Function at 0x1003bafd
Capabilities:
Get graphical window text
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10069916
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2e0
push ebx
push esi
push edi
mov dword [esp + 0x4c], ecx
mov esi, edx
mov dword [esp + 0x20], 0x9b55bb2c
xor ebx, ebx
push 3
mov dword [esp + 0x34], 1
mov dword [esp + 0x40], esi
mov dword [esp + 0x24], ebx
pop edi
jmp 0x1003bb59
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x1f8], 0x9351
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edi
jl 0x1003bb46
mov dword [esp + 0x20], ebx
jmp 0x1003bc16
mov dword [esp + 0x1c], 0x417be18
mov dword [esp + 0x24], 0x3bed162c
mov dword [esp + 0x1c], ebx
jmp 0x1003bc07
mov dword [esp + 0x18], 0xfffffffe
mov dword [esp + 0x28], 0xce34aafb
mov dword [esp + 0x34], 0xfffffffb
mov eax, dword [esp + 0x1c]
cmp dword [esp + eax*4 + 0x1f8], ebx
jne 0x1003bbf5
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x200]
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x1f8], ecx
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x24], ebx
mov eax, dword [esp + 0x24]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x1c]
cmp dword [esp + eax*4 + 0x1f8], ebx
jne 0x1003bbf1
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x24]
neg eax
sbb eax, eax
neg eax
mov dword [esp + 0x34], eax
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jle 0x1003bb81
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 0x1b
jle 0x1003bb68
push dword [esp + 0x2c]
movdqa xmm0, xmmword [0x100087d0]
lea eax, [esp + 0x250]
push eax
lea eax, [esp + 0x244]
mov dword [esp + 0x84], ebx
push eax
push ebx
lea ecx, [esp + 0x8c]
mov dword [esp + 0x90], ebx
movdqu xmmword [esp + 0x24c], xmm0
mov dword [esp + 0x94], ebx
call fcn.1002f047
push 7
pop eax
mov dword [esp + 0x2f4], ebx
lea ecx, [esp + 0xe8]
mov dword [esp + 0x1c], eax
push 4
call fcn.10029e7b
xor eax, eax
inc eax
mov byte [esp + 0x2f4], al
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x2c], 0xcdba0066
mov dword [esp + 0x20], ebx
jmp 0x1003bcba
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0xe8]
mov dword [eax + ecx*4], 0xc353
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 4
jl 0x1003bca4
mov dword [esp + 0x1c], ebx
push 0xffffffffffffffff
pop ecx
cmp dword [esp + 0x1c], edi
jg 0x1003bfd4
mov esi, dword [esp + 0x7c]
jmp 0x1003bcdb
or ecx, 0xffffffff
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x2c], 0x7b6a
mov dword [esp + 0x2c], 0x97618de0
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], 0x2440
cmp dword [esp + 0x30], 0xd1c
jge 0x1003bd74
lea eax, [esp + 0x88]
push eax
push 0x100081ec
call fcn.1004f9f0
pop ecx
pop ecx
push dword [esp + 0x8c]
push dword [esp + 0x8c]
push dword [esp + 0x94]
push dword [esp + 0x94]
call fcn.10053a10
push dword [esp + 0x8c]
add eax, 5
push dword [esp + 0x8c]
adc edx, ebx
push edx
push eax
call fcn.10053a10
push ebx
push 6
push edx
push eax
call fcn.10053a50
push edx
push eax
push 0x10008314
call fcn.1004fd81
add esp, 0xc
or ecx, 0xffffffff
mov dword [esp + 0x10], ebx
jmp 0x1003bd89
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x10c], edi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x1003bd7a
mov dword [esp + 0x10], ebx
jmp 0x1003bda4
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x214], ecx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1003bd95
mov edx, dword [esp + 0x1c]
push 7
pop eax
cmp eax, dword [esi + 8]
mov eax, dword [esp + 0x7c]
sbb ecx, ecx
inc ecx
cmp dword [eax + edx*4], ecx
jg 0x1003bdcd
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
cmp dword [esi + 4], ebx
mov byte [esp + 0x17], bl
je 0x1003bdf4
cmp byte [esp + 0x17], 0
je 0x1003bde8
push ebx
call dword [sym.imp.GDI32.dll_CreateBrushIndirect]
cmp dword [esp + 0x1c], ebx
jne 0x1003bfc2
jmp 0x1003be17
cmp byte [esp + 0x17], 0
je 0x1003be17
push 0xea8
push 0x1467
push ebx
push ebx
push 0xac2
push 0x1704
call dword [sym.imp.USER32.dll_ToUnicode]
mov dword [esp + 0x10c], ebx
cmp dword [esp + 0x10c], edi
jg 0x1003bfc2
mov edi, dword [esp + 0xe8]
mov dword [esp + 0x2c], 0x7d2a7e9f
lea ecx, [esp + 0xf4]
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], 0xfffffffb
mov dword [esp + 0x2c], ebx
push 2
call fcn.10029e7b
mov byte [esp + 0x2f4], 2
lea eax, [esp + 0x25c]
push dword [esp + 0x2c]
movdqa xmm0, xmmword [0x100087f0]
lea ecx, [esp + 0xc0]
push eax
lea eax, [esp + 0x254]
mov dword [esp + 0xc4], ebx
push eax
push ebx
movdqu xmmword [esp + 0x25c], xmm0
mov dword [esp + 0xd0], ebx
mov dword [esp + 0xd4], ebx
call fcn.1002f047
mov dword [esp + 0x20], ebx
jmp 0x1003bec0
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0xf4]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 2
jl 0x1003bead
mov eax, dword [esp + 0xbc]
mov eax, dword [eax + 0xc]
mov dword [esp + 0x218], eax
test eax, eax
je 0x1003beef
mov eax, dword [esp + 0x10c]
xor ecx, ecx
mov eax, dword [esp + 0x114]
inc ecx
jmp 0x1003bef1
mov ecx, ebx
mov eax, dword [esp + 0xf4]
xor edx, edx
cmp ecx, dword [eax]
mov eax, dword [esp + 0x34]
sete dl
xor ecx, ecx
cmp edx, eax
mov dword [esi + 8], edx
sete cl
imul ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0xf4]
imul ecx, dword [eax]
add ecx, 0xb237
mov dword [esp + 0x20], ecx
xor ecx, ecx
mov eax, dword [esp + 0x20]
inc dword [esp + 0x24]
mov eax, dword [esp + 0x24]
cmp eax, dword [edi + 0xc]
setge cl
xor eax, eax
cmp ecx, dword [esi + 4]
setl al
mov dword [esp + 0x30], eax
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1003bf5c
push 0xefc
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push dword [esp + 0xbc]
call fcn.1004fee7
xor eax, eax
mov dword [esp + 0xc0], ebx
inc eax
mov dword [esp + 0xc4], ebx
pop ecx
mov byte [esp + 0x2f4], al
push dword [esp + 0xf4]
mov dword [esp + 0xc8], ebx
call fcn.1004fee7
mov dword [esp + 0xf8], ebx
mov dword [esp + 0xfc], ebx
mov dword [esp + 0x100], ebx
inc dword [esp + 0x110]
cmp dword [esp + 0x110], 3
pop ecx
jle 0x1003be32
push 3
pop edi
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edi
jle 0x1003bcd8
mov esi, dword [esp + 0x3c]
cmp dword [esp + 0xe8], 0
je 0x1003c000
push dword [esp + 0xe8]
call fcn.1004fee7
pop ecx
mov dword [esp + 0xe8], ebx
mov dword [esp + 0xec], ebx
mov dword [esp + 0xf0], ebx
or edx, 0xffffffff
mov dword [esp + 0x2f4], edx
cmp dword [esp + 0x7c], 0
je 0x1003c030
push dword [esp + 0x7c]
call fcn.1004fee7
pop ecx
mov dword [esp + 0x7c], ebx
or edx, 0xffffffff
mov dword [esp + 0x80], ebx
mov dword [esp + 0x84], ebx
mov eax, dword [0x1200d7c0]
test al, 1
jne 0x1003c0d3
or eax, 1
mov dword [0x1200d7c0], eax
push ebx
mov dword [esp + 0x2f8], edi
push ebx
mov dword [0x1200d780], ebx
mov dword [0x1200d784], ebx
call fcn.1003eb22
mov dword [0x1200d780], eax
mov dword [0x1200d788], ebx
mov dword [0x1200d790], ebx
mov byte [esp + 0x2f4], 5
mov ecx, 0x1200d788
mov dword [esp + 0x1c0], eax
lea eax, [esp + 0x1c0]
push eax
push 0x10
push ebx
lea eax, [esp + 0x228]
mov dword [0x1200d79c], 0x3f800000
push eax
mov dword [0x1200d78c], ebx
call fcn.1003e8fa
push 7
pop eax
push 0x10069ec8
mov dword [0x1200d794], eax
mov dword [0x1200d798], 8
call fcn.1004fd57
or edx, 0xffffffff
pop ecx
mov dword [esp + 0x2f4], edx
xor ecx, ecx
mov dword [esp + 0x24], 0x9f4288a1
inc ecx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x10], ebx
jmp 0x1003c0f7
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x1b8], edx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ecx
jl 0x1003c0e8
mov dword [esp + 0x10], ebx
jmp 0x1003c116
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x2c8], 0xb283066c
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x1003c103
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1003c131
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [esp + 0x24], 0xfffffff7
xor ecx, ecx
mov edx, dword [esp + 0x24]
mov dword [esp + 0x1b8], edx
mov eax, dword [esp + 0x20]
cmp edx, eax
push edi
setne cl
imul eax, dword [esp + 0x50], 0x2710
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0x128]
add eax, esi
mov dword [esp + 0xbc], eax
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x1c], 0xf425f5f9
mov dword [esp + 0x30], 0xe86524f2
mov dword [esp + 0x2c], 0x79df9481
call fcn.10029e7b
mov dword [esp + 0x10], ebx
jmp 0x1003c1a6
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x2bc], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x1003c197
mov dword [esp + 0x10], ebx
jmp 0x1003c1c8
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x124]
mov dword [eax + ecx*4], 0x2d14b432
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x1003c1b2
mov eax, 0xffff
cmp dword [esp + 0x1c], ebx
je 0x1003c1ff
mov dword [esp + 0x2c], eax
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1003c1ef
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov ecx, dword [esp + 0x124]
xor eax, eax
inc eax
mov dword [esp + 0x28], eax
jmp 0x1003c277
xor ecx, ecx
mov dword [esp + 0x20], 0x4c9d8d92
inc ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x1c], ebx
jmp 0x1003c23f
mov dword [esp + 0x30], 0xfffffffe
mov dword [esp + 0x28], ebx
jmp 0x1003c22e
mov dword [esp + 0x20], 0xfb91e60e
inc dword [esp + 0x28]
cmp dword [esp + 0x28], 2
jle 0x1003c222
cmp dword [esp + 0x30], ebx
jne 0x1003c246
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xffffffe5
jg 0x1003c214
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x24], 0xfffffff8
cmp dword [esp + 0x24], ecx
jg 0x1003c266
cmp dword [esp + 0x24], ebx
jne 0x1003c268
mov ecx, ebx
mov eax, dword [esp + 0x20]
sub eax, ecx
mov ecx, dword [esp + 0x124]
mov dword [ecx], eax
test ecx, ecx
je 0x1003c297
push ecx
call fcn.1004fee7
pop ecx
mov dword [esp + 0x124], ebx
mov dword [esp + 0x128], ebx
mov dword [esp + 0x12c], ebx
lea eax, [esp + 0xb8]
push eax
call fcn.1003e036
push 7
lea ecx, [esp + 0x1e0]
mov esi, dword [eax]
mov dword [esp + 0x28], 0x2ff18c9a
pop eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0xd44f
mov dword [esp + 0x20], 0xfffffff9
mov dword [esp + 0x20], 0x5a52
mov dword [esp + 0x20], 0x7d3709e8
push 2
call fcn.10029e7b
mov dword [esp + 0x20], ebx
jmp 0x1003c2fc
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x1dc]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 2
jl 0x1003c2e9
mov dword [esp + 0x20], 0xdcda
xor ecx, ecx
mov eax, dword [esp + 0x24]
cmp eax, 2
setne cl
cmp ecx, dword [esp + 0x20]
jle 0x1003c321
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
mov ecx, 0xffff
mov eax, dword [esp + 0x24]
cmp ecx, eax
sbb eax, eax
neg eax
mov dword [esp + 0x24], eax
jne 0x1003c347
cmp dword [esp + 0x1c], ebx
jne 0x1003c347
xor edx, edx
mov ecx, ebx
inc edx
jmp 0x1003c34c
xor edx, edx
inc edx
mov ecx, edx
or eax, 0xffffffff
sub eax, ecx
cmp eax, dword [esp + 0x1c]
jle 0x1003c35f
mov ecx, ebx
cmp dword [esp + 0x1c], ebx
je 0x1003c361
mov ecx, edx
xor eax, eax
cmp ecx, 0x637b3047
setle al
xor edx, edx
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
cmp ecx, eax
setle dl
sub edx, dword [esp + 0x1c]
neg edx
sbb edx, edx
inc edx
sub edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
neg edx
sbb edx, edx
inc edx
mov dword [esp + 0x30], edx
xor edx, edx
cmp dword [esp + 0x30], eax
mov eax, dword [esp + 0x1c]
setle dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
cmp ecx, 0xffffffff
setge al
xor edx, edx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
cmp eax, 0x3ea3
mov eax, dword [esp + 0x1c]
setl dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
cmp ecx, 5
setl al
xor ecx, ecx
cmp eax, 0x3be41b0c
setle cl
add ecx, dword [esp + 0x1c]
je 0x1003c3f5
cmp dword [esp + 0x1c], ebx
je 0x1003c3f5
xor eax, eax
inc eax
jmp 0x1003c3f7
mov eax, ebx
mov dword [esp + 0x20], eax
xor edx, edx
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
cmp ecx, eax
setle dl
sub edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x1dc]
neg edx
push eax
sbb edx, edx
inc edx
mov dword [eax + 4], edx
call fcn.1004fee7
mov dword [esp + 0x1e0], ebx
mov dword [esp + 0x1e4], ebx
mov dword [esp + 0x1e8], ebx
pop ecx
test esi, esi
je 0x1003c449
mov dword [esp + 0x1d0], esi
jmp 0x1003dd01
mov dword [esp + 0x1c], edi
mov dword [esp + 0x30], ebx
mov dword [esp + 0x30], 0xbe945d44
mov dword [esp + 0x18], 0x80a25601
mov dword [esp + 0x10], ebx
jmp 0x1003c47a
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x220], 0xfffffffd
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1003c467
mov dword [esp + 0x10], ebx
jmp 0x1003c497
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x50], 0x4cd45360
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1003c487
xor eax, eax
inc eax
mov dword [esp + 0x54], eax
cmp dword [esp + 0x54], ebx
jl 0x1003c4c8
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1003c4c2
push ebx
push 0x211c
call dword [sym.imp.GDI32.dll_SelectClipRgn]
dec dword [esp + 0x54]
jns 0x1003c4ab
mov dword [esp + 0x1c], 0xfffffff1
jmp 0x1003c69c
push 2
lea ecx, [esp + 0x104]
call fcn.10029e7b
mov dword [esp + 0x28], 0xfffffff9
xor ecx, ecx
mov dword [esp + 0x24], 0xd09e
inc ecx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x34], 0x3ecb
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x10], 2
jge 0x1003c531
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x100]
mov dword [eax + ecx*4], 0xabac
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1003c511
xor ecx, ecx
inc ecx
mov dword [esp + 0x10], ebx
jmp 0x1003c54a
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x29c], 0xfffffffa
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x1003c537
mov esi, dword [esp + 0x100]
mov eax, dword [esi + 4]
mov dword [esp + 0x28], eax
cmp dword [esp + 0x28], ebx
je 0x1003c58d
mov eax, dword [esp + 0x224]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x54]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x20], eax
cmp dword [esp + 0x20], ebx
je 0x1003c58d
mov edx, ebx
cmp dword [esp + 0x28], ebx
je 0x1003c58f
mov edx, ecx
mov eax, dword [esp + 0x1c]
xor ecx, ecx
cmp eax, edx
setl cl
cmp ecx, dword [esp + 0x1c]
jge 0x1003c5a4
mov eax, dword [esp + 0x54]
mov eax, dword [esp + 0x29c]
xor edx, edx
