Function at 0x1002644a
Capabilities:
Connect pipe
Query environment variable
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100731a1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c0
push ebx
push esi
push edi
mov dword [esp + 0x5c], edx
xor ebx, ebx
push 5
mov esi, ecx
mov dword [esp + 0x28], 0xfffffff8
mov dword [esp + 0x20], ebx
pop ecx
jmp 0x10026493
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x6c], ecx
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 1
jl 0x10026487
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x24], ebx
jl 0x100264c5
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x100264bf
push 1
call edi
push eax
call dword [sym.imp.USER32.dll_GetSystemMenu]
dec dword [esp + 0x24]
jns 0x100264aa
mov eax, dword [esp + 0x24]
mov dword [esp + 0x24], eax
cmp dword [esi + 0x10], ebx
jne 0x100264d9
xor al, al
jmp 0x10027822
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x1c], ebx
jmp 0x100264f6
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x1a0], 0x20624039
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 3
jl 0x100264e3
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x10026510
call edi
push eax
call dword [sym.imp.USER32.dll_IsZoomed]
mov dword [esp + 0x1c], 2
cmp dword [esp + 0x1c], ebx
jl 0x10026537
mov dword [esp + 0x34], ebx
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + eax*4 + 0x1a0]
mov dword [esp + 0x34], eax
dec dword [esp + 0x1c]
jns 0x1002651e
mov dword [esp + 0x30], ebx
mov dword [esp + 0x38], 0x1c5a3d7f
mov dword [esp + 0x18], ebx
mov dword [esp + 0x24], 0x6ef3b063
push 4
mov dword [esp + 0x50], 1
mov dword [esp + 0x24], ebx
pop ecx
jmp 0x10026573
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x88], 0x2ba10f40
inc dword [esp + 0x20]
cmp dword [esp + 0x20], ecx
jl 0x10026560
mov dword [esp + 0x20], ebx
jmp 0x1002658b
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x7c], ecx
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 3
jl 0x1002657f
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x30]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x30]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x24], 1
mov dword [esp + 0x18], 0x1c
cmp dword [esp + 0x18], 0xfffffffa
je 0x10026a0f
push 5
pop edi
mov dword [esp + 0x40], 0xbadcab39
mov dword [esp + 0x3c], 0xffffffff
mov dword [esp + 0x44], 0x79038991
mov dword [esp + 0x1c], 0xbe49c906
mov dword [esp + 0xc0], 0xfffffff9
mov dword [esp + 0xa8], 1
mov dword [esp + 0xac], 1
mov dword [esp + 0xb0], 1
mov dword [esp + 0xb4], 1
mov dword [esp + 0x14], 0x61c0
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x30], 0xfffffffc
jmp 0x10026706
mov dword [esp + 0x20], ebx
mov eax, dword [esp + 0x24]
cmp eax, dword [esp + 0x38]
jge 0x100266df
mov dword [esp + 0x38], 0xb319bd1
xor edx, edx
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
cmp ecx, eax
mov eax, dword [esp + 0x24]
setl dl
sub eax, edx
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
sub ecx, eax
je 0x100266c3
cmp dword [esp + 0x40], ebx
je 0x100266c3
xor eax, eax
inc eax
jmp 0x100266c5
mov eax, ebx
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x20]
cmp dword [esp + 0x44], eax
jge 0x100266df
mov ecx, ebx
jmp 0x100266e2
xor ecx, ecx
inc ecx
mov eax, dword [esp + 0x8c]
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x40]
