Function at 0x41b6d0
Capabilities:
Check for time delay via gettickcount
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x46ae4b
mov eax, dword fs:[0]
push eax
sub esp, 0x158
mov eax, dword [0x4860f0]
xor eax, esp
mov dword [esp + 0x150], eax
push ebx
push esi
push edi
mov eax, dword [0x4860f0]
xor eax, esp
push eax
lea eax, [esp + 0x168]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov esi, edx
cmp dword [esi], 0
mov dword [esp + 0x38], esi
mov dword [esp + 0x50], eax
mov dword [esp + 0x28], ebx
mov dword [esp + 0x14], ecx
je 0x41cbee
lea ecx, [esi + 0x100]
xor eax, eax
mov dword [esp + 0x3c], ecx
call fcn.00420410
mov dword [esp + 0x40], eax
test eax, eax
je 0x41b7f3
mov edi, edi
mov edx, dword [esp + 0x3c]
xor ecx, ecx
call fcn.004203b0
mov edx, dword [esp + 0x40]
mov eax, dword [edx + 0x108]
test eax, eax
je 0x41b782
lea edi, [eax + 0x34]
mov eax, edi
call fcn.0042b760
test al, al
je 0x41b782
mov ebx, edx
call fcn.0042b7c0
mov ebx, dword [esp + 0x28]
lea eax, [esi + 0xb8]
xor edi, edi
call fcn.0041ec70
test eax, eax
jle 0x41b7bd
mov edx, edi
lea eax, [esi + 0xb8]
call fcn.00420430
mov ecx, dword [esp + 0x40]
mov edx, dword [eax]
mov edx, dword [edx]
push ecx
mov ecx, eax
call edx
lea eax, [esi + 0xb8]
inc edi
call fcn.0041ec70
cmp edi, eax
jl 0x41b793
mov edi, dword [esp + 0x40]
lea ecx, [edi + 0x84]
call fcn.0040dad0
mov ecx, edi
call fcn.0040dad0
push edi
call fcn.004567f0
mov ecx, dword [esp + 0x40]
add esp, 4
xor eax, eax
call fcn.00420410
mov dword [esp + 0x40], eax
test eax, eax
jne 0x41b750
lea eax, [esi + 0xdc]
mov dword [esp + 0x40], 0
call fcn.0041ec70
mov edi, dword [esp + 0x50]
test eax, eax
jle 0x41b85a
mov edi, edi
mov edx, dword [esp + 0x40]
lea eax, [esi + 0xdc]
mov byte [esp + 0x27], 0
call fcn.00420430
mov edx, dword [eax]
mov edx, dword [edx]
lea ecx, [esp + 0x27]
push ecx
mov ecx, dword [ebp + 8]
push ebx
push edi
push ecx
mov ecx, eax
call edx
cmp byte [esp + 0x27], 0
jne 0x41c189
mov ecx, dword [esp + 0x40]
inc ecx
lea eax, [esi + 0xdc]
mov dword [esp + 0x40], ecx
call fcn.0041ec70
cmp ecx, eax
jl 0x41b810
mov eax, dword [ebp + 8]
cmp eax, 0x111
ja 0x41c1b9
je 0x41c196
add eax, 0xfffffffb
cmp eax, 0xfd
ja case.0x41c1e1.276
movzx edx, byte [eax + 0x41cc48]
jmp dword [edx*4 + 0x41cc18]
mov ecx, dword [esi + 0x68]
xor eax, eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], eax
mov eax, dword [esi + 0x64]
mov dword [esp + 0x54], 0
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x58]
mov dword [esp + 0x5c], eax
test ecx, ecx
je 0x41b8ea
mov dword [esp + 0x54], 0xa
mov dword [esp + 0x58], ecx
mov edx, dword [ecx]
mov edx, dword [edx + 0x108]
lea eax, [esp + 0x54]
push eax
call edx
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x41b90c
mov dword [esp + 0x54], 0xe
mov dword [esp + 0x58], ecx
mov eax, dword [ecx]
mov eax, dword [eax + 0x108]
lea edx, [esp + 0x54]
push edx
call eax
push 0
mov eax, esi
call fcn.0041d1a0
mov ecx, dword [esi]
push 4
push ecx
call dword [sym.imp.USER32.dll_GetWindow]
test eax, eax
je case.0x41c1e1.276
push eax
call dword [sym.imp.USER32.dll_SetFocus]
jmp case.0x41c1e1.276
mov edx, dword [esp + 0x14]
mov dword [edx], 1
mov al, 1
jmp 0x41cbf0
mov ecx, dword [esi]
xor eax, eax
xor edi, edi
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
push edi
lea eax, [esp + 0x44]
push eax
push ecx
mov dword [esp + 0x4c], edi
call dword [sym.imp.USER32.dll_GetUpdateRect]
test eax, eax
je 0x41c18f
cmp dword [esi + 0x50], edi
jne 0x41b9b8
push 0x3c
lea edx, [esp + 0x9c]
push edi
push edx
mov dword [esp + 0xa0], edi
call fcn.00459a90
mov ecx, dword [esi]
add esp, 0xc
lea eax, [esp + 0x94]
push eax
push ecx
call dword [sym.imp.USER32.dll_BeginPaint]
mov eax, dword [esi]
lea edx, [esp + 0x94]
push edx
push eax
call dword [sym.imp.USER32.dll_EndPaint]
mov al, 1
jmp 0x41cbf0
cmp byte [esi + 0xb1], 0
je 0x41bafd
mov edx, dword [esi]
lea ecx, [esp + 0x14]
xor eax, eax
push ecx
push edx
mov byte [esi + 0xb1], 0
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
call dword [sym.imp.USER32.dll_GetClientRect]
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
jne 0x41bafd
mov ecx, dword [esi + 0x50]
mov eax, ecx
call fcn.00426dd0
mov edx, dword [ecx]
test al, al
je 0x41ba78
mov edi, dword [esp + 0x14]
sub esp, 0x10
mov eax, esp
mov dword [eax], edi
mov edi, dword [esp + 0x28]
mov dword [eax + 4], edi
mov edi, dword [esp + 0x2c]
mov dword [eax + 8], edi
mov edi, dword [esp + 0x30]
mov dword [eax + 0xc], edi
mov eax, dword [edx + 0x34]
call eax
mov eax, dword [esi + 0xc]
mov edi, dword [sym.imp.GDI32.dll_DeleteDC]
xor ebx, ebx
cmp eax, ebx
je 0x41ba46
push eax
call edi
mov eax, dword [esi + 0x10]
cmp eax, ebx
je 0x41ba50
push eax
call edi
mov eax, dword [esi + 0x14]
mov edi, dword [sym.imp.GDI32.dll_DeleteObject]
cmp eax, ebx
je 0x41ba60
push eax
call edi
mov eax, dword [esi + 0x18]
cmp eax, ebx
je 0x41ba6a
push eax
call edi
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
jmp 0x41badc
mov eax, dword [edx + 0xfc]
push SysReAllocString
push 0
push 0x41e760
call eax
mov ebx, eax
test ebx, ebx
je 0x41badc
mov edi, dword [ebx]
mov edx, dword [edi + 0x30]
mov ecx, ebx
call edx
mov edx, dword [eax]
sub esp, 0x10
mov ecx, esp
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [ecx + 8], edx
mov edx, dword [edi + 0x34]
mov dword [ecx + 0xc], eax
mov ecx, ebx
call edx
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
mov edx, dword [eax + 0xfc]
push SysReAllocString
push 0
push 0x41e760
call edx
mov ebx, eax
test ebx, ebx
jne 0x41ba92
cmp byte [esi + 0xb0], 0
je 0x41bafd
mov edi, dword [esi + 0x50]
push 0
push 0
mov ebx, str.windowinit
mov byte [esi + 0xb0], 0
call fcn.0041d8f0
cmp byte [esi + 0xb2], 0
je 0x41bb11
mov bl, 1
call fcn.0041d680
mov esi, dword [esp + 0x38]
cmp byte [esi + 0xb3], 0
je 0x41bb6b
xor eax, eax
cmp dword [esi + 0x14], eax
jne 0x41bb6b
mov ecx, dword [esi]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
lea eax, [esp + 0x28]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
mov edx, dword [esi + 8]
push edx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ecx, dword [esp + 0x30]
sub ecx, dword [esp + 0x28]
mov edx, dword [esi + 8]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0x34]
sub eax, dword [esp + 0x2c]
push eax
push ecx
push edx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [esi + 0x14], eax
push 0x3c
lea eax, [esp + 0x5c]
push 0
push eax
mov dword [esp + 0x60], 0
call fcn.00459a90
mov edx, dword [esi]
add esp, 0xc
lea ecx, [esp + 0x54]
push ecx
push edx
call dword [sym.imp.USER32.dll_BeginPaint]
cmp byte [esi + 0xb3], 0
je 0x41bd7f
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 0xc]
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
push eax
push ecx
call edi
mov edx, dword [esi + 0xc]
push edx
mov dword [esp + 0x40], eax
call dword [sym.imp.GDI32.dll_SaveDC]
cmp byte [esi + 0xb4], 0
mov ebx, dword [sym.imp.GDI32.dll_BitBlt]
mov dword [esp + 0x28], eax
je 0x41bc8c
mov eax, dword [esi + 0x18]
test eax, eax
jne 0x41bc5c
mov ecx, dword [esi]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
lea eax, [esp + 0x14]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
mov edx, dword [esi + 8]
push edx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ecx, dword [esp + 0x1c]
sub ecx, dword [esp + 0x14]
mov edx, dword [esi + 8]
mov dword [esi + 0x10], eax
mov eax, dword [esp + 0x20]
sub eax, dword [esp + 0x18]
push eax
push ecx
push edx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x10]
push eax
call edi
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x5c]
mov edx, dword [esp + 0x54]
push 0xcc0020
push eax
push ecx
push edx
mov edx, dword [esp + 0x78]
sub edx, eax
push edx
mov edx, dword [esp + 0x78]
sub edx, ecx
push edx
push eax
mov eax, dword [esi + 0x10]
push ecx
push eax
call ebx
jmp 0x41bc63
mov ecx, dword [esi + 0x10]
push eax
push ecx
call edi
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x5c]
mov edx, dword [esi + 0x10]
push 0xcc0020
push eax
push ecx
push edx
mov edx, dword [esp + 0x78]
sub edx, eax
push edx
mov edx, dword [esp + 0x78]
sub edx, ecx
push edx
push eax
mov eax, dword [esi + 0xc]
push ecx
push eax
call ebx
mov ecx, dword [esi + 0x50]
mov edx, dword [ecx]
mov edx, dword [edx + 0x118]
lea eax, [esp + 0x5c]
push eax
mov eax, dword [esi + 0xc]
push eax
call edx
lea edi, [esi + 0xe8]
mov eax, edi
xor ebx, ebx
call fcn.0041ec70
test eax, eax
jle 0x41bcdf
mov edx, ebx
mov eax, edi
call fcn.00420430
mov edx, dword [eax]
mov edx, dword [edx + 0x130]
lea ecx, [esp + 0x5c]
push ecx
mov ecx, dword [esi + 0xc]
push ecx
mov ecx, eax
call edx
mov eax, edi
inc ebx
call fcn.0041ec70
cmp ebx, eax
jl 0x41bcb5
mov eax, dword [esp + 0x28]
mov ecx, dword [esi + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_RestoreDC]
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x5c]
mov edx, dword [esi + 0xc]
push 0xcc0020
push eax
push ecx
push edx
mov edx, dword [esp + 0x78]
sub edx, eax
push edx
mov edx, dword [esp + 0x78]
sub edx, ecx
push edx
push eax
mov eax, dword [esp + 0x70]
push ecx
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
mov ecx, dword [esp + 0x3c]
mov edx, dword [esi + 0xc]
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
push ecx
push edx
call edi
cmp byte [esi + 0x4c], 0
je 0x41bdaf
mov eax, dword [0x489ca4]
mov ecx, dword [esp + 0x54]
push eax
push ecx
call edi
push 5
mov ebx, eax
call dword [sym.imp.GDI32.dll_GetStockObject]
mov edx, dword [esp + 0x54]
push eax
push edx
call edi
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x44]
push eax
mov eax, dword [esp + 0x44]
push ecx
mov ecx, dword [esp + 0x5c]
push edx
push eax
push ecx
call dword [sym.imp.GDI32.dll_Rectangle]
mov edx, dword [esp + 0x54]
push ebx
push edx
call edi
jmp 0x41bdaf
mov eax, dword [esp + 0x54]
push eax
call dword [sym.imp.GDI32.dll_SaveDC]
mov ecx, dword [esi + 0x50]
mov edx, dword [ecx]
mov edx, dword [edx + 0x118]
mov edi, eax
lea eax, [esp + 0x5c]
push eax
mov eax, dword [esp + 0x58]
push eax
call edx
mov eax, dword [esp + 0x54]
push edi
push eax
call dword [sym.imp.GDI32.dll_RestoreDC]
mov edx, dword [esi]
lea ecx, [esp + 0x54]
push ecx
push edx
call dword [sym.imp.USER32.dll_EndPaint]
cmp byte [esi + 0xb1], 0
je 0x41bdd3
mov eax, dword [esi]
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov al, 1
jmp 0x41cbf0
mov eax, dword [esi + 0x6c]
test eax, eax
jle 0x41bde4
mov dword [ebx + 0x18], eax
mov eax, dword [esi + 0x70]
test eax, eax
jle 0x41bdee
mov dword [ebx + 0x1c], eax
mov eax, dword [esi + 0x74]
test eax, eax
jle 0x41bdf8
mov dword [ebx + 0x20], eax
mov eax, dword [esi + 0x78]
test eax, eax
jle case.0x41c1e1.276
mov dword [ebx + 0x24], eax
jmp case.0x41c1e1.276
mov ecx, dword [esi + 0x54]
test ecx, ecx
je 0x41be58
xor eax, eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], eax
mov dword [esp + 0x54], 0x17
mov dword [esp + 0x58], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x54]
mov dword [esp + 0x5c], eax
mov edx, dword [ecx]
mov edx, dword [edx + 0x108]
lea eax, [esp + 0x54]
push eax
call edx
mov esi, dword [esi + 0x50]
test esi, esi
je 0x41be66
mov eax, esi
call fcn.00426de0
mov al, 1
jmp 0x41cbf0
movsx eax, bx
shr ebx, 0x10
lea edx, [esp + 0x14]
mov dword [esp + 0x14], eax
mov eax, dword [esi]
movsx ecx, bx
push edx
push eax
mov dword [esp + 0x20], ecx
call dword [sym.imp.USER32.dll_ScreenToClient]
cmp dword [esi + 0x5c], 0
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi + 0x64], ecx
mov dword [esi + 0x68], edx
je case.0x41c1e1.276
push esi
call fcn.0041d650
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor eax, eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], eax
mov dword [esp + 0x70], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x6c], eax
mov eax, dword [esi + 0x5c]
mov dword [esp + 0x54], 0x12
mov dword [esp + 0x58], eax
mov dword [esp + 0x60], ecx
mov dword [esp + 0x64], edx
mov word [esp + 0x6a], di
mov dword [esp + 0x70], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x5c]
mov dword [esp + 0x5c], eax
mov eax, dword [ecx]
mov eax, dword [eax + 0x108]
lea edx, [esp + 0x54]
push edx
call eax
mov dword [esi + 0x5c], 0
jmp case.0x41c1e1.276
cmp dword [esi + 0x54], 0
je case.0x41c1e1.276
mov ecx, dword [esi + 0x64]
mov edx, dword [esi + 0x68]
xor eax, eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], eax
mov dword [esp + 0x54], 5
mov word [esp + 0x68], di
mov dword [esp + 0x60], ecx
mov dword [esp + 0x64], edx
call fcn.0041a9c0
mov word [esp + 0x6a], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x54]
mov dword [esp + 0x5c], eax
mov eax, dword [ecx]
mov eax, dword [eax + 0x108]
lea edx, [esp + 0x54]
push edx
call eax
jmp case.0x41c1e1.276
cmp dword [esi + 0x54], 0
je case.0x41c1e1.276
mov ecx, dword [esi + 0x64]
mov edx, dword [esi + 0x68]
xor eax, eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], eax
mov dword [esp + 0x54], 3
mov word [esp + 0x68], di
mov dword [esp + 0x60], ecx
mov dword [esp + 0x64], edx
call fcn.0041a9c0
mov word [esp + 0x6a], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x54]
mov dword [esp + 0x5c], eax
mov eax, dword [ecx]
mov eax, dword [eax + 0x108]
lea edx, [esp + 0x54]
push edx
call eax
mov ecx, dword [esi + 0x54]
mov dword [esi + 0x60], ecx
jmp case.0x41c1e1.276
cmp dword [esi + 0x60], 0
je case.0x41c1e1.276
mov edx, dword [esi + 0x64]
xor eax, eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], eax
mov eax, dword [esi + 0x68]
mov dword [esp + 0x54], 4
mov word [esp + 0x68], di
mov dword [esp + 0x60], edx
mov dword [esp + 0x64], eax
call fcn.0041a9c0
mov word [esp + 0x6a], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x60]
mov dword [esp + 0x5c], eax
mov edx, dword [ecx]
mov edx, dword [edx + 0x108]
lea eax, [esp + 0x54]
push eax
call edx
mov dword [esi + 0x60], 0
jmp case.0x41c1e1.276
cmp bx, 1
jne case.0x41c1e1.276
cmp byte [esi + 0xb6], 0
jne 0x41c18f
xor eax, eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov edx, dword [esi]
lea ecx, [esp + 0x28]
push ecx
push edx
call dword [sym.imp.USER32.dll_ScreenToClient]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
push eax
push ecx
mov eax, esi
call fcn.0041e560
mov dword [esp + 0x14], eax
test eax, eax
je case.0x41c1e1.276
mov ecx, eax
mov edx, dword [ecx]
mov eax, dword [edx + 0x14]
call eax
test al, 2
je case.0x41c1e1.276
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
xor eax, eax
mov dword [esp + 0xa0], eax
mov dword [esp + 0xa4], eax
mov dword [esp + 0xac], eax
mov dword [esp + 0xb0], eax
mov dword [esp + 0x98], eax
mov dword [esp + 0x9c], eax
mov dword [esp + 0xa8], eax
mov dword [esp + 0x94], 0x18
mov dword [esp + 0xac], edi
mov dword [esp + 0xb0], ebx
mov dword [esp + 0xa0], ecx
mov dword [esp + 0xa4], edx
call fcn.0041a9c0
mov word [esp + 0xaa], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x9c], eax
mov eax, dword [ecx]
mov eax, dword [eax + 0x108]
lea edx, [esp + 0x94]
push edx
call eax
mov al, bl
jmp 0x41cbf0
test ebx, ebx
je 0x41c18f
mov ecx, dword [ebp + 8]
mov edx, dword [ebx]
push ebx
push edi
add ecx, 0x2000
push ecx
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esp + 0x14]
mov dword [ecx], eax
mov al, 1
jmp 0x41cbf0
test ebx, ebx
je case.0x41c1e1.276
push ebx
push edi
push 0x2111
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [esp + 0x14]
mov dword [edx], eax
mov al, 1
jmp 0x41cbf0
cmp eax, 0x2a1
ja 0x41c9d3
je 0x41c828
add eax, 0xfffffeed
cmp eax, 0xf7
ja case.0x41c1e1.276
movzx eax, byte [eax + 0x41cd70]
jmp dword [eax*4 + 0x41cd48]
lea eax, [esi + 0xc4]
xor edx, edx
call fcn.0041ec70
test eax, eax
jle case.0x41c1e1.276
lea ecx, [ecx]
lea eax, [esi + 0xc4]
call fcn.00420430
mov ebx, eax
mov eax, dword [esi]
cmp dword [ebx + 8], eax
jne 0x41c222
movzx ecx, di
cmp dword [ebx + 0xc], ecx
jne 0x41c222
cmp byte [ebx + 0x10], 0
je 0x41c237
lea eax, [esi + 0xc4]
inc edx
call fcn.0041ec70
cmp edx, eax
jl 0x41c200
jmp case.0x41c1e1.276
mov edx, dword [ebx]
xor eax, eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x6c], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], eax
mov dword [esp + 0x70], eax
mov eax, dword [ebx + 4]
mov dword [esp + 0x54], 0x19
mov dword [esp + 0x58], edx
mov dword [esp + 0x6c], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebx]
mov dword [esp + 0x5c], eax
mov edx, dword [ecx]
mov edx, dword [edx + 0x108]
lea eax, [esp + 0x54]
push eax
call edx
jmp case.0x41c1e1.276
cmp byte [esi + 0xb5], 0
jne 0x41c2ee
xor eax, eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov eax, dword [esi]
mov dword [esp + 0x30], eax
mov eax, dword [esi + 0x1c]
mov dword [esp + 0x28], 0x10
mov dword [esp + 0x2c], 3
test eax, eax
jne 0x41c2c8
mov dword [esp + 0x34], 0x190
jmp 0x41c2dc
push 0
push 3
push 0x415
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [esp + 0x34], eax
lea ecx, [esp + 0x28]
push ecx
call dword [sym.imp.COMCTL32.dll__TrackMouseEvent]
mov byte [esi + 0xb5], 1
movsx edi, bx
shr ebx, 0x10
movsx eax, bx
push eax
mov dword [esp + 0x1c], eax
mov dword [esi + 0x68], eax
push edi
mov eax, esi
mov dword [esi + 0x64], edi
call fcn.0041e560
mov ebx, eax
test ebx, ebx
je 0x41c321
mov edx, dword [ebx]
mov eax, dword [edx + 0x1c]
mov ecx, ebx
call eax
cmp eax, esi
jne case.0x41c1e1.276
mov ecx, dword [esp + 0x18]
xor eax, eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], eax
mov dword [esp + 0x60], edi
mov dword [esp + 0x64], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x58]
mov dword [esp + 0x5c], eax
cmp ebx, ecx
je 0x41c39f
test ecx, ecx
je 0x41c39f
mov dword [esp + 0x54], 0xa
mov dword [esp + 0x58], ecx
mov edx, dword [ecx]
mov edx, dword [edx + 0x108]
lea eax, [esp + 0x54]
push eax
call edx
mov eax, dword [esi + 0x1c]
mov dword [esi + 0x58], 0
test eax, eax
je 0x41c39f
lea ecx, [esi + 0x20]
push ecx
push 0
push 0x411
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
cmp ebx, dword [esi + 0x58]
je 0x41c3c8
test ebx, ebx
je 0x41c3c8
mov dword [esp + 0x54], 0xb
mov dword [esp + 0x58], ebx
mov edx, dword [ebx]
mov edx, dword [edx + 0x108]
lea eax, [esp + 0x54]
push eax
mov ecx, ebx
call edx
mov dword [esi + 0x58], ebx
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x41c3ef
mov dword [esp + 0x54], 9
mov dword [esp + 0x58], ecx
mov eax, dword [ecx]
mov eax, dword [eax + 0x108]
lea edx, [esp + 0x54]
push edx
call eax
jmp case.0x41c1e1.276
test ebx, ebx
je case.0x41c1e1.276
mov dword [esp + 0x54], 9
mov dword [esp + 0x58], ebx
mov edx, dword [ebx]
mov edx, dword [edx + 0x108]
lea eax, [esp + 0x54]
push eax
mov ecx, ebx
call edx
jmp case.0x41c1e1.276
mov eax, dword [esi]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, ebx
shr ecx, 0x10
movsx ecx, cx
movsx eax, bx
push ecx
mov dword [esp + 0x18], eax
mov dword [esi + 0x64], eax
push eax
mov eax, esi
mov dword [esp + 0x20], ecx
mov dword [esi + 0x68], ecx
call fcn.0041e560
mov edi, eax
test edi, edi
je case.0x41c1e1.276
mov edx, dword [edi]
mov eax, dword [edx + 0x1c]
mov ecx, edi
call eax
cmp eax, esi
jne case.0x41c1e1.276
mov dword [esi + 0x5c], edi
mov edx, dword [edi]
mov eax, dword [edx + 0xf0]
mov ecx, edi
call eax
call fcn.0041d630
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor eax, eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], eax
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 0x54], 0xd
mov dword [esp + 0x58], edi
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], ebx
mov dword [esp + 0x60], ecx
mov dword [esp + 0x64], edx
mov word [esp + 0x6a], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x5c], eax
mov eax, dword [edi]
mov edx, dword [eax + 0x108]
lea ecx, [esp + 0x54]
push ecx
mov ecx, edi
call edx
jmp case.0x41c1e1.276
mov eax, dword [esi]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
movsx edi, bx
shr ebx, 0x10
movsx eax, bx
push eax
mov dword [esp + 0x1c], eax
mov dword [esi + 0x68], eax
push edi
mov eax, esi
mov dword [esi + 0x64], edi
call fcn.0041e560
mov ebx, eax
test ebx, ebx
je case.0x41c1e1.276
mov edx, dword [ebx]
mov eax, dword [edx + 0x1c]
mov ecx, ebx
call eax
cmp eax, esi
jne case.0x41c1e1.276
call fcn.0041d630
mov ecx, dword [esp + 0x18]
mov dx, word [esp + 0x50]
xor eax, eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], eax
mov dword [esp + 0x54], 0x11
mov dword [esp + 0x58], ebx
mov dword [esp + 0x60], edi
mov dword [esp + 0x64], ecx
mov word [esp + 0x6a], dx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x5c], eax
mov eax, dword [ebx]
mov edx, dword [eax + 0x108]
lea ecx, [esp + 0x54]
push ecx
mov ecx, ebx
call edx
mov eax, esi
mov dword [eax + 0x5c], ebx
jmp case.0x41c1e1.276
mov ecx, ebx
shr ecx, 0x10
cmp dword [esi + 0x5c], 0
movsx eax, bx
movsx ecx, cx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
mov dword [esi + 0x64], eax
mov dword [esi + 0x68], ecx
je case.0x41c1e1.276
push esi
call fcn.0041d650
mov dword [esp + 0x54], 0xe
mov edx, dword [esi + 0x5c]
mov ecx, dword [esp + 0x2c]
xor eax, eax
mov dword [esp + 0x70], eax
mov dword [esp + 0x6c], eax
mov dword [esp + 0x68], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x58], edx
mov dword [esp + 0x6c], edi
mov dword [esp + 0x70], ebx
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], ecx
mov word [esp + 0x6a], di
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x5c]
mov dword [esp + 0x5c], eax
mov edx, dword [ecx]
mov edx, dword [edx + 0x108]
lea eax, [esp + 0x54]
push eax
call edx
mov dword [esi + 0x5c], 0
jmp case.0x41c1e1.276
mov eax, dword [esi]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, ebx
shr ecx, 0x10
movsx ecx, cx
movsx eax, bx
push ecx
mov dword [esp + 0x18], eax
mov dword [esi + 0x64], eax
push eax
mov eax, esi
mov dword [esp + 0x20], ecx
mov dword [esi + 0x68], ecx
call fcn.0041e560
mov edi, eax
test edi, edi
je case.0x41c1e1.276
mov edx, dword [edi]
mov eax, dword [edx + 0x1c]
mov ecx, edi
call eax
cmp eax, esi
jne case.0x41c1e1.276
mov edx, dword [edi]
mov eax, dword [edx + 0xf0]
mov ecx, edi
call eax
call fcn.0041d630
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor eax, eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], eax
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 0x54], 0xf
mov dword [esp + 0x58], edi
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], ebx
mov dword [esp + 0x60], ecx
mov dword [esp + 0x64], edx
mov word [esp + 0x6a], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 0x5c], eax
mov eax, dword [edi]
mov edx, dword [eax + 0x108]
lea ecx, [esp + 0x54]
push ecx
mov ecx, edi
call edx
mov eax, esi
mov dword [eax + 0x5c], edi
jmp case.0x41c1e1.276
mov ecx, ebx
shr ecx, 0x10
cmp dword [esi + 0x5c], 0
movsx eax, bx
movsx ecx, cx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
mov dword [esi + 0x64], eax
mov dword [esi + 0x68], ecx
je case.0x41c1e1.276
push esi
call fcn.0041d650
mov dword [esp + 0x54], 0x10
jmp 0x41c5b9
movsx eax, bx
mov ecx, ebx
shr ecx, 0x10
mov dword [esp + 0x40], eax
movsx edx, cx
mov ecx, dword [esi]
lea eax, [esp + 0x40]
push eax
push ecx
mov dword [esp + 0x4c], edx
call dword [sym.imp.USER32.dll_ScreenToClient]
mov ecx, dword [esp + 0x44]
mov eax, dword [esp + 0x40]
push ecx
mov dword [esi + 0x64], eax
push eax
mov eax, esi
mov dword [esi + 0x68], ecx
call fcn.0041e560
mov dword [esp + 0x14], eax
test eax, eax
je case.0x41c1e1.276
mov ecx, eax
mov edx, dword [ecx]
mov eax, dword [edx + 0x1c]
call eax
cmp eax, esi
jne case.0x41c1e1.276
mov ecx, dword [esp + 0x14]
xor eax, eax
xor edx, edx
shr edi, 0x10
test di, di
setl dl
mov dword [esp + 0x58], eax
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], eax
mov dword [esp + 0x54], 0x13
mov dword [esp + 0x58], ecx
mov dword [esp + 0x6c], edx
mov dword [esp + 0x70], ebx
call fcn.0041a9c0
mov word [esp + 0x6a], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x5c], eax
mov eax, dword [ecx]
mov eax, dword [eax + 0x108]
lea edx, [esp + 0x54]
push edx
call eax
movzx ecx, word [esi + 0x68]
movzx edx, word [esi + 0x64]
mov eax, dword [esi]
shl ecx, 0x10
or ecx, edx
push ecx
push 0
push 0x200
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
jmp case.0x41c1e1.276
test ebx, ebx
je case.0x41c1e1.276
mov ecx, dword [ebp + 8]
push ebx
push edi
add ecx, 0x2000
push ecx
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [esp + 0x14]
mov dword [edx], eax
mov al, 1
jmp 0x41cbf0
movsx edi, bx
shr ebx, 0x10
movsx eax, bx
push eax
mov dword [esp + 0x1c], eax
push edi
mov eax, esi
mov byte [esi + 0xb5], 0
call fcn.0041e560
mov ebx, eax
test ebx, ebx
je case.0x41c1e1.276
mov ecx, dword [esi + 0x58]
test ecx, ecx
je 0x41c8a8
xor eax, eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x60], edi
mov dword [esp + 0x64], eax
mov dword [esp + 0x54], 0xc
mov dword [esp + 0x58], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0x58]
mov dword [esp + 0x5c], eax
mov edx, dword [ecx]
mov edx, dword [edx + 0x108]
lea eax, [esp + 0x54]
push eax
call edx
mov eax, dword [ebx]
mov edx, dword [eax + 0x98]
lea ecx, [esp + 0xd4]
push ecx
mov ecx, ebx
call edx
lea eax, [esp + 0xd4]
mov dword [esp + 0x170], 0
call fcn.004206b0
test al, al
jne 0x41c9c0
push 0x2c
lea edi, [esi + 0x20]
push 0
push edi
call fcn.00459a90
mov eax, dword [esi]
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov eax, dword [0x489ca8]
mov dword [esi + 0x40], eax
add esp, 0xc
lea eax, [esp + 0xd4]
mov dword [edi], 0x2c
mov dword [esi + 0x24], 1
call fcn.0041b310
mov dword [esi + 0x44], eax
mov edx, dword [ebx]
mov eax, dword [edx + 0x30]
mov ecx, ebx
call eax
cmp dword [esi + 0x1c], 0
mov ecx, dword [eax]
mov dword [esi + 0x30], ecx
mov edx, dword [eax + 4]
mov dword [esi + 0x34], edx
mov ecx, dword [eax + 8]
mov dword [esi + 0x38], ecx
mov edx, dword [eax + 0xc]
mov dword [esi + 0x3c], edx
jne 0x41c984
mov eax, dword [0x489ca8]
mov ecx, dword [esi]
push 0
push eax
push 0
push ecx
push SysReAllocString
push SysReAllocString
push SysReAllocString
push SysReAllocString
push SysStringLen
push 0
push str.tooltips_class32
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
push edi
push 0
push 0x432
push eax
mov dword [esi + 0x1c], eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [ebx]
mov eax, dword [edx + 0xa4]
mov ecx, ebx
call eax
mov ecx, dword [esi + 0x1c]
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push eax
push 0
push 0x418
push ecx
call ebx
mov edx, dword [esi + 0x1c]
push edi
push 0
push 0x436
push edx
call ebx
mov eax, dword [esi + 0x1c]
push edi
push 1
push 0x411
push eax
call ebx
lea ecx, [esp + 0xd4]
call fcn.0040dad0
mov al, 1
jmp 0x41cbf0
sub eax, 0x2a3
je 0x41cb0f
sub eax, 0x75
je 0x41ca32
sub eax, 0x7ce9
jne case.0x41c1e1.276
add esi, 0xf4
mov eax, esi
xor edi, edi
call fcn.0041ec70
test eax, eax
jle 0x41ca24
mov edx, edi
mov eax, esi
call fcn.00420430
test eax, eax
je 0x41ca18
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx]
push 1
call eax
mov eax, esi
inc edi
call fcn.0041ec70
cmp edi, eax
jl 0x41ca01
call fcn.00420240
mov esi, dword [esp + 0x38]
jmp case.0x41c1e1.276
mov edx, dword [esi]
lea ecx, [esp + 0x54]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetClientRect]
push edi
call dword [sym.imp.GDI32.dll_SaveDC]
mov ecx, dword [esi + 0x50]
mov dword [esp + 0x14], eax
mov eax, dword [ecx]
mov eax, dword [eax + 0x118]
lea edx, [esp + 0x54]
push edx
push edi
call eax
test bl, 0x10
je 0x41cafd
mov ecx, dword [esi]
push 5
push ecx
call dword [sym.imp.USER32.dll_GetWindow]
mov edi, eax
test edi, edi
je 0x41cafd
or ebx, 2
mov dword [esp + 0x28], ebx
mov ebx, dword [esp + 0x50]
xor eax, eax
lea edx, [esp + 0x40]
push edx
push edi
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [esi]
push 2
lea eax, [esp + 0x44]
push eax
push ecx
push 0
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov edx, dword [esp + 0x44]
mov eax, dword [esp + 0x40]
push 0
neg edx
push edx
neg eax
push eax
push ebx
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
mov ecx, dword [esp + 0x28]
push ecx
push ebx
push 0x317
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
push 2
push edi
call dword [sym.imp.USER32.dll_GetWindow]
mov edi, eax
test edi, edi
jne 0x41ca87
mov edx, dword [esp + 0x14]
push edx
push ebx
call dword [sym.imp.GDI32.dll_RestoreDC]
jmp case.0x41c1e1.276
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x50]
push edx
push ebx
call dword [sym.imp.GDI32.dll_RestoreDC]
jmp case.0x41c1e1.276
mov eax, dword [esi + 0x1c]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x41cb2a
lea ecx, [esi + 0x20]
push ecx
push 0
push 0x411
push eax
call edi
cmp byte [esi + 0xb5], 0
je 0x41cb41
mov edx, dword [esi]
push 0xffffffffffffffff
push 0
push 0x200
push edx
call edi
mov byte [esi + 0xb5], 0
mov ecx, dword [esp + 0x3c]
xor eax, eax
call fcn.00420410
mov ebx, eax
test ebx, ebx
je 0x41cbee
add esi, 0xb8
mov edx, dword [esp + 0x3c]
xor ecx, ecx
call fcn.004203b0
mov eax, dword [ebx + 0x108]
test eax, eax
je 0x41cb8b
lea edi, [eax + 0x34]
mov eax, edi
call fcn.0042b760
test al, al
je 0x41cb8b
call fcn.0042b7c0
mov eax, esi
xor edi, edi
call fcn.0041ec70
test eax, eax
jle 0x41cbbe
jmp 0x41cba0
mov edx, edi
mov eax, esi
call fcn.00420430
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx]
push ebx
call eax
mov eax, esi
inc edi
call fcn.0041ec70
cmp edi, eax
jl 0x41cba0
lea ecx, [ebx + 0x84]
call fcn.0040dad0
mov ecx, ebx
call fcn.0040dad0
push ebx
call fcn.004567f0
mov ecx, dword [esp + 0x40]
add esp, 4
xor eax, eax
call fcn.00420410
mov ebx, eax
test ebx, ebx
jne 0x41cb63
xor al, al
mov ecx, dword [esp + 0x168]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x150]
xor ecx, esp
call fcn.004567fb
mov esp, ebp
pop ebp
ret 0xc