Function at 0x1001635
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xd58
mov eax, dword [0x1054064]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0xc64], eax
mov eax, dword [ebp + 0x10]
push 0x200
mov dword [ebp - 0xc68], eax
xor ebx, ebx
lea eax, [ebp - 0x458]
push eax
xor esi, esi
push 0xd9
inc esi
push ebx
mov dword [ebp - 0xc5c], ebx
mov dword [ebp - 0xc60], ebx
mov dword [ebp - 0xcc0], esi
mov dword [ebp - 0xcbc], ebx
mov dword [ebp - 0xcb8], ebx
mov dword [ebp - 0xcb4], ebx
call edi
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x10275a6
mov ecx, dword [0x10540ac]
call fcn.01012a40
push 0x1054a70
push 0x10551f8
push 0x10321ab
push 0x1001d5c
call fcn.0101293b
cmp dword [0x105521c], ebx
jne 0x10275ad
push ebx
call edi
push eax
call fcn.010134a3
mov esi, dword [ebp - 0xc64]
push ebx
mov dword [ebp - 0xcf0], 0x30
mov dword [ebp - 0xcec], ebx
mov dword [ebp - 0xce8], 0x1001ede
mov dword [ebp - 0xce4], ebx
mov dword [ebp - 0xce0], ebx
mov dword [ebp - 0xcdc], esi
call fcn.01012a09
push 1
mov dword [ebp - 0xcd8], eax
call fcn.01012a09
push 0x7f00
push ebx
mov dword [ebp - 0xcc4], eax
call dword [sym.imp.USER32.dll_LoadCursorW]
mov dword [ebp - 0xcd4], eax
lea eax, [ebp - 0xc74]
push eax
push 1
push 0x9d
push ebx
call edi
push eax
call fcn.010076e7
mov eax, dword [ebp - 0xc74]
mov dword [0x105432c], eax
lea eax, [ebp - 0xcf0]
mov edi, 0x1001d70
push eax
mov dword [ebp - 0xcd0], ebx
mov dword [ebp - 0xccc], 0x6c
mov dword [ebp - 0xcc8], edi
call dword [sym.imp.USER32.dll_RegisterClassExW]
test ax, ax
je 0x1027621
push ebx
push esi
push ebx
push ebx
mov esi, SysReAllocString
push esi
push esi
push esi
push esi
push 0xca0000
lea eax, [ebp - 0x458]
push eax
push edi
push 0x100
call dword [sym.imp.USER32.dll_CreateWindowExW]
push ebx
push dword [ebp - 0xc64]
mov dword [ebp - 0xc6c], eax
push ebx
push eax
push esi
push esi
push esi
push esi
push 0x40000000
push ebx
push edi
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0x34
mov dword [0x1054330], eax
call fcn.01002286
mov esi, eax
pop ecx
cmp esi, ebx
je 0x1019212
push 0x1014e7c
lea ecx, [ebp - 0xcb0]
call fcn.010127cb
xor edi, edi
inc edi
push edi
lea eax, [ebp - 0xcb0]
push eax
mov ecx, esi
mov dword [ebp - 0xc5c], edi
call fcn.0101733e
test byte [ebp - 0xc5c], 1
mov dword [0x1054080], eax
je 0x1001841
and dword [ebp - 0xc5c], 0xfffffffe
push ebx
push edi
lea ecx, [ebp - 0xcb0]
call fcn.0101212a
push 0x38
call fcn.01002286
mov esi, eax
pop ecx
cmp esi, ebx
je 0x101921c
push 0x1001d84
lea ecx, [ebp - 0xcb0]
call fcn.010127cb
or dword [ebp - 0xc5c], 2
push 0x12c
push 5
lea eax, [ebp - 0xcb0]
push eax
push dword [0x1054080]
mov ecx, esi
call fcn.01016716
test byte [ebp - 0xc5c], 2
mov dword [0x1054084], eax
je 0x10018a0
push ebx
push edi
lea ecx, [ebp - 0xcb0]
call fcn.0101212a
push 0xffffffffffffffff
push dword [ebp - 0xc68]
lea eax, [ebp - 0xc58]
push 0x400
push eax
lea eax, [ebp - 0xc70]
push eax
mov dword [ebp - 0xc70], ebx
call dword [sym.imp.msvcrt.dll_mbstowcs_s]
add esp, 0x14
lea eax, [ebp - 0xc58]
push eax
lea ecx, [ebp - 0xcb0]
call fcn.010127cb
mov ecx, dword [0x1054080]
lea eax, [ebp - 0xcb0]
push eax
call fcn.010173a5
push ebx
push edi
lea ecx, [ebp - 0xcb0]
mov dword [ebp - 0xc68], eax
call fcn.0101212a
push ebx
lea eax, [ebp - 0xcc0]
push eax
lea eax, [ebp - 0xc78]
push eax
call sub.gdiplus.dll_GdiplusStartup
push ebx
lea eax, [ebp - 0xc60]
push eax
push ebx
push 0x20019
push ebx
push ebx
push ebx
push 0x100879c
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1027628
push edi
mov edi, 0x100b990
push edi
push dword [ebp - 0xc60]
call fcn.010157b1
mov esi, eax
cmp esi, 4
jge 0x1027633
push ebx
push 0x1014e6c
push dword [ebp - 0xc60]
call fcn.010157b1
push ebx
push 0x100c5e8
push dword [ebp - 0xc60]
mov dword [ebp - 0xc64], eax
call fcn.010157b1
mov dword [0x1054a50], ebx
cmp eax, ebx
jne 0x10191eb
push ebx
push 0x100c9e4
push dword [ebp - 0xc60]
call fcn.010157b1
test eax, eax
jne 0x1027648
push ebx
push 0x100c9f8
push dword [ebp - 0xc60]
call fcn.010157b1
cmp eax, ebx
jne 0x10191f7
push ebx
push 0x100ca0c
push dword [ebp - 0xc60]
call fcn.010157b1
test eax, eax
jne 0x102765f
cmp dword [ebp - 0xc60], ebx
je 0x10019f0
push dword [ebp - 0xc60]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [0x1054330]
mov dword [0x1054304], esi
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_GetMenu]
mov edi, dword [sym.imp.USER32.dll_CheckMenuRadioItem]
push ebx
add esi, 0x130
push esi
push 0x133
push 0x130
push eax
mov dword [ebp - 0xc5c], eax
call edi
mov eax, dword [ebp - 0xc64]
neg eax
sbb eax, eax
and eax, 8
push eax
push 0x12f
push dword [ebp - 0xc5c]
call dword [sym.imp.USER32.dll_CheckMenuItem]
mov esi, 0x1054210
mov ecx, esi
call fcn.010150ab
mov ecx, esi
call fcn.01015078
lea ecx, [ebp - 0xd2c]
call fcn.0100885d
push dword [ebp - 0xc6c]
lea ecx, [ebp - 0xd2c]
push ebx
call fcn.01017089
lea eax, [ebp - 0xd58]
push eax
push dword [ebp - 0xc6c]
lea ecx, [ebp - 0xd2c]
call fcn.01017101
lea eax, [ebp - 0xd58]
push eax
push dword [ebp - 0xc6c]
mov dword [ebp - 0xd50], ebx
call dword [sym.imp.USER32.dll_SetWindowPlacement]
cmp dword [0x1054330], ebx
je 0x102766b
mov ecx, esi
call fcn.01016803
push esi
lea ecx, [ebp - 0xd00]
call fcn.0101549c
mov ecx, dword [0x1054080]
call fcn.010172a3
mov ecx, dword [0x1054084]
lea eax, [ebp - 0xd00]
push eax
call fcn.010157f4
mov ecx, dword [0x1054084]
call fcn.0101580e
cmp dword [ebp - 0xc68], ebx
jne 0x1027677
push 1
mov ecx, esi
call fcn.01015162
push ebx
mov ecx, esi
call fcn.0100b4c6
push dword [0x1054330]
call dword [sym.imp.USER32.dll_GetParent]
push eax
lea ecx, [ebp - 0xd2c]
call fcn.0101240d
push dword [ebp - 0xc64]
mov ecx, dword [0x1054300]
call fcn.01014973
cmp dword [0x105521c], ebx
jne 0x1027692
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jl 0x1027709
push ebx
mov ecx, esi
call fcn.0100bab5
cmp byte [0x105430a], bl
jne 0x101a833
mov ecx, esi
call fcn.0100a49d
push 0x96
push dword [0x1054340]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
push ebx
call fcn.010021b6
mov ecx, eax
call fcn.01002541
mov ecx, eax
call fcn.0100334a
call fcn.010024b9
push dword [0x1054330]
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
xor eax, eax
cmp eax, 0x1054220
je 0x1001bd2
lea edi, [eax*2 + 0x1054220]
cmp word [edi], bx
jne 0x1027723
cmp eax, ebx
jg 0x1027738
call fcn.01014995
push ebx
push ebx
push ebx
lea eax, [ebp - 0xc94]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x1001cc4
mov edi, dword [sym.imp.USER32.dll_TranslateAcceleratorW]
lea eax, [ebp - 0xc94]
push eax
push dword [0x1054324]
push dword [0x1054330]
call edi
test eax, eax
jne 0x1001cac
lea eax, [ebp - 0xc94]
push eax
mov ecx, esi
call fcn.01001d93
test eax, eax
jne 0x1001cac
lea eax, [ebp - 0xc94]
push eax
call fcn.01001e16
test al, al
jne 0x1001cac
cmp dword [ebp - 0xc90], 0x201
je 0x1006552
lea eax, [ebp - 0xc94]
push eax
mov ecx, esi
call fcn.01001dd6
test eax, eax
jne 0x1001cac
lea eax, [ebp - 0xc94]
push eax
push dword [0x1054328]
push dword [0x1054330]
call edi
test eax, eax
jne 0x1001cac
lea eax, [ebp - 0xc94]
push eax
mov eax, dword [0x105430c]
push dword [eax*4 + 0x1054310]
push dword [0x1054330]
call edi
test eax, eax
jne 0x1001cac
lea eax, [ebp - 0xc94]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0xc94]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push ebx
push ebx
push ebx
lea eax, [ebp - 0xc94]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x1001bf5
push 0x1054a70
call fcn.01017f25
call fcn.010021b6
cmp eax, ebx
je 0x1001ce0
push 1
mov ecx, eax
call fcn.010189df
mov ecx, dword [0x10540ac]
call fcn.0101850a
mov ecx, dword [0x10540ac]
call fcn.010180f1
call dword [sym.imp.ole32.dll_CoUninitialize]
push dword [ebp - 0xc78]
call sub.gdiplus.dll_GdiplusShutdown
call fcn.010180b9
mov ecx, dword [0x1054084]
cmp ecx, ebx
je 0x1001d1d
push 1
call fcn.01018a29
mov ecx, dword [0x1054080]
cmp ecx, ebx
je 0x1001d2e
push 1
call fcn.01018bc0
mov esi, dword [ebp - 0xc8c]
lea ecx, [ebp - 0xd2c]
mov dword [ebp - 0xd00], 0x100cf90
call fcn.0100d0d5
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01001e8f
leave
ret 0x10
call dword [sym.imp.USER32.dll_GetMessageExtraInfo]
test eax, 0xff515780
je 0x1001c48
jmp 0x10277af
mov byte [0x1054308], 1
jmp 0x1001991
dec eax
mov byte [0x105430a], 1
