Function at 0x40b4dc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x30]
mov edx, dword [0x409a14]
call fcn.0040357c
xor eax, eax
push ebp
push 0x40be45
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [esi + 4]
cmp eax, 0x83ef
jg 0x40b5c3
je 0x40bbc4
cmp eax, 0x214
jg 0x40b576
je 0x40b97d
cmp eax, 0x46
jg 0x40b552
je 0x40b8cc
sub eax, 3
je 0x40bb3e
sub eax, 4
je 0x40bb04
dec eax
je 0x40bb21
jmp case.0x40b5d1.33788
sub eax, 0x47
je 0x40b9ba
sub eax, 0xcc
je 0x40b7d3
sub eax, 0xed
je 0x40b618
jmp case.0x40b5d1.33788
cmp eax, 0x83eb
jg 0x40b5a5
je 0x40bb81
sub eax, 0x2a3
je 0x40b76a
sub eax, 0x8146
je 0x40bb5b
dec eax
je 0x40bb6e
jmp case.0x40b5d1.33788
sub eax, 0x83ec
je 0x40bb94
dec eax
je 0x40bba4
dec eax
je 0x40bbb4
jmp case.0x40b5d1.33788
add eax, 0xffff7c10
cmp eax, 0xf
ja case.0x40b5d1.33788
jmp dword [eax*4 + 0x40b5d8]
mov dword [ebx + 0x50], 0x10
mov eax, dword [ebx + 0xd0]
mov eax, dword [eax + 0x18]
mov dword [ebx + 0x58], eax
mov dword [ebx + 0x54], 2
lea eax, [ebx + 0x50]
push eax
call sub.user32.dll_TrackMouseEvent
mov ax, word [esi + 0xc]
mov word [ebx + 0x38], ax
mov eax, dword [esi + 0xc]
call fcn.00404c90
mov word [ebx + 0x3a], ax
cmp byte [ebx + 0x14], 0
jne 0x40b6a0
lea eax, [ebp - 0x10]
push eax
call sub.user32.dll_GetCursorPos
lea eax, [ebp - 0x40]
push eax
mov eax, dword [ebx + 0xd0]
mov eax, dword [eax + 0x18]
push eax
call sub.user32.dll_GetWindowRect
push dword [ebp - 0xc]
push dword [ebp - 0x10]
lea eax, [ebp - 0x40]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x40b69c
push 0
push 0
push 0x83ff
mov eax, dword [ebx + 0xd0]
mov eax, dword [eax + 0x18]
push eax
call sub.user32.dll_SendMessageA
mov byte [ebx + 0x14], 1
mov edi, dword [ebx + 0x70]
test edi, edi
je 0x40b6e6
mov eax, dword [edi + 0x4c]
call dword [edi + 0x48]
test al, al
je 0x40b6e6
movsx eax, word [ebx + 0x38]
cmp eax, dword [ebx + 0x48]
jne 0x40b6c3
movsx eax, word [ebx + 0x3a]
cmp eax, dword [ebx + 0x4c]
je 0x40b6e6
movsx eax, word [ebx + 0x38]
mov dword [ebx + 0x48], eax
movsx eax, word [ebx + 0x3a]
mov dword [ebx + 0x4c], eax
movsx eax, word [ebx + 0x3a]
push eax
movsx ecx, word [ebx + 0x38]
mov edi, dword [ebx + 0x70]
mov edx, dword [ebx + 0x40]
mov eax, dword [edi + 0x34]
call dword [edi + 0x30]
mov eax, dword [esi + 8]
dec eax
je 0x40b6f6
dec eax
je 0x40b6fa
sub eax, 0xe
je 0x40b700
jmp 0x40b706
xor eax, eax
jmp 0x40b709
mov ax, 1
jmp 0x40b709
mov ax, 2
jmp 0x40b709
or eax, 0xffffffff
movsx eax, ax
push eax
push 0
push 0x83f0
mov eax, dword [ebx + 0xd0]
mov eax, dword [eax + 0x18]
push eax
call sub.user32.dll_SendMessageA
jmp case.0x40b5d1.33788
cmp dword [ebx + 0x70], 0
je 0x40b74d
push 0
mov edx, dword [ebx + 0x70]
mov eax, dword [edx + 0x3c]
call dword [edx + 0x38]
push eax
mov eax, dword [ebx + 0xd0]
mov edi, dword [eax + 0x18]
mov eax, edi
dec eax
push eax
push edi
call sub.user32.dll_SetTimer
push 0
push 0
push 0x83f7
mov eax, dword [ebx + 0xd0]
mov eax, dword [eax + 0x18]
push eax
call sub.user32.dll_SendMessageA
jmp case.0x40b5d1.33788
mov eax, dword [ebx + 0x70]
test eax, eax
je 0x40b7b2
mov edi, eax
xor ecx, ecx
mov edx, dword [ebx + 0x40]
mov eax, dword [edi + 0x14]
call dword [edi + 0x10]
mov edi, dword [ebx + 0x70]
mov edx, dword [ebx + 0x40]
mov eax, dword [edi + 0x2c]
call dword [edi + 0x28]
mov eax, dword [ebx + 0xd0]
mov eax, dword [eax + 0x18]
mov edx, eax
dec edx
push edx
push eax
call sub.user32.dll_KillTimer
mov eax, dword [ebx + 0xd0]
mov eax, dword [eax + 0x18]
mov edx, eax
sub edx, 2
push edx
push eax
call sub.user32.dll_KillTimer
mov byte [ebx + 0x14], 0
push 0
push 0
push 0x83f8
mov eax, dword [ebx + 0xd0]
mov eax, dword [eax + 0x18]
push eax
call sub.user32.dll_SendMessageA
jmp case.0x40b5d1.33788
mov eax, dword [esi + 8]
mov edx, dword [ebx + 0xd0]
mov edx, dword [edx + 0x18]
mov ecx, edx
dec ecx
cmp eax, ecx
jne 0x40b88d
mov eax, dword [ebx + 0xdc]
cmp eax, 7
jge 0x40b80c
mov edx, dword [ebx + 0xd8]
push edx
mov edi, dword [ebx + 0x70]
mov ecx, eax
mov edx, dword [ebx + 0x40]
mov eax, dword [edi + 0x1c]
call dword [edi + 0x18]
jmp 0x40b825
mov eax, dword [ebx + 0xd8]
push eax
mov eax, dword [ebx + 0xc]
mov ecx, dword [eax + 0x1c]
mov edi, dword [ebx + 0x70]
mov edx, dword [ebx + 0x40]
mov eax, dword [edi + 0x1c]
call dword [edi + 0x18]
mov edi, dword [ebx + 0x70]
mov ecx, dword [ebx + 0x104]
mov edx, dword [ebx + 0x40]
mov eax, dword [edi + 0x14]
call dword [edi + 0x10]
mov edi, dword [ebx + 0x70]
mov edx, dword [ebx + 0x40]
mov eax, dword [edi + 0x24]
call dword [edi + 0x20]
mov eax, dword [ebx + 0xd0]
mov eax, dword [eax + 0x18]
mov edx, eax
dec edx
push edx
push eax
call sub.user32.dll_KillTimer
mov edi, dword [ebx + 0x70]
mov eax, dword [edi + 0x4c]
call dword [edi + 0x48]
test al, al
jne case.0x40b5d1.33788
push 0
mov edx, dword [ebx + 0x70]
mov eax, dword [edx + 0x44]
call dword [edx + 0x40]
push eax
mov eax, dword [ebx + 0xd0]
mov edi, dword [eax + 0x18]
mov eax, edi
sub eax, 2
push eax
push edi
call sub.user32.dll_SetTimer
jmp case.0x40b5d1.33788
sub edx, 2
cmp eax, edx
jne case.0x40b5d1.33788
mov edi, dword [ebx + 0x70]
xor ecx, ecx
mov edx, dword [ebx + 0x40]
mov eax, dword [edi + 0x14]
call dword [edi + 0x10]
mov edi, dword [ebx + 0x70]
mov edx, dword [ebx + 0x40]
mov eax, dword [edi + 0x2c]
call dword [edi + 0x28]
mov eax, dword [ebx + 0xd0]
mov eax, dword [eax + 0x18]
mov edx, eax
sub edx, 2
push edx
push eax
call sub.user32.dll_KillTimer
jmp case.0x40b5d1.33788
mov edi, dword [esi + 0xc]
test byte [edi + 0x18], 1
jne case.0x40b5d1.33788
mov eax, dword [ebx + 0xd0]
call fcn.00407fdc
mov dword [ebp - 8], eax
mov eax, dword [edi + 0x14]
cmp eax, dword [ebp - 8]
je 0x40b924
mov edx, eax
sub edx, dword [ebp - 8]
lea eax, [ebp - 0x30]
call fcn.0040a278
lea eax, [ebp - 0x30]
lea edx, [ebx + 0x248]
call fcn.00409ebc
lea eax, [ebp - 0x30]
call fcn.0040a2e0
test al, al
je 0x40b924
lea eax, [ebp - 0x30]
call fcn.00409dac
add eax, dword [ebp - 8]
mov dword [edi + 0x14], eax
mov eax, dword [ebx + 0xd0]
call fcn.00407fb4
mov dword [ebp - 8], eax
mov eax, dword [edi + 0x10]
cmp eax, dword [ebp - 8]
je case.0x40b5d1.33788
mov edx, dword [edi + 0x10]
sub edx, dword [ebp - 8]
lea eax, [ebp - 0x30]
call fcn.0040a278
lea eax, [ebp - 0x30]
lea edx, [ebx + 0x23c]
call fcn.00409ebc
lea eax, [ebp - 0x30]
call fcn.0040a2e0
test al, al
je case.0x40b5d1.33788
lea eax, [ebp - 0x30]
call fcn.00409dac
add eax, dword [ebp - 8]
mov dword [edi + 0x10], eax
jmp case.0x40b5d1.33788
mov eax, dword [esi + 8]
cmp eax, 3
je 0x40b9a2
cmp eax, 4
je 0x40b9a2
cmp eax, 5
je 0x40b9a2
cmp eax, 6
je 0x40b9a2
cmp eax, 7
je 0x40b9a2
cmp eax, 8
jne case.0x40b5d1.33788
push 0
push 0
mov eax, dword [ebx + 0xd0]
mov eax, dword [eax + 0x18]
push eax
call sub.user32.dll_InvalidateRect
jmp case.0x40b5d1.33788
mov edi, dword [ebx + 0xd0]
cmp dword [edi + 0x253], 0
je 0x40b9ef
mov eax, edi
call fcn.00407fb4
mov edx, dword [ebx + 0xd0]
cmp eax, dword [edx + 0x253]
jge 0x40b9ef
mov eax, dword [ebx + 0xd0]
mov edx, dword [eax + 0x253]
call fcn.00407fc0
mov edi, dword [ebx + 0xd0]
cmp dword [edi + 0x24f], 0
je 0x40ba24
mov eax, edi
call fcn.00407fb4
mov edx, dword [ebx + 0xd0]
cmp eax, dword [edx + 0x24f]
jle 0x40ba24
mov eax, dword [ebx + 0xd0]
mov edx, dword [eax + 0x24f]
call fcn.00407fc0
mov edi, dword [ebx + 0xd0]
cmp dword [edi + 0x25b], 0
je 0x40ba59
mov eax, edi
call fcn.00407fdc
mov edx, dword [ebx + 0xd0]
cmp eax, dword [edx + 0x25b]
jge 0x40ba59
mov eax, dword [ebx + 0xd0]
mov edx, dword [eax + 0x25b]
call fcn.00407fe8
mov edi, dword [ebx + 0xd0]
cmp dword [edi + 0x257], 0
je 0x40ba8e
mov eax, edi
call fcn.00407fdc
mov edx, dword [ebx + 0xd0]
cmp eax, dword [edx + 0x257]
jle 0x40ba8e
mov eax, dword [ebx + 0xd0]
mov edx, dword [eax + 0x257]
call fcn.00407fe8
mov eax, dword [ebx + 0xd0]
call fcn.00408d48
test eax, eax
je 0x40baf4
cmp dword [ebx + 0x74], 0
jne 0x40baf4
mov eax, dword [ebx + 0xd0]
call fcn.00408d48
dec eax
test eax, eax
jl 0x40baf4
inc eax
mov dword [ebp - 0x14], eax
xor edi, edi
mov eax, dword [ebx + 0xd0]
mov edx, edi
call fcn.00408158
cmp byte [eax + 0x2a8], 0
jne 0x40baee
push 0
push 0
push 0x83fe
mov eax, dword [ebx + 0xd0]
mov edx, edi
call fcn.00408158
mov eax, dword [eax + 0x18]
push eax
call sub.user32.dll_SendMessageA
inc edi
dec dword [ebp - 0x14]
jne 0x40bab9
mov eax, dword [ebx + 0xd0]
call fcn.00409560
jmp case.0x40b5d1.33788
push 0
push 0
push 0x83f9
mov eax, dword [ebx + 0xd0]
mov eax, dword [eax + 0x18]
push eax
call sub.user32.dll_SendMessageA
jmp case.0x40b5d1.33788
push 0
push 0
push 0x83fa
mov eax, dword [ebx + 0xd0]
mov eax, dword [eax + 0x18]
push eax
call sub.user32.dll_SendMessageA
jmp case.0x40b5d1.33788
push 0
push 0
push 0x83f3
mov eax, dword [ebx + 0xd0]
mov eax, dword [eax + 0x18]
push eax
call sub.user32.dll_SendMessageA
jmp case.0x40b5d1.33788
mov edx, dword [esi + 0xc]
lea eax, [ebx + 0x17c]
call fcn.0040a0c8
jmp case.0x40b5d1.33788
mov edx, dword [esi + 0xc]
lea eax, [ebx + 0x170]
call fcn.0040a0c8
jmp case.0x40b5d1.33788
mov edx, dword [esi + 0xc]
lea eax, [ebx + 0x188]
call fcn.0040a130
jmp case.0x40b5d1.33788
lea eax, [ebx + 0x1f4]
call fcn.0040a200
jmp case.0x40b5d1.33788
lea eax, [ebx + 0x200]
call fcn.0040a200
jmp case.0x40b5d1.33788
lea eax, [ebx + 0x1e8]
call fcn.0040a200
jmp case.0x40b5d1.33788
mov edx, dword [esi + 0xc]
lea eax, [ebx + 0x194]
call fcn.0040a0c8
jmp case.0x40b5d1.33788
mov edx, dword [esi + 0xc]
lea eax, [ebx + 0x1a0]
call fcn.0040a0c8
jmp case.0x40b5d1.33788
mov edx, dword [esi + 0xc]
lea eax, [ebx + 0x1ac]
call fcn.0040a0c8
jmp case.0x40b5d1.33788
mov edx, dword [esi + 0xc]
lea eax, [ebx + 0x1b8]
call fcn.0040a0c8
jmp case.0x40b5d1.33788
lea eax, [ebx + 0x20c]
call fcn.0040a200
jmp case.0x40b5d1.33788
mov edx, dword [esi + 0xc]
lea eax, [ebx + 0x78]
call fcn.0040a0c8
jmp case.0x40b5d1.33788
mov edx, dword [esi + 0xc]
lea eax, [ebx + 0x84]
call fcn.0040a0c8
jmp case.0x40b5d1.33788
mov edx, dword [esi + 0xc]
lea eax, [ebx + 0x1dc]
call fcn.0040a0c8
jmp case.0x40b5d1.33788
lea eax, [ebx + 0x218]
call fcn.0040a200
jmp case.0x40b5d1.33788
lea eax, [ebx + 0x224]
call fcn.0040a200
jmp case.0x40b5d1.33788
lea eax, [ebx + 0x1c4]
call fcn.0040a200
jmp case.0x40b5d1.33788
lea eax, [ebx + 0x1d0]
call fcn.0040a200
jmp case.0x40b5d1.33788
lea eax, [ebx + 0x90]
call fcn.0040a200
jmp case.0x40b5d1.33788
cmp byte [ebx + 0x15e], 0
je 0x40bd5c
cmp byte [ebx + 0x15c], 0
jne 0x40bd0d
push 4
mov eax, dword [ebx + 0xd0]
call fcn.00407fdc
push eax
mov eax, dword [ebx + 0xc8]
push eax
mov eax, dword [ebx + 0xd0]
call fcn.00407f84
push eax
mov eax, dword [ebx + 0xd0]
mov eax, dword [eax + 0x49]
call fcn.00407fb4
mov edx, dword [ebx + 0xc8]
add edx, dword [ebx + 0xc0]
sub eax, edx
push eax
push 0
mov eax, dword [ebx + 0xd0]
mov eax, dword [eax + 0x18]
push eax
call sub.user32.dll_SetWindowPos
jmp 0x40bd5c
push 4
mov eax, dword [ebx + 0xd0]
call fcn.00407fdc
push eax
mov eax, dword [ebx + 0xd0]
mov eax, dword [eax + 0x49]
call fcn.00407fb4
mov edx, dword [ebx + 0xbc]
add edx, dword [ebx + 0xc0]
sub eax, edx
push eax
mov eax, dword [ebx + 0xd0]
call fcn.00407f84
push eax
mov eax, dword [ebx + 0xbc]
push eax
push 0
mov eax, dword [ebx + 0xd0]
mov eax, dword [eax + 0x18]
push eax
call sub.user32.dll_SetWindowPos
cmp byte [ebx + 0x15f], 0
je case.0x40b5d1.33788
cmp byte [ebx + 0x15d], 0
jne 0x40bdc3
push 4
mov eax, dword [ebx + 0xcc]
push eax
mov eax, dword [ebx + 0xd0]
call fcn.00407fb4
push eax
mov eax, dword [ebx + 0xd0]
mov eax, dword [eax + 0x49]
call fcn.00407fdc
mov edx, dword [ebx + 0xcc]
add edx, dword [ebx + 0xc4]
sub eax, edx
push eax
mov eax, dword [ebx + 0xd0]
call fcn.00407f54
push eax
push 0
mov eax, dword [ebx + 0xd0]
mov eax, dword [eax + 0x18]
push eax
call sub.user32.dll_SetWindowPos
jmp case.0x40b5d1.33788
push 4
mov eax, dword [ebx + 0xd0]
mov eax, dword [eax + 0x49]
call fcn.00407fdc
mov edx, dword [ebx + 0xb8]
add edx, dword [ebx + 0xc4]
sub eax, edx
push eax
mov eax, dword [ebx + 0xd0]
call fcn.00407fb4
push eax
mov eax, dword [ebx + 0xd0]
call fcn.00407f84
push eax
mov eax, dword [ebx + 0xd0]
call fcn.00407f54
push eax
push 0
mov eax, dword [ebx + 0xd0]
mov eax, dword [eax + 0x18]
push eax
call sub.user32.dll_SetWindowPos
push dword [ebx + 0x1c]
push dword [ebx + 0x18]
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.0040a424
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40be4c
lea eax, [ebp - 0x30]
mov edx, dword [0x409a14]
call fcn.00403648
ret