Function at 0x10005ae2
Capabilities:
Write file on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10018985
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x68
mov eax, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push esi
push edi
mov edi, dword [ebx + 0xc]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x2c], eax
cmp edi, 2
je 0x10005cb6
cmp edi, 3
je 0x10005cb6
cmp edi, 6
je 0x10005bff
cmp edi, 7
je 0x10005bff
lea eax, [edi - 4]
cmp eax, 0x13
ja case.0x10005acf.6
jmp dword [eax*4 + 0x1000667c]
mov dword [ebp - 0x14], 0xfde9
jmp 0x10005b67
mov dword [ebp - 0x14], 0xfde8
jmp 0x10005b67
mov dword [ebp - 0x14], 0x3a4
jmp 0x10005b67
mov dword [ebp - 0x14], 0x4e4
jmp 0x10005b67
mov dword [ebp - 0x14], 0x4e2
jmp 0x10005b67
mov dword [ebp - 0x14], 0x3a8
jmp 0x10005b67
mov dword [ebp - 0x14], 0x3b6
jmp 0x10005b67
mov dword [ebp - 0x14], 0x3b5
jmp 0x10005b67
mov dword [ebp - 0x14], 0x4e3
jmp 0x10005b67
mov dword [ebp - 0x14], 0x4e5
jmp 0x10005b67
mov dword [ebp - 0x14], 0x4e6
jmp 0x10005b67
mov dword [ebp - 0x14], 0x4e7
jmp 0x10005b67
mov dword [ebp - 0x14], 0x4e8
jmp 0x10005b67
mov dword [ebp - 0x14], 0x4e9
jmp 0x10005b67
mov dword [ebp - 0x14], 0x4ea
jmp 0x10005b67
mov dword [ebp - 0x14], 0x36a
cmp dword [ecx + 0xc], 1
jge 0x10005b79
mov dword [ebp - 0x18], 0
jmp 0x10005cd1
xor edx, edx
mov dword [ebp - 0x1c], 0
xor esi, esi
mov dword [ebp - 0x28], edx
xor edi, edi
jmp 0x10005b93
mov ecx, dword [ebp - 0x20]
mov eax, dword [ecx + 0x10]
mov ecx, dword [eax + esi + 4]
test ecx, ecx
je 0x10005bbf
push 0
push 0
push 0
push 0
push ecx
push dword [eax + edi]
push 0
push dword [ebp - 0x14]
call dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x28]
add ecx, eax
mov dword [ebp - 0x1c], ecx
jmp 0x10005bc2
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
inc edx
add esi, 8
mov dword [ebp - 0x28], edx
add edi, 8
mov eax, dword [eax + 0xc]
cmp edx, eax
jl 0x10005b90
mov esi, dword [ebp - 0x20]
dec eax
mov edi, dword [ebx + 0xc]
mov edx, dword [esi + 0xc]
lea eax, [ecx + eax*2]
dec edx
add ecx, edx
cmp dword [ebx + 0x10], 2
cmove ecx, eax
mov dword [ebp - 0x18], ecx
jmp 0x10005cd1
mov eax, 6
jmp 0x10006667
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x18], edx
cmp edx, 1
jge 0x10005c11
xor ecx, ecx
jmp 0x10005ca4
mov ecx, dword [ecx + 0x10]
xor edi, edi
xor eax, eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x28], 0xfc00
mov dword [ebp - 0x34], 0xd800
mov dword [ebp - 0x30], 0xdc00
mov esi, dword [ecx + eax*8 + 4]
test esi, esi
je 0x10005c87
mov eax, dword [ecx + eax*8]
mov edx, 1
mov dword [ebp - 0x24], eax
xor ecx, ecx
cmp edx, esi
jae 0x10005c74
mov ax, word [eax + ecx*2]
and ax, word [ebp - 0x28]
cmp ax, word [ebp - 0x34]
jne 0x10005c74
mov eax, dword [ebp - 0x24]
mov ax, word [eax + ecx*2 + 2]
and ax, word [ebp - 0x28]
cmp ax, word [ebp - 0x30]
jne 0x10005c74
add ecx, 2
add edx, 2
jmp 0x10005c76
inc ecx
inc edx
mov eax, dword [ebp - 0x24]
inc edi
cmp ecx, esi
jb 0x10005c48
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x1c], eax
cmp eax, edx
jl 0x10005c33
xor ecx, ecx
lea eax, [edx - 1]
cmp dword [ebx + 0x10], 2
sete cl
inc ecx
imul ecx, eax
add ecx, edi
mov edi, dword [ebx + 0xc]
lea esi, [ecx*4]
mov dword [ebp - 0x18], esi
mov esi, dword [ebp - 0x34]
mov dword [ebp - 0x14], esi
jmp 0x10005cd1
cmp dword [ebx + 0x10], 2
sete al
movzx eax, al
push eax
call fcn.100049a0
add eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x44], 0x1003bd5c
push dword [ebp - 0x18]
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], 0
call fcn.10004760
mov edx, eax
mov dword [ebp - 0x1c], edx
test edx, edx
jne 0x10005d09
lea esi, [eax + 1]
jmp 0x10006647
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov esi, edx
mov dword [ebp - 0x28], ecx
cmp dword [eax + 0xc], ecx
jle 0x10005ed9
nop dword [eax]
mov eax, dword [eax + 0x10]
mov ecx, dword [eax + ecx*8 + 4]
mov dword [ebp - 0x34], ecx
test ecx, ecx
je 0x10005e1b
mov edi, dword [ebp - 0x28]
mov edi, dword [eax + edi*8]
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x24], edi
cmp eax, 2
je 0x10005de3
cmp eax, 3
je 0x10005de3
cmp eax, 6
je 0x10005d76
cmp eax, 7
je 0x10005d76
push 0
push 0
sub edx, esi
add edx, dword [ebp - 0x18]
push edx
push esi
push ecx
push edi
push 0
push dword [ebp - 0x14]
call dword [ebp - 0x2c]
add esi, eax
jmp 0x10005e1b
xor eax, eax
mov dword [ebp - 0x30], eax
nop dword [eax + eax]
lea ecx, [eax + 1]
lea edx, [eax + eax]
mov dword [ebp - 0x38], ecx
cmp ecx, dword [ebp - 0x34]
jae 0x10005dcd
movzx ecx, word [edx + edi]
mov eax, ecx
and eax, 0xfc00
cmp eax, 0xd800
jne 0x10005dcd
movzx eax, word [edx + edi + 2]
mov edi, eax
and eax, 0xfc00
cmp eax, 0xdc00
jne 0x10005dca
mov eax, dword [ebp - 0x30]
and edi, 0x3ff
shr ecx, 6
and ecx, 0xf
inc ecx
or ecx, edi
mov edi, dword [ebp - 0x24]
jmp 0x10005dd7
mov edi, dword [ebp - 0x24]
mov eax, dword [ebp - 0x38]
movzx ecx, word [edx + edi]
mov dword [ebp - 0x30], eax
mov dword [esi], ecx
add esi, 4
cmp eax, dword [ebp - 0x34]
jb 0x10005d80
jmp 0x10005e1b
lea edi, [ecx + ecx]
cmp esi, 0x10000
jb 0x10005e19
mov eax, esi
not eax
cmp edi, eax
ja 0x10005e19
mov ecx, dword [ebp - 0x24]
cmp ecx, 0x10000
jb 0x10005e19
or eax, 0xffffffff
sub eax, ecx
cmp edi, eax
ja 0x10005e19
test edi, edi
je 0x10005e19
push edi
push ecx
push esi
call fcn.1000ddd0
add esp, 0xc
add esi, edi
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x28]
mov edi, dword [ebx + 0xc]
mov eax, dword [eax + 0xc]
dec eax
cmp ecx, eax
jge 0x10005ec6
cmp edi, 2
je 0x10005e97
cmp edi, 3
je 0x10005e97
cmp edi, 6
je 0x10005e66
cmp edi, 7
je 0x10005e66
mov eax, dword [ebx + 0x10]
sub eax, 1
je 0x10005e60
sub eax, 1
je 0x10005e5c
sub eax, 1
jne 0x10005ec6
mov byte [esi], 0xd
inc esi
jmp 0x10005ec6
mov byte [esi], 0xd
inc esi
mov byte [esi], 0xa
inc esi
jmp 0x10005ec6
mov eax, dword [ebx + 0x10]
sub eax, 1
je 0x10005e8c
sub eax, 1
je 0x10005e83
sub eax, 1
jne 0x10005ec6
mov dword [esi], 0xd
add esi, 4
jmp 0x10005ec6
mov dword [esi], 0xd
add esi, 4
mov dword [esi], 0xa
add esi, 4
jmp 0x10005ec6
mov eax, dword [ebx + 0x10]
sub eax, 1
je 0x10005ebb
sub eax, 1
je 0x10005eb0
sub eax, 1
jne 0x10005ec6
mov eax, 0xd
jmp 0x10005ec0
mov eax, 0xd
mov word [esi], ax
add esi, 2
mov eax, 0xa
mov word [esi], ax
add esi, 2
mov eax, dword [ebp - 0x20]
inc ecx
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x28], ecx
cmp ecx, dword [eax + 0xc]
jl 0x10005d20
xor eax, eax
mov dword [ebp - 0x78], vtable.PictureFan::FileStream.0
xorps xmm0, xmm0
mov dword [ebp - 0x74], 0xffffffff
movups xmmword [ebp - 0x70], xmm0
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 7
mov word [ebp - 0x70], ax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x58], 0x1003bce0
mov dword [ebp - 0x4c], 0x8000
mov dword [ebp - 0x48], eax
push 0x22
push dword [ebx + 8]
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 1
call fcn.1000b3e0
test al, al
jne 0x10005f38
mov esi, 2
jmp 0x1000663f
cmp dword [ebx + 0x14], 0
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
je case.0x10005f54.5
lea eax, [edi - 2]
cmp eax, 5
ja case.0x10005f54.5
jmp dword [eax*4 + 0x100066cc]
cmp dword [ebp - 0x54], 0
je 0x1000605c
mov esi, dword [ebp - 0x50]
mov edx, 2
mov ecx, dword [ebp - 0x48]
mov edi, 0x1003bde4
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x20], edx
nop dword [eax + eax]
cmp ecx, esi
jne 0x10005fb0
mov eax, dword [ebp - 0x78]
lea ecx, [ebp - 0x78]
mov eax, dword [eax + 0x40]
cmp eax, fcn.1000bb60
jne 0x10005f9b
call fcn.1000bb60
jmp 0x10005f9d
call eax
test al, al
je 0x1000604e
mov ecx, dword [ebp - 0x48]
mov edx, dword [ebp - 0x20]
jmp 0x1000603b
test ecx, ecx
jne 0x10005fe5
cmp edx, esi
jb 0x10005fe5
push ecx
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], ecx
push eax
push esi
push edi
push dword [ebp - 0x74]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1000604e
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x34]
sub edx, eax
mov dword [ebp - 0x20], edx
cmp eax, esi
jb 0x1000604e
mov ecx, dword [ebp - 0x48]
add edi, eax
jmp 0x1000603b
mov eax, esi
mov esi, edx
sub eax, ecx
cmp eax, edx
cmovb esi, eax
mov eax, dword [ebp - 0x54]
add eax, ecx
mov dword [ebp - 0x38], eax
cmp eax, 0x10000
jb 0x1000602c
not eax
cmp esi, eax
ja 0x1000602c
cmp edi, 0x10000
jb 0x1000602c
mov eax, edi
not eax
cmp esi, eax
ja 0x1000602c
test esi, esi
je 0x1000602c
push esi
push edi
push dword [ebp - 0x38]
call fcn.1000ddd0
mov ecx, dword [ebp - 0x48]
add esp, 0xc
mov edx, dword [ebp - 0x20]
sub edx, esi
add edi, esi
add ecx, esi
mov dword [ebp - 0x20], edx
mov esi, dword [ebp - 0x30]
mov dword [ebp - 0x48], ecx
test edx, edx
jne 0x10005f80
mov edi, dword [ebx + 0xc]
lea eax, [edi - 2]
jmp switch.0x100064e6
mov edi, dword [ebx + 0xc]
mov ecx, dword [ebp - 0x48]
lea eax, [edi - 2]
jmp switch.0x100064e6
push 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
push eax
push 2
push 0x1003bde4
push dword [ebp - 0x74]
call esi
mov ecx, dword [ebp - 0x48]
lea eax, [edi - 2]
jmp switch.0x100064e6
cmp dword [ebp - 0x54], 0
je 0x10006172
mov esi, dword [ebp - 0x50]
mov edx, 2
mov ecx, dword [ebp - 0x48]
mov edi, 0x1003be2c
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x20], edx
cmp ecx, esi
jne 0x100060cc
mov eax, dword [ebp - 0x78]
lea ecx, [ebp - 0x78]
mov eax, dword [eax + 0x40]
cmp eax, fcn.1000bb60
jne 0x100060bb
call fcn.1000bb60
jmp 0x100060bd
call eax
test al, al
je 0x1000604e
mov ecx, dword [ebp - 0x48]
mov edx, dword [ebp - 0x20]
jmp 0x1000615f
test ecx, ecx
jne 0x10006109
cmp edx, esi
jb 0x10006109
push ecx
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], ecx
push eax
push esi
push edi
push dword [ebp - 0x74]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1000604e
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x34]
sub edx, eax
mov dword [ebp - 0x20], edx
cmp eax, esi
jb 0x1000604e
mov ecx, dword [ebp - 0x48]
add edi, eax
jmp 0x1000615f
mov eax, esi
mov esi, edx
sub eax, ecx
cmp eax, edx
cmovb esi, eax
mov eax, dword [ebp - 0x54]
add eax, ecx
mov dword [ebp - 0x38], eax
cmp eax, 0x10000
jb 0x10006150
not eax
cmp esi, eax
ja 0x10006150
cmp edi, 0x10000
jb 0x10006150
mov eax, edi
not eax
cmp esi, eax
ja 0x10006150
test esi, esi
je 0x10006150
push esi
push edi
push dword [ebp - 0x38]
call fcn.1000ddd0
mov ecx, dword [ebp - 0x48]
add esp, 0xc
mov edx, dword [ebp - 0x20]
sub edx, esi
add edi, esi
add ecx, esi
mov dword [ebp - 0x20], edx
mov esi, dword [ebp - 0x30]
mov dword [ebp - 0x48], ecx
test edx, edx
jne 0x100060a0
mov edi, dword [ebx + 0xc]
lea eax, [edi - 2]
jmp switch.0x100064e6
push 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
push eax
push 2
push 0x1003be2c
push dword [ebp - 0x74]
call esi
lea eax, [edi - 2]
jmp 0x100064e3
cmp dword [ebp - 0x54], 0
je 0x10006289
mov esi, dword [ebp - 0x50]
mov edx, 3
mov ecx, dword [ebp - 0x48]
mov edi, 0x1003be28
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x20], edx
cmp ecx, esi
jne 0x100061e3
mov eax, dword [ebp - 0x78]
lea ecx, [ebp - 0x78]
mov eax, dword [eax + 0x40]
cmp eax, fcn.1000bb60
jne 0x100061ce
call fcn.1000bb60
jmp 0x100061d0
call eax
test al, al
je 0x1000604e
mov ecx, dword [ebp - 0x48]
mov edx, dword [ebp - 0x20]
jmp 0x10006276
test ecx, ecx
jne 0x10006220
cmp edx, esi
jb 0x10006220
push ecx
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], ecx
push eax
push esi
push edi
push dword [ebp - 0x74]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1000604e
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x34]
sub edx, eax
mov dword [ebp - 0x20], edx
cmp eax, esi
jb 0x1000604e
mov ecx, dword [ebp - 0x48]
add edi, eax
jmp 0x10006276
mov eax, esi
mov esi, edx
sub eax, ecx
cmp eax, edx
cmovb esi, eax
mov eax, dword [ebp - 0x54]
add eax, ecx
mov dword [ebp - 0x38], eax
cmp eax, 0x10000
jb 0x10006267
not eax
cmp esi, eax
ja 0x10006267
cmp edi, 0x10000
jb 0x10006267
mov eax, edi
not eax
cmp esi, eax
ja 0x10006267
test esi, esi
je 0x10006267
push esi
push edi
push dword [ebp - 0x38]
call fcn.1000ddd0
mov ecx, dword [ebp - 0x48]
add esp, 0xc
mov edx, dword [ebp - 0x20]
sub edx, esi
add edi, esi
add ecx, esi
mov dword [ebp - 0x20], edx
mov esi, dword [ebp - 0x30]
mov dword [ebp - 0x48], ecx
test edx, edx
jne 0x100061b3
mov edi, dword [ebx + 0xc]
lea eax, [edi - 2]
jmp switch.0x100064e6
push 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
push eax
push 3
push 0x1003be28
push dword [ebp - 0x74]
call esi
lea eax, [edi - 2]
jmp 0x100064e3
cmp dword [ebp - 0x54], 0
je 0x100063a6
mov esi, dword [ebp - 0x50]
mov edx, 4
mov ecx, dword [ebp - 0x48]
mov edi, 0x1003be24
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x20], edx
nop word [eax + eax]
cmp ecx, esi
jne 0x10006300
mov eax, dword [ebp - 0x78]
lea ecx, [ebp - 0x78]
mov eax, dword [eax + 0x40]
cmp eax, fcn.1000bb60
jne 0x100062eb
call fcn.1000bb60
jmp 0x100062ed
call eax
test al, al
je 0x1000604e
mov ecx, dword [ebp - 0x48]
mov edx, dword [ebp - 0x20]
jmp 0x10006393
test ecx, ecx
jne 0x1000633d
cmp edx, esi
jb 0x1000633d
push ecx
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], ecx
push eax
push esi
push edi
push dword [ebp - 0x74]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1000604e
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x34]
sub edx, eax
mov dword [ebp - 0x20], edx
cmp eax, esi
jb 0x1000604e
mov ecx, dword [ebp - 0x48]
add edi, eax
jmp 0x10006393
mov eax, esi
mov esi, edx
sub eax, ecx
cmp eax, edx
cmovb esi, eax
mov eax, dword [ebp - 0x54]
add eax, ecx
mov dword [ebp - 0x38], eax
cmp eax, 0x10000
jb 0x10006384
not eax
cmp esi, eax
ja 0x10006384
cmp edi, 0x10000
jb 0x10006384
mov eax, edi
not eax
cmp esi, eax
ja 0x10006384
test esi, esi
je 0x10006384
push esi
push edi
push dword [ebp - 0x38]
call fcn.1000ddd0
mov ecx, dword [ebp - 0x48]
add esp, 0xc
mov edx, dword [ebp - 0x20]
sub edx, esi
add edi, esi
add ecx, esi
mov dword [ebp - 0x20], edx
mov esi, dword [ebp - 0x30]
mov dword [ebp - 0x48], ecx
test edx, edx
jne 0x100062d0
mov edi, dword [ebx + 0xc]
lea eax, [edi - 2]
jmp switch.0x100064e6
push 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
push eax
push 4
push 0x1003be24
push dword [ebp - 0x74]
call esi
lea eax, [edi - 2]
jmp 0x100064e3
cmp dword [ebp - 0x54], 0
je 0x100064bd
mov esi, dword [ebp - 0x50]
mov edx, 4
mov ecx, dword [ebp - 0x48]
mov edi, 0x1003bde8
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x20], edx
cmp ecx, esi
jne 0x10006417
mov eax, dword [ebp - 0x78]
lea ecx, [ebp - 0x78]
mov eax, dword [eax + 0x40]
cmp eax, fcn.1000bb60
jne 0x10006402
call fcn.1000bb60
jmp 0x10006404
call eax
test al, al
je 0x100064b2
mov ecx, dword [ebp - 0x48]
mov edx, dword [ebp - 0x20]
jmp 0x100064a2
test ecx, ecx
jne 0x1000644c
cmp edx, esi
jb 0x1000644c
push ecx
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], ecx
push eax
push esi
push edi
push dword [ebp - 0x74]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x100064b2
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x34]
sub edx, eax
mov dword [ebp - 0x20], edx
cmp eax, esi
jb 0x100064b2
mov ecx, dword [ebp - 0x48]
add edi, eax
jmp 0x100064a2
mov eax, esi
mov esi, edx
sub eax, ecx
cmp eax, edx
cmovb esi, eax
mov eax, dword [ebp - 0x54]
add eax, ecx
mov dword [ebp - 0x38], eax
cmp eax, 0x10000
jb 0x10006493
not eax
cmp esi, eax
ja 0x10006493
cmp edi, 0x10000
jb 0x10006493
mov eax, edi
not eax
cmp esi, eax
ja 0x10006493
test esi, esi
je 0x10006493
push esi
push edi
push dword [ebp - 0x38]
call fcn.1000ddd0
mov ecx, dword [ebp - 0x48]
add esp, 0xc
mov edx, dword [ebp - 0x20]
sub edx, esi
add edi, esi
add ecx, esi
mov dword [ebp - 0x20], edx
mov esi, dword [ebp - 0x30]
mov dword [ebp - 0x48], ecx
test edx, edx
jne 0x100063e7
mov eax, dword [ebx + 0xc]
add eax, 0xfffffffe
jmp switch.0x100064e6
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebp - 0x48]
add eax, 0xfffffffe
jmp switch.0x100064e6
push 0
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
push eax
push 4
push 0x1003bde8
push dword [ebp - 0x74]
call esi
lea eax, [edi - 2]
jmp 0x100064e3
lea eax, [edi - 2]
cmp eax, 5
ja case.default.0x100064e6
mov ecx, dword [ebp - 0x48]
jmp dword [eax*4 + 0x100066e4]
mov edx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
mov ecx, edi
shr edx, 1
call fcn.1000ad20
mov ecx, dword [ebp - 0x48]
jmp 0x10006521
mov edx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
mov ecx, edi
shr edx, 2
call fcn.1000af00
mov ecx, dword [ebp - 0x48]
jmp 0x10006521
mov ecx, dword [ebp - 0x48]
mov edi, dword [ebp - 0x1c]
jmp 0x10006527
mov edi, dword [ebp - 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 0x18]
test edx, edx
je 0x10006630
cmp dword [ebp - 0x54], 0
je 0x1000660d
mov edi, dword [ebp - 0x50]
nop
cmp ecx, edi
jne 0x10006570
mov eax, dword [ebp - 0x78]
lea ecx, [ebp - 0x78]
mov eax, dword [eax + 0x40]
cmp eax, fcn.1000bb60
jne 0x1000655b
call fcn.1000bb60
jmp 0x1000655d
call eax
mov edx, dword [ebp - 0x18]
test al, al
je 0x10006606
mov ecx, dword [ebp - 0x48]
jmp 0x100065f8
test ecx, ecx
jne 0x100065a4
cmp edx, edi
jb 0x100065a4
push ecx
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], ecx
push eax
push edi
push dword [ebp - 0x1c]
push dword [ebp - 0x74]
call esi
mov edx, dword [ebp - 0x18]
test eax, eax
je 0x10006606
mov eax, dword [ebp - 0x34]
sub edx, eax
mov dword [ebp - 0x18], edx
cmp eax, edi
jb 0x10006606
add dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x48]
jmp 0x100065f8
mov eax, edi
mov esi, edx
sub eax, ecx
cmp eax, edx
mov edx, dword [ebp - 0x54]
cmovb esi, eax
add edx, ecx
cmp edx, 0x10000
jb 0x100065e8
mov eax, edx
not eax
cmp esi, eax
ja 0x100065e8
mov eax, dword [ebp - 0x1c]
cmp eax, 0x10000
jb 0x100065e8
not eax
cmp esi, eax
ja 0x100065e8
test esi, esi
je 0x100065e8
push esi
push dword [ebp - 0x1c]
push edx
call fcn.1000ddd0
mov ecx, dword [ebp - 0x48]
add esp, 0xc
mov edx, dword [ebp - 0x18]
add dword [ebp - 0x1c], esi
sub edx, esi
add ecx, esi
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x48], ecx
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
test edx, edx
jne 0x10006540
test edx, edx
sete al
jmp 0x10006632
push 0
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0
push eax
push edx
push edi
push dword [ebp - 0x74]
call esi
test eax, eax
je 0x10006630
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x30], eax
sete al
jmp 0x10006632
xor al, al
test al, al
jne 0x1000663d
mov esi, 4
jmp 0x1000663f
xor esi, esi
lea ecx, [ebp - 0x78]
call fcn.1000b2e0
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], vtable.PictureFan::MemoryBuffer.0
test eax, eax
je 0x10006665
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x10