Function at 0x505a91
Capabilities:
Log keystrokes via polling
Parse pe header

Disassembly:
push ebp
sub esp, 0x5c
push 0x2ec
mov eax, 0x63863e
call fcn.0058c0ed
mov edi, ecx
mov eax, dword [edi + 0x1d4]
xor ebx, ebx
cmp dword [eax + 0x210], 0xffffffff
je 0x505ac7
push 0x105
push ebx
push ebx
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_RedrawWindow]
push dword [edi + 0x360]
lea ecx, [ebp + 0x14]
mov dword [ebp + 0x3c], 0x1004
mov dword [ebp + 0x48], 0x1194
call fcn.004c85fc
push dword [edi + 0x360]
lea ecx, [ebp - 0xb0]
mov dword [ebp - 4], ebx
call fcn.004c85fc
push dword [edi + 0x360]
lea ecx, [ebp - 0x110]
mov byte [ebp - 4], 1
call fcn.004c85fc
push dword [edi + 0x360]
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 2
call fcn.004c85fc
push dword [edi + 0x360]
lea ecx, [ebp - 0xf0]
mov byte [ebp - 4], 3
call fcn.004c85fc
push dword [edi + 0x360]
lea ecx, [ebp - 0xd0]
mov byte [ebp - 4], 4
call fcn.004c85fc
mov byte [ebp - 4], 5
call dword [sym.imp.USER32.dll_CreatePopupMenu]
push eax
lea ecx, [ebp + 0x14]
call fcn.005656a6
mov ecx, dword [edi + 0x334]
cmp byte [ecx + 0x110], 0
jne 0x505b77
call fcn.0040c737
mov byte [ebp + 0x47], 0
test al, al
je 0x505b7b
mov byte [ebp + 0x47], 1
mov eax, dword [edi + 0x334]
cmp byte [eax + 0x164], 0
mov esi, dword [sym.imp.USER32.dll_AppendMenuW]
je 0x505bda
push 0x10c
lea ecx, [ebp + 0x54]
call fcn.0050b7ca
push dword [eax]
push 0x1241
push ebx
push dword [ebp + 0x18]
call esi
mov ecx, dword [ebp + 0x54]
add ecx, 0xfffffff0
call fcn.00401493
push 0x10d
lea ecx, [ebp + 0x54]
call fcn.0050b7ca
push dword [eax]
push 0x1240
push ebx
push dword [ebp + 0x18]
call esi
mov ecx, dword [ebp + 0x54]
add ecx, 0xfffffff0
call fcn.00401493
push 0x10e
lea ecx, [ebp + 0x54]
call fcn.0050b7ca
push dword [eax]
xor ebx, ebx
push 0x123f
push ebx
push dword [ebp + 0x18]
call esi
mov ecx, dword [ebp + 0x54]
add ecx, 0xfffffff0
call fcn.00401493
push 0x2f
lea ecx, [ebp + 0x54]
call fcn.0050b7ca
push dword [eax]
push 0x1237
push ebx
push dword [ebp + 0x18]
call esi
mov ecx, dword [ebp + 0x54]
add ecx, 0xfffffff0
call fcn.00401493
push 0xda
lea ecx, [ebp + 0x54]
call fcn.0050b7ca
push dword [eax]
push 0x1246
push ebx
push dword [ebp + 0x18]
call esi
mov ecx, dword [ebp + 0x54]
add ecx, 0xfffffff0
call fcn.00401493
push 0x10f
lea ecx, [ebp + 0x54]
call fcn.0050b7ca
push dword [eax]
push 0x123e
push ebx
push dword [ebp + 0x18]
call esi
mov ecx, dword [ebp + 0x54]
add ecx, 0xfffffff0
call fcn.00401493
push 0x117
lea ecx, [ebp + 0x54]
call fcn.0050b7ca
push dword [eax]
push 0x123a
push ebx
push dword [ebp + 0x18]
call esi
mov ecx, dword [ebp + 0x54]
add ecx, 0xfffffff0
call fcn.00401493
push ebx
push 0x123a
lea ecx, [ebp + 0x14]
call fcn.004c8562
push 0x6401e8
push ebx
push 0x800
push dword [ebp + 0x18]
call esi
push dword [edi + 0x360]
lea ecx, [ebp - 0x2c]
call fcn.004c85fc
mov byte [ebp - 4], 6
call dword [sym.imp.USER32.dll_CreatePopupMenu]
push eax
lea ecx, [ebp - 0x2c]
call fcn.005656a6
push 0x111
lea ecx, [ebp + 0x54]
call fcn.0050b7ca
push dword [eax]
push dword [ebp - 0x28]
push 0x10
push dword [ebp + 0x18]
call esi
mov ecx, dword [ebp + 0x54]
add ecx, 0xfffffff0
call fcn.00401493
push 0x45
push 1
push dword [ebp - 0x28]
lea ecx, [ebp + 0x14]
call fcn.004c84ac
push dword [edi + 0x360]
lea ecx, [ebp - 0x70]
call fcn.004c85fc
mov byte [ebp - 4], 7
call dword [sym.imp.USER32.dll_CreatePopupMenu]
push eax
lea ecx, [ebp - 0x70]
call fcn.005656a6
push 0x1b
lea ecx, [ebp + 0x54]
call fcn.0050b7ca
push dword [eax]
push 0xafc8
push ebx
push dword [ebp - 0x6c]
call esi
mov ecx, dword [ebp + 0x54]
add ecx, 0xfffffff0
call fcn.00401493
push 0x1c
lea ecx, [ebp + 0x54]
call fcn.0050b7ca
push dword [eax]
push 0xafc9
push ebx
push dword [ebp - 0x6c]
call esi
mov ecx, dword [ebp + 0x54]
add ecx, 0xfffffff0
call fcn.00401493
push 0x1d
lea ecx, [ebp + 0x54]
call fcn.0050b7ca
push dword [eax]
push 0xafca
push ebx
push dword [ebp - 0x6c]
call esi
mov ecx, dword [ebp + 0x54]
add ecx, 0xfffffff0
call fcn.00401493
push 0x1e
lea ecx, [ebp + 0x54]
call fcn.0050b7ca
push dword [eax]
push 0xafcb
push ebx
push dword [ebp - 0x6c]
call esi
mov ecx, dword [ebp + 0x54]
add ecx, 0xfffffff0
call fcn.00401493
push 0x1f
lea ecx, [ebp + 0x54]
call fcn.0050b7ca
push dword [eax]
push 0xafcc
push ebx
push dword [ebp - 0x6c]
call esi
mov ecx, dword [ebp + 0x54]
add ecx, 0xfffffff0
call fcn.00401493
push 0x23b
lea ecx, [ebp + 0x54]
mov dword [ebp + 0x5c], 0xafce
call fcn.0050b7ca
push dword [eax]
push 0xafcd
push ebx
push dword [ebp - 0x6c]
call esi
mov ecx, dword [ebp + 0x54]
add ecx, 0xfffffff0
call fcn.00401493
push 0x6431dc
push dword [ebp - 0x6c]
push 0x10
push dword [ebp - 0x28]
call esi
push dword [edi + 0x360]
lea ecx, [ebp - 0x170]
call fcn.004c85fc
lea eax, [ebp - 0x170]
push eax
lea eax, [ebp + 0x5c]
push eax
mov ecx, edi
mov byte [ebp - 4], 8
call fcn.004f1f4e
push 0x669754
push dword [ebp - 0x16c]
mov ebx, 0x410
push ebx
push dword [ebp - 0x28]
call esi
push dword [edi + 0x360]
lea ecx, [ebp - 0x290]
call fcn.004c85fc
lea eax, [ebp - 0x290]
push eax
lea eax, [ebp + 0x5c]
push eax
mov ecx, edi
mov byte [ebp - 4], 9
call fcn.004f1f4e
push 0x669750
push dword [ebp - 0x28c]
push ebx
push dword [ebp - 0x28]
call esi
push dword [edi + 0x360]
lea ecx, [ebp - 0x250]
call fcn.004c85fc
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp + 0x5c]
push eax
mov ecx, edi
mov byte [ebp - 4], 0xa
call fcn.004f1f4e
push 0x66974c
push dword [ebp - 0x24c]
push ebx
push dword [ebp - 0x28]
call esi
push dword [edi + 0x360]
lea ecx, [ebp - 0x210]
call fcn.004c85fc
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp + 0x5c]
push eax
mov ecx, edi
mov byte [ebp - 4], 0xb
call fcn.004f1f4e
push 0x669748
push dword [ebp - 0x20c]
push ebx
push dword [ebp - 0x28]
call esi
push dword [edi + 0x360]
lea ecx, [ebp - 0x1d0]
call fcn.004c85fc
lea eax, [ebp - 0x1d0]
mov byte [ebp - 4], 0xc
push eax
lea eax, [ebp + 0x5c]
push eax
mov ecx, edi
call fcn.004f1f4e
push 0x669744
push dword [ebp - 0x1cc]
push ebx
push dword [ebp - 0x28]
call esi
push dword [edi + 0x360]
lea ecx, [ebp - 0x190]
call fcn.004c85fc
lea eax, [ebp - 0x190]
push eax
lea eax, [ebp + 0x5c]
push eax
mov ecx, edi
mov byte [ebp - 4], 0xd
call fcn.004f1f4e
push 0x65e060
push dword [ebp - 0x18c]
push ebx
push dword [ebp - 0x28]
call esi
push dword [edi + 0x360]
lea ecx, [ebp - 0x150]
call fcn.004c85fc
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp + 0x5c]
push eax
mov ecx, edi
mov byte [ebp - 4], 0xe
call fcn.004f1f4e
push 0x65e058
push dword [ebp - 0x14c]
push ebx
push dword [ebp - 0x28]
call esi
push dword [edi + 0x360]
lea ecx, [ebp - 0x1f0]
call fcn.004c85fc
lea eax, [ebp - 0x1f0]
push eax
lea eax, [ebp + 0x5c]
push eax
mov ecx, edi
mov byte [ebp - 4], 0xf
call fcn.004f1f4e
push 0x669734
push dword [ebp - 0x1ec]
push ebx
push dword [ebp - 0x28]
call esi
push dword [edi + 0x360]
lea ecx, [ebp - 0x230]
call fcn.004c85fc
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp + 0x5c]
push eax
mov ecx, edi
mov byte [ebp - 4], 0x10
call fcn.004f1f4e
push 0x66972c
push dword [ebp - 0x22c]
push ebx
push dword [ebp - 0x28]
call esi
push dword [edi + 0x360]
lea ecx, [ebp - 0x1b0]
call fcn.004c85fc
lea eax, [ebp - 0x1b0]
push eax
mov byte [ebp - 4], 0x11
lea eax, [ebp + 0x5c]
push eax
mov ecx, edi
call fcn.004f1f4e
push 0x66971c
push dword [ebp - 0x1ac]
push ebx
push dword [ebp - 0x28]
call esi
push dword [edi + 0x360]
lea ecx, [ebp - 0x270]
call fcn.004c85fc
lea eax, [ebp - 0x270]
push eax
lea eax, [ebp + 0x5c]
push eax
mov ecx, edi
mov byte [ebp - 4], 0x12
call fcn.004f1f4e
push 0x669924
push dword [ebp - 0x26c]
push ebx
push dword [ebp - 0x28]
call esi
push dword [edi + 0x360]
lea ecx, [ebp - 0x130]
call fcn.004c85fc
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp + 0x5c]
push eax
mov ecx, edi
mov byte [ebp - 4], 0x13
call fcn.004f1f4e
push 0x66991c
push dword [ebp - 0x12c]
push ebx
push dword [ebp - 0x28]
call esi
mov ebx, 0x6401e8
push ebx
push 0
push 0x800
push dword [ebp - 0x28]
call esi
push 0x14a
lea ecx, [ebp + 0x54]
call fcn.0050b7ca
push dword [eax]
push 0x124f
push 0
push dword [ebp - 0x28]
call esi
mov ecx, dword [ebp + 0x54]
add ecx, 0xfffffff0
call fcn.00401493
push ebx
push 0
push 0x800
push dword [ebp - 0x28]
call esi
push 0x112
lea ecx, [ebp + 0x54]
call fcn.0050b7ca
push dword [eax]
push 0x123c
push 0
push dword [ebp - 0x28]
call esi
mov ecx, dword [ebp + 0x54]
add ecx, 0xfffffff0
call fcn.00401493
push ebx
xor ebx, ebx
push ebx
push 0x800
push dword [ebp - 0x28]
call esi
push 0x113
lea ecx, [ebp + 0x54]
call fcn.0050b7ca
push dword [eax]
push 0x123b
push ebx
push dword [ebp - 0x28]
call esi
mov ecx, dword [ebp + 0x54]
add ecx, 0xfffffff0
call fcn.00401493
push 0x114
lea ecx, [ebp + 0x54]
call fcn.0050b7ca
push dword [eax]
push 0x1254
push ebx
push dword [ebp + 0x18]
call esi
mov ecx, dword [ebp + 0x54]
add ecx, 0xfffffff0
call fcn.00401493
push dword [edi + 0x360]
lea ecx, [ebp - 0x90]
call fcn.004c85fc
mov byte [ebp - 4], 0x14
call dword [sym.imp.USER32.dll_CreatePopupMenu]
push eax
lea ecx, [ebp - 0x90]
call fcn.005656a6
mov eax, dword [edi + 0x334]
mov eax, dword [eax + 0xcb4]
mov dword [ebp + 0x40], eax
cmp eax, ebx
je 0x506263
mov ecx, dword [edi + 0x334]
lea eax, [ebp + 0x40]
push eax
add ecx, 0xcb0
call fcn.00408c8a
mov eax, dword [eax]
lea ecx, [ebp + 0x54]
push ecx
mov ecx, eax
mov dword [ebp + 0x38], eax
call fcn.004ed0b2
push eax
lea ecx, [ebp + 0x5c]
mov byte [ebp - 4], 0x15
call fcn.00402e5b
mov ecx, dword [ebp + 0x54]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0x17
call fcn.00401493
mov eax, dword [ebp + 0x5c]
cmp dword [eax - 0xc], ebx
jne 0x506237
push 0x1d3
lea ecx, [ebp + 0x58]
call fcn.0050b7ca
mov dword [ebp + 0x10], eax
mov ecx, dword [ebp + 0x38]
mov byte [ebp - 4], 0x18
call fcn.004ebd8e
push eax
mov eax, dword [ebp + 0x10]
push dword [eax]
lea eax, [ebp + 0x5c]
push str._s__i
push eax
call fcn.00401e49
mov ecx, dword [ebp + 0x58]
add esp, 0x10
add ecx, 0xfffffff0
call fcn.00401493
push dword [ebp + 0x5c]
push dword [ebp + 0x48]
push ebx
push dword [ebp - 0x8c]
call esi
mov ecx, dword [ebp + 0x5c]
inc dword [ebp + 0x48]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0x14
call fcn.00401493
cmp dword [ebp + 0x40], ebx
jne 0x5061b0
jmp 0x506265
xor ebx, ebx
mov eax, dword [edi + 0x334]
cmp dword [eax + 0xcbc], ebx
jle 0x506282
push ebx
push ebx
push 0x800
push dword [ebp - 0x8c]
call esi
push 0x11
lea ecx, [ebp + 0x58]
call fcn.0050b7ca
push dword [eax]
push 0x1245
push ebx
push dword [ebp - 0x8c]
call esi
mov ecx, dword [ebp + 0x58]
add ecx, 0xfffffff0
call fcn.00401493
push ebx
push ebx
push 0x800
push dword [ebp - 0x8c]
call esi
push 0x52
lea ecx, [ebp + 0x58]
call fcn.0050b7ca
push dword [eax]
push 0x1248
push ebx
push dword [ebp - 0x8c]
call esi
mov ecx, dword [ebp + 0x58]
add ecx, 0xfffffff0
call fcn.00401493
push 0x1d3
lea ecx, [ebp + 0x58]
call fcn.0050b7ca
push dword [eax]
push dword [ebp - 0x8c]
push 0x10
push dword [ebp + 0x18]
call esi
mov ecx, dword [ebp + 0x58]
add ecx, 0xfffffff0
call fcn.00401493
push 0x43
push 1
push dword [ebp - 0x8c]
lea ecx, [ebp + 0x14]
call fcn.004c84ac
mov eax, dword [edi + 0x3f8]
cmp eax, 0xffffffff
je 0x506354
mov ecx, dword [edi + 0x334]
push eax
call fcn.00409909
test eax, eax
je 0x506354
push 0x1e8
lea ecx, [ebp + 0x58]
call fcn.0050b7ca
push dword [eax]
push 0x1244
push ebx
push dword [ebp + 0x18]
call esi
mov ecx, dword [ebp + 0x58]
add ecx, 0xfffffff0
call fcn.00401493
push 0x110
lea ecx, [ebp + 0x58]
call fcn.0050b7ca
push dword [eax]
push 0x123d
push ebx
push dword [ebp + 0x18]
call esi
mov ecx, dword [ebp + 0x58]
add ecx, 0xfffffff0
call fcn.00401493
push 0x6401e8
push ebx
push 0x800
push dword [ebp + 0x18]
call esi
cmp byte [ebp + 0x47], 0
je 0x50660b
mov eax, dword [edi + 0x334]
mov eax, dword [eax + 0xf74]
mov dword [edi + 0x188], eax
mov dword [edi + 0x18c], ebx
call dword [sym.imp.USER32.dll_CreatePopupMenu]
push eax
lea ecx, [ebp - 0xb0]
call fcn.005656a6
lea eax, [edi + 0x140]
mov ecx, dword [eax]
cmp dword [ecx - 0xc], ebx
je 0x50647d
push ecx
mov dword [ebp + 4], esp
mov ecx, esp
push eax
call fcn.00402e5b
mov ecx, dword [edi + 0x334]
lea eax, [ebp + 0x48]
push eax
call fcn.00415919
push 0x2a
lea ecx, [ebp + 0x38]
mov byte [ebp - 4], 0x19
call fcn.0050b7ca
push 0x669914
push eax
lea eax, [ebp + 0x54]
push eax
mov byte [ebp - 4], 0x1a
call fcn.0040e47a
lea ecx, [ebp + 0x48]
push ecx
push eax
lea eax, [ebp + 0x10]
push eax
mov byte [ebp - 4], 0x1b
call fcn.0040e423
push str.__tCtrlR
push eax
lea eax, [ebp + 0x58]
push eax
mov byte [ebp - 4], 0x1c
call fcn.0040e47a
add esp, 0x24
push dword [eax]
push 0x125a
push ebx
push dword [ebp - 0xac]
call esi
mov ecx, dword [ebp + 0x58]
add ecx, 0xfffffff0
call fcn.00401493
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
call fcn.00401493
mov ecx, dword [ebp + 0x54]
add ecx, 0xfffffff0
call fcn.00401493
mov ecx, dword [ebp + 0x38]
add ecx, 0xfffffff0
call fcn.00401493
mov ecx, dword [ebp + 0x48]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0x14
call fcn.00401493
push 2
lea eax, [ebp - 0xb0]
push eax
mov ecx, edi
call fcn.004f4330
push ebx
push 0x125b
push 0x800
push dword [ebp - 0xac]
call esi
push 0x2b
lea ecx, [ebp + 0x58]
call fcn.0050b7ca
push dword [eax]
push 0x1258
push ebx
push dword [ebp - 0xac]
call esi
mov ecx, dword [ebp + 0x58]
add ecx, 0xfffffff0
call fcn.00401493
push 0xdb
lea ecx, [ebp + 0x58]
call fcn.0050b7ca
push dword [eax]
push 0x1255
push ebx
push dword [ebp - 0xac]
call esi
mov ecx, dword [ebp + 0x58]
add ecx, 0xfffffff0
call fcn.00401493
mov eax, dword [edi + 0x334]
mov ecx, dword [eax + 0xf60]
mov dword [ebp + 0x5c], ecx
cmp ecx, ebx
je 0x5065c5
push ebx
push ecx
lea ecx, [eax + 0xf70]
call fcn.00565371
mov ecx, dword [edi + 0x334]
mov dword [ebp + 0x40], eax
lea eax, [ebp + 0x40]
push eax
add ecx, 0xf70
call fcn.00408c8a
mov eax, dword [ebp + 0x40]
mov dword [edi + 0x188], eax
mov eax, dword [edi + 0x334]
mov eax, dword [eax + 0xf74]
mov dword [ebp + 0x48], 1
mov dword [ebp + 0x40], eax
cmp eax, ebx
je 0x506579
mov ecx, dword [edi + 0x334]
lea eax, [ebp + 0x40]
push eax
add ecx, 0xf70
call fcn.00408c8a
mov ecx, dword [ebp + 0x5c]
cmp dword [eax], ecx
jne 0x506571
mov eax, dword [ebp + 0x48]
mov dword [edi + 0x18c], eax
inc dword [ebp + 0x48]
cmp dword [ebp + 0x40], ebx
jne 0x50654c
call dword [sym.imp.USER32.dll_CreatePopupMenu]
push eax
lea ecx, [ebp - 0x110]
call fcn.005656a6
mov eax, dword [edi + 0x334]
mov eax, dword [eax + 0xf60]
mov eax, dword [eax + 0x10]
inc eax
push eax
lea eax, [ebp - 0x110]
push eax
mov ecx, edi
call fcn.004f4330
mov eax, dword [edi + 0x334]
mov eax, dword [eax + 0xf60]
push dword [eax]
push dword [ebp - 0x10c]
push 0x10
push dword [ebp + 0x18]
call esi
push 0x2e
lea ecx, [ebp + 0x58]
call fcn.0050b7ca
push dword [eax]
push dword [ebp - 0xac]
push 0x10
push dword [ebp + 0x18]
call esi
mov ecx, dword [ebp + 0x58]
add ecx, 0xfffffff0
call fcn.00401493
push 0x6b
push 1
push dword [ebp - 0xac]
lea ecx, [ebp + 0x14]
call fcn.004c84ac
push 0x6401e8
push ebx
push 0x800
push dword [ebp + 0x18]
call esi
cmp byte [edi + 0x80], 0
push 0x118
lea ecx, [ebp + 0x58]
je 0x50664b
call fcn.0050b7ca
push dword [eax]
push 0x1251
push ebx
push dword [ebp + 0x18]
call esi
mov ecx, dword [ebp + 0x58]
add ecx, 0xfffffff0
call fcn.00401493
push 8
push 0x1251
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_CheckMenuItem]
jmp 0x506668
call fcn.0050b7ca
push dword [eax]
push 0x1250
push ebx
push dword [ebp + 0x18]
call esi
mov ecx, dword [ebp + 0x58]
add ecx, 0xfffffff0
call fcn.00401493
mov eax, dword [edi + 0x23c]
mov dword [ebp + 0x48], ebx
cmp eax, 0xffffffff
je 0x506698
mov ecx, dword [edi + 0x334]
push eax
call fcn.004091aa
cmp eax, ebx
je 0x506698
mov ecx, eax
call fcn.004ebd9d
test al, al
je 0x506698
mov dword [ebp + 0x48], 1
push 0x119
lea ecx, [ebp + 0x58]
call fcn.0050b7ca
push dword [eax]
push 0x1238
push ebx
push dword [ebp + 0x18]
call esi
mov ecx, dword [ebp + 0x58]
add ecx, 0xfffffff0
call fcn.00401493
push 0x11f
lea ecx, [ebp + 0x58]
call fcn.0050b7ca
push dword [eax]
push 0x1239
push dword [ebp + 0x48]
push dword [ebp + 0x18]
call esi
mov ecx, dword [ebp + 0x58]
add ecx, 0xfffffff0
call fcn.00401493
cmp byte [edi + 0x190], 0
lea ecx, [ebp + 0x58]
je 0x506724
push 0xf8
call fcn.0050b7ca
push dword [eax]
push 0x124e
push ebx
push dword [ebp + 0x18]
call esi
mov ecx, dword [ebp + 0x58]
add ecx, 0xfffffff0
call fcn.00401493
push 8
push 0x124e
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_CheckMenuItem]
jmp 0x506746
push 0xf7
call fcn.0050b7ca
push dword [eax]
push 0x124d
push ebx
push dword [ebp + 0x18]
call esi
mov ecx, dword [ebp + 0x58]
add ecx, 0xfffffff0
call fcn.00401493
cmp byte [edi + 0x1d9], 0
lea ecx, [ebp + 0x58]
je 0x506786
push 0xfc
call fcn.0050b7ca
push dword [eax]
push 0x1253
push ebx
push dword [ebp + 0x18]
call esi
mov ecx, dword [ebp + 0x58]
add ecx, 0xfffffff0
call fcn.00401493
push 8
push 0x1253
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_CheckMenuItem]
jmp 0x5067a8
push 0xfb
call fcn.0050b7ca
push dword [eax]
push 0x1252
push ebx
push dword [ebp + 0x18]
call esi
mov ecx, dword [ebp + 0x58]
add ecx, 0xfffffff0
call fcn.00401493
cmp dword [edi + 0x2f4], ebx
jne 0x50684f
cmp byte [edi + 0x238], 0
lea ecx, [ebp + 0x58]
je 0x5067d3
push 0x1c6
call fcn.0050b7ca
push dword [eax]
push 0x124b
jmp 0x5067e4
push 0x1c7
call fcn.0050b7ca
push dword [eax]
push 0x124a
push ebx
push dword [ebp + 0x18]
call esi
mov ecx, dword [ebp + 0x58]
add ecx, 0xfffffff0
call fcn.00401493
cmp byte [edi + 0x27c], 0
push 0x74
lea ecx, [ebp + 0x58]
je 0x506832
call fcn.0050b7ca
push dword [eax]
push 0x122b
push ebx
push dword [ebp + 0x18]
call esi
mov ecx, dword [ebp + 0x58]
add ecx, 0xfffffff0
call fcn.00401493
push 8
push 0x122b
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_CheckMenuItem]
jmp 0x50684f
call fcn.0050b7ca
push dword [eax]
push 0x122a
push ebx
push dword [ebp + 0x18]
call esi
mov ecx, dword [ebp + 0x58]
add ecx, 0xfffffff0
call fcn.00401493
mov eax, dword [edi + 0x334]
lea ecx, [ebp + 0x58]
cmp dword [eax + 0xe44], edi
jne 0x506894
push 0x1c9
call fcn.0050b7ca
push dword [eax]
push 0x1249
push ebx
push dword [ebp + 0x18]
call esi
mov ecx, dword [ebp + 0x58]
add ecx, 0xfffffff0
call fcn.00401493
push 8
push 0x1249
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_CheckMenuItem]
jmp 0x5068b6
push 0x1c8
call fcn.0050b7ca
push dword [eax]
push 0x1249
push ebx
push dword [ebp + 0x18]
call esi
mov ecx, dword [ebp + 0x58]
add ecx, 0xfffffff0
call fcn.00401493
mov eax, dword [edi + 0x334]
cmp byte [eax + 0x1693], 0
jne 0x5068ea
push 0x1da
lea ecx, [ebp + 0x58]
call fcn.0050b7ca
push dword [eax]
push 0x1242
push ebx
push dword [ebp + 0x18]
call esi
mov ecx, dword [ebp + 0x58]
add ecx, 0xfffffff0
call fcn.00401493
call dword [sym.imp.USER32.dll_CreatePopupMenu]
push eax
lea ecx, [ebp - 0x50]
call fcn.005656a6
push 0x115
lea ecx, [ebp + 0x58]
call fcn.0050b7ca
push dword [eax]
push 0x802a
push ebx
push dword [ebp - 0x4c]
call esi
mov ecx, dword [ebp + 0x58]
add ecx, 0xfffffff0
call fcn.00401493
push 0x6698f8
push 0x802b
push ebx
push dword [ebp - 0x4c]
call esi
push 0x662f80
push 0x802c
push ebx
push dword [ebp - 0x4c]
call esi
push 0x662f78
push 0x802d
push ebx
push dword [ebp - 0x4c]
call esi
push 0x662f70
push 0x802e
push ebx
push dword [ebp - 0x4c]
call esi
push 0x662f68
push 0x802f
push ebx
push dword [ebp - 0x4c]
call esi
push 0x662f60
push 0x8030
push ebx
push dword [ebp - 0x4c]
call esi
push 0x662f58
push 0x8031
push ebx
push dword [ebp - 0x4c]
call esi
push 0x662f50
push 0x8032
push ebx
push dword [ebp - 0x4c]
call esi
push 0x6698f0
push 0x8033
push ebx
push dword [ebp - 0x4c]
call esi
push 0x64
pop eax
sub eax, dword [edi + 0x194]
push 0xa
cdq
pop ecx
idiv ecx
cmp eax, ecx
jne 0x5069c3
xor eax, eax
push 8
add eax, 0x802a
push eax
push dword [ebp - 0x4c]
call dword [sym.imp.USER32.dll_CheckMenuItem]
push 0x116
lea ecx, [ebp + 0x58]
call fcn.0050b7ca
push dword [eax]
push dword [ebp - 0x4c]
push 0x10
push dword [ebp + 0x18]
call esi
mov ecx, dword [ebp + 0x58]
add ecx, 0xfffffff0
call fcn.00401493
call dword [sym.imp.USER32.dll_CreatePopupMenu]
push eax
lea ecx, [ebp - 0xf0]
call fcn.005656a6
mov dword [ebp + 0x5c], ebx
mov dword [ebp + 0x40], ebx
mov eax, dword [edi + 0x334]
mov ecx, dword [ebp + 0x40]
mov eax, dword [ecx + eax + 0x1534]
cmp dword [eax - 0xc], ebx
je 0x506a7f
call fcn.0054f69d
push eax
lea ecx, [ebp + 0x48]
call fcn.004018a6
push dword [ebp + 0x5c]
mov eax, dword [edi + 0x334]
mov ecx, dword [ebp + 0x40]
push dword [ecx + eax + 0x1540]
lea eax, [ebp + 0x48]
push str._s_tAlt_i
push eax
mov byte [ebp - 4], 0x1d
call fcn.00401e49
mov eax, dword [ebp + 0x5c]
add esp, 0x10
push dword [ebp + 0x48]
add eax, 0x10cc
push eax
push ebx
push dword [ebp - 0xec]
call esi
mov ecx, dword [ebp + 0x48]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0x14
call fcn.00401493
inc dword [ebp + 0x5c]
add dword [ebp + 0x40], 0x18
cmp dword [ebp + 0x40], 0xd8
jle 0x506a10
push 0x4a
lea ecx, [ebp + 0x58]
call fcn.0050b7ca
push dword [eax]
push dword [ebp - 0xec]
push 0x10
push dword [ebp + 0x18]
call esi
mov ecx, dword [ebp + 0x58]
add ecx, 0xfffffff0
call fcn.00401493
cmp dword [edi + 0x2bc], 1
jne 0x506b2a
call dword [sym.imp.USER32.dll_CreatePopupMenu]
push eax
lea ecx, [ebp - 0xd0]
call fcn.005656a6
mov dword [ebp + 0x48], ebx
mov dword [ebp + 0x40], ebx
mov eax, dword [edi + 0x334]
mov ecx, dword [ebp + 0x40]
push dword [ecx + eax + 0x1540]
mov eax, dword [ebp + 0x48]
add eax, 0x1068
push eax
push ebx
push dword [ebp - 0xcc]
call esi
inc dword [ebp + 0x48]
add dword [ebp + 0x40], 0x18
cmp dword [ebp + 0x40], 0xd8
jle 0x506ad4
push 0x4b
lea ecx, [ebp + 0x58]
call fcn.0050b7ca
push dword [eax]
push dword [ebp - 0xcc]
push 0x10
push dword [ebp + 0x18]
call esi
mov ecx, dword [ebp + 0x58]
add ecx, 0xfffffff0
call fcn.00401493
mov eax, dword [edi + 0x334]
mov eax, dword [eax + 0xbf0]
mov dword [ebp + 0x40], eax
cmp eax, ebx
je 0x506b83
push 0x6401e8
push ebx
push 0x800
push dword [ebp + 0x18]
call esi
mov ecx, dword [edi + 0x334]
lea eax, [ebp + 0x40]
push eax
add ecx, 0xbec
call fcn.00408c8a
mov eax, dword [eax]
push dword [eax]
mov dword [ebp + 0x58], eax
push dword [ebp + 0x3c]
push ebx
push dword [ebp + 0x18]
call esi
mov ecx, dword [ebp + 0x3c]
mov eax, dword [ebp + 0x58]
inc dword [ebp + 0x3c]
mov dword [eax + 8], ecx
cmp dword [ebp + 0x40], ebx
jne 0x506b3d
mov eax, dword [edi + 0x2b4]
mov dword [ebp + 0x48], eax
cmp eax, ebx
je 0x506bca
lea eax, [ebp + 0x48]
push eax
lea ecx, [edi + 0x2b0]
call fcn.00408c8a
mov eax, dword [eax]
mov ecx, dword [edi + 0x334]
push ebx
push eax
add ecx, 0x14c4
mov dword [ebp + 0x58], eax
call fcn.00565371
test eax, eax
je 0x506bc5
mov eax, dword [ebp + 0x58]
mov byte [eax + 0x22c], 0
cmp dword [ebp + 0x48], ebx
jne 0x506b90
cmp dword [edi + 0x2bc], 1
jle 0x506c4e
call fcn.0054f69d
push eax
lea ecx, [ebp + 0x48]
call fcn.004018a6
push 0x199
lea ecx, [ebp + 0x58]
mov byte [ebp - 4], 0x1e
call fcn.0050b7ca
mov ecx, dword [edi + 0x2bc]
mov eax, dword [eax]
push ecx
push eax
lea eax, [ebp + 0x48]
push eax
mov byte [ebp - 4], 0x1f
call fcn.00401e49
mov ecx, dword [ebp + 0x58]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.00401493
push ebx
push ebx
push 0xc00
push ebx
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_InsertMenuW]
push dword [ebp + 0x48]
push 0x1236
push 0x401
push ebx
push dword [ebp + 0x18]
call dword [sym.imp.USER32.dll_InsertMenuW]
mov ecx, dword [ebp + 0x48]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0x14
call fcn.00401493
push ebx
push ebx
push 0x800
push dword [ebp + 0x18]
call esi
push 0xd
lea ecx, [ebp + 0x58]
call fcn.0050b7ca
push dword [eax]
push 0x1243
push ebx
push dword [ebp + 0x18]
call esi
mov ecx, dword [ebp + 0x58]
add ecx, 0xfffffff0
call fcn.00401493
mov ecx, dword [edi + 0x334]
xor eax, eax
cmp byte [ecx + 0xc90], al
je 0x506c91
mov eax, 0x8008
push ebx
push edi
push dword [ebp + 0x6c]
or eax, 0x102
push dword [ebp + 0x68]
lea ecx, [ebp + 0x14]
push eax
call fcn.00553dad
lea ecx, [ebp + 0x14]
mov dword [ebp + 0x5c], eax
call fcn.005656fe
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x10
call esi
test ax, ax
setl al
push 0x11
mov byte [ebp + 0x3c], al
call esi
test ax, ax
setl al
mov esi, 0x6401e8
push esi
lea ecx, [ebp + 0xc]
mov byte [ebp + 0x48], al
call fcn.00402035
cmp dword [ebp + 0x5c], 0x1242
mov byte [ebp - 4], 0x20
jne 0x506d14
lea eax, [ebp + 0x58]
push eax
mov ecx, edi
call fcn.0050052d
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 0x21
call fcn.00401dd7
mov ecx, dword [ebp + 0x58]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0x20
call fcn.00401493
push 0x669390
lea ecx, [ebp + 0xc]
call fcn.00406897
test eax, eax
je 0x507ca8
cmp dword [ebp + 0x5c], 0x1248
mov dword [ebp + 0x38], ebx
jne 0x506d5c
mov ecx, dword [edi + 0x334]
call fcn.004116a0
mov ecx, eax
mov dword [ebp + 0x38], ecx
call fcn.004ebd8e
push eax
mov eax, dword [edi + 0x334]
mov ecx, dword [eax + 0xbac]
call fcn.004ab4f7
push esi
lea ecx, [ebp + 8]
mov byte [ebp + 0x47], 0
call fcn.00402035
push 0x6430ec
lea ecx, [ebp + 0x34]
mov byte [ebp - 4], 0x22
call fcn.00402035
mov eax, dword [edi + 0x2b8]
mov byte [ebp - 4], 0x23
mov dword [ebp + 0x54], eax
cmp eax, ebx
je 0x507b57
lea eax, [ebp + 0x54]
push eax
lea ecx, [edi + 0x2b0]
call fcn.00408cbc
mov esi, dword [eax]
mov ecx, dword [edi + 0x334]
push ebx
push esi
add ecx, 0x14c4
call fcn.00565371
test eax, eax
je 0x507b28
mov eax, dword [edi + 0x334]
mov eax, dword [eax + 0xbf0]
mov dword [ebp + 0x40], eax
cmp eax, ebx
je 0x506e16
mov ecx, dword [edi + 0x334]
lea eax, [ebp + 0x40]
push eax
add ecx, 0xbec
call fcn.00408c8a
mov eax, dword [eax]
mov ecx, dword [ebp + 0x5c]
cmp ecx, dword [eax + 8]
jne 0x506e11
push esi
push ecx
mov ecx, esp
add eax, 4
mov dword [ebp], esp
push eax
push str.505_custom_sticky_command:
push ecx
call fcn.00405a0e
mov ecx, dword [esi + 0x334]
add esp, 0xc
call fcn.0040c8a2
cmp dword [ebp + 0x40], ebx
jne 0x506dce
cmp byte [esi + 0x22c], 0
je 0x506e5b
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x506e5b
push dword [esi + 0x36c]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [edi + 0x334]
cmp byte [eax + 0x15c], 0
push ebx
mov ecx, esi
je 0x506e50
push ebx
jmp 0x506e56
push dword [edi + 0x194]
call fcn.004f1808
lea ecx, [esi + 0x298]
push 0x6401e8
call fcn.00406897
test eax, eax
je 0x506edf
push 0x6430ec
lea ecx, [ebp + 0x34]
call fcn.00406897
test eax, eax
lea eax, [esi + 0x298]
jne 0x506e91
push eax
lea ecx, [ebp + 0x34]
call fcn.00401dd7
jmp 0x506edf
push ecx
mov dword [ebp], esp
mov ecx, esp
push eax
call fcn.00402e5b
push ecx
lea eax, [ebp + 0x34]
mov dword [ebp + 0x40], esp
mov ecx, esp
push eax
mov byte [ebp - 4], 0x24
call fcn.00402e5b
lea eax, [ebp + 0x58]
mov byte [ebp - 4], 0x23
mov ecx, dword [edi + 0x334]
push eax
call fcn.00413fa6
push eax
lea ecx, [ebp + 0x34]
mov byte [ebp - 4], 0x25
call fcn.00401dd7
mov ecx, dword [ebp + 0x58]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0x23
call fcn.00401493
push dword [esi + 0x3f4]
mov ecx, dword [edi + 0x334]
lea eax, [ebp + 4]
push eax
call fcn.0040e2ec
push eax
lea eax, [ebp - 0x30]
push 0x641288
push eax
mov byte [ebp - 4], 0x26
call fcn.00405a0e
push 0x641288
push eax
lea eax, [ebp + 0x10]
push eax
mov byte [ebp - 4], 0x27
call fcn.0040e47a
add esp, 0x18
push eax
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0x28
call fcn.004104a0
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
call fcn.00401493
mov ecx, dword [ebp - 0x30]
add ecx, 0xfffffff0
call fcn.00401493
mov ecx, dword [ebp + 4]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0x23
call fcn.00401493
cmp dword [ebp + 0x5c], 0x1241
jne 0x506f5f
mov ecx, esi
call fcn.00500b03
cmp dword [ebp + 0x5c], 0x1240
jne 0x506f6f
mov ecx, esi
call fcn.004f994a
mov eax, dword [ebp + 0x5c]
lea ecx, [eax - 0x10cc]
cmp ecx, 0xa
ja 0x506fa3
mov edx, dword [edi + 0x334]
add eax, 0xffffef34
mov ecx, eax
imul ecx, ecx, 0x18
mov ecx, dword [ecx + edx + 0x1534]
cmp dword [ecx - 0xc], ebx
je 0x506fa3
push 1
push eax
mov ecx, esi
call fcn.005018eb
cmp dword [ebp + 0x5c], 0x124b
jne 0x506fcd
cmp dword [esi + 0x2f4], ebx
jne 0x507b28
mov ecx, esi
mov byte [esi + 0x238], 0
call fcn.004f0a1f
mov ecx, esi
call fcn.004fbc73
cmp dword [ebp + 0x5c], 0x124a
jne 0x506ff7
cmp dword [esi + 0x2f4], ebx
jne 0x507b28
mov ecx, esi
mov byte [esi + 0x238], 1
call fcn.004f0a1f
mov ecx, esi
call fcn.004fbc73
mov eax, dword [ebp + 0x5c]
add eax, 0xffff5038
cmp eax, 0x63
ja case.default.0x50702a
lea eax, [ebp + 0x4c]
push eax
call fcn.0040a60c
mov eax, dword [ebp + 0x5c]
add eax, 0xffff5038
cmp eax, 0x4d
ja case.default.0x50702a
mov eax, dword [ebp + 0x5c]
add eax, 0xffff5038
jmp dword [eax*4 + 0x507dfd]
push ebx
push 0x3c
mov ecx, esi
call fcn.00504807
jmp case.default.0x50702a
push ebx
push 0xe10
jmp 0x507034
push ebx
push 0x15180
jmp 0x507034
push ebx
push 0x93a80
jmp 0x507034
push ebx
push 0x278d00
jmp 0x507034
push 0xffffffffffffffff
lea ecx, [ebp + 0x4c]
call fcn.00404cbd
push eax
lea ecx, [ebp + 0x4c]
call fcn.00404ca1
push eax
lea ecx, [ebp + 0x4c]
call fcn.00404c85
push eax
lea ecx, [ebp + 0x4c]
call fcn.00404c6a
push eax
lea ecx, [ebp + 0x4c]
call fcn.00404c4e
push eax
lea ecx, [ebp + 0x4c]
call fcn.00404c2e
inc eax
lea ecx, [ebp - 0x2e8]
jmp 0x50764b
push ebx
push 0x78
jmp 0x507034
push ebx
push 0x1c20
jmp 0x507034
push ebx
push 0x2a300
jmp 0x507034
push ebx
push 0x127500
jmp 0x507034
push ebx
push 0x4f1a00
jmp 0x507034
push 0xffffffffffffffff
lea ecx, [ebp + 0x4c]
call fcn.00404cbd
push eax
lea ecx, [ebp + 0x4c]
call fcn.00404ca1
push eax
lea ecx, [ebp + 0x4c]
call fcn.00404c85
push eax
lea ecx, [ebp + 0x4c]
call fcn.00404c6a
push eax
lea ecx, [ebp + 0x4c]
call fcn.00404c4e
push eax
lea ecx, [ebp + 0x4c]
call fcn.00404c2e
inc eax
inc eax
lea ecx, [ebp - 0x2c0]
jmp 0x50764b
push ebx
push 0xb4
jmp 0x507034
push ebx
push 0x2a30
jmp 0x507034
push ebx
push 0x3f480
jmp 0x507034
push ebx
push 0x1baf80
jmp 0x507034
push ebx
push 0x76a700
jmp 0x507034
push 0xffffffffffffffff
lea ecx, [ebp + 0x4c]
call fcn.00404cbd
push eax
lea ecx, [ebp + 0x4c]
call fcn.00404ca1
push eax
lea ecx, [ebp + 0x4c]
call fcn.00404c85
push eax
lea ecx, [ebp + 0x4c]
call fcn.00404c6a
push eax
lea ecx, [ebp + 0x4c]
call fcn.00404c4e
push eax
lea ecx, [ebp + 0x4c]
call fcn.00404c2e
add eax, 3
lea ecx, [ebp - 0x2e0]
jmp 0x50764b
push ebx
push 0xf0
jmp 0x507034
push ebx
push 0x3840
jmp 0x507034
push ebx
push 0x54600
jmp 0x507034
push ebx
push 0x24ea00
jmp 0x507034
push ebx
push 0x9e3400
jmp 0x507034
push 0xffffffffffffffff
lea ecx, [ebp + 0x4c]
call fcn.00404cbd
push eax
lea ecx, [ebp + 0x4c]
call fcn.00404ca1
push eax
lea ecx, [ebp + 0x4c]
call fcn.00404c85
push eax
lea ecx, [ebp + 0x4c]
call fcn.00404c6a
push eax
lea ecx, [ebp + 0x4c]
call fcn.00404c4e
push eax
lea ecx, [ebp + 0x4c]
call fcn.00404c2e
add eax, 4
lea ecx, [ebp - 0x2a0]
jmp 0x50764b
push ebx
push 0x12c
jmp 0x507034
push ebx
push 0x4650
jmp 0x507034
push ebx
push 0x69780
jmp 0x507034
push ebx
push 0x2e2480
jmp 0x507034
push ebx
push 0xc5c100
jmp 0x507034
push 0xffffffffffffffff
lea ecx, [ebp + 0x4c]
call fcn.00404cbd
push eax
lea ecx, [ebp + 0x4c]
call fcn.00404ca1
push eax
lea ecx, [ebp + 0x4c]
call fcn.00404c85
push eax
lea ecx, [ebp + 0x4c]
call fcn.00404c6a
push eax
lea ecx, [ebp + 0x4c]
call fcn.00404c4e
push eax
lea ecx, [ebp + 0x4c]
call fcn.00404c2e
add eax, 5
lea ecx, [ebp - 0x2a8]
jmp 0x50764b
push ebx
push 0x168
jmp 0x507034
push ebx
push 0x5460
jmp 0x507034
push ebx
push 0x7e900
jmp 0x507034
push ebx
push 0x375f00
jmp 0x507034
push ebx
push 0xed4e00
jmp 0x507034
push 0xffffffffffffffff
lea ecx, [ebp + 0x4c]
call fcn.00404cbd
push eax
lea ecx, [ebp + 0x4c]
call fcn.00404ca1
push eax
lea ecx, [ebp + 0x4c]
call fcn.00404c85
push eax
lea ecx, [ebp + 0x4c]
call fcn.00404c6a
push eax
lea ecx, [ebp + 0x4c]
call fcn.00404c4e
push eax
lea ecx, [ebp + 0x4c]
call fcn.00404c2e
add eax, 6
lea ecx, [ebp - 0x2b8]
jmp 0x50764b
push ebx
push 0x258
jmp 0x507034
push ebx
push 0x8ca0
jmp 0x507034
push ebx
push 0xd2f00
jmp 0x507034
push ebx
push 0x5c4900
jmp 0x507034
push ebx
push 0x18b8200
jmp 0x507034
push 0xffffffffffffffff
lea ecx, [ebp + 0x4c]
call fcn.00404cbd
push eax
lea ecx, [ebp + 0x4c]
call fcn.00404ca1
push eax
lea ecx, [ebp + 0x4c]
call fcn.00404c85
push eax
lea ecx, [ebp + 0x4c]
call fcn.00404c6a
push eax
lea ecx, [ebp + 0x4c]
call fcn.00404c4e
push eax
lea ecx, [ebp + 0x4c]
call fcn.00404c2e
add eax, 0xa
lea ecx, [ebp - 0x2c8]
jmp 0x50764b
push ebx
push 0x2d0
jmp 0x507034
push ebx
push 0xa8c0
jmp 0x507034
push ebx
push 0xfd200
jmp 0x507034
push ebx
push 0x6ebe00
jmp 0x507034
push ebx
push 0x1da9c00
jmp 0x507034
push 0xffffffffffffffff
lea ecx, [ebp + 0x4c]
call fcn.00404cbd
push eax
lea ecx, [ebp + 0x4c]
call fcn.00404ca1
push eax
lea ecx, [ebp + 0x4c]
call fcn.00404c85
push eax
lea ecx, [ebp + 0x4c]
call fcn.00404c6a
push eax
lea ecx, [ebp + 0x4c]
call fcn.00404c4e
push eax
lea ecx, [ebp + 0x4c]
call fcn.00404c2e
add eax, 0xc
lea ecx, [ebp - 0x2d8]
jmp 0x50764b
push ebx
push 0x384
jmp 0x507034
push ebx
push 0xd2f0
jmp 0x507034
push ebx
push 0x13c680
jmp 0x507034
push ebx
push 0x8a6d80
jmp 0x507034
push ebx
push 0x2514300
jmp 0x507034
push 0xffffffffffffffff
lea ecx, [ebp + 0x4c]
call fcn.00404cbd
push eax
lea ecx, [ebp + 0x4c]
call fcn.00404ca1
push eax
lea ecx, [ebp + 0x4c]
call fcn.00404c85
push eax
lea ecx, [ebp + 0x4c]
call fcn.00404c6a
push eax
lea ecx, [ebp + 0x4c]
call fcn.00404c4e
push eax
lea ecx, [ebp + 0x4c]
call fcn.00404c2e
add eax, 0xf
lea ecx, [ebp - 0x298]
jmp 0x50764b
push ebx
push 0x4b0
jmp 0x507034
push ebx
push 0x11940
jmp 0x507034
push ebx
push 0x1a5e00
jmp 0x507034
push ebx
push 0xb89200
jmp 0x507034
push ebx
push 0x3170400
jmp 0x507034
push 0xffffffffffffffff
lea ecx, [ebp + 0x4c]
call fcn.00404cbd
push eax
lea ecx, [ebp + 0x4c]
call fcn.00404ca1
push eax
lea ecx, [ebp + 0x4c]
call fcn.00404c85
push eax
lea ecx, [ebp + 0x4c]
call fcn.00404c6a
push eax
lea ecx, [ebp + 0x4c]
call fcn.00404c4e
push eax
lea ecx, [ebp + 0x4c]
call fcn.00404c2e
add eax, 0x14
lea ecx, [ebp - 0x2f8]
jmp 0x50764b
push ebx
push 0x708
jmp 0x507034
push ebx
push 0x1a5e0
jmp 0x507034
push ebx
push 0x114db00
jmp 0x507034
push ebx
push 0x4a28600
jmp 0x507034
push 0xffffffffffffffff
lea ecx, [ebp + 0x4c]
call fcn.00404cbd
push eax
lea ecx, [ebp + 0x4c]
call fcn.00404ca1
push eax
lea ecx, [ebp + 0x4c]
call fcn.00404c85
push eax
lea ecx, [ebp + 0x4c]
call fcn.00404c6a
push eax
lea ecx, [ebp + 0x4c]
call fcn.00404c4e
push eax
lea ecx, [ebp + 0x4c]
call fcn.00404c2e
add eax, 0x1e
lea ecx, [ebp - 0x2d0]
jmp 0x50764b
push ebx
push 0xa8c
jmp 0x507034
push ebx
push 0x278d0
jmp 0x507034
push ebx
push 0x3b5380
jmp 0x507034
push ebx
push 0x19f4880
jmp 0x507034
push ebx
push 0x6f3c900
jmp 0x507034
push 0xffffffffffffffff
lea ecx, [ebp + 0x4c]
call fcn.00404cbd
push eax
lea ecx, [ebp + 0x4c]
call fcn.00404ca1
push eax
lea ecx, [ebp + 0x4c]
call fcn.00404c85
push eax
lea ecx, [ebp + 0x4c]
call fcn.00404c6a
push eax
lea ecx, [ebp + 0x4c]
call fcn.00404c4e
push eax
lea ecx, [ebp + 0x4c]
call fcn.00404c2e
add eax, 0x2d
lea ecx, [ebp - 0x2b0]
jmp 0x50764b
push ebx
push 0x1518
jmp 0x507034
push ebx
push 0x4f1a0
jmp 0x507034
push ebx
push 0x33e9100
jmp 0x507034
push ebx
push 0xde79200
jmp 0x507034
push 0xffffffffffffffff
lea ecx, [ebp + 0x4c]
call fcn.00404cbd
push eax
lea ecx, [ebp + 0x4c]
call fcn.00404ca1
push eax
lea ecx, [ebp + 0x4c]
call fcn.00404c85
push eax
lea ecx, [ebp + 0x4c]
call fcn.00404c6a
push eax
lea ecx, [ebp + 0x4c]
call fcn.00404c4e
push eax
lea ecx, [ebp + 0x4c]
call fcn.00404c2e
add eax, 0x5a
lea ecx, [ebp - 0x2f0]
push eax
call fcn.00404a9d
push dword [eax + 4]
mov ecx, dword [eax]
push ecx
mov ecx, esi
call fcn.00504853
cmp dword [ebp + 0x5c], 0x124f
jne 0x50766e
mov ecx, esi
call fcn.00505373
cmp dword [ebp + 0x5c], 0x124e
jne 0x507686
push ebx
mov ecx, esi
call fcn.004f9ddf
mov ecx, esi
call fcn.004f9089
cmp dword [ebp + 0x5c], 0x124d
jne 0x50769f
push 1
mov ecx, esi
call fcn.004f9ddf
mov ecx, esi
call fcn.004f9089
cmp dword [ebp + 0x5c], 0x123a
jne 0x5076b2
push dword [ebp + 0x3c]
mov ecx, esi
call fcn.00505233
cmp dword [ebp + 0x5c], 0x1250
je 0x5076c4
cmp dword [ebp + 0x5c], 0x1251
jne 0x5076d2
mov ecx, esi
call fcn.004fc6bd
mov ecx, esi
call fcn.004f0a1f
cmp dword [ebp + 0x5c], 0x1252
je 0x5076e4
cmp dword [ebp + 0x5c], 0x1253
jne 0x507700
cmp byte [edi + 0x1d9], 0
mov ecx, esi
sete al
movzx eax, al
push eax
call fcn.004fc1e5
mov ecx, esi
call fcn.004f0a1f
cmp dword [ebp + 0x5c], 0x802a
jne 0x507722
push dword [esi + 0x36c]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_KillTimer]
push 1
push ebx
mov ecx, esi
call fcn.004f1808
cmp dword [ebp + 0x5c], 0x802b
jne 0x507769
mov dword [esi + 0x194], 0x5a
mov eax, dword [edi + 0x334]
cmp byte [eax + 0x15c], 0
je 0x507748
cmp esi, edi
je 0x507762
push dword [esi + 0x36c]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_KillTimer]
push 1
push 0x5a
mov ecx, esi
call fcn.004f1808
mov ecx, esi
call fcn.004f0a1f
cmp dword [ebp + 0x5c], 0x802c
jne 0x5077b0
mov dword [esi + 0x194], 0x50
mov eax, dword [edi + 0x334]
cmp byte [eax + 0x15c], 0
je 0x50778f
cmp esi, edi
je 0x5077a9
push dword [esi + 0x36c]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_KillTimer]
push 1
push 0x50
mov ecx, esi
call fcn.004f1808
mov ecx, esi
call fcn.004f0a1f
cmp dword [ebp + 0x5c], 0x802d
jne 0x5077f7
mov dword [esi + 0x194], 0x46
mov eax, dword [edi + 0x334]
cmp byte [eax + 0x15c], 0
je 0x5077d6
cmp esi, edi
je 0x5077f0
push dword [esi + 0x36c]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_KillTimer]
push 1
push 0x46
mov ecx, esi
call fcn.004f1808
mov ecx, esi
call fcn.004f0a1f
cmp dword [ebp + 0x5c], 0x802e
jne 0x50783e
mov dword [esi + 0x194], 0x3c
mov eax, dword [edi + 0x334]
cmp byte [eax + 0x15c], 0
je 0x50781d
cmp esi, edi
je 0x507837
push dword [esi + 0x36c]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_KillTimer]
push 1
push 0x3c
mov ecx, esi
call fcn.004f1808
mov ecx, esi
call fcn.004f0a1f
cmp dword [ebp + 0x5c], 0x802f
jne 0x507885
mov dword [esi + 0x194], 0x32
mov eax, dword [edi + 0x334]
cmp byte [eax + 0x15c], 0
je 0x507864
cmp esi, edi
je 0x50787e
push dword [esi + 0x36c]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_KillTimer]
push 1
push 0x32
mov ecx, esi
call fcn.004f1808
mov ecx, esi
call fcn.004f0a1f
cmp dword [ebp + 0x5c], 0x8030
jne 0x5078cc
mov dword [esi + 0x194], 0x28
mov eax, dword [edi + 0x334]
cmp byte [eax + 0x15c], 0
je 0x5078ab
cmp esi, edi
je 0x5078c5
push dword [esi + 0x36c]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_KillTimer]
push 1
push 0x28
mov ecx, esi
call fcn.004f1808
mov ecx, esi
call fcn.004f0a1f
cmp dword [ebp + 0x5c], 0x8031
jne 0x507913
mov dword [esi + 0x194], 0x1e
mov eax, dword [edi + 0x334]
cmp byte [eax + 0x15c], 0
je 0x5078f2
cmp esi, edi
je 0x50790c
push dword [esi + 0x36c]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_KillTimer]
push 1
push 0x1e
mov ecx, esi
call fcn.004f1808
mov ecx, esi
call fcn.004f0a1f
cmp dword [ebp + 0x5c], 0x8032
jne 0x50795a
mov dword [esi + 0x194], 0x14
mov eax, dword [edi + 0x334]
cmp byte [eax + 0x15c], 0
je 0x507939
cmp esi, edi
je 0x507953
push dword [esi + 0x36c]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_KillTimer]
push 1
push 0x14
mov ecx, esi
call fcn.004f1808
mov ecx, esi
call fcn.004f0a1f
cmp dword [ebp + 0x5c], 0x8033
jne 0x5079a1
mov dword [esi + 0x194], 0xa
mov eax, dword [edi + 0x334]
cmp byte [eax + 0x15c], 0
je 0x507980
cmp esi, edi
je 0x50799a
push dword [esi + 0x36c]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_KillTimer]
push 1
push 0xa
mov ecx, esi
call fcn.004f1808
mov ecx, esi
call fcn.004f0a1f
cmp dword [ebp + 0x5c], 0xb798
jb 0x507a04
mov eax, dword [edi + 0x334]
mov ecx, dword [eax + 0xf7c]
add ecx, 0xb798
cmp dword [ebp + 0x5c], ecx
jae 0x507a04
mov ecx, dword [ebp + 0x5c]
add ecx, 0xffff4868
push ecx
lea ecx, [eax + 0xf70]
call fcn.0056534e
cmp eax, ebx
je 0x507df7
mov ecx, dword [eax + 8]
mov eax, dword [edi + 0x334]
push dword [eax + 0xfc4]
movzx eax, byte [eax + 0xfd4]
push eax
push ebx
push dword [ebp + 0x48]
push dword [ebp + 0x3c]
push ecx
mov ecx, esi
call fcn.00503e9d
mov eax, dword [ebp + 0x5c]
add eax, 0xffff4c50
cmp eax, 9
ja 0x507a27
push dword [ebp + 0x48]
mov eax, dword [ebp + 0x5c]
push dword [ebp + 0x3c]
add eax, 0xffff4c50
push eax
mov ecx, esi
call fcn.005053ee
cmp dword [ebp + 0x5c], 0x125a
jne 0x507a3d
push dword [ebp + 0x48]
mov ecx, esi
push dword [ebp + 0x3c]
call fcn.0050489f
cmp dword [ebp + 0x5c], 0x1245
jne 0x507a61
push 0xffffffffffffffff
mov ecx, esi
call fcn.004fe458
mov ecx, esi
call fcn.004fc0be
mov ecx, esi
mov byte [ebp + 0x47], 1
call fcn.004f0a1f
cmp dword [ebp + 0x5c], 0x1194
jb 0x507ab7
cmp dword [ebp + 0x5c], 0x11f7
ja 0x507ab7
mov eax, dword [ebp + 0x5c]
mov ecx, dword [edi + 0x334]
add eax, 0xffffee6c
push eax
add ecx, 0xcb0
call fcn.0056534e
cmp eax, ebx
je 0x507df7
mov ecx, dword [eax + 8]
call fcn.004ebd8e
push eax
mov ecx, esi
call fcn.004fe458
mov ecx, esi
call fcn.004fc0be
mov ecx, esi
mov byte [ebp + 0x47], 1
call fcn.004f0a1f
cmp dword [ebp + 0x5c], 0x1242
jne 0x507add
push ecx
lea eax, [ebp + 0xc]
mov dword [ebp], esp
mov ecx, esp
push eax
call fcn.00402e5b
mov ecx, esi
call fcn.004fdf89
mov ecx, esi
call fcn.004f0a1f
cmp dword [ebp + 0x5c], 0x1248
jne 0x507b01
mov ecx, dword [ebp + 0x38]
call fcn.004ebd8e
push eax
mov ecx, esi
call fcn.004fe458
mov ecx, esi
mov byte [ebp + 0x47], 1
call fcn.004f0a1f
cmp dword [ebp + 0x5c], 0x122a
je 0x507b13
cmp dword [ebp + 0x5c], 0x122b
jne 0x507b28
cmp byte [edi + 0x27c], 0
mov ecx, esi
sete al
movzx eax, al
push eax
call fcn.004fc516
cmp dword [ebp + 0x54], ebx
jne 0x506d8f
cmp byte [ebp + 0x47], 0
je 0x507b57
mov eax, dword [edi + 0x334]
mov ecx, dword [eax + 0xbac]
push 0xffffffffffffffff
push 1
call fcn.004be817
mov ecx, dword [edi + 0x334]
call fcn.004090df
cmp dword [ebp + 0x5c], 0x1249
jne 0x507b67
mov ecx, edi
call fcn.004fc6f5
cmp dword [ebp + 0x5c], 0x123b
jne 0x507b77
mov ecx, edi
call fcn.005013e8
cmp dword [ebp + 0x5c], 0x123d
jne 0x507b87
mov ecx, edi
call fcn.005015b1
cmp dword [ebp + 0x5c], 0x1238
jne 0x507b97
mov ecx, edi
call fcn.004fda7b
cmp dword [ebp + 0x5c], 0x1255
jne 0x507ba7
mov ecx, edi
call fcn.0050430c
cmp dword [ebp + 0x5c], 0x1254
jne 0x507bb7
mov ecx, edi
call fcn.00500b8e
cmp dword [ebp + 0x5c], 0x1258
jne 0x507bc7
mov ecx, edi
call fcn.005044c3
cmp dword [ebp + 0x5c], 0x1239
jne 0x507bd7
mov ecx, edi
call fcn.004fc810
cmp dword [ebp + 0x5c], 0x123c
jne 0x507be7
mov ecx, edi
call fcn.00501bcd
cmp dword [ebp + 0x5c], 0x1237
jne 0x507bf9
push 0xffffffffffffffff
mov ecx, edi
call fcn.00500814
cmp dword [ebp + 0x5c], 0x123e
jne 0x507c09
mov ecx, edi
call fcn.004f35df
cmp dword [ebp + 0x5c], 0x123f
jne 0x507c19
mov ecx, edi
call fcn.004f50b4
cmp dword [ebp + 0x5c], 0x1244
jne 0x507c29
mov ecx, edi
call fcn.004f05e0
cmp dword [ebp + 0x5c], 0x1243
jne 0x507c39
mov ecx, edi
call fcn.004f06c9
cmp dword [ebp + 0x5c], 0x1246
jne 0x507c75
push dword [edi + 0x2bc]
lea eax, [ebp + 0x34]
push ecx
mov dword [ebp], esp
mov ecx, esp
push eax
call fcn.00402e5b
push ecx
lea eax, [ebp + 8]
mov dword [ebp + 4], esp
mov ecx, esp
push eax
mov byte [ebp - 4], 0x29
call fcn.00402e5b
mov ecx, edi
mov byte [ebp - 4], 0x23
call fcn.004f3238
mov eax, dword [ebp + 0x5c]
add eax, 0xffffef98
cmp eax, 0xa
ja 0x507c92
mov eax, dword [ebp + 0x5c]
add eax, 0xffffef98
push eax
mov ecx, edi
call fcn.004f3900
mov ecx, dword [ebp + 0x34]
add ecx, 0xfffffff0
call fcn.00401493
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00401493
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.00401493
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 0x13
call fcn.0040bd21
lea ecx, [ebp - 0x130]
mov byte [ebp - 4], 0x12
call fcn.0040bd21
lea ecx, [ebp - 0x270]
mov byte [ebp - 4], 0x11
call fcn.0040bd21
lea ecx, [ebp - 0x1b0]
mov byte [ebp - 4], 0x10
call fcn.0040bd21
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 0xf
call fcn.0040bd21
lea ecx, [ebp - 0x1f0]
mov byte [ebp - 4], 0xe
call fcn.0040bd21
lea ecx, [ebp - 0x150]
mov byte [ebp - 4], 0xd
call fcn.0040bd21
lea ecx, [ebp - 0x190]
mov byte [ebp - 4], 0xc
call fcn.0040bd21
lea ecx, [ebp - 0x1d0]
mov byte [ebp - 4], 0xb
call fcn.0040bd21
lea ecx, [ebp - 0x210]
mov byte [ebp - 4], 0xa
call fcn.0040bd21
lea ecx, [ebp - 0x250]
mov byte [ebp - 4], 9
call fcn.0040bd21
lea ecx, [ebp - 0x290]
mov byte [ebp - 4], 8
call fcn.0040bd21
lea ecx, [ebp - 0x170]
mov byte [ebp - 4], 7
call fcn.0040bd21
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 6
call fcn.0040bd21
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 5
call fcn.0040bd21
lea ecx, [ebp - 0xd0]
mov byte [ebp - 4], 4
call fcn.0040bd21
lea ecx, [ebp - 0xf0]
mov byte [ebp - 4], 3
call fcn.0040bd21
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 2
call fcn.0040bd21
lea ecx, [ebp - 0x110]
mov byte [ebp - 4], 1
call fcn.0040bd21
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0
call fcn.0040bd21
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x14]
call fcn.0040bd21
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add ebp, 0x60
leave
ret 8
call fcn.0054d916
nop
xor dword [eax + 0x50], esi
add byte [eax + 112], al
push eax
add byte [eax + 0x70], cl
push eax
add byte [eax + 0x70], dl
push eax
add byte [eax + 0x70], bl
push eax
add byte [eax + 0x70], ah
push eax
add byte [ebx - 0x57ffaf90], ah
jo 0x507e6c
add byte [eax - 0x44ffaf90], dh
jo 0x507e74
add dh, al
jo 0x507e78
add cl, dl
jo 0x507e7c
add byte [0x20005071], dl
jno 0x507e84
add byte [ebx], ch
jno 0x507e88
add byte [esi], dh
jno 0x507e8c
add byte [ecx + 0x71], al
push eax
add byte [ecx + esi*2 + 0x50], cl
add byte [ecx - 0x63ffaf8f], dl
jno 0x507e9c
add byte [edi - 0x4dffaf8f], ah
jno 0x507ea4
add byte [ebp - 0x37ffaf8f], bh
jno 0x507eac
add byte [0x18005072], cl
jb 0x507eb4
add byte [ebx], ah
jb 0x507eb8
add byte [esi], ch
jb 0x507ebc
add byte [ecx], bh
jb 0x507ec0
add byte [edx + esi*2 + 0x50], al
add byte [ecx - 0x6bffaf8e], cl
jb 0x507ecc
add byte [edx + esi*2 + 0x729f0050], dl
push eax
add byte [edx - 0x4affaf8e], ch
jb 0x507ed8
add byte [edi - 0x55ffaf8e], bl
jb 0x507ed4
add byte [ebp - 0x3fffaf8e], dh
add al, al
jb 0x507edc
add byte [0x10005073], al
jae 0x507ee4
add byte [ebx], bl
jae 0x507ee8
add byte [esi], ah
jae 0x507eec
add byte [ecx], dh
jae 0x507ef0
add byte [ebx + esi*2], bh
push eax
add byte [ecx - 0x73ffaf8d], al
jae 0x507efc
add byte [edi - 0x5dffaf8d], dl
jae 0x507f04
add byte [ebp - 0x47ffaf8d], ch
jae 0x507f0c
add byte [eax - 0x2ffaf8d], bh
add ch, bh
jae 0x507f10
add byte [eax], cl
je 0x507f14
add byte [ebx], dl
je 0x507f18
add byte [esi], bl
je 0x507f1c
add byte [ecx], ch
je 0x507f20
add byte [esp + esi*2], dh
push eax
add byte [ecx + 0x74], bh
push eax
add byte [esp + esi*2 + 0x748f0050], al
push eax
add byte [edx - 0x5affaf8c], bl
je 0x507f38
add byte [edi - 0x65ffaf8c], cl
je 0x507f34
add byte [ebp - 0x4fffaf8c], ah
je 0x507f3c
add byte [eax - 0xaffaf8c], dh
add ch, dh
je 0x507f40
add byte [eax], al
jne 0x507f44
add byte [eax + 0x70], bl
push eax
add byte [ebx], cl
jne 0x507f4c
add byte [esi], dl
jne 0x507f50
add byte [ecx], ah
jne 0x507f54
add byte [esi + 0x75], ah
push eax
add byte [ecx + 0x75], dh
push eax
add byte [ebp + esi*2 + 0x50], bh
add byte [edi - 0x6dffaf8b], al
jne 0x507f68
add byte [edx - 0x62ffaf8b], dl
jne 0x507f6c
add byte [ebp - 0x20ffaf8b], bl
add bh, bl
jne 0x507f70
add dl, ch
jne 0x507f74
add byte [ecx + 0x71], al
push eax
add ch, dh
jne 0x507f7c
add byte [eax], al
jbe 0x507f80
add byte [ebx], cl
jbe 0x507f84
add byte [ebp - 0x7d], dl
in al, dx
dec eax
push pe_nt_image_headers32
add byte [eax], al
mov eax, 0x6386c0
xchg byte [ebx], ah
call fcn.0058c0ed
movsd dword es:[edi], dword [esi]
inc ecx
or byte [eax], al
mov ebx, ecx
cmp dword [ebx + 0x168], 6
push 0x6000001
push es
jne 0x507f66
push dword [ebp + 0x5c]
jne 0x507fb2
push dword [ebp + 0x58]
push dword [ebp + 0x54]
call fcn.004fe86c
jmp 0x509759
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
sar cl, 0x63
add byte [ebx + 0x1aca3], al
add byte [eax], al
and dword [ebx + 0x1ac], 0
add byte [eax], al
add byte [edx + 0x10], ch
push 0x10
adc bh, bh
salc
call esi
test ax, ax
push 0x11
setl byte [ebp + 0x54]
call esi
test ax, ax
push 0x12
setl byte [ebp + 0x48]
shr byte [edx + 0x12], 0xf
pushfd
inc ebp
dec eax
call esi
cmp dword [ebx + 0x1b8], 0xffffffff
mov ecx, ebx
je 0x507fa2
call fcn.004fdebb
jmp 0x509759
call fcn.004f0580
lea ecx, [ebp - 0x80]
call fcn.0040d212
and dword [ebp - 4], 0
lea eax, [ebp - 0x80]
push eax
mov ecx, ebx
call fcn.004f5b39
xor edi, edi
inc edi
cmp dword [ebx + 0x2f4], edi
jne 0x50857a
add byte [ebp - 0x74af7fbb], cl
retf
mov ecx, dword [ebx + 0x1d4]
lea eax, [ebp - 0x80]
push eax
call fcn.004dbffa
cmp dword [ebp + 0x58], eax
jle 0x50857a
mov ecx, dword [ebx + 0x1d4]
lea eax, [ebp - 0x80]
push eax
call fcn.004dbfdc
cmp dword [ebp + 0x5c], eax
jle 0x50857a
mov ecx, dword [ebx + 0x1d4]
lea eax, [ebp - 0x80]
push eax
call fcn.004dc009
mov ecx, ebx
mov edi, eax
call fcn.004f17ed
sub eax, edi
cmp dword [ebp + 0x58], eax
jge 0x508577
mov ecx, dword [ebx + 0x1d4]
lea eax, [ebp - 0x80]
push eax
call fcn.004dbfeb
mov ecx, ebx
mov edi, eax
call fcn.004f7c77
sub eax, edi
cmp dword [ebp + 0x5c], eax
jge 0x508577
mov ecx, dword [ebx + 0x1d4]
lea eax, [ebp - 0x80]
push eax
call fcn.004dbffa
sub dword [ebp + 0x58], eax
mov ecx, dword [ebx + 0x1d4]
lea eax, [ebp - 0x80]
push eax
call fcn.004dbfdc
sub dword [ebp + 0x5c], eax
mov eax, dword [ebx + 0x334]
mov ecx, dword [eax + 0xc4c]
add ecx, 0xfffffffe
cmp ecx, 0xc
ja case.default.0x50807f
jmp dword [ecx*4 + 0x509771]
lea ecx, [ebp + 0x38]
call fcn.00550747
cmp byte [ebp + 0x54], 0
je 0x5080f1
push 0
mov byte [ebp - 4], 1
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [ebp + 0x38]
call fcn.00550fc4
mov eax, dword [ebx + 0x2f8]
test eax, eax
je 0x5080b6
mov eax, dword [eax + 4]
push eax
push dword [ebp + 0x3c]
call fcn.0055135a
push 1
push 1
push dword [ebp + 0x5c]
mov esi, eax
push dword [ebp + 0x58]
push dword [ebp + 0x3c]
call dword [sym.imp.GDI32.dll_GetPixel]
push eax
mov ecx, ebx
call fcn.004fc135
test esi, esi
je 0x5080e3
mov esi, dword [esi + 4]
push esi
push dword [ebp + 0x3c]
call fcn.0055135a
jmp 0x50853d
push 0
mov byte [ebp - 4], 2
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [ebp + 0x38]
call fcn.00550fc4
mov eax, dword [ebx + 0x2f8]
test eax, eax
je 0x508113
mov eax, dword [eax + 4]
push eax
push dword [ebp + 0x3c]
call fcn.0055135a
push dword [ebp + 0x5c]
mov esi, eax
push dword [ebp + 0x58]
push dword [ebp + 0x3c]
call dword [sym.imp.GDI32.dll_GetPixel]
mov ecx, dword [ebx + 0x334]
mov dword [ecx + 0xc48], eax
mov eax, dword [ebx + 0x334]
add eax, 0xc48
push eax
mov ecx, ebx
call fcn.004f0506
mov ecx, ebx
call fcn.004f673c
mov ecx, ebx
call fcn.004f2da9
jmp 0x5080dc
cmp byte [ebx + 0x1d9], 0
jne case.default.0x50807f
mov ecx, ebx
call fcn.004f08f7
mov ecx, dword [ebx + 0x334]
push dword [ecx + 0xc48]
call fcn.0040997b
push eax
jmp 0x50819c
cmp byte [ebx + 0x1d9], 0
jne case.default.0x50807f
mov ecx, ebx
call fcn.004f08f7
push 0xffffffffffffffff
push 0xf
push dword [ebp + 0x5c]
lea eax, [ebp + 0x20]
push dword [ebp + 0x58]
mov ecx, ebx
push dword [ebp + 0x5c]
push dword [ebp + 0x58]
push eax
call fcn.004f82d5
mov ecx, ebx
call fcn.004f0a0d
mov ecx, ebx
call fcn.004f6c9f
mov ecx, ebx
call fcn.004f0a1f
push 1
lea eax, [ebp + 0x20]
push eax
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, dword [ebp + 0x58]
mov dword [ebx + 0x304], eax
mov eax, dword [ebp + 0x5c]
mov dword [ebx + 0x168], 5
mov dword [ebx + 0x308], eax
jmp case.default.0x50807f
or eax, 0xffffffff
mov dword [ebp + 0x38], eax
mov dword [ebp + 0x3c], eax
mov dword [ebp + 0x40], eax
mov dword [ebp + 0x44], eax
lea edi, [ebx + 0x30c]
lea esi, [ebp + 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov dword [ebx + 0x168], 5
movsd dword es:[edi], dword [esi]
call fcn.004f9251
lea eax, [ebp + 0x18]
push eax
mov eax, dword [ebx + 0x2f8]
push 0x18
push dword [eax + 4]
call dword [sym.imp.GDI32.dll_GetObjectW]
mov ecx, dword [ebp + 0x58]
mov eax, dword [ebp + 0x1c]
cmp ecx, eax
jle 0x50824a
lea ecx, [eax - 1]
mov dword [ebp + 0x58], ecx
mov eax, dword [ebp + 0x5c]
mov edx, dword [ebp + 0x20]
cmp eax, edx
jle 0x50825a
lea eax, [edx - 1]
mov dword [ebp + 0x5c], eax
mov dword [ebx + 0x304], ecx
mov dword [ebx + 0x308], eax
jmp 0x5084a4
cmp byte [ebx + 0x1d9], 0
jne case.default.0x50807f
cmp dword [eax + 0xc8c], ebx
jne 0x508444
mov ecx, ebx
call fcn.004f08f7
mov ecx, dword [ebx + 0x1d4]
lea eax, [ebp - 0x80]
push eax
call fcn.004dbffa
sub dword [ebp + 0x58], eax
mov ecx, dword [ebx + 0x1d4]
lea eax, [ebp - 0x80]
push eax
call fcn.004dbfdc
sub dword [ebp + 0x5c], eax
mov eax, dword [ebx + 0x2f8]
lea ecx, [ebp + 0x18]
push ecx
push 0x18
push dword [eax + 4]
call dword [sym.imp.GDI32.dll_GetObjectW]
lea ecx, [ebp + 0x38]
call fcn.00550747
push 0
mov byte [ebp - 4], 3
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [ebp + 0x38]
call fcn.00550fc4
mov eax, dword [ebx + 0x2f8]
test eax, eax
je 0x5082ee
mov eax, dword [eax + 4]
push eax
push dword [ebp + 0x3c]
call fcn.0055135a
push dword [ebp + 0x20]
mov esi, eax
push dword [ebp + 0x1c]
lea eax, [ebp + 0x38]
push dword [ebp + 0x5c]
mov ecx, ebx
push dword [ebp + 0x58]
push eax
call fcn.004f65ee
test esi, esi
je 0x508317
mov esi, dword [esi + 4]
push esi
push dword [ebp + 0x3c]
call fcn.0055135a
jmp 0x508423
cmp byte [ebx + 0x1d9], 0
jne case.default.0x50807f
mov ecx, ebx
call fcn.004f34d1
jmp case.default.0x50807f
cmp byte [ebx + 0x1d9], 0
jne case.default.0x50807f
push dword [eax + 0xc48]
mov ecx, ebx
push dword [ebp + 0x5c]
push dword [ebp + 0x58]
call fcn.004f8414
jmp case.default.0x50807f
cmp byte [ebx + 0x1d9], 0
jne case.default.0x50807f
cmp dword [eax + 0xc8c], ebx
jne 0x508444
mov ecx, ebx
call fcn.004f08f7
lea ecx, [ebp + 0x38]
call fcn.00550747
push 0
mov byte [ebp - 4], 4
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [ebp + 0x38]
call fcn.00550fc4
mov eax, dword [ebx + 0x2f8]
test eax, eax
je 0x5083ad
mov eax, dword [eax + 4]
push eax
push dword [ebp + 0x3c]
call fcn.0055135a
mov esi, eax
mov eax, dword [ebx + 0x334]
push ecx
add eax, 0x1634
mov dword [ebp + 0x54], esp
mov ecx, esp
push eax
call fcn.00402e5b
push dword [ebp + 0x5c]
lea eax, [ebp + 0x38]
push dword [ebp + 0x58]
mov ecx, ebx
push eax
call fcn.004f299a
test esi, esi
je 0x5083e7
mov esi, dword [esi + 4]
push esi
push dword [ebp + 0x3c]
call fcn.0055135a
mov eax, dword [ebx + 0x334]
mov ecx, dword [eax + 0x163c]
mov dword [eax + 0xc48], ecx
mov eax, dword [ebx + 0x334]
add eax, 0xc48
push eax
mov ecx, ebx
call fcn.004f0506
mov ecx, ebx
call fcn.004f673c
mov ecx, ebx
call fcn.004f2da9
mov ecx, ebx
call fcn.004f6c9f
mov ecx, ebx
call fcn.004f0a1f
mov ecx, ebx
call fcn.004f0a0d
lea ecx, [ebp + 0x38]
mov byte [ebp - 4], 0
call fcn.00551043
mov ecx, ebx
call fcn.004f0978
jmp case.default.0x50807f
cmp byte [ebx + 0x1d9], 0
jne case.default.0x50807f
mov ecx, dword [ebx + 0x1d4]
lea eax, [ebp - 0x80]
push eax
mov dword [ebx + 0x168], 6
call fcn.004dbffa
add dword [ebp + 0x58], eax
mov ecx, dword [ebx + 0x1d4]
lea eax, [ebp - 0x80]
push eax
call fcn.004dbfdc
add dword [ebp + 0x5c], eax
mov eax, dword [ebp + 0x58]
mov dword [ebx + 0x230], eax
mov eax, dword [ebp + 0x5c]
mov ecx, ebx
mov dword [ebx + 0x234], eax
call fcn.004f08f7
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_SetCapture]
push eax
call fcn.0055543f
jmp case.default.0x50807f
cmp byte [ebx + 0x1d9], 0
jne case.default.0x50807f
mov ecx, ebx
call fcn.004f08f7
lea ecx, [ebp + 0x38]
call fcn.00550747
push 0
mov byte [ebp - 4], 5
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
lea ecx, [ebp + 0x38]
call fcn.00550fc4
mov eax, dword [ebx + 0x2f8]
test eax, eax
je 0x5084f6
mov eax, dword [eax + 4]
push eax
push dword [ebp + 0x3c]
call fcn.0055135a
push dword [ebx + 0x288]
mov esi, eax
push dword [ebp + 0x5c]
lea eax, [ebp + 0x38]
push dword [ebp + 0x58]
mov ecx, ebx
push eax
call fcn.004f2b33
test esi, esi
je 0x50851f
mov esi, dword [esi + 4]
push esi
push dword [ebp + 0x3c]
call fcn.0055135a
mov ecx, ebx
call fcn.004f6c9f
mov ecx, ebx
call fcn.004f0a1f
mov ecx, ebx
call fcn.004f0a0d
lea ecx, [ebp + 0x38]
mov byte [ebp - 4], 0
call fcn.00551043
cmp byte [ebp + 0x48], 0
je 0x508567
mov ecx, ebx
call fcn.004f1df0
mov ecx, dword [ebx + 0x334]
push ebx
call fcn.0040a037
jmp case.default.0x509578
mov ecx, dword [ebx + 0x334]
call fcn.0040a07b
jmp case.default.0x509578
xor edi, edi
inc edi
mov ecx, dword [ebx + 0x1d4]
lea eax, [ebp - 0x80]
push eax
push dword [ebp + 0x5c]
push dword [ebp + 0x58]
call fcn.004dcdfe
mov dword [ebp + 0x34], eax
test eax, eax
jle 0x5092d6
dec eax
cmp eax, 0xbc
ja case.0x5085a6.7
jmp dword [eax*4 + 0x5097a5]
push dword [ebp + 0x54]
mov ecx, ebx
call fcn.00505233
jmp case.0x5085a6.7
mov ecx, ebx
call fcn.004fc6bd
jmp case.0x5085a6.7
cmp byte [ebx + 0x190], 0
mov ecx, ebx
sete al
movzx eax, al
push eax
call fcn.004f9ddf
mov ecx, ebx
call fcn.004f9089
jmp case.0x5085a6.7
mov ecx, ebx
call fcn.00505373
jmp case.0x5085a6.7
push dword [ebp + 0x48]
mov ecx, ebx
push dword [ebp + 0x54]
call fcn.0050489f
jmp case.0x5085a6.7
mov ecx, ebx
call fcn.00500b03
jmp case.0x5085a6.7
mov ecx, ebx
call fcn.005044c3
jmp case.0x5085a6.7
mov ecx, ebx
call fcn.004f35df
jmp case.0x5085a6.7
mov ecx, dword [ebx + 0x334]
call fcn.00408fc2
jmp case.0x5085a6.7
mov ecx, dword [ebx + 0x334]
call fcn.00425f75
jmp case.0x5085a6.7
mov ecx, dword [ebx + 0x334]
call fcn.0040b8c5
jmp case.0x5085a6.7
mov ecx, ebx
call fcn.004f994a
jmp case.0x5085a6.7
mov eax, dword [ebx + 0x334]
add eax, 0x1628
push str.activity.log
push eax
lea eax, [ebp + 0x48]
push eax
call fcn.0040e47a
add esp, 0xc
push edi
push 0
push dword [eax]
push str.notepad.exe
push 0
push dword [ebx + 0x20]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp + 0x48]
add ecx, 0xfffffff0
call fcn.00401493
jmp case.0x5085a6.7
mov ecx, ebx
call fcn.004f3725
jmp case.0x5085a6.7
mov ecx, ebx
call fcn.004f2042
jmp case.0x5085a6.7
push 0xffffffffffffffff
push edi
push edi
push ecx
mov dword [ebp + 0x54], esp
mov ecx, esp
push 0x6477c0
call fcn.00402035
mov ecx, dword [ebx + 0x334]
call fcn.0041b93f
jmp case.0x5085a6.7
mov ecx, ebx
call fcn.00501bcd
jmp case.0x5085a6.7
mov ecx, ebx
call fcn.004fda7b
jmp case.0x5085a6.7
mov ecx, ebx
call fcn.004fa621
jmp case.0x5085a6.7
cmp byte [ebp + 0x54], 0
mov ecx, ebx
sete al
movzx eax, al
push eax
call fcn.004f9a49
jmp case.0x5085a6.7
mov ecx, dword [ebx + 0x334]
push 0
push 0
call fcn.00423413
jmp case.0x5085a6.7
mov ecx, ebx
call fcn.004f06c9
jmp case.0x5085a6.7
mov ecx, dword [ebx + 0x334]
call fcn.00408972
jmp case.0x5085a6.7
push ecx
lea esi, [ebx + 0x334]
mov eax, dword [esi]
add eax, 0x108
mov dword [ebp + 0x54], esp
mov ecx, esp
push eax
call fcn.00402e5b
mov ecx, dword [esi]
call fcn.00420c9f
jmp case.0x5085a6.7
mov ecx, dword [ebx + 0x334]
call fcn.00416897
jmp case.0x5085a6.7
mov ecx, dword [ebx + 0x334]
call fcn.0040a4ee
jmp case.0x5085a6.7
push ecx
mov dword [ebp + 0x54], esp
mov ecx, esp
push str.skin_button
call fcn.00402035
mov ecx, dword [ebx + 0x334]
push 0
call fcn.0041d6c4
jmp case.0x5085a6.7
mov ecx, ebx
call fcn.005015b1
jmp case.0x5085a6.7
mov ecx, ebx
call fcn.004fc810
jmp case.0x5085a6.7
mov ecx, ebx
call fcn.005013e8
jmp case.0x5085a6.7
lea ecx, [ebx + 0x84]
call fcn.0049f79f
jmp case.0x5085a6.7
cmp dword [ebx + 0x2f4], 0
jne 0x508804
lea ecx, [ebx + 0x84]
call fcn.0049f456
jmp case.0x5085a6.7
mov ecx, ebx
call fcn.004f0965
test al, al
je case.0x5085a6.7
call fcn.004faa53
jmp case.0x5085a6.7
lea ecx, [ebx + 0x84]
call fcn.0049ef66
jmp case.0x5085a6.7
mov eax, dword [ebx + 0x2f4]
sub eax, 0
je 0x50884b
dec eax
jne case.0x5085a6.7
mov ecx, ebx
call fcn.004f3425
jmp case.0x5085a6.7
push 0x10
call esi
test ax, ax
setl al
movzx eax, al
push eax
lea ecx, [ebx + 0x84]
call fcn.0049ffa2
jmp case.0x5085a6.7
cmp byte [ebx + 0x1d9], 0
jne case.0x5085a6.7
mov eax, dword [ebx + 0x2f4]
sub eax, 0
je 0x5088aa
dec eax
jne case.0x5085a6.7
mov ecx, ebx
call fcn.004f1db8
test al, al
je case.0x5085a6.7
mov ecx, ebx
call fcn.004f08f7
mov ecx, ebx
call fcn.004fbaa2
jmp case.0x5085a6.7
push 0
push 0
push 0xe
push dword [ebx + 0xa4]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jne 0x5088d7
mov ecx, ebx
call fcn.004f1db8
test al, al
je 0x5088d7
mov ecx, ebx
call fcn.005004ef
jmp case.0x5085a6.7
push 0x10
call esi
test ax, ax
setl al
movzx eax, al
push eax
lea ecx, [ebx + 0x84]
call fcn.0049f4fc
jmp case.0x5085a6.7
lea ecx, [ebx + 0x84]
call fcn.004f0a99
jmp case.0x5085a6.7
xor esi, esi
push esi
push esi
push 0xe
push dword [ebx + 0xa4]
call dword [sym.imp.USER32.dll_SendMessageW]
push eax
push esi
lea ecx, [ebx + 0x84]
call fcn.00566fce
jmp case.0x5085a6.7
cmp dword [ebx + 0x2f4], edi
je case.0x5085a6.7
lea ecx, [ebx + 0x84]
call fcn.004a12fc
jmp case.0x5085a6.7
cmp dword [ebx + 0x2f4], 0
jne case.0x5085a6.7
push 0
push 0
push 0x454
push dword [ebx + 0xa4]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp case.0x5085a6.7
lea ecx, [ebx + 0x84]
call fcn.0049e9fb
jmp case.0x5085a6.7
lea ecx, [ebx + 0x84]
call fcn.0049ea39
jmp case.0x5085a6.7
lea ecx, [ebx + 0x84]
call fcn.0049ea77
jmp case.0x5085a6.7
lea ecx, [ebx + 0x84]
call fcn.0049f28e
jmp case.0x5085a6.7
lea ecx, [ebx + 0x84]
call fcn.0049f36d
jmp case.0x5085a6.7
lea ecx, [ebx + 0x84]
call fcn.0049eaf3
jmp case.0x5085a6.7
lea ecx, [ebx + 0x84]
call fcn.0049eb40
jmp case.0x5085a6.7
lea ecx, [ebx + 0x84]
call fcn.0049eb8d
jmp case.0x5085a6.7
lea ecx, [ebx + 0x84]
call fcn.0049ebda
jmp case.0x5085a6.7
mov ecx, ebx
call fcn.004f50b4
jmp case.0x5085a6.7
cmp byte [ebx + 0x27d], 0
je 0x508a20
mov ecx, dword [ebx + 0x334]
push 2
call fcn.004165b1
jmp 0x508a2b
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.WINMM.dll_PlaySoundW]
cmp byte [ebx + 0x27d], 0
sete al
mov byte [ebx + 0x27d], al
jmp case.0x5085a6.7
mov ecx, dword [ebx + 0x1d4]
lea eax, [ebp + 0x10]
push eax
call fcn.0040bc92
push edi
xor ecx, ecx
push ecx
push ecx
push dword [eax]
push ecx
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [ebp + 0x10]
jmp 0x50869c
push 0xffffffffffffffff
mov ecx, ebx
call fcn.00500814
jmp case.default.0x509578
push 0
push 0xffffffffffffffff
lea ecx, [ebx + 0x84]
call fcn.00566fb1
jmp case.0x5085a6.7
push 0
push edi
jmp 0x508a78
lea eax, [ebx + 0x1fc]
cmp byte [eax], 0
sete cl
mov byte [eax], cl
lea ecx, [ebp - 0xf4]
call fcn.0040d212
lea eax, [ebp - 0xf4]
push eax
mov ecx, ebx
mov byte [ebp - 4], 6
call fcn.004f5b39
lea eax, [ebp - 0xf4]
push eax
push 0xa
mov ecx, dword [ebx + 0x1d4]
call fcn.004dd16a
mov ecx, ebx
call fcn.004fbc73
mov ecx, ebx
call fcn.004f7d2e
mov ecx, ebx
call fcn.004f0a1f
lea ecx, [ebp - 0xf4]
mov byte [ebp - 4], 0
call fcn.0040c7d6
jmp case.0x5085a6.7
lea eax, [ebx + 0x1fd]
cmp byte [eax], 0
sete cl
mov byte [eax], cl
lea ecx, [ebp - 0xf4]
call fcn.0040d212
lea eax, [ebp - 0xf4]
push eax
mov ecx, ebx
mov byte [ebp - 4], 7
call fcn.004f5b39
lea eax, [ebp - 0xf4]
push eax
push 0xb
jmp 0x508ac1
lea eax, [ebx + 0x1fe]
cmp byte [eax], 0
sete cl
mov byte [eax], cl
lea ecx, [ebp - 0xf4]
call fcn.0040d212
lea eax, [ebp - 0xf4]
push eax
mov ecx, ebx
mov byte [ebp - 4], 8
call fcn.004f5b39
lea eax, [ebp - 0xf4]
push eax
push 0xc
jmp 0x508ac1
cmp byte [ebx + 0x29c], 0
mov ecx, ebx
sete al
movzx eax, al
push eax
call fcn.004fbcfa
jmp case.0x5085a6.7
push 0
push 0
lea ecx, [ebx + 0x84]
call fcn.0049f1ef
jmp case.0x5085a6.7
push 0
push edi
jmp 0x508b82
push 0x200
push 2
jmp 0x508b82
push 0
push 3
jmp 0x508b82
push edi
jmp 0x5085b0
cmp byte [ebx + 0x1d9], 0
mov ecx, ebx
sete al
movzx eax, al
push eax
call fcn.004fc1e5
jmp case.0x5085a6.7
mov ecx, dword [ebx + 0x1d4]
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp]
push eax
call fcn.004dc74f
mov ecx, dword [ebx + 0x1d4]
lea eax, [ebp - 0x80]
push eax
push dword [ebp - 0x54]
lea eax, [ebp + 0x20]
push dword [ebp - 0x58]
push dword [ebp - 0x7c]
push dword [ebp - 0x80]
push eax
call fcn.004dc439
mov eax, dword [ebp + 0x24]
mov ecx, dword [ebp + 0x2c]
cmp dword [ebp + 4], eax
jne 0x508c0c
cmp dword [ebp + 0xc], ecx
je case.0x5085a6.7
mov edx, dword [ebp + 0x5c]
mov dword [ebx + 0x174], eax
lea eax, [ebp + 0x40]
mov dword [ebx + 0x178], ecx
push eax
lea ecx, [ebx + 0x84]
mov dword [ebx + 0x168], 4
mov dword [ebx + 0x170], edx
call fcn.0049f5b2
fild dword [ebp + 0x44]
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp + 4]
push dword [ebx + 0x20]
mov dword [ebp + 0x30], eax
fild dword [ebp + 0x30]
fdiv qword [0x641600]
fdivp st(1)
fstp qword [ebx + 0x180]
call dword [sym.imp.USER32.dll_SetCapture]
push eax
call fcn.0055543f
mov ecx, ebx
call fcn.004f0a1f
jmp case.0x5085a6.7
lea ecx, [ebx + 0x84]
call fcn.0049edd3
jmp 0x508c66
lea ecx, [ebx + 0x84]
call fcn.0049ede6
jmp 0x508c66
mov ecx, ebx
call fcn.0050430c
jmp case.default.0x509578
mov ecx, ebx
call fcn.00500b8e
jmp case.0x5085a6.7
push dword [ebp + 0x48]
push dword [ebp + 0x54]
push 0
mov ecx, ebx
call fcn.005053ee
jmp case.0x5085a6.7
push dword [ebp + 0x48]
push dword [ebp + 0x54]
push edi
jmp 0x508cac
push dword [ebp + 0x48]
push dword [ebp + 0x54]
push 2
jmp 0x508cac
push dword [ebp + 0x48]
push dword [ebp + 0x54]
push 3
jmp 0x508cac
push dword [ebp + 0x48]
push dword [ebp + 0x54]
push 4
jmp 0x508cac
push dword [ebp + 0x48]
push dword [ebp + 0x54]
push 5
jmp 0x508cac
push dword [ebp + 0x48]
push dword [ebp + 0x54]
push 6
jmp 0x508cac
push dword [ebp + 0x48]
push dword [ebp + 0x54]
push 7
jmp 0x508cac
push dword [ebp + 0x48]
push dword [ebp + 0x54]
push 8
jmp 0x508cac
push dword [ebp + 0x48]
push dword [ebp + 0x54]
push 9
jmp 0x508cac
push edi
push 0
mov ecx, ebx
call fcn.005018eb
jmp case.0x5085a6.7
push edi
push edi
jmp 0x508d14
push edi
push 2
jmp 0x508d14
push edi
push 3
jmp 0x508d14
push edi
push 4
jmp 0x508d14
push edi
push 5
jmp 0x508d14
push edi
push 6
jmp 0x508d14
push edi
push 7
jmp 0x508d14
push edi
push 8
jmp 0x508d14
push edi
push 9
jmp 0x508d14
push 5
mov ecx, ebx
call fcn.004fa47e
jmp case.0x5085a6.7
push 3
jmp 0x508d4e
push 4
jmp 0x508d4e
mov ecx, ebx
call fcn.004f34d1
jmp case.0x5085a6.7
push 2
jmp 0x508d4e
mov ecx, ebx
call fcn.004f8636
jmp case.0x5085a6.7
cmp byte [ebx + 0x1d9], 0
jne case.0x5085a6.7
mov ecx, ebx
call fcn.004f08f7
mov ecx, ebx
call fcn.004fa99f
jmp case.0x5085a6.7
cmp byte [ebx + 0x1d9], 0
jne case.0x5085a6.7
mov ecx, ebx
call fcn.004f08f7
mov ecx, ebx
call fcn.004f055c
push eax
call fcn.004fa214
jmp case.0x5085a6.7
cmp byte [ebx + 0x1d9], 0
jne case.0x5085a6.7
mov ecx, ebx
call fcn.004f08f7
mov ecx, ebx
call fcn.004f8367
jmp case.0x5085a6.7
mov ecx, ebx
call fcn.00502682
jmp case.0x5085a6.7
mov ecx, ebx
call fcn.004fe40c
jmp case.0x5085a6.7
mov ecx, ebx
call fcn.004fa2fd
jmp case.0x5085a6.7
lea eax, [ebp + 0x40]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [ebp + 0x40]
mov edx, dword [ebp + 0x44]
push ecx
push ecx
mov eax, esp
mov dword [eax], ecx
mov ecx, ebx
mov dword [ebp + 0x30], esp
mov dword [eax + 4], edx
call fcn.00505a91
jmp case.0x5085a6.7
lea eax, [ebp + 0x40]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [ebx + 0x2f4]
xor ecx, ecx
sub eax, ecx
je 0x508e6b
dec eax
jne case.0x5085a6.7
mov ecx, dword [ebp + 0x40]
mov edx, dword [ebp + 0x44]
push ecx
push ecx
mov eax, esp
mov dword [eax], ecx
mov ecx, ebx
mov dword [ebp + 0x30], esp
mov dword [eax + 4], edx
call fcn.005031bd
jmp case.0x5085a6.7
push ecx
xor eax, eax
push eax
push ecx
lea ecx, [ebx + 0x84]
call fcn.004a14cc
jmp case.0x5085a6.7
mov ecx, ebx
call fcn.004fdc1a
jmp case.0x5085a6.7
mov ecx, ebx
call fcn.004f314e
jmp case.0x5085a6.7
mov ecx, ebx
call fcn.004f1ea2
jmp case.0x5085a6.7
mov ecx, ebx
call fcn.004faac8
jmp case.0x5085a6.7
push 8
jmp 0x508d4e
push 0xc
jmp 0x508d4e
push 0xa
jmp 0x508d4e
push 0xb
jmp 0x508d4e
push edi
mov ecx, dword [ebx + 0x334]
call fcn.0040b0cf
mov ecx, ebx
call fcn.004f2da9
jmp case.0x5085a6.7
push 2
jmp 0x508ecd
push 3
jmp 0x508ecd
push 4
jmp 0x508ecd
push 5
jmp 0x508ecd
push 6
jmp 0x508ecd
push 7
jmp 0x508ecd
push 8
jmp 0x508ecd
push 9
jmp 0x508ecd
push 0xa
jmp 0x508ecd
push 0xb
jmp 0x508ecd
push 0xd
jmp 0x508ecd
push 0xf
jmp 0x508ecd
push 0x11
jmp 0x508ecd
push 0x13
jmp 0x508ecd
push 0x15
jmp 0x508ecd
push 0
lea ecx, [ebx + 0x84]
call fcn.0049e93b
jmp case.0x5085a6.7
push edi
jmp 0x508f22
lea eax, [ebp + 0x14]
push eax
mov ecx, ebx
call fcn.0050052d
mov ecx, dword [ebp + 0x14]
jmp 0x50869c
push 0x6401e8
lea ecx, [ebp + 0x54]
call fcn.00402035
lea eax, [ebp + 0x54]
lea ecx, [ebx + 0x228]
push eax
mov byte [ebp - 4], 9
call fcn.00401dd7
mov ecx, dword [ebp + 0x54]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.00401493
mov eax, dword [ebx + 0x334]
add eax, 0x1a8
push eax
mov ecx, ebx
call fcn.004fb67d
jmp 0x508c66
mov ecx, dword [ebx + 0x334]
call fcn.004227c4
jmp case.0x5085a6.7
push 0xffffffffffffffff
lea ecx, [ebx + 0x84]
call fcn.0049f137
jmp case.0x5085a6.7
mov eax, dword [ebx + 0x334]
push dword [eax + 0xe60]
jmp 0x508fa1
mov eax, dword [ebx + 0x334]
push dword [eax + 0xe64]
jmp 0x508fa1
mov eax, dword [ebx + 0x334]
push dword [eax + 0xe68]
jmp 0x508fa1
mov eax, dword [ebx + 0x334]
push dword [eax + 0xe6c]
jmp 0x508fa1
mov eax, dword [ebx + 0x334]
push dword [eax + 0xe70]
jmp 0x508fa1
mov eax, dword [ebx + 0x334]
push dword [eax + 0xe74]
jmp 0x508fa1
mov eax, dword [ebx + 0x334]
push dword [eax + 0xe78]
jmp 0x508fa1
push dword [ebx + 0x36c]
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_KillTimer]
push edi
push 0
mov ecx, ebx
call fcn.004f1808
jmp case.0x5085a6.7
push 0x5a
mov eax, dword [ebx + 0x334]
pop esi
mov dword [ebx + 0x194], esi
cmp byte [eax + 0x15c], 0
jne 0x508c66
push dword [ebx + 0x36c]
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_KillTimer]
push edi
push esi
mov ecx, ebx
call fcn.004f1808
jmp 0x508c66
push 0x50
jmp 0x509033
push 0x46
jmp 0x509033
push 0x3c
jmp 0x509033
push 0x32
jmp 0x509033
push 0x28
jmp 0x509033
push 0x1e
jmp 0x509033
push 0x14
jmp 0x509033
push 0xa
jmp 0x509033
cmp dword [ebx + 0x2f4], 0
jne case.0x5085a6.7
lea ecx, [ebx + 0x84]
call fcn.0049ed45
jmp case.0x5085a6.7
cmp dword [ebx + 0x2f4], 0
jne case.0x5085a6.7
lea ecx, [ebx + 0x84]
call fcn.0049ed77
jmp case.0x5085a6.7
lea eax, [ebx + 0x238]
cmp byte [eax], 0
sete cl
mov byte [eax], cl
lea ecx, [ebp - 0xf4]
call fcn.0040d212
lea eax, [ebp - 0xf4]
push eax
mov ecx, ebx
mov byte [ebp - 4], 0xa
call fcn.004f5b39
mov ecx, dword [ebx + 0x1d4]
lea eax, [ebp - 0xf4]
push eax
push 0xf
call fcn.004dd16a
mov ecx, ebx
call fcn.004f0a1f
mov ecx, ebx
call fcn.004fbc73
jmp 0x508ae1
mov ecx, ebx
call fcn.004fc6f5
jmp case.0x5085a6.7
mov ecx, dword [ebx + 0x334]
call fcn.00422c9c
jmp case.0x5085a6.7
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebx + 0x334]
call fcn.00422c94
jmp case.0x5085a6.7
push dword [ebp + 0x54]
push 0
mov ecx, ebx
call fcn.004fb175
jmp case.0x5085a6.7
push dword [ebp + 0x54]
push edi
jmp 0x509152
push 0
push 3
jmp 0x509152
push 0
push 4
jmp 0x509152
push dword [ebp + 0x54]
push 2
jmp 0x509152
push dword [ebp + 0x54]
push 5
jmp 0x509152
mov ecx, ebx
call fcn.004fac8b
jmp case.0x5085a6.7
push dword [ebp + 0x54]
push 6
jmp 0x509152
push dword [ebp + 0x54]
push 7
jmp 0x509152
push 0xd
mov ecx, ebx
call fcn.004fa47e
mov eax, dword [ebx + 0x334]
mov dword [eax + 0xc8c], ebx
jmp case.0x5085a6.7
mov ecx, dword [ebx + 0x334]
call fcn.0041cfed
jmp case.0x5085a6.7
mov ecx, ebx
call fcn.004f05e0
jmp case.0x5085a6.7
mov eax, dword [ebx + 0x334]
cmp byte [eax + 0xec9], 0
je case.0x5085a6.7
lea ecx, [ebx + 0x84]
call fcn.004a1058
jmp case.0x5085a6.7
cmp byte [ebx + 0x27c], 0
mov ecx, ebx
sete al
movzx eax, al
push eax
call fcn.004fc516
jmp case.0x5085a6.7
mov ecx, ebx
call fcn.004fe60d
jmp case.0x5085a6.7
lea ecx, [ebx + 0x84]
call fcn.0049eab5
jmp case.0x5085a6.7
push 0xe
jmp 0x508d4e
lea ecx, [ebx + 0x84]
call fcn.0049fc21
jmp case.0x5085a6.7
lea ecx, [ebx + 0x84]
call fcn.0049fcdf
jmp case.0x5085a6.7
lea ecx, [ebx + 0x84]
call fcn.004a01d7
jmp case.0x5085a6.7
lea ecx, [ebx + 0x84]
call fcn.004a03b6
jmp case.0x5085a6.7
push 0x28
jmp 0x50926a
push 0x50
jmp 0x50926a
push 0x78
jmp 0x50926a
push 0xf0
lea ecx, [ebx + 0x84]
call fcn.0049f670
mov eax, dword [ebp + 0x34]
cmp eax, 0x3a
je 0x509290
cmp eax, 0x47
je 0x509290
cmp eax, 0x48
je 0x509290
cmp eax, 0x3b
jne case.default.0x509578
push dword [ebx + 0x20]
mov dword [ebx + 0x168], 3
mov dword [ebx + 0x16c], eax
call dword [sym.imp.USER32.dll_SetCapture]
push eax
call fcn.0055543f
push 0
push 0x190
push 0x4ce
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [ebx + 0x374], eax
mov byte [ebx + 0x3f1], 1
jmp case.default.0x509578
mov ecx, dword [ebx + 0x334]
call fcn.0040ae67
mov eax, dword [ebp + 0x5c]
mov ecx, dword [ebx + 0x1d4]
mov esi, dword [ebp + 0x58]
mov dword [ebp + 0x44], eax
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp + 0x20]
push eax
call fcn.004dc712
push dword [ebp + 0x44]
push esi
push eax
call dword [sym.imp.USER32.dll_PtInRect]
mov esi, dword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x509533
cmp byte [ebx + 0x1d9], 0
je 0x509332
mov eax, dword [ebx + 0x334]
cmp byte [eax + 0xce0], 0
jne 0x50954c
cmp byte [ebp + 0x54], 0
je 0x50947a
cmp byte [ebp + 0x48], 0
mov ecx, dword [ebx + 0x334]
push edi
mov byte [ebx + 0x1ff], 1
push ebx
je 0x50941d
cmp dword [ecx + 0xefc], 0
sete al
mov byte [ebx + 0x2cc], al
call fcn.0040a142
mov eax, dword [ebx + 0x334]
mov eax, dword [eax + 0xef4]
mov dword [ebp + 0x34], eax
mov esi, 0xef0
test eax, eax
je 0x5093d1
mov ecx, dword [ebx + 0x334]
lea eax, [ebp + 0x34]
push eax
add ecx, esi
call fcn.00408c8a
mov eax, dword [eax]
mov ecx, dword [ebx + 0x334]
push 0
push eax
add ecx, 0x14c4
mov dword [ebp + 0x54], eax
call fcn.00565371
test eax, eax
je 0x5093cb
mov ecx, dword [ebp + 0x54]
lea eax, [ebp + 0x40]
push eax
call fcn.004f179d
push dword [eax + 4]
mov ecx, ebx
push dword [eax]
push dword [ebp + 0x54]
call fcn.004fe75d
cmp dword [ebp + 0x34], 0
jne 0x509382
mov ecx, dword [ebx + 0x334]
push 0
push ebx
add ecx, esi
call fcn.00565371
test eax, eax
je 0x509401
lea eax, [ebp + 0x20]
push eax
mov ecx, ebx
call fcn.004f0b8d
lea edi, [ebx + 0x348]
mov esi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor edi, edi
inc edi
jmp 0x509411
lea eax, [ebx + 0x348]
push eax
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov byte [ebx + 0x2cd], 1
jmp 0x50950a
cmp dword [ecx + 0xefc], 0
sete al
mov byte [ebx + 0x2cc], al
call fcn.0040a142
mov ecx, dword [ebx + 0x334]
push 0
push ebx
add ecx, 0xef0
call fcn.00565371
test eax, eax
je 0x509469
lea eax, [ebp + 0x20]
push eax
mov ecx, ebx
call fcn.004f0b8d
lea edi, [ebx + 0x348]
mov esi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor edi, edi
inc edi
jmp 0x50950a
lea eax, [ebx + 0x348]
push eax
push dword [ebx + 0x20]
call esi
jmp 0x50950a
mov ecx, ebx
call fcn.004f1df0
mov ecx, dword [ebx + 0x334]
push 0
push ebx
add ecx, 0xef0
call fcn.00565371
test eax, eax
je 0x5094b5
lea eax, [ebp + 0x20]
push eax
mov ecx, ebx
call fcn.004f0b8d
lea edi, [ebx + 0x348]
mov esi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor edi, edi
inc edi
jmp 0x5094c1
lea eax, [ebx + 0x348]
push eax
push dword [ebx + 0x20]
call esi
cmp byte [ebp + 0x48], 0
je 0x50950a
and dword [ebx + 0x1ac], 0
lea eax, [ebx + 0x2a0]
push eax
mov byte [ebx + 0x29e], 1
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp + 0x40]
push eax
mov ecx, ebx
call fcn.004f179d
mov ecx, dword [eax]
mov dword [ebx + 0x2a8], ecx
mov eax, dword [eax + 4]
mov ecx, dword [ebx + 0x334]
push ebx
mov dword [ebx + 0x2ac], eax
call fcn.0040a037
mov eax, dword [ebp + 0x58]
push dword [ebx + 0x20]
mov dword [ebx + 0x340], eax
mov eax, dword [ebp + 0x5c]
mov dword [ebx + 0x168], edi
mov dword [ebx + 0x344], eax
call dword [sym.imp.USER32.dll_SetCapture]
push eax
call fcn.0055543f
jmp 0x50954c
cmp byte [ebp + 0x48], 0
je 0x50954c
mov ecx, ebx
call fcn.004f1df0
mov ecx, dword [ebx + 0x334]
push ebx
call fcn.0040a037
cmp byte [ebx + 0x1d9], 0
je 0x509568
mov eax, dword [ebx + 0x334]
cmp byte [eax + 0xce0], 0
jne case.default.0x509578
mov eax, dword [ebx + 0x19c]
dec eax
cmp eax, 7
ja case.default.0x509578
jmp dword [eax*4 + 0x509a99]
lea esi, [ebx + 0x348]
push esi
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov dword [ebx + 0x164], 1
mov eax, dword [ebp + 0x58]
lea edi, [ebx + 0x26c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebx + 0x340], eax
mov eax, dword [ebp + 0x5c]
mov dword [ebx + 0x344], eax
lea eax, [ebp + 0x58]
movsd dword es:[edi], dword [esi]
push eax
push dword [ebx + 0x20]
movsd dword es:[edi], dword [esi]
mov dword [ebx + 0x168], 2
call dword [sym.imp.USER32.dll_ClientToScreen]
mov eax, dword [ebp + 0x58]
mov dword [ebx + 0x1a0], eax
jmp 0x509742
lea esi, [ebx + 0x348]
push esi
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov dword [ebx + 0x164], 4
jmp 0x509599
lea esi, [ebx + 0x348]
push esi
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov dword [ebx + 0x164], 3
mov dword [ebx + 0x168], 2
mov eax, dword [ebp + 0x58]
lea edi, [ebx + 0x26c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebx + 0x340], eax
mov eax, dword [ebp + 0x5c]
movsd dword es:[edi], dword [esi]
mov dword [ebx + 0x344], eax
jmp 0x509742
lea esi, [ebx + 0x348]
push esi
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov dword [ebx + 0x164], 5
jmp 0x509610
lea esi, [ebx + 0x348]
push esi
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_GetWindowRect]
push 2
pop eax
mov dword [ebx + 0x164], eax
mov dword [ebx + 0x168], eax
jmp 0x50961a
lea esi, [ebx + 0x348]
push esi
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp + 0x58]
lea edi, [ebx + 0x26c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebx + 0x340], eax
mov eax, dword [ebp + 0x5c]
mov dword [ebx + 0x344], eax
lea eax, [ebp + 0x58]
movsd dword es:[edi], dword [esi]
push eax
push dword [ebx + 0x20]
movsd dword es:[edi], dword [esi]
mov dword [ebx + 0x164], 8
mov dword [ebx + 0x168], 2
call dword [sym.imp.USER32.dll_ClientToScreen]
mov eax, dword [ebp + 0x58]
mov dword [ebx + 0x1a0], eax
jmp 0x509739
lea esi, [ebx + 0x348]
push esi
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov dword [ebx + 0x164], 6
jmp 0x509706
lea esi, [ebx + 0x348]
push esi
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov dword [ebx + 0x164], 7
mov eax, dword [ebp + 0x58]
lea edi, [ebx + 0x26c]
movsd dword es:[edi], dword [esi]
mov dword [ebx + 0x340], eax
mov eax, dword [ebp + 0x5c]
movsd dword es:[edi], dword [esi]
mov dword [ebx + 0x344], eax
lea eax, [ebp + 0x58]
movsd dword es:[edi], dword [esi]
push eax
push dword [ebx + 0x20]
movsd dword es:[edi], dword [esi]
mov dword [ebx + 0x168], 2
call dword [sym.imp.USER32.dll_ClientToScreen]
mov eax, dword [ebp + 0x5c]
mov dword [ebx + 0x1a4], eax
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_SetCapture]
push eax
call fcn.0055543f
lea ecx, [ebp - 0x80]
call fcn.0040c7d6
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add ebp, 0x4c
leave
ret 0xc