Function at 0x1007242f
Capabilities:
Check for time delay via gettickcount
Create directory
Get graphical window text
Resolve function by parsing pe exports
Set global application hook

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100886c2
mov eax, dword fs:[0]
push eax
sub esp, 0x248
mov eax, dword [0x100a609c]
xor eax, esp
mov dword [esp + 0x240], eax
push ebx
push esi
push edi
mov eax, dword [0x100a609c]
xor eax, esp
push eax
lea eax, [esp + 0x258]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
call dword [sym.imp.mfc100.dll_Ordinal_9475]
xor ebx, ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], vtable.CRgn.0
lea eax, [esp + 0x7c]
push eax
mov dword [esp + 0x264], ebx
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetClientRect]
mov edx, dword [esp + 0x80]
mov eax, dword [esp + 0x88]
mov edi, dword [esp + 0x7c]
mov ecx, dword [esp + 0x84]
push 6
sub eax, edx
push 6
sub ecx, edi
sub eax, 3
push eax
sub ecx, 3
push ecx
add edx, 3
push edx
add edi, 3
push edi
call dword [sym.imp.GDI32.dll_CreateRoundRectRgn]
mov edi, dword [sym.imp.mfc100.dll_Ordinal_2184]
push eax
lea ecx, [esp + 0x2c]
call edi
push 1
push dword [esp + 0x30]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_SetWindowRgn]
mov esi, dword [sym.imp.mfc100.dll_Ordinal_265]
push 0x1f4
call esi
mov dword [esp + 0x20], eax
mov dword [esp], 0x1f4
call esi
mov esi, dword [sym.imp.MSVCR100.dll_sprintf]
mov dword [esp], 0x10111f10
push str._sMap__btn_min.png
push dword [esp + 0x24]
mov dword [esp + 0x24], eax
call esi
add esp, 0xc
push 0x10111f10
push str._sMap__Background.png
push dword [esp + 0x20]
call esi
add esp, 0xc
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], vtable.CBitmap.0
lea esi, [esp + 0x30]
call fcn.10004edd
mov ecx, dword [esp + 0x18]
mov eax, esi
push eax
mov byte [esp + 0x264], 2
call fcn.10004cc8
mov eax, dword [esp + 0x34]
or dword [esp + 0x50], 0xffffffff
or dword [esp + 0x54], 0xffffffff
push eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x48], ebx
mov word [esp + 0x50], bx
call edi
push dword [esp + 0x24]
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
push eax
mov ecx, 0x100a6324
call edi
push ecx
mov ecx, esp
mov dword [esp + 0x6c], esp
push dword [esp + 0x1c]
call dword [sym.imp.mfc100.dll_Ordinal_310]
push ecx
mov byte [esp + 0x268], 3
mov ecx, esp
mov dword [esp + 0x6c], esp
push dword [esp + 0x24]
call dword [sym.imp.mfc100.dll_Ordinal_310]
mov esi, dword [esp + 0x1c]
add esi, 0x338
mov byte [esp + 0x268], 2
call fcn.10004125
mov eax, dword [esp + 0x84]
add eax, 0xffffffd3
push eax
mov edi, esi
call fcn.10004172
push dword [esp + 0x1c]
mov esi, dword [sym.imp.mfc100.dll_Ordinal_1296]
call esi
pop ecx
push dword [esp + 0x18]
call esi
mov edi, dword [esp + 0x18]
mov esi, dword [sym.imp.mfc100.dll_Ordinal_7214]
pop ecx
push ebx
push ebx
push 0x10094b30
push 1
add edi, 0x94
push 1
mov ecx, edi
call esi
push ebx
push ebx
push 0x10094b38
push 2
push 1
mov ecx, edi
call esi
push ebx
push ebx
push 0x10094b40
push 3
push 1
mov ecx, edi
call esi
push ebx
push ebx
push 0x10094b48
push 4
push 1
mov ecx, edi
call esi
push ebx
push ebx
push 0x10094b60
push 5
push 1
mov ecx, edi
call esi
push ebx
push ebx
push 0x10094b8c
push 6
push 1
mov ecx, edi
call esi
push ebx
push ebx
push 0x10094b94
push 7
push 1
mov ecx, edi
call esi
push ebx
push ebx
push 0x1009c584
push 8
push 1
mov ecx, edi
call esi
push ebx
push ebx
push 0x10094b9c
push 9
push 1
mov ecx, edi
call esi
push ebx
push ebx
push 0x10094bc0
push 0xa
push 1
mov ecx, edi
call esi
push ebx
push ebx
push 0x10094bd0
push 0xb
push 1
mov ecx, edi
call esi
push ebx
push ebx
push 0x1009c58c
push 0xc
push 1
mov ecx, edi
call esi
push ebx
push ebx
push 0x1009c594
push 0xd
push 1
mov ecx, edi
call esi
mov ecx, dword [esp + 0x14]
mov esi, dword [sym.imp.mfc100.dll_Ordinal_4785]
mov ebx, 0x1b58
push ebx
call esi
mov edi, dword [sym.imp.mfc100.dll_Ordinal_2752]
push eax
push 0x1b5b
mov ecx, 0x103c2878
call edi
mov ecx, dword [esp + 0x14]
push ebx
call esi
push eax
push 0x1b5c
mov ecx, 0x103c3c78
call edi
mov ecx, dword [esp + 0x14]
push ebx
call esi
push eax
push 0x1b5d
mov ecx, 0x103c5438
call edi
mov ecx, dword [esp + 0x14]
push ebx
call esi
push eax
push 0x1b5e
mov ecx, 0x103c6658
call edi
mov ecx, dword [esp + 0x14]
push ebx
call esi
push eax
push 0x1b5f
mov ecx, 0x103c7628
call edi
mov ecx, dword [esp + 0x14]
push ebx
call esi
push eax
push 0x1b60
mov ecx, 0x103c7ff8
call edi
mov ecx, dword [esp + 0x14]
push ebx
call esi
push eax
push 0x1b61
mov ecx, 0x103c8810
call edi
mov ecx, dword [esp + 0x14]
push ebx
call esi
push eax
push 0x1b62
mov ecx, 0x103c8b30
call edi
mov ecx, dword [esp + 0x14]
push ebx
call esi
push eax
push 0x1b63
mov ecx, 0x103c9228
call edi
mov ecx, dword [esp + 0x14]
push ebx
call esi
push eax
push 0x1b64
mov ecx, 0x103ca8f8
call edi
mov ecx, dword [esp + 0x14]
push ebx
call esi
push eax
push 0x1b65
mov ecx, 0x103cb418
call edi
mov ecx, dword [esp + 0x14]
push ebx
call esi
push eax
push 0x1b66
mov ecx, 0x103cc930
call edi
mov ecx, dword [esp + 0x14]
push ebx
call esi
push eax
push 0x1b67
mov ecx, 0x103ccbc8
call edi
mov ecx, dword [esp + 0x14]
push ebx
call esi
push eax
push 0x1b6a
mov ecx, 0x103cda20
call edi
mov ecx, dword [esp + 0x14]
push ebx
call esi
push eax
push 0x1b6b
mov ecx, 0x103cdf30
call edi
mov ecx, dword [esp + 0x14]
push ebx
call esi
push eax
push 0x1b6c
mov ecx, 0x103ce4c8
call edi
mov ecx, dword [esp + 0x14]
push ebx
call esi
push eax
push 0x1b77
mov ecx, 0x103cfe28
call edi
mov ecx, dword [esp + 0x14]
push ebx
call esi
push eax
push 0x1b80
mov ecx, 0x103d0ef8
call edi
push ebx
mov ebx, dword [esp + 0x18]
mov ecx, ebx
call esi
push eax
push 0x1b82
mov ecx, 0x103d1870
call edi
lea eax, [esp + 0x6c]
push eax
push dword [ebx + 0xb4]
call dword [sym.imp.USER32.dll_GetClientRect]
fild dword [esp + 0x74]
fmul qword [0x1009ee28]
call fcn.100840a0
fild dword [esp + 0x78]
mov dword [esp + 0x6c], eax
fmul qword [0x1009ee20]
call fcn.100840a0
mov ecx, dword [esp + 0x78]
mov esi, dword [sym.imp.mfc100.dll_Ordinal_7933]
xor edi, edi
sub ecx, eax
inc edi
push edi
push ecx
mov ecx, dword [esp + 0x7c]
sub ecx, dword [esp + 0x74]
mov dword [esp + 0x78], eax
push ecx
push eax
push dword [esp + 0x7c]
mov ecx, 0x103c2878
call esi
mov eax, dword [esp + 0x78]
sub eax, dword [esp + 0x70]
push edi
push eax
mov eax, dword [esp + 0x7c]
sub eax, dword [esp + 0x74]
mov ecx, 0x103c3c78
push eax
push dword [esp + 0x7c]
push dword [esp + 0x7c]
call esi
mov eax, dword [esp + 0x78]
sub eax, dword [esp + 0x70]
push edi
push eax
mov eax, dword [esp + 0x7c]
sub eax, dword [esp + 0x74]
mov ecx, 0x103c5438
push eax
push dword [esp + 0x7c]
push dword [esp + 0x7c]
call esi
mov eax, dword [esp + 0x78]
sub eax, dword [esp + 0x70]
push edi
push eax
mov eax, dword [esp + 0x7c]
sub eax, dword [esp + 0x74]
mov ecx, 0x103c6658
push eax
push dword [esp + 0x7c]
push dword [esp + 0x7c]
call esi
mov eax, dword [esp + 0x78]
sub eax, dword [esp + 0x70]
push edi
push eax
mov eax, dword [esp + 0x7c]
sub eax, dword [esp + 0x74]
mov ecx, 0x103c7628
push eax
push dword [esp + 0x7c]
push dword [esp + 0x7c]
call esi
mov eax, dword [esp + 0x78]
sub eax, dword [esp + 0x70]
push edi
push eax
mov eax, dword [esp + 0x7c]
sub eax, dword [esp + 0x74]
mov ecx, 0x103c7ff8
push eax
push dword [esp + 0x7c]
push dword [esp + 0x7c]
call esi
mov eax, dword [esp + 0x78]
sub eax, dword [esp + 0x70]
push edi
push eax
mov eax, dword [esp + 0x7c]
sub eax, dword [esp + 0x74]
mov ecx, 0x103c8810
push eax
push dword [esp + 0x7c]
push dword [esp + 0x7c]
call esi
mov eax, dword [esp + 0x78]
sub eax, dword [esp + 0x70]
push edi
push eax
mov eax, dword [esp + 0x7c]
sub eax, dword [esp + 0x74]
mov ecx, 0x103c8b30
push eax
push dword [esp + 0x7c]
push dword [esp + 0x7c]
call esi
mov eax, dword [esp + 0x78]
sub eax, dword [esp + 0x70]
push edi
push eax
mov eax, dword [esp + 0x7c]
sub eax, dword [esp + 0x74]
mov ecx, 0x103c9228
push eax
push dword [esp + 0x7c]
push dword [esp + 0x7c]
call esi
mov eax, dword [esp + 0x78]
sub eax, dword [esp + 0x70]
push edi
push eax
mov eax, dword [esp + 0x7c]
sub eax, dword [esp + 0x74]
mov ecx, 0x103ca8f8
push eax
push dword [esp + 0x7c]
push dword [esp + 0x7c]
call esi
mov eax, dword [esp + 0x78]
sub eax, dword [esp + 0x70]
push edi
push eax
mov eax, dword [esp + 0x7c]
sub eax, dword [esp + 0x74]
mov ecx, 0x103cb418
push eax
push dword [esp + 0x7c]
push dword [esp + 0x7c]
call esi
mov eax, dword [esp + 0x78]
sub eax, dword [esp + 0x70]
push edi
push eax
mov eax, dword [esp + 0x7c]
sub eax, dword [esp + 0x74]
push eax
push dword [esp + 0x7c]
mov ecx, 0x103cc930
push dword [esp + 0x7c]
call esi
mov eax, dword [esp + 0x78]
sub eax, dword [esp + 0x70]
push edi
push eax
mov eax, dword [esp + 0x7c]
sub eax, dword [esp + 0x74]
mov ecx, 0x103ccbc8
push eax
push dword [esp + 0x7c]
push dword [esp + 0x7c]
call esi
mov eax, dword [esp + 0x78]
sub eax, dword [esp + 0x70]
push edi
push eax
mov eax, dword [esp + 0x7c]
sub eax, dword [esp + 0x74]
mov ecx, 0x103cda20
push eax
push dword [esp + 0x7c]
push dword [esp + 0x7c]
call esi
mov eax, dword [esp + 0x78]
sub eax, dword [esp + 0x70]
push edi
push eax
mov eax, dword [esp + 0x7c]
sub eax, dword [esp + 0x74]
mov ecx, 0x103cdf30
push eax
push dword [esp + 0x7c]
push dword [esp + 0x7c]
call esi
mov eax, dword [esp + 0x78]
sub eax, dword [esp + 0x70]
push edi
push eax
mov eax, dword [esp + 0x7c]
sub eax, dword [esp + 0x74]
mov ecx, 0x103ce4c8
push eax
push dword [esp + 0x7c]
push dword [esp + 0x7c]
call esi
mov eax, dword [esp + 0x78]
sub eax, dword [esp + 0x70]
push edi
push eax
mov eax, dword [esp + 0x7c]
sub eax, dword [esp + 0x74]
mov ecx, 0x103cfe28
push eax
push dword [esp + 0x7c]
push dword [esp + 0x7c]
call esi
mov eax, dword [esp + 0x78]
sub eax, dword [esp + 0x70]
push edi
push eax
mov eax, dword [esp + 0x7c]
sub eax, dword [esp + 0x74]
mov ecx, 0x103d0ef8
push eax
push dword [esp + 0x7c]
push dword [esp + 0x7c]
call esi
mov eax, dword [esp + 0x78]
sub eax, dword [esp + 0x70]
push edi
push eax
mov eax, dword [esp + 0x7c]
sub eax, dword [esp + 0x74]
mov ecx, 0x103d1870
push eax
push dword [esp + 0x7c]
push dword [esp + 0x7c]
call esi
push 5
mov ecx, 0x103c2878
call dword [sym.imp.mfc100.dll_Ordinal_12962]
mov esi, dword [sym.imp.mfc100.dll_Ordinal_6213]
mov ecx, 0x103c29a8
call esi
push 0
push 0
push 0x31
push dword [0x103c29c8]
mov dword [0x100a78d8], eax
call dword [sym.imp.USER32.dll_SendMessageA]
push eax
call dword [sym.imp.mfc100.dll_Ordinal_4341]
mov dword [0x100a78d4], eax
lea eax, [ebx + 0x3e8]
mov dword [esp + 0x1c], eax
call fcn.1000237f
mov dword [0x100a7284], eax
lea eax, [ebx + 0x108]
call fcn.1000237f
lea ecx, [ebx + 0x220]
mov dword [0x100a75ac], eax
call esi
and dword [0x1035ff98], 0
mov esi, 0x103d719c
mov dword [0x100a709c], eax
call fcn.1000102f
mov esi, 0x103d71a8
call fcn.1000102f
mov esi, 0x103d71b4
call fcn.1000102f
mov esi, 0x103cfe1c
call fcn.1000102f
mov esi, 0x103d035c
call fcn.1000102f
mov esi, 0x103d0eec
call fcn.1000102f
mov esi, 0x103d2944
call fcn.1000102f
mov esi, 0x103d2e6c
call fcn.1000102f
mov esi, 0x103d43dc
call fcn.1000102f
mov esi, 0x103d6ea4
call fcn.1000102f
mov esi, 0x103d70d0
call fcn.1000102f
mov esi, 0x103d722c
call fcn.1000102f
mov esi, 0x103d7238
call fcn.1000102f
mov esi, 0x103d7214
call fcn.1000102f
mov esi, 0x103d7220
call fcn.1000102f
mov esi, 0x103d71e4
call fcn.1000102f
mov esi, 0x103d71fc
call fcn.1000102f
mov esi, 0x103d73d0
call fcn.1000102f
mov esi, 0x103d7160
call fcn.1000102f
mov esi, 0x103d716c
call fcn.1000102f
mov esi, 0x103d7274
call fcn.1000102f
mov esi, 0x103d7298
call fcn.1000102f
mov esi, 0x103d72b0
call fcn.1000102f
mov esi, 0x103d7190
call fcn.1000102f
mov esi, 0x103d71c0
call fcn.1000102f
mov esi, 0x103d7280
call fcn.1000102f
mov esi, 0x103d728c
call fcn.1000102f
mov byte [0x10111080], 0
mov esi, 0x103d7184
call fcn.1000102f
mov esi, 0x103d7178
call fcn.1000102f
mov esi, 0x103d73c4
call fcn.1000102f
mov esi, 0x103ccd8c
call fcn.1000102f
mov esi, 0x103cd52c
call fcn.1000102f
mov eax, dword [0x103cdf2c]
test eax, eax
je 0x10072d32
xor esi, esi
test eax, eax
jle 0x10072d17
mov eax, dword [0x103cdf24]
push dword [eax + esi*4]
call dword [sym.imp.mfc100.dll_Ordinal_1296]
inc esi
pop ecx
cmp esi, dword [0x103cdf2c]
jl 0x10072cff
push dword [0x103cdf24]
push 0
push dword [0x103cdf28]
call dword [sym.imp.KERNEL32.dll_HeapFree]
and dword [0x103cdf2c], 0
mov esi, 0x103cf29c
call fcn.1000102f
mov esi, 0x103c286c
call fcn.1000102f
mov esi, 0x103c3c6c
call fcn.1000102f
mov esi, 0x103c542c
call fcn.1000102f
mov esi, 0x103c664c
call fcn.1000102f
mov esi, 0x103c8804
call fcn.1000102f
mov esi, 0x103c761c
call fcn.1000102f
mov esi, 0x103c8b24
call fcn.1000102f
xor eax, eax
mov esi, 0x103d7358
mov dword [0x1035fd20], eax
mov dword [0x1035fd24], eax
mov dword [0x1035fd10], eax
mov dword [0x1035fd14], eax
mov byte [0x1038549d], al
mov dword [0x100a78d0], eax
mov dword [0x100a75a8], eax
call fcn.1000102f
push 0x100714fa
push 0xfffffffffffffffc
push dword [ebx + 0x20]
xor esi, esi
mov dword [0x1035ff8c], esi
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov dword [0x10114478], eax
mov eax, dword [0x307809c]
cmp eax, esi
je 0x10072dec
movzx eax, word [eax + 0x14]
imul eax, eax, 0x1cc
mov eax, dword [eax + 0x33fc129]
mov dword [0x10112778], eax
call fcn.10071632
call fcn.100718b1
xor ebx, ebx
cmp dword [0x103d715c], esi
jle 0x10072e23
mov eax, dword [0x103d7154]
push dword [eax + ebx*4]
push esi
push 0x143
push dword [0x103c52ec]
call dword [sym.imp.USER32.dll_SendMessageA]
inc ebx
cmp ebx, dword [0x103d715c]
jl 0x10072e00
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push esi
push esi
mov dword [esp + 0x20], esi
mov esi, 0x146
push esi
push dword [0x103c69ac]
call ebx
test eax, eax
jle 0x10072e7d
mov eax, dword [0x100a78d0]
imul eax, eax, 0x28
add eax, 0x100a75b0
push eax
push dword [esp + 0x1c]
push 0x148
push dword [0x103c69ac]
call ebx
inc dword [0x100a78d0]
inc dword [esp + 0x18]
push 0
push 0
push esi
push dword [0x103c69ac]
call ebx
cmp dword [esp + 0x18], eax
jl 0x10072e41
xor eax, eax
push eax
push eax
push esi
push dword [0x103c6a58]
mov dword [esp + 0x28], eax
call ebx
test eax, eax
jle 0x10072ece
mov eax, dword [0x100a75a8]
imul eax, eax, 0x28
add eax, 0x100a7288
push eax
push dword [esp + 0x1c]
push 0x148
push dword [0x103c6a58]
call ebx
inc dword [0x100a75a8]
inc dword [esp + 0x18]
push 0
push 0
push esi
push dword [0x103c6a58]
call ebx
cmp dword [esp + 0x18], eax
jl 0x10072e92
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
and dword [0x101127c4], 0
mov dword [0x1035fee4], 0xa
call ebx
xor edx, edx
mov ecx, 0x3e8
div ecx
mov dword [0x1035fd64], eax
call ebx
mov ebx, dword [sym.imp.WINMM.dll_timeGetTime]
mov dword [0x1035fd44], eax
call ebx
mov ecx, dword [0xf34f30]
mov dword [ecx + 0x60054], eax
call ebx
mov ecx, dword [0xf34f30]
mov dword [ecx + 0x6005c], eax
call ebx
mov ecx, dword [0xf34f30]
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push 5
push 0x1011260c
push 0x6bc37f
push dword [0x100e08d4]
mov dword [ecx + 0x60060], eax
call esi
xor ebx, ebx
push 0x32
lea eax, [esp + 0x90]
push ebx
mov dword [0xe4ecd0], 0x43960000
push eax
mov dword [0xe4ecb4], 0x437a0000
mov dword [0x10112c04], ebx
mov dword [0x10112bfc], ebx
mov dword [0x10112bf4], ebx
mov dword [0x10112bec], ebx
mov dword [0x10112be4], 0xbb8
mov dword [0x10112bdc], 0x1f4
mov dword [0x10112bd4], ebx
mov dword [0x10112bcc], ebx
mov dword [0x10112bc4], ebx
call sub.MSVCR100.dll_memset
add esp, 0xc
push ebx
push 6
lea eax, [esp + 0x94]
push eax
push 0x6f8649
push dword [0x100e08d4]
mov dword [esp + 0xa0], 0x90909090
mov word [esp + 0xa4], 0x9090
call esi
push ebx
push 6
lea eax, [esp + 0x94]
push eax
push 0x6f4b44
push dword [0x100e08d4]
call esi
push ebx
push 6
lea eax, [esp + 0x94]
push eax
push 0x6f4b05
push dword [0x100e08d4]
call esi
push ebx
push 6
lea eax, [esp + 0x94]
push eax
push 0x950a1f
push dword [0x100e08d4]
call esi
push ebx
push 2
lea eax, [esp + 0x94]
push eax
push 0x706523
push dword [0x100e08d4]
call esi
push ebx
push 2
lea eax, [esp + 0x94]
push eax
push 0x7065ac
push dword [0x100e08d4]
call esi
push ebx
push 6
lea eax, [esp + 0x94]
push eax
push 0x6d04e2
push dword [0x100e08d4]
mov dword [esp + 0xa0], 0xfff0fae9
mov word [esp + 0xa4], 0x90ff
call esi
push ebx
push 6
lea eax, [esp + 0x94]
push eax
push 0x6bdd85
push dword [0x100e08d4]
mov dword [esp + 0xa0], 0xe2e9
mov word [esp + 0xa4], 0x9000
call esi
push ebx
push 0xb
lea eax, [esp + 0x94]
push eax
push 0x9509ec
push dword [0x100e08d4]
mov dword [esp + 0xa0], 0x90909090
mov dword [esp + 0xa4], 0x90909090
mov dword [esp + 0xa8], 0x90909090
call esi
push ebx
push 2
lea eax, [esp + 0x94]
push eax
push 0x5b9097
push dword [0x100e08d4]
call esi
push ebx
push 6
lea eax, [esp + 0x94]
push eax
push 0x5ad4a3
push dword [0x100e08d4]
call esi
push ebx
push 2
lea eax, [esp + 0x94]
push eax
push 0x55936f
push dword [0x100e08d4]
mov word [esp + 0xa0], 0x9090
call esi
push ebx
push edi
lea eax, [esp + 0x94]
push eax
push 0x91f251
push dword [0x100e08d4]
mov word [esp + 0xa0], 0x7eb
call esi
push ebx
push edi
lea eax, [esp + 0x94]
push eax
push 0xa45af6
push dword [0x100e08d4]
mov byte [esp + 0xa0], 0xeb
call esi
push ebx
push edi
lea eax, [esp + 0x94]
push eax
push 0x54eda3
push dword [0x100e08d4]
call esi
push ebx
push 6
lea eax, [esp + 0x94]
push eax
push 0x87f18e
push dword [0x100e08d4]
mov dword [esp + 0xa0], 0xb9e9
mov word [esp + 0xa4], 0x9000
call esi
push ebx
push edi
lea eax, [esp + 0x94]
push eax
push 0x94fa98
push dword [0x100e08d4]
mov byte [esp + 0xa0], 0xeb
call esi
push ebx
push edi
lea eax, [esp + 0x94]
push eax
push 0x716669
push dword [0x100e08d4]
call esi
push ebx
push edi
lea eax, [esp + 0x94]
push eax
push 0x7009b8
push dword [0x100e08d4]
call esi
push ebx
push edi
lea eax, [esp + 0x94]
push eax
push 0x7a2809
push dword [0x100e08d4]
call esi
push ebx
push edi
lea eax, [esp + 0x94]
push eax
push 0x7a0730
push dword [0x100e08d4]
call esi
push ebx
push 2
lea eax, [esp + 0x94]
push eax
push 0x6edc7b
push dword [0x100e08d4]
mov word [esp + 0xa0], 0x13eb
call esi
push ebx
push 5
pop edi
mov eax, 0x10048146
sub eax, 0xad9f25
push edi
mov dword [esp + 0x95], eax
lea eax, [esp + 0x94]
push eax
push 0xad9f20
push dword [0x100e08d4]
mov byte [esp + 0xa0], 0xe9
call esi
push ebx
mov eax, 0x10048171
sub eax, 0x6bc384
push edi
mov dword [esp + 0x95], eax
lea eax, [esp + 0x94]
push eax
push 0x6bc37f
push dword [0x100e08d4]
mov byte [esp + 0xa0], 0xe8
call esi
mov eax, 0x10048187
sub eax, 0xb26f32
mov byte [esp + 0x8c], 0xe8
mov dword [esp + 0x8d], eax
push ebx
push edi
lea eax, [esp + 0x94]
push eax
push 0xb26f2d
push dword [0x100e08d4]
call esi
push ebx
mov eax, 0x1004819f
sub eax, 0x6bdcb2
push edi
mov dword [esp + 0x95], eax
lea eax, [esp + 0x94]
push eax
push 0x6bdcb3
push dword [0x100e08d4]
mov byte [esp + 0xa0], 0xe8
mov word [esp + 0xa6], 0x9090
mov byte [esp + 0xa8], 0x90
call esi
push ebx
push 6
lea eax, [esp + 0x94]
push eax
push 0x9495bf
push dword [0x100e08d4]
mov dword [esp + 0xa0], 0xd80e9
mov word [esp + 0xa4], 0x9000
call esi
push ebx
mov eax, 0x100481db
sub eax, 0x7a06d5
push 6
mov dword [esp + 0x95], eax
lea eax, [esp + 0x94]
push eax
push 0x7a06d0
push dword [0x100e08d4]
mov byte [esp + 0xa0], 0xe9
call esi
push ebx
mov eax, 0x10048214
sub eax, 0x6f8436
push 8
mov dword [esp + 0x95], eax
lea eax, [esp + 0x94]
push eax
push 0x6f8431
push dword [0x100e08d4]
mov byte [esp + 0xa5], 0x90
mov byte [esp + 0xa0], 0xe8
call esi
push ebx
mov eax, 0x100481bd
sub eax, 0x5df6c8
push edi
mov dword [esp + 0x95], eax
lea eax, [esp + 0x94]
push eax
push 0x5df6c3
push dword [0x100e08d4]
mov byte [esp + 0xa0], 0xe9
mov word [esp + 0xa5], 0x9090
call esi
push ebx
mov eax, 0x1004812d
sub eax, 0x70257b
push 6
mov dword [esp + 0x95], eax
lea eax, [esp + 0x94]
push eax
push 0x702576
push dword [0x100e08d4]
mov byte [esp + 0xa0], 0xe8
mov byte [esp + 0xa5], 0x90
call esi
lea eax, [esp + 0xc0]
push eax
mov byte [esp + 0x90], 0xe8
call dword [sym.imp.MSVCR100.dll__strdate]
pop ecx
lea eax, [esp + 0xc0]
push eax
push 2
pop edi
lea esi, [esp + 0xd8]
call fcn.100064da
pop ecx
lea eax, [esp + 0xc0]
push eax
push 3
pop ebx
lea esi, [esp + 0xec]
call fcn.1000653e
pop ecx
lea eax, [esp + 0xc0]
push eax
call dword [sym.imp.MSVCR100.dll__strtime]
pop ecx
lea eax, [esp + 0xc6]
push eax
lea eax, [esp + 0xc7]
push eax
lea eax, [esp + 0xc8]
push eax
mov eax, esi
mov esi, dword [sym.imp.MSVCR100.dll_sprintf]
push eax
lea eax, [esp + 0xe4]
push eax
xor ebx, ebx
push 0x1009c59c
push 0x10111128
mov byte [esp + 0xde], bl
mov byte [esp + 0xe1], bl
call esi
add esp, 0x1c
mov edi, 0x1035ffc0
cmp byte [0x1035ffc0], bl
jne 0x100734f2
push 0x3592e68
push edi
call dword [sym.imp.MSVCR100.dll_strcpy]
pop ecx
pop ecx
push 0x1f4
call dword [sym.imp.mfc100.dll_Ordinal_265]
pop ecx
push edi
push 0x10111f10
push str._s_s.txt
push eax
mov dword [esp + 0x28], eax
call esi
push 0x1008c724
push dword [esp + 0x2c]
call dword [sym.imp.MSVCR100.dll_fopen]
add esp, 0x18
test eax, eax
je 0x10073544
mov ecx, dword [esp + 0x18]
call fcn.10055a82
push edi
lea eax, [esp + 0x100]
push 0x1009c5b4
push eax
call esi
add esp, 0xc
jmp 0x10073575
push str.default
push 0x10111f10
push str._s_s.txt
push dword [esp + 0x24]
call esi
mov ecx, dword [esp + 0x28]
call fcn.10055a82
push edi
lea eax, [esp + 0x110]
push 0x1009c5d4
push eax
call esi
add esp, 0x1c
lea eax, [esp + 0xfc]
push eax
call fcn.100060db
pop ecx
push dword [esp + 0x18]
call dword [sym.imp.mfc100.dll_Ordinal_1296]
pop ecx
push edi
lea eax, [esp + 0x168]
push str._s
push eax
call esi
add esp, 0xc
lea eax, [esp + 0x164]
push eax
mov eax, dword [0x1012fca4]
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_SetWindowTextA]
push edi
push dword [0x100dfd8c]
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x164]
push eax
call dword [sym.imp.mfc100.dll_Ordinal_12868]
push 0x1f4
call dword [sym.imp.mfc100.dll_Ordinal_265]
pop ecx
push edi
push 0x10111f10
push 0x1008d900
push eax
mov dword [esp + 0x2c], eax
call esi
add esp, 0x10
push dword [esp + 0x1c]
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
jne 0x10073610
push ebx
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push dword [esp + 0x1c]
call dword [sym.imp.mfc100.dll_Ordinal_1296]
mov eax, dword [esp + 0x18]
pop ecx
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push ebx
push 0x100752d0
push 3
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
fild dword [0x1035fed0]
mov dword [0x1011447c], eax
fld st(0)
fld qword [0x1009ee78]
fdiv st(1), st(0)
fdiv st(1), st(0)
fxch st(1)
call fcn.100840a0
mov dword [esp + 0x14], eax
imul eax, eax, 0xe10
mov dword [esp + 0x1c], eax
fild dword [esp + 0x1c]
fsubp st(2)
fld st(1)
fdivrp st(1)
call fcn.100840a0
mov dword [esp + 0x18], eax
imul eax, eax, 0x3c
mov dword [esp + 0x1c], eax
fild dword [esp + 0x1c]
fsubp st(1)
call fcn.100840a0
push eax
push dword [esp + 0x1c]
lea eax, [esp + 0x104]
push dword [esp + 0x1c]
push 0x1009c5f4
push eax
call esi
lea eax, [esp + 0x110]
add esp, 0x14
push eax
call fcn.100060db
pop ecx
push 0x7d
lea eax, [esp + 0x1d0]
push ebx
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x37b33c8
lea eax, [esp + 0x1d0]
push 0x1008b5f8
push eax
call esi
add esp, 0xc
lea eax, [esp + 0x1cc]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x2719
push dword [0x100f415c]
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [esp + 0x1c], eax
movzx eax, ax
mov dword [0x103c24c4], eax
movzx eax, word [esp + 0x1e]
push edi
push 0x103c27e0
mov dword [0x103c24c0], eax
call dword [sym.imp.MSVCR100.dll_strcpy]
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
pop ecx
pop ecx
mov byte [0x1035ffc0], bl
call esi
mov edi, 0x3e8
xor edx, edx
mov ecx, edi
div ecx
mov dword [0x10360884], eax
call esi
xor edx, edx
div edi
lea ecx, [esp + 0x30]
mov dword [0x1035fd2c], 0xfffff8f8
mov dword [0x10360114], ebx
mov dword [0x1035fef4], ebx
mov dword [0x1035fd80], eax
call fcn.10004e7d
mov byte [esp + 0x260], bl
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], vtable.CBitmap.0
call fcn.10001900
or dword [esp + 0x260], 0xffffffff
lea ecx, [esp + 0x28]
mov dword [esp + 0x28], vtable.CRgn.0
call fcn.10001900
xor eax, eax
inc eax
mov ecx, dword [esp + 0x258]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x240]
xor ecx, esp
call fcn.1008344f
mov esp, ebp
pop ebp
ret