Function at 0x49a2b0
Capabilities:
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x294
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push esi
push edi
mov esi, eax
jmp 0x49a2d0
mov eax, dword [ebp + 0xc]
cmp eax, 0x1000
jb 0x49a2e5
cmp eax, 0x1100
jb 0x49a607
mov edi, dword [ebp + 8]
lea ecx, [eax - 0x200]
cmp ecx, 0xe
ja 0x49a34f
mov eax, dword [ebp + 0x14]
movsx edx, ax
mov ecx, eax
shr ecx, 0x10
mov dword [esp + 0x24], eax
xor eax, eax
mov dword [esp + 0x6c], edx
movsx edx, cx
mov ecx, dword [ebp + 0xc]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov eax, dword [esi + 0x24]
mov dword [esp + 0x70], edx
mov edx, dword [ebp + 0x10]
push eax
lea eax, [esp + 0x70]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], edx
call fcn.00499f90
mov edx, dword [esi + 0x24]
lea ecx, [esp + 0x18]
push ecx
push 0
push 0x407
push edx
call ebx
mov eax, dword [ebp + 0xc]
cmp eax, 0x201
je 0x49a436
cmp eax, 0x200
je 0x49a4fd
cmp eax, 0x202
je 0x49a5cf
cmp eax, 0x100
ja 0x49af69
jne 0x49a653
movzx eax, byte [esi + 0xb4]
neg eax
sbb eax, eax
and eax, 0xfffff78e
push 0xfffffffffffffff4
add eax, 0x7d7
push edi
mov dword [esp + 0x28], eax
mov dword [esp + 0x20], edi
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov cx, word [ebp + 0x10]
lea edx, [esp + 0x18]
push edx
push eax
push 0x4e
push edi
mov dword [esp + 0x2c], eax
mov word [esp + 0x34], cx
mov dword [esp + 0x36], 0
call dword [sym.imp.USER32.dll_GetParent]
push eax
call ebx
mov edx, dword [ebp + 0x10]
lea eax, [edx - 0x21]
cmp eax, 0x4a
ja case.0x49a3e4.35
movzx eax, byte [eax + 0x49b3e0]
jmp dword [eax*4 + 0x49b3cc]
mov eax, dword [esi + 0x70]
test eax, eax
je case.0x49a3e4.35
mov ecx, dword [eax + 0x20]
cmp edx, 0x27
mov edx, ecx
jne 0x49af2e
shr edx, 6
test dl, 1
je case.0x49a3e4.35
shr ecx, 4
test cl, 1
je 0x49af20
mov dword [ebp + 0x14], 0
mov dword [ebp + 0x10], 0x28
mov dword [ebp + 0xc], 0x100
jmp 0x49a2d0
cmp byte [esi + 0xac], 0
je 0x49a470
movsx ebx, word [ebp + 0x14]
mov eax, ebx
sub eax, dword [esi + 0x84]
cdq
xor eax, edx
sub eax, edx
cmp eax, 8
jg 0x49a4e6
push edi
call dword [sym.imp.USER32.dll_SetCapture]
mov eax, dword [esi + 0x2c]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov dword [esi + 0xb0], ebx
push edi
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [ebp + 0x14]
movsx eax, cx
shr ecx, 0x10
movsx ecx, cx
push ecx
push eax
lea ecx, [esp + 0x18]
push ecx
push 0
lea edx, [esp + 0x7c]
push edx
mov eax, esi
mov dword [esp + 0x24], 0
call fcn.00498c10
mov ebx, eax
test bl, 0xe0
je 0x49a4be
mov eax, dword [esp + 0x10]
push 0
push 0
push eax
mov eax, dword [esi]
push 0
mov ecx, 0xfffffffe
call fcn.004976a0
test bl, 0x40
je 0x49b221
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x20]
shr ecx, 4
not cl
and cl, 1
movzx edx, cl
push edx
mov ecx, esi
call fcn.004978f0
jmp case.0x49a3e4.35
mov ecx, dword [esi]
push 0xfffffffffffffff4
