Function at 0x10001f45
Capabilities:
Allocate or change rwx memory
Extract resource via kernel32 functions
Inspect load icon resource
Read file on windows
Terminate process

Disassembly:
push 0x6a
push 0
call sub.USER32.DLL_LoadIconA
sub ecx, dword [0x1005216c]
mov edi, 4
cmp eax, 1
ja 0x10001f7c
mov dword [0x10051f00], edx
mov eax, dword [0x10051dac]
or eax, esi
mov eax, dword [0x1005207c]
mov dword [0x10051e64], esi
mov dword [0x1005208c], edx
mov eax, dword [0x100520f8]
push 1
push dword [0x10051f9c]
call sub.USER32.DLL_IsChild
mov eax, dword [0x10051db4]
sub eax, edi
mov eax, dword [0x10051d9c]
mov eax, 0x10
cmp eax, dword [0x10051dd8]
ja 0x10001fc9
mov eax, dword [0x10051dc4]
mov eax, dword [0x10052030]
mov edi, 0x1d
mov eax, dword [0x10051e9c]
mov ax, 0x80
xor dword [0x10051e44], 0xff0000ff
mov eax, dword [0x1005211c]
call sub.KERNEL32.DLL_GetThreadLocale
mov esi, dword [0x10051ed0]
mov edi, 2
mov eax, dword [0x10051f08]
cmp dword [0x10051f7c], eax
jne 0x10002008
mov edi, dword [0x10051e3c]
mov edx, dword [0x100520fc]
add edx, eax
mov ax, 0x40
mov dword [0x10052124], eax
or dword [0x10051e9c], eax
mov dword [0x10051e9c], esi
call sub.KERNEL32.DLL_GetThreadLocale
mov edi, dword [0x100520d8]
add eax, eax
mov edx, dword [0x10051e48]
cmp dword [0x100520e8], 0x34
jl 0x10002058
mov eax, dword [0x100520e8]
mov eax, dword [0x10052038]
mov eax, dword [0x10051de8]
mov edi, 0x52
mov ecx, dword [0x10052004]
and esi, edi
mov dword [0x10051ef4], edx
mov dword [0x10051fe4], edx
mov esi, dword [0x10052114]
mov dword [0x10052024], eax
mov dword [0x10051f0c], eax
push 2
call sub.USER32.DLL_IsWindowUnicode
mov esi, dword [0x10051ff0]
mov ecx, 0x66
mov edx, dword [0x10051f04]
mov cx, 2
cmp dword [0x10051ddc], 0xf5
jl 0x100020a7
mov dword [0x10051e78], ecx
mov eax, dword [0x10052180]
mov eax, 0x80
sub edx, edx
mov dword [0x10051f54], eax
mov dword [0x100520ac], ecx
add ecx, ecx
push ecx
push 0x82
call sub.USER32.DLL_KillTimer
mov edi, dword [0x100520cc]
or edx, edx
cmp eax, eax
jne 0x100020e1
mov dword [0x10052028], eax
mov eax, dword [0x10051e4c]
add ecx, eax
mov eax, 0x60
mov dword [0x10051d9c], eax
mov dword [0x10051e24], eax
mov ecx, dword [0x10051e7c]
mov dword [0x10051ff4], ecx
push dword [0x10052070]
push 2
call sub.USER32.DLL_IsChild
mov eax, dword [0x1005212c]
mov eax, 0x20
mov cx, 0x7a
cmp edx, 1
jb 0x10002127
mov dword [0x10052004], esi
mov edi, dword [0x10052164]
add edx, edx
mov esi, dword [0x10051ebc]
mov dword [0x10051fd4], esi
mov esi, dword [0x10051f78]
mov eax, dword [0x10051ec4]
and edi, ecx
push edi
mov eax, 4
push eax
call sub.USER32.DLL_IsChild
mov eax, dword [0x1005207c]
add eax, ecx
cmp dword [0x10052140], 1
jl 0x10002160
mov dword [0x100520b4], eax
mov esi, dword [0x10051e0c]
mov ecx, 4
mov dword [0x10051f84], ecx
mov eax, dword [0x10051e0c]
push ecx
push edi
call sub.USER32.DLL_IsChild
mov ecx, dword [0x10051f84]
add ecx, esi
mov edi, dword [0x100520b8]
cmp eax, ecx
jg 0x10002198
mov eax, dword [0x10051ef4]
mov esi, dword [0x10051fe8]
sub eax, edx
sub edi, edi
mov dword [0x10051f14], edi
mov dword [0x10052050], eax
mov eax, dword [0x10051ddc]
mov dword [0x10051eb0], eax
call sub.KERNEL32.DLL_GetThreadLocale
mov ecx, dword [0x10052060]
xor edi, esi
mov ax, 0xab
test ecx, ecx
jg 0x100021cd
mov eax, dword [0x10051ef8]
add eax, esi
mov eax, dword [0x10051f1c]
mov dword [0x1005203c], eax
mov eax, dword [0x10052104]
adc dword [0x10051e70], eax
mov dword [0x1005203c], eax
push esi
push 0x80
call sub.USER32.DLL_IsChild
mov edi, dword [0x10051d9c]
mov ecx, 8
mov edi, dword [0x10052150]
cmp edx, dword [0x10052018]
jae 0x10002225
or esi, dword [0x10051e7c]
mov eax, dword [0x10051e14]
mov esi, dword [0x10051e54]
add eax, edi
mov eax, dword [0x10051e60]
mov dword [0x10051ea8], edi
mov dword [0x10052090], eax
mov ecx, dword [0x10051f78]
mov dword [0x100520c4], eax
mov esi, dword [0x10051f80]
call sub.KERNEL32.DLL_GetThreadLocale
mov esi, dword [0x100520b8]
sub ecx, eax
mov eax, dword [0x10051f4c]
cmp eax, 0
jne 0x10002273
mov eax, dword [0x10052150]
mov eax, dword [0x10051ea0]
sub eax, dword [0x10051d9c]
sub eax, edx
mov edx, dword [0x10051fd4]
mov ax, 8
mov dword [0x10052070], eax
mov dword [0x100520fc], eax
mov dword [0x100520d8], edx
mov eax, dword [0x10051f08]
mov dword [0x10051f98], eax
mov dword [0x100520c0], edi
push 0x6af
push 0
call sub.USER32.DLL_LoadIconA
mov edx, dword [0x10051d9c]
mov ax, 0xa0
and ecx, dword [0x10051e58]
mov ax, 0xdb
test ecx, ecx
jne 0x100022db
mov dword [0x10052040], ecx
mov edx, dword [0x100520bc]
mov esi, 0x20
mov edi, dword [0x10051ea0]
mov edi, 0x7d
mov dword [0x1005206c], edx
mov dword [0x10051f88], ecx
sbb eax, dword [0x10052014]
mov edx, dword [0x10052050]
mov dword [0x10051f84], eax
call sub.KERNEL32.DLL_GetThreadLocale
mov eax, dword [0x10052058]
add ecx, edx
mov eax, dword [0x10051f78]
mov eax, 8
cmp ecx, 0
jae 0x10002321
mov ecx, dword [0x10051f28]
mov dword [0x10051fdc], eax
mov eax, dword [0x10051ee4]
mov esi, 0x80
mov dword [0x10051e30], edx
adc eax, dword [0x10051dc8]
mov dword [0x10051e60], eax
mov dword [0x10051da4], eax
mov ecx, dword [0x100520bc]
push 0x8c
push dword fs:[0x30]
sub dword [ebp - 0xdc], 0x149c1
call sub.KERNEL32.DLL_IsBadHugeReadPtr
cmp eax, 0
je 0x100028e0
push eax
mov esi, dword [0x10051eec]
push esi
push esi
call sub.KERNEL32.DLL_LoadLibraryExA
call sub.USER32.DLL_GetClassLongA
push dword [0x10051e58]
push ecx
push dword [0x10051e54]
call sub.USER32.DLL_GetClassLongA
push eax
mov edi, dword [0x10052040]
push edi
push eax
mov esi, 8
push esi
call sub.USER32.DLL_GetClassNameA
push eax
push dword [0x10051ee0]
call sub.USER32.DLL_GetClassNameA
push edx
mov dword [0x10051d9c], eax
push dword [0x10051e60]
mov eax, dword [0x10051e90]
push eax
call sub.GDI32.DLL_CreateDIBSection
mov dword [0x10052174], edx
push 8
mov dword [0x1005210c], esi
push dword [0x10051fcc]
push dword [0x10051e64]
call sub.USER32.DLL_GetClientRect
mov edx, 0x42
push edx
push 0xef
mov eax, dword [0x10051ed4]
push eax
push edi
call sub.KERNEL32.DLL_ResetEvent
call sub.USER32.DLL_GetClientRect
mov ecx, dword [0x10052068]
push ecx
call sub.GDI32.DLL_CreateBrushIndirect
push eax
mov dword [0x10052154], eax
push dword [0x10051ec8]
push dword [0x10051d9c]
call sub.USER32.DLL_GetClassLongA
push eax
mov dword [0x10052130], eax
push 0x10
push eax
push edx
call sub.USER32.DLL_GetClassLongA
mov dword [0x10051f70], eax
push 0xce
call sub.USER32.DLL_GetClientRect
mov eax, dword [0x10051ffc]
mov esi, 0x40
mov eax, dword [0x10051f54]
sub eax, edi
cmp eax, 1
jl 0x10002458
xor eax, dword [0x10051de0]
mov ecx, 4
mov eax, 2
mov dword [0x10051f00], eax
mov dword [0x10051fd0], eax
sub eax, dword [0x10051d9c]
mov dword [0x10052120], edi
push 0x10
mov eax, 0x47
push eax
call sub.KERNEL32.DLL_RaiseException
push dword [0x10051eb0]
call sub.USER32.DLL_GetClassNameA
push 0xb7
call sub.USER32.DLL_GetClientRect
mov eax, dword [0x10052030]
mov eax, 0x4c
mov edx, dword [0x10052144]
mov eax, 0x80
test ecx, ecx
jne 0x100024bd
mov dword [0x10051edc], ecx
mov eax, dword [0x10051d9c]
add esi, edx
mov eax, dword [0x10051f88]
add dword [0x10051e34], edx
mov dword [0x10051e04], ecx
mov dword [0x1005203c], eax
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
push edi
call sub.KERNEL32.DLL_ResetEvent
push eax
mov eax, 0x80
push eax
mov edx, dword [0x100520e8]
push edx
call sub.USER32.DLL_GetClientRect
mov ecx, dword [0x10052024]
sub ecx, eax
mov eax, dword [0x10052120]
test eax, eax
ja 0x1000250d
mov dword [0x10051e0c], eax
mov eax, dword [0x10051fbc]
add esi, eax
mov dword [0x10051f80], eax
mov eax, dword [0x10051e84]
mov dword [0x10052164], eax
add esi, dword [0x10051f10]
push ecx
call sub.USER32.DLL_GetClientRect
mov edi, dword [0x10052134]
mov ax, 0xaa
or eax, dword [0x10051da8]
mov esi, 0x98
cmp dword [0x100520c4], eax
je 0x1000254d
mov dword [0x10051dc8], eax
mov edx, dword [0x10051fb0]
sub edi, eax
mov eax, dword [0x10052180]
mov dword [0x10052124], eax
push ecx
push 0x40
call sub.KERNEL32.DLL_ReadFile
mov eax, dword [0x10052090]
mov eax, 0x40
push eax
push eax
call sub.USER32.DLL_GetClassLongA
push eax
mov dword [0x10051f9c], eax
push dword [0x10051ec8]
mov ecx, dword [0x10051da0]
push ecx
mov edx, dword [0x100520dc]
push edx
call sub.KERNEL32.DLL_RaiseException
mov dword [0x10052158], edi
