Function at 0x10071728
Capabilities:
Check for time delay via gettickcount
Create directory
Get graphical window text
Resolve function by parsing pe exports
Set global application hook

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100875b9
mov eax, dword fs:[0]
push eax
sub esp, 0x248
mov eax, dword [0x100a509c]
xor eax, esp
mov dword [esp + 0x240], eax
push ebx
push esi
push edi
mov eax, dword [0x100a509c]
xor eax, esp
push eax
lea eax, [esp + 0x258]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
call dword [sym.imp.mfc100.dll_Ordinal_9475]
xor ebx, ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], vtable.CRgn.0
lea eax, [esp + 0x7c]
push eax
mov dword [esp + 0x264], ebx
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetClientRect]
mov edx, dword [esp + 0x80]
mov eax, dword [esp + 0x88]
mov edi, dword [esp + 0x7c]
mov ecx, dword [esp + 0x84]
push 6
sub eax, edx
push 6
sub ecx, edi
sub eax, 3
push eax
sub ecx, 3
push ecx
add edx, 3
push edx
add edi, 3
push edi
call dword [sym.imp.GDI32.dll_CreateRoundRectRgn]
mov edi, dword [sym.imp.mfc100.dll_Ordinal_2184]
push eax
lea ecx, [esp + 0x2c]
call edi
push 1
push dword [esp + 0x30]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_SetWindowRgn]
mov esi, dword [sym.imp.mfc100.dll_Ordinal_265]
push 0x1f4
call esi
mov dword [esp + 0x20], eax
mov dword [esp], 0x1f4
call esi
mov esi, dword [sym.imp.MSVCR100.dll_sprintf]
mov dword [esp], 0x10110f10
push str._sMap__btn_min.png
push dword [esp + 0x24]
mov dword [esp + 0x24], eax
call esi
add esp, 0xc
push 0x10110f10
push str._sMap__Background.png
push dword [esp + 0x20]
call esi
add esp, 0xc
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], vtable.CBitmap.0
lea esi, [esp + 0x30]
call fcn.10004efd
mov ecx, dword [esp + 0x18]
mov eax, esi
push eax
mov byte [esp + 0x264], 2
call fcn.10004ce8
mov eax, dword [esp + 0x34]
or dword [esp + 0x50], 0xffffffff
or dword [esp + 0x54], 0xffffffff
push eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x48], ebx
mov word [esp + 0x50], bx
call edi
push dword [esp + 0x24]
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
push eax
mov ecx, 0x100a5324
call edi
push ecx
mov ecx, esp
mov dword [esp + 0x6c], esp
push dword [esp + 0x1c]
call dword [sym.imp.mfc100.dll_Ordinal_310]
push ecx
mov byte [esp + 0x268], 3
mov ecx, esp
mov dword [esp + 0x6c], esp
push dword [esp + 0x24]
call dword [sym.imp.mfc100.dll_Ordinal_310]
mov esi, dword [esp + 0x1c]
add esi, 0x338
mov byte [esp + 0x268], 2
call fcn.10004145
mov eax, dword [esp + 0x84]
add eax, 0xffffffd3
push eax
mov edi, esi
call fcn.10004192
push dword [esp + 0x1c]
mov esi, dword [sym.imp.mfc100.dll_Ordinal_1296]
call esi
pop ecx
push dword [esp + 0x18]
call esi
mov edi, dword [esp + 0x18]
mov esi, dword [sym.imp.mfc100.dll_Ordinal_7214]
pop ecx
push ebx
push ebx
push 0x10093ad0
push 1
add edi, 0x94
push 1
mov ecx, edi
call esi
push ebx
push ebx
push 0x10093ad8
push 2
push 1
mov ecx, edi
call esi
push ebx
push ebx
push 0x10093ae0
push 3
push 1
mov ecx, edi
call esi
push ebx
push ebx
push 0x10093ae8
push 4
push 1
mov ecx, edi
call esi
push ebx
push ebx
push 0x10093b00
push 5
push 1
mov ecx, edi
call esi
push ebx
push ebx
push 0x10093b2c
push 6
push 1
mov ecx, edi
call esi
push ebx
push ebx
push 0x10093b34
push 7
push 1
mov ecx, edi
call esi
push ebx
push ebx
push 0x1009b1e4
push 8
push 1
mov ecx, edi
call esi
push ebx
push ebx
push 0x10093b3c
push 9
push 1
mov ecx, edi
call esi
push ebx
push ebx
push 0x10093b60
push 0xa
push 1
mov ecx, edi
call esi
push ebx
push ebx
push 0x10093b70
push 0xb
push 1
mov ecx, edi
call esi
push ebx
push ebx
push 0x1009b1ec
push 0xc
push 1
mov ecx, edi
call esi
push ebx
push ebx
push 0x1009b1f4
push 0xd
push 1
mov ecx, edi
call esi
mov ecx, dword [esp + 0x14]
mov esi, dword [sym.imp.mfc100.dll_Ordinal_4785]
mov ebx, 0x1b58
push ebx
call esi
mov edi, dword [sym.imp.mfc100.dll_Ordinal_2752]
push eax
push 0x1b5b
mov ecx, 0x103c17f0
call edi
mov ecx, dword [esp + 0x14]
push ebx
call esi
push eax
push 0x1b5c
mov ecx, 0x103c2bf0
call edi
mov ecx, dword [esp + 0x14]
push ebx
call esi
push eax
push 0x1b5d
mov ecx, 0x103c43b0
call edi
mov ecx, dword [esp + 0x14]
push ebx
call esi
push eax
push 0x1b5e
mov ecx, 0x103c55d0
call edi
mov ecx, dword [esp + 0x14]
push ebx
call esi
push eax
push 0x1b5f
mov ecx, 0x103c65a0
call edi
mov ecx, dword [esp + 0x14]
push ebx
call esi
push eax
push 0x1b60
mov ecx, 0x103c6f70
call edi
mov ecx, dword [esp + 0x14]
push ebx
call esi
push eax
push 0x1b61
mov ecx, 0x103c7788
call edi
mov ecx, dword [esp + 0x14]
push ebx
call esi
push eax
push 0x1b62
mov ecx, 0x103c7aa8
call edi
mov ecx, dword [esp + 0x14]
push ebx
call esi
push eax
push 0x1b63
mov ecx, 0x103c81a0
call edi
mov ecx, dword [esp + 0x14]
push ebx
call esi
push eax
push 0x1b64
mov ecx, 0x103c9780
call edi
mov ecx, dword [esp + 0x14]
push ebx
call esi
push eax
push 0x1b65
mov ecx, 0x103ca2a0
call edi
mov ecx, dword [esp + 0x14]
push ebx
call esi
push eax
push 0x1b66
mov ecx, 0x103cb7b8
call edi
mov ecx, dword [esp + 0x14]
push ebx
call esi
push eax
push 0x1b67
mov ecx, 0x103cba50
call edi
mov ecx, dword [esp + 0x14]
push ebx
call esi
push eax
push 0x1b6a
mov ecx, 0x103cc8a8
call edi
mov ecx, dword [esp + 0x14]
push ebx
call esi
push eax
push 0x1b6b
mov ecx, 0x103ccdb8
call edi
mov ecx, dword [esp + 0x14]
push ebx
call esi
push eax
push 0x1b6c
mov ecx, 0x103cd350
call edi
mov ecx, dword [esp + 0x14]
push ebx
call esi
push eax
push 0x1b77
mov ecx, 0x103cecb0
call edi
mov ecx, dword [esp + 0x14]
push ebx
call esi
push eax
push 0x1b80
mov ecx, 0x103cfd80
call edi
push ebx
mov ebx, dword [esp + 0x18]
mov ecx, ebx
call esi
push eax
push 0x1b82
mov ecx, 0x103d06f8
call edi
lea eax, [esp + 0x6c]
push eax
push dword [ebx + 0xb4]
call dword [sym.imp.USER32.dll_GetClientRect]
fild dword [esp + 0x74]
fmul qword [0x1009da20]
call fcn.10082ff0
fild dword [esp + 0x78]
mov dword [esp + 0x6c], eax
fmul qword [0x1009da18]
call fcn.10082ff0
mov ecx, dword [esp + 0x78]
mov esi, dword [sym.imp.mfc100.dll_Ordinal_7933]
xor edi, edi
sub ecx, eax
inc edi
push edi
push ecx
mov ecx, dword [esp + 0x7c]
sub ecx, dword [esp + 0x74]
mov dword [esp + 0x78], eax
push ecx
push eax
push dword [esp + 0x7c]
mov ecx, 0x103c17f0
call esi
mov eax, dword [esp + 0x78]
sub eax, dword [esp + 0x70]
push edi
push eax
mov eax, dword [esp + 0x7c]
sub eax, dword [esp + 0x74]
mov ecx, 0x103c2bf0
push eax
push dword [esp + 0x7c]
push dword [esp + 0x7c]
call esi
mov eax, dword [esp + 0x78]
sub eax, dword [esp + 0x70]
push edi
push eax
mov eax, dword [esp + 0x7c]
sub eax, dword [esp + 0x74]
mov ecx, 0x103c43b0
push eax
push dword [esp + 0x7c]
push dword [esp + 0x7c]
call esi
mov eax, dword [esp + 0x78]
sub eax, dword [esp + 0x70]
push edi
push eax
mov eax, dword [esp + 0x7c]
sub eax, dword [esp + 0x74]
mov ecx, 0x103c55d0
push eax
push dword [esp + 0x7c]
push dword [esp + 0x7c]
call esi
mov eax, dword [esp + 0x78]
sub eax, dword [esp + 0x70]
push edi
push eax
mov eax, dword [esp + 0x7c]
sub eax, dword [esp + 0x74]
mov ecx, 0x103c65a0
push eax
push dword [esp + 0x7c]
push dword [esp + 0x7c]
call esi
mov eax, dword [esp + 0x78]
sub eax, dword [esp + 0x70]
push edi
push eax
mov eax, dword [esp + 0x7c]
sub eax, dword [esp + 0x74]
mov ecx, 0x103c6f70
push eax
push dword [esp + 0x7c]
push dword [esp + 0x7c]
call esi
mov eax, dword [esp + 0x78]
sub eax, dword [esp + 0x70]
push edi
push eax
mov eax, dword [esp + 0x7c]
sub eax, dword [esp + 0x74]
mov ecx, 0x103c7788
push eax
push dword [esp + 0x7c]
push dword [esp + 0x7c]
call esi
mov eax, dword [esp + 0x78]
sub eax, dword [esp + 0x70]
push edi
push eax
mov eax, dword [esp + 0x7c]
sub eax, dword [esp + 0x74]
mov ecx, 0x103c7aa8
push eax
push dword [esp + 0x7c]
push dword [esp + 0x7c]
call esi
mov eax, dword [esp + 0x78]
sub eax, dword [esp + 0x70]
push edi
push eax
mov eax, dword [esp + 0x7c]
sub eax, dword [esp + 0x74]
mov ecx, 0x103c81a0
push eax
push dword [esp + 0x7c]
push dword [esp + 0x7c]
call esi
mov eax, dword [esp + 0x78]
sub eax, dword [esp + 0x70]
push edi
push eax
mov eax, dword [esp + 0x7c]
sub eax, dword [esp + 0x74]
mov ecx, 0x103c9780
push eax
push dword [esp + 0x7c]
push dword [esp + 0x7c]
call esi
mov eax, dword [esp + 0x78]
sub eax, dword [esp + 0x70]
push edi
push eax
mov eax, dword [esp + 0x7c]
sub eax, dword [esp + 0x74]
mov ecx, 0x103ca2a0
push eax
push dword [esp + 0x7c]
push dword [esp + 0x7c]
call esi
mov eax, dword [esp + 0x78]
sub eax, dword [esp + 0x70]
push edi
push eax
mov eax, dword [esp + 0x7c]
sub eax, dword [esp + 0x74]
push eax
push dword [esp + 0x7c]
mov ecx, 0x103cb7b8
push dword [esp + 0x7c]
call esi
mov eax, dword [esp + 0x78]
sub eax, dword [esp + 0x70]
push edi
push eax
mov eax, dword [esp + 0x7c]
sub eax, dword [esp + 0x74]
mov ecx, 0x103cba50
push eax
push dword [esp + 0x7c]
push dword [esp + 0x7c]
call esi
mov eax, dword [esp + 0x78]
sub eax, dword [esp + 0x70]
push edi
push eax
mov eax, dword [esp + 0x7c]
sub eax, dword [esp + 0x74]
mov ecx, 0x103cc8a8
push eax
push dword [esp + 0x7c]
push dword [esp + 0x7c]
call esi
mov eax, dword [esp + 0x78]
sub eax, dword [esp + 0x70]
push edi
push eax
mov eax, dword [esp + 0x7c]
sub eax, dword [esp + 0x74]
mov ecx, 0x103ccdb8
push eax
push dword [esp + 0x7c]
push dword [esp + 0x7c]
call esi
mov eax, dword [esp + 0x78]
sub eax, dword [esp + 0x70]
push edi
push eax
mov eax, dword [esp + 0x7c]
sub eax, dword [esp + 0x74]
mov ecx, 0x103cd350
push eax
push dword [esp + 0x7c]
push dword [esp + 0x7c]
call esi
mov eax, dword [esp + 0x78]
sub eax, dword [esp + 0x70]
push edi
push eax
mov eax, dword [esp + 0x7c]
sub eax, dword [esp + 0x74]
mov ecx, 0x103cecb0
push eax
push dword [esp + 0x7c]
push dword [esp + 0x7c]
call esi
mov eax, dword [esp + 0x78]
sub eax, dword [esp + 0x70]
push edi
push eax
mov eax, dword [esp + 0x7c]
sub eax, dword [esp + 0x74]
mov ecx, 0x103cfd80
push eax
push dword [esp + 0x7c]
push dword [esp + 0x7c]
call esi
mov eax, dword [esp + 0x78]
sub eax, dword [esp + 0x70]
push edi
push eax
mov eax, dword [esp + 0x7c]
sub eax, dword [esp + 0x74]
mov ecx, 0x103d06f8
push eax
push dword [esp + 0x7c]
push dword [esp + 0x7c]
call esi
push 5
mov ecx, 0x103c17f0
call dword [sym.imp.mfc100.dll_Ordinal_12962]
mov esi, dword [sym.imp.mfc100.dll_Ordinal_6213]
mov ecx, 0x103c1920
call esi
push 0
push 0
push 0x31
push dword [0x103c1940]
mov dword [0x100a68d8], eax
call dword [sym.imp.USER32.dll_SendMessageA]
push eax
call dword [sym.imp.mfc100.dll_Ordinal_4341]
mov dword [0x100a68d4], eax
lea eax, [ebx + 0x3e8]
mov dword [esp + 0x1c], eax
call fcn.10002375
mov dword [0x100a6284], eax
lea eax, [ebx + 0x108]
call fcn.10002375
lea ecx, [ebx + 0x220]
mov dword [0x100a65ac], eax
call esi
mov esi, 0x103d5f20
mov dword [0x100a609c], eax
mov byte [0x1035ef2b], 0
call section..text
mov esi, 0x103d5f2c
call section..text
mov esi, 0x103d5f38
call section..text
mov esi, 0x103ceca4
call section..text
mov esi, 0x103cf1e4
call section..text
mov esi, 0x103cfd74
call section..text
mov esi, 0x103d1384
call section..text
mov esi, 0x103d1764
call section..text
mov esi, 0x103d1c8c
call section..text
mov esi, 0x103d455c
call section..text
mov esi, 0x103d5c34
call section..text
mov esi, 0x103d5fb0
call section..text
mov esi, 0x103d5fbc
call section..text
mov esi, 0x103d5f98
call section..text
mov esi, 0x103d5fa4
call section..text
mov esi, 0x103d5f68
call section..text
mov esi, 0x103d5f80
call section..text
mov esi, 0x103d6154
call section..text
mov esi, 0x103d5ee4
call section..text
mov esi, 0x103d5ef0
call section..text
mov esi, 0x103d5ff8
call section..text
mov esi, 0x103d601c
call section..text
mov esi, 0x103d6034
call section..text
mov esi, 0x103d5f14
call section..text
mov esi, 0x103d5f44
call section..text
mov esi, 0x103d6004
call section..text
mov esi, 0x103d6010
call section..text
mov byte [0x10110080], 0
mov esi, 0x103d5f08
call section..text
mov esi, 0x103d5efc
call section..text
mov esi, 0x103d6148
call section..text
mov esi, 0x103cbc14
call section..text
mov esi, 0x103cc3b4
call section..text
mov eax, dword [0x103ccdb4]
test eax, eax
je 0x1007202b
xor esi, esi
test eax, eax
jle 0x10072010
mov eax, dword [0x103ccdac]
push dword [eax + esi*4]
call dword [sym.imp.mfc100.dll_Ordinal_1296]
inc esi
pop ecx
cmp esi, dword [0x103ccdb4]
jl 0x10071ff8
push dword [0x103ccdac]
push 0
push dword [0x103ccdb0]
call dword [sym.imp.KERNEL32.dll_HeapFree]
and dword [0x103ccdb4], 0
mov esi, 0x103ce124
call section..text
mov esi, 0x103c17e4
call section..text
mov esi, 0x103c2be4
call section..text
mov esi, 0x103c43a4
call section..text
mov esi, 0x103c55c4
call section..text
mov esi, 0x103c777c
call section..text
mov esi, 0x103c6594
call section..text
mov esi, 0x103c7a9c
call section..text
xor eax, eax
mov esi, 0x103d60dc
mov dword [0x1035ed30], eax
mov dword [0x1035ed34], eax
mov dword [0x1035ed20], eax
mov dword [0x1035ed24], eax
mov byte [0x10384415], al
mov dword [0x100a68d0], eax
mov dword [0x100a65a8], eax
call section..text
push 0x100707f3
push 0xfffffffffffffffc
push dword [ebx + 0x20]
mov byte [0x1035ef28], 0
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov dword [0x1011348c], eax
mov eax, dword [0x2fb7ac4]
xor ebx, ebx
cmp eax, ebx
je 0x100720e6
movzx eax, word [eax + 0x14]
imul eax, eax, 0x1cc
mov eax, dword [eax + 0x333bb68]
mov dword [0x10111778], eax
call fcn.1007092b
call fcn.10070baa
xor esi, esi
cmp dword [0x103d5ee0], ebx
jle 0x1007211d
mov eax, dword [0x103d5ed8]
push dword [eax + esi*4]
push ebx
push 0x143
push dword [0x103c4264]
call dword [sym.imp.USER32.dll_SendMessageA]
inc esi
cmp esi, dword [0x103d5ee0]
jl 0x100720fa
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push ebx
push ebx
push 0x146
push dword [0x103c5924]
mov dword [esp + 0x28], ebx
call esi
test eax, eax
jle 0x10072178
mov eax, dword [0x100a68d0]
imul eax, eax, 0x28
add eax, 0x100a65b0
push eax
push dword [esp + 0x1c]
push 0x148
push dword [0x103c5924]
call esi
inc dword [0x100a68d0]
inc dword [esp + 0x18]
push ebx
push ebx
push 0x146
push dword [0x103c5924]
call esi
cmp dword [esp + 0x18], eax
jl 0x1007213a
push ebx
push ebx
push 0x146
push dword [0x103c59d0]
mov dword [esp + 0x28], ebx
call esi
test eax, eax
jle 0x100721cd
mov eax, dword [0x100a65a8]
imul eax, eax, 0x28
add eax, 0x100a6288
push eax
push dword [esp + 0x1c]
push 0x148
push dword [0x103c59d0]
call esi
inc dword [0x100a65a8]
inc dword [esp + 0x18]
push ebx
push ebx
push 0x146
push dword [0x103c59d0]
call esi
cmp dword [esp + 0x18], eax
jl 0x1007218f
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1035eee4], 0xa
mov dword [0x101117c4], ebx
call esi
xor edx, edx
mov ecx, 0x3e8
div ecx
mov dword [0x1035ed68], eax
call esi
mov esi, dword [sym.imp.WINMM.dll_timeGetTime]
mov dword [0x1035ed50], eax
call esi
mov ecx, dword [0xe77dfc]
mov dword [ecx + 0x60054], eax
call esi
mov ecx, dword [0xe77dfc]
mov dword [ecx + 0x6005c], eax
call esi
mov ecx, dword [0xe77dfc]
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push ebx
push 5
push 0x1011160c
push 0x67b3b5
push dword [0x100df8d4]
mov dword [ecx + 0x60060], eax
call esi
push 0x32
lea eax, [esp + 0x90]
push ebx
mov dword [0xd941b8], 0x43960000
push eax
mov dword [0xd9419c], 0x437a0000
mov dword [0x10111c14], ebx
mov dword [0x10111c0c], ebx
mov dword [0x10111c04], ebx
mov dword [0x10111bfc], ebx
mov dword [0x10111bf4], 0xbb8
mov dword [0x10111bec], 0x1f4
mov dword [0x10111be4], ebx
mov dword [0x10111bdc], ebx
mov dword [0x10111bd4], ebx
call sub.MSVCR100.dll_memset
add esp, 0xc
push ebx
push 6
lea eax, [esp + 0x94]
push eax
push 0x6b6da9
push dword [0x100df8d4]
mov dword [esp + 0xa0], 0x90909090
mov word [esp + 0xa4], 0x9090
call esi
push ebx
push 6
lea eax, [esp + 0x94]
push eax
push 0x6b3309
push dword [0x100df8d4]
call esi
push ebx
push 6
lea eax, [esp + 0x94]
push eax
push 0x6b32ca
push dword [0x100df8d4]
call esi
push ebx
push 6
lea eax, [esp + 0x94]
push eax
push 0x902350
push dword [0x100df8d4]
call esi
push ebx
push 2
lea eax, [esp + 0x94]
push eax
push 0x6c52e6
push dword [0x100df8d4]
call esi
push ebx
push 2
lea eax, [esp + 0x94]
push eax
push 0x6c5361
push dword [0x100df8d4]
call esi
push ebx
push 6
lea eax, [esp + 0x94]
push eax
push 0x68f209
push dword [0x100df8d4]
mov dword [esp + 0xa0], 0xfff0dce9
mov word [esp + 0xa4], 0x90ff
call esi
push ebx
push 6
lea eax, [esp + 0x94]
push eax
push 0x67cad5
push dword [0x100df8d4]
mov dword [esp + 0xa0], 0xe2e9
mov word [esp + 0xa4], 0x9000
call esi
push ebx
push 0xb
lea eax, [esp + 0x94]
push eax
push 0x90231d
push dword [0x100df8d4]
mov dword [esp + 0xa0], 0x90909090
mov dword [esp + 0xa4], 0x90909090
mov dword [esp + 0xa8], 0x90909090
call esi
push ebx
push 2
lea eax, [esp + 0x94]
push eax
push 0x5b1fb7
push dword [0x100df8d4]
call esi
push ebx
push 6
lea eax, [esp + 0x94]
push eax
push 0x5a64bc
push dword [0x100df8d4]
call esi
push ebx
push 2
lea eax, [esp + 0x94]
push eax
push 0x553d6f
push dword [0x100df8d4]
mov word [esp + 0xa0], 0x9090
call esi
push ebx
push edi
lea eax, [esp + 0x94]
push eax
push 0x8d1225
push dword [0x100df8d4]
mov word [esp + 0xa0], 0x7eb
call esi
push ebx
push edi
lea eax, [esp + 0x94]
push eax
push 0x9ec4e4
push dword [0x100df8d4]
mov byte [esp + 0xa0], 0xeb
call esi
push ebx
push edi
lea eax, [esp + 0x94]
push eax
push 0x54c723
push dword [0x100df8d4]
call esi
mov dword [esp + 0x8c], 0xabbeb
push ebx
push edi
lea eax, [esp + 0x94]
push eax
push 0x6c4ffc
push dword [0x100df8d4]
mov word [esp + 0xa4], 0x9000
call esi
push ebx
push 6
lea eax, [esp + 0x94]
push eax
push 0x83402e
push dword [0x100df8d4]
mov dword [esp + 0xa0], 0xb9e9
mov word [esp + 0xa4], 0x9000
call esi
push ebx
push edi
lea eax, [esp + 0x94]
push eax
push 0x901488
push dword [0x100df8d4]
mov byte [esp + 0xa0], 0xeb
call esi
push ebx
push edi
lea eax, [esp + 0x94]
push eax
push 0x6d46c9
push dword [0x100df8d4]
call esi
push ebx
push edi
lea eax, [esp + 0x94]
push eax
push 0x6bfe28
push dword [0x100df8d4]
call esi
push ebx
push edi
lea eax, [esp + 0x94]
push eax
push 0x6ef297
push dword [0x100df8d4]
call esi
push ebx
push edi
lea eax, [esp + 0x94]
push eax
push 0x759c09
push dword [0x100df8d4]
call esi
push ebx
push edi
lea eax, [esp + 0x94]
push eax
push 0x757b70
push dword [0x100df8d4]
call esi
push ebx
push 2
lea eax, [esp + 0x94]
push eax
push 0x6ac86b
push dword [0x100df8d4]
mov word [esp + 0xa0], 0x13eb
call esi
push ebx
push 5
pop edi
mov eax, 0x10047791
sub eax, 0xa7d195
push edi
mov dword [esp + 0x95], eax
lea eax, [esp + 0x94]
push eax
push 0xa7d190
push dword [0x100df8d4]
mov byte [esp + 0xa0], 0xe9
call esi
push ebx
mov eax, 0x100477bc
sub eax, 0x67b3ba
push edi
mov dword [esp + 0x95], eax
lea eax, [esp + 0x94]
push eax
push 0x67b3b5
push dword [0x100df8d4]
mov byte [esp + 0xa0], 0xe8
call esi
push ebx
mov eax, 0x100477d2
sub eax, 0xace1a1
push edi
mov dword [esp + 0x95], eax
lea eax, [esp + 0x94]
push eax
push 0xace19c
push dword [0x100df8d4]
mov byte [esp + 0xa0], 0xe8
call esi
push ebx
mov eax, 0x100477ea
sub eax, 0x67ca02
push edi
mov dword [esp + 0x95], eax
lea eax, [esp + 0x94]
push eax
push 0x67ca03
push dword [0x100df8d4]
mov byte [esp + 0xa0], 0xe8
mov word [esp + 0xa6], 0x9090
mov byte [esp + 0xa8], 0x90
call esi
push ebx
mov eax, 0x10047826
sub eax, 0x757b15
push 6
mov dword [esp + 0x95], eax
lea eax, [esp + 0x94]
push eax
push 0x757b10
push dword [0x100df8d4]
mov byte [esp + 0xa0], 0xe9
call esi
push ebx
mov eax, 0x1004785f
sub eax, 0x6b6b8f
push 8
mov dword [esp + 0x95], eax
lea eax, [esp + 0x94]
push eax
push 0x6b6b8a
push dword [0x100df8d4]
mov byte [esp + 0xa5], 0x90
mov byte [esp + 0xa0], 0xe8
call esi
push ebx
mov eax, 0x10047808
sub eax, 0x5c9bd8
push edi
mov dword [esp + 0x95], eax
lea eax, [esp + 0x94]
push eax
push 0x5c9bd3
push dword [0x100df8d4]
mov byte [esp + 0xa0], 0xe9
mov word [esp + 0xa5], 0x9090
call esi
mov eax, 0x10047778
push ebx
sub eax, 0x6c19e3
push 6
mov dword [esp + 0x95], eax
lea eax, [esp + 0x94]
push eax
push 0x6c19de
push dword [0x100df8d4]
mov byte [esp + 0xa0], 0xe8
mov byte [esp + 0xa5], 0x90
call esi
lea eax, [esp + 0xc0]
push eax
mov byte [esp + 0x90], 0xe8
call dword [sym.imp.MSVCR100.dll__strdate]
pop ecx
lea eax, [esp + 0xc0]
push eax
push 2
pop edi
lea esi, [esp + 0xd8]
call fcn.100064fa
pop ecx
lea eax, [esp + 0xc0]
push eax
push 3
pop ebx
lea esi, [esp + 0xec]
call fcn.1000655e
pop ecx
lea eax, [esp + 0xc0]
push eax
call dword [sym.imp.MSVCR100.dll__strtime]
pop ecx
lea eax, [esp + 0xc6]
push eax
lea eax, [esp + 0xc7]
push eax
lea eax, [esp + 0xc8]
push eax
mov eax, esi
mov esi, dword [sym.imp.MSVCR100.dll_sprintf]
push eax
lea eax, [esp + 0xe4]
push eax
xor ebx, ebx
push 0x1009b1fc
push 0x10110128
mov byte [esp + 0xde], bl
mov byte [esp + 0xe1], bl
call esi
add esp, 0x1c
mov edi, 0x1035ef38
cmp byte [0x1035ef38], bl
jne 0x10072803
push 0x34d28e8
push edi
call dword [sym.imp.MSVCR100.dll_strcpy]
pop ecx
pop ecx
push 0x1f4
call dword [sym.imp.mfc100.dll_Ordinal_265]
pop ecx
push edi
push 0x10110f10
push str._s_s.txt
push eax
mov dword [esp + 0x28], eax
call esi
push 0x1008b734
push dword [esp + 0x2c]
call dword [sym.imp.MSVCR100.dll_fopen]
add esp, 0x18
test eax, eax
je 0x10072855
mov ecx, dword [esp + 0x18]
call fcn.10054ed4
push edi
lea eax, [esp + 0x100]
push 0x1009b214
push eax
call esi
add esp, 0xc
jmp 0x10072886
push str.default
push 0x10110f10
push str._s_s.txt
push dword [esp + 0x24]
call esi
mov ecx, dword [esp + 0x28]
call fcn.10054ed4
push edi
lea eax, [esp + 0x110]
push 0x1009b234
push eax
call esi
add esp, 0x1c
lea eax, [esp + 0xfc]
push eax
call fcn.100060fb
pop ecx
push dword [esp + 0x18]
call dword [sym.imp.mfc100.dll_Ordinal_1296]
pop ecx
push edi
lea eax, [esp + 0x168]
push 0x1009b24c
push eax
call esi
add esp, 0xc
lea eax, [esp + 0x164]
push eax
mov eax, dword [0x1012ecb8]
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_SetWindowTextA]
push edi
push dword [0x100ded8c]
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x164]
push eax
call dword [sym.imp.mfc100.dll_Ordinal_12868]
push 0x1f4
call dword [sym.imp.mfc100.dll_Ordinal_265]
pop ecx
push edi
push 0x10110f10
push 0x1008c908
push eax
mov dword [esp + 0x2c], eax
call esi
add esp, 0x10
push dword [esp + 0x1c]
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
jne 0x10072921
push ebx
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push dword [esp + 0x1c]
call dword [sym.imp.mfc100.dll_Ordinal_1296]
mov eax, dword [esp + 0x18]
pop ecx
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push ebx
push 0x100745ef
push 3
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
fild dword [0x1035eed0]
mov dword [0x10113490], eax
fld st(0)
fld qword [0x1009da70]
fdiv st(1), st(0)
fdiv st(1), st(0)
fxch st(1)
call fcn.10082ff0
mov dword [esp + 0x14], eax
imul eax, eax, 0xe10
mov dword [esp + 0x1c], eax
fild dword [esp + 0x1c]
fsubp st(2)
fld st(1)
fdivrp st(1)
call fcn.10082ff0
mov dword [esp + 0x18], eax
imul eax, eax, 0x3c
mov dword [esp + 0x1c], eax
fild dword [esp + 0x1c]
fsubp st(1)
call fcn.10082ff0
push eax
push dword [esp + 0x1c]
lea eax, [esp + 0x104]
push dword [esp + 0x1c]
push 0x1009b254
push eax
call esi
lea eax, [esp + 0x110]
add esp, 0x14
push eax
call fcn.100060fb
pop ecx
push 0x7d
lea eax, [esp + 0x1d0]
push ebx
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x36f2cd8
lea eax, [esp + 0x1d0]
push 0x1008a5f0
push eax
call esi
add esp, 0xc
lea eax, [esp + 0x1cc]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x2719
push dword [0x100f315c]
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [esp + 0x1c], eax
movzx eax, ax
mov dword [0x103c143c], eax
movzx eax, word [esp + 0x1e]
push edi
push 0x103c1758
mov dword [0x103c1438], eax
call dword [sym.imp.MSVCR100.dll_strcpy]
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
pop ecx
pop ecx
mov byte [0x1035ef38], bl
call esi
mov edi, 0x3e8
xor edx, edx
mov ecx, edi
div ecx
mov dword [0x1035f7fc], eax
call esi
xor edx, edx
div edi
lea ecx, [esp + 0x30]
mov dword [0x1035ed38], 0xfffff8f8
mov dword [0x1035f08c], ebx
mov dword [0x1035eef4], ebx
mov dword [0x101117d8], eax
call fcn.10004e9d
mov byte [esp + 0x260], bl
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], vtable.CBitmap.0
call fcn.100018f7
or dword [esp + 0x260], 0xffffffff
lea ecx, [esp + 0x28]
mov dword [esp + 0x28], vtable.CRgn.0
call fcn.100018f7
xor eax, eax
inc eax
mov ecx, dword [esp + 0x258]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x240]
xor ecx, esp
call fcn.10082395
mov esp, ebp
pop ebp
ret