Function at 0x40b5c4
Capabilities:
Check for foreground window switch
Check for software breakpoints
Check for time delay via gettickcount
Hide graphical window
Log keystrokes via polling
Set current directory

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x1f4
push ebx
xor ebx, ebx
push esi
xor esi, esi
inc ebx
cmp dword [ebp + 0x7c], 2
push edi
mov byte [ebp + 0x6c], 0
jne 0x40b5f6
cmp byte [0x465357], 0
mov dword [ebp + 0x7c], ebx
jne 0x40b5f6
mov byte [0x465357], bl
mov byte [ebp + 0x6c], bl
cmp dword [0x466198], esi
je 0x40b609
push esi
mov ecx, 0x466180
call fcn.00442a74
cmp dword [ebp + 0x78], 0x8000012f
push 0xa
pop edi
jne 0x40b61e
mov dword [ebp + 0x78], edi
mov byte [ebp + 0x38], 1
jmp 0x40b62c
cmp dword [ebp + 0x78], 5
setle byte [ebp + 0x38]
cmp byte [ebp + 0x38], 0
je 0x40b631
mov dword [ebp + 0x18], esi
jmp 0x40b63a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp + 0x18], eax
cmp dword [0x466ed4], esi
je 0x40b647
call fcn.0040c7ff
cmp dword [0x466100], esi
mov byte [ebp + 0x6f], 0
je 0x40b660
call fcn.0040af17
test al, al
je 0x40b660
mov byte [ebp + 0x6f], 1
cmp dword [ebp + 0x78], esi
jle 0x40b6ec
cmp dword [ebp + 0x7c], ebx
jne 0x40b6ec
inc dword [0x465358]
cmp byte [0x465350], 0
mov byte [ebp + 0x6e], 1
jne 0x40b69b
push esi
push edi
push 9
push dword [0x465208]
call dword [sym.imp.USER32.dll_SetTimer]
test eax, eax
setne al
mov byte [0x465350], al
mov ebx, dword [ebp + 0x78]
mov byte [ebp + 0x67], 0
mov byte [ebp + 0x6d], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
xor ecx, ecx
cmp dword [ebp + 0x78], ecx
mov edi, eax
jle 0x40b842
cmp byte [ebp + 0x6d], cl
jne 0x40b842
cmp byte [0x465357], cl
jne 0x40b84f
cmp byte [0x4651f0], cl
je 0x40b6f2
cmp byte [0x463069], cl
je 0x40b6f2
cmp dword [0x465370], ecx
jne 0x40b6f2
xor eax, eax
jmp 0x40b6f7
mov byte [ebp + 0x6e], 0
jmp 0x40b69b
mov eax, 0x311
push eax
push ecx
push ecx
lea eax, [ebp + 0x44]
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
cmp eax, 0xffffffff
je 0x40b6a6
call esi
mov ecx, eax
sub ecx, edi
cmp ecx, 3
jbe 0x40b719
mov dword [0x466150], eax
cmp dword [0x465b0c], 0
je 0x40b746
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp + 0x44]
push eax
push dword [ebp + 0x50]
push dword [ebp + 0x4c]
push dword [ebp + 0x48]
push dword [ebp + 0x44]
call fcn.0040b0a0
add esp, 0x18
test al, al
jne 0x40b6a6
cmp dword [0x468ee8], 0
je 0x40bbd3
mov eax, dword [ebp + 0x44]
test eax, eax
je 0x40bbd3
cmp eax, dword [0x465208]
je 0x40bbd3
cmp dword [ebp + 0x48], 0x414
je 0x40bbd3
cmp dword [ebp + 0x48], 0x402
je 0x40bbd3
cmp dword [ebp + 0x48], 0x100
jne 0x40bb84
mov eax, dword [ebp + 0x4c]
cmp eax, 0x22
je 0x40b7b1
cmp eax, 0x21
je 0x40b7b1
cmp eax, 9
je 0x40b7b1
cmp eax, 0x25
je 0x40b7b1
cmp eax, 0x27
jne 0x40bab5
call dword [sym.imp.USER32.dll_GetFocus]
mov esi, eax
test esi, esi
je 0x40bab5
push esi
call fcn.0043ad5c
test eax, eax
pop ecx
je 0x40bab5
push eax
call fcn.00431cc3
mov ebx, eax
test ebx, ebx
pop ecx
je 0x40bab5
cmp byte [ebx + 0x54], 0
je 0x40bab5
push 0
push esi
mov ecx, ebx
call fcn.00431c64
mov edi, eax
test edi, edi
mov dword [ebp + 0x68], edi
je 0x40bab5
mov al, byte [edi + 4]
cmp al, 0xf
je 0x40bab5
xor esi, esi
cmp al, 0x13
mov eax, dword [ebp + 0x4c]
jne 0x40ba35
cmp eax, 0x25
mov esi, edi
je 0x40b82a
cmp eax, 0x27
jne 0x40ba35
cmp eax, 0x27
sete al
push 0
push 0
push eax
push edi
mov ecx, ebx
call fcn.004352bf
jmp 0x40b6a6
cmp byte [0x465357], 0
je 0x40b9a4
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
test esi, esi
je 0x40b9a4
push 0
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [0x465c44]
jne 0x40b9a4
cmp dword [0x46537c], 0
je 0x40b8a5
push 0x20
lea eax, [ebp - 0x3c]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClassNameA]
lea eax, [ebp - 0x3c]
push str.32770
push eax
call fcn.00455990
neg eax
sbb al, al
pop ecx
inc al
pop ecx
mov byte [ebp + 0x43], al
jne 0x40b8df
call dword [sym.imp.USER32.dll_GetFocus]
test eax, eax
je 0x40b9a4
push 0x20
lea ecx, [ebp - 0x3c]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetClassNameA]
lea eax, [ebp - 0x3c]
push str.SysTreeView32
push eax
call fcn.00441811
neg eax
sbb al, al
pop ecx
inc al
pop ecx
mov byte [ebp + 0x43], al
je 0x40b9a4
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
xor eax, eax
push eax
push 0x1ff
push eax
push eax
lea eax, [ebp + 0x44]
push eax
call esi
test eax, eax
jne 0x40b92b
cmp byte [0x4651f0], al
je 0x40b911
cmp byte [0x463069], al
je 0x40b911
cmp dword [0x465370], eax
je 0x40b916
mov eax, 0x311
push 1
push eax
push 0x20e
push 0
lea eax, [ebp + 0x44]
push eax
call esi
jmp 0x40b9d6
cmp byte [0x4651f0], 0
mov esi, dword [ebp + 0x54]
je 0x40b94a
cmp byte [0x463069], 0
je 0x40b94a
xor eax, eax
cmp dword [0x465370], eax
je 0x40b94f
mov eax, 0x311
push 0
push eax
push 0x20e
push 0
lea eax, [ebp + 0x44]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x40b970
mov eax, dword [ebp + 0x54]
sub eax, esi
test eax, eax
jle 0x40b979
push 1
push 0x1ff
jmp 0x40b9c8
cmp byte [0x4651f0], 0
je 0x40b995
cmp byte [0x463069], 0
je 0x40b995
xor eax, eax
cmp dword [0x465370], eax
je 0x40b99a
mov eax, 0x311
push 1
push eax
push 0x20e
jmp 0x40b9ca
cmp byte [0x4651f0], 0
je 0x40b9c0
cmp byte [0x463069], 0
je 0x40b9c0
xor eax, eax
cmp dword [0x465370], eax
je 0x40b9c5
mov eax, 0x311
push 1
push eax
push 0
lea eax, [ebp + 0x44]
push 0
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
xor esi, esi
cmp eax, esi
jne 0x40b719
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, edi
cmp ecx, 3
jbe 0x40b9f4
mov dword [0x466150], eax
cmp dword [ebp + 0x78], esi
jne 0x40ba0f
cmp byte [ebp + 0x67], 0
jne 0x40ba0f
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [ebp + 0x67], 1
jmp 0x40b6a6
push dword [ebp + 0x38]
push dword [ebp + 0x18]
push dword [ebp + 0x78]
call fcn.0040c7be
add esp, 0xc
test eax, eax
jne 0x40c729
push 5
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40b6a6
cmp eax, 0x25
je 0x40bab5
cmp eax, 0x27
je 0x40bab5
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, ah
jns 0x40bab5
cmp dword [ebp + 0x4c], 9
jne 0x40ba65
cmp byte [edi + 4], 0xc
jne 0x40ba65
push 0xfffffffffffffff0
push dword [edi]
call dword [sym.imp.USER32.dll_GetWindowLongA]
test al, 4
jne 0x40bab5
test esi, esi
jne 0x40ba8a
xor eax, eax
mov al, byte [edi + 6]
mov ecx, ebx
push eax
call fcn.004322b9
mov esi, eax
test esi, esi
jne 0x40ba8a
push eax
mov ecx, ebx
call fcn.004322b9
mov esi, eax
test esi, esi
je 0x40bab5
cmp dword [ebp + 0x4c], 0x22
je 0x40baa6
cmp dword [ebp + 0x4c], 9
jne 0x40baa2
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, ah
jns 0x40baa6
xor al, al
jmp 0x40baaa
xor eax, eax
mov al, 1
push 1
push 1
push eax
push esi
jmp 0x40b836
cmp dword [ebp + 0x4c], 0x1b
je 0x40badb
cmp dword [ebp + 0x4c], 9
je 0x40badb
cmp dword [ebp + 0x4c], 0x41
jne 0x40bb5e
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, ah
jns 0x40bb5e
call dword [sym.imp.USER32.dll_GetFocus]
mov esi, eax
test esi, esi
je 0x40bb5e
push esi
call fcn.0043ad5c
test eax, eax
pop ecx
je 0x40bb5e
push eax
call fcn.00431cc3
mov ebx, eax
test ebx, ebx
pop ecx
je 0x40bb5e
push 0
push esi
mov ecx, ebx
call fcn.00431c64
test eax, eax
mov dword [ebp + 0x68], eax
je 0x40bb5e
cmp byte [eax + 4], 0xc
jne 0x40bb5e
cmp dword [ebp + 0x4c], 0x1b
je 0x40bb52
cmp dword [ebp + 0x4c], 0x41
je 0x40bb36
test byte [eax + 5], 0x80
je 0x40bb5e
push 0x4585e4
push 1
push 0xc2
jmp 0x40bb45
test byte [eax + 5], 2
jne 0x40bb5e
push 0xffffffffffffffff
push 0
push 0xb1
push dword [eax]
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x40b6a6
mov ecx, ebx
call fcn.004319fe
jmp 0x40b6a6
mov eax, dword [0x468eec]
xor ecx, ecx
cmp eax, ecx
je 0x40bb84
cmp dword [ebp + 0x4c], 0xd
jne 0x40bb73
push ecx
push ecx
jmp 0x40bb7c
cmp dword [ebp + 0x4c], 0x1b
jne 0x40bb84
push ecx
push 1
push 0x1116
push eax
jmp 0x40bb47
xor edi, edi
mov esi, 0x465928
mov eax, dword [esi]
test eax, eax
je 0x40bbc8
cmp dword [eax], 0
je 0x40bbbf
mov ecx, dword [ebp + 0x48]
mov dword [0x4651e8], ecx
lea ecx, [ebp + 0x44]
push ecx
mov byte [0x4651ec], 1
push dword [eax]
call dword [sym.imp.USER32.dll_IsDialogMessageA]
test eax, eax
jne 0x40c112
mov byte [0x4651ec], al
inc edi
cmp dword [0x468ee8], edi
je 0x40bbd3
add esi, 4
cmp esi, 0x465ab4
jl 0x40bb8b
mov ecx, dword [ebp + 0x48]
mov eax, 0x312
cmp ecx, eax
ja 0x40bd28
je 0x40bd6b
mov eax, ecx
sub eax, 0x12
je 0x40bd13
sub eax, 0x39
je 0x40bd03
sub eax, 0xb5
je 0x40bcd7
sub eax, 0x13
jne 0x40c092
xor esi, esi
cmp dword [ebp + 0x50], esi
jne 0x40c092
mov eax, dword [0x465208]
cmp dword [ebp + 0x44], eax
jne 0x40c092
cmp dword [0x466ed4], esi
je 0x40bc37
call fcn.0040c7ff
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x466100], esi
mov dword [0x466154], eax
je 0x40bc57
call fcn.0040af17
test al, al
je 0x40bc57
mov byte [ebp + 0x6f], 1
cmp dword [ebp + 0x7c], esi
je 0x40b6a6
cmp dword [ebp + 0x78], 1
jl 0x40b6a6
push dword [ebp + 0x38]
push dword [ebp + 0x18]
push dword [ebp + 0x78]
call fcn.0040c7be
add esp, 0xc
test eax, eax
je 0x40b6a6
cmp byte [ebp + 0x6c], 0
je 0x40bc90
mov byte [0x465357], 0
cmp byte [ebp + 0x6e], 0
je 0x40bc9c
dec dword [0x465358]
cmp byte [0x465350], 0
je 0x40c78e
xor eax, eax
cmp dword [ebp + 0x78], eax
jle 0x40c7b3
cmp dword [0x465358], eax
jne 0x40c7b3
cmp dword [0x466100], eax
jne 0x40c7b3
cmp dword [0x466ed4], eax
jmp 0x40c766
mov eax, dword [ebp + 0x44]
cmp eax, dword [0x46520c]
jne 0x40c092
cmp dword [ebp + 0x4c], 0x1b
jne 0x40c092
push 0
push dword [0x465208]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x40b6a6
and dword [0x465340], 0
mov byte [ebp + 0x6d], 1
jmp 0x40b6a6
push 0
push 0
push 6
mov ecx, 0x465c88
call fcn.004152c3
jmp 0x40b6a6
cmp ecx, 0x400
jb 0x40c092
cmp ecx, 0x401
jbe 0x40bd58
cmp ecx, 0x402
je 0x40bd6b
cmp ecx, 0x414
je 0x40bd6b
cmp ecx, 0x415
jne 0x40c092
mov eax, dword [ebp + 0x44]
test eax, eax
je 0x40bd6b
cmp eax, dword [0x465208]
jne 0x40c092
mov eax, ecx
xor esi, esi
xor edi, edi
sub eax, 0x401
je 0x40bf47
dec eax
je 0x40bf22
sub eax, 0x12
je 0x40bdde
dec eax
je 0x40bdd4
mov eax, dword [0x4641d0]
movzx eax, word [eax]
cmp dword [ebp + 0x4c], eax
jae 0x40b6a6
mov eax, dword [ebp + 0x4c]
mov ecx, dword [eax*4 + 0x4663d0]
lea eax, [ebp + 0x34]
push eax
mov dword [ebp + 0x14], ecx
call fcn.0040f2e7
test eax, eax
mov dword [ebp + 0x24], eax
je 0x40b6a6
mov ecx, eax
mov al, byte [ecx + 0x18]
cmp al, 1
je 0x40bdcd
cmp al, 3
je 0x40bdcd
and dword [ebp + 0x34], edi
mov eax, dword [ecx]
jmp 0x40bfb9
mov eax, dword [0x4660e8]
jmp 0x40bfb9
push dword [ebp + 0x44]
call fcn.00431cc3
mov ebx, eax
cmp ebx, esi
pop ecx
je 0x40c092
mov eax, dword [ebx + 8]
mov ecx, dword [ebp + 0x4c]
mov edx, dword [ebp + 0x50]
mov dword [ebp + 8], eax
movzx eax, cx
shr ecx, 0x10
cmp eax, 8
mov dword [ebp + 0x60], edx
mov dword [ebp + 0x1c], eax
mov dword [ebp + 0x10], ecx
jne 0x40be1f
mov dword [ebp + 0x60], ecx
mov ecx, 0x2af8
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], ecx
cmp ecx, dword [ebx + 0xc]
jae 0x40be32
mov edx, dword [ebx + 0x14]
lea ecx, [ecx + ecx*4]
lea ecx, [edx + ecx*4]
mov dword [ebp + 0x68], ecx
jmp 0x40be35
mov dword [ebp + 0x68], esi
sub eax, 5
mov dword [ebp + 0x30], esi
mov byte [ebp + 0x66], 0
je 0x40bed9
dec eax
je 0x40bec6
dec eax
je 0x40beb0
dec eax
je 0x40be9d
dec eax
je 0x40be8d
cmp dword [ebp + 0x68], esi
je 0x40b6a6
mov eax, dword [ebp + 0x68]
mov ecx, dword [eax + 0xc]
test ecx, ecx
mov dword [ebp + 0x3c], ecx
jne 0x40be7d
test byte [eax + 5], 1
je 0x40b6a6
mov ecx, ebx
call fcn.0042e86c
jmp 0x40b6a6
test byte [eax + 5], 4
jne 0x40b6a6
mov byte [ebp + 0x66], 1
jmp 0x40bf02
mov eax, dword [ebx + 0x2c]
cmp eax, esi
mov dword [ebp + 0x3c], eax
je 0x40b6a6
jmp 0x40bf02
mov eax, dword [ebx + 0x24]
cmp eax, esi
mov dword [ebp + 0x3c], eax
je 0x40b6a6
lea eax, [ebx + 0x32]
jmp 0x40bec1
mov eax, dword [ebx + 0x20]
cmp eax, esi
mov dword [ebp + 0x3c], eax
je 0x40b6a6
lea eax, [ebx + 0x31]
mov dword [ebp + 0x30], eax
jmp 0x40bf02
mov eax, dword [ebx + 0x1c]
cmp eax, esi
mov dword [ebp + 0x3c], eax
je 0x40b6a6
lea eax, [ebx + 0x30]
jmp 0x40bec1
mov eax, dword [ebx + 0x28]
cmp eax, esi
mov edi, dword [ebx + 0x6c]
mov dword [ebp + 0x3c], eax
je 0x40bf0a
cmp edi, esi
je 0x40b6a6
xor esi, esi
push esi
push esi
push 0xffffffffffffffff
push edi
call dword [sym.imp.SHELL32.dll_DragQueryFileA]
cmp eax, esi
mov dword [ebp + 0x60], eax
je 0x40bf0a
mov eax, dword [ebp + 0x3c]
jmp 0x40bfb9
cmp edi, esi
je 0x40b6a6
push edi
call dword [sym.imp.SHELL32.dll_DragFinish]
and dword [ebx + 0x6c], 0
jmp 0x40b6a6
push dword [ebp + 0x50]
mov ecx, 0x465c88
call fcn.00436122
cmp eax, esi
mov dword [ebp + 0x28], eax
je 0x40b6a6
mov eax, dword [eax + 0xc]
test eax, eax
je 0x40b6a6
jmp 0x40bfb9
mov eax, dword [ebp + 0x4c]
cmp eax, dword [0x466edc]
jae 0x40b6a6
mov eax, dword [0x466ed8]
mov ecx, dword [ebp + 0x4c]
mov esi, dword [eax + ecx*4]
xor eax, eax
mov al, byte [esi + 0x20]
test al, al
mov dword [ebp + 0x2c], esi
je 0x40bf92
push dword [esi + 0x10]
push dword [esi + 0xc]
push eax
call fcn.0040d5f2
add esp, 0xc
test eax, eax
mov dword [ebp + 0x34], eax
je 0x40b6a6
mov al, byte [esi + 0x20]
cmp al, 1
je 0x40bf96
cmp al, 3
je 0x40bf96
and dword [ebp + 0x34], 0
push dword [ebp + 0x50]
mov ecx, esi
call fcn.0040d256
mov eax, dword [esi + 8]
cmp byte [eax], 0
jne 0x40b6a6
mov al, byte [ebp + 0x50]
mov byte [0x466118], al
mov eax, dword [ebp + 0x2c]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov ecx, dword [0x46535c]
cmp ecx, dword [0x463078]
mov al, byte [eax]
mov byte [ebp + 0x20], al
jl 0x40bffc
cmp ecx, 0x14
jg 0x40c130
cmp al, 0xd5
je 0x40bffc
cmp al, 0xc1
je 0x40bffc
cmp al, 0xcf
je 0x40bffc
cmp al, 0xd0
je 0x40bffc
cmp al, 0xcb
je 0x40bffc
cmp al, 0xcc
je 0x40bffc
cmp al, 0xcd
je 0x40bffc
cmp al, 0xce
jne 0x40c130
mov eax, dword [ebp + 0x48]
sub eax, 0x401
je 0x40c122
dec eax
je 0x40c05a
sub eax, 0x12
je 0x40c04e
dec eax
je 0x40c03a
push dword [ebp + 0x24]
mov ecx, dword [ebp + 0x14]
call fcn.0040f202
test al, al
jne 0x40c032
push dword [ebp + 0x24]
call fcn.0040f23f
pop ecx
jmp 0x40b6a6
mov eax, dword [ebp + 0x24]
jmp 0x40c125
cmp byte [0x4660e4], 0
jne 0x40b6a6
xor esi, esi
jmp 0x40c128
mov eax, dword [ebp + 0x30]
test eax, eax
je 0x40c047
cmp byte [eax], 0
jmp 0x40c041
mov eax, dword [ebp + 0x28]
mov esi, dword [eax + 0x18]
mov eax, dword [ebp + 0x4c]
cmp eax, 0x63
jae 0x40c11e
mov ebx, dword [eax*4 + 0x465928]
test ebx, ebx
jne 0x40c128
cmp dword [ebp + 0x44], ebx
je 0x40c128
mov eax, dword [0x465208]
cmp dword [ebp + 0x44], eax
je 0x40c128
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
test esi, esi
je 0x40c6df
push 0
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [0x465c44]
jne 0x40c6df
push 0x20
lea eax, [ebp - 0x3c]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClassNameA]
lea eax, [ebp - 0x3c]
push str.32770
push eax
call fcn.00455990
test eax, eax
pop ecx
pop ecx
jne 0x40c6df
mov eax, dword [ebp + 0x48]
mov dword [0x4651e8], eax
lea eax, [ebp + 0x44]
push eax
push esi
mov byte [0x4651ec], 1
call dword [sym.imp.USER32.dll_IsDialogMessageA]
test eax, eax
je 0x40c6d8
cmp dword [0x46537c], 0
je 0x40c112
push 0x465b28
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov byte [0x4651ec], 0
jmp 0x40b6a6
xor ebx, ebx
jmp 0x40c128
mov eax, dword [ebp + 0x2c]
mov esi, dword [eax + 0x14]
cmp esi, dword [0x465164]
jge 0x40c137
test edi, edi
jmp 0x40bf0c
cmp dword [0x466100], 0
mov byte [ebp + 0x6f], 1
jne 0x40c16f
cmp dword [0x466ed4], 0
jne 0x40c16f
cmp byte [0x465350], 0
je 0x40c16f
push 9
push dword [0x465208]
call dword [sym.imp.USER32.dll_KillTimer]
test eax, eax
je 0x40c16f
mov byte [0x465350], 0
mov eax, dword [ebp + 0x48]
cmp eax, 0x402
je 0x40c1c7
cmp eax, 0x413
jbe 0x40c187
cmp eax, 0x415
jbe 0x40c1f2
cmp eax, 0x401
mov ecx, dword [0x4660d8]
mov dword [0x4660dc], ecx
mov ecx, dword [0x466110]
mov dword [0x466114], ecx
jne 0x40c1af
mov eax, dword [ebp + 0x2c]
mov eax, dword [eax]
mov eax, dword [eax]
jmp 0x40c1b5
mov eax, dword [ebp + 0x14]
mov eax, dword [eax + 4]
mov dword [0x4660d8], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x466110], eax
jmp 0x40c1f2
mov eax, dword [ebp + 0x28]
mov edi, 0x105
push edi
push dword [eax]
push 0x465ecc
call fcn.00438c79
mov eax, dword [ebp + 0x28]
mov eax, dword [eax + 0x14]
push edi
push dword [eax]
push 0x465fd1
call fcn.00438c79
add esp, 0x18
mov ecx, dword [0x465b20]
push 0x80
call fcn.00401d39
push eax
lea eax, [ebp - 0xbc]
push eax
call fcn.00438c79
push 0xc8
lea eax, [ebp - 0x184]
push 0x465138
push eax
call fcn.00455650
push dword [ebp + 0x20]
xor edi, edi
inc edi
push edi
push 0
push esi
call fcn.0040b4ee
add esp, 0x28
push 0
mov ecx, 0x465c88
call fcn.0040b419
cmp dword [0x46537c], 0
je 0x40c257
push 0x465b28
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x466154], eax
mov dword [0x466150], eax
mov eax, dword [ebp + 0x48]
sub eax, 0x401
je 0x40c62c
dec eax
je 0x40c601
sub eax, 0x12
je 0x40c31c
dec eax
je 0x40c2b3
mov ecx, dword [ebp + 0x14]
mov al, byte [ecx + 0x12]
cmp al, 0x9e
je 0x40c296
cmp al, 0x9f
jne 0x40c29e
mov eax, dword [ebp + 0x50]
mov dword [0x465170], eax
mov eax, dword [ebp + 0x34]
push dword [ebp + 0x24]
mov dword [0x4651d4], eax
call fcn.0040f3dc
jmp 0x40c63c
call dword [sym.imp.USER32.dll_CountClipboardFormats]
test eax, eax
je 0x40c2e6
mov esi, dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
push edi
call esi
test eax, eax
jne 0x40c2de
push 0xf
call esi
test eax, eax
jne 0x40c2de
mov dword [0x465170], 2
jmp 0x40c2ed
mov dword [0x465170], edi
jmp 0x40c2ed
and dword [0x465170], 0
push dword [0x465170]
mov ecx, dword [0x465b20]
call fcn.004018f8
mov ecx, dword [0x4660e8]
mov byte [0x4660e4], 1
call fcn.0040595f
mov byte [0x4660e4], 0
jmp 0x40c63c
mov ecx, dword [ebp + 0x1c]
push 5
pop edi
cmp ecx, edi
mov byte [ebp - 8], 0
je 0x40c4fb
jbe 0x40c474
cmp ecx, 8
jbe 0x40c40d
cmp ecx, 9
jne 0x40c474
mov ecx, dword [ebp + 0x58]
mov esi, dword [ebp + 0x68]
xor eax, eax
cmp dword [ebp + 0x60], eax
mov dword [0x465174], ecx
mov ecx, dword [ebp + 0x5c]
sete al
and dword [ebp + 0x60], 0
test esi, esi
mov dword [0x465178], ecx
lea eax, [eax + eax + 1]
mov dword [0x46516c], eax
je 0x40c3fa
cmp eax, 1
jne 0x40c38a
push 0x465174
push esi
mov ecx, ebx
call fcn.0042f216
movzx eax, byte [esi + 4]
sub eax, 9
je 0x40c3e5
dec eax
je 0x40c3da
dec eax
jne 0x40c3fa
cmp dword [0x46516c], 1
jne 0x40c3ad
push 0
push 9
push 0x110a
jmp 0x40c3d0
mov eax, dword [ebp + 0x58]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x5c]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
push eax
push dword [esi]
call dword [sym.imp.USER32.dll_ScreenToClient]
lea eax, [ebp - 0x1c]
push eax
push 0
push 0x1111
push dword [esi]
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x40c3f7
push 1
push 0xffffffffffffffff
push 0x100c
jmp 0x40c3ee
push 0
push 0
push 0x19f
push dword [esi]
call dword [sym.imp.USER32.dll_SendMessageA]
inc eax
mov dword [ebp + 0x60], eax
push dword [ebx]
push 0x465174
call fcn.00438a18
pop ecx
pop ecx
jmp 0x40c54e
cmp ecx, 8
mov esi, dword [ebp + 0x68]
mov dword [0x46516c], 1
jne 0x40c546
mov eax, dword [ebp + 0xc]
mov dword [0x465174], eax
push dword [ebp + 0x60]
mov ecx, dword [0x465b20]
call fcn.004018f8
mov eax, dword [ebx]
mov edi, dword [ebp + 0x10]
mov dword [0x4651d4], eax
mov eax, dword [ebx + 8]
mov dword [0x46517c], eax
mov eax, dword [ebx + 8]
mov dword [0x465184], eax
mov eax, dword [ebp + 0x60]
mov dword [0x465170], eax
mov eax, dword [ebp + 0x30]
test eax, eax
mov dword [0x465180], edi
je 0x40c568
mov byte [eax], 1
jmp 0x40c572
mov esi, dword [ebp + 0x68]
mov al, byte [esi + 4]
cmp al, 0xa
je 0x40c4a5
cmp al, 0x15
jne 0x40c4f3
mov eax, dword [ebp + 0x58]
mov dword [0x465174], eax
mov eax, dword [ebp + 0x5c]
mov dword [0x465178], eax
push dword [ebx]
push 0x465174
call fcn.00438a18
pop ecx
pop ecx
mov ecx, dword [ebp + 0x1c]
jmp 0x40c4f3
cmp cl, 0x49
jne 0x40c4f3
test ch, 1
lea eax, [ebp - 8]
je 0x40c4b8
mov byte [ebp - 8], 0x53
jmp 0x40c4c1
test ch, 2
je 0x40c4c4
mov byte [ebp - 8], 0x73
lea eax, [ebp - 7]
test ch, 4
je 0x40c4ce
mov byte [eax], 0x46
jmp 0x40c4d6
test ch, 8
je 0x40c4d7
mov byte [eax], 0x66
inc eax
test ch, 0x10
je 0x40c4e1
mov byte [eax], 0x43
jmp 0x40c4e9
test ch, 0x20
je 0x40c4ea
mov byte [eax], 0x63
inc eax
push 0x49
pop ecx
mov byte [eax], 0
mov dword [ebp + 0x1c], ecx
mov dword [0x46516c], ecx
jmp 0x40c53d
mov eax, dword [ebp + 0x58]
mov dword [0x465174], eax
mov eax, dword [ebp + 0x5c]
mov dword [0x46516c], edi
mov dword [0x465178], eax
push dword [ebx]
push 0x465174
call fcn.00438a18
pop ecx
pop ecx
push 0xffffffffffffffec
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowLongA]
and eax, 0xffffffef
push eax
push 0xffffffffffffffec
push dword [ebx]
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov esi, dword [ebp + 0x68]
mov ecx, dword [ebp + 0x1c]
cmp ecx, 8
je 0x40c42b
cmp ecx, edi
je 0x40c42b
mov ecx, dword [0x465b20]
push 1
push 0
push 0xffffffffffffffff
lea eax, [ebp - 8]
push eax
call fcn.00401592
jmp 0x40c439
cmp byte [ebp + 0x66], 0
je 0x40c572
or byte [esi + 5], 4
mov ecx, dword [ebp + 0x3c]
call fcn.0040595f
mov eax, dword [ebp + 8]
mov ebx, dword [eax*4 + 0x465928]
test ebx, ebx
je 0x40c63c
cmp edi, dword [ebx + 0xc]
jae 0x40c59c
mov ecx, dword [ebx + 0x14]
lea eax, [edi + edi*4]
lea ecx, [ecx + eax*4]
jmp 0x40c59e
xor ecx, ecx
mov eax, dword [ebp + 0x1c]
sub eax, 5
mov dword [ebp + 0x68], ecx
je 0x40c5d5
dec eax
je 0x40c5cf
dec eax
je 0x40c5c9
dec eax
je 0x40c5c3
dec eax
je 0x40c63c
test ecx, ecx
je 0x40c63c
and byte [ecx + 5], 0xfb
jmp 0x40c63c
mov byte [ebx + 0x32], 0
jmp 0x40c63c
mov byte [ebx + 0x31], 0
jmp 0x40c63c
mov byte [ebx + 0x30], 0
jmp 0x40c63c
mov eax, dword [ebx + 0x6c]
test eax, eax
je 0x40c5e7
push eax
call dword [sym.imp.SHELL32.dll_DragFinish]
and dword [ebx + 0x6c], 0
push 0xffffffffffffffec
push dword [ebx]
call dword [sym.imp.USER32.dll_GetWindowLongA]
or eax, 0x10
push eax
push 0xffffffffffffffec
push dword [ebx]
call dword [sym.imp.USER32.dll_SetWindowLongA]
jmp 0x40c63c
test ebx, ebx
je 0x40c61f
mov eax, dword [ebx]
mov dword [0x4651d4], eax
mov dword [0x46516c], edi
mov eax, dword [ebx + 8]
mov dword [0x465184], eax
mov dword [0x46517c], eax
mov eax, dword [ebp + 0x28]
mov ecx, dword [eax + 0xc]
call fcn.0040595f
jmp 0x40c63c
mov eax, dword [ebp + 0x34]
mov ecx, dword [ebp + 0x2c]
mov dword [0x4651d4], eax
call fcn.0040d514
push 1
lea eax, [ebp - 0xbc]
push eax
lea eax, [ebp - 0x184]
push eax
call fcn.0040b337
add esp, 0xc
cmp dword [ebp + 0x7c], 0
jne 0x40c67e
mov byte [0x4651f0], 1
mov byte [0x4651f2], 0
mov byte [0x4651f1], 1
mov dword [0x465164], 0x80000000
jmp 0x40b6a6
push dword [ebp + 0x38]
push dword [ebp + 0x18]
push dword [ebp + 0x78]
call fcn.0040c7be
add esp, 0xc
test eax, eax
je 0x40c6a0
mov byte [ebp + 0x6d], 1
mov byte [ebp + 0x38], 1
jmp 0x40b6a6
cmp byte [ebp + 0x6e], 0
je 0x40b6a6
cmp byte [0x465350], 0
jne 0x40b6a6
push 0
push 0xa
push 9
push dword [0x465208]
call dword [sym.imp.USER32.dll_SetTimer]
test eax, eax
setne al
mov byte [0x465350], al
jmp 0x40b6a6
mov byte [0x4651ec], 0
mov eax, dword [0x465218]
test eax, eax
je 0x40c701
lea ecx, [ebp + 0x44]
push ecx
push eax
push dword [0x465208]
call dword [sym.imp.USER32.dll_TranslateAcceleratorA]
test eax, eax
jne 0x40b6a6
mov eax, dword [ebp + 0x48]
mov dword [0x4651e8], eax
lea eax, [ebp + 0x44]
push eax
mov byte [0x4651ec], 1
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp + 0x44]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x40c112
cmp byte [ebp + 0x6c], 0
je 0x40c736
mov byte [0x465357], 0
cmp byte [ebp + 0x6e], 0
je 0x40c742
dec dword [0x465358]
cmp byte [0x465350], 0
je 0x40c783
cmp dword [ebp + 0x78], esi
jle 0x40c7b3
cmp dword [0x465358], esi
jne 0x40c7b3
cmp dword [0x466100], esi
jne 0x40c7b3
cmp dword [0x466ed4], esi
jne 0x40c7b3
push 9
push dword [0x465208]
call dword [sym.imp.USER32.dll_KillTimer]
test eax, eax
je 0x40c7b3
mov byte [0x465350], 0
jmp 0x40c7b3
cmp dword [0x465358], esi
je 0x40c7b3
push esi
jmp 0x40c799
cmp dword [0x465358], 0
je 0x40c7b3
push 0
push 0xa
push 9
push dword [0x465208]
call dword [sym.imp.USER32.dll_SetTimer]
test eax, eax
setne al
mov byte [0x465350], al
mov al, byte [ebp + 0x6f]
pop edi
pop esi
pop ebx
add ebp, 0x70
leave
ret