push dword [0x10052134]
push dword [0x10051e60]
push dword [0x10051d9c]
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, dword [0x10051fbc]
sub edi, eax
mov ax, 0x62
cmp eax, 1
jne 0x100025d2
add ecx, dword [0x10051e18]
sub edi, eax
mov esi, dword [0x10051de0]
mov esi, 0xba
mov dword [0x10051ff4], edx
mov dword [0x10052150], ecx
mov eax, dword [0x100520bc]
push eax
mov eax, dword [0x10051ef0]
mov eax, 0x8b
push eax
mov dword [0x10051db0], eax
push 4
call sub.USER32.DLL_GetClassNameA
call sub.GDI32.DLL_CreateCompatibleBitmap
push esi
mov esi, dword [0x10052150]
add esi, eax
push esi
call sub.USER32.DLL_GetClassNameA
call sub.KERNEL32.DLL_RaiseException
push dword [0x10051f60]
call sub.KERNEL32.DLL_ResetEvent
mov eax, 0x10
push eax
push 8
push dword [0x10051fa4]
add eax, eax
push eax
call sub.GDI32.DLL_CreateBitmap
mov si, 2
push esi
push eax
call sub.USER32.DLL_GetClassNameA
mov eax, dword [0x100520b8]
sub edi, eax
mov dx, 0x20
cmp dword [0x1005201c], 6
jg 0x10002668
mov esi, dword [0x10052180]
mov dword [0x10052100], eax
mov esi, dword [0x10051f1c]
mov si, 0xd4
mov ecx, 0x10
mov dword [0x10052054], ecx
mov dword [0x10051e04], eax
push 0x20
mov esi, dword [0x10051de0]
push esi
push edx
call sub.USER32.DLL_GetClassNameA
mov eax, dword [0x10052058]
sub eax, eax
cmp edi, dword [0x10052098]
jae 0x100026a4
mov edi, dword [0x10052078]
mov edi, dword [0x10051e5c]
add edx, edi
mov dword [0x10052154], eax
mov edx, dword [0x10051efc]
mov edx, dword [0x10052040]
push esi
mov dword [0x10051ecc], ecx
push 4
call sub.KERNEL32.DLL_RaiseException
mov edx, dword [0x10052100]
mov eax, 2
mov edx, dword [0x1005205c]
mov ecx, 0x10
cmp dword [0x10051ebc], eax
jne 0x100026f8
mov dword [0x10051ecc], eax
mov eax, dword [0x10052034]
mov ax, 2
mov eax, dword [0x10052010]
mov dword [0x10051e40], eax
mov dword [0x10051dd0], eax
mov eax, dword [0x10051da8]
push eax
mov edx, 0xb7
push edx
call sub.USER32.DLL_GetClassNameA
call sub.USER32.DLL_GetClientRect
push esi
push dword [0x10052044]
call sub.USER32.DLL_GetClassLongA
mov edx, dword [0x10051e48]
sub ecx, ecx
cmp dword [0x10051de0], 1
jne 0x10002745
mov esi, dword [0x10051f64]
add esi, eax
adc edx, dword [0x1005213c]
mov dword [0x10052100], esi
mov dword [0x10052014], eax
mov dword [0x10052068], esi
call sub.USER32.DLL_GetClassNameA
call sub.GDI32.DLL_CreateBitmap
push 4
call sub.KERNEL32.DLL_ReadFile
mov edi, dword [0x10051de0]
mov eax, 2
mov eax, dword [0x100520a0]
cmp dword [0x1005202c], 8
jb 0x10002791
mov dword [0x10052028], 0x94
mov edi, dword [0x1005215c]
add esi, ecx
mov edi, dword [0x100520dc]
mov dword [0x1005216c], eax
mov dword [0x10052128], eax
push eax
mov dword [0x10052154], eax
push 4
push eax
call sub.GDI32.DLL_CreateDIBSection
mov eax, 0x20
push eax
push ecx
push 8
push edx
call sub.GDI32.DLL_CreateDIBSection
mov eax, 0xca
push eax
mov esi, 0x40
push esi
call sub.KERNEL32.DLL_VirtualAllocEx
mov edi, dword [0x10051fa8]
add edi, edi
cmp edx, ecx
jl 0x100027e8
mov esi, dword [0x10051f00]
mov esi, dword [0x10052120]
mov edi, 0x28
add eax, esi
mov dword [0x10051f08], eax
mov dword [0x10051d9c], eax
mov dword [0x10051de0], eax
mov dword [0x10052018], eax
push dword [0x10051d9c]
mov eax, dword [0x10052110]
sub eax, esi
push eax
push dword [0x10051d9c]
call sub.KERNEL32.DLL_ResetEvent
add eax, eax
push eax
push esi
push esi
push eax
call sub.GDI32.DLL_CreateCompatibleDC
push 2
call sub.KERNEL32.DLL_LockResource
mov eax, dword [0x10051f64]
push eax
push 0x46
push eax
push ecx
call sub.USER32.DLL_GetClassNameA
push dword [0x100520ac]
call sub.KERNEL32.DLL_ReadFile
mov dword [0x1005206c], eax
push 0xfd
push eax
call sub.USER32.DLL_GetClassNameA
push eax
call sub.USER32.DLL_GetClientRect
push edi
call sub.USER32.DLL_GetClassLongA
mov eax, dword [0x10051fd8]
push eax
call sub.KERNEL32.DLL_VirtualAllocEx
call sub.KERNEL32.DLL_ResetEvent
mov eax, dword [0x10051fa4]
mov edx, 0x9d
sub eax, esi
cmp ecx, esi
jne 0x1000288b
mov dword [0x10052070], edi
mov eax, dword [0x10051dd4]
sub ecx, esi
mov dword [0x10052134], edx
mov eax, dword [0x10051e7c]
mov dword [0x10052078], eax
call sub.KERNEL32.DLL_LockResource
mov eax, dword [0x10051e94]
mov ax, 0x80
mov esi, dword [0x10051d9c]
mov ecx, 0x10
cmp dword [0x10051ea4], 0x40
jae 0x100028d4
mov dword [0x10051fc4], eax
mov esi, dword [0x10051f30]
sub eax, edi
mov esi, dword [0x10051eec]
mov dword [0x10051e94], eax
mov eax, dword [0x10051e40]
mov eax, dword [0x10051ff0]
push dword [ebp - 0x84]
call dword [sym.imp.KERNEL32.DLL_ExitThread]
mov eax, dword [0x10051f64]
add ecx, ecx
cmp ecx, 1
je 0x10002916
mov eax, dword [0x10051e90]
mov eax, dword [0x10051f70]
mov ecx, dword [0x10052100]
mov esi, 0xb1
mov edx, dword [0x10052070]
mov dword [0x10052178], eax
mov dword [0x10051fc4], eax
mov dword [0x10052148], eax
mov ecx, dword [0x10051f7c]
mov eax, dword [0x1005212c]
push eax
push dword [0x10051fa0]
call sub.USER32.DLL_IsChild
mov edx, dword [0x10051e78]
sub eax, edi
sub edi, esi
test eax, eax
jl 0x10002962
mov dword [0x10051e24], eax
mov esi, dword [0x10051d9c]
sub eax, edi
mov eax, dword [0x100520c4]
mov si, 8
mov dword [0x10051f90], edi
mov dword [0x10051fd4], ecx
mov dword [0x1005211c], eax
sub eax, esi
push eax
call sub.USER32.DLL_IsWindowUnicode
mov eax, dword [0x10051fd8]
mov ax, 0x33
cmp esi, dword [0x10052064]
je 0x1000298d
mov eax, dword [0x10051f4c]
add edx, edi
mov dword [0x100520b4], eax
mov dword [0x10051dc0], edx
mov eax, dword [0x1005205c]
call fcn.100016ec
and eax, dword [0x10051d9c]
sub eax, eax
sub eax, eax
cmp ecx, eax
jb 0x100029bf
mov esi, dword [0x1005217c]
mov cx, 0x33
mov dword [0x10052180], eax
mov dword [0x10051f1c], eax
mov edi, dword [0x10051ff8]
push dword [0x10052018]
call sub.USER32.DLL_IsWindowUnicode
and edi, dword [0x10051ef0]
mov edi, 0xf
mov edi, dword [0x10051de0]
mov cx, 0x60
cmp eax, dword [0x10051ea0]
jne 0x10002a0e
sub dword [0x10051ee0], eax
mov edx, dword [0x10051e9c]
mov edi, 0x40
mov edi, dword [0x10051efc]
mov dword [0x10052140], ecx
mov eax, dword [0x10051ff0]
mov eax, dword [0x100520bc]
sbb eax, dword [0x10051fa4]
mov eax, dword [0x10052128]
call fcn.1000122f
mov edx, dword [0x10052178]
add eax, eax
add eax, edx
cmp ecx, 1
jbe 0x10002a43
mov ecx, dword [0x10051f7c]
mov ax, 0x20
mov dword [0x10051fc4], ecx
mov dword [0x10051f68], esi
mov dword [0x10051d9c], eax
mov eax, dword [0x10051ebc]
mov edi, dword [0x10051e0c]
add eax, eax
test edi, edi
jb 0x10002a72
mov dword [0x10051d9c], ecx
mov edx, dword [0x10051f0c]
sub eax, eax
mov dword [0x10051dac], eax
mov dword [0x10051fe4], edx
mov edx, dword [0x10051d9c]
call fcn.10002e0e
mov edi, dword [0x10051f0c]
sub edi, eax
mov edi, dword [0x10051d9c]
mov ax, 0x7d
cmp esi, 0
jae 0x10002abd
mov dword [0x10051f68], eax
mov eax, dword [0x10051fe4]
mov eax, dword [0x10051f60]
add edx, ecx
mov edi, dword [0x10052058]
add ecx, eax
mov dword [0x10051fe8], eax
or dword [0x100520c0], eax
mov dword [0x10051e1c], eax
mov dword [0x10052018], 0x47
call fcn.10003876
or esi, dword [0x10051ecc]
add eax, eax
mov edx, dword [0x10051f70]
add eax, eax
cmp dword [0x10051ed0], eax
jg 0x10002b0c
mov eax, dword [0x10051e58]
mov eax, dword [0x10051d9c]
mov si, 2
mov ecx, dword [0x10051f88]
sub edx, esi
mov dword [0x10051d9c], esi
mov dword [0x10051e54], edx
mov dword [0x10052120], ecx
call fcn.10001d3f
mov edi, dword [0x10051fa4]
add eax, esi
sub eax, eax
cmp dword [0x1005206c], 0x85
jl 0x10002b58
xor eax, dword [0x10051ebc]
mov dword [0x100520a0], esi
mov eax, dword [0x10051ed0]
sub eax, eax
mov ecx, dword [0x10051fb0]
sub esi, ecx
mov dword [0x10052164], eax
sub dword [0x10052068], eax
mov eax, dword [0x10051f7c]
mov dword [0x10052018], ecx
mov dword [0x10051fa0], esi
push ecx
call sub.USER32.DLL_IsWindowUnicode
call fcn.10002f60
mov eax, dword [0x100520f8]
or eax, eax
mov edi, dword [0x10052030]
sub edx, edi
cmp esi, eax
ja 0x10002b9d
mov dword [0x10051f80], eax
mov eax, dword [0x10052118]
mov ecx, dword [0x10051dc0]
sub esi, eax
mov dword [0x10052134], eax
mov dword [0x100520c8], eax
mov dword [0x10052130], eax
mov dword [0x10051e00], esi
push 0x10
push edi
call sub.USER32.DLL_IsChild
call fcn.10003af3
call fcn.10001d3f
mov eax, dword [0x10051fc4]
sub eax, eax
mov eax, dword [0x10052040]
cmp dword [0x10052090], eax
ja 0x10002be3
mov eax, dword [0x10052140]
xor eax, edi
adc eax, dword [0x10051ebc]
add eax, eax
sbb dword [0x100520f8], esi
mov dword [0x1005218c], eax
call fcn.10002e0e
mov ecx, dword [0x10051e90]
xor eax, eax
mov edx, dword [0x10051d9c]
cmp dword [0x10052108], eax
jne 0x10002c1a
mov dword [0x10051dbc], eax
mov edi, dword [0x10051d9c]
mov eax, 0xd1
mov dword [0x10052000], ecx
mov dword [0x100520e8], esi
mov dword [0x10051d9c], eax
push eax
call sub.USER32.DLL_IsWindowUnicode
call fcn.10002e0e
mov eax, dword [0x10051dd4]
sub edi, edx
add edi, edi
cmp edx, 1
jbe 0x10002c53
mov esi, dword [0x10051e54]
mov edx, 0x80
mov eax, dword [0x10051da8]
mov dword [0x10051fbc], eax
mov edi, dword [0x10052000]
mov ecx, dword [0x10051db8]
mov eax, dword [0x100520f4]
call fcn.100035de
mov dx, 0x10
push edx
call sub.USER32.DLL_IsWindowUnicode
mov edi, dword [0x100520c4]
mov eax, 0x6c
cmp dword [0x10051e24], 8
jae 0x10002ca1
mov edi, dword [0x10051fbc]
mov eax, dword [0x10052030]
mov di, 0xa7
mov dword [0x10051fac], esi
mov dword [0x10051ff4], edx
mov eax, dword [0x10051e24]
add esi, dword [0x10051e48]
mov dword [0x10051e1c], eax
call fcn.10003af3
mov ecx, dword [0x10051da8]
mov eax, 0x2c
mov edx, 0x80
test ecx, ecx
jo 0x10002ce4
mov ecx, dword [0x10051f5c]
xor eax, eax
mov edx, dword [0x10051f5c]
mov dword [0x10051d9c], ecx
mov eax, dword [0x10051d9c]
mov ecx, dword [0x1005209c]
mov esi, dword [0x10051db0]
mov cx, 0x40
cmp eax, dword [0x10051ebc]
jne 0x10002d11
mov eax, dword [0x10052134]
mov dword [0x10052128], eax
mov eax, dword [0x10051fa4]
mov si, 2
add edx, esi
mov dword [0x10051f34], edx
mov dword [0x10051e48], eax
call fcn.100018c4
adc ecx, dword [0x10051ee8]
mov si, 0x91
cmp ecx, 0
jl 0x10002d4e
mov dword [0x1005216c], eax
mov dword [0x10051f6c], edx
mov eax, dword [0x10051de4]
mov esi, 2
mov ax, 8
mov dword [0x10051e98], eax
mov edx, dword [0x10051dc0]
mov dword [0x10051f90], edi
mov dword [0x10051df4], eax
push 0x20
push dword [0x10051f7c]
call sub.USER32.DLL_IsChild
mov eax, dword [0x10051e3c]
add esi, ecx
mov esi, dword [0x1005215c]
add edx, eax
cmp eax, 1
jb 0x10002da2
mov dword [0x10052134], esi
mov dword [0x10051d9c], ecx
mov esi, dword [0x10051d9c]
mov eax, 0x9d
mov eax, dword [0x10051e2c]
mov dword [0x10052078], edx
mov dword [0x10051e98], ecx
mov edi, dword [0x10051d9c]
call fcn.100035de
mov edx, dword [0x10051f6c]
sub eax, eax
sub edi, eax
cmp eax, edx
je 0x10002dea
mov dword [0x10051dd4], edx
mov esi, dword [0x10051d9c]
mov ecx, 8
mov esi, dword [0x10051f88]
sub esi, eax
mov dword [0x10051f64], edx
mov dword [0x10051f04], eax
mov dword [0x10051f98], eax
mov ecx, dword [0x10052164]
mov dword [0x100520a4], eax
mov ax, 0xd9
push eax
mov dword [0x10052074], esi
push 0x40
call sub.USER32.DLL_KillTimer
call fcn.10002e0e
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]