calc.asm
lawlrenz_crumble/crumble/examples/calc.asm

WNDCLASSEXW struc ; (sizeof=0x30, standard type) ; XREF: ...
cbSize dd ?
style dd ?
lpfnWndProc dd ?	; offset
cbClsExtra dd ?
cbWndExtra dd ?
hInstance dd ?		; offset
hIcon dd ?		; offset
hCursor	dd ?		; offset
hbrBackground dd ?	; offset
lpszMenuName dd	?	; offset
lpszClassName dd ?	; offset
hIconSm	dd ?		; offset
WNDCLASSEXW ends


tagRECT	struc ;	(sizeof=0x10, standard type) ; XREF: ...
left dd	?
top dd ?
right dd ?
bottom dd ?
tagRECT	ends


tagPOINT struc ; (sizeof=0x8, standard type) ; XREF: ...
x dd ?
y dd ?
tagPOINT ends


_SCOPETABLE_ENTRY struc	; (sizeof=0xC) ; XREF: ...
EnclosingLevel dd ?
FilterFunc dd ?		; offset
HandlerFunc dd ?	; offset
_SCOPETABLE_ENTRY ends


CPPEH_RECORD struc ; (sizeof=0x18) ; XREF: ...
old_esp	dd ?		; XREF:	...
exc_ptr	dd ?		; XREF:	... ; offset
registration _EH3_EXCEPTION_REGISTRATION ? ; XREF: ...
CPPEH_RECORD ends


_EH3_EXCEPTION_REGISTRATION struc ; (sizeof=0x10, standard type) ; XREF: ...
Next dd	?		; offset
ExceptionHandler dd ?	; offset
ScopeTable dd ?		; offset
TryLevel dd ?		; XREF:	...
_EH3_EXCEPTION_REGISTRATION ends


_STARTUPINFOA struc ; (sizeof=0x44, standard type) ; XREF: ...
cb dd ?
lpReserved dd ?		; offset
lpDesktop dd ?		; offset
lpTitle	dd ?		; offset
dwX dd ?
dwY dd ?
dwXSize	dd ?
dwYSize	dd ?
dwXCountChars dd ?
dwYCountChars dd ?
dwFillAttribute	dd ?
dwFlags	dd ?
wShowWindow dw ?	; XREF:	...
cbReserved2 dw ?
lpReserved2 dd ?	; offset
hStdInput dd ?		; offset
hStdOutput dd ?		; offset
hStdError dd ?		; offset
_STARTUPINFOA ends


_msExcept7 struc ; (sizeof=0x1C) ; XREF: ...
Magic dd ?		; base 16
Count dd ?		; base 10
InfoPtr	dd ?		; offset
CountDtr dd ?		; base 10
DtrPtr dd ?		; offset
_unk dd	2 dup(?)
_msExcept7 ends


_msExcInfo struc ; (sizeof=0x8)	; XREF:	...
Id dd ?			; base 10
Proc dd	?		; offset
_msExcInfo ends


_msExcExt struc	; (sizeof=0x14)	; XREF:	...
_unk dd	3 dup(?)
Count dd ?		; base 10
RttiBlkPtr dd ?		; offset
_msExcExt ends


_msRttiDscr struc ; (sizeof=0x10) ; XREF: ...
_unk dd	?		; base 16
RttiPtr	dd ?		; offset
spoff dd ?		; base 10
Dtr dd ?		; offset
_msRttiDscr ends


_ms_type_info struc ; (sizeof=0x8, variable size) ; XREF: ...
getInfoPtr dq ?		; offset
Name db	0 dup(?)	; string(C)
_ms_type_info ends


;
; +-------------------------------------------------------------------------+
; |   This file	has been generated by The Interactive Disassembler (IDA)    |
; |	      Copyright	(c) 2013 Hex-Rays, <support@hex-rays.com>	    |
; |			 License info: 48-3215-7394-8A			    |
; |  Universitaet Bonn/	Institut fuer Informatik Abteilung fuer	Informati   |
; +-------------------------------------------------------------------------+
;
; Input	MD5   :	829E4805B0E12B383EE09ABDC9E2DC3C
; Input	CRC32 :	E5607793

; File Name   :	Y:\binaries\calc.exe
; Format      :	Portable executable for	80386 (PE)
; Imagebase   :	1000000
; Section 1. (virtual address 00001000)
; Virtual size			: 000126B0 (  75440.)
; Section size in file		: 00012800 (  75776.)
; Offset to raw	data for section: 00000400
; Flags	60000020: Text Executable Readable
; Alignment	: default
;
; Imports from ADVAPI32.dll
;

include	uni.inc	; see unicode subdir of	ida for	info on	unicode

.686p
.mmx
.model flat


; Segment type:	Externs
; _idata
; LSTATUS __stdcall RegOpenKeyExA(HKEY hKey, LPCSTR lpSubKey, DWORD ulOptions, REGSAM samDesired, PHKEY	phkResult)
extrn RegOpenKeyExA:dword
; LSTATUS __stdcall RegQueryValueExA(HKEY hKey,	LPCSTR lpValueName, LPDWORD lpReserved,	LPDWORD	lpType,	LPBYTE lpData, LPDWORD lpcbData)
extrn RegQueryValueExA:dword
; LSTATUS __stdcall RegCloseKey(HKEY hKey)
extrn RegCloseKey:dword

;
; Imports from GDI32.dll
;
; COLORREF __stdcall SetBkColor(HDC hdc, COLORREF color)
extrn SetBkColor:dword
; COLORREF __stdcall SetTextColor(HDC hdc, COLORREF color)
extrn SetTextColor:dword
; int __stdcall	SetBkMode(HDC hdc, int mode)
extrn SetBkMode:dword

;
; Imports from KERNEL32.dll
;
; HMODULE __stdcall GetModuleHandleA(LPCSTR lpModuleName)
extrn GetModuleHandleA:dword
; HMODULE __stdcall LoadLibraryA(LPCSTR	lpLibFileName)
extrn LoadLibraryA:dword
; FARPROC __stdcall GetProcAddress(HMODULE hModule, LPCSTR lpProcName)
extrn GetProcAddress:dword
; SIZE_T __stdcall GlobalCompact(DWORD dwMinFree)
extrn GlobalCompact:dword
; HGLOBAL __stdcall GlobalAlloc(UINT uFlags, SIZE_T dwBytes)
extrn GlobalAlloc:dword
; HGLOBAL __stdcall GlobalFree(HGLOBAL hMem)
extrn GlobalFree:dword
; HGLOBAL __stdcall GlobalReAlloc(HGLOBAL hMem,	SIZE_T dwBytes,	UINT uFlags)
extrn GlobalReAlloc:dword
; int __stdcall	lstrcmpW(LPCWSTR lpString1, LPCWSTR lpString2)
extrn lstrcmpW:dword
; void __stdcall Sleep(DWORD dwMilliseconds)
extrn Sleep:dword
; BOOL __stdcall WriteProfileStringW(LPCWSTR lpAppName,	LPCWSTR	lpKeyName, LPCWSTR lpString)
extrn WriteProfileStringW:dword
; void __stdcall GetStartupInfoA(LPSTARTUPINFOA	lpStartupInfo)
extrn GetStartupInfoA:dword
; SIZE_T __stdcall GlobalSize(HGLOBAL hMem)
extrn GlobalSize:dword
; BOOL __stdcall GlobalUnlock(HGLOBAL hMem)
extrn GlobalUnlock:dword
; HANDLE __stdcall CreateEventW(LPSECURITY_ATTRIBUTES lpEventAttributes, BOOL bManualReset, BOOL bInitialState,	LPCWSTR	lpName)
extrn CreateEventW:dword
; HANDLE __stdcall CreateThread(LPSECURITY_ATTRIBUTES lpThreadAttributes, SIZE_T dwStackSize, LPTHREAD_START_ROUTINE lpStartAddress, LPVOID lpParameter, DWORD dwCreationFlags,	LPDWORD	lpThreadId)
extrn CreateThread:dword
; BOOL __stdcall ResetEvent(HANDLE hEvent)
extrn ResetEvent:dword
; LPWSTR __stdcall lstrcpynW(LPWSTR lpString1, LPCWSTR lpString2, int iMaxLength)
extrn lstrcpynW:dword
; BOOL __stdcall SetEvent(HANDLE hEvent)
extrn SetEvent:dword
; DWORD	__stdcall WaitForSingleObject(HANDLE hHandle, DWORD dwMilliseconds)
extrn WaitForSingleObject:dword
; BOOL __stdcall CloseHandle(HANDLE hObject)
extrn CloseHandle:dword
; LPWSTR __stdcall lstrcatW(LPWSTR lpString1, LPCWSTR lpString2)
extrn lstrcatW:dword
; int __stdcall	lstrlenW(LPCWSTR lpString)
extrn lstrlenW:dword
; HLOCAL __stdcall LocalReAlloc(HLOCAL hMem, SIZE_T uBytes, UINT uFlags)
extrn LocalReAlloc:dword
; HLOCAL __stdcall LocalFree(HLOCAL hMem)
extrn LocalFree:dword
; HLOCAL __stdcall LocalAlloc(UINT uFlags, SIZE_T uBytes)
extrn LocalAlloc:dword
; DWORD	__stdcall GetProfileStringW(LPCWSTR lpAppName, LPCWSTR lpKeyName, LPCWSTR lpDefault, LPWSTR lpReturnedString, DWORD nSize)
extrn GetProfileStringW:dword
; LPVOID __stdcall GlobalLock(HGLOBAL hMem)
extrn GlobalLock:dword
; LPWSTR __stdcall GetCommandLineW()
extrn GetCommandLineW:dword
; LPWSTR __stdcall lstrcpyW(LPWSTR lpString1, LPCWSTR lpString2)
extrn lstrcpyW:dword
; UINT __stdcall GetProfileIntW(LPCWSTR	lpAppName, LPCWSTR lpKeyName, INT nDefault)
extrn GetProfileIntW:dword

;
; Imports from SHELL32.dll
;
; INT __stdcall	ShellAboutW(HWND hWnd, LPCWSTR szApp, LPCWSTR szOtherStuff, HICON hIcon)
extrn ShellAboutW:dword

;
; Imports from USER32.dll
;
; HMENU	__stdcall GetMenu(HWND hWnd)
extrn GetMenu:dword
; BOOL __stdcall SetDlgItemInt(HWND hDlg, int nIDDlgItem, UINT uValue, BOOL bSigned)
extrn SetDlgItemInt:dword
; int __stdcall	GetWindowTextW(HWND hWnd, LPWSTR lpString, int nMaxCount)
extrn GetWindowTextW:dword
; BOOL __stdcall CheckDlgButton(HWND hDlg, int nIDButton, UINT uCheck)
extrn CheckDlgButton:dword
; BOOL __stdcall HideCaret(HWND	hWnd)
extrn HideCaret:dword
; LRESULT __stdcall CallWindowProcW(WNDPROC lpPrevWndFunc, HWND	hWnd, UINT Msg,	WPARAM wParam, LPARAM lParam)
extrn CallWindowProcW:dword
; int __stdcall	DrawTextW(HDC hdc, LPCWSTR lpchText, int cchText, LPRECT lprc, UINT format)
extrn DrawTextW:dword
; BOOL __stdcall WinHelpW(HWND hWndMain, LPCWSTR lpszHelp, UINT	uCommand, ULONG_PTR dwData)
extrn WinHelpW:dword
; void __stdcall PostQuitMessage(int nExitCode)
extrn PostQuitMessage:dword
; int __stdcall	GetDlgCtrlID(HWND hWnd)
extrn GetDlgCtrlID:dword
; BOOL __stdcall ScreenToClient(HWND hWnd, LPPOINT lpPoint)
extrn ScreenToClient:dword
; HWND __stdcall ChildWindowFromPoint(HWND hWndParent, POINT Point)
extrn ChildWindowFromPoint:dword
; LRESULT __stdcall DefWindowProcW(HWND	hWnd, UINT Msg,	WPARAM wParam, LPARAM lParam)
extrn DefWindowProcW:dword
; BOOL __stdcall IsClipboardFormatAvailable(UINT format)
extrn IsClipboardFormatAvailable:dword
; BOOL __stdcall EnableMenuItem(HMENU hMenu, UINT uIDEnableItem, UINT uEnable)
extrn EnableMenuItem:dword
; BOOL __stdcall TrackPopupMenuEx(HMENU, UINT, int, int, HWND, LPTPMPARAMS)
extrn TrackPopupMenuEx:dword
; HWND __stdcall GetDesktopWindow()
extrn GetDesktopWindow:dword
; BOOL __stdcall OpenClipboard(HWND hWndNewOwner)
extrn OpenClipboard:dword
; HANDLE __stdcall GetClipboardData(UINT uFormat)
extrn GetClipboardData:dword
; LPSTR	__stdcall CharNextA(LPCSTR lpsz)
extrn CharNextA:dword
; BOOL __stdcall CloseClipboard()
extrn CloseClipboard:dword
; DWORD	__stdcall GetSysColor(int nIndex)
extrn GetSysColor:dword
; INT_PTR __stdcall DialogBoxParamW(HINSTANCE hInstance, LPCWSTR lpTemplateName, HWND hWndParent, DLGPROC lpDialogFunc,	LPARAM dwInitParam)
extrn DialogBoxParamW:dword
; BOOL __stdcall EndDialog(HWND	hDlg, INT_PTR nResult)
extrn EndDialog:dword
; BOOL __stdcall MessageBeep(UINT uType)
extrn MessageBeep:dword
; HMENU	__stdcall GetSubMenu(HMENU hMenu, int nPos)
extrn GetSubMenu:dword
; BOOL __stdcall CheckRadioButton(HWND hDlg, int nIDFirstButton, int nIDLastButton, int	nIDCheckButton)
extrn CheckRadioButton:dword
; BOOL __stdcall SetWindowTextW(HWND hWnd, LPCWSTR lpString)
extrn SetWindowTextW:dword
; HWND __stdcall SetFocus(HWND hWnd)
extrn SetFocus:dword
; HCURSOR __stdcall SetCursor(HCURSOR hCursor)
extrn SetCursor:dword
; LPWSTR __stdcall CharNextW(LPCWSTR lpsz)
extrn CharNextW:dword
; ATOM __stdcall RegisterClassExW(const	WNDCLASSEXW *)
extrn RegisterClassExW:dword
; HBRUSH __stdcall GetSysColorBrush(int	nIndex)
extrn GetSysColorBrush:dword
; HCURSOR __stdcall LoadCursorW(HINSTANCE hInstance, LPCWSTR lpCursorName)
extrn LoadCursorW:dword
; HICON	__stdcall LoadIconW(HINSTANCE hInstance, LPCWSTR lpIconName)
extrn LoadIconW:dword
; BOOL __stdcall InvalidateRect(HWND hWnd, const RECT *lpRect, BOOL bErase)
extrn InvalidateRect:dword
; BOOL __stdcall UpdateWindow(HWND hWnd)
extrn UpdateWindow:dword
; BOOL __stdcall ShowWindow(HWND hWnd, int nCmdShow)
extrn ShowWindow:dword
; LRESULT __stdcall SendMessageW(HWND hWnd, UINT Msg, WPARAM wParam, LPARAM lParam)
extrn SendMessageW:dword
; BOOL __stdcall SetDlgItemTextW(HWND hDlg, int	nIDDlgItem, LPCWSTR lpString)
extrn SetDlgItemTextW:dword
; DWORD	__stdcall CheckMenuItem(HMENU hMenu, UINT uIDCheckItem,	UINT uCheck)
extrn CheckMenuItem:dword
; BOOL __stdcall CheckMenuRadioItem(HMENU hmenu, UINT first, UINT last,	UINT check, UINT flags)
extrn CheckMenuRadioItem:dword
; BOOL __stdcall SetWindowPos(HWND hWnd, HWND hWndInsertAfter, int X, int Y, int cx, int cy, UINT uFlags)
extrn SetWindowPos:dword
; BOOL __stdcall OffsetRect(LPRECT lprc, int dx, int dy)
extrn OffsetRect:dword
; int __stdcall	MapWindowPoints(HWND hWndFrom, HWND hWndTo, LPPOINT lpPoints, UINT cPoints)
extrn MapWindowPoints:dword
; BOOL __stdcall GetClientRect(HWND hWnd, LPRECT lpRect)
extrn GetClientRect:dword
; BOOL __stdcall EnableWindow(HWND hWnd, BOOL bEnable)
extrn EnableWindow:dword
; HMENU	__stdcall LoadMenuW(HINSTANCE hInstance, LPCWSTR lpMenuName)
extrn LoadMenuW:dword
; LONG __stdcall SetWindowLongW(HWND hWnd, int nIndex, LONG dwNewLong)
extrn SetWindowLongW:dword
; LONG __stdcall GetWindowLongW(HWND hWnd, int nIndex)
extrn GetWindowLongW:dword
; HWND __stdcall CreateDialogParamW(HINSTANCE hInstance, LPCWSTR lpTemplateName, HWND hWndParent, DLGPROC lpDialogFunc,	LPARAM dwInitParam)
extrn CreateDialogParamW:dword
; HWND __stdcall GetDlgItem(HWND hDlg, int nIDDlgItem)
extrn GetDlgItem:dword
; BOOL __stdcall DestroyMenu(HMENU hMenu)
extrn DestroyMenu:dword
; BOOL __stdcall DestroyWindow(HWND hWnd)
extrn DestroyWindow:dword
; BOOL __stdcall SetMenu(HWND hWnd, HMENU hMenu)
extrn SetMenu:dword
; BOOL __stdcall GetWindowRect(HWND hWnd, LPRECT lpRect)
extrn GetWindowRect:dword
; BOOL __stdcall SystemParametersInfoW(UINT uiAction, UINT uiParam, PVOID pvParam, UINT	fWinIni)
extrn SystemParametersInfoW:dword
; LRESULT __stdcall DispatchMessageW(const MSG *lpMsg)
extrn DispatchMessageW:dword
; BOOL __stdcall TranslateMessage(const	MSG *lpMsg)
extrn TranslateMessage:dword
; int __stdcall	TranslateAcceleratorW(HWND hWnd, HACCEL	hAccTable, LPMSG lpMsg)
extrn TranslateAcceleratorW:dword
; BOOL __stdcall IsChild(HWND hWndParent, HWND hWnd)
extrn IsChild:dword
; BOOL __stdcall IsDialogMessageW(HWND hDlg, LPMSG lpMsg)
extrn IsDialogMessageW:dword
; BOOL __stdcall GetMessageW(LPMSG lpMsg, HWND hWnd, UINT wMsgFilterMin, UINT wMsgFilterMax)
extrn GetMessageW:dword
; HACCEL __stdcall LoadAcceleratorsW(HINSTANCE hInstance, LPCWSTR lpTableName)
extrn LoadAcceleratorsW:dword
; HWND __stdcall CreateWindowExW(DWORD dwExStyle, LPCWSTR lpClassName, LPCWSTR lpWindowName, DWORD dwStyle, int	X, int Y, int nWidth, int nHeight, HWND	hWndParent, HMENU hMenu, HINSTANCE hInstance, LPVOID lpParam)
extrn CreateWindowExW:dword
; int __stdcall	MessageBoxW(HWND hWnd, LPCWSTR lpText, LPCWSTR lpCaption, UINT uType)
extrn MessageBoxW:dword
; int __stdcall	LoadStringW(HINSTANCE hInstance, UINT uID, LPWSTR lpBuffer, int	cchBufferMax)
extrn LoadStringW:dword
; BOOL __stdcall SetProcessDefaultLayout(DWORD dwDefaultLayout)
extrn SetProcessDefaultLayout:dword
; BOOL __stdcall GetProcessDefaultLayout(DWORD *pdwDefaultLayout)
extrn GetProcessDefaultLayout:dword

;
; Imports from msvcrt.dll
;
extrn __imp___CxxFrameHandler:dword
extrn __imp__CxxThrowException:dword
; unsigned __int32 __cdecl wcstoul(const wchar_t *Str, wchar_t **EndPtr, int Radix)
extrn wcstoul:dword
; int __cdecl toupper(int C)
extrn toupper:dword
; wchar_t *__cdecl wcschr(const	wchar_t	*Str, wchar_t Ch)
extrn wcschr:dword
; void *__cdecl	memmove(void *Dst, const void *Src, size_t Size)
extrn memmove:dword
; size_t __cdecl wcslen(const wchar_t *Str)
extrn wcslen:dword
; wchar_t *__cdecl wcsrev(wchar_t *Str)
extrn _wcsrev:dword
; void __cdecl c_exit()
extrn _c_exit:dword
; void __cdecl exit(int	Code)
extrn _exit:dword
extrn __imp__XcptFilter:dword
; void __cdecl cexit()
extrn _cexit:dword
; void __cdecl exit(int	Code)
extrn exit:dword
extrn _acmdln:dword
extrn __getmainargs:dword
extrn __imp__initterm:dword
extrn __setusermatherr:dword
extrn _adjust_fdiv:dword
extrn __p__commode:dword
extrn __p__fmode:dword
extrn __set_app_type:dword
; __declspec(dllimport)	void __cdecl operator delete(void *)
extrn __imp_??3@YAXPAX@Z:dword
; __declspec(dllimport)	public:	virtual	__thiscall type_info::~type_info(void)
extrn __imp_??1type_info@@UAE@XZ:dword
; unsigned int __cdecl _controlfp(unsigned int NewValue, unsigned int Mask)
extrn __imp__controlfp:dword
extrn __imp__except_handler3:dword
; __declspec(dllimport)	void __cdecl terminate(void)
extrn __imp_?terminate@@YAXXZ:dword



; Segment type:	Pure code
; Segment permissions: Read/Execute
_text segment para public 'CODE' use32
assume cs:_text
;org 1001228h
assume es:nothing, ss:nothing, ds:_data, fs:nothing, gs:nothing
dword_1001228 dd 0
dword_100122C dd 0
dword_1001230 dd 0
dword_1001234 dd 4 dup(0)
dd 3B7D8410h, 0
dd 2, 19h, 160Ch, 0A0Ch
; const	WCHAR IconName
IconName:
unicode	0, <SC>,0
align 4
; const	WCHAR aM
aM:
unicode	0, < M>,0
align 4
; const	WCHAR aSgrouping
aSgrouping:
unicode	0, <sGrouping>,0
; const	WCHAR a30
a30:
unicode	0, <3;0>,0
; const	WCHAR aSthousand
aSthousand:
unicode	0, <sThousand>,0
; const	WCHAR asc_100129C
asc_100129C:
unicode	0, <,>,0
; const	WCHAR AppName
AppName:
unicode	0, <intl>,0
align 4
; const	WCHAR KeyName
KeyName:
unicode	0, <sDecimal>,0
align 10h
; const	WCHAR Default
Default:
unicode	0, <.>,0
; const	WCHAR aUsesep
aUsesep:
unicode	0, <UseSep>,0
align 4
; const	WCHAR aLayout
aLayout:
unicode	0, <layout>,0
align 4
; const	WCHAR ClassName
ClassName:
unicode	0, <EDIT>,0
align 10h
; const	WCHAR WindowName
WindowName:
unicode	0, <CalcMsgPumpWnd>,0
align 10h
; const	WCHAR a0
a0:
unicode	0, <0>,0
; const	WCHAR asc_1001314
asc_1001314:
unicode	0, <(=>,0
align 4
; const	WCHAR Text
Text:
unicode	0, <An unknown error has occure>
unicode	0, <d.>,0
; const	WCHAR Caption
Caption:
unicode	0, <Error>,0
; const	WCHAR word_1001364
word_1001364 dw	20h
align 4
dword_1001368 dd 30h
word_100136C dw	7Ch
align 10h
dd 31h,	7Dh, 32h, 7Eh, 33h, 7Fh, 34h, 80h
dd 35h,	81h, 36h, 82h, 37h, 83h, 38h, 84h
dd 39h,	85h, 41h, 86h, 42h, 87h, 43h, 88h
dd 44h,	89h, 45h, 8Ah, 46h, 8Bh, 21h, 6Ah
dd 53h,	62h, 4Fh, 63h, 54h, 64h, 52h, 6Bh
dd 59h,	5Fh, 23h, 69h, 40h, 68h, 4Dh, 13Ah
dd 4Eh,	65h, 4Ch, 66h, 56h, 6Eh, 58h, 75h
dd 49h,	8Ch, 48h, 8Dh, 50h, 6Fh, 2Fh, 5Ah
dd 2Ah,	5Bh, 25h, 5Eh, 2Dh, 5Dh, 3Dh, 70h
dd 2Bh,	5Ch, 26h, 56h, 7Ch, 57h, 5Eh, 58h
dd 7Eh,	61h, 3Bh, 60h, 3Ch, 59h, 28h, 7Ah
dd 29h,	7Bh, 5Ch, 79h, 2 dup(51h), 0D1h
dd 51h,	0D3h, 54h, 0CDh, 73h, 0D0h, 74h
dd 0C3h, 71h, 0D2h, 72h, 0C1h, 76h, 0D4h
dd 77h,	0C4h, 78h, 0B2h, 137h, 0B3h, 13Bh
dd 0B4h, 13Ch, 0B5h, 132h, 0B6h, 133h, 0B7h
dd 134h, 0B8h, 135h, 0B9h, 50h,	0BCh, 136h
dword_1001578 dd 30h
; const	WCHAR word_100157C
word_100157C dw	31h
align 10h
; const	WCHAR aColors
aColors:
unicode	0, <colors>,0
align 10h
; char LibFileName[]
LibFileName db 'hhctrl.ocx',0
align 10h
; char SubKey[]
SubKey db 'CLSID\{ADB880A6-D8FF-11CF-9377-00AA'
db '003B7A11}\InprocServer32',0
; char ValueName[4]
ValueName db 4 dup(0)
stru_10015E0 _SCOPETABLE_ENTRY <0FFFFFFFFh, \ ;	SEH scope table	for function 1012475
		   offset loc_1012602, \
		   offset loc_1012616>
off_10015EC dd offset sub_1012676
stru_10015F0 _SCOPETABLE_ENTRY <0FFFFFFFFh, \ ;	SEH scope table	for function 1012818
		   offset loc_1012847, \
		   offset loc_101286B>
align 10h
stru_1001600 _SCOPETABLE_ENTRY <0FFFFFFFFh, 0, \ ; SEH scope table for function	1012876
		   offset loc_10128BE>
aNb10 db 'NB10',0
align 4
dd 3B7D8410h, 1, 636C6163h, 6264702Eh, 3 dup(0)



; int __stdcall	sub_1001630(LPCWSTR lpsz, int)
sub_1001630 proc near

lpsz= dword ptr	 4
arg_4= dword ptr  8

mov	eax, [esp+lpsz]
push	esi
xor	esi, esi
jmp	short loc_1001652

loc_1001639:
cmp	cx, 39h
ja	short loc_100165B
movzx	ecx, cx
lea	edx, [esi+esi*4]
push	eax		; lpsz
lea	esi, [ecx+edx*2-30h]
call	ds:CharNextW
xor	ecx, ecx

loc_1001652:
mov	cx, [eax]
cmp	cx, 30h
jnb	short loc_1001639

loc_100165B:
mov	ecx, [esp+4+arg_4]
mov	[ecx], esi
pop	esi
retn	8
sub_1001630 endp




sub_1001665 proc near
push	esi
push	edi
call	ds:GetCommandLineW
mov	esi, ds:CharNextW
jmp	short loc_1001684

loc_1001675:
cmp	cx, 20h
jz	short loc_1001681
cmp	cx, 9
jnz	short loc_100168C

loc_1001681:		; lpsz
push	eax
call	esi ; CharNextW

loc_1001684:
mov	cx, [eax]
test	cx, cx
jnz	short loc_1001675

loc_100168C:
mov	cx, [eax]
xor	edi, edi
test	cx, cx
jz	loc_10017C2

loc_100169A:
test	edi, edi
jnz	short loc_10016AA
cmp	cx, 20h
jz	short loc_10016C4
cmp	cx, 9
jz	short loc_10016C4

loc_10016AA:
cmp	cx, 22h
jnz	short loc_10016B9
xor	ecx, ecx
test	edi, edi
setz	cl
mov	edi, ecx

loc_10016B9:		; lpsz
push	eax
call	esi ; CharNextW
mov	cx, [eax]
test	cx, cx
jnz	short loc_100169A

loc_10016C4:
mov	cx, [eax]
test	cx, cx
jz	loc_10017C2
push	2
pop	edi

loc_10016D3:
movzx	ecx, cx
sub	ecx, 50h
jz	loc_100178A
sub	ecx, edi
jz	short loc_100173F
sub	ecx, 5
jz	short loc_1001712
sub	ecx, 19h
jz	loc_100178A
sub	ecx, edi
jz	short loc_100173F
sub	ecx, 5
jnz	loc_10017B3
jmp	short loc_1001712

loc_1001700:
cmp	cx, 3Ah
jz	short loc_1001712
cmp	cx, 20h
jz	short loc_1001712
cmp	cx, 9
jnz	short loc_100171D

loc_1001712:		; lpsz
push	eax
call	esi ; CharNextW
mov	cx, [eax]
test	cx, cx
jnz	short loc_1001700

loc_100171D:		; int
push	offset dword_1014014
push	eax		; lpsz
call	sub_1001630
jmp	loc_10017B3

loc_100172D:
cmp	cx, 3Ah
jz	short loc_100173F
cmp	cx, 20h
jz	short loc_100173F
cmp	cx, 9
jnz	short loc_100174A

loc_100173F:		; lpsz
push	eax
call	esi ; CharNextW
mov	cx, [eax]
test	cx, cx
jnz	short loc_100172D

loc_100174A:		; int
push	offset dword_1014010
push	eax		; lpsz
call	sub_1001630
mov	ecx, dword_1014010
cmp	ecx, 10h
jle	short loc_100176C
mov	dword_1014010, 10h
jmp	short loc_10017B3

loc_100176C:
cmp	ecx, edi
jge	short loc_10017B3
mov	dword_1014010, edi
jmp	short loc_10017B3

loc_1001778:
cmp	cx, 3Ah
jz	short loc_100178A
cmp	cx, 20h
jz	short loc_100178A
cmp	cx, 9
jnz	short loc_1001795

loc_100178A:		; lpsz
push	eax
call	esi ; CharNextW
mov	cx, [eax]
test	cx, cx
jnz	short loc_1001778

loc_1001795:		; int
push	offset dword_1014008
push	eax		; lpsz
call	sub_1001630
cmp	dword_1014008, 40h
jle	short loc_10017B3
mov	dword_1014008, 40h

loc_10017B3:		; lpsz
push	eax
call	esi ; CharNextW
mov	cx, [eax]
test	cx, cx
jnz	loc_10016D3

loc_10017C2:
pop	edi
pop	esi
retn	4
sub_1001665 endp



; Attributes: bp-based frame

sub_10017C7 proc near

var_30=	WNDCLASSEXW ptr	-30h
arg_0= dword ptr  8

push	ebp
mov	ebp, esp
sub	esp, 30h
push	esi
xor	esi, esi
cmp	[ebp+arg_0], esi
jnz	short loc_1001845
mov	eax, hInstance
push	offset IconName	; "SC"
push	eax		; hInstance
mov	[ebp+var_30.cbSize], 30h
mov	[ebp+var_30.style], esi
mov	[ebp+var_30.lpfnWndProc], offset sub_1006118
mov	[ebp+var_30.cbClsExtra], esi
mov	[ebp+var_30.cbWndExtra], 1Eh
mov	[ebp+var_30.hInstance],	eax
call	ds:LoadIconW
push	7F00h		; lpCursorName
push	esi		; hInstance
mov	[ebp+var_30.hIcon], eax
call	ds:LoadCursorW
push	0Fh		; nIndex
mov	[ebp+var_30.hCursor], eax
call	ds:GetSysColorBrush
mov	[ebp+var_30.hbrBackground], eax
lea	eax, [ebp+var_30]
push	eax		; WNDCLASSEXW *
mov	[ebp+var_30.lpszMenuName], 6Ah
mov	[ebp+var_30.lpszClassName], offset aScicalc ; "SciCalc"
mov	[ebp+var_30.hIconSm], esi
call	ds:RegisterClassExW
test	ax, ax
jnz	short loc_1001845
xor	eax, eax
jmp	short loc_1001848

loc_1001845:
xor	eax, eax
inc	eax

loc_1001848:
pop	esi
leave
retn	4
sub_10017C7 endp




sub_100184D proc near
push	ebx
push	esi
push	edi
push	offset unk_1014DC0
call	sub_10021FF
push	dword_1014D90	; hMem
mov	dword_1014DB8, 1
call	sub_1007BD1
xor	ebx, ebx
mov	dword_1014D90, ebx
call	sub_1007C26
mov	dword_1014D90, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014D90
mov	[eax], ebx
mov	eax, dword_1014F84
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014D90
mov	[ecx], eax
mov	eax, dword_1014F84
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, dword_1014D90
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, dword_1014D90
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014D90
mov	[eax+4], ebx
mov	eax, dword_1014F84
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014D90
mov	[ecx+4], eax
mov	eax, dword_1014F84
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, dword_1014D90
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
push	dword_1014D98	; hMem
call	sub_1007BD1
mov	dword_1014D98, ebx
call	sub_1007C26
mov	dword_1014D98, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014D98
mov	[eax], ebx
mov	eax, dword_1014F84
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014D98
mov	[ecx], eax
mov	eax, dword_1014F84
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, dword_1014D98
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, dword_1014D98
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014D98
mov	[eax+4], ebx
mov	eax, dword_1014F84
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014D98
mov	[ecx+4], eax
mov	eax, dword_1014F84
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, dword_1014D98
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
push	19h
pop	ecx
xor	eax, eax
push	19h
mov	edi, offset dword_1014C08
rep stosd
pop	ecx
push	4		; uBytes
mov	edi, offset dword_1014C70
push	40h		; uFlags
rep stosd
call	ds:LocalAlloc
pop	edi
pop	esi
cmp	eax, ebx
mov	lpString, eax
pop	ebx
jz	short locret_1001A16
push	offset String2	; lpString2
push	eax		; lpString1
call	ds:lstrcpyW

locret_1001A16:
retn
sub_100184D endp



; Attributes: bp-based frame

; int __stdcall	sub_1001A17(int	hWnd)
sub_1001A17 proc near

EndPtr=	word ptr -80h
Points=	tagPOINT ptr -40h
var_38=	dword ptr -38h
Rect= tagRECT ptr -30h
rc= tagRECT ptr	-20h
var_10=	dword ptr -10h
var_C= dword ptr -0Ch
var_8= dword ptr -8
var_4= dword ptr -4
hWnd= dword ptr	 8

push	ebp
mov	ebp, esp
sub	esp, 80h
push	ebx
push	esi
xor	esi, esi
push	edi
mov	[ebp+var_4], esi
mov	[ebp+Rect.left], esi
mov	[ebp+Rect.top],	esi
mov	[ebp+Rect.right], esi
mov	[ebp+Rect.bottom], esi
call	sub_100184D
mov	eax, ReturnedString
push	5		; nSize
push	offset ReturnedString ;	lpReturnedString
mov	[ebp+var_10], eax
mov	eax, dword_1014038
push	offset Default	; "."
mov	[ebp+var_C], eax
mov	eax, dword_1014000
push	offset KeyName	; "sDecimal"
mov	dword_1014DB8, esi
mov	esi, ds:GetProfileStringW
mov	ebx, offset AppName ; "intl"
push	ebx		; lpAppName
mov	[ebp+var_8], eax
call	esi ; GetProfileStringW
push	5		; nSize
push	offset dword_1014038 ; lpReturnedString
push	offset asc_100129C ; ","
push	offset aSthousand ; "sThousand"
push	ebx		; lpAppName
call	esi ; GetProfileStringW
push	10h
pop	ecx
xor	eax, eax
push	20h		; nSize
lea	edi, [ebp+EndPtr]
rep stosd
lea	eax, [ebp+EndPtr]
push	eax		; lpReturnedString
push	offset a30	; "3;0"
push	offset aSgrouping ; "sGrouping"
push	ebx		; lpAppName
call	esi ; GetProfileStringW
lea	eax, [ebp+EndPtr]
push	eax		; EndPtr
call	sub_1004459
xor	esi, esi
inc	esi
cmp	eax, [ebp+var_8]
mov	dword_1014000, eax
jz	short loc_1001AC0
mov	[ebp+var_4], esi

loc_1001AC0:
mov	ax, word ptr [ebp+var_C]
cmp	word ptr dword_1014038,	ax
jz	short loc_1001AD0
mov	[ebp+var_4], esi

loc_1001AD0:
mov	eax, ReturnedString
cmp	ax, word ptr [ebp+var_10]
jz	short loc_1001AF3
mov	edi, eax
push	edi
push	offset unk_1014DC0
call	sub_1002597
mov	eax, dword_1014A64
mov	[eax], di
mov	[ebp+var_4], esi

loc_1001AF3:
push	0Ch
pop	eax
xor	edi, edi
push	edi		; fWinIni
lea	ecx, [ebp+rc.top]
push	ecx		; pvParam
push	eax		; uiParam
push	42h		; uiAction
mov	[ebp+rc.top], eax
call	ds:SystemParametersInfoW
test	eax, eax
jz	short loc_1001B22
mov	eax, [ebp+rc.right]
and	eax, esi
cmp	eax, dword_1014D9C
jz	short loc_1001B22
mov	dword_1014D9C, eax
mov	[ebp+var_4], esi

loc_1001B22:
cmp	[ebp+hWnd], edi
jz	loc_1001E2D
mov	eax, hWnd
cmp	eax, edi
mov	ebx, ds:GetWindowRect
mov	[ebp+var_4], edi
jz	short loc_1001B77
push	hMenu		; hMenu
push	eax		; hWnd
call	ds:SetMenu
lea	eax, [ebp+Rect]
push	eax		; lpRect
push	hWnd		; hWnd
mov	[ebp+var_4], esi
call	ebx ; GetWindowRect
push	hWnd		; hWnd
call	ds:DestroyWindow
push	dword_1014D7C	; hMenu
call	ds:DestroyMenu
mov	dword_1014D7C, edi

loc_1001B77:
cmp	dword_1014D48, edi
mov	esi, ds:GetDlgItem
push	edi		; dwInitParam
push	edi		; lpDialogFunc
push	edi		; hWndParent
jz	short loc_1001BDA
push	66h		; lpTemplateName
push	hInstance	; hInstance
call	ds:CreateDialogParamW
push	eax		; hWnd
mov	hWnd, eax
call	ds:GetMenu
cmp	dword_1014DA0, edi
mov	hMenu, eax
jz	loc_1001CF0
push	0FFFFFFECh	; nIndex
push	hWnd		; hWnd
call	ds:GetWindowLongW
or	eax, 500000h
push	eax		; dwNewLong
push	0FFFFFFECh	; nIndex
push	hWnd		; hWnd
call	ds:SetWindowLongW
jmp	loc_1001CF0

loc_1001BDA:		; lpTemplateName
push	65h
push	hInstance	; hInstance
call	ds:CreateDialogParamW
push	eax		; hWnd
mov	hWnd, eax
call	ds:GetMenu
push	6Ch		; lpMenuName
push	hInstance	; hInstance
mov	hMenu, eax
call	ds:LoadMenuW
cmp	dword_1014DA0, edi
mov	dword_1014D7C, eax
jz	short loc_1001C36
push	0FFFFFFECh	; nIndex
push	hWnd		; hWnd
call	ds:GetWindowLongW
or	eax, 500000h
push	eax		; dwNewLong
push	0FFFFFFECh	; nIndex
push	hWnd		; hWnd
call	ds:SetWindowLongW

loc_1001C36:
mov	[ebp+hWnd], 76h

loc_1001C3D:		; bEnable
push	edi
push	[ebp+hWnd]	; nIDDlgItem
push	hWnd		; hDlg
call	esi ; GetDlgItem
push	eax		; hWnd
call	ds:EnableWindow
inc	[ebp+hWnd]
cmp	[ebp+hWnd], 79h
jle	short loc_1001C3D
push	dword_1014D54	; int
push	bEnable		; bEnable
push	0Ah		; int
call	sub_1006626
cmp	dword_1014008, 20h
jle	short loc_1001CF0
push	193h		; nIDDlgItem
push	hWnd		; hDlg
call	esi ; GetDlgItem
lea	ecx, [ebp+rc]
push	ecx		; lpRect
push	eax		; hWnd
mov	[ebp+hWnd], eax
call	ebx ; GetWindowRect
lea	eax, [ebp+Points]
push	eax		; lpRect
push	hWnd		; hWnd
call	ds:GetClientRect
push	2		; cPoints
lea	eax, [ebp+Points]
push	eax		; lpPoints
push	edi		; hWndTo
push	hWnd		; hWndFrom
call	ds:MapWindowPoints
mov	ecx, [ebp+var_38]
sub	ecx, [ebp+rc.right]
mov	eax, [ebp+Points.x]
add	ecx, eax
mov	[ebp+rc.left], ecx
mov	ecx, [ebp+Points.y]
neg	ecx
push	ecx		; dy
neg	eax
push	eax		; dx
lea	eax, [ebp+rc]
push	eax		; lprc
call	ds:OffsetRect
mov	eax, [ebp+rc.bottom]
sub	eax, [ebp+rc.top]
push	14h		; uFlags
push	eax		; cy
mov	eax, [ebp+rc.right]
sub	eax, [ebp+rc.left]
push	eax		; cx
push	[ebp+rc.top]	; Y
push	[ebp+rc.left]	; X
push	edi		; hWndInsertAfter
push	[ebp+hWnd]	; hWnd
call	ds:SetWindowPos

loc_1001CF0:		; nIDDlgItem
push	193h
push	hWnd		; hDlg
call	esi ; GetDlgItem
mov	esi, eax
cmp	esi, edi
jz	short loc_1001D23
push	0FFFFFFFCh	; nIndex
push	esi		; hWnd
call	ds:GetWindowLongW
cmp	eax, edi
mov	lpPrevWndFunc, eax
jz	short loc_1001D23
push	offset sub_100652A ; dwNewLong
push	0FFFFFFFCh	; nIndex
push	esi		; hWnd
call	ds:SetWindowLongW

loc_1001D23:
cmp	[ebp+var_4], edi
jz	short loc_1001D3F
push	5		; uFlags
push	edi		; cy
push	edi		; cx
push	[ebp+Rect.top]	; Y
push	[ebp+Rect.left]	; X
push	edi		; hWndInsertAfter
push	hWnd		; hWnd
call	ds:SetWindowPos

loc_1001D3F:
mov	ebx, ds:CheckMenuRadioItem
xor	eax, eax
cmp	dword_1014D48, edi
push	edi		; flags
setnz	al
mov	esi, 130h
add	eax, esi
push	eax		; check
push	131h		; last
push	esi		; first
push	hMenu		; hmenu
call	ebx ; CheckMenuRadioItem
mov	eax, dword_1014D4C
neg	eax
sbb	eax, eax
and	eax, 8
push	eax		; uCheck
push	12Fh		; uIDCheckItem
push	hMenu		; hMenu
call	ds:CheckMenuItem
mov	eax, dword_1014D7C
cmp	eax, edi
jz	short loc_1001DC4
xor	ecx, ecx
cmp	dword_1014D48, edi
push	edi		; flags
setnz	cl
add	ecx, esi
push	ecx		; check
push	131h		; last
push	esi		; first
push	eax		; hmenu
call	ebx ; CheckMenuRadioItem
mov	eax, dword_1014D4C
neg	eax
sbb	eax, eax
and	eax, 8
push	eax		; uCheck
push	12Fh		; uIDCheckItem
push	dword_1014D7C	; hMenu
call	ds:CheckMenuItem

loc_1001DC4:
or	dword_1014278, 0FFFFFFFFh
push	0Ah
call	sub_100675B
push	dword_1014D94
call	sub_100BD61
test	eax, eax
mov	eax, offset String
jnz	short loc_1001DEB
mov	eax, offset aM	; " M"

loc_1001DEB:		; lpString
push	eax
push	191h		; nIDDlgItem
push	hWnd		; hDlg
call	ds:SetDlgItemTextW
push	edi		; lParam
push	3		; wParam
push	127h		; Msg
push	hWnd		; hWnd
call	ds:SendMessageW
push	5		; nCmdShow
push	hWnd		; hWnd
call	ds:ShowWindow
push	hWnd		; hWnd
call	ds:UpdateWindow
jmp	short loc_1001E40

loc_1001E2D:
cmp	[ebp+var_4], edi
jz	short loc_1001E40
push	esi		; bErase
push	edi		; lpRect
push	hWnd		; hWnd
call	ds:InvalidateRect

loc_1001E40:
pop	edi
pop	esi
pop	ebx
leave
retn	4
sub_1001A17 endp




sub_1001E47 proc near
push	esi
push	edi
push	offset unk_1014DC0
call	sub_10021FF
mov	dword_1014DB8, 1
call	sub_1005291
mov	eax, dword_1014FC4
mov	dword_1014D38, eax
mov	eax, dword_1014FC8
mov	dword_1014D3C, eax
mov	eax, dword_1014FCC
mov	dword_1014D40, eax
mov	eax, dword_1014FD0
mov	dword_1014D44, eax
call	sub_100184D
push	dword_1014D94	; hMem
call	sub_1007BD1
and	dword_1014D94, 0
call	sub_1007C26
mov	dword_1014D94, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014D94
and	dword ptr [eax], 0
mov	eax, dword_1014F84
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014D94
mov	[ecx], eax
mov	eax, dword_1014F84
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, dword_1014D94
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, dword_1014D94
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014D94
and	dword ptr [eax+4], 0
mov	eax, dword_1014F84
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014D94
mov	[ecx+4], eax
mov	eax, dword_1014F84
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, dword_1014D94
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
pop	edi
pop	esi
retn
sub_1001E47 endp




sub_1001F51 proc near
mov	eax, offset sub_10128EE
call	sub_1012650
sub	esp, 0F0h
push	ebx
push	esi
push	edi
mov	[ebp-10h], esp
push	31h
pop	ecx
xor	eax, eax
xor	ebx, ebx
mov	[ebp-0FCh], bx
lea	edi, [ebp-0FAh]
rep stosd
stosw
lea	eax, [ebp-18h]
push	eax		; pdwDefaultLayout
call	ds:GetProcessDefaultLayout
test	eax, eax
jz	short loc_1001FA8
mov	eax, [ebp-18h]
test	al, 1
jz	short loc_1001FA8
and	eax, 0FFFFFFFEh
push	eax		; dwDefaultLayout
call	ds:SetProcessDefaultLayout
mov	dword_1014DA0, 1

loc_1001FA8:
push	dword ptr [ebp+10h]
call	sub_1001665
mov	eax, [ebp+8]
push	dword ptr [ebp+0Ch]
mov	hInstance, eax
call	sub_10017C7
test	eax, eax
jz	loc_10020A8
push	800h		; uBytes
push	40h		; uFlags
mov	[ebp-4], ebx
call	ds:LocalAlloc
cmp	eax, ebx
mov	[ebp+10h], eax
jnz	short loc_1001FE3
push	ebx
push	ebx
jmp	short loc_1002061

loc_1001FE3:
and	dword ptr [ebp+0Ch], 0
mov	edi, ds:LocalReAlloc
mov	esi, 400h

loc_1001FF2:
cmp	dword ptr [ebp+0Ch], 54h
jg	short loc_1002049

loc_1001FF8:
mov	eax, [ebp+10h]
mov	[ebp-14h], esi
sub	[ebp-14h], ebx
push	dword ptr [ebp-14h] ; cchBufferMax
lea	eax, [eax+ebx*2]
push	eax		; lpBuffer
push	dword ptr [ebp+0Ch] ; uID
push	dword ptr [ebp+8] ; hInstance
call	ds:LoadStringW
inc	eax
cmp	eax, [ebp-14h]
jnz	short loc_1002038
add	esi, 400h
push	2		; uFlags
lea	eax, [esi+esi]
push	eax		; uBytes
push	dword ptr [ebp+10h] ; hMem
call	edi ; LocalReAlloc
test	eax, eax
jnz	short loc_1002033
push	eax
push	eax
jmp	short loc_1002061

loc_1002033:
mov	[ebp+10h], eax
jmp	short loc_1001FF8

loc_1002038:
mov	ecx, [ebp+0Ch]
mov	dword_1014A50[ecx*4], ebx
add	ebx, eax
inc	dword ptr [ebp+0Ch]
jmp	short loc_1001FF2

loc_1002049:		; uFlags
push	2
lea	eax, [ebx+ebx]
push	eax		; uBytes
push	dword ptr [ebp+10h] ; hMem
call	edi ; LocalReAlloc
mov	esi, eax
xor	ecx, ecx
cmp	esi, ecx
mov	[ebp+8], esi
jnz	short loc_10020AF
push	ecx
push	ecx

loc_1002061:
call	_CxxThrowException

loc_1002066:
xor	esi, esi
cmp	[ebp+10h], esi
jz	short loc_1002076
push	dword ptr [ebp+10h] ; hMem
call	ds:LocalFree

loc_1002076:		; cchBufferMax
push	64h
lea	eax, [ebp-0FCh]
push	eax		; lpBuffer
push	54h		; uID
push	hInstance	; hInstance
call	ds:LoadStringW
test	eax, eax
jz	short loc_10020A2
push	10h		; uType
push	esi		; lpCaption
lea	eax, [ebp-0FCh]
push	eax		; lpText
push	esi		; hWnd
call	ds:MessageBoxW

loc_10020A2:
mov	eax, offset loc_10020A8
retn

loc_10020A8:
xor	eax, eax
jmp	loc_10021C0

loc_10020AF:
xor	edx, edx

loc_10020B1:
cmp	edx, 54h
jg	short loc_10020C7
lea	eax, ds:1014A50h[edx*4]
mov	edi, [eax]
lea	edi, [esi+edi*2]
mov	[eax], edi
inc	edx
jmp	short loc_10020B1

loc_10020C7:		; lpParam
push	ecx
push	hInstance	; hInstance
or	dword ptr [ebp-4], 0FFFFFFFFh
push	ecx		; hMenu
push	ecx		; hWndParent
push	ecx		; nHeight
mov	eax, 80000000h
push	eax		; nWidth
push	ecx		; Y
push	eax		; X
push	10000000h	; dwStyle
push	offset WindowName ; "CalcMsgPumpWnd"
push	offset ClassName ; "EDIT"
push	ecx		; dwExStyle
call	ds:CreateWindowExW
mov	dword_1014D70, eax
call	sub_1001E47
mov	esi, ds:GetProfileIntW
push	1		; nDefault
push	offset aLayout	; "layout"
mov	edi, offset aScicalc ; "SciCalc"
push	edi		; lpAppName
call	esi ; GetProfileIntW
xor	ebx, ebx
push	ebx		; nDefault
push	offset aUsesep	; "UseSep"
push	edi		; lpAppName
mov	dword_1014D48, eax
call	esi ; GetProfileIntW
push	1		; hWnd
mov	dword_1014D4C, eax
call	sub_1001A17
push	69h		; lpTableName
push	hInstance	; hInstance
call	ds:LoadAcceleratorsW
mov	esi, ds:GetMessageW
mov	hAccTable, eax
jmp	short loc_10021A7

loc_1002149:
mov	eax, hDlg
cmp	eax, ebx
jz	short loc_1002161
lea	ecx, [ebp-34h]
push	ecx		; lpMsg
push	eax		; hDlg
call	ds:IsDialogMessageW
test	eax, eax
jnz	short loc_10021A7

loc_1002161:
mov	eax, hWnd
cmp	[ebp-34h], eax
jz	short loc_1002179
push	dword ptr [ebp-34h] ; hWnd
push	eax		; hWndParent
call	ds:IsChild
test	eax, eax
jz	short loc_1002193

loc_1002179:
lea	eax, [ebp-34h]
push	eax		; lpMsg
push	hAccTable	; hAccTable
push	hWnd		; hWnd
call	ds:TranslateAcceleratorW
test	eax, eax
jnz	short loc_10021A7

loc_1002193:
lea	eax, [ebp-34h]
push	eax		; lpMsg
call	ds:TranslateMessage
lea	eax, [ebp-34h]
push	eax		; lpMsg
call	ds:DispatchMessageW

loc_10021A7:		; wMsgFilterMax
push	ebx
push	ebx		; wMsgFilterMin
lea	eax, [ebp-34h]
push	ebx		; hWnd
push	eax		; lpMsg
call	esi ; GetMessageW
test	eax, eax
jnz	short loc_1002149
push	dword ptr [ebp+8] ; hMem
call	ds:LocalFree
mov	eax, [ebp-2Ch]

loc_10021C0:
mov	ecx, [ebp-0Ch]
pop	edi
pop	esi
mov	large fs:0, ecx
pop	ebx
leave
retn	10h
sub_1001F51 endp




sub_10021D1 proc near

arg_0= dword ptr  4

push	esi
mov	esi, [esp+4+arg_0]
and	dword ptr [esi+4], 0
push	edi
push	offset a0	; "0"
lea	edi, [esi+0Ch]
push	edi		; lpString1
mov	dword ptr [esi], 1
call	ds:lstrcpyW
push	edi		; lpString
call	ds:lstrlenW
pop	edi
mov	[esi+8], eax
pop	esi
retn	4
sub_10021D1 endp




sub_10021FF proc near

arg_0= dword ptr  4

push	esi
mov	esi, [esp+4+arg_0]
lea	eax, [esi+8]
push	eax
call	sub_10021D1
lea	eax, [esi+98h]
push	eax
call	sub_10021D1
and	dword ptr [esi], 0
or	dword ptr [esi+4], 0FFFFFFFFh
pop	esi
retn	4
sub_10021FF endp



; Attributes: bp-based frame

sub_1002224 proc near

arg_0= dword ptr  8
arg_4= dword ptr  0Ch

push	ebp
mov	ebp, esp
mov	eax, [ebp+arg_4]
mov	edx, [eax+10h]
push	ebx
push	esi
push	edi
xor	edi, edi
xor	ecx, ecx
mov	[eax+edx*2+14h], di
cmp	[eax], edi
jz	short loc_100224D
mov	edx, [eax+0A0h]
lea	ecx, [eax+0A4h]
mov	[ecx+edx*2], di

loc_100224D:		; int
push	ecx
push	dword ptr [eax+9Ch] ; int
lea	ecx, [eax+14h]
push	ecx		; Str
push	dword ptr [eax+0Ch] ; int
call	sub_10087E1
mov	ebx, [ebp+arg_0]
push	dword ptr [ebx]	; hMem
mov	esi, eax
mov	[ebp+arg_4], esi
call	sub_1007BD1
mov	[ebx], edi
call	sub_1007C26
mov	[ebx], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebx]
mov	[eax], edi
mov	eax, [esi]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebx]
mov	[ecx], eax
mov	esi, [esi]
mov	ecx, [esi+4]
mov	eax, [ebx]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebx]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebx]
and	dword ptr [eax+4], 0
mov	esi, [ebp+arg_4]
mov	eax, [esi+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebx]
mov	[ecx+4], eax
mov	esi, [esi+4]
mov	ecx, [esi+4]
mov	eax, [ebx]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
pop	edi
pop	esi
pop	ebx
pop	ebp
retn	8
sub_1002224 endp



; Attributes: bp-based frame

sub_10022F9 proc near

var_10A= word ptr -10Ah
String=	word ptr -108h
arg_0= dword ptr  8
arg_4= dword ptr  0Ch
arg_8= dword ptr  10h

push	ebp
mov	ebp, esp
sub	esp, 108h
push	ebx
push	esi
mov	esi, [ebp+arg_4]
mov	eax, [esi+10h]
push	edi
xor	edi, edi
mov	[esi+eax*2+14h], di
cmp	[esi], edi
jz	short loc_1002324
mov	eax, [esi+0A0h]
mov	[esi+eax*2+0A4h], di

loc_1002324:
cmp	[esi+0Ch], edi
jz	short loc_1002335
xor	edi, edi
mov	[ebp+String], 2Dh
inc	edi

loc_1002335:
mov	ebx, ds:lstrcpyW
lea	eax, [esi+14h]
push	eax		; lpString2
lea	eax, [ebp+edi*2+String]
push	eax		; lpString1
call	ebx ; lstrcpyW
add	edi, [esi+10h]
cmp	dword ptr [esi+4], 0FFFFFFFFh
jnz	short loc_1002361
mov	ax, word ptr ReturnedString
mov	[ebp+edi*2+String], ax
inc	edi

loc_1002361:
cmp	dword ptr [esi], 0
jz	short loc_10023B6
xor	eax, eax
cmp	[ebp+arg_8], 0Ah
setnz	al
dec	eax
and	eax, 7
add	eax, 5Eh
mov	[ebp+edi*2+String], ax
inc	edi
cmp	dword ptr [esi+9Ch], 0
jz	short loc_1002394
mov	[ebp+edi*2+String], 2Dh
jmp	short loc_100239E

loc_1002394:
mov	[ebp+edi*2+String], 2Bh

loc_100239E:
lea	eax, [esi+0A4h]
push	eax		; lpString2
inc	edi
lea	eax, [ebp+edi*2+String]
push	eax		; lpString1
call	ebx ; lstrcpyW
add	edi, [esi+0A0h]

loc_10023B6:
lea	eax, [ebp+String]
push	eax		; lpString
call	ds:lstrlenW
lea	eax, [eax+eax+2]
push	eax		; uBytes
push	40h		; uFlags
call	ds:LocalAlloc
test	eax, eax
mov	esi, [ebp+arg_0]
mov	[ebp+arg_4], eax
jz	short loc_10023EF
mov	eax, [esi]
test	eax, eax
jz	short loc_10023EA
push	eax		; hMem
call	ds:LocalFree
and	dword ptr [esi], 0

loc_10023EA:
mov	eax, [ebp+arg_4]
mov	[esi], eax

loc_10023EF:
cmp	[ebp+arg_8], 0Ah
jz	short loc_1002407
mov	ax, [ebp+edi*2+var_10A]
cmp	ax, word ptr ReturnedString
jnz	short loc_1002407
dec	edi

loc_1002407:
and	[ebp+edi*2+String], 0
lea	eax, [ebp+String]
push	eax		; lpString2
push	dword ptr [esi]	; lpString1
call	ebx ; lstrcpyW
pop	edi
pop	esi
pop	ebx
leave
retn	0Ch
sub_10022F9 endp




sub_1002422 proc near

arg_0= dword ptr  4
arg_4= dword ptr  8

push	ebx
push	esi
mov	esi, [esp+8+arg_4]
cmp	esi, 0Ah
push	edi
lea	ebx, [esi+30h]
jl	short loc_1002434
lea	ebx, [esi+37h]

loc_1002434:
mov	eax, [esp+0Ch+arg_0]
mov	edi, [eax]
test	edi, edi
jz	short loc_1002449
push	4
lea	ecx, [eax+98h]
pop	eax
jmp	short loc_1002451

loc_1002449:
lea	ecx, [eax+8]
mov	eax, dword_10149D8

loc_1002451:
mov	edx, [ecx]
test	edx, edx
jz	short loc_100245B
test	esi, esi
jz	short loc_10024B7

loc_100245B:
mov	esi, [ecx+8]
cmp	esi, eax
jge	short loc_1002477
test	edx, edx
jz	short loc_100246D
and	dword ptr [ecx+8], 0
and	dword ptr [ecx], 0

loc_100246D:
mov	eax, [ecx+8]
mov	[ecx+eax*2+0Ch], bx
jmp	short loc_10024B4

loc_1002477:
cmp	dword_1014010, 8
jnz	short loc_10024A0
cmp	esi, eax
jnz	short loc_10024A0
test	edi, edi
jnz	short loc_10024A0
mov	eax, dword_1014014
push	3
cdq
pop	edi
idiv	edi
dec	edx
jz	short loc_10024A8
dec	edx
jnz	short loc_10024A0
cmp	word ptr [ecx+0Ch], 33h
jbe	short loc_10024AF

loc_10024A0:
xor	eax, eax

loc_10024A2:
pop	edi
pop	esi
pop	ebx
retn	8

loc_10024A8:
cmp	word ptr [ecx+0Ch], 31h
jnz	short loc_10024A0

loc_10024AF:
mov	[ecx+esi*2+0Ch], bx

loc_10024B4:
inc	dword ptr [ecx+8]

loc_10024B7:
xor	eax, eax
inc	eax
jmp	short loc_10024A2
sub_1002422 endp




sub_10024BC proc near

arg_0= dword ptr  4

mov	eax, [esp+arg_0]
xor	ecx, ecx
cmp	[eax+8], ecx
jz	short loc_10024D2
mov	[eax+0Ch], ecx
mov	[eax+9Ch], ecx
jmp	short locret_10024EF

loc_10024D2:
xor	edx, edx
cmp	[eax], ecx
jz	short loc_10024E6
add	eax, 9Ch
cmp	[eax], ecx
setz	dl
mov	[eax], edx
jmp	short locret_10024EF

loc_10024E6:
cmp	[eax+0Ch], ecx
setz	dl
mov	[eax+0Ch], edx

locret_10024EF:
retn	4
sub_10024BC endp




sub_10024F2 proc near

arg_0= dword ptr  4

mov	eax, [esp+arg_0]
cmp	dword ptr [eax+4], 0FFFFFFFFh
jnz	short loc_1002501
cmp	dword ptr [eax], 0
jz	short loc_1002505

loc_1002501:
xor	eax, eax
jmp	short locret_1002525

loc_1002505:
mov	ecx, [eax+10h]
and	dword ptr [eax+8], 0
mov	[eax+4], ecx
inc	ecx
mov	[eax+10h], ecx
mov	ecx, [eax+4]
mov	dx, word ptr ReturnedString
mov	[eax+ecx*2+14h], dx
xor	eax, eax
inc	eax

locret_1002525:
retn	4
sub_10024F2 endp




sub_1002528 proc near

arg_0= dword ptr  4

push	esi
mov	esi, [esp+4+arg_0]
push	esi
call	sub_10024F2
xor	eax, eax
cmp	[esi], eax
jnz	short loc_100253C
inc	eax
mov	[esi], eax

loc_100253C:
pop	esi
retn	4
sub_1002528 endp




sub_1002540 proc near

arg_0= dword ptr  4

mov	eax, [esp+arg_0]
cmp	dword ptr [eax], 0
jz	short loc_1002564
lea	ecx, [eax+98h]
cmp	dword ptr [ecx], 0
jnz	short loc_100255F
dec	dword ptr [eax+0A0h]
jnz	short loc_1002591
push	ecx
jmp	short loc_100258C

loc_100255F:
and	dword ptr [eax], 0
jmp	short loc_1002591

loc_1002564:
lea	edx, [eax+8]
cmp	dword ptr [edx], 0
jnz	short loc_100256F
dec	dword ptr [eax+10h]

loc_100256F:
mov	ecx, [eax+10h]
cmp	ecx, [eax+4]
jg	short loc_100257B
or	dword ptr [eax+4], 0FFFFFFFFh

loc_100257B:
test	ecx, ecx
jz	short loc_100258B
cmp	ecx, 1
jnz	short loc_1002591
cmp	word ptr [eax+14h], 30h
jnz	short loc_1002591

loc_100258B:
push	edx

loc_100258C:
call	sub_10021D1

loc_1002591:
xor	eax, eax
inc	eax
retn	4
sub_1002540 endp




sub_1002597 proc near

arg_0= dword ptr  4

mov	ecx, [esp+arg_0]
mov	eax, [ecx+4]
cmp	eax, 0FFFFFFFFh
jz	short locret_10025AF
mov	dx, word ptr ReturnedString
mov	[ecx+eax*2+14h], dx

locret_10025AF:
retn	8
sub_1002597 endp




sub_10025B2 proc near

arg_0= dword ptr  4

cmp	[esp+arg_0], 0
jz	short loc_10025D8
cmp	hCursor, 0
jnz	short loc_10025FA
push	7F02h		; lpCursorName
push	0		; hInstance
call	ds:LoadCursorW
push	eax		; hCursor
call	ds:SetCursor
jmp	short loc_10025EA

loc_10025D8:
mov	eax, hCursor
test	eax, eax
jz	short loc_10025FF
push	eax		; hCursor
call	ds:SetCursor
xor	eax, eax

loc_10025EA:
cmp	[esp+arg_0], 0
mov	hCursor, eax
jz	short loc_10025FF
test	eax, eax
jz	short loc_10025FF

loc_10025FA:
xor	eax, eax
inc	eax
jmp	short locret_1002601

loc_10025FF:
xor	eax, eax

locret_1002601:
retn	4
sub_10025B2 endp




; int __stdcall	sub_1002604(HWND hDlg, LPCWSTR lpString)
sub_1002604 proc near

hDlg= dword ptr	 4
lpString= dword	ptr  8

push	esi
push	edi
push	193h		; nIDDlgItem
push	[esp+0Ch+hDlg]	; hDlg
call	ds:GetDlgItem
push	[esp+8+lpString] ; lpString
mov	esi, eax
call	ds:lstrlenW
push	[esp+8+lpString] ; lpString
mov	edi, eax
push	esi		; hWnd
call	ds:SetWindowTextW
push	esi		; hWnd
call	ds:SetFocus
push	edi		; lParam
push	edi		; wParam
push	0B1h		; Msg
push	esi		; hWnd
call	ds:SendMessageW
xor	eax, eax
pop	edi
inc	eax
pop	esi
retn	8
sub_1002604 endp




sub_100264B proc near
mov	eax, offset sub_10128F8
call	sub_1012650
sub	esp, 0CCh
push	ebx
push	esi
mov	esi, [ebp+8]
mov	eax, 8Ch
cmp	esi, eax
push	edi
mov	[ebp-10h], esp
jb	short loc_1002675
cmp	esi, 8Dh
jbe	short loc_10026D0

loc_1002675:
cmp	esi, 132h
jb	short loc_1002685
cmp	esi, 135h
jbe	short loc_10026D0

loc_1002685:
cmp	esi, 136h
jb	short loc_1002695
cmp	esi, 139h
jbe	short loc_10026D0

loc_1002695:
cmp	esi, 13Ah
jb	short loc_10026A5
cmp	esi, 13Ch
jbe	short loc_10026D0

loc_10026A5:
cmp	esi, 54h
jz	short loc_10026D0
cmp	esi, 6Eh
jz	short loc_10026D0
cmp	esi, 71h
jz	short loc_10026D0
cmp	esi, 53h
jz	short loc_10026D0
cmp	esi, 75h
jz	short loc_10026D0
mov	ecx, dword_1014D58
mov	dword_1014EE8, ecx
mov	dword_1014D58, esi

loc_10026D0:
xor	ebx, ebx
cmp	dword_1014D8C, ebx
jz	short loc_10026F0
cmp	esi, 51h
jz	short loc_10026F0
cmp	esi, 52h
jz	short loc_10026F0
cmp	esi, 13Dh
jnz	loc_10027CF

loc_10026F0:
cmp	dword_1014DB8, ebx
jz	loc_100277E
cmp	esi, 56h
jb	short loc_1002706
cmp	esi, 74h
jbe	short loc_1002754

loc_1002706:
cmp	esi, 76h
jb	short loc_1002710
cmp	esi, 7Bh
jbe	short loc_1002754

loc_1002710:
cmp	esi, eax
jb	short loc_100271C
cmp	esi, 8Dh
jbe	short loc_1002754

loc_100271C:
cmp	esi, 132h
jb	short loc_100272C
cmp	esi, 135h
jbe	short loc_1002754

loc_100272C:
cmp	esi, 136h
jb	short loc_100273C
cmp	esi, 139h
jbe	short loc_1002754

loc_100273C:
cmp	esi, 13Ah
jb	short loc_100274C
cmp	esi, 13Ch
jbe	short loc_1002754

loc_100274C:
cmp	esi, 12Dh
jnz	short loc_10027A7

loc_1002754:
push	1
mov	dword_1014DB8, ebx
call	sub_10025B2
mov	edi, offset unk_1014DC0
push	edi
push	offset dword_1014D90
call	sub_1002224
call	sub_10045C4
push	ebx
call	sub_10025B2
jmp	short loc_10027AC

loc_100277E:
cmp	esi, 7Ch
jb	short loc_100278B
cmp	esi, 8Bh
jbe	short loc_1002790

loc_100278B:
cmp	esi, 55h
jnz	short loc_10027A7

loc_1002790:
mov	edi, offset unk_1014DC0
push	edi
mov	dword_1014DB8, 1
call	sub_10021FF
jmp	short loc_10027AC

loc_10027A7:
mov	edi, offset unk_1014DC0

loc_10027AC:
cmp	esi, 7Ch
jb	short loc_10027E5
cmp	esi, 8Bh
ja	short loc_10027E5
lea	eax, [esi-7Ch]
cmp	eax, dword_1014010
jge	short loc_10027CF
push	eax
push	edi
call	sub_1002422
test	eax, eax
jnz	short loc_10027DB

loc_10027CF:		; uType
push	ebx
call	ds:MessageBeep
jmp	loc_10042EB

loc_10027DB:
call	sub_10045C4
jmp	loc_10042EB

loc_10027E5:
cmp	esi, 76h
jb	short loc_100283F
cmp	esi, 79h
ja	short loc_100283F
cmp	hDlg, ebx
jz	short loc_1002822
call	sub_10045C4
push	esi		; hMem
mov	[ebp-4], ebx
call	sub_1006E70
jmp	short loc_100280F

loc_1002807:
mov	eax, offset loc_100280D
retn

loc_100280D:
xor	ebx, ebx

loc_100280F:
or	dword ptr [ebp-4], 0FFFFFFFFh
cmp	dword_1014D8C, ebx
jnz	short loc_1002829
call	sub_10045C4
jmp	short loc_1002829

loc_1002822:		; uType
push	ebx
call	ds:MessageBeep

loc_1002829:		; __int16
push	ebx
push	8Ch		; nIDButton
mov	dword_1014D88, ebx
call	sub_100660D
jmp	loc_10042EB

loc_100283F:
cmp	esi, 56h
jb	loc_1002DAB
cmp	esi, 5Fh
ja	loc_1002DAB
cmp	dword_1014D88, ebx
jz	short loc_1002875
cmp	esi, 59h
jnz	short loc_1002875
push	ebx		; __int16
push	8Ch		; nIDButton
mov	dword_1014D88, ebx
call	sub_100660D
push	7
pop	esi
mov	[ebp+8], esi

loc_1002875:
mov	eax, dword_1014EE8
cmp	eax, 56h
jl	short loc_100288F
cmp	eax, 5Fh
jg	short loc_100288F
mov	dword_1014D60, esi
jmp	loc_10042EB

loc_100288F:
cmp	dword_1014EF4, ebx
jz	loc_1002C19

loc_100289B:
movzx	edx, byte_101404C
xor	edi, edi
cmp	esi, edx
jz	short loc_10028BA

loc_10028A8:
cmp	edi, 0Ch
jge	short loc_10028BA
movzx	eax, byte_101404E[edi*2]
inc	edi
cmp	esi, eax
jnz	short loc_10028A8

loc_10028BA:
mov	eax, dword_1014D60
xor	ecx, ecx
jmp	short loc_10028D1

loc_10028C3:
cmp	ecx, 0Ch
jge	short loc_10028D5
movzx	edx, byte_101404E[ecx*2]
inc	ecx

loc_10028D1:
cmp	eax, edx
jnz	short loc_10028C3

loc_10028D5:
cmp	edi, 0Ch
jnz	short loc_10028DC
xor	edi, edi

loc_10028DC:
cmp	ecx, 0Ch
jnz	short loc_10028E3
xor	ecx, ecx

loc_10028E3:
mov	al, byte_101404D[edi*2]
cmp	al, byte_101404D[ecx*2]
jbe	short loc_10028FF
cmp	dword_1014D48, ebx
jz	loc_1002AD5

loc_10028FF:
push	1
call	sub_10025B2
push	dword_1014D98
push	offset dword_1014D90
push	dword_1014D60
call	sub_1005A7A
push	ebx
call	sub_10025B2
mov	eax, dword_1014D64
cmp	eax, ebx
jz	loc_1002C0C
cmp	dword_10149DC[eax*4], ebx
jz	loc_1002C0C
push	dword_1014D98	; hMem
dec	eax
mov	dword_1014D64, eax
shl	eax, 2
cmp	dword_1014C70[eax], ebx
mov	ecx, dword_10149E0[eax]
mov	dword_1014D60, ecx
jz	loc_1002A3D
call	sub_1007BD1
mov	dword_1014D98, ebx
call	sub_1007C26
mov	dword_1014D98, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014D98
mov	[eax], ebx
mov	eax, dword_1014D64
mov	eax, dword_1014C70[eax*4]
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014D98
mov	[ecx], eax
mov	eax, dword_1014D64
mov	eax, dword_1014C70[eax*4]
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, dword_1014D98
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, dword_1014D98
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014D98
mov	[eax+4], ebx
mov	eax, dword_1014D64
mov	eax, dword_1014C70[eax*4]
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014D98
mov	[ecx+4], eax
mov	eax, dword_1014D64
mov	eax, dword_1014C70[eax*4]

loc_1002A12:
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, dword_1014D98
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	esi, [ebp+8]
jmp	loc_100289B

loc_1002A3D:
call	sub_1007BD1
mov	dword_1014D98, ebx
call	sub_1007C26
mov	dword_1014D98, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014D98
mov	[eax], ebx
mov	eax, dword_1014F84
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014D98
mov	[ecx], eax
mov	eax, dword_1014F84
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, dword_1014D98
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, dword_1014D98
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014D98
mov	[eax+4], ebx
mov	eax, dword_1014F84
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014D98
mov	[ecx+4], eax
mov	eax, dword_1014F84
jmp	loc_1002A12

loc_1002AD5:
mov	eax, dword_1014D64
cmp	eax, 19h
jge	loc_1002BF3
push	dword_1014C70[eax*4] ; hMem
call	sub_1007BD1
mov	eax, dword_1014D64
mov	dword_1014C70[eax*4], ebx
call	sub_1007C26
mov	ecx, dword_1014D64
mov	dword_1014C70[ecx*4], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014D64
mov	eax, dword_1014C70[eax*4]
mov	[eax], ebx
mov	eax, dword_1014D98
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014D64
mov	ecx, dword_1014C70[ecx*4]
mov	[ecx], eax
mov	eax, dword_1014D98
mov	esi, [eax]
mov	eax, dword_1014D64
mov	eax, dword_1014C70[eax*4]
mov	ecx, [esi+4]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, dword_1014D64
mov	eax, dword_1014C70[eax*4]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014D64
mov	eax, dword_1014C70[eax*4]
mov	[eax+4], ebx
mov	eax, dword_1014D98
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014D64
mov	ecx, dword_1014C70[ecx*4]
mov	[ecx+4], eax
mov	eax, dword_1014D98
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, dword_1014D64
mov	eax, dword_1014C70[eax*4]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, dword_1014D60
mov	ecx, dword_1014D64
mov	dword_10149E0[ecx*4], eax
jmp	short loc_1002C04

loc_1002BF3:		; uType
push	ebx
mov	dword_1014D64, 18h
call	ds:MessageBeep

loc_1002C04:
inc	dword_1014D64
jmp	short loc_1002C19

loc_1002C0C:
cmp	dword_1014D8C, ebx
jnz	short loc_1002C19
call	sub_10045C4

loc_1002C19:		; hMem
push	dword_1014D98
call	sub_1007BD1
mov	dword_1014D98, ebx
call	sub_1007C26
mov	dword_1014D98, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014D98
mov	[eax], ebx
mov	eax, dword_1014D90
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014D98
mov	[ecx], eax
mov	eax, dword_1014D90
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, dword_1014D98
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, dword_1014D98
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014D98
mov	[eax+4], ebx
mov	eax, dword_1014D90
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014D98
mov	[ecx+4], eax
mov	eax, dword_1014D90
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, dword_1014D98
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
push	dword_1014D90	; hMem
call	sub_1007BD1
mov	dword_1014D90, ebx
call	sub_1007C26
mov	dword_1014D90, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014D90
mov	[eax], ebx
mov	eax, dword_1014F84
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014D90
mov	[ecx], eax
mov	eax, dword_1014F84
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, dword_1014D90
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, dword_1014D90
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014D90
mov	[eax+4], ebx
mov	eax, dword_1014F84
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014D90
mov	[ecx+4], eax
mov	eax, dword_1014F84
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, dword_1014D90
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
mov	eax, [ebp+8]
and	ecx, 3
rep movsb
mov	dword_1014D60, eax
xor	eax, eax
inc	eax
mov	dword_1014EF4, eax
mov	dword_1014048, eax
jmp	loc_10042EB

loc_1002DAB:
cmp	esi, 60h
jb	loc_1002F37
cmp	esi, 6Dh
ja	loc_1002F37
mov	eax, dword_1014EE8
cmp	eax, 56h
jl	loc_1002E93
cmp	eax, 5Fh
jg	loc_1002E93
push	dword_1014D90	; hMem
call	sub_1007BD1
mov	dword_1014D90, ebx
call	sub_1007C26
mov	dword_1014D90, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014D90
mov	[eax], ebx
mov	eax, dword_1014D98
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014D90
mov	[ecx], eax
mov	eax, dword_1014D98
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, dword_1014D90
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, dword_1014D90
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014D90
mov	[eax+4], ebx
mov	eax, dword_1014D98
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014D90
mov	[ecx+4], eax
mov	eax, dword_1014D98
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, dword_1014D90
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	esi, [ebp+8]

loc_1002E93:
xor	edi, edi
inc	edi
push	edi
call	sub_10025B2
push	esi
push	offset dword_1014D90
call	sub_1004A78
push	ebx
call	sub_10025B2
cmp	dword_1014D8C, ebx
jnz	loc_10042EB
call	sub_10045C4
cmp	dword_1014D88, ebx
jz	short loc_1002F04
cmp	esi, 60h
jz	short loc_1002EF3
cmp	esi, 62h
jz	short loc_1002EF3
cmp	esi, 63h
jz	short loc_1002EF3
cmp	esi, 64h
jz	short loc_1002EF3
cmp	esi, 68h
jz	short loc_1002EF3
cmp	esi, 69h
jz	short loc_1002EF3
cmp	esi, 66h
jz	short loc_1002EF3
cmp	esi, 65h
jz	short loc_1002EF3
cmp	esi, 6Ch
jnz	short loc_1002F04

loc_1002EF3:		; __int16
push	ebx
push	8Ch		; nIDButton
mov	dword_1014D88, ebx
call	sub_100660D

loc_1002F04:
cmp	dword_1014D84, ebx
jz	short loc_1002F2C
cmp	esi, 62h
jz	short loc_1002F1B
cmp	esi, 63h
jz	short loc_1002F1B
cmp	esi, 64h
jnz	short loc_1002F2C

loc_1002F1B:		; __int16
push	ebx
push	8Dh		; nIDButton
mov	dword_1014D84, ebx
call	sub_100660D

loc_1002F2C:
mov	dword_1014048, edi
jmp	loc_10042EB

loc_1002F37:
cmp	esi, 132h
jb	short loc_1002F60
cmp	esi, 135h
ja	short loc_1002F60
cmp	dword_1014D48, 1
jnz	short loc_1002F55
mov	esi, 133h

loc_1002F55:
push	esi
call	sub_100675B
jmp	loc_10042EB

loc_1002F60:
push	1
call	sub_10025B2
cmp	esi, 72h
ja	loc_1003A98
jz	loc_10039D7
cmp	esi, 55h
ja	loc_100323E
jz	loc_1003216
sub	esi, 50h
jz	loc_10031F5
dec	esi
jz	short loc_1002FEA
dec	esi
jz	loc_10030F0
dec	esi
jz	short loc_1002FC3
dec	esi
jnz	loc_10042E5
mov	eax, hDlg
cmp	eax, ebx
jz	short loc_1002FB7
push	eax		; hWnd
call	ds:SetFocus
jmp	loc_10042E5

loc_1002FB7:		; bEnable
push	1
call	sub_1006893
jmp	loc_10042E5

loc_1002FC3:
cmp	dword_1014DB8, ebx
jz	loc_1003232
push	edi
call	sub_1002540
test	eax, eax
jnz	short loc_1002FE0
push	ebx		; uType
call	ds:MessageBeep

loc_1002FE0:
call	sub_10045C4
jmp	loc_10042E5

loc_1002FEA:		; hMem
push	dword_1014D98
call	sub_1007BD1
mov	dword_1014D98, ebx
call	sub_1007C26
mov	dword_1014D98, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014D98
mov	[eax], ebx
mov	eax, dword_1014F84
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014D98
mov	[ecx], eax
mov	eax, dword_1014F84
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, dword_1014D98
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, dword_1014D98
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014D98
mov	[eax+4], ebx
mov	eax, dword_1014F84
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014D98
mov	[ecx+4], eax
mov	eax, dword_1014F84
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, dword_1014D98
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
push	offset String	; lpString
and	ecx, 3
rep movsb
push	192h		; nIDDlgItem
push	hWnd		; hDlg
mov	dword_1014EF4, ebx
mov	dword_1014D5C, ebx
mov	dword_1014D60, ebx
mov	dword_1014EE8, ebx
mov	dword_1014D58, ebx
mov	dword_1014D64, ebx
mov	dword_1014D68, ebx
mov	dword_1014048, 1
call	ds:SetDlgItemTextW

loc_10030F0:		; hMem
push	dword_1014D90
call	sub_1007BD1
mov	dword_1014D90, ebx
call	sub_1007C26
mov	dword_1014D90, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014D90
mov	[eax], ebx
mov	eax, dword_1014F84
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014D90
mov	[ecx], eax
mov	eax, dword_1014F84
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, dword_1014D90
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, dword_1014D90
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014D90
mov	[eax+4], ebx
mov	eax, dword_1014F84
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014D90
mov	[ecx+4], eax
mov	eax, dword_1014F84
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, dword_1014D90
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
cmp	dword_1014D48, ebx
jnz	short loc_10031D6
push	ebx		; __int16
push	8Ch		; nIDButton
mov	dword_1014D88, ebx
call	sub_100660D
push	ebx		; __int16
push	8Dh		; nIDButton
mov	dword_1014D84, ebx
call	sub_100660D

loc_10031D6:
push	offset unk_1014DC0
mov	dword_1014D8C, ebx
call	sub_10021FF
mov	dword_1014DB8, 1
jmp	loc_1002FE0

loc_10031F5:
cmp	dword_1014DB8, ebx
jz	short loc_1003208
push	edi
call	sub_10024BC
jmp	loc_1002FE0

loc_1003208:
mov	eax, dword_1014D90
mov	eax, [eax]
neg	dword ptr [eax]
jmp	loc_1002FE0

loc_1003216:
cmp	dword_1014DB8, ebx
jz	short loc_1003232
cmp	dword_1014010, 0Ah
jnz	short loc_1003232
push	edi
call	sub_10024F2
jmp	loc_100408B

loc_1003232:		; uType
push	ebx
call	ds:MessageBeep
jmp	loc_10042E5

loc_100323E:
sub	esi, 6Eh
jz	loc_10039C2
dec	esi
jz	loc_1003844
dec	esi
jz	loc_1003348
dec	esi
jnz	loc_10042E5
push	dword_1014D94	; hMem
call	sub_1007BD1
mov	dword_1014D94, ebx
call	sub_1007C26
mov	dword_1014D94, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014D94
mov	[eax], ebx
mov	eax, dword_1014F84
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014D94
mov	[ecx], eax
mov	eax, dword_1014F84
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, dword_1014D94
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, dword_1014D94
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014D94
mov	[eax+4], ebx
mov	eax, dword_1014F84
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014D94
mov	[ecx+4], eax
mov	eax, dword_1014F84

loc_10032F5:
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, dword_1014D94
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb

loc_1003318:
push	dword_1014D94
call	sub_100BD61
test	eax, eax
mov	eax, offset aM	; " M"
jz	short loc_1003331
mov	eax, offset String

loc_1003331:		; lpString
push	eax
push	191h		; nIDDlgItem
push	hWnd		; hDlg
call	ds:SetDlgItemTextW
jmp	loc_10042E5

loc_1003348:
mov	eax, dword_1014EE8
cmp	eax, 56h
jl	loc_100341B
cmp	eax, 5Fh
jg	loc_100341B
push	dword_1014D90	; hMem
call	sub_1007BD1
mov	dword_1014D90, ebx
call	sub_1007C26
mov	dword_1014D90, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014D90
mov	[eax], ebx
mov	eax, dword_1014D98
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014D90
mov	[ecx], eax
mov	eax, dword_1014D98
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, dword_1014D90
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, dword_1014D90
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014D90
mov	[eax+4], ebx
mov	eax, dword_1014D98
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014D90
mov	[ecx+4], eax
mov	eax, dword_1014D98
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, dword_1014D90
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb

loc_100341B:
cmp	dword_1014D60, ebx
jz	loc_1003671
cmp	dword_1014048, ebx
jz	loc_10034CE
push	dword_1014EF0	; hMem
call	sub_1007BD1
mov	dword_1014EF0, ebx
call	sub_1007C26
push	dword ptr [eax]
mov	dword_1014EF0, eax
call	sub_1007BC1
mov	eax, dword_1014EF0
mov	[eax], ebx
mov	eax, dword_1014D90
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	edx, dword_1014EF0
mov	[edx], eax
mov	ecx, dword_1014D90
mov	esi, [ecx]
mov	ecx, [esi+4]
lea	ecx, ds:0Ch[ecx*4]
mov	edi, eax
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
push	dword ptr [edx+4]
call	sub_1007BC1
mov	eax, dword_1014EF0
mov	[eax+4], ebx
mov	eax, dword_1014D90
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014EF0
mov	[ecx+4], eax
mov	ecx, dword_1014D90
mov	esi, [ecx+4]
mov	edi, eax
jmp	loc_1003572

loc_10034CE:		; hMem
push	dword_1014D90
call	sub_1007BD1
mov	dword_1014D90, ebx
call	sub_1007C26
mov	dword_1014D90, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014D90
mov	[eax], ebx
mov	eax, dword_1014EF0
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014D90
mov	[ecx], eax
mov	eax, dword_1014EF0
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, dword_1014D90
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, dword_1014D90
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014D90
mov	[eax+4], ebx
mov	eax, dword_1014EF0
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014D90
mov	[ecx+4], eax
mov	eax, dword_1014EF0
mov	esi, [eax+4]
mov	eax, dword_1014D90
mov	edi, [eax+4]

loc_1003572:
mov	ecx, [esi+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
push	dword_1014D98
push	offset dword_1014D90
push	dword_1014D60
call	sub_1005A7A
push	dword_1014D98	; hMem
call	sub_1007BD1
mov	dword_1014D98, ebx
call	sub_1007C26
mov	dword_1014D98, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014D98
mov	[eax], ebx
mov	eax, dword_1014D90
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014D98
mov	[ecx], eax
mov	eax, dword_1014D90
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, dword_1014D98
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, dword_1014D98
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014D98
mov	[eax+4], ebx
mov	eax, dword_1014D90
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014D98
mov	[ecx+4], eax
mov	eax, dword_1014D90
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, dword_1014D98
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
cmp	dword_1014D8C, ebx
jnz	short loc_1003669
call	sub_10045C4

loc_1003669:
mov	dword_1014048, ebx
jmp	short loc_100367E

loc_1003671:
cmp	dword_1014D8C, ebx
jnz	short loc_100367E
call	sub_10045C4

loc_100367E:
mov	eax, dword_1014D64
cmp	eax, ebx
jz	loc_1004061
cmp	dword_1014D48, 1
jz	loc_1004061
push	dword_1014D98	; hMem
dec	eax
mov	dword_1014D64, eax
shl	eax, 2
cmp	dword_1014C70[eax], ebx
mov	ecx, dword_10149E0[eax]
mov	dword_1014D60, ecx
jz	loc_1003773
call	sub_1007BD1
mov	dword_1014D98, ebx
call	sub_1007C26
mov	dword_1014D98, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014D98
mov	[eax], ebx
mov	eax, dword_1014D64
mov	eax, dword_1014C70[eax*4]
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014D98
mov	[ecx], eax
mov	eax, dword_1014D64
mov	eax, dword_1014C70[eax*4]
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, dword_1014D98
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, dword_1014D98
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014D98
mov	[eax+4], ebx
mov	eax, dword_1014D64
mov	eax, dword_1014C70[eax*4]
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014D98
mov	[ecx+4], eax
mov	eax, dword_1014D64
mov	eax, dword_1014C70[eax*4]
jmp	loc_1003806

loc_1003773:
call	sub_1007BD1
mov	dword_1014D98, ebx
call	sub_1007C26
mov	dword_1014D98, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014D98
mov	[eax], ebx
mov	eax, dword_1014F84
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014D98
mov	[ecx], eax
mov	eax, dword_1014F84
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, dword_1014D98
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, dword_1014D98
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014D98
mov	[eax+4], ebx
mov	eax, dword_1014F84
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014D98
mov	[ecx+4], eax
mov	eax, dword_1014F84

loc_1003806:
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, dword_1014D98
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
cmp	dword_1014D64, ebx
mov	dword_1014048, 1
jge	loc_1003348
jmp	loc_1004061

loc_1003844:
cmp	dword_1014010, 0Ah
jnz	loc_1003232
cmp	dword_1014D88, ebx
push	dword_1014D90	; hMem
jz	loc_10038FB
call	sub_1007BD1
mov	dword_1014D90, ebx
call	sub_1007C26
mov	dword_1014D90, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014D90
mov	[eax], ebx
mov	eax, dword_1014FAC
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014D90
mov	[ecx], eax
mov	eax, dword_1014FAC
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, dword_1014D90
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, dword_1014D90
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014D90
mov	[eax+4], ebx
mov	eax, dword_1014FAC
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014D90
mov	[ecx+4], eax
mov	eax, dword_1014FAC
jmp	loc_100398E

loc_10038FB:
call	sub_1007BD1
mov	dword_1014D90, ebx
call	sub_1007C26
mov	dword_1014D90, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014D90
mov	[eax], ebx
mov	eax, dword_1014FA4
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014D90
mov	[ecx], eax
mov	eax, dword_1014FA4
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, dword_1014D90
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, dword_1014D90
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014D90
mov	[eax+4], ebx
mov	eax, dword_1014FA4
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014D90
mov	[ecx+4], eax
mov	eax, dword_1014FA4

loc_100398E:
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, dword_1014D90
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
call	sub_10045C4
mov	dword_1014D88, ebx
push	ebx
jmp	loc_100415C

loc_10039C2:
xor	eax, eax
cmp	dword_1014D68, ebx
setz	al
mov	dword_1014D68, eax
jmp	loc_1002FE0

loc_10039D7:		; hMem
push	dword_1014D90
call	sub_1007BD1
mov	dword_1014D90, ebx
call	sub_1007C26
mov	dword_1014D90, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014D90
mov	[eax], ebx
mov	eax, dword_1014D94
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014D90
mov	[ecx], eax
mov	eax, dword_1014D94
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, dword_1014D90
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, dword_1014D90
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014D90
mov	[eax+4], ebx
mov	eax, dword_1014D94
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014D90
mov	[ecx+4], eax
mov	eax, dword_1014D94
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, dword_1014D90
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
jmp	loc_1002FE0

loc_1003A98:
mov	eax, 8Ch
cmp	esi, eax
ja	loc_1004166
jz	loc_100414B
cmp	esi, 73h
jz	loc_10040AD
cmp	esi, 74h
jz	loc_1004098
cmp	esi, 75h
jz	loc_100406C
cmp	esi, 79h
jbe	loc_10042E5
cmp	esi, 7Bh
ja	loc_10042E5
cmp	esi, 7Ah
mov	[ebp+8], ebx
jnz	short loc_1003AE7
mov	dword ptr [ebp+8], 1

loc_1003AE7:
mov	eax, dword_1014D5C
cmp	eax, 19h
jl	short loc_1003AFA
cmp	[ebp+8], ebx
jnz	loc_1003232

loc_1003AFA:
cmp	eax, ebx
jnz	short loc_1003B07
cmp	[ebp+8], ebx
jz	loc_1003232

loc_1003B07:
mov	ecx, dword_1014D64
cmp	ecx, 19h
jl	short loc_1003B1F
cmp	dword_10149DC[ecx*4], ebx
jnz	loc_1003232

loc_1003B1F:
cmp	[ebp+8], ebx
jz	loc_1003E95
push	dword_1014C08[eax*4] ; hMem
call	sub_1007BD1
mov	eax, dword_1014D5C
mov	dword_1014C08[eax*4], ebx
call	sub_1007C26
mov	ecx, dword_1014D5C
mov	dword_1014C08[ecx*4], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014D5C
mov	eax, dword_1014C08[eax*4]
mov	[eax], ebx
mov	eax, dword_1014D98
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014D5C
mov	ecx, dword_1014C08[ecx*4]
mov	[ecx], eax
mov	eax, dword_1014D98
mov	esi, [eax]
mov	eax, dword_1014D5C
mov	eax, dword_1014C08[eax*4]
mov	ecx, [esi+4]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, dword_1014D5C
mov	eax, dword_1014C08[eax*4]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014D5C
mov	eax, dword_1014C08[eax*4]
mov	[eax+4], ebx
mov	eax, dword_1014D98
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014D5C
mov	ecx, dword_1014C08[ecx*4]
mov	[ecx+4], eax
mov	eax, dword_1014D98
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, dword_1014D5C
mov	eax, dword_1014C08[eax*4]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, dword_1014D60
mov	ecx, dword_1014D5C
inc	dword_1014D5C
push	dword_1014D98	; hMem
mov	dword_1014BA0[ecx*4], eax
mov	eax, dword_1014D64
inc	dword_1014D64
mov	dword_10149E0[eax*4], ebx
call	sub_1007BD1
mov	dword_1014D98, ebx
call	sub_1007C26
mov	dword_1014D98, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014D98
mov	[eax], ebx
mov	eax, dword_1014F84
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014D98
mov	[ecx], eax
mov	eax, dword_1014F84
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, dword_1014D98
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, dword_1014D98
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014D98
mov	[eax+4], ebx
mov	eax, dword_1014F84
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014D98
mov	[ecx+4], eax
mov	eax, dword_1014F84
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, dword_1014D98
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	dword_1014D58, ebx
mov	dword_1014D60, 5Ch
jmp	loc_1003FC9

loc_1003D1F:
cmp	dword_1014C70[eax], ebx
jz	loc_1003DDF
call	sub_1007BD1
mov	dword_1014D98, ebx
call	sub_1007C26
mov	dword_1014D98, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014D98
mov	[eax], ebx
mov	eax, dword_1014D64
mov	eax, dword_1014C70[eax*4]
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014D98
mov	[ecx], eax
mov	eax, dword_1014D64
mov	eax, dword_1014C70[eax*4]
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, dword_1014D98
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, dword_1014D98
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014D98
mov	[eax+4], ebx
mov	eax, dword_1014D64
mov	eax, dword_1014C70[eax*4]
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014D98
mov	[ecx+4], eax
mov	eax, dword_1014D64
mov	eax, dword_1014C70[eax*4]
jmp	loc_1003E72

loc_1003DDF:
call	sub_1007BD1
mov	dword_1014D98, ebx
call	sub_1007C26
mov	dword_1014D98, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014D98
mov	[eax], ebx
mov	eax, dword_1014F84
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014D98
mov	[ecx], eax
mov	eax, dword_1014F84
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, dword_1014D98
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, dword_1014D98
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014D98
mov	[eax+4], ebx
mov	eax, dword_1014F84
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014D98
mov	[ecx+4], eax
mov	eax, dword_1014F84

loc_1003E72:
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, dword_1014D98
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb

loc_1003E95:
push	dword_1014D98
push	offset dword_1014D90
push	dword_1014D60
call	sub_1005A7A
dec	dword_1014D64
mov	eax, dword_1014D64
push	dword_1014D98	; hMem
shl	eax, 2
mov	ecx, dword_10149E0[eax]
cmp	ecx, ebx
mov	dword_1014D60, ecx
jnz	loc_1003D1F
dec	dword_1014D5C
call	sub_1007BD1
mov	dword_1014D98, ebx
call	sub_1007C26
mov	dword_1014D98, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014D98
mov	[eax], ebx
mov	eax, dword_1014D5C
mov	eax, dword_1014C08[eax*4]
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014D98
mov	[ecx], eax
mov	eax, dword_1014D5C
mov	eax, dword_1014C08[eax*4]
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, dword_1014D98
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, dword_1014D98
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014D98
mov	[eax+4], ebx
mov	eax, dword_1014D5C
mov	eax, dword_1014C08[eax*4]
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014D98
mov	[ecx+4], eax
mov	eax, dword_1014D5C
mov	eax, dword_1014C08[eax*4]
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, dword_1014D98
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, dword_1014D5C
mov	eax, dword_1014BA0[eax*4]
xor	ecx, ecx
cmp	eax, ebx
setnz	cl
mov	dword_1014D60, eax
mov	dword_1014EF4, ecx

loc_1003FC9:		; "(="
push	offset asc_1001314
lea	eax, [ebp-74h]
push	eax		; lpString1
call	ds:lstrcpyW
lea	eax, [ebp-0D8h]
push	eax
push	dword_1014D5C
call	sub_1007A6A
push	eax		; lpString2
lea	eax, [ebp-74h]
push	eax		; lpString1
call	ds:lstrcatW
cmp	dword_1014D5C, ebx
lea	eax, [ebp-74h]
jnz	short loc_1004005
mov	eax, offset String

loc_1004005:		; lpString
push	eax
push	192h		; nIDDlgItem
push	hWnd		; hDlg
call	ds:SetDlgItemTextW
cmp	dword_1014D8C, ebx
jnz	loc_10042E5
cmp	[ebp+8], ebx
jz	loc_1002FE0
mov	edx, dword_1014D5C
xor	eax, eax
cmp	edx, ebx
jle	short loc_100404D
mov	ecx, edx
shr	ecx, 1
mov	eax, 280028h
lea	edi, [ebp-74h]
rep stosd
adc	ecx, ecx
rep stosw
mov	eax, edx

loc_100404D:
mov	[ebp+eax*2-74h], bx
lea	eax, [ebp-74h]
push	eax		; lpString
push	hWnd		; hDlg
call	sub_1002604

loc_1004061:
mov	dword_1014EF4, ebx
jmp	loc_10042E5

loc_100406C:
cmp	dword_1014DB8, ebx
jz	loc_1003232
cmp	dword_1014010, 0Ah
jnz	loc_1003232
push	edi
call	sub_1002528

loc_100408B:
test	eax, eax
jz	loc_1003232
jmp	loc_1002FE0

loc_1004098:
push	dword_1014D90
push	offset dword_1014D94
call	sub_100BC54
jmp	loc_1003318

loc_10040AD:		; hMem
push	dword_1014D94
call	sub_1007BD1
mov	dword_1014D94, ebx
call	sub_1007C26
mov	dword_1014D94, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014D94
mov	[eax], ebx
mov	eax, dword_1014D90
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014D94
mov	[ecx], eax
mov	eax, dword_1014D90
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, dword_1014D94
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, dword_1014D94
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014D94
mov	[eax+4], ebx
mov	eax, dword_1014D90
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014D94
mov	[ecx+4], eax
mov	eax, dword_1014D90
jmp	loc_10032F5

loc_100414B:
xor	eax, eax
cmp	dword_1014D88, ebx
setz	al
mov	dword_1014D88, eax
push	eax

loc_100415C:
push	8Ch
jmp	loc_10042E0

loc_1004166:
cmp	esi, 8Dh
jz	loc_10042CA
cmp	esi, 12Bh
jbe	loc_10042E5
cmp	esi, 131h
jbe	short loc_10041A6
cmp	esi, 135h
jbe	loc_10042E5
cmp	esi, 13Ch
jbe	short loc_10041B1
cmp	esi, 13Dh
jnz	loc_10042E5

loc_10041A6:		; String
push	esi
call	sub_100565B
jmp	loc_1002FE0

loc_10041B1:
cmp	dword_1014010, 0Ah
jnz	short loc_100420C
cmp	esi, 13Ah
jb	loc_1002FE0
lea	eax, [esi-13Ah]
push	ebx		; flags
mov	bEnable, eax
add	eax, 13Ah
push	eax		; check
mov	edi, 13Ch
push	edi		; last
mov	esi, 13Ah
push	esi		; first
push	1		; nPos
push	hWnd		; hWnd
call	ds:GetMenu
push	eax		; hMenu
call	ds:GetSubMenu
push	eax		; hmenu
call	ds:CheckMenuRadioItem
mov	eax, bEnable
add	eax, esi
jmp	loc_10042B6

loc_100420C:
cmp	esi, 13Ah
jb	short loc_1004217
sub	esi, 3

loc_1004217:
cmp	dword_1014DB8, ebx
jz	short loc_1004230
push	edi
push	offset dword_1014D90
call	sub_1002224
mov	dword_1014DB8, ebx

loc_1004230:
lea	eax, [esi-136h]
mov	dword_1014D54, eax
sub	eax, ebx
jz	short loc_100426C
dec	eax
jz	short loc_1004260
dec	eax
jz	short loc_1004254
dec	eax
jnz	short loc_1004276
mov	dword_1014014, 8
jmp	short loc_1004276

loc_1004254:
mov	dword_1014014, 10h
jmp	short loc_1004276

loc_1004260:
mov	dword_1014014, 20h
jmp	short loc_1004276

loc_100426C:
mov	dword_1014014, 40h

loc_1004276:
call	sub_1005291
mov	eax, dword_1014D54
push	ebx		; flags
add	eax, 136h
push	eax		; check
mov	edi, 139h
push	edi		; last
mov	esi, 136h
push	esi		; first
push	1		; nPos
push	hWnd		; hWnd
call	ds:GetMenu
push	eax		; hMenu
call	ds:GetSubMenu
push	eax		; hmenu
call	ds:CheckMenuRadioItem
mov	eax, dword_1014D54
add	eax, esi

loc_10042B6:		; nIDCheckButton
push	eax
push	edi		; nIDLastButton
push	esi		; nIDFirstButton
push	hWnd		; hDlg
call	ds:CheckRadioButton
jmp	loc_1002FE0

loc_10042CA:
xor	eax, eax
cmp	dword_1014D84, ebx
setz	al
push	eax		; __int16
mov	dword_1014D84, eax
push	8Dh		; nIDButton

loc_10042E0:
call	sub_100660D

loc_10042E5:
push	ebx
call	sub_10025B2

loc_10042EB:
mov	ecx, [ebp-0Ch]
pop	edi
pop	esi
mov	large fs:0, ecx
pop	ebx
leave
retn	4
sub_100264B endp




sub_10042FC proc near
mov	eax, offset loc_1012902
call	sub_1012650
push	ecx
cmp	dword ptr [ebp+8], 12Eh
push	ebx
push	esi
push	edi
mov	[ebp-10h], esp
jz	short loc_100431D
push	1
call	sub_10049A0

loc_100431D:
push	dword ptr [ebp+8]
and	dword ptr [ebp-4], 0
call	sub_100264B

loc_1004329:
or	dword ptr [ebp-4], 0FFFFFFFFh
cmp	dword ptr [ebp+8], 12Eh
jz	short loc_100433D
push	0
call	sub_10049A0

loc_100433D:
mov	ecx, [ebp-0Ch]
pop	edi
pop	esi
mov	large fs:0, ecx
pop	ebx
leave
retn	4
sub_10042FC endp




sub_100434E proc near
push	0		; uType
push	offset Caption	; "Error"
push	offset Text	; "An unknown error has	occured."
push	hWnd		; hWnd
call	ds:MessageBoxW
mov	eax, offset loc_1004329
retn
sub_100434E endp




sub_100436C proc near
push	esi
push	hEvent		; hEvent
mov	esi, ds:SetEvent
mov	dword_1014EF8, 1
call	esi ; SetEvent
push	dword_1014F00	; hEvent
call	esi ; SetEvent
push	9C40h		; dwMilliseconds
push	hHandle		; hHandle
call	ds:WaitForSingleObject
push	hEvent		; hObject
mov	esi, ds:CloseHandle
call	esi ; CloseHandle
push	dword_1014F00	; hObject
call	esi ; CloseHandle
push	hHandle		; hObject
call	esi ; CloseHandle
pop	esi
retn
sub_100436C endp



; Attributes: bp-based frame

; INT_PTR __stdcall DialogFunc(HWND, UINT, WPARAM, LPARAM)
DialogFunc proc	near

Rect= tagRECT ptr -10h
hWnd= dword ptr	 8
arg_4= dword ptr  0Ch
arg_8= word ptr	 10h

push	ebp
mov	ebp, esp
sub	esp, 10h
mov	eax, [ebp+arg_4]
sub	eax, 110h
jz	short loc_10043E5
dec	eax
jz	short loc_10043D5
xor	eax, eax
jmp	short locret_100443D

loc_10043D5:
movzx	eax, [ebp+arg_8]
push	eax		; nResult
push	[ebp+hWnd]	; hDlg
call	ds:EndDialog
jmp	short loc_100443A

loc_10043E5:
push	ebx
mov	ebx, [ebp+hWnd]
push	esi
push	edi
lea	eax, [ebp+Rect]
push	eax		; lpRect
push	193h		; nIDDlgItem
push	hWnd		; hDlg
mov	dword_1014F08, ebx
call	ds:GetDlgItem
mov	esi, ds:GetWindowRect
push	eax		; hWnd
call	esi ; GetWindowRect
mov	edi, [ebp+Rect.bottom]
lea	eax, [ebp+Rect]
push	eax		; lpRect
push	hWnd		; hWnd
call	esi ; GetWindowRect
mov	ecx, [ebp+Rect.left]
push	15h		; uFlags
xor	eax, eax
push	eax		; cy
push	eax		; cx
add	edi, 28h
push	edi		; Y
add	ecx, 0Fh
push	ecx		; X
push	eax		; hWndInsertAfter
push	ebx		; hWnd
call	ds:SetWindowPos
pop	edi
pop	esi
pop	ebx

loc_100443A:
xor	eax, eax
inc	eax

locret_100443D:
leave
retn	10h
DialogFunc endp




sub_1004441 proc near
push	0		; dwInitParam
push	offset DialogFunc ; lpDialogFunc
push	0		; hWndParent
push	68h		; lpTemplateName
push	hInstance	; hInstance
call	ds:DialogBoxParamW
retn
sub_1004441 endp



; Attributes: bp-based frame

; int __stdcall	sub_1004459(wchar_t *EndPtr)
sub_1004459 proc near

EndPtr=	dword ptr  8

push	ebp
mov	ebp, esp
mov	eax, [ebp+EndPtr]
push	edi
xor	edi, edi
cmp	eax, edi
jnz	short loc_100446A
xor	eax, eax
jmp	short loc_10044AF

loc_100446A:
push	ebx
xor	ebx, ebx
cmp	[eax], di
push	esi
mov	esi, eax
jz	short loc_10044AB

loc_1004475:		; Radix
push	0Ah
lea	eax, [ebp+EndPtr]
push	eax		; EndPtr
push	esi		; Str
call	ds:wcstoul
add	esp, 0Ch
test	eax, eax
jbe	short loc_1004497
cmp	eax, 10h
jnb	short loc_1004497
mov	ecx, edi
shl	eax, cl
add	edi, 4
or	ebx, eax

loc_1004497:
mov	eax, [ebp+EndPtr]
test	eax, eax
jz	short loc_10044A3
lea	esi, [eax+2]
jmp	short loc_10044A5

loc_10044A3:
inc	esi
inc	esi

loc_10044A5:
cmp	word ptr [esi],	0
jnz	short loc_1004475

loc_10044AB:
pop	esi
mov	eax, ebx
pop	ebx

loc_10044AF:
pop	edi
pop	ebp
retn	4
sub_1004459 endp



; Attributes: bp-based frame

; int __stdcall	sub_10044B4(__int16, int, int, LPCWSTR lpString2, LPWSTR lpString1)
sub_10044B4 proc near

var_10=	dword ptr -10h
var_C= dword ptr -0Ch
var_8= dword ptr -8
var_4= dword ptr -4
arg_0= word ptr	 8
arg_4= dword ptr  0Ch
arg_8= dword ptr  10h
lpString2= dword ptr  14h
lpString1= dword ptr  18h

push	ebp
mov	ebp, esp
sub	esp, 10h
cmp	[ebp+arg_0], 0
push	edi
jz	loc_10045B3
mov	edi, [ebp+arg_4]
test	edi, edi
jz	loc_10045B3
mov	edx, [ebp+lpString2]
mov	ax, word ptr ReturnedString
push	ebx
xor	ecx, ecx
mov	cx, [edx]
push	esi
mov	ebx, edx
jmp	short loc_10044EF

loc_10044E5:
test	cx, cx
jz	short loc_10044F4
inc	ebx
inc	ebx
mov	cx, [ebx]

loc_10044EF:
cmp	cx, ax
jnz	short loc_10044E5

loc_10044F4:
mov	eax, ebx
sub	eax, edx
xor	edx, edx
sar	eax, 1
cmp	[ebp+arg_8], edx
mov	ecx, eax
setnz	dl
mov	esi, edi
mov	[ebp+arg_4], edi
sub	ecx, edx
and	esi, 0Fh
mov	[ebp+var_C], ecx
mov	edx, esi
jmp	short loc_100452A

loc_1004515:
cmp	ecx, edx
jbe	short loc_1004528
sub	ecx, edx
inc	eax
shr	edi, 4
jz	short loc_100452A
mov	edx, edi
and	edx, 0Fh
jmp	short loc_100452A

loc_1004528:
sub	ecx, edx

loc_100452A:
test	ecx, ecx
jg	short loc_1004515
mov	ecx, [ebp+var_C]
and	[ebp+var_4], 0
cmp	[ebp+var_C], 0
mov	[ebp+var_8], ecx
mov	ecx, [ebp+arg_4]
mov	[ebp+arg_4], ecx
mov	ecx, [ebp+lpString1]
mov	[ebp+var_10], esi
lea	esi, [ecx+eax*2]
lea	edi, [ebx-2]
lea	ecx, [esi-2]
jle	short loc_1004595

loc_1004553:
mov	ax, [edi]
dec	[ebp+var_8]
inc	[ebp+var_4]
mov	[ecx], ax
mov	eax, [ebp+var_4]
xor	edx, edx
div	[ebp+var_10]
test	edx, edx
jnz	short loc_100458B
cmp	[ebp+var_8], edx
jle	short loc_100458B
mov	ax, [ebp+arg_0]
and	[ebp+var_4], edx
dec	ecx
dec	ecx
shr	[ebp+arg_4], 4
mov	[ecx], ax
jz	short loc_100458B
mov	eax, [ebp+arg_4]
and	eax, 0Fh
mov	[ebp+var_10], eax

loc_100458B:
dec	ecx
dec	ecx
dec	edi
dec	edi
cmp	[ebp+var_8], 0
jg	short loc_1004553

loc_1004595:
cmp	[ebp+arg_8], 0
jz	short loc_10045A7
mov	eax, [ebp+lpString2]
mov	ax, [eax]
mov	ecx, [ebp+lpString1]
mov	[ecx], ax

loc_10045A7:		; lpString2
push	ebx
push	esi		; lpString1
call	ds:lstrcpyW
pop	esi
pop	ebx
jmp	short loc_10045BF

loc_10045B3:		; lpString2
push	[ebp+lpString2]
push	[ebp+lpString1]	; lpString1
call	ds:lstrcpyW

loc_10045BF:
pop	edi
leave
retn	14h
sub_10044B4 endp



; Attributes: bp-based frame

sub_10045C4 proc near

String=	word ptr -200h

push	ebp
mov	ebp, esp
sub	esp, 200h
push	ebx
push	1
call	sub_10025B2
xor	ebx, ebx
cmp	dword_1014DB8, ebx
jnz	loc_1004673
mov	eax, dword_1014064
cmp	eax, ebx
jz	loc_1004673
push	dword_1014D90
push	eax
call	sub_1008B8C
test	eax, eax
jz	short loc_1004673
mov	eax, dword_1014068
cmp	eax, dword_1014008
jnz	short loc_1004673
mov	eax, dword_1014010
cmp	dword_101406C, eax
jnz	short loc_1004673
mov	ecx, dword_1014070
cmp	ecx, dword_1014D68
jnz	short loc_1004673
mov	ecx, dword_1014074
cmp	ecx, dword_1014D48
jnz	short loc_1004673
mov	ecx, dword_1014084
cmp	ecx, dword_1014D4C
jnz	short loc_1004673
mov	ecx, dword_1014078
cmp	ecx, dword_1014D54
jnz	short loc_1004673
xor	ecx, ecx
cmp	eax, 0Ah
setnz	cl
cmp	dword_101407C, ecx
jnz	short loc_1004673
mov	eax, dword_1014080
cmp	eax, dword_1014DB8
jz	loc_100490D

loc_1004673:
cmp	dword_1014D90, ebx
push	esi
jz	loc_100473E
push	edi
push	dword_1014064	; hMem
call	sub_1007BD1
mov	dword_1014064, ebx
call	sub_1007C26
mov	dword_1014064, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014064
mov	[eax], ebx
mov	eax, dword_1014D90
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014064
mov	[ecx], eax
mov	eax, dword_1014D90
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, dword_1014064
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, dword_1014064
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014064
mov	[eax+4], ebx
mov	eax, dword_1014D90
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014064
mov	[ecx+4], eax
mov	eax, dword_1014D90
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, dword_1014064
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
pop	edi

loc_100473E:
mov	ecx, dword_1014D48
mov	eax, dword_1014008
mov	esi, dword_1014D68
mov	edx, dword_1014D4C
mov	dword_1014074, ecx
mov	ecx, dword_1014D54
mov	dword_1014078, ecx
xor	ecx, ecx
mov	dword_1014068, eax
mov	eax, dword_1014010
cmp	eax, 0Ah
setnz	cl
mov	dword_101406C, eax
mov	dword_1014070, esi
mov	dword_1014084, edx
mov	dword_101407C, ecx
mov	ecx, dword_1014DB8
cmp	ecx, ebx
mov	dword_1014080, ecx
jz	short loc_10047B5
push	eax
push	offset unk_1014DC0
push	offset lpString
call	sub_10022F9
jmp	loc_100485C

loc_10047B5:
cmp	eax, 0Ah
jnz	short loc_10047D1
push	esi
push	eax
push	dword_1014D90
push	offset lpString
call	sub_1005540
jmp	loc_100485C

loc_10047D1:
mov	esi, offset dword_1014D90
push	esi
call	sub_1008A54
push	dword_1014F84
push	dword_1014D90
call	sub_1008F17
test	eax, eax
jz	short loc_100480C
mov	eax, dword_1014D90
mov	eax, [eax]
neg	dword ptr [eax]
push	dword_1014F88
push	esi
call	sub_100BE29
push	esi
call	sub_1005418

loc_100480C:
mov	eax, dword_1014D54
push	dword_1014D38[eax*4]
push	esi
call	sub_100C450
push	ebx
push	dword_1014010
push	dword_1014D90
push	offset lpString
call	sub_1005540
push	lpString	; lpString
call	ds:lstrlenW
dec	eax
js	short loc_100485C
mov	ecx, lpString
lea	eax, [ecx+eax*2]
mov	dx, [eax]
cmp	dx, word ptr ReturnedString
jnz	short loc_1004862
mov	[eax], bx

loc_100485C:
mov	ecx, lpString

loc_1004862:
cmp	dword_1014D4C, ebx
pop	esi
jnz	short loc_1004880
push	0FEh		; iMaxLength
push	ecx		; lpString2
lea	eax, [ebp+String]
push	eax		; lpString1
call	ds:lstrcpynW
jmp	short loc_10048E9

loc_1004880:
mov	eax, dword_1014010
dec	eax
dec	eax
jz	short loc_10048D7
sub	eax, 6
jz	short loc_10048CA
dec	eax
dec	eax
jz	short loc_10048A7
sub	eax, 6
jz	short loc_10048D7
push	ecx		; lpString2
lea	eax, [ebp+String]
push	eax		; lpString1
call	ds:lstrcpyW
jmp	short loc_10048E9

loc_10048A7:
lea	eax, [ebp+String]
push	eax
xor	eax, eax
cmp	word ptr [ecx],	2Dh
push	ecx
setz	al
push	eax
push	dword_1014000
xor	eax, eax
mov	ax, word ptr dword_1014038
push	eax
jmp	short loc_10048E4

loc_10048CA:
lea	eax, [ebp+String]
push	eax
push	ecx
push	ebx
push	3
jmp	short loc_10048E2

loc_10048D7:
lea	eax, [ebp+String]
push	eax		; lpString1
push	ecx		; lpString2
push	ebx		; int
push	4		; int

loc_10048E2:		; __int16
push	20h

loc_10048E4:
call	sub_10044B4

loc_10048E9:
lea	eax, [ebp+String]
push	offset word_1001364 ; lpString2
push	eax		; lpString1
call	ds:lstrcatW
lea	eax, [ebp+String]
push	eax		; lpString
push	hWnd		; hDlg
call	sub_1002604

loc_100490D:
push	ebx
call	sub_10025B2
pop	ebx
leave
retn
sub_10045C4 endp




; DWORD	__stdcall StartAddress(LPVOID)
StartAddress proc near
cmp	dword_1014EF8, 0
jnz	short loc_100499A
push	ebx
push	esi
push	edi
mov	edi, ds:WaitForSingleObject
mov	ebx, 102h

loc_100492D:		; dwMilliseconds
push	0FFFFFFFFh
push	hEvent		; hHandle
call	edi ; WaitForSingleObject
cmp	dword_1014EF8, 0
jnz	short loc_1004997
mov	esi, 2710h
push	esi
jmp	short loc_1004976

loc_1004948:		; uType
push	30h
call	ds:MessageBeep
call	sub_1004441
cmp	dword_1014EF8, 0
jnz	short loc_1004984
cmp	eax, 6
jz	short loc_1004984
cmp	eax, 2
jz	short loc_1004984
add	esi, esi
mov	eax, 9C40h
cmp	esi, eax
jbe	short loc_1004975
mov	esi, eax

loc_1004975:		; dwMilliseconds
push	esi

loc_1004976:		; hHandle
push	dword_1014F00
call	edi ; WaitForSingleObject
cmp	eax, ebx
jz	short loc_1004948
jmp	short loc_100498E

loc_1004984:
mov	dword_1014F58, 1

loc_100498E:
cmp	dword_1014EF8, 0
jz	short loc_100492D

loc_1004997:
pop	edi
pop	esi
pop	ebx

loc_100499A:
push	2Ah
pop	eax
retn	4
StartAddress endp



; Attributes: bp-based frame

sub_10049A0 proc near

ThreadId= dword	ptr -4
arg_0= dword ptr  8

push	ebp
mov	ebp, esp
push	ecx
push	esi
xor	esi, esi
cmp	hEvent,	esi
push	edi
mov	edi, ds:CreateEventW
jnz	short loc_10049C1
push	esi		; lpName
push	esi		; bInitialState
push	esi		; bManualReset
push	esi		; lpEventAttributes
call	edi ; CreateEventW
mov	hEvent,	eax

loc_10049C1:
cmp	dword_1014F00, esi
jnz	short loc_10049D5
push	esi		; lpName
push	esi		; bInitialState
push	1		; bManualReset
push	esi		; lpEventAttributes
call	edi ; CreateEventW
mov	dword_1014F00, eax

loc_10049D5:
cmp	hHandle, esi
jnz	short loc_10049F5
lea	eax, [ebp+ThreadId]
push	eax		; lpThreadId
push	esi		; dwCreationFlags
push	esi		; lpParameter
push	offset StartAddress ; lpStartAddress
push	esi		; dwStackSize
push	esi		; lpThreadAttributes
call	ds:CreateThread
mov	hHandle, eax

loc_10049F5:
cmp	[ebp+arg_0], esi
push	dword_1014F00	; hEvent
jz	short loc_1004A1A
mov	dword_1014F58, esi
call	ds:ResetEvent
push	hEvent		; hEvent
call	ds:SetEvent
jmp	short loc_1004A47

loc_1004A1A:
call	ds:SetEvent
mov	eax, dword_1014F08
cmp	eax, esi
jz	short loc_1004A38
push	esi		; lParam
push	4		; wParam
push	111h		; Msg
push	eax		; hWnd
call	ds:SendMessageW

loc_1004A38:
cmp	dword_1014F58, esi
jz	short loc_1004A47
push	5
call	sub_1004A4D

loc_1004A47:
pop	edi
pop	esi
leave
retn	4
sub_10049A0 endp




sub_1004A4D proc near

arg_0= dword ptr  4

push	esi
mov	esi, [esp+4+arg_0]
push	dword_1014B6C[esi*4] ; lpString
push	hWnd		; hDlg
call	sub_1002604
mov	dword_1014F0C, esi
mov	dword_1014D8C, 1
pop	esi
retn	4
sub_1004A4D endp




sub_1004A78 proc near

; FUNCTION CHUNK AT 010050E6 SIZE 00000006 BYTES

mov	eax, offset loc_101290C
call	sub_1012650
sub	esp, 20h
mov	ecx, [ebp+0Ch]
push	ebx
push	esi
xor	ebx, ebx
lea	eax, [ecx-60h]
cmp	eax, 0Dh	; switch 14 cases
push	edi
mov	[ebp-10h], esp
mov	[ebp-4], ebx
ja	short loc_1004AB2 ; jumptable 01004A9B default case
jmp	ds:off_10050FA[eax*4] ;	switch jump

loc_1004AA2:		; jumptable 01004A9B case 0
cmp	dword_1014D88, ebx
push	dword ptr [ebp+8]
jz	short loc_1004AC3
call	sub_100BB88

loc_1004AB2:		; jumptable 01004A9B default case
mov	ecx, [ebp-0Ch]
pop	edi
pop	esi
mov	large fs:0, ecx
pop	ebx
leave
retn	8

loc_1004AC3:
call	sub_1008A54
jmp	short loc_1004AB2 ; jumptable 01004A9B default case

loc_1004ACA:		; jumptable 01004A9B case 1
push	dword ptr [ebp+8]
call	sub_1005418
jmp	short loc_1004AB2 ; jumptable 01004A9B default case

loc_1004AD4:		; jumptable 01004A9B case 13
push	ebx
mov	[ebp+0Ch], ebx
mov	[ebp-18h], ebx
mov	byte ptr [ebp-4], 1
call	sub_1007BD1
mov	[ebp+0Ch], ebx
call	sub_1007C26
mov	[ebp+0Ch], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+0Ch]
mov	[eax], ebx
mov	eax, dword_1014D98
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+0Ch]
mov	[ecx], eax
mov	eax, dword_1014D98
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+0Ch]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+0Ch]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+0Ch]
mov	[eax+4], ebx
mov	eax, dword_1014D98
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+0Ch]
mov	[ecx+4], eax
mov	eax, dword_1014D98
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+0Ch]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
push	64h		; hMem
lea	eax, [ebp-18h]
and	ecx, 3
push	eax		; int
rep movsb
call	sub_100548F
push	dword ptr [ebp-18h]
lea	eax, [ebp+0Ch]
push	eax
call	sub_100BD6F
push	dword ptr [ebp-18h] ; hMem
call	sub_1007BD1
push	dword ptr [ebp+0Ch]
mov	[ebp-18h], ebx
push	dword ptr [ebp+8]
call	sub_100BBD4
jmp	loc_1004E09

loc_1004BB2:
xor	esi, esi
cmp	[ebp+0Ch], esi
jz	short loc_1004BC4
push	dword ptr [ebp+0Ch] ; hMem
call	sub_1007BD1
mov	[ebp+0Ch], esi

loc_1004BC4:
cmp	[ebp-18h], esi
jz	short loc_1004BD4
push	dword ptr [ebp-18h] ; hMem
call	sub_1007BD1
mov	[ebp-18h], esi

loc_1004BD4:
mov	eax, [ebp-14h]
mov	[ebp-1Ch], eax
push	offset dword_1012A34
lea	eax, [ebp-1Ch]
jmp	loc_10050E6

loc_1004BE7:		; jumptable 01004A9B case 2
cmp	dword_1014010, 0Ah
jnz	loc_1004E95
cmp	dword_1014D88, ebx
jz	short loc_1004C24
cmp	dword_1014D84, ebx
jz	short loc_1004C11
push	dword ptr [ebp+8]
call	sub_10102E1
jmp	loc_1004AB2	; jumptable 01004A9B default case

loc_1004C11:
push	bEnable
push	dword ptr [ebp+8]
call	sub_10102B7
jmp	loc_1004AB2	; jumptable 01004A9B default case

loc_1004C24:
cmp	dword_1014D84, ebx
push	dword ptr [ebp+8]
jz	short loc_1004C39
call	sub_100ED2B
jmp	loc_1004AB2	; jumptable 01004A9B default case

loc_1004C39:
call	sub_1005459
jmp	loc_1004AB2	; jumptable 01004A9B default case

loc_1004C43:		; jumptable 01004A9B case 3
cmp	dword_1014010, 0Ah
jnz	loc_1004E95
cmp	dword_1014D88, ebx
jz	short loc_1004C80
cmp	dword_1014D84, ebx
jz	short loc_1004C6D
push	dword ptr [ebp+8] ; hMem
call	sub_10107FC
jmp	loc_1004AB2	; jumptable 01004A9B default case

loc_1004C6D:
push	bEnable
push	dword ptr [ebp+8]
call	sub_10102C5
jmp	loc_1004AB2	; jumptable 01004A9B default case

loc_1004C80:
cmp	dword_1014D84, ebx
push	dword ptr [ebp+8]
jz	short loc_1004C95
call	sub_100F0E4
jmp	loc_1004AB2	; jumptable 01004A9B default case

loc_1004C95:
call	sub_100546B
jmp	loc_1004AB2	; jumptable 01004A9B default case

loc_1004C9F:		; jumptable 01004A9B case 4
cmp	dword_1014010, 0Ah
jnz	loc_1004E95
cmp	dword_1014D88, ebx
jz	short loc_1004CDC
cmp	dword_1014D84, ebx
jz	short loc_1004CC9
push	dword ptr [ebp+8]
call	sub_101090E
jmp	loc_1004AB2	; jumptable 01004A9B default case

loc_1004CC9:
push	bEnable
push	dword ptr [ebp+8]
call	sub_10102D3
jmp	loc_1004AB2	; jumptable 01004A9B default case

loc_1004CDC:
cmp	dword_1014D84, ebx
push	dword ptr [ebp+8]
jz	short loc_1004CF1
call	sub_100F2A9
jmp	loc_1004AB2	; jumptable 01004A9B default case

loc_1004CF1:
call	sub_100547D
jmp	loc_1004AB2	; jumptable 01004A9B default case

loc_1004CFB:		; jumptable 01004A9B case 11
push	dword ptr [ebp+8]
call	sub_10052B8
jmp	loc_1004AB2	; jumptable 01004A9B default case

loc_1004D08:		; jumptable 01004A9B cases 7,8
cmp	dword_1014D88, ebx
jnz	short loc_1004D27
cmp	dword_1014D48, ebx
jnz	short loc_1004D27
push	2

loc_1004D1A:
push	dword ptr [ebp+8]
call	sub_10086C8
jmp	loc_1004AB2	; jumptable 01004A9B default case

loc_1004D27:
push	dword_1014F90
push	dword ptr [ebp+8]
call	sub_100BE44
jmp	loc_1004AB2	; jumptable 01004A9B default case

loc_1004D3A:		; jumptable 01004A9B case 9
cmp	dword_1014D88, ebx
jz	loc_1004E3B
push	ebx		; hMem
mov	[ebp+0Ch], ebx
mov	byte ptr [ebp-4], 3
call	sub_1007BD1
mov	[ebp+0Ch], ebx
call	sub_1007C26
mov	[ebp+0Ch], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+0Ch]
mov	[eax], ebx
mov	eax, dword_1014F88
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+0Ch]
mov	[ecx], eax
mov	eax, dword_1014F88
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+0Ch]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+0Ch]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+0Ch]
mov	[eax+4], ebx
mov	eax, dword_1014F88
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+0Ch]
mov	[ecx+4], eax
mov	eax, dword_1014F88
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+0Ch]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
push	dword_1014F90
lea	eax, [ebp+0Ch]
push	eax
call	sub_100BC54
push	dword ptr [ebp+0Ch]
push	dword ptr [ebp+8]
call	sub_100BE44

loc_1004E09:		; hMem
push	dword ptr [ebp+0Ch]

loc_1004E0C:
call	sub_1007BD1
jmp	loc_1004AB2	; jumptable 01004A9B default case

loc_1004E16:
cmp	dword ptr [ebp+0Ch], 0
jz	short loc_1004E28
push	dword ptr [ebp+0Ch] ; hMem
call	sub_1007BD1
and	dword ptr [ebp+0Ch], 0

loc_1004E28:
mov	eax, [ebp-18h]
mov	[ebp-20h], eax
push	offset dword_1012A34
lea	eax, [ebp-20h]
jmp	loc_10050E6

loc_1004E3B:
push	3
jmp	loc_1004D1A

loc_1004E42:		; jumptable 01004A9B cases 5,6
cmp	dword_1014D88, ebx
push	dword ptr [ebp+8]
jz	short loc_1004E66
cmp	ecx, 66h
jnz	short loc_1004E5C
call	sub_1005575
jmp	loc_1004AB2	; jumptable 01004A9B default case

loc_1004E5C:
call	sub_100D9B6
jmp	loc_1004AB2	; jumptable 01004A9B default case

loc_1004E66:
cmp	ecx, 66h
jnz	short loc_1004E75
call	sub_100E2DA
jmp	loc_1004AB2	; jumptable 01004A9B default case

loc_1004E75:
call	sub_100DFEF
jmp	loc_1004AB2	; jumptable 01004A9B default case

loc_1004E7F:		; jumptable 01004A9B case 10
push	dword ptr [ebp+8]
call	sub_100D2D4
jmp	loc_1004AB2	; jumptable 01004A9B default case

loc_1004E8C:		; jumptable 01004A9B case 12
cmp	dword_1014010, 0Ah
jz	short loc_1004EA1

loc_1004E95:		; uType
push	ebx
call	ds:MessageBeep
jmp	loc_1004AB2	; jumptable 01004A9B default case

loc_1004EA1:
mov	eax, dword_1014D88
neg	eax
sbb	eax, eax
and	eax, 28h
add	eax, 3Ch
push	eax		; hMem
lea	eax, [ebp-18h]
push	eax		; int
mov	[ebp+0Ch], ebx
mov	[ebp-14h], ebx
mov	[ebp-18h], ebx
mov	byte ptr [ebp-4], 5
call	sub_100548F
push	dword ptr [ebp+0Ch] ; hMem
call	sub_1007BD1
mov	[ebp+0Ch], ebx
call	sub_1007C26
mov	[ebp+0Ch], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+0Ch]
mov	[eax], ebx
mov	ebx, [ebp+8]
mov	eax, [ebx]
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+0Ch]
mov	[ecx], eax
mov	eax, [ebx]
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+0Ch]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+0Ch]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+0Ch]
and	dword ptr [eax+4], 0
mov	eax, [ebx]
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+0Ch]
mov	[ecx+4], eax
mov	eax, [ebx]
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+0Ch]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
push	ebx
rep movsb
call	sub_1008A54
push	dword ptr [ebx]
lea	eax, [ebp+0Ch]
push	eax
call	sub_100BE29
push	dword ptr [ebp-18h]
lea	eax, [ebp+0Ch]
push	eax
call	sub_100BBD4
push	dword ptr [ebp-14h] ; hMem
call	sub_1007BD1
and	dword ptr [ebp-14h], 0
call	sub_1007C26
mov	[ebp-14h], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp-14h]
and	dword ptr [eax], 0
mov	eax, [ebp+0Ch]
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp-14h]
mov	[ecx], eax
mov	eax, [ebp+0Ch]
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp-14h]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp-14h]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp-14h]
and	dword ptr [eax+4], 0
mov	eax, [ebp+0Ch]
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp-14h]
mov	[ecx+4], eax
mov	eax, [ebp+0Ch]
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp-14h]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
lea	eax, [ebp+0Ch]
and	ecx, 3
push	eax
rep movsb
call	sub_1008A54
push	dword ptr [ebp+0Ch]
lea	eax, [ebp-14h]
push	eax
call	sub_100BE29
push	dword ptr [ebp-18h]
lea	eax, [ebp-14h]
push	eax
call	sub_100BBD4
mov	eax, dword_1014D88
neg	eax
sbb	eax, eax
and	eax, 0FFFFFFD8h
add	eax, 64h
push	eax		; hMem
lea	eax, [ebp-18h]
push	eax		; int
call	sub_100548F
push	dword ptr [ebp-18h]
lea	eax, [ebp-14h]
push	eax
call	sub_100BD6F
push	dword ptr [ebp-14h]
lea	eax, [ebp+0Ch]
push	eax
call	sub_100BC54
push	dword ptr [ebp-18h]
lea	eax, [ebp+0Ch]
push	eax
call	sub_100BD6F
push	dword ptr [ebp+0Ch]
push	ebx
call	sub_100BC54
push	dword ptr [ebp-18h] ; hMem
call	sub_1007BD1
and	dword ptr [ebp-18h], 0
push	dword ptr [ebp+0Ch] ; hMem
call	sub_1007BD1
and	dword ptr [ebp+0Ch], 0
push	dword ptr [ebp-14h]
jmp	loc_1004E0C
sub_1004A78 endp




sub_10050A6 proc near
xor	esi, esi
cmp	[ebp-18h], esi
jz	short loc_10050B8
push	dword ptr [ebp-18h] ; hMem
call	sub_1007BD1
mov	[ebp-18h], esi

loc_10050B8:
cmp	[ebp+0Ch], esi
jz	short loc_10050C8
push	dword ptr [ebp+0Ch] ; hMem
call	sub_1007BD1
mov	[ebp+0Ch], esi

loc_10050C8:
cmp	[ebp-14h], esi
jz	short loc_10050D8
push	dword ptr [ebp-14h] ; hMem
call	sub_1007BD1
mov	[ebp-14h], esi

loc_10050D8:
mov	eax, [ebp-28h]
mov	[ebp-24h], eax
push	offset dword_1012A34
lea	eax, [ebp-24h]
sub_10050A6 endp ; sp-analysis failed

; START	OF FUNCTION CHUNK FOR sub_1004A78

loc_10050E6:
push	eax
call	_CxxThrowException
; END OF FUNCTION CHUNK	FOR sub_1004A78



sub_10050EC proc near
push	dword ptr [ebp-2Ch]
call	sub_1004A4D
mov	eax, offset loc_1004AB2	; jumptable 01004A9B default case
retn
sub_10050EC endp

off_10050FA dd offset loc_1004AA2 ; jump table for switch statement
dd offset loc_1004ACA
dd offset loc_1004BE7
dd offset loc_1004C43
dd offset loc_1004C9F
dd offset loc_1004E42
dd offset loc_1004E42
dd offset loc_1004D08
dd offset loc_1004D08
dd offset loc_1004D3A
dd offset loc_1004E7F
dd offset loc_1004CFB
dd offset loc_1004E8C
dd offset loc_1004AD4



sub_1005132 proc near

arg_0= dword ptr  4

cmp	[esp+arg_0], 50h
jl	short loc_1005148
cmp	[esp+arg_0], 8Bh
jg	short loc_1005148
xor	eax, eax
inc	eax
jmp	short locret_100514A

loc_1005148:
xor	eax, eax

locret_100514A:
retn	4
sub_1005132 endp




sub_100514D proc near

arg_0= dword ptr  4

cmp	dword_1014D9C, 0
jnz	short loc_1005182
mov	ecx, [esp+arg_0]
push	ecx
call	sub_1005132
test	eax, eax
jz	short loc_1005182
cmp	dword_1014D48, 0
jz	short loc_1005179
cmp	ecx, 6Bh
jnz	short loc_1005179
mov	eax, 0FF0000h
jmp	short locret_100518A

loc_1005179:
mov	eax, ds:dword_1013E18[ecx*8]
jmp	short locret_100518A

loc_1005182:		; nIndex
push	12h
call	ds:GetSysColor

locret_100518A:
retn	4
sub_100514D endp




sub_100518D proc near

arg_0= dword ptr  4

mov	ecx, [esp+arg_0]
push	ecx
call	sub_1005132
test	eax, eax
jz	short loc_10051A7
mov	eax, ds:dword_1013E1C[ecx*8]
jmp	locret_100524A

loc_10051A7:
mov	eax, 138h
cmp	ecx, eax
jg	short loc_1005203
jz	short loc_10051FF
add	eax, 0FFFFFFFCh
cmp	ecx, eax
jg	short loc_10051E5
jz	short loc_10051E1
sub	ecx, 8Ch
jz	short loc_10051DD
dec	ecx
jz	short loc_10051D9
sub	ecx, 0A5h
jz	short loc_10051D5
dec	ecx
jnz	short loc_100521F
push	7Bh
jmp	short loc_1005249

loc_10051D5:
push	7Ch
jmp	short loc_1005249

loc_10051D9:
push	7Eh
jmp	short loc_1005249

loc_10051DD:
push	7Dh
jmp	short loc_1005249

loc_10051E1:
push	7Ah
jmp	short loc_1005249

loc_10051E5:
sub	ecx, 135h
jz	short loc_10051FB
dec	ecx
jz	short loc_10051F7
dec	ecx
jnz	short loc_100521F
push	15h
jmp	short loc_1005249

loc_10051F7:
push	14h
jmp	short loc_1005249

loc_10051FB:
push	79h
jmp	short loc_1005249

loc_10051FF:
push	16h
jmp	short loc_1005249

loc_1005203:
sub	ecx, 139h
jz	short loc_1005247
dec	ecx
jz	short loc_1005243
dec	ecx
jz	short loc_100523C
dec	ecx
jz	short loc_1005235
sub	ecx, 55h
jz	short loc_100522E
dec	ecx
jz	short loc_1005227
dec	ecx
jz	short loc_1005223

loc_100521F:
xor	eax, eax
jmp	short locret_100524A

loc_1005223:
push	9
jmp	short loc_1005249

loc_1005227:
mov	eax, 83h
jmp	short locret_100524A

loc_100522E:
mov	eax, 82h
jmp	short locret_100524A

loc_1005235:
mov	eax, 81h
jmp	short locret_100524A

loc_100523C:
mov	eax, 80h
jmp	short locret_100524A

loc_1005243:
push	7Fh
jmp	short loc_1005249

loc_1005247:
push	17h

loc_1005249:
pop	eax

locret_100524A:
retn	4
sub_100518D endp




sub_100524D proc near

arg_0= dword ptr  4

mov	ecx, [esp+arg_0]
xor	eax, eax
jmp	short loc_1005258

loc_1005255:
inc	eax
sar	ecx, 1

loc_1005258:
test	cl, 1
jz	short loc_1005255
sar	ecx, 1
jz	short locret_1005267

loc_1005261:
inc	eax
sar	ecx, 1
jnz	short loc_1005261
inc	eax

locret_1005267:
retn	4
sub_100524D endp




sub_100526A proc near
mov	eax, dword_1014010
cmp	eax, 0Ah
jnz	short loc_100527B
mov	eax, dword_1014008
jmp	short loc_100528B

loc_100527B:
push	eax
call	sub_100524D
mov	ecx, eax
mov	eax, dword_1014014
cdq
idiv	ecx

loc_100528B:
mov	dword_10149D8, eax
retn
sub_100526A endp




sub_1005291 proc near
call	sub_100526A
mov	eax, dword_1014010
cmp	eax, 0Ah
jnz	short loc_10052A9
push	dword_10149D8
push	eax
jmp	short loc_10052B2

loc_10052A9:
mov	ecx, dword_10149D8
inc	ecx
push	ecx
push	eax

loc_10052B2:
call	sub_100ABDD
retn
sub_1005291 endp



; Attributes: bp-based frame

sub_10052B8 proc near

hMem= dword ptr	-4
arg_0= dword ptr  8

push	ebp
mov	ebp, esp
push	ecx
push	ebx
push	esi
push	edi
xor	ebx, ebx
push	ebx		; hMem
mov	[ebp+hMem], ebx
call	sub_1007BD1
mov	[ebp+hMem], ebx
call	sub_1007C26
mov	[ebp+hMem], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+hMem]
mov	[eax], ebx
mov	eax, dword_1014F88
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx], eax
mov	eax, dword_1014F88
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+hMem]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+hMem]
mov	[eax+4], ebx
mov	eax, dword_1014F88
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx+4], eax
mov	eax, dword_1014F88
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax+4]
mov	ebx, [ebp+arg_0]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
push	dword ptr [ebx]
lea	eax, [ebp+hMem]
push	eax
call	sub_100BD6F
push	dword ptr [ebx]	; hMem
call	sub_1007BD1
and	dword ptr [ebx], 0
call	sub_1007C26
mov	[ebx], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebx]
and	dword ptr [eax], 0
mov	eax, [ebp+hMem]
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebx]
mov	[ecx], eax
mov	eax, [ebp+hMem]
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebx]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebx]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebx]
and	dword ptr [eax+4], 0
mov	eax, [ebp+hMem]
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebx]
mov	[ecx+4], eax
mov	eax, [ebp+hMem]
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebx]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
push	[ebp+hMem]	; hMem
call	sub_1007BD1
pop	edi
pop	esi
pop	ebx
leave
retn	4
sub_10052B8 endp




sub_1005418 proc near

arg_0= dword ptr  4

cmp	dword_1014010, 0Ah
jnz	short loc_1005441
push	esi
mov	esi, [esp+4+arg_0]
push	esi
call	sub_1008A54
push	dword_1014F88
push	esi
call	sub_100BC54
mov	eax, [esi]
mov	eax, [eax]
neg	dword ptr [eax]
pop	esi
jmp	short locret_1005456

loc_1005441:
mov	eax, dword_1014D54
push	dword_1014D38[eax*4]
push	[esp+4+arg_0]
call	sub_100C474

locret_1005456:
retn	4
sub_1005418 endp




sub_1005459 proc near

arg_0= dword ptr  4

push	bEnable
push	[esp+4+arg_0]
call	sub_1010E65
retn	4
sub_1005459 endp




sub_100546B proc near

arg_0= dword ptr  4

push	bEnable
push	[esp+4+arg_0]
call	sub_1011277
retn	4
sub_100546B endp




sub_100547D proc near

arg_0= dword ptr  4

push	bEnable
push	[esp+4+arg_0]
call	sub_1011569
retn	4
sub_100547D endp



; Attributes: bp-based frame

; int __stdcall	sub_100548F(int, HLOCAL	hMem)
sub_100548F proc near

arg_0= dword ptr  8
hMem= dword ptr	 0Ch

push	ebp
mov	ebp, esp
push	ebx
push	esi
push	edi
push	[ebp+hMem]
call	sub_10081CC
mov	ebx, [ebp+arg_0]
push	dword ptr [ebx]	; hMem
mov	esi, eax
mov	[ebp+hMem], esi
call	sub_1007BD1
and	dword ptr [ebx], 0
call	sub_1007C26
mov	[ebx], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebx]
and	dword ptr [eax], 0
mov	eax, [esi]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebx]
mov	[ecx], eax
mov	esi, [esi]
mov	ecx, [esi+4]
mov	eax, [ebx]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebx]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebx]
and	dword ptr [eax+4], 0
mov	esi, [ebp+hMem]
mov	eax, [esi+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebx]
mov	[ecx+4], eax
mov	esi, [esi+4]
mov	ecx, [esi+4]
mov	eax, [ebx]
mov	edi, [eax+4]
push	[ebp+hMem]	; hMem
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
call	sub_1007BD1
pop	edi
pop	esi
pop	ebx
pop	ebp
retn	8
sub_100548F endp




sub_1005540 proc near

arg_0= dword ptr  4
arg_4= byte ptr	 8
arg_8= dword ptr  0Ch
arg_C= dword ptr  10h

push	edi
push	[esp+4+arg_C]
lea	eax, [esp+8+arg_4]
push	[esp+8+arg_8]
push	eax
call	sub_1008642
mov	edi, eax
test	edi, edi
jz	short loc_1005571
push	esi
mov	esi, [esp+8+arg_0]
mov	eax, [esi]
test	eax, eax
jz	short loc_100556E
push	eax		; hMem
call	ds:LocalFree
and	dword ptr [esi], 0

loc_100556E:
mov	[esi], edi
pop	esi

loc_1005571:
pop	edi
retn	10h
sub_1005540 endp



; Attributes: bp-based frame

sub_1005575 proc near

hMem= dword ptr	-4
arg_0= dword ptr  8

push	ebp
mov	ebp, esp
push	ecx
push	ebx
push	esi
push	edi
push	0Ah		; hMem
lea	eax, [ebp+hMem]
xor	esi, esi
push	eax		; int
mov	[ebp+hMem], esi
call	sub_100548F
mov	ebx, [ebp+arg_0]
push	dword ptr [ebx]
lea	eax, [ebp+hMem]
push	eax
call	sub_100E2F5
push	dword ptr [ebx]	; hMem
call	sub_1007BD1
mov	[ebx], esi
call	sub_1007C26
mov	[ebx], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebx]
mov	[eax], esi
mov	eax, [ebp+hMem]
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebx]
mov	[ecx], eax
mov	eax, [ebp+hMem]
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebx]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebx]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebx]
and	dword ptr [eax+4], 0
mov	eax, [ebp+hMem]
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebx]
mov	[ecx+4], eax
mov	eax, [ebp+hMem]
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebx]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
push	[ebp+hMem]	; hMem
call	sub_1007BD1
pop	edi
pop	esi
pop	ebx
leave
retn	4
sub_1005575 endp




sub_100563C proc near
push	0		; uType
call	ds:MessageBeep
push	10h		; uType
push	0		; lpCaption
push	lpText		; lpText
push	hWnd		; hWnd
call	ds:MessageBoxW
retn
sub_100563C endp



; Attributes: bp-based frame

; int __stdcall	sub_100565B(const WCHAR	String)
sub_100565B proc near

var_212= byte ptr -212h
String1= word ptr -210h
var_10=	dword ptr -10h
hMem= dword ptr	-0Ch
var_8= dword ptr -8
var_4= dword ptr -4
String=	word ptr  8

push	ebp
mov	ebp, esp
sub	esp, 210h
mov	eax, dword ptr [ebp+String]
cmp	eax, 12Ch
push	ebx
push	esi
push	edi
jz	loc_10059D5
cmp	eax, 12Dh
jz	loc_10057CB
cmp	eax, 12Eh
jz	loc_1005792
mov	esi, 12Fh
cmp	eax, esi
jz	loc_1005726
jbe	loc_1005A73
cmp	eax, 131h
jbe	short loc_10056CB
cmp	eax, 13Dh
jnz	loc_1005A73
xor	ebx, ebx
push	ebx
push	ebx
push	dword_1014B98
call	ds:GetDesktopWindow
push	eax
call	sub_1007B0E
jmp	loc_1005A73

loc_10056CB:
lea	esi, [eax-130h]
cmp	dword_1014D48, esi
jz	loc_1005A73
lea	eax, [esi+30h]
mov	[ebp+String], ax
lea	eax, [ebp+String]
push	eax		; lpString
push	offset aLayout	; "layout"
xor	ebx, ebx
push	offset aScicalc	; "SciCalc"
mov	[ebp+0Ah], bx
call	ds:WriteProfileStringW
cmp	hDlg, ebx
jz	short loc_1005714
cmp	dword_1014D48, ebx
jnz	short loc_1005714
push	ebx		; bEnable
call	sub_1006893

loc_1005714:		; hWnd
push	1
mov	dword_1014D48, esi
call	sub_1001A17
jmp	loc_1005A73

loc_1005726:
mov	edi, ds:CheckMenuItem
xor	eax, eax
xor	ebx, ebx
cmp	dword_1014D4C, ebx
setz	al
mov	dword_1014D4C, eax
neg	eax
sbb	eax, eax
and	eax, 8
push	eax		; uCheck
push	esi		; uIDCheckItem
push	hMenu		; hMenu
call	edi ; CheckMenuItem
mov	eax, dword_1014D7C
cmp	eax, ebx
jz	short loc_100576A
mov	ecx, dword_1014D4C
neg	ecx
sbb	ecx, ecx
and	ecx, 8
push	ecx		; uCheck
push	esi		; uIDCheckItem
push	eax		; hMenu
call	edi ; CheckMenuItem

loc_100576A:
cmp	dword_1014D4C, ebx
mov	eax, offset word_100157C
jnz	short loc_100577C
mov	eax, offset dword_1001578

loc_100577C:		; lpString
push	eax
push	offset aUsesep	; "UseSep"
push	offset aScicalc	; "SciCalc"
call	ds:WriteProfileStringW
jmp	loc_1005A73

loc_1005792:		; "SC"
push	offset IconName
push	hInstance	; hInstance
call	ds:LoadIconW
push	eax		; hIcon
push	0		; szOtherStuff
push	szApp		; szApp
push	hWnd		; hWnd
call	ds:ShellAboutW
cmp	eax, 0FFFFFFFFh
jnz	loc_1005A73
call	sub_100563C
jmp	loc_1005A73

loc_10057CB:		; hWndNewOwner
push	hWnd
xor	ebx, ebx
mov	[ebp+var_4], ebx
call	ds:OpenClipboard
test	eax, eax
jnz	short loc_10057FF
push	30h		; uType
push	szApp		; lpCaption
push	dword_1014B90	; lpText
push	hWnd		; hWnd
call	ds:MessageBoxW
jmp	loc_1005A73

loc_10057FF:		; uFormat
push	1
call	ds:GetClipboardData
mov	esi, eax
cmp	esi, ebx
mov	[ebp+hMem], esi
jz	loc_10059CA
push	esi		; hMem
call	ds:GlobalLock
mov	edi, eax
cmp	edi, ebx
jz	loc_10059CA
push	esi		; hMem
call	ds:GlobalSize
add	eax, edi
cmp	dword_1014D8C, ebx
mov	[ebp+var_10], eax
mov	dword ptr [ebp+String],	ebx
jnz	loc_10059C1
jmp	short loc_1005848

loc_1005842:
mov	edi, [ebp+var_8]
mov	eax, [ebp+var_10]

loc_1005848:
cmp	edi, eax
jnb	loc_10059C1
movsx	si, byte ptr [edi]
push	edi		; lpsz
call	ds:CharNextA
cmp	si, 20h
mov	[ebp+var_8], eax
jz	loc_10059B5
push	0Ah
pop	edx
cmp	si, dx
jz	loc_10059B5
cmp	si, 0Dh
jz	loc_10059B5
cmp	si, word ptr dword_1014038
jz	loc_10059B5
cmp	si, bx
jz	loc_10059C1
cmp	si, word ptr ReturnedString
jnz	short loc_10058A8
mov	dword ptr [ebp+String],	esi
push	55h

loc_10058A2:
pop	esi
jmp	loc_1005977

loc_10058A8:
cmp	[ebp+String], bx
jnz	short loc_10058C0
cmp	si, 2Dh
jnz	short loc_10058C0
mov	[ebp+var_4], 1
jmp	loc_10059B5

loc_10058C0:
mov	eax, dword_1014010
push	78h
pop	ecx
cmp	si, cx
jz	short loc_10058D3
cmp	si, 65h
jnz	short loc_10058DE

loc_10058D3:
cmp	eax, edx
jnz	short loc_10058DE
mov	dword ptr [ebp+String],	ecx
push	75h
jmp	short loc_10058A2

loc_10058DE:
cmp	[ebp+String], cx
jnz	short loc_1005905
cmp	si, 2Bh
jnz	short loc_10058F2
cmp	eax, edx
jz	loc_10059B5

loc_10058F2:
push	2Dh
pop	ecx
cmp	si, cx
jnz	short loc_1005913
cmp	eax, edx
jnz	short loc_1005913
mov	dword ptr [ebp+String],	ecx
push	50h
jmp	short loc_10058A2

loc_1005905:
cmp	[ebp+String], 3Ah
jnz	short loc_1005913
mov	edi, 80h
jmp	short loc_1005915

loc_1005913:
xor	edi, edi

loc_1005915:
cmp	si, 3Ah
mov	dword ptr [ebp+String],	esi
jz	loc_10059B5
movzx	eax, si
push	eax		; C
call	ds:toupper
add	eax, edi
movzx	eax, ax
pop	ecx
xor	ecx, ecx
cmp	eax, 30h
jz	short loc_100594D

loc_1005939:
cmp	ecx, 42h
jge	short loc_100594B
inc	ecx
cmp	eax, ds:dword_1001368[ecx*8]
jnz	short loc_1005939
cmp	ecx, 42h

loc_100594B:
jz	short loc_10059C1

loc_100594D:
xor	esi, esi
cmp	dword_1014010, 0Ah
mov	si, ds:word_100136C[ecx*8]
jz	short loc_1005977
movzx	eax, si
cmp	eax, 13Ah
jl	short loc_1005977
cmp	eax, 13Ch
jg	short loc_1005977
add	esi, 0FFFDh

loc_1005977:
mov	edi, ds:SendMessageW
movzx	eax, si
push	ebx		; lParam
or	eax, 10000h
push	eax		; wParam
push	111h		; Msg
push	hWnd		; hWnd
call	edi ; SendMessageW
cmp	[ebp+var_4], ebx
jz	short loc_10059B5
cmp	si, 7Ch
jz	short loc_10059B5
push	ebx		; lParam
push	10050h		; wParam
push	111h		; Msg
push	hWnd		; hWnd
call	edi ; SendMessageW
mov	[ebp+var_4], ebx

loc_10059B5:
cmp	dword_1014D8C, ebx
jz	loc_1005842

loc_10059C1:		; hMem
push	[ebp+hMem]
call	ds:GlobalUnlock

loc_10059CA:
call	ds:CloseClipboard
jmp	loc_1005A73

loc_10059D5:
xor	ebx, ebx
cmp	dword_1014DB8, ebx
jz	short loc_10059F4
push	dword_1014010
push	offset unk_1014DC0
push	offset lpString
call	sub_10022F9

loc_10059F4:		; lpString2
push	lpString
lea	eax, [ebp+String1]
push	eax		; lpString1
call	ds:lstrcpyW
cmp	dword_1014DB8, ebx
jz	short loc_1005A18
cmp	dword_1014DC4, 0FFFFFFFFh
jnz	short loc_1005A3B

loc_1005A18:
lea	eax, [ebp+String1]
push	eax		; lpString
call	ds:lstrlenW
lea	eax, [ebp+eax*2+var_212]
mov	cx, [eax]
cmp	cx, word ptr ReturnedString
jnz	short loc_1005A3B
mov	[eax], bx

loc_1005A3B:
lea	eax, [ebp+String1]
push	eax		; lpString
push	dword_1014D70	; hWnd
call	ds:SetWindowTextW
mov	esi, ds:SendMessageW
push	0FFFFFFFFh	; lParam
push	ebx		; wParam
push	0B1h		; Msg
push	dword_1014D70	; hWnd
call	esi ; SendMessageW
push	ebx		; lParam
push	ebx		; wParam
push	300h		; Msg
push	dword_1014D70	; hWnd
call	esi ; SendMessageW

loc_1005A73:
pop	edi
pop	esi
pop	ebx
leave
retn	4
sub_100565B endp




sub_1005A7A proc near
mov	eax, offset loc_1012916
call	sub_1012650
sub	esp, 0Ch
mov	eax, [ebp+8]
push	ebx
push	esi
xor	esi, esi
cmp	eax, 5Ah
push	edi
mov	[ebp-10h], esp
mov	[ebp-14h], esi
mov	[ebp-4], esi
jg	loc_1005D7C
jz	loc_1005F05
sub	eax, 7
jz	loc_1005C40
sub	eax, 4Fh
jz	loc_1005C33
dec	eax
jz	loc_1005C26
dec	eax
jz	loc_1005C0A
dec	eax
jnz	loc_1006049
push	dword ptr [ebp-14h] ; hMem
call	sub_1007BD1
mov	[ebp-14h], esi
call	sub_1007C26
mov	[ebp-14h], eax
mov	eax, [ebp-14h]
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp-14h]
mov	ebx, [ebp+0Ch]
mov	[eax], esi
mov	eax, [ebx]
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp-14h]
mov	[ecx], eax
mov	eax, [ebx]
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp-14h]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
mov	eax, [ebp-14h]
and	ecx, 3
rep movsb
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp-14h]
and	dword ptr [eax+4], 0
mov	eax, [ebx]
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp-14h]
mov	[ecx+4], eax
mov	eax, [ebx]
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp-14h]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
push	dword ptr [ebx]	; hMem
call	sub_1007BD1
and	dword ptr [ebx], 0
call	sub_1007C26
mov	[ebx], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebx]
and	dword ptr [eax], 0
mov	esi, [ebp+10h]
mov	eax, [esi]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebx]
mov	[ecx], eax
mov	esi, [esi]
mov	ecx, [esi+4]
mov	eax, [ebx]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebx]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebx]
and	dword ptr [eax+4], 0
mov	esi, [ebp+10h]
mov	eax, [esi+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebx]
push	dword ptr [ebp-14h]
mov	[ecx+4], eax
mov	esi, [esi+4]
mov	ecx, [esi+4]
mov	eax, [ebx]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
push	ebx
rep movsb
call	sub_100BF18
jmp	loc_1006049

loc_1005C0A:
push	dword ptr [ebp+10h]
push	dword ptr [ebp+0Ch]
call	sub_100C474

loc_1005C15:
mov	ecx, [ebp-0Ch]
pop	edi
pop	esi
mov	large fs:0, ecx
pop	ebx
leave
retn	0Ch

loc_1005C26:
push	dword ptr [ebp+10h]
push	dword ptr [ebp+0Ch]
call	sub_100C462
jmp	short loc_1005C15

loc_1005C33:
push	dword ptr [ebp+10h]
push	dword ptr [ebp+0Ch]
call	sub_100C450
jmp	short loc_1005C15

loc_1005C40:		; hMem
push	dword ptr [ebp-14h]
call	sub_1007BD1
mov	[ebp-14h], esi
call	sub_1007C26
mov	[ebp-14h], eax
mov	eax, [ebp-14h]
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp-14h]
mov	ebx, [ebp+0Ch]
mov	[eax], esi
mov	eax, [ebx]
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp-14h]
mov	[ecx], eax
mov	eax, [ebx]
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp-14h]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
mov	eax, [ebp-14h]
and	ecx, 3
rep movsb
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp-14h]
and	dword ptr [eax+4], 0
mov	eax, [ebx]
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp-14h]
mov	[ecx+4], eax
mov	eax, [ebx]
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp-14h]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
push	dword ptr [ebx]	; hMem
call	sub_1007BD1
and	dword ptr [ebx], 0
call	sub_1007C26
mov	[ebx], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebx]
and	dword ptr [eax], 0
mov	esi, [ebp+10h]
mov	eax, [esi]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebx]
mov	[ecx], eax
mov	esi, [esi]
mov	ecx, [esi+4]
mov	eax, [ebx]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebx]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebx]
and	dword ptr [eax+4], 0
mov	esi, [ebp+10h]
mov	eax, [esi+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebx]
push	dword ptr [ebp-14h]
mov	[ecx+4], eax
mov	esi, [esi+4]
mov	ecx, [esi+4]
mov	eax, [ebx]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
push	ebx
rep movsb
call	sub_100C03A
jmp	loc_1006049

loc_1005D7C:
sub	eax, 5Bh
jz	loc_100608E
dec	eax
jz	loc_100607E
dec	eax
jz	loc_1006067
dec	eax
jz	loc_1005F05
dec	eax
jnz	loc_1006049
push	dword ptr [ebp-14h] ; hMem
call	sub_1007BD1
mov	[ebp-14h], esi
call	sub_1007C26
mov	[ebp-14h], eax
mov	eax, [ebp-14h]
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp-14h]
mov	ebx, [ebp+0Ch]
mov	[eax], esi
mov	eax, [ebx]
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp-14h]
mov	[ecx], eax
mov	eax, [ebx]
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp-14h]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
mov	eax, [ebp-14h]
and	ecx, 3
rep movsb
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp-14h]
and	dword ptr [eax+4], 0
mov	eax, [ebx]
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp-14h]
mov	[ecx+4], eax
mov	eax, [ebx]
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp-14h]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
push	dword ptr [ebx]	; hMem
call	sub_1007BD1
and	dword ptr [ebx], 0
call	sub_1007C26
mov	[ebx], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebx]
and	dword ptr [eax], 0
mov	esi, [ebp+10h]
mov	eax, [esi]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebx]
mov	[ecx], eax
mov	esi, [esi]
mov	ecx, [esi+4]
mov	eax, [ebx]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebx]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebx]
and	dword ptr [eax+4], 0
mov	esi, [ebp+10h]
mov	eax, [esi+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebx]
mov	[ecx+4], eax
mov	esi, [esi+4]
mov	ecx, [esi+4]
mov	eax, [ebx]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
xor	eax, eax
rep movsb
cmp	dword_1014D88, eax
jz	short loc_1005EF7
push	eax		; __int16
push	8Ch		; nIDButton
mov	dword_1014D88, eax
call	sub_100660D
push	dword ptr [ebp-14h]
push	ebx
call	sub_100BE44
jmp	loc_1006049

loc_1005EF7:
push	dword ptr [ebp-14h]
push	ebx
call	sub_100E2F5
jmp	loc_1006049

loc_1005F05:		; hMem
push	dword ptr [ebp-14h]
call	sub_1007BD1
mov	[ebp-14h], esi
call	sub_1007C26
mov	[ebp-14h], eax
mov	eax, [ebp-14h]
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp-14h]
mov	ebx, [ebp+0Ch]
mov	[eax], esi
mov	eax, [ebx]
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp-14h]
mov	[ecx], eax
mov	eax, [ebx]
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp-14h]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
mov	eax, [ebp-14h]
and	ecx, 3
rep movsb
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp-14h]
and	dword ptr [eax+4], 0
mov	eax, [ebx]
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp-14h]
mov	[ecx+4], eax
mov	eax, [ebx]
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp-14h]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
push	dword ptr [ebx]	; hMem
call	sub_1007BD1
and	dword ptr [ebx], 0
call	sub_1007C26
mov	[ebx], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebx]
and	dword ptr [eax], 0
mov	esi, [ebp+10h]
mov	eax, [esi]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebx]
mov	[ecx], eax
mov	esi, [esi]
mov	ecx, [esi+4]
mov	eax, [ebx]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebx]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebx]
and	dword ptr [eax+4], 0
mov	esi, [ebp+10h]
mov	eax, [esi+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebx]
mov	[ecx+4], eax
mov	esi, [esi+4]
mov	ecx, [esi+4]
mov	eax, [ebx]
mov	edi, [eax+4]
push	dword ptr [ebp-14h]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
cmp	dword ptr [ebp+8], 5Ah
rep movsb
push	ebx
jnz	short loc_1006044
call	sub_100BD6F
jmp	short loc_1006049

loc_1006044:
call	sub_100C266

loc_1006049:
cmp	dword ptr [ebp-14h], 0
jz	loc_1005C15
push	dword ptr [ebp-14h] ; hMem
call	sub_1007BD1
mov	dword ptr [ebp-14h], 0
jmp	loc_1005C15

loc_1006067:
push	dword ptr [ebp+10h]
mov	esi, [ebp+0Ch]
push	esi
call	sub_100BE29
mov	eax, [esi]
mov	eax, [eax]
neg	dword ptr [eax]
jmp	loc_1005C15

loc_100607E:
push	dword ptr [ebp+10h]
push	dword ptr [ebp+0Ch]
call	sub_100BC54
jmp	loc_1005C15

loc_100608E:
push	dword ptr [ebp+10h]
push	dword ptr [ebp+0Ch]
call	sub_100BBD4
jmp	loc_1005C15
sub_1005A7A endp




sub_100609E proc near
cmp	dword ptr [ebp-14h], 0
jz	short loc_10060B3
push	dword ptr [ebp-14h] ; hMem
call	sub_1007BD1
mov	dword ptr [ebp-14h], 0

loc_10060B3:
push	dword ptr [ebp-18h]
call	sub_1004A4D
mov	eax, offset loc_1005C15
retn
sub_100609E endp




; int __stdcall	sub_10060C1(HWND, HINSTANCE hInstance, int)
sub_10060C1 proc near

arg_0= dword ptr  4
hInstance= dword ptr  8
arg_8= dword ptr  0Ch

push	esi
push	6Dh		; lpMenuName
push	[esp+8+hInstance] ; hInstance
call	ds:LoadMenuW
mov	esi, eax
test	esi, esi
jz	short loc_1006112
mov	eax, [esp+4+arg_8]
push	edi
push	0		; LPTPMPARAMS
push	[esp+0Ch+arg_0]	; HWND
shr	eax, 10h
push	eax		; int
movzx	eax, word ptr [esp+14h+arg_8]
push	eax		; int
push	102h		; UINT
push	0		; nPos
push	esi		; hMenu
call	ds:GetSubMenu
push	eax		; HMENU
call	ds:TrackPopupMenuEx
push	esi		; hMenu
mov	edi, eax
call	ds:DestroyMenu
xor	eax, eax
cmp	edi, 8
setz	al
pop	edi
jmp	short loc_1006114

loc_1006112:
xor	eax, eax

loc_1006114:
pop	esi
retn	0Ch
sub_10060C1 endp



; Attributes: bp-based frame

; int __stdcall	sub_1006118(int, UINT Msg, int hWnd, LPCWSTR lParam)
sub_1006118 proc near

Rect= tagRECT ptr -10h
arg_0= dword ptr  8
Msg= dword ptr	0Ch
hWnd= dword ptr	 10h
lParam=	dword ptr  14h

push	ebp
mov	ebp, esp
sub	esp, 10h
push	ebx
push	esi
push	edi
mov	edi, [ebp+Msg]
cmp	edi, 7Bh
ja	loc_10063CD
jz	loc_1006336
cmp	edi, 5
jz	loc_100628D
cmp	edi, 10h
jz	loc_100623F
cmp	edi, 1Ah
jz	loc_1006207
cmp	edi, 4Eh
jz	short loc_1006177
cmp	edi, 53h
jnz	loc_10063EB
xor	ebx, ebx
push	ebx
push	ebx
push	dword_1014B98
call	ds:GetDesktopWindow
push	eax
call	sub_1007B0E
jmp	loc_1006521

loc_1006177:
mov	esi, [ebp+lParam]
cmp	dword ptr [esi+8], 0FFFFFFF4h
mov	ebx, [esi+4]
jnz	loc_1006521
push	ebx
call	sub_1005132
test	eax, eax
jz	loc_1006521
mov	eax, [esi+0Ch]
cmp	eax, 3
jnz	short loc_10061A1
push	20h
jmp	short loc_1006201

loc_10061A1:
cmp	eax, 1
jnz	loc_1006521
mov	edi, ds:SetBkMode
push	eax		; mode
push	dword ptr [esi+10h] ; hdc
call	edi ; SetBkMode
test	byte ptr [esi+28h], 4
mov	[ebp+hWnd], eax
mov	eax, dword_1014910[ebx*4]
mov	[ebp+lParam], eax
jz	short loc_10061D3
push	11h		; nIndex
call	ds:GetSysColor
jmp	short loc_10061D9

loc_10061D3:
push	ebx
call	sub_100514D

loc_10061D9:		; color
push	eax
push	dword ptr [esi+10h] ; hdc
call	ds:SetTextColor
push	25h		; format
lea	eax, [esi+14h]
push	eax		; lprc
push	0FFFFFFFFh	; cchText
push	[ebp+lParam]	; lpchText
push	dword ptr [esi+10h] ; hdc
call	ds:DrawTextW
push	[ebp+hWnd]	; mode
push	dword ptr [esi+10h] ; hdc
call	edi ; SetBkMode
push	4

loc_1006201:
pop	eax
jmp	loc_1006523

loc_1006207:
xor	ebx, ebx
cmp	[ebp+lParam], ebx
jz	short loc_1006234
mov	esi, ds:lstrcmpW
push	offset aColors	; "colors"
push	[ebp+lParam]	; lpString1
call	esi ; lstrcmpW
test	eax, eax
jz	short loc_1006234
push	offset AppName	; "intl"
push	[ebp+lParam]	; lpString1
call	esi ; lstrcmpW
test	eax, eax
jnz	loc_1006521

loc_1006234:		; hWnd
push	ebx
call	sub_1001A17
jmp	loc_1006521

loc_100623F:
mov	eax, hDlg
xor	ebx, ebx
cmp	eax, ebx
jz	short loc_100625B
push	ebx		; lParam
push	ebx		; wParam
push	10h		; Msg
push	eax		; hWnd
call	ds:SendMessageW
mov	hDlg, ebx

loc_100625B:		; hWnd
push	hWnd
call	ds:DestroyWindow
call	sub_100436C
push	ebx		; dwData
push	2		; uCommand
push	lpszHelp	; lpszHelp
push	hWnd		; hWndMain
call	ds:WinHelpW
push	ebx		; nExitCode
call	ds:PostQuitMessage
jmp	loc_1006521

loc_100628D:
push	5
xor	ebx, ebx
cmp	[ebp+hWnd], 1
pop	ecx
jnz	short loc_100629A
xor	ecx, ecx

loc_100629A:
mov	eax, hDlg
cmp	eax, ebx
jz	short loc_10062B6
cmp	[ebp+hWnd], 1
jz	short loc_10062AE
cmp	[ebp+hWnd], ebx
jnz	short loc_10062B6

loc_10062AE:		; nCmdShow
push	ecx
push	eax		; hWnd
call	ds:ShowWindow

loc_10062B6:		; nIDDlgItem
push	3E8h
push	hWnd		; hDlg
call	ds:GetDlgItem
mov	esi, eax
cmp	esi, ebx
jz	loc_10063EB
lea	eax, [ebp+Rect]
push	eax		; lpRect
push	esi		; hWnd
call	ds:GetClientRect
push	2		; cPoints
lea	eax, [ebp+Rect]
push	eax		; lpPoints
push	hWnd		; hWndTo
push	esi		; hWndFrom
call	ds:MapWindowPoints
mov	eax, [ebp+lParam]
mov	esi, [ebp+Rect.bottom]
shr	eax, 10h
sub	esi, eax
jz	loc_10063EB
lea	eax, [ebp+Rect]
push	eax		; lpRect
push	hWnd		; hWnd
call	ds:GetWindowRect
mov	eax, [ebp+Rect.bottom]
sub	eax, [ebp+Rect.top]
push	16h		; uFlags
add	eax, esi
push	eax		; cy
mov	eax, [ebp+Rect.right]
sub	eax, [ebp+Rect.left]
push	eax		; cx
push	ebx		; Y
push	ebx		; X
push	ebx		; hWndInsertAfter
push	hWnd		; hWnd
call	ds:SetWindowPos
jmp	loc_1006521

loc_1006336:
mov	ebx, [ebp+hWnd]
mov	eax, hWnd
cmp	ebx, eax
mov	edi, ds:GetDlgCtrlID
jnz	short loc_100638B
movsx	ecx, word ptr [ebp+lParam]
mov	[ebp+Rect.right], ecx
movsx	ecx, word ptr [ebp+lParam+2]
mov	[ebp+Rect.bottom], ecx
lea	ecx, [ebp+Rect.right]
push	ecx		; lpPoint
push	eax		; hWnd
call	ds:ScreenToClient
push	[ebp+Rect.bottom]
push	[ebp+Rect.right] ; Point
push	hWnd		; hWndParent
call	ds:ChildWindowFromPoint
mov	esi, eax
test	esi, esi
jz	short loc_10063C5
cmp	esi, hWnd
jz	short loc_10063C5
push	esi		; hWnd
call	edi ; GetDlgCtrlID
cmp	eax, 0FFFFFFFFh
jz	short loc_10063C5
mov	ebx, esi

loc_100638B:		; int
push	[ebp+lParam]
push	hInstance	; hInstance
push	hWnd		; HWND
call	sub_10060C1
test	eax, eax
jz	loc_1006521
push	ebx		; hWnd
call	edi ; GetDlgCtrlID
push	eax
call	sub_100518D
push	eax		; dwData
push	8		; uCommand
push	lpszHelp	; lpszHelp
push	ebx		; hWndMain
call	ds:WinHelpW
jmp	loc_1006521

loc_10063C5:
push	[ebp+lParam]
push	ebx
push	7Bh
jmp	short loc_10063F2

loc_10063CD:
mov	eax, edi
sub	eax, 111h
jz	loc_10064A4
dec	eax
jz	loc_100647D
sub	eax, 5
jz	short loc_1006450
sub	eax, 21h
jz	short loc_1006400

loc_10063EB:		; lParam
push	[ebp+lParam]
push	[ebp+hWnd]	; wParam
push	edi		; Msg

loc_10063F2:		; hWnd
push	[ebp+arg_0]
call	ds:DefWindowProcW
jmp	loc_1006523

loc_1006400:		; hWnd
push	[ebp+lParam]
call	ds:GetDlgCtrlID
cmp	eax, 193h
jnz	short loc_1006443
push	5		; nIndex
call	ds:GetSysColorBrush
mov	esi, ds:GetSysColor
push	5		; nIndex
mov	edi, eax
call	esi ; GetSysColor
push	eax		; color
push	[ebp+hWnd]	; hdc
call	ds:SetBkColor
push	8		; nIndex
call	esi ; GetSysColor
push	eax		; color
push	[ebp+hWnd]	; hdc
call	ds:SetTextColor
mov	eax, edi
jmp	loc_1006523

loc_1006443:
push	[ebp+lParam]
push	[ebp+hWnd]
push	138h
jmp	short loc_10063F2

loc_1006450:		; format
push	1
call	ds:IsClipboardFormatAvailable
neg	eax
sbb	eax, eax
and	eax, 0FFFFFFFDh
add	eax, 3
push	eax		; uEnable
push	12Dh		; uIDEnableItem
push	[ebp+arg_0]	; hWnd
call	ds:GetMenu
push	eax		; hMenu
call	ds:EnableMenuItem
jmp	loc_1006521

loc_100647D:
mov	eax, [ebp+hWnd]
and	eax, 0FFF0h
cmp	eax, 0F060h
jnz	short loc_1006494
push	0		; nExitCode
call	ds:PostQuitMessage

loc_1006494:
push	[ebp+lParam]
push	[ebp+hWnd]
push	112h
jmp	loc_10063F2

loc_10064A4:
mov	ecx, [ebp+hWnd]
mov	eax, ecx
shr	eax, 10h
cmp	cx, 5Eh
mov	[ebp+lParam], ecx
jnz	short loc_10064C5
cmp	dword_1014D48, 1
jnz	short loc_10064C5
mov	[ebp+lParam], 6Dh

loc_10064C5:
cmp	ax, 1
jnz	short loc_1006503
movzx	eax, word ptr [ebp+lParam]
push	eax		; nIDDlgItem
push	hWnd		; hDlg
call	ds:GetDlgItem
mov	esi, ds:SendMessageW
xor	ebx, ebx
push	ebx		; lParam
push	1		; wParam
mov	edi, 0F3h
push	edi		; Msg
push	eax		; hWnd
mov	[ebp+hWnd], eax
call	esi ; SendMessageW
push	14h		; dwMilliseconds
call	ds:Sleep
push	ebx		; lParam
push	ebx		; wParam
push	edi		; Msg
push	[ebp+hWnd]	; hWnd
call	esi ; SendMessageW

loc_1006503:
mov	eax, [ebp+lParam]
cmp	ax, 193h
jz	short loc_1006521
cmp	ax, 191h
jz	short loc_1006521
cmp	ax, 192h
jz	short loc_1006521
movzx	eax, ax
push	eax
call	sub_10042FC

loc_1006521:
xor	eax, eax

loc_1006523:
pop	edi
pop	esi
pop	ebx
leave
retn	10h
sub_1006118 endp



; Attributes: bp-based frame

; int __stdcall	sub_100652A(HWND hWnd, UINT Msg, WPARAM	wParam,	LPARAM lParam)
sub_100652A proc near

hWnd= dword ptr	 8
Msg= dword ptr	0Ch
wParam=	dword ptr  10h
lParam=	dword ptr  14h

push	ebp
mov	ebp, esp
cmp	[ebp+Msg], 200h
jb	short loc_1006543
cmp	[ebp+Msg], 20Dh
ja	short loc_1006543
xor	eax, eax
jmp	short loc_1006564

loc_1006543:		; hWnd
push	[ebp+hWnd]
call	ds:HideCaret
push	[ebp+lParam]	; lParam
push	[ebp+wParam]	; wParam
push	[ebp+Msg]	; Msg
push	[ebp+hWnd]	; hWnd
push	lpPrevWndFunc	; lpPrevWndFunc
call	ds:CallWindowProcW

loc_1006564:
pop	ebp
retn	10h
sub_100652A endp




sub_1006568 proc near
mov	eax, dword_1014278
mov	ecx, dword_1014010
cmp	eax, ecx
jz	loc_1006602
xor	edx, edx
cmp	ecx, 0Ah
push	ebx
mov	ebx, ds:GetDlgItem
setz	dl
cmp	eax, 0Ah
push	ebp
push	esi
push	edi
mov	edi, ds:EnableWindow
mov	ebp, edx
jz	short loc_100659E
test	ebp, ebp
jz	short loc_10065BA

loc_100659E:
xor	esi, esi

loc_10065A0:		; bEnable
push	ebp
push	dword_101427C[esi] ; nIDDlgItem
push	hWnd		; hDlg
call	ebx ; GetDlgItem
push	eax		; hWnd
call	edi ; EnableWindow
add	esi, 4
cmp	esi, 1Ch
jbe	short loc_10065A0

loc_10065BA:
push	2
pop	esi
cmp	dword_1014010, esi
jle	short loc_10065E4

loc_10065C5:		; bEnable
push	1
lea	eax, [esi+7Ch]
push	eax		; nIDDlgItem
push	hWnd		; hDlg
call	ebx ; GetDlgItem
push	eax		; hWnd
call	edi ; EnableWindow
inc	esi
cmp	esi, dword_1014010
jl	short loc_10065C5
cmp	esi, 10h
jge	short loc_10065FE

loc_10065E4:
add	esi, 7Ch

loc_10065E7:		; bEnable
push	0
push	esi		; nIDDlgItem
push	hWnd		; hDlg
call	ebx ; GetDlgItem
push	eax		; hWnd
call	edi ; EnableWindow
inc	esi
cmp	esi, 8Ch
jl	short loc_10065E7

loc_10065FE:
pop	edi
pop	esi
pop	ebp
pop	ebx

loc_1006602:
mov	eax, dword_1014010
mov	dword_1014278, eax
retn
sub_1006568 endp




; int __stdcall	sub_100660D(int	nIDButton, __int16)
sub_100660D proc near

nIDButton= dword ptr  4
arg_4= word ptr	 8

movzx	eax, [esp+arg_4]
push	eax		; uCheck
push	[esp+4+nIDButton] ; nIDButton
push	hWnd		; hDlg
call	ds:CheckDlgButton
retn	8
sub_100660D endp




; int __stdcall	sub_1006626(int, BOOL bEnable, int)
sub_1006626 proc near

arg_0= dword ptr  4
bEnable= dword ptr  8
arg_8= dword ptr  0Ch

cmp	[esp+arg_0], 0Ah
push	ebx
push	ebp
push	esi
push	edi
mov	ebp, 139h
mov	ebx, 136h
jnz	short loc_1006682
mov	esi, [esp+10h+bEnable]
mov	eax, hMenu
add	esi, 13Ah
test	eax, eax
mov	[esp+10h+bEnable], esi
jz	short loc_100665F
push	eax		; hMenu
push	hWnd		; hWnd
call	ds:SetMenu

loc_100665F:		; flags
push	0
push	esi		; check
mov	esi, 13Ch
push	esi		; last
mov	edi, 13Ah
push	edi		; first
push	hMenu		; hmenu
call	ds:CheckMenuRadioItem
push	[esp+10h+bEnable]
push	esi
push	edi
jmp	short loc_10066B6

loc_1006682:
mov	esi, [esp+10h+arg_8]
mov	eax, dword_1014D7C
add	esi, 136h
test	eax, eax
jz	short loc_10066A2
push	eax		; hMenu
push	hWnd		; hWnd
call	ds:SetMenu

loc_10066A2:		; flags
push	0
push	esi		; check
push	ebp		; last
push	ebx		; first
push	dword_1014D7C	; hmenu
call	ds:CheckMenuRadioItem
push	esi		; nIDCheckButton
push	ebp		; nIDLastButton
push	ebx		; nIDFirstButton

loc_10066B6:		; hDlg
push	hWnd
call	ds:CheckRadioButton
mov	esi, [esp+10h+arg_0]
mov	edi, ds:GetDlgItem
xor	eax, eax
cmp	esi, 0Ah
setnz	al
sub	esi, 0Ah
neg	esi
sbb	esi, esi
and	esi, 5
mov	[esp+10h+bEnable], eax

loc_10066E2:		; bEnable
push	[esp+10h+bEnable]
push	ebx		; nIDDlgItem
push	hWnd		; hDlg
call	edi ; GetDlgItem
push	eax		; hWnd
call	ds:EnableWindow
push	esi		; nCmdShow
push	ebx		; nIDDlgItem
push	hWnd		; hDlg
call	edi ; GetDlgItem
push	eax		; hWnd
call	ds:ShowWindow
inc	ebx
cmp	ebx, ebp
jle	short loc_10066E2
xor	ebx, ebx
cmp	[esp+10h+arg_0], 0Ah
mov	esi, 13Ah
setz	bl

loc_100671B:		; bEnable
push	ebx
push	esi		; nIDDlgItem
push	hWnd		; hDlg
call	edi ; GetDlgItem
push	eax		; hWnd
call	ds:EnableWindow
cmp	[esp+10h+arg_0], 0Ah
jz	short loc_1006737
xor	eax, eax
jmp	short loc_100673A

loc_1006737:
push	5
pop	eax

loc_100673A:		; nCmdShow
push	eax
push	esi		; nIDDlgItem
push	hWnd		; hDlg
call	edi ; GetDlgItem
push	eax		; hWnd
call	ds:ShowWindow
inc	esi
cmp	esi, 13Ch
jle	short loc_100671B
pop	edi
pop	esi
pop	ebp
pop	ebx
retn	0Ch
sub_1006626 endp




sub_100675B proc near

arg_0= dword ptr  4

push	ebx
push	ebp
push	esi
mov	esi, [esp+0Ch+arg_0]
cmp	esi, 2
push	edi
mov	edi, 133h
mov	ebx, 135h
mov	ebp, 132h
jz	short loc_10067AF
cmp	esi, 8
jz	short loc_10067A8
cmp	esi, 0Ah
jz	short loc_10067B1
cmp	esi, 10h
jz	short loc_10067A4
cmp	esi, 131h
jbe	short loc_10067B1
cmp	esi, ebx
ja	short loc_10067B1
mov	eax, esi
shl	eax, 2
mov	ecx, offset unk_101476C
sub	ecx, eax
mov	edi, esi
mov	esi, [ecx]
jmp	short loc_10067B1

loc_10067A4:
mov	edi, ebp
jmp	short loc_10067B1

loc_10067A8:
mov	edi, 134h
jmp	short loc_10067B1

loc_10067AF:
mov	edi, ebx

loc_10067B1:		; int
push	dword_1014D54
push	bEnable		; bEnable
push	esi		; int
call	sub_1006626
push	0		; flags
push	edi		; check
push	ebx		; last
push	ebp		; first
push	1		; nPos
push	hWnd		; hWnd
call	ds:GetMenu
push	eax		; hMenu
call	ds:GetSubMenu
push	eax		; hmenu
call	ds:CheckMenuRadioItem
push	edi		; nIDCheckButton
push	ebx		; nIDLastButton
push	ebp		; nIDFirstButton
push	hWnd		; hDlg
call	ds:CheckRadioButton
mov	dword_1014010, esi
call	sub_1005291
call	sub_1006568
call	sub_10045C4
pop	edi
pop	esi
pop	ebp
pop	ebx
retn	4
sub_100675B endp




sub_100680F proc near

arg_0= word ptr	 4
arg_4= dword ptr  8

cmp	[esp+arg_0], 1
jnz	short loc_100683D
mov	eax, [esp+arg_4]
push	40h		; uFlags
add	eax, 60h
push	eax		; dwBytes
push	hMem		; hMem
call	ds:GlobalReAlloc
xor	ecx, ecx
test	eax, eax
setz	cl
mov	dword_1014F14, eax
mov	eax, ecx
jmp	short locret_1006856

loc_100683D:		; lParam
push	lpString
push	0		; wParam
push	180h		; Msg
push	dword_1014D78	; hWnd
call	ds:SendMessageW

locret_1006856:
retn	8
sub_100680F endp



; Attributes: bp-based frame

sub_1006859 proc near

Caption= word ptr -64h

push	ebp
mov	ebp, esp
sub	esp, 64h
push	0		; uType
call	ds:MessageBeep
push	31h		; nMaxCount
lea	eax, [ebp+Caption]
push	eax		; lpString
push	hDlg		; hWnd
call	ds:GetWindowTextW
push	0		; uType
lea	eax, [ebp+Caption]
push	eax		; lpCaption
push	lpText		; lpText
push	hDlg		; hWnd
call	ds:MessageBoxW
leave
retn
sub_1006859 endp




; int __stdcall	sub_1006893(BOOL bEnable)
sub_1006893 proc near

bEnable= dword ptr  4

push	esi
push	edi
xor	edi, edi
cmp	[esp+8+bEnable], edi
jz	short loc_1006904
push	edi		; dwInitParam
push	offset sub_100699D ; lpDialogFunc
push	edi		; hWndParent
push	67h		; lpTemplateName
push	hInstance	; hInstance
mov	dword_1014F1C, 18h
call	ds:CreateDialogParamW
push	edi		; dwBytes
push	42h		; uFlags
mov	hDlg, eax
call	ds:GlobalAlloc
cmp	eax, edi
mov	hMem, eax
jnz	short loc_10068F4
call	sub_1006859
push	edi		; lParam
push	196h		; wParam
push	111h		; Msg
push	hDlg		; hWnd
call	ds:SendMessageW
jmp	loc_1006998

loc_10068F4:		; nCmdShow
push	1
push	hDlg		; hWnd
call	ds:ShowWindow
jmp	short loc_1006971

loc_1006904:
mov	eax, hDlg
cmp	eax, edi
jz	short loc_1006971
push	eax		; hWnd
call	ds:DestroyWindow
push	hMem		; hMem
call	ds:GlobalLock
xor	esi, esi
cmp	uValue,	edi
mov	dword_1014F18, eax
jle	short loc_100694D

loc_100692F:
mov	eax, dword_1014F18
push	dword ptr [eax+esi*4] ;	hMem
call	sub_1007BD1
mov	eax, dword_1014F18
mov	[eax+esi*4], edi
inc	esi
cmp	esi, uValue
jl	short loc_100692F

loc_100694D:		; hMem
push	hMem
call	ds:GlobalUnlock
push	hMem		; hMem
mov	uValue,	edi
call	ds:GlobalFree
mov	hDlg, edi

loc_1006971:
xor	esi, esi

loc_1006973:		; bEnable
push	[esp+8+bEnable]
push	dword_10142AC[esi] ; nIDDlgItem
push	hWnd		; hDlg
call	ds:GetDlgItem
push	eax		; hWnd
call	ds:EnableWindow
add	esi, 4
cmp	esi, 10h
jb	short loc_1006973

loc_1006998:
pop	edi
pop	esi
retn	4
sub_1006893 endp



; Attributes: bp-based frame

; INT_PTR __stdcall sub_100699D(HWND, UINT, WPARAM, LPARAM)
sub_100699D proc near

hDlg= dword ptr	 8
arg_4= dword ptr  0Ch
arg_8= dword ptr  10h
arg_C= dword ptr  14h

push	ebp
mov	ebp, esp
mov	eax, [ebp+arg_4]
push	ebx
dec	eax
dec	eax
push	esi
push	edi
jz	loc_1006E5F
sub	eax, 0Eh
jz	loc_1006E58
sub	eax, 43h
jz	loc_1006E33
sub	eax, 28h
jz	loc_1006E21
sub	eax, 95h
jz	loc_1006E0C
dec	eax
jnz	loc_1006E08
mov	eax, [ebp+arg_8]
shr	eax, 10h
cmp	ax, 2
jz	loc_1006CBE
cmp	word ptr [ebp+arg_8], 19Ah
jz	loc_1006CBE
movzx	eax, word ptr [ebp+arg_8]
sub	eax, 194h
mov	esi, ds:SendMessageW
jz	short loc_1006A29
dec	eax
jz	loc_1006BC3
sub	eax, 6
jnz	loc_1006E08
push	hWnd		; hWnd
call	ds:SetFocus
jmp	loc_1006E66

loc_1006A29:
xor	edi, edi
push	edi		; lParam
push	edi		; wParam
push	188h		; Msg
push	dword_1014D78	; hWnd
call	esi ; SendMessageW
cmp	eax, 0FFFFFFFFh
mov	dword_1014300, eax
jz	loc_1006CB2
mov	ecx, uValue
lea	edx, [ecx-1]
cmp	eax, edx
jg	loc_1006CB2
cmp	ecx, edi
jz	loc_1006CB2
push	edi		; lParam
movzx	eax, ax
push	eax		; wParam
push	182h		; Msg
push	dword_1014D78	; hWnd
call	esi ; SendMessageW
dec	uValue
jz	loc_1006BC5
mov	ecx, dword_1014300
cmp	ecx, eax
jl	short loc_1006A8D
cmp	eax, edi
jnz	short loc_1006A90

loc_1006A8D:
lea	eax, [ecx+1]

loc_1006A90:
movzx	eax, ax
push	edi		; lParam
dec	eax
push	eax		; wParam
push	186h		; Msg
push	dword_1014D78	; hWnd
call	esi ; SendMessageW
push	hMem		; hMem
call	ds:GlobalLock
mov	dword_1014F18, eax
mov	eax, dword_1014300
mov	[ebp+arg_8], eax

loc_1006ABC:
cmp	eax, uValue
jge	loc_1006C46
mov	ebx, [ebp+arg_8]
mov	eax, dword_1014F18
shl	ebx, 2
push	dword ptr [ebx+eax] ; hMem
call	sub_1007BD1
mov	eax, dword_1014F18
mov	[ebx+eax], edi
call	sub_1007C26
mov	ecx, dword_1014F18
mov	[ebx+ecx], eax
mov	eax, dword_1014F18
mov	eax, [ebx+eax]
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014F18
mov	eax, [ebx+eax]
mov	[eax], edi
mov	eax, dword_1014F18
mov	eax, [ebx+eax+4]
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014F18
mov	ecx, [ebx+ecx]
mov	[ecx], eax
mov	eax, dword_1014F18
add	eax, ebx
mov	ecx, [eax+4]
mov	esi, [ecx]
mov	eax, [eax]
mov	ecx, [esi+4]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, dword_1014F18
mov	eax, [ebx+eax]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014F18
mov	eax, [ebx+eax]
and	dword ptr [eax+4], 0
mov	eax, dword_1014F18
mov	eax, [ebx+eax+4]
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014F18
mov	ecx, [ebx+ecx]
mov	[ecx+4], eax
mov	eax, dword_1014F18
add	ebx, eax
mov	eax, [ebx+4]
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebx]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
inc	[ebp+arg_8]
mov	eax, [ebp+arg_8]
rep movsb
xor	edi, edi
jmp	loc_1006ABC

loc_1006BC3:
xor	edi, edi

loc_1006BC5:		; lParam
push	edi
push	edi		; wParam
push	184h		; Msg
push	dword_1014D78	; hWnd
call	esi ; SendMessageW
push	edi		; bSigned
push	edi		; uValue
push	198h		; nIDDlgItem
push	[ebp+hDlg]	; hDlg
call	ds:SetDlgItemInt
push	hMem		; hMem
call	ds:GlobalLock
xor	esi, esi
cmp	uValue,	edi
mov	dword_1014F18, eax
jle	short loc_1006C1D

loc_1006BFF:
mov	eax, dword_1014F18
push	dword ptr [eax+esi*4] ;	hMem
call	sub_1007BD1
mov	eax, dword_1014F18
mov	[eax+esi*4], edi
inc	esi
cmp	esi, uValue
jl	short loc_1006BFF

loc_1006C1D:		; hMem
push	hMem
call	ds:GlobalUnlock
push	hMem		; hMem
call	ds:GlobalFree
push	edi		; dwBytes
push	42h		; uFlags
mov	uValue,	edi
call	ds:GlobalAlloc
jmp	short loc_1006CA8

loc_1006C46:		; hMem
push	hMem
call	ds:GlobalUnlock
push	edi		; bSigned
push	uValue		; uValue
push	198h		; nIDDlgItem
push	[ebp+hDlg]	; hDlg
call	ds:SetDlgItemInt
push	hMem		; hMem
call	ds:GlobalSize
mov	ecx, eax
mov	eax, uValue
cdq
idiv	dword_1014F1C
test	edx, edx
jnz	loc_1006E66
push	40h		; uFlags
add	ecx, 0FFFFFFA0h
push	ecx		; dwBytes
push	hMem		; hMem
call	ds:GlobalReAlloc
cmp	eax, edi
mov	dword_1014F14, eax
jz	loc_1006E66

loc_1006CA8:
mov	hMem, eax
jmp	loc_1006E66

loc_1006CB2:		; uType
push	edi
call	ds:MessageBeep
jmp	loc_1006E08

loc_1006CBE:		; hMem
push	hMem
call	ds:GlobalLock
xor	ebx, ebx
push	ebx		; lParam
push	ebx		; wParam
push	188h		; Msg
push	dword_1014D78	; hWnd
mov	dword_1014F18, eax
call	ds:SendMessageW
cmp	uValue,	ebx
mov	dword_1014300, eax
jle	loc_1006DE0
cmp	eax, 0FFFFFFFFh
jz	loc_1006DE0
push	dword_1014D90	; hMem
call	sub_1007BD1
mov	dword_1014D90, ebx
call	sub_1007C26
mov	dword_1014D90, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014D90
mov	ecx, dword_1014300
mov	[eax], ebx
mov	eax, dword_1014F18
mov	eax, [eax+ecx*4]
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014D90
mov	[ecx], eax
mov	eax, dword_1014F18
mov	ecx, dword_1014300
mov	eax, [eax+ecx*4]
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, dword_1014D90
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, dword_1014D90
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014D90
mov	ecx, dword_1014300
mov	[eax+4], ebx
mov	eax, dword_1014F18
mov	eax, [eax+ecx*4]
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014D90
mov	[ecx+4], eax
mov	eax, dword_1014F18
mov	ecx, dword_1014300
mov	eax, [eax+ecx*4]
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, dword_1014D90
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
jmp	short loc_1006DE7

loc_1006DE0:		; uType
push	ebx
call	ds:MessageBeep

loc_1006DE7:
mov	dword_1014DB8, ebx
call	sub_10045C4
push	hMem		; hMem
mov	dword_1014D58, 20h
call	ds:GlobalUnlock

loc_1006E08:
xor	eax, eax
jmp	short loc_1006E69

loc_1006E0C:		; nIDDlgItem
push	197h
push	[ebp+hDlg]	; hDlg
call	ds:GetDlgItem
mov	dword_1014D78, eax
jmp	short loc_1006E66

loc_1006E21:
push	offset unk_10142C0
push	0Ah
push	lpszHelp
push	[ebp+arg_8]
jmp	short loc_1006E50

loc_1006E33:
mov	eax, [ebp+arg_C]
push	dword ptr [eax+8] ; nIDDlgItem
push	[ebp+hDlg]	; hDlg
call	ds:GetDlgItem
push	offset unk_10142C0 ; dwData
push	0Ch		; uCommand
push	lpszHelp	; lpszHelp
push	eax		; hWndMain

loc_1006E50:
call	ds:WinHelpW
jmp	short loc_1006E66

loc_1006E58:		; bEnable
push	0
call	sub_1006893

loc_1006E5F:
and	uValue,	0

loc_1006E66:
xor	eax, eax
inc	eax

loc_1006E69:
pop	edi
pop	esi
pop	ebx
pop	ebp
retn	10h
sub_100699D endp



; Attributes: bp-based frame

; int __stdcall	sub_1006E70(HLOCAL hMem)
sub_1006E70 proc near

var_C= dword ptr -0Ch
var_8= dword ptr -8
var_4= dword ptr -4
hMem= dword ptr	 8

push	ebp
mov	ebp, esp
sub	esp, 0Ch
mov	eax, [ebp+hMem]
cmp	eax, 76h
push	ebx
push	esi
push	edi
jb	loc_1007A57
cmp	eax, 77h
jbe	loc_10077AD
cmp	eax, 78h
jz	loc_10070A7
cmp	eax, 79h
jnz	loc_1007A57
mov	eax, uValue
cdq
idiv	dword_1014F1C
mov	esi, ds:GlobalCompact
or	edi, 0FFFFFFFFh
test	edx, edx
jnz	short loc_1006EF0
push	hMem		; hMem
call	ds:GlobalSize
mov	ebx, eax
push	ebx
push	1
call	sub_100680F
test	eax, eax
jz	short loc_1006EE6
push	edi		; dwMinFree
call	esi ; GlobalCompact
push	ebx
push	1
call	sub_100680F
test	eax, eax
jnz	loc_100709D

loc_1006EE6:
mov	eax, dword_1014F14
mov	hMem, eax

loc_1006EF0:		; nIDDlgItem
push	197h
push	hDlg		; hDlg
call	ds:GetDlgItem
xor	ebx, ebx
push	ebx
push	2
mov	dword_1014D78, eax
call	sub_100680F
cmp	eax, edi
jz	short loc_1006F19
cmp	eax, 0FFFFFFFEh
jnz	short loc_1006F35

loc_1006F19:		; dwMinFree
push	edi
call	esi ; GlobalCompact
push	ebx
push	2
call	sub_100680F
cmp	eax, edi
jz	loc_100709D
cmp	eax, 0FFFFFFFEh
jz	loc_100709D

loc_1006F35:		; lParam
push	ebx
movzx	eax, ax
push	eax		; wParam
push	186h		; Msg
push	dword_1014D78	; hWnd
call	ds:SendMessageW
push	hMem		; hMem
call	ds:GlobalLock
mov	ecx, uValue
mov	dword_1014F18, eax
push	dword ptr [eax+ecx*4] ;	hMem
call	sub_1007BD1
mov	eax, dword_1014F18
mov	ecx, uValue
mov	[eax+ecx*4], ebx
call	sub_1007C26
mov	ecx, dword_1014F18
mov	edx, uValue
mov	[ecx+edx*4], eax
mov	eax, dword_1014F18
mov	ecx, uValue
mov	eax, [eax+ecx*4]
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014F18
mov	ecx, uValue
mov	eax, [eax+ecx*4]
mov	[eax], ebx
mov	eax, dword_1014D90
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	edx, uValue
mov	ecx, dword_1014F18
mov	ecx, [ecx+edx*4]
mov	[ecx], eax
mov	eax, dword_1014D90
mov	esi, [eax]
mov	eax, dword_1014F18
mov	edx, uValue
mov	eax, [eax+edx*4]
mov	ecx, [esi+4]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, dword_1014F18
mov	ecx, uValue
mov	eax, [eax+ecx*4]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014F18
mov	ecx, uValue
mov	eax, [eax+ecx*4]
mov	[eax+4], ebx
mov	eax, dword_1014D90
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	edx, uValue
mov	ecx, dword_1014F18
mov	ecx, [ecx+edx*4]
mov	[ecx+4], eax
mov	eax, dword_1014D90
mov	esi, [eax+4]
mov	eax, uValue
mov	edx, dword_1014F18
mov	ecx, [esi+4]
mov	eax, [edx+eax*4]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
inc	uValue
push	ebx		; bSigned
push	uValue		; uValue
push	198h		; nIDDlgItem
push	hDlg		; hDlg
call	ds:SetDlgItemInt
jmp	loc_1007A57

loc_100709D:
call	sub_1006859
jmp	loc_1007A63

loc_10070A7:
xor	ebx, ebx
cmp	uValue,	1
mov	[ebp+hMem], ebx
mov	[ebp+var_4], ebx
mov	[ebp+var_8], ebx
jg	loc_1007180
push	dword_1014D90	; hMem
call	sub_1007BD1
mov	dword_1014D90, ebx
call	sub_1007C26
mov	dword_1014D90, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014D90
mov	[eax], ebx
mov	eax, dword_1014F84
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014D90
mov	[ecx], eax
mov	eax, dword_1014F84
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, dword_1014D90
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, dword_1014D90
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014D90
mov	[eax+4], ebx
mov	eax, dword_1014F84
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014D90
mov	[ecx+4], eax
mov	eax, dword_1014F84
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, dword_1014D90
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
jmp	loc_1007A63

loc_1007180:		; hMem
push	hMem
call	ds:GlobalLock
push	dword_1014D90	; hMem
mov	dword_1014F18, eax
call	sub_1007BD1
mov	dword_1014D90, ebx
call	sub_1007C26
mov	dword_1014D90, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014D90
mov	[eax], ebx
mov	eax, dword_1014F84
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014D90
mov	[ecx], eax
mov	eax, dword_1014F84
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, dword_1014D90
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, dword_1014D90
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014D90
mov	[eax+4], ebx
mov	eax, dword_1014F84
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014D90
mov	[ecx+4], eax
mov	eax, dword_1014F84
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, dword_1014D90
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
push	[ebp+hMem]	; hMem
call	sub_1007BD1
mov	[ebp+hMem], ebx
call	sub_1007C26
mov	[ebp+hMem], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+hMem]
mov	[eax], ebx
mov	eax, dword_1014F84
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx], eax
mov	eax, dword_1014F84
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+hMem]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+hMem]
mov	[eax+4], ebx
mov	eax, dword_1014F84
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx+4], eax
mov	eax, dword_1014F84
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, uValue
xor	esi, esi
cmp	eax, ebx
mov	[ebp+var_C], esi
jle	loc_100748D
jmp	short loc_1007308

loc_1007305:
mov	esi, [ebp+var_C]

loc_1007308:		; hMem
push	[ebp+var_4]
call	sub_1007BD1
mov	[ebp+var_4], ebx
call	sub_1007C26
mov	[ebp+var_4], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+var_4]
mov	[eax], ebx
mov	eax, dword_1014F18
mov	eax, [eax+esi*4]
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+var_4]
mov	[ecx], eax
mov	eax, dword_1014F18
mov	eax, [eax+esi*4]
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+var_4]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+var_4]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+var_4]
mov	esi, [ebp+var_C]
mov	[eax+4], ebx
mov	eax, dword_1014F18
mov	eax, [eax+esi*4]
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+var_4]
mov	[ecx+4], eax
mov	eax, dword_1014F18
mov	eax, [eax+esi*4]
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+var_4]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
push	[ebp+var_4]
lea	eax, [ebp+hMem]
push	eax
call	sub_100BC54
push	[ebp+var_8]	; hMem
call	sub_1007BD1
mov	[ebp+var_8], ebx
call	sub_1007C26
mov	[ebp+var_8], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+var_8]
mov	[eax], ebx
mov	eax, [ebp+var_4]
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+var_8]
mov	[ecx], eax
mov	eax, [ebp+var_4]
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+var_8]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+var_8]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+var_8]
mov	[eax+4], ebx
mov	eax, [ebp+var_4]
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+var_8]
mov	[ecx+4], eax
mov	eax, [ebp+var_4]
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+var_8]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
push	[ebp+var_4]
lea	eax, [ebp+var_8]
push	eax
call	sub_100BBD4
push	[ebp+var_8]
push	offset dword_1014D90
call	sub_100BC54
inc	[ebp+var_C]
mov	eax, uValue
cmp	[ebp+var_C], eax
jl	loc_1007305

loc_100748D:		; hMem
push	eax
lea	eax, [ebp+var_8]
push	eax		; int
call	sub_100548F
push	[ebp+var_4]	; hMem
call	sub_1007BD1
mov	[ebp+var_4], ebx
call	sub_1007C26
mov	[ebp+var_4], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+var_4]
mov	[eax], ebx
mov	eax, [ebp+hMem]
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+var_4]
mov	[ecx], eax
mov	eax, [ebp+hMem]
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+var_4]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+var_4]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+var_4]
mov	[eax+4], ebx
mov	eax, [ebp+hMem]
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+var_4]
mov	[ecx+4], eax
mov	eax, [ebp+hMem]
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+var_4]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
push	[ebp+hMem]
lea	eax, [ebp+var_4]
push	eax
call	sub_100BBD4
push	[ebp+var_8]
lea	eax, [ebp+var_4]
push	eax
call	sub_100BD6F
push	[ebp+hMem]	; hMem
call	sub_1007BD1
mov	[ebp+hMem], ebx
call	sub_1007C26
mov	[ebp+hMem], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+hMem]
mov	[eax], ebx
mov	eax, dword_1014D90
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx], eax
mov	eax, dword_1014D90
mov	esi, [eax]
mov	ecx, [esi+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, [ebp+hMem]
mov	edi, [eax]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+hMem]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+hMem]
mov	[eax+4], ebx
mov	eax, dword_1014D90
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx+4], eax
mov	eax, dword_1014D90
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
push	[ebp+var_4]
lea	eax, [ebp+hMem]
push	eax
call	sub_100BE29
push	[ebp+hMem]
call	sub_100BD61
test	eax, eax
jz	loc_10076A9
push	dword_1014D90	; hMem
call	sub_1007BD1
mov	dword_1014D90, ebx
call	sub_1007C26
mov	dword_1014D90, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014D90
mov	[eax], ebx
mov	eax, dword_1014F84
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014D90
mov	[ecx], eax
mov	eax, dword_1014F84
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, dword_1014D90
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, dword_1014D90
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014D90
mov	[eax+4], ebx
mov	eax, dword_1014F84
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014D90
mov	[ecx+4], eax
mov	eax, dword_1014F84
jmp	loc_100776C

loc_10076A9:
cmp	dword_1014D88, ebx
jnz	short loc_10076C0
push	dword_1014F88
lea	eax, [ebp+var_8]
push	eax
call	sub_100BE29

loc_10076C0:
push	[ebp+var_8]
lea	eax, [ebp+hMem]
push	eax
call	sub_100BD6F
push	dword_1014F90
lea	eax, [ebp+hMem]
push	eax
call	sub_100BE44
push	dword_1014D90	; hMem
call	sub_1007BD1
mov	dword_1014D90, ebx
call	sub_1007C26
mov	dword_1014D90, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014D90
mov	[eax], ebx
mov	eax, [ebp+hMem]
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014D90
mov	[ecx], eax
mov	eax, [ebp+hMem]
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, dword_1014D90
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, dword_1014D90
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014D90
mov	[eax+4], ebx
mov	eax, [ebp+hMem]
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014D90
mov	[ecx+4], eax
mov	eax, [ebp+hMem]

loc_100776C:
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, dword_1014D90
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
push	[ebp+var_8]	; hMem
call	sub_1007BD1
push	[ebp+var_4]	; hMem
mov	[ebp+var_8], ebx
call	sub_1007BD1
push	[ebp+hMem]
mov	[ebp+var_4], ebx
jmp	loc_1007A52

loc_10077AD:		; hMem
push	hMem
xor	ebx, ebx
mov	[ebp+var_4], ebx
call	ds:GlobalLock
push	dword_1014D90	; hMem
mov	dword_1014F18, eax
call	sub_1007BD1
mov	dword_1014D90, ebx
call	sub_1007C26
mov	dword_1014D90, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014D90
mov	[eax], ebx
mov	eax, dword_1014F84
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014D90
mov	[ecx], eax
mov	eax, dword_1014F84
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, dword_1014D90
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, dword_1014D90
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014D90
mov	[eax+4], ebx
mov	eax, dword_1014F84
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014D90
mov	[ecx+4], eax
mov	eax, dword_1014F84
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, dword_1014D90
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, uValue
xor	edi, edi
cmp	eax, ebx
mov	[ebp+var_C], edi
jle	loc_1007A1B
jmp	short loc_1007896

loc_1007893:
mov	edi, [ebp+var_C]

loc_1007896:		; hMem
push	[ebp+var_4]
call	sub_1007BD1
call	sub_1007C26
mov	esi, eax
push	dword ptr [esi]
mov	[ebp+var_4], esi
call	sub_1007BC1
mov	[esi], ebx
mov	eax, dword_1014F18
mov	eax, [eax+edi*4]
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	[esi], eax
mov	ecx, dword_1014F18
mov	ecx, [ecx+edi*4]
mov	esi, [ecx]
mov	ecx, [esi+4]
lea	ecx, ds:0Ch[ecx*4]
mov	edi, eax
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	esi, [ebp+var_4]
push	dword ptr [esi+4]
call	sub_1007BC1
mov	edi, [ebp+var_C]
mov	[esi+4], ebx
mov	eax, dword_1014F18
mov	eax, [eax+edi*4]
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	[esi+4], eax
mov	ecx, dword_1014F18
mov	ecx, [ecx+edi*4]
mov	esi, [ecx+4]
mov	ecx, [esi+4]
lea	ecx, ds:0Ch[ecx*4]
mov	edi, eax
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
cmp	dword_1014D88, ebx
jz	loc_10079FD
push	ebx		; hMem
mov	[ebp+var_8], ebx
call	sub_1007BD1
mov	[ebp+var_8], ebx
call	sub_1007C26
mov	[ebp+var_8], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+var_8]
mov	esi, [ebp+var_4]
mov	[eax], ebx
mov	eax, [esi]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+var_8]
mov	[ecx], eax
mov	esi, [esi]
mov	ecx, [esi+4]
mov	eax, [ebp+var_8]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+var_8]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+var_8]
mov	esi, [ebp+var_4]
mov	[eax+4], ebx
mov	eax, [esi+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+var_8]
mov	[ecx+4], eax
mov	esi, [esi+4]
mov	ecx, [esi+4]
mov	eax, [ebp+var_8]
mov	edi, [eax+4]
push	[ebp+var_4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
lea	eax, [ebp+var_8]
and	ecx, 3
push	eax
rep movsb
call	sub_100BBD4
push	[ebp+var_8]
push	offset dword_1014D90
call	sub_100BC54
push	[ebp+var_8]	; hMem
call	sub_1007BD1
jmp	short loc_1007A0A

loc_10079FD:
push	[ebp+var_4]
push	offset dword_1014D90
call	sub_100BC54

loc_1007A0A:
inc	[ebp+var_C]
mov	eax, uValue
cmp	[ebp+var_C], eax
jl	loc_1007893

loc_1007A1B:
cmp	[ebp+hMem], 76h
jnz	short loc_1007A4F
cmp	eax, ebx
mov	[ebp+hMem], ebx
jnz	short loc_1007A30
push	ebx
call	sub_1004A4D
jmp	short loc_1007A57

loc_1007A30:		; hMem
push	eax
lea	eax, [ebp+hMem]
push	eax		; int
call	sub_100548F
push	[ebp+hMem]
push	offset dword_1014D90
call	sub_100BD6F
push	[ebp+hMem]	; hMem
call	sub_1007BD1

loc_1007A4F:		; hMem
push	[ebp+var_4]

loc_1007A52:
call	sub_1007BD1

loc_1007A57:		; hMem
push	hMem
call	ds:GlobalUnlock

loc_1007A63:
pop	edi
pop	esi
pop	ebx
leave
retn	4
sub_1006E70 endp



; Attributes: bp-based frame

sub_1007A6A proc near

var_20=	byte ptr -20h
arg_0= dword ptr  8
arg_4= dword ptr  0Ch

push	ebp
mov	ebp, esp
sub	esp, 20h
lea	ecx, [ebp+var_20]
push	edi

loc_1007A74:
mov	eax, [ebp+arg_0]
xor	edx, edx
push	0Ah
pop	edi
div	edi
add	edx, 30h
mov	[ecx], dx
inc	ecx
inc	ecx
test	eax, eax
mov	[ebp+arg_0], eax
jnz	short loc_1007A74
mov	eax, [ebp+arg_4]
pop	edi
jmp	short loc_1007A9B

loc_1007A93:
mov	dx, [ecx]
mov	[eax], dx
inc	eax
inc	eax

loc_1007A9B:
dec	ecx
dec	ecx
lea	edx, [ebp+var_20]
cmp	ecx, edx
jnb	short loc_1007A93
and	word ptr [eax],	0
mov	eax, [ebp+arg_4]
leave
retn	8
sub_1007A6A endp



