Function at 0x4bd510
Capabilities:
Check for time delay via gettickcount
Check for unmoving mouse cursor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6312e7
mov eax, dword fs:[0]
push eax
sub esp, 0x5d8
mov eax, dword [0x6bae70]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x250], ecx
mov eax, dword [ebp - 0x250]
cmp dword [eax + 0x84], 0
jne 0x4bd557
xor al, al
jmp 0x4c116d
mov dword [ebp - 0x2d8], 0
jmp 0x4bd572
mov ecx, dword [ebp - 0x2d8]
add ecx, 1
mov dword [ebp - 0x2d8], ecx
mov ecx, dword [ebp - 0x250]
add ecx, 0x2e4
call fcn.005105d0
cmp dword [ebp - 0x2d8], eax
jge 0x4bd6ea
mov byte [ebp - 0x267], 0
mov edx, dword [ebp - 0x2d8]
push edx
mov ecx, dword [ebp - 0x250]
add ecx, 0x2e4
call fcn.004b8f00
mov dword [ebp - 0x39c], eax
lea eax, [ebp - 0x267]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x39c]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x39c]
mov eax, dword [edx]
call eax
mov dword [ebp - 0x59c], eax
movzx ecx, byte [ebp - 0x267]
test ecx, ecx
je 0x4bd6e5
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp - 0x59c]
mov dword [edx], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x2e4], ecx
cmp dword [ebp - 0x2e4], 0x203
ja 0x4bd628
cmp dword [ebp - 0x2e4], 0x200
jae 0x4bd639
cmp dword [ebp - 0x2e4], 0x7b
je 0x4bd680
jmp 0x4bd6de
cmp dword [ebp - 0x2e4], 0x20a
je 0x4bd680
jmp 0x4bd6de
mov edx, dword [ebp + 0x10]
and edx, 0xffff
movsx eax, dx
mov dword [ebp - 0x598], eax
mov ecx, dword [ebp + 0x10]
shr ecx, 0x10
and ecx, 0xffff
movsx edx, cx
mov dword [ebp - 0x594], edx
mov eax, dword [ebp - 0x250]
mov ecx, dword [ebp - 0x598]
mov dword [eax + 0xfc], ecx
mov edx, dword [ebp - 0x594]
mov dword [eax + 0x100], edx
jmp 0x4bd6de
mov eax, dword [ebp + 0x10]
and eax, 0xffff
movsx ecx, ax
mov dword [ebp - 0x3b4], ecx
mov edx, dword [ebp + 0x10]
shr edx, 0x10
and edx, 0xffff
movsx eax, dx
mov dword [ebp - 0x3b0], eax
lea ecx, [ebp - 0x3b4]
push ecx
mov edx, dword [ebp - 0x250]
mov eax, dword [edx + 0x84]
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
mov ecx, dword [ebp - 0x250]
mov edx, dword [ebp - 0x3b4]
mov dword [ecx + 0xfc], edx
mov eax, dword [ebp - 0x3b0]
mov dword [ecx + 0x100], eax
mov al, 1
jmp 0x4c116d
jmp 0x4bd563
mov ecx, dword [ebp - 0x250]
movzx edx, byte [ecx + 0x14d]
test edx, edx
je 0x4bd785
mov eax, dword [ebp + 8]
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], 0x83
je 0x4bd775
cmp dword [ebp - 0x328], 0x85
je 0x4bd775
cmp dword [ebp - 0x328], 0x86
je 0x4bd72e
jmp 0x4bd785
mov ecx, dword [ebp - 0x250]
mov edx, dword [ecx + 0x84]
push edx
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
jne 0x4bd773
cmp dword [ebp + 0xc], 0
jne 0x4bd757
mov dword [ebp - 0x398], 1
jmp 0x4bd761
mov dword [ebp - 0x398], 0
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x398]
mov dword [eax], ecx
mov al, 1
jmp 0x4c116d
jmp 0x4bd785
mov edx, dword [ebp + 0x14]
mov dword [edx], 0
mov al, 1
jmp 0x4c116d
mov eax, dword [ebp + 8]
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 0x111
ja 0x4bd7dd
cmp dword [ebp - 0x258], 0x111
je 0x4c10f7
mov ecx, dword [ebp - 0x258]
sub ecx, 5
mov dword [ebp - 0x258], ecx
cmp dword [ebp - 0x258], 0xfd
ja case.default.0x4bd86f
mov edx, dword [ebp - 0x258]
movzx eax, byte [edx + 0x4c11c0]
jmp dword [eax*4 + 0x4c1188]
cmp dword [ebp - 0x258], 0x200
ja 0x4bd82e
cmp dword [ebp - 0x258], 0x200
je 0x4bfce9
cmp dword [ebp - 0x258], 0x113
je 0x4bf3b3
cmp dword [ebp - 0x258], 0x133
je 0x4c1132
cmp dword [ebp - 0x258], 0x138
je 0x4c1132
jmp case.default.0x4bd86f
cmp dword [ebp - 0x258], 0x20a
ja 0x4bd876
cmp dword [ebp - 0x258], 0x20a
je 0x4c0914
mov ecx, dword [ebp - 0x258]
sub ecx, 0x201
mov dword [ebp - 0x258], ecx
cmp dword [ebp - 0x258], 3
ja case.default.0x4bd86f
mov edx, dword [ebp - 0x258]
jmp dword [edx*4 + 0x4c12c0]
cmp dword [ebp - 0x258], 0x318
ja 0x4bd8b7
cmp dword [ebp - 0x258], 0x318
je 0x4bf0a3
cmp dword [ebp - 0x258], 0x2a1
je 0x4bf5b7
cmp dword [ebp - 0x258], 0x2a3
je 0x4bfb08
jmp case.default.0x4bd86f
cmp dword [ebp - 0x258], 0x8001
je 0x4bd8c8
jmp case.default.0x4bd86f
mov eax, dword [ebp - 0x250]
mov byte [eax + 0x2bc], 0
mov dword [ebp - 0x274], 0
push 0
mov ecx, dword [ebp - 0x250]
add ecx, 0x320
call fcn.004b9850
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 0
je 0x4bda4d
push 1
push 0
mov ecx, dword [ebp - 0x250]
add ecx, 0x320
call fcn.004b9e40
mov ecx, dword [ebp - 0x274]
cmp dword [ecx + 0x108], 0
je 0x4bd95f
mov edx, dword [ebp - 0x274]
mov ecx, dword [edx + 0x108]
add ecx, 0x38
call fcn.004cd980
movzx eax, al
test eax, eax
je 0x4bd95f
mov ecx, dword [ebp - 0x274]
push ecx
mov edx, dword [ebp - 0x274]
mov ecx, dword [edx + 0x108]
add ecx, 0x38
call fcn.004cd9d0
mov dword [ebp - 0x2d4], 0
jmp 0x4bd97a
mov eax, dword [ebp - 0x2d4]
add eax, 1
mov dword [ebp - 0x2d4], eax
mov ecx, dword [ebp - 0x250]
add ecx, 0x2c0
call fcn.005105d0
cmp dword [ebp - 0x2d4], eax
jge 0x4bd9cc
mov ecx, dword [ebp - 0x2d4]
push ecx
mov ecx, dword [ebp - 0x250]
add ecx, 0x2c0
call fcn.004b8f00
mov dword [ebp - 0x380], eax
mov edx, dword [ebp - 0x274]
push edx
mov eax, dword [ebp - 0x380]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x380]
mov eax, dword [edx]
call eax
jmp 0x4bd96b
mov ecx, dword [ebp - 0x274]
mov dword [ebp - 0x56c], ecx
mov edx, dword [ebp - 0x56c]
mov dword [ebp - 0x29c], edx
cmp dword [ebp - 0x29c], 0
je 0x4bda3e
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x29c]
add ecx, 0x84
call fcn.004b8d30
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x29c]
call fcn.004b8d30
mov eax, 1
and eax, 1
je 0x4bda30
mov ecx, dword [ebp - 0x29c]
push ecx
call fcn.005e8fa6
add esp, 4
mov edx, dword [ebp - 0x29c]
mov dword [ebp - 0x5a0], edx
jmp 0x4bda48
mov dword [ebp - 0x5a0], 0
jmp 0x4bd8df
mov dword [ebp - 0x2b4], 0
jmp 0x4bda68
mov eax, dword [ebp - 0x2b4]
add eax, 1
mov dword [ebp - 0x2b4], eax
mov ecx, dword [ebp - 0x250]
add ecx, 0x314
call fcn.005105d0
cmp dword [ebp - 0x2b4], eax
jge 0x4bdab3
mov ecx, dword [ebp - 0x2b4]
push ecx
mov ecx, dword [ebp - 0x250]
add ecx, 0x314
call fcn.004b8f00
mov dword [ebp - 0x3ac], eax
mov edx, dword [ebp - 0x3ac]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x3ac]
mov edx, dword [eax]
call edx
jmp 0x4bda59
mov ecx, dword [ebp - 0x250]
add ecx, 0x314
call fcn.004b94c0
jmp case.default.0x4bd86f
mov dword [ebp - 0x3d4], 0
xor eax, eax
mov dword [ebp - 0x3d0], eax
mov dword [ebp - 0x3cc], eax
mov dword [ebp - 0x3c8], eax
mov dword [ebp - 0x3c4], eax
mov dword [ebp - 0x3c0], eax
mov dword [ebp - 0x3bc], eax
mov dword [ebp - 0x3b8], eax
mov ecx, dword [ebp - 0x250]
mov edx, dword [ecx + 0xfc]
mov eax, dword [ecx + 0x100]
mov dword [ebp - 0x3c8], edx
mov dword [ebp - 0x3c4], eax
call fcn.004bd480
mov word [ebp - 0x3be], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x3cc], eax
mov ecx, dword [ebp - 0x250]
cmp dword [ecx + 0xec], 0
je 0x4bdb89
mov dword [ebp - 0x3d4], 0xa
mov edx, dword [ebp - 0x250]
mov eax, dword [edx + 0xec]
mov dword [ebp - 0x3d0], eax
lea ecx, [ebp - 0x3d4]
push ecx
mov edx, dword [ebp - 0x250]
mov eax, dword [edx + 0xec]
mov ecx, dword [ebp - 0x250]
mov edx, dword [eax]
mov ecx, dword [ecx + 0xec]
mov eax, dword [edx + 0x11c]
call eax
mov ecx, dword [ebp - 0x250]
cmp dword [ecx + 0xf0], 0
je 0x4bdbdd
mov dword [ebp - 0x3d4], 0xe
mov edx, dword [ebp - 0x250]
mov eax, dword [edx + 0xf0]
mov dword [ebp - 0x3d0], eax
lea ecx, [ebp - 0x3d4]
push ecx
mov edx, dword [ebp - 0x250]
mov eax, dword [edx + 0xf0]
mov ecx, dword [ebp - 0x250]
mov edx, dword [eax]
mov ecx, dword [ecx + 0xf0]
mov eax, dword [edx + 0x11c]
call eax
push 1
push 0
mov ecx, dword [ebp - 0x250]
call fcn.004c2eb0
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov ecx, dword [ebp - 0x250]
cmp eax, dword [ecx + 0x84]
jne 0x4bdc66
push 4
mov edx, dword [ebp - 0x250]
mov eax, dword [edx + 0x84]
push eax
call dword [sym.imp.USER32.dll_GetWindow]
mov dword [ebp - 0x30c], eax
push 0xfffffffffffffff0
mov ecx, dword [ebp - 0x250]
mov edx, dword [ecx + 0x84]
push edx
call dword [sym.imp.USER32.dll_GetWindowLongW]
and eax, 0x40000000
je 0x4bdc50
mov eax, dword [ebp - 0x250]
mov ecx, dword [eax + 0x84]
push ecx
call dword [sym.imp.USER32.dll_GetParent]
mov dword [ebp - 0x30c], eax
cmp dword [ebp - 0x30c], 0
je 0x4bdc66
mov edx, dword [ebp - 0x30c]
push edx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [ebp - 0x250]
cmp dword [eax + 0xac], 0
je 0x4bdc98
mov ecx, dword [ebp - 0x250]
mov edx, dword [ecx + 0xac]
push edx
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [ebp - 0x250]
mov dword [eax + 0xac], 0
jmp case.default.0x4bd86f
mov ecx, dword [ebp + 0x14]
mov dword [ecx], 1
mov al, 1
jmp 0x4c116d
mov edx, dword [ebp - 0x250]
cmp dword [edx + 0xe4], 0
jne 0x4bdd35
mov dword [ebp - 0x1cc], 0
push 0x3c
push 0
lea eax, [ebp - 0x1c8]
push eax
call fcn.005eb2b0
add esp, 0xc
lea ecx, [ebp - 0x1cc]
push ecx
mov edx, dword [ebp - 0x250]
mov eax, dword [edx + 0x84]
push eax
call dword [sym.imp.USER32.dll_BeginPaint]
push 0xff000000
lea ecx, [ebp - 0x1c4]
push ecx
mov edx, dword [ebp - 0x250]
mov eax, dword [edx + 0x88]
push eax
call fcn.004ce310
add esp, 0xc
lea ecx, [ebp - 0x1cc]
push ecx
mov edx, dword [ebp - 0x250]
mov eax, dword [edx + 0x84]
push eax
call dword [sym.imp.USER32.dll_EndPaint]
mov al, 1
jmp 0x4c116d
mov dword [ebp - 0x17c], 0
xor ecx, ecx
mov dword [ebp - 0x178], ecx
mov dword [ebp - 0x174], ecx
mov dword [ebp - 0x170], ecx
lea edx, [ebp - 0x17c]
push edx
mov eax, dword [ebp - 0x250]
mov ecx, dword [eax + 0x84]
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
mov dword [ebp - 0x20], 0
xor edx, edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x250]
movzx ecx, byte [eax + 0x14d]
test ecx, ecx
je 0x4bde73
mov edx, dword [ebp - 0x250]
mov byte [edx + 0x14b], 1
mov eax, dword [ebp - 0x250]
add eax, 0x164
mov ecx, dword [eax]
mov dword [ebp - 0x20], ecx
mov edx, dword [eax + 4]
mov dword [ebp - 0x1c], edx
mov ecx, dword [eax + 8]
mov dword [ebp - 0x18], ecx
mov edx, dword [eax + 0xc]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x250]
add eax, 0x164
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
je 0x4bde31
mov dword [ebp - 0x20c], 0
push 0x3c
push 0
lea ecx, [ebp - 0x208]
push ecx
call fcn.005eb2b0
add esp, 0xc
lea edx, [ebp - 0x20c]
push edx
mov eax, dword [ebp - 0x250]
mov ecx, dword [eax + 0x84]
push ecx
call dword [sym.imp.USER32.dll_BeginPaint]
lea edx, [ebp - 0x20c]
push edx
mov eax, dword [ebp - 0x250]
mov ecx, dword [eax + 0x84]
push ecx
call dword [sym.imp.USER32.dll_EndPaint]
mov al, 1
jmp 0x4c116d
mov edx, dword [ebp - 0x18]
cmp edx, dword [ebp - 0x174]
jle 0x4bde45
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 0x170]
jle 0x4bde59
mov edx, dword [ebp - 0x170]
mov dword [ebp - 0x14], edx
push 0x10
push 0
mov eax, dword [ebp - 0x250]
add eax, 0x164
push eax
call fcn.005eb2b0
add esp, 0xc
jmp 0x4bde97
push 0
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x250]
mov eax, dword [edx + 0x84]
push eax
call dword [sym.imp.USER32.dll_GetUpdateRect]
test eax, eax
jne 0x4bde97
mov al, 1
jmp 0x4c116d
mov ecx, dword [ebp - 0x250]
movzx edx, byte [ecx + 0x14a]
test edx, edx
je 0x4bdeb5
push 1
mov ecx, dword [ebp - 0x250]
call fcn.004c34b0
push 1
mov ecx, dword [ebp - 0x250]
call fcn.004c3700
mov eax, dword [ebp - 0x250]
movzx ecx, byte [eax + 0x149]
test ecx, ecx
je 0x4be275
mov edx, dword [ebp - 0x250]
mov byte [edx + 0x149], 0
lea eax, [ebp - 0x17c]
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
jne 0x4be270
mov ecx, dword [ebp - 0x250]
mov ecx, dword [ecx + 0xe4]
call fcn.004c5cf0
movzx edx, al
test edx, edx
je 0x4be09c
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x178]
mov dword [ebp - 0x4c], ecx
mov edx, dword [ebp - 0x174]
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x250]
cmp dword [ecx + 0x8c], 0
je 0x4bdf5b
mov edx, dword [ebp - 0x250]
mov eax, dword [edx + 0x8c]
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
mov ecx, dword [ebp - 0x250]
cmp dword [ecx + 0x90], 0
je 0x4bdf7d
mov edx, dword [ebp - 0x250]
mov eax, dword [edx + 0x90]
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
mov ecx, dword [ebp - 0x250]
cmp dword [ecx + 0x94], 0
je 0x4bdf9f
mov edx, dword [ebp - 0x250]
mov eax, dword [edx + 0x94]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, dword [ebp - 0x250]
cmp dword [ecx + 0x9c], 0
je 0x4bdfc1
mov edx, dword [ebp - 0x250]
mov eax, dword [edx + 0x9c]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, dword [ebp - 0x250]
mov dword [ecx + 0x8c], 0
mov edx, dword [ebp - 0x250]
mov dword [edx + 0x90], 0
mov eax, dword [ebp - 0x250]
mov dword [eax + 0x94], 0
mov ecx, dword [ebp - 0x250]
mov dword [ecx + 0x9c], 0
mov edx, dword [ebp - 0x250]
movzx eax, byte [edx + 0x14d]
test eax, eax
je 0x4be05a
mov ecx, dword [ebp - 0x250]
mov edx, dword [ebp - 0x50]
add edx, dword [ecx + 0x150]
mov dword [ebp - 0x50], edx
mov eax, dword [ebp - 0x250]
mov ecx, dword [ebp - 0x4c]
add ecx, dword [eax + 0x154]
mov dword [ebp - 0x4c], ecx
mov edx, dword [ebp - 0x250]
mov eax, dword [ebp - 0x48]
sub eax, dword [edx + 0x158]
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x250]
mov edx, dword [ebp - 0x44]
sub edx, dword [ecx + 0x15c]
mov dword [ebp - 0x44], edx
push 1
sub esp, 0x10
mov eax, esp
mov ecx, dword [ebp - 0x50]
mov dword [eax], ecx
mov edx, dword [ebp - 0x4c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x48]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 0x44]
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 0x250]
mov ecx, dword [eax + 0xe4]
mov edx, dword [ebp - 0x250]
mov eax, dword [ecx]
mov ecx, dword [edx + 0xe4]
mov edx, dword [eax + 0x4c]
call edx
jmp 0x4be1ec
mov dword [ebp - 0x264], 0
mov ecx, dword [ebp - 0x250]
add ecx, 0x32c
call fcn.004b94c0
push reloc.OLEAUT32.dll_VariantCopy
push 0
push 0x4c46c0
mov eax, dword [ebp - 0x250]
mov ecx, dword [eax + 0xe4]
mov edx, dword [ebp - 0x250]
mov eax, dword [ecx]
mov ecx, dword [edx + 0xe4]
mov edx, dword [eax + 0x110]
call edx
mov dword [ebp - 0x2b8], 0
jmp 0x4be100
mov eax, dword [ebp - 0x2b8]
add eax, 1
mov dword [ebp - 0x2b8], eax
mov ecx, dword [ebp - 0x250]
add ecx, 0x32c
call fcn.005105d0
cmp dword [ebp - 0x2b8], eax
jge 0x4be1ec
mov ecx, dword [ebp - 0x2b8]
push ecx
mov ecx, dword [ebp - 0x250]
add ecx, 0x32c
call fcn.004b8f00
mov dword [ebp - 0x264], eax
mov edx, dword [ebp - 0x264]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x264]
mov edx, dword [eax + 0x108]
call edx
movzx eax, al
test eax, eax
jne 0x4be19d
push 1
mov ecx, dword [ebp - 0x264]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x264]
mov eax, dword [edx + 0x40]
call eax
sub esp, 0x10
mov ecx, esp
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov eax, dword [eax + 0xc]
mov dword [ecx + 0xc], eax
mov ecx, dword [ebp - 0x264]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x264]
mov eax, dword [edx + 0x4c]
call eax
jmp 0x4be1e7
push 1
lea ecx, [ebp - 0xe8]
push ecx
mov edx, dword [ebp - 0x264]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x264]
mov edx, dword [eax + 0x44]
call edx
sub esp, 0x10
mov ecx, esp
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov eax, dword [eax + 0xc]
mov dword [ecx + 0xc], eax
mov ecx, dword [ebp - 0x264]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x264]
mov eax, dword [edx + 0x4c]
call eax
jmp 0x4be0f1
mov ecx, dword [ebp - 0x250]
movzx edx, byte [ecx + 0x148]
test edx, edx
je 0x4be270
mov eax, dword [ebp - 0x250]
mov byte [eax + 0x148], 0
push 1
push 0
push 0
push 0
push str.windowinit
mov ecx, dword [ebp - 0x250]
mov edx, dword [ecx + 0xe4]
push edx
mov ecx, dword [ebp - 0x250]
call fcn.004c29b0
mov eax, dword [ebp - 0x250]
movzx ecx, byte [eax + 0x14d]
test ecx, ecx
je 0x4be270
mov edx, dword [ebp - 0x250]
movzx eax, byte [edx + 0x160]
test eax, eax
je 0x4be270
mov ecx, dword [ebp - 0x250]
call fcn.004bd1d0
push 0
mov ecx, dword [ebp - 0x250]
call fcn.004c3700
mov al, 1
jmp 0x4c116d
jmp 0x4be381
mov ecx, dword [ebp - 0x250]
movzx edx, byte [ecx + 0x14d]
test edx, edx
je 0x4be381
mov eax, dword [ebp - 0x250]
movzx ecx, byte [eax + 0x160]
test ecx, ecx
je 0x4be381
mov edx, dword [ebp - 0x17c]
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x174]
mov dword [ebp - 0x38], ecx
mov edx, dword [ebp - 0x170]
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x250]
cmp dword [eax + 0x98], 0
je 0x4be2fc
mov ecx, dword [ebp - 0x38]
sub ecx, dword [ebp - 0x40]
mov edx, dword [ebp - 0x34]
sub edx, dword [ebp - 0x3c]
imul ecx, edx
shl ecx, 2
push ecx
push 0
mov eax, dword [ebp - 0x250]
mov ecx, dword [eax + 0x98]
push ecx
call fcn.005eb2b0
add esp, 0xc
mov edx, dword [ebp - 0x250]
mov eax, dword [ebp - 0x40]
add eax, dword [edx + 0x150]
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x250]
mov edx, dword [ebp - 0x3c]
add edx, dword [ecx + 0x154]
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x250]
mov ecx, dword [ebp - 0x38]
sub ecx, dword [eax + 0x158]
mov dword [ebp - 0x38], ecx
mov edx, dword [ebp - 0x250]
mov eax, dword [ebp - 0x34]
sub eax, dword [edx + 0x15c]
mov dword [ebp - 0x34], eax
push 1
sub esp, 0x10
mov ecx, esp
mov edx, dword [ebp - 0x40]
mov dword [ecx], edx
mov eax, dword [ebp - 0x3c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x38]
mov dword [ecx + 8], edx
mov eax, dword [ebp - 0x34]
mov dword [ecx + 0xc], eax
mov ecx, dword [ebp - 0x250]
mov edx, dword [ecx + 0xe4]
mov eax, dword [ebp - 0x250]
mov edx, dword [edx]
mov ecx, dword [eax + 0xe4]
mov eax, dword [edx + 0x4c]
call eax
mov ecx, dword [ebp - 0x250]
movzx edx, byte [ecx + 0x14b]
test edx, edx
je 0x4be45c
mov eax, dword [ebp - 0x250]
cmp dword [eax + 0x94], 0
jne 0x4be45c
mov ecx, dword [ebp - 0x250]
mov edx, dword [ecx + 0x88]
push edx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ecx, dword [ebp - 0x250]
mov dword [ecx + 0x8c], eax
mov edx, dword [ebp - 0x250]
movzx eax, byte [edx + 0x14d]
test eax, eax
je 0x4be423
mov ecx, dword [ebp - 0x250]
add ecx, 0x98
push ecx
mov edx, dword [ebp - 0x170]
sub edx, dword [ebp - 0x178]
push edx
mov eax, dword [ebp - 0x174]
sub eax, dword [ebp - 0x17c]
push eax
mov ecx, dword [ebp - 0x250]
mov edx, dword [ecx + 0x88]
push edx
call fcn.004ce230
add esp, 0x10
mov ecx, dword [ebp - 0x250]
mov dword [ecx + 0x94], eax
jmp 0x4be45c
mov edx, dword [ebp - 0x170]
sub edx, dword [ebp - 0x178]
push edx
mov eax, dword [ebp - 0x174]
sub eax, dword [ebp - 0x17c]
push eax
mov ecx, dword [ebp - 0x250]
mov edx, dword [ecx + 0x88]
push edx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov ecx, dword [ebp - 0x250]
