Function at 0x4b2f90
Capabilities:
Create process on windows
Log keystrokes via polling
Resolve function by parsing pe exports
Resume thread
Suspend thread

Disassembly:
push 0xffffffffffffffff
push 0x53c465
mov eax, dword fs:[0]
push eax
mov eax, 0x121c
mov dword fs:[0], esp
call fcn.004ea990
mov eax, dword [0x590f68]
push ebx
push ebp
mov dword [esp + 0x1220], eax
mov eax, dword [esp + 0x1234]
push esi
xor ebp, ebp
cmp eax, ebp
push edi
mov esi, ecx
je 0x4b307e
cmp dword [esi + 0x1f8], ebp
je 0x4b307e
mov eax, dword [esi + 0x30c]
mov eax, dword [eax + 0xf8]
mov ecx, dword [eax + 0x28]
push ecx
xor ebx, ebx
call dword [sym.imp.kernel32.dll_SuspendThread]
push ebp
push 4
push 0x55d8f0
call fcn.00515e6f
cmp eax, 6
je 0x4b300d
mov ebx, 1
mov edi, dword [sym.imp.kernel32.dll_ResumeThread]
jmp 0x4b3020
mov edx, dword [esi + 0x30c]
mov eax, dword [edx + 0xf8]
mov eax, dword [eax + 0x28]
push eax
call edi
cmp eax, 1
jg 0x4b3020
cmp ebx, ebp
jne 0x4b4d15
mov eax, dword [esi + 0x1d4]
or edi, 0xffffffff
cmp eax, edi
je 0x4b3068
push ecx
mov ecx, esp
mov dword [esp + 0x54], esp
push 0x55d8c4
call fcn.004018f0
mov ecx, dword [esi + 0x30c]
call fcn.0048d180
mov ecx, dword [esi + 0x30c]
mov dword [ecx + 0xf4], 1
mov dword [esi + 0x1d4], edi
mov edx, dword [esi + 0x1f8]
xor eax, eax
cmp edx, ebp
sete al
cmp eax, ebp
mov dword [esi + 0x1f8], eax
je 0x4b4bb5
mov eax, dword [esi + 0x1c]
lea edx, [esp + 0xd4]
push edx
push eax
mov dword [esp + 0x58], 3
call dword [sym.imp.user32.dll_GetClientRect]
mov eax, dword [esi + 0x6dc]
cmp eax, ebp
mov edi, dword [sym.imp.kernel32.dll_GlobalFree]
je 0x4b30d2
push eax
call edi
mov dword [esi + 0x6dc], ebp
mov dword [esi + 0x6d8], ebp
mov eax, dword [esi + 0x6e4]
cmp eax, ebp
je 0x4b30eb
push eax
call edi
mov dword [esi + 0x6e4], ebp
mov dword [esi + 0x6e0], ebp
mov eax, dword [esi + 0x6ec]
cmp eax, ebp
je 0x4b3104
push eax
call edi
mov dword [esi + 0x6ec], ebp
mov dword [esi + 0x6e8], ebp
mov eax, dword [esi + 0x6f4]
cmp eax, ebp
je 0x4b311d
push eax
call edi
mov dword [esi + 0x6f4], ebp
mov dword [esi + 0x6f0], ebp
lea ecx, [esi + 0xa4]
call fcn.00496ed0
lea ecx, [esi + 0xf4]
call fcn.00496ed0
push 0x11
mov dword [esp + 0x28], ebp
call dword [sym.imp.user32.dll_GetKeyState]
test ax, ax
jge 0x4b314c
mov dword [esp + 0x24], 1
fld dword [esi + 0x2a4]
fld qword [0x550eb8]
fucompp
fnstsw ax
test ah, 0x44
jnp 0x4b3191
push ebp
push 4
push 0x55d870
call fcn.00515e6f
cmp eax, 6
jne 0x4b3191
mov ecx, esi
mov dword [esi + 0x2a4], 0x3f800000
call fcn.004a8af0
mov ecx, dword [esi + 0x1c]
push 1
push ebp
push ecx
call dword [sym.imp.user32.dll_InvalidateRect]
mov dword [esi + 0x2ac], ebp
mov dword [esi + 0x2b0], ebp
mov dword [esi + 0x1fc], ebp
call fcn.00503c89
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x20], eax
mov dword [esp + 0x1234], ebp
call fcn.00503c89
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x28], eax
mov eax, dword [esi + 0x1e4]
lea edi, [esi + 0x1e4]
push 0x54e04a
push eax
mov byte [esp + 0x123c], 1
call fcn.004ea679
add esp, 8
test eax, eax
je 0x4b332e
push 0x55d868
lea eax, [esp + 0x38]
push edi
push eax
call fcn.00402f80
push 0x5935b4
push eax
lea ecx, [esp + 0x44]
push ecx
mov byte [esp + 0x124c], 2
call fcn.00402ed0
add esp, 0x18
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x1238], 3
call fcn.00402e60
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
mov byte [esp + 0x1234], 2
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4b325d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
mov byte [esp + 0x1234], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4b3283
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push 0x5935b8
lea eax, [esp + 0x30]
push 0x55d860
push eax
call fcn.00404c20
push 0x55d858
push eax
lea ecx, [esp + 0x48]
push ecx
mov byte [esp + 0x124c], 4
call fcn.00402f80
push 0x5935bc
push eax
lea edx, [esp + 0x50]
mov bl, 5
push edx
mov byte [esp + 0x1258], bl
call fcn.00402ed0
add esp, 0x24
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x1238], 6
call fcn.00402e60
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
mov byte [esp + 0x1234], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4b3302
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
mov byte [esp + 0x1234], 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4b3328
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x2c]
jmp 0x4b3369
push 0x5935b4
lea ecx, [esp + 0x2c]
call fcn.00402e60
push 0x5935bc
lea eax, [esp + 0x34]
push 0x5935b8
push eax
call fcn.00402ed0
add esp, 0xc
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x1238], 7
call fcn.00402e60
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
mov byte [esp + 0x1234], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4b3390
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
jmp 0x4b3390
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x20]
push ebp
push esi
push eax
push 0x806
push 0x54e04a
push ecx
push ebp
lea ecx, [esp + 0x998]
call fcn.004fdae9
cmp dword [0x592db8], ebp
mov byte [esp + 0x1234], 8
lea ecx, [esp + 0x97c]
je 0x4b33d7
call fcn.004fd78c
mov dword [eax], 0x4c
jmp 0x4b33e2
call fcn.004fd78c
mov dword [eax], 0x58
mov edx, dword [esi + 0x308]
mov edi, dword [edx + 0x704]
lea ecx, [esp + 0x97c]
call fcn.004fd78c
lea ecx, [esp + 0x97c]
mov dword [eax + 0x2c], edi
call fcn.004fd78c
mov ecx, dword [esi + 0x1c8]
mov dword [eax + 0x18], ecx
call fcn.00503c89
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x18], eax
mov byte [esp + 0x1234], 9
call fcn.00503c89
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x14], eax
mov byte [esp + 0x1234], 0xa
call fcn.00503c89
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x1c], eax
mov eax, dword [esi + 0x1d4]
or edi, 0xffffffff
cmp eax, edi
mov byte [esp + 0x1234], 0xb
mov dword [esi + 0x2f8], ebp
je 0x4b350c
push 3
lea edi, [esi + 0x300]
push 0x553844
mov ecx, edi
call fcn.00401720
push edi
lea ecx, [esp + 0x18]
call fcn.00402e60
lea eax, [esi + 0x1dc]
lea ebx, [esi + 0x2fc]
push eax
mov ecx, ebx
call fcn.00402e60
mov ecx, dword [ebx]
mov edi, dword [ecx - 0xc]
mov eax, ecx
push 0x5c
push eax
call fcn.004ea4f2
add esp, 8
cmp eax, ebp
jne 0x4b34c7
or eax, 0xffffffff
jmp 0x4b34c9
sub eax, dword [ebx]
sub edi, eax
dec edi
push edi
lea edx, [esp + 0x5c]
push edx
mov ecx, ebx
call fcn.00402d10
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x1238], 0xc
call fcn.00402e60
mov eax, dword [esp + 0x58]
add eax, 0xfffffff0
mov byte [esp + 0x1234], 0xb
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x4b3756
lea ecx, [esp + 0x97c]
call fcn.004fd790
cmp eax, 1
jne 0x4b4b62
lea ecx, [esp + 0x97c]
call fcn.004fd78c
mov eax, dword [eax + 0x18]
mov dword [esi + 0x1c8], eax
mov eax, dword [esi + 0x1e4]
push 0x54e04a
push eax
call fcn.004ea679
add esp, 8
test eax, eax
je 0x4b355e
cmp dword [esi + 0x1c8], 1
jne 0x4b355e
mov eax, 1
jmp 0x4b3560
xor eax, eax
lea ecx, [esp + 0x64]
push ecx
lea ecx, [esp + 0x980]
mov dword [esi + 0x1ec], eax
call fcn.004fdc89
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x1238], 0xd
call fcn.00402e60
mov eax, dword [esp + 0x64]
add eax, 0xfffffff0
mov byte [esp + 0x1234], 0xb
lea edx, [eax + 0xc]
mov ecx, edi
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4b35ae
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea eax, [esp + 0x68]
push eax
lea ecx, [esp + 0x980]
call fcn.004fde64
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x1238], 0xe
call fcn.00402e60
mov eax, dword [esp + 0x68]
add eax, 0xfffffff0
mov byte [esp + 0x1234], 0xb
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x4b35f4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ebx, dword [esp + 0x14]
mov eax, dword [ebx - 4]
mov edi, dword [ebx - 0xc]
mov ecx, 1
sub ecx, eax
mov eax, dword [ebx - 8]
sub eax, edi
or eax, ecx
jge 0x4b361c
push edi
lea ecx, [esp + 0x18]
call fcn.00401560
mov ebx, dword [esp + 0x14]
push ebx
call fcn.004ea55d
add esp, 4
cmp edi, ebp
jl 0x4b4b58
cmp edi, dword [ebx - 8]
jg 0x4b4b58
mov dword [ebx - 0xc], edi
mov byte [edi + ebx], 0
mov edi, dword [esp + 0x18]
push 0x2e
push edi
call fcn.004ea4f2
add esp, 8
cmp eax, ebp
jne 0x4b3655
or eax, 0xffffffff
jmp 0x4b3657
sub eax, edi
push eax
lea eax, [esp + 0x64]
push eax
lea ecx, [esp + 0x20]
call fcn.00402d70
lea ebx, [esi + 0x2fc]
push eax
mov ecx, ebx
mov byte [esp + 0x1238], 0xf
call fcn.00402e60
mov eax, dword [esp + 0x60]
add eax, 0xfffffff0
mov byte [esp + 0x1234], 0xb
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4b36a2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea eax, [esp + 0x6c]
push eax
lea ecx, [esp + 0x980]
call fcn.004fdf74
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x1238], 0x10
call fcn.00402e60
mov eax, dword [esp + 0x6c]
add eax, 0xfffffff0
mov byte [esp + 0x1234], 0xb
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4b36eb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea eax, [esp + 0x14]