setne dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [esp + 0x8c], ecx
dec dword [esp + 0x30]
cmp dword [esp + 0x30], 0xfffffff3
jle 0x10026678
mov eax, dword [esp + 0x7c]
xor edx, edx
dec dword [esp + 0x14]
mov ecx, dword [esp + 0xb4]
mov eax, dword [esp + 0x1c]
cmp eax, ecx
mov eax, dword [esp + 0x1c]
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
xor edx, edx
cmp ecx, 0x2dc6606a
mov ecx, dword [esp + 0x84]
mov eax, dword [esp + 0x84]
setge dl
add ecx, edx
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x1c]
setl dl
sub edx, eax
sub edx, dword [esp + 0x30]
add edx, dword [esp + 0x14]
je 0x10026773
cmp dword [esp + 0x30], ebx
je 0x10026773
xor ecx, ecx
inc ecx
jmp 0x10026775
mov ecx, ebx
mov eax, dword [esp + 0x8c]
sub eax, ecx
mov ecx, dword [esp + 0xc0]
neg eax
sbb eax, eax
add eax, 0x851aa8ca
add ecx, eax
je 0x10026904
mov dword [esp + 0x20], 0x21bf
mov dword [esp + 0x44], 0xfffffff6
cmp dword [esp + 0x20], ebx
jne 0x10026837
mov ecx, dword [esp + 0x14]
xor edx, edx
mov eax, dword [esp + 0x18]
cmp eax, ecx
setne dl
mov dword [esp + 0xb0], edx
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x88]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x8c]
mov eax, dword [esp + 0x1c]
cmp dword [esp + 0x40], 0xf3b42422
ja 0x100267f1
mov eax, dword [esp + 0xb4]
mov edx, dword [esp + 0x84]
xor ecx, ecx
mov eax, dword [esp + 0x20]
imul edx, eax
mov eax, dword [esp + 0x8c]
cmp edx, eax
mov eax, dword [esp + 0x84]
sete cl
xor edx, edx
imul eax, ecx
imul ecx, eax, 0xffff94b6
mov eax, dword [esp + 0x1c]
cmp ecx, eax
mov eax, dword [esp + 0x20]
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
test ecx, ecx
jle 0x10026842
cmp dword [esp + 0x18], ebx
je 0x10026842
xor ecx, ecx
inc ecx
jmp 0x10026844
mov ecx, ebx
xor eax, eax
inc eax
sub eax, ecx
cmp eax, dword [esp + 0x20]
jg 0x10026856
mov eax, dword [esp + 0x94]
cmp dword [esp + 0x1c], 1
jne 0x10026867
cmp dword [esp + 0x20], ebx
jne 0x10026867
mov eax, ebx
jmp 0x1002686a
xor eax, eax
inc eax
mov dword [esp + 0x24], 2
xor edx, edx
mov dword [esp + 0x44], eax
mov ecx, dword [esp + 0x44]
mov eax, dword [esp + 0x20]
cmp ecx, eax
mov eax, dword [esp + 0x20]
setle dl
xor ecx, ecx
test edx, edx
sets cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x4c]
setle dl
xor ecx, ecx
cmp edx, eax
setl cl
xor edx, edx
add ecx, dword [esp + 0x20]
imul ecx, dword [esp + 0x3c]
mov eax, dword [esp + 0x24]
sub eax, ecx
cmp eax, 0x1ab1936
setl dl
xor ecx, ecx
sub edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x2c]
cmp edx, eax
setge cl
mov dword [esp + 0x84], ecx
mov dword [esp + 0x2c], 3
cmp dword [esp + 0x2c], ebx
jl 0x100269f7
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + eax*4 + 0x88]
mov eax, dword [esp + 0x2c]
mov dword [esp + eax*4 + 0xa8], ecx
dec dword [esp + 0x2c]
jns 0x100268e3
jmp 0x100269f7
push dword [esp + 0x6c]
movdqa xmm0, xmmword [0x10007e30]
lea eax, [esp + 0x1a4]
push eax
lea eax, [esp + 0x198]
mov dword [esp + 0x78], ebx
push eax
push ebx
lea ecx, [esp + 0x80]
mov dword [esp + 0x84], ebx
movdqu xmmword [esp + 0x1a0], xmm0
mov dword [esp + 0x88], ebx
call fcn.10025f0c
push 2
lea ecx, [esp + 0x114]
mov dword [esp + 0x1d8], ebx
call fcn.10024d89
mov dword [esp + 0x14], ebx
jmp 0x10026979
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x110]
