Function at 0x1001865e
Capabilities:
Extract resource via kernel32 functions
Resolve function by parsing pe exports
Suspend thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10076277
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2b0
push ebx
mov dword [esp + 0x48], ecx
xor ebx, ebx
mov dword [esp + 0x24], 0xeac8b13e
push esi
mov byte [esp + 0x13], bl
mov esi, edx
push edi
mov dword [esp + 0x48], esi
cmp byte [esp + 0x17], bl
je 0x100186b2
push ebx
push ebx
push 0x1748
push 0x1e57
call dword [sym.imp.USER32.dll_PostMessageA]
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], bl
je 0x100186ce
push 0x1c86
push ebx
push ebx
push 0x1d5a
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
push 3
mov dword [esp + 0x14], 0xffffffff
lea ecx, [esp + 0x1d4]
pop edi
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x2c], 2
mov dword [esp + 0x2c], 0x283066c9
push edi
call fcn.1001ae5e
mov dword [esp + 0x2c], 0x35637001
mov dword [esp + 0x20], 0x7f8b4dfe
mov dword [esp + 0xc], ebx
jmp 0x10018723
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x1ec], 0xa8c6a53d
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x10018710
mov dword [esp + 0xc], ebx
jmp 0x10018745
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x1d0]
mov dword [eax + ecx*4], 0x439cb61d
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x1001872f
mov dword [esp + 0x10], 2
cmp dword [esp + 0x10], ebx
jl 0x1001878c
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], bl
je 0x10018770
push ebx
push 0xec3
push ebx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + eax*4 + 0x1ec]
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x1ec], ecx
dec dword [esp + 0x10]
jns 0x10018759
inc dword [esp + 0x20]
lea ecx, [esp + 0x1d0]
call fcn.1001b9e4
mov eax, dword [0x10f5ac30]
xor edi, edi
inc edi
test al, 1
jne 0x10018841
or eax, edi
mov dword [0x10f5ac30], eax
push ebx
mov dword [esp + 0x2c8], ebx
push ebx
mov dword [0x10f5ac10], ebx
mov dword [0x10f5ac14], ebx
call fcn.1001f4c5
mov dword [0x10f5ac10], eax
mov dword [0x10f5ac18], ebx
mov dword [0x10f5ac20], ebx
mov byte [esp + 0x2c4], 2
mov ecx, 0x10f5ac18
mov dword [esp + 0xf8], eax
lea eax, [esp + 0xf8]
push eax
push 0x10
push ebx
lea eax, [esp + 0x1e8]
mov dword [0x10f5ac2c], 0x3f800000
push eax
mov dword [0x10f5ac1c], ebx
call fcn.1001f29d
push 0x100774a5
mov dword [0x10f5ac24], 7
mov dword [0x10f5ac28], 8
call fcn.1005dc69
or dword [esp + 0x2c8], 0xffffffff
pop ecx
mov dword [esp + 0x1c], 8
lea ecx, [esp + 0x19c]
mov dword [esp + 0x18], 0x85faafe3
mov dword [esp + 0x20], 0xe7ccc895
mov dword [esp + 0x18], 0x12f3ccd2
push 2
call fcn.1001ae5e
mov dword [esp + 0x20], 0xe3d1aa12
mov dword [esp + 0x28], 3
mov dword [esp + 0x10], ebx
jmp 0x1001889b
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x19c]
mov dword [eax + ecx*4], 0xa11600d5
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x10018885
mov dword [esp + 0x18], 0xfffe
xor edx, edx
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
cmp ecx, eax
mov eax, dword [esp + 0x19c]
setge dl
mov dword [eax], edx
test edx, edx
jne 0x100188ca
mov eax, dword [esp + 0x18]
mov dword [esp + 0x20], ebx
xor edx, edx
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
cmp ecx, eax
setle dl
mov dword [esp + 0x18], edx
mov eax, dword [esp + 0x1c]
dec eax
neg eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x20]
imul ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
cmp ecx, eax
setge dl
add edx, dword [esp + 0x1c]
cmp edx, dword [esp + 0x1c]
jge 0x10018921
mov eax, ebx
cmp dword [esp + 0x18], ebx
je 0x10018923
mov eax, edi
mov dword [esp + 0x28], eax
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10018939
push ebx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
lea ecx, [esp + 0x19c]
call fcn.1001b9e4
imul eax, dword [esp + 0x50], 0x2710
lea ecx, [esp + 0x148]
push edi
add eax, esi
mov dword [esp + 0x80], eax
mov dword [esp + 0x14], 0x860b4ffb
call fcn.1001ae5e
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0xc], ebx
jmp 0x10018988
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x1f8], ebx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x10018979
mov dword [esp + 0xc], ebx
jmp 0x100189ab
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x148]
mov dword [eax + ecx*4], 5
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x10018995
mov dword [esp + 0x10], 2
cmp dword [esp + 0x10], ebx
jl 0x10018a9d
mov dword [esp + 0xc], ebx
mov dword [esp + 0x20], edi
mov dword [esp + 0x18], 0x2a17d0b0
mov dword [esp + 0x1c], ebx
jmp 0x100189ec
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x190], 0x5ca42045
