Function at 0x401340
Capabilities:
Check for foreground window switch
Check for time delay via gettickcount
Hide graphical window
Log keystrokes via polling
Resolve function by parsing pe exports
Set current directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x134
push ebx
push esi
push edi
xor edi, edi
cmp dword [ebp + 0xc], 2
mov byte [esp + 0x1b], 0
lea ebx, [edi + 1]
jne 0x401375
cmp byte [0x4a0b80], 0
mov dword [ebp + 0xc], ebx
jne 0x401375
mov byte [0x4a0b80], bl
mov byte [esp + 0x1b], bl
cmp dword [0x4a2c14], edi
je 0x4013a9
cmp dword [0x4a2c04], edi
je 0x401397
mov eax, dword [0x4a2bfc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [0x4a2c04], edi
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [0x4a2c14], edi
mov dword [0x4a2bfc], edi
mov esi, dword [ebp + 8]
cmp esi, 0x8000012f
jne 0x4013c9
mov dword [ebp + 8], 0xa
mov esi, dword [ebp + 8]
mov byte [esp + 0x58], 1
mov dword [esp + 0x6c], edi
jmp 0x4013e7
cmp esi, 5
setle al
mov byte [esp + 0x58], al
test al, al
je 0x4013dd
mov dword [esp + 0x6c], edi
jmp 0x4013e7
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x6c], eax
cmp dword [0x4a24a0], edi
je 0x4013f4
call fcn.00402b90
mov byte [esp + 0x18], 0
cmp dword [0x4a30b0], edi
je 0x40140f
call fcn.00402a20
test al, al
je 0x40140f
mov byte [esp + 0x18], 1
cmp esi, edi
jle 0x40162d
cmp dword [ebp + 0xc], ebx
jne 0x40162d
add dword [0x4a0b90], ebx
cmp byte [0x4a0b7a], 0
mov byte [esp + 0x19], 1
jne 0x401451
mov ecx, dword [0x4a0a38]
push edi
push 0xa
push 9
push ecx
call dword [sym.imp.USER32.dll_SetTimer]
test eax, eax
setne dl
mov byte [0x4a0b7a], dl
mov byte [esp + 0x23], 0
mov byte [esp + 0x1a], 0
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
cmp dword [ebp + 8], 0
mov ebx, eax
jle 0x401637
cmp byte [esp + 0x1a], 0
jne 0x401637
cmp byte [0x4a0b80], 0
jne 0x401644
call fcn.004030f0
neg eax
sbb eax, eax
and eax, 0xfffffcef
add eax, 0x311
push eax
push 0
push 0
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
cmp eax, 0xffffffff
je 0x40145b
call edi
mov ecx, eax
sub ecx, ebx
cmp ecx, 3
jbe 0x4014bf
mov dword [0x4a3100], eax
cmp dword [0x4a1344], 0
je 0x4014f9
mov edx, dword [esp + 0x34]
lea eax, [esp + 0x9c]
push eax
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x34]
push edx
mov edx, dword [esp + 0x34]
push eax
push ecx
push edx
call fcn.00402c00
add esp, 0x18
test al, al
jne 0x40145b
cmp dword [0x4a2b64], 0
mov esi, dword [esp + 0x2c]
je 0x401b1d
mov eax, dword [esp + 0x28]
test eax, eax
je 0x401b1d
cmp eax, dword [0x4a0a38]
je 0x401b1d
cmp esi, 0x414
je 0x401b1d
cmp esi, 0x402
je 0x401b1d
cmp esi, 0x100
jne 0x401ab7
mov edi, dword [esp + 0x30]
cmp edi, 0x22
je 0x401567
cmp edi, 0x21
je 0x401567
cmp edi, 9
je 0x401567
cmp edi, 0x25
je 0x401567
cmp edi, 0x27
jne 0x4018ae
call dword [sym.imp.USER32.dll_GetFocus]
mov esi, eax
test esi, esi
je 0x4018aa
call fcn.004685d0
test eax, eax
je 0x4018aa
mov edi, eax
call fcn.004012d0
mov ebx, eax
mov dword [esp + 0x10], ebx
test ebx, ebx
je 0x4018aa
cmp byte [ebx + 0x54], 0
je 0x4018aa
push esi
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
lea edi, [eax - 3]
cmp edi, dword [ebx + 0xc]
jb 0x4015d0
push esi
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
je 0x4015c7
push eax
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
lea edi, [eax - 3]
cmp edi, dword [ebx + 0xc]
jae 0x4018a2
mov ecx, dword [ebx + 0x14]
lea eax, [edi + edi*4]
lea esi, [ecx + eax*4]
mov dword [esp + 0x14], esi
test esi, esi
je 0x4018aa
mov al, byte [esi + 4]
cmp al, 0xf
je 0x4018aa