mov dword [eax + ecx*4], 0xbad55379
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x10026963
mov eax, dword [esp + 0x70]
mov ecx, dword [eax + 8]
mov eax, dword [esp + 0x110]
mov dword [eax + 4], ecx
xor ecx, ecx
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x70]
cmp dword [eax + 4], 0xfff6
mov eax, dword [esp + 0x34]
sete cl
xor edx, edx
cmp ecx, eax
setge dl
inc edx
neg edx
sbb edx, edx
inc edx
sub edx, dword [esp + 0x28]
mov eax, dword [esp + 0x70]
cmp edi, edx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, dword [eax + 0xc]
mov eax, dword [esp + 0x34]
setg dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [esp + 0x3c], ecx
lea ecx, [esp + 0x110]
call fcn.10024e55
or dword [esp + 0x1d4], 0xffffffff
lea ecx, [esp + 0x70]
call fcn.10024e55
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 0xfffffffa
push 4
pop ecx
jne 0x100265fc
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [esp + 0x1c], 3
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x1c], ebx
jmp 0x10026abc
mov dword [esp + 0x24], 8
lea ecx, [esp + 0x11c]
push 1
call fcn.10024d89
xor edx, edx
mov dword [esp + 0x14], ebx
inc edx
jmp 0x10026a59
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x11c]
mov dword [eax + ecx*4], edx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x10026a47
cmp dword [esp + 0x1c], ebx
je 0x10026a6f
mov eax, dword [esp + 0x24]
mov dword [esp + 0x28], eax
jmp 0x10026a8f
mov dword [esp + 0x24], ebx
jmp 0x10026a89
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x11c]
cmp dword [eax + ecx*4], ebx
jne 0x10026a8f
inc dword [esp + 0x24]
cmp dword [esp + 0x24], ebx
jle 0x10026a75
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10026aac
push 0x2363
push ebx
push 0x128d
push ebx
call dword [sym.imp.USER32.dll_LoadStringA]
lea ecx, [esp + 0x11c]
call fcn.10024e55
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xffffffe3
jge 0x10026a28
push dword [esp + 0x6c]
movdqa xmm0, xmmword [0x10007ea0]
lea eax, [esp + 0x194]
push eax
lea eax, [esp + 0x188]
mov dword [esp + 0xa4], ebx
push eax
push ebx
lea ecx, [esp + 0xac]
mov dword [esp + 0xb0], ebx
movdqu xmmword [esp + 0x190], xmm0
mov dword [esp + 0xb4], ebx
call fcn.10025f0c
xor eax, eax
lea ecx, [esp + 0xc8]
inc eax
push eax
mov dword [esp + 0x1d8], eax
call fcn.10024d89
mov byte [esp + 0x1d4], 2
mov dword [esp + 0x14], ebx
jmp 0x10026b46
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc8]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 1
jl 0x10026b33
mov eax, dword [esp + 0xc8]
mov dword [eax], 3
mov dword [esp + 0x1c], 0x2751c76d
mov dword [esp + 0x28], 0xbe8f2100
mov dword [esp + 0x28], 0x33c2251
mov dword [esp + 0x28], 0x23ccde6b
mov dword [esp + 0x28], 0xbf2465cd
mov dword [esp + 0x1c], 3
cmp dword [esp + 0x1c], ebx
jl 0x10026bff
mov dword [esp + 0x28], 0xa82a10aa
lea ecx, [esp + 0x138]
push 2
call fcn.10024d89
mov dword [esp + 0x34], 0x351a9382
mov dword [esp + 0x14], ebx
jmp 0x10026bca
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x138]
mov dword [eax + ecx*4], 0x4c38b6b0
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x10026bb4
mov ecx, dword [esp + 0x1c]
xor edx, edx
mov eax, dword [esp + 0x9c]
cmp dword [eax + ecx*4], 3
lea ecx, [esp + 0x138]
setle dl
mov dword [esp + 0x28], edx
inc dword [esp + 0x34]
call fcn.10024e55
dec dword [esp + 0x1c]
jns 0x10026b90
mov eax, dword [esp + 0xc8]
dec dword [eax]
jns 0x10026b5a
lea ecx, [esp + 0xc8]
call fcn.10024e55
or dword [esp + 0x1d4], 0xffffffff
lea ecx, [esp + 0x9c]
call fcn.10024e55
xor ecx, ecx
inc ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x1c], 0xbe8e56f9
mov dword [esp + 0x14], ebx
jmp 0x10026c53
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x60], 0x6bdde0bc
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ecx
jl 0x10026c43
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10026c6c
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov dword [esp + 0x1c], ebx
cmp dword [esp + 0x1c], ebx
jl 0x10026d5d
push 5
pop eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x34], 0x6b8642e5
mov dword [esp + 0x20], ebx
cmp dword [esp + 0x20], ebx
jg 0x10026d53
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x18], ebx
jmp 0x10026d30
mov dword [esp + 0x34], 0xffffffff
mov ecx, 0xea28c7ff
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + eax*4 + 0x60]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
cmp ecx, eax
mov eax, dword [esp + 0x60]
sbb ecx, ecx
xor edx, edx
neg ecx
add ecx, eax
mov eax, dword [esp + 0x34]
cmp ecx, eax
mov eax, dword [esp + 0x18]
sete dl
cmp edx, 0xff5ecce3
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
sub ecx, dword [esp + 0x34]
je 0x10026cfe
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
xor edx, edx
mov eax, dword [esp + 0x20]
cmp eax, ecx
mov eax, dword [esp + 0x20]
setl dl
sub edx, 2
neg edx
mov eax, dword [esp + eax*4 + 0x60]
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setle cl
add ecx, dword [esp + 0x20]
mov dword [esp + 0x34], ecx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ebx
jle 0x10026ca8
mov dword [esp + 0x34], 0xa19ae86a
inc dword [esp + 0x20]
cmp dword [esp + 0x20], ebx
jle 0x10026c97
push 5
pop eax
dec dword [esp + 0x1c]
jns 0x10026c7d
mov dword [esp + 0x28], 0xffffffff
xor edx, edx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x18], 0xa927213e
mov dword [esp + 0x3c], 0xec6f0d4a
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x30]
cmp ecx, eax
mov eax, dword [esp + 0x30]
setg dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [esp + 0x30]
setl cl
add ecx, 2
mov dword [esp + 0x28], ecx
xor ecx, ecx
cmp dword [esp + 0x28], eax
setg cl
mov dword [esp + 0x30], ecx
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x18], ebx
je 0x10026df8
mov dword [esp + 0x18], 8
jmp 0x10026dec
mov dword [esp + 0x28], 0x57e3b6f9
mov dword [esp + 0x30], ebx
jmp 0x10026de1
mov eax, dword [esp + 0x18]
mov dword [esp + 0x28], eax
dec dword [esp + 0x30]
cmp dword [esp + 0x30], 0xffffffea
jge 0x10026dd5
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0x15
je 0x10026dc7
jmp 0x10026ee4
mov dword [esp + 0x34], 0x7d96711d
xor edx, edx
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x40], 0xffffffff
mov dword [esp + 0x34], 0xfffffffa
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
cmp ecx, eax
mov eax, dword [esp + 0x20]
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
imul ecx, dword [esp + 0x18]
add ecx, 0x6f62939
mov dword [esp + 0x18], ecx
je 0x10026e52
cmp dword [esp + 0x20], ebx
je 0x10026e52
xor ecx, ecx
inc ecx
jmp 0x10026e54
mov ecx, ebx
mov eax, dword [esp + 0x20]