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 3
jl 0x100189d9
mov eax, dword [esp + 0x18]
inc dword [esp + 0x18]
test eax, eax
jne 0x10018a55
mov eax, dword [esp + 0x10]
xor edx, edx
mov ecx, dword [esp + eax*4 + 0x1f8]
mov eax, dword [esp + 0x148]
cmp ecx, dword [eax]
setge dl
mov dword [esp + 0x20], edx
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x148]
mov dword [eax], ecx
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
cmp dword [esp + eax*4 + 0x1f8], ebx
jne 0x10018a46
mov eax, ebx
cmp dword [esp + 0xc], ebx
je 0x10018a48
mov eax, edi
add eax, 0x448112de
cmp eax, dword [esp + 0x10]
mov eax, ebx
jle 0x10018a57
mov eax, edi
mov dword [esp + 0x24], eax
mov ecx, 0xf738f585
mov eax, dword [esp + 0x24]
sub eax, 0x434a
neg eax
sbb eax, eax
inc eax
cmp ecx, eax
mov eax, dword [esp + 0x190]
sbb edx, edx
xor ecx, ecx
neg edx
imul edx, eax
mov eax, dword [esp + 0x198]
cmp edx, eax
sete cl
mov dword [esp + 0x190], ecx
dec dword [esp + 0x10]
jns 0x100189c3
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10018ab9
push 0x257a
push 0x23f3
push ebx
call dword [sym.imp.USER32.dll_OffsetRect]
lea ecx, [esp + 0x148]
call fcn.1001b9e4
lea eax, [esp + 0x7c]
push eax
call fcn.1001b286
mov esi, dword [eax]
test esi, esi
je 0x10018c5a
mov dword [esp + 0x10], ebx
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10018af5
push 0xea
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [esp + 0x10], ebx
jmp 0x10018b11
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10018b0d
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0xe
jg 0x10018afb
mov dword [esp + 0x10], 0xfff6
mov dword [esp + 0xc], ebx
mov eax, dword [esp + 0x10]
mov dword [esp + 0xc], edi
mov dword [esp + 0xdc], esi
mov dword [esp + 0xc], ebx
jmp 0x10018c4a
mov dword [esp + 0x18], 0x18e418a5
push 3
mov dword [esp + 0x24], edi
pop ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x24], ebx
jmp 0x10018b68
mov eax, dword [esp + 0x24]
mov dword [esp + eax*4 + 0x1a8], 0xffffffff
inc dword [esp + 0x24]
cmp dword [esp + 0x24], ecx
jl 0x10018b55
mov dword [esp + 0x24], ebx
jmp 0x10018b87
mov eax, dword [esp + 0x24]
mov dword [esp + eax*4 + 0x278], 0xb2097e65
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 4
jl 0x10018b74
cmp dword [esp + 0x18], ebx
jne 0x10018c33
mov eax, dword [esp + 0xc]
sub eax, dword [esp + 0x10]
neg eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0xc]
cmp ecx, eax
mov eax, dword [esp + 0xc]
setge dl
xor ecx, ecx
cmp edx, eax
setle cl
neg ecx
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0xc]
cmp dword [esp + 0x10], ebx
je 0x10018bdf
mov edx, edi
cmp dword [esp + 0xc], ebx
jne 0x10018be1
mov edx, ebx
mov eax, dword [esp + 0x10]
xor ecx, ecx
cmp edx, eax
setg cl
add ecx, 0x2633
imul ecx, dword [esp + 0x1a8]
test ecx, ecx
je 0x10018c02
mov eax, dword [esp + 0x10]
mov dword [esp + 0x1a8], 0x649690b2
mov ecx, edi
mov dword [esp + 0x27c], ebx
mov edx, ebx
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x1a8]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
sub ecx, eax
je 0x10018c35
mov edx, edi
mov eax, dword [esp + 0xc]
xor ecx, ecx
neg eax
cmp eax, edx
setl cl
mov dword [esp + 0x1c], ecx
dec dword [esp + 0xc]
cmp dword [esp + 0xc], 0xffffffe8
jl 0x10018b3c
jmp 0x1001a38d
mov dword [esp + 0xc], 0xfffffffc
mov dword [esp + 0x10], ebx
jmp 0x10018c7b
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x1cc], 0x3250e6da
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x10018c68
push 4
mov dword [esp + 0x10], ebx
pop esi
jmp 0x10018c9c
mov dword [esp + 0x28], 0x2cb51dba
cmp dword [esp + 0x28], ebx
jne 0x10018ca2
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jg 0x10018c8a
mov dword [esp + 0xc], ebx
jmp 0x10018cc3
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10018cbf
push ebx
push 0x4e0
call dword [sym.imp.GDI32.dll_GetClipBox]
inc dword [esp + 0xc]
cmp dword [esp + 0xc], ebx
jle 0x10018ca8
mov eax, dword [0x10f5ac30]
test al, 2
jne 0x10018d6d
or eax, 2
mov dword [0x10f5ac30], eax
push ebx
mov dword [esp + 0x2c8], 3
push ebx
mov dword [0x10f5abd0], ebx
mov dword [0x10f5abd4], ebx
call fcn.1001f4c5
mov dword [0x10f5abd0], eax
mov dword [0x10f5abd8], ebx
mov dword [0x10f5abe0], ebx
mov byte [esp + 0x2c4], 5
mov ecx, 0x10f5abd8
mov dword [esp + 0x12c], eax
lea eax, [esp + 0x12c]
push eax
push 0x10
push ebx
lea eax, [esp + 0x64]
mov dword [0x10f5abec], 0x3f800000
push eax
mov dword [0x10f5abdc], ebx
call fcn.1001f29d
push 0x100774a0
mov dword [0x10f5abe4], 7
mov dword [0x10f5abe8], 8
call fcn.1005dc69
or dword [esp + 0x2c8], 0xffffffff
pop ecx
mov dword [esp + 0x20], 0xfffffff8
mov dword [esp + 0x20], 0xff446cd5
mov dword [esp + 0x28], edi