imul eax, dword [esp + 0x24], 0xcd4f
mov dword [esp + 0x30], eax
mov ecx, dword [esp + 0x54]
mov eax, dword [esp + 0x54]
cmp ecx, eax
mov eax, dword [esp + 0x1c]
setge dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [esp + 0x50], ecx
cmp ecx, dword [esp + 0x1c]
jl 0x1003c5e6
cmp dword [esp + 0x28], ebx
je 0x1003c5e6
xor eax, eax
inc eax
jmp 0x1003c5e8
mov eax, ebx
xor edx, edx
cmp eax, 0xccc41425
mov eax, dword [esp + 0x34]
sete dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [esp + 0x30], ecx
mov ecx, 0xb3b3333d
mov eax, dword [esp + 0x18]
cmp ecx, eax
mov eax, dword [esp + 0x24]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov ecx, dword [esp + 0x1c]
setge dl
xor eax, eax
cmp edx, dword [esi + 4]
setge al
add ecx, eax
mov eax, dword [esp + 0x100]
imul ecx, dword [eax]
imul ecx, dword [esi + 4]
cmp ecx, 0xfffffffe
sbb eax, eax
inc eax
cmp eax, 2
jle 0x1003c66b
xor eax, eax
mov dword [esp + 0x24], 0xb52d9b6e
mov dword [esp + 0x18], ebx
inc eax
jmp 0x1003c663
mov dword [esp + 0x2c], 0x5901a700
inc dword [esp + 0x24]
inc dword [esp + 0x18]
cmp dword [esp + 0x18], eax
jle 0x1003c653
jmp 0x1003c676
xor eax, eax
inc eax
mov dword [esp + 0x24], eax
neg dword [esp + 0x24]
push dword [esp + 0x100]
call fcn.1004fee7
mov dword [esp + 0x104], ebx
mov dword [esp + 0x108], ebx
mov dword [esp + 0x10c], ebx
inc dword [esp + 0x20]
pop ecx
cmp dword [esp + 0x1c], 0xd
jg 0x1003c4d5
mov eax, dword [0x1200d7c0]
test al, 2
jne 0x1003c750
or eax, 2
mov dword [0x1200d7c0], eax
push ebx
mov dword [esp + 0x2f8], 6
push ebx
mov dword [0x1200d7a0], ebx
mov dword [0x1200d7a4], ebx
call fcn.1003eb22
mov dword [0x1200d7a0], eax
mov dword [0x1200d7a8], ebx
mov dword [0x1200d7b0], ebx
mov byte [esp + 0x2f4], 8
mov ecx, 0x1200d7a8
mov dword [esp + 0x1b4], eax
lea eax, [esp + 0x1b4]
push eax
push 0x10
push ebx
lea eax, [esp + 0x238]
mov dword [0x1200d7bc], 0x3f800000
push eax
mov dword [0x1200d7ac], ebx
call fcn.1003e8fa
push 7
pop eax
push 0x10069ec3
mov dword [0x1200d7b4], eax
mov dword [0x1200d7b8], 8
call fcn.1004fd57
or esi, 0xffffffff
pop ecx
mov dword [esp + 0x2f4], esi
jmp 0x1003c753
or esi, 0xffffffff
push edi
lea ecx, [esp + 0x1a0]
call fcn.10029e7b
mov dword [esp + 0x2f4], 9
lea ecx, [esp + 0x16c]
mov dword [esp + 0x28], 0x2667a876
mov dword [esp + 0x2c], 5
mov dword [esp + 0x24], 0xfffffffa
mov dword [esp + 0x2c], 0xbb002891
push edi
call fcn.10029e7b
mov byte [esp + 0x2f4], 0xa
mov dword [esp + 0x2c], 0x42b6
mov dword [esp + 0x10], ebx
jmp 0x1003c7c4
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x19c]
mov dword [eax + ecx*4], 0xfdf99ff6
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x1003c7ae
mov dword [esp + 0x10], ebx
jmp 0x1003c7e6
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x16c]
mov dword [eax + ecx*4], 0x33bd3e01
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x1003c7d0
mov dword [esp + 0x28], ebx
jmp 0x1003c92b
mov dword [esp + 0x18], 0x696a485b
xor ecx, ecx
mov dword [esp + 0x2c], 0x96141e4f
inc ecx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x20], ebx
jmp 0x1003c825
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x1bc], 8
inc dword [esp + 0x20]
cmp dword [esp + 0x20], ecx
jl 0x1003c812
mov dword [esp + 0x18], ebx
jmp 0x1003c8f6
mov dword [esp + 0x24], 0x7161ab6e
lea ecx, [esp + 0x184]
mov dword [esp + 0x2c], esi
mov dword [esp + 0x2c], 0x887e08a1
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x2c], 0x748dc164
push edi
call fcn.10029e7b
mov dword [esp + 0x10], 0xff6