imul eax, ecx
test eax, eax
je 0x10026e6a
cmp dword [esp + 0x18], ebx
je 0x10026e6a
xor eax, eax
inc eax
jmp 0x10026e6c
mov eax, ebx
mov dword [esp + 0x20], eax
cmp dword [esp + 0x20], ebx
jne 0x10026e7a
mov edx, ebx
jmp 0x10026e7d
xor edx, edx
inc edx
mov dword [esp + 0x34], ebx
xor ecx, ecx
mov eax, dword [esp + 0x34]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x3c]
sub edx, eax
mov eax, dword [esp + 0x40]
cmp edx, eax
setg cl
xor eax, eax
cmp ecx, 0xc7f
mov ecx, dword [esp + 0x30]
setl al
sub ecx, eax
neg ecx
sbb ecx, ecx
add ecx, 0x79df
mov dword [esp + 0x34], ecx
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x40]
mov eax, dword [esp + 0x3c]
neg eax
sbb eax, eax
neg eax
mov dword [esp + 0x40], eax
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10026ee4
call dword [sym.imp.GDI32.dll_GdiFlush]
mov dword [esp + 0x38], ebx
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x4c], 0xf3d37a5b
mov dword [esp + 0x4c], 0x8e9646b8
mov dword [esp + 0x38], ebx
jmp 0x10026ffd
push 2
lea ecx, [esp + 0x178]
call fcn.10024d89
mov dword [esp + 0x1c], 0x446df37d
xor edx, edx
mov dword [esp + 0x4c], 0x872d9ee1
inc edx
mov dword [esp + 0x14], 0x9cdc345f
mov dword [esp + 0x24], edx
mov dword [esp + 0x18], ebx
jmp 0x10026f4e
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x174]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jl 0x10026f3c
mov dword [esp + 0x18], ebx
jmp 0x10026f6e
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x160], 6
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edx
jl 0x10026f5b
mov dword [esp + 0x1c], ebx
jmp 0x10026f92
mov dword [esp + 0x4c], 0xc9ed9ba0
mov dword [esp + 0x4c], edx
mov dword [esp + 0x4c], ebx
dec dword [esp + 0x24]
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edx
jle 0x10026f7a
mov dword [esp + 0x24], ebx
jmp 0x10026fe6
cmp dword [esp + 0x1c], ebx
je 0x10026fcc
mov dword [esp + 0x14], 0xb
jmp 0x10026fc3
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10026fbf
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
dec dword [esp + 0x14]
cmp dword [esp + 0x14], 7
jg 0x10026fae
jmp 0x10026fe2
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10026fde
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [esp + 0x28]
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 0x2c
je 0x10026f9e
lea ecx, [esp + 0x174]
call fcn.10024e55
inc dword [esp + 0x38]
cmp dword [esp + 0x38], 6
je 0x10026f09
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1002701f
push 0x6d0
push ebx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
mov dword [esp + 0x38], 0xf6af1124
lea ecx, [esp + 0x144]
mov dword [esp + 0x28], 0xffffffff
push 2
call fcn.10024d89
mov dword [esp + 0x1d4], 3
mov dword [esp + 0x14], ebx
jmp 0x10027064
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x144]
mov dword [eax + ecx*4], 0xfffffff8
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x1002704e
mov dword [esp + 0x38], 6
cmp dword [esp + 0x38], 0xffffffef
jge 0x1002725b
xor ecx, ecx
inc ecx
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x44], ecx
mov dword [esp + 0x18], ebx
jmp 0x100270a6
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0xc4], 0x91e29ea4
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ecx
jl 0x10027093
mov dword [esp + 0x18], ebx
jmp 0x100270c5
