Function at 0x100022b1
Capabilities:
Terminate process

Disassembly:
push eax
call sub.gdi32.dll_GetBkColor
mov eax, dword [0x10052970]
sub edx, eax
mov eax, dword [0x100529c8]
add ecx, eax
cmp dword [0x10052bbc], eax
je 0x100022e9
mov edx, dword [0x10052d34]
add edx, edi
mov esi, dword [0x10052be0]
add eax, ecx
adc dword [0x100529ec], eax
mov dword [0x10052be8], edi
push ecx
call sub.gdi32.dll_GetBkMode
mov eax, dword [0x10052970]
add ecx, edx
mov edi, dword [0x10052980]
add eax, edi
cmp eax, eax
jae 0x1000232c
mov ecx, dword [0x10052d44]
mov edx, 2
mov eax, dword [0x10052adc]
mov ecx, pe_nt_image_headers32
mov dword [0x10052c6c], eax
mov dword [0x10052984], eax
mov ecx, dword [0x10052a60]
mov eax, dword [0x10052b8c]
mov dword [0x10052d60], eax
push 2
call sub.gdi32.dll_GetTextColor
mov eax, dword [0x10052c78]
sub edi, edx
sub esi, edi
cmp edi, esi
jbe 0x10002369
add edi, dword [0x10052978]
sub eax, edi
mov edi, dword [0x10052b48]
mov ax, 0x80
mov dword [0x10052a60], edi
mov dword [0x10052d64], edx
mov edx, dword [0x10052c4c]
sub dword [0x100529ec], 0xd1
mov ecx, dword [0x10052cc4]
call sub.USER32.dll_GetDesktopWindow
mov edi, dword [0x10052adc]
mov ax, 0x27
cmp dword [0x10052c28], eax
jne 0x100023aa
mov edx, dword [0x10052b70]
sub esi, edi
mov dword [0x10052970], edi
mov dword [0x10052aec], esi
xor dword [0x10052a5c], eax
mov edi, dword [0x10052b64]
mov eax, dword [0x10052bc8]
mov dx, 4
mov eax, dword [0x10052c10]
cmp dword [0x100529ec], 0x2b
ja 0x100023f0
mov esi, dword [0x10052be8]
sub eax, dword [0x10052bb0]
mov esi, dword [0x10052b70]
mov eax, 0x3f
sub ecx, eax
mov dword [0x10052970], eax
mov dword [0x10052ce8], esi
mov eax, dword [0x10052d0c]
push 0x10052907
call sub.KERNEL32.dll_LoadLibraryA
mov edi, eax
mov edx, 0x10052a71
mov ecx, dword [edx + 0x10]
sub ecx, edx
mov dword [edx], ecx
mov dword [edx + 0x14], ecx
mov edx, dword [edi]
inc edi
cmp edx, dword [0x10052922]
jne 0x1000240b
mov eax, dword [0x10052bd0]
sub edx, eax
sub eax, eax
cmp eax, 1
jae 0x10002437
mov dword [0x100529ec], edi
mov eax, dword [0x10052d4c]
sub eax, edi
mov dword [0x10052ad0], ecx
mov eax, dword [0x10052ab0]
mov eax, dword [0x10052c2c]
mov eax, dword [0x10052be0]
sub eax, esi
or eax, dword [0x10052b6c]
add eax, esi
test eax, eax
jbe 0x1000246c
mov edi, dword [0x10052ae4]
mov eax, dword [0x10052970]
add eax, ecx
mov eax, 0x20
mov dword [0x10052c34], edi
mov edx, dword [0x10052ae0]
push dword [0x10052d34]
call sub.gdi32.dll_GetTextColor
mov ecx, dword [0x10052d28]
mov ax, 0x2c
mov cx, 1
cmp edi, esi
jl 0x100024a8
mov eax, dword [0x10052b88]
mov edi, dword [0x10052b1c]
sub eax, eax
mov dword [0x10052c6c], ecx
mov dword [0x10052cbc], edx
mov dword [0x10052c70], eax
push esi
call sub.gdi32.dll_GetBkMode
mov eax, dword [0x10052b28]
mov ax, 0xad
cmp ecx, 1
jne 0x100024df
add eax, dword [0x10052b5c]
sub esi, esi
mov dword [0x10052c8c], esi
mov dword [0x10052b04], esi
mov dword [0x10052a54], eax
mov dword [0x10052970], eax
mov edi, dword [0x10052cf8]
call fcn.10003191
mov eax, dword [0x10052a90]
sub eax, edi
mov eax, dword [0x10052c94]
cmp eax, edx
jnp 0x10002512
mov eax, dword [0x10052970]
add ecx, ecx
mov ecx, dword [0x10052b54]
mov dword [0x10052b60], edx
mov eax, dword [0x10052ad8]
mov dword [0x10052ad8], edi
call sub.USER32.dll_GetCapture
mov edx, dword [0x10052970]
mov edi, 4
mov esi, dword [0x10052970]
cmp eax, 1
je 0x10002553
mov dword [0x10052b48], eax
mov edi, dword [0x10052bfc]
mov di, 1
mov dword [0x100529e8], eax
mov dword [0x10052a60], edx
mov edi, dword [0x100529e4]
mov dword [0x10052bac], eax
call fcn.10002ad1
mov eax, dword [0x10052bc4]
sub edx, eax
mov eax, dword [0x10052d28]
cmp eax, dword [0x10052ca8]
je 0x10002597
mov dword [0x100529b4], ecx
mov edx, dword [0x10052b0c]
add eax, eax
add eax, esi
xor dword [0x100529c8], eax
xor dword [0x1005299c], esi
mov dword [0x10052980], eax
mov dword [0x10052a9c], eax
call fcn.10002d6e
mov eax, dword [0x10052cb4]
mov dx, 0x80
mov eax, dword [0x100529fc]
cmp esi, 0
jne 0x100025bd
mov esi, dword [0x100529c8]
add edi, eax
mov dword [0x10052a98], edi
mov dword [0x10052cc4], eax
call fcn.10001960
mov edi, dword [0x100529bc]
sub eax, edx
mov esi, dword [0x10052bb4]
or eax, eax
cmp dword [0x10052b50], eax
jne 0x100025fb
mov dword [0x100529d8], edi
mov eax, dword [0x10052ba8]
mov si, 8
mov eax, dword [0x10052b00]
add edx, esi
mov dword [0x10052c28], esi
mov esi, dword [0x10052970]
mov dx, 0x59
mov eax, dword [0x100529e0]
cmp ecx, eax
je 0x10002624
mov eax, dword [0x10052cd8]
sub edi, edi
mov eax, dword [0x10052ac8]
mov dword [0x10052ac0], eax
mov eax, dword [0x100529b8]
mov dword [0x10052a18], eax
call fcn.1000217b
mov edi, dword [0x10052ce0]
sub ecx, eax
mov eax, dword [0x10052b1c]
sub esi, esi
cmp eax, 1
je 0x1000266a
mov dword [0x10052a90], eax
mov eax, dword [0x10052b88]
mov eax, dword [0x10052b7c]
sub eax, eax
mov eax, dword [0x10052c7c]
add esi, esi
mov dword [0x10052b70], eax
mov dword [0x10052d54], esi
mov dword [0x100529c4], eax
mov edi, dword [0x10052be0]
mov edi, dword [0x10052b98]
mov edi, dword [0x10052bd8]
mov ax, 0x8f
mov eax, dword [0x10052be4]
mov ax, 1
cmp edi, dword [0x10052b10]
jl 0x100026ac
mov edi, dword [0x100529fc]
mov eax, dword [0x10052d50]
mov edi, 0x80
mov dword [0x10052a48], eax
mov ecx, dword [0x10052a2c]
xor edx, dword [0x10052b24]
call fcn.10001f65
mov eax, dword [0x10052ae0]
add eax, eax
xor edi, eax
cmp dword [0x10052b10], 0x96
jne 0x100026fd
mov edi, dword [0x10052b68]
mov eax, dword [0x10052b18]
mov esi, dword [0x10052cb8]
mov si, 0x20
mov eax, dword [0x100529f0]
mov dword [0x10052d30], ecx
mov dword [0x10052c34], esi
mov eax, dword [0x10052b60]
mov ecx, dword [0x10052a5c]
mov eax, dword [0x10052aa4]
mov edx, dword [0x10052c08]
and dword [0x10052cb8], eax
push dword [0x10052cd8]
call sub.gdi32.dll_GetBkMode
mov eax, dword [0x10052b98]
add eax, eax
or eax, dword [0x10052d60]
cmp ecx, eax
jb 0x1000274e
mov dword [0x10052a74], ecx
mov esi, dword [0x10052af4]
add eax, eax
sub esi, dword [0x10052d14]
mov dword [0x10052970], edi
mov eax, dword [0x10052aa4]
mov eax, dword [0x10052cc0]
mov dword [0x100529a8], esi
call fcn.10002f7e
mov eax, dword [0x10052970]
sub eax, eax
cmp dword [0x10052d10], eax
jb 0x1000277c
mov eax, dword [0x10052a78]
mov ax, 1
mov dword [0x10052994], edi
mov eax, dword [0x10052990]
mov eax, dword [0x10052b88]
push dword [0x10052c44]
call sub.gdi32.dll_GetBkMode
mov ecx, dword [0x10052c00]
add ecx, eax
mov ax, 0x40
cmp esi, 1
je 0x100027b9
mov edi, dword [0x100529cc]
add eax, eax
mov si, 0x20
mov dword [0x10052b9c], eax
mov dword [0x10052970], ecx
mov dword [0x100529e4], eax
mov edi, dword [0x10052d28]
call fcn.100011a8
mov eax, dword [0x10052ab4]
mov eax, 0x5c
or eax, dword [0x10052c34]
sub esi, eax
cmp eax, 1
jo 0x100027fc
mov eax, dword [0x100529bc]
mov eax, 4
mov dword [0x10052a30], edi
mov dword [0x10052d04], eax
mov ecx, dword [0x10052970]
mov dword [0x10052b8c], edx
call sub.USER32.dll_GetCapture
call fcn.10003191
call fcn.100029d7
mov eax, dword [0x10052b44]
mov dx, 0x6c
add edx, eax
cmp esi, 0
jg 0x1000282f
mov eax, dword [0x100529e0]
mov eax, dword [0x100529e8]
mov eax, 0xbf
mov dword [0x10052c14], eax
mov ecx, dword [0x10052970]
mov dword [0x10052c88], esi
call fcn.1000217b
mov eax, dword [0x10052cd4]
mov eax, 8
mov eax, dword [0x10052ce8]
test edx, edx
jbe 0x10002870
mov esi, dword [0x10052c84]
mov edi, dword [0x10052c78]
add eax, ecx
mov ax, 0xd6
mov dword [0x10052a10], edi
mov eax, dword [0x10052a20]
mov eax, dword [0x10052cd4]
mov edi, dword [0x100529d8]
add eax, eax
mov edi, dword [0x10052d34]
cmp dword [0x10052ad4], 0x20
jbe 0x100028b0
mov dword [0x100529b8], eax
mov esi, dword [0x10052c9c]
and eax, ecx
sub eax, ecx
mov dword [0x10052cf8], eax
mov dword [0x10052a98], eax
mov dword [0x10052d58], eax
sub esi, dword [0x100529d0]
mov dword [0x10052a64], eax
call fcn.10002f7e
mov eax, dword [0x10052ce0]
mov si, 0xf4
mov ecx, dword [0x10052b18]
cmp ecx, 0
je 0x100028f6
mov dword [0x10052bc4], esi
mov esi, dword [0x10052bec]
sub eax, eax
mov edx, dword [0x10052ad4]
mov di, 0xe6
mov dword [0x10052bd4], esi
mov dword [0x10052c4c], eax
mov dword [0x10052988], eax
mov eax, dword [0x10052be8]
mov eax, dword [0x10052a5c]
push eax
call sub.gdi32.dll_GetTextColor
call fcn.100012b9
mov edi, dword [0x10052a48]
sub eax, eax
cmp dword [0x10052d08], 2
jbe 0x1000293c
mov dword [0x10052c68], edi
mov eax, dword [0x10052c88]
mov edi, 4
mov eax, dword [0x10052bfc]
mov dword [0x10052998], esi
mov dword [0x100529a8], eax
mov eax, dword [0x10052ba4]
mov cx, 0x49
and eax, edi
test edx, edx
jl 0x1000296e
mov eax, dword [0x10052bbc]
mov eax, dword [0x10052b64]
mov esi, dword [0x100529b0]
sub ecx, eax
mov eax, dword [0x10052c20]
mov dword [0x10052b0c], edx
mov dword [0x10052b94], esi
mov dword [0x10052c20], edi
mov dword [0x10052c88], eax
call fcn.100029d7
mov esi, dword [0x10052b0c]
add eax, eax
mov eax, dword [0x10052b04]
add edx, ecx
cmp edx, 0
ja 0x100029ba
mov dword [0x10052a48], eax
mov edi, dword [0x10052b9c]
mov esi, dword [0x10052b18]
mov si, 0x20
sub eax, eax
mov dword [0x10052d14], edi
mov eax, dword [0x10052ac4]
mov dword [0x100529e4], esi
mov dword [0x10052b38], esi
mov dword [0x10052d58], eax
call fcn.100029d7
call fcn.100011a8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]