The following examples can be given in the the TestSample directory of C-Decompiler V1.1; it is recommended to use the "AutoRun.bat" batch file;it will generate the results of the following classic examples for you automatically.
Example 1:Notepad.exe
| C Code Output of C-Decompiler | ASM Code Output of C-Decompiler |
/*
* Input file : testsample\notepad.exe
* File type : EXE
*/
int gVal_0x10090e8; // 0x10090e8
LPCWSTR gVal_0x1009078; // 0x1009078
LPCWSTR gVal_0x100907c; // 0x100907c
int gVal_0x1009070; // 0x1009070
short gVal_0x100ab90; // 0x100ab90
LPWSTR gVal_0x100a3e0; // 0x100a3e0
LPWSTR gVal_0x100a430; // 0x100a430
int gVal_0x100a4e4; // 0x100a4e4
int gVal_0x100a4ec; // 0x100a4ec
int gVal_0x100a4d0; // 0x100a4d0
int gVal_0x100a4d8; // 0x100a4d8
int gVal_0x100a4b0; // 0x100a4b0
int gVal_0x100a4cc; // 0x100a4cc
int gVal_0x100a4d4; // 0x100a4d4
int gVal_0x1009604; // 0x1009604
int gVal_0x1009600; // 0x1009600
int gVal_0x1009838; // 0x1009838
int gVal_0x1009850; // 0x1009850
int gVal_0x1009858; // 0x1009858
int gVal_0x100ab84; // 0x100ab84
HANDLE gVal_0x100a480; // 0x100a480
int gVal_0x1009068; // 0x1009068
int gVal_0x1009054; // 0x1009054
int gVal_0x1009830; // 0x1009830
int gVal_0x100984c; // 0x100984c
HINSTANCE gVal_0x100ab80; // 0x100ab80
int gVal_0x100a6dc; // 0x100a6dc
int gVal_0x100a6d8; // 0x100a6d8
HGLOBAL gVal_0x100a4ac; // 0x100a4ac
unsigned char gVal_0x100a4b1; // 0x100a4b1
int gVal_0x1009ae8; // 0x1009ae8
int gVal_0x1009ae4; // 0x1009ae4
int gVal_0x1009ae0; // 0x1009ae0
int gVal_0x1009adc; // 0x1009adc
int gVal_0x1009ad8; // 0x1009ad8
int gVal_0x1009ad4; // 0x1009ad4
int gVal_0x1009ad0; // 0x1009ad0
int gVal_0x1009acc; // 0x1009acc
LPCWSTR gVal_0x1009084; // 0x1009084
LPCWSTR gVal_0x1009088; // 0x1009088
HGLOBAL gVal_0x100a4a8; // 0x100a4a8
// Proc: proc_0x1003429
LRESULT proc_0x1003429(HWND arg0, DWORD arg1, WPARAM arg2, LPARAM arg3)
{
int loc1;
int loc2;
int loc3; /* edi */
int loc4; /* eax */
int loc5; /* edx */
int loc6; /* esi */
int loc7; /* ebx */
short loc8; /* ax */
loc3 = loc3;
if (arg1 <= 28) {
if (arg1 != 28) {
if (arg1 <= 8) {
if (arg1 != 8) {
loc4 = arg1;
loc4--;
loc4--;
switch ((null))
{
case 1:
PostQuitMessage (0);
goto L1;
break;
loc4 = (loc4 - 3);
case 3:
if ((arg2 - 0) != 0) {
loc4--;
if loc4 {
if loc4 {
loc3 = ;
(gVal_0x1009834);
loc5 = ((arg3 * 3) % 4);
loc2 = ((arg3 * 3) / 4);
(gVal_0x1009834);
proc_0x10019e0 (arg3, arg0);
goto L1;
}
else {
loc4 = 0;
goto L2;
}
}
else {
DefWindowProcW (arg0, arg1, arg2, arg3);
goto L2;
}
}
break;
loc4--;
case 1:
if ((arg2 != 1) && (arg2 != 2)) {
}
else {
IsIconic ();
if (loc4 == 0) {
loc6 = ;
();
if (loc4 == gVal_0x1009830) {
();
SetFocus ();
goto L1;
}
}
}
break;
loc4--;
if loc4 {
IsIconic ();
if (loc4 == 0) {
}
}
else {
if (arg1 == gVal_0x100a488) {
loc4 = ( ~ []);
loc4 = (loc4 & 1);
gVal_0x1009a94 = loc4;
gVal_0x1009a90 = (([] >> 2) & 1);
if (([] & 8) != 0) {
loc6 = ;
();
}
else {
if (([] & 16) != 0) {
loc6 = ;
(gVal_0x100ab84);
proc_0x100207f ();
proc_0x100594c ();
(gVal_0x100ab88);
goto L1;
}
else {
if (([] & 32) != 0) {
if (loc4 != 0) {
gVal_0x1009a94 = 0;
}
loc7 = ;
(gVal_0x100ab84);
loc3 = ;
(gVal_0x1009838);
do {
proc_0x100207f ();
proc_0x100594c ();
} while ((loc4 != 0));
(gVal_0x100ab88);
(gVal_0x1009838);
(gVal_0x1009838);
loc4 = proc_0x1001c42 (1);
goto L1;
}
else {
if (([] & 64) != 0) {
gVal_0x100983c = (gVal_0x100983c & 0);
goto L1;
}
}
}
}
}
else {
}
}
}
else {
SendMessageW ();
goto L1;
}
}
else {
if ((arg1 - 16) != 0) {
loc4--;
if loc4 {
loc4 = (loc4 - 9);
goto L3;
}
}
else {
if (gVal_0x1009854 != 0) {
loc3 = ;
();
();
MessageBoxW ();
goto L1;
}
else {
proc_0x100270f (1);
goto L2;
}
}
}
else {
proc_0x1003a39 ();
loc4 = proc_0x100270f (0, 183);
if ((arg1 - 16) != 0) {
WinHelpW ();
if ((arg1 - 16) == 0) {
MessageBoxW ();
}
loc6 = ;
();
();
DeleteObject ();
goto L1;
}
}
}
}
else {
if (arg2 != 0) {
if ((gVal_0x100985c == 0) && (gVal_0x1009860 == 0)) {
}
else {
loc3 = ;
}
}
else {
loc3 = ;
(gVal_0x1009838);
if (gVal_0x100985c == gVal_0x1009860) {
gVal_0x100985c = 0;
gVal_0x1009860 = 0;
goto L1;
}
else {
(gVal_0x1009838);
(gVal_0x1009838);
goto L1;
}
}
}
}
else {
if ((arg1 - 273) != 0) {
loc4--;
if loc4 {
loc4 = (loc4 - 4);
if (loc4 != 0) {
loc4--;
if loc4 {
loc4 = (loc4 - 284);
if (loc4 != 0) {
loc4 = (loc4 - 230);
if (loc4 != 0) {
loc4 = (loc4 - 0x7CE8);
goto L3;
}
else {
loc6 = 0;
GetKeyboardLayout ();
loc8 = (loc8 & 0x3FF);
if (loc8 == 17) {
loc6++;
}
}
}
else {
if (((arg3 >> 16) & 0xFFF) == 5) {
proc_0x1002b87 (arg0);
goto L1;
}
else {
if (loc3 == gVal_0x1009838) {
if (((arg2 >> 16) != 0x500) && (((arg3 >> 16) & 0xFFF) != 0x501)) {
proc_0x1002b87 (arg0, arg2);
if ((arg2 >> 16) == 0) {
}
}
else {
if (gVal_0x1009848 == 1) {
gVal_0x1009848 = 2;
goto L1;
}
else {
}
}
}
}
}
}
else {
proc_0x10033dc (arg2, arg0);
goto L1;
}
}
else {
if ((gVal_0x100984c != 0) && ((arg3 >> 16) != 0)) {
EnableMenuItem ();
goto L1;
}
}
}
else {
proc_0x1001d73 ();
goto L1;
}
}
else {
loc4 = arg2;
if (gVal_0x100984c != 0) {
if (((arg2 != 0xF020) && (arg2 != 0xF040)) && (arg2 != 0xF050)) {
DefWindowProcW (arg0, 274, loc4, arg3);
goto L4;
}
}
}
}
}
}
// Proc: proc_0x1001be8
int proc_0x1001be8(int arg0)
{
short loc1; /* cx */
int loc2; /* esi */
int loc3; /* eax */
while (([] != 0)) {
if (((loc1 != 32) && (loc1 != 9)) && (loc2 == 0)) {
while ((([] != 32) && ([] != 9))) {
loc3++;
loc3++;
} /* end of while */
goto L5;
}
else {
return;
}
}
else {
if (loc1 == 34) {
}
CharNextW ();
}
} /* end of while */
goto L6;
}
// Proc: proc_0x1004047
int proc_0x1004047(int arg0)
{
HLOCAL loc1;
int loc2; /* edi */
int loc3; /* eax */
int loc4; /* Dmy */
int loc5; /* esi */
int loc6; /* ecx */
loc2 = loc2;
while ((LocalAlloc (64, 560) != 0)) {
loc1 = LocalAlloc (64, 560);
do {
loc3 = gVal_0x10090e8;
loc4 = loc5;
loc4 = (loc4 + 0xFFFFFFFF);
loc6 = loc4;
if (LoadStringW (arg0, , loc1, loc5) < loc6) {
loc2++;
}
LocalFree (loc1);
if (loc2 < 45) {
loc5 = (loc5 + loc5);
loc4 = loc5;
loc4 = (loc4 * 2);
loc3 = loc4;
}
else {
return (((0 + LoadStringW (arg0, , loc1, loc5)) + 1));
}
} while ((loc2 < 45));
goto L7;
} /* end of while */
goto L8;
}
// Proc: proc_0x10040ba
int proc_0x10040ba(int arg0)
{
int loc1; /* edi */
int loc2; /* eax */
int loc3; /* Dmy */
int loc4; /* ebx */
loc1 = loc1;
if (proc_0x1004047 (arg0) != 0) {
loc2 = (proc_0x1004047 (arg0) + loc2);
if (LocalAlloc (64, loc2) != 0) {
if ((LocalSize (LocalAlloc (64, loc2)) >> 1) == 0) {
loc2 = 0;
}
else {
do {
loc2 = [];
LoadStringW (arg0, [], LocalAlloc (64, loc2), (LocalSize (LocalAlloc (64, loc2)) >> 1));
loc2++;
[] = LocalAlloc (64, loc2);
loc3 = loc2;
loc3 = (loc3 * 2);
loc3 = (loc3 + LocalAlloc (64, loc2));
if (loc2 <= (LocalSize (LocalAlloc (64, loc2)) >> 1)) {
loc4 = ((LocalSize (LocalAlloc (64, loc2)) >> 1) - loc2);
}
else {
MessageBoxW ();
loc2 = 0;
}
} while (((0x10090E8 + 4) < 0x100919C));
lstrcpynW (gVal_0x100a3e0, gVal_0x1009078, 40);
lstrcpynW (gVal_0x100a430, gVal_0x100907c, 40);
gVal_0x100ab90 = [];
loc2 = 0;
loc2++;
}
}
}
return (loc2);
}
// Proc: proc_0x10044d7
int proc_0x10044d7()
{
WNDCLASSEXW* loc1;
int loc2;
int loc3; /* edi */
int loc4; /* eax */
int loc5; /* esi */
short loc6; /* ax */
loc3 = loc3;
loc1 = 48;
GetSystemMetrics ();
loc4 = (loc4 - 1);
loc4 = (loc4 + 0x7F01);
loc1->hCursor = LoadCursorW (0, loc4);
loc1->hIcon = LoadIconW (loc5, 2);
LoadImageW ();
loc2 = LoadIconW (loc5, 2);
loc1->lpszMenuName = 1;
loc1->hInstance = loc5;
loc1->hIconSm = 0x1009020;
loc1->lpfnWndProc = proc_0x1003429;
loc1->hbrBackground = 6;
loc1->style = 0;
loc1->cbClsExtra = 0;
loc1->cbWndExtra = 0;
loc6 = !RegisterClassExW (&loc1);
loc4 = !loc4;
return (loc4);
}
// Proc: proc_0x100195d
int proc_0x100195d()
{
short loc1;
int loc2; /* eax */
gVal_0x100a4e4 = 0x1005F63;
gVal_0x100a4ec = 12;
GetLocaleInfoW ();
if (loc1 == 49) {
gVal_0x100a4d0 = 0x3E8;
gVal_0x100a4d8 = 0x3E8;
gVal_0x100a4b0 = 0xA006;
loc2 = 750;
}
else {
gVal_0x100a4d0 = 0x9C4;
gVal_0x100a4d8 = 0x9C4;
gVal_0x100a4b0 = 0xA00A;
loc2 = 0x7D0;
}
gVal_0x100a4cc = loc2;
gVal_0x100a4d4 = loc2;
return (loc2);
}
// Proc: proc_0x100398d
int proc_0x100398d(int arg0, int arg1, int arg2)
{
LPDWORD loc1;
LPBYTE loc2;
LPDWORD loc3;
int loc4; /* eax */
loc2 = 1;
loc3 = 4;
if (arg0 != 0) {
if ((RegQueryValueExW (arg0, arg1, 0, &loc1, loc2, &loc3) != 0) || (loc1 != 4)) {
loc4 = arg2;
goto L9;
}
else {
loc4 = loc2;
goto L9;
}
}
}
// Proc: proc_0x10039e2
int proc_0x10039e2(int arg4, int arg0, int arg3, int arg1, int arg2)
{
int loc1; /* edi */
int loc2; /* esi */
int loc3; /* ecx */
int loc4; /* eax */
loc1 = loc1;
loc2 = (arg4 + loc2);
loc1 = arg3;
arg4 = loc2;
if (arg0 != 0) {
if ((RegQueryValueExW (arg0, arg1, 0, &arg0, arg3, &arg4) != 0) || (arg0 != 1)) {
loc3 = loc2;
loc4 = loc3;
loc3 = (loc3 >> 2);
loc3 = (loc3 & 3);
goto L10;
}
else {
return (loc4);
}
}
}
// Proc: proc_0x1007147
int proc_0x1007147()
{
int loc1;
int loc2;
int loc3;
int loc4;
int loc5;
int loc6;
short loc7;
short loc8;
short loc9;
short loc10;
short loc11;
short loc12;
int loc13;
int loc14;
int loc15;
int loc16;
int loc17;
int loc18;
int loc19;
int loc20;
int loc21[0];
int loc22;
int loc23;
BOOL loc24; /* eax */
int loc25; /* edi */
int loc26; /* ecx */
int loc27; /* edx */
int loc28; /* ebx */
int loc29; /* esi */
short loc30; /* ss */
short loc31; /* cs */
short loc32; /* ds */
short loc33; /* es */
short loc34; /* fs */
short loc35; /* gs */
if if return (loc24);
}
else {
while(1){
loc25 = loc25;
loc1 = loc24;
loc2 = loc26;
loc3 = loc27;
loc4 = loc28;
loc5 = loc29;
loc6 = loc25;
loc7 = loc30;
loc8 = loc31;
loc9 = loc32;
loc10 = loc33;
loc11 = loc34;
loc12 = loc35;
loc14 = 0x10001;
loc15 = 0x1003F45;
loc16 = &0x1003F45;
loc17 = [];
loc24 = 0;
loc25 = &loc18;
loc18 = 0xC0000409;
loc19 = 0x1003F45;
loc20 = &loc18;
loc21[0] = &loc14;
loc22 = gVal_0x1009604;
loc23 = gVal_0x1009600;
SetUnhandledExceptionFilter (0);
loc24 = TerminateProcess (GetCurrentProcess (), 0x502);
} /* end of loop */
return (loc24);
}
}
else {
}
}
// Proc: proc_0x1003c92
int proc_0x1003c92()
{
int loc1;
int loc2;
HKEY loc3;
int loc4;
int loc5;
int loc6;
int loc7;
int loc8;
int loc9;
int loc10;
int loc11;
int loc12;
int loc13;
int loc14;
int loc15; /* edi */
int loc16; /* eax */
loc15 = loc15;
loc1 = gVal_0x1009604;
GetStockObject ();
if (gVal_0x1009604 != 0) {
GetObjectW ();
}
RegCreateKeyW ();
if (&loc3 != 0) {
loc3 = 0;
}
gVal_0x100ab24 = 0;
gVal_0x100ab28 = proc_0x100398d (loc3);
gVal_0x100ab2c = proc_0x100398d (loc3);
gVal_0x100ab30 = proc_0x100398d (loc3);
gVal_0x100ab34 = proc_0x100398d (loc3);
gVal_0x100ab35 = proc_0x100398d (loc3);
gVal_0x100ab36 = proc_0x100398d (loc3);
gVal_0x100ab37 = proc_0x100398d (loc3);
gVal_0x100ab38 = proc_0x100398d (loc3);
gVal_0x100ab39 = proc_0x100398d (loc3);
gVal_0x100ab3a = proc_0x100398d (loc3);
gVal_0x100ab3b = proc_0x100398d (loc3);
proc_0x10039e2 (loc3);
gVal_0x1009018 = proc_0x100398d (loc3);
gVal_0x1009850 = proc_0x100398d (loc3);
gVal_0x1009840 = proc_0x100398d (loc3);
gVal_0x1009a84 = proc_0x100398d (loc3);
loc16 = proc_0x10039e2 (loc3);
proc_0x10039e2 (loc3);
gVal_0x100a4d0 = proc_0x100398d (loc3);
gVal_0x100a4d8 = proc_0x100398d (loc3);
gVal_0x100a4cc = proc_0x100398d (loc3);
gVal_0x100a4d4 = proc_0x100398d (loc3);
gVal_0x1009a7c = proc_0x100398d (loc3);
gVal_0x1009a78 = proc_0x100398d (loc3);
gVal_0x1009a74 = proc_0x100398d (loc3);
gVal_0x1009a70 = proc_0x100398d (loc3);
gVal_0x1009858 = proc_0x100398d (loc3);
if (loc3 != loc15) {
RegCloseKey (loc3);
}
loc16 = proc_0x1007147 ();
return (loc16);
}
// Proc: proc_0x1001c42
int proc_0x1001c42(int arg0)
{
int loc1;
int loc2;
int loc3;
int loc4;
short loc5;
int loc6; /* edi */
int loc7; /* Dmy */
int loc8; /* eax */
int loc9; /* ebx */
loc6 = loc6;
loc1 = gVal_0x1009604;
SendMessageW ();
SendMessageW ();
loc6 = &loc3;
loc6++;
loc7 = loc6;
loc7 = (loc7 + 0xFFFFFFFF);
loc8 = loc7;
SendMessageW ();
loc9 = (loc3 - loc8);
loc9++;
if (((arg0 != 0) || (loc9 != gVal_0x1009624)) || (loc6 != gVal_0x1009620)) {
_snwprintf ();
if (gVal_0x1009834 != 0) {
SendMessageW ();
gVal_0x1009620 = loc6;
gVal_0x1009624 = loc9;
loc8 = proc_0x1007147 ();
return (loc8);
}
}
}
// Proc: proc_0x1002409
int proc_0x1002409(int arg1, int arg0, int arg2)
{
int loc1; /* eax */
int loc2; /* edx */
int loc3; /* esi */
if (arg1 == 0) {
loc1 = 0x80070057;
}
else {
while (([] != 0)) {
[] = [];
loc2++;
loc2++;
loc3++;
loc3++;
} /* end of while */
if (arg1 == 0) {
loc2--;
loc2--;
loc1 = 0x8007007A;
}
[] = ([] & 0);
}
return (loc1);
}
// Proc: proc_0x1002a55
int proc_0x1002a55(int arg0)
{
short loc1;
int loc2;
int loc3;
LPWSTR loc4;
LPWIN32_FIND_DATAW loc5;
int loc6;
int loc7; /* edi */
int loc8; /* ecx */
int loc9; /* eax */
int loc10; /* esi */
loc7 = loc7;
loc2 = gVal_0x1009604;
loc8 = 63;
loc9 = 0;
loc7 = &loc3;
if (lstrcmpW (arg0, gVal_0x1009040) == 0) {
loc9 = proc_0x1002409 (&loc4);
}
else {
GetFileAttributesW (loc10);
FindFirstFileW (loc10, loc5);
if (loc7 != 0xFFFFFFFF) {
FindClose (loc7);
}
else {
}
GetFileTitleW ();
}
_snwprintf ();
if (gVal_0x1009834 != 0) {
SendMessageW ();
}
lstrcatW (loc4, gVal_0x1009044);
SetWindowTextW ();
loc9 = proc_0x1007147 ();
return (loc9);
}
// Proc: proc_0x100417a
int proc_0x100417a(int arg0)
{
int loc1; /* eax */
while ((([] != 32) && ([] != 9))) {
loc1++;
loc1++;
} /* end of while */
goto L11;
}
else {
return (loc1);
}
}
// Proc: proc_0x1003f4c
short proc_0x1003f4c()
{
int loc1;
int loc2; /* edi */
int loc3; /* ebx */
int loc4; /* eax */
short loc5; /* ax */
loc2 = loc2;
loc3 = loc4;
if ( != 0) {
do {
loc4 = loc4;
CharUpperW ();
loc1 = loc4;
loc2++;
loc2++;
loc3++;
loc3++;
CharUpperW ();
if (loc1 == ) {
}
else {
loc4 = 0;
loc4++;
return (loc5);
}
} while (( != 0));
loc4 = 0;
}
}
// Proc: proc_0x1004dcd
int proc_0x1004dcd(int arg0)
{
int loc1; /* edx */
int loc2; /* ecx */
int loc3; /* esi */
LPWSTR loc4; /* eax */
while ((((([] == 46) || ([] == 46)) || (loc1 == 58)) || (loc2 <= loc3))) {
loc2--;
loc2--;
} /* end of while */
if (([] != 46) && ((lstrlenW (arg0) + 5) <= 260)) {
loc4 = lstrcatW (arg0, ".");
}
return (loc4);
}
// Proc: proc_0x1003f99
int proc_0x1003f99(int arg0, int arg1)
{
int loc1;
LPWIN32_FIND_DATAW loc2;
int loc3; /* edi */
int loc4; /* esi */
int loc5; /* edx */
short loc6; /* ax */
int loc7; /* ecx */
int loc8; /* eax */
loc3 = loc3;
loc1 = gVal_0x1009604;
if (([] != 34) && ([] != 39)) {
lstrcpynW (arg0, arg1, 260);
}
else {
loc4++;
loc4++;
while (((([] == 0) || ) || (loc5 >= 260))) {
= loc6;
loc7++;
loc7++;
loc5++;
loc4++;
loc4++;
loc8 = 0;
} /* end of while */
= ( & 0);
}
if (FindFirstFileW (arg0, loc2) == 0xFFFFFFFF) {
proc_0x1004dcd (arg0);
if (FindFirstFileW (arg0, loc2) != 0xFFFFFFFF) {
FindClose (FindFirstFileW (arg0, loc2));
loc8 = arg1;
loc8 = proc_0x1007147 ();
return (loc8);
}
}
}
// Proc: proc_0x1001f02
int proc_0x1001f02(int arg0, int arg2, int arg1)
{
int loc1; /* edi */
short loc2; /* dx */
int loc3; /* eax */
int loc4; /* ecx */
int loc5; /* esi */
loc1 = loc1;
loc2 = [];
while (([] != gVal_0x100ab90)) {
[] = [];
loc3 = (arg2 + 2);
loc4 = (arg0 + 2);
loc2 = [];
} /* end of while */
if (arg1 != 0) {
while (([] != 0)) {
[] = loc2;
loc3 = (loc3 + loc1);
loc5 = (loc5 + loc1);
} /* end of while */
}
do {
[] = [];
loc3 = (arg2 + 2);
loc4 = ((arg0 + 4) + 2);
} while (([] != 0));
loc3 = 0;
loc3++;
return (loc3);
}
// Proc: proc_0x1001f70
int proc_0x1001f70(int arg3, int arg2, int arg4, int arg1, int arg0)
{
int loc1; /* edi */
int loc2; /* esi */
int loc3; /* eax */
loc1 = loc1;
loc2 = ;
if (arg3 != 0) {
}
else {
}
if (LocalAlloc (64, (((lstrlenW (arg2) + lstrlenW (arg3)) * 2) + 2)) != 0) {
MessageBoxW ();
loc1 = proc_0x1001f02 (arg2, arg3, LocalAlloc (64, (((lstrlenW (arg2) + lstrlenW (arg3)) * 2) + 2)));
LocalFree (LocalAlloc (64, (((lstrlenW (arg2) + lstrlenW (arg3)) * 2) + 2)));
}
else {
MessageBoxW ();
loc1 = LocalAlloc (64, (((lstrlenW (arg2) + lstrlenW (arg3)) * 2) + 2));
}
loc3 = loc1;
return (loc3);
}
// Proc: proc_0x1004e20
int proc_0x1004e20(int arg0)
{
int loc1;
LPWSTR loc2;
int loc3; /* eax */
loc1 = gVal_0x1009604;
GetUserDefaultUILanguage ();
if (FormatMessageW (0x1200, 0, GetLastError (), loc2, loc2, 256, 0) != 0) {
MessageBoxW ();
}
else {
loc3 = proc_0x1001f70 (gVal_0x1009830, gVal_0x1009054, gVal_0x1009034);
}
loc3 = proc_0x1007147 ();
return (loc3);
}
// Proc: proc_0x10070b1
int proc_0x10070b1(int arg1, int arg0)
{
LPINT loc1;
IsTextUnicode (arg0, arg1, loc1);
return;
}
// Proc: proc_0x1007059
int proc_0x1007059(int arg1, int arg0)
{
int loc1; /* esi */
int loc2; /* edx */
int loc3; /* ecx */
int loc4; /* eax */
char loc5; /* al */
loc1 = 0;
loc1++;
loc2 = 0;
if (arg1 > 0) {
do {
if (0 == 0) {
if ([] >= 128) {
do {
loc2++;
} while ((([] << 1) >= 0));
loc2--;
if loc2 {
loc3++;
}
else {
loc4 = 0;
return;
}
}
}
else {
loc5 = (loc5 & 192);
if (loc5 == 128) {
loc2--;
}
}
} while ((loc3 < arg1));
goto L12;
}
else {
loc4 = 0;
loc4++;
}
}
}
// Proc: proc_0x1001b99
int proc_0x1001b99(int arg0)
{
int loc1; /* eax */
loc1 = arg0;
loc1--;
SendMessageW ();
if (loc1 != 0xFFFFFFFF) {
SendMessageW ();
SendMessageW ();
}
return (loc1);
}
// Proc: proc_0x1004c49
int proc_0x1004c49()
{
int loc1; /* edi */
int loc2; /* eax */
loc1 = loc1;
if (gVal_0x1009850 != 0) {
if (gVal_0x1009858 != 0) {
loc2 = proc_0x1001b99 (1);
}
else {
SendMessageW ();
SendMessageW ();
}
SendMessageW ();
}
return (loc2);
}
// Proc: proc_0x1004b99
int proc_0x1004b99(int arg4, int arg1, int arg3, int arg2, int arg0)
{
int loc1;
DWORD loc2;
HLOCAL loc3;
LPDWORD loc4;
int loc5; /* edi */
int loc6; /* eax */
int loc7; /* esi */
loc5 = loc5;
if (arg4 == 0) {
loc6 = 0;
loc6++;
}
else {
loc1 = 0;
if (arg1 != 0xFDE9) {
loc1 = &loc2;
}
loc7 = ;
WideCharToMultiByte ();
if (&loc2 != 0) {
loc3 = LocalAlloc (64, (&loc2 + 1));
if (LocalAlloc (64, (&loc2 + 1)) == 0) {
SetLastError (8);
loc6 = 0;
return (loc6);
}
else {
WideCharToMultiByte ();
if (LocalAlloc (64, (&loc2 + 1)) != 0) {
}
LocalFree (loc3);
loc6 = WriteFile (arg0, loc3, &loc2, &loc4, 0);
}
}
}
}
// Proc: proc_0x1004b65
int proc_0x1004b65(int arg2, int arg1, int arg0)
{
int loc1; /* esi */
short loc2; /* dx */
int loc3; /* ebx */
int loc4; /* edx */
int loc5; /* ecx */
int loc6; /* eax */
loc1 = arg2;
if (arg2 > 0) {
do {
loc2 = [];
loc3 = 0;
loc4 = (loc4 ^ loc3);
[] = loc2;
loc5++;
loc5++;
loc6++;
loc6++;
} while ((--loc1 != 0));
}
return;
}
// Proc: proc_0x10019e0
int proc_0x10019e0(LPARAM arg1, int arg0)
{
InvalidateRect ();
MoveWindow ();
return (((gVal_0x1009840 - 1) & gVal_0x100a6e0));
}
// Proc: proc_0x1005b41
int proc_0x1005b41(int arg0)
{
int loc1;
int loc2;
int loc3;
int loc4;
HLOCAL loc5;
LPRECT loc6;
int loc7;
LPRECT loc8;
int loc9; /* edi */
HWND loc10; /* eax */
int loc11; /* Dmy */
loc9 = loc9;
loc1 = ((arg0 >> 20) & 1);
SetCursor ();
loc2 = loc10;
if ( != 0) {
SendMessageW ();
}
SendMessageW ();
loc10 = !proc_0x1001b99 (1);
loc10 = !loc10;
loc3 = loc10;
SendMessageW ();
loc4 = loc10;
loc11 = loc10;
loc11 = (loc11 * 2);
loc11 = (loc11 + 2);
loc10 = loc11;
loc5 = LocalAlloc (2, loc10);
if (LocalAlloc (2, loc10) == 0) {
if (loc1 != 0) {
SendMessageW ();
}
SetCursor ();
loc10 = 0;
}
else {
GetClientRect (gVal_0x1009830, loc6);
loc10 = LocalLock (loc5);
loc7 = LocalLock (loc5);
loc10 = loc4;
loc10++;
SendMessageW ();
arg0 = CreateWindowExW (512, "E", "", arg0, 0, 0, loc6->right, loc6->bottom, gVal_0x1009830, 15, gVal_0x100ab80, 0);
if (CreateWindowExW (512, "E", "", arg0, 0, 0, loc6->right, loc6->bottom, gVal_0x1009830, 15, gVal_0x100ab80, 0) == 0) {
SetCursor ();
if (loc1 != 0) {
SendMessageW ();
LocalUnlock (loc5);
LocalFree (loc5);
}
}
else {
GetWindowLongW ();
SetWindowLongW ();
SendMessageW ();
SendMessageW ();
if ((CreateWindowExW (512, "E", "", arg0, 0, 0, loc6->right, loc6->bottom, gVal_0x1009830, 15, gVal_0x100ab80, 0) | 512) == 0) {
SetCursor ();
if (loc1 != 0) {
SendMessageW ();
}
DestroyWindow (arg0);
}
else {
LocalUnlock (loc5);
DestroyWindow (gVal_0x1009838);
gVal_0x1009838 = arg0;
if (gVal_0x100ab8c != 0) {
LocalFree (gVal_0x100ab8c);
}
gVal_0x100ab8c = loc5;
PostMessageW ();
ShowWindow (gVal_0x1009830, 5);
SendMessageW ();
SetFocus ();
SetCursor ();
if (gVal_0x1009840 != 0) {
GetClientRect (gVal_0x1009830, loc8);
loc10 = proc_0x10019e0 ((loc8->right - loc8), (loc8->bottom - loc8->top));
loc10 = proc_0x1001c42 (1);
ShowWindow (gVal_0x1009834, 5);
}
loc10 = 0;
loc10++;
return (loc10);
}
}
}
}
// Proc: proc_0x1004cab
int proc_0x1004cab()
{
int loc1; /* eax */
if (gVal_0x1009850 != 0) {
if (gVal_0x1009858 != 0) {
loc1 = proc_0x1005b41 (0x50200104);
return (loc1);
}
else {
SendMessageW ();
SendMessageW ();
return (0);
}
}
}
// Proc: proc_0x1004eae
int proc_0x1004eae(int arg2, int arg1, int arg0)
{
int loc1;
int loc2;
HLOCAL loc3;
LPDWORD loc4;
int loc5;
int loc6; /* edi */
int loc7; /* eax */
int loc8; /* ebx */
int loc9; /* esi */
int loc10; /* Dmy */
loc6 = loc6;
loc1 = 0;
if (arg2 == 0) {
}
else {
}
gVal_0x100a480 = CreateFileW (arg1, 0xC0000000, 1, 3, 0, 4, 128);
if (CreateFileW (arg1, 0xC0000000, 1, 3, 0, 4, 128) != 0xFFFFFFFF) {
GetLastError ();
loc2 = 0;
if (gVal_0x100a480 == 0xFFFFFFFF) {
proc_0x1001f70 (arg0, gVal_0x1009054, gVal_0x1009068);
loc7 = 0;
return (loc7);
}
else {
if (gVal_0x1009850 != 0) {
}
loc6 = [];
SendMessageW ();
loc8 = proc_0x1004c49 ();
SendMessageW ();
loc3 = proc_0x1004c49 ();
if (proc_0x1004c49 () != 0) {
arg2 = LocalLock (proc_0x1004c49 ());
if (LocalLock (proc_0x1004c49 ()) != 0) {
loc7 = gVal_0x100a528;
loc7--;
if loc7 {
loc7--;
if loc7 {
loc7--;
if loc7 {
}
if (gVal_0x100a528 != 3) {
GetACP ();
loc5 = WriteFile (gVal_0x100a480, "??, 3, &loc4, 0);
loc6 = 0x400;
}
else {
loc7 = 0;
loc5 = 0xFDE9;
}
WideCharToMultiByte ();
if (loc1 == 0) {
if ((proc_0x1004c49 () != 0) && (&loc1 == 0)) {
if (proc_0x1001f70 (arg0, gVal_0x1009054, gVal_0x10090a0) != 2) {
loc6 = 0;
if (loc6 == loc9) {
SetCursor ();
loc7 = proc_0x1004e20 (arg1);
SetCursor ();
CloseHandle (gVal_0x100a480);
gVal_0x100a480 = (gVal_0x100a480 | 0xFFFFFFFF);
if (loc3 != 0) {
LocalUnlock (loc3);
}
if (loc2 != 0) {
DeleteFileW (arg1);
}
if (gVal_0x1009850 != 0) {
loc7 = proc_0x1004cab ();
}
loc7 = 0;
}
else {
SetEndOfFile (gVal_0x100a480);
gVal_0x1009030 = gVal_0x100a528;
SendMessageW ();
loc7 = proc_0x1002a55 (arg1);
gVal_0x100901c = 0;
CloseHandle (gVal_0x100a480);
gVal_0x100a480 = (gVal_0x100a480 | 0xFFFFFFFF);
LocalUnlock (loc3);
if (gVal_0x1009850 != 0) {
loc7 = proc_0x1004cab ();
}
SetCursor ();
loc7 = 0;
loc7++;
}
}
}
}
}
else {
WriteFile (gVal_0x100a480, "?", 2, &loc4, loc9);
loc10 = (loc10 * 2);
(gVal_0x100a480, arg2);
}
}
else {
WriteFile (gVal_0x100a480, "??, 2, &loc4, loc9);
loc10 = (loc10 * 2);
();
}
}
}
}
}
}
// Proc: proc_0x100270f
int proc_0x100270f(int arg0)
{
int loc1;
LPWSTR loc2;
int loc3;
int loc4;
int loc5; /* edi */
int loc6; /* ecx */
int loc7; /* esi */
int loc8; /* eax */
int loc9; /* ebx */
loc5 = loc5;
loc1 = gVal_0x1009604;
loc2 = 0;
loc6 = 129;
loc5 = &loc3;
loc7 = 0;
loc7++;
loc5 = ;
loc4 = loc7;
if (gVal_0x100901c != 0) {
SendMessageW ();
if (0 != 0) {
SendMessageW ();
if (0 != 0) {
loc8 = gVal_0x1009040;
if (gVal_0x100901c == 0) {
loc8 = 0x100A900;
}
gVal_0x1009854 = loc7;
loc4 = proc_0x1001f70 (gVal_0x1009830, gVal_0x1009054, gVal_0x100903c);
gVal_0x1009854 = 0;
if (proc_0x1001f70 (gVal_0x1009830, gVal_0x1009054, gVal_0x100903c) == 6) {
if (gVal_0x100901c != 0) {
}
else {
gVal_0x100a528 = gVal_0x1009030;
if (proc_0x1004eae (gVal_0x1009830, 0x100A900) != 0) {
loc8 = loc7;
loc8 = proc_0x1007147 ();
return (loc8);
}
else {
lstrcpyW (loc2, "*");
loc9 = 0x100A680;
gVal_0x100a69c = &loc2;
gVal_0x1009854 = loc7;
gVal_0x100a698 = loc7;
gVal_0x100a6bc = 0x10013C4;
gVal_0x100a68c = 0x100A540;
gVal_0x100a6c4 = 0x1001A28;
gVal_0x100a6c8 = 0x10013A0;
gVal_0x100a6b4 = 0x888866;
gVal_0x100a6b0 = gVal_0x1009090;
SendMessageW ();
while ((gVal_0x1009090 != 0)) {
lstrcpyW (loc2, gVal_0x100a69c);
loc8 = proc_0x1004eae (gVal_0x1009830, &loc2);
if (loc2 == 0) {
loc8 = lstrcpyW (loc2, gVal_0x100a900);
}
else {
lstrcpyW (gVal_0x100a900, loc8);
gVal_0x1009030 = gVal_0x100a528;
gVal_0x1009854 = (gVal_0x1009854 & 0);
loc8 = 0;
}
gVal_0x100a69c = &loc2;
gVal_0x1009854 = loc7;
gVal_0x100a698 = loc7;
gVal_0x100a6bc = 0x10013C4;
gVal_0x100a68c = 0x100A540;
gVal_0x100a6c4 = 0x1001A28;
gVal_0x100a6c8 = 0x10013A0;
gVal_0x100a6b4 = 0x888866;
gVal_0x100a6b0 = gVal_0x1009090;
SendMessageW ();
} /* end of while */
loc4 = 2;
CommDlgExtendedError ();
if (gVal_0x1009090 != 0) {
MessageBoxW ();
}
}
}
}
}
}
}
}
// Proc: proc_0x1004cff
int proc_0x1004cff(int arg0)
{
int loc1; /* edi */
int loc2; /* ebx */
loc1 = loc1;
if (arg0 != 0) {
if (proc_0x100270f (0, loc2) != 0) {
SendMessageW ();
gVal_0x100901c = 1;
lstrcpyW (gVal_0x100a900, gVal_0x1009040);
proc_0x1002a55 (0x100A900);
SendMessageW ();
SendMessageW ();
if (LocalReAlloc (gVal_0x100ab8c, 2, 2) != 0) {
gVal_0x100ab8c = LocalReAlloc (gVal_0x100ab8c, 2, 2);
}
LocalLock (gVal_0x100ab8c);
= 0;
LocalUnlock (gVal_0x100ab8c);
SendMessageW ();
gVal_0x100a800 = 0;
return;
}
}
}
// Proc: proc_0x1006f10
int proc_0x1006f10(int arg0)
{
int loc1;
LPWSTR loc2;
int loc3;
LPSYSTEMTIME loc4;
LPCWSTR loc5;
LPCWSTR loc6;
int loc7; /* edi */
int loc8; /* esi */
short loc9; /* si */
int loc10; /* eax */
loc7 = loc7;
loc1 = gVal_0x1009604;
loc2 = 0;
loc7 = &loc3;
loc8 = 0;
loc8++;
loc7 = loc8;
GetUserDefaultLCID ();
if (((0 & 0x3FF) != loc9) && ((0 & 0x3FF) != 13)) {
}
GetLocalTime (loc4);
if ( != 0) {
GetWindowLongW ();
if ((loc2 & 32) != 0) {
}
else {
}
lstrcatW (loc2, " ");
}
GetDateFormatW ();
GetTimeFormatW ();
if (arg0 != 0) {
lstrcatW (loc2, "\r");
}
lstrcatW (loc2, loc6);
lstrcatW (loc2, " ");
lstrcatW (loc2, loc5);
if (arg0 != 0) {
lstrcatW (loc2, "\r");
}
SendMessageW ();
loc10 = proc_0x1007147 ();
return;
}
// Proc: proc_0x1005179
int proc_0x1005179()
{
int loc1;
int loc2;
int loc3;
int loc4;
int loc5;
int loc6;
int loc7;
int loc8;
LPWSTR loc9;
int loc10;
int loc11;
int loc12;
int loc13;
int loc14;
int loc15;
int loc16;
int loc17;
int loc18;
int loc19;
int loc20;
int loc21;
int loc22;
LPCWSTR loc23;
int loc24;
int loc25;
int loc26;
int loc27;
int loc28;
int loc29;
int loc30;
int loc31;
int loc32;
int loc33;
int loc34;
int loc35;
int loc36;
int loc37;
int loc38;
int loc39;
int loc40;
int loc41;
int loc42;
HLOCAL loc43;
int loc44;
int loc45;
LPCWSTR loc46;
int loc47;
int loc48;
int loc49;
int loc50;
int loc51;
int loc52;
int loc53; /* eax */
int loc54; /* edi */
int loc55; /* ebx */
int loc56; /* ecx */
int loc57; /* esi */
short loc58; /* cx */
int loc59; /* edx */
short loc60; /* di */
int loc61; /* Dmy */
short loc62; /* bx */
_SEH_prolog ();
loc53 = gVal_0x1009604;
loc1 = loc53;
loc54 = ;
loc3 = loc54;
loc55 = 0;
loc4 = loc55;
loc5 = loc55;
loc6 = loc55;
loc7 = loc55;
loc8 = loc55;
loc53 = gVal_0x100a480;
if loc53 = 0;
_SEH_epilog ();
return (loc53);
}
else {
loc56 = &loc9;
GetFileInformationByHandle ();
loc57 = loc10;
loc11 = loc57;
if CloseHandle (gVal_0x100a480);
gVal_0x100a480 = (gVal_0x100a480 | 0xFFFFFFFF);
}
else {
if if SetCursor ();
if loc54 = 0;
loc7 = loc54;
CreateFileMappingW ();
loc13 = loc53;
if MapViewOfFile ();
loc7 = loc53;
CloseHandle ();
loc54 = loc7;
CloseHandle ();
gVal_0x100a480 = (gVal_0x100a480 | 0xFFFFFFFF);
if SetCursor ();
}
else {
loc16 = loc55;
loc11 = loc54;
loc53 = loc17;
if loc53 = ;
if if (loc53 != 0xFEFF) {
if (loc53 == 0xFFFE) {
loc18 = 1;
loc3 = 2;
loc55 = (loc57 >> 1);
loc55--;
loc33 = loc55;
if (loc20 == 0) {
MultiByteToWideChar ();
loc21 = loc53;
loc53 = 0;
}
SendMessageW ();
(gVal_0x1009838);
(gVal_0x1009838);
LocalReAlloc (gVal_0x100ab8c, ((loc55 * 2) + 2), 2);
loc22 = loc53;
if (loc53 == 0) {
lstrcpyW (loc9, loc23);
SetCursor ();
if (loc54 != &loc25) {
UnmapViewOfFile (loc54);
}
(gVal_0x1009838);
}
else {
LocalLock (loc53);
loc34 = loc53;
if (loc32 != 0) {
if ( == 0xFEFF) {
loc57 = (loc54 + 2);
}
else {
if (loc58 == 0xFFFE) {
loc53 = loc29;
gVal_0x1009030 = loc39;
do {
} while ((loc54 == &loc43));
UnmapViewOfFile (loc54);
loc53 = loc36;
if (loc53 != 0) {
if (loc55 > loc54) {
do {
= 32;
loc56++;
loc56++;
loc59--;
} while (loc59);
do {
= loc60;
loc53++;
loc53++;
} while (( != 46));
loc53++;
loc53++;
if ( == 76) {
loc53++;
loc53++;
if ( == 79) {
loc44 = 1;
if ( != 71) {
loc44 = loc54;
do {
} while ((loc45 == loc54));
LocalUnlock (loc43);
gVal_0x100ab8c = loc45;
lstrcpyW (gVal_0x100a900, loc46);
gVal_0x100901c = loc54;
gVal_0x1009848 = 1;
();
if (gVal_0x1009848 == 2) {
SetCursor ();
gVal_0x1009848 = loc54;
(gVal_0x1009838);
}
else {
gVal_0x1009848 = loc54;
PostMessageW ();
if (loc48 != loc54) {
(gVal_0x1009838);
(gVal_0x1009838);
loc55++;
(gVal_0x1009838);
SetScrollPos ();
(gVal_0x1009838);
InvalidateRect ();
UpdateWindow (gVal_0x1009838);
SetCursor ();
loc53 = loc55;
}
}
}
}
}
}
loc53 = 0;
loc53++;
return (loc53);
}
}
else {
loc56 = ((loc55 * 2) >> 2);
loc56 = ((loc55 * 2) & 3);
}
}
}
else {
MultiByteToWideChar ();
loc38 = loc53;
}
}
}
else {
loc15 = loc53;
if (loc53 != loc55) {
loc7 = 1;
loc55 = (loc57 >> 1);
}
else {
loc19 = loc53;
if (loc53 != loc55) {
loc5 = 3;
loc15 = 0xFDE9;
}
else {
loc27 = loc55;
loc28 = loc55;
}
}
}
}
else {
loc53 = 0;
loc53++;
loc18 = loc53;
loc3 = loc53;
}
}
else {
if if loc50 = 1;
loc51 = 0xFDE9;
loc53 = 3;
loc52 = loc53;
loc61 = loc54;
loc61 = (loc61 + 3);
loc56 = loc61;
loc30 = loc56;
loc57 = (loc57 - loc53);
loc31 = loc57;
}
}
}
}
else {
loc53--;
if loc53--;
if loc53--;
goto L13;
}
else {
loc29 = 1;
loc28 = 0xFDE9;
loc53 = 3;
loc27 = loc53;
if if goto L14;
}
}
}
}
}
else {
loc53 = 0;
loc53++;
loc32 = loc53;
loc27 = loc53;
loc55 = loc57;
loc55 = (loc55 >> 1);
loc33 = loc55;
goto L15;
}
}
}
else {
loc53 = 0;
loc53++;
loc32 = loc53;
loc27 = loc53;
loc55 = loc57;
loc55 = (loc55 >> 1);
loc33 = loc55;
}
}
}
}
}
else {
loc53 = &loc11;
loc7 = loc53;
loc11 = loc62;
}
}
else {
proc_0x1001f70 ();
}
}
}
}
}
// Proc: proc_0x100419e
int proc_0x100419e(int arg0)
{
int loc1;
int loc2; /* edi */
int loc3; /* eax */
short loc4; /* ax */
int loc5; /* esi */
loc2 = loc2;
loc3 = arg0;
loc1 = 0;
loc4 = proc_0x1003f4c ();
if (loc3 == 0) {
gVal_0x100984c = 1;
GetSystemMenu ();
gVal_0x100a6dc = loc3;
gVal_0x100a6d8 = LoadAcceleratorsW (gVal_0x100ab80, "S");
SetWindowLongW ();
loc3 = proc_0x100417a ((arg0 + 14));
if ( != 0) {
loc5 = 0x100A900;
proc_0x1003f99 (0x100A900, loc3);
gVal_0x100a480 = CreateFileW (gVal_0x100a900, 0x80000000, 3, 0, 3, 128, 0);
if (CreateFileW (gVal_0x100a900, 0x80000000, 3, 0, 3, 128, 0) == 0xFFFFFFFF) {
GetLastError ();
loc3--;
loc3--;
if loc3 {
loc3 = (loc3 - 3);
if (loc3 != 0) {
loc3 = (loc3 - 118);
if (loc3 != 0) {
loc1 = proc_0x1001f70 (gVal_0x1009830, gVal_0x1009054, gVal_0x1009034);
if (gVal_0x100a480 != 0xFFFFFFFF) {
proc_0x1005179 (0x100A900, gVal_0x1009a80);
if (loc1 != 2) {
loc3 = 6;
return (loc3);
}
}
else {
loc3 = 0;
}
}
else {
}
}
else {
}
}
else {
loc1 = loc3;
if (loc3 == 6) {
();
gVal_0x100a480 = loc3;
}
}
}
}
}
}
// Proc: proc_0x1006428
int proc_0x1006428()
{
BOOL loc1; /* eax */
int loc2; /* edi */
int loc3; /* Dmy */
int loc4; /* esi */
if (gVal_0x100a4ac == 0) {
gVal_0x100a4b1 = (gVal_0x100a4b1 | 4);
PageSetupDlgW ();
gVal_0x100a4b1 = (gVal_0x100a4b1 & 251);
if (gVal_0x100a4ac == 0) {
MessageBoxW ();
loc1 = (loc1 | 0xFFFFFFFF);
return (loc1);
}
else {
loc2 = ;
loc1 = 0;
if (gVal_0x100a4a8 != 0) {
loc1 = GlobalLock (gVal_0x100a4a8);
}
loc3 = ([] * 2);
loc3 = (loc3 + loc4);
loc1 = loc3;
loc3 = ([] * 2);
loc3 = (loc3 + loc4);
loc1 = loc3;
CreateDCW ();
loc2 = loc1;
GlobalUnlock (gVal_0x100a4ac);
if (gVal_0x100a4a8 != 0) {
}
if (loc2 == 0) {
MessageBoxW ();
loc1 = (GlobalUnlock (gVal_0x100a4a8) | 0xFFFFFFFF);
}
else {
loc1 = loc2;
}
return (loc1);
}
}
}
// Proc: proc_0x10064f3
int proc_0x10064f3()
{
int loc1;
UINT loc2;
int loc3; /* edi */
HLOCAL loc4; /* eax */
loc3 = loc3;
OpenPrinterW ();
if (&loc1 == 0) {
loc4 = (&loc1 | 0xFFFFFFFF);
}
else {
GetPrinterDriverW ();
if (LocalAlloc (64, loc2) == 0) {
ClosePrinter ();
LocalFree (LocalAlloc (64, loc2)) = (LocalFree (LocalAlloc (64, loc2)) | 0xFFFFFFFF);
}
else {
ClosePrinter ();
if (&loc2 == 0) {
LocalFree (LocalAlloc (64, loc2));
}
else {
gVal_0x100a4b1 = (gVal_0x100a4b1 | 4);
PageSetupDlgW ();
gVal_0x100a4b1 = (gVal_0x100a4b1 & 251);
CreateDCW ();
ClosePrinter ();
if (&loc2 == 0) {
MessageBoxW ();
}
else {
loc4 = &loc2;
return;
}
}
}
}
}
// Proc: proc_0x1005e6d
int proc_0x1005e6d()
{
int loc1;
int loc2;
int loc3;
int loc4;
int loc5;
int loc6;
int loc7;
int loc8;
int loc9; /* edi */
int loc10; /* eax */
int loc11; /* edx */
loc9 = loc9;
if (gVal_0x100a4ac == 0) {
gVal_0x100a4b0 = (gVal_0x100a4b0 | 0x480);
PageSetupDlgW ();
gVal_0x100a4b0 = (gVal_0x100a4b0 & 0xFFFFFB7F);
}
loc10 = 0;
loc2 = gVal_0x1009830;
loc1 = 84;
loc3 = (&loc1 | 0xFFFFFFFF);
loc4 = 0x84010C;
if (gVal_0x100a4a8 != 0) {
loc5 = gVal_0x100a4a8;
}
if (loc11 != 0) {
loc6 = gVal_0x100a4ac;
}
PrintDlgExW ();
if (&loc1 == 0) {
if (loc7 != 1) {
if (loc7 == 2) {
if (gVal_0x100a4a8 == 0) {
gVal_0x100a4b0 = (gVal_0x100a4b0 | 0x480);
PageSetupDlgW ();
gVal_0x100a4b0 = (gVal_0x100a4b0 & 0xFFFFFB7F);
}
gVal_0x100a4a8 = loc5;
gVal_0x100a4ac = loc6;
loc10 = loc9;
return;
}
}
else {
}
}
}
// Proc: proc_0x1005e0c
void proc_0x1005e0c(int arg0)
{
int loc1; /* edi */
int loc2; /* eax */
loc1 = loc1;
loc1 = arg0;
GetDeviceCaps ();
gVal_0x1009ae8 = loc2;
GetDeviceCaps ();
gVal_0x1009ae4 = loc2;
GetDeviceCaps ();
gVal_0x1009ae0 = loc2;
GetDeviceCaps ();
gVal_0x1009adc = loc2;
GetDeviceCaps ();
gVal_0x1009ad8 = loc2;
GetDeviceCaps ();
gVal_0x1009ad4 = loc2;
GetDeviceCaps ();
gVal_0x1009ad0 = loc2;
return;
}
// Proc: proc_0x1006091
int proc_0x1006091(int arg0)
{
int loc1;
int loc2;
int loc3;
int loc4;
int loc5;
int loc6;
int loc7;
LPCWSTR loc8;
int loc9; /* edi */
int loc10; /* esi */
int loc11; /* eax */
int loc12; /* ecx */
int loc13; /* Dmy */
int loc14; /* ebp */
int loc15; /* edx */
short loc16; /* cx */
int loc17; /* ebx */
loc9 = loc9;
loc1 = gVal_0x1009604;
loc10 = 0;
loc3 = arg0;
loc10++;
loc4 = 0;
loc5 = 0;
loc6 = 0;
time ();
localtime ();
if ([] != 0) {
loc11 = gVal_0x1009080;
if ([] == 0) {
loc12 = loc3;
if ([loc7] == 38) {
if (([loc7] != []) && ([loc7] != )) {
if (([loc7] != ) && ([loc7] != )) {
if (([loc7] != ) && ([loc7] != )) {
if (([loc7] != ) && ([loc7] != )) {
if ([loc7] == 38) {
loc13 = loc10;
loc13 = (loc13 * 4);
loc13 = (loc13 + loc14);
loc13 = (loc13 + 0xFFFFFDE0);
loc12 = loc13;
loc7 = ([loc7] + 1);
if (([loc7] + 1) < 260) {
loc9 = loc10;
loc9 = (loc9 * 260);
loc9 = (loc9 + [loc7]);
gVal_0x1009b00 = 38;
[loc7] = loc7;
if ([loc7] == 0) {
do {
loc15 = ([] + 0);
gVal_0x1009b00 = (gVal_0x1009b00 & 0);
loc11 = (&loc4 + 4);
} while (((0 + 260) <= 520));
loc11 = proc_0x1007147 ();
return (loc11);
}
else {
if (loc16 != 38) {
loc17 = (loc17 * 260);
loc13 = (loc13 * 4);
loc13 = (loc13 + loc14);
loc13 = (loc13 + 0xFFFFFDE0);
loc17 = (loc17 + );
gVal_0x1009b00 = loc16;
loc9++;
= loc9;
}
}
}
}
else {
if ((loc16 != ) && (loc16 != )) {
if ((loc16 != ) && (loc16 != )) {
if ((loc16 != ) && (loc16 != )) {
}
else {
}
}
else {
}
}
else {
loc10++;
}
}
}
else {
();
loc13 = (loc13 * 4);
loc13 = (loc13 + loc14);
loc13 = (loc13 + 0xFFFFFDE0);
loc13 = ([] + loc11);
loc7 = loc15;
if (loc15 < 260) {
loc11 = loc10;
loc11 = (loc11 * 260);
loc11 = (loc11 + loc12);
loc13 = (loc13 * 2);
loc13 = (loc13 + 0x1009B00);
loc11 = loc13;
wcsncpy ();
loc11 = loc7;
[] = loc11;
loc11 = gVal_0x1009080;
}
}
}
else {
();
loc13 = (loc13 * 4);
loc13 = (loc13 + loc14);
loc13 = (loc13 + 0xFFFFFDE0);
loc13 = ([] + loc11);
loc7 = loc15;
if (loc15 < 260) {
}
}
}
else {
loc11 = loc3;
if ([] == 43) {
loc11++;
loc11++;
loc3 = loc11;
iswctype ([], 4);
while ((loc11 != 0)) {
loc13 = (loc13 * 5);
loc13 = (loc13 * 2);
loc13 = (loc13 + []);
loc13 = (loc13 + 0xFFFFFFD0);
loc11++;
loc11++;
loc3 = loc11;
iswctype ([], 4);
} /* end of while */
}
loc11 = (gVal_0x1009abc + loc9);
wsprintfW ();
loc13 = (loc13 * 4);
loc13 = (loc13 + loc14);
loc13 = (loc13 + 0xFFFFFDE0);
();
loc12 = (loc12 + []);
if (loc12 < 260) {
loc12 = (loc12 * 260);
loc12 = (loc12 + loc11);
loc13 = (loc13 * 2);
loc13 = (loc13 + 0x1009B00);
loc11 = loc13;
lstrcpyW (loc11, loc8);
(&loc8);
loc11 = (loc11 + []);
[] = loc11;
}
}
}
else {
loc11 = &loc8;
if (gVal_0x100901c == 0) {
GetFileTitleW ();
}
else {
lstrcpyW (loc11, gVal_0x1009040);
}
loc13 = (loc13 * 4);
loc13 = (loc13 + loc14);
loc13 = (loc13 + 0xFFFFFDE0);
(&loc8);
loc12 = (loc12 + []);
if (loc12 < 260) {
loc12 = (loc12 * 260);
loc12 = (loc12 + loc11);
loc13 = (loc13 * 2);
loc13 = (loc13 + 0x1009B00);
loc11 = loc13;
lstrcpyW (loc11, loc8);
(&loc8);
loc11 = (loc11 + []);
}
}
}
}
}
}
// Proc: proc_0x1006657
int proc_0x1006657(int arg1, int arg0)
{
int loc1;
int loc2; /* edi */
int loc3; /* eax */
int loc4; /* edx */
loc2 = loc2;
if ( == 0) {
loc3 = 0;
}
else {
proc_0x1006091 ((((arg1 * 5) << 4) + 0x100A3E0));
if (arg1 == 0) {
}
else {
loc3 = ((gVal_0x1009ae4 - gVal_0x100a130) - gVal_0x1009ac8);
}
arg1 = gVal_0x1009acc;
if (gVal_0x1009b00 != 0) {
loc3 = lstrlenW (gVal_0x1009b00);
TextOutW ();
}
if (gVal_0x1009d08 != 0) {
loc3 = lstrlenW (gVal_0x1009d08);
GetTextExtentPoint32W ();
loc3 = ((gVal_0x1009ae8 - gVal_0x1009ac0) + gVal_0x1009ac4);
loc3 = (((gVal_0x1009ae8 - gVal_0x1009ac0) + gVal_0x1009ac4) - loc4);
loc2 = loc3;
loc3 = loc1;
loc3 = (loc1 - loc4);
loc3 = (loc3 >> 1);
loc2 = (loc2 >> 1);
loc2 = (loc2 - loc3);
loc3 = lstrlenW (gVal_0x1009d08);
TextOutW ();
}
if (gVal_0x1009f10 != 0) {
loc3 = lstrlenW (gVal_0x1009f10);
GetTextExtentPoint32W ();
loc3 = lstrlenW (gVal_0x1009f10);
TextOutW ();
}
loc3 = 0;
loc3++;
}
return;
}
// Proc: proc_0x1005f3c
int proc_0x1005f3c()
{
BOOL loc1; /* eax */
EnableWindow ();
loc1 = DestroyWindow (gVal_0x100a138);
gVal_0x100a138 = (gVal_0x100a138 & 0);
return (loc1);
}
// Proc: proc_0x1006773
int proc_0x1006773(int arg0)
{
int loc1;
int loc2;
HLOCAL loc3;
int loc4;
int loc5;
int loc6;
LPCWSTR loc7;
int loc8;
int loc9;
int loc10;
int loc11;
int loc12;
char loc13;
int loc14;
int loc15;
int loc16;
int loc17;
int loc18;
int loc19;
int loc20;
int loc21;
int loc22;
int loc23;
int loc24;
int loc25;
int loc26;
int loc27;
int loc28;
int loc29;
int loc30;
int loc31; /* edi */
int loc32; /* ecx */
int loc33; /* esi */
int loc34; /* edx */
int loc35; /* ebx */
int loc36; /* eax */
int loc37; /* Dmy */
short loc38; /* si */
char loc39; /* ah */
loc31 = loc31;
loc1 = gVal_0x1009604;
loc2 = arg0;
loc3 = 0;
loc4 = 0;
loc5 = 0;
loc6 = 0;
loc7 = 0;
gVal_0x100a134 = 0;
gVal_0x100a138 = 0;
SetCursor ();
proc_0x1005e0c (arg0);
GetUserDefaultLCID ();
loc8 = GetLocalTime (gVal_0x1009af0);
GetDateFormatW ();
GetTimeFormatW ();
loc32 = 23;
loc33 = 0x100AB20;
loc31 = &loc9;
loc34 = ((gVal_0x1009ae0 * gVal_0x1009018) % 0xFFFFFD30);
loc10 = 0;
loc35 = [];
loc9 = ((gVal_0x1009ae0 * gVal_0x1009018) / 0xFFFFFD30);
SetMapMode ();
SetViewportExtEx ();
SetWindowExtEx ();
loc31 = 0x100A120;
loc33 = 0x100A4CC;
LPtoDP ();
loc31 = 0;
loc31++;
SetMapMode ();
loc35 = [];
CreateFontIndirectW ();
loc11 = &loc9;
if (&loc9 != 0) {
SelectObject ();
loc4 = &loc9;
if (&loc9 != 0) {
SetBkMode ();
loc33 = [];
GetTextMetricsW ();
if (&loc12 != 0) {
if ((loc13 & 6) == 0) {
SelectObject ();
DeleteObject ();
loc32 = 16;
loc36 = 0;
loc31 = &loc14;
CreateFontIndirectW ();
loc11 = &loc9;
if (&loc9 != 0) {
SelectObject ();
loc4 = &loc9;
if (&loc9 != 0) {
GetTextMetricsW ();
if (&loc12 != 0) {
loc31 = 0;
loc31++;
gVal_0x100a13c = (loc16 << 3);
gVal_0x100a130 = (loc15 + loc12);
gVal_0x1009ac4 = (gVal_0x100a120 - gVal_0x1009ad4);
if ((gVal_0x100a120 - gVal_0x1009ad4) <= 0) {
gVal_0x1009ac4 = 0;
}
loc34 = ((gVal_0x1009ae8 - gVal_0x1009adc) + gVal_0x100a128);
loc36 = (loc36 + loc34);
gVal_0x1009ac0 = loc36;
if (loc36 <= loc35) {
gVal_0x1009ac0 = 0;
}
gVal_0x1009acc = (gVal_0x100a124 - gVal_0x1009ad0);
if (loc36 <= loc35) {
gVal_0x1009acc = 0;
}
loc33 = ((gVal_0x1009ae4 - gVal_0x1009ad8) + gVal_0x100a12c);
loc34 = (loc34 + loc33);
gVal_0x1009ac8 = loc34;
if (loc34 <= loc35) {
gVal_0x1009ac8 = 0;
}
loc36 = (loc36 - gVal_0x1009ac8);
loc36 = (loc36 - gVal_0x1009acc);
loc36 = (loc37 / loc32);
loc34 = (loc37 % loc32);
if (gVal_0x100a3e0 != 0) {
loc36--;
}
if (gVal_0x100a430 != 0) {
loc36--;
}
if (loc36 > loc35) {
SetAbortProc ();
loc33 = loc36;
if (loc33 >= 0) {
SendMessageW ();
loc3 = loc36;
if (loc36 != 0) {
loc7 = LocalLock (loc36);
if (LocalLock (loc36) != 0) {
GetWindowTextW ();
EnableWindow ();
CreateDialogParamW ();
gVal_0x100a138 = &loc17;
if (&loc17 != 0) {
loc18 = 20;
loc19 = &loc17;
loc20 = 0;
loc21 = 0;
loc22 = 0;
SetLastError (0);
StartDocW ();
if (&loc18 <= 0) {
if (loc4 != 0) {
SelectObject ();
DeleteObject ();
}
if (loc7 != 0) {
}
if (loc5 != 0) {
EndPage ();
if ((LocalUnlock (loc3) <= 0) && (GetLastError () == 0)) {
if (loc6 != 0) {
if (gVal_0x100a134 != 0) {
AbortDoc ();
DeleteDC ();
loc36 = proc_0x1005f3c ();
SetCursor ();
if (gVal_0x100a134 == 0) {
loc36 = GetLastError ();
}
else {
loc36 = 0xFFFFFFFD;
}
loc36 = proc_0x1007147 ();
return (loc36);
}
else {
EndDoc ();
if ((loc36 <= 0) && (loc33 == loc35)) {
GetLastError ();
}
}
}
}
}
}
else {
loc36 = 0;
loc6 = loc31;
loc31 = &loc23;
loc23 = gVal_0x1009ac4;
loc36 = gVal_0x1009ae8;
loc36 = (loc31 - gVal_0x1009ac0);
loc24 = loc36;
loc25 = gVal_0x1009acc;
loc36 = gVal_0x1009ae4;
loc36 = (loc31 - gVal_0x1009ac8);
loc8 = loc35;
loc5 = loc35;
loc26 = loc36;
if (gVal_0x100a3e0 != 0) {
loc25 = (loc25 + loc32);
}
if (gVal_0x100a430 != loc38) {
loc36 = (loc36 - loc32);
loc26 = loc36;
}
lstrlenW (loc7);
GetWindowLongW ();
if ((loc39 & 32) != 0) {
loc8 = 0x20002;
}
if (gVal_0x100a134 == loc33) {
while ((loc35 > 0)) {
_snwprintf ();
SetDlgItemTextW ();
loc36 = 0;
loc31 = &loc28;
loc28 = 20;
loc29 = gVal_0x100a13c;
StartPage ();
if (loc36 > 0) {
loc31++;
loc5 = loc31;
DrawTextExW ();
EndPage ();
if (loc36 > 0) {
gVal_0x1009abc++;
if (loc30 != 0) {
loc37 = (loc37 * 2);
loc37 = (loc37 + loc7);
loc35 = (loc35 - loc36);
loc7 = loc32;
}
else {
MessageBoxW ();
SetLastError (loc35);
GetLastError ();
}
}
}
} /* end of while */
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
// Proc: proc_0x1006df7
int proc_0x1006df7(int arg0)
{
int loc1; /* eax */
SetCursor ();
switch (arg0)
{
case 0:
goto L16;
break;
loc1--;
loc1--;
case 1:
goto L16;
break;
default:
goto L16;
break;
}
L16:
if (proc_0x1006428 () == 0xFFFFFFFF) {
SetCursor ();
loc1 = 0;
}
else {
loc1 = proc_0x1006773 (proc_0x1006428 ());
goto L17;
}
return (loc1);
}
// Proc: proc_0x1006e4b
int proc_0x1006e4b(int arg0)
{
int loc1;
LPWSTR loc2;
int loc3; /* esi */
int loc4; /* ecx */
int loc5; /* eax */
loc1 = gVal_0x1009604;
if (((proc_0x1006df7 (arg0) != 0) && (proc_0x1006df7 (arg0) != 0xFFFFFFFE)) && (proc_0x1006df7 (arg0) != 0xFFFFFFFD)) {
if (proc_0x1006df7 (arg0) == 0xFFFFFFFC) {
loc3 = 112;
}
if (loc3 == 0xFFFFFFFB) {
loc3 = 14;
}
if (loc3 == 0xFFFFFFFF) {
}
if (GetLastError () != 0) {
GetUserDefaultUILanguage ();
loc4 = gVal_0x1009060;
if (FormatMessageW (0x1200, 0, GetLastError (), loc2, loc2, 400, 0) != 0) {
loc4 = &loc2;
}
loc5 = gVal_0x1009040;
if (gVal_0x100901c == 0) {
loc5 = 0x100A900;
}
proc_0x1001f70 (gVal_0x1009830, gVal_0x1009054, loc4);
loc5 = proc_0x1007147 ();
return (loc5);
}
}
}
// Proc: proc_0x10042f9
int proc_0x10042f9(int arg0, int arg1)
{
int loc1;
int loc2; /* edi */
int loc3; /* eax */
int loc4; /* ecx */
short loc5; /* ax */
int loc6; /* esi */
short loc7; /* cx */
short loc8; /* di */
int loc9; /* edx */
loc2 = loc2;
loc3 = arg0;
loc4 = 0x1001774;
loc1 = 1;
loc5 = proc_0x1003f4c ();
if (loc3 == 0) {
loc6 = (arg0 + 6);
loc1 = 0;
if ( != 0) {
ShowWindow (gVal_0x1009830, arg1);
proc_0x1003f99 (0x100A900, proc_0x100417a ((arg0 + 6)));
loc3++;
loc3++;
if (loc1 == 0) {
if ( != 0) {
proc_0x100417a (loc3);
if ( == 34) {
loc3++;
loc3++;
while ((((loc7 == loc8) || ) || (loc9 >= 255))) {
gVal_0x100a140 = loc7;
loc9++;
loc3++;
loc3++;
} /* end of while */
gVal_0x100a140 = loc8;
gVal_0x100a480 = CreateFileW (loc6, 0x80000000, 3, 0, 3, 128, 0);
if (CreateFileW (loc6, 0x80000000, 3, 0, 3, 128, 0) == 0xFFFFFFFF) {
GetLastError ();
loc3--;
loc3--;
if loc3 {
loc3 = (loc3 - 3);
if (loc3 != 0) {
loc3 = (loc3 - 60);
if (loc3 != 0) {
loc3 = (loc3 - 58);
if (loc3 != 0) {
loc3 = gVal_0x1009034;
proc_0x1001f70 (gVal_0x1009830, gVal_0x1009054, loc3);
loc3 = 0;
loc3++;
return (loc3);
}
else {
loc3 = gVal_0x1009064;
}
}
else {
loc3 = gVal_0x100909c;
}
}
}
else {
loc3 = gVal_0x1009038;
}
}
else {
loc3 = proc_0x1005179 (0x100A900, gVal_0x1009a80);
if (loc1 != 0) {
}
else {
}
proc_0x1006e4b (1);
}
}
else {
loc3 = 0;
}
}
}
}
}
else {
loc3 = arg0;
loc5 = proc_0x1003f4c ();
if (loc3 == 0) {
loc6 = (loc6 + 4);
}
}
}
// Proc: proc_0x1004458
int proc_0x1004458(int arg0)
{
int loc1; /* edi */
int loc2; /* eax */
loc1 = loc1;
lstrcpyW (arg0, gVal_0x1009084);
lstrcpyW ((((lstrlenW (arg0) * 2) + arg0) + 2), "*");
lstrcpyW ((((lstrlenW ((((lstrlenW (arg0) * 2) + arg0) + 2)) * 2) + (((lstrlenW (arg0) * 2) + arg0) + 2)) + 2), gVal_0x1009088);
lstrcpyW ((((lstrlenW ((((lstrlenW ((((lstrlenW (arg0) * 2) + arg0) + 2)) * 2) + (((lstrlenW (arg0) * 2) + arg0) + 2)) + 2)) * 2) + (((lstrlenW ((((lstrlenW (arg0) * 2) + arg0) + 2)) * 2) + (((lstrlenW (arg0) * 2) + arg0) + 2)) + 2)) + 2), "*");
loc2 = lstrlenW ((((lstrlenW ((((lstrlenW ((((lstrlenW (arg0) * 2) + arg0) + 2)) * 2) + (((lstrlenW (arg0) * 2) + arg0) + 2)) + 2)) * 2) + (((lstrlenW ((((lstrlenW (arg0) * 2) + arg0) + 2)) * 2) + (((lstrlenW (arg0) * 2) + arg0) + 2)) + 2)) + 2));
[] = ([] & 0);
return (loc2);
}
// Proc: proc_0x1004565
int proc_0x1004565(HINSTANCE arg0, HINSTANCE arg2, int arg1, int arg3)
{
int loc1;
HINSTANCE loc2;
int loc3;
int loc4;
int loc5;
int loc6;
int loc7;
int loc8;
int loc9;
LPRECT loc10;
LPRECT loc11;
int loc12;
int loc13;
int loc14;
LPCWSTR loc15;
int loc16; /* edi */
int loc17; /* eax */
int loc18; /* ecx */
int loc19; /* edx */
short loc20; /* ax */
int loc21; /* ebx */
loc16 = loc16;
loc16 = ;
loc1 = gVal_0x1009604;
loc2 = arg0;
loc3 = arg2;
RegisterWindowMessageW ();
gVal_0x100a488 = arg2;
if (arg2 != 0) {
RegisterWindowMessageW ();
gVal_0x100a484 = arg2;
if (arg2 != 0) {
GetDC ();
loc4 = arg2;
if (arg2 != 0) {
if (proc_0x10040ba (arg0) != 0) {
GetSystemMetrics ();
loc16 = [];
gVal_0x100ab88 = LoadCursorW (0, ((proc_0x10040ba (arg0) - 1) + 0x7F01));
gVal_0x100ab84 = LoadCursorW (0, 0x7F02);
gVal_0x100a6d8 = LoadAcceleratorsW (arg0, "M");
if ((gVal_0x100ab84 != 0) && (LoadAcceleratorsW (arg0, "M") != 0)) {
if (arg1 == 0) {
if (proc_0x10044d7 () != 0) {
gVal_0x100ab80 = arg0;
gVal_0x100a4a0 = 84;
gVal_0x100a4a8 = 0;
gVal_0x100a4ac = 0;
gVal_0x100a4dc = arg0;
proc_0x100195d ();
proc_0x1003c92 ();
gVal_0x1009830 = CreateWindowExW (0, "N", "", 0xCF0000, gVal_0x1009a78, gVal_0x1009a7c, gVal_0x1009a74, gVal_0x1009a70, 0, 0, arg0, 0);
gVal_0x100a4a4 = CreateWindowExW (0, "N", "", 0xCF0000, gVal_0x1009a78, gVal_0x1009a7c, gVal_0x1009a74, gVal_0x1009a70, 0, 0, arg0, 0);
if (CreateWindowExW (0, "N", "", 0xCF0000, gVal_0x1009a78, gVal_0x1009a7c, gVal_0x1009a74, gVal_0x1009a70, 0, 0, arg0, 0) != 0) {
if ((gVal_0x1009a74 != 0x80000000) && (gVal_0x1009a70 != 0x80000000)) {
loc17 = 0;
loc18 = 11;
loc16 = &loc5;
loc6 = gVal_0x1009a78;
loc7 = (gVal_0x1009a78 + gVal_0x1009a74);
loc8 = gVal_0x1009a7c;
loc9 = (gVal_0x1009a7c + gVal_0x1009a70);
loc5 = 44;
SetWindowPlacement ();
loc19 = gVal_0x1009830;
}
DragAcceptFiles ();
loc16 = [];
GetClientRect (gVal_0x1009830, loc10);
loc17 = !gVal_0x1009850;
loc17 = (loc17 & 0xFFF00000);
loc17 = (loc17 + 0x50300104);
gVal_0x1009838 = CreateWindowExW (512, "E", "", loc17, 0, 0, loc10->right, (loc10->bottom + 0xFFFFFF9C), gVal_0x1009830, 15, loc2, 0);
if (CreateWindowExW (512, "E", "", loc17, 0, 0, loc10->right, (loc10->bottom + 0xFFFFFF9C), gVal_0x1009830, 15, loc2, 0) != 0) {
loc17 = !gVal_0x1009840;
loc17 = (loc17 & 0x10000000);
loc17 = (loc17 | 0x44800000);
CreateStatusWindowW ();
gVal_0x1009834 = loc17;
if (loc17 != 0) {
proc_0x1001c42 (1);
GetClientRect (gVal_0x1009834, loc11);
gVal_0x100a6e0 = (loc11->bottom - loc11->top);
loc19 = (((loc11->right - loc11) * 3) % 4);
loc13 = (((loc11->right - loc11) * 3) / 4);
SendMessageW ();
SendMessageW ();
if (gVal_0x1009850 != 0) {
GetMenu ();
GetSubMenu ();
EnableMenuItem ();
}
GetDeviceCaps ();
gVal_0x100ab20 = !MulDiv (gVal_0x1009018, &loc13, loc4);
CreateFontIndirectW ();
gVal_0x100ab7c = !MulDiv (gVal_0x1009018, &loc13, loc4);
SelectObject ();
loc14 = !MulDiv (gVal_0x1009018, &loc13, loc4);
GetTextFaceW ();
SelectObject ();
if (lstrcmpiW (loc15, gVal_0x100ab3c) != 0) {
EnumFontsW ();
DeleteObject ();
CreateFontIndirectW ();
gVal_0x100ab7c = lstrcmpiW (loc15, gVal_0x100ab3c);
}
SendMessageW ();
ReleaseDC ();
gVal_0x100a800 = 0;
gVal_0x100ab8c = LocalAlloc (66, 2);
PostMessageW ();
proc_0x1002a55 (gVal_0x1009040);
ShowWindow (gVal_0x1009830, arg3);
SetCursor ();
gVal_0x1009a80 = (gVal_0x1009a80 | 0xFFFFFFFF);
loc20 = proc_0x1003f4c ();
if (loc17 == 0) {
gVal_0x1009a80 = 0;
}
else {
loc17 = loc16;
if (loc17 == 0) {
gVal_0x1009a80 = 1;
}
goto L18;
}
else {
if (proc_0x100419e (proc_0x100417a ((proc_0x100417a (loc3) + 4))) != 0) {
if (proc_0x100419e (proc_0x100417a ((proc_0x100417a (loc3) + 4))) == 2) {
loc17 = 0;
loc17 = proc_0x1007147 ();
return;
}
else {
loc17 = proc_0x1004458 (0x100A5E0);
proc_0x1004458 (0x100A540);
loc17 = 0;
loc16 = 0x100A680;
gVal_0x100a688 = loc2;
loc17 = 0;
gVal_0x100a680 = 88;
gVal_0x100a684 = gVal_0x1009830;
gVal_0x100a6a0 = 260;
gVal_0x100a500 = 40;
gVal_0x100a504 = gVal_0x1009830;
SendMessageW ();
SendMessageW ();
SendMessageW ();
GetKeyboardLayout ();
if ((&loc14 & 0x3FF) == 17) {
SendMessageW ();
loc17 = 0;
loc17++;
}
}
}
else {
if (proc_0x10042f9 (proc_0x100417a ((proc_0x100417a (loc3) + 4)), arg3) != 0) {
PostMessageW ();
}
else {
if ( != 0) {
loc17 = proc_0x1003f99 (0x100A900, proc_0x100417a ((proc_0x100417a (loc3) + 4)));
gVal_0x100a480 = CreateFileW (gVal_0x100a900, 0x80000000, 3, 0, 3, 128, 0);
if (CreateFileW (gVal_0x100a900, 0x80000000, 3, 0, 3, 128, 0) == 0xFFFFFFFF) {
if (GetLastError () == 2) {
if (proc_0x1001f70 (gVal_0x1009830, gVal_0x1009054, gVal_0x1009038) != 2) {
if (loc17 == 6) {
CreateFileW (loc16, 0xC0000000, 3, loc21, 4, 128, loc21);
gVal_0x100a480 = loc17;
if (gVal_0x100a480 != 0xFFFFFFFF) {
}
}
}
}
else {
lstrcpyW (loc16, gVal_0x1009040);
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
}
// Proc: proc_0x1001929
int proc_0x1001929()
{
if (gVal_0x100a4a8 != 0) {
GlobalFree (gVal_0x100a4a8);
}
if (gVal_0x100a4ac != 0) {
GlobalFree (gVal_0x100a4ac);
}
gVal_0x100a4a8 = (gVal_0x100a4a8 & 0);
gVal_0x100a4ac = (gVal_0x100a4ac & 0);
return;
}
// Proc: _tWinMain
int _tWinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPTSTR lpCmdLine, int nCmdShow)
{
int (*InDirectCall_125)();
MSG* loc1;
int loc2; /* edi */
int loc3; /* eax */
int loc4; /* esi */
int loc5; /* ebx */
loc2 = loc2;
GetSystemMetrics ();
int (*InDirectCall_125)() = GetProcAddress (GetCommandLineW (), 41);
if (GetProcAddress (GetCommandLineW (), 41) != 0) {
();
}
if (proc_0x1004565 (hInstance, hPrevInstance) == 0) {
loc3->wParam = 0;
}
else {
GetCurrentProcessId ();
SetWinEventHook ();
while ((loc3 != 0)) {
(&loc1);
if (loc3->message == 80) {
PostMessageW ();
}
if (gVal_0x100983c != loc4) {
IsDialogMessageW ();
if (loc3 == 0) {
TranslateAcceleratorW (gVal_0x1009830, gVal_0x100a6d8, loc1);
if (loc3 == 0) {
TranslateMessage (&loc1);
DispatchMessageW (&loc1);
}
}
}
} /* end of while */
LocalFree (gVal_0x100ab8c);
if (loc5 != loc4) {
UnhookWinEvent ();
}
}
if (int (*InDirectCall_125)() != 0) {
int (*InDirectCall_125)() ();
}
loc3 = loc3->wParam;
return;
}
|
BeginProc _tWinMain 000 1002936 8BFF MOV edi, edi 001 1002938 55 PUSH ebp 002 1002939 8BEC MOV ebp, esp 003 100293B 83EC20 SUB esp, 20h 004 100293E 56 PUSH esi 005 100293F 57 PUSH edi 006 1002940 FF1514110001 CALL GetCommandLineW 007 1002946 68D8130001 PUSH 10013D8h 008 100294B 6A29 PUSH 29h 009 100294D 8BF8 MOV edi, eax 010 100294F FF151C120001 CALL GetSystemMetrics 011 1002955 50 PUSH eax 012 1002956 FF1510110001 CALL GetProcAddress 013 100295C 33F6 XOR esi, esi 014 100295E 3BC6 CMP eax, esi 015 1002960 8945FC MOV dword ptr [ebp - 0x4], eax 016 1002963 7406 JE L1 017 1002965 6A01 PUSH 1 018 1002967 6A01 PUSH 1 019 1002969 FFD0 CALL eax 020 100296B FF7514 L1: PUSH dword ptr [ebp + 0x14] 021 100296E 57 PUSH edi 022 100296F E874F2FFFF CALL proc_0x1001be8 023 1002974 50 PUSH eax 024 1002975 FF750C PUSH dword ptr [ebp + 0xc] 025 1002978 FF7508 PUSH dword ptr [ebp + 0x8] 026 100297B E8E51B0000 CALL proc_0x1004565 027 1002980 85C0 TEST eax, eax 028 1002982 7508 JNE L2 029 1002984 8975E8 MOV dword ptr [ebp - 0x18], esi 030 1002987 E9B0000000 JMP L3 031 100298C 53 L2: PUSH ebx 032 100298D 56 PUSH esi 033 100298E 56 PUSH esi 034 100298F FF150C110001 CALL GetCurrentProcessId 035 1002995 50 PUSH eax 036 1002996 681C1D0001 PUSH 1001D1Ch 037 100299B 56 PUSH esi 038 100299C B80B800000 MOV eax, 800Bh 039 10029A1 50 PUSH eax 040 10029A2 50 PUSH eax 041 10029A3 FF15AC120001 CALL SetWinEventHook 042 10029A9 8B3DA8120001 MOV edi, dword ptr [0x10012a8] 043 10029AF 8BD8 MOV ebx, eax 044 10029B1 EB5F JMP L4 045 10029B3 837DE450 L5: CMP dword ptr [ebp - 0x1c], 50h 046 10029B7 7513 JNE L6 047 10029B9 56 PUSH esi 048 10029BA 56 PUSH esi 049 10029BB 6801800000 PUSH 8001h 050 10029C0 FF3530980001 PUSH dword ptr [0x1009830] 051 10029C6 FF15A4120001 CALL PostMessageW 052 10029CC A13C980001 L6: MOV eax, dword ptr [0x100983c] 053 10029D1 3BC6 CMP eax, esi 054 10029D3 740F JE L7 055 10029D5 8D4DE0 LEA ecx, dword ptr [ebp - 0x20] 056 10029D8 51 PUSH ecx 057 10029D9 50 PUSH eax 058 10029DA FF15A0120001 CALL IsDialogMessageW 059 10029E0 85C0 TEST eax, eax 060 10029E2 752E JNE L4 061 10029E4 8D45E0 L7: LEA eax, dword ptr [ebp - 0x20] 062 10029E7 50 PUSH eax 063 10029E8 FF35D8A60001 PUSH dword ptr [0x100a6d8] 064 10029EE FF3530980001 PUSH dword ptr [0x1009830] 065 10029F4 FF159C120001 CALL TranslateAcceleratorW 066 10029FA 85C0 TEST eax, eax 067 10029FC 7514 JNE L4 068 10029FE 8D45E0 LEA eax, dword ptr [ebp - 0x20] 069 1002A01 50 PUSH eax 070 1002A02 FF1598120001 CALL TranslateMessage 071 1002A08 8D45E0 LEA eax, dword ptr [ebp - 0x20] 072 1002A0B 50 PUSH eax 073 1002A0C FF1594120001 CALL DispatchMessageW 074 1002A12 56 L4: PUSH esi 075 1002A13 56 PUSH esi 076 1002A14 8D45E0 LEA eax, dword ptr [ebp - 0x20] 077 1002A17 56 PUSH esi 078 1002A18 50 PUSH eax 079 1002A19 FFD7 CALL edi 080 1002A1B 85C0 TEST eax, eax 081 1002A1D 7594 JNE L5 082 1002A1F E805EFFFFF CALL proc_0x1001929 083 1002A24 FF358CAB0001 PUSH dword ptr [0x100ab8c] 084 1002A2A FF15DC100001 CALL LocalFree 085 1002A30 3BDE CMP ebx, esi 086 1002A32 7407 JE L8 087 1002A34 53 PUSH ebx 088 1002A35 FF1590120001 CALL UnhookWinEvent 089 1002A3B 5B L8: POP ebx 090 1002A3C 3975FC L3: CMP dword ptr [ebp - 0x4], esi 091 1002A3F 7406 JE L9 092 1002A41 56 PUSH esi 093 1002A42 6A01 PUSH 1 094 1002A44 FF55FC CALL dword ptr [ebp - 0x4] 095 1002A47 8B45E8 L9: MOV eax, dword ptr [ebp - 0x18] 096 1002A4A 5F POP edi 097 1002A4B 5E POP esi 098 1002A4C C9 LEAVE 099 1002A4D C21000 RET 10h EndProc _tWinMain BeginProc proc_0x1001be8 000 1001BE8 8BFF MOV edi, edi 001 1001BEA 55 PUSH ebp 002 1001BEB 8BEC MOV ebp, esp 003 1001BED 8B4508 MOV eax, dword ptr [ebp + 0x8] 004 1001BF0 56 PUSH esi 005 1001BF1 33F6 XOR esi, esi 006 1001BF3 33C9 XOR ecx, ecx 007 1001BF5 EB26 JMP L1 008 1001BF7 6683F920 L2: CMP cx, 20h 009 1001BFB 7406 JE L3 010 1001BFD 6683F909 CMP cx, 9 011 1001C01 7504 JNE L4 012 1001C03 85F6 L3: TEST esi, esi 013 1001C05 741E JE L5 014 1001C07 6683F922 L4: CMP cx, 22h 015 1001C0B 7509 JNE L6 016 1001C0D 33C9 XOR ecx, ecx 017 1001C0F 85F6 TEST esi, esi 018 1001C11 0F94C1 SETE cl 019 1001C14 8BF1 MOV esi, ecx 020 1001C16 50 L6: PUSH eax 021 1001C17 FF1544120001 CALL CharNextW 022 1001C1D 668B08 L1: MOV cx, word ptr [eax] 023 1001C20 6685C9 TEST cx, cx 024 1001C23 75D2 JNE L2 025 1001C25 5E L5: POP esi 026 1001C26 668B08 L7: MOV cx, word ptr [eax] 027 1001C29 6683F920 CMP cx, 20h 028 1001C2D 7406 JE L8 029 1001C2F 6683F909 CMP cx, 9 030 1001C33 7504 JNE L9 031 1001C35 40 L8: INC eax 032 1001C36 40 INC eax 033 1001C37 EBED JMP L7 034 1001C39 5D L9: POP ebp 035 1001C3A C20400 RET 4 EndProc proc_0x1001be8 BeginProc proc_0x1004565 000 1004565 8BFF MOV edi, edi 001 1004567 55 PUSH ebp 002 1004568 8BEC MOV ebp, esp 003 100456A 81ECA8000000 SUB esp, 0A8h 004 1004570 A104960001 MOV eax, dword ptr [0x1009604] 005 1004575 53 PUSH ebx 006 1004576 56 PUSH esi 007 1004577 8B7508 MOV esi, dword ptr [ebp + 0x8] 008 100457A 57 PUSH edi 009 100457B 8B3DF8110001 MOV edi, dword ptr [0x10011f8] 010 1004581 8945FC MOV dword ptr [ebp - 0x4], eax 011 1004584 8B4510 MOV eax, dword ptr [ebp + 0x10] 012 1004587 68CC170001 PUSH 10017CCh 013 100458C 8975AC MOV dword ptr [ebp - 0x54], esi 014 100458F 8945B0 MOV dword ptr [ebp - 0x50], eax 015 1004592 FFD7 CALL edi 016 1004594 33DB XOR ebx, ebx 017 1004596 3BC3 CMP eax, ebx 018 1004598 A388A40001 MOV dword ptr [0x100a488], eax 019 100459D 0F840B040000 JE L1 020 10045A3 68B0170001 PUSH 10017B0h 021 10045A8 FFD7 CALL edi 022 10045AA 3BC3 CMP eax, ebx 023 10045AC A384A40001 MOV dword ptr [0x100a484], eax 024 10045B1 0F84F7030000 JE L1 025 10045B7 53 PUSH ebx 026 10045B8 FF1594110001 CALL GetDC 027 10045BE 3BC3 CMP eax, ebx 028 10045C0 8945B8 MOV dword ptr [ebp - 0x48], eax 029 10045C3 0F84E5030000 JE L1 030 10045C9 56 PUSH esi 031 10045CA E8EBFAFFFF CALL proc_0x10040ba 032 10045CF 85C0 TEST eax, eax 033 10045D1 0F84D7030000 JE L1 034 10045D7 6A29 PUSH 29h 035 10045D9 FF151C120001 CALL GetSystemMetrics 036 10045DF 8B3DD8110001 MOV edi, dword ptr [0x10011d8] 037 10045E5 F7D8 NEG eax 038 10045E7 1BC0 SBB eax, eax 039 10045E9 05017F0000 ADD eax, 7F01h 040 10045EE 50 PUSH eax 041 10045EF 53 PUSH ebx 042 10045F0 FFD7 CALL edi 043 10045F2 68027F0000 PUSH 7F02h 044 10045F7 53 PUSH ebx 045 10045F8 A388AB0001 MOV dword ptr [0x100ab88], eax 046 10045FD FFD7 CALL edi 047 10045FF 68A0170001 PUSH 10017A0h 048 1004604 56 PUSH esi 049 1004605 A384AB0001 MOV dword ptr [0x100ab84], eax 050 100460A FF15C8110001 CALL LoadAcceleratorsW 051 1004610 391D84AB0001 CMP dword ptr [0x100ab84], ebx 052 1004616 A3D8A60001 MOV dword ptr [0x100a6d8], eax 053 100461B 0F848D030000 JE L1 054 1004621 3BC3 CMP eax, ebx 055 1004623 0F8485030000 JE L1 056 1004629 395D0C CMP dword ptr [ebp + 0xc], ebx 057 100462C 750D JNE L2 058 100462E E8A4FEFFFF CALL proc_0x10044d7 059 1004633 85C0 TEST eax, eax 060 1004635 0F8473030000 JE L1 061 100463B 893580AB0001 L2: MOV dword ptr [0x100ab80], esi 062 1004641 C705A0A4000154000000MOV dword ptr [0x100a4a0], 54h 063 100464B 891DA8A40001 MOV dword ptr [0x100a4a8], ebx 064 1004651 891DACA40001 MOV dword ptr [0x100a4ac], ebx 065 1004657 8935DCA40001 MOV dword ptr [0x100a4dc], esi 066 100465D E8FBD2FFFF CALL proc_0x100195d 067 1004662 E82BF6FFFF CALL proc_0x1003c92 068 1004667 53 PUSH ebx 069 1004668 56 PUSH esi 070 1004669 53 PUSH ebx 071 100466A 53 PUSH ebx 072 100466B FF35709A0001 PUSH dword ptr [0x1009a70] 073 1004671 BE94130001 MOV esi, 1001394h 074 1004676 FF35749A0001 PUSH dword ptr [0x1009a74] 075 100467C FF357C9A0001 PUSH dword ptr [0x1009a7c] 076 1004682 FF35789A0001 PUSH dword ptr [0x1009a78] 077 1004688 680000CF00 PUSH 0CF0000h 078 100468D 56 PUSH esi 079 100468E 6820900001 PUSH 1009020h 080 1004693 53 PUSH ebx 081 1004694 FF15E0110001 CALL CreateWindowExW 082 100469A 8BD0 MOV edx, eax 083 100469C 3BD3 CMP edx, ebx 084 100469E 891530980001 MOV dword ptr [0x1009830], edx 085 10046A4 8915A4A40001 MOV dword ptr [0x100a4a4], edx 086 10046AA 0F84FE020000 JE L1 087 10046B0 B800000080 MOV eax, 80000000h 088 10046B5 3905749A0001 CMP dword ptr [0x1009a74], eax 089 10046BB 7462 JE L3 090 10046BD 3905709A0001 CMP dword ptr [0x1009a70], eax 091 10046C3 745A JE L3 092 10046C5 33C0 XOR eax, eax 093 10046C7 6A0B PUSH 0Bh 094 10046C9 59 POP ecx 095 10046CA 8DBD58FFFFFF LEA edi, dword ptr [ebp - 0xa8] 096 10046D0 F3AB REP STOSD 097 10046D2 A1789A0001 MOV eax, dword ptr [0x1009a78] 098 10046D7 8B0D749A0001 MOV ecx, dword ptr [0x1009a74] 099 10046DD 898574FFFFFF MOV dword ptr [ebp - 0x8c], eax 100 10046E3 03C1 ADD eax, ecx 101 10046E5 8B0D709A0001 MOV ecx, dword ptr [0x1009a70] 102 10046EB 89857CFFFFFF MOV dword ptr [ebp - 0x84], eax 103 10046F1 A17C9A0001 MOV eax, dword ptr [0x1009a7c] 104 10046F6 898578FFFFFF MOV dword ptr [ebp - 0x88], eax 105 10046FC 03C1 ADD eax, ecx 106 10046FE 894580 MOV dword ptr [ebp - 0x80], eax 107 1004701 8D8558FFFFFF LEA eax, dword ptr [ebp - 0xa8] 108 1004707 50 PUSH eax 109 1004708 52 PUSH edx 110 1004709 C78558FFFFFF2C000000MOV dword ptr [ebp - 0xa8], 2Ch 111 1004713 FF15DC110001 CALL SetWindowPlacement 112 1004719 8B1530980001 MOV edx, dword ptr [0x1009830] 113 100471F 6A01 L3: PUSH 1 114 1004721 52 PUSH edx 115 1004722 FF157C110001 CALL DragAcceptFiles 116 1004728 8B3D88110001 MOV edi, dword ptr [0x1001188] 117 100472E 8D4584 LEA eax, dword ptr [ebp - 0x7c] 118 1004731 50 PUSH eax 119 1004732 FF3530980001 PUSH dword ptr [0x1009830] 120 1004738 FFD7 CALL edi 121 100473A 8B4590 MOV eax, dword ptr [ebp - 0x70] 122 100473D 53 PUSH ebx 123 100473E FF75AC PUSH dword ptr [ebp - 0x54] 124 1004741 83C09C ADD eax, 0FFFFFF9Ch 125 1004744 6A0F PUSH 0Fh 126 1004746 FF3530980001 PUSH dword ptr [0x1009830] 127 100474C 50 PUSH eax 128 100474D FF758C PUSH dword ptr [ebp - 0x74] 129 1004750 A150980001 MOV eax, dword ptr [0x1009850] 130 1004755 F7D8 NEG eax 131 1004757 53 PUSH ebx 132 1004758 1BC0 SBB eax, eax 133 100475A 53 PUSH ebx 134 100475B 250000F0FF AND eax, 0FFF00000h 135 1004760 0504013050 ADD eax, 50300104h 136 1004765 50 PUSH eax 137 1004766 56 PUSH esi 138 1004767 6894170001 PUSH 1001794h 139 100476C 6800020000 PUSH 200h 140 1004771 FF15E0110001 CALL CreateWindowExW 141 1004777 3BC3 CMP eax, ebx 142 1004779 A338980001 MOV dword ptr [0x1009838], eax 143 100477E 0F842A020000 JE L1 144 1004784 A140980001 MOV eax, dword ptr [0x1009840] 145 1004789 F7D8 NEG eax 146 100478B 6801040000 PUSH 401h 147 1004790 FF3530980001 PUSH dword ptr [0x1009830] 148 1004796 1BC0 SBB eax, eax 149 1004798 2500000010 AND eax, 10000000h 150 100479D 56 PUSH esi 151 100479E 0D00008044 OR eax, 44800000h 152 10047A3 50 PUSH eax 153 10047A4 FF1520100001 CALL CreateStatusWindowW 154 10047AA 3BC3 CMP eax, ebx 155 10047AC A334980001 MOV dword ptr [0x1009834], eax 156 10047B1 0F84F7010000 JE L1 157 10047B7 6A01 PUSH 1 158 10047B9 E884D4FFFF CALL proc_0x1001c42 159 10047BE 8D4594 LEA eax, dword ptr [ebp - 0x6c] 160 10047C1 50 PUSH eax 161 10047C2 FF3534980001 PUSH dword ptr [0x1009834] 162 10047C8 FFD7 CALL edi 163 10047CA 8B45A0 MOV eax, dword ptr [ebp - 0x60] 164 10047CD 2B4598 SUB eax, dword ptr [ebp - 0x68] 165 10047D0 6A04 PUSH 4 166 10047D2 A3E0A60001 MOV dword ptr [0x100a6e0], eax 167 10047D7 8B459C MOV eax, dword ptr [ebp - 0x64] 168 10047DA 2B4594 SUB eax, dword ptr [ebp - 0x6c] 169 10047DD 59 POP ecx 170 10047DE 8D0440 LEA eax, dword ptr [eax + eax*0x2] 173 10047E1 99 CDQ 175 10047E2 F7F9 IDIV eax, ecx 177 10047E4 8B3540120001 MOV esi, dword ptr [0x1001240] 178 10047EA 834DA8FF OR dword ptr [ebp - 0x58], 0FFFFFFFFh 179 10047EE 8945A4 MOV dword ptr [ebp - 0x5c], eax 180 10047F1 8D45A4 LEA eax, dword ptr [ebp - 0x5c] 181 10047F4 50 PUSH eax 182 10047F5 6A02 PUSH 2 183 10047F7 6804040000 PUSH 404h 184 10047FC FF3534980001 PUSH dword ptr [0x1009834] 185 1004802 FFD6 CALL esi 186 1004804 53 PUSH ebx 187 1004805 FF3550980001 PUSH dword ptr [0x1009850] 188 100480B 68C8000000 PUSH 0C8h 189 1004810 FF3538980001 PUSH dword ptr [0x1009838] 190 1004816 FFD6 CALL esi 191 1004818 391D50980001 CMP dword ptr [0x1009850], ebx 192 100481E 7420 JE L4 193 1004820 FF3530980001 PUSH dword ptr [0x1009830] 194 1004826 FF1564120001 CALL GetMenu 195 100482C 6A01 PUSH 1 196 100482E 6A1B PUSH 1Bh 197 1004830 6A03 PUSH 3 198 1004832 50 PUSH eax 199 1004833 FF1560120001 CALL GetSubMenu 200 1004839 50 PUSH eax 201 100483A FF155C120001 CALL EnableMenuItem 202 1004840 68D0020000 L4: PUSH 2D0h 203 1004845 6A5A PUSH 5Ah 204 1004847 FF75B8 PUSH dword ptr [ebp - 0x48] 205 100484A FF1560100001 CALL GetDeviceCaps 206 1004850 50 PUSH eax 207 1004851 FF3518900001 PUSH dword ptr [0x1009018] 208 1004857 FF152C110001 CALL MulDiv 209 100485D F7D8 NEG eax 210 100485F BF20AB0001 MOV edi, 100AB20h 211 1004864 57 PUSH edi 212 1004865 A320AB0001 MOV dword ptr [0x100ab20], eax 213 100486A FF1564100001 CALL CreateFontIndirectW 214 1004870 50 PUSH eax 215 1004871 FF75B8 PUSH dword ptr [ebp - 0x48] 216 1004874 A37CAB0001 MOV dword ptr [0x100ab7c], eax 217 1004879 FF1584100001 CALL SelectObject 218 100487F 8945B4 MOV dword ptr [ebp - 0x4c], eax 219 1004882 8D45BC LEA eax, dword ptr [ebp - 0x44] 220 1004885 50 PUSH eax 221 1004886 6A20 PUSH 20h 222 1004888 FF75B8 PUSH dword ptr [ebp - 0x48] 223 100488B FF1548100001 CALL GetTextFaceW 224 1004891 FF75B4 PUSH dword ptr [ebp - 0x4c] 225 1004894 FF75B8 PUSH dword ptr [ebp - 0x48] 226 1004897 FF1584100001 CALL SelectObject 227 100489D 683CAB0001 PUSH 100AB3Ch 228 10048A2 8D45BC LEA eax, dword ptr [ebp - 0x44] 229 10048A5 50 PUSH eax 230 10048A6 FF1508110001 CALL lstrcmpiW 231 10048AC 85C0 TEST eax, eax 232 10048AE 742C JE L5 233 10048B0 57 PUSH edi 234 10048B1 68BB440001 PUSH 10044BBh 235 10048B6 683CAB0001 PUSH 100AB3Ch 236 10048BB FF75B8 PUSH dword ptr [ebp - 0x48] 237 10048BE FF1554100001 CALL EnumFontsW 238 10048C4 FF357CAB0001 PUSH dword ptr [0x100ab7c] 239 10048CA FF1568100001 CALL DeleteObject 240 10048D0 57 PUSH edi 241 10048D1 FF1564100001 CALL CreateFontIndirectW 242 10048D7 A37CAB0001 MOV dword ptr [0x100ab7c], eax 243 10048DC 53 L5: PUSH ebx 244 10048DD FF357CAB0001 PUSH dword ptr [0x100ab7c] 245 10048E3 6A30 PUSH 30h 246 10048E5 FF3538980001 PUSH dword ptr [0x1009838] 247 10048EB FFD6 CALL esi 248 10048ED FF75B8 PUSH dword ptr [ebp - 0x48] 249 10048F0 53 PUSH ebx 250 10048F1 FF1590110001 CALL ReleaseDC 251 10048F7 6A02 PUSH 2 252 10048F9 6A42 PUSH 42h 253 10048FB 66891D00A80001 MOV word ptr [0x100a800], bx 254 1004902 FF15E0100001 CALL LocalAlloc 255 1004908 53 PUSH ebx 256 1004909 53 PUSH ebx 257 100490A 68C5000000 PUSH 0C5h 258 100490F FF3538980001 PUSH dword ptr [0x1009838] 259 1004915 A38CAB0001 MOV dword ptr [0x100ab8c], eax 260 100491A FF15A4120001 CALL PostMessageW 261 1004920 FF3540900001 PUSH dword ptr [0x1009040] 262 1004926 E82AE1FFFF CALL proc_0x1002a55 263 100492B FF7514 PUSH dword ptr [ebp + 0x14] 264 100492E FF3530980001 PUSH dword ptr [0x1009830] 265 1004934 FF15B0110001 CALL ShowWindow 266 100493A FF3588AB0001 PUSH dword ptr [0x100ab88] 267 1004940 FF158C110001 CALL SetCursor 268 1004946 FF75B0 PUSH dword ptr [ebp - 0x50] 269 1004949 E82CF8FFFF CALL proc_0x100417a 270 100494E 830D809A0001FF OR dword ptr [0x1009a80], 0FFFFFFFFh 271 1004955 B98C170001 MOV ecx, 100178Ch 272 100495A 8BF8 MOV edi, eax 273 100495C E8EBF5FFFF CALL proc_0x1003f4c 274 1004961 85C0 TEST eax, eax 275 1004963 7508 JNE L6 276 1004965 891D809A0001 MOV dword ptr [0x1009a80], ebx 277 100496B EB23 JMP L7 278 100496D 8BC7 L6: MOV eax, edi 279 100496F B984170001 MOV ecx, 1001784h 280 1004974 E8D3F5FFFF CALL proc_0x1003f4c 281 1004979 85C0 TEST eax, eax 282 100497B 750A JNE L8 283 100497D C705809A000101000000MOV dword ptr [0x1009a80], 1 284 1004987 833D809A0001FF L8: CMP dword ptr [0x1009a80], 0FFFFFFFFh 285 100498E 740B JE L9 286 1004990 83C704 L7: ADD edi, 4 287 1004993 57 PUSH edi 288 1004994 E8E1F7FFFF CALL proc_0x100417a 289 1004999 8BF8 MOV edi, eax 290 100499B 57 L9: PUSH edi 291 100499C E8FDF7FFFF CALL proc_0x100419e 292 10049A1 3BC3 CMP eax, ebx 293 10049A3 741A JE L10 294 10049A5 83F802 CMP eax, 2 295 10049A8 0F85ED000000 JNE L11 296 10049AE 33C0 L1: XOR eax, eax 297 10049B0 8B4DFC L12: MOV ecx, dword ptr [ebp - 0x4] 298 10049B3 5F POP edi 299 10049B4 5E POP esi 300 10049B5 5B POP ebx 301 10049B6 E88C270000 CALL proc_0x1007147 302 10049BB C9 LEAVE 303 10049BC C21000 RET 10h 304 10049BF FF7514 L10: PUSH dword ptr [ebp + 0x14] 305 10049C2 57 PUSH edi 306 10049C3 E831F9FFFF CALL proc_0x10042f9 307 10049C8 85C0 TEST eax, eax 308 10049CA 7415 JE L13 309 10049CC 53 PUSH ebx 310 10049CD 53 PUSH ebx 311 10049CE 6A10 PUSH 10h 312 10049D0 FF3530980001 PUSH dword ptr [0x1009830] 313 10049D6 FF15A4120001 CALL PostMessageW 314 10049DC E977010000 JMP L14 315 10049E1 66391F L13: CMP word ptr [edi], bx 316 10049E4 0F84B1000000 JE L11 317 10049EA 57 PUSH edi 318 10049EB BF00A90001 MOV edi, 100A900h 319 10049F0 57 PUSH edi 320 10049F1 E8A3F5FFFF CALL proc_0x1003f99 321 10049F6 53 PUSH ebx 322 10049F7 6880000000 PUSH 80h 323 10049FC 6A03 PUSH 3 324 10049FE 53 PUSH ebx 325 10049FF 6A03 PUSH 3 326 1004A01 6800000080 PUSH 80000000h 327 1004A06 57 PUSH edi 328 1004A07 FF1504110001 CALL CreateFileW 329 1004A0D 83F8FF CMP eax, 0FFFFFFFFh 330 1004A10 A380A40001 MOV dword ptr [0x100a480], eax 331 1004A15 7578 JNE L15 332 1004A17 FF1538110001 CALL GetLastError 333 1004A1D 83F802 CMP eax, 2 334 1004A20 7546 JNE L16 335 1004A22 6A33 PUSH 33h 336 1004A24 57 PUSH edi 337 1004A25 FF3538900001 PUSH dword ptr [0x1009038] 338 1004A2B FF3554900001 PUSH dword ptr [0x1009054] 339 1004A31 FF3530980001 PUSH dword ptr [0x1009830] 340 1004A37 E834D5FFFF CALL proc_0x1001f70 341 1004A3C 83F802 CMP eax, 2 342 1004A3F 0F8469FFFFFF JE L1 343 1004A45 83F806 CMP eax, 6 344 1004A48 753C JNE L17 345 1004A4A 53 PUSH ebx 346 1004A4B 6880000000 PUSH 80h 347 1004A50 6A04 PUSH 4 348 1004A52 53 PUSH ebx 349 1004A53 6A03 PUSH 3 350 1004A55 68000000C0 PUSH 0C0000000h 351 1004A5A 57 PUSH edi 352 1004A5B FF1504110001 CALL CreateFileW 353 1004A61 A380A40001 MOV dword ptr [0x100a480], eax 354 1004A66 EB1E JMP L17 355 1004A68 57 L16: PUSH edi 356 1004A69 E8B2030000 CALL proc_0x1004e20 357 1004A6E FF3540900001 PUSH dword ptr [0x1009040] 358 1004A74 E8DCDFFFFF CALL proc_0x1002a55 359 1004A79 FF3540900001 PUSH dword ptr [0x1009040] 360 1004A7F 57 PUSH edi 361 1004A80 FF15FC100001 CALL lstrcpyW 362 1004A86 833D80A40001FF L17: CMP dword ptr [0x100a480], 0FFFFFFFFh 363 1004A8D 740C JE L11 364 1004A8F FF35809A0001 L15: PUSH dword ptr [0x1009a80] 365 1004A95 57 PUSH edi 366 1004A96 E8DE060000 CALL proc_0x1005179 367 1004A9B 68E0A50001 L11: PUSH 100A5E0h 368 1004AA0 E8B3F9FFFF CALL proc_0x1004458 369 1004AA5 6840A50001 PUSH 100A540h 370 1004AAA E8A9F9FFFF CALL proc_0x1004458 371 1004AAF 8B1530980001 MOV edx, dword ptr [0x1009830] 372 1004AB5 6A16 PUSH 16h 373 1004AB7 59 POP ecx 374 1004AB8 33C0 XOR eax, eax 375 1004ABA 6A0A PUSH 0Ah 376 1004ABC BF80A60001 MOV edi, 100A680h 377 1004AC1 F3AB REP STOSD 378 1004AC3 8B45AC MOV eax, dword ptr [ebp - 0x54] 379 1004AC6 59 POP ecx 380 1004AC7 A388A60001 MOV dword ptr [0x100a688], eax 381 1004ACC 33C0 XOR eax, eax 382 1004ACE BF00A50001 MOV edi, 100A500h 383 1004AD3 F3AB REP STOSD 384 1004AD5 8D45B0 LEA eax, dword ptr [ebp - 0x50] 385 1004AD8 50 PUSH eax 386 1004AD9 8D45B4 LEA eax, dword ptr [ebp - 0x4c] 387 1004ADC 50 PUSH eax 388 1004ADD 68B0000000 PUSH 0B0h 389 1004AE2 FF3538980001 PUSH dword ptr [0x1009838] 390 1004AE8 C70580A6000158000000MOV dword ptr [0x100a680], 58h 391 1004AF2 891584A60001 MOV dword ptr [0x100a684], edx 392 1004AF8 C705A0A6000104010000MOV dword ptr [0x100a6a0], 104h 393 1004B02 C70500A5000128000000MOV dword ptr [0x100a500], 28h 394 1004B0C 891504A50001 MOV dword ptr [0x100a504], edx 395 1004B12 FFD6 CALL esi 396 1004B14 FF75B0 PUSH dword ptr [ebp - 0x50] 397 1004B17 FF75B4 PUSH dword ptr [ebp - 0x4c] 398 1004B1A 68B1000000 PUSH 0B1h 399 1004B1F FF3538980001 PUSH dword ptr [0x1009838] 400 1004B25 FFD6 CALL esi 401 1004B27 53 PUSH ebx 402 1004B28 53 PUSH ebx 403 1004B29 68B7000000 PUSH 0B7h 404 1004B2E FF3538980001 PUSH dword ptr [0x1009838] 405 1004B34 FFD6 CALL esi 406 1004B36 53 PUSH ebx 407 1004B37 FF15A0110001 CALL GetKeyboardLayout 408 1004B3D 6625FF03 AND ax, 3FFh 409 1004B41 663D1100 CMP ax, 11h 410 1004B45 7511 JNE L14 411 1004B47 6A01 PUSH 1 412 1004B49 6A01 PUSH 1 413 1004B4B 68D8000000 PUSH 0D8h 414 1004B50 FF3538980001 PUSH dword ptr [0x1009838] 415 1004B56 FFD6 CALL esi 416 1004B58 33C0 L14: XOR eax, eax 417 1004B5A 40 INC eax 418 1004B5B E950FEFFFF JMP L12 EndProc proc_0x1004565 BeginProc proc_0x10040ba 000 10040BA 8BFF MOV edi, edi 001 10040BC 55 PUSH ebp 002 10040BD 8BEC MOV ebp, esp 003 10040BF FF7508 PUSH dword ptr [ebp + 0x8] 004 10040C2 E880FFFFFF CALL proc_0x1004047 005 10040C7 85C0 TEST eax, eax 006 10040C9 0F848A000000 JE L1 007 10040CF 56 PUSH esi 008 10040D0 03C0 ADD eax, eax 009 10040D2 50 PUSH eax 010 10040D3 6A40 PUSH 40h 011 10040D5 FF15E0100001 CALL LocalAlloc 012 10040DB 8BF0 MOV esi, eax 013 10040DD 85F6 TEST esi, esi 014 10040DF 7477 JE L2 015 10040E1 53 PUSH ebx 016 10040E2 56 PUSH esi 017 10040E3 FF1534110001 CALL LocalSize 018 10040E9 8BD8 MOV ebx, eax 019 10040EB D1EB SHR ebx, 1 020 10040ED 7504 JNE L3 021 10040EF 33C0 XOR eax, eax 022 10040F1 EB64 JMP L4 023 10040F3 57 L3: PUSH edi 024 10040F4 BFE8900001 MOV edi, 10090E8h 025 10040F9 8B07 L5: MOV eax, dword ptr [edi] 026 10040FB 53 PUSH ebx 027 10040FC 56 PUSH esi 028 10040FD FF30 PUSH dword ptr [eax] 029 10040FF FF7508 PUSH dword ptr [ebp + 0x8] 030 1004102 FF15C4110001 CALL LoadStringW 031 1004108 8B0F MOV ecx, dword ptr [edi] 032 100410A 40 INC eax 033 100410B 3BC3 CMP eax, ebx 034 100410D 8931 MOV dword ptr [ecx], esi 035 100410F 8D3446 LEA esi, dword ptr [esi + eax*0x2] 039 1004112 7F49 JG L6 040 1004114 83C704 ADD edi, 4 041 1004117 2BD8 SUB ebx, eax 042 1004119 81FF9C910001 CMP edi, 100919Ch 043 100411F 7CD8 JL L5 044 1004121 8B3530110001 MOV esi, dword ptr [0x1001130] 045 1004127 6A28 PUSH 28h 046 1004129 FF3578900001 PUSH dword ptr [0x1009078] 047 100412F 68E0A30001 PUSH 100A3E0h 048 1004134 FFD6 CALL esi 049 1004136 6A28 PUSH 28h 050 1004138 FF357C900001 PUSH dword ptr [0x100907c] 051 100413E 6830A40001 PUSH 100A430h 052 1004143 FFD6 CALL esi 053 1004145 A170900001 MOV eax, dword ptr [0x1009070] 054 100414A 668B00 MOV ax, word ptr [eax] 055 100414D 66A390AB0001 MOV word ptr [0x100ab90], ax 056 1004153 33C0 XOR eax, eax 057 1004155 40 INC eax 058 1004156 5F L7: POP edi 059 1004157 5B L4: POP ebx 060 1004158 5E L2: POP esi 061 1004159 5D L1: POP ebp 062 100415A C20400 RET 4 063 100415D 6A00 L6: PUSH 0 064 100415F 6830170001 PUSH 1001730h 065 1004164 68FC160001 PUSH 10016FCh 066 1004169 6A00 PUSH 0 067 100416B FF1568120001 CALL MessageBoxW 068 1004171 33C0 XOR eax, eax 069 1004173 EBE1 JMP L7 EndProc proc_0x10040ba BeginProc proc_0x1004047 000 1004047 8BFF MOV edi, edi 001 1004049 55 PUSH ebp 002 100404A 8BEC MOV ebp, esp 003 100404C 51 PUSH ecx 004 100404D 53 PUSH ebx 005 100404E 56 PUSH esi 006 100404F 57 PUSH edi 007 1004050 BE18010000 MOV esi, 118h 008 1004055 6830020000 PUSH 230h 009 100405A EB3F JMP L1 010 100405C 33FF L2: XOR edi, edi 011 100405E 33DB XOR ebx, ebx 012 1004060 8B04BDE8900001 L3: MOV eax, dword ptr [edi*0x4 + 0x10090e8] 013 1004067 56 PUSH esi 014 1004068 FF75FC PUSH dword ptr [ebp - 0x4] 015 100406B FF30 PUSH dword ptr [eax] 016 100406D FF7508 PUSH dword ptr [ebp + 0x8] 017 1004070 FF15C4110001 CALL LoadStringW 018 1004076 8D4EFF LEA ecx, dword ptr [esi - 0x1] 021 1004079 3BC1 CMP eax, ecx 022 100407B 7D0A JGE L4 023 100407D 47 INC edi 024 100407E 83FF2D CMP edi, 2Dh 025 1004081 8D5C0301 LEA ebx, dword ptr [ebx + eax + 0x1] 029 1004085 7CD9 JL L3 030 1004087 FF75FC L4: PUSH dword ptr [ebp - 0x4] 031 100408A FF15DC100001 CALL LocalFree 032 1004090 83FF2D CMP edi, 2Dh 033 1004093 7D17 JGE L5 034 1004095 03F6 ADD esi, esi 035 1004097 8D0436 LEA eax, dword ptr [esi + esi] 038 100409A 50 PUSH eax 039 100409B 6A40 L1: PUSH 40h 040 100409D FF15E0100001 CALL LocalAlloc 041 10040A3 85C0 TEST eax, eax 042 10040A5 8945FC MOV dword ptr [ebp - 0x4], eax 043 10040A8 75B2 JNE L2 044 10040AA EB02 JMP L6 045 10040AC 8BC3 L5: MOV eax, ebx 046 10040AE 5F L6: POP edi 047 10040AF 5E POP esi 048 10040B0 5B POP ebx 049 10040B1 C9 LEAVE 050 10040B2 C20400 RET 4 EndProc proc_0x1004047 BeginProc proc_0x10044d7 000 10044D7 8BFF MOV edi, edi 001 10044D9 55 PUSH ebp 002 10044DA 8BEC MOV ebp, esp 003 10044DC 83EC30 SUB esp, 30h 004 10044DF 57 PUSH edi 005 10044E0 6A29 PUSH 29h 006 10044E2 C745D030000000 MOV dword ptr [ebp - 0x30], 30h 007 10044E9 FF151C120001 CALL GetSystemMetrics 008 10044EF F7D8 NEG eax 009 10044F1 1BC0 SBB eax, eax 010 10044F3 05017F0000 ADD eax, 7F01h 011 10044F8 50 PUSH eax 012 10044F9 33FF XOR edi, edi 013 10044FB 57 PUSH edi 014 10044FC FF15D8110001 CALL LoadCursorW 015 1004502 6A02 PUSH 2 016 1004504 56 PUSH esi 017 1004505 8945EC MOV dword ptr [ebp - 0x14], eax 018 1004508 FF15EC110001 CALL LoadIconW 019 100450E 57 PUSH edi 020 100450F 6A10 PUSH 10h 021 1004511 6A10 PUSH 10h 022 1004513 6A01 PUSH 1 023 1004515 6A02 PUSH 2 024 1004517 56 PUSH esi 025 1004518 8945E8 MOV dword ptr [ebp - 0x18], eax 026 100451B FF15D4110001 CALL LoadImageW 027 1004521 8945FC MOV dword ptr [ebp - 0x4], eax 028 1004524 8D45D0 LEA eax, dword ptr [ebp - 0x30] 029 1004527 50 PUSH eax 030 1004528 C745F401000000 MOV dword ptr [ebp - 0xc], 1 031 100452F 8975E4 MOV dword ptr [ebp - 0x1c], esi 032 1004532 C745F820900001 MOV dword ptr [ebp - 0x8], 1009020h 033 1004539 C745D829340001 MOV dword ptr [ebp - 0x28], 1003429h 034 1004540 C745F006000000 MOV dword ptr [ebp - 0x10], 6 035 1004547 897DD4 MOV dword ptr [ebp - 0x2c], edi 036 100454A 897DDC MOV dword ptr [ebp - 0x24], edi 037 100454D 897DE0 MOV dword ptr [ebp - 0x20], edi 038 1004550 FF15D0110001 CALL RegisterClassExW 039 1004556 66F7D8 NEG ax 040 1004559 5F POP edi 041 100455A 1BC0 SBB eax, eax 042 100455C F7D8 NEG eax 043 100455E C9 LEAVE 044 100455F C3 RET EndProc proc_0x10044d7 BeginProc proc_0x100195d 000 100195D 8BFF MOV edi, edi 001 100195F 55 PUSH ebp 002 1001960 8BEC MOV ebp, esp 003 1001962 51 PUSH ecx 004 1001963 6A02 PUSH 2 005 1001965 8D45FC LEA eax, dword ptr [ebp - 0x4] 006 1001968 50 PUSH eax 007 1001969 6A0D PUSH 0Dh 008 100196B 6800040000 PUSH 400h 009 1001970 C705E4A40001635F0001MOV dword ptr [0x100a4e4], 1005F63h 010 100197A C705ECA400010C000000MOV dword ptr [0x100a4ec], 0Ch 011 1001984 FF15D8100001 CALL GetLocaleInfoW 012 100198A 66837DFC31 CMP word ptr [ebp - 0x4], 31h 013 100198F 7520 JNE L1 014 1001991 B8E8030000 MOV eax, 3E8h 015 1001996 A3D0A40001 MOV dword ptr [0x100a4d0], eax 016 100199B A3D8A40001 MOV dword ptr [0x100a4d8], eax 017 10019A0 C705B0A4000106A00000MOV dword ptr [0x100a4b0], 0A006h 018 10019AA B8EE020000 MOV eax, 2EEh 019 10019AF EB1E JMP L2 020 10019B1 B8C4090000 L1: MOV eax, 9C4h 021 10019B6 A3D0A40001 MOV dword ptr [0x100a4d0], eax 022 10019BB A3D8A40001 MOV dword ptr [0x100a4d8], eax 023 10019C0 C705B0A400010AA00000MOV dword ptr [0x100a4b0], 0A00Ah 024 10019CA B8D0070000 MOV eax, 7D0h 025 10019CF A3CCA40001 L2: MOV dword ptr [0x100a4cc], eax 026 10019D4 A3D4A40001 MOV dword ptr [0x100a4d4], eax 027 10019D9 C9 LEAVE 028 10019DA C3 RET EndProc proc_0x100195d BeginProc proc_0x1003c92 000 1003C92 8BFF MOV edi, edi 001 1003C94 55 PUSH ebp 002 1003C95 8BEC MOV ebp, esp 003 1003C97 83EC64 SUB esp, 64h 004 1003C9A A104960001 MOV eax, dword ptr [0x1009604] 005 1003C9F 56 PUSH esi 006 1003CA0 57 PUSH edi 007 1003CA1 6A10 PUSH 10h 008 1003CA3 8945FC MOV dword ptr [ebp - 0x4], eax 009 1003CA6 FF1558100001 CALL GetStockObject 010 1003CAC 33FF XOR edi, edi 011 1003CAE 3BC7 CMP eax, edi 012 1003CB0 740D JE L1 013 1003CB2 8D4DA0 LEA ecx, dword ptr [ebp - 0x60] 014 1003CB5 51 PUSH ecx 015 1003CB6 6A5C PUSH 5Ch 016 1003CB8 50 PUSH eax 017 1003CB9 FF155C100001 CALL GetObjectW 018 1003CBF 8D459C L1: LEA eax, dword ptr [ebp - 0x64] 019 1003CC2 50 PUSH eax 020 1003CC3 68A4160001 PUSH 10016A4h 021 1003CC8 6801000080 PUSH 80000001h 022 1003CCD FF1508100001 CALL RegCreateKeyW 023 1003CD3 85C0 TEST eax, eax 024 1003CD5 7403 JE L2 025 1003CD7 897D9C MOV dword ptr [ebp - 0x64], edi 026 1003CDA FF75A8 L2: PUSH dword ptr [ebp - 0x58] 027 1003CDD 893D24AB0001 MOV dword ptr [0x100ab24], edi 028 1003CE3 6888160001 PUSH 1001688h 029 1003CE8 FF759C PUSH dword ptr [ebp - 0x64] 030 1003CEB E89DFCFFFF CALL proc_0x100398d 031 1003CF0 FF75AC PUSH dword ptr [ebp - 0x54] 032 1003CF3 A328AB0001 MOV dword ptr [0x100ab28], eax 033 1003CF8 686C160001 PUSH 100166Ch 034 1003CFD FF759C PUSH dword ptr [ebp - 0x64] 035 1003D00 E888FCFFFF CALL proc_0x100398d 036 1003D05 FF75B0 PUSH dword ptr [ebp - 0x50] 037 1003D08 A32CAB0001 MOV dword ptr [0x100ab2c], eax 038 1003D0D 6858160001 PUSH 1001658h 039 1003D12 FF759C PUSH dword ptr [ebp - 0x64] 040 1003D15 E873FCFFFF CALL proc_0x100398d 041 1003D1A A330AB0001 MOV dword ptr [0x100ab30], eax 042 1003D1F 0FB645B4 MOVZX eax, byte ptr [ebp - 0x4c] 043 1003D23 50 PUSH eax 044 1003D24 6844160001 PUSH 1001644h 045 1003D29 FF759C PUSH dword ptr [ebp - 0x64] 046 1003D2C E85CFCFFFF CALL proc_0x100398d 047 1003D31 A234AB0001 MOV byte ptr [0x100ab34], al 048 1003D36 0FB645B5 MOVZX eax, byte ptr [ebp - 0x4b] 049 1003D3A 50 PUSH eax 050 1003D3B 682C160001 PUSH 100162Ch 051 1003D40 FF759C PUSH dword ptr [ebp - 0x64] 052 1003D43 E845FCFFFF CALL proc_0x100398d 053 1003D48 A235AB0001 MOV byte ptr [0x100ab35], al 054 1003D4D 0FB645B6 MOVZX eax, byte ptr [ebp - 0x4a] 055 1003D51 50 PUSH eax 056 1003D52 6814160001 PUSH 1001614h 057 1003D57 FF759C PUSH dword ptr [ebp - 0x64] 058 1003D5A E82EFCFFFF CALL proc_0x100398d 059 1003D5F A236AB0001 MOV byte ptr [0x100ab36], al 060 1003D64 0FB645B7 MOVZX eax, byte ptr [ebp - 0x49] 061 1003D68 50 PUSH eax 062 1003D69 6800160001 PUSH 1001600h 063 1003D6E FF759C PUSH dword ptr [ebp - 0x64] 064 1003D71 E817FCFFFF CALL proc_0x100398d 065 1003D76 A237AB0001 MOV byte ptr [0x100ab37], al 066 1003D7B 0FB645B8 MOVZX eax, byte ptr [ebp - 0x48] 067 1003D7F 50 PUSH eax 068 1003D80 68E0150001 PUSH 10015E0h 069 1003D85 FF759C PUSH dword ptr [ebp - 0x64] 070 1003D88 E800FCFFFF CALL proc_0x100398d 071 1003D8D A238AB0001 MOV byte ptr [0x100ab38], al 072 1003D92 0FB645B9 MOVZX eax, byte ptr [ebp - 0x47] 073 1003D96 50 PUSH eax 074 1003D97 68C0150001 PUSH 10015C0h 075 1003D9C FF759C PUSH dword ptr [ebp - 0x64] 076 1003D9F E8E9FBFFFF CALL proc_0x100398d 077 1003DA4 A239AB0001 MOV byte ptr [0x100ab39], al 078 1003DA9 0FB645BA MOVZX eax, byte ptr [ebp - 0x46] 079 1003DAD 50 PUSH eax 080 1003DAE 68AC150001 PUSH 10015ACh 081 1003DB3 FF759C PUSH dword ptr [ebp - 0x64] 082 1003DB6 E8D2FBFFFF CALL proc_0x100398d 083 1003DBB A23AAB0001 MOV byte ptr [0x100ab3a], al 084 1003DC0 0FB645BB MOVZX eax, byte ptr [ebp - 0x45] 085 1003DC4 50 PUSH eax 086 1003DC5 6888150001 PUSH 1001588h 087 1003DCA FF759C PUSH dword ptr [ebp - 0x64] 088 1003DCD E8BBFBFFFF CALL proc_0x100398d 089 1003DD2 6A20 PUSH 20h 090 1003DD4 683CAB0001 PUSH 100AB3Ch 091 1003DD9 68DC160001 PUSH 10016DCh 092 1003DDE 680C150001 PUSH 100150Ch 093 1003DE3 FF759C PUSH dword ptr [ebp - 0x64] 094 1003DE6 A23BAB0001 MOV byte ptr [0x100ab3b], al 095 1003DEB E8F2FBFFFF CALL proc_0x10039e2 096 1003DF0 6A64 PUSH 64h 097 1003DF2 6870150001 PUSH 1001570h 098 1003DF7 FF759C PUSH dword ptr [ebp - 0x64] 099 1003DFA E88EFBFFFF CALL proc_0x100398d 100 1003DFF 57 PUSH edi 101 1003E00 6864150001 PUSH 1001564h 102 1003E05 FF759C PUSH dword ptr [ebp - 0x64] 103 1003E08 A318900001 MOV dword ptr [0x1009018], eax 104 1003E0D E87BFBFFFF CALL proc_0x100398d 105 1003E12 A350980001 MOV dword ptr [0x1009850], eax 106 1003E17 57 PUSH edi 107 1003E18 6850150001 PUSH 1001550h 108 1003E1D FF759C PUSH dword ptr [ebp - 0x64] 109 1003E20 E868FBFFFF CALL proc_0x100398d 110 1003E25 57 PUSH edi 111 1003E26 6824150001 PUSH 1001524h 112 1003E2B FF759C PUSH dword ptr [ebp - 0x64] 113 1003E2E A340980001 MOV dword ptr [0x1009840], eax 114 1003E33 E855FBFFFF CALL proc_0x100398d 115 1003E38 6A28 PUSH 28h 116 1003E3A A3849A0001 MOV dword ptr [0x1009a84], eax 117 1003E3F B8E0A30001 MOV eax, 100A3E0h 118 1003E44 50 PUSH eax 119 1003E45 50 PUSH eax 120 1003E46 68F8140001 PUSH 10014F8h 121 1003E4B FF759C PUSH dword ptr [ebp - 0x64] 122 1003E4E E88FFBFFFF CALL proc_0x10039e2 123 1003E53 6A28 PUSH 28h 124 1003E55 B830A40001 MOV eax, 100A430h 125 1003E5A 50 PUSH eax 126 1003E5B 50 PUSH eax 127 1003E5C 68E4140001 PUSH 10014E4h 128 1003E61 FF759C PUSH dword ptr [ebp - 0x64] 129 1003E64 E879FBFFFF CALL proc_0x10039e2 130 1003E69 FF35D0A40001 PUSH dword ptr [0x100a4d0] 131 1003E6F 68CC140001 PUSH 10014CCh 132 1003E74 FF759C PUSH dword ptr [ebp - 0x64] 133 1003E77 E811FBFFFF CALL proc_0x100398d 134 1003E7C FF35D8A40001 PUSH dword ptr [0x100a4d8] 135 1003E82 A3D0A40001 MOV dword ptr [0x100a4d0], eax 136 1003E87 68B0140001 PUSH 10014B0h 137 1003E8C FF759C PUSH dword ptr [ebp - 0x64] 138 1003E8F E8F9FAFFFF CALL proc_0x100398d 139 1003E94 FF35CCA40001 PUSH dword ptr [0x100a4cc] 140 1003E9A A3D8A40001 MOV dword ptr [0x100a4d8], eax 141 1003E9F 6898140001 PUSH 1001498h 142 1003EA4 FF759C PUSH dword ptr [ebp - 0x64] 143 1003EA7 E8E1FAFFFF CALL proc_0x100398d 144 1003EAC FF35D4A40001 PUSH dword ptr [0x100a4d4] 145 1003EB2 A3CCA40001 MOV dword ptr [0x100a4cc], eax 146 1003EB7 687C140001 PUSH 100147Ch 147 1003EBC FF759C PUSH dword ptr [ebp - 0x64] 148 1003EBF E8C9FAFFFF CALL proc_0x100398d 149 1003EC4 BE00000080 MOV esi, 80000000h 150 1003EC9 56 PUSH esi 151 1003ECA 682C140001 PUSH 100142Ch 152 1003ECF FF759C PUSH dword ptr [ebp - 0x64] 153 1003ED2 A3D4A40001 MOV dword ptr [0x100a4d4], eax 154 1003ED7 E8B1FAFFFF CALL proc_0x100398d 155 1003EDC 56 PUSH esi 156 1003EDD 6844140001 PUSH 1001444h 157 1003EE2 FF759C PUSH dword ptr [ebp - 0x64] 158 1003EE5 A37C9A0001 MOV dword ptr [0x1009a7c], eax 159 1003EEA E89EFAFFFF CALL proc_0x100398d 160 1003EEF 56 PUSH esi 161 1003EF0 6810140001 PUSH 1001410h 162 1003EF5 FF759C PUSH dword ptr [ebp - 0x64] 163 1003EF8 A3789A0001 MOV dword ptr [0x1009a78], eax 164 1003EFD E88BFAFFFF CALL proc_0x100398d 165 1003F02 56 PUSH esi 166 1003F03 68F4130001 PUSH 10013F4h 167 1003F08 FF759C PUSH dword ptr [ebp - 0x64] 168 1003F0B A3749A0001 MOV dword ptr [0x1009a74], eax 169 1003F10 E878FAFFFF CALL proc_0x100398d 170 1003F15 57 PUSH edi 171 1003F16 685C140001 PUSH 100145Ch 172 1003F1B FF759C PUSH dword ptr [ebp - 0x64] 173 1003F1E A3709A0001 MOV dword ptr [0x1009a70], eax 174 1003F23 E865FAFFFF CALL proc_0x100398d 175 1003F28 397D9C CMP dword ptr [ebp - 0x64], edi 176 1003F2B 5F POP edi 177 1003F2C A358980001 MOV dword ptr [0x1009858], eax 178 1003F31 5E POP esi 179 1003F32 7409 JE L3 180 1003F34 FF759C PUSH dword ptr [ebp - 0x64] 181 1003F37 FF1504100001 CALL RegCloseKey 182 1003F3D 8B4DFC L3: MOV ecx, dword ptr [ebp - 0x4] 183 1003F40 E802320000 CALL proc_0x1007147 184 1003F45 C9 LEAVE 185 1003F46 C3 RET EndProc proc_0x1003c92 BeginProc proc_0x100398d 000 100398D 8BFF MOV edi, edi 001 100398F 55 PUSH ebp 002 1003990 8BEC MOV ebp, esp 003 1003992 83EC0C SUB esp, 0Ch 004 1003995 8365FC00 AND dword ptr [ebp - 0x4], 0 005 1003999 837D0800 CMP dword ptr [ebp + 0x8], 0 006 100399D C745F801000000 MOV dword ptr [ebp - 0x8], 1 007 10039A4 C745F404000000 MOV dword ptr [ebp - 0xc], 4 008 10039AB 7424 JE L1 009 10039AD 8D45F4 LEA eax, dword ptr [ebp - 0xc] 010 10039B0 50 PUSH eax 011 10039B1 8D45F8 LEA eax, dword ptr [ebp - 0x8] 012 10039B4 50 PUSH eax 013 10039B5 8D45FC LEA eax, dword ptr [ebp - 0x4] 014 10039B8 50 PUSH eax 015 10039B9 6A00 PUSH 0 016 10039BB FF750C PUSH dword ptr [ebp + 0xc] 017 10039BE FF7508 PUSH dword ptr [ebp + 0x8] 018 10039C1 FF1500100001 CALL RegQueryValueExW 019 10039C7 85C0 TEST eax, eax 020 10039C9 7506 JNE L1 021 10039CB 837DFC04 CMP dword ptr [ebp - 0x4], 4 022 10039CF 7405 JE L2 023 10039D1 8B4510 L1: MOV eax, dword ptr [ebp + 0x10] 024 10039D4 EB03 JMP L3 025 10039D6 8B45F8 L2: MOV eax, dword ptr [ebp - 0x8] 026 10039D9 C9 L3: LEAVE 027 10039DA C20C00 RET 0Ch EndProc proc_0x100398d BeginProc proc_0x10039e2 000 10039E2 8BFF MOV edi, edi 001 10039E4 55 PUSH ebp 002 10039E5 8BEC MOV ebp, esp 003 10039E7 56 PUSH esi 004 10039E8 8B7518 MOV esi, dword ptr [ebp + 0x18] 005 10039EB 03F6 ADD esi, esi 006 10039ED 837D0800 CMP dword ptr [ebp + 0x8], 0 007 10039F1 57 PUSH edi 008 10039F2 8B7D14 MOV edi, dword ptr [ebp + 0x14] 009 10039F5 897518 MOV dword ptr [ebp + 0x18], esi 010 10039F8 7421 JE L1 011 10039FA 8D4518 LEA eax, dword ptr [ebp + 0x18] 012 10039FD 50 PUSH eax 013 10039FE 57 PUSH edi 014 10039FF 8D4508 LEA eax, dword ptr [ebp + 0x8] 015 1003A02 50 PUSH eax 016 1003A03 6A00 PUSH 0 017 1003A05 FF750C PUSH dword ptr [ebp + 0xc] 018 1003A08 FF7508 PUSH dword ptr [ebp + 0x8] 019 1003A0B FF1500100001 CALL RegQueryValueExW 020 1003A11 85C0 TEST eax, eax 021 1003A13 7506 JNE L1 022 1003A15 837D0801 CMP dword ptr [ebp + 0x8], 1 023 1003A19 7413 JE L2 024 1003A1B 8BCE L1: MOV ecx, esi 025 1003A1D 8B7510 MOV esi, dword ptr [ebp + 0x10] 026 1003A20 8BC1 MOV eax, ecx 027 1003A22 C1E902 SHR ecx, 2 028 1003A25 F3A5 REP MOVSD 029 1003A27 8BC8 MOV ecx, eax 030 1003A29 83E103 AND ecx, 3 031 1003A2C F3A4 REP MOVSB 032 1003A2E 5F L2: POP edi 033 1003A2F 5E POP esi 034 1003A30 5D POP ebp 035 1003A31 C21400 RET 14h EndProc proc_0x10039e2 BeginProc proc_0x1007147 000 1007147 3B0D04960001 CMP ecx, dword ptr [0x1009604] 001 100714D 7509 JNE L1 002 100714F F7C10000FFFF TEST ecx, 0FFFF0000h 003 1007155 7501 JNE L1 004 1007157 C3 RET 005 1007158 E905000000 L1: JMP L2 006 100715D CC INT 3 007 100715E CC INT 3 008 100715F CC INT 3 009 1007160 CC INT 3 010 1007161 CC INT 3 011 1007162 8BFF L2: MOV edi, edi 012 1007164 55 PUSH ebp 013 1007165 8BEC MOV ebp, esp 014 1007167 81EC30030000 SUB esp, 330h 015 100716D 57 PUSH edi 016 100716E 8985D8FDFFFF MOV dword ptr [ebp - 0x228], eax 017 1007174 898DD4FDFFFF MOV dword ptr [ebp - 0x22c], ecx 018 100717A 8995D0FDFFFF MOV dword ptr [ebp - 0x230], edx 019 1007180 899DCCFDFFFF MOV dword ptr [ebp - 0x234], ebx 020 1007186 89B5C8FDFFFF MOV dword ptr [ebp - 0x238], esi 021 100718C 89BDC4FDFFFF MOV dword ptr [ebp - 0x23c], edi 022 1007192 668C95F0FDFFFF MOV word ptr [ebp - 0x210], ss 023 1007199 668C8DE4FDFFFF MOV word ptr [ebp - 0x21c], cs 024 10071A0 668C9DC0FDFFFF MOV word ptr [ebp - 0x240], ds 025 10071A7 668C85BCFDFFFF MOV word ptr [ebp - 0x244], es 026 10071AE 668CA5B8FDFFFF MOV word ptr [ebp - 0x248], fs 027 10071B5 668CADB4FDFFFF MOV word ptr [ebp - 0x24c], gs 028 10071BC 9C PUSHF 029 10071BD 8F85E8FDFFFF POP dword ptr [ebp - 0x218] 030 10071C3 C78528FDFFFF01000100MOV dword ptr [ebp - 0x2d8], 10001h 031 10071CD 8B4504 MOV eax, 1003F45h 032 10071D0 8985E0FDFFFF MOV dword ptr [ebp - 0x220], eax 033 10071D6 8D4504 LEA eax, 1003F45h 034 10071D9 8985ECFDFFFF MOV dword ptr [ebp - 0x214], eax 035 10071DF 8D4504 LEA eax, 1003F45h 036 10071E2 8B40FC MOV eax, dword ptr [eax - 0x4] 037 10071E5 8985DCFDFFFF MOV dword ptr [ebp - 0x224], eax 038 10071EB 6A14 PUSH 14h 039 10071ED 59 POP ecx 040 10071EE 33C0 XOR eax, eax 041 10071F0 8DBDD0FCFFFF LEA edi, dword ptr [ebp - 0x330] 042 10071F6 F3AB REP STOSD 043 10071F8 C785D0FCFFFF090400C0MOV dword ptr [ebp - 0x330], 0C0000409h 044 1007202 8B4504 MOV eax, 1003F45h 045 1007205 8985DCFCFFFF MOV dword ptr [ebp - 0x324], eax 046 100720B 8D85D0FCFFFF LEA eax, dword ptr [ebp - 0x330] 047 1007211 8945F8 MOV dword ptr [ebp - 0x8], eax 048 1007214 8D8528FDFFFF LEA eax, dword ptr [ebp - 0x2d8] 049 100721A 8945FC MOV dword ptr [ebp - 0x4], eax 050 100721D A104960001 MOV eax, dword ptr [0x1009604] 051 1007222 898520FDFFFF MOV dword ptr [ebp - 0x2e0], eax 052 1007228 A100960001 MOV eax, dword ptr [0x1009600] 053 100722D 898524FDFFFF MOV dword ptr [ebp - 0x2dc], eax 054 1007233 6A00 PUSH 0 055 1007235 FF15C4100001 CALL SetUnhandledExceptionFilter 056 100723B 8D45F8 LEA eax, dword ptr [ebp - 0x8] 057 100723E 50 PUSH eax 058 100723F FF156C110001 CALL UnhandledExceptionFilter 059 1007245 6802050000 PUSH 502h 060 100724A FF15C0100001 CALL GetCurrentProcess 061 1007250 50 PUSH eax 062 1007251 FF15BC100001 CALL TerminateProcess 063 1007257 5F POP edi 064 1007258 C9 LEAVE 065 1007259 C3 RET EndProc proc_0x1007147 BeginProc proc_0x1001c42 000 1001C42 8BFF MOV edi, edi 001 1001C44 55 PUSH ebp 002 1001C45 8BEC MOV ebp, esp 003 1001C47 81EC0C010000 SUB esp, 10Ch 004 1001C4D A104960001 MOV eax, dword ptr [0x1009604] 005 1001C52 53 PUSH ebx 006 1001C53 56 PUSH esi 007 1001C54 8B3540120001 MOV esi, dword ptr [0x1001240] 008 1001C5A 57 PUSH edi 009 1001C5B 8945FC MOV dword ptr [ebp - 0x4], eax 010 1001C5E 8D85F4FEFFFF LEA eax, dword ptr [ebp - 0x10c] 011 1001C64 50 PUSH eax 012 1001C65 8D85F8FEFFFF LEA eax, dword ptr [ebp - 0x108] 013 1001C6B 50 PUSH eax 014 1001C6C 68B0000000 PUSH 0B0h 015 1001C71 FF3538980001 PUSH dword ptr [0x1009838] 016 1001C77 FFD6 CALL esi 017 1001C79 6A00 PUSH 0 018 1001C7B FFB5F8FEFFFF PUSH dword ptr [ebp - 0x108] 019 1001C81 68C9000000 PUSH 0C9h 020 1001C86 FF3538980001 PUSH dword ptr [0x1009838] 021 1001C8C FFD6 CALL esi 022 1001C8E 8BF8 MOV edi, eax 023 1001C90 6A00 PUSH 0 024 1001C92 47 INC edi 025 1001C93 8D47FF LEA eax, dword ptr [edi - 0x1] 028 1001C96 50 PUSH eax 029 1001C97 68BB000000 PUSH 0BBh 030 1001C9C FF3538980001 PUSH dword ptr [0x1009838] 031 1001CA2 FFD6 CALL esi 032 1001CA4 8B9DF8FEFFFF MOV ebx, dword ptr [ebp - 0x108] 033 1001CAA 2BD8 SUB ebx, eax 034 1001CAC 43 INC ebx 035 1001CAD 837D0800 CMP dword ptr [ebp + 0x8], 0 036 1001CB1 7510 JNE L1 037 1001CB3 3B1D24960001 CMP ebx, dword ptr [0x1009624] 038 1001CB9 7508 JNE L1 039 1001CBB 3B3D20960001 CMP edi, dword ptr [0x1009620] 040 1001CC1 7439 JE L2 041 1001CC3 53 L1: PUSH ebx 042 1001CC4 57 PUSH edi 043 1001CC5 FF35C8900001 PUSH dword ptr [0x10090c8] 044 1001CCB 8D85FCFEFFFF LEA eax, dword ptr [ebp - 0x104] 045 1001CD1 6A7F PUSH 7Fh 046 1001CD3 50 PUSH eax 047 1001CD4 FF1514130001 CALL _snwprintf 048 1001CDA A134980001 MOV eax, dword ptr [0x1009834] 049 1001CDF 668365FA00 AND word ptr [ebp - 0x6], 0 050 1001CE4 83C414 ADD esp, 14h 051 1001CE7 85C0 TEST eax, eax 052 1001CE9 7411 JE L2 053 1001CEB 8D8DFCFEFFFF LEA ecx, dword ptr [ebp - 0x104] 054 1001CF1 51 PUSH ecx 055 1001CF2 6A01 PUSH 1 056 1001CF4 680B040000 PUSH 40Bh 057 1001CF9 50 PUSH eax 058 1001CFA FFD6 CALL esi 059 1001CFC 8B4DFC L2: MOV ecx, dword ptr [ebp - 0x4] 060 1001CFF 893D20960001 MOV dword ptr [0x1009620], edi 061 1001D05 5F POP edi 062 1001D06 5E POP esi 063 1001D07 891D24960001 MOV dword ptr [0x1009624], ebx 064 1001D0D 5B POP ebx 065 1001D0E E834540000 CALL proc_0x1007147 066 1001D13 C9 LEAVE 067 1001D14 C20400 RET 4 EndProc proc_0x1001c42 BeginProc proc_0x1002a55 000 1002A55 8BFF MOV edi, edi 001 1002A57 55 PUSH ebp 002 1002A58 8BEC MOV ebp, esp 003 1002A5A 81ECC8070000 SUB esp, 7C8h 004 1002A60 A104960001 MOV eax, dword ptr [0x1009604] 005 1002A65 6683A5FCFEFFFF00 AND word ptr [ebp - 0x104], 0 006 1002A6D 56 PUSH esi 007 1002A6E 8B7508 MOV esi, dword ptr [ebp + 0x8] 008 1002A71 57 PUSH edi 009 1002A72 6A3F PUSH 3Fh 010 1002A74 8945FC MOV dword ptr [ebp - 0x4], eax 011 1002A77 59 POP ecx 012 1002A78 FF3540900001 PUSH dword ptr [0x1009040] 013 1002A7E 33C0 XOR eax, eax 014 1002A80 8DBDFEFEFFFF LEA edi, dword ptr [ebp - 0x102] 015 1002A86 F3AB REP STOSD 016 1002A88 56 PUSH esi 017 1002A89 66AB STOSD 018 1002A8B FF1528110001 CALL lstrcmpW 019 1002A91 85C0 TEST eax, eax 020 1002A93 7519 JNE L1 021 1002A95 FF3540900001 PUSH dword ptr [0x1009040] 022 1002A9B 8D8590FCFFFF LEA eax, dword ptr [ebp - 0x370] 023 1002AA1 6836010000 PUSH 136h 024 1002AA6 50 PUSH eax 025 1002AA7 E85DF9FFFF CALL proc_0x1002409 026 1002AAC EB66 JMP L2 027 1002AAE 56 L1: PUSH esi 028 1002AAF FF1524110001 CALL GetFileAttributesW 029 1002AB5 8D8538F8FFFF LEA eax, dword ptr [ebp - 0x7c8] 030 1002ABB 50 PUSH eax 031 1002ABC 56 PUSH esi 032 1002ABD FF1520110001 CALL FindFirstFileW 033 1002AC3 8BF8 MOV edi, eax 034 1002AC5 83FFFF CMP edi, 0FFFFFFFFh 035 1002AC8 7422 JE L3 036 1002ACA 8D8564F8FFFF LEA eax, dword ptr [ebp - 0x79c] 037 1002AD0 50 PUSH eax 038 1002AD1 BE04010000 MOV esi, 104h 039 1002AD6 56 PUSH esi 040 1002AD7 8D8588FAFFFF LEA eax, dword ptr [ebp - 0x578] 041 1002ADD 50 PUSH eax 042 1002ADE E826F9FFFF CALL proc_0x1002409 043 1002AE3 57 PUSH edi 044 1002AE4 FF151C110001 CALL FindClose 045 1002AEA EB13 JMP L4 046 1002AEC 56 L3: PUSH esi 047 1002AED BE04010000 MOV esi, 104h 048 1002AF2 56 PUSH esi 049 1002AF3 8D8588FAFFFF LEA eax, dword ptr [ebp - 0x578] 050 1002AF9 50 PUSH eax 051 1002AFA E80AF9FFFF CALL proc_0x1002409 052 1002AFF 56 L4: PUSH esi 053 1002B00 8D8590FCFFFF LEA eax, dword ptr [ebp - 0x370] 054 1002B06 50 PUSH eax 055 1002B07 8D8588FAFFFF LEA eax, dword ptr [ebp - 0x578] 056 1002B0D 50 PUSH eax 057 1002B0E FF15D4120001 CALL GetFileTitleW 058 1002B14 6A01 L2: PUSH 1 059 1002B16 6A01 PUSH 1 060 1002B18 FF35C8900001 PUSH dword ptr [0x10090c8] 061 1002B1E 8D85FCFEFFFF LEA eax, dword ptr [ebp - 0x104] 062 1002B24 6A7F PUSH 7Fh 063 1002B26 50 PUSH eax 064 1002B27 FF1514130001 CALL _snwprintf 065 1002B2D A134980001 MOV eax, dword ptr [0x1009834] 066 1002B32 83C414 ADD esp, 14h 067 1002B35 85C0 TEST eax, eax 068 1002B37 5F POP edi 069 1002B38 5E POP esi 070 1002B39 7415 JE L5 071 1002B3B 8D8DFCFEFFFF LEA ecx, dword ptr [ebp - 0x104] 072 1002B41 51 PUSH ecx 073 1002B42 6A01 PUSH 1 074 1002B44 680B040000 PUSH 40Bh 075 1002B49 50 PUSH eax 076 1002B4A FF1540120001 CALL SendMessageW 077 1002B50 FF3544900001 L5: PUSH dword ptr [0x1009044] 078 1002B56 8D8590FCFFFF LEA eax, dword ptr [ebp - 0x370] 079 1002B5C 50 PUSH eax 080 1002B5D FF1518110001 CALL lstrcatW 081 1002B63 8D8590FCFFFF LEA eax, dword ptr [ebp - 0x370] 082 1002B69 50 PUSH eax 083 1002B6A FF3530980001 PUSH dword ptr [0x1009830] 084 1002B70 FF15F0110001 CALL SetWindowTextW 085 1002B76 8B4DFC MOV ecx, dword ptr [ebp - 0x4] 086 1002B79 E8C9450000 CALL proc_0x1007147 087 1002B7E C9 LEAVE 088 1002B7F C20400 RET 4 EndProc proc_0x1002a55 BeginProc proc_0x1002409 000 1002409 8BFF MOV edi, edi 001 100240B 55 PUSH ebp 002 100240C 8BEC MOV ebp, esp 003 100240E 33C0 XOR eax, eax 004 1002410 39450C CMP dword ptr [ebp + 0xc], eax 005 1002413 7507 JNE L1 006 1002415 B857000780 MOV eax, 80070057h 007 100241A EB2D JMP L2 008 100241C 8B5508 L1: MOV edx, dword ptr [ebp + 0x8] 009 100241F 56 PUSH esi 010 1002420 8B7510 MOV esi, dword ptr [ebp + 0x10] 011 1002423 668B0E L3: MOV cx, word ptr [esi] 012 1002426 6685C9 TEST cx, cx 013 1002429 740C JE L4 014 100242B 66890A MOV word ptr [edx], cx 015 100242E 42 INC edx 016 100242F 42 INC edx 017 1002430 46 INC esi 018 1002431 46 INC esi 019 1002432 FF4D0C DEC dword ptr [ebp + 0xc] 020 1002435 75EC JNE L3 021 1002437 837D0C00 L4: CMP dword ptr [ebp + 0xc], 0 022 100243B 5E POP esi 023 100243C 7507 JNE L5 024 100243E 4A DEC edx 025 100243F 4A DEC edx 026 1002440 B87A000780 MOV eax, 8007007Ah 027 1002445 66832200 L5: AND word ptr [edx], 0 028 1002449 5D L2: POP ebp 029 100244A C20C00 RET 0Ch EndProc proc_0x1002409 BeginProc proc_0x100417a 000 100417A 8BFF MOV edi, edi 001 100417C 55 PUSH ebp 002 100417D 8BEC MOV ebp, esp 003 100417F 8B4508 MOV eax, dword ptr [ebp + 0x8] 004 1004182 668B08 L1: MOV cx, word ptr [eax] 005 1004185 6683F920 CMP cx, 20h 006 1004189 7406 JE L2 007 100418B 6683F909 CMP cx, 9 008 100418F 7504 JNE L3 009 1004191 40 L2: INC eax 010 1004192 40 INC eax 011 1004193 EBED JMP L1 012 1004195 5D L3: POP ebp 013 1004196 C20400 RET 4 EndProc proc_0x100417a BeginProc proc_0x1003f4c 000 1003F4C 8BFF MOV edi, edi 001 1003F4E 55 PUSH ebp 002 1003F4F 8BEC MOV ebp, esp 003 1003F51 51 PUSH ecx 004 1003F52 53 PUSH ebx 005 1003F53 56 PUSH esi 006 1003F54 57 PUSH edi 007 1003F55 8BF9 MOV edi, ecx 008 1003F57 8BD8 MOV ebx, eax 009 1003F59 668B07 MOV ax, word ptr [edi] 010 1003F5C 6685C0 TEST ax, ax 011 1003F5F 7427 JE L1 012 1003F61 8B35C0110001 MOV esi, dword ptr [0x10011c0] 013 1003F67 0FB7C0 L2: MOVZX eax, eax 014 1003F6A 50 PUSH eax 015 1003F6B FFD6 CALL esi 016 1003F6D 8945FC MOV dword ptr [ebp - 0x4], eax 017 1003F70 0FB703 MOVZX eax, dword ptr [ebx] 018 1003F73 47 INC edi 019 1003F74 47 INC edi 020 1003F75 43 INC ebx 021 1003F76 50 PUSH eax 022 1003F77 43 INC ebx 023 1003F78 FFD6 CALL esi 024 1003F7A 663945FC CMP word ptr [ebp - 0x4], ax 025 1003F7E 750F JNE L3 026 1003F80 668B07 MOV ax, word ptr [edi] 027 1003F83 6685C0 TEST ax, ax 028 1003F86 75DF JNE L2 029 1003F88 33C0 L1: XOR eax, eax 030 1003F8A 5F L4: POP edi 031 1003F8B 5E POP esi 032 1003F8C 5B POP ebx 033 1003F8D C9 LEAVE 034 1003F8E C3 RET 035 1003F8F 33C0 L3: XOR eax, eax 036 1003F91 40 INC eax 037 1003F92 EBF6 JMP L4 EndProc proc_0x1003f4c BeginProc proc_0x100419e 000 100419E 8BFF MOV edi, edi 001 10041A0 55 PUSH ebp 002 10041A1 8BEC MOV ebp, esp 003 10041A3 51 PUSH ecx 004 10041A4 53 PUSH ebx 005 10041A5 56 PUSH esi 006 10041A6 8B7508 MOV esi, dword ptr [ebp + 0x8] 007 10041A9 57 PUSH edi 008 10041AA 33FF XOR edi, edi 009 10041AC 8BC6 MOV eax, esi 010 10041AE B95C170001 MOV ecx, 100175Ch 011 10041B3 897DFC MOV dword ptr [ebp - 0x4], edi 012 10041B6 E891FDFFFF CALL proc_0x1003f4c 013 10041BB 85C0 TEST eax, eax 014 10041BD 0F8528010000 JNE L1 015 10041C3 57 PUSH edi 016 10041C4 FF3530980001 PUSH dword ptr [0x1009830] 017 10041CA C7054C98000101000000MOV dword ptr [0x100984c], 1 018 10041D4 FF15CC110001 CALL GetSystemMenu 019 10041DA 6848170001 PUSH 1001748h 020 10041DF FF3580AB0001 PUSH dword ptr [0x100ab80] 021 10041E5 A3DCA60001 MOV dword ptr [0x100a6dc], eax 022 10041EA FF15C8110001 CALL LoadAcceleratorsW 023 10041F0 680000FD00 PUSH 0FD0000h 024 10041F5 6AF0 PUSH 0FFFFFFF0h 025 10041F7 FF3530980001 PUSH dword ptr [0x1009830] 026 10041FD A3D8A60001 MOV dword ptr [0x100a6d8], eax 027 1004202 FF156C120001 CALL SetWindowLongW 028 1004208 83C60E ADD esi, 0Eh 029 100420B 56 PUSH esi 030 100420C E869FFFFFF CALL proc_0x100417a 031 1004211 663938 CMP word ptr [eax], di 032 1004214 0F84CC000000 JE L2 033 100421A 50 PUSH eax 034 100421B BE00A90001 MOV esi, 100A900h 035 1004220 56 PUSH esi 036 1004221 E873FDFFFF CALL proc_0x1003f99 037 1004226 57 PUSH edi 038 1004227 BB80000000 MOV ebx, 80h 039 100422C 53 PUSH ebx 040 100422D 6A03 PUSH 3 041 100422F 57 PUSH edi 042 1004230 8B3D04110001 MOV edi, dword ptr [0x1001104] 043 1004236 6A03 PUSH 3 044 1004238 6800000080 PUSH 80000000h 045 100423D 56 PUSH esi 046 100423E FFD7 CALL edi 047 1004240 83F8FF CMP eax, 0FFFFFFFFh 048 1004243 A380A40001 MOV dword ptr [0x100a480], eax 049 1004248 0F8584000000 JNE L3 050 100424E FF1538110001 CALL GetLastError 051 1004254 48 DEC eax 052 1004255 48 DEC eax 053 1004256 7439 JE L4 054 1004258 83E803 SUB eax, 3 055 100425B 6A31 PUSH 31h 056 100425D 56 PUSH esi 057 100425E 7429 JE L5 058 1004260 83E876 SUB eax, 76h 059 1004263 741C JE L6 060 1004265 FF3534900001 PUSH dword ptr [0x1009034] 061 100426B FF3554900001 L7: PUSH dword ptr [0x1009054] 062 1004271 FF3530980001 PUSH dword ptr [0x1009830] 063 1004277 E8F4DCFFFF CALL proc_0x1001f70 064 100427C 8945FC MOV dword ptr [ebp - 0x4], eax 065 100427F EB48 JMP L8 066 1004281 FF3564900001 L6: PUSH dword ptr [0x1009064] 067 1004287 EBE2 JMP L7 068 1004289 FF359C900001 L5: PUSH dword ptr [0x100909c] 069 100428F EBDA JMP L7 070 1004291 6A33 L4: PUSH 33h 071 1004293 56 PUSH esi 072 1004294 FF3538900001 PUSH dword ptr [0x1009038] 073 100429A FF3554900001 PUSH dword ptr [0x1009054] 074 10042A0 FF3530980001 PUSH dword ptr [0x1009830] 075 10042A6 E8C5DCFFFF CALL proc_0x1001f70 076 10042AB 83F806 CMP eax, 6 077 10042AE 8945FC MOV dword ptr [ebp - 0x4], eax 078 10042B1 7516 JNE L8 079 10042B3 6A00 PUSH 0 080 10042B5 53 PUSH ebx 081 10042B6 6A04 PUSH 4 082 10042B8 6A00 PUSH 0 083 10042BA 6A03 PUSH 3 084 10042BC 68000000C0 PUSH 0C0000000h 085 10042C1 56 PUSH esi 086 10042C2 FFD7 CALL edi 087 10042C4 A380A40001 MOV dword ptr [0x100a480], eax 088 10042C9 833D80A40001FF L8: CMP dword ptr [0x100a480], 0FFFFFFFFh 089 10042D0 7419 JE L1 090 10042D2 FF35809A0001 L3: PUSH dword ptr [0x1009a80] 091 10042D8 56 PUSH esi 092 10042D9 E89B0E0000 CALL proc_0x1005179 093 10042DE 6A02 PUSH 2 094 10042E0 58 POP eax 095 10042E1 3945FC CMP dword ptr [ebp - 0x4], eax 096 10042E4 7407 JE L9 097 10042E6 6A06 L2: PUSH 6 098 10042E8 58 POP eax 099 10042E9 EB02 JMP L9 100 10042EB 33C0 L1: XOR eax, eax 101 10042ED 5F L9: POP edi 102 10042EE 5E POP esi 103 10042EF 5B POP ebx 104 10042F0 C9 LEAVE 105 10042F1 C20400 RET 4 EndProc proc_0x100419e BeginProc proc_0x1003f99 000 1003F99 8BFF MOV edi, edi 001 1003F9B 55 PUSH ebp 002 1003F9C 8BEC MOV ebp, esp 003 1003F9E 81EC54020000 SUB esp, 254h 004 1003FA4 A104960001 MOV eax, dword ptr [0x1009604] 005 1003FA9 53 PUSH ebx 006 1003FAA 8B5D08 MOV ebx, dword ptr [ebp + 0x8] 007 1003FAD 56 PUSH esi 008 1003FAE 8B750C MOV esi, dword ptr [ebp + 0xc] 009 1003FB1 8945FC MOV dword ptr [ebp - 0x4], eax 010 1003FB4 668B06 MOV ax, word ptr [esi] 011 1003FB7 663D2200 CMP ax, 22h 012 1003FBB 57 PUSH edi 013 1003FBC 8BCB MOV ecx, ebx 014 1003FBE 7415 JE L1 015 1003FC0 663D2700 CMP ax, 27h 016 1003FC4 740F JE L1 017 1003FC6 6804010000 PUSH 104h 018 1003FCB 56 PUSH esi 019 1003FCC 53 PUSH ebx 020 1003FCD FF1530110001 CALL lstrcpynW 021 1003FD3 EB2B JMP L2 022 1003FD5 33D2 L1: XOR edx, edx 023 1003FD7 46 INC esi 024 1003FD8 8BF8 MOV edi, eax 025 1003FDA 46 INC esi 026 1003FDB EB17 JMP L3 027 1003FDD 663BC7 L4: CMP ax, di 028 1003FE0 741A JE L5 029 1003FE2 81FA04010000 CMP edx, 104h 030 1003FE8 7312 JAE L5 031 1003FEA 668901 MOV word ptr [ecx], ax 032 1003FED 41 INC ecx 033 1003FEE 41 INC ecx 034 1003FEF 42 INC edx 035 1003FF0 46 INC esi 036 1003FF1 46 INC esi 037 1003FF2 33C0 XOR eax, eax 038 1003FF4 668B06 L3: MOV ax, word ptr [esi] 039 1003FF7 6685C0 TEST ax, ax 040 1003FFA 75E1 JNE L4 041 1003FFC 66832100 L5: AND word ptr [ecx], 0 042 1004000 8B3D20110001 L2: MOV edi, dword ptr [0x1001120] 043 1004006 8D85ACFDFFFF LEA eax, dword ptr [ebp - 0x254] 044 100400C 50 PUSH eax 045 100400D 53 PUSH ebx 046 100400E FFD7 CALL edi 047 1004010 83F8FF CMP eax, 0FFFFFFFFh 048 1004013 7515 JNE L6 049 1004015 53 PUSH ebx 050 1004016 E8B20D0000 CALL proc_0x1004dcd 051 100401B 8D85ACFDFFFF LEA eax, dword ptr [ebp - 0x254] 052 1004021 50 PUSH eax 053 1004022 53 PUSH ebx 054 1004023 FFD7 CALL edi 055 1004025 83F8FF CMP eax, 0FFFFFFFFh 056 1004028 7407 JE L7 057 100402A 50 L6: PUSH eax 058 100402B FF151C110001 CALL FindClose 059 1004031 8B4DFC L7: MOV ecx, dword ptr [ebp - 0x4] 060 1004034 5F POP edi 061 1004035 8BC6 MOV eax, esi 062 1004037 5E POP esi 063 1004038 5B POP ebx 064 1004039 E809310000 CALL proc_0x1007147 065 100403E C9 LEAVE 066 100403F C20800 RET 8 EndProc proc_0x1003f99 BeginProc proc_0x1004dcd 000 1004DCD 8BFF MOV edi, edi 001 1004DCF 55 PUSH ebp 002 1004DD0 8BEC MOV ebp, esp 003 1004DD2 56 PUSH esi 004 1004DD3 8B7508 MOV esi, dword ptr [ebp + 0x8] 005 1004DD6 56 PUSH esi 006 1004DD7 FF15E4100001 CALL lstrlenW 007 1004DDD 8D0C46 LEA ecx, dword ptr [esi + eax*0x2] 011 1004DE0 EB10 JMP L1 012 1004DE2 83FA5C L2: CMP edx, 5Ch 013 1004DE5 7413 JE L3 014 1004DE7 83FA3A CMP edx, 3Ah 015 1004DEA 740E JE L3 016 1004DEC 3BCE CMP ecx, esi 017 1004DEE 760A JBE L3 018 1004DF0 49 DEC ecx 019 1004DF1 49 DEC ecx 020 1004DF2 0FB711 L1: MOVZX edx, dword ptr [ecx] 021 1004DF5 83FA2E CMP edx, 2Eh 022 1004DF8 75E8 JNE L2 023 1004DFA 6683392E L3: CMP word ptr [ecx], 2Eh 024 1004DFE 7416 JE L4 025 1004E00 83C005 ADD eax, 5 026 1004E03 3D04010000 CMP eax, 104h 027 1004E08 770C JA L4 028 1004E0A 68F4170001 PUSH 10017F4h 029 1004E0F 56 PUSH esi 030 1004E10 FF1518110001 CALL lstrcatW 031 1004E16 5E L4: POP esi 032 1004E17 5D POP ebp 033 1004E18 C20400 RET 4 EndProc proc_0x1004dcd BeginProc proc_0x1001f70 000 1001F70 8BFF MOV edi, edi 001 1001F72 55 PUSH ebp 002 1001F73 8BEC MOV ebp, esp 003 1001F75 837D1400 CMP dword ptr [ebp + 0x14], 0 004 1001F79 56 PUSH esi 005 1001F7A 8B35E4100001 MOV esi, dword ptr [0x10010e4] 006 1001F80 57 PUSH edi 007 1001F81 7409 JE L1 008 1001F83 FF7514 PUSH dword ptr [ebp + 0x14] 009 1001F86 FFD6 CALL esi 010 1001F88 8BF8 MOV edi, eax 011 1001F8A EB02 JMP L2 012 1001F8C 33FF L1: XOR edi, edi 013 1001F8E FF7510 L2: PUSH dword ptr [ebp + 0x10] 014 1001F91 FFD6 CALL esi 015 1001F93 03C7 ADD eax, edi 016 1001F95 8D440002 LEA eax, dword ptr [eax + eax + 0x2] 020 1001F99 50 PUSH eax 021 1001F9A 6A40 PUSH 40h 022 1001F9C FF15E0100001 CALL LocalAlloc 023 1001FA2 8BF0 MOV esi, eax 024 1001FA4 85F6 TEST esi, esi 025 1001FA6 7427 JE L3 026 1001FA8 56 PUSH esi 027 1001FA9 FF7514 PUSH dword ptr [ebp + 0x14] 028 1001FAC FF7510 PUSH dword ptr [ebp + 0x10] 029 1001FAF E84EFFFFFF CALL proc_0x1001f02 030 1001FB4 FF7518 PUSH dword ptr [ebp + 0x18] 031 1001FB7 FF750C PUSH dword ptr [ebp + 0xc] 032 1001FBA 56 PUSH esi 033 1001FBB FF7508 PUSH dword ptr [ebp + 0x8] 034 1001FBE FF1568120001 CALL MessageBoxW 035 1001FC4 56 PUSH esi 036 1001FC5 8BF8 MOV edi, eax 037 1001FC7 FF15DC100001 CALL LocalFree 038 1001FCD EB14 JMP L4 039 1001FCF FF7518 L3: PUSH dword ptr [ebp + 0x18] 040 1001FD2 FF750C PUSH dword ptr [ebp + 0xc] 041 1001FD5 FF7510 PUSH dword ptr [ebp + 0x10] 042 1001FD8 FF7508 PUSH dword ptr [ebp + 0x8] 043 1001FDB FF1568120001 CALL MessageBoxW 044 1001FE1 8BF8 MOV edi, eax 045 1001FE3 8BC7 L4: MOV eax, edi 046 1001FE5 5F POP edi 047 1001FE6 5E POP esi 048 1001FE7 5D POP ebp 049 1001FE8 C21400 RET 14h EndProc proc_0x1001f70 BeginProc proc_0x1001f02 000 1001F02 8BFF MOV edi, edi 001 1001F04 55 PUSH ebp 002 1001F05 8BEC MOV ebp, esp 003 1001F07 8B4D08 MOV ecx, dword ptr [ebp + 0x8] 004 1001F0A 8B4510 MOV eax, dword ptr [ebp + 0x10] 005 1001F0D 57 PUSH edi 006 1001F0E 6A02 PUSH 2 007 1001F10 5F POP edi 008 1001F11 EB12 JMP L1 009 1001F13 668B11 L2: MOV dx, word ptr [ecx] 010 1001F16 668910 MOV word ptr [eax], dx 011 1001F19 668B11 MOV dx, word ptr [ecx] 012 1001F1C 03C7 ADD eax, edi 013 1001F1E 03CF ADD ecx, edi 014 1001F20 6685D2 TEST dx, dx 015 1001F23 7416 JE L3 016 1001F25 668B11 L1: MOV dx, word ptr [ecx] 017 1001F28 663B1590AB0001 CMP dx, word ptr [0x100ab90] 018 1001F2F 75E2 JNE L2 019 1001F31 56 PUSH esi 020 1001F32 8B750C MOV esi, dword ptr [ebp + 0xc] 021 1001F35 85F6 TEST esi, esi 022 1001F37 7417 JE L4 023 1001F39 EB0D JMP L5 024 1001F3B 33C0 L3: XOR eax, eax 025 1001F3D EB27 JMP L6 026 1001F3F 668910 L7: MOV word ptr [eax], dx 027 1001F42 03C7 ADD eax, edi 028 1001F44 03F7 ADD esi, edi 029 1001F46 33D2 XOR edx, edx 030 1001F48 668B16 L5: MOV dx, word ptr [esi] 031 1001F4B 6685D2 TEST dx, dx 032 1001F4E 75EF JNE L7 033 1001F50 83C104 L4: ADD ecx, 4 034 1001F53 5E POP esi 035 1001F54 668B11 L8: MOV dx, word ptr [ecx] 036 1001F57 668910 MOV word ptr [eax], dx 037 1001F5A 03C7 ADD eax, edi 038 1001F5C 03CF ADD ecx, edi 039 1001F5E 6685D2 TEST dx, dx 040 1001F61 75F1 JNE L8 041 1001F63 33C0 XOR eax, eax 042 1001F65 40 INC eax 043 1001F66 5F L6: POP edi 044 1001F67 5D POP ebp 045 1001F68 C20C00 RET 0Ch EndProc proc_0x1001f02 BeginProc proc_0x1005179 000 1005179 6880020000 PUSH 280h 001 100517E 6800180001 PUSH 1001800h 002 1005183 E8E0230000 CALL _SEH_prolog 003 1005188 A104960001 MOV eax, dword ptr [0x1009604] 004 100518D 8945E4 MOV dword ptr [ebp - 0x1c], eax 005 1005190 8B7D08 MOV edi, dword ptr [ebp + 0x8] 006 1005193 89BDC0FDFFFF MOV dword ptr [ebp - 0x240], edi 007 1005199 33DB XOR ebx, ebx 008 100519B 899DCCFDFFFF MOV dword ptr [ebp - 0x234], ebx 009 10051A1 899DB0FDFFFF MOV dword ptr [ebp - 0x250], ebx 010 10051A7 899DC8FDFFFF MOV dword ptr [ebp - 0x238], ebx 011 10051AD 899DB8FDFFFF MOV dword ptr [ebp - 0x248], ebx 012 10051B3 899DD0FDFFFF MOV dword ptr [ebp - 0x230], ebx 013 10051B9 A180A40001 MOV eax, dword ptr [0x100a480] 014 10051BE 83F8FF CMP eax, 0FFFFFFFFh 015 10051C1 7506 JNE L1 016 10051C3 57 PUSH edi 017 10051C4 E9D7000000 JMP L2 018 10051C9 8D8D70FDFFFF L1: LEA ecx, dword ptr [ebp - 0x290] 019 10051CF 51 PUSH ecx 020 10051D0 50 PUSH eax 021 10051D1 FF15B0100001 CALL GetFileInformationByHandle 022 10051D7 8BB594FDFFFF MOV esi, dword ptr [ebp - 0x26c] 023 10051DD 89B5ACFDFFFF MOV dword ptr [ebp - 0x254], esi 024 10051E3 3BC3 CMP eax, ebx 025 10051E5 750B JNE L3 026 10051E7 57 PUSH edi 027 10051E8 E833FCFFFF CALL proc_0x1004e20 028 10051ED E9EF050000 JMP L4 029 10051F2 81FE00000040 L3: CMP esi, 40000000h 030 10051F8 0F83C9050000 JAE L5 031 10051FE 399D90FDFFFF CMP dword ptr [ebp - 0x270], ebx 032 1005204 0F85BD050000 JNE L5 033 100520A FF3584AB0001 PUSH dword ptr [0x100ab84] 034 1005210 FF158C110001 CALL SetCursor 035 1005216 3BF3 CMP esi, ebx 036 1005218 7444 JE L6 037 100521A 33FF XOR edi, edi 038 100521C 89BDC4FDFFFF MOV dword ptr [ebp - 0x23c], edi 039 1005222 53 PUSH ebx 040 1005223 56 PUSH esi 041 1005224 53 PUSH ebx 042 1005225 6A02 PUSH 2 043 1005227 53 PUSH ebx 044 1005228 FF3580A40001 PUSH dword ptr [0x100a480] 045 100522E FF15B4100001 CALL CreateFileMappingW 046 1005234 8985A4FDFFFF MOV dword ptr [ebp - 0x25c], eax 047 100523A 3BC3 CMP eax, ebx 048 100523C 7439 JE L7 049 100523E 56 PUSH esi 050 100523F 53 PUSH ebx 051 1005240 53 PUSH ebx 052 1005241 6A04 PUSH 4 053 1005243 50 PUSH eax 054 1005244 FF1568110001 CALL MapViewOfFile 055 100524A 8985C4FDFFFF MOV dword ptr [ebp - 0x23c], eax 056 1005250 FFB5A4FDFFFF PUSH dword ptr [ebp - 0x25c] 057 1005256 FF15F8100001 CALL CloseHandle 058 100525C EB13 JMP L8 059 100525E 8D85B4FDFFFF L6: LEA eax, dword ptr [ebp - 0x24c] 060 1005264 8985C4FDFFFF MOV dword ptr [ebp - 0x23c], eax 061 100526A 66899DB4FDFFFF MOV word ptr [ebp - 0x24c], bx 062 1005271 8BBDC4FDFFFF L8: MOV edi, dword ptr [ebp - 0x23c] 063 1005277 FF3580A40001 L7: PUSH dword ptr [0x100a480] 064 100527D FF15F8100001 CALL CloseHandle 065 1005283 830D80A40001FF OR dword ptr [0x100a480], 0FFFFFFFFh 066 100528A 3BFB CMP edi, ebx 067 100528C 751C JNE L9 068 100528E FF3588AB0001 PUSH dword ptr [0x100ab88] 069 1005294 FF158C110001 CALL SetCursor 070 100529A FFB5C0FDFFFF PUSH dword ptr [ebp - 0x240] 071 10052A0 E87BFBFFFF L2: CALL proc_0x1004e20 072 10052A5 E94A050000 JMP L10 073 10052AA 895DFC L9: MOV dword ptr [ebp - 0x4], ebx 074 10052AD 89BDBCFDFFFF MOV dword ptr [ebp - 0x244], edi 075 10052B3 8B450C MOV eax, dword ptr [ebp + 0xc] 076 10052B6 83F8FF CMP eax, 0FFFFFFFFh 077 10052B9 0F85B2010000 JNE L11 078 10052BF 0FB707 MOVZX eax, dword ptr [edi] 079 10052C2 3DEFBB0000 CMP eax, 0BBEFh 080 10052C7 743C JE L12 081 10052C9 3DFFFE0000 CMP eax, 0FEFFh 082 10052CE 7424 JE L13 083 10052D0 3DFEFF0000 CMP eax, 0FFFEh 084 10052D5 755B JNE L14 085 10052D7 C785C8FDFFFF01000000MOV dword ptr [ebp - 0x238], 1 086 10052E1 C785D4FDFFFF02000000MOV dword ptr [ebp - 0x22c], 2 087 10052EB 8BDE L15: MOV ebx, esi 088 10052ED D1EB SHR ebx, 1 089 10052EF E930020000 JMP L16 090 10052F4 33C0 L13: XOR eax, eax 091 10052F6 40 INC eax 092 10052F7 8985C8FDFFFF MOV dword ptr [ebp - 0x238], eax 093 10052FD 8985D4FDFFFF MOV dword ptr [ebp - 0x22c], eax 094 1005303 EBE6 JMP L15 095 1005332 56 L14: PUSH esi 096 1005333 57 PUSH edi 097 1005334 E8781D0000 CALL proc_0x10070b1 098 1005339 8985C8FDFFFF MOV dword ptr [ebp - 0x238], eax 099 100533F 3BC3 CMP eax, ebx 100 1005341 7413 JE L17 101 1005343 C785D4FDFFFF01000000MOV dword ptr [ebp - 0x22c], 1 102 100534D 8BDE MOV ebx, esi 103 100534F D1EB SHR ebx, 1 104 1005351 E9CF010000 JMP L18 105 1005356 56 L17: PUSH esi 106 1005357 57 PUSH edi 107 1005358 E8FC1C0000 CALL proc_0x1007059 108 100535D 8985A8FDFFFF MOV dword ptr [ebp - 0x258], eax 109 1005363 3BC3 CMP eax, ebx 110 1005365 0F8413010000 JE L19 111 100536B C785D4FDFFFF03000000MOV dword ptr [ebp - 0x22c], 3 112 1005375 C785D0FDFFFFE9FD0000MOV dword ptr [ebp - 0x230], 0FDE9h 113 100537F 8B9DD8FDFFFF L20: MOV ebx, dword ptr [ebp - 0x228] 114 1005385 33C0 L21: XOR eax, eax 115 1005387 3985C8FDFFFF CMP dword ptr [ebp - 0x238], eax 116 100538D 7520 JNE L22 117 100538F 50 PUSH eax 118 1005390 50 PUSH eax 119 1005391 56 PUSH esi 120 1005392 FFB5BCFDFFFF PUSH dword ptr [ebp - 0x244] 121 1005398 50 PUSH eax 122 1005399 FFB5D0FDFFFF PUSH dword ptr [ebp - 0x230] 123 100539F FF1564110001 CALL MultiByteToWideChar 124 10053A5 8BD8 MOV ebx, eax 125 10053A7 899DD8FDFFFF MOV dword ptr [ebp - 0x228], ebx 126 10053AD 33C0 XOR eax, eax 127 10053AF 50 L22: PUSH eax 128 10053B0 50 PUSH eax 129 10053B1 6A0B PUSH 0Bh 130 10053B3 FF3538980001 PUSH dword ptr [0x1009838] 131 10053B9 8B3540120001 MOV esi, dword ptr [0x1001240] 132 10053BF FFD6 CALL esi 133 10053C1 6A00 PUSH 0 134 10053C3 6A00 PUSH 0 135 10053C5 68B1000000 PUSH 0B1h 136 10053CA FF3538980001 PUSH dword ptr [0x1009838] 137 10053D0 FFD6 CALL esi 138 10053D2 6A00 PUSH 0 139 10053D4 6A00 PUSH 0 140 10053D6 68B7000000 PUSH 0B7h 141 10053DB FF3538980001 PUSH dword ptr [0x1009838] 142 10053E1 FFD6 CALL esi 143 10053E3 6A02 PUSH 2 144 10053E5 8D441B02 LEA eax, dword ptr [ebx + ebx + 0x2] 148 10053E9 50 PUSH eax 149 10053EA FF358CAB0001 PUSH dword ptr [0x100ab8c] 150 10053F0 FF1548110001 CALL LocalReAlloc 151 10053F6 8985B8FDFFFF MOV dword ptr [ebp - 0x248], eax 152 10053FC 85C0 TEST eax, eax 153 10053FE 0F852C010000 JNE L23 154 1005404 FFB5C0FDFFFF PUSH dword ptr [ebp - 0x240] 155 100540A 8D85DCFDFFFF LEA eax, dword ptr [ebp - 0x224] 156 1005410 50 PUSH eax 157 1005411 FF15FC100001 CALL lstrcpyW 158 1005417 33DB XOR ebx, ebx 159 1005419 53 PUSH ebx 160 100541A E8E0F8FFFF CALL proc_0x1004cff 161 100541F FF3588AB0001 PUSH dword ptr [0x100ab88] 162 1005425 FF158C110001 CALL SetCursor 163 100542B 6A30 PUSH 30h 164 100542D 8D85DCFDFFFF LEA eax, dword ptr [ebp - 0x224] 165 1005433 50 PUSH eax 166 1005434 FF3550900001 PUSH dword ptr [0x1009050] 167 100543A FF3554900001 PUSH dword ptr [0x1009054] 168 1005440 FF3530980001 PUSH dword ptr [0x1009830] 169 1005446 E825CBFFFF CALL proc_0x1001f70 170 100544B 8D85B4FDFFFF LEA eax, dword ptr [ebp - 0x24c] 171 1005451 3BF8 CMP edi, eax 172 1005453 7407 JE L24 173 1005455 57 PUSH edi 174 1005456 FF1560110001 CALL UnmapViewOfFile 175 100545C 53 L24: PUSH ebx 176 100545D 53 PUSH ebx 177 100545E 6A0B PUSH 0Bh 178 1005460 FF3538980001 PUSH dword ptr [0x1009838] 179 1005466 FFD6 CALL esi 180 1005468 834DFCFF OR dword ptr [ebp - 0x4], 0FFFFFFFFh 181 100546C E983030000 JMP L10 182 1005471 48 L11: DEC eax 183 1005472 0F8488000000 JE L25 184 1005478 48 DEC eax 185 1005479 7465 JE L26 186 100547B 48 DEC eax 187 100547C 7411 JE L27 188 100547E 899DD4FDFFFF L19: MOV dword ptr [ebp - 0x22c], ebx 189 1005484 899DD0FDFFFF MOV dword ptr [ebp - 0x230], ebx 190 100548A E9F0FEFFFF JMP L20 191 100548F C785A8FDFFFF010L27:0MOV dword ptr [ebp - 0x258], 1 192 1005499 C785D0FDFFFFE9FD0000MOV dword ptr [ebp - 0x230], 0FDE9h 193 10054A3 6A03 PUSH 3 194 10054A5 58 POP eax 195 10054A6 8985D4FDFFFF MOV dword ptr [ebp - 0x22c], eax 196 10054AC 83FE02 CMP esi, 2 197 10054AF 0F86CAFEFFFF JBE L20 198 10054B5 66813FEFBB CMP word ptr [edi], 0BBEFh 199 10054BA 0F85BFFEFFFF JNE L20 200 10054C0 807F02BF CMP byte ptr [edi + 0x2], 0BFh 201 10054C4 0F85B5FEFFFF JNE L20 202 10054CA 8D4F03 L28: LEA ecx, dword ptr [edi + 0x3] 205 10054CD 898DBCFDFFFF MOV dword ptr [ebp - 0x244], ecx 206 10054D3 2BF0 SUB esi, eax 207 10054D5 89B5ACFDFFFF MOV dword ptr [ebp - 0x254], esi 208 10054DB E99FFEFFFF JMP L20 209 10054E0 33C0 L26: XOR eax, eax 210 10054E2 40 INC eax 211 10054E3 8985C8FDFFFF MOV dword ptr [ebp - 0x238], eax 212 10054E9 8985D4FDFFFF MOV dword ptr [ebp - 0x22c], eax 213 10054EF 8BDE MOV ebx, esi 214 10054F1 D1EB SHR ebx, 1 215 10054F3 899DD8FDFFFF MOV dword ptr [ebp - 0x228], ebx 216 10054F9 66813FFEFF CMP word ptr [edi], 0FFFEh 217 10054FE EB1E JMP L29 218 1005500 33C0 L25: XOR eax, eax 219 1005502 40 INC eax 220 1005503 8985C8FDFFFF MOV dword ptr [ebp - 0x238], eax 221 1005509 8985D4FDFFFF MOV dword ptr [ebp - 0x22c], eax 222 100550F 8BDE MOV ebx, esi 223 1005511 D1EB SHR ebx, 1 224 1005513 899DD8FDFFFF MOV dword ptr [ebp - 0x228], ebx 225 1005519 66813FFFFE CMP word ptr [edi], 0FEFFh 226 100551E 0F8561FEFFFF L29: JNE L21 227 1005524 4B L16: DEC ebx 228 1005525 899DD8FDFFFF L18: MOV dword ptr [ebp - 0x228], ebx 229 100552B E955FEFFFF JMP L21 230 1005530 50 L23: PUSH eax 231 1005531 FF15F0100001 CALL LocalLock 232 1005537 8985CCFDFFFF MOV dword ptr [ebp - 0x234], eax 233 100553D 83BDC8FDFFFF00 CMP dword ptr [ebp - 0x238], 0 234 1005544 7446 JE L30 235 1005546 668B0F MOV cx, word ptr [edi] 236 1005549 6681F9FFFE CMP cx, 0FEFFh 237 100554E 7505 JNE L31 238 1005550 8D7702 LEA esi, dword ptr [edi + 0x2] 241 1005553 EB16 JMP L32 242 1005555 6681F9FEFF L31: CMP cx, 0FFFEh 243 100555A 750D JNE L33 244 100555C 53 PUSH ebx 245 100555D 8D4F02 LEA ecx, dword ptr [edi + 0x2] 248 1005560 51 PUSH ecx 249 1005561 50 PUSH eax 250 1005562 E8FEF5FFFF CALL proc_0x1004b65 251 1005567 EB47 JMP L34 252 1005569 8BF7 L33: MOV esi, edi 253 100556B 8D0C1B L32: LEA ecx, dword ptr [ebx + ebx] 256 100556E 8BF8 MOV edi, eax 257 1005570 8BC1 MOV eax, ecx 258 1005572 C1E902 SHR ecx, 2 259 1005575 F3A5 REP MOVSD 260 1005577 8BC8 MOV ecx, eax 261 1005579 83E103 AND ecx, 3 262 100557C F3A4 REP MOVSB 263 100557E 8BBDC4FDFFFF MOV edi, dword ptr [ebp - 0x23c] 264 1005584 8B3540120001 MOV esi, dword ptr [0x1001240] 265 100558A EB24 JMP L34 266 100558C 53 L30: PUSH ebx 267 100558D 50 PUSH eax 268 100558E FFB5ACFDFFFF PUSH dword ptr [ebp - 0x254] 269 1005594 FFB5BCFDFFFF PUSH dword ptr [ebp - 0x244] 270 100559A 6A00 PUSH 0 271 100559C FFB5D0FDFFFF PUSH dword ptr [ebp - 0x230] 272 10055A2 FF1564110001 CALL MultiByteToWideChar 273 10055A8 8BD8 MOV ebx, eax 274 10055AA 899DD8FDFFFF MOV dword ptr [ebp - 0x228], ebx 275 10055B0 8B85CCFDFFFF L34: MOV eax, dword ptr [ebp - 0x234] 276 10055B6 8B8DD4FDFFFF MOV ecx, dword ptr [ebp - 0x22c] 277 10055BC 890D30900001 MOV dword ptr [0x1009030], ecx 278 10055C2 834DFCFF OR dword ptr [ebp - 0x4], 0FFFFFFFFh 279 10055C6 EB3E JMP L35 280 10055C8 33C0 XOR eax, eax 281 10055CA 40 INC eax 282 10055CB C3 RET 283 10055CC 8B65E8 MOV esp, dword ptr [ebp - 0x18] 284 10055CF 6A30 PUSH 30h 285 10055D1 FFB5C0FDFFFF PUSH dword ptr [ebp - 0x240] 286 10055D7 FF3534900001 PUSH dword ptr [0x1009034] 287 10055DD FF3554900001 PUSH dword ptr [0x1009054] 288 10055E3 FF3530980001 PUSH dword ptr [0x1009830] 289 10055E9 E882C9FFFF CALL proc_0x1001f70 290 10055EE 33DB XOR ebx, ebx 291 10055F0 834DFCFF OR dword ptr [ebp - 0x4], 0FFFFFFFFh 292 10055F4 8BBDC4FDFFFF MOV edi, dword ptr [ebp - 0x23c] 293 10055FA 8B3540120001 MOV esi, dword ptr [0x1001240] 294 1005600 8B85CCFDFFFF MOV eax, dword ptr [ebp - 0x234] 295 1005606 8D8DB4FDFFFF L35: LEA ecx, dword ptr [ebp - 0x24c] 296 100560C 3BF9 CMP edi, ecx 297 100560E 740D JE L36 298 1005610 57 PUSH edi 299 1005611 FF1560110001 CALL UnmapViewOfFile 300 1005617 8B85CCFDFFFF MOV eax, dword ptr [ebp - 0x234] 301 100561D 33FF L36: XOR edi, edi 302 100561F 3BC7 CMP eax, edi 303 1005621 7452 JE L37 304 1005623 8BC8 MOV ecx, eax 305 1005625 3BDF CMP ebx, edi 306 1005627 7611 JBE L38 307 1005629 8BD3 MOV edx, ebx 308 100562B 663939 L39: CMP word ptr [ecx], di 309 100562E 7505 JNE L40 310 1005630 66C7012000 MOV word ptr [ecx], 20h 311 1005635 41 L40: INC ecx 312 1005636 41 INC ecx 313 1005637 4A DEC edx 314 1005638 75F1 JNE L39 315 100563A 66893C58 L38: MOV word ptr [eax + ebx*0x2], di 316 100563E 668B08 MOV cx, word ptr [eax] 317 1005641 40 INC eax 318 1005642 40 INC eax 319 1005643 6683F92E CMP cx, 2Eh 320 1005647 7526 JNE L41 321 1005649 668B08 MOV cx, word ptr [eax] 322 100564C 40 INC eax 323 100564D 40 INC eax 324 100564E 6683F94C CMP cx, 4Ch 325 1005652 751B JNE L41 326 1005654 668B08 MOV cx, word ptr [eax] 327 1005657 40 INC eax 328 1005658 40 INC eax 329 1005659 6683F94F CMP cx, 4Fh 330 100565D 7510 JNE L41 331 100565F 66833847 CMP word ptr [eax], 47h 332 1005663 C785B0FDFFFF01000000MOV dword ptr [ebp - 0x250], 1 333 100566D 7406 JE L37 334 100566F 89BDB0FDFFFF L41: MOV dword ptr [ebp - 0x250], edi 335 1005675 39BDB8FDFFFF L37: CMP dword ptr [ebp - 0x248], edi 336 100567B 7417 JE L42 337 100567D FFB5B8FDFFFF PUSH dword ptr [ebp - 0x248] 338 1005683 FF15E8100001 CALL LocalUnlock 339 1005689 8B85B8FDFFFF MOV eax, dword ptr [ebp - 0x248] 340 100568F A38CAB0001 MOV dword ptr [0x100ab8c], eax 341 1005694 FFB5C0FDFFFF L42: PUSH dword ptr [ebp - 0x240] 342 100569A 6800A90001 PUSH 100A900h 343 100569F FF15FC100001 CALL lstrcpyW 344 10056A5 FFB5C0FDFFFF PUSH dword ptr [ebp - 0x240] 345 10056AB E8A5D3FFFF CALL proc_0x1002a55 346 10056B0 893D1C900001 MOV dword ptr [0x100901c], edi 347 10056B6 C7054898000101000000MOV dword ptr [0x1009848], 1 348 10056C0 57 PUSH edi 349 10056C1 FF358CAB0001 PUSH dword ptr [0x100ab8c] 350 10056C7 68BC000000 PUSH 0BCh 351 10056CC FF3538980001 PUSH dword ptr [0x1009838] 352 10056D2 FFD6 CALL esi 353 10056D4 833D4898000102 CMP dword ptr [0x1009848], 2 354 10056DB 7549 JNE L43 355 10056DD FF3588AB0001 PUSH dword ptr [0x100ab88] 356 10056E3 FF158C110001 CALL SetCursor 357 10056E9 893D48980001 MOV dword ptr [0x1009848], edi 358 10056EF 6A30 PUSH 30h 359 10056F1 FFB5C0FDFFFF PUSH dword ptr [ebp - 0x240] 360 10056F7 FF3550900001 PUSH dword ptr [0x1009050] 361 10056FD FF3554900001 PUSH dword ptr [0x1009054] 362 1005703 FF3530980001 PUSH dword ptr [0x1009830] 363 1005709 E862C8FFFF CALL proc_0x1001f70 364 100570E 57 PUSH edi 365 100570F E8EBF5FFFF CALL proc_0x1004cff 366 1005714 57 PUSH edi 367 1005715 6A01 PUSH 1 368 1005717 6A0B PUSH 0Bh 369 1005719 FF3538980001 PUSH dword ptr [0x1009838] 370 100571F FFD6 CALL esi 371 1005721 E9CE000000 JMP L10 372 1005726 893D48980001 L43: MOV dword ptr [0x1009848], edi 373 100572C 57 PUSH edi 374 100572D 57 PUSH edi 375 100572E 68C5000000 PUSH 0C5h 376 1005733 FF3538980001 PUSH dword ptr [0x1009838] 377 1005739 FF15A4120001 CALL PostMessageW 378 100573F 39BDB0FDFFFF CMP dword ptr [ebp - 0x250], edi 379 1005745 7425 JE L44 380 1005747 53 PUSH ebx 381 1005748 53 PUSH ebx 382 1005749 68B1000000 PUSH 0B1h 383 100574E FF3538980001 PUSH dword ptr [0x1009838] 384 1005754 FFD6 CALL esi 385 1005756 57 PUSH edi 386 1005757 57 PUSH edi 387 1005758 68B7000000 PUSH 0B7h 388 100575D FF3538980001 PUSH dword ptr [0x1009838] 389 1005763 FFD6 CALL esi 390 1005765 6A01 PUSH 1 391 1005767 E8A4170000 CALL proc_0x1006f10 392 100576C 33DB L44: XOR ebx, ebx 393 100576E 43 INC ebx 394 100576F 53 PUSH ebx 395 1005770 57 PUSH edi 396 1005771 68BE000000 PUSH 0BEh 397 1005776 6815010000 PUSH 115h 398 100577B FF3538980001 PUSH dword ptr [0x1009838] 399 1005781 FFD6 CALL esi 400 1005783 50 PUSH eax 401 1005784 53 PUSH ebx 402 1005785 FF3530980001 PUSH dword ptr [0x1009830] 403 100578B FF1500120001 CALL SetScrollPos 404 1005791 57 PUSH edi 405 1005792 53 PUSH ebx 406 1005793 6A0B PUSH 0Bh 407 1005795 FF3538980001 PUSH dword ptr [0x1009838] 408 100579B FFD6 CALL esi 409 100579D 53 PUSH ebx 410 100579E 57 PUSH edi 411 100579F FF3538980001 PUSH dword ptr [0x1009838] 412 10057A5 FF1524120001 CALL InvalidateRect 413 10057AB FF3538980001 PUSH dword ptr [0x1009838] 414 10057B1 FF15FC110001 CALL UpdateWindow 415 10057B7 FF3588AB0001 PUSH dword ptr [0x100ab88] 416 10057BD FF158C110001 CALL SetCursor 417 10057C3 8BC3 MOV eax, ebx 418 10057C5 EB2F JMP L45 419 10057C7 6A30 L5: PUSH 30h 420 10057C9 57 PUSH edi 421 10057CA FF3550900001 PUSH dword ptr [0x1009050] 422 10057D0 FF3554900001 PUSH dword ptr [0x1009054] 423 10057D6 FF3530980001 PUSH dword ptr [0x1009830] 424 10057DC E88FC7FFFF CALL proc_0x1001f70 425 10057E1 FF3580A40001 L4: PUSH dword ptr [0x100a480] 426 10057E7 FF15F8100001 CALL CloseHandle 427 10057ED 830D80A40001FF OR dword ptr [0x100a480], 0FFFFFFFFh 428 10057F4 33C0 L10: XOR eax, eax 429 10057F6 8B4DE4 L45: MOV ecx, dword ptr [ebp - 0x1c] 430 10057F9 E849190000 CALL proc_0x1007147 431 10057FE E8A01D0000 CALL _SEH_epilog 432 1005803 C20800 RET 8 433 1005305 83FE02 L12: CMP esi, 2 434 1005308 7628 JBE L14 435 100530A 807F02BF CMP byte ptr [edi + 0x2], 0BFh 436 100530E 7522 JNE L14 437 1005310 C785A8FDFFFF01000000MOV dword ptr [ebp - 0x258], 1 438 100531A C785D0FDFFFFE9FD0000MOV dword ptr [ebp - 0x230], 0FDE9h 439 1005324 6A03 PUSH 3 440 1005326 58 POP eax 441 1005327 8985D4FDFFFF MOV dword ptr [ebp - 0x22c], eax 442 100532D E998010000 JMP L28 EndProc proc_0x1005179 BeginProc proc_0x1004e20 000 1004E20 8BFF MOV edi, edi 001 1004E22 55 PUSH ebp 002 1004E23 8BEC MOV ebp, esp 003 1004E25 81EC04020000 SUB esp, 204h 004 1004E2B A104960001 MOV eax, dword ptr [0x1009604] 005 1004E30 56 PUSH esi 006 1004E31 8B7508 MOV esi, dword ptr [ebp + 0x8] 007 1004E34 6A00 PUSH 0 008 1004E36 8945FC MOV dword ptr [ebp - 0x4], eax 009 1004E39 6800010000 PUSH 100h 010 1004E3E 8D85FCFDFFFF LEA eax, dword ptr [ebp - 0x204] 011 1004E44 50 PUSH eax 012 1004E45 FF1550110001 CALL GetUserDefaultUILanguage 013 1004E4B 0FB7C0 MOVZX eax, eax 014 1004E4E 50 PUSH eax 015 1004E4F FF1538110001 CALL GetLastError 016 1004E55 50 PUSH eax 017 1004E56 6A00 PUSH 0 018 1004E58 6800120000 PUSH 1200h 019 1004E5D FF154C110001 CALL FormatMessageW 020 1004E63 85C0 TEST eax, eax 021 1004E65 6A30 PUSH 30h 022 1004E67 741B JE L1 023 1004E69 FF3554900001 PUSH dword ptr [0x1009054] 024 1004E6F 8D85FCFDFFFF LEA eax, dword ptr [ebp - 0x204] 025 1004E75 50 PUSH eax 026 1004E76 FF3530980001 PUSH dword ptr [0x1009830] 027 1004E7C FF1568120001 CALL MessageBoxW 028 1004E82 EB18 JMP L2 029 1004E84 56 L1: PUSH esi 030 1004E85 FF3534900001 PUSH dword ptr [0x1009034] 031 1004E8B FF3554900001 PUSH dword ptr [0x1009054] 032 1004E91 FF3530980001 PUSH dword ptr [0x1009830] 033 1004E97 E8D4D0FFFF CALL proc_0x1001f70 034 1004E9C 8B4DFC L2: MOV ecx, dword ptr [ebp - 0x4] 035 1004E9F 5E POP esi 036 1004EA0 E8A2220000 CALL proc_0x1007147 037 1004EA5 C9 LEAVE 038 1004EA6 C20400 RET 4 EndProc proc_0x1004e20 BeginProc proc_0x10070b1 000 10070B1 8BFF MOV edi, edi 001 10070B3 55 PUSH ebp 002 10070B4 8BEC MOV ebp, esp 003 10070B6 51 PUSH ecx 004 10070B7 834DFCFF OR dword ptr [ebp - 0x4], 0FFFFFFFFh 005 10070BB 8D45FC LEA eax, dword ptr [ebp - 0x4] 006 10070BE 50 PUSH eax 007 10070BF FF750C PUSH dword ptr [ebp + 0xc] 008 10070C2 FF7508 PUSH dword ptr [ebp + 0x8] 009 10070C5 FF150C100001 CALL IsTextUnicode 010 10070CB C9 LEAVE 011 10070CC C20800 RET 8 EndProc proc_0x10070b1 BeginProc proc_0x1007059 000 1007059 8BFF MOV edi, edi 001 100705B 55 PUSH ebp 002 100705C 8BEC MOV ebp, esp 003 100705E 56 PUSH esi 004 100705F 33F6 XOR esi, esi 005 1007061 33C9 XOR ecx, ecx 006 1007063 46 INC esi 007 1007064 33D2 XOR edx, edx 008 1007066 394D0C CMP dword ptr [ebp + 0xc], ecx 009 1007069 7E35 JLE L1 010 100706B 8B4508 L2: MOV eax, dword ptr [ebp + 0x8] 011 100706E 8A0401 MOV al, byte ptr [ecx + eax] 012 1007071 84C0 TEST al, al 013 1007073 7902 JNS L3 014 1007075 33F6 XOR esi, esi 015 1007077 85D2 L3: TEST edx, edx 016 1007079 7510 JNE L4 017 100707B 3C80 CMP al, 80h 018 100707D 7213 JB L5 019 100707F D0E0 L6: SHL al, 1 020 1007081 42 INC edx 021 1007082 84C0 TEST al, al 022 1007084 78F9 JS L6 023 1007086 4A DEC edx 024 1007087 7417 JE L1 025 1007089 EB07 JMP L5 026 100708B 24C0 L4: AND al, 0C0h 027 100708D 3C80 CMP al, 80h 028 100708F 750F JNE L1 029 1007091 4A DEC edx 030 1007092 41 L5: INC ecx 031 1007093 3B4D0C CMP ecx, dword ptr [ebp + 0xc] 032 1007096 7CD3 JL L2 033 1007098 85D2 TEST edx, edx 034 100709A 7704 JA L1 035 100709C 85F6 TEST esi, esi 036 100709E 7404 JE L7 037 10070A0 33C0 L1: XOR eax, eax 038 10070A2 EB03 JMP L8 039 10070A4 33C0 L7: XOR eax, eax 040 10070A6 40 INC eax 041 10070A7 5E L8: POP esi 042 10070A8 5D POP ebp 043 10070A9 C20800 RET 8 EndProc proc_0x1007059 BeginProc proc_0x1004cff 000 1004CFF 8BFF MOV edi, edi 001 1004D01 55 PUSH ebp 002 1004D02 8BEC MOV ebp, esp 003 1004D04 53 PUSH ebx 004 1004D05 33DB XOR ebx, ebx 005 1004D07 395D08 CMP dword ptr [ebp + 0x8], ebx 006 1004D0A 740E JE L1 007 1004D0C 53 PUSH ebx 008 1004D0D E8FDD9FFFF CALL proc_0x100270f 009 1004D12 85C0 TEST eax, eax 010 1004D14 0F84A9000000 JE L2 011 1004D1A 56 L1: PUSH esi 012 1004D1B 8B3540120001 MOV esi, dword ptr [0x1001240] 013 1004D21 57 PUSH edi 014 1004D22 6894130001 PUSH 1001394h 015 1004D27 53 PUSH ebx 016 1004D28 6A0C PUSH 0Ch 017 1004D2A FF3538980001 PUSH dword ptr [0x1009838] 018 1004D30 FFD6 CALL esi 019 1004D32 FF3540900001 PUSH dword ptr [0x1009040] 020 1004D38 BF00A90001 MOV edi, 100A900h 021 1004D3D 57 PUSH edi 022 1004D3E C7051C90000101000000MOV dword ptr [0x100901c], 1 023 1004D48 FF15FC100001 CALL lstrcpyW 024 1004D4E 57 PUSH edi 025 1004D4F E801DDFFFF CALL proc_0x1002a55 026 1004D54 53 PUSH ebx 027 1004D55 53 PUSH ebx 028 1004D56 68B1000000 PUSH 0B1h 029 1004D5B FF3538980001 PUSH dword ptr [0x1009838] 030 1004D61 FFD6 CALL esi 031 1004D63 53 PUSH ebx 032 1004D64 53 PUSH ebx 033 1004D65 68B7000000 PUSH 0B7h 034 1004D6A FF3538980001 PUSH dword ptr [0x1009838] 035 1004D70 FFD6 CALL esi 036 1004D72 6A02 PUSH 2 037 1004D74 6A02 PUSH 2 038 1004D76 FF358CAB0001 PUSH dword ptr [0x100ab8c] 039 1004D7C FF1548110001 CALL LocalReAlloc 040 1004D82 3BC3 CMP eax, ebx 041 1004D84 7405 JE L3 042 1004D86 A38CAB0001 MOV dword ptr [0x100ab8c], eax 043 1004D8B FF358CAB0001 L3: PUSH dword ptr [0x100ab8c] 044 1004D91 FF15F0100001 CALL LocalLock 045 1004D97 668918 MOV word ptr [eax], bx 046 1004D9A FF358CAB0001 PUSH dword ptr [0x100ab8c] 047 1004DA0 FF15E8100001 CALL LocalUnlock 048 1004DA6 53 PUSH ebx 049 1004DA7 FF358CAB0001 PUSH dword ptr [0x100ab8c] 050 1004DAD 68BC000000 PUSH 0BCh 051 1004DB2 FF3538980001 PUSH dword ptr [0x1009838] 052 1004DB8 FFD6 CALL esi 053 1004DBA 5F POP edi 054 1004DBB 66891D00A80001 MOV word ptr [0x100a800], bx 055 1004DC2 5E POP esi 056 1004DC3 5B L2: POP ebx 057 1004DC4 5D POP ebp 058 1004DC5 C20400 RET 4 EndProc proc_0x1004cff BeginProc proc_0x100270f 000 100270F 8BFF MOV edi, edi 001 1002711 55 PUSH ebp 002 1002712 8BEC MOV ebp, esp 003 1002714 81EC10020000 SUB esp, 210h 004 100271A A104960001 MOV eax, dword ptr [0x1009604] 005 100271F 53 PUSH ebx 006 1002720 56 PUSH esi 007 1002721 57 PUSH edi 008 1002722 8945FC MOV dword ptr [ebp - 0x4], eax 009 1002725 33DB XOR ebx, ebx 010 1002727 33C0 XOR eax, eax 011 1002729 66899DF4FDFFFF MOV word ptr [ebp - 0x20c], bx 012 1002730 B981000000 MOV ecx, 81h 013 1002735 8DBDF6FDFFFF LEA edi, dword ptr [ebp - 0x20a] 014 100273B F3AB REP STOSD 015 100273D 33F6 XOR esi, esi 016 100273F 46 INC esi 017 1002740 391D1C900001 CMP dword ptr [0x100901c], ebx 018 1002746 66AB STOSD 019 1002748 8B3D40120001 MOV edi, dword ptr [0x1001240] 020 100274E 89B5F0FDFFFF MOV dword ptr [ebp - 0x210], esi 021 1002754 7414 JE L1 022 1002756 53 PUSH ebx 023 1002757 53 PUSH ebx 024 1002758 6A0E PUSH 0Eh 025 100275A FF3538980001 PUSH dword ptr [0x1009838] 026 1002760 FFD7 CALL edi 027 1002762 85C0 TEST eax, eax 028 1002764 0F849C000000 JE L2 029 100276A 53 L1: PUSH ebx 030 100276B 53 PUSH ebx 031 100276C 68B8000000 PUSH 0B8h 032 1002771 FF3538980001 PUSH dword ptr [0x1009838] 033 1002777 FFD7 CALL edi 034 1002779 85C0 TEST eax, eax 035 100277B 0F847D010000 JE L3 036 1002781 391D1C900001 CMP dword ptr [0x100901c], ebx 037 1002787 A140900001 MOV eax, dword ptr [0x1009040] 038 100278C BF00A90001 MOV edi, 100A900h 039 1002791 7502 JNE L4 040 1002793 8BC7 MOV eax, edi 041 1002795 8B4D08 L4: MOV ecx, dword ptr [ebp + 0x8] 042 1002798 F7D9 NEG ecx 043 100279A 1BC9 SBB ecx, ecx 044 100279C 81E100100000 AND ecx, 1000h 045 10027A2 0FB7C9 MOVZX ecx, ecx 046 10027A5 83C933 OR ecx, 33h 047 10027A8 51 PUSH ecx 048 10027A9 50 PUSH eax 049 10027AA FF353C900001 PUSH dword ptr [0x100903c] 050 10027B0 893554980001 MOV dword ptr [0x1009854], esi 051 10027B6 FF3554900001 PUSH dword ptr [0x1009054] 052 10027BC FF3530980001 PUSH dword ptr [0x1009830] 053 10027C2 E8A9F7FFFF CALL proc_0x1001f70 054 10027C7 83F806 CMP eax, 6 055 10027CA 8985F0FDFFFF MOV dword ptr [ebp - 0x210], eax 056 10027D0 891D54980001 MOV dword ptr [0x1009854], ebx 057 10027D6 0F8522010000 JNE L3 058 10027DC 391D1C900001 CMP dword ptr [0x100901c], ebx 059 10027E2 7407 JE L5 060 10027E4 68CC130001 PUSH 10013CCh 061 10027E9 EB23 JMP L6 062 10027EB A130900001 L5: MOV eax, dword ptr [0x1009030] 063 10027F0 53 PUSH ebx 064 10027F1 57 PUSH edi 065 10027F2 FF3530980001 PUSH dword ptr [0x1009830] 066 10027F8 A328A50001 MOV dword ptr [0x100a528], eax 067 10027FD E8AC260000 CALL proc_0x1004eae 068 1002802 85C0 TEST eax, eax 069 1002804 7407 JE L7 070 1002806 8BC6 L2: MOV eax, esi 071 1002808 E9FD000000 JMP L8 072 100280D 57 L7: PUSH edi 073 100280E 8D85F4FDFFFF L6: LEA eax, dword ptr [ebp - 0x20c] 074 1002814 50 PUSH eax 075 1002815 FF15FC100001 CALL lstrcpyW 076 100281B 8B3DE4120001 MOV edi, dword ptr [0x10012e4] 077 1002821 BB80A60001 MOV ebx, 100A680h 078 1002826 EB40 JMP L9 079 1002828 FF359CA60001 L10: PUSH dword ptr [0x100a69c] 080 100282E 8D85F4FDFFFF LEA eax, dword ptr [ebp - 0x20c] 081 1002834 50 PUSH eax 082 1002835 FF15FC100001 CALL lstrcpyW 083 100283B 56 PUSH esi 084 100283C 8D85F4FDFFFF LEA eax, dword ptr [ebp - 0x20c] 085 1002842 50 PUSH eax 086 1002843 FF3530980001 PUSH dword ptr [0x1009830] 087 1002849 E860260000 CALL proc_0x1004eae 088 100284E 85C0 TEST eax, eax 089 1002850 8D85F4FDFFFF LEA eax, dword ptr [ebp - 0x20c] 090 1002856 0F85BD000000 JNE L11 091 100285C 6800A90001 PUSH 100A900h 092 1002861 50 PUSH eax 093 1002862 FF15FC100001 CALL lstrcpyW 094 1002868 8D85F4FDFFFF L9: LEA eax, dword ptr [ebp - 0x20c] 095 100286E A39CA60001 MOV dword ptr [0x100a69c], eax 096 1002873 A190900001 MOV eax, dword ptr [0x1009090] 097 1002878 53 PUSH ebx 098 1002879 893554980001 MOV dword ptr [0x1009854], esi 099 100287F 893598A60001 MOV dword ptr [0x100a698], esi 100 1002885 C705BCA60001C4130001MOV dword ptr [0x100a6bc], 10013C4h 101 100288F C7058CA6000140A50001MOV dword ptr [0x100a68c], 100A540h 102 1002899 C705C4A60001281A0001MOV dword ptr [0x100a6c4], 1001A28h 103 10028A3 C705C8A60001A0130001MOV dword ptr [0x100a6c8], 10013A0h 104 10028AD C705B4A6000166888800MOV dword ptr [0x100a6b4], 888866h 105 10028B7 A3B0A60001 MOV dword ptr [0x100a6b0], eax 106 10028BC FFD7 CALL edi 107 10028BE 85C0 TEST eax, eax 108 10028C0 0F8562FFFFFF JNE L10 109 10028C6 C785F0FDFFFF02000000MOV dword ptr [ebp - 0x210], 2 110 10028D0 FF15E0120001 CALL CommDlgExtendedError 111 10028D6 85C0 TEST eax, eax 112 10028D8 741D JE L12 113 10028DA 6810100000 PUSH 1010h 114 10028DF FF3554900001 PUSH dword ptr [0x1009054] 115 10028E5 FF354C900001 PUSH dword ptr [0x100904c] 116 10028EB FF3530980001 PUSH dword ptr [0x1009830] 117 10028F1 FF1568120001 CALL MessageBoxW 118 10028F7 83255498000100 L12: AND dword ptr [0x1009854], 0 119 10028FE 33C0 L3: XOR eax, eax 120 1002900 83BDF0FDFFFF02 CMP dword ptr [ebp - 0x210], 2 121 1002907 0F95C0 SETNE al 122 100290A 8B4DFC L8: MOV ecx, dword ptr [ebp - 0x4] 123 100290D 5F POP edi 124 100290E 5E POP esi 125 100290F 5B POP ebx 126 1002910 E832480000 CALL proc_0x1007147 127 1002915 C9 LEAVE 128 1002916 C20400 RET 4 129 1002919 50 L11: PUSH eax 130 100291A 6800A90001 PUSH 100A900h 131 100291F FF15FC100001 CALL lstrcpyW 132 1002925 A128A50001 MOV eax, dword ptr [0x100a528] 133 100292A A330900001 MOV dword ptr [0x1009030], eax 134 100292F EBC6 JMP L12 EndProc proc_0x100270f BeginProc proc_0x1004eae 000 1004EAE 8BFF MOV edi, edi 001 1004EB0 55 PUSH ebp 002 1004EB1 8BEC MOV ebp, esp 003 1004EB3 83EC14 SUB esp, 14h 004 1004EB6 56 PUSH esi 005 1004EB7 33F6 XOR esi, esi 006 1004EB9 397510 CMP dword ptr [ebp + 0x10], esi 007 1004EBC 56 PUSH esi 008 1004EBD 6880000000 PUSH 80h 009 1004EC2 6A04 PUSH 4 010 1004EC4 8975F0 MOV dword ptr [ebp - 0x10], esi 011 1004EC7 56 PUSH esi 012 1004EC8 7504 JNE L1 013 1004ECA 6A01 PUSH 1 014 1004ECC EB02 JMP L2 015 1004ECE 6A03 L1: PUSH 3 016 1004ED0 68000000C0 L2: PUSH 0C0000000h 017 1004ED5 FF750C PUSH dword ptr [ebp + 0xc] 018 1004ED8 FF1504110001 CALL CreateFileW 019 1004EDE 83F8FF CMP eax, 0FFFFFFFFh 020 1004EE1 A380A40001 MOV dword ptr [0x100a480], eax 021 1004EE6 741C JE L3 022 1004EE8 FF1538110001 CALL GetLastError 023 1004EEE 33C9 XOR ecx, ecx 024 1004EF0 3DB7000000 CMP eax, 0B7h 025 1004EF5 0F95C1 SETNE cl 026 1004EF8 833D80A40001FF CMP dword ptr [0x100a480], 0FFFFFFFFh 027 1004EFF 894DEC MOV dword ptr [ebp - 0x14], ecx 028 1004F02 7520 JNE L4 029 1004F04 6A30 L3: PUSH 30h 030 1004F06 FF750C PUSH dword ptr [ebp + 0xc] 031 1004F09 FF3568900001 PUSH dword ptr [0x1009068] 032 1004F0F FF3554900001 PUSH dword ptr [0x1009054] 033 1004F15 FF7508 PUSH dword ptr [ebp + 0x8] 034 1004F18 E853D0FFFF CALL proc_0x1001f70 035 1004F1D 33C0 XOR eax, eax 036 1004F1F E9DA010000 JMP L5 037 1004F24 393550980001 L4: CMP dword ptr [0x1009850], esi 038 1004F2A 7405 JE L6 039 1004F2C E818FDFFFF CALL proc_0x1004c49 040 1004F31 53 L6: PUSH ebx 041 1004F32 57 PUSH edi 042 1004F33 8B3D40120001 MOV edi, dword ptr [0x1001240] 043 1004F39 56 PUSH esi 044 1004F3A 56 PUSH esi 045 1004F3B 6A0E PUSH 0Eh 046 1004F3D FF3538980001 PUSH dword ptr [0x1009838] 047 1004F43 FFD7 CALL edi 048 1004F45 56 PUSH esi 049 1004F46 56 PUSH esi 050 1004F47 68BD000000 PUSH 0BDh 051 1004F4C FF3538980001 PUSH dword ptr [0x1009838] 052 1004F52 8BD8 MOV ebx, eax 053 1004F54 FFD7 CALL edi 054 1004F56 3BC6 CMP eax, esi 055 1004F58 8945F4 MOV dword ptr [ebp - 0xc], eax 056 1004F5B 0F8449010000 JE L7 057 1004F61 50 PUSH eax 058 1004F62 FF15F0100001 CALL LocalLock 059 1004F68 3BC6 CMP eax, esi 060 1004F6A 894510 MOV dword ptr [ebp + 0x10], eax 061 1004F6D 0F8437010000 JE L7 062 1004F73 A128A50001 MOV eax, dword ptr [0x100a528] 063 1004F78 48 DEC eax 064 1004F79 0F84EB000000 JE L8 065 1004F7F 48 DEC eax 066 1004F80 0F849A000000 JE L9 067 1004F86 48 DEC eax 068 1004F87 7518 JNE L10 069 1004F89 56 PUSH esi 070 1004F8A 8D45FC LEA eax, dword ptr [ebp - 0x4] 071 1004F8D 50 PUSH eax 072 1004F8E 6A03 PUSH 3 073 1004F90 68E0910001 PUSH 10091E0h 074 1004F95 FF3580A40001 PUSH dword ptr [0x100a480] 075 1004F9B FF153C110001 CALL WriteFile 076 1004FA1 833D28A5000103 L10: CMP dword ptr [0x100a528], 3 077 1004FA8 7413 JE L11 078 1004FAA FF155C110001 CALL GetACP 079 1004FB0 8945F8 MOV dword ptr [ebp - 0x8], eax 080 1004FB3 8D45F0 LEA eax, dword ptr [ebp - 0x10] 081 1004FB6 BF00040000 MOV edi, 400h 082 1004FBB EB0B JMP L12 083 1004FBD 33C0 L11: XOR eax, eax 084 1004FBF C745F8E9FD0000 MOV dword ptr [ebp - 0x8], 0FDE9h 085 1004FC6 33FF XOR edi, edi 086 1004FC8 50 L12: PUSH eax 087 1004FC9 56 PUSH esi 088 1004FCA 56 PUSH esi 089 1004FCB 56 PUSH esi 090 1004FCC 53 PUSH ebx 091 1004FCD FF7510 PUSH dword ptr [ebp + 0x10] 092 1004FD0 57 PUSH edi 093 1004FD1 FF75F8 PUSH dword ptr [ebp - 0x8] 094 1004FD4 FF1544110001 CALL WideCharToMultiByte 095 1004FDA 3975F0 CMP dword ptr [ebp - 0x10], esi 096 1004FDD 7508 JNE L13 097 1004FDF 3BDE CMP ebx, esi 098 1004FE1 7428 JE L14 099 1004FE3 3BC6 CMP eax, esi 100 1004FE5 7524 JNE L14 101 1004FE7 6A31 L13: PUSH 31h 102 1004FE9 FF750C PUSH dword ptr [ebp + 0xc] 103 1004FEC FF35A0900001 PUSH dword ptr [0x10090a0] 104 1004FF2 FF3554900001 PUSH dword ptr [0x1009054] 105 1004FF8 FF7508 PUSH dword ptr [ebp + 0x8] 106 1004FFB E870CFFFFF CALL proc_0x1001f70 107 1005000 83F802 CMP eax, 2 108 1005003 0F84A9000000 JE L15 109 1005009 33FF XOR edi, edi 110 100500B 53 L14: PUSH ebx 111 100500C FF7510 PUSH dword ptr [ebp + 0x10] 112 100500F 57 PUSH edi 113 1005010 FF75F8 PUSH dword ptr [ebp - 0x8] 114 1005013 FF3580A40001 PUSH dword ptr [0x100a480] 115 1005019 E87BFBFFFF CALL proc_0x1004b99 116 100501E EB78 JMP L16 117 1005020 8B3D3C110001 L9: MOV edi, dword ptr [0x100113c] 118 1005026 56 PUSH esi 119 1005027 8D45FC LEA eax, dword ptr [ebp - 0x4] 120 100502A 50 PUSH eax 121 100502B 6A02 PUSH 2 122 100502D 68E8910001 PUSH 10091E8h 123 1005032 FF3580A40001 PUSH dword ptr [0x100a480] 124 1005038 FFD7 CALL edi 125 100503A 53 PUSH ebx 126 100503B FF7510 PUSH dword ptr [ebp + 0x10] 127 100503E FF7510 PUSH dword ptr [ebp + 0x10] 128 1005041 E81FFBFFFF CALL proc_0x1004b65 129 1005046 56 PUSH esi 130 1005047 8D45FC LEA eax, dword ptr [ebp - 0x4] 131 100504A 50 PUSH eax 132 100504B 8D041B LEA eax, dword ptr [ebx + ebx] 135 100504E 50 PUSH eax 136 100504F FF7510 PUSH dword ptr [ebp + 0x10] 137 1005052 FF3580A40001 PUSH dword ptr [0x100a480] 138 1005058 FFD7 CALL edi 139 100505A 53 PUSH ebx 140 100505B FF7510 PUSH dword ptr [ebp + 0x10] 141 100505E 8BF8 MOV edi, eax 142 1005060 FF7510 PUSH dword ptr [ebp + 0x10] 143 1005063 E8FDFAFFFF CALL proc_0x1004b65 144 1005068 EB30 JMP L17 145 100506A 8B3D3C110001 L8: MOV edi, dword ptr [0x100113c] 146 1005070 56 PUSH esi 147 1005071 8D45FC LEA eax, dword ptr [ebp - 0x4] 148 1005074 50 PUSH eax 149 1005075 6A02 PUSH 2 150 1005077 68E4910001 PUSH 10091E4h 151 100507C FF3580A40001 PUSH dword ptr [0x100a480] 152 1005082 FFD7 CALL edi 153 1005084 56 PUSH esi 154 1005085 8D45FC LEA eax, dword ptr [ebp - 0x4] 155 1005088 50 PUSH eax 156 1005089 8D041B LEA eax, dword ptr [ebx + ebx] 159 100508C 50 PUSH eax 160 100508D FF7510 PUSH dword ptr [ebp + 0x10] 161 1005090 FF3580A40001 PUSH dword ptr [0x100a480] 162 1005096 FFD7 CALL edi 163 1005098 8BF8 L16: MOV edi, eax 164 100509A 3BFE L17: CMP edi, esi 165 100509C 7565 JNE L18 166 100509E FF3588AB0001 PUSH dword ptr [0x100ab88] 167 10050A4 FF158C110001 CALL SetCursor 168 10050AA FF750C L7: PUSH dword ptr [ebp + 0xc] 169 10050AD E86EFDFFFF CALL proc_0x1004e20 170 10050B2 FF3588AB0001 L15: PUSH dword ptr [0x100ab88] 171 10050B8 FF158C110001 CALL SetCursor 172 10050BE FF3580A40001 PUSH dword ptr [0x100a480] 173 10050C4 FF15F8100001 CALL CloseHandle 174 10050CA 830D80A40001FF OR dword ptr [0x100a480], 0FFFFFFFFh 175 10050D1 3975F4 CMP dword ptr [ebp - 0xc], esi 176 10050D4 7409 JE L19 177 10050D6 FF75F4 PUSH dword ptr [ebp - 0xc] 178 10050D9 FF15E8100001 CALL LocalUnlock 179 10050DF 3975EC L19: CMP dword ptr [ebp - 0x14], esi 180 10050E2 7409 JE L20 181 10050E4 FF750C PUSH dword ptr [ebp + 0xc] 182 10050E7 FF1558110001 CALL DeleteFileW 183 10050ED 393550980001 L20: CMP dword ptr [0x1009850], esi 184 10050F3 7405 JE L21 185 10050F5 E8B1FBFFFF CALL proc_0x1004cab 186 10050FA 33C0 L21: XOR eax, eax 187 10050FC 5F L22: POP edi 188 10050FD 5B POP ebx 189 10050FE 5E L5: POP esi 190 10050FF C9 LEAVE 191 1005100 C20C00 RET 0Ch 192 1005103 FF3580A40001 L18: PUSH dword ptr [0x100a480] 193 1005109 FF1554110001 CALL SetEndOfFile 194 100510F A128A50001 MOV eax, dword ptr [0x100a528] 195 1005114 56 PUSH esi 196 1005115 56 PUSH esi 197 1005116 68B9000000 PUSH 0B9h 198 100511B FF3538980001 PUSH dword ptr [0x1009838] 199 1005121 A330900001 MOV dword ptr [0x1009030], eax 200 1005126 FF1540120001 CALL SendMessageW 201 100512C FF750C PUSH dword ptr [ebp + 0xc] 202 100512F E821D9FFFF CALL proc_0x1002a55 203 1005134 FF3580A40001 PUSH dword ptr [0x100a480] 204 100513A 89351C900001 MOV dword ptr [0x100901c], esi 205 1005140 FF15F8100001 CALL CloseHandle 206 1005146 FF75F4 PUSH dword ptr [ebp - 0xc] 207 1005149 830D80A40001FF OR dword ptr [0x100a480], 0FFFFFFFFh 208 1005150 FF15E8100001 CALL LocalUnlock 209 1005156 393550980001 CMP dword ptr [0x1009850], esi 210 100515C 7405 JE L23 211 100515E E848FBFFFF CALL proc_0x1004cab 212 1005163 FF3588AB0001 L23: PUSH dword ptr [0x100ab88] 213 1005169 FF158C110001 CALL SetCursor 214 100516F 33C0 XOR eax, eax 215 1005171 40 INC eax 216 1005172 EB88 JMP L22 EndProc proc_0x1004eae BeginProc proc_0x1004c49 000 1004C49 8BFF MOV edi, edi 001 1004C4B 57 PUSH edi 002 1004C4C 33FF XOR edi, edi 003 1004C4E 393D50980001 CMP dword ptr [0x1009850], edi 004 1004C54 744E JE L1 005 1004C56 393D58980001 CMP dword ptr [0x1009858], edi 006 1004C5C 56 PUSH esi 007 1004C5D 8B3540120001 MOV esi, dword ptr [0x1001240] 008 1004C63 7409 JE L2 009 1004C65 6A01 PUSH 1 010 1004C67 E82DCFFFFF CALL proc_0x1001b99 011 1004C6C EB26 JMP L3 012 1004C6E 68889A0001 L2: PUSH 1009A88h 013 1004C73 688C9A0001 PUSH 1009A8Ch 014 1004C78 68B0000000 PUSH 0B0h 015 1004C7D FF3538980001 PUSH dword ptr [0x1009838] 016 1004C83 FFD6 CALL esi 017 1004C85 57 PUSH edi 018 1004C86 57 PUSH edi 019 1004C87 68B1000000 PUSH 0B1h 020 1004C8C FF3538980001 PUSH dword ptr [0x1009838] 021 1004C92 FFD6 CALL esi 022 1004C94 57 L3: PUSH edi 023 1004C95 57 PUSH edi 024 1004C96 68C8000000 PUSH 0C8h 025 1004C9B FF3538980001 PUSH dword ptr [0x1009838] 026 1004CA1 FFD6 CALL esi 027 1004CA3 5E POP esi 028 1004CA4 5F L1: POP edi 029 1004CA5 C3 RET EndProc proc_0x1004c49 BeginProc proc_0x1001b99 000 1001B99 8BFF MOV edi, edi 001 1001B9B 55 PUSH ebp 002 1001B9C 8BEC MOV ebp, esp 003 1001B9E 8B4508 MOV eax, dword ptr [ebp + 0x8] 004 1001BA1 56 PUSH esi 005 1001BA2 8B3540120001 MOV esi, dword ptr [0x1001240] 006 1001BA8 6A00 PUSH 0 007 1001BAA 48 DEC eax 008 1001BAB 50 PUSH eax 009 1001BAC 68BB000000 PUSH 0BBh 010 1001BB1 FF3538980001 PUSH dword ptr [0x1009838] 011 1001BB7 FFD6 CALL esi 012 1001BB9 83F8FF CMP eax, 0FFFFFFFFh 013 1001BBC 7420 JE L1 014 1001BBE 50 PUSH eax 015 1001BBF 50 PUSH eax 016 1001BC0 68B1000000 PUSH 0B1h 017 1001BC5 FF3538980001 PUSH dword ptr [0x1009838] 018 1001BCB FFD6 CALL esi 019 1001BCD 6A00 PUSH 0 020 1001BCF 6A00 PUSH 0 021 1001BD1 68B7000000 PUSH 0B7h 022 1001BD6 FF3538980001 PUSH dword ptr [0x1009838] 023 1001BDC FFD6 CALL esi 024 1001BDE 5E L1: POP esi 025 1001BDF 5D POP ebp 026 1001BE0 C20400 RET 4 EndProc proc_0x1001b99 BeginProc proc_0x1004b99 000 1004B99 8BFF MOV edi, edi 001 1004B9B 55 PUSH ebp 002 1004B9C 8BEC MOV ebp, esp 003 1004B9E 83EC10 SUB esp, 10h 004 1004BA1 53 PUSH ebx 005 1004BA2 33DB XOR ebx, ebx 006 1004BA4 395D18 CMP dword ptr [ebp + 0x18], ebx 007 1004BA7 7508 JNE L1 008 1004BA9 33C0 XOR eax, eax 009 1004BAB 40 INC eax 010 1004BAC E98E000000 JMP L2 011 1004BB1 817D0CE9FD0000 L1: CMP dword ptr [ebp + 0xc], 0FDE9h 012 1004BB8 895DFC MOV dword ptr [ebp - 0x4], ebx 013 1004BBB 7406 JE L3 014 1004BBD 8D45F4 LEA eax, dword ptr [ebp - 0xc] 015 1004BC0 8945FC MOV dword ptr [ebp - 0x4], eax 016 1004BC3 56 L3: PUSH esi 017 1004BC4 8B3544110001 MOV esi, dword ptr [0x1001144] 018 1004BCA 57 PUSH edi 019 1004BCB FF75FC PUSH dword ptr [ebp - 0x4] 020 1004BCE 53 PUSH ebx 021 1004BCF 53 PUSH ebx 022 1004BD0 53 PUSH ebx 023 1004BD1 FF7518 PUSH dword ptr [ebp + 0x18] 024 1004BD4 FF7514 PUSH dword ptr [ebp + 0x14] 025 1004BD7 FF7510 PUSH dword ptr [ebp + 0x10] 026 1004BDA FF750C PUSH dword ptr [ebp + 0xc] 027 1004BDD FFD6 CALL esi 028 1004BDF 8BF8 MOV edi, eax 029 1004BE1 3BFB CMP edi, ebx 030 1004BE3 741B JE L4 031 1004BE5 8D4701 LEA eax, dword ptr [edi + 0x1] 034 1004BE8 50 PUSH eax 035 1004BE9 6A40 PUSH 40h 036 1004BEB FF15E0100001 CALL LocalAlloc 037 1004BF1 3BC3 CMP eax, ebx 038 1004BF3 8945F8 MOV dword ptr [ebp - 0x8], eax 039 1004BF6 750C JNE L5 040 1004BF8 6A08 PUSH 8 041 1004BFA FF1540110001 CALL SetLastError 042 1004C00 33C0 L4: XOR eax, eax 043 1004C02 EB39 JMP L6 044 1004C04 FF75FC L5: PUSH dword ptr [ebp - 0x4] 045 1004C07 53 PUSH ebx 046 1004C08 57 PUSH edi 047 1004C09 50 PUSH eax 048 1004C0A FF7518 PUSH dword ptr [ebp + 0x18] 049 1004C0D FF7514 PUSH dword ptr [ebp + 0x14] 050 1004C10 FF7510 PUSH dword ptr [ebp + 0x10] 051 1004C13 FF750C PUSH dword ptr [ebp + 0xc] 052 1004C16 FFD6 CALL esi 053 1004C18 8BF0 MOV esi, eax 054 1004C1A 3BF3 CMP esi, ebx 055 1004C1C 7414 JE L7 056 1004C1E 53 PUSH ebx 057 1004C1F 8D45F0 LEA eax, dword ptr [ebp - 0x10] 058 1004C22 50 PUSH eax 059 1004C23 57 PUSH edi 060 1004C24 FF75F8 PUSH dword ptr [ebp - 0x8] 061 1004C27 FF7508 PUSH dword ptr [ebp + 0x8] 062 1004C2A FF153C110001 CALL WriteFile 063 1004C30 8BF0 MOV esi, eax 064 1004C32 FF75F8 L7: PUSH dword ptr [ebp - 0x8] 065 1004C35 FF15DC100001 CALL LocalFree 066 1004C3B 8BC6 MOV eax, esi 067 1004C3D 5F L6: POP edi 068 1004C3E 5E POP esi 069 1004C3F 5B L2: POP ebx 070 1004C40 C9 LEAVE 071 1004C41 C21400 RET 14h EndProc proc_0x1004b99 BeginProc proc_0x1004b65 000 1004B65 8BFF MOV edi, edi 001 1004B67 55 PUSH ebp 002 1004B68 8BEC MOV ebp, esp 003 1004B6A 56 PUSH esi 004 1004B6B 8B7510 MOV esi, dword ptr [ebp + 0x10] 005 1004B6E 85F6 TEST esi, esi 006 1004B70 761D JBE L1 007 1004B72 8B450C MOV eax, dword ptr [ebp + 0xc] 008 1004B75 8B4D08 MOV ecx, dword ptr [ebp + 0x8] 009 1004B78 53 PUSH ebx 010 1004B79 660FB65001 L2: MOVZX dx, byte ptr [eax + 0x1] 011 1004B7E 33DB XOR ebx, ebx 012 1004B80 8A38 MOV bh, byte ptr [eax] 013 1004B82 33D3 XOR edx, ebx 014 1004B84 668911 MOV word ptr [ecx], dx 015 1004B87 41 INC ecx 016 1004B88 41 INC ecx 017 1004B89 40 INC eax 018 1004B8A 40 INC eax 019 1004B8B 4E DEC esi 020 1004B8C 75EB JNE L2 021 1004B8E 5B POP ebx 022 1004B8F 5E L1: POP esi 023 1004B90 5D POP ebp 024 1004B91 C20C00 RET 0Ch EndProc proc_0x1004b65 BeginProc proc_0x1004cab 000 1004CAB 33C0 XOR eax, eax 001 1004CAD 390550980001 CMP dword ptr [0x1009850], eax 002 1004CB3 7444 JE L1 003 1004CB5 390558980001 CMP dword ptr [0x1009858], eax 004 1004CBB 740B JE L2 005 1004CBD 6804012050 PUSH 50200104h 006 1004CC2 E87A0E0000 CALL proc_0x1005b41 007 1004CC7 C3 RET 008 1004CC8 56 L2: PUSH esi 009 1004CC9 8B3540120001 MOV esi, dword ptr [0x1001240] 010 1004CCF 50 PUSH eax 011 1004CD0 6A01 PUSH 1 012 1004CD2 68C8000000 PUSH 0C8h 013 1004CD7 FF3538980001 PUSH dword ptr [0x1009838] 014 1004CDD FFD6 CALL esi 015 1004CDF FF35889A0001 PUSH dword ptr [0x1009a88] 016 1004CE5 FF358C9A0001 PUSH dword ptr [0x1009a8c] 017 1004CEB 68B1000000 PUSH 0B1h 018 1004CF0 FF3538980001 PUSH dword ptr [0x1009838] 019 1004CF6 FFD6 CALL esi 020 1004CF8 5E POP esi 021 1004CF9 C3 L1: RET EndProc proc_0x1004cab BeginProc proc_0x1005b41 000 1005B41 8BFF MOV edi, edi 001 1005B43 55 PUSH ebp 002 1005B44 8BEC MOV ebp, esp 003 1005B46 83EC38 SUB esp, 38h 004 1005B49 53 PUSH ebx 005 1005B4A 8B1D8C110001 MOV ebx, dword ptr [0x100118c] 006 1005B50 56 PUSH esi 007 1005B51 8B7508 MOV esi, dword ptr [ebp + 0x8] 008 1005B54 57 PUSH edi 009 1005B55 FF3584AB0001 PUSH dword ptr [0x100ab84] 010 1005B5B C1EE14 SHR esi, 14h 011 1005B5E 83E601 AND esi, 1 012 1005B61 8975F4 MOV dword ptr [ebp - 0xc], esi 013 1005B64 FFD3 CALL ebx 014 1005B66 33FF XOR edi, edi 015 1005B68 3BF7 CMP esi, edi 016 1005B6A 8B3540120001 MOV esi, dword ptr [0x1001240] 017 1005B70 8945F8 MOV dword ptr [ebp - 0x8], eax 018 1005B73 7416 JE L1 019 1005B75 6A01 PUSH 1 020 1005B77 E81DC0FFFF CALL proc_0x1001b99 021 1005B7C 57 PUSH edi 022 1005B7D 57 PUSH edi 023 1005B7E 68C8000000 PUSH 0C8h 024 1005B83 FF3538980001 PUSH dword ptr [0x1009838] 025 1005B89 FFD6 CALL esi 026 1005B8B 57 L1: PUSH edi 027 1005B8C 57 PUSH edi 028 1005B8D 68B8000000 PUSH 0B8h 029 1005B92 FF3538980001 PUSH dword ptr [0x1009838] 030 1005B98 FFD6 CALL esi 031 1005B9A 57 PUSH edi 032 1005B9B F7D8 NEG eax 033 1005B9D 57 PUSH edi 034 1005B9E 1BC0 SBB eax, eax 035 1005BA0 6A0E PUSH 0Eh 036 1005BA2 FF3538980001 PUSH dword ptr [0x1009838] 037 1005BA8 F7D8 NEG eax 038 1005BAA 8945E8 MOV dword ptr [ebp - 0x18], eax 039 1005BAD FFD6 CALL esi 040 1005BAF 8945F0 MOV dword ptr [ebp - 0x10], eax 041 1005BB2 8D440002 LEA eax, dword ptr [eax + eax + 0x2] 045 1005BB6 50 PUSH eax 046 1005BB7 6A02 PUSH 2 047 1005BB9 FF15E0100001 CALL LocalAlloc 048 1005BBF 3BC7 CMP eax, edi 049 1005BC1 8945FC MOV dword ptr [ebp - 0x4], eax 050 1005BC4 751F JNE L2 051 1005BC6 397DF4 CMP dword ptr [ebp - 0xc], edi 052 1005BC9 7410 JE L3 053 1005BCB 57 PUSH edi 054 1005BCC 6A01 PUSH 1 055 1005BCE 68C8000000 PUSH 0C8h 056 1005BD3 FF3538980001 PUSH dword ptr [0x1009838] 057 1005BD9 FFD6 CALL esi 058 1005BDB FF75F8 L3: PUSH dword ptr [ebp - 0x8] 059 1005BDE FFD3 CALL ebx 060 1005BE0 E9F0000000 JMP L4 061 1005BE5 8D45C8 L2: LEA eax, dword ptr [ebp - 0x38] 062 1005BE8 50 PUSH eax 063 1005BE9 FF3530980001 PUSH dword ptr [0x1009830] 064 1005BEF FF1588110001 CALL GetClientRect 065 1005BF5 FF75FC PUSH dword ptr [ebp - 0x4] 066 1005BF8 FF15F0100001 CALL LocalLock 067 1005BFE 50 PUSH eax 068 1005BFF 8945EC MOV dword ptr [ebp - 0x14], eax 069 1005C02 8B45F0 MOV eax, dword ptr [ebp - 0x10] 070 1005C05 40 INC eax 071 1005C06 50 PUSH eax 072 1005C07 6A0D PUSH 0Dh 073 1005C09 FF3538980001 PUSH dword ptr [0x1009838] 074 1005C0F FFD6 CALL esi 075 1005C11 57 PUSH edi 076 1005C12 FF3580AB0001 PUSH dword ptr [0x100ab80] 077 1005C18 6A0F PUSH 0Fh 078 1005C1A FF3530980001 PUSH dword ptr [0x1009830] 079 1005C20 FF75D4 PUSH dword ptr [ebp - 0x2c] 080 1005C23 FF75D0 PUSH dword ptr [ebp - 0x30] 081 1005C26 57 PUSH edi 082 1005C27 57 PUSH edi 083 1005C28 FF7508 PUSH dword ptr [ebp + 0x8] 084 1005C2B 6894130001 PUSH 1001394h 085 1005C30 6894170001 PUSH 1001794h 086 1005C35 6800020000 PUSH 200h 087 1005C3A FF15E0110001 CALL CreateWindowExW 088 1005C40 3BC7 CMP eax, edi 089 1005C42 894508 MOV dword ptr [ebp + 0x8], eax 090 1005C45 751C JNE L5 091 1005C47 FF75F8 PUSH dword ptr [ebp - 0x8] 092 1005C4A FFD3 CALL ebx 093 1005C4C 397DF4 CMP dword ptr [ebp - 0xc], edi 094 1005C4F 7472 JE L6 095 1005C51 57 PUSH edi 096 1005C52 6A01 PUSH 1 097 1005C54 68C8000000 PUSH 0C8h 098 1005C59 FF3538980001 PUSH dword ptr [0x1009838] 099 1005C5F FFD6 CALL esi 100 1005C61 EB60 JMP L6 101 1005C63 6AEC L5: PUSH 0FFFFFFECh 102 1005C65 FF3538980001 PUSH dword ptr [0x1009838] 103 1005C6B FF1570120001 CALL GetWindowLongW 104 1005C71 0D00020000 OR eax, 200h 105 1005C76 50 PUSH eax 106 1005C77 6AEC PUSH 0FFFFFFECh 107 1005C79 FF7508 PUSH dword ptr [ebp + 0x8] 108 1005C7C FF156C120001 CALL SetWindowLongW 109 1005C82 6A01 PUSH 1 110 1005C84 FF357CAB0001 PUSH dword ptr [0x100ab7c] 111 1005C8A 6A30 PUSH 30h 112 1005C8C FF7508 PUSH dword ptr [ebp + 0x8] 113 1005C8F FFD6 CALL esi 114 1005C91 FF75EC PUSH dword ptr [ebp - 0x14] 115 1005C94 57 PUSH edi 116 1005C95 6A0C PUSH 0Ch 117 1005C97 FF7508 PUSH dword ptr [ebp + 0x8] 118 1005C9A FFD6 CALL esi 119 1005C9C 85C0 TEST eax, eax 120 1005C9E 753C JNE L7 121 1005CA0 FF75F8 PUSH dword ptr [ebp - 0x8] 122 1005CA3 FFD3 CALL ebx 123 1005CA5 397DF4 CMP dword ptr [ebp - 0xc], edi 124 1005CA8 7410 JE L8 125 1005CAA 57 PUSH edi 126 1005CAB 6A01 PUSH 1 127 1005CAD 68C8000000 PUSH 0C8h 128 1005CB2 FF3538980001 PUSH dword ptr [0x1009838] 129 1005CB8 FFD6 CALL esi 130 1005CBA FF7508 L8: PUSH dword ptr [ebp + 0x8] 131 1005CBD FF15A8110001 CALL DestroyWindow 132 1005CC3 FF75FC L6: PUSH dword ptr [ebp - 0x4] 133 1005CC6 FF15E8100001 CALL LocalUnlock 134 1005CCC FF75FC PUSH dword ptr [ebp - 0x4] 135 1005CCF FF15DC100001 CALL LocalFree 136 1005CD5 33C0 L4: XOR eax, eax 137 1005CD7 E9BB000000 JMP L9 138 1005CDC FF75FC L7: PUSH dword ptr [ebp - 0x4] 139 1005CDF FF15E8100001 CALL LocalUnlock 140 1005CE5 FF3538980001 PUSH dword ptr [0x1009838] 141 1005CEB FF15A8110001 CALL DestroyWindow 142 1005CF1 8B4508 MOV eax, dword ptr [ebp + 0x8] 143 1005CF4 A338980001 MOV dword ptr [0x1009838], eax 144 1005CF9 A18CAB0001 MOV eax, dword ptr [0x100ab8c] 145 1005CFE 3BC7 CMP eax, edi 146 1005D00 7407 JE L10 147 1005D02 50 PUSH eax 148 1005D03 FF15DC100001 CALL LocalFree 149 1005D09 8B45FC L10: MOV eax, dword ptr [ebp - 0x4] 150 1005D0C 57 PUSH edi 151 1005D0D 57 PUSH edi 152 1005D0E 68C5000000 PUSH 0C5h 153 1005D13 FF3538980001 PUSH dword ptr [0x1009838] 154 1005D19 A38CAB0001 MOV dword ptr [0x100ab8c], eax 155 1005D1E FF15A4120001 CALL PostMessageW 156 1005D24 6A05 PUSH 5 157 1005D26 FF3530980001 PUSH dword ptr [0x1009830] 158 1005D2C FF15B0110001 CALL ShowWindow 159 1005D32 57 PUSH edi 160 1005D33 FF75E8 PUSH dword ptr [ebp - 0x18] 161 1005D36 68B9000000 PUSH 0B9h 162 1005D3B FF3538980001 PUSH dword ptr [0x1009838] 163 1005D41 FFD6 CALL esi 164 1005D43 FF3538980001 PUSH dword ptr [0x1009838] 165 1005D49 FF1578120001 CALL SetFocus 166 1005D4F FF75F8 PUSH dword ptr [ebp - 0x8] 167 1005D52 FFD3 CALL ebx 168 1005D54 393D40980001 CMP dword ptr [0x1009840], edi 169 1005D5A 7438 JE L11 170 1005D5C 8D45D8 LEA eax, dword ptr [ebp - 0x28] 171 1005D5F 50 PUSH eax 172 1005D60 FF3530980001 PUSH dword ptr [0x1009830] 173 1005D66 FF1588110001 CALL GetClientRect 174 1005D6C 8B45E4 MOV eax, dword ptr [ebp - 0x1c] 175 1005D6F 2B45DC SUB eax, dword ptr [ebp - 0x24] 176 1005D72 50 PUSH eax 177 1005D73 8B45E0 MOV eax, dword ptr [ebp - 0x20] 178 1005D76 2B45D8 SUB eax, dword ptr [ebp - 0x28] 179 1005D79 50 PUSH eax 180 1005D7A E861BCFFFF CALL proc_0x10019e0 181 1005D7F 6A01 PUSH 1 182 1005D81 E8BCBEFFFF CALL proc_0x1001c42 183 1005D86 6A05 PUSH 5 184 1005D88 FF3534980001 PUSH dword ptr [0x1009834] 185 1005D8E FF15B0110001 CALL ShowWindow 186 1005D94 33C0 L11: XOR eax, eax 187 1005D96 40 INC eax 188 1005D97 5F L9: POP edi 189 1005D98 5E POP esi 190 1005D99 5B POP ebx 191 1005D9A C9 LEAVE 192 1005D9B C20400 RET 4 EndProc proc_0x1005b41 BeginProc proc_0x10019e0 000 10019E0 8BFF MOV edi, edi 001 10019E2 55 PUSH ebp 002 10019E3 8BEC MOV ebp, esp 003 10019E5 6A01 PUSH 1 004 10019E7 6A00 PUSH 0 005 10019E9 FF3538980001 PUSH dword ptr [0x1009838] 006 10019EF FF1524120001 CALL InvalidateRect 007 10019F5 A140980001 MOV eax, dword ptr [0x1009840] 008 10019FA 8B4D0C MOV ecx, dword ptr [ebp + 0xc] 009 10019FD F7D8 NEG eax 010 10019FF 1BC0 SBB eax, eax 011 1001A01 2305E0A60001 AND eax, dword ptr [0x100a6e0] 012 1001A07 6A01 PUSH 1 013 1001A09 2BC8 SUB ecx, eax 014 1001A0B 51 PUSH ecx 015 1001A0C FF7508 PUSH dword ptr [ebp + 0x8] 016 1001A0F 6A00 PUSH 0 017 1001A11 6A00 PUSH 0 018 1001A13 FF3538980001 PUSH dword ptr [0x1009838] 019 1001A19 FF1520120001 CALL MoveWindow 020 1001A1F 5D POP ebp 021 1001A20 C20800 RET 8 EndProc proc_0x10019e0 BeginProc proc_0x1006f10 000 1006F10 8BFF MOV edi, edi 001 1006F12 55 PUSH ebp 002 1006F13 8BEC MOV ebp, esp 003 1006F15 81ECE8030000 SUB esp, 3E8h 004 1006F1B A104960001 MOV eax, dword ptr [0x1009604] 005 1006F20 53 PUSH ebx 006 1006F21 56 PUSH esi 007 1006F22 57 PUSH edi 008 1006F23 8945FC MOV dword ptr [ebp - 0x4], eax 009 1006F26 33DB XOR ebx, ebx 010 1006F28 66899D68FDFFFF MOV word ptr [ebp - 0x298], bx 011 1006F2F 33C0 XOR eax, eax 012 1006F31 B9A4000000 MOV ecx, 0A4h 013 1006F36 8DBD6AFDFFFF LEA edi, dword ptr [ebp - 0x296] 014 1006F3C F3AB REP STOSD 015 1006F3E 33F6 XOR esi, esi 016 1006F40 66AB STOSD 017 1006F42 46 INC esi 018 1006F43 8BFE MOV edi, esi 019 1006F45 FF159C100001 CALL GetUserDefaultLCID 020 1006F4B 25FF030000 AND eax, 3FFh 021 1006F50 663BC6 CMP ax, si 022 1006F53 7408 JE L1 023 1006F55 663D0D00 CMP ax, 0Dh 024 1006F59 7402 JE L1 025 1006F5B 33F6 XOR esi, esi 026 1006F5D 8D8518FCFFFF L1: LEA eax, dword ptr [ebp - 0x3e8] 027 1006F63 50 PUSH eax 028 1006F64 FF1598100001 CALL GetLocalTime 029 1006F6A 3BF3 CMP esi, ebx 030 1006F6C 8B3518110001 MOV esi, dword ptr [0x1001118] 031 1006F72 742E JE L2 032 1006F74 6AEC PUSH 0FFFFFFECh 033 1006F76 FF3538980001 PUSH dword ptr [0x1009838] 034 1006F7C FF1570120001 CALL GetWindowLongW 035 1006F82 F6C420 TEST ah, 20h 036 1006F85 8D8568FDFFFF LEA eax, dword ptr [ebp - 0x298] 037 1006F8B 740A JE L3 038 1006F8D 6A21 PUSH 21h 039 1006F8F 5F POP edi 040 1006F90 6844180001 PUSH 1001844h 041 1006F95 EB08 JMP L4 042 1006F97 6A11 L3: PUSH 11h 043 1006F99 5F POP edi 044 1006F9A 6840180001 PUSH 1001840h 045 1006F9F 50 L4: PUSH eax 046 1006FA0 FFD6 CALL esi 047 1006FA2 6A50 L2: PUSH 50h 048 1006FA4 8D8528FCFFFF LEA eax, dword ptr [ebp - 0x3d8] 049 1006FAA 50 PUSH eax 050 1006FAB 53 PUSH ebx 051 1006FAC 8D8518FCFFFF LEA eax, dword ptr [ebp - 0x3e8] 052 1006FB2 50 PUSH eax 053 1006FB3 57 PUSH edi 054 1006FB4 BF00040000 MOV edi, 400h 055 1006FB9 57 PUSH edi 056 1006FBA FF15A0100001 CALL GetDateFormatW 057 1006FC0 6A50 PUSH 50h 058 1006FC2 8D85C8FCFFFF LEA eax, dword ptr [ebp - 0x338] 059 1006FC8 50 PUSH eax 060 1006FC9 53 PUSH ebx 061 1006FCA 8D8518FCFFFF LEA eax, dword ptr [ebp - 0x3e8] 062 1006FD0 50 PUSH eax 063 1006FD1 6A02 PUSH 2 064 1006FD3 57 PUSH edi 065 1006FD4 FF15A4100001 CALL GetTimeFormatW 066 1006FDA 395D08 CMP dword ptr [ebp + 0x8], ebx 067 1006FDD BF38180001 MOV edi, 1001838h 068 1006FE2 740A JE L5 069 1006FE4 57 PUSH edi 070 1006FE5 8D8568FDFFFF LEA eax, dword ptr [ebp - 0x298] 071 1006FEB 50 PUSH eax 072 1006FEC FFD6 CALL esi 073 1006FEE 8D85C8FCFFFF L5: LEA eax, dword ptr [ebp - 0x338] 074 1006FF4 50 PUSH eax 075 1006FF5 8D8568FDFFFF LEA eax, dword ptr [ebp - 0x298] 076 1006FFB 50 PUSH eax 077 1006FFC FFD6 CALL esi 078 1006FFE 6834180001 PUSH 1001834h 079 1007003 8D8568FDFFFF LEA eax, dword ptr [ebp - 0x298] 080 1007009 50 PUSH eax 081 100700A FFD6 CALL esi 082 100700C 8D8528FCFFFF LEA eax, dword ptr [ebp - 0x3d8] 083 1007012 50 PUSH eax 084 1007013 8D8568FDFFFF LEA eax, dword ptr [ebp - 0x298] 085 1007019 50 PUSH eax 086 100701A FFD6 CALL esi 087 100701C 395D08 CMP dword ptr [ebp + 0x8], ebx 088 100701F 740A JE L6 089 1007021 57 PUSH edi 090 1007022 8D8568FDFFFF LEA eax, dword ptr [ebp - 0x298] 091 1007028 50 PUSH eax 092 1007029 FFD6 CALL esi 093 100702B 8D8568FDFFFF L6: LEA eax, dword ptr [ebp - 0x298] 094 1007031 50 PUSH eax 095 1007032 6A01 PUSH 1 096 1007034 68C2000000 PUSH 0C2h 097 1007039 FF3538980001 PUSH dword ptr [0x1009838] 098 100703F FF1540120001 CALL SendMessageW 099 1007045 8B4DFC MOV ecx, dword ptr [ebp - 0x4] 100 1007048 5F POP edi 101 1007049 5E POP esi 102 100704A 5B POP ebx 103 100704B E8F7000000 CALL proc_0x1007147 104 1007050 C9 LEAVE 105 1007051 C20400 RET 4 EndProc proc_0x1006f10 BeginProc proc_0x10042f9 000 10042F9 8BFF MOV edi, edi 001 10042FB 55 PUSH ebp 002 10042FC 8BEC MOV ebp, esp 003 10042FE 51 PUSH ecx 004 10042FF 56 PUSH esi 005 1004300 8B7508 MOV esi, dword ptr [ebp + 0x8] 006 1004303 57 PUSH edi 007 1004304 8BC6 MOV eax, esi 008 1004306 B974170001 MOV ecx, 1001774h 009 100430B C745FC01000000 MOV dword ptr [ebp - 0x4], 1 010 1004312 E835FCFFFF CALL proc_0x1003f4c 011 1004317 33FF XOR edi, edi 012 1004319 85C0 TEST eax, eax 013 100431B 750E JNE L1 014 100431D 83C606 ADD esi, 6 015 1004320 56 PUSH esi 016 1004321 E854FEFFFF CALL proc_0x100417a 017 1004326 897DFC MOV dword ptr [ebp - 0x4], edi 018 1004329 EB1D JMP L2 019 100432B 8BC6 L1: MOV eax, esi 020 100432D B96C170001 MOV ecx, 100176Ch 021 1004332 E815FCFFFF CALL proc_0x1003f4c 022 1004337 85C0 TEST eax, eax 023 1004339 0F850C010000 JNE L3 024 100433F 83C604 ADD esi, 4 025 1004342 56 PUSH esi 026 1004343 E832FEFFFF CALL proc_0x100417a 027 1004348 8BF0 L2: MOV esi, eax 028 100434A 66393E CMP word ptr [esi], di 029 100434D 0F84F8000000 JE L3 030 1004353 FF750C PUSH dword ptr [ebp + 0xc] 031 1004356 FF3530980001 PUSH dword ptr [0x1009830] 032 100435C FF15B0110001 CALL ShowWindow 033 1004362 56 PUSH esi 034 1004363 BE00A90001 MOV esi, 100A900h 035 1004368 56 PUSH esi 036 1004369 E82BFCFFFF CALL proc_0x1003f99 037 100436E 40 INC eax 038 100436F 40 INC eax 039 1004370 397DFC CMP dword ptr [ebp - 0x4], edi 040 1004373 754A JNE L4 041 1004375 663938 CMP word ptr [eax], di 042 1004378 0F84CD000000 JE L3 043 100437E 50 PUSH eax 044 100437F E8F6FDFFFF CALL proc_0x100417a 045 1004384 66833822 CMP word ptr [eax], 22h 046 1004388 0F85BD000000 JNE L3 047 100438E 40 INC eax 048 100438F 40 INC eax 049 1004390 33D2 XOR edx, edx 050 1004392 EB1B JMP L5 051 1004394 6683F922 L6: CMP cx, 22h 052 1004398 741D JE L7 053 100439A 81FAFF000000 CMP edx, 0FFh 054 10043A0 7315 JAE L7 055 10043A2 66890C5540A10001 MOV word ptr [edx*0x2 + 0x100a140], cx 056 10043AA 42 INC edx 057 10043AB 40 INC eax 058 10043AC 40 INC eax 059 10043AD 33C9 XOR ecx, ecx 060 10043AF 668B08 L5: MOV cx, word ptr [eax] 061 10043B2 663BCF CMP cx, di 062 10043B5 75DD JNE L6 063 10043B7 66893C5540A1000L7: MOV word ptr [edx*0x2 + 0x100a140], di 064 10043BF 57 L4: PUSH edi 065 10043C0 6880000000 PUSH 80h 066 10043C5 6A03 PUSH 3 067 10043C7 57 PUSH edi 068 10043C8 6A03 PUSH 3 069 10043CA 6800000080 PUSH 80000000h 070 10043CF 56 PUSH esi 071 10043D0 FF1504110001 CALL CreateFileW 072 10043D6 83F8FF CMP eax, 0FFFFFFFFh 073 10043D9 A380A40001 MOV dword ptr [0x100a480], eax 074 10043DE 754A JNE L8 075 10043E0 FF1538110001 CALL GetLastError 076 10043E6 48 DEC eax 077 10043E7 48 DEC eax 078 10043E8 7424 JE L9 079 10043EA 83E803 SUB eax, 3 080 10043ED 7418 JE L10 081 10043EF 83E83C SUB eax, 3Ch 082 10043F2 7413 JE L10 083 10043F4 83E83A SUB eax, 3Ah 084 10043F7 7407 JE L11 085 10043F9 A134900001 MOV eax, dword ptr [0x1009034] 086 10043FE EB13 JMP L12 087 1004400 A164900001 L11: MOV eax, dword ptr [0x1009064] 088 1004405 EB0C JMP L12 089 1004407 A19C900001 L10: MOV eax, dword ptr [0x100909c] 090 100440C EB05 JMP L12 091 100440E A138900001 L9: MOV eax, dword ptr [0x1009038] 092 1004413 6A30 L12: PUSH 30h 093 1004415 56 PUSH esi 094 1004416 50 PUSH eax 095 1004417 FF3554900001 PUSH dword ptr [0x1009054] 096 100441D FF3530980001 PUSH dword ptr [0x1009830] 097 1004423 E848DBFFFF CALL proc_0x1001f70 098 1004428 EB1C JMP L13 099 100442A FF35809A0001 L8: PUSH dword ptr [0x1009a80] 100 1004430 56 PUSH esi 101 1004431 E8430D0000 CALL proc_0x1005179 102 1004436 397DFC CMP dword ptr [ebp - 0x4], edi 103 1004439 7404 JE L14 104 100443B 6A01 PUSH 1 105 100443D EB02 JMP L15 106 100443F 6A02 L14: PUSH 2 107 1004441 E8052A0000 L15: CALL proc_0x1006e4b 108 1004446 33C0 L13: XOR eax, eax 109 1004448 40 INC eax 110 1004449 EB02 JMP L16 111 100444B 33C0 L3: XOR eax, eax 112 100444D 5F L16: POP edi 113 100444E 5E POP esi 114 100444F C9 LEAVE 115 1004450 C20800 RET 8 EndProc proc_0x10042f9 BeginProc proc_0x1006e4b 000 1006E4B 8BFF MOV edi, edi 001 1006E4D 55 PUSH ebp 002 1006E4E 8BEC MOV ebp, esp 003 1006E50 81EC24030000 SUB esp, 324h 004 1006E56 A104960001 MOV eax, dword ptr [0x1009604] 005 1006E5B 56 PUSH esi 006 1006E5C FF7508 PUSH dword ptr [ebp + 0x8] 007 1006E5F 8945FC MOV dword ptr [ebp - 0x4], eax 008 1006E62 E890FFFFFF CALL proc_0x1006df7 009 1006E67 8BF0 MOV esi, eax 010 1006E69 85F6 TEST esi, esi 011 1006E6B 0F848D000000 JE L1 012 1006E71 83FEFE CMP esi, 0FFFFFFFEh 013 1006E74 0F8484000000 JE L1 014 1006E7A 83FEFD CMP esi, 0FFFFFFFDh 015 1006E7D 747F JE L1 016 1006E7F 83FEFC CMP esi, 0FFFFFFFCh 017 1006E82 7503 JNE L2 018 1006E84 6A70 PUSH 70h 019 1006E86 5E POP esi 020 1006E87 83FEFB L2: CMP esi, 0FFFFFFFBh 021 1006E8A 7503 JNE L3 022 1006E8C 6A0E PUSH 0Eh 023 1006E8E 5E POP esi 024 1006E8F 83FEFF L3: CMP esi, 0FFFFFFFFh 025 1006E92 7508 JNE L4 026 1006E94 FF1538110001 CALL GetLastError 027 1006E9A 8BF0 MOV esi, eax 028 1006E9C 85F6 L4: TEST esi, esi 029 1006E9E 745E JE L1 030 1006EA0 6A00 PUSH 0 031 1006EA2 6890010000 PUSH 190h 032 1006EA7 8D85DCFCFFFF LEA eax, dword ptr [ebp - 0x324] 033 1006EAD 50 PUSH eax 034 1006EAE FF1550110001 CALL GetUserDefaultUILanguage 035 1006EB4 0FB7C0 MOVZX eax, eax 036 1006EB7 50 PUSH eax 037 1006EB8 56 PUSH esi 038 1006EB9 6A00 PUSH 0 039 1006EBB 6800120000 PUSH 1200h 040 1006EC0 FF154C110001 CALL FormatMessageW 041 1006EC6 85C0 TEST eax, eax 042 1006EC8 8B0D60900001 MOV ecx, dword ptr [0x1009060] 043 1006ECE 7406 JE L5 044 1006ED0 8D8DDCFCFFFF LEA ecx, dword ptr [ebp - 0x324] 045 1006ED6 833D1C90000100 L5: CMP dword ptr [0x100901c], 0 046 1006EDD A140900001 MOV eax, dword ptr [0x1009040] 047 1006EE2 7505 JNE L6 048 1006EE4 B800A90001 MOV eax, 100A900h 049 1006EE9 6A30 L6: PUSH 30h 050 1006EEB 50 PUSH eax 051 1006EEC 51 PUSH ecx 052 1006EED FF3554900001 PUSH dword ptr [0x1009054] 053 1006EF3 FF3530980001 PUSH dword ptr [0x1009830] 054 1006EF9 E872B0FFFF CALL proc_0x1001f70 055 1006EFE 8B4DFC L1: MOV ecx, dword ptr [ebp - 0x4] 056 1006F01 5E POP esi 057 1006F02 E840020000 CALL proc_0x1007147 058 1006F07 C9 LEAVE 059 1006F08 C20400 RET 4 EndProc proc_0x1006e4b BeginProc proc_0x1006df7 000 1006DF7 8BFF MOV edi, edi 001 1006DF9 55 PUSH ebp 002 1006DFA 8BEC MOV ebp, esp 003 1006DFC 56 PUSH esi 004 1006DFD FF3584AB0001 PUSH dword ptr [0x100ab84] 005 1006E03 8B358C110001 MOV esi, dword ptr [0x100118c] 006 1006E09 FFD6 CALL esi 007 1006E0B 8B4508 MOV eax, dword ptr [ebp + 0x8] 008 1006E0E 83E800 SUB eax, 0 009 1006E11 7412 JE L1 010 1006E13 48 DEC eax 011 1006E14 48 DEC eax 012 1006E15 7407 JE L2 013 1006E17 E80CF6FFFF CALL proc_0x1006428 014 1006E1C EB0C JMP L3 015 1006E1E E8D0F6FFFF L2: CALL proc_0x10064f3 016 1006E23 EB05 JMP L3 017 1006E25 E843F0FFFF L1: CALL proc_0x1005e6d 018 1006E2A 83F8FF L3: CMP eax, 0FFFFFFFFh 019 1006E2D 750C JNE L4 020 1006E2F FF3588AB0001 PUSH dword ptr [0x100ab88] 021 1006E35 FFD6 CALL esi 022 1006E37 33C0 XOR eax, eax 023 1006E39 EB06 JMP L5 024 1006E3B 50 L4: PUSH eax 025 1006E3C E832F9FFFF CALL proc_0x1006773 026 1006E41 5E L5: POP esi 027 1006E42 5D POP ebp 028 1006E43 C20400 RET 4 EndProc proc_0x1006df7 BeginProc proc_0x1006428 000 1006428 833DACA4000100 CMP dword ptr [0x100a4ac], 0 001 100642F 7540 JNE L1 002 1006431 800DB1A4000104 OR byte ptr [0x100a4b1], 4 003 1006438 68A0A40001 PUSH 100A4A0h 004 100643D FF15C4120001 CALL PageSetupDlgW 005 1006443 8025B1A40001FB AND byte ptr [0x100a4b1], 0FBh 006 100644A 833DACA4000100 CMP dword ptr [0x100a4ac], 0 007 1006451 751E JNE L1 008 1006453 6A30 PUSH 30h 009 1006455 FF3554900001 PUSH dword ptr [0x1009054] 010 100645B FF3598900001 PUSH dword ptr [0x1009098] 011 1006461 FF3530980001 PUSH dword ptr [0x1009830] 012 1006467 FF1568120001 CALL MessageBoxW 013 100646D 83C8FF OR eax, 0FFFFFFFFh 014 1006470 C3 RET 015 1006471 56 L1: PUSH esi 016 1006472 57 PUSH edi 017 1006473 FF35ACA40001 PUSH dword ptr [0x100a4ac] 018 1006479 8B3DA8100001 MOV edi, dword ptr [0x10010a8] 019 100647F FFD7 CALL edi 020 1006481 8B0DA8A40001 MOV ecx, dword ptr [0x100a4a8] 021 1006487 8BF0 MOV esi, eax 022 1006489 33C0 XOR eax, eax 023 100648B 85C9 TEST ecx, ecx 024 100648D 7403 JE L2 025 100648F 51 PUSH ecx 026 1006490 FFD7 CALL edi 027 1006492 50 L2: PUSH eax 028 1006493 0FB74602 MOVZX eax, dword ptr [esi + 0x2] 029 1006497 8D0446 LEA eax, dword ptr [esi + eax*0x2] 033 100649A 6A00 PUSH 0 034 100649C 50 PUSH eax 035 100649D 0FB706 MOVZX eax, dword ptr [esi] 036 10064A0 8D0446 LEA eax, dword ptr [esi + eax*0x2] 040 10064A3 50 PUSH eax 041 10064A4 FF1540100001 CALL CreateDCW 042 10064AA FF35ACA40001 PUSH dword ptr [0x100a4ac] 043 10064B0 8B35AC100001 MOV esi, dword ptr [0x10010ac] 044 10064B6 8BF8 MOV edi, eax 045 10064B8 FFD6 CALL esi 046 10064BA A1A8A40001 MOV eax, dword ptr [0x100a4a8] 047 10064BF 85C0 TEST eax, eax 048 10064C1 7403 JE L3 049 10064C3 50 PUSH eax 050 10064C4 FFD6 CALL esi 051 10064C6 85FF L3: TEST edi, edi 052 10064C8 751F JNE L4 053 10064CA 6A30 PUSH 30h 054 10064CC FF3554900001 PUSH dword ptr [0x1009054] 055 10064D2 FF3598900001 PUSH dword ptr [0x1009098] 056 10064D8 FF3530980001 PUSH dword ptr [0x1009830] 057 10064DE FF1568120001 CALL MessageBoxW 058 10064E4 83C8FF OR eax, 0FFFFFFFFh 059 10064E7 EB02 JMP L5 060 10064E9 8BC7 L4: MOV eax, edi 061 10064EB 5F L5: POP edi 062 10064EC 5E POP esi 063 10064ED C3 RET EndProc proc_0x1006428 BeginProc proc_0x10064f3 000 10064F3 8BFF MOV edi, edi 001 10064F5 55 PUSH ebp 002 10064F6 8BEC MOV ebp, esp 003 10064F8 51 PUSH ecx 004 10064F9 51 PUSH ecx 005 10064FA 53 PUSH ebx 006 10064FB 57 PUSH edi 007 10064FC 33DB XOR ebx, ebx 008 10064FE 53 PUSH ebx 009 10064FF 8D45FC LEA eax, dword ptr [ebp - 0x4] 010 1006502 50 PUSH eax 011 1006503 BF40A10001 MOV edi, 100A140h 012 1006508 57 PUSH edi 013 1006509 E8840E0000 CALL OpenPrinterW 014 100650E 85C0 TEST eax, eax 015 1006510 7508 JNE L1 016 1006512 83C8FF OR eax, 0FFFFFFFFh 017 1006515 E9A8000000 JMP L2 018 100651A 56 L1: PUSH esi 019 100651B 8D45F8 LEA eax, dword ptr [ebp - 0x8] 020 100651E 50 PUSH eax 021 100651F 53 PUSH ebx 022 1006520 53 PUSH ebx 023 1006521 6A01 PUSH 1 024 1006523 53 PUSH ebx 025 1006524 FF75FC PUSH dword ptr [ebp - 0x4] 026 1006527 E85A0E0000 CALL GetPrinterDriverW 027 100652C FF75F8 PUSH dword ptr [ebp - 0x8] 028 100652F 6A40 PUSH 40h 029 1006531 FF15E0100001 CALL LocalAlloc 030 1006537 8BF0 MOV esi, eax 031 1006539 3BF3 CMP esi, ebx 032 100653B 750D JNE L3 033 100653D FF75FC L4: PUSH dword ptr [ebp - 0x4] 034 1006540 E8350E0000 CALL ClosePrinter 035 1006545 83C8FF L5: OR eax, 0FFFFFFFFh 036 1006548 EB77 JMP L6 037 100654A 8D45F8 L3: LEA eax, dword ptr [ebp - 0x8] 038 100654D 50 PUSH eax 039 100654E FF75F8 PUSH dword ptr [ebp - 0x8] 040 1006551 56 PUSH esi 041 1006552 6A01 PUSH 1 042 1006554 53 PUSH ebx 043 1006555 FF75FC PUSH dword ptr [ebp - 0x4] 044 1006558 E8290E0000 CALL ClosePrinter 045 100655D 85C0 TEST eax, eax 046 100655F 7509 JNE L7 047 1006561 56 PUSH esi 048 1006562 FF15DC100001 CALL LocalFree 049 1006568 EBD3 JMP L4 050 100656A 800DB1A4000104 L7: OR byte ptr [0x100a4b1], 4 051 1006571 68A0A40001 PUSH 100A4A0h 052 1006576 FF15C4120001 CALL PageSetupDlgW 053 100657C 8025B1A40001FB AND byte ptr [0x100a4b1], 0FBh 054 1006583 53 PUSH ebx 055 1006584 53 PUSH ebx 056 1006585 57 PUSH edi 057 1006586 FF36 PUSH dword ptr [esi] 058 1006588 FF1540100001 CALL CreateDCW 059 100658E 56 PUSH esi 060 100658F 8BF8 MOV edi, eax 061 1006591 FF15DC100001 CALL LocalFree 062 1006597 FF75FC PUSH dword ptr [ebp - 0x4] 063 100659A E8DB0D0000 CALL ClosePrinter 064 100659F 3BFB CMP edi, ebx 065 10065A1 751C JNE L8 066 10065A3 6A30 PUSH 30h 067 10065A5 FF3554900001 PUSH dword ptr [0x1009054] 068 10065AB FF3598900001 PUSH dword ptr [0x1009098] 069 10065B1 FF3530980001 PUSH dword ptr [0x1009830] 070 10065B7 FF1568120001 CALL MessageBoxW 071 10065BD EB86 JMP L5 072 10065BF 8BC7 L8: MOV eax, edi 073 10065C1 5E L6: POP esi 074 10065C2 5F L2: POP edi 075 10065C3 5B POP ebx 076 10065C4 C9 LEAVE 077 10065C5 C3 RET EndProc proc_0x10064f3 BeginProc proc_0x1005e6d 000 1005E6D 8BFF MOV edi, edi 001 1005E6F 55 PUSH ebp 002 1005E70 8BEC MOV ebp, esp 003 1005E72 83EC54 SUB esp, 54h 004 1005E75 8B15ACA40001 MOV edx, dword ptr [0x100a4ac] 005 1005E7B 85D2 TEST edx, edx 006 1005E7D 53 PUSH ebx 007 1005E7E 56 PUSH esi 008 1005E7F 8B35C4120001 MOV esi, dword ptr [0x10012c4] 009 1005E85 57 PUSH edi 010 1005E86 BB7FFBFFFF MOV ebx, 0FFFFFB7Fh 011 1005E8B 751C JNE L1 012 1005E8D 66810DB0A400018004 OR word ptr [0x100a4b0], 480h 013 1005E96 68A0A40001 PUSH 100A4A0h 014 1005E9B FFD6 CALL esi 015 1005E9D 211DB0A40001 AND dword ptr [0x100a4b0], ebx 016 1005EA3 8B15ACA40001 MOV edx, dword ptr [0x100a4ac] 017 1005EA9 33C0 L1: XOR eax, eax 018 1005EAB 6A15 PUSH 15h 019 1005EAD 59 POP ecx 020 1005EAE 8D7DAC LEA edi, dword ptr [ebp - 0x54] 021 1005EB1 F3AB REP STOSD 022 1005EB3 A130980001 MOV eax, dword ptr [0x1009830] 023 1005EB8 8945B0 MOV dword ptr [ebp - 0x50], eax 024 1005EBB A1A8A40001 MOV eax, dword ptr [0x100a4a8] 025 1005EC0 83CFFF OR edi, 0FFFFFFFFh 026 1005EC3 85C0 TEST eax, eax 027 1005EC5 C745AC54000000 MOV dword ptr [ebp - 0x54], 54h 028 1005ECC 897DF8 MOV dword ptr [ebp - 0x8], edi 029 1005ECF C745C00C018400 MOV dword ptr [ebp - 0x40], 84010Ch 030 1005ED6 7403 JE L2 031 1005ED8 8945B4 MOV dword ptr [ebp - 0x4c], eax 032 1005EDB 85D2 L2: TEST edx, edx 033 1005EDD 7403 JE L3 034 1005EDF 8955B8 MOV dword ptr [ebp - 0x48], edx 035 1005EE2 8D45AC L3: LEA eax, dword ptr [ebp - 0x54] 036 1005EE5 50 PUSH eax 037 1005EE6 FF15CC120001 CALL PrintDlgExW 038 1005EEC 85C0 TEST eax, eax 039 1005EEE 7540 JNE L4 040 1005EF0 837DFC01 CMP dword ptr [ebp - 0x4], 1 041 1005EF4 7408 JE L5 042 1005EF6 837DFC02 CMP dword ptr [ebp - 0x4], 2 043 1005EFA 7534 JNE L4 044 1005EFC EB03 JMP L6 045 1005EFE 8B7DBC L5: MOV edi, dword ptr [ebp - 0x44] 046 1005F01 833DA8A4000100 L6: CMP dword ptr [0x100a4a8], 0 047 1005F08 7516 JNE L7 048 1005F0A 66810DB0A400018004 OR word ptr [0x100a4b0], 480h 049 1005F13 68A0A40001 PUSH 100A4A0h 050 1005F18 FFD6 CALL esi 051 1005F1A 211DB0A40001 AND dword ptr [0x100a4b0], ebx 052 1005F20 8B45B4 L7: MOV eax, dword ptr [ebp - 0x4c] 053 1005F23 A3A8A40001 MOV dword ptr [0x100a4a8], eax 054 1005F28 8B45B8 MOV eax, dword ptr [ebp - 0x48] 055 1005F2B A3ACA40001 MOV dword ptr [0x100a4ac], eax 056 1005F30 8BC7 L4: MOV eax, edi 057 1005F32 5F POP edi 058 1005F33 5E POP esi 059 1005F34 5B POP ebx 060 1005F35 C9 LEAVE 061 1005F36 C3 RET EndProc proc_0x1005e6d BeginProc proc_0x1006773 000 1006773 8BFF MOV edi, edi 001 1006775 55 PUSH ebp 002 1006776 8BEC MOV ebp, esp 003 1006778 81ECC8030000 SUB esp, 3C8h 004 100677E A104960001 MOV eax, dword ptr [0x1009604] 005 1006783 53 PUSH ebx 006 1006784 56 PUSH esi 007 1006785 8B7508 MOV esi, dword ptr [ebp + 0x8] 008 1006788 33DB XOR ebx, ebx 009 100678A 57 PUSH edi 010 100678B FF3584AB0001 PUSH dword ptr [0x100ab84] 011 1006791 8945FC MOV dword ptr [ebp - 0x4], eax 012 1006794 89B5C8FCFFFF MOV dword ptr [ebp - 0x338], esi 013 100679A 899DACFCFFFF MOV dword ptr [ebp - 0x354], ebx 014 10067A0 899DC0FCFFFF MOV dword ptr [ebp - 0x340], ebx 015 10067A6 899DBCFCFFFF MOV dword ptr [ebp - 0x344], ebx 016 10067AC 899DB0FCFFFF MOV dword ptr [ebp - 0x350], ebx 017 10067B2 899DC4FCFFFF MOV dword ptr [ebp - 0x33c], ebx 018 10067B8 891D34A10001 MOV dword ptr [0x100a134], ebx 019 10067BE 891D38A10001 MOV dword ptr [0x100a138], ebx 020 10067C4 FF158C110001 CALL SetCursor 021 10067CA 56 PUSH esi 022 10067CB E83CF6FFFF CALL proc_0x1005e0c 023 10067D0 BEF09A0001 MOV esi, 1009AF0h 024 10067D5 56 PUSH esi 025 10067D6 FF1598100001 CALL GetLocalTime 026 10067DC FF159C100001 CALL GetUserDefaultLCID 027 10067E2 BF04010000 MOV edi, 104h 028 10067E7 57 PUSH edi 029 10067E8 68F0910001 PUSH 10091F0h 030 10067ED 53 PUSH ebx 031 10067EE 56 PUSH esi 032 10067EF 6A02 PUSH 2 033 10067F1 50 PUSH eax 034 10067F2 8985B8FCFFFF MOV dword ptr [ebp - 0x348], eax 035 10067F8 FF15A0100001 CALL GetDateFormatW 036 10067FE 57 PUSH edi 037 10067FF 68F8930001 PUSH 10093F8h 038 1006804 53 PUSH ebx 039 1006805 56 PUSH esi 040 1006806 53 PUSH ebx 041 1006807 FFB5B8FCFFFF PUSH dword ptr [ebp - 0x348] 042 100680D FF15A4100001 CALL GetTimeFormatW 043 1006813 A1E09A0001 MOV eax, dword ptr [0x1009ae0] 044 1006818 0FAF0518900001 IMUL eax, dword ptr [0x1009018] 045 100681F 6A17 PUSH 17h 046 1006821 59 POP ecx 047 1006822 BE20AB0001 MOV esi, 100AB20h 048 1006827 8DBDCCFCFFFF LEA edi, dword ptr [ebp - 0x334] 049 100682D F3A5 REP MOVSD 050 100682F 99 CDQ 051 1006830 B930FDFFFF MOV ecx, 0FFFFFD30h 053 1006835 F7F9 IDIV eax, ecx 055 1006837 6A08 PUSH 8 056 1006839 FFB5C8FCFFFF PUSH dword ptr [ebp - 0x338] 057 100683F 899DD0FCFFFF MOV dword ptr [ebp - 0x330], ebx 058 1006845 8B1D80100001 MOV ebx, dword ptr [0x1001080] 059 100684B 8985CCFCFFFF MOV dword ptr [ebp - 0x334], eax 060 1006851 FFD3 CALL ebx 061 1006853 6A00 PUSH 0 062 1006855 FF35D89A0001 PUSH dword ptr [0x1009ad8] 063 100685B FF35DC9A0001 PUSH dword ptr [0x1009adc] 064 1006861 FFB5C8FCFFFF PUSH dword ptr [ebp - 0x338] 065 1006867 FF157C100001 CALL SetViewportExtEx 066 100686D 6A00 PUSH 0 067 100686F FF35B8A40001 PUSH dword ptr [0x100a4b8] 068 1006875 FF35B4A40001 PUSH dword ptr [0x100a4b4] 069 100687B FFB5C8FCFFFF PUSH dword ptr [ebp - 0x338] 070 1006881 FF1578100001 CALL SetWindowExtEx 071 1006887 B820A10001 MOV eax, 100A120h 072 100688C 8BF8 MOV edi, eax 073 100688E BECCA40001 MOV esi, 100A4CCh 074 1006893 A5 MOVSD 075 1006894 A5 MOVSD 076 1006895 A5 MOVSD 077 1006896 6A02 PUSH 2 078 1006898 A5 MOVSD 079 1006899 8BB5C8FCFFFF MOV esi, dword ptr [ebp - 0x338] 080 100689F 50 PUSH eax 081 10068A0 56 PUSH esi 082 10068A1 FF1574100001 CALL LPtoDP 083 10068A7 33FF XOR edi, edi 084 10068A9 47 INC edi 085 10068AA 57 PUSH edi 086 10068AB 56 PUSH esi 087 10068AC FFD3 CALL ebx 088 10068AE 8B1D64100001 MOV ebx, dword ptr [0x1001064] 089 10068B4 8D85CCFCFFFF LEA eax, dword ptr [ebp - 0x334] 090 10068BA 50 PUSH eax 091 10068BB FFD3 CALL ebx 092 10068BD 85C0 TEST eax, eax 093 10068BF 8985B4FCFFFF MOV dword ptr [ebp - 0x34c], eax 094 10068C5 0F84C9040000 JE L1 095 10068CB 50 PUSH eax 096 10068CC 56 PUSH esi 097 10068CD FF1584100001 CALL SelectObject 098 10068D3 85C0 TEST eax, eax 099 10068D5 8985C0FCFFFF MOV dword ptr [ebp - 0x340], eax 100 10068DB 0F84B3040000 JE L1 101 10068E1 57 PUSH edi 102 10068E2 56 PUSH esi 103 10068E3 FF1570100001 CALL SetBkMode 104 10068E9 8D8538FCFFFF LEA eax, dword ptr [ebp - 0x3c8] 105 10068EF 50 PUSH eax 106 10068F0 56 PUSH esi 107 10068F1 8B356C100001 MOV esi, dword ptr [0x100106c] 108 10068F7 FFD6 CALL esi 109 10068F9 85C0 TEST eax, eax 110 10068FB 0F8493040000 JE L1 111 1006901 F6856FFCFFFF06 TEST byte ptr [ebp - 0x391], 6 112 1006908 7572 JNE L2 113 100690A FFB5C0FCFFFF PUSH dword ptr [ebp - 0x340] 114 1006910 FFB5C8FCFFFF PUSH dword ptr [ebp - 0x338] 115 1006916 FF1584100001 CALL SelectObject 116 100691C 50 PUSH eax 117 100691D FF1568100001 CALL DeleteObject 118 1006923 6A10 PUSH 10h 119 1006925 59 POP ecx 120 1006926 33C0 XOR eax, eax 121 1006928 8DBDE8FCFFFF LEA edi, dword ptr [ebp - 0x318] 122 100692E F3AB REP STOSD 123 1006930 8D85CCFCFFFF LEA eax, dword ptr [ebp - 0x334] 124 1006936 50 PUSH eax 125 1006937 FFD3 CALL ebx 126 1006939 85C0 TEST eax, eax 127 100693B 8985B4FCFFFF MOV dword ptr [ebp - 0x34c], eax 128 1006941 0F844D040000 JE L1 129 1006947 50 PUSH eax 130 1006948 FFB5C8FCFFFF PUSH dword ptr [ebp - 0x338] 131 100694E FF1584100001 CALL SelectObject 132 1006954 85C0 TEST eax, eax 133 1006956 8985C0FCFFFF MOV dword ptr [ebp - 0x340], eax 134 100695C 0F8432040000 JE L1 135 1006962 8D8538FCFFFF LEA eax, dword ptr [ebp - 0x3c8] 136 1006968 50 PUSH eax 137 1006969 FFB5C8FCFFFF PUSH dword ptr [ebp - 0x338] 138 100696F FFD6 CALL esi 139 1006971 85C0 TEST eax, eax 140 1006973 0F841B040000 JE L1 141 1006979 33FF XOR edi, edi 142 100697B 47 INC edi 143 100697C 8B8538FCFFFF L2: MOV eax, dword ptr [ebp - 0x3c8] 144 1006982 8B8D48FCFFFF MOV ecx, dword ptr [ebp - 0x3b8] 145 1006988 8B1520A10001 MOV edx, dword ptr [0x100a120] 146 100698E 03C8 ADD ecx, eax 147 1006990 8B854CFCFFFF MOV eax, dword ptr [ebp - 0x3b4] 148 1006996 C1E003 SHL eax, 3 149 1006999 A33CA10001 MOV dword ptr [0x100a13c], eax 150 100699E A1D49A0001 MOV eax, dword ptr [0x1009ad4] 151 10069A3 2BD0 SUB edx, eax 152 10069A5 33DB XOR ebx, ebx 153 10069A7 3BD3 CMP edx, ebx 154 10069A9 890D30A10001 MOV dword ptr [0x100a130], ecx 155 10069AF 8915C49A0001 MOV dword ptr [0x1009ac4], edx 156 10069B5 7F06 JG L3 157 10069B7 891DC49A0001 MOV dword ptr [0x1009ac4], ebx 158 10069BD 8B15E89A0001 L3: MOV edx, dword ptr [0x1009ae8] 159 10069C3 2B15DC9A0001 SUB edx, dword ptr [0x1009adc] 160 10069C9 031528A10001 ADD edx, dword ptr [0x100a128] 161 10069CF 03C2 ADD eax, edx 162 10069D1 3BC3 CMP eax, ebx 163 10069D3 A3C09A0001 MOV dword ptr [0x1009ac0], eax 164 10069D8 7F06 JG L4 165 10069DA 891DC09A0001 MOV dword ptr [0x1009ac0], ebx 166 10069E0 A124A10001 L4: MOV eax, dword ptr [0x100a124] 167 10069E5 8B15D09A0001 MOV edx, dword ptr [0x1009ad0] 168 10069EB 2BC2 SUB eax, edx 169 10069ED 3BC3 CMP eax, ebx 170 10069EF A3CC9A0001 MOV dword ptr [0x1009acc], eax 171 10069F4 7F06 JG L5 172 10069F6 891DCC9A0001 MOV dword ptr [0x1009acc], ebx 173 10069FC A1E49A0001 L5: MOV eax, dword ptr [0x1009ae4] 174 1006A01 8BF0 MOV esi, eax 175 1006A03 2B35D89A0001 SUB esi, dword ptr [0x1009ad8] 176 1006A09 03352CA10001 ADD esi, dword ptr [0x100a12c] 177 1006A0F 03D6 ADD edx, esi 178 1006A11 3BD3 CMP edx, ebx 179 1006A13 8915C89A0001 MOV dword ptr [0x1009ac8], edx 180 1006A19 7F06 JG L6 181 1006A1B 891DC89A0001 MOV dword ptr [0x1009ac8], ebx 182 1006A21 2B05C89A0001 L6: SUB eax, dword ptr [0x1009ac8] 183 1006A27 2B05CC9A0001 SUB eax, dword ptr [0x1009acc] 184 1006A2D 99 CDQ 186 1006A2E F7F9 IDIV eax, ecx 188 1006A30 66391DE0A30001 CMP word ptr [0x100a3e0], bx 189 1006A37 7401 JE L7 190 1006A39 48 DEC eax 191 1006A3A 66391D30A40001 L7: CMP word ptr [0x100a430], bx 192 1006A41 7401 JE L8 193 1006A43 48 DEC eax 194 1006A44 3BC3 L8: CMP eax, ebx 195 1006A46 0F8E27030000 JLE L9 196 1006A4C 68A35D0001 PUSH 1005DA3h 197 1006A51 FFB5C8FCFFFF PUSH dword ptr [ebp - 0x338] 198 1006A57 FF1544100001 CALL SetAbortProc 199 1006A5D 8BF0 MOV esi, eax 200 1006A5F 3BF3 CMP esi, ebx 201 1006A61 0F8C8E020000 JL L10 202 1006A67 53 PUSH ebx 203 1006A68 53 PUSH ebx 204 1006A69 68BD000000 PUSH 0BDh 205 1006A6E FF3538980001 PUSH dword ptr [0x1009838] 206 1006A74 FF1540120001 CALL SendMessageW 207 1006A7A 3BC3 CMP eax, ebx 208 1006A7C 8985ACFCFFFF MOV dword ptr [ebp - 0x354], eax 209 1006A82 0F840C030000 JE L1 210 1006A88 50 PUSH eax 211 1006A89 FF15F0100001 CALL LocalLock 212 1006A8F 3BC3 CMP eax, ebx 213 1006A91 8985C4FCFFFF MOV dword ptr [ebp - 0x33c], eax 214 1006A97 0F84F7020000 JE L1 215 1006A9D 6804010000 PUSH 104h 216 1006AA2 8D8528FDFFFF LEA eax, dword ptr [ebp - 0x2d8] 217 1006AA8 50 PUSH eax 218 1006AA9 FF3530980001 PUSH dword ptr [0x1009830] 219 1006AAF FF1518120001 CALL GetWindowTextW 220 1006AB5 53 PUSH ebx 221 1006AB6 FF3530980001 PUSH dword ptr [0x1009830] 222 1006ABC FF150C120001 CALL EnableWindow 223 1006AC2 53 PUSH ebx 224 1006AC3 68CB650001 PUSH 10065CBh 225 1006AC8 FF3530980001 PUSH dword ptr [0x1009830] 226 1006ACE 6A0B PUSH 0Bh 227 1006AD0 FF3580AB0001 PUSH dword ptr [0x100ab80] 228 1006AD6 FF1514120001 CALL CreateDialogParamW 229 1006ADC 3BC3 CMP eax, ebx 230 1006ADE A338A10001 MOV dword ptr [0x100a138], eax 231 1006AE3 0F84AB020000 JE L1 232 1006AE9 8D8528FDFFFF LEA eax, dword ptr [ebp - 0x2d8] 233 1006AEF 53 PUSH ebx 234 1006AF0 C78588FCFFFF14000000MOV dword ptr [ebp - 0x378], 14h 235 1006AFA 89858CFCFFFF MOV dword ptr [ebp - 0x374], eax 236 1006B00 899D90FCFFFF MOV dword ptr [ebp - 0x370], ebx 237 1006B06 899D94FCFFFF MOV dword ptr [ebp - 0x36c], ebx 238 1006B0C 899D98FCFFFF MOV dword ptr [ebp - 0x368], ebx 239 1006B12 FF1540110001 CALL SetLastError 240 1006B18 8D8588FCFFFF LEA eax, dword ptr [ebp - 0x378] 241 1006B1E 50 PUSH eax 242 1006B1F FFB5C8FCFFFF PUSH dword ptr [ebp - 0x338] 243 1006B25 FF1550100001 CALL StartDocW 244 1006B2B 85C0 TEST eax, eax 245 1006B2D 7F0D JG L11 246 1006B2F FF1538110001 CALL GetLastError 247 1006B35 8BF0 MOV esi, eax 248 1006B37 E9B9010000 JMP L10 249 1006B3C 33C0 L11: XOR eax, eax 250 1006B3E 89BDB0FCFFFF MOV dword ptr [ebp - 0x350], edi 251 1006B44 893DBC9A0001 MOV dword ptr [0x1009abc], edi 252 1006B4A 8DBD9CFCFFFF LEA edi, dword ptr [ebp - 0x364] 253 1006B50 AB STOSD 254 1006B51 AB STOSD 255 1006B52 AB STOSD 256 1006B53 8B0D30A10001 MOV ecx, dword ptr [0x100a130] 257 1006B59 AB STOSD 258 1006B5A A1C49A0001 MOV eax, dword ptr [0x1009ac4] 259 1006B5F 89859CFCFFFF MOV dword ptr [ebp - 0x364], eax 260 1006B65 A1E89A0001 MOV eax, dword ptr [0x1009ae8] 261 1006B6A 2B05C09A0001 SUB eax, dword ptr [0x1009ac0] 262 1006B70 33F6 XOR esi, esi 263 1006B72 8985A4FCFFFF MOV dword ptr [ebp - 0x35c], eax 264 1006B78 A1CC9A0001 MOV eax, dword ptr [0x1009acc] 265 1006B7D 8985A0FCFFFF MOV dword ptr [ebp - 0x360], eax 266 1006B83 A1E49A0001 MOV eax, dword ptr [0x1009ae4] 267 1006B88 2B05C89A0001 SUB eax, dword ptr [0x1009ac8] 268 1006B8E 663935E0A30001 CMP word ptr [0x100a3e0], si 269 1006B95 899DB8FCFFFF MOV dword ptr [ebp - 0x348], ebx 270 1006B9B 899DBCFCFFFF MOV dword ptr [ebp - 0x344], ebx 271 1006BA1 8985A8FCFFFF MOV dword ptr [ebp - 0x358], eax 272 1006BA7 7406 JE L12 273 1006BA9 018DA0FCFFFF ADD dword ptr [ebp - 0x360], ecx 274 1006BAF 66393530A40001 L12: CMP word ptr [0x100a430], si 275 1006BB6 7408 JE L13 276 1006BB8 2BC1 SUB eax, ecx 277 1006BBA 8985A8FCFFFF MOV dword ptr [ebp - 0x358], eax 278 1006BC0 FFB5C4FCFFFF L13: PUSH dword ptr [ebp - 0x33c] 279 1006BC6 FF15E4100001 CALL lstrlenW 280 1006BCC 6AEC PUSH 0FFFFFFECh 281 1006BCE FF3538980001 PUSH dword ptr [0x1009838] 282 1006BD4 8BD8 MOV ebx, eax 283 1006BD6 FF1570120001 CALL GetWindowLongW 284 1006BDC F6C420 TEST ah, 20h 285 1006BDF 740A JE L14 286 1006BE1 C785B8FCFFFF02000200MOV dword ptr [ebp - 0x348], 20002h 287 1006BEB 393534A10001 L14: CMP dword ptr [0x100a134], esi 288 1006BF1 0F85FA000000 JNE L15 289 1006BF7 85DB L16: TEST ebx, ebx 290 1006BF9 0F8EF2000000 JLE L15 291 1006BFF FF35BC9A0001 PUSH dword ptr [0x1009abc] 292 1006C05 8D8530FFFFFF LEA eax, dword ptr [ebp - 0xd0] 293 1006C0B FF35C4900001 PUSH dword ptr [0x10090c4] 294 1006C11 6A64 PUSH 64h 295 1006C13 50 PUSH eax 296 1006C14 FF1514130001 CALL _snwprintf 297 1006C1A 83C410 ADD esp, 10h 298 1006C1D 8D8530FFFFFF LEA eax, dword ptr [ebp - 0xd0] 299 1006C23 50 PUSH eax 300 1006C24 6A15 PUSH 15h 301 1006C26 FF3538A10001 PUSH dword ptr [0x100a138] 302 1006C2C FF157C120001 CALL SetDlgItemTextW 303 1006C32 8BB5C8FCFFFF MOV esi, dword ptr [ebp - 0x338] 304 1006C38 6A00 PUSH 0 305 1006C3A 56 PUSH esi 306 1006C3B E817FAFFFF CALL proc_0x1006657 307 1006C40 33C0 XOR eax, eax 308 1006C42 8DBD74FCFFFF LEA edi, dword ptr [ebp - 0x38c] 309 1006C48 AB STOSD 310 1006C49 AB STOSD 311 1006C4A AB STOSD 312 1006C4B AB STOSD 313 1006C4C AB STOSD 314 1006C4D A13CA10001 MOV eax, dword ptr [0x100a13c] 315 1006C52 56 PUSH esi 316 1006C53 C78574FCFFFF14000000MOV dword ptr [ebp - 0x38c], 14h 317 1006C5D 898578FCFFFF MOV dword ptr [ebp - 0x388], eax 318 1006C63 FF1538100001 CALL StartPage 319 1006C69 85C0 TEST eax, eax 320 1006C6B 0F8E23010000 JLE L1 321 1006C71 8D8574FCFFFF LEA eax, dword ptr [ebp - 0x38c] 322 1006C77 50 PUSH eax 323 1006C78 8B85B8FCFFFF MOV eax, dword ptr [ebp - 0x348] 324 1006C7E 0D50280000 OR eax, 2850h 325 1006C83 50 PUSH eax 326 1006C84 8D859CFCFFFF LEA eax, dword ptr [ebp - 0x364] 327 1006C8A 50 PUSH eax 328 1006C8B 53 PUSH ebx 329 1006C8C FFB5C4FCFFFF PUSH dword ptr [ebp - 0x33c] 330 1006C92 33FF XOR edi, edi 331 1006C94 47 INC edi 332 1006C95 56 PUSH esi 333 1006C96 89BDBCFCFFFF MOV dword ptr [ebp - 0x344], edi 334 1006C9C FF1510120001 CALL DrawTextExW 335 1006CA2 57 PUSH edi 336 1006CA3 56 PUSH esi 337 1006CA4 E8AEF9FFFF CALL proc_0x1006657 338 1006CA9 56 PUSH esi 339 1006CAA FF1528100001 CALL EndPage 340 1006CB0 85C0 TEST eax, eax 341 1006CB2 0F8EDC000000 JLE L1 342 1006CB8 83A5BCFCFFFF00 AND dword ptr [ebp - 0x344], 0 343 1006CBF 8B8584FCFFFF MOV eax, dword ptr [ebp - 0x37c] 344 1006CC5 FF05BC9A0001 INC dword ptr [0x1009abc] 345 1006CCB 85C0 TEST eax, eax 346 1006CCD 0F849E000000 JE L17 347 1006CD3 8B8DC4FCFFFF MOV ecx, dword ptr [ebp - 0x33c] 348 1006CD9 8D0C41 LEA ecx, dword ptr [ecx + eax*0x2] 352 1006CDC 2BD8 SUB ebx, eax 353 1006CDE 833D34A1000100 CMP dword ptr [0x100a134], 0 354 1006CE5 898DC4FCFFFF MOV dword ptr [ebp - 0x33c], ecx 355 1006CEB 0F8406FFFFFF JE L16 356 1006CF1 33F6 L15: XOR esi, esi 357 1006CF3 33DB L18: XOR ebx, ebx 358 1006CF5 399DC0FCFFFF L10: CMP dword ptr [ebp - 0x340], ebx 359 1006CFB 741E JE L19 360 1006CFD FFB5C0FCFFFF PUSH dword ptr [ebp - 0x340] 361 1006D03 FFB5C8FCFFFF PUSH dword ptr [ebp - 0x338] 362 1006D09 FF1584100001 CALL SelectObject 363 1006D0F FFB5B4FCFFFF PUSH dword ptr [ebp - 0x34c] 364 1006D15 FF1568100001 CALL DeleteObject 365 1006D1B 399DC4FCFFFF L19: CMP dword ptr [ebp - 0x33c], ebx 366 1006D21 740C JE L20 367 1006D23 FFB5ACFCFFFF PUSH dword ptr [ebp - 0x354] 368 1006D29 FF15E8100001 CALL LocalUnlock 369 1006D2F 399DBCFCFFFF L20: CMP dword ptr [ebp - 0x344], ebx 370 1006D35 741C JE L21 371 1006D37 FFB5C8FCFFFF PUSH dword ptr [ebp - 0x338] 372 1006D3D FF1528100001 CALL EndPage 373 1006D43 85C0 TEST eax, eax 374 1006D45 7F0C JG L21 375 1006D47 3BF3 CMP esi, ebx 376 1006D49 7508 JNE L21 377 1006D4B FF1538110001 CALL GetLastError 378 1006D51 8BF0 MOV esi, eax 379 1006D53 399DB0FCFFFF L21: CMP dword ptr [ebp - 0x350], ebx 380 1006D59 745C JE L22 381 1006D5B 391D34A10001 CMP dword ptr [0x100a134], ebx 382 1006D61 FFB5C8FCFFFF PUSH dword ptr [ebp - 0x338] 383 1006D67 7438 JE L23 384 1006D69 FF152C100001 CALL AbortDoc 385 1006D6F EB46 JMP L22 386 1006D71 33DB L17: XOR ebx, ebx 387 1006D73 6A30 L9: PUSH 30h 388 1006D75 FF3554900001 PUSH dword ptr [0x1009054] 389 1006D7B FF35A4900001 PUSH dword ptr [0x10090a4] 390 1006D81 FF3530980001 PUSH dword ptr [0x1009830] 391 1006D87 FF1568120001 CALL MessageBoxW 392 1006D8D 53 PUSH ebx 393 1006D8E FF1540110001 CALL SetLastError 394 1006D94 FF1538110001 L1: CALL GetLastError 395 1006D9A 8BF0 MOV esi, eax 396 1006D9C E952FFFFFF JMP L18 397 1006DA1 FF1530100001 L23: CALL EndDoc 398 1006DA7 85C0 TEST eax, eax 399 1006DA9 7F0C JG L22 400 1006DAB 3BF3 CMP esi, ebx 401 1006DAD 7508 JNE L22 402 1006DAF FF1538110001 CALL GetLastError 403 1006DB5 8BF0 MOV esi, eax 404 1006DB7 FFB5C8FCFFFF L22: PUSH dword ptr [ebp - 0x338] 405 1006DBD FF1534100001 CALL DeleteDC 406 1006DC3 E874F1FFFF CALL proc_0x1005f3c 407 1006DC8 FF3588AB0001 PUSH dword ptr [0x100ab88] 408 1006DCE FF158C110001 CALL SetCursor 409 1006DD4 391D34A10001 CMP dword ptr [0x100a134], ebx 410 1006DDA 7504 JNE L24 411 1006DDC 8BC6 MOV eax, esi 412 1006DDE EB03 JMP L25 413 1006DE0 6AFD L24: PUSH 0FFFFFFFDh 414 1006DE2 58 POP eax 415 1006DE3 8B4DFC L25: MOV ecx, dword ptr [ebp - 0x4] 416 1006DE6 5F POP edi 417 1006DE7 5E POP esi 418 1006DE8 5B POP ebx 419 1006DE9 E859030000 CALL proc_0x1007147 420 1006DEE C9 LEAVE 421 1006DEF C20400 RET 4 EndProc proc_0x1006773 BeginProc proc_0x1005e0c 000 1005E0C 8BFF MOV edi, edi 001 1005E0E 55 PUSH ebp 002 1005E0F 8BEC MOV ebp, esp 003 1005E11 56 PUSH esi 004 1005E12 8B3560100001 MOV esi, dword ptr [0x1001060] 005 1005E18 57 PUSH edi 006 1005E19 8B7D08 MOV edi, dword ptr [ebp + 0x8] 007 1005E1C 6A08 PUSH 8 008 1005E1E 57 PUSH edi 009 1005E1F FFD6 CALL esi 010 1005E21 6A0A PUSH 0Ah 011 1005E23 57 PUSH edi 012 1005E24 A3E89A0001 MOV dword ptr [0x1009ae8], eax 013 1005E29 FFD6 CALL esi 014 1005E2B 6A5A PUSH 5Ah 015 1005E2D 57 PUSH edi 016 1005E2E A3E49A0001 MOV dword ptr [0x1009ae4], eax 017 1005E33 FFD6 CALL esi 018 1005E35 6A6E PUSH 6Eh 019 1005E37 57 PUSH edi 020 1005E38 A3E09A0001 MOV dword ptr [0x1009ae0], eax 021 1005E3D FFD6 CALL esi 022 1005E3F 6A6F PUSH 6Fh 023 1005E41 57 PUSH edi 024 1005E42 A3DC9A0001 MOV dword ptr [0x1009adc], eax 025 1005E47 FFD6 CALL esi 026 1005E49 6A70 PUSH 70h 027 1005E4B 57 PUSH edi 028 1005E4C A3D89A0001 MOV dword ptr [0x1009ad8], eax 029 1005E51 FFD6 CALL esi 030 1005E53 6A71 PUSH 71h 031 1005E55 57 PUSH edi 032 1005E56 A3D49A0001 MOV dword ptr [0x1009ad4], eax 033 1005E5B FFD6 CALL esi 034 1005E5D 5F POP edi 035 1005E5E A3D09A0001 MOV dword ptr [0x1009ad0], eax 036 1005E63 5E POP esi 037 1005E64 5D POP ebp 038 1005E65 C20400 RET 4 EndProc proc_0x1005e0c BeginProc proc_0x1006657 000 1006657 8BFF MOV edi, edi 001 1006659 55 PUSH ebp 002 100665A 8BEC MOV ebp, esp 003 100665C 51 PUSH ecx 004 100665D 51 PUSH ecx 005 100665E 53 PUSH ebx 006 100665F 56 PUSH esi 007 1006660 8B750C MOV esi, dword ptr [ebp + 0xc] 008 1006663 8D04B6 LEA eax, dword ptr [esi + esi*0x4] 011 1006666 C1E004 SHL eax, 4 012 1006669 8D80E0A30001 LEA eax, dword ptr [eax + 0x100a3e0] 015 100666F 33DB XOR ebx, ebx 016 1006671 663918 CMP word ptr [eax], bx 017 1006674 7507 JNE L1 018 1006676 33C0 XOR eax, eax 019 1006678 E9EB000000 JMP L2 020 100667D 50 L1: PUSH eax 021 100667E E80EFAFFFF CALL proc_0x1006091 022 1006683 3BF3 CMP esi, ebx 023 1006685 7507 JNE L3 024 1006687 A1CC9A0001 MOV eax, dword ptr [0x1009acc] 025 100668C EB11 JMP L4 026 100668E A1E49A0001 L3: MOV eax, dword ptr [0x1009ae4] 027 1006693 2B0530A10001 SUB eax, dword ptr [0x100a130] 028 1006699 2B05C89A0001 SUB eax, dword ptr [0x1009ac8] 029 100669F 66391D009B0001 L4: CMP word ptr [0x1009b00], bx 030 10066A6 8B35E4100001 MOV esi, dword ptr [0x10010e4] 031 10066AC 89450C MOV dword ptr [ebp + 0xc], eax 032 10066AF 57 PUSH edi 033 10066B0 741C JE L5 034 10066B2 BF009B0001 MOV edi, 1009B00h 035 10066B7 57 PUSH edi 036 10066B8 FFD6 CALL esi 037 10066BA 50 PUSH eax 038 10066BB 57 PUSH edi 039 10066BC FF750C PUSH dword ptr [ebp + 0xc] 040 10066BF FF35C49A0001 PUSH dword ptr [0x1009ac4] 041 10066C5 FF7508 PUSH dword ptr [ebp + 0x8] 042 10066C8 FF154C100001 CALL TextOutW 043 10066CE 66391D089D0001 L5: CMP word ptr [0x1009d08], bx 044 10066D5 744B JE L6 045 10066D7 8D45F8 LEA eax, dword ptr [ebp - 0x8] 046 10066DA 50 PUSH eax 047 10066DB BB089D0001 MOV ebx, 1009D08h 048 10066E0 53 PUSH ebx 049 10066E1 FFD6 CALL esi 050 10066E3 50 PUSH eax 051 10066E4 53 PUSH ebx 052 10066E5 FF7508 PUSH dword ptr [ebp + 0x8] 053 10066E8 FF153C100001 CALL GetTextExtentPoint32W 054 10066EE A1E89A0001 MOV eax, dword ptr [0x1009ae8] 055 10066F3 2B05C09A0001 SUB eax, dword ptr [0x1009ac0] 056 10066F9 53 PUSH ebx 057 10066FA 0305C49A0001 ADD eax, dword ptr [0x1009ac4] 058 1006700 99 CDQ 059 1006701 2BC2 SUB eax, edx 060 1006703 8BF8 MOV edi, eax 061 1006705 8B45F8 MOV eax, dword ptr [ebp - 0x8] 062 1006708 99 CDQ 063 1006709 2BC2 SUB eax, edx 064 100670B D1F8 SAR eax, 1 065 100670D D1FF SAR edi, 1 066 100670F 2BF8 SUB edi, eax 067 1006711 FFD6 CALL esi 068 1006713 50 PUSH eax 069 1006714 53 PUSH ebx 070 1006715 FF750C PUSH dword ptr [ebp + 0xc] 071 1006718 57 PUSH edi 072 1006719 FF7508 PUSH dword ptr [ebp + 0x8] 073 100671C FF154C100001 CALL TextOutW 074 1006722 66833D109F00010L6: CMP word ptr [0x1009f10], 0 075 100672A 7438 JE L7 076 100672C 8D45F8 LEA eax, dword ptr [ebp - 0x8] 077 100672F 50 PUSH eax 078 1006730 BB109F0001 MOV ebx, 1009F10h 079 1006735 53 PUSH ebx 080 1006736 FFD6 CALL esi 081 1006738 50 PUSH eax 082 1006739 53 PUSH ebx 083 100673A FF7508 PUSH dword ptr [ebp + 0x8] 084 100673D FF153C100001 CALL GetTextExtentPoint32W 085 1006743 8B3DE89A0001 MOV edi, dword ptr [0x1009ae8] 086 1006749 2B3DC09A0001 SUB edi, dword ptr [0x1009ac0] 087 100674F 53 PUSH ebx 088 1006750 2B7DF8 SUB edi, dword ptr [ebp - 0x8] 089 1006753 FFD6 CALL esi 090 1006755 50 PUSH eax 091 1006756 53 PUSH ebx 092 1006757 FF750C PUSH dword ptr [ebp + 0xc] 093 100675A 57 PUSH edi 094 100675B FF7508 PUSH dword ptr [ebp + 0x8] 095 100675E FF154C100001 CALL TextOutW 096 1006764 33C0 L7: XOR eax, eax 097 1006766 40 INC eax 098 1006767 5F POP edi 099 1006768 5E L2: POP esi 100 1006769 5B POP ebx 101 100676A C9 LEAVE 102 100676B C20800 RET 8 EndProc proc_0x1006657 BeginProc proc_0x1006091 000 1006091 8BFF MOV edi, edi 001 1006093 55 PUSH ebp 002 1006094 8BEC MOV ebp, esp 003 1006096 81EC24020000 SUB esp, 224h 004 100609C A104960001 MOV eax, dword ptr [0x1009604] 005 10060A1 53 PUSH ebx 006 10060A2 56 PUSH esi 007 10060A3 8945FC MOV dword ptr [ebp - 0x4], eax 008 10060A6 57 PUSH edi 009 10060A7 8B7D08 MOV edi, dword ptr [ebp + 0x8] 010 10060AA 33DB XOR ebx, ebx 011 10060AC 8D85DCFDFFFF LEA eax, dword ptr [ebp - 0x224] 012 10060B2 33F6 XOR esi, esi 013 10060B4 50 PUSH eax 014 10060B5 89BDF0FDFFFF MOV dword ptr [ebp - 0x210], edi 015 10060BB 46 INC esi 016 10060BC 899DE0FDFFFF MOV dword ptr [ebp - 0x220], ebx 017 10060C2 899DE4FDFFFF MOV dword ptr [ebp - 0x21c], ebx 018 10060C8 899DE8FDFFFF MOV dword ptr [ebp - 0x218], ebx 019 10060CE FF15F8120001 CALL time 020 10060D4 8D85DCFDFFFF LEA eax, dword ptr [ebp - 0x224] 021 10060DA 50 PUSH eax 022 10060DB FF15FC120001 CALL localtime 023 10060E1 59 POP ecx 024 10060E2 59 POP ecx 025 10060E3 668B0F MOV cx, word ptr [edi] 026 10060E6 663BCB CMP cx, bx 027 10060E9 0F84FF020000 JE L1 028 10060EF A180900001 MOV eax, dword ptr [0x1009080] 029 10060F4 EB34 JMP L2 030 10060F6 6683F926 L3: CMP cx, 26h 031 10060FA 7449 JE L4 032 10060FC 8385F0FDFFFF02 ADD dword ptr [ebp - 0x210], 2 033 1006103 8BDE MOV ebx, esi 034 1006105 69DB04010000 IMUL ebx, ebx, 104h 035 100610B 8D94B5E0FDFFFF LEA edx, dword ptr [ebp + esi*0x4 - 0x220] 040 1006112 8B3A MOV edi, dword ptr [edx] 041 1006114 03DF ADD ebx, edi 042 1006116 66890C5D009B0001 MOV word ptr [ebx*0x2 + 0x1009b00], cx 043 100611E 8B8DF0FDFFFF MOV ecx, dword ptr [ebp - 0x210] 044 1006124 0FB709 MOVZX ecx, dword ptr [ecx] 045 1006127 47 INC edi 046 1006128 893A MOV dword ptr [edx], edi 047 100612A 6685C9 L2: TEST cx, cx 048 100612D 8B1DE4100001 MOV ebx, dword ptr [0x10010e4] 049 1006133 75C1 JNE L3 050 1006135 8B8DF0FDFFFF MOV ecx, dword ptr [ebp - 0x210] 051 100613B 66833926 CMP word ptr [ecx], 26h 052 100613F 0F8597020000 JNE L5 053 1006145 8385F0FDFFFF02 L4: ADD dword ptr [ebp - 0x210], 2 054 100614C 8B8DF0FDFFFF MOV ecx, dword ptr [ebp - 0x210] 055 1006152 668B09 MOV cx, word ptr [ecx] 056 1006155 663B08 CMP cx, word ptr [eax] 057 1006158 0F84F9010000 JE L6 058 100615E 663B4802 CMP cx, word ptr [eax + 0x2] 059 1006162 0F84EF010000 JE L6 060 1006168 663B4804 CMP cx, word ptr [eax + 0x4] 061 100616C 0F8434010000 JE L7 062 1006172 663B4806 CMP cx, word ptr [eax + 0x6] 063 1006176 0F842A010000 JE L7 064 100617C 663B4808 CMP cx, word ptr [eax + 0x8] 065 1006180 0F84CF000000 JE L8 066 1006186 663B480A CMP cx, word ptr [eax + 0xa] 067 100618A 0F84C5000000 JE L8 068 1006190 663B480C CMP cx, word ptr [eax + 0xc] 069 1006194 0F848E000000 JE L9 070 100619A 663B480E CMP cx, word ptr [eax + 0xe] 071 100619E 0F8484000000 JE L9 072 10061A4 6683F926 CMP cx, 26h 073 10061A8 753F JNE L10 074 10061AA 8D8CB5E0FDFFFF LEA ecx, dword ptr [ebp + esi*0x4 - 0x220] 079 10061B1 8B11 MOV edx, dword ptr [ecx] 080 10061B3 8D7A01 LEA edi, dword ptr [edx + 0x1] 083 10061B6 81FF04010000 CMP edi, 104h 084 10061BC 89BDECFDFFFF MOV dword ptr [ebp - 0x214], edi 085 10061C2 0F8D0D020000 JGE L11 086 10061C8 8BFE MOV edi, esi 087 10061CA 69FF04010000 IMUL edi, edi, 104h 088 10061D0 03FA ADD edi, edx 089 10061D2 8B95ECFDFFFF MOV edx, dword ptr [ebp - 0x214] 090 10061D8 66C7047D009B00012600MOV word ptr [edi*0x2 + 0x1009b00], 26h 091 10061E2 8911 MOV dword ptr [ecx], edx 092 10061E4 E9EC010000 JMP L11 093 10061E9 663B4810 L10: CMP cx, word ptr [eax + 0x10] 094 10061ED 7431 JE L12 095 10061EF 663B4812 CMP cx, word ptr [eax + 0x12] 096 10061F3 742B JE L12 097 10061F5 663B4814 CMP cx, word ptr [eax + 0x14] 098 10061F9 741D JE L13 099 10061FB 663B4816 CMP cx, word ptr [eax + 0x16] 100 10061FF 7417 JE L13 101 1006201 663B4818 CMP cx, word ptr [eax + 0x18] 102 1006205 740A JE L14 103 1006207 663B481A CMP cx, word ptr [eax + 0x1a] 104 100620B 0F85C4010000 JNE L11 105 1006211 33F6 L14: XOR esi, esi 106 1006213 E9BD010000 JMP L11 107 1006218 6A02 L13: PUSH 2 108 100621A 5E POP esi 109 100621B E9B5010000 JMP L11 110 1006220 33F6 L12: XOR esi, esi 111 1006222 46 INC esi 112 1006223 E9AD010000 JMP L11 113 1006228 68F0910001 L9: PUSH 10091F0h 114 100622D FFD3 CALL ebx 115 100622F 8DBCB5E0FDFFFF LEA edi, dword ptr [ebp + esi*0x4 - 0x220] 120 1006236 8B0F MOV ecx, dword ptr [edi] 121 1006238 8D1401 LEA edx, dword ptr [ecx + eax] 124 100623B 81FA04010000 CMP edx, 104h 125 1006241 8995ECFDFFFF MOV dword ptr [ebp - 0x214], edx 126 1006247 0F8D83010000 JGE L15 127 100624D 50 PUSH eax 128 100624E 68F0910001 PUSH 10091F0h 129 1006253 EB2B JMP L16 130 1006255 68F8930001 L8: PUSH 10093F8h 131 100625A FFD3 CALL ebx 132 100625C 8DBCB5E0FDFFFF LEA edi, dword ptr [ebp + esi*0x4 - 0x220] 137 1006263 8B0F MOV ecx, dword ptr [edi] 138 1006265 8D1401 LEA edx, dword ptr [ecx + eax] 141 1006268 81FA04010000 CMP edx, 104h 142 100626E 8995ECFDFFFF MOV dword ptr [ebp - 0x214], edx 143 1006274 0F8D56010000 JGE L15 144 100627A 50 PUSH eax 145 100627B 68F8930001 PUSH 10093F8h 146 1006280 8BC6 L16: MOV eax, esi 147 1006282 69C004010000 IMUL eax, eax, 104h 148 1006288 03C1 ADD eax, ecx 149 100628A 8D0445009B0001 LEA eax, dword ptr [eax*0x2 + 0x1009b00] 153 1006291 50 PUSH eax 154 1006292 FF1540130001 CALL wcsncpy 155 1006298 8B85ECFDFFFF MOV eax, dword ptr [ebp - 0x214] 156 100629E 83C40C ADD esp, 0Ch 157 10062A1 E928010000 JMP L17 158 10062A6 8385F0FDFFFF02 L7: ADD dword ptr [ebp - 0x210], 2 159 10062AD 8B85F0FDFFFF MOV eax, dword ptr [ebp - 0x210] 160 10062B3 33FF XOR edi, edi 161 10062B5 6683382B CMP word ptr [eax], 2Bh 162 10062B9 752C JNE L18 163 10062BB EB10 JMP L19 164 10062BD 8B85F0FDFFFF L20: MOV eax, dword ptr [ebp - 0x210] 165 10062C3 0FB710 MOVZX edx, dword ptr [eax] 166 10062C6 8D0CBF LEA ecx, dword ptr [edi + edi*0x4] 169 10062C9 8D7C4AD0 LEA edi, dword ptr [edx + ecx*0x2 - 0x30] 174 10062CD 40 L19: INC eax 175 10062CE 40 INC eax 176 10062CF 8985F0FDFFFF MOV dword ptr [ebp - 0x210], eax 177 10062D5 0FB700 MOVZX eax, dword ptr [eax] 178 10062D8 6A04 PUSH 4 179 10062DA 50 PUSH eax 180 10062DB FF1504130001 CALL iswctype 181 10062E1 85C0 TEST eax, eax 182 10062E3 59 POP ecx 183 10062E4 59 POP ecx 184 10062E5 75D6 JNE L20 185 10062E7 A1BC9A0001 L18: MOV eax, dword ptr [0x1009abc] 186 10062EC 03C7 ADD eax, edi 187 10062EE 50 PUSH eax 188 10062EF 8D85F4FDFFFF LEA eax, dword ptr [ebp - 0x20c] 189 10062F5 6898130001 PUSH 1001398h 190 10062FA 50 PUSH eax 191 10062FB FF1580120001 CALL wsprintfW 192 1006301 83C40C ADD esp, 0Ch 193 1006304 8D85F4FDFFFF LEA eax, dword ptr [ebp - 0x20c] 194 100630A 50 PUSH eax 195 100630B 8DBCB5E0FDFFFF LEA edi, dword ptr [ebp + esi*0x4 - 0x220] 200 1006312 FFD3 CALL ebx 201 1006314 8BC8 MOV ecx, eax 202 1006316 8B07 MOV eax, dword ptr [edi] 203 1006318 03C8 ADD ecx, eax 204 100631A 81F904010000 CMP ecx, 104h 205 1006320 7D2C JGE L21 206 1006322 8D8DF4FDFFFF LEA ecx, dword ptr [ebp - 0x20c] 207 1006328 51 PUSH ecx 208 1006329 8BCE MOV ecx, esi 209 100632B 69C904010000 IMUL ecx, ecx, 104h 210 1006331 03C8 ADD ecx, eax 211 1006333 8D044D009B0001 LEA eax, dword ptr [ecx*0x2 + 0x1009b00] 215 100633A 50 PUSH eax 216 100633B FF15FC100001 CALL lstrcpyW 217 1006341 8D85F4FDFFFF LEA eax, dword ptr [ebp - 0x20c] 218 1006347 50 PUSH eax 219 1006348 FFD3 CALL ebx 220 100634A 0307 ADD eax, dword ptr [edi] 221 100634C 8907 MOV dword ptr [edi], eax 222 100634E 83ADF0FDFFFF02 L21: SUB dword ptr [ebp - 0x210], 2 223 1006355 EB79 JMP L15 224 1006357 833D1C90000100 L6: CMP dword ptr [0x100901c], 0 225 100635E 8D85F4FDFFFF LEA eax, dword ptr [ebp - 0x20c] 226 1006364 7513 JNE L22 227 1006366 6804010000 PUSH 104h 228 100636B 50 PUSH eax 229 100636C 6800A90001 PUSH 100A900h 230 1006371 FF15D4120001 CALL GetFileTitleW 231 1006377 EB0D JMP L23 232 1006379 FF3540900001 L22: PUSH dword ptr [0x1009040] 233 100637F 50 PUSH eax 234 1006380 FF15FC100001 CALL lstrcpyW 235 1006386 8D85F4FDFFFF L23: LEA eax, dword ptr [ebp - 0x20c] 236 100638C 50 PUSH eax 237 100638D 8DBCB5E0FDFFFF LEA edi, dword ptr [ebp + esi*0x4 - 0x220] 242 1006394 FFD3 CALL ebx 243 1006396 8BC8 MOV ecx, eax 244 1006398 8B07 MOV eax, dword ptr [edi] 245 100639A 03C8 ADD ecx, eax 246 100639C 81F904010000 CMP ecx, 104h 247 10063A2 7D2C JGE L15 248 10063A4 8D8DF4FDFFFF LEA ecx, dword ptr [ebp - 0x20c] 249 10063AA 51 PUSH ecx 250 10063AB 8BCE MOV ecx, esi 251 10063AD 69C904010000 IMUL ecx, ecx, 104h 252 10063B3 03C8 ADD ecx, eax 253 10063B5 8D044D009B0001 LEA eax, dword ptr [ecx*0x2 + 0x1009b00] 257 10063BC 50 PUSH eax 258 10063BD FF15FC100001 CALL lstrcpyW 259 10063C3 8D85F4FDFFFF LEA eax, dword ptr [ebp - 0x20c] 260 10063C9 50 PUSH eax 261 10063CA FFD3 CALL ebx 262 10063CC 0307 ADD eax, dword ptr [edi] 263 10063CE 8907 L17: MOV dword ptr [edi], eax 264 10063D0 A180900001 L15: MOV eax, dword ptr [0x1009080] 265 10063D5 8385F0FDFFFF02 L11: ADD dword ptr [ebp - 0x210], 2 266 10063DC 8B8DF0FDFFFF L5: MOV ecx, dword ptr [ebp - 0x210] 267 10063E2 668B09 MOV cx, word ptr [ecx] 268 10063E5 6685C9 TEST cx, cx 269 10063E8 0F8508FDFFFF JNE L3 270 10063EE 5F L1: POP edi 271 10063EF 5E POP esi 272 10063F0 33C9 XOR ecx, ecx 273 10063F2 8D85E0FDFFFF LEA eax, dword ptr [ebp - 0x220] 274 10063F8 5B POP ebx 275 10063F9 8B10 L24: MOV edx, dword ptr [eax] 276 10063FB 03D1 ADD edx, ecx 277 10063FD 66832455009B000100 AND word ptr [edx*0x2 + 0x1009b00], 0 278 1006406 81C104010000 ADD ecx, 104h 279 100640C 83C004 ADD eax, 4 280 100640F 81F908020000 CMP ecx, 208h 281 1006415 7EE2 JLE L24 282 1006417 8B4DFC MOV ecx, dword ptr [ebp - 0x4] 283 100641A E8280D0000 CALL proc_0x1007147 284 100641F C9 LEAVE 285 1006420 C20400 RET 4 EndProc proc_0x1006091 BeginProc proc_0x1005f3c 000 1005F3C 6A01 PUSH 1 001 1005F3E FF3530980001 PUSH dword ptr [0x1009830] 002 1005F44 FF150C120001 CALL EnableWindow 003 1005F4A FF3538A10001 PUSH dword ptr [0x100a138] 004 1005F50 FF15A8110001 CALL DestroyWindow 005 1005F56 832538A1000100 AND dword ptr [0x100a138], 0 006 1005F5D C3 RET EndProc proc_0x1005f3c BeginProc proc_0x1004458 000 1004458 8BFF MOV edi, edi 001 100445A 55 PUSH ebp 002 100445B 8BEC MOV ebp, esp 003 100445D 53 PUSH ebx 004 100445E 8B5D08 MOV ebx, dword ptr [ebp + 0x8] 005 1004461 56 PUSH esi 006 1004462 8B35FC100001 MOV esi, dword ptr [0x10010fc] 007 1004468 57 PUSH edi 008 1004469 FF3584900001 PUSH dword ptr [0x1009084] 009 100446F 53 PUSH ebx 010 1004470 FFD6 CALL esi 011 1004472 8B3DE4100001 MOV edi, dword ptr [0x10010e4] 012 1004478 53 PUSH ebx 013 1004479 FFD7 CALL edi 014 100447B 8D5C4302 LEA ebx, dword ptr [ebx + eax*0x2 + 0x2] 019 100447F 68CC130001 PUSH 10013CCh 020 1004484 53 PUSH ebx 021 1004485 FFD6 CALL esi 022 1004487 53 PUSH ebx 023 1004488 FFD7 CALL edi 024 100448A FF3588900001 PUSH dword ptr [0x1009088] 025 1004490 8D5C4302 LEA ebx, dword ptr [ebx + eax*0x2 + 0x2] 030 1004494 53 PUSH ebx 031 1004495 FFD6 CALL esi 032 1004497 53 PUSH ebx 033 1004498 FFD7 CALL edi 034 100449A 8D5C4302 LEA ebx, dword ptr [ebx + eax*0x2 + 0x2] 039 100449E 687C170001 PUSH 100177Ch 040 10044A3 53 PUSH ebx 041 10044A4 FFD6 CALL esi 042 10044A6 53 PUSH ebx 043 10044A7 FFD7 CALL edi 044 10044A9 668364430200 AND word ptr [ebx + eax*0x2 + 0x2], 0 045 10044AF 5F POP edi 046 10044B0 5E POP esi 047 10044B1 5B POP ebx 048 10044B2 5D POP ebp 049 10044B3 C20400 RET 4 EndProc proc_0x1004458 BeginProc proc_0x1001929 000 1001929 A1A8A40001 MOV eax, dword ptr [0x100a4a8] 001 100192E 85C0 TEST eax, eax 002 1001930 56 PUSH esi 003 1001931 8B35D4100001 MOV esi, dword ptr [0x10010d4] 004 1001937 7403 JE L1 005 1001939 50 PUSH eax 006 100193A FFD6 CALL esi 007 100193C A1ACA40001 L1: MOV eax, dword ptr [0x100a4ac] 008 1001941 85C0 TEST eax, eax 009 1001943 7403 JE L2 010 1001945 50 PUSH eax 011 1001946 FFD6 CALL esi 012 1001948 8325A8A4000100 L2: AND dword ptr [0x100a4a8], 0 013 100194F 8325ACA4000100 AND dword ptr [0x100a4ac], 0 014 1001956 5E POP esi 015 1001957 C3 RET EndProc proc_0x1001929 BeginProc proc_0x1003429 000 1003429 8BFF MOV edi, edi 001 100342B 55 PUSH ebp 002 100342C 8BEC MOV ebp, esp 003 100342E 51 PUSH ecx 004 100342F 51 PUSH ecx 005 1003430 56 PUSH esi 006 1003431 8B750C MOV esi, dword ptr [ebp + 0xc] 007 1003434 83FE1C CMP esi, 1Ch 008 1003437 57 PUSH edi 009 1003438 6A08 PUSH 8 010 100343A 5A POP edx 011 100343B 0F8741020000 JA L1 012 1003441 0F84B7010000 JE L2 013 1003447 3BF2 CMP esi, edx 014 1003449 0F87ED000000 JA L3 015 100344F 0F84DB000000 JE L4 016 1003455 8BC6 MOV eax, esi 017 1003457 48 DEC eax 018 1003458 48 DEC eax 019 1003459 0F84C7000000 JE L5 020 100345F 83E803 SUB eax, 3 021 1003462 7461 JE L6 022 1003464 48 DEC eax 023 1003465 741F JE L7 024 1003467 48 DEC eax 025 1003468 0F855C020000 JNE L8 026 100346E FF3530980001 PUSH dword ptr [0x1009830] 027 1003474 FF15B8110001 CALL IsIconic 028 100347A 85C0 TEST eax, eax 029 100347C 753F JNE L9 030 100347E FF3538980001 PUSH dword ptr [0x1009838] 031 1003484 EB31 JMP L10 032 1003486 66837D1001 L7: CMP word ptr [ebp + 0x10], 1 033 100348B 7407 JE L11 034 100348D 66837D1002 CMP word ptr [ebp + 0x10], 2 035 1003492 7529 JNE L9 036 1003494 FF3530980001 L11: PUSH dword ptr [0x1009830] 037 100349A FF15B8110001 CALL IsIconic 038 10034A0 85C0 TEST eax, eax 039 10034A2 7519 JNE L9 040 10034A4 8B35B4110001 MOV esi, dword ptr [0x10011b4] 041 10034AA FFD6 CALL esi 042 10034AC 3B0530980001 CMP eax, dword ptr [0x1009830] 043 10034B2 7509 JNE L9 044 10034B4 FFD6 CALL esi 045 10034B6 50 PUSH eax 046 10034B7 FF1578120001 L10: CALL SetFocus 047 10034BD 33C0 L9: XOR eax, eax 048 10034BF 5F L12: POP edi 049 10034C0 5E POP esi 050 10034C1 C9 LEAVE 051 10034C2 C21000 RET 10h 052 10034C5 8B4510 L6: MOV eax, dword ptr [ebp + 0x10] 053 10034C8 33F6 XOR esi, esi 054 10034CA 2BC6 SUB eax, esi 055 10034CC 7406 JE L13 056 10034CE 48 DEC eax 057 10034CF 7449 JE L14 058 10034D1 48 DEC eax 059 10034D2 75E9 JNE L9 060 10034D4 8B3D40120001 L13: MOV edi, dword ptr [0x1001240] 061 10034DA 56 PUSH esi 062 10034DB 56 PUSH esi 063 10034DC 6A05 PUSH 5 064 10034DE FF3534980001 PUSH dword ptr [0x1009834] 065 10034E4 FFD7 CALL edi 066 10034E6 0FBF7514 MOVSX esi, word ptr [ebp + 0x14] 067 10034EA 6A04 PUSH 4 068 10034EC 59 POP ecx 069 10034ED 8D0476 LEA eax, dword ptr [esi + esi*0x2] 072 10034F0 99 CDQ 074 10034F1 F7F9 IDIV eax, ecx 076 10034F3 834DFCFF OR dword ptr [ebp - 0x4], 0FFFFFFFFh 077 10034F7 8945F8 MOV dword ptr [ebp - 0x8], eax 078 10034FA 8D45F8 LEA eax, dword ptr [ebp - 0x8] 079 10034FD 50 PUSH eax 080 10034FE 6A02 PUSH 2 081 1003500 6804040000 PUSH 404h 082 1003505 FF3534980001 PUSH dword ptr [0x1009834] 083 100350B FFD7 CALL edi 084 100350D 0FBF4516 MOVSX eax, word ptr [ebp + 0x16] 085 1003511 50 PUSH eax 086 1003512 56 PUSH esi 087 1003513 E8C8E4FFFF CALL proc_0x10019e0 088 1003518 EBA3 JMP L9 089 100351A FF7514 L14: PUSH dword ptr [ebp + 0x14] 090 100351D 6A01 PUSH 1 091 100351F 6A05 PUSH 5 092 1003521 E9AD020000 JMP L15 093 1003526 6A00 L5: PUSH 0 094 1003528 FF15F4110001 CALL PostQuitMessage 095 100352E EB8D JMP L9 096 10036CA 3B3588A40001 L8: CMP esi, dword ptr [0x100a488] 097 10036D0 0F85F6000000 JNE L16 098 10036D6 8B4514 MOV eax, dword ptr [ebp + 0x14] 099 10036D9 8B480C MOV ecx, dword ptr [eax + 0xc] 100 10036DC 8BC1 MOV eax, ecx 101 10036DE 8BF1 MOV esi, ecx 102 10036E0 C1EE02 SHR esi, 2 103 10036E3 F7D0 NOT eax 104 10036E5 83E001 AND eax, 1 105 10036E8 83E601 AND esi, 1 106 10036EB 84CA TEST cl, dl 107 10036ED A3949A0001 MOV dword ptr [0x1009a94], eax 108 10036F2 8935909A0001 MOV dword ptr [0x1009a90], esi 109 10036F8 7410 JE L17 110 10036FA FF3584AB0001 PUSH dword ptr [0x100ab84] 111 1003700 8B358C110001 MOV esi, dword ptr [0x100118c] 112 1003706 FFD6 CALL esi 113 1003708 EB1A JMP L18 114 100370A F6C110 L17: TEST cl, 10h 115 100370D 742C JE L19 116 100370F FF3584AB0001 PUSH dword ptr [0x100ab84] 117 1003715 8B358C110001 MOV esi, dword ptr [0x100118c] 118 100371B FFD6 CALL esi 119 100371D 6A01 PUSH 1 120 100371F E85BE9FFFF CALL proc_0x100207f 121 1003724 6800A80001 L18: PUSH 100A800h 122 1003729 E81E220000 CALL proc_0x100594c 123 100372E FF3588AB0001 PUSH dword ptr [0x100ab88] 124 1003734 FFD6 CALL esi 125 1003736 E982FDFFFF JMP L9 126 100373B F6C120 L19: TEST cl, 20h 127 100373E 7477 JE L20 128 1003740 33F6 XOR esi, esi 129 1003742 3BC6 CMP eax, esi 130 1003744 7406 JE L21 131 1003746 8935949A0001 MOV dword ptr [0x1009a94], esi 132 100374C 53 L21: PUSH ebx 133 100374D FF3584AB0001 PUSH dword ptr [0x100ab84] 134 1003753 8B1D8C110001 MOV ebx, dword ptr [0x100118c] 135 1003759 FFD3 CALL ebx 136 100375B 8B3D40120001 MOV edi, dword ptr [0x1001240] 137 1003761 56 PUSH esi 138 1003762 56 PUSH esi 139 1003763 68B1000000 PUSH 0B1h 140 1003768 FF3538980001 PUSH dword ptr [0x1009838] 141 100376E FFD7 CALL edi 142 1003770 56 L22: PUSH esi 143 1003771 E809E9FFFF CALL proc_0x100207f 144 1003776 6800A80001 PUSH 100A800h 145 100377B E8CC210000 CALL proc_0x100594c 146 1003780 85C0 TEST eax, eax 147 1003782 75EC JNE L22 148 1003784 FF3588AB0001 PUSH dword ptr [0x100ab88] 149 100378A FFD3 CALL ebx 150 100378C 56 PUSH esi 151 100378D 56 PUSH esi 152 100378E 68B1000000 PUSH 0B1h 153 1003793 FF3538980001 PUSH dword ptr [0x1009838] 154 1003799 FFD7 CALL edi 155 100379B 56 PUSH esi 156 100379C 56 PUSH esi 157 100379D 68B7000000 PUSH 0B7h 158 10037A2 FF3538980001 PUSH dword ptr [0x1009838] 159 10037A8 FFD7 CALL edi 160 10037AA 6A01 PUSH 1 161 10037AC E891E4FFFF CALL proc_0x1001c42 162 10037B1 5B POP ebx 163 10037B2 E906FDFFFF JMP L9 164 10037B7 F6C140 L20: TEST cl, 40h 165 10037BA 0F84FDFCFFFF JE L9 166 10037C0 83253C98000100 AND dword ptr [0x100983c], 0 167 10037C7 E9F1FCFFFF JMP L9 168 10037CC FF7514 L16: PUSH dword ptr [ebp + 0x14] 169 10037CF FF7510 L23: PUSH dword ptr [ebp + 0x10] 170 10037D2 56 PUSH esi 171 10037D3 FF7508 L15: PUSH dword ptr [ebp + 0x8] 172 10037D6 FF15A4110001 CALL DefWindowProcW 173 10037DC E9DEFCFFFF JMP L12 174 1003530 FF7514 L4: PUSH dword ptr [ebp + 0x14] 175 1003533 FF7510 PUSH dword ptr [ebp + 0x10] 176 1003536 52 PUSH edx 177 1003537 E9C1020000 JMP L24 178 100353C 8BC6 L3: MOV eax, esi 179 100353E 83E810 SUB eax, 10h 180 1003541 7449 JE L25 181 1003543 48 DEC eax 182 1003544 740E JE L26 183 1003546 83E809 SUB eax, 9 184 1003549 0F846EFFFFFF JE L9 185 100354F E976010000 JMP L8 186 1003554 33F6 L26: XOR esi, esi 187 1003556 393554980001 CMP dword ptr [0x1009854], esi 188 100355C 7422 JE L27 189 100355E 8B3DAC110001 MOV edi, dword ptr [0x10011ac] 190 1003564 56 PUSH esi 191 1003565 FFD7 CALL edi 192 1003567 56 PUSH esi 193 1003568 FFD7 CALL edi 194 100356A 6800100000 PUSH 1000h 195 100356F FF3554900001 PUSH dword ptr [0x1009054] 196 1003575 FF3594900001 PUSH dword ptr [0x1009094] 197 100357B E98A030000 JMP L28 198 1003580 6A01 L27: PUSH 1 199 1003582 E888F1FFFF CALL proc_0x100270f 200 1003587 E933FFFFFF JMP L12 201 100358C E8A8040000 L25: CALL proc_0x1003a39 202 1003591 33F6 XOR esi, esi 203 1003593 56 PUSH esi 204 1003594 E876F1FFFF CALL proc_0x100270f 205 1003599 85C0 TEST eax, eax 206 100359B 0F841CFFFFFF JE L9 207 10035A1 56 PUSH esi 208 10035A2 6A02 PUSH 2 209 10035A4 FF3574900001 PUSH dword ptr [0x1009074] 210 10035AA FF3530980001 PUSH dword ptr [0x1009830] 211 10035B0 FF1528120001 CALL WinHelpW 212 10035B6 85C0 TEST eax, eax 213 10035B8 751D JNE L29 214 10035BA 6810100000 PUSH 1010h 215 10035BF FF3554900001 PUSH dword ptr [0x1009054] 216 10035C5 FF354C900001 PUSH dword ptr [0x100904c] 217 10035CB FF3530980001 PUSH dword ptr [0x1009830] 218 10035D1 FF1568120001 CALL MessageBoxW 219 10035D7 FF3534980001 L29: PUSH dword ptr [0x1009834] 220 10035DD 8B35A8110001 MOV esi, dword ptr [0x10011a8] 221 10035E3 FFD6 CALL esi 222 10035E5 FF3530980001 PUSH dword ptr [0x1009830] 223 10035EB FFD6 CALL esi 224 10035ED FF357CAB0001 PUSH dword ptr [0x100ab7c] 225 10035F3 FF1568100001 CALL DeleteObject 226 10035F9 E9BFFEFFFF JMP L9 227 10035FE 33F6 L2: XOR esi, esi 228 1003600 397510 CMP dword ptr [ebp + 0x10], esi 229 1003603 7440 JE L30 230 1003605 A15C980001 MOV eax, dword ptr [0x100985c] 231 100360A 3BC6 CMP eax, esi 232 100360C 8B0D60980001 MOV ecx, dword ptr [0x1009860] 233 1003612 7508 JNE L31 234 1003614 3BCE CMP ecx, esi 235 1003616 0F84A1FEFFFF JE L9 236 100361C 8B3D40120001 L31: MOV edi, dword ptr [0x1001240] 237 1003622 51 L32: PUSH ecx 238 1003623 50 PUSH eax 239 1003624 68B1000000 PUSH 0B1h 240 1003629 FF3538980001 PUSH dword ptr [0x1009838] 241 100362F FFD7 CALL edi 242 1003631 56 PUSH esi 243 1003632 56 PUSH esi 244 1003633 68B7000000 PUSH 0B7h 245 1003638 FF3538980001 PUSH dword ptr [0x1009838] 246 100363E FFD7 CALL edi 247 1003640 E978FEFFFF JMP L9 248 1003645 8B3D40120001 L30: MOV edi, dword ptr [0x1001240] 249 100364B 6860980001 PUSH 1009860h 250 1003650 685C980001 PUSH 100985Ch 251 1003655 68B0000000 PUSH 0B0h 252 100365A FF3538980001 PUSH dword ptr [0x1009838] 253 1003660 FFD7 CALL edi 254 1003662 A15C980001 MOV eax, dword ptr [0x100985c] 255 1003667 8B0D60980001 MOV ecx, dword ptr [0x1009860] 256 100366D 3BC1 CMP eax, ecx 257 100366F 75B1 JNE L32 258 1003671 89355C980001 MOV dword ptr [0x100985c], esi 259 1003677 893560980001 MOV dword ptr [0x1009860], esi 260 100367D E93BFEFFFF JMP L9 261 1003682 8B7D14 L1: MOV edi, dword ptr [ebp + 0x14] 262 1003685 8BC6 MOV eax, esi 263 1003687 2D11010000 SUB eax, 111h 264 100368C 0F8435020000 JE L33 265 1003692 48 DEC eax 266 1003693 0F84EA010000 JE L34 267 1003699 83E804 SUB eax, 4 268 100369C 0F84D4010000 JE L35 269 10036A2 48 DEC eax 270 10036A3 0F8499010000 JE L36 271 10036A9 2D1C010000 SUB eax, 11Ch 272 10036AE 0F847E010000 JE L37 273 10036B4 2DE6000000 SUB eax, 0E6h 274 10036B9 0F844F010000 JE L38 275 10036BF 2DE87C0000 SUB eax, 7CE8h 276 10036C4 0F8417010000 JE L39 277 JMP L8 ;Synthetic inst 278 10037E1 33F6 L39: XOR esi, esi 279 10037E3 56 PUSH esi 280 10037E4 FF15A0110001 CALL GetKeyboardLayout 281 10037EA 6625FF03 AND ax, 3FFh 282 10037EE 663D1100 CMP ax, 11h 283 10037F2 7501 JNE L40 284 10037F4 46 INC esi 285 10037F5 56 L40: PUSH esi 286 10037F6 6A01 PUSH 1 287 10037F8 68D8000000 PUSH 0D8h 288 10037FD FF3538980001 L24: PUSH dword ptr [0x1009838] 289 1003803 FF1540120001 CALL SendMessageW 290 1003809 E9AFFCFFFF JMP L9 291 100380E 8BC7 L38: MOV eax, edi 292 1003810 C1E810 SHR eax, 10h 293 1003813 6625FF0F AND ax, 0FFFh 294 1003817 663D0500 CMP ax, 5 295 100381B 0F85A6000000 JNE L33 296 1003821 6A00 PUSH 0 297 1003823 6A15 PUSH 15h 298 1003825 FF7508 PUSH dword ptr [ebp + 0x8] 299 1003828 E85AF3FFFF CALL proc_0x1002b87 300 100382D E98BFCFFFF JMP L9 301 10038C7 3B3D38980001 L33: CMP edi, dword ptr [0x1009838] 302 10038CD 754C JNE L41 303 10038CF 8B4510 MOV eax, dword ptr [ebp + 0x10] 304 10038D2 C1E810 SHR eax, 10h 305 10038D5 663D0005 CMP ax, 500h 306 10038D9 7406 JE L42 307 10038DB 663D0105 CMP ax, 501h 308 10038DF 753A JNE L41 309 10038E1 833D4898000101 L42: CMP dword ptr [0x1009848], 1 310 10038E8 750F JNE L43 311 10038EA C7054898000102000000MOV dword ptr [0x1009848], 2 312 10038F4 E9C4FBFFFF JMP L9 313 10038F9 6810100000 L43: PUSH 1010h 314 10038FE FF3554900001 PUSH dword ptr [0x1009054] 315 1003904 FF354C900001 PUSH dword ptr [0x100904c] 316 100390A FF3530980001 L28: PUSH dword ptr [0x1009830] 317 1003910 FF1568120001 CALL MessageBoxW 318 1003916 E9A2FBFFFF JMP L9 319 100391B 57 L41: PUSH edi 320 100391C FF7510 PUSH dword ptr [ebp + 0x10] 321 100391F FF7508 PUSH dword ptr [ebp + 0x8] 322 1003922 E860F2FFFF CALL proc_0x1002b87 323 1003927 85C0 TEST eax, eax 324 1003929 0F858EFBFFFF JNE L9 325 100392F 57 PUSH edi 326 1003930 E99AFEFFFF JMP L23 327 1003832 FF7508 L37: PUSH dword ptr [ebp + 0x8] 328 1003835 FF7510 PUSH dword ptr [ebp + 0x10] 329 1003838 E89FFBFFFF CALL proc_0x10033dc 330 100383D E97BFCFFFF JMP L9 331 1003842 833D4C98000100 L36: CMP dword ptr [0x100984c], 0 332 1003849 0F846EFCFFFF JE L9 333 100384F 8B4514 MOV eax, dword ptr [ebp + 0x14] 334 1003852 C1E810 SHR eax, 10h 335 1003855 6685C0 TEST ax, ax 336 1003858 0F845FFCFFFF JE L9 337 100385E 6A03 PUSH 3 338 1003860 6820F00000 PUSH 0F020h 339 1003865 FF35DCA60001 PUSH dword ptr [0x100a6dc] 340 100386B FF155C120001 CALL EnableMenuItem 341 1003871 E947FCFFFF JMP L9 342 1003876 FF7508 L35: PUSH dword ptr [ebp + 0x8] 343 1003879 E8F5E4FFFF CALL proc_0x1001d73 344 100387E E93AFCFFFF JMP L9 345 1003883 833D4C98000100 L34: CMP dword ptr [0x100984c], 0 346 100388A 8B4510 MOV eax, dword ptr [ebp + 0x10] 347 100388D 7421 JE L44 348 100388F 3D20F00000 CMP eax, 0F020h 349 1003894 0F8423FCFFFF JE L9 350 100389A 3D40F00000 CMP eax, 0F040h 351 100389F 0F8418FCFFFF JE L9 352 10038A5 3D50F00000 CMP eax, 0F050h 353 10038AA 0F840DFCFFFF JE L9 354 10038B0 FF7514 L44: PUSH dword ptr [ebp + 0x14] 355 10038B3 50 PUSH eax 356 10038B4 6812010000 PUSH 112h 357 10038B9 FF7508 PUSH dword ptr [ebp + 0x8] 358 10038BC FF15A4110001 CALL DefWindowProcW 359 10038C2 E9F6FBFFFF JMP L9 EndProc proc_0x1003429 |
Example 2:class-inherit.exe(Class inheritance)
| C Code Output of C-Decompiler | ASM Code Output of C-Decompiler |
/*
* Input file : testsample\class-inherit.exe
* File type : EXE
*/
int gVal_fs_0x0; // 0x0
class class_0 : public class_1
{
public:
class_0();
~class_0();
int proc_0x411cb0(int arg0);
int proc_0x411e10();
int m_var0
};
class class_1
{
public:
class_1();
~class_1();
};
// Proc: proc_0x411bf0
class_1::class_1()
{
int loc1;
int loc2; /* ecx */
loc1 = loc2;
printf ("A constructor\n");
return (loc1);
}
// Proc: proc_0x411d40
class_0::class_0()
{
int loc1;
int loc2; /* ecx */
int loc3; /* eax */
loc1 = loc2;
loc3 = class_1 ();
printf ("B constructor\n");
return (loc1);
}
// Proc: proc_0x411cb0
int class_0::proc_0x411cb0(int arg0)
{
int loc1;
int loc2; /* ecx */
loc1 = loc2;
this->m_var0 = arg0;
return (loc1);
}
// Proc: proc_0x411d00
int class_0::proc_0x411d00()
{
int loc1;
int loc2; /* ecx */
loc1 = loc2;
return (this->m_var0);
}
// Proc: proc_0x411e10
int class_0::proc_0x411e10()
{
int loc1;
int loc2;
int loc3; /* ecx */
int loc4; /* eax */
loc1 = loc3;
loc2 = proc_0x411d00 ();
loc4 = printf ("m_a: %d\n", loc2);
return (loc4);
}
// Proc: proc_0x411c50
class_1::~class_1()
{
int loc1;
int loc2; /* ecx */
int loc3; /* eax */
loc1 = loc2;
loc3 = printf ("A destructor\n");
return;
}
// Proc: proc_0x411db0
class_0::~class_0()
{
int loc1;
int loc2; /* ecx */
int loc3; /* eax */
loc1 = loc2;
printf ("B destructor\n");
loc3 = ~class_1 ();
return;
}
// Proc: _tmain
int _tmain(int argc, _TCHAR argv)
{
class_0 loc1;
int loc2;
int loc3;
int loc4;
int loc5; /* esp */
int loc6; /* ecx */
int loc7; /* eax */
int loc8; /* ebp */
gVal_fs_0x0 = loc5;
loc6 = &loc1;
loc7 = loc1.class_0 ();
loc2 = 0;
loc6 = &loc1;
loc7 = loc1.proc_0x411cb0 (10);
loc6 = &loc1;
loc7 = loc1.proc_0x411e10 ();
loc3 = 0;
loc2 = 0xFFFFFFFF;
loc6 = &loc1;
loc7 = loc1.~class_0 ();
loc7 = loc3;
loc6 = loc8;
gVal_fs_0x0 = loc4;
return (loc7);
}
|
BeginProc _tmain
000 411E80 55 PUSH ebp
001 411E81 8BEC MOV ebp, esp
002 411E83 6AFF PUSH 0FFFFFFFFh
003 411E85 68A85D4200 PUSH 425DA8h
004 411E8A 64A100000000 MOV eax, dword ptr fs:[0]
005 411E90 50 PUSH eax
006 411E91 64892500000000 MOV dword ptr fs:[0], esp
007 411E98 81ECD8000000 SUB esp, 0D8h
008 411E9E 53 PUSH ebx
009 411E9F 56 PUSH esi
010 411EA0 57 PUSH edi
011 411EA1 8DBD1CFFFFFF LEA edi, dword ptr [ebp - 0xe4]
012 411EA7 B936000000 MOV ecx, 36h
013 411EAC B8CCCCCCCC MOV eax, 0CCCCCCCCh
014 411EB1 F3AB REP STOSD
015 411EB3 8D4DEC LEA ecx, dword ptr [ebp - 0x14]
016 411EB6 E8ABF4FFFF CALL proc_0x411d40
017 411EBB C745FC00000000 MOV dword ptr [ebp - 0x4], 0
018 411EC2 6A0A PUSH 0Ah
019 411EC4 8D4DEC LEA ecx, dword ptr [ebp - 0x14]
020 411EC7 E816F6FFFF CALL proc_0x411cb0
021 411ECC 8D4DEC LEA ecx, dword ptr [ebp - 0x14]
022 411ECF E815F4FFFF CALL proc_0x411e10
023 411ED4 C78520FFFFFF00000000MOV dword ptr [ebp - 0xe0], 0
024 411EDE C745FCFFFFFFFF MOV dword ptr [ebp - 0x4], 0FFFFFFFFh
025 411EE5 8D4DEC LEA ecx, dword ptr [ebp - 0x14]
026 411EE8 E8CEF4FFFF CALL proc_0x411db0
027 411EED 8B8520FFFFFF MOV eax, dword ptr [ebp - 0xe0]
028 411EF3 52 PUSH edx
029 411EF4 8BCD MOV ecx, ebp
030 411EF6 50 PUSH eax
031 411EF7 8D15221F4100 LEA edx, dword ptr [0x411f22]
032 411EFD E8E3F2FFFF CALL _RTC_CheckStackVars
033 411F02 58 POP eax
034 411F03 5A POP edx
035 411F04 8B4DF4 MOV ecx, dword ptr [ebp - 0xc]
036 411F07 64890D00000000 MOV dword ptr fs:[0], ecx
037 411F0E 5F POP edi
038 411F0F 5E POP esi
039 411F10 5B POP ebx
040 411F11 81C4E4000000 ADD esp, 0E4h
041 411F17 3BEC CMP ebp, esp
042 411F19 E838F5FFFF CALL _RTC_CheckEsp
043 411F1E 8BE5 MOV esp, ebp
044 411F20 5D POP ebp
045 411F21 C3 RET
EndProc _tmain
BeginProc proc_0x411d40
000 411D40 55 PUSH ebp
001 411D41 8BEC MOV ebp, esp
002 411D43 81ECCC000000 SUB esp, 0CCh
003 411D49 53 PUSH ebx
004 411D4A 56 PUSH esi
005 411D4B 57 PUSH edi
006 411D4C 51 PUSH ecx
007 411D4D 8DBD34FFFFFF LEA edi, dword ptr [ebp - 0xcc]
008 411D53 B933000000 MOV ecx, 33h
009 411D58 B8CCCCCCCC MOV eax, 0CCCCCCCCh
010 411D5D F3AB REP STOSD
011 411D5F 59 POP ecx
012 411D60 894DF8 MOV dword ptr [ebp - 0x8], ecx
013 411D63 8B4DF8 MOV ecx, dword ptr [ebp - 0x8]
014 411D66 E831F7FFFF CALL proc_0x411bf0
015 411D6B 68EC704200 PUSH 4270ECh
016 411D70 E8FEF7FFFF CALL printf
017 411D75 83C404 ADD esp, 4
018 411D78 8B45F8 MOV eax, dword ptr [ebp - 0x8]
019 411D7B 5F POP edi
020 411D7C 5E POP esi
021 411D7D 5B POP ebx
022 411D7E 81C4CC000000 ADD esp, 0CCh
023 411D84 3BEC CMP ebp, esp
024 411D86 E8CBF6FFFF CALL _RTC_CheckEsp
025 411D8B 8BE5 MOV esp, ebp
026 411D8D 5D POP ebp
027 411D8E C3 RET
EndProc proc_0x411d40
BeginProc proc_0x411bf0
000 411BF0 55 PUSH ebp
001 411BF1 8BEC MOV ebp, esp
002 411BF3 81ECCC000000 SUB esp, 0CCh
003 411BF9 53 PUSH ebx
004 411BFA 56 PUSH esi
005 411BFB 57 PUSH edi
006 411BFC 51 PUSH ecx
007 411BFD 8DBD34FFFFFF LEA edi, dword ptr [ebp - 0xcc]
008 411C03 B933000000 MOV ecx, 33h
009 411C08 B8CCCCCCCC MOV eax, 0CCCCCCCCh
010 411C0D F3AB REP STOSD
011 411C0F 59 POP ecx
012 411C10 894DF8 MOV dword ptr [ebp - 0x8], ecx
013 411C13 68C8704200 PUSH 4270C8h
014 411C18 E856F9FFFF CALL printf
015 411C1D 83C404 ADD esp, 4
016 411C20 8B45F8 MOV eax, dword ptr [ebp - 0x8]
017 411C23 5F POP edi
018 411C24 5E POP esi
019 411C25 5B POP ebx
020 411C26 81C4CC000000 ADD esp, 0CCh
021 411C2C 3BEC CMP ebp, esp
022 411C2E E823F8FFFF CALL _RTC_CheckEsp
023 411C33 8BE5 MOV esp, ebp
024 411C35 5D POP ebp
025 411C36 C3 RET
EndProc proc_0x411bf0
BeginProc proc_0x411cb0
000 411CB0 55 PUSH ebp
001 411CB1 8BEC MOV ebp, esp
002 411CB3 81ECCC000000 SUB esp, 0CCh
003 411CB9 53 PUSH ebx
004 411CBA 56 PUSH esi
005 411CBB 57 PUSH edi
006 411CBC 51 PUSH ecx
007 411CBD 8DBD34FFFFFF LEA edi, dword ptr [ebp - 0xcc]
008 411CC3 B933000000 MOV ecx, 33h
009 411CC8 B8CCCCCCCC MOV eax, 0CCCCCCCCh
010 411CCD F3AB REP STOSD
011 411CCF 59 POP ecx
012 411CD0 894DF8 MOV dword ptr [ebp - 0x8], ecx
013 411CD3 8B45F8 MOV eax, dword ptr [ebp - 0x8]
014 411CD6 8B4D08 MOV ecx, dword ptr [ebp + 0x8]
015 411CD9 8908 MOV dword ptr [eax], ecx
016 411CDB 5F POP edi
017 411CDC 5E POP esi
018 411CDD 5B POP ebx
019 411CDE 8BE5 MOV esp, ebp
020 411CE0 5D POP ebp
021 411CE1 C20400 RET 4
EndProc proc_0x411cb0
BeginProc proc_0x411e10
000 411E10 55 PUSH ebp
001 411E11 8BEC MOV ebp, esp
002 411E13 81ECD8000000 SUB esp, 0D8h
003 411E19 53 PUSH ebx
004 411E1A 56 PUSH esi
005 411E1B 57 PUSH edi
006 411E1C 51 PUSH ecx
007 411E1D 8DBD28FFFFFF LEA edi, dword ptr [ebp - 0xd8]
008 411E23 B936000000 MOV ecx, 36h
009 411E28 B8CCCCCCCC MOV eax, 0CCCCCCCCh
010 411E2D F3AB REP STOSD
011 411E2F 59 POP ecx
012 411E30 894DF8 MOV dword ptr [ebp - 0x8], ecx
013 411E33 8B4DF8 MOV ecx, dword ptr [ebp - 0x8]
014 411E36 E86DF4FFFF CALL proc_0x411d00
015 411E3B 8945EC MOV dword ptr [ebp - 0x14], eax
016 411E3E 8B45EC MOV eax, dword ptr [ebp - 0x14]
017 411E41 50 PUSH eax
018 411E42 6810714200 PUSH 427110h
019 411E47 E827F7FFFF CALL printf
020 411E4C 83C408 ADD esp, 8
021 411E4F 5F POP edi
022 411E50 5E POP esi
023 411E51 5B POP ebx
024 411E52 81C4D8000000 ADD esp, 0D8h
025 411E58 3BEC CMP ebp, esp
026 411E5A E8F7F5FFFF CALL _RTC_CheckEsp
027 411E5F 8BE5 MOV esp, ebp
028 411E61 5D POP ebp
029 411E62 C3 RET
EndProc proc_0x411e10
BeginProc proc_0x411d00
000 411D00 55 PUSH ebp
001 411D01 8BEC MOV ebp, esp
002 411D03 81ECCC000000 SUB esp, 0CCh
003 411D09 53 PUSH ebx
004 411D0A 56 PUSH esi
005 411D0B 57 PUSH edi
006 411D0C 51 PUSH ecx
007 411D0D 8DBD34FFFFFF LEA edi, dword ptr [ebp - 0xcc]
008 411D13 B933000000 MOV ecx, 33h
009 411D18 B8CCCCCCCC MOV eax, 0CCCCCCCCh
010 411D1D F3AB REP STOSD
011 411D1F 59 POP ecx
012 411D20 894DF8 MOV dword ptr [ebp - 0x8], ecx
013 411D23 8B45F8 MOV eax, dword ptr [ebp - 0x8]
014 411D26 8B00 MOV eax, dword ptr [eax]
015 411D28 5F POP edi
016 411D29 5E POP esi
017 411D2A 5B POP ebx
018 411D2B 8BE5 MOV esp, ebp
019 411D2D 5D POP ebp
020 411D2E C3 RET
EndProc proc_0x411d00
BeginProc proc_0x411db0
000 411DB0 55 PUSH ebp
001 411DB1 8BEC MOV ebp, esp
002 411DB3 81ECCC000000 SUB esp, 0CCh
003 411DB9 53 PUSH ebx
004 411DBA 56 PUSH esi
005 411DBB 57 PUSH edi
006 411DBC 51 PUSH ecx
007 411DBD 8DBD34FFFFFF LEA edi, dword ptr [ebp - 0xcc]
008 411DC3 B933000000 MOV ecx, 33h
009 411DC8 B8CCCCCCCC MOV eax, 0CCCCCCCCh
010 411DCD F3AB REP STOSD
011 411DCF 59 POP ecx
012 411DD0 894DF8 MOV dword ptr [ebp - 0x8], ecx
013 411DD3 6800714200 PUSH 427100h
014 411DD8 E896F7FFFF CALL printf
015 411DDD 83C404 ADD esp, 4
016 411DE0 8B4DF8 MOV ecx, dword ptr [ebp - 0x8]
017 411DE3 E887F6FFFF CALL proc_0x411c50
018 411DE8 5F POP edi
019 411DE9 5E POP esi
020 411DEA 5B POP ebx
021 411DEB 81C4CC000000 ADD esp, 0CCh
022 411DF1 3BEC CMP ebp, esp
023 411DF3 E85EF6FFFF CALL _RTC_CheckEsp
024 411DF8 8BE5 MOV esp, ebp
025 411DFA 5D POP ebp
026 411DFB C3 RET
EndProc proc_0x411db0
BeginProc proc_0x411c50
000 411C50 55 PUSH ebp
001 411C51 8BEC MOV ebp, esp
002 411C53 81ECCC000000 SUB esp, 0CCh
003 411C59 53 PUSH ebx
004 411C5A 56 PUSH esi
005 411C5B 57 PUSH edi
006 411C5C 51 PUSH ecx
007 411C5D 8DBD34FFFFFF LEA edi, dword ptr [ebp - 0xcc]
008 411C63 B933000000 MOV ecx, 33h
009 411C68 B8CCCCCCCC MOV eax, 0CCCCCCCCh
010 411C6D F3AB REP STOSD
011 411C6F 59 POP ecx
012 411C70 894DF8 MOV dword ptr [ebp - 0x8], ecx
013 411C73 68DC704200 PUSH 4270DCh
014 411C78 E8F6F8FFFF CALL printf
015 411C7D 83C404 ADD esp, 4
016 411C80 5F POP edi
017 411C81 5E POP esi
018 411C82 5B POP ebx
019 411C83 81C4CC000000 ADD esp, 0CCh
020 411C89 3BEC CMP ebp, esp
021 411C8B E8C6F7FFFF CALL _RTC_CheckEsp
022 411C90 8BE5 MOV esp, ebp
023 411C92 5D POP ebp
024 411C93 C3 RET
EndProc proc_0x411c50
|
Example 3:MatrixMUL.exe
| C Code Output of C-Decompiler | ASM Code Output of C-Decompiler |
/*
* Input file : testsample\MatrixMUL.exe
* File type : EXE
*/
// Proc: _tmain
int _tmain(int argc, _TCHAR argv)
{
int loc1[2][3];
int loc2[3][2];
int loc3[2][2];
int loc4;
int loc5;
int loc6;
int loc7; /* eax */
loc1[0][0] = 1;
loc1[0][1] = 2;
loc1[0][2] = 3;
loc1[1][0] = 4;
loc1[1][1] = 5;
loc1[1][2] = 6;
loc2[0][0] = 1;
loc2[0][1] = 2;
loc2[1][0] = 3;
loc2[1][1] = 4;
loc2[2][0] = 5;
loc2[2][1] = 6;
loc3[0][0] = 0;
loc3[0][1] = 0;
loc3[1][0] = 0;
loc3[1][1] = 0;
loc4 = 0;
while ((loc4 < 2)) {
loc5 = 0;
while ((loc5 < 2)) {
loc6 = 0;
while ((loc6 < 3)) {
loc3[loc4][loc5] = ((loc1[loc4][loc6] * loc2[loc6][loc5]) + loc3[loc4][loc5]);
loc6 = (loc6 + 1);
} /* end of while */
loc5 = (loc5 + 1);
} /* end of while */
loc4 = (loc4 + 1);
} /* end of while */
loc7 = 0;
return (loc7);
}
|
BeginProc _tmain
000 411A10 55 PUSH ebp
001 411A11 8BEC MOV ebp, esp
002 411A13 81EC3C010000 SUB esp, 13Ch
003 411A19 53 PUSH ebx
004 411A1A 56 PUSH esi
005 411A1B 57 PUSH edi
006 411A1C 8DBDC4FEFFFF LEA edi, dword ptr [ebp - 0x13c]
007 411A22 B94F000000 MOV ecx, 4Fh
008 411A27 B8CCCCCCCC MOV eax, 0CCCCCCCCh
009 411A2C F3AB REP STOSD
010 411A2E C745E401000000 MOV dword ptr [ebp - 0x1c], 1
011 411A35 C745E802000000 MOV dword ptr [ebp - 0x18], 2
012 411A3C C745EC03000000 MOV dword ptr [ebp - 0x14], 3
013 411A43 C745F004000000 MOV dword ptr [ebp - 0x10], 4
014 411A4A C745F405000000 MOV dword ptr [ebp - 0xc], 5
015 411A51 C745F806000000 MOV dword ptr [ebp - 0x8], 6
016 411A58 C745C401000000 MOV dword ptr [ebp - 0x3c], 1
017 411A5F C745C802000000 MOV dword ptr [ebp - 0x38], 2
018 411A66 C745CC03000000 MOV dword ptr [ebp - 0x34], 3
019 411A6D C745D004000000 MOV dword ptr [ebp - 0x30], 4
020 411A74 C745D405000000 MOV dword ptr [ebp - 0x2c], 5
021 411A7B C745D806000000 MOV dword ptr [ebp - 0x28], 6
022 411A82 C745AC00000000 MOV dword ptr [ebp - 0x54], 0
023 411A89 C745B000000000 MOV dword ptr [ebp - 0x50], 0
024 411A90 C745B400000000 MOV dword ptr [ebp - 0x4c], 0
025 411A97 C745B800000000 MOV dword ptr [ebp - 0x48], 0
026 411A9E C745A000000000 MOV dword ptr [ebp - 0x60], 0
027 411AA5 EB09 JMP L1
028 411AA7 8B45A0 L2: MOV eax, dword ptr [ebp - 0x60]
029 411AAA 83C001 ADD eax, 1
030 411AAD 8945A0 MOV dword ptr [ebp - 0x60], eax
031 411AB0 837DA002 L1: CMP dword ptr [ebp - 0x60], 2
032 411AB4 7D6E JGE L3
033 411AB6 C7459400000000 MOV dword ptr [ebp - 0x6c], 0
034 411ABD EB09 JMP L4
035 411ABF 8B4594 L5: MOV eax, dword ptr [ebp - 0x6c]
036 411AC2 83C001 ADD eax, 1
037 411AC5 894594 MOV dword ptr [ebp - 0x6c], eax
038 411AC8 837D9402 L4: CMP dword ptr [ebp - 0x6c], 2
039 411ACC 7D54 JGE L6
040 411ACE C7458800000000 MOV dword ptr [ebp - 0x78], 0
041 411AD5 EB09 JMP L7
042 411AD7 8B4588 L8: MOV eax, dword ptr [ebp - 0x78]
043 411ADA 83C001 ADD eax, 1
044 411ADD 894588 MOV dword ptr [ebp - 0x78], eax
045 411AE0 837D8803 L7: CMP dword ptr [ebp - 0x78], 3
046 411AE4 7D3A JGE L9
047 411AE6 8B45A0 MOV eax, dword ptr [ebp - 0x60]
048 411AE9 8D4CC5AC LEA ecx, dword ptr [ebp + eax*0x8 - 0x54]
053 411AED 8B55A0 MOV edx, dword ptr [ebp - 0x60]
054 411AF0 6BD20C IMUL edx, edx, 0Ch
055 411AF3 8D4415E4 LEA eax, dword ptr [ebp + edx - 0x1c]
059 411AF7 8B5588 MOV edx, dword ptr [ebp - 0x78]
060 411AFA 8D54D5C4 LEA edx, dword ptr [ebp + edx*0x8 - 0x3c]
065 411AFE 8B7588 MOV esi, dword ptr [ebp - 0x78]
066 411B01 8B7D94 MOV edi, dword ptr [ebp - 0x6c]
067 411B04 8B04B0 MOV eax, dword ptr [eax + esi*0x4]
068 411B07 0FAF04BA IMUL eax, dword ptr [edx + edi*0x4]
069 411B0B 8B5594 MOV edx, dword ptr [ebp - 0x6c]
070 411B0E 030491 ADD eax, dword ptr [ecx + edx*0x4]
071 411B11 8B4DA0 MOV ecx, dword ptr [ebp - 0x60]
072 411B14 8D54CDAC LEA edx, dword ptr [ebp + ecx*0x8 - 0x54]
077 411B18 8B4D94 MOV ecx, dword ptr [ebp - 0x6c]
078 411B1B 89048A MOV dword ptr [edx + ecx*0x4], eax
079 411B1E EBB7 JMP L8
080 411B20 EB9D L9: JMP L5
081 411B22 EB83 L6: JMP L2
082 411B24 33C0 L3: XOR eax, eax
083 411B26 52 PUSH edx
084 411B27 8BCD MOV ecx, ebp
085 411B29 50 PUSH eax
086 411B2A 8D153E1B4100 LEA edx, dword ptr [0x411b3e]
087 411B30 E865F6FFFF CALL _RTC_CheckStackVars
088 411B35 58 POP eax
089 411B36 5A POP edx
090 411B37 5F POP edi
091 411B38 5E POP esi
092 411B39 5B POP ebx
093 411B3A 8BE5 MOV esp, ebp
094 411B3C 5D POP ebp
095 411B3D C3 RET
EndProc _tmain
|
Example 4:win32-2003debug.exe(Optimized code readability)
| C Code Output of C-Decompiler | ASM Code Output of C-Decompiler |
/*
* Input file : testsample\win32-2003debug.exe
* File type : EXE
*/
int gVal_0x4295cc; // 0x4295cc
char* gVal_0x429500; // 0x429500
char* gVal_0x429568; // 0x429568
// Proc: proc_0x411f20
LRESULT proc_0x411f20(HWND arg0, DWORD arg1, WPARAM arg2, LPARAM arg3)
{
int loc1;
int loc2;
int loc3;
PAINTSTRUCT* loc4;
int loc5;
int loc6; /* edi */
LRESULT loc7; /* eax */
loc6 = &loc1;
loc1 = arg1;
switch (loc1)
{
case 2:
PostQuitMessage (0);
goto L1;
break;
case 15:
loc5 = BeginPaint (arg0, loc4);
EndPaint (arg0, &loc4);
goto L1;
break;
case 273:
loc2 = (arg2 & 0xFFFF);
loc3 = (arg2 >> 16);
loc1 = loc2;
switch (loc1)
{
case 104:
DialogBoxParamA (gVal_0x4295cc, 103, arg0, proc_0x412110, 0);
goto L1;
break;
case 105:
DestroyWindow (arg0);
goto L1;
break;
default:
loc7 = DefWindowProcA (arg0, arg1, arg2, arg3);
goto L2;
break;
}
break;
default:
loc7 = DefWindowProcA (arg0, arg1, arg2, arg3);
goto L2;
break;
}
L1:
loc7 = 0;
L2:
return (loc7);
}
// Proc: proc_0x412110
int proc_0x412110(HWND arg0, DWORD arg1, WPARAM arg2, LPARAM arg3)
{
int loc1;
int loc2; /* edi */
INT_PTR loc3; /* eax */
loc2 = &loc1;
loc1 = arg1;
switch (loc1)
{
case 272:
loc3 = 1;
break;
case 273:
if (((arg2 & 0xFFFF) != 1) && ((arg2 & 0xFFFF) != 2)) {
loc3 = 0;
}
else {
EndDialog (arg0, (arg2 & 0xFFFF));
loc3 = 1;
}
break;
}
return (loc3);
}
// Proc: proc_0x411d00
int proc_0x411d00(HINSTANCE arg0)
{
WNDCLASSEXA* loc1;
ATOM loc2; /* eax */
loc1 = 48;
loc1->style = 3;
loc1->lpfnWndProc = proc_0x411f20;
loc1->cbClsExtra = 0;
loc1->cbWndExtra = 0;
loc1->hInstance = arg0;
loc1->hIcon = LoadIconA (arg0, 107);
loc1->hCursor = LoadCursorA (0, 0x7F00);
loc1->hbrBackground = 6;
loc1->lpszMenuName = 109;
loc1->lpszClassName = 0x429500;
loc1->hIconSm = LoadIconA (loc1->hInstance, 108);
loc2 = RegisterClassExA (&loc1);
return (loc2);
}
// Proc: proc_0x411e40
int proc_0x411e40(HINSTANCE arg0, int arg1)
{
HWND loc1;
int loc2; /* eax */
gVal_0x4295cc = arg0;
loc1 = CreateWindowExA (0, gVal_0x429500, gVal_0x429568, 0xCF0000, 0x80000000, 0, 0x80000000, 0, 0, 0, arg0, 0);
if (loc1 == 0) {
loc2 = 0;
}
else {
ShowWindow (loc1, arg1);
UpdateWindow (loc1);
loc2 = 1;
}
return (loc2);
}
// Proc: _tWinMain
int _tWinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPTSTR lpCmdLine, int nCmdShow)
{
HWND loc1;
MSG* loc2;
int loc3; /* eax */
LoadStringA (hInstance, 103, gVal_0x429568, 100);
LoadStringA (hInstance, 109, gVal_0x429500, 100);
proc_0x411d00 (hInstance);
if (proc_0x411e40 (hInstance, nCmdShow) == 0) {
loc3 = 0;
}
else {
loc1 = LoadAcceleratorsA (hInstance, 109);
while ((GetMessageA (loc2, 0, 0, 0) != 0)) {
if (TranslateAcceleratorA (loc2, loc1, loc2) == 0) {
TranslateMessage (&loc2);
DispatchMessageA (&loc2);
}
} /* end of while */
loc3 = loc2->wParam;
}
return (loc3);
}
|
BeginProc _tWinMain
000 411B70 55 PUSH ebp
001 411B71 8BEC MOV ebp, esp
002 411B73 81ECF0000000 SUB esp, 0F0h
003 411B79 53 PUSH ebx
004 411B7A 56 PUSH esi
005 411B7B 57 PUSH edi
006 411B7C 8DBD10FFFFFF LEA edi, dword ptr [ebp - 0xf0]
007 411B82 B93C000000 MOV ecx, 3Ch
008 411B87 B8CCCCCCCC MOV eax, 0CCCCCCCCh
009 411B8C F3AB REP STOSD
010 411B8E 8BF4 MOV esi, esp
011 411B90 6A64 PUSH 64h
012 411B92 6868954200 PUSH 429568h
013 411B97 6A67 PUSH 67h
014 411B99 8B4508 MOV eax, dword ptr [ebp + 0x8]
015 411B9C 50 PUSH eax
016 411B9D FF159CC34200 CALL LoadStringA
017 411BA3 3BF4 CMP esi, esp
018 411BA5 E875F8FFFF CALL _RTC_CheckEsp
019 411BAA 8BF4 MOV esi, esp
020 411BAC 6A64 PUSH 64h
021 411BAE 6800954200 PUSH 429500h
022 411BB3 6A6D PUSH 6Dh
023 411BB5 8B4508 MOV eax, dword ptr [ebp + 0x8]
024 411BB8 50 PUSH eax
025 411BB9 FF159CC34200 CALL LoadStringA
026 411BBF 3BF4 CMP esi, esp
027 411BC1 E859F8FFFF CALL _RTC_CheckEsp
028 411BC6 8B4508 MOV eax, dword ptr [ebp + 0x8]
029 411BC9 50 PUSH eax
030 411BCA E8C7F9FFFF CALL proc_0x411d00
031 411BCF 83C404 ADD esp, 4
032 411BD2 8B4514 MOV eax, dword ptr [ebp + 0x14]
033 411BD5 50 PUSH eax
034 411BD6 8B4D08 MOV ecx, dword ptr [ebp + 0x8]
035 411BD9 51 PUSH ecx
036 411BDA E85AF7FFFF CALL proc_0x411e40
037 411BDF 83C408 ADD esp, 8
038 411BE2 85C0 TEST eax, eax
039 411BE4 7504 JNE L1
040 411BE6 33C0 XOR eax, eax
041 411BE8 EB7F JMP L2
042 411BEA 8BF4 L1: MOV esi, esp
043 411BEC 6A6D PUSH 6Dh
044 411BEE 8B4508 MOV eax, dword ptr [ebp + 0x8]
045 411BF1 50 PUSH eax
046 411BF2 FF15A0C34200 CALL LoadAcceleratorsA
047 411BF8 3BF4 CMP esi, esp
048 411BFA E820F8FFFF CALL _RTC_CheckEsp
049 411BFF 8945D4 MOV dword ptr [ebp - 0x2c], eax
050 411C02 8BF4 L3: MOV esi, esp
051 411C04 6A00 PUSH 0
052 411C06 6A00 PUSH 0
053 411C08 6A00 PUSH 0
054 411C0A 8D45E0 LEA eax, dword ptr [ebp - 0x20]
055 411C0D 50 PUSH eax
056 411C0E FF15A4C34200 CALL GetMessageA
057 411C14 3BF4 CMP esi, esp
058 411C16 E804F8FFFF CALL _RTC_CheckEsp
059 411C1B 85C0 TEST eax, eax
060 411C1D 7447 JE L4
061 411C1F 8BF4 MOV esi, esp
062 411C21 8D45E0 LEA eax, dword ptr [ebp - 0x20]
063 411C24 50 PUSH eax
064 411C25 8B4DD4 MOV ecx, dword ptr [ebp - 0x2c]
065 411C28 51 PUSH ecx
066 411C29 8B55E0 MOV edx, dword ptr [ebp - 0x20]
067 411C2C 52 PUSH edx
068 411C2D FF15A8C34200 CALL TranslateAcceleratorA
069 411C33 3BF4 CMP esi, esp
070 411C35 E8E5F7FFFF CALL _RTC_CheckEsp
071 411C3A 85C0 TEST eax, eax
072 411C3C 7526 JNE L5
073 411C3E 8BF4 MOV esi, esp
074 411C40 8D45E0 LEA eax, dword ptr [ebp - 0x20]
075 411C43 50 PUSH eax
076 411C44 FF15ACC34200 CALL TranslateMessage
077 411C4A 3BF4 CMP esi, esp
078 411C4C E8CEF7FFFF CALL _RTC_CheckEsp
079 411C51 8BF4 MOV esi, esp
080 411C53 8D45E0 LEA eax, dword ptr [ebp - 0x20]
081 411C56 50 PUSH eax
082 411C57 FF15B0C34200 CALL DispatchMessageA
083 411C5D 3BF4 CMP esi, esp
084 411C5F E8BBF7FFFF CALL _RTC_CheckEsp
085 411C64 EB9C L5: JMP L3
086 411C66 8B45E8 L4: MOV eax, dword ptr [ebp - 0x18]
087 411C69 52 L2: PUSH edx
088 411C6A 8BCD MOV ecx, ebp
089 411C6C 50 PUSH eax
090 411C6D 8D15901C4100 LEA edx, dword ptr [0x411c90]
091 411C73 E859F5FFFF CALL _RTC_CheckStackVars
092 411C78 58 POP eax
093 411C79 5A POP edx
094 411C7A 5F POP edi
095 411C7B 5E POP esi
096 411C7C 5B POP ebx
097 411C7D 81C4F0000000 ADD esp, 0F0h
098 411C83 3BEC CMP ebp, esp
099 411C85 E895F7FFFF CALL _RTC_CheckEsp
100 411C8A 8BE5 MOV esp, ebp
101 411C8C 5D POP ebp
102 411C8D C21000 RET 10h
EndProc _tWinMain
BeginProc proc_0x411d00
000 411D00 55 PUSH ebp
001 411D01 8BEC MOV ebp, esp
002 411D03 81ECF8000000 SUB esp, 0F8h
003 411D09 53 PUSH ebx
004 411D0A 56 PUSH esi
005 411D0B 57 PUSH edi
006 411D0C 8DBD08FFFFFF LEA edi, dword ptr [ebp - 0xf8]
007 411D12 B93E000000 MOV ecx, 3Eh
008 411D17 B8CCCCCCCC MOV eax, 0CCCCCCCCh
009 411D1C F3AB REP STOSD
010 411D1E C745CC30000000 MOV dword ptr [ebp - 0x34], 30h
011 411D25 C745D003000000 MOV dword ptr [ebp - 0x30], 3
012 411D2C C745D442144100 MOV dword ptr [ebp - 0x2c], 411442h
013 411D33 C745D800000000 MOV dword ptr [ebp - 0x28], 0
014 411D3A C745DC00000000 MOV dword ptr [ebp - 0x24], 0
015 411D41 8B4508 MOV eax, dword ptr [ebp + 0x8]
016 411D44 8945E0 MOV dword ptr [ebp - 0x20], eax
017 411D47 8BF4 MOV esi, esp
018 411D49 6A6B PUSH 6Bh
019 411D4B 8B4508 MOV eax, dword ptr [ebp + 0x8]
020 411D4E 50 PUSH eax
021 411D4F FF1590C34200 CALL LoadIconA
022 411D55 3BF4 CMP esi, esp
023 411D57 E8C3F6FFFF CALL _RTC_CheckEsp
024 411D5C 8945E4 MOV dword ptr [ebp - 0x1c], eax
025 411D5F 8BF4 MOV esi, esp
026 411D61 68007F0000 PUSH 7F00h
027 411D66 6A00 PUSH 0
028 411D68 FF1594C34200 CALL LoadCursorA
029 411D6E 3BF4 CMP esi, esp
030 411D70 E8AAF6FFFF CALL _RTC_CheckEsp
031 411D75 8945E8 MOV dword ptr [ebp - 0x18], eax
032 411D78 C745EC06000000 MOV dword ptr [ebp - 0x14], 6
033 411D7F C745F06D000000 MOV dword ptr [ebp - 0x10], 6Dh
034 411D86 C745F400954200 MOV dword ptr [ebp - 0xc], 429500h
035 411D8D 8BF4 MOV esi, esp
036 411D8F 6A6C PUSH 6Ch
037 411D91 8B45E0 MOV eax, dword ptr [ebp - 0x20]
038 411D94 50 PUSH eax
039 411D95 FF1590C34200 CALL LoadIconA
040 411D9B 3BF4 CMP esi, esp
041 411D9D E87DF6FFFF CALL _RTC_CheckEsp
042 411DA2 8945F8 MOV dword ptr [ebp - 0x8], eax
043 411DA5 8BF4 MOV esi, esp
044 411DA7 8D45CC LEA eax, dword ptr [ebp - 0x34]
045 411DAA 50 PUSH eax
046 411DAB FF1598C34200 CALL RegisterClassExA
047 411DB1 3BF4 CMP esi, esp
048 411DB3 E867F6FFFF CALL _RTC_CheckEsp
049 411DB8 52 PUSH edx
050 411DB9 8BCD MOV ecx, ebp
051 411DBB 50 PUSH eax
052 411DBC 8D15DD1D4100 LEA edx, dword ptr [0x411ddd]
053 411DC2 E80AF4FFFF CALL _RTC_CheckStackVars
054 411DC7 58 POP eax
055 411DC8 5A POP edx
056 411DC9 5F POP edi
057 411DCA 5E POP esi
058 411DCB 5B POP ebx
059 411DCC 81C4F8000000 ADD esp, 0F8h
060 411DD2 3BEC CMP ebp, esp
061 411DD4 E846F6FFFF CALL _RTC_CheckEsp
062 411DD9 8BE5 MOV esp, ebp
063 411DDB 5D POP ebp
064 411DDC C3 RET
EndProc proc_0x411d00
BeginProc proc_0x411e40
000 411E40 55 PUSH ebp
001 411E41 8BEC MOV ebp, esp
002 411E43 81ECCC000000 SUB esp, 0CCh
003 411E49 53 PUSH ebx
004 411E4A 56 PUSH esi
005 411E4B 57 PUSH edi
006 411E4C 8DBD34FFFFFF LEA edi, dword ptr [ebp - 0xcc]
007 411E52 B933000000 MOV ecx, 33h
008 411E57 B8CCCCCCCC MOV eax, 0CCCCCCCCh
009 411E5C F3AB REP STOSD
010 411E5E 8B4508 MOV eax, dword ptr [ebp + 0x8]
011 411E61 A3CC954200 MOV dword ptr [0x4295cc], eax
012 411E66 8BF4 MOV esi, esp
013 411E68 6A00 PUSH 0
014 411E6A 8B4508 MOV eax, dword ptr [ebp + 0x8]
015 411E6D 50 PUSH eax
016 411E6E 6A00 PUSH 0
017 411E70 6A00 PUSH 0
018 411E72 6A00 PUSH 0
019 411E74 6800000080 PUSH 80000000h
020 411E79 6A00 PUSH 0
021 411E7B 6800000080 PUSH 80000000h
022 411E80 680000CF00 PUSH 0CF0000h
023 411E85 6868954200 PUSH 429568h
024 411E8A 6800954200 PUSH 429500h
025 411E8F 6A00 PUSH 0
026 411E91 FF1584C34200 CALL CreateWindowExA
027 411E97 3BF4 CMP esi, esp
028 411E99 E881F5FFFF CALL _RTC_CheckEsp
029 411E9E 8945F8 MOV dword ptr [ebp - 0x8], eax
030 411EA1 837DF800 CMP dword ptr [ebp - 0x8], 0
031 411EA5 7504 JNE L1
032 411EA7 33C0 XOR eax, eax
033 411EA9 EB2F JMP L2
034 411EAB 8BF4 L1: MOV esi, esp
035 411EAD 8B450C MOV eax, dword ptr [ebp + 0xc]
036 411EB0 50 PUSH eax
037 411EB1 8B4DF8 MOV ecx, dword ptr [ebp - 0x8]
038 411EB4 51 PUSH ecx
039 411EB5 FF1588C34200 CALL ShowWindow
040 411EBB 3BF4 CMP esi, esp
041 411EBD E85DF5FFFF CALL _RTC_CheckEsp
042 411EC2 8BF4 MOV esi, esp
043 411EC4 8B45F8 MOV eax, dword ptr [ebp - 0x8]
044 411EC7 50 PUSH eax
045 411EC8 FF158CC34200 CALL UpdateWindow
046 411ECE 3BF4 CMP esi, esp
047 411ED0 E84AF5FFFF CALL _RTC_CheckEsp
048 411ED5 B801000000 MOV eax, 1
049 411EDA 5F L2: POP edi
050 411EDB 5E POP esi
051 411EDC 5B POP ebx
052 411EDD 81C4CC000000 ADD esp, 0CCh
053 411EE3 3BEC CMP ebp, esp
054 411EE5 E835F5FFFF CALL _RTC_CheckEsp
055 411EEA 8BE5 MOV esp, ebp
056 411EEC 5D POP ebp
057 411EED C3 RET
EndProc proc_0x411e40
BeginProc proc_0x411f20
000 411F20 55 PUSH ebp
001 411F21 8BEC MOV ebp, esp
002 411F23 81EC30010000 SUB esp, 130h
003 411F29 53 PUSH ebx
004 411F2A 56 PUSH esi
005 411F2B 57 PUSH edi
006 411F2C 8DBDD0FEFFFF LEA edi, dword ptr [ebp - 0x130]
007 411F32 B94C000000 MOV ecx, 4Ch
008 411F37 B8CCCCCCCC MOV eax, 0CCCCCCCCh
009 411F3C F3AB REP STOSD
010 411F3E 8B450C MOV eax, dword ptr [ebp + 0xc]
011 411F41 8985D0FEFFFF MOV dword ptr [ebp - 0x130], eax
012 411F47 83BDD0FEFFFF02 CMP dword ptr [ebp - 0x130], 2
013 411F4E 0F84E5000000 JE L1
014 411F54 83BDD0FEFFFF0F CMP dword ptr [ebp - 0x130], 0Fh
015 411F5B 0F84A5000000 JE L2
016 411F61 81BDD0FEFFFF11010000CMP dword ptr [ebp - 0x130], 111h
017 411F6B 7405 JE L3
018 411F6D E9DA000000 JMP L4
019 411F72 8B4510 L3: MOV eax, dword ptr [ebp + 0x10]
020 411F75 25FFFF0000 AND eax, 0FFFFh
021 411F7A 0FB7C8 MOVZX ecx, eax
022 411F7D 894DF8 MOV dword ptr [ebp - 0x8], ecx
023 411F80 8B4510 MOV eax, dword ptr [ebp + 0x10]
024 411F83 C1E810 SHR eax, 10h
025 411F86 0FB7C8 MOVZX ecx, eax
026 411F89 894DEC MOV dword ptr [ebp - 0x14], ecx
027 411F8C 8B45F8 MOV eax, dword ptr [ebp - 0x8]
028 411F8F 8985D0FEFFFF MOV dword ptr [ebp - 0x130], eax
029 411F95 83BDD0FEFFFF68 CMP dword ptr [ebp - 0x130], 68h
030 411F9C 740B JE L5
031 411F9E 83BDD0FEFFFF69 CMP dword ptr [ebp - 0x130], 69h
032 411FA5 7427 JE L6
033 411FA7 EB3A JMP L7
034 411FA9 8BF4 L5: MOV esi, esp
035 411FAB 6A00 PUSH 0
036 411FAD 6834134100 PUSH 411334h
037 411FB2 8B4508 MOV eax, dword ptr [ebp + 0x8]
038 411FB5 50 PUSH eax
039 411FB6 6A67 PUSH 67h
040 411FB8 8B0DCC954200 MOV ecx, dword ptr [0x4295cc]
041 411FBE 51 PUSH ecx
042 411FBF FF156CC34200 CALL DialogBoxParamA
043 411FC5 3BF4 CMP esi, esp
044 411FC7 E853F4FFFF CALL _RTC_CheckEsp
045 411FCC EB36 JMP L8
046 411FCE 8BF4 L6: MOV esi, esp
047 411FD0 8B4508 MOV eax, dword ptr [ebp + 0x8]
048 411FD3 50 PUSH eax
049 411FD4 FF1570C34200 CALL DestroyWindow
050 411FDA 3BF4 CMP esi, esp
051 411FDC E83EF4FFFF CALL _RTC_CheckEsp
052 411FE1 EB21 JMP L8
053 411FE3 8BF4 L7: MOV esi, esp
054 411FE5 8B4514 MOV eax, dword ptr [ebp + 0x14]
055 411FE8 50 PUSH eax
056 411FE9 8B4D10 MOV ecx, dword ptr [ebp + 0x10]
057 411FEC 51 PUSH ecx
058 411FED 8B550C MOV edx, dword ptr [ebp + 0xc]
059 411FF0 52 PUSH edx
060 411FF1 8B4508 MOV eax, dword ptr [ebp + 0x8]
061 411FF4 50 PUSH eax
062 411FF5 FF1574C34200 CALL DefWindowProcA
063 411FFB 3BF4 CMP esi, esp
064 411FFD E81DF4FFFF CALL _RTC_CheckEsp
065 412002 EB6B JMP L9
066 412004 EB67 L8: JMP L10
067 412006 8BF4 L2: MOV esi, esp
068 412008 8D45A4 LEA eax, dword ptr [ebp - 0x5c]
069 41200B 50 PUSH eax
070 41200C 8B4D08 MOV ecx, dword ptr [ebp + 0x8]
071 41200F 51 PUSH ecx
072 412010 FF1578C34200 CALL BeginPaint
073 412016 3BF4 CMP esi, esp
074 412018 E802F4FFFF CALL _RTC_CheckEsp
075 41201D 894598 MOV dword ptr [ebp - 0x68], eax
076 412020 8BF4 MOV esi, esp
077 412022 8D45A4 LEA eax, dword ptr [ebp - 0x5c]
078 412025 50 PUSH eax
079 412026 8B4D08 MOV ecx, dword ptr [ebp + 0x8]
080 412029 51 PUSH ecx
081 41202A FF157CC34200 CALL EndPaint
082 412030 3BF4 CMP esi, esp
083 412032 E8E8F3FFFF CALL _RTC_CheckEsp
084 412037 EB34 JMP L10
085 412039 8BF4 L1: MOV esi, esp
086 41203B 6A00 PUSH 0
087 41203D FF1580C34200 CALL PostQuitMessage
088 412043 3BF4 CMP esi, esp
089 412045 E8D5F3FFFF CALL _RTC_CheckEsp
090 41204A EB21 JMP L10
091 41204C 8BF4 L4: MOV esi, esp
092 41204E 8B4514 MOV eax, dword ptr [ebp + 0x14]
093 412051 50 PUSH eax
094 412052 8B4D10 MOV ecx, dword ptr [ebp + 0x10]
095 412055 51 PUSH ecx
096 412056 8B550C MOV edx, dword ptr [ebp + 0xc]
097 412059 52 PUSH edx
098 41205A 8B4508 MOV eax, dword ptr [ebp + 0x8]
099 41205D 50 PUSH eax
100 41205E FF1574C34200 CALL DefWindowProcA
101 412064 3BF4 CMP esi, esp
102 412066 E8B4F3FFFF CALL _RTC_CheckEsp
103 41206B EB02 JMP L9
104 41206D 33C0 L10: XOR eax, eax
105 41206F 52 L9: PUSH edx
106 412070 8BCD MOV ecx, ebp
107 412072 50 PUSH eax
108 412073 8D1596204100 LEA edx, dword ptr [0x412096]
109 412079 E853F1FFFF CALL _RTC_CheckStackVars
110 41207E 58 POP eax
111 41207F 5A POP edx
112 412080 5F POP edi
113 412081 5E POP esi
114 412082 5B POP ebx
115 412083 81C430010000 ADD esp, 130h
116 412089 3BEC CMP ebp, esp
117 41208B E88FF3FFFF CALL _RTC_CheckEsp
118 412090 8BE5 MOV esp, ebp
119 412092 5D POP ebp
120 412093 C21000 RET 10h
EndProc proc_0x411f20
BeginProc proc_0x412110
000 412110 55 PUSH ebp
001 412111 8BEC MOV ebp, esp
002 412113 81ECC4000000 SUB esp, 0C4h
003 412119 53 PUSH ebx
004 41211A 56 PUSH esi
005 41211B 57 PUSH edi
006 41211C 8DBD3CFFFFFF LEA edi, dword ptr [ebp - 0xc4]
007 412122 B931000000 MOV ecx, 31h
008 412127 B8CCCCCCCC MOV eax, 0CCCCCCCCh
009 41212C F3AB REP STOSD
010 41212E 8B450C MOV eax, dword ptr [ebp + 0xc]
011 412131 89853CFFFFFF MOV dword ptr [ebp - 0xc4], eax
012 412137 81BD3CFFFFFF10010000CMP dword ptr [ebp - 0xc4], 110h
013 412141 740E JE L1
014 412143 81BD3CFFFFFF11010000CMP dword ptr [ebp - 0xc4], 111h
015 41214D 7409 JE L2
016 41214F EB4D JMP L3
017 412151 B801000000 L1: MOV eax, 1
018 412156 EB48 JMP L4
019 412158 8B4510 L2: MOV eax, dword ptr [ebp + 0x10]
020 41215B 25FFFF0000 AND eax, 0FFFFh
021 412160 0FB7C8 MOVZX ecx, eax
022 412163 83F901 CMP ecx, 1
023 412166 7410 JE L5
024 412168 8B4510 MOV eax, dword ptr [ebp + 0x10]
025 41216B 25FFFF0000 AND eax, 0FFFFh
026 412170 0FB7C8 MOVZX ecx, eax
027 412173 83F902 CMP ecx, 2
028 412176 7526 JNE L3
029 412178 8B4510 L5: MOV eax, dword ptr [ebp + 0x10]
030 41217B 25FFFF0000 AND eax, 0FFFFh
031 412180 0FB7C8 MOVZX ecx, eax
032 412183 8BF4 MOV esi, esp
033 412185 51 PUSH ecx
034 412186 8B5508 MOV edx, dword ptr [ebp + 0x8]
035 412189 52 PUSH edx
036 41218A FF1568C34200 CALL EndDialog
037 412190 3BF4 CMP esi, esp
038 412192 E888F2FFFF CALL _RTC_CheckEsp
039 412197 B801000000 MOV eax, 1
040 41219C EB02 JMP L4
041 41219E 33C0 L3: XOR eax, eax
042 4121A0 5F L4: POP edi
043 4121A1 5E POP esi
044 4121A2 5B POP ebx
045 4121A3 81C4C4000000 ADD esp, 0C4h
046 4121A9 3BEC CMP ebp, esp
047 4121AB E86FF2FFFF CALL _RTC_CheckEsp
048 4121B0 8BE5 MOV esp, ebp
049 4121B2 5D POP ebp
050 4121B3 C21000 RET 10h
EndProc proc_0x412110
|