mov edi, dword [esp + 0x30]
xor ebx, ebx
cmp al, 0x13
jne 0x401993
mov ebx, esi
cmp edi, 0x25
je 0x40160e
cmp edi, 0x27
jne 0x401993
mov ecx, dword [esp + 0x10]
cmp edi, 0x27
push 0
sete dl
movzx eax, dl
push 0
push eax
push ecx
mov eax, esi
call fcn.0045b870
jmp 0x40145b
mov byte [esp + 0x19], 0
jmp 0x401451
cmp byte [0x4a0b80], 0
je 0x4017bf
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
test esi, esi
je 0x4017bf
push 0
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [0x4a2bbc]
jne 0x4017bf
cmp dword [0x4a0bbc], 0
je 0x4016a1
push 0x20
lea edx, [esp + 0xa4]
push edx
push esi
call dword [sym.imp.USER32.dll_GetClassNameA]
lea eax, [esp + 0xa0]
push str.32770
push eax
call fcn.00476dcc
add esp, 8
test eax, eax
sete al
test al, al
jne 0x4016f6
call dword [sym.imp.USER32.dll_GetFocus]
test eax, eax
je 0x4017bf
push 0x20
lea ecx, [esp + 0xa4]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetClassNameA]
lea edx, [esp + 0xa0]
push str.SysTreeView32
push edx
call fcn.00476cb6
add esp, 8
test eax, eax
je 0x4016f6
lea eax, [esp + 0xa0]
push str.SysListView32
push eax
call fcn.00476cb6
add esp, 8
test eax, eax
jne 0x4017bf
mov edi, dword [sym.imp.USER32.dll_PeekMessageA]
push 0
push 0x1ff
push 0
push 0
lea ecx, [esp + 0x38]
push ecx
call edi
test eax, eax
jne 0x40173b
push 1
call fcn.004030f0
neg eax
sbb eax, eax
and eax, 0xfffffcef
add eax, 0x311
push eax
push 0x20e
push 0
lea edx, [esp + 0x38]
push edx
call edi
jmp 0x40183a
mov esi, dword [esp + 0x38]
push 0
call fcn.004030f0
neg eax
sbb eax, eax
and eax, 0xfffffcef
add eax, 0x311
push eax
push 0x20e
push 0
lea eax, [esp + 0x38]
push eax
call edi
push 1
test eax, eax
jne 0x40177c
push 0x1ff
push eax
push eax
lea ecx, [esp + 0x38]
push ecx
call edi
jmp 0x40183a
mov edx, dword [esp + 0x3c]
sub edx, esi
test edx, edx
jle 0x40179b
push 0x1ff
push 0
push 0
lea eax, [esp + 0x38]
push eax
call edi
jmp 0x40183a
call fcn.004030f0
neg eax
sbb eax, eax
and eax, 0xfffffcef
add eax, 0x311
push eax
push 0x20e
push 0
lea ecx, [esp + 0x38]
push ecx
call edi
jmp 0x40183a
cmp dword [0x49d328], 0
je 0x401818
cmp dword [0x4a0bb0], 0
jne 0x401818
mov eax, dword [0x49d3c8]
cmp byte [eax + 0xc4], 0
jne 0x40180f
cmp byte [eax + 0xc6], 0
jne 0x40180f
cmp dword [eax + 0xb8], 0xffffffff
jle 0x40180f
call edi
mov edx, eax
mov eax, dword [0x49d3c8]
sub edx, dword [eax + 0xb4]
cmp edx, dword [eax + 0xb8]
jb 0x40180f
mov byte [eax + 0xc4], 1
movzx eax, byte [eax + 0xc4]
jmp 0x40181a
xor eax, eax
neg eax
sbb eax, eax
push 1
and eax, 0xfffffcef
add eax, 0x311
push eax
push 0
push 0
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne 0x4014bf
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov ecx, eax
sub ecx, ebx
cmp ecx, 3
jbe 0x401858
mov dword [0x4a3100], eax
mov esi, dword [ebp + 8]
test esi, esi
jne 0x401877
cmp byte [esp + 0x23], 0
jne 0x401877
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [esp + 0x23], 1
jmp 0x40145b
call edi
cmp byte [esp + 0x58], 0
jne 0x40286f
mov edx, dword [esp + 0x6c]
sub edx, eax
add edx, esi
cmp edx, 5
jle 0x40286f
push 5
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40145b
mov dword [esp + 0x14], 0
mov edi, dword [esp + 0x30]
cmp edi, 0x1b
je 0x4018d7
cmp edi, 9
je 0x4018d7
cmp edi, 0x41
jne 0x401a4f
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x401a4b
call dword [sym.imp.USER32.dll_GetFocus]
mov esi, eax
test esi, esi
je 0x401a4b
call fcn.004685d0
test eax, eax
je 0x401a4b
mov edi, eax
call fcn.004012d0
mov dword [esp + 0x10], eax
test eax, eax
je 0x401a4b
mov ebx, dword [sym.imp.USER32.dll_GetDlgCtrlID]
push esi
call ebx
mov edx, dword [esp + 0x10]
lea edi, [eax - 3]
cmp edi, dword [edx + 0xc]
jb 0x40192d
push esi
call dword [sym.imp.USER32.dll_GetParent]
test eax, eax
je 0x40192d
push eax
call ebx
lea edi, [eax - 3]
mov eax, dword [esp + 0x10]
cmp edi, dword [eax + 0xc]
jae 0x401a43
mov edx, dword [eax + 0x14]
lea ecx, [edi + edi*4]
lea eax, [edx + ecx*4]
mov dword [esp + 0x14], eax
test eax, eax
je 0x401a4b
cmp byte [eax + 4], 0xc
jne 0x401a4b
mov edi, dword [esp + 0x30]
cmp edi, 0x1b
je 0x401a8f
cmp edi, 0x41
je 0x401a72
test byte [eax + 5], 0x80
je 0x401a4f
mov ecx, dword [eax]
push 0x490074
push 1
push 0xc2
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x40145b
cmp edi, 0x25
je 0x4018ae
cmp edi, 0x27
je 0x4018ae
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov edx, 0x8000
test dx, ax
je 0x4018aa
mov edi, dword [esp + 0x30]
cmp edi, 9
jne 0x4019e1
cmp byte [esi + 4], 0xc
jne 0x4019e1
mov eax, dword [esi]
push 0xfffffffffffffff0
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
test al, 4
jne 0x4018aa
mov edi, dword [esp + 0x30]
test ebx, ebx
jne 0x401a08
mov bl, byte [esi + 6]
mov ecx, dword [esp + 0x10]
call fcn.0045b600
mov ebx, eax
test ebx, ebx
jne 0x401a08
xor bl, bl
call fcn.0045b600
mov ebx, eax
test ebx, ebx
je 0x4018ae
cmp edi, 0x22
je 0x401a28
cmp edi, 9
jne 0x401a24
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x401a28
xor al, al
jmp 0x401a2d
mov eax, 1
mov edx, dword [esp + 0x10]
push 1
push 1
push eax
push edx
mov eax, ebx
call fcn.0045b870
jmp 0x40145b
mov dword [esp + 0x14], 0
mov edi, dword [esp + 0x30]
mov eax, dword [0x4a2b68]
test eax, eax
je 0x401ab7
cmp edi, 0xd
jne 0x401a9d
push 0
push 0
push 0x1116
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x40145b
test byte [eax + 5], 2
jne 0x401a4f
mov edx, dword [eax]
push 0xffffffffffffffff
push 0
push 0xb1
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x40145b
mov eax, dword [esp + 0x10]
call fcn.004582e0
jmp 0x40145b
cmp edi, 0x1b
jne 0x401ab7
push 0
push 1
push 0x1116
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x40145b
xor esi, esi
mov edi, 0x4a11b8
mov edi, edi
mov eax, dword [edi]
test eax, eax
je 0x401b0e
cmp dword [eax], 0
je 0x401b05
mov eax, dword [0x49d3c8]
mov byte [eax + 0xc0], 1
mov ecx, dword [esp + 0x2c]
mov dword [eax + 0xbc], ecx
mov eax, dword [edi]
mov ecx, dword [eax]
lea edx, [esp + 0x28]
push edx
push ecx
call dword [sym.imp.USER32.dll_IsDialogMessageA]
test eax, eax
jne 0x40218a
mov edx, dword [0x49d3c8]
mov byte [edx + 0xc0], al
inc esi
cmp dword [0x4a2b64], esi
je 0x401b19
add edi, 4
cmp edi, 0x4a1344
jl 0x401ac0
mov esi, dword [esp + 0x2c]
cmp esi, 0x312
ja 0x401c84
je case.0x401c9a.1026
cmp esi, 0x100
ja 0x401b9f
je 0x401b70
cmp esi, 0x12
je 0x401b5b
cmp esi, 0x4b
jne case.0x401c9a.1027
mov dword [0x4a0b70], 0
mov byte [esp + 0x1a], 1
jmp 0x40145b
push 0
push 0
push 6
mov ecx, 0x4a2c18
call fcn.00414960
jmp 0x40145b
mov ecx, dword [esp + 0x28]
cmp ecx, dword [0x4a0a3c]
jne case.0x401c9a.1027
cmp dword [esp + 0x30], 0x1b
jne case.0x401c9a.1027
mov edx, dword [0x4a0a38]
push 0
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x40145b
cmp esi, 0x113
jne case.0x401c9a.1027
cmp dword [esp + 0x34], 0
jne case.0x401c9a.1027
mov eax, dword [0x4a0a38]
cmp dword [esp + 0x28], eax
jne case.0x401c9a.1027
cmp dword [0x4a24a0], 0
je 0x401bd3
call fcn.00402b90
cmp dword [0x4a30b0], 0
je 0x401bea
call fcn.00402a20
test al, al
je 0x401bea
mov byte [esp + 0x18], 1
cmp dword [ebp + 0xc], 0
je 0x40145b
cmp dword [ebp + 8], 1
jl 0x40145b
mov ecx, dword [esp + 0x58]
mov edx, dword [esp + 0x6c]
mov esi, dword [ebp + 8]
push ecx
push edx
call fcn.004029e0
add esp, 8
test eax, eax
je 0x40145b
cmp byte [esp + 0x1b], 0
je 0x401c29
mov byte [0x4a0b80], 0
cmp byte [esp + 0x19], 0
je 0x401c79
dec dword [0x4a0b90]
cmp dword [ebp + 8], 0
jle 0x401c79
cmp dword [0x4a0b90], 0
jne 0x401c79
cmp dword [0x4a30b0], 0
jne 0x401c79
cmp dword [0x4a24a0], 0
jne 0x401c79
cmp byte [0x4a0b7a], 0
je 0x401c79
mov eax, dword [0x4a0a38]
push 9
push eax
call dword [sym.imp.USER32.dll_KillTimer]
test eax, eax
je 0x401c79
mov byte [0x4a0b7a], 0
mov al, byte [esp + 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esi - 0x400]
cmp eax, 0x15
ja case.0x401c9a.1027
movzx eax, byte [eax + 0x402908]
jmp dword [eax*4 + 0x4028fc]
mov eax, dword [esp + 0x28]
test eax, eax
je case.0x401c9a.1026
cmp eax, dword [0x4a0a38]
jne case.0x401c9a.1027
xor ebx, ebx
lea eax, [esi - 0x401]
mov dword [esp + 0x68], ebx
cmp eax, 0x14
ja case.0x401cd1.1027
movzx ecx, byte [eax + 0x402934]
jmp dword [ecx*4 + 0x402920]
mov edi, dword [esp + 0x28]
call fcn.004012d0
mov dword [esp + 0x10], eax
cmp eax, ebx
je case.0x401c9a.1027
mov ecx, dword [esp + 0x30]
mov edx, dword [eax + 8]
movzx edi, cx
mov dword [esp + 0x78], edx
mov edx, dword [esp + 0x34]
shr ecx, 0x10
mov dword [esp + 0x24], edx
mov dword [esp + 0x48], edi
mov dword [esp + 0x70], ecx
cmp edi, 8
jne 0x401d27
mov dword [esp + 0x70], 0x2af8
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x70]
mov dword [esp + 0x74], edx
cmp ecx, dword [eax + 0xc]
jae 0x401d3b
mov edx, dword [eax + 0x14]
lea ecx, [ecx + ecx*4]
lea ecx, [edx + ecx*4]
mov dword [esp + 0x14], ecx
jmp 0x401d3f
mov dword [esp + 0x14], ebx
lea ecx, [edi - 5]
mov dword [esp + 0x60], ebx
mov byte [esp + 0x22], bl
cmp ecx, 4
ja case.default.0x401d53
jmp dword [ecx*4 + 0x40294c]
mov eax, dword [eax + 0x24]
mov dword [esp + 0x44], eax
cmp eax, ebx
je 0x40145b
mov edx, dword [esp + 0x10]
mov ecx, dword [eax + 4]
mov al, byte [ecx]
mov ebx, dword [esp + 0x1c]
add edx, 0x32
mov dword [esp + 0x60], edx
jmp 0x402034
mov eax, dword [eax + 0x1c]
mov dword [esp + 0x44], eax
cmp eax, ebx
je 0x40145b
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x1c]
add eax, 0x30
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x44]
mov ecx, dword [eax + 4]
mov al, byte [ecx]
jmp 0x402034
mov eax, dword [eax + 0x20]
mov dword [esp + 0x44], eax
cmp eax, ebx
je 0x40145b
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0x1c]
add ecx, 0x31
mov dword [esp + 0x60], ecx
mov ecx, dword [eax + 4]
mov al, byte [ecx]
jmp 0x402034
mov eax, dword [eax + 0x2c]
mov dword [esp + 0x44], eax
cmp eax, ebx
je 0x40145b
mov ecx, dword [eax + 4]
mov al, byte [ecx]
mov ebx, dword [esp + 0x1c]
jmp 0x402034
mov esi, dword [eax + 0x6c]
mov eax, dword [eax + 0x28]
mov dword [esp + 0x68], esi
mov dword [esp + 0x44], eax
cmp eax, ebx
je 0x401e22
cmp esi, ebx
je 0x40145b
xor ebx, ebx
push ebx
push ebx
push 0xffffffffffffffff
push esi
call dword [sym.imp.SHELL32.dll_DragQueryFileA]
mov dword [esp + 0x24], eax
cmp eax, ebx
jne 0x401e93
cmp esi, ebx
je 0x40145b
push esi
call dword [sym.imp.SHELL32.dll_DragFinish]
mov edx, dword [esp + 0x10]
mov dword [edx + 0x6c], 0
jmp 0x40145b
cmp dword [esp + 0x14], ebx
je 0x40145b
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0xc]
mov dword [esp + 0x44], ecx
test ecx, ecx
jne 0x401e72
test byte [eax + 5], 1
je 0x40145b
mov eax, dword [esp + 0x10]
call fcn.00458280
jmp 0x40145b
test byte [eax + 5], 4
jne 0x40145b
mov eax, dword [esp + 0x44]
