Function at 0x43f510
Capabilities:
Check for unmoving mouse cursor
Log keystrokes via polling

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4d7089
push eax
mov dword fs:[0], esp
sub esp, 0x140
push ebx
mov ebx, dword [esp + 0x158]
push ebp
push esi
mov esi, dword [esp + 0x168]
push edi
mov edi, dword [esp + 0x168]
cmp ebx, 0x15
mov ebp, ecx
ja 0x43f754
cmp ebx, 0x15
je 0x43f73b
lea eax, [ebx - 1]
cmp eax, 0xf
ja case.0x43fe76.517
xor ecx, ecx
mov cl, byte [eax + 0x4403c4]
jmp dword [ecx*4 + 0x4403a4]
push 0x730
call fcn.004c7e90
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
mov dword [esp + 0x158], 0
je 0x43f5af
mov edx, dword [esp + 0x160]
mov ecx, dword [ebp + 4]
push edx
push ecx
push ebp
mov ecx, eax
call fcn.004375c0
mov dword [ebp + 8], eax
jmp case.0x43f77c.28
xor eax, eax
mov dword [ebp + 8], eax
jmp case.0x43f77c.28
mov ecx, dword [ebp + 8]
push 0
push 0
call fcn.0045d120
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x43f5d2
mov edx, dword [ecx]
push 1
call dword [edx]
mov dword [ebp + 8], 0
jmp case.0x43f77c.28
mov eax, dword [ebp]
mov ecx, ebp
call dword [eax + 0x18]
jmp case.0x43f77c.28
cmp word [esp + 0x168], 0
je 0x43f617
mov ecx, ebp
call fcn.004418c0
test eax, eax
je 0x43f617
mov eax, dword [0x4fb95c]
test eax, eax
je 0x43f617
push 0
call dword [sym.imp.user32.dll_SetCursor]
jmp case.0x43f77c.28
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
push eax
call dword [sym.imp.user32.dll_SetCursor]
jmp case.0x43f77c.28
xor eax, eax
mov dword [ebp + 0x7c], eax
mov dword [ebp + 0x78], eax
mov dword [ebp + 0x84], eax
mov dword [ebp + 0x80], eax
jmp case.0x43f77c.28
mov eax, dword [ebp + 0xac]
test eax, eax
je 0x43f678
mov al, byte [0x4fb8ec]
test al, al
je 0x43f678
mov ecx, dword [esp + 0x160]
mov edx, dword [0x4ee264]
push ecx
push 0x4efe5c
push edx
call fcn.004425a0
add esp, 0xc
mov dword [ebp + 0xac], 0
mov eax, 1
jmp 0x440386
mov edi, dword [esp + 0x168]
mov ecx, ebp
cmp edi, 1
jne 0x43f6a4
call fcn.0043b510
jmp case.0x43f77c.28
call fcn.0043b730
mov eax, dword [ebp + 0xa8]
xor esi, esi
cmp eax, esi
je 0x43f704
mov al, byte [0x4fb8ec]
test al, al
je 0x43f6da
mov eax, dword [esp + 0x160]
mov ecx, dword [0x4ee264]
push eax
push 0x4efe5c
push ecx
call fcn.004425a0
add esp, 0xc
cmp dword [ebp + 0xb0], esi
jne 0x43f6fe
mov eax, dword [0x4fb8dc]
mov ecx, dword [0x4fb8e0]
cmp eax, esi
jne 0x43f6f5
cmp ecx, esi
je 0x43f6fe
push ecx
push eax
mov ecx, ebp
call fcn.00438d70
mov dword [ebp + 0xa8], esi
cmp edi, esi
jne case.0x43f77c.28
mov ecx, ebp
call fcn.004418c0
test eax, eax
je case.0x43f77c.28
cmp dword [ebp + 0x1bc], esi
je case.0x43f77c.28
push 1
mov ecx, ebp
mov dword [ebp + 0x1bc], esi
call fcn.00438fa0
jmp case.0x43f77c.28
mov edx, dword [esp + 0x160]
push esi
push edi
push 0x15
push edx
call fcn.00442510
add esp, 0x10
jmp 0x440343
cmp ebx, 0x11f
ja 0x43fe4d
je 0x43fd49
lea eax, [ebx - 0x1c]
cmp eax, 0xfb
ja case.0x43fe76.517
xor ecx, ecx
mov cl, byte [eax + 0x440408]
jmp dword [ecx*4 + 0x4403d4]
mov edx, dword [esp + 0x16c]
mov ecx, ebp
push edx
call fcn.00442020
jmp 0x440386
mov eax, dword [esp + 0x168]
cmp eax, 0x64
jne 0x43f7af
mov ecx, ebp
call fcn.0043b5a0
jmp case.0x43f77c.28
cmp eax, 0x65
jne case.0x43f77c.28
mov esi, dword [esp + 0x160]
push eax
push esi
mov dword [ebp + 0x94], 0
call dword [sym.imp.user32.dll_KillTimer]
mov eax, dword [ebp + 0x44]
test eax, eax
jne case.0x43f77c.28
mov eax, dword [ebp]
mov ecx, ebp
call dword [eax + 0xc]
mov eax, dword [0x4fb8e4]
test eax, eax
je 0x43f800
mov ecx, ebp
call fcn.00438970
push esi
call dword [sym.imp.user32.dll_SetFocus]
jmp case.0x43f77c.28
mov ecx, dword [0x4ee264]
push 0xa
push esi
push 0x4efe5c
push ecx
call fcn.00442620
add esp, 0x10
push esi
call dword [sym.imp.user32.dll_SetFocus]
jmp case.0x43f77c.28
mov edx, dword [ebp]
mov ecx, ebp
call dword [edx + 0x2c]
mov esi, dword [esp + 0x160]
push esi
call dword [sym.imp.user32.dll_IsWindowVisible]
test eax, eax
je 0x43f85e
push esi
call dword [sym.imp.user32.dll_IsIconic]
test eax, eax
jne 0x43f85e
mov ecx, ebp
call fcn.004418c0
test eax, eax
je 0x43f85e
push 1
mov ecx, ebp
call fcn.00438fa0
jmp 0x43f868
mov dword [ebp + 0x1bc], 1
mov ebp, dword [ebp + 0x58]
test ebp, ebp
je 0x440343
mov ecx, ebp
call fcn.00454c10
jmp 0x440343
mov eax, dword [ebp + 0x98]
test eax, eax
jne 0x43f8ad
mov eax, dword [ebp + 0x9c]
test eax, eax
jne 0x43f8ad
mov eax, dword [esp + 0x16c]
mov dword [eax + 0x18], 0x14f
mov dword [eax + 0x1c], 0x64
jmp case.0x43f77c.28
mov eax, dword [esp + 0x16c]
mov dword [eax + 0x18], 0x1cc
mov dword [eax + 0x1c], 0x96
jmp case.0x43f77c.28
cmp edi, 0xc8
jne 0x43f925
mov edi, dword [0x4fb8d4]
xor eax, eax
test edi, edi
mov edx, dword [esp + 0x160]
push 3
sete al
xor ecx, ecx
push 0
test eax, eax
setne cl
push 0
push 0
add ecx, 0xfffffffe
push 0
push ecx
push edx
mov dword [0x4fb8d4], eax
call dword [sym.imp.user32.dll_SetWindowPos]
mov eax, dword [0x4fb8d4]
mov ecx, dword [ebp + 0x20]
neg eax
sbb eax, eax
and eax, 8
push eax
push 0xc8
push ecx
call dword [sym.imp.user32.dll_CheckMenuItem]
jmp case.0x43f77c.28
mov esi, edi
and esi, 0xfff0
cmp esi, 0xf120
jne 0x43f956
mov edx, dword [esp + 0x160]
push edx
call dword [sym.imp.user32.dll_IsIconic]
test eax, eax
jne 0x43f956
mov dword [ebp + 0xa8], 1
jmp 0x440343
cmp esi, 0xf030
jne 0x440343
mov dword [ebp + 0xa8], 1
jmp 0x440343
mov esi, dword [esp + 0x160]
push esi
call dword [sym.imp.user32.dll_IsWindowVisible]
test eax, eax
jne 0x43f9a0
mov eax, dword [esp + 0x16c]
mov ecx, dword [esp + 0x168]
push eax
push ecx
push ebx
push esi
call dword [sym.imp.user32.dll_DefWindowProcA]
jmp 0x440386
mov ecx, dword [esp + 0x168]
lea eax, [ecx - 0x10]
cmp eax, 0x58
ja case.0x43f9bb.26
xor edx, edx
mov dl, byte [eax + 0x440530]
jmp dword [edx*4 + 0x440504]
mov ecx, ebp
call fcn.00441a00
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.user32.dll_GetCursorPos]
mov ecx, dword [ebp + 8]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push edx
mov esi, dword [ecx + 0x50]
jmp 0x43fb00
mov dword [ebp + 0x78], 1
jmp case.0x43f77c.28
mov dword [ebp + 0x7c], 1
jmp case.0x43f77c.28
mov dword [ebp + 0x80], 1
jmp case.0x43f77c.28
mov dword [ebp + 0x84], 1
jmp case.0x43f77c.28
mov eax, dword [ebp + 0x9c]
xor ecx, ecx
test eax, eax
sete cl
mov dword [ebp + 0x9c], ecx
mov ecx, ebp
call fcn.0043b730
jmp case.0x43f77c.28
mov eax, dword [ebp + 0x98]
xor edx, edx
test eax, eax
sete dl
mov ecx, ebp
mov dword [ebp + 0x98], edx
call fcn.0043b730
jmp case.0x43f77c.28
mov eax, dword [ebp + 0x1c]
push eax
push esi
call dword [sym.imp.user32.dll_SetMenu]
mov ecx, ebp
call fcn.0043b730
push 0
push 0xf100
push 0x112
push esi
call dword [sym.imp.user32.dll_PostMessageA]
jmp case.0x43f77c.28
mov esi, dword [esp + 0x160]
push esi
call dword [sym.imp.user32.dll_IsWindowVisible]
test eax, eax
jne 0x43fab5
mov eax, dword [esp + 0x16c]
mov ecx, dword [esp + 0x168]
push eax
push ecx
push ebx
push esi
call dword [sym.imp.user32.dll_DefWindowProcA]
jmp 0x440386
push 0x10
call dword [sym.imp.user32.dll_GetKeyState]
mov ecx, dword [esp + 0x168]
lea eax, [ecx - 0x10]
cmp eax, 0x58
ja case.0x43f9bb.26
xor edx, edx
mov dl, byte [eax + 0x4405ac]
jmp dword [edx*4 + 0x44058c]
mov ecx, ebp
call fcn.00441a00
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.user32.dll_GetCursorPos]
mov ecx, dword [ebp + 8]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push edx
mov esi, dword [ecx + 0x50]
push eax
call dword [sym.imp.user32.dll_WindowFromPoint]
cmp eax, esi
jne case.0x43f77c.28
mov ecx, dword [ebp + 8]
call fcn.0045dfa0
jmp case.0x43f77c.28
mov dword [ebp + 0x78], 0
jmp case.0x43f77c.28
mov dword [ebp + 0x7c], 0
jmp case.0x43f77c.28
mov dword [ebp + 0x80], 0
jmp case.0x43f77c.28
mov dword [ebp + 0x84], 0
jmp case.0x43f77c.28
mov ecx, ebp
call fcn.0043b990
jmp case.0x43f77c.28
mov edx, dword [esp + 0x16c]
push edx
push ecx
push ebx
push esi
call dword [sym.imp.user32.dll_DefWindowProcA]
jmp 0x440386
mov eax, dword [esp + 0x16c]
cmp ax, 0xffff
jne case.0x43f77c.28
shr eax, 0x10
cmp eax, 0xffff
jne case.0x43f77c.28
mov esi, dword [esp + 0x160]
lea eax, [esp + 0x1c]
push eax
push esi
call dword [sym.imp.user32.dll_GetClientRect]
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x10]
cdq
sub eax, edx
push ecx
sar eax, 1
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x2c]
cdq
sub eax, edx
push esi
sar eax, 1
mov dword [esp + 0x1c], eax
call dword [sym.imp.user32.dll_ClientToScreen]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push edx
push eax
mov ecx, ebp
call fcn.0043ad10
jmp case.0x43f77c.28
mov eax, dword [esi + 8]
cmp eax, 0xfffffd3a
je 0x43fc47
cmp eax, 0xfffffd3c
je 0x43fc2a
cmp eax, 0xfffffdf8
jne 0x440343
mov eax, dword [0x4fbc60]
test eax, eax
je 0x440343
mov edx, dword [esi + 4]
mov ecx, dword [ebp + 4]
push edx
mov dword [esi + 0x60], ecx
call fcn.00404f50
add esp, 4
and eax, 0xffff
mov dword [esi + 0xc], eax
jmp case.0x43f77c.28
mov eax, dword [ebp + 0x10]
push 0
push 0
push 0x421
push eax
call dword [sym.imp.user32.dll_SendMessageA]
mov eax, 1
jmp 0x440386
cmp dword [esi + 0xc], 0x4f28
jne 0x43fc3d
mov ecx, dword [ebp + 4]
push 0x7d
push ecx
call dword [sym.imp.user32.dll_LoadMenuA]
mov esi, eax
push 0
push esi
call dword [sym.imp.user32.dll_GetSubMenu]
lea edx, [esp + 0x10]
mov edi, eax
push edx
call dword [sym.imp.user32.dll_GetCursorPos]
mov eax, dword [esp + 0x160]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push 0
push eax
push 0
push ecx
push edx
push 0
push edi
call dword [sym.imp.user32.dll_TrackPopupMenu]
push esi
call dword [sym.imp.user32.dll_DestroyMenu]
jmp case.0x43f77c.28
mov eax, dword [esp + 0x16c]
mov ecx, dword [esp + 0x168]
push eax
push ecx
mov ecx, ebp
call fcn.00440640
jmp 0x440386
mov edx, dword [ebp + 0x1c]
push edx
call dword [sym.imp.user32.dll_GetMenuItemCount]
xor edi, edi
mov dword [esp + 0x18], eax
test eax, eax
jle 0x440343
mov ebx, dword [sym.imp.user32.dll_GetMenuItemID]
mov esi, dword [sym.imp.user32.dll_EnableMenuItem]
mov eax, dword [esp + 0x168]
push edi
push eax
call ebx
cmp eax, 0x4f3b
jne 0x43fd06
push 0xf
call dword [sym.imp.user32.dll_IsClipboardFormatAvailable]
neg eax
sbb eax, eax
inc eax
push eax
push 0x4f3b
jmp 0x43fd2e
cmp eax, 0x4f70
jne 0x43fd34
mov ecx, dword [ebp + 8]
lea edx, [esp + 0x40]
push 1
push edx
call fcn.0045ccf0
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.user32.dll_SetRectEmpty]
push 1
push 0x4f70
mov ecx, dword [ebp + 0x1c]
push ecx
call esi
mov eax, dword [esp + 0x18]
inc edi
cmp edi, eax
jl 0x43fcdf
mov ebx, dword [esp + 0x164]
jmp 0x440343
mov ecx, dword [esp + 0x168]
mov eax, ecx
shr eax, 0x10
cmp ax, 0xffff
jne 0x43fd9b
mov edx, dword [ebp + 0x18]
push 0
push 0
push 0x409
push edx
call dword [sym.imp.user32.dll_SendMessageA]
mov ecx, ebp
call fcn.004418c0
test eax, eax
jne 0x43fd86
mov eax, dword [0x4fb910]
test eax, eax
jne case.0x43f77c.28
mov eax, dword [esp + 0x160]
push 0
push eax
call dword [sym.imp.user32.dll_SetMenu]
jmp case.0x43f77c.28
test al, 0x10
jne 0x43fe35
test ah, 0x20
jne 0x43fe35
test ah, 8
je 0x43fdcf
mov ecx, dword [ebp + 0x18]
push 0x4fbe40
push 0xff
push 0x401
push ecx
call dword [sym.imp.user32.dll_SendMessageA]
jmp case.0x43f77c.28
mov eax, dword [ebp + 4]
lea edx, [esp + 0x50]
push 0x100
and ecx, 0xffff
push edx
push ecx
push eax
call dword [sym.imp.user32.dll_LoadStringA]
test eax, eax
je 0x43fe1d
mov edx, dword [ebp + 0x18]
mov esi, dword [sym.imp.user32.dll_SendMessageA]
lea ecx, [esp + 0x50]
push ecx
push 0xff
push 0x401
push edx
call esi
mov eax, dword [ebp + 0x18]
push 0
push 1
push 0x409
push eax
call esi
jmp case.0x43f77c.28
mov ecx, dword [ebp + 0x18]
push 0
push 0
push 0x409
push ecx
call dword [sym.imp.user32.dll_SendMessageA]
jmp case.0x43f77c.28
mov edx, dword [ebp + 0x18]
push 0
push 0
push 0x409
push edx
call dword [sym.imp.user32.dll_SendMessageA]
jmp case.0x43f77c.28
cmp ebx, 0x216
ja 0x43ff8a
je 0x43ff70
lea eax, [ebx - 0x200]
cmp eax, 0x14
ja case.0x43fe76.517
xor ecx, ecx
mov cl, byte [eax + 0x440620]
jmp dword [ecx*4 + 0x440608]
call dword [sym.imp.user32.dll_GetFocus]
mov ecx, dword [esp + 0x160]
mov bl, byte [esp + 0x168]
cmp eax, ecx
jne 0x43fec5
mov ecx, ebp
call fcn.004418c0
test eax, eax
je 0x43fec5
mov eax, dword [0x4fb95c]
test eax, eax
je 0x43fec5
mov eax, dword [ebp + 8]
add eax, 0x6ec
push eax
call dword [sym.imp.user32.dll_IsRectEmpty]
test eax, eax
je 0x43fec5
test bl, 0x1f
jne 0x43fec5
push 0
jmp 0x43fed3
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
push eax
call dword [sym.imp.user32.dll_SetCursor]
test bl, 4
je case.0x43f77c.28
mov ecx, ebp
call fcn.00441a00
jmp case.0x43f77c.28
mov eax, 1
mov dword [ebp + 0xa4], 0
mov dword [ebp + 0xa8], eax
jmp 0x440386
mov edx, dword [ebp]
push 1
mov ecx, ebp
call dword [edx + 0x1c]
jmp case.0x43f77c.28
test byte [esp + 0x168], 1
je 0x43ff2d
mov ecx, ebp
call fcn.0043e790
jmp case.0x43f77c.28
mov eax, dword [esp + 0x16c]
lea edx, [esp + 0x10]
mov ecx, eax
push edx
shr eax, 0x10
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x164]
and ecx, 0xffff
push eax
mov dword [esp + 0x18], ecx
call dword [sym.imp.user32.dll_ClientToScreen]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push ecx
push edx
mov ecx, ebp
call fcn.0043ad10
jmp case.0x43f77c.28
mov eax, 1
mov dword [ebp + 0xa4], 0
mov dword [ebp + 0xac], eax
jmp 0x440386
cmp ebx, 0x311
ja 0x440284
je 0x4401d7
cmp ebx, 0x233
je 0x43ffb5
cmp ebx, 0x30f
je 0x4401e4
jmp case.0x43fe76.517
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp dword [eax + 0x728], ebx
jne case.0x43f77c.28
mov ecx, dword [esp + 0x168]
push ebx
push ebx
push 0xffffffffffffffff
push ecx
call dword [sym.imp.shell32.dll_DragQueryFile]
mov esi, eax
cmp esi, 0x64
mov dword [esp + 0x38], esi
jle 0x43fffa
push 0x7f02
push ebx
call dword [sym.imp.user32.dll_LoadCursorA]
push eax
call dword [sym.imp.user32.dll_SetCursor]
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x160]
push edx
call dword [sym.imp.user32.dll_BringWindowToTop]
push 0x80
mov dword [esp + 0x20], 0x4d86f4
call fcn.004c7e90
add esp, 4
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], 0x1f
mov dword [esp + 0x30], pe_nt_image_headers32
mov eax, 1
cmp esi, ebx
mov dword [esp + 0x158], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x18], ebx
jle 0x44011a
mov eax, dword [esp + 0x168]
push 0
push 0
push ebx
push eax
call dword [sym.imp.shell32.dll_DragQueryFile]
mov esi, eax
inc esi
push esi
call fcn.004c7e90
mov ecx, dword [esp + 0x16c]
add esp, 4
mov edi, eax
push esi
push edi
push ebx
push ecx
mov dword [esp + 0x4c], edi
call dword [sym.imp.shell32.dll_DragQueryFile]
test edi, edi
je 0x440109
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
lea edx, [eax + 1]
cmp ecx, edx
jne 0x4400f5
mov ecx, dword [esp + 0x30]
add ecx, eax
lea edx, [ecx*4 + 4]
push edx
call fcn.004c7e90
mov ebx, eax
mov eax, dword [esp + 0x2c]
mov esi, dword [esp + 0x24]
mov edi, ebx
lea ecx, [eax*4 + 4]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x24]
push eax
call fcn.004c7e56
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x30]
mov edi, dword [esp + 0x44]
add esp, 8
add eax, ecx
mov dword [esp + 0x20], ebx
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x28], eax
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
mov dword [edx + eax*4], edi
mov eax, dword [esp + 0x24]
inc eax
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x38]
inc ebx
cmp ebx, eax
mov dword [esp + 0x18], ebx
jl 0x440051
mov ecx, dword [esp + 0x168]
push ecx
call dword [sym.imp.shell32.dll_DragFinish]
mov edx, dword [0x4fb948]
push 0
dec edx
lea eax, [esp + 0x20]
neg edx
sbb edx, edx
mov ecx, ebp
and edx, 3
push edx
push 0
push eax
call fcn.00439aa0
test eax, eax
jne 0x44016c
mov ecx, dword [0x4ee054]
mov edx, dword [esp + 0x160]
push eax
mov eax, dword [ebp + 4]
push ecx
push 0x223
push edx
push eax
call fcn.00443680
add esp, 0x14
mov eax, dword [esp + 0x10]
test eax, eax
je 0x44017b
push eax
call dword [sym.imp.user32.dll_SetCursor]
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x158], 0xffffffff
test eax, eax
mov dword [esp + 0x1c], 0x4d86f4
je 0x4401c5
mov eax, dword [esp + 0x24]
xor esi, esi
test eax, eax
jle 0x4401c5
cmp esi, eax
jge 0x4401b1
test esi, esi
jl 0x4401b1
mov ecx, dword [esp + 0x20]
mov eax, dword [ecx + esi*4]
jmp 0x4401b3
xor eax, eax
push eax
call fcn.004c7e56
mov eax, dword [esp + 0x28]
add esp, 4
inc esi
cmp esi, eax
jl 0x4401a4
mov edx, dword [esp + 0x20]
push edx
call fcn.004c7e56
add esp, 4
jmp case.0x43f77c.28
cmp edi, dword [esp + 0x160]
je case.0x43f77c.28
mov eax, dword [ebp + 0x60]
mov ecx, dword [ebp + 0x44]
cmp eax, ecx
jge 0x440343
test eax, eax
jl 0x440343
mov ecx, dword [ebp + 0x40]
mov edi, dword [ecx + eax*4]
test edi, edi
je 0x440343
push 0xffffffffffffffff
mov ecx, edi
call fcn.00454a40
test eax, eax
je 0x440343
mov edx, dword [esp + 0x160]
push edx
call dword [sym.imp.user32.dll_GetDC]
push 0
push 0xffffffffffffffff
mov ecx, edi
mov esi, eax
call fcn.00454a40
mov ebx, dword [sym.imp.gdi32.dll_SelectPalette]
push eax
push esi
call ebx
push esi
mov edi, eax
call dword [sym.imp.gdi32.dll_RealizePalette]
test edi, edi
mov dword [esp + 0x10], eax
je 0x440255
push 0
push edi
push esi
call ebx
mov eax, dword [esp + 0x160]
push esi
push eax
call dword [sym.imp.user32.dll_ReleaseDC]
mov esi, dword [esp + 0x10]
test esi, esi
je 0x44027d
mov ecx, dword [ebp + 8]
push 1
push 0
mov edx, dword [ecx + 0x50]
push edx
call dword [sym.imp.user32.dll_InvalidateRect]
mov eax, esi
jmp 0x440386
mov eax, ebx
sub eax, 0x401
je 0x440375
dec eax
je 0x440364
mov edx, dword [0x4fbe24]
cmp ebx, edx
je 0x4402ae
cmp ebx, 0x20a
jne 0x440343
mov eax, edi
and eax, 0xffff
mov esi, eax
and eax, 4
and esi, 8
shr edi, 0x10
cmp ebx, edx
movsx ecx, di
jne 0x4402eb
mov edi, dword [sym.imp.user32.dll_GetKeyState]
push 0x11
call edi
mov si, ax
push 0x10
shr esi, 0xf
and esi, 1
call edi
mov ecx, dword [esp + 0x168]
shr eax, 0xf
and eax, 1
test esi, esi
je 0x440307
test ecx, ecx
jge 0x4402fc
mov ecx, ebp
call fcn.0043cf70
jmp 0x440343
jle 0x440343
mov ecx, ebp
call fcn.0043ce80
jmp 0x440343
test eax, eax
je 0x44032d
test ecx, ecx
jge 0x44031d
push 0x4efe
mov ecx, ebp
call fcn.0043cd80
jmp 0x440343
jle 0x440343
push 0x4eff
mov ecx, ebp
call fcn.0043cd80
jmp 0x440343
test ecx, ecx
jge 0x44033a
mov ecx, ebp
call fcn.0043cb00
jmp 0x440343
jle 0x440343
mov ecx, ebp
call fcn.0043ca80
mov eax, dword [esp + 0x16c]
mov ecx, dword [esp + 0x168]
mov edx, dword [esp + 0x160]
push eax
push ecx
push ebx
push edx
call dword [sym.imp.user32.dll_DefWindowProcA]
jmp 0x440386
mov eax, dword [esp + 0x168]
mov ecx, ebp
push eax
call fcn.00441990
jmp case.0x43f77c.28
mov ecx, dword [esp + 0x16c]
push ecx
mov ecx, ebp
call fcn.00441b20
xor eax, eax
mov ecx, dword [esp + 0x150]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14c
ret 0x10