mov dword [ecx + 0x94], eax
mov dword [ebp - 0x24c], 0
push 0x3c
push 0
lea edx, [ebp - 0x248]
push edx
call fcn.005eb2b0
add esp, 0xc
lea eax, [ebp - 0x24c]
push eax
mov ecx, dword [ebp - 0x250]
mov edx, dword [ecx + 0x84]
push edx
call dword [sym.imp.USER32.dll_BeginPaint]
mov eax, dword [ebp - 0x250]
movzx ecx, byte [eax + 0x14b]
test ecx, ecx
je 0x4befe4
mov edx, dword [ebp - 0x250]
mov eax, dword [edx + 0x94]
push eax
mov ecx, dword [ebp - 0x250]
mov edx, dword [ecx + 0x8c]
push edx
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 0x554], eax
mov eax, dword [ebp - 0x250]
mov ecx, dword [eax + 0x8c]
push ecx
call dword [sym.imp.GDI32.dll_SaveDC]
mov dword [ebp - 0x54c], eax
mov edx, dword [ebp - 0x250]
movzx eax, byte [edx + 0x14d]
test eax, eax
je 0x4be5b3
mov ecx, dword [ebp - 0x250]
cmp dword [ecx + 0x280], 0
jne 0x4be5b3
mov dword [ebp - 0x3a4], 0
mov edx, dword [ebp - 0x170]
sub edx, dword [ebp - 0x14]
mov dword [ebp - 0x2ec], edx
jmp 0x4be539
mov eax, dword [ebp - 0x2ec]
add eax, 1
mov dword [ebp - 0x2ec], eax
mov ecx, dword [ebp - 0x170]
sub ecx, dword [ebp - 0x1c]
cmp dword [ebp - 0x2ec], ecx
jge 0x4be5b3
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x2dc], edx
jmp 0x4be564
mov eax, dword [ebp - 0x2dc]
add eax, 1
mov dword [ebp - 0x2dc], eax
mov ecx, dword [ebp - 0x2dc]
cmp ecx, dword [ebp - 0x18]
jge 0x4be5ae
mov edx, dword [ebp - 0x174]
sub edx, dword [ebp - 0x17c]
imul edx, dword [ebp - 0x2ec]
mov eax, dword [ebp - 0x250]
mov ecx, dword [eax + 0x98]
lea edx, [ecx + edx*4]
mov eax, dword [ebp - 0x2dc]
lea ecx, [edx + eax*4]
mov dword [ebp - 0x3a4], ecx
mov edx, dword [ebp - 0x3a4]
mov dword [edx], 0
jmp 0x4be555
jmp 0x4be52a
push 0
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x250]
mov edx, dword [ecx + 0x8c]
push edx
mov eax, dword [ebp - 0x250]
mov ecx, dword [eax + 0xe4]
mov edx, dword [ebp - 0x250]
mov eax, dword [ecx]
mov ecx, dword [edx + 0xe4]
mov edx, dword [eax + 0x138]
call edx
mov eax, dword [ebp - 0x250]
movzx ecx, byte [eax + 0x14d]
test ecx, ecx
je 0x4be8fa
mov dword [ebp - 0x298], 0
mov ecx, dword [ebp - 0x250]
add ecx, 0x2fc
call fcn.005105d0
cmp dword [ebp - 0x298], eax
jge 0x4be8fa
mov edx, dword [ebp - 0x298]
push edx
mov ecx, dword [ebp - 0x250]
add ecx, 0x2fc
call fcn.004b8f00
mov dword [ebp - 0x300], eax
mov eax, dword [ebp - 0x300]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x4be68c
push 1
mov ecx, dword [ebp - 0x298]
push ecx
mov ecx, dword [ebp - 0x250]
add ecx, 0x2fc
call fcn.004b9e40
push 1
mov edx, dword [ebp - 0x298]
push edx
mov ecx, dword [ebp - 0x250]
add ecx, 0x308
call fcn.004b9e40
jmp 0x4be607
mov eax, dword [ebp - 0x298]
add eax, 1
mov dword [ebp - 0x298], eax
mov ecx, dword [ebp - 0x300]
push ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x4be6b1
jmp 0x4be607
mov edx, dword [ebp - 0x300]
push edx
lea eax, [ebp - 0x18c]
push eax
mov ecx, dword [ebp - 0x250]
call fcn.004bce10
mov dword [ebp - 0x90], 0
xor ecx, ecx
mov dword [ebp - 0x8c], ecx
mov dword [ebp - 0x88], ecx
mov dword [ebp - 0x84], ecx
lea edx, [ebp - 0x18c]
push edx
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x90]
push ecx
call dword [sym.imp.USER32.dll_IntersectRect]
test eax, eax
jne 0x4be709
jmp 0x4be607
mov dword [ebp - 0x308], 0
mov edx, dword [ebp - 0x250]
mov eax, dword [edx + 0x8c]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [ebp - 0x288], eax
lea ecx, [ebp - 0x308]
push ecx
mov edx, dword [ebp - 0x180]
sub edx, dword [ebp - 0x188]
push edx
mov eax, dword [ebp - 0x184]
sub eax, dword [ebp - 0x18c]
push eax
mov ecx, dword [ebp - 0x288]
push ecx
call fcn.004ce230
add esp, 0x10
mov dword [ebp - 0x384], eax
mov edx, dword [ebp - 0x184]
sub edx, dword [ebp - 0x18c]
mov eax, dword [ebp - 0x180]
sub eax, dword [ebp - 0x188]
imul edx, eax
shl edx, 2
push edx
push 0
mov ecx, dword [ebp - 0x308]
push ecx
call fcn.005eb2b0
add esp, 0xc
mov edx, dword [ebp - 0x384]
push edx
mov eax, dword [ebp - 0x288]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 0x590], eax
push 0x35
mov ecx, dword [ebp - 0x288]
push ecx
push 0x317
mov edx, dword [ebp - 0x300]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x2bc], 0
jmp 0x4be7e2
mov eax, dword [ebp - 0x2bc]
add eax, 1
mov dword [ebp - 0x2bc], eax
mov ecx, dword [ebp - 0x180]
sub ecx, dword [ebp - 0x188]
cmp dword [ebp - 0x2bc], ecx
jge 0x4be87c
mov dword [ebp - 0x2c4], 0
jmp 0x4be815
mov edx, dword [ebp - 0x2c4]
add edx, 1
mov dword [ebp - 0x2c4], edx
mov eax, dword [ebp - 0x184]
sub eax, dword [ebp - 0x18c]
cmp dword [ebp - 0x2c4], eax
jge 0x4be877
mov ecx, dword [ebp - 0x184]
sub ecx, dword [ebp - 0x18c]
imul ecx, dword [ebp - 0x2bc]
mov edx, dword [ebp - 0x308]
lea eax, [edx + ecx*4]
mov ecx, dword [ebp - 0x2c4]
lea edx, [eax + ecx*4]
mov dword [ebp - 0x310], edx
mov eax, dword [ebp - 0x310]
cmp dword [eax], 0
je 0x4be875
mov ecx, dword [ebp - 0x310]
mov edx, dword [ecx]
or edx, 0xff000000
mov eax, dword [ebp - 0x310]
mov dword [eax], edx
jmp 0x4be806
jmp 0x4be7d3
push 0xcc0020
push 0
push 0
mov ecx, dword [ebp - 0x288]
push ecx
mov edx, dword [ebp - 0x180]
sub edx, dword [ebp - 0x188]
push edx
mov eax, dword [ebp - 0x184]
sub eax, dword [ebp - 0x18c]
push eax
mov ecx, dword [ebp - 0x188]
push ecx
mov edx, dword [ebp - 0x18c]
push edx
mov eax, dword [ebp - 0x250]
mov ecx, dword [eax + 0x8c]
push ecx
call dword [sym.imp.GDI32.dll_BitBlt]
mov edx, dword [ebp - 0x590]
push edx
mov eax, dword [ebp - 0x288]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [ebp - 0x384]
push ecx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov edx, dword [ebp - 0x288]
push edx
call dword [sym.imp.GDI32.dll_DeleteDC]
jmp 0x4be607
mov dword [ebp - 0x2d0], 0
jmp 0x4be915
mov eax, dword [ebp - 0x2d0]
add eax, 1
mov dword [ebp - 0x2d0], eax
mov ecx, dword [ebp - 0x250]
add ecx, 0x2f0
call fcn.005105d0
cmp dword [ebp - 0x2d0], eax
jge 0x4be975
mov ecx, dword [ebp - 0x2d0]
push ecx
mov ecx, dword [ebp - 0x250]
add ecx, 0x2f0
call fcn.004b8f00
mov dword [ebp - 0x388], eax
lea edx, [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x250]
mov ecx, dword [eax + 0x8c]
push ecx
mov edx, dword [ebp - 0x388]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x388]
mov edx, dword [eax + 0x154]
call edx
jmp 0x4be906
mov eax, dword [ebp - 0x54c]
push eax
mov ecx, dword [ebp - 0x250]
mov edx, dword [ecx + 0x8c]
push edx
call dword [sym.imp.GDI32.dll_RestoreDC]
mov eax, dword [ebp - 0x250]
movzx ecx, byte [eax + 0x14d]
test ecx, ecx
je 0x4beee6
mov dword [ebp - 0x70], 0
xor edx, edx
mov dword [ebp - 0x6c], edx
mov dword [ebp - 0x68], edx
mov dword [ebp - 0x64], edx
lea eax, [ebp - 0x70]
push eax
mov ecx, dword [ebp - 0x250]
mov edx, dword [ecx + 0x84]
push edx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x174]
sub eax, dword [ebp - 0x17c]
mov dword [ebp - 0x290], eax
mov ecx, dword [ebp - 0x170]
sub ecx, dword [ebp - 0x178]
mov dword [ebp - 0x2b0], ecx
mov edx, dword [ebp - 0x17c]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x174]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x170]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x250]
mov ecx, dword [ebp - 0x30]
add ecx, dword [eax + 0x150]
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x250]
mov eax, dword [ebp - 0x2c]
add eax, dword [edx + 0x154]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x250]
mov edx, dword [ebp - 0x28]
sub edx, dword [ecx + 0x158]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x250]
mov ecx, dword [ebp - 0x24]
sub ecx, dword [eax + 0x15c]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x250]
mov eax, dword [edx + 0x98]
mov dword [ebp - 0x2a8], eax
mov ecx, dword [ebp - 0x250]
mov edx, dword [ecx + 0xa0]
mov dword [ebp - 0x3a8], edx
mov byte [ebp - 0x251], 0
mov byte [ebp - 0x265], 0
mov byte [ebp - 0x268], 0
mov byte [ebp - 0x266], 0
mov eax, dword [ebp - 0x250]
cmp dword [eax + 0x280], 0
je 0x4bee32
mov ecx, dword [ebp - 0x250]
cmp dword [ecx + 0x9c], 0
jne 0x4bebec
mov edx, dword [ebp - 0x250]
mov eax, dword [edx + 0x88]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ecx, dword [ebp - 0x250]
mov dword [ecx + 0x90], eax
mov edx, dword [ebp - 0x250]
add edx, 0xa0
push edx
mov eax, dword [ebp - 0x2b0]
push eax
mov ecx, dword [ebp - 0x290]
push ecx
mov edx, dword [ebp - 0x250]
mov eax, dword [edx + 0x88]
push eax
call fcn.004ce230
add esp, 0x10
mov ecx, dword [ebp - 0x250]
mov dword [ecx + 0x9c], eax
mov edx, dword [ebp - 0x290]
imul edx, dword [ebp - 0x2b0]
shl edx, 2
push edx
push 0
mov eax, dword [ebp - 0x250]
mov ecx, dword [eax + 0xa0]
push ecx
call fcn.005eb2b0
add esp, 0xc
mov edx, dword [ebp - 0x250]
mov eax, dword [edx + 0x9c]
push eax
mov ecx, dword [ebp - 0x250]
mov edx, dword [ecx + 0x90]
push edx
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 4], 1
lea eax, [ebp - 0xd8]
push eax
sub esp, 0x10
mov ecx, esp
mov edx, dword [ebp - 0x30]
mov dword [ecx], edx
mov eax, dword [ebp - 0x2c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x28]
mov dword [ecx + 8], edx
mov eax, dword [ebp - 0x24]
mov dword [ecx + 0xc], eax
mov ecx, dword [ebp - 0x250]
mov edx, dword [ecx + 0x90]
push edx
call fcn.004d5130
add esp, 0x18
mov eax, dword [ebp - 0x250]
add eax, 0x174
push eax
lea ecx, [ebp - 0x30]
push ecx
lea edx, [ebp - 0x30]
push edx
mov eax, dword [ebp - 0x250]
push eax
mov ecx, dword [ebp - 0x250]
mov edx, dword [ecx + 0x90]
push edx
call fcn.004d3ea0
add esp, 0x14
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd8]
call fcn.004cdb10
jmp 0x4becab
mov eax, dword [ebp - 0x250]
movzx ecx, byte [eax + 0x160]
test ecx, ecx
je 0x4becab
mov edx, dword [ebp - 0x290]
imul edx, dword [ebp - 0x2b0]
shl edx, 2
push edx
push 0
mov eax, dword [ebp - 0x250]
mov ecx, dword [eax + 0xa0]
push ecx
call fcn.005eb2b0
add esp, 0xc
mov dword [ebp - 4], 2
lea edx, [ebp - 0xbc]
push edx
sub esp, 0x10
mov eax, esp
mov ecx, dword [ebp - 0x30]
mov dword [eax], ecx
mov edx, dword [ebp - 0x2c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x28]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 0x24]
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 0x250]
mov ecx, dword [eax + 0x90]
push ecx
call fcn.004d5130
add esp, 0x18
mov edx, dword [ebp - 0x250]
add edx, 0x174
push edx
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x30]
push ecx
mov edx, dword [ebp - 0x250]
push edx
mov eax, dword [ebp - 0x250]
mov ecx, dword [eax + 0x90]
push ecx
call fcn.004d3ea0
add esp, 0x14
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbc]
call fcn.004cdb10
mov edx, dword [ebp - 0x250]
mov eax, dword [edx + 0x280]
movzx ecx, byte [eax + 0x14]
test ecx, ecx
je 0x4bee32
mov edx, dword [ebp - 0x170]
sub edx, dword [ebp - 0x14]
mov dword [ebp - 0x2a4], edx
jmp 0x4bece3
mov eax, dword [ebp - 0x2a4]
add eax, 1
mov dword [ebp - 0x2a4], eax
mov ecx, dword [ebp - 0x170]
sub ecx, dword [ebp - 0x1c]
cmp dword [ebp - 0x2a4], ecx
jge 0x4bee32
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x2ac], edx
jmp 0x4bed12
mov eax, dword [ebp - 0x2ac]
add eax, 1
mov dword [ebp - 0x2ac], eax
mov ecx, dword [ebp - 0x2ac]
cmp ecx, dword [ebp - 0x18]
jge 0x4bee2d
mov edx, dword [ebp - 0x2a4]
imul edx, dword [ebp - 0x290]
mov eax, dword [ebp - 0x250]
mov ecx, dword [eax + 0x98]
lea edx, [ecx + edx*4]
mov eax, dword [ebp - 0x2ac]
lea ecx, [edx + eax*4]
mov dword [ebp - 0x2a8], ecx
mov edx, dword [ebp - 0x2a4]
imul edx, dword [ebp - 0x290]
mov eax, dword [ebp - 0x250]
mov ecx, dword [eax + 0xa0]
lea edx, [ecx + edx*4]
mov eax, dword [ebp - 0x2ac]
lea ecx, [edx + eax*4]
mov dword [ebp - 0x3a8], ecx
mov edx, dword [ebp - 0x3a8]
mov eax, dword [edx]
shr eax, 0x18
mov byte [ebp - 0x251], al
mov ecx, dword [ebp - 0x2a8]
mov edx, dword [ecx]
shr edx, 0x10
movzx eax, dl
movzx ecx, byte [ebp - 0x251]
imul eax, ecx
cdq
mov ecx, 0xff
idiv ecx
mov byte [ebp - 0x265], al
mov edx, dword [ebp - 0x2a8]
mov eax, dword [edx]
shr eax, 8
movzx eax, al
movzx ecx, byte [ebp - 0x251]
imul eax, ecx
cdq
mov ecx, 0xff
idiv ecx
mov byte [ebp - 0x268], al
mov edx, dword [ebp - 0x2a8]
movzx eax, byte [edx]
movzx ecx, byte [ebp - 0x251]
imul eax, ecx
cdq
mov ecx, 0xff
idiv ecx
mov byte [ebp - 0x266], al
movzx edx, byte [ebp - 0x266]
movzx eax, byte [ebp - 0x268]
shl eax, 8
or edx, eax
movzx ecx, byte [ebp - 0x265]
shl ecx, 0x10
or edx, ecx
movzx eax, byte [ebp - 0x251]
shl eax, 0x18
add edx, eax
mov ecx, dword [ebp - 0x2a8]
mov dword [ecx], edx
jmp 0x4bed03
jmp 0x4becd4
mov byte [ebp - 0x2e0], 0
mov byte [ebp - 0x2df], 0
mov edx, dword [ebp - 0x250]
mov al, byte [edx + 0x14c]
mov byte [ebp - 0x2de], al
mov byte [ebp - 0x2dd], 1
mov ecx, dword [ebp - 0x70]
mov dword [ebp - 0x5dc], ecx
mov edx, dword [ebp - 0x6c]
mov dword [ebp - 0x5d8], edx
mov eax, dword [ebp - 0x290]
mov dword [ebp - 0x5e4], eax
mov ecx, dword [ebp - 0x2b0]
mov dword [ebp - 0x5e0], ecx
mov dword [ebp - 0x5d4], 0
mov dword [ebp - 0x5d0], 0
push 2
lea edx, [ebp - 0x2e0]
push edx
push 0
lea eax, [ebp - 0x5d4]
push eax
mov ecx, dword [ebp - 0x250]
mov edx, dword [ecx + 0x8c]
push edx
lea eax, [ebp - 0x5e4]
push eax
lea ecx, [ebp - 0x5dc]
push ecx
mov edx, dword [ebp - 0x250]
mov eax, dword [edx + 0x88]
push eax
mov ecx, dword [ebp - 0x250]
mov edx, dword [ecx + 0x84]
push edx
call dword [0x6c3e00]
jmp 0x4bef29
push 0xcc0020
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x250]
mov eax, dword [edx + 0x8c]
push eax
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x18]
sub edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x250]
mov eax, dword [edx + 0x88]
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
mov ecx, dword [ebp - 0x554]
push ecx
mov edx, dword [ebp - 0x250]
mov eax, dword [edx + 0x8c]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [ebp - 0x250]
movzx edx, byte [ecx + 0xe1]
test edx, edx
je 0x4befe2
mov eax, dword [ebp - 0x250]
movzx ecx, byte [eax + 0x14d]
test ecx, ecx
jne 0x4befe2
mov edx, dword [0x6c3e04]
push edx
mov eax, dword [ebp - 0x250]
mov ecx, dword [eax + 0x88]
push ecx
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 0x548], eax
push 5
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
mov edx, dword [ebp - 0x250]
mov eax, dword [edx + 0x88]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x250]
mov eax, dword [edx + 0x88]
push eax
call dword [sym.imp.GDI32.dll_Rectangle]
mov ecx, dword [ebp - 0x548]
push ecx
mov edx, dword [ebp - 0x250]
mov eax, dword [edx + 0x88]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
jmp 0x4bf04c
mov ecx, dword [ebp - 0x250]
mov edx, dword [ecx + 0x88]
push edx
call dword [sym.imp.GDI32.dll_SaveDC]
mov dword [ebp - 0x568], eax
push 0
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x250]
mov edx, dword [ecx + 0x88]
push edx
mov eax, dword [ebp - 0x250]
mov ecx, dword [eax + 0xe4]
mov edx, dword [ebp - 0x250]
mov eax, dword [ecx]
mov ecx, dword [edx + 0xe4]
mov edx, dword [eax + 0x138]
call edx
mov eax, dword [ebp - 0x568]
push eax
mov ecx, dword [ebp - 0x250]
mov edx, dword [ecx + 0x88]
push edx
call dword [sym.imp.GDI32.dll_RestoreDC]
lea eax, [ebp - 0x24c]
push eax
mov ecx, dword [ebp - 0x250]
mov edx, dword [ecx + 0x84]
push edx
call dword [sym.imp.USER32.dll_EndPaint]
push 0
mov ecx, dword [ebp - 0x250]
call fcn.004c3700
mov eax, dword [ebp - 0x250]
mov byte [eax + 0x160], 0
mov ecx, dword [ebp - 0x250]
movzx edx, byte [ecx + 0x149]
test edx, edx
je 0x4bf09c
mov ecx, dword [ebp - 0x250]
call fcn.004bd1d0
mov al, 1
jmp 0x4c116d
mov eax, dword [ebp - 0x250]
cmp dword [eax + 0xe4], 0
jne 0x4bf0b7
jmp case.default.0x4bd86f
lea ecx, [ebp - 0xa0]
push ecx
mov edx, dword [ebp - 0x250]
mov eax, dword [edx + 0x84]
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x2e8], ecx
mov edx, dword [ebp - 0x2e8]
push edx
call dword [sym.imp.GDI32.dll_SaveDC]
mov dword [ebp - 0x5ac], eax
push 0
lea eax, [ebp - 0xa0]
push eax
mov ecx, dword [ebp - 0x2e8]
push ecx
mov edx, dword [ebp - 0x250]
mov eax, dword [edx + 0xe4]
mov ecx, dword [ebp - 0x250]
mov edx, dword [eax]
mov ecx, dword [ecx + 0xe4]
mov eax, dword [edx + 0x138]
call eax
mov ecx, dword [ebp + 0x10]
and ecx, 0x10
je 0x4bf1e3
push 5
mov edx, dword [ebp - 0x250]
mov eax, dword [edx + 0x84]
push eax
call dword [sym.imp.USER32.dll_GetWindow]
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 0
je 0x4bf1e3
mov dword [ebp - 0x60], 0
xor ecx, ecx
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x54], ecx
lea edx, [ebp - 0x60]
push edx
mov eax, dword [ebp - 0x2a0]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push 2
lea ecx, [ebp - 0x60]
push ecx
mov edx, dword [ebp - 0x250]
mov eax, dword [edx + 0x84]
push eax
push 0
call dword [sym.imp.USER32.dll_MapWindowPoints]
push 0
mov ecx, dword [ebp - 0x5c]
neg ecx
push ecx
mov edx, dword [ebp - 0x60]
neg edx
push edx
mov eax, dword [ebp - 0x2e8]
push eax
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
mov ecx, dword [ebp + 0x10]
or ecx, 2
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0x317
mov eax, dword [ebp - 0x2a0]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 2
mov ecx, dword [ebp - 0x2a0]
push ecx
call dword [sym.imp.USER32.dll_GetWindow]
mov dword [ebp - 0x2a0], eax
jmp 0x4bf146
mov edx, dword [ebp - 0x5ac]
push edx
mov eax, dword [ebp - 0x2e8]
push eax
call dword [sym.imp.GDI32.dll_RestoreDC]
jmp case.default.0x4bd86f
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x2f0], ecx
mov edx, dword [ebp - 0x250]
cmp dword [edx + 0x104], 0
jle 0x4bf229
mov eax, dword [ebp - 0x2f0]
mov ecx, dword [ebp - 0x250]
mov edx, dword [ecx + 0x104]
mov dword [eax + 0x18], edx
mov eax, dword [ebp - 0x250]
cmp dword [eax + 0x108], 0
jle 0x4bf24d
mov ecx, dword [ebp - 0x2f0]
mov edx, dword [ebp - 0x250]
mov eax, dword [edx + 0x108]
mov dword [ecx + 0x1c], eax
mov ecx, dword [ebp - 0x250]
cmp dword [ecx + 0x10c], 0
jle 0x4bf271
mov edx, dword [ebp - 0x2f0]
mov eax, dword [ebp - 0x250]
mov ecx, dword [eax + 0x10c]
mov dword [edx + 0x20], ecx
mov edx, dword [ebp - 0x250]
cmp dword [edx + 0x110], 0
jle 0x4bf295
mov eax, dword [ebp - 0x2f0]
mov ecx, dword [ebp - 0x250]
mov edx, dword [ecx + 0x110]
mov dword [eax + 0x24], edx
jmp case.default.0x4bd86f
mov eax, dword [ebp - 0x250]
cmp dword [eax + 0xe8], 0
je 0x4bf370
mov dword [ebp - 0x4a4], 0
xor ecx, ecx
mov dword [ebp - 0x4a0], ecx
mov dword [ebp - 0x49c], ecx
mov dword [ebp - 0x498], ecx
mov dword [ebp - 0x494], ecx
mov dword [ebp - 0x490], ecx
mov dword [ebp - 0x48c], ecx
mov dword [ebp - 0x488], ecx
mov dword [ebp - 0x4a4], 0x16
mov edx, dword [ebp - 0x250]
mov eax, dword [edx + 0xe8]
mov dword [ebp - 0x4a0], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x48c], ecx
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x488], edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x49c], eax
mov eax, dword [ebp - 0x250]
mov ecx, dword [eax + 0xfc]
mov edx, dword [eax + 0x100]
mov dword [ebp - 0x498], ecx
mov dword [ebp - 0x494], edx
call fcn.004bd480
mov word [ebp - 0x48e], ax
lea eax, [ebp - 0x4a4]
push eax
mov ecx, dword [ebp - 0x250]
mov edx, dword [ecx + 0xe8]
mov eax, dword [ebp - 0x250]
mov edx, dword [edx]
mov ecx, dword [eax + 0xe8]
mov eax, dword [edx + 0x11c]
call eax
mov ecx, dword [ebp - 0x250]
cmp dword [ecx + 0xe4], 0
je 0x4bf390
mov edx, dword [ebp - 0x250]
mov ecx, dword [edx + 0xe4]
call fcn.004c5f80
mov eax, dword [ebp - 0x250]
movzx ecx, byte [eax + 0x14d]
test ecx, ecx
je 0x4bf3ac
mov ecx, dword [ebp - 0x250]
call fcn.004bd1d0
mov al, 1
jmp 0x4c116d
mov edx, dword [ebp + 0xc]
and edx, 0xffff
movzx eax, dx
cmp eax, 0x2000
jne 0x4bf42b
mov ecx, dword [ebp - 0x250]
movzx edx, byte [ecx + 0x14d]
test edx, edx
je 0x4bf42b
mov eax, dword [ebp - 0x250]
add eax, 0x164
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
jne 0x4bf42b
mov dword [ebp - 0x5a8], 0
mov ecx, dword [ebp - 0x250]
mov edx, dword [ecx + 0x84]
push edx
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
jne 0x4bf426
lea eax, [ebp - 0x5a8]
push eax
push 0
push 0
push 0xf
mov ecx, dword [ebp - 0x250]
call fcn.004bd510
jmp case.default.0x4bd86f
mov dword [ebp - 0x2fc], 0
jmp 0x4bf446
mov ecx, dword [ebp - 0x2fc]
add ecx, 1
mov dword [ebp - 0x2fc], ecx
mov ecx, dword [ebp - 0x250]
add ecx, 0x2cc
call fcn.005105d0
cmp dword [ebp - 0x2fc], eax
jge 0x4bf58c
mov edx, dword [ebp - 0x2fc]
push edx
mov ecx, dword [ebp - 0x250]
add ecx, 0x2cc
call fcn.004b8f00
mov dword [ebp - 0x278], eax
mov eax, dword [ebp - 0x278]
mov ecx, dword [ebp - 0x250]
mov edx, dword [eax + 8]
cmp edx, dword [ecx + 0x84]
jne 0x4bf587
mov eax, dword [ebp + 0xc]
and eax, 0xffff
movzx ecx, ax
mov edx, dword [ebp - 0x278]
cmp dword [edx + 0xc], ecx
jne 0x4bf587
mov eax, dword [ebp - 0x278]
movzx ecx, byte [eax + 0x10]
test ecx, ecx
jne 0x4bf587
mov dword [ebp - 0x504], 0
xor edx, edx
mov dword [ebp - 0x500], edx
mov dword [ebp - 0x4fc], edx
mov dword [ebp - 0x4f8], edx
mov dword [ebp - 0x4f4], edx
mov dword [ebp - 0x4f0], edx
mov dword [ebp - 0x4ec], edx
mov dword [ebp - 0x4e8], edx
mov dword [ebp - 0x504], 0x18
mov eax, dword [ebp - 0x278]
mov ecx, dword [eax]
mov dword [ebp - 0x500], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x4fc], eax
mov edx, dword [ebp - 0x250]
mov eax, dword [edx + 0xfc]
mov ecx, dword [edx + 0x100]
mov dword [ebp - 0x4f8], eax
mov dword [ebp - 0x4f4], ecx
call fcn.004bd480
mov word [ebp - 0x4ee], ax
mov edx, dword [ebp - 0x278]
mov eax, dword [edx + 4]
mov dword [ebp - 0x4ec], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x4e8], ecx
lea edx, [ebp - 0x504]
push edx
mov eax, dword [ebp - 0x278]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x278]
mov eax, dword [ecx]
mov ecx, dword [edx]
mov edx, dword [eax + 0x11c]
call edx
jmp 0x4bf58c
jmp 0x4bf437
jmp case.default.0x4bd86f
mov eax, dword [ebp - 0x250]
movzx ecx, byte [eax + 0xe0]
test ecx, ecx
je 0x4bf5b2
mov edx, dword [ebp + 0x14]
mov dword [edx], 3
mov al, 1
jmp 0x4c116d
jmp case.default.0x4bd86f
mov eax, dword [ebp - 0x250]
cmp dword [eax + 0xe4], 0
jne 0x4bf5cb
jmp case.default.0x4bd86f
mov ecx, dword [ebp - 0x250]
mov byte [ecx + 0x2b8], 0
mov edx, dword [ebp + 0x10]
and edx, 0xffff
movsx eax, dx
mov dword [ebp - 0x320], eax
mov ecx, dword [ebp + 0x10]
shr ecx, 0x10
and ecx, 0xffff
movsx edx, cx
mov dword [ebp - 0x31c], edx
mov eax, dword [ebp - 0x31c]
push eax
mov ecx, dword [ebp - 0x320]
push ecx
mov ecx, dword [ebp - 0x250]
call fcn.004bc320
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 0
jne 0x4bf62c
jmp case.default.0x4bd86f
mov edx, dword [ebp - 0x250]
cmp dword [edx + 0xec], 0
je 0x4bf6fc
mov dword [ebp - 0x544], 0
xor eax, eax
mov dword [ebp - 0x540], eax
mov dword [ebp - 0x53c], eax
mov dword [ebp - 0x538], eax
mov dword [ebp - 0x534], eax
mov dword [ebp - 0x530], eax
mov dword [ebp - 0x52c], eax
mov dword [ebp - 0x528], eax
mov dword [ebp - 0x544], 0xc
mov ecx, dword [ebp - 0x250]
mov edx, dword [ecx + 0xec]
mov dword [ebp - 0x540], edx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x52c], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x528], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x53c], eax
mov edx, dword [ebp - 0x320]
mov dword [ebp - 0x538], edx
mov eax, dword [ebp - 0x31c]
mov dword [ebp - 0x534], eax
call fcn.004bd480
mov word [ebp - 0x52e], ax
lea ecx, [ebp - 0x544]
push ecx
mov edx, dword [ebp - 0x250]
mov eax, dword [edx + 0xec]
mov ecx, dword [ebp - 0x250]
mov edx, dword [eax]
mov ecx, dword [ecx + 0xec]
mov eax, dword [edx + 0x11c]
call eax
lea ecx, [ebp - 0x16c]
push ecx
mov edx, dword [ebp - 0x260]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x260]
mov edx, dword [eax + 0xac]
call edx
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x16c]
call fcn.004b9c50
movzx eax, al
test eax, eax
je 0x4bf756
mov byte [ebp - 0x27d], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x16c]
call fcn.004b8d30
mov al, byte [ebp - 0x27d]
jmp 0x4c116d
lea ecx, [ebp - 0x16c]
push ecx
call fcn.004c15d0
add esp, 4
push 0x2c
push 0
mov edx, dword [ebp - 0x250]
add edx, 0xb0
push edx
call fcn.005eb2b0
add esp, 0xc
mov eax, dword [ebp - 0x250]
mov dword [eax + 0xb0], 0x2c
mov ecx, dword [ebp - 0x250]
mov dword [ecx + 0xb4], 1
mov edx, dword [ebp - 0x250]
mov eax, dword [ebp - 0x250]
mov ecx, dword [eax + 0x84]
mov dword [edx + 0xb8], ecx
mov edx, dword [ebp - 0x250]
mov eax, dword [ebp - 0x250]
mov ecx, dword [eax + 0x84]
mov dword [edx + 0xbc], ecx
mov edx, dword [ebp - 0x250]
mov eax, dword [0x6c3df8]
mov dword [edx + 0xd0], eax
lea ecx, [ebp - 0x16c]
call fcn.004b8f40
mov ecx, dword [ebp - 0x250]
mov dword [ecx + 0xd4], eax
mov edx, dword [ebp - 0x260]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x260]
mov edx, dword [eax + 0x40]
call edx
mov ecx, dword [ebp - 0x250]
add ecx, 0xc0
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov eax, dword [eax + 0xc]
mov dword [ecx + 0xc], eax
mov ecx, dword [ebp - 0x250]
cmp dword [ecx + 0xac], 0
jne 0x4bf92d
push 0
mov edx, dword [0x6c3df8]
push edx
push 0
mov eax, dword [ebp - 0x250]
mov ecx, dword [eax + 0x84]
push ecx
push SysReAllocString
push SysReAllocString
push SysReAllocString
push SysReAllocString
push reloc.WS2_32.dll_closesocket
push 0
push str.tooltips_class32
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov edx, dword [ebp - 0x250]
mov dword [edx + 0xac], eax
mov eax, dword [ebp - 0x250]
add eax, 0xb0
push eax
push 0
push 0x432
mov ecx, dword [ebp - 0x250]
mov edx, dword [ecx + 0xac]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x260]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x260]
mov eax, dword [edx + 0xb8]
call eax
push eax
push 0
push 0x418
mov ecx, dword [ebp - 0x250]
mov edx, dword [ecx + 0xac]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x250]
add eax, 0xb0
push eax
push 0
push 0x436
mov ecx, dword [ebp - 0x250]
mov edx, dword [ecx + 0xac]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x250]
add eax, 0xb0
push eax
push 1
push 0x411
mov ecx, dword [ebp - 0x250]
mov edx, dword [ecx + 0xac]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x250]
cmp dword [eax + 0xf8], 0
jne 0x4bf953
mov ecx, dword [ebp - 0x250]
mov edx, dword [ebp - 0x260]
mov dword [ecx + 0xf8], edx
jmp 0x4bfab1
mov eax, dword [ebp - 0x250]
mov ecx, dword [eax + 0xf8]
cmp ecx, dword [ebp - 0x260]
jne 0x4bfa32
mov edx, dword [ebp - 0x260]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x260]
mov edx, dword [eax + 0xb8]
call edx
mov ecx, dword [ebp - 0x250]
cmp dword [ecx + 0xa8], eax
je 0x4bf9e2
mov edx, dword [ebp - 0x260]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x260]
mov edx, dword [eax + 0xb8]
call edx
push eax
push 0
push 0x418
mov eax, dword [ebp - 0x250]
mov ecx, dword [eax + 0xac]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [ebp - 0x260]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x260]
mov edx, dword [eax + 0xb8]
call edx
mov ecx, dword [ebp - 0x250]
mov dword [ecx + 0xa8], eax
mov edx, dword [ebp - 0x250]
add edx, 0xb0
push edx
push 0
push 0x436
mov eax, dword [ebp - 0x250]
mov ecx, dword [eax + 0xac]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [ebp - 0x250]
add edx, 0xb0
push edx
push 1
push 0x411
mov eax, dword [ebp - 0x250]
mov ecx, dword [eax + 0xac]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x4bfab1
mov edx, dword [ebp - 0x260]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x260]
mov edx, dword [eax + 0xb8]
call edx
push eax
push 0
push 0x418
mov eax, dword [ebp - 0x250]
mov ecx, dword [eax + 0xac]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [ebp - 0x250]
add edx, 0xb0
push edx
push 0
push 0x436
mov eax, dword [ebp - 0x250]
mov ecx, dword [eax + 0xac]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [ebp - 0x250]
add edx, 0xb0
push edx
push 1
push 0x411
mov eax, dword [ebp - 0x250]
mov ecx, dword [eax + 0xac]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [ebp - 0x320]
and edx, 0xffff
movzx eax, dx
mov ecx, dword [ebp - 0x31c]
and ecx, 0xffff
movzx edx, cx
shl edx, 0x10
or eax, edx
push eax
push 0
push 0x412
mov eax, dword [ebp - 0x250]
mov ecx, dword [eax + 0xac]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x16c]
call fcn.004b8d30
mov al, 1
jmp 0x4c116d
mov edx, dword [ebp - 0x250]
cmp dword [edx + 0xe4], 0
jne 0x4bfb1c
jmp case.default.0x4bd86f
mov eax, dword [ebp - 0x250]
cmp dword [eax + 0xac], 0
je 0x4bfb52
mov ecx, dword [ebp - 0x250]
add ecx, 0xb0
push ecx
push 0
push 0x411
mov edx, dword [ebp - 0x250]
mov eax, dword [edx + 0xac]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0x250]
movzx edx, byte [ecx + 0x2b8]
test edx, edx
je 0x4bfcd7
mov dword [ebp - 0x2cc], 0
xor eax, eax
mov dword [ebp - 0x2c8], eax
mov dword [ebp - 0x80], 0
xor ecx, ecx
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x78], ecx
mov dword [ebp - 0x74], ecx
lea edx, [ebp - 0x2cc]
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x80]
push eax
mov ecx, dword [ebp - 0x250]
mov edx, dword [ecx + 0x84]
push edx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x250]
mov ecx, dword [eax + 0x84]
push ecx
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
jne 0x4bfcbb
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov edx, dword [ebp - 0x250]
cmp eax, dword [edx + 0x84]
jne 0x4bfcbb
mov eax, dword [ebp - 0x2c8]
push eax
mov ecx, dword [ebp - 0x2cc]
push ecx
lea edx, [ebp - 0x80]
push edx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x4bfcbb
mov eax, dword [ebp - 0x2cc]
and eax, 0xffff
movzx ecx, ax
mov edx, dword [ebp - 0x2c8]
and edx, 0xffff
movzx eax, dx
shl eax, 0x10
or ecx, eax
push ecx
push 0
push 0x84
mov ecx, dword [ebp - 0x250]
mov edx, dword [ecx + 0x84]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 1
jne 0x4bfc9d
lea eax, [ebp - 0x2cc]
push eax
mov ecx, dword [ebp - 0x250]
mov edx, dword [ecx + 0x84]
push edx
call dword [sym.imp.USER32.dll_ScreenToClient]
mov eax, dword [ebp - 0x2cc]
and eax, 0xffff
movzx ecx, ax
mov edx, dword [ebp - 0x2c8]
and edx, 0xffff
movzx eax, dx
shl eax, 0x10
or ecx, eax
push ecx
push 0
push 0x200
mov ecx, dword [ebp - 0x250]
mov edx, dword [ecx + 0x84]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x4bfcb9
push 0xffffffffffffffff
push 0
push 0x200
mov eax, dword [ebp - 0x250]
mov ecx, dword [eax + 0x84]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x4bfcd7
push 0xffffffffffffffff
push 0
push 0x200
mov edx, dword [ebp - 0x250]
mov eax, dword [edx + 0x84]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0x250]
mov byte [ecx + 0x2b8], 0
jmp case.default.0x4bd86f
mov edx, dword [ebp - 0x250]
cmp dword [edx + 0xe4], 0
jne 0x4bfcfd
jmp case.default.0x4bd86f
mov eax, dword [ebp - 0x250]
movzx ecx, byte [eax + 0x2b8]
test ecx, ecx
jne 0x4bfdc1
mov dword [ebp - 0x444], 0
xor edx, edx
mov dword [ebp - 0x440], edx
mov dword [ebp - 0x43c], edx
mov dword [ebp - 0x438], edx
mov dword [ebp - 0x444], 0x10
mov dword [ebp - 0x440], 3
mov eax, dword [ebp - 0x250]
mov ecx, dword [eax + 0x84]
mov dword [ebp - 0x43c], ecx
mov edx, dword [ebp - 0x250]
cmp dword [edx + 0xac], 0
jne 0x4bfd79
mov eax, dword [ebp - 0x250]
mov ecx, dword [eax + 0xdc]
mov dword [ebp - 0x390], ecx
jmp 0x4bfd9b
push 0
push 3
push 0x415
mov edx, dword [ebp - 0x250]
mov eax, dword [edx + 0xac]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x390], eax
mov ecx, dword [ebp - 0x390]
mov dword [ebp - 0x438], ecx
lea edx, [ebp - 0x444]
push edx
call dword [sym.imp.COMCTL32.dll__TrackMouseEvent]
mov eax, dword [ebp - 0x250]
mov byte [eax + 0x2b8], 1
mov ecx, dword [ebp + 0x10]
and ecx, 0xffff
movsx edx, cx
mov dword [ebp - 0x2f8], edx
mov eax, dword [ebp + 0x10]
shr eax, 0x10
and eax, 0xffff
movsx ecx, ax
mov dword [ebp - 0x2f4], ecx
mov edx, dword [ebp - 0x250]
mov eax, dword [ebp - 0x2f8]
mov dword [edx + 0xfc], eax
mov ecx, dword [ebp - 0x2f4]
mov dword [edx + 0x100], ecx
mov edx, dword [ebp - 0x2f4]
push edx
mov eax, dword [ebp - 0x2f8]
push eax
mov ecx, dword [ebp - 0x250]
call fcn.004bc320
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0
je 0x4bfe4d
mov ecx, dword [ebp - 0x25c]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x25c]
mov eax, dword [edx + 0x24]
call eax
cmp eax, dword [ebp - 0x250]
je 0x4bfe4d
jmp case.default.0x4bd86f
mov dword [ebp - 0x370], 0
xor ecx, ecx
mov dword [ebp - 0x36c], ecx
mov dword [ebp - 0x368], ecx
mov dword [ebp - 0x364], ecx
mov dword [ebp - 0x360], ecx
mov dword [ebp - 0x35c], ecx
mov dword [ebp - 0x358], ecx
mov dword [ebp - 0x354], ecx
mov edx, dword [ebp - 0x2f8]
mov dword [ebp - 0x364], edx
mov eax, dword [ebp - 0x2f4]
mov dword [ebp - 0x360], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x358], ecx
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x354], edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x368], eax
call fcn.004bd480
mov word [ebp - 0x35a], ax
mov ecx, dword [ebp - 0x250]
call fcn.004bd270
movzx eax, al
test eax, eax
jne 0x4c012d
mov ecx, dword [ebp - 0x2f4]
push ecx
mov edx, dword [ebp - 0x2f8]
push edx
mov ecx, dword [ebp - 0x250]
call fcn.004bc320
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0
je 0x4bff23
mov eax, dword [ebp - 0x25c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x25c]
mov eax, dword [edx + 0x24]
call eax
cmp eax, dword [ebp - 0x250]
je 0x4bff23
jmp case.default.0x4bd86f
mov ecx, dword [ebp - 0x250]
mov edx, dword [ebp - 0x25c]
cmp edx, dword [ecx + 0xec]
je 0x4c00cb
mov eax, dword [ebp - 0x250]
cmp dword [eax + 0xec], 0
je 0x4c00cb
mov dword [ebp - 0x370], 0xa
mov ecx, dword [ebp - 0x250]
mov edx, dword [ecx + 0xec]
mov dword [ebp - 0x36c], edx
mov ecx, dword [ebp - 0x250]
add ecx, 0x338
call fcn.005105d0
push eax
lea ecx, [ebp - 0x560]
call fcn.004b8a10
mov dword [ebp - 4], 4
mov ecx, dword [ebp - 0x250]
add ecx, 0x338
call fcn.005105d0
push eax
lea ecx, [ebp - 0x560]
call fcn.004ba230
mov ecx, dword [ebp - 0x250]
add ecx, 0x338
call fcn.005105d0
shl eax, 2
push eax
mov ecx, dword [ebp - 0x250]
add ecx, 0x338
call fcn.004b8f40
push eax
lea ecx, [ebp - 0x560]
call fcn.004b8f40
push eax
call fcn.005e9ba0
add esp, 0xc
mov dword [ebp - 0x304], 0
jmp 0x4c0001
mov eax, dword [ebp - 0x304]
add eax, 1
mov dword [ebp - 0x304], eax
lea ecx, [ebp - 0x560]
call fcn.005105d0
cmp dword [ebp - 0x304], eax
jge 0x4c004b
mov ecx, dword [ebp - 0x304]
push ecx
lea ecx, [ebp - 0x560]
call fcn.004b8f00
mov dword [ebp - 0x3a0], eax
lea edx, [ebp - 0x370]
push edx
mov eax, dword [ebp - 0x3a0]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x3a0]
mov eax, dword [edx + 0x11c]
call eax
jmp 0x4bfff2
lea ecx, [ebp - 0x370]
push ecx
mov edx, dword [ebp - 0x250]
mov eax, dword [edx + 0xec]
mov ecx, dword [ebp - 0x250]
mov edx, dword [eax]
mov ecx, dword [ecx + 0xec]
mov eax, dword [edx + 0x11c]
call eax
mov ecx, dword [ebp - 0x250]
mov dword [ecx + 0xec], 0
mov edx, dword [ebp - 0x250]
cmp dword [edx + 0xac], 0
je 0x4c00b9
mov eax, dword [ebp - 0x250]
add eax, 0xb0
push eax
push 0
push 0x411
mov ecx, dword [ebp - 0x250]
mov edx, dword [ecx + 0xac]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x560]
call fcn.004b8d00
mov eax, dword [ebp - 0x250]
mov ecx, dword [ebp - 0x25c]
cmp ecx, dword [eax + 0xec]
je 0x4c012d
cmp dword [ebp - 0x25c], 0
je 0x4c012d
mov dword [ebp - 0x370], 0xb
mov edx, dword [ebp - 0x25c]
mov dword [ebp - 0x36c], edx
lea eax, [ebp - 0x370]
push eax
mov ecx, dword [ebp - 0x25c]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x25c]
mov eax, dword [edx + 0x11c]
call eax
mov ecx, dword [ebp - 0x250]
mov edx, dword [ebp - 0x25c]
mov dword [ecx + 0xec], edx
mov eax, dword [ebp - 0x250]
cmp dword [eax + 0xf0], 0
je 0x4c0183
mov dword [ebp - 0x370], 9
mov ecx, dword [ebp - 0x250]
mov edx, dword [ecx + 0xf0]
mov dword [ebp - 0x36c], edx
lea eax, [ebp - 0x370]
push eax
mov ecx, dword [ebp - 0x250]
mov edx, dword [ecx + 0xf0]
mov eax, dword [ebp - 0x250]
mov edx, dword [edx]
mov ecx, dword [eax + 0xf0]
mov eax, dword [edx + 0x11c]
call eax
jmp 0x4c01bf
cmp dword [ebp - 0x25c], 0
je 0x4c01bf
mov dword [ebp - 0x370], 9
mov ecx, dword [ebp - 0x25c]
mov dword [ebp - 0x36c], ecx
lea edx, [ebp - 0x370]
push edx
mov eax, dword [ebp - 0x25c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x25c]
mov eax, dword [edx + 0x11c]
call eax
jmp case.default.0x4bd86f
mov ecx, dword [ebp - 0x250]
movzx edx, byte [ecx + 0xe0]
test edx, edx
jne 0x4c01e8
mov eax, dword [ebp - 0x250]
mov ecx, dword [eax + 0x84]
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
mov edx, dword [ebp - 0x250]
cmp dword [edx + 0xe4], 0
jne 0x4c01fc
jmp case.default.0x4bd86f
mov eax, dword [ebp + 0x10]
and eax, 0xffff
movsx ecx, ax
mov dword [ebp - 0x330], ecx
mov edx, dword [ebp + 0x10]
shr edx, 0x10
and edx, 0xffff
movsx eax, dx
mov dword [ebp - 0x32c], eax
mov ecx, dword [ebp - 0x250]
mov edx, dword [ebp - 0x330]
mov dword [ecx + 0xfc], edx
mov eax, dword [ebp - 0x32c]
mov dword [ecx + 0x100], eax
mov ecx, dword [ebp - 0x32c]
push ecx
mov edx, dword [ebp - 0x330]
push edx
mov ecx, dword [ebp - 0x250]
call fcn.004bc320
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 0
jne 0x4c026d
jmp case.default.0x4bd86f
mov eax, dword [ebp - 0x26c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x26c]
mov eax, dword [edx + 0x24]
call eax
cmp eax, dword [ebp - 0x250]
je 0x4c028d
jmp case.default.0x4bd86f
mov ecx, dword [ebp - 0x250]
mov edx, dword [ebp - 0x26c]
mov dword [ecx + 0xf0], edx
mov eax, dword [ebp - 0x26c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x26c]
mov eax, dword [edx + 0x104]
call eax
mov ecx, dword [ebp - 0x250]
call fcn.004c2ac0
mov dword [ebp - 0x464], 0
xor ecx, ecx
mov dword [ebp - 0x460], ecx
mov dword [ebp - 0x45c], ecx
mov dword [ebp - 0x458], ecx
mov dword [ebp - 0x454], ecx
mov dword [ebp - 0x450], ecx
mov dword [ebp - 0x44c], ecx
mov dword [ebp - 0x448], ecx
mov dword [ebp - 0x464], 0xd
mov edx, dword [ebp - 0x26c]
mov dword [ebp - 0x460], edx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x44c], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x448], ecx
mov edx, dword [ebp - 0x330]
mov dword [ebp - 0x458], edx
mov eax, dword [ebp - 0x32c]
mov dword [ebp - 0x454], eax
mov cx, word [ebp + 0xc]
mov word [ebp - 0x44e], cx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x45c], eax
lea edx, [ebp - 0x464]
push edx
mov eax, dword [ebp - 0x26c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x26c]
mov eax, dword [edx + 0x11c]
call eax
jmp case.default.0x4bd86f
mov ecx, dword [ebp - 0x250]
movzx edx, byte [ecx + 0xe0]
test edx, edx
jne 0x4c0393
mov eax, dword [ebp - 0x250]
mov ecx, dword [eax + 0x84]
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
mov edx, dword [ebp + 0x10]
and edx, 0xffff
movsx eax, dx
mov dword [ebp - 0x340], eax
mov ecx, dword [ebp + 0x10]
shr ecx, 0x10
and ecx, 0xffff
movsx edx, cx
mov dword [ebp - 0x33c], edx
mov eax, dword [ebp - 0x250]
mov ecx, dword [ebp - 0x340]
mov dword [eax + 0xfc], ecx
mov edx, dword [ebp - 0x33c]
mov dword [eax + 0x100], edx
mov eax, dword [ebp - 0x33c]
push eax
mov ecx, dword [ebp - 0x340]
push ecx
mov ecx, dword [ebp - 0x250]
call fcn.004bc320
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 0
jne 0x4c0405
jmp case.default.0x4bd86f
mov edx, dword [ebp - 0x27c]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x27c]
mov edx, dword [eax + 0x24]
call edx
cmp eax, dword [ebp - 0x250]
je 0x4c0425
jmp case.default.0x4bd86f
mov ecx, dword [ebp - 0x250]
call fcn.004c2ac0
mov dword [ebp - 0x5cc], 0
xor eax, eax
mov dword [ebp - 0x5c8], eax
mov dword [ebp - 0x5c4], eax
mov dword [ebp - 0x5c0], eax
mov dword [ebp - 0x5bc], eax
mov dword [ebp - 0x5b8], eax
mov dword [ebp - 0x5b4], eax
mov dword [ebp - 0x5b0], eax
mov dword [ebp - 0x5cc], 0x10
mov ecx, dword [ebp - 0x27c]
mov dword [ebp - 0x5c8], ecx
mov edx, dword [ebp - 0x340]
mov dword [ebp - 0x5c0], edx
mov eax, dword [ebp - 0x33c]
mov dword [ebp - 0x5bc], eax
mov cx, word [ebp + 0xc]
mov word [ebp - 0x5b6], cx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x5c4], eax
lea edx, [ebp - 0x5cc]
push edx
mov eax, dword [ebp - 0x27c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x27c]
mov eax, dword [edx + 0x11c]
call eax
mov ecx, dword [ebp - 0x250]
mov edx, dword [ebp - 0x27c]
mov dword [ecx + 0xf0], edx
jmp case.default.0x4bd86f
mov eax, dword [ebp + 0x10]
and eax, 0xffff
movsx ecx, ax
mov dword [ebp - 0x37c], ecx
mov edx, dword [ebp + 0x10]
shr edx, 0x10
and edx, 0xffff
movsx eax, dx
mov dword [ebp - 0x378], eax
mov ecx, dword [ebp - 0x250]
mov edx, dword [ebp - 0x37c]
mov dword [ecx + 0xfc], edx
mov eax, dword [ebp - 0x378]
mov dword [ecx + 0x100], eax
mov ecx, dword [ebp - 0x250]
cmp dword [ecx + 0xf0], 0
jne 0x4c0537
jmp case.default.0x4bd86f
mov ecx, dword [ebp - 0x250]
call fcn.004c1960
mov dword [ebp - 0x524], 0
xor edx, edx
mov dword [ebp - 0x520], edx
mov dword [ebp - 0x51c], edx
mov dword [ebp - 0x518], edx
mov dword [ebp - 0x514], edx
mov dword [ebp - 0x510], edx
mov dword [ebp - 0x50c], edx
mov dword [ebp - 0x508], edx
mov dword [ebp - 0x524], 0xe
mov eax, dword [ebp - 0x250]
mov ecx, dword [eax + 0xf0]
mov dword [ebp - 0x520], ecx
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x50c], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x508], eax
mov ecx, dword [ebp - 0x37c]
mov dword [ebp - 0x518], ecx
mov edx, dword [ebp - 0x378]
mov dword [ebp - 0x514], edx
mov ax, word [ebp + 0xc]
mov word [ebp - 0x50e], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x51c], eax
mov ecx, dword [ebp - 0x250]
mov edx, dword [ecx + 0xf0]
mov dword [ebp - 0x38c], edx
mov eax, dword [ebp - 0x250]
mov dword [eax + 0xf0], 0
lea ecx, [ebp - 0x524]
push ecx
mov edx, dword [ebp - 0x38c]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x38c]
mov edx, dword [eax + 0x11c]
call edx
jmp case.default.0x4bd86f
mov eax, dword [ebp - 0x250]
movzx ecx, byte [eax + 0xe0]
test ecx, ecx
jne 0x4c063d
mov edx, dword [ebp - 0x250]
mov eax, dword [edx + 0x84]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [ebp + 0x10]
and ecx, 0xffff
movsx edx, cx
mov dword [ebp - 0x338], edx
mov eax, dword [ebp + 0x10]
shr eax, 0x10
and eax, 0xffff
movsx ecx, ax
mov dword [ebp - 0x334], ecx
mov edx, dword [ebp - 0x250]
mov eax, dword [ebp - 0x338]
mov dword [edx + 0xfc], eax
mov ecx, dword [ebp - 0x334]
mov dword [edx + 0x100], ecx
mov edx, dword [ebp - 0x334]
push edx
mov eax, dword [ebp - 0x338]
push eax
mov ecx, dword [ebp - 0x250]
call fcn.004bc320
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 0
jne 0x4c06ae
jmp case.default.0x4bd86f
mov ecx, dword [ebp - 0x270]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x270]
mov eax, dword [edx + 0x24]
call eax
cmp eax, dword [ebp - 0x250]
je 0x4c06ce
jmp case.default.0x4bd86f
mov ecx, dword [ebp - 0x270]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x270]
mov eax, dword [edx + 0x104]
call eax
mov dword [ebp - 0x4e4], 0
xor ecx, ecx
mov dword [ebp - 0x4e0], ecx
mov dword [ebp - 0x4dc], ecx
mov dword [ebp - 0x4d8], ecx
mov dword [ebp - 0x4d4], ecx
mov dword [ebp - 0x4d0], ecx
mov dword [ebp - 0x4cc], ecx
mov dword [ebp - 0x4c8], ecx
mov dword [ebp - 0x4e4], 0xf
mov edx, dword [ebp - 0x270]
mov dword [ebp - 0x4e0], edx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x4cc], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x4c8], ecx
mov edx, dword [ebp - 0x338]
mov dword [ebp - 0x4d8], edx
mov eax, dword [ebp - 0x334]
mov dword [ebp - 0x4d4], eax
mov cx, word [ebp + 0xc]
mov word [ebp - 0x4ce], cx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x4dc], eax
lea edx, [ebp - 0x4e4]
push edx
mov eax, dword [ebp - 0x270]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x270]
mov eax, dword [edx + 0x11c]
call eax
mov ecx, dword [ebp - 0x250]
mov edx, dword [ebp - 0x270]
mov dword [ecx + 0xf0], edx
jmp case.default.0x4bd86f
mov eax, dword [ebp - 0x250]
cmp dword [eax + 0xe4], 0
jne 0x4c07b9
jmp case.default.0x4bd86f
mov ecx, dword [ebp - 0x250]
call fcn.004bd270
movzx ecx, al
test ecx, ecx
je 0x4c07d0
jmp case.default.0x4bd86f
mov edx, dword [ebp + 0x10]
and edx, 0xffff
movsx eax, dx
mov dword [ebp - 0x350], eax
mov ecx, dword [ebp + 0x10]
shr ecx, 0x10
and ecx, 0xffff
movsx edx, cx
mov dword [ebp - 0x34c], edx
lea eax, [ebp - 0x350]
push eax
mov ecx, dword [ebp - 0x250]
mov edx, dword [ecx + 0x84]
push edx
call dword [sym.imp.USER32.dll_ScreenToClient]
mov eax, dword [ebp - 0x250]
mov ecx, dword [ebp - 0x350]
mov dword [eax + 0xfc], ecx
mov edx, dword [ebp - 0x34c]
mov dword [eax + 0x100], edx
mov eax, dword [ebp - 0x250]
cmp dword [eax + 0xf0], 0
jne 0x4c0843
jmp case.default.0x4bd86f
mov dword [ebp - 0x58c], 0
xor ecx, ecx
mov dword [ebp - 0x588], ecx
mov dword [ebp - 0x584], ecx
mov dword [ebp - 0x580], ecx
mov dword [ebp - 0x57c], ecx
mov dword [ebp - 0x578], ecx
mov dword [ebp - 0x574], ecx
mov dword [ebp - 0x570], ecx
mov dword [ebp - 0x58c], 0x11
mov edx, dword [ebp - 0x250]
mov eax, dword [edx + 0xf0]
mov dword [ebp - 0x588], eax
mov ecx, dword [ebp - 0x350]
mov dword [ebp - 0x580], ecx
mov edx, dword [ebp - 0x34c]
mov dword [ebp - 0x57c], edx
mov ax, word [ebp + 0xc]
mov word [ebp - 0x576], ax
mov ecx, dword [ebp - 0x250]
mov edx, dword [ecx + 0xf0]
mov dword [ebp - 0x570], edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x584], eax
lea eax, [ebp - 0x58c]
push eax
mov ecx, dword [ebp - 0x250]
mov edx, dword [ecx + 0xf0]
mov eax, dword [ebp - 0x250]
mov edx, dword [edx]
mov ecx, dword [eax + 0xf0]
mov eax, dword [edx + 0x11c]
call eax
mov ecx, dword [ebp - 0x250]
mov dword [ecx + 0xf0], 0
jmp case.default.0x4bd86f
mov edx, dword [ebp - 0x250]
cmp dword [edx + 0xe4], 0
jne 0x4c0928
jmp case.default.0x4bd86f
mov eax, dword [ebp + 0x10]
and eax, 0xffff
movsx ecx, ax
mov dword [ebp - 0x348], ecx
mov edx, dword [ebp + 0x10]
shr edx, 0x10
and edx, 0xffff
movsx eax, dx
mov dword [ebp - 0x344], eax
lea ecx, [ebp - 0x348]
push ecx
mov edx, dword [ebp - 0x250]
mov eax, dword [edx + 0x84]
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
mov ecx, dword [ebp - 0x250]
mov edx, dword [ebp - 0x348]
mov dword [ecx + 0xfc], edx
mov eax, dword [ebp - 0x344]
mov dword [ecx + 0x100], eax
mov ecx, dword [ebp - 0x344]
push ecx
mov edx, dword [ebp - 0x348]
push edx
mov ecx, dword [ebp - 0x250]
call fcn.004bc320
mov dword [ebp - 0x284], eax
cmp dword [ebp - 0x284], 0
jne 0x4c09b3
jmp case.default.0x4bd86f
mov eax, dword [ebp - 0x284]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x284]
mov eax, dword [edx + 0x24]
call eax
cmp eax, dword [ebp - 0x250]
je 0x4c09d3
jmp case.default.0x4bd86f
mov ecx, dword [ebp + 0xc]
shr ecx, 0x10
and ecx, 0xffff
movsx edx, cx
mov dword [ebp - 0x564], edx
mov dword [ebp - 0x484], 0
xor eax, eax
mov dword [ebp - 0x480], eax
mov dword [ebp - 0x47c], eax
mov dword [ebp - 0x478], eax
mov dword [ebp - 0x474], eax
mov dword [ebp - 0x470], eax
mov dword [ebp - 0x46c], eax
mov dword [ebp - 0x468], eax
mov dword [ebp - 0x484], 0x12
mov ecx, dword [ebp - 0x284]
mov dword [ebp - 0x480], ecx
cmp dword [ebp - 0x564], 0
jge 0x4c0a49
mov dword [ebp - 0x394], 1
jmp 0x4c0a53
mov dword [ebp - 0x394], 0
mov edx, dword [ebp - 0x394]
and edx, 0xffff
movzx eax, dx
mov dword [ebp - 0x46c], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x468], ecx
mov edx, dword [ebp - 0x250]
mov eax, dword [edx + 0xfc]
mov ecx, dword [edx + 0x100]
mov dword [ebp - 0x478], eax
mov dword [ebp - 0x474], ecx
call fcn.004bd480
mov word [ebp - 0x46e], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x47c], eax
lea edx, [ebp - 0x484]
push edx
mov eax, dword [ebp - 0x284]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x284]
mov eax, dword [edx + 0x11c]
call eax
mov ecx, dword [ebp - 0x250]
mov edx, dword [ecx + 0xfc]
and edx, 0xffff
movzx eax, dx
mov ecx, dword [ebp - 0x250]
mov edx, dword [ecx + 0x100]
and edx, 0xffff
movzx ecx, dx
shl ecx, 0x10
or eax, ecx
push eax
push 0
push 0x200
mov edx, dword [ebp - 0x250]
mov eax, dword [edx + 0x84]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
jmp case.default.0x4bd86f
mov ecx, dword [ebp - 0x250]
cmp dword [ecx + 0xe4], 0
jne 0x4c0b27
jmp case.default.0x4bd86f
mov edx, dword [ebp - 0x250]
cmp dword [edx + 0xe8], 0
jne 0x4c0b3b
jmp case.default.0x4bd86f
mov dword [ebp - 0x434], 0
xor eax, eax
mov dword [ebp - 0x430], eax
mov dword [ebp - 0x42c], eax
mov dword [ebp - 0x428], eax
mov dword [ebp - 0x424], eax
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x418], eax
mov dword [ebp - 0x434], 5
mov ecx, dword [ebp - 0x250]
mov edx, dword [ecx + 0xe8]
mov dword [ebp - 0x430], edx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x41c], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x418], ecx
mov dx, word [ebp + 0xc]
mov word [ebp - 0x420], dx
mov eax, dword [ebp - 0x250]
mov ecx, dword [eax + 0xfc]
mov edx, dword [eax + 0x100]
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x424], edx
call fcn.004bd480
mov word [ebp - 0x41e], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x42c], eax
lea eax, [ebp - 0x434]
push eax
mov ecx, dword [ebp - 0x250]
mov edx, dword [ecx + 0xe8]
mov eax, dword [ebp - 0x250]
mov edx, dword [edx]
mov ecx, dword [eax + 0xe8]
mov eax, dword [edx + 0x11c]
call eax
jmp case.default.0x4bd86f
mov ecx, dword [ebp - 0x250]
cmp dword [ecx + 0xe4], 0
jne 0x4c0c22
jmp case.default.0x4bd86f
mov edx, dword [ebp - 0x250]
cmp dword [edx + 0xe8], 0
jne 0x4c0c36
jmp case.default.0x4bd86f
mov dword [ebp - 0x414], 0
xor eax, eax
mov dword [ebp - 0x410], eax
mov dword [ebp - 0x40c], eax
mov dword [ebp - 0x408], eax
mov dword [ebp - 0x404], eax
mov dword [ebp - 0x400], eax
mov dword [ebp - 0x3fc], eax
mov dword [ebp - 0x3f8], eax
mov dword [ebp - 0x414], 3
mov ecx, dword [ebp - 0x250]
mov edx, dword [ecx + 0xe8]
mov dword [ebp - 0x410], edx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3fc], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x3f8], ecx
mov dx, word [ebp + 0xc]
mov word [ebp - 0x400], dx
mov eax, dword [ebp - 0x250]
mov ecx, dword [eax + 0xfc]
mov edx, dword [eax + 0x100]
mov dword [ebp - 0x408], ecx
mov dword [ebp - 0x404], edx
call fcn.004bd480
mov word [ebp - 0x3fe], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x40c], eax
lea eax, [ebp - 0x414]
push eax
mov ecx, dword [ebp - 0x250]
mov edx, dword [ecx + 0xe8]
mov eax, dword [ebp - 0x250]
mov edx, dword [edx]
mov ecx, dword [eax + 0xe8]
mov eax, dword [edx + 0x11c]
call eax
mov ecx, dword [ebp - 0x250]
mov edx, dword [ebp - 0x250]
mov eax, dword [edx + 0xe8]
mov dword [ecx + 0xf4], eax
jmp case.default.0x4bd86f
mov ecx, dword [ebp - 0x250]
cmp dword [ecx + 0xe4], 0
jne 0x4c0d35
jmp case.default.0x4bd86f
mov edx, dword [ebp - 0x250]
cmp dword [edx + 0xf4], 0
jne 0x4c0d49
jmp case.default.0x4bd86f
mov dword [ebp - 0x3f4], 0
xor eax, eax
mov dword [ebp - 0x3f0], eax
mov dword [ebp - 0x3ec], eax
mov dword [ebp - 0x3e8], eax
mov dword [ebp - 0x3e4], eax
mov dword [ebp - 0x3e0], eax
mov dword [ebp - 0x3dc], eax
mov dword [ebp - 0x3d8], eax
mov dword [ebp - 0x3f4], 4
mov ecx, dword [ebp - 0x250]
mov edx, dword [ecx + 0xf4]
mov dword [ebp - 0x3f0], edx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3dc], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x3d8], ecx
mov dx, word [ebp + 0xc]
mov word [ebp - 0x3e0], dx
mov eax, dword [ebp - 0x250]
mov ecx, dword [eax + 0xfc]
mov edx, dword [eax + 0x100]
mov dword [ebp - 0x3e8], ecx
mov dword [ebp - 0x3e4], edx
call fcn.004bd480
mov word [ebp - 0x3de], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x3ec], eax
lea eax, [ebp - 0x3f4]
push eax
mov ecx, dword [ebp - 0x250]
mov edx, dword [ecx + 0xf4]
mov eax, dword [ebp - 0x250]
mov edx, dword [edx]
mov ecx, dword [eax + 0xf4]
mov eax, dword [edx + 0x11c]
call eax
mov ecx, dword [ebp - 0x250]
mov dword [ecx + 0xf4], 0
jmp case.default.0x4bd86f
mov edx, dword [ebp - 0x250]
cmp dword [edx + 0xe4], 0
jne 0x4c0e40
jmp case.default.0x4bd86f
mov eax, dword [ebp + 0x10]
and eax, 0xffff
movzx ecx, ax
cmp ecx, 1
je 0x4c0e55
jmp case.default.0x4bd86f
mov edx, dword [ebp - 0x250]
movzx eax, byte [edx + 0x2b9]
test eax, eax
je 0x4c0e6d
mov al, 1
jmp 0x4c116d
mov dword [ebp - 0x318], 0
xor ecx, ecx
mov dword [ebp - 0x314], ecx
lea edx, [ebp - 0x318]
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x318]
push eax
mov ecx, dword [ebp - 0x250]
mov edx, dword [ecx + 0x84]
push edx
call dword [sym.imp.USER32.dll_ScreenToClient]
mov eax, dword [ebp - 0x314]
push eax
mov ecx, dword [ebp - 0x318]
push ecx
mov ecx, dword [ebp - 0x250]
call fcn.004bc320
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0
jne 0x4c0ed3
jmp case.default.0x4bd86f
mov edx, dword [ebp - 0x28c]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x28c]
mov edx, dword [eax + 0x18]
call edx
and eax, 2
jne 0x4c0ef0
jmp case.default.0x4bd86f
mov dword [ebp - 0x4c4], 0
xor eax, eax
mov dword [ebp - 0x4c0], eax
mov dword [ebp - 0x4bc], eax
mov dword [ebp - 0x4b8], eax
mov dword [ebp - 0x4b4], eax
mov dword [ebp - 0x4b0], eax
mov dword [ebp - 0x4ac], eax
mov dword [ebp - 0x4a8], eax
mov dword [ebp - 0x4c4], 0x17
mov ecx, dword [ebp - 0x28c]
mov dword [ebp - 0x4c0], ecx
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x4ac], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x4a8], eax
mov ecx, dword [ebp - 0x318]
mov dword [ebp - 0x4b8], ecx
mov edx, dword [ebp - 0x314]
mov dword [ebp - 0x4b4], edx
call fcn.004bd480
mov word [ebp - 0x4ae], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x4bc], eax
lea eax, [ebp - 0x4c4]
push eax
mov ecx, dword [ebp - 0x28c]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x28c]
mov eax, dword [edx + 0x11c]
call eax
mov al, 1
jmp 0x4c116d
cmp dword [ebp + 0xc], 0
je 0x4c10b4
call dword [sym.imp.USER32.dll_GetFocus]
mov dword [ebp - 0x324], eax
mov dword [ebp - 0x2c0], 0
mov ecx, dword [ebp - 0x324]
push ecx
call dword [sym.imp.USER32.dll_GetParent]
mov dword [ebp - 0x2c0], eax
cmp dword [ebp - 0x2c0], 0
je 0x4c10b4
mov edx, dword [ebp - 0x250]
mov eax, dword [edx + 0x84]
cmp eax, dword [ebp - 0x2c0]
jne 0x4c10a3
mov dword [ebp - 0x294], 0
jmp 0x4c1015
mov ecx, dword [ebp - 0x294]
add ecx, 1
mov dword [ebp - 0x294], ecx
mov ecx, dword [ebp - 0x250]
add ecx, 0x2fc
call fcn.005105d0
cmp dword [ebp - 0x294], eax
jge 0x4c10a1
mov edx, dword [ebp - 0x294]
push edx
mov ecx, dword [ebp - 0x250]
add ecx, 0x2fc
call fcn.004b8f00
cmp eax, dword [ebp - 0x324]
jne 0x4c109c
mov eax, dword [ebp - 0x294]
push eax
mov ecx, dword [ebp - 0x250]
add ecx, 0x308
call fcn.004b8f00
mov ecx, dword [ebp - 0x250]
cmp eax, dword [ecx + 0xe8]
je 0x4c109a
push 0
mov edx, dword [ebp - 0x294]
push edx
mov ecx, dword [ebp - 0x250]
add ecx, 0x308
call fcn.004b8f00
push eax
mov ecx, dword [ebp - 0x250]
call fcn.004c2eb0
jmp 0x4c10a1
jmp 0x4c1006
jmp 0x4c10b4
mov eax, dword [ebp - 0x2c0]
mov dword [ebp - 0x324], eax
jmp 0x4c0fc2
jmp case.default.0x4bd86f
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x374], ecx
cmp dword [ebp - 0x374], 0
je 0x4c10f1
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x2000
push ecx
mov edx, dword [ebp - 0x374]
mov eax, dword [edx]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
mov al, 1
jmp 0x4c116d
cmp dword [ebp + 0x10], 0
jne 0x4c10ff
jmp case.default.0x4bd86f
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x550], edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
add edx, 0x2000
push edx
mov eax, dword [ebp - 0x550]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
mov al, 1
jmp 0x4c116d
cmp dword [ebp + 0x10], 0
jne 0x4c113a
jmp case.default.0x4bd86f
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x5a4], edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
add edx, 0x2000
push edx
mov eax, dword [ebp - 0x5a4]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
mov al, 1
jmp 0x4c116d
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005e9734
mov esp, ebp
pop ebp
ret 0x10