Function at 0x100025f0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get common file path
Read .ini file
Read file on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x1002500c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x208
call fcn.1000e565
add esp, 4
mov esi, eax
push 0x100268e0
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push str.Drama233.ini
push 0x100268e0
push str._ls_ls
push 0x100266c0
call dword [sym.imp.USER32.dll_wsprintfW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
add esp, 0x10
push 0x100266c0
push 0x104
push 0x100264a0
push 0x10022d04
push 0x10022e40
push str.FileName
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0x100266c0
push 0
push str.CreateFontIndirect
push str.Settings
call edi
push 0x100266c0
push 0
push str.CreateFont
push str.Settings
mov dword [0x10026b44], eax
call edi
push 0x100266c0
push 0
push 0x10022eb0
push str.Settings
mov dword [0x10026b48], eax
call edi
push 0x100266c0
push 0
push 0x10022ed8
push str.Settings
mov dword [0x10026b4c], eax
call edi
push 0x100266c0
push 0
push 0x10022bec
push str.Settings
mov dword [0x10026b50], eax
call edi
push 0x100266c0
push 1
push str.CreateWindowEx
push str.Settings
mov dword [0x10026b54], eax
call edi
push 0x100266c0
push 0
push 0x10022f20
push str.Settings
mov dword [0x10026b70], eax
call edi
push 0x100266c0
push 0
push 0x10022f38
push str.Settings
mov dword [0x10026b58], eax
call edi
push 0x100266c0
push 0
push 0x10022f50
push str.Settings
mov dword [0x10026b5c], eax
call edi
push 0x100266c0
mov dword [0x10026b60], eax
push 0
push 0x10022f70
push str.Settings
call edi
push 0x100266c0
push 0
push 0x10022f90
push str.Settings
mov dword [0x10026b64], eax
call edi
push 0x100266c0
push 0
push 0x10022fa8
push str.Settings
mov dword [0x10026b68], eax
call edi
push 0x100266c0
push 0
push 0x10022d70
push str.Settings
mov dword [0x10026b6c], eax
call edi
push 0x100266c0
push 0
push str.EnumFontFamiliesA
push str.Settings
mov dword [0x10026b74], eax
call edi
push 0x100266c0
push 0
push str.EnumFontFamiliesEx
push str.Settings
mov dword [0x10026b78], eax
call edi
push 0x100266c0
push 0
push str.BorderPatch
push str.Settings
mov dword [0x10026b7c], eax
call edi
push 0x100266c0
push 0
push str.ChangeFace
push str.Settings
mov dword [0x10026b8c], eax
call edi
push 0x100266c0
push 0
push 0x10023024
push str.Settings
mov dword [0x10026b90], eax
call edi
push 0x100266c0
push 0
push 0x10023038
push str.Settings
mov dword [0x10026b94], eax
call edi
push 0x100266c0
push 0
push 0x10022c44
push str.Settings
mov dword [0x10026b98], eax
call edi
push 0x100266c0
push 0
push 0x1002304c
push str.Settings
mov dword [0x10026b9c], eax
call edi
push 0x100266c0
push 0
push str.GetDriveType
push str.Settings
mov dword [0x10026ba0], eax
call edi
push 0x100266c0
push 0
push str.FindFirstFile
push str.Settings
mov dword [0x10026b80], eax
call edi
push 0x100266c0
push 0
push 0x10022d20
push str.Settings
mov dword [0x10026b88], eax
call edi
push 0x100266c0
push 0
push 0x10023098
push str.Settings
mov dword [0x10026b84], eax
call edi
push 0x100266c0
push 0
push str.Drama233_Log
push str.Settings
mov dword [0x10026b40], eax
call edi
push 0x100266c0
push 0
push str.Drama233_Plus
push str.Settings
mov dword [0x10026ba4], eax
call edi
cmp dword [0x10026b40], 0
mov dword [0x10026ba8], eax
je 0x10002909
call fcn.10005c50
test eax, eax
je 0x10004576
cmp dword [0x10026ba4], 0
je 0x100029c0
push 0x100266c0
push 0xa
push esi
push 0
push str.Log_Mode
push str.Drama233_Log
call ebx
push 4
push str.CHAR
push esi
call fcn.1000e52b
add esp, 0xc
test eax, eax
jne 0x10002959
push 0x10023128
push str.Drama233_Char.log
call fcn.1000b634
add esp, 8
mov dword [0x100263f4], eax
jmp 0x100029c0
push 5
push str.WCHAR
push esi
call fcn.1000e52b
add esp, 0xc
test eax, eax
jne 0x10002981
push str.wt_ccsUNICODE
push str.Drama233_Wchar.log
call fcn.1000b634
add esp, 8
jmp 0x100029bb
push 3
push 0x10023170
push esi
call fcn.1000e52b
add esp, 0xc
test eax, eax
jne 0x100029c0
push 0x10023128
push str.Drama233_Char.log
call fcn.1000b634
push str.wt_ccsUNICODE
push str.Drama233_Wchar.log
mov dword [0x100263f4], eax
call fcn.1000b634
add esp, 0x10
mov dword [0x10026408], eax
cmp dword [0x10026ba8], 0
je 0x10002d71
push 0x100266c0
push 0x14
push esi
push 0
push str.Plus_Engine
push str.Drama233_Plus
call ebx
push 9
push str.RioShiina
push esi
call fcn.1000e52b
add esp, 0xc
test eax, eax
jne 0x10002bae
push 0x100266c0
push 0x14
push esi
push eax
push str.RS_pGetFileName
push str.Drama233_Plus
call ebx
push 2
push 0x10022b9c
push esi
call fcn.1000e52b
add esp, 0xc
test eax, eax
je 0x10002a44
push 2
push 0x10022ba4
push esi
call fcn.1000e52b
add esp, 0xc
test eax, eax
je 0x10002a44
