Function at 0x40ee9d
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f9dfd
mov eax, dword fs:[0]
push eax
sub esp, 0x378
mov eax, dword [0x53e200]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xc4], ecx
mov eax, dword [ebp + 0x14]
mov byte [eax], 0
lea ecx, [ebp - 0x110]
push ecx
mov ecx, dword [ebp - 0xc4]
add ecx, 0x1ac
call fcn.00411250
jmp 0x40d1b5
push 0
lea edx, [ebp - 0x27c]
push edx
lea ecx, [ebp - 0x110]
call fcn.00411190
lea eax, [ebp - 0x2b0]
push eax
mov ecx, dword [ebp - 0xc4]
add ecx, 0x1ac
call fcn.004111e0
push eax
lea ecx, [ebp - 0x110]
call fcn.00411150
movzx ecx, al
test ecx, ecx
je 0x40d250
mov dword [ebp - 0x14c], 0
lea ecx, [ebp - 0x110]
call fcn.004111c0
mov edx, dword [eax]
mov dword [ebp - 0x140], edx
lea eax, [ebp - 0x14c]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x140]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x140]
mov eax, dword [edx]
call eax
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x14c], 0
je 0x40d24b
cmp dword [ebp + 8], 0x200
je 0x40d24b
mov ecx, dword [ebp + 0x14]
mov byte [ecx], 1
mov eax, dword [ebp - 0x1cc]
jmp 0x40f251
jmp 0x40d1a1
mov edx, dword [ebp + 8]
mov dword [ebp - 0xc8], edx
cmp dword [ebp - 0xc8], 0x10d
ja 0x40d2a8
cmp dword [ebp - 0xc8], 0x10d
je 0x40e0d5
mov eax, dword [ebp - 0xc8]
sub eax, 5
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0xfd
ja case.0x40d340.3
mov ecx, dword [ebp - 0xc8]
movzx edx, byte [ecx + 0x40f29c]
jmp dword [edx*4 + 0x40f26c]
cmp dword [ebp - 0xc8], 0x240
ja 0x40d2f9
cmp dword [ebp - 0xc8], 0x240
je 0x40e286
mov eax, dword [ebp - 0xc8]
sub eax, 0x10e
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0xfc
ja case.0x40d340.3
mov ecx, dword [ebp - 0xc8]
movzx edx, byte [ecx + 0x40f3c8]
jmp dword [edx*4 + 0x40f39c]
cmp dword [ebp - 0xc8], 0x2a1
ja 0x40d347
cmp dword [ebp - 0xc8], 0x2a1
je 0x40d697
mov eax, dword [ebp - 0xc8]
sub eax, 0x245
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 7
ja case.0x40d340.3
mov ecx, dword [ebp - 0xc8]
movzx edx, byte [ecx + 0x40f4d0]
jmp dword [edx*4 + 0x40f4c8]
cmp dword [ebp - 0xc8], 0x2a3
je 0x40d93b
cmp dword [ebp - 0xc8], 0x8001
je 0x40d368
jmp case.0x40d340.3
lea eax, [ebp - 0x114]
push eax
mov ecx, dword [ebp - 0xc4]
add ecx, 0x1d0
call fcn.00411250
jmp 0x40d396
push 0
lea ecx, [ebp - 0x25c]
push ecx
lea ecx, [ebp - 0x114]
call fcn.00411190
lea edx, [ebp - 0x2bc]
push edx
mov ecx, dword [ebp - 0xc4]
add ecx, 0x1d0
call fcn.004111e0
push eax
lea ecx, [ebp - 0x114]
call fcn.00411150
movzx eax, al
test eax, eax
je 0x40d432
lea ecx, [ebp - 0x114]
call fcn.004111c0
mov ecx, dword [eax]
mov dword [ebp - 0x1d0], ecx
mov edx, dword [ebp - 0x1d0]
mov dword [ebp - 0xfc], edx
cmp dword [ebp - 0xfc], 0
je 0x40d423
push 1
mov eax, dword [ebp - 0xfc]
mov ecx, dword [eax + 4]
mov edx, dword [ecx + 4]
mov eax, dword [ebp - 0xfc]
mov ecx, dword [eax + 4]
mov eax, dword [ecx + 4]
mov ecx, dword [ebp - 0xfc]
lea ecx, [ecx + eax + 4]
mov eax, dword [ebp - 0xfc]
mov edx, dword [eax + edx + 4]
mov eax, dword [edx]
call eax
mov dword [ebp - 0x1a0], eax
jmp 0x40d42d
mov dword [ebp - 0x1a0], 0
jmp 0x40d382
mov ecx, dword [ebp - 0xc4]
add ecx, 0x1d0
call fcn.004115a0
jmp case.0x40d340.3
mov ecx, dword [ebp - 0xc4]
cmp dword [ecx + 0xe8], 0
je 0x40d48b
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
lea ecx, [ebp - 0x304]
call fcn.0041be80
mov edx, dword [eax + 4]
push edx
mov eax, dword [eax]
push eax
push 0
push 0
push 0
push 0x10
mov ecx, dword [ebp - 0xc4]
mov ecx, dword [ecx + 0xe8]
call fcn.0042e2d0
mov edx, dword [ebp - 0xc4]
cmp dword [edx + 0xec], 0
je 0x40d4ce
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
lea ecx, [ebp - 0x2fc]
call fcn.0041be80
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
push 0
push 0
push 0
push 0x13
mov eax, dword [ebp - 0xc4]
mov ecx, dword [eax + 0xec]
call fcn.0042e2d0
mov ecx, dword [ebp - 0xc4]
cmp dword [ecx + 0xfc], 0
je 0x40d511
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
lea ecx, [ebp - 0x314]
call fcn.0041be80
mov edx, dword [eax + 4]
push edx
mov eax, dword [eax]
push eax
push 0
push 0
push 0
push 0x13
mov ecx, dword [ebp - 0xc4]
mov ecx, dword [ecx + 0xfc]
call fcn.0042e2d0
mov edx, dword [ebp - 0xc4]
cmp dword [edx + 0x108], 0
je 0x40d554
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
lea ecx, [ebp - 0x30c]
call fcn.0041be80
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
push 0
push 0
push 0
push 0x13
mov eax, dword [ebp - 0xc4]
mov ecx, dword [eax + 0x108]
call fcn.0042e2d0
push 0
mov ecx, dword [ebp - 0xc4]
call fcn.0040f6a0
push 4
mov ecx, dword [ebp - 0xc4]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.USER32.dll_GetWindow]
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 0
je 0x40d58f
mov eax, dword [ebp - 0x170]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
jmp case.0x40d340.3
mov ecx, dword [ebp + 0x14]
mov byte [ecx], 1
mov eax, 1
jmp 0x40f251
mov ecx, dword [ebp - 0xc4]
call fcn.0040fdb0
mov edx, dword [ebp + 0x14]
mov byte [edx], 1
xor eax, eax
jmp 0x40f251
mov edx, dword [ebp - 0xc4]
cmp dword [edx + 0xe0], 0
je 0x40d631
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
lea ecx, [ebp - 0x2c4]
call fcn.0041be80
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
push 0
push 0
push 0
push 0x26
mov eax, dword [ebp - 0xc4]
mov ecx, dword [eax + 0xe0]
call fcn.0042e2d0
mov ecx, dword [ebp - 0xc4]
cmp dword [ecx + 0x1c], 0
je 0x40d656
mov edx, dword [ebp - 0xc4]
mov eax, dword [edx + 0x1c]
mov ecx, dword [ebp - 0xc4]
mov edx, dword [eax]
mov ecx, dword [ecx + 0x1c]
mov eax, dword [edx + 0x24]
call eax
cmp dword [ebp + 0xc], 2
jne 0x40d671
push 1
mov ecx, dword [ebp - 0xc4]
add ecx, 0x1fc
call fcn.00433b70
jmp 0x40d68a
cmp dword [ebp + 0xc], 0
jne 0x40d68a
push 0
mov ecx, dword [ebp - 0xc4]
add ecx, 0x1fc
call fcn.00433b70
mov ecx, dword [ebp + 0x14]
mov byte [ecx], 1
xor eax, eax
jmp 0x40f251
mov edx, dword [ebp - 0xc4]
mov byte [edx + 0x116], 0
mov eax, dword [ebp + 0x10]
and eax, 0xffff
movsx ecx, ax
mov dword [ebp - 0x18c], ecx
mov edx, dword [ebp + 0x10]
shr edx, 0x10
and edx, 0xffff
movsx eax, dx
mov dword [ebp - 0x188], eax
mov ecx, dword [ebp - 0x188]
push ecx
mov edx, dword [ebp - 0x18c]
push edx
mov ecx, dword [ebp - 0xc4]
call fcn.0040fa60
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0
jne 0x40d6f7
jmp case.0x40d340.3
mov eax, dword [ebp - 0xc4]
cmp dword [eax + 0xe8], 0
je 0x40d73f
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
sub esp, 8
mov ecx, esp
mov dword [ebp - 0x2b8], esp
lea edx, [ebp - 0x18c]
push edx
call fcn.004192c0
push 0
push 0
push 0
push 0x11
mov eax, dword [ebp - 0xc4]
mov ecx, dword [eax + 0xe8]
call fcn.0042e2d0
lea ecx, [ebp - 0x28]
push ecx
mov edx, dword [ebp - 0xd4]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xd4]
mov edx, dword [eax + 0x3c]
call edx
mov dword [ebp - 4], 0
push 0x30
push 0
mov eax, dword [ebp - 0xc4]
add eax, 0xb0
push eax
call fcn.004c8420
add esp, 0xc
mov ecx, dword [ebp - 0xc4]
mov dword [ecx + 0xb0], 0x30
mov edx, dword [ebp - 0xc4]
mov dword [edx + 0xb4], 1
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0xc4]
mov edx, dword [ecx + 0x10]
mov dword [eax + 0xb8], edx
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0xc4]
mov edx, dword [ecx + 0x10]
mov dword [eax + 0xbc], edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ecx, dword [ebp - 0xc4]
mov dword [ecx + 0xd0], eax
lea ecx, [ebp - 0x28]
call fcn.004064a0
mov edx, dword [ebp - 0xc4]
mov dword [edx + 0xd4], eax
push 1
lea eax, [ebp - 0x38]
push eax
mov ecx, dword [ebp - 0xd4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xd4]
mov eax, dword [edx + 0x1c]
call eax
mov ecx, dword [ebp - 0xc4]
add ecx, 0xc0
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov eax, dword [eax + 0xc]
mov dword [ecx + 0xc], eax
mov ecx, dword [ebp - 0xc4]
cmp dword [ecx + 0xac], 0
jne 0x40d8a3
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
push 0
mov edx, dword [ebp - 0xc4]
mov eax, dword [edx + 0x10]
push eax
push SysReAllocString
push SysReAllocString
push SysReAllocString
push SysReAllocString
push SysStringLen
push 0
push str.tooltips_class32
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov ecx, dword [ebp - 0xc4]
mov dword [ecx + 0xac], eax
mov edx, dword [ebp - 0xc4]
add edx, 0xb0
push edx
push 0
push 0x432
mov eax, dword [ebp - 0xc4]
mov ecx, dword [eax + 0xac]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [ebp - 0xd4]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xd4]
mov edx, dword [eax + 0x58]
call edx
push eax
push 0
push 0x418
mov eax, dword [ebp - 0xc4]
mov ecx, dword [eax + 0xac]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [ebp - 0xc4]
add edx, 0xb0
push edx
push 0
push 0x436
mov eax, dword [ebp - 0xc4]
mov ecx, dword [eax + 0xac]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [ebp - 0xc4]
add edx, 0xb0
push edx
push 1
push 0x411
mov eax, dword [ebp - 0xc4]
mov ecx, dword [eax + 0xac]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00406380
mov edx, dword [ebp + 0x14]
mov byte [edx], 1
xor eax, eax
jmp 0x40f251
mov eax, dword [ebp - 0xc4]
cmp dword [eax + 0xac], 0
je 0x40d971
mov ecx, dword [ebp - 0xc4]
add ecx, 0xb0
push ecx
push 0
push 0x411
mov edx, dword [ebp - 0xc4]
mov eax, dword [edx + 0xac]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0xc4]
movzx edx, byte [ecx + 0x116]
test edx, edx
je 0x40d99b
push 0xffffffffffffffff
push 0
push 0x200
mov eax, dword [ebp - 0xc4]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [ebp - 0xc4]
mov byte [edx + 0x116], 0
jmp case.0x40d340.3
mov eax, dword [ebp - 0xc4]
cmp dword [eax + 0xfc], 0
jne 0x40d9cb
mov ecx, dword [ebp - 0xc4]
cmp dword [ecx + 0x108], 0
je 0x40d9d0
jmp case.0x40d340.3
mov edx, dword [ebp - 0xc4]
movzx eax, byte [edx + 0x116]
test eax, eax
jne 0x40da85
xor ecx, ecx
mov dword [ebp - 0x19c], ecx
mov dword [ebp - 0x198], ecx
mov dword [ebp - 0x194], ecx
mov dword [ebp - 0x190], ecx
mov dword [ebp - 0x19c], 0x10
mov dword [ebp - 0x198], 3
mov edx, dword [ebp - 0xc4]
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x194], eax
mov ecx, dword [ebp - 0xc4]
cmp dword [ecx + 0xac], 0
jne 0x40da3d
mov dword [ebp - 0x174], 0x190
jmp 0x40da5f
push 0
push 3
push 0x415
mov edx, dword [ebp - 0xc4]
mov eax, dword [edx + 0xac]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x174], eax
mov ecx, dword [ebp - 0x174]
mov dword [ebp - 0x190], ecx
lea edx, [ebp - 0x19c]
push edx
call dword [sym.imp.COMCTL32.dll__TrackMouseEvent]
mov eax, dword [ebp - 0xc4]
mov byte [eax + 0x116], 1
mov ecx, dword [ebp + 0x10]
and ecx, 0xffff
movsx edx, cx
mov dword [ebp - 0x16c], edx
mov eax, dword [ebp + 0x10]
shr eax, 0x10
and eax, 0xffff
movsx ecx, ax
mov dword [ebp - 0x168], ecx
lea edx, [ebp - 0x16c]
push edx
lea ecx, [ebp - 0x250]
call fcn.004192c0
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0x250]
mov edx, dword [ebp - 0x24c]
mov dword [eax + 0xf4], ecx
mov dword [eax + 0xf8], edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x16c]
push edx
mov ecx, dword [ebp - 0xc4]
call fcn.0040f530
movzx eax, al
test eax, eax
jne 0x40db01
jmp case.0x40d340.3
mov ecx, dword [ebp - 0xc4]
cmp dword [ecx + 0xec], 0
je 0x40db4f
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
sub esp, 8
mov ecx, esp
mov dword [ebp - 0x2b4], esp
lea edx, [ebp - 0x16c]
push edx
call fcn.004192c0
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0xe
mov edx, dword [ebp - 0xc4]
mov ecx, dword [edx + 0xec]
call fcn.0042e2d0
jmp 0x40db9b
mov eax, dword [ebp - 0xc4]
cmp dword [eax + 0xe4], 0
je 0x40db9b
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
sub esp, 8
mov ecx, esp
mov dword [ebp - 0x29c], esp
lea edx, [ebp - 0x16c]
push edx
call fcn.004192c0
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0xe
mov edx, dword [ebp - 0xc4]
mov ecx, dword [edx + 0xe4]
call fcn.0042e2d0
jmp case.0x40d340.3
mov eax, dword [ebp - 0xc4]
cmp dword [eax + 0xfc], 0
jne 0x40dbbe
mov ecx, dword [ebp - 0xc4]
cmp dword [ecx + 0x108], 0
je 0x40dbc3
jmp case.0x40d340.3
mov edx, dword [ebp - 0xc4]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [ebp + 0x10]
and ecx, 0xffff
movsx edx, cx
mov dword [ebp - 0x164], edx
mov eax, dword [ebp + 0x10]
shr eax, 0x10
and eax, 0xffff
movsx ecx, ax
mov dword [ebp - 0x160], ecx
lea edx, [ebp - 0x164]
push edx
lea ecx, [ebp - 0x258]
call fcn.004192c0
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0x258]
mov edx, dword [ebp - 0x254]
mov dword [eax + 0xf4], ecx
mov dword [eax + 0xf8], edx
mov eax, dword [ebp - 0x160]
push eax
mov ecx, dword [ebp - 0x164]
push ecx
mov ecx, dword [ebp - 0xc4]
call fcn.0040fa60
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0
jne 0x40dc56
jmp case.0x40d340.3
mov edx, dword [ebp - 0xd8]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xd8]
mov edx, dword [eax]
call edx
cmp eax, dword [ebp - 0xc4]
je 0x40dc75
jmp case.0x40d340.3
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0xd8]
mov dword [eax + 0xec], ecx
mov edx, dword [ebp - 0xd8]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xd8]
mov edx, dword [eax + 0xa4]
call edx
mov ecx, dword [ebp - 0xc4]
call fcn.0040f820
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
sub esp, 8
mov ecx, esp
mov dword [ebp - 0x298], esp
lea eax, [ebp - 0x164]
push eax
call fcn.004192c0
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0x12
mov ecx, dword [ebp - 0xd8]
call fcn.0042e2d0
jmp case.0x40d340.3
mov eax, dword [ebp - 0xc4]
cmp dword [eax + 0xfc], 0
jne 0x40dd02
mov ecx, dword [ebp - 0xc4]
cmp dword [ecx + 0x108], 0
je 0x40dd07
jmp case.0x40d340.3
mov edx, dword [ebp - 0xc4]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [ebp + 0x10]
and ecx, 0xffff
movsx edx, cx
mov dword [ebp - 0x15c], edx
mov eax, dword [ebp + 0x10]
shr eax, 0x10
and eax, 0xffff
movsx ecx, ax
mov dword [ebp - 0x158], ecx
lea edx, [ebp - 0x15c]
push edx
lea ecx, [ebp - 0x1e0]
call fcn.004192c0
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0x1e0]
mov edx, dword [ebp - 0x1dc]
mov dword [eax + 0xf4], ecx
mov dword [eax + 0xf8], edx
mov eax, dword [ebp - 0x158]
push eax
mov ecx, dword [ebp - 0x15c]
push ecx
mov ecx, dword [ebp - 0xc4]
call fcn.0040fa60
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0
jne 0x40dd9a
jmp case.0x40d340.3
mov edx, dword [ebp - 0xdc]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xdc]
mov edx, dword [eax]
call edx
cmp eax, dword [ebp - 0xc4]
je 0x40ddb9
jmp case.0x40d340.3
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0xdc]
mov dword [eax + 0xec], ecx
mov edx, dword [ebp - 0xdc]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xdc]
mov edx, dword [eax + 0xa4]
call edx
mov ecx, dword [ebp - 0xc4]
call fcn.0040f820
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
sub esp, 8
mov ecx, esp
mov dword [ebp - 0x290], esp
lea eax, [ebp - 0x15c]
push eax
call fcn.004192c0
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0x14
mov ecx, dword [ebp - 0xdc]
call fcn.0042e2d0
jmp case.0x40d340.3
mov eax, dword [ebp - 0xc4]
cmp dword [eax + 0xfc], 0
jne 0x40de46
mov ecx, dword [ebp - 0xc4]
cmp dword [ecx + 0x108], 0
je 0x40de4b
jmp case.0x40d340.3
mov edx, dword [ebp - 0xc4]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [ebp + 0x10]
and ecx, 0xffff
movsx edx, cx
mov dword [ebp - 0x148], edx
mov eax, dword [ebp + 0x10]
shr eax, 0x10
and eax, 0xffff
movsx ecx, ax
mov dword [ebp - 0x144], ecx
lea edx, [ebp - 0x148]
push edx
lea ecx, [ebp - 0x1e8]
call fcn.004192c0
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0x1e8]
mov edx, dword [ebp - 0x1e4]
mov dword [eax + 0xf4], ecx
mov dword [eax + 0xf8], edx
mov eax, dword [ebp - 0x144]
push eax
mov ecx, dword [ebp - 0x148]
push ecx
mov ecx, dword [ebp - 0xc4]
call fcn.0040fa60
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 0
jne 0x40dede
jmp case.0x40d340.3
mov edx, dword [ebp - 0x100]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x100]
mov edx, dword [eax]
call edx
cmp eax, dword [ebp - 0xc4]
je 0x40defd
jmp case.0x40d340.3
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0x100]
mov dword [eax + 0xec], ecx
mov ecx, dword [ebp - 0xc4]
call fcn.0040f820
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
sub esp, 8
mov ecx, esp
mov dword [ebp - 0x28c], esp
lea edx, [ebp - 0x148]
push edx
call fcn.004192c0
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0
mov ecx, dword [ebp - 0x100]
call fcn.0042e2d0
jmp case.0x40d340.3
mov edx, dword [ebp + 0x10]
and edx, 0xffff
movsx eax, dx
mov dword [ebp - 0x1b0], eax
mov ecx, dword [ebp + 0x10]
shr ecx, 0x10
and ecx, 0xffff
movsx edx, cx
mov dword [ebp - 0x1ac], edx
lea eax, [ebp - 0x1b0]
push eax
lea ecx, [ebp - 0x1f0]
call fcn.004192c0
mov ecx, dword [ebp - 0xc4]
mov edx, dword [ebp - 0x1f0]
mov eax, dword [ebp - 0x1ec]
mov dword [ecx + 0xf4], edx
mov dword [ecx + 0xf8], eax
mov ecx, dword [ebp - 0xc4]
call fcn.0040f850
mov ecx, dword [ebp - 0xc4]
cmp dword [ecx + 0xec], 0
jne 0x40dfcc
jmp case.0x40d340.3
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
sub esp, 8
mov ecx, esp
mov dword [ebp - 0x288], esp
lea edx, [ebp - 0x1b0]
push edx
call fcn.004192c0
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0x13
mov edx, dword [ebp - 0xc4]
mov ecx, dword [edx + 0xec]
call fcn.0042e2d0
mov eax, dword [ebp - 0xc4]
mov dword [eax + 0xec], 0
jmp case.0x40d340.3
mov ecx, dword [ebp + 0x10]
and ecx, 0xffff
movsx edx, cx
mov dword [ebp - 0x1a8], edx
mov eax, dword [ebp + 0x10]
shr eax, 0x10
and eax, 0xffff
movsx ecx, ax
mov dword [ebp - 0x1a4], ecx
lea edx, [ebp - 0x1a8]
push edx
lea ecx, [ebp - 0x1f8]
call fcn.004192c0
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0x1f8]
mov edx, dword [ebp - 0x1f4]
mov dword [eax + 0xf4], ecx
mov dword [eax + 0xf8], edx
mov ecx, dword [ebp - 0xc4]
call fcn.0040f850
mov eax, dword [ebp - 0xc4]
cmp dword [eax + 0xec], 0
jne 0x40e093
jmp case.0x40d340.3
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
sub esp, 8
mov ecx, esp
mov dword [ebp - 0x284], esp
lea edx, [ebp - 0x1a8]
push edx
call fcn.004192c0
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0x15
mov edx, dword [ebp - 0xc4]
mov ecx, dword [edx + 0xec]
call fcn.0042e2d0
jmp case.0x40d340.3
mov eax, dword [ebp - 0xc4]
cmp dword [eax + 0xe0], 0
jne 0x40e0e9
jmp case.0x40d340.3
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
lea ecx, [ebp - 0x2cc]
call fcn.0041be80
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
movzx eax, word [ebp + 0xc]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0x30
mov eax, dword [ebp - 0xc4]
mov ecx, dword [eax + 0xe0]
call fcn.0042e2d0
jmp case.0x40d340.3
mov ecx, dword [ebp - 0xc4]
cmp dword [ecx + 0xe0], 0
jne 0x40e13d
jmp case.0x40d340.3
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
lea ecx, [ebp - 0x2d4]
call fcn.0041be80
mov edx, dword [eax + 4]
push edx
mov eax, dword [eax]
push eax
movzx ecx, word [ebp + 0xc]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 0x31
mov ecx, dword [ebp - 0xc4]
mov ecx, dword [ecx + 0xe0]
call fcn.0042e2d0
jmp case.0x40d340.3
mov edx, dword [ebp + 0x10]
and edx, 0xffff
movsx eax, dx
mov dword [ebp - 0x154], eax
mov ecx, dword [ebp + 0x10]
shr ecx, 0x10
and ecx, 0xffff
movsx edx, cx
mov dword [ebp - 0x150], edx
lea eax, [ebp - 0x154]
push eax
mov ecx, dword [ebp - 0xc4]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.USER32.dll_ScreenToClient]
lea eax, [ebp - 0x154]
push eax
lea ecx, [ebp - 0x200]
call fcn.004192c0
mov ecx, dword [ebp - 0xc4]
mov edx, dword [ebp - 0x200]
mov eax, dword [ebp - 0x1fc]
mov dword [ecx + 0xf4], edx
mov dword [ecx + 0xf8], eax
mov ecx, dword [ebp - 0x150]
push ecx
mov edx, dword [ebp - 0x154]
push edx
mov ecx, dword [ebp - 0xc4]
call fcn.0040fa60
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0
jne 0x40e218
jmp case.0x40d340.3
mov eax, dword [ebp - 0x108]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x108]
mov eax, dword [edx]
call eax
cmp eax, dword [ebp - 0xc4]
je 0x40e237
jmp case.0x40d340.3
mov ecx, dword [ebp + 0xc]
shr ecx, 0x10
and ecx, 0xffff
movsx edx, cx
mov dword [ebp - 0x1b4], edx
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
lea ecx, [ebp - 0x2dc]
call fcn.0041be80
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x1b4]
push ecx
push 0x18
mov ecx, dword [ebp - 0x108]
call fcn.0042e2d0
jmp case.0x40d340.3
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x118], edx
xor ecx, ecx
mov eax, dword [ebp - 0x118]
mov edx, 0x28
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004c635a
add esp, 4
mov dword [ebp - 0x1b8], eax
mov eax, dword [ebp - 0x1b8]
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0x118], 1
jb 0x40e662
push 0x28
mov ecx, dword [ebp - 0xd0]
push ecx
mov edx, dword [ebp - 0x118]
push edx
mov eax, dword [ebp + 0x10]
push eax
call fcn.004359d0
add esp, 0x10
movzx ecx, al
test ecx, ecx
je 0x40e662
mov edx, 0x28
imul eax, edx, 0
mov ecx, dword [ebp - 0xd0]
cmp dword [ecx + eax + 0xc], 0
je 0x40e662
mov edx, 0x28
imul eax, edx, 0
mov ecx, dword [ebp - 0xd0]
mov eax, dword [ecx + eax]
cdq
mov ecx, 0x64
idiv ecx
mov dword [ebp - 0xf8], eax
mov edx, 0x28
imul eax, edx, 0
mov ecx, dword [ebp - 0xd0]
mov eax, dword [ecx + eax + 4]
cdq
mov ecx, 0x64
idiv ecx
mov dword [ebp - 0xf4], eax
lea edx, [ebp - 0xf8]
push edx
mov eax, dword [ebp - 0xc4]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.USER32.dll_ScreenToClient]
mov edx, 0x28
imul eax, edx, 0
mov ecx, dword [ebp - 0xd0]
mov edx, dword [ecx + eax + 0x10]
and edx, 2
je 0x40e49a
mov eax, dword [ebp - 0xc4]
cmp dword [eax + 0xec], 0
jne 0x40e39c
mov ecx, dword [ebp - 0xc4]
cmp dword [ecx + 0x108], 0
je 0x40e3a1
jmp case.0x40d340.3
mov edx, dword [ebp - 0xc4]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
lea ecx, [ebp - 0xf8]
push ecx
lea ecx, [ebp - 0x248]
call fcn.004192c0
mov edx, dword [ebp - 0xc4]
mov eax, dword [ebp - 0x248]
mov ecx, dword [ebp - 0x244]
mov dword [edx + 0x100], eax
mov dword [edx + 0x104], ecx
mov edx, dword [ebp - 0xf4]
push edx
mov eax, dword [ebp - 0xf8]
push eax
mov ecx, dword [ebp - 0xc4]
call fcn.0040fa60
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 0
jne 0x40e40e
jmp case.0x40d340.3
mov ecx, dword [ebp - 0xe0]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xe0]
mov eax, dword [edx]
call eax
cmp eax, dword [ebp - 0xc4]
je 0x40e42d
jmp case.0x40d340.3
mov ecx, dword [ebp - 0xc4]
mov edx, dword [ebp - 0xe0]
mov dword [ecx + 0xfc], edx
mov eax, dword [ebp - 0xe0]
mov edx, dword [eax]
mov ecx, dword [ebp - 0xe0]
mov eax, dword [edx + 0xa4]
call eax
mov ecx, dword [ebp - 0xc4]
call fcn.0040f820
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
sub esp, 8
mov ecx, esp
mov dword [ebp - 0x280], esp
lea edx, [ebp - 0xf8]
push edx
call fcn.004192c0
push 0
mov eax, dword [ebp + 0x10]
push eax
push 0
push 0x1b
mov ecx, dword [ebp - 0xe0]
call fcn.0042e2d0
jmp 0x40e662
mov ecx, 0x28
imul edx, ecx, 0
mov eax, dword [ebp - 0xd0]
mov ecx, dword [eax + edx + 0x10]
and ecx, 1
je 0x40e5ad
mov edx, dword [ebp - 0xc4]
cmp dword [edx + 0xec], 0
jne 0x40e4d3
mov eax, dword [ebp - 0xc4]
cmp dword [eax + 0x108], 0
je 0x40e4d8
jmp case.0x40d340.3
mov ecx, dword [ebp - 0xc4]
mov edx, dword [ecx + 0x100]
cmp edx, dword [ebp - 0xf8]
jne 0x40e505
mov eax, dword [ebp - 0xc4]
mov ecx, dword [eax + 0x104]
cmp ecx, dword [ebp - 0xf4]
jne 0x40e505
jmp case.0x40d340.3
lea edx, [ebp - 0xf8]
push edx
lea ecx, [ebp - 0x208]
call fcn.004192c0
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0x208]
mov edx, dword [ebp - 0x204]
mov dword [eax + 0x100], ecx
mov dword [eax + 0x104], edx
mov eax, dword [ebp - 0xc4]
cmp dword [eax + 0xfc], 0
jne 0x40e549
jmp case.0x40d340.3
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0xf8]
push eax
mov ecx, dword [ebp - 0xc4]
call fcn.0040f530
movzx ecx, al
test ecx, ecx
jne 0x40e56f
jmp case.0x40d340.3
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
sub esp, 8
mov ecx, esp
mov dword [ebp - 0x278], esp
lea edx, [ebp - 0xf8]
push edx
call fcn.004192c0
push 0
push 0
push 0
push 0x1c
mov eax, dword [ebp - 0xc4]
mov ecx, dword [eax + 0xfc]
call fcn.0042e2d0
jmp 0x40e662
mov ecx, 0x28
imul edx, ecx, 0
mov eax, dword [ebp - 0xd0]
mov ecx, dword [eax + edx + 0x10]
and ecx, 4
je 0x40e662
lea edx, [ebp - 0xf8]
push edx
lea ecx, [ebp - 0x210]
call fcn.004192c0
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0x210]
mov edx, dword [ebp - 0x20c]
mov dword [eax + 0x100], ecx
mov dword [eax + 0x104], edx
mov ecx, dword [ebp - 0xc4]
call fcn.0040f850
mov eax, dword [ebp - 0xc4]
cmp dword [eax + 0xfc], 0
jne 0x40e617
jmp case.0x40d340.3
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
sub esp, 8
mov ecx, esp
mov dword [ebp - 0x294], esp
lea edx, [ebp - 0xf8]
push edx
call fcn.004192c0
push 0
mov eax, dword [ebp + 0x10]
push eax
push 0
push 0x1d
mov ecx, dword [ebp - 0xc4]
mov ecx, dword [ecx + 0xfc]
call fcn.0042e2d0
mov edx, dword [ebp - 0xc4]
mov dword [edx + 0xfc], 0
mov eax, dword [ebp + 0x10]
push eax
call fcn.00435a70
add esp, 4
mov ecx, dword [ebp - 0xd0]
mov dword [ebp - 0x1bc], ecx
mov edx, dword [ebp - 0x1bc]
push edx
call fcn.004c62a9
add esp, 4
jmp case.0x40d340.3
mov eax, dword [ebp - 0xc4]
movzx ecx, byte [eax + 0x10c]
test ecx, ecx
jne 0x40e6a4
jmp case.0x40d340.3
mov edx, dword [ebp + 0xc]
shr edx, 0x10
and edx, 0xffff
movzx eax, dx
and eax, 0x2000
jne 0x40e6c5
mov ecx, dword [ebp + 0x14]
mov byte [ecx], 1
jmp case.0x40d340.3
mov edx, dword [ebp + 0xc]
and edx, 0xffff
movzx eax, dx
mov dword [ebp - 0x11c], eax
lea ecx, [ebp - 0x1c0]
push ecx
mov edx, dword [ebp - 0x11c]
push edx
call fcn.00435b00
add esp, 8
movzx eax, al
test eax, eax
jne 0x40e6fb
xor eax, eax
jmp 0x40f251
xor ecx, ecx
mov dword [ebp - 0xf0], ecx
mov dword [ebp - 0xec], ecx
xorps xmm0, xmm0
movss dword [ebp - 0x104], xmm0
mov edx, dword [ebp - 0x1c0]
mov dword [ebp - 0x178], edx
cmp dword [ebp - 0x178], 2
je 0x40e73b
cmp dword [ebp - 0x178], 3
je 0x40e7bf
jmp 0x40e843
lea eax, [ebp - 0xc0]
push eax
mov ecx, dword [ebp - 0x11c]
push ecx
call fcn.00435b90
add esp, 8
movzx edx, al
test edx, edx
jne 0x40e75f
xor eax, eax
jmp 0x40f251
mov eax, dword [ebp - 0x98]
mov ecx, dword [ebp - 0x94]
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0xec], ecx
mov edx, dword [ebp - 0x3c]
mov dword [ebp - 0x17c], edx
cvtsi2sd xmm0, dword [ebp - 0x17c]
mov eax, dword [ebp - 0x17c]
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x526370]
movsd qword [ebp - 0x2a4], xmm0
cvtsd2ss xmm0, qword [ebp - 0x2a4]
divss xmm0, dword [0x526358]
movss dword [ebp - 0x104], xmm0
jmp 0x40e84a
lea ecx, [ebp - 0x384]
push ecx
mov edx, dword [ebp - 0x11c]
push edx
call fcn.00435c20
add esp, 8
movzx eax, al
test eax, eax
jne 0x40e7e3
xor eax, eax
jmp 0x40f251
mov ecx, dword [ebp - 0x35c]
mov edx, dword [ebp - 0x358]
mov dword [ebp - 0xf0], ecx
mov dword [ebp - 0xec], edx
mov eax, dword [ebp - 0x324]
mov dword [ebp - 0x128], eax
cvtsi2sd xmm0, dword [ebp - 0x128]
mov ecx, dword [ebp - 0x128]
shr ecx, 0x1f
addsd xmm0, qword [ecx*8 + 0x526370]
movsd qword [ebp - 0x2ac], xmm0
cvtsd2ss xmm0, qword [ebp - 0x2ac]
divss xmm0, dword [0x526358]
movss dword [ebp - 0x104], xmm0
jmp 0x40e84a
xor eax, eax
jmp 0x40f251
lea edx, [ebp - 0xf0]
push edx
mov eax, dword [ebp - 0xc4]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.USER32.dll_ScreenToClient]
mov edx, dword [ebp + 8]
mov dword [ebp - 0x10c], edx
mov eax, dword [ebp - 0x10c]
sub eax, 0x245
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 7
ja case.0x40e88e.3
mov ecx, dword [ebp - 0x10c]
jmp dword [ecx*4 + 0x40f4d8]
mov edx, dword [ebp - 0xc4]
cmp dword [edx + 0xec], 0
jne 0x40e8b3
mov eax, dword [ebp - 0xc4]
cmp dword [eax + 0xfc], 0
je 0x40e8be
mov ecx, dword [ebp + 0x14]
mov byte [ecx], 1
jmp case.0x40e88e.3
mov edx, dword [ebp - 0xc4]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
lea ecx, [ebp - 0xf0]
push ecx
lea ecx, [ebp - 0x218]
call fcn.004192c0
mov edx, dword [ebp - 0xc4]
mov eax, dword [ebp - 0x218]
mov ecx, dword [ebp - 0x214]
mov dword [edx + 0xf4], eax
mov dword [edx + 0xf8], ecx
mov edx, dword [ebp - 0xec]
push edx
mov eax, dword [ebp - 0xf0]
push eax
mov ecx, dword [ebp - 0xc4]
call fcn.0040fa60
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0
jne 0x40e92b
jmp case.0x40e88e.3
mov ecx, dword [ebp - 0xe4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xe4]
mov eax, dword [edx]
call eax
cmp eax, dword [ebp - 0xc4]
je 0x40e94a
jmp case.0x40e88e.3
mov ecx, dword [ebp - 0xc4]
mov edx, dword [ebp - 0xe4]
mov dword [ecx + 0x108], edx
mov eax, dword [ebp - 0xe4]
mov edx, dword [eax]
mov ecx, dword [ebp - 0xe4]
mov eax, dword [edx + 0xa4]
call eax
mov ecx, dword [ebp - 0xc4]
call fcn.0040f820
push ecx
movss xmm0, dword [ebp - 0x104]
movss dword [esp], xmm0
sub esp, 8
mov ecx, esp
mov dword [ebp - 0x260], esp
lea edx, [ebp - 0xf0]
push edx
call fcn.004192c0
push 0
mov eax, dword [ebp + 0x10]
push eax
push 0
push 0x20
mov ecx, dword [ebp - 0xe4]
call fcn.0042e2d0
mov ecx, dword [ebp - 0xc4]
cmp dword [ecx + 0x108], 0
je 0x40e9e4
mov edx, dword [ebp - 0xc4]
mov ecx, dword [edx + 0x108]
call fcn.004192a0
movzx eax, al
test eax, eax
je 0x40e9e4
mov ecx, dword [ebp + 0x14]
mov byte [ecx], 1
jmp case.0x40e88e.3
mov edx, dword [ebp - 0xc4]
cmp dword [edx + 0xec], 0
jne 0x40ea07
mov eax, dword [ebp - 0xc4]
cmp dword [eax + 0xfc], 0
je 0x40ea12
mov ecx, dword [ebp + 0x14]
mov byte [ecx], 1
jmp case.0x40e88e.3
lea edx, [ebp - 0xf0]
push edx
lea ecx, [ebp - 0x220]
call fcn.004192c0
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0x220]
mov edx, dword [ebp - 0x21c]
mov dword [eax + 0xf4], ecx
mov dword [eax + 0xf8], edx
mov eax, dword [ebp - 0xc4]
cmp dword [eax + 0x108], 0
jne 0x40ea56
jmp case.0x40e88e.3
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0xf0]
push eax
mov ecx, dword [ebp - 0xc4]
call fcn.0040f530
movzx ecx, al
test ecx, ecx
jne 0x40ea7c
jmp case.0x40e88e.3
push ecx
movss xmm0, dword [ebp - 0x104]
movss dword [esp], xmm0
sub esp, 8
mov ecx, esp
mov dword [ebp - 0x264], esp
lea edx, [ebp - 0xf0]
push edx
call fcn.004192c0
push 0
push 0
push 0
push 0x21
mov eax, dword [ebp - 0xc4]
mov ecx, dword [eax + 0x108]
call fcn.0042e2d0
mov ecx, dword [ebp - 0xc4]
cmp dword [ecx + 0x108], 0
je 0x40eae7
mov edx, dword [ebp - 0xc4]
mov ecx, dword [edx + 0x108]
call fcn.004192a0
movzx eax, al
test eax, eax
je 0x40eae7
mov ecx, dword [ebp + 0x14]
mov byte [ecx], 1
jmp case.0x40e88e.3
lea edx, [ebp - 0xf0]
push edx
lea ecx, [ebp - 0x228]
call fcn.004192c0
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0x228]
mov edx, dword [ebp - 0x224]
mov dword [eax + 0xf4], ecx
mov dword [eax + 0xf8], edx
mov ecx, dword [ebp - 0xc4]
call fcn.0040f850
mov eax, dword [ebp - 0xc4]
cmp dword [eax + 0x108], 0
jne 0x40eb38
jmp case.0x40e88e.3
push ecx
movss xmm0, dword [ebp - 0x104]
movss dword [esp], xmm0
sub esp, 8
mov ecx, esp
mov dword [ebp - 0x268], esp
lea edx, [ebp - 0xf0]
push edx
call fcn.004192c0
push 0
mov eax, dword [ebp + 0x10]
push eax
push 0
push 0x22
mov ecx, dword [ebp - 0xc4]
mov ecx, dword [ecx + 0x108]
call fcn.0042e2d0
mov edx, dword [ebp - 0xc4]
cmp dword [edx + 0x108], 0
je 0x40eba5
mov eax, dword [ebp - 0xc4]
mov ecx, dword [eax + 0x108]
call fcn.004192a0
movzx ecx, al
test ecx, ecx
je 0x40eba5
mov edx, dword [ebp + 0x14]
mov byte [edx], 1
mov eax, dword [ebp - 0xc4]
mov dword [eax + 0x108], 0
xor eax, eax
jmp 0x40f251
mov ecx, dword [ebp - 0xc4]
cmp dword [ecx + 0xec], 0
je 0x40ebe9
mov edx, dword [ebp - 0xc4]
mov eax, dword [edx + 0xec]
mov dword [ebp - 0x12c], eax
jmp 0x40ebf3
mov dword [ebp - 0x12c], 0
mov ecx, dword [ebp - 0x12c]
mov dword [ebp - 0xe8], ecx
mov edx, dword [ebp - 0xc4]
cmp dword [edx + 0xfc], 0
je 0x40ec22
mov eax, dword [ebp - 0xc4]
mov ecx, dword [eax + 0xfc]
mov dword [ebp - 0x130], ecx
jmp 0x40ec2e
mov edx, dword [ebp - 0xe8]
mov dword [ebp - 0x130], edx
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0xe8], eax
mov ecx, dword [ebp - 0xc4]
cmp dword [ecx + 0x108], 0
je 0x40ec5d
mov edx, dword [ebp - 0xc4]
mov eax, dword [edx + 0x108]
mov dword [ebp - 0x134], eax
jmp 0x40ec69
mov ecx, dword [ebp - 0xe8]
mov dword [ebp - 0x134], ecx
mov edx, dword [ebp - 0x134]
mov dword [ebp - 0xe8], edx
mov eax, dword [ebp + 0x10]
and eax, 0xffff
movsx ecx, ax
mov dword [ebp - 0x1d8], ecx
mov edx, dword [ebp + 0x10]
shr edx, 0x10
and edx, 0xffff
movsx eax, dx
mov dword [ebp - 0x1d4], eax
lea ecx, [ebp - 0x1d8]
push ecx
lea ecx, [ebp - 0x230]
call fcn.004192c0
mov edx, dword [ebp - 0xc4]
mov eax, dword [ebp - 0x230]
mov ecx, dword [ebp - 0x22c]
mov dword [edx + 0xf4], eax
mov dword [edx + 0xf8], ecx
cmp dword [ebp - 0xe8], 0
je 0x40ece6
mov ecx, dword [ebp - 0xe8]
call fcn.00419280
movzx edx, al
test edx, edx
jne 0x40eceb
jmp case.0x40d340.3
mov ecx, dword [ebp - 0xc4]
call fcn.0040f850
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
sub esp, 8
mov ecx, esp
mov dword [ebp - 0x26c], esp
lea eax, [ebp - 0x1d8]
push eax
call fcn.004192c0
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0x13
mov ecx, dword [ebp - 0xe8]
call fcn.0042e2d0
mov eax, dword [ebp - 0xc4]
mov dword [eax + 0xec], 0
mov ecx, dword [ebp - 0xc4]
mov dword [ecx + 0xfc], 0
mov edx, dword [ebp - 0xc4]
mov dword [edx + 0x108], 0
jmp case.0x40d340.3
mov eax, dword [ebp + 0x10]
and eax, 0xffff
movsx ecx, ax
mov dword [ebp - 0x184], ecx
mov edx, dword [ebp + 0x10]
shr edx, 0x10
and edx, 0xffff
movsx eax, dx
mov dword [ebp - 0x180], eax
lea ecx, [ebp - 0x184]
push ecx
mov edx, dword [ebp - 0xc4]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
lea ecx, [ebp - 0x184]
push ecx
lea ecx, [ebp - 0x238]
call fcn.004192c0
mov edx, dword [ebp - 0xc4]
mov eax, dword [ebp - 0x238]
mov ecx, dword [ebp - 0x234]
mov dword [edx + 0xf4], eax
mov dword [edx + 0xf8], ecx
mov edx, dword [ebp - 0xc4]
cmp dword [edx + 0xec], 0
jne 0x40ede3
jmp case.0x40d340.3
mov ecx, dword [ebp - 0xc4]
call fcn.0040f850
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
sub esp, 8
mov ecx, esp
mov dword [ebp - 0x270], esp
lea eax, [ebp - 0x184]
push eax
call fcn.004192c0
push 0
mov ecx, dword [ebp - 0xc4]
mov edx, dword [ecx + 0xec]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 1
mov ecx, dword [ebp - 0xc4]
mov ecx, dword [ecx + 0xec]
call fcn.0042e2d0
mov edx, dword [ebp - 0xc4]
mov dword [edx + 0xec], 0
jmp case.0x40d340.3
mov eax, dword [ebp - 0xc4]
cmp dword [eax + 0xe0], 0
jne 0x40ee5d
jmp case.0x40d340.3
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
lea ecx, [ebp - 0x2e4]
call fcn.0041be80
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
movzx eax, word [ebp + 0xc]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0xa
mov eax, dword [ebp - 0xc4]
mov ecx, dword [eax + 0xe0]
call fcn.0042e2d0
jmp case.0x40d340.3
mov ecx, dword [ebp - 0xc4]
cmp dword [ecx + 0xe0], 0
jne 0x40eeb1
jmp case.0x40d340.3
cmp dword [ebp + 0xc], 9
jne 0x40efbc
mov edx, dword [ebp - 0xc4]
cmp dword [edx + 0xe0], 0
je 0x40ef80
mov eax, dword [ebp - 0xc4]
mov ecx, dword [eax + 0xe0]
mov edx, dword [ebp - 0xc4]
mov eax, dword [ecx]
mov ecx, dword [edx + 0xe0]
mov edx, dword [eax + 0x14]
call edx
movzx eax, al
test eax, eax
je 0x40ef80
mov ecx, dword [ebp - 0xc4]
mov edx, dword [ecx + 0xe0]
mov eax, dword [ebp - 0xc4]
mov edx, dword [edx]
mov ecx, dword [eax + 0xe0]
mov eax, dword [edx + 0x88]
call eax
movzx ecx, al
test ecx, ecx
je 0x40ef80
push 0
push 0x540518
push 0x5404fc
push 0
mov edx, dword [ebp - 0xc4]
mov eax, dword [edx + 0xe0]
push eax
call fcn.004c8985
add esp, 0x14
test eax, eax
je 0x40ef80
push 0
push 0x540518
push 0x5404fc
push 0
mov ecx, dword [ebp - 0xc4]
mov edx, dword [ecx + 0xe0]
push edx
call fcn.004c8985
add esp, 0x14
mov ecx, eax
call fcn.00439700
movzx eax, al
test eax, eax
je 0x40ef80
xor eax, eax
jmp 0x40f251
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
test ecx, ecx
jl 0x40ef98
mov byte [ebp - 0xc9], 1
jmp 0x40ef9f
mov byte [ebp - 0xc9], 0
movzx edx, byte [ebp - 0xc9]
push edx
mov ecx, dword [ebp - 0xc4]
call fcn.0040f890
mov eax, 1
jmp 0x40f251
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0xc4]
mov edx, dword [ecx + 0xe0]
mov dword [eax + 0xf0], edx
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
lea ecx, [ebp - 0x2ec]
call fcn.0041be80
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
movzx eax, word [ebp + 0xc]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 8
mov eax, dword [ebp - 0xc4]
mov ecx, dword [eax + 0xe0]
call fcn.0042e2d0
jmp case.0x40d340.3
mov ecx, dword [ebp - 0xc4]
cmp dword [ecx + 0xf0], 0
jne 0x40f028
jmp case.0x40d340.3
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
lea ecx, [ebp - 0x2f4]
call fcn.0041be80
mov edx, dword [eax + 4]
push edx
mov eax, dword [eax]
push eax
movzx ecx, word [ebp + 0xc]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 9
mov ecx, dword [ebp - 0xc4]
mov ecx, dword [ecx + 0xf0]
call fcn.0042e2d0
mov edx, dword [ebp - 0xc4]
mov dword [edx + 0xf0], 0
jmp case.0x40d340.3
mov eax, dword [ebp + 0x10]
and eax, 0xffff
movzx ecx, ax
cmp ecx, 1
je 0x40f08d
jmp case.0x40d340.3
mov edx, dword [ebp - 0xc4]
cmp dword [edx + 0xec], 0
jne 0x40f0ba
mov eax, dword [ebp - 0xc4]
cmp dword [eax + 0xfc], 0
jne 0x40f0ba
mov ecx, dword [ebp - 0xc4]
cmp dword [ecx + 0x108], 0
je 0x40f0c7
mov edx, dword [ebp + 0x14]
mov byte [edx], 1
xor eax, eax
jmp 0x40f251
xor eax, eax
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x120], eax
lea ecx, [ebp - 0x124]
push ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
lea edx, [ebp - 0x124]
push edx
mov eax, dword [ebp - 0xc4]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.USER32.dll_ScreenToClient]
lea edx, [ebp - 0x124]
push edx
lea ecx, [ebp - 0x240]
call fcn.004192c0
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0x240]
mov edx, dword [ebp - 0x23c]
mov dword [eax + 0xf4], ecx
mov dword [eax + 0xf8], edx
mov eax, dword [ebp - 0x120]
push eax
mov ecx, dword [ebp - 0x124]
push ecx
mov ecx, dword [ebp - 0xc4]
call fcn.0040fa60
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0
jne 0x40f156
jmp case.0x40d340.3
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
sub esp, 8
mov ecx, esp
mov dword [ebp - 0x274], esp
lea edx, [ebp - 0x124]
push edx
call fcn.004192c0
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0x28
mov ecx, dword [ebp - 0x138]
call fcn.0042e2d0
mov edx, dword [ebp + 0x14]
mov byte [edx], 1
xor eax, eax
jmp 0x40f251
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0
je 0x40f1d1
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
add eax, 0x2000
push eax
mov ecx, dword [ebp - 0x13c]
mov edx, dword [ecx]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x40f251
mov eax, dword [ebp + 0x14]
mov byte [eax], 1
xor eax, eax
jmp 0x40f251
cmp dword [ebp + 0x10], 0
jne 0x40f1e5
jmp case.0x40d340.3
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x1c4], ecx
mov edx, dword [ebp + 0x14]
mov byte [edx], 1
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
add edx, 0x2000
push edx
mov eax, dword [ebp - 0x1c4]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x40f251
cmp dword [ebp + 0x10], 0
jne 0x40f21f
jmp case.0x40d340.3
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x1c8], ecx
mov edx, dword [ebp + 0x14]
mov byte [edx], 1
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
add edx, 0x2000
push edx
mov eax, dword [ebp - 0x1c8]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x40f251
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c626c
mov esp, ebp
pop ebp
ret 0x10