Function at 0x41292b
Capabilities:
Hide graphical window
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa18
push esi
push edi
mov dword [ebp - 0x8f0], ecx
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 8], 0
mov eax, dword [ebp + 8]
cmp dword [eax], 1
jne 0x41505d
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x10]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x14]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x18]
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 1
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x8f4], ecx
cmp dword [ebp - 0x8f4], 0x85
ja 0x4129d1
cmp dword [ebp - 0x8f4], 0x85
je 0x4134ba
mov edx, dword [ebp - 0x8f4]
sub edx, 2
mov dword [ebp - 0x8f4], edx
cmp dword [ebp - 0x8f4], 0x80
ja case.0x412a1a.7
mov ecx, dword [ebp - 0x8f4]
xor eax, eax
mov al, byte [ecx + 0x4189d4]
jmp dword [eax*4 + 0x418994]
cmp dword [ebp - 0x8f4], 0x11f
ja 0x412a21
cmp dword [ebp - 0x8f4], 0x11f
je 0x4144ea
mov edx, dword [ebp - 0x8f4]
sub edx, 0xa1
mov dword [ebp - 0x8f4], edx
cmp dword [ebp - 0x8f4], 0x76
ja case.0x412a1a.7
mov ecx, dword [ebp - 0x8f4]
xor eax, eax
mov al, byte [ecx + 0x418a75]
jmp dword [eax*4 + 0x418a55]
cmp dword [ebp - 0x8f4], 0x202
ja 0x412a72
cmp dword [ebp - 0x8f4], 0x202
je case.0x412a1a.1
cmp dword [ebp - 0x8f4], 0x120
je case.0x412a1a.2
cmp dword [ebp - 0x8f4], 0x200
je case.0x412a1a.1
cmp dword [ebp - 0x8f4], 0x201
je case.0x412a1a.0
jmp case.0x412a1a.7
cmp dword [ebp - 0x8f4], 0x206
ja 0x412ab3
cmp dword [ebp - 0x8f4], 0x206
je 0x414e2a
cmp dword [ebp - 0x8f4], 0x203
jb case.0x412a1a.7
cmp dword [ebp - 0x8f4], 0x204
jbe 0x414e2a
jmp case.0x412a1a.7
cmp dword [ebp - 0x8f4], 0x1635
je 0x412ac4
jmp case.0x412a1a.7
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x24]
mov eax, dword [edx + 4]
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x8f0]
mov eax, dword [edx + 0x1c]
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
mov ecx, dword [ebp - 0x8f0]
mov edx, dword [ebp - 0x20]
add edx, dword [ecx + 0x28]
mov eax, dword [ebp - 0x24]
mov dword [eax], edx
mov ecx, dword [ebp - 0x8f0]
mov edx, dword [ebp - 0x1c]
add edx, dword [ecx + 0x2c]
mov eax, dword [ebp - 0x24]
mov dword [eax + 4], edx
jmp 0x41505d
mov ecx, dword [ebp - 0x8f0]
xor edx, edx
mov dx, word [ecx + 0x22]
and edx, 0x4000
test edx, edx
je 0x412be2
mov eax, dword [ebp - 0x8f0]
cmp dword [eax + 0x48], 0
jne 0x412be2
mov ecx, dword [ebp - 0x8f0]
cmp dword [ecx + 0x134], 0
je 0x412b61
mov edx, dword [ebp - 0x8f0]
mov eax, dword [edx + 0x1c]
mov dword [ebp - 0x8f8], eax
jmp 0x412b6b
mov dword [ebp - 0x8f8], 0
mov ecx, dword [ebp - 0x8f0]
cmp dword [ecx + 0x134], 0
je 0x412b8e
mov edx, dword [ebp - 0x8f0]
mov eax, dword [edx + 0x134]
mov dword [ebp - 0x8fc], eax
jmp 0x412b9d
mov ecx, dword [ebp - 0x8f0]
mov edx, dword [ecx + 0x1c]
mov dword [ebp - 0x8fc], edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x10]
push eax
mov ecx, dword [ebp - 0x8f8]
push ecx
mov edx, dword [ebp - 0x8fc]
push edx
call dword [sym.imp.USER32.dll_DefFrameProcA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x8f0]
mov dword [eax + 0x1c], 0
mov ecx, dword [ebp - 0x8f0]
mov dword [ecx + 0x134], 0
jmp 0x412bf4
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x8f0]
call fcn.0042f7f7
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x8f0]
cmp dword [eax + 0x48], 0
jne 0x412c58
mov ecx, dword [ebp - 0x8f0]
xor edx, edx
mov dx, word [ecx + 0x26]
and edx, 0x4000
test edx, edx
jne 0x412c58
mov eax, dword [ebp - 0x8f0]
mov cx, word [eax + 0x26]
or ch, 8
mov edx, dword [ebp - 0x8f0]
mov word [edx + 0x26], cx
mov eax, dword [ebp - 0x8f0]
push eax
mov ecx, dword [0x45243c]
call fcn.0041a450
mov ecx, dword [ebp - 0x8f0]
mov dx, word [ecx + 0x26]
and dx, 0xf7ff
mov eax, dword [ebp - 0x8f0]
mov word [eax + 0x26], dx
jmp 0x41505d
mov ecx, dword [ebp - 0x8f0]
add ecx, 0xd0
call fcn.0040b590
mov dword [ebp - 0x28], eax
jmp 0x412c7e
mov ecx, dword [ebp - 0x28]
call fcn.0040b590
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x412cce
push 0x839
mov ecx, dword [ebp - 0x28]
call fcn.0041ae20
test eax, eax
je 0x412cb0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x28]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x28]
call dword [eax + 0x10]
mov ecx, dword [ebp - 0x28]
mov dword [ecx + 0x1c], 0
jmp 0x412ccc
mov edx, dword [ebp - 0x28]
xor eax, eax
mov ax, word [edx + 0x26]
and eax, 0x400
test eax, eax
jne 0x412ccc
mov ecx, dword [ebp - 0x28]
mov dword [ecx + 0x1c], 0
jmp 0x412c73
mov ecx, dword [ebp - 0x8f0]
call fcn.004119d0
mov dword [ebp - 0x28], eax
jmp 0x412ce9
mov ecx, dword [ebp - 0x28]
call fcn.0040b590
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x412d0d
mov edx, dword [ebp - 0x28]
xor eax, eax
mov ax, word [edx + 0x26]
and eax, 0x400
test eax, eax
jne 0x412d0b
mov ecx, dword [ebp - 0x28]
mov dword [ecx + 0x1c], 0
jmp 0x412cde
mov edx, dword [ebp - 0x8f0]
cmp dword [edx + 0x48], 0
jne 0x412d2f
mov eax, dword [ebp - 0x8f0]
xor ecx, ecx
mov cx, word [eax + 0x22]
and ecx, 0x4000
test ecx, ecx
jne 0x412d56
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x8f0]
call fcn.0042f7f7
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x8f0]
mov dword [eax + 0x134], 0
jmp 0x412dd8
mov ecx, dword [ebp - 0x8f0]
cmp dword [ecx + 0x134], 0
je 0x412d76
mov edx, dword [ebp - 0x8f0]
mov eax, dword [edx + 0x1c]
mov dword [ebp - 0x900], eax
jmp 0x412d80
mov dword [ebp - 0x900], 0
mov ecx, dword [ebp - 0x8f0]
cmp dword [ecx + 0x134], 0
je 0x412da3
mov edx, dword [ebp - 0x8f0]
mov eax, dword [edx + 0x134]
mov dword [ebp - 0x904], eax
jmp 0x412db2
mov ecx, dword [ebp - 0x8f0]
mov edx, dword [ecx + 0x1c]
mov dword [ebp - 0x904], edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x10]
push eax
mov ecx, dword [ebp - 0x900]
push ecx
mov edx, dword [ebp - 0x904]
push edx
call dword [sym.imp.USER32.dll_DefFrameProcA]
mov dword [ebp - 4], eax
jmp 0x41505d
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
mov edx, dword [ecx + 0x10]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x2c]
cmp dword [edx + 0x48], 0
je 0x412e26
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x48]
cmp ecx, dword [ebp - 0x8f0]
je 0x412e26
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x48]
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx + 0x48]
mov edx, dword [eax]
call dword [edx + 0x10]
jmp 0x41898c
mov eax, dword [ebp - 0x8f0]
cmp dword [eax + 0xbc], 0
je 0x412e51
mov ecx, dword [ebp - 0x30]
push ecx
mov edx, dword [ebp - 0x2c]
push edx
mov eax, dword [ebp - 0x8f0]
call dword [eax + 0xbc]
add esp, 8
mov dword [ebp - 4], eax
jmp 0x412e59
or eax, 0xffffffff
jmp 0x41898c
jmp 0x41505d
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x38], ecx
mov ecx, dword [ebp - 0x8f0]
call fcn.004119d0
mov dword [ebp - 0xc], eax
jmp 0x412e7f
mov ecx, dword [ebp - 0xc]
call fcn.0040b590
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x412ebe
mov edx, dword [ebp - 0xc]
xor eax, eax
mov ax, word [edx + 0x5e]
mov ecx, dword [ebp - 0x38]
cmp eax, dword [ecx + 4]
jne 0x412ebc
mov edx, dword [ebp - 0xc]
xor eax, eax
mov ax, word [edx + 0x26]
and eax, 0x1000
test eax, eax
je 0x412ebc
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xc]
call dword [eax + 0x10]
jmp 0x41898c
jmp 0x412e74
mov dword [ebp - 8], 0
jmp 0x41505d
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x3c], ecx
mov edx, dword [ebp - 0x3c]
cmp dword [edx], 4
jne 0x412ef2
mov eax, dword [ebp - 0x3c]
push eax
push 0
push 0x2b
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ecx + 0x14]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [ebp - 4], eax
jmp 0x412f16
mov eax, dword [ebp - 0x3c]
cmp dword [eax + 8], 0
jl 0x412f16
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ecx + 0x2c]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xc]
call dword [edx + 0x10]
mov dword [ebp - 4], eax
jmp 0x41505d
mov eax, dword [ebp - 0x8f0]
cmp dword [eax + 0x48], 0
je 0x412f9b
mov ecx, dword [ebp - 0x8f0]
xor edx, edx
mov dx, word [ecx + 0x22]
and edx, 0x4000
test edx, edx
jne 0x412f9b
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x8f0]
mov edx, dword [ecx + 0x48]
mov eax, dword [ebp - 0x8f0]
mov ecx, dword [eax + 0x48]
mov edx, dword [edx + 0x30]
sub edx, dword [ecx + 0x28]
add edx, 1
mov eax, dword [ebp - 0x40]
mov dword [eax + 8], edx
mov ecx, dword [ebp - 0x8f0]
mov edx, dword [ecx + 0x48]
mov eax, dword [ebp - 0x8f0]
mov ecx, dword [eax + 0x48]
mov edx, dword [edx + 0x34]
sub edx, dword [ecx + 0x2c]
add edx, 1
mov eax, dword [ebp - 0x40]
mov dword [eax + 0xc], edx
mov ecx, dword [ebp - 0x40]
mov dword [ecx + 0x14], 0
mov edx, dword [ebp - 0x40]
mov dword [edx + 0x10], 0
jmp 0x412fa2
mov dword [ebp - 8], 0
jmp 0x41505d
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x8f0]
mov edx, dword [ebp - 0x44]
cmp edx, dword [ecx + 0x138]
je 0x413117
mov eax, dword [ebp - 0x10]
shr eax, 0x10
and eax, 0xffff
and eax, 0xffff
test eax, eax
je 0x413117
mov ecx, dword [ebp - 0x8f0]
xor edx, edx
mov dx, word [ecx + 0x26]
and edx, 0xc0
neg edx
sbb edx, edx
inc edx
push edx
push 0xf120
mov eax, dword [ebp - 0x44]
push eax
call dword [sym.imp.USER32.dll_EnableMenuItem]
mov ecx, dword [ebp - 0x8f0]
xor edx, edx
mov dx, word [ecx + 0x22]
and edx, 0x80
test edx, edx
jne 0x413036
mov eax, dword [ebp - 0x8f0]
xor ecx, ecx
mov cx, word [eax + 0x26]
and ecx, 0x40
test ecx, ecx
jne 0x413036
mov dword [ebp - 0x908], 0
jmp 0x413040
mov dword [ebp - 0x908], 1
mov edx, dword [ebp - 0x908]
push edx
push 0xf010
mov eax, dword [ebp - 0x44]
push eax
call dword [sym.imp.USER32.dll_EnableMenuItem]
mov ecx, dword [ebp - 0x8f0]
xor edx, edx
mov dx, word [ecx + 0x22]
and edx, 0x40
test edx, edx
jne 0x41308b
mov eax, dword [ebp - 0x8f0]
xor ecx, ecx
mov cx, word [eax + 0x26]
and ecx, 0xc0
test ecx, ecx
jne 0x41308b
mov dword [ebp - 0x90c], 0
jmp 0x413095
mov dword [ebp - 0x90c], 1
mov edx, dword [ebp - 0x90c]
push edx
push 0xf000
mov eax, dword [ebp - 0x44]
push eax
call dword [sym.imp.USER32.dll_EnableMenuItem]
mov ecx, dword [ebp - 0x8f0]
xor edx, edx
mov dx, word [ecx + 0x22]
and edx, 0x200
test edx, edx
jne 0x4130ef
mov eax, dword [ebp - 0x8f0]
cmp dword [eax + 0x48], 0
je 0x4130e3
mov ecx, dword [ebp - 0x8f0]
xor edx, edx
mov dx, word [ecx + 0x22]
and edx, 0x4000
test edx, edx
je 0x4130ef
mov dword [ebp - 0x910], 0
jmp 0x4130f9
mov dword [ebp - 0x910], 1
xor eax, eax
cmp dword [ebp - 0x910], 0
setne al
push eax
push 0xf060
mov ecx, dword [ebp - 0x44]
push ecx
call dword [sym.imp.USER32.dll_EnableMenuItem]
jmp 0x41311e
mov dword [ebp - 8], 0
jmp 0x41505d
mov edx, dword [ebp - 0x8f0]
xor eax, eax
mov ax, word [edx + 0x26]
and eax, 0x80
test eax, eax
je 0x41326a
mov ecx, dword [ebp - 0x8f0]
cmp dword [ecx + 0x13c], 0
je 0x41326a
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0x4c], eax
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 0x4c]
push eax
call dword [sym.imp.GDI32.dll_GetBkColor]
push eax
mov ecx, dword [ebp - 0x48]
push ecx
call dword [sym.imp.GDI32.dll_SetBkColor]
mov edx, dword [ebp - 0x4c]
push edx
call dword [sym.imp.GDI32.dll_GetBkMode]
push eax
mov eax, dword [ebp - 0x48]
push eax
call dword [sym.imp.GDI32.dll_SetBkMode]
mov ecx, dword [ebp - 0x8f0]
xor edx, edx
mov dx, word [ecx + 0x22]
and edx, 0x4000
test edx, edx
je 0x41322c
mov eax, dword [ebp - 0x8f0]
cmp dword [eax + 0x48], 0
jne 0x41322c
mov ecx, dword [ebp - 0x8f0]
cmp dword [ecx + 0x134], 0
je 0x4131d0
mov edx, dword [ebp - 0x8f0]
mov eax, dword [edx + 0x1c]
mov dword [ebp - 0x914], eax
jmp 0x4131da
mov dword [ebp - 0x914], 0
mov ecx, dword [ebp - 0x8f0]
cmp dword [ecx + 0x134], 0
je 0x4131fd
mov edx, dword [ebp - 0x8f0]
mov eax, dword [edx + 0x134]
mov dword [ebp - 0x918], eax
jmp 0x41320c
mov ecx, dword [ebp - 0x8f0]
mov edx, dword [ecx + 0x1c]
mov dword [ebp - 0x918], edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
push 0x27
mov edx, dword [ebp - 0x914]
push edx
mov eax, dword [ebp - 0x918]
push eax
call dword [sym.imp.USER32.dll_DefFrameProcA]
jmp 0x413255
mov esi, dword [ebp + 8]
mov ecx, 0xe
lea edi, [ebp - 0x84]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x74], 0x27
lea ecx, [ebp - 0x84]
push ecx
mov ecx, dword [ebp - 0x8f0]
call fcn.0042f7f7
mov edx, dword [ebp - 0x4c]
push edx
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
mov dword [ebp - 4], 1
jmp 0x41329b
mov eax, dword [ebp - 0x8f0]
xor ecx, ecx
mov cx, word [eax + 0x26]
and ecx, 0x1000
test ecx, ecx
je 0x413289
mov dword [ebp - 4], 1
jmp 0x41329b
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x8f0]
call fcn.0042f7f7
mov dword [ebp - 4], eax
jmp 0x41505d
mov eax, dword [ebp - 0x8f0]
xor ecx, ecx
mov cx, word [eax + 0x26]
and ecx, 0x80
test ecx, ecx
je 0x4133a6
mov edx, dword [ebp - 0x8f0]
cmp dword [edx + 0x13c], 0
je 0x4133a6
lea eax, [ebp - 0xd4]
push eax
mov ecx, dword [ebp - 0x8f0]
mov edx, dword [ecx + 0x134]
push edx
call dword [sym.imp.USER32.dll_BeginPaint]
mov dword [ebp - 0xd8], eax
push 0
mov eax, dword [ebp - 0xd8]
push eax
push 0x14
mov ecx, dword [ebp - 0x8f0]
mov edx, dword [ecx + 0x134]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [ebp - 0x94]
push eax
mov ecx, dword [ebp - 0x8f0]
mov edx, dword [ecx + 0x134]
push edx
call dword [sym.imp.USER32.dll_GetClientRect]
push 0xb
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, dword [ebp - 0x8c]
sub ecx, eax
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0x94], eax
push 0xc
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov edx, dword [ebp - 0x88]
sub edx, eax
mov eax, edx
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x8f0]
mov ecx, dword [eax + 0x13c]
push ecx
mov edx, dword [ebp - 0x90]
push edx
mov eax, dword [ebp - 0x94]
push eax
mov ecx, dword [ebp - 0xd8]
push ecx
call dword [sym.imp.USER32.dll_DrawIcon]
lea edx, [ebp - 0xd4]
push edx
mov eax, dword [ebp - 0x8f0]
mov ecx, dword [eax + 0x134]
push ecx
call dword [sym.imp.USER32.dll_EndPaint]
jmp 0x4134b5
mov edx, dword [ebp - 0x8f0]
cmp dword [edx + 0x134], 0
je 0x4133cc
mov eax, dword [ebp - 0x8f0]
mov ecx, dword [ebp - 0x8f0]
mov edx, dword [eax + 0x1c]
cmp edx, dword [ecx + 0x134]
jne 0x4133d8
mov dword [ebp - 8], 0
jmp 0x4134b5
mov eax, dword [ebp - 0x8f0]
xor ecx, ecx
mov cx, word [eax + 0x22]
and ecx, 0x4000
test ecx, ecx
je 0x413486
mov edx, dword [ebp - 0x8f0]
cmp dword [edx + 0x48], 0
jne 0x413486
mov eax, dword [ebp - 0x8f0]
cmp dword [eax + 0x134], 0
je 0x413422
mov ecx, dword [ebp - 0x8f0]
mov edx, dword [ecx + 0x1c]
mov dword [ebp - 0x91c], edx
jmp 0x41342c
mov dword [ebp - 0x91c], 0
mov eax, dword [ebp - 0x8f0]
cmp dword [eax + 0x134], 0
je 0x41344f
mov ecx, dword [ebp - 0x8f0]
mov edx, dword [ecx + 0x134]
mov dword [ebp - 0x920], edx
jmp 0x41345e
mov eax, dword [ebp - 0x8f0]
mov ecx, dword [eax + 0x1c]
mov dword [ebp - 0x920], ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x10]
push edx
mov eax, dword [ebp - 0x91c]
push eax
mov ecx, dword [ebp - 0x920]
push ecx
call dword [sym.imp.USER32.dll_DefFrameProcA]
mov dword [ebp - 4], eax
jmp 0x4134b5
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x8f0]
mov eax, dword [edx + 0x134]
push eax
mov ecx, dword [ebp - 0x8f0]
mov edx, dword [ecx + 0xb4]
push edx
call dword [sym.imp.USER32.dll_CallWindowProcA]
mov dword [ebp - 4], eax
jmp 0x41505d
mov eax, dword [ebp - 0x8f0]
cmp dword [eax + 0x48], 0
je 0x4134e9
push 0x3fa
mov ecx, dword [ebp - 0x8f0]
mov ecx, dword [ecx + 0x48]
call fcn.0041ae20
test eax, eax
je 0x4134e9
mov dword [ebp - 4], 0
jmp 0x4135e4
mov edx, dword [ebp - 0x8f0]
xor eax, eax
mov ax, word [edx + 0x22]
and eax, 0x8000
test eax, eax
je 0x413524
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
push 0x443220
call dword [sym.imp.USER32.dll_CallWindowProcA]
mov dword [ebp - 4], eax
jmp 0x4135e4
mov eax, dword [ebp - 0x8f0]
xor ecx, ecx
mov cx, word [eax + 0x22]
and ecx, 0x4000
test ecx, ecx
je 0x4135d2
mov edx, dword [ebp - 0x8f0]
cmp dword [edx + 0x48], 0
jne 0x4135d2
mov eax, dword [ebp - 0x8f0]
cmp dword [eax + 0x134], 0
je 0x41356e
mov ecx, dword [ebp - 0x8f0]
mov edx, dword [ecx + 0x1c]
mov dword [ebp - 0x924], edx
jmp 0x413578
mov dword [ebp - 0x924], 0
mov eax, dword [ebp - 0x8f0]
cmp dword [eax + 0x134], 0
je 0x41359b
mov ecx, dword [ebp - 0x8f0]
mov edx, dword [ecx + 0x134]
mov dword [ebp - 0x928], edx
jmp 0x4135aa
mov eax, dword [ebp - 0x8f0]
mov ecx, dword [eax + 0x1c]
mov dword [ebp - 0x928], ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x10]
push edx
mov eax, dword [ebp - 0x924]
push eax
mov ecx, dword [ebp - 0x928]
push ecx
call dword [sym.imp.USER32.dll_DefFrameProcA]
mov dword [ebp - 4], eax
jmp 0x4135e4
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x8f0]
call fcn.0042f7f7
mov dword [ebp - 4], eax
jmp 0x41505d
mov eax, dword [ebp - 0x8f0]
xor ecx, ecx
mov cx, word [eax + 0x26]
and ecx, 0x80
test ecx, ecx
je 0x41361f
mov edx, dword [ebp - 0x8f0]
cmp dword [edx + 0x13c], 0
je 0x41361f
mov eax, dword [ebp - 0x8f0]
mov ecx, dword [eax + 0x13c]
mov dword [ebp - 4], ecx
jmp 0x413626
mov dword [ebp - 8], 0
jmp 0x41505d
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x8f0]
call fcn.0042f7f7
mov eax, dword [ebp - 0x8f0]
xor ecx, ecx
mov cx, word [eax + 0x26]
and ecx, 0x800
test ecx, ecx
jne 0x41369d
mov edx, dword [ebp - 0x8f0]
mov ax, word [edx + 0x26]
or ah, 8
mov ecx, dword [ebp - 0x8f0]
mov word [ecx + 0x26], ax
push 0
push 0xfffffe70
lea ecx, [ebp - 0x510]
call fcn.0040abe5
push eax
mov ecx, dword [ebp - 0x8f0]
call fcn.0042f7f7
mov edx, dword [ebp - 0x8f0]
mov ax, word [edx + 0x26]
and ax, 0xf7ff
mov ecx, dword [ebp - 0x8f0]
mov word [ecx + 0x26], ax
jmp 0x41505d
mov edx, dword [ebp - 0x8f0]
cmp dword [edx + 0x48], 0
jne 0x4136f6
mov eax, dword [ebp - 0x8f0]
mov cx, word [eax + 0x26]
or ch, 8
mov edx, dword [ebp - 0x8f0]
mov word [edx + 0x26], cx
mov eax, dword [ebp - 0x8f0]
push eax
mov ecx, dword [0x45243c]
mov edx, dword [ecx]
mov ecx, dword [0x45243c]
call dword [edx + 0x2c]
mov eax, dword [ebp - 0x8f0]
mov cx, word [eax + 0x26]
and cx, 0xf7ff
mov edx, dword [ebp - 0x8f0]
mov word [edx + 0x26], cx
mov eax, dword [ebp - 0x8f0]
cmp dword [eax + 0xc8], 0
je 0x41379b
push 0
push 0xffffff34
lea ecx, [ebp - 0x548]
call fcn.0040abe5
push eax
mov ecx, dword [ebp - 0x8f0]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x8f0]
call dword [edx + 0x10]
mov ecx, dword [ebp - 0x8f0]
call fcn.004233b0
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
xor ecx, ecx
mov cx, word [eax + 0x20]
and ecx, 0x20
test ecx, ecx
je 0x41375f
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x54]
push eax
mov ecx, dword [ebp - 0x8f0]
call fcn.00411a30
jmp 0x41379b
mov ecx, dword [ebp - 0x8f0]
mov edx, dword [ebp - 0xc]
mov eax, dword [ecx + 0x1c]
cmp eax, dword [edx + 0x1c]
je 0x41379b
push 0
lea ecx, [ebp - 0xdc]
push ecx
push 0x454
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xc]
call dword [eax + 8]
mov ecx, dword [ebp - 0xdc]
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
jmp 0x41505d
mov dword [ebp - 8], 0
jmp 0x41505d
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0xe4], edx
mov eax, dword [ebp - 0x18]
shr eax, 0x10
and eax, 0xffff
and eax, 0xffff
mov dword [ebp - 0xe0], eax
mov ecx, dword [ebp - 0x18]
and ecx, 0xffff
mov dword [ebp - 0xf0], ecx
cmp dword [ebp - 0xe4], 0
jne 0x413971
push 0
xor edx, edx
cmp dword [ebp - 0x14], 0x115
sete dl
add edx, 0xfffffed3
push edx
lea ecx, [ebp - 0x138]
call fcn.0040abe5
cmp dword [ebp - 0x14], 0x115
jne 0x41381e
mov eax, dword [ebp - 0x8f0]
add eax, 0x11a
mov dword [ebp - 0x92c], eax
jmp 0x413830
mov ecx, dword [ebp - 0x8f0]
add ecx, 0x110
mov dword [ebp - 0x92c], ecx
mov edx, dword [ebp - 0x92c]
mov dword [ebp - 0x54c], edx
mov eax, dword [ebp - 0x54c]
mov ecx, dword [eax]
mov dword [ebp - 0xfc], ecx
mov edx, dword [eax + 4]
mov dword [ebp - 0xf8], edx
mov ax, word [eax + 8]
mov word [ebp - 0xf4], ax
mov dword [ebp - 0x100], 0
mov ecx, dword [ebp - 0xf0]
mov dword [ebp - 0x930], ecx
cmp dword [ebp - 0x930], 5
ja case.default.0x413883
mov edx, dword [ebp - 0x930]
jmp dword [edx*4 + 0x418aec]
movsx eax, word [ebp - 0xf4]
neg eax
mov dword [ebp - 0x100], eax
jmp case.default.0x413883
movsx ecx, word [ebp - 0xf4]
mov dword [ebp - 0x100], ecx
jmp case.default.0x413883
movsx edx, word [ebp - 0xf6]
neg edx
mov dword [ebp - 0x100], edx
jmp case.default.0x413883
movsx eax, word [ebp - 0xf6]
mov dword [ebp - 0x100], eax
jmp case.default.0x413883
movsx ecx, word [ebp - 0xfc]
mov edx, dword [ebp - 0xe0]
sub edx, ecx
mov dword [ebp - 0x100], edx
movsx eax, word [ebp - 0xfc]
add eax, dword [ebp - 0x100]
movsx ecx, word [ebp - 0xfa]
cmp eax, ecx
jge 0x41390f
movsx edx, word [ebp - 0xfa]
movsx eax, word [ebp - 0xfc]
sub edx, eax
mov dword [ebp - 0x100], edx
jmp 0x41393d
movsx ecx, word [ebp - 0xfc]
add ecx, dword [ebp - 0x100]
movsx edx, word [ebp - 0xf8]
cmp ecx, edx
jle 0x41393d
movsx eax, word [ebp - 0xf8]
movsx ecx, word [ebp - 0xfc]
sub eax, ecx
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 0
je 0x41396c
mov dx, word [ebp - 0x100]
mov word [ebp - 0x108], dx
lea eax, [ebp - 0x138]
push eax
mov ecx, dword [ebp - 0x8f0]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x8f0]
call dword [edx + 0x10]
jmp 0x41505d
push 0xfffffffffffffff4
mov eax, dword [ebp - 0xe4]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov word [ebp - 0xec], ax
push 0
lea ecx, [ebp - 0xec]
push ecx
push 1
mov edx, dword [ebp - 0x8f0]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x8f0]
call dword [eax + 8]
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 0
je 0x4139ca
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xe8]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xe8]
call dword [eax + 0x10]
mov dword [ebp - 4], eax
jmp 0x41505d
mov cx, word [ebp - 0x18]
mov word [ebp - 0x140], cx
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x13c], edx
mov eax, dword [ebp - 0x140]
and eax, 0xffff
cmp eax, 0xf000
jl 0x413a3e
mov ecx, dword [ebp - 0x8f0]
cmp dword [ecx + 0x48], 0
jne 0x413a1f
mov edx, dword [ebp - 0x8f0]
xor eax, eax
mov ax, word [edx + 0x22]
and eax, 0x4000
test eax, eax
je 0x413a1f
mov dword [ebp - 8], 0
jmp 0x413a39
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x18]
push edx
push 0x112
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x413ae6
push 0
lea edx, [ebp - 0x140]
push edx
push 1
mov eax, dword [ebp - 0x8f0]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x8f0]
call dword [edx + 8]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x413adf
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x8f0]
je 0x413adf
cmp dword [ebp - 0x13c], 0
je 0x413a8b
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xc]
call dword [eax + 0x10]
mov dword [ebp - 4], eax
jmp 0x413adf
push 0
push 0xfffffe70
lea ecx, [ebp - 0x178]
call fcn.0040abe5
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x150], ecx
lea edx, [ebp - 0x178]
push edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x48]
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x48]
mov edx, dword [eax]
call dword [edx + 0x10]
push 0
push 0x3ea
lea ecx, [ebp - 0x584]
call fcn.0040abe5
push eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
mov ecx, dword [ebp - 0xc]
call dword [edx + 0x10]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
jmp 0x41505d
mov dword [ebp - 8], 0
mov ax, word [ebp - 0x18]
mov word [ebp - 0x17c], ax
mov ecx, dword [ebp - 0x17c]
and ecx, 0xffff
cmp ecx, 0xf000
jge 0x413b5c
push 0
lea edx, [ebp - 0x17c]
push edx
push 1
mov eax, dword [ebp - 0x8f0]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x8f0]
call dword [edx + 8]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x413b57
push 0
push 0x3ea
lea ecx, [ebp - 0x5bc]
call fcn.0040abe5
push eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
mov ecx, dword [ebp - 0xc]
call dword [edx + 0x10]
mov dword [ebp - 4], eax
jmp 0x413e7d
mov ax, word [ebp - 0x17c]
and ax, 0xfff0
mov word [ebp - 0x17c], ax
mov ecx, dword [ebp - 0x17c]
and ecx, 0xffff
mov dword [ebp - 0x934], ecx
cmp dword [ebp - 0x934], 0xf030
jg 0x413bcd
cmp dword [ebp - 0x934], 0xf030
je 0x413c62
cmp dword [ebp - 0x934], 0xf000
je 0x413c43
cmp dword [ebp - 0x934], 0xf010
je 0x413c22
cmp dword [ebp - 0x934], 0xf020
je 0x413c62
jmp 0x413e76
cmp dword [ebp - 0x934], 0xf060
je 0x413d83
cmp dword [ebp - 0x934], 0xf120
je 0x413bee
jmp 0x413e76
mov edx, dword [ebp - 0x8f0]
mov ax, word [edx + 0x26]
and ax, 0xff3f
mov ecx, dword [ebp - 0x8f0]
mov word [ecx + 0x26], ax
mov edx, dword [ebp - 0x8f0]
mov ax, word [edx + 0x26]
or ah, 1
mov ecx, dword [ebp - 0x8f0]
mov word [ecx + 0x26], ax
jmp 0x413e7d
mov edx, dword [ebp - 0x8f0]
xor eax, eax
mov ax, word [edx + 0x22]
and eax, 0x80
test eax, eax
je 0x413c3e
mov dword [ebp - 8], 1
jmp 0x413e7d
mov ecx, dword [ebp - 0x8f0]
xor edx, edx
mov dx, word [ecx + 0x22]
and edx, 0x40
test edx, edx
je 0x413c5d
mov dword [ebp - 8], 1
jmp 0x413e7d
mov eax, dword [ebp - 0x8f0]
add eax, 0x38
mov ecx, dword [ebp - 0x8f0]
add ecx, 0x144
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov eax, dword [eax + 0xc]
mov dword [ecx + 0xc], eax
mov ecx, dword [ebp - 0x8f0]
xor edx, edx
mov dx, word [ecx + 0x22]
and edx, 0x100
test edx, edx
je 0x413d7e
mov eax, dword [ebp - 0x8f0]
xor ecx, ecx
mov cx, word [eax + 0x22]
and ecx, 0x4000
test ecx, ecx
je 0x413d52
mov edx, dword [ebp - 0x8f0]
cmp dword [edx + 0x48], 0
jne 0x413d52
mov eax, dword [ebp - 0x8f0]
cmp dword [eax + 0x134], 0
je 0x413cf1
mov ecx, dword [ebp - 0x8f0]
mov edx, dword [ecx + 0x1c]
mov dword [ebp - 0x938], edx
jmp 0x413cfb
mov dword [ebp - 0x938], 0
mov eax, dword [ebp - 0x8f0]
cmp dword [eax + 0x134], 0
je 0x413d1e
mov ecx, dword [ebp - 0x8f0]
mov edx, dword [ecx + 0x134]
mov dword [ebp - 0x93c], edx
jmp 0x413d2d
mov eax, dword [ebp - 0x8f0]
mov ecx, dword [eax + 0x1c]
mov dword [ebp - 0x93c], ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x938]
push edx
mov eax, dword [ebp - 0x93c]
push eax
call dword [sym.imp.USER32.dll_DefFrameProcA]
mov dword [ebp - 4], eax
jmp 0x413d64
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x8f0]
call fcn.0042f7f7
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x8f0]
mov eax, dword [edx + 0x134]
push eax
call dword [sym.imp.USER32.dll_BringWindowToTop]
mov dword [ebp - 8], 1
jmp 0x413e7d
mov ecx, dword [ebp - 0x8f0]
mov edx, dword [0x45243c]
mov eax, dword [ecx + 0x1c]
cmp eax, dword [edx + 0x1c]
jne 0x413dc9
push 2
push 0
push 0x3f3
lea ecx, [ebp - 0x5f4]
call fcn.0040abe5
push eax
mov ecx, dword [0x452438]
mov edx, dword [ecx]
mov ecx, dword [0x452438]
call dword [edx + 0x14]
mov dword [ebp - 8], 1
jmp 0x413e74
mov eax, dword [ebp - 0x8f0]
xor ecx, ecx
mov cx, word [eax + 0x22]
and ecx, 0x200
test ecx, ecx
je 0x413deb
mov dword [ebp - 8], 1
jmp 0x413e74
mov edx, dword [ebp - 0x8f0]
xor eax, eax
mov ax, word [edx + 0x22]
and eax, 0x100
test eax, eax
je 0x413e74
mov ecx, dword [ebp - 0x8f0]
call fcn.0040b590
mov dword [ebp - 0x180], eax
jmp 0x413e24
mov ecx, dword [ebp - 0x180]
call fcn.0040b590
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 0
je 0x413e74
push 0
lea ecx, [ebp - 0x184]
push ecx
push 0x454
mov edx, dword [ebp - 0x180]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x180]
call dword [eax + 8]
push 1
mov ecx, dword [ebp - 0x184]
push ecx
call dword [sym.imp.USER32.dll_EnableWindow]
mov edx, dword [ebp - 0x180]
xor eax, eax
mov ax, word [edx + 0x22]
and eax, 0x100
test eax, eax
je 0x413e72
jmp 0x413e74
jmp 0x413e13
jmp 0x413e7d
mov dword [ebp - 8], 0
jmp 0x41505d
mov ecx, dword [ebp - 0x8f0]
mov dx, word [ecx + 0x26]
or dh, 8
mov eax, dword [ebp - 0x8f0]
mov word [eax + 0x26], dx
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x18c], ecx
mov dl, byte [ebp - 0x18c]
push edx
call fcn.0042b502
add esp, 4
movsx eax, al
mov dword [ebp - 0x18c], eax
mov ecx, dword [ebp - 0x10]
and ecx, 0x20000000
sar ecx, 0x12
mov edx, dword [ebp - 0x18c]
add edx, ecx
mov dword [ebp - 0x18c], edx
mov dword [ebp - 0x188], 0
mov eax, dword [ebp - 0x18c]
and eax, 0x800
test eax, eax
je 0x413f6a
mov dword [ebp - 0x190], 0
jmp 0x413f0f
mov ecx, dword [ebp - 0x190]
add ecx, 1
mov dword [ebp - 0x190], ecx
mov edx, dword [ebp - 0x190]
imul edx, edx, 0x14
mov eax, dword [ebp - 0x8f0]
mov ecx, dword [eax + 0x14]
movsx edx, word [ecx + edx]
cmp edx, 0xffffffff
je 0x413f68
mov eax, dword [ebp - 0x190]
imul eax, eax, 0x14
mov ecx, dword [ebp - 0x8f0]
mov edx, dword [ecx + 0x14]
mov eax, dword [edx + eax + 0xc]
cmp eax, dword [ebp - 0x18c]
jne 0x413f66
mov ecx, dword [ebp - 0x190]
imul ecx, ecx, 0x14
mov edx, dword [ebp - 0x8f0]
mov eax, dword [edx + 0x14]
xor edx, edx
mov dl, byte [eax + ecx + 4]
mov dword [ebp - 0x188], edx
jmp 0x413f00
jmp 0x413f89
mov eax, dword [ebp - 0x8f0]
xor ecx, ecx
mov cx, word [eax + 0x22]
and ecx, 0x20
test ecx, ecx
je 0x413f89
mov edx, dword [ebp - 0x18c]
mov dword [ebp - 0x188], edx
cmp dword [ebp - 0x188], 0
jne 0x414095
mov dword [ebp - 8], 1
mov eax, dword [ebp - 0x8f0]
xor ecx, ecx
mov cx, word [eax + 0x22]
and ecx, 0x4000
test ecx, ecx
je 0x41404b
mov edx, dword [ebp - 0x8f0]
cmp dword [edx + 0x48], 0
jne 0x41404b
mov eax, dword [ebp - 0x8f0]
cmp dword [eax + 0x134], 0
je 0x413fe7
mov ecx, dword [ebp - 0x8f0]
mov edx, dword [ecx + 0x1c]
mov dword [ebp - 0x940], edx
jmp 0x413ff1
mov dword [ebp - 0x940], 0
mov eax, dword [ebp - 0x8f0]
cmp dword [eax + 0x134], 0
je 0x414014
mov ecx, dword [ebp - 0x8f0]
mov edx, dword [ecx + 0x134]
mov dword [ebp - 0x944], edx
jmp 0x414023
mov eax, dword [ebp - 0x8f0]
mov ecx, dword [eax + 0x1c]
mov dword [ebp - 0x944], ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x10]
push edx
mov eax, dword [ebp - 0x940]
push eax
mov ecx, dword [ebp - 0x944]
push ecx
call dword [sym.imp.USER32.dll_DefFrameProcA]
mov dword [ebp - 4], eax
jmp 0x414077
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x10]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
push ecx
mov edx, dword [ebp - 0x8f0]
mov eax, dword [edx + 0xb4]
push eax
call dword [sym.imp.USER32.dll_CallWindowProcA]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x8f0]
mov dx, word [ecx + 0x26]
and dx, 0xf7ff
mov eax, dword [ebp - 0x8f0]
mov word [eax + 0x26], dx
jmp 0x41505d
mov ecx, dword [ebp - 0x8f0]
add ecx, 0xd0
call fcn.0040b590
mov dword [ebp - 0xc], eax
jmp 0x4140b6
mov ecx, dword [ebp - 0xc]
call fcn.0040b590
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4141d4
cmp dword [ebp - 8], 0
jne 0x4141d4
mov ecx, dword [ebp - 0xc]
cmp dword [ecx + 0x8c], 0xff
jne 0x414121
mov edx, dword [ebp - 0xc]
xor eax, eax
mov ax, word [edx + 0x26]
and eax, 0x800
test eax, eax
jne 0x414121
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xc]
call dword [eax + 0x10]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x10000
jne 0x41411c
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 0x8f0]
call fcn.00411a30
mov dword [ebp - 8], 1
