Function at 0x416c90
Capabilities:
Create thread
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5177c7
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x572c40]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [0xb66c7c]
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x24], edi
mov ecx, dword [eax + ecx*4]
mov eax, dword [0xb62f28]
cmp eax, dword [ecx + 4]
jg 0x417f7a
mov eax, dword [ebp + 0xc]
xorps xmm0, xmm0
movups xmmword [ebp - 0x38], xmm0
cmp eax, 0x110
ja 0x4172d9
je 0x417032
add eax, 0xfffffffb
cmp eax, 0x4e
ja case.0x4174e6.1012
movzx eax, byte [eax + 0x417fc4]
jmp dword [eax*4 + 0x417fb0]
lea eax, [ebp - 0x20]
push eax
push 1
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
movd xmm1, dword [ebp - 0x18]
movd xmm0, dword [ebp - 0x20]
cvtdq2pd xmm1, xmm1
cvtdq2pd xmm0, xmm0
subsd xmm1, xmm0
movd xmm0, dword [ebp - 0x1c]
cvtdq2pd xmm0, xmm0
cvttsd2si eax, xmm1
movd xmm1, dword [ebp - 0x14]
cvtdq2pd xmm1, xmm1
shl eax, 3
mov dword [esi + 0x18], eax
subsd xmm1, xmm0
cvttsd2si eax, xmm1
imul eax, eax, 0x17
mov dword [esi + 0x1c], eax
jmp case.0x4174e6.1012
cmp dword [esi + 4], 0x4e3
jne case.0x4174e6.1012
mov eax, dword [esi + 8]
cmp eax, 0xfffffffb
ja 0x416f6d
je 0x416efe
add eax, 0x19c
cmp eax, 0xa
ja case.0x4174e6.1012
jmp dword [eax*4 + 0x418014]
push 0x40c830
push 0xfffffffffffffffc
push 0
push 0
push 0x110f
push dword [0x57badc]
call dword [sym.imp.USER32.dll_SendMessageA]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov dword [0x57bae0], eax
jmp case.0x4174e6.1012
mov dword [0x57bae0], 0
mov eax, dword [esi + 0x1c]
test eax, eax
je case.0x4174e6.1012
cmp byte [eax], 0
je case.0x4174e6.1012
push eax
imul eax, dword [0x57c900], 0xeb8
push dword [esi + 0x30]
push dword [esi + 0x10]
add eax, dword [0x5664d0]
push eax
call fcn.0040c7b0
jmp 0x417f58
cmp byte [0xb63050], 0
je 0x416e26
push 1
push 0
push edi
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov byte [0xb63050], 0
mov eax, 1
jmp 0x417f5d
mov eax, dword [esi + 0x3c]
mov dword [0xb62f18], eax
test eax, eax
je case.0x4174e6.1012
push edi
mov dword [0xb62f1c], 0
call dword [sym.imp.USER32.dll_SetCapture]
push 0xb63034
push dword [0x57badc]
call dword [sym.imp.USER32.dll_GetClientRect]
push 0
push 9
push 0x110b
push dword [0x57badc]
call dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [ebp - 0x60]
push eax
push 0x104
push 0xb62f30
push dword [0xb62f18]
call fcn.0040c3c0
push 0x120
call fcn.004817a0
add esp, 0x14
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x416ed1
push 0xb62f30
push dword [ebp - 0x48]
mov ecx, eax
push dword [0x57badc]
call fcn.0040b1a0
mov dword [0xb63044], eax
jmp case.0x4174e6.1012
xor eax, eax
mov dword [0xb63044], eax
jmp case.0x4174e6.1012
call fcn.00424010
jmp case.0x4174e6.1012
cmp word [esi + 0xc], 0x2e
jne case.0x4174e6.1012
push 0
push 0x4b7
jmp 0x417002
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x38]
push eax
push dword [0x57badc]
call dword [sym.imp.USER32.dll_ScreenToClient]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [ebp - 0x38]
push eax
push 0
push 0x1111
push dword [0x57badc]
call esi
mov dword [0xb62f20], eax
test eax, eax
je case.0x4174e6.1012
push eax
push 9
push 0x110b
push dword [0x57badc]
call esi
test byte [ebp - 0x30], 0x10
mov ecx, 0x514
mov eax, 0x4b0
cmovne eax, ecx
push eax
call fcn.00421c80
add esp, 4
jmp case.0x4174e6.1012
cmp eax, 0xfffffffd
jne case.0x4174e6.1012
push 0
push 9
push 0x110a
push dword [0x57badc]
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
je case.0x4174e6.1012
imul esi, dword [0x57c900], 0xeb8
push 0
push 0
push 0
push eax
add esi, dword [0x5664d0]
call fcn.0040c3c0
push eax
push esi
call fcn.0040bd30
add esp, 0x18
cmp eax, 0xffffffff
je case.0x4174e6.1012
imul edx, dword [0x57c900], 0xeb8
mov ecx, dword [0x5664d0]
mov edx, dword [edx + ecx + 0xe98]
cmp eax, dword [edx]
jge case.0x4174e6.1012
imul ecx, eax, 0x2740
mov eax, dword [edx + 4]
test byte [eax + ecx + 0x108], 1
je case.0x4174e6.1011
mov byte [0xb63050], 1
push 0
push 0x4b1
push 0x83ed
push dword [0x57c7d4]
call dword [sym.imp.USER32.dll_PostMessageA]
jmp case.0x4174e6.1012
push 0
push 9
push 0x111
push edi
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, 1
jmp 0x417f5d
push 0x56664c
push 0x5664cc
mov dword [0x57c7d8], edi
call fcn.00416480
mov eax, dword [0x57c900]
add esp, 8
mov ecx, 0xb64288
mov dword [0xb6304c], eax
push edi
call fcn.0042d260
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x4e3
push edi
call esi
push 0x406370
push 0xfffffffffffffffc
push 0x412
push edi
mov dword [0x57badc], eax
call esi
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 1
push edi
mov dword [0x579720], eax
call fcn.00416510
push edi
call fcn.00423940
push edi
push 0x5664cc
call fcn.00422420
imul esi, dword [0x57c900], 0xeb8
add esp, 0x14
add esi, dword [0x5664d0]
je 0x4170e4
xor eax, eax
cmp byte [esi + 0x104], al
setne al
push eax
push 0x427
push edi
call fcn.00433a50
push 0xffffffffffffffff
push esi
call fcn.0040c8b0
add esp, 0x14
call fcn.00424010
push 1
push edi
mov ecx, 0x56651c
call fcn.0042f9e0
push 1
push 0x4a0
mov ecx, 0x56651c
call fcn.0042f7a0
push 1
push 0x476
mov ecx, 0x56651c
call fcn.0042f7a0
push 8
push 0x417
mov ecx, 0x56651c
call fcn.0042f7a0
push 8
push 0x418
mov ecx, 0x56651c
call fcn.0042f7a0
push 8
push 0x49d
mov ecx, 0x56651c
call fcn.0042f7a0
push 8
push 0x401
mov ecx, 0x56651c
call fcn.0042f7a0
push 3
push 0x4a1
mov ecx, 0x56651c
call fcn.0042f7a0
push 3
push 0x4e3
mov ecx, 0x56651c
call fcn.0042f7a0
push 4
push 0x4c1
mov ecx, 0x56651c
call fcn.0042f7a0
push 4
push 0x490
mov ecx, 0x56651c
call fcn.0042f7a0
push 4
push 0x40e
mov ecx, 0x56651c
call fcn.0042f7a0
push 8
push 0x4a3
mov ecx, 0x56651c
call fcn.0042f7a0
push 0x100
push 0x411
mov ecx, 0x56651c
call fcn.0042f7a0
push 0x100
push 0x413
mov ecx, 0x56651c
call fcn.0042f7a0
push 0x100
push 0x412
mov ecx, 0x56651c
call fcn.0042f7a0
push 0x100
push 0x3fa
mov ecx, 0x56651c
call fcn.0042f7a0
push 0xc
push 0x4a2
mov ecx, 0x56651c
call fcn.0042f7a0
push 0x100
push 0x4fa
mov ecx, 0x56651c
call fcn.0042f7a0
push 0x100
push 0x3f3
mov ecx, 0x56651c
call fcn.0042f7a0
push 0x100
push 0x3f2
mov ecx, 0x56651c
call fcn.0042f7a0
push 0x100
push 0x3fe
mov ecx, 0x56651c
call fcn.0042f7a0
push 4
push 9
mov ecx, 0x56651c
call fcn.0042f7a0
push 4
push 0x32
mov ecx, 0x56651c
call fcn.0042f7a0
push 4
push 0x409
mov ecx, 0x56651c
call fcn.0042f7a0
push 0xc
push 1
mov ecx, 0x56651c
call fcn.0042f7a0
push 0xc
push 0x3c
mov ecx, 0x56651c
call fcn.0042f7a0
push 0xc
push 2
mov ecx, 0x56651c
call fcn.0042f7a0
mov ecx, 0x56651c
call fcn.0042fb80
jmp case.0x4174e6.1012
cmp eax, 0x200
ja 0x417e5e
je 0x417b1d
sub eax, 0x111
je 0x41737e
sub eax, 1
je 0x41735c
sub eax, 1
jne case.0x4174e6.1012
cmp dword [ebp + 0x10], 0x5432
jne case.0x4174e6.1012
mov ecx, dword [0xb63044]
test ecx, ecx
je case.0x4174e6.1012
push 1
call fcn.0040b560
push dword [0xb62f24]
push 2
push 0x1102
push dword [0x57badc]
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [0xb63044]
push 0
call fcn.0040b560
push 0x5432
push edi
call dword [sym.imp.USER32.dll_KillTimer]
jmp case.0x4174e6.1012
cmp dword [ebp + 0x10], 0xf060
jne case.0x4174e6.1012
push 0
push 2
push 0x111
push edi
call dword [sym.imp.USER32.dll_SendMessageA]
jmp case.0x4174e6.1012
cmp dword [0x57bae0], 0
jne case.0x4174e6.1012
mov ecx, dword [ebp + 0x10]
movzx eax, cx
cmp eax, 0x3f2
ja 0x4174be
je 0x416ef2
dec eax
cmp eax, 0x3b
ja case.0x4174e6.1012
movzx eax, byte [eax + 0x418058]
jmp dword [eax*4 + 0x418040]
push edi
call dword [sym.imp.USER32.dll_DestroyWindow]
push dword [0xb51a00]
mov dword [0x57c7d8], 0
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0x56664c
call fcn.00421f20
call fcn.00423410
push 1
call fcn.00423bc0
add esp, 8
jmp case.0x4174e6.1012
push dword [0xb51a00]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0x56664c
push 0x5664cc
call fcn.00416480
add esp, 8
call fcn.00423410
push 0
push 0x4fa
push 0x111
push edi
call dword [sym.imp.USER32.dll_SendMessageA]
jmp case.0x4174e6.1012
cmp dword [0xb63044], 0
je 0x417458
push 0
push 0
push 0x202
push edi
mov dword [0xb62f1c], 0
call dword [sym.imp.USER32.dll_PostMessageA]
jmp case.0x4174e6.1012
push edi
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0x5664cc
push 0x56664c
mov dword [0x57c7d8], 0
call fcn.00416480
mov eax, dword [0xb6304c]
push 0x56664c
mov dword [0x57c900], eax
call fcn.00421f20
push 1
call fcn.00423bc0
jmp 0x417f58
push 0
push str.WindowManager.chm
mov ecx, 0xb64288
call fcn.0042e760
jmp case.0x4174e6.1012
push 0
push edi
call fcn.0043c1c0
add esp, 8
jmp case.0x4174e6.1012
cmp eax, 0x4fa
ja case.0x4174e6.1012
je 0x417b08
sub eax, 0x3f3
cmp eax, 0x83
ja case.0x4174e6.1012
movzx eax, byte [eax + 0x4180cc]
jmp dword [eax*4 + 0x418094]
shr ecx, 0x10
cmp ecx, 1
jne case.0x4174e6.1012
mov esi, dword [sym.imp.USER32.dll_SendDlgItemMessageA]
push 0
push 0
push 0x147
push 0x476
push edi
call esi
cmp eax, 0xffffffff
je case.0x4174e6.1012
push 0xb62f30
push eax
push 0x148
push 0x476
push edi
call esi
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
not al
and eax, 0xffffff01
push eax
push eax
push 0
push 0
push 0xb62f30
push 0x5664cc
call fcn.004230e0
add esp, 0xc
push eax
call fcn.00423e00
jmp 0x417f58
mov eax, dword [0x57c900]
cmp eax, dword [0x5664cc]
jge case.0x4174e6.1012
imul eax, eax, 0xeb8
add eax, dword [0x5664d0]
push eax
push 0x41a600
push edi
push 0x4d1
push dword [0xb64288]
call dword [sym.imp.USER32.dll_DialogBoxParamA]
cmp eax, 1
jne case.0x4174e6.1012
imul eax, dword [0x57c900], 0xeb8
push 0x5664cc
add eax, dword [0x5664d0]
push eax
call fcn.00422ec0
push edi
push 0x5664cc
call fcn.00422420
imul eax, dword [0x57c900], 0xeb8
push 0xffffffffffffffff
add eax, dword [0x5664d0]
push eax
call fcn.0040c8b0
push 1
push 0x5664cc
call fcn.004222e0
add esp, 0x20
jmp case.0x4174e6.1012
mov eax, dword [0x57c900]
cmp eax, dword [0x5664cc]
jge 0x417621
imul eax, eax, 0xeb8
push 0xffffffffffffffff
add eax, dword [0x5664d0]
push eax
push 0x104
push 0xb62f30
call fcn.0048dea4
add esp, 0x10
jmp 0x417628
mov byte [0xb62f30], 0
push 0x5664cc
push 0x41d690
push edi
push 0x4e4
push dword [0xb64288]
call dword [sym.imp.USER32.dll_DialogBoxParamA]
cmp eax, 1
jne case.0x4174e6.1012
mov eax, dword [0x5664cc]
xor esi, esi
test eax, eax
jle 0x4176a9
mov edi, dword [0x5664d0]
nop
mov ecx, 0xb62f30
mov eax, edi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x417687
test dl, dl
je 0x417683
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x417687
add eax, 2
add ecx, 2
test dl, dl
jne 0x417667
xor eax, eax
jmp 0x41768c
sbb eax, eax
or eax, 1
test eax, eax
jne 0x417696
mov dword [0x57c900], esi
mov eax, dword [0x5664cc]
inc esi
add edi, 0xeb8
cmp esi, eax
jl 0x417660
mov edi, dword [ebp - 0x24]
cmp esi, eax
jne 0x4176b7
mov dword [0x57c900], 0
test eax, eax
jne 0x4176c0
call fcn.004078b0
push edi
push 0x5664cc
call fcn.00422420
imul eax, dword [0x57c900], 0xeb8
push 0xffffffffffffffff
add eax, dword [0x5664d0]
push eax
call fcn.0040c8b0
push 1
push 0x5664cc
call fcn.004222e0
add esp, 0x18
jmp case.0x4174e6.1012
mov eax, dword [0x57c900]
cmp eax, dword [0x5664cc]
jge case.0x4174e6.1012
imul esi, eax, 0xeb8
push 0x427
push edi
add esi, dword [0x5664d0]
call fcn.00432540
push 1
mov byte [esi + 0x104], al
call fcn.00423bc0
add esp, 0xc
jmp case.0x4174e6.1012
mov eax, dword [0x579b28]
test eax, eax
je 0x417755
push eax
call dword [sym.imp.USER32.dll_BringWindowToTop]
push dword [0x579b28]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp case.0x4174e6.1012
push 0
push 0x405900
push 0
push 0x4ce
push 0
call dword [sym.imp.USER32.dll_CreateDialogParamA]
jmp case.0x4174e6.1012
mov eax, dword [0x579b28]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
je 0x41778b
push 0
push 2
push 0x111
push eax
call esi
push 0
push 1
push 0x111
push edi
call esi
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp case.0x4174e6.1012
push 0x4b0
call fcn.00421c80
add esp, 4
jmp case.0x4174e6.1012
imul esi, dword [0x57c900], 0xeb8
add esi, dword [0x5664d0]
cmp byte [esi + 0x104], 0
je case.0x4174e6.1012
push esi
push str.PRF:_Updating_Profile___s_
call fcn.004133e0
push 1
push 0
push 0xffffffffffffffff
push esi
mov byte [esi + 0xeb4], 0