mov dword [esp + 0xc], ebx
jmp 0x10018d97
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x5c], 8
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x10018d87
mov dword [esp + 0xc], ebx
jmp 0x10018db3
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x210], edi
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x10018da4
mov eax, dword [esp + 0x60]
xor ecx, ecx
mov eax, dword [esp + 0x64]
mov eax, dword [esp + 0x64]
mov eax, dword [esp + 0x5c]
mov eax, dword [esp + 0x5c]
mov eax, dword [esp + 0x64]
cmp eax, 0xffffffff
push 6
setne cl
mov dword [esp + 0x24], ecx
mov eax, dword [esp + 0x24]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
pop ecx
sub ecx, eax
xor eax, eax
cmp ecx, 0x22736378
setl al
add eax, 0xfffef8a3
neg eax
sbb eax, eax
inc eax
sub eax, dword [esp + 0x5c]
neg eax
sbb eax, eax
inc eax
cmp eax, 0xffffffff
je 0x10018e1a
mov edx, edi
cmp dword [esp + 0x5c], ebx
jne 0x10018e1c
mov edx, ebx
mov eax, dword [esp + 0x5c]
xor ecx, ecx
cmp eax, edx
xorps xmm0, xmm0
mov eax, dword [esp + 0x5c]
setle cl
sub ecx, eax
mov eax, dword [esp + 0x60]
add eax, ecx
mov dword [esp + 0x210], eax
mov dword [esp + 0x28], eax
lea eax, [esp + 0x50]
push eax
movdqu xmmword [esp + 0xcc], xmm0
call fcn.1001b2e8
mov edi, dword [eax]
xor eax, eax
mov dword [esp + 0xc], 0x68ec0ae9
inc eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x20], 0xfffffff6
mov dword [esp + 0x30], ebx
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], edi
mov dword [esp + 0x10], ebx
jmp 0x10018e92
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x26c], 3
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x10018e7f
mov dword [esp + 0xc], 0xb
cmp dword [esp + 0xc], 0xfffffffe
jne 0x10018f9d
xor edi, edi
inc edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x10], ebx
jmp 0x10018ecc
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x178], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x10018ebd
mov dword [esp + 0x1c], 2
cmp dword [esp + 0x1c], ebx
jl 0x10018f82
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x10], 2
cmp dword [esp + 0x10], ebx
jl 0x10018f78
mov dword [esp + 0x30], 0xf4442628
mov eax, dword [esp + 0x10]
cmp dword [esp + eax*4 + 0x178], ebx
je 0x10018f14
mov eax, dword [esp + 0xc]
cmp dword [esp + 0xc], ebx
jne 0x10018f46
mov eax, dword [esp + 0x18]
xor ecx, ecx
cmp eax, 7
mov eax, dword [esp + 0x1c]
setge cl
xor edx, edx
cmp ecx, eax
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
setle dl
sub ecx, edx
cmp ecx, dword [esp + eax*4 + 0x178]
mov eax, ebx
jle 0x10018f48
mov eax, edi
mov dword [esp + 0x20], eax
xor edx, edx
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + eax*4 + 0x178]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
cmp ecx, eax
setne dl
mov dword [esp + 0x30], edx
dec dword [esp + 0x10]
jns 0x10018efb
dec dword [esp + 0x1c]
jns 0x10018ee5
mov eax, dword [esp + 0xc]
mov dword [esp + 0x1c], eax
dec dword [esp + 0xc]
cmp dword [esp + 0xc], 0xfffffffe
je 0x10018eaf
mov edi, dword [esp + 0x28]
mov dword [esp + 0xc], ebx
jmp 0x1001903a
mov dword [esp + 0x18], 0x4fa3fda3
mov dword [esp + 0x30], 0x5534fd39
mov dword [esp + 0x10], ebx
jmp 0x10018fcf
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x248], 5
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x10018fbc
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10018fea
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x250], eax
mov dword [esp + 0x274], eax
mov dword [esp + 0x20], 6
mov eax, dword [esp + 0x20]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x24]
sub eax, 0x3ed13222
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x30], eax
dec dword [esp + 0xc]
cmp dword [esp + 0xc], 0xfffffff0
jne 0x10018fa6
cmp byte [ebp + 0xc], 0
jne 0x10019053
test edi, edi
jne 0x100192cd
mov dword [esp + 0x10], 0xc96dd1e1
mov dword [esp + 0x10], ebx
jmp 0x10019074
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x298], 1
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x10019061
mov dword [esp + 0x10], ebx
jmp 0x10019093
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x298], 0xffffffff
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x10019080
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x100190ae
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov dl, byte [ebp + 0xc]
lea eax, [esp + 0x2a8]
mov ecx, dword [esp + 0x50]
push eax
call fcn.1000a4d8
mov esi, eax
lea edi, [esp + 0xcc]
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [esp + 0x10], 0xd7f825e
xor esi, esi
mov byte [esp + 0x17], bl
inc esi
cmp byte [esp + 0x17], 0
je 0x100190f0
push esi
push ebx
