Function at 0x40cbf0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fcdad
mov eax, dword fs:[0]
push eax
sub esp, 0x378
mov eax, dword [0x53e180]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xc4], ecx
mov eax, dword [ebp + 0x14]
mov byte [eax], 0
lea ecx, [ebp - 0x110]
push ecx
mov ecx, dword [ebp - 0xc4]
add ecx, 0x1ac
call fcn.00410d00
jmp 0x40cc55
push 0
lea edx, [ebp - 0x27c]
push edx
lea ecx, [ebp - 0x110]
call fcn.00410c40
lea eax, [ebp - 0x2b0]
push eax
mov ecx, dword [ebp - 0xc4]
add ecx, 0x1ac
call fcn.00410c90
push eax
lea ecx, [ebp - 0x110]
call fcn.00410c00
movzx ecx, al
test ecx, ecx
je 0x40ccf0
mov dword [ebp - 0x14c], 0
lea ecx, [ebp - 0x110]
call fcn.00410c70
mov edx, dword [eax]
mov dword [ebp - 0x140], edx
lea eax, [ebp - 0x14c]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x140]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x140]
mov eax, dword [edx]
call eax
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x14c], 0
je 0x40cceb
cmp dword [ebp + 8], 0x200
je 0x40cceb
mov ecx, dword [ebp + 0x14]
mov byte [ecx], 1
mov eax, dword [ebp - 0x1cc]
jmp 0x40ecf1
jmp 0x40cc41
mov edx, dword [ebp + 8]
mov dword [ebp - 0xc8], edx
cmp dword [ebp - 0xc8], 0x10d
ja 0x40cd48
cmp dword [ebp - 0xc8], 0x10d
je 0x40db75
mov eax, dword [ebp - 0xc8]
sub eax, 5
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0xfd
ja case.0x40cde0.3
mov ecx, dword [ebp - 0xc8]
movzx edx, byte [ecx + 0x40ed3c]
jmp dword [edx*4 + 0x40ed0c]
cmp dword [ebp - 0xc8], 0x240
ja 0x40cd99
cmp dword [ebp - 0xc8], 0x240
je 0x40dd26
mov eax, dword [ebp - 0xc8]
sub eax, 0x10e
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0xfc
ja case.0x40cde0.3
mov ecx, dword [ebp - 0xc8]
movzx edx, byte [ecx + 0x40ee68]
jmp dword [edx*4 + 0x40ee3c]
cmp dword [ebp - 0xc8], 0x2a1
ja 0x40cde7
cmp dword [ebp - 0xc8], 0x2a1
je 0x40d137
mov eax, dword [ebp - 0xc8]
sub eax, 0x245
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 7
ja case.0x40cde0.3
mov ecx, dword [ebp - 0xc8]
movzx edx, byte [ecx + 0x40ef70]
jmp dword [edx*4 + 0x40ef68]
cmp dword [ebp - 0xc8], 0x2a3
je 0x40d3db
cmp dword [ebp - 0xc8], 0x8001
je 0x40ce08
jmp case.0x40cde0.3
lea eax, [ebp - 0x114]
push eax
mov ecx, dword [ebp - 0xc4]
add ecx, 0x1d0
call fcn.00410d00
jmp 0x40ce36
push 0
lea ecx, [ebp - 0x25c]
push ecx
lea ecx, [ebp - 0x114]
call fcn.00410c40
lea edx, [ebp - 0x2bc]
push edx
mov ecx, dword [ebp - 0xc4]
add ecx, 0x1d0
call fcn.00410c90
push eax
lea ecx, [ebp - 0x114]
call fcn.00410c00
movzx eax, al
test eax, eax
je 0x40ced2
lea ecx, [ebp - 0x114]
call fcn.00410c70
mov ecx, dword [eax]
mov dword [ebp - 0x1d0], ecx
mov edx, dword [ebp - 0x1d0]
mov dword [ebp - 0xfc], edx
cmp dword [ebp - 0xfc], 0
je 0x40cec3
push 1
mov eax, dword [ebp - 0xfc]
mov ecx, dword [eax + 4]
mov edx, dword [ecx + 4]
mov eax, dword [ebp - 0xfc]
mov ecx, dword [eax + 4]
mov eax, dword [ecx + 4]
mov ecx, dword [ebp - 0xfc]
lea ecx, [ecx + eax + 4]
mov eax, dword [ebp - 0xfc]
mov edx, dword [eax + edx + 4]
mov eax, dword [edx]
call eax
mov dword [ebp - 0x1a0], eax
jmp 0x40cecd
mov dword [ebp - 0x1a0], 0
jmp 0x40ce22
mov ecx, dword [ebp - 0xc4]
add ecx, 0x1d0
call fcn.00411050
jmp case.0x40cde0.3
mov ecx, dword [ebp - 0xc4]
cmp dword [ecx + 0xe8], 0
je 0x40cf2b
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
lea ecx, [ebp - 0x304]
call fcn.0041b870
mov edx, dword [eax + 4]
push edx
mov eax, dword [eax]
push eax
push 0
push 0
push 0
push 0x10
mov ecx, dword [ebp - 0xc4]
mov ecx, dword [ecx + 0xe8]
call fcn.00436c20
mov edx, dword [ebp - 0xc4]
cmp dword [edx + 0xec], 0
je 0x40cf6e
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
lea ecx, [ebp - 0x2fc]
call fcn.0041b870
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
push 0
push 0
push 0
push 0x13
mov eax, dword [ebp - 0xc4]
mov ecx, dword [eax + 0xec]
call fcn.00436c20
mov ecx, dword [ebp - 0xc4]
cmp dword [ecx + 0xfc], 0
je 0x40cfb1
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
lea ecx, [ebp - 0x314]
call fcn.0041b870
mov edx, dword [eax + 4]
push edx
mov eax, dword [eax]
push eax
push 0
push 0
push 0
push 0x13
mov ecx, dword [ebp - 0xc4]
mov ecx, dword [ecx + 0xfc]
call fcn.00436c20
mov edx, dword [ebp - 0xc4]
cmp dword [edx + 0x108], 0
je 0x40cff4
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
lea ecx, [ebp - 0x30c]
call fcn.0041b870
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
push 0
push 0
push 0
push 0x13
mov eax, dword [ebp - 0xc4]
mov ecx, dword [eax + 0x108]
call fcn.00436c20
push 0
mov ecx, dword [ebp - 0xc4]
call fcn.0040f140
push 4
mov ecx, dword [ebp - 0xc4]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.USER32.dll_GetWindow]
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 0
je 0x40d02f
mov eax, dword [ebp - 0x170]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
jmp case.0x40cde0.3
mov ecx, dword [ebp + 0x14]
mov byte [ecx], 1
mov eax, 1
jmp 0x40ecf1
mov ecx, dword [ebp - 0xc4]
call fcn.0040f850
mov edx, dword [ebp + 0x14]
mov byte [edx], 1
xor eax, eax
jmp 0x40ecf1
mov edx, dword [ebp - 0xc4]
cmp dword [edx + 0xe0], 0
je 0x40d0d1
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
lea ecx, [ebp - 0x2c4]
call fcn.0041b870
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
push 0
push 0
push 0
push 0x26
mov eax, dword [ebp - 0xc4]
mov ecx, dword [eax + 0xe0]
call fcn.00436c20
mov ecx, dword [ebp - 0xc4]
cmp dword [ecx + 0x1c], 0
je 0x40d0f6
mov edx, dword [ebp - 0xc4]
mov eax, dword [edx + 0x1c]
mov ecx, dword [ebp - 0xc4]
mov edx, dword [eax]
mov ecx, dword [ecx + 0x1c]
mov eax, dword [edx + 0x24]
call eax
cmp dword [ebp + 0xc], 2
jne 0x40d111
push 1
mov ecx, dword [ebp - 0xc4]
add ecx, 0x1fc
call fcn.00421e90
jmp 0x40d12a
cmp dword [ebp + 0xc], 0
jne 0x40d12a
push 0
mov ecx, dword [ebp - 0xc4]
add ecx, 0x1fc
call fcn.00421e90
mov ecx, dword [ebp + 0x14]
mov byte [ecx], 1
xor eax, eax
jmp 0x40ecf1
mov edx, dword [ebp - 0xc4]
mov byte [edx + 0x116], 0
mov eax, dword [ebp + 0x10]
and eax, 0xffff
movsx ecx, ax
mov dword [ebp - 0x18c], ecx
mov edx, dword [ebp + 0x10]
shr edx, 0x10
and edx, 0xffff
movsx eax, dx
mov dword [ebp - 0x188], eax
mov ecx, dword [ebp - 0x188]
push ecx
mov edx, dword [ebp - 0x18c]
push edx
mov ecx, dword [ebp - 0xc4]
call fcn.0040f500
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0
jne 0x40d197
jmp case.0x40cde0.3
mov eax, dword [ebp - 0xc4]
cmp dword [eax + 0xe8], 0
je 0x40d1df
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
sub esp, 8
mov ecx, esp
mov dword [ebp - 0x2b8], esp
lea edx, [ebp - 0x18c]
push edx
call fcn.00418d30
push 0
push 0
push 0
push 0x11
mov eax, dword [ebp - 0xc4]
mov ecx, dword [eax + 0xe8]
call fcn.00436c20
lea ecx, [ebp - 0x28]
push ecx
mov edx, dword [ebp - 0xd4]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xd4]
mov edx, dword [eax + 0x3c]
call edx
mov dword [ebp - 4], 0
push 0x30
push 0
mov eax, dword [ebp - 0xc4]
add eax, 0xb0
push eax
call fcn.004ca8c0
add esp, 0xc
mov ecx, dword [ebp - 0xc4]
mov dword [ecx + 0xb0], 0x30
mov edx, dword [ebp - 0xc4]
mov dword [edx + 0xb4], 1
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0xc4]
mov edx, dword [ecx + 0x10]
mov dword [eax + 0xb8], edx
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0xc4]
mov edx, dword [ecx + 0x10]
mov dword [eax + 0xbc], edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ecx, dword [ebp - 0xc4]
mov dword [ecx + 0xd0], eax
lea ecx, [ebp - 0x28]
call fcn.00402ba0
mov edx, dword [ebp - 0xc4]
mov dword [edx + 0xd4], eax
push 1
lea eax, [ebp - 0x38]
push eax
mov ecx, dword [ebp - 0xd4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xd4]
mov eax, dword [edx + 0x1c]
call eax
mov ecx, dword [ebp - 0xc4]
add ecx, 0xc0
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov eax, dword [eax + 0xc]
mov dword [ecx + 0xc], eax
mov ecx, dword [ebp - 0xc4]
cmp dword [ecx + 0xac], 0
jne 0x40d343
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
push 0
mov edx, dword [ebp - 0xc4]
mov eax, dword [edx + 0x10]
push eax
push SysReAllocString
push SysReAllocString
push SysReAllocString
push SysReAllocString
push SysStringLen
push 0
push str.tooltips_class32
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov ecx, dword [ebp - 0xc4]
mov dword [ecx + 0xac], eax
mov edx, dword [ebp - 0xc4]
add edx, 0xb0
push edx
push 0
push 0x432
mov eax, dword [ebp - 0xc4]
mov ecx, dword [eax + 0xac]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [ebp - 0xd4]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xd4]
mov edx, dword [eax + 0x58]
call edx
push eax
push 0
push 0x418
mov eax, dword [ebp - 0xc4]
mov ecx, dword [eax + 0xac]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [ebp - 0xc4]
add edx, 0xb0
push edx
push 0
push 0x436
mov eax, dword [ebp - 0xc4]
mov ecx, dword [eax + 0xac]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [ebp - 0xc4]
add edx, 0xb0
push edx
push 1
push 0x411
mov eax, dword [ebp - 0xc4]
mov ecx, dword [eax + 0xac]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00402a80
mov edx, dword [ebp + 0x14]
mov byte [edx], 1
xor eax, eax
jmp 0x40ecf1
mov eax, dword [ebp - 0xc4]
cmp dword [eax + 0xac], 0
je 0x40d411
mov ecx, dword [ebp - 0xc4]
add ecx, 0xb0
push ecx
push 0
push 0x411
mov edx, dword [ebp - 0xc4]
mov eax, dword [edx + 0xac]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0xc4]
movzx edx, byte [ecx + 0x116]
test edx, edx
je 0x40d43b
push 0xffffffffffffffff
push 0
push 0x200
mov eax, dword [ebp - 0xc4]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [ebp - 0xc4]
mov byte [edx + 0x116], 0
jmp case.0x40cde0.3
mov eax, dword [ebp - 0xc4]
cmp dword [eax + 0xfc], 0
jne 0x40d46b
mov ecx, dword [ebp - 0xc4]
cmp dword [ecx + 0x108], 0
je 0x40d470
jmp case.0x40cde0.3
mov edx, dword [ebp - 0xc4]
movzx eax, byte [edx + 0x116]
test eax, eax
jne 0x40d525
xor ecx, ecx
mov dword [ebp - 0x19c], ecx
mov dword [ebp - 0x198], ecx
mov dword [ebp - 0x194], ecx
mov dword [ebp - 0x190], ecx
mov dword [ebp - 0x19c], 0x10
mov dword [ebp - 0x198], 3
mov edx, dword [ebp - 0xc4]
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x194], eax
mov ecx, dword [ebp - 0xc4]
cmp dword [ecx + 0xac], 0
jne 0x40d4dd
mov dword [ebp - 0x174], 0x190
jmp 0x40d4ff
push 0
push 3
push 0x415
mov edx, dword [ebp - 0xc4]
mov eax, dword [edx + 0xac]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x174], eax
mov ecx, dword [ebp - 0x174]
mov dword [ebp - 0x190], ecx
lea edx, [ebp - 0x19c]
push edx
call dword [sym.imp.COMCTL32.dll__TrackMouseEvent]
mov eax, dword [ebp - 0xc4]
mov byte [eax + 0x116], 1
mov ecx, dword [ebp + 0x10]
and ecx, 0xffff
movsx edx, cx
mov dword [ebp - 0x16c], edx
mov eax, dword [ebp + 0x10]
shr eax, 0x10
and eax, 0xffff
movsx ecx, ax
mov dword [ebp - 0x168], ecx
lea edx, [ebp - 0x16c]
push edx
lea ecx, [ebp - 0x250]
call fcn.00418d30
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0x250]
mov edx, dword [ebp - 0x24c]
mov dword [eax + 0xf4], ecx
mov dword [eax + 0xf8], edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x16c]
push edx
mov ecx, dword [ebp - 0xc4]
call fcn.0040efd0
movzx eax, al
test eax, eax
jne 0x40d5a1
jmp case.0x40cde0.3
mov ecx, dword [ebp - 0xc4]
cmp dword [ecx + 0xec], 0
je 0x40d5ef
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
sub esp, 8
mov ecx, esp
mov dword [ebp - 0x2b4], esp
lea edx, [ebp - 0x16c]
push edx
call fcn.00418d30
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0xe
mov edx, dword [ebp - 0xc4]
mov ecx, dword [edx + 0xec]
call fcn.00436c20
jmp 0x40d63b
mov eax, dword [ebp - 0xc4]
cmp dword [eax + 0xe4], 0
je 0x40d63b
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
sub esp, 8
mov ecx, esp
mov dword [ebp - 0x29c], esp
lea edx, [ebp - 0x16c]
push edx
call fcn.00418d30
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0xe
mov edx, dword [ebp - 0xc4]
mov ecx, dword [edx + 0xe4]
call fcn.00436c20
jmp case.0x40cde0.3
mov eax, dword [ebp - 0xc4]
cmp dword [eax + 0xfc], 0
jne 0x40d65e
mov ecx, dword [ebp - 0xc4]
cmp dword [ecx + 0x108], 0
je 0x40d663
jmp case.0x40cde0.3
mov edx, dword [ebp - 0xc4]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [ebp + 0x10]
and ecx, 0xffff
movsx edx, cx
mov dword [ebp - 0x164], edx
mov eax, dword [ebp + 0x10]
shr eax, 0x10
and eax, 0xffff
movsx ecx, ax
mov dword [ebp - 0x160], ecx
lea edx, [ebp - 0x164]
push edx
lea ecx, [ebp - 0x258]
call fcn.00418d30
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0x258]
mov edx, dword [ebp - 0x254]
mov dword [eax + 0xf4], ecx
mov dword [eax + 0xf8], edx
mov eax, dword [ebp - 0x160]
push eax
mov ecx, dword [ebp - 0x164]
push ecx
mov ecx, dword [ebp - 0xc4]
call fcn.0040f500
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0
jne 0x40d6f6
jmp case.0x40cde0.3
mov edx, dword [ebp - 0xd8]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xd8]
mov edx, dword [eax]
call edx
cmp eax, dword [ebp - 0xc4]
je 0x40d715
jmp case.0x40cde0.3
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0xd8]
mov dword [eax + 0xec], ecx
mov edx, dword [ebp - 0xd8]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xd8]
mov edx, dword [eax + 0xa4]
call edx
mov ecx, dword [ebp - 0xc4]
call fcn.0040f2c0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
sub esp, 8
mov ecx, esp
mov dword [ebp - 0x298], esp
lea eax, [ebp - 0x164]
push eax
call fcn.00418d30
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0x12
mov ecx, dword [ebp - 0xd8]
call fcn.00436c20
jmp case.0x40cde0.3
mov eax, dword [ebp - 0xc4]
cmp dword [eax + 0xfc], 0
jne 0x40d7a2
mov ecx, dword [ebp - 0xc4]
cmp dword [ecx + 0x108], 0
je 0x40d7a7
jmp case.0x40cde0.3
mov edx, dword [ebp - 0xc4]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [ebp + 0x10]
and ecx, 0xffff
movsx edx, cx
mov dword [ebp - 0x15c], edx
mov eax, dword [ebp + 0x10]
shr eax, 0x10
and eax, 0xffff
movsx ecx, ax
mov dword [ebp - 0x158], ecx
lea edx, [ebp - 0x15c]
push edx
lea ecx, [ebp - 0x1e0]
call fcn.00418d30
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0x1e0]
mov edx, dword [ebp - 0x1dc]
mov dword [eax + 0xf4], ecx
mov dword [eax + 0xf8], edx
mov eax, dword [ebp - 0x158]
push eax
mov ecx, dword [ebp - 0x15c]
push ecx
mov ecx, dword [ebp - 0xc4]
call fcn.0040f500
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0
jne 0x40d83a
jmp case.0x40cde0.3
mov edx, dword [ebp - 0xdc]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xdc]
mov edx, dword [eax]
call edx
cmp eax, dword [ebp - 0xc4]
je 0x40d859
jmp case.0x40cde0.3
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0xdc]
mov dword [eax + 0xec], ecx
mov edx, dword [ebp - 0xdc]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xdc]
mov edx, dword [eax + 0xa4]
call edx
mov ecx, dword [ebp - 0xc4]
call fcn.0040f2c0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
sub esp, 8
mov ecx, esp
mov dword [ebp - 0x290], esp
lea eax, [ebp - 0x15c]
push eax
call fcn.00418d30
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0x14
mov ecx, dword [ebp - 0xdc]
call fcn.00436c20
jmp case.0x40cde0.3
mov eax, dword [ebp - 0xc4]
cmp dword [eax + 0xfc], 0
jne 0x40d8e6
mov ecx, dword [ebp - 0xc4]
cmp dword [ecx + 0x108], 0
je 0x40d8eb
jmp case.0x40cde0.3
mov edx, dword [ebp - 0xc4]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [ebp + 0x10]
and ecx, 0xffff
movsx edx, cx
mov dword [ebp - 0x148], edx
mov eax, dword [ebp + 0x10]
shr eax, 0x10
and eax, 0xffff
movsx ecx, ax
mov dword [ebp - 0x144], ecx
lea edx, [ebp - 0x148]
push edx
lea ecx, [ebp - 0x1e8]
call fcn.00418d30
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0x1e8]
mov edx, dword [ebp - 0x1e4]
mov dword [eax + 0xf4], ecx
mov dword [eax + 0xf8], edx
mov eax, dword [ebp - 0x144]
push eax
mov ecx, dword [ebp - 0x148]
push ecx
mov ecx, dword [ebp - 0xc4]
call fcn.0040f500
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 0
jne 0x40d97e
jmp case.0x40cde0.3
mov edx, dword [ebp - 0x100]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x100]
mov edx, dword [eax]
call edx
cmp eax, dword [ebp - 0xc4]
je 0x40d99d
jmp case.0x40cde0.3
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0x100]
mov dword [eax + 0xec], ecx
mov ecx, dword [ebp - 0xc4]
call fcn.0040f2c0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
sub esp, 8
mov ecx, esp
mov dword [ebp - 0x28c], esp
lea edx, [ebp - 0x148]
push edx
call fcn.00418d30
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0
mov ecx, dword [ebp - 0x100]
call fcn.00436c20
jmp case.0x40cde0.3
mov edx, dword [ebp + 0x10]
and edx, 0xffff
movsx eax, dx
mov dword [ebp - 0x1b0], eax
mov ecx, dword [ebp + 0x10]
shr ecx, 0x10
and ecx, 0xffff
movsx edx, cx
mov dword [ebp - 0x1ac], edx
lea eax, [ebp - 0x1b0]
push eax
lea ecx, [ebp - 0x1f0]
call fcn.00418d30
mov ecx, dword [ebp - 0xc4]
mov edx, dword [ebp - 0x1f0]
mov eax, dword [ebp - 0x1ec]
mov dword [ecx + 0xf4], edx
mov dword [ecx + 0xf8], eax
mov ecx, dword [ebp - 0xc4]
call fcn.0040f2f0
mov ecx, dword [ebp - 0xc4]
cmp dword [ecx + 0xec], 0
jne 0x40da6c
jmp case.0x40cde0.3
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
sub esp, 8
mov ecx, esp
mov dword [ebp - 0x288], esp
lea edx, [ebp - 0x1b0]
push edx
call fcn.00418d30
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0x13
mov edx, dword [ebp - 0xc4]
mov ecx, dword [edx + 0xec]
call fcn.00436c20
mov eax, dword [ebp - 0xc4]
mov dword [eax + 0xec], 0
jmp case.0x40cde0.3
mov ecx, dword [ebp + 0x10]
and ecx, 0xffff
movsx edx, cx
mov dword [ebp - 0x1a8], edx
mov eax, dword [ebp + 0x10]
shr eax, 0x10
and eax, 0xffff
movsx ecx, ax
mov dword [ebp - 0x1a4], ecx
lea edx, [ebp - 0x1a8]
push edx
lea ecx, [ebp - 0x1f8]
call fcn.00418d30
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0x1f8]
mov edx, dword [ebp - 0x1f4]
mov dword [eax + 0xf4], ecx
mov dword [eax + 0xf8], edx
mov ecx, dword [ebp - 0xc4]
call fcn.0040f2f0
mov eax, dword [ebp - 0xc4]
cmp dword [eax + 0xec], 0
jne 0x40db33
jmp case.0x40cde0.3
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
sub esp, 8
mov ecx, esp
mov dword [ebp - 0x284], esp
lea edx, [ebp - 0x1a8]
push edx
call fcn.00418d30
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0x15
mov edx, dword [ebp - 0xc4]
mov ecx, dword [edx + 0xec]
call fcn.00436c20
jmp case.0x40cde0.3
mov eax, dword [ebp - 0xc4]
cmp dword [eax + 0xe0], 0
jne 0x40db89
jmp case.0x40cde0.3
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
lea ecx, [ebp - 0x2cc]
call fcn.0041b870
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
movzx eax, word [ebp + 0xc]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0x30
mov eax, dword [ebp - 0xc4]
mov ecx, dword [eax + 0xe0]
call fcn.00436c20
jmp case.0x40cde0.3
mov ecx, dword [ebp - 0xc4]
cmp dword [ecx + 0xe0], 0
jne 0x40dbdd
jmp case.0x40cde0.3
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
lea ecx, [ebp - 0x2d4]
call fcn.0041b870
mov edx, dword [eax + 4]
push edx
mov eax, dword [eax]
push eax
movzx ecx, word [ebp + 0xc]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 0x31
mov ecx, dword [ebp - 0xc4]
mov ecx, dword [ecx + 0xe0]
call fcn.00436c20
jmp case.0x40cde0.3
mov edx, dword [ebp + 0x10]
and edx, 0xffff
movsx eax, dx
mov dword [ebp - 0x154], eax
mov ecx, dword [ebp + 0x10]
shr ecx, 0x10
and ecx, 0xffff
movsx edx, cx
mov dword [ebp - 0x150], edx
lea eax, [ebp - 0x154]
push eax
mov ecx, dword [ebp - 0xc4]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.USER32.dll_ScreenToClient]
lea eax, [ebp - 0x154]
push eax
lea ecx, [ebp - 0x200]
call fcn.00418d30
mov ecx, dword [ebp - 0xc4]
mov edx, dword [ebp - 0x200]
mov eax, dword [ebp - 0x1fc]
mov dword [ecx + 0xf4], edx
mov dword [ecx + 0xf8], eax
mov ecx, dword [ebp - 0x150]
push ecx
mov edx, dword [ebp - 0x154]
push edx
mov ecx, dword [ebp - 0xc4]
call fcn.0040f500
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0
jne 0x40dcb8
jmp case.0x40cde0.3
mov eax, dword [ebp - 0x108]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x108]
mov eax, dword [edx]
call eax
cmp eax, dword [ebp - 0xc4]
je 0x40dcd7
jmp case.0x40cde0.3
mov ecx, dword [ebp + 0xc]
shr ecx, 0x10
and ecx, 0xffff
movsx edx, cx
mov dword [ebp - 0x1b4], edx
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
lea ecx, [ebp - 0x2dc]
call fcn.0041b870
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x1b4]
push ecx
push 0x18
mov ecx, dword [ebp - 0x108]
call fcn.00436c20
jmp case.0x40cde0.3
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x118], edx
xor ecx, ecx
mov eax, dword [ebp - 0x118]
mov edx, 0x28
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004c661d
add esp, 4
mov dword [ebp - 0x1b8], eax
mov eax, dword [ebp - 0x1b8]
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0x118], 1
jb 0x40e102
push 0x28
mov ecx, dword [ebp - 0xd0]
push ecx
mov edx, dword [ebp - 0x118]
push edx
mov eax, dword [ebp + 0x10]
push eax
call fcn.00440320
add esp, 0x10
movzx ecx, al
test ecx, ecx
je 0x40e102
mov edx, 0x28
imul eax, edx, 0
mov ecx, dword [ebp - 0xd0]
cmp dword [ecx + eax + 0xc], 0
je 0x40e102
mov edx, 0x28
imul eax, edx, 0
mov ecx, dword [ebp - 0xd0]
mov eax, dword [ecx + eax]
cdq
mov ecx, 0x64
idiv ecx
mov dword [ebp - 0xf8], eax
mov edx, 0x28
imul eax, edx, 0
mov ecx, dword [ebp - 0xd0]
mov eax, dword [ecx + eax + 4]
cdq
mov ecx, 0x64
idiv ecx
mov dword [ebp - 0xf4], eax
lea edx, [ebp - 0xf8]
push edx
mov eax, dword [ebp - 0xc4]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.USER32.dll_ScreenToClient]
mov edx, 0x28
imul eax, edx, 0
mov ecx, dword [ebp - 0xd0]
mov edx, dword [ecx + eax + 0x10]
and edx, 2
je 0x40df3a
mov eax, dword [ebp - 0xc4]
cmp dword [eax + 0xec], 0
jne 0x40de3c
mov ecx, dword [ebp - 0xc4]
cmp dword [ecx + 0x108], 0
je 0x40de41
jmp case.0x40cde0.3
mov edx, dword [ebp - 0xc4]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
lea ecx, [ebp - 0xf8]
push ecx
lea ecx, [ebp - 0x248]
call fcn.00418d30
mov edx, dword [ebp - 0xc4]
mov eax, dword [ebp - 0x248]
mov ecx, dword [ebp - 0x244]
mov dword [edx + 0x100], eax
mov dword [edx + 0x104], ecx
mov edx, dword [ebp - 0xf4]
push edx
mov eax, dword [ebp - 0xf8]
push eax
mov ecx, dword [ebp - 0xc4]
call fcn.0040f500
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 0
jne 0x40deae
jmp case.0x40cde0.3
mov ecx, dword [ebp - 0xe0]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xe0]
mov eax, dword [edx]
call eax
cmp eax, dword [ebp - 0xc4]
je 0x40decd
jmp case.0x40cde0.3
mov ecx, dword [ebp - 0xc4]
mov edx, dword [ebp - 0xe0]
mov dword [ecx + 0xfc], edx
mov eax, dword [ebp - 0xe0]
mov edx, dword [eax]
mov ecx, dword [ebp - 0xe0]
mov eax, dword [edx + 0xa4]
call eax
mov ecx, dword [ebp - 0xc4]
call fcn.0040f2c0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
sub esp, 8
mov ecx, esp
mov dword [ebp - 0x280], esp
lea edx, [ebp - 0xf8]
push edx
call fcn.00418d30
push 0
mov eax, dword [ebp + 0x10]
push eax
push 0
push 0x1b
mov ecx, dword [ebp - 0xe0]
call fcn.00436c20
jmp 0x40e102
mov ecx, 0x28
imul edx, ecx, 0
mov eax, dword [ebp - 0xd0]
mov ecx, dword [eax + edx + 0x10]
and ecx, 1
je 0x40e04d
mov edx, dword [ebp - 0xc4]
cmp dword [edx + 0xec], 0
jne 0x40df73
mov eax, dword [ebp - 0xc4]
cmp dword [eax + 0x108], 0
je 0x40df78
jmp case.0x40cde0.3
mov ecx, dword [ebp - 0xc4]
mov edx, dword [ecx + 0x100]
cmp edx, dword [ebp - 0xf8]
jne 0x40dfa5
mov eax, dword [ebp - 0xc4]
mov ecx, dword [eax + 0x104]
cmp ecx, dword [ebp - 0xf4]
jne 0x40dfa5
jmp case.0x40cde0.3
lea edx, [ebp - 0xf8]
push edx
lea ecx, [ebp - 0x208]
call fcn.00418d30
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0x208]
mov edx, dword [ebp - 0x204]
mov dword [eax + 0x100], ecx
mov dword [eax + 0x104], edx
mov eax, dword [ebp - 0xc4]
cmp dword [eax + 0xfc], 0
jne 0x40dfe9
jmp case.0x40cde0.3
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0xf8]
push eax
mov ecx, dword [ebp - 0xc4]
call fcn.0040efd0
movzx ecx, al
test ecx, ecx
jne 0x40e00f
jmp case.0x40cde0.3
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
sub esp, 8
mov ecx, esp
mov dword [ebp - 0x278], esp
lea edx, [ebp - 0xf8]
push edx
call fcn.00418d30
push 0
push 0
push 0
push 0x1c
mov eax, dword [ebp - 0xc4]
mov ecx, dword [eax + 0xfc]
call fcn.00436c20
jmp 0x40e102
mov ecx, 0x28
imul edx, ecx, 0
mov eax, dword [ebp - 0xd0]
mov ecx, dword [eax + edx + 0x10]
and ecx, 4
je 0x40e102
lea edx, [ebp - 0xf8]
push edx
lea ecx, [ebp - 0x210]
call fcn.00418d30
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0x210]
mov edx, dword [ebp - 0x20c]
mov dword [eax + 0x100], ecx
mov dword [eax + 0x104], edx
mov ecx, dword [ebp - 0xc4]
call fcn.0040f2f0
mov eax, dword [ebp - 0xc4]
cmp dword [eax + 0xfc], 0
jne 0x40e0b7
jmp case.0x40cde0.3
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
sub esp, 8
mov ecx, esp
mov dword [ebp - 0x294], esp
lea edx, [ebp - 0xf8]
push edx
call fcn.00418d30
push 0
mov eax, dword [ebp + 0x10]
push eax
push 0
push 0x1d
mov ecx, dword [ebp - 0xc4]
mov ecx, dword [ecx + 0xfc]
call fcn.00436c20
mov edx, dword [ebp - 0xc4]
mov dword [edx + 0xfc], 0
mov eax, dword [ebp + 0x10]
push eax
call fcn.004403c0
add esp, 4
mov ecx, dword [ebp - 0xd0]
mov dword [ebp - 0x1bc], ecx
mov edx, dword [ebp - 0x1bc]
push edx
call fcn.004c6626
add esp, 4
jmp case.0x40cde0.3
mov eax, dword [ebp - 0xc4]
movzx ecx, byte [eax + 0x10c]
test ecx, ecx
jne 0x40e144
jmp case.0x40cde0.3
mov edx, dword [ebp + 0xc]
shr edx, 0x10
and edx, 0xffff
movzx eax, dx
and eax, 0x2000
jne 0x40e165
mov ecx, dword [ebp + 0x14]
mov byte [ecx], 1
jmp case.0x40cde0.3
mov edx, dword [ebp + 0xc]
and edx, 0xffff
movzx eax, dx
mov dword [ebp - 0x11c], eax
lea ecx, [ebp - 0x1c0]
push ecx
mov edx, dword [ebp - 0x11c]
push edx
call fcn.00440450
add esp, 8
movzx eax, al
test eax, eax
jne 0x40e19b
xor eax, eax
jmp 0x40ecf1
xor ecx, ecx
mov dword [ebp - 0xf0], ecx
mov dword [ebp - 0xec], ecx
xorps xmm0, xmm0
movss dword [ebp - 0x104], xmm0
mov edx, dword [ebp - 0x1c0]
mov dword [ebp - 0x178], edx
cmp dword [ebp - 0x178], 2
je 0x40e1db
cmp dword [ebp - 0x178], 3
je 0x40e25f
jmp 0x40e2e3
lea eax, [ebp - 0xc0]
push eax
mov ecx, dword [ebp - 0x11c]
push ecx
call fcn.004404e0
add esp, 8
movzx edx, al
test edx, edx
jne 0x40e1ff
xor eax, eax
jmp 0x40ecf1
mov eax, dword [ebp - 0x98]
mov ecx, dword [ebp - 0x94]
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0xec], ecx
mov edx, dword [ebp - 0x3c]
mov dword [ebp - 0x17c], edx
cvtsi2sd xmm0, dword [ebp - 0x17c]
mov eax, dword [ebp - 0x17c]
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x526f50]
movsd qword [ebp - 0x2a4], xmm0
cvtsd2ss xmm0, qword [ebp - 0x2a4]
divss xmm0, dword [0x526f30]
movss dword [ebp - 0x104], xmm0
jmp 0x40e2ea
lea ecx, [ebp - 0x384]
push ecx
mov edx, dword [ebp - 0x11c]
push edx
call fcn.00440570
add esp, 8
movzx eax, al
test eax, eax
jne 0x40e283
xor eax, eax
jmp 0x40ecf1
mov ecx, dword [ebp - 0x35c]
mov edx, dword [ebp - 0x358]
mov dword [ebp - 0xf0], ecx
mov dword [ebp - 0xec], edx
mov eax, dword [ebp - 0x324]
mov dword [ebp - 0x128], eax
cvtsi2sd xmm0, dword [ebp - 0x128]
mov ecx, dword [ebp - 0x128]
shr ecx, 0x1f
addsd xmm0, qword [ecx*8 + 0x526f50]
movsd qword [ebp - 0x2ac], xmm0
cvtsd2ss xmm0, qword [ebp - 0x2ac]
divss xmm0, dword [0x526f30]
movss dword [ebp - 0x104], xmm0
jmp 0x40e2ea
xor eax, eax
jmp 0x40ecf1
lea edx, [ebp - 0xf0]
push edx
mov eax, dword [ebp - 0xc4]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.USER32.dll_ScreenToClient]
mov edx, dword [ebp + 8]
mov dword [ebp - 0x10c], edx
mov eax, dword [ebp - 0x10c]
sub eax, 0x245
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 7
ja case.0x40e32e.3
mov ecx, dword [ebp - 0x10c]
jmp dword [ecx*4 + 0x40ef78]
mov edx, dword [ebp - 0xc4]
cmp dword [edx + 0xec], 0
jne 0x40e353
mov eax, dword [ebp - 0xc4]
cmp dword [eax + 0xfc], 0
je 0x40e35e
mov ecx, dword [ebp + 0x14]
mov byte [ecx], 1
jmp case.0x40e32e.3
mov edx, dword [ebp - 0xc4]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
lea ecx, [ebp - 0xf0]
push ecx
lea ecx, [ebp - 0x218]
call fcn.00418d30
mov edx, dword [ebp - 0xc4]
mov eax, dword [ebp - 0x218]
mov ecx, dword [ebp - 0x214]
mov dword [edx + 0xf4], eax
mov dword [edx + 0xf8], ecx
mov edx, dword [ebp - 0xec]
push edx
mov eax, dword [ebp - 0xf0]
push eax
mov ecx, dword [ebp - 0xc4]
call fcn.0040f500
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0
jne 0x40e3cb
jmp case.0x40e32e.3
mov ecx, dword [ebp - 0xe4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xe4]
mov eax, dword [edx]
call eax
cmp eax, dword [ebp - 0xc4]
je 0x40e3ea
jmp case.0x40e32e.3
mov ecx, dword [ebp - 0xc4]
mov edx, dword [ebp - 0xe4]
mov dword [ecx + 0x108], edx
mov eax, dword [ebp - 0xe4]
mov edx, dword [eax]
mov ecx, dword [ebp - 0xe4]
mov eax, dword [edx + 0xa4]
call eax
mov ecx, dword [ebp - 0xc4]
call fcn.0040f2c0
push ecx
movss xmm0, dword [ebp - 0x104]
movss dword [esp], xmm0
sub esp, 8
mov ecx, esp
mov dword [ebp - 0x260], esp
lea edx, [ebp - 0xf0]
push edx
call fcn.00418d30
push 0
mov eax, dword [ebp + 0x10]
push eax
push 0
push 0x20
mov ecx, dword [ebp - 0xe4]
call fcn.00436c20
mov ecx, dword [ebp - 0xc4]
cmp dword [ecx + 0x108], 0
je 0x40e484
mov edx, dword [ebp - 0xc4]
mov ecx, dword [edx + 0x108]
call fcn.00418d10
movzx eax, al
test eax, eax
je 0x40e484
mov ecx, dword [ebp + 0x14]
mov byte [ecx], 1
jmp case.0x40e32e.3
mov edx, dword [ebp - 0xc4]
cmp dword [edx + 0xec], 0
jne 0x40e4a7
mov eax, dword [ebp - 0xc4]
cmp dword [eax + 0xfc], 0
je 0x40e4b2
mov ecx, dword [ebp + 0x14]
mov byte [ecx], 1
jmp case.0x40e32e.3
lea edx, [ebp - 0xf0]
push edx
lea ecx, [ebp - 0x220]
call fcn.00418d30
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0x220]
mov edx, dword [ebp - 0x21c]
mov dword [eax + 0xf4], ecx
mov dword [eax + 0xf8], edx
mov eax, dword [ebp - 0xc4]
cmp dword [eax + 0x108], 0
jne 0x40e4f6
jmp case.0x40e32e.3
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0xf0]
push eax
mov ecx, dword [ebp - 0xc4]
call fcn.0040efd0
movzx ecx, al
test ecx, ecx
jne 0x40e51c
jmp case.0x40e32e.3
push ecx
movss xmm0, dword [ebp - 0x104]
movss dword [esp], xmm0
sub esp, 8
mov ecx, esp
mov dword [ebp - 0x264], esp
lea edx, [ebp - 0xf0]
push edx
call fcn.00418d30
push 0
push 0
push 0
push 0x21
mov eax, dword [ebp - 0xc4]
mov ecx, dword [eax + 0x108]
call fcn.00436c20
mov ecx, dword [ebp - 0xc4]
cmp dword [ecx + 0x108], 0
je 0x40e587
mov edx, dword [ebp - 0xc4]
mov ecx, dword [edx + 0x108]
call fcn.00418d10
movzx eax, al
test eax, eax
je 0x40e587
mov ecx, dword [ebp + 0x14]
mov byte [ecx], 1
jmp case.0x40e32e.3
lea edx, [ebp - 0xf0]
push edx
lea ecx, [ebp - 0x228]
call fcn.00418d30
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0x228]
mov edx, dword [ebp - 0x224]
mov dword [eax + 0xf4], ecx
mov dword [eax + 0xf8], edx
mov ecx, dword [ebp - 0xc4]
call fcn.0040f2f0
mov eax, dword [ebp - 0xc4]
cmp dword [eax + 0x108], 0
jne 0x40e5d8
jmp case.0x40e32e.3
push ecx
movss xmm0, dword [ebp - 0x104]
movss dword [esp], xmm0
sub esp, 8
mov ecx, esp
mov dword [ebp - 0x268], esp
lea edx, [ebp - 0xf0]
push edx
call fcn.00418d30
push 0
mov eax, dword [ebp + 0x10]
push eax
push 0
push 0x22
mov ecx, dword [ebp - 0xc4]
mov ecx, dword [ecx + 0x108]
call fcn.00436c20
mov edx, dword [ebp - 0xc4]
cmp dword [edx + 0x108], 0
je 0x40e645
mov eax, dword [ebp - 0xc4]
mov ecx, dword [eax + 0x108]
call fcn.00418d10
movzx ecx, al
test ecx, ecx
je 0x40e645
mov edx, dword [ebp + 0x14]
mov byte [edx], 1
mov eax, dword [ebp - 0xc4]
mov dword [eax + 0x108], 0
xor eax, eax
jmp 0x40ecf1
mov ecx, dword [ebp - 0xc4]
cmp dword [ecx + 0xec], 0
je 0x40e689
mov edx, dword [ebp - 0xc4]
mov eax, dword [edx + 0xec]
mov dword [ebp - 0x12c], eax
jmp 0x40e693
mov dword [ebp - 0x12c], 0
mov ecx, dword [ebp - 0x12c]
mov dword [ebp - 0xe8], ecx
mov edx, dword [ebp - 0xc4]
cmp dword [edx + 0xfc], 0
je 0x40e6c2
mov eax, dword [ebp - 0xc4]
mov ecx, dword [eax + 0xfc]
mov dword [ebp - 0x130], ecx
jmp 0x40e6ce
mov edx, dword [ebp - 0xe8]
mov dword [ebp - 0x130], edx
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0xe8], eax
mov ecx, dword [ebp - 0xc4]
cmp dword [ecx + 0x108], 0
je 0x40e6fd
mov edx, dword [ebp - 0xc4]
mov eax, dword [edx + 0x108]
mov dword [ebp - 0x134], eax
jmp 0x40e709
mov ecx, dword [ebp - 0xe8]
mov dword [ebp - 0x134], ecx
mov edx, dword [ebp - 0x134]
mov dword [ebp - 0xe8], edx
mov eax, dword [ebp + 0x10]
and eax, 0xffff
movsx ecx, ax
mov dword [ebp - 0x1d8], ecx
mov edx, dword [ebp + 0x10]
shr edx, 0x10
and edx, 0xffff
movsx eax, dx
mov dword [ebp - 0x1d4], eax
lea ecx, [ebp - 0x1d8]
push ecx
lea ecx, [ebp - 0x230]
call fcn.00418d30
mov edx, dword [ebp - 0xc4]
mov eax, dword [ebp - 0x230]
mov ecx, dword [ebp - 0x22c]
mov dword [edx + 0xf4], eax
mov dword [edx + 0xf8], ecx
cmp dword [ebp - 0xe8], 0
je 0x40e786
mov ecx, dword [ebp - 0xe8]
call fcn.00418cf0
movzx edx, al
test edx, edx
jne 0x40e78b
jmp case.0x40cde0.3
mov ecx, dword [ebp - 0xc4]
call fcn.0040f2f0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
sub esp, 8
mov ecx, esp
mov dword [ebp - 0x26c], esp
lea eax, [ebp - 0x1d8]
push eax
call fcn.00418d30
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0x13
mov ecx, dword [ebp - 0xe8]
call fcn.00436c20
mov eax, dword [ebp - 0xc4]
mov dword [eax + 0xec], 0
mov ecx, dword [ebp - 0xc4]
mov dword [ecx + 0xfc], 0
mov edx, dword [ebp - 0xc4]
mov dword [edx + 0x108], 0
jmp case.0x40cde0.3
mov eax, dword [ebp + 0x10]
and eax, 0xffff
movsx ecx, ax
mov dword [ebp - 0x184], ecx
mov edx, dword [ebp + 0x10]
shr edx, 0x10
and edx, 0xffff
movsx eax, dx
mov dword [ebp - 0x180], eax
lea ecx, [ebp - 0x184]
push ecx
mov edx, dword [ebp - 0xc4]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
lea ecx, [ebp - 0x184]
push ecx
lea ecx, [ebp - 0x238]
call fcn.00418d30
mov edx, dword [ebp - 0xc4]
mov eax, dword [ebp - 0x238]
mov ecx, dword [ebp - 0x234]
mov dword [edx + 0xf4], eax
mov dword [edx + 0xf8], ecx
mov edx, dword [ebp - 0xc4]
cmp dword [edx + 0xec], 0
jne 0x40e883
jmp case.0x40cde0.3
mov ecx, dword [ebp - 0xc4]
call fcn.0040f2f0
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
sub esp, 8
mov ecx, esp
mov dword [ebp - 0x270], esp
lea eax, [ebp - 0x184]
push eax
call fcn.00418d30
push 0
mov ecx, dword [ebp - 0xc4]
mov edx, dword [ecx + 0xec]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 1
mov ecx, dword [ebp - 0xc4]
mov ecx, dword [ecx + 0xec]
call fcn.00436c20
mov edx, dword [ebp - 0xc4]
mov dword [edx + 0xec], 0
jmp case.0x40cde0.3
mov eax, dword [ebp - 0xc4]
cmp dword [eax + 0xe0], 0
jne 0x40e8fd
jmp case.0x40cde0.3
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
lea ecx, [ebp - 0x2e4]
call fcn.0041b870
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
movzx eax, word [ebp + 0xc]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0xa
mov eax, dword [ebp - 0xc4]
mov ecx, dword [eax + 0xe0]
call fcn.00436c20
jmp case.0x40cde0.3
mov ecx, dword [ebp - 0xc4]
cmp dword [ecx + 0xe0], 0
jne 0x40e951
jmp case.0x40cde0.3
cmp dword [ebp + 0xc], 9
jne 0x40ea5c
mov edx, dword [ebp - 0xc4]
cmp dword [edx + 0xe0], 0
je 0x40ea20
mov eax, dword [ebp - 0xc4]
mov ecx, dword [eax + 0xe0]
mov edx, dword [ebp - 0xc4]
mov eax, dword [ecx]
mov ecx, dword [edx + 0xe0]
mov edx, dword [eax + 0x14]
call edx
movzx eax, al
test eax, eax
je 0x40ea20
mov ecx, dword [ebp - 0xc4]
mov edx, dword [ecx + 0xe0]
mov eax, dword [ebp - 0xc4]
mov edx, dword [edx]
mov ecx, dword [eax + 0xe0]
mov eax, dword [edx + 0x88]
call eax
movzx ecx, al
test ecx, ecx
je 0x40ea20
push 0
push 0x540338
push 0x54031c
push 0
mov edx, dword [ebp - 0xc4]
mov eax, dword [edx + 0xe0]
push eax
call fcn.004cc5cf
add esp, 0x14
test eax, eax
je 0x40ea20
push 0
push 0x540338
push 0x54031c
push 0
mov ecx, dword [ebp - 0xc4]
mov edx, dword [ecx + 0xe0]
push edx
call fcn.004cc5cf
add esp, 0x14
mov ecx, eax
call fcn.00443f60
movzx eax, al
test eax, eax
je 0x40ea20
xor eax, eax
jmp 0x40ecf1
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
test ecx, ecx
jl 0x40ea38
mov byte [ebp - 0xc9], 1
jmp 0x40ea3f
mov byte [ebp - 0xc9], 0
movzx edx, byte [ebp - 0xc9]
push edx
mov ecx, dword [ebp - 0xc4]
call fcn.0040f330
mov eax, 1
jmp 0x40ecf1
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0xc4]
mov edx, dword [ecx + 0xe0]
mov dword [eax + 0xf0], edx
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
lea ecx, [ebp - 0x2ec]
call fcn.0041b870
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
movzx eax, word [ebp + 0xc]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 8
mov eax, dword [ebp - 0xc4]
mov ecx, dword [eax + 0xe0]
call fcn.00436c20
jmp case.0x40cde0.3
mov ecx, dword [ebp - 0xc4]
cmp dword [ecx + 0xf0], 0
jne 0x40eac8
jmp case.0x40cde0.3
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
lea ecx, [ebp - 0x2f4]
call fcn.0041b870
mov edx, dword [eax + 4]
push edx
mov eax, dword [eax]
push eax
movzx ecx, word [ebp + 0xc]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 9
mov ecx, dword [ebp - 0xc4]
mov ecx, dword [ecx + 0xf0]
call fcn.00436c20
mov edx, dword [ebp - 0xc4]
mov dword [edx + 0xf0], 0
jmp case.0x40cde0.3
mov eax, dword [ebp + 0x10]
and eax, 0xffff
movzx ecx, ax
cmp ecx, 1
je 0x40eb2d
jmp case.0x40cde0.3
mov edx, dword [ebp - 0xc4]
cmp dword [edx + 0xec], 0
jne 0x40eb5a
mov eax, dword [ebp - 0xc4]
cmp dword [eax + 0xfc], 0
jne 0x40eb5a
mov ecx, dword [ebp - 0xc4]
cmp dword [ecx + 0x108], 0
je 0x40eb67
mov edx, dword [ebp + 0x14]
mov byte [edx], 1
xor eax, eax
jmp 0x40ecf1
xor eax, eax
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x120], eax
lea ecx, [ebp - 0x124]
push ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
lea edx, [ebp - 0x124]
push edx
mov eax, dword [ebp - 0xc4]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.USER32.dll_ScreenToClient]
lea edx, [ebp - 0x124]
push edx
lea ecx, [ebp - 0x240]
call fcn.00418d30
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0x240]
mov edx, dword [ebp - 0x23c]
mov dword [eax + 0xf4], ecx
mov dword [eax + 0xf8], edx
mov eax, dword [ebp - 0x120]
push eax
mov ecx, dword [ebp - 0x124]
push ecx
mov ecx, dword [ebp - 0xc4]
call fcn.0040f500
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0
jne 0x40ebf6
jmp case.0x40cde0.3
push ecx
xorps xmm0, xmm0
movss dword [esp], xmm0
sub esp, 8
mov ecx, esp
mov dword [ebp - 0x274], esp
lea edx, [ebp - 0x124]
push edx
call fcn.00418d30
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0x28
mov ecx, dword [ebp - 0x138]
call fcn.00436c20
mov edx, dword [ebp + 0x14]
mov byte [edx], 1
xor eax, eax
jmp 0x40ecf1
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0
je 0x40ec71
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
add eax, 0x2000
push eax
mov ecx, dword [ebp - 0x13c]
mov edx, dword [ecx]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x40ecf1
mov eax, dword [ebp + 0x14]
mov byte [eax], 1
xor eax, eax
jmp 0x40ecf1
cmp dword [ebp + 0x10], 0
jne 0x40ec85
jmp case.0x40cde0.3
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x1c4], ecx
mov edx, dword [ebp + 0x14]
mov byte [edx], 1
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
add edx, 0x2000
push edx
mov eax, dword [ebp - 0x1c4]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x40ecf1
cmp dword [ebp + 0x10], 0
jne 0x40ecbf
jmp case.0x40cde0.3
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x1c8], ecx
mov edx, dword [ebp + 0x14]
mov byte [edx], 1
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
add edx, 0x2000
push edx
mov eax, dword [ebp - 0x1c8]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x40ecf1
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c662b
mov esp, ebp
pop ebp
ret 0x10