mov dword [esp + 0x20], ebx
jmp 0x1003c885
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x184]
mov dword [eax + ecx*4], 0xfffffffd
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edi
jl 0x1003c86f
mov dword [esp + 0x24], 2
cmp dword [esp + 0x24], ebx
jl 0x1003c8c6
xor eax, eax
inc eax
mov dword [esp + 0x2c], 0xfffffffb
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x2c], 0xc92ea21e
mov dword [esp + 0x2c], 0x6ce028f4
mov dword [esp + 0x2c], eax
dec dword [esp + 0x10]
dec dword [esp + 0x24]
jns 0x1003c89c
cmp dword [esp + 0x184], 0
je 0x1003c8f2
push dword [esp + 0x184]
call fcn.1004fee7
pop ecx
mov dword [esp + 0x184], ebx
mov dword [esp + 0x188], ebx
mov dword [esp + 0x18c], ebx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jle 0x1003c834
mov dword [esp + 0x24], 2
cmp dword [esp + 0x24], ebx
jl 0x1003c927
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1003c921
push ebx
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
dec dword [esp + 0x24]
jns 0x1003c90f
inc dword [esp + 0x28]
cmp dword [esp + 0x28], 2
jle 0x1003c7f5
cmp dword [esp + 0x16c], 0
je 0x1003c962
push dword [esp + 0x16c]
call fcn.1004fee7
pop ecx
mov dword [esp + 0x16c], ebx
mov dword [esp + 0x170], ebx
mov dword [esp + 0x174], ebx
mov dword [esp + 0x2f4], esi
cmp dword [esp + 0x19c], 0
je 0x1003c995
push dword [esp + 0x19c]
call fcn.1004fee7
pop ecx
mov dword [esp + 0x19c], ebx
mov dword [esp + 0x1a0], ebx
mov dword [esp + 0x1a4], ebx
xorps xmm0, xmm0
xor edx, edx
movdqu xmmword [esp + 0x1e8], xmm0
mov dword [esp + 0x20], 0x85c9e53e
mov dword [esp + 0x24], 0xf4a41637
mov dword [esp + 0x30], 5
mov dword [esp + 0x30], edi
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
cmp ecx, eax
push 0
setl dl
mov dword [esp + 0x28], edx
mov eax, dword [esp + 0x28]
mov dword [esp + 0x34], eax
cmp dword [esp + 0x24], esi
sbb eax, eax
neg eax
pop eax
sets al
xor edx, edx
imul eax, eax, 0x531f
cmp eax, 8
mov eax, dword [esp + 0x20]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [esp + 0x30], ecx
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1003ca27
push 0x16d2
push 0x1827
push 0x142b
call dword [sym.imp.USER32.dll_SetClassLongA]
lea eax, [esp + 0x4c]
push eax
call fcn.1003e098
cmp byte [ebp + 0xc], 0
mov esi, dword [eax]
mov dword [esp + 0x20], esi
jne 0x1003ca45
test esi, esi
jne 0x1003ce73
xor ecx, ecx
inc ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x10], 6
mov dword [esp + 0x28], 2
cmp dword [esp + 0x24], ebx
mov dword [esp + 0x18], ebx
je 0x1003cb33
jmp 0x1003ca7f
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x148], 0xc781ced8
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x1003ca6c
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1003caa0
push 0x10e8
push 0x2149
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
mov eax, dword [esp + 0x14c]
xor ecx, ecx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x14c]
cmp eax, 0x9a2b441
setg cl
xor eax, eax
cmp ecx, 0x2a96950a
mov ecx, 0xe1636939
setl al
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x14c]
sub ecx, eax
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x24]
add edx, ecx
mov ecx, dword [esp + 0x30]
sub ecx, eax
cmp edx, ecx
jge 0x1003caf4
mov eax, dword [esp + 0x14c]
mov ecx, dword [esp + 0x14c]
mov eax, dword [esp + 0x14c]
dec ecx
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [esp + 0x24]
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [esp + 0x28], ecx
jmp 0x1003cb5c
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x1c4], 0x2e819d33
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ecx
jl 0x1003cb20
mov eax, dword [esp + 0x28]
mov dword [esp + 0x10], eax
mov dword [esp + 0x10], ebx
jmp 0x1003cb56
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x1c4], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ecx
jl 0x1003cb47
mov dl, byte [ebp + 0xc]
lea eax, [esp + 0x2d8]
mov ecx, dword [esp + 0x4c]
push eax
call fcn.10030894
mov esi, eax
lea edi, [esp + 0x1ec]
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x1c], 0xb950
mov dword [esp + 0x18], ebx
jmp 0x1003cba3
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x94], 0x2daab72b
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jl 0x1003cb90
mov eax, dword [esp + 0x10]
xor edx, edx
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
cmp ecx, eax
mov eax, dword [esp + 0x10]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x1c]
setle cl
xor edx, edx
cmp ecx, eax
setg dl
mov dword [esp + 0x98], edx
mov eax, dword [esp + 0x10]
neg eax
sbb eax, eax
inc eax
cmp eax, edx
jg 0x1003cc07
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1003cd11
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
jmp 0x1003cd11
push 0xffffffffffffffe4
mov dword [esp + 0x2c], 0x30a4ccfd
mov dword [esp + 0x20], 0xfffffff4
pop esi
jmp 0x1003cd07
mov dword [esp + 0x24], 0xd133f29
xor edx, edx
mov dword [esp + 0x30], 0xdc32c752
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x28]
cmp ecx, eax
push 0xfffffffffffffff7
setge dl
xor eax, eax
inc eax
cmp eax, edx
pop edx
sbb eax, eax
mov ecx, edx
neg eax
sub ecx, eax
neg ecx
sbb ecx, ecx
neg ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], edx
jmp 0x1003ccf9
push 7
mov dword [esp + 0x1c], 0xffffffff
pop eax
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
cmp eax, dword [esp + 0x1c]
jg 0x1003cc86
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x98]
xor edx, edx
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], 0xdfe9
mov ecx, dword [esp + 0x18]
sub ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x98]
cmp eax, ecx
mov eax, dword [esp + 0x94]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x24]
setle cl
mov dword [esp + 0x30], ecx
xor ecx, ecx
cmp dword [esp + 0x30], eax
setl cl
sub ecx, dword [esp + 0x1c]
jne 0x1003ccee
cmp dword [esp + 0x28], ebx
jne 0x1003ccee
mov eax, ebx
jmp 0x1003ccf1
xor eax, eax
inc eax
mov dword [esp + 0x30], eax
dec dword [esp + 0x28]
cmp dword [esp + 0x28], esi
je 0x1003cc61
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], esi
jl 0x1003cc1f
mov dword [esp + 0x10], ebx
jmp 0x1003ce3b
push 2
lea ecx, [esp + 0x164]
call fcn.10029e7b
mov dword [esp + 0x2f4], 0xb
lea eax, [esp + 0x27c]
push dword [esp + 0x1bc]
movdqa xmm0, xmmword [0x10008820]
lea ecx, [esp + 0xa4]
push eax
lea eax, [esp + 0x274]
mov dword [esp + 0xa8], ebx
push eax
push ebx
movdqu xmmword [esp + 0x27c], xmm0
mov dword [esp + 0xb4], ebx
mov dword [esp + 0xb8], ebx
call fcn.1002f047
push 2
mov dword [esp + 0x28], 0xfffffff9
mov dword [esp + 0x1c], ebx
pop edx
jmp 0x1003cda4
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x160]
mov dword [eax + ecx*4], 0xcd5c0f4
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edx
jl 0x1003cd8e
mov dword [esp + 0x1c], ebx
jmp 0x1003cdc3
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x94], 0xfffffffc
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edx
jl 0x1003cdb0
mov eax, dword [esp + 0x160]
mov ecx, dword [eax]
mov eax, dword [esp + 0xa0]
mov dword [eax + 8], ecx
mov dword [esp + 0x24], ecx
mov eax, dword [esp + 0x24]
push dword [esp + 0xa0]
mov dword [esp + 0x9c], eax
call fcn.1004fee7
or dword [esp + 0x2f8], 0xffffffff
pop ecx
push dword [esp + 0x160]
mov dword [esp + 0xa4], ebx
mov dword [esp + 0xa8], ebx
mov dword [esp + 0xac], ebx
call fcn.1004fee7
mov dword [esp + 0x164], ebx
mov dword [esp + 0x168], ebx
mov dword [esp + 0x16c], ebx
inc dword [esp + 0x14]
pop ecx
cmp dword [esp + 0x10], 0x20
jne 0x1003cd1a
cmp byte [ebp + 0xc], 0
mov esi, dword [esp + 0x20]
push 3
pop edi
je 0x1003ce73
mov ecx, dword [esp + 0x1f0]
test ecx, ecx
je 0x1003ce73
mov eax, dword [esp + 0x1f4]
mov dword [esp + 0x1d4], eax
mov dword [esp + 0x1d8], ecx
mov dword [esp + 0x18], 0xfffffffe
mov dword [esp + 0x18], ebx
jmp 0x1003ce94
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x2a8], 0x3b91
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x1003ce81
mov dword [esp + 0x18], 2
cmp dword [esp + 0x18], ebx
jl 0x1003cecb
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1003ceba
push ebx
call dword [sym.imp.USER32.dll_RegisterClassW]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + eax*4 + 0x2a8]
dec dword [esp + 0x18]
jns 0x1003cea8
test esi, esi
jne 0x1003da83
cmp dword [esp + 0x1e8], esi
jle 0x1003da83
xor eax, eax
mov dword [esp + 0x18], 0x33147f59
inc eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x1c], 0xa41b8700
lea ecx, [esp + 0xac]
mov dword [esp + 0x10], 0x87778e10
push eax
call fcn.10029e7b
mov dword [esp + 0x2f4], 0xc
xor edx, edx
inc edx
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], 0x533b
mov dword [esp + 0x24], 0x2c9c813c
mov dword [esp + 0x10], ebx
jmp 0x1003cf40
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x38], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x1003cf34
mov dword [esp + 0x10], ebx
jmp 0x1003cf62
lea ecx, [esp + 0x1e8]
call fcn.10037a74
test esi, esi
je 0x1003dc05
mov dword [esp + 0x28], 0xfff7
lea ecx, [esp + 0x154]
mov dword [esp + 0x30], 0x5c174734
xor eax, eax
mov dword [esp + 0x2c], 0xc47d1afd
inc eax
mov dword [esp + 0x24], eax
mov eax, 0x28cbd6cd
mov dword [esp + 0x34], 0x9d3cd362
mov dword [esp + 0x20], 0x65cab430
mov dword [esp + 0x18], 0x2ab2bc8f
mov dword [esp + 0x34], 0x4b38b4b7
mov dword [esp + 0x204], eax
mov dword [esp + 0x208], eax
mov dword [esp + 0x20c], eax
mov dword [esp + 0x210], eax
push 4
call fcn.10029e7b
push 7
pop eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], ebx
jmp 0x1003db25
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x2b4], 0xfffffff9
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1003db12
mov dword [esp + 0x10], ebx
jmp 0x1003db48
push 7
pop eax
mov dword [esp + 0x20], eax
lea ecx, [esp + 0x230]
mov dword [esp + 0x28], edi
or eax, 0xffffffff
mov dword [esp + 0x24], eax
mov dword [esp + 0x10], 0xd44c039e
mov dword [esp + 0x18], 6
mov dword [esp + 0x2c], 0x780f885b
mov dword [esp + 0x3c], 0x85950cfd
push edi
call fcn.10029e7b
mov dword [esp + 0x24], ebx
jmp 0x1003dc60
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x230]
mov dword [eax + ecx*4], 0x604491d0
inc dword [esp + 0x24]
cmp dword [esp + 0x24], edi
jl 0x1003dc4a
mov ecx, dword [esp + 0x20]
xor edx, edx
mov eax, dword [esp + 0x20]
cmp ecx, eax
setl dl
mov dword [esp + 0x28], edx
mov eax, dword [esp + 0x28]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x20], eax
jle 0x1003dcb4
mov eax, dword [ebp + 8]
lea esi, [esp + 0x1d0]
mov ecx, dword [esp + 0x2ec]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret