Function at 0x247db60
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Terminate process

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x58
cmp eax, 0x102
push ebx
push ebp
push esi
push edi
mov esi, ecx
ja 0x247ef61
je 0x247e620
cmp eax, 0xf
ja 0x247e003
je 0x247dd88
lea ecx, [eax - 1]
cmp ecx, 7
ja case.0x247db99.2
jmp dword [ecx*4 + 0x247f368]
mov edi, dword [esp + 0x6c]
lea eax, [esp + 0x18]
push eax
push edi
call dword [sym.imp.user32.dll_GetClientRect]
test eax, eax
jne 0x247dbdc
push 0x2000
push 0x24dacf0
call dword [sym.imp.kernel32.dll_GetLastError]
mov ecx, eax
call fcn.0247f800
push eax
push 0
call dword [sym.imp.user32.dll_MessageBoxA]
push 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov eax, dword [esp + 0x20]
cdq
idiv dword [esi + 0xf8]
push 0
push 0
push 7
push edi
mov ecx, esi
mov dword [esi + 0xd4], eax
mov eax, dword [esp + 0x34]
cdq
idiv dword [esi + 0xe4]
mov dword [esi + 0xd8], eax
call fcn.0247db60
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x58
ret 0x10
mov eax, dword [esi + 0xf8]
mov ecx, dword [esi + 0xe4]
mov edi, dword [esp + 0x6c]
cdq
and edx, 3
push ecx
add eax, edx
sar eax, 2
push eax
push 0
push edi
call dword [sym.imp.user32.dll_CreateCaret]
mov eax, dword [esi + 0xc8]
sub eax, dword [esi + 0xc0]
js 0x247dc81
mov ecx, dword [esi + 0xcc]
sub ecx, dword [esi + 0xc4]
js 0x247dc81
imul ecx, dword [esi + 0xe4]
imul eax, dword [esi + 0xf8]
push ecx
push eax
call dword [sym.imp.user32.dll_SetCaretPos]
push edi
call dword [sym.imp.user32.dll_ShowCaret]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x58
ret 0x10
push edi
call dword [sym.imp.user32.dll_HideCaret]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x58
ret 0x10
call dword [sym.imp.user32.dll_DestroyCaret]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x58
ret 0x10
mov edi, dword [esp + 0x6c]
push edi
call dword [sym.imp.user32.dll_GetDC]
mov ebx, eax
test ebx, ebx
jne 0x247dcde
push 0x2000
push 0x24dacf0
call dword [sym.imp.kernel32.dll_GetLastError]
mov ecx, eax
call fcn.0247f800
push eax
push ebx
call dword [sym.imp.user32.dll_MessageBoxA]
push 1
call dword [sym.imp.kernel32.dll_ExitProcess]
push 0x10
call dword [sym.imp.gdi32.dll_GetStockObject]
mov ebp, dword [sym.imp.gdi32.dll_SelectObject]
push eax
push ebx
call ebp
lea edx, [esi + 0xe4]
push edx
push ebx
mov dword [esp + 0x74], eax
call dword [sym.imp.gdi32.dll_GetTextMetricsA]
test eax, eax
jne 0x247dd2e
push 0x2000
push 0x24dacf0
call dword [sym.imp.kernel32.dll_GetLastError]
mov ecx, eax
call fcn.0247f800
push eax
push 0
call dword [sym.imp.user32.dll_MessageBoxA]
push 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov eax, dword [esp + 0x6c]
push eax
push ebx
call ebp
push ebx
push edi
call dword [sym.imp.user32.dll_ReleaseDC]
push 0
push 0
push 0x7ff
push edi
mov ecx, esi
call fcn.0247db60
push 0
push 0
push 0x800
push edi
mov ecx, esi
call fcn.0247db60
push 0
push 0
push 5
push edi
mov ecx, esi
call fcn.0247db60
push 0
push 0
push 7
push edi
mov ecx, esi
call fcn.0247db60
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x58
ret 0x10
mov edi, dword [esp + 0x6c]
lea ecx, [esp + 0x18]
push ecx
push edi
call dword [sym.imp.user32.dll_GetClientRect]
test eax, eax
jne 0x247ddc4
push 0x2000
push 0x24dacf0
call dword [sym.imp.kernel32.dll_GetLastError]
mov ecx, eax
call fcn.0247f800
push eax
push 0
call dword [sym.imp.user32.dll_MessageBoxA]
push 1
call dword [sym.imp.kernel32.dll_ExitProcess]
lea edx, [esp + 0x28]
push edx
push edi
call dword [sym.imp.user32.dll_BeginPaint]
test eax, eax
jne 0x247ddfc
push 0x2000
push 0x24dacf0
call dword [sym.imp.kernel32.dll_GetLastError]
mov ecx, eax
call fcn.0247f800
push eax
push 0
call dword [sym.imp.user32.dll_MessageBoxA]
push 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov eax, dword [esi + 0xc4]
mov ebp, dword [esp + 0x28]
push 0
lea ecx, [esp + 0x74]
push ecx
mov ecx, esi
mov dword [esp + 0x78], eax
call fcn.0247f460
mov edx, dword [esi + 0xd8]
xor ebx, ebx
inc edx
test edx, edx
mov dword [esp + 0x78], eax
mov dword [esp + 0x10], ebx
jle 0x247df98
mov eax, dword [esp + 0x78]
push eax
mov ecx, esi
call fcn.0247f410
sub eax, dword [esi + 0xc0]
mov dword [esp + 0x74], eax
jns 0x247de51
mov dword [esp + 0x74], 0
mov edi, dword [esi + 0xd4]
mov eax, dword [esp + 0x74]
inc edi
cmp eax, edi
jge 0x247deae
mov edx, dword [esi + 0xe4]
mov ecx, edx
imul ecx, ebx
lea eax, [ebx + 1]
mov ebx, dword [esi + 0xf8]
imul eax, edx
mov edx, ebx
imul edi, ebx
imul edx, dword [esp + 0x74]
push 0x42
mov dword [esp + 0x28], eax
sub eax, ecx
push eax
mov dword [esp + 0x28], edi
sub edi, edx
push edi
push ecx
push edx
push ebp
mov dword [esp + 0x34], ecx
mov dword [esp + 0x30], edx
call dword [sym.imp.gdi32.dll_PatBlt]
test eax, eax
je 0x247dfdb
mov ebx, dword [esp + 0x10]
mov eax, dword [esp + 0x74]
test eax, eax
jle 0x247df63
mov eax, dword [esi + 0xe4]
mov ecx, eax
lea edx, [ebx + 1]
imul ecx, ebx
imul edx, eax
mov eax, dword [esi + 0xd4]
inc eax
imul eax, dword [esi + 0xf8]
push 0x10
mov dword [esp + 0x20], ecx
mov dword [esp + 0x28], edx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], eax
call dword [sym.imp.gdi32.dll_GetStockObject]
push eax
push ebp
call dword [sym.imp.gdi32.dll_SelectObject]
mov ecx, dword [esi + 0x120]
push ecx
push ebp
mov dword [esp + 0x18], eax
call dword [sym.imp.gdi32.dll_SetBkColor]
mov edx, dword [esi + 0x124]
push edx
push ebp
call dword [sym.imp.gdi32.dll_SetTextColor]
mov edi, dword [esi + 0xc0]
mov ecx, dword [esp + 0x78]
mov eax, dword [esi + 0xbc]
add edi, ecx
cmp edi, eax
jb 0x247df3d
mov ecx, 0x24dad88
call fcn.0247f7e0
mov ecx, dword [esp + 0x74]
push 0
lea eax, [esp + 0x1c]
push eax
push ecx
add edi, dword [esi + 0xa8]
push edi
push ebp
call dword [sym.imp.user32.dll_DrawTextA]
mov edx, dword [esp + 0x10]
push edx
push ebp
call dword [sym.imp.gdi32.dll_SelectObject]
mov eax, dword [esp + 0x78]
push eax
lea ecx, [esp + 0x74]
push ecx
mov ecx, esi
mov dword [esp + 0x78], 1
call fcn.0247f460
mov edx, dword [esi + 0xd8]
inc ebx
inc edx
cmp ebx, edx
mov dword [esp + 0x78], eax
mov dword [esp + 0x10], ebx
jl 0x247de31
mov edi, dword [esp + 0x6c]
push edi
call dword [sym.imp.user32.dll_ShowCaret]
lea eax, [esp + 0x28]
push eax
push edi
call dword [sym.imp.user32.dll_EndPaint]
test eax, eax
jne case.0x247f0c0.8
push 0x2000
push 0x24dacf0
call dword [sym.imp.kernel32.dll_GetLastError]
mov ecx, eax
call fcn.0247f800
push eax
push 0
call dword [sym.imp.user32.dll_MessageBoxA]
push 1
call dword [sym.imp.kernel32.dll_ExitProcess]
push 0x2000
push 0x24dacf0
call dword [sym.imp.kernel32.dll_GetLastError]
mov ecx, eax
call fcn.0247f800
push eax
push 0
call dword [sym.imp.user32.dll_MessageBoxA]
push 1
call dword [sym.imp.kernel32.dll_ExitProcess]
cmp eax, 0x10
je 0x247e602
cmp eax, 0x14
je 0x247e5f3
cmp eax, 0x100
jne case.0x247db99.2
mov eax, dword [esi + 0xcc]
xor ebp, ebp
xor edi, edi
test eax, eax
mov dword [esp + 0x70], ebp
jl case.0x247f0c0.8
mov edx, dword [esi + 0xc8]
test edx, edx
jl case.0x247f0c0.8
mov ecx, dword [esp + 0x74]
cmp ecx, 0x26
mov ebx, dword [esp + 0x6c]
ja 0x247e191
cmp ecx, 0x26
je 0x247e17b
add ecx, 0xffffffdf
cmp ecx, 4
ja case.default.0x247e06a
jmp dword [ecx*4 + 0x247f388]
push 0
lea ecx, [esp + 0x78]
push ecx
mov ecx, esi
mov dword [esp + 0x7c], eax
call fcn.0247f460
cmp dword [esp + 0x74], 0xffffffff
jle 0x247e0ae
mov ecx, dword [esi + 0xc0]
xor eax, eax
cmp ecx, eax
mov dword [esi + 0xc8], eax
je 0x247e0a3
mov edi, 1
mov ebp, edi
mov dword [esi + 0xc0], eax
jmp case.default.0x247e06a
push eax
mov ecx, esi
call fcn.0247f410
mov edx, dword [esi + 0xc0]
mov ecx, eax
mov eax, dword [esi + 0xd4]
lea ebx, [eax + edx - 1]
cmp ecx, ebx
jg 0x247e0d0
cmp ecx, edx
jge 0x247e103
lea edx, [eax*4]
mov eax, 0x66666667
imul edx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ecx
sub eax, edx
dec eax
xor edx, edx
test eax, eax
setle dl
mov ebp, 1
mov edi, ebp
dec edx
and eax, edx
mov dword [esi + 0xc0], eax
mov ebx, dword [esp + 0x6c]
mov dword [esi + 0xc8], ecx
jmp case.default.0x247e06a
sub eax, dword [esi + 0xd8]
mov ecx, 0
sets cl
push 0
push 2
push 0x115
push ebx
dec ecx
and eax, ecx
mov ecx, esi
mov dword [esi + 0xcc], eax
call fcn.0247db60
jmp case.default.0x247e06a
mov edx, dword [esi + 0xd8]
push 0
push 3
push 0x115
add edx, eax
push ebx
mov ecx, esi
mov dword [esi + 0xcc], edx
call fcn.0247db60
jmp case.default.0x247e06a
xor ecx, ecx
lea eax, [edx - 1]
test eax, eax
setl cl
dec ecx
and eax, ecx
mov dword [esi + 0xc8], eax
jmp case.default.0x247e06a
dec eax
xor edx, edx
test eax, eax
setl dl
dec edx
and eax, edx
mov dword [esi + 0xcc], eax
jmp case.default.0x247e06a
cmp ecx, 0x2d
ja 0x247e1d4
je 0x247e1bc
sub ecx, 0x27
je 0x247e1b0
dec ecx
jne case.default.0x247e06a
inc eax
mov dword [esi + 0xcc], eax
jmp case.default.0x247e06a
inc edx
mov dword [esi + 0xc8], edx
jmp case.default.0x247e06a
mov ecx, dword [esi + 0xd0]
xor eax, eax
test ecx, ecx
sete al
mov dword [esi + 0xd0], eax
jmp case.default.0x247e06a
cmp ecx, 0x2e
je 0x247e210
cmp ecx, 0xffffffff
jne case.default.0x247e06a
push 0
push 0
push 0x7ff
push ebx
mov ecx, esi
call fcn.0247db60
push 0
push 0
push 0x800
push ebx
mov ecx, esi
call fcn.0247db60
mov ebp, 1
mov edi, ebp
jmp case.default.0x247e06a
mov ecx, dword [esi + 0x11c]
test ecx, ecx
je case.default.0x247e06a
push 0
lea ecx, [esp + 0x78]
push ecx
mov ecx, esi
mov dword [esp + 0x7c], eax
call fcn.0247f460
mov ebp, eax
cmp dword [esp + 0x74], 0xffffffff
mov ebx, ebp
mov dword [esp + 0x14], ebx
jg 0x247e492
push ebp
mov ecx, esi
call fcn.0247f410
mov ecx, dword [esi + 0xc8]
add ebp, eax
test ecx, ecx
jl 0x247e492
cmp ecx, eax
jbe 0x247e3be
mov edi, dword [esi + 0xb4]
sub ecx, eax
mov eax, dword [esi + 0xac]
mov ebx, ecx
add edi, ebx
cmp edi, eax
jbe 0x247e283
mov ecx, 0x24daf34
call fcn.0247f7e0
cmp edi, dword [esi + 0xb0]
jbe 0x247e2d9
mov ecx, dword [esi + 0xac]
mov edx, dword [esi + 0xb8]
imul edx, ecx
mov eax, 0x51eb851f
mul edx
shr edx, 5
add edi, edx
cmp edi, ecx
jbe 0x247e2ac
mov edi, ecx
mov eax, dword [esi + 0xa8]
push 0x40
push 0x1000
push edi
push eax
call dword [sym.imp.kernel32.dll_VirtualAlloc]
cmp dword [esi + 0xa8], eax
je 0x247e2d3
mov ecx, 0x24daf0c
call fcn.0247f7e0
mov dword [esi + 0xb0], edi
mov edx, dword [esi + 0xb4]
mov edi, dword [esi + 0xa8]
add edi, edx
mov ecx, ebx
mov edx, ecx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov edi, dword [esi + 0xb4]
mov ecx, dword [esi + 0xbc]
add edi, ebx
mov eax, edi
sub eax, ebx
cmp eax, ecx
mov dword [esi + 0xb4], edi
je 0x247e31f
mov ecx, 0x24dad4c
call fcn.0247f7e0
mov edi, dword [esi + 0xbc]
add edi, ebx
mov eax, edi
mov dword [esp + 0x78], eax
sub eax, ebx
sub eax, ebp
mov dword [esi + 0xbc], edi
je 0x247e38b
mov eax, edi
cmp ebp, eax
jb 0x247e349
mov ecx, 0x24dad88
call fcn.0247f7e0
mov eax, dword [esi + 0xa8]
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0xbc]
lea edi, [ebx + ebp]
cmp edi, eax
jb 0x247e36a
mov ecx, 0x24dad88
call fcn.0247f7e0
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x10]
mov edx, dword [esi + 0xa8]
sub eax, ebx
sub eax, ebp
push eax
add ecx, ebp
push ecx
add edi, edx
push edi
call fcn.024ad500
add esp, 0xc
cmp ebp, dword [esi + 0xbc]
jb 0x247e39d
mov ecx, 0x24dad88
call fcn.0247f7e0
mov edi, dword [esi + 0xa8]
mov ecx, ebx
mov ebx, dword [esp + 0x14]
mov edx, ecx
shr ecx, 2
add edi, ebp
mov eax, 0x20202020
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esi + 0xc8]
mov edi, dword [esi + 0xbc]
add ebx, eax
mov eax, edi
sub eax, ebx
dec eax
test eax, eax
jle 0x247e420
lea ebp, [ebx + 1]
mov eax, edi
cmp ebp, eax
jb 0x247e3e8
mov ecx, 0x24dad88
call fcn.0247f7e0
cmp ebx, dword [esi + 0xbc]
mov ecx, dword [esi + 0xa8]
mov dword [esp + 0x78], ecx
jb 0x247e404
mov ecx, 0x24dad88
call fcn.0247f7e0
mov edx, dword [esp + 0x78]
mov eax, dword [esi + 0xa8]
sub edi, ebx
dec edi
push edi
add edx, ebp
push edx
add eax, ebx
push eax
call fcn.024ad500
add esp, 0xc
mov ecx, dword [esi + 0xbc]
sub ecx, ebx
test ecx, ecx
jle 0x247e467
mov ecx, dword [esi + 0xbc]
mov eax, 1
cmp ecx, eax
jae 0x247e441
mov eax, ecx
test eax, eax
je 0x247e467
mov edx, dword [esi + 0xb4]
cmp edx, eax
ja 0x247e457
mov dword [esi + 0xb4], 0
jmp 0x247e45f
sub edx, eax
mov dword [esi + 0xb4], edx
sub ecx, eax
mov dword [esi + 0xbc], ecx
mov edi, dword [esp + 0x6c]
push 0
push 0
push 0x7ff
push edi
mov ecx, esi
call fcn.0247db60
push 0
push 0
push 0x800
push edi
mov ecx, esi
call fcn.0247db60
mov edi, 1
mov ebx, dword [esp + 0x6c]
mov ebp, dword [esp + 0x70]
mov eax, dword [esi + 0xcc]
cmp dword [esi + 0xc4], eax
jle 0x247e4bf
xor ecx, ecx
test eax, eax
setl cl
mov edi, 1
mov ebp, edi
dec ecx
and ecx, eax
mov dword [esi + 0xc4], ecx
mov ecx, dword [esi + 0xd8]
mov edx, dword [esi + 0xc4]
lea edx, [ecx + edx - 1]
cmp edx, eax
jge 0x247e4ed
sub eax, ecx
inc eax
xor ecx, ecx
test eax, eax
setl cl
mov edi, 1
mov ebp, edi
dec ecx
and eax, ecx
mov dword [esi + 0xc4], eax
mov ecx, dword [esi + 0xc8]
cmp dword [esi + 0xc0], ecx
jle 0x247e52d
mov edx, dword [esi + 0xd4]
mov eax, 0x66666667
imul edx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ecx
sub eax, edx
mov edx, 0
sets dl
mov edi, 1
mov ebp, edi
dec edx
and eax, edx
mov dword [esi + 0xc0], eax
mov eax, dword [esi + 0xd4]
mov edx, dword [esi + 0xc0]
lea edx, [eax + edx - 1]
cmp edx, ecx
jge 0x247e574
lea edx, [eax*4]
mov eax, 0x66666667
imul edx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ecx
sub eax, edx
mov ecx, 0
sets cl
mov edi, 1
mov ebp, edi
dec ecx
and eax, ecx
mov dword [esi + 0xc0], eax
push 0
push 0
push 7
push ebx
mov ecx, esi
call fcn.0247db60
test edi, edi
je 0x247e5bd
push 1
push 0
push ebx
call dword [sym.imp.user32.dll_InvalidateRect]
test eax, eax
jne 0x247e5bd
push 0x2000
push 0x24dacf0
call dword [sym.imp.kernel32.dll_GetLastError]
mov ecx, eax
call fcn.0247f800
push eax
push 0
call dword [sym.imp.user32.dll_MessageBoxA]
push 1
call dword [sym.imp.kernel32.dll_ExitProcess]
test ebp, ebp
je case.0x247f0c0.8
mov edx, dword [esi + 0xc0]
mov edi, dword [sym.imp.user32.dll_SetScrollPos]
push 1
push edx
push 0
push ebx
call edi
mov eax, dword [esi + 0xc4]
push 1
push eax
push 1
push ebx
call edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x58
ret 0x10
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x58
ret 0x10
mov ecx, dword [esp + 0x6c]
push ecx
call dword [sym.imp.user32.dll_DestroyWindow]
mov dword [esi + 4], 0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x58
ret 0x10
mov eax, dword [esi + 0x11c]
xor ebp, ebp
cmp eax, ebp
je case.0x247f0c0.8
mov eax, dword [esi + 0xcc]
cmp eax, ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x10], ebp
mov dword [esp + 0x78], ebp
jl case.0x247f0c0.8
mov edi, dword [esi + 0xc8]
cmp edi, ebp
jl case.0x247f0c0.8
mov edx, dword [esp + 0x74]
mov ebx, dword [esp + 0x6c]
lea ecx, [edx - 8]
cmp ecx, 0x13
ja case.0x247e680.11
xor edx, edx
mov dl, byte [ecx + 0x247f3ac]
jmp dword [edx*4 + 0x247f39c]
cmp edi, ebp
jbe 0x247ef02
push 1
push 0x25
push 0x100
push ebx
mov ecx, esi
call fcn.0247db60
push 1
push 0x2e
push 0x100
push ebx
mov ecx, esi
call fcn.0247db60
jmp 0x247ef02
mov dword [esp + 0x74], eax
push 0
lea eax, [esp + 0x78]
push eax
mov ecx, esi
call fcn.0247f460
mov ebp, eax
mov eax, dword [esp + 0x74]
cmp eax, 0xffffffff
mov ebx, ebp
jle 0x247e7f5
mov ecx, dword [esi + 0xb4]
lea ebp, [eax + 1]
mov eax, dword [esi + 0xac]
mov edi, ebp
add edi, ecx
cmp edi, eax
jbe 0x247e6fa
mov ecx, 0x24daf34
call fcn.0247f7e0
cmp edi, dword [esi + 0xb0]
jbe 0x247e750
mov ecx, dword [esi + 0xac]
mov edx, dword [esi + 0xb8]
imul edx, ecx
mov eax, 0x51eb851f
mul edx
shr edx, 5
add edi, edx
cmp edi, ecx
jbe 0x247e723
mov edi, ecx
mov eax, dword [esi + 0xa8]
push 0x40
push 0x1000
push edi
push eax
call dword [sym.imp.kernel32.dll_VirtualAlloc]
cmp dword [esi + 0xa8], eax
je 0x247e74a
mov ecx, 0x24daf0c
call fcn.0247f7e0
mov dword [esi + 0xb0], edi
mov edi, dword [esi + 0xb4]
add edi, dword [esi + 0xa8]
mov ecx, ebp
mov edx, ecx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov edi, dword [esi + 0xb4]
mov ecx, dword [esi + 0xbc]
add edi, ebp
mov eax, edi
sub eax, ebp
cmp eax, ecx
mov dword [esi + 0xb4], edi
je 0x247e794
mov ecx, 0x24dad4c
call fcn.0247f7e0
mov edx, dword [esi + 0xbc]
add edx, ebp
mov eax, edx
sub eax, ebp
mov edi, eax
mov eax, edx
cmp edi, eax
mov dword [esi + 0xbc], edx
jb 0x247e7b8
mov ecx, 0x24dad88
call fcn.0247f7e0
mov eax, dword [esp + 0x74]
mov edx, dword [esi + 0xa8]
lea ecx, [eax + 1]
add edi, edx
mov edx, ecx
shr ecx, 2
mov eax, 0xd0d0d0d
rep stosd dword es:[edi], eax
push 0
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x70]
mov ebp, dword [esi + 0xbc]
push 0
push 0x7ff
push eax
mov ecx, esi
call fcn.0247db60
push ebp
mov ecx, esi
call fcn.0247f410
mov ecx, dword [esi + 0xc8]
add ebp, eax
test ecx, ecx
jl 0x247ef02
cmp ecx, eax
jb 0x247e994
mov edi, dword [esi + 0xb4]
sub ecx, eax
mov eax, dword [esi + 0xac]
inc ecx
mov ebx, ecx
add edi, ebx
cmp edi, eax
jbe 0x247e836
mov ecx, 0x24daf34
call fcn.0247f7e0
cmp edi, dword [esi + 0xb0]
jbe 0x247e88c
mov ecx, dword [esi + 0xac]
mov edx, dword [esi + 0xb8]
imul edx, ecx
mov eax, 0x51eb851f
mul edx
shr edx, 5
add edi, edx
cmp edi, ecx
jbe 0x247e85f
mov edi, ecx
mov eax, dword [esi + 0xa8]
push 0x40
push 0x1000
push edi
push eax
call dword [sym.imp.kernel32.dll_VirtualAlloc]
cmp dword [esi + 0xa8], eax
je 0x247e886
mov ecx, 0x24daf0c
call fcn.0247f7e0
mov dword [esi + 0xb0], edi
mov edx, dword [esi + 0xb4]
mov edi, dword [esi + 0xa8]
add edi, edx
mov ecx, ebx
mov edx, ecx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov edi, dword [esi + 0xb4]
mov ecx, dword [esi + 0xbc]
add edi, ebx
mov eax, edi
sub eax, ebx
cmp eax, ecx
mov dword [esi + 0xb4], edi
je 0x247e8d2
mov ecx, 0x24dad4c
call fcn.0247f7e0
mov edi, dword [esi + 0xbc]
add edi, ebx
mov eax, edi
mov dword [esp + 0x78], eax
sub eax, ebx
sub eax, ebp
mov dword [esi + 0xbc], edi
je 0x247e93e
mov eax, edi
cmp ebp, eax
jb 0x247e8fc
mov ecx, 0x24dad88
call fcn.0247f7e0
mov eax, dword [esi + 0xa8]
mov dword [esp + 0x70], eax
mov eax, dword [esi + 0xbc]
lea edi, [ebx + ebp]
cmp edi, eax
jb 0x247e91d
mov ecx, 0x24dad88
call fcn.0247f7e0
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x70]
mov edx, dword [esi + 0xa8]
sub eax, ebx
sub eax, ebp
push eax
add ecx, ebp
push ecx
add edi, edx
push edi
call fcn.024ad500
add esp, 0xc
cmp ebp, dword [esi + 0xbc]
jb 0x247e950
mov ecx, 0x24dad88
call fcn.0247f7e0
mov edi, dword [esi + 0xa8]
mov ecx, ebx
mov edx, ecx
shr ecx, 2
add edi, ebp
mov eax, 0x20202020
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esi + 0xbc]
lea ebp, [ebx + ebp - 1]
cmp ebp, eax
jb 0x247e985
mov ecx, 0x24dad88
call fcn.0247f7e0
mov eax, dword [esi + 0xa8]
mov byte [eax + ebp], 0xd
jmp 0x247ea1e
lea ebp, [ecx + ebx]
lea edi, [esi + 0xa8]
push 1
mov ecx, edi
call fcn.02428f30
cmp eax, dword [edi + 0x14]
je 0x247e9b5
mov ecx, 0x24dad4c
call fcn.0247f7e0
mov ecx, dword [edi + 0x14]
inc ecx
mov eax, ecx
cmp ebp, eax
mov dword [edi + 0x14], ecx
mov ebx, dword [esi + 0xbc]
jb 0x247e9d2
mov ecx, 0x24dad88
call fcn.0247f7e0
mov ecx, dword [edi]
mov dword [esp + 0x78], ecx
mov ecx, dword [edi + 0x14]
lea eax, [ebp + 1]
cmp eax, ecx
jb 0x247e9ec
mov ecx, 0x24dad88
call fcn.0247f7e0
mov edx, dword [esp + 0x78]
mov ecx, dword [edi]
sub ebx, ebp
dec ebx
push ebx
add edx, ebp
lea eax, [ebp + 1]
push edx
add ecx, eax
push ecx
call fcn.024ad500
mov eax, dword [edi + 0x14]
add esp, 0xc
cmp ebp, eax
jb 0x247ea18
mov ecx, 0x24dad88
call fcn.0247f7e0
mov edx, dword [edi]
mov byte [edx + ebp], 0xd
mov edi, dword [esp + 0x6c]
push 0
push 0x24
push 0x100
push edi
mov ecx, esi
call fcn.0247db60
push 0
push 0x28
push 0x100
push edi
mov ecx, esi
call fcn.0247db60
push 0
push 0
push 0x7ff
push edi
mov ecx, esi
call fcn.0247db60
mov dword [esp + 0x78], 1
mov dword [esp + 0x10], 0
jmp 0x247ef02
mov dword [esp + 0x70], eax
push 0
lea eax, [esp + 0x74]
push eax
mov ecx, esi
call fcn.0247f460
mov ebp, eax
mov eax, dword [esp + 0x70]
cmp eax, 0xffffffff
mov ebx, ebp
jle 0x247eba9
mov ecx, dword [esi + 0xb4]
lea ebp, [eax + 1]
mov eax, dword [esi + 0xac]
mov edi, ebp
add edi, ecx
cmp edi, eax
jbe 0x247eaae
mov ecx, 0x24daf34
call fcn.0247f7e0
cmp edi, dword [esi + 0xb0]
jbe 0x247eb04
mov ecx, dword [esi + 0xac]
mov edx, dword [esi + 0xb8]
imul edx, ecx
mov eax, 0x51eb851f
mul edx
shr edx, 5
add edi, edx
cmp edi, ecx
jbe 0x247ead7
mov edi, ecx
mov eax, dword [esi + 0xa8]
push 0x40
push 0x1000
push edi
push eax
call dword [sym.imp.kernel32.dll_VirtualAlloc]
cmp dword [esi + 0xa8], eax
je 0x247eafe
mov ecx, 0x24daf0c
call fcn.0247f7e0
mov dword [esi + 0xb0], edi
mov edi, dword [esi + 0xb4]
add edi, dword [esi + 0xa8]
mov ecx, ebp
mov edx, ecx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov edi, dword [esi + 0xb4]
mov ecx, dword [esi + 0xbc]
add edi, ebp
mov eax, edi
sub eax, ebp
cmp eax, ecx
mov dword [esi + 0xb4], edi
je 0x247eb48
mov ecx, 0x24dad4c
call fcn.0247f7e0
mov edx, dword [esi + 0xbc]
add edx, ebp
mov eax, edx
sub eax, ebp
mov edi, eax
mov eax, edx
cmp edi, eax
mov dword [esi + 0xbc], edx
jb 0x247eb6c
mov ecx, 0x24dad88
call fcn.0247f7e0
mov eax, dword [esp + 0x70]
mov edx, dword [esi + 0xa8]
lea ecx, [eax + 1]
add edi, edx
mov edx, ecx
shr ecx, 2
mov eax, 0xd0d0d0d
rep stosd dword es:[edi], eax
push 0
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x70]
mov ebp, dword [esi + 0xbc]
push 0
push 0x7ff
push eax
mov ecx, esi
call fcn.0247db60
push ebp
mov ecx, esi
call fcn.0247f410
mov ecx, dword [esi + 0xc8]
add ebp, eax
test ecx, ecx
jl 0x247ef02
cmp ecx, eax
jb 0x247ed49
mov edi, dword [esi + 0xb4]
sub ecx, eax
mov eax, dword [esi + 0xac]
inc ecx
mov ebx, ecx
add edi, ebx
cmp edi, eax
jbe 0x247ebea
mov ecx, 0x24daf34
call fcn.0247f7e0
cmp edi, dword [esi + 0xb0]
jbe 0x247ec40
mov ecx, dword [esi + 0xac]
mov edx, dword [esi + 0xb8]
imul edx, ecx
mov eax, 0x51eb851f
mul edx
shr edx, 5
add edi, edx
cmp edi, ecx
jbe 0x247ec13
mov edi, ecx
mov eax, dword [esi + 0xa8]
push 0x40
push 0x1000
push edi
push eax
call dword [sym.imp.kernel32.dll_VirtualAlloc]
cmp dword [esi + 0xa8], eax
je 0x247ec3a
mov ecx, 0x24daf0c
call fcn.0247f7e0
mov dword [esi + 0xb0], edi
mov edi, dword [esi + 0xb4]
add edi, dword [esi + 0xa8]
mov ecx, ebx
mov edx, ecx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov edi, dword [esi + 0xb4]
mov ecx, dword [esi + 0xbc]
add edi, ebx
mov eax, edi
sub eax, ebx
cmp eax, ecx
mov dword [esi + 0xb4], edi
je 0x247ec84
mov ecx, 0x24dad4c
call fcn.0247f7e0
mov edi, dword [esi + 0xbc]
add edi, ebx
mov eax, edi
mov dword [esp + 0x78], eax
sub eax, ebx
sub eax, ebp
mov dword [esi + 0xbc], edi
je 0x247ecf0
mov eax, edi
cmp ebp, eax
jb 0x247ecae
mov ecx, 0x24dad88
call fcn.0247f7e0
mov eax, dword [esi + 0xa8]
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0xbc]
lea edi, [ebx + ebp]
cmp edi, eax
jb 0x247eccf
mov ecx, 0x24dad88
call fcn.0247f7e0
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x14]
mov edx, dword [esi + 0xa8]
sub eax, ebx
sub eax, ebp
push eax
add ecx, ebp
push ecx
add edi, edx
push edi
call fcn.024ad500
add esp, 0xc
cmp ebp, dword [esi + 0xbc]
jb 0x247ed02
mov ecx, 0x24dad88
call fcn.0247f7e0
mov edi, dword [esi + 0xa8]
mov ecx, ebx
mov edx, ecx
shr ecx, 2
add edi, ebp
mov eax, 0x20202020
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esi + 0xbc]
lea edi, [ebx + ebp - 1]
cmp edi, eax
jb 0x247ed37
mov ecx, 0x24dad88
call fcn.0247f7e0
mov eax, dword [esi + 0xa8]
mov cl, byte [esp + 0x74]
mov byte [edi + eax], cl
jmp 0x247ee9e
mov eax, dword [esi + 0xd0]
test eax, eax
lea ebp, [ecx + ebx]
je 0x247ee7f
mov edi, dword [esi + 0xb4]
mov eax, dword [esi + 0xac]
inc edi
cmp edi, eax
jbe 0x247ed75
mov ecx, 0x24daf34
call fcn.0247f7e0
cmp edi, dword [esi + 0xb0]
jbe 0x247edcb
mov ecx, dword [esi + 0xac]
mov edx, dword [esi + 0xb8]
imul edx, ecx
mov eax, 0x51eb851f
mul edx
shr edx, 5
add edi, edx
cmp edi, ecx
jbe 0x247ed9e
mov edi, ecx
mov eax, dword [esi + 0xa8]
push 0x40
push 0x1000
push edi
push eax
call dword [sym.imp.kernel32.dll_VirtualAlloc]
cmp dword [esi + 0xa8], eax
je 0x247edc5
mov ecx, 0x24daf0c
call fcn.0247f7e0
mov dword [esi + 0xb0], edi
mov edi, dword [esi + 0xb4]
mov ecx, dword [esi + 0xa8]
add ecx, edi
mov byte [ecx], 0
mov edx, dword [esi + 0xb4]
mov ecx, dword [esi + 0xbc]
inc edx
mov eax, edx
dec eax
cmp eax, ecx
mov dword [esi + 0xb4], edx
je 0x247ee00
mov ecx, 0x24dad4c
call fcn.0247f7e0
mov ecx, dword [esi + 0xbc]
inc ecx
mov eax, ecx
cmp ebp, eax
mov dword [esi + 0xbc], ecx
mov ebx, ecx
jb 0x247ee1f
mov ecx, 0x24dad88
call fcn.0247f7e0
mov eax, dword [esi + 0xbc]
mov edx, dword [esi + 0xa8]
lea edi, [ebp + 1]
cmp edi, eax
mov dword [esp + 0x78], edx
jb 0x247ee40
mov ecx, 0x24dad88
call fcn.0247f7e0
mov eax, dword [esp + 0x78]
sub ebx, ebp
dec ebx
push ebx
mov ebx, dword [esi + 0xa8]
add eax, ebp
push eax
add edi, ebx
push edi
call fcn.024ad500
mov eax, dword [esi + 0xbc]
add esp, 0xc
cmp ebp, eax
jb 0x247ee70
mov ecx, 0x24dad88
call fcn.0247f7e0
mov ecx, dword [esi + 0xa8]
mov dl, byte [esp + 0x74]
mov byte [ecx + ebp], dl
jmp 0x247ee9e
cmp ebp, dword [esi + 0xbc]
jb 0x247ee91
mov ecx, 0x24dad88
call fcn.0247f7e0
mov eax, dword [esi + 0xa8]
mov cl, byte [esp + 0x74]
mov byte [eax + ebp], cl
mov edx, dword [esp + 0x6c]
push 0
push 0x27
push 0x100
push edx
mov ecx, esi
call fcn.0247db60
mov edx, dword [esi + 0xc4]
mov ecx, dword [esi + 0xe4]
lea eax, [esp + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0xcc]
sub eax, edx
mov edx, eax
imul edx, ecx
inc eax
imul eax, ecx
mov dword [esp + 0x24], eax
mov eax, dword [esi + 0xd4]
inc eax
imul eax, dword [esi + 0xf8]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x78], 1
mov edi, dword [esp + 0x6c]
push 0
push 0
push 0x800
push edi
mov ecx, esi
call fcn.0247db60
mov eax, dword [esp + 0x78]
test eax, eax
je case.0x247f0c0.8
mov ecx, dword [esp + 0x10]
push 1
push ecx
push edi
call dword [sym.imp.user32.dll_InvalidateRect]
test eax, eax
jne case.0x247f0c0.8
push 0x2000
push 0x24dacf0
call dword [sym.imp.kernel32.dll_GetLastError]
mov ecx, eax
call fcn.0247f800
push eax
push 0
call dword [sym.imp.user32.dll_MessageBoxA]
push 1
call dword [sym.imp.kernel32.dll_ExitProcess]
cmp eax, 0x204
ja 0x247f1be
je 0x247f30e
mov ecx, eax
sub ecx, 0x114
je 0x247f09d
dec ecx
je 0x247ef94
sub ecx, 0xec
je 0x247f30e
jmp case.0x247db99.2
mov ecx, dword [esp + 0x74]
mov ebx, dword [esp + 0x6c]
mov eax, ecx
and ecx, 0xffff
xor ebp, ebp
xor edx, edx
shr eax, 0x10
cmp ecx, 8
mov edi, 1
ja case.default.0x247efb9
jmp dword [ecx*4 + 0x247f3c0]
mov edx, dword [esi + 0xe0]
mov dword [esi + 0xc4], edx
jmp 0x247f061
mov eax, dword [esi + 0xc4]
cmp eax, dword [esi + 0xe0]
jge 0x247effb
inc eax
mov dword [esi + 0xc4], eax
jmp 0x247f061
mov eax, dword [esi + 0xc4]
cmp eax, ebp
jle 0x247effb
dec eax
mov dword [esi + 0xc4], eax
jmp 0x247f061
xor edi, edi
jmp 0x247f061
mov eax, dword [esi + 0xc4]
mov ecx, dword [esi + 0xe0]
cmp eax, ecx
jl 0x247f011
xor edi, edi
mov edx, dword [esi + 0xd8]
add eax, edx
cmp eax, ecx
mov dword [esi + 0xc4], eax
jle 0x247f061
mov dword [esi + 0xc4], ecx
jmp 0x247f061
mov eax, dword [esi + 0xc4]
cmp eax, ebp
jg 0x247f037
xor edi, edi
sub eax, dword [esi + 0xd8]
mov dword [esi + 0xc4], eax
jns 0x247f061
mov dword [esi + 0xc4], ebp
jmp 0x247f061
mov edx, 1
and eax, 0xffff
cmp edx, ebp
mov dword [esi + 0xc4], eax
je case.default.0x247efb9
mov eax, dword [esi + 0xc4]
push 1
push eax
push 1
push ebx
call dword [sym.imp.user32.dll_SetScrollPos]
cmp edi, ebp
je case.0x247f0c0.8
push ebp
push ebp
push 7
push ebx
mov ecx, esi
call fcn.0247db60
push 1
push ebp
push ebx
call dword [sym.imp.user32.dll_InvalidateRect]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x58
ret 0x10
mov ecx, dword [esp + 0x74]
mov ebp, dword [esp + 0x6c]
mov eax, ecx
and ecx, 0xffff
xor edx, edx
shr eax, 0x10
cmp ecx, 8
mov ebx, 1
ja case.default.0x247f0c0
jmp dword [ecx*4 + 0x247f3e4]
mov ecx, dword [esi + 0xdc]
mov dword [esi + 0xc0], ecx
jmp 0x247f17f
mov eax, dword [esi + 0xc0]
test eax, eax
jle 0x247f105
dec eax
mov dword [esi + 0xc0], eax
jmp 0x247f17f
mov eax, dword [esi + 0xc0]
cmp eax, dword [esi + 0xdc]
jge 0x247f105
inc eax
mov dword [esi + 0xc0], eax
jmp 0x247f17f
xor ebx, ebx
jmp 0x247f17f
mov edi, dword [esi + 0xc0]
mov ecx, dword [esi + 0xdc]
cmp edi, ecx
jl 0x247f11b
xor ebx, ebx
mov eax, dword [esi + 0xd4]
cdq
sub eax, edx
sar eax, 1
add eax, edi
cmp eax, ecx
mov dword [esi + 0xc0], eax
jle 0x247f17f
mov dword [esi + 0xc0], ecx
jmp 0x247f17f
mov ecx, dword [esi + 0xc0]
test ecx, ecx
jg 0x247f146
xor ebx, ebx
mov eax, dword [esi + 0xd4]
cdq
sub eax, edx
mov edx, eax
sar edx, 1
mov eax, ecx
sub eax, edx
mov dword [esi + 0xc0], eax
jns 0x247f17f
mov dword [esi + 0xc0], 0
jmp 0x247f17f
mov edx, 1
and eax, 0xffff
test edx, edx
mov dword [esi + 0xc0], eax
je case.default.0x247f0c0
mov eax, dword [esi + 0xc0]
push 1
push eax
push 0
push ebp
call dword [sym.imp.user32.dll_SetScrollPos]
test ebx, ebx
je case.0x247f0c0.8
push 0
push 0
push 7
push ebp
mov ecx, esi
call fcn.0247db60
push 1
push 0
push ebp
call dword [sym.imp.user32.dll_InvalidateRect]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x58
ret 0x10
mov ecx, eax
sub ecx, 0x207
je 0x247f30e
sub ecx, 0x5f8
je 0x247f28b
dec ecx
je 0x247f1fc
mov ecx, dword [esp + 0x78]
mov edx, dword [esp + 0x74]
push ecx
push edx
push eax
mov eax, dword [esp + 0x78]
push eax
mov ecx, esi
call fcn.024787e0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret 0x10
xor ebp, ebp
xor edi, edi
mov eax, dword [esi + 0xbc]
xor ebx, ebx
cmp edi, eax
jae 0x247f243
cmp edi, eax
jb 0x247f21a
mov ecx, 0x24dad88
call fcn.0247f7e0
mov ecx, dword [esi + 0xa8]
cmp byte [edi + ecx], 0xd
je 0x247f232
mov eax, dword [esi + 0xbc]
inc edi
inc ebx
cmp edi, eax
jb 0x247f21a
cmp ebx, ebp
jbe 0x247f238
mov ebp, ebx
cmp edi, dword [esi + 0xbc]
jae 0x247f243
inc edi
jmp 0x247f200
mov edx, dword [esp + 0x6c]
push 1
push ebp
push 0
push 0
push edx
mov dword [esi + 0xdc], ebp
call dword [sym.imp.user32.dll_SetScrollRange]
test eax, eax
jne case.0x247f0c0.8
push 0x2000
push 0x24dacf0
call dword [sym.imp.kernel32.dll_GetLastError]
mov ecx, eax
call fcn.0247f800
push eax
push 0
call dword [sym.imp.user32.dll_MessageBoxA]
push 1
call dword [sym.imp.kernel32.dll_ExitProcess]
xor ebx, ebx
xor edi, edi
mov eax, dword [esi + 0xbc]
cmp edi, eax
jae 0x247f2ca
cmp edi, eax
jb 0x247f2a7
mov ecx, 0x24dad88
call fcn.0247f7e0
mov eax, dword [esi + 0xa8]
cmp byte [eax + edi], 0xd
je 0x247f2be
mov eax, dword [esi + 0xbc]
inc edi
cmp edi, eax
jb 0x247f2a7
cmp edi, dword [esi + 0xbc]
jae 0x247f2ca
inc edi
inc ebx
jmp 0x247f28f
mov ecx, dword [esp + 0x6c]
push 1
push ebx
push 0
push 1
push ecx
mov dword [esi + 0xe0], ebx
call dword [sym.imp.user32.dll_SetScrollRange]
test eax, eax
jne case.0x247f0c0.8
push 0x2000
push 0x24dacf0
call dword [sym.imp.kernel32.dll_GetLastError]
mov ecx, eax
call fcn.0247f800
push eax
push 0
call dword [sym.imp.user32.dll_MessageBoxA]
push 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov ecx, dword [esp + 0x78]
mov eax, ecx
and eax, 0xffff
cdq
idiv dword [esi + 0xf8]
mov edx, dword [esi + 0xc0]
mov ebx, dword [esi + 0xc4]
push 0
push 0
push 7
add eax, edx
mov dword [esi + 0xc8], eax
mov eax, ecx
shr eax, 0x10
cdq
idiv dword [esi + 0xe4]
mov edx, dword [esp + 0x78]
push edx
mov ecx, esi
add eax, ebx
mov dword [esi + 0xcc], eax
call fcn.0247db60
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x58
ret 0x10