push ecx
call dword [sym.imp.USER32.dll_GetClassLongW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
jmp 0x49a470
cmp byte [esi + 0xac], 0
je 0x49af8e
movsx edx, word [ebp + 0x14]
mov dword [esp + 0x10], edx
call dword [sym.imp.USER32.dll_GetCapture]
cmp eax, edi
jne 0x49a595
test byte [ebp + 0x10], 1
je 0x49a595
mov ecx, dword [esi + 0xb0]
mov eax, dword [esp + 0x10]
sub eax, ecx
je 0x49a586
mov edi, dword [esi + 0x84]
mov ecx, dword [esi + 0x88]
lea edx, [edi + eax]
cmp edx, ecx
jge 0x49a547
sub ecx, edi
mov eax, ecx
mov ecx, dword [esi + 0xb0]
add ecx, eax
add edi, eax
mov eax, edi
mov dword [esi + 0xb0], ecx
call fcn.00498590
mov ecx, dword [esi + 4]
lea eax, [esp + 0x18]
push eax
push 0
push 0x120c
push ecx
mov dword [esp + 0x28], 1
mov dword [esp + 0x2c], edi
call ebx
mov eax, esi
call fcn.00498110
mov edi, dword [ebp + 8]
mov edx, dword [esi + 0x2c]
push edx
call dword [sym.imp.USER32.dll_SetCursor]
jmp 0x49af8b
mov eax, dword [esp + 0x10]
sub eax, dword [esi + 0x84]
cdq
xor eax, edx
sub eax, edx
cmp eax, 8
jg 0x49a5b8
mov eax, dword [esi + 0x2c]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
jmp 0x49af8b
mov ecx, dword [esi]
push 0xfffffffffffffff4
push ecx
call dword [sym.imp.USER32.dll_GetClassLongW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
jmp 0x49af8b
cmp byte [esi + 0xac], 0
je case.default.0x49b31f
call dword [sym.imp.USER32.dll_GetCapture]
cmp eax, edi
jne case.default.0x49b31f
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov edx, dword [esi]
push 0xfffffffffffffff4
push edx
call dword [sym.imp.USER32.dll_GetClassLongW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
jmp case.0x49a3e4.35
add eax, 0xffffeffc
cmp eax, 0xb2
ja 0x49a634
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 8]
push ecx
push edx
push eax
mov ecx, esi
call fcn.0049bc20
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 8]
push edx
push eax
push ecx
call dword [sym.imp.USER32.dll_DefWindowProcW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
add eax, 0xfffffffe
cmp eax, 0x85
ja case.default.0x49b31f
movzx edx, byte [eax + 0x49b45c]
jmp dword [edx*4 + 0x49b42c]
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x49a6af
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
push ecx
push eax
push edx
push edi
call dword [sym.imp.USER32.dll_DefWindowProcW]
mov edi, eax
mov eax, esi
mov byte [esi + 0xc0], 1
call fcn.00497550
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0xc]
push eax
push 0
push ecx
push edi
mov byte [esi + 0xc0], 0
call dword [sym.imp.USER32.dll_DefWindowProcW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [ebp + 0x10], edi
jne case.default.0x49b31f
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp word [ebp + 0x14], 0
mov ecx, dword [ebp + 0x10]
mov edx, dword [esi + 4]
setne al
movzx edi, al
push edi
push ecx
push 0x30
push edx
mov byte [esp + 0x27], al
mov dword [esi + 0x28], ecx
call ebx
mov eax, dword [esi + 0x28]
mov ecx, dword [esi + 0xc]
push edi
push eax
push 0x30
push ecx
call ebx
mov edx, dword [esi + 0x28]
mov eax, dword [esi + 0x24]
push edi
push edx
push 0x30
push eax
call ebx
mov ecx, dword [esi + 0x28]
mov edx, dword [esi + 8]
push edi
push ecx
push 0x30
push edx
call ebx
mov eax, dword [esi + 0x28]
mov ecx, dword [esi + 0x10]
push edi
push eax
push 0x30
push ecx
call ebx
mov eax, dword [esi]
lea edx, [esp + 0x18]
push edx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
xor eax, eax
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], eax
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], eax
mov dword [esp + 0x90], eax
mov dword [esp + 0x94], eax
lea eax, [esp + 0x6c]
push eax
lea ecx, [esp + 0x1c]
push 0
mov dword [esp + 0x74], ecx
mov ecx, dword [esi + 4]
push 0x1205
lea edx, [esp + 0x88]
push ecx
mov dword [esp + 0x8c], 0
mov dword [esp + 0x80], edx
call ebx
mov edx, dword [esp + 0x94]
mov eax, dword [esp + 0x90]
mov ecx, dword [esi + 0x84]
mov edi, dword [sym.imp.USER32.dll_SetWindowPos]
or edx, 0x40
push edx
mov edx, dword [esp + 0x84]
push eax
mov eax, dword [esi + 4]
push ecx
push 0
push 0
push edx
push eax
call edi
mov eax, dword [esi + 0x84]
mov ecx, dword [esp + 0x94]
mov edx, dword [esp + 0x90]
or ecx, 0x40
push ecx
mov ecx, dword [esp + 0x90]
push edx
mov edx, dword [esi + 4]
sub ecx, eax
push ecx
push 0
push eax
mov eax, dword [esi + 0xc]
push edx
push eax
call edi
cmp byte [esp + 0x17], 0
je 0x49a817
mov eax, esi
call fcn.00497550
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov edi, dword [esi + 0x70]
test edi, edi
je case.default.0x49b31f
call fcn.00499f40
jmp case.default.0x49b31f
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CreateRectRgn]
push 0
mov ebx, eax
push ebx
push edi
call dword [sym.imp.USER32.dll_GetUpdateRgn]
cmp eax, 1
je 0x49a87b
lea ecx, [esp + 0x18]
push ecx
push edi
call dword [sym.imp.USER32.dll_BeginPaint]
push ebx
lea edx, [esp + 0x1c]
push edx
mov eax, esi
call fcn.004990a0
lea eax, [esp + 0x18]
push eax
push edi
call dword [sym.imp.USER32.dll_EndPaint]
push ebx
call dword [sym.imp.GDI32.dll_DeleteObject]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push ecx
push edx
push eax
push edi
call dword [sym.imp.USER32.dll_DefWindowProcW]
or eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, esi
call fcn.00498110
mov eax, esi
call fcn.004981e0
call fcn.00498740
xor eax, eax
mov dword [esp + 0x20], eax
lea ecx, [esp + 0x28]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov eax, dword [esi]
push ecx
push eax
mov dword [esp + 0x20], 0x30
mov dword [esp + 0x28], eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esi + 0x24]
lea edx, [esp + 0x18]
push edx
push 0
push 0x434
push eax
call ebx
jmp case.0x49a3e4.35
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
cmp edx, dword [esi + 0x24]
jne 0x49ab5e
mov eax, ecx
mov ecx, dword [eax + 8]
cmp ecx, 0xfffffdee
je 0x49a9e3
cmp ecx, 0xfffffdf7
jne 0x49ab5e
mov eax, dword [esi + 0xa0]
mov ecx, dword [esi + 0x98]
push eax
mov eax, dword [esi + 0x9c]
push 1
push 0
push ecx
lea edi, [esp + 0x6c]
mov ecx, esi
call fcn.00498ea0
mov eax, dword [esi + 0x24]
mov edx, edi
push edx
push 1
push 0x41f
push eax
call ebx
mov edx, dword [esi]
push 2
mov ecx, edi
push ecx
push 0
push edx
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x5c]
mov edx, dword [esi + 0x24]
push 0x15
push 0
push 0
push eax
push ecx
push 0
push edx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [esi + 0x28]
mov ecx, dword [esi + 0x24]
push 0
push eax
push 0x30
push ecx
call ebx
mov edx, dword [esi + 0xa0]
mov eax, dword [esi + 0x98]
push 0
push 0
push edx
push eax
mov eax, dword [esi + 0x24]
mov ecx, 0x7d5
call fcn.004976a0
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [esi + 0xa0], 0
je 0x49ab57
lea edi, [eax + 0x10]
add eax, 0xc
push eax
mov dword [eax], edi
mov ecx, dword [esi + 0xa0]
mov edx, dword [esi + 0x98]
push 0
push ecx
mov dword [esp + 0x64], eax
mov eax, dword [esi]
push edx
mov ecx, 0x7d4
call fcn.004976a0
test eax, eax
jne case.default.0x49b0d2
mov eax, dword [esi + 0xa0]
mov ecx, dword [eax + 4]
mov edx, dword [ecx]
push 0x50
push edi
mov edi, dword [esi + 0x98]
push edi
push eax
mov eax, dword [edx + 8]
call eax
xor ebx, ebx
push 0x4e
mov dword [esp + 0x14], eax
mov dword [esp + 0x60], ebx
mov dword [esp + 0x64], ebx
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [esp + 0x64], eax
call fcn.00497b80
mov ecx, dword [esi + 0xa0]
mov edx, dword [esi + 0x98]
push ecx
push 1
push 1
mov dword [esp + 0x74], eax
mov eax, dword [esi + 0x9c]
push edx
lea edi, [esp + 0x8c]
mov ecx, esi
call fcn.00498ea0
mov ecx, dword [esi + 0x1c]
xor eax, eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
lea eax, [esp + 0x18]
push eax
push 2
push ecx
mov dword [esp + 0x24], 0x1c
mov dword [esp + 0x28], 4
call dword [sym.imp.USER32.dll_GetScrollInfo]
mov edx, dword [esp + 0x7c]
cmp edx, dword [esi + 0x84]
jne 0x49aad2
cmp dword [esp + 0x2c], ebx
jne case.default.0x49b0d2
mov edi, dword [esi + 0x94]
mov eax, dword [esi]
and edi, 0xfffb3fff
push eax
or edi, 0x400
call dword [sym.imp.USER32.dll_GetDC]
mov ecx, dword [esi + 0x28]
mov ebx, eax
push ecx
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push edi
lea edx, [esp + 0x60]
push edx
mov dword [esp + 0x74], eax
mov eax, dword [esp + 0x18]
push 0xffffffffffffffff
push eax
push ebx
call dword [sym.imp.USER32.dll_DrawTextW]
mov ecx, dword [esp + 0x6c]
push ecx
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [esi]
push ebx
push edx
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [esp + 0x84]
mov ecx, dword [esp + 0x64]
sub eax, dword [esp + 0x7c]
sub ecx, dword [esp + 0x5c]
cmp ecx, eax
jle 0x49ab4b
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x58]
mov dword [eax], edx
jmp 0x49ab5e
mov ecx, dword [esp + 0x58]
mov dword [ecx], 0x4d9064
jmp 0x49ab5e
mov dword [eax + 0xc], 0x4d9064
mov edx, dword [ebp + 0x14]
mov eax, dword [edx]
mov edi, dword [esi + 4]
cmp eax, edi
je 0x49ab6f
cmp eax, dword [esi + 0xc]
jne case.default.0x49b31f
mov ecx, dword [edx + 8]
cmp ecx, 0xfffffec0
ja 0x49ad8b
je 0x49ac25
cmp ecx, 0xfffffebb
je 0x49abe3
cmp ecx, 0xfffffebe
je 0x49abc2
cmp ecx, 0xfffffebf
jne case.default.0x49b31f
mov eax, esi
call fcn.00498110
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push eax
push ecx
push edx
push edi
call dword [sym.imp.USER32.dll_DefWindowProcW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp eax, edi
jne 0x49abca
xor eax, eax
jmp 0x49abce
mov eax, dword [edx + 0xc]
inc eax
push 0
push 0
push 0
push eax
mov eax, dword [esi]
mov ecx, 0x7d3
call fcn.004976a0
jmp case.default.0x49b31f
xor ebx, ebx
cmp eax, dword [esi + 0xc]
sete bl
add ebx, dword [edx + 0xc]
jne 0x49ac00
cmp byte [esi + 0x90], bl
je 0x49ac00
mov edi, dword [esi + 0x8c]
jmp 0x49ac0a
push ebx
mov edi, esi
call fcn.00499cb0
mov edi, eax
mov edx, edi
mov eax, ebx
mov ecx, esi
call fcn.00497610
test ebx, ebx
jne 0x49ab9c
mov eax, edi
call fcn.00498590
jmp 0x49ab9c
mov edx, dword [edx + 0x14]
test byte [edx], 1
je case.default.0x49b31f
mov ecx, dword [ebp + 0x14]
mov ecx, dword [ecx + 0xc]
test ecx, ecx
jne 0x49ac4a
mov edx, dword [edx + 4]
cmp edx, dword [esi + 0x88]
jl case.0x49b0d2.8
xor ebx, ebx
cmp eax, dword [esi + 0xc]
lea edi, [esp + 0x5c]
sete bl
add ebx, ecx
mov eax, ebx
call fcn.004975c0
mov ecx, dword [esi]
lea eax, [esp + 0x18]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
mov edx, dword [ebp + 0x14]
mov eax, dword [edx + 0x14]
mov edi, dword [eax + 4]
mov eax, dword [esp + 0x64]
sub edi, eax
add edi, dword [esp + 0x5c]
je 0x49ad80
mov ecx, dword [esp + 0x68]
mov edx, dword [esp + 0x20]
mov dword [esp + 0x70], ecx
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x6c], eax
mov dword [esp + 0x74], edx
mov dword [esp + 0x78], ecx
test ebx, ebx
jne 0x49acab
dec eax
mov dword [esp + 0x6c], eax
mov eax, dword [esi + 0x14]
push 0xfffffffffffffff0
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
shr eax, 0x1c
test al, 1
je 0x49acca
push 2
call dword [sym.imp.USER32.dll_GetSystemMetrics]
sub dword [esp + 0x74], eax
mov eax, dword [esi]
push 2
push 0
push 0
push 0
lea edx, [esp + 0x7c]
push edx
push 0
push edi
push eax
call dword [sym.imp.USER32.dll_ScrollWindowEx]
test ebx, ebx
jne 0x49acef
cmp byte [esi + 0x90], bl
jne 0x49ad32
mov edx, dword [esp + 0x68]
mov eax, dword [esp + 0x64]
mov ecx, dword [esp + 0x5c]
mov dword [esp + 0x80], edx
push 0
lea edx, [esp + 0x80]
mov dword [esp + 0x88], eax
mov eax, dword [esi]
mov dword [esp + 0x80], ecx
mov ecx, dword [esp + 0x28]
push edx
push eax
mov dword [esp + 0x94], ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
test ebx, ebx
jne 0x49ad6f
mov ecx, dword [esp + 0x64]
lea eax, [ecx + edi]
call fcn.00498590
mov eax, esi
call fcn.00498110
mov eax, esi
call fcn.004981e0
mov edx, dword [esi + 0xc]
mov edi, dword [sym.imp.USER32.dll_UpdateWindow]
push edx
call edi
mov eax, dword [esi + 0x18]
push eax
call edi
mov ecx, dword [esi + 0x1c]
push ecx
call edi
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, esi
call fcn.00498110
mov edx, dword [esi + 0x1c]
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp ecx, 0xfffffec9
je 0x49adae
cmp ecx, 0xfffffffb
jne case.default.0x49b31f
push 0
push 0
push 0
push 0
call fcn.004976a0
jmp case.default.0x49b31f
mov eax, dword [esi]
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
call fcn.00497b10
jmp case.0x49a3e4.35
mov eax, dword [esi + 0x30]
test eax, eax
je 0x49ade4
cmp byte [esi + 0x34], 0
jne 0x49ade4
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_Destroy]
movzx ecx, word [0x4ff7ec]
mov edx, dword [ebp + 8]
push 0
push ecx
push edx
call dword [sym.imp.USER32.dll_SetPropW]
mov edi, esi
call fcn.0049b550
jmp case.default.0x49b31f
push 0xa2
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
je case.default.0x49b31f
mov eax, esi
xor ebx, ebx
call fcn.004975a0
test eax, eax
jle 0x49ae5b
test ebx, ebx
jne 0x49ae39
cmp byte [esi + 0x90], bl
je 0x49ae39
mov eax, dword [esi + 0x8c]
jmp 0x49ae44
push ebx
mov edi, esi
call fcn.00499cb0
mov edi, dword [ebp + 8]
mov edx, eax
mov eax, ebx
mov ecx, esi
call fcn.00497610
mov eax, esi
inc ebx
call fcn.004975a0
cmp ebx, eax
jl 0x49ae25
mov eax, esi
call fcn.00498110
jmp case.0x49a3e4.35
mov ecx, dword [esi + 0x70]
test ecx, ecx
je case.0x49a3e4.35
cmp edx, 0x28
jne 0x49ae7e
call fcn.00496530
jmp 0x49ae83
call fcn.00496570
mov ebx, eax
test ebx, ebx
je case.default.0x49b31f
mov edi, ebx
push esi
call fcn.00499e20
mov edi, eax
mov eax, esi
call fcn.00497720
mov eax, edi
mov ecx, esi
call fcn.00498a10
jmp case.default.0x49b31f
mov ebx, dword [esi + 0x70]
test ebx, ebx
je case.0x49a3e4.35
mov ecx, dword [esi + 0x14]
xor eax, eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
lea eax, [esp + 0x18]
push eax
push 2
push ecx
mov dword [esp + 0x24], 0x1c
mov dword [esp + 0x28], 2
call dword [sym.imp.USER32.dll_GetScrollInfo]
xor edi, edi
cmp dword [esp + 0x28], edi
jbe 0x49ae85
cmp dword [ebp + 0x10], 0x22
mov ecx, ebx
jne 0x49af05
call fcn.00496530
jmp 0x49af0a
call fcn.00496570
test eax, eax
je 0x49ae85
inc edi
mov ebx, eax
cmp edi, dword [esp + 0x28]
jb 0x49aef6
jmp 0x49ae85
push 1
mov ecx, esi
call fcn.004978f0
jmp case.0x49a3e4.35
shr edx, 4
test dl, 1
je 0x49af4c
shr ecx, 6
test cl, 1
je 0x49af4c
push 0
mov ecx, esi
call fcn.004978f0
jmp case.0x49a3e4.35
mov ebx, dword [eax + 8]
test ebx, ebx
je case.0x49a3e4.35
lea ecx, [esi + 0x38]
cmp ebx, ecx
je case.0x49a3e4.35
mov edi, eax
jmp 0x49ae8f
cmp eax, 0x31a
ja 0x49b311
je 0x49b307
cmp eax, 0x201
ja 0x49b23d
je 0x49a470
mov eax, dword [ebp + 0xc]
sub eax, 0x102
je 0x49b17a
sub eax, 0x12
je 0x49b082
sub eax, 1
jne case.default.0x49b31f
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov eax, dword [esi + 0x14]
push 2
push eax
mov dword [esp + 0x24], 0x1c
mov dword [esp + 0x28], 7
call dword [sym.imp.USER32.dll_GetScrollInfo]
mov eax, dword [ebp + 0x10]
movzx ecx, ax
cmp ecx, 8
ja case.default.0x49b0d2
jmp dword [ecx*4 + 0x49b4e4]
shr eax, 0x10
push eax
mov dword [esp + 0x30], eax
call fcn.00497c00
jmp case.0x49a3e4.35
mov eax, dword [esp + 0x24]
push eax
mov dword [esp + 0x30], eax
call fcn.00497c00
jmp case.0x49a3e4.35
xor eax, eax
push eax
mov dword [esp + 0x30], eax
call fcn.00497c00
jmp case.0x49a3e4.35
mov eax, dword [esp + 0x2c]
inc eax
push eax
mov dword [esp + 0x30], eax
call fcn.00497c00
jmp case.0x49a3e4.35
mov eax, dword [esp + 0x2c]
dec eax
push eax
mov dword [esp + 0x30], eax
call fcn.00497c00
jmp case.0x49a3e4.35
mov eax, dword [esp + 0x2c]
add eax, dword [esp + 0x28]
push eax
mov dword [esp + 0x30], eax
call fcn.00497c00
jmp case.0x49a3e4.35
mov eax, dword [esp + 0x2c]
sub eax, dword [esp + 0x28]
push eax
mov dword [esp + 0x30], eax
call fcn.00497c00
jmp case.0x49a3e4.35
cmp dword [ebp + 0x14], 0
je case.default.0x49b31f
mov ebx, dword [ebp + 0x14]
lea ecx, [esp + 0x18]
xor eax, eax
push ecx
push 2
push ebx
mov dword [esp + 0x24], 0x1c
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x28], 7
call dword [sym.imp.USER32.dll_GetScrollInfo]
mov eax, dword [ebp + 0x10]
movzx ecx, ax
cmp ecx, 8
ja case.default.0x49b0d2
jmp dword [ecx*4 + 0x49b508]
shr eax, 0x10
push eax
mov dword [esp + 0x30], eax
push esi
mov eax, ebx
call fcn.00498280
jmp case.0x49a3e4.35
mov eax, dword [esp + 0x24]
push eax
mov dword [esp + 0x30], eax
push esi
mov eax, ebx
call fcn.00498280
jmp case.0x49a3e4.35
xor eax, eax
push eax
mov dword [esp + 0x30], eax
push esi
mov eax, ebx
call fcn.00498280
jmp case.0x49a3e4.35
mov eax, dword [esp + 0x2c]
inc eax
push eax
mov dword [esp + 0x30], eax
push esi
mov eax, ebx
call fcn.00498280
jmp case.0x49a3e4.35
mov eax, dword [esp + 0x2c]
dec eax
push eax
mov dword [esp + 0x30], eax
push esi
mov eax, ebx
call fcn.00498280
jmp case.0x49a3e4.35
mov eax, dword [esp + 0x2c]
add eax, dword [esp + 0x28]
push eax
mov dword [esp + 0x30], eax
push esi
mov eax, ebx
call fcn.00498280
jmp case.0x49a3e4.35
mov eax, dword [esp + 0x2c]
sub eax, dword [esp + 0x28]
push eax
mov dword [esp + 0x30], eax
push esi
mov eax, ebx
call fcn.00498280
jmp case.0x49a3e4.35
cmp dword [esi + 0x54], 0
je case.default.0x49b31f
mov ecx, dword [esi + 0x70]
test ecx, ecx
je 0x49b1a1
call fcn.00496530
mov dword [esp + 0x10], eax
test eax, eax
jne 0x49b1a8
mov edx, dword [esi + 0x4c]
mov dword [esp + 0x10], edx
jmp 0x49b1a8
mov eax, dword [esi + 0x4c]
mov dword [esp + 0x10], eax
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.004a159d
mov ebx, dword [esp + 0x14]
add esp, 4
movzx edi, ax
jmp 0x49b1c0
mov ecx, dword [ebx + 4]
mov edx, dword [ecx]
mov edx, dword [edx + 8]
push 0x104
lea eax, [esp + 0x9c]
push eax
push 0
push ebx
call edx
movzx eax, word [eax]
push eax
call fcn.004a159d
add esp, 4
cmp ax, di
je 0x49b206
mov ecx, ebx
call fcn.00496530
mov ebx, eax
test ebx, ebx
jne 0x49b1fb
mov ebx, dword [esi + 0x4c]
cmp ebx, dword [esp + 0x10]
jne 0x49b1c0
jmp case.default.0x49b31f
mov eax, esi
call fcn.00497720
push esi
mov edi, ebx
call fcn.00499e20
mov ecx, esi
call fcn.00498a10
jmp case.default.0x49b31f
test ebx, 0x1e0
je case.default.0x49b31f
mov ebx, dword [esp + 0x10]
mov eax, esi
call fcn.00497720
jmp case.0x49a3e4.35
cmp eax, 0x203
jb case.default.0x49b31f
mov eax, dword [ebp + 0xc]
cmp eax, 0x204
jbe 0x49b2a0
cmp eax, 0x20a
jne case.default.0x49b31f
mov eax, dword [ebp + 0x10]
shr eax, 0x10
movsx ecx, ax
add dword [esi + 0x80], ecx
mov ecx, dword [esi + 0x80]
mov eax, ecx
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x28
jl case.default.0x49b31f
mov eax, ecx
cdq
mov ecx, 0x28
idiv ecx
mov ecx, esi
neg eax
mov dword [esi + 0x80], edx
call fcn.00497c70
jmp case.0x49a3e4.35
mov ecx, dword [ebp + 0x14]
movsx eax, cx
shr ecx, 0x10
movsx ecx, cx
push ecx
xor edx, edx
push eax
mov dword [esp + 0x18], edx
mov dword [esp + 0x60], edx
lea edx, [esp + 0x60]
push edx
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x7c]
push ecx
mov eax, esi
call fcn.00498c10
test al, 0xe0
je case.default.0x49b31f
mov ebx, dword [esp + 0x58]
mov eax, esi
call fcn.00497720
mov edx, dword [esp + 0x10]
mov eax, dword [esi]
xor ecx, ecx
cmp dword [ebp + 0xc], 0x203
push 0
sete cl
push 0
push ebx
push edx
lea ecx, [ecx + ecx - 5]
call fcn.004976a0
jmp case.0x49a3e4.35
call fcn.00496970
jmp case.0x49a3e4.35
add eax, 0xffffe000
cmp eax, 5
ja case.default.0x49b31f
jmp dword [eax*4 + 0x49b52c]
cmp dword [ebp + 0x14], 0
mov eax, dword [ebp + 0x10]
je 0x49b34d
or dword [eax + 0x20], 0x40
cmp dword [eax + 0x1c], 0
mov ecx, dword [eax + 0x20]
jne case.default.0x49b0d2
and ecx, 0xffffffef
mov dword [eax + 0x20], ecx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
and dword [eax + 0x20], 0xffffffbf
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [ebp + 0x14], 0
setne al
movzx ecx, al
mov eax, dword [ebp + 0x10]
push ecx
mov ecx, esi
call fcn.004978f0
movzx eax, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov edx, dword [ebp + 0x10]
mov eax, dword [edx + 0x1c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov edi, dword [ebp + 0x10]
call fcn.00499f40
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
mov eax, dword [eax]
push ecx
push edx
call fcn.0049bbb0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov edi, dword [ebp + 0x10]
push esi
call fcn.00499e20
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10