Function at 0x100063dd
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10064853
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x140
mov byte [esp + 0x40], dl
push ebx
push esi
push edi
test dl, dl
je 0x10006c01
mov esi, dword [ebp + 0x14]
mov eax, dword [esi]
cmp eax, dword [esi + 4]
je 0x10006bf6
lea eax, [esp + 0x98]
xor ebx, ebx
push eax
push 0x1000
lea ecx, [esp + 0x58]
mov dword [esp + 0xa0], ebx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x60], ebx
call fcn.10008640
mov dword [esp + 0x154], ebx
mov eax, dword [esp + 0x54]
sub eax, dword [esp + 0x50]
push dword [esp + 0x50]
sar eax, 1
push eax
push 0x10f94
push 0xad5d
call fcn.1002d751
pop ecx
pop ecx
call eax
push dword [esp + 0x50]
lea ecx, [esp + 0x68]
call fcn.1000754b
inc ebx
push 0x9c08
mov byte [esp + 0x158], bl
call fcn.1004693b
cmp dword [esp + 0x7c], 8
pop ecx
movzx edx, ax
lea ecx, [esp + 0x64]
cmovae ecx, dword [esp + 0x64]
mov eax, dword [esp + 0x74]
mov dword [esp + 0x24], edx
cmp word [ecx + eax*2 - 2], dx
je 0x100064ce
lea eax, [esp + 0x24]
push eax
push ecx
push ecx
lea eax, [esp + 0x70]
mov ecx, 0x7b80
push eax
push ebx
push 0xe08
call fcn.10005e5c
add esp, 0x18
push ecx
push ebx
lea edx, [esp + 0x6c]
call fcn.100049d0
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [esp + 0x18], 0x5cae
cmp dword [esp + 0x18], 0x6036
pop ecx
pop ecx
jle 0x100065f4
push 0x1ce2
push 0x118a
push 0x22af
push 0
push 0xcf4
push 0xfb
call edi
mov esi, dword [sym.imp.USER32.dll_GetDC]
push eax
call esi
push eax
push 0x1d09
push 0xf51
push 0x24f8
push 0x1776
call edi
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_MaskBlt]
xor eax, eax
mov dword [esp + 0x14], eax
xor edi, edi
mov dword [esp + 0x28], edi
xor esi, esi
mov dword [esp + 0x60], esi
and dword [esp + 0x94], 0
mov eax, edi
mov edi, dword [esp + 0x14]
mov ecx, esi
mov esi, dword [esp + 0x94]
sar eax, cl
mov dword [esp + 0x20], eax
mov ecx, esi
shl eax, cl
lea ecx, [esp + 0x118]
and eax, edi
cdq
push edx
push eax
call fcn.10001aad
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000658c
mov eax, dword [eax]
push eax
call fcn.1004da5d
pop ecx
push 0
push ebx
lea ecx, [esp + 0x120]
call fcn.10007f12
mov eax, dword [esp + 0x20]
inc esi
cmp esi, 0x7c5d
jl 0x1000656d
mov esi, dword [esp + 0x60]
mov edi, dword [esp + 0x28]
inc esi
mov dword [esp + 0x60], esi
cmp esi, 0x3830
jl 0x10006550
inc edi
mov dword [esp + 0x28], edi
cmp edi, 0x5cf3
jl 0x1000654a
mov eax, dword [esp + 0x14]
inc eax
mov dword [esp + 0x14], eax
cmp eax, 0x765b
jl 0x10006544
push 0
call dword [sym.imp.USER32.dll_CharUpperW]
mov esi, dword [ebp + 0x14]
cmp dword [esp + 0x10], 0x5ad3
jge 0x10006609
push str.qjoiizk_nyq_sifvm_amod_folky_wedlvaq_ugi_afveddpm_jjiu
call fcn.1004da5d
pop ecx
mov dword [esp + 0x154], ebx
lea eax, [esp + 0x64]
cmp dword [esp + 0x78], 8
push 0
cmovae eax, dword [esp + 0x68]
push eax
push 0x10f94
push 0x50ed
call fcn.1002d751
pop ecx
pop ecx
call eax
push ecx
lea eax, [esp + 0x68]
mov edx, 0x7b57
push eax
push ebx
push ecx
lea eax, [esp + 0x34]
mov ecx, 0x205c
push eax
call fcn.10004af1
and dword [esp + 0x70], 0
lea eax, [esp + 0x70]
add esp, 0x14
mov edx, 0x717f
mov cl, bl
push 0x5ed3
push ebx
push esi
push eax
push 0x4821
push 0x26e5
push 0x22fc
push 0x4d1c
push ebx
call fcn.10004caa
add esp, 0x24
mov word [esp + 0x2c], 0x6a00
xor eax, eax
mov byte [esp + 0x2e], bl
mov byte [esp + 0x1f], al
mov dword [esp + 0x28], eax
mov byte [esp + 0x2f], 0x6f
mov byte [esp + 0x30], bl
mov dword [esp + 0x31], 0x200034b
mov byte [esp + 0x35], 0x1d
lea eax, [esp + 0x64]
push eax
lea ecx, [esp + 0xa0]
call fcn.10007510
push 0x10
pop edx
lea ecx, [esp + 0x100]
mov byte [esp + 0x154], 4
call fcn.10033af2
push 0x66d1
push ebx
push 0x3953
push 0x10d8
push ebx
push ebx
lea eax, [esp + 0x118]
mov byte [esp + 0x16c], 5
push eax
push 0x35a2
mov edx, 0x2277
lea ecx, [esp + 0xbc]
call fcn.10005f2b
add esp, 0x20
xor ecx, ecx
mov dword [esp + 0x14], ecx
push 0x2e
pop eax
push 2
mov word [esp + 0x80], ax
pop esi
cmp esi, 2
jne 0x10006737
push esi
pop ecx
mov dword [esp + 0x14], ecx
jmp 0x10006791
movzx edx, byte [esp + esi + 0x2d]
mov eax, esi
sub eax, ecx
push 0x21fb
push 0x6acc
push ebx
movzx eax, byte [esp + eax + 0x36]
push 0x69
push 0x46fc
push 0
movzx eax, word [esp + eax*2 + 0x94]
mov ecx, eax
and eax, edx
or ecx, edx
mov edx, 0x5d52
sub ecx, eax
movzx eax, byte [esp + esi + 0x44]
push 0x12ef
push ebx
mov word [esp + eax*2 + 0x9c], cx
lea ecx, [esp + 0x34]
call fcn.1000622a
mov ecx, dword [esp + 0x34]
add esp, 0x20
add esi, 2
cmp esi, 0xa
jb 0x1000672a
xor eax, eax
mov word [esp + 0x84], ax
mov dword [esp + 0x10], 0x78b2
cmp dword [esp + 0x10], 0x7b41
jle 0x1000681f
xor esi, esi
xor edi, edi
mov eax, esi
lea ecx, [esp + 0x130]
cdq
idiv edi
mov eax, edx
cdq
push edx
push eax
call fcn.10001aad
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100067d9
mov eax, dword [eax]
push eax
call fcn.1004da5d
pop ecx
push 0
push ebx
lea ecx, [esp + 0x138]
call fcn.10007f12
inc edi
cmp edi, 0x4134
jl 0x100067b9
inc esi
cmp esi, 0x1175
jl 0x100067b7
push 0x1d4
push 0x17d
push 0x315
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
call dword [sym.imp.USER32.dll_PeekMessageA]
and dword [esp + 0xf4], 0
lea ecx, [esp + 0xe4]
xor eax, eax
mov dword [esp + 0xf8], 7
mov word [esp + 0xe4], ax
lea eax, [esp + 0x7c]
push eax
call fcn.10008214
push ecx
push ecx
lea eax, [esp + 0xec]
mov byte [esp + 0x15c], 6
push eax
lea ecx, [esp + 0xa8]
call fcn.10009b5b
push 0
push ebx
lea ecx, [esp + 0xec]
call fcn.10008371
cmp dword [esp + 0x10], 0x75dc
jge 0x1000688f
push str.gyphvddkj_xfui_yksj
call fcn.1004da5d
pop ecx
xor eax, eax
mov dword [esp + 0x154], 5
cmp dword [esp + 0xb0], 8
lea edi, [esp + 0x7c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x9c]
cmovae eax, dword [esp + 0x9c]
xor edi, edi
push edi
push 0x80
push 2
push edi
push edi
push 0x40000000
push eax
push 0x10f94
push 0x8ab3
call fcn.1002d751
pop ecx
pop ecx
call eax
mov esi, eax
cmp esi, 0xffffffff
je 0x1000692d
push edi
lea eax, [esp + 0x100]
push eax
push dword [esp + 0x64]
mov eax, dword [ebp + 0x14]
push dword [eax]
push esi
push 0x10f94
push 0x795e
call fcn.1002d751
pop ecx
pop ecx
call eax
push esi
test eax, eax
push 0x10f94
push 0x10406
setne bl
call fcn.1002d751
pop ecx
pop ecx
call eax
test bl, bl
jne 0x10006975
xor ebx, ebx
inc ebx
push edi
push ebx
lea ecx, [esp + 0x108]
call fcn.10008371
push edi
push ebx
lea ecx, [esp + 0xa4]
mov byte [esp + 0x15c], bl
call fcn.10008371
mov edi, dword [esp + 0x28]
inc edi
mov dword [esp + 0x28], edi
cmp edi, 0x12c
jb 0x100066b3
mov eax, dword [ebp + 0xc]
push 0
mov dword [eax], 2
jmp 0x10006be1
push 0x22
pop esi
xor eax, eax
mov word [esp + 0x48], 0x2d00
push 7
mov word [esp + 0x4a], ax
lea ecx, [esp + 0xb8]
pop edi
mov word [esp + 0xb4], ax
xor ebx, ebx
lea eax, [esp + 0x44]
mov word [esp + 0x44], si
push eax
mov dword [esp + 0xcc], edi
mov dword [esp + 0xc8], ebx
call fcn.10008214
push ecx
push ecx
lea eax, [esp + 0xa4]
mov byte [esp + 0x15c], 9
push eax
lea ecx, [esp + 0xc0]
mov dword [esp + 0x50], ebx
call fcn.10009b5b
inc ebx
mov word [esp + 0x88], si
push 2
xor ecx, ecx
mov dword [esp + 0x3c], 0xc102f300
mov word [esp + 0x40], 0x37f
mov byte [esp + 0x42], 0x71
mov byte [esp + 0x43], bl
mov word [esp + 0x44], 0x273
mov byte [esp + 0x46], 0xf
pop esi
mov dword [esp + 0x18], ecx
cmp esi, 2
jne 0x10006a1f
push 3
pop ecx
push ecx
mov dword [esp + 0x1c], ecx
pop esi
jmp 0x10006a73
movzx edx, byte [esp + esi + 0x39]
mov eax, esi
sub eax, ecx
push 0x37be
movzx eax, byte [esp + eax + 0x3a]
movzx eax, word [esp + eax*2 + 0x8c]
mov ecx, eax
and eax, edx
or ecx, edx
mov edx, 0x428b
sub ecx, eax
movzx eax, byte [esp + esi + 0x3c]
mov word [esp + eax*2 + 0x8c], cx
lea eax, [esp + 0x1c]
push eax
push ecx
push 0x5aab
push 0x3bc4
push ecx
mov cl, bl
call fcn.10006c60
mov ecx, dword [esp + 0x30]
add esp, 0x18
add esi, 2
cmp esi, 0xb
jb 0x10006a0f
xor eax, eax
mov dword [esp + 0xe0], edi
mov word [esp + 0x90], ax
lea ecx, [esp + 0xcc]
mov word [esp + 0xcc], ax
xor esi, esi
lea eax, [esp + 0x88]
mov dword [esp + 0xdc], esi
push eax
call fcn.10008214
push ecx
push ecx
lea eax, [esp + 0xd4]
mov byte [esp + 0x15c], 0xa
push eax
lea ecx, [esp + 0xc0]
call fcn.10009b5b
push esi
push ebx
lea ecx, [esp + 0xd4]
mov byte [esp + 0x15c], 9
call fcn.10008371
xor eax, eax
lea edi, [esp + 0x88]
stosd dword es:[edi], eax
mov edx, 0x2396
push 0x602e
push 0x36e7
push ebx
stosd dword es:[edi], eax
mov ecx, 0x4409
push 0x9ce
stosw word es:[edi], ax
lea eax, [esp + 0x2f]
push eax
push ebx
push 0xb9b
push ebx
call fcn.1000622a
add esp, 0x20
lea edx, [esp + 0x64]
lea ecx, [esp + 0xb4]
call fcn.1000427b
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov dword [esp + 0x20], 0x6d0b
cmp dword [esp + 0x20], 0x6f61
jle 0x10006bb6
mov dword [esp + 0x10], esi
xor edi, edi
xor eax, eax
mov dword [esp + 0x18], esi
mov ecx, edi
mov dword [esp + 0x24], eax
shl esi, cl
mov dword [esp + 0x18], esi
mov ecx, eax
mov dword [esp + 0x20], esi
xor ebx, ebx
shl esi, cl
mov eax, esi
mov ecx, 0x10082178
or eax, ebx
cdq
push edx
push eax
call fcn.100073fb
inc ebx
cmp ebx, 0x7f00
jl 0x10006b69
mov eax, dword [esp + 0x24]
mov esi, dword [esp + 0x18]
inc eax
mov dword [esp + 0x24], eax
cmp eax, 0x666a
jl 0x10006b5f
mov esi, dword [esp + 0x10]
inc edi
cmp edi, 0x31c
jl 0x10006b4d
inc esi
mov dword [esp + 0x10], esi
cmp esi, 0x1d22
jl 0x10006b4b
xor ebx, ebx
inc ebx
xor esi, esi
push esi
push ebx
lea ecx, [esp + 0xbc]
call fcn.10008371
push esi
push ebx
lea ecx, [esp + 0x108]
call fcn.10008371
push esi
push ebx
lea ecx, [esp + 0xa4]
call fcn.10008371
push esi
push ebx
lea ecx, [esp + 0x6c]
call fcn.10008371
lea ecx, [esp + 0x50]
call fcn.100086d1
jmp 0x10006c25
mov eax, dword [ebp + 0xc]
mov dword [eax], 1
jmp 0x10006c25
mov edx, dword [ebp + 0x1c]
xor ebx, ebx
inc ebx
mov dword [edx], 0
cmp dword [edx], ebx
jge 0x10006c25
mov esi, dword [ebp + 0x18]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x50bf
inc dword [edx]
cmp dword [edx], ebx
jl 0x10006c14
mov ecx, dword [esp + 0x14c]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret