Function at 0x1003e0bc
Capabilities:
Create process on windows
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1007d1e9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1b8
mov dword [esp + 4], 0xeb0647dc
mov eax, 0xbb94d0f
mov dword [esp + 8], 0x265ab3e9
mov dword [esp + 0x1c], 0x85e0710d
mov dword [esp + 0xa4], eax
mov dword [esp + 0xa8], eax
mov dword [esp + 0xac], eax
mov dword [esp + 0xb0], eax
mov dword [esp + 0x14], 0x9904
mov dword [esp + 0x18], 0xffffffff
push ebx
xor ebx, ebx
mov dword [esp + 0x38], ecx
mov dword [esp + 0x24], ebx
mov eax, dword [esp + 8]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 8]
push esi
push edi
mov edi, edx
xor edx, edx
cmp ecx, eax
mov dword [esp + 0x44], edi
setne dl
add edx, dword [esp + 0x10]
mov dword [esp + 0x28], edx
mov eax, dword [esp + 0x28]
mov dword [esp + 0xb4], eax
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
jne 0x1003e179
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0xb4]
push 1
pop ecx
cmp eax, dword [esp + 0x14]
jge 0x1003e191
mov eax, ebx
cmp dword [esp + 0x20], ebx
je 0x1003e193
mov eax, ecx
cmp eax, dword [esp + 0x14]
jl 0x1003e19f
cmp dword [esp + 0x14], ebx
jne 0x1003e1a1
mov ecx, ebx
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
xor eax, eax
cmp ecx, 0x4d996497
setge al
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x24], eax
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], bl
je 0x1003e1da
push 0x1bc2
push ebx
call esi
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov dword [esp + 0x38], 0xd6c05baf
mov dword [esp + 0x38], ebx
cmp dword [esp + 0x38], 0xffffffe9
jl 0x1003f1ad
xor edi, edi
inc edi
push dword [esp + 0x40]
movdqa xmm0, xmmword [0x100082b0]
lea eax, [esp + 0x1a0]
push eax
lea eax, [esp + 0x194]
mov dword [esp + 0x1c], 0xffff
push eax
mov dword [esp + 0x34], ebx
lea ecx, [esp + 0x80]
mov dword [esp + 0x2c], 3
mov dword [esp + 0x38], ebx
push ebx
movdqu xmmword [esp + 0x19c], xmm0
mov dword [esp + 0x84], ebx
mov dword [esp + 0x88], ebx
mov dword [esp + 0x8c], ebx
call fcn.1000c726
mov dword [esp + 0x2c], 0xe0fa
mov dword [esp + 0x10], ebx
jmp 0x1003e270
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x150], edi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x1003e261
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x14], ebx
jne 0x1003e289
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov ecx, 0xf5fa3187
mov eax, dword [esp + 0x14]
sub eax, dword [esp + 0x14]
cmp ecx, eax
sbb eax, eax
neg eax
cmp eax, 0xfffffff9
jne 0x1003e2ad
mov ecx, edi
cmp dword [esp + 0x14], ebx
jne 0x1003e2af
mov ecx, ebx
mov eax, dword [esp + 0x14]
sub eax, ecx
sub eax, dword [esp + 0x14]
neg eax
sbb eax, eax
xor edx, edx
inc eax
imul eax, dword [esp + 0x14]
mov dword [esp + 0x28], eax
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x14]
cmp ecx, eax
mov eax, dword [esp + 0x14]
setle dl
sub edx, 0x2a67f8b4
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setle cl
mov dword [esp + 0x20], ecx
lea ecx, [esp + 0x74]
inc dword [esp + 0x150]
call fcn.1000c27b
mov dword [esp + 0x68], 0x7543
lea ecx, [esp + 0x114]
push 3
call fcn.1000c1f9
mov dword [esp + 0x1cc], ebx
mov dword [esp + 0x20], 0xfffffff8
cmp dword [esp + 0x20], ebx
mov byte [esp + 0x1b], bl
je 0x1003e33e
cmp byte [esp + 0x1b], 0
je 0x1003e354
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
jmp 0x1003e354
cmp byte [esp + 0x1b], 0
je 0x1003e354
push ebx
push 0x260a
call esi
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
mov dword [esp + 0x28], 0x5f5c184c
lea ecx, [esp + 0x5c]
mov dword [esp + 0x20], edi
mov dword [esp + 0x30], 0xffffffff
push 2
call fcn.1000c1f9
xor eax, eax
push 0xfffffffffffffffd
inc eax
pop ecx
mov byte [esp + 0x1cc], al
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x108]
mov dword [esp + 0x3c], 0xbc6e5c7a
push eax
call fcn.1000c1f9
mov dword [esp + 0x14], ebx
jmp 0x1003e3b2
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x5c]
mov dword [eax + ecx*4], 0x5c68ec0a
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x1003e39f
xor edi, edi
mov dword [esp + 0x14], ebx
inc edi
jmp 0x1003e3d4
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x108]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x1003e3c2
mov eax, dword [esp + 0x5c]
mov dword [eax], 0xfffffffe
mov dword [esp + 0x10], 5
jmp 0x1003e4ba
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x1c], 0xcee61780
mov dword [esp + 0x14], 0x2628217c
mov dword [esp + 0x24], 0xfe44fa3f
cmp dword [eax], ebx
mov eax, dword [esp + 0x14]
setne cl
mov dword [esp + 0x34], ecx
xor ecx, ecx
cmp eax, 0x5922
setg cl
xor edx, edx
add ecx, dword [esp + 0x1c]
cmp ecx, 0xfffffff8
setle dl
sub edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [esp + 0x1c]
setge cl
cmp ecx, 0xfffd
sbb edx, edx
xor ecx, ecx
inc edx
neg edx
cmp eax, edx
setne cl
cmp ecx, dword [esp + 0x14]
jle 0x1003e46a
mov edx, edi
cmp dword [esp + 0x3c], ebx
jne 0x1003e46c
mov edx, ebx
mov eax, dword [esp + 0x10]
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x24]
setle cl
xor edx, edx
cmp ecx, eax
setl dl
sub edx, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
imul edx, dword [esp + 0x34]
cmp edx, eax
setle cl
cmp ecx, dword [esp + 0x10]
jl 0x1003e4ae
mov eax, dword [esp + 0x108]
mov ecx, edi
cmp dword [eax], ebx
jne 0x1003e4b0
mov ecx, ebx
mov eax, dword [esp + 0x5c]
mov dword [eax], ecx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 8
jle 0x1003e3f1
lea ecx, [esp + 0x108]
call fcn.1000c27b
lea ecx, [esp + 0x5c]
mov byte [esp + 0x1cc], bl
call fcn.1000c27b
mov dword [esp + 0x2c], 0xe5316d00
mov dword [esp + 0x10], 0xe83c7730
mov dword [esp + 0x34], 0xa5223fa3
mov dword [esp + 0x10], ebx
jmp 0x1003e512
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x19c], 0xffff
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x1003e4ff
mov dword [esp + 0x10], 2
cmp dword [esp + 0x10], ebx
jl 0x1003e5c0
mov dword [esp + 0x14], ebx
lea ecx, [esp + 0xe4]
push 3
call fcn.1000c1f9
mov dword [esp + 0x1c], ebx
jmp 0x1003e559
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0xe4]
mov dword [eax + ecx*4], 0x580d416d
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 3
jl 0x1003e543
push 2
pop edx
mov dword [esp + 0x14], edx
cmp dword [esp + 0x14], ebx
jl 0x1003e5aa
mov ecx, dword [esp + 0xe4]
mov dword [esp + 0x1c], ebx
jmp 0x1003e589
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x13c], edx
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edx
jl 0x1003e57a
mov eax, dword [esp + 0x10]
mov eax, dword [esp + eax*4 + 0x19c]
mov dword [esp + 0x140], eax
mov dword [ecx + 8], eax
dec dword [esp + 0x14]
jns 0x1003e574
lea ecx, [esp + 0xe4]
call fcn.1000c27b
dec dword [esp + 0x10]
jns 0x1003e52b
mov dword [esp + 0x10], 3
mov eax, dword [esp + 0x10]
push 0xfffffffffffffffd
mov dword [esp + 0x38], eax
pop edx
mov dword [esp + 0x34], edx
mov dword [esp + 0x10], ebx
jmp 0x1003e5f0
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x1b0], 0x50041ac5
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x1003e5dd
mov dword [esp + 0x10], 0xcea5d6c0
mov dword [esp + 0x34], 0x307d7c11
mov dword [esp + 0x10], 0xfffffff5
jmp 0x1003e638
mov dword [esp + 0x34], 0xc5534bf8
cmp dword [esp + 0x10], ebx
jne 0x1003e627
mov ecx, ebx
cmp dword [esp + 0x34], ebx
je 0x1003e629
mov ecx, edi
xor eax, eax
test ecx, ecx
sets al
mov dword [esp + 0x34], eax
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xffffffe4
jle 0x1003e611
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1003e663
push 0x1f20
push ebx
push 0x121a
push 0x17ee
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
push 0xfffffffffffffffd
pop edx
mov eax, dword [esp + 0x30]
xor ecx, ecx
neg eax
cmp eax, 0xb545
push 0x12
setne cl
pop eax
sub eax, ecx
add eax, dword [esp + 0x28]
cmp dword [esp + 0x28], eax
jg 0x1003e9f0
mov dword [esp + 0x10], 9
xor ecx, ecx
mov dword [esp + 0x24], 0x76d9935f
inc ecx
mov dword [esp + 0x1c], ebx
jmp 0x1003e6af
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x48], 0xa885
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], ecx
jl 0x1003e69f
mov eax, dword [esp + 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x10], 0x19
jg 0x1003e7f8
mov dword [esp + 0x1c], 0xdba33992
mov dword [esp + 0x30], edx
mov dword [esp + 0x24], 0xbee6daba
mov dword [esp + 0x1c], ebx
cmp dword [esp + 0x1c], 0xfffffffe
jl 0x1003e7e3
push 0xfffffffffffffffd
pop esi
mov dword [esp + 0x14], ecx
mov dword [esp + 0x28], 0xa4ccfd66
mov dword [esp + 0x24], 0xffffffff
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x30]
cmp dword [esp + 0x10], 0xffffffff
jg 0x1003e731
mov eax, ebx
cmp dword [esp + 0x1c], ebx
je 0x1003e733
mov eax, ecx
mov dword [esp + 0x24], eax
xor ecx, ecx
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x14]
test eax, eax
mov eax, dword [esp + 0x14]
setg cl
xor edx, edx
cmp ecx, 0x604491d0
setl dl
xor ecx, ecx
cmp eax, edx
mov eax, 0xfc4f
setge cl
sub eax, ecx
je 0x1003e772
cmp dword [esp + 0x14], ebx
je 0x1003e772
xor edi, edi
lea eax, [edi + 1]
jmp 0x1003e774
mov eax, ebx
mov dword [esp + 0x24], eax
xor ecx, ecx
mov eax, dword [esp + 0x24]
cmp eax, 0xffffffff
setle cl
mov dword [esp + 0x24], ecx
mov dword [esp + 0x14], ebx
jmp 0x1003e7c8
mov dword [esp + 0x34], 0x2658
xor ecx, ecx
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x48]
cmp eax, 0xbdae1919
mov eax, dword [esp + 0x14]
setne cl
cmp esi, ecx
mov eax, dword [esp + eax*4 + 0x48]
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setge cl
mov dword [esp + 0x24], ecx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ebx
jle 0x1003e78e
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xfffffffe
push 1
pop ecx
jge 0x1003e6f2
push 0xfffffffffffffffd
pop edx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x19
jle 0x1003e6cc
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
push 2
lea ecx, [esp + 0x100]
call fcn.1000c1f9
mov dword [esp + 0x30], 0xffffffff
push 2
mov dword [esp + 0x38], 0xaae0
mov dword [esp + 0x18], ebx
pop edx
jmp 0x1003e832
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x98], 0x3a18e418
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x1003e81f
mov dword [esp + 0x14], ebx
jmp 0x1003e854
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xfc]
mov dword [eax + ecx*4], 0xb58e17c1
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x1003e83e
mov eax, dword [esp + 0x9c]
xor edi, edi
mov dword [esp + 0x9c], eax
inc edi
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0xfc]
inc ecx
neg ecx
sbb ecx, ecx
mov dword [eax + 4], edi
neg ecx
xor eax, eax
cmp ecx, edi
lea ecx, [esp + 0xfc]
sete al
mov dword [esp + 0x34], eax
call fcn.1000c27b
mov eax, 0x2d5e48d3
mov byte [esp + 0x1b], bl
mov dword [esp + 0x120], eax
lea ecx, [esp + 0x8c]
mov dword [esp + 0x124], eax
mov dword [esp + 0x128], eax
mov dword [esp + 0x12c], eax
mov dword [esp + 0x10], 0x52061f6
push 2
call fcn.1000c1f9
mov dword [esp + 0x10], ebx
jmp 0x1003e8ee
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x8c]
mov dword [eax + ecx*4], 0x5b40194
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1003e8d8
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x10], 3
jg 0x1003e920
mov ecx, dword [esp + 0x8c]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + eax*4 + 0x120]
mov dword [ecx + 4], eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jle 0x1003e907
mov eax, dword [esp + 0x8c]
lea ecx, [esp + 0x8c]
mov eax, dword [eax + 4]
mov dword [esp + 0x10], eax
call fcn.1000c27b
cmp byte [esp + 0x1b], 0
je 0x1003ec24
mov dword [esp + 0x10], 0xbc6e5c7a
mov dword [esp + 0x24], 0xeea53061
mov dword [esp + 0x24], 3
mov dword [esp + 0x28], 0xec299e88
mov dword [esp + 0x30], ebx
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1003e98b
push 0xb13
push ebx
push ebx
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PolyPolyline]
mov eax, dword [esp + 0x10]
xor edx, edx
mov dword [esp + 0x24], 0x401d1b98
mov eax, dword [esp + 0x24]
add eax, 0x1cfae141
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x24]
add ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
cmp ecx, eax
mov eax, dword [esp + 0x10]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, 0xb445acee
push ebx
setge cl
cmp eax, ecx
sbb eax, eax
inc eax
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
cmp dword [esp + 0x2c], 0xf7c629c4
sbb eax, eax
neg eax
mov dword [esp + 0x34], eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x1003ec24
mov dword [esp + 0x2c], 0x7f45a323
lea ecx, [esp + 0xcc]
push 3
call fcn.1000c1f9
mov byte [esp + 0x1cc], 2
lea eax, [esp + 0x18c]
push dword [esp + 0x40]
movdqa xmm0, xmmword [0x10008240]
lea ecx, [esp + 0x54]
push eax
lea eax, [esp + 0x184]
mov dword [esp + 0x58], ebx
push eax
push ebx
movdqu xmmword [esp + 0x18c], xmm0
mov dword [esp + 0x64], ebx
mov dword [esp + 0x68], ebx
call fcn.1000c726
push 2
lea ecx, [esp + 0x134]
mov byte [esp + 0x1d0], 3
call fcn.1000c1f9
mov byte [esp + 0x1cc], 4
mov dword [esp + 0x14], ebx
jmp 0x1003ea83
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xcc]
mov dword [eax + ecx*4], 0xbb2c2135
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x1003ea6d
push 2
mov dword [esp + 0x18], ebx
pop edx
jmp 0x1003eaa9
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x130]
mov dword [eax + ecx*4], 0xbdbdf7c
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x1003ea93
mov eax, dword [esp + 0x50]
mov dword [eax], edx
push 3
lea ecx, [esp + 0x84]
call fcn.1000c1f9
mov dword [esp + 0x10], ebx
jmp 0x1003eadf
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x80]
mov dword [eax + ecx*4], 0x10f7a73
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x1003eac9
mov eax, dword [esp + 0x80]
mov dword [eax], ebx
inc dword [eax]
cmp dword [eax], 2
mov dword [esp + 0x30], 0x43ac
mov dword [esp + 0x30], 0x5021c3a2
jle 0x1003eaef
mov esi, dword [esp + 0x50]
mov eax, dword [esp + 0xcc]
mov ecx, dword [esi]
cmp dword [eax + ecx*4], ebx
lea ecx, [esp + 0x80]
call fcn.1000c27b
dec dword [esi]
jns 0x1003eab5
lea ecx, [esp + 0x130]
call fcn.1000c27b
lea ecx, [esp + 0x50]
call fcn.1000c27b
lea ecx, [esp + 0xcc]
mov byte [esp + 0x1cc], bl
call fcn.1000c27b
push edi
lea ecx, [esp + 0xc4]
call fcn.1000c1f9
xor edx, edx
mov dword [esp + 0x14], ebx
inc edx
jmp 0x1003eb74
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x4c], 0x1465ee6d
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x1003eb64
mov dword [esp + 0x14], ebx
cmp dword [esp + 0x14], 2
jge 0x1003eb9e
push 0xfffffffffffffffc
pop ecx
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x174], ecx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x1003eb88
mov dword [esp + 0x14], ebx
jmp 0x1003ebba
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc0]
mov dword [eax + ecx*4], 9
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x1003eba4
mov eax, dword [esp + 0x20]
xor edi, edi
xor edx, edx
inc edi
cmp eax, edi
mov eax, dword [esp + 0x4c]
setle dl
xor ecx, ecx
cmp edx, eax
setg cl
cmp ecx, 0x4640
jle 0x1003ebe9
mov edx, ebx
cmp dword [esp + 0x4c], ebx
je 0x1003ebeb
mov edx, edi
mov eax, dword [esp + 0x20]
xor ecx, ecx
neg edx
cmp edx, eax
mov eax, dword [esp + 0xc0]
setl cl
mov dword [esp + 0x174], ecx
mov dword [eax], ecx
mov eax, dword [esp + 0x28]
add eax, ecx
lea ecx, [esp + 0xc0]
mov dword [esp + 0x34], eax
call fcn.1000c27b
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [esp + 0x70], 0x946b43d2
mov dword [esp + 0x14], 0x831713b9
mov dword [esp + 0x14], ebx
jmp 0x1003eced
mov dword [esp + 0x1c], 0xfffffff7
lea ecx, [esp + 0x15c]
push 2
call fcn.1000c1f9
mov byte [esp + 0x1cc], 5
mov dword [esp + 0x10], ebx
jmp 0x1003ec73
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x15c]
mov dword [eax + ecx*4], edi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1003ec61
mov dword [esp + 0x1c], 0xffffffec
jmp 0x1003eccf
push 3
lea ecx, [esp + 0xdc]
call fcn.1000c1f9
mov dword [esp + 0x10], ebx
jmp 0x1003ecae
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xd8]
mov dword [eax + ecx*4], 0xfffffffd
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x1003ec98
mov eax, dword [esp + 0xd8]
lea ecx, [esp + 0xd8]
dec dword [eax + 4]
call fcn.1000c27b
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xfffffff1
jne 0x1003ec84
lea ecx, [esp + 0x15c]
mov byte [esp + 0x1cc], bl
call fcn.1000c27b
dec dword [esp + 0x14]
cmp dword [esp + 0x14], 0xfffffffe
je 0x1003ec3d
mov dword [esp + 0x10], 0x89480189
inc dword [esp + 0x10]
mov dword [esp + 0x10], ebx
jmp 0x1003ed2e
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1003ed2a
push ebx
push ebx
push 0x1aa5
push 0x1a30
call esi
push eax
call dword [sym.imp.USER32.dll_ScrollWindow]
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x12
je 0x1003ed0a
push 2
lea ecx, [esp + 0xf4]
call fcn.1000c1f9
mov dword [esp + 0x10], ebx
mov dword [esp + 0x10], ebx
jmp 0x1003ed5f
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xf0]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1003ed4d
mov dword [esp + 0x10], edi
cmp dword [esp + 0x10], ebx
jl 0x1003ed86
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xf0]
cmp dword [eax + ecx*4], ebx
jne 0x1003ed86
dec dword [esp + 0x10]
jns 0x1003ed70
lea ecx, [esp + 0xf0]
call fcn.1000c27b
mov dword [esp + 0x1c], edi
lea ecx, [esp + 0x168]
mov dword [esp + 0x2c], 4
or eax, 0xffffffff
mov dword [esp + 0x2c], eax
mov dword [esp + 0x2c], 0xddd1d8f8
mov dword [esp + 0x20], 0x5165352f
mov dword [esp + 0x20], 0x516a205b
mov dword [esp + 0x30], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x30], 0x9c3d069f
mov dword [esp + 0x30], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x30], 0x6c21
mov dword [esp + 0x30], eax
push 2
call fcn.1000c1f9
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x24], 5
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x34], 0x1dc6
mov dword [esp + 0x1c], ebx
jmp 0x1003ee23
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x168]
mov dword [eax + ecx*4], edi
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jl 0x1003ee11
mov dword [esp + 0x1c], 0x19
jmp 0x1003ee67
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1003ee51
push 0x16f8
push ebx
push ebx
push 0x1f09
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1003ee63
push ebx
call dword [sym.imp.GDI32.dll_DeleteObject]
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xffffffe9
jl 0x1003ee34
mov eax, dword [esp + 0x24]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x30]
imul eax, dword [esp + 0x10]
cmp dword [esp + 0x20], eax
jne 0x1003ee99
mov eax, dword [esp + 0x34]
cmp dword [esp + 0x24], eax
mov eax, edi
jne 0x1003ee9b
mov eax, ebx
cmp eax, dword [esp + 0x3c]
jle 0x1003eea5
mov eax, dword [esp + 0x14]
inc dword [esp + 0x28]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
sub eax, 0x281c3dc7
cmp eax, 0xd5eb
je 0x1003eee4
mov dword [esp + 0x20], 0xfffffff7
mov dword [esp + 0x10], 0x15
jmp 0x1003eedb
mov eax, dword [esp + 0x20]
mov dword [esp + 0x20], eax
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xfffffff3
je 0x1003eecf
jmp 0x1003ef01
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1003ef01
push 0x829
push ebx
push ebx
push ebx
push ebx
call esi
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [esp + 0x168]
call fcn.1000c27b
mov dword [esp + 0x10], ebx
jmp 0x1003ef25
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x114]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x1003ef13
mov dword [esp + 0x10], 0xeb0647dc
mov eax, 0xbb94d0f
mov dword [esp + 0x14], 0x265ab3e9
xor edx, edx
mov dword [esp + 0x20], 0x85e0710d
mov dword [esp + 0xa0], eax
mov dword [esp + 0xa4], eax
mov dword [esp + 0xa8], eax
mov dword [esp + 0xac], eax
mov dword [esp + 0x2c], 0x9904
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x30], ebx
mov eax, dword [esp + 0x10]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
cmp ecx, eax
setne dl
add edx, dword [esp + 0x10]
mov dword [esp + 0x20], edx
mov eax, dword [esp + 0x20]
mov dword [esp + 0xa4], eax
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
jne 0x1003efb9
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0xa4]
cmp eax, dword [esp + 0x14]
jge 0x1003efce
mov eax, ebx
cmp dword [esp + 0x2c], ebx
je 0x1003efd0
mov eax, edi
cmp eax, dword [esp + 0x14]
jl 0x1003efde
mov ecx, edi
cmp dword [esp + 0x14], ebx
jne 0x1003efe0
mov ecx, ebx
xor eax, eax
cmp ecx, 0x4d996497
setge al
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x30], eax
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1003f014
push 0x1bc2
push ebx
call esi
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov dword [esp + 0x14], 0x7e2799ac
lea ecx, [esp + 0x144]
mov dword [esp + 0x2c], 0xf59172dd
mov dword [esp + 0x2c], 0xbbb66efe
mov dword [esp + 0x2c], 0xe7374489
mov dword [esp + 0x2c], 0x11b55e97
push edi
call fcn.1000c1f9
mov dword [esp + 0x28], 0x57cf
mov dword [esp + 0x10], ebx
jmp 0x1003f06d
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x144]
mov dword [eax + ecx*4], 0x8214d2fc
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x1003f057
mov dword [esp + 0x14], 0x1a
cmp dword [esp + 0x14], 7
jne 0x1003f15a
push 0xfffffffffffffffc
pop esi
mov dword [esp + 0x24], 0xb5c6f8b8
xor edx, edx
mov dword [esp + 0x20], 0xb0bb8bff
mov dword [esp + 0x2c], 0xfffffffa
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x2c], 0xeab3ae5d
mov dword [esp + 0x2c], 0xffffffff
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x14]
cmp eax, ecx
setg dl
mov dword [esp + 0x20], edx
cmp dword [esp + 0x20], ebx
je 0x1003f0f6
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x14]
sub eax, dword [esp + 0x14]
neg eax
sbb eax, eax
add eax, 2
inc eax
jne 0x1003f0f2
cmp dword [esp + 0x14], ebx
je 0x1003f0f6
mov ecx, edi
jmp 0x1003f0f8
mov ecx, ebx
xor eax, eax
cmp ecx, 0xffff
sete al
xor ecx, ecx
cmp eax, 0xb44a
mov eax, dword [esp + 0x14]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x14]
setg dl
xor ecx, ecx
cmp edx, eax
setg cl
cmp esi, ecx
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0xe283
setne cl
xor eax, eax
cmp ecx, 0xcf45
setge al
mov dword [esp + 0x2c], eax
dec dword [esp + 0x28]
dec dword [esp + 0x14]
cmp dword [esp + 0x14], 7
je 0x1003f089
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
lea ecx, [esp + 0x144]
call fcn.1000c27b
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x6c]
push eax
lea eax, [esp + 0x11c]
push eax
lea eax, [esp + 0x7c]
push ebx
push eax
call fcn.10040256
or dword [esp + 0x1e0], 0xffffffff
lea ecx, [esp + 0x128]
add esp, 0x14
call fcn.1000c27b
dec dword [esp + 0x38]
cmp dword [esp + 0x38], 0xffffffe9
jge 0x1003e1f4
mov edi, dword [esp + 0x44]
mov dword [esp + 0x20], 0xc29a3df6
xor ecx, ecx
mov dword [esp + 0x24], 0xffffffff
inc ecx
mov dword [esp + 0x28], 0x773672d7
mov dword [esp + 0x14], ebx
jmp 0x1003f1da
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x6c], ecx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ecx
jl 0x1003f1ce
mov dword [esp + 0x14], ebx
jmp 0x1003f1f9
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x1a8], 0xe0091df8
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x1003f1e6
mov eax, dword [esp + 0x20]
sub eax, dword [esp + 0x20]
neg eax
sbb eax, eax
or ecx, 0xffffffff
inc eax
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x6c], eax
dec dword [esp + 0x28]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x20], 0xf9d44c03
mov dword [esp + 0x44], 0x531f145b
mov dword [esp + 0x20], 0x70512a30
mov dword [esp + 0x2c], 0xf906d8bc
mov dword [esp + 0x2c], 0xadf86095
mov eax, dword [esp + 0x10]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [esp + 0x20], ecx
cmp dword [esp + 0x44], 0xffffffff
mov eax, dword [esp + 0x20]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
mov ecx, 0x7fce
setg dl
add edx, 0x86bd085
mov dword [esp + 0x20], edx
mov eax, dword [esp + 0x10]
sub ecx, eax
add ecx, dword [esp + 0x20]
jne 0x1003f293
cmp dword [esp + 0x10], ebx
jne 0x1003f293
mov eax, ebx
jmp 0x1003f296
xor eax, eax
inc eax
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x2c], 0x85bd52a2
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], al
je 0x1003f2cf
push 0xa9e
push 0x1094
push 0x215d
push 0x14a6
push ebx
call dword [sym.imp.USER32.dll_SetRect]
mov eax, edi
mov ecx, 0x3e8
cdq
idiv ecx
mov ecx, dword [esp + 0x40]
mov esi, edx
mov edi, eax
call fcn.1003e04a
mov ecx, dword [esp + 0x1c4]
add eax, esi
add eax, edi
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret