Function at 0x40b62f
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
sub esp, 0x84
lea ebp, [esp - 4]
mov eax, dword [0x472940]
xor eax, ebp
mov dword [ebp + 0x84], eax
push 0x68
mov eax, 0x45a10c
call fcn.00446874
mov eax, dword [ebp + 0x94]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x98]
mov ebx, ecx
cmp dword [ebx], 0
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x9c]
mov dword [ebp - 0x68], eax
je 0x40c745
lea ecx, [ebx + 0x100]
mov dword [ebp - 0x44], ecx
jmp 0x40b6f7
mov ecx, dword [ebp - 0x44]
push 0
call fcn.0040cba7
lea edi, [esi + 0x88]
mov eax, dword [edi]
test eax, eax
je 0x40b6b1
lea ecx, [eax + 0x34]
call fcn.004160ae
test al, al
je 0x40b6b1
mov ecx, dword [edi]
push esi
add ecx, 0x34
call fcn.0041610a
and dword [ebp - 0x14], 0
lea edi, [ebx + 0xb8]
mov ecx, edi
call fcn.004212ae
test eax, eax
jle 0x40b6e6
push dword [ebp - 0x14]
mov ecx, edi
call fcn.0040cc1b
mov edx, dword [eax]
push esi
mov ecx, eax
call dword [edx]
inc dword [ebp - 0x14]
mov ecx, edi
call fcn.004212ae
cmp dword [ebp - 0x14], eax
jl 0x40b6c6
mov ecx, esi
call fcn.00409820
push esi
call fcn.004367bb
pop ecx
mov ecx, dword [ebp - 0x44]
push 0
call fcn.0040cc02
mov esi, eax
test esi, esi
jne 0x40b684
and dword [ebp - 0x14], eax
lea edi, [ebx + 0xdc]
mov ecx, edi
call fcn.004212ae
mov esi, dword [ebp + 0x90]
test eax, eax
jle 0x40b756
push dword [ebp - 0x14]
mov ecx, edi
mov byte [ebp - 0x3d], 0
call fcn.0040cc1b
mov edx, dword [eax]
lea ecx, [ebp - 0x3d]
push ecx
push dword [ebp - 0x10]
mov ecx, eax
push dword [ebp - 0x1c]
push esi
call dword [edx]
cmp byte [ebp - 0x3d], 0
jne 0x40b7e0
inc dword [ebp - 0x14]
mov ecx, edi
call fcn.004212ae
cmp dword [ebp - 0x14], eax
jl 0x40b71e
mov eax, 0x113
cmp esi, eax
ja 0x40bf8d
je 0x40bf06
cmp esi, 0x4e
ja 0x40bd69
je 0x40bd48
mov eax, esi
sub eax, 5
je 0x40bcfe
push 0xa
pop esi
sub eax, esi
je 0x40b922
dec eax
je 0x40b8a2
sub eax, 4
je 0x40b894
sub eax, 0xc
je 0x40b7ec
sub eax, 4
jne 0x40c6bc
mov eax, dword [ebx + 0x6c]
mov ecx, dword [ebp - 0x10]
test eax, eax
jle 0x40b7b9
mov dword [ecx + 0x18], eax
mov eax, dword [ebx + 0x70]
test eax, eax
jle 0x40b7c3
mov dword [ecx + 0x1c], eax
mov eax, dword [ebx + 0x74]
test eax, eax
jle 0x40b7cd
mov dword [ecx + 0x20], eax
mov eax, dword [ebx + 0x78]
test eax, eax
jle 0x40c6bc
mov dword [ecx + 0x24], eax
jmp 0x40c6bc
mov ecx, dword [ebp - 0x68]
mov dword [ecx], eax
mov al, 1
jmp 0x40c747
cmp word [ebp - 0x10], 1
jne 0x40c6bc
cmp byte [ebx + 0xb6], 0
jne 0x40b7e5
and dword [ebp - 0x4c], 0
xor eax, eax
lea edi, [ebp - 0x48]
stosd dword es:[edi], eax
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [ebp - 0x4c]
push eax
push dword [ebx]
call dword [sym.imp.USER32.dll_ScreenToClient]
push dword [ebp - 0x48]
mov ecx, ebx
push dword [ebp - 0x4c]
call fcn.0040af8c
mov esi, eax
test esi, esi
je 0x40c6bc
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
test al, 2
je 0x40c6bc
xor eax, eax
push 7
pop ecx
lea edi, [ebp + 0x24]
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp + 0x38], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp + 0x3c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp + 0x2c], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp + 0x20], 0x17
mov dword [ebp + 0x30], eax
call fcn.004097cd
mov word [ebp + 0x36], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [ebp + 0x20]
mov dword [ebp + 0x28], eax
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 0x108]
jmp 0x40b7e5
mov eax, dword [ebp - 0x68]
mov dword [eax], 1
jmp 0x40b7e5
and dword [ebp - 0x3c], 0
push 7
xor eax, eax
pop ecx
lea edi, [ebp - 0x38]
rep stosd dword es:[edi], eax
mov eax, dword [ebx + 0x64]
mov dword [ebp - 0x30], eax
mov eax, dword [ebx + 0x68]
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebx + 0x58]
mov dword [ebp - 0x34], eax
test ecx, ecx
je 0x40b8de
lea edx, [ebp - 0x3c]
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], ecx
mov eax, dword [ecx]
push edx
call dword [eax + 0x108]
mov ecx, dword [ebx + 0x5c]
test ecx, ecx
je 0x40b8fb
lea edx, [ebp - 0x3c]
mov dword [ebp - 0x3c], 0xe
mov dword [ebp - 0x38], ecx
mov eax, dword [ecx]
push edx
call dword [eax + 0x108]
push 0
mov ecx, ebx
call fcn.0040b1d1
push 4
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindow]
test eax, eax
je 0x40c6bc
push eax
call dword [sym.imp.USER32.dll_SetFocus]
jmp 0x40c6bc
and dword [ebp - 0x64], 0
xor eax, eax
lea edi, [ebp - 0x60]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor esi, esi
push esi
lea eax, [ebp - 0x64]
push eax
push dword [ebx]
call dword [sym.imp.USER32.dll_GetUpdateRect]
test eax, eax
je 0x40b7e5
cmp dword [ebx + 0x50], esi
jne 0x40b979
push 0x3c
lea eax, [ebp + 4]
push esi
push eax
mov dword [ebp], esi
call fcn.00445f90
add esp, 0xc
lea eax, [ebp]
push eax
push dword [ebx]
call dword [sym.imp.USER32.dll_BeginPaint]
lea eax, [ebp]
push eax
push dword [ebx]
call dword [sym.imp.USER32.dll_EndPaint]
jmp 0x40b7e5
cmp byte [ebx + 0xb1], 0
je 0x40ba7a
and dword [ebp - 0x74], 0
xor eax, eax
lea edi, [ebp - 0x70]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x74]
push eax
push dword [ebx]
mov byte [ebx + 0xb1], 0
call dword [sym.imp.USER32.dll_GetClientRect]
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
jne 0x40ba7a
mov ecx, dword [ebx + 0x50]
call fcn.0040f8c4
mov ecx, dword [ebx + 0x50]
test al, al
mov eax, dword [ecx]
je 0x40ba3f
sub esp, 0x10
mov edi, esp
lea esi, [ebp - 0x74]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [eax + 0x34]
mov eax, dword [ebx + 0xc]
mov esi, dword [sym.imp.GDI32.dll_DeleteDC]
test eax, eax
je 0x40b9e7
push eax
call esi
mov eax, dword [ebx + 0x10]
xor edi, edi
cmp eax, edi
je 0x40b9f3
push eax
call esi
mov eax, dword [ebx + 0x14]
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
cmp eax, edi
je 0x40ba03
push eax
call esi
mov eax, dword [ebx + 0x18]
cmp eax, edi
je 0x40ba0d
push eax
call esi
mov dword [ebx + 0xc], edi
mov dword [ebx + 0x10], edi
mov dword [ebx + 0x14], edi
mov dword [ebx + 0x18], edi
jmp 0x40ba58
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx]
mov dword [ebp - 0x44], eax
call dword [eax + 0x30]
mov ecx, dword [ebp - 0x14]
sub esp, 0x10
mov esi, eax
mov eax, dword [ebp - 0x44]
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call dword [eax + 0x34]
mov ecx, dword [ebx + 0x50]
mov eax, dword [ecx]
push SysReAllocStringLen
push 0
push 0x40a666
call dword [eax + 0xfc]
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x40ba1b
lea eax, [ebx + 0xb0]
cmp byte [eax], 0
je 0x40ba7a
mov byte [eax], 0
xor eax, eax
push eax
push eax
push eax
push str.windowinit
push dword [ebx + 0x50]
mov ecx, ebx
call fcn.0040abeb
cmp byte [ebx + 0xb2], 0
je 0x40ba8c
push 1
mov ecx, ebx
call fcn.0040b369
xor esi, esi
cmp byte [ebx + 0xb3], 0
je 0x40bad9
cmp dword [ebx + 0x14], esi
jne 0x40bad9
xor eax, eax
mov dword [ebp - 0x54], esi
lea edi, [ebp - 0x50]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x54]
push eax
push dword [ebx]
call dword [sym.imp.USER32.dll_GetClientRect]
push dword [ebx + 8]
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [ebx + 0xc], eax
mov eax, dword [ebp - 0x48]
sub eax, dword [ebp - 0x50]
push eax
mov eax, dword [ebp - 0x4c]
sub eax, dword [ebp - 0x54]
push eax
push dword [ebx + 8]
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [ebx + 0x14], eax
xor eax, eax
mov dword [ebp - 0x2c], esi
lea edi, [ebp - 0x28]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebx]
call dword [sym.imp.USER32.dll_GetClientRect]
push 0x3c
lea eax, [ebp + 0x48]
push esi
push eax
mov dword [ebp + 0x44], esi
call fcn.00445f90
add esp, 0xc
lea eax, [ebp + 0x44]
push eax
push dword [ebx]
call dword [sym.imp.USER32.dll_BeginPaint]
cmp byte [ebx + 0xb3], 0
je 0x40bcb9
push dword [ebx + 0x14]
mov esi, dword [sym.imp.GDI32.dll_SelectObject]
push dword [ebx + 0xc]
call esi
push dword [ebx + 0xc]
mov dword [ebp - 0x68], eax
call dword [sym.imp.GDI32.dll_SaveDC]
cmp byte [ebx + 0xb4], 0
mov dword [ebp - 0x44], eax
je 0x40bbeb
mov eax, dword [ebx + 0x18]
test eax, eax
jne 0x40bbba
and dword [ebp - 0x54], eax
lea edi, [ebp - 0x50]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x54]
push eax
push dword [ebx]
call dword [sym.imp.USER32.dll_GetClientRect]
push dword [ebx + 8]
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [ebx + 0x10], eax
mov eax, dword [ebp - 0x48]
sub eax, dword [ebp - 0x50]
push eax
mov eax, dword [ebp - 0x4c]
sub eax, dword [ebp - 0x54]
push eax
push dword [ebx + 8]
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
push dword [ebx + 0x10]
mov dword [ebx + 0x18], eax
call esi
mov eax, dword [ebp + 0x58]
sub eax, dword [ebp + 0x50]
push 0xcc0020
push dword [ebp + 0x50]
push dword [ebp + 0x4c]
push dword [ebp + 0x44]
push eax
mov eax, dword [ebp + 0x54]
sub eax, dword [ebp + 0x4c]
push eax
push dword [ebp + 0x50]
push dword [ebp + 0x4c]
push dword [ebx + 0x10]
call dword [sym.imp.GDI32.dll_BitBlt]
jmp 0x40bbc0
push eax
push dword [ebx + 0x10]
call esi
mov eax, dword [ebp + 0x58]
sub eax, dword [ebp + 0x50]
push 0xcc0020
push dword [ebp + 0x50]
push dword [ebp + 0x4c]
push dword [ebx + 0x10]
push eax
mov eax, dword [ebp + 0x54]
sub eax, dword [ebp + 0x4c]
push eax
push dword [ebp + 0x50]
push dword [ebp + 0x4c]
push dword [ebx + 0xc]
call dword [sym.imp.GDI32.dll_BitBlt]
mov ecx, dword [ebx + 0x50]
mov eax, dword [ecx]
lea edx, [ebp + 0x4c]
push edx
push dword [ebx + 0xc]
call dword [eax + 0x118]
and dword [ebp - 0x14], 0
lea edi, [ebx + 0xe8]
mov ecx, edi
call fcn.004212ae
test eax, eax
jle 0x40bc3c
push dword [ebp - 0x14]
mov ecx, edi
call fcn.0040cc1b
mov edx, dword [eax]
lea ecx, [ebp + 0x4c]
push ecx
push dword [ebx + 0xc]
mov ecx, eax
call dword [edx + 0x130]
inc dword [ebp - 0x14]
mov ecx, edi
call fcn.004212ae
cmp dword [ebp - 0x14], eax
jl 0x40bc12
push dword [ebp - 0x44]
push dword [ebx + 0xc]
call dword [sym.imp.GDI32.dll_RestoreDC]
mov eax, dword [ebp + 0x58]
sub eax, dword [ebp + 0x50]
push 0xcc0020
push dword [ebp + 0x50]
push dword [ebp + 0x4c]
push dword [ebx + 0xc]
push eax
mov eax, dword [ebp + 0x54]
sub eax, dword [ebp + 0x4c]
push eax
push dword [ebp + 0x50]
push dword [ebp + 0x4c]
push dword [ebp + 0x44]
call dword [sym.imp.GDI32.dll_BitBlt]
push dword [ebp - 0x68]
push dword [ebx + 0xc]
call esi
cmp byte [ebx + 0x4c], 0
je 0x40bce0
push dword [0x473d80]
push dword [ebp + 0x44]
call esi
push 5
mov edi, eax
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
push dword [ebp + 0x44]
call esi
push dword [ebp - 0x58]
push dword [ebp - 0x5c]
push dword [ebp - 0x60]
push dword [ebp - 0x64]
push dword [ebp + 0x44]
call dword [sym.imp.GDI32.dll_Rectangle]
push edi
push dword [ebp + 0x44]
call esi
jmp 0x40bce0
push dword [ebp + 0x44]
call dword [sym.imp.GDI32.dll_SaveDC]
mov ecx, dword [ebx + 0x50]
lea edx, [ebp + 0x4c]
push edx
push dword [ebp + 0x44]
mov esi, eax
mov eax, dword [ecx]
call dword [eax + 0x118]
push esi
push dword [ebp + 0x44]
call dword [sym.imp.GDI32.dll_RestoreDC]
cmp byte [ebx + 0xb1], 0
je 0x40b7e5
push 0
push 0
push dword [ebx]
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x40b7e5
mov edx, dword [ebx + 0x54]
test edx, edx
je 0x40bd31
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x38]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x3c], 0x16
mov dword [ebp - 0x38], edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebx + 0x54]
lea edx, [ebp - 0x3c]
mov dword [ebp - 0x34], eax
mov eax, dword [ecx]
push edx
call dword [eax + 0x108]
mov ebx, dword [ebx + 0x50]
test ebx, ebx
je 0x40b7e5
mov ecx, ebx
call fcn.0040f8cb
jmp 0x40b7e5
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x40b7e5
push eax
push dword [ebp - 0x1c]
push 0x204e
push dword [eax]
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x40b7e0
sub esi, 0x7b
je 0x40be9a
sub esi, 0x85
je 0x40be41
dec esi
je 0x40bdea
dec esi
je 0x40bda6
sub esi, 0xf
jne 0x40c6bc
cmp dword [ebp - 0x10], esi
je 0x40c6bc
push dword [ebp - 0x10]
push dword [ebp - 0x1c]
push 0x2111
push dword [ebp - 0x10]
jmp 0x40bd5e
cmp dword [ebx + 0x54], 0
je 0x40c6bc
xor eax, eax
push 7
pop ecx
lea edi, [ebp - 0x38]
rep stosd dword es:[edi], eax
mov al, byte [ebp - 0x1c]
mov byte [ebp - 0x28], al
mov eax, dword [ebx + 0x64]
mov dword [ebp - 0x30], eax
mov eax, dword [ebx + 0x68]
mov dword [ebp - 0x3c], 5
mov dword [ebp - 0x2c], eax
call fcn.004097cd
mov word [ebp - 0x26], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebx + 0x54]
jmp 0x40bf79
cmp dword [ebx + 0x60], 0
je 0x40c6bc
xor eax, eax
push 7
pop ecx
lea edi, [ebp - 0x38]
rep stosd dword es:[edi], eax
mov al, byte [ebp - 0x1c]
mov byte [ebp - 0x28], al
mov eax, dword [ebx + 0x64]
mov dword [ebp - 0x30], eax
mov eax, dword [ebx + 0x68]
mov dword [ebp - 0x3c], 4
mov dword [ebp - 0x2c], eax
call fcn.004097cd
mov word [ebp - 0x26], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebx + 0x60]
lea edx, [ebp - 0x3c]
mov dword [ebp - 0x34], eax
mov eax, dword [ecx]
push edx
call dword [eax + 0x108]
and dword [ebx + 0x60], 0
jmp 0x40c6bc
cmp dword [ebx + 0x54], 0
je 0x40c6bc
xor eax, eax
push 7
pop ecx
lea edi, [ebp - 0x38]
rep stosd dword es:[edi], eax
mov al, byte [ebp - 0x1c]
mov byte [ebp - 0x28], al
mov eax, dword [ebx + 0x64]
mov dword [ebp - 0x30], eax
mov eax, dword [ebx + 0x68]
mov dword [ebp - 0x3c], 3
mov dword [ebp - 0x2c], eax
call fcn.004097cd
mov word [ebp - 0x26], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebx + 0x54]
lea edx, [ebp - 0x3c]
mov dword [ebp - 0x34], eax
mov eax, dword [ecx]
push edx
call dword [eax + 0x108]
mov eax, dword [ebx + 0x54]
mov dword [ebx + 0x60], eax
jmp 0x40c6bc
mov eax, dword [ebp - 0x10]
movsx ecx, ax
shr eax, 0x10
cwde
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push eax
push dword [ebx]
mov dword [ebp - 0x18], ecx
call dword [sym.imp.USER32.dll_ScreenToClient]
cmp dword [ebx + 0x5c], 0
mov eax, dword [ebp - 0x18]
mov dword [ebx + 0x64], eax
mov eax, dword [ebp - 0x14]
mov dword [ebx + 0x68], eax
je 0x40c6bc
mov ecx, ebx
call fcn.00409dad
push 7
xor eax, eax
pop ecx
lea edi, [ebp - 0x38]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebx + 0x5c]
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x2c], ecx
mov cx, word [ebp - 0x1c]
mov dword [ebp - 0x3c], 0x11
mov dword [ebp - 0x38], eax
mov word [ebp - 0x26], cx
mov dword [ebp - 0x20], eax
jmp 0x40c0b9
and dword [ebp - 0x14], 0
lea edi, [ebx + 0xc4]
mov ecx, edi
call fcn.004212ae
test eax, eax
jle 0x40c6bc
push dword [ebp - 0x14]
mov ecx, edi
call fcn.0040cc1b
mov esi, eax
mov eax, dword [esi + 8]
cmp eax, dword [ebx]
jne 0x40bf41
movzx eax, word [ebp - 0x1c]
cmp dword [esi + 0xc], eax
jne 0x40bf41
cmp byte [esi + 0x10], 0
je 0x40bf55
inc dword [ebp - 0x14]
mov ecx, edi
call fcn.004212ae
cmp dword [ebp - 0x14], eax
jl 0x40bf1f
jmp 0x40c6bc
push 7
xor eax, eax
pop ecx
lea edi, [ebp - 0x38]
rep stosd dword es:[edi], eax
mov eax, dword [esi]
mov dword [ebp - 0x38], eax
mov eax, dword [esi + 4]
mov dword [ebp - 0x3c], 0x18
mov dword [ebp - 0x24], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi]
mov dword [ebp - 0x34], eax
mov eax, dword [ecx]
lea edx, [ebp - 0x3c]
push edx
call dword [eax + 0x108]
jmp 0x40c6bc
mov eax, 0x204
cmp esi, eax
ja 0x40c350
je 0x40c2ce
mov eax, esi
sub eax, 0x133
je 0x40c2b2
sub eax, 5
je 0x40c2b2
sub eax, 0xc8
je 0x40c16f
dec eax
je 0x40c0da
dec eax
je 0x40c064
dec eax
jne 0x40c6bc
push dword [ebx]
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [ebp - 0x10]
movsx ecx, ax
shr eax, 0x10
cwde
push eax
mov dword [ebp - 0x18], ecx
mov dword [ebx + 0x64], ecx
push ecx
mov ecx, ebx
mov dword [ebp - 0x14], eax
mov dword [ebx + 0x68], eax
call fcn.0040af8c
mov esi, eax
test esi, esi
je 0x40c6bc
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c]
cmp eax, ebx
jne 0x40c6bc
mov ecx, ebx
call fcn.00409d99
xor eax, eax
push 7
pop ecx
lea edi, [ebp - 0x38]
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2c], eax
mov ax, word [ebp - 0x1c]
mov dword [ebp - 0x3c], 0x10
mov dword [ebp - 0x38], esi
mov word [ebp - 0x26], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x34], eax
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 0x108]
mov dword [ebx + 0x5c], esi
jmp 0x40c6bc
mov eax, dword [ebp - 0x10]
movsx esi, word [ebp - 0x10]
shr eax, 0x10
cmp dword [ebx + 0x5c], 0
cwde
mov dword [ebp - 0x48], eax
mov dword [ebx + 0x64], esi
mov dword [ebx + 0x68], eax
je 0x40c6bc
mov ecx, ebx
call fcn.00409dad
push 7
xor eax, eax
pop ecx
lea edi, [ebp - 0x38]
rep stosd dword es:[edi], eax
mov eax, dword [ebx + 0x5c]
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x48]
mov dword [ebp - 0x3c], 0xe
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], ecx
mov word [ebp - 0x26], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebx + 0x5c]
lea edx, [ebp - 0x3c]
mov dword [ebp - 0x34], eax
mov eax, dword [ecx]
push edx
call dword [eax + 0x108]
and dword [ebx + 0x5c], 0
jmp 0x40c6bc
push dword [ebx]
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [ebp - 0x10]
movsx eax, word [ebp - 0x10]
shr ecx, 0x10
movsx ecx, cx
push ecx
mov dword [ebp - 0x14], ecx
mov dword [ebx + 0x68], ecx
push eax
mov ecx, ebx
mov dword [ebp - 0x18], eax
mov dword [ebx + 0x64], eax
call fcn.0040af8c
mov esi, eax
test esi, esi
je 0x40c6bc
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c]
cmp eax, ebx
jne 0x40c6bc
mov dword [ebx + 0x5c], esi
mov eax, dword [esi]
mov ecx, esi
call dword [eax + pe_nt_image_headers32]
mov ecx, ebx
call fcn.00409d99
push 7
xor eax, eax
pop ecx
lea edi, [ebp - 0x38]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x3c], 0xd
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x2c], ecx
mov word [ebp - 0x26], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x34], eax
jmp 0x40c2a5
cmp byte [ebx + 0xb5], 0
jne 0x40c1c5
xor eax, eax
lea edi, [ebp - 0x60]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebx]
push 3
mov dword [ebp - 0x5c], eax
mov eax, dword [ebx + 0x1c]
pop ecx
mov dword [ebp - 0x64], 0x10
mov dword [ebp - 0x60], ecx
test eax, eax
jne 0x40c1a2
mov dword [ebp - 0x58], 0x190
jmp 0x40c1b4
push 0
push ecx
push 0x415
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.COMCTL32.dll__TrackMouseEvent]
mov byte [ebx + 0xb5], 1
mov eax, dword [ebp - 0x10]
movsx esi, ax
shr eax, 0x10
cwde
push eax
push esi
mov ecx, ebx
mov dword [ebp - 0x68], eax
mov dword [ebx + 0x64], esi
mov dword [ebx + 0x68], eax
call fcn.0040af8c
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40c1f7
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x1c]
cmp eax, ebx
jne 0x40c6bc
and dword [ebp - 0x3c], 0
push 7
xor eax, eax
pop ecx
lea edi, [ebp - 0x38]
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebx + 0x58]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x14], ecx
je 0x40c256
test ecx, ecx
je 0x40c256
lea edx, [ebp - 0x3c]
mov dword [ebp - 0x3c], 0xa
mov dword [ebp - 0x38], ecx
mov eax, dword [ecx]
push edx
call dword [eax + 0x108]
mov eax, dword [ebx + 0x1c]
and dword [ebx + 0x58], 0
test eax, eax
je 0x40c256
lea ecx, [ebx + 0x20]
push ecx
push 0
push 0x411
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov esi, dword [ebp - 0x14]
cmp esi, dword [ebx + 0x58]
je 0x40c27d
test esi, esi
je 0x40c27d
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x3c], 0xb
mov dword [ebp - 0x38], esi
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 0x108]
mov dword [ebx + 0x58], esi
mov ecx, dword [ebx + 0x5c]
test ecx, ecx
je 0x40c293
mov dword [ebp - 0x3c], 9
mov dword [ebp - 0x38], ecx
jmp 0x40bf7c
test esi, esi
je 0x40c6bc
mov dword [ebp - 0x3c], 9
mov dword [ebp - 0x38], esi
mov eax, dword [esi]
lea ecx, [ebp - 0x3c]
push ecx
mov ecx, esi
jmp 0x40bf82
cmp dword [ebp - 0x10], 0
je 0x40c6bc
push dword [ebp - 0x10]
add esi, 0x2000
push dword [ebp - 0x1c]
push esi
jmp 0x40bda1
push dword [ebx]
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [ebp - 0x10]
movsx eax, word [ebp - 0x10]
shr ecx, 0x10
movsx ecx, cx
push ecx
mov dword [ebp - 0x14], ecx
mov dword [ebx + 0x68], ecx
push eax
mov ecx, ebx
mov dword [ebp - 0x18], eax
mov dword [ebx + 0x64], eax
call fcn.0040af8c
mov esi, eax
test esi, esi
je 0x40c6bc
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c]
cmp eax, ebx
jne 0x40c6bc
mov eax, dword [esi]
mov ecx, esi
call dword [eax + pe_nt_image_headers32]
mov ecx, ebx
call fcn.00409d99
push 7
xor eax, eax
pop ecx
lea edi, [ebp - 0x38]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x3c], 0xf
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x2c], ecx
jmp 0x40c03e
sub esi, 0x20a
je 0x40c611
sub esi, 0x97
je 0x40c4b4
dec esi
dec esi
je 0x40c479
sub esi, 0x75
je 0x40c3c0
sub esi, 0x7ce9
jne 0x40c6bc
lea esi, [ebx + 0xf4]
mov ecx, esi
xor edi, edi
call fcn.004212ae
test eax, eax
jle 0x40c3b4
push edi
mov ecx, esi
call fcn.0040cc1b
test eax, eax
je 0x40c3a8
mov edx, dword [eax]
push 1
mov ecx, eax
call dword [edx]
mov ecx, esi
inc edi
call fcn.004212ae
cmp edi, eax
jl 0x40c394
mov ecx, esi
call fcn.0040ca75
jmp 0x40c6bc
lea eax, [ebp - 0x2c]
push eax
push dword [ebx]
call dword [sym.imp.USER32.dll_GetClientRect]
push dword [ebp - 0x1c]
call dword [sym.imp.GDI32.dll_SaveDC]
mov ecx, dword [ebx + 0x50]
lea edx, [ebp - 0x2c]
push edx
push dword [ebp - 0x1c]
mov dword [ebp - 0x68], eax
mov eax, dword [ecx]
call dword [eax + 0x118]
test byte [ebp - 0x10], 0x10
je 0x40c468
push 5
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindow]
mov esi, eax
test esi, esi
je 0x40c468
mov eax, dword [ebp - 0x10]
or eax, 2
mov dword [ebp - 0x14], eax
and dword [ebp - 0x64], 0
xor eax, eax
lea edi, [ebp - 0x60]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x64]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowRect]
push 2
lea eax, [ebp - 0x64]
push eax
push dword [ebx]
push 0
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov eax, dword [ebp - 0x60]
push 0
neg eax
push eax
mov eax, dword [ebp - 0x64]
neg eax
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
push dword [ebp - 0x14]
push dword [ebp - 0x1c]
push 0x317
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
push 2
push esi
call dword [sym.imp.USER32.dll_GetWindow]
mov esi, eax
test esi, esi
jne 0x40c409
push dword [ebp - 0x68]
push dword [ebp - 0x1c]
call dword [sym.imp.GDI32.dll_RestoreDC]
jmp 0x40c6bc
mov eax, dword [ebx + 0x1c]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
je 0x40c494
lea ecx, [ebx + 0x20]
push ecx
push 0
push 0x411
push eax
call esi
lea edi, [ebx + 0xb5]
cmp byte [edi], 0
je 0x40c4ac
push 0xffffffffffffffff
push 0
push 0x200
push dword [ebx]
call esi
mov byte [edi], 0
jmp 0x40c6bc
mov eax, dword [ebp - 0x10]
movsx esi, ax
shr eax, 0x10
cwde
push eax
push esi
mov ecx, ebx
mov byte [ebx + 0xb5], 0
mov dword [ebp - 0x68], eax
call fcn.0040af8c
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40c6bc
mov edx, dword [ebx + 0x58]
test edx, edx
je 0x40c518
push 7
xor eax, eax
pop ecx
lea edi, [ebp - 0x38]
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0xc
mov dword [ebp - 0x38], edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebx + 0x58]
lea edx, [ebp - 0x3c]
mov dword [ebp - 0x34], eax
mov eax, dword [ecx]
push edx
call dword [eax + 0x108]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx]
lea edx, [ebp + 0x40]
push edx
call dword [eax + 0x98]
and dword [ebp - 4], 0
lea ecx, [ebp + 0x40]
call fcn.0040cd4f
test al, al
je 0x40c548
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x40]
call fcn.0040cc32
jmp 0x40b7e5
push 0x2c
pop edi
push edi
lea esi, [ebx + 0x20]
push 0
push esi
call fcn.00445f90
mov eax, dword [ebx]
mov dword [esi], edi
mov dword [ebx + 0x24], 1
mov dword [ebx + 0x28], eax
mov dword [ebx + 0x2c], eax
mov eax, dword [0x473d84]
add esp, 0xc
lea ecx, [ebp + 0x40]
mov dword [ebx + 0x40], eax
call fcn.0040cc4c
mov ecx, dword [ebp - 0x14]
mov dword [ebx + 0x44], eax
mov eax, dword [ecx]
call dword [eax + 0x30]
cmp dword [ebx + 0x1c], 0
lea edi, [ebx + 0x30]
mov esi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
jne 0x40c5d4
xor edi, edi
push edi
push dword [0x473d84]
mov eax, SysReAllocStringLen
push edi
push dword [ebx]
push eax
push eax
push eax
push eax
push SysReAllocStringLen
push edi
push str.tooltips_class32
push edi
call dword [sym.imp.USER32.dll_CreateWindowExA]
lea ecx, [ebx + 0x20]
push ecx
push edi
push 0x404
push eax
mov dword [ebx + 0x1c], eax
call esi
jmp 0x40c5d6
xor edi, edi
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx]
call dword [eax + 0xa4]
push eax
push edi
push 0x418
push dword [ebx + 0x1c]
call esi
lea eax, [ebx + 0x20]
push eax
push edi
push 0x409
push dword [ebx + 0x1c]
call esi
lea eax, [ebx + 0x20]
push eax
push 1
push 0x411
push dword [ebx + 0x1c]
call esi
jmp 0x40c537
movsx eax, word [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
shr eax, 0x10
cwde
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push eax
push dword [ebx]
call dword [sym.imp.USER32.dll_ScreenToClient]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
push ecx
mov dword [ebx + 0x68], ecx
push eax
mov ecx, ebx
mov dword [ebx + 0x64], eax
call fcn.0040af8c
mov esi, eax
test esi, esi
je 0x40c6bc
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c]
cmp eax, ebx
jne 0x40c6bc
xor eax, eax
push 7
pop ecx
lea edi, [ebp - 0x38]
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x1c]
shr eax, 0x10
xor ecx, ecx
test ax, ax
mov eax, dword [ebp - 0x10]
setl cl
mov dword [ebp - 0x3c], 0x12
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ecx
call fcn.004097cd
mov word [ebp - 0x26], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x34], eax
mov eax, dword [esi]
push ecx
mov ecx, esi
call dword [eax + 0x108]
movzx eax, word [ebx + 0x68]
movzx ecx, word [ebx + 0x64]
shl eax, 0x10
or eax, ecx
push eax
push 0
push 0x200
push dword [ebx]
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [ebp - 0x44]
push 0
call fcn.0040cc02
mov edi, eax
test edi, edi
je 0x40c745
add ebx, 0xb8
mov ecx, dword [ebp - 0x44]
push 0
call fcn.0040cba7
lea esi, [edi + 0x88]
mov eax, dword [esi]
test eax, eax
je 0x40c6ff
lea ecx, [eax + 0x34]
call fcn.004160ae
test al, al
je 0x40c6ff
mov ecx, dword [esi]
push edi
add ecx, 0x34
call fcn.0041610a
mov ecx, ebx
xor esi, esi
call fcn.004212ae
test eax, eax
jle 0x40c727
push esi
mov ecx, ebx
call fcn.0040cc1b
mov edx, dword [eax]
push edi
mov ecx, eax
call dword [edx]
mov ecx, ebx
inc esi
call fcn.004212ae
cmp esi, eax
jl 0x40c70c
mov ecx, edi
call fcn.00409820
push edi
call fcn.004367bb
pop ecx
mov ecx, dword [ebp - 0x44]
push 0
call fcn.0040cc02
mov edi, eax
test edi, edi
jne 0x40c6d2
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x84]
xor ecx, ebp
call fcn.00443100
add ebp, 0x88
leave
ret 0x10