mov ecx, dword [eax + 4]
mov al, byte [ecx]
mov ebx, dword [esp + 0x1c]
mov byte [esp + 0x22], 1
jmp 0x402034
mov eax, dword [esp + 0x44]
mov ecx, dword [eax + 4]
mov esi, dword [esp + 0x2c]
mov al, byte [ecx]
mov ebx, dword [esp + 0x1c]
jmp 0x402034
mov edx, dword [esp + 0x34]
mov eax, 0x4a2c18
call fcn.00401310
mov dword [esp + 0x64], eax
cmp eax, ebx
je 0x40145b
mov edx, eax
mov eax, dword [edx + 0xc]
test eax, eax
je 0x40145b
mov eax, dword [eax + 4]
mov al, byte [eax]
mov ebx, dword [esp + 0x1c]
jmp 0x402034
mov eax, dword [esp + 0x30]
cmp eax, dword [0x4a24a8]
jae 0x40145b
mov ecx, dword [0x4a24a4]
mov edi, dword [ecx + eax*4]
mov dl, byte [edi + 0x24]
mov dword [esp + 0x4c], edi
test dl, dl
je 0x401f8c
mov eax, dword [edi]
test eax, eax
je 0x401f10
mov eax, dword [eax]
jmp 0x401f15
mov eax, 0x49588a
mov ecx, dword [edi + 0xc]
push eax
mov eax, dword [edi + 0x1c]
push eax
mov eax, dword [edi + 0x10]
mov bl, dl
call fcn.00408dd0
add esp, 8
mov dword [esp + 0x50], eax
test eax, eax
je 0x40145b
mov ecx, edi
mov al, byte [ecx + 0x24]
cmp al, 1
je 0x401f4b
cmp al, 3
je 0x401f4b
mov dword [esp + 0x50], 0
mov edi, ecx
mov edx, dword [esp + 0x34]
push edx
call 0x40bb00
mov eax, dword [edi + 8]
cmp byte [eax], 0
jne 0x40145b
mov eax, dword [esp + 0x4c]
mov cl, byte [eax + 0x2e]
mov esi, dword [esp + 0x2c]
mov ebx, dword [esp + 0x1c]
neg cl
sbb cl, cl
and cl, byte [esp + 0x34]
mov byte [0x4a30c8], cl
mov edx, dword [eax]
mov eax, dword [edx + 4]
mov al, byte [eax]
jmp 0x402034
mov dword [esp + 0x50], ebx
jmp 0x401f4d
mov ecx, dword [0x4a3098]
mov ebx, dword [esp + 0x1c]
jmp 0x40202f
mov ecx, dword [esp + 0x30]
mov edx, dword [0x49e4e0]
mov eax, ecx
and eax, 0x3fff
cmp ax, word [edx]
jae 0x40145b
mov edx, dword [eax*4 + 0x4a14f0]
mov eax, ecx
shr eax, 0x10
mov dword [esp + 0x5c], edx
test ax, ax
je 0x401ffa
mov ecx, edx
mov ebx, dword [ecx + 0x20]
add eax, 0xffff
mov dword [esp + 0x1c], ebx
test ax, ax
je 0x401ff6
mov edx, dword [ebx + 0x14]
add eax, 0xffff
mov dword [esp + 0x1c], edx
mov ebx, edx
test ax, ax
jne 0x401fe3
test ebx, ebx
jne 0x40201a
mov eax, dword [esp + 0x5c]
push eax
lea eax, [esp + 0x54]
call fcn.00409700
mov dword [esp + 0x1c], eax
test eax, eax
je 0x40145b
mov esi, dword [esp + 0x2c]
mov ebx, eax
mov al, byte [ebx + 0x1e]
cmp al, 1
je 0x40202d
cmp al, 3
je 0x40202d
mov dword [esp + 0x50], 0
mov ecx, dword [ebx]
mov edx, dword [ecx + 4]
mov al, byte [edx]
mov ecx, dword [0x4a0b94]
mov edx, dword [0x49d334]
mov byte [esp + 0x54], al
cmp ecx, edx
jl 0x402081
add edx, 2
cmp ecx, edx
jge 0x40206f
cmp al, 0xd8
je 0x402081
cmp al, 0xc4
je 0x402081
cmp al, 0xd2
je 0x402081
cmp al, 0xd3
je 0x402081
cmp al, 0xce
je 0x402081
cmp al, 0xcf
je 0x402081
cmp al, 0xd0
je 0x402081
cmp al, 0xd1
je 0x402081
mov eax, dword [esp + 0x68]
test eax, eax
je 0x40145b
push eax
jmp 0x402228
lea eax, [esi - 0x401]
cmp eax, 0x14
ja case.0x402097.1027
movzx ecx, byte [eax + 0x402974]
jmp dword [ecx*4 + 0x402960]
mov eax, dword [esp + 0x60]
test eax, eax
je 0x4020b3
cmp byte [eax], 0
jne 0x40145b
mov ebx, dword [esp + 0x1c]
xor edi, edi
jmp 0x40220d
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x64]
mov edi, dword [edx + 0x18]
cmp eax, 0x63
jae 0x40219b
mov eax, dword [eax*4 + 0x4a11b8]
mov dword [esp + 0x10], eax
test eax, eax
jne 0x40220d
mov eax, dword [esp + 0x28]
test eax, eax
je 0x40220d
cmp eax, dword [0x4a0a38]
je 0x40220d
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov edi, eax
test edi, edi
je 0x40280e
push 0
push edi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [0x4a2bbc]
jne 0x40280e
push 0x20
lea edx, [esp + 0xa4]
push edx
push edi
call dword [sym.imp.USER32.dll_GetClassNameA]
lea eax, [esp + 0xa0]
push str.32770
push eax
call fcn.00476dcc
add esp, 8
test eax, eax
jne 0x40280e
mov eax, dword [0x49d3c8]
lea edx, [esp + 0x28]
mov byte [eax + 0xc0], 1
mov ecx, dword [esp + 0x2c]
push edx
push edi
mov dword [eax + 0xbc], ecx
call dword [sym.imp.USER32.dll_IsDialogMessageA]
test eax, eax
je 0x402801
cmp dword [0x4a0bbc], 0
je 0x40218a
push 0x4a13a8
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov eax, dword [0x49d3c8]
mov byte [eax + 0xc0], 0
jmp 0x40145b
mov dword [esp + 0x10], 0
jmp 0x40220d
mov eax, dword [esp + 0x4c]
mov edi, dword [eax + 0x14]
jmp 0x40220d
cmp byte [0x4a3094], 0
jne 0x40145b
mov ebx, dword [esp + 0x1c]
xor edi, edi
jmp 0x40220d
mov cl, byte [ebx + 0x1f]
cmp cl, byte [ebx + 0x20]
jb 0x40220a
mov edx, dword [ebx]
mov eax, dword [edx + 4]
mov al, byte [eax]
cmp al, 0xd8
je 0x40220a
cmp al, 0xc4
je 0x40220a
cmp al, 0xd2
je 0x40220a
cmp al, 0xd3
je 0x40220a
cmp al, 0xce
je 0x40220a
cmp al, 0xcf
je 0x40220a
cmp al, 0xd0
je 0x40220a
cmp al, 0xd1
je 0x40220a
cmp byte [ebx + 0x22], 0
je 0x4021fc
mov byte [ebx + 0x23], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebx + 4], eax
jmp 0x40145b
mov edi, dword [ebx + 0x18]
mov ecx, dword [0x49d3c8]
cmp edi, dword [ecx + 0x2c]
jge 0x40223e
cmp dword [esp + 0x68], 0
je 0x40145b
mov edx, dword [esp + 0x68]
push edx
call dword [sym.imp.SHELL32.dll_DragFinish]
mov eax, dword [esp + 0x10]
mov dword [eax + 0x6c], 0
jmp 0x40145b
mov byte [esp + 0x18], 1
cmp esi, 0x402
je 0x4022b4
cmp esi, 0x413
jbe 0x40225f
cmp esi, 0x415
jbe 0x4022f3
mov ecx, dword [0x4a3088]
mov edx, dword [0x4a30c0]
mov dword [0x4a308c], ecx
mov dword [0x4a30c4], edx
cmp esi, 0x401
jne 0x40229a
mov eax, dword [esp + 0x4c]
mov ecx, dword [eax]
mov edx, dword [ecx]
mov dword [0x4a3088], edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4a30c0], eax
jmp 0x4022f3
mov eax, dword [esp + 0x5c]
mov ecx, dword [eax + 4]
mov dword [0x4a3088], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4a30c0], eax
jmp 0x4022f3
mov esi, dword [esp + 0x64]
mov edx, dword [esi]
push 0x104
push edx
push 0x4a2e7c
call fcn.0047a8e0
mov byte [0x4a2f80], 0
mov eax, dword [esi + 0x14]
mov ecx, dword [eax]
add esp, 0xc
push 0x104
push ecx
push 0x4a2f81
call fcn.0047a8e0
add esp, 0xc
mov byte [0x4a3085], 0
mov ecx, dword [0x4a13a4]
mov esi, 1
push esi
call fcn.00401230
push 0x7f
push eax
lea edx, [esp + 0xc8]
push edx
call fcn.0047a8e0
mov eax, dword [esp + 0x60]
add esp, 0xc
push eax
push 0
push edi
mov al, 1
mov byte [esp + 0x14b], 0
call fcn.00402fb0
mov edi, dword [0x49d3c8]
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4a3104], eax
mov dword [0x4a3100], eax
mov eax, dword [esp + 0x2c]
add eax, 0xfffffbff
cmp eax, 0x14
ja case.0x402360.1027
movzx ecx, byte [eax + 0x4029a0]
jmp dword [ecx*4 + 0x40298c]
mov ecx, dword [esp + 0x48]
lea eax, [ecx - 5]
mov byte [esp + 0x7c], 0
cmp eax, 4
ja case.default.0x40237c
jmp dword [eax*4 + 0x4029b8]
xor edx, edx
cmp dword [esp + 0x24], edx
lea ebx, [edi + 0x3c]
sete dl
cmp dword [esp + 0x14], 0
mov dword [esp + 0x24], 0
lea edx, [edx + edx + 1]
mov dword [edi + 0x34], edx
mov eax, dword [esp + 0x3c]
mov dword [ebx], eax
mov ecx, dword [esp + 0x40]
mov dword [ebx + 4], ecx
je 0x402472
cmp edx, esi
jne 0x4023c9
mov esi, dword [esp + 0x14]
push ebx
call fcn.0045b9d0
mov esi, 1
mov edx, dword [esp + 0x14]
movzx eax, byte [edx + 4]
sub eax, 9
je 0x402456
sub eax, esi
je 0x402445
sub eax, esi
jne 0x402472
cmp dword [edi + 0x34], esi
jne 0x402400
push eax
push 9
mov eax, edx
mov ecx, dword [eax]
push 0x110a
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x40246e
mov edx, dword [esp + 0x3c]
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x40]
lea ecx, [esp + 0x8c]
mov dword [esp + 0x8c], edx
mov edx, dword [esi]
push ecx
push edx
mov dword [esp + 0x98], eax
call dword [sym.imp.USER32.dll_ScreenToClient]
mov ecx, dword [esi]
lea eax, [esp + 0x8c]
push eax
push 0
push 0x1111
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x40246e
mov edx, dword [esp + 0x14]
mov eax, dword [edx]
push esi
push 0xffffffffffffffff
push 0x100c
push eax
jmp 0x402466
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
push 0
push 0
push 0x19f
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
add eax, esi
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov esi, ebx
call fcn.00465290
mov ecx, dword [esp + 0x48]
jmp 0x4025ce
mov eax, dword [esp + 0x10]
mov dword [edi + 0x34], ecx
mov ecx, dword [esp + 0x3c]
lea esi, [edi + 0x3c]
mov dword [esi], ecx
mov edx, dword [esp + 0x40]
mov dword [esi + 4], edx
mov ecx, dword [eax]
call fcn.00465290
mov esi, dword [esp + 0x10]
mov ecx, dword [esi]
push 0xffffffffffffffec
push ecx
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov edx, dword [esi]
and eax, 0xffffffef
push eax
push 0xffffffffffffffec
push edx
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov ecx, dword [esp + 0x48]
jmp 0x4025ce
mov dword [edi + 0x34], esi
cmp ecx, 8
jne 0x4025d7
mov eax, dword [esp + 0x74]
mov dword [edi + 0x3c], eax
mov ecx, dword [esp + 0x24]
mov eax, dword [0x4a13a4]
push 0x18
push 0
push ecx
call fcn.004010d0
mov eax, dword [esp + 0x10]
mov edx, dword [eax]
mov esi, dword [esp + 0x70]
mov dword [edi + 0xa0], edx
mov ecx, dword [eax + 8]
mov dword [edi + 0x44], ecx
mov edx, dword [eax + 8]
mov eax, dword [esp + 0x24]
mov dword [edi + 0x38], eax
mov eax, dword [esp + 0x60]
mov dword [edi + 0x4c], edx
mov dword [edi + 0x48], esi
xor edi, edi
cmp eax, edi
je 0x4025fe
mov byte [eax], 1
jmp 0x40260d
mov edx, dword [esp + 0x14]
mov al, byte [edx + 4]
cmp al, 0xa
je 0x40255f
cmp al, 0x15
jne 0x4025cb
mov eax, dword [esp + 0x3c]
mov edx, dword [esp + 0x10]
lea esi, [edi + 0x3c]
mov dword [esi], eax
mov ecx, dword [esp + 0x40]
mov dword [esi + 4], ecx
mov ecx, dword [edx]
call fcn.00465290
jmp 0x4025c7
cmp cl, 0x49
jne 0x4025cb
lea eax, [esp + 0x7c]
test ecx, 0x100
je 0x402577
mov byte [esp + 0x7c], 0x53
jmp 0x402584
test ecx, 0x200
je 0x402588
mov byte [esp + 0x7c], 0x73
lea eax, [esp + 0x7d]
test ecx, 0x400
je 0x402595
mov byte [eax], 0x46
jmp 0x4025a0
test ecx, 0x800
je 0x4025a2
mov byte [eax], 0x66
add eax, esi
test ecx, 0x1000
je 0x4025af
mov byte [eax], 0x43
jmp 0x4025ba
test ecx, 0x2000
je 0x4025bc
mov byte [eax], 0x63
add eax, esi
mov byte [eax], 0
mov dword [esp + 0x48], 0x49
mov ecx, dword [esp + 0x48]
mov dword [edi + 0x34], ecx
cmp ecx, 8
je 0x4024e0
cmp ecx, 5
je 0x4024e0
mov ecx, dword [0x4a13a4]
push 1
push 0
push 0xffffffffffffffff
lea eax, [esp + 0x88]
push eax
call fcn.004668b0
jmp 0x4024f3
cmp byte [esp + 0x22], 0
je 0x40260d
mov eax, dword [esp + 0x14]
or byte [eax + 5], 4
mov ecx, dword [esp + 0x44]
call fcn.00401290
mov ecx, dword [esp + 0x78]
mov eax, dword [ecx*4 + 0x4a11b8]
mov dword [esp + 0x10], eax
cmp eax, edi
je case.0x402651.9
cmp esi, dword [eax + 0xc]
jae 0x402641
mov eax, dword [eax + 0x14]
lea edx, [esi + esi*4]
lea ecx, [eax + edx*4]
mov dword [esp + 0x14], ecx
jmp 0x402645
mov dword [esp + 0x14], edi
mov eax, dword [esp + 0x48]
add eax, 0xfffffffb
cmp eax, 4
ja case.default.0x402651
jmp dword [eax*4 + 0x4029cc]
mov edx, dword [esp + 0x10]
mov byte [edx + 0x32], 0
jmp case.0x402651.9
mov eax, dword [esp + 0x10]
mov byte [eax + 0x30], 0
jmp case.0x402651.9
mov ecx, dword [esp + 0x10]
mov byte [ecx + 0x31], 0
jmp case.0x402651.9
mov esi, dword [esp + 0x10]
mov eax, dword [esi + 0x6c]
cmp eax, edi
je 0x402694
push eax
call dword [sym.imp.SHELL32.dll_DragFinish]
mov dword [esi + 0x6c], edi
mov edx, dword [esi]
push 0xffffffffffffffec
push edx
call dword [sym.imp.USER32.dll_GetWindowLongA]
or eax, 0x10
push eax
mov eax, dword [esi]
push 0xffffffffffffffec
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
jmp case.0x402651.9
cmp dword [esp + 0x14], edi
je case.0x402651.9
mov eax, dword [esp + 0x14]
and byte [eax + 5], 0xfb
jmp case.0x402651.9
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4026e6
mov ecx, dword [eax]
mov dword [edi + 0xa0], ecx
mov dword [edi + 0x34], esi
mov eax, dword [eax + 8]
mov dword [edi + 0x4c], eax
mov dword [edi + 0x44], eax
mov edx, dword [esp + 0x64]
mov ecx, dword [edx + 0xc]
call fcn.00401290
jmp case.0x402651.9
mov eax, dword [esp + 0x50]
mov esi, dword [esp + 0x4c]
mov dword [edi + 0xa0], eax
call fcn.0040ba70
jmp case.0x402651.9
call dword [sym.imp.USER32.dll_CountClipboardFormats]
test eax, eax
je 0x40273d
mov esi, dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
push 1
call esi
test eax, eax
jne 0x402736
push 0xf
call esi
test eax, eax
jne 0x402736
mov eax, 2
jmp 0x40273f
mov eax, 1
jmp 0x40273f
xor eax, eax
push 0x18
push 0
mov dword [edi + 0x38], eax
push eax
mov eax, dword [0x4a13a4]
call fcn.004010d0
mov ecx, dword [0x4a3098]
mov byte [0x4a3094], 1
call fcn.00401290
mov byte [0x4a3094], 0
jmp case.0x402651.9
mov ecx, dword [esp + 0x5c]
mov al, byte [ecx + 0x12]
cmp al, 0x9c
jb 0x402782
cmp al, 0x9f
ja 0x402782
mov edx, dword [esp + 0x34]
mov dword [edi + 0x38], edx
mov ecx, dword [esp + 0x5c]
mov eax, dword [esp + 0x50]
push ecx
mov dword [edi + 0xa0], eax
call fcn.004099f0
mov ecx, dword [0x4a13a4]
dec dword [0x4a0b94]
sub dword [0x49d3c8], 0xd8
push 1
push 0
push 0xffffffffffffffff
lea edx, [esp + 0xcc]
push edx
call fcn.004668b0
push 0
mov eax, 0x4a2c18
call fcn.00414620
cmp dword [ebp + 0xc], 0
je 0x40145b
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x6c]
mov esi, dword [ebp + 8]
push eax
push ecx
call fcn.004029e0
add esp, 8
test eax, eax
je 0x40145b
mov byte [esp + 0x1a], 1
mov byte [esp + 0x58], 1
jmp 0x40145b
mov ecx, dword [0x49d3c8]
mov byte [ecx + 0xc0], 0
mov eax, dword [0x4a0a4c]
test eax, eax
je 0x402831
lea edx, [esp + 0x28]
push edx
push eax
mov eax, dword [0x4a0a38]
push eax
call dword [sym.imp.USER32.dll_TranslateAcceleratorA]
test eax, eax
jne 0x40145b
mov eax, dword [0x49d3c8]
mov byte [eax + 0xc0], 1
mov ecx, dword [esp + 0x2c]
lea edx, [esp + 0x28]
push edx
mov dword [eax + 0xbc], ecx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
mov ecx, dword [0x49d3c8]
mov byte [ecx + 0xc0], 0
jmp 0x40145b
cmp esi, 0xffffffff
jle 0x40288d
mov dword [0x4a30f0], 0
mov dword [0x4a30f4], 0
mov dword [0x4a3100], eax
cmp byte [esp + 0x1b], 0
mov dword [0x4a3104], eax
je 0x4028a0
mov byte [0x4a0b80], 0
cmp byte [esp + 0x19], 0
je 0x401c79
dec dword [0x4a0b90]
test esi, esi
jle 0x401c79
cmp dword [0x4a0b90], 0
jne 0x401c79
cmp dword [0x4a30b0], 0
jne 0x401c79
cmp dword [0x4a24a0], 0
jne 0x401c79
cmp byte [0x4a0b7a], 0
je 0x401c79
mov edx, dword [0x4a0a38]
push 9
push edx
jmp 0x401c68