Function at 0x100019f0
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime
Log keystrokes
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x530
push ebx
push ebp
push esi
push edi
xor edi, edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x9c], edi
mov dword [esp + 0xa4], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, dword [esp + 0x548]
mov ebx, eax
cmp esi, 0x7e9
mov ebp, 0x1234
jne 0x10001a7d
cmp dword [esp + 0x54c], ebp
jne 0x10001a7d
push edi
call fcn.10006800
mov edi, eax
add esp, 4
test edi, edi
mov dword [esp + 0xa4], edi
je 0x10001a6c
push 0
push edi
call fcn.10006880
add esp, 8
mov dword [esp + 0x9c], eax
test eax, eax
jne 0x10001a7b
push edi
call fcn.100068b0
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x530
ret 0x14
xor edi, edi
call fcn.1000b180
cmp eax, edi
jbe 0x10001b64
cmp eax, 1
jne 0x10001a99
call fcn.1000e000
jmp 0x10001b57
cmp eax, 2
jne 0x10001aa8
call fcn.1000df00
jmp 0x10001b57
cmp eax, 3
jne 0x10001ab7
call fcn.1000df80
jmp 0x10001b57
cmp eax, 4
jne 0x10001ac6
call fcn.100132e0
jmp 0x10001b57
cmp eax, 5
jne 0x10001ad5
call fcn.10013330
jmp 0x10001b57
cmp eax, 6
jne 0x10001ae1
call fcn.10013380
jmp 0x10001b57
cmp eax, 7
jne 0x10001aed
call fcn.10013470
jmp 0x10001b57
cmp eax, 8
jne 0x10001af9
call fcn.1000fe70
jmp 0x10001b57
cmp eax, 9
jne 0x10001b05
call fcn.100134c0
jmp 0x10001b57
cmp eax, 0xa
jne 0x10001b11
call fcn.100135b0
jmp 0x10001b57
cmp eax, 0xb
jne 0x10001b1d
call fcn.10013600
jmp 0x10001b57
cmp eax, 0xc
jne 0x10001b29
call fcn.100136f0
jmp 0x10001b57
cmp eax, 0xd
jne 0x10001b35
call fcn.10010380
jmp 0x10001b57
cmp eax, 0xe
jne 0x10001b41
call fcn.10010400
jmp 0x10001b57
cmp eax, 0xf
jne 0x10001b4d
call fcn.1000e090
jmp 0x10001b57
cmp eax, 0x10
jne 0x10001b57
call fcn.1000e130
call fcn.1000b180
cmp eax, edi
ja 0x10001a8a
mov eax, dword [0x100280a4]
mov edi, eax
test edi, edi
jne 0x10001ba4
mov ecx, dword [0x100280a8]
test ecx, ecx
je 0x10001ba4
cmp esi, 6
je 0x10001b9f
cmp esi, 0x1c
je 0x10001b9f
cmp esi, 0x86
je 0x10001b9f
cmp esi, 8
je 0x10001b9f
cmp esi, 0x46
je 0x10001b9f
cmp esi, 0x47
je 0x10001b9f
cmp esi, 0x18
jne 0x10001ba4
mov edi, 1
test eax, eax
jne 0x10001be3
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [0x1003d27c]
mov ecx, eax
sub ecx, edx
cmp ecx, 0xbb8
jb 0x10001be3
push 1
mov dword [0x1003d27c], eax
mov dword [0x100280ac], 0
call fcn.10009f70
add esp, 4
mov dword [0x100280ac], 1
call fcn.1000b750
mov eax, dword [esp + 0x544]
cmp esi, 0x8b0
jb 0x10001c30
cmp esi, 0x8ba
jae 0x10001c38
mov ebp, dword [esp + 0x550]
mov edx, dword [esp + 0x54c]
push ebp
push edx
push eax
push esi
call fcn.10013be0
test eax, eax
je 0x100042b8
mov eax, 1
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
jmp 0x100042b8
cmp esi, 0x8ba
jb 0x10001c59
cmp esi, 0x8bf
jae 0x10001c59
mov ebp, dword [esp + 0x550]
mov ecx, dword [esp + 0x54c]
push ebp
push ecx
push eax
push esi
call fcn.10016090
jmp 0x10001c16
test edi, edi
jne 0x10001c6b
cmp esi, 0x84e
jne 0x100042b1
jmp 0x10001c73
cmp esi, 0x84e
jne 0x10001cb1
cmp dword [esp + 0x54c], ebp
jne 0x100042b1
mov ebp, dword [esp + 0x550]
mov eax, 1
mov edx, ebp
mov ecx, ebp
and edx, eax
and ecx, 0x8000
mov dword [0x100280a4], edx
mov dword [0x100280a8], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
jmp 0x100042b8
cmp esi, 6
jne 0x10001d04
push 0x596235d2
call fcn.1000b0a0
add esp, 4
test eax, eax
je 0x100042b1
mov eax, dword [0x1003ca64]
test eax, eax
jne 0x100042b1
mov edx, dword [esp + 0x550]
mov eax, dword [esp + 0x54c]
mov ecx, dword [esp + 0x544]
push edx
push eax
push esi
push ecx
call dword [sym.imp.USER32.dll_DefWindowProcA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x530
ret 0x14
cmp esi, 0x1c
jne 0x10001d57
push 0x596235d2
call fcn.1000b0a0
add esp, 4
test eax, eax
je 0x100042b1
mov eax, dword [0x1003ca64]
test eax, eax
jne 0x100042b1
mov edx, dword [esp + 0x550]
mov eax, dword [esp + 0x54c]
mov ecx, dword [esp + 0x544]
push edx
push eax
push esi
push ecx
call dword [sym.imp.USER32.dll_DefWindowProcA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x530
ret 0x14
cmp esi, 0x86
jne 0x10001d69
push 0x596235d2
jmp 0x10001ec2
cmp esi, 8
jne 0x10001dbc
push 0x596235d2
call fcn.1000b0a0
add esp, 4
test eax, eax
je 0x100042b1
mov eax, dword [0x1003ca64]
test eax, eax
jne 0x100042b1
mov edx, dword [esp + 0x550]
mov eax, dword [esp + 0x54c]
mov ecx, dword [esp + 0x544]
push edx
push eax
push esi
push ecx
call dword [sym.imp.USER32.dll_DefWindowProcA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x530
ret 0x14
cmp esi, 0x46
jne 0x10001e0f
push 0x596235d2
call fcn.1000b0a0
add esp, 4
test eax, eax
je 0x100042b1
mov eax, dword [0x1003ca64]
test eax, eax
jne 0x100042b1
mov edx, dword [esp + 0x550]
mov eax, dword [esp + 0x54c]
mov ecx, dword [esp + 0x544]
push edx
push eax
push esi
push ecx
call dword [sym.imp.USER32.dll_DefWindowProcA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x530
ret 0x14
cmp esi, 0x47
jne 0x10001e62
push 0x596235d2
call fcn.1000b0a0
add esp, 4
test eax, eax
je 0x100042b1
mov eax, dword [0x1003ca64]
test eax, eax
jne 0x100042b1
mov edx, dword [esp + 0x550]
mov eax, dword [esp + 0x54c]
mov ecx, dword [esp + 0x544]
push edx
push eax
push esi
push ecx
call dword [sym.imp.USER32.dll_DefWindowProcA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x530
ret 0x14
cmp esi, 0x18
jne 0x10001eb5
push 0x596235d2
call fcn.1000b0a0
add esp, 4
test eax, eax
je 0x100042b1
mov eax, dword [0x1003ca64]
test eax, eax
jne 0x100042b1
mov edx, dword [esp + 0x550]
mov eax, dword [esp + 0x54c]
mov ecx, dword [esp + 0x544]
push edx
push eax
push esi
push ecx
call dword [sym.imp.USER32.dll_DefWindowProcA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x530
ret 0x14
cmp esi, 0x215
jne 0x10001eee
push 0x7fae1452
call fcn.1000b0a0
add esp, 4
test eax, eax
je 0x100042b1
mov eax, dword [0x1003ca64]
test eax, eax
jne 0x100042b1
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x530
ret 0x14
cmp esi, 0x84
jne 0x1000203d
mov ebp, dword [esp + 0x550]
mov ebx, dword [esp + 0x544]
mov edx, ebp
lea eax, [esp + 0x80]
shr edx, 0x10
push eax
push ebx
movsx esi, bp
movsx edi, dx
call dword [sym.imp.USER32.dll_GetClientRect]
xor eax, eax
mov ecx, dword [esp + 0x88]
mov edx, dword [esp + 0x8c]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x2c], ecx
push eax
push ebx
mov ebx, dword [sym.imp.USER32.dll_ClientToScreen]
mov dword [esp + 0x38], edx
call ebx
lea ecx, [esp + 0x2c]
mov edx, dword [esp + 0x544]
push ecx
push edx
call ebx
cmp esi, dword [esp + 0x18]
jl 0x10002014
cmp esi, dword [esp + 0x2c]
jge 0x10002014
cmp edi, dword [esp + 0x1c]
jl 0x10002014
cmp edi, dword [esp + 0x30]
jge 0x10002014
push 0x592629e2
call fcn.1000b0a0
add esp, 4
test eax, eax
jne 0x10001fa1
mov eax, dword [0x1003ca4c]
test eax, eax
je 0x10001fb2
mov eax, dword [0x1003ca64]
test eax, eax
jne 0x10001fb2
mov ebp, dword [0x1003ca1c]
jmp 0x10001fc9
and edi, 0xffff
and esi, 0xffff
shl edi, 0x10
or edi, esi
mov dword [0x1003ca1c], edi
push 0x5e1c1dfb
call fcn.1000b0a0
add esp, 4
test eax, eax
je 0x100042b8
mov eax, dword [0x1003ca64]
test eax, eax
jne 0x100042b8
mov eax, dword [esp + 0x54c]
mov ecx, dword [esp + 0x544]
push ebp
push eax
push 0x84
push ecx
call dword [sym.imp.USER32.dll_DefWindowProcA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x530
ret 0x14
mov edx, dword [esp + 0x54c]
mov eax, dword [esp + 0x544]
push ebp
push edx
push 0x84
push eax
call dword [sym.imp.USER32.dll_DefWindowProcA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x530
ret 0x14
cmp esi, 0xa0
je 0x10004a9e
cmp esi, 0xa1
je 0x10004a9e
cmp esi, 0xa2
je 0x10004a9e
cmp esi, 0xa3
je 0x10004a9e
cmp esi, 0xa4
je 0x10004a9e
cmp esi, 0xa5
je 0x10004a9e
cmp esi, 0xa6
je 0x10004a9e
cmp esi, 0xa7
je 0x10004a9e
cmp esi, 0xa8
je 0x10004a9e
cmp esi, 0xa9
je 0x10004a9e
cmp esi, 0x200
jne 0x100021a0
mov ecx, dword [0x1003ca28]
mov ebp, dword [esp + 0x550]
add ecx, 0xffffffec
mov edi, 0x8000
test ecx, ecx
je 0x10002159
push 0x592629e2
call fcn.1000b0a0
add esp, 4
test eax, eax
jne 0x100020f4
mov eax, dword [0x1003ca4c]
test eax, eax
je 0x1000210a
mov eax, dword [0x1003ca64]
test eax, eax
jne 0x1000210a
test dword [esp + 0x54c], edi
je 0x10001a6c
mov eax, ebp
movsx edx, bp
shr eax, 0x10
movsx ecx, ax
mov eax, dword [0x1003ca28]
mov dword [esp + 0x18], edx
lea edx, [esp + 0x18]
add eax, 0xffffffec
push edx
push eax
mov dword [esp + 0x24], ecx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov eax, dword [0x1003ca5c]
test eax, eax
jne 0x10002159
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
and ecx, 0xffff
and edx, 0xffff
shl ecx, 0x10
or ecx, edx
mov dword [0x1003ca1c], ecx
test dword [esp + 0x54c], edi
jne 0x1000217d
push 0
call fcn.10012760
add esp, 4
test eax, eax
jne 0x1000217d
mov eax, dword [0x1003ca5c]
test eax, eax
je 0x10001a6c
mov edx, dword [esp + 0x54c]
push 0x200
and dh, 0x7f
mov dword [esp + 0x550], edx
call fcn.10001760
add esp, 4
jmp 0x100042b8
cmp esi, 0x201
jne 0x100022c5
mov eax, dword [0x1003ca28]
mov edi, 0x8000
add eax, 0xffffffec
test eax, eax
je 0x10002277
push 0x5e1c1dfb
call fcn.1000b0a0
add esp, 4
test eax, eax
jne 0x100021db
mov eax, dword [0x1003ca4c]
test eax, eax
je 0x100021f1
mov eax, dword [0x1003ca64]
test eax, eax
jne 0x100021f1
test dword [esp + 0x54c], edi
je 0x10001a6c
push 0x592629e2
call fcn.1000b0a0
add esp, 4
test eax, eax
jne 0x1000220b
mov eax, dword [0x1003ca4c]
test eax, eax
je 0x10002259
mov eax, dword [0x1003ca64]
test eax, eax
jne 0x10002259
mov eax, dword [0x1003ca1c]
movsx ecx, ax
shr eax, 0x10
mov dword [esp + 0x18], ecx
mov ecx, dword [0x1003ca28]
movsx edx, ax
lea eax, [esp + 0x18]
add ecx, 0xffffffec
push eax
push ecx
mov dword [esp + 0x24], edx
call fcn.10008430
mov ebp, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
and ebp, 0xffff
shl ebp, 0x10
and edx, 0xffff
or ebp, edx
jmp 0x10002260
mov ebp, dword [esp + 0x550]
test dword [esp + 0x54c], edi
jne 0x100022a2
push 0
push 0
call fcn.10010880
add esp, 8
jmp 0x1000227e
mov ebp, dword [esp + 0x550]
test dword [esp + 0x54c], edi
jne 0x100022a2
push 0
call fcn.10012760
add esp, 4
test eax, eax
jne 0x100022a2
mov eax, dword [0x1003ca5c]
test eax, eax
je 0x10001a6c
mov edx, dword [esp + 0x54c]
push 0x201
and dh, 0x7f
mov dword [esp + 0x550], edx
call fcn.10001760
add esp, 4
jmp 0x100042b8
cmp esi, 0x202
jne 0x100023ea
mov eax, dword [0x1003ca28]
mov edi, 0x8000
add eax, 0xffffffec
test eax, eax
je 0x1000239c
push 0x5e1c1dfb
call fcn.1000b0a0
add esp, 4
test eax, eax
jne 0x10002300
mov eax, dword [0x1003ca4c]
test eax, eax
je 0x10002316
mov eax, dword [0x1003ca64]
test eax, eax
jne 0x10002316
test dword [esp + 0x54c], edi
je 0x10001a6c
push 0x592629e2
call fcn.1000b0a0
add esp, 4
test eax, eax
jne 0x10002330
mov eax, dword [0x1003ca4c]
test eax, eax
je 0x1000237e
mov eax, dword [0x1003ca64]
test eax, eax
jne 0x1000237e
mov eax, dword [0x1003ca1c]
movsx ecx, ax
shr eax, 0x10
mov dword [esp + 0x18], ecx
mov ecx, dword [0x1003ca28]
movsx edx, ax
lea eax, [esp + 0x18]
add ecx, 0xffffffec
push eax
push ecx
mov dword [esp + 0x24], edx
call fcn.10008430
mov ebp, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
and ebp, 0xffff
shl ebp, 0x10
and edx, 0xffff
or ebp, edx
jmp 0x10002385
mov ebp, dword [esp + 0x550]
test dword [esp + 0x54c], edi
jne 0x100023c7
push 0
push 0
call fcn.10010b60
add esp, 8
jmp 0x100023a3
mov ebp, dword [esp + 0x550]
test dword [esp + 0x54c], edi
jne 0x100023c7
push 0
call fcn.10012760
add esp, 4
test eax, eax
jne 0x100023c7
mov eax, dword [0x1003ca5c]
test eax, eax
je 0x10001a6c
mov edx, dword [esp + 0x54c]
push 0x202
and dh, 0x7f
mov dword [esp + 0x550], edx
call fcn.10001760
add esp, 4
jmp 0x100042b8
cmp esi, 0x203
jne 0x100024e4
mov eax, dword [0x1003ca28]
mov edi, 0x8000
add eax, 0xffffffec
test eax, eax
je 0x100024a3
push 0x5e1c1dfb
call fcn.1000b0a0
add esp, 4
test eax, eax
jne 0x10002425
mov eax, dword [0x1003ca4c]
test eax, eax
je 0x1000243b
mov eax, dword [0x1003ca64]
test eax, eax
jne 0x1000243b
test dword [esp + 0x54c], edi
je 0x10001a6c
push 0x592629e2
call fcn.1000b0a0
add esp, 4
test eax, eax
jne 0x10002455
mov eax, dword [0x1003ca4c]
test eax, eax
je 0x100024a3
mov eax, dword [0x1003ca64]
test eax, eax
jne 0x100024a3
mov eax, dword [0x1003ca1c]
movsx ecx, ax
shr eax, 0x10
mov dword [esp + 0x18], ecx
mov ecx, dword [0x1003ca28]
movsx edx, ax
lea eax, [esp + 0x18]
add ecx, 0xffffffec
push eax
push ecx
mov dword [esp + 0x24], edx
call fcn.10008430
mov ebp, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
and ebp, 0xffff
shl ebp, 0x10
and edx, 0xffff
or ebp, edx
jmp 0x100024aa
mov ebp, dword [esp + 0x550]
test dword [esp + 0x54c], edi
jne 0x100024ce
push 0
call fcn.10012760
add esp, 4
test eax, eax
jne 0x100024ce
mov eax, dword [0x1003ca5c]
test eax, eax
je 0x10001a6c
mov eax, dword [esp + 0x54c]
and ah, 0x7f
mov dword [esp + 0x54c], eax
jmp 0x100042b8
cmp esi, 0x204
jne 0x10002609
mov eax, dword [0x1003ca28]
mov edi, 0x8000
add eax, 0xffffffec
test eax, eax
je 0x100025bb
push 0x5e1c1dfb
call fcn.1000b0a0
add esp, 4
test eax, eax
jne 0x1000251f
mov eax, dword [0x1003ca4c]
test eax, eax
je 0x10002535
mov eax, dword [0x1003ca64]
test eax, eax
jne 0x10002535
test dword [esp + 0x54c], edi
je 0x10001a6c
push 0x592629e2
call fcn.1000b0a0
add esp, 4
test eax, eax
jne 0x1000254f
mov eax, dword [0x1003ca4c]
test eax, eax
je 0x1000259d
mov eax, dword [0x1003ca64]
test eax, eax
jne 0x1000259d
mov eax, dword [0x1003ca1c]
movsx ecx, ax
shr eax, 0x10
mov dword [esp + 0x18], ecx
mov ecx, dword [0x1003ca28]
movsx edx, ax
lea eax, [esp + 0x18]
add ecx, 0xffffffec
push eax
push ecx
mov dword [esp + 0x24], edx
call fcn.10008430
mov ebp, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
and ebp, 0xffff
shl ebp, 0x10
and edx, 0xffff
or ebp, edx
jmp 0x100025a4
mov ebp, dword [esp + 0x550]
test dword [esp + 0x54c], edi
jne 0x100025e6
push 0
push 1
call fcn.10010880
add esp, 8
jmp 0x100025c2
mov ebp, dword [esp + 0x550]
test dword [esp + 0x54c], edi
jne 0x100025e6
push 0
call fcn.10012760
add esp, 4
test eax, eax
jne 0x100025e6
mov eax, dword [0x1003ca5c]
test eax, eax
je 0x10001a6c
mov edx, dword [esp + 0x54c]
push 0x204
and dh, 0x7f
mov dword [esp + 0x550], edx
call fcn.10001760
add esp, 4
jmp 0x100042b8
cmp esi, 0x205
jne 0x1000272e
mov eax, dword [0x1003ca28]
mov edi, 0x8000
add eax, 0xffffffec
test eax, eax
je 0x100026e0
push 0x5e1c1dfb
call fcn.1000b0a0
add esp, 4
test eax, eax
jne 0x10002644
mov eax, dword [0x1003ca4c]
test eax, eax
je 0x1000265a
mov eax, dword [0x1003ca64]
test eax, eax
jne 0x1000265a
test dword [esp + 0x54c], edi
je 0x10001a6c
push 0x592629e2
call fcn.1000b0a0
add esp, 4
test eax, eax
jne 0x10002674
mov eax, dword [0x1003ca4c]
test eax, eax
je 0x100026c2
mov eax, dword [0x1003ca64]
test eax, eax
jne 0x100026c2
mov eax, dword [0x1003ca1c]
movsx ecx, ax
shr eax, 0x10
mov dword [esp + 0x18], ecx
mov ecx, dword [0x1003ca28]
movsx edx, ax
lea eax, [esp + 0x18]
add ecx, 0xffffffec
push eax
push ecx
mov dword [esp + 0x24], edx
call fcn.10008430
mov ebp, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
and ebp, 0xffff
shl ebp, 0x10
and edx, 0xffff
or ebp, edx
jmp 0x100026c9
mov ebp, dword [esp + 0x550]
test dword [esp + 0x54c], edi
jne 0x1000270b
push 0
push 1
call fcn.10010b60
add esp, 8
jmp 0x100026e7
mov ebp, dword [esp + 0x550]
test dword [esp + 0x54c], edi
jne 0x1000270b
push 0
call fcn.10012760
add esp, 4
test eax, eax
jne 0x1000270b
mov eax, dword [0x1003ca5c]
test eax, eax
je 0x10001a6c
mov edx, dword [esp + 0x54c]
push 0x205
and dh, 0x7f
mov dword [esp + 0x550], edx
call fcn.10001760
add esp, 4
jmp 0x100042b8
cmp esi, 0x207
jne 0x1000280c
mov eax, dword [0x1003ca28]
mov edi, 0x8000
add eax, 0xffffffec
test eax, eax
je 0x100024a3
push 0x5e1c1dfb
call fcn.1000b0a0
add esp, 4
test eax, eax
jne 0x10002769
mov eax, dword [0x1003ca4c]
test eax, eax
je 0x1000277f
mov eax, dword [0x1003ca64]
test eax, eax
jne 0x1000277f
test dword [esp + 0x54c], edi
je 0x10001a6c
push 0x592629e2
call fcn.1000b0a0
add esp, 4
test eax, eax
jne 0x10002799
mov eax, dword [0x1003ca4c]
test eax, eax
je 0x100027e7
mov eax, dword [0x1003ca64]
test eax, eax
jne 0x100027e7
mov eax, dword [0x1003ca1c]
movsx ecx, ax
shr eax, 0x10
mov dword [esp + 0x18], ecx
mov ecx, dword [0x1003ca28]
movsx edx, ax
lea eax, [esp + 0x18]
add ecx, 0xffffffec
push eax
push ecx
mov dword [esp + 0x24], edx
call fcn.10008430
mov ebp, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
and ebp, 0xffff
shl ebp, 0x10
and edx, 0xffff
or ebp, edx
jmp 0x100027ee
mov ebp, dword [esp + 0x550]
test dword [esp + 0x54c], edi
jne 0x100024ce
push 0
push 2
call fcn.10010880
add esp, 8
jmp 0x100024aa
cmp esi, 0x208
jne 0x100028ea
mov eax, dword [0x1003ca28]
mov edi, 0x8000
add eax, 0xffffffec
test eax, eax
je 0x100024a3
push 0x5e1c1dfb
call fcn.1000b0a0
add esp, 4
test eax, eax
jne 0x10002847
mov eax, dword [0x1003ca4c]
test eax, eax
je 0x1000285d
mov eax, dword [0x1003ca64]
test eax, eax
jne 0x1000285d
test dword [esp + 0x54c], edi
je 0x10001a6c
push 0x592629e2
call fcn.1000b0a0
add esp, 4
test eax, eax
jne 0x10002877
mov eax, dword [0x1003ca4c]
test eax, eax
je 0x100028c5
mov eax, dword [0x1003ca64]
test eax, eax
jne 0x100028c5
mov eax, dword [0x1003ca1c]
movsx ecx, ax
shr eax, 0x10
mov dword [esp + 0x18], ecx
mov ecx, dword [0x1003ca28]
movsx edx, ax
lea eax, [esp + 0x18]
add ecx, 0xffffffec
push eax
push ecx
mov dword [esp + 0x24], edx
call fcn.10008430
mov ebp, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
and ebp, 0xffff
shl ebp, 0x10
and edx, 0xffff
or ebp, edx
jmp 0x100028cc
mov ebp, dword [esp + 0x550]
test dword [esp + 0x54c], edi
jne 0x100024ce
push 0
push 2
call fcn.10010b60
add esp, 8
jmp 0x100024aa
cmp esi, 0x20a
jne 0x100029c9
mov eax, dword [0x1003ca28]
mov edi, 0x8000
add eax, 0xffffffec
test eax, eax
je 0x1000297b
push 0x5e1c1dfb
call fcn.1000b0a0
add esp, 4
test eax, eax
jne 0x10002921
mov eax, dword [0x1003ca4c]
test eax, eax
je 0x10002937
mov eax, dword [0x1003ca64]
test eax, eax
jne 0x10002937
test dword [esp + 0x54c], edi
je 0x10001a6c
push 0x592629e2
call fcn.1000b0a0
add esp, 4
test eax, eax
jne 0x10002951
mov eax, dword [0x1003ca4c]
test eax, eax
je 0x1000297b
mov eax, dword [0x1003ca64]
test eax, eax
jne 0x1000297b
mov eax, dword [0x1003ca1c]
movsx ecx, ax
shr eax, 0x10
movsx ebp, ax
and ebp, 0xffff
and ecx, 0xffff
shl ebp, 0x10
or ebp, ecx
jmp 0x10002982
mov ebp, dword [esp + 0x550]
test dword [esp + 0x54c], edi
jne 0x100029a6
push 0
call fcn.10012760
add esp, 4
test eax, eax
jne 0x100029a6
mov eax, dword [0x1003ca5c]
test eax, eax
je 0x10001a6c
mov edx, dword [esp + 0x54c]
push 0x20a
and dh, 0x7f
mov dword [esp + 0x550], edx
call fcn.10001760
add esp, 4
jmp 0x100042b8
cmp esi, 0x2a3
jne 0x10002a6e
mov ecx, dword [0x1003ca28]
add ecx, 0xffffffec
test ecx, ecx
je 0x100042b1
push 0x592629e2
call fcn.1000b0a0
add esp, 4
test eax, eax
jne 0x10002a04
mov eax, dword [0x1003ca4c]
test eax, eax
je 0x100042b1
mov eax, dword [0x1003ca64]
test eax, eax
jne 0x100042b1
mov eax, dword [0x1003ca1c]
lea ecx, [esp + 0x18]
movsx edx, ax
mov dword [esp + 0x18], edx
mov edx, dword [0x1003ca28]
shr eax, 0x10
movsx eax, ax
add edx, 0xffffffec
push ecx
push edx
mov dword [esp + 0x550], 0x2a1
mov dword [esp + 0x554], 0
mov dword [esp + 0x24], eax
call fcn.10008430
mov ebp, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
and ebp, 0xffff
shl ebp, 0x10
and eax, 0xffff
or ebp, eax
jmp 0x100042b8
cmp esi, 0x2a2
jne 0x10002b13
mov ecx, dword [0x1003ca28]
add ecx, 0xffffffec
test ecx, ecx
je 0x100042b1
push 0x592629e2
call fcn.1000b0a0
add esp, 4
test eax, eax
jne 0x10002aa9
mov eax, dword [0x1003ca4c]
test eax, eax
je 0x100042b1
mov eax, dword [0x1003ca64]
test eax, eax
jne 0x100042b1
mov eax, dword [0x1003ca1c]
lea ecx, [esp + 0x18]
movsx edx, ax
mov dword [esp + 0x18], edx
mov edx, dword [0x1003ca28]
shr eax, 0x10
movsx eax, ax
add edx, 0xffffffec
push ecx
push edx
mov dword [esp + 0x550], 0x2a1
mov dword [esp + 0x554], 0
mov dword [esp + 0x24], eax
call fcn.10008430
mov ebp, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
and ebp, 0xffff
shl ebp, 0x10
and eax, 0xffff
or ebp, eax
jmp 0x100042b8
cmp esi, 0x100
jne 0x10002b54
mov ebp, dword [esp + 0x550]
test ebp, 0x4000000
jne 0x10002b3c
push 1
call fcn.10012760
add esp, 4
test eax, eax
je 0x10001a6c
push 0x100
and ebp, 0xfbffffff
call fcn.100016e0
add esp, 4
jmp 0x100042b8
cmp esi, 0x101
jne 0x10002b95
mov ebp, dword [esp + 0x550]
test ebp, 0x4000000
jne 0x10002b7d
push 1
call fcn.10012760
add esp, 4
test eax, eax
je 0x10001a6c
push 0x101
and ebp, 0xfbffffff
call fcn.100016e0
add esp, 4
jmp 0x100042b8
cmp esi, 0x104
jne 0x10002bd6
mov ebp, dword [esp + 0x550]
test ebp, 0x4000000
jne 0x10002bbe
push 1
call fcn.10012760
add esp, 4
test eax, eax
je 0x10001a6c
push 0x104
and ebp, 0xfbffffff
call fcn.100016e0
add esp, 4
jmp 0x100042b8
cmp esi, 0x105
jne 0x10002c17
mov ebp, dword [esp + 0x550]
test ebp, 0x4000000
jne 0x10002bff
push 1
call fcn.10012760
add esp, 4
test eax, eax
je 0x10001a6c
push 0x105
and ebp, 0xfbffffff
call fcn.100016e0
add esp, 4
jmp 0x100042b8
cmp esi, 0x106
jne 0x10002c4b
mov ebp, dword [esp + 0x550]
test ebp, 0x4000000
jne 0x10002c40
push 1
call fcn.10012760
add esp, 4
test eax, eax
je 0x10001a6c
and ebp, 0xfbffffff
jmp 0x100042b8
cmp esi, 0x102
jne 0x10002ccb
mov ebx, dword [esp + 0x54c]
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp bl, 0x76
mov edi, 0x8000
je 0x10002c6f
cmp bl, 0x56
jne 0x10002c7b
push 0x11
call esi
test edi, eax
jne 0x10001a6c
mov eax, dword [0x1003d290]
mov ebp, dword [esp + 0x550]
test eax, eax
je 0x10002ca5
test ebp, 0x4000000
jne 0x10002ca5
push 1
call fcn.10012760
add esp, 4
test eax, eax
je 0x10001a6c
push 0x10
call esi
test edi, eax
je 0x10002cc0
push ebx
call fcn.10010750
movsx ecx, al
add esp, 4
mov dword [esp + 0x54c], ecx
and ebp, 0xfbffffff
jmp 0x100042b8
cmp esi, 0x7e9
jne 0x1000303b
cmp dword [esp + 0x54c], ebp
jne 0x100042b1
call fcn.10001470
mov ebp, dword [esp + 0x9c]
mov dword [esp + 0x18], 0
mov eax, dword [ebp + 0x1000424]
test eax, eax
jbe 0x10002efd
mov eax, dword [0x10030a10]
lea ebx, [ebp + 0x1000024]
mov dword [esp + 0x2c], ebx
mov ecx, dword [0x10030a14]
mov edx, dword [0x10030a0c]
sub ecx, eax
mov esi, eax
sar ecx, 2
cmp ecx, 1
jae 0x10002e16
test edx, edx
je 0x10002d4a
mov ecx, eax
sub ecx, edx
sar ecx, 2
cmp ecx, 1
jbe 0x10002d4a
mov ecx, eax
sub ecx, edx
sar ecx, 2
jmp 0x10002d4f
mov ecx, 1
test edx, edx
jne 0x10002d57
xor eax, eax
jmp 0x10002d5c
sub eax, edx
sar eax, 2
lea ebp, [eax + ecx]
test ebp, ebp
mov eax, ebp
jge 0x10002d67
xor eax, eax
lea edx, [eax*4]
push edx
call fcn.10019e52
mov ecx, dword [0x10030a0c]
add esp, 4
cmp ecx, esi
mov edi, eax
je 0x10002d95
test eax, eax
je 0x10002d8b
mov edx, dword [ecx]
mov dword [eax], edx
add ecx, 4
add eax, 4
cmp ecx, esi
jne 0x10002d83
test eax, eax
je 0x10002d9d
mov ecx, dword [ebx]
mov dword [eax], ecx
mov edx, dword [0x10030a10]
lea ecx, [eax + 4]
cmp esi, edx
je 0x10002dc8
mov ebx, ecx
sub ebx, eax
lea eax, [ebx + esi - 4]
test ecx, ecx
je 0x10002dba
mov esi, dword [eax]
mov dword [ecx], esi
add eax, 4
add ecx, 4
cmp eax, edx
jne 0x10002db2
mov ebx, dword [esp + 0x2c]
mov eax, dword [0x10030a0c]
push eax
mov dword [esp + 0x30], eax
call fcn.10019670
mov ecx, dword [0x10030a0c]
add esp, 4
lea edx, [edi + ebp*4]
test ecx, ecx
mov dword [0x10030a14], edx
jne 0x10002df1
xor eax, eax
jmp 0x10002dfb
mov eax, dword [0x10030a10]
sub eax, ecx
sar eax, 2
mov ebp, dword [esp + 0x9c]
lea eax, [edi + eax*4 + 4]
mov dword [0x10030a10], eax
mov dword [0x10030a0c], edi
jmp 0x10002edf
mov ecx, eax
sub ecx, esi
sar ecx, 2
cmp ecx, 1
jae 0x10002e7d
mov edi, eax
lea ecx, [esi + 4]
cmp esi, edi
je 0x10002e45
lea edx, [ecx - 4]
test ecx, ecx
je 0x10002e3b
mov eax, dword [edx]
mov dword [ecx], eax
mov eax, dword [0x10030a10]
add edx, 4
add ecx, 4
cmp edx, edi
jne 0x10002e2e
mov ecx, eax
mov edx, 1
sub ecx, esi
sar ecx, 2
sub edx, ecx
mov ecx, eax
je 0x10002e6a
test ecx, ecx
je 0x10002e64
mov eax, dword [ebx]
mov dword [ecx], eax
mov eax, dword [0x10030a10]
add ecx, 4
dec edx
jne 0x10002e57
cmp esi, eax
mov ecx, esi
je 0x10002ed7
mov edx, dword [ebx]
mov dword [ecx], edx
add ecx, 4
cmp ecx, eax
jne 0x10002e70
jmp 0x10002ed2
mov edi, eax
lea ecx, [eax - 4]
cmp ecx, edi
mov edx, eax
mov dword [esp + 0x2c], ecx
je 0x10002ea3
test edx, edx
je 0x10002e99
mov eax, dword [ecx]
mov dword [edx], eax
mov eax, dword [0x10030a10]
add ecx, 4
add edx, 4
cmp ecx, edi
jne 0x10002e8c
lea ecx, [eax - 4]
cmp esi, ecx
je 0x10002ebe
mov edx, dword [ecx - 4]
sub ecx, 4
sub eax, 4
cmp ecx, esi
mov dword [eax], edx
jne 0x10002eaa
mov eax, dword [0x10030a10]
lea edx, [esi + 4]
mov ecx, esi
cmp esi, edx
je 0x10002ed7
mov eax, dword [ebx]
mov dword [ecx], eax
add ecx, 4
cmp ecx, edx
jne 0x10002ec7
mov eax, dword [0x10030a10]
add eax, 4
mov dword [0x10030a10], eax
mov ecx, dword [esp + 0x18]
mov edx, dword [ebp + 0x1000424]
inc ecx
add ebx, 4
cmp ecx, edx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x2c], ebx
jb 0x10002d15
mov ecx, 0x100
xor eax, eax
lea edi, [ebp + 0x1000024]
push ebp
rep stosd dword es:[edi], eax
call fcn.1000dab0
add esp, 4
test eax, eax
je 0x10002f70
push ebp
call fcn.1000fd60
add esp, 4
test eax, eax
je 0x10002f70
push ebp
call fcn.1000d500
add esp, 4
test eax, eax
je 0x10002f70
push ebp
call fcn.10008da0
add esp, 4
test eax, eax
je 0x10002f70
push ebp
call fcn.10012810
add esp, 4
test eax, eax
je 0x10002f70
push ebp
call fcn.1000d920
add esp, 4
test eax, eax
je 0x10002f70
push ebp
call fcn.100101b0
add esp, 4
test eax, eax
je 0x10002f70
mov ebx, 1
mov ebp, ebx
jmp 0x10002f77
xor ebp, ebp
mov ebx, 1
push 0x3f1c98f9
call fcn.1000b0a0
add esp, 4
test eax, eax
je 0x10002f8e
call dword [sym.imp.USER32.dll_ReleaseCapture]
push 0x6a5a450a
call fcn.1000b0a0
add esp, 4
test eax, eax
je 0x10002fa5
mov dword [0x1003d274], ebx
push 0x7d877e7a
call fcn.1000b0a0
add esp, 4
test eax, eax
je 0x10002fbc
mov dword [0x1003d278], ebx
mov eax, dword [esp + 0x9c]
mov ecx, 0x18
mov edi, 0x1002c898
lea esi, [eax + 0x1000480]
rep movsd dword es:[edi], dword [esi]
lea esi, [eax + 0x10004e0]
mov ecx, 0x18
mov edi, 0x1002c838
rep movsd dword es:[edi], dword [esi]
call fcn.10001680
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor esi, esi
mov dword [0x1003d2e0], eax
cmp ebp, esi
mov dword [0x100280ac], esi
je 0x10003014
push esi
call fcn.10009f70
add esp, 4
mov dword [esp + 0x14], ebx
test eax, eax
jne 0x10003018
mov dword [esp + 0x14], esi
mov ecx, 0x1000
xor eax, eax
mov edi, 0x1002ca00
mov dword [0x100280ac], ebx
mov dword [esp + 0x10], ebx
mov dword [0x1003ca44], esi
rep stosd dword es:[edi], eax
jmp 0x100042b1
cmp esi, 0x7ea
jne 0x1000305e
cmp dword [esp + 0x54c], ebp
jne 0x100042b1
push eax
call fcn.10001840
add esp, 4
jmp 0x100042a9
cmp esi, 0x837
jne 0x100035b6
mov ecx, dword [esp + 0x54c]
xor edi, edi
mov eax, ecx
mov esi, ecx
and eax, 0x80
mov dword [esp + 0x18], eax
mov eax, ecx
shr esi, 0x10
and eax, 0x40
test cl, 1
mov dword [esp + 0x2c], eax
je 0x10003096
mov edi, 1
test esi, esi
jl 0x100042b1
cmp esi, 2
jg 0x100042b1
mov ebp, dword [esp + 0x550]
test ebp, ebp
jl 0x100042b8
cmp ebp, 0xff
jg 0x100042b8
push 0
push ebp
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov ebx, eax
push ebp
shl ebx, 0x10
or ebx, 1
mov dword [esp + 0x94], eax
mov dword [esp + 0x14], ebx
call fcn.10001330
add esp, 4
test eax, eax
je 0x100030f5
or ebx, 0x1000000
mov dword [esp + 0x10], ebx
cmp esi, 1
jne 0x1000312d
test edi, edi
jne 0x10003113
cmp ebp, 0x79
je 0x10003113
push ebp
mov dword [esp + 0x58], 0x100
call fcn.10010bf0
jmp 0x1000316d
or ebx, 0x20000000
push ebp
mov dword [esp + 0x14], ebx
mov dword [esp + 0x58], 0x104
call fcn.10010bf0
jmp 0x1000316d
test edi, edi
jne 0x1000314a
cmp ebp, 0x79
je 0x1000314a
or ebx, 0xc0000000
mov dword [esp + 0x54], 0x101
mov dword [esp + 0x10], ebx
jmp 0x10003162
or ebx, 0x20000000
mov dword [esp + 0x54], 0x105
or ebx, 0xc0000000
mov dword [esp + 0x10], ebx
cmp esi, 2
jne 0x10003170
push ebp
call fcn.10010ee0
add esp, 4
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x1000317e
xor ebx, ebx
mov dword [esp + 0x10], ebx
call fcn.100075a0
mov esi, dword [esp + 0x544]
mov edi, eax
test edi, edi
mov dword [esp + 0x14], edi
jne 0x100031a1
push esi
call dword [sym.imp.USER32.dll_SetFocus]
mov edi, esi
mov dword [esp + 0x14], edi
push 0x797a779e
call fcn.1000b0a0
add esp, 4
test eax, eax
jne 0x100031b8
mov edi, esi
mov dword [esp + 0x14], edi
mov eax, dword [0x1003ca64]
test eax, eax
jne 0x100031d8
cmp edi, esi
jne 0x100031d8
mov eax, dword [0x1003ca58]
test eax, eax
jne 0x100031d8
or ebx, 0x4000000
mov dword [esp + 0x10], ebx
push 0x18d3d20
call fcn.1000b0a0
add esp, 4
test eax, eax
je 0x100034af
mov eax, dword [0x1003d280]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov bl, 0x65
jne 0x10003344
lea ecx, [esp + 0x34]
lea edx, [esp + 0x20]
push ecx
push edx
mov byte [esp + 0x28], 0x75
mov byte [esp + 0x29], 0x73
mov byte [esp + 0x2a], bl
mov byte [esp + 0x2b], 0x72
mov byte [esp + 0x2c], 0x33
mov byte [esp + 0x2d], 0x32
mov byte [esp + 0x2e], 0x2e
mov byte [esp + 0x2f], 0x64
mov byte [esp + 0x30], 0x6c
mov byte [esp + 0x31], 0x6c
mov byte [esp + 0x32], 0
mov byte [esp + 0x3c], 0x47
mov byte [esp + 0x3d], bl
mov byte [esp + 0x3e], 0x74
mov byte [esp + 0x3f], 0x52
mov byte [esp + 0x40], bl
mov byte [esp + 0x41], 0x67
mov byte [esp + 0x42], 0x69
mov byte [esp + 0x43], 0x73
mov byte [esp + 0x44], 0x74
mov byte [esp + 0x45], bl
mov byte [esp + 0x46], 0x72
mov byte [esp + 0x47], bl
mov byte [esp + 0x48], 0x64
mov byte [esp + 0x49], 0x52
mov byte [esp + 0x4a], 0x61
mov byte [esp + 0x4b], 0x77
mov byte [esp + 0x4c], 0x49
mov byte [esp + 0x4d], 0x6e
mov byte [esp + 0x4e], 0x70
mov byte [esp + 0x4f], 0x75
mov byte [esp + 0x50], 0x74
mov byte [esp + 0x51], 0x44
mov byte [esp + 0x52], bl
mov byte [esp + 0x53], 0x76
mov byte [esp + 0x54], 0x69
mov byte [esp + 0x55], 0x63
mov byte [esp + 0x56], bl
mov byte [esp + 0x57], 0x73
mov byte [esp + 0x58], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call esi
mov edx, eax
test edx, edx
je 0x10003331
mov ecx, 0x1e
xor eax, eax
lea edi, [esp + 0xa8]
push 0xc
rep stosd dword es:[edi], eax
lea eax, [esp + 0x30]
lea ecx, [esp + 0xac]
push eax
push ecx
mov dword [esp + 0x38], 0xa
call edx
xor ecx, ecx
test eax, eax
jbe 0x10003331
lea edx, [esp + 0xaa]
cmp word [edx], 6
je 0x10003322
inc ecx
add edx, 0xc
cmp ecx, eax
jb 0x10003312
jmp 0x10003331
lea edx, [ecx + ecx*2]
mov eax, dword [esp + edx*4 + 0xb0]
mov dword [0x1003d280], eax
mov eax, dword [0x1003d280]
test eax, eax
jne 0x10003344
mov ecx, dword [esp + 0x14]
mov dword [0x1003d280], ecx
mov eax, dword [0x1003d28c]
test eax, eax
jne 0x10003463
lea edx, [esp + 0x34]
lea eax, [esp + 0x20]
push edx
push eax
mov byte [esp + 0x28], 0x75
mov byte [esp + 0x29], 0x73
mov byte [esp + 0x2a], bl
mov byte [esp + 0x2b], 0x72
mov byte [esp + 0x2c], 0x33
mov byte [esp + 0x2d], 0x32
mov byte [esp + 0x2e], 0x2e
mov byte [esp + 0x2f], 0x64
mov byte [esp + 0x30], 0x6c
mov byte [esp + 0x31], 0x6c
mov byte [esp + 0x32], 0
mov byte [esp + 0x3c], 0x47
mov byte [esp + 0x3d], bl
mov byte [esp + 0x3e], 0x74
mov byte [esp + 0x3f], 0x52
mov byte [esp + 0x40], 0x61
mov byte [esp + 0x41], 0x77
mov byte [esp + 0x42], 0x49
mov byte [esp + 0x43], 0x6e
mov byte [esp + 0x44], 0x70
mov byte [esp + 0x45], 0x75
mov byte [esp + 0x46], 0x74
mov byte [esp + 0x47], 0x44
mov byte [esp + 0x48], bl
mov byte [esp + 0x49], 0x76
mov byte [esp + 0x4a], 0x69
mov byte [esp + 0x4b], 0x63
mov byte [esp + 0x4c], bl
mov byte [esp + 0x4d], 0x4c
mov byte [esp + 0x4e], 0x69
mov byte [esp + 0x4f], 0x73
mov byte [esp + 0x50], 0x74
mov byte [esp + 0x51], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call esi
mov edx, eax
test edx, edx
je 0x10003463
mov ecx, 0xc8
xor eax, eax
lea edi, [esp + 0x220]
push 8
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x30]
lea eax, [esp + 0x224]
push ecx
push eax
mov dword [esp + 0x38], 0x64
call edx
xor ecx, ecx
test eax, eax
jbe 0x10003463
lea edx, [esp + 0x220]
cmp dword [edx + 4], 1
jne 0x1000344c
cmp dword [edx], 0
jne 0x10003456
inc ecx
add edx, 8
cmp ecx, eax
jb 0x10003441
jmp 0x10003463
mov ecx, dword [esp + ecx*8 + 0x220]
mov dword [0x1003d28c], ecx
mov eax, dword [esp + 0x18]
test eax, eax
je 0x1000348f
mov edx, dword [0x1003ca6c]
mov eax, dword [0x1003d280]
push 0
push edx
push 1
push 0x12345678
push 0
push 0xff
push eax
call fcn.10001800
jmp 0x100034a7
mov ecx, dword [0x1003d280]
push 0x12345678
push 0
push 0xff
push ecx
call fcn.100017f0
mov ebx, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
mov eax, dword [0x1003d294]
test eax, eax
je 0x100034ff
mov eax, dword [0x1003d29c]
xor ecx, ecx
lea edx, [eax + eax*4]
lea eax, [edx*4 + 0x1002c770]
mov edx, eax
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
mov dword [edx + 0x10], ecx
mov ecx, dword [esp + 0x90]
mov dword [eax], ebp
mov dword [eax + 4], ecx
mov eax, dword [0x1003d29c]
inc eax
cmp eax, 0xa
mov dword [0x1003d29c], eax
jb 0x100034ff
mov dword [0x1003d29c], 0
mov eax, dword [0x100280b0]
test eax, eax
je 0x10003559
mov eax, dword [esp + 0x18]
test eax, eax
je 0x1000353a
mov edx, dword [0x1003ca6c]
mov eax, dword [esp + 0x54]
push 0
push edx
push 1
push ebx
push ebp
push eax
push edi
call fcn.10001800
mov eax, 1
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
jmp 0x100042b8
mov ecx, dword [esp + 0x54]
push ebx
push ebp
push ecx
push edi
call fcn.100017f0
mov eax, 1
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
jmp 0x100042b8
mov esi, dword [esp + 0x10]
mov ebx, dword [esp + 0x54]
mov edx, dword [esp + 0x544]
and esi, 0xfbffffff
push esi
push ebp
push ebx
push edx
call dword [0x1003d2e4]
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x34]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x34]
push ecx
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebp
mov dword [esp + 0x44], esi
call dword [sym.imp.USER32.dll_TranslateMessage]
mov eax, 1
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
jmp 0x100042b8
cmp esi, 0x838
jne 0x10003ecb
mov ebx, dword [esp + 0x54c]
xor edx, edx
mov eax, ebx
mov ecx, ebx
shr eax, 0x10
and ecx, 0x80
mov dword [esp + 0x54], eax
test bl, 1
mov dword [esp + 0x18], ecx
mov dword [esp + 0x90], edx
mov dword [esp + 0x2c], edx
je 0x100035f5
mov edx, 1
test bl, 2
je 0x10003605
mov dword [esp + 0x90], 1
test bl, 4
je 0x10003612
mov dword [esp + 0x2c], 1
mov ebp, dword [esp + 0x550]
mov ecx, ebp
shr ecx, 0x10
movsx ecx, cx
test eax, eax
mov dword [esp + 0xa0], ecx
jl 0x100042b8
cmp eax, 0xa
jg 0x100042b8
mov eax, dword [esp + 0x54]
mov ecx, dword [sym.imp.USER32.dll_ClientToScreen]
xor ebx, ebx
xor edi, edi
mov esi, ebp
cmp eax, 1
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], edi
mov dword [esp + 0x98], esi
jne 0x10003699
test edx, edx
je 0x1000366a
mov edi, 1
mov dword [esp + 0x14], edi
mov ecx, dword [esp + 0x90]
test ecx, ecx
je 0x1000367c
or edi, 2
mov dword [esp + 0x14], edi
mov ecx, dword [esp + 0x2c]
test ecx, ecx
je 0x1000368b
or edi, 0x10
mov dword [esp + 0x14], edi
mov ebx, 0x200
mov dword [esp + 0x10], ebx
jmp 0x10003831
cmp eax, 2
jne 0x100036b5
mov edi, 1
mov ebx, 0x201
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], ebx
jmp 0x10003831
cmp eax, 8
jne 0x100036d1
mov edi, 1
mov ebx, 0x203
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], ebx
jmp 0x10003831
cmp eax, 3
jne 0x100036e4
mov ebx, 0x202
mov dword [esp + 0x10], ebx
jmp 0x10003831
cmp eax, 4
jne 0x10003700
mov edi, 2
mov ebx, 0x204
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], ebx
jmp 0x10003831
cmp eax, 5
jne 0x10003713
mov ebx, 0x205
mov dword [esp + 0x10], ebx
jmp 0x10003831
cmp eax, 6
jne 0x1000372f
mov edi, 0x10
mov ebx, 0x207
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], ebx
jmp 0x10003831
cmp eax, 7
jne 0x10003742
mov ebx, 0x208
mov dword [esp + 0x10], ebx
jmp 0x10003831
cmp eax, 9
jne 0x100037ad
test edx, edx
je 0x10003750
mov edi, 1
mov eax, dword [esp + 0x90]
test eax, eax
je 0x1000375e
or edi, 2
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x10003769
or edi, 0x10
mov edx, dword [esp + 0xa0]
and edi, 0xffff
movsx eax, bp
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], edx
mov edx, dword [esp + 0x544]
lea eax, [esp + 0x2c]
or edi, 0x780000
push eax
push edx
mov dword [esp + 0x1c], edi
call ecx
mov esi, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
and esi, 0xffff
shl esi, 0x10
jmp 0x10003816
cmp eax, 0xa
jne 0x10003831
test edx, edx
je 0x100037bb
mov edi, 1
mov eax, dword [esp + 0x90]
test eax, eax
je 0x100037c9
or edi, 2
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x100037d4
or edi, 0x10
mov edx, dword [esp + 0xa0]
and edi, 0xffff
movsx eax, bp
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], edx
mov edx, dword [esp + 0x544]
lea eax, [esp + 0x2c]
or edi, 0xff880000
push eax
push edx
mov dword [esp + 0x1c], edi
call ecx
mov esi, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
and esi, 0xffff
shl esi, 0x10
and eax, 0xffff
mov ebx, 0x20a
or esi, eax
mov eax, dword [esp + 0x54]
mov dword [esp + 0x98], esi
mov dword [esp + 0x10], ebx
mov ecx, dword [0x1003ca64]
test ecx, ecx
jne 0x1000384f
mov ecx, dword [0x1003ca58]
test ecx, ecx
jne 0x1000384f
or edi, 0x8000
mov dword [esp + 0x14], edi
cmp eax, 1
jne 0x10003965
xor eax, eax
lea edx, [esp + 0x90]
mov dword [esp + 0x90], eax
mov dword [esp + 0x94], eax
mov eax, dword [0x1003ca1c]
push edx
movsx edi, ax
shr eax, 0x10
movsx ecx, ax
mov eax, dword [esp + 0x548]
mov dword [esp + 0x30], ecx
push eax
call dword [sym.imp.USER32.dll_ClientToScreen]
movsx edx, bp
mov eax, dword [esp + 0x94]
mov ecx, dword [esp + 0xa0]
lea ebx, [ecx + eax]
mov ecx, dword [esp + 0x90]
and ebx, 0xffff
add edx, ecx
shl ebx, 0x10
and edx, 0xffff
sub ecx, edi
mov edi, dword [esp + 0x2c]
or ebx, edx
movsx edx, bp
add ecx, edx
mov edx, dword [esp + 0xa0]
sub eax, edi
mov dword [0x1003ca1c], ebx
add eax, edx
test ecx, ecx
mov edi, eax
je 0x100038ed
push 1
push ecx
push 0x37
call fcn.10010bb0
add esp, 0xc
test edi, edi
je 0x100038fe
push 1
push edi
push 0x38
call fcn.10010bb0
add esp, 0xc
mov ebx, dword [esp + 0x10]
call fcn.100075a0
mov edi, dword [esp + 0x544]
mov dword [esp + 0x2c], eax
test eax, eax
jne 0x10003921
push edi
call dword [sym.imp.USER32.dll_SetFocus]
mov dword [esp + 0x2c], edi
push 0x797a779e
call fcn.1000b0a0
add esp, 4
test eax, eax
jne 0x10003936
mov dword [esp + 0x2c], edi
mov eax, dword [esp + 0x18]
test eax, eax
je 0x10003a34
mov eax, dword [0x1003ca68]
mov ecx, dword [0x1003ca1c]
push 0
push eax
push 1
push ecx
push 0
push 0x84
push edi
call fcn.10001800
jmp 0x10003a48
cmp eax, 2
je 0x10003a23
cmp eax, 8
je 0x10003a23
cmp eax, 3
jne 0x1000398d
push 1
push 0
call fcn.10010b60
add esp, 8
jmp 0x10003902
cmp eax, 4
jne 0x100039a3
push 1
push 1
call fcn.10010880
add esp, 8
jmp 0x10003902
cmp eax, 5
jne 0x100039b9
push 1
push 1
call fcn.10010b60
add esp, 8
jmp 0x10003902
cmp eax, 6
jne 0x100039cf
push 1
push 2
call fcn.10010880
add esp, 8
jmp 0x10003902
cmp eax, 7
jne 0x100039e5
push 1
push 2
call fcn.10010b60
add esp, 8
jmp 0x10003902
cmp eax, 0xa
jne 0x10003a02
push 1
push 4
call fcn.10010880
push 0xffffffffffffff88
call fcn.10010870
add esp, 0xc
jmp 0x10003902
cmp eax, 9
jne 0x10003902
push 1
push 5
call fcn.10010880
push 0x78
call fcn.10010870
add esp, 0xc
jmp 0x10003902
push 1
push 0
call fcn.10010880
add esp, 8
jmp 0x10003902
mov edx, dword [0x1003ca1c]
push edx
push 0
push 0x84
push edi
call fcn.100017e0
cmp dword [esp + 0x54], 1
jne 0x10003a7f
mov eax, dword [esp + 0x18]
test eax, eax
je 0x10003a71
mov eax, dword [0x1003ca68]
push 0
push eax
push 1
push 0x2000001
push edi
push 0x20
push edi
call fcn.10001800
jmp 0x10003a7f
push 0x2000001
push edi
push 0x20
push edi
call fcn.100017e0
push 0x326cd5b9
call fcn.1000b0a0
add esp, 4
test eax, eax
je 0x10003da8
mov eax, dword [0x1003d284]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov bl, 0x65
jne 0x10003bf1
lea ecx, [esp + 0x34]
lea edx, [esp + 0x20]
push ecx
push edx
mov byte [esp + 0x28], 0x75
mov byte [esp + 0x29], 0x73
mov byte [esp + 0x2a], bl
mov byte [esp + 0x2b], 0x72
mov byte [esp + 0x2c], 0x33
mov byte [esp + 0x2d], 0x32
mov byte [esp + 0x2e], 0x2e
mov byte [esp + 0x2f], 0x64
mov byte [esp + 0x30], 0x6c
mov byte [esp + 0x31], 0x6c
mov byte [esp + 0x32], 0
mov byte [esp + 0x3c], 0x47
mov byte [esp + 0x3d], bl
mov byte [esp + 0x3e], 0x74
mov byte [esp + 0x3f], 0x52
mov byte [esp + 0x40], bl
mov byte [esp + 0x41], 0x67
mov byte [esp + 0x42], 0x69
mov byte [esp + 0x43], 0x73
mov byte [esp + 0x44], 0x74
mov byte [esp + 0x45], bl
mov byte [esp + 0x46], 0x72
mov byte [esp + 0x47], bl
mov byte [esp + 0x48], 0x64
mov byte [esp + 0x49], 0x52
mov byte [esp + 0x4a], 0x61
mov byte [esp + 0x4b], 0x77
mov byte [esp + 0x4c], 0x49
mov byte [esp + 0x4d], 0x6e
mov byte [esp + 0x4e], 0x70
mov byte [esp + 0x4f], 0x75
mov byte [esp + 0x50], 0x74
mov byte [esp + 0x51], 0x44
mov byte [esp + 0x52], bl
mov byte [esp + 0x53], 0x76
mov byte [esp + 0x54], 0x69
mov byte [esp + 0x55], 0x63
mov byte [esp + 0x56], bl
mov byte [esp + 0x57], 0x73
mov byte [esp + 0x58], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call esi
mov edx, eax
test edx, edx
je 0x10003bde
mov ecx, 0x1e
xor eax, eax
lea edi, [esp + 0xa8]
push 0xc
rep stosd dword es:[edi], eax
lea eax, [esp + 0x94]
lea ecx, [esp + 0xac]
push eax
push ecx
mov dword [esp + 0x9c], 0xa
call edx
xor ecx, ecx
test eax, eax
jbe 0x10003bde
lea edx, [esp + 0xaa]
cmp word [edx], 2
je 0x10003bcf
inc ecx
add edx, 0xc
cmp ecx, eax
jb 0x10003bbf
jmp 0x10003bde
lea edx, [ecx + ecx*2]
mov eax, dword [esp + edx*4 + 0xb0]
mov dword [0x1003d284], eax
mov eax, dword [0x1003d284]
test eax, eax
jne 0x10003bf1
mov ecx, dword [esp + 0x2c]
mov dword [0x1003d284], ecx
mov eax, dword [0x1003d288]
test eax, eax
jne 0x10003d11
lea edx, [esp + 0x34]
lea eax, [esp + 0x20]
push edx
push eax
mov byte [esp + 0x28], 0x75
mov byte [esp + 0x29], 0x73
mov byte [esp + 0x2a], bl
mov byte [esp + 0x2b], 0x72
mov byte [esp + 0x2c], 0x33
mov byte [esp + 0x2d], 0x32
mov byte [esp + 0x2e], 0x2e
mov byte [esp + 0x2f], 0x64
mov byte [esp + 0x30], 0x6c
mov byte [esp + 0x31], 0x6c
mov byte [esp + 0x32], 0
mov byte [esp + 0x3c], 0x47
mov byte [esp + 0x3d], bl
mov byte [esp + 0x3e], 0x74
mov byte [esp + 0x3f], 0x52
mov byte [esp + 0x40], 0x61
mov byte [esp + 0x41], 0x77
mov byte [esp + 0x42], 0x49
mov byte [esp + 0x43], 0x6e
mov byte [esp + 0x44], 0x70
mov byte [esp + 0x45], 0x75
mov byte [esp + 0x46], 0x74
mov byte [esp + 0x47], 0x44
mov byte [esp + 0x48], bl
mov byte [esp + 0x49], 0x76
mov byte [esp + 0x4a], 0x69
mov byte [esp + 0x4b], 0x63
mov byte [esp + 0x4c], bl
mov byte [esp + 0x4d], 0x4c
mov byte [esp + 0x4e], 0x69
mov byte [esp + 0x4f], 0x73
mov byte [esp + 0x50], 0x74
mov byte [esp + 0x51], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call esi
mov edx, eax
test edx, edx
je 0x10003d11
mov ecx, 0xc8
xor eax, eax
lea edi, [esp + 0x220]
push 8
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x30]
lea eax, [esp + 0x224]
push ecx
push eax
mov dword [esp + 0x38], 0x64
call edx
xor ecx, ecx
test eax, eax
jbe 0x10003d11
lea edx, [esp + 0x220]
mov esi, dword [edx + 4]
test esi, esi
jne 0x10003cfa
cmp dword [edx], 0
jne 0x10003d04
inc ecx
add edx, 8
cmp ecx, eax
jb 0x10003cee
jmp 0x10003d11
mov ecx, dword [esp + ecx*8 + 0x220]
mov dword [0x1003d288], ecx
mov eax, dword [esp + 0x18]
test eax, eax
je 0x10003d67
mov edx, dword [0x1003ca68]
mov eax, dword [0x1003d284]
push 0
push edx
push 1
push 0x12345679
push 0
push 0xff
push eax
call fcn.10001800
cmp dword [esp + 0x54], 1
jne 0x10003d9d
mov ecx, dword [0x1003ca68]
mov edx, dword [0x1003d284]
push 0
push ecx
push 1
push 0x12345679
push 0
push 0xff
push edx
call fcn.10001800
jmp 0x10003d9d
mov eax, dword [0x1003d284]
push 0x12345679
push 0
push 0xff
push eax
call fcn.100017f0
cmp dword [esp + 0x54], 1
jne 0x10003d9d
mov ecx, dword [0x1003d284]
push 0x12345679
push 0
push 0xff
push ecx
call fcn.100017f0
mov esi, dword [esp + 0x98]
mov ebx, dword [esp + 0x10]
mov eax, dword [0x1003d298]
test eax, eax
je 0x10003e44
cmp ebx, 0x203
je 0x10003e44
cmp ebx, 0x207
je 0x10003e44
cmp ebx, 0x208
je 0x10003e44
mov eax, dword [0x1003d2a4]
mov ecx, 6
lea edx, [eax + eax*2]
xor eax, eax
cmp ebx, 0x20a
lea edx, [edx*8 + 0x1002c910]
mov edi, edx
rep stosd dword es:[edi], eax
movsx eax, bp
mov dword [edx], eax
mov eax, dword [esp + 0xa0]
mov dword [edx + 4], eax
jne 0x10003e19
cmp dword [esp + 0x54], 9
jne 0x10003e12
mov dword [edx + 8], 0x780000
jmp 0x10003e19
mov dword [edx + 8], 0xff880000
mov edi, dword [esp + 0x544]
push edx
push edi
call dword [sym.imp.USER32.dll_ClientToScreen]
mov eax, dword [0x1003d2a4]
inc eax
cmp eax, 0xa
mov dword [0x1003d2a4], eax
jb 0x10003e4b
mov dword [0x1003d2a4], 0
jmp 0x10003e4b
mov edi, dword [esp + 0x544]
mov eax, dword [0x100280b4]
test eax, eax
je 0x10003ea5
mov eax, dword [esp + 0x18]
test eax, eax
je 0x10003e86
mov ecx, dword [0x1003ca68]
mov edx, dword [esp + 0x14]
push 0
push ecx
push 1
push esi
push edx
push ebx
push edi
call fcn.10001800
mov eax, 1
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
jmp 0x100042b8
mov eax, dword [esp + 0x14]
push esi
push eax
push ebx
push edi
call fcn.100017f0
mov eax, 1
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
jmp 0x100042b8
mov ecx, dword [esp + 0x14]
and esi, 0xfbffffff
push esi
push ecx
push ebx
push edi
call dword [0x1003d2e4]
mov eax, 1
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
jmp 0x100042b8
cmp esi, 0x83a
jne 0x10003ef7
cmp dword [esp + 0x54c], ebp
jne 0x100042b1
mov eax, 1
mov dword [0x100280a0], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
jmp 0x100042b1
cmp esi, 0x83d
jne 0x10003f3a
cmp dword [esp + 0x54c], ebp
jne 0x100042b1
mov ebp, dword [esp + 0x550]
mov edx, ebp
shr edx, 0x10
movsx eax, dx
movsx ecx, bp
push eax
push ecx
call fcn.10010850
mov eax, 1
add esp, 8
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
jmp 0x100042b8
cmp esi, 0x83f
jne 0x10003f80
cmp dword [esp + 0x54c], ebp
jne 0x100042b1
mov ebp, dword [esp + 0x550]
mov edx, ebp
mov eax, ebp
and edx, 0x7fffffff
shr eax, 0x1f
mov dword [0x1003ca30], eax
mov eax, 1
mov dword [0x1003ca34], edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
jmp 0x100042b8
cmp esi, 0x863
jne 0x10003fba
cmp dword [esp + 0x54c], ebp
jne 0x100042b1
fild dword [esp + 0x550]
mov eax, 1
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
fmul qword [0x10024268]
fstp qword [0x100280b8]
jmp 0x100042b1
cmp esi, 0x842
jne 0x1000403c
cmp dword [esp + 0x54c], ebp
jne 0x100042b1
push 0x16cc25d5
call fcn.1000b0a0
mov ebp, dword [esp + 0x554]
add esp, 4
test eax, eax
je 0x10004027
call fcn.100111e0
mov esi, eax
push esi
call fcn.10001280
mov edi, eax
push ebp
push edi
call fcn.10001090
add esp, 0xc
mov dword [esp + 0x14], eax
test esi, esi
je 0x1000400f
push esi
call dword [sym.imp.USER32.dll_DestroyCursor]
test edi, edi
je 0x1000402f
push edi
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [esp + 0x10], 1
jmp 0x100042b8
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 1
jmp 0x100042b8
cmp esi, 0x843
jne 0x100040d6
cmp dword [esp + 0x54c], ebp
jne 0x100042b1
push 0x16cc25d5
call fcn.1000b0a0
add esp, 4
test eax, eax
je 0x100040c9
call fcn.100111e0
mov ebp, eax
mov edi, 0xffff
test ebp, ebp
mov esi, edi
je 0x100040af
lea ecx, [esp + 0x34]
push ecx
push ebp
call dword [sym.imp.USER32.dll_GetIconInfo]
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [esp + 0x44]
test eax, eax
je 0x10004095
push eax
call esi
mov eax, dword [esp + 0x40]
test eax, eax
je 0x100040a0
push eax
call esi
mov edi, dword [esp + 0x38]
mov esi, dword [esp + 0x3c]
push ebp
call dword [sym.imp.USER32.dll_DestroyCursor]
and esi, 0xffff
and edi, 0xffff
shl esi, 0x10
or esi, edi
mov dword [esp + 0x14], esi
jmp 0x100042a9
mov dword [esp + 0x14], 0xffffffff
jmp 0x100042a9
cmp esi, 0x844
jne 0x1000411d
cmp dword [esp + 0x54c], ebp
jne 0x10004110
mov eax, dword [0x1003ca44]
cmp eax, 0x1000
jge 0x10004110
lea ecx, [eax + 1]
mov dword [eax*4 + 0x1002ca00], 1
mov dword [esp + 0x14], ecx
mov dword [0x1003ca44], ecx
jmp 0x100042a9
mov dword [esp + 0x14], 0x1388
jmp 0x100042a9
cmp esi, 0x845
jne 0x1000416a
cmp dword [esp + 0x54c], ebp
jne 0x100042b1
mov ebp, dword [esp + 0x550]
cmp ebp, 0x1000
jg 0x10001c1e
test ebp, ebp
jle 0x10001c1e
mov eax, 1
mov dword [ebp*4 + 0x1002c9fc], 0
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
jmp 0x100042b8
cmp esi, 0x846
jne 0x10004261
cmp dword [esp + 0x54c], ebp
jne 0x100042b1
mov ebp, dword [esp + 0x550]
xor ecx, ecx
cmp ebp, ecx
jne 0x100041b4
mov eax, 1
mov dword [0x1003ca4c], ecx
mov dword [0x1003ca50], ecx
mov dword [0x1003d290], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
jmp 0x100042b8
mov eax, 1
cmp ebp, eax
jne 0x100041da
mov dword [0x1003ca4c], eax
mov dword [0x1003ca50], eax
mov dword [0x1003d290], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
jmp 0x100042b8
cmp ebp, 2
jne 0x100041fd
mov dword [0x1003ca4c], eax
mov dword [0x1003ca50], ecx
mov dword [0x1003d290], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
jmp 0x100042b8
cmp ebp, 3
jne 0x10004220
mov dword [0x1003ca4c], ecx
mov dword [0x1003ca50], eax
mov dword [0x1003d290], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
jmp 0x100042b8
cmp ebp, 4
jne 0x1000423e
mov dword [0x1003ca4c], eax
mov dword [0x1003ca50], eax
mov dword [0x1003d290], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
jmp 0x100042b8
cmp ebp, 5
jne 0x10001c23
mov dword [0x1003ca4c], ecx
mov dword [0x1003ca50], eax
mov dword [0x1003d290], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
jmp 0x100042b8
cmp esi, 0x850
jne 0x1000428e
cmp dword [esp + 0x54c], ebp
jne 0x100042b1
mov ebp, dword [esp + 0x550]
mov eax, 1
mov dword [0x1003ca54], ebp
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
jmp 0x100042b8
cmp esi, 0x851
jne 0x100042f5
cmp dword [esp + 0x54c], ebp
jne 0x100042b1
mov edx, dword [0x1003ca1c]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], 1
mov ebp, dword [esp + 0x550]
mov eax, dword [esp + 0x9c]
test eax, eax
je 0x100042d9
push eax
call fcn.100068a0
mov ecx, dword [esp + 0xa8]
push ecx
call fcn.100068b0
add esp, 8
cmp dword [esp + 0x10], 1
jne 0x10004b37
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x530
ret 0x14
cmp esi, 0x852
jne 0x10004322
cmp dword [esp + 0x54c], ebp
jne 0x100042b1
mov ebp, dword [esp + 0x550]
mov eax, 1
mov dword [0x100280b0], ebp
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
jmp 0x100042b8
cmp esi, 0x853
jne 0x10004356
cmp dword [esp + 0x54c], ebp
jne 0x100042b1
mov ebp, dword [esp + 0x550]
mov eax, 1
mov dword [0x100280b4], ebp
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
jmp 0x100042b8
cmp esi, 0x84d
jne 0x1000438a
cmp dword [esp + 0x54c], ebp
jne 0x100042b1
mov ebp, dword [esp + 0x550]
mov eax, 1
mov dword [0x1003ca58], ebp
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
jmp 0x100042b8
cmp esi, 0x84f
jne 0x10004837
cmp dword [esp + 0x54c], ebp
jne 0x100042b1
mov ebp, dword [esp + 0x550]
test ebp, ebp
je 0x100045f6
lea eax, [esp + 0x20]
mov byte [esp + 0x20], 0x69
push eax
mov byte [esp + 0x25], 0x6d
mov byte [esp + 0x26], 0x6d
mov byte [esp + 0x27], 0x33
mov byte [esp + 0x28], 0x32
mov byte [esp + 0x29], 0x2e
mov byte [esp + 0x2a], 0x64
mov byte [esp + 0x2b], 0x6c
mov byte [esp + 0x2c], 0x6c
mov byte [esp + 0x2d], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x10001c1e
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [esp + 0x80]
mov bl, 0x65
push ecx
push esi
mov byte [esp + 0x88], 0x49
mov byte [esp + 0x89], 0x6d
mov byte [esp + 0x8a], 0x6d
mov byte [esp + 0x8b], 0x47
mov byte [esp + 0x8c], bl
mov byte [esp + 0x8d], 0x74
mov byte [esp + 0x8e], 0x43
mov byte [esp + 0x8f], 0x6f
mov byte [esp + 0x90], 0x6e
mov byte [esp + 0x91], 0x74
mov byte [esp + 0x92], bl
mov byte [esp + 0x93], 0x78
mov byte [esp + 0x94], 0x74
mov byte [esp + 0x95], 0
call edi
lea edx, [esp + 0x6c]
mov byte [esp + 0x6c], 0x49
push edx
push esi
mov dword [esp + 0x20], eax
mov byte [esp + 0x75], 0x6d
mov byte [esp + 0x76], 0x6d
mov byte [esp + 0x77], 0x47
mov byte [esp + 0x78], bl
mov byte [esp + 0x79], 0x74
mov byte [esp + 0x7a], 0x4f
mov byte [esp + 0x7b], 0x70
mov byte [esp + 0x7c], bl
mov byte [esp + 0x7d], 0x6e
mov byte [esp + 0x7e], 0x53
mov byte [esp + 0x7f], 0x74
mov byte [esp + 0x80], 0x61
mov byte [esp + 0x81], 0x74
mov byte [esp + 0x82], 0x75
mov byte [esp + 0x83], 0x73
mov byte [esp + 0x84], 0
call edi
mov byte [esp + 0x58], 0x49
mov byte [esp + 0x59], 0x6d
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x58]
push eax
push esi
mov byte [esp + 0x62], 0x6d
mov byte [esp + 0x63], 0x53
mov byte [esp + 0x64], bl
mov byte [esp + 0x65], 0x74
mov byte [esp + 0x66], 0x4f
mov byte [esp + 0x67], 0x70
mov byte [esp + 0x68], bl
mov byte [esp + 0x69], 0x6e
mov byte [esp + 0x6a], 0x53
mov byte [esp + 0x6b], 0x74
mov byte [esp + 0x6c], 0x61
mov byte [esp + 0x6d], 0x74
mov byte [esp + 0x6e], 0x75
mov byte [esp + 0x6f], 0x73
mov byte [esp + 0x70], 0
call edi
mov byte [esp + 0x34], 0x49
mov byte [esp + 0x35], 0x6d
mov dword [esp + 0x90], eax
mov byte [esp + 0x36], 0x6d
mov byte [esp + 0x37], 0x52
mov byte [esp + 0x38], bl
mov byte [esp + 0x39], 0x6c
mov byte [esp + 0x3a], bl
mov byte [esp + 0x3b], 0x61
mov byte [esp + 0x3c], 0x73
mov byte [esp + 0x3d], bl
mov byte [esp + 0x3e], 0x43
mov byte [esp + 0x3f], 0x6f
mov byte [esp + 0x40], 0x6e
mov byte [esp + 0x41], 0x74
mov byte [esp + 0x42], bl
mov byte [esp + 0x43], 0x78
lea ecx, [esp + 0x34]
mov byte [esp + 0x44], 0x74
push ecx
push esi
mov byte [esp + 0x4d], 0
call edi
mov edx, dword [0x1003ca28]
mov ebx, eax
add edx, 0xffffffec
push edx
call dword [esp + 0x1c]
mov edi, eax
push edi
call dword [esp + 0x30]
test eax, eax
jne 0x100045d1
push 1
push edi
call dword [esp + 0x98]
mov eax, dword [0x1003ca28]
push edi
add eax, 0xffffffec
push eax
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
jmp 0x100042b8
lea ecx, [esp + 0x20]
mov byte [esp + 0x20], 0x69
push ecx
mov byte [esp + 0x25], 0x6d
mov byte [esp + 0x26], 0x6d
mov byte [esp + 0x27], 0x33
mov byte [esp + 0x28], 0x32
mov byte [esp + 0x29], 0x2e
mov byte [esp + 0x2a], 0x64
mov byte [esp + 0x2b], 0x6c
mov byte [esp + 0x2c], 0x6c
mov byte [esp + 0x2d], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x10001c1e
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea edx, [esp + 0x80]
mov bl, 0x65
push edx
push esi
mov byte [esp + 0x88], 0x49
mov byte [esp + 0x89], 0x6d
mov byte [esp + 0x8a], 0x6d
mov byte [esp + 0x8b], 0x47
mov byte [esp + 0x8c], bl
mov byte [esp + 0x8d], 0x74
mov byte [esp + 0x8e], 0x43
mov byte [esp + 0x8f], 0x6f
mov byte [esp + 0x90], 0x6e
mov byte [esp + 0x91], 0x74
mov byte [esp + 0x92], bl
mov byte [esp + 0x93], 0x78
mov byte [esp + 0x94], 0x74
mov byte [esp + 0x95], 0
call edi
mov ebp, eax
lea eax, [esp + 0x58]
push eax
push esi
mov byte [esp + 0x60], 0x49
mov byte [esp + 0x61], 0x6d
mov byte [esp + 0x62], 0x6d
mov byte [esp + 0x63], 0x47
mov byte [esp + 0x64], bl
mov byte [esp + 0x65], 0x74
mov byte [esp + 0x66], 0x4f
mov byte [esp + 0x67], 0x70
mov byte [esp + 0x68], bl
mov byte [esp + 0x69], 0x6e
mov byte [esp + 0x6a], 0x53
mov byte [esp + 0x6b], 0x74
mov byte [esp + 0x6c], 0x61
mov byte [esp + 0x6d], 0x74
mov byte [esp + 0x6e], 0x75
mov byte [esp + 0x6f], 0x73
mov byte [esp + 0x70], 0
call edi
lea ecx, [esp + 0x6c]
mov byte [esp + 0x6c], 0x49
push ecx
push esi
mov dword [esp + 0x20], eax
mov byte [esp + 0x75], 0x6d
mov byte [esp + 0x76], 0x6d
mov byte [esp + 0x77], 0x53
mov byte [esp + 0x78], bl
mov byte [esp + 0x79], 0x74
mov byte [esp + 0x7a], 0x4f
mov byte [esp + 0x7b], 0x70
mov byte [esp + 0x7c], bl
mov byte [esp + 0x7d], 0x6e
mov byte [esp + 0x7e], 0x53
mov byte [esp + 0x7f], 0x74
mov byte [esp + 0x80], 0x61
mov byte [esp + 0x81], 0x74
mov byte [esp + 0x82], 0x75
mov byte [esp + 0x83], 0x73
mov byte [esp + 0x84], 0
call edi
mov byte [esp + 0x34], 0x49
mov byte [esp + 0x35], 0x6d
mov dword [esp + 0x2c], eax
mov byte [esp + 0x36], 0x6d
mov byte [esp + 0x37], 0x52
mov byte [esp + 0x38], bl
mov byte [esp + 0x39], 0x6c
mov byte [esp + 0x3a], bl
mov byte [esp + 0x3b], 0x61
mov byte [esp + 0x3c], 0x73
mov byte [esp + 0x3d], bl
mov byte [esp + 0x3e], 0x43
mov byte [esp + 0x3f], 0x6f
mov byte [esp + 0x40], 0x6e
mov byte [esp + 0x41], 0x74
mov byte [esp + 0x42], bl
mov byte [esp + 0x43], 0x78
lea edx, [esp + 0x34]
mov byte [esp + 0x44], 0x74
push edx
push esi
mov byte [esp + 0x4d], 0
call edi
mov ebx, eax
mov eax, dword [0x1003ca28]
add eax, 0xffffffec
push eax
call ebp
mov edi, eax
push edi
call dword [esp + 0x1c]
test eax, eax
je 0x1000480a
push 0
push edi
call dword [esp + 0x34]
mov ecx, dword [0x1003ca28]
push edi
add ecx, 0xffffffec
push ecx
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
mov ebp, dword [esp + 0x550]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
jmp 0x100042b8
cmp esi, 0x847
jne 0x1000486b
cmp dword [esp + 0x54c], ebp
jne 0x100042b1
mov ebp, dword [esp + 0x550]
mov eax, 1
mov dword [0x1003ca5c], ebp
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
jmp 0x100042b8
cmp esi, 0x848
jne 0x1000489f
cmp dword [esp + 0x54c], ebp
jne 0x100042b1
mov ebp, dword [esp + 0x550]
mov eax, 1
mov dword [0x1003ca60], ebp
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
jmp 0x100042b8
cmp esi, 0x840
je 0x100048af
cmp esi, 0x841
jne 0x100048ce
cmp dword [esp + 0x54c], ebp
jne 0x100042b1
mov eax, 1
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
jmp 0x100042b1
cmp esi, 0x849
jne 0x1000490d
mov eax, dword [esp + 0x54c]
test eax, eax
je 0x100048e6
mov dword [0x1003ca6c], eax
mov ebp, dword [esp + 0x550]
test ebp, ebp
je 0x10001c1e
mov eax, 1
mov dword [0x1003ca68], ebp
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
jmp 0x100042b8
cmp esi, 0x84a
jne 0x100049ff
cmp dword [esp + 0x54c], ebp
jne 0x100042b1
mov ebp, dword [esp + 0x550]
test ebp, ebp
je 0x100049e3
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x121]
mov byte [esp + 0x120], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push ebx
push 3
mov byte [0x1003ca74], 0
stosb byte es:[edi], al
call fcn.100178b0
add esp, 4
lea edx, [esp + 0x124]
push eax
push edx
call fcn.10017310
add esp, 0xc
lea eax, [esp + 0x120]
push eax
push 0
push 0xf001f
call fcn.10006010
mov ebx, eax
test ebx, ebx
je 0x100049cc
push 0
push 0
push 0
push 6
push ebx
call fcn.10005e90
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push edx
mov eax, ecx
mov esi, edi
mov edi, 0x1003ca74
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.10005f40
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov dword [0x1003ca70], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
jmp 0x100042b8
mov eax, 1
mov dword [0x1003ca70], 0
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
jmp 0x100042b8
cmp esi, 0x84b
jne 0x10004a3a
cmp dword [esp + 0x54c], ebp
jne 0x100042b1
mov ebp, dword [esp + 0x550]
xor ecx, ecx
test ebp, ebp
setne cl
mov eax, 1
mov dword [0x100280ac], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
jmp 0x100042b8
cmp esi, 0x854
jne 0x10004a5a
cmp dword [esp + 0x54c], ebp
jne 0x100042b1
mov edx, dword [0x1003ca38]
jmp 0x100042a5
cmp esi, 0x84c
jne 0x100042b1
cmp dword [esp + 0x54c], ebp
jne 0x100042b1
mov esi, 1
mov dword [0x100280ac], 0
push esi
call fcn.10009f70
add esp, 4
mov dword [0x100280ac], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], esi
jmp 0x100042b1
mov eax, dword [0x1003ca28]
add eax, 0xffffffec
test eax, eax
je 0x100042b1
push 0x592629e2
call fcn.1000b0a0
add esp, 4
test eax, eax
jne 0x10004ac8
mov eax, dword [0x1003ca4c]
test eax, eax
je 0x10004afd
mov eax, dword [0x1003ca64]
test eax, eax
jne 0x10004afd
mov ecx, dword [esp + 0x550]
mov edx, dword [esp + 0x54c]
mov eax, dword [esp + 0x544]
push ecx
push edx
push esi
push eax
call dword [sym.imp.USER32.dll_DefWindowProcA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x530
ret 0x14
mov edx, dword [0x1003ca5c]
mov ebp, dword [esp + 0x550]
movsx eax, word [esp + 0x552]
test edx, edx
movsx ecx, bp
jne 0x100042b8
and eax, 0xffff
and ecx, 0xffff
shl eax, 0x10
or eax, ecx
mov dword [0x1003ca1c], eax
jmp 0x100042b8
mov ecx, dword [0x1003d2e4]
mov eax, dword [esp + 0x554]
test ecx, ecx
je 0x10004b74
test eax, eax
jne 0x10004b74
mov edx, dword [esp + 0x54c]
mov eax, dword [esp + 0x548]
push ebp
push edx
mov edx, dword [esp + 0x54c]
push eax
push edx
call ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x530
ret 0x14
mov ecx, dword [0x1003d2f0]
test ecx, ecx
je 0x10001a6c
test eax, eax
je 0x10001a6c
mov edx, dword [esp + 0x54c]
push ebp
push edx
mov edx, dword [esp + 0x550]
push edx
mov edx, dword [esp + 0x550]
push edx
push eax
call ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x530
ret 0x14