; Attributes: bp-based frame

; int __stdcall	sub_1007AAF(LPBYTE lpData)
sub_1007AAF proc near

cbData=	dword ptr -8
hKey= dword ptr	-4
lpData=	dword ptr  8

push	ebp
mov	ebp, esp
push	ecx
push	ecx
lea	eax, [ebp+hKey]
push	esi
xor	esi, esi
push	eax		; phkResult
push	20019h		; samDesired
push	esi		; ulOptions
push	offset SubKey	; "CLSID\\{ADB880A6-D8FF-11CF-9377-00AA003"...
push	80000000h	; hKey
call	ds:RegOpenKeyExA
test	eax, eax
jnz	short loc_1007B07
lea	eax, [ebp+cbData]
mov	[ebp+cbData], 104h
push	eax		; lpcbData
push	[ebp+lpData]	; lpData
push	esi		; lpType
push	esi		; lpReserved
push	offset ValueName ; lpValueName
push	[ebp+hKey]	; hKey
call	ds:RegQueryValueExA
test	eax, eax
jnz	short loc_1007AFA
push	1
pop	esi

loc_1007AFA:		; hKey
push	[ebp+hKey]
call	ds:RegCloseKey
mov	eax, esi
jmp	short loc_1007B09

loc_1007B07:
xor	eax, eax

loc_1007B09:
pop	esi
leave
retn	4
sub_1007AAF endp



; Attributes: bp-based frame

sub_1007B0E proc near

Data= byte ptr -104h
arg_0= dword ptr  8
arg_4= dword ptr  0Ch
arg_8= dword ptr  10h
arg_C= dword ptr  14h

push	ebp
mov	ebp, esp
sub	esp, 104h
mov	ecx, hModule
push	esi
test	ecx, ecx
jnz	short loc_1007B6B
cmp	dword_1014F28, ecx
jnz	short loc_1007B6B
lea	eax, [ebp+Data]
push	eax		; lpData
call	sub_1007AAF
mov	esi, ds:LoadLibraryA
test	eax, eax
jz	short loc_1007B4E
lea	eax, [ebp+Data]
push	eax		; lpLibFileName
call	esi ; LoadLibraryA
mov	hModule, eax

loc_1007B4E:
mov	ecx, hModule
test	ecx, ecx
jnz	short loc_1007B6B
push	offset LibFileName ; "hhctrl.ocx"
call	esi ; LoadLibraryA
mov	ecx, eax
test	ecx, ecx
mov	hModule, ecx
jz	short loc_1007B86

loc_1007B6B:
mov	eax, dword_1014F38
test	eax, eax
jnz	short loc_1007B94
push	0Fh		; lpProcName
push	ecx		; hModule
call	ds:GetProcAddress
test	eax, eax
mov	dword_1014F38, eax
jnz	short loc_1007B94

loc_1007B86:
mov	dword_1014F28, 1
xor	eax, eax
jmp	short loc_1007BA2

loc_1007B94:
push	[ebp+arg_C]
push	[ebp+arg_8]
push	[ebp+arg_4]
push	[ebp+arg_0]
call	eax ; dword_1014F38

loc_1007BA2:
pop	esi
leave
retn	10h
sub_1007B0E endp



; Attributes: noreturn bp-based	frame

sub_1007BA7 proc near

var_4= dword ptr -4

push	ebp
mov	ebp, esp
push	ecx
push	offset dword_1012A34
lea	eax, [ebp+var_4]
push	eax
mov	[ebp+var_4], 80000007h
call	_CxxThrowException
sub_1007BA7 endp

db 0CCh



sub_1007BC1 proc near

arg_0= dword ptr  4

cmp	[esp+arg_0], 0
jz	short locret_1007BCE
jmp	ds:LocalFree

locret_1007BCE:
retn	4
sub_1007BC1 endp




; int __stdcall	sub_1007BD1(HLOCAL hMem)
sub_1007BD1 proc near

hMem= dword ptr	 4

push	esi
mov	esi, [esp+4+hMem]
test	esi, esi
jz	short loc_1007BF7
push	dword ptr [esi]
call	sub_1007BC1
push	dword ptr [esi+4]
and	dword ptr [esi], 0
call	sub_1007BC1
and	dword ptr [esi+4], 0
push	esi		; hMem
call	ds:LocalFree

loc_1007BF7:
pop	esi
retn	4
sub_1007BD1 endp




sub_1007BFB proc near

arg_0= dword ptr  4

mov	eax, [esp+arg_0]
push	esi
lea	eax, ds:10h[eax*4]
push	eax		; uBytes
push	40h		; uFlags
call	ds:LocalAlloc
mov	esi, eax
test	esi, esi
jnz	short loc_1007C20
push	80000007h
call	sub_1007BA7

loc_1007C20:
mov	eax, esi
pop	esi
retn	4
sub_1007BFB endp




sub_1007C26 proc near
push	esi
push	8		; uBytes
push	40h		; uFlags
call	ds:LocalAlloc
mov	esi, eax
test	esi, esi
jnz	short loc_1007C41
push	80000007h
call	sub_1007BA7

loc_1007C41:
and	dword ptr [esi], 0
and	dword ptr [esi+4], 0
mov	eax, esi
pop	esi
retn
sub_1007C26 endp




sub_1007C4C proc near

arg_0= dword ptr  4
arg_4= dword ptr  8

push	esi
push	21h
call	sub_1007BFB
mov	ecx, eax
mov	eax, [esp+4+arg_0]
and	dword ptr [ecx+4], 0
and	dword ptr [ecx+8], 0
test	eax, eax
lea	esi, [ecx+0Ch]
jge	short loc_1007C70
or	dword ptr [ecx], 0FFFFFFFFh
neg	eax
jmp	short loc_1007C76

loc_1007C70:
mov	dword ptr [ecx], 1

loc_1007C76:
xor	edx, edx
div	[esp+4+arg_4]
mov	[esi], edx
add	esi, 4
inc	dword ptr [ecx+4]
test	eax, eax
jnz	short loc_1007C76
mov	eax, ecx
pop	esi
retn	8
sub_1007C4C endp




sub_1007C8E proc near

arg_0= dword ptr  4
arg_4= dword ptr  8

mov	eax, [esp+arg_0]
mov	ecx, [eax+4]
push	esi
xor	esi, esi
test	ecx, ecx
push	edi
mov	edi, [eax+8]
lea	edx, [eax+ecx*4+8]
jle	short loc_1007CBD
push	ebx
lea	ebx, [ecx+edi]

loc_1007CA8:
test	ebx, ebx
jle	short loc_1007CBC
imul	esi, [esp+0Ch+arg_4]
add	esi, [edx]
sub	edx, 4
dec	ecx
dec	ebx
test	ecx, ecx
jg	short loc_1007CA8

loc_1007CBC:
pop	ebx

loc_1007CBD:
test	edi, edi
jle	short loc_1007CC9

loc_1007CC1:
imul	esi, [esp+8+arg_4]
dec	edi
jnz	short loc_1007CC1

loc_1007CC9:
mov	eax, [eax]
pop	edi
imul	eax, esi
pop	esi
retn	8
sub_1007C8E endp




sub_1007CD3 proc near

arg_0= dword ptr  4
arg_4= dword ptr  8

mov	edx, [esp+arg_0]
push	ebx
mov	ebx, [edx+4]
push	esi
push	edi
xor	eax, eax
cmp	ebx, [esp+0Ch+arg_4]
lea	edi, [edx+0Ch]
mov	esi, edi
jle	short loc_1007CF5
sub	ebx, [esp+0Ch+arg_4]
lea	esi, [esi+ebx*4]
mov	ebx, [esp+0Ch+arg_4]

loc_1007CF5:
test	ebx, ebx
jle	short loc_1007D1C

loc_1007CF9:
cmp	dword ptr [esi], 0
jnz	short loc_1007D09
add	esi, 4
xor	eax, eax
dec	ebx
inc	eax
test	ebx, ebx
jg	short loc_1007CF9

loc_1007D09:
test	eax, eax
jz	short loc_1007D1C
mov	ecx, ebx
rep movsd
mov	ecx, [edx+4]
sub	ecx, ebx
add	[edx+8], ecx
mov	[edx+4], ebx

loc_1007D1C:
pop	edi
pop	esi
pop	ebx
retn	8
sub_1007CD3 endp



; Attributes: bp-based frame

sub_1007D22 proc near

var_4= dword ptr -4
arg_0= dword ptr  8
arg_4= dword ptr  0Ch
arg_8= dword ptr  10h

push	ebp
mov	ebp, esp
push	ecx
and	[ebp+var_4], 0
push	ebx
push	edi
push	[ebp+arg_8]
push	1
call	sub_1007C4C
mov	ebx, [ebp+arg_4]
test	ebx, ebx
mov	edi, [ebp+arg_0]
mov	[ebp+var_4], eax
jle	short loc_1007DAC
push	esi

loc_1007D44:
test	bl, 1
jz	short loc_1007D57
push	[ebp+arg_8]
lea	eax, [ebp+var_4]
push	dword ptr [edi]
push	eax
call	sub_1011AA0

loc_1007D57:
push	[ebp+arg_8]
push	dword ptr [edi]
push	edi
call	sub_1011AA0
cmp	byte_1014F60, 0
jnz	short loc_1007DA5
mov	ecx, [edi]
mov	eax, [ecx+4]
mov	esi, eax
sub	esi, dword_1014F40
sub	esi, dword_1014F5C
cmp	esi, 1
jle	short loc_1007DA5
sub	eax, esi
shl	eax, 2
push	eax		; Size
lea	eax, [ecx+esi*4+0Ch]
push	eax		; Src
add	ecx, 0Ch
push	ecx		; Dst
call	ds:memmove
mov	eax, [edi]
sub	[eax+4], esi
mov	eax, [edi]
add	esp, 0Ch
add	[eax+8], esi

loc_1007DA5:
sar	ebx, 1
test	ebx, ebx
jg	short loc_1007D44
pop	esi

loc_1007DAC:
push	dword ptr [edi]
call	sub_1007BC1
mov	eax, [ebp+var_4]
mov	[edi], eax
pop	edi
pop	ebx
leave
retn	0Ch
sub_1007D22 endp



; Attributes: bp-based frame

sub_1007DBE proc near

var_8= dword ptr -8
var_4= dword ptr -4
arg_0= dword ptr  8
arg_4= dword ptr  0Ch

push	ebp
mov	ebp, esp
push	ecx
push	ecx
push	ebx
push	esi
push	edi
push	[ebp+arg_4]
xor	eax, eax
push	eax
mov	[ebp+var_4], eax
mov	[ebp+var_8], eax
call	sub_1007C4C
push	[ebp+arg_4]
mov	[ebp+var_4], eax
push	80000000h
call	sub_1007C4C
mov	edi, dword_1014F5C
mov	esi, [ebp+arg_0]
mov	[ebp+var_8], eax
mov	eax, [esi+4]
inc	edi
cmp	edi, eax
jbe	short loc_1007DFD
mov	edi, eax

loc_1007DFD:
mov	ecx, [esi+8]
push	[ebp+arg_4]
sub	ecx, edi
add	ecx, eax
push	ecx
lea	eax, [ebp+var_8]
push	eax
call	sub_1007D22
test	edi, edi
mov	eax, [esi+4]
lea	ebx, [esi+eax*4+8]
jbe	short loc_1007E54

loc_1007E1C:
cmp	dword_1014F58, 0
jnz	short loc_1007E54
mov	[ebp+arg_0], 40000000h

loc_1007E2C:
push	[ebp+arg_4]
lea	eax, [ebp+var_4]
push	[ebp+var_4]
push	eax
call	sub_1011A3C
mov	eax, [ebp+arg_0]
test	[ebx], eax
jz	short loc_1007E49
mov	eax, [ebp+var_4]
or	dword ptr [eax+0Ch], 1

loc_1007E49:
shr	[ebp+arg_0], 1
jnz	short loc_1007E2C
sub	ebx, 4
dec	edi
jnz	short loc_1007E1C

loc_1007E54:
push	[ebp+arg_4]
lea	eax, [ebp+var_4]
push	[ebp+var_8]
push	eax
call	sub_1011AA0
push	[ebp+var_8]
call	sub_1007BC1
mov	eax, [esi]
mov	ecx, [ebp+var_4]
pop	edi
pop	esi
mov	[ecx], eax
mov	eax, [ebp+var_4]
pop	ebx
leave
retn	8
sub_1007DBE endp



; Attributes: bp-based frame

sub_1007E7C proc near

var_C= dword ptr -0Ch
var_8= dword ptr -8
var_4= dword ptr -4
arg_0= dword ptr  8

push	ebp
mov	ebp, esp
sub	esp, 0Ch
push	ebx
push	esi
push	edi
xor	eax, eax
mov	esi, 80000000h
push	esi
push	eax
mov	[ebp+var_8], eax
mov	[ebp+var_4], eax
call	sub_1007C4C
mov	ebx, [ebp+arg_0]
and	[ebp+arg_0], 0
mov	[ebp+var_8], eax
mov	eax, [ebx+4]
test	eax, eax
lea	edi, [ebx+eax*4+8]
jle	short loc_1007EEA

loc_1007EAE:
push	dword_1014F78
lea	eax, [ebp+var_8]
push	eax
call	sub_1012314
mov	eax, [edi]
push	esi
push	eax
call	sub_1007C4C
push	esi
push	eax
mov	[ebp+var_C], eax
lea	eax, [ebp+var_8]
push	eax
sub	edi, 4
call	sub_1011A3C
push	[ebp+var_C]
call	sub_1007BC1
inc	[ebp+arg_0]
mov	eax, [ebp+arg_0]
cmp	eax, [ebx+4]
jl	short loc_1007EAE

loc_1007EEA:
push	[ebp+var_4]
call	sub_1007BC1
mov	eax, dword_1014F78
and	[ebp+var_4], 0
push	dword ptr [eax+4]
call	sub_1007BFB
mov	esi, dword_1014F78
mov	edi, eax
mov	[ebp+var_4], edi
mov	ecx, [esi+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
push	dword ptr [ebx+8]
lea	eax, [ebp+var_4]
push	eax
call	sub_101239E
push	[ebp+var_4]
lea	eax, [ebp+var_8]
push	eax
call	sub_1012314
push	[ebp+var_4]
call	sub_1007BC1
mov	eax, [ebx]
mov	ecx, [ebp+var_8]
pop	edi
pop	esi
mov	[ecx], eax
mov	eax, [ebp+var_8]
pop	ebx
leave
retn	0Ch
sub_1007E7C endp




; int __stdcall	sub_1007F57(wchar_t *Str)
sub_1007F57 proc near

var_C= dword ptr -0Ch
var_8= dword ptr -8
var_4= dword ptr -4
Str= dword ptr	4

sub	esp, 0Ch
and	[esp+0Ch+var_C], 0
push	ebx
push	ebp
push	esi
push	edi
mov	edi, [esp+1Ch+Str]
xor	ebx, ebx
inc	ebx
push	edi		; Str
mov	[esp+20h+var_8], ebx
call	ds:wcslen
mov	ebp, eax
pop	ecx
push	ebp
mov	[esp+20h+var_4], ebp
call	sub_1007BFB
mov	esi, eax
mov	[esi], ebx
xor	ebx, ebx
lea	eax, [esi+ebp*4+8]
mov	[esi+4], ebx
mov	[esi+8], ebx
mov	[esp+1Ch+Str], eax
mov	dword_1014F44, ebx
movzx	eax, word ptr [edi]
cmp	eax, ebx
jz	loc_10080FB
mov	ebp, offset Str

loc_1007FAC:
cmp	eax, 0Ah
jz	loc_10080E5
xor	ecx, ecx
cmp	word ptr ReturnedString, cx
jz	short loc_1007FFF
mov	edx, ReturnedString

loc_1007FC6:
cmp	dx, [edi]
jnz	short loc_1007FDB
mov	dx, word ptr ReturnedString+2[ecx*2]
inc	ecx
inc	edi
inc	edi
test	dx, dx
jnz	short loc_1007FC6

loc_1007FDB:
test	ecx, ecx
jz	short loc_1007FFF
lea	eax, [ecx+ecx]
cmp	word ptr ReturnedString[eax], 0
jnz	short loc_1007FF3
push	2Eh
dec	edi
pop	eax
dec	edi
jmp	short loc_1007FFF

loc_1007FF3:
push	2
pop	ecx
sub	ecx, eax
add	edi, ecx
movzx	eax, word ptr [edi]
inc	edi
inc	edi

loc_1007FFF:
mov	ecx, eax
sub	ecx, 2Bh
jz	short loc_1008051
dec	ecx
dec	ecx
jz	short loc_1008051
dec	ecx
jz	short loc_1008047
dec	ecx
dec	ecx
jz	short loc_100803D
sub	ecx, 2Eh
jz	short loc_100801B
sub	ecx, 7
jnz	short loc_1008029

loc_100801B:
cmp	eax, 5Eh
jz	short loc_1008033
cmp	dword_1014010, 0Ah
jz	short loc_1008033

loc_1008029:
movsx	ebx, byte_1014392[ebx+ebx*4]
jmp	short loc_1008059

loc_1008033:
movsx	ebx, byte_1014394[ebx+ebx*4]
jmp	short loc_1008059

loc_100803D:
movsx	ebx, byte_1014391[ebx+ebx*4]
jmp	short loc_1008059

loc_1008047:
movsx	ebx, byte_1014390[ebx+ebx*4]
jmp	short loc_1008059

loc_1008051:
movsx	ebx, byte_1014393[ebx+ebx*4]

loc_1008059:
cmp	ebx, 9
jg	loc_1008133
jz	loc_1008185
mov	ecx, ebx
dec	ecx
jz	loc_1008123
sub	ecx, 3
jz	short loc_1008083
dec	ecx
jz	short loc_100807E
dec	ecx
jz	short loc_1008086
jmp	short loc_10080D8

loc_100807E:
dec	dword ptr [esi+8]
jmp	short loc_10080D8

loc_1008083:
inc	dword ptr [esi+8]

loc_1008086:
mov	ecx, dword_1014010
cmp	ecx, 24h
jg	short loc_100809E
cmp	ecx, 0Ah
jle	short loc_100809E
push	eax		; C
call	ds:toupper
pop	ecx

loc_100809E:		; Ch
push	eax
push	ebp		; Str
call	ds:wcschr
test	eax, eax
pop	ecx
pop	ecx
jz	short loc_10080CB
sub	eax, ebp
sar	eax, 1
cmp	eax, dword_1014010
jge	short loc_10080CB
mov	ecx, [esp+1Ch+Str]
sub	[esp+1Ch+Str], 4
mov	[ecx], eax
dec	dword ptr [esi+8]
inc	dword ptr [esi+4]
jmp	short loc_10080D8

loc_10080CB:
mov	dword_1014F44, 1

loc_10080D5:
push	0Eh
pop	ebx

loc_10080D8:
inc	edi
inc	edi
movzx	eax, word ptr [edi]
test	eax, eax
jnz	loc_1007FAC

loc_10080E5:
cmp	ebx, 5
jz	loc_100819A
cmp	ebx, 0Dh
jz	loc_100819A
mov	ebp, [esp+1Ch+var_4]

loc_10080FB:
cmp	[esi+4], ebp
jge	short loc_1008112
mov	eax, [esi+4]
mov	ecx, [esi+8]

loc_1008106:
inc	eax
dec	ecx
cmp	eax, ebp
jl	short loc_1008106
mov	[esi+8], ecx
mov	[esi+4], eax

loc_1008112:
mov	eax, [esp+1Ch+var_C]
imul	eax, [esp+1Ch+var_8]
add	[esi+8], eax
jmp	loc_10081A6

loc_1008123:
xor	ecx, ecx
cmp	eax, 2Dh
setnz	cl
lea	ecx, [ecx+ecx-1]
mov	[esi], ecx
jmp	short loc_10080D8

loc_1008133:
mov	ecx, ebx
sub	ecx, 0Ah
jz	short loc_1008141
dec	ecx
dec	ecx
jz	short loc_1008185
dec	ecx
jnz	short loc_10080D8

loc_1008141:
mov	ecx, dword_1014010
cmp	ecx, 24h
jg	short loc_1008159
cmp	ecx, 0Ah
jle	short loc_1008159
push	eax		; C
call	ds:toupper
pop	ecx

loc_1008159:		; Ch
push	eax
push	ebp		; Str
call	ds:wcschr
test	eax, eax
pop	ecx
pop	ecx
jz	loc_10080D5
mov	ecx, dword_1014010
imul	ecx, [esp+1Ch+var_C]
sub	eax, ebp
sar	eax, 1
add	eax, ecx
mov	[esp+1Ch+var_C], eax
jmp	loc_10080D8

loc_1008185:
xor	ecx, ecx
cmp	eax, 2Dh
setnz	cl
lea	ecx, [ecx+ecx-1]
mov	[esp+1Ch+var_8], ecx
jmp	loc_10080D8

loc_100819A:
xor	eax, eax
inc	eax
and	dword ptr [esi+8], 0
mov	[esi+4], eax
mov	[esi], eax

loc_10081A6:
cmp	dword ptr [esi+4], 0
jnz	short loc_10081B4
push	esi
call	sub_1007BC1
xor	esi, esi

loc_10081B4:
push	dword_1014F5C
push	esi
call	sub_1007CD3
pop	edi
mov	eax, esi
pop	esi
pop	ebp
pop	ebx
add	esp, 0Ch
retn	4
sub_1007F57 endp




sub_10081CC proc near

arg_0= dword ptr  4

push	esi
push	edi
call	sub_1007C26
mov	edi, 80000000h
push	edi
push	[esp+0Ch+arg_0]
mov	esi, eax
call	sub_1007C4C
push	edi
push	1
mov	[esi], eax
call	sub_1007C4C
mov	[esi+4], eax
pop	edi
mov	eax, esi
pop	esi
retn	4
sub_10081CC endp



; Attributes: bp-based frame

sub_10081F8 proc near

hMem= dword ptr	-4
arg_0= dword ptr  8

push	ebp
mov	ebp, esp
push	ecx
push	ebx
mov	ebx, [ebp+arg_0]
push	esi
push	edi
push	dword_1014FC8
xor	esi, esi
push	ebx
mov	[ebp+hMem], esi
call	sub_1008D44
test	eax, eax
jnz	loc_1008340
push	dword_1014FF8
push	ebx
call	sub_1008F17
test	eax, eax
jnz	loc_1008340
push	[ebp+hMem]	; hMem
call	sub_1007BD1
mov	[ebp+hMem], esi
call	sub_1007C26
mov	[ebp+hMem], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+hMem]
mov	[eax], esi
mov	eax, [ebx]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx], eax
mov	esi, [ebx]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+hMem]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+hMem]
and	dword ptr [eax+4], 0
mov	eax, [ebx+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx+4], eax
mov	ebx, [ebx+4]
mov	ecx, [ebx+4]
mov	eax, [ebp+hMem]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
mov	esi, ebx
rep movsd
mov	ecx, eax
lea	eax, [ebp+hMem]
and	ecx, 3
push	eax
rep movsb
call	sub_1008A54
mov	eax, [ebp+hMem]
push	dword ptr [eax+4]
push	eax
call	sub_10123EB
mov	eax, [ebp+hMem]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+hMem]
and	dword ptr [eax+4], 0
mov	eax, dword_1014F64
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx+4], eax
mov	esi, dword_1014F64
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	esi, [ebp+hMem]
push	80000000h
push	dword ptr [esi]
call	sub_1007C8E
mov	edi, eax
push	esi		; hMem
call	sub_1007BD1
mov	eax, edi
pop	edi
pop	esi
pop	ebx
leave
retn	4

loc_1008340:
push	offset dword_1012A34
lea	eax, [ebp+arg_0]
push	eax
mov	[ebp+arg_0], 80000001h
call	_CxxThrowException
sub_10081F8 endp

align 2


; Attributes: bp-based frame

sub_1008356 proc near

var_18=	dword ptr -18h
var_14=	dword ptr -14h
var_10=	dword ptr -10h
var_C= dword ptr -0Ch
var_8= dword ptr -8
var_4= dword ptr -4
arg_0= dword ptr  8
arg_4= dword ptr  0Ch

push	ebp
mov	ebp, esp
sub	esp, 18h
mov	ecx, dword_1014F5C
and	[ebp+var_4], 0
push	ebx
mov	ebx, [ebp+arg_4]
push	esi
push	edi
mov	edi, [ebp+arg_0]
mov	eax, [edi]
add	ecx, 2
push	ecx
push	eax
mov	[ebp+var_10], ebx
mov	[ebp+arg_0], eax
call	sub_1007CD3
mov	eax, [ebp+arg_0]
mov	ecx, [eax+4]
mov	esi, [eax+8]
mov	eax, dword_1014F5C
add	esi, ecx
cmp	esi, eax
mov	[ebp+var_C], ecx
jle	short loc_10083A3
test	ebx, ebx
jnz	short loc_10083A3
mov	[ebp+arg_4], 1

loc_10083A3:
cmp	ecx, eax
jle	short loc_10083AA
mov	[ebp+var_C], eax

loc_10083AA:
lea	eax, [eax+eax+20h]
push	eax		; uBytes
lea	ecx, [esi-1]
push	40h		; uFlags
mov	[ebp+var_8], ecx
call	ds:LocalAlloc
mov	ebx, eax
test	ebx, ebx
mov	[ebp+var_14], ebx
jnz	short loc_10083D0
push	80000007h
call	sub_1007BA7

loc_10083D0:
push	[ebp+arg_0]
call	sub_1011A18
test	eax, eax
mov	ecx, dword_1014F5C
jnz	short loc_1008436
mov	eax, [ebp+arg_0]
cmp	[eax+4], ecx
jl	short loc_1008436
mov	eax, dword_1014010
push	eax
push	eax
call	sub_1007C4C
push	dword_1014010
mov	[ebp+var_4], eax
push	dword_1014F68
lea	eax, [ebp+var_4]
push	eax
call	sub_1011EE7
mov	eax, [ebp+arg_0]
mov	edx, [eax+8]
mov	ecx, [ebp+var_4]
sub	edx, [ecx+4]
add	edx, [eax+4]
sub	edx, dword_1014F5C
mov	[ecx+8], edx
mov	eax, [ebp+arg_0]
mov	ecx, [ebp+var_4]
mov	eax, [eax]
mov	[ecx], eax
mov	ecx, dword_1014F5C

loc_1008436:
cmp	[ebp+arg_4], 0
jnz	short loc_1008476
mov	eax, [ebp+var_C]
sub	eax, esi
lea	edx, [ecx+2]
cmp	eax, edx
jg	short loc_100846F
lea	eax, [ecx+3]
cmp	esi, eax
jg	short loc_100846F
mov	eax, esi
cdq
xor	eax, edx
sub	eax, edx
add	eax, [ebp+var_C]
cmp	eax, ecx
jge	short loc_1008476
mov	eax, [ebp+var_4]
test	eax, eax
jz	short loc_10084C9
sub	[eax+8], esi
mov	ecx, dword_1014F5C
jmp	short loc_1008476

loc_100846F:
mov	[ebp+arg_4], 1

loc_1008476:
cmp	[ebp+var_4], 0
jz	short loc_10084C9
push	dword_1014010
push	[ebp+var_4]
push	edi
call	sub_1011A3C
mov	ecx, [edi]
mov	edx, [ebp+var_4]
mov	[ebp+arg_0], ecx
mov	eax, [ecx+8]
sub	eax, [edx+8]
sub	eax, [edx+4]
add	eax, [ecx+4]
push	eax
push	ecx
call	sub_1007CD3
push	[ebp+var_4]
mov	edi, eax
call	sub_1007BC1
and	[ebp+var_4], 0
test	edi, edi
jz	short loc_10084D2
push	[ebp+var_10]
lea	eax, [ebp+arg_0]
push	eax
call	sub_1008356
jmp	loc_100863B

loc_10084C9:
push	ecx
push	[ebp+arg_0]
call	sub_1007CD3

loc_10084D2:
mov	ecx, [ebp+arg_0]
mov	eax, [ecx+4]
lea	eax, [ecx+eax*4+8]
mov	[ebp+var_18], eax
xor	eax, eax
inc	eax
cmp	[ebp+arg_4], eax
push	2
pop	edi
jz	short loc_10084F9
cmp	[ebp+arg_4], edi
jz	short loc_10084F9
and	[ebp+var_10], 0
and	[ebp+var_8], 0
jmp	short loc_1008523

loc_10084F9:
cmp	[ebp+var_8], 0
mov	[ebp+var_10], eax
jz	short loc_1008523
cmp	[ebp+arg_4], edi
jnz	short loc_1008521
mov	eax, [ebp+var_8]
push	3
cdq
pop	esi
idiv	esi
mov	esi, edx
sub	[ebp+var_8], esi
inc	esi
jns	short loc_1008523
add	esi, 3
sub	[ebp+var_8], 3
jmp	short loc_1008523

loc_1008521:
mov	esi, eax

loc_1008523:
cmp	dword ptr [ecx], 0FFFFFFFFh
jnz	short loc_1008539
cmp	[ebp+var_C], 0
jle	short loc_1008539
mov	ebx, [ebp+var_14]
mov	word ptr [ebx],	2Dh
add	ebx, 2

loc_1008539:
test	esi, esi
jg	short loc_1008577
cmp	[ebp+var_10], 0
jnz	short loc_1008555
mov	word ptr [ebx],	30h
mov	ax, word ptr ReturnedString
add	ebx, edi
mov	[ebx], ax
add	ebx, edi

loc_1008555:
test	esi, esi
jge	short loc_1008577
mov	edx, esi
neg	edx
mov	ecx, edx
shr	ecx, 1
mov	edi, ebx
mov	eax, 300030h
rep stosd
adc	ecx, ecx
push	2
rep stosw
add	esi, edx
lea	ebx, [ebx+edx*2]
pop	edi

loc_1008577:
mov	eax, [ebp+var_C]
test	eax, eax
jle	short loc_10085BE
mov	ecx, [ebp+var_18]

loc_1008581:
mov	edx, [ecx]
mov	dx, Str[edx*2]
dec	esi
mov	[ebx], dx
add	ebx, edi
sub	ecx, 4
test	esi, esi
jnz	short loc_10085A4
mov	dx, word ptr ReturnedString
mov	[ebx], dx
add	ebx, edi

loc_10085A4:
dec	eax
jnz	short loc_1008581
jmp	short loc_10085BE

loc_10085A9:
mov	word ptr [ebx],	30h
add	ebx, edi
dec	esi
jnz	short loc_10085BE
mov	ax, word ptr ReturnedString
mov	[ebx], ax
add	ebx, edi

loc_10085BE:
test	esi, esi
jg	short loc_10085A9
cmp	[ebp+var_10], 0
jz	short loc_1008634
cmp	dword_1014010, 0Ah
jnz	short loc_10085D8
mov	word ptr [ebx],	65h
jmp	short loc_10085DD

loc_10085D8:
mov	word ptr [ebx],	5Eh

loc_10085DD:
mov	eax, [ebp+var_8]
xor	ecx, ecx
add	ebx, edi
test	eax, eax
setl	cl
cdq
lea	ecx, [ecx+ecx+2Bh]
mov	[ebx], cx
mov	ecx, eax
xor	ecx, edx
add	ebx, edi
sub	ecx, edx
xor	esi, esi

loc_10085FB:
mov	eax, ecx
cdq
idiv	dword_1014010
mov	ax, Str[edx*2]
mov	[ebx], ax
mov	eax, ecx
cdq
idiv	dword_1014010
inc	ebx
inc	ebx
inc	esi
mov	ecx, eax
test	ecx, ecx
jg	short loc_10085FB
and	word ptr [ebx],	0
lea	eax, [esi+esi]
mov	ecx, ebx
sub	ecx, eax
push	ecx		; Str
call	ds:_wcsrev
pop	ecx

loc_1008634:
and	word ptr [ebx],	0
mov	eax, [ebp+var_14]

loc_100863B:
pop	edi
pop	esi
pop	ebx
leave
retn	8
sub_1008356 endp



; Attributes: bp-based frame

sub_1008642 proc near

var_4= dword ptr -4
arg_0= dword ptr  8
arg_4= dword ptr  0Ch
arg_8= dword ptr  10h

push	ebp
mov	ebp, esp
push	ecx
and	[ebp+var_4], 0
push	esi
mov	esi, [ebp+arg_0]
mov	edx, [esi]
mov	ecx, [edx]
mov	edx, [edx+4]
mov	eax, [ecx+8]
mov	edx, [edx+8]
cmp	eax, edx
push	edi
jge	short loc_1008662
mov	edx, eax

loc_1008662:
test	edx, edx
jge	short loc_1008668
xor	edx, edx

loc_1008668:
push	[ebp+arg_4]
sub	eax, edx
mov	[ecx+8], eax
mov	eax, [esi]
mov	eax, [eax+4]
sub	[eax+8], edx
mov	eax, [esi]
push	dword ptr [eax]
call	sub_1007DBE
push	[ebp+arg_4]
mov	[ebp+var_4], eax
mov	eax, [esi]
push	dword ptr [eax+4]
call	sub_1007DBE
push	[ebp+arg_4]
mov	esi, eax
push	esi
lea	eax, [ebp+var_4]
push	eax
call	sub_1011EE7
push	[ebp+arg_8]
lea	eax, [ebp+var_4]
push	eax
call	sub_1008356
push	[ebp+var_4]
mov	edi, eax
call	sub_1007BC1
and	[ebp+var_4], 0
push	esi
call	sub_1007BC1
mov	eax, edi
pop	edi
pop	esi
leave
retn	0Ch
sub_1008642 endp



; Attributes: bp-based frame

sub_10086C8 proc near

arg_0= dword ptr  8
arg_4= dword ptr  0Ch

push	ebp
mov	ebp, esp
push	ebx
mov	ebx, [ebp+arg_4]
test	ebx, ebx
push	esi
jge	short loc_10086F0
mov	esi, [ebp+arg_0]
neg	ebx
push	ebx
push	esi
call	sub_10086C8
mov	eax, [esi]
mov	edx, [eax+4]
mov	ecx, [eax]
mov	[eax], edx
mov	eax, [esi]
mov	[eax+4], ecx
jmp	short loc_100874E

loc_10086F0:
and	[ebp+arg_4], 0
push	1
call	sub_10081CC
mov	esi, [ebp+arg_0]
mov	[ebp+arg_4], eax
jmp	short loc_100873E

loc_1008703:
test	bl, 1
jz	short loc_1008725
mov	eax, [esi]
push	dword ptr [eax]
push	[ebp+arg_4]
call	sub_1012314
mov	eax, [esi]
push	dword ptr [eax+4]
mov	eax, [ebp+arg_4]
add	eax, 4
push	eax
call	sub_1012314

loc_1008725:
push	dword ptr [esi]
push	esi
call	sub_100BBD4
lea	eax, [ebp+arg_4]
push	eax
call	sub_100AB09
push	esi
call	sub_100AB09
sar	ebx, 1

loc_100873E:
test	ebx, ebx
jg	short loc_1008703
push	dword ptr [esi]	; hMem
call	sub_1007BD1
mov	eax, [ebp+arg_4]
mov	[esi], eax

loc_100874E:
pop	esi
pop	ebx
pop	ebp
retn	8
sub_10086C8 endp




sub_1008754 proc near

arg_0= dword ptr  4
arg_4= dword ptr  8

push	ebx
push	esi
push	edi
push	0
call	sub_1007BC1
mov	esi, [esp+0Ch+arg_0]
push	dword ptr [esi+4]
call	sub_1007BFB
mov	ecx, [esi+4]
push	[esp+0Ch+arg_4]
lea	ecx, ds:0Ch[ecx*4]
mov	ebx, eax
mov	eax, ecx
shr	ecx, 2
mov	edi, ebx
rep movsd
mov	ecx, eax
and	ecx, 3
push	1
rep movsb
call	sub_1007C4C
mov	esi, eax
mov	eax, [ebx+8]
test	eax, eax
jge	short loc_10087A1
sub	[esi+8], eax
and	dword ptr [ebx+8], 0

loc_10087A1:
call	sub_1007C26
push	dword_1014F40
mov	edi, eax
push	[esp+10h+arg_4]
push	ebx
call	sub_1007E7C
mov	[edi], eax
push	dword_1014F40
push	[esp+10h+arg_4]
push	esi
call	sub_1007E7C
push	ebx
mov	[edi+4], eax
call	sub_1007BC1
push	esi
call	sub_1007BC1
mov	eax, edi
pop	edi
pop	esi
pop	ebx
retn	8
sub_1008754 endp



; Attributes: bp-based frame

; int __stdcall	sub_10087E1(int, wchar_t *Str, int, int)
sub_10087E1 proc near

var_8= dword ptr -8
var_4= dword ptr -4
arg_0= dword ptr  8
Str= dword ptr	0Ch
arg_8= dword ptr  10h
arg_C= dword ptr  14h

push	ebp
mov	ebp, esp
push	ecx
push	ecx
mov	eax, [ebp+Str]
push	ebx
xor	ebx, ebx
cmp	eax, ebx
push	esi
push	edi
mov	[ebp+var_8], ebx
mov	[ebp+var_4], ebx
jz	short loc_1008827
cmp	[eax], bx
jz	short loc_1008827
push	eax		; Str
call	sub_1007F57
mov	esi, eax
cmp	esi, ebx
jz	loc_100897E
push	dword_1014010
push	esi
call	sub_1008754
push	esi
mov	[ebp+var_4], eax
call	sub_1007BC1
jmp	loc_1008963

loc_1008827:
mov	eax, [ebp+arg_C]
cmp	eax, ebx
jz	loc_10088C1
cmp	[eax], bx
jz	loc_10088C1
push	ebx		; hMem
call	sub_1007BD1
mov	[ebp+var_4], ebx
call	sub_1007C26
mov	[ebp+var_4], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+var_4]
mov	[eax], ebx
mov	eax, dword_1014F88
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+var_4]
mov	[ecx], eax
mov	eax, dword_1014F88
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+var_4]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+var_4]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+var_4]
mov	[eax+4], ebx
mov	eax, dword_1014F88
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+var_4]
mov	[ecx+4], eax
mov	eax, dword_1014F88
jmp	loc_1008942

loc_10088C1:		; hMem
push	ebx
call	sub_1007BD1
mov	[ebp+var_4], ebx
call	sub_1007C26
mov	[ebp+var_4], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+var_4]
mov	[eax], ebx
mov	eax, dword_1014F84
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+var_4]
mov	[ecx], eax
mov	eax, dword_1014F84
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+var_4]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+var_4]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+var_4]
mov	[eax+4], ebx
mov	eax, dword_1014F84
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+var_4]
mov	[ecx+4], eax
mov	eax, dword_1014F84

loc_1008942:
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+var_4]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb

loc_1008963:
mov	eax, [ebp+arg_C]
cmp	eax, ebx
jz	short loc_100899F
cmp	[eax], bx
jz	short loc_100899F
push	eax		; Str
call	sub_1007F57
mov	esi, eax
cmp	esi, ebx
mov	[ebp+var_8], esi
jnz	short loc_1008985

loc_100897E:
xor	eax, eax
jmp	loc_1008A4D

loc_1008985:
push	dword_1014010
push	esi
call	sub_1007C8E
push	esi
mov	[ebp+arg_C], eax
call	sub_1007BC1
mov	[ebp+var_8], ebx
jmp	short loc_10089A2

loc_100899F:
mov	[ebp+arg_C], ebx

loc_10089A2:
push	80000000h
push	dword_1014010
call	sub_1007C4C
mov	[ebp+var_8], eax
mov	eax, [ebp+arg_C]
cdq
xor	eax, edx
sub	eax, edx
push	eax
lea	eax, [ebp+var_8]
push	eax
call	sub_101239E
call	sub_1007C26
mov	ebx, eax
push	dword ptr [ebx]
call	sub_1007BC1
and	dword ptr [ebx], 0
mov	eax, [ebp+var_8]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	[ebx], eax
mov	esi, [ebp+var_8]
mov	ecx, [esi+4]
lea	ecx, ds:0Ch[ecx*4]
mov	edi, eax
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
push	80000000h
and	ecx, 3
push	1
rep movsb
call	sub_1007C4C
mov	[ebx+4], eax
push	[ebp+var_8]
call	sub_1007BC1
xor	esi, esi
cmp	[ebp+arg_8], esi
mov	[ebp+var_8], esi
jz	short loc_1008A2F
push	ebx
lea	eax, [ebp+var_4]
push	eax
call	sub_100BD6F
jmp	short loc_1008A3E

loc_1008A2F:
cmp	[ebp+arg_C], esi
jle	short loc_1008A3E
push	ebx
lea	eax, [ebp+var_4]
push	eax
call	sub_100BBD4

loc_1008A3E:
cmp	[ebp+arg_0], esi
jz	short loc_1008A4A
mov	eax, [ebp+var_4]
mov	eax, [eax]
neg	dword ptr [eax]

loc_1008A4A:
mov	eax, [ebp+var_4]

loc_1008A4D:
pop	edi
pop	esi
pop	ebx
leave
retn	10h
sub_10087E1 endp



; Attributes: bp-based frame

sub_1008A54 proc near

hMem= dword ptr	-4
arg_0= dword ptr  8

push	ebp
mov	ebp, esp
push	ecx
push	ebx
mov	ebx, [ebp+arg_0]
mov	eax, [ebx]
push	esi
xor	esi, esi
mov	[ebp+hMem], esi
push	dword ptr [eax]
call	sub_1011A18
test	eax, eax
jnz	loc_1008B86
push	dword_1014F64
mov	eax, [ebx]
push	dword ptr [eax+4]
call	sub_1011913
test	eax, eax
jnz	loc_1008B86
push	edi
push	esi
push	dword_1014010
push	ebx
call	sub_1008642
mov	edi, eax
push	edi		; Str
call	sub_1007F57
push	edi		; hMem
mov	[ebp+arg_0], eax
call	ds:LocalFree
push	dword ptr [ebx]	; hMem
call	sub_1007BD1
mov	[ebx], esi
push	dword_1014010
push	[ebp+arg_0]
call	sub_1008754
push	[ebp+arg_0]
mov	[ebx], eax
call	sub_1007BC1
push	[ebp+hMem]	; hMem
call	sub_1007BD1
mov	[ebp+hMem], esi
call	sub_1007C26
mov	[ebp+hMem], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+hMem]
mov	[eax], esi
mov	eax, [ebx]
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx], eax
mov	eax, [ebx]
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+hMem]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+hMem]
and	dword ptr [eax+4], 0
mov	eax, [ebx]
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx+4], eax
mov	eax, [ebx]
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
push	dword_1014F88
lea	eax, [ebp+hMem]
push	eax
call	sub_100C266
push	[ebp+hMem]
push	ebx
call	sub_100BE29
push	[ebp+hMem]	; hMem
call	sub_1007BD1
pop	edi

loc_1008B86:
pop	esi
pop	ebx
leave
retn	4
sub_1008A54 endp



; Attributes: bp-based frame

sub_1008B8C proc near

hMem= dword ptr	-4
arg_0= dword ptr  8
arg_4= dword ptr  0Ch

push	ebp
mov	ebp, esp
push	ecx
push	ebx
push	esi
push	edi
xor	esi, esi
push	esi		; hMem
mov	[ebp+hMem], esi
call	sub_1007BD1
mov	[ebp+hMem], esi
call	sub_1007C26
mov	[ebp+hMem], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+hMem]
mov	ebx, [ebp+arg_0]
mov	[eax], esi
mov	eax, [ebx]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx], eax
mov	esi, [ebx]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+hMem]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+hMem]
and	dword ptr [eax+4], 0
mov	eax, [ebx+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx+4], eax
mov	ebx, [ebx+4]
mov	ecx, [ebx+4]
mov	eax, [ebp+hMem]
mov	edi, [eax+4]
push	[ebp+arg_4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
mov	esi, ebx
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+hMem]
mov	eax, [eax]
neg	dword ptr [eax]
lea	eax, [ebp+hMem]
push	eax
call	sub_100BC54
mov	eax, [ebp+hMem]
push	dword ptr [eax]
call	sub_1011A18
push	[ebp+hMem]	; hMem
mov	esi, eax
call	sub_1007BD1
pop	edi
mov	eax, esi
pop	esi
pop	ebx
leave
retn	8
sub_1008B8C endp



; Attributes: bp-based frame

sub_1008C5C proc near

hMem= dword ptr	-4
arg_0= dword ptr  8
arg_4= dword ptr  0Ch

push	ebp
mov	ebp, esp
push	ecx
push	ebx
push	esi
push	edi
xor	esi, esi
push	esi		; hMem
mov	[ebp+hMem], esi
call	sub_1007BD1
mov	[ebp+hMem], esi
call	sub_1007C26
mov	[ebp+hMem], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+hMem]
mov	ebx, [ebp+arg_0]
mov	[eax], esi
mov	eax, [ebx]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx], eax
mov	esi, [ebx]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+hMem]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+hMem]
and	dword ptr [eax+4], 0
mov	eax, [ebx+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx+4], eax
mov	ebx, [ebx+4]
mov	ecx, [ebx+4]
mov	eax, [ebp+hMem]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
mov	esi, ebx
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	esi, [ebp+arg_4]
mov	eax, [esi]
neg	dword ptr [eax]
push	esi
lea	eax, [ebp+hMem]
push	eax
call	sub_100BC54
mov	eax, [esi]
neg	dword ptr [eax]
mov	eax, [ebp+hMem]
push	dword ptr [eax]
call	sub_1011A18
xor	esi, esi
inc	esi
test	eax, eax
mov	eax, [ebp+hMem]
jnz	short loc_1008D35
mov	ecx, [eax+4]
mov	edx, [eax]
mov	ecx, [ecx]
imul	ecx, [edx]
cmp	ecx, esi
jz	short loc_1008D35
xor	esi, esi

loc_1008D35:		; hMem
push	eax
call	sub_1007BD1
pop	edi
mov	eax, esi
pop	esi
pop	ebx
leave
retn	8
sub_1008C5C endp



; Attributes: bp-based frame

sub_1008D44 proc near

hMem= dword ptr	-4
arg_0= dword ptr  8
arg_4= dword ptr  0Ch

push	ebp
mov	ebp, esp
push	ecx
push	ebx
push	esi
push	edi
xor	esi, esi
push	esi		; hMem
mov	[ebp+hMem], esi
call	sub_1007BD1
mov	[ebp+hMem], esi
call	sub_1007C26
mov	[ebp+hMem], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+hMem]
mov	ebx, [ebp+arg_0]
mov	[eax], esi
mov	eax, [ebx]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx], eax
mov	esi, [ebx]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+hMem]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+hMem]
and	dword ptr [eax+4], 0
mov	eax, [ebx+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx+4], eax
mov	ebx, [ebx+4]
mov	ecx, [ebx+4]
mov	eax, [ebp+hMem]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
mov	esi, ebx
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	esi, [ebp+arg_4]
mov	eax, [esi]
neg	dword ptr [eax]
push	esi
lea	eax, [ebp+hMem]
push	eax
call	sub_100BC54
mov	eax, [esi]
neg	dword ptr [eax]
mov	eax, [ebp+hMem]
push	dword ptr [eax]
call	sub_1011A18
test	eax, eax
mov	eax, [ebp+hMem]
jnz	short loc_1008E1B
mov	ecx, [eax+4]
mov	edx, [eax]
mov	ecx, [ecx]
imul	ecx, [edx]
xor	esi, esi
inc	esi
cmp	ecx, esi
jz	short loc_1008E1D

loc_1008E1B:
xor	esi, esi

loc_1008E1D:		; hMem
push	eax
call	sub_1007BD1
pop	edi
mov	eax, esi
pop	esi
pop	ebx
leave
retn	8
sub_1008D44 endp



; Attributes: bp-based frame

sub_1008E2C proc near

hMem= dword ptr	-4
arg_0= dword ptr  8
arg_4= dword ptr  0Ch

push	ebp
mov	ebp, esp
push	ecx
push	ebx
push	esi
push	edi
xor	esi, esi
push	esi		; hMem
mov	[ebp+hMem], esi
call	sub_1007BD1
mov	[ebp+hMem], esi
call	sub_1007C26
mov	[ebp+hMem], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+hMem]
mov	ebx, [ebp+arg_0]
mov	[eax], esi
mov	eax, [ebx]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx], eax
mov	esi, [ebx]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+hMem]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+hMem]
and	dword ptr [eax+4], 0
mov	eax, [ebx+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx+4], eax
mov	ebx, [ebx+4]
mov	ecx, [ebx+4]
mov	eax, [ebp+hMem]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
mov	esi, ebx
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	esi, [ebp+arg_4]
mov	eax, [esi]
neg	dword ptr [eax]
push	esi
lea	eax, [ebp+hMem]
push	eax
call	sub_100BC54
mov	eax, [esi]
neg	dword ptr [eax]
mov	eax, [ebp+hMem]
push	dword ptr [eax]
call	sub_1011A18
test	eax, eax
mov	eax, [ebp+hMem]
jnz	short loc_1008F05
mov	ecx, [eax+4]
mov	edx, [eax]
mov	ecx, [ecx]
imul	ecx, [edx]
cmp	ecx, 0FFFFFFFFh
jz	short loc_1008F05
xor	esi, esi
jmp	short loc_1008F08

loc_1008F05:
xor	esi, esi
inc	esi

loc_1008F08:		; hMem
push	eax
call	sub_1007BD1
pop	edi
mov	eax, esi
pop	esi
pop	ebx
leave
retn	8
sub_1008E2C endp



; Attributes: bp-based frame

sub_1008F17 proc near

hMem= dword ptr	-4
arg_0= dword ptr  8
arg_4= dword ptr  0Ch

push	ebp
mov	ebp, esp
push	ecx
push	ebx
push	esi
push	edi
xor	esi, esi
push	esi		; hMem
mov	[ebp+hMem], esi
call	sub_1007BD1
mov	[ebp+hMem], esi
call	sub_1007C26
mov	[ebp+hMem], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+hMem]
mov	ebx, [ebp+arg_0]
mov	[eax], esi
mov	eax, [ebx]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx], eax
mov	esi, [ebx]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+hMem]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+hMem]
and	dword ptr [eax+4], 0
mov	eax, [ebx+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx+4], eax
mov	ebx, [ebx+4]
mov	ecx, [ebx+4]
mov	eax, [ebp+hMem]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
mov	esi, ebx
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	esi, [ebp+arg_4]
mov	eax, [esi]
neg	dword ptr [eax]
push	esi
lea	eax, [ebp+hMem]
push	eax
call	sub_100BC54
mov	eax, [esi]
neg	dword ptr [eax]
mov	eax, [ebp+hMem]
push	dword ptr [eax]
call	sub_1011A18
test	eax, eax
mov	eax, [ebp+hMem]
jnz	short loc_1008FF1
mov	ecx, [eax+4]
mov	edx, [eax]
mov	ecx, [ecx]
imul	ecx, [edx]
cmp	ecx, 0FFFFFFFFh
jnz	short loc_1008FF1
xor	esi, esi
inc	esi
jmp	short loc_1008FF3

loc_1008FF1:
xor	esi, esi

loc_1008FF3:		; hMem
push	eax
call	sub_1007BD1
pop	edi
mov	eax, esi
pop	esi
pop	ebx
leave
retn	8
sub_1008F17 endp



; Attributes: bp-based frame

sub_1009002 proc near

hMem= dword ptr	-4
arg_0= dword ptr  8
arg_4= dword ptr  0Ch

push	ebp
mov	ebp, esp
push	ecx
push	ebx
push	esi
push	edi
xor	esi, esi
push	esi		; hMem
mov	[ebp+hMem], esi
call	sub_1007BD1
mov	[ebp+hMem], esi
call	sub_1007C26
mov	[ebp+hMem], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+hMem]
mov	ebx, [ebp+arg_0]
mov	[eax], esi
mov	eax, [ebx]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx], eax
mov	esi, [ebx]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+hMem]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+hMem]
and	dword ptr [eax+4], 0
mov	eax, [ebx+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx+4], eax
mov	ebx, [ebx+4]
mov	ecx, [ebx+4]
mov	eax, [ebp+hMem]
mov	edi, [eax+4]
push	[ebp+arg_4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
mov	esi, ebx
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+hMem]
mov	eax, [eax]
neg	dword ptr [eax]
lea	eax, [ebp+hMem]
push	eax
call	sub_100BC54
mov	eax, [ebp+hMem]
push	dword ptr [eax]
call	sub_1011A18
push	[ebp+hMem]	; hMem
mov	esi, eax
neg	esi
sbb	esi, esi
inc	esi
call	sub_1007BD1
pop	edi
mov	eax, esi
pop	esi
pop	ebx
leave
retn	8
sub_1009002 endp



; Attributes: bp-based frame

sub_10090D7 proc near

hMem= dword ptr	-4
arg_0= dword ptr  8
arg_4= dword ptr  0Ch

push	ebp
mov	ebp, esp
push	ecx
push	ebx
push	esi
push	edi
xor	esi, esi
push	esi		; hMem
mov	[ebp+hMem], esi
call	sub_1007BD1
mov	[ebp+hMem], esi
call	sub_1007C26
mov	[ebp+hMem], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+hMem]
mov	ebx, [ebp+arg_0]
mov	[eax], esi
mov	eax, [ebx]
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx], eax
mov	eax, [ebx]
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+hMem]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+hMem]
and	dword ptr [eax+4], 0
mov	eax, [ebx]
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx+4], eax
mov	eax, [ebx]
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	ecx, [ebp+hMem]
mov	eax, [ecx+4]
mov	ecx, [ecx]
mov	esi, [ecx+8]
sub	esi, [eax+8]
sub	esi, [eax+4]
add	esi, [ecx+4]
imul	esi, dword_1014F40
test	esi, esi
jle	short loc_10091A4
add	dword_1014F5C, esi
jmp	short loc_10091A6

loc_10091A4:
xor	esi, esi

loc_10091A6:
push	[ebp+arg_4]
lea	eax, [ebp+hMem]
push	eax
call	sub_100BD6F
lea	eax, [ebp+hMem]
push	eax
call	sub_1008A54
push	[ebp+arg_4]
lea	eax, [ebp+hMem]
push	eax
call	sub_100BBD4
mov	eax, [ebp+hMem]
mov	eax, [eax]
neg	dword ptr [eax]
push	[ebp+hMem]
push	ebx
call	sub_100BC54
push	[ebp+hMem]	; hMem
sub	dword_1014F5C, esi
call	sub_1007BD1
pop	edi
pop	esi
pop	ebx
leave
retn	8
sub_10090D7 endp



; Attributes: bp-based frame

sub_10091EC proc near

var_8= dword ptr -8
hMem= dword ptr	-4
arg_0= dword ptr  8

push	ebp
mov	ebp, esp
push	ecx
push	ecx
push	ebx
push	esi
xor	esi, esi
push	edi
push	esi		; hMem
mov	[ebp+var_8], esi
mov	[ebp+hMem], esi
call	sub_1007BD1
mov	[ebp+var_8], esi
call	sub_1007C26
mov	[ebp+var_8], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+var_8]
mov	ebx, [ebp+arg_0]
mov	[eax], esi
mov	eax, [ebx]
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+var_8]
mov	[ecx], eax
mov	eax, [ebx]
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+var_8]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+var_8]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+var_8]
and	dword ptr [eax+4], 0
mov	eax, [ebx]
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+var_8]
mov	[ecx+4], eax
mov	eax, [ebx]
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+var_8]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	ecx, [ebp+var_8]
mov	eax, [ecx+4]
mov	ecx, [ecx]
mov	ebx, [ecx+8]
sub	ebx, [eax+8]
push	[ebp+hMem]	; hMem
sub	ebx, [eax+4]
xor	esi, esi
add	ebx, [ecx+4]
imul	ebx, dword_1014F40
cmp	ebx, esi
jle	loc_1009392
add	dword_1014F5C, ebx
call	sub_1007BD1
mov	[ebp+hMem], esi
call	sub_1007C26
mov	[ebp+hMem], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+hMem]
mov	[eax], esi
mov	eax, dword_1014F98
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx], eax
mov	eax, dword_1014F98
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+hMem]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+hMem]
and	dword ptr [eax+4], 0
mov	eax, dword_1014F98
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx+4], eax
mov	eax, dword_1014F98
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
lea	eax, [ebp+hMem]
and	ecx, 3
push	eax
rep movsb
call	sub_100F73F
push	dword_1014F94
lea	eax, [ebp+hMem]
push	eax
call	sub_100BBD4
push	dword_1014F90
lea	eax, [ebp+hMem]
push	eax
call	sub_100BBD4
jmp	loc_1009435

loc_1009392:
call	sub_1007BD1
mov	[ebp+hMem], esi
call	sub_1007C26
mov	[ebp+hMem], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+hMem]
mov	[eax], esi
mov	eax, dword_1014FAC
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx], eax
mov	eax, dword_1014FAC
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+hMem]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+hMem]
xor	ebx, ebx
mov	[eax+4], ebx
mov	eax, dword_1014FAC
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx+4], eax
mov	eax, dword_1014FAC
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb

loc_1009435:
push	[ebp+hMem]
lea	eax, [ebp+var_8]
push	eax
call	sub_100BD6F
lea	eax, [ebp+var_8]
push	eax
call	sub_1008A54
push	[ebp+hMem]
lea	eax, [ebp+var_8]
push	eax
call	sub_100BBD4
mov	eax, [ebp+var_8]
mov	eax, [eax]
neg	dword ptr [eax]
push	[ebp+var_8]
push	[ebp+arg_0]
call	sub_100BC54
push	[ebp+hMem]	; hMem
sub	dword_1014F5C, ebx
call	sub_1007BD1
push	[ebp+var_8]	; hMem
and	[ebp+hMem], 0
call	sub_1007BD1
pop	edi
pop	esi
pop	ebx
leave
retn	4
sub_10091EC endp



; Attributes: bp-based frame

sub_1009489 proc near

arg_0= dword ptr  8
arg_4= dword ptr  0Ch

push	ebp
mov	ebp, esp
push	ebx
mov	ebx, [ebp+arg_0]
push	esi
mov	esi, [ebp+arg_4]
push	edi
push	esi
push	dword ptr [ebx]
call	sub_1008D44
test	eax, eax
jz	loc_1009536
push	dword ptr [ebx]	; hMem
call	sub_1007BD1
and	dword ptr [ebx], 0
call	sub_1007C26
mov	[ebx], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebx]
and	dword ptr [eax], 0
mov	eax, [esi]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebx]
mov	[ecx], eax
mov	esi, [esi]
mov	ecx, [esi+4]
mov	eax, [ebx]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebx]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebx]
and	dword ptr [eax+4], 0
mov	esi, [ebp+arg_4]
mov	eax, [esi+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebx]
mov	[ecx+4], eax
mov	esi, [esi+4]
mov	ecx, [esi+4]
mov	eax, [ebx]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
jmp	loc_10095DD

loc_1009536:
mov	eax, [esi]
neg	dword ptr [eax]
push	esi
push	dword ptr [ebx]
call	sub_1008F17
test	eax, eax
jz	loc_10095D9
push	dword ptr [ebx]	; hMem
call	sub_1007BD1
and	dword ptr [ebx], 0
call	sub_1007C26
mov	[ebx], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebx]
and	dword ptr [eax], 0
mov	eax, [esi]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebx]
mov	[ecx], eax
mov	esi, [esi]
mov	ecx, [esi+4]
mov	eax, [ebx]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebx]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebx]
and	dword ptr [eax+4], 0
mov	esi, [ebp+arg_4]
mov	eax, [esi+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebx]
mov	[ecx+4], eax
mov	esi, [esi+4]
mov	ecx, [esi+4]
mov	eax, [ebx]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	esi, [ebp+arg_4]

loc_10095D9:
mov	esi, [esi]
neg	dword ptr [esi]

loc_10095DD:
pop	edi
pop	esi
pop	ebx
pop	ebp
retn	8
sub_1009489 endp




sub_10095E4 proc near
push	ebx
push	ebp
push	esi
push	edi
push	dword_1014F64
call	sub_1007BC1
push	dword_10143E4
xor	ebx, ebx
mov	dword_1014F64, ebx
call	sub_1007BFB
mov	ecx, dword_10143E4
lea	ecx, ds:0Ch[ecx*4]
mov	dword_1014F64, eax
mov	edi, eax
mov	eax, ecx
shr	ecx, 2
mov	esi, offset unk_10143E0
rep movsd
push	3
pop	ebp
mov	ecx, eax
and	ecx, ebp
rep movsb
push	dword_1014F68
call	sub_1007BC1
push	dword_10143F4
mov	dword_1014F68, ebx
call	sub_1007BFB
mov	ecx, dword_10143F4
lea	ecx, ds:0Ch[ecx*4]
mov	dword_1014F68, eax
mov	edi, eax
mov	eax, ecx
shr	ecx, 2
mov	esi, offset unk_10143F0
rep movsd
mov	ecx, eax
and	ecx, ebp
rep movsb
push	dword_1014F6C
call	sub_1007BC1
push	dword_1014404
mov	dword_1014F6C, ebx
call	sub_1007BFB
mov	ecx, dword_1014404
lea	ecx, ds:0Ch[ecx*4]
mov	dword_1014F6C, eax
mov	edi, eax
mov	eax, ecx
shr	ecx, 2
mov	esi, offset unk_1014400
rep movsd
mov	ecx, eax
and	ecx, ebp
rep movsb
push	dword_1014F70
call	sub_1007BC1
push	dword_1014414
mov	dword_1014F70, ebx
call	sub_1007BFB
mov	ecx, dword_1014414
lea	ecx, ds:0Ch[ecx*4]
mov	dword_1014F70, eax
mov	edi, eax
mov	eax, ecx
shr	ecx, 2
mov	esi, offset unk_1014410
rep movsd
mov	ecx, eax
and	ecx, ebp
rep movsb
push	dword_1014F74
call	sub_1007BC1
push	dword_1014424
mov	dword_1014F74, ebx
call	sub_1007BFB
mov	ecx, dword_1014424
mov	dword_1014F74, eax
lea	ecx, ds:0Ch[ecx*4]
mov	esi, offset unk_1014420
mov	edi, eax
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, ebp
rep movsb
call	sub_1007C26
mov	dword_1014FA0, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014FA0
mov	[eax], ebx
push	dword_101448C
call	sub_1007BFB
mov	ecx, dword_1014FA0
mov	[ecx], eax
mov	ecx, dword_101448C
mov	eax, dword_1014FA0
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
mov	esi, offset unk_1014488
rep movsd
mov	ecx, eax
and	ecx, ebp
rep movsb
mov	eax, dword_1014FA0
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014FA0
mov	[eax+4], ebx
push	dword_101449C
call	sub_1007BFB
mov	ecx, dword_1014FA0
mov	[ecx+4], eax
mov	ecx, dword_101449C
mov	eax, dword_1014FA0
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
mov	esi, offset unk_1014498
rep movsd
mov	ecx, eax
and	ecx, ebp
rep movsb
call	sub_1007C26
mov	dword_1014F94, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014F94
mov	[eax], ebx
push	dword_10144AC
call	sub_1007BFB
mov	ecx, dword_1014F94
mov	[ecx], eax
mov	ecx, dword_10144AC
mov	eax, dword_1014F94
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
mov	esi, offset unk_10144A8
rep movsd
mov	ecx, eax
and	ecx, ebp
rep movsb
mov	eax, dword_1014F94
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014F94
mov	[eax+4], ebx
push	dword_10144BC
call	sub_1007BFB
mov	ecx, dword_1014F94
mov	[ecx+4], eax
mov	ecx, dword_10144BC
mov	eax, dword_1014F94
lea	ecx, ds:0Ch[ecx*4]
mov	esi, offset unk_10144B8
mov	edi, [eax+4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, ebp
rep movsb
call	sub_1007C26
mov	dword_1014F90, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014F90
mov	[eax], ebx
push	dword_10144CC
call	sub_1007BFB
mov	ecx, dword_1014F90
mov	[ecx], eax
mov	ecx, dword_10144CC
mov	eax, dword_1014F90
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
mov	esi, offset unk_10144C8
rep movsd
mov	ecx, eax
and	ecx, ebp
rep movsb
mov	eax, dword_1014F90
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014F90
mov	[eax+4], ebx
push	dword_10144DC
call	sub_1007BFB
mov	ecx, dword_1014F90
mov	[ecx+4], eax
mov	ecx, dword_10144DC
mov	eax, dword_1014F90
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
mov	esi, offset unk_10144D8
rep movsd
mov	ecx, eax
and	ecx, ebp
rep movsb
call	sub_1007C26
mov	dword_1014F84, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014F84
mov	[eax], ebx
push	dword_10144EC
call	sub_1007BFB
mov	ecx, dword_1014F84
mov	[ecx], eax
mov	ecx, dword_10144EC
mov	eax, dword_1014F84
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
mov	esi, offset unk_10144E8
rep movsd
mov	ecx, eax
and	ecx, ebp
rep movsb
mov	eax, dword_1014F84
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014F84
mov	[eax+4], ebx
push	dword_10144FC
call	sub_1007BFB
mov	ecx, dword_1014F84
mov	[ecx+4], eax
mov	ecx, dword_10144FC
lea	ecx, ds:0Ch[ecx*4]
mov	esi, offset unk_10144F8
mov	eax, dword_1014F84
mov	edi, [eax+4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, ebp
rep movsb
call	sub_1007C26
mov	dword_1014F88, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014F88
mov	[eax], ebx
push	dword_101450C
call	sub_1007BFB
mov	ecx, dword_1014F88
mov	[ecx], eax
mov	ecx, dword_101450C
mov	eax, dword_1014F88
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
mov	esi, offset unk_1014508
rep movsd
mov	ecx, eax
and	ecx, ebp
rep movsb
mov	eax, dword_1014F88
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014F88
mov	[eax+4], ebx
push	dword_101451C
call	sub_1007BFB
mov	ecx, dword_1014F88
mov	[ecx+4], eax
mov	ecx, dword_101451C
mov	eax, dword_1014F88
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
mov	esi, offset unk_1014518
rep movsd
mov	ecx, eax
and	ecx, ebp
rep movsb
call	sub_1007C26
mov	dword_1014F8C, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014F8C
mov	[eax], ebx
push	dword_101452C
call	sub_1007BFB
mov	ecx, dword_1014F8C
mov	[ecx], eax
mov	ecx, dword_101452C
mov	eax, dword_1014F8C
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
mov	esi, offset unk_1014528
rep movsd
mov	ecx, eax
and	ecx, ebp
rep movsb
mov	eax, dword_1014F8C
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014F8C
mov	[eax+4], ebx
push	dword_101453C
call	sub_1007BFB
mov	ecx, dword_1014F8C
mov	[ecx+4], eax
mov	ecx, dword_101453C
lea	ecx, ds:0Ch[ecx*4]
mov	eax, dword_1014F8C
mov	edi, [eax+4]
mov	eax, ecx
shr	ecx, 2
mov	esi, offset unk_1014538
rep movsd
mov	ecx, eax
and	ecx, ebp
rep movsb
call	sub_1007C26
mov	dword_1014F98, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014F98
mov	[eax], ebx
push	dword_101454C
call	sub_1007BFB
mov	ecx, dword_1014F98
mov	[ecx], eax
mov	ecx, dword_101454C
mov	eax, dword_1014F98
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
mov	esi, offset unk_1014548
rep movsd
mov	ecx, eax
and	ecx, ebp
rep movsb
mov	eax, dword_1014F98
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014F98
mov	[eax+4], ebx
push	dword_101455C
call	sub_1007BFB
mov	ecx, dword_1014F98
mov	[ecx+4], eax
mov	ecx, dword_101455C
mov	eax, dword_1014F98
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
mov	esi, offset unk_1014558
rep movsd
mov	ecx, eax
and	ecx, ebp
rep movsb
call	sub_1007C26
mov	dword_1014F9C, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014F9C
mov	[eax], ebx
push	dword_101456C
call	sub_1007BFB
mov	ecx, dword_1014F9C
mov	[ecx], eax
mov	ecx, dword_101456C
mov	eax, dword_1014F9C
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
mov	esi, offset unk_1014568
rep movsd
mov	ecx, eax
and	ecx, ebp
rep movsb
mov	eax, dword_1014F9C
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014F9C
mov	[eax+4], ebx
push	dword_101457C
call	sub_1007BFB
mov	ecx, dword_1014F9C
mov	[ecx+4], eax
mov	ecx, dword_101457C
mov	eax, dword_1014F9C
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
mov	esi, offset unk_1014578
rep movsd
mov	ecx, eax
and	ecx, ebp
rep movsb
call	sub_1007C26
mov	dword_1014FA4, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014FA4
mov	[eax], ebx
push	dword_101458C
call	sub_1007BFB
mov	ecx, dword_1014FA4
mov	[ecx], eax
mov	ecx, dword_101458C
mov	eax, dword_1014FA4
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
mov	esi, offset unk_1014588
rep movsd
mov	ecx, eax
and	ecx, ebp
rep movsb
mov	eax, dword_1014FA4
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014FA4
mov	[eax+4], ebx
push	dword_10145B0
call	sub_1007BFB
mov	ecx, dword_1014FA4
mov	[ecx+4], eax
mov	ecx, dword_10145B0
mov	eax, dword_1014FA4
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
mov	esi, offset unk_10145AC
rep movsd
mov	ecx, eax
and	ecx, ebp
rep movsb
call	sub_1007C26
mov	dword_1014FAC, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014FAC
mov	[eax], ebx
push	dword_10145D4
call	sub_1007BFB
mov	ecx, dword_1014FAC
mov	[ecx], eax
mov	ecx, dword_10145D4
mov	eax, dword_1014FAC
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
mov	esi, offset unk_10145D0
rep movsd
mov	ecx, eax
and	ecx, ebp
rep movsb
mov	eax, dword_1014FAC
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014FAC
mov	[eax+4], ebx
push	dword_10145F8
call	sub_1007BFB
mov	ecx, dword_1014FAC
mov	[ecx+4], eax
mov	ecx, dword_10145F8
mov	eax, dword_1014FAC
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
mov	esi, offset unk_10145F4
rep movsd
mov	ecx, eax
and	ecx, ebp
rep movsb
call	sub_1007C26
mov	dword_1014FA8, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014FA8
mov	[eax], ebx
push	dword_101461C
call	sub_1007BFB
mov	ecx, dword_1014FA8
mov	[ecx], eax
mov	ecx, dword_101461C
mov	eax, dword_1014FA8
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
mov	esi, offset unk_1014618
rep movsd
mov	ecx, eax
and	ecx, ebp
rep movsb
mov	eax, dword_1014FA8
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014FA8
mov	[eax+4], ebx
push	dword_1014640
call	sub_1007BFB
mov	ecx, dword_1014FA8
mov	[ecx+4], eax
mov	ecx, dword_1014640
mov	eax, dword_1014FA8
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
mov	esi, offset unk_101463C
rep movsd
mov	ecx, eax
and	ecx, ebp
rep movsb
call	sub_1007C26
mov	dword_1014FB0, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014FB0
mov	[eax], ebx
push	dword_1014664
call	sub_1007BFB
mov	ecx, dword_1014FB0
mov	[ecx], eax
mov	ecx, dword_1014664
mov	eax, dword_1014FB0
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
mov	esi, offset unk_1014660
rep movsd
mov	ecx, eax
and	ecx, ebp
rep movsb
mov	eax, dword_1014FB0
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014FB0
mov	[eax+4], ebx
push	dword_1014688
call	sub_1007BFB
mov	ecx, dword_1014FB0
mov	[ecx+4], eax
mov	ecx, dword_1014688
mov	eax, dword_1014FB0
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
mov	esi, offset unk_1014684
rep movsd
mov	ecx, eax
and	ecx, ebp
rep movsb
call	sub_1007C26
mov	dword_1014FB4, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014FB4
mov	[eax], ebx
push	dword_10146AC
call	sub_1007BFB
mov	ecx, dword_1014FB4
mov	[ecx], eax
mov	ecx, dword_10146AC
mov	eax, dword_1014FB4
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
mov	esi, offset unk_10146A8
rep movsd
mov	ecx, eax
and	ecx, ebp
rep movsb
mov	eax, dword_1014FB4
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014FB4
mov	[eax+4], ebx
push	dword_10146D0
call	sub_1007BFB
mov	ecx, dword_1014FB4
mov	[ecx+4], eax
mov	ecx, dword_10146D0
mov	eax, dword_1014FB4
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
mov	esi, offset unk_10146CC
rep movsd
mov	ecx, eax
and	ecx, ebp
rep movsb
call	sub_1007C26
mov	dword_1014FB8, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014FB8
mov	[eax], ebx
push	dword_10146F4
call	sub_1007BFB
mov	ecx, dword_1014FB8
mov	[ecx], eax
mov	ecx, dword_10146F4
mov	eax, dword_1014FB8
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
mov	esi, offset unk_10146F0
rep movsd
mov	ecx, eax
and	ecx, ebp
rep movsb
mov	eax, dword_1014FB8
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014FB8
mov	[eax+4], ebx
push	dword_1014718
call	sub_1007BFB
mov	ecx, dword_1014FB8
mov	[ecx+4], eax
mov	ecx, dword_1014718
mov	eax, dword_1014FB8
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
mov	esi, offset unk_1014714
rep movsd
mov	ecx, eax
and	ecx, ebp
rep movsb
call	sub_1007C26
mov	dword_1014F7C, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014F7C
mov	[eax], ebx
push	dword_101473C
call	sub_1007BFB
mov	ecx, dword_1014F7C
mov	[ecx], eax
mov	ecx, dword_101473C
mov	eax, dword_1014F7C
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
mov	esi, offset unk_1014738
rep movsd
mov	ecx, eax
and	ecx, ebp
rep movsb
mov	eax, dword_1014F7C
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014F7C
mov	[eax+4], ebx
push	dword_1014760
call	sub_1007BFB
mov	ecx, dword_1014F7C
mov	[ecx+4], eax
mov	ecx, dword_1014760
mov	eax, dword_1014F7C
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
mov	esi, offset unk_101475C
rep movsd
mov	ecx, eax
and	ecx, ebp
rep movsb
call	sub_1007C26
mov	dword_1014F80, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014F80
mov	[eax], ebx
push	dword_1014784
call	sub_1007BFB
mov	ecx, dword_1014F80
mov	[ecx], eax
mov	ecx, dword_1014784
mov	eax, dword_1014F80
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
mov	esi, offset unk_1014780
rep movsd
mov	ecx, eax
and	ecx, ebp
rep movsb
mov	eax, dword_1014F80
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014F80
mov	[eax+4], ebx
push	dword_10147A8
call	sub_1007BFB
mov	ecx, dword_1014F80
mov	[ecx+4], eax
mov	ecx, dword_10147A8
mov	eax, dword_1014F80
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
mov	esi, offset unk_10147A4
rep movsd
mov	ecx, eax
and	ecx, ebp
rep movsb
call	sub_1007C26
mov	dword_1014FBC, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014FBC
mov	[eax], ebx
push	dword_10147CC
call	sub_1007BFB
mov	ecx, dword_1014FBC
mov	[ecx], eax
mov	ecx, dword_10147CC
mov	eax, dword_1014FBC
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
mov	esi, offset unk_10147C8
rep movsd
mov	ecx, eax
and	ecx, ebp
rep movsb
mov	eax, dword_1014FBC
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014FBC
mov	[eax+4], ebx
push	dword_10147F0
call	sub_1007BFB
mov	ecx, dword_1014FBC
mov	[ecx+4], eax
mov	ecx, dword_10147F0
mov	eax, dword_1014FBC
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
mov	esi, offset unk_10147EC
rep movsd
mov	ecx, eax
and	ecx, ebp
rep movsb
call	sub_1007C26
mov	dword_1014FC0, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014FC0
mov	[eax], ebx
push	dword_1014814
call	sub_1007BFB
mov	ecx, dword_1014FC0
mov	[ecx], eax
mov	ecx, dword_1014814
mov	eax, dword_1014FC0
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
mov	esi, offset unk_1014810
rep movsd
mov	ecx, eax
and	ecx, ebp
rep movsb
mov	eax, dword_1014FC0
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014FC0
mov	[eax+4], ebx
push	dword_1014838
call	sub_1007BFB
mov	ecx, dword_1014FC0
mov	[ecx+4], eax
mov	ecx, dword_1014838
mov	eax, dword_1014FC0
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
mov	esi, offset unk_1014834
rep movsd
mov	ecx, eax
and	ecx, ebp
rep movsb
call	sub_1007C26
mov	dword_1014FC4, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014FC4
mov	[eax], ebx
push	dword_101485C
call	sub_1007BFB
mov	ecx, dword_1014FC4
mov	[ecx], eax
mov	ecx, dword_101485C
mov	eax, dword_1014FC4
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
mov	esi, offset unk_1014858
rep movsd
mov	ecx, eax
and	ecx, ebp
rep movsb
mov	eax, dword_1014FC4
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014FC4
mov	[eax+4], ebx
push	dword_1014874
call	sub_1007BFB
mov	ecx, dword_1014FC4
mov	[ecx+4], eax
mov	ecx, dword_1014874
mov	eax, dword_1014FC4
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
mov	esi, offset unk_1014870
rep movsd
mov	ecx, eax
and	ecx, ebp
rep movsb
call	sub_1007C26
mov	dword_1014FC8, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014FC8
mov	[eax], ebx
push	dword_1014884
call	sub_1007BFB
mov	ecx, dword_1014FC8
mov	[ecx], eax
mov	ecx, dword_1014884
mov	eax, dword_1014FC8
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
mov	esi, offset unk_1014880
rep movsd
mov	ecx, eax
and	ecx, ebp
rep movsb
mov	eax, dword_1014FC8
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014FC8
mov	[eax+4], ebx
push	dword_1014898
call	sub_1007BFB
mov	ecx, dword_1014FC8
mov	[ecx+4], eax
mov	ecx, dword_1014898
mov	eax, dword_1014FC8
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
mov	esi, offset unk_1014894
rep movsd
mov	ecx, eax
and	ecx, ebp
rep movsb
call	sub_1007C26
mov	dword_1014FCC, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014FCC
mov	[eax], ebx
push	dword_10148CC
call	sub_1007BFB
mov	ecx, dword_1014FCC
mov	[ecx], eax
mov	ecx, dword_10148CC
mov	eax, dword_1014FCC
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
mov	esi, offset unk_10148C8
rep movsd
mov	ecx, eax
and	ecx, ebp
rep movsb
mov	eax, dword_1014FCC
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014FCC
mov	[eax+4], ebx
push	dword_10148DC
call	sub_1007BFB
mov	ecx, dword_1014FCC
mov	[ecx+4], eax
mov	ecx, dword_10148DC
mov	eax, dword_1014FCC
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
mov	esi, offset unk_10148D8
rep movsd
mov	ecx, eax
and	ecx, ebp
rep movsb
call	sub_1007C26
mov	dword_1014FD0, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014FD0
mov	[eax], ebx
push	dword_10148EC
call	sub_1007BFB
mov	ecx, dword_1014FD0
mov	[ecx], eax
mov	ecx, dword_10148EC
mov	eax, dword_1014FD0
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
mov	esi, offset unk_10148E8
rep movsd
mov	ecx, eax
and	ecx, ebp
rep movsb
mov	eax, dword_1014FD0
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014FD0
mov	[eax+4], ebx
push	dword_10148FC
call	sub_1007BFB
mov	ecx, dword_1014FD0
mov	[ecx+4], eax
mov	ecx, dword_10148FC
mov	eax, dword_1014FD0
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
mov	esi, offset unk_10148F8
rep movsd
mov	ecx, eax
and	ecx, ebp
rep movsb
call	sub_1007C26
mov	dword_1014FD4, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014FD4
mov	[eax], ebx
push	dword_101492C
call	sub_1007BFB
mov	ecx, dword_1014FD4
mov	[ecx], eax
mov	ecx, dword_101492C
mov	eax, dword_1014FD4
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
mov	esi, offset unk_1014928
rep movsd
mov	ecx, eax
and	ecx, ebp
rep movsb
mov	eax, dword_1014FD4
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014FD4
mov	[eax+4], ebx
push	dword_101493C
call	sub_1007BFB
mov	ecx, dword_1014FD4
mov	[ecx+4], eax
mov	ecx, dword_101493C
mov	eax, dword_1014FD4
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
mov	esi, offset unk_1014938
rep movsd
mov	ecx, eax
and	ecx, ebp
rep movsb
call	sub_1007C26
mov	dword_1014FD8, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014FD8
mov	[eax], ebx
push	dword_101490C
call	sub_1007BFB
mov	ecx, dword_1014FD8
mov	[ecx], eax
mov	ecx, dword_101490C
mov	eax, dword_1014FD8
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
mov	esi, offset unk_1014908
rep movsd
mov	ecx, eax
and	ecx, ebp
rep movsb
mov	eax, dword_1014FD8
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014FD8
mov	[eax+4], ebx
push	dword_101491C
call	sub_1007BFB
mov	ecx, dword_1014FD8
mov	[ecx+4], eax
mov	ecx, dword_101491C
mov	eax, dword_1014FD8
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
mov	esi, offset unk_1014918
rep movsd
mov	ecx, eax
and	ecx, ebp
rep movsb
call	sub_1007C26
mov	dword_1014FDC, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014FDC
mov	[eax], ebx
push	dword_101496C
call	sub_1007BFB
mov	ecx, dword_1014FDC
mov	[ecx], eax
mov	ecx, dword_101496C
mov	eax, dword_1014FDC
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
mov	esi, offset unk_1014968
rep movsd
mov	ecx, eax
and	ecx, ebp
rep movsb
mov	eax, dword_1014FDC
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014FDC
mov	[eax+4], ebx
push	dword_101497C
call	sub_1007BFB
mov	ecx, dword_1014FDC
mov	[ecx+4], eax
mov	ecx, dword_101497C
mov	eax, dword_1014FDC
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
mov	esi, offset unk_1014978
rep movsd
mov	ecx, eax
and	ecx, ebp
rep movsb
call	sub_1007C26
mov	dword_1014FE0, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014FE0
mov	[eax], ebx
push	dword_101494C
call	sub_1007BFB
mov	ecx, dword_1014FE0
mov	[ecx], eax
mov	ecx, dword_101494C
mov	eax, dword_1014FE0
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
mov	esi, offset unk_1014948
rep movsd
mov	ecx, eax
and	ecx, ebp
rep movsb
mov	eax, dword_1014FE0
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014FE0
mov	[eax+4], ebx
push	dword_101495C
call	sub_1007BFB
mov	ecx, dword_1014FE0
mov	[ecx+4], eax
mov	ecx, dword_101495C
mov	eax, dword_1014FE0
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
mov	esi, offset unk_1014958
rep movsd
mov	ecx, eax
and	ecx, ebp
rep movsb
call	sub_1007C26
mov	dword_1014FE8, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014FE8
mov	[eax], ebx
push	dword_1014434
call	sub_1007BFB
mov	ecx, dword_1014FE8
mov	[ecx], eax
mov	ecx, dword_1014434
mov	eax, dword_1014FE8
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
mov	esi, offset unk_1014430
rep movsd
mov	ecx, eax
and	ecx, ebp
rep movsb
mov	eax, dword_1014FE8
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014FE8
mov	[eax+4], ebx
push	dword_1014444
call	sub_1007BFB
mov	ecx, dword_1014FE8
mov	[ecx+4], eax
mov	ecx, dword_1014444
mov	eax, dword_1014FE8
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
mov	esi, offset unk_1014440
rep movsd
mov	ecx, eax
and	ecx, ebp
rep movsb
call	sub_1007C26
mov	dword_1014FEC, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014FEC
mov	[eax], ebx
push	dword_1014460
call	sub_1007BFB
mov	ecx, dword_1014FEC
mov	[ecx], eax
mov	ecx, dword_1014460
mov	eax, dword_1014FEC
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
mov	esi, offset unk_101445C
rep movsd
mov	ecx, eax
and	ecx, ebp
rep movsb
mov	eax, dword_1014FEC
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014FEC
mov	[eax+4], ebx
push	dword_1014470
call	sub_1007BFB
mov	ecx, dword_1014FEC
mov	[ecx+4], eax
mov	ecx, dword_1014470
mov	eax, dword_1014FEC
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
mov	esi, offset unk_101446C
rep movsd
mov	ecx, eax
and	ecx, ebp
rep movsb
call	sub_1007C26
mov	dword_1014FF0, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014FF0
mov	[eax], ebx
push	dword_101498C
call	sub_1007BFB
mov	ecx, dword_1014FF0
mov	[ecx], eax
mov	ecx, dword_101498C
mov	eax, dword_1014FF0
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
mov	esi, offset unk_1014988
rep movsd
mov	ecx, eax
and	ecx, ebp
rep movsb
mov	eax, dword_1014FF0
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014FF0
mov	[eax+4], ebx
push	dword_101499C
call	sub_1007BFB
mov	ecx, dword_1014FF0
mov	[ecx+4], eax
mov	ecx, dword_101499C
mov	eax, dword_1014FF0
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
mov	esi, offset unk_1014998
rep movsd
mov	ecx, eax
and	ecx, ebp
rep movsb
call	sub_1007C26
mov	dword_1014FF4, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014FF4
mov	[eax], ebx
push	dword_10149AC
call	sub_1007BFB
mov	ecx, dword_1014FF4
mov	[ecx], eax
mov	ecx, dword_10149AC
mov	eax, dword_1014FF4
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
mov	esi, offset unk_10149A8
rep movsd
mov	ecx, eax
and	ecx, ebp
rep movsb
mov	eax, dword_1014FF4
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014FF4
mov	[eax+4], ebx
push	dword_10149BC
call	sub_1007BFB
mov	ecx, dword_1014FF4
mov	[ecx+4], eax
mov	ecx, dword_10149BC
mov	eax, dword_1014FF4
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
mov	esi, offset unk_10149B8
rep movsd
mov	ecx, eax
and	ecx, ebp
rep movsb
call	sub_1007C26
mov	dword_1014FF8, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014FF8
mov	[eax], ebx
push	dword_10148A8
call	sub_1007BFB
mov	ecx, dword_1014FF8
mov	[ecx], eax
mov	ecx, dword_10148A8
mov	eax, dword_1014FF8
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
mov	esi, offset unk_10148A4
rep movsd
mov	ecx, eax
and	ecx, ebp
rep movsb
mov	eax, dword_1014FF8
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014FF8
mov	[eax+4], ebx
push	dword_10148BC
call	sub_1007BFB
mov	ecx, dword_1014FF8
mov	[ecx+4], eax
mov	ecx, dword_10148BC
mov	eax, dword_1014FF8
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
mov	esi, offset unk_10148B8
rep movsd
mov	ecx, eax
and	ecx, ebp
rep movsb
push	dword_1014F4C
call	sub_1007BC1
mov	eax, dword_1014F64
mov	dword_1014F4C, ebx
push	dword ptr [eax+4]
call	sub_1007BFB
mov	esi, dword_1014F64
mov	dword_1014F4C, eax
mov	ecx, [esi+4]
lea	ecx, ds:0Ch[ecx*4]
mov	edi, eax
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, ebp
rep movsb
mov	dword_1014F54, ebx
mov	dword_1014F50, ebx
pop	edi
pop	esi
pop	ebp
pop	ebx
retn
sub_10095E4 endp




sub_100AB09 proc near

arg_0= dword ptr  4

cmp	byte_1014F60, 0
jnz	locret_100ABDA
mov	eax, [esp+arg_0]
mov	eax, [eax]
push	ebx
push	ebp
push	esi
mov	esi, [eax+4]
mov	ecx, [esi+8]
push	edi
mov	edi, [eax]
mov	eax, [esi+4]
mov	ebx, [edi+8]
add	eax, ecx
mov	ecx, [edi+4]
add	ecx, ebx
cmp	ecx, eax
jge	short loc_100AB3B
mov	eax, ecx

loc_100AB3B:
mov	ebp, dword_1014F40
dec	eax
imul	eax, ebp
sub	eax, dword_1014F5C
cmp	eax, ebp
jle	short loc_100ABC2
cdq
idiv	ebp
mov	ebp, eax
cmp	ebp, ebx
jg	short loc_100AB5F
sub	ebx, ebp
mov	[edi+8], ebx
jmp	short loc_100AB87

loc_100AB5F:
sub	ecx, ebp
mov	eax, ebp
sub	eax, ebx
shl	ecx, 2
push	ecx		; Size
lea	eax, [edi+eax*4+0Ch]
push	eax		; Src
lea	eax, [edi+0Ch]
push	eax		; Dst
call	ds:memmove
mov	eax, [edi+8]
sub	eax, ebp
add	[edi+4], eax
add	esp, 0Ch
and	dword ptr [edi+8], 0

loc_100AB87:
mov	eax, [esi+8]
cmp	ebp, eax
jg	short loc_100AB95
sub	eax, ebp
mov	[esi+8], eax
jmp	short loc_100ABC2

loc_100AB95:
mov	ecx, eax
sub	ecx, ebp
add	ecx, [esi+4]
shl	ecx, 2
push	ecx		; Size
mov	ecx, ebp
sub	ecx, eax
lea	eax, [esi+ecx*4+0Ch]
push	eax		; Src
lea	eax, [esi+0Ch]
push	eax		; Dst
call	ds:memmove
mov	eax, [esi+8]
sub	eax, ebp
add	[esi+4], eax
add	esp, 0Ch
and	dword ptr [esi+8], 0

loc_100ABC2:
mov	eax, [edi+8]
mov	ecx, [esi+8]
cmp	eax, ecx
jge	short loc_100ABCE
mov	ecx, eax

loc_100ABCE:
sub	eax, ecx
mov	[edi+8], eax
sub	[esi+8], ecx
pop	edi
pop	esi
pop	ebp
pop	ebx

locret_100ABDA:
retn	4
sub_100AB09 endp




sub_100ABDD proc near

arg_0= dword ptr  4
arg_4= dword ptr  8

push	ebx
push	ebp
xor	edx, edx
push	esi
mov	esi, [esp+0Ch+arg_0]
mov	ebp, 80000000h
mov	eax, ebp
div	esi
xor	edx, edx
push	edi
mov	edi, [esp+10h+arg_4]
xor	ebx, ebx
inc	edx
xor	ecx, ecx
mov	dword_1014F5C, edi
mov	dword_1014F58, ebx
cmp	eax, edx
jbe	short loc_100AC13

loc_100AC0B:
imul	edx, esi
inc	ecx
cmp	edx, eax
jb	short loc_100AC0B

loc_100AC13:
push	dword_1014F78
xor	eax, eax
cmp	ecx, ebx
setz	al
add	ecx, eax
mov	dword_1014F40, ecx
call	sub_1007BC1
push	ebp
push	esi
mov	dword_1014F78, ebx
call	sub_1007C4C
push	dword_1014FE4	; hMem
mov	dword_1014F78, eax
call	sub_1007BD1
push	esi
mov	dword_1014FE4, ebx
call	sub_10081CC
mov	dword_1014FE4, eax
mov	eax, dword_1014F40
imul	eax, esi
imul	eax, edi
cmp	dword_10143DC, eax
jge	loc_100B9EA
push	ebp
push	1
mov	byte_1014F60, bl
call	sub_1007C4C
push	ebp
push	2
mov	dword_1014F64, eax
call	sub_1007C4C
push	ebp
push	5
mov	dword_1014F68, eax
call	sub_1007C4C
push	ebp
push	6
mov	dword_1014F6C, eax
call	sub_1007C4C
push	ebp
push	0Ah
mov	dword_1014F70, eax
call	sub_1007C4C
push	dword_1014FE8	; hMem
mov	dword_1014F74, eax
call	sub_1007BD1
mov	dword_1014FE8, ebx
call	sub_1007C26
mov	dword_1014FE8, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014FE8
mov	[eax], ebx
mov	eax, dword_1014FE4
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014FE8
mov	[ecx], eax
mov	eax, dword_1014FE4
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, dword_1014FE8
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, dword_1014FE8
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014FE8
mov	[eax+4], ebx
mov	eax, dword_1014FE4
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014FE8
mov	[ecx+4], eax
mov	eax, dword_1014FE4
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, dword_1014FE8
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
mov	eax, [esp+10h+arg_4]
neg	eax
push	eax
and	ecx, 3
push	offset dword_1014FE8
rep movsb
call	sub_10086C8
push	dword_1014FEC	; hMem
call	sub_1007BD1
mov	dword_1014FEC, ebx
call	sub_1007C26
mov	dword_1014FEC, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014FEC
mov	[eax], ebx
mov	eax, dword_1014FE8
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014FEC
mov	[ecx], eax
mov	eax, dword_1014FE8
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, dword_1014FEC
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, dword_1014FEC
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014FEC
mov	[eax+4], ebx
mov	eax, dword_1014FE8
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014FEC
mov	[ecx+4], eax
mov	eax, dword_1014FE8
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, dword_1014FEC
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, dword_1014FEC
mov	eax, [eax]
or	dword ptr [eax], 0FFFFFFFFh
call	sub_1007C26
mov	dword_1014F98, eax
call	sub_1007C26
push	ebp
push	55h
mov	dword_1014FA0, eax
call	sub_1007C4C
mov	ecx, dword_1014FA0
push	ebp
push	64h
mov	[ecx], eax
call	sub_1007C4C
mov	ecx, dword_1014FA0
push	6
mov	[ecx+4], eax
call	sub_10081CC
push	2
mov	dword_1014F94, eax
call	sub_10081CC
push	ebx
mov	dword_1014F90, eax
call	sub_10081CC
push	1
mov	dword_1014F84, eax
call	sub_10081CC
push	0FFFFFFFFh
mov	dword_1014F88, eax
call	sub_10081CC
mov	dword_1014F8C, eax
mov	eax, dword_1014F98
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014F98
mov	[eax], ebx
mov	eax, dword_1014F64
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014F98
mov	[ecx], eax
mov	esi, dword_1014F64
mov	ecx, [esi+4]
mov	eax, dword_1014F98
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, dword_1014F98
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014F98
mov	[eax+4], ebx
mov	eax, dword_1014F68
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014F98
mov	[ecx+4], eax
mov	esi, dword_1014F68
mov	ecx, [esi+4]
mov	eax, dword_1014F98
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
push	0Ah
rep movsb
call	sub_10081CC
push	dword_1014FA4	; hMem
mov	dword_1014F9C, eax
mov	eax, dword_1014F40
add	dword_1014F5C, eax
call	sub_1007BD1
mov	dword_1014FA4, ebx
call	sub_1007C26
mov	dword_1014FA4, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014FA4
mov	[eax], ebx
mov	eax, dword_1014F98
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014FA4
mov	[ecx], eax
mov	eax, dword_1014F98
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, dword_1014FA4
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, dword_1014FA4
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014FA4
mov	[eax+4], ebx
mov	eax, dword_1014F98
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014FA4
mov	[ecx+4], eax
mov	eax, dword_1014F98
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, dword_1014FA4
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	esi, offset dword_1014FA4
push	esi
call	sub_100F73F
push	dword_1014F94
push	esi
call	sub_100BBD4
push	dword_1014FAC	; hMem
call	sub_1007BD1
mov	dword_1014FAC, ebx
call	sub_1007C26
mov	dword_1014FAC, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014FAC
mov	[eax], ebx
mov	eax, dword_1014FA4
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014FAC
mov	[ecx], eax
mov	eax, dword_1014FA4
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, dword_1014FAC
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, dword_1014FAC
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014FAC
mov	[eax+4], ebx
mov	eax, dword_1014FA4
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014FAC
mov	[ecx+4], eax
mov	eax, dword_1014FA4
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, dword_1014FAC
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
push	dword_1014FA8	; hMem
call	sub_1007BD1
mov	dword_1014FA8, ebx
call	sub_1007C26
mov	dword_1014FA8, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014FA8
mov	[eax], ebx
mov	eax, dword_1014FA4
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014FA8
mov	[ecx], eax
mov	eax, dword_1014FA4
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, dword_1014FA8
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, dword_1014FA8
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014FA8
mov	[eax+4], ebx
mov	eax, dword_1014FA4
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014FA8
mov	[ecx+4], eax
mov	eax, dword_1014FA4
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, dword_1014FA8
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
push	dword_1014FB0	; hMem
call	sub_1007BD1
mov	dword_1014FB0, ebx
call	sub_1007C26
mov	dword_1014FB0, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014FB0
mov	[eax], ebx
mov	eax, dword_1014FA4
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014FB0
mov	[ecx], eax
mov	eax, dword_1014FA4
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, dword_1014FB0
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, dword_1014FB0
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014FB0
mov	[eax+4], ebx
mov	eax, dword_1014FA4
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014FB0
mov	[ecx+4], eax
mov	eax, dword_1014FA4
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, dword_1014FB0
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
push	dword_1014FA4
push	offset dword_1014FAC
call	sub_100BC54
push	dword_1014F90
push	offset dword_1014FA8
call	sub_100BD6F
push	dword_1014FA8
push	offset dword_1014FB0
call	sub_100BC54
push	dword_1014FB4	; hMem
call	sub_1007BD1
mov	dword_1014FB4, ebx
call	sub_1007C26
mov	dword_1014FB4, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014FB4
mov	[eax], ebx
mov	eax, dword_1014F98
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014FB4
mov	[ecx], eax
mov	eax, dword_1014F98
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, dword_1014FB4
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, dword_1014FB4
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014FB4
mov	[eax+4], ebx
mov	eax, dword_1014F98
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014FB4
mov	[ecx+4], eax
mov	eax, dword_1014F98
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, dword_1014FB4
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
push	offset dword_1014FB4
rep movsb
call	sub_100D73B
push	dword_1014FB8	; hMem
call	sub_1007BD1
mov	dword_1014FB8, ebx
call	sub_1007C26
mov	dword_1014FB8, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014FB8
mov	[eax], ebx
mov	eax, dword_1014F88
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014FB8
mov	[ecx], eax
mov	eax, dword_1014F88
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, dword_1014FB8
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, dword_1014FB8
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014FB8
mov	[eax+4], ebx
mov	eax, dword_1014F88
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014FB8
mov	[ecx+4], eax
mov	eax, dword_1014F88
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, dword_1014FB8
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
push	offset dword_1014FB8
rep movsb
call	sub_100D73B
push	dword_1014F7C	; hMem
call	sub_1007BD1
mov	dword_1014F7C, ebx
call	sub_1007C26
mov	dword_1014F7C, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014F7C
mov	[eax], ebx
mov	eax, dword_1014F9C
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014F7C
mov	[ecx], eax
mov	eax, dword_1014F9C
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, dword_1014F7C
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, dword_1014F7C
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014F7C
mov	[eax+4], ebx
mov	eax, dword_1014F9C
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014F7C
mov	[ecx+4], eax
mov	eax, dword_1014F9C
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, dword_1014F7C
lea	ecx, ds:0Ch[ecx*4]
mov	edi, [eax+4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
push	offset dword_1014F7C
rep movsb
call	sub_100DFEF
push	dword_1014F80	; hMem
call	sub_1007BD1
mov	dword_1014F80, ebx
call	sub_1007C26
mov	dword_1014F80, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014F80
mov	[eax], ebx
mov	eax, dword_1014F90
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014F80
mov	[ecx], eax
mov	eax, dword_1014F90
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, dword_1014F80
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, dword_1014F80
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014F80
mov	[eax+4], ebx
mov	eax, dword_1014F90
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014F80
mov	[ecx+4], eax
mov	eax, dword_1014F90
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, dword_1014F80
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
push	offset dword_1014F80
rep movsb
call	sub_100DFEF
push	dword_1014FBC	; hMem
call	sub_1007BD1
push	0B4h
mov	dword_1014FBC, ebx
call	sub_10081CC
push	dword_1014FA4
mov	dword_1014FBC, eax
push	offset dword_1014FBC
call	sub_100BD6F
push	dword_1014FC0	; hMem
call	sub_1007BD1
push	0C8h
mov	dword_1014FC0, ebx
call	sub_10081CC
push	dword_1014FA4
mov	dword_1014FC0, eax
push	offset dword_1014FC0
call	sub_100BD6F
mov	eax, dword_1014F40
sub	dword_1014F5C, eax
push	dword_1014FC4	; hMem
call	sub_1007BD1
mov	dword_1014FC4, ebx
call	sub_1007C26
mov	dword_1014FC4, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014FC4
mov	[eax], ebx
mov	eax, dword_1014F90
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014FC4
mov	[ecx], eax
mov	eax, dword_1014F90
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, dword_1014FC4
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, dword_1014FC4
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014FC4
mov	[eax+4], ebx
mov	eax, dword_1014F90
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014FC4
mov	[ecx+4], eax
mov	eax, dword_1014F90
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, dword_1014FC4
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
push	ebp
and	ecx, 3
push	40h
rep movsb
push	dword_1014FC4
call	sub_1007D22
push	dword_1014F88
push	offset dword_1014FC4
call	sub_100BE29
push	dword_1014FC8	; hMem
call	sub_1007BD1
mov	dword_1014FC8, ebx
call	sub_1007C26
mov	dword_1014FC8, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014FC8
mov	[eax], ebx
mov	eax, dword_1014F90
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014FC8
mov	[ecx], eax
mov	eax, dword_1014F90
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, dword_1014FC8
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, dword_1014FC8
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014FC8
mov	[eax+4], ebx
mov	eax, dword_1014F90
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014FC8
mov	[ecx+4], eax
mov	eax, dword_1014F90
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, dword_1014FC8
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
push	ebp
and	ecx, 3
push	20h
rep movsb
push	dword_1014FC8
call	sub_1007D22
push	dword_1014F88
push	offset dword_1014FC8
call	sub_100BE29
push	dword_1014FF8	; hMem
call	sub_1007BD1
mov	dword_1014FF8, ebx
call	sub_1007C26
mov	dword_1014FF8, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014FF8
mov	[eax], ebx
mov	eax, dword_1014FC8
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014FF8
mov	[ecx], eax
mov	eax, dword_1014FC8
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, dword_1014FF8
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
push	3
mov	ecx, eax
pop	ebp
and	ecx, ebp
rep movsb
mov	eax, dword_1014FF8
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014FF8
mov	[eax+4], ebx
mov	eax, dword_1014FC8
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014FF8
mov	[ecx+4], eax
mov	eax, dword_1014FC8
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, dword_1014FF8
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, ebp
rep movsb
mov	eax, dword_1014FF8
mov	eax, [eax]
neg	dword ptr [eax]
push	0FFFFh
call	sub_10081CC
push	0FFh
mov	dword_1014FCC, eax
call	sub_10081CC
push	190h
mov	dword_1014FD0, eax
call	sub_10081CC
push	168h
mov	dword_1014FD8, eax
call	sub_10081CC
push	0C8h
mov	dword_1014FD4, eax
call	sub_10081CC
push	0B4h
mov	dword_1014FE0, eax
call	sub_10081CC
push	186A0h
mov	dword_1014FDC, eax
call	sub_10081CC
push	dword_1014FF4	; hMem
mov	dword_1014FF0, eax
call	sub_1007BD1
mov	dword_1014FF4, ebx
call	sub_1007C26
mov	dword_1014FF4, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014FF4
mov	[eax], ebx
mov	eax, dword_1014FF0
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014FF4
mov	[ecx], eax
mov	eax, dword_1014FF0
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, dword_1014FF4
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, ebp
rep movsb
mov	eax, dword_1014FF4
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014FF4
mov	[eax+4], ebx
mov	eax, dword_1014FF0
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014FF4
mov	[ecx+4], eax
mov	eax, dword_1014FF0
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, dword_1014FF4
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, ebp
rep movsb
mov	eax, dword_1014FF4
mov	eax, [eax]
neg	dword ptr [eax]
mov	eax, dword_1014F40
imul	eax, [esp+10h+arg_0]
imul	eax, [esp+10h+arg_4]
mov	dword_10143DC, eax
jmp	loc_100BB81

loc_100B9EA:
call	sub_10095E4
push	dword_1014FE8	; hMem
call	sub_1007BD1
mov	dword_1014FE8, ebx
call	sub_1007C26
mov	dword_1014FE8, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014FE8
mov	[eax], ebx
mov	eax, dword_1014FE4
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014FE8
mov	[ecx], eax
mov	eax, dword_1014FE4
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, dword_1014FE8
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
push	3
mov	ecx, eax
pop	ebp
and	ecx, ebp
rep movsb
mov	eax, dword_1014FE8
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014FE8
mov	[eax+4], ebx
mov	eax, dword_1014FE4
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014FE8
mov	[ecx+4], eax
mov	eax, dword_1014FE4
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, dword_1014FE8
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
mov	eax, [esp+10h+arg_4]
neg	eax
push	eax
and	ecx, ebp
push	offset dword_1014FE8
rep movsb
call	sub_10086C8
push	dword_1014FEC	; hMem
call	sub_1007BD1
mov	dword_1014FEC, ebx
call	sub_1007C26
mov	dword_1014FEC, eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, dword_1014FEC
mov	[eax], ebx
mov	eax, dword_1014FE8
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014FEC
mov	[ecx], eax
mov	eax, dword_1014FE8
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, dword_1014FEC
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, ebp
rep movsb
mov	eax, dword_1014FEC
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, dword_1014FEC
mov	[eax+4], ebx
mov	eax, dword_1014FE8
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, dword_1014FEC
mov	[ecx+4], eax
mov	eax, dword_1014FE8
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, dword_1014FEC
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, ebp
rep movsb
mov	eax, dword_1014FEC
mov	eax, [eax]
or	dword ptr [eax], 0FFFFFFFFh

loc_100BB81:
pop	edi
pop	esi
pop	ebp
pop	ebx
retn	8
sub_100ABDD endp




sub_100BB88 proc near

arg_0= dword ptr  4

push	esi
mov	esi, [esp+4+arg_0]
mov	eax, [esi]
push	80000000h
push	dword ptr [eax+4]
push	eax
call	sub_1011B2D
mov	eax, [esi]
mov	ecx, [eax]
mov	ecx, [ecx+8]
test	ecx, ecx
jge	short loc_100BBB6
mov	eax, [eax+4]
sub	[eax+8], ecx
mov	eax, [esi]
mov	eax, [eax]
and	dword ptr [eax+8], 0

loc_100BBB6:
mov	eax, [esi]
mov	ecx, [eax+4]
mov	ecx, [ecx+8]
test	ecx, ecx
jge	short loc_100BBD0
mov	eax, [eax]
sub	[eax+8], ecx
mov	eax, [esi]
mov	eax, [eax+4]
and	dword ptr [eax+8], 0

loc_100BBD0:
pop	esi
retn	4
sub_100BB88 endp




sub_100BBD4 proc near

arg_0= dword ptr  4
arg_4= dword ptr  8

push	esi
push	edi
mov	edi, [esp+8+arg_0]
mov	eax, [edi]
push	dword ptr [eax]
call	sub_1011A18
test	eax, eax
jnz	short loc_100BC0A
mov	esi, [esp+8+arg_4]
push	dword ptr [esi]
push	dword ptr [edi]
call	sub_1012314
mov	eax, [edi]
push	dword ptr [esi+4]
add	eax, 4
push	eax
call	sub_1012314
push	edi
call	sub_100AB09
jmp	short loc_100BC4F

loc_100BC0A:
mov	eax, [edi]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [edi]
and	dword ptr [eax+4], 0
mov	eax, dword_1014F64
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [edi]
mov	[ecx+4], eax
mov	esi, dword_1014F64
mov	ecx, [esi+4]
mov	eax, [edi]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb

loc_100BC4F:
pop	edi
pop	esi
retn	8
sub_100BBD4 endp



; Attributes: bp-based frame

sub_100BC54 proc near

var_4= dword ptr -4
arg_0= dword ptr  8
arg_4= dword ptr  0Ch

push	ebp
mov	ebp, esp
push	ecx
and	[ebp+var_4], 0
push	ebx
mov	ebx, [ebp+arg_0]
mov	eax, [ebx]
push	esi
mov	esi, [ebp+arg_4]
push	dword ptr [esi+4]
push	dword ptr [eax+4]
call	sub_1011913
test	eax, eax
jz	short loc_100BCB1
mov	eax, [ebx]
mov	ecx, [eax]
mov	eax, [eax+4]
mov	eax, [eax]
imul	eax, [ecx]
mov	[ecx], eax
mov	eax, [ebx]
mov	eax, [eax+4]
xor	ecx, ecx
inc	ecx
mov	[eax], ecx
mov	edx, [esi+4]
mov	eax, [esi]
mov	edx, [edx]
imul	edx, [eax]
mov	[eax], edx
mov	eax, [esi+4]
push	80000000h
mov	[eax], ecx
push	dword ptr [esi]
push	dword ptr [ebx]
call	sub_1011A3C
jmp	loc_100BD5B

loc_100BCB1:
push	edi
push	[ebp+var_4]
call	sub_1007BC1
and	[ebp+var_4], 0
mov	eax, [ebx]
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebx]
mov	[ebp+var_4], eax
mov	esi, [ecx+4]
mov	ecx, [esi+4]
lea	ecx, ds:0Ch[ecx*4]
mov	edi, eax
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	esi, [ebp+arg_4]
push	dword ptr [esi+4]
lea	eax, [ebp+var_4]
push	eax
call	sub_1012314
push	dword ptr [esi+4]
push	dword ptr [ebx]
call	sub_1012314
mov	eax, [ebx]
push	dword ptr [esi]
add	eax, 4
push	eax
call	sub_1012314
mov	eax, [ebx]
push	80000000h
push	dword ptr [eax+4]
push	eax
call	sub_1011A3C
mov	eax, [ebx]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebx]
and	dword ptr [eax+4], 0
mov	eax, [ebx]
mov	ecx, [ebp+var_4]
push	ebx
mov	[eax+4], ecx
call	sub_100AB09
mov	eax, [ebx]
mov	ecx, [eax]
mov	eax, [eax+4]
mov	eax, [eax]
imul	eax, [ecx]
mov	[ecx], eax
mov	eax, [ebx]
mov	eax, [eax+4]
mov	dword ptr [eax], 1
pop	edi

loc_100BD5B:
pop	esi
pop	ebx
leave
retn	8
sub_100BC54 endp




sub_100BD61 proc near

arg_0= dword ptr  4

mov	eax, [esp+arg_0]
push	dword ptr [eax]
call	sub_1011A18
retn	4
sub_100BD61 endp



; Attributes: bp-based frame

sub_100BD6F proc near

arg_0= dword ptr  8
arg_4= dword ptr  0Ch

push	ebp
mov	ebp, esp
push	esi
push	edi
mov	edi, [ebp+arg_0]
mov	eax, [edi]
push	dword ptr [eax]
call	sub_1011A18
test	eax, eax
jnz	short loc_100BDBD
mov	esi, [ebp+arg_4]
push	dword ptr [esi+4]
push	dword ptr [edi]
call	sub_1012314
mov	eax, [edi]
push	dword ptr [esi]
add	eax, 4
push	eax
call	sub_1012314
mov	eax, [edi]
push	dword ptr [eax+4]
call	sub_1011A18
test	eax, eax
jz	short loc_100BDB5
mov	[ebp+arg_4], 80000000h
jmp	short loc_100BDD0

loc_100BDB5:
push	edi
call	sub_100AB09
jmp	short loc_100BE23

loc_100BDBD:
push	[ebp+arg_4]
call	sub_100BD61
test	eax, eax
jz	short loc_100BDDE
mov	[ebp+arg_4], 80000002h

loc_100BDD0:
push	offset dword_1012A34
lea	eax, [ebp+arg_4]
push	eax
call	_CxxThrowException

loc_100BDDE:
mov	eax, [edi]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [edi]
and	dword ptr [eax+4], 0
mov	eax, dword_1014F64
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [edi]
mov	[ecx+4], eax
mov	esi, dword_1014F64
mov	ecx, [esi+4]
mov	eax, [edi]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb

loc_100BE23:
pop	edi
pop	esi
pop	ebp
retn	8
sub_100BD6F endp




sub_100BE29 proc near

arg_0= dword ptr  4
arg_4= dword ptr  8

push	esi
mov	esi, [esp+4+arg_4]
mov	eax, [esi]
neg	dword ptr [eax]
push	esi
push	[esp+8+arg_0]
call	sub_100BC54
mov	eax, [esi]
neg	dword ptr [eax]
pop	esi
retn	8
sub_100BE29 endp



; Attributes: bp-based frame

sub_100BE44 proc near

hMem= dword ptr	-4
arg_0= dword ptr  8
arg_4= dword ptr  0Ch

push	ebp
mov	ebp, esp
push	ecx
push	ebx
push	esi
push	edi
xor	ebx, ebx
push	ebx		; hMem
mov	[ebp+hMem], ebx
call	sub_1007BD1
mov	[ebp+hMem], ebx
call	sub_1007C26
mov	[ebp+hMem], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+hMem]
mov	[eax], ebx
mov	eax, dword_1014F88
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx], eax
mov	eax, dword_1014F88
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+hMem]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+hMem]
mov	[eax+4], ebx
mov	eax, dword_1014F88
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx+4], eax
mov	eax, dword_1014F88
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax+4]
push	[ebp+arg_4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
lea	eax, [ebp+hMem]
and	ecx, 3
push	eax
rep movsb
call	sub_100BD6F
push	[ebp+hMem]
push	[ebp+arg_0]
call	sub_100E2F5
push	[ebp+hMem]	; hMem
call	sub_1007BD1
pop	edi
pop	esi
pop	ebx
leave
retn	8
sub_100BE44 endp



; Attributes: bp-based frame

sub_100BF18 proc near

hMem= dword ptr	-4
arg_0= dword ptr  8
arg_4= dword ptr  0Ch

push	ebp
mov	ebp, esp
push	ecx
and	[ebp+hMem], 0
push	esi
mov	esi, [ebp+arg_0]
push	esi
call	sub_1008A54
mov	eax, [esi]
push	dword ptr [eax]
call	sub_1011A18
test	eax, eax
jnz	loc_100C035
push	dword_1014FF0
push	[ebp+arg_4]
call	sub_1008D44
test	eax, eax
jz	short loc_100BF62
push	offset dword_1012A34
lea	eax, [ebp+arg_4]
push	eax
mov	[ebp+arg_4], 80000001h
call	_CxxThrowException

loc_100BF62:
push	edi
push	[ebp+arg_4]
call	sub_10081F8
push	[ebp+hMem]	; hMem
mov	[ebp+arg_4], eax
call	sub_1007BD1
and	[ebp+hMem], 0
call	sub_1007C26
mov	[ebp+hMem], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+hMem]
and	dword ptr [eax], 0
mov	eax, dword_1014F90
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx], eax
mov	eax, dword_1014F90
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+hMem]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+hMem]
and	dword ptr [eax+4], 0
mov	eax, dword_1014F90
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx+4], eax
mov	eax, dword_1014F90
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax+4]
push	[ebp+arg_4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
lea	eax, [ebp+hMem]
and	ecx, 3
push	eax
rep movsb
call	sub_10086C8
push	[ebp+hMem]
push	[ebp+arg_0]
call	sub_100BBD4
push	[ebp+hMem]	; hMem
call	sub_1007BD1
pop	edi

loc_100C035:
pop	esi
leave
retn	8
sub_100BF18 endp



; Attributes: bp-based frame

sub_100C03A proc near

hMem= dword ptr	-4
arg_0= dword ptr  8
arg_4= dword ptr  0Ch

push	ebp
mov	ebp, esp
push	ecx
and	[ebp+hMem], 0
push	esi
mov	esi, [ebp+arg_0]
push	esi
call	sub_1008A54
mov	eax, [esi]
push	dword ptr [eax]
call	sub_1011A18
test	eax, eax
jnz	loc_100C157
push	dword_1014FF4
push	[ebp+arg_4]
call	sub_1008F17
test	eax, eax
jz	short loc_100C084
push	offset dword_1012A34
lea	eax, [ebp+arg_4]
push	eax
mov	[ebp+arg_4], 80000001h
call	_CxxThrowException

loc_100C084:
push	edi
push	[ebp+arg_4]
call	sub_10081F8
push	[ebp+hMem]	; hMem
mov	[ebp+arg_4], eax
call	sub_1007BD1
and	[ebp+hMem], 0
call	sub_1007C26
mov	[ebp+hMem], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+hMem]
and	dword ptr [eax], 0
mov	eax, dword_1014F90
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx], eax
mov	eax, dword_1014F90
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+hMem]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+hMem]
and	dword ptr [eax+4], 0
mov	eax, dword_1014F90
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx+4], eax
mov	eax, dword_1014F90
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax+4]
push	[ebp+arg_4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
lea	eax, [ebp+hMem]
and	ecx, 3
push	eax
rep movsb
call	sub_10086C8
push	[ebp+hMem]
push	[ebp+arg_0]
call	sub_100BD6F
push	[ebp+hMem]	; hMem
call	sub_1007BD1
pop	edi

loc_100C157:
pop	esi
leave
retn	8
sub_100C03A endp



; Attributes: bp-based frame

sub_100C15C proc near

var_10=	dword ptr -10h
var_C= dword ptr -0Ch
var_8= dword ptr -8
var_4= dword ptr -4
arg_0= dword ptr  8
arg_4= dword ptr  0Ch
arg_8= dword ptr  10h

push	ebp
mov	ebp, esp
sub	esp, 10h
mov	eax, [ebp+arg_0]
push	ebx
mov	ebx, [ebp+arg_4]
mov	edx, [ebx+8]
push	esi
mov	esi, [ebx+4]
push	edi
mov	edi, [eax]
mov	ecx, [edi+8]
mov	eax, [edi+4]
add	eax, ecx
add	esi, edx
cmp	eax, esi
jg	short loc_100C183
mov	eax, esi

loc_100C183:
cmp	ecx, edx
jl	short loc_100C189
mov	ecx, edx

loc_100C189:
sub	eax, ecx
push	eax
mov	[ebp+arg_4], eax
call	sub_1007BFB
mov	ecx, [ebx+8]
mov	esi, eax
mov	eax, [edi+8]
cmp	eax, ecx
jl	short loc_100C1A2
mov	eax, ecx

loc_100C1A2:
lea	ecx, [edi+0Ch]
mov	[ebp+var_C], ecx
mov	[esi+8], eax
mov	[ebp+var_8], eax
mov	eax, [ebp+arg_4]
test	eax, eax
lea	ecx, [ebx+0Ch]
mov	[ebp+var_10], ecx
mov	[esi+4], eax
lea	ecx, [esi+0Ch]
jle	short loc_100C23C

loc_100C1C1:
mov	eax, [edi+8]
cmp	[ebp+var_8], eax
jl	short loc_100C1E7
sub	eax, [esi+8]
mov	edx, [esi+4]
add	eax, [ebp+arg_4]
sub	edx, [edi+4]
cmp	eax, edx
jle	short loc_100C1E7
mov	eax, [ebp+var_C]
mov	eax, [eax]
add	[ebp+var_C], 4
mov	[ebp+var_4], eax
jmp	short loc_100C1EB

loc_100C1E7:
and	[ebp+var_4], 0

loc_100C1EB:
mov	eax, [ebx+8]
cmp	[ebp+var_8], eax
jl	short loc_100C20E
sub	eax, [esi+8]
mov	edx, [esi+4]
add	eax, [ebp+arg_4]
sub	edx, [ebx+4]
cmp	eax, edx
jle	short loc_100C20E
mov	eax, [ebp+var_10]
mov	eax, [eax]
add	[ebp+var_10], 4
jmp	short loc_100C210

loc_100C20E:
xor	eax, eax

loc_100C210:
mov	edx, [ebp+arg_8]
sub	edx, 0
jz	short loc_100C228
dec	edx
jz	short loc_100C223
dec	edx
jnz	short loc_100C230
xor	eax, [ebp+var_4]
jmp	short loc_100C22B

loc_100C223:
or	eax, [ebp+var_4]
jmp	short loc_100C22B

loc_100C228:
and	eax, [ebp+var_4]

loc_100C22B:
mov	[ecx], eax
add	ecx, 4

loc_100C230:
dec	[ebp+arg_4]
inc	[ebp+var_8]
cmp	[ebp+arg_4], 0
jg	short loc_100C1C1

loc_100C23C:
mov	eax, [edi]
mov	[esi], eax
jmp	short loc_100C24D

loc_100C242:
sub	ecx, 4
cmp	dword ptr [ecx], 0
jnz	short loc_100C253
dec	dword ptr [esi+4]

loc_100C24D:
cmp	dword ptr [esi+4], 1
jg	short loc_100C242

loc_100C253:
mov	edi, [ebp+arg_0]
push	dword ptr [edi]
call	sub_1007BC1
mov	[edi], esi
pop	edi
pop	esi
pop	ebx
leave
retn	0Ch
sub_100C15C endp



; Attributes: bp-based frame

sub_100C266 proc near

arg_0= dword ptr  8
arg_4= dword ptr  0Ch

push	ebp
mov	ebp, esp
push	ebx
push	esi
mov	esi, [ebp+arg_4]
push	edi
push	esi
call	sub_100BD61
test	eax, eax
jz	short loc_100C28E
push	offset dword_1012A34
lea	eax, [ebp+arg_4]
push	eax
mov	[ebp+arg_4], 80000002h
call	_CxxThrowException

loc_100C28E:		; hMem
push	0
call	sub_1007BD1
call	sub_1007C26
mov	ebx, eax
push	dword ptr [ebx]
call	sub_1007BC1
and	dword ptr [ebx], 0
mov	eax, [esi]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	[ebx], eax
mov	esi, [esi]
mov	ecx, [esi+4]
lea	ecx, ds:0Ch[ecx*4]
mov	edi, eax
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
push	dword ptr [ebx+4]
call	sub_1007BC1
and	dword ptr [ebx+4], 0
mov	esi, [ebp+arg_4]
mov	eax, [esi+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	[ebx+4], eax
mov	esi, [esi+4]
mov	ecx, [esi+4]
lea	ecx, ds:0Ch[ecx*4]
mov	edi, eax
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
push	dword ptr [ebx+4]
mov	esi, [ebp+arg_0]
push	dword ptr [esi]
call	sub_1012314
mov	eax, [esi]
push	dword ptr [eax+4]
push	ebx
call	sub_1012314
push	80000000h
push	dword ptr [ebx]
push	dword ptr [esi]
call	sub_1011B2D
mov	eax, [esi]
push	dword ptr [ebx+4]
add	eax, 4
push	eax
call	sub_1012314
mov	eax, [esi]
mov	ecx, [eax]
mov	ecx, [ecx+8]
test	ecx, ecx
jge	short loc_100C355
mov	eax, [eax+4]
sub	[eax+8], ecx
mov	eax, [esi]
mov	eax, [eax]
and	dword ptr [eax+8], 0

loc_100C355:
mov	eax, [esi]
mov	ecx, [eax+4]
mov	ecx, [ecx+8]
test	ecx, ecx
jge	short loc_100C36F
mov	eax, [eax]
sub	[eax+8], ecx
mov	eax, [esi]
mov	eax, [eax+4]
and	dword ptr [eax+8], 0

loc_100C36F:		; hMem
push	ebx
call	sub_1007BD1
pop	edi
pop	esi
pop	ebx
pop	ebp
retn	8
sub_100C266 endp



; Attributes: bp-based frame

sub_100C37C proc near

hMem= dword ptr	-4
arg_0= dword ptr  8
arg_4= dword ptr  0Ch
arg_8= dword ptr  10h

push	ebp
mov	ebp, esp
push	ecx
push	ebx
push	esi
push	edi
push	[ebp+arg_0]
xor	esi, esi
mov	[ebp+hMem], esi
call	sub_1008A54
push	[ebp+hMem]	; hMem
call	sub_1007BD1
mov	[ebp+hMem], esi
call	sub_1007C26
mov	[ebp+hMem], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+hMem]
mov	ebx, [ebp+arg_4]
mov	[eax], esi
mov	eax, [ebx]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx], eax
mov	esi, [ebx]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+hMem]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+hMem]
and	dword ptr [eax+4], 0
mov	eax, [ebx+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx+4], eax
mov	ebx, [ebx+4]
mov	ecx, [ebx+4]
mov	eax, [ebp+hMem]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
mov	esi, ebx
rep movsd
mov	ecx, eax
lea	eax, [ebp+hMem]
and	ecx, 3
push	eax
rep movsb
call	sub_1008A54
push	[ebp+arg_8]
mov	eax, [ebp+hMem]
push	dword ptr [eax]
mov	eax, [ebp+arg_0]
push	dword ptr [eax]
call	sub_100C15C
push	[ebp+hMem]	; hMem
call	sub_1007BD1
pop	edi
pop	esi
pop	ebx
leave
retn	0Ch
sub_100C37C endp




sub_100C450 proc near

arg_0= dword ptr  4
arg_4= dword ptr  8

push	0
push	[esp+4+arg_4]
push	[esp+8+arg_0]
call	sub_100C37C
retn	8
sub_100C450 endp




sub_100C462 proc near

arg_0= dword ptr  4
arg_4= dword ptr  8

push	1
push	[esp+4+arg_4]
push	[esp+8+arg_0]
call	sub_100C37C
retn	8
sub_100C462 endp




sub_100C474 proc near

arg_0= dword ptr  4
arg_4= dword ptr  8

push	2
push	[esp+4+arg_4]
push	[esp+8+arg_0]
call	sub_100C37C
retn	8
sub_100C474 endp



; Attributes: bp-based frame

sub_100C486 proc near

var_34=	dword ptr -34h
var_30=	dword ptr -30h
var_2C=	dword ptr -2Ch
var_28=	dword ptr -28h
var_24=	dword ptr -24h
var_20=	dword ptr -20h
var_1C=	dword ptr -1Ch
var_18=	dword ptr -18h
var_14=	dword ptr -14h
var_10=	dword ptr -10h
var_C= dword ptr -0Ch
var_8= dword ptr -8
hMem= dword ptr	-4
arg_0= dword ptr  8

push	ebp
mov	ebp, esp
sub	esp, 34h
mov	eax, dword_1014F5C
push	ebx
xor	ebx, ebx
push	esi
push	edi
push	eax
mov	[ebp+var_14], ebx
mov	[ebp+var_24], ebx
mov	[ebp+hMem], ebx
mov	[ebp+var_28], ebx
mov	[ebp+var_C], ebx
mov	[ebp+var_1C], ebx
mov	[ebp+var_8], ebx
mov	[ebp+var_10], ebx
mov	[ebp+var_18], ebx
mov	[ebp+var_20], ebx
mov	[ebp+var_34], eax
call	sub_10081CC
push	dword_1014010
mov	[ebp+var_30], eax
call	sub_10081CC
mov	[ebp+var_C], eax
lea	eax, [ebp+var_C]
push	eax
call	sub_100DFEF
push	[ebp+var_30]
lea	eax, [ebp+var_C]
push	eax
call	sub_100BBD4
push	dword_1014F90
lea	eax, [ebp+var_C]
push	eax
call	sub_100BC54
push	[ebp+hMem]	; hMem
call	sub_1007BD1
mov	[ebp+hMem], ebx
call	sub_1007C26
mov	[ebp+hMem], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+hMem]
mov	[eax], ebx
mov	eax, [ebp+var_C]
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx], eax
mov	eax, [ebp+var_C]
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+hMem]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+hMem]
mov	[eax+4], ebx
mov	eax, [ebp+var_C]
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx+4], eax
mov	eax, [ebp+var_C]
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
lea	eax, [ebp+hMem]
and	ecx, 3
push	eax
rep movsb
call	sub_100DFEF
mov	esi, [ebp+arg_0]
push	dword ptr [esi]
lea	eax, [ebp+hMem]
push	eax
call	sub_100BBD4
push	[ebp+hMem]
lea	eax, [ebp+var_C]
push	eax
call	sub_100BC54
push	dword_1014F88
lea	eax, [ebp+var_C]
push	eax
call	sub_100BC54
push	[ebp+hMem]	; hMem
call	sub_1007BD1
mov	[ebp+hMem], ebx
call	sub_1007C26
mov	[ebp+hMem], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+hMem]
mov	[eax], ebx
mov	eax, [esi]
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx], eax
mov	eax, [esi]
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+hMem]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+hMem]
mov	esi, [ebp+arg_0]
mov	[eax+4], ebx
mov	eax, [esi]
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx+4], eax
mov	eax, [esi]
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
push	3
rep movsb
call	sub_10081CC
push	dword_1014F90
mov	[ebp+var_28], eax
lea	eax, [ebp+var_28]
push	eax
call	sub_100BD6F
push	[ebp+var_28]
lea	eax, [ebp+hMem]
push	eax
call	sub_100BC54
push	[ebp+var_8]	; hMem
call	sub_1007BD1
mov	[ebp+var_8], ebx
call	sub_1007C26
mov	[ebp+var_8], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+var_8]
mov	[eax], ebx
mov	eax, [ebp+var_C]
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+var_8]
mov	[ecx], eax
mov	eax, [ebp+var_C]
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+var_8]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+var_8]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+var_8]
mov	[eax+4], ebx
mov	eax, [ebp+var_C]
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+var_8]
mov	[ecx+4], eax
mov	eax, [ebp+var_C]
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+var_8]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
push	[ebp+hMem]
lea	eax, [ebp+var_8]
push	eax
call	sub_100E2F5
push	[ebp+hMem]	; hMem
call	sub_1007BD1
mov	[ebp+hMem], ebx
call	sub_1007C26
mov	[ebp+hMem], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+hMem]
mov	[eax], ebx
mov	eax, [ebp+var_C]
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx], eax
mov	eax, [ebp+var_C]
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+hMem]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+hMem]
mov	[eax+4], ebx
mov	eax, [ebp+var_C]
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx+4], eax
mov	eax, [ebp+var_C]
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
lea	eax, [ebp+hMem]
and	ecx, 3
push	eax
rep movsb
call	sub_100D9B6
push	[ebp+hMem]
lea	eax, [ebp+var_8]
push	eax
call	sub_100BBD4
lea	eax, [ebp+var_8]
push	eax
call	sub_100DFEF
push	dword_1014010
call	sub_10081CC
push	[ebp+hMem]	; hMem
mov	esi, eax
mov	[ebp+var_2C], esi
call	sub_1007BD1
mov	[ebp+hMem], ebx
call	sub_1007C26
mov	[ebp+hMem], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+hMem]
mov	[eax], ebx
mov	eax, [esi]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx], eax
mov	esi, [esi]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+hMem]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+hMem]
mov	esi, [ebp+var_2C]
mov	[eax+4], ebx
mov	eax, [esi+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx+4], eax
mov	esi, [esi+4]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
lea	eax, [ebp+hMem]
and	ecx, 3
push	eax
rep movsb
call	sub_100DFEF
push	[ebp+hMem]
lea	eax, [ebp+var_8]
push	eax
call	sub_100BE29
push	[ebp+var_8]
call	sub_10081F8
push	[ebp+var_14]	; hMem
add	dword_1014F5C, eax
call	sub_1007BD1
mov	[ebp+var_14], ebx
call	sub_1007C26
mov	[ebp+var_14], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+var_14]
mov	[eax], ebx
mov	eax, dword_1014F88
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+var_14]
mov	[ecx], eax
mov	eax, dword_1014F88
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+var_14]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+var_14]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+var_14]
mov	[eax+4], ebx
mov	eax, dword_1014F88
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+var_14]
mov	[ecx+4], eax
mov	eax, dword_1014F88
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+var_14]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
push	80000000h
and	ecx, 3
push	ebx
rep movsb
call	sub_1007C4C
push	[ebp+var_20]	; hMem
mov	[ebp+var_24], eax
call	sub_1007BD1
mov	[ebp+var_20], ebx
call	sub_1007C26
mov	[ebp+var_20], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+var_20]
mov	[eax], ebx
mov	eax, [ebp+var_C]
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+var_20]
mov	[ecx], eax
mov	eax, [ebp+var_C]
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+var_20]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+var_20]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+var_20]
mov	[eax+4], ebx
mov	eax, [ebp+var_C]
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+var_20]
mov	[ecx+4], eax
mov	eax, [ebp+var_C]
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+var_20]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
mov	eax, [ebp+arg_0]
and	ecx, 3
rep movsb
push	dword ptr [eax]
lea	eax, [ebp+var_20]
push	eax
call	sub_100E2F5
push	[ebp+var_1C]	; hMem
call	sub_1007BD1
mov	[ebp+var_1C], ebx
call	sub_1007C26
mov	[ebp+var_1C], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+var_1C]
mov	[eax], ebx
mov	eax, [ebp+var_C]
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+var_1C]
mov	[ecx], eax
mov	eax, [ebp+var_C]
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+var_1C]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+var_1C]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+var_1C]
mov	[eax+4], ebx
mov	eax, [ebp+var_C]
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+var_1C]
mov	[ecx+4], eax
mov	eax, [ebp+var_C]
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+var_1C]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
push	[ebp+var_C]
lea	eax, [ebp+var_1C]
push	eax
call	sub_100BBD4
push	[ebp+var_10]	; hMem
call	sub_1007BD1
mov	[ebp+var_10], ebx
call	sub_1007C26
mov	[ebp+var_10], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+var_10]
mov	[eax], ebx
mov	eax, dword_1014F88
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+var_10]
mov	[ecx], eax
mov	eax, dword_1014F88
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+var_10]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+var_10]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+var_10]
mov	[eax+4], ebx
mov	eax, dword_1014F88
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+var_10]
mov	[ecx+4], eax
mov	eax, dword_1014F88
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+var_10]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	esi, [ebp+arg_0]
push	dword ptr [esi]
lea	eax, [ebp+var_10]
push	eax
call	sub_100BD6F
push	[ebp+hMem]	; hMem
call	sub_1007BD1
mov	[ebp+hMem], ebx
call	sub_1007C26
mov	[ebp+hMem], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+hMem]
mov	[eax], ebx
mov	eax, [esi]
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx], eax
mov	eax, [esi]
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+hMem]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+hMem]
mov	esi, [ebp+arg_0]
mov	[eax+4], ebx
mov	eax, [esi]
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx+4], eax
mov	eax, [esi]
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
push	dword_1014F88
lea	eax, [ebp+hMem]
push	eax
call	sub_100BC54
push	[ebp+var_8]	; hMem
call	sub_1007BD1
mov	[ebp+var_8], ebx
call	sub_1007C26
mov	[ebp+var_8], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+var_8]
mov	[eax], ebx
mov	eax, [ebp+var_C]
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+var_8]
mov	[ecx], eax
mov	eax, [ebp+var_C]
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+var_8]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+var_8]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+var_8]
mov	[eax+4], ebx
mov	eax, [ebp+var_C]
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+var_8]
mov	[ecx+4], eax
mov	eax, [ebp+var_C]
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+var_8]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
push	[ebp+hMem]
lea	eax, [ebp+var_8]
push	eax
call	sub_100BD6F
push	[ebp+var_8]
lea	eax, [ebp+var_10]
push	eax
call	sub_100BE29
push	[ebp+var_18]	; hMem
call	sub_1007BD1
mov	[ebp+var_18], ebx
call	sub_1007C26
mov	[ebp+var_18], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+var_18]
mov	esi, [ebp+var_2C]
mov	[eax], ebx
mov	eax, [esi]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+var_18]
mov	[ecx], eax
mov	esi, [esi]
mov	ecx, [esi+4]
mov	eax, [ebp+var_18]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+var_18]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+var_18]
mov	esi, [ebp+var_2C]
mov	[eax+4], ebx
mov	eax, [esi+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+var_18]
mov	[ecx+4], eax
mov	esi, [esi+4]
mov	ecx, [esi+4]
mov	eax, [ebp+var_18]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	ecx, [ebp+var_30]
mov	eax, [ecx]
neg	dword ptr [eax]
push	ecx
lea	eax, [ebp+var_18]
push	eax
call	sub_100E2F5
push	[ebp+var_2C]
lea	eax, [ebp+var_18]
push	eax
call	sub_100BD6F
push	[ebp+var_8]	; hMem
call	sub_1007BD1
mov	[ebp+var_8], ebx
call	sub_1007C26
mov	[ebp+var_8], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+var_8]
mov	[eax], ebx
mov	eax, dword_1014F90
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+var_8]
mov	[ecx], eax
mov	eax, dword_1014F90
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+var_8]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+var_8]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+var_8]
mov	[eax+4], ebx
mov	eax, dword_1014F90
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+var_8]
mov	[ecx+4], eax
mov	eax, dword_1014F90
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+var_8]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
jmp	loc_100D1A1

loc_100CE18:
push	[ebp+var_18]
push	[ebp+var_8]
call	sub_1008D44
test	eax, eax
jz	loc_100D1B1
cmp	dword_1014F58, ebx
jnz	loc_100D1B1
push	dword_1014F90
mov	esi, [ebp+arg_0]
push	esi
call	sub_100BC54
mov	ecx, [ebp+var_24]
mov	eax, [ecx+0Ch]
mov	edi, 7FFFFFFFh
cmp	eax, edi
jnb	short loc_100CE5B
inc	eax
mov	[ecx+0Ch], eax
jmp	short loc_100CE6F

loc_100CE5B:
push	80000000h
push	dword_1014F64
lea	eax, [ebp+var_24]
push	eax
call	sub_1011A3C

loc_100CE6F:
push	[ebp+var_24]
push	[ebp+var_14]
call	sub_1012314
mov	ecx, [ebp+var_24]
mov	eax, [ecx+0Ch]
cmp	eax, edi
jnb	short loc_100CE8A
inc	eax
mov	[ecx+0Ch], eax
jmp	short loc_100CE9E

loc_100CE8A:
push	80000000h
push	dword_1014F64
lea	eax, [ebp+var_24]
push	eax
call	sub_1011A3C

loc_100CE9E:
push	[ebp+var_24]
push	[ebp+var_14]
call	sub_1012314
push	[ebp+var_1C]
lea	eax, [ebp+var_14]
push	eax
call	sub_100BD6F
push	[ebp+hMem]	; hMem
call	sub_1007BD1
mov	[ebp+hMem], ebx
call	sub_1007C26
mov	[ebp+hMem], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+hMem]
mov	[eax], ebx
mov	eax, [esi]
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx], eax
mov	eax, [esi]
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+hMem]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+hMem]
mov	esi, [ebp+arg_0]
mov	[eax+4], ebx
mov	eax, [esi]
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx+4], eax
mov	eax, [esi]
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
push	dword_1014F88
lea	eax, [ebp+hMem]
push	eax
call	sub_100BC54
push	[ebp+var_8]	; hMem
call	sub_1007BD1
mov	[ebp+var_8], ebx
call	sub_1007C26
mov	[ebp+var_8], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+var_8]
mov	[eax], ebx
mov	eax, [ebp+var_24]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+var_8]
mov	[ecx], eax
mov	esi, [ebp+var_24]
mov	ecx, [esi+4]
mov	eax, [ebp+var_8]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+var_8]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+var_8]
mov	[eax+4], ebx
mov	eax, dword_1014F64
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+var_8]
mov	[ecx+4], eax
mov	esi, dword_1014F64
mov	ecx, [esi+4]
mov	eax, [ebp+var_8]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
push	dword_1014F88
lea	eax, [ebp+var_8]
push	eax
call	sub_100BC54
push	[ebp+hMem]
lea	eax, [ebp+var_8]
push	eax
call	sub_100BBD4
push	[ebp+hMem]	; hMem
call	sub_1007BD1
mov	[ebp+hMem], ebx
call	sub_1007C26
mov	[ebp+hMem], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+hMem]
mov	[eax], ebx
mov	eax, [ebp+var_C]
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx], eax
mov	eax, [ebp+var_C]
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+hMem]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+hMem]
mov	[eax+4], ebx
mov	eax, [ebp+var_C]
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx+4], eax
mov	eax, [ebp+var_C]
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
push	[ebp+var_8]
lea	eax, [ebp+hMem]
push	eax
call	sub_100BD6F
push	[ebp+var_8]	; hMem
call	sub_1007BD1
mov	[ebp+var_8], ebx
call	sub_1007C26
mov	[ebp+var_8], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+var_8]
mov	[eax], ebx
mov	eax, dword_1014F88
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+var_8]
mov	[ecx], eax
mov	eax, dword_1014F88
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+var_8]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+var_8]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+var_8]
mov	[eax+4], ebx
mov	eax, dword_1014F88
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+var_8]
mov	[ecx+4], eax
mov	eax, dword_1014F88
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+var_8]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
mov	eax, [ebp+arg_0]
and	ecx, 3
rep movsb
push	dword ptr [eax]
lea	eax, [ebp+var_8]
push	eax
call	sub_100BD6F
push	[ebp+hMem]
lea	eax, [ebp+var_8]
push	eax
call	sub_100BE29
push	[ebp+var_14]
lea	eax, [ebp+var_8]
push	eax
call	sub_100BD6F
push	[ebp+var_8]
lea	eax, [ebp+var_10]
push	eax
call	sub_100BC54
mov	eax, [ebp+var_8]
mov	ecx, [eax]
xor	eax, eax
inc	eax
mov	[ecx], eax
mov	ecx, [ebp+var_8]
mov	ecx, [ecx+4]
mov	[ecx], eax

loc_100D1A1:
push	[ebp+var_8]
call	sub_100BD61
test	eax, eax
jz	loc_100CE18

loc_100D1B1:
push	[ebp+var_20]
lea	eax, [ebp+var_10]
push	eax
call	sub_100BBD4
mov	eax, [ebp+var_34]
push	[ebp+var_30]	; hMem
mov	dword_1014F5C, eax
call	sub_1007BD1
push	[ebp+var_18]	; hMem
call	sub_1007BD1
push	[ebp+var_8]	; hMem
mov	[ebp+var_18], ebx
call	sub_1007BD1
push	[ebp+var_C]	; hMem
mov	[ebp+var_8], ebx
call	sub_1007BD1
push	[ebp+var_1C]	; hMem
mov	[ebp+var_C], ebx
call	sub_1007BD1
push	[ebp+hMem]	; hMem
mov	[ebp+var_1C], ebx
call	sub_1007BD1
push	[ebp+var_28]	; hMem
mov	[ebp+hMem], ebx
call	sub_1007BD1
push	[ebp+var_24]
mov	[ebp+var_28], ebx
call	sub_1007BC1
push	[ebp+var_14]	; hMem
mov	[ebp+var_24], ebx
call	sub_1007BD1
mov	edi, [ebp+arg_0]
push	dword ptr [edi]	; hMem
mov	[ebp+var_14], ebx
call	sub_1007BD1
push	ebx		; hMem
mov	[edi], ebx
call	sub_1007BD1
mov	[edi], ebx
call	sub_1007C26
mov	[edi], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [edi]
mov	[eax], ebx
mov	eax, [ebp+var_10]
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [edi]
mov	[ecx], eax
mov	eax, [ebp+var_10]
mov	esi, [eax]
mov	eax, [edi]
mov	ecx, [esi+4]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	edi, [ebp+arg_0]
mov	eax, [edi]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [edi]
mov	[eax+4], ebx
mov	eax, [ebp+var_10]
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [edi]
mov	[ecx+4], eax
mov	eax, [ebp+var_10]
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [edi]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
push	[ebp+var_10]	; hMem
call	sub_1007BD1
pop	edi
pop	esi
pop	ebx
leave
retn	4
sub_100C486 endp



; Attributes: bp-based frame

sub_100D2D4 proc near

var_C= dword ptr -0Ch
hMem= dword ptr	-8
var_4= dword ptr -4
arg_0= dword ptr  8

push	ebp
mov	ebp, esp
sub	esp, 0Ch
push	ebx
push	esi
xor	ebx, ebx
push	edi
push	ebx		; hMem
mov	[ebp+var_4], ebx
mov	[ebp+hMem], ebx
call	sub_1007BD1
mov	[ebp+var_4], ebx
call	sub_1007C26
mov	[ebp+var_4], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+var_4]
mov	[eax], ebx
mov	eax, dword_1014F88
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+var_4]
mov	[ecx], eax
mov	eax, dword_1014F88
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+var_4]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+var_4]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+var_4]
mov	[eax+4], ebx
mov	eax, dword_1014F88
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+var_4]
mov	[ecx+4], eax
mov	eax, dword_1014F88
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+var_4]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
push	ebx		; hMem
rep movsb
call	sub_1007BD1
call	sub_1007C26
mov	ebx, eax
push	dword ptr [ebx]
mov	[ebp+var_C], ebx
call	sub_1007BC1
and	dword ptr [ebx], 0
mov	eax, dword_1014F88
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	[ebx], eax
mov	ecx, dword_1014F88
mov	esi, [ecx]
mov	ecx, [esi+4]
lea	ecx, ds:0Ch[ecx*4]
mov	edi, eax
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
push	dword ptr [ebx+4]
call	sub_1007BC1
and	dword ptr [ebx+4], 0
mov	eax, dword_1014F88
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	[ebx+4], eax
mov	ecx, dword_1014F88
mov	esi, [ecx+4]
mov	ecx, [esi+4]
lea	ecx, ds:0Ch[ecx*4]
mov	edi, eax
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	ebx, [ebx]
neg	dword ptr [ebx]
push	[ebp+hMem]	; hMem
call	sub_1007BD1
and	[ebp+hMem], 0
call	sub_1007C26
mov	[ebp+hMem], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+hMem]
and	dword ptr [eax], 0
mov	ebx, [ebp+arg_0]
mov	eax, [ebx]
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx], eax
mov	eax, [ebx]
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+hMem]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+hMem]
and	dword ptr [eax+4], 0
mov	eax, [ebx]
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx+4], eax
mov	eax, [ebx]
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
lea	eax, [ebp+hMem]
and	ecx, 3
push	eax
rep movsb
call	sub_100BB88
push	[ebp+hMem]
call	sub_100BD61
test	eax, eax
jnz	short loc_100D4F3
mov	ecx, [ebp+hMem]
mov	eax, [ecx+4]
mov	ecx, [ecx]
mov	edx, [ecx+8]
sub	edx, [eax+8]
sub	edx, [eax+4]
mov	eax, dword_1014F5C
add	edx, [ecx+4]
neg	eax
imul	edx, dword_1014F40
cmp	edx, eax
jg	short loc_100D55F

loc_100D4F3:
mov	eax, [ebx]
mov	ecx, [eax+4]
mov	eax, [eax]
mov	ecx, [ecx]
imul	ecx, [eax]
cmp	ecx, 0FFFFFFFFh
jnz	short loc_100D55F
push	offset dword_1012A34
lea	eax, [ebp+arg_0]
push	eax
mov	[ebp+arg_0], 80000001h
call	_CxxThrowException

loc_100D519:
cmp	dword_1014F58, 0
jnz	short loc_100D570
mov	ecx, [ebx]
mov	edx, [ecx]
mov	eax, [ecx+4]
mov	esi, [edx+8]
sub	esi, [eax+8]
sub	esi, [eax+4]
mov	eax, dword_1014F5C
add	esi, [edx+4]
mov	edx, eax
imul	esi, dword_1014F40
neg	edx
cmp	esi, edx
jle	short loc_100D575
push	ecx
lea	eax, [ebp+var_4]
push	eax
call	sub_100BBD4
push	dword_1014F88
push	ebx
call	sub_100BE29

loc_100D55F:
push	dword_1014F84
push	dword ptr [ebx]
call	sub_1008D44
test	eax, eax
jnz	short loc_100D519

loc_100D570:
mov	eax, dword_1014F5C

loc_100D575:
mov	ecx, [ebx]
mov	esi, [ecx]
mov	edx, [ecx+4]
mov	edi, [esi+8]
sub	edi, [edx+8]
neg	eax
sub	edi, [edx+4]
add	edi, [esi+4]
imul	edi, dword_1014F40
cmp	edi, eax
jg	loc_100D660
push	ecx		; hMem
call	sub_1007BD1
and	dword ptr [ebx], 0
call	sub_1007C26
mov	[ebx], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebx]
and	dword ptr [eax], 0
mov	eax, dword_1014F84
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebx]
mov	[ecx], eax
mov	eax, dword_1014F84
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebx]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebx]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebx]
and	dword ptr [eax+4], 0
mov	eax, dword_1014F84
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebx]
mov	[ecx+4], eax
mov	eax, dword_1014F84
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebx]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
lea	eax, [ebp+var_4]
and	ecx, 3
push	eax
rep movsb
call	sub_1008A54
jmp	short loc_100D660

loc_100D640:
cmp	dword_1014F58, 0
jnz	short loc_100D66E
push	dword_1014F88
push	ebx
call	sub_100BC54
push	dword ptr [ebx]
lea	eax, [ebp+var_4]
push	eax
call	sub_100BD6F

loc_100D660:
push	[ebp+var_C]
push	dword ptr [ebx]
call	sub_1008F17
test	eax, eax
jnz	short loc_100D640

loc_100D66E:
push	dword_1014F84
push	dword ptr [ebx]
call	sub_1009002
test	eax, eax
jz	short loc_100D69F
push	dword_1014F88
push	ebx
call	sub_100BC54
push	ebx
call	sub_100C486
push	[ebp+var_4]
push	ebx
call	sub_100BBD4
jmp	loc_100D734

loc_100D69F:		; hMem
push	dword ptr [ebx]
call	sub_1007BD1
and	dword ptr [ebx], 0
call	sub_1007C26
mov	[ebx], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebx]
and	dword ptr [eax], 0
mov	eax, [ebp+var_4]
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebx]
mov	[ecx], eax
mov	eax, [ebp+var_4]
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebx]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebx]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebx]
and	dword ptr [eax+4], 0
mov	eax, [ebp+var_4]
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebx]
mov	[ecx+4], eax
mov	eax, [ebp+var_4]
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebx]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb

loc_100D734:
pop	edi
pop	esi
pop	ebx
leave
retn	4
sub_100D2D4 endp



; Attributes: bp-based frame

sub_100D73B proc near

var_10=	dword ptr -10h
var_C= dword ptr -0Ch
var_8= dword ptr -8
hMem= dword ptr	-4
arg_0= dword ptr  8

push	ebp
mov	ebp, esp
sub	esp, 10h
push	ebx
push	esi
xor	esi, esi
push	edi
push	esi		; hMem
mov	[ebp+var_8], esi
mov	[ebp+var_10], esi
mov	[ebp+var_C], esi
mov	[ebp+hMem], esi
call	sub_1007BD1
mov	[ebp+var_8], esi
call	sub_1007C26
mov	[ebp+var_8], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+var_8]
mov	ebx, [ebp+arg_0]
mov	[eax], esi
mov	eax, [ebx]
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+var_8]
mov	[ecx], eax
mov	eax, [ebx]
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+var_8]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+var_8]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+var_8]
and	dword ptr [eax+4], 0
mov	eax, [ebx]
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+var_8]
mov	[ecx+4], eax
mov	eax, [ebx]
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+var_8]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
push	dword ptr [ebx]
lea	eax, [ebp+var_8]
push	eax
call	sub_100BBD4
call	sub_1007C26
mov	ebx, 80000000h
push	ebx
xor	esi, esi
push	esi
mov	[ebp+var_C], eax
call	sub_1007C4C
mov	ecx, [ebp+var_C]
push	ebx
push	esi
mov	[ecx], eax
call	sub_1007C4C
mov	ecx, [ebp+var_C]
push	ebx
mov	[ecx+4], eax
push	dword_1014F64
push	[ebp+var_C]
call	sub_1011A3C
mov	eax, [ebp+var_C]
push	ebx
push	dword_1014F64
add	eax, 4
push	eax
call	sub_1011A3C
push	[ebp+hMem]	; hMem
call	sub_1007BD1
mov	[ebp+hMem], esi
call	sub_1007C26
mov	[ebp+hMem], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+hMem]
mov	[eax], esi
mov	eax, [ebp+var_C]
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx], eax
mov	eax, [ebp+var_C]
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+hMem]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+hMem]
and	dword ptr [eax+4], 0
mov	eax, [ebp+var_C]
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx+4], eax
mov	eax, [ebp+var_C]
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
push	ebx
xor	edi, edi
push	edi
call	sub_1007C4C
mov	[ebp+var_10], eax

loc_100D8EA:
mov	esi, [ebp+arg_0]
push	dword ptr [esi]
lea	eax, [ebp+hMem]
push	eax
call	sub_100BBD4
mov	ecx, [ebp+var_10]
mov	eax, [ecx+0Ch]
cmp	eax, 7FFFFFFFh
jnb	short loc_100D90B
inc	eax
mov	[ecx+0Ch], eax
jmp	short loc_100D91B

loc_100D90B:
push	ebx
push	dword_1014F64
lea	eax, [ebp+var_10]
push	eax
call	sub_1011A3C

loc_100D91B:
mov	eax, [ebp+hMem]
push	[ebp+var_10]
add	eax, 4
push	eax
call	sub_1012314
push	[ebp+hMem]
lea	eax, [ebp+var_C]
push	eax
call	sub_100BC54
mov	eax, [ebp+hMem]
push	dword ptr [eax]
call	sub_1011A18
test	eax, eax
jnz	short loc_100D977
mov	ecx, [ebp+hMem]
mov	eax, [ecx+4]
mov	edx, [eax+8]
mov	ecx, [ecx]
sub	edx, [ecx+8]
mov	eax, [eax+4]
sub	edx, [ecx+4]
lea	eax, [edx+eax-1]
imul	eax, dword_1014F40
cmp	eax, dword_1014F5C
jg	short loc_100D977
cmp	dword_1014F58, edi
jz	loc_100D8EA

loc_100D977:
push	[ebp+var_10]
call	sub_1007BC1
push	[ebp+var_8]	; hMem
mov	[ebp+var_10], edi
call	sub_1007BD1
push	[ebp+hMem]	; hMem
mov	[ebp+var_8], edi
call	sub_1007BD1
push	dword ptr [esi]	; hMem
mov	[ebp+hMem], edi
call	sub_1007BD1
lea	eax, [ebp+var_C]
push	eax
mov	[esi], edi
call	sub_100AB09
mov	eax, [ebp+var_C]
pop	edi
mov	[esi], eax
pop	esi
pop	ebx
leave
retn	4
sub_100D73B endp



; Attributes: bp-based frame

sub_100D9B6 proc near

var_8= dword ptr -8
hMem= dword ptr	-4
arg_0= dword ptr  8

push	ebp
mov	ebp, esp
push	ecx
push	ecx
push	ebx
mov	ebx, [ebp+arg_0]
push	esi
push	edi
push	dword_1014FF0
xor	esi, esi
push	dword ptr [ebx]
mov	[ebp+hMem], esi
mov	[ebp+var_8], esi
call	sub_1008D44
test	eax, eax
jnz	loc_100DC42
push	dword_1014FF4
push	dword ptr [ebx]
call	sub_1008F17
test	eax, eax
jnz	loc_100DC42
push	[ebp+hMem]	; hMem
call	sub_1007BD1
mov	[ebp+hMem], esi
call	sub_1007C26
mov	[ebp+hMem], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+hMem]
mov	[eax], esi
mov	eax, dword_1014FB8
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx], eax
mov	eax, dword_1014FB8
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+hMem]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+hMem]
and	dword ptr [eax+4], 0
mov	eax, dword_1014FB8
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx+4], eax
mov	eax, dword_1014FB8
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
push	[ebp+var_8]	; hMem
call	sub_1007BD1
and	[ebp+var_8], 0
call	sub_1007C26
mov	[ebp+var_8], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+var_8]
and	dword ptr [eax], 0
mov	eax, [ebx]
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+var_8]
mov	[ecx], eax
mov	eax, [ebx]
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+var_8]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+var_8]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+var_8]
and	dword ptr [eax+4], 0
mov	eax, [ebx]
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+var_8]
mov	[ecx+4], eax
mov	eax, [ebx]
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+var_8]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
lea	eax, [ebp+var_8]
and	ecx, 3
push	eax
rep movsb
call	sub_1008A54
push	[ebp+var_8]
call	sub_10081F8
push	eax
lea	eax, [ebp+hMem]
push	eax
call	sub_10086C8
push	[ebp+var_8]
push	ebx
call	sub_100BE29
push	dword_1014FEC
push	dword ptr [ebx]
call	sub_1008D44
test	eax, eax
jz	loc_100DC18
push	dword_1014FE8
push	dword ptr [ebx]
call	sub_1008F17
test	eax, eax
jz	loc_100DC18
push	dword ptr [ebx]	; hMem
call	sub_1007BD1
and	dword ptr [ebx], 0
call	sub_1007C26
mov	[ebx], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebx]
and	dword ptr [eax], 0
mov	eax, [ebp+hMem]
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebx]
mov	[ecx], eax
mov	eax, [ebp+hMem]
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebx]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebx]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebx]
and	dword ptr [eax+4], 0
mov	eax, [ebp+hMem]
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebx]
mov	[ecx+4], eax
mov	eax, [ebp+hMem]
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebx]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
jmp	short loc_100DC27

loc_100DC18:
push	ebx
call	sub_100D73B
push	[ebp+hMem]
push	ebx
call	sub_100BBD4

loc_100DC27:		; hMem
push	[ebp+hMem]
call	sub_1007BD1
push	[ebp+var_8]	; hMem
and	[ebp+hMem], 0
call	sub_1007BD1
pop	edi
pop	esi
pop	ebx
leave
retn	4

loc_100DC42:
push	offset dword_1012A34
lea	eax, [ebp+arg_0]
push	eax
mov	[ebp+arg_0], 80000001h
call	_CxxThrowException
sub_100D9B6 endp

align 4


; Attributes: bp-based frame

sub_100DC58 proc near

var_10=	dword ptr -10h
var_C= dword ptr -0Ch
hMem= dword ptr	-8
var_4= dword ptr -4
arg_0= dword ptr  8

push	ebp
mov	ebp, esp
sub	esp, 10h
push	ebx
push	esi
xor	esi, esi
push	edi
push	esi		; hMem
mov	[ebp+var_C], esi
mov	[ebp+var_10], esi
mov	[ebp+hMem], esi
mov	[ebp+var_4], esi
call	sub_1007BD1
mov	[ebp+var_C], esi
call	sub_1007C26
mov	[ebp+var_C], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+var_C]
mov	ebx, [ebp+arg_0]
mov	[eax], esi
mov	eax, [ebx]
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+var_C]
mov	[ecx], eax
mov	eax, [ebx]
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+var_C]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+var_C]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+var_C]
and	dword ptr [eax+4], 0
mov	eax, [ebx]
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+var_C]
mov	[ecx+4], eax
mov	eax, [ebx]
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+var_C]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
push	dword ptr [ebx]
lea	eax, [ebp+var_C]
push	eax
call	sub_100BBD4
call	sub_1007C26
mov	esi, 80000000h
push	esi
xor	edi, edi
push	edi
mov	[ebp+hMem], eax
call	sub_1007C4C
mov	ecx, [ebp+hMem]
push	esi
push	edi
mov	[ecx], eax
call	sub_1007C4C
mov	ecx, [ebp+hMem]
mov	[ecx+4], eax
call	sub_1007C26
mov	[ebp+var_4], eax
mov	eax, [ebx]
mov	eax, [eax+4]
neg	dword ptr [eax]
mov	eax, [ebx]
push	esi
push	dword ptr [eax+4]
push	eax
call	sub_1011A3C
mov	eax, [ebx]
mov	eax, [eax+4]
neg	dword ptr [eax]
push	[ebp+hMem]	; hMem
call	sub_1007BD1
mov	[ebp+hMem], edi
call	sub_1007C26
mov	[ebp+hMem], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+hMem]
mov	[eax], edi
mov	eax, [ebx]
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx], eax
mov	eax, [ebx]
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+hMem]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+hMem]
and	dword ptr [eax+4], 0
mov	eax, [ebx]
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx+4], eax
mov	eax, [ebx]
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
push	[ebp+var_4]	; hMem
call	sub_1007BD1
and	[ebp+var_4], 0
call	sub_1007C26
mov	[ebp+var_4], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+var_4]
and	dword ptr [eax], 0
mov	eax, [ebx]
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+var_4]
mov	[ecx], eax
mov	eax, [ebx]
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+var_4]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+var_4]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+var_4]
and	dword ptr [eax+4], 0
mov	eax, [ebx]
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+var_4]
mov	[ecx+4], eax
mov	eax, [ebx]
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+var_4]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
push	80000000h
and	ecx, 3
push	1
rep movsb
call	sub_1007C4C
mov	[ebp+var_10], eax
mov	eax, [ebx]
mov	eax, [eax]
neg	dword ptr [eax]

loc_100DEA7:
push	dword ptr [ebx]
lea	eax, [ebp+var_4]
push	eax
call	sub_100BBD4
push	[ebp+var_10]
push	[ebp+var_4]
call	sub_1012314
mov	ecx, [ebp+var_10]
mov	eax, [ecx+0Ch]
cmp	eax, 7FFFFFFFh
jnb	short loc_100DED0
inc	eax
mov	[ecx+0Ch], eax
jmp	short loc_100DEE4

loc_100DED0:
push	80000000h
push	dword_1014F64
lea	eax, [ebp+var_10]
push	eax
call	sub_1011A3C

loc_100DEE4:
mov	eax, [ebp+var_4]
push	[ebp+var_10]
add	eax, 4
push	eax
call	sub_1012314
push	[ebp+var_4]
lea	eax, [ebp+hMem]
push	eax
call	sub_100BC54
cmp	byte_1014F60, 0
jnz	short loc_100DF6C
mov	eax, [ebx]
mov	edi, [eax]
mov	eax, dword_1014F5C
cdq
idiv	dword_1014F40
mov	ecx, [edi+4]
mov	esi, ecx
sub	esi, eax
dec	esi
dec	esi
cmp	esi, 1
jle	short loc_100DF4C
sub	ecx, esi
shl	ecx, 2
push	ecx		; Size
lea	eax, [edi+esi*4+0Ch]
push	eax		; Src
add	edi, 0Ch
push	edi		; Dst
call	ds:memmove
mov	eax, [ebx]
mov	eax, [eax]
sub	[eax+4], esi
mov	eax, [ebx]
mov	eax, [eax]
add	esp, 0Ch
add	[eax+8], esi

loc_100DF4C:
mov	ecx, [ebx]
mov	edx, [ecx]
mov	ecx, [ecx+4]
mov	eax, [edx+8]
mov	ecx, [ecx+8]
cmp	eax, ecx
jge	short loc_100DF5F
mov	ecx, eax

loc_100DF5F:
sub	eax, ecx
mov	[edx+8], eax
mov	eax, [ebx]
mov	eax, [eax+4]
sub	[eax+8], ecx

loc_100DF6C:
mov	eax, [ebp+var_4]
push	dword ptr [eax]
call	sub_1011A18
test	eax, eax
jnz	short loc_100DFAE
mov	ecx, [ebp+var_4]
mov	eax, [ecx+4]
mov	edx, [eax+8]
mov	ecx, [ecx]
sub	edx, [ecx+8]
mov	eax, [eax+4]
sub	edx, [ecx+4]
lea	eax, [edx+eax-1]
imul	eax, dword_1014F40
cmp	eax, dword_1014F5C
jg	short loc_100DFAE
cmp	dword_1014F58, 0
jz	loc_100DEA7

loc_100DFAE:
push	[ebp+var_10]
call	sub_1007BC1
push	[ebp+var_C]	; hMem
xor	esi, esi
mov	[ebp+var_10], esi
call	sub_1007BD1
push	[ebp+var_4]	; hMem
mov	[ebp+var_C], esi
call	sub_1007BD1
push	dword ptr [ebx]	; hMem
mov	[ebp+var_4], esi
call	sub_1007BD1
lea	eax, [ebp+hMem]
push	eax
mov	[ebx], esi
call	sub_100AB09
mov	eax, [ebp+hMem]
pop	edi
pop	esi
mov	[ebx], eax
pop	ebx
leave
retn	4
sub_100DC58 endp



; Attributes: bp-based frame

sub_100DFEF proc near

var_8= dword ptr -8
hMem= dword ptr	-4
arg_0= dword ptr  8

push	ebp
mov	ebp, esp
push	ecx
push	ecx
push	ebx
mov	ebx, [ebp+arg_0]
push	edi
push	dword_1014F84
xor	edi, edi
push	dword ptr [ebx]
mov	[ebp+hMem], edi
mov	[ebp+var_8], edi
call	sub_1008E2C
test	eax, eax
jz	short loc_100E027
push	offset dword_1012A34
lea	eax, [ebp+arg_0]
push	eax
mov	[ebp+arg_0], 80000001h
call	_CxxThrowException

loc_100E027:
push	dword_1014F88
push	dword ptr [ebx]
call	sub_1008F17
cmp	eax, edi
mov	[ebp+arg_0], eax
jz	short loc_100E049
mov	eax, [ebx]
mov	edx, [eax+4]
mov	ecx, [eax]
mov	[eax], edx
mov	eax, [ebx]
mov	[eax+4], ecx

loc_100E049:
mov	eax, [ebx]
mov	ecx, [eax+4]
mov	edx, [eax]
mov	eax, [edx+8]
sub	eax, [ecx+4]
push	esi
add	eax, [edx+4]
mov	esi, [ecx+8]
sub	eax, esi
cmp	eax, 1
jle	loc_100E0FF
dec	eax
add	esi, eax
imul	eax, 1Fh
push	eax
mov	[ecx+8], esi
call	sub_10081CC
push	dword_1014F80
mov	[ebp+hMem], eax
lea	eax, [ebp+hMem]
push	eax
call	sub_100BBD4
cmp	byte_1014F60, 0
jnz	loc_100E1A4
mov	eax, [ebx]
mov	edi, [eax]
mov	eax, dword_1014F5C
cdq
idiv	dword_1014F40
mov	ecx, [edi+4]
mov	esi, ecx
sub	esi, eax
dec	esi
dec	esi
cmp	esi, 1
jle	short loc_100E0DA
sub	ecx, esi
shl	ecx, 2
push	ecx		; Size
lea	eax, [edi+esi*4+0Ch]
push	eax		; Src
add	edi, 0Ch
push	edi		; Dst
call	ds:memmove
mov	eax, [ebx]
mov	eax, [eax]
sub	[eax+4], esi
mov	eax, [ebx]
mov	eax, [eax]
add	esp, 0Ch
add	[eax+8], esi

loc_100E0DA:
mov	ecx, [ebx]
mov	edx, [ecx]
mov	ecx, [ecx+4]
mov	eax, [edx+8]
mov	ecx, [ecx+8]
cmp	eax, ecx
jge	short loc_100E0ED
mov	ecx, eax

loc_100E0ED:
sub	eax, ecx
mov	[edx+8], eax
mov	eax, [ebx]
mov	eax, [eax+4]
sub	[eax+8], ecx
jmp	loc_100E1A4

loc_100E0FF:		; hMem
push	[ebp+hMem]
call	sub_1007BD1
mov	[ebp+hMem], edi
call	sub_1007C26
mov	[ebp+hMem], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+hMem]
mov	[eax], edi
mov	eax, dword_1014F84
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx], eax
mov	eax, dword_1014F84
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+hMem]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+hMem]
and	dword ptr [eax+4], 0
mov	eax, dword_1014F84
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx+4], eax
mov	eax, dword_1014F84
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb

loc_100E1A4:		; hMem
push	[ebp+var_8]
call	sub_1007BD1
and	[ebp+var_8], 0
call	sub_1007C26
mov	[ebp+var_8], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+var_8]
and	dword ptr [eax], 0
mov	eax, dword_1014F84
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+var_8]
mov	[ecx], eax
mov	eax, dword_1014F84
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+var_8]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+var_8]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+var_8]
and	dword ptr [eax+4], 0
mov	eax, dword_1014F84
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+var_8]
mov	[ecx+4], eax
mov	eax, dword_1014F84
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+var_8]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
push	dword_1014FB4
push	dword ptr [ebx]
call	sub_1008D44
pop	esi
jmp	short loc_100E28C

loc_100E25B:
cmp	dword_1014F58, 0
jnz	short loc_100E290
push	dword_1014FB4
push	ebx
call	sub_100BD6F
push	dword_1014F88
lea	eax, [ebp+var_8]
push	eax
call	sub_100BC54
push	dword_1014FB4
push	dword ptr [ebx]
call	sub_1008D44

loc_100E28C:
test	eax, eax
jnz	short loc_100E25B

loc_100E290:
push	ebx
call	sub_100DC58
push	dword_1014F90
lea	eax, [ebp+var_8]
push	eax
call	sub_100BD6F
push	[ebp+var_8]
lea	eax, [ebp+hMem]
push	eax
call	sub_100BC54
push	[ebp+hMem]
push	ebx
call	sub_100BC54
push	ebx
call	sub_100AB09
cmp	[ebp+arg_0], 0
jz	short loc_100E2CC
mov	eax, [ebx]
mov	eax, [eax]
neg	dword ptr [eax]

loc_100E2CC:		; hMem
push	[ebp+hMem]
call	sub_1007BD1
pop	edi
pop	ebx
leave
retn	4
sub_100DFEF endp




sub_100E2DA proc near

arg_0= dword ptr  4

push	[esp+arg_0]
call	sub_100DFEF
push	dword_1014F7C
push	[esp+4+arg_0]
call	sub_100BD6F
retn	4
sub_100E2DA endp



; Attributes: bp-based frame

sub_100E2F5 proc near

var_10=	dword ptr -10h
var_C= dword ptr -0Ch
var_8= dword ptr -8
hMem= dword ptr	-4
arg_0= dword ptr  8
arg_4= dword ptr  0Ch

push	ebp
mov	ebp, esp
sub	esp, 10h
push	ebx
mov	ebx, [ebp+arg_0]
mov	eax, [ebx]
push	esi
push	edi
xor	edi, edi
mov	[ebp+hMem], edi
mov	[ebp+var_8], edi
mov	ecx, [eax]
mov	eax, [eax+4]
mov	esi, [eax]
imul	esi, [ecx]
xor	eax, eax
inc	eax
mov	[ecx], eax
mov	ecx, [ebx]
mov	ecx, [ecx+4]
mov	[ecx], eax
push	dword ptr [ebx]
mov	[ebp+var_10], esi
call	sub_100BD61
test	eax, eax
jz	loc_100E400
push	dword_1014F84
push	[ebp+arg_4]
call	sub_1008F17
test	eax, eax
jnz	loc_100E973
push	[ebp+arg_4]
call	sub_100BD61
test	eax, eax
jz	loc_100E9BB
push	dword ptr [ebx]	; hMem
call	sub_1007BD1
mov	[ebx], edi
call	sub_1007C26
mov	[ebx], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebx]
mov	[eax], edi
mov	eax, dword_1014F88
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebx]
mov	[ecx], eax
mov	eax, dword_1014F88
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebx]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebx]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebx]
and	dword ptr [eax+4], 0
mov	eax, dword_1014F88
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebx]
mov	[ecx+4], eax
mov	eax, dword_1014F88
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebx]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	[ebp+var_10], 1
jmp	loc_100E9B8

loc_100E400:		; hMem
push	edi
mov	[ebp+var_C], edi
call	sub_1007BD1
mov	[ebp+var_C], edi
call	sub_1007C26
mov	[ebp+var_C], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+var_C]
mov	[eax], edi
mov	eax, [ebx]
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+var_C]
mov	[ecx], eax
mov	eax, [ebx]
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+var_C]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+var_C]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+var_C]
and	dword ptr [eax+4], 0
mov	eax, [ebx]
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+var_C]
mov	[ecx+4], eax
mov	eax, [ebx]
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+var_C]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
push	dword_1014F88
lea	eax, [ebp+var_C]
push	eax
call	sub_100BE29
push	dword_1014FEC
push	[ebp+var_C]
call	sub_1008D44
test	eax, eax
jz	loc_100E588
push	dword_1014FE8
push	[ebp+var_C]
call	sub_1008F17
test	eax, eax
jz	loc_100E588
cmp	[ebp+var_10], 1
jnz	loc_100E588
push	dword ptr [ebx]	; hMem
call	sub_1007BD1
and	dword ptr [ebx], 0
call	sub_1007C26
mov	[ebx], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebx]
and	dword ptr [eax], 0
mov	eax, dword_1014F88
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebx]
mov	[ecx], eax
mov	eax, dword_1014F88
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebx]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebx]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebx]
and	dword ptr [eax+4], 0
mov	eax, dword_1014F88
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebx]
mov	[ecx+4], eax
mov	eax, dword_1014F88
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebx]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	[ebp+var_10], 1
jmp	loc_100E9B0

loc_100E588:		; hMem
push	[ebp+hMem]
call	sub_1007BD1
and	[ebp+hMem], 0
call	sub_1007C26
mov	[ebp+hMem], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+hMem]
and	dword ptr [eax], 0
mov	esi, [ebp+arg_4]
mov	eax, [esi]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx], eax
mov	esi, [esi]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+hMem]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+hMem]
and	dword ptr [eax+4], 0
mov	esi, [ebp+arg_4]
mov	eax, [esi+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx+4], eax
mov	esi, [esi+4]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
lea	eax, [ebp+hMem]
and	ecx, 3
push	eax
rep movsb
call	sub_100BB88
push	dword_1014FEC
push	[ebp+hMem]
call	sub_1008D44
test	eax, eax
jz	loc_100E827
push	dword_1014FE8
push	[ebp+hMem]
call	sub_1008F17
test	eax, eax
jz	loc_100E827
xor	esi, esi
push	esi		; hMem
mov	[ebp+arg_0], esi
call	sub_1007BD1
mov	[ebp+arg_0], esi
call	sub_1007C26
mov	[ebp+arg_0], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+arg_0]
mov	[eax], esi
mov	esi, [ebp+arg_4]
mov	eax, [esi]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+arg_0]
mov	[ecx], eax
mov	esi, [esi]
mov	ecx, [esi+4]
mov	eax, [ebp+arg_0]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+arg_0]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+arg_0]
and	dword ptr [eax+4], 0
mov	esi, [ebp+arg_4]
mov	eax, [esi+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+arg_0]
mov	[ecx+4], eax
mov	esi, [esi+4]
mov	ecx, [esi+4]
mov	eax, [ebp+arg_0]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
push	[ebp+hMem]
lea	eax, [ebp+arg_0]
push	eax
call	sub_100BE29
push	[ebp+arg_0]
call	sub_10081F8
push	[ebp+var_8]	; hMem
mov	[ebp+arg_4], eax
call	sub_1007BD1
and	[ebp+var_8], 0
call	sub_1007C26
mov	[ebp+var_8], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+var_8]
and	dword ptr [eax], 0
mov	eax, [ebx]
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+var_8]
mov	[ecx], eax
mov	eax, [ebx]
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+var_8]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+var_8]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+var_8]
and	dword ptr [eax+4], 0
mov	eax, [ebx]
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+var_8]
mov	[ecx+4], eax
mov	eax, [ebx]
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+var_8]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
lea	eax, [ebp+var_8]
and	ecx, 3
push	eax
rep movsb
call	sub_100DFEF
push	[ebp+arg_0]
lea	eax, [ebp+var_8]
push	eax
call	sub_100BBD4
push	dword_1014FF0
push	[ebp+var_8]
call	sub_1008D44
test	eax, eax
jnz	short loc_100E80A
push	dword_1014FF4
push	[ebp+var_8]
call	sub_1008F17
test	eax, eax
jnz	short loc_100E80A
push	[ebp+var_8]	; hMem
call	sub_1007BD1
push	[ebp+arg_4]
and	[ebp+var_8], 0
push	ebx
call	sub_10086C8
test	byte ptr [ebp+arg_4], 1
jnz	short loc_100E7FD
mov	[ebp+var_10], 1

loc_100E7FD:		; hMem
push	[ebp+arg_0]
call	sub_1007BD1
jmp	loc_100E9A4

loc_100E80A:		; hMem
push	[ebp+var_8]
call	sub_1007BD1
push	[ebp+arg_0]	; hMem
and	[ebp+var_8], 0
call	sub_1007BD1
and	[ebp+arg_0], 0
jmp	loc_100E973

loc_100E827:
cmp	[ebp+var_10], 0FFFFFFFFh
jnz	loc_100E988
push	dword_1014F8C
push	[ebp+arg_4]
call	sub_1008D44
test	eax, eax
jz	loc_100E967
push	dword_1014F84
push	[ebp+arg_4]
call	sub_1008F17
test	eax, eax
jz	loc_100E967
push	[ebp+hMem]	; hMem
call	sub_1007BD1
and	[ebp+hMem], 0
call	sub_1007C26
mov	[ebp+hMem], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+hMem]
and	dword ptr [eax], 0
mov	eax, dword_1014F88
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx], eax
mov	eax, dword_1014F88
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+hMem]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+hMem]
and	dword ptr [eax+4], 0
mov	eax, dword_1014F88
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx+4], eax
mov	eax, dword_1014F88
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax+4]
push	[ebp+arg_4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
lea	eax, [ebp+hMem]
and	ecx, 3
push	eax
rep movsb
call	sub_100BD6F
mov	eax, [ebp+hMem]
mov	ecx, [eax]
xor	eax, eax
inc	eax
mov	[ecx], eax
mov	ecx, [ebp+hMem]
mov	ecx, [ecx+4]
mov	[ecx], eax
push	dword_1014F90
lea	eax, [ebp+hMem]
push	eax
call	sub_100BD6F
lea	eax, [ebp+hMem]
push	eax
call	sub_100BB88
push	[ebp+hMem]
lea	eax, [ebp+hMem]
push	eax
call	sub_100BC54
push	dword_1014F88
lea	eax, [ebp+hMem]
push	eax
call	sub_100BE29
push	dword_1014F84
push	[ebp+hMem]
call	sub_1008F17
test	eax, eax
jz	short loc_100E98F

loc_100E967:		; hMem
push	[ebp+hMem]
call	sub_1007BD1
and	[ebp+hMem], 0

loc_100E973:
push	offset dword_1012A34
lea	eax, [ebp+arg_4]
push	eax
mov	[ebp+arg_4], 80000001h
call	_CxxThrowException

loc_100E988:
mov	[ebp+var_10], 1

loc_100E98F:
push	ebx
call	sub_100DFEF
push	[ebp+arg_4]
push	ebx
call	sub_100BBD4
push	ebx
call	sub_100D9B6

loc_100E9A4:		; hMem
push	[ebp+hMem]
call	sub_1007BD1
and	[ebp+hMem], 0

loc_100E9B0:		; hMem
push	[ebp+var_C]
call	sub_1007BD1

loc_100E9B8:
mov	esi, [ebp+var_10]

loc_100E9BB:
mov	eax, [ebx]
mov	eax, [eax]
mov	ecx, [eax]
imul	ecx, esi
pop	edi
pop	esi
mov	[eax], ecx
pop	ebx
leave
retn	8
sub_100E2F5 endp



; Attributes: bp-based frame

sub_100E9CD proc near

var_10=	dword ptr -10h
var_C= dword ptr -0Ch
var_8= dword ptr -8
hMem= dword ptr	-4
arg_0= dword ptr  8

push	ebp
mov	ebp, esp
sub	esp, 10h
push	ebx
push	esi
xor	esi, esi
push	edi
push	esi		; hMem
mov	[ebp+var_C], esi
mov	[ebp+var_10], esi
mov	[ebp+hMem], esi
mov	[ebp+var_8], esi
call	sub_1007BD1
mov	[ebp+var_C], esi
call	sub_1007C26
mov	[ebp+var_C], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+var_C]
mov	ebx, [ebp+arg_0]
mov	[eax], esi
mov	eax, [ebx]
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+var_C]
mov	[ecx], eax
mov	eax, [ebx]
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+var_C]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+var_C]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+var_C]
and	dword ptr [eax+4], 0
mov	eax, [ebx]
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+var_C]
mov	[ecx+4], eax
mov	eax, [ebx]
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+var_C]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
push	dword ptr [ebx]
lea	eax, [ebp+var_C]
push	eax
call	sub_100BBD4
call	sub_1007C26
mov	esi, 80000000h
push	esi
xor	edi, edi
push	edi
mov	[ebp+hMem], eax
call	sub_1007C4C
mov	ecx, [ebp+hMem]
push	esi
push	edi
mov	[ecx], eax
call	sub_1007C4C
mov	ecx, [ebp+hMem]
mov	[ecx+4], eax
push	[ebp+hMem]	; hMem
call	sub_1007BD1
mov	[ebp+hMem], edi
call	sub_1007C26
mov	[ebp+hMem], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+hMem]
mov	[eax], edi
mov	eax, [ebx]
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx], eax
mov	eax, [ebx]
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+hMem]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+hMem]
and	dword ptr [eax+4], 0
mov	eax, [ebx]
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx+4], eax
mov	eax, [ebx]
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
push	[ebp+var_8]	; hMem
call	sub_1007BD1
and	[ebp+var_8], 0
call	sub_1007C26
mov	[ebp+var_8], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+var_8]
and	dword ptr [eax], 0
mov	eax, [ebp+hMem]
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+var_8]
mov	[ecx], eax
mov	eax, [ebp+hMem]
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+var_8]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+var_8]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+var_8]
and	dword ptr [eax+4], 0
mov	eax, [ebp+hMem]
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+var_8]
mov	[ecx+4], eax
mov	eax, [ebp+hMem]
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+var_8]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
push	[ebp+var_10]
call	sub_1007BC1
mov	eax, dword_1014F64
and	[ebp+var_10], 0
push	dword ptr [eax+4]
call	sub_1007BFB
mov	esi, dword_1014F64
mov	[ebp+var_10], eax
mov	ecx, [esi+4]
lea	ecx, ds:0Ch[ecx*4]
mov	edi, eax
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	esi, 7FFFFFFFh

loc_100EC2A:
push	[ebp+var_C]
lea	eax, [ebp+var_8]
push	eax
call	sub_100BBD4
mov	ecx, [ebp+var_10]
mov	eax, [ecx+0Ch]
cmp	eax, esi
jnb	short loc_100EC46
inc	eax
mov	[ecx+0Ch], eax
jmp	short loc_100EC5A

loc_100EC46:
push	80000000h
push	dword_1014F64
lea	eax, [ebp+var_10]
push	eax
call	sub_1011A3C

loc_100EC5A:
mov	eax, [ebp+var_8]
push	[ebp+var_10]
add	eax, 4
push	eax
call	sub_1012314
mov	ecx, [ebp+var_10]
mov	eax, [ecx+0Ch]
cmp	eax, esi
jnb	short loc_100EC79
inc	eax
mov	[ecx+0Ch], eax
jmp	short loc_100EC8D

loc_100EC79:
push	80000000h
push	dword_1014F64
lea	eax, [ebp+var_10]
push	eax
call	sub_1011A3C

loc_100EC8D:
mov	eax, [ebp+var_8]
push	[ebp+var_10]
add	eax, 4
push	eax
call	sub_1012314
push	[ebp+var_8]
lea	eax, [ebp+hMem]
push	eax
call	sub_100BC54
mov	eax, [ebp+var_8]
push	dword ptr [eax]
call	sub_1011A18
test	eax, eax
jnz	short loc_100ECEA
mov	ecx, [ebp+var_8]
mov	eax, [ecx+4]
mov	edx, [eax+8]
mov	ecx, [ecx]
sub	edx, [ecx+8]
mov	eax, [eax+4]
sub	edx, [ecx+4]
lea	eax, [edx+eax-1]
imul	eax, dword_1014F40
cmp	eax, dword_1014F5C
jg	short loc_100ECEA
cmp	dword_1014F58, 0
jz	loc_100EC2A

loc_100ECEA:
push	[ebp+var_10]
call	sub_1007BC1
push	[ebp+var_C]	; hMem
xor	esi, esi
mov	[ebp+var_10], esi
call	sub_1007BD1
push	[ebp+var_8]	; hMem
mov	[ebp+var_C], esi
call	sub_1007BD1
push	dword ptr [ebx]	; hMem
mov	[ebp+var_8], esi
call	sub_1007BD1
lea	eax, [ebp+hMem]
push	eax
mov	[ebx], esi
call	sub_100AB09
mov	eax, [ebp+hMem]
pop	edi
pop	esi
mov	[ebx], eax
pop	ebx
leave
retn	4
sub_100E9CD endp



; Attributes: bp-based frame

sub_100ED2B proc near

hMem= dword ptr	-4
arg_0= dword ptr  8

push	ebp
mov	ebp, esp
push	ecx
push	ebx
mov	ebx, [ebp+arg_0]
push	esi
push	dword_1014F88
xor	esi, esi
push	dword ptr [ebx]
mov	[ebp+hMem], esi
call	sub_1008C5C
test	eax, eax
jz	loc_100EE1E
push	edi
push	[ebp+hMem]	; hMem
call	sub_1007BD1
mov	[ebp+hMem], esi
call	sub_1007C26
mov	[ebp+hMem], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+hMem]
mov	[eax], esi
mov	eax, [ebx]
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx], eax
mov	eax, [ebx]
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+hMem]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+hMem]
and	dword ptr [eax+4], 0
mov	eax, [ebx]
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx+4], eax
mov	eax, [ebx]
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
push	ebx
rep movsb
call	sub_100D9B6
mov	eax, [ebp+hMem]
mov	eax, [eax]
neg	dword ptr [eax]
lea	eax, [ebp+hMem]
push	eax
call	sub_100D9B6
push	[ebp+hMem]
push	ebx
call	sub_100BE29
push	dword_1014F90
push	ebx
call	sub_100BD6F
push	[ebp+hMem]	; hMem
call	sub_1007BD1
pop	edi
jmp	short loc_100EE24

loc_100EE1E:
push	ebx
call	sub_100E9CD

loc_100EE24:
pop	esi
pop	ebx
leave
retn	4
sub_100ED2B endp



; Attributes: bp-based frame

sub_100EE2A proc near

var_10=	dword ptr -10h
var_C= dword ptr -0Ch
var_8= dword ptr -8
hMem= dword ptr	-4
arg_0= dword ptr  8

push	ebp
mov	ebp, esp
sub	esp, 10h
push	ebx
push	esi
xor	esi, esi
push	edi
push	esi		; hMem
mov	[ebp+var_8], esi
mov	[ebp+var_10], esi
mov	[ebp+var_C], esi
mov	[ebp+hMem], esi
call	sub_1007BD1
mov	[ebp+var_8], esi
call	sub_1007C26
mov	[ebp+var_8], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+var_8]
mov	ebx, [ebp+arg_0]
mov	[eax], esi
mov	eax, [ebx]
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+var_8]
mov	[ecx], eax
mov	eax, [ebx]
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+var_8]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+var_8]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+var_8]
and	dword ptr [eax+4], 0
mov	eax, [ebx]
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+var_8]
mov	[ecx+4], eax
mov	eax, [ebx]
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+var_8]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
push	dword ptr [ebx]
lea	eax, [ebp+var_8]
push	eax
call	sub_100BBD4
call	sub_1007C26
mov	esi, 80000000h
push	esi
xor	edi, edi
push	edi
mov	[ebp+var_C], eax
call	sub_1007C4C
mov	ecx, [ebp+var_C]
push	esi
push	edi
mov	[ecx], eax
call	sub_1007C4C
mov	ecx, [ebp+var_C]
mov	[ecx+4], eax
push	dword_1014010
push	1
call	sub_1007C4C
mov	ecx, [ebp+var_C]
mov	[ecx], eax
push	dword_1014010
push	1
call	sub_1007C4C
mov	ecx, [ebp+var_C]
mov	[ecx+4], eax
push	[ebp+hMem]	; hMem
call	sub_1007BD1
mov	[ebp+hMem], edi
call	sub_1007C26
mov	[ebp+hMem], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+hMem]
mov	[eax], edi
mov	eax, [ebp+var_C]
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx], eax
mov	eax, [ebp+var_C]
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+hMem]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+hMem]
and	dword ptr [eax+4], 0
mov	eax, [ebp+var_C]
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx+4], eax
mov	eax, [ebp+var_C]
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
push	dword_1014010
xor	edi, edi
push	edi
call	sub_1007C4C
mov	[ebp+var_10], eax
mov	esi, 7FFFFFFFh

loc_100EFE6:
push	[ebp+var_8]
lea	eax, [ebp+hMem]
push	eax
call	sub_100BBD4
mov	ecx, [ebp+var_10]
mov	eax, [ecx+0Ch]
cmp	eax, esi
jnb	short loc_100F002
inc	eax
mov	[ecx+0Ch], eax
jmp	short loc_100F016

loc_100F002:
push	80000000h
push	dword_1014F64
lea	eax, [ebp+var_10]
push	eax
call	sub_1011A3C

loc_100F016:
mov	eax, [ebp+hMem]
push	[ebp+var_10]
add	eax, 4
push	eax
call	sub_1012314
mov	ecx, [ebp+var_10]
mov	eax, [ecx+0Ch]
cmp	eax, esi
jnb	short loc_100F035
inc	eax
mov	[ecx+0Ch], eax
jmp	short loc_100F049

loc_100F035:
push	80000000h
push	dword_1014F64
lea	eax, [ebp+var_10]
push	eax
call	sub_1011A3C

loc_100F049:
mov	eax, [ebp+hMem]
push	[ebp+var_10]
add	eax, 4
push	eax
call	sub_1012314
push	[ebp+hMem]
lea	eax, [ebp+var_C]
push	eax
call	sub_100BC54
mov	eax, [ebp+hMem]
push	dword ptr [eax]
call	sub_1011A18
test	eax, eax
jnz	short loc_100F0A5
mov	ecx, [ebp+hMem]
mov	eax, [ecx+4]
mov	edx, [eax+8]
mov	ecx, [ecx]
sub	edx, [ecx+8]
mov	eax, [eax+4]
sub	edx, [ecx+4]
lea	eax, [edx+eax-1]
imul	eax, dword_1014F40
cmp	eax, dword_1014F5C
jg	short loc_100F0A5
cmp	dword_1014F58, edi
jz	loc_100EFE6

loc_100F0A5:
push	[ebp+var_10]
call	sub_1007BC1
push	[ebp+var_8]	; hMem
mov	[ebp+var_10], edi
call	sub_1007BD1
push	[ebp+hMem]	; hMem
mov	[ebp+var_8], edi
call	sub_1007BD1
push	dword ptr [ebx]	; hMem
mov	[ebp+hMem], edi
call	sub_1007BD1
lea	eax, [ebp+var_C]
push	eax
mov	[ebx], edi
call	sub_100AB09
mov	eax, [ebp+var_C]
pop	edi
pop	esi
mov	[ebx], eax
pop	ebx
leave
retn	4
sub_100EE2A endp



; Attributes: bp-based frame

sub_100F0E4 proc near

hMem= dword ptr	-4
arg_0= dword ptr  8

push	ebp
mov	ebp, esp
push	ecx
push	ebx
mov	ebx, [ebp+arg_0]
mov	eax, [ebx]
push	esi
xor	esi, esi
mov	[ebp+hMem], esi
mov	ecx, [eax]
xor	eax, eax
inc	eax
mov	[ecx], eax
mov	ecx, [ebx]
mov	ecx, [ecx+4]
push	edi
mov	[ecx], eax
push	dword_1014F88
push	dword ptr [ebx]
call	sub_1008C5C
test	eax, eax
jz	loc_100F1EC
push	[ebp+hMem]	; hMem
call	sub_1007BD1
mov	[ebp+hMem], esi
call	sub_1007C26
mov	[ebp+hMem], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+hMem]
mov	[eax], esi
mov	eax, [ebx]
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx], eax
mov	eax, [ebx]
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+hMem]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+hMem]
and	dword ptr [eax+4], 0
mov	eax, [ebx]
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx+4], eax
mov	eax, [ebx]
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
push	ebx
rep movsb
call	sub_100D9B6
mov	eax, [ebp+hMem]
mov	eax, [eax]
neg	dword ptr [eax]
lea	eax, [ebp+hMem]
push	eax
call	sub_100D9B6
push	[ebp+hMem]
push	ebx
call	sub_100BC54
push	dword_1014F90
push	ebx
call	sub_100BD6F
push	[ebp+hMem]	; hMem
call	sub_1007BD1
and	[ebp+hMem], 0
xor	esi, esi
jmp	short loc_100F1F2

loc_100F1EC:
push	ebx
call	sub_100EE2A

loc_100F1F2:
push	dword_1014F88
push	dword ptr [ebx]
call	sub_1008F17
test	eax, eax
jz	loc_100F2A2
push	dword ptr [ebx]	; hMem
call	sub_1007BD1
mov	[ebx], esi
call	sub_1007C26
mov	[ebx], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebx]
mov	[eax], esi
mov	eax, dword_1014F88
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebx]
mov	[ecx], eax
mov	eax, dword_1014F88
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebx]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebx]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebx]
and	dword ptr [eax+4], 0
mov	eax, dword_1014F88
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebx]
mov	[ecx+4], eax
mov	eax, dword_1014F88
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebx]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb

loc_100F2A2:
pop	edi
pop	esi
pop	ebx
leave
retn	4
sub_100F0E4 endp



; Attributes: bp-based frame

sub_100F2A9 proc near

hMem= dword ptr	-4
arg_0= dword ptr  8

push	ebp
mov	ebp, esp
push	ecx
push	ebx
push	esi
push	edi
xor	esi, esi
push	esi		; hMem
mov	[ebp+hMem], esi
call	sub_1007BD1
mov	[ebp+hMem], esi
call	sub_1007C26
mov	[ebp+hMem], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+hMem]
mov	ebx, [ebp+arg_0]
mov	[eax], esi
mov	eax, [ebx]
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx], eax
mov	eax, [ebx]
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+hMem]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+hMem]
and	dword ptr [eax+4], 0
mov	eax, [ebx]
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx+4], eax
mov	eax, [ebx]
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
push	ebx
rep movsb
call	sub_100ED2B
lea	eax, [ebp+hMem]
push	eax
call	sub_100F0E4
mov	eax, [ebp+hMem]
push	dword ptr [eax+4]
push	dword ptr [ebx]
call	sub_1012314
mov	eax, [ebp+hMem]
push	dword ptr [eax]
mov	eax, [ebx]
add	eax, 4
push	eax
call	sub_1012314
push	[ebp+hMem]	; hMem
call	sub_1007BD1
pop	edi
pop	esi
pop	ebx
leave
retn	4
sub_100F2A9 endp



; Attributes: bp-based frame

sub_100F38A proc near

arg_0= dword ptr  8
arg_4= dword ptr  0Ch

push	ebp
mov	ebp, esp
mov	eax, [ebp+arg_4]
sub	eax, 0
jz	short loc_100F3AF
dec	eax
dec	eax
jnz	short loc_100F3CB
push	dword_1014FAC
push	[ebp+arg_0]
call	sub_100BD6F
push	dword_1014FD8
jmp	short loc_100F3C3

loc_100F3AF:
push	dword_1014FAC
push	[ebp+arg_0]
call	sub_100BD6F
push	dword_1014FD4

loc_100F3C3:
push	[ebp+arg_0]
call	sub_100BBD4

loc_100F3CB:
pop	ebp
retn	8
sub_100F38A endp



; Attributes: bp-based frame

sub_100F3CF proc near

var_10=	dword ptr -10h
var_C= dword ptr -0Ch
hMem= dword ptr	-8
var_4= dword ptr -4
arg_0= dword ptr  8

push	ebp
mov	ebp, esp
sub	esp, 10h
push	ebx
push	esi
xor	esi, esi
push	edi
push	esi		; hMem
mov	[ebp+var_10], esi
mov	[ebp+var_C], esi
mov	[ebp+hMem], esi
mov	[ebp+var_4], esi
call	sub_1007BD1
mov	[ebp+var_10], esi
call	sub_1007C26
mov	[ebp+var_10], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+var_10]
mov	ebx, [ebp+arg_0]
mov	[eax], esi
mov	eax, [ebx]
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+var_10]
mov	[ecx], eax
mov	eax, [ebx]
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+var_10]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+var_10]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+var_10]
and	dword ptr [eax+4], 0
mov	eax, [ebx]
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+var_10]
mov	[ecx+4], eax
mov	eax, [ebx]
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+var_10]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
push	dword ptr [ebx]
lea	eax, [ebp+var_10]
push	eax
call	sub_100BBD4
call	sub_1007C26
mov	esi, 80000000h
push	esi
xor	edi, edi
push	edi
mov	[ebp+hMem], eax
call	sub_1007C4C
mov	ecx, [ebp+hMem]
push	esi
push	edi
mov	[ecx], eax
call	sub_1007C4C
mov	ecx, [ebp+hMem]
mov	[ecx+4], eax
push	[ebp+hMem]	; hMem
call	sub_1007BD1
mov	[ebp+hMem], edi
call	sub_1007C26
mov	[ebp+hMem], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+hMem]
mov	[eax], edi
mov	eax, [ebx]
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx], eax
mov	eax, [ebx]
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+hMem]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+hMem]
and	dword ptr [eax+4], 0
mov	eax, [ebx]
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx+4], eax
mov	eax, [ebx]
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
push	[ebp+var_4]	; hMem
call	sub_1007BD1
and	[ebp+var_4], 0
call	sub_1007C26
mov	[ebp+var_4], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+var_4]
and	dword ptr [eax], 0
mov	eax, [ebx]
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+var_4]
mov	[ecx], eax
mov	eax, [ebx]
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+var_4]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+var_4]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+var_4]
and	dword ptr [eax+4], 0
mov	eax, [ebx]
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+var_4]
mov	[ecx+4], eax
mov	eax, [ebx]
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+var_4]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
push	[ebp+var_C]
call	sub_1007BC1
mov	eax, dword_1014F64
and	[ebp+var_C], 0
push	dword ptr [eax+4]
call	sub_1007BFB
mov	esi, dword_1014F64
mov	[ebp+var_C], eax
mov	ecx, [esi+4]
lea	ecx, ds:0Ch[ecx*4]
mov	edi, eax
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	esi, 7FFFFFFFh

loc_100F628:
push	[ebp+var_10]
lea	eax, [ebp+var_4]
push	eax
call	sub_100BBD4
push	[ebp+var_C]
push	[ebp+var_4]
call	sub_1012314
push	[ebp+var_C]
push	[ebp+var_4]
call	sub_1012314
mov	ecx, [ebp+var_C]
mov	eax, [ecx+0Ch]
cmp	eax, esi
jnb	short loc_100F65A
inc	eax
mov	[ecx+0Ch], eax
jmp	short loc_100F66E

loc_100F65A:
push	80000000h
push	dword_1014F64
lea	eax, [ebp+var_C]
push	eax
call	sub_1011A3C

loc_100F66E:
mov	eax, [ebp+var_4]
push	[ebp+var_C]
add	eax, 4
push	eax
call	sub_1012314
mov	ecx, [ebp+var_C]
mov	eax, [ecx+0Ch]
cmp	eax, esi
jnb	short loc_100F68D
inc	eax
mov	[ecx+0Ch], eax
jmp	short loc_100F6A1

loc_100F68D:
push	80000000h
push	dword_1014F64
lea	eax, [ebp+var_C]
push	eax
call	sub_1011A3C

loc_100F6A1:
mov	eax, [ebp+var_4]
push	[ebp+var_C]
add	eax, 4
push	eax
call	sub_1012314
push	[ebp+var_4]
lea	eax, [ebp+hMem]
push	eax
call	sub_100BC54
mov	eax, [ebp+var_4]
push	dword ptr [eax]
call	sub_1011A18
test	eax, eax
jnz	short loc_100F6FE
mov	ecx, [ebp+var_4]
mov	eax, [ecx+4]
mov	edx, [eax+8]
mov	ecx, [ecx]
sub	edx, [ecx+8]
mov	eax, [eax+4]
sub	edx, [ecx+4]
lea	eax, [edx+eax-1]
imul	eax, dword_1014F40
cmp	eax, dword_1014F5C
jg	short loc_100F6FE
cmp	dword_1014F58, 0
jz	loc_100F628

loc_100F6FE:
push	[ebp+var_C]
call	sub_1007BC1
push	[ebp+var_10]	; hMem
xor	esi, esi
mov	[ebp+var_C], esi
call	sub_1007BD1
push	[ebp+var_4]	; hMem
mov	[ebp+var_10], esi
call	sub_1007BD1
push	dword ptr [ebx]	; hMem
mov	[ebp+var_4], esi
call	sub_1007BD1
lea	eax, [ebp+hMem]
push	eax
mov	[ebx], esi
call	sub_100AB09
mov	eax, [ebp+hMem]
pop	edi
pop	esi
mov	[ebx], eax
pop	ebx
leave
retn	4
sub_100F3CF endp



; Attributes: bp-based frame

sub_100F73F proc near

var_8= dword ptr -8
hMem= dword ptr	-4
arg_0= dword ptr  8

push	ebp
mov	ebp, esp
push	ecx
push	ecx
push	ebx
mov	ebx, [ebp+arg_0]
mov	eax, [ebx]
push	esi
xor	esi, esi
mov	[ebp+hMem], esi
mov	ecx, [eax]
mov	eax, [eax+4]
mov	eax, [eax]
imul	eax, [ecx]
mov	[ebp+var_8], eax
xor	eax, eax
inc	eax
mov	[ecx], eax
mov	ecx, [ebx]
mov	ecx, [ecx+4]
push	edi
mov	[ecx], eax
push	[ebp+hMem]	; hMem
call	sub_1007BD1
mov	[ebp+hMem], esi
call	sub_1007C26
mov	[ebp+hMem], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+hMem]
mov	[eax], esi
mov	eax, [ebx]
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx], eax
mov	eax, [ebx]
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+hMem]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+hMem]
and	dword ptr [eax+4], 0
mov	eax, [ebx]
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx+4], eax
mov	eax, [ebx]
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
push	dword_1014F88
lea	eax, [ebp+hMem]
push	eax
call	sub_100BE29
push	dword_1014FE8
push	[ebp+hMem]
call	sub_1008E2C
test	eax, eax
jz	loc_100F8EB
push	dword_1014FEC
push	[ebp+hMem]
call	sub_1008C5C
test	eax, eax
jz	loc_100F8EB
push	[ebp+hMem]	; hMem
call	sub_1007BD1
push	dword ptr [ebx]	; hMem
xor	esi, esi
mov	[ebp+hMem], esi
call	sub_1007BD1
mov	[ebx], esi
call	sub_1007C26
mov	[ebx], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebx]
mov	[eax], esi
mov	eax, dword_1014FA8
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebx]
mov	[ecx], eax
mov	eax, dword_1014FA8
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebx]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebx]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebx]
and	dword ptr [eax+4], 0
mov	eax, dword_1014FA8
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebx]
mov	[ecx+4], eax
mov	eax, dword_1014FA8
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebx]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
jmp	loc_100FAC3

loc_100F8EB:		; hMem
push	[ebp+hMem]
call	sub_1007BD1
push	dword_1014FA0
xor	edi, edi
push	dword ptr [ebx]
mov	[ebp+hMem], edi
call	sub_1008D44
test	eax, eax
jz	loc_100FABD
push	dword_1014F88
push	dword ptr [ebx]
call	sub_1008D44
test	eax, eax
jz	loc_100F9F1
push	dword_1014F88
push	ebx
call	sub_100BE29
push	dword_1014FE8
push	dword ptr [ebx]
call	sub_1008D44
test	eax, eax
jz	short loc_100F954
push	offset dword_1012A34
lea	eax, [ebp+arg_0]
push	eax
mov	[ebp+arg_0], 80000001h
call	_CxxThrowException

loc_100F954:		; hMem
push	dword ptr [ebx]
call	sub_1007BD1
mov	[ebx], edi
call	sub_1007C26
mov	[ebx], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebx]
mov	[eax], edi
mov	eax, dword_1014F88
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebx]
mov	[ecx], eax
mov	eax, dword_1014F88
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebx]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebx]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebx]
and	dword ptr [eax+4], 0
mov	eax, dword_1014F88
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebx]
mov	[ecx+4], eax
mov	eax, dword_1014F88
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebx]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
xor	edi, edi

loc_100F9F1:		; hMem
push	edi
call	sub_1007BD1
call	sub_1007C26
mov	esi, eax
push	dword ptr [esi]
mov	[ebp+arg_0], esi
call	sub_1007BC1
mov	[esi], edi
mov	eax, [ebx]
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	[esi], eax
mov	ecx, [ebx]
mov	esi, [ecx]
mov	ecx, [esi+4]
lea	ecx, ds:0Ch[ecx*4]
mov	edi, eax
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	esi, [ebp+arg_0]
push	dword ptr [esi+4]
call	sub_1007BC1
and	dword ptr [esi+4], 0
mov	eax, [ebx]
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
push	[ebp+arg_0]
mov	[esi+4], eax
mov	ecx, [ebx]
mov	esi, [ecx+4]
mov	ecx, [esi+4]
lea	ecx, ds:0Ch[ecx*4]
mov	edi, eax
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
push	ebx
rep movsb
call	sub_100BBD4
mov	eax, [ebx]
mov	eax, [eax]
neg	dword ptr [eax]
push	dword_1014F88
push	ebx
call	sub_100BC54
push	dword_1014F90
push	ebx
call	sub_100BE44
push	ebx
call	sub_100F3CF
mov	eax, [ebx]
mov	eax, [eax]
neg	dword ptr [eax]
push	dword_1014FA8
push	ebx
call	sub_100BC54
push	[ebp+arg_0]	; hMem
call	sub_1007BD1
jmp	short loc_100FAC3

loc_100FABD:
push	ebx
call	sub_100F3CF

loc_100FAC3:
mov	eax, [ebx]
mov	eax, [eax]
mov	ecx, [ebp+var_8]
mov	[eax], ecx
mov	eax, [ebx]
mov	eax, [eax+4]
pop	edi
pop	esi
mov	dword ptr [eax], 1
pop	ebx
leave
retn	4
sub_100F73F endp




sub_100FADE proc near

arg_0= dword ptr  4

push	ebx
mov	ebx, [esp+4+arg_0]
mov	eax, [ebx]
mov	ecx, [eax]
mov	eax, [eax+4]
push	esi
mov	esi, [eax]
imul	esi, [ecx]
xor	eax, eax
inc	eax
mov	[ecx], eax
mov	ecx, [ebx]
mov	ecx, [ecx+4]
push	edi
mov	[ecx], eax
push	dword_1014F88
push	dword ptr [ebx]
call	sub_1008B8C
test	eax, eax
jz	loc_100FC22
push	dword ptr [ebx]	; hMem
call	sub_1007BD1
and	dword ptr [ebx], 0
call	sub_1007C26
mov	[ebx], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebx]
and	dword ptr [eax], 0
cmp	esi, 0FFFFFFFFh
jnz	loc_100FBBD
mov	eax, dword_1014FA4
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebx]
mov	[ecx], eax
mov	eax, dword_1014FA4
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebx]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebx]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebx]
and	dword ptr [eax+4], 0
mov	eax, dword_1014FA4
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebx]
mov	[ecx+4], eax
mov	eax, dword_1014FA4

loc_100FB98:
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebx]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
jmp	loc_100FC40

loc_100FBBD:
mov	eax, dword_1014F84
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebx]
mov	[ecx], eax
mov	eax, dword_1014F84
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebx]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebx]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebx]
and	dword ptr [eax+4], 0
mov	eax, dword_1014F84
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebx]
mov	[ecx+4], eax
mov	eax, dword_1014F84
jmp	loc_100FB98

loc_100FC22:
mov	eax, [ebx]
mov	eax, [eax]
push	ebx
mov	[eax], esi
call	sub_100F73F
mov	eax, [ebx]
mov	eax, [eax]
neg	dword ptr [eax]
push	dword_1014FA8
push	ebx
call	sub_100BC54

loc_100FC40:
pop	edi
pop	esi
pop	ebx
retn	4
sub_100FADE endp



; Attributes: bp-based frame

sub_100FC46 proc near

var_10=	dword ptr -10h
var_C= dword ptr -0Ch
hMem= dword ptr	-8
var_4= dword ptr -4
arg_0= dword ptr  8

push	ebp
mov	ebp, esp
sub	esp, 10h
push	ebx
push	esi
xor	esi, esi
push	edi
push	esi		; hMem
mov	[ebp+var_C], esi
mov	[ebp+var_10], esi
mov	[ebp+hMem], esi
mov	[ebp+var_4], esi
call	sub_1007BD1
mov	[ebp+var_C], esi
call	sub_1007C26
mov	[ebp+var_C], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+var_C]
mov	ebx, [ebp+arg_0]
mov	[eax], esi
mov	eax, [ebx]
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+var_C]
mov	[ecx], eax
mov	eax, [ebx]
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+var_C]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+var_C]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+var_C]
and	dword ptr [eax+4], 0
mov	eax, [ebx]
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+var_C]
mov	[ecx+4], eax
mov	eax, [ebx]
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+var_C]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
push	dword ptr [ebx]
lea	eax, [ebp+var_C]
push	eax
call	sub_100BBD4
call	sub_1007C26
mov	esi, 80000000h
push	esi
xor	edi, edi
push	edi
mov	[ebp+hMem], eax
call	sub_1007C4C
mov	ecx, [ebp+hMem]
push	esi
push	edi
mov	[ecx], eax
call	sub_1007C4C
mov	ecx, [ebp+hMem]
mov	[ecx+4], eax
push	[ebp+hMem]	; hMem
call	sub_1007BD1
mov	[ebp+hMem], edi
call	sub_1007C26
mov	[ebp+hMem], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+hMem]
mov	[eax], edi
mov	eax, [ebx]
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx], eax
mov	eax, [ebx]
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+hMem]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+hMem]
and	dword ptr [eax+4], 0
mov	eax, [ebx]
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx+4], eax
mov	eax, [ebx]
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
push	[ebp+var_4]	; hMem
call	sub_1007BD1
and	[ebp+var_4], 0
call	sub_1007C26
mov	[ebp+var_4], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+var_4]
and	dword ptr [eax], 0
mov	eax, [ebx]
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+var_4]
mov	[ecx], eax
mov	eax, [ebx]
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+var_4]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+var_4]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+var_4]
and	dword ptr [eax+4], 0
mov	eax, [ebx]
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+var_4]
mov	[ecx+4], eax
mov	eax, [ebx]
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+var_4]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
push	[ebp+var_10]
call	sub_1007BC1
mov	eax, dword_1014F64
and	[ebp+var_10], 0
push	dword ptr [eax+4]
call	sub_1007BFB
mov	esi, dword_1014F64
mov	[ebp+var_10], eax
mov	ecx, [esi+4]
lea	ecx, ds:0Ch[ecx*4]
mov	edi, eax
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+var_C]
mov	eax, [eax]
neg	dword ptr [eax]
mov	esi, 7FFFFFFFh

loc_100FEA6:
push	[ebp+var_C]
lea	eax, [ebp+var_4]
push	eax
call	sub_100BBD4
push	[ebp+var_10]
push	[ebp+var_4]
call	sub_1012314
mov	ecx, [ebp+var_10]
mov	eax, [ecx+0Ch]
cmp	eax, esi
jnb	short loc_100FECD
inc	eax
mov	[ecx+0Ch], eax
jmp	short loc_100FEE1

loc_100FECD:
push	80000000h
push	dword_1014F64
lea	eax, [ebp+var_10]
push	eax
call	sub_1011A3C

loc_100FEE1:
mov	ecx, [ebp+var_10]
mov	eax, [ecx+0Ch]
cmp	eax, esi
jnb	short loc_100FEF1
inc	eax
mov	[ecx+0Ch], eax
jmp	short loc_100FF05

loc_100FEF1:
push	80000000h
push	dword_1014F64
lea	eax, [ebp+var_10]
push	eax
call	sub_1011A3C

loc_100FF05:
mov	eax, [ebp+var_4]
push	[ebp+var_10]
add	eax, 4
push	eax
call	sub_1012314
push	[ebp+var_4]
lea	eax, [ebp+hMem]
push	eax
call	sub_100BC54
mov	eax, [ebp+var_4]
push	dword ptr [eax]
call	sub_1011A18
test	eax, eax
jnz	short loc_100FF62
mov	ecx, [ebp+var_4]
mov	eax, [ecx+4]
mov	edx, [eax+8]
mov	ecx, [ecx]
sub	edx, [ecx+8]
mov	eax, [eax+4]
sub	edx, [ecx+4]
lea	eax, [edx+eax-1]
imul	eax, dword_1014F40
cmp	eax, dword_1014F5C
jg	short loc_100FF62
cmp	dword_1014F58, 0
jz	loc_100FEA6

loc_100FF62:
push	[ebp+var_10]
call	sub_1007BC1
push	[ebp+var_C]	; hMem
xor	esi, esi
mov	[ebp+var_10], esi
call	sub_1007BD1
push	[ebp+var_4]	; hMem
mov	[ebp+var_C], esi
call	sub_1007BD1
push	dword ptr [ebx]	; hMem
mov	[ebp+var_4], esi
call	sub_1007BD1
lea	eax, [ebp+hMem]
push	eax
mov	[ebx], esi
call	sub_100AB09
mov	eax, [ebp+hMem]
pop	edi
pop	esi
mov	[ebx], eax
pop	ebx
leave
retn	4
sub_100FC46 endp



; Attributes: bp-based frame

sub_100FFA3 proc near

hMem= dword ptr	-4
arg_0= dword ptr  8

push	ebp
mov	ebp, esp
push	ecx
and	[ebp+hMem], 0
push	ebx
mov	ebx, [ebp+arg_0]
mov	eax, [ebx]
mov	ecx, [eax]
mov	eax, [eax+4]
push	esi
mov	esi, [eax]
imul	esi, [ecx]
push	edi
xor	edi, edi
inc	edi
mov	[ecx], edi
mov	eax, [ebx]
mov	eax, [eax+4]
mov	[eax], edi
push	dword_1014FA0
mov	[ebp+arg_0], esi
push	dword ptr [ebx]
call	sub_1008D44
test	eax, eax
jz	loc_1010280
push	dword_1014F90
push	dword ptr [ebx]
call	sub_1008D44
test	eax, eax
mov	eax, [ebx]
mov	eax, [eax]
mov	[eax], esi
jz	loc_101018B
mov	eax, [ebx]
mov	eax, [eax+4]
mov	[eax], edi
push	[ebp+hMem]	; hMem
call	sub_1007BD1
and	[ebp+hMem], 0
call	sub_1007C26
mov	[ebp+hMem], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+hMem]
and	dword ptr [eax], 0
mov	eax, dword_1014F88
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx], eax
mov	eax, dword_1014F88
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+hMem]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+hMem]
and	dword ptr [eax+4], 0
mov	eax, dword_1014F88
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx+4], eax
mov	eax, dword_1014F88
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
push	dword ptr [ebx]
lea	eax, [ebp+hMem]
push	eax
call	sub_100BD6F
lea	eax, [ebp+hMem]
push	eax
call	sub_100FC46
mov	eax, [ebp+hMem]
mov	eax, [eax]
mov	ecx, [ebp+arg_0]
mov	[eax], ecx
mov	eax, [ebp+hMem]
mov	eax, [eax+4]
mov	dword ptr [eax], 1
push	dword ptr [ebx]	; hMem
call	sub_1007BD1
and	dword ptr [ebx], 0
call	sub_1007C26
mov	[ebx], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebx]
and	dword ptr [eax], 0
mov	eax, dword_1014FA8
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebx]
mov	[ecx], eax
mov	eax, dword_1014FA8
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebx]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebx]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebx]
and	dword ptr [eax+4], 0
mov	eax, dword_1014FA8
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebx]
mov	[ecx+4], eax
mov	eax, dword_1014FA8
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebx]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
push	[ebp+hMem]
push	ebx
call	sub_100BE29
push	[ebp+hMem]	; hMem
call	sub_1007BD1
and	[ebp+hMem], 0
jmp	loc_1010293

loc_101018B:		; hMem
push	[ebp+hMem]
call	sub_1007BD1
and	[ebp+hMem], 0
call	sub_1007C26
mov	[ebp+hMem], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+hMem]
and	dword ptr [eax], 0
mov	eax, [ebx]
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx], eax
mov	eax, [ebx]
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+hMem]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+hMem]
and	dword ptr [eax+4], 0
mov	eax, [ebx]
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx+4], eax
mov	eax, [ebx]
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
push	dword ptr [ebx]
lea	eax, [ebp+hMem]
push	eax
call	sub_100BBD4
push	dword_1014F88
lea	eax, [ebp+hMem]
push	eax
call	sub_100BC54
push	dword_1014F90
lea	eax, [ebp+hMem]
push	eax
call	sub_100BE44
push	[ebp+hMem]
push	ebx
call	sub_100BD6F
push	[ebp+hMem]	; hMem
call	sub_1007BD1
and	[ebp+hMem], 0
push	ebx
call	sub_100F73F
mov	eax, [ebx]
mov	eax, [eax]
mov	ecx, [ebp+arg_0]
mov	[eax], ecx
mov	eax, [ebx]
mov	eax, [eax+4]
mov	dword ptr [eax], 1
jmp	short loc_1010293

loc_1010280:
mov	eax, [ebx]
mov	eax, [eax]
mov	[eax], esi
mov	eax, [ebx]
mov	eax, [eax+4]
push	ebx
mov	[eax], edi
call	sub_100FC46

loc_1010293:
push	dword_1014FA8
push	dword ptr [ebx]
call	sub_1008D44
test	eax, eax
jz	short loc_10102B0
push	dword_1014FA4
push	ebx
call	sub_100BE29

loc_10102B0:
pop	edi
pop	esi
pop	ebx
leave
retn	4
sub_100FFA3 endp




sub_10102B7 proc near

arg_0= dword ptr  4

push	[esp+arg_0]
call	sub_100F73F
jmp	sub_100F38A
sub_10102B7 endp




sub_10102C5 proc near

arg_0= dword ptr  4

push	[esp+arg_0]
call	sub_100FADE
jmp	sub_100F38A
sub_10102C5 endp




sub_10102D3 proc near

arg_0= dword ptr  4

push	[esp+arg_0]
call	sub_100FFA3
jmp	sub_100F38A
sub_10102D3 endp



; Attributes: bp-based frame

sub_10102E1 proc near

var_10=	dword ptr -10h
var_C= dword ptr -0Ch
var_8= dword ptr -8
hMem= dword ptr	-4
arg_0= dword ptr  8

push	ebp
mov	ebp, esp
sub	esp, 10h
push	ebx
push	esi
push	edi
push	0		; hMem
call	sub_1007BD1
call	sub_1007C26
mov	ebx, eax
push	dword ptr [ebx]
mov	[ebp+var_10], ebx
call	sub_1007BC1
and	dword ptr [ebx], 0
mov	eax, dword_1014FA0
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	[ebx], eax
mov	ecx, dword_1014FA0
mov	esi, [ecx]
mov	ecx, [esi+4]
lea	ecx, ds:0Ch[ecx*4]
mov	edi, eax
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
push	dword ptr [ebx+4]
call	sub_1007BC1
and	dword ptr [ebx+4], 0
mov	eax, dword_1014FA0
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	[ebx+4], eax
mov	ecx, dword_1014FA0
mov	esi, [ecx+4]
mov	ecx, [esi+4]
lea	ecx, ds:0Ch[ecx*4]
mov	edi, eax
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	ebx, [ebx]
neg	dword ptr [ebx]
push	dword_1014FA0
mov	ebx, [ebp+arg_0]
push	dword ptr [ebx]
call	sub_1008D44
test	eax, eax
jnz	loc_1010711
push	[ebp+var_10]
push	dword ptr [ebx]
call	sub_1008F17
test	eax, eax
jnz	loc_1010711
xor	esi, esi
push	esi		; hMem
mov	[ebp+var_8], esi
mov	[ebp+var_C], esi
mov	[ebp+hMem], esi
mov	[ebp+arg_0], esi
call	sub_1007BD1
mov	[ebp+var_8], esi
call	sub_1007C26
mov	[ebp+var_8], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+var_8]
mov	[eax], esi
mov	eax, [ebx]
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+var_8]
mov	[ecx], eax
mov	eax, [ebx]
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+var_8]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+var_8]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+var_8]
and	dword ptr [eax+4], 0
mov	eax, [ebx]
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+var_8]
mov	[ecx+4], eax
mov	eax, [ebx]
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+var_8]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
push	dword ptr [ebx]
lea	eax, [ebp+var_8]
push	eax
call	sub_100BBD4
call	sub_1007C26
mov	esi, 80000000h
push	esi
xor	edi, edi
push	edi
mov	[ebp+hMem], eax
call	sub_1007C4C
mov	ecx, [ebp+hMem]
push	esi
push	edi
mov	[ecx], eax
call	sub_1007C4C
mov	ecx, [ebp+hMem]
mov	[ecx+4], eax
mov	eax, [ebp+var_8]
mov	eax, [eax]
neg	dword ptr [eax]
push	[ebp+hMem]	; hMem
call	sub_1007BD1
mov	[ebp+hMem], edi
call	sub_1007C26
mov	[ebp+hMem], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+hMem]
mov	[eax], edi
mov	eax, [ebx]
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx], eax
mov	eax, [ebx]
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+hMem]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+hMem]
and	dword ptr [eax+4], 0
mov	eax, [ebx]
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx+4], eax
mov	eax, [ebx]
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
push	[ebp+arg_0]	; hMem
call	sub_1007BD1
and	[ebp+arg_0], 0
call	sub_1007C26
mov	[ebp+arg_0], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+arg_0]
and	dword ptr [eax], 0
mov	eax, [ebx]
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+arg_0]
mov	[ecx], eax
mov	eax, [ebx]
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+arg_0]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+arg_0]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+arg_0]
and	dword ptr [eax+4], 0
mov	eax, [ebx]
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+arg_0]
mov	[ecx+4], eax
mov	eax, [ebx]
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+arg_0]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
push	[ebp+var_C]
call	sub_1007BC1
mov	eax, dword_1014F64
and	[ebp+var_C], 0
push	dword ptr [eax+4]
call	sub_1007BFB
mov	esi, dword_1014F64
mov	[ebp+var_C], eax
mov	ecx, [esi+4]
lea	ecx, ds:0Ch[ecx*4]
mov	edi, eax
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	esi, 7FFFFFFFh

loc_10105FC:
push	[ebp+var_8]
lea	eax, [ebp+arg_0]
push	eax
call	sub_100BBD4
push	[ebp+var_C]
push	[ebp+arg_0]
call	sub_1012314
push	[ebp+var_C]
push	[ebp+arg_0]
call	sub_1012314
mov	ecx, [ebp+var_C]
mov	eax, [ecx+0Ch]
cmp	eax, esi
jnb	short loc_101062E
inc	eax
mov	[ecx+0Ch], eax
jmp	short loc_1010642

loc_101062E:
push	80000000h
push	dword_1014F64
lea	eax, [ebp+var_C]
push	eax
call	sub_1011A3C

loc_1010642:
mov	eax, [ebp+arg_0]
push	[ebp+var_C]
add	eax, 4
push	eax
call	sub_1012314
mov	ecx, [ebp+var_C]
mov	eax, [ecx+0Ch]
cmp	eax, esi
jnb	short loc_1010661
inc	eax
mov	[ecx+0Ch], eax
jmp	short loc_1010675

loc_1010661:
push	80000000h
push	dword_1014F64
lea	eax, [ebp+var_C]
push	eax
call	sub_1011A3C

loc_1010675:
mov	eax, [ebp+arg_0]
push	[ebp+var_C]
add	eax, 4
push	eax
call	sub_1012314
push	[ebp+arg_0]
lea	eax, [ebp+hMem]
push	eax
call	sub_100BC54
mov	eax, [ebp+arg_0]
push	dword ptr [eax]
call	sub_1011A18
test	eax, eax
jnz	short loc_10106D2
mov	ecx, [ebp+arg_0]
mov	eax, [ecx+4]
mov	edx, [eax+8]
mov	ecx, [ecx]
sub	edx, [ecx+8]
mov	eax, [eax+4]
sub	edx, [ecx+4]
lea	eax, [edx+eax-1]
imul	eax, dword_1014F40
cmp	eax, dword_1014F5C
jg	short loc_10106D2
cmp	dword_1014F58, 0
jz	loc_10105FC

loc_10106D2:
push	[ebp+var_C]
call	sub_1007BC1
push	[ebp+var_8]	; hMem
xor	esi, esi
mov	[ebp+var_C], esi
call	sub_1007BD1
push	[ebp+arg_0]	; hMem
mov	[ebp+var_8], esi
call	sub_1007BD1
push	dword ptr [ebx]	; hMem
mov	[ebp+arg_0], esi
call	sub_1007BD1
lea	eax, [ebp+hMem]
push	eax
mov	[ebx], esi
call	sub_100AB09
mov	eax, [ebp+hMem]
mov	[ebx], eax
jmp	loc_10107ED

loc_1010711:
xor	esi, esi
push	esi		; hMem
mov	[ebp+arg_0], esi
call	sub_1007BD1
mov	[ebp+arg_0], esi
call	sub_1007C26
mov	[ebp+arg_0], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+arg_0]
mov	[eax], esi
mov	eax, [ebx]
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+arg_0]
mov	[ecx], eax
mov	eax, [ebx]
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+arg_0]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+arg_0]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+arg_0]
and	dword ptr [eax+4], 0
mov	eax, [ebx]
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+arg_0]
mov	[ecx+4], eax
mov	eax, [ebx]
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+arg_0]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
push	dword ptr [ebx]
lea	eax, [ebp+arg_0]
push	eax
call	sub_100BBD4
push	dword_1014F88
lea	eax, [ebp+arg_0]
push	eax
call	sub_100BC54
push	dword_1014F90
lea	eax, [ebp+arg_0]
push	eax
call	sub_100BE44
push	[ebp+arg_0]
push	ebx
call	sub_100BC54
push	ebx
call	sub_100DFEF
push	[ebp+arg_0]	; hMem
call	sub_1007BD1

loc_10107ED:		; hMem
push	[ebp+var_10]
call	sub_1007BD1
pop	edi
pop	esi
pop	ebx
leave
retn	4
sub_10102E1 endp



