x7f21
call fcn.10024e5f
add esp, 0x14
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0x19
jg 0x1001b292
lea ecx, [esp + 0xb4]
mov byte [esp + 0x1a4], 3
call fcn.100187d8
mov eax, dword [esp + 0x68]
inc dword [eax + 8]
mov eax, dword [esp + 0x68]
cmp dword [eax + 8], 0x1c
jne 0x1001b149
lea eax, [esp + 0x9c]
push eax
push ebx
call fcn.1001bfe3
pop ecx
pop ecx
lea ecx, [esp + 0x124]
call fcn.100187d8
or dword [esp + 0x1a4], 0xffffffff
lea ecx, [esp + 0x68]
call fcn.100187d8
cmp dword [edi + 0x10], ebx
jne 0x1001b327
xor al, al
jmp 0x1001bef5
mov ebx, dword [esp + 0x34]
lea ecx, [esp + 0x110]
xor esi, esi
push 3
mov dword [ebx], esi
inc esi
mov dword [esp + 0x20], esi
call fcn.10018753
mov dword [esp + 0x10], 0
jmp 0x1001b362
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x110]
mov dword [eax + ecx*4], 0xb7ce
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x1001b34c
mov dword [esp + 0x1c], 7
jmp 0x1001b3cb
mov dword [esp + 0x28], 0xb72fd491
mov byte [esp + 0x1b], 0
cmp byte [esp + 0x1b], 0
je 0x1001b3c3
push 0x22cc
push 0x49d
push 0x255a
push 0x124b
push 0x1204
push 0xbb0
push 0x20ee
push 0x15c5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Arc]
dec dword [esp + 0x28]
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xc
je 0x1001b373
mov dword [esp + 0x1c], 0
jmp 0x1001b43c
mov dword [esp + 0x10], 0x14173bf3
mov dword [esp + 0x10], 0
jmp 0x1001b431
mov byte [esp + 0x1b], 0
cmp byte [esp + 0x1b], 0
je 0x1001b418
push 0x18cb
push 0x322
push 0
push 0
push 0x1df0
push 0x1f71
call dword [sym.imp.USER32.dll_ToUnicode]
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x110]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jle 0x1001b3ee
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jle 0x1001b3dc
lea ecx, [esp + 0x110]
call fcn.100187d8
mov dword [esp + 0x20], 0x7f6af112
xor edx, edx
mov dword [esp + 0x28], 8
mov dword [esp + 0x10], edx
jmp 0x1001b47a
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0xf0], 0xa75c
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1001b467
mov dword [esp + 0x20], edx
jmp 0x1001b553
push edx
lea eax, [esp + 0x47]
mov dword [esp + 0x28], 0xdd3f4672
push eax
mov dword [esp + 0x30], 0x22db785b
mov dword [esp + 0x34], 0x5429
mov byte [esp + 0x4b], dl
push 0x7df6
call fcn.1001de1c
mov dword [esp + 0x30], esi
xor edx, edx
add esp, 0xc
cmp dword [esp + 0x24], edx
jl 0x1001b54f
mov dword [esp + 0x10], edx
jmp 0x1001b4e2
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x130], 0xb04800fa
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x1001b4cf
inc dword [esp + 0x134]
xor edx, edx
mov eax, dword [esp + 0x20]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
cmp eax, 0xafa3
mov eax, dword [esp + 0x20]
setl dl
xor ecx, ecx
cmp edx, eax
setge cl
xor edx, edx
add ecx, dword [esp + 0xf0]
je 0x1001b527
mov eax, esi
cmp dword [esp + 0xf0], edx
jne 0x1001b529
mov eax, edx
imul eax, eax, 0x226c
xor ecx, ecx
cmp eax, 0xd238
setne cl
mov dword [esp + 0x28], ecx
mov eax, dword [esp + 0x28]
mov dword [esp + 0x2c], eax
dec dword [esp + 0x24]
jns 0x1001b4c9
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 0x19
jg 0x1001b48a
mov byte [esp + 0x1b], dl
cmp byte [esp + 0x1b], 0
je 0x1001b578
push 0x52d1
push edx
call fcn.1001bf48
pop ecx
pop ecx
xor edx, edx
cmp dword [edi + 0x14], 0x10
jb 0x1001b582
mov esi, dword [edi]
jmp 0x1001b584
mov esi, edi
cmp dword [edi + 0x14], 0x10
jb 0x1001b58e
mov ecx, dword [edi]
jmp 0x1001b590
mov ecx, edi
mov eax, dword [edi + 0x10]
add eax, ecx
cmp esi, eax
je 0x1001bbf8
mov dword [esp + 0x48], 1
mov dword [esp + 0x28], 0x38591b68
mov dword [esp + 0x10], edx
jmp 0x1001b5c2
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x168], edx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x1001b5b3
lea eax, [esp + 0x48]
push eax
push edx
call fcn.1001de65
pop ecx
pop ecx
xor edx, edx
push 3
pop ecx
mov dword [esp + 0x48], edx
cmp dword [esp + 0x48], ecx
jg 0x1001b73b
mov ebx, 0xffff
mov dword [esp + 0x14], 1
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x14], edx
jmp 0x1001b71f
mov dword [esp + 0x20], 0x5bfc88eb
mov dword [esp + 0x80], 0x15169ff4
mov dword [esp + 0x10], edx
jmp 0x1001b633
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x94], 1
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1001b620
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov edx, dword [esp + eax*4 + 0x168]
mov eax, dword [esp + 0x94]
imul edx, eax
mov eax, dword [esp + 0x14]
cmp eax, 0xf871
setge cl
xor eax, eax
cmp ecx, 0xd5feaf86
setne al
cmp ebx, eax
sbb eax, eax
xor ecx, ecx
neg eax
cmp edx, eax
mov eax, dword [esp + 0x14]
sete cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x14]
setle dl
xor ecx, ecx
neg edx
mov eax, dword [esp + eax*4 + 0x168]
cmp eax, edx
setle cl
xor edx, edx
imul ecx, dword [esp + 0x94]
test ecx, ecx
je 0x1001b6a8
cmp dword [esp + 0x14], edx
jne 0x1001b6b5
cmp dword [esp + 0x94], edx
jne 0x1001b6b5
mov ecx, edx
jmp 0x1001b6b8
xor ecx, ecx
inc ecx
mov dword [esp + 0x20], 2
mov eax, dword [esp + 0x20]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
imul eax, ecx
push 3
pop ecx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x80], eax
mov dword [esp + 0x1c], ecx
cmp dword [esp + 0x1c], edx
jl 0x1001b71b
mov dword [esp + 0x20], edx
cmp dword [esp + 0x20], ecx
jg 0x1001b715
lea eax, [esp + 0x80]
push eax
push edx
call fcn.1001c0c2
inc dword [esp + 0x28]
pop ecx
pop ecx
push 3
pop ecx
push 0
pop edx
cmp dword [esp + 0x20], ecx
jle 0x1001b6f5
dec dword [esp + 0x1c]
jns 0x1001b6eb
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ecx
jle 0x1001b607
inc dword [esp + 0x48]
cmp dword [esp + 0x48], ecx
jle 0x1001b5ee
mov ebx, dword [esp + 0x34]
mov al, byte [esi]
cmp al, 0x30
jl 0x1001b758
cmp al, 0x39
jg 0x1001b758
imul ecx, dword [ebx], 0xa
movsx eax, al
add eax, 0xffffffd0
add eax, ecx
inc esi
mov dword [ebx], eax
jmp 0x1001b584
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 0x38591b68
mov dword [esp + 0x10], edx
jmp 0x1001b77d
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x188], edx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x1001b76e
inc dword [esp + 0x1c]
mov dword [esp + 0x1c], edx
cmp dword [esp + 0x1c], ecx
jg 0x1001b8f8
mov ebx, 0xffff
mov dword [esp + 0x14], 1
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x14], edx
cmp dword [esp + 0x14], ecx
jg 0x1001b8e6
push 2
pop esi
mov dword [esp + 0x20], 0x5bfc88eb
mov dword [esp + 0x10], 0x15169ff4
mov dword [esp + 0x10], edx
jmp 0x1001b7e5
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0xa0], 1
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x1001b7d2
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov edx, dword [esp + eax*4 + 0x188]
mov eax, dword [esp + 0xa0]
imul edx, eax
mov eax, dword [esp + 0x14]
cmp eax, 0xf871
setge cl
xor eax, eax
cmp ecx, 0xd5feaf86
setne al
cmp ebx, eax
sbb eax, eax
xor ecx, ecx
neg eax
cmp edx, eax
mov eax, dword [esp + 0x14]
sete cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x14]
setle dl
xor ecx, ecx
neg edx
mov eax, dword [esp + eax*4 + 0x188]
cmp eax, edx
setle cl
xor edx, edx
imul ecx, dword [esp + 0xa0]
test ecx, ecx
je 0x1001b859
cmp dword [esp + 0x14], edx
jne 0x1001b866
cmp dword [esp + 0xa0], edx
jne 0x1001b866
mov ecx, edx
jmp 0x1001b869
xor ecx, ecx
inc ecx
mov dword [esp + 0x20], esi
mov eax, dword [esp + 0x20]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
imul eax, ecx
push 3
pop ecx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x10], eax
mov dword [esp + 0x24], ecx
cmp dword [esp + 0x24], edx
jl 0x1001b8d8
mov dword [esp + 0x20], edx
jmp 0x1001b8cc
mov dword [esp + 0x10], ecx
cmp dword [esp + 0x10], edx
jl 0x1001b8c8
push edx
lea eax, [esp + 0x3f]
mov byte [esp + 0x3f], dl
push 0x6f01
push eax
call fcn.1001df35
add esp, 0xc
dec dword [esp + 0x10]
push 0
pop edx
jns 0x1001b8a5
push 3
pop ecx
inc dword [esp + 0x20]
cmp dword [esp + 0x20], ecx
jle 0x1001b89b
dec dword [esp + 0x24]
jns 0x1001b895
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ecx
jle 0x1001b7bc
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], ecx
jle 0x1001b79b
mov ebx, dword [esp + 0x34]
push 2
lea ecx, [esp + 0x60]
mov dword [ebx], edx
call fcn.10018753
lea eax, [esp + 0x144]
mov dword [esp + 0x1a4], 5
push eax
lea eax, [esp + 0x60]
xor ebx, ebx
push eax
mov dword [esp + 0x1c], ebx
push 0x6a63
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x34], 4
push ebx
call fcn.1001ef6d
add esp, 0x10
mov dword [esp + 0x14], ebx
jmp 0x1001bbdf
mov dword [esp + 0x1c], 0xf1dbeccc
mov dword [esp + 0x50], 0xb6890635
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], 0xd4e203d7
mov dword [esp + 0x1c], ebx
jmp 0x1001b991
lea eax, [esp + 0x7c]
mov dword [esp + 0x7c], 0xcdcb363f
push eax
lea eax, [esp + 0x60]
push ebx
push eax
call fcn.1001f31e
add esp, 0xc
cmp dword [esp + 0x7c], ebx
jne 0x1001b998
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 1
jle 0x1001b96c
mov dword [esp + 0x1c], ebx
jmp 0x1001bbd0
mov dword [esp + 0x10], 0x1b185749
lea ecx, [esp + 0xcc]
push 1
call fcn.10018753
mov byte [esp + 0x1a4], 6
mov dword [esp + 0x10], ebx
jmp 0x1001b9db
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xcc]
mov dword [eax + ecx*4], 0x8301
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 1
jl 0x1001b9c5
mov eax, dword [esp + 0x14]
xor ebx, ebx
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x5c]
cmp dword [eax + ecx*4], 1
sete bl
imul ebx, dword [eax + edx*4]
imul eax, ebx, 0x94bb
xor ebx, ebx
test eax, eax
je 0x1001ba1d
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x5c]
cmp dword [eax + ecx*4], ebx
je 0x1001ba1d
xor eax, eax
inc eax
jmp 0x1001ba1f
mov eax, ebx
mov esi, dword [esp + 0x1c]
xor edx, edx
cmp eax, 0x3388
setl dl
xor ecx, ecx
add edx, 0x1932
imul edx, dword [esp + 0x20]
mov eax, dword [esp + 0x5c]
cmp dword [eax + esi*4], edx
setne cl
mov dword [esp + 0x50], ecx
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x5c]
mov eax, dword [esp + 0x50]
cmp dword [ecx + edx*4], eax
jle 0x1001ba5d
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
xor edx, edx
mov eax, dword [esp + 0x1c]
cmp ecx, eax
setne dl
mov dword [esp + 0x10], edx
xor edx, edx
mov dword [esp + 0x20], ebx
inc edx
jmp 0x1001bbae
mov dword [esp + 0x34], 0x3c6d
mov dword [esp + 0x78], ebx
mov dword [esp + 0x2c], 0xa0ff8149
mov dword [esp + 0x10], ebx
jmp 0x1001baa6
cmp dword [esp + 0x20], edx
jle 0x1001ba7c
lea ecx, [esp + 0xcc]
mov byte [esp + 0x1a4], 5
call fcn.100187d8
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 1
jle 0x1001b9a1
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 1
jle 0x1001b94a
lea ecx, [esp + 0x5c]
call fcn.100187d8
jmp 0x1001b320
mov dword [esp + 0x14], 9
mov dword [esp + 0x2c], 0x13cef33
mov dword [esp + 0x30], 0xfffffffd
mov dword [esp + 0x10], edx
jmp 0x1001bc29
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0xf8], 4
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x1001bc16
mov dword [esp + 0x14], edx
xor ebx, ebx
cmp dword [esp + 0x14], 0x10
jg 0x1001bd3a
xor esi, esi
inc ebx
push 4
lea ecx, [esp + 0xe8]
call fcn.10018753
mov dword [esp + 0x24], ebx
push 4
mov dword [esp + 0x2c], 0x92978d8e
pop edx
mov dword [esp + 0x4c], edx
mov dword [esp + 0x10], esi
jmp 0x1001bc7d
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xe4]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x1001bc6b
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x24]
neg eax
sbb eax, eax
xor edx, edx
neg eax
mov dword [esp + 0x28], eax
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
cmp ecx, eax
mov eax, dword [esp + 0xe4]
setle dl
add edx, dword [eax + 4]
jne 0x1001bcb8
mov ecx, esi
cmp dword [esp + 0x14], esi
je 0x1001bcba
mov ecx, ebx
mov eax, dword [esp + 0x24]
sub ecx, eax
xor eax, eax
cmp ecx, 0xfffffff9
setl al
mov dword [esp + 0xf8], eax
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0xe4]
mov ecx, dword [esp + 0x100]
imul ecx, dword [eax + 8]
cmp ecx, dword [esp + 0x2c]
je 0x1001bcf6
mov ecx, ebx
cmp dword [esp + 0xf8], esi
jne 0x1001bcf8
mov ecx, esi
cmp dword [esp + 0x14], 0x912491e2
sbb eax, eax
neg eax
add eax, 0x3b26
add eax, ecx
je 0x1001bd15
mov eax, ebx
cmp dword [esp + 0x24], esi
jne 0x1001bd17
mov eax, esi
mov dword [esp + 0x4c], eax
lea ecx, [esp + 0xe4]
call fcn.100187d8
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0x10
jle 0x1001bc44
xor edx, edx
jmp 0x1001bd3b
inc ebx
dec dword [esp + 0x30]
mov dword [esp + 0x24], 0xad313dd3
mov dword [esp + 0x24], 8
jmp 0x1001bd8f
push 0x1950
push 0x7470
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x34], 0xfffffffc
push edx
call fcn.1001e326
add esp, 0xc
xor edx, edx
mov dword [esp + 0x10], edx
jmp 0x1001bd84
mov dword [esp + 0x2c], ebx
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xffffffeb
jge 0x1001bd7c
dec dword [esp + 0x24]
cmp dword [esp + 0x24], 0xfffffff6
jl 0x1001bd51
push 2
pop esi
mov dword [esp + 0x1c], ebx
lea ecx, [esp + 0xc0]
mov dword [esp + 0x20], 0xfffffff8
push esi
call fcn.10018753
xor ebx, ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x14], ebx
jmp 0x1001bdce
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x54], 0x1891f782
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x1001bdbe
mov dword [esp + 0x14], ebx
jmp 0x1001bdf0
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc0]
mov dword [eax + ecx*4], 0x26f39384
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x1001bdda
cmp dword [esp + 0x54], ebx
je 0x1001be73
mov eax, dword [esp + 0x1c]
xor ecx, ecx
mov eax, dword [esp + 0x54]
cmp eax, 1
setge cl
cmp ecx, dword [esp + 0x58]
jl 0x1001be1d
cmp dword [esp + 0x58], ebx
je 0x1001be1d
xor eax, eax
inc eax
jmp 0x1001be1f
mov eax, ebx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
add eax, dword [esp + 0x58]
jne 0x1001be37
cmp dword [esp + 0x20], ebx
jne 0x1001be37
mov eax, ebx
jmp 0x1001be3a
xor eax, eax
inc eax
mov ecx, dword [esp + 0x1c]
xor edx, edx
imul ecx, eax
mov eax, dword [esp + 0x54]
cmp eax, ecx
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0xc0]
setle dl
add ecx, edx
xor edx, edx
inc edx
mov dword [eax + 4], ecx
mov ecx, edx
mov eax, dword [esp + 0x54]
mov dword [esp + 0x54], edx
mov eax, dword [esp + 0x1c]
sub ecx, eax
mov eax, edx
jne 0x1001be75
mov eax, ebx
xor edx, edx
cmp eax, 0xfffffffe
mov eax, dword [esp + 0x1c]
setne dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [esp + 0x28], ecx
mov dword [esp + 0x1c], ebx
jmp 0x1001bee0
mov eax, dword [esp + 0xc0]
mov eax, dword [eax]
mov dword [esp + 0x28], eax
mov dword [esp + 0x20], 1
cmp dword [esp + 0x20], ebx
jl 0x1001bedc
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], bl
je 0x1001bed6
push ebx
push 0x188
push 0x12a7
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
dec dword [esp + 0x20]
jns 0x1001bead
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0x20
jge 0x1001be92
lea ecx, [esp + 0xc0]
call fcn.100187d8
mov al, 1
mov ecx, dword [esp + 0x19c]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret