Function at 0x412740
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x572c40]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
push dword [ebx + 4]
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x2c], ebx
call fcn.0040a8d0
add esp, 4
cmp eax, 0xffffffff
je 0x412780
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4131ed
cmp byte [edi + 0x6d4], 0
je 0x4127e8
push 0x2d20
call fcn.004817a0
push 0x2740
mov ebx, eax
push edi
push ebx
call fcn.00482d10
mov esi, dword [ebp - 0x2c]
lea edi, [ebx + 0x2740]
mov al, byte [ebp + 0x10]
add esp, 0x10
mov ecx, 0x174
rep movsd dword es:[edi], dword [esi]
mov byte [ebx + 0x2d1c], al
mov eax, dword [ebp + 0x14]
mov dword [ebx + 0x2d10], eax
lea eax, [ebp - 0x40]
push eax
push 0
push ebx
push 0x411980
push 0
push 0
mov byte [ebx + 0x6d4], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x4131e6
cmp byte [edi + 0x70a], 0
je 0x412813
push 0
push 0
push 0x10
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_PostMessageA]
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00481761
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x14]
and eax, 0xfffffffe
cmp byte [edi + 0x6e5], 0
cmovne eax, dword [ebp + 0x14]
mov ecx, eax
and ecx, 0xfffffffd
cmp byte [edi + 0x6f3], 0
cmovne ecx, eax
mov eax, ecx
and eax, 0xfffffffb
cmp byte [edi + 0x703], 0
cmovne eax, ecx
mov ecx, eax
and ecx, 0xfffffff7
cmp byte [edi + 0x708], 0
cmovne ecx, eax
mov edx, ecx
and edx, 0xffffffef
cmp byte [edi + 0x272c], 0
cmovne edx, ecx
cmp byte [edi + 0x6f1], 0
mov dword [ebp - 0x24], edx
je 0x41287f
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x50]
push eax
call fcn.00422040
mov edx, dword [ebp - 0x24]
add esp, 8
test dl, 7
je 0x412f40
mov ecx, dword [edi + 0x6f8]
mov dword [ebp - 0x20], ecx
cmp ecx, 0x7fffffff
je 0x41289e
test dl, 2
jne 0x4128a7
mov ecx, dword [ebx + 0x5a0]
mov dword [ebp - 0x20], ecx
mov eax, dword [edi + 0x6fc]
mov esi, eax
mov dword [ebp - 0x34], eax
cmp esi, 0x7fffffff
je 0x4128bf
test dl, 2
jne 0x4128c8
mov esi, dword [ebx + 0x5a4]
mov dword [ebp - 0x34], esi
cmp byte [edi + 0x700], 0
jne 0x4129e6
cmp byte [edi + 0x701], 0
je 0x412983
test dl, 2
je 0x412983
mov ecx, dword [edi + 0x6f8]
cmp ecx, 0x7fffffff
je 0x412980
cmp eax, 0x7fffffff
je 0x412980
movsd xmm2, qword [0x51b998]
test dl, 0x20
je 0x412945
mov esi, dword [ebx + 0x5a0]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
mov dword [ebp - 0x20], esi
movd xmm0, esi
cvtdq2pd xmm0, xmm0
mulsd xmm1, xmm0
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
divsd xmm1, xmm0
addsd xmm1, xmm2
cvttsd2si esi, xmm1
mov dword [ebp - 0x34], esi
test dl, 0x40
je 0x412980
mov esi, dword [ebx + 0x5a4]
movd xmm1, ecx
cvtdq2pd xmm1, xmm1
mov dword [ebp - 0x34], esi
movd xmm0, esi
cvtdq2pd xmm0, xmm0
mulsd xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm1, xmm0
addsd xmm1, xmm2
cvttsd2si ecx, xmm1
mov dword [ebp - 0x20], ecx
jmp 0x412983
mov ecx, dword [ebp - 0x20]
cmp byte [edi + 0x702], 0
je 0x4129e6
test dl, 2
je 0x4129e6
mov eax, dword [edi + 0x6f8]
cmp eax, 0x7fffffff
jne 0x4129bb
cmp dword [edi + 0x6fc], eax
je 0x4129c7
mov eax, dword [ebx + 0x5a0]
imul eax, esi
cdq
idiv dword [ebx + 0x5a4]
mov dword [ebp - 0x20], eax
jmp 0x4129e3
cmp dword [edi + 0x6fc], 0x7fffffff
jne 0x4129e6
cmp eax, 0x7fffffff
je 0x4129e6
mov eax, dword [ebx + 0x5a4]
imul eax, ecx
cdq
idiv dword [ebx + 0x5a0]
mov esi, eax
mov dword [ebp - 0x34], esi
mov edx, dword [ebp - 0x24]
mov eax, dword [edi + 0x6e8]
mov dword [ebp - 0x18], eax
cmp eax, 0x7fffffff
je 0x4129fb
test dl, 1
jne 0x412a04
mov eax, dword [ebx + 0x598]
mov dword [ebp - 0x18], eax
mov ecx, dword [edi + 0x6ec]
mov edx, ecx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1c], edx
cmp edx, 0x7fffffff
je 0x412a1e
test al, 1
jne 0x412a2f
mov edx, dword [ebx + 0x59c]
mov dword [ebp - 0x1c], edx
test al, 1
je 0x412c81
mov al, byte [edi + 0x6e6]
cmp al, 2
jb 0x412bae
movzx eax, al
xorps xmm0, xmm0
movups xmmword [ebp - 0x14], xmm0
sub eax, 2
je 0x412b04
sub eax, 1
je 0x412a9a
sub eax, 1
jne 0x412b5b
mov edx, dword [edi + 0x6e8]
cmp byte [edi + 0x6f1], al
je 0x412a87
add ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x58]
push ecx
add eax, edx
push eax
push ecx
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_SetRect]
jmp 0x412b5b
push ecx
push edx
push ecx
push edx
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_SetRect]
jmp 0x412b5b
lea eax, [ebp - 0x14]
push eax
push 4
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x412ad6
movd xmm1, dword [ebp - 0xc]
movd xmm0, dword [ebp - 0x14]
cvtdq2pd xmm1, xmm1
cvtdq2pd xmm0, xmm0
subsd xmm1, xmm0
cvttsd2si eax, xmm1
test eax, eax
jg 0x412b5b
push 1
push 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebx + 0x5a4]
cdq
sub eax, edx
sar eax, 1
add eax, dword [ebx + 0x59c]
push eax
mov eax, dword [ebx + 0x5a0]
cdq
sub eax, edx
sar eax, 1
add eax, dword [ebx + 0x598]
push eax
jmp 0x412b53
cmp byte [edi + 0x6f1], 0
je 0x412b1f
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x50]
jmp 0x412b49
mov eax, dword [ebx + 0x5a0]
cdq
sub eax, edx
mov ecx, eax
mov eax, dword [ebx + 0x5a4]
cdq
sub eax, edx
sar ecx, 1
add ecx, dword [ebx + 0x598]
sar eax, 1
add eax, dword [ebx + 0x59c]
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], eax
push 1
push 0
lea edx, [ebp - 0x14]
push edx
push eax
push ecx
call fcn.004327f0
add esp, 0x14
mov ecx, dword [ebp - 0x14]
movd xmm1, dword [ebp - 0xc]
cvtdq2pd xmm1, xmm1
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
subsd xmm1, xmm0
cvttsd2si eax, xmm1
movd xmm1, dword [ebp - 8]
sub eax, dword [ebp - 0x20]
cdq
sub eax, edx
sar eax, 1
add eax, ecx
mov ecx, dword [ebp - 0x10]
cvtdq2pd xmm1, xmm1
mov dword [ebp - 0x18], eax
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
subsd xmm1, xmm0
cvttsd2si eax, xmm1
sub eax, esi
cdq
sub eax, edx
mov edx, eax
sar edx, 1
add edx, ecx
mov dword [ebp - 0x1c], edx
mov eax, dword [edi + 0x104]
mov dword [ebp - 0x38], eax
cmp eax, 1
jle 0x412c8c
cmp dword [edi + 0x70c], 0
jne 0x412bd6
cmp dword [edi + 0x710], 0
je 0x412c8c
mov esi, dword [0x57c8fc]
lea eax, [edi + 4]
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x2c]
xor ebx, ebx
mov eax, dword [eax + 4]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x30], eax
mov edi, dword [ebp - 0x3c]
cmp dword [eax], edi
mov edi, dword [ebp - 0x48]
je 0x412c4a
xor eax, eax
test esi, esi
jle 0x412c47
mov edx, dword [edi + ebx*4 + 4]
mov ecx, 0x57cb5c
nop
cmp dword [ecx], edx
je 0x412c27
inc eax
add ecx, 0x5d0
cmp eax, esi
jl 0x412c10
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
jmp 0x412c47
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
cmp eax, esi
jge 0x412c47
imul eax, eax, 0x5d0
cmp dword [eax + 0x57d0f0], ecx
jne 0x412c47
cmp dword [eax + 0x57d0f4], edx
je 0x412c61
mov eax, dword [ebp - 0x30]
inc ebx
add eax, 4
mov dword [ebp - 0x30], eax
cmp ebx, dword [ebp - 0x38]
jl 0x412bf6
mov ebx, dword [ebp - 0x2c]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
jmp 0x412c8f
add ecx, dword [edi + 0x70c]
add edx, dword [edi + 0x710]
mov eax, dword [edi + 0x104]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
jmp 0x412be5
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
jmp 0x412c92
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
movzx esi, byte [edi + 0x705]
mov dword [ebp - 0x38], esi
cmp esi, 0xff
je 0x412ca8
test al, 4
jne 0x412cb1
mov esi, dword [ebx + 0x5b4]
mov dword [ebp - 0x38], esi
cmp byte [edi + 0x6f1], 0
je 0x412ccf
cmp byte [edi + 0x6e6], 0
jne 0x412ccf
add ecx, dword [ebp - 0x58]
add edx, dword [ebp - 0x54]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
cmp byte [edi + 0x6f2], 0
je 0x412d2b
push 1
push 0
lea eax, [ebp - 0x14]
push eax
push edx
push ecx
call fcn.004327f0
mov eax, dword [ebp - 0x18]
add esp, 0x14
mov edx, dword [ebp - 0x20]
add eax, edx
mov ecx, dword [ebp - 0xc]
cmp eax, ecx
jle 0x412d00
mov eax, ecx
sub eax, edx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0x1c]
add eax, edx
mov ecx, dword [ebp - 8]
cmp eax, ecx
jle 0x412d14
mov edx, ecx
sub edx, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [ebp - 0x14]
cmovl ecx, dword [ebp - 0x14]
cmp edx, dword [ebp - 0x10]
mov dword [ebp - 0x18], ecx
cmovl edx, dword [ebp - 0x10]
mov dword [ebp - 0x1c], edx
xor ecx, ecx
mov dword [ebp - 0x30], 2
cmp byte [edi + 0x703], cl
mov eax, 4
mov byte [ebp - 0x25], 0
cmovne ecx, eax
xor eax, eax
cmp byte [edi + 0x6f3], al
cmovne eax, dword [ebp - 0x30]
or ecx, eax
xor eax, eax
cmp byte [edi + 0x6e5], al
setne al
or ecx, eax
mov eax, dword [ebp - 0x18]
push ecx
push esi
push dword [ebp - 0x34]
push dword [ebp - 0x20]
push edx
push eax
push dword [ebx + 4]
call fcn.00423a70
mov esi, dword [sym.imp.USER32.dll_IsIconic]
add esp, 0x1c
cmp byte [edi + 0x703], 0
jne 0x412e3d
cmp byte [edi + 0x707], 0
je 0x412e3d
test byte [ebp - 0x24], 4
je 0x412e3d
push dword [ebx + 4]
call esi
push dword [ebx + 4]
mov esi, eax
xor eax, eax
test esi, esi
setne al
mov dword [ebp - 0x3c], eax
call dword [sym.imp.USER32.dll_IsZoomed]
test eax, eax
je 0x412dc8
mov esi, 2
jmp 0x412dcf
test esi, esi
je 0x412e37
mov esi, dword [ebp - 0x3c]
xor ecx, ecx
cmp byte [edi + 0x6f3], cl
cmovne ecx, dword [ebp - 0x30]
xor eax, eax
cmp byte [edi + 0x6e5], al
setne al
add eax, 4
or ecx, eax
push ecx
push 0
push dword [ebp - 0x34]
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
push dword [ebx + 4]
call fcn.00423a70
xor ecx, ecx
cmp byte [edi + 0x6f3], cl
cmovne ecx, dword [ebp - 0x30]
xor eax, eax
cmp byte [edi + 0x6e5], al
setne al
add eax, 4
or ecx, eax
push ecx
push esi
push dword [ebp - 0x34]
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
push dword [ebx + 4]
call fcn.00423a70
add esp, 0x38
mov esi, dword [sym.imp.USER32.dll_IsIconic]
push 0
push 0
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x5c]
push eax
push dword [ebx + 4]
call fcn.004220f0
mov eax, dword [ebp - 0x20]
add esp, 0x1c
cmp dword [ebp - 0x3c], eax
jne 0x412e7c
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x44], eax
jne 0x412e7c
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x5c], eax
jne 0x412e7c
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x40], eax
je 0x412e80
mov byte [ebp - 0x25], 1
cmp byte [edi + 0x703], 0
je 0x412eb4
test byte [ebp - 0x24], 4
je 0x412eb4
push dword [ebx + 4]
call esi
mov esi, dword [ebp - 0x2c]
xor ebx, ebx
test eax, eax
setne bl
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsZoomed]
test eax, eax
cmovne ebx, dword [ebp - 0x30]
cmp ebx, dword [ebp - 0x38]
jne 0x412ec1
mov ebx, esi
cmp byte [ebp - 0x25], 0
je 0x412f40
mov esi, dword [ebp - 0x2c]
cmp byte [edi + 0x6dc], 0
je 0x412f2d
push 0x2d20
call fcn.004817a0
push 0x2740
mov ebx, eax
push edi
push ebx
call fcn.00482d10
mov al, byte [ebp + 0x10]
lea edi, [ebx + 0x2740]
add esp, 0x10
mov ecx, 0x174
rep movsd dword es:[edi], dword [esi]
mov byte [ebx + 0x2d1c], al
mov eax, dword [ebp - 0x24]
mov dword [ebx + 0x2d10], eax
lea eax, [ebp - 0x40]
push eax
push 0
push ebx
push 0x413cd0
push 0
push 0
mov byte [ebx + 0x6d4], 0
mov byte [ebx + 0x6dc], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x4131e6
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00481761
mov esp, ebp
pop ebp
ret
cmp byte [edi + 0x70b], 0
mov esi, dword [sym.imp.USER32.dll_SetWindowPos]
je 0x412f72
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetFocus]
push 3
push 0
push 0
push 0
push 0
push 0
push dword [ebx + 4]
call esi
cmp byte [edi + 0x708], 0
je case.default.0x412f8d
test byte [ebp - 0x24], 8
je case.default.0x412f8d
movzx eax, byte [edi + 0x709]
cmp eax, 3
ja case.default.0x412f8d
jmp dword [eax*4 + 0x413200]
push 3
push 0
push 0
push 0
push 0
push 0
jmp 0x412fca
push 3
push 0
push 0
push 0
push 0
push 1
jmp 0x412fca
push 0x13
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
jmp 0x412fca
push 0x13
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
push dword [ebx + 4]
call esi
cmp byte [edi + 0x714], 0
je 0x4130e6
mov ecx, dword [0x566508]
xor esi, esi
mov eax, dword [0x56650c]
mov dword [ebp - 0x38], eax
test ecx, ecx
jle 0x413002
mov edx, dword [ebx + 4]
cmp dword [eax], edx
je 0x412fff
inc esi
add eax, 0xc
cmp esi, ecx
jl 0x412ff3
mov eax, dword [ebp - 0x38]
cmp esi, ecx
jge 0x41309e
mov cl, byte [edi + 0x715]
lea ebx, [esi + esi*2]
shl ebx, 2
push 0
push 0
test cl, cl
jne 0x413071
push dword [ebx + eax]
mov ecx, 0xb64288
call fcn.0042e5a0
test esi, esi
js 0x4130e6
mov edx, dword [0x566508]
dec edx
cmp esi, edx
jg 0x4130e6
mov dword [0x566508], edx
je 0x4130e6
mov ecx, dword [0x56650c]
sub edx, esi
add ecx, ebx
lea eax, [edx + edx*2]
shl eax, 2
push eax
lea eax, [ecx + 0xc]
push eax
push ecx
call fcn.00482d10
add esp, 0xc
jmp 0x4130e6
movzx eax, cl
mov ecx, dword [ebp - 0x38]
mov dword [ebx + ecx + 4], eax
mov eax, dword [0x56650c]
mov cl, byte [edi + 0x716]
mov byte [ebx + eax + 8], cl
mov ecx, 0xb64288
mov eax, dword [0x56650c]
push dword [ebx + eax]
call fcn.0042e5a0
jmp 0x4130e6
mov al, byte [edi + 0x716]
movzx ecx, byte [edi + 0x715]
test al, al
mov edx, dword [ebx + 4]
mov byte [ebp - 8], al
setne al
movzx eax, al
push eax
push ecx
mov dword [ebp - 0xc], ecx
mov ecx, 0xb64288
push edx
mov dword [ebp - 0x10], edx
call fcn.0042e5a0
test al, al
je 0x4130e6
push 1
push dword [0x566508]
lea eax, [ebp - 0x10]
mov ecx, 0x566508
push eax
call fcn.00413210
mov ecx, dword [0xb4cb68]
test ecx, ecx
je 0x413160
cmp byte [edi + 0x272c], 0
je 0x413160
cmp byte [edi + 0x272e], 0xff
je 0x413160
test byte [ebp - 0x24], 0x10
mov ebx, dword [ebp - 0x2c]
je 0x413163
mov eax, dword [ecx]
push dword [ebx + 4]
mov eax, dword [eax + 0x24]
call eax
cmp byte [edi + 0x272e], 0xfe
jne 0x413136
test al, al
jne 0x413163
mov ecx, dword [0xb4cb68]
push dword [ebx + 4]
mov eax, dword [ecx]
call dword [eax + 0x1c]
jmp 0x413163
test al, al
je 0x413148
mov ecx, dword [0xb4cb68]
push dword [ebx + 4]
mov eax, dword [ecx]
call dword [eax + 0x20]
mov ecx, dword [0xb4cb68]
movzx eax, byte [edi + 0x272e]
push eax
push dword [ebx + 4]
mov edx, dword [ecx]
call dword [edx + 0xc]
jmp 0x413163
mov ebx, dword [ebp - 0x2c]
mov ecx, str.CabinetWClass
lea eax, [ebx + 0x40c]
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x413190
test dl, dl
je 0x41318c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x413190
add eax, 2
add ecx, 2
test dl, dl
jne 0x413170
xor eax, eax
jmp 0x413195
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4131ed
cmp byte [edi + 0x271f], al
je 0x4131ed
cmp dword [edi + 0x2720], eax
je 0x4131ed
mov esi, dword [ebx + 4]
push 0x2740
call fcn.004817a0
push 0x2740
push dword [ebp - 0x48]
mov edi, eax
push edi
call fcn.00482d10
add esp, 0x10
mov dword [edi + 4], esi
lea eax, [ebp - 0x40]
push eax
push 0
push edi
push 0x4141a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x4131ed
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00481761
mov esp, ebp
pop ebp
ret