lea ecx, [esi + 0x300]
push eax
call fcn.00402e60
push 0x5c
push edi
call fcn.004ea4f2
add esp, 8
cmp eax, ebp
jne 0x4b370f
or eax, 0xffffffff
jmp 0x4b3711
sub eax, edi
push eax
lea ecx, [esp + 0x58]
push ecx
lea ecx, [esp + 0x20]
call fcn.00402d70
mov ecx, dword [esi + 0x308]
add ecx, 0x704
push eax
mov byte [esp + 0x1238], 0x11
call fcn.00402e60
mov eax, dword [esp + 0x54]
add eax, 0xfffffff0
mov byte [esp + 0x1234], 0xb
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4b3760
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esi + 0x308]
mov ecx, dword [eax + 0x5cc]
mov dword [eax + 0x5b8], ecx
mov eax, dword [esi + 0x308]
mov edx, dword [eax + 0x5d0]
mov dword [eax + 0x5bc], edx
fild dword [esi + 0x184]
fmul dword [esi + 0x2a4]
fadd dword [0x54fb3c]
call fcn.004eaa58
fild dword [esi + 0x188]
mov edi, eax
mov dword [esi + 0x1a4], edi
fmul dword [esi + 0x2a4]
fadd dword [0x54fb3c]
call fcn.004eaa58
cmp dword [esp + 0x24], ebp
mov dword [esi + 0x1a8], eax
jne 0x4b383c
cmp edi, dword [esi + 0x148]
jg 0x4b37da
cmp eax, dword [esi + 0x14c]
jle 0x4b38b2
mov ecx, dword [esi + 0x30c]
push 0x80e4
mov dword [esi + 0x2f8], 1
call fcn.0048d430
mov ecx, dword [esi + 0x30c]
push 0x80ed
call fcn.00485710
mov eax, dword [esi + 0x1a4]
cmp eax, dword [esi + 0x148]
jg 0x4b3824
mov ecx, dword [esi + 0x1a8]
cmp ecx, dword [esi + 0x14c]
jle 0x4b38b2
mov ecx, dword [esi + 0x30c]
push 0x80ee
call fcn.00485710
mov dword [esp + 0x24], 1
mov ecx, dword [esi + 0x310]
mov edx, dword [ecx]
call dword [edx + 0x58]
mov edi, eax
mov eax, dword [esi + 0x308]
push 0x55d840
add eax, 0x680
push eax
lea ecx, [esp + 0x64]
push ecx
call fcn.00402f80
add esp, 0xc
mov ecx, dword [esi + 0x310]
mov ebp, dword [esp + 0x5c]
mov edx, dword [ecx]
push ebp
mov byte [esp + 0x1238], 0x12
call dword [edx + 0x78]
test edi, edi
je 0x4b3890
mov ecx, dword [esi + 0x310]
mov eax, dword [ecx]
push 1
call dword [eax + 0x5c]
lea eax, [ebp - 0x10]
mov byte [esp + 0x1234], 0xb
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4b38b2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ebp, dword [esp + 0x14]
push 0x5539e8
push ebp
call fcn.004ea679
neg eax
sbb al, al
inc al
movzx edi, al
push 0x5539e4
push ebp
mov dword [esp + 0x48], edi
call fcn.004ea679
add esp, 0x10
neg eax
sbb al, al
inc al
test edi, edi
movzx eax, al
mov dword [esp + 0x34], eax
jne 0x4b38f5
test eax, eax
mov dword [esp + 0x2c], edi
je 0x4b38fd
mov dword [esp + 0x2c], 1
lea ecx, [esp + 0x934]
mov dword [esp + 0x10], 0
call fcn.004dbc60
push 0x58
lea ecx, [esp + 0x938]
mov byte [esp + 0x1238], 0x13
call fcn.004db970
mov ebp, eax
xor eax, eax
mov ecx, 0x16
mov edi, ebp
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x4b3dff
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x4b3dff
mov eax, dword [esp + 0x38]
test eax, eax
mov dword [esp + 0x30], 0
je 0x4b3ac2
lea ecx, [esp + 0x70]
call fcn.00409b70
mov ecx, dword [esi + 0x1a4]
mov eax, dword [esi + 0x1a8]
mov dword [esp + 0xb4], eax
imul eax, ecx
mov dword [esp + 0xb0], ecx
xor edx, edx
lea ecx, [esp + 0xac]
lea eax, [eax + eax*2]
push ecx
lea ecx, [esp + 0x74]
mov byte [esp + 0x1238], 0x14
mov dword [esp + 0xb0], 0x28
mov word [esp + 0xbe], 0x18
mov word [esp + 0xbc], 1
mov dword [esp + 0xc0], edx
mov dword [esp + 0xc4], eax
mov dword [esp + 0xc8], edx
mov dword [esp + 0xcc], edx
mov dword [esp + 0xd0], edx
mov dword [esp + 0xd4], edx
call fcn.00409c40
mov edi, eax
cmp edi, 1
jne 0x4b3a68
mov edx, dword [esi + 0x308]
mov eax, dword [esp + 0x94]
mov dword [edx + 0x688], eax
mov ecx, dword [esi + 0x308]
mov edx, dword [esp + 0x98]
mov dword [ecx + 0x68c], edx
mov eax, dword [esi + 0x308]
mov ecx, dword [esp + 0x74]
mov dword [eax + 0x690], ecx
mov edx, dword [esi + 0x308]
mov eax, dword [esp + 0x78]
mov dword [edx + 0x694], eax
mov ecx, dword [esi + 0x308]
mov edx, dword [esp + 0x7c]
mov dword [ecx + 0x698], edx
mov eax, dword [esi + 0x308]
mov ecx, dword [esp + 0x80]
mov dword [eax + 0x69c], ecx
mov edx, dword [esp + 0x9c]
mov dword [esp + 0x30], edx
lea ecx, [esp + 0x70]
mov byte [esp + 0x1234], 0x13
call fcn.00409bb0
cmp edi, 1
jne 0x4b3de8
mov edi, dword [esi + 0x574]
test edi, edi
je 0x4b3a9c
mov ecx, edi
call fcn.00493ca0
push edi
call fcn.005043e0
add esp, 4
push 0xa0
call fcn.005043b5
add esp, 4
mov dword [esp + 0x38], eax
test eax, eax
mov byte [esp + 0x1234], 0x16
je 0x4b3b38
mov ecx, eax
call fcn.004940f0
jmp 0x4b3b3a
mov eax, dword [esp + 0x34]
test eax, eax
je 0x4b3b25
mov eax, dword [esi + 0x308]
lea edi, [esi + 0x578]
push edi
push eax
push 0
lea ecx, [esp + 0xb4c]
call fcn.004d8480
lea ecx, [esp + 0xb40]
mov byte [esp + 0x1234], 0x15
call fcn.00504c03
cmp eax, 1
mov byte [esp + 0x1234], 0x13
jne 0x4b423b
mov ecx, dword [esp + 0x11cc]
mov dword [edi], ecx
lea ecx, [esp + 0xb40]
call fcn.004d8770
jmp 0x4b3a82
push 0
push 0
push 0x55d824
call fcn.00515e6f
jmp 0x4b3df1
xor eax, eax
test eax, eax
mov byte [esp + 0x1234], 0x13
mov dword [esi + 0x574], eax
je 0x4b4256
call fcn.00503c89
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x34]
test eax, eax
mov byte [esp + 0x1234], 0x17
jne 0x4b3bf1
push 0x55d81c
lea eax, [esp + 0x48]
push ebx
push eax
call fcn.00402f80
add esp, 0xc
mov eax, dword [eax]
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x1238], 0x18
call fcn.004ac250
mov eax, dword [esp + 0x44]
add eax, 0xfffffff0
mov byte [esp + 0x1234], 0x17
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4b3bc0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x30]
mov edi, dword [esp + 0x10]
push eax
push ecx
add edi, 0xfffffff0
mov dword [esp + 0x40], esp
mov ebx, esp
push edi
call fcn.00494020
add eax, 0x10
mov dword [ebx], eax
mov ecx, dword [esi + 0x574]
add esp, 4
call fcn.00494bd0
jmp 0x4b3c8a
mov ecx, dword [esi + 0x574]
mov edx, dword [esi + 0x1a4]
mov dword [ecx + 0x24], edx
mov eax, dword [esi + 0x574]
mov ecx, dword [esi + 0x1a8]
push 0x55d814
lea edx, [esp + 0x40]
push ebx
push edx
mov dword [eax + 0x20], ecx
call fcn.00402f80
add esp, 0xc
mov eax, dword [eax]
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x1238], 0x19
call fcn.004ac250
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
mov byte [esp + 0x1234], 0x17
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4b3c5c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esi + 0x578]
mov edi, dword [esp + 0x10]
push eax
push ecx
add edi, 0xfffffff0
mov dword [esp + 0x40], esp
mov ebx, esp
push edi
call fcn.00494020
add eax, 0x10
mov dword [ebx], eax
mov ecx, dword [esi + 0x574]
add esp, 4
call fcn.00494f40
xor edx, edx
cmp eax, edx
je 0x4b4273
mov eax, dword [esi + 0x1a4]
mov ecx, eax
and ecx, 0x80000003
mov dword [esi + 0x1c0], eax
jns 0x4b3caf
dec ecx
or ecx, 0xfffffffc
inc ecx
je 0x4b3cbc
sub eax, ecx
add eax, 4
mov dword [esi + 0x1a4], eax
mov dword [ebp + 0x40], edx
mov word [ebp + 0x3e], 0x18
mov dword [ebp + 0x30], 0x28
mov ecx, dword [esi + 0x1a4]
mov dword [ebp + 0x34], ecx
mov eax, dword [esi + 0x1a8]
mov dword [ebp + 0x38], eax
mov word [ebp + 0x3c], 1
mov eax, dword [esi + 0x1a8]
imul eax, dword [esi + 0x1a4]
lea ecx, [eax + eax*2]
mov dword [ebp + 0x44], ecx
mov dword [ebp + 0x54], edx
mov dword [ebp + 0x50], edx
mov eax, dword [esi + 0x308]
mov ecx, dword [eax + 0x5ac]
mov edx, dword [eax + 0x5b0]
imul ecx, ecx, 0x64
add ecx, edx
mov eax, 0x3b9aca00
cdq
idiv ecx
mov ebx, dword [sym.imp.user32.dll_SetRectEmpty]
push ebp
cdq
mov dword [ebp + 0x2c], edx
mov dword [ebp + 0x28], eax
mov edx, dword [esi + 0x574]
mov dword [edx + 8], eax
mov ecx, dword [ebp + 0x2c]
mov dword [edx + 0xc], ecx
call ebx
lea edx, [ebp + 0x10]
push edx
call ebx
push 0x567390
lea ecx, [esp + 0x938]
call fcn.004db8d0
push 0x5666a0
lea ecx, [esp + 0x938]
call fcn.004db930
push 0
lea ecx, [esp + 0x938]
call fcn.004db920
push 0x567110
lea ecx, [esp + 0x938]
call fcn.004db8f0
mov eax, dword [ebp + 0x44]
push eax
lea ecx, [esp + 0x938]
call fcn.004dbe20
lea ecx, [esp + 0x934]
push ecx
mov ecx, dword [esi + 0x574]
call fcn.004933d0
mov ecx, dword [esi + 0x574]
call fcn.00493400
test eax, eax
je 0x4b4287
mov ecx, dword [esi + 0x574]
call fcn.004943f0
mov dword [esp + 0x10], eax
mov byte [esp + 0x1234], 0x13
lea edx, [edi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x4b3df1
mov ecx, dword [edi]
mov edx, dword [ecx]
push edi
call dword [edx + 4]
jmp 0x4b3df1
cmp edi, 2
je 0x4b4264
mov eax, dword [esi + 0x1c]
push 1
push 0
push eax
call dword [sym.imp.user32.dll_InvalidateRect]
push 0
lea ecx, [esp + 0xe8]
call fcn.00497a70
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x50]
push 0x55d800
push edx
mov byte [esp + 0x1240], 0x1a
call fcn.00404c20
push 0x5539dc
push eax
lea eax, [esp + 0x5c]
push eax
mov byte [esp + 0x124c], 0x1b
call fcn.00402f80
lea ecx, [esi + 0x300]
push ecx
push eax
lea ecx, [esp + 0x60]
push ecx
mov byte [esp + 0x1258], 0x1c
call fcn.00402ed0
add esp, 0x24
mov ecx, dword [eax]
mov edi, dword [esp + 0x774]
lea eax, [ecx - 0x10]
add edi, 0xfffffff0
cmp eax, edi
mov byte [esp + 0x1234], 0x1d
je 0x4b3ecb
mov edx, dword [edi + 0xc]
test edx, edx
lea ebx, [edi + 0xc]
jl 0x4b3eba
mov edx, dword [eax]
cmp edx, dword [edi]
jne 0x4b3eba
push eax
call fcn.00402ae0
mov dword [esp + 0x3c], eax
add esp, 4
or eax, 0xffffffff
lock xadd dword [ebx], eax
dec eax
test eax, eax
jg 0x4b3eaa
mov ecx, dword [edi]
mov edx, dword [ecx]
push edi
call dword [edx + 4]
mov eax, dword [esp + 0x38]
add eax, 0x10
mov dword [esp + 0x774], eax
jmp 0x4b3ecb
mov eax, dword [ecx - 0xc]
push eax
push ecx
lea ecx, [esp + 0x77c]
call fcn.00401720
mov eax, dword [esp + 0x40]
add eax, 0xfffffff0
mov byte [esp + 0x1234], 0x1c
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4b3ef1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x48]
add eax, 0xfffffff0
mov byte [esp + 0x1234], 0x1b
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4b3f17
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x4c]
add eax, 0xfffffff0
mov byte [esp + 0x1234], 0x1a
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4b3f3d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
fld dword [esi + 0x2a4]
mov eax, dword [esi + 0x148]
fmul dword [0x550ea0]
mov ecx, dword [esi + 0x14c]
mov edx, dword [esi + 0x184]
mov dword [esp + 0x790], eax
mov eax, dword [esi + 0x188]
fadd dword [0x54fb3c]
mov dword [esp + 0x794], ecx
mov dword [esp + 0x788], edx
mov dword [esp + 0x78c], eax
call fcn.004eaa58
mov ecx, dword [esp + 0x24]
mov ebx, dword [esp + 0x14]
push 0x553848
push ebx
mov dword [esp + 0x784], eax
mov dword [esp + 0x778], ecx
mov dword [esp + 0x74c], 0
call fcn.004ea679
add esp, 8
test eax, eax
je 0x4b3ffd
push 0x553844
push ebx
call fcn.004ea679
add esp, 8
test eax, eax
je 0x4b3ffd
push 0x553840
push ebx
call fcn.004ea679
add esp, 8
test eax, eax
je 0x4b3ffd
push 0x55383c
push ebx
call fcn.004ea679
add esp, 8
test eax, eax
je 0x4b3ffd
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4b4097
mov edx, dword [esi + 0x24c]
push 0x553848
mov edi, 1
push ebx
mov dword [esp + 0x74c], edi
mov dword [esp + 0x758], edx
call fcn.004ea679
add esp, 8
test eax, eax
je 0x4b4037
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x4b4037
mov dword [esp + 0x764], edi
push 0x553844
push ebx
call fcn.004ea679
add esp, 8
test eax, eax
jne 0x4b4054
mov dword [esp + 0x7a0], 4
push 0x553840
push ebx
call fcn.004ea679
add esp, 8
test eax, eax
jne 0x4b4078
mov dword [esp + 0x7a0], 3
mov dword [esp + 0x768], edi
push 0x55383c
push ebx
call fcn.004ea679
add esp, 8
test eax, eax
jne 0x4b409c
mov dword [esp + 0x7a0], 0x8e
jmp 0x4b409c
mov edi, 1
push 0x55d7fc
push ebx
call fcn.004ea679
add esp, 8
test eax, eax
je 0x4b40c0
push 0x55d7f8
push ebx
call fcn.004ea679
add esp, 8
test eax, eax
jne 0x4b40ce
mov dword [esp + 0x748], edi
mov dword [esp + 0x76c], edi
mov eax, dword [esi + 0x1b0]
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x778], eax
mov eax, dword [esi + 0x284]
xor edx, edx
test eax, eax
mov eax, dword [esi + 0x1e4]
sete dl
push 0x54e04a
push eax
mov dword [esp + 0x75c], ecx
mov dword [esp + 0x768], edx
call fcn.004ea679
add esp, 8
test eax, eax
je 0x4b413c
lea ecx, [esp + 0x97c]
call fcn.004fd78c
cmp dword [eax + 0x18], edi
jne 0x4b413c
mov dword [esp + 0x760], 0
mov dword [esp + 0x750], edi
mov dword [esp + 0x744], edi
cmp dword [esi + 0x1d4], 0xffffffff
jne 0x4b429f
lea ecx, [esp + 0xe4]
call fcn.00504c03
cmp eax, edi
je 0x4b4334
cmp eax, 3
jne 0x4b4319
mov eax, dword [esi + 0x2f8]
test eax, eax
je 0x4b418a
mov ecx, dword [esi + 0x30c]
push 0x80ee
mov dword [esi + 0x2f8], 0
call fcn.00485710
lea ecx, [esp + 0xe4]
mov byte [esp + 0x1234], 0x13
call fcn.00497dc0
lea ecx, [esp + 0x934]
mov byte [esp + 0x1234], 0xb
call fcn.004dbc20
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
mov byte [esp + 0x1234], 0xa
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4b41d8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea eax, [ebx - 0x10]
mov byte [esp + 0x1234], 9
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4b41fa
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov byte [esp + 0x1234], 8
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4b4220
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea ecx, [esp + 0x97c]
mov byte [esp + 0x1234], 1
call fcn.004fda11
xor ebp, ebp
jmp 0x4b3390
lea ecx, [esp + 0xb40]
mov dword [esi + 0x1f8], 0
call fcn.004d8770
jmp 0x4b4af1
push 0
push 0
push 0x55d7d4
call fcn.00515e6f
mov dword [esi + 0x1f8], 0
jmp 0x4b4af1
lea ecx, [esp + 0x10]
mov dword [esi + 0x1f8], edx
call fcn.00494610
jmp 0x4b4af1
lea ecx, [esp + 0x10]
mov dword [esi + 0x1f8], 0
call fcn.00494610
jmp 0x4b4af1
mov ecx, dword [esi + 0x1e0]
mov edx, dword [esi + 0x1d4]
xor eax, eax
test ecx, ecx
mov ecx, dword [esi + 0x308]
sete al
mov dword [esp + 0x750], edi
mov dword [esp + 0x758], edi
mov dword [esi + 0x284], eax
mov eax, dword [esi + 0x184]
mov dword [esp + 0x780], eax
mov dword [esi + 0x1a4], eax
mov eax, dword [esi + 0x188]
mov dword [esp + 0x784], eax
mov dword [esi + 0x1a8], eax
mov dword [ecx + 0x5b8], edx
mov eax, dword [esi + 0x308]
mov ecx, dword [esi + 0x1d8]
mov dword [eax + 0x5bc], ecx
mov dword [esi + 0x1cc], 4
jmp 0x4b43d1
mov edx, dword [esi + 0x2a4]
mov dword [esi + 0x2a8], edx
mov dword [esi + 0x1f8], 0
jmp 0x4b4add
fild dword [esp + 0x77c]
mov ecx, esi
fmul dword [0x550234]
fst dword [esi + 0x2a4]
fstp dword [esi + 0x2a8]
call fcn.004a8af0
mov eax, dword [esi + 0x308]
mov ecx, dword [eax + 0x5bc]
cmp ecx, dword [eax + 0x5d0]
jle 0x4b4386
mov dword [eax + 0x5d0], ecx
mov eax, dword [esi + 0x308]
mov ecx, dword [eax + 0x5d0]
push ecx
mov ecx, dword [esi + 0x30c]
call fcn.0048d390
mov eax, dword [esi + 0x308]
mov edx, dword [eax + 0x5b8]
mov dword [eax + 0x5b4], edx
mov eax, dword [esp + 0x748]
test eax, eax
je 0x4b43b0
mov eax, dword [esp + 0x778]
mov dword [esi + 0x1b0], eax
mov eax, dword [esp + 0x760]
mov ecx, dword [esp + 0x7a0]
xor edx, edx
test eax, eax
sete dl
mov dword [esi + 0x1cc], ecx
mov dword [esi + 0x284], edx
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x750]
xor edi, edi
cmp ecx, edi
mov dword [esi + 0x24c], eax
mov ebx, 0x20
je 0x4b4452
cmp eax, edi
je 0x4b4452
mov ecx, dword [esi + 0x574]
call fcn.004934f0
mov word [ebp + 0x3e], bx
mov eax, dword [esi + 0x1a8]
imul eax, dword [esi + 0x1a4]
shl eax, 2
push 0x5670d0
lea ecx, [esp + 0x938]
mov dword [ebp + 0x44], eax
call fcn.004db8f0
mov ecx, dword [ebp + 0x44]
push ecx
lea ecx, [esp + 0x938]
call fcn.004dbe20
mov ecx, dword [esi + 0x574]
lea edx, [esp + 0x934]
push edx
call fcn.004933d0
mov ecx, dword [esi + 0x574]
call fcn.00493400
cmp dword [esp + 0x24], edi
je 0x4b46e6
call fcn.00503c89
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x24], eax
mov eax, dword [esi + 0x308]
mov ecx, dword [eax + 0x5bc]
mov edx, dword [eax + 0x5b8]
inc ecx
push ecx
inc edx
push edx
lea eax, [esp + 0x2c]
push 0x55d7c0
push eax
mov byte [esp + 0x1244], 0x1e
call fcn.00404c00
mov ecx, dword [esi + 0x308]
add ecx, 0x680
push ecx
lea edx, [esp + 0x58]
push 0x55d7b8
push edx
call fcn.00404c20
push 0x55d798
push eax
lea eax, [esp + 0x60]
push eax
mov byte [esp + 0x125c], 0x1f
call fcn.00402f80
lea ecx, [esi + 0x2fc]
push ecx
push eax
lea edx, [esp + 0x70]
push edx
mov byte [esp + 0x1268], bl
call fcn.00402ed0
push 0x5539dc
push eax
lea eax, [esp + 0x84]
push eax
mov byte [esp + 0x1274], 0x21
call fcn.00402f80
add esp, 0x40
lea ecx, [esp + 0x14]
push ecx
push eax
lea edx, [esp + 0x54]
push edx
mov byte [esp + 0x1240], 0x22
call fcn.00402ed0
lea ecx, [esp + 0x30]
push ecx
push eax
lea edx, [esp + 0x24]
push edx
mov byte [esp + 0x124c], 0x23
call fcn.00402ed0
add esp, 0x18
lea ecx, [esp + 0x4c]
call fcn.004015d0
lea ecx, [esp + 0x48]
call fcn.004015d0
lea ecx, [esp + 0x40]
call fcn.004015d0
lea ecx, [esp + 0x3c]
call fcn.004015d0
mov bl, 0x25
lea ecx, [esp + 0x44]
mov byte [esp + 0x1234], bl
call fcn.004015d0
cmp dword [esi + 0x24c], edi
je 0x4b45f3
lea ecx, [esp + 0x2c]
call fcn.00401a90
mov eax, dword [esp + 0x798]
push eax
lea ecx, [esp + 0x30]
push 0x55d78c
push ecx
mov byte [esp + 0x1240], 0x2a
call fcn.00404c00
add esp, 0xc
lea edx, [esp + 0x2c]
push edx
lea ecx, [esp + 0x14]
call fcn.00405370
cmp dword [esi + 0x284], edi
jne 0x4b45c7
push 0x55d780
lea ecx, [esp + 0x14]
call fcn.00405390
mov eax, dword [esi + 0x308]
cmp dword [eax + 0x28c], edi
je 0x4b45e3
push 0x55d778
lea ecx, [esp + 0x14]
call fcn.00405390
lea ecx, [esp + 0x2c]
mov byte [esp + 0x1234], bl
call fcn.004015d0
mov ecx, dword [esi + 0x308]
cmp dword [ecx + 0x29c], edi
lea ecx, [esp + 0x10]
je 0x4b461b
cmp dword [esi + 0x2e0], edi
je 0x4b4614
push 0x55d770
jmp 0x4b4620
push 0x55d768
jmp 0x4b4620
push 0x55d75c
call fcn.00405390
cmp dword [esi + 0x250], edi
lea ecx, [esp + 0x10]
je 0x4b4647
cmp dword [esi + 0x254], edi
je 0x4b4640
push 0x55d750
jmp 0x4b464c
push 0x55d748
jmp 0x4b464c
push 0x55d73c
call fcn.00405390
push 0x55d730
lea ecx, [esp + 0x14]
call fcn.00405390
mov eax, dword [esi + 0x1c]
mov edx, dword [esp + 0x10]
mov dword [esp + 0x78], eax
mov eax, dword [esi + 0x308]
mov dword [esp + 0x84], edx
mov dword [esp + 0x70], 0x3c
mov dword [esp + 0x74], 0x40
mov dword [esp + 0x7c], edi
mov dword [esp + 0x80], 0x55d718
mov ecx, dword [eax + 0x680]
lea edx, [esp + 0x70]
push edx
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x90], 1
call dword [sym.imp.shell32.dll_ShellExecuteEx]
mov eax, dword [esp + 0xa8]
push 0xffffffffffffffff
push eax
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
lea ecx, [esp + 0x10]
mov dword [esi + 0x1f8], edi
call fcn.004015d0
lea ecx, [esp + 0x24]
call fcn.004015d0
jmp 0x4b4add
cmp dword [esp + 0x2c], edi
je 0x4b48d0
mov ecx, dword [esi + 0x574]
call fcn.004935f0
cmp dword [esp + 0x75c], edi
lea ebp, [esi + 0x580]
mov dword [esi + 0x61c], edi
mov dword [esi + 0x620], edi
mov dword [esi + 0x57c], edi
mov dword [ebp], edi
je 0x4b476b
mov ecx, dword [esi + 0x630]
xor edx, edx
xor eax, eax
cmp ecx, edi
jle 0x4b476b
mov ebx, dword [esp + 0x79c]
cmp eax, edi
jl 0x4b48b4
cmp eax, dword [esi + 0x630]
jge 0x4b48b4
mov ecx, dword [esi + 0x62c]
lea ecx, [ecx + eax*4]
mov ecx, dword [ecx]
cmp dword [ecx + 0x174], edi
je 0x4b4760
cmp edx, ebx
je 0x4b47c2
inc edx
mov ecx, dword [esi + 0x630]
inc eax
cmp eax, ecx
jl 0x4b4734
cmp dword [esi + 0x57c], edi
mov dword [esi + 0x1fc], 1
je 0x4b48d0
mov edx, dword [esi + 0x450]
lea ecx, [esi + 0x584]
push ecx
push ebp
push edx
call dword [0x592964]
test eax, eax
je 0x4b48b9
push edi
push edi
push 0x55d6f4
call fcn.00515e6f
mov eax, dword [esi + 0x57c]
push eax
call dword [0x592978]
mov dword [esi + 0x57c], edi
jmp 0x4b48d0
mov eax, dword [ecx + 0x174]
push 0x8c
lea edx, [esi + 0x584]
push edx
push eax
mov dword [esi + 0x57c], eax
call dword [0x592984]
mov ecx, dword [esi + 0x57c]
lea eax, [esp + 0x24]
push eax
push edi
push edi
push ecx
call dword [0x592990]
mov edx, dword [esp + 0x24]
push edx
call fcn.005043e5
mov edx, dword [esi + 0x57c]
add esp, 4
lea ecx, [esp + 0x24]
push ecx
push eax
push edi
push edx
mov dword [esi + 0x620], eax
call dword [0x592990]
mov ecx, dword [esi + 0x308]
mov eax, 0x3e8
cdq
idiv dword [ecx + 0x5ac]
mov edx, dword [esi + 0x57c]
push eax
push edx
call sub.avifil32.dll_AVIStreamTimeToSample
mov ecx, dword [esi + 0x5b4]
imul ecx, eax
push ecx
mov dword [esi + 0x610], eax
call fcn.005043e5
mov ecx, dword [esi + 0x308]
mov dword [esi + 0x61c], eax
mov eax, dword [ecx + 0x5b8]
imul eax, eax, 0x3e8
cdq
idiv dword [ecx + 0x5ac]
mov edx, dword [esi + 0x57c]
add esp, 4
push eax
push edx
call sub.avifil32.dll_AVIStreamTimeToSample
push 0x28
push eax
mov dword [esi + 0x614], eax
mov eax, dword [esi + 0x57c]
push eax
mov dword [esi + 0x618], edi
call sub.avifil32.dll_AVIStreamFindSample
cmp eax, 0xffffffff
jne 0x4b476b
push edi
push edi
push 0x55d6c8
call fcn.00515e6f
jmp 0x4b476b
call fcn.004fd76e
mov ecx, dword [esp + 0x24]
mov edx, dword [esi + 0x620]
mov eax, dword [ebp]
push ecx
push edx
push edi
push eax
call dword [0x592968]
cmp dword [esi + 0x24c], edi
mov edx, 4
jne 0x4b48e1
mov edx, dword [esp + 0x50]
cmp dword [esp + 0x2c], edi
jne 0x4b490f
mov eax, dword [esi + 0x1a4]
mov ecx, eax
and ecx, 0x80000003
mov dword [esi + 0x1c0], eax
jns 0x4b4902
dec ecx
or ecx, 0xfffffffc
inc ecx
je 0x4b490f
sub eax, ecx
add eax, 4
mov dword [esi + 0x1a4], eax
mov edi, dword [esi + 0x1a8]
imul edi, dword [esi + 0x1a4]
mov ebp, dword [sym.imp.kernel32.dll_GlobalAlloc]
imul edi, edx
push edi
xor ebx, ebx
push ebx
call ebp
cmp eax, ebx
mov dword [esi + 0x6dc], eax
jne 0x4b494c
push ebx
push ebx
push 0x55381c
call fcn.00515e6f
mov dword [esi + 0x1f8], ebx
jmp 0x4b4add
push eax
call dword [sym.imp.kernel32.dll_GlobalLock]
mov ecx, dword [esi + 0x308]
mov dword [esi + 0x6d8], eax
cmp dword [ecx + 0x29c], ebx
je 0x4b4999
push edi
push ebx
call ebp
cmp eax, ebx
mov dword [esi + 0x6e4], eax
jne 0x4b498c
push ebx
push ebx
push 0x55d6a0
call fcn.00515e6f
mov dword [esi + 0x1f8], ebx
jmp 0x4b4add
push eax
call dword [sym.imp.kernel32.dll_GlobalLock]
mov dword [esi + 0x6e0], eax
cmp dword [esi + 0x24c], ebx
je 0x4b4a76
mov edx, dword [esi + 0x1a8]
imul edx, dword [esi + 0x1a4]
push edx
push ebx
call ebp
cmp eax, ebx
mov dword [esi + 0x6ec], eax
jne 0x4b49da
push ebx
push ebx
push 0x55d678
call fcn.00515e6f
mov dword [esi + 0x24c], ebx
mov dword [esi + 0x6e8], ebx
jmp 0x4b49e7
push eax
call dword [sym.imp.kernel32.dll_GlobalLock]
mov dword [esi + 0x6e8], eax
mov eax, dword [esi + 0x308]
cmp dword [eax + 0x29c], ebx
je 0x4b4a2a
push edi
push ebx
call ebp
cmp eax, ebx
mov dword [esi + 0x6f4], eax
jne 0x4b4a1d
push ebx
push ebx
push 0x55d650
call fcn.00515e6f
mov dword [esi + 0x24c], ebx
mov dword [esi + 0x6f0], ebx
jmp 0x4b4a2a
push eax
call dword [sym.imp.kernel32.dll_GlobalLock]
mov dword [esi + 0x6f0], eax
mov ecx, dword [esi + 0x30c]
cmp dword [ecx + 0xd8], ebx
jne 0x4b4a76
lea edi, [esi + 0x54]
push edi
lea ecx, [esi + 0xa4]
call fcn.00497010
test eax, eax
jne 0x4b4a54
push ebx
push ebx
push 0x55d62c
jmp 0x4b4a6b
push edi
lea ecx, [esi + 0xf4]
call fcn.00497010
test eax, eax
jne 0x4b4a76
push ebx
push ebx
push 0x55d608
call fcn.00515e6f
mov dword [esi + 0x24c], ebx
mov edx, dword [esi + 0x30c]
mov ecx, dword [edx + 0x474]
call fcn.0044f8d0
mov eax, dword [esi + 0x308]
mov ecx, dword [eax + 0x5d4]
mov dword [eax + 0x5d8], ecx
mov edx, dword [esi + 0x308]
mov dword [edx + 0x5d4], ebx
cmp dword [esi + 0x1f8], ebx
je 0x4b4add
mov eax, dword [esi + 0x308]
cmp dword [eax + 0x244], ebx
jne 0x4b4add
mov ecx, dword [esi + 0x30c]
mov eax, dword [ecx + 0x478]
mov edx, dword [eax + 0x70]
push 1
push ebx
push edx
call dword [sym.imp.user32.dll_InvalidateRect]
push 1
mov ecx, esi
call fcn.004abd40
lea ecx, [esp + 0xe4]
mov byte [esp + 0x1234], 0x13
call fcn.00497dc0
lea ecx, [esp + 0x934]
mov byte [esp + 0x1234], 0xb
call fcn.004dbc20
lea ecx, [esp + 0x1c]
call fcn.004015d0
lea ecx, [esp + 0x14]
call fcn.004015d0
lea ecx, [esp + 0x18]
call fcn.004015d0
lea ecx, [esp + 0x97c]
mov byte [esp + 0x1234], 1
call fcn.004fda11
lea ecx, [esp + 0x28]
call fcn.004015d0
lea ecx, [esp + 0x20]
mov dword [esp + 0x1234], 0xffffffff
call fcn.004015d0
xor ebp, ebp
jmp 0x4b4d15
push 0x80070057
call fcn.00401120
lea ecx, [esp + 0x1c]
mov dword [esi + 0x1f8], ebp
call fcn.004015d0
lea ecx, [esp + 0x14]
call fcn.004015d0
lea ecx, [esp + 0x18]
call fcn.004015d0
lea ecx, [esp + 0x97c]
mov byte [esp + 0x1234], 1
call fcn.004fda11
lea ecx, [esp + 0x28]
call fcn.004015d0
lea ecx, [esp + 0x20]
mov dword [esp + 0x1234], edi
call fcn.004015d0
jmp 0x4b4d15
mov eax, dword [esi + 0x308]
cmp dword [eax + 0x244], ebp
je 0x4b4bcc
push 1
mov ecx, esi
call fcn.004abd40
mov eax, dword [esi + 0x308]
mov ecx, dword [eax + 0x5d8]
mov dword [eax + 0x5d4], ecx
cmp dword [esi + 0x1fc], ebp
je 0x4b4c6a
mov eax, dword [esi + 0x580]
cmp eax, ebp
je 0x4b4bfb
push eax
call dword [0x592978]
mov eax, dword [esi + 0x61c]
cmp eax, ebp
mov dword [esi + 0x580], ebp
mov dword [esi + 0x57c], ebp
je 0x4b4c1a
push eax
call fcn.005043ea
add esp, 4
mov eax, dword [esi + 0x620]
cmp eax, ebp
mov dword [esi + 0x61c], ebp
je 0x4b4c33
push eax
call fcn.005043ea
add esp, 4
mov ecx, dword [esi + 0x574]
mov dword [esi + 0x620], ebp
call fcn.00493e20
mov edi, dword [esi + 0x574]
cmp edi, ebp
je 0x4b4c5e
mov ecx, edi
call fcn.00493ca0
push edi
call fcn.005043e0
add esp, 4
mov dword [esi + 0x574], ebp
mov dword [esi + 0x1fc], ebp
cmp dword [esi + 0x1ec], ebp
je 0x4b4c95
mov edx, dword [esi + 0x1e8]
mov eax, dword [esi + 0x1f0]
push 1
push ebp
push edx
push eax
push 0x54eb38
push ebp
call dword [sym.imp.shell32.dll_ShellExecuteA]
mov dword [esi + 0x1ec], ebp
mov eax, dword [esi + 0x6dc]
cmp eax, ebp
mov edi, dword [sym.imp.kernel32.dll_GlobalFree]
je 0x4b4cb4
push eax
call edi
mov dword [esi + 0x6dc], ebp
mov dword [esi + 0x6d8], ebp
mov eax, dword [esi + 0x6e4]
cmp eax, ebp
je 0x4b4ccd
push eax
call edi
mov dword [esi + 0x6e4], ebp
mov dword [esi + 0x6e0], ebp
mov eax, dword [esi + 0x6ec]
cmp eax, ebp
je 0x4b4ce6
push eax
call edi
mov dword [esi + 0x6ec], ebp
mov dword [esi + 0x6e8], ebp
mov eax, dword [esi + 0x6f4]
cmp eax, ebp
je 0x4b4cff
push eax
call edi
mov dword [esi + 0x6f4], ebp
mov dword [esi + 0x6f0], ebp
lea ecx, [esi + 0xa4]
call fcn.00496ed0
lea ecx, [esi + 0xf4]
call fcn.00496ed0
cmp dword [esi + 0x1f8], ebp
jne 0x4b4d37
cmp dword [esi + 0x2f8], ebp
je 0x4b4d37
mov ecx, dword [esi + 0x30c]
push 0x80ee
call fcn.00485710
jmp 0x4b4d44
mov ecx, dword [esi + 0x1c]
push 1
push ebp
push ecx
call dword [sym.imp.user32.dll_InvalidateRect]
cmp dword [esi + 0x1f8], ebp
jne 0x4b4d6c
mov edi, dword [esi + 0x574]
cmp edi, ebp
je 0x4b4d6c
mov ecx, edi
call fcn.00493ca0
push edi
call fcn.005043e0
add esp, 4
mov dword [esi + 0x574], ebp
mov ecx, dword [esp + 0x122c]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x1228]
call fcn.004e9911
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1228
ret 4