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0xb8], 0xfffffff8
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ecx
jl 0x100270b2
dec dword [esp + 0x20]
mov dword [esp + 0x20], ebx
cmp dword [esp + 0x20], ebx
jg 0x1002724c
mov dword [esp + 0x1c], 0xfca86293
mov dword [esp + 0x28], 0xfffffffa
mov dword [esp + 0x14], ebx
jmp 0x10027106
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x150], 0x9a22db78
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x100270f3
cmp dword [esp + 0x20], ebx
je 0x10027224
mov dword [esp + 0x2c], 0xfffffffb
lea ecx, [esp + 0xf8]
mov dword [esp + 0x34], 0xffff
mov dword [esp + 0x24], 6
push 2
call fcn.10024d89
xor edx, edx
mov dword [esp + 0x14], ebx
inc edx
cmp dword [esp + 0x14], 2
jge 0x1002715f
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xf8]
mov dword [eax + ecx*4], edx
inc dword [esp + 0x14]
jmp 0x10027144
cmp dword [esp + 0x158], ebx
jne 0x10027173
mov ecx, ebx
cmp dword [esp + 0xc4], ebx
je 0x10027175
mov ecx, edx
xor eax, eax
cmp ecx, 0x53fc
setle al
cmp eax, 0x4593f6a0
je 0x1002718f
mov eax, ebx
cmp dword [esp + 0x2c], ebx
je 0x10027191
mov eax, edx
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x15c]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x15c], 0x26d8f9c3
mov dword [esp + 0x1c], edx
mov dword [esp + 0x1c], ebx
jmp 0x1002720f
mov dword [esp + 0x2c], ebx
jmp 0x10027205
mov dword [esp + 0x24], ebx
jmp 0x100271fa
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x100271ed
push ebx
push 0x23f9
push ebx
call dword [sym.imp.GDI32.dll_GetRegionData]
mov eax, dword [esp + 0xf8]
inc dword [eax]
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 3
jle 0x100271d5
inc dword [esp + 0x2c]
cmp dword [esp + 0x2c], ebx
jle 0x100271cf
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 3
jle 0x100271c9
lea ecx, [esp + 0xf8]
call fcn.10024e55
jmp 0x10027237
mov dword [esp + 0x28], 0x5708880d
mov eax, dword [esp + 0x28]
mov dword [esp + 0xb8], eax
inc dword [esp + 0x44]
inc dword [esp + 0x20]
cmp dword [esp + 0x20], ebx
jle 0x100270dd
xor ecx, ecx
inc ecx
dec dword [esp + 0x38]
cmp dword [esp + 0x38], 0xffffffef
jl 0x10027081
or dword [esp + 0x1d4], 0xffffffff
lea ecx, [esp + 0x144]
call fcn.10024e55
mov dword [esp + 0x18], ebx
jmp 0x10027288
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x128], 0xa8eac8b1
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jl 0x10027275
mov dword [esp + 0x1c], 0x4ccb63e8
lea ecx, [esp + 0xe0]
mov dword [esp + 0x34], 0xe28fdeb7
push 1
call fcn.10024d89
mov dword [esp + 0x34], 0xa329ef4a
mov dword [esp + 0x28], 0xfffffff8
mov dword [esp + 0x14], ebx
jmp 0x100272d6
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xe0]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 1
jl 0x100272c3
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x100272fa
push ebx
push 0x1a88
push 0xaa3
push ebx
call dword [sym.imp.GDI32.dll_SetPaletteEntries]
mov eax, dword [esp + 0x1c]
xor edx, edx
mov dword [esp + 0x34], 0x94f9
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x1c]
cmp ecx, eax
setl dl
xor ecx, ecx
add edx, dword [esp + 0x1c]
inc ecx
mov eax, dword [esp + 0xe0]
mov dword [eax], edx
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
sub ecx, eax
add ecx, dword [esp + 0x1c]
mov dword [esp + 0x34], ecx
lea ecx, [esp + 0xe0]
mov eax, dword [esp + 0x34]
mov dword [esp + 0x28], eax
call fcn.10024e55
xor ecx, ecx
mov dword [esp + 0x18], ebx
inc ecx
jmp 0x10027360
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x68], ecx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ecx
jl 0x10027354
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], ebx
jmp 0x10027383
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x134], 0xfffffff9
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ecx
jl 0x10027370
mov dword [esp + 0x18], ebx
cmp dword [esp + 0x18], ebx
jl 0x100273b4
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x100273ae
push 0x12c0
push ebx
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
dec dword [esp + 0x18]
jns 0x10027393
mov dword [esp + 0x18], ebx
jmp 0x100273cf
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x100273cb
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ebx
jle 0x100273ba
mov dword [esp + 0x24], ebx
jmp 0x100273f5
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + eax*4 + 0x128]
mov eax, dword [esp + 0x24]
mov dword [esp + eax*4 + 0x128], ecx
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 2
jle 0x100273db
inc dword [esp + 0x68]
lea ecx, [esp + 0xec]
mov dword [esp + 0x2c], 0x263126ff
push 1
call fcn.10024d89
mov dword [esp + 0x14], ebx
jmp 0x10027432
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xec]
mov dword [eax + ecx*4], 0xa7b7e80d
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 1
jl 0x1002741c
mov eax, dword [esp + 0x2c]
xor ecx, ecx
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x2c]
cmp eax, 0x69f4
setl cl
xor edx, edx
cmp ecx, 0x5352
setle dl
inc edx
add edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x2c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [esp + 0x2c]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x2c]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x2c]
setne cl
mov dword [esp + 0x28], ecx
xor ecx, ecx
cmp dword [esp + 0x28], eax
mov eax, dword [esp + 0xec]
setg cl
mov dword [eax], ecx
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x100274c5
push 0x26bb
push 0xab9
push 0x5c6
push 0x1323
push ebx
call dword [sym.imp.USER32.dll_CheckMenuRadioItem]
lea ecx, [esp + 0xec]
call fcn.10024e55
lea eax, [esp + 0x5c]
push eax
push ebx
call fcn.10029692
mov dword [esp + 0x30], 0xb4e1a362
mov eax, 0xa233712
pop ecx
pop ecx
push 2
pop ecx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x28], 0x9c17633e
mov dword [esp + 0x28], 0xfffffff9
mov dword [esp + 0x28], ebx
mov dword [esp + 0x28], 0xcb8ce3e6
mov dword [esp + 0x28], 0xda622a14
mov dword [esp + 0x28], 0xfffffffc
mov dword [esp + 0x164], eax
mov dword [esp + 0x168], eax
mov dword [esp + 0x16c], eax
mov dword [esp + 0x170], eax
mov dword [esp + 0x28], 0xbde6
mov dword [esp + 0x28], 0xa82e
mov dword [esp + 0x28], 0xfffffff8
mov dword [esp + 0x34], 0xae7
dec dword [esp + 0x34]
mov dword [esp + 0x40], 0xb0647dc4
push ecx
mov dword [esp + 0x5c], 0x44555950
lea ecx, [esp + 0x108]
mov dword [esp + 0x2c], 0x6085
call fcn.10024d89
push 4
pop ecx
mov dword [esp + 0x1d4], ecx
mov dword [esp + 0x3c], 0xf58aae07
mov dword [esp + 0x28], 0x9634d71b
mov dword [esp + 0x54], ebx
jmp 0x100275b6
mov eax, dword [esp + 0x54]
mov dword [esp + eax*4 + 0x1b8], 0x4d9edbda
inc dword [esp + 0x54]
cmp dword [esp + 0x54], ecx
