Function at 0x729c20bf
Capabilities:
Hide graphical window
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
and dword [ebp - 4], 0
push ebx
push esi
mov esi, dword [ebp + 8]
test esi, esi
push edi
je 0x729c2165
mov eax, dword [esi + 0x30]
mov ecx, dword [eax + 0x34]
mov dword [ebp - 4], ecx
mov ebx, dword [ebp + 0x10]
mov edi, dword [sym.imp.USER32.dll_IsIconic]
cmp ebx, 0x20
mov eax, 0x86
mov edx, 0x112
ja 0x729c25b9
cmp ebx, 0x20
je 0x729c2506
cmp ebx, 7
ja 0x729c242d
je 0x729c23e3
mov eax, ebx
dec eax
je 0x729c22a7
dec eax
je 0x729c229c
sub eax, 3
je 0x729c2188
dec eax
jne case.0x729c2d61.292
mov ecx, dword [ecx + 0x520]
test ecx, ecx
je 0x729c214e
xor eax, eax
push 2
cmp word [ebp + 0x14], ax
setne al
push eax
call fcn.729472ab
cmp word [ebp + 0x14], 0
push 0
je 0x729c217b
push dword [ebp + 0xc]
push esi
call fcn.729c4801
jmp 0x729c235c
lea eax, [ebp - 4]
mov ecx, 0x72a4e470
push eax
call fcn.7294596b
mov ecx, dword [ebp - 4]
jmp 0x729c20e3
push 0
push esi
call fcn.7298fb11
jmp 0x729c2426
cmp dword [ebp + 0x14], 1
jne 0x729c225e
push dword [ebp + 0xc]
call edi
test eax, eax
jne 0x729c225e
push dword [ebp - 4]
call fcn.729a926d
mov eax, dword [esi + 0x30]
or byte [eax + 0x28], 0x80
mov eax, dword [esi + 0x130]
test eax, eax
je 0x729c21d9
mov ecx, dword [eax]
lea edx, [ebp + 0x10]
push edx
push eax
call dword [ecx + 0x40]
test eax, eax
jl 0x729c21d9
test byte [ebp + 0x10], 1
je 0x729c21d9
push 1
push 0
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_InvalidateRect]
test byte [esi + 0x100], 0x40
jne 0x729c21fa
mov eax, dword [ebp + 0x18]
shr eax, 0x10
movsx eax, ax
push eax
movsx eax, word [ebp + 0x18]
push eax
push dword [ebp + 0x14]
push esi
call fcn.729960f6
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x729c222a
push dword [ebp + 0xc]
call fcn.7298f5a1
mov edx, dword [esi + 0x140]
lea ecx, [esi + 0x140]
and eax, 3
and dx, 0xfe7f
shl eax, 7
or edx, eax
mov dword [ecx], edx
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push ebx
push dword [ebp + 0xc]
push esi
call fcn.7299cfd0
cmp ebx, 5
mov edi, eax
ja 0x729c3230
je 0x729c31ab
mov eax, ebx
dec eax
dec eax
jne 0x729c2257
push esi
call fcn.729c4623
mov eax, edi
jmp 0x729c235c
mov eax, dword [esi + 0x30]
test byte [eax + 0x28], 0x80
je 0x729c21ae
cmp dword [ebp + 0x14], 2
je 0x729c227b
cmp dword [ebp + 0x14], 0
jne 0x729c21ae
push esi
call fcn.729a92c3
mov eax, dword [esi + 0x30]
push 0
add eax, 0x1c
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov eax, dword [esi + 0x30]
and byte [eax + 0x28], 0x7f
jmp 0x729c21ae
push dword [ebp + 0xc]
push esi
call fcn.7298fef0
jmp 0x729c222a
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x58]
test byte [eax + 0x99], 0x10
jne 0x729c22c7
push 0
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_GetSystemMenu]
mov dword [esi + 0x158], eax
mov eax, dword [esi + 0x28]
mov eax, dword [eax]
cmp byte [eax + 0x37], 0x11
jne 0x729c2392
mov edi, 0x46000001
call dword [sym.imp.USER32.dll_CreateMenu]
test byte [esi + 0x194], 1
mov dword [esi + 0x1a0], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0x8000
je 0x729c22ff
mov edi, 0x46300001
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_GetClientRect]
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push dword [0x72a4e7d4]
sub eax, dword [ebp - 0x18]
push 0xcac
push dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x1c]
push eax
mov eax, dword [esi + 0x24]
push dword [ebp - 0x18]
shr eax, 1
push dword [ebp - 0x1c]
and eax, 1
shl eax, 9
push edi
push 0
push 0x7296aa98
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov ecx, dword [esi + 0x30]
test eax, eax
mov edx, dword [ecx + 0x2c]
mov dword [edx + 0x3c], eax
jne 0x729c2363
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret 0x14
mov dword [ecx + 0x44], eax
push dword [ecx + 0x2c]
call fcn.729c4a1e
mov eax, dword [esi + 0x30]
push 5
mov eax, dword [eax + 0x2c]
push dword [eax + 0x3c]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push esi
call fcn.729bfcba
test eax, eax
jne 0x729c2392
push 7
call fcn.72991b1e
cmp dword [0x72a4e898], 0
je 0x729c23d3
mov eax, dword [esi + 0x28]
mov eax, dword [eax]
test byte [eax + 3], 8
je 0x729c23d3
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x58]
test byte [eax + 0x99], 0x10
je 0x729c23d3
mov eax, dword [esi + 0x24]
test eax, 0x20000000
je 0x729c23d3
shr eax, 0x1d
and eax, 1
push 0x3000
push eax
push dword [ebp + 0xc]
call fcn.7299f6db
push 0xffffffffffffffff
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_SetWindowContextHelpId]
jmp 0x729c222a
cmp dword [ebp + 0xc], 0
je 0x729c23f2
push dword [ebp + 0xc]
call edi
test eax, eax
jne 0x729c2411
mov eax, dword [esi + 0x28]
mov eax, dword [eax]
cmp byte [eax + 0x37], 0x11
jne 0x729c2418
mov eax, dword [esi + 0x194]
lea ecx, [esi + 0x194]
test al, 0x10
je 0x729c2418
and al, 0xef
mov dword [ecx], eax
xor eax, eax
jmp 0x729c235c
push esi
call fcn.729b2252
test eax, eax
je case.0x729c2d61.292
push 1
jmp 0x729c2622
mov eax, ebx
sub eax, 0xf
je 0x729c24c7
dec eax
je 0x729c24b4
sub eax, 4
je 0x729c2470
dec eax
jne case.0x729c2d61.292
mov edi, dword [sym.imp.USER32.dll_GetWindow]
push 5
push dword [ebp + 0xc]
call edi
mov ebx, eax
test ebx, ebx
je case.0x729c2d61.292
push 0
push 0
push 0x15
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
push 2
push ebx
jmp 0x729c2452
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x729c2426
mov esi, dword [esi + 0x30]
mov eax, dword [esi + 0x58]
test byte [eax + 0x99], 0x10
je 0x729c249f
mov eax, dword [esi + 0x2c]
push dword [ebp + 0x14]
push dword [eax + 0x34]
push dword [eax + 0x3c]
call fcn.729a058e
jmp 0x729c2426
push 0
push dword [ebp + 0x14]
push 0x27
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_DefWindowProcA]
jmp 0x729c235c
push esi
call fcn.7298ff85
test eax, eax
jne 0x729c2411
jmp case.0x729c2d61.292
push dword [ebp + 0xc]
and byte [esi + 0x143], 0xf7
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x729c24ef
cmp dword [ebp + 0x14], 0
jne 0x729c24ef
push dword [ebp + 0xc]
push esi
call fcn.7299009e
jmp 0x729c235c
push 0
push 0
push 0x16
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push esi
call fcn.72a01f52
jmp 0x729c2411
cmp dword [ebp + 0x18], 0x201fffe
jne case.0x729c2d61.292
push 5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, dword [sym.imp.USER32.dll_GetWindow]
push eax
call edi
mov ebx, eax
test ebx, ebx
mov dword [ebp + 8], ebx
je 0x729c255a
push 0xffffffffffffffec
push ebx
call dword [sym.imp.USER32.dll_GetWindowLongA]
test al, 8
je 0x729c253f
push 2
push ebx
jmp 0x729c2522
test ebx, ebx
je 0x729c255a
push ebx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x729c255a
push 2
push ebx
call edi
mov ebx, eax
mov dword [ebp + 8], ebx
jmp 0x729c253f
push 0
push ebx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, eax
call fcn.7294dcfa
cmp ebx, eax
je case.0x729c2d61.292
push 2
push dword [ebp + 8]
call edi
test eax, eax
mov dword [ebp + 8], eax
je 0x729c25a1
push 0
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, eax
call fcn.7294dcfa
cmp ebx, eax
jne 0x729c2572
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x729c2572
cmp dword [ebp + 8], 0
je case.0x729c2d61.292
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x729c2411
cmp ebx, 0x37
ja 0x729c268e
je 0x729c2662
mov eax, ebx
sub eax, 0x21
je 0x729c2608
dec eax
je 0x729c2628
dec eax
dec eax
jne case.0x729c2d61.292
mov eax, dword [esi + 0x30]
mov esi, dword [ebp + 0x18]
mov eax, dword [eax + 0x58]
test byte [eax + 0x99], 0x10
je 0x729c25fb
push esi
push dword [ebp + 0x14]
push 0x24
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_DefMDIChildProcA]
and dword [esi + 0x18], 0
and dword [esi + 0x1c], 0
jmp 0x729c2426
mov eax, dword [ecx + 0x520]
test eax, eax
je 0x729c2628
cmp dword [eax + 0x18], 0
je 0x729c2628
push 0
call dword [sym.imp.USER32.dll_MessageBeep]
push 4
pop eax
jmp 0x729c235c
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x58]
test byte [eax + 0x99], 0x10
je case.0x729c2d61.292
mov edi, 0x105a
push 2
push edi
push edi
push dword [ebp + 0xc]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne case.0x729c2d61.292
push eax
push eax
push edi
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x729c222a
push dword [esi + 0x13c]
call fcn.72a025ad
test eax, eax
jne 0x729c235c
push eax
push dword [esi + 0x28]
call fcn.72a0267f
test eax, eax
jne 0x729c235c
mov ebx, dword [ebp + 0x10]
jmp 0x729c222a
cmp ebx, 0x53
ja 0x729c27e2
je 0x729c26e1
cmp ebx, 0x47
jne case.0x729c2d61.292
push dword [ebp + 0x18]
mov edi, dword [esi + 0x30]
push dword [ebp + 0x14]
push ebx
push dword [ebp + 0xc]
push esi
call fcn.7299cfd0
test byte [edi + 0x22], 8
mov ebx, eax
je 0x729c26da
mov eax, dword [esi + 0x30]
test byte [eax + 0x20], 0x10
jne 0x729c26da
push 0xfffffffffffffff0
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, 0x21000000
jne 0x729c26da
push esi
call fcn.729903f9
mov eax, ebx
jmp 0x729c235c
mov eax, dword [esi + 0x28]
xor ebx, ebx
mov eax, dword [eax]
cmp byte [eax + 0x37], 0x1d
jne 0x729c2706
mov eax, dword [esi + 0x19c]
lea ecx, [esi + 0x19c]
mov ebx, eax
shr ebx, 6
and ebx, 1
and al, 0xbf
mov dword [ecx], eax
mov eax, dword [ebp + 0x18]
cmp dword [eax + 4], 1
jne 0x729c274a
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and eax, 1
mov dword [ebp + 8], eax
je 0x729c2757
xor eax, eax
push eax
push eax
push eax
mov eax, dword [ebp + 0x18]
push dword [eax + 0x18]
push dword [eax + 0x14]
call fcn.7298c5b8
mov edi, eax
mov eax, dword [esi + 0x30]
push edi
push dword [eax + 0xa0]
call fcn.7298f9ef
test eax, eax
jne 0x729c2769
test ebx, ebx
jne 0x729c2426
jmp case.0x729c2d61.292
mov eax, dword [ebp + 0x18]
push 0
push dword [esi + 0x30]
push dword [eax + 0xc]
call fcn.7298b241
jmp 0x729c2735
test edi, edi
je 0x729c2426
cmp dword [edi + 0xa0], 0
jne 0x729c2794
push edi
call fcn.7298b32c
mov edi, eax
test edi, edi
je 0x729c2426
cmp esi, edi
je 0x729c2426
jmp 0x729c2771
lea eax, [ebp - 0x158]
push 0x104
push eax
push edi
call fcn.72990b7e
lea eax, [ebp - 0x1c]
push eax
push edi
call fcn.7298c18a
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
add eax, 0xf
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x158]
push dword [edi + 0xa0]
push 8
push eax
mov eax, dword [ebp + 0x18]
push dword [eax + 0xc]
call fcn.7294b761
jmp 0x729c2426
cmp ebx, eax
ja 0x729c2810
je 0x729c27ff
cmp ebx, 0x82
jne case.0x729c2d61.292
push esi
call fcn.7298ff1a
jmp 0x729c222a
push dword [ebp + 0x14]
push esi
push dword [ebp + 0xc]
call fcn.7299020a
jmp 0x729c24ba
cmp ebx, edx
ja 0x729c285e
je 0x729c2849
cmp ebx, 0xa1
jne case.0x729c2d61.292
push esi
call fcn.7298f29a
test eax, eax
jne 0x729c283f
cmp dword [ebp + 0x14], 2
jne 0x729c283f
push dword [ebp + 0xc]
call edi
test eax, eax
je 0x729c2411
call fcn.7298fc7b
jmp 0x729c222a
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push esi
call fcn.7299011d
test eax, eax
je 0x729c283f
jmp 0x729c2411
mov eax, 0x11f
cmp ebx, eax
ja 0x729c2975
je 0x729c2951
mov eax, ebx
sub eax, 0x116
je 0x729c2c4f
dec eax
jne case.0x729c2d61.292
mov ebx, dword [ebp + 0x14]
cmp ebx, dword [esi + 0x158]
jne 0x729c289f
push ebx
push dword [ebp + 0xc]
push esi
call fcn.729c4877
jmp 0x729c235c
mov eax, dword [esi + 0x30]
mov edx, dword [ebp + 0xc]
mov eax, dword [eax + 0x2c]
cmp edx, dword [eax + 0x38]
jne 0x729c28e0
push dword [eax + 0x3c]
call fcn.7298b2cc
mov edi, eax
test edi, edi
je 0x729c28dd
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x2c]
push dword [eax + 0x3c]
call dword [sym.imp.USER32.dll_IsZoomed]
test eax, eax
je 0x729c28dd
cmp ebx, dword [edi + 0x158]
jne 0x729c28dd
push ebx
push dword [edi + 0x3c]
push edi
jmp 0x729c2895
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x508], 0
je case.0x729c2d61.292
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x2c]
cmp dword [eax + 0x34], 0
je case.0x729c2d61.292
push dword [ebp + 0x14]
push esi
call fcn.729bfe6c
test eax, eax
jne 0x729c292d
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x50c]
test ecx, ecx
je 0x729c2925
push dword [ebp + 0x14]
push 0x729bfdff
push ecx
call fcn.729c02f4
test eax, eax
je case.0x729c2d61.292
test byte [eax + 0xd0], 0x20
je case.0x729c2d61.292
push dword [ebp + 0x14]
push eax
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x2c]
push dword [eax + 0x34]
call fcn.729f2bf1
jmp case.0x729c2d61.292
and dword [ecx + 0xe4], 0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x14]
mov dword [eax + 0x504], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x18]
mov dword [eax + 0x500], ecx
jmp 0x729c222a
mov eax, 0x201
cmp ebx, eax
ja 0x729c2a46
je 0x729c283f
cmp ebx, 0x120
jne case.0x729c2d61.292
mov eax, dword [esi + 0x30]
mov ecx, dword [eax + 0x58]
test byte [ecx + 0x99], 0x10
jne 0x729c29be
mov ecx, dword [eax + 0x2c]
cmp esi, dword [ecx + 0x34]
jne 0x729c29b1
cmp byte [ebp + 0x14], 0x2d
je 0x729c29be
mov ecx, dword [ebp + 0x14]
shr ecx, 0x10
cmp cx, 0x2000
je 0x729c2a11
mov eax, dword [eax + 0x2c]
cmp esi, dword [eax + 0x34]
jne case.0x729c2d61.292
cmp byte [ebp + 0x14], 0x2d
jne case.0x729c2d61.292
push dword [eax + 0x3c]
call fcn.7298b2cc
mov edi, eax
test edi, edi
je 0x729c2a1b
mov eax, dword [edi + 0x3c]
test eax, eax
je case.0x729c2d61.292
test edi, edi
jne 0x729c2a3d
push 0xfffffffffffffff0
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, 0x80000
jne 0x729c2a35
mov eax, dword [ebp + 0x14]
shr eax, 0x10
cmp ax, 0x2000
jne case.0x729c2d61.292
mov eax, 0x10000
jmp 0x729c235c
mov eax, dword [esi + 0x30]
push 0
push 0
push 0x229
mov eax, dword [eax + 0x2c]
push dword [eax + 0x3c]
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x729c29e5
test edi, edi
je case.0x729c2d61.292
test byte [edi + 0x140], 2
jmp 0x729c2a0b
mov eax, 0x1000
cmp ebx, eax
ja 0x729c2b18
je 0x729c2ab3
cmp ebx, 0x222
jne 0x729c222a
mov ecx, dword [ecx + 0x520]
mov ebx, dword [ebp + 0x18]
mov edi, dword [ebp + 0xc]
test ecx, ecx
je 0x729c2a80
xor eax, eax
cmp ebx, edi
sete al
push 2
push eax
call fcn.729472ab
cmp dword [ebp + 0x10], 0x104b
je 0x729c2a97
xor eax, eax
cmp ebx, edi
sete al
push eax
push esi
call fcn.729a9342
cmp ebx, edi
jne 0x729c2f08
mov eax, dword [esi + 0x30]
add eax, 0x1c
push eax
mov ecx, dword [eax]
call dword [ecx + 0x30]
push 1
push edi
jmp 0x729c215a
mov eax, dword [esi + 0x28]
mov eax, dword [eax]
cmp byte [eax + 0x37], 0x11
je 0x729c2ac4
push esi
call fcn.72995eeb
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x2c]
mov ecx, dword [eax + 0x10]
test byte [ecx + 0x3c], 1
je 0x729c2ada
and byte [esi + 0x141], 0xfd
mov ecx, dword [esi + 0x140]
shr ecx, 9
and ecx, 1
push ecx
push eax
call fcn.729fc51c
test eax, eax
jne 0x729c235c
mov eax, dword [esi + 0x140]
mov ecx, eax
and eax, 0x200
and ecx, 0xfeffffff
shl eax, 0xf
or ecx, eax
mov dword [esi + 0x140], ecx
jmp 0x729c222a
mov eax, 0x100e
cmp ebx, eax
ja 0x729c2bfb
je 0x729c2b92
cmp ebx, 0x1001
jne case.0x729c2d61.292
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x58]
test byte [eax + 0x99], 0x10
je 0x729c2b4b
push dword [ebp + 0xc]
push esi
call fcn.7299ebfe
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x38]
neg eax
sbb eax, eax
neg eax
push eax
push esi
call fcn.7298d4ad
mov eax, dword [esi + 0x130]
test eax, eax
je 0x729c2b73
push eax
push esi
push dword [ebp + 0xc]
call fcn.72a0242d
cmp dword [esi + 0x13c], 0
lea eax, [esi + 0x13c]
je case.0x729c2d61.292
push eax
push esi
call fcn.7298fe6d
jmp 0x729c222a
mov eax, dword [ebp + 0x14]
sub eax, 3
je 0x729c2bd9
dec eax
dec eax
jne case.0x729c2d61.292
lea eax, [ebp + 0xc]
xor edi, edi
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x30]
push eax
push 5
push esi
mov dword [ebp + 0xc], edi
call fcn.7299264c
cmp eax, 0x9c68
je 0x729c2bca
cmp word [ebp + 0xc], di
je 0x729c2426
push edi
push dword [ebp + 0x18]
push esi
call fcn.729c44c1
jmp 0x729c2411
mov eax, dword [ebp + 0x18]
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x30]
push eax
push 3
push esi
call fcn.7299264c
neg eax
sbb eax, eax
inc eax
jmp 0x729c235c
mov eax, 0x1032
cmp ebx, eax
ja 0x729c2edf
je 0x729c2e68
cmp ebx, 0x1011
jne case.0x729c2d61.292
mov eax, dword [ebp + 0x14]
mov ecx, 0x105
cmp eax, ecx
ja 0x729c2c68
je 0x729c2c5a
sub eax, 3
je 0x729c2c4f
dec eax
jne case.0x729c2d61.292
push dword [ebp + 0xc]
call fcn.7298f5a1
test ax, ax
je case.0x729c2d61.292
mov eax, 0x180
jmp 0x729c235c
push esi
call fcn.729c4a46
jmp 0x729c222a
push dword [ebp + 0x18]
push esi
call fcn.729b0ebe
jmp 0x729c235c
mov ecx, 0x10b
cmp eax, ecx
ja 0x729c2cab
je 0x729c2c9d
cmp eax, 0x107
jne case.0x729c2d61.292
push dword [ebp + 0x18]
or byte [esi + 0x143], 0x10
lea edi, [esi + 0x140]
push esi
call fcn.729ac0dd
and byte [edi + 3], 0xef
jmp 0x729c235c
push dword [ebp + 0x18]
push esi
call fcn.729b0a5f
jmp 0x729c235c
mov ecx, 0x120
cmp eax, ecx
ja 0x729c2d3b
je 0x729c2cf6
sub eax, 0x10c
je 0x729c2ce8
dec eax
je 0x729c2cda
dec eax
dec eax
jne case.0x729c2d61.292
push dword [ebp + 0x18]
push esi
call fcn.729c118b
jmp 0x729c235c
push dword [ebp + 0x18]
push esi
call fcn.7299966b
jmp 0x729c235c
push dword [ebp + 0x18]
push esi
call fcn.72999896
jmp 0x729c235c
mov eax, dword [ebp + 0x18]
push ecx
fld dword [eax + 0x20]
fstp dword [esp]
fld dword [eax + 0x1c]
push ecx
fstp dword [esp]
fld dword [eax + 0x18]
push ecx
fstp dword [esp]
push dword [eax + 0x14]
fld dword [eax + 0x10]
push ecx
fstp dword [esp]
fld dword [eax + 0xc]
push ecx
fstp dword [esp]
fld dword [eax + 8]
mov ax, word [eax + 4]
push ecx
fstp dword [esp]
push eax
push esi
call fcn.72997619
and eax, 0xffff
jmp 0x729c235c
mov ecx, 0x162
cmp eax, ecx
ja case.0x729c2d61.292
mov eax, dword [ebp + 0x14]
cmp eax, ecx
je 0x729c2e48
add eax, 0xfffffedf
cmp eax, 0xb
ja case.0x729c2d61.292
jmp dword [eax*4 + 0x729c33b6]
mov eax, dword [ebp + 0x18]
push dword [eax + 0x18]
fld dword [eax + 0x14]
push ecx
fstp dword [esp]
fld dword [eax + 0x10]
push ecx
fstp dword [esp]
fld dword [eax + 0xc]
push ecx
fstp dword [esp]
fld dword [eax + 8]
mov ax, word [eax + 4]
push ecx
fstp dword [esp]
push eax
push esi
call fcn.72997bf3
jmp 0x729c2d31
mov eax, dword [ebp + 0x18]
push dword [eax + 0x10]
fld dword [eax + 0xc]
push ecx
fstp dword [esp]
fld dword [eax + 8]
mov ax, word [eax + 4]
push ecx
fstp dword [esp]
push eax
push esi
call fcn.729990fc
jmp 0x729c2d31
push esi
call fcn.72997efa
jmp 0x729c235c
push dword [ebp + 0x18]
push esi
call fcn.72998934
jmp 0x729c235c
push dword [ebp + 0x18]
push esi
call fcn.72998a31
jmp 0x729c235c
push dword [ebp + 0x18]
push esi
call fcn.7299936b
jmp 0x729c235c
push 1
push dword [ebp + 0x18]
push esi
call fcn.72999575
jmp 0x729c235c
push 0
jmp 0x729c2df2
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x729c2411
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x729c2411
test byte [esi + 0x141], 0x40
je 0x729c2411
mov eax, dword [esi + 0x28]
push 0
push 0xf180
push 0x112
push dword [esi + 0x3c]
mov eax, dword [eax]
push esi
call dword [eax + 0x10]
jmp 0x729c2411
mov eax, dword [esi + 0x30]
push 0
push dword [eax + 0x74]
call fcn.7299e9ee
neg eax
sbb eax, eax
and eax, 0x7ff5fe84
add eax, 0x800a017c
jmp 0x729c235c
mov edi, dword [ebp + 0x18]
mov ebx, dword [sym.imp.GDI32.dll_OffsetWindowOrgEx]
push 0
mov eax, dword [edi + 8]
mov ecx, dword [eax + 4]
mov eax, dword [eax]
neg ecx
neg eax
push ecx
push eax
push dword [ebp + 0x14]
call ebx
mov ecx, dword [edi + 0xc]
test ecx, ecx
je 0x729c2ea2
mov eax, dword [edi + 8]
mov edx, dword [eax + 4]
mov eax, dword [eax]
neg edx
neg eax
push edx
push eax
push ecx
call dword [sym.imp.USER32.dll_OffsetRect]
push 0
push dword [edi + 0xc]
push 0x16
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push esi
call fcn.72a01f52
mov ecx, dword [edi + 0xc]
test ecx, ecx
je 0x729c2ecb
mov eax, dword [edi + 8]
push dword [eax + 4]
push dword [eax]
push ecx
call dword [sym.imp.USER32.dll_OffsetRect]
mov edi, dword [edi + 8]
push 0
push dword [edi + 4]
push dword [edi]
push dword [ebp + 0x14]
call ebx
jmp 0x729c2411
mov eax, 0x104b
cmp ebx, eax
ja 0x729c2f10
je 0x729c2a61
cmp ebx, 0x1046
jne case.0x729c2d61.292
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_SetActiveWindow]
jmp 0x729c222a
push ebx
push 1
jmp 0x729c217d
mov edi, 0x105a
cmp ebx, edi
ja 0x729c2fd0
je 0x729c2fc5
cmp ebx, 0x1056
jne case.0x729c2d61.292
mov eax, dword [esi + 0x30]
mov ecx, dword [eax + 0x58]
test byte [ecx + 0x99], 0x10
je 0x729c2f92
mov eax, dword [eax + 0x2c]
mov edi, 0xffbfffff
mov eax, dword [eax + 0x34]
cmp esi, dword [eax + 0x198]
jne 0x729c2f75
cmp dword [0x72a4e898], 0
je 0x729c2f75
mov ecx, dword [eax + 0x24]
shr ecx, 0x1d
and ecx, 1
push ecx
push dword [eax + 0x15c]
call fcn.729c4b6a
and dword [esi + 0x140], edi
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x2c]
mov eax, dword [eax + 0x34]
push dword [eax + 0x3c]
call dword [sym.imp.USER32.dll_DrawMenuBar]
and dword [esi + 0x140], edi
jmp 0x729c2411
cmp dword [0x72a4e898], 0
mov edi, 0xffbfffff
je 0x729c2fc0
mov eax, dword [esi + 0x15c]
test eax, eax
je 0x729c2fba
mov ecx, dword [esi + 0x24]
shr ecx, 0x1d
and ecx, 1
push ecx
push eax
call fcn.729c4b6a
and dword [esi + 0x140], edi
push dword [ebp + 0xc]
jmp 0x729c2f81
push esi
call fcn.72990636
jmp 0x729c2411
mov eax, ebx
sub eax, 0x105b
je 0x729c338f
dec eax
je 0x729c3122
dec eax
je 0x729c30ad
sub eax, 0x21
je 0x729c309c
sub eax, 0xa
je 0x729c3022
dec eax
dec eax
jne case.0x729c2d61.292
push dword [ebp + 0xc]
push esi
call fcn.7298d02a
test eax, eax
jne 0x729c2411
push dword [ebp + 0x14]
push dword [ebp + 0x18]
call fcn.729fd0c3
jmp 0x729c235c
push dword [ebp + 0xc]
push esi
call fcn.7298d02a
test eax, eax
jne 0x729c2411
mov ecx, dword [ebp + 0x14]
test ch, 0x80
je 0x729c308f
mov edi, dword [ebp + 0x18]
sub ecx, 0x8006
je 0x729c3087
sub ecx, 5
je 0x729c307f
dec ecx
jne 0x729c3054
push edi
call fcn.729fc9ac
test eax, eax
je 0x729c2411
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x30]
push eax
mov eax, dword [esi + 0x28]
movzx eax, byte [eax + 0xf8]
push eax
push edi
call fcn.7299264c
jmp 0x729c2411
push edi
call fcn.729fc36e
jmp 0x729c3054
push edi
call fcn.729fc510
jmp 0x729c3054
lea eax, [ebp - 0x54]
push eax
movzx eax, cx
push eax
push dword [ebp + 0x18]
jmp 0x729c3075
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x34]
mov eax, dword [eax + 0x4f8]
jmp 0x729c235c
mov eax, dword [esi + 0x30]
test byte [eax + 0x20], 0x10
jne 0x729c3109
cmp dword [ebp + 0x14], 0
je 0x729c30f5
or byte [esi + 0x143], 8
lea eax, [esi + 0x140]
mov eax, dword [esi + 0x140]
not eax
shr eax, 0x1a
and eax, 1
push eax
push esi
call fcn.7298f2bd
push dword [ebp + 0xc]
push esi
call fcn.7298d02a
test eax, eax
je 0x729c30fd
mov eax, 0x16c
jmp 0x729c235c
push esi
call fcn.7298f387
jmp 0x729c30de
and byte [esi + 0x143], 0xfb
jmp 0x729c2411
mov eax, dword [ebp + 0x14]
neg eax
sbb eax, eax
and eax, 5
push eax
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x729c2411
mov eax, dword [esi + 0x30]
mov ecx, dword [eax + 0x58]
test byte [ecx + 0x99], 0x10
je 0x729c3168
mov eax, dword [eax + 0x2c]
mov ebx, dword [eax + 0x34]
push ebx
call fcn.729c4a46
mov eax, dword [esi + 0x15c]
lea edi, [esi + 0x15c]
test eax, eax
je 0x729c3157
push eax
call dword [sym.imp.USER32.dll_DestroyMenu]
and dword [edi], 0
cmp dword [ebx + 0x19c], esi
lea eax, [ebx + 0x19c]
jne 0x729c3168
and dword [eax], 0
mov eax, dword [esi + 0x188]
lea edi, [esi + 0x188]
test eax, eax
je 0x729c3182
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
and dword [edi], 0
mov ecx, esi
call fcn.729c1c72
mov eax, dword [esi + 0x164]
test eax, eax
je case.0x729c2d61.292
push eax
push 0
push dword [0x72a4e7cc]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp case.0x729c2d61.292
mov eax, dword [esi + 0x30]
add eax, 0x1c
push eax
mov ecx, dword [eax]
call dword [ecx + 0x28]
cmp dword [ebp + 0x14], 1
je 0x729c2257
mov eax, dword [esi + 0x28]
mov eax, dword [eax]
mov al, byte [eax + 0x37]
cmp al, 0x1d
je 0x729c321e
cmp al, 0x1e
je 0x729c321e
cmp al, 0x1f
je 0x729c321e
xor ebx, ebx
cmp dword [0x72a50b20], ebx
je 0x729c31e8
mov eax, dword [ebp - 4]
dec dword [eax + 0x3c8]
push ebx
push 7
push esi
call fcn.7299264c
cmp dword [0x72a50b20], ebx
je 0x729c3202
mov eax, dword [ebp - 4]
inc dword [eax + 0x3c8]
push dword [ebp + 0xc]
push esi
call fcn.7298d02a
test eax, eax
jne 0x729c2257
push esi
call fcn.729b8cef
jmp 0x729c2257
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x20]
shr eax, 0x14
test al, 1
jne 0x729c3213
jmp 0x729c2257
cmp ebx, 0xc
je 0x729c32dc
cmp ebx, 0x18
je 0x729c32c3
cmp ebx, 0x30
je 0x729c32a9
cmp ebx, 0x81
je 0x729c3281
cmp ebx, 0x84
jbe 0x729c2257
cmp ebx, 0x86
jbe 0x729c335a
cmp ebx, 0x112
jne 0x729c2257
push dword [ebp + 0x14]
push esi
call fcn.72990183
jmp 0x729c2257
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax + 0x20]
mov eax, 0xc00000
mov edx, ecx
and edx, eax
cmp edx, eax
je 0x729c2257
push ecx
push 0xfffffffffffffff0
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_SetWindowLongA]
jmp 0x729c2257
cmp dword [ebp + 0x14], 0
je 0x729c2257
push 0xfffffd41
push esi
call fcn.729aa8e4
jmp 0x729c2257
cmp word [ebp + 0x18], 3
jne 0x729c2257
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_UpdateWindow]
jmp 0x729c2257
mov eax, dword [esi + 0x28]
mov eax, dword [eax]
cmp byte [eax + 0x37], 0x11
je 0x729c32f6
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x58]
test byte [eax + 0x99], 0x10
je 0x729c335a
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x2c]
mov eax, dword [eax + 0x38]
test eax, eax
je 0x729c335a
push eax
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x729c335a
mov eax, dword [esi + 0x30]
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push 0
mov eax, dword [eax + 0x2c]
mov ecx, dword [eax + 0x34]
mov ecx, dword [ecx + 0x140]
not ecx
shr ecx, 0x19
and ecx, 1
push ecx
push 0x86
push dword [eax + 0x38]
call ebx
mov eax, dword [esi + 0x30]
push 0
mov eax, dword [eax + 0x2c]
mov ecx, dword [eax + 0x34]
mov ecx, dword [ecx + 0x140]
shr ecx, 0x19
and ecx, 1
push ecx
push 0x86
push dword [eax + 0x38]
call ebx
cmp dword [0x72a4e7e8], 0
jne 0x729c2257
test byte [esi + 0x24], 2
je 0x729c2257
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
jne 0x729c2257
push dword [ebp + 0xc]
call fcn.7299046f
jmp 0x729c2257
cmp dword [ecx + 0x514], 0
je 0x729c2411
push dword [ebp + 0x14]
push dword [ebp + 0x18]
call fcn.729bfefd
mov eax, dword [ebp - 4]
and dword [eax + 0x514], 0
jmp 0x729c2411