Function at 0x6602022a
Capabilities:
Hide graphical window
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
and dword [ebp - 4], 0
push ebx
push esi
mov esi, dword [ebp + 8]
test esi, esi
push edi
je 0x6603d8db
mov eax, dword [esi + 0x30]
mov edi, dword [eax + 0x34]
mov dword [ebp - 4], edi
mov ebx, dword [ebp + 0x10]
mov ecx, dword [sym.imp.USER32.dll_IsIconic]
cmp ebx, 0x20
mov eax, 0x86
mov edx, 0x112
jbe 0x66020296
cmp ebx, 0x37
jbe 0x660204cc
cmp ebx, 0x53
jbe 0x6602050d
cmp ebx, eax
ja 0x6602057a
je 0x6602055f
cmp ebx, 0x82
jne case.0x6603e18e.292
push esi
call fcn.6602b577
jmp case.0x6603e18e.292
cmp ebx, 0x20
je 0x660204ba
cmp ebx, 7
jbe 0x66020321
sub ebx, 0xf
je 0x6602048b
dec ebx
je 0x6603db15
sub ebx, 4
je 0x66020472
dec ebx
je 0x6603dab2
mov ebx, dword [ebp + 0x18]
mov edi, dword [ebp + 0x10]
push ebx
push dword [ebp + 0x14]
push edi
push dword [ebp + 0xc]
push esi
call fcn.660208d7
cmp edi, 5
mov dword [ebp + 0x18], eax
jbe 0x660207e0
cmp edi, 0xc
je 0x6603e616
cmp edi, 0x18
je 0x660208c8
cmp edi, 0x30
je 0x660208ae
cmp edi, 0x81
je 0x66020895
cmp edi, 0x84
ja 0x6602086a
mov eax, dword [ebp + 0x18]
pop edi
pop esi
pop ebx
leave
ret 0x14
je 0x66020440
dec ebx
je 0x660203f4
dec ebx
je 0x660203e6
sub ebx, 3
je 0x66020379
dec ebx
jne case.0x6603e18e.292
mov ecx, dword [edi + 0x4e4]
test ecx, ecx
je 0x66020358
xor eax, eax
push 2
cmp word [ebp + 0x14], ax
setne al
push eax
call fcn.660113d2
cmp word [ebp + 0x14], 0
push 0
je 0x6602036c
push dword [ebp + 0xc]
push esi
call fcn.660234d3
jmp 0x6602031a
push 0
push esi
call fcn.6602a796
jmp 0x66020483
mov edi, dword [ebp + 0x14]
cmp edi, 1
je 0x6603d8f1
mov eax, dword [esi + 0x30]
test byte [eax + 0x28], 0x80
jne 0x6603d912
mov eax, dword [esi + 0x128]
test eax, eax
jne 0x6603d940
test byte [esi + 0x100], 0x40
je 0x6603d96e
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je case.0x6603e18e.292
push dword [ebp + 0xc]
call fcn.660225f8
mov edx, dword [esi + 0x138]
lea ecx, [esi + 0x138]
and eax, 3
and dx, 0xfe7f
shl eax, 7
or eax, edx
mov dword [ecx], eax
jmp case.0x6603e18e.292
push dword [ebp + 0xc]
push esi
call fcn.6602b544
jmp case.0x6603e18e.292
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x58]
test byte [eax + 0x99], 0x10
jne 0x66020414
push 0
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_GetSystemMenu]
mov dword [esi + 0x150], eax
mov eax, dword [esi + 0x28]
mov eax, dword [eax]
cmp byte [eax + 0x37], 0x11
je 0x6603d989
cmp dword [0x6610e7b4], 0
jne 0x6603da4c
push 0xffffffffffffffff
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_SetWindowContextHelpId]
jmp case.0x6603e18e.292
cmp dword [ebp + 0xc], 0
je 0x66020453
push dword [ebp + 0xc]
call ecx
test eax, eax
jne 0x66020573
mov eax, dword [esi + 0x28]
mov eax, dword [eax]
cmp byte [eax + 0x37], 0x11
je 0x6603da95
push esi
call fcn.66023526
test eax, eax
je case.0x6603e18e.292
jmp 0x66020483
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
jne 0x6603dadb
push 1
pop eax
jmp 0x6602031a
push dword [ebp + 0xc]
and byte [esi + 0x13b], 0xf7
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
jne 0x6603db20
push 0
push 0
push 0x16
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push esi
call fcn.66026a0e
jmp 0x66020573
cmp dword [ebp + 0x18], 0x201fffe
jne case.0x6603e18e.292
jmp 0x6603db38
je 0x6603dc53
sub ebx, 0x21
je 0x6603dbf2
dec ebx
je 0x6603dc11
dec ebx
dec ebx
jne case.0x6603e18e.292
mov eax, dword [esi + 0x30]
