Function at 0x10036950
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d9da0
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x10145188]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
push ebx
mov esi, ecx
push 0xbbb
mov dword [ebp - 0x2c], esi
call dword [sym.imp.mfc100u.dll_CDialogEx::CDialogEx]
mov dword [ebp - 4], ebx
mov dword [esi], vtable.CDuiCaptureScreen.0
mov dword [esi + 0xbc], vtable.CPngImage2.0
mov dword [esi + 0xc0], ebx
mov dword [esi + 0xc4], vtable.CPngImage2.0
mov dword [esi + 0xc8], ebx
mov dword [esi + 0xcc], vtable.CPngImage2.0
mov dword [esi + 0xd0], ebx
mov dword [esi + 0xd4], vtable.CPngImage2.0
mov dword [esi + 0xd8], ebx
mov byte [ebp - 4], 4
mov dword [esi + 0xe8], ebx
mov dword [esi + 0xec], ebx
mov dword [esi + 0xf0], ebx
mov dword [esi + 0xf4], ebx
mov dword [esi + 0xf8], ebx
mov dword [esi + 0xfc], ebx
mov dword [esi + 0x100], ebx
mov dword [esi + 0x104], ebx
mov dword [esi + 0x108], ebx
mov dword [esi + 0x10c], ebx
mov dword [esi + 0x110], ebx
mov dword [esi + 0x114], ebx
mov dword [esi + 0x118], ebx
mov dword [esi + 0x11c], ebx
mov dword [esi + 0x120], ebx
mov dword [esi + 0x124], ebx
mov dword [esi + 0x128], ebx
mov dword [esi + 0x12c], ebx
mov dword [esi + 0x130], ebx
mov dword [esi + 0x134], ebx
mov dword [esi + 0x138], ebx
mov dword [esi + 0x13c], ebx
mov dword [esi + 0x140], ebx
mov dword [esi + 0x144], ebx
mov dword [esi + 0x148], ebx
mov dword [esi + 0x14c], ebx
mov dword [esi + 0x150], ebx
mov dword [esi + 0x154], ebx
mov dword [esi + 0x158], ebx
mov dword [esi + 0x15c], ebx
mov dword [esi + 0x160], ebx
mov dword [esi + 0x164], ebx
mov dword [esi + 0x168], ebx
mov dword [esi + 0x16c], ebx
mov dword [esi + 0x170], ebx
mov dword [esi + 0x174], ebx
mov dword [esi + 0x178], ebx
mov dword [esi + 0x17c], ebx
mov dword [esi + 0x1a8], ebx
mov dword [esi + 0x1ac], ebx
mov dword [esi + 0x1b0], ebx
mov dword [esi + 0x1b4], ebx
mov dword [esi + 0x1b8], ebx
mov dword [esi + 0x1bc], ebx
mov dword [esi + 0x1c0], ebx
mov dword [esi + 0x1c4], ebx
mov dword [esi + method.CRectTracker.virtual_0], vtable.CRectTracker.0
mov dword [esi + 0x1e0], ebx
mov dword [esi + 0x1e4], ebx
mov dword [esi + 0x1e8], ebx
mov dword [esi + 0x1ec], ebx
mov dword [esi + 0x1f0], ebx
mov dword [esi + 0x1f4], ebx
mov dword [esi + 0x200], ebx
mov dword [esi + 0x204], ebx
mov dword [esi + 0x208], ebx
mov dword [esi + 0x20c], ebx
mov dword [esi + 0x210], ebx
mov dword [esi + 0x214], ebx
lea ecx, [esi + 0x1d8]
call dword [sym.imp.mfc100u.dll_CRectTracker::Construct]
mov dword [esi + method.CRectTrackerInheritance.virtual_0], vtable.CRectTrackerInheritance.0
mov dword [esi + 0x230], ebx
mov dword [esi + 0x234], ebx
mov dword [esi + 0x238], ebx
mov dword [esi + 0x23c], ebx
mov dword [esi + 0x244], ebx
mov dword [esi + method.CRgn.virtual_0], vtable.CRgn.0
mov byte [ebp - 4], 6
lea ecx, [esi + 0x260]
mov dword [esi + 0x248], ebx
mov dword [esi + 0x24c], ebx
call dword [sym.imp.mfc100u.dll_CToolBar::CToolBar]
or eax, 0xffffffff
push 0x10148900
mov dword [esi + method.ATL::CImage.virtual_0], vtable.ATL::CImage.0
mov dword [esi + 0x344], ebx
mov dword [esi + 0x348], ebx
mov dword [esi + 0x34c], ebx
mov dword [esi + 0x350], ebx
mov dword [esi + 0x354], ebx
mov dword [esi + 0x358], ebx
mov word [esi + 0x35c], bx
mov dword [esi + 0x360], eax
mov dword [esi + 0x364], eax
mov dword [esi + 0x368], ebx
mov dword [esi + 0x36c], ebx
mov dword [esi + 0x370], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
inc dword [0x10148918]
push 0x10148900
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea ecx, [esi + 0x378]
call dword [0x100ec970]
lea eax, [ebp - 0x28]
push ebx
push eax
mov byte [ebp - 4], 9
call dword [sym.imp.Common.dll_class_ATL::CStringT_wchar_t__class_StrTraitMFC_DLL_wchar_t__class_ATL::ChTraitsCRT_wchar_t______cdecl_COMMON::GetAppPath_int_]
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x24]
push edx
mov edi, str.ResourceclassroomexamSC_MASK.png
mov byte [ebp - 4], 0xa
call fcn.10001a90
add esp, 0x10
mov byte [ebp - 4], 0xb
mov eax, dword [eax]
push eax
lea edi, [esi + 0xbc]
call fcn.100407a0
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0xa
call dword [sym.imp.mfc100u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_cla]
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x24]
push ecx
mov edi, str.Resourceclassroomexam_screenshot_btn.png
call fcn.10001a90
add esp, 8
mov byte [ebp - 4], 0xc
mov eax, dword [eax]
push eax
lea edi, [esi + 0xc4]
call fcn.100407a0
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0xa
call dword [sym.imp.mfc100u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_cla]
lea edx, [ebp - 0x28]
push edx
lea eax, [ebp - 0x24]
push eax
mov edi, str.Resourceclassroomexam_btn_cancel.png
call fcn.10001a90
add esp, 8
mov byte [ebp - 4], 0xd
mov eax, dword [eax]
push eax
lea edi, [esi + 0xd4]
call fcn.100407a0
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0xa
call dword [sym.imp.mfc100u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_cla]
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x24]
push edx
mov edi, str.Resourceclassroomexam_btn_confirm.png
call fcn.10001a90
add esp, 8
mov byte [ebp - 4], 0xe
mov eax, dword [eax]
push eax
lea edi, [esi + 0xcc]
call fcn.100407a0
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0xa
call dword [sym.imp.mfc100u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_cla]
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push ebx
call edi
push 1
mov dword [esi + 0x1cc], eax
call edi
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
mov dword [esi + 0x1d0], eax
push 0xffffffffffffffff
lea eax, [esi + 0x1e0]
push eax
mov dword [esi + 0x1dc], 0xa
call dword [sym.imp.USER32.dll_SetRect]
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x24]
push edx
mov edi, str.ResourceclassroomexamARROW_COLOR.cur
call fcn.10001a90
add esp, 8
mov byte [ebp - 4], 0xf
mov edi, dword [eax]
call dword [sym.imp.mfc100u.dll_AfxGetModuleState]
mov eax, dword [eax + 8]
push 0x10
push 0x20
push 0x20
push 2
push edi
push eax
call dword [sym.imp.USER32.dll_LoadImageW]
lea ecx, [ebp - 0x24]
mov dword [esi + 0x22c], eax
mov byte [ebp - 4], 0xa
call dword [sym.imp.mfc100u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_cla]
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
xor eax, eax
push ebx
mov byte [esi + 0x25c], 1
mov dword [esi + 0x250], ebx
mov dword [esi + 0x254], ebx
mov dword [esi + 0x258], ebx
mov dword [esi + 0x248], eax
mov dword [esi + 0x24c], ebx
mov dword [esi + 0x1d4], ebx
call edi
mov dword [esi + 0x220], eax
push 1
call edi
mov ecx, dword [esi + 0x220]
push ebx
lea edx, [ebp - 0x20]
push edx
mov dword [esi + 0x224], eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], eax
call fcn.10038010
push eax
call dword [sym.imp.mfc100u.dll_CGdiObject::FromHandle]
push 0x32
push 0x32
push ebx
push ebx
mov dword [esi + 0x228], eax
mov dword [esi + 0xdc], eax
call dword [sym.imp.GDI32.dll_CreateRectRgn]
push eax
lea ecx, [esi + 0x240]
call dword [sym.imp.mfc100u.dll_CGdiObject::Attach]
push 0x10
push ebx
push ebx
push 1
push str.resClassManagerAppTch.ico
push ebx
mov byte [esi + 0x374], bl
mov dword [esi + 0x37c], ebx
call dword [sym.imp.USER32.dll_LoadImageW]
lea ecx, [ebp - 0x28]
mov dword [esi + 0xb8], eax
call dword [sym.imp.mfc100u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_cla]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100d0962
mov esp, ebp
pop ebp
ret