mov dword [0x1054a50], eax
cmp eax, 3
jbe 0x10019dc
jmp 0x1027654
xor edi, edi
xor eax, eax
inc edi
jmp 0x100181f
xor eax, eax
jmp 0x1001885
push ebx
push 0xffffffffffffffff
push 0x3d3
push 0x3cd
push dword [ebp - 0xc5c]
call edi
mov eax, dword [0x1054a50]
push ebx
add eax, 0x2710
push eax
push 0x2713
push 0x2710
push dword [ebp - 0xc5c]
call edi
mov eax, dword [0x1054a50]
mov ecx, dword [0x1054300]
add eax, 0x2710
push eax
call fcn.0101a886
jmp 0x1001b66
push esi
call dword [sym.imp.msvcrt.dll_exit]
mov al, byte [0x1055220]
cmp al, 4
jae 0x10275be
cmp al, bl
jne 0x10016e1
mov eax, dword [0x1055208]
mov ecx, dword [0x105520c]
mov edx, 0x10000
mov esi, 0x80010000
and eax, edx
and ecx, esi
or eax, ecx
je 0x10016e1
mov eax, dword [0x1055210]
mov ecx, eax
and ecx, edx
mov edx, dword [0x1055214]
and edx, esi
cmp ecx, eax
jne 0x10016e1
cmp edx, dword [0x1055214]
jne 0x10016e1
push 5
push 0x10277c0
push dword [0x1054a74]
push dword [0x1054a70]
call fcn.01032202
jmp 0x10016e1
xor eax, eax
jmp 0x1001d4b
mov dword [ebp - 0xc60], ebx
jmp 0x100193e
xor esi, esi
inc esi
push esi
push edi
push dword [ebp - 0xc60]
call fcn.0100e974
jmp 0x100195b
mov byte [0x1054309], 1
jmp 0x10019dc
mov dword [0x1054a50], ebx
jmp 0x10019dc
mov byte [0x105430b], 1
jmp 0x10019dc
mov ecx, esi
call fcn.01032246
jmp 0x1001ab6
mov ecx, dword [0x1054084]
call fcn.01043360
mov ecx, dword [0x1054084]
call fcn.0104333f
jmp 0x1001afd
mov al, byte [0x1055220]
cmp al, 4
jae 0x10276a3
cmp al, bl
jne 0x1001b43
mov eax, dword [0x1055208]
mov ecx, dword [0x105520c]
mov edx, 0x10000
and eax, edx
and ecx, 0x80010000
or eax, ecx
je 0x1001b43
mov eax, dword [0x1055210]
mov ecx, eax
and ecx, edx
mov edx, dword [0x1055214]
and edx, 0x80010000
cmp ecx, eax
jne 0x1001b43
cmp edx, dword [0x1055214]
jne 0x1001b43
push 6
push 0x10277d0
push dword [0x1054a74]
push dword [0x1054a70]
call fcn.01032202
jmp 0x1001b43
lea ecx, [ebp - 0xd2c]
mov dword [ebp - 0xd00], 0x100cf90
call fcn.0100d0d5
jmp 0x1027621
mov cl, byte [edi]
mov byte [ebp + eax - 0x58], cl
inc eax
cmp eax, 0x52
jae 0x1001bca
jmp 0x1001bba
mov byte [ebp + eax - 0x58], bl
lea eax, [ebp + eax - 0x57]
push ebx
push eax
lea eax, [ebp - 0x58]
push eax
mov eax, dword [0x1054338]
mov eax, dword [eax + 8]
push dword [eax + 4]
mov ecx, esi
call fcn.0102210b
mov ecx, dword [0x1054300]
push 0x93
call fcn.01004d6f
lea eax, [ebp - 0xca4]
push eax
push dword [0x1054340]
call dword [sym.imp.USER32.dll_GetClientRect]
push 2
lea eax, [ebp - 0xca4]
push eax
push dword [0x1054330]
push dword [0x1054340]
call dword [sym.imp.USER32.dll_MapWindowPoints]
push ebx
lea eax, [ebp - 0xca4]
push eax
push dword [0x1054330]
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x1001bd2
mov eax, dword [0x10540ac]
or dword [eax + 0x20], 4
jmp 0x1001c48