mov esi, dword [ebp + 0x18]
mov eax, dword [eax + 0x58]
test byte [eax + 0x99], 0x10
jne 0x6603dbde
and dword [esi + 0x18], 0
and dword [esi + 0x1c], 0
jmp 0x66020483
je 0x6603dc7c
cmp ebx, 0x47
jne case.0x6603e18e.292
push dword [ebp + 0x18]
mov edi, dword [esi + 0x30]
push dword [ebp + 0x14]
push ebx
push dword [ebp + 0xc]
push esi
call fcn.660208d7
test byte [edi + 0x22], 8
mov ebx, eax
je 0x66020558
mov eax, dword [esi + 0x30]
test byte [eax + 0x20], 0x10
jne 0x66020558
push 0xfffffffffffffff0
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, 0x21000000
jne 0x66020558
push esi
call fcn.66023b92
mov eax, ebx
jmp 0x6602031a
push dword [ebp + 0x14]
push esi
push dword [ebp + 0xc]
call fcn.66023364
test eax, eax
je case.0x6603e18e.292
xor eax, eax
jmp 0x6602031a
cmp ebx, edx
jbe 0x6603dd7d
mov eax, 0x11f
cmp ebx, eax
jbe 0x6603ddcb
mov eax, 0x201
cmp ebx, eax
jbe 0x6603ded4
mov eax, 0x1000
mov edx, 0x104b
cmp ebx, eax
jbe 0x6602064d
mov eax, 0x100e
cmp ebx, eax
jbe 0x660206b8
mov eax, 0x1032
cmp ebx, eax
jbe 0x66020733
cmp ebx, edx
jbe 0x6603e30c
mov edi, 0x105a
cmp ebx, edi
jbe 0x66020776
sub ebx, 0x105b
je 0x6603e6ca
dec ebx
je 0x66020787
dec ebx
jne 0x6603e3d8
mov eax, dword [esi + 0x30]
test byte [eax + 0x20], 0x10
jne 0x6603e4af
cmp dword [ebp + 0x14], 0
je 0x6603e49a
or byte [esi + 0x13b], 8
lea eax, [esi + 0x138]
mov eax, dword [esi + 0x138]
not eax
shr eax, 0x1a
and eax, 1
push eax
push esi
call fcn.660231ce
push dword [ebp + 0xc]
push esi
call fcn.6602293f
test eax, eax
jne 0x6603e4a5
and byte [esi + 0x13b], 0xfb
jmp 0x66020573
jne 0x6603df98
mov eax, dword [esi + 0x28]
mov eax, dword [eax]
cmp byte [eax + 0x37], 0x11
je 0x66020664
push esi
call fcn.6602173b
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x2c]
mov ecx, dword [eax + 0x10]
test byte [ecx + 0x3c], 1
je 0x6602067a
and byte [esi + 0x139], 0xfd
mov ecx, dword [esi + 0x138]
shr ecx, 9
and ecx, 1
push ecx
push eax
call fcn.660217fa
test eax, eax
jne 0x6602031a
mov eax, dword [esi + 0x138]
mov ecx, eax
and eax, 0x200
and ecx, 0xfeffffff
shl eax, 0xf
or ecx, eax
mov dword [esi + 0x138], ecx
jmp case.0x6603e18e.292
jne 0x660206d3
mov eax, dword [ebp + 0x14]
sub eax, 3
je 0x6603e04a
dec eax
dec eax
jne case.0x6603e18e.292
jmp 0x6603e013
cmp ebx, 0x1001
jne case.0x6603e18e.292
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x58]
test byte [eax + 0x99], 0x10
jne 0x6603dff6
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x38]
neg eax
sbb eax, eax
neg eax
push eax
push esi
call fcn.660220b5
mov eax, dword [esi + 0x128]
test eax, eax
jne 0x6603e004
cmp dword [esi + 0x134], 0
lea eax, [esi + 0x134]
je case.0x6603e18e.292
push eax
push esi
call fcn.660220cb
jmp case.0x6603e18e.292
je 0x6603e295
cmp ebx, 0x1011
jne case.0x6603e18e.292
mov eax, dword [ebp + 0x14]
mov ecx, 0x105
cmp eax, ecx
jbe 0x6603e06c
mov ecx, 0x10b
cmp eax, ecx
ja 0x6603e0d8
jne 0x6603e0ae
push dword [ebp + 0x18]
push esi
call fcn.66022ffb
jmp 0x6602031a
jne 0x6603e336
push esi
call fcn.660279ef
jmp 0x66020573
mov eax, dword [esi + 0x30]
mov ecx, dword [eax + 0x58]
test byte [ecx + 0x99], 0x10
jne 0x6603e4c8
mov eax, dword [esi + 0x180]
lea edi, [esi + 0x180]
test eax, eax
jne 0x6603e504
mov edi, dword [esi + 0x188]
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
test edi, edi
jne 0x6603e513
mov eax, dword [esi + 0x15c]
test eax, eax
je case.0x6603e18e.292
push eax
push 0
push dword [0x6610e6c0]
call ebx
jmp case.0x6603e18e.292
je 0x660207f5
dec edi
dec edi
jne 0x66020317
push esi
call fcn.6601f645
jmp 0x66020317
mov eax, dword [esi + 0x30]
add eax, 0x1c
push eax
mov ecx, dword [eax]
call dword [ecx + 0x28]
cmp dword [ebp + 0x14], 1
je 0x66020317
mov eax, dword [esi + 0x28]
mov eax, dword [eax]
mov al, byte [eax + 0x37]
cmp al, 0x1d
je 0x6603e5d3
cmp al, 0x1e
je 0x6603e5d3
cmp al, 0x1f
je 0x6603e5d3
xor edi, edi
cmp dword [0x6610f5e4], edi
jne 0x6603e5b7
push edi
push 7
push esi
call fcn.66022982
cmp dword [0x6610f5e4], edi
jne 0x6603e5c5
push dword [ebp + 0xc]
push esi
call fcn.6602293f
test eax, eax
jne 0x66020317
push esi
call fcn.66023be6
jmp 0x66020317
cmp edi, 0x86
ja 0x66020884
cmp dword [0x6610e6dc], 0
jne 0x66020317
jmp 0x6603e6a2
cmp edi, 0x112
jne 0x66020317
jmp 0x6603e5e9
mov ecx, dword [ebx + 0x20]
mov eax, 0xc00000
mov edx, ecx
and edx, eax
cmp edx, eax
je 0x66020317
jmp 0x6603e5f7
cmp dword [ebp + 0x14], 0
je 0x66020317
push 0xfffffd41
push esi
call fcn.660216d9
jmp 0x66020317
cmp bx, 3
jne 0x66020317
jmp 0x6603e608
lea eax, [ebp - 4]
mov ecx, 0x6610e470
push eax
call fcn.660037a1
mov edi, dword [ebp - 4]
jmp 0x6602024e
push dword [ebp + 0xc]
call ecx
test eax, eax
jne 0x66020385
push dword [ebp - 4]
call fcn.6602347c
mov eax, dword [esi + 0x30]
or byte [eax + 0x28], 0x80
jmp 0x66020392
cmp edi, 2
je 0x6603d91f
test edi, edi
jne 0x66020392
push esi
call fcn.66080617
mov eax, dword [esi + 0x30]
push 0
add eax, 0x1c
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov eax, dword [esi + 0x30]
and byte [eax + 0x28], 0x7f
jmp 0x66020392
mov ecx, dword [eax]
lea edx, [ebp + 8]
push edx
push eax
call dword [ecx + 0x40]
test eax, eax
jl 0x660203a0
test byte [ebp + 8], 1
je 0x660203a0
push 1
push 0
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x660203a0
mov eax, dword [ebp + 0x18]
shr eax, 0x10
movsx eax, ax
push eax
movsx eax, word [ebp + 0x18]
push eax
push edi
push esi
call fcn.66074c34
jmp 0x660203ad
mov ebx, 0x46000001
call dword [sym.imp.USER32.dll_CreateMenu]
test byte [esi + 0x18c], 1
mov dword [esi + 0x198], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0x8000
je 0x6603d9b2
mov ebx, 0x46300001
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_GetClientRect]
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push dword [0x6610e6c8]
sub eax, dword [ebp - 0x18]
push 0xcac
push dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x1c]
push eax
mov eax, dword [esi + 0x24]
push dword [ebp - 0x18]
shr eax, 1
push dword [ebp - 0x1c]
and eax, 1
shl eax, 9
push ebx
push 0
push 0x66050f90
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov ecx, dword [esi + 0x30]
test eax, eax
mov edx, dword [ecx + 0x2c]
mov dword [edx + 0x3c], eax
jne 0x6603da14
or eax, 0xffffffff
jmp 0x6602031a
mov dword [ecx + 0x44], eax
push dword [ecx + 0x2c]
call fcn.66094702
mov eax, dword [esi + 0x30]
push 5
mov eax, dword [eax + 0x2c]
push dword [eax + 0x3c]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push esi
call fcn.66091bfe
test eax, eax
jne 0x66020423
push 7
call fcn.660721aa
jmp 0x66020423
mov eax, dword [esi + 0x28]
mov eax, dword [eax]
test byte [eax + 3], 8
je 0x66020430
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x58]
test byte [eax + 0x99], 0x10
je 0x66020430
mov eax, dword [esi + 0x24]
test eax, 0x20000000
je 0x66020430
shr eax, 0x1d
and eax, 1
push 0x3000
push eax
push dword [ebp + 0xc]
call fcn.66079ff0
jmp 0x66020430
mov eax, dword [esi + 0x18c]
lea ecx, [esi + 0x18c]
test al, 0x10
je 0x66020462
and al, 0xef
mov dword [ecx], eax
jmp 0x66020573
mov edi, dword [sym.imp.USER32.dll_GetWindow]
push 5
push dword [ebp + 0xc]
call edi
mov ebx, eax
test ebx, ebx
je case.0x6603e18e.292
push 0
push 0
push 0x15
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
push 2
push ebx
jmp 0x6603dabd
mov esi, dword [esi + 0x30]
mov eax, dword [esi + 0x58]
test byte [eax + 0x99], 0x10
je 0x6603db00
mov eax, dword [esi + 0x2c]
push dword [ebp + 0x14]
push dword [eax + 0x34]
push dword [eax + 0x3c]
call fcn.6607a645
jmp 0x66020483
push 0
push dword [ebp + 0x14]
push 0x27
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_DefWindowProcA]
jmp 0x6602031a
push esi
call fcn.66070e12
jmp 0x6602056b
cmp dword [ebp + 0x14], 0
jne 0x660204a3
push dword [ebp + 0xc]
push esi
call fcn.66070e2b
jmp 0x6602031a
push 5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edi, dword [sym.imp.USER32.dll_GetWindow]
push eax
call edi
mov ebx, eax
test ebx, ebx
mov dword [ebp + 8], ebx
je 0x6603db7f
push 0xffffffffffffffec
push ebx
call dword [sym.imp.USER32.dll_GetWindowLongA]
test al, 8
je 0x6603db64
push 2
push ebx
jmp 0x6603db47
test ebx, ebx
je 0x6603db7f
push ebx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x6603db7f
push 2
push ebx
call edi
mov ebx, eax
mov dword [ebp + 8], ebx
jmp 0x6603db64
push 0
push ebx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, eax
call fcn.6601817b
cmp ebx, eax
je case.0x6603e18e.292
push 2
push dword [ebp + 8]
call edi
test eax, eax
mov dword [ebp + 8], eax
je 0x6603dbc6
push 0
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, eax
call fcn.6601817b
cmp ebx, eax
jne 0x6603db97
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x6603db97
cmp dword [ebp + 8], 0
je case.0x6603e18e.292
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x66020573
push esi
push dword [ebp + 0x14]
push 0x24
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_DefMDIChildProcA]
jmp 0x66020500
mov eax, dword [edi + 0x4e4]
test eax, eax
je 0x6603dc11
cmp dword [eax + 0x18], 0
je 0x6603dc11
push 0
call dword [sym.imp.USER32.dll_MessageBeep]
push 4
jmp 0x66020485
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x58]
test byte [eax + 0x99], 0x10
je case.0x6603e18e.292
mov edi, 0x105a
push 2
push edi
push edi
push dword [ebp + 0xc]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jne case.0x6603e18e.292
push eax
push eax
push edi
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_PostMessageA]
jmp case.0x6603e18e.292
push dword [esi + 0x134]
call fcn.660ce295
test eax, eax
jne 0x6602031a
push eax
push dword [esi + 0x28]
call fcn.660ce335
test eax, eax
je case.0x6603e18e.292
jmp 0x6602031a
mov eax, dword [esi + 0x28]
xor ebx, ebx
mov eax, dword [eax]
cmp byte [eax + 0x37], 0x1d
jne 0x6603dca1
mov eax, dword [esi + 0x194]
lea ecx, [esi + 0x194]
mov ebx, eax
shr ebx, 6
and ebx, 1
and al, 0xbf
mov dword [ecx], eax
mov eax, dword [ebp + 0x18]
cmp dword [eax + 4], 1
jne 0x6603dce5
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and eax, 1
mov dword [ebp + 8], eax
je 0x6603dcf2
xor eax, eax
push eax
push eax
push eax
mov eax, dword [ebp + 0x18]
push dword [eax + 0x18]
push dword [eax + 0x14]
call fcn.6602c055
mov edi, eax
mov eax, dword [esi + 0x30]
push edi
push dword [eax + 0xa0]
call fcn.66070b81
test eax, eax
jne 0x6603dd04
test ebx, ebx
je case.0x6603e18e.292
jmp 0x66020483
mov eax, dword [ebp + 0x18]
push 0
push dword [esi + 0x30]
push dword [eax + 0xc]
call fcn.6602371f
jmp 0x6603dcd0
test edi, edi
je 0x66020483
cmp dword [edi + 0xa0], 0
jne 0x6603dd2f
push edi
call fcn.6602a421
mov edi, eax
test edi, edi
je 0x66020483
cmp esi, edi
je 0x66020483
jmp 0x6603dd0c
lea eax, [ebp - 0x158]
push 0x104
push eax
push edi
call fcn.660715da
lea eax, [ebp - 0x1c]
push eax
push edi
call fcn.6606ee28
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
add eax, 0xf
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x158]
push dword [edi + 0xa0]
push 8
push eax
mov eax, dword [ebp + 0x18]
push dword [eax + 0xc]
call fcn.66015c61
jmp 0x66020483
je 0x6603ddb6
cmp ebx, 0xa1
jne case.0x6603e18e.292
push esi
call fcn.6607093c
test eax, eax
jne 0x6603ddac
cmp dword [ebp + 0x14], 2
jne 0x6603ddac
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x66020573
call fcn.6602a7bc
jmp case.0x6603e18e.292
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push esi
call fcn.66070eaa
test eax, eax
je 0x6603ddac
jmp 0x66020573
je 0x6603deb0
sub ebx, 0x116
je 0x6603e095
dec ebx
jne case.0x6603e18e.292
mov edi, dword [ebp + 0x14]
cmp edi, dword [esi + 0x150]
jne 0x6603ddfe
push edi
push dword [ebp + 0xc]
push esi
call fcn.6609455b
jmp 0x6602031a
mov eax, dword [esi + 0x30]
mov ecx, dword [ebp + 0xc]
mov eax, dword [eax + 0x2c]
cmp ecx, dword [eax + 0x38]
jne 0x6603de3c
push dword [eax + 0x3c]
call fcn.6606e409
mov ebx, eax
test ebx, ebx
je 0x6603de3c
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x2c]
push dword [eax + 0x3c]
call dword [sym.imp.USER32.dll_IsZoomed]
test eax, eax
je 0x6603de3c
cmp edi, dword [ebx + 0x150]
jne 0x6603de3c
push edi
push dword [ebx + 0x3c]
push ebx
jmp 0x6603ddf4
mov eax, dword [ebp - 4]
cmp dword [eax + 0x4cc], 0
je case.0x6603e18e.292
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x2c]
cmp dword [eax + 0x34], 0
je case.0x6603e18e.292
push dword [ebp + 0x14]
push esi
call fcn.66091db0
test eax, eax
jne 0x6603de8c
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x4d0]
test ecx, ecx
je 0x6603de84
push dword [ebp + 0x14]
push 0x66091d43
push ecx
call fcn.66092238
test eax, eax
je case.0x6603e18e.292
test byte [eax + 0xd0], 0x20
je case.0x6603e18e.292
push dword [ebp + 0x14]
push eax
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x2c]
push dword [eax + 0x34]
call fcn.660bf7c1
jmp case.0x6603e18e.292
and dword [edi + 0xa8], 0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x14]
mov dword [eax + 0x4c8], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x18]
mov dword [eax + 0x4c4], ecx
jmp case.0x6603e18e.292
je 0x6603ddac
cmp ebx, 0x120
jne case.0x6603e18e.292
mov eax, dword [esi + 0x30]
mov ecx, dword [eax + 0x58]
test byte [ecx + 0x99], 0x10
jne 0x6603df10
mov ecx, dword [eax + 0x2c]
cmp esi, dword [ecx + 0x34]
jne 0x6603df03
cmp byte [ebp + 0x14], 0x2d
je 0x6603df10
mov ecx, dword [ebp + 0x14]
shr ecx, 0x10
cmp cx, 0x2000
je 0x6603df63
mov eax, dword [eax + 0x2c]
cmp esi, dword [eax + 0x34]
jne case.0x6603e18e.292
cmp byte [ebp + 0x14], 0x2d
jne case.0x6603e18e.292
push dword [eax + 0x3c]
call fcn.6606e409
mov edi, eax
test edi, edi
je 0x6603df6d
mov eax, dword [edi + 0x3c]
test eax, eax
je case.0x6603e18e.292
test edi, edi
jne 0x6603df8f
push 0xfffffffffffffff0
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, 0x80000
jne 0x6603df87
mov eax, dword [ebp + 0x14]
shr eax, 0x10
cmp ax, 0x2000
jne case.0x6603e18e.292
mov eax, 0x10000
jmp 0x6602031a
mov eax, dword [esi + 0x30]
push 0
push 0
push 0x229
mov eax, dword [eax + 0x2c]
push dword [eax + 0x3c]
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x6603df37
test edi, edi
je case.0x6603e18e.292
test byte [edi + 0x138], 2
jmp 0x6603df5d
cmp ebx, 0x222
jne case.0x6603e18e.292
mov ecx, dword [edi + 0x4e4]
mov edi, dword [ebp + 0xc]
test ecx, ecx
je 0x6603dfc6
xor eax, eax
cmp dword [ebp + 0x18], edi
push 2
sete al
push eax
call fcn.660113d2
mov edx, 0x104b
cmp ebx, edx
je 0x6603dfd9
xor eax, eax
cmp dword [ebp + 0x18], edi
sete al
push eax
push esi
call fcn.660233e7
cmp dword [ebp + 0x18], edi
jne 0x6603e32c
mov eax, dword [esi + 0x30]
add eax, 0x1c
push eax
mov ecx, dword [eax]
call dword [ecx + 0x30]
push 1
push edi
jmp 0x66020364
push dword [ebp + 0xc]
push esi
call fcn.66023a97
jmp 0x660206f2
push eax
push esi
push dword [ebp + 0xc]
call fcn.660ce136
jmp 0x66020714
lea eax, [ebp + 0xc]
xor edi, edi
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x30]
push eax
push 5
push esi
mov dword [ebp + 0xc], edi
call fcn.66022982
cmp eax, 0x9c68
je 0x6603e03b
cmp word [ebp + 0xc], di
je 0x66020483
push edi
push dword [ebp + 0x18]
push esi
call fcn.660942cb
jmp 0x66020573
mov eax, dword [ebp + 0x18]
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x30]
push eax
push 3
push esi
call fcn.66022982
neg eax
sbb eax, eax
inc eax
jmp 0x6602031a
je 0x6603e0a0
sub eax, 3
je 0x6603e095
dec eax
jne case.0x6603e18e.292
push dword [ebp + 0xc]
call fcn.660225f8
test ax, ax
je case.0x6603e18e.292
mov eax, 0x180
jmp 0x6602031a
push esi
call fcn.6609472a
jmp case.0x6603e18e.292
push dword [ebp + 0x18]
push esi
call fcn.66086573
jmp 0x6602031a
cmp eax, 0x107
jne case.0x6603e18e.292
push dword [ebp + 0x18]
or byte [esi + 0x13b], 0x10
lea edi, [esi + 0x138]
push esi
call fcn.6608328e
and byte [edi + 3], 0xef
jmp 0x6602031a
mov ecx, 0x120
cmp eax, ecx
ja 0x6603e168
je 0x6603e123
sub eax, 0x10c
je 0x6603e115
dec eax
je 0x6603e107
dec eax
dec eax
jne case.0x6603e18e.292
push dword [ebp + 0x18]
push esi
call fcn.660930cf
jmp 0x6602031a
push dword [ebp + 0x18]
push esi
call fcn.66077c9a
jmp 0x6602031a
push dword [ebp + 0x18]
push esi
call fcn.66077ec5
jmp 0x6602031a
mov eax, dword [ebp + 0x18]
push ecx
fld dword [eax + 0x20]
fstp dword [esp]
fld dword [eax + 0x1c]
push ecx
fstp dword [esp]
fld dword [eax + 0x18]
push ecx
fstp dword [esp]
push dword [eax + 0x14]
fld dword [eax + 0x10]
push ecx
fstp dword [esp]
fld dword [eax + 0xc]
push ecx
fstp dword [esp]
fld dword [eax + 8]
mov ax, word [eax + 4]
push ecx
fstp dword [esp]
push eax
push esi
call fcn.66075c48
and eax, 0xffff
jmp 0x6602031a
mov ecx, 0x162
cmp eax, ecx
ja case.0x6603e18e.292
mov eax, dword [ebp + 0x14]
cmp eax, ecx
je 0x6603e275
add eax, 0xfffffedf
cmp eax, 0xb
ja case.0x6603e18e.292
jmp dword [eax*4 + 0x6603e6f4]
mov eax, dword [ebp + 0x18]
push dword [eax + 0x18]
fld dword [eax + 0x14]
push ecx
fstp dword [esp]
fld dword [eax + 0x10]
push ecx
fstp dword [esp]
fld dword [eax + 0xc]
push ecx
fstp dword [esp]
fld dword [eax + 8]
mov ax, word [eax + 4]
push ecx
fstp dword [esp]
push eax
push esi
call fcn.66076222
jmp 0x6603e15e
mov eax, dword [ebp + 0x18]
push dword [eax + 0x10]
fld dword [eax + 0xc]
push ecx
fstp dword [esp]
fld dword [eax + 8]
mov ax, word [eax + 4]
push ecx
fstp dword [esp]
push eax
push esi
call fcn.6607772b
jmp 0x6603e15e
push esi
call fcn.66076529
jmp 0x6602031a
push dword [ebp + 0x18]
push esi
call fcn.66076f63
jmp 0x6602031a
push dword [ebp + 0x18]
push esi
call fcn.66077060
jmp 0x6602031a
push dword [ebp + 0x18]
push esi
call fcn.6607799a
jmp 0x6602031a
push 1
push dword [ebp + 0x18]
push esi
call fcn.66077ba4
jmp 0x6602031a
push 0
jmp 0x6603e21f
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x66020573
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x66020573
test byte [esi + 0x139], 0x40
je 0x66020573
mov eax, dword [esi + 0x28]
push 0
push 0xf180
push 0x112
push dword [esi + 0x3c]
mov eax, dword [eax]
push esi
call dword [eax + 0x10]
jmp 0x66020573
mov eax, dword [esi + 0x30]
push 0
push dword [eax + 0x74]
call fcn.66079a4c
neg eax
sbb eax, eax
and eax, 0x7ff5fe84
add eax, 0x800a017c
jmp 0x6602031a
mov edi, dword [ebp + 0x18]
mov ebx, dword [sym.imp.GDI32.dll_OffsetWindowOrgEx]
push 0
mov eax, dword [edi + 8]
mov ecx, dword [eax + 4]
mov eax, dword [eax]
neg ecx
neg eax
push ecx
push eax
push dword [ebp + 0x14]
call ebx
mov ecx, dword [edi + 0xc]
test ecx, ecx
je 0x6603e2cf
mov eax, dword [edi + 8]
mov edx, dword [eax + 4]
mov eax, dword [eax]
neg edx
neg eax
push edx
push eax
push ecx
call dword [sym.imp.USER32.dll_OffsetRect]
push 0
push dword [edi + 0xc]
push 0x16
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push esi
call fcn.66026a0e
mov ecx, dword [edi + 0xc]
test ecx, ecx
je 0x6603e2f8
mov eax, dword [edi + 8]
push dword [eax + 4]
push dword [eax]
push ecx
call dword [sym.imp.USER32.dll_OffsetRect]
mov edi, dword [edi + 8]
push 0
push dword [edi + 4]
push dword [edi]
push dword [ebp + 0x14]
call ebx
jmp 0x66020573
je 0x6603dfa4
cmp ebx, 0x1046
jne case.0x6603e18e.292
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_SetActiveWindow]
jmp case.0x6603e18e.292
push dword [ebp + 0x18]
push 1
jmp 0x6602036e
cmp ebx, 0x1056
jne case.0x6603e18e.292
mov eax, dword [esi + 0x30]
mov ecx, dword [eax + 0x58]
test byte [ecx + 0x99], 0x10
je 0x6603e3a5
mov eax, dword [eax + 0x2c]
mov edi, 0xffbfffff
mov eax, dword [eax + 0x34]
cmp esi, dword [eax + 0x190]
jne 0x6603e388
cmp dword [0x6610e7b4], 0
je 0x6603e388
mov ecx, dword [eax + 0x24]
shr ecx, 0x1d
and ecx, 1
push ecx
push dword [eax + 0x154]
call fcn.6609484e
and dword [esi + 0x138], edi
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x2c]
mov eax, dword [eax + 0x34]
push dword [eax + 0x3c]
call dword [sym.imp.USER32.dll_DrawMenuBar]
and dword [esi + 0x138], edi
jmp 0x66020573
cmp dword [0x6610e7b4], 0
mov edi, 0xffbfffff
je 0x6603e3d3
mov eax, dword [esi + 0x154]
test eax, eax
je 0x6603e3cd
mov ecx, dword [esi + 0x24]
shr ecx, 0x1d
and ecx, 1
push ecx
push eax
call fcn.6609484e
and dword [esi + 0x138], edi
push dword [ebp + 0xc]
jmp 0x6603e394
sub ebx, 0x21
je 0x6603e489
sub ebx, 0xa
je 0x6603e40f
dec ebx
dec ebx
jne case.0x6603e18e.292
push dword [ebp + 0xc]
push esi
call fcn.6602293f
test eax, eax
jne 0x66020573
push dword [ebp + 0x14]
push dword [ebp + 0x18]
call fcn.660c93f3
jmp 0x6602031a
push dword [ebp + 0xc]
push esi
call fcn.6602293f
test eax, eax
jne 0x66020573
mov ecx, dword [ebp + 0x14]
test ch, 0x80
je 0x6603e47c
mov edi, dword [ebp + 0x18]
sub ecx, 0x8006
je 0x6603e474
sub ecx, 5
je 0x6603e46c
dec ecx
jne 0x6603e441
push edi
call fcn.660c8e1f
test eax, eax
je 0x66020573
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x30]
push eax
mov eax, dword [esi + 0x28]
movzx eax, byte [eax + 0xf8]
push eax
push edi
call fcn.66022982
jmp 0x66020573
push edi
call fcn.660c8925
jmp 0x6603e441
push edi
call fcn.660c8ac7
jmp 0x6603e441
lea eax, [ebp - 0x54]
push eax
movzx eax, cx
push eax
push dword [ebp + 0x18]
jmp 0x6603e462
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x34]
mov eax, dword [eax + 0x4bc]
jmp 0x6602031a
push esi
call fcn.6607095f
jmp 0x66020630
mov eax, 0x16c
jmp 0x6602031a
mov eax, dword [ebp + 0x14]
neg eax
sbb eax, eax
and eax, 5
push eax
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x66020573
mov eax, dword [eax + 0x2c]
mov ebx, dword [eax + 0x34]
push ebx
call fcn.6609472a
mov eax, dword [esi + 0x154]
lea edi, [esi + 0x154]
test eax, eax
je 0x6603e4ee
push eax
call dword [sym.imp.USER32.dll_DestroyMenu]
and dword [edi], 0
add ebx, 0x194
cmp dword [ebx], esi
jne 0x6602079a
and dword [ebx], 0
jmp 0x6602079a
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
and dword [edi], 0
jmp 0x660207ae
mov eax, dword [edi + 4]
test eax, eax
mov dword [ebp - 8], eax
je 0x660207c2
and dword [ebp + 8], 0
cmp word [edi], 0
jbe 0x6603e560
mov eax, dword [eax]
test eax, eax
je 0x6603e537
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
movzx eax, word [ebp + 8]
mov ecx, dword [edi + 8]
add dword [ebp - 8], 4
mov eax, dword [ecx + eax*4]
test eax, eax
je 0x6603e554
push eax
push 0
push dword [0x6610e6c0]
call ebx
inc dword [ebp + 8]
mov ax, word [ebp + 8]
cmp ax, word [edi]
jb 0x6603e5af
push dword [edi + 8]
push 0
push dword [0x6610e6c0]
call ebx
push dword [edi + 0xc]
push 0
push dword [0x6610e6c0]
call ebx
push dword [edi + 0x10]
push 0
push dword [0x6610e6c0]
call ebx
push dword [edi + 4]
xor edi, edi
push edi
push dword [0x6610e6c0]
call ebx
push dword [esi + 0x188]
push edi
push dword [0x6610e6c0]
call ebx
mov dword [esi + 0x188], edi
jmp 0x660207c2
mov eax, dword [ebp - 8]
jmp 0x6603e52b
mov eax, dword [ebp - 4]
dec dword [eax + 0x38c]
jmp 0x66020839
mov eax, dword [ebp - 4]
inc dword [eax + 0x38c]
jmp 0x6602084e
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x20]
shr eax, 0x14
test al, 1
je 0x66020317
jmp 0x6602085f
push dword [ebp + 0x14]
push esi
call fcn.66070f10
jmp 0x66020317
push ecx
push 0xfffffffffffffff0
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_SetWindowLongA]
jmp 0x66020317
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_UpdateWindow]
jmp 0x66020317
mov eax, dword [esi + 0x28]
mov eax, dword [eax]
cmp byte [eax + 0x37], 0x11
je 0x6603e634
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x58]
test byte [eax + 0x99], 0x10
je 0x66020872
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 0x2c]
mov eax, dword [eax + 0x38]
test eax, eax
je 0x66020872
push eax
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x66020872
mov eax, dword [esi + 0x30]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
mov ebx, 0x86
mov eax, dword [eax + 0x2c]
mov ecx, dword [eax + 0x34]
mov ecx, dword [ecx + 0x138]
not ecx
shr ecx, 0x19
and ecx, 1
push ecx
push ebx
push dword [eax + 0x38]
call edi
mov eax, dword [esi + 0x30]
push 0
mov eax, dword [eax + 0x2c]
mov ecx, dword [eax + 0x34]
mov ecx, dword [ecx + 0x138]
shr ecx, 0x19
and ecx, 1
push ecx
push ebx
push dword [eax + 0x38]
call edi
jmp 0x66020872
test byte [esi + 0x24], 2
je 0x66020317
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
jne 0x66020317
push dword [ebp + 0xc]
call fcn.660710ab
jmp 0x66020317
mov eax, dword [ebp - 4]
cmp dword [eax + 0x4d8], 0
je 0x66020573
push dword [ebp + 0x14]
push dword [ebp + 0x18]
call fcn.66091e41
mov eax, dword [ebp - 4]
and dword [eax + 0x4d8], 0
jmp 0x66020573