Function at 0x4becaf
Capabilities:
Check for unmoving mouse cursor
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1bc
push ebx
mov ebx, ecx
xor al, al
push esi
push edi
mov dword [esp + 0x30], ebx
test dword [ebx + 0x74], 0x200000
mov byte [esp + 0x12], al
mov byte [esp + 0x13], al
mov byte [esp + 0x53], al
je 0x4bed02
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
cmp eax, 0x21
jne 0x4becf9
mov eax, dword [ebp + 0x18]
mov dword [eax], 3
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x24
cmp eax, 8
je 0x4bf3ae
cmp byte [ebx + 0x67], 0
mov dword [esp + 0x20], 0x4009
je 0x4bef57
mov esi, dword [ebx + 0x34]
xor ecx, ecx
mov dword [esp + 0x78], ecx
mov dword [esp + 0x7c], ecx
mov dword [esp + 0x80], ecx
mov dword [esp + 0x84], ecx
test esi, esi
je 0x4bef57
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x24]
mov edi, edi
mov edx, dword [esi + 4]
test edx, edx
je 0x4bed6e
push dword [ebp + 0x20]
mov eax, dword [edx]
lea ecx, [esp + 0x7c]
push ecx
mov ecx, dword [ebp + 0x14]
push dword [ecx]
mov ecx, dword [ebp + 0xc]
push dword [edi]
push dword [ecx]
push edx
call dword [eax + 0x80]
mov ecx, dword [esp + 0x78]
test eax, eax
jns 0x4bed6e
mov byte [ebx], 0
test cx, cx
je 0x4bef49
xor edx, edx
mov byte [esp + 0xc4], 0
mov word [esp + 0xb4], dx
lea eax, [esp + 0x78]
cmp cx, 3
jne 0x4bedad
mov eax, dword [esp + 0x80]
mov dword [esp + 0xb0], eax
mov dword [esp + 0xc5], edx
jmp 0x4bef16
mov edx, 0x4003
cmp cx, dx
jne 0x4bedd7
mov eax, dword [esp + 0x80]
mov eax, dword [eax]
mov dword [esp + 0xb0], eax
mov dword [esp + 0xc5], 0
jmp 0x4bef16
mov dword [esp + 0xb0], 0
cmp cx, 0xa
jne 0x4bee11
cmp dword [esp + 0x80], 0x80020004
jne 0x4bee96
mov byte [esp + 0xc4], 1
mov dword [esp + 0xc5], 0x80020005
jmp 0x4bef16
cmp cx, 9
je 0x4bee21
mov edx, 0x4009
cmp cx, dx
jne 0x4bee96
test ecx, 0x4000
je 0x4bee34
mov eax, dword [esp + 0x80]
mov edx, dword [eax]
jmp 0x4bee3b
mov edx, dword [esp + 0x80]
test edx, edx
je 0x4bef0b
push 0
push 0
lea ecx, [esp + 0xbc]
xor eax, eax
push ecx
lea ecx, [esp + 0x74]
mov dword [esp + 0x74], eax
push ecx
push 3
push 0
push 0x556a40
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], eax
mov dword [esp + 0x90], eax
mov eax, dword [edx]
push 0
push edx
call dword [eax + 0x18]
mov dword [esp + 0xc5], eax
test eax, eax
js 0x4bef05
mov ecx, dword [esp + 0x78]
lea eax, [esp + 0xb4]
movzx edx, word [eax]
cmp edx, 1
jne 0x4beeab
mov dword [esp + 0xc5], 0x800a005e
jmp 0x4bef16
xor ecx, ecx
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], ecx
mov ecx, 0x400c
cmp dx, cx
jne 0x4beecf
mov eax, dword [eax + 8]
cmp word [eax], cx
je 0x4beec7
push 3
push 2
push 0x400
push eax
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.OLEAUT32.dll_SafeArrayPtrOfIndex]
mov dword [esp + 0xc5], eax
test eax, eax
js 0x4bef05
mov eax, dword [esp + 0x40]
mov dword [esp + 0xb0], eax
mov dword [esp + 0xc5], 0
mov ecx, dword [esp + 0x78]
jmp 0x4bef16
mov dword [esp + 0xc5], 0x800a005b
cmp word [esp + 0xb4], 0
mov edx, dword [ebp + 0x18]
mov eax, dword [esp + 0xb0]
mov dword [edx], eax
mov al, 1
mov byte [esp + 0x12], al
mov byte [esp + 0x13], al
je 0x4bef49
lea eax, [esp + 0xb4]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov ecx, dword [esp + 0x78]
mov esi, dword [esi]
test esi, esi
jne 0x4bed3f
mov ebx, dword [esp + 0x30]
cmp byte [ebp + 0x28], 0
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, dword [ebp + 0xc]
jne case.0x4bef8b.258
mov eax, dword [ecx]
cmp eax, 0x201
ja case.0x4bef8b.258
je 0x4bf3c2
sub eax, 0x100
cmp eax, 5
ja case.0x4bef8b.258
jmp dword [eax*4 + 0x4bec97]
mov eax, dword [ebx + 0x2c]
mov esi, dword [ebp + 8]
push 0
mov edi, dword [eax + 0x34]
mov eax, dword [ebp + 0x10]
push dword [eax]
push 0x87
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [esp + 0x1c], eax
test al, 4
jne 0x4befde
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
lea edx, [ecx - 9]
cmp edx, 0x22
ja case.0x4befce.10
movzx eax, byte [edx + 0x4bec73]
jmp dword [eax*4 + 0x4bec5f]
mov eax, dword [ebx]
push ebx
call dword [eax + 0xd8]
mov edi, esi
jmp 0x4bf208
mov eax, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call eax
shr eax, 0xf
mov edx, edi
and al, 1
mov byte [esp + 0x2b], 0
mov byte [esp + 0x1c], al
mov eax, dword [ebp + 0x10]
push dword [eax]
lea eax, [esp + 0x57]
push eax
lea eax, [esp + 0x33]
push eax
lea eax, [esp + 0x1f]
push eax
push dword [esp + 0x2c]
call fcn.004be79e
add esp, 0x14
cmp byte [esp + 0x2b], 0
jne 0x4bf3ae
cmp byte [esp + 0x53], 0
mov al, byte [esp + 0x13]
mov byte [esp + 0x12], al
jne case.0x4befce.10
mov edi, esi
jmp 0x4bf20c
cmp byte [ebx + 0x66], 0
jne 0x4befde
test byte [esp + 0x1c], 1
jne 0x4befde
cmp ecx, 0x25
je 0x4bf05f
mov byte [esp + 0x14], 0
cmp ecx, 0x26
jne 0x4bf064
mov byte [esp + 0x14], 1
mov edx, dword [edi + 0x38]
mov ecx, edi
push 1
push dword [esp + 0x18]
push 0
call fcn.004c1e0a
mov edx, eax
add esp, 0xc
mov dword [esp + 0x2c], edx
test edx, edx
je 0x4befde
mov ecx, dword [edx + 0xc]
mov byte [esp + 0x2b], 0
mov eax, dword [ecx + 0x1c]
mov eax, dword [eax + 0x24]
mov eax, dword [eax + 0x28]
mov esi, dword [eax + 0x3c]
mov dword [esp + 0x48], esi
test esi, esi
jne 0x4bf0ec
lea edx, [esp + 0x54]
mov dword [esp + 0x54], esi
mov eax, dword [ecx]
push edx
push 0x55a2c8
push ecx
call dword [eax]
test eax, eax
js 0x4bf0dc
mov ecx, dword [esp + 0x54]
test ecx, ecx
je 0x4bf0dc
mov eax, dword [ecx]
lea edx, [esp + 0x48]
push edx
push ecx
mov byte [esp + 0x33], 1
call dword [eax + 0xc]
mov eax, dword [esp + 0x54]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov esi, dword [esp + 0x48]
mov edx, dword [esp + 0x2c]
test esi, esi
je 0x4bf205
mov eax, dword [edx + 0xc]
mov eax, dword [eax + 0x1c]
mov ecx, dword [eax + 0x24]
mov eax, dword [ecx + 0x24]
cmp word [eax + 0xbc], 0
je 0x4bf112
mov ecx, dword [ecx + 0x28]
call fcn.004be6da
test al, al
jne 0x4bf3ed
cmp byte [esp + 0x2b], 0
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
mov dword [esp + 0x1c], eax
je 0x4bf199
push 5
push esi
call dword [sym.imp.USER32.dll_GetWindow]
mov esi, eax
test esi, esi
je 0x4bf148
push 1
push esi
call dword [sym.imp.USER32.dll_GetWindow]
mov esi, eax
test esi, esi
je 0x4bf148
mov eax, dword [sym.imp.USER32.dll_SetFocus]
push esi
call eax
mov ecx, dword [esp + 0x2c]
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x18], 0
push 0x55a2c8
mov ecx, dword [ecx + 0xc]
push ecx
mov eax, dword [ecx]
call dword [eax]
test eax, eax
js 0x4bf182
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x4bf182
mov eax, dword [ecx]
push ecx
call dword [eax + 0x14]
mov eax, dword [esp + 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0x2c]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
mov ecx, dword [eax + 0x24]
mov ecx, dword [ecx + 0x28]
call fcn.004c21bd
jmp 0x4bf1a1
mov eax, dword [sym.imp.USER32.dll_SetFocus]
push esi
call eax
call dword [sym.imp.USER32.dll_GetFocus]
mov edx, dword [edi + 0x54]
mov ecx, edi
push esi
mov dword [esp + 0x60], eax
call fcn.004c194d
mov esi, dword [esp + 0x60]
add esp, 4
mov eax, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push dword [esp + 0x20]
push 0x87
push esi
call eax
test al, 8
je 0x4bf205
mov eax, dword [edi + 0x28]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
mov eax, dword [eax + 0x24]
cmp word [eax + 0xae], 0
je 0x4bf205
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0xe
push esi
call edi
inc eax
push eax
push 0
push 0xb1
push esi
call edi
mov edi, dword [ebp + 8]
mov al, byte [esp + 0x12]
mov edx, dword [ebp + 0x10]
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, dword [ebp + 0xc]
test al, al
jne case.0x4c06f8.1034
mov eax, dword [ecx]
cmp eax, 0x100
ja 0x4bfc3f
je case.0x4bfc5a.260
dec eax
cmp eax, 0x83
ja case.0x4c06f8.1034
movzx eax, byte [eax + 0x4bebdb]
jmp dword [eax*4 + 0x4beba7]
call dword [sym.imp.USER32.dll_GetFocus]
push 0
push 0
mov esi, eax
mov eax, dword [sym.imp.USER32.dll_SendMessageW]
push 0x87
push esi
call eax
push esi
push dword [edi + 0x54]
mov dword [esp + 0x24], eax
call dword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x4bf2a3
test byte [esp + 0x1c], 0x30
je 0x4bf2a3
push 0
push 0
push 0xf5
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x24
cmp dword [edi + 0x110], 0
je 0x4bf205
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x10
call esi
movzx ebx, ax
push 0x11
shr ebx, 0xf
call esi
shr eax, 0xf
and al, 1
test bl, 1
jne 0x4bf2f1
test al, al
jne 0x4bf2f1
mov eax, dword [edi + 0x110]
mov esi, dword [eax + 0x34]
test esi, esi
je 0x4bf2f1
mov eax, dword [esi + 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xec]
mov esi, dword [esi]
test esi, esi
jne 0x4bf2df
mov ebx, dword [esp + 0x30]
jmp 0x4bf205
mov esi, dword [ebp + 8]
mov eax, dword [ebx + 0x2c]
mov ecx, dword [eax + 0x34]
test ecx, ecx
je 0x4bf205
cmp byte [ecx + 0x6b], 0
mov edx, dword [ebp + 0x10]
je 0x4bf49d
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x108], 0
mov dword [esp + 0x10c], 0
mov dword [esp + 0x110], 0
mov eax, dword [eax]
mov dword [esp + 0xfc], eax
mov eax, dword [edx]
mov dword [esp + 0x100], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0xf8], esi
mov dword [esp + 0x14], 0
mov eax, dword [eax]
mov dword [esp + 0x104], eax
mov eax, dword [ecx + 0x28]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
mov eax, dword [eax + 0x28]
mov esi, dword [eax + 0x34]
test esi, esi
je 0x4bf49d
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x4bf39d
mov eax, dword [ecx]
lea edx, [esp + 0x14]
push edx
lea edx, [esp + 0xfc]
push edx
push ecx
call dword [eax + 0xc0]
mov esi, dword [esi]
test esi, esi
jne 0x4bf380
cmp word [esp + 0x14], si
je 0x4bf205
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x24
mov eax, dword [ebx + 0x2c]
mov ecx, dword [eax + 0x34]
mov eax, dword [eax + 0x2c]
mov dword [esp + 0x1c], ecx
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
mov eax, dword [eax + 0x24]
cmp word [eax + 0xbc], 0
je 0x4bf3f4
mov ecx, ebx
call fcn.004be6da
test al, al
je 0x4bf3f4
mov dl, 1
jmp 0x4bfbf4
mov edi, dword [ebp + 8]
xor esi, esi
push 0xffffffffffffffe0
push edi
call dword [sym.imp.USER32.dll_GetClassWord]
movzx ecx, ax
mov ax, word [0x4e0538]
cmp cx, ax
jne 0x4bf415
test ax, ax
jne 0x4bf425
mov ax, word [0x4e0534]
cmp cx, ax
jne 0x4bf455
test ax, ax
je 0x4bf455
call fcn.004d6912
xor esi, esi
mov ecx, dword [eax + 0x20b]
test ecx, ecx
je 0x4bf455
mov eax, edi
shr eax, 4
movzx eax, ax
mov eax, dword [ecx + eax*4]
test eax, eax
je 0x4bf455
cmp dword [eax + 4], edi
je 0x4bf452
mov eax, dword [eax]
test eax, eax
jne 0x4bf445
jmp 0x4bf455
mov esi, dword [eax + 8]
mov eax, dword [esp + 0x1c]
mov edx, dword [eax + 0x54]
cmp edx, edi
je 0x4bf46b
push edi
mov ecx, eax
call fcn.004c194d
add esp, 4
test esi, esi
je 0x4bf208
cmp dword [esi + 0x3c], edi
jne 0x4bf208
mov eax, dword [esi + 0x2c]
mov eax, dword [eax + 0x24]
cmp word [eax + 0xb4], 0
je 0x4bf208
mov eax, dword [sym.imp.USER32.dll_SetFocus]
push edi
call eax
jmp 0x4bf208
mov edi, dword [ebp + 8]
mov al, byte [esp + 0x12]
jmp 0x4bf20f
mov edi, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
mov al, byte [esp + 0x12]
jmp 0x4bf218
call fcn.004d6912
mov ecx, dword [ebx + 0x2c]
mov esi, eax
mov eax, dword [ecx + 0x34]
test eax, eax
je case.0x4c06f8.1034
mov eax, dword [eax + 0x28]
cmp eax, dword [ecx + 0x2c]
je case.0x4c06f8.1034
cmp byte [esi + 0x182], 0
jne case.0x4c06f8.1034
cmp byte [esi + 0x183], 0
jne case.0x4c06f8.1034
lea eax, [esp + 0x138]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowRect]
push 2
lea eax, [esp + 0x13c]
push eax
push edi
call dword [sym.imp.USER32.dll_GetParent]
push eax
push 0
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov al, byte [esi + 0x183]
mov byte [esi + 0x183], 1
cmp dword [ebx + 0xb4], 0
mov byte [esp + 0x37], al
jne 0x4bf5fd
mov ecx, dword [ebx + 0x2c]
fld qword [0x552080]
fild dword [esp + 0x138]
mov eax, dword [ecx + 0x34]
mov eax, dword [eax + 0x58]
mov dword [esp + 0x30], eax
cmp eax, 0x60
je 0x4bf577
fstp qword [esp + 0x20]
fld qword [esp + 0x20]
fmul st(1)
fild dword [esp + 0x30]
fstp qword [esp + 0x20]
fdiv qword [esp + 0x20]
mov al, byte [esp + 0x13]
mov byte [esp + 0x12], al
mov eax, dword [ecx + 0x2c]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
mov eax, dword [eax + 0x24]
fstp qword [eax + 0x40]
mov ecx, dword [ebx + 0x2c]
mov eax, dword [ecx + 0x34]
mov eax, dword [eax + 0x58]
mov dword [esp + 0x30], eax
cmp eax, 0x60
jne 0x4bf5a3
fstp st(0)
fild dword [esp + 0x13c]
jmp 0x4bf5c6
fild dword [esp + 0x13c]
fstp qword [esp + 0x38]
fmul qword [esp + 0x38]
fild dword [esp + 0x30]
fstp qword [esp + 0x38]
fdiv qword [esp + 0x38]
mov al, byte [esp + 0x13]
mov byte [esp + 0x12], al
mov eax, dword [ecx + 0x2c]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
mov eax, dword [eax + 0x24]
fstp qword [eax + 0x48]
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax + 0x2c]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax + 0x2c]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov al, byte [esp + 0x37]
mov byte [esi + 0x183], al
jmp case.0x4c06f8.1034
call fcn.004d6912
mov edx, eax
lea esi, [ebx + 0x2c]
mov eax, dword [esi]
mov ecx, esi
mov dword [esp + 0x1c], edx
mov eax, dword [eax + 0x34]
test eax, eax
je 0x4bf7a0
mov ebx, dword [esi]
mov eax, dword [eax + 0x28]
cmp eax, dword [ebx + 0x2c]
mov ebx, dword [esp + 0x30]
je 0x4bf7a0
cmp byte [edx + 0x182], 0
jne 0x4bf7a0
cmp byte [edx + 0x183], 0
jne 0x4bf7a0
lea eax, [esp + 0xcc]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowRect]
push 2
lea eax, [esp + 0xd0]
push eax
push edi
call dword [sym.imp.USER32.dll_GetParent]
push eax
push 0
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov edi, dword [esp + 0x1c]
mov ecx, esi
mov al, byte [edi + 0x183]
mov byte [edi + 0x183], 1
cmp dword [ebx + 0xb4], 0
mov byte [esp + 0x37], al
jne 0x4bf79a
mov ecx, dword [esi]
fld qword [0x552080]
mov eax, dword [ecx + 0x34]
mov eax, dword [eax + 0x58]
cmp eax, 0x60
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0xd4]
jne 0x4bf6cd
sub eax, dword [esp + 0xcc]
mov dword [esp + 0x1c], eax
fild dword [esp + 0x1c]
jmp 0x4bf6fa
sub eax, dword [esp + 0xcc]
mov dword [esp + 0x20], eax
fild dword [esp + 0x20]
fstp qword [esp + 0x20]
fld qword [esp + 0x20]
fmul st(1)
fild dword [esp + 0x30]
fstp qword [esp + 0x20]
fdiv qword [esp + 0x20]
mov al, byte [esp + 0x13]
mov byte [esp + 0x12], al
mov eax, dword [ecx + 0x2c]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
mov eax, dword [eax + 0x24]
fstp qword [eax + 0x50]
mov ecx, dword [ebx + 0x2c]
mov eax, dword [ecx + 0x34]
mov eax, dword [eax + 0x58]
cmp eax, 0x60
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0xd8]
jne 0x4bf735
sub eax, dword [esp + 0xd0]
fstp st(0)
mov dword [esp + 0x20], eax
fild dword [esp + 0x20]
jmp 0x4bf760
sub eax, dword [esp + 0xd0]
mov dword [esp + 0x20], eax
fild dword [esp + 0x20]
fstp qword [esp + 0x38]
fmul qword [esp + 0x38]
fild dword [esp + 0x30]
fstp qword [esp + 0x38]
fdiv qword [esp + 0x38]
mov al, byte [esp + 0x13]
mov byte [esp + 0x12], al
mov eax, dword [ecx + 0x2c]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
mov eax, dword [eax + 0x24]
fstp qword [eax + 0x58]
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax + 0x2c]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax + 0x2c]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov al, byte [esp + 0x37]
lea ecx, [ebx + 0x2c]
mov byte [edi + 0x183], al
mov ecx, dword [ecx]
mov eax, dword [ecx + 0x34]
test eax, eax
je case.0x4c06f8.1034
mov eax, dword [eax + 0x28]
cmp eax, dword [ecx + 0x2c]
je case.0x4c06f8.1034
mov esi, dword [ebx + 0x34]
test esi, esi
je 0x4bf7d3
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x4bf7cd
mov eax, dword [ecx]
push ecx
call dword [eax + 0x70]
mov esi, dword [esi]
test esi, esi
jne 0x4bf7c0
mov esi, dword [ebx + 0x34]
test esi, esi
je case.0x4c06f8.1034
nop
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x4bf7ec
mov eax, dword [ecx]
push ecx
call dword [eax + 0x74]
mov esi, dword [esi]
test esi, esi
jne 0x4bf7df
jmp case.0x4c06f8.1034
mov eax, dword [ebp + 0x14]
mov edi, dword [ebx + 0x2c]
mov edx, dword [eax]
mov dword [esp + 0x20], edx
cmp dword [edx + 4], 2
jne 0x4bf84c
mov eax, dword [edi + 0x34]
mov eax, dword [eax + 0x28]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
mov eax, dword [eax + 0x28]
mov esi, dword [eax + 0x34]
test esi, esi
je 0x4bf8db
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x4bf83a
push dword [edx + 8]
mov eax, dword [ecx]
push ecx
call dword [eax + 0xbc]
mov edx, dword [esp + 0x20]
mov esi, dword [esi]
test esi, esi
jne 0x4bf823
mov ebx, dword [ebp + 0x18]
mov dl, 1
mov dword [ebx], esi
jmp 0x4bfbf7
mov edi, dword [edi + 0x2c]
cmp dword [edi + 0x38], 0
je 0x4bf8ab
mov eax, dword [edx + 0x14]
mov ecx, dword [edx + 0x18]
mov dword [esp + 0x48], eax
lea eax, [esp + 0x48]
mov dword [esp + 0x4c], ecx
push eax
mov eax, dword [edi + 0x1c]
mov dword [esp + 0x18], 0
mov eax, dword [eax + 0x24]
mov eax, dword [eax + 0x28]
push dword [eax + 0x3c]
call dword [sym.imp.USER32.dll_ScreenToClient]
mov ecx, dword [ebx + 0x2c]
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x50]
push 0
push eax
lea edx, [esp + 0x54]
call fcn.004be5c5
mov eax, dword [esp + 0x20]
add esp, 0xc
test eax, eax
je 0x4bf8ab
mov eax, dword [eax + 0x2c]
mov edi, dword [eax + 0x2c]
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax + 0x34]
mov eax, dword [eax + 0x28]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
mov eax, dword [eax + 0x28]
mov esi, dword [eax + 0x34]
test esi, esi
je 0x4bf8db
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x4bf8d5
mov eax, dword [ecx]
push edi
push ecx
call dword [eax + 0xb8]
mov esi, dword [esi]
test esi, esi
jne 0x4bf8c4
mov ebx, dword [ebp + 0x18]
mov dl, 1
mov dword [ebx], 0
jmp 0x4bfbf7
mov eax, dword [ebx + 0x2c]
mov ebx, dword [ebp + 0x18]
mov eax, dword [eax + 0x34]
cmp edi, dword [eax + 0x54]
je 0x4bf9dc
cmp dword [eax + 0xd0], 0
je 0x4bf9dc
mov dword [ebx], 0xffffffff
mov dl, 1
jmp 0x4bfbf7
mov eax, dword [ebp + 0x14]
mov dword [ebx + 0x3c], edi
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x20]
mov eax, dword [eax + 0x2c]
mov eax, dword [eax + 0x24]
cmp word [eax + 0xb0], 0
jne case.0x4c06f8.1034
push str.UxTheme.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je case.0x4c06f8.1034
push str.SetWindowTheme
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x55c75e
push 0x55c75e
push edi
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp case.0x4c06f8.1034
cmp byte [ebx + 0x6d], 0
mov dword [esp + 0x14], 0
jne 0x4bf9b3
mov esi, dword [ebx + 0x34]
mov edi, dword [edx]
test esi, esi
je case.0x4c06f8.1034
mov edi, edi
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x4bf9a2
mov eax, dword [ecx]
lea edx, [esp + 0x14]
push edx
push edi
push ecx
call dword [eax + 0x1c]
mov esi, dword [esi]
test esi, esi
jne 0x4bf98f
cmp word [esp + 0x14], si
je case.0x4c06f8.1034
mov ebx, dword [ebp + 0x18]
mov dl, 1
mov dword [ebx], 1
jmp 0x4bfbf7
mov eax, dword [ebx + 0x2c]
mov ebx, dword [ebp + 0x18]
mov ecx, dword [eax + 0x34]
cmp byte [ecx + 0x63], 0
je 0x4bf9dc
cmp word [edx], 0
setne al
mov byte [ecx + 0x68], al
mov dl, byte [esp + 0x12]
jmp 0x4bfbf7
mov eax, dword [edx]
mov edi, dword [ebx + 0xb8]
test eax, eax
je 0x4bf9f7
mov dword [ebx + 0xb8], eax
mov esi, dword [ebx + 0x34]
xor eax, eax
mov dword [esp + 0x14], eax
test esi, esi
je 0x4bfa23
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x4bfa16
mov eax, dword [ecx]
lea edx, [esp + 0x14]
push edx
push ecx
call dword [eax + 0x64]
mov esi, dword [esi]
test esi, esi
jne 0x4bfa04
mov eax, dword [esp + 0x14]
mov edx, dword [ebp + 0x10]
cmp dword [edx], 0
je 0x4bfa2e
mov dword [ebx + 0xb8], edi
mov ebx, dword [ebp + 0x18]
test ax, ax
je 0x4bf9dc
mov dword [ebx], 0
mov dl, 1
jmp 0x4bfbf7
mov esi, dword [ebx + 0x34]
test esi, esi
je 0x4bfa65
jmp 0x4bfa4f
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x4bfa5f
mov eax, dword [ecx]
push ecx
call dword [eax + 0xf8]
mov esi, dword [esi]
test esi, esi
jne 0x4bfa4f
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax + 0x34]
test eax, eax
je case.0x4c06f8.1034
mov esi, dword [sym.imp.USER32.dll_PostMessageW]
cmp dword [eax + 0x54], edi
je 0x4bfa91
push 0
push 0
push 0x406
push edi
call dword [sym.imp.USER32.dll_GetParent]
push eax
call esi
call fcn.004d6912
push 0
push 0
push 0x407
push edi
mov byte [eax + 0x187], 1
call esi
jmp case.0x4c06f8.1034
push 0xfffffffffffffff0
push edi
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, 0x10000000
jne case.0x4c06f8.1034
mov eax, dword [ebx + 0x2c]
mov ecx, dword [eax + 0x34]
test ecx, ecx
je case.0x4c06f8.1034
mov ecx, dword [ecx + 0x38]
cmp ecx, dword [eax + 0x2c]
jne case.0x4c06f8.1034
test ecx, ecx
je case.0x4c06f8.1034
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax + 0x34]
mov dword [eax + 0x38], 0
jmp case.0x4c06f8.1034
push 0
push 0
push edi
call dword [sym.imp.USER32.dll_InvalidateRect]
cmp byte [ebx + 0x70], 0
jne 0x4c0285
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax + 0x34]
cmp dword [eax + 0x74], 0
jne 0x4c0285
mov ecx, dword [ebp + 0x10]
mov esi, dword [ecx]
test esi, esi
je 0x4bfba7
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esp + 0x14], eax
jne 0x4c0285
push 0x80
lea eax, [esp + 0x14c]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClassNameW]
mov edx, 0xe
lea ecx, [esp + 0x148]
mov esi, str.Thunder
mov eax, dword [ecx]
cmp eax, dword [esi]
jne 0x4bfb91
sub edx, 4
add ecx, 4
add esi, 4
mov eax, edx
cmp edx, 4
jae 0x4bfb77
test eax, eax
je 0x4bfba4
sub esi, ecx
mov al, byte [ecx]
dec edx
cmp al, byte [ecx + esi]
jne 0x4c0285
inc ecx
test edx, edx
jne 0x4bfb93
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebx + 0x2c]
cmp dword [eax + 0x34], 0
je case.0x4c06f8.1034
cmp byte [ebx + 0x6f], 0
jne case.0x4c06f8.1034
push 0
mov byte [ebx + 0x6f], 1
push dword [ecx]
push 0x409
push edi
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax + 0x34]
cmp dword [eax + 0x54], edi
je case.0x4c06f8.1034
mov eax, dword [ebp + 0x10]
push edi
mov esi, dword [eax]
call dword [sym.imp.USER32.dll_GetParent]
push 0
push esi
push 0x408
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov dl, byte [esp + 0x12]
mov ebx, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x1c]
test ecx, ecx
je 0x4bfc14
mov eax, dword [ecx]
test eax, eax
je 0x4bfc14
mov eax, dword [eax + 0x44]
cmp eax, dword [ecx + 4]
je 0x4bfc14
mov dword [ebx], 0
mov dl, 1
mov al, dl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x24
call fcn.004d6912
mov dl, byte [esp + 0x12]
cmp dword [eax + 0x1a5], ebx
mov ebx, dword [ebp + 0x18]
jne 0x4bfbf7
mov dword [eax + 0x1a5], 0
jmp 0x4bfbf7
cmp eax, 0x200
ja 0x4bff5c
je 0x4bfec4
sub eax, 0x101
cmp eax, 4
ja case.0x4c06f8.1034
jmp dword [eax*4 + 0x4beb93]
movzx eax, byte [edx]
mov dword [esp + 0x14], eax
test eax, eax
je 0x4bfd71
push 0x11
call esi
movsx esi, ax
mov eax, dword [sym.imp.USER32.dll_GetKeyState]
and esi, 0xbfffffff
push 0x10
call eax
movsx edi, ax
shr edi, 1
or edi, esi
push 0x12
shr edi, 1
call dword [sym.imp.USER32.dll_GetKeyState]
mov esi, dword [ebx + 0x34]
cwde
and eax, 0x9fffffff
or eax, edi
shr eax, 0x1d
mov dword [esp + 0x48], eax
test esi, esi
je 0x4bfccc
mov ebx, eax
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x4bfcc2
mov eax, dword [ecx]
lea edx, [esp + 0x14]
push ebx
push edx
push ecx
call dword [eax + 0x24]
mov esi, dword [esi]
test esi, esi
jne 0x4bfcaf
mov ebx, dword [esp + 0x30]
test dword [ebx + 0x74], 0x2000000
je 0x4bfce2
call fcn.004c25f4
test al, al
je 0x4bfd6a
mov esi, dword [ebx + 0x84]
cmp esi, 0xffffffff
je 0x4bfd6a
mov eax, dword [ebx + 0x2c]
mov ecx, dword [eax + 0x2c]
movzx eax, word [esp + 0x14]
mov edx, dword [ecx + 0x24]
mov dword [esp + 0x54], eax
add edx, 4
xor eax, eax
mov dword [esp + 0x40], 2
mov dword [esp + 0x3c], eax
mov dword [esp + 0x44], eax
lea eax, [esp + 0xf8]
mov dword [esp + 0x38], eax
mov eax, 0x4002
mov word [esp + 0x108], ax
lea eax, [esp + 0x54]
mov dword [esp + 0x110], eax
mov eax, 2
mov word [esp + 0xf8], ax
mov eax, dword [esp + 0x48]
mov word [esp + 0x100], ax
lea eax, [esp + 0x38]
push eax
push esi
push ecx
push edx
mov ecx, ebx
call fcn.004c25f7
movsx eax, word [esp + 0x54]
jmp 0x4bfd6e
mov eax, dword [esp + 0x14]
mov edx, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x18]
mov dword [edx], eax
test eax, eax
jne 0x4bf9dc
mov dword [ebx], eax
mov dl, 1
jmp 0x4bfbf7
movzx eax, byte [edx]
mov dword [esp + 0x14], eax
test eax, eax
je 0x4bfd71
push 0x11
call esi
movsx esi, ax
push 0x10
and esi, 0xbfffffff
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edi, ax
shr edi, 1
or edi, esi
push 0x12
shr edi, 1
call dword [sym.imp.USER32.dll_GetKeyState]
mov esi, dword [ebx + 0x34]
cwde
and eax, 0x9fffffff
or eax, edi
shr eax, 0x1d
mov dword [esp + 0x48], eax
test esi, esi
je 0x4bfded
mov ebx, eax
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x4bfde3
mov eax, dword [ecx]
lea edx, [esp + 0x14]
push ebx
push edx
push ecx
call dword [eax + 0x28]
mov esi, dword [esi]
test esi, esi
jne 0x4bfdd0
mov ebx, dword [esp + 0x30]
test dword [ebx + 0x74], 0x2000000
je 0x4bfe03
call fcn.004c25f4
test al, al
je 0x4bfd6a
mov esi, dword [ebx + 0x88]
jmp 0x4bfce8
mov ecx, dword [edx]
and ecx, 0xffff
mov dword [esp + 0x2c], ecx
je 0x4bfeab
mov esi, dword [ebx + 0x34]
test esi, esi
je 0x4bfe43
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x4bfe39
mov eax, dword [ecx]
lea edx, [esp + 0x2c]
push edx
push ecx
call dword [eax + 0x2c]
mov esi, dword [esi]
test esi, esi
jne 0x4bfe27
mov ecx, dword [esp + 0x2c]
test dword [ebx + 0x74], 0x2000000
je 0x4bfe55
call fcn.004c25f4
test al, al
je 0x4bfeab
mov edx, dword [ebx + 0x8c]
cmp edx, 0xffffffff
je 0x4bfeab
mov eax, dword [ebx + 0x2c]
xor esi, esi
mov eax, dword [eax + 0x2c]
mov ecx, dword [eax + 0x24]
mov dword [esp + 0x3c], esi
add ecx, 4
mov dword [esp + 0x44], esi
lea esi, [esp + 0x68]
mov dword [esp + 0x38], esi
mov esi, 0x4002
mov word [esp + 0x68], si
lea esi, [esp + 0x2c]
mov dword [esp + 0x70], esi
lea esi, [esp + 0x38]
push esi
push edx
push eax
push ecx
mov ecx, ebx
mov dword [esp + 0x50], 1
call fcn.004c25f7
mov ecx, dword [esp + 0x2c]
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x18]
mov dword [eax], ecx
test ecx, ecx
jne 0x4bf9dc
mov dword [ebx], ecx
mov dl, 1
jmp 0x4bfbf7
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax + 0x34]
cmp dword [eax + 0xd0], 0
je case.0x4c06f8.1034
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0
push eax
mov dword [esp + 0x1c], 0
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [ebx + 0x2c]
mov esi, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ecx, dword [eax + 0x34]
sub esi, dword [ecx + 0xd8]
mov dword [esp + 0x14], esi
sub edx, dword [ecx + 0xdc]
mov dword [esp + 0x18], edx
cmp byte [ecx + 0xc5], 0
jne 0x4bff4c
test esi, esi
jne 0x4bff25
test edx, edx
je 0x4bff4c
mov eax, dword [ecx + 0xcc]
push 0
push dword [ecx + 0xd4]
add eax, edx
push dword [ecx + 0xd0]
push eax
mov eax, dword [ecx + 0xc8]
mov ecx, ebx
add eax, esi
push eax
call fcn.004c26ee
mov ebx, dword [ebp + 0x18]
mov dl, 1
mov dword [ebx], 0
jmp 0x4bfbf7
cmp eax, 0x406
ja 0x4c06d9
je 0x4c0662
sub eax, 0x201
cmp eax, 0x21
ja case.0x4c06f8.1034
movzx eax, byte [eax + 0x4beb6f]
jmp dword [eax*4 + 0x4beb53]
mov esi, dword [ebx + 0x34]
test esi, esi
je case.0x4c06f8.1034
xor eax, eax
mov ecx, eax
mov dword [esp + 0x118], eax
mov dword [esp + 0x11c], eax
mov dword [esp + 0x120], ecx
mov dword [esp + 0x124], eax
mov edx, dword [esi + 4]
test edx, edx
je 0x4bffdf
mov eax, dword [edx]
lea ecx, [esp + 0x118]
push ecx
mov ecx, dword [ebp + 0x14]
push dword [ecx]
push edx
call dword [eax + 0xa4]
mov ecx, dword [esp + 0x120]
mov eax, dword [esp + 0x118]
test ax, ax
jne 0x4bffef
mov esi, dword [esi]
test esi, esi
jne 0x4bff94
jmp case.0x4c06f8.1034
xor esi, esi
mov byte [esp + 0xf0], 0
mov word [esp + 0xe0], si
lea edx, [esp + 0x118]
cmp ax, 3
jne 0x4c001e
mov eax, dword [ebp + 0x18]
mov dword [eax], ecx
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x24
mov esi, 0x4003
cmp ax, si
jne 0x4c003a
mov eax, dword [ecx]
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x24
xor esi, esi
mov dword [esp + 0xdc], esi
cmp ax, 0xa
jne 0x4c0061
cmp ecx, 0x80020004
jne 0x4c0061
mov eax, dword [ebp + 0x18]
mov dword [eax], esi
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x24
cmp ax, 9
je 0x4c0071
mov ebx, 0x4009
cmp ax, bx
jne 0x4c00dc
test eax, 0x4000
je 0x4c007a
mov ecx, dword [ecx]
test ecx, ecx
je 0x4c0159
push 0
push 0
lea edx, [esp + 0xe8]
xor eax, eax
push edx
lea edx, [esp + 0x74]
mov dword [esp + 0x74], eax
push edx
push 3
push 0
push 0x556a40
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], eax
mov dword [esp + 0x90], eax
mov eax, dword [ecx]
push 0
push ecx
call dword [eax + 0x18]
mov dword [esp + 0xf1], eax
test eax, eax
js 0x4c0150
mov esi, dword [esp + 0xdc]
lea edx, [esp + 0xe0]
movzx eax, word [edx]
cmp eax, 1
jne 0x4c00f4
mov dword [esp + 0xf1], 0x800a005e
jmp 0x4c0164
xor ecx, ecx
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], ecx
mov ecx, 0x400c
cmp ax, cx
jne 0x4c0118
mov edx, dword [edx + 8]
cmp word [edx], cx
je 0x4c0110
push 3
push 2
push 0x400
push edx
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.OLEAUT32.dll_SafeArrayPtrOfIndex]
mov dword [esp + 0xf1], eax
test eax, eax
js 0x4c0150
mov esi, dword [esp + 0x40]
mov dword [esp + 0xdc], esi
mov dword [esp + 0xf1], 0
jmp 0x4c0164
mov esi, dword [esp + 0xdc]
jmp 0x4c0164
mov dword [esp + 0xf1], 0x800a005b
cmp word [esp + 0xe0], 0
mov eax, dword [ebp + 0x18]
mov dword [eax], esi
je 0x4c0182
lea eax, [esp + 0xe0]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x24
mov byte [ebx + 0x6a], 1
jmp case.0x4c06f8.1034
mov eax, dword [ebx + 0x3c]
lea edi, [ebx + 0x3c]
cmp eax, dword [edx]
jne 0x4c0219
mov esi, dword [ebx + 0x34]
test esi, esi
je 0x4c01c8
lea esp, [esp]
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x4c01bf
mov eax, dword [ecx]
push ecx
call dword [eax + 0xdc]
mov esi, dword [esi]
test esi, esi
jne 0x4c01af
lea edi, [ebx + 0x3c]
call fcn.004d6912
mov eax, dword [eax + 0x1ff]
test eax, eax
je 0x4c0219
mov eax, dword [eax + 0x28]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
mov eax, dword [eax + 0x28]
mov esi, dword [eax + 0x34]
test esi, esi
je 0x4c0219
jmp 0x4c01ef
mov edx, dword [esi + 4]
test edx, edx
je 0x4c0210
mov eax, dword [ebx + 0x2c]
mov ecx, dword [edx]
mov eax, dword [eax + 0x34]
movzx eax, byte [eax + 0x66]
neg eax
sbb eax, eax
push eax
push 0
push edx
call dword [ecx + 0xe0]
mov esi, dword [esi]
test esi, esi
jne 0x4c01ef
lea edi, [ebx + 0x3c]
mov ecx, dword [ebp + 0x14]
mov eax, dword [edi]
cmp eax, dword [ecx]
jne 0x4c0285
mov esi, dword [ebx + 0x34]
test esi, esi
je 0x4c0245
lea ebx, [ebx]
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x4c023f
mov eax, dword [ecx]
push ecx
call dword [eax + 0xd8]
mov esi, dword [esi]
test esi, esi
jne 0x4c022f
call fcn.004d6912
mov eax, dword [eax + 0x1ff]
test eax, eax
je 0x4c0285
mov eax, dword [eax + 0x28]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
mov eax, dword [eax + 0x28]
mov esi, dword [eax + 0x34]
test esi, esi
je 0x4c0285
mov edx, dword [esi + 4]
test edx, edx
je 0x4c027f
mov eax, dword [ebx + 0x2c]
mov ecx, dword [edx]
push 0
push dword [eax + 0x2c]
push edx
call dword [ecx + 0xe0]
mov esi, dword [esi]
test esi, esi
jne 0x4c0267
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0x24
mov eax, dword [ebx]
lea ecx, [esp + 0x88]
push ecx
fldz
push ebx
fstp qword [esp + 0x90]
call dword [eax + 0x14]
push 0x11
call esi
movsx esi, ax
push 0x10
and esi, 0xbfffffff
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edi, ax
shr edi, 1
or edi, esi
push 0x12
shr edi, 1
call dword [sym.imp.USER32.dll_GetKeyState]
mov esi, dword [ebx + 0x34]
cwde
and eax, 0x9fffffff
mov dword [esp + 0x5c], 0
or eax, edi
shr eax, 0x1d
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [esp + 0x2c], eax
test esi, esi
je case.0x4c06f8.1034
lea esp, [esp]
mov edi, dword [esi + 4]
test edi, edi
je 0x4c03ab
mov ecx, dword [ebx + 0x2c]
lea eax, [esp + 0x5c]
mov edx, dword [edi]
push eax
mov eax, dword [ebp + 0x14]
sub esp, 8
movsx eax, word [eax + 2]
mov dword [esp + 0x2c], eax
fild dword [esp + 0x2c]
mov eax, dword [ebp + 0x14]
fstp qword [esp + 0x2c]
fld qword [esp + 0x2c]
fdiv qword [esp + 0x94]
movsx eax, word [eax]
fmul qword [ecx + 0x74]
fstp dword [esp + 0x2c]
fld dword [esp + 0x2c]
fstp dword [esp + 4]
mov dword [esp + 0x2c], eax
fild dword [esp + 0x2c]
fstp qword [esp + 0x2c]
fld qword [esp + 0x2c]
fdiv qword [esp + 0x94]
fmul qword [ecx + 0x6c]
xor ecx, ecx
cmp dword [esp + 0x38], 0x207
setne cl
xor eax, eax
dec ecx
and ecx, 4
cmp dword [esp + 0x38], 0x204
fstp dword [esp + 0x2c]
fld dword [esp + 0x2c]
setne al
dec eax
and eax, 2
or ecx, eax
xor eax, eax
cmp dword [esp + 0x38], 0x201
fstp dword [esp]
push dword [esp + 0x28]
sete al
or ecx, eax
push ecx
push edi
call dword [edx + 0x44]
mov esi, dword [esi]
test esi, esi
jne 0x4c02ff
cmp word [esp + 0x5c], si
je 0x4c0659
mov ebx, dword [ebp + 0x18]
mov dl, 1
mov dword [ebx], 0
jmp 0x4bfbf7
mov eax, dword [ebx]
lea ecx, [esp + 0x60]
push ecx
fldz
push ebx
fstp qword [esp + 0x68]
call dword [eax + 0x14]
push 0x11
call esi
movsx esi, ax
push 0x10
and esi, 0xbfffffff
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edi, ax
shr edi, 1
or edi, esi
push 0x12
shr edi, 1
call dword [sym.imp.USER32.dll_GetKeyState]
mov esi, dword [ebx + 0x34]
cwde
and eax, 0x9fffffff
mov dword [esp + 0x1c], 0
or eax, edi
shr eax, 0x1d
mov dword [esp + 0x5c], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [esp + 0x2c], eax
test esi, esi
je case.0x4c06f8.1034
mov edi, dword [esi + 4]
test edi, edi
je 0x4c04d8
mov ecx, dword [ebx + 0x2c]
lea eax, [esp + 0x1c]
mov edx, dword [edi]
push eax
mov eax, dword [ebp + 0x14]
sub esp, 8
movsx eax, word [eax + 2]
mov dword [esp + 0x2c], eax
fild dword [esp + 0x2c]
mov eax, dword [ebp + 0x14]
fstp qword [esp + 0x2c]
fld qword [esp + 0x2c]
fdiv qword [esp + 0x6c]
movsx eax, word [eax]
fmul qword [ecx + 0x74]
fstp dword [esp + 0x2c]
fld dword [esp + 0x2c]
fstp dword [esp + 4]
mov dword [esp + 0x2c], eax
fild dword [esp + 0x2c]
fstp qword [esp + 0x2c]
fld qword [esp + 0x2c]
fdiv qword [esp + 0x6c]
fmul qword [ecx + 0x6c]
xor ecx, ecx
cmp dword [esp + 0x38], 0x208
setne cl
xor eax, eax
dec ecx
and ecx, 4
cmp dword [esp + 0x38], 0x205
fstp dword [esp + 0x2c]
fld dword [esp + 0x2c]
setne al
dec eax
and eax, 2
or ecx, eax
xor eax, eax
cmp dword [esp + 0x38], 0x202
fstp dword [esp]
push dword [esp + 0x68]
sete al
or ecx, eax
push ecx
push edi
call dword [edx + 0x48]
mov esi, dword [esi]
test esi, esi
jne 0x4c0432
cmp word [esp + 0x1c], si
jmp 0x4c03ba
mov eax, dword [ebx]
lea ecx, [esp + 0x38]
push ecx
fldz
push ebx
fstp qword [esp + 0x40]
call dword [eax + 0x14]
mov edi, dword [ebp + 0x10]
lea esi, [ebx + 0x34]
mov ecx, dword [ebp + 0x14]
lea edx, [esp + 0x14]
mov dword [esp + 0x54], esi
mov dword [esp + 0x2c], 0
mov eax, dword [edi]
mov dword [esp + 0x1c], eax
shr eax, 2
mov dword [esp + 0x20], eax
movsx eax, word [ecx]
mov dword [esp + 0x14], eax
movsx eax, word [ecx + 2]
mov ecx, dword [ebx + 0x2c]
mov dword [esp + 0x48], eax
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x50]
push eax
call fcn.004be5c5
fild dword [esp + 0x20]
add esp, 0xc
fstp qword [esp + 0x60]
fld qword [esp + 0x60]
fdiv qword [esp + 0x38]
fild dword [esp + 0x48]
fstp qword [esp + 0x60]
fld qword [esp + 0x60]
mov ecx, dword [esp + 0x54]
fdiv qword [esp + 0x38]
cmp ecx, esi
jne 0x4c0587
mov eax, dword [ebx + 0x2c]
fld qword [eax + 0x6c]
fmulp st(2)
fxch st(1)
fst qword [esp + 0x60]
fld qword [eax + 0x74]
jmp 0x4c0597
fld qword [0x552068]
fmul st(2), st(0)
fxch st(2)
fst qword [esp + 0x60]
fxch st(1)
mov esi, dword [ecx]
fmulp st(2)
fxch st(1)
fst qword [esp + 0x88]
test esi, esi
je 0x4c05fd
mov ebx, dword [esp + 0x20]
mov edi, dword [esi + 4]
test edi, edi
je 0x4c05e4
mov eax, dword [esp + 0x1c]
sub esp, 8
mov edx, dword [edi]
mov ecx, ebx
fstp dword [esp + 0x28]
fld dword [esp + 0x28]
and ecx, 4
fstp dword [esp + 4]
and eax, 3
fstp dword [esp + 0x28]
fld dword [esp + 0x28]
or ecx, eax
fstp dword [esp]
push ecx
push edi
call dword [edx + 0x58]
jmp 0x4c05e8
fstp st(1)
fstp st(0)
mov esi, dword [esi]
fld qword [esp + 0x60]
fld qword [esp + 0x88]
test esi, esi
jne 0x4c05ac
mov ebx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
fstp st(1)
fstp st(0)
mov esi, ebx
test eax, eax
je 0x4c060d
mov esi, eax
test dword [ebx + 0x74], 0x2000000
je 0x4c061f
call fcn.004c25f4
test al, al
je 0x4c0659
cmp dword [esi + 0xa8], 0xffffffff
je 0x4c0659
test dword [esi + 0x74], 0x1000
je 0x4c063c
mov ecx, esi
call fcn.004c1c26
test al, al
je 0x4c0659
mov eax, dword [esi + 0x2c]
mov ecx, ebx
push 0
push dword [esi + 0xa8]
mov eax, dword [eax + 0x2c]
push eax
mov eax, dword [eax + 0x24]
add eax, 4
push eax
call fcn.004c25f7
mov dl, byte [esp + 0x13]
jmp 0x4bfbf4
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax + 0x34]
test eax, eax
je case.0x4c06f8.1034
cmp byte [eax + 0x6b], 0
je case.0x4c06f8.1034
mov edx, dword [eax + 0x54]
cmp edi, edx
je 0x4c0690
mov ecx, edi
call fcn.004c20b2
test al, al
je case.0x4c06f8.1034
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax + 0x34]
cmp byte [eax + 0x6c], 0
jne case.0x4c06f8.1034
mov byte [eax + 0x6c], 1
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax + 0x34]
mov eax, dword [eax + 0x28]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
mov eax, dword [eax + 0x28]
mov esi, dword [eax + 0x34]
test esi, esi
je case.0x4c06f8.1034
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x4c06ce
mov eax, dword [ecx]
push ecx
call dword [eax + 0x38]
mov esi, dword [esi]
test esi, esi
jne 0x4c06c1
jmp case.0x4c06f8.1034
cmp eax, 0x77ea
ja case.0x4c06f8.1034
je 0x4c0afa
sub eax, 0x407
cmp eax, 6
ja case.0x4c06f8.1034
jmp dword [eax*4 + 0x4beb37]
mov eax, dword [ebx + 0x2c]
lea ecx, [ebx + 0x2c]
mov esi, dword [edx]
mov eax, dword [eax + 0x34]
test eax, eax
je case.0x4c06f8.1034
cmp byte [eax + 0x6b], 0
je case.0x4c06f8.1034
mov edx, dword [eax + 0x54]
cmp edi, edx
je 0x4c0735
mov ecx, edi
call fcn.004c20b2
test al, al
je case.0x4c06f8.1034
lea ecx, [ebx + 0x2c]
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax + 0x34]
cmp byte [eax + 0x6c], 0
je case.0x4c06f8.1034
test esi, esi
je 0x4c0767
mov eax, dword [eax + 0x54]
cmp esi, eax
je case.0x4c06f8.1034
push esi
push eax
call dword [sym.imp.USER32.dll_IsChild]
test eax, eax
jne case.0x4c06f8.1034
lea ecx, [ebx + 0x2c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x6c], 0
mov eax, dword [ecx]
mov eax, dword [eax + 0x34]
mov eax, dword [eax + 0x28]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
mov eax, dword [eax + 0x28]
mov esi, dword [eax + 0x34]
test esi, esi
je case.0x4c06f8.1034
lea ecx, [ecx]
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x4c079c
mov eax, dword [ecx]
push ecx
call dword [eax + 0x3c]
mov esi, dword [esi]
test esi, esi
jne 0x4c078f
jmp case.0x4c06f8.1034
call fcn.004d6912
mov esi, eax
cmp byte [esi + 0x188], 0
je 0x4c07e1
cmp dword [esi + 0x1ad], 0xa
jge 0x4c07e1
mov eax, dword [ebp + 0x14]
push dword [eax]
mov eax, dword [ebp + 0x10]
push dword [eax]
mov eax, dword [ebp + 0xc]
push dword [eax]
push edi
call dword [sym.imp.USER32.dll_PostMessageW]
inc dword [esi + 0x1ad]
jmp case.0x4c06f8.1034
mov byte [esi + 0x187], 0
mov eax, dword [ebx + 0x2c]
mov ecx, dword [eax + 0x34]
test ecx, ecx
je case.0x4c06f8.1034
mov eax, dword [esi + 0x16e]
cmp eax, dword [ecx + 0x28]
jne case.0x4c06f8.1034
mov dword [esi + 0x1a1], ecx
mov esi, dword [ebx + 0x34]
test esi, esi
je case.0x4c06f8.1034
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x4c0823
mov eax, dword [ecx]
push ecx
call dword [eax + 0x5c]
mov esi, dword [esi]
test esi, esi
jne 0x4c0816
jmp case.0x4c06f8.1034
call fcn.004d6912
cmp byte [eax + 0x187], 0
lea esi, [eax + 0x1a9]
je 0x4c0864
cmp dword [esi], 0xa
jge 0x4c0864
mov eax, dword [ebp + 0x14]
push dword [eax]
mov eax, dword [ebp + 0x10]
push dword [eax]
mov eax, dword [ebp + 0xc]
push dword [eax]
push edi
call dword [sym.imp.USER32.dll_PostMessageW]
inc dword [esi]
jmp case.0x4c06f8.1034
mov word [eax + 0x187], 0
mov dword [esi], 0
mov eax, dword [ebx + 0x2c]
cmp dword [eax + 0x34], 0
je case.0x4c06f8.1034
mov esi, dword [ebx + 0x34]
test esi, esi
je case.0x4c06f8.1034
lea esp, [esp]
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x4c089c
mov eax, dword [ecx]
push ecx
call dword [eax + 0x60]
mov esi, dword [esi]
test esi, esi
jne 0x4c088f
jmp case.0x4c06f8.1034
push 0
push 0
push edi
call dword [sym.imp.USER32.dll_InvalidateRect]
call fcn.004d6912
cmp byte [ebx + 0x6f], 0
mov dword [esp + 0x48], eax
jne case.0x4c06f8.1034
lea eax, [ebx + 0x2c]
mov dword [esp + 0x14], eax
mov eax, dword [eax]
mov edx, dword [eax + 0x34]
test edx, edx
je 0x4c09d7
cmp dword [edx + 0x54], edi
jne 0x4c09d0
cmp byte [edx + 0x6b], 0
je 0x4c0956
mov eax, dword [edx + 0x28]
mov ecx, dword [edx + 0x4c]
test ecx, ecx
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
mov eax, dword [eax + 0x28]
mov esi, dword [eax + 0x34]
lea eax, [ecx + 1]
mov dword [edx + 0x4c], eax
lea ecx, [ebx + 0x2c]
jne 0x4c0929
mov dword [esp + 0x14], ecx
test esi, esi
je 0x4c0929
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x4c091c
mov eax, dword [ecx]
push ecx
call dword [eax + 0x40]
mov esi, dword [esi]
test esi, esi
jne 0x4c090f
lea ecx, [ebx + 0x2c]
mov dword [esp + 0x14], ecx
mov eax, dword [ecx]
mov eax, dword [eax + 0x34]
inc dword [eax + 0x74]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x34]
call fcn.004c1eeb
mov dl, al
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
mov ecx, dword [eax + 0x34]
dec dword [ecx + 0x74]
test dl, dl
jne case.0x4c06f8.1034
jmp 0x4c09d7
mov ecx, dword [edx + 0x38]
test ecx, ecx
je 0x4c09c0
mov eax, dword [ecx]
lea edx, [esp + 0x14]
push edx
push 0x558838
push ecx
mov dword [esp + 0x20], 0
call dword [eax]
test eax, eax
js 0x4c099c
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4c099c
mov eax, dword [eax + 0x1c]
test eax, eax
je 0x4c099c
mov eax, dword [eax + 0x24]
test eax, eax
je 0x4c099c
mov eax, dword [eax + 0x28]
test eax, eax
je 0x4c099c
mov eax, dword [eax + 0x3c]
test eax, eax
jne 0x4c09b4
mov eax, dword [ebx + 0x2c]
mov edx, str.hWnd
push ecx
mov ecx, dword [eax + 0x34]
mov ecx, dword [ecx + 0x38]
call fcn.004c144b
test eax, eax
je 0x4c09d7
push eax
call dword [sym.imp.USER32.dll_SetFocus]
jmp case.0x4c06f8.1034
mov ecx, edx
call fcn.004c1eeb
test al, al
je 0x4c09d7
jmp case.0x4c06f8.1034
mov ecx, ebx
call fcn.004c21bd
mov eax, dword [esp + 0x48]
mov esi, dword [eax + 0x1a5]
mov byte [eax + 0x187], 0
cmp esi, ebx
je case.0x4c06f8.1034
test esi, esi
je 0x4c0a48
cmp byte [ebx + 0x72], 0
je 0x4c0a00
mov byte [ebx + 0x72], 0
jmp 0x4c0a48
mov esi, dword [esi + 0x34]
test esi, esi
je 0x4c0a1e
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x4c0a14
mov eax, dword [ecx]
push ecx
call dword [eax + 0x34]
mov esi, dword [esi]
test esi, esi
jne 0x4c0a07
mov eax, dword [esp + 0x48]
mov ecx, dword [eax + 0x1a5]
mov edx, dword [ecx + 0x7c]
cmp edx, 0xffffffff
je 0x4c0a48
mov eax, dword [ecx + 0x2c]
mov ecx, ebx
push 0
push edx
mov eax, dword [eax + 0x2c]
push eax
mov eax, dword [eax + 0x24]
add eax, 4
push eax
call fcn.004c25f7
mov eax, dword [esp + 0x48]
mov dword [eax + 0x1a5], ebx
mov ecx, dword [ebx + 0x2c]
mov eax, dword [eax + 0x1a1]
cmp eax, dword [ecx + 0x34]
je 0x4c0a6b
push 0
push 0
push 0x40d
push edi
jmp 0x4bfbea
mov esi, dword [ebx + 0x34]
test esi, esi
je 0x4c0a85
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x4c0a7f
mov eax, dword [ecx]
push ecx
call dword [eax + 0x30]
mov esi, dword [esi]
test esi, esi
jne 0x4c0a72
mov ecx, dword [ebx + 0x78]
cmp ecx, 0xffffffff
je case.0x4c06f8.1034
mov eax, dword [ebx + 0x2c]
push 0
push ecx
mov ecx, ebx
mov eax, dword [eax + 0x2c]
push eax
mov eax, dword [eax + 0x24]
add eax, 4
push eax
call fcn.004c25f7
jmp case.0x4c06f8.1034
mov esi, dword [ebx + 0x34]
test esi, esi
je 0x4c0ac8
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x4c0ac2
mov eax, dword [ecx]
push ecx
call dword [eax + 0x30]
mov esi, dword [esi]
test esi, esi
jne 0x4c0ab5
mov ecx, dword [ebx + 0x78]
cmp ecx, 0xffffffff
je case.0x4c06f8.1034
mov eax, dword [ebx + 0x2c]
push 0
push ecx
mov ecx, ebx
mov eax, dword [eax + 0x2c]
push eax
mov eax, dword [eax + 0x24]
add eax, 4
push eax
call fcn.004c25f7
jmp case.0x4c06f8.1034
mov byte [ebx + 0x6f], 0
jmp case.0x4c06f8.1034
mov edi, dword [edx]
mov esi, dword [ebx + 0x34]
mov dword [esp + 0x5c], edi
mov eax, dword [edi + 4]
cmp eax, 0x114
ja 0x4c110c
je 0x4c10d8
sub eax, 0x20
cmp eax, 0xf1
ja case.0x4c1121.278
movzx eax, byte [eax + 0x4bea43]
jmp dword [eax*4 + 0x4bea2b]
mov ecx, dword [ebx + 0xbc]
mov esi, dword [ebp + 8]
test ecx, ecx
je 0x4c0bbd
xor eax, eax
cmp ecx, 0x13
setge al
dec eax
and eax, ecx
mov dword [esp + 0x1c], eax
jne 0x4c0b91
test esi, esi
je 0x4c0b91
push 0xfffffffffffffff4
push esi
call dword [sym.imp.USER32.dll_GetClassLongA]
mov ecx, eax
mov eax, dword [0x4e0530]
mov dword [esp + 0x20], ecx
test eax, eax
jne 0x4c0b86
push 0x7f00
push eax
call dword [sym.imp.USER32.dll_LoadCursorW]
mov ecx, dword [esp + 0x20]
mov dword [0x4e0530], eax
test ecx, ecx
je 0x4c0b91
cmp ecx, eax
je 0x4c0b91
push ecx
jmp 0x4c0ba2
mov eax, dword [0x4e0550]
mov ecx, dword [esp + 0x1c]
mov eax, dword [eax + ecx*4]
test eax, eax
je 0x4c0ba8
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov eax, dword [ebp + 0x18]
mov byte [esp + 0x12], 1
mov dword [eax], 1
mov dword [edi + 0x10], 1
lea eax, [esp + 0x54]
mov dword [esp + 0x54], 0
push eax
mov dword [esp + 0x5c], 0
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [esp + 0x54]
push eax
push esi
call dword [sym.imp.USER32.dll_ScreenToClient]
mov eax, dword [ebx + 0x2c]
mov ecx, dword [eax + 0x2c]
mov eax, dword [eax + 0x34]
mov dword [esp + 0x1c], ecx
test eax, eax
je 0x4c0c1a
mov eax, dword [eax + 0x28]
test eax, eax
je 0x4c0c1a
mov eax, dword [eax + 0x1c]
test eax, eax
je 0x4c0c1a
mov eax, dword [eax + 0x24]
test eax, eax
je 0x4c0c1a
mov eax, dword [eax + 0x28]
test eax, eax
je 0x4c0c1a
test dword [eax + 0x74], 0x8000
jne 0x4c0c71
mov edx, dword [ecx + 0x38]
test edx, edx
je 0x4c0c71
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0x1c]
test ecx, ecx
je 0x4c0c67
mov eax, dword [ecx + 0x24]
mov eax, dword [eax + 0x28]
test eax, eax
je 0x4c0c67
cmp byte [eax + 0x64], 0
je 0x4c0c67
mov ebx, dword [ecx + 0x28]
cmp dword [esp + 0x54], ebx
jl 0x4c0c67
mov eax, dword [ecx + 0x30]
add eax, ebx
cmp dword [esp + 0x54], eax
jg 0x4c0c67
mov ebx, dword [ecx + 0x2c]
cmp dword [esp + 0x58], ebx
jl 0x4c0c67
mov eax, dword [ecx + 0x34]
add eax, ebx
cmp dword [esp + 0x58], eax
jle 0x4c0d0c
mov edx, dword [edx]
test edx, edx
jne 0x4c0c21
mov ecx, dword [esp + 0x1c]
mov eax, dword [ecx + 0x1c]
mov eax, dword [eax + 0x24]
mov ecx, dword [eax + 0x24]
mov ebx, dword [ecx + 0x30]
test ebx, ebx
je case.0x4c1121.278
cmp ebx, 0x63
jne 0x4c0d14
mov ecx, dword [ecx + 0xc]
xor bl, bl
test ecx, ecx
je 0x4c0cf4
mov eax, dword [ecx]
lea edx, [esp + 0x14]
push edx
push 0x55a244
push ecx
mov dword [esp + 0x20], 0
call dword [eax]
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x4c0cf4
mov dword [esp + 0x48], 0
lea edx, [esp + 0x48]
mov eax, dword [ecx]
push edx
push ecx
call dword [eax + 0xc]
mov eax, dword [esp + 0x48]
test eax, eax
je 0x4c0cea
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov eax, dword [ebp + 0x18]
mov bl, 1
mov dword [eax], 1
mov dword [edi + 0x10], 1
mov eax, dword [esp + 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
test bl, bl
mov dl, 1
mov ebx, dword [ebp + 0x18]
jne 0x4c1228
xor dl, dl
mov byte [edi + 0x14], 1
jmp 0x4bfbf7
mov ecx, dword [edx + 0xc]
jmp 0x4c0c71
cmp ebx, 0x13
jl 0x4c0d4f
xor ebx, ebx
test esi, esi
je 0x4c0d4f
push 0xfffffffffffffff4
push esi
call dword [sym.imp.USER32.dll_GetClassLongA]
mov esi, eax
mov eax, dword [0x4e0530]
test eax, eax
jne 0x4c0d44
push 0x7f00
push eax
call dword [sym.imp.USER32.dll_LoadCursorW]
mov dword [0x4e0530], eax
test esi, esi
je 0x4c0d4f
cmp esi, eax
je 0x4c0d4f
push esi
jmp 0x4c0d5c
mov eax, dword [0x4e0550]
mov eax, dword [eax + ebx*4]
test eax, eax
je 0x4c0d62
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov ebx, dword [ebp + 0x18]
mov dl, 1
mov dword [ebx], 1
mov dword [edi + 0x10], 1
mov byte [edi + 0x14], dl
jmp 0x4bfbf7
mov eax, dword [edi + 8]
movzx ecx, word [eax + 2]
movzx eax, word [eax]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], 0
test esi, esi
je 0x4c0dc8
mov ebx, ecx
mov edi, eax
nop
mov edx, dword [esi + 4]
test edx, edx
je 0x4c0db6
mov ecx, dword [edx]
lea eax, [esp + 0x14]
push eax
push edi
movzx eax, bx
push eax
push edx
call dword [ecx + 0xc]
mov esi, dword [esi]
test esi, esi
jne 0x4c0d9f
mov ebx, dword [esp + 0x30]
mov edi, dword [esp + 0x5c]
mov ecx, dword [esp + 0x1c]
test cx, cx
jne 0x4c0e0f
cmp dword [ebx + 0x80], 0xffffffff
je 0x4c0e0f
mov eax, dword [ebx + 0x74]
test eax, 0x2000
jne 0x4c0e0f
test eax, 0x1000
je 0x4c0df2
mov ecx, ebx
call fcn.004c1c26
test al, al
je 0x4c0e0f
mov eax, dword [ebx + 0x2c]
mov ecx, ebx
push 0
push dword [ebx + 0x80]
mov eax, dword [eax + 0x2c]
push eax
mov eax, dword [eax + 0x24]
add eax, 4
push eax
call fcn.004c25f7
cmp word [esp + 0x14], 0
mov ebx, dword [ebp + 0x18]
je 0x4c1224
mov dl, 1
mov byte [edi + 0x14], dl
jmp 0x4bfbf7
test esi, esi
je case.0x4c1121.278
xor ecx, ecx
mov ebx, ecx
mov dword [esp + 0x128], ecx
mov dword [esp + 0x12c], ecx
mov dword [esp + 0x130], ebx
mov dword [esp + 0x134], ecx
mov edx, dword [esi + 4]
test edx, edx
je 0x4c0e7b
mov ecx, dword [edx]
lea eax, [esp + 0x128]
push eax
mov eax, dword [edi + 0xc]
push dword [eax]
push edx
call dword [ecx + 0xa8]
mov ebx, dword [esp + 0x130]
mov ecx, dword [esp + 0x128]
test cx, cx
je 0x4c103a
xor edx, edx
mov byte [esp + 0xa8], 0
mov word [esp + 0x98], dx
lea eax, [esp + 0x128]
cmp cx, 3
jne 0x4c0ebc
mov edx, ebx
mov dword [esp + 0xa9], 0
mov dword [esp + 0x94], edx
jmp 0x4c1013
mov edx, 0x4003
cmp cx, dx
jne 0x4c0edf
mov edx, dword [ebx]
mov dword [esp + 0x94], edx
mov dword [esp + 0xa9], 0
jmp 0x4c1013
xor edx, edx
mov dword [esp + 0x94], edx
cmp cx, 0xa
jne 0x4c0f12
cmp ebx, 0x80020004
jne 0x4c0f8b
mov byte [esp + 0xa8], 1
mov dword [esp + 0xa9], 0x80020005
jmp 0x4c1013
cmp cx, 9
je 0x4c0f1f
cmp cx, word [esp + 0x20]
jne 0x4c0f8b
test ecx, 0x4000
je 0x4c0f29
mov ebx, dword [ebx]
test ebx, ebx
je 0x4c1008
push 0
push 0
lea ecx, [esp + 0xa0]
xor eax, eax
push ecx
lea ecx, [esp + 0x74]
mov dword [esp + 0x74], eax
push ecx
push 3
push 0
push 0x556a40
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], eax
mov dword [esp + 0x90], eax
mov eax, dword [ebx]
push 0
push ebx
call dword [eax + 0x18]
mov dword [esp + 0xa9], eax
test eax, eax
js 0x4c0fff
mov edx, dword [esp + 0x94]
lea eax, [esp + 0x98]
movzx ecx, word [eax]
cmp ecx, 1
jne 0x4c0fa0
mov dword [esp + 0xa9], 0x800a005e
jmp 0x4c1013
xor edx, edx
mov dword [esp + 0x38], edx
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], edx
mov edx, 0x400c
cmp cx, dx
jne 0x4c0fc7
lea ecx, [ecx]
mov eax, dword [eax + 8]
cmp word [eax], dx
je 0x4c0fbf
push 3
push 2
push 0x400
push eax
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.OLEAUT32.dll_SafeArrayPtrOfIndex]
mov dword [esp + 0xa9], eax
test eax, eax
js 0x4c0fff
mov edx, dword [esp + 0x40]
mov dword [esp + 0x94], edx
mov dword [esp + 0xa9], 0
jmp 0x4c1013
mov edx, dword [esp + 0x94]
jmp 0x4c1013
mov dword [esp + 0xa9], 0x800a005b
cmp word [esp + 0x98], 0
mov ebx, dword [ebp + 0x18]
mov dword [ebx], edx
mov dword [edi + 0x10], edx
mov byte [edi + 0x14], 1
je 0x4c103d
lea eax, [esp + 0x98]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
jmp 0x4c103d
mov ebx, dword [ebp + 0x18]
mov esi, dword [esi]
test esi, esi
jne 0x4c0e30
mov dl, byte [esp + 0x12]
mov byte [edi + 0x14], 1
jmp 0x4bfbf7
mov dword [esp + 0x14], 0
test esi, esi
je case.0x4c1121.278
mov edx, dword [esi + 4]
test edx, edx
je 0x4c107e
mov ecx, dword [edx]
lea eax, [esp + 0x14]
push eax
mov eax, dword [edi + 0xc]
push dword [eax]
push edx
call dword [ecx + 0x88]
mov esi, dword [esi]
test esi, esi
jne 0x4c1064
jmp 0x4c10b6
mov dword [esp + 0x14], 0
test esi, esi
je case.0x4c1121.278
mov edx, dword [esi + 4]
test edx, edx
je 0x4c10b0
mov ecx, dword [edx]
lea eax, [esp + 0x14]
push eax
mov eax, dword [edi + 0xc]
push dword [eax]
push edx
call dword [ecx + 0x8c]
mov esi, dword [esi]
test esi, esi
jne 0x4c1096
cmp word [esp + 0x14], 0
mov ebx, dword [ebp + 0x18]
mov dl, byte [esp + 0x12]
je 0x4c1228
mov dword [ebx], 1
mov byte [edi + 0x14], 1
jmp 0x4bfbf7
test esi, esi
je case.0x4c1121.278
mov edx, dword [esi + 4]
test edx, edx
je 0x4c10f6
mov eax, dword [edi + 8]
mov ecx, dword [edx]
push 0xffffffffffffffff
movzx eax, word [eax]
push eax
push edx
call dword [ecx + 0x20]
mov esi, dword [esi]
test esi, esi
jne 0x4c10e0
mov ebx, dword [ebp + 0x18]
mov dl, byte [esp + 0x12]
mov byte [edi + 0x14], 1
jmp 0x4bfbf7
sub eax, 0x115
cmp eax, 0x23
ja case.0x4c1121.278
movzx eax, byte [eax + 0x4be9fb]
jmp dword [eax*4 + 0x4be9e3]
test esi, esi
je case.0x4c1121.278
mov edx, dword [esi + 4]
test edx, edx
je 0x4c1146
mov eax, dword [edi + 8]
mov ecx, dword [edx]
push 0
movzx eax, word [eax]
push eax
push edx
call dword [ecx + 0x20]
mov esi, dword [esi]
test esi, esi
jne 0x4c1130
mov ebx, dword [ebp + 0x18]
mov dl, byte [esp + 0x12]
mov byte [edi + 0x14], 1
jmp 0x4bfbf7
test esi, esi
je case.0x4c1121.278
mov edx, dword [esi + 4]
test edx, edx
je 0x4c117c
mov ecx, dword [edx]
lea eax, [edi + 0x10]
push 0
push eax
mov eax, dword [edi + 8]
push dword [eax]
push edx
call dword [ecx + 0x18]
mov esi, dword [esi]
test esi, esi
jne 0x4c1164
mov ebx, dword [ebp + 0x18]
mov dl, byte [esp + 0x12]
mov byte [edi + 0x14], 1
jmp 0x4bfbf7
test esi, esi
je case.0x4c1121.278
jmp 0x4c119f
mov edx, dword [esi + 4]
test edx, edx
je 0x4c11b7
mov ecx, dword [edx]
lea eax, [edi + 0x10]
push 8
push eax
mov eax, dword [edi + 8]
push dword [eax]
push edx
call dword [ecx + 0x18]
mov esi, dword [esi]
test esi, esi
jne 0x4c119f
mov ebx, dword [ebp + 0x18]
mov dl, byte [esp + 0x12]
mov byte [edi + 0x14], 1
jmp 0x4bfbf7
test esi, esi
je case.0x4c1121.278
mov edx, dword [esi + 4]
test edx, edx
je 0x4c11e9
mov ecx, dword [edx]
lea eax, [edi + 0x10]
push 1
push eax
mov eax, dword [edi + 8]
push dword [eax]
push edx
call dword [ecx + 0x18]
mov esi, dword [esi]
test esi, esi
jne 0x4c11d1
mov ebx, dword [ebp + 0x18]
mov dl, byte [esp + 0x12]
mov byte [edi + 0x14], 1
jmp 0x4bfbf7
test esi, esi
je case.0x4c1121.278
mov edx, dword [esi + 4]
test edx, edx
je 0x4c121b
mov ecx, dword [edx]
lea eax, [edi + 0x10]
push 6
push eax
mov eax, dword [edi + 8]
push dword [eax]
push edx
call dword [ecx + 0x18]
mov esi, dword [esi]
test esi, esi
jne 0x4c1203
mov ebx, dword [ebp + 0x18]
mov dl, byte [esp + 0x12]
mov byte [edi + 0x14], 1
jmp 0x4bfbf7