; Attributes: bp-based frame

; int __stdcall	sub_10107FC(HLOCAL hMem)
sub_10107FC proc near

hMem= dword ptr	 8

push	ebp
mov	ebp, esp
push	ebx
mov	ebx, [ebp+hMem]
push	esi
push	edi
push	dword_1014F88
push	dword ptr [ebx]
call	sub_1008F17
test	eax, eax
jz	short loc_101082B
push	offset dword_1012A34
lea	eax, [ebp+hMem]
push	eax
mov	[ebp+hMem], 80000001h
call	_CxxThrowException

loc_101082B:
xor	esi, esi
push	esi		; hMem
mov	[ebp+hMem], esi
call	sub_1007BD1
mov	[ebp+hMem], esi
call	sub_1007C26
mov	[ebp+hMem], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+hMem]
mov	[eax], esi
mov	eax, [ebx]
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx], eax
mov	eax, [ebx]
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+hMem]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+hMem]
and	dword ptr [eax+4], 0
mov	eax, [ebx]
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx+4], eax
mov	eax, [ebx]
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
push	dword ptr [ebx]
lea	eax, [ebp+hMem]
push	eax
call	sub_100BBD4
push	dword_1014F88
lea	eax, [ebp+hMem]
push	eax
call	sub_100BE29
push	dword_1014F90
lea	eax, [ebp+hMem]
push	eax
call	sub_100BE44
push	[ebp+hMem]
push	ebx
call	sub_100BC54
push	ebx
call	sub_100DFEF
push	[ebp+hMem]	; hMem
call	sub_1007BD1
pop	edi
pop	esi
pop	ebx
pop	ebp
retn	4
sub_10107FC endp



; Attributes: bp-based frame

sub_101090E proc near

hMem= dword ptr	-4
arg_0= dword ptr  8

push	ebp
mov	ebp, esp
push	ecx
push	ebx
push	esi
push	edi
xor	esi, esi
push	esi		; hMem
mov	[ebp+hMem], esi
call	sub_1007BD1
mov	[ebp+hMem], esi
call	sub_1007C26
mov	[ebp+hMem], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+hMem]
mov	ebx, [ebp+arg_0]
mov	[eax], esi
mov	eax, [ebx]
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx], eax
mov	eax, [ebx]
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+hMem]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+hMem]
and	dword ptr [eax+4], 0
mov	eax, [ebx]
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx+4], eax
mov	eax, [ebx]
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
push	dword_1014F88
lea	eax, [ebp+hMem]
push	eax
call	sub_100BE29
push	dword_1014F88
push	ebx
call	sub_100BC54
push	[ebp+hMem]
push	ebx
call	sub_100BD6F
mov	eax, [ebx]
mov	eax, [eax]
neg	dword ptr [eax]
push	ebx
call	sub_100DFEF
push	dword_1014F90
push	ebx
call	sub_100BD6F
push	[ebp+hMem]	; hMem
call	sub_1007BD1
pop	edi
pop	esi
pop	ebx
leave
retn	4
sub_101090E endp




sub_10109FF proc near

arg_0= dword ptr  4
arg_4= dword ptr  8

mov	eax, [esp+arg_4]
sub	eax, 0
jz	short loc_1010A21
dec	eax
jz	short loc_1010A16
dec	eax
jnz	short locret_1010A30
push	dword_1014FD8
jmp	short loc_1010A27

loc_1010A16:
push	[esp+arg_0]
call	sub_10091EC
jmp	short locret_1010A30

loc_1010A21:
push	dword_1014FD4

loc_1010A27:
push	[esp+4+arg_0]
call	sub_10090D7

locret_1010A30:
retn	8
sub_10109FF endp



; Attributes: bp-based frame

sub_1010A33 proc near

var_10=	dword ptr -10h
var_C= dword ptr -0Ch
hMem= dword ptr	-8
var_4= dword ptr -4
arg_0= dword ptr  8

push	ebp
mov	ebp, esp
sub	esp, 10h
push	ebx
push	esi
xor	esi, esi
push	edi
push	esi		; hMem
mov	[ebp+var_C], esi
mov	[ebp+var_10], esi
mov	[ebp+hMem], esi
mov	[ebp+var_4], esi
call	sub_1007BD1
mov	[ebp+var_C], esi
call	sub_1007C26
mov	[ebp+var_C], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+var_C]
mov	ebx, [ebp+arg_0]
mov	[eax], esi
mov	eax, [ebx]
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+var_C]
mov	[ecx], eax
mov	eax, [ebx]
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+var_C]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+var_C]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+var_C]
and	dword ptr [eax+4], 0
mov	eax, [ebx]
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+var_C]
mov	[ecx+4], eax
mov	eax, [ebx]
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+var_C]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
push	dword ptr [ebx]
lea	eax, [ebp+var_C]
push	eax
call	sub_100BBD4
call	sub_1007C26
mov	esi, 80000000h
push	esi
xor	edi, edi
push	edi
mov	[ebp+hMem], eax
call	sub_1007C4C
mov	ecx, [ebp+hMem]
push	esi
push	edi
mov	[ecx], eax
call	sub_1007C4C
mov	ecx, [ebp+hMem]
mov	[ecx+4], eax
push	[ebp+hMem]	; hMem
call	sub_1007BD1
mov	[ebp+hMem], edi
call	sub_1007C26
mov	[ebp+hMem], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+hMem]
mov	[eax], edi
mov	eax, [ebx]
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx], eax
mov	eax, [ebx]
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+hMem]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+hMem]
and	dword ptr [eax+4], 0
mov	eax, [ebx]
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx+4], eax
mov	eax, [ebx]
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
push	[ebp+var_4]	; hMem
call	sub_1007BD1
and	[ebp+var_4], 0
call	sub_1007C26
mov	[ebp+var_4], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+var_4]
and	dword ptr [eax], 0
mov	eax, [ebx]
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+var_4]
mov	[ecx], eax
mov	eax, [ebx]
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+var_4]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+var_4]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+var_4]
and	dword ptr [eax+4], 0
mov	eax, [ebx]
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+var_4]
mov	[ecx+4], eax
mov	eax, [ebx]
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+var_4]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
push	[ebp+var_10]
call	sub_1007BC1
mov	eax, dword_1014F64
and	[ebp+var_10], 0
push	dword ptr [eax+4]
call	sub_1007BFB
mov	esi, dword_1014F64
mov	[ebp+var_10], eax
mov	ecx, [esi+4]
lea	ecx, ds:0Ch[ecx*4]
mov	edi, eax
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+var_C]
mov	eax, [eax]
neg	dword ptr [eax]
mov	esi, 7FFFFFFFh

loc_1010C93:
push	[ebp+var_C]
lea	eax, [ebp+var_4]
push	eax
call	sub_100BBD4
mov	ecx, [ebp+var_10]
mov	eax, [ecx+0Ch]
cmp	eax, esi
jnb	short loc_1010CAF
inc	eax
mov	[ecx+0Ch], eax
jmp	short loc_1010CC3

loc_1010CAF:
push	80000000h
push	dword_1014F64
lea	eax, [ebp+var_10]
push	eax
call	sub_1011A3C

loc_1010CC3:
mov	eax, [ebp+var_4]
push	[ebp+var_10]
add	eax, 4
push	eax
call	sub_1012314
mov	ecx, [ebp+var_10]
mov	eax, [ecx+0Ch]
cmp	eax, esi
jnb	short loc_1010CE2
inc	eax
mov	[ecx+0Ch], eax
jmp	short loc_1010CF6

loc_1010CE2:
push	80000000h
push	dword_1014F64
lea	eax, [ebp+var_10]
push	eax
call	sub_1011A3C

loc_1010CF6:
mov	eax, [ebp+var_4]
push	[ebp+var_10]
add	eax, 4
push	eax
call	sub_1012314
push	[ebp+var_4]
lea	eax, [ebp+hMem]
push	eax
call	sub_100BC54
mov	eax, [ebp+var_4]
push	dword ptr [eax]
call	sub_1011A18
test	eax, eax
jnz	short loc_1010D53
mov	ecx, [ebp+var_4]
mov	eax, [ecx+4]
mov	edx, [eax+8]
mov	ecx, [ecx]
sub	edx, [ecx+8]
mov	eax, [eax+4]
sub	edx, [ecx+4]
lea	eax, [edx+eax-1]
imul	eax, dword_1014F40
cmp	eax, dword_1014F5C
jg	short loc_1010D53
cmp	dword_1014F58, 0
jz	loc_1010C93

loc_1010D53:
push	[ebp+var_10]
call	sub_1007BC1
push	[ebp+var_C]	; hMem
xor	esi, esi
mov	[ebp+var_10], esi
call	sub_1007BD1
push	[ebp+var_4]	; hMem
mov	[ebp+var_C], esi
call	sub_1007BD1
push	dword ptr [ebx]	; hMem
mov	[ebp+var_4], esi
call	sub_1007BD1
lea	eax, [ebp+hMem]
push	eax
mov	[ebx], esi
call	sub_100AB09
mov	eax, [ebp+hMem]
mov	[ebx], eax
push	dword_1014F88
push	ebx
call	sub_1009489
push	dword_1014FE8
push	dword ptr [ebx]
call	sub_1008E2C
test	eax, eax
jz	loc_1010E5E
push	dword_1014FEC
push	dword ptr [ebx]
call	sub_1008C5C
test	eax, eax
jz	loc_1010E5E
push	dword ptr [ebx]	; hMem
call	sub_1007BD1
mov	[ebx], esi
call	sub_1007C26
mov	[ebx], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebx]
mov	[eax], esi
mov	eax, dword_1014F84
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebx]
mov	[ecx], eax
mov	eax, dword_1014F84
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebx]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebx]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebx]
and	dword ptr [eax+4], 0
mov	eax, dword_1014F84
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebx]
mov	[ecx+4], eax
mov	eax, dword_1014F84
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebx]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb

loc_1010E5E:
pop	edi
pop	esi
pop	ebx
leave
retn	4
sub_1010A33 endp




sub_1010E65 proc near

arg_0= dword ptr  4
arg_4= dword ptr  8

push	esi
push	[esp+4+arg_4]
mov	esi, [esp+8+arg_0]
push	esi
call	sub_10109FF
mov	eax, [esp+4+arg_4]
sub	eax, 0
jz	short loc_1010EA6
dec	eax
dec	eax
jnz	short loc_1010EDB
push	dword_1014FE0
push	dword ptr [esi]
call	sub_1008D44
test	eax, eax
jz	short loc_1010E9E
push	dword_1014FD8
push	esi
call	sub_100BE29

loc_1010E9E:
push	dword_1014FE0
jmp	short loc_1010EC9

loc_1010EA6:
push	dword_1014FDC
push	dword ptr [esi]
call	sub_1008D44
test	eax, eax
jz	short loc_1010EC3
push	dword_1014FD4
push	esi
call	sub_100BE29

loc_1010EC3:
push	dword_1014FDC

loc_1010EC9:
push	esi
call	sub_100BD6F
push	dword_1014FA4
push	esi
call	sub_100BBD4

loc_1010EDB:
push	esi
call	sub_1010A33
pop	esi
retn	8
sub_1010E65 endp



; Attributes: bp-based frame

sub_1010EE5 proc near

var_10=	dword ptr -10h
var_C= dword ptr -0Ch
var_8= dword ptr -8
hMem= dword ptr	-4
arg_0= dword ptr  8

push	ebp
mov	ebp, esp
sub	esp, 10h
push	ebx
push	esi
xor	esi, esi
push	edi
push	esi		; hMem
mov	[ebp+var_8], esi
mov	[ebp+var_10], esi
mov	[ebp+var_C], esi
mov	[ebp+hMem], esi
call	sub_1007BD1
mov	[ebp+var_8], esi
call	sub_1007C26
mov	[ebp+var_8], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+var_8]
mov	ebx, [ebp+arg_0]
mov	[eax], esi
mov	eax, [ebx]
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+var_8]
mov	[ecx], eax
mov	eax, [ebx]
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+var_8]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+var_8]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+var_8]
and	dword ptr [eax+4], 0
mov	eax, [ebx]
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+var_8]
mov	[ecx+4], eax
mov	eax, [ebx]
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+var_8]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
push	dword ptr [ebx]
lea	eax, [ebp+var_8]
push	eax
call	sub_100BBD4
call	sub_1007C26
mov	esi, 80000000h
push	esi
xor	edi, edi
push	edi
mov	[ebp+var_C], eax
call	sub_1007C4C
mov	ecx, [ebp+var_C]
push	esi
push	edi
mov	[ecx], eax
call	sub_1007C4C
mov	ecx, [ebp+var_C]
mov	[ecx+4], eax
push	dword_1014010
push	1
call	sub_1007C4C
mov	ecx, [ebp+var_C]
mov	[ecx], eax
push	dword_1014010
push	1
call	sub_1007C4C
mov	ecx, [ebp+var_C]
mov	[ecx+4], eax
push	[ebp+hMem]	; hMem
call	sub_1007BD1
mov	[ebp+hMem], edi
call	sub_1007C26
mov	[ebp+hMem], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+hMem]
mov	[eax], edi
mov	eax, [ebp+var_C]
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx], eax
mov	eax, [ebp+var_C]
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+hMem]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+hMem]
and	dword ptr [eax+4], 0
mov	eax, [ebp+var_C]
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx+4], eax
mov	eax, [ebp+var_C]
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
push	dword_1014010
xor	edi, edi
push	edi
call	sub_1007C4C
mov	[ebp+var_10], eax
mov	eax, [ebp+var_8]
mov	eax, [eax]
neg	dword ptr [eax]
mov	esi, 7FFFFFFFh

loc_10110A8:
push	[ebp+var_8]
lea	eax, [ebp+hMem]
push	eax
call	sub_100BBD4
mov	ecx, [ebp+var_10]
mov	eax, [ecx+0Ch]
cmp	eax, esi
jnb	short loc_10110C4
inc	eax
mov	[ecx+0Ch], eax
jmp	short loc_10110D8

loc_10110C4:
push	80000000h
push	dword_1014F64
lea	eax, [ebp+var_10]
push	eax
call	sub_1011A3C

loc_10110D8:
mov	eax, [ebp+hMem]
push	[ebp+var_10]
add	eax, 4
push	eax
call	sub_1012314
mov	ecx, [ebp+var_10]
mov	eax, [ecx+0Ch]
cmp	eax, esi
jnb	short loc_10110F7
inc	eax
mov	[ecx+0Ch], eax
jmp	short loc_101110B

loc_10110F7:
push	80000000h
push	dword_1014F64
lea	eax, [ebp+var_10]
push	eax
call	sub_1011A3C

loc_101110B:
mov	eax, [ebp+hMem]
push	[ebp+var_10]
add	eax, 4
push	eax
call	sub_1012314
push	[ebp+hMem]
lea	eax, [ebp+var_C]
push	eax
call	sub_100BC54
mov	eax, [ebp+hMem]
push	dword ptr [eax]
call	sub_1011A18
test	eax, eax
jnz	short loc_1011167
mov	ecx, [ebp+hMem]
mov	eax, [ecx+4]
mov	edx, [eax+8]
mov	ecx, [ecx]
sub	edx, [ecx+8]
mov	eax, [eax+4]
sub	edx, [ecx+4]
lea	eax, [edx+eax-1]
imul	eax, dword_1014F40
cmp	eax, dword_1014F5C
jg	short loc_1011167
cmp	dword_1014F58, edi
jz	loc_10110A8

loc_1011167:
push	[ebp+var_10]
call	sub_1007BC1
push	[ebp+var_8]	; hMem
mov	[ebp+var_10], edi
call	sub_1007BD1
push	[ebp+hMem]	; hMem
mov	[ebp+var_8], edi
call	sub_1007BD1
push	dword ptr [ebx]	; hMem
mov	[ebp+hMem], edi
call	sub_1007BD1
lea	eax, [ebp+var_C]
push	eax
mov	[ebx], edi
call	sub_100AB09
mov	eax, [ebp+var_C]
mov	[ebx], eax
push	dword_1014F88
push	ebx
call	sub_1009489
push	dword_1014FE8
push	dword ptr [ebx]
call	sub_1008E2C
test	eax, eax
jz	loc_1011270
push	dword_1014FEC
push	dword ptr [ebx]
call	sub_1008C5C
test	eax, eax
jz	loc_1011270
push	dword ptr [ebx]	; hMem
call	sub_1007BD1
mov	[ebx], edi
call	sub_1007C26
mov	[ebx], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebx]
mov	[eax], edi
mov	eax, dword_1014F84
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebx]
mov	[ecx], eax
mov	eax, dword_1014F84
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebx]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebx]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebx]
and	dword ptr [eax+4], 0
mov	eax, dword_1014F84
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebx]
mov	[ecx+4], eax
mov	eax, dword_1014F84
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebx]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb

loc_1011270:
pop	edi
pop	esi
pop	ebx
leave
retn	4
sub_1010EE5 endp



; Attributes: bp-based frame

sub_1011277 proc near

arg_0= dword ptr  8
arg_4= dword ptr  0Ch

push	ebp
mov	ebp, esp
push	ebx
mov	ebx, [ebp+arg_0]
push	esi
push	edi
push	[ebp+arg_4]
push	ebx
call	sub_10109FF
mov	eax, [ebp+arg_4]
xor	esi, esi
sub	eax, esi
jz	loc_101137B
dec	eax
dec	eax
jnz	loc_1011465
push	dword_1014FE0
push	dword ptr [ebx]
call	sub_1008D44
test	eax, eax
jz	loc_1011370
push	esi		; hMem
mov	[ebp+arg_4], esi
call	sub_1007BD1
mov	[ebp+arg_4], esi
call	sub_1007C26
mov	[ebp+arg_4], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+arg_4]
mov	[eax], esi
mov	eax, dword_1014FD8
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+arg_4]
mov	[ecx], eax
mov	eax, dword_1014FD8
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+arg_4]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+arg_4]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+arg_4]
and	dword ptr [eax+4], 0
mov	eax, dword_1014FD8
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+arg_4]
mov	[ecx+4], eax
mov	eax, dword_1014FD8
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+arg_4]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
push	dword ptr [ebx]
lea	eax, [ebp+arg_4]
push	eax
call	sub_100BE29
push	dword ptr [ebx]	; hMem
call	sub_1007BD1
mov	eax, [ebp+arg_4]
mov	[ebx], eax

loc_1011370:
push	dword_1014FE0
jmp	loc_1011453

loc_101137B:
push	dword_1014FDC
push	dword ptr [ebx]
call	sub_1008D44
test	eax, eax
jz	loc_101144D
push	esi		; hMem
mov	[ebp+arg_4], esi
call	sub_1007BD1
mov	[ebp+arg_4], esi
call	sub_1007C26
mov	[ebp+arg_4], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+arg_4]
mov	[eax], esi
mov	eax, dword_1014FD4
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+arg_4]
mov	[ecx], eax
mov	eax, dword_1014FD4
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+arg_4]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+arg_4]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+arg_4]
and	dword ptr [eax+4], 0
mov	eax, dword_1014FD4
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+arg_4]
mov	[ecx+4], eax
mov	eax, dword_1014FD4
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+arg_4]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
push	dword ptr [ebx]
lea	eax, [ebp+arg_4]
push	eax
call	sub_100BE29
push	dword ptr [ebx]	; hMem
call	sub_1007BD1
mov	eax, [ebp+arg_4]
mov	[ebx], eax

loc_101144D:
push	dword_1014FDC

loc_1011453:
push	ebx
call	sub_100BD6F
push	dword_1014FA4
push	ebx
call	sub_100BBD4

loc_1011465:
push	ebx
call	sub_1010EE5
pop	edi
pop	esi
pop	ebx
pop	ebp
retn	8
sub_1011277 endp



; Attributes: bp-based frame

sub_1011472 proc near

hMem= dword ptr	-4
arg_0= dword ptr  8

push	ebp
mov	ebp, esp
push	ecx
push	ebx
push	esi
push	edi
xor	esi, esi
push	esi		; hMem
mov	[ebp+hMem], esi
call	sub_1007BD1
mov	[ebp+hMem], esi
call	sub_1007C26
mov	[ebp+hMem], eax
push	dword ptr [eax]
call	sub_1007BC1
mov	eax, [ebp+hMem]
mov	ebx, [ebp+arg_0]
mov	[eax], esi
mov	eax, [ebx]
mov	eax, [eax]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx], eax
mov	eax, [ebx]
mov	esi, [eax]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebp+hMem]
push	dword ptr [eax+4]
call	sub_1007BC1
mov	eax, [ebp+hMem]
and	dword ptr [eax+4], 0
mov	eax, [ebx]
mov	eax, [eax+4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	ecx, [ebp+hMem]
mov	[ecx+4], eax
mov	eax, [ebx]
mov	esi, [eax+4]
mov	ecx, [esi+4]
mov	eax, [ebp+hMem]
mov	edi, [eax+4]
lea	ecx, ds:0Ch[ecx*4]
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
push	ebx
rep movsb
call	sub_1010A33
lea	eax, [ebp+hMem]
push	eax
call	sub_1010EE5
push	[ebp+hMem]
call	sub_100BD61
test	eax, eax
push	[ebp+hMem]	; hMem
jz	short loc_1011554
call	sub_1007BD1
and	[ebp+hMem], 0
push	offset dword_1012A34
lea	eax, [ebp+arg_0]
push	eax
mov	[ebp+arg_0], 80000001h
call	_CxxThrowException

loc_1011554:
push	ebx
call	sub_100BD6F
push	[ebp+hMem]	; hMem
call	sub_1007BD1
pop	edi
pop	esi
pop	ebx
leave
retn	4
sub_1011472 endp




sub_1011569 proc near

arg_0= dword ptr  4
arg_4= dword ptr  8

push	esi
push	[esp+4+arg_4]
mov	esi, [esp+8+arg_0]
push	esi
call	sub_10109FF
mov	eax, [esp+4+arg_4]
sub	eax, 0
jz	short loc_10115AA
dec	eax
dec	eax
jnz	short loc_10115DF
push	dword_1014FE0
push	dword ptr [esi]
call	sub_1008D44
test	eax, eax
jz	short loc_10115A2
push	dword_1014FE0
push	esi
call	sub_100BE29

loc_10115A2:
push	dword_1014FE0
jmp	short loc_10115CD

loc_10115AA:
push	dword_1014FDC
push	dword ptr [esi]
call	sub_1008D44
test	eax, eax
jz	short loc_10115C7
push	dword_1014FDC
push	esi
call	sub_100BE29

loc_10115C7:
push	dword_1014FDC

loc_10115CD:
push	esi
call	sub_100BD6F
push	dword_1014FA4
push	esi
call	sub_100BBD4

loc_10115DF:
push	esi
call	sub_1011472
pop	esi
retn	8
sub_1011569 endp



; Attributes: bp-based frame

sub_10115E9 proc near

var_20=	dword ptr -20h
var_1C=	dword ptr -1Ch
var_18=	dword ptr -18h
var_14=	dword ptr -14h
var_10=	dword ptr -10h
var_C= dword ptr -0Ch
var_8= dword ptr -8
var_4= dword ptr -4
arg_0= dword ptr  8
arg_4= dword ptr  0Ch
arg_8= dword ptr  10h

push	ebp
mov	ebp, esp
sub	esp, 20h
xor	eax, eax
push	ebx
mov	ebx, [ebp+arg_4]
push	esi
mov	esi, [ebx+4]
mov	[ebp+var_C], eax
mov	[ebp+var_10], eax
mov	[ebp+var_14], eax
mov	eax, [ebp+arg_0]
push	edi
mov	edi, [eax]
mov	ecx, [edi+4]
mov	eax, [edi+8]
lea	edx, [ecx+eax]
mov	ecx, [ebx+8]
add	esi, ecx
cmp	edx, esi
jg	short loc_101161C
mov	edx, esi

loc_101161C:
cmp	eax, ecx
jl	short loc_1011622
mov	eax, ecx

loc_1011622:
sub	edx, eax
mov	[ebp+arg_4], edx
inc	edx
push	edx
call	sub_1007BFB
mov	ecx, [ebx+8]
mov	esi, eax
mov	eax, [edi+8]
cmp	eax, ecx
jl	short loc_101163C
mov	eax, ecx

loc_101163C:
mov	[esi+8], eax
mov	[ebp+var_8], eax
mov	eax, [ebp+arg_4]
mov	[esi+4], eax
lea	eax, [edi+0Ch]
mov	[ebp+var_18], eax
lea	eax, [ebx+0Ch]
mov	[ebp+var_1C], eax
mov	eax, [edi]
cmp	eax, [ebx]
lea	ecx, [esi+0Ch]
jz	loc_1011716
xor	edx, edx
cmp	eax, 0FFFFFFFFh
setz	dl
xor	eax, eax
cmp	dword ptr [ebx], 0FFFFFFFFh
mov	[ebp+var_C], 1
setz	al
mov	[ebp+var_10], edx
mov	[ebp+var_14], eax
jmp	loc_1011716

loc_1011683:
mov	eax, [edi+8]
cmp	[ebp+var_8], eax
jl	short loc_10116A9
sub	eax, [esi+8]
mov	edx, [esi+4]
add	eax, [ebp+arg_4]
sub	edx, [edi+4]
cmp	eax, edx
jle	short loc_10116A9
mov	eax, [ebp+var_18]
mov	eax, [eax]
add	[ebp+var_18], 4
mov	[ebp+var_4], eax
jmp	short loc_10116AD

loc_10116A9:
and	[ebp+var_4], 0

loc_10116AD:
mov	eax, [ebx+8]
cmp	[ebp+var_8], eax
jl	short loc_10116D3
sub	eax, [esi+8]
mov	edx, [esi+4]
add	eax, [ebp+arg_4]
sub	edx, [ebx+4]
cmp	eax, edx
jle	short loc_10116D3
mov	eax, [ebp+var_1C]
mov	eax, [eax]
add	[ebp+var_1C], 4
mov	[ebp+var_20], eax
jmp	short loc_10116D7

loc_10116D3:
and	[ebp+var_20], 0

loc_10116D7:
cmp	[ebp+var_10], 0
jz	short loc_10116E7
mov	eax, [ebp+arg_8]
sub	eax, [ebp+var_4]
dec	eax
mov	[ebp+var_4], eax

loc_10116E7:
cmp	[ebp+var_14], 0
jz	short loc_10116F6
mov	eax, [ebp+arg_8]
sub	eax, [ebp+var_20]
dec	eax
jmp	short loc_10116F9

loc_10116F6:
mov	eax, [ebp+var_20]

loc_10116F9:
mov	edx, [ebp+var_4]
add	edx, eax
mov	eax, [ebp+var_C]
add	eax, edx
xor	edx, edx
div	[ebp+arg_8]
mov	[ecx], edx
add	ecx, 4
dec	[ebp+arg_4]
inc	[ebp+var_8]
mov	[ebp+var_C], eax

loc_1011716:
cmp	[ebp+arg_4], 0
jg	loc_1011683
mov	eax, [ebp+var_C]
xor	edx, edx
cmp	eax, edx
jz	short loc_101173B
cmp	[ebp+var_10], edx
jnz	short loc_101174B
cmp	[ebp+var_14], edx
jnz	short loc_101174B
mov	[ecx], eax
add	ecx, 4
inc	dword ptr [esi+4]

loc_101173B:
cmp	[ebp+var_10], edx
jnz	short loc_101174B
cmp	[ebp+var_14], edx
jnz	short loc_101174B
mov	eax, [edi]
mov	[esi], eax
jmp	short loc_101178C

loc_101174B:
cmp	eax, edx
jz	short loc_1011757
mov	dword ptr [esi], 1
jmp	short loc_101178C

loc_1011757:
mov	edx, [esi+4]
or	dword ptr [esi], 0FFFFFFFFh
xor	eax, eax
inc	eax
test	edx, edx
lea	ecx, [esi+0Ch]
jle	short loc_101178C
mov	edi, edx

loc_1011769:
mov	edx, [ebp+arg_8]
sub	edx, [ecx]
lea	eax, [eax+edx-1]
xor	edx, edx
div	[ebp+arg_8]
mov	[ecx], edx
add	ecx, 4
dec	edi
jnz	short loc_1011769
jmp	short loc_101178C

loc_1011781:
sub	ecx, 4
cmp	dword ptr [ecx], 0
jnz	short loc_1011792
dec	dword ptr [esi+4]

loc_101178C:
cmp	dword ptr [esi+4], 1
jg	short loc_1011781

loc_1011792:
mov	edi, [ebp+arg_0]
push	dword ptr [edi]
call	sub_1007BC1
mov	[edi], esi
pop	edi
pop	esi
pop	ebx
leave
retn	0Ch
sub_10115E9 endp



; Attributes: bp-based frame

sub_10117A5 proc near

var_44=	dword ptr -44h
var_3C=	dword ptr -3Ch
var_38=	dword ptr -38h
var_34=	dword ptr -34h
var_2C=	dword ptr -2Ch
var_28=	dword ptr -28h
var_24=	dword ptr -24h
var_20=	dword ptr -20h
var_1C=	dword ptr -1Ch
var_18=	dword ptr -18h
var_14=	dword ptr -14h
var_10=	dword ptr -10h
var_C= dword ptr -0Ch
var_8= dword ptr -8
var_4= dword ptr -4
arg_0= dword ptr  8
arg_4= dword ptr  0Ch
arg_8= dword ptr  10h

push	ebp
mov	ebp, esp
sub	esp, 48h
mov	eax, [ebp+arg_0]
and	[ebp+var_8], 0
push	ebx
mov	ebx, [ebp+arg_4]
push	esi
mov	esi, [eax]
mov	eax, [ebx+4]
mov	ecx, [esi+4]
lea	eax, [eax+ecx-1]
mov	[ebp+var_4], eax
push	edi
inc	eax
push	eax
call	sub_1007BFB
mov	edi, eax
mov	eax, [ebp+var_4]
mov	[edi+4], eax
mov	eax, [esi]
imul	eax, [ebx]
mov	[edi], eax
mov	eax, [esi+8]
add	eax, [ebx+8]
lea	ecx, [edi+0Ch]
mov	[edi+8], eax
lea	eax, [esi+0Ch]
mov	esi, [esi+4]
test	esi, esi
mov	[ebp+var_C], esi
jle	loc_10118FA
lea	edx, [ebx+0Ch]
mov	[ebp+var_1C], edx

loc_1011800:
mov	edx, [eax]
mov	[ebp+var_20], edx
mov	edx, [ebp+var_1C]
mov	[ebp+var_10], edx
mov	edx, [ebx+4]
add	eax, 4
mov	[ebp+var_14], ecx
add	ecx, 4
test	edx, edx
mov	[ebp+var_28], eax
mov	[ebp+var_24], ecx
mov	[ebp+var_4], edx
jle	loc_10118DD

loc_1011828:
xor	eax, eax
push	eax
push	[ebp+var_20]
xor	esi, esi
and	[ebp+var_2C], esi
push	eax
mov	eax, [ebp+var_10]
push	dword ptr [eax]
call	sub_1012770
mov	ecx, eax
or	ecx, edx
jz	short loc_1011856
and	[ebp+var_8], esi
cmp	[ebp+var_4], 1
jnz	short loc_1011856
cmp	[ebp+var_C], 1
jnz	short loc_1011856
inc	dword ptr [edi+4]

loc_1011856:
mov	ecx, eax
or	ecx, edx
jnz	short loc_1011863
mov	ecx, esi
or	ecx, [ebp+var_2C]
jz	short loc_10118C2

loc_1011863:
and	[ebp+var_3C], 0
push	[ebp+var_3C]
mov	ebx, [ebp+var_14]
push	[ebp+arg_8]
mov	ecx, [ebp+var_8]
push	edx
lea	ecx, [ebx+ecx*4]
push	eax
mov	[ebp+var_18], ecx
call	sub_10126D0
push	[ebp+var_3C]
mov	[ebp+var_38], eax
mov	eax, [ebp+var_18]
mov	eax, [eax]
push	[ebp+arg_8]
mov	[ebp+var_34], edx
xor	edx, edx
add	eax, ecx
adc	edx, ebx
add	esi, eax
adc	[ebp+var_2C], edx
push	[ebp+var_2C]
push	esi
call	sub_10126D0
inc	[ebp+var_8]
mov	[ebp+var_44], ebx
mov	esi, eax
mov	eax, [ebp+var_18]
mov	ebx, edx
mov	edx, [ebp+var_34]
mov	[eax], ecx
mov	eax, [ebp+var_38]
mov	[ebp+var_2C], ebx
mov	ebx, [ebp+arg_4]
jmp	short loc_1011856

loc_10118C2:
add	[ebp+var_10], 4
add	[ebp+var_14], 4
dec	[ebp+var_4]
cmp	[ebp+var_4], 0
jg	loc_1011828
mov	ecx, [ebp+var_24]
mov	eax, [ebp+var_28]

loc_10118DD:
dec	[ebp+var_C]
cmp	[ebp+var_C], 0
jg	loc_1011800
jmp	short loc_10118FA

loc_10118EC:
mov	eax, [edi+4]
cmp	dword ptr [edi+eax*4+8], 0
jnz	short loc_1011900
dec	eax
mov	[edi+4], eax

loc_10118FA:
cmp	dword ptr [edi+4], 1
jg	short loc_10118EC

loc_1011900:
mov	esi, [ebp+arg_0]
push	dword ptr [esi]
call	sub_1007BC1
mov	[esi], edi
pop	edi
pop	esi
pop	ebx
leave
retn	0Ch
sub_10117A5 endp



; Attributes: bp-based frame

sub_1011913 proc near

arg_0= dword ptr  8
arg_4= dword ptr  0Ch

push	ebp
mov	ebp, esp
mov	edx, [ebp+arg_0]
mov	ecx, [ebp+arg_4]
mov	eax, [edx+8]
sub	eax, [ecx+8]
push	esi
mov	esi, [ecx+4]
push	edi
mov	edi, [edx+4]
sub	eax, esi
add	eax, edi
jns	short loc_1011934

loc_1011930:
xor	eax, eax
jmp	short loc_1011986

loc_1011934:
test	eax, eax
jg	short loc_1011930
cmp	edi, esi
push	ebx
lea	eax, [edx+edi*4+8]
lea	ebx, [ecx+esi*4+8]
mov	[ebp+arg_0], eax
mov	ecx, edi
jg	short loc_101194C
mov	ecx, esi

loc_101194C:
test	ecx, ecx
jle	short loc_1011982
mov	[ebp+arg_4], ecx
sub	[ebp+arg_4], edi
mov	edi, ecx
sub	edi, esi

loc_101195A:
cmp	ecx, [ebp+arg_4]
jle	short loc_101196A
mov	eax, [ebp+arg_0]
mov	edx, [eax]
sub	[ebp+arg_0], 4
jmp	short loc_101196C

loc_101196A:
xor	edx, edx

loc_101196C:
cmp	ecx, edi
jle	short loc_1011977
mov	eax, [ebx]
sub	ebx, 4
jmp	short loc_1011979

loc_1011977:
xor	eax, eax

loc_1011979:
cmp	edx, eax
jnz	short loc_101198C
dec	ecx
test	ecx, ecx
jg	short loc_101195A

loc_1011982:
xor	eax, eax
inc	eax

loc_1011985:
pop	ebx

loc_1011986:
pop	edi
pop	esi
pop	ebp
retn	8

loc_101198C:
xor	eax, eax
jmp	short loc_1011985
sub_1011913 endp



; Attributes: bp-based frame

sub_1011990 proc near

arg_0= dword ptr  8
arg_4= dword ptr  0Ch

push	ebp
mov	ebp, esp
mov	edx, [ebp+arg_0]
mov	ecx, [ebp+arg_4]
mov	eax, [edx+8]
sub	eax, [ecx+8]
push	esi
mov	esi, [ecx+4]
push	edi
mov	edi, [edx+4]
sub	eax, esi
add	eax, edi
jns	short loc_10119B2
xor	eax, eax
inc	eax
jmp	short loc_1011A07

loc_10119B2:
test	eax, eax
jle	short loc_10119BA
xor	eax, eax
jmp	short loc_1011A07

loc_10119BA:
cmp	edi, esi
lea	eax, [edx+edi*4+8]
push	ebx
mov	[ebp+arg_0], eax
lea	ebx, [ecx+esi*4+8]
mov	edx, edi
jg	short loc_10119CE
mov	edx, esi

loc_10119CE:
test	edx, edx
jle	short loc_1011A04
mov	[ebp+arg_4], edx
sub	[ebp+arg_4], edi
mov	edi, edx
sub	edi, esi

loc_10119DC:
cmp	edx, [ebp+arg_4]
jle	short loc_10119EC
mov	eax, [ebp+arg_0]
mov	eax, [eax]
sub	[ebp+arg_0], 4
jmp	short loc_10119EE

loc_10119EC:
xor	eax, eax

loc_10119EE:
cmp	edx, edi
jle	short loc_10119F9
mov	ecx, [ebx]
sub	ebx, 4
jmp	short loc_10119FB

loc_10119F9:
xor	ecx, ecx

loc_10119FB:
sub	eax, ecx
jnz	short loc_1011A0D
dec	edx
test	edx, edx
jg	short loc_10119DC

loc_1011A04:
xor	eax, eax

loc_1011A06:
pop	ebx

loc_1011A07:
pop	edi
pop	esi
pop	ebp
retn	8

loc_1011A0D:
xor	ecx, ecx
test	eax, eax
setl	cl
mov	eax, ecx
jmp	short loc_1011A06
sub_1011990 endp




sub_1011A18 proc near

arg_0= dword ptr  4

mov	ecx, [esp+arg_0]
mov	eax, [ecx+4]
add	ecx, 0Ch
jmp	short loc_1011A2E

loc_1011A24:
mov	edx, [ecx]
dec	eax
add	ecx, 4
test	edx, edx
jnz	short loc_1011A38

loc_1011A2E:
test	eax, eax
jg	short loc_1011A24
xor	eax, eax
inc	eax

locret_1011A35:
retn	4

loc_1011A38:
xor	eax, eax
jmp	short locret_1011A35
sub_1011A18 endp




sub_1011A3C proc near

arg_0= dword ptr  4
arg_4= dword ptr  8
arg_8= dword ptr  0Ch

push	esi
mov	esi, [esp+4+arg_4]
push	edi
xor	edi, edi
cmp	dword ptr [esi+4], 1
jg	short loc_1011A4F
cmp	[esi+0Ch], edi
jz	short loc_1011A9B

loc_1011A4F:
push	ebx
mov	ebx, [esp+0Ch+arg_0]
mov	eax, [ebx]
cmp	dword ptr [eax+4], 1
jg	short loc_1011A8F
cmp	[eax+0Ch], edi
jnz	short loc_1011A8F
push	eax
call	sub_1007BC1
mov	[ebx], edi
push	dword ptr [esi+4]
call	sub_1007BFB
mov	[ebx], eax
mov	ecx, [esi+4]
lea	ecx, ds:0Ch[ecx*4]
mov	edi, eax
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
jmp	short loc_1011A9A

loc_1011A8F:
push	[esp+0Ch+arg_8]
push	esi
push	ebx
call	sub_10115E9

loc_1011A9A:
pop	ebx

loc_1011A9B:
pop	edi
pop	esi
retn	0Ch
sub_1011A3C endp



; Attributes: bp-based frame

sub_1011AA0 proc near

arg_0= dword ptr  8
arg_4= dword ptr  0Ch
arg_8= dword ptr  10h

push	ebp
mov	ebp, esp
push	esi
mov	esi, [ebp+arg_4]
xor	ecx, ecx
push	edi
inc	ecx
xor	edi, edi
cmp	[esi+4], ecx
jg	short loc_1011ACA
cmp	[esi+0Ch], ecx
jnz	short loc_1011ACA
cmp	[esi+8], edi
jnz	short loc_1011ACA
mov	eax, [ebp+arg_0]
mov	eax, [eax]
mov	ecx, [eax]
imul	ecx, [esi]
mov	[eax], ecx
jmp	short loc_1011B27

loc_1011ACA:
push	ebx
mov	ebx, [ebp+arg_0]
mov	eax, [ebx]
cmp	[eax+4], ecx
jg	short loc_1011B1C
cmp	[eax+0Ch], ecx
jnz	short loc_1011B1C
cmp	[eax+8], edi
jnz	short loc_1011B1C
mov	ecx, [eax]
push	eax
mov	[ebp+arg_0], ecx
call	sub_1007BC1
mov	[ebx], edi
push	dword ptr [esi+4]
call	sub_1007BFB
mov	[ebx], eax
mov	ecx, [esi+4]
lea	ecx, ds:0Ch[ecx*4]
mov	edi, eax
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	ebx, [ebx]
mov	eax, [ebx]
imul	eax, [ebp+arg_0]
mov	[ebx], eax
jmp	short loc_1011B26

loc_1011B1C:
push	[ebp+arg_8]
push	esi
push	ebx
call	sub_10117A5

loc_1011B26:
pop	ebx

loc_1011B27:
pop	edi
pop	esi
pop	ebp
retn	0Ch
sub_1011AA0 endp



; Attributes: bp-based frame

sub_1011B2D proc near

var_8= dword ptr -8
var_4= dword ptr -4
arg_0= dword ptr  8
arg_4= dword ptr  0Ch
arg_8= dword ptr  10h

push	ebp
mov	ebp, esp
push	ecx
push	ecx
mov	eax, [ebp+arg_0]
push	esi
mov	esi, [ebp+arg_4]
push	esi
push	dword ptr [eax]
call	sub_1011990
test	eax, eax
jnz	loc_1011C7B
push	ebx
push	edi
jmp	short loc_1011B50

loc_1011B4D:
mov	esi, [ebp+arg_4]

loc_1011B50:
cmp	dword_1014F58, 0
jnz	loc_1011C79
push	0
call	sub_1007BC1
push	dword ptr [esi+4]
call	sub_1007BFB
mov	ecx, [esi+4]
lea	ecx, ds:0Ch[ecx*4]
mov	ebx, eax
mov	eax, ecx
shr	ecx, 2
mov	edi, ebx
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	esi, [ebp+arg_0]
mov	edi, [esi]
push	edi
push	ebx
mov	[ebp+var_8], ebx
call	sub_1011990
test	eax, eax
jz	short loc_1011BBD
mov	eax, [edi+8]
add	eax, [edi+4]
sub	eax, [ebx+4]
mov	[ebx+8], eax
mov	ecx, [esi]
mov	edx, [ecx+4]
mov	edi, [ebx+4]
mov	ecx, [ecx+edx*4+8]
cmp	ecx, [ebx+edi*4+8]
ja	short loc_1011BBD
dec	eax
mov	[ebx+8], eax

loc_1011BBD:
push	0
call	sub_1007BC1
push	[ebp+arg_8]
push	0
call	sub_1007C4C
push	dword ptr [esi]
mov	[ebp+var_4], eax
push	ebx
call	sub_1011990
test	eax, eax
jz	short loc_1011C2E

loc_1011BDD:
push	[ebp+var_4]
call	sub_1007BC1
push	dword ptr [ebx+4]
call	sub_1007BFB
mov	ecx, [ebx+4]
push	[ebp+arg_8]
lea	ecx, ds:0Ch[ecx*4]
mov	edi, eax
mov	eax, ecx
shr	ecx, 2
mov	[ebp+var_4], edi
mov	esi, ebx
rep movsd
mov	ecx, eax
push	ebx
lea	eax, [ebp+var_8]
and	ecx, 3
push	eax
rep movsb
call	sub_1011A3C
mov	eax, [ebp+arg_0]
push	dword ptr [eax]
mov	ebx, [ebp+var_8]
push	ebx
call	sub_1011990
test	eax, eax
jnz	short loc_1011BDD
mov	esi, [ebp+arg_0]

loc_1011C2E:
push	ebx
push	dword ptr [esi]
call	sub_1011990
test	eax, eax
jz	short loc_1011C47
push	ebx
call	sub_1007BC1
mov	ebx, [ebp+var_4]
and	[ebp+var_4], 0

loc_1011C47:
mov	eax, [esi]
push	[ebp+arg_8]
mov	eax, [eax]
push	ebx
neg	eax
push	esi
mov	[ebx], eax
call	sub_1011A3C
push	ebx
call	sub_1007BC1
push	[ebp+var_4]
call	sub_1007BC1
push	[ebp+arg_4]
push	dword ptr [esi]
call	sub_1011990
test	eax, eax
jz	loc_1011B4D

loc_1011C79:
pop	edi
pop	ebx

loc_1011C7B:
pop	esi
leave
retn	0Ch
sub_1011B2D endp



; Attributes: bp-based frame

sub_1011C80 proc near

var_18=	dword ptr -18h
var_14=	dword ptr -14h
var_10=	dword ptr -10h
var_C= dword ptr -0Ch
var_8= dword ptr -8
var_4= dword ptr -4
arg_0= dword ptr  8
arg_4= dword ptr  0Ch
arg_8= dword ptr  10h

push	ebp
mov	ebp, esp
sub	esp, 18h
mov	eax, [ebp+arg_0]
push	esi
mov	esi, [eax]
mov	eax, [esi+4]
push	edi
mov	edi, dword_1014F5C
add	edi, 2
cmp	edi, eax
mov	[ebp+var_8], edi
mov	[ebp+var_18], esi
jge	short loc_1011CA8
mov	[ebp+var_8], eax
mov	edi, eax

loc_1011CA8:
push	ebx
mov	ebx, [ebp+arg_4]
mov	eax, [ebx+4]
cmp	edi, eax
jge	short loc_1011CB8
mov	[ebp+var_8], eax
mov	edi, eax

loc_1011CB8:
lea	eax, [edi+1]
push	eax
call	sub_1007BFB
mov	ecx, [esi+8]
sub	ecx, [ebx+4]
mov	edx, [esi+4]
sub	ecx, [ebx+8]
mov	[ebp+var_C], eax
lea	ecx, [ecx+edx+1]
mov	[eax+8], ecx
mov	ecx, [esi]
imul	ecx, [ebx]
mov	[eax], ecx
lea	eax, [eax+edi*4+0Ch]
push	0
mov	[ebp+var_4], eax
call	sub_1007BC1
push	dword ptr [esi+4]
call	sub_1007BFB
mov	ecx, [esi+4]
lea	ecx, ds:0Ch[ecx*4]
mov	edi, eax
mov	[ebp+var_10], eax
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
push	0
rep movsb
call	sub_1007BC1
push	dword ptr [ebx+4]
call	sub_1007BFB
mov	ecx, [ebx+4]
lea	ecx, ds:0Ch[ecx*4]
mov	edx, ecx
shr	ecx, 2
mov	edi, eax
mov	esi, ebx
rep movsd
mov	ecx, edx
and	ecx, 3
rep movsb
mov	ecx, [ebp+var_18]
mov	ecx, [ecx]
mov	esi, [ebp+var_10]
mov	[eax], ecx
mov	[ebp+var_14], eax
mov	eax, [ebx+4]
sub	eax, [esi+4]
push	0Ch		; uBytes
add	eax, [ebx+8]
push	40h		; uFlags
mov	[esi+8], eax
call	ds:LocalAlloc
mov	edi, [ebp+arg_8]
push	edi
push	0
mov	ebx, eax
call	sub_1007C4C
and	dword ptr [ebx+8], 0
cmp	edi, 1
mov	[ebx], eax
jle	short loc_1011DDA
dec	edi
mov	[ebp+arg_4], edi

loc_1011D7B:		; uBytes
push	0Ch
push	40h		; uFlags
call	ds:LocalAlloc
mov	esi, eax
xor	edi, edi
push	edi
mov	[ebp+var_18], esi
mov	[esi], edi
call	sub_1007BC1
mov	[esi], edi
mov	eax, [ebx]
push	dword ptr [eax+4]
call	sub_1007BFB
push	[ebp+arg_8]
mov	[esi], eax
mov	esi, [ebx]
mov	ecx, [esi+4]
push	[ebp+var_14]
lea	ecx, ds:0Ch[ecx*4]
mov	edi, eax
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	esi, [ebp+var_18]
push	esi
call	sub_1011A3C
dec	[ebp+arg_4]
mov	[esi+8], ebx
mov	ebx, esi
jnz	short loc_1011D7B
mov	esi, [ebp+var_10]

loc_1011DDA:
push	[ebp+var_14]
call	sub_1007BC1
and	[ebp+arg_4], 0
cmp	[ebp+var_8], 0
jle	short loc_1011E50

loc_1011DEC:
inc	[ebp+arg_4]
push	esi
call	sub_1011A18
test	eax, eax
jnz	short loc_1011E53
mov	eax, [ebp+arg_8]
dec	eax
mov	edi, ebx
mov	[ebp+var_14], eax

loc_1011E02:
push	dword ptr [edi]
push	esi
call	sub_1011990
test	eax, eax
jz	short loc_1011E1A
dec	[ebp+var_14]
jz	short loc_1011E39
mov	edi, [edi+8]
test	edi, edi
jnz	short loc_1011E02

loc_1011E1A:
cmp	[ebp+var_14], 0
jz	short loc_1011E39
mov	eax, [edi]
push	[ebp+arg_8]
neg	dword ptr [eax]
push	dword ptr [edi]
lea	eax, [ebp+var_10]
push	eax
call	sub_1011A3C
mov	edi, [edi]
neg	dword ptr [edi]
mov	esi, [ebp+var_10]

loc_1011E39:
mov	eax, [ebp+var_14]
mov	ecx, [ebp+var_4]
inc	dword ptr [esi+8]
sub	[ebp+var_4], 4
mov	[ecx], eax
mov	eax, [ebp+var_8]
cmp	[ebp+arg_4], eax
jl	short loc_1011DEC

loc_1011E50:
inc	[ebp+arg_4]

loc_1011E53:
mov	edi, [ebp+var_C]
add	[ebp+var_4], 4
dec	[ebp+arg_4]
add	edi, 0Ch
cmp	edi, [ebp+var_4]
jz	short loc_1011E70
mov	ecx, [ebp+arg_4]
mov	esi, [ebp+var_4]
rep movsd
mov	esi, [ebp+var_10]

loc_1011E70:
mov	edi, ebx

loc_1011E72:
push	dword ptr [edi]
mov	ebx, [ebx+8]
call	sub_1007BC1
and	dword ptr [edi], 0
push	edi		; hMem
call	ds:LocalFree
test	ebx, ebx
mov	edi, ebx
jnz	short loc_1011E72
mov	ecx, [ebp+arg_4]
test	ecx, ecx
pop	ebx
jnz	short loc_1011EA3
mov	edi, [ebp+var_C]
and	[edi+8], ecx
mov	dword ptr [edi+4], 1
jmp	short loc_1011ECF

loc_1011EA3:
mov	eax, [ebp+var_C]
sub	[eax+8], ecx
cmp	ecx, 1
mov	[eax+4], ecx
jle	short loc_1011ECC

loc_1011EB1:
mov	ecx, [ebp+var_C]
mov	eax, [ecx+4]
cmp	dword ptr [ecx+eax*4+8], 0
jnz	short loc_1011ECC
lea	ecx, [eax-1]
cmp	ecx, 1
mov	eax, [ebp+var_C]
mov	[eax+4], ecx
jg	short loc_1011EB1

loc_1011ECC:
mov	edi, [ebp+var_C]

loc_1011ECF:
push	esi
call	sub_1007BC1
mov	esi, [ebp+arg_0]
push	dword ptr [esi]
call	sub_1007BC1
mov	[esi], edi
pop	edi
pop	esi
leave
retn	0Ch
sub_1011C80 endp




sub_1011EE7 proc near

arg_0= dword ptr  4
arg_4= dword ptr  8
arg_8= dword ptr  0Ch

mov	eax, [esp+arg_4]
cmp	dword ptr [eax+4], 1
jg	short loc_1011F0C
cmp	dword ptr [eax+0Ch], 1
jnz	short loc_1011F0C
cmp	dword ptr [eax+8], 0
jnz	short loc_1011F0C
mov	ecx, [esp+arg_0]
mov	ecx, [ecx]
mov	edx, [ecx]
imul	edx, [eax]
mov	[ecx], edx
jmp	short locret_1011F1A

loc_1011F0C:
push	[esp+arg_8]
push	eax
push	[esp+8+arg_0]
call	sub_1011C80

locret_1011F1A:
retn	0Ch
sub_1011EE7 endp



; Attributes: bp-based frame

sub_1011F1D proc near

var_34=	dword ptr -34h
var_30=	dword ptr -30h
var_2C=	dword ptr -2Ch
var_28=	dword ptr -28h
var_24=	dword ptr -24h
var_20=	dword ptr -20h
var_1C=	dword ptr -1Ch
var_18=	dword ptr -18h
var_14=	dword ptr -14h
var_10=	dword ptr -10h
var_C= dword ptr -0Ch
var_8= dword ptr -8
var_4= dword ptr -4
arg_0= dword ptr  8
arg_4= dword ptr  0Ch

push	ebp
mov	ebp, esp
sub	esp, 34h
xor	eax, eax
push	ebx
mov	[ebp+var_34], eax
mov	[ebp+var_30], eax
mov	[ebp+var_4], eax
mov	eax, [ebp+arg_0]
push	esi
mov	esi, [eax]
mov	eax, [ebp+arg_4]
mov	eax, [eax+4]
mov	ecx, [esi+4]
lea	ebx, [eax+ecx-1]
push	edi
lea	eax, [ebx+1]
push	eax
call	sub_1007BFB
mov	ecx, [ebp+arg_4]
mov	edi, eax
mov	[edi+4], ebx
mov	eax, [esi]
imul	eax, [ecx]
mov	[edi], eax
mov	eax, [esi+8]
add	eax, [ecx+8]
lea	ebx, [esi+0Ch]
mov	[edi+8], eax
mov	esi, [esi+4]
test	esi, esi
lea	edx, [edi+0Ch]
mov	[ebp+var_C], esi
jle	loc_1012075

loc_1011F78:
mov	eax, [ebx]
mov	[ebp+var_18], eax
lea	eax, [ecx+0Ch]
mov	[ebp+var_10], eax
mov	eax, [ecx+4]
add	ebx, 4
mov	[ebp+var_14], edx
add	edx, 4
test	eax, eax
mov	[ebp+var_20], ebx
mov	[ebp+var_24], edx
mov	[ebp+var_8], eax
jle	loc_1012058

loc_1011FA0:
mov	eax, [ebp+var_10]
mov	eax, [eax]
and	[ebp+var_2C], 0
and	[ebp+var_28], 0
mov	[ebp+var_1C], eax
mov	eax, [ebp+var_1C]
mul	[ebp+var_18]
mov	esi, eax
or	esi, edx
mov	[ebp+var_30], edx
mov	[ebp+var_34], eax
jz	short loc_1011FD5
and	[ebp+var_4], 0
cmp	[ebp+var_8], 1
jnz	short loc_1011FD5
cmp	[ebp+var_C], 1
jnz	short loc_1011FD5
inc	dword ptr [edi+4]

loc_1011FD5:
mov	edx, eax
or	edx, [ebp+var_30]
jnz	short loc_1011FE4
mov	edx, [ebp+var_2C]
or	edx, [ebp+var_28]
jz	short loc_1012040

loc_1011FE4:
mov	edx, [ebp+var_4]
mov	ecx, [ebp+var_14]
lea	ecx, [ecx+edx*4]
mov	esi, [ecx]
and	eax, 7FFFFFFFh
xor	edx, edx
xor	ebx, ebx
add	eax, esi
adc	edx, ebx
add	[ebp+var_2C], eax
mov	eax, [ebp+var_2C]
adc	[ebp+var_28], edx
and	eax, 7FFFFFFFh
inc	[ebp+var_4]
mov	[ecx], eax
mov	eax, [ebp+var_34]
mov	edx, [ebp+var_30]
shrd	eax, edx, 1Fh
shr	edx, 1Fh
mov	[ebp+var_34], eax
mov	[ebp+var_30], edx
mov	eax, [ebp+var_2C]
mov	edx, [ebp+var_28]
shrd	eax, edx, 1Fh
shr	edx, 1Fh
mov	[ebp+var_2C], eax
mov	[ebp+var_28], edx
mov	eax, [ebp+var_34]
mov	ebx, [ebp+var_20]
mov	ecx, [ebp+arg_4]
jmp	short loc_1011FD5

loc_1012040:
add	[ebp+var_10], 4
add	[ebp+var_14], 4
dec	[ebp+var_8]
cmp	[ebp+var_8], 0
jg	loc_1011FA0
mov	edx, [ebp+var_24]

loc_1012058:
dec	[ebp+var_C]
cmp	[ebp+var_C], 0
jg	loc_1011F78
jmp	short loc_1012075

loc_1012067:
mov	eax, [edi+4]
cmp	dword ptr [edi+eax*4+8], 0
jnz	short loc_101207B
dec	eax
mov	[edi+4], eax

loc_1012075:
cmp	dword ptr [edi+4], 1
jg	short loc_1012067

loc_101207B:
mov	esi, [ebp+arg_0]
push	dword ptr [esi]
call	sub_1007BC1
mov	[esi], edi
pop	edi
pop	esi
pop	ebx
leave
retn	8
sub_1011F1D endp



; Attributes: bp-based frame

sub_101208E proc near

var_1C=	dword ptr -1Ch
var_18=	dword ptr -18h
var_14=	dword ptr -14h
var_10=	dword ptr -10h
var_C= dword ptr -0Ch
var_8= dword ptr -8
var_4= dword ptr -4
arg_0= dword ptr  8
arg_4= dword ptr  0Ch

push	ebp
mov	ebp, esp
sub	esp, 1Ch
mov	eax, dword_1014F5C
mov	ecx, dword_1014F40
and	[ebp+var_4], 0
and	[ebp+var_8], 0
push	ebx
push	esi
push	edi
lea	edi, [ecx+eax]
mov	eax, [ebp+arg_0]
mov	esi, [eax]
mov	eax, [esi+4]
cmp	edi, eax
mov	[ebp+var_C], edi
jge	short loc_10120C1
mov	[ebp+var_C], eax
mov	edi, eax

loc_10120C1:
mov	ebx, [ebp+arg_4]
mov	eax, [ebx+4]
cmp	edi, eax
jge	short loc_10120D0
mov	[ebp+var_C], eax
mov	edi, eax

loc_10120D0:
lea	eax, [edi+1]
push	eax
call	sub_1007BFB
mov	ecx, [esi+8]
sub	ecx, [ebx+4]
mov	edx, [esi+4]
sub	ecx, [ebx+8]
and	[ebp+arg_4], 0
lea	ecx, [ecx+edx+1]
mov	[eax+8], ecx
mov	ecx, [esi]
imul	ecx, [ebx]
mov	[eax], ecx
push	[ebp+var_8]
mov	[ebp+var_1C], eax
lea	eax, [eax+edi*4+0Ch]
mov	[ebp+var_14], eax
call	sub_1007BC1
and	[ebp+var_8], 0
push	dword ptr [esi+4]
call	sub_1007BFB
mov	[ebp+var_8], eax
mov	ecx, [esi+4]
lea	ecx, ds:0Ch[ecx*4]
mov	edi, eax
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	eax, [ebx]
mov	ecx, [ebp+var_8]
mov	[ecx], eax
mov	ecx, [ebx+4]
mov	eax, [ebp+var_8]
sub	ecx, [eax+4]
add	ecx, [ebx+8]
cmp	[ebp+var_C], 0
mov	[eax+8], ecx
jle	loc_10122AA

loc_1012152:
push	[ebp+var_8]
inc	[ebp+arg_4]
call	sub_1011A18
test	eax, eax
jnz	loc_10122AD
mov	eax, [ebp+var_14]
and	dword ptr [eax], 0
jmp	loc_1012283

loc_1012170:
push	[ebp+var_4]
mov	[ebp+var_18], 1
call	sub_1007BC1
push	dword ptr [ebx+4]
and	[ebp+var_4], 0
call	sub_1007BFB
mov	ecx, [ebx+4]
lea	ecx, ds:0Ch[ecx*4]
mov	[ebp+var_4], eax
mov	edi, eax
mov	eax, ecx
shr	ecx, 2
mov	esi, ebx
rep movsd
mov	ecx, eax
and	ecx, 3
push	0
rep movsb
call	sub_1007BC1
push	80000000h
push	0
call	sub_1007C4C
mov	[ebp+var_10], eax
jmp	short loc_1012215

loc_10121C2:
push	[ebp+var_10]
call	sub_1007BC1
push	0
call	sub_1007BC1
mov	eax, [ebp+var_4]
push	dword ptr [eax+4]
call	sub_1007BFB
mov	esi, [ebp+var_4]
mov	ecx, [esi+4]
lea	ecx, ds:0Ch[ecx*4]
mov	edi, eax
mov	eax, ecx
shr	ecx, 2
mov	[ebp+var_10], edi
rep movsd
mov	ecx, eax
and	ecx, 3
push	80000000h
rep movsb
push	[ebp+var_4]
lea	eax, [ebp+var_4]
push	eax
call	sub_1011A3C
mov	eax, [ebp+var_18]
add	eax, eax
mov	[ebp+var_18], eax

loc_1012215:
push	[ebp+var_8]
push	[ebp+var_4]
call	sub_1011990
test	eax, eax
jnz	short loc_10121C2
push	[ebp+var_4]
push	[ebp+var_8]
call	sub_1011990
test	eax, eax
jz	short loc_1012251
push	[ebp+var_4]
call	sub_1007BC1
mov	eax, [ebp+var_18]
cdq
sub	eax, edx
sar	eax, 1
mov	esi, eax
mov	eax, [ebp+var_10]
and	[ebp+var_10], 0
mov	[ebp+var_4], eax
jmp	short loc_1012257

loc_1012251:
mov	eax, [ebp+var_4]
mov	esi, [ebp+var_18]

loc_1012257:
neg	dword ptr [eax]
push	80000000h
push	[ebp+var_4]
lea	eax, [ebp+var_8]
push	eax
call	sub_1011A3C
push	[ebp+var_4]
call	sub_1007BC1
push	[ebp+var_10]
and	[ebp+var_4], 0
call	sub_1007BC1
mov	eax, [ebp+var_14]
or	[eax], esi

loc_1012283:
push	ebx
push	[ebp+var_8]
call	sub_1011990
test	eax, eax
jz	loc_1012170
mov	eax, [ebp+var_8]
inc	dword ptr [eax+8]
mov	eax, [ebp+var_C]
sub	[ebp+var_14], 4
cmp	[ebp+arg_4], eax
jl	loc_1012152

loc_10122AA:
inc	[ebp+arg_4]

loc_10122AD:
mov	esi, [ebp+var_14]
mov	ebx, [ebp+var_1C]
dec	[ebp+arg_4]
mov	eax, [ebp+arg_4]
add	esi, 4
lea	edi, [ebx+0Ch]
cmp	edi, esi
jz	short loc_10122C7
mov	ecx, eax
rep movsd

loc_10122C7:
xor	esi, esi
cmp	eax, esi
jnz	short loc_10122D9
mov	[ebx+8], esi
mov	dword ptr [ebx+4], 1
jmp	short loc_10122F6

loc_10122D9:
sub	[ebx+8], eax
cmp	eax, 1
mov	[ebx+4], eax
jle	short loc_10122F6

loc_10122E4:
mov	eax, [ebx+4]
cmp	[ebx+eax*4+8], esi
jnz	short loc_10122F6
dec	eax
cmp	eax, 1
mov	[ebx+4], eax
jg	short loc_10122E4

loc_10122F6:
push	[ebp+var_8]
call	sub_1007BC1
mov	[ebp+var_8], esi
mov	esi, [ebp+arg_0]
push	dword ptr [esi]
call	sub_1007BC1
pop	edi
mov	[esi], ebx
pop	esi
pop	ebx
leave
retn	8
sub_101208E endp



; Attributes: bp-based frame

sub_1012314 proc near

arg_0= dword ptr  8
arg_4= dword ptr  0Ch

push	ebp
mov	ebp, esp
push	esi
mov	esi, [ebp+arg_4]
xor	ecx, ecx
push	edi
inc	ecx
xor	edi, edi
cmp	[esi+4], ecx
jg	short loc_101233E
cmp	[esi+0Ch], ecx
jnz	short loc_101233E
cmp	[esi+8], edi
jnz	short loc_101233E
mov	eax, [ebp+arg_0]
mov	eax, [eax]
mov	ecx, [eax]
imul	ecx, [esi]
mov	[eax], ecx
jmp	short loc_1012398

loc_101233E:
push	ebx
mov	ebx, [ebp+arg_0]
mov	eax, [ebx]
cmp	[eax+4], ecx
jg	short loc_1012390
cmp	[eax+0Ch], ecx
jnz	short loc_1012390
cmp	[eax+8], edi
jnz	short loc_1012390
mov	ecx, [eax]
push	eax
mov	[ebp+arg_0], ecx
call	sub_1007BC1
mov	[ebx], edi
push	dword ptr [esi+4]
call	sub_1007BFB
mov	[ebx], eax
mov	ecx, [esi+4]
lea	ecx, ds:0Ch[ecx*4]
mov	edi, eax
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	ebx, [ebx]
mov	eax, [ebx]
imul	eax, [ebp+arg_0]
mov	[ebx], eax
jmp	short loc_1012397

loc_1012390:
push	esi
push	ebx
call	sub_1011F1D

loc_1012397:
pop	ebx

loc_1012398:
pop	edi
pop	esi
pop	ebp
retn	8
sub_1012314 endp



; Attributes: bp-based frame

sub_101239E proc near

var_4= dword ptr -4
arg_0= dword ptr  8
arg_4= dword ptr  0Ch

push	ebp
mov	ebp, esp
push	ecx
push	ebx
push	esi
push	80000000h
push	1
call	sub_1007C4C
mov	ebx, [ebp+arg_4]
mov	esi, [ebp+arg_0]
mov	[ebp+var_4], eax
jmp	short loc_10123D5

loc_10123BB:
test	bl, 1
jz	short loc_10123CB
push	dword ptr [esi]
lea	eax, [ebp+var_4]
push	eax
call	sub_1012314

loc_10123CB:
push	dword ptr [esi]
push	esi
call	sub_1012314
sar	ebx, 1

loc_10123D5:
test	ebx, ebx
jg	short loc_10123BB
push	dword ptr [esi]
call	sub_1007BC1
mov	eax, [ebp+var_4]
mov	[esi], eax
pop	esi
pop	ebx
leave
retn	8
sub_101239E endp



; Attributes: bp-based frame

sub_10123EB proc near

arg_0= dword ptr  8
arg_4= dword ptr  0Ch

push	ebp
mov	ebp, esp
push	esi
mov	esi, [ebp+arg_4]
xor	ecx, ecx
push	edi
inc	ecx
xor	edi, edi
cmp	[esi+4], ecx
jg	short loc_1012415
cmp	[esi+0Ch], ecx
jnz	short loc_1012415
cmp	[esi+8], edi
jnz	short loc_1012415
mov	eax, [ebp+arg_0]
mov	eax, [eax]
mov	ecx, [eax]
imul	ecx, [esi]
mov	[eax], ecx
jmp	short loc_101246F

loc_1012415:
push	ebx
mov	ebx, [ebp+arg_0]
mov	eax, [ebx]
cmp	[eax+4], ecx
jg	short loc_1012467
cmp	[eax+0Ch], ecx
jnz	short loc_1012467
cmp	[eax+8], edi
jnz	short loc_1012467
mov	ecx, [eax]
push	eax
mov	[ebp+arg_0], ecx
call	sub_1007BC1
mov	[ebx], edi
push	dword ptr [esi+4]
call	sub_1007BFB
mov	[ebx], eax
mov	ecx, [esi+4]
lea	ecx, ds:0Ch[ecx*4]
mov	edi, eax
mov	eax, ecx
shr	ecx, 2
rep movsd
mov	ecx, eax
and	ecx, 3
rep movsb
mov	ebx, [ebx]
mov	eax, [ebx]
imul	eax, [ebp+arg_0]
mov	[ebx], eax
jmp	short loc_101246E

loc_1012467:
push	esi
push	ebx
call	sub_101208E

loc_101246E:
pop	ebx

loc_101246F:
pop	edi
pop	esi
pop	ebp
retn	8
sub_10123EB endp

assume fs:nothing, gs:nothing


; Attributes: bp-based frame

public start
start proc near

Code= dword ptr	-80h
var_7C=	dword ptr -7Ch
StartupInfo= _STARTUPINFOA ptr -78h
var_34=	dword ptr -34h
var_30=	dword ptr -30h
var_2C=	byte ptr -2Ch
var_28=	byte ptr -28h
var_24=	byte ptr -24h
var_20=	dword ptr -20h
var_1C=	dword ptr -1Ch
ms_exc=	CPPEH_RECORD ptr -18h

push	70h
push	offset stru_10015E0
call	__SEH_prolog
xor	ebx, ebx
push	ebx		; lpModuleName
mov	edi, ds:GetModuleHandleA
call	edi ; GetModuleHandleA
cmp	word ptr [eax],	5A4Dh
jnz	short loc_10124B2
mov	ecx, [eax+3Ch]
add	ecx, eax
cmp	dword ptr [ecx], 4550h
jnz	short loc_10124B2
movzx	eax, word ptr [ecx+18h]
cmp	eax, 10Bh
jz	short loc_10124CA
cmp	eax, 20Bh
jz	short loc_10124B7

loc_10124B2:
mov	[ebp+var_1C], ebx
jmp	short loc_10124DE

loc_10124B7:
cmp	dword ptr [ecx+84h], 0Eh
jbe	short loc_10124B2
xor	eax, eax
cmp	[ecx+0F8h], ebx
jmp	short loc_10124D8

loc_10124CA:
cmp	dword ptr [ecx+74h], 0Eh
jbe	short loc_10124B2
xor	eax, eax
cmp	[ecx+0E8h], ebx

loc_10124D8:
setnz	al
mov	[ebp+var_1C], eax

loc_10124DE:
mov	[ebp+ms_exc.registration.TryLevel], ebx
push	2
call	ds:__set_app_type
pop	ecx
or	dword_1015010, 0FFFFFFFFh
or	dword_1015014, 0FFFFFFFFh
call	ds:__p__fmode
mov	ecx, dword_101500C
mov	[eax], ecx
call	ds:__p__commode
mov	ecx, dword_1015008
mov	[eax], ecx
mov	eax, ds:_adjust_fdiv
mov	eax, [eax]
mov	dword_1015018, eax
call	sub_10127C2
cmp	dword_10149D0, ebx
jnz	short loc_1012539
push	offset sub_10127C2
call	ds:__setusermatherr
pop	ecx

loc_1012539:
call	sub_10127B0
push	offset dword_1001234
push	offset dword_1001230
call	_initterm
mov	eax, dword_1015004
mov	[ebp+var_20], eax
lea	eax, [ebp+var_20]
push	eax
push	dword_1015000
lea	eax, [ebp+var_24]
push	eax
lea	eax, [ebp+var_28]
push	eax
lea	eax, [ebp+var_2C]
push	eax
call	ds:__getmainargs
mov	[ebp+var_30], eax
push	offset dword_100122C
push	offset dword_1001228
call	_initterm
add	esp, 24h
mov	eax, ds:_acmdln
mov	esi, [eax]
mov	[ebp+var_34], esi
cmp	byte ptr [esi],	22h
jnz	short loc_10125CF

loc_1012595:
inc	esi
mov	[ebp+var_34], esi
mov	al, [esi]
cmp	al, bl
jz	short loc_10125A3
cmp	al, 22h
jnz	short loc_1012595

loc_10125A3:
cmp	byte ptr [esi],	22h
jnz	short loc_10125AC

loc_10125A8:
inc	esi
mov	[ebp+var_34], esi

loc_10125AC:
mov	al, [esi]
cmp	al, bl
jz	short loc_10125B6
cmp	al, 20h
jbe	short loc_10125A8

loc_10125B6:
mov	[ebp+StartupInfo.dwFlags], ebx
lea	eax, [ebp+StartupInfo]
push	eax		; lpStartupInfo
call	ds:GetStartupInfoA
test	byte ptr [ebp+StartupInfo.dwFlags], 1
jz	short loc_10125DA
movzx	eax, [ebp+StartupInfo.wShowWindow]
jmp	short loc_10125DD

loc_10125CF:
cmp	byte ptr [esi],	20h
jbe	short loc_10125AC
inc	esi
mov	[ebp+var_34], esi
jmp	short loc_10125CF

loc_10125DA:
push	0Ah
pop	eax

loc_10125DD:
push	eax
push	esi
push	ebx
push	ebx		; lpModuleName
call	edi ; GetModuleHandleA
push	eax
call	sub_1001F51
mov	esi, eax
mov	[ebp+var_7C], esi
cmp	[ebp+var_1C], ebx
jnz	short loc_10125FA
push	esi		; Code
call	ds:exit

loc_10125FA:
call	ds:_cexit
jmp	short loc_101262F

loc_1012602:		; Exception filter 0 for function 1012475
mov	eax, [ebp+ms_exc.exc_ptr]
mov	ecx, [eax]
mov	ecx, [ecx]
mov	[ebp+Code], ecx
push	eax
push	ecx
call	_XcptFilter
pop	ecx
pop	ecx
retn

loc_1012616:		; Exception handler 0 for function 1012475
mov	esp, [ebp+ms_exc.old_esp]
mov	esi, [ebp+Code]
cmp	[ebp+var_1C], 0
jnz	short loc_1012629
push	esi		; Code
call	ds:_exit

loc_1012629:
call	ds:_c_exit

loc_101262F:
or	[ebp+ms_exc.registration.TryLevel], 0FFFFFFFFh
mov	eax, esi
call	__SEH_epilog
retn
start endp

align 4
; [00000006 BYTES: COLLAPSED FUNCTION __CxxFrameHandler. PRESS KEYPAD CTRL-"+" TO EXPAND]
align 10h



sub_1012650 proc near
push	0FFFFFFFFh
push	eax
mov	eax, large fs:0
push	eax
mov	eax, [esp+0Ch]
mov	large fs:0, esp
mov	[esp+0Ch], ebp
lea	ebp, [esp+0Ch]
push	eax
retn
sub_1012650 endp ; sp-analysis failed

align 10h
; [00000006 BYTES: COLLAPSED FUNCTION _CxxThrowException. PRESS	KEYPAD CTRL-"+"	TO EXPAND]



; int __thiscall sub_1012676(void *, char)
sub_1012676 proc near

arg_0= byte ptr	 4

push	ebx
mov	bl, [esp+4+arg_0]
test	bl, 2
push	esi
mov	esi, ecx
jz	short loc_10126A7
push	edi
push	offset ??1type_info@@UAE@XZ ; type_info::~type_info(void)
lea	edi, [esi-4]
push	dword ptr [edi]
push	0Ch
push	esi
call	sub_1012876
test	bl, 1
jz	short loc_10126A2
push	edi		; void *
call	??3@YAXPAX@Z	; operator delete(void *)
pop	ecx

loc_10126A2:
mov	eax, edi
pop	edi
jmp	short loc_10126BC

loc_10126A7:
mov	ecx, esi
call	??1type_info@@UAE@XZ ; type_info::~type_info(void)
test	bl, 1
jz	short loc_10126BA
push	esi		; void *
call	??3@YAXPAX@Z	; operator delete(void *)
pop	ecx

loc_10126BA:
mov	eax, esi

loc_10126BC:
pop	esi
pop	ebx
retn	4
sub_1012676 endp

align 10h



sub_10126D0 proc near

arg_0= dword ptr  4
arg_4= dword ptr  8
arg_8= dword ptr  0Ch
arg_C= dword ptr  10h

push	esi
mov	eax, [esp+4+arg_C]
or	eax, eax
jnz	short loc_1012701
mov	ecx, [esp+4+arg_8]
mov	eax, [esp+4+arg_4]
xor	edx, edx
div	ecx
mov	ebx, eax
mov	eax, [esp+4+arg_0]
div	ecx
mov	esi, eax
mov	eax, ebx
mul	[esp+4+arg_8]
mov	ecx, eax
mov	eax, esi
mul	[esp+4+arg_8]
add	edx, ecx
jmp	short loc_1012748

loc_1012701:
mov	ecx, eax
mov	ebx, [esp+4+arg_8]
mov	edx, [esp+4+arg_4]
mov	eax, [esp+4+arg_0]

loc_101270F:
shr	ecx, 1
rcr	ebx, 1
shr	edx, 1
rcr	eax, 1
or	ecx, ecx
jnz	short loc_101270F
div	ebx
mov	esi, eax
mul	[esp+4+arg_C]
mov	ecx, eax
mov	eax, [esp+4+arg_8]
mul	esi
add	edx, ecx
jb	short loc_101273D
cmp	edx, [esp+4+arg_4]
ja	short loc_101273D
jb	short loc_1012746
cmp	eax, [esp+4+arg_0]
jbe	short loc_1012746

loc_101273D:
dec	esi
sub	eax, [esp+4+arg_8]
sbb	edx, [esp+4+arg_C]

loc_1012746:
xor	ebx, ebx

loc_1012748:
sub	eax, [esp+4+arg_0]
sbb	edx, [esp+4+arg_4]
neg	edx
neg	eax
sbb	edx, 0
mov	ecx, edx
mov	edx, ebx
mov	ebx, ecx
mov	ecx, eax
mov	eax, esi
pop	esi
retn	10h
sub_10126D0 endp

align 10h



sub_1012770 proc near

arg_0= dword ptr  4
arg_4= dword ptr  8
arg_8= dword ptr  0Ch
arg_C= dword ptr  10h

mov	eax, [esp+arg_4]
mov	ecx, [esp+arg_C]
or	ecx, eax
mov	ecx, [esp+arg_8]
jnz	short loc_1012789
mov	eax, [esp+arg_0]
mul	ecx
retn	10h

loc_1012789:
push	ebx
mul	ecx
mov	ebx, eax
mov	eax, [esp+4+arg_0]
mul	[esp+4+arg_C]
add	ebx, eax
mov	eax, [esp+4+arg_0]
mul	ecx
add	edx, ebx
pop	ebx
retn	10h
sub_1012770 endp

; [00000006 BYTES: COLLAPSED FUNCTION _XcptFilter. PRESS KEYPAD	CTRL-"+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION _initterm. PRESS KEYPAD CTRL-"+" TO EXPAND]



sub_10127B0 proc near
push	30000h		; Mask
push	10000h		; NewValue
call	_controlfp
pop	ecx
pop	ecx
retn
sub_10127B0 endp




sub_10127C2 proc near
xor	eax, eax
retn
sub_10127C2 endp

align 4
; [00000039 BYTES: COLLAPSED FUNCTION __SEH_prolog. PRESS KEYPAD CTRL-"+" TO EXPAND]
; [00000011 BYTES: COLLAPSED FUNCTION __SEH_epilog. PRESS KEYPAD CTRL-"+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION operator delete(void *). PRESS KEYPAD CTRL-"+" TO	EXPAND]


; Attributes: bp-based frame

sub_1012818 proc near

var_24=	dword ptr -24h
var_20=	dword ptr -20h
var_1C=	dword ptr -1Ch
ms_exc=	CPPEH_RECORD ptr -18h
arg_0= dword ptr  8
arg_4= dword ptr  0Ch
arg_8= dword ptr  10h
arg_C= dword ptr  14h

; FUNCTION CHUNK AT 01012870 SIZE 00000006 BYTES

push	14h
push	offset stru_10015F0
call	__SEH_prolog
and	[ebp+ms_exc.registration.TryLevel], 0

loc_1012828:
dec	[ebp+arg_8]
js	short loc_101283B
mov	ecx, [ebp+arg_0]
sub	ecx, [ebp+arg_4]
mov	[ebp+arg_0], ecx
call	[ebp+arg_C]
jmp	short loc_1012828

loc_101283B:
or	[ebp+ms_exc.registration.TryLevel], 0FFFFFFFFh
call	__SEH_epilog
retn	10h

loc_1012847:		; Exception filter 0 for function 1012818
mov	eax, [ebp+ms_exc.exc_ptr]
mov	[ebp+var_1C], eax
mov	eax, [ebp+var_1C]
mov	eax, [eax]
mov	[ebp+var_20], eax
mov	eax, [ebp+var_20]
cmp	dword ptr [eax], 0E06D7363h
jz	short loc_1012870
mov	[ebp+var_24], 0
mov	eax, [ebp+var_24]
retn

loc_101286B:		; Exception handler 0 for function 1012818
mov	esp, [ebp+ms_exc.old_esp]
jmp	short loc_101283B
sub_1012818 endp ; sp-analysis failed

; START	OF FUNCTION CHUNK FOR sub_1012818

loc_1012870:		; terminate(void)
call	?terminate@@YAXXZ
align 2
; END OF FUNCTION CHUNK	FOR sub_1012818


; Attributes: bp-based frame

sub_1012876 proc near

var_1C=	dword ptr -1Ch
ms_exc=	CPPEH_RECORD ptr -18h
arg_0= dword ptr  8
arg_4= dword ptr  0Ch
arg_8= dword ptr  10h
arg_C= dword ptr  14h

push	0Ch
push	offset stru_1001600
call	__SEH_prolog
and	[ebp+var_1C], 0
mov	esi, [ebp+arg_4]
mov	eax, esi
imul	eax, [ebp+arg_8]
add	[ebp+arg_0], eax
and	[ebp+ms_exc.registration.TryLevel], 0

loc_1012896:
dec	[ebp+arg_8]
js	short loc_10128A6
sub	[ebp+arg_0], esi
mov	ecx, [ebp+arg_0]
call	[ebp+arg_C]
jmp	short loc_1012896

loc_10128A6:
mov	[ebp+var_1C], 1
or	[ebp+ms_exc.registration.TryLevel], 0FFFFFFFFh
call	loc_10128BE	; Finally handler 0 for	function 1012876

loc_10128B6:
call	__SEH_epilog
retn	10h

loc_10128BE:		; Finally handler 0 for	function 1012876
cmp	[ebp+var_1C], 0
jnz	short loc_10128D5
push	[ebp+arg_C]
push	[ebp+arg_8]
push	[ebp+arg_4]
push	[ebp+arg_0]
call	sub_1012818

loc_10128D5:
retn
sub_1012876 endp

; [00000006 BYTES: COLLAPSED FUNCTION type_info::~type_info(void). PRESS KEYPAD	CTRL-"+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION _controlfp. PRESS	KEYPAD CTRL-"+"	TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION _except_handler3.	PRESS KEYPAD CTRL-"+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION terminate(void). PRESS KEYPAD CTRL-"+" TO	EXPAND]



sub_10128EE proc near
mov	eax, offset stru_1012954
jmp	__CxxFrameHandler
sub_10128EE endp




sub_10128F8 proc near
mov	eax, offset stru_10129A4
jmp	__CxxFrameHandler
sub_10128F8 endp


loc_1012902:
mov	eax, offset stru_10129F4
jmp	__CxxFrameHandler

loc_101290C:
mov	eax, offset stru_1012B14
jmp	__CxxFrameHandler

loc_1012916:
mov	eax, offset stru_1012B64
jmp	__CxxFrameHandler
stru_1012920 _msExcInfo	2 dup(<-1, 0>)
stru_1012930 _msRttiDscr <0, 0,	0, \
	     offset loc_1002066>
stru_1012940 dd	0, 0, 1		     ; _unk
dd 1			; Count
dd offset stru_1012930	; RttiBlkPtr
stru_1012954 _msExcept7	<19930520h, 2, \
	    offset stru_1012920, 1, \
	    offset stru_1012940, 0>
stru_1012970 _msExcInfo	2 dup(<-1, 0>)
stru_1012980 _msRttiDscr <0, 0,	0, \
	     offset loc_1002807>
stru_1012990 dd	0, 0, 1		     ; _unk
dd 1			; Count
dd offset stru_1012980	; RttiBlkPtr
stru_10129A4 _msExcept7	<19930520h, 2, \
	    offset stru_1012970, 1, \
	    offset stru_1012990, 0>
stru_10129C0 _msExcInfo	2 dup(<-1, 0>)
stru_10129D0 _msRttiDscr <0, 0,	0, \
	     offset sub_100434E>
stru_10129E0 dd	0, 0, 1		     ; _unk
dd 1			; Count
dd offset stru_10129D0	; RttiBlkPtr
stru_10129F4 _msExcept7	<19930520h, 2, \
	    offset stru_10129C0, 1, \
	    offset stru_10129E0, 0>
dd 1, 1014088h,	0
dd 0FFFFFFFFh, 0
dd 4, 0
dword_1012A2C dd 1, 1012A10h
dword_1012A34 dd 3 dup(0)
dd offset dword_1012A2C
stru_1012A44 _msExcInfo	<-1, 0>
_msExcInfo 6 dup(<0, 0>)
_msExcInfo <-1,	0>
stru_1012A84 _msRttiDscr <0, offset stru_1014088, \
	     -20, offset loc_1004BB2>
stru_1012A94 _msRttiDscr <0, offset stru_1014088, \
	     -24, offset loc_1004E16>
stru_1012AA4 _msRttiDscr <0, offset stru_1014088, \
	     -40, offset sub_10050A6>
stru_1012AB4 _msRttiDscr <0, offset stru_1014088, \
	     -44, offset sub_10050EC>
stru_1012AC4 dd	1, 1, 2		     ; _unk
dd 1			; Count
dd offset stru_1012A84	; RttiBlkPtr
dd 3, 3, 4		; _unk
dd 1			; Count
dd offset stru_1012A94	; RttiBlkPtr
dd 5, 5, 6		; _unk
dd 1			; Count
dd offset stru_1012AA4	; RttiBlkPtr
dd 0, 6, 7		; _unk
dd 1			; Count
dd offset stru_1012AB4	; RttiBlkPtr
stru_1012B14 _msExcept7	<19930520h, 8, \
	    offset stru_1012A44, 4, \
	    offset stru_1012AC4, 0>
stru_1012B30 _msExcInfo	2 dup(<-1, 0>)
stru_1012B40 _msRttiDscr <0, offset stru_1014088, \
	     -24, offset sub_100609E>
stru_1012B50 dd	0, 0, 1		     ; _unk
dd 1			; Count
dd offset stru_1012B40	; RttiBlkPtr
stru_1012B64 _msExcept7	<19930520h, 2, \
	    offset stru_1012B30, 1, \
	    offset stru_1012B50, 0>
__IMPORT_DESCRIPTOR_SHELL32 dd rva off_1012CA8 ; Import	Name Table
dd 0FFFFFFFFh		; Time stamp
dd 0FFFFFFFFh		; Forwarder Chain
dd rva aShell32_dll	; DLL Name
dd rva ShellAboutW	; Import Address Table
__IMPORT_DESCRIPTOR_msvcrt dd rva off_1012DC8 ;	Import Name Table
dd 0FFFFFFFFh		; Time stamp
dd 0FFFFFFFFh		; Forwarder Chain
dd rva aMsvcrt_dll	; DLL Name
dd rva __imp___CxxFrameHandler ; Import	Address	Table
__IMPORT_DESCRIPTOR_ADVAPI32 dd	rva off_1012C0C	; Import Name Table
dd 0FFFFFFFFh		; Time stamp
dd 0FFFFFFFFh		; Forwarder Chain
dd rva aAdvapi32_dll	; DLL Name
dd rva RegOpenKeyExA	; Import Address Table
__IMPORT_DESCRIPTOR_KERNEL32 dd	rva off_1012C2C	; Import Name Table
dd 0FFFFFFFFh		; Time stamp
dd 0FFFFFFFFh		; Forwarder Chain
dd rva aKernel32_dll	; DLL Name
dd rva GetModuleHandleA	; Import Address Table
__IMPORT_DESCRIPTOR_GDI32 dd rva off_1012C1C ; Import Name Table
dd 0FFFFFFFFh		; Time stamp
dd 0FFFFFFFFh		; Forwarder Chain
dd rva aGdi32_dll	; DLL Name
dd rva SetBkColor	; Import Address Table
__IMPORT_DESCRIPTOR_USER32 dd rva off_1012CB0 ;	Import Name Table
dd 0FFFFFFFFh		; Time stamp
dd 0FFFFFFFFh		; Forwarder Chain
dd rva aUser32_dll	; DLL Name
dd rva GetMenu		; Import Address Table
dd 5 dup(0)
;
; Import names for ADVAPI32.dll
;
off_1012C0C dd rva word_1012FEC
dd rva word_1012FD8
dd rva word_1012FCA
dd 0
;
; Import names for GDI32.dll
;
off_1012C1C dd rva word_10131E2
dd rva word_10131F0
dd rva word_1013200
dd 0
;
; Import names for KERNEL32.dll
;
off_1012C2C dd rva word_10131AE
dd rva word_101319E
dd rva word_101318C
dd rva word_101317C
dd rva word_101316E
dd rva word_1013160
dd rva word_1013150
dd rva word_1013144
dd rva word_101313C
dd rva word_1013126
dd rva word_10131C2
dd rva word_101310A
dd rva word_10130FA
dd rva word_10130EA
dd rva word_10130DA
dd rva word_10130CC
dd rva word_10130C0
dd rva word_10130B4
dd rva word_101309E
dd rva word_1013090
dd rva word_1013084
dd rva word_1013078
dd rva word_1013068
dd rva word_101305C
dd rva word_1013028
dd rva word_1013036
dd rva word_1013118
dd rva word_101300A
dd rva word_101301C
dd rva word_101304A
dd 0
;
; Import names for SHELL32.dll
;
off_1012CA8 dd rva word_1012E34
dd 0
;
; Import names for USER32.dll
;
off_1012CB0 dd rva word_101335C
dd rva word_1013694
dd rva word_1013682
dd rva word_1013670
dd rva word_1013664
dd rva word_1013652
dd rva word_1013646
dd rva word_101363A
dd rva word_1013628
dd rva word_1013618
dd rva word_1013606
dd rva word_10135EE
dd rva word_10135DC
dd rva word_10135BE
dd rva word_10135AC
dd rva word_1013598
dd rva word_1013584
dd rva word_1013574
dd rva word_1013560
dd rva word_1013554
dd rva word_1013542
dd rva word_1013534
dd rva word_1013522
dd rva word_1013516
dd rva word_1013508
dd rva word_10134FA
dd rva word_10134E6
dd rva word_10134D4
dd rva word_10134C8
dd rva word_10134BC
dd rva word_1013216
dd rva word_1013222
dd rva word_1013236
dd rva word_101324A
dd rva word_1013258
dd rva word_1013264
dd rva word_1013276
dd rva word_1013286
dd rva word_1013294
dd rva word_10132A4
dd rva word_10132B6
dd rva word_10132C6
dd rva word_10132DC
dd rva word_10132EC
dd rva word_10132FA
dd rva word_101330C
dd rva word_101331C
dd rva word_101332C
dd rva word_1013338
dd rva word_101334A
dd rva word_1013366
dd rva word_101337C
dd rva word_101338A
dd rva word_1013398
dd rva word_10133A8
dd rva word_10133B2
dd rva word_10133C2
dd rva word_10133DA
dd rva word_10133EE
dd rva word_1013402
dd rva word_101341A
dd rva word_1013424
dd rva word_1013438
dd rva word_1013446
dd rva word_101345A
dd rva word_101346C
dd rva word_101347A
dd rva word_1013488
dd rva word_10134A2
dd 0
;
; Import names for msvcrt.dll
;
off_1012DC8 dd rva word_1012E4E
dd rva word_1012E62
dd rva word_1012E78
dd rva word_1012E82
dd rva word_1012E8C
dd rva word_1012E96
dd rva word_1012EA0
dd rva word_1012EAA
dd rva word_1012EB4
dd rva word_1012EBE
dd rva word_1012EC6
dd rva word_1012ED4
dd rva word_1012EDE
dd rva word_1012EE6
dd rva word_1012EF0
dd rva word_1012F00
dd rva word_1012F0C
dd rva word_1012F20
dd rva word_1012F30
dd rva word_1012F40
dd rva word_1012F4E
dd rva word_1012F6C
dd rva word_1012F7C
dd rva word_1012F94
dd rva word_1012FA2
dd rva word_1012FB6
dd 0
word_1012E34 dw	94h
db 'ShellAboutW',0
aShell32_dll db	'SHELL32.dll',0
word_1012E4E dw	52h
db '__CxxFrameHandler',0
word_1012E62 dw	47h
db '_CxxThrowException',0
align 4
word_1012E78 dw	338h
db 'wcstoul',0
word_1012E82 dw	31Ah
db 'toupper',0
word_1012E8C dw	326h
db 'wcschr',0
align 2
word_1012E96 dw	2DEh
db 'memmove',0
word_1012EA0 dw	32Ch
db 'wcslen',0
align 2
word_1012EAA dw	22Fh
db '_wcsrev',0
word_1012EB4 dw	0C5h
db '_c_exit',0
word_1012EBE dw	0F6h
db '_exit',0
word_1012EC6 dw	4Eh
db '_XcptFilter',0
word_1012ED4 dw	0C8h
db '_cexit',0
align 2
word_1012EDE dw	28Fh
db 'exit',0
align 2
word_1012EE6 dw	0A8h
db '_acmdln',0
word_1012EF0 dw	6Dh
db '__getmainargs',0
word_1012F00 dw	13Ah
db '_initterm',0
word_1012F0C dw	9Ah
db '__setusermatherr',0
align 10h
word_1012F20 dw	0B6h
db '_adjust_fdiv',0
align 10h
word_1012F30 dw	80h
db '__p__commode',0
align 10h
word_1012F40 dw	85h
db '__p__fmode',0
align 2
word_1012F4E dw	98h
db '__set_app_type',0
align 10h
aMsvcrt_dll db 'msvcrt.dll',0
align 4
word_1012F6C dw	12h
db '??3@YAXPAX@Z',0
align 4
word_1012F7C dw	10h
db '??1type_info@@UAE@XZ',0
align 4
word_1012F94 dw	0D6h
db '_controlfp',0
align 2
word_1012FA2 dw	0EDh
db '_except_handler3',0
align 2
word_1012FB6 dw	34h
db '?terminate@@YAXXZ',0
word_1012FCA dw	1C8h
db 'RegCloseKey',0
word_1012FD8 dw	1EBh
db 'RegQueryValueExA',0
align 4
word_1012FEC dw	1E1h
db 'RegOpenKeyExA',0
aAdvapi32_dll db 'ADVAPI32.dll',0
align 2
word_101300A dw	0FEh
db 'GetCommandLineW',0
word_101301C dw	399h
db 'lstrcpyW',0
align 4
word_1013028 dw	234h
db 'LocalAlloc',0
align 2
word_1013036 dw	198h
db 'GetProfileStringW',0
word_101304A dw	194h
db 'GetProfileIntW',0
align 4
word_101305C dw	238h
db 'LocalFree',0
word_1013068 dw	23Bh
db 'LocalReAlloc',0
align 4
word_1013078 dw	39Fh
db 'lstrlenW',0
align 4
word_1013084 dw	390h
db 'lstrcatW',0
align 10h
word_1013090 dw	2Ch
db 'CloseHandle',0
word_101309E dw	365h
db 'WaitForSingleObject',0
word_10130B4 dw	2ECh
db 'SetEvent',0
align 10h
word_10130C0 dw	39Ch
db 'lstrcpynW',0
word_10130CC dw	2A9h
db 'ResetEvent',0
align 2
word_10130DA dw	65h
db 'CreateThread',0
align 2
word_10130EA dw	47h
db 'CreateEventW',0
align 2
word_10130FA dw	1E9h
db 'GlobalUnlock',0
align 2
word_101310A dw	1E6h
db 'GlobalSize',0
align 4
word_1013118 dw	1E2h
db 'GlobalLock',0
align 2
word_1013126 dw	383h
db 'WriteProfileStringW',0
word_101313C dw	329h
db 'Sleep',0
word_1013144 dw	393h
db 'lstrcmpW',0
align 10h
word_1013150 dw	1E5h
db 'GlobalReAlloc',0
word_1013160 dw	1DEh
db 'GlobalFree',0
align 2
word_101316E dw	1D7h
db 'GlobalAlloc',0
word_101317C dw	1D8h
db 'GlobalCompact',0
word_101318C dw	189h
db 'GetProcAddress',0
align 2
word_101319E dw	22Eh
db 'LoadLibraryA',0
align 2
word_10131AE dw	167h
db 'GetModuleHandleA',0
align 2
word_10131C2 dw	19Ch
db 'GetStartupInfoA',0
aKernel32_dll db 'KERNEL32.dll',0
align 2
word_10131E2 dw	213h
db 'SetBkColor',0
align 10h
word_10131F0 dw	23Ah
db 'SetTextColor',0
align 10h
word_1013200 dw	214h
db 'SetBkMode',0
aGdi32_dll db 'GDI32.dll',0
word_1013216 dw	2Ch
db 'CharNextW',0
word_1013222 dw	218h
db 'RegisterClassExW',0
align 2
word_1013236 dw	15Bh
db 'GetSysColorBrush',0
align 2
word_101324A dw	1BAh
db 'LoadCursorW',0
word_1013258 dw	1BCh
db 'LoadIconW',0
word_1013264 dw	193h
db 'InvalidateRect',0
align 2
word_1013276 dw	2BBh
db 'UpdateWindow',0
align 2
word_1013286 dw	292h
db 'ShowWindow',0
align 4
word_1013294 dw	240h
db 'SendMessageW',0
align 4
word_10132A4 dw	254h
db 'SetDlgItemTextW',0
word_10132B6 dw	39h
db 'CheckMenuItem',0
word_10132C6 dw	3Ah
db 'CheckMenuRadioItem',0
align 4
word_10132DC dw	283h
db 'SetWindowPos',0
align 4
word_10132EC dw	1F2h
db 'OffsetRect',0
align 2
word_10132FA dw	1D7h
db 'MapWindowPoints',0
word_101330C dw	0FFh
db 'GetClientRect',0
word_101331C dw	0C4h
db 'EnableWindow',0
align 4
word_101332C dw	1C6h
db 'LoadMenuW',0
word_1013338 dw	281h
db 'SetWindowLongW',0
align 2
word_101334A dw	16Fh
db 'GetWindowLongW',0
align 4
word_101335C dw	12Ch
db 'GetMenu',0
word_1013366 dw	56h
db 'CreateDialogParamW',0
align 4
word_101337C dw	111h
db 'GetDlgItem',0
align 2
word_101338A dw	97h
db 'DestroyMenu',0
word_1013398 dw	99h
db 'DestroyWindow',0
word_10133A8 dw	25Dh
db 'SetMenu',0
word_10133B2 dw	174h
db 'GetWindowRect',0
word_10133C2 dw	29Ah
db 'SystemParametersInfoW',0
word_10133DA dw	0A2h
db 'DispatchMessageW',0
align 2
word_10133EE dw	2AAh
db 'TranslateMessage',0
align 2
word_1013402 dw	2A8h
db 'TranslateAcceleratorW',0
word_101341A dw	19Eh
db 'IsChild',0
word_1013424 dw	1A2h
db 'IsDialogMessageW',0
align 4
word_1013438 dw	13Eh
db 'GetMessageW',0
word_1013446 dw	1B4h
db 'LoadAcceleratorsW',0
word_101345A dw	61h
db 'CreateWindowExW',0
word_101346C dw	1E3h
db 'MessageBoxW',0
word_101347A dw	1C9h
db 'LoadStringW',0
word_1013488 dw	267h
db 'SetProcessDefaultLayout',0
word_10134A2 dw	147h
db 'GetProcessDefaultLayout',0
word_10134BC dw	24Dh
db 'SetCursor',0
word_10134C8 dw	256h
db 'SetFocus',0
align 4
word_10134D4 dw	287h
db 'SetWindowTextW',0
align 2
word_10134E6 dw	3Bh
db 'CheckRadioButton',0
align 2
word_10134FA dw	159h
db 'GetSubMenu',0
align 4
word_1013508 dw	1DBh
db 'MessageBeep',0
word_1013516 dw	0C6h
db 'EndDialog',0
word_1013522 dw	9Fh
db 'DialogBoxParamW',0
word_1013534 dw	15Ah
db 'GetSysColor',0
word_1013542 dw	42h
db 'CloseClipboard',0
align 4
word_1013554 dw	2Ah
db 'CharNextA',0
word_1013560 dw	101h
db 'GetClipboardData',0
align 4
word_1013574 dw	1F3h
db 'OpenClipboard',0
word_1013584 dw	10Eh
db 'GetDesktopWindow',0
align 4
word_1013598 dw	2A5h
db 'TrackPopupMenuEx',0
align 4
word_10135AC dw	0C2h
db 'EnableMenuItem',0
align 2
word_10135BE dw	19Fh
db 'IsClipboardFormatAvailable',0
align 4
word_10135DC dw	8Fh
db 'DefWindowProcW',0
align 2
word_10135EE dw	3Ch
db 'ChildWindowFromPoint',0
align 2
word_1013606 dw	231h
db 'ScreenToClient',0
align 4
word_1013618 dw	110h
db 'GetDlgCtrlID',0
align 4
word_1013628 dw	201h
db 'PostQuitMessage',0
word_101363A dw	2D3h
db 'WinHelpW',0
align 2
word_1013646 dw	0BFh
db 'DrawTextW',0
word_1013652 dw	1Ch
db 'CallWindowProcW',0
word_1013664 dw	17Fh
db 'HideCaret',0
word_1013670 dw	38h
db 'CheckDlgButton',0
align 2
word_1013682 dw	17Ah
db 'GetWindowTextW',0
align 4
word_1013694 dw	252h
db 'SetDlgItemInt',0
aUser32_dll db 'USER32.dll',0
align 200h
dd 186h	dup(?)
dword_1013E18 dd ?
dword_1013E1C dd ?
dd 78h dup(?)
_text ends

; Section 2. (virtual address 00014000)
; Virtual size			: 0000101C (   4124.)
; Section size in file		: 00000A00 (   2560.)
; Offset to raw	data for section: 00012C00
; Flags	C0000040: Data Readable	Writable
; Alignment	: default

; Segment type:	Pure data
; Segment permissions: Read/Write
_data segment para public 'DATA' use32
assume cs:_data
;org 1014000h
dword_1014000 dd 3
db    1
db    0
db    0
db    0
dword_1014008 dd 20h
db  0Ah
db    0
db    0
db    0
dword_1014010 dd 0Ah
dword_1014014 dd 40h
; const	WCHAR aScicalc
aScicalc:
unicode	0, <SciCalc>,0
db    0
db    0
db    0
db    0
; WCHAR	ReturnedString
ReturnedString dd 2Eh
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
; WCHAR	dword_1014038
dword_1014038 dd 2Ch
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
; const	WCHAR String2
String2	dw 30h
align 4
dword_1014048 dd 1
byte_101404C db	0
byte_101404D db	0
byte_101404E db	57h
align 10h
db  58h	; X
db    0
db  56h	; V
db    1
db  5Ch	; \
db    2
db  5Dh	; ]
db    2
db    7
db    3
db  59h	; Y
db    3
db  5Eh	; ^
db    3
db  5Ah	; Z
db    3
db  5Bh	; [
db    3
db  5Fh	; _
db    4
; HLOCAL dword_1014064
dword_1014064 dd 0
dword_1014068 dd 0FFFFFFFFh
dword_101406C dd 0FFFFFFFFh
dword_1014070 dd 0FFFFFFFFh
dword_1014074 dd 0FFFFFFFFh
dword_1014078 dd 0FFFFFFFFh
dword_101407C dd 0
dword_1014080 dd 0
dword_1014084 dd 0
stru_1014088 dq	offset off_10015EC   ; getInfoPtr
db '.K',0               ; Name
align 4
db    0
db    0
db    0
db    0
db    0
db    0
db 0FFh
db    0
db  50h	; P
db    0
db    0
db    0
db 0FFh
db    0
db    0
db    0
db  51h	; Q
db    0
db    0
db    0
db 0FFh
db    0
db    0
db    0
db  52h	; R
db    0
db    0
db    0
db 0FFh
db    0
db    0
db    0
db  53h	; S
db    0
db    0
db    0
db    0
db    0
db 0FFh
db    0
db  54h	; T
db    0
db    0
db    0
db    0
db    0
db 0FFh
db    0
db  55h	; U
db    0
db    0
db    0
db 0FFh
db    0
db    0
db    0
db  56h	; V
db    0
db    0
db    0
db 0FFh
db    0
db    0
db    0
db  57h	; W
db    0
db    0
db    0
db 0FFh
db    0
db    0
db    0
db  58h	; X
db    0
db    0
db    0
db 0FFh
db    0
db    0
db    0
db  59h	; Y
db    0
db    0
db    0
db 0FFh
db    0
db    0
db    0
db  5Ah	; Z
db    0
db    0
db    0
db 0FFh
db    0
db    0
db    0
db  5Bh	; [
db    0
db    0
db    0
db 0FFh
db    0
db    0
db    0
db  5Ch	; \
db    0
db    0
db    0
db 0FFh
db    0
db    0
db    0
db  5Dh	; ]
db    0
db    0
db    0
db 0FFh
db    0
db    0
db    0
db  5Eh	; ^
db    0
db    0
db    0
db 0FFh
db    0
db 0FFh
db    0
db  5Fh	; _
db    0
db    0
db    0
db 0FFh
db    0
db    0
db    0
db  60h	; `
db    0
db    0
db    0
db 0FFh
db    0
db    0
db    0
db  61h	; a
db    0
db    0
db    0
db 0FFh
db    0
db 0FFh
db    0
db  62h	; b
db    0
db    0
db    0
db 0FFh
db    0
db 0FFh
db    0
db  63h	; c
db    0
db    0
db    0
db 0FFh
db    0
db 0FFh
db    0
db  64h	; d
db    0
db    0
db    0
db 0FFh
db    0
db 0FFh
db    0
db  65h	; e
db    0
db    0
db    0
db 0FFh
db    0
db 0FFh
db    0
db  66h	; f
db    0
db    0
db    0
db    0
db    0
db 0FFh
db    0
db  67h	; g
db    0
db    0
db    0
db 0FFh
db    0
db 0FFh
db    0
db  8Ch	; å
db    0
db    0
db    0
db 0FFh
db    0
db 0FFh
db    0
db  68h	; h
db    0
db    0
db    0
db 0FFh
db    0
db 0FFh
db    0
db  69h	; i
db    0
db    0
db    0
db 0FFh
db    0
db 0FFh
db    0
db  6Ah	; j
db    0
db    0
db    0
db 0FFh
db    0
db 0FFh
db    0
db  6Bh	; k
db    0
db    0
db    0
db    0
db    0
db 0FFh
db    0
db  6Ch	; l
db    0
db    0
db    0
db 0FFh
db    0
db 0FFh
db    0
db  6Dh	; m
db    0
db    0
db    0
db    0
db    0
db 0FFh
db    0
db  6Eh	; n
db    0
db    0
db    0
db 0FFh
db    0
db    0
db    0
db  6Fh	; o
db    0
db    0
db    0
db 0FFh
db    0
db    0
db    0
db  70h	; p
db    0
db    0
db    0
db 0FFh
db    0
db    0
db    0
db  71h	; q
db    0
db    0
db    0
db 0FFh
db    0
db    0
db    0
db  72h	; r
db    0
db    0
db    0
db 0FFh
db    0
db    0
db    0
db  73h	; s
db    0
db    0
db    0
db 0FFh
db    0
db 0FFh
db    0
db  74h	; t
db    0
db    0
db    0
db    0
db    0
db 0FFh
db    0
db  75h	; u
db    0
db    0
db    0
db    0
db    0
db 0FFh
db    0
db  76h	; v
db    0
db    0
db    0
db    0
db    0
db 0FFh
db    0
db  77h	; w
db    0
db    0
db    0
db    0
db    0
db 0FFh
db    0
db  78h	; x
db    0
db    0
db    0
db 0FFh
db    0
db 0FFh
db    0
db  28h	; (
db    0
db    0
db    0
db 0FFh
db    0
db 0FFh
db    0
db  29h	; )
db    0
db    0
db    0
db    0
db    0
db 0FFh
db    0
db  30h	; 0
db    0
db    0
db    0
db    0
db    0
db 0FFh
db    0
db  30h	; 0
db    0
db    0
db    0
db    0
db    0
db 0FFh
db    0
db  30h	; 0
db    0
db    0
db    0
db    0
db    0
db 0FFh
db    0
db  30h	; 0
db    0
db    0
db    0
db    0
db    0
db 0FFh
db    0
db  30h	; 0
db    0
db    0
db    0
db    0
db    0
db 0FFh
db    0
db  30h	; 0
db    0
db    0
db    0
db    0
db    0
db 0FFh
db    0
db  30h	; 0
db    0
db    0
db    0
db    0
db    0
db 0FFh
db    0
db  30h	; 0
db    0
db    0
db    0
db    0
db    0
db 0FFh
db    0
db  30h	; 0
db    0
db    0
db    0
db    0
db    0
db 0FFh
db    0
db  30h	; 0
db    0
db    0
db    0
db    0
db    0
db 0FFh
db    0
db  41h	; A
db    0
db    0
db    0
db    0
db    0
db 0FFh
db    0
db  41h	; A
db    0
db    0
db    0
db    0
db    0
db 0FFh
db    0
db  41h	; A
db    0
db    0
db    0
db    0
db    0
db 0FFh
db    0
db  41h	; A
db    0
db    0
db    0
db    0
db    0
db 0FFh
db    0
db  41h	; A
db    0
db    0
db    0
db    0
db    0
db 0FFh
db    0
db  41h	; A
db    0
db    0
db    0
dword_1014278 dd 0FFFFFFFFh
dword_101427C dd 6Eh
db  6Ch	; l
db    0
db    0
db    0
db  62h	; b
db    0
db    0
db    0
db  63h	; c
db    0
db    0
db    0
db  64h	; d
db    0
db    0
db    0
db  75h	; u
db    0
db    0
db    0
db  6Fh	; o
db    0
db    0
db    0
db    2
db    0
db    0
db    0
db    8
db    0
db    0
db    0
db  0Ah
db    0
db    0
db    0
db  10h
db    0
db    0
db    0
db    1
db    0
db    0
db    0
dword_10142AC dd 76h
db  77h	; w
db    0
db    0
db    0
db  78h	; x
db    0
db    0
db    0
db  79h	; y
db    0
db    0
db    0
db    0
db    0
db    0
db    0
unk_10142C0 db	97h ; ó
db    1
db    0
db    0
db  91h	; ë
db    1
db    0
db    0
db  95h	; ï
db    1
db    0
db    0
db  95h	; ï
db    1
db    0
db    0
db  94h	; î
db    1
db    0
db    0
db  94h	; î
db    1
db    0
db    0
db  9Ah	; ö
db    1
db    0
db    0
db  93h	; ì
db    1
db    0
db    0
db  9Bh	; õ
db    1
db    0
db    0
db  92h	; í
db    1
db    0
db    0
db  99h	; ô
db    1
db    0
db    0
db  96h	; ñ
db    1
db    0
db    0
db  98h	; ò
db    1
db    0
db    0
db  96h	; ñ
db    1
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
dword_1014300 dd 0FFFFFFFFh
align 8
; wchar_t Str
Str dw 30h
db  31h	; 1
db    0
db  32h	; 2
db    0
db  33h	; 3
db    0
db  34h	; 4
db    0
db  35h	; 5
db    0
db  36h	; 6
db    0
db  37h	; 7
db    0
db  38h	; 8
db    0
db  39h	; 9
db    0
db  41h	; A
db    0
db  42h	; B
db    0
db  43h	; C
db    0
db  44h	; D
db    0
db  45h	; E
db    0
db  46h	; F
db    0
db  47h	; G
db    0
db  48h	; H
db    0
db  49h	; I
db    0
db  4Ah	; J
db    0
db  4Bh	; K
db    0
db  4Ch	; L
db    0
db  4Dh	; M
db    0
db  4Eh	; N
db    0
db  4Fh	; O
db    0
db  50h	; P
db    0
db  51h	; Q
db    0
db  52h	; R
db    0
db  53h	; S
db    0
db  54h	; T
db    0
db  55h	; U
db    0
db  56h	; V
db    0
db  57h	; W
db    0
db  58h	; X
db    0
db  59h	; Y
db    0
db  5Ah	; Z
db    0
db  61h	; a
db    0
db  62h	; b
db    0
db  63h	; c
db    0
db  64h	; d
db    0
db  65h	; e
db    0
db  66h	; f
db    0
db  67h	; g
db    0
db  68h	; h
db    0
db  69h	; i
db    0
db  6Ah	; j
db    0
db  6Bh	; k
db    0
db  6Ch	; l
db    0
db  6Dh	; m
db    0
db  6Eh	; n
db    0
db  6Fh	; o
db    0
db  70h	; p
db    0
db  71h	; q
db    0
db  72h	; r
db    0
db  73h	; s
db    0
db  74h	; t
db    0
db  75h	; u
db    0
db  76h	; v
db    0
db  77h	; w
db    0
db  78h	; x
db    0
db  79h	; y
db    0
db  7Ah	; z
db    0
db  5Fh	; _
db    0
db  40h	; @
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
byte_1014390 db	3
byte_1014391 db	2
byte_1014392 db	4
byte_1014393 db	1
byte_1014394 db	0Eh
db    3
db    2
db    4
db  0Eh
db  0Eh
db    3
db    2
db    4
db  0Eh
db  0Bh
db  0Eh
db    5
db    6
db  0Eh
db    8
db    7
db    4
db    4
db  0Eh
db    8
db  0Eh
db    5
db    6
db  0Eh
db  0Bh
db  0Eh
db    6
db    6
db  0Eh
db    8
db  0Eh
db    6
db    6
db  0Eh
db    8
db  0Eh
db  0Ah
db  0Ah
db    9
db  0Eh
db  0Eh
db  0Ah
db  0Ah
db  0Eh
db  0Eh
db  0Eh
db  0Ah
db  0Ah
db  0Eh
db  0Eh
db  0Eh
db  0Dh
db  0Dh
db  0Ch
db  0Eh
db  0Eh
db  0Dh
db  0Dh
db  0Eh
db  0Eh
db  0Eh
db  0Dh
db  0Dh
db  0Eh
db  0Eh
db  0Eh
db  0Eh
db  0Eh
db  0Eh
db  0Eh
db    0
dword_10143DC dd 0B40h
unk_10143E0 db	  1
db    0
db    0
db    0
dword_10143E4 dd 1
db    0
db    0
db    0
db    0
db    1
db    0
db    0
db    0
unk_10143F0 db	  1
db    0
db    0
db    0
dword_10143F4 dd 1
db    0
db    0
db    0
db    0
db    2
db    0
db    0
db    0
unk_1014400 db	  1
db    0
db    0
db    0
dword_1014404 dd 1
db    0
db    0
db    0
db    0
db    5
db    0
db    0
db    0
unk_1014410 db	  1
db    0
db    0
db    0
dword_1014414 dd 1
db    0
db    0
db    0
db    0
db    6
db    0
db    0
db    0
unk_1014420 db	  1
db    0
db    0
db    0
dword_1014424 dd 1
db    0
db    0
db    0
db    0
db  0Ah
db    0
db    0
db    0
unk_1014430 db	  1
db    0
db    0
db    0
dword_1014434 dd 1
db    0
db    0
db    0
db    0
db    1
db    0
db    0
db    0
unk_1014440 db	  1
db    0
db    0
db    0
dword_1014444 dd 4
align 10h
db    2
db 0DFh	; ﬂ
db  59h	; Y
db  0Bh
db  6Eh	; n
db    5
db 0B5h	; µ
db  35h	; 5
db  71h	; q
db  27h	; '
db    0
db    0
unk_101445C db 0FFh
db 0FFh
db 0FFh
db 0FFh
dword_1014460 dd 1
align 8
db    1
db    0
db    0
db    0
unk_101446C db	  1
db    0
db    0
db    0
dword_1014470 dd 4
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    2
db 0DFh	; ﬂ
db  59h	; Y
db  0Bh
db  6Eh	; n
db    5
db 0B5h	; µ
db  35h	; 5
db  71h	; q
db  27h	; '
db    0
db    0
unk_1014488 db	  1
db    0
db    0
db    0
dword_101448C dd 1
db    0
db    0
db    0
db    0
db  55h	; U
db    0
db    0
db    0
unk_1014498 db	  1
db    0
db    0
db    0
dword_101449C dd 1
db    0
db    0
db    0
db    0
db  64h	; d
db    0
db    0
db    0
unk_10144A8 db	  1
db    0
db    0
db    0
dword_10144AC dd 1
db    0
db    0
db    0
db    0
db    6
db    0
db    0
db    0
unk_10144B8 db	  1
db    0
db    0
db    0
dword_10144BC dd 1
db    0
db    0
db    0
db    0
db    1
db    0
db    0
db    0
unk_10144C8 db	  1
db    0
db    0
db    0
dword_10144CC dd 1
db    0
db    0
db    0
db    0
db    2
db    0
db    0
db    0
unk_10144D8 db	  1
db    0
db    0
db    0
dword_10144DC dd 1
db    0
db    0
db    0
db    0
db    1
db    0
db    0
db    0
unk_10144E8 db	  1
db    0
db    0
db    0
dword_10144EC dd 1
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
unk_10144F8 db	  1
db    0
db    0
db    0
dword_10144FC dd 1
db    0
db    0
db    0
db    0
db    1
db    0
db    0
db    0
unk_1014508 db	  1
db    0
db    0
db    0
dword_101450C dd 1
db    0
db    0
db    0
db    0
db    1
db    0
db    0
db    0
unk_1014518 db	  1
db    0
db    0
db    0
dword_101451C dd 1
db    0
db    0
db    0
db    0
db    1
db    0
db    0
db    0
unk_1014528 db 0FFh
db 0FFh
db 0FFh
db 0FFh
dword_101452C dd 1
db    0
db    0
db    0
db    0
db    1
db    0
db    0
db    0
unk_1014538 db	  1
db    0
db    0
db    0
dword_101453C dd 1
db    0
db    0
db    0
db    0
db    1
db    0
db    0
db    0
unk_1014548 db	  1
db    0
db    0
db    0
dword_101454C dd 1
db    0
db    0
db    0
db    0
db    1
db    0
db    0
db    0
unk_1014558 db	  1
db    0
db    0
db    0
dword_101455C dd 1
db    0
db    0
db    0
db    0
db    2
db    0
db    0
db    0
unk_1014568 db	  1
db    0
db    0
db    0
dword_101456C dd 1
db    0
db    0
db    0
db    0
db  0Ah
db    0
db    0
db    0
unk_1014578 db	  1
db    0
db    0
db    0
dword_101457C dd 1
db    0
db    0
db    0
db    0
db    1
db    0
db    0
db    0
unk_1014588 db	  1
db    0
db    0
db    0
dword_101458C dd 6
db    0
db    0
db    0
db    0
db  58h	; X
db  67h	; g
db  7Bh	; {
db    7
db 0EEh	; Ó
db 0F1h	; Ò
db 0EBh	; Î
db  10h
db  70h	; p
db 0C3h	; √
db 0DAh	; ⁄
db  74h	; t
db  4Ah	; J
db 0ADh	; ≠
db 0B5h	; µ
db  63h	; c
db  50h	; P
db 0E3h	; „
db 0C7h	; «
db  4Ch	; L
db    8
db    0
db    0
db    0
unk_10145AC db	  1
db    0
db    0
db    0
dword_10145B0 dd 6
align 8
db 0F2h	; Ú
db  1Fh
db 0CBh	; À
db  4Ch	; L
db 0B9h	; π
db  9Dh	; ù
db 0C3h	; √
db  42h	; B
db 0F4h	; Ù
db 0D3h	; ”
db 0E3h	; „
db  6Eh	; n
db  36h	; 6
db 0E4h	; ‰
db 0E0h	; ‡
db  73h	; s
db 0B4h	; ¥
db 0B0h	; ∞
db  63h	; c
db  5Eh	; ^
db    2
db    0
db    0
db    0
unk_10145D0 db	  1
db    0
db    0
db    0
dword_10145D4 dd 6
db    0
db    0
db    0
db    0
db 0B0h	; ∞
db 0CEh	; Œ
db 0F6h	; ˆ
db  0Eh
db 0DCh	; ‹
db 0E3h	; „
db 0D7h	; ◊
db  21h	; !
db 0E0h	; ‡
db  86h	; Ü
db 0B5h	; µ
db  69h	; i
db  95h	; ï
db  5Ah	; Z
db  6Bh	; k
db  47h	; G
db 0A1h	; °
db 0C6h	; ∆
db  8Fh	; è
db  19h
db  11h
db    0
db    0
db    0
unk_10145F4 db	  1
db    0
db    0
db    0
dword_10145F8 dd 6
align 10h
db 0F2h	; Ú
db  1Fh
db 0CBh	; À
db  4Ch	; L
db 0B9h	; π
db  9Dh	; ù
db 0C3h	; √
db  42h	; B
db 0F4h	; Ù
db 0D3h	; ”
db 0E3h	; „
db  6Eh	; n
db  36h	; 6
db 0E4h	; ‰
db 0E0h	; ‡
db  73h	; s
db 0B4h	; ¥
db 0B0h	; ∞
db  63h	; c
db  5Eh	; ^
db    2
db    0
db    0
db    0
unk_1014618 db	  1
db    0
db    0
db    0
dword_101461C dd 6
db    0
db    0
db    0
db    0
db  58h	; X
db  67h	; g
db  7Bh	; {
db    7
db 0EEh	; Ó
db 0F1h	; Ò
db 0EBh	; Î
db  10h
db  70h	; p
db 0C3h	; √
db 0DAh	; ⁄
db  74h	; t
db  4Ah	; J
db 0ADh	; ≠
db 0B5h	; µ
db  63h	; c
db  50h	; P
db 0E3h	; „
db 0C7h	; «
db  4Ch	; L
db    8
db    0
db    0
db    0
unk_101463C db	  1
db    0
db    0
db    0
dword_1014640 dd 6
align 8
db 0E4h	; ‰
db  3Fh	; ?
db  96h	; ñ
db  19h
db  73h	; s
db  3Bh	; ;
db  87h	; á
db    5
db 0E9h	; È
db 0A7h	; ß
db 0C7h	; «
db  5Dh	; ]
db  6Dh	; m
db 0C8h	; »
db 0C1h	; ¡
db  67h	; g
db  69h	; i
db  61h	; a
db 0C7h	; «
db  3Ch	; <
db    5
db    0
db    0
db    0
unk_1014660 db	  1
db    0
db    0
db    0
dword_1014664 dd 6
db    0
db    0
db    0
db    0
db 0A0h	; †
db  3Ah	; :
db 0FBh	; ˚
db  49h	; I
db  55h	; U
db 0D1h	; —
db  18h
db  10h
db  88h	; à
db 0C1h	; ¡
db 0ADh	; ≠
db  3Eh	; >
db 0B5h	; µ
db 0A2h	; ¢
db 0BCh	; º
db  72h	; r
db  73h	; s
db 0ABh	; ´
db 0E3h	; „
db  4Fh	; O
db  46h	; F
db    0
db    0
db    0
unk_1014684 db	  1
db    0
db    0
db    0
dword_1014688 dd 6
align 10h
db 0F3h	; Û
db 0DFh	; ﬂ
db  27h	; '
db  5Eh	; ^
db  57h	; W
db  33h	; 3
db  8Dh	; ç
db  6Dh	; m
db 0B4h	; ¥
db 0F5h	; ı
db 0A2h	; ¢
db  3Fh	; ?
db 0DCh	; ‹
db 0BCh	; º
db  34h	; 4
db  1Fh
db    3
db 0F8h	; ¯
db  52h	; R
db  7Eh	; ~
db  0Eh
db    0
db    0
db    0
unk_10146A8 db	  1
db    0
db    0
db    0
dword_10146AC dd 6
db    0
db    0
db    0
db    0
db 0CCh	; Ã
db 0ADh	; ≠
db  50h	; P
db  0Fh
db  23h	; #
db  3Fh	; ?
db 0E3h	; „
db  0Ch
db  42h	; B
db  98h	; ò
db  52h	; R
db  0Dh
db  24h	; $
db  32h	; 2
db  75h	; u
db  1Ch
db  4Dh	; M
db  54h	; T
db 0A2h	; ¢
db  22h	; "
db  17h
db    0
db    0
db    0
unk_10146CC db	  1
db    0
db    0
db    0
dword_10146D0 dd 6
align 8
db 0CBh	; À
db  23h	; #
db  9Ah	; ö
db  5Bh	; [
db    4
db    7
db 0A2h	; ¢
db  29h	; )
db 0FBh	; ˚
db 0B7h	; ∑
db  31h	; 1
db  43h	; C
db 0D2h	; “
db  50h	; P
db  5Dh	; ]
db  0Dh
db  10h
db    6
db 0A2h	; ¢
db  0Eh
db  0Eh
db    0
db    0
db    0
unk_10146F0 db	  1
db    0
db    0
db    0
dword_10146F4 dd 6
db    0
db    0
db    0
db    0
db  2Fh	; /
db  30h	; 0
db  3Fh	; ?
db  38h	; 8
db 0B8h	; ∏
db  25h	; %
db 0C2h	; ¬
db  5Fh	; _
db 0EAh	; Í
db 0E0h	; ‡
db  43h	; C
db  41h	; A
db  98h	; ò
db  2Eh	; .
db 0DEh	; ﬁ
db  68h	; h
db  7Bh	; {
db 0A1h	; °
db 0A5h	; •
db  63h	; c
db 0FDh	; ˝
db  24h	; $
db  11h
db    0
unk_1014714 db	  1
db    0
db    0
db    0
dword_1014718 dd 6
align 10h
db 0E0h	; ‡
db  2Bh	; +
db  68h	; h
db  34h	; 4
db  64h	; d
db 0B3h	; ≥
db  92h	; í
db  78h	; x
db  22h	; "
db 0ABh	; ´
db 0CCh	; Ã
db  24h	; $
db 0C4h	; ƒ
db 0C0h	; ¿
db 0F3h	; Û
db  51h	; Q
db  7Bh	; {
db  13h
db  82h	; Ç
db  51h	; Q
db  9Eh	; û
db  4Eh	; N
db    6
db    0
unk_1014738 db	  1
db    0
db    0
db    0
dword_101473C dd 6
db    0
db    0
db    0
db    0
db 0FAh	; ˙
db 0EFh	; Ô
db  59h	; Y
db  7Ch	; |
db 0BCh	; º
db 0D2h	; “
db 0E1h	; ·
db    9
db 0CFh	; œ
db  6Bh	; k
db  67h	; g
db  54h	; T
db 0DEh	; ﬁ
db  8Fh	; è
db  5Ah	; Z
db  6Eh	; n
db  68h	; h
db  8Ah	; ä
db 0D8h	; ÿ
db  70h	; p
db  39h	; 9
db  6Bh	; k
db 0E5h	; Â
db    3
unk_101475C db	  1
db    0
db    0
db    0
dword_1014760 dd 6
align 8
db 0FCh	; ¸
db 0CAh	;  
db  98h	; ò
db    1
unk_101476C db 0C7h ; «
db  15h
db 0A6h	; ¶
db  21h	; !
db  41h	; A
db 0DDh	; ›
db 0BAh	; ∫
db  2Eh	; .
db 0F0h	; 
db  5Ch	; \
db 0E0h	; ‡
db  0Ch
db  50h	; P
db  94h	; î
db  43h	; C
db  5Dh	; ]
db  6Ah	; j
db  2Ch	; ,
db 0B1h	; ±
db    1
unk_1014780 db	  1
db    0
db    0
db    0
dword_1014784 dd 6
db    0
db    0
db    0
db    0
db 0A1h	; °
db  7Ch	; |
db 0A5h	; •
db  6Ah	; j
db 0BCh	; º
db 0B2h	; ≤
db  0Eh
db  3Fh	; ?
db  1Dh
db  20h
db 0A4h	; §
db  2Ah	; *
db 0D9h	; Ÿ
db  34h	; 4
db  2Bh	; +
db  36h	; 6
db  33h	; 3
db  33h	; 3
db  1Eh
db  54h	; T
db    3
db    0
db    0
db    0
unk_10147A4 db	  1
db    0
db    0
db    0
dword_10147A8 dd 6
align 10h
db  97h	; ó
db 0B9h	; π
db 0F9h	; ˘
db  5Ch	; \
db 0E6h	; Ê
db  7Eh	; ~
db  13h
db  73h	; s
db  7Bh	; {
db  5Ch	; \
db  3Ah	; :
db  49h	; I
db 0DFh	; ﬂ
db 0BBh	; ª
db  0Dh
db  0Dh
db  13h
db 0FAh	; ˙
db  59h	; Y
db  23h	; #
db    5
db    0
db    0
db    0
unk_10147C8 db	  1
db    0
db    0
db    0
dword_10147CC dd 6
db    0
db    0
db    0
db    0
db  28h	; (
db  76h	; v
db 0D2h	; “
db  7Eh	; ~
db  7Fh	; 
db 0E6h	; Ê
db  8Ah	; ä
db  71h	; q
db 0EDh	; Ì
db    7
db  31h	; 1
db  78h	; x
db  93h	; ì
db  76h	; v
db  20h
db  7Ah	; z
db  32h	; 2
db  3Fh	; ?
db  18h
db  5Eh	; ^
db 0ECh	; Ï
db    1
db    0
db    0
unk_10147EC db	  1
db    0
db    0
db    0
dword_10147F0 dd 6
align 8
db  58h	; X
db  67h	; g
db  7Bh	; {
db    7
db 0EEh	; Ó
db 0F1h	; Ò
db 0EBh	; Î
db  10h
db  70h	; p
db 0C3h	; √
db 0DAh	; ⁄
db  74h	; t
db  4Ah	; J
db 0ADh	; ≠
db 0B5h	; µ
db  63h	; c
db  50h	; P
db 0E3h	; „
db 0C7h	; «
db  4Ch	; L
db    8
db    0
db    0
db    0
unk_1014810 db	  1
db    0
db    0
db    0
dword_1014814 dd 6
db    0
db    0
db    0
db    0
db  10h
db 0F5h	; ı
db 0B0h	; ∞
db  7Eh	; ~
db 0FFh
db  38h	; 8
db 0D3h	; ”
db  28h	; (
db    8
db  97h	; ó
db 0FDh	; ˝
db  21h	; !
db 0DDh	; ›
db  4Ah	; J
db 0B2h	; ≤
db    7
db  55h	; U
db  0Dh
db 0E2h	; ‚
db  3Dh	; =
db  23h	; #
db    2
db    0
db    0
unk_1014834 db	  1
db    0
db    0
db    0
dword_1014838 dd 6
align 10h
db  58h	; X
db  67h	; g
db  7Bh	; {
db    7
db 0EEh	; Ó
db 0F1h	; Ò
db 0EBh	; Î
db  10h
db  70h	; p
db 0C3h	; √
db 0DAh	; ⁄
db  74h	; t
db  4Ah	; J
db 0ADh	; ≠
db 0B5h	; µ
db  63h	; c
db  50h	; P
db 0E3h	; „
db 0C7h	; «
db  4Ch	; L
db    8
db    0
db    0
db    0
unk_1014858 db	  1
db    0
db    0
db    0
dword_101485C dd 3
db    0
db    0
db    0
db    0
db 0FFh
db 0FFh
db 0FFh
db  7Fh	; 
db 0FFh
db 0FFh
db 0FFh
db  7Fh	; 
db    3
db    0
db    0
db    0
unk_1014870 db	  1
db    0
db    0
db    0
dword_1014874 dd 1
db    0
db    0
db    0
db    0
db    1
db    0
db    0
db    0
unk_1014880 db	  1
db    0
db    0
db    0
dword_1014884 dd 2
db    0
db    0
db    0
db    0
db 0FFh
db 0FFh
db 0FFh
db  7Fh	; 
db    1
db    0
db    0
db    0
unk_1014894 db	  1
db    0
db    0
db    0
dword_1014898 dd 1
align 10h
db    1
db    0
db    0
db    0
unk_10148A4 db 0FFh
db 0FFh
db 0FFh
db 0FFh
dword_10148A8 dd 2
align 10h
db 0FFh
db 0FFh
db 0FFh
db  7Fh	; 
db    1
db    0
db    0
db    0
unk_10148B8 db	  1
db    0
db    0
db    0
dword_10148BC dd 1
db    0
db    0
db    0
db    0
db    1
db    0
db    0
db    0
unk_10148C8 db	  1
db    0
db    0
db    0
dword_10148CC dd 1
db    0
db    0
db    0
db    0
db 0FFh
db 0FFh
db    0
db    0
unk_10148D8 db	  1
db    0
db    0
db    0
dword_10148DC dd 1
db    0
db    0
db    0
db    0
db    1
db    0
db    0
db    0
unk_10148E8 db	  1
db    0
db    0
db    0
dword_10148EC dd 1
db    0
db    0
db    0
db    0
db 0FFh
db    0
db    0
db    0
unk_10148F8 db	  1
db    0
db    0
db    0
dword_10148FC dd 1
db    0
db    0
db    0
db    0
db    1
db    0
db    0
db    0
unk_1014908 db	  1
db    0
db    0
db    0
dword_101490C dd 1
dword_1014910 dd 0
db  90h	; ê
db    1
db    0
db    0
unk_1014918 db	  1
db    0
db    0
db    0
dword_101491C dd 1
db    0
db    0
db    0
db    0
db    1
db    0
db    0
db    0
unk_1014928 db	  1
db    0
db    0
db    0
dword_101492C dd 1
db    0
db    0
db    0
db    0
db  68h	; h
db    1
db    0
db    0
unk_1014938 db	  1
db    0
db    0
db    0
dword_101493C dd 1
db    0
db    0
db    0
db    0
db    1
db    0
db    0
db    0
unk_1014948 db	  1
db    0
db    0
db    0
dword_101494C dd 1
db    0
db    0
db    0
db    0
db 0C8h	; »
db    0
db    0
db    0
unk_1014958 db	  1
db    0
db    0
db    0
dword_101495C dd 1
db    0
db    0
db    0
db    0
db    1
db    0
db    0
db    0
unk_1014968 db	  1
db    0
db    0
db    0
dword_101496C dd 1
db    0
db    0
db    0
db    0
db 0B4h	; ¥
db    0
db    0
db    0
unk_1014978 db	  1
db    0
db    0
db    0
dword_101497C dd 1
db    0
db    0
db    0
db    0
db    1
db    0
db    0
db    0
unk_1014988 db	  1
db    0
db    0
db    0
dword_101498C dd 1
db    0
db    0
db    0
db    0
db 0A0h	; †
db  86h	; Ü
db    1
db    0
unk_1014998 db	  1
db    0
db    0
db    0
dword_101499C dd 1
db    0
db    0
db    0
db    0
db    1
db    0
db    0
db    0
unk_10149A8 db 0FFh
db 0FFh
db 0FFh
db 0FFh
dword_10149AC dd 1
db    0
db    0
db    0
db    0
db 0A0h	; †
db  86h	; Ü
db    1
db    0
unk_10149B8 db	  1
db    0
db    0
db    0
dword_10149BC dd 1
db    0
db    0
db    0
db    0
db    1
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
dword_10149D0 dd 1
align 8
dword_10149D8 dd 0
dword_10149DC dd 0
dword_10149E0 dd 0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    0
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
; HACCEL hAccTable
hAccTable dd ?
; HINSTANCE hInstance
hInstance dd ?
align 10h
dword_1014A50 dd ?
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
dword_1014A64 dd ?
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
; LPCWSTR dword_1014B6C
dword_1014B6C dd ?
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
; LPCWSTR lpszHelp
lpszHelp dd ?
; LPCWSTR dword_1014B90
dword_1014B90 dd ?
; LPCWSTR lpText
lpText dd ?
dword_1014B98 dd ?
; LPCWSTR szApp
szApp dd ?
dword_1014BA0 dd ?
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
; HLOCAL dword_1014C08
dword_1014C08 dd ?
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
; HLOCAL dword_1014C70
dword_1014C70 dd ?
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
dword_1014D38 dd ?
dword_1014D3C dd ?
dword_1014D40 dd ?
dword_1014D44 dd ?
dword_1014D48 dd ?
dword_1014D4C dd ?
; BOOL bEnable
bEnable	dd ?
; int dword_1014D54
dword_1014D54 dd ?
dword_1014D58 dd ?
dword_1014D5C dd ?
dword_1014D60 dd ?
dword_1014D64 dd ?
dword_1014D68 dd ?
; HWND hWnd
hWnd dd	?
; HWND dword_1014D70
dword_1014D70 dd ?
; HWND hDlg
hDlg dd	?
; HWND dword_1014D78
dword_1014D78 dd ?
; HMENU	dword_1014D7C
dword_1014D7C dd ?
; HMENU	hMenu
hMenu dd ?
dword_1014D84 dd ?
dword_1014D88 dd ?
dword_1014D8C dd ?
; HLOCAL dword_1014D90
dword_1014D90 dd ?
; HLOCAL dword_1014D94
dword_1014D94 dd ?
; HLOCAL dword_1014D98
dword_1014D98 dd ?
dword_1014D9C dd ?
dword_1014DA0 dd ?
; const	WCHAR String
String dw ?
align 10h
; LPCWSTR lpString
lpString dd ?
align 8
dword_1014DB8 dd ?
align 10h
unk_1014DC0 db	  ? ;
db    ?	;
db    ?	;
db    ?	;
dword_1014DC4 dd ?
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
db    ?	;
dword_1014EE8 dd ?
; HCURSOR hCursor
hCursor	dd ?
; HLOCAL dword_1014EF0
dword_1014EF0 dd ?
dword_1014EF4 dd ?
dword_1014EF8 dd ?
; HANDLE hEvent
hEvent dd ?
; HANDLE dword_1014F00
dword_1014F00 dd ?
; HANDLE hHandle
hHandle	dd ?
; HWND dword_1014F08
dword_1014F08 dd ?
dword_1014F0C dd ?
; WNDPROC lpPrevWndFunc
lpPrevWndFunc dd ?
dword_1014F14 dd ?
dword_1014F18 dd ?
dword_1014F1C dd ?
; HGLOBAL hMem
hMem dd	?
; UINT uValue
uValue dd ?
dword_1014F28 dd ?
align 10h
; HMODULE hModule
hModule	dd ?
align 8
dword_1014F38 dd ?
align 10h
dword_1014F40 dd ?
dword_1014F44 dd ?
db    ?	;
db    ?	;
db    ?	;
db    ?	;
dword_1014F4C dd ?
dword_1014F50 dd ?
dword_1014F54 dd ?
dword_1014F58 dd ?
dword_1014F5C dd ?
byte_1014F60 db	?
align 4
dword_1014F64 dd ?
dword_1014F68 dd ?
dword_1014F6C dd ?
dword_1014F70 dd ?
dword_1014F74 dd ?
dword_1014F78 dd ?
; HLOCAL dword_1014F7C
dword_1014F7C dd ?
; HLOCAL dword_1014F80
dword_1014F80 dd ?
dword_1014F84 dd ?
dword_1014F88 dd ?
dword_1014F8C dd ?
dword_1014F90 dd ?
dword_1014F94 dd ?
dword_1014F98 dd ?
dword_1014F9C dd ?
dword_1014FA0 dd ?
; HLOCAL dword_1014FA4
dword_1014FA4 dd ?
; HLOCAL dword_1014FA8
dword_1014FA8 dd ?
; HLOCAL dword_1014FAC
dword_1014FAC dd ?
; HLOCAL dword_1014FB0
dword_1014FB0 dd ?
; HLOCAL dword_1014FB4
dword_1014FB4 dd ?
; HLOCAL dword_1014FB8
dword_1014FB8 dd ?
; HLOCAL dword_1014FBC
dword_1014FBC dd ?
; HLOCAL dword_1014FC0
dword_1014FC0 dd ?
; HLOCAL dword_1014FC4
dword_1014FC4 dd ?
; HLOCAL dword_1014FC8
dword_1014FC8 dd ?
dword_1014FCC dd ?
dword_1014FD0 dd ?
dword_1014FD4 dd ?
dword_1014FD8 dd ?
dword_1014FDC dd ?
dword_1014FE0 dd ?
; HLOCAL dword_1014FE4
dword_1014FE4 dd ?
; HLOCAL dword_1014FE8
dword_1014FE8 dd ?
; HLOCAL dword_1014FEC
dword_1014FEC dd ?
dword_1014FF0 dd ?
; HLOCAL dword_1014FF4
dword_1014FF4 dd ?
; HLOCAL dword_1014FF8
dword_1014FF8 dd ?
align 10h
dword_1015000 dd ?
dword_1015004 dd ?
dword_1015008 dd ?
dword_101500C dd ?
dword_1015010 dd ?
dword_1015014 dd ?
dword_1015018 dd ?
align 1000h
_data ends


end start