jmp 0x4141cf
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x188]
cmp eax, dword [edx + 0x8c]
jne 0x4141cf
mov ecx, dword [ebp - 0xc]
xor edx, edx
mov dx, word [ecx + 0x20]
and edx, 0x400
test edx, edx
jne 0x4141cf
mov eax, dword [ebp - 0xc]
xor ecx, ecx
mov cx, word [eax + 0x22]
and ecx, 2
test ecx, ecx
jne 0x41416c
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 0x8f0]
call fcn.00411a30
push 2
mov ecx, dword [ebp - 0xc]
call fcn.0041ae20
test eax, eax
jne 0x414188
push 5
mov ecx, dword [ebp - 0xc]
call fcn.0041ae20
test eax, eax
je 0x4141a6
push 0
push 0x3ea
lea ecx, [ebp - 0x62c]
call fcn.0040abe5
push eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
mov ecx, dword [ebp - 0xc]
call dword [edx + 0x10]
mov dword [ebp - 8], 1
mov dword [ebp - 4], 0x10000
mov eax, dword [ebp - 0x8f0]
mov cx, word [eax + 0x26]
and cx, 0xf7ff
mov edx, dword [ebp - 0x8f0]
mov word [edx + 0x26], cx
jmp 0x4141d4
jmp 0x4140ab
mov eax, dword [ebp - 0x8f0]
cmp dword [eax + 0x48], 0
jne 0x414209
mov ecx, dword [ebp - 0x8f0]
xor edx, edx
mov dx, word [ecx + 0x22]
and edx, 0x4000
test edx, edx
je 0x414209
mov ecx, dword [ebp - 0x8f0]
call fcn.004119f0
mov dword [ebp - 0x948], eax
jmp 0x41421a
mov ecx, dword [ebp - 0x8f0]
call fcn.004119d0
mov dword [ebp - 0x948], eax
mov eax, dword [ebp - 0x948]
mov dword [ebp - 0xc], eax
jmp 0x41426d
mov ecx, dword [ebp - 0x8f0]
cmp dword [ecx + 0x48], 0
jne 0x414256
mov edx, dword [ebp - 0x8f0]
xor eax, eax
mov ax, word [edx + 0x22]
and eax, 0x4000
test eax, eax
je 0x414256
mov ecx, dword [ebp - 0xc]
call fcn.0041a2a0
mov dword [ebp - 0x94c], eax
jmp 0x414264
mov ecx, dword [ebp - 0xc]
call fcn.0040b590
mov dword [ebp - 0x94c], eax
mov ecx, dword [ebp - 0x94c]
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0
je 0x41438c
cmp dword [ebp - 8], 0
jne 0x41438c
mov edx, dword [ebp - 0xc]
cmp dword [edx + 0x8c], 0xff
jne 0x4142d9
mov eax, dword [ebp - 0xc]
xor ecx, ecx
mov cx, word [eax + 0x26]
and ecx, 0x800
test ecx, ecx
jne 0x4142d9
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
mov ecx, dword [ebp - 0xc]
call dword [edx + 0x10]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x10000
jne 0x4142d4
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x8f0]
call fcn.00411a30
mov dword [ebp - 8], 1
jmp 0x414387
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x188]
cmp edx, dword [ecx + 0x8c]
jne 0x414387
mov eax, dword [ebp - 0xc]
xor ecx, ecx
mov cx, word [eax + 0x20]
and ecx, 0x400
test ecx, ecx
jne 0x414387
mov edx, dword [ebp - 0xc]
xor eax, eax
mov ax, word [edx + 0x22]
and eax, 2
test eax, eax
jne 0x414324
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 0x8f0]
call fcn.00411a30
push 2
mov ecx, dword [ebp - 0xc]
call fcn.0041ae20
test eax, eax
jne 0x414340
push 5
mov ecx, dword [ebp - 0xc]
call fcn.0041ae20
test eax, eax
je 0x41435e
push 0
push 0x3ea
lea ecx, [ebp - 0x664]
call fcn.0040abe5
push eax
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xc]
call dword [eax + 0x10]
mov dword [ebp - 8], 1
mov dword [ebp - 4], 0x10000
mov ecx, dword [ebp - 0x8f0]
mov dx, word [ecx + 0x26]
and dx, 0xf7ff
mov eax, dword [ebp - 0x8f0]
mov word [eax + 0x26], dx
jmp 0x41438c
jmp 0x414225
cmp dword [ebp - 8], 0
je 0x4143b0
mov ecx, dword [ebp - 0x8f0]
mov dx, word [ecx + 0x26]
and dx, 0xf7ff
mov eax, dword [ebp - 0x8f0]
mov word [eax + 0x26], dx
jmp 0x41505d
mov ecx, dword [ebp - 0x8f0]
cmp dword [ecx + 0x48], 0
jne 0x414491
mov edx, dword [ebp - 0x8f0]
xor eax, eax
mov ax, word [edx + 0x22]
and eax, 0x4000
test eax, eax
je 0x41445d
mov ecx, dword [ebp - 0x8f0]
cmp dword [ecx + 0x134], 0
je 0x4143f9
mov edx, dword [ebp - 0x8f0]
mov eax, dword [edx + 0x1c]
mov dword [ebp - 0x950], eax
jmp 0x414403
mov dword [ebp - 0x950], 0
mov ecx, dword [ebp - 0x8f0]
cmp dword [ecx + 0x134], 0
je 0x414426
mov edx, dword [ebp - 0x8f0]
mov eax, dword [edx + 0x134]
mov dword [ebp - 0x954], eax
jmp 0x414435
mov ecx, dword [ebp - 0x8f0]
mov edx, dword [ecx + 0x1c]
mov dword [ebp - 0x954], edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x10]
push eax
mov ecx, dword [ebp - 0x950]
push ecx
mov edx, dword [ebp - 0x954]
push edx
call dword [sym.imp.USER32.dll_DefFrameProcA]
mov dword [ebp - 4], eax
jmp 0x41448f
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x10]
push eax
mov ecx, dword [ebp - 0x8f0]
mov edx, dword [ecx + 0x134]
push edx
mov eax, dword [ebp - 0x8f0]
mov ecx, dword [eax + 0xb4]
push ecx
call dword [sym.imp.USER32.dll_CallWindowProcA]
mov dword [ebp - 4], eax
jmp 0x4144c5
mov edx, dword [ebp - 0x8f0]
cmp dword [edx + 0x48], 0
je 0x4144c5
mov eax, dword [ebp - 0x8f0]
mov ecx, dword [eax + 0x48]
xor edx, edx
mov dx, word [ecx + 0x26]
and edx, 0x800
test edx, edx
jne 0x4144c5
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x8f0]
call fcn.0042f7f7
mov dword [ebp - 8], 1
mov ecx, dword [ebp - 0x8f0]
mov dx, word [ecx + 0x26]
and dx, 0xf7ff
mov eax, dword [ebp - 0x8f0]
mov word [eax + 0x26], dx
jmp 0x41505d
mov ecx, dword [ebp - 0x8f0]
call fcn.004233b0
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x414528
push 0x3ec
mov ecx, dword [ebp - 0xc]
call fcn.0041ae20
test eax, eax
jne 0x4145b9
push 0x3ee
mov ecx, dword [ebp - 0xc]
call fcn.0041ae20
test eax, eax
jne 0x4145b9
mov ecx, dword [ebp - 0x8f0]
add ecx, 0xd0
call fcn.00411960
mov dword [ebp - 0xc], eax
jmp 0x414549
mov ecx, dword [ebp - 0xc]
call fcn.0041a2a0
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4145b9
push 0x3ec
mov ecx, dword [ebp - 0xc]
call fcn.0041ae20
test eax, eax
jne 0x414571
push 0x3ee
mov ecx, dword [ebp - 0xc]
call fcn.0041ae20
test eax, eax
je 0x4145b7
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x8f0]
mov eax, dword [edx + 0xc8]
mov dword [ecx + 0x54], eax
mov ecx, dword [ebp - 0xc]
mov dx, word [ecx + 0x26]
or dh, 0x40
mov eax, dword [ebp - 0xc]
mov word [eax + 0x26], dx
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 0x8f0]
call fcn.00411a30
mov edx, dword [ebp - 0xc]
mov ax, word [edx + 0x26]
and ax, 0xbfff
mov ecx, dword [ebp - 0xc]
mov word [ecx + 0x26], ax
jmp 0x4145b9
jmp 0x41453e
mov dx, word [ebp - 0x18]
mov word [ebp - 0x194], dx
mov eax, dword [ebp - 0x18]
shr eax, 0x10
and eax, 0xffff
mov word [ebp - 0x198], ax
mov ecx, dword [ebp - 0x8f0]
call fcn.004233b0
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x198]
and ecx, 0xffff
cmp ecx, 0xffff
jne 0x41465f
mov edx, dword [ebp - 0x194]
and edx, 0xffff
test edx, edx
jne 0x41465f
cmp dword [ebp - 0xc], 0
je 0x41465f
push 0x3ec
mov ecx, dword [ebp - 0xc]
call fcn.0041ae20
test eax, eax
jne 0x414630
push 0x3ee
mov ecx, dword [ebp - 0xc]
call fcn.0041ae20
test eax, eax
je 0x41465f
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x54]
push ecx
mov ecx, dword [ebp - 0x8f0]
call fcn.00411a30
mov edx, dword [ebp - 0xc]
cmp dword [edx + 0x54], 0
jne 0x41465d
mov eax, dword [ebp - 0x8f0]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x54]
mov dword [eax + 0xc8], edx
jmp 0x414674
cmp dword [ebp - 0xc], 0
je 0x414674
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xc]
call dword [edx + 0x10]
jmp 0x41505d
mov ax, word [ebp - 0x10]
mov word [ebp - 0x19c], ax
mov ecx, dword [ebp - 0x8f0]
xor edx, edx
mov dx, word [ecx + 0x22]
and edx, 0x40
test edx, edx
je 0x414736
mov eax, dword [ebp - 0x19c]
and eax, 0xffff
cmp eax, 0xa
je 0x414720
mov ecx, dword [ebp - 0x19c]
and ecx, 0xffff
cmp ecx, 0xc
je 0x414720
mov edx, dword [ebp - 0x19c]
and edx, 0xffff
cmp edx, 0xb
je 0x414720
mov eax, dword [ebp - 0x19c]
and eax, 0xffff
cmp eax, 0xf
je 0x414720
mov ecx, dword [ebp - 0x19c]
and ecx, 0xffff
cmp ecx, 0xd
je 0x414720
mov edx, dword [ebp - 0x19c]
and edx, 0xffff
cmp edx, 0xe
je 0x414720
mov eax, dword [ebp - 0x19c]
and eax, 0xffff
cmp eax, 0x10
je 0x414720
mov ecx, dword [ebp - 0x19c]
and ecx, 0xffff
cmp ecx, 0x11
jne 0x414736
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
jmp 0x41473d
mov dword [ebp - 8], 0
jmp 0x41505d
mov edx, dword [ebp - 0x8f0]
cmp dword [edx + 0x48], 0
je 0x414768
mov eax, dword [ebp - 0x8f0]
xor ecx, ecx
mov cx, word [eax + 0x22]
and ecx, 0x4000
test ecx, ecx
je 0x414a1a
mov dword [ebp - 8], 0
mov edx, dword [ebp - 0x8f0]
cmp dword [edx + 0x134], 0
je 0x414792
mov eax, dword [ebp - 0x8f0]
mov ecx, dword [eax + 0x134]
mov dword [ebp - 0x958], ecx
jmp 0x4147a1
mov edx, dword [ebp - 0x8f0]
mov eax, dword [edx + 0x1c]
mov dword [ebp - 0x958], eax
lea ecx, [ebp - 0x1ac]
push ecx
mov edx, dword [ebp - 0x958]
push edx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x8f0]
cmp dword [eax + 0x48], 0
je 0x41483f
mov ecx, dword [ebp - 0x1ac]
mov dword [ebp - 0x1b4], ecx
mov edx, dword [ebp - 0x1a8]
mov dword [ebp - 0x1b0], edx
lea eax, [ebp - 0x1b4]
push eax
mov ecx, dword [ebp - 0x8f0]
mov edx, dword [ecx + 0x48]
mov eax, dword [edx + 0x1c]
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
mov ecx, dword [ebp - 0x1ac]
sub ecx, dword [ebp - 0x1b4]
mov edx, dword [ebp - 0x1a4]
sub edx, ecx
mov dword [ebp - 0x1a4], edx
mov eax, dword [ebp - 0x1a8]
sub eax, dword [ebp - 0x1b0]
mov ecx, dword [ebp - 0x1a0]
sub ecx, eax
mov dword [ebp - 0x1a0], ecx
mov edx, dword [ebp - 0x1b4]
mov dword [ebp - 0x1ac], edx
mov eax, dword [ebp - 0x1b0]
mov dword [ebp - 0x1a8], eax
mov ecx, dword [ebp - 0x8f0]
mov edx, dword [ebp - 0x1ac]
cmp edx, dword [ecx + 0x28]
jne 0x414861
mov eax, dword [ebp - 0x8f0]
mov ecx, dword [ebp - 0x1a8]
cmp ecx, dword [eax + 0x2c]
je 0x4148c7
push 0
push 0xfffffffffffffff2
lea ecx, [ebp - 0x1ec]
call fcn.0040abe5
mov edx, dword [ebp - 0x8f0]
mov eax, dword [ebp - 0x1ac]
sub eax, dword [edx + 0x28]
mov dword [ebp - 0x1c4], eax
mov ecx, dword [ebp - 0x8f0]
mov edx, dword [ebp - 0x1a8]
sub edx, dword [ecx + 0x2c]
mov dword [ebp - 0x1c0], edx
lea eax, [ebp - 0x1ec]
push eax
mov ecx, dword [ebp - 0x8f0]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x8f0]
call dword [edx + 0x10]
lea eax, [ebp - 0x1ac]
push eax
mov ecx, dword [ebp - 0x8f0]
add ecx, 0x28
call fcn.00411980
mov ecx, dword [ebp - 0x8f0]
xor edx, edx
mov dx, word [ecx + 0x26]
and edx, 0x2000
test edx, edx
je 0x4149f2
mov eax, dword [ebp - 0x8f0]
cmp dword [eax + 0x28], 0
jl 0x4148fd
mov ecx, dword [ebp - 0x8f0]
cmp dword [ecx + 0x2c], 0
jge 0x4149f2
mov ecx, dword [ebp - 0x8f0]
add ecx, 0x28
call fcn.0041a3d0
mov dword [ebp - 0x1f0], eax
mov ecx, dword [ebp - 0x8f0]
add ecx, 0x28
call fcn.0041a350
mov dword [ebp - 0x1f4], eax
mov edx, dword [ebp - 0x8f0]
cmp dword [edx + 0x28], 0
jge 0x41493e
mov eax, dword [ebp - 0x8f0]
mov dword [eax + 0x28], 0
mov ecx, dword [ebp - 0x8f0]
cmp dword [ecx + 0x2c], 0
jge 0x414957
mov edx, dword [ebp - 0x8f0]
mov dword [edx + 0x2c], 0
mov eax, dword [ebp - 0x8f0]
mov ecx, dword [eax + 0x28]
mov edx, dword [ebp - 0x1f0]
lea eax, [ecx + edx - 1]
mov ecx, dword [ebp - 0x8f0]
mov dword [ecx + 0x30], eax
mov edx, dword [ebp - 0x8f0]
mov eax, dword [edx + 0x2c]
mov ecx, dword [ebp - 0x1f4]
lea edx, [eax + ecx - 1]
mov eax, dword [ebp - 0x8f0]
mov dword [eax + 0x34], edx
mov ecx, dword [ebp - 0x8f0]
cmp dword [ecx + 0x134], 0
je 0x4149b2
mov edx, dword [ebp - 0x8f0]
mov eax, dword [edx + 0x134]
mov dword [ebp - 0x95c], eax
jmp 0x4149c1
mov ecx, dword [ebp - 0x8f0]
mov edx, dword [ecx + 0x1c]
mov dword [ebp - 0x95c], edx
push 1
mov eax, dword [ebp - 0x1f4]
push eax
mov ecx, dword [ebp - 0x1f0]
push ecx
mov edx, dword [ebp - 0x8f0]
mov eax, dword [edx + 0x2c]
push eax
mov ecx, dword [ebp - 0x8f0]
mov edx, dword [ecx + 0x28]
push edx
mov eax, dword [ebp - 0x95c]
push eax
call dword [sym.imp.USER32.dll_MoveWindow]
mov ecx, dword [ebp - 0x8f0]
add ecx, 0x28
mov edx, dword [ebp - 0x8f0]
add edx, 0x38
mov eax, dword [ecx]
mov dword [edx], eax
mov eax, dword [ecx + 4]
mov dword [edx + 4], eax
mov eax, dword [ecx + 8]
mov dword [edx + 8], eax
mov ecx, dword [ecx + 0xc]
mov dword [edx + 0xc], ecx
jmp 0x41505d
mov edx, dword [ebp - 0x8f0]
xor eax, eax
mov ax, word [edx + 0x26]
and eax, 0x4000
test eax, eax
je 0x414a5a
mov ecx, dword [ebp - 0x8f0]
cmp dword [ecx + 0x48], 0
je 0x414a55
mov edx, dword [ebp - 0x8f0]
xor eax, eax
mov ax, word [edx + 0x22]
and eax, 0x4000
test eax, eax
jne 0x414a5a
jmp 0x41505d
mov ecx, dword [ebp - 0x8f0]
mov dx, word [ecx + 0x26]
and dx, 0xff3f
mov eax, dword [ebp - 0x8f0]
mov word [eax + 0x26], dx
cmp dword [ebp - 0x18], 1
jne 0x414a92
mov ecx, dword [ebp - 0x8f0]
mov dx, word [ecx + 0x26]
or dl, 0x80
mov eax, dword [ebp - 0x8f0]
mov word [eax + 0x26], dx
jmp 0x414aaf
cmp dword [ebp - 0x18], 2
jne 0x414aaf
mov ecx, dword [ebp - 0x8f0]
mov dx, word [ecx + 0x26]
or dl, 0x40
mov eax, dword [ebp - 0x8f0]
mov word [eax + 0x26], dx
mov ecx, dword [ebp - 0x8f0]
cmp dword [ecx + 0x48], 0
je 0x414ad4
mov edx, dword [ebp - 0x8f0]
xor eax, eax
mov ax, word [edx + 0x22]
and eax, 0x4000
test eax, eax
je 0x414c17
mov ecx, dword [ebp - 0x8f0]
cmp dword [ecx + 0x134], 0
je 0x414af7
mov edx, dword [ebp - 0x8f0]
mov eax, dword [edx + 0x134]
mov dword [ebp - 0x960], eax
jmp 0x414b06
mov ecx, dword [ebp - 0x8f0]
mov edx, dword [ecx + 0x1c]
mov dword [ebp - 0x960], edx
lea eax, [ebp - 0x204]
push eax
mov ecx, dword [ebp - 0x960]
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [ebp - 0x8f0]
cmp dword [edx + 0x48], 0
je 0x414bd8
mov eax, dword [ebp - 0x204]
mov dword [ebp - 0x20c], eax
mov ecx, dword [ebp - 0x200]
mov dword [ebp - 0x208], ecx
lea edx, [ebp - 0x20c]
push edx
mov eax, dword [ebp - 0x8f0]
mov ecx, dword [eax + 0x48]
mov edx, dword [ecx + 0x1c]
push edx
call dword [sym.imp.USER32.dll_ScreenToClient]
mov eax, dword [ebp - 0x204]
sub eax, dword [ebp - 0x20c]
mov ecx, dword [ebp - 0x8f0]
add eax, dword [ecx + 0xa0]
mov edx, dword [ebp - 0x1fc]
sub edx, eax
mov dword [ebp - 0x1fc], edx
mov eax, dword [ebp - 0x200]
sub eax, dword [ebp - 0x208]
mov ecx, dword [ebp - 0x8f0]
add eax, dword [ecx + 0xa4]
mov edx, dword [ebp - 0x1f8]
sub edx, eax
mov dword [ebp - 0x1f8], edx
mov eax, dword [ebp - 0x8f0]
mov ecx, dword [ebp - 0x20c]
sub ecx, dword [eax + 0xa0]
mov dword [ebp - 0x204], ecx
mov edx, dword [ebp - 0x8f0]
mov eax, dword [ebp - 0x208]
sub eax, dword [edx + 0xa4]
mov dword [ebp - 0x200], eax
lea ecx, [ebp - 0x204]
push ecx
mov ecx, dword [ebp - 0x8f0]
add ecx, 0x28
call fcn.00411980
mov edx, dword [ebp - 0x8f0]
add edx, 0x28
mov eax, dword [ebp - 0x8f0]
add eax, 0x38
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [edx + 4]
mov dword [eax + 4], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov edx, dword [edx + 0xc]
mov dword [eax + 0xc], edx
jmp 0x414c5d
mov eax, dword [ebp - 0x10]
and eax, 0xffff
mov ecx, dword [ebp - 0x8f0]
mov edx, dword [ecx + 0x28]
lea eax, [edx + eax - 1]
mov ecx, dword [ebp - 0x8f0]
mov dword [ecx + 0x30], eax
mov edx, dword [ebp - 0x10]
shr edx, 0x10
and edx, 0xffff
and edx, 0xffff
mov eax, dword [ebp - 0x8f0]
mov ecx, dword [eax + 0x2c]
lea edx, [ecx + edx - 1]
mov eax, dword [ebp - 0x8f0]
mov dword [eax + 0x34], edx
mov ecx, dword [ebp - 0x8f0]
cmp dword [ecx + 0x48], 0
jne 0x414d37
mov edx, dword [ebp - 0x8f0]
xor eax, eax
mov ax, word [edx + 0x22]
and eax, 0x4000
test eax, eax
je 0x414d37
push 0
push 0
push 0xb
mov ecx, dword [ebp - 0x8f0]
mov edx, dword [ecx + 0x1c]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [ebp - 0x8f0]
cmp dword [eax + 0x134], 0
je 0x414cbc
mov ecx, dword [ebp - 0x8f0]
mov edx, dword [ecx + 0x1c]
mov dword [ebp - 0x964], edx
jmp 0x414cc6
mov dword [ebp - 0x964], 0
mov eax, dword [ebp - 0x8f0]
cmp dword [eax + 0x134], 0
je 0x414ce9
mov ecx, dword [ebp - 0x8f0]
mov edx, dword [ecx + 0x134]
mov dword [ebp - 0x968], edx
jmp 0x414cf8
mov eax, dword [ebp - 0x8f0]
mov ecx, dword [eax + 0x1c]
mov dword [ebp - 0x968], ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x10]
push edx
mov eax, dword [ebp - 0x964]
push eax
mov ecx, dword [ebp - 0x968]
push ecx
call dword [sym.imp.USER32.dll_DefFrameProcA]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x8f0]
mov ax, word [edx + 0x26]
or ah, 1
mov ecx, dword [ebp - 0x8f0]
mov word [ecx + 0x26], ax
jmp 0x414d49
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x8f0]
call fcn.0042f7f7
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x8f0]
xor ecx, ecx
mov cx, word [eax + 0x26]
and ecx, 0x80
test ecx, ecx
jne 0x414e0e
push 0
push 0xffffff37
lea ecx, [ebp - 0x69c]
call fcn.0040abe5
push eax
mov edx, dword [ebp - 0x8f0]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x8f0]
call dword [eax + 0x10]
mov ecx, dword [ebp - 0x8f0]
xor edx, edx
mov dx, word [ecx + 0x26]
and edx, 0x100
test edx, edx
je 0x414e0e
push 0
push 1
push 0xb
mov eax, dword [ebp - 0x8f0]
mov ecx, dword [eax + 0x1c]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edx, dword [ebp - 0x8f0]
cmp dword [edx + 0x134], 0
je 0x414dd6
mov eax, dword [ebp - 0x8f0]
mov ecx, dword [eax + 0x134]
mov dword [ebp - 0x96c], ecx
jmp 0x414de5
mov edx, dword [ebp - 0x8f0]
mov eax, dword [edx + 0x1c]
mov dword [ebp - 0x96c], eax
push 1
push 0
mov ecx, dword [ebp - 0x96c]
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
mov edx, dword [ebp - 0x8f0]
mov ax, word [edx + 0x26]
and ax, 0xfeff
mov ecx, dword [ebp - 0x8f0]
mov word [ecx + 0x26], ax
jmp 0x41505d
push 0
push 0
push 0x68
mov edx, dword [ebp - 0x8f0]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x8f0]
call dword [eax + 8]
mov ecx, dword [ebp - 0x8f0]
xor edx, edx
mov dx, word [ecx + 0x26]
and edx, 0x2000
test edx, edx
je 0x414e47
mov dword [ebp - 8], 0
push 0x17
mov ecx, dword [ebp - 0x8f0]
call fcn.0041ae20
test eax, eax
jne 0x414e5f
mov dword [ebp - 8], 0
cmp dword [ebp - 0x14], 0xa1
jne 0x414e6d
jmp 0x41505d
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x8f0]
mov edx, dword [eax + 0x28]
sub edx, dword [ecx + 0x28]
mov dword [ebp - 0x214], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x8f0]
mov edx, dword [eax + 0x2c]
sub edx, dword [ecx + 0x2c]
mov dword [ebp - 0x210], edx
mov ecx, dword [ebp - 0x8f0]
call fcn.004119d0
mov dword [ebp - 0xc], eax
jmp 0x414eb2
mov ecx, dword [ebp - 0xc]
call fcn.0040b590
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x414f75
lea eax, [ebp - 0x214]
push eax
mov ecx, dword [ebp - 0xc]
add ecx, 0x28
call fcn.0041a370
test eax, eax
je 0x414f70
mov ecx, dword [ebp - 0xc]
xor edx, edx
mov dx, word [ecx + 0x20]
and edx, 0x400
test edx, edx
je 0x414eff
mov eax, dword [ebp - 0x8f0]
xor ecx, ecx
mov cx, word [eax + 0x26]
and ecx, 0x2000
test ecx, ecx
je 0x414f70
mov esi, dword [ebp + 8]
mov ecx, 0xe
lea edi, [ebp - 0x24c]
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x1c]
mov dword [ebp - 0x240], eax
mov ecx, dword [ebp - 0x214]
mov dword [ebp - 0x224], ecx
mov edx, dword [ebp - 0x210]
mov dword [ebp - 0x220], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x2c]
shl ecx, 0x10
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x28]
or eax, ecx
mov ecx, dword [ebp - 0x234]
sub ecx, eax
mov dword [ebp - 0x234], ecx
lea edx, [ebp - 0x24c]
push edx
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
mov ecx, dword [ebp - 0xc]
call dword [edx + 0x10]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 1
jmp 0x414f75
jmp 0x414ea7
jmp 0x41505d
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x8f0]
call fcn.0042f7f7
mov dword [ebp - 4], eax
jmp 0x41505d
mov dword [ebp - 8], 0
jmp 0x41505d
mov ecx, dword [ebp - 0x8f0]
xor edx, edx
mov dx, word [ecx + 0x22]
and edx, 0x4000
test edx, edx
je 0x41504b
mov eax, dword [ebp - 0x8f0]
cmp dword [eax + 0x48], 0
jne 0x41504b
mov ecx, dword [ebp - 0x8f0]
cmp dword [ecx + 0x134], 0
je 0x414fe7
mov edx, dword [ebp - 0x8f0]
mov eax, dword [edx + 0x1c]
mov dword [ebp - 0x970], eax
jmp 0x414ff1
mov dword [ebp - 0x970], 0
mov ecx, dword [ebp - 0x8f0]
cmp dword [ecx + 0x134], 0
je 0x415014
mov edx, dword [ebp - 0x8f0]
mov eax, dword [edx + 0x134]
mov dword [ebp - 0x974], eax
jmp 0x415023
mov ecx, dword [ebp - 0x8f0]
mov edx, dword [ecx + 0x1c]
mov dword [ebp - 0x974], edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x10]
push eax
mov ecx, dword [ebp - 0x970]
push ecx
mov edx, dword [ebp - 0x974]
push edx
call dword [sym.imp.USER32.dll_DefFrameProcA]
mov dword [ebp - 4], eax
jmp 0x41505d
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x8f0]
call fcn.0042f7f7
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0
jne 0x418989
push 1
push 0x3ef
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x8f0]
call fcn.0041ae90
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
mov dword [ebp - 0x978], edx
cmp dword [ebp - 0x978], 0xffffffec
jg 0x415170
cmp dword [ebp - 0x978], 0xffffffec
je 0x4154e2
cmp dword [ebp - 0x978], 0xfffffe70
jg 0x4150f2
cmp dword [ebp - 0x978], 0xfffffe70
je 0x417777
mov eax, dword [ebp - 0x978]
add eax, 0x20d
mov dword [ebp - 0x978], eax
cmp dword [ebp - 0x978], 0x7c
ja case.0x41525c.6
mov edx, dword [ebp - 0x978]
xor ecx, ecx
mov cl, byte [edx + 0x418b24]
jmp dword [ecx*4 + 0x418b04]
cmp dword [ebp - 0x978], 0xffffff37
jg 0x415141
cmp dword [ebp - 0x978], 0xffffff37
je 0x41635d
mov eax, dword [ebp - 0x978]
add eax, 0x12d
mov dword [ebp - 0x978], eax
cmp dword [ebp - 0x978], 0x63
ja case.0x41525c.6
mov edx, dword [ebp - 0x978]
xor ecx, ecx
mov cl, byte [edx + 0x418bb1]
jmp dword [ecx*4 + 0x418ba1]
cmp dword [ebp - 0x978], 0xffffff38
je case.0x41513a.2
cmp dword [ebp - 0x978], 0xffffffe6
je 0x4161c8
cmp dword [ebp - 0x978], 0xffffffe7
je 0x417700
jmp case.0x41525c.6
cmp dword [ebp - 0x978], 0x3f1
jg 0x41522f
cmp dword [ebp - 0x978], 0x3f1
je 0x417aea
cmp dword [ebp - 0x978], 0xfffffff7
jg 0x4151cf
cmp dword [ebp - 0x978], 0xfffffff7
je 0x415263
mov eax, dword [ebp - 0x978]
add eax, 0x11
mov dword [ebp - 0x978], eax
cmp dword [ebp - 0x978], 7
ja case.0x41525c.6
mov ecx, dword [ebp - 0x978]
jmp dword [ecx*4 + 0x418c15]
cmp dword [ebp - 0x978], 0x3ea
jg 0x41520a
cmp dword [ebp - 0x978], 0x3ea
je 0x418818
cmp dword [ebp - 0x978], 0xfffffffb
jl case.0x41525c.6
cmp dword [ebp - 0x978], 0xfffffffc
jle 0x417700
jmp case.0x41525c.6
cmp dword [ebp - 0x978], 0x3ec
jl case.0x41525c.6
cmp dword [ebp - 0x978], 0x3ed
jle case.0x41525c.5
jmp case.0x41525c.6
mov edx, dword [ebp - 0x978]
sub edx, 0x41a
mov dword [ebp - 0x978], edx
cmp dword [ebp - 0x978], 0x69
ja case.0x41525c.6
mov ecx, dword [ebp - 0x978]
xor eax, eax
mov al, byte [ecx + 0x418c51]
jmp dword [eax*4 + 0x418c35]
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x8f0]
call fcn.0042f7f7
mov eax, dword [ebp - 0x8f0]
cmp dword [eax + 0x1c], 0
je 0x4152be
mov ecx, dword [ebp - 0x8f0]
cmp dword [ecx + 0x48], 0
jne 0x4152be
mov edx, dword [ebp - 0x8f0]
mov eax, dword [edx + 0x130]
neg eax
sbb eax, eax
and eax, 0x80000000
add eax, 0x80000000
mov ecx, dword [ebp - 0x8f0]
mov edx, dword [ecx + 0xb0]
or edx, eax
mov eax, dword [ebp - 0x8f0]
mov dword [eax + 0xb0], edx
mov ecx, dword [ebp - 0x8f0]
add ecx, 0xd0
call fcn.0040b590
mov dword [ebp - 0xc], eax
jmp 0x4152df
mov ecx, dword [ebp - 0xc]
call fcn.0040b590
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4152f6
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xc]
call dword [eax + 0x10]
jmp 0x4152d4
mov ecx, dword [ebp - 0x8f0]
call fcn.004119d0
mov dword [ebp - 0xc], eax
jmp 0x415311
mov ecx, dword [ebp - 0xc]
call fcn.0040b590
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x41549d
mov ecx, dword [ebp - 0xc]
xor edx, edx
mov dx, word [ecx + 0x26]
and edx, 2
test edx, edx
jne 0x415369
mov eax, dword [ebp - 0x8f0]
cmp dword [eax + 0xc8], 0
jne 0x415476
mov ecx, dword [ebp - 0xc]
xor edx, edx
mov dx, word [ecx + 0x20]
and edx, 0x400
test edx, edx
jne 0x415476
mov eax, dword [ebp - 0xc]
xor ecx, ecx
mov cx, word [eax + 0x22]
and ecx, 2
test ecx, ecx
jne 0x415476
mov edx, dword [ebp - 0x8f0]
cmp dword [edx + 0xc8], 0
je 0x4153a3
mov ecx, dword [ebp - 0x8f0]
call fcn.004233b0
add eax, 0x26
mov dword [ebp - 0x97c], eax
mov eax, dword [ebp - 0x97c]
mov cx, word [eax]
and cx, 0xfffd
mov edx, dword [ebp - 0x97c]
mov word [edx], cx
mov eax, dword [ebp - 0x8f0]
cmp dword [eax + 0xc8], 0
je 0x415408
mov ecx, dword [ebp - 0x8f0]
xor edx, edx
mov dx, word [ecx + 0xcc]
and edx, 0x20
test edx, edx
je 0x415408
mov eax, dword [ebp - 0x8f0]
xor ecx, ecx
mov cx, word [eax + 0xcc]
and ecx, 2
test ecx, ecx
jne 0x415408
mov ecx, dword [ebp - 0x8f0]
call fcn.004233b0
add eax, 0x26
mov dword [ebp - 0x980], eax
mov edx, dword [ebp - 0x980]
mov ax, word [edx]
and ax, 0xfff7
mov ecx, dword [ebp - 0x980]
mov word [ecx], ax
mov edx, dword [ebp - 0x8f0]
mov eax, dword [ebp - 0xc]
mov dword [edx + 0xc8], eax
mov ecx, dword [ebp - 0x8f0]
xor edx, edx
mov dx, word [ecx + 0x26]
and edx, 2
mov eax, dword [ebp - 0xc]
mov cx, word [eax + 0x26]
or cx, dx
mov edx, dword [ebp - 0xc]
mov word [edx + 0x26], cx
mov eax, dword [ebp - 0x8f0]
xor ecx, ecx
mov cx, word [eax + 0xcc]
and ecx, 0x20
test ecx, ecx
je 0x415474
mov edx, dword [ebp - 0x8f0]
xor eax, eax
mov ax, word [edx + 0xcc]
and eax, 2
test eax, eax
jne 0x415474
mov ecx, dword [ebp - 0xc]
mov dx, word [ecx + 0x26]
or dl, 8
mov eax, dword [ebp - 0xc]
mov word [eax + 0x26], dx
jmp 0x415489
mov ecx, dword [ebp - 0xc]
mov dx, word [ecx + 0x26]
and dx, 0xfffd
mov eax, dword [ebp - 0xc]
mov word [eax + 0x26], dx
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xc]
call dword [eax + 0x10]
jmp 0x415306
mov ecx, dword [ebp - 0x8f0]
cmp dword [ecx + 0x48], 0
jne 0x4154dd
mov edx, dword [ebp - 0x8f0]
mov eax, dword [edx + 0x130]
neg eax
sbb eax, eax
and eax, 0x80000000
add eax, 0x80000000
mov ecx, dword [ebp - 0x8f0]
mov edx, dword [ecx + 0xb0]
or edx, eax
mov eax, dword [ebp - 0x8f0]
mov dword [eax + 0xb0], edx
jmp 0x418989
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x8f0]
call fcn.0042f7f7
mov edx, dword [ebp - 0x8f0]
xor eax, eax
mov ax, word [edx + 0x26]
and eax, 0xc0
test eax, eax
je 0x415559
mov ecx, dword [ebp - 0x8f0]
add ecx, 0x144
mov edx, dword [ebp - 0x8f0]
add edx, 0x28
mov eax, dword [ecx]
mov dword [edx], eax
mov eax, dword [ecx + 4]
mov dword [edx + 4], eax
mov eax, dword [ecx + 8]
mov dword [edx + 8], eax
mov ecx, dword [ecx + 0xc]
mov dword [edx + 0xc], ecx
mov edx, dword [ebp - 0x8f0]
add edx, 0x28
mov eax, dword [ebp - 0x8f0]
add eax, 0x38
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [edx + 4]
mov dword [eax + 4], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov edx, dword [edx + 0xc]
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 0x8f0]
mov dword [eax + 0x138], 0
mov ecx, dword [ebp - 0x8f0]
mov dword [ecx + 0x13c], 0
mov edx, dword [ebp - 0x8f0]
mov dword [edx + 0x130], 0
mov ecx, dword [ebp - 0x8f0]
add ecx, 0xd0
call fcn.0040b590
mov dword [ebp - 0xc], eax
jmp 0x4155aa
mov ecx, dword [ebp - 0xc]
call fcn.0040b590
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4155c1
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xc]
call dword [edx + 0x10]
jmp 0x41559f
mov ecx, dword [ebp - 0x8f0]
call fcn.004119d0
mov dword [ebp - 0xc], eax
jmp 0x4155dc
mov ecx, dword [ebp - 0xc]
call fcn.0040b590
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4155f3
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xc]
call dword [edx + 0x10]
jmp 0x4155d1
jmp 0x418989
mov byte [ebp - 0x25c], 0x43
mov byte [ebp - 0x25b], 0x4c
mov byte [ebp - 0x25a], 0x49
mov byte [ebp - 0x259], 0x45
mov byte [ebp - 0x258], 0x4e
mov byte [ebp - 0x257], 0x54
mov byte [ebp - 0x256], 0
mov byte [ebp - 0x254], 0
mov ecx, dword [ebp - 0x8f0]
add ecx, 0xf4
mov eax, dword [ebp - 0x8f0]
mov edx, dword [eax + 0xf4]
call dword [edx + 4]
mov eax, dword [ebp - 0x8f0]
cmp dword [eax + 0x48], 0
je 0x415671
mov ecx, dword [ebp - 0x8f0]
xor edx, edx
mov dx, word [ecx + 0x22]
and edx, 0x4000
test edx, edx
je 0x415709
mov eax, dword [0x452434]
mov ecx, dword [eax + 0x18]
imul ecx, ecx, 0xa
mov dword [ebp - 0x260], ecx
mov ecx, dword [ebp - 0x8f0]
add ecx, 0x38
call fcn.0041a3d0
cmp eax, dword [ebp - 0x260]
jge 0x4156b4
mov edx, dword [ebp - 0x8f0]
mov eax, dword [edx + 0x38]
mov ecx, dword [ebp - 0x260]
lea edx, [eax + ecx - 1]
mov eax, dword [ebp - 0x8f0]
mov dword [eax + 0x40], edx
mov ecx, dword [0x452434]
mov edx, dword [ecx + 0x1c]
mov dword [ebp - 0x264], edx
mov eax, dword [0x44dc94]
mov ecx, dword [ebp - 0x264]
lea edx, [ecx + eax*2]
mov dword [ebp - 0x264], edx
mov ecx, dword [ebp - 0x8f0]
add ecx, 0x38
call fcn.0041a350
cmp eax, dword [ebp - 0x264]
jge 0x415709
mov eax, dword [ebp - 0x8f0]
mov ecx, dword [eax + 0x3c]
mov edx, dword [ebp - 0x264]
lea eax, [ecx + edx - 1]
mov ecx, dword [ebp - 0x8f0]
mov dword [ecx + 0x44], eax
mov edx, dword [ebp - 0x8f0]
mov eax, dword [edx + 0xb0]
and eax, 0x300000
mov dword [ebp - 0x250], eax
mov ecx, dword [ebp - 0x8f0]
mov edx, dword [ecx + 0xb0]
and edx, 0xffcfffff
mov eax, dword [ebp - 0x8f0]
mov dword [eax + 0xb0], edx
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x8f0]
call fcn.0042f7f7
mov edx, dword [ebp - 0x8f0]
xor eax, eax
mov ax, word [edx + 0x26]
and eax, 0x40
test eax, eax
je 0x4157ab
mov ecx, dword [ebp - 0x8f0]
mov edx, dword [ecx + 0xb0]
or edx, 0x1000000
mov eax, dword [ebp - 0x8f0]
mov dword [eax + 0xb0], edx
mov ecx, dword [ebp - 0x8f0]
add ecx, 0x38
mov edx, dword [ebp - 0x8f0]
add edx, 0x144
mov eax, dword [ecx]
mov dword [edx], eax
mov eax, dword [ecx + 4]
mov dword [edx + 4], eax
mov eax, dword [ecx + 8]
mov dword [edx + 8], eax
mov ecx, dword [ecx + 0xc]
mov dword [edx + 0xc], ecx
jmp 0x415809
mov edx, dword [ebp - 0x8f0]
xor eax, eax
mov ax, word [edx + 0x26]
and eax, 0x80
test eax, eax
je 0x415809
mov ecx, dword [ebp - 0x8f0]
mov edx, dword [ecx + 0xb0]
or edx, 0x20000000
mov eax, dword [ebp - 0x8f0]
mov dword [eax + 0xb0], edx
mov ecx, dword [ebp - 0x8f0]
add ecx, 0x38
mov edx, dword [ebp - 0x8f0]
add edx, 0x144
mov eax, dword [ecx]
mov dword [edx], eax
mov eax, dword [ecx + 4]
mov dword [edx + 4], eax
mov eax, dword [ecx + 8]
mov dword [edx + 8], eax
mov ecx, dword [ecx + 0xc]
mov dword [edx + 0xc], ecx
mov edx, dword [ebp - 0x8f0]
cmp dword [edx + 0x48], 0
je 0x41585c
push 0x3e9
mov eax, dword [ebp - 0x8f0]
mov ecx, dword [eax + 0x48]
call fcn.0041ae20
test eax, eax
je 0x41585c
mov ecx, dword [ebp - 0x8f0]
push ecx
mov ecx, dword [ebp - 0x8f0]
call fcn.0040f41f
push eax
push 0x181
mov edx, dword [ebp - 0x8f0]
mov eax, dword [edx + 0x48]
mov ecx, dword [eax + 0x1c]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x415d94
mov edx, dword [ebp - 0x8f0]
cmp dword [edx + 0x48], 0
je 0x4158af
push 0x3f0
mov eax, dword [ebp - 0x8f0]
mov ecx, dword [eax + 0x48]
call fcn.0041ae20
test eax, eax
je 0x4158af
mov ecx, dword [ebp - 0x8f0]
push ecx
mov ecx, dword [ebp - 0x8f0]
call fcn.0040f41f
push eax
push 0x14a
mov edx, dword [ebp - 0x8f0]
mov eax, dword [edx + 0x48]
mov ecx, dword [eax + 0x1c]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x415d94
mov edx, dword [ebp - 0x8f0]
xor eax, eax
mov ax, word [edx + 0x22]
and eax, 0x4000
test eax, eax
je 0x4159f9
mov ecx, dword [ebp - 0x8f0]
cmp dword [ecx + 0x48], 0
jne 0x4159f9
mov edx, dword [ebp - 0x8f0]
cmp dword [edx + 0x130], 0
je 0x415912
push 0
push 0
push 0xb
mov eax, dword [ebp - 0x8f0]
mov ecx, dword [eax + 0x130]
mov edx, dword [ebp - 0x8f0]
mov eax, dword [edx + 0x130]
mov edx, dword [eax]
call dword [edx + 8]
mov dword [ebp - 0x984], eax
jmp 0x41591c
mov dword [ebp - 0x984], 0
mov eax, dword [ebp - 0x8f0]
mov ecx, dword [eax + 0x138]
push ecx
mov edx, dword [ebp - 0x984]
push edx
push 0x452564
push 0
push 0x44e288
mov ecx, dword [ebp - 0x8f0]
call fcn.00432a28
mov dword [ebp - 0x26c], 0
mov dword [ebp - 0x268], 0x1000
mov eax, dword [ebp - 0x8f0]
mov cx, word [eax + 0xcc]
or ch, 1
mov edx, dword [ebp - 0x8f0]
mov word [edx + 0xcc], cx
mov eax, dword [ebp - 0x8f0]
mov ecx, dword [eax + 0xb0]
and ecx, 9
or ecx, 0x50000000
or ecx, dword [ebp - 0x250]
mov dword [ebp - 0x270], ecx
mov edx, dword [ebp - 0x8f0]
mov eax, dword [ebp - 0x8f0]
mov ecx, dword [eax + 0x1c]
mov dword [edx + 0x134], ecx
lea edx, [ebp - 0x26c]
push edx
mov eax, dword [0x452434]
mov ecx, dword [eax + 0x40]
push ecx
push 0
mov edx, dword [ebp - 0x8f0]
mov eax, dword [edx + 0x134]
push eax
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 0x270]
push ecx
push 0
push str.MDICLIENT
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov edx, dword [ebp - 0x8f0]
mov dword [edx + 0x1c], eax
jmp 0x415d94
mov eax, dword [ebp - 0x8f0]
xor ecx, ecx
mov cx, word [eax + 0x22]
and ecx, 0x4000
test ecx, ecx
je 0x415bee
mov edx, dword [ebp - 0x8f0]
mov ax, word [edx + 0x26]
or ah, 8
mov ecx, dword [ebp - 0x8f0]
mov word [ecx + 0x26], ax
mov edx, dword [ebp - 0x8f0]
cmp dword [edx + 0x130], 0
je 0x415a64
push 0
push 0
push 0xb
mov eax, dword [ebp - 0x8f0]
mov ecx, dword [eax + 0x130]
mov edx, dword [ebp - 0x8f0]
mov eax, dword [edx + 0x130]
mov edx, dword [eax]
call dword [edx + 8]
mov dword [ebp - 0x988], eax
jmp 0x415a6e
mov dword [ebp - 0x988], 0
mov eax, dword [ebp - 0x8f0]
mov ecx, dword [eax + 0x138]
push ecx
mov edx, dword [ebp - 0x988]
push edx
push 0x452568
push 0
push 0x44e2a4
mov ecx, dword [ebp - 0x8f0]
call fcn.00432a28
mov eax, dword [ebp - 0x8f0]
mov cx, word [eax + 0x26]
and cx, 0xf7ff
mov edx, dword [ebp - 0x8f0]
mov word [edx + 0x26], cx
cmp dword [0x45256c], 0
jne 0x415b49
mov dword [ebp - 0x298], 0
mov dword [ebp - 0x294], 0x4128b9
mov dword [ebp - 0x290], 0
mov dword [ebp - 0x28c], 4
mov eax, dword [0x452434]
mov ecx, dword [eax + 0x40]
mov dword [ebp - 0x288], ecx
mov dword [ebp - 0x284], 0
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [ebp - 0x280], eax
mov dword [ebp - 0x27c], 6
mov dword [ebp - 0x278], 0
lea edx, [ebp - 0x25c]
mov dword [ebp - 0x274], edx
lea eax, [ebp - 0x298]
push eax
call dword [sym.imp.USER32.dll_RegisterClassA]
mov dword [0x45256c], 1
mov ecx, dword [ebp - 0x8f0]
mov dword [0x45255c], ecx
mov edx, dword [ebp - 0x8f0]
mov eax, dword [ebp - 0x8f0]
mov ecx, dword [eax + 0x1c]
mov dword [edx + 0x134], ecx
push 0
mov edx, dword [0x452434]
mov eax, dword [edx + 0x40]
push eax
push 0
mov ecx, dword [ebp - 0x8f0]
mov edx, dword [ecx + 0x134]
push edx
mov ecx, dword [ebp - 0x8f0]
add ecx, 0x28
call fcn.0041a350
push eax
mov ecx, dword [ebp - 0x8f0]
add ecx, 0x28
call fcn.0041a3d0
push eax
mov eax, dword [ebp - 0x8f0]
mov ecx, dword [eax + 0x2c]
push ecx
mov edx, dword [ebp - 0x8f0]
mov eax, dword [edx + 0x28]
push eax
mov ecx, dword [ebp - 0x250]
or ecx, 0x10000000
or ecx, 0x40000000
push ecx
lea edx, [ebp - 0x254]
push edx
lea eax, [ebp - 0x25c]
push eax
push 4
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov ecx, dword [ebp - 0x8f0]
mov dword [ecx + 0x1c], eax
jmp 0x415d94
mov edx, dword [ebp - 0x8f0]
cmp dword [edx + 0x130], 0
je 0x415c28
push 0
push 0
push 0xb
mov eax, dword [ebp - 0x8f0]
mov ecx, dword [eax + 0x130]
mov edx, dword [ebp - 0x8f0]
mov eax, dword [edx + 0x130]
mov edx, dword [eax]
call dword [edx + 8]
mov dword [ebp - 0x98c], eax
jmp 0x415c32
mov dword [ebp - 0x98c], 0
mov eax, dword [ebp - 0x8f0]
mov ecx, dword [eax + 0x138]
push ecx
mov edx, dword [ebp - 0x98c]
push edx
push 0x452560
push 0
push 0x44e2b4
mov ecx, dword [ebp - 0x8f0]
call fcn.00432a28
cmp dword [0x45256c], 0
jne 0x415cf4
mov dword [ebp - 0x2c0], 3
mov dword [ebp - 0x2bc], 0x4128b9
mov dword [ebp - 0x2b8], 0
mov dword [ebp - 0x2b4], 4
mov eax, dword [0x452434]
mov ecx, dword [eax + 0x40]
mov dword [ebp - 0x2b0], ecx
mov dword [ebp - 0x2ac], 0
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [ebp - 0x2a8], eax
mov dword [ebp - 0x2a4], 6
mov dword [ebp - 0x2a0], 0
lea edx, [ebp - 0x25c]
mov dword [ebp - 0x29c], edx
lea eax, [ebp - 0x2c0]
push eax
call dword [sym.imp.USER32.dll_RegisterClassA]
mov dword [0x45256c], 1
mov ecx, dword [ebp - 0x8f0]
mov dword [0x45255c], ecx
mov edx, dword [ebp - 0x8f0]
mov eax, dword [ebp - 0x8f0]
mov ecx, dword [eax + 0x1c]
mov dword [edx + 0x134], ecx
push 0
mov edx, dword [0x452434]
mov eax, dword [edx + 0x40]
push eax
push 0
mov ecx, dword [ebp - 0x8f0]
mov edx, dword [ecx + 0x134]
push edx
mov ecx, dword [ebp - 0x8f0]
add ecx, 0x28
call fcn.0041a350
push eax
mov ecx, dword [ebp - 0x8f0]
add ecx, 0x28
call fcn.0041a3d0
push eax
mov eax, dword [ebp - 0x8f0]
mov ecx, dword [eax + 0x2c]
push ecx
mov edx, dword [ebp - 0x8f0]
mov eax, dword [edx + 0x28]
push eax
mov ecx, dword [ebp - 0x250]
or ecx, 0x10000000
or ecx, 0x40000000
push ecx
lea edx, [ebp - 0x254]
push edx
lea eax, [ebp - 0x25c]
push eax
push 4
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov ecx, dword [ebp - 0x8f0]
mov dword [ecx + 0x1c], eax
mov ecx, dword [ebp - 0x8f0]
add ecx, 0xd0
call fcn.0040b590
mov dword [ebp - 0xc], eax
jmp 0x415db5
mov ecx, dword [ebp - 0xc]
call fcn.0040b590
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x415e37
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
mov ecx, dword [ebp - 0xc]
call dword [edx + 0x10]
mov eax, dword [ebp - 0xc]
xor ecx, ecx
mov cx, word [eax + 0x26]
and ecx, 0x400
test ecx, ecx
je 0x415e32
mov edx, dword [ebp - 0xc]
xor eax, eax
mov ax, word [edx + 0x20]
and eax, 0x200
test eax, eax
je 0x415e32
push 0x839
mov ecx, dword [ebp - 0xc]
call fcn.0041ae20
test eax, eax
jne 0x415e32
mov ecx, dword [ebp - 0x8f0]
xor edx, edx
cmp dword [ecx + 0x48], 0
sete dl
push edx
mov eax, dword [ebp - 0xc]
add eax, 0x28
push eax
mov ecx, dword [ebp - 0x8f0]
mov edx, dword [ecx + 0x1c]
push edx
mov ecx, dword [ebp - 0x8f0]
add ecx, 0xf4
call fcn.0042b840
jmp 0x415daa
mov eax, dword [ebp - 0x8f0]
cmp dword [eax + 0x134], 0
je 0x415fa8
mov ecx, dword [ebp - 0x8f0]
mov edx, dword [ebp - 0x8f0]
mov eax, dword [ecx + 0x1c]
cmp eax, dword [edx + 0x134]
je 0x415fa8
mov ecx, dword [ebp - 0x8f0]
add ecx, 0xf4
call fcn.0040b590
test eax, eax
je 0x415fa8
mov ecx, dword [ebp - 0x8f0]
add ecx, 0xf4
call fcn.0040b590
add eax, 0x10
mov ecx, dword [eax]
mov dword [ebp - 0x2d0], ecx
mov edx, dword [eax + 4]
mov dword [ebp - 0x2cc], edx
mov ecx, dword [eax + 8]
mov dword [ebp - 0x2c8], ecx
mov edx, dword [eax + 0xc]
mov dword [ebp - 0x2c4], edx
push 0
lea ecx, [ebp - 0x2d0]
call fcn.0041a350
push eax
lea ecx, [ebp - 0x2d0]
call fcn.0041a3d0
push eax
mov eax, dword [ebp - 0x2cc]
push eax
mov ecx, dword [ebp - 0x2d0]
push ecx
mov edx, dword [ebp - 0x8f0]
mov eax, dword [edx + 0x1c]
push eax
call dword [sym.imp.USER32.dll_MoveWindow]
mov ecx, dword [ebp - 0x8f0]
add ecx, 0xf4
mov edx, dword [ebp - 0x8f0]
mov eax, dword [edx + 0xf4]
call dword [eax + 4]
lea ecx, [ebp - 0x2d0]
call fcn.0041a3d0
sub eax, 1
mov dword [ebp - 0x2c8], eax
mov dword [ebp - 0x2d0], 0
lea ecx, [ebp - 0x2d0]
call fcn.0041a350
sub eax, 1
mov dword [ebp - 0x2c4], eax
mov dword [ebp - 0x2cc], 0
push 0x20
call fcn.00403197
add esp, 4
mov dword [ebp - 0x6a0], eax
cmp dword [ebp - 0x6a0], 0
je 0x415f81
lea ecx, [ebp - 0x2d0]
push ecx
mov edx, dword [ebp - 0x8f0]
mov eax, dword [edx + 0x1c]
push eax
mov ecx, dword [ebp - 0x6a0]
call fcn.0042b740
mov dword [ebp - 0x990], eax
jmp 0x415f8b
mov dword [ebp - 0x990], 0
mov ecx, dword [ebp - 0x990]
push ecx
mov ecx, dword [ebp - 0x8f0]
add ecx, 0xf4
call fcn.0040f4c6
jmp 0x416099
mov edx, dword [ebp - 0x8f0]
cmp dword [edx + 0x134], 0
je 0x416099
mov eax, dword [ebp - 0x8f0]
mov ecx, dword [ebp - 0x8f0]
mov edx, dword [eax + 0x1c]
cmp edx, dword [ecx + 0x134]
je 0x416099
lea eax, [ebp - 0x2e0]
push eax
mov ecx, dword [ebp - 0x8f0]
mov edx, dword [ecx + 0x134]
push edx
call dword [sym.imp.USER32.dll_GetClientRect]
lea eax, [ebp - 0x2e0]
push eax
lea ecx, [ebp - 0x2f0]
call fcn.00411980
push 0
lea ecx, [ebp - 0x2f0]
call fcn.0041a350
push eax
lea ecx, [ebp - 0x2f0]
call fcn.0041a3d0
push eax
mov ecx, dword [ebp - 0x2ec]
push ecx
mov edx, dword [ebp - 0x2f0]
push edx
mov eax, dword [ebp - 0x8f0]
mov ecx, dword [eax + 0x1c]
push ecx
call dword [sym.imp.USER32.dll_MoveWindow]
push 0x20
call fcn.00403197
add esp, 4
mov dword [ebp - 0x6a4], eax
cmp dword [ebp - 0x6a4], 0
je 0x416077
lea edx, [ebp - 0x2f0]
push edx
mov eax, dword [ebp - 0x8f0]
mov ecx, dword [eax + 0x1c]
push ecx
mov ecx, dword [ebp - 0x6a4]
call fcn.0042b740
mov dword [ebp - 0x994], eax
jmp 0x416081
mov dword [ebp - 0x994], 0
mov edx, dword [ebp - 0x994]
push edx
mov ecx, dword [ebp - 0x8f0]
add ecx, 0xf4
call fcn.0040f4c6
mov ecx, dword [ebp - 0x8f0]
call fcn.004119d0
mov dword [ebp - 0xc], eax
jmp 0x4160b4
mov ecx, dword [ebp - 0xc]
call fcn.0040b590
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x416110
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xc]
call dword [edx + 0x10]
mov eax, dword [ebp - 0xc]
xor ecx, ecx
mov cx, word [eax + 0x20]
and ecx, 0x200
test ecx, ecx
je 0x41610e
mov edx, dword [ebp - 0x8f0]
xor eax, eax
cmp dword [edx + 0x48], 0
sete al
push eax
mov ecx, dword [ebp - 0xc]
add ecx, 0x28
push ecx
mov edx, dword [ebp - 0x8f0]
mov eax, dword [edx + 0x1c]
push eax
mov ecx, dword [ebp - 0x8f0]
add ecx, 0xf4
call fcn.0042b840
jmp 0x4160a9
mov ecx, dword [ebp - 0x8f0]
add ecx, 0xf4
call fcn.0040b590
test eax, eax
jne 0x416187
push 0x20
call fcn.00403197
add esp, 4
mov dword [ebp - 0x6a8], eax
cmp dword [ebp - 0x6a8], 0
je 0x416165
mov ecx, dword [ebp - 0x8f0]
add ecx, 0x28
push ecx
mov edx, dword [ebp - 0x8f0]
mov eax, dword [edx + 0x1c]
push eax
mov ecx, dword [ebp - 0x6a8]
call fcn.0042b740
mov dword [ebp - 0x998], eax
jmp 0x41616f
mov dword [ebp - 0x998], 0
mov ecx, dword [ebp - 0x998]
push ecx
mov ecx, dword [ebp - 0x8f0]
add ecx, 0xf4
call fcn.0040f4c6
mov edx, dword [ebp - 0x8f0]
xor eax, eax
mov ax, word [edx + 0xcc]
and eax, 0x100
test eax, eax
jne 0x4161c3
push 0
push 0xfffffecc
lea ecx, [ebp - 0x6e0]
call fcn.0040abe5
push eax
mov ecx, dword [ebp - 0x8f0]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x8f0]
call dword [edx + 0x28]
jmp 0x418989
mov eax, dword [ebp - 0x8f0]
xor ecx, ecx
mov cx, word [eax + 0x22]
and ecx, 0x4000
test ecx, ecx
je 0x416262
mov edx, dword [ebp - 0x8f0]
cmp dword [edx + 0x48], 0
jne 0x416262
mov eax, dword [ebp - 0x8f0]
cmp dword [eax + 0x130], 0
je 0x416228
push 0
push 0
push 0xb
mov ecx, dword [ebp - 0x8f0]
mov ecx, dword [ecx + 0x130]
mov edx, dword [ebp - 0x8f0]
mov eax, dword [edx + 0x130]
mov edx, dword [eax]
call dword [edx + 8]
mov dword [ebp - 0x99c], eax
jmp 0x416232
mov dword [ebp - 0x99c], 0
mov eax, dword [ebp - 0x8f0]
mov ecx, dword [eax + 0x138]
push ecx
mov edx, dword [ebp - 0x99c]
push edx
push 0x452564
push 0
push str.UIW_MDIFRAME
mov ecx, dword [ebp - 0x8f0]
call fcn.00432a28
jmp 0x416358
mov eax, dword [ebp - 0x8f0]
xor ecx, ecx
mov cx, word [eax + 0x22]
and ecx, 0x4000
test ecx, ecx
je 0x4162e9
mov edx, dword [ebp - 0x8f0]
cmp dword [edx + 0x130], 0
je 0x4162b2
push 0
push 0
push 0xb
mov eax, dword [ebp - 0x8f0]
mov ecx, dword [eax + 0x130]
mov edx, dword [ebp - 0x8f0]
mov eax, dword [edx + 0x130]
mov edx, dword [eax]
call dword [edx + 8]
mov dword [ebp - 0x9a0], eax
jmp 0x4162bc
mov dword [ebp - 0x9a0], 0
mov eax, dword [ebp - 0x8f0]
mov ecx, dword [eax + 0x138]
push ecx
mov edx, dword [ebp - 0x9a0]
push edx
push 0x452568
push 0
push 0x44e2d0
mov ecx, dword [ebp - 0x8f0]
call fcn.00432a28
jmp 0x416358
mov eax, dword [ebp - 0x8f0]
cmp dword [eax + 0x130], 0
je 0x416323
push 0
push 0
push 0xb
mov ecx, dword [ebp - 0x8f0]
mov ecx, dword [ecx + 0x130]
mov edx, dword [ebp - 0x8f0]
mov eax, dword [edx + 0x130]
mov edx, dword [eax]
call dword [edx + 8]
mov dword [ebp - 0x9a4], eax
jmp 0x41632d
mov dword [ebp - 0x9a4], 0
mov eax, dword [ebp - 0x8f0]
mov ecx, dword [eax + 0x138]
push ecx
mov edx, dword [ebp - 0x9a4]
push edx
push 0x452560
push 0
push 0x44e2e0
mov ecx, dword [ebp - 0x8f0]
call fcn.00432a28
jmp 0x418989
mov eax, dword [ebp - 0x8f0]
cmp dword [eax + 0x1c], 0
je 0x41637f
mov ecx, dword [ebp - 0x8f0]
xor edx, edx
mov dx, word [ecx + 0x26]
and edx, 0x4000
test edx, edx
je 0x416384
jmp 0x418989
mov eax, dword [ebp - 0x8f0]
cmp dword [eax + 0x48], 0
je 0x4164b0
mov ecx, dword [ebp - 0x8f0]
xor edx, edx
mov dx, word [ecx + 0x22]
and edx, 0x4000
test edx, edx
jne 0x4164b0
mov eax, dword [ebp - 0x8f0]
add eax, 0x28
mov ecx, dword [eax]
mov dword [ebp - 0x320], ecx
mov edx, dword [eax + 4]
mov dword [ebp - 0x31c], edx
mov ecx, dword [eax + 8]
mov dword [ebp - 0x318], ecx
mov edx, dword [eax + 0xc]
mov dword [ebp - 0x314], edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x8f0]
call fcn.0042f7f7
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x320]
push ecx
mov ecx, dword [ebp - 0x8f0]
add ecx, 0x28
call fcn.0041a3f0
test eax, eax
je 0x4164ae
mov edx, dword [ebp - 0x8f0]
cmp dword [edx + 0x134], 0
je 0x41642c
mov eax, dword [ebp - 0x8f0]
mov ecx, dword [eax + 0x134]
mov dword [ebp - 0x9a8], ecx
jmp 0x41643b
mov edx, dword [ebp - 0x8f0]
mov eax, dword [edx + 0x1c]
mov dword [ebp - 0x9a8], eax
mov ecx, dword [ebp - 0x9a8]
mov dword [ebp - 0x324], ecx
push 0
push 0
push 0xb
mov edx, dword [ebp - 0x324]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
mov ecx, dword [ebp - 0x8f0]
add ecx, 0x28
call fcn.0041a350
push eax
mov ecx, dword [ebp - 0x8f0]
add ecx, 0x28
call fcn.0041a3d0
push eax
mov eax, dword [ebp - 0x8f0]
mov ecx, dword [eax + 0x2c]
push ecx
mov edx, dword [ebp - 0x8f0]
mov eax, dword [edx + 0x28]
push eax
mov ecx, dword [ebp - 0x324]
push ecx
call dword [sym.imp.USER32.dll_MoveWindow]
push 0
push 1
push 0xb
mov edx, dword [ebp - 0x324]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x4164b7
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x8f0]
add ecx, 0xf4
mov eax, dword [ebp - 0x8f0]
mov edx, dword [eax + 0xf4]
call dword [edx + 4]
mov eax, dword [ebp - 0x8f0]
cmp dword [eax + 0x134], 0
je 0x4164f5
mov ecx, dword [ebp - 0x8f0]
mov edx, dword [ecx + 0x134]
mov dword [ebp - 0x9ac], edx
jmp 0x416504
mov eax, dword [ebp - 0x8f0]
mov ecx, dword [eax + 0x1c]
mov dword [ebp - 0x9ac], ecx
lea edx, [ebp - 0x300]
push edx
mov eax, dword [ebp - 0x9ac]
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
lea ecx, [ebp - 0x300]
push ecx
lea ecx, [ebp - 0x310]
call fcn.00411980
push 0x20
call fcn.00403197
add esp, 4
mov dword [ebp - 0x6e4], eax
cmp dword [ebp - 0x6e4], 0
je 0x416567
lea edx, [ebp - 0x310]
push edx
mov eax, dword [ebp - 0x8f0]
mov ecx, dword [eax + 0x1c]
push ecx
mov ecx, dword [ebp - 0x6e4]
call fcn.0042b740
mov dword [ebp - 0x9b0], eax
jmp 0x416571
mov dword [ebp - 0x9b0], 0
mov edx, dword [ebp - 0x9b0]
push edx
mov ecx, dword [ebp - 0x8f0]
add ecx, 0xf4
call fcn.0040f4c6
push 0x3e9
mov ecx, dword [ebp - 0x8f0]
call fcn.0041ae20
test eax, eax
jne 0x4170e9
mov ecx, dword [ebp - 0x8f0]
add ecx, 0xd0
call fcn.0040b590
mov dword [ebp - 0xc], eax
jmp 0x4165c2
mov ecx, dword [ebp - 0xc]
call fcn.0040b590
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4168ab
mov eax, dword [ebp - 0xc]
add eax, 0x28
mov ecx, dword [eax]
mov dword [ebp - 0x338], ecx
mov edx, dword [eax + 4]
mov dword [ebp - 0x334], edx
mov ecx, dword [eax + 8]
mov dword [ebp - 0x330], ecx
mov edx, dword [eax + 0xc]
mov dword [ebp - 0x32c], edx
push 0
push 0xffffff37
lea ecx, [ebp - 0x71c]
call fcn.0040abe5
push eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
mov ecx, dword [ebp - 0xc]
call dword [edx + 0x10]
mov eax, dword [ebp - 0x8f0]
xor ecx, ecx
mov cx, word [eax + 0x26]
and ecx, 0x80
neg ecx
sbb ecx, ecx
neg ecx
mov word [ebp - 0x328], cx
mov edx, dword [ebp - 0xc]
xor eax, eax
mov ax, word [edx + 0x26]
and eax, 0x400
test eax, eax
je 0x4167f2
mov ecx, dword [ebp - 0xc]
xor edx, edx
mov dx, word [ecx + 0x20]
and edx, 0x200
test edx, edx
je 0x4167f2
push 0x839
mov ecx, dword [ebp - 0xc]
call fcn.0041ae20
test eax, eax
jne 0x4167f2
mov eax, dword [ebp - 0x8f0]
cmp dword [eax + 0x48], 0
je 0x4166a2
mov ecx, dword [ebp - 0x8f0]
xor edx, edx
mov dx, word [ecx + 0x22]
and edx, 0x4000
test edx, edx
jne 0x4166a2
mov dword [ebp - 0x9b4], 0
jmp 0x4166ac
mov dword [ebp - 0x9b4], 1
mov eax, dword [ebp - 0x9b4]
push eax
mov ecx, dword [ebp - 0xc]
add ecx, 0x28
push ecx
mov edx, dword [ebp - 0x8f0]
mov eax, dword [edx + 0x1c]
push eax
mov ecx, dword [ebp - 0x8f0]
add ecx, 0xf4
call fcn.0042b840
lea ecx, [ebp - 0x338]
push ecx
mov ecx, dword [ebp - 0xc]
add ecx, 0x28
call fcn.0041a3f0
test eax, eax
je 0x4167ed
push 0
lea edx, [ebp - 0x33c]
push edx
push 0x454
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
mov ecx, dword [ebp - 0xc]
call dword [edx + 8]
push 0
push 0
push 0xb
mov eax, dword [ebp - 0x33c]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [ebp - 0x328]
and ecx, 0xffff
or ecx, 0x1c
push ecx
mov ecx, dword [ebp - 0xc]
add ecx, 0x28
call fcn.0041a350
push eax
mov ecx, dword [ebp - 0xc]
add ecx, 0x28
call fcn.0041a3d0
push eax
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x2c]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x28]
push edx
push 0
mov eax, dword [ebp - 0x33c]
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0
push 1
push 0xb
mov ecx, dword [ebp - 0x33c]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edx, dword [ebp - 0x8f0]
mov ax, word [edx + 0x26]
or ah, 1
mov ecx, dword [ebp - 0x8f0]
mov word [ecx + 0x26], ax
mov edx, dword [ebp - 0x338]
mov dword [ebp - 0x34c], edx
mov eax, dword [ebp - 0x334]
mov dword [ebp - 0x348], eax
mov ecx, dword [ebp - 0x330]
add ecx, 1
mov dword [ebp - 0x344], ecx
mov edx, dword [ebp - 0x32c]
add edx, 1
mov dword [ebp - 0x340], edx
push 1
lea eax, [ebp - 0x34c]
push eax
mov ecx, dword [ebp - 0x8f0]
mov edx, dword [ecx + 0x134]
push edx
call dword [sym.imp.USER32.dll_InvalidateRect]
push 1
push 0
mov eax, dword [ebp - 0x33c]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x4168a6
lea ecx, [ebp - 0x338]
push ecx
mov ecx, dword [ebp - 0xc]
add ecx, 0x28
call fcn.0041a3f0
test eax, eax
je 0x4168a6
mov edx, dword [ebp - 0xc]
xor eax, eax
mov ax, word [edx + 0x26]
and eax, 0x400
test eax, eax
je 0x4168a6
push 0
lea ecx, [ebp - 0x350]
push ecx
push 0x454
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xc]
call dword [eax + 8]
push 0
push 0
push 0xb
mov ecx, dword [ebp - 0x350]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edx, dword [ebp - 0x328]
and edx, 0xffff
or edx, 0x1c
push edx
mov ecx, dword [ebp - 0xc]
add ecx, 0x28
call fcn.0041a350
push eax
mov ecx, dword [ebp - 0xc]
add ecx, 0x28
call fcn.0041a3d0
push eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x2c]
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x28]
push eax
push 0
mov ecx, dword [ebp - 0x350]
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0
push 1
push 0xb
mov edx, dword [ebp - 0x350]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x4165b7
mov ecx, dword [ebp - 0x8f0]
add ecx, 0xf4
call fcn.0040b590
test eax, eax
jne 0x41694b
mov dword [ebp - 0x360], 0xffffffff
mov dword [ebp - 0x35c], 0xffffffff
mov dword [ebp - 0x358], 0xffffffff
mov dword [ebp - 0x354], 0xffffffff
push 0x20
call fcn.00403197
add esp, 4
mov dword [ebp - 0x720], eax
cmp dword [ebp - 0x720], 0
je 0x416929
lea eax, [ebp - 0x360]
push eax
mov ecx, dword [ebp - 0x8f0]
mov edx, dword [ecx + 0x1c]
push edx
mov ecx, dword [ebp - 0x720]
call fcn.0042b740
mov dword [ebp - 0x9b8], eax
jmp 0x416933
mov dword [ebp - 0x9b8], 0
mov eax, dword [ebp - 0x9b8]
push eax
mov ecx, dword [ebp - 0x8f0]
add ecx, 0xf4
call fcn.0040f4c6
mov ecx, dword [ebp - 0x8f0]
cmp dword [ecx + 0x134], 0
je 0x416e4f
mov edx, dword [ebp - 0x8f0]
mov eax, dword [ebp - 0x8f0]
mov ecx, dword [edx + 0x1c]
cmp ecx, dword [eax + 0x134]
je 0x416e4f
mov ecx, dword [ebp - 0x8f0]
add ecx, 0xf4
call fcn.0040b590
add eax, 0x10
mov edx, dword [eax]
mov dword [ebp - 0x398], edx
mov ecx, dword [eax + 4]
mov dword [ebp - 0x394], ecx
mov edx, dword [eax + 8]
mov dword [ebp - 0x390], edx
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x38c], eax
lea ecx, [ebp - 0x388]
push ecx
mov edx, dword [ebp - 0x8f0]
mov eax, dword [edx + 0x1c]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [ebp - 0x388]
mov dword [ebp - 0x368], ecx
mov edx, dword [ebp - 0x384]
mov dword [ebp - 0x364], edx
lea eax, [ebp - 0x368]
push eax
mov ecx, dword [ebp - 0x8f0]
mov edx, dword [ecx + 0x134]
push edx
call dword [sym.imp.USER32.dll_ScreenToClient]
mov eax, dword [ebp - 0x388]
sub eax, dword [ebp - 0x368]
mov ecx, dword [ebp - 0x380]
sub ecx, eax
mov dword [ebp - 0x380], ecx
mov edx, dword [ebp - 0x368]
mov dword [ebp - 0x388], edx
mov eax, dword [ebp - 0x384]
sub eax, dword [ebp - 0x364]
mov ecx, dword [ebp - 0x37c]
sub ecx, eax
mov dword [ebp - 0x37c], ecx
mov edx, dword [ebp - 0x364]
mov dword [ebp - 0x384], edx
lea eax, [ebp - 0x388]
push eax
lea ecx, [ebp - 0x378]
call fcn.00411980
lea ecx, [ebp - 0x398]
push ecx
lea ecx, [ebp - 0x378]
call fcn.0041a3f0
test eax, eax
je 0x416d62
lea edx, [ebp - 0x3b8]
push edx
mov eax, dword [ebp - 0x8f0]
mov ecx, dword [eax + 0x1c]
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
push 0
lea ecx, [ebp - 0x398]
call fcn.0041a350
push eax
lea ecx, [ebp - 0x398]
call fcn.0041a3d0
push eax
mov edx, dword [ebp - 0x394]
push edx
mov eax, dword [ebp - 0x398]
push eax
mov ecx, dword [ebp - 0x8f0]
mov edx, dword [ecx + 0x1c]
push edx
call dword [sym.imp.USER32.dll_MoveWindow]
mov eax, dword [ebp - 0x8f0]
mov cx, word [eax + 0x26]
or ch, 1
mov edx, dword [ebp - 0x8f0]
mov word [edx + 0x26], cx
mov eax, dword [ebp - 0x8f0]
cmp dword [eax + 0x10c], 0
je 0x416af6
push 3
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 0x9bc], eax
jmp 0x416b00
mov dword [ebp - 0x9bc], 0
mov esi, dword [ebp - 0x3ac]
add esi, dword [ebp - 0x9bc]
lea ecx, [ebp - 0x398]
call fcn.0041a350
cmp esi, eax
jge 0x416baa
mov dword [ebp - 0x3c8], 0
mov ecx, dword [ebp - 0x3ac]
mov dword [ebp - 0x3c4], ecx
mov esi, dword [ebp - 0x3b0]
add esi, 1
lea ecx, [ebp - 0x398]
call fcn.0041a3d0
cmp esi, eax
jge 0x416b5e
mov edx, dword [ebp - 0x3b0]
add edx, 1
mov dword [ebp - 0x9c0], edx
jmp 0x416b6f
lea ecx, [ebp - 0x398]
call fcn.0041a3d0
mov dword [ebp - 0x9c0], eax
mov eax, dword [ebp - 0x9c0]
mov dword [ebp - 0x3c0], eax
lea ecx, [ebp - 0x398]
call fcn.0041a350
mov dword [ebp - 0x3bc], eax
push 1
lea ecx, [ebp - 0x3c8]
push ecx
mov edx, dword [ebp - 0x8f0]
mov eax, dword [edx + 0x1c]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x416c57
mov ecx, dword [ebp - 0x8f0]
cmp dword [ecx + 0x10c], 0
je 0x416c57
mov dword [ebp - 0x3d8], 0
lea ecx, [ebp - 0x398]
call fcn.0041a350
mov esi, eax
push 3
call dword [sym.imp.USER32.dll_GetSystemMetrics]
sub esi, eax
sub esi, 1
mov dword [ebp - 0x3d4], esi
mov esi, dword [ebp - 0x3b0]
add esi, 1
lea ecx, [ebp - 0x398]
call fcn.0041a3d0
cmp esi, eax
jge 0x416c10
mov edx, dword [ebp - 0x3b0]
add edx, 1
mov dword [ebp - 0x9c4], edx
jmp 0x416c21
lea ecx, [ebp - 0x398]
call fcn.0041a3d0
mov dword [ebp - 0x9c4], eax
mov eax, dword [ebp - 0x9c4]
mov dword [ebp - 0x3d0], eax
lea ecx, [ebp - 0x398]
call fcn.0041a350
mov dword [ebp - 0x3cc], eax
push 1
lea ecx, [ebp - 0x3d8]
push ecx
mov edx, dword [ebp - 0x8f0]
mov eax, dword [edx + 0x1c]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov ecx, dword [ebp - 0x8f0]
cmp dword [ecx + 0x108], 0
je 0x416c76
push 2
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 0x9c8], eax
jmp 0x416c80
mov dword [ebp - 0x9c8], 0
mov esi, dword [ebp - 0x3b0]
add esi, dword [ebp - 0x9c8]
lea ecx, [ebp - 0x398]
call fcn.0041a3d0
cmp esi, eax
jge 0x416cee
mov edx, dword [ebp - 0x3b0]
mov dword [ebp - 0x3e8], edx
mov dword [ebp - 0x3e4], 0
lea ecx, [ebp - 0x398]
call fcn.0041a3d0
mov dword [ebp - 0x3e0], eax
lea ecx, [ebp - 0x398]
call fcn.0041a350
mov dword [ebp - 0x3dc], eax
push 1
lea eax, [ebp - 0x3e8]
push eax
mov ecx, dword [ebp - 0x8f0]
mov edx, dword [ecx + 0x1c]
push edx
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x416d62
mov eax, dword [ebp - 0x8f0]
cmp dword [eax + 0x108], 0
je 0x416d62
lea ecx, [ebp - 0x398]
call fcn.0041a3d0
mov esi, eax
push 2
call dword [sym.imp.USER32.dll_GetSystemMetrics]
sub esi, eax
sub esi, 1
mov dword [ebp - 0x3f8], esi
mov dword [ebp - 0x3f4], 0
lea ecx, [ebp - 0x398]
call fcn.0041a3d0
mov dword [ebp - 0x3f0], eax
lea ecx, [ebp - 0x398]
call fcn.0041a350
mov dword [ebp - 0x3ec], eax
push 1
lea ecx, [ebp - 0x3f8]
push ecx
mov edx, dword [ebp - 0x8f0]
mov eax, dword [edx + 0x1c]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov ecx, dword [ebp - 0x8f0]
add ecx, 0xf4
call fcn.0040b590
add eax, 0x10
mov ecx, dword [eax]
mov dword [ebp - 0x3a8], ecx
mov edx, dword [eax + 4]
mov dword [ebp - 0x3a4], edx
mov ecx, dword [eax + 8]
mov dword [ebp - 0x3a0], ecx
mov edx, dword [eax + 0xc]
mov dword [ebp - 0x39c], edx
mov ecx, dword [ebp - 0x8f0]
add ecx, 0xf4
mov eax, dword [ebp - 0x8f0]
mov edx, dword [eax + 0xf4]
call dword [edx + 4]
lea ecx, [ebp - 0x3a8]
call fcn.0041a3d0
sub eax, 1
mov dword [ebp - 0x3a0], eax
mov dword [ebp - 0x3a8], 0
lea ecx, [ebp - 0x3a8]
call fcn.0041a350
sub eax, 1
mov dword [ebp - 0x39c], eax
mov dword [ebp - 0x3a4], 0
push 0x20
call fcn.00403197
add esp, 4
mov dword [ebp - 0x724], eax
cmp dword [ebp - 0x724], 0
je 0x416e2d
lea eax, [ebp - 0x3a8]
push eax
mov ecx, dword [ebp - 0x8f0]
mov edx, dword [ecx + 0x1c]
push edx
mov ecx, dword [ebp - 0x724]
call fcn.0042b740
mov dword [ebp - 0x9cc], eax
jmp 0x416e37
mov dword [ebp - 0x9cc], 0
mov eax, dword [ebp - 0x9cc]
push eax
mov ecx, dword [ebp - 0x8f0]
add ecx, 0xf4
call fcn.0040f4c6
mov ecx, dword [ebp - 0x8f0]
call fcn.004119d0
mov dword [ebp - 0xc], eax
jmp 0x416e6a
mov ecx, dword [ebp - 0xc]
call fcn.0040b590
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4170ab
mov ecx, dword [ebp - 0xc]
add ecx, 0x28
mov edx, dword [ecx]
mov dword [ebp - 0x408], edx
mov eax, dword [ecx + 4]
mov dword [ebp - 0x404], eax
mov edx, dword [ecx + 8]
mov dword [ebp - 0x400], edx
mov eax, dword [ecx + 0xc]
mov dword [ebp - 0x3fc], eax
push 0
push 0xffffff37
lea ecx, [ebp - 0x75c]
call fcn.0040abe5
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xc]
call dword [edx + 0x10]
mov eax, dword [ebp - 0xc]
xor ecx, ecx
mov cx, word [eax + 0x20]
and ecx, 0x200
test ecx, ecx
je 0x416f00
mov edx, dword [ebp - 0x8f0]
xor eax, eax
cmp dword [edx + 0x48], 0
sete al
push eax
mov ecx, dword [ebp - 0xc]
add ecx, 0x28
push ecx
mov edx, dword [ebp - 0x8f0]
mov eax, dword [edx + 0x1c]
push eax
mov ecx, dword [ebp - 0x8f0]
add ecx, 0xf4
call fcn.0042b840
lea ecx, [ebp - 0x408]
push ecx
mov ecx, dword [ebp - 0xc]
add ecx, 0x28
call fcn.0041a3f0
test eax, eax
je 0x4170a6
mov edx, dword [ebp - 0xc]
xor eax, eax
mov ax, word [edx + 0x26]
and eax, 0x400
test eax, eax
je 0x4170a6
mov ecx, dword [ebp - 0x8f0]
xor edx, edx
mov dx, word [ecx + 0x26]
and edx, 0x80
neg edx
sbb edx, edx
neg edx
mov word [ebp - 0x40c], dx
push 0
lea eax, [ebp - 0x410]
push eax
push 0x454
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xc]
call dword [edx + 8]
push 0
push 0
push 0xb
mov eax, dword [ebp - 0x410]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [ebp - 0x40c]
and ecx, 0xffff
or ecx, 0x1c
push ecx
mov ecx, dword [ebp - 0xc]
add ecx, 0x28
call fcn.0041a350
push eax
mov ecx, dword [ebp - 0xc]
add ecx, 0x28
call fcn.0041a3d0
push eax
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x2c]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x28]
push edx
push 0
mov eax, dword [ebp - 0x410]
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0
push 1
push 0xb
mov ecx, dword [ebp - 0x410]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edx, dword [ebp - 0x8f0]
mov ax, word [edx + 0x26]
or ah, 1
mov ecx, dword [ebp - 0x8f0]
mov word [ecx + 0x26], ax
mov edx, dword [ebp - 0x408]
mov dword [ebp - 0x420], edx
mov eax, dword [ebp - 0x404]
mov dword [ebp - 0x41c], eax
mov ecx, dword [ebp - 0x400]
add ecx, 1
mov dword [ebp - 0x418], ecx
mov edx, dword [ebp - 0x3fc]
add edx, 1
mov dword [ebp - 0x414], edx
push 1
lea eax, [ebp - 0x420]
push eax
mov ecx, dword [ebp - 0x8f0]
mov edx, dword [ecx + 0x1c]
push edx
call dword [sym.imp.USER32.dll_InvalidateRect]
push 1
push 0
mov eax, dword [ebp - 0x410]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov ecx, dword [ebp - 0x8f0]
xor edx, edx
mov dx, word [ecx + 0x22]
and edx, 0x4000
test edx, edx
je 0x4170a6
mov eax, dword [ebp - 0x8f0]
cmp dword [eax + 0x48], 0
je 0x4170a6
push 0
push 1
push 0xb
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x1c]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 1
push 0x85
mov eax, dword [ebp - 0x410]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push 1
push 0
mov ecx, dword [ebp - 0x410]
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x416e5f
mov edx, dword [ebp - 0x8f0]
xor eax, eax
mov ax, word [edx + 0xcc]
and eax, 0x100
test eax, eax
jne 0x4170e7
push 0
push 0xfffffecc
lea ecx, [ebp - 0x794]
call fcn.0040abe5
push eax
mov ecx, dword [ebp - 0x8f0]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x8f0]
call dword [edx + 0x28]
jmp 0x41712a
mov ecx, dword [ebp - 0x8f0]
call fcn.004119d0
mov dword [ebp - 0xc], eax
jmp 0x417104
mov ecx, dword [ebp - 0xc]
call fcn.0040b590
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x41712a
push 0
push 0xffffff37
lea ecx, [ebp - 0x7cc]
call fcn.0040abe5
push eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
mov ecx, dword [ebp - 0xc]
call dword [edx + 0x10]
jmp 0x4170f9
jmp 0x418989
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x424], 0
mov ecx, dword [ebp - 0x8f0]
add ecx, 0xd0
call fcn.0040b590
mov dword [ebp - 0xc], eax
jmp 0x417164
mov ecx, dword [ebp - 0xc]
call fcn.0040b590
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x41718e
lea eax, [ebp - 0x428]
push eax
push 0
push 0xfffffffffffffff2
lea ecx, [ebp - 0x804]
call fcn.0040aca0
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xc]
call dword [edx + 0x10]
jmp 0x417159
mov ecx, dword [ebp - 0x8f0]
call fcn.004119d0
mov dword [ebp - 0xc], eax
jmp 0x4171a9
mov ecx, dword [ebp - 0xc]
call fcn.0040b590
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4171d3
lea eax, [ebp - 0x428]
push eax
push 0
push 0xfffffffffffffff2
lea ecx, [ebp - 0x83c]
call fcn.0040aca0
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xc]
call dword [edx + 0x10]
jmp 0x41719e
jmp 0x418989
mov dword [ebp - 4], 0xfffffe6b
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x8f0]
call fcn.0042f7f7
mov dword [ebp - 4], eax
jmp 0x418989
mov esi, dword [ebp + 8]
mov ecx, 0xe
lea edi, [ebp - 0x460]
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x460]
push ecx
mov edx, dword [ebp - 0x8f0]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x8f0]
call dword [eax + 0x28]
mov dword [ebp - 4], eax
jmp 0x418989
mov ecx, dword [ebp - 0x8f0]
mov dx, word [ecx + 0x26]
or dh, 8
mov eax, dword [ebp - 0x8f0]
mov word [eax + 0x26], dx
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x8f0]
call fcn.0042f7f7
mov edx, dword [ebp - 0x8f0]
cmp dword [edx + 0x128], 0
je 0x417298
push 0
xor eax, eax
cmp dword [ebp - 4], 0xffffff34
sete al
add eax, 0xffffff2d
push eax
lea ecx, [ebp - 0x874]
call fcn.0040abe5
push eax
mov ecx, dword [ebp - 0x8f0]
mov ecx, dword [ecx + 0x128]
mov edx, dword [ebp - 0x8f0]
mov eax, dword [edx + 0x128]
mov edx, dword [eax]
call dword [edx + 0x10]
mov eax, dword [ebp - 0x8f0]
cmp dword [eax + 0xc8], 0
je 0x4172de
push 0
mov ecx, dword [ebp - 4]
push ecx
lea ecx, [ebp - 0x8ac]
call fcn.0040abe5
push eax
mov ecx, dword [ebp - 0x8f0]
call fcn.004233b0
mov dword [ebp - 0x9d0], eax
mov edx, dword [ebp - 0x9d0]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x9d0]
call dword [eax + 0x10]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x8f0]
mov dx, word [ecx + 0x26]
and dx, 0xf7ff
mov eax, dword [ebp - 0x8f0]
mov word [eax + 0x26], dx
jmp 0x418989
mov ecx, dword [ebp - 0x8f0]
cmp dword [ecx + 0x48], 0
jne 0x417421
mov edx, dword [ebp - 0x8f0]
xor eax, eax
mov ax, word [edx + 0x22]
and eax, 0x4000
test eax, eax
je 0x417421
mov dword [ebp - 0x464], 0
mov ecx, dword [ebp - 0x8f0]
call fcn.004119f0
mov dword [ebp - 0x464], eax
jmp 0x417353
mov ecx, dword [ebp - 0x464]
call fcn.0041a2a0
mov dword [ebp - 0x464], eax
cmp dword [ebp - 0x464], 0
je 0x417374
mov ecx, dword [ebp - 0x464]
xor edx, edx
mov dx, word [ecx + 0x22]
and edx, 0x4000
test edx, edx
jne 0x417374
jmp 0x417342
cmp dword [ebp - 0x464], 0
je 0x417421
mov eax, dword [ebp - 0x8f0]
mov cx, word [eax + 0x26]
or ch, 8
mov edx, dword [ebp - 0x8f0]
mov word [edx + 0x26], cx
mov eax, dword [ebp - 0x464]
push eax
mov ecx, dword [ebp - 0x8f0]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x8f0]
call dword [edx + 0x30]
mov eax, dword [ebp - 0x8f0]
mov cx, word [eax + 0x26]
and cx, 0xf7ff
mov edx, dword [ebp - 0x8f0]
mov word [edx + 0x26], cx
mov eax, dword [ebp - 0x464]
xor ecx, ecx
mov cx, word [eax + 0x22]
and ecx, 0x10
test ecx, ecx
jne 0x417421
mov edx, dword [ebp - 0x464]
mov dword [ebp - 0x8b4], edx
mov eax, dword [ebp - 0x8b4]
mov dword [ebp - 0x8b0], eax
cmp dword [ebp - 0x8b0], 0
je 0x417417
push 1
mov ecx, dword [ebp - 0x8b0]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x8b0]
call dword [edx]
mov dword [ebp - 0x9d4], eax
jmp 0x417421
mov dword [ebp - 0x9d4], 0
jmp 0x418989
mov eax, dword [ebp - 0x8f0]
cmp dword [eax + 0x48], 0
jne 0x41754d
mov ecx, dword [ebp - 0x8f0]
xor edx, edx
mov dx, word [ecx + 0x22]
and edx, 0x4000
test edx, edx
je 0x41754d
mov eax, dword [ebp - 0x8f0]
cmp dword [eax + 0x134], 0
je 0x41754d
mov ecx, dword [ebp - 0x8f0]
mov edx, dword [ebp - 0x8f0]
mov eax, dword [ecx + 0x1c]
cmp eax, dword [edx + 0x134]
je 0x41754d
mov ecx, dword [ebp - 0x8f0]
cmp dword [ecx + 0xc8], 0
je 0x41754d
mov dword [ebp - 0x468], 0
mov ecx, dword [ebp - 0x8f0]
call fcn.004119f0
mov dword [ebp - 0x468], eax
jmp 0x4174bf
mov ecx, dword [ebp - 0x468]
call fcn.0041a2a0
mov dword [ebp - 0x468], eax
cmp dword [ebp - 0x468], 0
je 0x4174df
mov edx, dword [ebp - 0x468]
xor eax, eax
mov ax, word [edx + 0x22]
and eax, 0x4000
test eax, eax
jne 0x4174df
jmp 0x4174ae
cmp dword [ebp - 0x468], 0
je 0x41754d
mov dword [ebp - 0x46c], 9
cmp dword [ebp - 4], 0xfffffe07
jne 0x417507
mov dword [ebp - 0x46c], 3
jmp 0x41751a
cmp dword [ebp - 4], 0xfffffe08
jne 0x41751a
mov dword [ebp - 0x46c], 2
push 0
lea ecx, [ebp - 0x470]
push ecx
push 0x454
mov edx, dword [ebp - 0x468]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x468]
call dword [eax + 8]
mov ecx, dword [ebp - 0x46c]
push ecx
mov edx, dword [ebp - 0x470]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x418989
mov eax, dword [ebp - 0x8f0]
mov cx, word [eax + 0x26]
or ch, 0x40
mov edx, dword [ebp - 0x8f0]
mov word [edx + 0x26], cx
mov ecx, dword [ebp - 0x8f0]
add ecx, 0xd0
call fcn.0040b590
mov dword [ebp - 0x474], eax
jmp 0x417593
mov ecx, dword [ebp - 0x474]
call fcn.0040b590
mov dword [ebp - 0x474], eax
cmp dword [ebp - 0x474], 0
je 0x4175e3
mov eax, dword [ebp - 0x474]
mov cx, word [eax + 0x26]
or ch, 8
mov edx, dword [ebp - 0x474]
mov word [edx + 0x26], cx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x474]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x474]
call dword [edx + 0x10]
mov eax, dword [ebp - 0x474]
mov cx, word [eax + 0x26]
and cx, 0xf7ff
mov edx, dword [ebp - 0x474]
mov word [edx + 0x26], cx
jmp 0x417582
mov ecx, dword [ebp - 0x8f0]
call fcn.004119d0
mov dword [ebp - 0x474], eax
jmp 0x417607
mov ecx, dword [ebp - 0x474]
call fcn.0040b590
mov dword [ebp - 0x474], eax
cmp dword [ebp - 0x474], 0
je 0x417657
mov eax, dword [ebp - 0x474]
mov cx, word [eax + 0x26]
or ch, 8
mov edx, dword [ebp - 0x474]
mov word [edx + 0x26], cx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x474]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x474]
call dword [edx + 0x10]
mov eax, dword [ebp - 0x474]
mov cx, word [eax + 0x26]
and cx, 0xf7ff
mov edx, dword [ebp - 0x474]
mov word [edx + 0x26], cx
jmp 0x4175f6
mov eax, dword [ebp - 0x8f0]
mov cx, word [eax + 0x26]
and cx, 0xbfff
mov edx, dword [ebp - 0x8f0]
mov word [edx + 0x26], cx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x8f0]
call fcn.0042f7f7
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x8f0]
cmp dword [ecx + 0xc8], 0
jne 0x4176de
mov edx, dword [ebp - 0x8f0]
xor eax, eax
mov ax, word [edx + 0x22]
and eax, 0x4000
test eax, eax
je 0x4176ba
mov ecx, dword [ebp - 0x8f0]
mov edx, dword [ecx + 0xc0]
mov dword [ebp - 0x9d8], edx
jmp 0x4176cc
mov eax, dword [ebp - 0x8f0]
mov ecx, dword [eax + 0xc4]
mov dword [ebp - 0x9d8], ecx
mov edx, dword [ebp - 0x8f0]
mov eax, dword [ebp - 0x9d8]
mov dword [edx + 0xc8], eax
mov ecx, dword [ebp - 0x8f0]
call fcn.004233b0
push eax
mov ecx, dword [ebp - 0x8f0]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x8f0]
call dword [edx + 0x2c]
jmp 0x418989
mov dword [ebp - 0x478], 9
cmp dword [ebp - 4], 0xfffffffb
jne 0x41771c
mov dword [ebp - 0x478], 3
jmp 0x41772c
cmp dword [ebp - 4], 0xfffffffc
jne 0x41772c
mov dword [ebp - 0x478], 2
mov eax, dword [ebp - 0x8f0]
cmp dword [eax + 0x134], 0
je 0x41774f
mov ecx, dword [ebp - 0x8f0]
mov edx, dword [ecx + 0x134]
mov dword [ebp - 0x9dc], edx
jmp 0x41775e
mov eax, dword [ebp - 0x8f0]
mov ecx, dword [eax + 0x1c]
mov dword [ebp - 0x9dc], ecx
mov edx, dword [ebp - 0x478]
push edx
mov eax, dword [ebp - 0x9dc]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x418989
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x28]
push edx
mov eax, dword [ebp - 0x8f0]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x8f0]
call dword [edx + 0x2c]
jmp 0x418989
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x28]
push ecx
mov edx, dword [ebp - 0x8f0]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x8f0]
call dword [eax + 0x30]
jmp 0x418989
mov dword [ebp - 4], 0xfffffe6d
push 0x3e9
mov ecx, dword [ebp - 0x8f0]
call fcn.0041ae20
test eax, eax
jne 0x4177e3
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x8f0]
call fcn.0042f7f7
mov dword [ebp - 4], eax
jmp 0x4179ad
mov edx, dword [ebp - 0x8f0]
xor eax, eax
mov ax, word [edx + 0x22]
and eax, 0x1000
test eax, eax
jne 0x417867
mov ecx, dword [0x45243c]
mov edx, dword [ecx + 0x158]
push edx
mov ecx, dword [ebp - 0x8f0]
add ecx, 0xb8
call fcn.0040f92a
cmp eax, 0xffffffff
jne 0x417842
mov eax, dword [0x45243c]
mov ecx, dword [eax + 0x158]
cmp ecx, dword [ebp - 0x8f0]
je 0x417842
push 0xfffffb47
push 0x1e
mov ecx, dword [0x452438]
call fcn.0040afe1
jmp 0x417862
xor edx, edx
cmp dword [ebp - 4], 0xfffffe6d
sete dl
add edx, 0xfffffb45
push edx
push 0x1e
mov ecx, dword [0x452438]
call fcn.0040afe1
jmp 0x4179ad
push 0x3e9
mov eax, dword [0x45243c]
mov ecx, dword [eax + 0x158]
call fcn.0041ae20
test eax, eax
je 0x417942
mov dword [ebp - 0x47c], 0
push 0
lea ecx, [ebp - 0x480]
push ecx
push 0x10
mov edx, dword [0x45243c]
mov ecx, dword [edx + 0x158]
mov eax, dword [0x45243c]
mov edx, dword [eax + 0x158]
mov eax, dword [edx]
call dword [eax + 8]
jmp 0x4178c8
mov ecx, dword [ebp - 0x480]
call fcn.0040b590
mov dword [ebp - 0x480], eax
cmp dword [ebp - 0x480], 0
je 0x4178f5
mov ecx, dword [ebp - 0x480]
xor edx, edx
mov dx, word [ecx + 0x26]
and edx, 8
test edx, edx
je 0x4178f3
mov eax, dword [ebp - 0x47c]
add eax, 1
mov dword [ebp - 0x47c], eax
jmp 0x4178b7
cmp dword [ebp - 0x47c], 1
jle 0x417920
xor ecx, ecx
cmp dword [ebp - 4], 0xfffffe6d
sete cl
add ecx, 0xfffffb43
push ecx
push 0x1e
mov ecx, dword [0x452438]
call fcn.0040afe1
jmp 0x417940
xor edx, edx
cmp dword [ebp - 4], 0xfffffe6d
sete dl
add edx, 0xfffffb45
push edx
push 0x1e
mov ecx, dword [0x452438]
call fcn.0040afe1
jmp 0x4179ad
cmp dword [ebp - 4], 0xfffffe6c
je 0x417979
mov eax, dword [0x45243c]
mov ecx, dword [eax + 0x158]
cmp dword [ecx + 0x48], 0
je 0x41799b
push 0x3e9
mov edx, dword [0x45243c]
mov eax, dword [edx + 0x158]
mov ecx, dword [eax + 0x48]
call fcn.0041ae20
test eax, eax
je 0x41799b
xor ecx, ecx
cmp dword [ebp - 4], 0xfffffe6d
sete cl
add ecx, 0xfffffb45
push ecx
push 0x1e
mov ecx, dword [0x452438]
call fcn.0040afe1
jmp 0x4179ad
push 0xfffffb47
push 0x1e
mov ecx, dword [0x452438]
call fcn.0040afe1
jmp 0x418989
mov edx, dword [ebp - 0x8f0]
xor eax, eax
mov ax, word [edx + 0x26]
and eax, 0x80
test eax, eax
je 0x4179de
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x8f0]
call fcn.0042f7f7
mov dword [ebp - 4], eax
jmp 0x418989
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x8f0]
mov ecx, dword [edx + 0x28]
sub ecx, dword [eax + 0x28]
mov dword [ebp - 0x488], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x8f0]
mov ecx, dword [edx + 0x2c]
sub ecx, dword [eax + 0x2c]
mov dword [ebp - 0x484], ecx
mov ecx, dword [ebp - 0x8f0]
call fcn.004119d0
mov dword [ebp - 0xc], eax
jmp 0x417a23
mov ecx, dword [ebp - 0xc]
call fcn.0040b590
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x417acd
lea edx, [ebp - 0x488]
push edx
mov ecx, dword [ebp - 0xc]
add ecx, 0x28
call fcn.0041a370
test eax, eax
je 0x417ac8
mov eax, dword [0x45243c]
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [eax + 0x158]
je 0x417ac8
mov esi, dword [ebp + 8]
mov ecx, 0xe
lea edi, [ebp - 0x4c0]
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x1c]
mov dword [ebp - 0x4b4], eax
mov ecx, dword [ebp - 0x488]
mov dword [ebp - 0x498], ecx
mov edx, dword [ebp - 0x484]
mov dword [ebp - 0x494], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x2c]
shl ecx, 0x10
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x28]
or eax, ecx
mov ecx, dword [ebp - 0x4a8]
sub ecx, eax
mov dword [ebp - 0x4a8], ecx
lea edx, [ebp - 0x4c0]
push edx
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
mov ecx, dword [ebp - 0xc]
call dword [edx + 0x10]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 1
jmp 0x417acd
jmp 0x417a18
cmp dword [ebp - 0xc], 0
jne 0x417ae5
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x8f0]
call fcn.0042f7f7
mov dword [ebp - 4], eax
jmp 0x418989
mov ecx, dword [ebp - 0x8f0]
cmp dword [ecx + 0xc8], 0
je 0x417b2c
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x8f0]
call fcn.004233b0
mov dword [ebp - 0x9e0], eax
mov eax, dword [ebp - 0x9e0]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x9e0]
call dword [edx + 0x10]
cmp eax, 0xfffffffe
je 0x417b2c
mov eax, dword [ebp - 4]
jmp 0x41898c
mov eax, dword [ebp - 0x8f0]
cmp dword [eax + 0x48], 0
je 0x417b52
mov ecx, dword [ebp - 0x8f0]
xor edx, edx
mov dx, word [ecx + 0x4c]
test edx, edx
jne 0x417b52
mov eax, 0xfffffffe
jmp 0x41898c
cmp dword [0x452444], 0
je 0x417b7d
mov eax, dword [ebp - 0x8f0]
mov cx, word [eax + 0x4c]
push ecx
mov edx, dword [0x45243c]
push edx
mov eax, dword [0x452444]
mov edx, dword [eax]
mov ecx, dword [0x452444]
call dword [edx + 4]
jmp 0x418989
mov eax, dword [ebp - 0x8f0]
cmp dword [eax + 0xc8], 0
je 0x417bbf
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x8f0]
call fcn.004233b0
mov dword [ebp - 0x9e4], eax
mov edx, dword [ebp - 0x9e4]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x9e4]
call dword [eax + 0x10]
mov dword [ebp - 0x9e8], eax
jmp 0x417bc9
mov dword [ebp - 0x9e8], 0xfffffffe
mov ecx, dword [ebp - 0x9e8]
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 0x8f0]
call fcn.004119d0
mov dword [ebp - 0xc], eax
jmp 0x417bed
mov ecx, dword [ebp - 0xc]
call fcn.0040b590
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x417c77
cmp dword [ebp - 4], 0xfffffffe
jne 0x417c77
mov edx, dword [ebp - 0xc]
xor eax, eax
mov ax, word [edx + 0x22]
and eax, 2
test eax, eax
jne 0x417c72
mov ecx, dword [ebp - 0xc]
xor edx, edx
mov dx, word [ecx + 0x20]
and edx, 0x400
test edx, edx
jne 0x417c72
mov eax, dword [ebp - 0x8f0]
mov cx, word [eax + 0xcc]
or cl, 0x80
mov edx, dword [ebp - 0x8f0]
mov word [edx + 0xcc], cx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x8f0]
call fcn.00411a30
mov ecx, dword [ebp - 0x8f0]
mov dx, word [ecx + 0xcc]
and dx, 0xff7f
mov eax, dword [ebp - 0x8f0]
mov word [eax + 0xcc], dx
mov dword [ebp - 4], 0x420
jmp 0x417be2
jmp 0x418989
mov ecx, dword [ebp - 0x8f0]
cmp dword [ecx + 0xc8], 0
je 0x417cb9
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x8f0]
call fcn.004233b0
mov dword [ebp - 0x9ec], eax
mov eax, dword [ebp - 0x9ec]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x9ec]
call dword [edx + 0x10]
mov dword [ebp - 0x9f0], eax
jmp 0x417cc3
mov dword [ebp - 0x9f0], 0xfffffffe
mov eax, dword [ebp - 0x9f0]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x8f0]
call fcn.004119f0
mov dword [ebp - 0xc], eax
jmp 0x417ce7
mov ecx, dword [ebp - 0xc]
call fcn.0041a2a0
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x417d6c
cmp dword [ebp - 4], 0xfffffffe
jne 0x417d6c
mov ecx, dword [ebp - 0xc]
xor edx, edx
mov dx, word [ecx + 0x22]
and edx, 2
test edx, edx
jne 0x417d67
mov eax, dword [ebp - 0xc]
xor ecx, ecx
mov cx, word [eax + 0x20]
and ecx, 0x400
test ecx, ecx
jne 0x417d67
mov edx, dword [ebp - 0x8f0]
mov ax, word [edx + 0xcc]
or al, 0x40
mov ecx, dword [ebp - 0x8f0]
mov word [ecx + 0xcc], ax
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 0x8f0]
call fcn.00411a30
mov eax, dword [ebp - 0x8f0]
mov cx, word [eax + 0xcc]
and cx, 0xffbf
mov edx, dword [ebp - 0x8f0]
mov word [edx + 0xcc], cx
mov dword [ebp - 4], 0x421
jmp 0x417cdc
jmp 0x418989
mov eax, dword [ebp - 4]
mov dword [ebp - 0x4c4], eax
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x8f0]
cmp dword [ecx + 0xc8], 0
jne 0x417dac
mov ecx, dword [ebp - 0x8f0]
call fcn.004119f0
push eax
mov ecx, dword [ebp - 0x8f0]
call fcn.00411a30
jmp 0x417f67
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x8f0]
call fcn.004233b0
mov dword [ebp - 0x9f4], eax
mov eax, dword [ebp - 0x9f4]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x9f4]
call dword [edx + 0x10]
cmp eax, 0xfffffffe
je 0x417de5
mov eax, dword [ebp - 0x4c4]
mov dword [ebp - 4], eax
jmp 0x417f67
mov ecx, dword [ebp - 0x8f0]
call fcn.004233b0
xor ecx, ecx
mov cx, word [eax + 0x20]
and ecx, 0x20
test ecx, ecx
je 0x417e07
call fcn.00434a50
jmp 0x417f67
mov ecx, dword [ebp - 0x8f0]
call fcn.004233b0
mov ecx, eax
call fcn.0041a2a0
test eax, eax
jne 0x417e38
mov edx, dword [ebp - 0x8f0]
xor eax, eax
mov ax, word [edx + 0xcc]
and eax, 1
test eax, eax
je 0x417e38
jmp 0x418989
mov ecx, dword [ebp - 0x8f0]
call fcn.004233b0
mov ecx, eax
call fcn.0041a2a0
test eax, eax
je 0x417e68
mov ecx, dword [ebp - 0x8f0]
call fcn.004233b0
mov ecx, eax
call fcn.0041a2a0
mov dword [ebp - 0x9f8], eax
jmp 0x417e79
mov ecx, dword [ebp - 0x8f0]
call fcn.004119f0
mov dword [ebp - 0x9f8], eax
mov ecx, dword [ebp - 0x9f8]
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0
je 0x417f67
mov edx, dword [ebp - 0x8f0]
mov eax, dword [ebp - 0xc]
cmp eax, dword [edx + 0xc8]
je 0x417f67
cmp dword [ebp - 4], 0xfffffffe
jne 0x417f67
mov ecx, dword [ebp - 0xc]
xor edx, edx
mov dx, word [ecx + 0x20]
and edx, 0x400
test edx, edx
jne 0x417f23
mov eax, dword [ebp - 0xc]
xor ecx, ecx
mov cx, word [eax + 0x22]
and ecx, 2
test ecx, ecx
jne 0x417f23
mov edx, dword [ebp - 0x8f0]
mov ax, word [edx + 0xcc]
or al, 0x80
mov ecx, dword [ebp - 0x8f0]
mov word [ecx + 0xcc], ax
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 0x8f0]
call fcn.00411a30
mov eax, dword [ebp - 0x8f0]
mov cx, word [eax + 0xcc]
and cx, 0xff7f
mov edx, dword [ebp - 0x8f0]
mov word [edx + 0xcc], cx
mov eax, dword [ebp - 0x4c4]
mov dword [ebp - 4], eax
jmp 0x417f62
mov ecx, dword [ebp - 0xc]
call fcn.0041a2a0
test eax, eax
je 0x417f3c
mov ecx, dword [ebp - 0xc]
call fcn.0041a2a0
mov dword [ebp - 0xc], eax
jmp 0x417f62
mov ecx, dword [ebp - 0x8f0]
xor edx, edx
mov dx, word [ecx + 0xcc]
and edx, 1
test edx, edx
je 0x417f54
jmp 0x417f67
mov ecx, dword [ebp - 0x8f0]
call fcn.004119f0
mov dword [ebp - 0xc], eax
jmp 0x417e82
jmp 0x418989
mov eax, dword [ebp - 4]
mov dword [ebp - 0x4c8], eax
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x8f0]
cmp dword [ecx + 0xc8], 0
jne 0x417fa7
mov ecx, dword [ebp - 0x8f0]
call fcn.004119d0
push eax
mov ecx, dword [ebp - 0x8f0]
call fcn.00411a30
jmp 0x418162
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x8f0]
call fcn.004233b0
mov dword [ebp - 0x9fc], eax
mov eax, dword [ebp - 0x9fc]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x9fc]
call dword [edx + 0x10]
cmp eax, 0xfffffffe
je 0x417fe0
mov eax, dword [ebp - 0x4c8]
mov dword [ebp - 4], eax
jmp 0x418162
mov ecx, dword [ebp - 0x8f0]
call fcn.004233b0
xor ecx, ecx
mov cx, word [eax + 0x20]
and ecx, 0x20
test ecx, ecx
je 0x418002
call fcn.00434a50
jmp 0x418162
mov ecx, dword [ebp - 0x8f0]
call fcn.004233b0
mov ecx, eax
call fcn.0040b590
test eax, eax
jne 0x418033
mov edx, dword [ebp - 0x8f0]
xor eax, eax
mov ax, word [edx + 0xcc]
and eax, 1
test eax, eax
je 0x418033
jmp 0x418989
mov ecx, dword [ebp - 0x8f0]
call fcn.004233b0
mov ecx, eax
call fcn.0040b590
test eax, eax
je 0x418063
mov ecx, dword [ebp - 0x8f0]
call fcn.004233b0
mov ecx, eax
call fcn.0040b590
mov dword [ebp - 0xa00], eax
jmp 0x418074
mov ecx, dword [ebp - 0x8f0]
call fcn.004119d0
mov dword [ebp - 0xa00], eax
mov ecx, dword [ebp - 0xa00]
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0
je 0x418162
mov edx, dword [ebp - 0x8f0]
mov eax, dword [ebp - 0xc]
cmp eax, dword [edx + 0xc8]
je 0x418162
cmp dword [ebp - 4], 0xfffffffe
jne 0x418162
mov ecx, dword [ebp - 0xc]
xor edx, edx
mov dx, word [ecx + 0x20]
and edx, 0x400
test edx, edx
jne 0x41811e
mov eax, dword [ebp - 0xc]
xor ecx, ecx
mov cx, word [eax + 0x22]
and ecx, 2
test ecx, ecx
jne 0x41811e
mov edx, dword [ebp - 0x8f0]
mov ax, word [edx + 0xcc]
or al, 0x40
mov ecx, dword [ebp - 0x8f0]
mov word [ecx + 0xcc], ax
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 0x8f0]
call fcn.00411a30
mov eax, dword [ebp - 0x8f0]
mov cx, word [eax + 0xcc]
and cx, 0xffbf
mov edx, dword [ebp - 0x8f0]
mov word [edx + 0xcc], cx
mov eax, dword [ebp - 0x4c8]
mov dword [ebp - 4], eax
jmp 0x41815d
mov ecx, dword [ebp - 0xc]
call fcn.0040b590
test eax, eax
je 0x418137
mov ecx, dword [ebp - 0xc]
call fcn.0040b590
mov dword [ebp - 0xc], eax
jmp 0x41815d
mov ecx, dword [ebp - 0x8f0]
xor edx, edx
mov dx, word [ecx + 0xcc]
and edx, 1
test edx, edx
je 0x41814f
jmp 0x418162
mov ecx, dword [ebp - 0x8f0]
call fcn.004119d0
mov dword [ebp - 0xc], eax
jmp 0x41807d
jmp 0x418989
mov eax, dword [ebp - 0x8f0]
cmp dword [eax + 0xc8], 0
je 0x418801
mov ecx, dword [ebp + 8]
cmp dword [ecx], 1
jne 0x4181b0
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x8f0]
call fcn.004233b0
mov dword [ebp - 0xa04], eax
mov eax, dword [ebp - 0xa04]
mov edx, dword [eax]
mov ecx, dword [ebp - 0xa04]
call dword [edx + 0x10]
mov dword [ebp - 4], eax
jmp 0x4187ff
mov dword [ebp - 0x4d4], 0
mov dword [ebp - 0x4cc], 0
mov dword [ebp - 0x4d0], 0
mov ecx, dword [ebp - 0x8f0]
call fcn.004119d0
mov dword [ebp - 0x4d8], eax
jmp 0x4181f2
mov ecx, dword [ebp - 0x4d8]
call fcn.0040b590
mov dword [ebp - 0x4d8], eax
cmp dword [ebp - 0x4d8], 0
je 0x41875c
mov ecx, dword [ebp - 0x8f0]
call fcn.004233b0
cmp dword [ebp - 0x4d8], eax
je 0x41823b
mov eax, dword [ebp - 0x4d8]
xor ecx, ecx
mov cx, word [eax + 0x20]
and ecx, 0x400
test ecx, ecx
jne 0x41823b
mov edx, dword [ebp - 0x4d8]
xor eax, eax
mov ax, word [edx + 0x22]
and eax, 2
test eax, eax
je 0x41823d
jmp 0x4181e1
cmp dword [ebp - 4], 0x41c
jne 0x418299
mov ecx, dword [ebp - 0x8f0]
call fcn.004233b0
mov ecx, dword [ebp - 0x4d8]
mov edx, dword [ecx + 0x2c]
cmp edx, dword [eax + 0x34]
jg 0x4183ad
mov ecx, dword [ebp - 0x8f0]
call fcn.004233b0
mov ecx, dword [ebp - 0x4d8]
mov edx, dword [ecx + 0x34]
cmp edx, dword [eax + 0x2c]
jle 0x418299
mov ecx, dword [ebp - 0x8f0]
call fcn.004233b0
mov ecx, dword [ebp - 0x4d8]
mov edx, dword [ecx + 0x28]
cmp edx, dword [eax + 0x28]
jg 0x4183ad
cmp dword [ebp - 4], 0x41d
jne 0x4182f5
mov ecx, dword [ebp - 0x8f0]
call fcn.004233b0
mov ecx, dword [ebp - 0x4d8]
mov edx, dword [ecx + 0x34]
cmp edx, dword [eax + 0x2c]
jl 0x4183ad
mov ecx, dword [ebp - 0x8f0]
call fcn.004233b0
mov ecx, dword [ebp - 0x4d8]
mov edx, dword [ecx + 0x2c]
cmp edx, dword [eax + 0x34]
jg 0x4182f5
mov ecx, dword [ebp - 0x8f0]
call fcn.004233b0
mov ecx, dword [ebp - 0x4d8]
mov edx, dword [ecx + 0x30]
cmp edx, dword [eax + 0x30]
jl 0x4183ad
cmp dword [ebp - 4], 0x41a
jne 0x41834d
mov ecx, dword [ebp - 0x8f0]
call fcn.004233b0
mov ecx, dword [ebp - 0x4d8]
mov edx, dword [ecx + 0x28]
cmp edx, dword [eax + 0x30]
jg 0x4183ad
mov ecx, dword [ebp - 0x8f0]
call fcn.004233b0
mov ecx, dword [ebp - 0x4d8]
mov edx, dword [ecx + 0x30]
cmp edx, dword [eax + 0x28]
jl 0x41834d
mov ecx, dword [ebp - 0x8f0]
call fcn.004233b0
mov ecx, dword [ebp - 0x4d8]
mov edx, dword [ecx + 0x2c]
cmp edx, dword [eax + 0x2c]
jg 0x4183ad
cmp dword [ebp - 4], 0x41b
jne 0x4184ef
mov ecx, dword [ebp - 0x8f0]
call fcn.004233b0
mov ecx, dword [ebp - 0x4d8]
mov edx, dword [ecx + 0x30]
cmp edx, dword [eax + 0x28]
jl 0x4183ad
mov ecx, dword [ebp - 0x8f0]
call fcn.004233b0
mov ecx, dword [ebp - 0x4d8]
mov edx, dword [ecx + 0x28]
cmp edx, dword [eax + 0x30]
jg 0x4184ef
mov ecx, dword [ebp - 0x8f0]
call fcn.004233b0
mov ecx, dword [ebp - 0x4d8]
mov edx, dword [ecx + 0x34]
cmp edx, dword [eax + 0x34]
jge 0x4184ef
cmp dword [ebp - 0x4d0], 0
je 0x4184de
cmp dword [ebp - 4], 0x41c
jne 0x418407
mov eax, dword [ebp - 0x4d8]
mov ecx, dword [ebp - 0x4d0]
mov edx, dword [eax + 0x34]
cmp edx, dword [ecx + 0x34]
jg 0x4184de
mov eax, dword [ebp - 0x4d8]
mov ecx, dword [ebp - 0x4d0]
mov edx, dword [eax + 0x34]
cmp edx, dword [ecx + 0x34]
jne 0x418407
mov eax, dword [ebp - 0x4d8]
mov ecx, dword [ebp - 0x4d0]
mov edx, dword [eax + 0x30]
cmp edx, dword [ecx + 0x30]
jg 0x4184de
cmp dword [ebp - 4], 0x41d
jne 0x418454
mov eax, dword [ebp - 0x4d8]
mov ecx, dword [ebp - 0x4d0]
mov edx, dword [eax + 0x2c]
cmp edx, dword [ecx + 0x2c]
jl 0x4184de
mov eax, dword [ebp - 0x4d8]
mov ecx, dword [ebp - 0x4d0]
mov edx, dword [eax + 0x2c]
cmp edx, dword [ecx + 0x2c]
jne 0x418454
mov eax, dword [ebp - 0x4d8]
mov ecx, dword [ebp - 0x4d0]
mov edx, dword [eax + 0x28]
cmp edx, dword [ecx + 0x28]
jl 0x4184de
cmp dword [ebp - 4], 0x41a
jne 0x418499
mov eax, dword [ebp - 0x4d8]
mov ecx, dword [ebp - 0x4d0]
mov edx, dword [eax + 0x30]
cmp edx, dword [ecx + 0x30]
jg 0x4184de
mov eax, dword [ebp - 0x4d8]
mov ecx, dword [ebp - 0x4d0]
mov edx, dword [eax + 0x30]
cmp edx, dword [ecx + 0x30]
jne 0x418499
mov eax, dword [ebp - 0x4d8]
mov ecx, dword [ebp - 0x4d0]
mov edx, dword [eax + 0x34]
cmp edx, dword [ecx + 0x34]
jg 0x4184de
cmp dword [ebp - 4], 0x41b
jne 0x4184ea
mov eax, dword [ebp - 0x4d8]
mov ecx, dword [ebp - 0x4d0]
mov edx, dword [eax + 0x28]
cmp edx, dword [ecx + 0x28]
jl 0x4184de
mov eax, dword [ebp - 0x4d8]
mov ecx, dword [ebp - 0x4d0]
mov edx, dword [eax + 0x28]
cmp edx, dword [ecx + 0x28]
jne 0x4184ea
mov eax, dword [ebp - 0x4d8]
mov ecx, dword [ebp - 0x4d0]
mov edx, dword [eax + 0x2c]
cmp edx, dword [ecx + 0x2c]
jge 0x4184ea
mov eax, dword [ebp - 0x4d8]
mov dword [ebp - 0x4d0], eax
jmp 0x4181e1
cmp dword [ebp - 4], 0x41c
jne 0x418511
mov ecx, dword [ebp - 0x8f0]
call fcn.004233b0
mov ecx, dword [ebp - 0x4d8]
mov edx, dword [ecx + 0x34]
cmp edx, dword [eax + 0x2c]
jg 0x41857f
cmp dword [ebp - 4], 0x41d
jne 0x418533
mov ecx, dword [ebp - 0x8f0]
call fcn.004233b0
mov ecx, dword [ebp - 0x4d8]
mov edx, dword [ecx + 0x2c]
cmp edx, dword [eax + 0x34]
jl 0x41857f
cmp dword [ebp - 4], 0x41a
jne 0x418555
mov ecx, dword [ebp - 0x8f0]
call fcn.004233b0
mov ecx, dword [ebp - 0x4d8]
mov edx, dword [ecx + 0x30]
cmp edx, dword [eax + 0x28]
jg 0x41857f
cmp dword [ebp - 4], 0x41b
jne 0x41860d
mov ecx, dword [ebp - 0x8f0]
call fcn.004233b0
mov ecx, dword [ebp - 0x4d8]
mov edx, dword [ecx + 0x28]
cmp edx, dword [eax + 0x30]
jge 0x41860d
cmp dword [ebp - 0x4d4], 0
je 0x4185fc
cmp dword [ebp - 4], 0x41c
jne 0x4185a5
mov eax, dword [ebp - 0x4d8]
mov ecx, dword [ebp - 0x4d4]
mov edx, dword [eax + 0x30]
cmp edx, dword [ecx + 0x30]
jg 0x4185fc
cmp dword [ebp - 4], 0x41d
jne 0x4185c2
mov eax, dword [ebp - 0x4d8]
mov ecx, dword [ebp - 0x4d4]
mov edx, dword [eax + 0x28]
cmp edx, dword [ecx + 0x28]
jl 0x4185fc
cmp dword [ebp - 4], 0x41a
jne 0x4185df
mov eax, dword [ebp - 0x4d8]
mov ecx, dword [ebp - 0x4d4]
mov edx, dword [eax + 0x34]
cmp edx, dword [ecx + 0x34]
jg 0x4185fc
cmp dword [ebp - 4], 0x41b
jne 0x418608
mov eax, dword [ebp - 0x4d8]
mov ecx, dword [ebp - 0x4d4]
mov edx, dword [eax + 0x2c]
cmp edx, dword [ecx + 0x2c]
jge 0x418608
mov eax, dword [ebp - 0x4d8]
mov dword [ebp - 0x4d4], eax
jmp 0x418757
cmp dword [ebp - 0x4d4], 0
jne 0x418757
cmp dword [ebp - 0x4cc], 0
je 0x41874b
cmp dword [ebp - 4], 0x41c
jne 0x418674
mov ecx, dword [ebp - 0x4d8]
mov edx, dword [ebp - 0x4cc]
mov eax, dword [ecx + 0x34]
cmp eax, dword [edx + 0x34]
jg 0x41874b
mov ecx, dword [ebp - 0x4d8]
mov edx, dword [ebp - 0x4cc]
mov eax, dword [ecx + 0x34]
cmp eax, dword [edx + 0x34]
jne 0x418674
mov ecx, dword [ebp - 0x4d8]
mov edx, dword [ebp - 0x4cc]
mov eax, dword [ecx + 0x30]
cmp eax, dword [edx + 0x30]
jg 0x41874b
cmp dword [ebp - 4], 0x41d
jne 0x4186c1
mov ecx, dword [ebp - 0x4d8]
mov edx, dword [ebp - 0x4cc]
mov eax, dword [ecx + 0x2c]
cmp eax, dword [edx + 0x2c]
jl 0x41874b
mov ecx, dword [ebp - 0x4d8]
mov edx, dword [ebp - 0x4cc]
mov eax, dword [ecx + 0x2c]
cmp eax, dword [edx + 0x2c]
jne 0x4186c1
mov ecx, dword [ebp - 0x4d8]
mov edx, dword [ebp - 0x4cc]
mov eax, dword [ecx + 0x28]
cmp eax, dword [edx + 0x28]
jl 0x41874b
cmp dword [ebp - 4], 0x41a
jne 0x418706
mov ecx, dword [ebp - 0x4d8]
mov edx, dword [ebp - 0x4cc]
mov eax, dword [ecx + 0x30]
cmp eax, dword [edx + 0x30]
jg 0x41874b
mov ecx, dword [ebp - 0x4d8]
mov edx, dword [ebp - 0x4cc]
mov eax, dword [ecx + 0x30]
cmp eax, dword [edx + 0x30]
jne 0x418706
mov ecx, dword [ebp - 0x4d8]
mov edx, dword [ebp - 0x4cc]
mov eax, dword [ecx + 0x34]
cmp eax, dword [edx + 0x34]
jg 0x41874b
cmp dword [ebp - 4], 0x41b
jne 0x418757
mov ecx, dword [ebp - 0x4d8]
mov edx, dword [ebp - 0x4cc]
mov eax, dword [ecx + 0x28]
cmp eax, dword [edx + 0x28]
jl 0x41874b
mov ecx, dword [ebp - 0x4d8]
mov edx, dword [ebp - 0x4cc]
mov eax, dword [ecx + 0x28]
cmp eax, dword [edx + 0x28]
jne 0x418757
mov ecx, dword [ebp - 0x4d8]
mov edx, dword [ebp - 0x4cc]
mov eax, dword [ecx + 0x2c]
cmp eax, dword [edx + 0x2c]
jge 0x418757
mov ecx, dword [ebp - 0x4d8]
mov dword [ebp - 0x4cc], ecx
jmp 0x4181e1
cmp dword [ebp - 0x4d4], 0
jne 0x41878d
mov edx, dword [ebp - 0x8f0]
xor eax, eax
mov ax, word [edx + 0xcc]
and eax, 1
test eax, eax
jne 0x4187ed
cmp dword [ebp - 0x4cc], 0
jne 0x41878d
cmp dword [ebp - 0x4d0], 0
je 0x4187ed
cmp dword [ebp - 0x4d4], 0
je 0x4187a4
mov ecx, dword [ebp - 0x4d4]
mov dword [ebp - 0xa08], ecx
jmp 0x4187d3
cmp dword [ebp - 0x4cc], 0
je 0x4187bb
mov edx, dword [ebp - 0x4cc]
mov dword [ebp - 0xa0c], edx
jmp 0x4187c7
mov eax, dword [ebp - 0x4d0]
mov dword [ebp - 0xa0c], eax
mov ecx, dword [ebp - 0xa0c]
mov dword [ebp - 0xa08], ecx
mov edx, dword [ebp - 0xa08]
push edx
mov eax, dword [ebp - 0x8f0]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x8f0]
call dword [edx + 0x2c]
jmp 0x4187ff
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x8f0]
call fcn.0042f7f7
mov dword [ebp - 4], eax
jmp 0x418813
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x8f0]
call fcn.0042f7f7
mov dword [ebp - 4], eax
jmp 0x418989
mov edx, dword [ebp - 0x8f0]
cmp dword [edx + 0x128], 0
je 0x41885c
push 0
push 0x3ea
lea ecx, [ebp - 0x8ec]
call fcn.0040abe5
push eax
mov eax, dword [ebp - 0x8f0]
mov ecx, dword [eax + 0x128]
mov edx, dword [ebp - 0x8f0]
mov eax, dword [edx + 0x128]
mov edx, dword [eax]
call dword [edx + 0x10]
mov dword [ebp - 4], eax
jmp 0x418863
mov dword [ebp - 4], 0xfffffffe
jmp 0x418989
mov eax, dword [ebp + 8]
cmp dword [eax], 1
jne 0x418928
mov ecx, dword [ebp - 0x8f0]
xor edx, edx
mov dx, word [ecx + 0x22]
and edx, 0x4000
test edx, edx
je 0x418928
mov eax, dword [ebp - 0x8f0]
cmp dword [eax + 0x48], 0
jne 0x418928
mov ecx, dword [ebp - 0x8f0]
cmp dword [ecx + 0x134], 0
je 0x4188be
mov edx, dword [ebp - 0x8f0]
mov eax, dword [edx + 0x1c]
mov dword [ebp - 0xa10], eax
jmp 0x4188c8
mov dword [ebp - 0xa10], 0
mov ecx, dword [ebp - 0x8f0]
cmp dword [ecx + 0x134], 0
je 0x4188eb
mov edx, dword [ebp - 0x8f0]
mov eax, dword [edx + 0x134]
mov dword [ebp - 0xa14], eax
jmp 0x4188fa
mov ecx, dword [ebp - 0x8f0]
mov edx, dword [ecx + 0x1c]
mov dword [ebp - 0xa14], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x18]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x10]
push edx
mov eax, dword [ebp - 0xa10]
push eax
mov ecx, dword [ebp - 0xa14]
push ecx
call dword [sym.imp.USER32.dll_DefFrameProcA]
mov dword [ebp - 4], eax
jmp 0x418989
mov edx, dword [ebp + 8]
cmp dword [edx], 1
je 0x41896e
mov eax, dword [ebp - 0x8f0]
cmp dword [eax + 0xc8], 0
je 0x41896e
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x8f0]
call fcn.004233b0
mov dword [ebp - 0xa18], eax
mov edx, dword [ebp - 0xa18]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xa18]
call dword [eax + 0x10]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xfffffffe
jne 0x418982
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x8f0]
call fcn.0042f7f7
mov dword [ebp - 4], eax
jmp 0x418989
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 4]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4