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov dword [esp + 0x10], 0xfffffff4
jmp 0x10019119
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10019115
push 0x2090
push 0xf3a
call dword [sym.imp.GDI32.dll_SetStretchBltMode]
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xffffffe4
jl 0x100190fa
cmp byte [ebp + 0xc], 0
je 0x100192cd
cmp dword [esp + 0xd0], 0
je 0x100192cd
mov eax, dword [esp + 0xd4]
lea ecx, [esp + 0x184]
mov dword [esp + 0xe0], eax
mov eax, 0x3b26bdde
mov dword [esp + 0x9c], eax
mov dword [esp + 0xa0], eax
mov dword [esp + 0xa4], eax
mov dword [esp + 0xa8], eax
push esi
call fcn.1001ae5e
mov dword [esp + 0x30], 0x26cd
cmp dword [esp + 0x30], 0x537
jge 0x10019246
lea eax, [esp + 0x74]
push eax
lea eax, [esp + 0x148]
push eax
push 0x100081e0
call fcn.1005d64b
xor eax, eax
mov dword [esp + 0x2c], ebx
mov edi, ebx
inc eax
add esp, 0xc
mov dword [esp + 0x18], eax
or esi, 0xffffffff
cmp dword [esp + 0x74], edi
jle 0x10019215
lea eax, [esp + 0x78]
push eax
lea eax, [esp + 0x12c]
push eax
push 0x100081e0
call fcn.1005d64b
mov ecx, dword [esp + 0x134]
lea eax, [edi + 1]
add esp, 0xc
cmp eax, ecx
jl 0x1001920c
cmp ecx, eax
mov eax, dword [esp + 0x18]
jge 0x100191f7
inc eax
mov esi, ecx
mov dword [esp + 0x18], eax
cmp dword [esp + 0x78], ecx
jg 0x10019211
mov ecx, dword [esp + 0x20]
mov edi, dword [esp + 0x78]
inc ecx
mov dword [esp + 0x20], ecx
cmp ecx, dword [esp + 0x74]
jl 0x100191ba
jmp 0x10019211
lea esi, [edi + 1]
mov eax, ebx
test esi, esi
jns 0x10019234
cmp edi, dword [esp + 0x144]
jge 0x10019223
lea esi, [edi + 1]
mov eax, ebx
test esi, esi
jns 0x10019234
push 0x10008388
call fcn.1005dee6
pop ecx
jmp 0x10019243
push eax
push esi
push 0x1000838c
call fcn.1005dc93
add esp, 0xc
xor esi, esi
inc esi
mov dword [esp + 0x10], ebx
jmp 0x10019262
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x184]
mov dword [eax + ecx*4], 0xfffffff9
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x1001924c
mov dword [esp + 0xa0], 0xfffffff7
jmp 0x100192a9
mov dword [esp + 0x20], 9
xor edx, edx
imul ecx, dword [esp + 0x20], 0xf37c
mov eax, dword [esp + 0xa0]
add ecx, eax
mov eax, dword [esp + 0x20]
cmp eax, ecx
mov eax, dword [esp + 0x184]
setl dl
mov dword [eax], edx
inc dword [esp + 0xa0]
cmp dword [esp + 0xa0], 0xd
je 0x10019275
lea ecx, [esp + 0x184]
call fcn.1001b9e4
mov eax, dword [esp + 0xd0]
mov dword [esp + 0xe4], eax
mov dword [esp + 0x10], 0xd4e06482
lea ecx, [esp + 0x160]
mov dword [esp + 0x68], ebx
push 3
call fcn.1001ae5e
mov dword [esp + 0x2c4], 6
mov dword [esp + 0x1c], 0xeafb
mov dword [esp + 0x18], 0xd8142c78
mov dword [esp + 0x2c], 0xfffffffc
mov dword [esp + 0x2c], 0x659b
mov dword [esp + 0x30], ebx
mov dword [esp + 0x10], ebx
jmp 0x10019332
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x160]
mov dword [eax + ecx*4], 0xfffffffd
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x1001931c
mov dword [esp + 0x10], 0xffffffeb
cmp dword [esp + 0x10], 0xffffffe9
je 0x1001959f
mov esi, dword [esp + 0x160]
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], 0x3d37
xor eax, eax
mov dword [esp + 0x80], 9
inc eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x44], 0xffffffff
mov dword [esp + 0x44], 0x623b4709
mov dword [esp + 0x18], 0xa7f4
mov dword [esp + 0x34], 0x1cd4
cmp dword [esp + 0x34], 0x610
jge 0x1001945e
lea eax, [esp + 0x54]
push eax
push 0x100081dc
call fcn.1005d64b
pop ecx
pop ecx
push dword [esp + 0x54]
lea ecx, [esp + 0x11c]
call fcn.1001ae5e
mov byte [esp + 0x2c4], 7
cmp dword [esp + 0x54], 0
mov esi, dword [esp + 0x118]
mov dword [esp + 0x34], ebx
jle 0x100193f9
mov edi, esi
push edi
push 0x100081dc
call fcn.1005d64b
inc ebx
add edi, 4
pop ecx
pop ecx
cmp ebx, dword [esp + 0x54]
jl 0x100193e0
xor ebx, ebx
push dword [esp + 0x11c]
push esi
call fcn.1001fc2b
mov edi, dword [esp + 0x5c]
mov edx, ebx
pop ecx
dec edi
pop ecx
mov ecx, ebx
test edi, edi
jle 0x10019425
mov eax, dword [esi + ecx*4 + 4]
sub eax, dword [esi + ecx*4]
add ecx, 2
add edx, eax
cmp ecx, edi
jl 0x10019415
push edx
push 0x100081e8
call fcn.1005dc93
mov byte [esp + 0x2cc], 6
pop ecx
pop ecx
test esi, esi
je 0x1001945a
push esi
call fcn.1005de9a
pop ecx
mov dword [esp + 0x118], ebx
mov dword [esp + 0x11c], ebx
mov dword [esp + 0x120], ebx
mov esi, dword [esp + 0x20]
mov dword [esp + 0x34], 0x9034
mov dword [esp + 0x44], 0x14ba
cmp dword [esp + 0x44], 0x61c
jge 0x100194e1
lea eax, [esp + 0x4c]
push eax
push 0x100081dc
call fcn.1005d64b
pop ecx
jmp 0x100194d3
dec eax
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x124]
push eax
lea eax, [esp + 0xec]
push eax
push 0x100081e0
call fcn.1005d64b
mov eax, dword [esp + 0xf4]
add esp, 0xc
mov ecx, 0x10008398
mov edi, 0x10008310
lea edx, [eax + eax]
mov eax, dword [esp + 0x124]
inc eax
cmp eax, edx
cmovg ecx, edi
push ecx
call fcn.1005dee6
mov eax, dword [esp + 0x50]
pop ecx
test eax, eax
jne 0x1001948a
dec eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x44], ebx
mov eax, dword [esp + 0x68]
cmp dword [esp + 0xc], ebx
je 0x100194fd
cmp dword [esp + 0x80], ebx
je 0x100194fd
xor ecx, ecx
inc ecx
jmp 0x100194ff
mov ecx, ebx
dec dword [esp + 0x18]
xor edx, edx
mov eax, dword [esp + 0x1c]
sub ecx, eax
mov eax, dword [esp + 0x18]
cmp eax, ecx
mov eax, dword [esp + 0x24]
setne dl
xor ecx, ecx
cmp edx, eax
mov dword [esi + 8], edx
sete cl
xor edx, edx
add ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x34]
cmp ecx, 0xfffffff7
setle dl
xor ecx, ecx
cmp edx, eax
setle cl
xor edx, edx
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
cmp ecx, eax
setge dl
xor ecx, ecx
add edx, dword [esp + 0x24]
mov eax, dword [esp + 0x80]
cmp edx, eax
setg cl
mov dword [esp + 0xc], ecx
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0xc]
sub edx, eax
neg edx
sbb edx, edx
add edx, 0xfffffffc
neg edx
sbb edx, edx
inc edx
sub edx, dword [esp + 0x34]
mov eax, dword [esp + 0x44]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
mov dword [esp + 0x2c], ecx
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xffffffe9
jne 0x10019357
dec dword [esp + 0x30]
lea ecx, [esp + 0x160]
or dword [esp + 0x2c4], 0xffffffff
call fcn.1001b9e4
mov edi, dword [esp + 0x28]
test edi, edi
jne 0x1001a017
cmp dword [esp + 0xc8], edi
jle 0x1001a017
mov dword [esp + 0xc], 0xf7e2799a
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], ebx
jmp 0x100195fa
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x3c], 0x6a162c9c
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jl 0x100195ea
xor esi, esi
mov dword [esp + 0xc], ebx
inc esi
cmp dword [esp + 0xc], 0xffffffe9
jne 0x10019889
mov dword [esp + 0x1c], 0x8b72fd49
mov dword [esp + 0x28], 0x6d35df96
mov dword [esp + 0x1c], 0x12
jmp 0x10019871
mov dword [esp + 0x24], 0x38c08872
mov dword [esp + 0x18], 0x1bca
mov dword [esp + 0x30], 2
mov dword [esp + 0x34], 0xf3fd26f3
mov dword [esp + 0x24], ebx
jmp 0x1001966c
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10019668
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
inc dword [esp + 0x24]
cmp dword [esp + 0x24], esi
jle 0x10019656
mov dword [esp + 0x24], ebx
jmp 0x10019863
mov dword [esp + 0x10], 0xffffffff
lea ecx, [esp + 0x16c]
push esi
call fcn.1001ae5e
mov dword [esp + 0x18], ebx
jmp 0x100196ac
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x16c]
mov dword [eax + ecx*4], 0xae50714b
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jl 0x10019696
mov eax, dword [esp + 0x1c]
xor ecx, ecx
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x40]
imul edx, eax
mov eax, dword [esp + 0x24]
cmp edx, eax
mov eax, dword [esp + 0x10]
setl cl
dec eax
add ecx, eax
xor edx, edx
mov eax, dword [esp + 0x40]
cmp eax, ecx
mov eax, dword [esp + 0x24]
setge dl
mov ecx, dword [esp + eax*4 + 0x3c]
mov eax, dword [esp + 0x24]
add eax, edx
xor edx, edx
add ecx, eax
mov eax, dword [esp + 0x24]
cmp ecx, eax
mov eax, dword [esp + 0x24]
setle dl
xor ecx, ecx
shl edx, 2
cmp edx, 0xec7e011b
setne cl
add ecx, eax
mov eax, dword [esp + 0x16c]
mov dword [eax], ecx
mov eax, dword [esp + 0x24]
cmp dword [esp + eax*4 + 0x3c], 0xffff
mov eax, dword [esp + 0x3c]
sbb edx, edx
add eax, ecx
inc edx
cmp eax, 0xf7a0211e
sbb eax, eax
xor ecx, ecx
neg eax
cmp edx, eax
mov eax, dword [esp + 0x3c]
setle cl
add eax, ecx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + eax*4 + 0x3c]
mov eax, dword [esp + 0x18]
shl eax, 3
sub ecx, eax
mov dword [esp + 0x30], ecx
cmp dword [esp + 0x1c], ebx
jne 0x100197e4
cmp dword [esp + 0xc], ebx
jne 0x100197a6
mov eax, dword [esp + 0x24]
xor edx, edx
mov ecx, dword [esp + eax*4 + 0x3c]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + eax*4 + 0x3c]
cmp ecx, eax
sete dl
xor eax, eax
imul edx, dword [esp + 0x3c]
cmp edx, esi
mov edx, ebx
setle al
xor ecx, ecx
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x2c], eax
setle cl
cmp ecx, dword [esp + 0x1c]
jl 0x100197a8
mov edx, esi
mov eax, dword [esp + 0xc]
xor ecx, ecx
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
cmp edx, eax
setle cl
sub ecx, dword [esp + 0x1c]
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [esp + 0xc]
mov dword [esp + 0x28], ecx
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + eax*4 + 0x3c]
mov dword [esp + 0x18], ebx
xor ecx, ecx
mov dword [esp + 0x2c], 0x47387092
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + eax*4 + 0x3c]
cmp eax, 0xbb76
