Function at 0x10026461
Capabilities:
Check os version

Disassembly:
mov eax, 0x1006cacb
call fcn.1006bf60
sub esp, 0x1ac
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor ebx, ebx
push 2
mov dword [ebp - 0x30], 0xc184c506
mov byte [ebp - 0x50], dl
mov dword [ebp - 0x80], ecx
mov dword [ebp - 0x30], ebx
pop esi
jmp 0x1002649f
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x1a0], 0xb57f
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], esi
jl 0x1002648e
xor edi, edi
mov dword [ebp - 0x30], ebx
inc edi
jmp 0x100264c3
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], bl
je 0x100264c0
push ebx
push 0x1062
call dword [sym.imp.GDI32.dll_RectVisible]
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], edi
jle 0x100264ac
mov dword [ebp - 0x14], 0xda439beb
lea ecx, [ebp - 0x7c]
push edi
call fcn.10023894
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x4c], 0x458230b5
push 0xfffffffffffffffa
mov dword [ebp - 0x28], 0xffffffff
pop edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x14], ebx
jmp 0x10026502
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x5c], 0xbca6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x100264f4
mov dword [ebp - 0x14], ebx
jmp 0x10026518
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x7c]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1002650c
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], edi
jg 0x10026654
push 3
pop edx
mov dword [ebp - 0x20], 0x80444555
xor ecx, ecx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x3c], 0xb839bf5b
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x5c]
test eax, eax
mov dword [ebp - 0x20], ebx
setne cl
imul ecx, ecx, 0x5273
add ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x7c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x58], edx
je 0x1002656e
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x5c]
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x5c], ebx
je 0x10026580
mov eax, dword [ebp - 0x7c]
mov edx, edi
cmp dword [eax], ebx
jne 0x10026582
mov edx, ebx
mov eax, dword [ebp - 0x5c]
xor ecx, ecx
cmp edx, eax
sete cl
cmp ecx, dword [ebp - 0x1c]
jne 0x1002659c
mov eax, dword [ebp - 0x14]
mov ecx, ebx
cmp dword [ebp + eax*4 - 0x5c], ebx
je 0x1002659e
mov ecx, edi
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
add eax, ecx
cmp eax, dword [ebp - 0x58]
jl 0x100265c5
mov dword [ebp - 0x1c], ebx
jmp 0x100265bb
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x7c]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x100265af
jmp 0x10026645
mov dword [ebp - 0x28], 9
mov dword [ebp - 0x2c], 0x856a759f
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], bl
je 0x100265e7
push ebx
push 0x1070
call dword [sym.imp.USER32.dll_KillTimer]
mov esi, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x7c]
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + eax*4 - 0x5c]
mov eax, dword [ebp - 0x14]
cmp eax, ecx
setl dl
xor eax, eax
cmp esi, edx
setge al
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x3c]
neg ecx
sbb ecx, ecx
inc ecx
inc dword [ebp - 0x3c]
cmp ecx, eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x5c]
mov ecx, edi
mov eax, dword [ebp - 0x14]
cmovge ecx, ebx
cmp ecx, 0x58b
jg 0x10026637
mov eax, ebx
cmp dword [ebp - 0x28], ebx
je 0x10026639
mov eax, edi
imul eax, eax, 0xe526
push 2
pop esi
mov dword [ebp - 0x2c], eax
inc dword [ebp - 0x14]
push 3
pop edx
cmp dword [ebp - 0x14], edi
jle 0x1002652c
mov eax, dword [ebp - 0x40]
xor edx, edx
mov dword [ebp - 0x14], edi
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
cmp eax, ecx
mov eax, dword [ebp - 0x58]
setg dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x7c]
sub ecx, 0x2e70
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, dword [eax]
jge 0x100266a5
mov dword [ebp - 0x1c], ebx
jmp 0x1002669d
mov dword [ebp - 0x14], edi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x1a
jge 0x10026697
jmp 0x100266c6
mov dword [ebp - 0x14], ebx
jmp 0x100266c1
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], bl
je 0x100266be
push 0xba
push ebx
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jle 0x100266aa
lea ecx, [ebp - 0x7c]
call fcn.10023916
push dword [ebp + 8]
movdqa xmm0, xmmword [0x10009390]
lea eax, [ebp - 0x180]
push eax
lea eax, [ebp - 0x190]
mov dword [ebp - 0x30], 4
push eax
push ebx
lea ecx, [ebp - 0x8c]
mov dword [ebp - 0x8c], ebx
movdqu xmmword [ebp - 0x190], xmm0
mov dword [ebp - 0x88], ebx
mov dword [ebp - 0x84], ebx
call fcn.100259c2
mov dword [ebp - 0x1c], ebx
jmp 0x10026727
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x38], 0xfffffffa
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x10026719
mov dword [ebp - 0x38], ebx
jmp 0x10026841
mov dword [ebp - 0x14], 9
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x1c], ebx
jmp 0x10026751
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x64], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x10026743
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], ebx
jg 0x100267b3
mov edx, dword [ebp - 0x8c]
mov dword [ebp - 0x3c], 0x31e7bf5c
xor ecx, ecx
mov dword [ebp - 0x2c], 0x700d
imul eax, dword [ebp - 0x64], 0xf889
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp - 0x24]
cmp eax, dword [edx + 4]
setl cl
mov dword [ebp - 0x2c], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x10026764
mov dword [ebp - 0x14], ebx
jmp 0x10026834
push 3
mov dword [ebp - 0x2c], 0xb5bcdce
mov dword [ebp - 0x1c], ebx
pop ecx
jmp 0x100267d8
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x144], 9
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x100267c7
cmp dword [ebp - 0x38], ebx
jne 0x1002683e
mov eax, dword [ebp - 0x13c]
xor edx, edx
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x8c]
cmp dword [eax], ecx
mov eax, dword [ebp - 0x38]
setge dl
imul eax, edx
test eax, eax
jne 0x1002680f
mov eax, ebx
cmp dword [ebp - 0x13c], ebx
je 0x10026811
mov eax, edi
mov ecx, dword [ebp - 0x14]
imul ecx, eax
mov eax, dword [ebp - 0x8c]
push 3
imul ecx, dword [eax]
pop eax
cmp eax, ecx
sbb eax, eax
inc eax
imul eax, eax, 0x4b3b
mov dword [ebp - 0x2c], eax
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffffe
jl 0x100267b8
dec dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xfffffff3
jge 0x10026734
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], bl
je 0x1002685e
push 0x1f34
call dword [sym.imp.USER32.dll_GetKeyboardType]
lea ecx, [ebp - 0x8c]
call fcn.10023916
mov eax, dword [0x1007361c]
lea ecx, [ebp - 0x15c]
mov dword [ebp - 0x14], ebx
push edi
mov dword [ebp - 0x3c], eax
call fcn.10023894
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1c], ebx
jmp 0x1002689b
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x15c]
mov dword [eax + ecx*4], 0xc5416513
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x10026888
mov dword [ebp - 0x14], 0xfffffff6
cmp dword [ebp - 0x14], 0x12
jge 0x1002692b
mov edi, dword [sym.imp.GDI32.dll_GetMetaFileBitsEx]
push 3
lea ecx, [ebp - 0xf0]
call fcn.10023894
push 3
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x1c], ebx
pop edx
jmp 0x100268e2
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xf0]
mov dword [eax + ecx*4], 0x51ad386c
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x100268cf
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x100268f9
push ebx
push 0x1cfa
push ebx
call edi
mov dword [ebp - 0x1c], ebx
jmp 0x1002690f
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xf0]
cmp dword [eax + ecx*4], ebx
jne 0x10026914
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jle 0x100268fe
lea ecx, [ebp - 0xf0]
call fcn.10023916
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x12
jl 0x100268b3
xor edi, edi
inc edi
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1002693b
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x15c]
call fcn.10023916
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x1c], 0xfffa
mov dword [ebp - 0x28], 0x933bd3e0
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x2c], edi
push esi
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
call fcn.10023894
push 3
pop ecx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x14], ebx
jmp 0x1002699a
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xfc], 0x7f21
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10026989
mov dword [ebp - 0x14], ebx
jmp 0x100269b7
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x114]
mov dword [eax + ecx*4], 0x314d
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x100269a4
mov eax, dword [ebp - 0x1c]
add eax, 0xf943
mov dword [ebp - 0xf4], eax
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 7
jne 0x100269dc
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x114]
imul ecx, dword [eax]
cmp ecx, dword [ebp - 0x24]
jg 0x100269fe
cmp dword [ebp - 0x40], ebx
jne 0x100269fe
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
xor edx, edx
sub ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
mov eax, dword [ebp - 0xf8]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setl cl
sub ecx, eax
xor eax, eax
cmp ecx, 0x968f
setne al
xor ecx, ecx
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
setg cl
cmp ecx, 0x97a0b891
lea ecx, [ebp - 0x114]
sbb eax, eax
inc eax
mov dword [ebp - 0x4c], eax
call fcn.10023916
cmp byte [ebp - 0x50], 0
je 0x10026d6b
cmp dword [ebp - 0x3c], edi
jne 0x10026d6b
mov dword [ebp - 0x44], 0xfffffff7
lea ecx, [ebp - 0x120]
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x44], 0x506e60b0
push esi
call fcn.10023894
mov dword [ebp - 0x28], 0x1bca9d69
mov dword [ebp - 0x1c], ebx
jmp 0x10026aa2
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x120]
mov dword [eax + ecx*4], 0x4fe5f36f
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10026a8f
inc dword [ebp - 0x28]
lea ecx, [ebp - 0x120]
call fcn.10023916
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x1c], 0xfffb
push edi
mov dword [eax + 8], 4
call fcn.10023894
mov dword [ebp - 4], edi
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x14], 0xce094bf7
mov dword [ebp - 0x24], 0x1717c264
mov dword [ebp - 0x14], ebx
jmp 0x10026afe
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x70]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10026af2
mov dword [ebp - 0x28], 0x8ac
cmp dword [ebp - 0x28], 0xbac
jle 0x10026b78
mov ecx, ebx
mov dword [ebp - 0x14], ebx
mov eax, ebx
mov dword [ebp - 0x24], ebx
mov esi, ebx
add eax, esi
add eax, ecx
lea ecx, [ebp - 0x1b8]
cdq
push edx
push eax
call fcn.1000a940
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10026b3b
mov eax, dword [eax]
push eax
call fcn.100551b6
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x1b8]
call fcn.10023d36
mov eax, dword [ebp - 0x24]
inc esi
mov ecx, dword [ebp - 0x14]
cmp esi, 0x7a24
jl 0x10026b1f
inc eax
mov dword [ebp - 0x24], eax
cmp eax, 0x5ec9
jl 0x10026b1d
inc ecx
mov dword [ebp - 0x14], ecx
cmp ecx, 0x6d01
jl 0x10026b18
push 2
pop esi
mov dword [ebp - 0x14], ebx
jmp 0x10026b8e
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xe4], 0xf0cdbbf8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10026b7d
cmp dword [ebp - 0x28], 0x5de
jge 0x10026ba7
push 0x10008464
call fcn.100551b6
pop ecx
mov dword [ebp - 4], edi
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x70]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
dec eax
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x70]
cmp dword [eax], ebx
je 0x10026be4
mov eax, edi
cmp dword [ebp - 0x20], ebx
jne 0x10026be6
mov eax, ebx
mov ecx, 0xc7c6
xor edx, edx
sub ecx, eax
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x70]
setge dl
cmp dword [ebp - 0x34], ebx
mov dword [eax], edx
mov eax, dword [ebp - 0x70]
jne 0x10026c08
cmp dword [eax], ebx
je 0x10026c0e
mov ecx, edi
cmp dword [eax], ebx
jne 0x10026c10
mov ecx, ebx
xor eax, eax
cmp ecx, 0x9550
setge al
mov dword [ebp - 0x20], eax
imul eax, dword [ebp - 0x20], 0xd93c
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x14], eax
jne 0x10026c36
mov eax, ebx
cmp dword [ebp - 0x1c], ebx
je 0x10026c38
mov eax, edi
add eax, 5
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jne 0x10026c4a
mov eax, ebx
cmp dword [ebp - 0x14], ebx
je 0x10026c4c
mov eax, edi
add eax, 0xfffc
imul eax, dword [ebp - 0x1c]
test eax, eax
je 0x10026c72
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10026d55
push ebx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
jmp 0x10026d55
mov dword [ebp - 0x1c], 0x41ab7a3e
lea ecx, [ebp - 0xb0]
push edi
call fcn.10023894
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x14], ebx
jmp 0x10026ca0
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xb0]
mov dword [eax + ecx*4], 0xf85a0455
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10026c8d
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
cmp eax, 0x211a
mov eax, dword [ebp - 0x1c]
setl cl
xor edx, edx
cmp ecx, eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x70]
setl dl
imul ecx, dword [eax]
xor eax, eax
cmp ecx, edx
setge al
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, ebx
cmp dword [ebp - 0x1c], ebx
je 0x10026ce1
mov eax, edi
mov ecx, dword [ebp - 0x24]
xor edx, edx
imul ecx, eax
mov eax, dword [ebp - 0x70]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xb0]
sub ecx, dword [eax]
mov eax, dword [ebp - 0x34]
cmp ecx, 0x2a97
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0xe0]
setl cl
add eax, ecx
mov ecx, dword [ebp - 0x28]
add ecx, eax
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0xe0]
cmp dword [ebp - 0x28], ebx
mov eax, dword [ebp - 0xb0]
je 0x10026d33
mov ecx, edi
cmp dword [eax], ebx
jne 0x10026d35
mov ecx, ebx
mov dword [eax], ecx
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10026d4a
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
lea ecx, [ebp - 0xb0]
call fcn.10023916
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x70]
call fcn.10023916
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0x1007361c
push dword [ebp + 8]
movdqa xmm0, xmmword [0x10009360]
lea eax, [ebp - 0x170]
push eax
lea eax, [ebp - 0x180]
mov dword [ebp - 0xd0], ebx
push eax
push ebx
lea ecx, [ebp - 0xd0]
mov dword [ebp - 0xcc], ebx
movdqu xmmword [ebp - 0x180], xmm0
mov dword [ebp - 0xc8], ebx
call fcn.100259c2
mov dword [ebp - 0x20], 0xfffffffb
mov dword [ebp - 0x20], 3
cmp dword [ebp - 0x20], ebx
jl 0x10026de1
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10026ddc
push 0x2480
push ebx
push 0x185c
push 0x857
call dword [sym.imp.USER32.dll_GetDlgItemTextW]
dec dword [ebp - 0x20]
jns 0x10026dbd
lea ecx, [ebp - 0xd0]
call fcn.10023916
mov eax, dword [ebp - 0x80]
cmp eax, dword [ebp - 0x3c]
jge 0x100275bd
mov dword [ebp - 0x14], ebx
lea ecx, [ebp - 0x168]
push edi
mov esi, 0x10073620
call fcn.10023894
mov dword [ebp - 4], 4
mov dword [ebp - 0x20], ebx
jmp 0x10026e2b
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x168]
mov dword [eax + ecx*4], 0xc5416513
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x10026e18
mov dword [ebp - 0x14], 0xfffffff6
cmp dword [ebp - 0x14], 0x12
jge 0x10026ec2
mov esi, dword [sym.imp.GDI32.dll_GetMetaFileBitsEx]
push 3
lea ecx, [ebp - 0x108]
call fcn.10023894
push 3
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x20], ebx
pop edx
jmp 0x10026e76
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x108]
mov dword [eax + ecx*4], 0x51ad386c
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x10026e63
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10026e8d
push ebx
push 0x1cfa
push ebx
call esi
mov dword [ebp - 0x1c], ebx
jmp 0x10026ea3
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x108]
cmp dword [eax + ecx*4], ebx
jne 0x10026ea9
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jle 0x10026e92
lea ecx, [ebp - 0x108]
call fcn.10023916
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x12
jl 0x10026e47
mov esi, 0x10073620
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10026ed2
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x168]
call fcn.10023916
mov eax, ebx
mov dword [ebp - 0x2c], ebx
cmp eax, dword [ebp - 0x80]
jge 0x1002738c
mov dword [ebp - 0x44], 0x1860ec01
lea ecx, [ebp - 0x12c]
push 2
call fcn.10023894
mov dword [ebp - 0x14], ebx
jmp 0x10026f16
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x60], 0xa296
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10026f08
mov dword [ebp - 0x14], ebx
jmp 0x10026f33
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x12c]
mov dword [eax + ecx*4], 4
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10026f20
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10026f50
push ebx
push ebx
push 0x2023
push ebx
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
mov eax, dword [ebp - 0x60]
mov ecx, 0xa1fa
sub ecx, eax
jne 0x10026f5f
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x60], ebx
je 0x10026f73
mov dword [ebp - 0x34], 0xffffffff
inc dword [ebp - 0x34]
jmp 0x10026f87
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10026f87
push 0x681
call dword [sym.imp.USER32.dll_GetMenu]
lea ecx, [ebp - 0x12c]
call fcn.10023916
mov eax, dword [esi]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x1c], 0xffffffee
jmp 0x10026fd4
mov dword [ebp - 0x20], ebx
jmp 0x10026fb5
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xb4], edi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x10026fa8
cmp dword [ebp - 0xb4], ebx
jne 0x10026fda
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10026fd1
call dword [sym.imp.USER32.dll_GetCapture]
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe6
jge 0x10026fa3
add esi, dword [ebp - 0x30]
push 3
pop ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x48], 0x125d16df
mov dword [ebp - 0x4c], 0xf4288a13
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x28], 0x9fb1c038
mov dword [ebp - 0x54], 0xa2d3
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], ebx
jmp 0x10027017
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xc4], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x1002700a
dec dword [ebp - 0x28]
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], ecx
jg 0x100270ef
mov dword [ebp - 0x34], 0x23fa9dfe
xor edx, edx
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x20], 0xbab0c3e5
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0xc4]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0xc4]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x4c]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setge dl
xor ecx, ecx
inc edx
mov eax, dword [ebp + eax*4 - 0xc4]
cmp edx, eax
setge cl
add ecx, dword [ebp - 0x24]
mov dword [ebp - 0xc0], ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0xc4]
sub eax, dword [ebp - 0x24]
jne 0x100270a5
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x34], edi
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0xc4]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xc4], ecx
imul eax, ecx, 0xffff
sub eax, 5
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x34]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x28]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x48], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jle 0x1002702c
mov esi, dword [ebp - 0x1c]
push 3
pop ecx
mov eax, dword [esi]
mov dword [ebp - 0x14], 0x6cce57bf
mov dword [ebp - 0x1c], 0xd0fa5166
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x20], ebx
jmp 0x1002711b
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x138], 0xfffffffa
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x1002710a
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10027130
push ebx
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x48], edi
cmp dword [ebp - 0x48], ebx
je 0x10027169
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10027202
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
jmp 0x10027202
push edi
lea ecx, [ebp - 0xdc]
call fcn.10023894
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x54], 0xc7e12fd8
mov dword [ebp - 0x34], 0x927eed05
mov dword [ebp - 0x20], ebx
jmp 0x1002719a
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xdc]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1002718b
mov dword [ebp - 0x14], ebx
jmp 0x100271b7
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xdc]
mov dword [eax + ecx*4], 0x1fad
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x100271a4
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x130]
mov eax, dword [ebp - 0x54]
mov edx, dword [ebp - 0x1c]
neg eax
sbb eax, eax
neg eax
sub edx, eax
sub edx, dword [ebp - 0x130]
mov eax, dword [ebp - 0xdc]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp dword [eax], edx
setg cl
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0xdc]
call fcn.10023916
add esi, dword [ebp - 0x30]
mov dword [ebp - 0x24], 7
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x24], 0xffffffe2
cmp dword [ebp - 0x24], 0xa
je 0x10027371
push 2
mov dword [ebp - 0x14], ebx
pop ecx
jmp 0x1002723c
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x170], 0xde0b4074
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1002722b
mov dword [ebp - 0x14], ebx
jmp 0x10027257
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x94], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10027246
mov dword [ebp - 0x94], ebx
cmp dword [ebp - 0x94], edi
jg 0x10027369
mov dword [ebp - 0x28], 0x251
cmp dword [ebp - 0x28], 0x4b9
jle 0x100272e0
mov esi, ebx
mov edi, ebx
mov eax, esi
mov ecx, ebx
cdq
idiv edi
mov dword [ebp - 0x34], ecx
mov eax, edx
mov dword [ebp - 0x20], eax
add eax, ecx
mov dword [ebp - 0x54], 0x87c
mov dword [ebp - 0x48], eax
cdq
mov ecx, 0x10615658
push edx
push eax
call fcn.1002377f
mov eax, dword [ebp - 0x48]
inc eax
dec dword [ebp - 0x54]
mov dword [ebp - 0x48], eax
jne 0x1002729d
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x20]
inc ecx
mov dword [ebp - 0x34], ecx
cmp ecx, 0x1e85
jl 0x10027291
inc edi
cmp edi, 0x5c90
jl 0x10027282
inc esi
cmp esi, 0x6726
jl 0x10027280
mov esi, dword [ebp - 0x1c]
xor edi, edi
inc edi
mov dword [ebp - 0x20], 0x8f0aa6e6
mov dword [ebp - 4], 5
cmp dword [ebp - 0x28], 0xfffffe7c
jge 0x10027306
mov edx, 0x10008498
mov ecx, 0x10615658
call fcn.10025485
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x20], edi
cmp dword [ebp - 0x20], ebx
jl 0x10027323
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x170], ebx
jne 0x10027323
dec dword [ebp - 0x20]
jns 0x10027312
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10027333
push ebx
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
inc dword [ebp - 0x94]
jmp 0x10027262
inc dword [ebp - 0x24]
jmp 0x10027219
cmp dword [ebp - 0x4c], 0
jne 0x1002737d
mov eax, dword [ebp - 0x30]
lea esi, [esi + eax*2]
mov eax, dword [ebp - 0x2c]
add esi, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x2c], eax
jmp 0x10026ee6
mov eax, dword [esi]
add esi, dword [ebp - 0x30]
mov dword [ebp - 0x1c], 0x4e064826
mov dword [ebp - 0x44], 0xffffffff
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], edi
jmp 0x10027415
mov dword [ebp - 0x20], 0xee1c
mov dword [ebp - 0x2c], 0xffffffff
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jne 0x100273c0
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x44]
mov ecx, edi
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
sub ecx, eax
je 0x100273d6
mov edx, edi
cmp dword [ebp - 0x20], ebx
jne 0x100273d8
mov edx, ebx
mov eax, dword [ebp - 0x20]
mov ecx, 0xc2285faa
cmp ecx, eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, edx
mov eax, dword [ebp - 0x1c]
setl cl
xor edx, edx
cmp ecx, 0xcd2466e9
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setg cl
mov dword [ebp - 0x2c], ecx
xor ecx, ecx
cmp eax, dword [ebp - 0x2c]
setne cl
mov dword [ebp - 0x2c], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xf
jg 0x100273a7
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1002742c
push ebx
push ebx
call dword [sym.imp.GDI32.dll_GetNearestPaletteIndex]
mov eax, dword [esi]
lea ecx, [ebp - 0x150]
add esi, dword [ebp - 0x30]
mov dword [ebp - 0x1c], 0xfffffff9
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x2c], 0x3111738a
mov dword [ebp - 0x2c], 0xfffffffc
mov dword [ebp - 0x2c], 0x3c61c71b
mov dword [ebp - 0x2c], 0x63ffaf07
mov dword [ebp - 0x2c], 6
push 3
mov dword [ebp - 0x44], eax
call fcn.10023894
push 3
mov dword [ebp - 0x2c], 0x4c7ba3f3
mov dword [ebp - 0x20], ebx
pop edx
jmp 0x10027490
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x150]
mov dword [eax + ecx*4], 0x15e82aa9
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x1002747d
mov dword [ebp - 0x1c], ebx
jmp 0x100274c9
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x40], 0xd3f7bf4
mov dword [ebp - 0x40], 9
mov dword [ebp - 0x20], ebx
jmp 0x100274bd
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x198], edi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x100274b0
dec dword [ebp - 0x2c]
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff4
jl 0x1002749a
lea ecx, [ebp - 0x150]
call fcn.10023916
cmp dword [ebp - 0x44], 0
jne 0x100275bd
cmp byte [ebp - 0x50], 0
je 0x100274fe
cmp dword [ebp - 0x3c], edi
jne 0x100274fe
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x14]
lea eax, [eax + ecx*4]
mov ecx, dword [ebp + 8]
add dword [ecx + 8], eax
mov eax, dword [esi]
add esi, dword [ebp - 0x30]
push dword [ebp - 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [esi]
add esi, dword [ebp - 0x30]
mov dword [ebp - 0x44], eax
call fcn.100506d1
pop ecx
mov dword [ebp - 0x4c], eax
lea ecx, [ebp - 0xa0]
lea eax, [ebp - 0xa4]
mov dword [ebp - 0xa4], ebx
push eax
push dword [ebp - 0x14]
mov dword [ebp - 0xa0], ebx
mov dword [ebp - 0x9c], ebx
mov dword [ebp - 0x98], ebx
call fcn.1002b97a
mov eax, dword [ebp - 0x14]
mov edx, ebx
mov ecx, dword [ebp - 0xa0]
mov dword [ebp - 0x40], ebx
test eax, eax
jle 0x100275a7
mov eax, edx
and eax, 0x80000001
jns 0x10027567
dec eax
or eax, 0xfffffffe
inc eax
neg eax
sbb eax, eax
and eax, dword [ebp - 0x2c]
add eax, edx
add eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0x44]
jmp 0x1002757c
lea eax, [edx + 1]
cdq
idiv dword [ebp - 0x14]
cmp word [ecx + edx*2], bx
jne 0x10027579
mov word [ecx + edx*2], di
mov al, byte [edx + esi]
mov edx, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x4c]
mov byte [edx + ecx], al
inc edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xa0]
mov dword [ebp - 0x40], edx
cmp edx, eax
jl 0x10027559
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov eax, dword [ebp - 0x4c]
mov dword [edx + 4], eax
test ecx, ecx
je 0x100275bd
push ecx
call fcn.10055327
pop ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret