Function at 0x475560
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d22f8
mov eax, dword fs:[0]
push eax
sub esp, 0x2b4
mov eax, dword [0x513b94]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x2b4], esi
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
mov dword [ebp - 0x2a4], eax
lea eax, [edi - 0x1000]
mov dword [ebp - 0x2b0], ecx
mov dword [ebp - 0x298], edx
cmp eax, 0xff
ja 0x4755d5
push edx
push ecx
push edi
push dword [ebp - 0x2a4]
mov ecx, esi
call fcn.00473160
jmp 0x4770ed
movzx eax, dx
mov dword [ebp - 0x29c], eax
lea eax, [edi - 0x200]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xe
mov eax, dword [ebp - 0x29c]
ja 0x475674
cwde
xorps xmm0, xmm0
mov dword [ebp - 0x230], eax
mov eax, edx
shr eax, 0x10
cwde
mov dword [ebp - 0x22c], eax
mov eax, dword [ebp - 0x2a4]
mov dword [ebp - 0x254], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x250], eax
lea eax, [ebp - 0x230]
push eax
push dword [esi + 0x2c]
mov dword [ebp - 0x24c], ecx
mov ecx, esi
mov dword [ebp - 0x248], edx
movq qword [ebp - 0x244], xmm0
mov dword [ebp - 0x23c], 0
call fcn.00475370
lea eax, [ebp - 0x254]
push eax
push 0
push 0x407
push dword [esi + 0x2c]
call edi
mov eax, dword [ebp - 0x29c]
mov ecx, dword [ebp - 0x2b0]
mov edx, dword [ebp - 0x298]
cmp dword [ebp + 0xc], 0x201
movzx eax, ax
mov dword [ebp - 0x29c], eax
movzx eax, ax
jne 0x4757b5
cmp byte [esi + 0xb4], 0
je 0x4756ca
movsx edi, ax
mov eax, edi
sub eax, dword [esi + 0x90]
cdq
xor eax, edx
sub eax, edx
cmp eax, 8
jg 0x47579e
push dword [ebp - 0x2a4]
call dword [sym.imp.USER32.dll_SetCapture]
push dword [esi + 0x34]
call dword [sym.imp.USER32.dll_SetCursor]
mov dword [esi + 0xb8], edi
push dword [ebp - 0x2a4]
call dword [sym.imp.USER32.dll_SetFocus]
mov edx, dword [ebp - 0x29c]
movzx eax, dx
lea edx, [ebp - 0x2a0]
movsx ecx, ax
mov eax, dword [ebp - 0x298]
push edx
push 0
shr eax, 0x10
lea edx, [ebp - 0x22c]
push edx
cwde
push eax
push ecx
mov ecx, esi
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x2a0], 0
call fcn.004723b0
mov edi, dword [ebp - 0x2a0]
mov dword [ebp - 0x22c], eax
test al, 0xe0
je 0x475742
push 0
push 0
push edi
push 0
push 0xfffffffffffffffe
push dword [esi + 8]
mov ecx, esi
call fcn.004704e0
mov eax, dword [ebp - 0x22c]
test al, 0x40
je 0x476f50
mov eax, dword [edi + 0x20]
shr eax, 4
mov cl, al
and al, 1
not cl
and cl, 1
mov byte [ebp - 0x2b9], cl
cmp cl, al
je case.0x4762c4.35
mov eax, dword [esi + 8]
test cl, cl
push 0
push 0
push edi
push 0
mov ecx, esi
je 0x476e66
push 0x7d1
push eax
call fcn.004704e0
test eax, eax
jne case.0x4762c4.35
or dword [edi + 0x20], 0x30
mov ecx, edi
call fcn.00472030
jmp 0x476e84
push 0xfffffffffffffff4
push dword [esi + 8]
call dword [sym.imp.USER32.dll_GetClassLongW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
jmp 0x4756ca
cmp dword [ebp + 0xc], 0x200
jne 0x475933
cmp byte [esi + 0xb4], 0
je case.0x4762c4.35
movsx edi, ax
mov dword [ebp - 0x29c], edi
call dword [sym.imp.USER32.dll_GetCapture]
cmp eax, dword [ebp - 0x2a4]
jne 0x47586f
test byte [ebp - 0x2b0], 1
je 0x47586f
sub edi, dword [esi + 0xb8]
mov dword [ebp - 0x29c], edi
je 0x475861
mov ecx, dword [esi + 0x94]
mov edx, ecx
mov edi, dword [esi + 0x90]
sub edx, edi
mov eax, dword [ebp - 0x29c]
add eax, edi
cmp eax, ecx
mov ecx, esi
cmovge edx, dword [ebp - 0x29c]
add dword [esi + 0xb8], edx
add edi, edx
push edi
call fcn.004745f0
lea eax, [ebp - 0x268]
mov dword [ebp - 0x268], 1
push eax
mov eax, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0x120c
push dword [esi + 0xc]
mov dword [ebp - 0x264], edi
call eax
mov ecx, esi
call fcn.00474770
push dword [esi + 0x34]
call dword [sym.imp.USER32.dll_SetCursor]
jmp case.0x4762c4.35
mov eax, edi
sub eax, dword [esi + 0x90]
cdq
xor eax, edx
sub eax, edx
cmp eax, 8
jle 0x475861
push 0xfffffffffffffff4
push dword [esi + 8]
call dword [sym.imp.USER32.dll_GetClassLongW]
cmp dword [esi + 0xd4], 0
mov ecx, eax
mov edi, dword [ebp - 0x298]
mov dword [ebp - 0x2a0], ecx
je 0x475927
lea ecx, [ebp - 0x2b4]
mov dword [ebp - 0x2b8], 0
push ecx
lea ecx, [ebp - 0x2ac]
mov dword [ebp - 0x2ac], 0
push ecx
mov eax, edi
mov dword [ebp - 0x2b4], 0
shr eax, 0x10
lea ecx, [ebp - 0x2b8]
push ecx
cwde
mov ecx, esi
push eax
push dword [ebp - 0x29c]
call fcn.004723b0
mov ecx, dword [ebp - 0x2b4]
test ecx, ecx
je 0x475921
push dword [ebp - 0x2ac]
mov eax, dword [esi + 0xd4]
push ecx
call eax
mov ecx, dword [ebp - 0x2a0]
add esp, 8
test eax, eax
cmovne ecx, eax
push ecx
call dword [sym.imp.USER32.dll_SetCursor]
jmp 0x4770d3
mov ecx, dword [ebp - 0x2a0]
push ecx
call dword [sym.imp.USER32.dll_SetCursor]
jmp 0x4770d3
mov eax, dword [ebp + 0xc]
cmp eax, 0x202
jne 0x475979
cmp byte [esi + 0xb4], 0
je case.0x4762c4.35
call dword [sym.imp.USER32.dll_GetCapture]
cmp eax, dword [ebp - 0x2a4]
jne case.0x4762c4.35
call dword [sym.imp.USER32.dll_ReleaseCapture]
push 0xfffffffffffffff4
push dword [esi + 8]