call fcn.00411240
add esp, 0x18
cmp byte [esi + 0x26c], 0
je 0x41781e
lea eax, [ebp - 0x28]
push eax
push 0
push esi
push 0x423590
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x41781e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x57c7d8]
test edx, edx
je case.0x4174e6.1012
imul eax, dword [0x57c900], 0xeb8
add eax, dword [0x5664d0]
nop dword [eax]
mov cl, byte [esi]
cmp cl, byte [eax]
jne 0x417860
test cl, cl
je 0x41785c
mov cl, byte [esi + 1]
cmp cl, byte [eax + 1]
jne 0x417860
add esi, 2
add eax, 2
test cl, cl
jne 0x417840
xor eax, eax
jmp 0x417865
sbb eax, eax
or eax, 1
test eax, eax
jne case.0x4174e6.1012
push 0xffffffffffffffff
push 1
push 0x405
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
jmp case.0x4174e6.1012
imul edi, dword [0x57c900], 0xeb8
add edi, dword [0x5664d0]
cmp byte [edi + 0x104], 0
je case.0x4174e6.1012
cmp byte [edi + 0xeb4], 0
je 0x41795f
push edi
push str.PRF:_Updating_Profile___s_
call fcn.004133e0
mov eax, dword [edi + 0x268]
add esp, 8
mov byte [edi + 0xeb4], 0
sub eax, 0
je 0x417950
sub eax, 1
je 0x41794a
sub eax, 1
jne 0x41795f
mov ecx, dword [edi + 0xe98]
xor esi, esi
cmp dword [ecx], esi
jle 0x41794a
xor edx, edx
mov dword [ebp - 0x24], edx
nop
mov eax, dword [ecx + 4]
add eax, edx
mov dword [ebp - 0x28], eax
test byte [eax + 0x108], 1
jne 0x417936
test esi, esi
js 0x41792f
mov eax, dword [ecx]
dec eax
cmp esi, eax
jg 0x41792f
mov dword [ecx], eax
je 0x41792f
mov ecx, dword [ebp - 0x28]
sub eax, esi
imul eax, eax, 0x2740
push eax
lea eax, [ecx + 0x2740]
push eax
push ecx
call fcn.00482d10
mov edx, dword [ebp - 0x24]
add esp, 0xc
dec esi
sub edx, 0x2740
mov ecx, dword [edi + 0xe98]
inc esi
add edx, 0x2740
mov dword [ebp - 0x24], edx
cmp esi, dword [ecx]
jl 0x4178f0
push 1
push 0
jmp 0x417954
push 1
push 1
push 0xffffffffffffffff
push edi
call fcn.00411240
add esp, 0x10
cmp byte [edi + 0x26c], 0
je 0x417989
lea eax, [ebp - 0x28]
push eax
push 0
push edi
push 0x423590
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x417989
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x57c7d8]
test edx, edx
je case.0x4174e6.1012
imul eax, dword [0x57c900], 0xeb8
add eax, dword [0x5664d0]
nop word [eax + eax]
mov cl, byte [edi]
cmp cl, byte [eax]
jne 0x417860
test cl, cl
je 0x41785c
mov cl, byte [edi + 1]
cmp cl, byte [eax + 1]
jne 0x417860
add edi, 2
add eax, 2
test cl, cl
jne 0x4179b0
xor eax, eax
jmp 0x417865
test esi, esi
je case.0x4174e6.1012
mov ecx, dword [0x57c8fc]
xor edi, edi
test ecx, ecx
jle case.0x4174e6.1012
mov eax, 0x57cb5c
nop dword [eax]
cmp dword [eax], esi
je 0x417a13
inc edi
add eax, 0x5d0
cmp edi, ecx
jl 0x417a00
jmp case.0x4174e6.1012
push 0x57bf8c
mov esi, 0x64
call dword [sym.imp.KERNEL32.dll_TryEnterCriticalSection]
mov dword [ebp - 0x24], eax
test eax, eax
jne 0x417a5a
nop word [eax + eax]
mov ecx, esi
dec esi
test ecx, ecx
jle 0x417a5a
push 0x3e5
push 0xa
mov ecx, 0xb64288
call fcn.0042aaa0
push 0x57bf8c
call dword [sym.imp.KERNEL32.dll_TryEnterCriticalSection]
mov dword [ebp - 0x24], eax
test eax, eax
je 0x417a30
imul esi, dword [0x57c900], 0xeb8
imul eax, edi, 0x5d0
push 1
push 0
add esi, dword [0x5664d0]
add eax, 0x57cb58
push eax
push esi
call fcn.004110e0
push eax
push esi
call fcn.0040c8b0
add esp, 0x18
cmp dword [ebp - 0x24], 0
je case.0x4174e6.1012
push 0x57bf8c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp case.0x4174e6.1012
push 0
push 0x418330
push edi
push 0x4cf
push dword [0xb64288]
call dword [sym.imp.USER32.dll_DialogBoxParamA]
jmp case.0x4174e6.1012
push 0x104
push 0xb62f30
push 0x490
push edi
call dword [sym.imp.USER32.dll_GetDlgItemTextA]
cmp byte [0xb62f30], 0
je case.0x4174e6.1012
imul eax, dword [0x57c900], 0xeb8
push 0xb62f30
add eax, dword [0x5664d0]
push eax
call fcn.0040c290
add esp, 8
jmp case.0x4174e6.1012
push 0xffffffffffffffff
push 1
push 0x405
push edi
call dword [sym.imp.USER32.dll_PostMessageA]
jmp case.0x4174e6.1012
cmp dword [0xb62f18], 0
je case.0x4174e6.1012
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x38]
push eax
push dword [0x57badc]
call dword [sym.imp.USER32.dll_ScreenToClient]
mov ecx, dword [0xb63044]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
test ecx, ecx
je 0x417bbb
mov edx, dword [ebp - 0x34]
cmp edx, dword [ecx + 4]
jl 0x417b68
mov eax, dword [0xb63040]
sub eax, dword [ecx + 4]
cmp edx, eax
jle 0x417bae
push 1
call fcn.0040b560
mov ecx, dword [0xb63044]
xor edx, edx
mov eax, dword [ebp - 0x34]
push 0
cmp eax, dword [ecx + 4]
setge dl
push edx
push 0x115
push dword [0x57badc]
call esi
mov ecx, dword [0xb63044]
push 0
call fcn.0040b560
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x34]
mov ecx, dword [0xb63044]
test ecx, ecx
je 0x417bbb
push edx
push dword [ebp - 0x38]
call fcn.0040bd70
lea eax, [ebp - 0x38]
mov dword [0xb62f1c], 0
push eax
push 0
push 0x1111
push dword [0x57badc]
call esi
mov dword [0xb62f20], eax
test eax, eax
je 0x417c3f
mov dword [ebp - 0x5c], eax
lea eax, [ebp - 0x60]
push eax
push 0
push 0x110c
push dword [0x57badc]
mov dword [ebp - 0x60], 0x48
mov dword [ebp - 0x54], 0x20
call esi
cmp dword [ebp - 0x40], 0
jle 0x417c2e
test byte [ebp - 0x58], 0x20
jne 0x417c2e
mov eax, dword [ebp - 0x5c]
push 0
push 0x3e8
push 0x5432
push edi
mov dword [0xb62f24], eax
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x417c3a
push 0x5432
push edi
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [0xb62f20]
push eax
push dword [0xb62f18]
call fcn.0040bae0
add esp, 8
test al, al
jne case.0x4174e6.1012
mov eax, dword [0xb62f20]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push 1
push 0x1104
push dword [0x57badc]
call esi
movd xmm2, dword [ebp - 0x14]
movd xmm1, dword [ebp - 0x1c]
cvtdq2pd xmm2, xmm2
mov dword [0xb63048], 0
cvtdq2pd xmm1, xmm1
movaps xmm0, xmm2
movd xmm3, dword [ebp - 0x34]
subsd xmm0, xmm1
cvtdq2pd xmm3, xmm3
cvttsd2si eax, xmm0
movd xmm0, eax
xor eax, eax
cvtdq2pd xmm0, xmm0
mulsd xmm0, qword [0x519a18]
addsd xmm1, xmm0
comisd xmm1, xmm3
jbe 0x417cca
mov dword [0xb63048], 0xffffffff
or eax, 0xffffffff
subsd xmm2, xmm0
comisd xmm3, xmm2
jbe 0x417d31
mov eax, dword [0xb62f20]
push 0
push 8
push 0x110b
push dword [0x57badc]
mov dword [0xb63048], 1
mov dword [0xb62f1c], eax
call esi
mov ecx, dword [0xb63044]
test ecx, ecx
je case.0x4174e6.1012
mov edx, dword [ebp - 0x20]
movd xmm1, dword [ebp - 0x18]
cvtdq2pd xmm1, xmm1
push 4
movd xmm0, edx
cvtdq2pd xmm0, xmm0
subsd xmm1, xmm0
cvttsd2si eax, xmm1
add eax, 0x14
push eax
mov eax, dword [ebp - 0x14]
jmp 0x417e24
cmp eax, 0xffffffff
je 0x417dd6
test eax, eax
jne 0x417e31
imul esi, dword [0x57c900], 0xeb8
push eax
push eax
push eax
push dword [0xb62f20]
add esi, dword [0x5664d0]
call fcn.0040c3c0
push eax
push esi
call fcn.0040bd30
imul edx, dword [0x57c900], 0xeb8
add esp, 0x18
mov ecx, dword [0x5664d0]
mov edx, dword [edx + ecx + 0xe98]
cmp eax, dword [edx]
jge 0x417e31
imul ecx, eax, 0x2740
mov eax, dword [edx + 4]
test byte [eax + ecx + 0x108], 1
je 0x417e31
mov eax, dword [0xb62f20]
push eax
push 8
push 0x110b
push dword [0x57badc]
mov dword [0xb62f1c], eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [0xb63044]
test ecx, ecx
je case.0x4174e6.1012
push 0
push 0
push 0
push 0
jmp 0x417e2c
mov eax, dword [0xb62f20]
push 0
push 8
push 0x110b
push dword [0x57badc]
mov dword [0xb62f1c], eax
call esi
mov ecx, dword [0xb63044]
test ecx, ecx
je case.0x4174e6.1012
mov edx, dword [ebp - 0x20]
movd xmm1, dword [ebp - 0x18]
cvtdq2pd xmm1, xmm1
push 4
movd xmm0, edx
cvtdq2pd xmm0, xmm0
subsd xmm1, xmm0
cvttsd2si eax, xmm1
add eax, 0x14
push eax
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffffe
push eax
lea eax, [edx - 0x14]
push eax
call fcn.0040b940
mov ecx, dword [0xb63044]
test ecx, ecx
je case.0x4174e6.1012
cmp dword [0xb62f1c], 0
jne case.0x4174e6.1012
push 0
push 0
push 0
push 0
call fcn.0040b940
jmp case.0x4174e6.1012
cmp eax, 0x202
je 0x417ec7
cmp eax, 0x2e0
je 0x417ea9
cmp eax, 0x405
jne case.0x4174e6.1012
imul eax, dword [0x57c900], 0xeb8
push esi
add eax, dword [0x5664d0]
cmp dword [ebp + 0x10], 1
push eax
jne 0x417e9c
call fcn.0040c8b0
add esp, 8
jmp case.0x4174e6.1012
call fcn.0040bb20
add esp, 8
jmp case.0x4174e6.1012
movzx eax, word [ebp + 0x10]
mov ecx, 0xb64288
push eax
push edi
call fcn.0042d9a0
push edi
call fcn.00423940
add esp, 4
jmp case.0x4174e6.1012
cmp dword [0xb62f18], 0
je case.0x4174e6.1012
push 0
push 8
push 0x110b
push dword [0x57badc]
call dword [sym.imp.USER32.dll_SendMessageA]
mov esi, dword [0xb63044]
test esi, esi
je 0x417f08
mov ecx, esi
call fcn.0040b370
push 0x120
push esi
call fcn.00481502
add esp, 8
mov dword [0xb63044], 0
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov eax, dword [0xb62f1c]
test eax, eax
je case.0x4174e6.1012
push dword [0xb63048]
push eax
imul eax, dword [0x57c900], 0xeb8
push dword [0xb62f18]
add eax, dword [0x5664d0]
push eax
call fcn.0040c570
mov dword [0xb62f18], 0
mov dword [0xb62f1c], 0
add esp, 0x10
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00481761
mov esp, ebp
pop ebp
ret 0x10
push 0xb62f28
call fcn.0048147b
add esp, 4
cmp dword [0xb62f28], 0xffffffff
jne 0x416ce3
push 0x518550
call fcn.0048174c
push 0xb62f28
call fcn.0048142a
add esp, 8
jmp 0x416ce3