Function at 0x1a011b40
Capabilities:
Capture screenshot
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1a01c2b8
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x1570
call fcn.1a01c170
mov eax, dword [0x1a02400c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov dword [ebp - 0x1508], ecx
lea ecx, [ebp - 0x1530]
call dword [sym.imp.HncBaseDraw.dll_public:_void___thiscall_CHncDrawContext::constructor_void_]
lea ecx, [ebp - 0x1510]
mov dword [ebp - 4], 0
call dword [sym.imp.HncBaseDraw.dll_public:_void___thiscall_CHncFont::constructor_void_]
mov byte [ebp - 4], 1
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x12
mov dword [ebp - 0x14e4], 0
call esi
test ax, ax
jns 0x1a011be3
push 0x11
call esi
test ax, ax
mov ecx, 4
mov eax, 2
cmovs eax, ecx
mov dword [ebp - 0x14e4], eax
push dword [ebp - 0x1508]
mov ecx, 0x3c
mov eax, edi
cmp edi, ecx
cmova eax, ecx
xor ecx, ecx
mov dword [ebp - 0x1534], eax
cmp edi, 0x3c
mov eax, edi
cmova eax, ecx
mov dword [ebp - 0x1500], eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
mov dword [0x1a02b690], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov esi, dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, eax
mov eax, dword [0x1a02b67c]
mov dword [0x1a02b694], ecx
test eax, eax
jne 0x1a011cbb
movaps xmm0, xmmword [0x1a01fdf0]
lea eax, [ebp - 0x1058]
push eax
push dword [ebp - 0x1508]
movups xmmword [ebp - 0x1058], xmm0
call esi
mov eax, dword [ebp - 0x1058]
mov esi, 1
mov ecx, dword [ebp - 0x1050]
mov edx, dword [ebp - 0x1054]
sub ecx, eax
cmp ecx, esi
mov dword [0x1a02b680], eax
mov eax, dword [ebp - 0x104c]
cmovg esi, ecx
mov dword [0x1a02b684], edx
sub eax, edx
mov dword [0x1a02b688], esi
mov ecx, 1
cmp eax, ecx
cmovg ecx, eax
push ecx
push esi
push dword [0x1a02b690]
mov dword [0x1a02b68c], ecx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov ecx, dword [0x1a02b694]
mov esi, dword [sym.imp.USER32.dll_GetClientRect]
mov dword [0x1a02b67c], eax
push eax
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [0x1a02b698], eax
mov eax, dword [0x1a02b694]
mov dword [ebp - 0x14d4], eax
test edi, edi
js 0x1a011cdc
cmp edi, 0x3c
jle 0x1a011d0e
lea eax, [ebp - 0x1058]
xorps xmm0, xmm0
push eax
push dword [ebp - 0x1508]
movups xmmword [ebp - 0x1058], xmm0
call esi
push dword [0x1a02d838]
lea eax, [ebp - 0x1058]
push eax
push dword [ebp - 0x14d4]
call dword [sym.imp.USER32.dll_FillRect]
mov edi, dword [0x1a02407c]
cmp edi, 0x64
jne 0x1a011d21
lea esi, [edi - 0x53]
lea edi, [esi - 0xf]
jmp 0x1a011d4d
mov ecx, edi
mov eax, 0x51eb851f
shl ecx, 4
add ecx, edi
imul ecx
lea ecx, [edi + edi]
mov eax, 0x51eb851f
sar edx, 5
mov esi, edx
shr esi, 0x1f
add esi, edx
imul ecx
sar edx, 5
mov edi, edx
shr edi, 0x1f
add edi, edx
call fcn.1a0142b0
imul eax, edi
push 0x420
push 0
add esi, eax
lea eax, [ebp - 0x14c8]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x14b8], esi
xor eax, eax
mov word [ebp - 0x14b4], 1
mov word [ebp - 0x14ac], ax
mov dword [ebp - 0x14a8], eax
lea eax, [ebp - 0x14a4]
push 0xffffffffffffffff
push 0x1a02d840
push 0x40
push eax
mov byte [ebp - 0x14b2], 0x64
mov dword [ebp - 0x14b0], 0
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
mov ecx, 0x25
lea esi, [ebp - 0x14b8]
lea edi, [ebp - 0x1424]
add esp, 0x10
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x25
lea esi, [ebp - 0x14b8]
lea edi, [ebp - 0x1390]
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x25
lea esi, [ebp - 0x14b8]
lea edi, [ebp - 0x12fc]
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x25
lea esi, [ebp - 0x14b8]
lea edi, [ebp - 0x1268]
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x25
lea esi, [ebp - 0x14b8]
lea edi, [ebp - 0x11d4]
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x25
lea esi, [ebp - 0x14b8]
lea edi, [ebp - 0x1140]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x14c8]
push eax
lea ecx, [ebp - 0x1510]
call dword [sym.imp.HncBaseDraw.dll_public:_int___thiscall_CHncFont::CreateFontW_struct_tagHNCLOGFONT_const__]
mov edi, dword [ebp - 0x14d4]
lea ecx, [ebp - 0x1530]
push edi
call dword [sym.imp.HncBaseDraw.dll_public:_struct_HDC______thiscall_CHncDrawContext::AttachDC_struct_HDC____]
lea eax, [ebp - 0x1510]
push eax
lea ecx, [ebp - 0x1530]
call dword [sym.imp.HncBaseDraw.dll_public:_class_CHncFont____thiscall_CHncDrawContext::SelectObject_class_CHncFont__]
push 1
lea ecx, [ebp - 0x1530]
call dword [sym.imp.HncBaseDraw.dll_public:_int___thiscall_CHncDrawContext::SetBkMode_int_]
push 0x10000
lea ecx, [ebp - 0x1530]
call dword [sym.imp.HncBaseDraw.dll_public:_unsigned_int___thiscall_CHncDrawContext::SetTextAlign_unsigned_int_]
mov esi, dword [sym.imp.GDI32.dll_GetStockObject]
push 7
call esi
push eax
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
push 4
mov dword [ebp - 0x1570], eax
call esi
push eax
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
push 3
mov dword [ebp - 0x156c], eax
call dword [sym.imp.USER32.dll_GetSysColor]
push eax
lea ecx, [ebp - 0x1530]
call dword [sym.imp.HncBaseDraw.dll_public:_unsigned_long_int___thiscall_CHncDrawContext::SetBkColor_unsigned_long_int_]
push 9
mov dword [ebp - 0x1560], eax
call dword [sym.imp.USER32.dll_GetSysColor]
mov edx, dword [sym.imp.HncBaseDraw.dll_public:_unsigned_long_int___thiscall_CHncDrawContext::SetTextColor_unsigned_long_int_]
lea ecx, [ebp - 0x1530]
push eax
call edx
push 3
mov dword [ebp - 0x155c], eax
call dword [sym.imp.USER32.dll_GetSysColor]
push eax
push edi
call dword [sym.imp.GDI32.dll_SetBkColor]
push 9
mov dword [ebp - 0x1564], eax
call dword [sym.imp.USER32.dll_GetSysColor]
push eax
push edi
call dword [sym.imp.GDI32.dll_SetTextColor]
push 0x11
mov dword [ebp - 0x1568], eax
call esi
push eax
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, str.SoftKeyboard
mov dword [ebp - 0x157c], eax
mov dword [ebp - 0x14f8], 1
mov dword [ebp - 0x14d8], 4
mov dword [ebp - 0x14e0], 4
call fcn.1a010b30
mov esi, eax
test esi, esi
je 0x1a011f7b
push 0
lea eax, [ebp - 0x14d8]
push eax
lea eax, [ebp - 0x14f8]
push eax
lea eax, [ebp - 0x14e0]
push eax
push 0
push str.BaseView
push esi
call dword [sym.imp.HncFoundation.dll_HncRegQueryValueEx]
push 0
push esi
call dword [sym.imp.HncFoundation.dll_HncRegCloseKey]
cmp dword [ebp - 0x14f8], 0
jne 0x1a011f97
call fcn.1a0141f0
mov dword [ebp - 0x14f8], 2
test eax, eax
je 0x1a011fa1
mov dword [ebp - 0x14f8], 3
mov esi, dword [0x1a02407c]
cmp esi, 0x64
jne 0x1a011fc7
mov dword [ebp - 0x14dc], 0xe
mov esi, 1
mov dword [ebp - 0x14d0], 8
jmp 0x1a012018
lea ecx, [esi*8]
mov eax, 0x51eb851f
sub ecx, esi
add ecx, ecx
imul ecx
lea ecx, [esi*8]
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ebp - 0x14dc], eax
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ebp - 0x14d0], eax
mov eax, 0x51eb851f
imul esi
sar edx, 5
mov esi, edx
shr esi, 0x1f
add esi, edx
mov dword [ebp - 0x14ec], esi
call fcn.1a0142b0
call fcn.1a0142b0
lea edi, [esi + esi]
call fcn.1a0142b0
imul eax, dword [ebp - 0x14d0]
mov ecx, edi
cdq
and edx, 3
add eax, edx
sar eax, 2
sub ecx, eax
sub ecx, dword [ebp - 0x14dc]
lea eax, [ecx + ecx*2]
cdq
sub eax, edx
mov esi, eax
sar esi, 1
call fcn.1a0142b0
imul eax, dword [ebp - 0x14d0]
add eax, dword [ebp - 0x14dc]
imul eax, dword [ebp - 0x14f8]
cdq
sub eax, edx
mov edx, dword [ebp - 0x14ec]
sar eax, 1
add eax, edx
mov ecx, eax
shl ecx, 4
sub ecx, eax
sub ecx, edi
mov edi, dword [0x1a02407c]
lea eax, [edx + ecx]
add eax, esi
mov dword [ebp - 0x1544], eax
cmp edi, 0x64
jne 0x1a0120a1
lea esi, [edi - 0x56]
lea edi, [esi - 6]
jmp 0x1a0120d5
lea ecx, [edi*8]
mov eax, 0x51eb851f
sub ecx, edi
add ecx, ecx
imul ecx
lea ecx, [edi*8]
mov eax, 0x51eb851f
sar edx, 5
mov esi, edx
shr esi, 0x1f
add esi, edx
imul ecx
sar edx, 5
mov edi, edx
shr edi, 0x1f
add edi, edx
call fcn.1a0142b0
imul eax, edi
mov edi, dword [0x1a02407c]
cdq
and edx, 3
add eax, edx
sar eax, 2
add eax, esi
mov dword [ebp - 0x1540], eax
cmp edi, 0x64
jne 0x1a01210b
lea esi, [edi - 0x56]
mov dword [ebp - 0x14f8], 1
lea edi, [esi - 6]
jmp 0x1a012156
mov eax, 0x51eb851f
lea ecx, [edi*8]
imul edi
sub ecx, edi
sar edx, 5
add ecx, ecx
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ebp - 0x14f8], eax
mov eax, 0x51eb851f
imul ecx
lea ecx, [edi*8]
mov eax, 0x51eb851f
sar edx, 5
mov esi, edx
shr esi, 0x1f
add esi, edx
imul ecx
sar edx, 5
mov edi, edx
shr edi, 0x1f
add edi, edx
call fcn.1a0142b0
mov ecx, dword [ebp - 0x14f8]
imul eax, edi
add ecx, ecx
mov edi, dword [0x1a02407c]
cdq
and edx, 3
add eax, edx
sar eax, 2
sub eax, ecx
add eax, esi
lea eax, [eax + eax*2]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0x154c], eax
cmp edi, 0x64
jne 0x1a01219e
lea esi, [edi - 0x56]
mov dword [ebp - 0x14d0], 1
lea edi, [esi - 6]
jmp 0x1a0121ed
lea ecx, [edi*8]
mov eax, 0x51eb851f
sub ecx, edi
add ecx, ecx
imul ecx
lea ecx, [edi*8]
mov eax, 0x51eb851f
sar edx, 5
mov esi, edx
shr esi, 0x1f
add esi, edx
imul ecx
mov eax, 0x51eb851f
sar edx, 5
mov edi, edx
shr edi, 0x1f
add edi, edx
imul dword [0x1a02407c]
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ebp - 0x14d0], eax
call fcn.1a0142b0
mov ecx, dword [ebp - 0x14d0]
imul eax, edi
add ecx, ecx
mov dword [ebp - 0x14d0], 1
mov dword [ebp - 0x14d8], 4
mov dword [ebp - 0x14e0], 4
cdq
and edx, 3
add eax, edx
sar eax, 2
sub eax, ecx
mov ecx, str.SoftKeyboard
add eax, esi
mov dword [ebp - 0x1550], eax
call fcn.1a010b30
mov esi, eax
test esi, esi
je 0x1a01226c
push 0
lea eax, [ebp - 0x14d8]
push eax
lea eax, [ebp - 0x14d0]
push eax
lea eax, [ebp - 0x14e0]
push eax
push 0
push str.BaseView
push esi
call dword [sym.imp.HncFoundation.dll_HncRegQueryValueEx]
push 0
push esi
call dword [sym.imp.HncFoundation.dll_HncRegCloseKey]
cmp dword [ebp - 0x14d0], 0
jne 0x1a012288
call fcn.1a0141f0
mov dword [ebp - 0x14d0], 2
test eax, eax
je 0x1a012292
mov dword [ebp - 0x14d0], 3
mov edi, dword [0x1a02407c]
cmp edi, 0x64
jne 0x1a0122af
lea esi, [edi - 0x56]
mov dword [ebp - 0x14dc], 1
lea edi, [esi - 6]
jmp 0x1a0122fe
lea ecx, [edi*8]
mov eax, 0x51eb851f
sub ecx, edi
add ecx, ecx
imul ecx
lea ecx, [edi*8]
mov eax, 0x51eb851f
sar edx, 5
mov esi, edx
shr esi, 0x1f
add esi, edx
imul ecx
mov eax, 0x51eb851f
sar edx, 5
mov edi, edx
shr edi, 0x1f
add edi, edx
imul dword [0x1a02407c]
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ebp - 0x14dc], eax
call fcn.1a0142b0
call fcn.1a0142b0
imul eax, edi
mov ecx, str.SoftKeyboard
mov dword [ebp - 0x14d8], 4
mov dword [ebp - 0x14e0], 4
add eax, esi
imul eax, dword [ebp - 0x14d0]
mov dword [ebp - 0x14d0], 1
cdq
sub eax, edx
sar eax, 1
add eax, dword [ebp - 0x14dc]
mov dword [ebp - 0x1554], eax
call fcn.1a010b30
mov esi, eax
test esi, esi
je 0x1a012381
push 0
lea eax, [ebp - 0x14d8]
push eax
lea eax, [ebp - 0x14d0]
push eax
lea eax, [ebp - 0x14e0]
push eax
push 0
push str.BaseView
push esi
call dword [sym.imp.HncFoundation.dll_HncRegQueryValueEx]
push 0
push esi
call dword [sym.imp.HncFoundation.dll_HncRegCloseKey]
cmp dword [ebp - 0x14d0], 0
jne 0x1a01239d
call fcn.1a0141f0
mov dword [ebp - 0x14d0], 2
test eax, eax
je 0x1a0123a7
mov dword [ebp - 0x14d0], 3
mov edi, dword [0x1a02407c]
cmp edi, 0x64
jne 0x1a0123c4
lea esi, [edi - 0x56]
mov dword [ebp - 0x14dc], 1
lea edi, [esi - 6]
jmp 0x1a012413
lea ecx, [edi*8]
mov eax, 0x51eb851f
sub ecx, edi
add ecx, ecx
imul ecx
lea ecx, [edi*8]
mov eax, 0x51eb851f
sar edx, 5
mov esi, edx
shr esi, 0x1f
add esi, edx
imul ecx
mov eax, 0x51eb851f
sar edx, 5
mov edi, edx
shr edi, 0x1f
add edi, edx
imul dword [0x1a02407c]
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ebp - 0x14dc], eax
call fcn.1a0142b0
call fcn.1a0142b0
mov ecx, dword [0x1a02407c]
imul eax, edi
add eax, esi
imul eax, dword [ebp - 0x14d0]
cdq
sub eax, edx
sar eax, 1
add eax, dword [ebp - 0x14dc]
mov dword [ebp - 0x1558], eax
cmp ecx, 0x64
jne 0x1a012451
mov dword [ebp - 0x153c], 1
jmp 0x1a012468
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov esi, edx
shr esi, 0x1f
add esi, edx
mov dword [ebp - 0x153c], esi
call fcn.1a0142b0
mov edi, dword [ebp - 0x1500]
cmp edi, dword [ebp - 0x1534]
je 0x1a01292d
push 0x208
lea eax, [ebp - 0x848]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x438]
push 0x208
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x1048]
push 0x800
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0xffffffffffffffeb
push dword [0x1a02b604]
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, eax
je 0x1a0124de
mov eax, dword [eax]
test eax, eax
je 0x1a0124de
mov ecx, dword [eax + 4]
jmp 0x1a0124e3
mov ecx, 0x200800
movzx eax, cx
mov edx, eax
mov dword [ebp - 0x14cc], ecx
mov edi, eax
mov eax, ecx
shr eax, 0x10
mov dword [ebp - 0x14d8], eax
mov eax, 0x81e
cmp dx, ax
jne 0x1a01250c
mov esi, 0x7c
jmp 0x1a012516
mov ecx, edx
call fcn.1a0055c0
lea esi, [eax + 0x79]
push 0x104
lea eax, [ebp - 0x848]
push eax
push esi
push dword [0x1a024044]
call dword [sym.imp.HncFoundation.dll_int___stdcall_HncLoadStringWToWSTRUsingRC_Deprecate_struct_HINSTANCE_____unsigned_int__unsigned_short_int___int_]
mov eax, 0x411
lea ecx, [eax + 1]
cmp di, ax
ja 0x1a01258c
mov ecx, dword [ebp - 0x14cc]
je 0x1a012585
mov eax, 0x404
cmp di, ax
ja 0x1a012574
je 0x1a01256d
test di, di
je 0x1a012566
mov eax, 0x400
cmp di, ax
jne 0x1a0125db
mov esi, 0xd2
jmp 0x1a0125db
mov esi, 0xbe
jmp 0x1a0125db
mov esi, 0xba
jmp 0x1a0125db
mov eax, 0x409
cmp di, ax
jne 0x1a0125db
mov esi, 0x96
jmp 0x1a0125db
mov esi, 0xaa
jmp 0x1a0125db
mov eax, 0x804
cmp di, ax
ja 0x1a0125bb
je 0x1a0125d0
cmp di, cx
mov ecx, dword [ebp - 0x14cc]
je 0x1a0125b4
mov eax, 0x800
cmp di, ax
jne 0x1a0125db
mov esi, 0xe6
jmp 0x1a0125db
mov esi, 0x98
jmp 0x1a0125db
mov ecx, dword [ebp - 0x14cc]
mov edx, 0x81e
movzx eax, cx
cmp ax, dx
jne 0x1a0125db
jmp 0x1a0125d6
mov ecx, dword [ebp - 0x14cc]
mov esi, 0xb4
push 0x104
lea eax, [ebp - 0x438]
push eax
mov eax, ecx
sar eax, 0x10
and eax, 0xf
add eax, esi
push eax
push dword [0x1a024044]
call dword [sym.imp.HncFoundation.dll_int___stdcall_HncLoadStringWToWSTRUsingRC_Deprecate_struct_HINSTANCE_____unsigned_int__unsigned_short_int___int_]
lea eax, [ebp - 0x848]
push eax
lea eax, [ebp - 0x1048]
push 0x400
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea eax, [ebp - 0x1048]
add esp, 0xc
push 0x1a01f918
push 0x400
push eax
call esi
mov eax, dword [ebp - 0x14d8]
add esp, 0xc
and al, 0xf0
cmp al, 0x10
jne 0x1a012815
xor eax, eax
lea edi, [ebp - 0x438]
push 0x208
mov ecx, 0x82
push eax
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x230]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x640]
push 0x208
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov ecx, str.UserKeyboard
xor esi, esi
call fcn.1a010b30
mov dword [ebp - 0x150c], eax
test eax, eax
je 0x1a0127c8
push esi
push 0x104
lea ecx, [ebp - 0x230]
push ecx
push esi
push eax
call dword [sym.imp.HncFoundation.dll_HncRegEnumKey]
test eax, eax
jne 0x1a0127c8
nop word [eax + eax]
inc esi
cmp word [ebp - 0x230], 0x7b
mov dword [ebp - 0x14d0], esi
jne 0x1a012710
cmp word [ebp - 0x226], 0x2d
jne 0x1a012710
cmp word [ebp - 0x21c], 0x7d
jne 0x1a012710
lea ecx, [ebp - 0x22e]
call fcn.1a010a10
lea ecx, [ebp - 0x224]
movzx esi, ax
call fcn.1a010a10
movzx ecx, ax
mov eax, esi
mov esi, dword [ebp - 0x14d0]
shl eax, 0x10
or ecx, eax
jmp 0x1a012713
or ecx, 0xffffffff
cmp dword [ebp - 0x14cc], ecx
jne 0x1a0127a5
lea eax, [ebp - 0x230]
push eax
push str.UserKeyboard
lea eax, [ebp - 0x640]
push str._s_s
push eax
call fcn.1a004750
add esp, 0x10
mov dword [ebp - 0x14e0], 3
lea ecx, [ebp - 0x640]
mov dword [ebp - 0x14d8], 0x104
call fcn.1a010b30
mov edi, eax
test edi, edi
je 0x1a0127a5
push 0
lea eax, [ebp - 0x14d8]
push eax
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x14e0]
push eax
push 0
push 0x1a01f164
push edi
call dword [sym.imp.HncFoundation.dll_HncRegQueryValueEx]
push 0
push edi
mov esi, eax
call dword [sym.imp.HncFoundation.dll_HncRegCloseKey]
xor ecx, ecx
test esi, esi
sete cl
test ecx, ecx
jne 0x1a0127c8
mov esi, dword [ebp - 0x14d0]
push 0
push 0x104
lea eax, [ebp - 0x230]
push eax
push esi
push dword [ebp - 0x150c]
call dword [sym.imp.HncFoundation.dll_HncRegEnumKey]
test eax, eax
je 0x1a0126c0
lea ecx, [ebp - 0x438]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1a0127d1
sub ecx, edx
sar ecx, 1
jne 0x1a0127f7
push 0
push 0x70008
push 0x1408
push 0
call sym.HncIMM.dll_HimControl
jmp 0x1a01282d
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x1048]
push eax
push 0x1a01f91c
push eax
call fcn.1a014af0
add esp, 0x10
jmp 0x1a01282d
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x1048]
push 0x400
push eax
call esi
add esp, 0xc
mov eax, dword [ebp - 0x1544]
mov edi, dword [ebp - 0x14d4]
mov dword [ebp - 0x1060], eax
mov eax, dword [ebp - 0x1540]
mov dword [ebp - 0x105c], eax
lea eax, [ebp - 0x10a4]
push eax
push edi
mov dword [ebp - 0x1068], 0
mov dword [ebp - 0x1064], 0
call dword [sym.imp.GDI32.dll_GetTextMetricsW]
mov esi, dword [ebp - 0x1068]
add esi, 2
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov ecx, 0x412
cmp ax, cx
lea ecx, [ebp - 0x1048]
lea edx, [ecx + 2]
je 0x1a0128e0
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1a012890
sub ecx, edx
lea eax, [ebp - 0x1048]
push 0
sar ecx, 1
push ecx
mov ecx, dword [ebp - 0x1064]
push eax
lea eax, [ebp - 0x1068]
push eax
mov eax, dword [ebp - 0x105c]
sub eax, ecx
inc ecx
cdq
sub eax, edx
sar eax, 1
push 2
add eax, ecx
lea ecx, [ebp - 0x1530]
push eax
push esi
call dword [sym.imp.HncBaseDraw.dll_public:_int___thiscall_CHncDrawContext::ExtTextOutW_int__int__unsigned_int__struct_tagRECT_const___unsigned_short_int_const___unsigned_int__int_const__]
jmp 0x1a012927
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1a0128e0
push 0
sub ecx, edx
lea eax, [ebp - 0x1048]
sar ecx, 1
push ecx
mov ecx, dword [ebp - 0x1064]
push eax
lea eax, [ebp - 0x1068]
push eax
mov eax, dword [ebp - 0x105c]
sub eax, dword [ebp - 0x10a4]
sub eax, ecx
inc ecx
cdq
sub eax, edx
push 2
sar eax, 1
add eax, ecx
push eax
push esi
push edi
call dword [sym.imp.GDI32.dll_ExtTextOutW]
mov edi, dword [ebp - 0x1500]
mov ecx, str.SoftKeyboard
mov dword [ebp - 0x1538], 1
mov dword [ebp - 0x14d8], 4
mov dword [ebp - 0x14e0], 4
call fcn.1a010b30
mov esi, eax
test esi, esi
je 0x1a012989
push 0
lea eax, [ebp - 0x14d8]
push eax
lea eax, [ebp - 0x1538]
push eax
lea eax, [ebp - 0x14e0]
push eax
push 0
push str.BaseView
push esi
call dword [sym.imp.HncFoundation.dll_HncRegQueryValueEx]
push 0
push esi
call dword [sym.imp.HncFoundation.dll_HncRegCloseKey]
mov ecx, str.SoftKeyboard
mov dword [ebp - 0x150c], 0
mov dword [ebp - 0x14d8], 4
mov dword [ebp - 0x14e0], 4
call fcn.1a010b30
mov esi, eax
test esi, esi
je 0x1a0129e5
push 0
lea eax, [ebp - 0x14d8]
push eax
lea eax, [ebp - 0x150c]
push eax
lea eax, [ebp - 0x14e0]
push eax
push 0
push str.ShiftView
push esi
call dword [sym.imp.HncFoundation.dll_HncRegQueryValueEx]
push 0
push esi
call dword [sym.imp.HncFoundation.dll_HncRegCloseKey]
mov ecx, str.SoftKeyboard
mov dword [ebp - 0x1548], 0
mov dword [ebp - 0x1574], 4
mov dword [ebp - 0x1578], 4
call fcn.1a010b30
mov esi, eax
test esi, esi
je 0x1a012a41
push 0
lea eax, [ebp - 0x1574]
push eax
lea eax, [ebp - 0x1548]
push eax
lea eax, [ebp - 0x1578]
push eax
push 0
push str.AttrView
push esi
call dword [sym.imp.HncFoundation.dll_HncRegQueryValueEx]
push 0
push esi
call dword [sym.imp.HncFoundation.dll_HncRegCloseKey]
mov eax, dword [ebp - 0x1548]
mov ecx, dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov dword [ebp - 0x14e0], eax
nop dword [eax]
nop word [eax + eax]
mov dword [ebp - 0x18], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x28], xmm0
cmp edi, 0x29
jne 0x1a012aac
mov edx, dword [ebp - 0x14f8]
mov eax, dword [ebp - 0x1544]
add eax, edx
mov dword [ebp - 0x1064], edx
mov dword [ebp - 0x1068], eax
add eax, dword [ebp - 0x154c]
mov dword [ebp - 0x1060], eax
mov eax, dword [ebp - 0x1550]
add eax, edx
mov dword [ebp - 0x105c], eax
jmp 0x1a012b40
movd xmm2, dword [ebp - 0x1554]
movd xmm1, dword [ebp - 0x1558]
imul edx, edi, 0x1d8
mov ecx, dword [ebp - 0x1540]
cvtdq2pd xmm2, xmm2
movsd xmm0, qword [edx + 0x1a02da40]
mulsd xmm0, xmm2
cvtdq2pd xmm1, xmm1
cvttsd2si esi, xmm0
movsd xmm0, qword [edx + 0x1a02da48]
mulsd xmm0, xmm1
cvttsd2si eax, xmm0
movsd xmm0, qword [edx + 0x1a02da50]
mulsd xmm0, xmm2
add ecx, eax
cvttsd2si eax, xmm0
movsd xmm0, qword [edx + 0x1a02da58]
mov edx, dword [ebp - 0x153c]
add eax, esi
mulsd xmm0, xmm1
mov dword [ebp - 0x1060], eax
cvttsd2si eax, xmm0
add eax, ecx
mov dword [ebp - 0x105c], eax
lea eax, [esi + edx]
mov dword [ebp - 0x1068], eax
lea eax, [ecx + edx]
mov ecx, dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov dword [ebp - 0x1064], eax
mov esi, dword [ebx + 8]
lea eax, [edi - 0x1d]
mov dword [ebp - 0x14e8], esi
cmp eax, 0x22
ja case.0x1a012b58.30
movzx eax, byte [eax + 0x1a013774]
jmp dword [eax*4 + 0x1a013760]
push 0x14
call ecx
test ax, ax
jns case.0x1a012b58.30
mov dword [ebp - 0x14e8], 2
jmp case.0x1a012b58.30
push 0x10
jmp 0x1a012b61
push 0x11
jmp 0x1a012b61
push 0x12
call ecx
test ax, ax
mov eax, 2
cmovs esi, eax
mov dword [ebp - 0x14e8], esi
imul esi, edi, 0x1d8
mov dword [ebp - 0x14f0], esi
lea ecx, [esi + 0x1a02daa2]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1a012ba6
sub ecx, edx
sar ecx, 1
jne 0x1a012c0c
lea ecx, [esi + 0x1a02dae0]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1a012bc0
sub ecx, edx
sar ecx, 1
jne 0x1a012c0c
mov eax, dword [ebp - 0x14e8]
xor ecx, ecx
xor edx, edx
mov dword [ebp - 0x14cc], ecx
cmp eax, 2
mov dword [ebp - 0x14fc], 0
mov edi, 0x3b3
mov dword [ebp - 0x14ec], edx
mov ecx, 0x331
cmovne edi, ecx
mov dword [ebp - 0x14f4], edi
jmp 0x1a012d19
cmp dword [ebp - 0x14e8], 2
push 0x10
jne 0x1a012c57
call dword [sym.imp.USER32.dll_GetKeyState]
mov esi, dword [0x1a02d81c]
test ax, ax
mov eax, 0
mov dword [ebp - 0x14ec], 1
sets al
mov edi, 0x193
inc eax
mov dword [ebp - 0x14f4], edi
mov ecx, eax
mov dword [ebp - 0x14fc], eax
mov dword [ebp - 0x14cc], ecx
jmp 0x1a012d30
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
call esi
xor ecx, ecx
mov edx, 1
test ax, ax
mov dword [ebp - 0x14ec], edx
mov edi, 0x111
sets cl
mov dword [ebp - 0x14f4], edi
inc ecx
cmp dword [ebp - 0x1538], 0
mov dword [ebp - 0x14cc], ecx
mov eax, ecx
mov dword [ebp - 0x14fc], ecx
je 0x1a012ccf
xor ecx, ecx
mov dword [ebp - 0x14ec], 3
push 0x10
mov dword [ebp - 0x14cc], ecx
mov dword [ebp - 0x14fc], eax
call esi
test ax, ax
mov esi, 2
mov eax, dword [ebp - 0x14fc]
cmovs eax, esi
xor ecx, ecx
mov dword [ebp - 0x14fc], eax
lea edx, [esi + 1]
jmp 0x1a012cda
mov eax, dword [ebp - 0x14fc]
mov esi, 2
cmp dword [ebp - 0x150c], 0
je 0x1a012d03
mov eax, 1
mov dword [ebp - 0x14fc], 2
cmp ecx, 2
cmove ecx, eax
mov dword [ebp - 0x14cc], ecx
lea edx, [eax + 2]
jmp 0x1a012d0d
test ecx, ecx
jne 0x1a012d13
cmp eax, 2
cmove edx, esi
mov dword [ebp - 0x14ec], edx
mov eax, dword [ebp - 0x14e8]
cmp eax, 2
jne 0x1a012dc1
mov esi, dword [0x1a02d81c]
test edx, edx
je 0x1a012e4d
cmp dword [ebp - 0x14e0], 0
je 0x1a012e4d
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
xor ecx, ecx
test ax, ax
sets cl
inc ecx
add ecx, dword [ebp - 0x14e4]
mov eax, ecx
shl eax, 5
sub eax, ecx
mov ecx, dword [ebp - 0x14f0]
movzx eax, word [ecx + eax*2 + 0x1a02da78]
or edi, eax
mov dword [ebp - 0x14f4], edi
test edi, 0x1000
je 0x1a012d84
mov esi, dword [0x1a02d820]
jmp 0x1a012e4d
test edi, 0x2000
je 0x1a012d97
mov esi, dword [0x1a02d824]
jmp 0x1a012e4d
test edi, 0x4000
je 0x1a012daa
mov esi, dword [0x1a02d828]
jmp 0x1a012e4d
test edi, 0x8000
je 0x1a012e4d
mov esi, dword [0x1a02d82c]
jmp 0x1a012e4d
mov esi, dword [0x1a02d808]
test edx, edx
je 0x1a012e4d
cmp dword [ebp - 0x14e0], 0
je 0x1a012e4d
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
xor ecx, ecx
test ax, ax
sets cl
inc ecx
add ecx, dword [ebp - 0x14e4]
mov eax, ecx
shl eax, 5
sub eax, ecx
mov ecx, dword [ebp - 0x14f0]
movzx eax, word [ecx + eax*2 + 0x1a02da78]
or edi, eax
mov dword [ebp - 0x14f4], edi
test edi, 0x1000
je 0x1a012e20
mov esi, dword [0x1a02d80c]
jmp 0x1a012e4d
test edi, 0x2000
je 0x1a012e30
mov esi, dword [0x1a02d810]
jmp 0x1a012e4d
test edi, 0x4000
je 0x1a012e40
mov esi, dword [0x1a02d814]
jmp 0x1a012e4d
test edi, 0x8000
cmovne esi, dword [0x1a02d818]
push esi
mov esi, dword [ebp - 0x14d4]
lea eax, [ebp - 0x1068]
push eax
push esi
call dword [sym.imp.USER32.dll_FillRect]
dec dword [ebp - 0x1060]
dec dword [ebp - 0x105c]
mov edi, dword [ebp - 0x14e8]
cmp edi, 2
mov eax, dword [0x1a02d830]
cmove eax, dword [0x1a02d834]
push eax
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
push 0
push dword [ebp - 0x105c]
mov esi, eax
push dword [ebp - 0x1068]
push dword [ebp - 0x14d4]
call dword [sym.imp.GDI32.dll_MoveToEx]
push dword [ebp - 0x1064]
push dword [ebp - 0x1068]
push dword [ebp - 0x14d4]
call dword [sym.imp.GDI32.dll_LineTo]
push dword [ebp - 0x1064]
push dword [ebp - 0x1060]
push dword [ebp - 0x14d4]
call dword [sym.imp.GDI32.dll_LineTo]
push esi
mov esi, dword [ebp - 0x14d4]
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [0x1a02d834]
cmp edi, 2
cmove eax, dword [0x1a02d830]
push eax
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
push dword [ebp - 0x105c]
mov esi, eax
push dword [ebp - 0x1060]
push dword [ebp - 0x14d4]
call dword [sym.imp.GDI32.dll_LineTo]
push dword [ebp - 0x105c]
push dword [ebp - 0x1068]
push dword [ebp - 0x14d4]
call dword [sym.imp.GDI32.dll_LineTo]
push esi
mov esi, dword [ebp - 0x14d4]
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
cmp edi, 2
jne 0x1a012f52
push 1
push 1
lea eax, [ebp - 0x1068]
push eax
call dword [sym.imp.USER32.dll_OffsetRect]
mov edx, dword [ebp - 0x14cc]
cmp edx, dword [ebp - 0x14fc]
ja 0x1a01361f
nop dword [eax]
nop dword [eax + eax]
movups xmm0, xmmword [ebp - 0x1068]
mov esi, dword [ebp - 0x14ec]
movups xmmword [ebp - 0x1058], xmm0
cmp esi, 2
jne 0x1a012f92
cmp edx, 1
je 0x1a013606
test edx, edx
jne 0x1a012ffa
test esi, esi
jne 0x1a012fbb
mov edi, dword [ebp - 0x14f0]
lea eax, [edi + 0x1a02da64]
push eax
lea eax, [ebp - 0x28]
push 0xa
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
jmp 0x1a013092
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
mov edi, dword [ebp - 0x14f0]
test ax, ax
jns 0x1a012fe4
mov ax, word [edi + 0x1a02da66]
mov word [ebp - 0x28], ax
xor eax, eax
mov word [ebp - 0x26], ax
jmp 0x1a013092
mov ax, word [edi + 0x1a02da64]
mov word [ebp - 0x28], ax
xor eax, eax
mov word [ebp - 0x26], ax
jmp 0x1a013092
mov edi, dword [ebp - 0x14f0]
test esi, esi
je 0x1a0130cb
mov ecx, dword [ebp - 0x14e4]
add ecx, edx
mov eax, ecx
shl eax, 5
sub eax, ecx
lea eax, [eax*2 + 0x1a02da64]
add eax, edi
push eax
lea eax, [ebp - 0x28]
push 0xa
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
mov eax, dword [ebp - 0x14e4]
add esp, 0xc
cmp word [ebp - 0x28], 0
jne 0x1a0130d3
cmp eax, 2
jb 0x1a0130d3
mov ecx, dword [ebp - 0x14cc]
lea esi, [eax - 2]
add ecx, esi
mov eax, ecx
shl eax, 5
sub eax, ecx
lea edi, [edi + eax*2]
add edi, 0x1a02da64
test esi, esi
js 0x1a013086
push edi
lea eax, [ebp - 0x28]
push 0xa
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
sub esi, 2
sub edi, 0x7c
cmp word [ebp - 0x28], 0
je 0x1a013065
mov edi, dword [ebp - 0x14f0]
mov esi, dword [ebp - 0x14ec]
mov edx, dword [ebp - 0x14cc]
mov eax, dword [ebp - 0x14e4]
cmp dword [ebp - 0x14e8], 1
jne 0x1a013125
test esi, esi
je 0x1a013125
test edx, edx
jne 0x1a0130db
movzx eax, word [edi + 0x1a02da78]
or eax, 0x111
mov dword [ebp - 0x14f4], eax
jmp 0x1a013125
xor eax, eax
mov word [ebp - 0x28], ax
jmp 0x1a013098
mov edx, dword [ebp - 0x14cc]
jmp 0x1a01309e
lea ecx, [edx + eax]
mov eax, ecx
shl eax, 5
sub eax, ecx
movzx eax, word [edi + eax*2 + 0x1a02da78]
or eax, 0x111
mov dword [ebp - 0x14f4], eax
cmp edx, 1
jne 0x1a01310c
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1a01311e
jmp 0x1a013125
cmp edx, 2
jne 0x1a013125
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1a013125
or dword [ebp - 0x14f4], 0x40
cmp esi, 1
jbe 0x1a01320f
mov edi, dword [ebp - 0x1050]
mov esi, dword [ebp - 0x104c]
sub edi, dword [ebp - 0x1058]
sub esi, dword [ebp - 0x1054]
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x1a0131b1
mov ecx, dword [ebp - 0x14cc]
sub ecx, 0
je 0x1a013191
sub ecx, 1
je 0x1a0131e4
sub ecx, 1
jne 0x1a01320f
mov eax, edi
cdq
sub eax, edx
sar eax, 1
add dword [ebp - 0x1058], eax
mov eax, esi
cdq
sub eax, edx
sar eax, 1
neg eax
add dword [ebp - 0x104c], eax
jmp 0x1a01320f
mov eax, edi
cdq
sub eax, edx
sar eax, 1
neg eax
add dword [ebp - 0x1050], eax
mov eax, esi
cdq
sub eax, edx
sar eax, 1
neg eax
add dword [ebp - 0x104c], eax
jmp 0x1a01320f
mov eax, dword [ebp - 0x14cc]
sub eax, 0
je 0x1a0131f3
sub eax, 1
je 0x1a0131d7
sub eax, 1
jne 0x1a01320f
mov eax, esi
cdq
sub eax, edx
sar eax, 1
neg eax
add dword [ebp - 0x104c], eax
jmp 0x1a01320f
mov eax, edi
cdq
sub eax, edx
sar eax, 1
add dword [ebp - 0x1058], eax
mov eax, esi
cdq
sub eax, edx
sar eax, 1
add dword [ebp - 0x1054], eax
jmp 0x1a01320f
mov eax, esi
cdq
sub eax, edx
sar eax, 1
add dword [ebp - 0x1054], eax
mov eax, edi
cdq
sub eax, edx
sar eax, 1
neg eax
add dword [ebp - 0x1050], eax
mov eax, dword [ebp - 0x14f4]
test al, al
jns 0x1a013220
push 0x2929cc
jmp 0x1a013238
test al, 0x40
je 0x1a01322b
push 0xcc2929
jmp 0x1a013238
test al, 0x20
je 0x1a013236
push 0x646464
jmp 0x1a013238
push 0
mov esi, dword [sym.imp.HncBaseDraw.dll_public:_unsigned_long_int___thiscall_CHncDrawContext::SetTextColor_unsigned_long_int_]
lea ecx, [ebp - 0x1530]
call esi
cmp dword [ebp - 0x1500], 0x29
jne 0x1a013273
mov edi, dword [sym.imp.USER32.dll_GetSysColor]
push 0xf
call edi
push eax
lea ecx, [ebp - 0x1530]
call dword [sym.imp.HncBaseDraw.dll_public:_unsigned_long_int___thiscall_CHncDrawContext::SetBkColor_unsigned_long_int_]
push 0x12
call edi
push eax
lea ecx, [ebp - 0x1530]
call esi
cmp word [ebp - 0x28], 0
je 0x1a013600
xorps xmm0, xmm0
lea ecx, [ebp - 0x28]
xor esi, esi
movlpd qword [ebp - 0x1518], xmm0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1a013291
sub ecx, edx
lea eax, [ebp - 0x1518]
push eax
sar ecx, 1
lea eax, [ebp - 0x28]
push ecx
push eax
lea ecx, [ebp - 0x1530]
call dword [sym.imp.HncBaseDraw.dll_public:_int___thiscall_CHncDrawContext::GetTextExtentPointW_unsigned_short_int_const___int__struct_tagSIZE__]
mov eax, dword [ebp - 0x28]
mov ecx, 0xff
add eax, 0x1000
cmp ax, cx
mov eax, dword [ebp - 0x1050]
ja 0x1a0132f8
mov ecx, dword [ebp - 0x1518]
test ecx, ecx
jne 0x1a0132f4
mov ecx, dword [ebp - 0x1058]
sub eax, ecx
mov eax, eax
test eax, eax
jns 0x1a0132eb
add eax, 1
sar eax, 1
lea edi, [ecx - 8]
add edi, eax
jmp 0x1a013311
sub eax, ecx
jmp 0x1a0132fe
sub eax, dword [ebp - 0x1518]
sub eax, dword [ebp - 0x1058]
cdq
sub eax, edx
mov edi, eax
sar edi, 1
add edi, dword [ebp - 0x1058]
mov ecx, dword [ebp - 0x1500]
mov eax, 0x1a01eee0
mov edx, 1
cmp dword [eax], ecx
cmove esi, edx
add eax, 4
cmp eax, 0x1a01ef14
jl 0x1a013321
test esi, esi
je 0x1a013386
lea ecx, [ebp - 0x28]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1a013340
sub ecx, edx
lea eax, [ebp - 0x1518]
push eax
sar ecx, 1
lea eax, [ebp - 0x28]
push ecx
push eax
lea ecx, [ebp - 0x1530]
call dword [sym.imp.HncBaseDraw.dll_public:_int___thiscall_CHncDrawContext::GetTextExtentPointW_unsigned_short_int_const___int__struct_tagSIZE__]
mov eax, dword [ebp - 0x1050]
sub eax, dword [ebp - 0x1518]
sub eax, dword [ebp - 0x1058]
cdq
sub eax, edx
mov edi, eax
sar edi, 1
add edi, dword [ebp - 0x1058]
mov eax, dword [ebp - 0x104c]
sub eax, dword [ebp - 0x1514]
sub eax, dword [ebp - 0x1054]
cdq
sub eax, edx
mov esi, eax
sar esi, 1
add esi, dword [ebp - 0x1054]
cmp dword [ebp - 0x1500], 0x29
jne 0x1a0135bc
mov ecx, str.SoftKeyboard
mov dword [ebp - 0x14d0], 1
mov dword [ebp - 0x14d8], 4
mov dword [ebp - 0x14dc], 4
call fcn.1a010b30
mov edi, dword [sym.imp.HncFoundation.dll_HncRegQueryValueEx]
mov esi, eax
test esi, esi
je 0x1a013410
push 0
lea eax, [ebp - 0x14d8]
push eax
lea eax, [ebp - 0x14d0]
push eax
lea eax, [ebp - 0x14dc]
push eax
push 0
push str.Size
push esi
call edi
push 0
push esi
call dword [sym.imp.HncFoundation.dll_HncRegCloseKey]
mov esi, dword [ebp - 0x14d0]
test esi, esi
js 0x1a01341f
cmp esi, 2
jle 0x1a013424
mov esi, 1
push 7
call sym.HncIMM.dll__HimGetMV_4
add eax, esi
mov dword [ebp - 0x14d0], 1
mov ecx, str.SoftKeyboard
mov dword [ebp - 0x14d8], eax
mov dword [ebp - 0x14dc], 4
mov dword [ebp - 0x1504], 4
call fcn.1a010b30
mov esi, eax
test esi, esi
je 0x1a01348b
push 0
lea eax, [ebp - 0x14dc]
push eax
lea eax, [ebp - 0x14d0]
push eax
lea eax, [ebp - 0x1504]
push eax
push 0
push str.Size
push esi
call edi
push 0
push esi
call dword [sym.imp.HncFoundation.dll_HncRegCloseKey]
mov edi, dword [ebp - 0x14d0]
test edi, edi
js 0x1a01349a
cmp edi, 2
jle 0x1a01349f
mov edi, 1
push 6
call sym.HncIMM.dll__HimGetMV_4
push 0
lea esi, [edi + eax]
mov eax, dword [ebp - 0x1050]
sub eax, dword [ebp - 0x1058]
cdq
sub eax, edx
mov edi, eax
mov eax, dword [ebp - 0x14d8]
cdq
sub eax, edx
sar edi, 1
sar eax, 1
sub edi, eax
mov eax, dword [ebp - 0x104c]
sub eax, dword [ebp - 0x1054]
add edi, dword [ebp - 0x1058]
cdq
sub eax, edx
mov dword [ebp - 0x14dc], edi
mov ecx, dword [ebp - 0x14dc]
mov edi, eax
mov eax, esi
sar edi, 1
cdq
sub eax, edx
sar eax, 1
sub edi, eax
mov eax, dword [ebp - 0x14d8]
add edi, dword [ebp - 0x1054]
add eax, ecx
mov dword [ebp - 0x1504], edi
add edi, esi
mov esi, dword [ebp - 0x1504]
push esi
push ecx
push dword [ebp - 0x14d4]
mov dword [ebp - 0x14d0], eax
call dword [sym.imp.GDI32.dll_MoveToEx]
mov eax, dword [ebp - 0x14d0]
push edi
dec eax
push eax
push dword [ebp - 0x14d4]
call dword [sym.imp.GDI32.dll_LineTo]
mov eax, dword [ebp - 0x14dc]
push 0
push esi
inc eax
push eax
push dword [ebp - 0x14d4]
call dword [sym.imp.GDI32.dll_MoveToEx]
push edi
push dword [ebp - 0x14d0]
push dword [ebp - 0x14d4]
call dword [sym.imp.GDI32.dll_LineTo]
push 0
dec edi
push edi
push dword [ebp - 0x14dc]
push dword [ebp - 0x14d4]
call dword [sym.imp.GDI32.dll_MoveToEx]
mov eax, dword [ebp - 0x14d0]
dec esi
push esi
dec eax
push eax
push dword [ebp - 0x14d4]
call dword [sym.imp.GDI32.dll_LineTo]
mov eax, dword [ebp - 0x14dc]
push 0
push edi
mov edi, dword [ebp - 0x14d4]
inc eax
push eax
push edi
call dword [sym.imp.GDI32.dll_MoveToEx]
push esi
push dword [ebp - 0x14d0]
push edi
call dword [sym.imp.GDI32.dll_LineTo]
jmp 0x1a013600
push 0x4000000
lea ecx, [ebp - 0x1530]
call dword [sym.imp.HncBaseDraw.dll_public:_unsigned_int___thiscall_CHncDrawContext::SetTextAlign_unsigned_int_]
lea ecx, [ebp - 0x28]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1a0135d3
push 0
sub ecx, edx
lea eax, [ebp - 0x28]
sar ecx, 1
push ecx
push eax
lea eax, [ebp - 0x1058]
push eax
push 4
push esi
push edi
lea ecx, [ebp - 0x1530]
call dword [sym.imp.HncBaseDraw.dll_public:_int___thiscall_CHncDrawContext::ExtTextOutW_int__int__unsigned_int__struct_tagRECT_const___unsigned_short_int_const___unsigned_int__int_const__]
mov edx, dword [ebp - 0x14cc]
inc edx
mov dword [ebp - 0x14cc], edx
cmp edx, dword [ebp - 0x14fc]
jle 0x1a012f70
mov esi, dword [ebp - 0x14d4]
mov edi, dword [ebp - 0x1500]
mov ecx, dword [sym.imp.USER32.dll_GetAsyncKeyState]
inc edi
mov dword [ebp - 0x1500], edi
cmp edi, dword [ebp - 0x1534]
jle 0x1a012a60
push dword [ebp - 0x155c]
mov edx, dword [sym.imp.HncBaseDraw.dll_public:_unsigned_long_int___thiscall_CHncDrawContext::SetTextColor_unsigned_long_int_]
lea ecx, [ebp - 0x1530]
call edx
push dword [ebp - 0x1560]
lea ecx, [ebp - 0x1530]
call dword [sym.imp.HncBaseDraw.dll_public:_unsigned_long_int___thiscall_CHncDrawContext::SetBkColor_unsigned_long_int_]
push dword [ebp - 0x1564]
push esi
call dword [sym.imp.GDI32.dll_SetBkColor]
push dword [ebp - 0x1568]
push esi
call dword [sym.imp.GDI32.dll_SetTextColor]
push dword [ebp - 0x156c]
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
push esi
call edi
push dword [ebp - 0x1570]
push esi
call edi
push dword [ebp - 0x157c]
push esi
call edi
lea ecx, [ebp - 0x1510]
call dword [sym.imp.HncBaseDraw.dll_public:_void___thiscall_CHncFont::ReleaseFont_void_]
lea ecx, [ebp - 0x1530]
call dword [sym.imp.HncBaseDraw.dll_public:_struct_HDC______thiscall_CHncDrawContext::DetachDC_void_]
push 0xcc0020
push 0
push 0
push dword [0x1a02b694]
push dword [0x1a02b68c]
push dword [0x1a02b688]
push dword [0x1a02b684]
push dword [0x1a02b680]
push dword [0x1a02b690]
call dword [sym.imp.GDI32.dll_BitBlt]
push dword [0x1a02b698]
push dword [0x1a02b694]
call edi
push dword [0x1a02b694]
call dword [sym.imp.GDI32.dll_DeleteDC]
push dword [0x1a02b690]
mov dword [0x1a02b694], 0
push dword [ebp - 0x1508]
call dword [sym.imp.USER32.dll_ReleaseDC]
lea ecx, [ebp - 0x1510]
mov dword [0x1a02b690], 0
call dword [sym.imp.HncBaseDraw.dll_public:_void___thiscall_CHncFont::destructor_void_]
lea ecx, [ebp - 0x1530]
call dword [sym.imp.HncBaseDraw.dll_public:_void___thiscall_CHncDrawContext::destructor_void_]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1a01aaa5
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret