Function at 0x407ecc
Capabilities:
Check for time delay via gettickcount

Disassembly:
push 0x178
mov eax, 0x45282c
call fcn.00435d41
mov ebx, ecx
mov dword [ebp - 0x15c], ebx
cmp dword [ebx], 0
mov edi, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x170], edi
mov dword [ebp - 0x16c], eax
je 0x4093e8
lea eax, [ebx + 0x1ec]
push 0
mov ecx, eax
mov dword [ebp - 0x168], eax
call fcn.0040b5c0
mov esi, eax
test esi, esi
je 0x407fb6
lea eax, [ebx + 0x1a4]
mov ebx, eax
mov ecx, dword [ebp - 0x168]
push 0
call fcn.0040b882
mov ecx, dword [esi + 0x108]
test ecx, ecx
je 0x407f57
add ecx, 0x38
call fcn.0040ed5b
test al, al
je 0x407f57
mov ecx, dword [esi + 0x108]
push esi
add ecx, 0x38
call fcn.0040ed71
mov ecx, ebx
xor edi, edi
call fcn.0042f4af
test eax, eax
jle 0x407f7f
push edi
mov ecx, ebx
call fcn.0040b255
push esi
mov ecx, eax
mov edx, dword [eax]
call dword [edx]
mov ecx, ebx
inc edi
call fcn.0042f4af
cmp edi, eax
jl 0x407f64
mov ecx, esi
call fcn.00407273
push pe_nt_image_headers32
push esi
call fcn.00435720
pop ecx
pop ecx
mov ecx, dword [ebp - 0x168]
push 0
call fcn.0040b5c0
mov esi, eax
test esi, esi
jne 0x407f25
mov ebx, dword [ebp - 0x15c]
mov edi, dword [ebp - 0x170]
and dword [ebp - 0x158], 0
lea ecx, [ebx + 0x1c8]
call fcn.0042f4af
mov esi, dword [ebp + 8]
test eax, eax
jle 0x408022
mov ecx, dword [ebp - 0x158]
push ecx
lea ecx, [ebx + 0x1c8]
mov byte [ebp - 0x161], 0
call fcn.0040b255
lea ecx, [ebp - 0x161]
push ecx
push edi
push dword [ebp + 0xc]
mov edx, dword [eax]
mov ecx, eax
push esi
call dword [edx]
cmp byte [ebp - 0x161], 0
jne 0x408145
inc dword [ebp - 0x158]
lea ecx, [ebx + 0x1c8]
call fcn.0042f4af
mov ecx, dword [ebp - 0x158]
cmp ecx, eax
jl 0x407fd5
mov eax, 0x112
cmp esi, eax
ja 0x408aed
je 0x408acd
cmp esi, 0x24
ja 0x4088b8
je 0x40887b
sub esi, 5
je 0x40882a
dec esi
sub esi, 1
je 0x4087cd
sub esi, 8
je 0x40821d
sub esi, 1
je 0x40818d
sub esi, 4
je 0x40817d
sub esi, 4
je 0x408154
sub esi, 8
jne 0x40934a
xor eax, eax
inc eax
cmp di, ax
jne 0x40934a
cmp byte [ebx + 0x1a2], 0
jne 0x4093ea
and dword [ebp - 0x160], esi
lea eax, [ebp - 0x160]
and dword [ebp - 0x15c], esi
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x160]
push eax
push dword [ebx]
call dword [sym.imp.USER32.dll_ScreenToClient]
push dword [ebp - 0x15c]
mov ecx, ebx
push dword [ebp - 0x160]
call fcn.004077f7
mov esi, eax
test esi, esi
je 0x40934a
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x14]
test al, 2
je 0x40934a
xor eax, eax
lea edi, [ebp - 0x2c]
push 7
pop ecx
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x30], 0x18
mov dword [ebp - 0x20], eax
call fcn.00407e80
mov word [ebp - 0x1a], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 0x30]
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 0x100]
jmp 0x40814d
mov ecx, dword [ebp - 0x16c]
mov dword [ecx], eax
mov al, 1
jmp 0x4093ea
xor eax, eax
inc eax
cmp dword [ebp + 0xc], eax
jne 0x40934a
cmp byte [ebx + 0x1a0], 0
je 0x40934a
push eax
push 0
push dword [ebx]
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x40934a
mov ecx, dword [ebp - 0x16c]
xor eax, eax
inc eax
mov dword [ecx], eax
jmp 0x4093ea
and dword [ebp - 0x30], 0
lea edi, [ebp - 0x2c]
push 7
xor eax, eax
pop ecx
rep stosd dword es:[edi], eax
mov eax, dword [ebx + 0x150]
mov dword [ebp - 0x24], eax
mov eax, dword [ebx + 0x154]
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebx + 0x144]
mov dword [ebp - 0x28], eax
test ecx, ecx
je 0x4081d6
mov dword [ebp - 0x30], 0xa
lea edx, [ebp - 0x30]
mov dword [ebp - 0x2c], ecx
mov eax, dword [ecx]
push edx
call dword [eax + 0x100]
mov ecx, dword [ebx + 0x148]
test ecx, ecx
je 0x4081f6
mov dword [ebp - 0x30], 0xe
lea edx, [ebp - 0x30]
mov dword [ebp - 0x2c], ecx
mov eax, dword [ecx]
push edx
call dword [eax + 0x100]
push 0
mov ecx, ebx
call fcn.00409e1c
push 4
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindow]
test eax, eax
je 0x40934a
push eax
call dword [sym.imp.USER32.dll_SetFocus]
jmp 0x40934a
push 0
lea eax, [ebp - 0x50]
xorps xmm0, xmm0
push eax
push dword [ebx]
movups xmmword [ebp - 0x50], xmm0
call dword [sym.imp.USER32.dll_GetUpdateRect]
test eax, eax
je 0x40814d
xor eax, eax
push 0x40
push eax
cmp dword [ebx + 0x13c], eax
jne 0x408279
lea eax, [ebp - 0x154]
push eax
call fcn.00438850
add esp, 0xc
lea eax, [ebp - 0x154]
push eax
push dword [ebx]
call dword [sym.imp.USER32.dll_BeginPaint]
lea eax, [ebp - 0x154]
push eax
push dword [ebx]
call dword [sym.imp.USER32.dll_EndPaint]
jmp 0x40814d
lea eax, [ebp - 0x114]
push eax
call fcn.00438850
add esp, 0xc
lea eax, [ebp - 0x114]
push eax
push dword [ebx]
call dword [sym.imp.USER32.dll_BeginPaint]
xor eax, eax
inc eax
cmp byte [ebx + 0x19d], 0
je 0x4083a4
lea eax, [ebp - 0x20]
mov byte [ebx + 0x19d], 0
push eax
push dword [ebx]
xorps xmm0, xmm0
movups xmmword [ebp - 0x20], xmm0
call dword [sym.imp.USER32.dll_GetClientRect]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
jne 0x4083a1
mov ecx, dword [ebx + 0x13c]
call fcn.0040f7af
test al, al
je 0x408332
push dword [ebx]
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
jne 0x408307
mov ecx, dword [ebx + 0x13c]
lea esi, [ebp - 0x20]
push 1
sub esp, 0x10
mov edi, esp
mov eax, dword [ecx]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [eax + 0x34]
cmp dword [ebx + 0xc], 0
je 0x408316
push dword [ebx + 0xc]
call dword [sym.imp.GDI32.dll_DeleteDC]
cmp dword [ebx + 0x10], 0
je 0x408325
push dword [ebx + 0x10]
call dword [sym.imp.GDI32.dll_DeleteObject]
xor eax, eax
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x10], eax
mov dword [ebx + 0x14], eax
jmp 0x40837d
mov ecx, dword [ebx + 0x13c]
push 0x80000001
push 0
push 0x40a72e
mov eax, dword [ecx]
call dword [eax + 0xf4]
mov dword [ebp - 0x168], eax
test eax, eax
je 0x40837b
mov ebx, dword [eax]
mov ecx, eax
call dword [ebx + 0x30]
mov ecx, dword [ebp - 0x168]
mov esi, eax
push 1
sub esp, 0x10
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [ebx + 0x34]
mov ebx, dword [ebp - 0x15c]
jmp 0x408332
xor eax, eax
cmp byte [ebx + 0x19c], 0
je 0x4083a1
push eax
push eax
push eax
push str.windowinit
push dword [ebx + 0x13c]
mov ecx, ebx
mov byte [ebx + 0x19c], al
call fcn.00409b74
xor eax, eax
inc eax
cmp byte [ebx + 0x19e], 0
je 0x4083b5
push eax
mov ecx, ebx
call fcn.0040a061
cmp byte [ebx + 0x1a0], 0
je 0x408612
push 0xffffffffffffffec
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ecx, 0x80000
test ecx, eax
jne 0x4083e2
or eax, ecx
push eax
push 0xffffffffffffffec
push dword [ebx]
call dword [sym.imp.USER32.dll_SetWindowLongW]
lea eax, [ebp - 0x40]
xorps xmm0, xmm0
push eax
push dword [ebx]
movups xmmword [ebp - 0x40], xmm0
call dword [sym.imp.USER32.dll_GetClientRect]
cmp byte [ebx + 0x28], 0
jne 0x408419
lea esi, [ebx + 0x18]
push esi
lea eax, [ebp - 0x50]
push eax
push eax
call dword [sym.imp.USER32.dll_UnionRect]
push 0x10
push 0
push esi
call fcn.00438850
add esp, 0xc
jmp 0x408427
lea esi, [ebp - 0x40]
mov byte [ebx + 0x28], 0
lea edi, [ebp - 0x50]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x38]
mov esi, dword [ebp - 0x34]
sub edi, dword [ebp - 0x40]
sub esi, dword [ebp - 0x3c]
cmp byte [ebx + 0x19f], 0
mov dword [ebp - 0x168], edi
je 0x4084d1
cmp dword [ebx + 0x10], 0
jne 0x4084d1
push dword [ebx + 8]
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push 0x2c
mov dword [ebx + 0xc], eax
lea eax, [ebp - 0x140]
push 0
push eax
call fcn.00438850
add esp, 0xc
mov dword [ebp - 0x140], 0x28
mov eax, esi
mov dword [ebp - 0x13c], edi
neg eax
imul esi, edi
mov dword [ebp - 0x138], eax
xor ecx, ecx
xor eax, eax
mov dword [ebp - 0x130], ecx
push 0x20
inc eax
mov dword [ebp - 0x120], ecx
mov word [ebp - 0x134], ax
pop eax
push ecx
push ecx
mov word [ebp - 0x132], ax
lea eax, [ebx + 0x14]
push eax
push ecx
lea eax, [ebp - 0x140]
shl esi, 2
push eax
push dword [ebx + 8]
mov dword [ebp - 0x12c], esi
call dword [sym.imp.GDI32.dll_CreateDIBSection]
mov dword [ebx + 0x10], eax
push dword [ebx + 0x10]
push dword [ebx + 0xc]
call dword [sym.imp.GDI32.dll_SelectObject]
push dword [ebx + 0xc]
mov dword [ebp - 0x16c], eax
call dword [sym.imp.GDI32.dll_SaveDC]
mov dword [ebp - 0x15c], eax
lea eax, [ebp - 0x50]
push eax
push edi
push dword [ebx + 0x14]
call fcn.00411165
mov ecx, dword [ebx + 0x13c]
lea eax, [ebp - 0x50]
add esp, 0xc
mov edx, dword [ecx]
push eax
push dword [ebx + 0xc]
call dword [edx + 0x110]
lea eax, [ebp - 0x50]
mov ecx, ebx
push eax
push dword [ebx + 0xc]
call fcn.0040771d
lea ecx, [ebx + 0x1d4]
xor esi, esi
call fcn.0042f4af
test eax, eax
jle 0x40856a
lea edi, [ebx + 0x1d4]
push esi
mov ecx, edi
call fcn.0040b255
lea ecx, [ebp - 0x10c]
push ecx
push dword [ebx + 0xc]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x128]
mov ecx, edi
inc esi
call fcn.0042f4af
cmp esi, eax
jl 0x40853c
mov edi, dword [ebp - 0x168]
lea eax, [ebp - 0x50]
push eax
push edi
push dword [ebx + 0x14]
call fcn.004165a7
add esp, 0xc
push dword [ebp - 0x15c]
push dword [ebx + 0xc]
call dword [sym.imp.GDI32.dll_RestoreDC]
lea eax, [ebp - 0x20]
xorps xmm0, xmm0
push eax
push dword [ebx]
movups xmmword [ebp - 0x20], xmm0
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
sub eax, ecx
mov dword [ebp - 0x17c], eax
mov eax, dword [ebp - 0x14]
sub eax, edx
mov dword [ebp - 0x184], ecx
push 2
mov dword [ebp - 0x178], eax
xor ecx, ecx
lea eax, [ebp - 0x158]
mov dword [ebp - 0x180], edx
push eax
push ecx
lea eax, [ebp - 0x174]
mov dword [ebp - 0x174], ecx
push eax
push dword [ebx + 0xc]
lea eax, [ebp - 0x17c]
mov dword [ebp - 0x170], ecx
push eax
lea eax, [ebp - 0x184]
mov dword [ebp - 0x158], 0x1ff0000
push eax
push ecx
push dword [ebx]
call dword [sym.imp.USER32.dll_UpdateLayeredWindow]
push dword [ebp - 0x16c]
jmp 0x40874b
cmp byte [ebx + 0x19f], 0
je 0x408756
cmp dword [ebx + 0x10], 0
jne 0x40865e
lea eax, [ebp - 0x20]
xorps xmm0, xmm0
push eax
push dword [ebx]
movups xmmword [ebp - 0x20], xmm0
call dword [sym.imp.USER32.dll_GetClientRect]
push dword [ebx + 8]
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [ebx + 0xc], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x20]
push eax
push dword [ebx + 8]
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [ebx + 0x10], eax
cmp byte [ebx + 0x19f], 0
je 0x408756
push dword [ebx + 0x10]
push dword [ebx + 0xc]
call dword [sym.imp.GDI32.dll_SelectObject]
push dword [ebx + 0xc]
mov dword [ebp - 0x15c], eax
call dword [sym.imp.GDI32.dll_SaveDC]
mov ecx, dword [ebx + 0x13c]
mov dword [ebp - 0x168], eax
lea eax, [ebp - 0x10c]
push eax
push dword [ebx + 0xc]
mov edx, dword [ecx]
call dword [edx + 0x110]
lea eax, [ebp - 0x10c]
mov ecx, ebx
push eax
push dword [ebx + 0xc]
call fcn.0040771d
lea edi, [ebx + 0x1d4]
xor esi, esi
mov ecx, edi
call fcn.0042f4af
test eax, eax
jle 0x4086f0
push esi
mov ecx, edi
call fcn.0040b255
lea ecx, [ebp - 0x10c]
push ecx
push dword [ebx + 0xc]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x128]
mov ecx, edi
inc esi
call fcn.0042f4af
cmp esi, eax
jl 0x4086c8
push dword [ebp - 0x168]
push dword [ebx + 0xc]
call dword [sym.imp.GDI32.dll_RestoreDC]
mov eax, dword [ebp - 0x100]
sub eax, dword [ebp - 0x108]
push 0xcc0020
push dword [ebp - 0x108]
push dword [ebp - 0x10c]
push dword [ebx + 0xc]
push eax
mov eax, dword [ebp - 0x104]
sub eax, dword [ebp - 0x10c]
push eax
push dword [ebp - 0x108]
push dword [ebp - 0x10c]
push dword [ebp - 0x114]
call dword [sym.imp.GDI32.dll_BitBlt]
push dword [ebp - 0x15c]
push dword [ebx + 0xc]
call dword [sym.imp.GDI32.dll_SelectObject]
jmp 0x4087a0
push dword [ebp - 0x114]
call dword [sym.imp.GDI32.dll_SaveDC]
mov ecx, dword [ebx + 0x13c]
mov esi, eax
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 0x114]
mov edx, dword [ecx]
call dword [edx + 0x110]
lea eax, [ebp - 0x10c]
mov ecx, ebx
push eax
push dword [ebp - 0x114]
call fcn.0040771d
push esi
push dword [ebp - 0x114]
call dword [sym.imp.GDI32.dll_RestoreDC]
lea eax, [ebp - 0x114]
push eax
push dword [ebx]
call dword [sym.imp.USER32.dll_EndPaint]
cmp byte [ebx + 0x19d], 0
je 0x40814d
push 0
push 0
push dword [ebx]
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x40814d
mov edx, dword [ebx + 0x140]
test edx, edx
je 0x40934a
push 7
xor eax, eax
lea edi, [ebp - 0x130]
pop ecx
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0x134], 0x16
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x130], edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebx + 0x140]
lea edx, [ebp - 0x134]
mov dword [ebp - 0x12c], eax
jmp 0x408e99
mov edx, dword [ebx + 0x140]
test edx, edx
je 0x408863
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x2c]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x30], 0x17
mov dword [ebp - 0x2c], edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebx + 0x140]
lea edx, [ebp - 0x30]
mov dword [ebp - 0x28], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x100]
mov ecx, dword [ebx + 0x13c]
test ecx, ecx
je 0x40814d
call fcn.0040f80b
jmp 0x40814d
mov eax, dword [ebx + 0x158]
test eax, eax
jle 0x408888
mov dword [edi + 0x18], eax
mov eax, dword [ebx + 0x15c]
test eax, eax
jle 0x408895
mov dword [edi + 0x1c], eax
mov eax, dword [ebx + 0x160]
test eax, eax
jle 0x4088a2
mov dword [edi + 0x20], eax
mov eax, dword [ebx + 0x164]
test eax, eax
jle 0x40934a
mov dword [edi + 0x24], eax
jmp 0x40934a
sub esi, 0x4e
je 0x408aaf
sub esi, 0x2d
je 0x408a24
sub esi, 0x85
je 0x4089b8
sub esi, 1
je 0x408951
sub esi, 1
je 0x408900
sub esi, 0xf
jne 0x40934a
test edi, edi
je 0x40934a
push edi
push dword [ebp + 0xc]
push 0x2111
push edi
jmp 0x408ac2
cmp dword [ebx + 0x140], 0
je 0x40934a
xor eax, eax
lea edi, [ebp - 0x2c]
push 7
pop ecx
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
mov word [ebp - 0x1c], ax
mov eax, dword [ebx + 0x150]
mov dword [ebp - 0x24], eax
mov eax, dword [ebx + 0x154]
mov dword [ebp - 0x30], 5
mov dword [ebp - 0x20], eax
call fcn.00407e80
mov word [ebp - 0x1a], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebx + 0x140]
jmp 0x408e93
cmp dword [ebx + 0x14c], 0
je 0x40934a
xor eax, eax
lea edi, [ebp - 0x2c]
push 7
pop ecx
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
mov word [ebp - 0x1c], ax
mov eax, dword [ebx + 0x150]
mov dword [ebp - 0x24], eax
mov eax, dword [ebx + 0x154]
mov dword [ebp - 0x30], 4
mov dword [ebp - 0x20], eax
call fcn.00407e80
mov word [ebp - 0x1a], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebx + 0x14c]
lea edx, [ebp - 0x30]
mov dword [ebp - 0x28], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x100]
and dword [ebx + 0x14c], 0
jmp 0x40934a
cmp dword [ebx + 0x140], 0
je 0x40934a
xor eax, eax
lea edi, [ebp - 0x2c]
push 7
pop ecx
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
mov word [ebp - 0x1c], ax
mov eax, dword [ebx + 0x150]
mov dword [ebp - 0x24], eax
mov eax, dword [ebx + 0x154]
mov dword [ebp - 0x30], 3
mov dword [ebp - 0x20], eax
call fcn.00407e80
mov word [ebp - 0x1a], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebx + 0x140]
lea edx, [ebp - 0x30]
mov dword [ebp - 0x28], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x100]
mov eax, dword [ebx + 0x140]
mov dword [ebx + 0x14c], eax
jmp 0x40934a
movsx eax, di
mov dword [ebp - 0x160], eax
shr edi, 0x10
movsx eax, di
mov dword [ebp - 0x15c], eax
lea eax, [ebp - 0x160]
push eax
push dword [ebx]
call dword [sym.imp.USER32.dll_ScreenToClient]
cmp dword [ebx + 0x148], 0
mov eax, dword [ebp - 0x160]
mov dword [ebx + 0x150], eax
mov eax, dword [ebp - 0x15c]
mov dword [ebx + 0x154], eax
je 0x40934a
mov ecx, ebx
call fcn.004096c8
xor eax, eax
lea edi, [ebp - 0x2c]
push 7
pop ecx
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x160]
mov ecx, dword [ebx + 0x148]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], 0x12
mov dword [ebp - 0x2c], ecx
mov word [ebp - 0x1a], ax
mov dword [ebp - 0x14], ecx
jmp 0x408b9b
test edi, edi
je 0x40814d
push edi
push dword [ebp + 0xc]
push 0x204e
push dword [edi]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x408145
mov ecx, dword [ebp + 0xc]
xor eax, eax
and ecx, 0xfff0
inc eax
cmp ecx, 0xf120
jne 0x4093ea
mov byte [ebx + 0x28], al
jmp 0x4093ea
mov eax, 0x203
cmp esi, eax
ja 0x408f28
je 0x408ea7
mov eax, esi
sub eax, 0x113
je 0x408def
sub eax, 0x20
je 0x408dd7
sub eax, 5
je 0x408dd7
sub eax, 0xc8
je 0x408c6b
sub eax, 1
je 0x408bc2
sub eax, 1
jne 0x40934a
mov ecx, ebx
call fcn.004096c8
mov eax, edi
movsx edx, di
shr eax, 0x10
movsx esi, ax
mov eax, dword [ebx + 0x148]
mov dword [ebx + 0x150], edx
mov dword [ebx + 0x154], esi
test eax, eax
je 0x40934a
push 7
xor eax, eax
lea edi, [ebp - 0x2c]
pop ecx
rep stosd dword es:[edi], eax
mov eax, dword [ebx + 0x148]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0x30], 0xe
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], esi
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x18], ecx
mov word [ebp - 0x1a], cx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebx + 0x148]
lea edx, [ebp - 0x30]
mov dword [ebp - 0x28], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x100]
and dword [ebx + 0x148], 0
jmp 0x40934a
push dword [ebx]
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, ebx
call fcn.00409c0c
mov eax, edi
movsx ecx, di
shr eax, 0x10
cwde
push eax
mov dword [ebp - 0x15c], ecx
mov dword [ebx + 0x150], ecx
push ecx
mov ecx, ebx
mov dword [ebp - 0x158], eax
mov dword [ebx + 0x154], eax
call fcn.004077f7
mov esi, eax
test esi, esi
je 0x40934a
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x1c]
cmp eax, ebx
jne 0x40934a
mov dword [ebx + 0x148], esi
mov ecx, esi
mov eax, dword [esi]
call dword [eax + 0xe8]
xor eax, eax
lea edi, [ebp - 0x2c]
push 7
pop ecx
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x170]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x30], 0xd
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x20], eax
mov word [ebp - 0x1a], cx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x28], eax
jmp 0x408dca
cmp byte [ebx + 0x1a1], 0
jne 0x408cc8
xor eax, eax
lea edi, [ebp - 0x3c]
cmp dword [ebx + 0x2c], 0
stosd dword es:[edi], eax
push 3
pop ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebx]
mov dword [ebp - 0x40], 0x10
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], eax
jne 0x408c9d
mov dword [ebp - 0x34], 0x190
jmp 0x408cb1
push 0
push ecx
push 0x415
push dword [ebx + 0x2c]
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.COMCTL32.dll__TrackMouseEvent]
mov edi, dword [ebp - 0x170]
mov byte [ebx + 0x1a1], 1
movsx eax, di
shr edi, 0x10
movsx ecx, di
push ecx
mov dword [ebp - 0x158], ecx
mov dword [ebx + 0x154], ecx
mov ecx, ebx
push eax
mov dword [ebp - 0x15c], eax
mov dword [ebx + 0x150], eax
call fcn.004077f7
mov esi, eax
test esi, esi
je 0x408d07
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x1c]
cmp eax, ebx
jne 0x40934a
and dword [ebp - 0x30], 0
lea edi, [ebp - 0x2c]
push 7
xor eax, eax
pop ecx
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebx + 0x144]
mov dword [ebp - 0x28], eax
cmp esi, ecx
je 0x408d75
test ecx, ecx
je 0x408d75
mov dword [ebp - 0x30], 0xa
lea edx, [ebp - 0x30]
mov dword [ebp - 0x2c], ecx
mov eax, dword [ecx]
push edx
call dword [eax + 0x100]
and dword [ebx + 0x144], 0
cmp dword [ebx + 0x2c], 0
je 0x408d75
lea eax, [ebx + 0x30]
push eax
push 0
push 0x411
push dword [ebx + 0x2c]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp esi, dword [ebx + 0x144]
je 0x408d9f
test esi, esi
je 0x408d9f
mov dword [ebp - 0x30], 0xb
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x2c], esi
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 0x100]
mov dword [ebx + 0x144], esi
mov ecx, dword [ebx + 0x148]
test ecx, ecx
je 0x408db8
mov dword [ebp - 0x30], 9
mov dword [ebp - 0x2c], ecx
jmp 0x408e96
test esi, esi
je 0x40934a
mov dword [ebp - 0x30], 9
mov dword [ebp - 0x2c], esi
mov eax, dword [esi]
lea ecx, [ebp - 0x30]
push ecx
mov ecx, esi
jmp 0x408e9c
test edi, edi
je 0x40934a
push edi
push dword [ebp + 0xc]
lea eax, [esi + 0x2000]
push eax
jmp 0x4088fa
mov esi, dword [ebp + 0xc]
mov eax, 0xf1
cmp ax, si
jne 0x408e16
lea eax, [ebx + 0x60]
mov ecx, ebx
push eax
call fcn.00407d40
cmp byte [ebx + 0x70], 0
sete al
mov byte [ebx + 0x70], al
jmp 0x40934a
lea ecx, [ebx + 0x1b0]
xor edi, edi
call fcn.0042f4af
test eax, eax
jle 0x40934a
push edi
lea ecx, [ebx + 0x1b0]
call fcn.0040b255
mov edx, eax
mov dword [ebp - 0x15c], edx
mov ecx, dword [edx + 8]
cmp ecx, dword [ebx]
jne 0x408e54
movzx ecx, si
cmp dword [edx + 0xc], ecx
jne 0x408e54
cmp byte [edx + 0x10], 0
je 0x408e69
lea ecx, [ebx + 0x1b0]
inc edi
call fcn.0042f4af
cmp edi, eax
jl 0x408e2b
jmp 0x40934a
push 7
xor eax, eax
lea edi, [ebp - 0x2c]
pop ecx
rep stosd dword es:[edi], eax
mov eax, dword [edx]
mov dword [ebp - 0x2c], eax
mov eax, dword [edx + 4]
mov dword [ebp - 0x30], 0x19
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 0x15c]
mov ecx, dword [ecx]
mov dword [ebp - 0x28], eax
lea edx, [ebp - 0x30]
mov eax, dword [ecx]
push edx
call dword [eax + 0x100]
jmp 0x40934a
push dword [ebx]
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, ebx
call fcn.00409c0c
movsx eax, di
shr edi, 0x10
movsx ecx, di
push ecx
mov dword [ebp - 0x158], ecx
mov dword [ebx + 0x154], ecx
mov ecx, ebx
push eax
mov dword [ebp - 0x15c], eax
mov dword [ebx + 0x150], eax
call fcn.004077f7
mov esi, eax
test esi, esi
je 0x40934a
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x1c]
cmp eax, ebx
jne 0x40934a
xor eax, eax
lea edi, [ebp - 0x2c]
push 7
pop ecx
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], 0x11
mov word [ebp - 0x1a], ax
jmp 0x40932a
sub esi, 0x204
je 0x4092a0
sub esi, 1
je 0x409237
sub esi, 5
je 0x409168
sub esi, 0x97
je 0x408fe7
dec esi
sub esi, 1
je 0x408fa9
sub esi, 0x7d5e
jne 0x40934a
lea esi, [ebx + 0x1e0]
xor edi, edi
mov ecx, esi
call fcn.0042f4af
test eax, eax
jle 0x408f9d
push edi
mov ecx, esi
call fcn.0040b255
test eax, eax
je 0x408f8b
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
mov ecx, esi
inc edi
call fcn.0042f4af
cmp edi, eax
jl 0x408f77
mov ebx, dword [ebp - 0x15c]
mov ecx, esi
call fcn.0040b44c
jmp 0x40934a
cmp dword [ebx + 0x2c], 0
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
je 0x408fc5
lea eax, [ebx + 0x30]
push eax
push 0
push 0x411
push dword [ebx + 0x2c]
call esi
cmp byte [ebx + 0x1a1], 0
je 0x408fdb
push 0xffffffffffffffff
push 0
push 0x200
push dword [ebx]
call esi
mov byte [ebx + 0x1a1], 0
jmp 0x40934a
movsx eax, di
shr edi, 0x10
movsx ecx, di
push ecx
mov dword [ebp - 0x158], ecx
mov ecx, ebx
push eax
mov byte [ebx + 0x1a1], 0
mov dword [ebp - 0x15c], eax
call fcn.004077f7
mov esi, eax
mov dword [ebp - 0x16c], esi
test esi, esi
je 0x40934a
mov edx, dword [ebx + 0x144]
test edx, edx
je 0x409067
push 7
xor eax, eax
lea edi, [ebp - 0x2c]
pop ecx
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0xc
mov dword [ebp - 0x2c], edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebx + 0x144]
lea edx, [ebp - 0x30]
mov dword [ebp - 0x28], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x100]
mov eax, dword [esi]
lea ecx, [ebp - 0xd4]
push ecx
mov ecx, esi
call dword [eax + 0x90]
and dword [ebp - 4], 0
lea ecx, [ebp - 0xd4]
call fcn.0040b784
test al, al
je 0x40909b
lea ecx, [ebp - 0xd4]
call fcn.0040b17f
jmp 0x40814d
push 0x30
lea edi, [ebx + 0x30]
push 0
push edi
call fcn.00438850
mov eax, dword [ebx]
lea ecx, [ebp - 0xd4]
add esp, 0xc
mov dword [edi], 0x30
mov dword [ebx + 0x34], 1
mov dword [ebx + 0x38], eax
mov dword [ebx + 0x3c], eax
mov eax, dword [0x46e6d8]
mov dword [ebx + 0x50], eax
call fcn.0040b264
mov dword [ebx + 0x54], eax
mov ecx, esi
mov eax, dword [esi]
call dword [eax + 0x30]
mov esi, eax
lea edi, [ebx + 0x40]
xor ecx, ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [ebx + 0x2c], ecx
jne 0x40912b
push ecx
push dword [0x46e6d8]
mov eax, 0x80000000
push ecx
push dword [ebx]
push eax
push eax
push eax
push eax
push 0x80000003
push ecx
push str.tooltips_class32
push ecx
call dword [sym.imp.USER32.dll_CreateWindowExW]
lea edi, [ebx + 0x30]
mov dword [ebx + 0x2c], eax
push edi
push 0
push 0x432
push eax
call esi
jmp 0x40912e
lea edi, [ebx + 0x30]
mov ecx, dword [ebp - 0x16c]
mov eax, dword [ecx]
call dword [eax + 0x9c]
push eax
push 0
push 0x418
push dword [ebx + 0x2c]
call esi
push edi
push 0
push 0x436
push dword [ebx + 0x2c]
call esi
push edi
push 1
push 0x411
push dword [ebx + 0x2c]
call esi
jmp 0x40908b
movsx eax, di
mov dword [ebp - 0x160], eax
mov eax, edi
shr eax, 0x10
cwde
mov dword [ebp - 0x15c], eax
lea eax, [ebp - 0x160]
push eax
push dword [ebx]
call dword [sym.imp.USER32.dll_ScreenToClient]
mov eax, dword [ebp - 0x15c]
mov ecx, dword [ebp - 0x160]
push eax
mov dword [ebx + 0x150], ecx
push ecx
mov ecx, ebx
mov dword [ebx + 0x154], eax
call fcn.004077f7
mov esi, eax
test esi, esi
je 0x40934a
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x1c]
cmp eax, ebx
jne 0x40934a
xor eax, eax
lea edi, [ebp - 0x2c]
push 7
pop ecx
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
shr eax, 0x10
shr eax, 0xf
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0x30], 0x13
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x14], eax
call fcn.00407e80
mov word [ebp - 0x1a], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 0x30]
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 0x100]
movzx ecx, word [ebx + 0x154]
movzx eax, word [ebx + 0x150]
shl ecx, 0x10
or ecx, eax
push ecx
push 0
push 0x200
push dword [ebx]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x40934a
mov ecx, ebx
call fcn.004096c8
mov eax, edi
movsx esi, di
shr eax, 0x10
mov ecx, ebx
cwde
push eax
push esi
mov dword [ebp - 0x15c], eax
mov dword [ebx + 0x150], esi
mov dword [ebx + 0x154], eax
call fcn.004077f7
mov edx, eax
mov dword [ebx + 0x148], edx
test edx, edx
je 0x40934a
push 7
xor eax, eax
lea edi, [ebp - 0x2c]
pop ecx
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x30], 0x10
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], eax
jmp 0x408b91
push dword [ebx]
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, edi
movsx ecx, di
shr eax, 0x10
cwde
push eax
mov dword [ebp - 0x15c], ecx
mov dword [ebx + 0x150], ecx
push ecx
mov ecx, ebx
mov dword [ebp - 0x158], eax
mov dword [ebx + 0x154], eax
call fcn.004077f7
mov esi, eax
test esi, esi
je 0x40934a
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x1c]
cmp eax, ebx
jne 0x40934a
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xe8]
mov ecx, ebx
call fcn.00409c0c
xor eax, eax
lea edi, [ebp - 0x2c]
push 7
pop ecx
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x170]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x30], 0xf
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x20], eax
mov word [ebp - 0x1a], cx
mov dword [ebp - 0x2c], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 0x30]
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 0x100]
mov dword [ebx + 0x148], esi
lea edi, [ebx + 0x1ec]
push 0
mov ecx, edi
call fcn.0040b5c0
mov esi, eax
test esi, esi
je 0x4093e8
add ebx, 0x1a4
push 0
mov ecx, edi
call fcn.0040b882
mov ecx, dword [esi + 0x108]
test ecx, ecx
je 0x409397
add ecx, 0x38
call fcn.0040ed5b
test al, al
je 0x409397
mov ecx, dword [esi + 0x108]
push esi
add ecx, 0x38
call fcn.0040ed71
mov ecx, ebx
xor edi, edi
call fcn.0042f4af
test eax, eax
jle 0x4093bf
push edi
mov ecx, ebx
call fcn.0040b255
push esi
mov ecx, eax
mov edx, dword [eax]
call dword [edx]
mov ecx, ebx
inc edi
call fcn.0042f4af
cmp edi, eax
jl 0x4093a4
mov ecx, esi
call fcn.00407273
push pe_nt_image_headers32
push esi
call fcn.00435720
mov edi, dword [ebp - 0x168]
pop ecx
pop ecx
push 0
mov ecx, edi
call fcn.0040b5c0
mov esi, eax
test esi, esi
jne 0x409369
xor al, al
call fcn.00435cfc
ret 0x10