mov eax, esi
lea edi, [esi + 4]
mov ecx, 0xa
jmp 0x10002a4e
lea eax, [esi + 4]
mov ecx, 0x10
mov edi, eax
push ecx
push 0
push eax
call fcn.1000c121
add esp, 0xc
mov dword [0x1002645c], eax
push 0x100266c0
push 0x14
push esi
push 0
push str.RS_pGetDataOffset
push str.Drama233_Plus
call ebx
push 2
push 0x10022b9c
push esi
call fcn.1000e52b
add esp, 0xc
test eax, eax
je 0x10002aa6
push 2
push 0x10022ba4
push esi
call fcn.1000e52b
add esp, 0xc
test eax, eax
je 0x10002aa6
mov eax, esi
mov ecx, 0xa
jmp 0x10002aad
mov eax, edi
mov ecx, 0x10
push ecx
push 0
push eax
call fcn.1000c121
add esp, 0xc
mov dword [0x10026460], eax
push 0x100266c0
push 0x14
push esi
push 0
push str.RS_pGetDataSize
push str.Drama233_Plus
call ebx
push 2
push 0x10022b9c
push esi
call fcn.1000e52b
add esp, 0xc
test eax, eax
je 0x10002b05
push 2
push 0x10022ba4
push esi
call fcn.1000e52b
add esp, 0xc
test eax, eax
je 0x10002b05
mov eax, esi
mov ecx, 0xa
jmp 0x10002b0c
mov eax, edi
mov ecx, 0x10
push ecx
push 0
push eax
call fcn.1000c121
add esp, 0xc
mov dword [0x10026464], eax
push 0x100266c0
push 0x14
push esi
push 0
push str.RS_pCopyFileToMem
push str.Drama233_Plus
call ebx
push 2
push 0x10022b9c
push esi
call fcn.1000e52b
add esp, 0xc
test eax, eax
je 0x10002b64
push 2
push 0x10022ba4
push esi
call fcn.1000e52b
add esp, 0xc
test eax, eax
je 0x10002b64
mov edi, esi
mov eax, 0xa
jmp 0x10002b69
mov eax, 0x10
push eax
push 0
push edi
call fcn.1000c121
add esp, 0xc
mov dword [0x10026468], eax
cmp dword [0x10026ba4], 0
je 0x10002b9f
push 0x10023128
push str.RioShiina_hook.log
call fcn.1000b634
add esp, 8
mov dword [0x1002646c], eax
jmp 0x10002d71
mov dword [0x1002646c], 0
jmp 0x10002d71
push 4
push str.CMVS
push esi
call fcn.1000e52b
add esp, 0xc
test eax, eax
jne 0x10002d71
push 0x100266c0
push 0x14
push esi
push eax
push str.CMVS_pGetFileName
push str.Drama233_Plus
call ebx
push 2
push 0x10022b9c
push esi
call fcn.1000e52b
add esp, 0xc
test eax, eax
je 0x10002c0f
push 2
push 0x10022ba4
push esi
call fcn.1000e52b
add esp, 0xc
test eax, eax
je 0x10002c0f
mov eax, esi
lea edi, [esi + 4]
mov ecx, 0xa
jmp 0x10002c19
lea eax, [esi + 4]
mov ecx, 0x10
mov edi, eax
push ecx
push 0
push eax
call fcn.1000c121
add esp, 0xc
mov dword [0x10026b24], eax
push 0x100266c0
push 0x14
push esi
push 0
push str.CMVS_pGetDataSize
push str.Drama233_Plus
call ebx
push 2
push 0x10022b9c
push esi
call fcn.1000e52b
add esp, 0xc
test eax, eax
je 0x10002c71
push 2
push 0x10022ba4
push esi
call fcn.1000e52b
add esp, 0xc
test eax, eax
je 0x10002c71
mov eax, esi
mov ecx, 0xa
jmp 0x10002c78
mov eax, edi
mov ecx, 0x10
push ecx
push 0
push eax
call fcn.1000c121
add esp, 0xc
mov dword [0x10026b28], eax
push 0x100266c0
push 0x14
push esi
push 0
push str.CMVS_pCopyFileToMem
push str.Drama233_Plus
call ebx
push 2
push 0x10022b9c
push esi
call fcn.1000e52b
add esp, 0xc
test eax, eax
je 0x10002cd0
push 2
push 0x10022ba4
push esi
call fcn.1000e52b
add esp, 0xc
test eax, eax
je 0x10002cd0
mov eax, esi
mov ecx, 0xa
jmp 0x10002cd7
mov eax, edi
mov ecx, 0x10
push ecx
push 0
push eax
call fcn.1000c121
add esp, 0xc
mov dword [0x10026b2c], eax
push 0x100266c0
push 0x14
push esi
push 0
push str.CMVS_pCopyPicToMem
push str.Drama233_Plus
call ebx
push 2
push 0x10022b9c
push esi
call fcn.1000e52b
add esp, 0xc
test eax, eax
je 0x10002d2f
push 2
push 0x10022ba4
push esi
call fcn.1000e52b
add esp, 0xc
test eax, eax
je 0x10002d2f
mov edi, esi
mov eax, 0xa
jmp 0x10002d34
mov eax, 0x10
push eax
push 0
push edi
call fcn.1000c121
add esp, 0xc
mov dword [0x10026b30], eax
cmp dword [0x10026ba4], 0
je 0x10002d67
push 0x10023128
push str.CMVS_hook.log
call fcn.1000b634
add esp, 8
mov dword [0x10026b34], eax
jmp 0x10002d71
mov dword [0x10026b34], 0
cmp dword [0x10026b44], 0
je 0x10002dea
push 0x100266c0
push 0x32
push esi
push str.0x86
push str.CharSet
push str.CreateFontIndirect
call ebx
push 2
push 0x10022b9c
push esi
call fcn.1000e52b
add esp, 0xc
test eax, eax
je 0x10002dca
push 2
push 0x10022ba4
push esi
call fcn.1000e52b
add esp, 0xc
test eax, eax
je 0x10002dca
lea edi, [esi + 4]
mov eax, esi
mov ecx, 0xa
mov dword [ebp - 0x34], edi
jmp 0x10002dd7
lea eax, [esi + 4]
mov ecx, 0x10
mov edi, eax
mov dword [ebp - 0x34], eax
push ecx
push 0
push eax
call fcn.1000c121
add esp, 0xc
mov byte [0x10026bd4], al
jmp 0x10002df0
lea edi, [esi + 4]
mov dword [ebp - 0x34], edi
cmp dword [0x10026b48], 0
je 0x10002e5b
push 0x100266c0
push 0x32
push esi
push str.0x86
push str.CharSet
push str.CreateFont
call ebx
push 2
push 0x10022b9c
push esi
call fcn.1000e52b
add esp, 0xc
test eax, eax
je 0x10002e43
push 2
push 0x10022ba4
push esi
call fcn.1000e52b
add esp, 0xc
test eax, eax
je 0x10002e43
mov eax, esi
mov ecx, 0xa
jmp 0x10002e4a
mov eax, edi
mov ecx, 0x10
push ecx
push 0
push eax
call fcn.1000c121
add esp, 0xc
mov byte [0x100268c8], al
cmp dword [0x10026b4c], 0
je 0x10002ec6
push 0x100266c0
push 0x32
push esi
push 0x10023310
push str.CodePage
push 0x10022eb0
call ebx
push 2
push 0x10022b9c
push esi
call fcn.1000e52b
add esp, 0xc
test eax, eax
je 0x10002eae
push 2
push 0x10022ba4
push esi
call fcn.1000e52b
add esp, 0xc
test eax, eax
je 0x10002eae
mov eax, esi
mov ecx, 0xa
jmp 0x10002eb5
mov eax, edi
mov ecx, 0x10
push ecx
push 0
push eax
call fcn.1000c121
add esp, 0xc
mov dword [0x10026bb0], eax
cmp dword [0x10026b50], 0
je 0x10002f31
push 0x100266c0
push 0x32
push esi
push 0x10023310
push str.CodePage
push 0x10022ed8
call ebx
push 2
push 0x10022b9c
push esi
call fcn.1000e52b
add esp, 0xc
test eax, eax
je 0x10002f19
push 2
push 0x10022ba4
push esi
call fcn.1000e52b
add esp, 0xc
test eax, eax
je 0x10002f19
mov eax, esi
mov ecx, 0xa
jmp 0x10002f20
mov eax, edi
mov ecx, 0x10
push ecx
push 0
push eax
call fcn.1000c121
add esp, 0xc
mov dword [0x100268d4], eax
cmp dword [0x10026b7c], 0
je 0x10002f9c
push 0x100266c0
push 0x32
push esi
push str.0x86
push str.CharSet
push str.EnumFontFamiliesEx
call ebx
push 2
push 0x10022b9c
push esi
call fcn.1000e52b
add esp, 0xc
test eax, eax
je 0x10002f84
push 2
push 0x10022ba4
push esi
call fcn.1000e52b
add esp, 0xc
test eax, eax
je 0x10002f84
mov eax, esi
mov ecx, 0xa
jmp 0x10002f8b
mov eax, edi
mov ecx, 0x10
push ecx
push 0
push eax
call fcn.1000c121
add esp, 0xc
mov byte [0x10026ae8], al
cmp dword [0x10026b78], 0
je 0x10003068
push 0x100266c0
push 0x32
push esi
push str.0x86
push str.CharSet
push str.EnumFontFamiliesA
call ebx
push 2
push 0x10022b9c
push esi
call fcn.1000e52b
add esp, 0xc
test eax, eax
je 0x10002ff3
push 2
push 0x10022ba4
push esi
call fcn.1000e52b
add esp, 0xc
test eax, eax
je 0x10002ff3
mov eax, esi
mov ecx, 0xa
jmp 0x10002ffa
mov eax, edi
mov ecx, 0x10
push ecx
push 0
push eax
call fcn.1000c121
add esp, 0xc
mov byte [0x10026b38], al
push 0x100266c0
push 0x32
push esi
push 0
push str.MemOffset
push str.EnumFontFamiliesA
call ebx
push 2
push 0x10022b9c
push esi
call fcn.1000e52b
add esp, 0xc
test eax, eax
je 0x10003052
push 2
push 0x10022ba4
push esi
call fcn.1000e52b
add esp, 0xc
test eax, eax
je 0x10003052
mov edi, esi
mov eax, 0xa
jmp 0x10003057
mov eax, 0x10
push eax
push 0
push edi
call fcn.1000c121
add esp, 0xc
mov dword [0x100268d0], eax
cmp dword [0x10026b54], 0
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
je 0x100030ef
push 0x100266c0
push 0
push 0x10022bd4
push 0x10022bec
call edi
test eax, eax
je 0x100030ef
push 0x100266c0
push 0x104
push esi
push 0x10022d04
push 0x10023340
push 0x10022bec
call ebx
cmp esi, 0x10022d04
je 0x1000457d
push 0x1002339c
push esi
call fcn.1000b61d
push 0x1fe00
mov edi, eax
call fcn.1000e565
push edi
push 0x1fe00
push 1
push eax
mov dword [0x10026478], eax
call fcn.1000e3fa
push edi
call fcn.1000c1c3
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
add esp, 0x20
cmp dword [0x10026b60], 0
je 0x100031f4
push 0x100266c0
push 0
push str.Count
push 0x10022f50
call edi
mov edi, eax
push 0x204
mov dword [ebp - 0x28], edi
call fcn.1000e565
add esp, 4
mov dword [ebp - 0x24], eax
mov dword [0x10026bb8], eax
mov dword [ebp - 0x1c], 1
cmp edi, 1
jb 0x100031f4
nop dword [eax]
push 0x204
call fcn.1000e565
push dword [ebp - 0x1c]
mov edi, eax
push str.OldString_d
push esi
mov dword [edi + 0x200], 0
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 0x100266c0
push 0x104
push esi
push 0
push esi
push 0x10022f50
call ebx
push 0
push 0
push 0x104
push edi
push 0xffffffffffffffff
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push dword [ebp - 0x1c]
push str.NewString_d
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0x100266c0
push 0x104
push esi
push 0
push esi
push 0x10022f50
call ebx
push 0
push 0
push 0x104
lea eax, [edi + 0xff]
push eax
push 0xffffffffffffffff
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], edi
mov dword [eax + 0x200], edi
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp eax, dword [ebp - 0x28]
jbe 0x10003140
cmp dword [0x10026b64], 0
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
je 0x100032cf
push 0x100266c0
push 0
push str.Count
push 0x10022f70
call edi
push 0x400
mov dword [ebp - 0x20], eax
call fcn.1000e565
add esp, 4
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x20], 1
mov dword [0x10026480], eax
mov dword [ebp - 0x1c], 1
jb 0x100032cf
push 0x400
call fcn.1000e565
push dword [ebp - 0x1c]
mov edi, eax
push str.OldString_d
push esi
mov dword [edi + 0x3fc], 0
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 0x100266c0
push 0x104
push edi
push 0
push esi
push 0x10022f70
call ebx
push dword [ebp - 0x1c]
push str.NewString_d
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [edi + 0x1fe]
push 0x100266c0
push 0x104
push eax
push 0
push esi
push 0x10022f70
call ebx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], edi
mov dword [eax + 0x3fc], edi
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp eax, dword [ebp - 0x20]
jbe 0x10003243
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp dword [0x10026b68], 0
je 0x100034d4
push 0x100266c0
push 0
push str.TextCount
push 0x10022f90
call edi
push 0x204
mov dword [ebp - 0x20], eax
call fcn.1000e565
add esp, 4
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x20], 1
mov dword [0x10026434], eax
mov dword [ebp - 0x1c], 1
jb 0x100033da
nop dword [eax + eax]
push 0x204
call fcn.1000e565
push dword [ebp - 0x1c]
mov edi, eax
push str.TextOldString_d
push esi
mov dword [edi + 0x200], 0
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 0x100266c0
push 0x104
push esi
push 0
push esi
push 0x10022f90
call ebx
push 0
push 0
push 0x104
push edi
push 0xffffffffffffffff
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push dword [ebp - 0x1c]
push str.TextNewString_d
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0x100266c0
push 0x104
push esi
push 0
push esi
push 0x10022f90
call ebx
push 0
push 0
push 0x104
lea eax, [edi + 0xff]
push eax
push 0xffffffffffffffff
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], edi
mov dword [eax + 0x200], edi
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp eax, dword [ebp - 0x20]
jbe 0x10003320
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0x100266c0
push 0
push str.CaptionCount
push 0x10022f90
call edi
mov edi, eax
push 0x204
mov dword [ebp - 0x28], edi
call fcn.1000e565
add esp, 4
mov dword [ebp - 0x24], eax
mov dword [0x10026428], eax
mov dword [ebp - 0x1c], 1
cmp edi, 1
jb 0x100034d4
nop word [eax + eax]
push 0x204
call fcn.1000e565
push dword [ebp - 0x1c]
mov edi, eax
push str.CaptionOldString_d
push esi
mov dword [edi + 0x200], 0
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 0x100266c0
push 0x104
push esi
push 0
push esi
push 0x10022f90
call ebx
push 0
push 0
push 0x104
push edi
push 0xffffffffffffffff
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push dword [ebp - 0x1c]
push str.CaptionNewString_d
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0x100266c0
push 0x104
push esi
push 0
push esi
push 0x10022f90
call ebx
push 0
push 0
push 0x104
lea eax, [edi + 0xff]
push eax
push 0xffffffffffffffff
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], edi
mov dword [eax + 0x200], edi
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp eax, dword [ebp - 0x28]
jbe 0x10003420
cmp dword [0x10026b6c], 0
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
je 0x1000367c
push 0x100266c0
push 0
push str.TextCount
push 0x10022fa8
call edi
push 0x400
mov dword [ebp - 0x20], eax
call fcn.1000e565
add esp, 4
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x20], 1
mov dword [0x1002642c], eax
mov dword [ebp - 0x1c], 1
jb 0x100035af
push 0x400
call fcn.1000e565
push dword [ebp - 0x1c]
mov edi, eax
push str.TextOldString_d
push esi
mov dword [edi + 0x3fc], 0
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 0x100266c0
push 0x104
push edi
push 0
push esi
push 0x10022fa8
call ebx
push dword [ebp - 0x1c]
push str.TextNewString_d
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [edi + 0x1fe]
push 0x100266c0
push 0x104
push eax
push 0
push esi
push 0x10022fa8
call ebx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], edi
mov dword [eax + 0x3fc], edi
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp eax, dword [ebp - 0x20]
jbe 0x10003523
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0x100266c0
push 0
push str.CaptionCount
push 0x10022fa8
call edi
push 0x400
mov dword [ebp - 0x20], eax
call fcn.1000e565
add esp, 4
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x20], 1
mov dword [0x100268cc], eax
mov dword [ebp - 0x1c], 1
jb 0x1000367c
nop dword [eax + eax]
push 0x400
call fcn.1000e565
push dword [ebp - 0x1c]
mov edi, eax
push str.CaptionOldString_d
push esi
mov dword [edi + 0x3fc], 0
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 0x100266c0
push 0x104
push edi
push 0
push esi
push 0x10022fa8
call ebx
push dword [ebp - 0x1c]
push str.CaptionNewString_d
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [edi + 0x1fe]
push 0x100266c0
push 0x104
push eax
push 0
push esi
push 0x10022fa8
call ebx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], edi
mov dword [eax + 0x3fc], edi
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp eax, dword [ebp - 0x20]
jbe 0x100035f0
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp dword [0x10026b58], 0
je 0x10003817
push 0x100266c0
push 0
push str.Count
push 0x10022f20
call edi
mov edi, eax
push 0x20c
mov dword [ebp - 0x28], edi
call fcn.1000e565
add esp, 4
mov dword [ebp - 0x20], eax
mov dword [0x1002647c], eax
mov dword [ebp - 0x1c], 1
cmp edi, 1
jb 0x10003817
push 0x20c
call fcn.1000e565
push dword [ebp - 0x1c]
mov edi, eax
push str.OldFileName_d
push esi
mov dword [ebp - 0x24], edi
mov dword [edi + 0x208], 0
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 0x100266c0
push 0x104
push esi
push 0
push esi
push 0x10022f20
call ebx
push 0x100266c0
push 0
push str.Use_Directory
push 0x10022f20
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x10003753
push 0x208
call fcn.1000e565
push esi
push 0x100268e0
mov edi, eax
push str._ls_ls
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
push edi
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
push edi
call fcn.1000e229
mov edi, dword [ebp - 0x24]
add esp, 0x20
push 0
push 0
push 0x104
push edi
push 0xffffffffffffffff
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push dword [ebp - 0x1c]
push str.NewFileName_d
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0x100266c0
push 0x104
push esi
push 0
push esi
push 0x10022f20
call ebx
push 0x100266c0
push 0
push str.Use_Directory
push 0x10022f20
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x100037de
push 0x208
call fcn.1000e565
push esi
push 0x100268e0
mov edi, eax
push str._ls_ls
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
push edi
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
push edi
call fcn.1000e229
mov edi, dword [ebp - 0x24]
add esp, 0x20
push 0
push 0
push 0x104
lea eax, [edi + 0x104]
push eax
push 0xffffffffffffffff
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], edi
mov dword [eax + 0x208], edi
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp eax, dword [ebp - 0x28]
jbe 0x100036c6
cmp dword [0x10026b5c], 0
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
je 0x10003977
push 0x100266c0
push 0
push str.Count
push 0x10022f38
call edi
push 0x414
mov dword [ebp - 0x28], eax
call fcn.1000e565
add esp, 4
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x28], 1
mov dword [0x10026bd0], eax
mov dword [ebp - 0x20], 1
jb 0x10003977
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
nop dword [eax]
push 0x414
call fcn.1000e565
push dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
push str.OldFileName_d
push esi
mov dword [eax + 0x410], 0
call edi
add esp, 0x10
push 0x100266c0
push 0
push str.Use_Directory
push 0x10022f38
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0x100266c0
push 0x104
test eax, eax
je 0x100038da
push esi
push 0
push esi
push 0x10022f38
call ebx
push esi
push 0x100268e0
push str._ls_ls
push dword [ebp - 0x1c]
call edi
add esp, 0x10
jmp 0x100038e7
push dword [ebp - 0x1c]
push 0
push esi
push 0x10022f38
call ebx
push dword [ebp - 0x20]
push str.NewFileName_d
push esi
call edi
mov eax, dword [ebp - 0x1c]
add esp, 0xc
add eax, 0x208
mov dword [ebp - 0x24], eax
push 0x100266c0
push 0
push str.Use_Directory
push 0x10022f38
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0x100266c0
push 0x104
test eax, eax
je 0x10003945
push esi
push 0
push esi
push 0x10022f38
call ebx
push esi
push 0x100268e0
push str._ls_ls
push dword [ebp - 0x24]
call edi
add esp, 0x10
jmp 0x10003952
push dword [ebp - 0x24]
push 0
push esi
push 0x10022f38
call ebx
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
mov dword [ecx + 0x410], eax
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp eax, dword [ebp - 0x28]
jbe 0x10003870
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp dword [0x10026b94], 0
je 0x10003a47
push 0x100266c0
push 0
push str.Count
push 0x10023024
call edi
mov edi, eax
push 0x414
mov dword [ebp - 0x2c], edi
call fcn.1000e565
add esp, 4
mov dword [ebp - 0x28], eax
mov dword [0x10026470], eax
mov dword [ebp - 0x20], 1
cmp edi, 1
jb 0x10003a47
push 0x414
call fcn.1000e565
push dword [ebp - 0x20]
mov edi, eax
push str.OldlpString_d
push esi
mov dword [edi + 0x410], 0
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 0x100266c0
push 0x104
push edi
push 0
push esi
push 0x10023024
call ebx
push dword [ebp - 0x20]
push str.NewlpString_d
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [edi + 0x208]
push 0x100266c0
push 0x104
push eax
push 0
push esi
push 0x10023024
call ebx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x28], edi
mov dword [eax + 0x410], edi
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp eax, dword [ebp - 0x2c]
jbe 0x100039c1
cmp dword [0x10026b9c], 0
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
je 0x10003bca
push 0x100266c0
push 0
push 0x10022bd4
push 0x10022c44
call edi
test eax, eax
je 0x10003ad2
push 0x100266c0
push 0x104
push esi
push 0x10022d04
push 0x10023340
push 0x10022c44
call ebx
cmp esi, 0x10022d04
je 0x10004598
push 0x1002339c
push esi
call fcn.1000b61d
push 0x1fe00
mov edi, eax
call fcn.1000e565
push edi
push 0x1fe00
push 1
push eax
mov dword [0x10026478], eax
call fcn.1000e3fa
push edi
call fcn.1000c1c3
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
add esp, 0x20
push 0x100266c0
push 0
push str.Count
push 0x10022c44
call edi
push 0x20c
mov dword [ebp - 0x2c], eax
call fcn.1000e565
add esp, 4
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x2c], 1
mov dword [0x10026474], eax
mov dword [ebp - 0x20], 1
jb 0x10003bca
nop
push 0x20c
call fcn.1000e565
push dword [ebp - 0x20]
mov edi, eax
push str.OldlpString_d
push esi
mov dword [edi + 0x208], 0
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 0x100266c0
push 0x104
push esi
push 0
push esi
push 0x10022c44
call ebx
push 0
push 0
push 0x104
push edi
push 0xffffffffffffffff
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push dword [ebp - 0x20]
push str.NewlpString_d
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0x100266c0
push 0x104
push esi
push 0
push esi
push 0x10022c44
call ebx
push 0
push 0
push 0x104
lea eax, [edi + 0x104]
push eax
push 0xffffffffffffffff
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x28], edi
mov dword [eax + 0x208], edi
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp eax, dword [ebp - 0x2c]
jbe 0x10003b10
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp dword [0x10026ba0], 0
je 0x10003c9a
push 0x100266c0
push 0
push str.Count
push 0x1002304c
call edi
mov edi, eax
push 0x414
mov dword [ebp - 0x2c], edi
call fcn.1000e565
add esp, 4
mov dword [ebp - 0x28], eax
mov dword [0x10026424], eax
mov dword [ebp - 0x20], 1
cmp edi, 1
jb 0x10003c9a
push 0x414
call fcn.1000e565
push dword [ebp - 0x20]
mov edi, eax
push str.OldlpString_d
push esi
mov dword [edi + 0x410], 0
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 0x100266c0
push 0x104
push edi
push 0
push esi
push 0x1002304c
call ebx
push dword [ebp - 0x20]
push str.NewlpString_d
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [edi + 0x208]
push 0x100266c0
push 0x104
push eax
push 0
push esi
push 0x1002304c
call ebx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x28], edi
mov dword [eax + 0x410], edi
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp eax, dword [ebp - 0x2c]
jbe 0x10003c14
cmp dword [0x10026b8c], 0
je 0x10003e1c
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0x100266c0
push 0
push str.Count
push str.BorderPatch
call edi
push 0x100266c0
push 1
push str.Border_Address_Static
push str.BorderPatch
mov dword [ebp - 0x1c], eax
call edi
push 0x100266c0
push 0xa
push esi
push 0
push str.Border_Mode
push str.BorderPatch
test eax, eax
je 0x10003f94
call ebx
push 3
push 0x10023170
push esi
call fcn.1000e52b
add esp, 0xc
test eax, eax
jne 0x10003e6c
push 0x100266c0
push 0xa
push esi
push eax
push str.Border
push str.BorderPatch
call ebx
push 2
push 0x10022b9c
push esi
call fcn.1000e52b
add esp, 0xc
test eax, eax
je 0x10003d55
push 2
push 0x10022ba4
push esi
call fcn.1000e52b
add esp, 0xc
test eax, eax
je 0x10003d55
mov edi, dword [ebp - 0x34]
mov eax, esi
mov ecx, 0xa
jmp 0x10003d5f
mov edi, dword [ebp - 0x34]
mov ecx, 0x10
mov eax, edi
push ecx
push 0
push eax
call fcn.1000c121
mov cl, al
add esp, 0xc
mov eax, 1
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x1c], eax
jb 0x10003e1c
movzx ecx, cl
mov dword [ebp - 0x2c], ecx
push eax
push str.Offset_d
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0x100266c0
push 0x32
push esi
push 0
push esi
push str.BorderPatch
call ebx
push 2
push 0x10022b9c
push esi
call fcn.1000e52b
add esp, 0xc
test eax, eax
je 0x10003dd7
push 2
push 0x10022ba4
push esi
call fcn.1000e52b
add esp, 0xc
test eax, eax
je 0x10003dd7
mov edi, esi
mov eax, 0xa
jmp 0x10003ddc
mov eax, 0x10
push eax
push 0
push edi
call fcn.1000c121
add esp, 0xc
mov edi, eax
push 0x10026438
push 0x40
push 1
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dl, byte [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
movzx ecx, dl
inc eax
shl dx, 8
or dx, cx
mov dword [ebp - 0x28], eax
mov byte [edi], dl
mov edi, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x1c]
jbe 0x10003d84
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
cmp dword [0x10026b90], 0
je 0x1000455c
push 0x100266c0
push 0xa
push esi
push 0
push str.ChangeFace_Mode
push str.ChangeFace
call ebx
push 3
push 0x10023170
push esi
call fcn.1000e52b
add esp, 0xc
test eax, eax
jne 0x10004225
mov dword [0x100263cc], 1
jmp 0x1000455c
push 3
push 0x100235d0
push esi
call fcn.1000e52b
add esp, 0xc
test eax, eax
jne 0x10003e1c
mov eax, 1
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x1c], eax
jb 0x10003e1c
nop dword [eax]
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
push eax
push str.Border_d
push esi
call edi
add esp, 0xc
push 0x100266c0
push 0xa
push esi
push 0
push esi
push str.BorderPatch
call ebx
push 2
push 0x10022b9c
push esi
call fcn.1000e52b
add esp, 0xc
test eax, eax
je 0x10003ee5
push 2
push 0x10022ba4
push esi
call fcn.1000e52b
add esp, 0xc
test eax, eax
je 0x10003ee5
mov eax, esi
mov ecx, 0xa
jmp 0x10003eed
mov eax, dword [ebp - 0x34]
mov ecx, 0x10
push ecx
push 0
push eax
call fcn.1000c121
push dword [ebp - 0x24]
mov byte [ebp - 0x2d], al
push str.Offset_d
push esi
call edi
add esp, 0x18
push 0x100266c0
push 0x32
push esi
push 0
push esi
push str.BorderPatch
call ebx
push 2
push 0x10022b9c
push esi
call fcn.1000e52b
add esp, 0xc
test eax, eax
je 0x10003f4a
push 2
push 0x10022ba4
push esi
call fcn.1000e52b
add esp, 0xc
test eax, eax
je 0x10003f4a
mov eax, esi
mov ecx, 0xa
jmp 0x10003f52
mov eax, dword [ebp - 0x34]
mov ecx, 0x10
push ecx
push 0
push eax
call fcn.1000c121
add esp, 0xc
mov edi, eax
push 0x10026438
push 0x40
push 1
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
movzx edx, byte [ebp - 0x2d]
mov eax, dword [ebp - 0x24]
mov ecx, edx
shl dx, 8
inc eax
or dx, cx
mov dword [ebp - 0x24], eax
mov byte [edi], dl
cmp eax, dword [ebp - 0x1c]
jbe 0x10003e90
jmp 0x10003e1c
call ebx
push 3
push 0x10023170
push esi
call fcn.1000e52b
add esp, 0xc
test eax, eax
jne 0x100040d7
push 0xc
call fcn.1000e565
add esp, 4
mov dword [ebp - 0x2c], eax
mov dword [0x10026bac], eax
push 0x100266c0
push 0xa
push esi
push 0
push str.Border
push str.BorderPatch
call ebx
push 2
push 0x10022b9c
push esi
call fcn.1000e52b
add esp, 0xc
test eax, eax
je 0x10004007
push 2
push 0x10022ba4
push esi
call fcn.1000e52b
add esp, 0xc
test eax, eax
je 0x10004007
mov eax, esi
mov ecx, 0xa
jmp 0x1000400f
mov eax, dword [ebp - 0x34]
mov ecx, 0x10
push ecx
push 0
push eax
call fcn.1000c121
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
cmp dword [ebp - 0x1c], 1
mov byte [ebp - 0x2d], al
mov dword [ebp - 0x24], 1
jb 0x10003e22
push 0xc
call fcn.1000e565
push dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
push str.Offset_d
push esi
mov dword [eax + 8], 0
call edi
add esp, 0x10
push 0x100266c0
push 0x32
push esi
push 0
push esi
push str.BorderPatch
call ebx
mov eax, dword [ebp - 0x28]
mov cl, byte [ebp - 0x2d]
push 2
push 0x10022b9c
push esi
mov byte [eax + 4], cl
call fcn.1000e52b
add esp, 0xc
test eax, eax
je 0x100040a0
push 2
push 0x10022ba4
push esi
call fcn.1000e52b
add esp, 0xc
test eax, eax
je 0x100040a0
mov eax, esi
mov ecx, 0xa
jmp 0x100040a8
mov eax, dword [ebp - 0x34]
mov ecx, 0x10
push ecx
push 0
push eax
call fcn.1000c121
mov ecx, dword [ebp - 0x28]
add esp, 0xc
mov dword [ecx], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x2c], ecx
mov dword [eax + 8], ecx
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp eax, dword [ebp - 0x1c]
jbe 0x10004035
jmp 0x10003e22
push 3
push 0x100235d0
push esi
call fcn.1000e52b
add esp, 0xc
test eax, eax
jne 0x10003e1c
push 0xc
call fcn.1000e565
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
add esp, 4
cmp dword [ebp - 0x1c], 1
mov dword [ebp - 0x2c], eax
mov dword [0x10026bac], eax
mov dword [ebp - 0x20], 1
jb 0x10003e22
push 0xc
call fcn.1000e565
push dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
push str.Border_d
push esi
mov dword [eax + 8], 0
call edi
add esp, 0x10
push 0x100266c0
push 0xa
push esi
push 0
push esi
push str.BorderPatch
call ebx
push 2
push 0x10022b9c
push esi
call fcn.1000e52b
add esp, 0xc
test eax, eax
je 0x1000417a
push 2
push 0x10022ba4
push esi
call fcn.1000e52b
add esp, 0xc
test eax, eax
je 0x1000417a
mov eax, esi
mov ecx, 0xa
jmp 0x10004182
mov eax, dword [ebp - 0x34]
mov ecx, 0x10
push ecx
push 0
push eax
call fcn.1000c121
push dword [ebp - 0x20]
mov ebx, eax
push str.Offset_d
push esi
call edi
add esp, 0x18
push 0x100266c0
push 0x32
push esi
push 0
push esi
push str.BorderPatch
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov eax, dword [ebp - 0x28]
push 2
push 0x10022b9c
push esi
mov byte [eax + 4], bl
call fcn.1000e52b
add esp, 0xc
test eax, eax
je 0x100041e8
push 2
push 0x10022ba4
push esi
call fcn.1000e52b
add esp, 0xc
test eax, eax
je 0x100041e8
mov eax, esi
mov ecx, 0xa
jmp 0x100041f0
mov eax, dword [ebp - 0x34]
mov ecx, 0x10
push ecx
push 0
push eax
call fcn.1000c121
mov ecx, dword [ebp - 0x28]
add esp, 0xc
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [ecx], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x2c], ecx
mov dword [eax + 8], ecx
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp eax, dword [ebp - 0x1c]
jbe 0x10004118
jmp 0x10003e22
push 3
push 0x100235d0
push esi
call fcn.1000e52b
add esp, 0xc
test eax, eax
jne 0x1000455c
push 0x100266c0
push eax
push str.Count
push str.ChangeFace
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0x100266c0
push 1
push str.Face_Address_Static
push str.ChangeFace
mov dword [ebp - 0x24], eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x100043d9
mov eax, 1
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x24], eax
jb 0x1000455c
push eax
push str.Offset_d
push esi
call edi
add esp, 0xc
push 0x100266c0
push 0x14
push esi
push 0
push esi
push str.ChangeFace
call ebx
push 2
push 0x10022b9c
push esi
call fcn.1000e52b
add esp, 0xc
test eax, eax
je 0x100042d5
push 2
push 0x10022ba4
push esi
call fcn.1000e52b
add esp, 0xc
test eax, eax
je 0x100042d5
mov eax, esi
mov ecx, 0xa
jmp 0x100042dd
mov eax, dword [ebp - 0x34]
mov ecx, 0x10
push ecx
push 0
push eax
call fcn.1000c121
push dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
push str.Size_d
push esi
call edi
add esp, 0x18
push 0x100266c0
push 0x14
push esi
push 0
push esi
push str.ChangeFace
call ebx
push 2
push 0x10022b9c
push esi
call fcn.1000e52b
add esp, 0xc
test eax, eax
je 0x1000433a
push 2
push 0x10022ba4
push esi
call fcn.1000e52b
add esp, 0xc
test eax, eax
je 0x1000433a
mov eax, esi
mov ecx, 0xa
jmp 0x10004342
mov eax, dword [ebp - 0x34]
mov ecx, 0x10
push ecx
push 0
push eax
call fcn.1000c121
push dword [ebp - 0x20]
mov edi, eax
push str.Face_d
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
push 0x100266c0
push 0x14
push esi
push 0
push esi
push str.ChangeFace
call ebx
push 0
push 0
push 0x104
lea eax, [ebp - 0x18]
push eax
push 0xffffffffffffffff
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0x10026438
push 0x40
push edi
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push edi
mov edi, dword [ebp - 0x28]
push 0
push edi
call fcn.1000a730
add esp, 0xc
lea ecx, [ebp - 0x18]
nop
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edi], al
lea edi, [edi + 1]
test al, al
jne 0x100043b0
mov eax, dword [ebp - 0x20]
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
inc eax
mov dword [ebp - 0x20], eax
cmp eax, dword [ebp - 0x24]
jbe 0x10004286
jmp 0x1000455c
push 0x20
call fcn.1000e565
add esp, 4
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x24], 1
mov dword [0x10026bbc], eax
mov dword [ebp - 0x1c], 1
jb 0x1000455c
nop dword [eax]
push 0x20
call fcn.1000e565
push dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
push str.Offset_d
push esi
mov dword [eax + 0x1c], 0
call edi
add esp, 0x10
push 0x100266c0
push 0x14
push esi
push 0
push esi
push str.ChangeFace
call ebx
push 2
push 0x10022b9c
push esi
call fcn.1000e52b
add esp, 0xc
test eax, eax
je 0x10004462
push 2
push 0x10022ba4
push esi
call fcn.1000e52b
add esp, 0xc
test eax, eax
je 0x10004462
mov eax, esi
mov ecx, 0xa
jmp 0x1000446a
mov eax, dword [ebp - 0x34]
mov ecx, 0x10
push ecx
push 0
push eax
call fcn.1000c121
push dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
push str.Size_d
push esi
call edi
add esp, 0x18
push 0x100266c0
push 0x14
push esi
push 0
push esi
push str.ChangeFace
call ebx
push 2
push 0x10022b9c
push esi
call fcn.1000e52b
add esp, 0xc
test eax, eax
je 0x100044c7
push 2
push 0x10022ba4
push esi
call fcn.1000e52b
add esp, 0xc
test eax, eax
je 0x100044c7
mov eax, esi
mov ecx, 0xa
jmp 0x100044cf
mov eax, dword [ebp - 0x34]
mov ecx, 0x10
push ecx
push 0
push eax
call fcn.1000c121
push dword [ebp - 0x1c]
mov edi, eax
push str.Face_d
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
push 0x100266c0
push 0x14
push esi
push 0
push esi
push str.ChangeFace
call ebx
push 0
push 0
push 0x104
lea eax, [ebp - 0x18]
push eax
push 0xffffffffffffffff
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edx, dword [ebp - 0x2c]
lea ecx, [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov dword [edx], eax
mov eax, edx
mov dword [edx + 4], edi
mov edi, ecx
sub eax, edi
lea edi, [eax + 8]
nop
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edi + ecx - 1], al
test al, al
jne 0x10004530
mov eax, dword [ebp - 0x28]
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
mov dword [ebp - 0x28], edx
mov dword [eax + 0x1c], edx
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp eax, dword [ebp - 0x24]
jbe 0x10004400
push esi
call fcn.1000e229
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.10009420
mov esp, ebp
pop ebp
ret
push 0
call fcn.1000b485
push 0
push 0x10023348
push 0x10023350
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call fcn.1000b485
push 0
push 0x10023348
push str.g_ac
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
call fcn.1000b485
int3