Function at 0x10001b78
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0xd0
mov eax, dword [sym.imp.USER32.dll_InSendMessage]
call eax
lea ecx, [esp + 0x88]
mov edx, dword [sym.imp.KERNEL32.dll_GetOEMCP]
mov dword [esp + 0x84], eax
mov dword [esp + 0x80], ecx
call edx
xor ecx, ecx
lea edx, [esp + 0x98]
lea esi, [esp + 0xb0]
mov dword [esp + 0x7c], eax
mov dword [esp + 0x78], edx
mov dword [esp + 0x74], esi
mov dword [esp + 0x70], ecx
jmp 0x10001c36
lea esp, [ebp - 4]
pop esi
pop ebp
ret
mov eax, dword [esp + 0x6c]
add eax, 1
mov ecx, esp
mov dword [ecx + 0xc], 0x208
mov dword [ecx + 8], 0x74e
mov dword [ecx + 4], 0x101886da
mov dword [ecx], 0x101886da
mov dword [esp + 0x68], eax
call sub.OLEAUT32.dll_VarR8Pow
sub esp, 0x10
mov ecx, dword [esp + 0x68]
cmp ecx, 0x118
mov dword [esp + 0x64], eax
mov dword [esp + 0x70], ecx
je 0x10001bcb
jmp 0x10001c36
mov eax, dword [esp + 0x60]
add eax, 1
cmp eax, 0x312
mov dword [esp + 0x5c], eax
je 0x10001d8c
jmp 0x10001d3b
mov eax, dword [esp + 0x70]
mov ecx, esp
mov dword [ecx + 8], 0x3224e9
mov dword [ecx + 4], 0xe8daa1
mov dword [ecx], 0x74b4e9
mov ecx, dword [sym.imp.GDI32.dll_FillRgn]
mov dword [esp + 0x6c], eax
call ecx
sub esp, 0xc
xor ecx, ecx
mov edx, 0x18
mov esi, dword [esp + 0x74]
mov dword [esp], esi
mov dword [esp + 4], 0
mov dword [esp + 8], 0x18
mov dword [esp + 0x58], eax
mov dword [esp + 0x54], ecx
mov dword [esp + 0x50], edx
call fcn.1013e780
mov eax, esp
lea ecx, [esp + 0xb0]
mov dword [eax], ecx
mov eax, dword [sym.imp.GDI32.dll_CreateBitmapIndirect]
call eax
sub esp, 4
xor ecx, ecx
mov edx, 0x14
mov esi, dword [esp + 0x78]
mov dword [esp], esi
mov dword [esp + 4], 0
mov dword [esp + 8], 0x14
mov dword [esp + 0x4c], eax
mov dword [esp + 0x48], ecx
mov dword [esp + 0x44], edx
call fcn.1013e780
mov dword [esp + 0x94], 0x6cd
mov eax, esp
lea ecx, [esp + 0x94]
mov dword [eax + 8], ecx
lea ecx, [esp + 0x98]
mov dword [eax + 4], ecx
mov dword [eax], 0x58e119
mov eax, dword [sym.imp.ADVAPI32.dll_PrivilegeCheck]
call eax
sub esp, 0xc
mov ecx, esp
mov dword [ecx], 0x841604
mov ecx, dword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [esp + 0x40], eax
call ecx
sub esp, 4
mov ecx, esp
mov dword [ecx], 0xb1e58c
mov ecx, dword [sym.imp.SHLWAPI.dll_SHRegCloseUSKey]
mov dword [esp + 0x3c], eax
call ecx
sub esp, 4
xor ecx, ecx
mov dword [esp + 0x38], eax
mov dword [esp + 0x5c], ecx
mov eax, dword [esp + 0x5c]
mov ecx, 0xd
mov dword [esp + 0x60], eax
xor edx, edx
div ecx
cmp edx, 3
jne 0x10001c19
mov dword [esp + 0x8c], 0
mov dword [esp + 0x88], 0
mov eax, esp
mov ecx, dword [esp + 0x80]
mov dword [eax], ecx
mov eax, dword [sym.imp.GDI32.dll_CreatePalette]
call eax
sub esp, 4
mov dword [esp + 0x34], eax
jmp 0x10001c19
mov eax, dword [esp + 0x6c]
sub eax, 0xb
mov dword [esp + 0x30], eax
je 0x10001e0e
jmp 0x10001d9b
mov eax, dword [esp + 0x6c]
sub eax, 0x64
mov dword [esp + 0x2c], eax
jne 0x10001bd1
jmp 0x10001dae
mov eax, esp
mov dword [eax], 0xec9368
mov eax, dword [sym.imp.USER32.dll_DestroyMenu]
call eax
sub esp, 4
mov ecx, esp
mov dword [ecx + 0x10], 0x430872
mov dword [ecx + 0xc], 0x430872
mov dword [ecx + 8], 0xcd4
mov dword [ecx + 4], 0xa41
mov dword [ecx], 0x6db48f
mov ecx, dword [sym.imp.USER32.dll_SetMenuItemBitmaps]
mov dword [esp + 0x28], eax
call ecx
sub esp, 0x14
mov ecx, esp
mov dword [ecx], 0xdeed37
mov ecx, dword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov dword [esp + 0x24], eax
call ecx
sub esp, 4
mov dword [esp + 0x20], eax
mov eax, esp
mov dword [eax + 4], 0xa3e
mov dword [eax], 0x777
mov eax, dword [sym.imp.KERNEL32.dll_SetSystemTimeAdjustment]
call eax
sub esp, 8
mov ecx, esp
mov dword [ecx], 0x75a896
mov ecx, dword [sym.imp.KERNEL32.dll_ClearCommBreak]
mov dword [esp + 0x1c], eax
call ecx
sub esp, 4
mov ecx, esp
mov dword [ecx], 0xe1d828
mov ecx, dword [sym.imp.USER32.dll_DestroyMenu]
mov dword [esp + 0x18], eax
call ecx
sub esp, 4
mov dword [esp + 0x14], eax
jmp 0x10001bd1