Function at 0x1000dcd0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10019d1e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
mov dword [esi + 0x88], 0x1001a23c
mov dword [esp + 0x14], 0x7f8a
mov dword [esp + 0x18], 0x7f00
mov dword [esp + 0x1c], 0x7f03
mov dword [esp + 0x20], 0x7f89
mov dword [esp + 0x24], 0x7f8b
mov dword [esp + 0x28], 0x7f01
mov dword [esp + 0x2c], 0x7f81
mov dword [esp + 0x30], 0x7f88
mov dword [esp + 0x34], 0x7f80
mov dword [esp + 0x38], 0x7f86
mov dword [esp + 0x3c], 0x7f83
mov dword [esp + 0x40], 0x7f85
mov dword [esp + 0x44], 0x7f82
mov dword [esp + 0x48], 0x7f84
mov dword [esp + 0x4c], 0x7f04
mov dword [esp + 0x50], 0x7f02
lea ebx, [esp + 0x14]
lea edi, [esi + 0xcc]
mov ebp, 0x10
mov eax, dword [ebx]
push eax
push 0
mov dword [edi - 0x40], eax
call dword [0x100201f4]
mov dword [edi], eax
add ebx, 4
add edi, 4
dec ebp
jne 0x1000dd8b
xor ebp, ebp
push str.GDI32.dll
mov dword [esp + 0x60], ebp
mov dword [esi], 0x1001a240
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [esp + 0x64]
mov dword [0x10020d8c], eax
lea eax, [ecx - 1]
cmp eax, 0x1f
ja case.0x1000ddd4.2
xor edx, edx
mov dl, byte [eax + 0x1000dfc8]
jmp dword [edx*4 + 0x1000dfc0]
mov dword [esi + 0x70], ecx
jmp 0x1000dde7
mov dword [esi + 0x70], 8
mov ecx, esi
call fcn.1000e7f0
test al, al
jne 0x1000de08
call dword [0x10020d84]
push eax
mov dword [esi + 0x10c], eax
call dword [0x10020d7c]
mov dword [esi + 0x44], eax
mov dword [esi + 0x10], 0xcc0020
mov byte [esi + 4], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 0x6c]
mov dword [esi + 0x14], eax
mov eax, 0x3e8
xor edx, edx
div ecx
mov edi, dword [0x100201e4]
push ebp
mov dword [esi + 8], ecx
mov dword [esi + 0x18], eax
mov al, byte [esp + 0x6c]
mov byte [esi + 0xc], al
call edi
push 1
mov dword [esi + 0x28], eax
call edi
mov dword [esi + 0x2c], eax
mov eax, 0x20
cdq
idiv dword [esi + 0x70]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0x30], ebp
push str.CreateCompatibleDC
mov byte [esi + 0x24], al
mov ecx, dword [0x10020d8c]
push ecx
call ebx
mov edx, dword [esi + 0x44]
mov edi, eax
push edx
call edi
mov dword [esi + 0x4c], eax
mov eax, dword [esi + 0x44]
push eax
call edi
push ebp
mov dword [esi + 0x80], eax
call edi
push ebp
mov dword [esi + 0x48], eax
call edi
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x70]
lea ebp, [esi + 0x5c]
push 1
push ecx
push edx
mov ecx, esi
mov dword [esi + 0x50], eax
mov dword [ebp], 0
mov dword [esi + 0x60], 0
call fcn.1000e460
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 0x70]
mov dword [esi + 0x64], eax
mov eax, dword [esi + 0x2c]
push eax
push ecx
push edx
mov ecx, esi
call fcn.1000e460
mov ecx, dword [esi + 0x70]
mov dword [esi + 0x68], eax
mov eax, dword [esi + 0x28]
push 1
push eax
push ecx
mov ecx, esi
call fcn.1000e460
mov dword [esi + 0x6c], eax
mov edx, dword [0x10020d8c]
push str.CreateDIBSection
push edx
call ebx
push 0
push 0
push ebp
mov edi, eax
push 0
mov eax, dword [esi + 0x64]
mov ecx, dword [esi + 0x44]
push eax
push ecx
call edi
mov edx, dword [esi + 0x68]
mov dword [esi + 0x54], eax
push 0
lea eax, [esi + 0x60]
push 0
push eax
mov eax, dword [esi + 0x44]
push 0
push edx
push eax
call edi
mov edx, dword [esi + 0x68]
push 0
lea ecx, [esi + 0x78]
push 0
mov dword [esi + 0x58], eax
mov eax, dword [esi + 0x44]
push ecx
push 0
push edx
push eax
call edi
mov dword [esi + 0x84], eax
mov ecx, dword [0x10020d8c]
push str.SelectObject
push ecx
call ebx
mov edx, dword [esi + 0x58]
mov edi, eax
mov eax, dword [esi + 0x4c]
push edx
push eax
call edi
mov ecx, dword [esi + 0x54]
mov edx, dword [esi + 0x48]
push ecx
push edx
call edi
mov eax, dword [esi + 0x84]
mov ecx, dword [esi + 0x80]
push eax
push ecx
call edi
mov edx, dword [esi + 0x2c]
mov eax, dword [esi + 0x28]
push edx
push eax
push 0
lea ecx, [esi + 0x34]
push 0
push ecx
call dword [0x10020d88]
mov edx, dword [esi + 0x68]
mov eax, dword [edx + 0x14]
shl eax, 1
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ecx, dword [esi + 0x68]
mov dword [esi + 0x1c], eax
xor edx, edx
add esp, 4
mov eax, dword [ecx + 0x14]
mov ecx, dword [esp + 0x54]
div dword [esi + 0x2c]
mov dword [esi + 0x20], 0
pop edi
mov dword [esi + 0x74], eax
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x50
ret 0xc
push 0x64616572
inc esp
jb 0x1001e128
popal
inc esp
jae str.CloseWindow
je 0x1001e13a
jo 0x1001e0cd
add byte [eax], al
add byte [ebx + 0x6c], al
inc ebx
insb byte es:[edi], dx
outsd dx, dword [esi]
jae 0x1001e13a
inc esp
jae 0x1001e144
je 0x1001e14a
jo 0x1001e0dd
add byte [eax], al
add byte [edi + 0x65], al
inc edi
je 0x1001e127
jne 0x1001e158
jb 0x1001e14d
outsb dx, byte [esi]
je 0x1001e13f
push 0x64616572
dec ecx
add byte fs:[eax], al
js 0x1001e167
insb byte es:[edi], dx
outsd dx, dword [esi]
jb 0x1001e160
jb 0x1001e12b
js 0x1001e165
add byte [eax], al
add byte [eax], al
dec ecx
outsb dx, byte [esi]
je 0x1001e16d
jb 0x1001e178
je 0x1001e15f
popal
inc esi
imul ebp, dword [ebp], 0x4d000000
dec ebp
outsd dx, dword [esi]
jp 0x1001e185
insb byte es:[edi], dx
insb byte es:[edi], dx
popal
das
xor al, 0x2e
xor byte [eax], ah
sub byte [ebx + 0x6f], ah
insd dword es:[edi], dx
jo 0x1001e18b
je 0x1001e195
imul esp, dword [edx + 0x6c], 0x2965
bound ebp, qword [ebp + 0x29]
add byte [eax], al
add byte [eax], al
inc ebx
insb byte es:[edi], dx
outsd dx, dword [esi]
jae 0x1001e19e
push edi
imul ebp, dword [esi + 0x64], 0x4300776f
inc ebx
push esi
add byte [ebx + 0x56], al
inc ebx
push esi
imul esp, dword [ebp + 0x6f], 0x706143
outsd dx, dword gs:[esi]
inc ebx
popal
jo 0x1001e14a
add byte [eax], al
arpl word [ecx + 0x70], sp
inc ebx
popal
jo 0x1001e193
jb 0x1001e1b7
popal
je 0x1001e1ba
inc ebx
popal
jo 0x1001e1cd
je 0x1001e1cf
jne 0x1001e1cd
jb 0x1001e1c1
push edi
push edi
imul ebp, dword [esi + 0x64], 0x41776f
inc ecx
outsd dx, dword fs:[esi]
outsd dx, dword [esi]
ja 0x1001e1a4
add byte [ecx + 0x56], al
inc ecx
push esi
push esi
dec ecx
inc ebx
inc ecx
push eax
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [eax], al
add byte [eax], al
and esi, dword [ebx]
xor dh, byte [edi]
aaa
xor byte [eax], al
add byte [ebx + 0x72], al
inc ebx
jb str.ICOpen
popal
je 0x1001e1e7
push edi
imul ebp, dword [esi + 0x64], 0x7845776f
inc ecx
outsd dx, dword fs:[esi]
ja 0x1001e1ce
js 0x1001e1cc
add byte [ebx + 0x61], ah
arpl word [ecx + 0x70], sp
inc edi
je 0x1001e1d7
jb 0x1001e1fe
jbe 0x1001e1fc
jb 0x1001e1dd
jae 0x1001e1ff
jb 0x1001e207
jo str.ICSeqCompressFrameEnd
imul ebp, dword [edi + 0x6e], 0x41
add byte [ecx + 0x43], cl
dec ecx
inc ebx
add byte [eax], al
add byte [eax], al
dec ecx
inc ebx
push ebx
jno 0x1001e1f1
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x1001e224
jae 0x1001e228
inc esi
jb 0x1001e219
popal
insd dword es:[edi], dx
add byte gs:[eax], al
add byte [eax], al
dec ecx
inc ebx
push ebx
jno 0x1001e205
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
jo str.:899jdaikkdlghct_bnl
jae 0x1001e23c
inc esi
jb 0x1001e22d
insd dword es:[edi], dx
push ebx
push ebx
je 0x1001e232
jb 0x1001e247
add byte [ecx + 0x43], cl
dec ecx
inc ebx
push ebx
outsb dx, byte gs:[esi]
dec ebp
jae 0x1001e251
jae 0x1001e240
popal
add byte gs:[bx + si], al
add byte [ecx + 0x43], cl
dec ecx
inc ebx
dec edi
jo 0x1001e24e
outsb dx, byte [esi]
add byte [eax], al
dec ebp
push ebx
push esi
inc esi
push edi
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [ecx + 0x43], cl
dec ecx
inc ebx
inc ebx
insb byte es:[edi], dx
outsd dx, dword [esi]
jae 0x1001e264
add byte gs:[ecx + 0x43], cl
dec ecx
inc ebx
add byte [ecx + 0x43], cl
dec ecx
inc ebx
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x1001e279
jae 0x1001e27d
outsd dx, dword [esi]
jb 0x1001e253
jb 0x1001e274
add byte gs:[eax], al
add byte [eax], al
dec ecx
inc ebx
push ebx
jno 0x1001e25d
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x1001e290
jae 0x1001e294
inc esi
jb 0x1001e285
insd dword es:[edi], dx
inc ebp
outsb dx, byte [esi]
add byte fs:[eax], al
add byte [eax], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [edx], bh
cmp bh, byte [eax]
cmp dword [ecx], edi
push 0x64
add byte [eax], al
add byte [eax], al
add byte [eax], al
cmp bh, byte [eax]
cmp dword [ecx], edi
push 0x64
popal
imul ebp, dword [ebx + 0x6b], 0x676c2a64
push 0x622f7463
imul ebp, dword [ebx + 0x64], 0x2a
insb byte es:[edi], dx
push 0x622f7463
arpl word [edi + ebp + 0x62], si
outsb dx, byte [esi]
insb byte es:[edi], dx
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add eax, dword [ebx]
add dword [ecx], eax
add dword [edx], eax
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [esp + eax]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add eax, 0x5050505
add eax, 0x5050505
add eax, 0x6050505
push es
add al, 4
add al, 4
add al, 5
add eax, 0x5050505
add eax, 0x5050505
add eax, 0x6060505
add eax, 0x5050505
add eax, 0x6060605
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [ecx], al
or byte [ebx], al
add al, byte [0x2010403]
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add eax, 0x5050505
add eax, 0x5050505
add eax, 0x6050505
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [ecx], al
or byte [ebx], al
add al, byte [0x2010403]
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add eax, dword [edx]
add dword [ebx], eax
add byte [edx], cl
or ch, byte [ebx + 0x77]
ja 0x1001e3db
cmp dword [esp + ebp], ebp
je 0x1001e3e0
jae 0x1001e399
insw word es:[edi], dx
pushal
jno 0x1001e39f
imul ebp, dword [bx + di + 0x2b], 0x6d
jne 0x1001e3a7
jno 0x1001e3fb
jno 0x1001e385
add eax, 0x5050505
add eax, 0x6060505
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [ecx], al
or byte [ebx], al
add al, byte [0x2010403]
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
add dword [eax], ecx
add eax, dword [edx]
add eax, 0x2010403
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add eax, 0x5050505
add eax, 0x5050505
add eax, 0x6050505
push es
push es
push es
add eax, 0x5050505
add eax, 0x5050505
add eax, 0x6060606
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
pop es
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [ecx], al
or byte [ebx], al
add al, byte [0x2010403]
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add eax, 0x5050505
add eax, 0x5050505
add eax, 0x6050505
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
push es
inc edi
sbb dword [edi], eax
pop es
retf 0xd5cc