setne cl
xor eax, eax
cmp eax, ecx
sbb ecx, ecx
neg ecx
sub ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x24]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
setl dl
sub edx, dword [esp + 0x34]
neg edx
sbb edx, edx
inc edx
imul edx, dword [esp + 0x18]
neg edx
sbb edx, edx
inc edx
mov dword [esp + 0x2c], edx
mov dword [esp + 0x10], ebx
jmp 0x1001984d
cmp dword [esp + 0x18], ebx
jne 0x10019853
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jle 0x10019843
lea ecx, [esp + 0x16c]
call fcn.1001b9e4
inc dword [esp + 0x24]
cmp dword [esp + 0x24], esi
jle 0x1001967b
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xb
je 0x10019630
mov dword [esp + 0x10], esi
dec dword [esp + 0xc]
jmp 0x10019608
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
sub edx, eax
mov eax, dword [esp + 0x10]
cmp edx, eax
setg cl
cmp ecx, 0x6aa55a69
jle 0x100198ae
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
xor edx, edx
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0xc]
cmp ecx, eax
setg dl
or eax, 0xffffffff
xor ecx, ecx
sub eax, edx
cmp eax, 0x9a6a
setle cl
sub ecx, dword [esp + 0x10]
add ecx, dword [esp + 0xc]
jne 0x100198ea
mov eax, ebx
cmp dword [esp + 0x20], ebx
je 0x100198ec
mov eax, esi
mov dword [esp + 0xc], eax
lea ecx, [esp + 0x204]
push 3
call fcn.1001ae5e
mov dword [esp + 0x2c4], 8
mov dword [esp + 0xc], ebx
jmp 0x1001991e
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x130], ebx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x1001990f
mov dword [esp + 0xc], ebx
jmp 0x10019941
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x204]
mov dword [eax + ecx*4], 0xbea5
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x1001992b
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10019960
push ebx
push 0x799
push ebx
call dword [sym.imp.GDI32.dll_GetEnhMetaFileHeader]
mov dword [esp + 0x130], 0xffffffef
jmp 0x10019a10
push 3
lea ecx, [esp + 0x1e4]
call fcn.1001ae5e
mov dword [esp + 0x18], 0xd8cb4c23
mov dword [esp + 0x18], ebx
jmp 0x100199a2
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1e0]
mov dword [eax + ecx*4], 0x2bb11acc
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jl 0x1001998c
mov dword [esp + 0x18], 2
cmp dword [esp + 0x18], ebx
jl 0x100199fd
mov dword [esp + 0x10], 7
mov dword [esp + 0x10], ebx
jmp 0x100199f0
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x100199e8
push 0xf5e
push ebx
push ebx
push 0x2677
push ebx
push 0x25ad
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov eax, dword [esp + 0x10]
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jle 0x100199c5
dec dword [esp + 0x18]
jns 0x100199b7
lea ecx, [esp + 0x1e0]
call fcn.1001b9e4
inc dword [esp + 0x130]
cmp dword [esp + 0x130], 0x15
jl 0x10019970
or dword [esp + 0x2c4], 0xffffffff
lea ecx, [esp + 0x204]
call fcn.1001b9e4
push esi
lea ecx, [esp + 0x88]
call fcn.1001ae5e
mov dword [esp + 0x2c4], 9
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0xc], ebx
jmp 0x10019a6b
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0xac], 0xfffffffe
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x10019a58
mov dword [esp + 0xc], ebx
jmp 0x10019a8b
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x84]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x10019a78
mov eax, dword [esp + 0x84]
mov dword [eax], 2
push dword [esp + 0x58]
lea eax, [esp + 0x22c]
mov dword [esp + 0xf0], ebx
push eax
lea eax, [esp + 0x220]
mov dword [esp + 0xf8], ebx
push eax
xorps xmm0, xmm0
mov dword [esp + 0x100], ebx
push ebx
lea ecx, [esp + 0xfc]
movdqu xmmword [esp + 0x228], xmm0
call fcn.10020824
mov dword [esp + 0x28], 0x1e283d1f
mov dword [esp + 0x18], ebx
jmp 0x10019b01
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x254], 0x14faf141
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jl 0x10019aee
mov esi, dword [esp + 0xec]
mov dword [esi + 8], 2
mov dword [esp + 0x28], 0xfffffff9
mov dword [esp + 0x18], ebx
jmp 0x10019b33
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x1c4], ebx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jl 0x10019b24
cmp dword [esi + 0xc], ebx
jne 0x10019b5c
mov eax, dword [esp + 0xb0]
mov dword [esp + 0x28], 1
mov eax, dword [esp + 0x28]
mov eax, dword [esi + 8]
mov eax, dword [esp + eax*4 + 0xac]
xor eax, eax
cmp dword [esi + 8], 0x5878ed7c
setl al
mov dword [esp + 0x28], eax
imul eax, dword [esp + 0x28], 0xd683
neg eax
sbb eax, eax
inc eax
imul ecx, eax, 0xb051
mov dword [esp + 0x1c8], eax
mov eax, dword [esp + 0x84]
mov dword [esp + 0x258], ecx
mov eax, dword [eax]
mov edx, dword [esp + eax*4 + 0xac]
xor eax, eax
cmp ecx, 0x63d1
setne al
xor ecx, ecx
cmp edx, eax
mov eax, dword [esi + 8]
setne cl
xor edx, edx
cmp ecx, dword [esi + 4]
mov eax, dword [esp + eax*4 + 0xac]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x84]
setg cl
mov dword [esp + 0x2c], ecx
xor ecx, ecx
mov edx, dword [eax]
mov eax, dword [esp + edx*4 + 0xac]
cmp dword [esp + 0x2c], eax
setge cl
xor eax, eax
add ecx, edx
cmp ecx, edx
setge al
imul eax, dword [esi + 8]
dec dword [esi + 8]
mov dword [esp + edx*4 + 0xac], eax
jns 0x10019b16
lea ecx, [esp + 0xec]
call fcn.1001b9e4
mov eax, dword [esp + 0x84]
dec dword [eax]
jns 0x10019a9e
mov dword [esp + 0x2c], 0x153c
cmp dword [esp + 0x2c], 0x126a
jge 0x10019cbe
lea eax, [esp + 0x108]
push eax
push ecx
lea eax, [esp + 0xe0]
mov ecx, 0x10666be8
push eax
call fcn.1001a4ac
pop ecx
mov ecx, eax
call fcn.1001a4ac
mov ecx, dword [esp + 0x108]
mov eax, ecx
movsd xmm3, qword [0x100089b0]
test ecx, ecx
jns 0x10019c6d
neg eax
movsd xmm1, qword [0x100089a8]
movapd xmm2, xmm1
test al, 1
je 0x10019c85
movapd xmm0, xmm3
mulsd xmm2, xmm0
shr eax, 1
je 0x10019c93
movapd xmm0, xmm3
mulsd xmm3, xmm0
jmp 0x10019c79
test ecx, ecx
jns 0x10019c9d
divsd xmm1, xmm2
jmp 0x10019ca1
movapd xmm1, xmm2
movd xmm0, dword [esp + 0xd8]
cvtdq2pd xmm0, xmm0
mulsd xmm1, xmm0
call fcn.1001ac0a
push eax
call fcn.1001f776
pop ecx
mov dword [esp + 0x10], ebx
jmp 0x10019cfa
mov dword [esp + 0x18], 0x9d073d4c
mov dword [esp + 0x18], 0xffffffe8
jmp 0x10019cef
mov eax, dword [esp + 0x84]
mov dword [esp + 0x2c], 0xfd0fe1f2
mov eax, dword [eax]
mov dword [esp + 0x2c], eax
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0x13
jg 0x10019cd6
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 8
jne 0x10019cc4
or dword [esp + 0x2c4], 0xffffffff
lea ecx, [esp + 0x84]
call fcn.1001b9e4
cmp dword [esp + 0xcc], 0
je 0x1001a017
mov dword [esp + 0x18], 0xe76f5020
mov dword [esp + 0x18], ebx
jmp 0x10019d44
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x13c], 0xc85f
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 1
jl 0x10019d31
mov dword [esp + 0x18], ebx
cmp dword [esp + 0x18], ebx
jl 0x10019de6
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10019dcf
mov dword [esp + 0x2c], 0x2188
cmp dword [esp + 0x2c], 0x70e
jge 0x10019dc3
lea eax, [esp + 0x140]
mov esi, 0x100081e8
push eax
push esi
call fcn.1005d64b
pop ecx
pop ecx
mov ecx, dword [esp + 0x140]
mov eax, ecx
and eax, 0x80000001
jns 0x10019da0
dec eax
or eax, 0xfffffffe
inc eax
je 0x10019dae
push 0x1000839c
call fcn.1005dee6
jmp 0x10019dc2
lea eax, [ecx - 1]
cdq
and edx, 3
add eax, edx
sar eax, 2
push eax
push esi
call fcn.1005dc93
pop ecx
pop ecx
push ebx
push 0x17da
call dword [sym.imp.USER32.dll_GetSystemMenu]
mov eax, dword [esp + 0x18]
cmp dword [esp + eax*4 + 0x13c], ebx
jne 0x10019de6
dec dword [esp + 0x18]
jns 0x10019d59
mov ecx, dword [esp + 0xcc]
call fcn.10018628
push dword [esp + 0x58]
movdqa xmm0, xmmword [0x10008b80]
lea ecx, [esp + 0x94]
mov edi, eax
mov dword [esp + 0x94], ebx
lea eax, [esp + 0x24c]
mov dword [esp + 0x98], ebx
push eax
lea eax, [esp + 0x240]
mov dword [esp + 0xa0], ebx
push eax
push ebx
movdqu xmmword [esp + 0x248], xmm0
call fcn.10020824
mov dword [esp + 0x2c4], 0xa
lea ecx, [esp + 0x154]
mov dword [esp + 0x10], 0xe948708e
push 4
call fcn.1001ae5e
mov dword [esp + 0x1c], 0x2ad21dd8
mov dword [esp + 0x18], ebx
jmp 0x10019e80
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x154]
mov dword [eax + ecx*4], 0x1f23
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 4
jl 0x10019e6a
mov edx, dword [esp + 0x90]
mov esi, dword [esp + 0x154]
mov dword [edx], ebx
mov eax, dword [edx]
mov dword [esp + 0x18], 0xa61e
mov dword [esp + 0x28], 0x735b263d
mov dword [esp + 0x10], eax
cmp dword [esp + 0x28], ebx
jne 0x10019edd
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x90]
mov eax, dword [eax + 8]
inc eax
cmp eax, 0xfffa
jne 0x10019edd
mov edx, ebx
jmp 0x10019ee0
xor edx, edx
inc edx
mov ecx, dword [esp + 0x18]
sub ecx, 0xb6f6
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, edx
setl al
imul eax, dword [esi + 0xc]
mov dword [esp + 0x10], eax
xor eax, eax
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x90]
add ecx, dword [edx]
cmp ecx, 0xcbde
setl al
dec dword [edx]
cmp dword [edx], 0xffffffea
mov dword [esp + 0x1c], eax
jne 0x10019e97
mov dword [esp + 0x10], 0xffffffe5
cmp dword [esp + 0x10], 0x13
je 0x10019feb
push 3
pop edx
mov dword [esp + 0x1c], ebx
jmp 0x10019fd2
cmp dword [esp + 0x1c], edx
jle 0x10019f44
lea ecx, [esp + 0x154]
call fcn.1001b9e4
or dword [esp + 0x2c4], 0xffffffff
lea ecx, [esp + 0x90]
call fcn.1001b9e4
lea eax, [esp + 0x50]
push eax
call fcn.1001b2e8
mov dword [eax], edi
push dword [esp + 0x58]
lea eax, [esp + 0x23c]
mov dword [esp + 0x1c], 0xde0980db
push eax
lea eax, [esp + 0x230]
mov dword [esp + 0x18], 0x9a8551b3
push eax
xorps xmm0, xmm0
mov dword [esp + 0x34], 0xffffffff
mov dword [esp + 0x3c], 0xfffffff7
lea ecx, [esp + 0x118]
push ebx
movdqu xmmword [esp + 0x238], xmm0
mov dword [esp + 0x11c], ebx
mov dword [esp + 0x120], ebx
mov dword [esp + 0x124], ebx
call fcn.10020824
push 0xfffffffffffffffd
pop edx
mov dword [esp + 0x28], edx
xor esi, esi
mov dword [esp + 0x28], 0xffffffff
inc esi
mov dword [esp + 0x34], 0xffffffff
mov dword [esp + 0x28], edx
mov dword [esp + 0x28], 0x5af849f
mov dword [esp + 0x2c], 0x402a53eb
mov dword [esp + 0xc], ebx
jmp 0x1001a0bd
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x38], 0xfffffffb
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x1001a0ad
mov dword [esp + 0xc], ebx
jmp 0x1001a0dc
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x288], 0xffffffff
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 4
jl 0x1001a0c9
cmp dword [esp + 0x18], ebx
je 0x1001a13b
mov eax, dword [esp + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
sub eax, dword [esp + 0x18]
imul ecx, eax, 0xfffd
mov eax, dword [esp + 0x18]
inc eax
neg eax
sbb eax, eax
inc eax
cmp eax, ecx
jl 0x1001a115
mov eax, esi
cmp dword [esp + 0x10], ebx
jne 0x1001a117
mov eax, ebx
mov dword [esp + 0x28], eax
mov ecx, esi
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x38]
cmp eax, dword [esp + 0x30]
jle 0x1001a13d
mov ecx, ebx
mov eax, dword [esp + 0x10c]
mov dword [eax + 4], ecx
mov ecx, esi
mov eax, dword [esp + 0x38]
sub ecx, eax
mov dword [esp + 0x28], ecx
xor ecx, ecx
mov eax, dword [esp + 0x38]
imul eax, dword [esp + 0x28]
cmp eax, edx
setge cl
mov dword [esp + 0x28], ecx
xor ecx, ecx
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
imul eax, dword [esp + 0x30]
imul eax, eax, 0x2743
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
cmp eax, 0xca62
mov eax, dword [esp + 0x38]
setge cl
xor edx, edx
imul ecx, eax
mov eax, dword [esp + 0x2c]
cmp ecx, eax
mov eax, dword [esp + 0x34]
sete dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [esp + 0x288], ecx
lea ecx, [esp + 0x10c]
call fcn.1001b9e4
lea ecx, [esp + 0xc8]
call fcn.100143ce
test edi, edi
je 0x1001a2c4
mov edx, dword [esp + 0x48]
mov ecx, edi
call fcn.10f5d000
mov dword [esp + 0x20], 0xef20
xor edi, edi
mov dword [esp + 0x48], 0x193208af
inc edi
mov dword [esp + 0x2c], edi
mov esi, eax
mov dword [esp + 0x68], 0xfffffffa
mov dword [esp + 0xdc], esi
mov dword [esp + 0xc], ebx
jmp 0x1001a229
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x6c], 0xa2b4
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x1001a219
mov dword [esp + 0xc], ebx
jmp 0x1001a249
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x260], 0x31fb
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x1001a236
cmp dword [esp + 0x20], ebx
je 0x1001a2af
mov eax, dword [esp + 0x6c]
xor edx, edx
mov eax, dword [esp + 0x70]
mov eax, dword [esp + 0x6c]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x260]
cmp eax, ecx
mov eax, dword [esp + 0x6c]
setge dl
cmp edi, edx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [esp + 0x6c]
mov ecx, dword [esp + 0x20]
sete dl
add eax, edx
xor edx, edx
add ecx, eax
mov eax, dword [esp + 0x48]
cmp ecx, 0xfffffffc
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, edi
setl cl
imul ecx, dword [esp + 0x2c]
test ecx, ecx
jne 0x1001a2b1
mov eax, ebx
mov dword [esp + 0x68], eax
lea eax, [esp + 0x7c]
push eax
call fcn.1001b286
mov dword [eax], esi
xor esi, esi
inc esi
push 6
pop eax
mov dword [esp + 0x1b4], eax
mov dword [esp + 0x1b8], eax
mov dword [esp + 0x1bc], eax
mov dword [esp + 0x1c0], eax
mov dword [esp + 0x28], 5
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], ebx
jmp 0x1001a304
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0xb8], ebx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 4
jl 0x1001a2f5
mov dword [esp + 0xbc], ebx
jmp 0x1001a383
mov dword [esp + 0x20], 0xc41fd9d0
mov dword [esp + 0x48], 0x6917ab6d
mov eax, dword [esp + 0x1bc]
inc eax
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0xbc]
mov eax, dword [esp + 0xbc]
add eax, dword [esp + 0xbc]
cmp eax, 0xfffffff7
mov eax, dword [esp + 0x20]
setne cl
xor edx, edx
cmp ecx, esi
setge dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [esp + 0x28], ecx
mov eax, dword [esp + 0x28]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x48], eax
inc dword [esp + 0xbc]
cmp dword [esp + 0xbc], 3
jle 0x1001a314
mov eax, dword [ebp + 8]
lea esi, [esp + 0xdc]
mov ecx, dword [esp + 0x2bc]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret