Function at 0x1001635
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xd58
mov eax, dword [0x105405c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0xc64], eax
mov eax, dword [ebp + 0x10]
push 0x200
mov dword [ebp - 0xc68], eax
xor ebx, ebx
lea eax, [ebp - 0x458]
push eax
xor esi, esi
push 0xd9
inc esi
push ebx
mov dword [ebp - 0xc5c], ebx
mov dword [ebp - 0xc60], ebx
mov dword [ebp - 0xcc0], esi
mov dword [ebp - 0xcbc], ebx
mov dword [ebp - 0xcb8], ebx
mov dword [ebp - 0xcb4], ebx
call edi
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x1027336
mov ecx, dword [0x10540a4]
call fcn.0100943c
push 0x1054a58
push 0x10551e0
push 0x1031ed3
push 0x1001d5c
call fcn.01009337
cmp dword [0x1055204], ebx
jne 0x102733d
push ebx
call edi
push eax
call fcn.01009e97
mov esi, dword [ebp - 0xc64]
push ebx
mov dword [ebp - 0xcf0], 0x30
mov dword [ebp - 0xcec], ebx
mov dword [ebp - 0xce8], 0x1001ede
mov dword [ebp - 0xce4], ebx
mov dword [ebp - 0xce0], ebx
mov dword [ebp - 0xcdc], esi
call fcn.01009405
push 1
mov dword [ebp - 0xcd8], eax
call fcn.01009405
push 0x7f00
push ebx
mov dword [ebp - 0xcc4], eax
call dword [sym.imp.USER32.dll_LoadCursorW]
mov dword [ebp - 0xcd4], eax
lea eax, [ebp - 0xc74]
push eax
push 1
push 0x9d
push ebx
call edi
push eax
call fcn.0101f633
mov eax, dword [ebp - 0xc74]
mov dword [0x1054314], eax
lea eax, [ebp - 0xcf0]
mov edi, 0x1001d70
push eax
mov dword [ebp - 0xcd0], ebx
mov dword [ebp - 0xccc], 0x6c
mov dword [ebp - 0xcc8], edi
call dword [sym.imp.USER32.dll_RegisterClassExW]
test ax, ax
je 0x10273b1
push ebx
push esi
push ebx
push ebx
mov esi, 0x80000000
push esi
push esi
push esi
push esi
push 0xca0000
lea eax, [ebp - 0x458]
push eax
push edi
push 0x100
call dword [sym.imp.USER32.dll_CreateWindowExW]
push ebx
push dword [ebp - 0xc64]
mov dword [ebp - 0xc6c], eax
push ebx
push eax
push esi
push esi
push esi
push esi
push 0x40000000
push ebx
push edi
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0x34
mov dword [0x1054318], eax
call fcn.0100219e
mov esi, eax
pop ecx
cmp esi, ebx
je 0x100fe98
push 0x100a64c
lea ecx, [ebp - 0xcb0]
call fcn.0100906d
xor edi, edi
inc edi
push edi
lea eax, [ebp - 0xcb0]
push eax
mov ecx, esi
mov dword [ebp - 0xc5c], edi
call fcn.0100dbe1
test byte [ebp - 0xc5c], 1
mov dword [0x1054078], eax
je 0x1001841
and dword [ebp - 0xc5c], 0xfffffffe
push ebx
push edi
lea ecx, [ebp - 0xcb0]
call fcn.01008a37
push 0x38
call fcn.0100219e
mov esi, eax
pop ecx
cmp esi, ebx
je 0x100fea2
push 0x1001d84
lea ecx, [ebp - 0xcb0]
call fcn.0100906d
or dword [ebp - 0xc5c], 2
push 0x12c
push 5
lea eax, [ebp - 0xcb0]
push eax
push dword [0x1054078]
mov ecx, esi
call fcn.0100cdec
test byte [ebp - 0xc5c], 2
mov dword [0x105407c], eax
je 0x10018a0
push ebx
push edi
lea ecx, [ebp - 0xcb0]
call fcn.01008a37
push 0xffffffffffffffff
push dword [ebp - 0xc68]
lea eax, [ebp - 0xc58]
push 0x400
push eax
lea eax, [ebp - 0xc70]
push eax
mov dword [ebp - 0xc70], ebx
call dword [sym.imp.msvcrt.dll_mbstowcs_s]
add esp, 0x14
lea eax, [ebp - 0xc58]
push eax
lea ecx, [ebp - 0xcb0]
call fcn.0100906d
mov ecx, dword [0x1054078]
lea eax, [ebp - 0xcb0]
push eax
call fcn.0100dc48
push ebx
push edi
lea ecx, [ebp - 0xcb0]
mov dword [ebp - 0xc68], eax
call fcn.01008a37
push ebx
lea eax, [ebp - 0xcc0]
push eax
lea eax, [ebp - 0xc78]
push eax
call sub.gdiplus.dll_GdiplusStartup
push ebx
lea eax, [ebp - 0xc60]
push eax
push ebx
push 0x20019
push ebx
push ebx
push ebx
push 0x1020948
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10273b8
push edi
mov edi, 0x10238d8
push edi
push dword [ebp - 0xc60]
call fcn.0100b279
mov esi, eax
cmp esi, 4
jge 0x10273c3
push ebx
push 0x100a63c
push dword [ebp - 0xc60]
call fcn.0100b279
push ebx
push 0x10244c4
push dword [ebp - 0xc60]
mov dword [ebp - 0xc64], eax
call fcn.0100b279
mov dword [0x1054a38], ebx
cmp eax, ebx
jne 0x100fe71
push ebx
push 0x10083f0
push dword [ebp - 0xc60]
call fcn.0100b279
test eax, eax
jne 0x10273d8
push ebx
push 0x1008404
push dword [ebp - 0xc60]
call fcn.0100b279
cmp eax, ebx
jne 0x100fe7d
push ebx
push 0x1008418
push dword [ebp - 0xc60]
call fcn.0100b279
test eax, eax
jne 0x10273ef
cmp dword [ebp - 0xc60], ebx
je 0x10019f0
push dword [ebp - 0xc60]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [0x1054318]
mov dword [0x10542ec], esi
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_GetMenu]
mov edi, dword [sym.imp.USER32.dll_CheckMenuRadioItem]
push ebx
add esi, 0x130
push esi
push 0x133
push 0x130
push eax
mov dword [ebp - 0xc5c], eax
call edi
mov eax, dword [ebp - 0xc64]
neg eax
sbb eax, eax
and eax, 8
push eax
push 0x12f
push dword [ebp - 0xc5c]
call dword [sym.imp.USER32.dll_CheckMenuItem]
mov esi, 0x10541f8
mov ecx, esi
call fcn.0100a977
mov ecx, esi
call fcn.0100a944
lea ecx, [ebp - 0xd2c]
call fcn.01020add
push dword [ebp - 0xc6c]
lea ecx, [ebp - 0xd2c]
push ebx
call fcn.0100d949
lea eax, [ebp - 0xd58]
push eax
push dword [ebp - 0xc6c]
lea ecx, [ebp - 0xd2c]
call fcn.0100ca0f
lea eax, [ebp - 0xd58]
push eax
push dword [ebp - 0xc6c]
mov dword [ebp - 0xd50], ebx
call dword [sym.imp.USER32.dll_SetWindowPlacement]
cmp dword [0x1054318], ebx
je 0x10273fb
mov ecx, esi
call fcn.0100ced9
push esi
lea ecx, [ebp - 0xd00]
call fcn.0100ae2f
mov ecx, dword [0x1054078]
call fcn.0100db46
mov ecx, dword [0x105407c]
lea eax, [ebp - 0xd00]
push eax
call fcn.0100b2bc
mov ecx, dword [0x105407c]
call fcn.0100b2d6
cmp dword [ebp - 0xc68], ebx
jne 0x1027407
push 1
mov ecx, esi
call fcn.0100aa2e
push ebx
mov ecx, esi
call fcn.010240b9
push dword [0x1054318]
call dword [sym.imp.USER32.dll_GetParent]
push eax
lea ecx, [ebp - 0xd2c]
call fcn.01008b76
push dword [ebp - 0xc64]
mov ecx, dword [0x10542e8]
call fcn.0100bf48
cmp dword [0x1055204], ebx
jne 0x1027422
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jl 0x1027499
push ebx
mov ecx, esi
call fcn.010228e7
cmp byte [0x10542f2], bl
jne 0x1010ead
mov ecx, esi
call fcn.0102241f
push 0x96
push dword [0x1054328]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
push ebx
call fcn.0100228d
mov ecx, eax
call fcn.010022a7
mov ecx, eax
call fcn.010024df
call fcn.010023fd
push dword [0x1054318]
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
xor eax, eax
cmp eax, 0x1054208
je 0x1001bd2
lea edi, [eax*2 + 0x1054208]
cmp word [edi], bx
jne 0x10274b3
cmp eax, ebx
jg 0x10274c8
call fcn.010091f9
push ebx
push ebx
push ebx
lea eax, [ebp - 0xc94]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x1001cc4
mov edi, dword [sym.imp.USER32.dll_TranslateAcceleratorW]
lea eax, [ebp - 0xc94]
push eax
push dword [0x105430c]
push dword [0x1054318]
call edi
test eax, eax
jne 0x1001cac
lea eax, [ebp - 0xc94]
push eax
mov ecx, esi
call fcn.01001d93
test eax, eax
jne 0x1001cac
lea eax, [ebp - 0xc94]
push eax
call fcn.01001e16
test al, al
jne 0x1001cac
cmp dword [ebp - 0xc90], 0x201
je 0x100673e
lea eax, [ebp - 0xc94]
push eax
mov ecx, esi
call fcn.01001dd6
test eax, eax
jne 0x1001cac
lea eax, [ebp - 0xc94]
push eax
push dword [0x1054310]
push dword [0x1054318]
call edi
test eax, eax
jne 0x1001cac
lea eax, [ebp - 0xc94]
push eax
mov eax, dword [0x10542f4]
push dword [eax*4 + 0x10542f8]
push dword [0x1054318]
call edi
test eax, eax
jne 0x1001cac
lea eax, [ebp - 0xc94]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0xc94]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push ebx
push ebx
push ebx
lea eax, [ebp - 0xc94]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x1001bf5
push 0x1054a58
call fcn.0100e538
call fcn.0100228d
cmp eax, ebx
je 0x1001ce0
push 1
mov ecx, eax
call fcn.0100eff2
mov ecx, dword [0x10540a4]
call fcn.0100eb1d
mov ecx, dword [0x10540a4]
call fcn.0100e704
call dword [sym.imp.ole32.dll_CoUninitialize]
push dword [ebp - 0xc78]
call sub.gdiplus.dll_GdiplusShutdown
call fcn.0100e6cc
mov ecx, dword [0x105407c]
cmp ecx, ebx
je 0x1001d1d
push 1
call fcn.0100f03c
mov ecx, dword [0x1054078]
cmp ecx, ebx
je 0x1001d2e
push 1
call fcn.0100f1d3
mov esi, dword [ebp - 0xc8c]
lea ecx, [ebp - 0xd2c]
mov dword [ebp - 0xd00], 0x1008880
call fcn.010089c5
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01001e8f
leave
ret 0x10
call dword [sym.imp.USER32.dll_GetMessageExtraInfo]
test eax, 0xff515780
je 0x1001c48
jmp 0x102753f
mov byte [0x10542f0], 1
jmp 0x1001991
dec eax
mov byte [0x10542f2], 1
mov dword [0x1054a38], eax
cmp eax, 3
jbe 0x10019dc
jmp 0x10273e4
xor edi, edi
xor eax, eax
inc edi
jmp 0x100181f
xor eax, eax
jmp 0x1001885
push ebx
push 0xffffffffffffffff
push 0x3d3
push 0x3cd
push dword [ebp - 0xc5c]
call edi
mov eax, dword [0x1054a38]
push ebx
add eax, 0x2710
push eax
push 0x2713
push 0x2710
push dword [ebp - 0xc5c]
call edi
mov eax, dword [0x1054a38]
mov ecx, dword [0x10542e8]
add eax, 0x2710
push eax
call fcn.01010f00
jmp 0x1001b66
push esi
call dword [sym.imp.msvcrt.dll_exit]
mov al, byte [0x1055208]
cmp al, 4
jae 0x102734e
cmp al, bl
jne 0x10016e1
mov eax, dword [0x10551f0]
mov ecx, dword [0x10551f4]
mov edx, 0x10000
mov esi, 0x80010000
and eax, edx
and ecx, esi
or eax, ecx
je 0x10016e1
mov eax, dword [0x10551f8]
mov ecx, eax
and ecx, edx
mov edx, dword [0x10551fc]
and edx, esi
cmp ecx, eax
jne 0x10016e1
cmp edx, dword [0x10551fc]
jne 0x10016e1
push 5
push 0x1027550
push dword [0x1054a5c]
push dword [0x1054a58]
call fcn.01031f2a
jmp 0x10016e1
xor eax, eax
jmp 0x1001d4b
mov dword [ebp - 0xc60], ebx
jmp 0x100193e
xor esi, esi
inc esi
push esi
push edi
push dword [ebp - 0xc60]
call fcn.01016082
jmp 0x100195b
mov byte [0x10542f1], 1
jmp 0x10019dc
mov dword [0x1054a38], ebx
jmp 0x10019dc
mov byte [0x10542f3], 1
jmp 0x10019dc
mov ecx, esi
call fcn.01031f6e
jmp 0x1001ab6
mov ecx, dword [0x105407c]
call fcn.01043214
mov ecx, dword [0x105407c]
call fcn.010431f3
jmp 0x1001afd
mov al, byte [0x1055208]
cmp al, 4
jae 0x1027433
cmp al, bl
jne 0x1001b43
mov eax, dword [0x10551f0]
mov ecx, dword [0x10551f4]
mov edx, 0x10000
and eax, edx
and ecx, 0x80010000
or eax, ecx
je 0x1001b43
mov eax, dword [0x10551f8]
mov ecx, eax
and ecx, edx
mov edx, dword [0x10551fc]
and edx, 0x80010000
cmp ecx, eax
jne 0x1001b43
cmp edx, dword [0x10551fc]
jne 0x1001b43
push 6
push 0x1027560
push dword [0x1054a5c]
push dword [0x1054a58]
call fcn.01031f2a
jmp 0x1001b43
lea ecx, [ebp - 0xd2c]
mov dword [ebp - 0xd00], 0x1008880
call fcn.010089c5
jmp 0x10273b1
mov cl, byte [edi]
mov byte [ebp + eax - 0x58], cl
inc eax
cmp eax, 0x52
jae 0x1001bca
jmp 0x1001bba
mov byte [ebp + eax - 0x58], bl
lea eax, [ebp + eax - 0x57]
push ebx
push eax
lea eax, [ebp - 0x58]
push eax
mov eax, dword [0x1054320]
mov eax, dword [eax + 8]
push dword [eax + 4]
mov ecx, esi
call fcn.0101aa7e
mov ecx, dword [0x10542e8]
push 0x93
call fcn.01004b7f
lea eax, [ebp - 0xca4]
push eax
push dword [0x1054328]
call dword [sym.imp.USER32.dll_GetClientRect]
push 2
lea eax, [ebp - 0xca4]
push eax
push dword [0x1054318]
push dword [0x1054328]
call dword [sym.imp.USER32.dll_MapWindowPoints]
push ebx
lea eax, [ebp - 0xca4]
push eax
push dword [0x1054318]
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x1001bd2
mov eax, dword [0x10540a4]
or dword [eax + 0x20], 4
jmp 0x1001c48