Function at 0x40dca7
Capabilities:
Check for foreground window switch
Check for software breakpoints
Check for time delay via gettickcount
Hide graphical window
Log keystrokes via polling
Set current directory

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x130
push ebx
xor ebx, ebx
push esi
xor esi, esi
inc ebx
cmp dword [ebp + 0x7c], 2
push edi
mov byte [ebp + 0x67], 0
jne 0x40dcd9
cmp byte [0x4663a5], 0
mov dword [ebp + 0x7c], ebx
jne 0x40dcd9
mov byte [0x4663a5], bl
mov byte [ebp + 0x67], bl
cmp dword [0x4671f0], esi
je 0x40dcec
push esi
mov ecx, 0x4671d8
call fcn.0044310a
cmp dword [ebp + 0x78], 0x8000012f
push 0xa
pop edi
jne 0x40dd01
mov dword [ebp + 0x78], edi
mov byte [ebp + 0x34], 1
jmp 0x40dd0f
cmp dword [ebp + 0x78], 5
setle byte [ebp + 0x34]
cmp byte [ebp + 0x34], 0
je 0x40dd14
mov dword [ebp + 0x14], esi
jmp 0x40dd1d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp + 0x14], eax
cmp dword [0x4683dc], esi
je 0x40dd2a
call fcn.0040edab
cmp dword [0x467158], esi
mov byte [ebp + 0x6f], 0
je 0x40dd43
call fcn.0040db25
test al, al
je 0x40dd43
mov byte [ebp + 0x6f], 1
cmp dword [ebp + 0x78], esi
jle 0x40df18
cmp dword [ebp + 0x7c], ebx
jne 0x40df18
inc dword [0x4663b4]
cmp byte [0x46639f], 0
mov byte [ebp + 0x66], 1
jne 0x40dd82
push esi
push edi
push 9
push dword [0x466254]
call dword [sym.imp.USER32.dll_SetTimer]
test eax, eax
setne al
mov byte [0x46639f], al
mov ebx, dword [ebp + 0x78]
mov byte [ebp + 0x64], 0
mov byte [ebp + 0x65], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
cmp dword [ebp + 0x78], 0
mov edi, eax
jle 0x40df21
cmp byte [ebp + 0x65], 0
jne 0x40df21
cmp byte [0x4663a5], 0
jne 0x40df2e
call fcn.0040dc45
neg eax
sbb eax, eax
and eax, 0xfffffcef
add eax, 0x311
push eax
push 0
push 0
lea eax, [ebp + 0x40]
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
cmp eax, 0xffffffff
je 0x40dd8d
call esi
mov ecx, eax
sub ecx, edi
cmp ecx, 3
jbe 0x40ddef
mov dword [0x4671a8], eax
cmp dword [0x466b64], 0
je 0x40de1c
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp + 0x40]
push eax
push dword [ebp + 0x4c]
push dword [ebp + 0x48]
push dword [ebp + 0x44]
push dword [ebp + 0x40]
call fcn.0040d776
add esp, 0x18
test al, al
jne 0x40dd8d
cmp dword [0x46a3fc], 0
je 0x40e28d
mov eax, dword [ebp + 0x40]
test eax, eax
je 0x40e28d
cmp eax, dword [0x466254]
je 0x40e28d
cmp dword [ebp + 0x44], 0x414
je 0x40e28d
cmp dword [ebp + 0x44], 0x402
je 0x40e28d
cmp dword [ebp + 0x44], 0x100
jne 0x40e22a
mov eax, dword [ebp + 0x48]
cmp eax, 0x22
je 0x40de87
cmp eax, 0x21
je 0x40de87
cmp eax, 9
je 0x40de87
cmp eax, 0x25
je 0x40de87
cmp eax, 0x27
jne 0x40e15b
call dword [sym.imp.USER32.dll_GetFocus]
mov esi, eax
test esi, esi
je 0x40e15b
push esi
call fcn.0043b3dd
test eax, eax
pop ecx
je 0x40e15b
push eax
call fcn.0043226b
mov ebx, eax
test ebx, ebx
pop ecx
je 0x40e15b
cmp byte [ebx + 0x54], 0
je 0x40e15b
push 0
push esi
mov ecx, ebx
call fcn.0043220c
mov edi, eax
test edi, edi
mov dword [ebp + 0x68], edi
je 0x40e15b
mov al, byte [edi + 4]
cmp al, 0xf
je 0x40e15b
xor esi, esi
cmp al, 0x13
mov eax, dword [ebp + 0x48]
jne 0x40e0db
cmp eax, 0x25
mov esi, edi
je 0x40df00
cmp eax, 0x27
jne 0x40e0db
cmp eax, 0x27
sete al
push 0
push 0
push eax
push edi
mov ecx, ebx
call fcn.004358d7
jmp 0x40dd8d
mov byte [ebp + 0x66], 0
jmp 0x40dd82
cmp byte [0x4663a5], 0
je 0x40e058
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
test esi, esi
je 0x40e058
push 0
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [0x466c9c]
jne 0x40e058
cmp dword [0x4663d8], 0
je 0x40df84
push 0x20
lea eax, [ebp - 0x40]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClassNameA]
lea eax, [ebp - 0x40]
push str.32770
push eax
call fcn.00457260
neg eax
sbb al, al
pop ecx
inc al
pop ecx
mov byte [ebp + 0x3f], al
jne 0x40dfbe
call dword [sym.imp.USER32.dll_GetFocus]
test eax, eax
je 0x40e058
push 0x20
lea ecx, [ebp - 0x40]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetClassNameA]
lea eax, [ebp - 0x40]
push str.SysTreeView32
push eax
call fcn.00441ec1
neg eax
sbb al, al
pop ecx
inc al
pop ecx
mov byte [ebp + 0x3f], al
je 0x40e058
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
xor eax, eax
push eax
push 0x1ff
push eax
push eax
lea eax, [ebp + 0x40]
push eax
call esi
test eax, eax
jne 0x40dffd
push 1
call fcn.0040dc45
neg eax
sbb eax, eax
and eax, 0xfffffcef
add eax, 0x311
push eax
push 0x20e
push 0
lea eax, [ebp + 0x40]
push eax
call esi
jmp 0x40e07c
mov esi, dword [ebp + 0x50]
push 0
call fcn.0040dc45
neg eax
sbb eax, eax
and eax, 0xfffffcef
add eax, 0x311
push eax
push 0x20e
push 0
lea eax, [ebp + 0x40]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
push 1
je 0x40e036
mov eax, dword [ebp + 0x50]
sub eax, esi
test eax, eax
jle 0x40e03d
push 0x1ff
jmp 0x40e06e
call fcn.0040dc45
neg eax
sbb eax, eax
and eax, 0xfffffcef
add eax, 0x311
push eax
push 0x20e
jmp 0x40e070
push 1
call fcn.0040dc45
neg eax
sbb eax, eax
and eax, 0xfffffcef
add eax, 0x311
push eax
push 0
lea eax, [ebp + 0x40]
push 0
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
xor esi, esi
cmp eax, esi
jne 0x40ddef
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, edi
cmp ecx, 3
jbe 0x40e09a
mov dword [0x4671a8], eax
cmp dword [ebp + 0x78], esi
jne 0x40e0b5
cmp byte [ebp + 0x64], 0
jne 0x40e0b5
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [ebp + 0x64], 1
jmp 0x40dd8d
push dword [ebp + 0x34]
push dword [ebp + 0x14]
push dword [ebp + 0x78]
call fcn.0040ed6a
add esp, 0xc
test eax, eax
jne 0x40ed21
push 5
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40dd8d
cmp eax, 0x25
je 0x40e15b
cmp eax, 0x27
je 0x40e15b
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, ah
jns 0x40e15b
cmp dword [ebp + 0x48], 9
jne 0x40e10b
cmp byte [edi + 4], 0xc
jne 0x40e10b
push 0xfffffffffffffff0
push dword [edi]
call dword [sym.imp.USER32.dll_GetWindowLongA]
test al, 4
jne 0x40e15b
test esi, esi
jne 0x40e130
xor eax, eax
mov al, byte [edi + 6]
mov ecx, ebx
push eax
call fcn.00432861
mov esi, eax
test esi, esi
jne 0x40e130
push eax
mov ecx, ebx
call fcn.00432861
mov esi, eax
test esi, esi
je 0x40e15b
cmp dword [ebp + 0x48], 0x22
je 0x40e14c
cmp dword [ebp + 0x48], 9
jne 0x40e148
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, ah
jns 0x40e14c
xor al, al
jmp 0x40e150
xor eax, eax
mov al, 1
push 1
push 1
push eax
push esi
jmp 0x40df0c
cmp dword [ebp + 0x48], 0x1b
je 0x40e181
cmp dword [ebp + 0x48], 9
je 0x40e181
cmp dword [ebp + 0x48], 0x41
jne 0x40e204
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, ah
jns 0x40e204
call dword [sym.imp.USER32.dll_GetFocus]
mov esi, eax
test esi, esi
je 0x40e204
push esi
call fcn.0043b3dd
test eax, eax
pop ecx
je 0x40e204
push eax
call fcn.0043226b
mov ebx, eax
test ebx, ebx
pop ecx
je 0x40e204
push 0
push esi
mov ecx, ebx
call fcn.0043220c
test eax, eax
mov dword [ebp + 0x68], eax
je 0x40e204
cmp byte [eax + 4], 0xc
jne 0x40e204
cmp dword [ebp + 0x48], 0x1b
je 0x40e1f8
cmp dword [ebp + 0x48], 0x41
je 0x40e1dc
test byte [eax + 5], 0x80
je 0x40e204
push 0x4595e4
push 1
push 0xc2
jmp 0x40e1eb
test byte [eax + 5], 2
jne 0x40e204
push 0xffffffffffffffff
push 0
push 0xb1
push dword [eax]
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x40dd8d
mov ecx, ebx
call fcn.00431fa1
jmp 0x40dd8d
mov eax, dword [0x46a400]
xor ecx, ecx
cmp eax, ecx
je 0x40e22a
cmp dword [ebp + 0x48], 0xd
jne 0x40e219
push ecx
push ecx
jmp 0x40e222
cmp dword [ebp + 0x48], 0x1b
jne 0x40e22a
push ecx
push 1
push 0x1116
push eax
jmp 0x40e1ed
xor edi, edi
mov esi, 0x466980
mov eax, dword [esi]
test eax, eax
je 0x40e282
cmp dword [eax], 0
je 0x40e279
mov eax, dword [0x464108]
mov byte [eax + 0xbc], 1
mov eax, dword [ebp + 0x44]
mov ecx, dword [0x464108]
mov dword [ecx + 0xb8], eax
lea eax, [ebp + 0x40]
push eax
mov eax, dword [esi]
push dword [eax]
call dword [sym.imp.USER32.dll_IsDialogMessageA]
test eax, eax
jne 0x40e397
mov eax, dword [0x464108]
mov byte [eax + 0xbc], 0
inc edi
cmp dword [0x46a3fc], edi
je 0x40e28d
add esi, 4
cmp esi, 0x466b0c
jl 0x40e231
mov ecx, dword [ebp + 0x44]
mov eax, 0x312
cmp ecx, eax
ja 0x40e3f9
je 0x40e43c
mov eax, ecx
sub eax, 0x12
je 0x40e3e4
sub eax, 0x39
je 0x40e3d4
sub eax, 0xb5
je 0x40e3a8
sub eax, 0x13
jne 0x40e767
xor esi, esi
cmp dword [ebp + 0x4c], esi
jne 0x40e767
mov eax, dword [0x466254]
cmp dword [ebp + 0x40], eax
jne 0x40e767
cmp dword [0x4683dc], esi
je 0x40e2f1
call fcn.0040edab
cmp dword [0x467158], esi
je 0x40e306
call fcn.0040db25
test al, al
je 0x40e306
mov byte [ebp + 0x6f], 1
cmp dword [ebp + 0x7c], esi
je 0x40dd8d
cmp dword [ebp + 0x78], 1
jl 0x40dd8d
push dword [ebp + 0x34]
push dword [ebp + 0x14]
push dword [ebp + 0x78]
call fcn.0040ed6a
add esp, 0xc
test eax, eax
je 0x40dd8d
cmp byte [ebp + 0x67], 0
je 0x40e33f
mov byte [0x4663a5], 0
cmp byte [ebp + 0x66], 0
je 0x40e38c
dec dword [0x4663b4]
xor eax, eax
cmp dword [ebp + 0x78], eax
jle 0x40e38c
cmp dword [0x4663b4], eax
jne 0x40e38c
cmp dword [0x467158], eax
jne 0x40e38c
cmp dword [0x4683dc], eax
jne 0x40e38c
cmp byte [0x46639f], 0
je 0x40e38c
push 9
push dword [0x466254]
call dword [sym.imp.USER32.dll_KillTimer]
test eax, eax
je 0x40e38c
mov byte [0x46639f], 0
mov al, byte [ebp + 0x6f]
pop edi
pop esi
pop ebx
add ebp, 0x70
leave
ret
mov eax, dword [0x464108]
mov byte [eax + 0xbc], 0
jmp 0x40dd8d
mov eax, dword [ebp + 0x40]
cmp eax, dword [0x466258]
jne 0x40e767
cmp dword [ebp + 0x48], 0x1b
jne 0x40e767
push 0
push dword [0x466254]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x40dd8d
and dword [0x466390], 0
mov byte [ebp + 0x65], 1
jmp 0x40dd8d
push 0
push 0
push 6
mov ecx, 0x466ce0
call fcn.00417a6f
jmp 0x40dd8d
cmp ecx, 0x400
jb 0x40e767
cmp ecx, 0x401
jbe 0x40e429
cmp ecx, 0x402
je 0x40e43c
cmp ecx, 0x414
je 0x40e43c
cmp ecx, 0x415
jne 0x40e767
mov eax, dword [ebp + 0x40]
test eax, eax
je 0x40e43c
cmp eax, dword [0x466254]
jne 0x40e767
mov eax, ecx
xor esi, esi
xor edi, edi
sub eax, 0x401
je 0x40e618
dec eax
je 0x40e5f3
sub eax, 0x12
je 0x40e4af
dec eax
je 0x40e4a5
mov eax, dword [0x465200]
movzx eax, word [eax]
cmp dword [ebp + 0x48], eax
jae 0x40dd8d
mov eax, dword [ebp + 0x48]
mov ecx, dword [eax*4 + 0x467428]
lea eax, [ebp + 0x30]
push eax
mov dword [ebp + 0x10], ecx
call fcn.0041189f
test eax, eax
mov dword [ebp + 0x20], eax
je 0x40dd8d
mov ecx, eax
mov al, byte [ecx + 0x18]
cmp al, 1
je 0x40e49e
cmp al, 3
je 0x40e49e
and dword [ebp + 0x30], edi
mov eax, dword [ecx]
jmp 0x40e68a
mov eax, dword [0x467140]
jmp 0x40e68a
push dword [ebp + 0x40]
call fcn.0043226b
mov ebx, eax
cmp ebx, esi
pop ecx
je 0x40e767
mov eax, dword [ebx + 8]
mov ecx, dword [ebp + 0x48]
mov edx, dword [ebp + 0x4c]
mov dword [ebp + 4], eax
movzx eax, cx
shr ecx, 0x10
cmp eax, 8
mov dword [ebp + 0x5c], edx
mov dword [ebp + 0x18], eax
mov dword [ebp + 0xc], ecx
jne 0x40e4f0
mov dword [ebp + 0x5c], ecx
mov ecx, 0x2af8
mov dword [ebp + 8], edx
mov dword [ebp + 0xc], ecx
cmp ecx, dword [ebx + 0xc]
jae 0x40e503
mov edx, dword [ebx + 0x14]
lea ecx, [ecx + ecx*4]
lea ecx, [edx + ecx*4]
mov dword [ebp + 0x68], ecx
jmp 0x40e506
mov dword [ebp + 0x68], esi
sub eax, 5
mov dword [ebp + 0x2c], esi
mov byte [ebp + 0x63], 0
je 0x40e5aa
dec eax
je 0x40e597
dec eax
je 0x40e581
dec eax
je 0x40e56e
dec eax
je 0x40e55e
cmp dword [ebp + 0x68], esi
je 0x40dd8d
mov eax, dword [ebp + 0x68]
mov ecx, dword [eax + 0xc]
test ecx, ecx
mov dword [ebp + 0x38], ecx
jne 0x40e54e
test byte [eax + 5], 1
je 0x40dd8d
mov ecx, ebx
call fcn.0042edfa
jmp 0x40dd8d
test byte [eax + 5], 4
jne 0x40dd8d
mov byte [ebp + 0x63], 1
jmp 0x40e5d3
mov eax, dword [ebx + 0x2c]
cmp eax, esi
mov dword [ebp + 0x38], eax
je 0x40dd8d
jmp 0x40e5d3
mov eax, dword [ebx + 0x24]
cmp eax, esi
mov dword [ebp + 0x38], eax
je 0x40dd8d
lea eax, [ebx + 0x32]
jmp 0x40e592
mov eax, dword [ebx + 0x20]
cmp eax, esi
mov dword [ebp + 0x38], eax
je 0x40dd8d
lea eax, [ebx + 0x31]
mov dword [ebp + 0x2c], eax
jmp 0x40e5d3
mov eax, dword [ebx + 0x1c]
cmp eax, esi
mov dword [ebp + 0x38], eax
je 0x40dd8d
lea eax, [ebx + 0x30]
jmp 0x40e592
mov eax, dword [ebx + 0x28]
cmp eax, esi
mov edi, dword [ebx + 0x6c]
mov dword [ebp + 0x38], eax
je 0x40e5db
cmp edi, esi
je 0x40dd8d
xor esi, esi
push esi
push esi
push 0xffffffffffffffff
push edi
call dword [sym.imp.SHELL32.dll_DragQueryFileA]
cmp eax, esi
mov dword [ebp + 0x5c], eax
je 0x40e5db
mov eax, dword [ebp + 0x38]
jmp 0x40e68a
cmp edi, esi
je 0x40dd8d
push edi
call dword [sym.imp.SHELL32.dll_DragFinish]
and dword [ebx + 0x6c], 0
jmp 0x40dd8d
push dword [ebp + 0x4c]
mov ecx, 0x466ce0
call fcn.0043673e
cmp eax, esi
mov dword [ebp + 0x24], eax
je 0x40dd8d
mov eax, dword [eax + 0xc]
test eax, eax
je 0x40dd8d
jmp 0x40e68a
mov eax, dword [ebp + 0x48]
cmp eax, dword [0x4683e4]
jae 0x40dd8d
mov eax, dword [0x4683e0]
mov ecx, dword [ebp + 0x48]
mov esi, dword [eax + ecx*4]
xor eax, eax
mov al, byte [esi + 0x20]
test al, al
mov dword [ebp + 0x28], esi
je 0x40e663
push dword [esi + 0x10]
push dword [esi + 0xc]
push eax
call fcn.0040fb9a
add esp, 0xc
test eax, eax
mov dword [ebp + 0x30], eax
je 0x40dd8d
mov al, byte [esi + 0x20]
cmp al, 1
je 0x40e667
cmp al, 3
je 0x40e667
and dword [ebp + 0x30], 0
push dword [ebp + 0x4c]
mov ecx, esi
call fcn.0040f80a
mov eax, dword [esi + 8]
cmp byte [eax], 0
jne 0x40dd8d
mov al, byte [ebp + 0x4c]
mov byte [0x467170], al
mov eax, dword [ebp + 0x28]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edx, dword [0x4663b8]
mov ecx, dword [0x46407c]
cmp edx, ecx
mov al, byte [eax]
mov byte [ebp + 0x1c], al
jl 0x40e6d1
add ecx, 2
cmp edx, ecx
jge 0x40e810
cmp al, 0xd6
je 0x40e6d1
cmp al, 0xc2
je 0x40e6d1
cmp al, 0xd0
je 0x40e6d1
cmp al, 0xd1
je 0x40e6d1
cmp al, 0xcc
je 0x40e6d1
cmp al, 0xcd
je 0x40e6d1
cmp al, 0xce
je 0x40e6d1
cmp al, 0xcf
jne 0x40e810
mov eax, dword [ebp + 0x44]
sub eax, 0x401
je 0x40e800
dec eax
je 0x40e72f
sub eax, 0x12
je 0x40e723
dec eax
je 0x40e70f
push dword [ebp + 0x20]
mov ecx, dword [ebp + 0x10]
call fcn.004117ba
test al, al
jne 0x40e707
push dword [ebp + 0x20]
call fcn.004117f7
pop ecx
jmp 0x40dd8d
mov eax, dword [ebp + 0x20]
jmp 0x40e803
cmp byte [0x46713c], 0
jne 0x40dd8d
xor esi, esi
jmp 0x40e806
mov eax, dword [ebp + 0x2c]
test eax, eax
je 0x40e71c
cmp byte [eax], 0
jmp 0x40e716
mov eax, dword [ebp + 0x24]
mov esi, dword [eax + 0x18]
mov eax, dword [ebp + 0x48]
cmp eax, 0x63
jae 0x40e7fc
mov ebx, dword [eax*4 + 0x466980]
test ebx, ebx
jne 0x40e806
cmp dword [ebp + 0x40], ebx
je 0x40e806
mov eax, dword [0x466254]
cmp dword [ebp + 0x40], eax
je 0x40e806
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
test esi, esi
je 0x40eccc
push 0
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [0x466c9c]
jne 0x40eccc
push 0x20
lea eax, [ebp - 0x40]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClassNameA]
lea eax, [ebp - 0x40]
push str.32770
push eax
call fcn.00457260
test eax, eax
pop ecx
pop ecx
jne 0x40eccc
mov eax, dword [0x464108]
mov byte [eax + 0xbc], 1
mov eax, dword [ebp + 0x44]
mov ecx, dword [0x464108]
mov dword [ecx + 0xb8], eax
lea eax, [ebp + 0x40]
push eax
push esi
call dword [sym.imp.USER32.dll_IsDialogMessageA]
test eax, eax
je 0x40ecc0
cmp dword [0x4663d8], 0
je 0x40e397
push 0x466b80
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
jmp 0x40e397
xor ebx, ebx
jmp 0x40e806
mov eax, dword [ebp + 0x28]
mov esi, dword [eax + 0x14]
mov eax, dword [0x464108]
cmp esi, dword [eax + 0x2c]
jge 0x40e817
test edi, edi
jmp 0x40e5dd
cmp dword [ebp + 0x44], 0x402
mov byte [ebp + 0x6f], 1
je 0x40e874
cmp dword [ebp + 0x44], 0x413
jbe 0x40e836
cmp dword [ebp + 0x44], 0x415
jbe 0x40e89f
cmp dword [ebp + 0x44], 0x401
mov eax, dword [0x467130]
mov dword [0x467134], eax
mov eax, dword [0x467168]
mov dword [0x46716c], eax
jne 0x40e85c
mov eax, dword [ebp + 0x28]
mov eax, dword [eax]
mov eax, dword [eax]
jmp 0x40e862
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 4]
mov dword [0x467130], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x467168], eax
jmp 0x40e89f
mov eax, dword [ebp + 0x24]
mov edi, 0x105
push edi
push dword [eax]
push 0x466f24
call fcn.004392af
mov eax, dword [ebp + 0x24]
mov eax, dword [eax + 0x14]
push edi
push dword [eax]
push 0x467029
call fcn.004392af
add esp, 0x18
mov ecx, dword [0x466b78]
xor edi, edi
push 0x80
inc edi
push edi
call fcn.00401e91
push eax
lea eax, [ebp - 0xc0]
push eax
call fcn.004392af
push dword [ebp + 0x1c]
push edi
push 0
push esi
call fcn.0040da3f
mov esi, dword [0x464108]
add esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4671ac], eax
mov dword [0x4671a8], eax
mov eax, dword [ebp + 0x44]
sub eax, 0x401
je 0x40ec72
dec eax
je 0x40ec4d
sub eax, 0x12
je 0x40e98d
dec eax
je 0x40e930
mov ecx, dword [ebp + 0x10]
mov al, byte [ecx + 0x12]
cmp al, 0x9c
jb 0x40e91a
cmp al, 0x9f
ja 0x40e91a
mov eax, dword [ebp + 0x4c]
mov dword [esi + 0x38], eax
mov eax, dword [ebp + 0x30]
push dword [ebp + 0x20]
mov dword [esi + 0x9c], eax
call fcn.00411994
jmp 0x40ec83
call dword [sym.imp.USER32.dll_CountClipboardFormats]
test eax, eax
je 0x40e95a
mov edi, dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
push 1
call edi
test eax, eax
jne 0x40e955
push 0xf
call edi
test eax, eax
jne 0x40e955
push 2
pop eax
jmp 0x40e95c
xor eax, eax
inc eax
jmp 0x40e95c
xor eax, eax
push 0x18
push 0
mov dword [esi + 0x38], eax
mov ecx, dword [0x466b78]
push eax
call fcn.00401c4f
mov ecx, dword [0x467140]
mov byte [0x46713c], 1
call fcn.00406481
mov byte [0x46713c], 0
jmp 0x40ec83
mov ecx, dword [ebp + 0x18]
push 5
pop edi
cmp ecx, edi
mov byte [ebp - 0xc], 0
je 0x40eb54
jbe 0x40ead6
cmp ecx, 8
jbe 0x40ea7b
cmp ecx, 9
jne 0x40ead6
xor ecx, ecx
xor eax, eax
cmp dword [ebp + 0x5c], eax
lea edi, [esi + 0x3c]
sete cl
cmp dword [ebp + 0x68], eax
mov dword [ebp + 0x5c], eax
lea ecx, [ecx + ecx + 1]
mov dword [esi + 0x34], ecx
mov ecx, dword [ebp + 0x54]
mov dword [edi], ecx
mov ecx, dword [ebp + 0x58]
mov dword [edi + 4], ecx
je 0x40ea6c
cmp dword [esi + 0x34], 1
jne 0x40e9f3
push edi
push dword [ebp + 0x68]
mov ecx, ebx
call fcn.0042f7b9
mov eax, dword [ebp + 0x68]
movzx eax, byte [eax + 4]
sub eax, 9
je 0x40ea54
dec eax
je 0x40ea49
dec eax
jne 0x40ea6c
cmp dword [esi + 0x34], 1
jne 0x40ea16
push 0
push 9
push 0x110a
jmp 0x40ea3c
mov eax, dword [ebp + 0x54]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x58]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp + 0x68]
push dword [eax]
call dword [sym.imp.USER32.dll_ScreenToClient]
lea eax, [ebp - 0x1c]
push eax
push 0
push 0x1111
mov eax, dword [ebp + 0x68]
push dword [eax]
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x40ea69
push 1
push 0xffffffffffffffff
push 0x100c
jmp 0x40ea5d
push 0
push 0
push 0x19f
mov eax, dword [ebp + 0x68]
push dword [eax]
call dword [sym.imp.USER32.dll_SendMessageA]
inc eax
mov dword [ebp + 0x5c], eax
push dword [ebx]
push edi
call fcn.0043904e
pop ecx
pop ecx
jmp 0x40eb9b
cmp ecx, 8
mov dword [esi + 0x34], 1
jne 0x40eb93
mov eax, dword [ebp + 8]
mov dword [esi + 0x3c], eax
mov ecx, dword [0x466b78]
push 0x18
push 0
push dword [ebp + 0x5c]
call fcn.00401c4f
mov eax, dword [ebx]
mov edi, dword [ebp + 0xc]
mov dword [esi + 0x9c], eax
mov eax, dword [ebx + 8]
mov dword [esi + 0x44], eax
mov eax, dword [ebx + 8]
mov dword [esi + 0x4c], eax
mov eax, dword [ebp + 0x5c]
mov dword [esi + 0x38], eax
mov eax, dword [ebp + 0x2c]
test eax, eax
mov dword [esi + 0x48], edi
je 0x40ebb5
mov byte [eax], 1
jmp 0x40ebc2
mov eax, dword [ebp + 0x68]
mov al, byte [eax + 4]
cmp al, 0xa
je 0x40eb01
cmp al, 0x15
jne 0x40eb4f
mov ecx, dword [ebp + 0x54]
lea eax, [esi + 0x3c]
mov dword [eax], ecx
mov ecx, dword [ebp + 0x58]
mov dword [eax + 4], ecx
push dword [ebx]
push eax
call fcn.0043904e
pop ecx
pop ecx
mov ecx, dword [ebp + 0x18]
jmp 0x40eb4f
cmp cl, 0x49
jne 0x40eb4f
test ch, 1
lea eax, [ebp - 0xc]
je 0x40eb14
mov byte [ebp - 0xc], 0x53
jmp 0x40eb1d
test ch, 2
je 0x40eb20
mov byte [ebp - 0xc], 0x73
lea eax, [ebp - 0xb]
test ch, 4
je 0x40eb2a
mov byte [eax], 0x46
jmp 0x40eb32
test ch, 8
je 0x40eb33
mov byte [eax], 0x66
inc eax
test ch, 0x10
je 0x40eb3d
mov byte [eax], 0x43
jmp 0x40eb45
test ch, 0x20
je 0x40eb46
mov byte [eax], 0x63
inc eax
push 0x49
pop ecx
mov byte [eax], 0
mov dword [ebp + 0x18], ecx
mov dword [esi + 0x34], ecx
jmp 0x40eb8a
mov dword [esi + 0x34], edi
mov ecx, dword [ebp + 0x54]
lea eax, [esi + 0x3c]
mov dword [eax], ecx
mov ecx, dword [ebp + 0x58]
mov dword [eax + 4], ecx
push dword [ebx]
push eax
call fcn.0043904e
pop ecx
pop ecx
push 0xffffffffffffffec
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowLongA]
and eax, 0xffffffef
push eax
push 0xffffffffffffffec
push dword [ebx]
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov ecx, dword [ebp + 0x18]
cmp ecx, 8
je 0x40ea91
cmp ecx, edi
je 0x40ea91
mov ecx, dword [0x466b78]
push 1
push 0
push 0xffffffffffffffff
lea eax, [ebp - 0xc]
push eax
call fcn.0040187e
jmp 0x40eaa3
cmp byte [ebp + 0x63], 0
je 0x40ebc2
mov eax, dword [ebp + 0x68]
or byte [eax + 5], 4
mov ecx, dword [ebp + 0x38]
call fcn.00406481
mov eax, dword [ebp + 4]
mov ebx, dword [eax*4 + 0x466980]
test ebx, ebx
je 0x40ec83
cmp edi, dword [ebx + 0xc]
jae 0x40ebec
mov ecx, dword [ebx + 0x14]
lea eax, [edi + edi*4]
lea ecx, [ecx + eax*4]
jmp 0x40ebee
xor ecx, ecx
mov eax, dword [ebp + 0x18]
sub eax, 5
mov dword [ebp + 0x68], ecx
je 0x40ec21
dec eax
je 0x40ec1b
dec eax
je 0x40ec15
dec eax
je 0x40ec0f
dec eax
je 0x40ec83
test ecx, ecx
je 0x40ec83
and byte [ecx + 5], 0xfb
jmp 0x40ec83
mov byte [ebx + 0x32], 0
jmp 0x40ec83
mov byte [ebx + 0x31], 0
jmp 0x40ec83
mov byte [ebx + 0x30], 0
jmp 0x40ec83
mov eax, dword [ebx + 0x6c]
test eax, eax
je 0x40ec33
push eax
call dword [sym.imp.SHELL32.dll_DragFinish]
and dword [ebx + 0x6c], 0
push 0xffffffffffffffec
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowLongA]
or eax, 0x10
push eax
push 0xffffffffffffffec
push dword [ebx]
call dword [sym.imp.USER32.dll_SetWindowLongA]
jmp 0x40ec83
test ebx, ebx
je 0x40ec65
mov eax, dword [ebx]
mov dword [esi + 0x9c], eax
mov dword [esi + 0x34], edi
mov eax, dword [ebx + 8]
mov dword [esi + 0x4c], eax
mov dword [esi + 0x44], eax
mov eax, dword [ebp + 0x24]
mov ecx, dword [eax + 0xc]
call fcn.00406481
jmp 0x40ec83
mov eax, dword [ebp + 0x30]
mov ecx, dword [ebp + 0x28]
mov dword [esi + 0x9c], eax
call fcn.0040fabc
lea eax, [ebp - 0xc0]
push eax
call fcn.0040da0d
cmp dword [ebp + 0x7c], 0
pop ecx
je 0x40dd8d
push dword [ebp + 0x34]
push dword [ebp + 0x14]
push dword [ebp + 0x78]
call fcn.0040ed6a
add esp, 0xc
test eax, eax
je 0x40dd8d
mov byte [ebp + 0x65], 1
mov byte [ebp + 0x34], 1
jmp 0x40dd8d
mov eax, dword [0x464108]
mov byte [eax + 0xbc], 0
mov eax, dword [0x466264]
test eax, eax
je 0x40ecee
lea ecx, [ebp + 0x40]
push ecx
push eax
push dword [0x466254]
call dword [sym.imp.USER32.dll_TranslateAcceleratorA]
test eax, eax
jne 0x40dd8d
mov eax, dword [0x464108]
mov byte [eax + 0xbc], 1
mov eax, dword [0x464108]
mov ecx, dword [ebp + 0x44]
mov dword [eax + 0xb8], ecx
lea eax, [ebp + 0x40]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp + 0x40]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x40e397
cmp byte [ebp + 0x67], 0
je 0x40ed2e
mov byte [0x4663a5], 0
cmp byte [ebp + 0x66], 0
je 0x40e38c
dec dword [0x4663b4]
cmp dword [ebp + 0x78], esi
jle 0x40e38c
cmp dword [0x4663b4], esi
jne 0x40e38c
cmp dword [0x467158], esi
jne 0x40e38c
cmp dword [0x4683dc], esi
jmp 0x40e368