call dword [sym.imp.USER32.dll_GetClassLongW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
jmp case.0x4762c4.35
cmp eax, 0x100
ja 0x47664c
je 0x476246
add eax, 0xfffffffe
cmp eax, 0x85
ja case.0x4762c4.35
movzx eax, byte [eax + 0x477158]
jmp dword [eax*4 + 0x477128]
push edx
push ecx
push dword [ebp + 0xc]
push dword [ebp - 0x2a4]
test ecx, ecx
je 0x4759d2
call dword [sym.imp.USER32.dll_DefWindowProcW]
mov ecx, esi
mov byte [esi + 0x9d], 0
mov edi, eax
call fcn.00474370
mov eax, edi
jmp 0x4770ed
mov byte [esi + 0x9d], 1
call dword [sym.imp.USER32.dll_DefWindowProcW]
jmp 0x4770ed
cmp ecx, dword [ebp - 0x2a4]
je case.0x476cfe.8
jmp case.0x4762c4.35
xor eax, eax
mov dword [esi + 0x30], ecx
cmp word [ebp - 0x29c], ax
setne al
push eax
push ecx
push 0x30
push dword [esi + 0xc]
mov dword [ebp - 0x2b8], eax
call edi
mov edi, dword [ebp - 0x2b8]
mov eax, dword [sym.imp.USER32.dll_SendMessageW]
push edi
push dword [esi + 0x30]
push 0x30
push dword [esi + 0x14]
call eax
push edi
push dword [esi + 0x30]
push 0x30
push dword [esi + 0x2c]
call dword [sym.imp.USER32.dll_SendMessageW]
push edi
push dword [esi + 0x30]
push 0x30
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_SendMessageW]
push edi
push dword [esi + 0x30]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0x30
push dword [esi + 0x18]
call edi
lea eax, [ebp - 0x248]
push eax
push dword [esi + 8]
call dword [sym.imp.USER32.dll_GetClientRect]
lea eax, [ebp - 0x248]
mov dword [ebp - 0x27c], 0
mov dword [ebp - 0x220], eax
xorps xmm0, xmm0
lea eax, [ebp - 0x294]
movq qword [ebp - 0x284], xmm0
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x220]
push eax
push 0
push 0x1205
push dword [esi + 0xc]
movups xmmword [ebp - 0x294], xmm0
call edi
mov eax, dword [ebp - 0x27c]
mov edi, dword [sym.imp.USER32.dll_SetWindowPos]
or eax, 0x40
push eax
push dword [ebp - 0x280]
push dword [esi + 0x90]
push 0
push 0
push dword [ebp - 0x290]
push dword [esi + 0xc]
call edi
mov eax, dword [ebp - 0x27c]
mov ecx, dword [esi + 0x90]
or eax, 0x40
push eax
push dword [ebp - 0x280]
mov eax, dword [ebp - 0x284]
sub eax, ecx
push eax
push 0
push ecx
push dword [esi + 0xc]
push dword [esi + 0x14]
call edi
cmp word [ebp - 0x29c], 0
je case.default.0x476cfe
mov ecx, esi
call fcn.00474370
xor eax, eax
jmp 0x4770ed
mov eax, dword [esi + 0x7c]
test eax, eax
je case.0x4762c4.35
push eax
mov ecx, esi
call fcn.004743c0
jmp case.0x4762c4.35
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CreateRectRgn]
push 0
mov edi, eax
push edi
push dword [ebp - 0x2a4]
call dword [sym.imp.USER32.dll_GetUpdateRgn]
cmp eax, 1
je 0x475b91
lea eax, [ebp - 0x278]
push eax
push dword [ebp - 0x2a4]
call dword [sym.imp.USER32.dll_BeginPaint]
push edi
lea eax, [ebp - 0x278]
mov ecx, esi
push eax
call fcn.00470560
lea eax, [ebp - 0x278]
push eax
push dword [ebp - 0x2a4]
call dword [sym.imp.USER32.dll_EndPaint]
push edi
call dword [sym.imp.GDI32.dll_DeleteObject]
xor eax, eax
jmp 0x4770ed
push edx
push ecx
push dword [ebp + 0xc]
push dword [ebp - 0x2a4]
call dword [sym.imp.USER32.dll_DefWindowProcW]
or eax, 1
jmp 0x4770ed
mov ecx, esi
call fcn.00474770
mov ecx, esi
call fcn.00474970
mov ecx, esi
call fcn.004744e0
push 0x2c
lea eax, [ebp - 0x264]
mov dword [ebp - 0x268], 0x30
push 0
push eax
call fcn.004a3e00
mov eax, dword [esi + 8]
lea ecx, [ebp - 0x258]
add esp, 0xc
mov dword [ebp - 0x260], eax
push ecx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
lea eax, [ebp - 0x268]
push eax
push 0
push 0x434
push dword [esi + 0x2c]
call edi
jmp case.0x4762c4.35
mov eax, dword [edx]
cmp eax, dword [esi + 0x2c]
mov eax, dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 0x29c], eax
jne 0x475ea9
mov eax, dword [edx + 8]
cmp eax, 0xfffffdee
je 0x475ce5
cmp eax, 0xfffffdf7
jne 0x475ea9
lea eax, [ebp - 0x288]
mov ecx, esi
push eax
push dword [esi + 0xac]
push 1
push 0
push dword [esi + 0xa4]
push dword [esi + 0xa8]
call fcn.004718c0
lea eax, [ebp - 0x288]
push eax
push 1
push 0x41f
push dword [esi + 0x2c]
call edi
push 2
lea eax, [ebp - 0x288]
push eax
push 0
push dword [esi + 8]
call dword [sym.imp.USER32.dll_MapWindowPoints]
push 0x15
push 0
push 0
push dword [ebp - 0x284]
push dword [ebp - 0x288]
push 0
push dword [esi + 0x2c]
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0
push dword [esi + 0x30]
push 0x30
push dword [esi + 0x2c]
call edi
push 0
push 0
push dword [esi + 0xac]
mov ecx, esi
push dword [esi + 0xa4]
push 0x7d5
push dword [esi + 0x2c]
call fcn.004704e0
mov eax, 1
jmp 0x4770ed
cmp dword [esi + 0xac], 0
lea eax, [edx + 0xc]
mov dword [ebp - 0x2a8], eax
je 0x475ea3
push eax
push 0
lea edi, [edx + 0x10]
mov ecx, esi
mov dword [eax], edi
push dword [esi + 0xac]
push dword [esi + 0xa4]
push 0x7d4
push dword [esi + 8]
call fcn.004704e0
test eax, eax
jne case.default.0x476cfe
mov edx, dword [esi + 0xac]
lea esi, [ebp - 0x2b8]
mov dword [ebp - 0x2b8], 0x50
push esi
mov esi, dword [ebp - 0x2b4]
mov ecx, dword [edx + 4]
push edi
push dword [esi + 0xa4]
mov eax, dword [ecx]
push edx
mov eax, dword [eax + 8]
call eax
push 0x4e
mov dword [ebp - 0x2ac], eax
mov dword [ebp - 0x288], 0
mov dword [ebp - 0x284], 0
call dword [ebp - 0x29c]
mov ecx, esi
mov dword [ebp - 0x280], eax
call fcn.004730b0
mov dword [ebp - 0x27c], eax
mov ecx, esi
lea eax, [ebp - 0x228]
push eax
push dword [esi + 0xac]
push 1
push 1
push dword [esi + 0xa4]
push dword [esi + 0xa8]
call fcn.004718c0
lea eax, [ebp - 0x254]
mov dword [ebp - 0x254], 0x1c
push eax
push 2
push dword [esi + 0x24]
xorps xmm0, xmm0
mov dword [ebp - 0x23c], 0
movups xmmword [ebp - 0x24c], xmm0
mov dword [ebp - 0x250], 4
call dword [sym.imp.USER32.dll_GetScrollInfo]
mov eax, dword [ebp - 0x228]
cmp eax, dword [esi + 0x90]
jne 0x475e03
cmp dword [ebp - 0x240], 0
jne case.default.0x476cfe
mov eax, dword [esi + 0xa0]
push dword [esi + 8]
and eax, 0xfffb3fff
or eax, 0x400
mov dword [ebp - 0x2b4], eax
call dword [sym.imp.USER32.dll_GetDC]
push dword [esi + 0x30]
mov dword [ebp - 0x2a0], eax
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
push dword [ebp - 0x2b4]
mov edi, eax
lea eax, [ebp - 0x288]
push eax
push 0xffffffffffffffff
push dword [ebp - 0x2ac]
push dword [ebp - 0x2a0]
call dword [sym.imp.USER32.dll_DrawTextW]
push edi
mov edi, dword [ebp - 0x2a0]
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
push edi
push dword [esi + 8]
call dword [sym.imp.USER32.dll_ReleaseDC]
mov edx, dword [ebp - 0x220]
mov ecx, 0x4dd79c
mov eax, dword [ebp - 0x280]
sub edx, dword [ebp - 0x228]
sub eax, dword [ebp - 0x288]
cmp eax, edx
mov eax, dword [ebp - 0x2a8]
mov edx, dword [ebp - 0x298]
cmovg ecx, dword [ebp - 0x2ac]
mov dword [eax], ecx
jmp 0x475ea9
mov dword [eax], 0x4dd79c
mov edi, dword [esi + 0xc]
mov ecx, dword [edx]
cmp ecx, edi
je 0x475ebb
cmp ecx, dword [esi + 0x14]
jne case.0x4762c4.35
mov eax, dword [edx + 8]
cmp eax, 0xfffffec0
ja 0x47612a
je 0x475f8e
cmp eax, 0xfffffebb
je 0x475f14
cmp eax, 0xfffffebe
je 0x475eed
cmp eax, 0xfffffebf
je 0x475f82
jmp case.0x4762c4.35
cmp ecx, edi
jne 0x475ef5
xor eax, eax
jmp 0x475ef9
mov eax, dword [edx + 0xc]
inc eax
push 0
push 0
push 0
push eax
push 0x7d3
push dword [esi + 8]
mov ecx, esi
call fcn.004704e0
jmp case.0x4762c4.35
xor eax, eax
cmp ecx, dword [esi + 0x14]
sete al
add eax, dword [edx + 0xc]
mov dword [ebp - 0x2a8], eax
jne 0x475f53
cmp byte [esi + 0x9c], 0
je 0x475f53
mov edi, dword [esi + 0x98]
mov ecx, esi
push edi
push eax
call fcn.00474cd0
push edi
mov ecx, esi
call fcn.004745f0
mov ecx, esi
call fcn.00474770
jmp case.0x4762c4.35
push eax
mov ecx, esi
call fcn.00471730
mov edi, dword [ebp - 0x2a8]
mov ecx, esi
push eax
push edi
mov dword [ebp - 0x2b8], eax
call fcn.00474cd0
test edi, edi
jne 0x475f82
mov edi, dword [ebp - 0x2b8]
mov ecx, esi
push edi
call fcn.004745f0
mov ecx, esi
call fcn.00474770
jmp case.0x4762c4.35
mov eax, dword [edx + 0x14]
test byte [eax], 1
je case.0x4762c4.35
mov edx, dword [edx + 0xc]
test edx, edx
jne 0x475fb0
mov eax, dword [eax + 4]
cmp eax, dword [esi + 0x94]
jl case.0x476cfe.8
xor eax, eax
cmp ecx, dword [esi + 0x14]
lea ecx, [ebp - 0x288]
sete al
add eax, edx
push ecx
push eax
mov ecx, esi
mov dword [ebp - 0x2a8], eax
call fcn.00471b10
lea eax, [ebp - 0x248]
push eax
push dword [esi + 8]
call dword [sym.imp.USER32.dll_GetClientRect]
mov edi, dword [ebp - 0x298]
mov ecx, dword [ebp - 0x280]
mov eax, dword [edi + 0x14]
mov eax, dword [eax + 4]
sub eax, ecx
add eax, dword [ebp - 0x288]
mov dword [ebp - 0x2a0], eax
je case.default.0x476cfe
mov eax, dword [ebp - 0x27c]
mov edi, dword [ebp - 0x2a8]
mov dword [ebp - 0x224], eax
mov eax, dword [ebp - 0x240]
mov dword [ebp - 0x220], eax
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x228], ecx
mov dword [ebp - 0x21c], eax
test edi, edi
jne 0x476042
lea eax, [ecx - 1]
mov dword [ebp - 0x228], eax
push 0xfffffffffffffff0
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowLongW]
shr eax, 0x1c
test al, 1
je 0x476062
push 2
call dword [ebp - 0x29c]
sub dword [ebp - 0x220], eax
push 2
push 0
push 0
push 0
lea eax, [ebp - 0x228]
push eax
push 0
push dword [ebp - 0x2a0]
push dword [esi + 8]
call dword [sym.imp.USER32.dll_ScrollWindowEx]
test edi, edi
jne 0x47608f
cmp byte [esi + 0x9c], 0
jne 0x4760d5
mov eax, dword [ebp - 0x288]
mov dword [ebp - 0x238], eax
mov eax, dword [ebp - 0x27c]
mov dword [ebp - 0x234], eax
mov eax, dword [ebp - 0x280]
mov dword [ebp - 0x230], eax
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x22c], eax
lea eax, [ebp - 0x238]
push 0
push eax
push dword [esi + 8]
call dword [sym.imp.USER32.dll_InvalidateRect]
test edi, edi
jne 0x476113
mov eax, dword [ebp - 0x280]
mov ecx, esi
add eax, dword [ebp - 0x2a0]
push eax
call fcn.004745f0
mov ecx, esi
call fcn.00474770
mov ecx, esi
call fcn.00474970
push dword [esi + 0x14]
mov edi, dword [sym.imp.USER32.dll_UpdateWindow]
call edi
push dword [esi + 0x20]
call edi
push dword [esi + 0x24]
call edi
xor eax, eax
jmp 0x4770ed
mov ecx, esi
call fcn.00474770
push dword [esi + 0x24]
call dword [sym.imp.USER32.dll_UpdateWindow]
xor eax, eax
jmp 0x4770ed
cmp eax, 0xfffffec9
je 0x476150
cmp eax, 0xfffffffb
jne case.0x4762c4.35
push 0
push 0
push 0
push 0
push eax
push ecx
mov ecx, esi
call fcn.004704e0
jmp case.0x4762c4.35
push 0
push 0
push dword [esi + 8]
call dword [sym.imp.USER32.dll_InvalidateRect]
xor eax, eax
jmp 0x4770ed
mov ecx, esi
call fcn.0046fdd0
jmp case.0x4762c4.35
mov eax, dword [esi + 0x38]
test eax, eax
je 0x476184
cmp byte [esi + 0x3c], 0
jne 0x476184
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_Destroy]
movzx eax, word [0x5187b0]
push 0
push eax
push dword [ebp - 0x2a4]
call dword [sym.imp.USER32.dll_SetPropW]
mov dword [esi], vtable.CTreeList.0
mov edi, dword [esi + 0xcc]
test edi, edi
je 0x4761f4
or eax, 0xffffffff
lock xadd dword [edi + 8], eax
dec eax
jne 0x4761ea
mov eax, dword [edi]
test eax, eax
je 0x4761c8
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [edi], 0
mov eax, dword [edi + 4]
test eax, eax
je 0x4761df
push eax
call fcn.004a0e5f
add esp, 4
mov dword [edi + 4], 0
push 0xc
push edi
call fcn.004a0e51
add esp, 8
mov dword [esi + 0xcc], 0
lea ecx, [esi + 0x40]
call fcn.0046fb00
mov eax, dword [esi + 4]
mov dword [ebp - 4], 5
mov dword [esi], vtable.CThemedWindow.0
test eax, eax
je 0x476217
push eax
call dword [0x5181b4]
push 0xd8
push esi
call fcn.004a0e51
mov edi, dword [ebp - 0x298]
add esp, 8
push edi
push dword [ebp - 0x2b0]
push dword [ebp + 0xc]
push dword [ebp - 0x2a4]
call dword [sym.imp.USER32.dll_DefWindowProcW]
jmp 0x4770ed
cmp byte [esi + 0xbc], 0
mov ecx, 0xffffff65
mov eax, 0x7d7
cmovne eax, ecx
mov dword [ebp - 0x244], eax
mov eax, dword [ebp - 0x2a4]
push 0xfffffffffffffff4
push eax
mov dword [ebp - 0x24c], eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ecx, dword [ebp - 0x2b0]
mov word [ebp - 0x240], cx
lea ecx, [ebp - 0x24c]
push ecx
push eax
push 0x4e
push dword [ebp - 0x2a4]
mov dword [ebp - 0x248], eax
mov dword [ebp - 0x23e], 0
call dword [sym.imp.USER32.dll_GetParent]
push eax
call edi
mov eax, dword [ebp - 0x2b0]
add eax, 0xffffffdf
cmp eax, 0x4a
ja case.0x4762c4.35
movzx eax, byte [eax + 0x4771f4]
jmp dword [eax*4 + 0x4771e0]
push 0xa2
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
je case.0x4762c4.35
xor edi, edi
push edi
push edi
push 0x1200
push dword [esi + 0x14]
call dword [sym.imp.USER32.dll_SendMessageW]
inc eax
test eax, eax
jle 0x476398
nop word [eax + eax]
test edi, edi
jne 0x476335
cmp byte [esi + 0x9c], 0
je 0x476335
mov eax, dword [esi + 0x98]
mov dword [ebp - 0x264], eax
lea eax, [ebp - 0x268]
push eax
push edi
push 0x120c
push dword [esi + 0xc]
mov dword [ebp - 0x268], 1
jmp 0x476376
push edi
mov ecx, esi
call fcn.00471730
mov dword [ebp - 0x268], 1
mov dword [ebp - 0x264], eax
test edi, edi
jne 0x476363
lea eax, [ebp - 0x268]
push eax
push edi
push 0x120c
push dword [esi + 0xc]
jmp 0x476376
lea eax, [ebp - 0x268]
push eax
lea eax, [edi - 1]
push eax
push 0x120c
push dword [esi + 0x14]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x1200
push dword [esi + 0x14]
inc edi
call dword [sym.imp.USER32.dll_SendMessageW]
inc eax
cmp edi, eax
jl 0x476300
mov ecx, esi
call fcn.00474770
jmp case.0x4762c4.35
mov ecx, dword [esi + 0x7c]
test ecx, ecx
je case.0x4762c4.35
cmp dword [ebp - 0x2b0], 0x28
jne 0x4763bf
call fcn.00473ff0
jmp 0x4763c4
call fcn.00474330
mov dword [ebp - 0x2a0], eax
test eax, eax
je case.0x4762c4.35
push eax
mov ecx, esi
call fcn.004716b0
push dword [ebp - 0x2a0]
mov ecx, esi
mov edi, eax
call fcn.00474c50
push edi
mov ecx, esi
call fcn.004714d0
jmp case.0x4762c4.35
mov edi, dword [esi + 0x7c]
mov dword [ebp - 0x29c], edi
test edi, edi
je case.0x4762c4.35
lea eax, [ebp - 0x254]
mov dword [ebp - 0x254], 0x1c
push eax
push 2
push dword [esi + 0x1c]
xorps xmm0, xmm0
mov dword [ebp - 0x23c], 0
movups xmmword [ebp - 0x24c], xmm0
mov dword [ebp - 0x250], 2
call dword [sym.imp.USER32.dll_GetScrollInfo]
mov eax, dword [ebp - 0x244]
xor edx, edx
mov dword [ebp - 0x2a0], edx
test eax, eax
je 0x4764bb
cmp dword [ebp - 0x2b0], 0x22
jne 0x4764ef
mov ecx, dword [edi + 0x14]
test ecx, ecx
je 0x476484
mov eax, dword [edi + 0x20]
shr eax, 4
test al, 1
je 0x476484
mov eax, dword [ebp - 0x244]
mov edi, ecx
mov dword [ebp - 0x29c], edi
jmp 0x47653a
mov eax, dword [edi + 0x10]
test eax, eax
je 0x47649e
mov edi, eax
mov eax, dword [ebp - 0x244]
mov dword [ebp - 0x29c], edi
jmp 0x47653a
mov eax, dword [edi + 8]
test eax, eax
je 0x4764b3
mov ecx, dword [eax + 0x10]
test ecx, ecx
jne 0x4764df
mov eax, dword [eax + 8]
test eax, eax
jne 0x4764a5
test edi, edi
je case.0x4762c4.35
push edi
mov ecx, esi
call fcn.004716b0
push dword [ebp - 0x29c]
mov ecx, esi
mov edi, eax
call fcn.00474c50
push edi
mov ecx, esi
call fcn.004714d0
jmp case.0x4762c4.35
mov eax, dword [ebp - 0x244]
mov edi, ecx
mov dword [ebp - 0x29c], ecx
jmp 0x47653a
mov ecx, dword [edi + 0xc]
test ecx, ecx
je 0x476521
mov edx, dword [ecx + 0x18]
test edx, edx
je 0x476519
nop dword [eax]
mov eax, dword [ecx + 0x20]
shr eax, 4
test al, 1
je 0x476513
mov ecx, edx
mov edx, dword [ecx + 0x18]
test edx, edx
jne 0x476500
mov eax, dword [ebp - 0x244]
mov edx, dword [ebp - 0x2a0]
jmp 0x47652e
mov ecx, dword [edi + 8]
test ecx, ecx
je 0x4764b3
cmp dword [ecx + 4], 0
je 0x4764b3
test ecx, ecx
je 0x4764b3
mov edi, ecx
mov dword [ebp - 0x29c], edi
inc edx
mov dword [ebp - 0x2a0], edx
cmp edx, eax
jb 0x476453
jmp 0x4764bb
mov edi, dword [esi + 0x7c]
test edi, edi
je case.0x4762c4.35
cmp dword [ebp - 0x2b0], 0x27
mov ecx, dword [edi + 0x20]
jne 0x4765f5
mov eax, ecx
shr eax, 6
test al, 1
je case.0x4762c4.35
shr ecx, 4
test cl, 1
mov ecx, esi
push 0
jne 0x4765de
push 0
push edi
push 0
push 0x7d1
push dword [esi + 8]
call fcn.004704e0
test eax, eax
jne case.0x4762c4.35
or dword [edi + 0x20], 0x30
mov ecx, edi
call fcn.00472030
mov dword [ebp - 0x2a8], eax
test eax, eax
je case.0x4762c4.35
push edi
mov ecx, esi
call fcn.004716b0
mov edi, eax
mov ecx, esi
push edi
push edi
call fcn.004743e0
push dword [ebp - 0x2a8]
lea eax, [edi + 1]
mov ecx, esi
push eax
call fcn.00472ec0
jmp case.0x4762c4.35
push 0x28
push 0x100
push dword [ebp - 0x2a4]
call fcn.00475560
jmp 0x4770ed
and ecx, 0x50
cmp cl, 0x50
jne 0x47660c
push 0
push edi
mov ecx, esi
call fcn.004715a0
jmp case.0x4762c4.35
mov ecx, dword [edi + 8]
mov dword [ebp - 0x2a8], ecx
test ecx, ecx
je case.0x4762c4.35
lea eax, [esi + 0x40]
cmp ecx, eax
je case.0x4762c4.35
push edi
mov ecx, esi
call fcn.004716b0
push dword [ebp - 0x2a8]
mov ecx, esi
mov edi, eax
call fcn.00474c50
push edi
mov ecx, esi
call fcn.004714d0
jmp case.0x4762c4.35
cmp eax, 0x20a
ja 0x476fba
je 0x476f68
cmp eax, 0x115
ja 0x476dbb
je 0x476cb2
sub eax, 0x102
je 0x47680a
sub eax, 0x11
je 0x4767c7
sub eax, 1
jne case.0x4762c4.35
test edx, edx
je case.0x4762c4.35
mov dword [ebp - 0x23c], eax
xorps xmm0, xmm0
lea eax, [ebp - 0x254]
mov dword [ebp - 0x254], 0x1c
push eax
push 2
push edx
movups xmmword [ebp - 0x24c], xmm0
mov dword [ebp - 0x250], 7
call dword [sym.imp.USER32.dll_GetScrollInfo]
mov eax, dword [ebp - 0x2b0]
movzx ecx, ax
cmp ecx, 8
ja case.default.0x476cfe
jmp dword [ecx*4 + 0x477240]
mov edi, dword [ebp - 0x298]
mov ecx, esi
shr eax, 0x10
push eax
push edi
mov dword [ebp - 0x240], eax
call fcn.004728e0
jmp 0x4770d3
mov eax, dword [ebp - 0x248]
mov ecx, esi
mov edi, dword [ebp - 0x298]
push eax
push edi
mov dword [ebp - 0x240], eax
call fcn.004728e0
jmp 0x4770d3
mov edi, dword [ebp - 0x298]
xor eax, eax
push eax
push edi
mov ecx, esi
mov dword [ebp - 0x240], eax
call fcn.004728e0
jmp 0x4770d3
mov eax, dword [ebp - 0x240]
mov ecx, esi
mov edi, dword [ebp - 0x298]
inc eax
push eax
push edi
mov dword [ebp - 0x240], eax
call fcn.004728e0
jmp 0x4770d3
mov eax, dword [ebp - 0x240]
mov ecx, esi
mov edi, dword [ebp - 0x298]
dec eax
push eax
push edi
mov dword [ebp - 0x240], eax
call fcn.004728e0
jmp 0x4770d3
mov eax, dword [ebp - 0x240]
mov ecx, esi
add eax, dword [ebp - 0x244]
mov edi, dword [ebp - 0x298]
push eax
push edi
mov dword [ebp - 0x240], eax
call fcn.004728e0
jmp 0x4770d3
mov eax, dword [ebp - 0x240]
mov ecx, esi
sub eax, dword [ebp - 0x244]
mov edi, dword [ebp - 0x298]
push eax
push edi
mov dword [ebp - 0x240], eax
call fcn.004728e0
jmp 0x4770d3
cmp ecx, 0x64
jne case.0x4762c4.35
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push 1
lea eax, [ebp - 0x230]
push eax
push dword [ebp - 0x2a4]
push 0
call dword [sym.imp.USER32.dll_MapWindowPoints]
lea eax, [ebp - 0x230]
mov ecx, esi
push eax
push dword [esi + 0x2c]
call fcn.00475370
jmp case.0x4762c4.35
cmp dword [esi + 0x5c], 0
je case.0x4762c4.35
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov dword [ebp - 0x22c], eax
sub ecx, dword [esi + 0xc8]
or eax, 0xffffffff
cmp ecx, 0x2ee
jbe 0x476902
mov edi, dword [esi + 0xcc]
test edi, edi
je 0x476861
cmp dword [edi + 4], 0
jne 0x476854
push dword [edi]
call fcn.004a2870
mov dword [edi + 4], eax
or eax, 0xffffffff
cmp dword [edi + 4], 0x4dd190
je 0x476902
mov edi, dword [esi + 0xcc]
test edi, edi
je 0x4768b2
lock xadd dword [edi + 8], eax
dec eax
jne 0x4768a8
mov eax, dword [edi]
test eax, eax
je 0x476886
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [edi], 0
mov eax, dword [edi + 4]
test eax, eax
je 0x47689d
push eax
call fcn.004a0e5f
add esp, 4
mov dword [edi + 4], 0
push 0xc
push edi
call fcn.004a0e51
add esp, 8
mov dword [esi + 0xcc], 0
push 0xc
call fcn.004a0e21
mov edi, eax
add esp, 4
mov dword [ebp - 0x21c], edi
mov dword [ebp - 4], 0
test edi, edi
je 0x4768eb
push 0x4dd190
mov dword [edi + 4], 0
mov dword [edi + 8], 1
call fcn.004a2990
mov dword [edi], eax
jmp 0x4768ed
xor edi, edi
mov dword [ebp - 4], 0xffffffff
mov dword [esi + 0xcc], edi
test edi, edi
je 0x477114
cmp dword [esi + 0x7c], 0
je 0x476a7c
push 0xc
call fcn.004a0e21
mov edi, eax
add esp, 4
mov dword [ebp - 0x21c], edi
mov dword [ebp - 4], 1
test edi, edi
je 0x476945
push 0x4dd190
mov dword [edi + 4], 0
mov dword [edi + 8], 1
call fcn.004a2990
mov dword [edi], eax
jmp 0x476947
xor edi, edi
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x29c], edi
test edi, edi
je 0x477114
mov eax, dword [esi + 0xcc]
mov dword [ebp - 0x2a8], eax
cmp eax, edi
jne 0x47697f
lea ecx, [ebp - 0x29c]
call fcn.00402620
mov eax, dword [esi + 0x7c]
jmp 0x476a6b
test eax, eax
jne 0x4769a8
mov eax, dword [edi]
test eax, eax
je 0x47696c
push eax
mov eax, dword [sym.imp.OLEAUT32.dll_VariantInit]
call eax
test eax, eax
je 0x47696c
lea ecx, [ebp - 0x29c]
call fcn.00402620
mov eax, dword [esi + 0x7c]
jmp 0x476a72
push dword [eax]
mov eax, dword [sym.imp.OLEAUT32.dll_VariantInit]
call eax
push dword [edi]
mov dword [ebp - 0x2a0], eax
call dword [sym.imp.OLEAUT32.dll_VariantInit]
mov edx, dword [ebp - 0x2a8]
mov ecx, eax
mov eax, dword [ebp - 0x2a0]
cmp eax, ecx
mov dword [ebp - 0x2b8], ecx
cmova eax, ecx
mov edx, dword [edx]
test eax, eax
je 0x476a1f
mov edi, dword [edi]
sub edi, edx
movzx ecx, word [edx + edi]
lea edx, [edx + 2]
dec eax
mov dword [ebp - 0x2a8], eax
mov eax, ecx
mov dword [ebp - 0x2ac], eax
movzx eax, word [edx - 2]
mov esi, eax
mov dword [ebp - 0x21c], esi
mov esi, dword [ebp - 0x2b4]
cmp ax, cx
jne 0x476a2e
mov eax, dword [ebp - 0x2a8]
test eax, eax
jne 0x4769e2
mov ecx, dword [ebp - 0x2b8]
mov edx, dword [ebp - 0x2a0]
cmp edx, ecx
jae 0x476a44
or edi, 0xffffffff
jmp 0x476a53
mov eax, dword [ebp - 0x2ac]
mov ecx, dword [ebp - 0x21c]
movzx eax, ax
movzx edi, cx
sub edi, eax
jmp 0x476a53
xor eax, eax
cmp edx, ecx
setne al
mov dword [ebp - 0x21c], eax
mov edi, eax
lea ecx, [ebp - 0x29c]
call fcn.00402620
mov eax, dword [esi + 0x7c]
mov dword [ebp - 0x29c], eax
test edi, edi
jne 0x476a78
mov ecx, eax
call fcn.00473ff0
mov dword [ebp - 0x29c], eax
test eax, eax
jne 0x476a85
mov eax, dword [esi + 0x54]
mov dword [ebp - 0x29c], eax
mov eax, dword [ebp - 0x22c]
mov dword [esi + 0xc8], eax
mov eax, dword [ebp - 0x2b0]
mov dword [ebp - 0x2c0], 0
push 0xc
mov word [ebp - 0x2c0], ax
call fcn.004a0e21
mov edi, eax
add esp, 4
mov dword [ebp - 0x22c], edi
mov dword [ebp - 4], 2
test edi, edi
je 0x476aec
lea eax, [ebp - 0x2c0]
mov dword [edi + 4], 0
push eax
mov dword [edi + 8], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [edi], eax
test eax, eax
je 0x47710a
jmp 0x476aee
xor edi, edi
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x2ac], edi
test edi, edi
je 0x477114
push 0xc
mov dword [ebp - 4], 3
call fcn.004a0e21
mov ecx, eax
add esp, 4
mov dword [ebp - 0x22c], ecx
mov byte [ebp - 4], 4
test ecx, ecx
je 0x476b41
lea eax, [ebp - 0x2ac]
push eax
lea eax, [esi + 0xcc]
push eax
call fcn.00421dd0
mov ecx, eax
mov dword [ebp - 0x2a0], eax
jmp 0x476b49
xor ecx, ecx
mov dword [ebp - 0x2a0], ecx
mov byte [ebp - 4], 3
test ecx, ecx
je 0x47711e
mov edi, dword [esi + 0xcc]
lea eax, [esi + 0xcc]
test edi, edi
je 0x476bb7
or edx, 0xffffffff
lock xadd dword [edi + 8], edx
dec edx
jne 0x476bb1
mov eax, dword [edi]
test eax, eax
je 0x476b83
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [edi], 0
mov eax, dword [edi + 4]
test eax, eax
je 0x476b9a
push eax
call fcn.004a0e5f
add esp, 4
mov dword [edi + 4], 0
push 0xc
push edi
call fcn.004a0e51
mov ecx, dword [ebp - 0x2a0]
lea eax, [esi + 0xcc]
add esp, 8
mov dword [eax], 0
mov dword [eax], ecx
lea ecx, [ebp - 0x2ac]
mov dword [ebp - 4], 0xffffffff
call fcn.00402620
mov edi, dword [ebp - 0x29c]
nop dword [eax]
nop word [eax + eax]
mov dword [ebp - 0x22c], 0x104
lea edx, [ebp - 0x22c]
mov ecx, dword [edi + 4]
push edx
lea edx, [ebp - 0x218]
push edx
mov eax, dword [ecx]
push 0
push edi
mov eax, dword [eax + 8]
call eax
mov ecx, dword [esi + 0xcc]
mov dword [ebp - 0x21c], eax
test ecx, ecx
je 0x476c34
mov edx, dword [ecx]
test edx, edx
je 0x476c2a
push edx
call dword [sym.imp.OLEAUT32.dll_VariantInit]
mov ecx, dword [esi + 0xcc]
jmp 0x476c2c
xor eax, eax
test ecx, ecx
je 0x476c36
mov ecx, dword [ecx]
jmp 0x476c38
xor eax, eax
xor ecx, ecx
push eax
push ecx
push dword [ebp - 0x21c]
call fcn.004b4f40
add esp, 0xc
test eax, eax
je 0x476c95
mov ecx, dword [edi + 0x14]
test ecx, ecx
je 0x476c61
mov eax, dword [edi + 0x20]
shr eax, 4
test al, 1
je 0x476c61
mov edi, ecx
jmp 0x476c84
mov eax, dword [edi + 0x10]
test eax, eax
je 0x476c6c
mov edi, eax
jmp 0x476c84
mov eax, dword [edi + 8]
test eax, eax
je 0x476c81
mov edi, dword [eax + 0x10]
test edi, edi
jne 0x476c84
mov eax, dword [eax + 8]
test eax, eax
jne 0x476c73
mov edi, dword [esi + 0x54]
cmp edi, dword [ebp - 0x29c]
jne 0x476be0
jmp case.0x4762c4.35
push edi
mov ecx, esi
call fcn.00474c50
push edi
mov ecx, esi
call fcn.004716b0
push eax
mov ecx, esi
call fcn.004714d0
jmp case.0x4762c4.35
lea eax, [ebp - 0x254]
mov dword [ebp - 0x254], 0x1c
push eax
push 2
push dword [esi + 0x1c]
xorps xmm0, xmm0
mov dword [ebp - 0x23c], 0
movups xmmword [ebp - 0x24c], xmm0
mov dword [ebp - 0x250], 7
call dword [sym.imp.USER32.dll_GetScrollInfo]
mov eax, dword [ebp - 0x2b0]
movzx ecx, ax
cmp ecx, 8
ja case.default.0x476cfe
jmp dword [ecx*4 + 0x477264]
shr eax, 0x10
mov ecx, esi
push eax
mov dword [ebp - 0x240], eax
call fcn.00475500
jmp case.0x4762c4.35
mov eax, dword [ebp - 0x248]
mov ecx, esi
push eax
mov dword [ebp - 0x240], eax
call fcn.00475500
jmp case.0x4762c4.35
xor eax, eax
mov ecx, esi
push eax
mov dword [ebp - 0x240], eax
call fcn.00475500
jmp case.0x4762c4.35
mov eax, dword [ebp - 0x240]
mov ecx, esi
inc eax
push eax
mov dword [ebp - 0x240], eax
call fcn.00475500
jmp case.0x4762c4.35
mov eax, dword [ebp - 0x240]
mov ecx, esi
dec eax
push eax
mov dword [ebp - 0x240], eax
call fcn.00475500
jmp case.0x4762c4.35
mov eax, dword [ebp - 0x240]
mov ecx, esi
add eax, dword [ebp - 0x244]
push eax
mov dword [ebp - 0x240], eax
call fcn.00475500
jmp case.0x4762c4.35
mov eax, dword [ebp - 0x240]
mov ecx, esi
sub eax, dword [ebp - 0x244]
push eax
mov dword [ebp - 0x240], eax
call fcn.00475500
jmp case.0x4762c4.35
sub eax, 0x201
je 0x4756ca
sub eax, 2
je 0x476dd4
sub eax, 1
jne case.0x4762c4.35
mov ecx, dword [ebp - 0x29c]
movzx eax, cx
movsx ecx, ax
mov eax, edx
lea edx, [ebp - 0x2a0]
shr eax, 0x10
push edx
lea edx, [ebp - 0x2ac]
cwde
push edx
lea edx, [ebp - 0x22c]
mov dword [ebp - 0x22c], 0
push edx
push eax
push ecx
mov ecx, esi
mov dword [ebp - 0x2ac], 0
mov dword [ebp - 0x2a0], 0
call fcn.004723b0
test al, 0xe0
je case.0x4762c4.35
mov edi, dword [ebp - 0x2a0]
mov ecx, esi
push edi
call fcn.00474c50
push 0
xor eax, eax
mov ecx, esi
cmp dword [ebp + 0xc], 0x203
push 0
push edi
push dword [ebp - 0x2ac]
sete al
lea eax, [eax*2 - 5]
push eax
push dword [esi + 8]
call fcn.004704e0
jmp case.0x4762c4.35
push 0x7d2
push eax
call fcn.004704e0
test eax, eax
jne case.0x4762c4.35
mov ecx, edi
call fcn.00472030
and dword [edi + 0x20], 0xffffffef
mov dword [ebp - 0x2b4], eax
test eax, eax
je case.0x4762c4.35
mov ecx, dword [esi + 0x54]
xor eax, eax
mov dword [ebp - 0x29c], eax
test ecx, ecx
je 0x476eee
cmp ecx, edi
je 0x476ef7
mov edx, dword [ecx + 0x14]
inc eax
mov dword [ebp - 0x29c], eax
test edx, edx
je 0x476ec7
mov eax, dword [ecx + 0x20]
shr eax, 4
test al, 1
je 0x476ec7
mov ecx, edx
mov eax, dword [ebp - 0x29c]
jmp 0x476ea1
mov eax, dword [ecx + 0x10]
test eax, eax
je 0x476ed8
mov ecx, eax
mov eax, dword [ebp - 0x29c]
jmp 0x476ea1
mov eax, dword [ecx + 8]
test eax, eax
je 0x476eee
nop
mov ecx, dword [eax + 0x10]
test ecx, ecx
jne 0x476ebf
mov eax, dword [eax + 8]
test eax, eax
jne 0x476ee0
or eax, 0xffffffff
mov dword [ebp - 0x29c], eax
push eax
push eax
mov ecx, esi
call fcn.004743e0
mov ecx, dword [ebp - 0x29c]
inc ecx
cmp byte [ebp - 0x2b9], 0
je 0x476f23
push dword [ebp - 0x2b4]
push ecx
mov ecx, esi
call fcn.00472ec0
jmp case.0x4762c4.35
mov eax, dword [ebp - 0x2b4]
neg eax
push eax
push ecx
mov ecx, esi
call fcn.00472ec0
mov eax, dword [esi + 0x7c]
test eax, eax
je case.0x4762c4.35
nop
cmp eax, edi
je 0x476f5b
mov eax, dword [eax + 8]
test eax, eax
jne 0x476f40
jmp case.0x4762c4.35
test eax, 0x1e0
je case.0x4762c4.35
push edi
mov ecx, esi
call fcn.00474c50
jmp case.0x4762c4.35
mov eax, ecx
shr eax, 0x10
movsx edi, ax
add edi, dword [esi + 0x8c]
mov eax, edi
mov dword [esi + 0x8c], edi
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x28
jl case.0x4762c4.35
mov eax, 0x66666667
imul edi
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
lea eax, [ecx + ecx*4]
neg ecx
shl eax, 3
sub edi, eax
push ecx
mov ecx, esi
mov dword [esi + 0x8c], edi
call fcn.004753f0
jmp case.0x4762c4.35
add eax, 0xffffe000
cmp eax, 5
ja case.default.0x476fc8
jmp dword [eax*4 + 0x477288]
mov eax, dword [ecx + 0x20]
test edx, edx
je 0x476fef
or eax, 0x40
cmp dword [ecx + 0x1c], 0
mov dword [ecx + 0x20], eax
jne case.default.0x476cfe
and eax, 0xffffffef
mov dword [ecx + 0x20], eax
xor eax, eax
jmp 0x4770ed
and eax, 0xffffffbf
mov dword [ecx + 0x20], eax
xor eax, eax
jmp 0x4770ed
test edx, edx
setne al
movzx eax, al
push eax
push ecx
mov ecx, esi
call fcn.004715a0
movzx eax, al
jmp 0x4770ed
mov eax, dword [ecx + 0x1c]
jmp 0x4770ed
push ecx
mov ecx, esi
call fcn.004743c0
xor eax, eax
jmp 0x4770ed
mov eax, dword [edx + 8]
mov edi, dword [edx + 4]
mov dword [ebp - 0x21c], eax
mov eax, dword [edx]
push 8
mov dword [ebp - 0x2a8], eax
call fcn.004a0e21
add esp, 4
mov dword [ebp - 0x22c], eax
test eax, eax
je 0x47705f
mov dword [eax], vtable.CListViewData.0
mov dword [eax + 4], edi
jmp 0x477061
xor eax, eax
push dword [ebp - 0x21c]
mov ecx, esi
push 0x473120
push eax
push dword [ebp - 0x2a8]
call fcn.00472da0
jmp 0x4770ed
push ecx
mov ecx, esi
call fcn.004716b0
jmp 0x4770ed
cmp dword [ebp + 0xc], 0x31a
jne case.0x4762c4.35
mov eax, dword [esi + 4]
test eax, eax
je 0x47709d
push eax
call dword [0x5181b4]
mov dword [esi + 4], 0
mov eax, dword [0x5181a8]
test eax, eax
je case.0x4762c4.35
call eax
test eax, eax
je case.0x4762c4.35
mov eax, dword [esi]
mov ecx, esi
mov edi, dword [0x5181ac]
mov eax, dword [eax]
call eax
push eax
push dword [ebp - 0x2a4]
call edi
mov dword [esi + 4], eax
mov edi, dword [ebp - 0x298]
mov ecx, dword [ebp - 0x2b0]
mov eax, dword [esi]
push edi
push ecx
push dword [ebp + 0xc]
mov eax, dword [eax + 4]
mov ecx, esi
push dword [ebp - 0x2a4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a0e13
mov esp, ebp
pop ebp
ret 0x10
push 0x8007000e
call fcn.004a2850
push 0x8007000e
call fcn.004a2850
push 0x8007000e
call fcn.004a2850
popal
inc edi
add byte [eax + 0x2000475b], bh
pop ebx
inc edi
add byte [esi + 0x38004759], ah
pop ebx
inc edi
add bl, bl
pop esp
inc edi
add ah, ah
pop ecx
inc edi
add ch, dh
pop ecx
inc edi
add byte [ecx], bl
pop esp
inc edi
add byte [eax + 0x61], dh
inc edi
add byte [edi - 0x32ffb8a5], bl
jo 0x47719e
add byte [eax], al
or ecx, dword [ebx]
add dword [ebx], ecx
add al, byte [edx]
or ecx, dword [ebx]
add ecx, dword [ebx]
or ecx, dword [ebx]
add al, 11
or ecx, dword [ebx]
or eax, dword [185273099]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or eax, dword [esi]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or eax, dword [edi]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [eax]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ecx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ah, byte [esi - 112]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or byte [ebx], cl
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or ecx, dword [ebx]
or dword [ebx], ecx
or ecx, dword [ebx]
or ecx, dword [edx]
nop
mul byte [ebx + 0x47]
add byte [esi + 101], cl
inc edi
add byte [ebx + 0x62cb0047], ah
inc edi
add ch, cl
jo 0x47723a
add byte [eax], al
add byte [esp + eax], al
add dword [edx], eax
add dword [edx], eax
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add al, 4
add edx, dword [eax + case.0x4766d9.0]
cmp dword [edi + 71], esp
add byte [ecx + 2063615847], ah
inc edi
add al, ah
inc di
add al, ah
inc di
add byte [0xfd004767], bl
inc di
add bl, bl
pop esp
inc edi
add byte [ebx + 0x6d], ah
inc edi
add byte [ecx + 0x6d], cl
inc edi
add byte [ebp + ebp*2 + 0x6d7d0047], bl
inc edi
add byte [0x500476d], al
insd dword es:[edi], dx
inc edi
add byte [ebp*2 + 0x6d1b0047], dh
inc edi
add bl, bl
pop esp
inc edi
add bh, cl
outsd dx, dword [esi]
inc edi
add ah, bh
outsd dx, dword [esi]
inc edi
add byte [0x1d004770], dl
jo 0x4772de
add byte [eax + esi*2], ch
inc edi
add byte [eax + esi*2 + 0x47], bh
add byte [ebp - 0x75], dl
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d238f
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x513b94]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp + 8]
mov dword [ebx], eax
mov dword [ebx + 4], 0
push 0x58
mov dword [ebp - 4], 0
add byte [eax], al
mov dword [ebx + 4], 0
call fcn.004a0e21
add esp, 4
mov dword [ebx + 4], eax
mov esi, dword [ebp + 0x10]
lea edi, [eax + 0x18]
mov dword [ebp - 4], 1
mov dword [ebp + 8], edi
mov ecx, dword [esi]
mov dword [eax + 0x10], ecx
lea ecx, [edi + 4]
mov eax, dword [esi + 8]
mov dword [edi], eax
mov dword [ebp + 0x10], ecx
mov dword [ecx], 0
mov eax, dword [esi + 0x10]
mov dword [ecx + 4], eax
mov ecx, dword [ecx]
mov byte [ebp - 4], 2
test ecx, ecx
je 0x47732d
call fcn.0049c750
mov ecx, dword [esi + 0xc]
mov dword [edi + 4], ecx
test ecx, ecx
je 0x47733c
call fcn.0049c480
mov ecx, dword [esi + 0x14]
mov byte [ebp - 4], 3
mov dword [edi + 0xc], ecx
test ecx, ecx
je 0x47734f
call fcn.0049c480
mov ecx, dword [esi + 0x18]
mov byte [ebp - 4], 4
mov dword [edi + 0x10], ecx
test ecx, ecx
je 0x477362
call fcn.0049c480
mov ecx, dword [esi + 0x1c]
mov byte [ebp - 4], 5
mov dword [edi + 0x14], ecx
test ecx, ecx
je 0x477375
call fcn.0049c480
mov ecx, dword [esi + 0x20]
mov byte [ebp - 4], 6
mov dword [edi + 0x18], ecx
test ecx, ecx
je 0x477388
call fcn.0049c480
mov ecx, dword [esi + 0x24]
mov byte [ebp - 4], 7
mov dword [edi + 0x1c], ecx
test ecx, ecx
je 0x47739b
call fcn.0049c480
mov ecx, dword [esi + 0x28]
mov byte [ebp - 4], 8
mov dword [edi + 0x20], ecx
test ecx, ecx
je 0x4773ae
call fcn.0049c480
mov eax, dword [esi + 0x2c]
mov dword [edi + 0x24], eax
mov eax, dword [esi + 0x30]
mov dword [edi + 0x28], eax
mov eax, dword [esi + 0x34]
mov dword [edi + 0x2c], eax
mov eax, dword [esi + 0x38]
mov ecx, dword [esi + 0x3c]
mov dword [edi + 0x30], eax
mov dword [edi + 0x34], ecx
mov eax, dword [esi + 0x40]
mov ecx, dword [esi + 0x44]
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], ecx
mov eax, dword [ebx + 4]
mov ecx, dword [ebp + 0xc]
mov dword [eax], ecx
mov eax, dword [ebx + 4]
mov dword [eax + 4], ecx
mov eax, dword [ebx + 4]
mov dword [eax + 8], ecx
mov eax, dword [ebx + 4]
mov byte [eax + 0xc], 0
mov eax, dword [ebx + 4]
mov byte [eax + 0xd], 0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc