Function at 0x10016964
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10082763
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1e0
push ebx
push esi
push edi
xor edi, edi
mov dword [esp + 0x14], 0xe0a8eac8
push 0
mov dword [esp + 0xac], edx
inc edi
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x18], 0x17
pop ebx
jmp 0x10016afc
mov dword [esp + 0x24], 4
mov dword [esp + 0x24], ebx
jmp 0x100169c8
mov eax, dword [esp + 0x24]
mov dword [esp + eax*4 + 0x44], edi
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 2
jl 0x100169bc
mov dword [esp + 0x24], edi
cmp dword [esp + 0x24], ebx
jl 0x10016af8
mov dword [esp + 0x18], 0xff63588c
mov dword [esp + 0x20], ebx
jmp 0x100169fb
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x34], 0xffffffff
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edi
jl 0x100169eb
mov dword [esp + 0x34], edi
cmp dword [esp + 0x34], ebx
jl 0x10016aee
push edi
lea ecx, [esp + 0x58]
call fcn.10014aaf
mov dword [esp + 0x20], ebx
jmp 0x10016a32
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x54]
mov dword [eax + ecx*4], 0x6b471dfd
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edi
jl 0x10016a1f
mov eax, dword [esp + 0x54]
mov dword [eax], edi
mov dword [esp + 0x20], 0xe864896
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10016a65
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateHalftonePalette]
mov dword [esp + 0x20], edi
cmp dword [esp + 0x20], ebx
jl 0x10016ac7
mov eax, dword [esp + 0x24]
xor edx, edx
mov ecx, dword [esp + eax*4 + 0x44]
mov eax, dword [esp + 0x20]
cmp ecx, eax
mov eax, dword [esp + 0x34]
setne dl
xor ecx, ecx
mov eax, dword [esp + eax*4 + 0x44]
imul edx, eax
mov eax, dword [esp + 0x20]
cmp edx, eax
mov eax, 0x92bb6a18
setne cl
sub eax, ecx
mov dword [esp + 0x18], eax
mov dword [esp + 0x18], ebx
jmp 0x10016abb
mov eax, dword [esp + 0x54]
mov ecx, dword [eax]
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x44], ecx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jle 0x10016aa9
dec dword [esp + 0x20]
jns 0x10016a6f
mov eax, dword [esp + 0x54]
dec dword [eax]
jns 0x10016a3e
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x54]
cmp dword [esp + eax*4 + 0x44], ebx
call fcn.100152cc
dec dword [esp + 0x34]
jns 0x10016a0f
dec dword [esp + 0x24]
jns 0x100169dd
dec dword [esp + 0x14]
cmp dword [esp + 0x14], edi
je 0x100169ae
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10016b18
push ebx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [esp + 0x20], 0x327cb3f4
mov dword [esp + 0x24], 0x52061f66
mov dword [esp + 0x14], 0xfc558bac
mov dword [esp + 0x1c], 0x86ba47c9
mov dword [esp + 0x14], 0x2b2e5f58
mov dword [esp + 0x14], 0x38d679bd
mov dword [esp + 0x14], ebx
jmp 0x10016b5a
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x2c], ebx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x10016b4e
dec dword [esp + 0x1c]
xor ecx, ecx
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x14], 0xfffffff6
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x24], eax
mov dword [esp + 0x14], 0x1ecb
mov eax, dword [esp + 0x14]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
cmp ecx, eax
mov eax, dword [esp + 0x2c]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp eax, ecx
mov eax, dword [esp + 0x1c]
setl dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
cmp ecx, 0x55adb51f
mov ecx, dword [esp + 0x24]
setl al
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x18], 5
mov dword [esp + 0x20], 0xc1188e17
mov dword [esp + 0x14], ebx
jmp 0x10016c12
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x3c], 0xfffffffa
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x10016c02
mov eax, dword [esp + 0x3c]
xor ecx, ecx
push 0xfffffffffffffff7
pop edx
mov dword [esp + 0x3c], edx
mov eax, dword [esp + 0x18]
cmp eax, edx
push 0xfffffffffffffffe
setg cl
imul ecx, dword [esp + 0x1c]
pop esi
mov dword [esp + 0x18], ecx
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [esp + 0x20], ecx
je 0x10016cc0
mov dword [esp + 0x1c], 0xc3203bd6
mov dword [esp + 0x14], ebx
jmp 0x10016c6d
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x9c], esi
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x10016c5e
xor ecx, ecx
mov dword [esp + 0x1c], 0x43c6fe23
mov eax, dword [esp + 0x9c]
cmp eax, 0x2530
mov eax, dword [esp + 0x9c]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x1c]
sete dl
dec eax
neg eax
sbb eax, eax
xor ecx, ecx
neg eax
add eax, 0xe6825540
add eax, edx
cmp eax, 0x53b1
setne cl
mov dword [esp + 0x9c], ecx
jmp 0x10016d0b
mov dword [esp + 0x18], ebx
jmp 0x10016cd6
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x3c], 0x82104667
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jl 0x10016cc6
mov dword [esp + 0x20], ebx
jmp 0x10016d04
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10016d00
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
dec dword [esp + 0x20]
cmp dword [esp + 0x20], 0xffffffeb
jle 0x10016ce3
mov eax, dword [esp + 0x3c]
lea ecx, [esp + 0x154]
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], 6
mov dword [esp + 0x1c], 0x1477a14a
mov dword [esp + 0x28], 0x93d7f285
mov dword [esp + 0x28], ebx
mov dword [esp + 0x28], 0x7b17b4d2
mov dword [esp + 0x28], 0xffffffff
push 2
call fcn.10014aaf
push 2
lea ecx, [esp + 0x110]
mov dword [esp + 0x1f8], ebx
call fcn.10014aaf
push 2
mov dword [esp + 0x1c], ebx
pop edx
jmp 0x10016d81
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x154]
mov dword [eax + ecx*4], 0xfffffff8
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edx
jl 0x10016d6b
mov dword [esp + 0x18], ebx
jmp 0x10016da3
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x10c]
mov dword [eax + ecx*4], 0xbec151d1
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edx
jl 0x10016d8d
mov dword [esp + 0x20], 0xfffffff9
jmp 0x10016e94
mov dword [esp + 0x24], 0x649f6d4a
mov dword [esp + 0x18], 0xfffb
mov dword [esp + 0x1c], 0x6ac3a608
mov dword [esp + 0x28], 0xc8fb
mov dword [esp + 0x14], esi
mov dword [esp + 0x14], 0x6d9e96bb
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x24]
sub eax, dword [esp + 0x20]
je 0x10016df8
mov edx, edi
cmp dword [esp + 0x24], ebx
jne 0x10016dfa
mov edx, ebx
mov eax, dword [esp + 0x24]
xor ecx, ecx
cmp edx, eax
sete cl
sub ecx, 0x9cdf
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [esp + 0x18]
neg ecx
sbb ecx, ecx
inc ecx
add ecx, dword [esp + 0x1c]
jne 0x10016e23
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x1c]
xor ecx, ecx
mov dword [esp + 0x14], ebx
mov edx, dword [esp + 0x14]
imul edx, dword [esp + 0x24]
add edx, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, 0xb5cf
mov ecx, dword [esp + 0x20]
setne al
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
imul eax, ecx, 0x3a4c
cmp eax, 0xfffffff9
sbb eax, eax
neg eax
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x18]
imul eax, dword [esp + 0x1c]
mov dword [esp + 0x14], eax
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10016e90
push ebx
push edi
push 0xadc
push ebx
call dword [sym.imp.USER32.dll_SetMenuItemInfoW]
dec dword [esp + 0x20]
cmp dword [esp + 0x20], 0xffffffe9
jl 0x10016db6
mov eax, dword [esp + 0x10c]
lea ecx, [esp + 0x10c]
dec dword [eax + 4]
call fcn.100152cc
or dword [esp + 0x1f4], 0xffffffff
lea ecx, [esp + 0x154]
call fcn.100152cc
mov dword [esp + 0x28], ebx
mov dword [esp + 0x28], 0xb642c70b
mov dword [esp + 0x28], 0xfffffffd
mov dword [esp + 0x28], 0xe871d976
mov dword [esp + 0x28], ebx
mov dword [esp + 0x28], 0x61c0f806
mov dword [esp + 0x28], edi
mov dword [esp + 0x28], 2
mov dword [esp + 0x28], edi
mov dword [esp + 0x28], 0xbe39
mov dword [esp + 0x28], 0x51cf
mov dword [esp + 0x28], 4
mov dword [esp + 0x28], 0xfffffff8
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x28], ebx
mov dword [esp + 0x1c], 0x7857
mov dword [esp + 0x14], ebx
jmp 0x10016f4e
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x1b8], 0xeb59008c
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x10016f3b
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10016f71
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push ebx
push ebx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
inc dword [esp + 0x1c]
lea ecx, [esp + 0xd0]
push 2
call fcn.10014aaf
push edi
lea ecx, [esp + 0x64]
mov dword [esp + 0x1f8], edi
call fcn.10014aaf
mov byte [esp + 0x1f4], 2
lea ecx, [esp + 0x13c]
mov dword [esp + 0x1c], 0xfffffff6
push 3
call fcn.10014aaf
mov dword [esp + 0x24], 8
mov dword [esp + 0x18], ebx
jmp 0x10016fd2
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x13c]
mov dword [eax + ecx*4], edi
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jl 0x10016fc0
mov dword [esp + 0x18], ebx
jmp 0x10016ff2
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x90], 0xf0f5ebe
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jl 0x10016fdf
mov dword [esp + 0x24], ebx
jmp 0x10017100
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x1c], 0x86992f1e
mov dword [esp + 0x28], 0xc44d4e2b
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10017033
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetSystemMenu]
mov dword [esp + 0x20], ebx
jmp 0x100170f1
mov dword [esp + 0x14], edi
mov dword [esp + 0x14], 2
cmp dword [esp + 0x14], ebx
jl 0x100170e2
mov esi, dword [esp + 0x13c]
mov dword [esp + 0x18], 8
mov dword [esp + 0x18], ebx
jmp 0x10017071
cmp dword [esp + 0x20], ebx
jne 0x10017078
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jle 0x10017067
mov eax, dword [esp + 0x20]
mov eax, dword [esi + 4]
neg eax
cmp eax, 0x45cb
jl 0x10017090
mov edx, edi
cmp dword [esp + 0x14], ebx
jne 0x10017092
mov edx, ebx
mov eax, dword [esp + 0x24]
xor ecx, ecx
cmp edx, eax
sete cl
xor edx, edx
add ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
cmp ecx, eax
setge dl
cmp edi, edx
mov dword [esp + 0x90], edx
sbb eax, eax
inc eax
cmp eax, 0xfffc
sbb eax, eax
inc eax
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x94]
mov eax, dword [esp + 0x18]
imul eax, dword [esp + 0x1c]
mov dword [esp + 0x28], eax
dec dword [esp + 0x14]
jns 0x10017059
mov eax, dword [esp + 0x20]
mov dword [esp + 0x90], eax
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 2
jle 0x1001703c
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 2
jle 0x10017002
lea ecx, [esp + 0x13c]
call fcn.100152cc
push dword [esp + 0x38]
movdqa xmm0, xmmword [0x10008250]
lea eax, [esp + 0x1b4]
push eax
lea eax, [esp + 0x1a8]
mov dword [esp + 0xb4], ebx
push eax
push ebx
lea ecx, [esp + 0xbc]
mov dword [esp + 0xc0], ebx
movdqu xmmword [esp + 0x1b0], xmm0
mov dword [esp + 0xc4], ebx
call fcn.1001606b
mov dword [esp + 0x14], 9
mov dword [esp + 0x14], ebx
jmp 0x10017180
mov dword [esp + 0x28], 7
mov dword [esp + 0x28], 0xffffffff
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jle 0x1001716c
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10017199
push ebx
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
lea ecx, [esp + 0xac]
call fcn.100152cc
mov dword [esp + 0x18], ebx
jmp 0x100171c1
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0xd0]
mov dword [eax + ecx*4], 0xea75c96
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jl 0x100171ab
mov dword [esp + 0x18], ebx
jmp 0x100171e1
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x60]
mov dword [eax + ecx*4], 0xf2f4a8b1
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x100171ce
mov dword [esp + 0x18], 0x32667a87
lea ecx, [esp + 0xe8]
mov dword [esp + 0x1c], 0xc863cc1d
push edi
call fcn.10014aaf
mov dword [esp + 0x20], ebx
jmp 0x1001721d
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x1c0], 0x2b96ce02
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 4
jl 0x1001720a
mov dword [esp + 0x20], ebx
jmp 0x10017240
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0xe8]
mov dword [eax + ecx*4], 0x17f215a
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edi
jl 0x1001722a
cmp dword [esp + 0x18], ebx
je 0x100172ca
mov eax, dword [esp + 0x18]
xor edx, edx
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
cmp ecx, eax
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
setl dl
mov dword [esp + 0x28], edx
xor edx, edx
mov esi, dword [esp + 0x28]
cmp ecx, eax
setne dl
xor ecx, ecx
sub esi, edx
mov dword [esp + 0x1c4], esi
mov eax, dword [esp + 0x18]
cmp esi, eax
setne cl
imul ecx, dword [esp + 0x18]
mov dword [esp + 0x1c], ecx
mov edx, dword [esp + 0x1c]
sub edx, dword [esp + 0x18]
neg edx
sbb edx, edx
inc edx
sub edx, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
sub edx, 0x395e2de4
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
neg edx
cmp edx, eax
setge cl
add ecx, 5
cmp ecx, 0xffffffff
mov ecx, edi
jg 0x100172cc
mov ecx, ebx
mov eax, dword [esp + 0xe8]
mov dword [eax], ecx
lea ecx, [esp + 0xe8]
call fcn.100152cc
mov eax, dword [esp + 0x60]
mov dword [eax], ebx
mov eax, dword [esp + 0xd0]
mov dword [esp + 0x28], eax
push edi
lea ecx, [esp + 0x104]
call fcn.10014aaf
mov byte [esp + 0x1f4], 3
lea ecx, [esp + 0x78]
mov dword [esp + 0x1c], 0xfffffff6
push edi
call fcn.10014aaf
mov byte [esp + 0x1f4], 4
mov dword [esp + 0x1c], 0xed562b99
mov dword [esp + 0x14], ebx
jmp 0x10017342
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x78]
mov dword [eax + ecx*4], 0x1713b910
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x1001732f
mov eax, dword [esp + 0x78]
mov dword [eax], 0x13
mov dword [esp + 0x20], 0xfff6
lea ecx, [esp + 0x124]
push 3
call fcn.10014aaf
mov dword [esp + 0x14], ebx
jmp 0x10017380
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x124]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x1001736e
inc dword [esp + 0x20]
xor edx, edx
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x78]
cmp dword [eax], ecx
mov eax, dword [esp + 0x20]
setle dl
mov esi, dword [esp + 0x78]
xor ecx, ecx
cmp edx, eax
setl cl
sub ecx, 0x9956a218
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, 0xed693765
mov ecx, dword [esp + 0x124]
sbb edx, edx
neg edx
sub edx, dword [esi]
mov eax, dword [ecx + 8]
neg edx
sbb edx, edx
inc edx
add eax, edx
mov dword [ecx + 4], eax
lea ecx, [esp + 0x124]
call fcn.100152cc
dec dword [esi]
cmp dword [esi], 0xffffffe6
jne 0x10017352
lea ecx, [esp + 0x78]
mov byte [esp + 0x1f4], 3
call fcn.100152cc
mov dword [esp + 0x24], 0xe495761b
mov dword [esp + 0x1c], 5
mov dword [esp + 0x14], ebx
jmp 0x1001743c
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x100]
mov dword [eax + ecx*4], 6
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x10017426
mov esi, dword [esp + 0x60]
xor ecx, ecx
mov eax, dword [esp + 0xd0]
mov edx, dword [esi]
cmp edx, 0xffffffff
setne cl
mov dword [eax + edx*4], ecx
xor ecx, ecx
mov eax, dword [esi]
mov edx, dword [esp + 0x28]
cmp eax, dword [edx + 4]
setl cl
mov dword [esp + 0x1c], ecx
xor ecx, ecx
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x100]
mov edx, dword [eax]
test edx, edx
setne cl
xor eax, eax
cmp edx, ecx
setne al
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x60]
sub ecx, dword [eax]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x24], 0x9f9b3198
mov dword [esp + 0x1c], 0xf506e60b
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x1c], edi
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x1c], 0x3a3fc4b0
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x1c], 0x348cc383
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x1c], 0xfffffffa
mov dword [esp + 0x1c], 0x21b0ae28
mov dword [esp + 0x1c], 5
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x1c], 0xfffffff6
mov dword [esp + 0x1c], 0x5dea311c
mov dword [esp + 0x1c], 0xfd52a42b
mov dword [esp + 0x1c], 0x1a80d1c1
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x1c], 0xeb11
mov dword [esp + 0x1c], 0x2b83
mov dword [esp + 0x14], ebx
jmp 0x1001754b
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x1d0], 0xfffffff9
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x10017538
mov dword [esp + 0x24], 6
jmp 0x100175db
mov dword [esp + 0x14], 0x36f6
lea ecx, [esp + 0x184]
mov dword [esp + 0x14], 0xa9d69236
mov dword [esp + 0x14], 0x393dda37
mov dword [esp + 0x14], 0xef989b1a
push edi
call fcn.10014aaf
mov dword [esp + 0x14], ebx
jmp 0x100175a5
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x184]
mov dword [eax + ecx*4], 0x7eb8e136
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x1001758f
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x100175c7
push 0x1446
push 0x23f2
push ebx
call dword [sym.imp.USER32.dll_EnableMenuItem]
inc dword [esp + 0x1c]
lea ecx, [esp + 0x184]
call fcn.100152cc
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 0xd
jge 0x1001755c
mov dword [esp + 0x14], ebx
jmp 0x100175fb
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x1dc], ebx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x100175ec
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10017641
push 0x549
push 0x11ec
push 0x2296
push 0x381
push 0x6ea
push 0x2099
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RoundRect]
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001765d
push 0x1446
push 0x23f2
push ebx
call dword [sym.imp.USER32.dll_EnableMenuItem]
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10017678
push ebx
push ebx
push 0x1bc3
call esi
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
lea ecx, [esp + 0x100]
mov byte [esp + 0x1f4], 2
call fcn.100152cc
mov eax, dword [esp + 0x60]
inc dword [eax]
cmp dword [eax], edi
jle 0x100172f2
lea ecx, [esp + 0x60]
call fcn.100152cc
or dword [esp + 0x1f4], 0xffffffff
lea ecx, [esp + 0xd0]
call fcn.100152cc
mov dword [esp + 0x1c], 0x25260
lea ecx, [esp + 0xb8]
mov dword [esp + 0x14], 6
mov dword [esp + 0x24], 0xffffffff
push 4
call fcn.10014aaf
push 2
lea ecx, [esp + 0x11c]
mov dword [esp + 0x1f8], 5
call fcn.10014aaf
mov dword [esp + 0x14], 0xd764
mov dword [esp + 0x18], ebx
jmp 0x1001771a
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0xb8]
mov dword [eax + ecx*4], 0xd0da0bdb
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 4
jl 0x10017704
mov dword [esp + 0x18], ebx
jmp 0x1001773d
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x118]
mov dword [eax + ecx*4], 0xa6ed
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jl 0x10017727
mov dword [esp + 0x18], ebx
jmp 0x1001775d
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x98], 0x4694
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x1001774a
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0xb8]
cmp dword [eax], ebx
jne 0x10017782
mov ecx, ebx
cmp dword [esp + 0x14], ebx
je 0x10017784
mov ecx, edi
mov edx, dword [esp + 0x118]
mov eax, dword [edx]
add ecx, eax
dec eax
cmp ecx, 0xffffffff
mov dword [edx], eax
mov edx, edi
mov eax, dword [esp + 0xb8]
cmovb edx, ebx
mov dword [esp + 0x14], 0x8358bd4d
mov ecx, dword [esp + 0x14]
sub ecx, edx
mov dword [eax + 4], edx
xor edx, edx
mov eax, dword [esp + 0x1c]
cmp eax, ecx
lea ecx, [esp + 0x118]
setge dl
sub edx, dword [esp + 0x24]
neg edx
sbb edx, edx
add edx, 0x8f33cde7
neg edx
sbb edx, edx
neg edx
mov dword [esp + 0x24], edx
call fcn.100152cc
or dword [esp + 0x1f4], 0xffffffff
lea ecx, [esp + 0xb8]
call fcn.100152cc
mov dword [esp + 0x14], ebx
jmp 0x1001780e
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x84], 0xfd3df75d
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x100177fb
mov dword [esp + 0x88], 0xffffffef
jmp 0x10017d33
push dword [esp + 0x98]
lea eax, [esp + 0x1a4]
mov dword [esp + 0xc8], ebx
push eax
lea eax, [esp + 0x198]
mov dword [esp + 0xd0], ebx
push eax
xorps xmm0, xmm0
mov dword [esp + 0xd8], ebx
push ebx
lea ecx, [esp + 0xd4]
movdqu xmmword [esp + 0x1a0], xmm0
call fcn.1001606b
mov dword [esp + 0x1f4], 6
mov dword [esp + 0x28], 0xb642c70b
mov dword [esp + 0x28], 0xfffffffd
mov dword [esp + 0x28], 0xe871d976
mov dword [esp + 0x28], ebx
mov dword [esp + 0x28], 0x61c0f806
mov dword [esp + 0x28], edi
push 2
pop ecx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x28], edi
mov dword [esp + 0x28], 0xbe39
mov dword [esp + 0x28], 0x51cf
mov dword [esp + 0x28], 4
mov dword [esp + 0x28], 0xfffffff8
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x28], ebx
mov dword [esp + 0x1c], 0x7857
mov dword [esp + 0x14], ebx
jmp 0x100178f5
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x1b0], 0xeb59008c
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ecx
jl 0x100178e2
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10017913
push ebx
push ebx
call esi
push eax
push ebx
push ebx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
inc dword [esp + 0x1c]
lea ecx, [esp + 0x148]
push 3
call fcn.10014aaf
mov byte [esp + 0x1f4], 7
mov dword [esp + 0x24], 0xfffffffc
mov dword [esp + 0x14], ebx
jmp 0x1001794e
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x148]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x1001793b
mov dword [esp + 0x24], ebx
jmp 0x10017a55
mov dword [esp + 0x20], 0xade2167f
mov dword [esp + 0x20], ebx
jmp 0x10017a1e
push 3
lea ecx, [esp + 0x134]
call fcn.10014aaf
mov dword [esp + 0x14], ebx
jmp 0x10017996
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x130]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x10017983
mov edx, dword [esp + 0x130]
mov dword [edx + 4], ebx
mov dword [esp + 0x1c], 0xfffffffd
mov dword [esp + 0x1c], 2
cmp dword [esp + 0x1c], ebx
jl 0x10017a01
mov dword [esp + 0x18], 0xae649f6d
mov dword [esp + 0x18], ebx
jmp 0x100179f4
mov dword [esp + 0x14], ebx
mov dword [esp + 0x14], ebx
jmp 0x100179e9
cmp dword [esp + 0x18], 2
jle 0x100179cb
dec dword [esp + 0x1c]
jns 0x100179bd
mov eax, dword [esp + 0x24]
inc dword [edx + 4]
cmp dword [edx + 4], 2
jle 0x100179a7
lea ecx, [esp + 0x130]
call fcn.100152cc
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 2
jle 0x1001796f
mov dword [esp + 0x20], ebx
jmp 0x10017a4a
cmp dword [esp + 0x24], 2
jle 0x1001795e
lea ecx, [esp + 0x148]
mov byte [esp + 0x1f4], 6
call fcn.100152cc
mov dword [esp + 0xa4], 0xfff7
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], 0x5de1
mov dword [esp + 0x24], ebx
jmp 0x10017afb
mov dword [esp + 0x20], 0x53aa9ac7
mov dword [esp + 0x20], 6
jmp 0x10017af0
mov dword [esp + 0x1c], 7
cmp dword [esp + 0x20], ebx
je 0x10017ada
mov dword [esp + 0x1c], 0xfffffff7
xor ecx, ecx
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
cmp eax, edi
setle cl
mov dword [esp + 0x1c], ecx
jmp 0x10017aec
mov dword [esp + 0x28], 0x17ab
cmp dword [esp + 0x28], ebx
jne 0x10017af7
mov eax, dword [esp + 0x1c]
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 9
jg 0x10017aa3
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 0x1a
je 0x10017a91
mov dword [esp + 0x14], 0xe0a8eac8
mov dword [esp + 0x14], 0x17
jmp 0x10017c61
cmp dword [esp + 0x14], edi
je 0x10017b17
cmp dword [esp + 0x88], 0xffffffee
jle 0x10017825
push 2
lea ecx, [esp + 0x17c]
call fcn.10014aaf
mov dword [esp + 0x24], 0xfffffffc
mov dword [esp + 0x28], 0xefa20bd0
mov dword [esp + 0x1c], ebx
jmp 0x10017d7b
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x178]
mov dword [eax + ecx*4], 0x13dd33a4
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jl 0x10017d65
mov dword [esp + 0x24], ebx
jmp 0x10017dba
mov dword [esp + 0x1c], 0x7a888ada
mov dword [esp + 0x1c], ebx
jmp 0x10017db0
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10017da8
push ebx
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov eax, dword [esp + 0x24]
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edi
jle 0x10017d96
inc dword [esp + 0x24]
cmp dword [esp + 0x24], edi
jle 0x10017d88
lea ecx, [esp + 0x178]
call fcn.100152cc
push 2
lea ecx, [esp + 0xe0]
call fcn.10014aaf
mov dword [esp + 0x1f4], 8
lea ecx, [esp + 0xf4]
mov dword [esp + 0x24], 0x78144ad7
mov dword [esp + 0x1c], 0x7cad7d71
push 3
call fcn.10014aaf
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x18], ebx
jmp 0x10017e23
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0xdc]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jl 0x10017e11
push 3
mov dword [esp + 0x1c], ebx
pop edx
jmp 0x10017e49
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0xf4]
mov dword [eax + ecx*4], 0xc007c7be
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edx
jl 0x10017e33
mov dword [esp + 0x18], ebx
jmp 0x10017e68
cmp dword [esp + 0x18], edx
jl 0x10017e55