jl 0x100275a3
lea eax, [esp + 0x104]
push eax
lea eax, [esp + 0x58]
push eax
push 0x1975
push ebx
call fcn.1002aecb
add esp, 0x10
cmp dword [esp + 0x40], ebx
jne 0x10027619
mov eax, dword [esp + 0x58]
xor ecx, ecx
add eax, 2
cmp eax, 0xd23c
setl cl
lea eax, [ecx + 0x6497]
xor ecx, ecx
mov dword [esp + 0x1bc], eax
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x58]
cmp eax, 6
setne cl
dec dword [esp + 0x3c]
cmp dword [esp + 0x3c], ecx
jg 0x10027619
mov edx, ebx
jmp 0x1002761c
xor edx, edx
inc edx
mov eax, dword [esp + 0x40]
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x40]
push 3
pop edi
setl cl
cmp edi, eax
sbb eax, eax
inc eax
sub eax, ecx
mov dword [esp + 0x28], eax
lea eax, [esp + 0x104]
push eax
push 0x4b83
lea eax, [esp + 0x60]
push eax
push 0x524e
push ebx
call fcn.10027875
or dword [esp + 0x1e8], 0xffffffff
lea ecx, [esp + 0x118]
add esp, 0x14
call fcn.10024e55
cmp dword [esi + 0x14], 0x10
jb 0x10027677
mov ecx, dword [esi]
jmp 0x10027679
mov ecx, esi
cmp dword [esi + 0x14], 0x10
mov dword [esp + 0x64], ecx
jb 0x10027687
mov edx, dword [esi]
jmp 0x10027689
mov edx, esi
mov eax, dword [esi + 0x10]
add eax, edx
cmp ecx, eax
je 0x100276fc
mov al, byte [ecx]
cmp al, 0x30
jl 0x100276b6
cmp al, 0x39
jg 0x100276b6
lea eax, [esp + 0x5c]
push eax
lea eax, [esp + 0x68]
push ebx
push eax
call fcn.100298c5
mov ecx, dword [esp + 0x70]
add esp, 0xc
inc ecx
jmp 0x10027679
mov eax, dword [esp + 0x5c]
push ebx
mov dword [eax], ebx
lea eax, [esp + 0x4f]
mov dword [esp + 0x2c], 0xfffffff6
mov byte [esp + 0x4f], bl
push eax
call fcn.1002a351
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
pop ecx
pop ecx
je 0x100264d2
push 0x67d9
push 0x33de
push ebx
call fcn.100296c1
add esp, 0xc
jmp 0x100264d2
mov dword [esp + 0x2c], 0xb58e469a
mov dword [esp + 0x14], ebx
jmp 0x1002771d
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x1ac], 1
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x1002770a
mov dword [esp + 0x2c], ebx
jmp 0x10027738
mov dword [esp + eax*4 + 0x1ac], 0xffffffff
inc dword [esp + 0x2c]
cmp dword [esp + 0x2c], edi
mov eax, dword [esp + 0x2c]
jl 0x10027729
push ebx
push 0x122f
mov dword [esp + 0x34], eax
mov dword [esp + 0x44], 0x365653d4
push 0x3606
call fcn.10029b4b
mov eax, dword [esp + 0x48]
add esp, 0xc
mov eax, dword [esp + 0x3c]
cmp dword [esp + 0x3c], ebx
je 0x10027782
lea eax, [esp + 0x53]
mov byte [esp + 0x53], bl
push ebx
push eax
call fcn.100278fd
pop ecx
pop ecx
jmp 0x100277b1
lea eax, [esp + 0xbc]
mov dword [esp + 0xbc], 0x1654
push eax
lea eax, [esp + 0x9c]
mov dword [esp + 0x9c], 0x969ac54c
push eax
push ebx
call fcn.1002aa7a
add esp, 0xc
push edi
lea ecx, [esp + 0xd8]
call fcn.10024d89
mov dword [esp + 0x14], 0xb13638ec
mov dword [esp + 0x28], 0x7222631
mov dword [esp + 0x14], ebx
jmp 0x100277ea
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xd4]
mov dword [eax + ecx*4], 0x3342eb90
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x100277d4
mov dword [esp + 0x14], 2
cmp dword [esp + 0x14], ebx
jl 0x10027814
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xd4]
cmp dword [eax + ecx*4], ebx
jne 0x10027814
dec dword [esp + 0x14]
jns 0x100277fe
lea ecx, [esp + 0xd4]
call fcn.10024e55
mov al, 1
mov ecx, dword [esp + 0x1cc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret