Function at 0x1003c0f0
Capabilities:
Encode data using xor
Get graphical window text
Hash data using fnv

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f970b
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x258
mov eax, dword [0x1013c014]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [ebx + 0x1c], 0
mov ecx, dword [ebx + 0x14]
mov edx, dword [ebx + 0x18]
mov dword [ebp - 0x25c], ecx
mov dword [ebp - 0x258], edx
jne 0x1003d213
mov eax, dword [edi + 0xa8]
mov esi, dword [ebx + 0x10]
test eax, eax
je 0x1003c17b
mov eax, dword [eax]
push edx
push ecx
push esi
push dword [ebx + 0xc]
push dword [edi + 0xa8]
call dword [eax + 0x1c]
test eax, eax
jne 0x1003c195
mov eax, 1
jmp 0x1003d215
mov eax, dword [edi + 0xa4]
test eax, eax
je 0x1003c19b
mov eax, dword [eax]
push ecx
push esi
push dword [ebx + 0xc]
push dword [edi + 0xa4]
call dword [eax + 0x18]
mov edx, dword [ebp - 0x258]
mov eax, dword [ebx + 0xc]
lea ecx, [edi - 8]
cmp eax, 1
jne 0x1003c1c0
sub esp, 0x10
call fcn.10059070
mov ecx, dword [ebp - 0x258]
mov dword [ecx], eax
mov eax, 1
jmp 0x1003d215
mov dword [ebp - 0x260], ecx
mov ecx, dword [ebp - 0x25c]
cmp eax, 2
jne 0x1003c1f1
mov ecx, dword [ebp - 0x260]
sub esp, 0x10
call fcn.1005ce30
mov ecx, dword [ebp - 0x258]
mov dword [ecx], eax
mov eax, 1
jmp 0x1003d215
cmp eax, 0x18
jne 0x1003c282
test esi, esi
jne 0x1003c21b
cmp byte [edi + 0x28], 0
jne 0x1003c21b
mov eax, dword [0x1013fb2c]
test eax, eax
je 0x1003c21b
push esi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [ebp - 0x258]
mov dword [edx], 0
mov ecx, dword [ebx + 0x10]
mov esi, dword [ebp - 0x25c]
mov eax, dword [ebx + 0xc]
cmp eax, dword [0x1014b52c]
jne 0x1003d141
test esi, esi
je 0x1003c272
movups xmm0, xmmword [esi]
mov eax, dword [esi + 0x38]
mov dword [0x1014b5b8], eax
movups xmmword [0x1014b580], xmm0
movups xmm0, xmmword [esi + 0x10]
movups xmmword [0x1014b590], xmm0
movups xmm0, xmmword [esi + 0x20]
movups xmmword [0x1014b5a0], xmm0
movq xmm0, qword [esi + 0x30]
movq qword [0x1014b5b0], xmm0
mov dword [edx], 0
mov eax, 1
jmp 0x1003d215
cmp eax, 0xf
jne 0x1003c2a8
push ecx
push ecx
push esi
push eax
mov ecx, dword [ebp - 0x260]
call fcn.10070720
mov ecx, dword [ebp - 0x258]
mov dword [ecx], eax
mov eax, 1
jmp 0x1003d215
cmp eax, 0x318
jne 0x1003c2b5
push ecx
push ecx
push esi
push eax
jmp 0x1003c28b
cmp eax, 0x14
jne 0x1003c2ca
mov dword [edx], 1
mov eax, 1
jmp 0x1003d215
cmp eax, 6
jne 0x1003c3d2
test si, si
je 0x1003c30e
mov eax, dword [0x1014c168]
test eax, eax
je case.0x1003ca67.4
push 0x13
push 0
push 0
push 0
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 0x258]
mov eax, 1
mov dword [ecx], 0
jmp 0x1003d215
cmp byte [0x1014b4ee], 0
jne case.0x1003ca67.4
mov esi, dword [0x1014c068]
test ecx, ecx
je 0x1003c366
mov eax, dword [0x1014c064]
cmp eax, esi
je 0x1003c34e
nop
mov edi, dword [eax]
cmp dword [edi + 0xc], ecx
je 0x1003d063
cmp dword [edi + 0x1a4], ecx
je 0x1003d063
add eax, 4
cmp eax, esi
jne 0x1003c330
cmp ecx, dword [sym.ExplorerShellDLL32.dll_struct_HWND____g_OwnerWindow]
je 0x1003d063
cmp ecx, dword [0x1014b4b0]
je 0x1003d063
mov edi, dword [sym.imp.USER32.dll_PostMessageW]
cmp esi, dword [0x1014c064]
je 0x1003c3a1
mov eax, dword [esi - 4]
add esi, 0xfffffffc
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x1003c399
cmp byte [eax + 0x31], 0
jne 0x1003c399
push 0
push 0
push 0x10
push ecx
call edi
mov eax, dword [esi]
mov byte [eax + 0x196], 1
cmp esi, dword [0x1014c064]
jne 0x1003c374
mov eax, dword [0x1014b4b0]
test eax, eax
je case.0x1003ca67.4
cmp byte [0x1014b4d0], 0
je case.0x1003ca67.4
push 0
push 0
push 0x10
push eax
call edi
mov ecx, dword [ebp - 0x258]
mov eax, 1
mov dword [ecx], 0
jmp 0x1003d215
cmp eax, 0x21
jne 0x1003c418
cmp dword [edi + 0x44], 0
jge 0x1003c3f0
test dword [edi + 0x34], 0x400000
jne 0x1003c3f0
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
jmp 0x1003c3ff
mov ecx, 3
mov dword [ebp - 0x21c], 1
cmp dword [ebp - 0x21c], 0
mov dword [edx], ecx
je 0x1003c4dd
mov eax, 1
jmp 0x1003d215
cmp eax, 0x200
jne 0x1003c442
lea ecx, [edi - 8]
push ecx
push dword [ebp - 0x25c]
push esi
push ecx
call fcn.1005d7a0
mov ecx, dword [ebp - 0x258]
mov dword [ecx], eax
mov eax, 1
jmp 0x1003d215
cmp eax, 0x2a3
jne 0x1003c4a8
cmp byte [edi + 0x2a], 0
je 0x1003c492
push 0
push 0
lea ecx, [edi - 8]
call fcn.10058ea0
push 0
push 0
push 0xffffffffffffffff
lea ecx, [edi - 8]
call fcn.10059a50
cmp dword [edi + 0xdc], 0xffffffff
mov byte [edi + 0x2a], 0
mov byte [edi + 0x18d], 0
je 0x1003c492
push 1
push dword [edi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
mov dword [edi + 0xdc], 0xffffffff
mov ecx, dword [ebp - 0x258]
mov eax, 1
mov dword [ecx], 0
jmp 0x1003d215
cmp eax, 0x20a
jne 0x1003c50b
push ecx
push ecx
push esi
push eax
lea ecx, [edi - 8]
mov dword [ebp - 0x21c], 1
call fcn.1005daa0
cmp dword [ebp - 0x21c], 0
mov edx, dword [ebp - 0x258]
mov dword [edx], eax
jne 0x1003c29e
mov eax, dword [ebx + 0xc]
cmp eax, 0x100
jne 0x1003cae6
lea ecx, [edi - 8]
push ecx
push dword [ebp - 0x25c]
push esi
push ecx
call fcn.1005b3d0
mov ecx, dword [ebp - 0x258]
mov dword [ecx], eax
mov eax, 1
jmp 0x1003d215
cmp eax, 0x201
jne 0x1003c534
push ecx
push ecx
mov ecx, dword [ebp - 0x260]
sub esp, 8
call fcn.1005e530
mov ecx, dword [ebp - 0x258]
mov dword [ecx], eax
mov eax, 1
jmp 0x1003d215
cmp eax, 0x203
jne 0x1003c62a
add edi, 0xfffffff8
cmp dword [edi + 0xdc], 0xffffffff
je 0x1003c555
mov dword [edi + 0xdc], 0xffffffff
movsx eax, cx
mov dword [ebp - 0x220], eax
mov eax, ecx
shr eax, 0x10
mov ecx, edi
cwde
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x265]
push 0
push eax
lea eax, [ebp - 0x220]
push eax
call fcn.10059730
mov dword [ebp - 0x260], eax
test eax, eax
js case.0x1003ca67.4
imul esi, eax, 0x54
add esi, dword [edi + 0xa0]
cmp dword [esi], 1
je case.0x1003ca67.4
lea eax, [ebp - 0x220]
push eax
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_ClientToScreen]
cmp byte [0x1014b4d1], 0
je 0x1003c5e6
cmp dword [esi], 9
jne 0x1003c5e6
push ecx
push dword [ebp - 0x25c]
mov ecx, edi
sub esp, 8
call fcn.1005e530
mov ecx, dword [ebp - 0x258]
mov eax, 1
mov dword [ecx], 0
jmp 0x1003d215
cmp byte [ebp - 0x265], 0
jne case.0x1003ca67.4
cmp dword [esi], 0xa
je case.0x1003ca67.4
push 0
lea eax, [ebp - 0x220]
push eax
push 4
push dword [ebp - 0x260]
mov ecx, edi
call fcn.10040810
mov ecx, dword [ebp - 0x258]
mov eax, 1
mov dword [ecx], 0
jmp 0x1003d215
cmp eax, 0x202
jne 0x1003c655
lea ecx, [edi - 8]
push ecx
push dword [ebp - 0x25c]
sub esp, 8
call fcn.1005e740
mov ecx, dword [ebp - 0x258]
mov dword [ecx], eax
mov eax, 1
jmp 0x1003d215
cmp eax, 0x204
jne 0x1003c738
call dword [sym.imp.USER32.dll_GetCapture]
test eax, eax
jne case.0x1003ca67.4
mov ecx, dword [ebp - 0x25c]
movsx eax, cx
shr ecx, 0x10
cmp dword [edi + 0xd4], 0xffffffff
mov dword [ebp - 0x264], eax
movsx eax, cx
mov dword [ebp - 0x260], eax
je 0x1003c69c
mov dword [edi + 0xd4], 0xffffffff
push 0
push 0
lea eax, [ebp - 0x264]
push eax
lea ecx, [edi - 8]
call fcn.10059730
mov esi, eax
test esi, esi
js 0x1003c6c4
mov ecx, dword [edi + 0x98]
imul edx, esi, 0x54
cmp dword [edx + ecx], 1
jmp 0x1003c6df
push dword [ebp - 0x260]
lea eax, [edi + 0x154]
push dword [ebp - 0x264]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je case.0x1003ca67.4
cmp dword [edi + 0xd4], esi
je 0x1003c719
mov dword [edi + 0xd4], esi
test esi, esi
js 0x1003c719
lea eax, [ebp - 0x234]
push eax
push esi
lea ecx, [edi - 8]
call fcn.10059640
push 1
lea eax, [ebp - 0x234]
push eax
push dword [edi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetCapture]
mov ecx, dword [ebp - 0x258]
mov eax, 1
mov dword [ecx], 0
jmp 0x1003d215
cmp eax, 0x205
jne 0x1003c8a9
add edi, 0xfffffff8
call dword [sym.imp.USER32.dll_GetCapture]
cmp eax, dword [edi + 0xc]
jne case.0x1003ca67.4
call dword [sym.imp.USER32.dll_ReleaseCapture]
cmp byte [0x1014b62a], 0
jne case.0x1003ca67.4
mov ecx, dword [ebp - 0x25c]
movsx eax, cx
mov dword [ebp - 0x220], eax
shr ecx, 0x10
movsx eax, cx
mov ecx, edi
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x260]
push 0
push eax
lea eax, [ebp - 0x220]
mov byte [ebp - 0x260], 0
push eax
call fcn.10059730
mov esi, eax
test esi, esi
js 0x1003c7d1
mov ecx, dword [edi + 0xa0]
imul edx, esi, 0x54
mov eax, dword [edx + ecx]
cmp eax, 1
je case.0x1003ca67.4
cmp eax, 0x30
jne 0x1003c7c8
cmp dword [edx + ecx + 0x48], 4
jae 0x1003c7f2
mov byte [ebp - 0x260], 0
jmp 0x1003c7f2
push dword [ebp - 0x21c]
lea eax, [edi + 0x15c]
push dword [ebp - 0x220]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je case.0x1003ca67.4
push 1
push dword [ebp - 0x260]
mov ecx, edi
push esi
call fcn.10059a50
lea eax, [ebp - 0x220]
push eax
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_ClientToScreen]
mov dword [ebp - 0x230], 0
mov word [ebp - 0x238], 0
mov word [ebp - 0x23b], 0
mov byte [ebp - 0x23c], 0
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x234], 0
mov dword [ebp - 4], 0
mov ecx, edi
mov al, byte [ebp - 0x260]
mov byte [ebp - 0x239], al
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x220]
push eax
push 5
push esi
call fcn.10040810
mov eax, dword [ebp - 0x230]
test eax, eax
je case.0x1003ca67.4
push eax
call dword [sym.imp.SHELL32.dll_ILFree]
mov ecx, dword [ebp - 0x258]
mov eax, 1
mov dword [ecx], 0
jmp 0x1003d215
cmp eax, 0x20
jne 0x1003c990
mov eax, dword [edi + 0x134]
lea esi, [edi + 0x134]
mov ecx, dword [sym.imp.USER32.dll_GetMessagePos]
cmp eax, dword [edi + 0x13c]
jge 0x1003c90e
call ecx
movsx ecx, ax
shr eax, 0x10
cwde
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x264]
push eax
push dword [edi + 4]
mov dword [ebp - 0x264], ecx
call dword [sym.imp.USER32.dll_ScreenToClient]
push dword [ebp - 0x260]
push dword [ebp - 0x264]
push esi
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x1003c966
mov ecx, dword [sym.imp.USER32.dll_GetMessagePos]
mov eax, dword [edi + 0x144]
lea esi, [edi + 0x144]
cmp eax, dword [edi + 0x14c]
jge 0x1003c215
call ecx
movsx ecx, ax
shr eax, 0x10
cwde
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x220]
push eax
push dword [edi + 4]
mov dword [ebp - 0x220], ecx
call dword [sym.imp.USER32.dll_ScreenToClient]
push dword [ebp - 0x21c]
push dword [ebp - 0x220]
push esi
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x1003c215
push 0x7f89
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov ecx, dword [ebp - 0x258]
mov eax, 1
mov dword [ecx], 1
jmp 0x1003d215
cmp eax, 0x7b
jne 0x1003ca44
add edi, 0xfffffff8
cmp byte [0x1014b62a], 0
jne case.0x1003ca67.4
movsx esi, cx
shr ecx, 0x10
movsx eax, cx
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x21c], eax
cmp esi, 0xffffffff
jne 0x1003c9de
cmp eax, esi
jne 0x1003c9de
mov eax, dword [edi + 0x54]
test eax, eax
js 0x1003d063
push 0
push 0
push 5
push eax
jmp 0x1003c60d
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x264]
push eax
push dword [edi + 0xc]
mov dword [ebp - 0x264], esi
call dword [sym.imp.USER32.dll_ScreenToClient]
push 0
push 0
lea eax, [ebp - 0x264]
mov ecx, edi
push eax
call fcn.10059730
mov esi, eax
test esi, esi
jns 0x1003ca33
push dword [ebp - 0x260]
lea ecx, [edi + 0x15c]
push dword [ebp - 0x264]
push ecx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je case.0x1003ca67.4
push 0
lea eax, [ebp - 0x220]
push eax
push 5
push esi
jmp 0x1003c60d
cmp eax, 0x115
jne 0x1003c4dd
mov eax, dword [edi + 0x1d0]
movzx ecx, si
mov dword [ebp - 0x260], eax
cmp ecx, 7
ja case.0x1003ca67.4
jmp dword [ecx*4 + 0x1003d484]
xor esi, esi
jmp 0x1003ca9b
mov esi, dword [edi + 0x1c8]
jmp 0x1003ca9b
lea esi, [eax - 1]
jmp 0x1003ca9b
lea esi, [eax + 1]
jmp 0x1003ca9b
mov esi, eax
sub esi, dword [edi + 0x1cc]
jmp 0x1003ca9b
mov esi, dword [edi + 0x1cc]
add esi, eax
jmp 0x1003ca9b
shr esi, 0x10
push 1
push esi
push 2
push dword [edi + 0x1d4]
call dword [sym.imp.USER32.dll_SetScrollPos]
mov dword [edi + 0x1d0], eax
cmp eax, dword [ebp - 0x260]
je case.0x1003ca67.4
push 1
lea eax, [edi + 0x114]
push eax
push dword [edi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov ecx, dword [ebp - 0x258]
mov eax, 1
mov dword [ecx], 0
jmp 0x1003d215
cmp eax, 0x104
jne 0x1003cb74
cmp esi, 0xd
jne 0x1003cb5a
mov esi, dword [edi + 0x4c]
test esi, esi
js 0x1003cb5a
mov eax, dword [edi + 0x98]
imul ecx, esi, 0x54
cmp dword [ecx + eax + 0x38], 0
je 0x1003cb53
cmp dword [ecx + eax + 0x3c], 0
jne 0x1003cb53
push 0
lea eax, [ebp - 0x220]
mov dword [ebp - 0x220], 0
push eax
push 9
push esi
lea ecx, [edi - 8]
mov dword [ebp - 0x21c], 0
call fcn.10040810
push 0
push esi
push 0x40e
push dword [edi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
mov edx, dword [ebp - 0x258]
mov eax, 1
jmp 0x1003cb5c
xor eax, eax
mov dword [edx], 0
test eax, eax
je 0x1003c221
mov eax, 1
jmp 0x1003d215
cmp eax, 0x102
jne 0x1003cb9e
lea ecx, [edi - 8]
push ecx
push dword [ebp - 0x25c]
push esi
push ecx
call fcn.1005ca40
mov ecx, dword [ebp - 0x258]
mov dword [ecx], eax
mov eax, 1
jmp 0x1003d215
cmp eax, 0x106
jne 0x1003cbcb
push ecx
push dword [ebp - 0x25c]
push esi
push ecx
mov ecx, dword [ebp - 0x260]
call fcn.1005ca40
mov ecx, dword [ebp - 0x258]
mov dword [ecx], eax
mov eax, 1
jmp 0x1003d215
cmp eax, 0x113
jne 0x1003cbf4
sub esp, 8
push esi
push ecx
mov ecx, dword [ebp - 0x260]
call fcn.1005ab00
mov ecx, dword [ebp - 0x258]
mov dword [ecx], eax
mov eax, 1
jmp 0x1003d215
cmp eax, 0x112
jne 0x1003cc30
mov ecx, dword [ebx + 0x10]
mov eax, ecx
and eax, 0xfff0
cmp eax, 0xf100
jne 0x1003cc71
push 1
call fcn.1005a750
mov ecx, dword [ebp - 0x258]
mov eax, 1
mov byte [0x1014b62b], 0
mov dword [ecx], 0
jmp 0x1003d215
cmp eax, 0x1a
jne 0x1003cc7c
mov ecx, dword [ebx + 0x10]
cmp ecx, 0x2f
jne 0x1003cc71
cmp byte [edi + 0x28], 0
jne 0x1003cc71
cmp byte [edi + 0x2c], 0
jne 0x1003cc71
cmp byte [0x1014b4ff], 0
jne 0x1003cc71
push 0
push 0
push 0x40f
mov byte [edi + 0x2c], 1
push dword [edi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [ebx + 0x10]
mov edx, dword [ebp - 0x258]
mov dword [edx], 0
jmp 0x1003c224
cmp eax, 0x7e
jne 0x1003ccbd
cmp byte [edi + 0x28], 0
jne 0x1003c21b
cmp byte [edi + 0x2c], 0
jne 0x1003c21b
cmp byte [0x1014b4ff], 0
jne 0x1003c21b
push 0
push 0
push 0x40f
mov byte [edi + 0x2c], 1
push dword [edi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x1003c215
cmp eax, 0x3d
jne 0x1003ccfc
cmp dword [ebp - 0x25c], 0xfffffffc
jne 0x1003c21b
mov eax, dword [edi + 0x80]
test eax, eax
je 0x1003c21b
push eax
push esi
push 0x10103d20
call dword [sym.imp.OLEACC.dll_LresultFromObject]
mov ecx, dword [ebp - 0x258]
mov dword [ecx], eax
mov eax, 1
jmp 0x1003d215
cmp eax, 0x133
jne 0x1003cd5f
cmp byte [edi + 0x18a], 0
jne 0x1003cd1e
push 0
push 0
push 0x40c
push dword [edi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
push dword [0x1014e714]
push esi
call dword [sym.imp.GDI32.dll_SetTextColor]
push dword [0x1014e71c]
push esi
call dword [sym.imp.GDI32.dll_SetBkColor]
push dword [0x1014e71c]
push esi
call dword [sym.imp.GDI32.dll_SetDCBrushColor]
push 0x12
call dword [sym.imp.GDI32.dll_GetStockObject]
mov ecx, dword [ebp - 0x258]
mov dword [ecx], eax
mov eax, 1
jmp 0x1003d215
cmp eax, 0x119
jne 0x1003cda8
mov esi, dword [ebp - 0x25c]
lea eax, [ebp - 0x21c]
push eax
push esi
sub esp, 8
mov dword [ebp - 0x21c], 1
lea ecx, [edi - 8]
call fcn.1005a000
cmp dword [ebp - 0x21c], 0
mov edx, dword [ebp - 0x258]
mov dword [edx], eax
je 0x1003cf0d
mov eax, 1
jmp 0x1003d215
cmp eax, 0x11a
jne 0x1003cf15
cmp byte [0x1014b503], 0
mov esi, dword [ebp - 0x25c]
je 0x1003cf07
mov eax, dword [esi + 8]
mov ecx, dword [edi + 4]
cmp eax, ecx
jne 0x1003ce92
movsx eax, word [esi + 0xc]
mov dword [ebp - 0x264], eax
movsx eax, word [esi + 0xe]
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x264]
push eax
push ecx
call dword [sym.imp.USER32.dll_ScreenToClient]
push 0
push 0
lea eax, [ebp - 0x264]
lea ecx, [edi - 8]
push eax
call fcn.10059730
test eax, eax
js 0x1003ce62
cmp eax, dword [edi + 0x170]
jge 0x1003ce1e
cmp dword [edi + 0x174], 0
jg 0x1003ce2f
cmp eax, dword [edi + 0x1c0]
jl 0x1003ce62
cmp dword [edi + 0x1c8], 0
jle 0x1003ce62
push 0xc
lea eax, [ebp - 0x224]
mov dword [ebp - 0x224], 4
push eax
push 1
push 0
push dword [esi + 8]
mov dword [ebp - 0x220], 0x12
mov dword [ebp - 0x21c], 4
jmp 0x1003cefb
push 0xc
lea eax, [ebp - 0x248]
mov dword [ebp - 0x248], 0
push eax
push 1
push 0
push dword [esi + 8]
mov dword [ebp - 0x244], 0
mov dword [ebp - 0x240], 1
jmp 0x1003cefb
mov ecx, dword [edi + 0x1b0]
test ecx, ecx
je 0x1003cec7
cmp eax, dword [ecx + 8]
jne 0x1003cec7
mov dword [ebp - 0x254], 0
lea ecx, [ebp - 0x254]
mov dword [ebp - 0x250], 1
mov dword [ebp - 0x24c], 0
jmp 0x1003cef3
cmp eax, dword [edi + 0x1d4]
jne 0x1003cf07
mov dword [ebp - 0x230], 0
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x228], 1
push 0xc
push ecx
push 1
push 0
push eax
call dword [sym.imp.USER32.dll_SetGestureConfig]
mov edx, dword [ebp - 0x258]
mov dword [edx], 0
mov ecx, dword [ebx + 0x10]
jmp 0x1003c22a
cmp eax, 0x40a
jne 0x1003cf39
sub esp, 0x10
lea ecx, [edi - 8]
call fcn.1005d430
mov ecx, dword [ebp - 0x258]
mov dword [ecx], eax
mov eax, 1
jmp 0x1003d215
cmp eax, 0x40b
jne 0x1003cfda
mov edx, dword [edi + 0x98]
lea eax, [edi - 8]
mov ecx, dword [eax + 0xa4]
xor edi, edi
sub ecx, edx
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x260], edx
mov eax, 0x30c30c31
imul ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
test ecx, ecx
jle case.0x1003ca67.4
mov eax, dword [ebp - 0x260]
add eax, 0xc
cmp dword [eax], esi
je 0x1003cfa7
inc edi
add eax, 0x54
cmp edi, ecx
jl 0x1003cf85
mov ecx, dword [ebp - 0x258]
mov eax, 1
mov dword [ecx], 0
jmp 0x1003d215
mov ecx, dword [ebp - 0x21c]
cmp dword [ecx + 0xec], edi
je case.0x1003ca67.4
mov dword [ecx + 0xec], edi
call fcn.10059df0
mov ecx, dword [ebp - 0x258]
mov eax, 1
mov dword [ecx], 0
jmp 0x1003d215
cmp eax, 0x40c
jne 0x1003d00c
push 0x105
push 0
push 0
push dword [edi + 0x19c]
call dword [sym.imp.USER32.dll_RedrawWindow]
mov ecx, dword [ebp - 0x258]
mov eax, 1
mov dword [ecx], 0
jmp 0x1003d215
cmp eax, 0x40d
jne 0x1003d073
mov esi, dword [0x1014c064]
cmp esi, dword [0x1014c068]
je 0x1003d063
mov eax, dword [esi]
cmp byte [eax + 0x31], 0
jne 0x1003d052
push 1
push 0
push dword [eax + 0xc]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, dword [edi + 0x1b0]
test eax, eax
je 0x1003d052
mov eax, dword [eax + 8]
test eax, eax
je 0x1003d052
push 1
push 0
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
add esi, 4
cmp esi, dword [0x1014c068]
jne 0x1003d021
mov edx, dword [ebp - 0x258]
mov dword [edx], 0
mov eax, 1
jmp 0x1003d215
cmp eax, 0x40e
jne 0x1003d119
mov ecx, dword [edi + 0x9c]
mov eax, 0x30c30c31
sub ecx, dword [edi + 0x98]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp esi, eax
jge 0x1003d0d1
nop
push 0
push esi
lea ecx, [edi - 8]
call fcn.1005b2c0
test al, al
jne 0x1003d0d1
mov ecx, dword [edi + 0x9c]
mov eax, 0x30c30c31
sub ecx, dword [edi + 0x98]
inc esi
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp esi, eax
jl 0x1003d0a0
mov ecx, dword [edi + 0x9c]
mov eax, 0x30c30c31
sub ecx, dword [edi + 0x98]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp esi, eax
jge case.0x1003ca67.4
push 1
push 0
push esi
lea ecx, [edi - 8]
call fcn.10059a50
mov ecx, dword [ebp - 0x258]
mov eax, 1
mov dword [ecx], 0
jmp 0x1003d215
cmp eax, 0x40f
jne 0x1003c221
sub esp, 0x10
lea ecx, [edi - 8]
call fcn.1005a8f0
mov ecx, dword [ebp - 0x258]
mov dword [ecx], eax
mov eax, 1
jmp 0x1003d215
cmp eax, 0x246
jne 0x1003d235
cmp byte [0x1014b503], 0
mov dword [edi + 0x1e4], 0
je 0x1003d1d2
shr ecx, 0x10
test cl, 4
je 0x1003d1d2
test ecx, 0x2000
je 0x1003d1d2
test cl, 0x10
je 0x1003d1d2
movsx eax, si
mov dword [ebp - 0x264], eax
mov eax, esi
shr eax, 0x10
cwde
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x264]
push eax
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ScreenToClient]
push 1
lea eax, [ebp - 0x264]
push eax
lea ecx, [edi - 8]
call fcn.10058ea0
cmp byte [edi + 0x189], 0
je 0x1003d1d2
mov ecx, dword [ebp - 0x258]
mov esi, dword [ebx + 0x10]
movzx eax, si
mov dword [edi + 0x1e4], eax
mov eax, 1
mov dword [ecx], 0
jmp 0x1003d215
mov eax, dword [ebp - 0x258]
mov dword [eax], 0
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x21c], 1
push eax
push esi
mov esi, dword [ebx + 0x10]
mov ecx, edi
push esi
push dword [ebx + 0xc]
call fcn.10047820
cmp dword [ebp - 0x21c], 0
mov ecx, dword [ebp - 0x258]
mov dword [ecx], eax
jne 0x1003c171
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100d4906
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x18
cmp eax, 0x245
jne 0x1003d32e
cmp byte [0x1014b503], 0
lea eax, [edi - 8]
mov dword [ebp - 0x260], eax
je 0x1003d323
movzx eax, cx
cmp dword [edi + 0x1e4], eax
jne 0x1003d323
shr ecx, 0x10
test cl, 4
je 0x1003d2c3
test cl, 0x10
je 0x1003d2c3
movsx eax, si
mov dword [ebp - 0x220], eax
shr esi, 0x10
movsx eax, si
mov esi, dword [ebp - 0x260]
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x220]
push eax
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_ScreenToClient]
push 1
lea eax, [ebp - 0x220]
mov ecx, esi
push eax
call fcn.10058ea0
mov eax, dword [ebp - 0x258]
mov dword [eax], 0
mov eax, 1
jmp 0x1003d215
mov esi, dword [ebp - 0x260]
push 3
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_KillTimer]
cmp byte [esi + 0x18e], 0
mov byte [esi + 0x191], 0
jne 0x1003d2ed
cmp byte [esi + 0x18f], 0
je 0x1003d303
push 1
push 0
mov word [esi + 0x18e], 0
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, dword [ebp - 0x258]
mov dword [esi + 0x1ec], 0
mov dword [eax], 0
mov eax, 1
jmp 0x1003d215
mov dword [edx], 0
jmp 0x1003d1de
cmp eax, 0x247
jne 0x1003d3a3
cmp byte [0x1014b503], 0
je 0x1003d323
movzx eax, cx
cmp dword [edi + 0x1e4], eax
jne 0x1003d323
push 3
push dword [edi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
cmp byte [edi + 0x186], 0
mov byte [edi + 0x189], 0
jne 0x1003d36d
cmp byte [edi + 0x187], 0
je 0x1003d383
push 1
push 0
mov word [edi + 0x186], 0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, dword [ebp - 0x258]
mov dword [edi + 0x1e4], 0
mov dword [eax], 0
mov eax, 1
jmp 0x1003d215
cmp eax, 0x111
jne 0x1003d1de
mov eax, ecx
mov ecx, 0x300
shr eax, 0x10
cmp cx, ax
jne 0x1003d1de
push 0x105
push 0
push 0
push dword [edi + 0x19c]
mov byte [0x1014b4fe], 0
call dword [sym.imp.USER32.dll_RedrawWindow]
push 0x100
lea eax, [ebp - 0x218]
push eax
push dword [edi + 0x19c]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0x100
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHELL32.dll_DoEnvironmentSubstW]
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1003d410
sub ecx, edx
mov esi, 0x811c9dc5
sar ecx, 1
lea edx, [ecx + ecx]
xor ecx, ecx
test edx, edx
jle 0x1003d445
nop dword [eax]
movzx eax, byte [ebp + ecx - 0x218]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jl 0x1003d430
cmp dword [edi + 0x1a0], esi
je 0x1003d465
cmp byte [edi + 0x18c], 0
jne 0x1003d465
push 0
push 0x64
push 7
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
mov eax, dword [ebp - 0x258]
mov dword [edi + 0x1a0], esi
mov dword [eax], 0
mov eax, 1
jmp 0x1003d215