Function at 0x4b72db
Capabilities:
Check for unmoving mouse cursor
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x1b4
push ebx
mov ebx, ecx
mov byte [esp + 7], 0
push esi
push edi
mov dword [esp + 0x24], ebx
test dword [ebx + 0x70], 0x200000
je 0x4b7325
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
cmp eax, 0x21
jne 0x4b731c
mov eax, dword [ebp + 0x18]
mov dword [eax], 4
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x24
cmp eax, 8
je 0x4b7c1f
cmp byte [ebx + 0x64], 0
mov dword [esp + 0x10], 0x4009
je 0x4b758c
mov esi, dword [ebx + 0x34]
xor ecx, ecx
mov dword [esp + 0x78], ecx
mov dword [esp + 0x7c], ecx
mov dword [esp + 0x80], ecx
mov dword [esp + 0x84], ecx
test esi, esi
je 0x4b758c
mov edi, dword [ebp + 0x24]
mov ebx, dword [ebp + 0x10]
mov edx, dword [esi + 4]
test edx, edx
je 0x4b738c
push dword [ebp + 0x20]
mov eax, dword [edx]
lea ecx, [esp + 0x7c]
push ecx
mov ecx, dword [ebp + 0x14]
push dword [ecx]
mov ecx, dword [ebp + 0xc]
push dword [ebx]
push dword [ecx]
push edx
call dword [eax + 0x74]
mov ecx, dword [esp + 0x78]
test eax, eax
jns 0x4b738c
mov byte [edi], 0
test cx, cx
je 0x4b757e
xor edx, edx
mov byte [esp + 0xe8], 0
mov word [esp + 0xd8], dx
lea eax, [esp + 0x78]
cmp cx, 3
jne 0x4b73cb
mov eax, dword [esp + 0x80]
mov dword [esp + 0xd4], eax
mov dword [esp + 0xe9], edx
jmp 0x4b7550
mov edx, 0x4003
cmp cx, dx
jne 0x4b73f5
mov eax, dword [esp + 0x80]
mov eax, dword [eax]
mov dword [esp + 0xd4], eax
mov dword [esp + 0xe9], 0
jmp 0x4b7550
mov dword [esp + 0xd4], 0
cmp cx, 0xa
jne 0x4b742f
cmp dword [esp + 0x80], 0x80020004
jne 0x4b74b8
mov byte [esp + 0xe8], 1
mov dword [esp + 0xe9], 0x80020005
jmp 0x4b7550
cmp cx, 9
je 0x4b743f
mov edx, 0x4009
cmp cx, dx
jne 0x4b74b8
test ecx, 0x4000
je 0x4b7452
mov eax, dword [esp + 0x80]
mov edx, dword [eax]
jmp 0x4b7459
mov edx, dword [esp + 0x80]
test edx, edx
je 0x4b7545
push 0
push 0
lea ecx, [esp + 0xe0]
xor eax, eax
push ecx
lea ecx, [esp + 0x74]
mov dword [esp + 0x74], eax
push ecx
push 3
push 0
push 0x519ca0
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], eax
mov dword [esp + 0x90], eax
mov eax, dword [edx]
push 0
push edx
call dword [eax + 0x18]
mov dword [esp + 0xe9], eax
test eax, eax
js 0x4b753f
mov ecx, dword [esp + 0x78]
lea eax, [esp + 0xd8]
movzx edx, word [eax]
cmp edx, 1
jne 0x4b74d0
mov dword [esp + 0xe9], 0x800a005e
jmp 0x4b7550
xor ecx, ecx
mov dword [esp + 0xa0], ecx
mov dword [esp + 0xa4], ecx
mov dword [esp + 0xa8], ecx
mov dword [esp + 0xac], ecx
mov ecx, 0x400c
cmp dx, cx
jne 0x4b7503
lea ecx, [ecx]
mov eax, dword [eax + 8]
cmp word [eax], cx
je 0x4b74fb
push 3
push 2
push 0x400
push eax
lea eax, [esp + 0xb0]
push eax
call dword [sym.imp.OLEAUT32.dll_SafeArrayPtrOfIndex]
mov dword [esp + 0xe9], eax
test eax, eax
js 0x4b753f
mov eax, dword [esp + 0xa8]
mov dword [esp + 0xd4], eax
mov dword [esp + 0xe9], 0
mov ecx, dword [esp + 0x78]
jmp 0x4b7550
mov dword [esp + 0xe9], 0x800a005b
cmp word [esp + 0xd8], 0
mov edx, dword [ebp + 0x18]
mov eax, dword [esp + 0xd4]
mov byte [esp + 0xf], 1
mov dword [edx], eax
je 0x4b757e
lea eax, [esp + 0xd8]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov ecx, dword [esp + 0x78]
mov esi, dword [esi]
test esi, esi
jne 0x4b7360
mov ebx, dword [esp + 0x24]
cmp byte [ebp + 0x28], 0
mov ecx, dword [sym.imp.USER32.dll_GetKeyState]
jne case.0x4b75c0.258
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
cmp eax, 0x201
ja case.0x4b75c0.258
je 0x4b7c33
sub eax, 0x100
cmp eax, 5
ja case.0x4b75c0.258
jmp dword [eax*4 + 0x4b72c3]
mov eax, dword [ebx + 0x2c]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
mov esi, dword [eax + 0x2c]
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x48], esi
push dword [eax]
push 0x87
push dword [ebp + 8]
call edi
mov dword [esp + 0x30], eax
test al, 4
jne 0x4b7aca
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
lea edx, [ecx - 9]
cmp edx, 0x22
ja case.0x4b760c.10
movzx eax, byte [edx + 0x4b729f]
jmp dword [eax*4 + 0x4b728f]
mov eax, dword [sym.imp.USER32.dll_GetKeyState]
mov edi, dword [esi + 0x28]
push 0x10
call eax
movzx ecx, ax
shr ecx, 0xf
and ecx, 0xffffff01
mov dword [esp + 0x28], ecx
mov al, byte [esi + 0x52]
mov byte [esp + 0x23], al
mov dword [esp + 0x88], 0
mov dword [esp + 0x8c], 0
mov dword [esp + 0x90], 0
mov dword [esp + 0x94], 0
mov dword [esp + 0x98], 0
mov byte [esp + 0x9d], 1
mov byte [esp + 0x9c], cl
test edi, edi
je 0x4b76be
push 0
mov edx, str.TabStop
mov ecx, edi
call fcn.004b6f93
test eax, eax
je 0x4b76be
mov eax, dword [edi + 0x28]
mov eax, dword [eax + 0x64]
mov eax, dword [eax + 0x80]
cmp byte [eax + 0x65], 0
je 0x4b76be
push SysReAllocString
mov edx, str.TabIndex
mov ecx, edi
call fcn.004b6f93
mov dword [esp + 0x88], eax
jmp 0x4b76c9
mov dword [esp + 0x88], VariantCopyInd
mov edx, dword [esi + 0x18]
lea ecx, [esp + 0x88]
call fcn.004b6e6a
mov eax, dword [esp + 0x98]
mov dword [esp + 0x40], eax
test eax, eax
jne 0x4b7702
cmp byte [esp + 0x23], al
setne al
dec eax
and eax, dword [esp + 0x94]
mov dword [esp + 0x40], eax
test eax, eax
je case.0x4b760c.10
mov ecx, dword [eax + 0xc]
mov dword [esp + 0x50], 0
mov byte [esp + 0x30], 0
mov eax, dword [ecx + 0x28]
mov eax, dword [eax + 0x64]
mov eax, dword [eax + 0x80]
mov eax, dword [eax + 0x3c]
mov dword [esp + 0x50], eax
test eax, eax
jne 0x4b7762
lea edx, [esp + 0x1c]
mov dword [esp + 0x1c], eax
mov eax, dword [ecx]
push edx
push 0x51d078
push ecx
call dword [eax]
test eax, eax
js 0x4b7762
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x4b7762
mov eax, dword [ecx]
lea edx, [esp + 0x50]
push edx
push ecx
mov byte [esp + 0x38], 1
call dword [eax + 0xc]
mov eax, dword [esp + 0x1c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [esp + 0x50], 0
mov esi, dword [esp + 0x40]
mov edi, dword [esi + 0xc]
jne 0x4b777d
mov esi, dword [esp + 0x44]
mov ecx, dword [esp + 0x28]
jmp 0x4b762f
mov eax, dword [edi + 0x28]
mov eax, dword [eax + 0x64]
mov eax, dword [eax + 0x80]
cmp byte [eax + 0x5e], 0
je 0x4b789c
lea edx, [esp + 0x60]
mov dword [esp + 0x60], 0
mov ecx, edi
call fcn.004b6dd5
cmp dword [esp + 0x60], 0
jne 0x4b789c
mov eax, dword [esi + 0xc]
mov edx, dword [eax + 0x28]
mov eax, dword [edx + 0x64]
test eax, eax
je 0x4b7816
mov ecx, dword [eax + 0x2c]
test ecx, ecx
je 0x4b7816
mov eax, dword [edx + 0x68]
test eax, eax
jne 0x4b77d3
mov eax, dword [ecx + 0x18]
test eax, eax
je 0x4b7816
mov esi, dword [eax + 0x30]
test esi, esi
je 0x4b7812
nop
mov ecx, dword [esi + 0xc]
mov eax, dword [ecx + 0x28]
mov eax, dword [eax + 0x64]
mov eax, dword [eax + 0x80]
test eax, eax
je 0x4b780c
cmp byte [eax + 0x5e], 0
je 0x4b780c
lea edx, [esp + 0x64]
mov dword [esp + 0x64], 0
call fcn.004b6dd5
cmp dword [esp + 0x64], 0
jne 0x4b781b
mov esi, dword [esi]
test esi, esi
jne 0x4b77db
mov esi, dword [esp + 0x40]
mov edi, dword [esi + 0xc]
jmp 0x4b7839
cmp dword [esi + 0xc], 0
mov edi, dword [esp + 0x40]
mov edi, dword [edi + 0xc]
je 0x4b7835
mov esi, dword [esp + 0x44]
mov ecx, dword [esp + 0x28]
jmp 0x4b762f
mov esi, dword [esp + 0x40]
push 0
push 0
push 0
lea ecx, [esp + 0x74]
mov dword [esp + 0xb4], 0xffffffff
push ecx
push 4
mov eax, 3
mov dword [esp + 0x84], 1
mov word [esp + 0xb4], ax
lea eax, [esp + 0xb4]
push 0
push 0x519ca0
mov dword [esp + 0x84], eax
mov eax, dword [edi]
push 0
push edi
mov dword [esp + 0x98], 1
mov dword [esp + 0x90], 0x4cefa0
call dword [eax + 0x18]
mov ecx, dword [esi + 0xc]
mov edx, str.CausesValidation
push 0
call fcn.004b6f93
test eax, eax
je 0x4b78ce
mov eax, dword [esi + 0xc]
mov eax, dword [eax + 0x28]
mov ecx, dword [eax + 0x64]
mov ecx, dword [ecx + 0x80]
call fcn.004b6d15
test al, al
je 0x4b78ce
mov dl, 1
jmp 0x4b8b25
mov eax, dword [ebp + 0x10]
mov edx, esi
mov ebx, dword [esp + 0x44]
mov ecx, ebx
push dword [eax]
push dword [esp + 0x34]
push dword [esp + 0x58]
call fcn.004b6bf1
add esp, 0xc
cmp dword [0x4cef74], 0
je 0x4b7c1f
push 0
push 3
push 0x128
push dword [ebx + 0x3c]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x24
cmp byte [ebx + 0x63], 0
jne 0x4b7aca
test byte [esp + 0x30], 1
jne 0x4b7aca
cmp ecx, 0x25
je 0x4b7941
cmp ecx, 0x26
je 0x4b7941
xor al, al
jmp 0x4b7943
mov al, 1
mov esi, dword [esi + 0x28]
mov dword [esp + 0x8c], 0
mov dword [esp + 0x90], 0
mov dword [esp + 0x94], 0
mov dword [esp + 0x98], 0
mov byte [esp + 0x9d], 0
mov byte [esp + 0x9c], al
test esi, esi
je 0x4b79c3
push 0
mov edx, str.TabStop
mov ecx, esi
call fcn.004b6f93
test eax, eax
je 0x4b79c3
mov eax, dword [esi + 0x28]
mov eax, dword [eax + 0x64]
mov eax, dword [eax + 0x80]
cmp byte [eax + 0x65], 0
je 0x4b79c3
push SysReAllocString
mov edx, str.TabIndex
mov ecx, esi
call fcn.004b6f93
mov dword [esp + 0x88], eax
jmp 0x4b79d2
mov dword [esp + 0x88], VariantCopyInd
test esi, esi
je 0x4b79f3
mov edx, dword [esi + 0x28]
mov eax, dword [edx + 0x64]
test eax, eax
je 0x4b79ef
mov eax, dword [eax + 0x2c]
test eax, eax
je 0x4b79ef
mov edx, dword [edx + 0x68]
test edx, edx
jne 0x4b79fa
mov edx, dword [eax + 0x18]
jmp 0x4b79fa
xor edx, edx
jmp 0x4b79fa
mov edx, dword [esp + 0x44]
mov edx, dword [edx + 0x18]
lea ecx, [esp + 0x88]
call fcn.004b6e6a
mov esi, dword [esp + 0x98]
test esi, esi
jne 0x4b7a20
mov esi, dword [esp + 0x94]
test esi, esi
je 0x4b7aca
mov ecx, dword [esi + 0xc]
mov byte [esp + 0x30], 0
mov eax, dword [ecx + 0x28]
mov eax, dword [eax + 0x64]
mov eax, dword [eax + 0x80]
mov edi, dword [eax + 0x3c]
mov dword [esp + 0x50], edi
test edi, edi
jne 0x4b7a80
lea edx, [esp + 0x1c]
mov dword [esp + 0x1c], edi
mov eax, dword [ecx]
push edx
push 0x51d078
push ecx
call dword [eax]
test eax, eax
js 0x4b7a78
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x4b7a78
mov eax, dword [ecx]
lea edx, [esp + 0x50]
push edx
push ecx
mov byte [esp + 0x38], 1
call dword [eax + 0xc]
mov eax, dword [esp + 0x1c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov edi, dword [esp + 0x50]
test edi, edi
je 0x4b7aca
mov ecx, dword [esi + 0xc]
mov edx, str.CausesValidation
push 0
call fcn.004b6f93
test eax, eax
je 0x4b7ab2
mov eax, dword [esi + 0xc]
mov eax, dword [eax + 0x28]
mov ecx, dword [eax + 0x64]
mov ecx, dword [ecx + 0x80]
call fcn.004b6d15
test al, al
je 0x4b7ab2
mov dl, 1
jmp 0x4b8b25
mov eax, dword [ebp + 0x10]
mov edx, esi
mov ecx, dword [esp + 0x44]
push dword [eax]
push dword [esp + 0x34]
push edi
call fcn.004b6bf1
add esp, 0xc
mov edx, dword [ebp + 8]
mov esi, dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [sym.imp.USER32.dll_GetKeyState]
mov edi, dword [ebp + 0x10]
cmp byte [esp + 0xf], 0
jne case.0x4b8744.523
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
cmp eax, 0x100
ja 0x4b8410
je case.0x4b842f.260
dec eax
cmp eax, 0x83
ja case.0x4b8744.523
movzx eax, byte [eax + 0x4b720b]
jmp dword [eax*4 + 0x4b71df]
call dword [sym.imp.USER32.dll_GetFocus]
push 0
push 0
mov esi, eax
push 0x87
push esi
call edi
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x44]
push esi
push dword [eax + 0x3c]
call dword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x4b7aca
test byte [esp + 0x30], 0x30
je 0x4b7aca
push 0
push 0
push 0xf5
push esi
call edi
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x24
mov edx, dword [ebp + 0xc]
mov eax, dword [ebx + 0x2c]
mov ecx, dword [eax + 0x2c]
test ecx, ecx
je 0x4b7aca
cmp byte [ecx + 0x52], 0
mov edi, dword [ebp + 0x10]
je 0x4b7d33
mov eax, dword [edx]
mov edx, dword [ebp + 8]
mov dword [esp + 0x104], eax
mov eax, dword [edi]
mov dword [esp + 0x108], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x110], 0
mov dword [esp + 0x114], 0
mov dword [esp + 0x118], 0
mov eax, dword [eax]
mov dword [esp + 0x100], edx
mov dword [esp + 0x10c], eax
mov dword [esp + 0x30], 0
mov eax, dword [ecx + 0x18]
mov eax, dword [eax + 0x28]
mov eax, dword [eax + 0x64]
mov eax, dword [eax + 0x80]
mov esi, dword [eax + 0x34]
test esi, esi
je 0x4b7d36
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x4b7c0e
mov eax, dword [ecx]
lea edx, [esp + 0x30]
push edx
lea edx, [esp + 0x104]
push edx
push ecx
call dword [eax + 0xb0]
mov esi, dword [esi]
test esi, esi
jne 0x4b7bf1
cmp word [esp + 0x30], si
je 0x4b7d33
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x24
mov ecx, dword [ebx + 0x2c]
mov edx, str.CausesValidation
push 0
mov edi, dword [ecx + 0x2c]
mov ecx, dword [ecx + 0x24]
call fcn.004b6f93
test eax, eax
je 0x4b7c5e
mov ecx, ebx
call fcn.004b6d15
test al, al
je 0x4b7c5e
mov dl, 1
jmp 0x4b8b25
push 0xffffffffffffffe0
push dword [ebp + 8]
xor esi, esi
call dword [sym.imp.USER32.dll_GetClassWord]
movzx ecx, ax
mov ax, word [0x4cef70]
cmp cx, ax
jne 0x4b7c7e
test ax, ax
jne 0x4b7c8e
mov ax, word [0x4cef6c]
cmp cx, ax
jne 0x4b7c9b
test ax, ax
je 0x4b7c9b
push 0xffffffffffffffeb
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov esi, eax
mov edi, dword [edi + 0x3c]
mov edx, dword [ebp + 8]
cmp edi, edx
je 0x4b7ceb
push 0
push 0
push 0x87
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0x4b9954
push edi
mov dword [esp + 0x3c], eax
call dword [sym.imp.USER32.dll_EnumChildWindows]
mov eax, dword [esp + 0x30]
test eax, 0x2000
je 0x4b7ce8
test al, 0x30
je 0x4b7ce8
push 1
push 1
push 0xf4
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [ebp + 8]
test esi, esi
je 0x4b7acd
cmp dword [esi + 0x3c], edx
jne 0x4b7acd
mov ecx, dword [esi + 0x2c]
mov edx, str.CanGetFocus
push 0
mov ecx, dword [ecx + 0x24]
call fcn.004b6f93
mov esi, dword [sym.imp.USER32.dll_SetFocus]
test eax, eax
je 0x4b7d1d
push dword [ebp + 8]
call esi
mov edx, dword [ebp + 8]
jmp 0x4b7ad3
mov edx, dword [ebp + 8]
mov esi, dword [sym.imp.USER32.dll_SetFocus]
jmp 0x4b7ad9
mov edx, dword [ebp + 8]
mov ecx, dword [sym.imp.USER32.dll_GetKeyState]
mov esi, dword [sym.imp.USER32.dll_SetFocus]
jmp 0x4b7adc
call fcn.004c50b1
mov ecx, dword [ebx + 0x2c]
mov esi, eax
mov eax, dword [ecx + 0x2c]
test eax, eax
je case.0x4b8744.523
mov eax, dword [eax + 0x18]
cmp eax, dword [ecx + 0x24]
je case.0x4b8744.523
cmp byte [esi + 0x180], 0
jne case.0x4b8744.523
cmp byte [esi + 0x181], 0
jne case.0x4b8744.523
mov edi, dword [ebp + 8]
lea eax, [esp + 0x130]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowRect]
push 2
lea eax, [esp + 0x134]
push eax
push edi
call dword [sym.imp.USER32.dll_GetParent]
push eax
push 0
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov al, byte [esi + 0x181]
mov byte [esi + 0x181], 1
cmp dword [ebx + 0xb0], 0
mov byte [esp + 0x23], al
jne 0x4b7e67
mov ecx, dword [ebx + 0x2c]
fld qword [0x515070]
mov eax, dword [ecx + 0x2c]
mov eax, dword [eax + 0x40]
mov dword [esp + 0x24], eax
cmp eax, 0x60
jne 0x4b7def
fstp st(0)
fild dword [esp + 0x130]
jmp 0x4b7e0a
fild dword [esp + 0x130]
fstp qword [esp + 0x10]
fmul qword [esp + 0x10]
fild dword [esp + 0x24]
fstp qword [esp + 0x10]
fdiv qword [esp + 0x10]
mov ecx, dword [ecx + 0x24]
sub esp, 8
mov edx, str.PixelsLeft
fstp qword [esp]
call fcn.004b6b61
mov ecx, dword [ebx + 0x2c]
fild dword [esp + 0x134]
mov eax, dword [ecx + 0x2c]
mov eax, dword [eax + 0x40]
mov dword [esp + 0x24], eax
cmp eax, 0x60
je 0x4b7e50
fstp qword [esp + 0x48]
fld qword [esp + 0x48]
fmul qword [0x515070]
fild dword [esp + 0x24]
fstp qword [esp + 0x48]
fdiv qword [esp + 0x48]
mov ecx, dword [ecx + 0x24]
sub esp, 8
mov edx, str.PixelsTop
fstp qword [esp]
call fcn.004b6b61
mov al, byte [esp + 0x23]
mov byte [esi + 0x181], al
jmp case.0x4b8744.523
call fcn.004c50b1
mov edx, dword [ebx + 0x2c]
lea ecx, [ebx + 0x2c]
mov edi, eax
mov eax, dword [edx + 0x2c]
test eax, eax
je 0x4b7fe2
mov eax, dword [eax + 0x18]
lea ecx, [ebx + 0x2c]
cmp eax, dword [edx + 0x24]
je 0x4b7fe2
cmp byte [edi + 0x180], 0
lea ecx, [ebx + 0x2c]
jne 0x4b7fe2
cmp byte [edi + 0x181], 0
lea ecx, [ebx + 0x2c]
jne 0x4b7fe2
lea eax, [esp + 0xf0]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowRect]
push 2
lea eax, [esp + 0xf4]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetParent]
push eax
push 0
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov al, byte [edi + 0x181]
lea ecx, [ebx + 0x2c]
mov byte [edi + 0x181], 1
cmp dword [ebx + 0xb0], 0
mov byte [esp + 0x23], al
jne 0x4b7fdc
mov ecx, dword [ebx + 0x2c]
fld qword [0x515070]
mov eax, dword [ecx + 0x2c]
mov eax, dword [eax + 0x40]
cmp eax, 0x60
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0xf8]
jne 0x4b7f39
sub eax, dword [esp + 0xf0]
fstp st(0)
mov dword [esp + 0x28], eax
fild dword [esp + 0x28]
jmp 0x4b7f5c
sub eax, dword [esp + 0xf0]
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
fstp qword [esp + 0x10]
fmul qword [esp + 0x10]
fild dword [esp + 0x24]
fstp qword [esp + 0x10]
fdiv qword [esp + 0x10]
mov ecx, dword [ecx + 0x24]
sub esp, 8
mov edx, str.PixelsWidth
fstp qword [esp]
call fcn.004b6b61
mov ecx, dword [ebx + 0x2c]
mov eax, dword [ecx + 0x2c]
mov eax, dword [eax + 0x40]
cmp eax, 0x60
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0xfc]
jne 0x4b7f99
sub eax, dword [esp + 0xf4]
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
jmp 0x4b7fc2
sub eax, dword [esp + 0xf4]
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
fstp qword [esp + 0x48]
fld qword [esp + 0x48]
fmul qword [0x515070]
fild dword [esp + 0x24]
fstp qword [esp + 0x48]
fdiv qword [esp + 0x48]
mov ecx, dword [ecx + 0x24]
sub esp, 8
mov edx, str.PixelsHeight
fstp qword [esp]
call fcn.004b6b61
mov al, byte [esp + 0x23]
lea ecx, [ebx + 0x2c]
mov byte [edi + 0x181], al
mov ecx, dword [ecx]
mov eax, dword [ecx + 0x2c]
test eax, eax
je case.0x4b8744.523
mov eax, dword [eax + 0x18]
cmp eax, dword [ecx + 0x24]
je case.0x4b8744.523
mov esi, dword [ebx + 0x34]
test esi, esi
je 0x4b8015
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x4b800f
mov eax, dword [ecx]
push ecx
call dword [eax + 0x64]
mov esi, dword [esi]
test esi, esi
jne 0x4b8002
mov esi, dword [ebx + 0x34]
test esi, esi
je case.0x4b8744.523
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x4b802d
mov eax, dword [ecx]
push ecx
call dword [eax + 0x68]
mov esi, dword [esi]
test esi, esi
jne 0x4b8020
jmp case.0x4b8744.523
mov eax, dword [ebp + 0x14]
mov edi, dword [ebx + 0x2c]
mov edx, dword [eax]
mov dword [esp + 0x10], edx
cmp dword [edx + 4], 2
jne 0x4b8094
mov eax, dword [edi + 0x2c]
mov eax, dword [eax + 0x18]
mov eax, dword [eax + 0x28]
mov eax, dword [eax + 0x64]
mov eax, dword [eax + 0x80]
mov esi, dword [eax + 0x34]
test esi, esi
je 0x4b8129
lea esp, [esp]
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x4b8082
push dword [edx + 8]
mov eax, dword [ecx]
push ecx
call dword [eax + 0xac]
mov edx, dword [esp + 0x10]
mov esi, dword [esi]
test esi, esi
jne 0x4b806b
mov ebx, dword [ebp + 0x18]
mov dl, 1
mov dword [ebx], esi
jmp 0x4b8b28
mov edi, dword [edi + 0x24]
cmp dword [edi + 0x30], 0
je 0x4b80f6
mov eax, dword [edx + 0x14]
mov ecx, dword [edx + 0x18]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x28]
mov dword [esp + 0x2c], ecx
push eax
mov eax, dword [edi + 0x28]
mov dword [esp + 0x34], 0
mov eax, dword [eax + 0x64]
mov eax, dword [eax + 0x80]
push dword [eax + 0x3c]
call dword [sym.imp.USER32.dll_ScreenToClient]
mov ecx, dword [ebx + 0x2c]
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x30]
push 0
push eax
lea edx, [esp + 0x34]
call fcn.004b6a94
mov eax, dword [esp + 0x3c]
add esp, 0xc
test eax, eax
je 0x4b80f6
mov eax, dword [eax + 0x2c]
mov edi, dword [eax + 0x24]
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax + 0x2c]
mov eax, dword [eax + 0x18]
mov eax, dword [eax + 0x28]
mov eax, dword [eax + 0x64]
mov eax, dword [eax + 0x80]
mov esi, dword [eax + 0x34]
test esi, esi
je 0x4b8129
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x4b8123
mov eax, dword [ecx]
push edi
push ecx
call dword [eax + 0xa8]
mov esi, dword [esi]
test esi, esi
jne 0x4b8112
mov ebx, dword [ebp + 0x18]
mov dl, 1
mov dword [ebx], 0
jmp 0x4b8b28
mov eax, dword [ebx + 0x2c]
mov ebx, dword [ebp + 0x18]
mov eax, dword [eax + 0x2c]
cmp edx, dword [eax + 0x3c]
je 0x4b9420
cmp dword [eax + 0xa4], 0
je 0x4b9420
mov dword [ebx], 0xffffffff
mov dl, 1
jmp 0x4b8b28
mov ecx, dword [ebx + 0x2c]
mov dword [ebx + 0x3c], edx
mov edx, str.VisualStyles
push 0xffffffffffffffff
mov ecx, dword [ecx + 0x24]
call fcn.004b6f93
test eax, eax
jne case.0x4b8744.523
push str.UxTheme.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je case.0x4b8744.523
push str.SetWindowTheme
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x51e5d4
push 0x51e5d4
push dword [ebp + 8]
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp case.0x4b8744.523
cmp byte [ebx + 0x6a], 0
mov dword [esp + 0x30], 0
jne 0x4b81ff
mov esi, dword [ebx + 0x34]
mov edi, dword [edi]
test esi, esi
je case.0x4b8744.523
mov edi, edi
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x4b81ee
mov eax, dword [ecx]
lea edx, [esp + 0x30]
push edx
push edi
push ecx
call dword [eax + 0x1c]
mov esi, dword [esi]
test esi, esi
jne 0x4b81db
cmp word [esp + 0x30], si
je case.0x4b8744.523
mov ebx, dword [ebp + 0x18]
mov dl, 1
mov dword [ebx], 1
jmp 0x4b8b28
mov eax, dword [ebx + 0x2c]
mov esi, dword [ebx + 0x34]
movzx ecx, word [edi]
mov edx, dword [eax + 0x2c]
cmp byte [edx + 0x4b], 0
jne 0x4b8263
test esi, esi
je case.0x4b8744.523
test cx, cx
jne 0x4b824b
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x4b823b
mov eax, dword [ecx]
push ecx
call dword [eax + 0x5c]
mov esi, dword [esi]
test esi, esi
jne 0x4b822e
jmp case.0x4b8744.523
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x4b8258
mov eax, dword [ecx]
push ecx
call dword [eax + 0x58]
mov esi, dword [esi]
test esi, esi
jne 0x4b824b
jmp case.0x4b8744.523
test cx, cx
setne al
mov byte [edx + 0x4f], al
jmp case.0x4b8744.523
mov eax, dword [ebp + 0x10]
mov edi, dword [ebx + 0xb4]
mov eax, dword [eax]
test eax, eax
je 0x4b8286
mov dword [ebx + 0xb4], eax
mov esi, dword [ebx + 0x34]
xor eax, eax
mov dword [esp + 0x30], eax
test esi, esi
je 0x4b82af
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x4b82a5
mov eax, dword [ecx]
lea edx, [esp + 0x30]
push edx
push ecx
call dword [eax + 0x60]
mov esi, dword [esi]
test esi, esi
jne 0x4b8293
mov eax, dword [esp + 0x30]
mov ecx, dword [ebp + 0x10]
cmp dword [ecx], 0
je 0x4b82bd
mov dword [ebx + 0xb4], edi
mov ebx, dword [ebp + 0x18]
test ax, ax
je 0x4b9420
mov dword [ebx], 0
mov dl, 1
jmp 0x4b8b28
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax + 0x2c]
test eax, eax
je case.0x4b8744.523
mov esi, dword [sym.imp.USER32.dll_PostMessageW]
cmp dword [eax + 0x3c], edx
je 0x4b8305
push 0
push 0
push 0x406
push edx
call dword [sym.imp.USER32.dll_GetParent]
push eax
call esi
mov edx, dword [ebp + 8]
push 0
push 0
push 0x407
push edx
call esi
jmp case.0x4b8744.523
cmp byte [ebx + 0x6d], 0
jne 0x4b8405
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax + 0x2c]
cmp dword [eax + 0x58], 0
jne 0x4b8405
mov esi, dword [edi]
test esi, esi
je 0x4b83a8
lea eax, [esp + 0x30]
mov dword [esp + 0x30], 0
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [esp + 0x30], eax
jne 0x4b8405
push 0x80
lea eax, [esp + 0x144]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClassNameW]
mov edx, 0xe
lea ecx, [esp + 0x140]
mov esi, str.Thunder
mov eax, dword [ecx]
cmp eax, dword [esi]
jne 0x4b8399
sub edx, 4
add ecx, 4
add esi, 4
mov eax, edx
cmp edx, 4
jae 0x4b837f
test eax, eax
je 0x4b83a8
sub esi, ecx
mov al, byte [ecx]
dec edx
cmp al, byte [esi + ecx]
jne 0x4b8405
inc ecx
test edx, edx
jne 0x4b839b
mov eax, dword [ebx + 0x2c]
cmp dword [eax + 0x2c], 0
je case.0x4b8744.523
cmp byte [ebx + 0x6c], 0
jne case.0x4b8744.523
push 0
mov byte [ebx + 0x6c], 1
push dword [edi]
mov edi, dword [sym.imp.USER32.dll_PostMessageW]
push 0x409
push dword [ebp + 8]
call edi
mov eax, dword [ebx + 0x2c]
mov ecx, dword [ebp + 8]
mov eax, dword [eax + 0x2c]
cmp dword [eax + 0x3c], ecx
je case.0x4b8744.523
mov eax, dword [ebp + 0x10]
push ecx
mov esi, dword [eax]
call dword [sym.imp.USER32.dll_GetParent]
push 0
push esi
push 0x408
push eax
call edi
jmp case.0x4b8744.523
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x24
cmp eax, 0x200
ja 0x4b871e
je 0x4b8686
sub eax, 0x101
cmp eax, 4
ja case.0x4b8744.523
jmp dword [eax*4 + 0x4b71cb]
movzx eax, byte [edi]
mov dword [esp + 0x1c], eax
test eax, eax
je 0x4b854b
push 0x11
call ecx
movsx esi, ax
mov eax, dword [sym.imp.USER32.dll_GetKeyState]
and esi, 0xbfffffff
push 0x10
call eax
movsx edi, ax
shr edi, 1
or edi, esi
push 0x12
shr edi, 1
call dword [sym.imp.USER32.dll_GetKeyState]
mov esi, dword [ebx + 0x34]
cwde
and eax, 0x9fffffff
or eax, edi
shr eax, 0x1d
mov dword [esp + 0x30], eax
test esi, esi
je 0x4b84a8
mov ebx, eax
lea esp, [esp]
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x4b849e
mov eax, dword [ecx]
lea edx, [esp + 0x1c]
push ebx
push edx
push ecx
call dword [eax + 0x24]
mov esi, dword [esi]
test esi, esi
jne 0x4b848b
mov ebx, dword [esp + 0x24]
test dword [ebx + 0x70], 0x2000000
je 0x4b84c0
mov ecx, ebx
call fcn.004b6a7c
test al, al
je 0x4b8544
mov esi, dword [ebx + 0x80]
cmp esi, 0xffffffff
je 0x4b8544
mov eax, dword [ebx + 0x2c]
mov edx, dword [eax + 0x24]
movzx eax, word [esp + 0x1c]
mov ecx, dword [edx + 0x18]
mov dword [esp + 0x28], eax
add ecx, 4
xor eax, eax
mov dword [esp + 0x58], 2
mov dword [esp + 0x54], eax
mov dword [esp + 0x5c], eax
lea eax, [esp + 0x100]
mov dword [esp + 0x50], eax
mov eax, 0x4002
mov word [esp + 0x110], ax
lea eax, [esp + 0x28]
mov dword [esp + 0x118], eax
mov eax, 2
mov word [esp + 0x100], ax
mov eax, dword [esp + 0x30]
mov word [esp + 0x108], ax
lea eax, [esp + 0x50]
push eax
push esi
call fcn.004c13c4
movsx eax, word [esp + 0x28]
jmp 0x4b8548
mov eax, dword [esp + 0x1c]
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x18]
mov dword [edi], eax
test eax, eax
jne 0x4b9420
mov dword [ebx], eax
mov dl, 1
jmp 0x4b8b28
movzx eax, byte [edi]
mov dword [esp + 0x1c], eax
test eax, eax
je 0x4b854b
push 0x11
call ecx
movsx esi, ax
push 0x10
and esi, 0xbfffffff
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edi, ax
shr edi, 1
or edi, esi
push 0x12
shr edi, 1
call dword [sym.imp.USER32.dll_GetKeyState]
mov esi, dword [ebx + 0x34]
cwde
and eax, 0x9fffffff
or eax, edi
shr eax, 0x1d
mov dword [esp + 0x30], eax
test esi, esi
je 0x4b85c8
mov ebx, eax
nop
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x4b85be
mov eax, dword [ecx]
lea edx, [esp + 0x1c]
push ebx
push edx
push ecx
call dword [eax + 0x28]
mov esi, dword [esi]
test esi, esi
jne 0x4b85ab
mov ebx, dword [esp + 0x24]
test dword [ebx + 0x70], 0x2000000
je 0x4b85e0
mov ecx, ebx
call fcn.004b6a7c
test al, al
je 0x4b8544
mov esi, dword [ebx + 0x84]
jmp 0x4b84c6
mov eax, dword [edi]
and eax, 0xffff
mov dword [esp + 0x1c], eax
je 0x4b867d
mov esi, dword [ebx + 0x34]
test esi, esi
je 0x4b861b
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x4b8615
mov eax, dword [ecx]
lea edx, [esp + 0x1c]
push edx
push ecx
call dword [eax + 0x2c]
mov esi, dword [esi]
test esi, esi
jne 0x4b8603
test dword [ebx + 0x70], 0x2000000
je 0x4b862f
mov ecx, ebx
call fcn.004b6a7c
test al, al
je 0x4b867d
mov esi, dword [ebx + 0x88]
cmp esi, 0xffffffff
je 0x4b867d
mov eax, dword [ebx + 0x2c]
mov edx, dword [eax + 0x24]
xor eax, eax
mov ecx, dword [edx + 0x18]
mov dword [esp + 0x34], eax
add ecx, 4
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x68]
mov dword [esp + 0x30], eax
mov eax, 0x4002
mov word [esp + 0x68], ax
lea eax, [esp + 0x1c]
mov dword [esp + 0x70], eax
lea eax, [esp + 0x30]
push eax
push esi
mov dword [esp + 0x40], 1
call fcn.004c13c4
mov eax, dword [esp + 0x1c]
jmp 0x4b854b
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax + 0x2c]
cmp dword [eax + 0xa4], 0
je case.0x4b8744.523
lea eax, [esp + 0x30]
mov dword [esp + 0x30], 0
push eax
mov dword [esp + 0x38], 0
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [ebx + 0x2c]
mov esi, dword [esp + 0x30]
mov edx, dword [esp + 0x34]
mov ecx, dword [eax + 0x2c]
sub esi, dword [ecx + 0xac]
mov dword [esp + 0x30], esi
sub edx, dword [ecx + 0xb0]
mov dword [esp + 0x34], edx
cmp byte [ecx + 0x9b], 0
jne 0x4b870e
test esi, esi
jne 0x4b86e7
test edx, edx
je 0x4b870e
mov eax, dword [ecx + 0xa0]
push 0
push dword [ecx + 0xa8]
add eax, edx
push dword [ecx + 0xa4]
push eax
mov eax, dword [ecx + 0x9c]
mov ecx, ebx
add eax, esi
push eax
call fcn.004b9cae
mov ebx, dword [ebp + 0x18]
mov dl, 1
mov dword [ebx], 0
jmp 0x4b8b28
cmp eax, 0x406
ja 0x4b8ba0
je 0x4b8b50
sub eax, 0x201
cmp eax, 0xd
ja case.0x4b8744.523
movzx eax, byte [eax + 0x4b71bb]
jmp dword [eax*4 + 0x4b71a7]
mov byte [ebx + 0x67], 1
jmp case.0x4b8744.523
mov eax, dword [ebx]
lea ecx, [esp + 0xb0]
push ecx
fldz
push ebx
fstp qword [esp + 0xb8]
call dword [eax + 0x14]
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call edi
movsx esi, ax
push 0x10
and esi, 0xbfffffff
call edi
movsx edi, ax
shr edi, 1
or edi, esi
push 0x12
shr edi, 1
call dword [sym.imp.USER32.dll_GetKeyState]
mov esi, dword [ebx + 0x34]
cwde
and eax, 0x9fffffff
mov dword [esp + 0x44], 0
or eax, edi
shr eax, 0x1d
mov dword [esp + 0x28], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [esp + 0x24], eax
test esi, esi
je case.0x4b8744.523
mov edi, dword [esi + 4]
test edi, edi
je 0x4b886a
mov ecx, dword [ebx + 0x2c]
lea eax, [esp + 0x44]
mov edx, dword [edi]
push eax
mov eax, dword [ebp + 0x14]
sub esp, 8
movsx eax, word [eax + 2]
mov dword [esp + 0x1c], eax
fild dword [esp + 0x1c]
mov eax, dword [ebp + 0x14]
fstp qword [esp + 0x1c]
fld qword [esp + 0x1c]
fdiv qword [esp + 0xbc]
movsx eax, word [eax]
fmul qword [ecx + 0x68]
fstp dword [esp + 0x1c]
fld dword [esp + 0x1c]
fstp dword [esp + 4]
mov dword [esp + 0x1c], eax
fild dword [esp + 0x1c]
fstp qword [esp + 0x1c]
fld qword [esp + 0x1c]
fdiv qword [esp + 0xbc]
fmul qword [ecx + 0x60]
xor ecx, ecx
cmp dword [esp + 0x30], 0x207
setne cl
xor eax, eax
dec ecx
and ecx, 4
cmp dword [esp + 0x30], 0x204
fstp dword [esp + 0x1c]
fld dword [esp + 0x1c]
setne al
dec eax
and eax, 2
or ecx, eax
xor eax, eax
cmp dword [esp + 0x30], 0x201
fstp dword [esp]
push dword [esp + 0x34]
sete al
or ecx, eax
push ecx
push edi
call dword [edx + 0x40]
mov esi, dword [esi]
test esi, esi
jne 0x4b87be
mov ebx, dword [ebp + 0x18]
cmp word [esp + 0x44], si
je 0x4b9420
mov dword [ebx], esi
mov dl, 1
jmp 0x4b8b28
mov eax, dword [ebx]
lea ecx, [esp + 0x48]
push ecx
fldz
push ebx
fstp qword [esp + 0x50]
call dword [eax + 0x14]
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call edi
movsx esi, ax
push 0x10
and esi, 0xbfffffff
call edi
movsx edi, ax
shr edi, 1
or edi, esi
push 0x12
shr edi, 1
call dword [sym.imp.USER32.dll_GetKeyState]
mov esi, dword [ebx + 0x34]
cwde
and eax, 0x9fffffff
mov dword [esp + 0x40], 0
or eax, edi
shr eax, 0x1d
mov dword [esp + 0x28], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [esp + 0x24], eax
test esi, esi
je case.0x4b8744.523
mov edi, dword [esi + 4]
test edi, edi
je 0x4b8995
mov ecx, dword [ebx + 0x2c]
lea eax, [esp + 0x40]
mov edx, dword [edi]
push eax
mov eax, dword [ebp + 0x14]
sub esp, 8
movsx eax, word [eax + 2]
mov dword [esp + 0x1c], eax
fild dword [esp + 0x1c]
mov eax, dword [ebp + 0x14]
fstp qword [esp + 0x1c]
fld qword [esp + 0x1c]
fdiv qword [esp + 0x54]
movsx eax, word [eax]
fmul qword [ecx + 0x68]
fstp dword [esp + 0x1c]
fld dword [esp + 0x1c]
fstp dword [esp + 4]
mov dword [esp + 0x1c], eax
fild dword [esp + 0x1c]
fstp qword [esp + 0x1c]
fld qword [esp + 0x1c]
fdiv qword [esp + 0x54]
fmul qword [ecx + 0x60]
xor ecx, ecx
cmp dword [esp + 0x30], 0x208
setne cl
xor eax, eax
dec ecx
and ecx, 4
cmp dword [esp + 0x30], 0x205
fstp dword [esp + 0x1c]
fld dword [esp + 0x1c]
setne al
dec eax
and eax, 2
or ecx, eax
xor eax, eax
cmp dword [esp + 0x30], 0x202
fstp dword [esp]
push dword [esp + 0x34]
sete al
or ecx, eax
push ecx
push edi
call dword [edx + 0x44]
mov esi, dword [esi]
test esi, esi
jne 0x4b88ef
mov ebx, dword [ebp + 0x18]
cmp word [esp + 0x40], si
je 0x4b9420
mov dword [ebx], esi
mov dl, 1
jmp 0x4b8b28
mov eax, dword [ebx]
lea ecx, [esp + 0x50]
push ecx
fldz
push ebx
fstp qword [esp + 0x58]
call dword [eax + 0x14]
mov eax, dword [edi]
lea esi, [ebx + 0x34]
mov ecx, dword [ebp + 0x14]
lea edx, [esp + 0x30]
mov edi, dword [ebx + 0x2c]
mov dword [esp + 0x1c], eax
shr eax, 2
mov dword [esp + 0x10], eax
movsx eax, word [ecx]
mov dword [esp + 0x30], eax
movsx eax, word [ecx + 2]
mov ecx, edi
mov dword [esp + 0x28], eax
lea eax, [esp + 0x60]
push eax
lea eax, [esp + 0x68]
mov dword [esp + 0x68], esi
push eax
lea eax, [esp + 0x30]
mov dword [esp + 0x68], 0
push eax
call fcn.004b6a94
fild dword [esp + 0x3c]
add esp, 0xc
fstp qword [esp + 0x48]
fld qword [esp + 0x48]
fdiv qword [esp + 0x50]
fild dword [esp + 0x28]
fstp qword [esp + 0x48]
fld qword [esp + 0x48]
mov eax, dword [esp + 0x64]
fdiv qword [esp + 0x50]
cmp eax, esi
jne 0x4b8a4d
fld qword [edi + 0x60]
fmulp st(2)
fxch st(1)
fst qword [esp + 0x48]
fld qword [edi + 0x68]
jmp 0x4b8a5d
fld qword [0x515048]
fmul st(2), st(0)
fxch st(2)
fst qword [esp + 0x48]
fxch st(1)
mov esi, dword [eax]
fmulp st(2)
fxch st(1)
fst qword [esp + 0xb0]
test esi, esi
je 0x4b8ac3
mov ebx, dword [esp + 0x10]
mov edi, dword [esi + 4]
test edi, edi
je 0x4b8aaa
mov eax, dword [esp + 0x1c]
sub esp, 8
mov edx, dword [edi]
mov ecx, ebx
fstp dword [esp + 0x18]
fld dword [esp + 0x18]
and ecx, 4
fstp dword [esp + 4]
and eax, 3
fstp dword [esp + 0x18]
fld dword [esp + 0x18]
or ecx, eax
fstp dword [esp]
push ecx
push edi
call dword [edx + 0x54]
jmp 0x4b8aae
fstp st(1)
fstp st(0)
mov esi, dword [esi]
fld qword [esp + 0x48]
fld qword [esp + 0xb0]
test esi, esi
jne 0x4b8a72
mov ebx, dword [esp + 0x24]
mov eax, dword [esp + 0x60]
fstp st(1)
fstp st(0)
mov esi, ebx
test eax, eax
je 0x4b8ad3
mov esi, eax
test dword [ebx + 0x70], 0x2000000
je 0x4b8ae7
mov ecx, ebx
call fcn.004b6a7c
test al, al
je case.0x4b8744.523
cmp dword [esi + 0xa4], 0xffffffff
je 0x4b941d
test dword [ebx + 0x70], 0x1000
je 0x4b8b08
mov ecx, ebx
call fcn.004b6a64
test al, al
je case.0x4b8744.523
mov eax, dword [esi + 0x2c]
push 0
push dword [esi + 0xa4]
mov edx, dword [eax + 0x24]
mov ecx, dword [edx + 0x18]
add ecx, 4
call fcn.004c13c4
mov dl, byte [esp + 0xf]
mov ebx, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x1c]
test ecx, ecx
je 0x4b8b45
mov eax, dword [ecx]
test eax, eax
je 0x4b8b45
mov eax, dword [eax + 0x44]
cmp eax, dword [ecx + 4]
je 0x4b8b45
mov dword [ebx], 0
mov dl, 1
pop edi
pop esi
mov al, dl
pop ebx
mov esp, ebp
pop ebp
ret 0x24
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax + 0x2c]
test eax, eax
je case.0x4b8744.523
cmp byte [eax + 0x52], 0
je case.0x4b8744.523
cmp byte [eax + 0x53], 0
jne case.0x4b8744.523
mov byte [eax + 0x53], 1
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax + 0x2c]
mov eax, dword [eax + 0x18]
mov eax, dword [eax + 0x28]
mov eax, dword [eax + 0x64]
mov eax, dword [eax + 0x80]
mov esi, dword [eax + 0x34]
test esi, esi
je case.0x4b8744.523
jmp 0x4b8b8b
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x4b8b98
mov eax, dword [ecx]
push ecx
call dword [eax + 0x38]
mov esi, dword [esi]
test esi, esi
jne 0x4b8b8b
jmp case.0x4b8744.523
cmp eax, 0x409
ja 0x4b8d03
je 0x4b8cdc
sub eax, 0x407
je 0x4b8c43
sub eax, 1
jne case.0x4b8744.523
mov eax, dword [ebx + 0x2c]
mov ecx, dword [edi]
mov eax, dword [eax + 0x2c]
test eax, eax
je case.0x4b8744.523
cmp byte [eax + 0x52], 0
je case.0x4b8744.523
cmp byte [eax + 0x53], 0
je case.0x4b8744.523
test ecx, ecx
je 0x4b8bff
push ecx
push dword [eax + 0x3c]
call dword [sym.imp.USER32.dll_IsChild]
test eax, eax
jne case.0x4b8744.523
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax + 0x2c]
mov byte [eax + 0x53], 0
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax + 0x2c]
mov eax, dword [eax + 0x18]
mov eax, dword [eax + 0x28]
mov eax, dword [eax + 0x64]
mov eax, dword [eax + 0x80]
mov esi, dword [eax + 0x34]
test esi, esi
je case.0x4b8744.523
mov edi, edi
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x4b8c38
mov eax, dword [ecx]
push ecx
call dword [eax + 0x3c]
mov esi, dword [esi]
test esi, esi
jne 0x4b8c2b
jmp case.0x4b8744.523
cmp byte [ebx + 0x6c], 0
jne case.0x4b8744.523
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax + 0x2c]
test eax, eax
je 0x4b8ca8
cmp dword [eax + 0x3c], edx
jne 0x4b8ca1
cmp byte [eax + 0x52], 0
je 0x4b8c85
inc dword [eax + 0x58]
mov ecx, dword [ebx + 0x2c]
mov ecx, dword [ecx + 0x2c]
call fcn.004b682b
mov dl, al
mov eax, dword [ebx + 0x2c]
mov ecx, dword [eax + 0x2c]
dec dword [ecx + 0x58]
test dl, dl
jne case.0x4b8744.523
jmp 0x4b8ca8
mov ecx, dword [eax + 0x28]
test ecx, ecx
je 0x4b8ca8
push 0
mov edx, str.hWnd
call fcn.004b6f93
test eax, eax
je 0x4b8ca8
push eax
call esi
jmp 0x4b8ca8
mov ecx, ebx
call fcn.004b99ca
mov esi, dword [ebx + 0x34]
test esi, esi
je 0x4b8cc2
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x4b8cbc
mov eax, dword [ecx]
push ecx
call dword [eax + 0x30]
mov esi, dword [esi]
test esi, esi
jne 0x4b8caf
mov ecx, dword [ebx + 0x74]
cmp ecx, 0xffffffff
je case.0x4b8744.523
mov eax, dword [ebx + 0x2c]
push 0
push ecx
mov edx, dword [eax + 0x24]
jmp 0x4b8b16
mov esi, dword [ebx + 0x34]
mov byte [ebx + 0x6c], 0
test esi, esi
je 0x4b8cfe
lea esp, [esp]
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x4b8cf8
mov eax, dword [ecx]
push ecx
call dword [eax + 0x34]
mov esi, dword [esi]
test esi, esi
jne 0x4b8ceb
mov ecx, dword [ebx + 0x78]
jmp 0x4b8cc5
cmp eax, 0x77ea
jne case.0x4b8744.523
mov edi, dword [edi]
mov esi, dword [ebx + 0x34]
mov dword [esp + 0x28], edi
mov eax, dword [edi + 4]
cmp eax, 0x114
ja 0x4b92f7
je 0x4b92bd
sub eax, 0x20
cmp eax, 0xf1
ja case.0x4b930c.278
movzx eax, byte [eax + 0x4b70b3]
jmp dword [eax*4 + 0x4b709b]
mov ecx, dword [ebx + 0xb8]
test ecx, ecx
je 0x4b8dc2
xor eax, eax
cmp ecx, 0x13
setge al
dec eax
and eax, ecx
mov dword [esp + 0x10], eax
jne 0x4b8d96
test edx, edx
je 0x4b8d96
push 0xfffffffffffffff4
push edx
call dword [sym.imp.USER32.dll_GetClassLongA]
mov esi, eax
mov eax, dword [0x4cef68]
test eax, eax
jne 0x4b8d8b
push 0x7f00
push eax
call dword [sym.imp.USER32.dll_LoadCursorW]
mov dword [0x4cef68], eax
test esi, esi
je 0x4b8d96
cmp esi, eax
je 0x4b8d96
push esi
jmp 0x4b8da7
mov eax, dword [str.xnf]
mov ecx, dword [esp + 0x10]
mov eax, dword [eax + ecx*4]
test eax, eax
je 0x4b8dad
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov eax, dword [ebp + 0x18]
mov byte [esp + 0xf], 1
mov dword [eax], 1
mov dword [edi + 0x10], 1
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 0
push eax
mov dword [esp + 0x30], 0
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [esp + 0x28]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ScreenToClient]
mov eax, dword [ebx + 0x2c]
mov ebx, dword [eax + 0x24]
mov dword [esp + 0x10], ebx
mov edx, dword [ebx + 0x30]
test edx, edx
je 0x4b8e4b
mov ebx, dword [edx + 0xc]
mov ecx, dword [ebx + 0x28]
test ecx, ecx
je 0x4b8e41
mov eax, dword [ecx + 0x64]
mov eax, dword [eax + 0x80]
test eax, eax
je 0x4b8e41
cmp byte [eax + 0x60], 0
je 0x4b8e41
mov esi, dword [ecx + 0x24]
cmp dword [esp + 0x28], esi
jl 0x4b8e41
mov eax, dword [ecx + 0x2c]
add eax, esi
cmp dword [esp + 0x28], eax
jg 0x4b8e41
mov esi, dword [ecx + 0x28]
cmp dword [esp + 0x2c], esi
jl 0x4b8e41
mov eax, dword [ecx + 0x30]
add eax, esi
cmp dword [esp + 0x2c], eax
jle 0x4b8e4b
mov edx, dword [edx]
test edx, edx
jne 0x4b8dfc
mov ebx, dword [esp + 0x10]
push 0
mov edx, str.MousePointer
mov ecx, ebx
call fcn.004b6f93
mov esi, eax
test esi, esi
je case.0x4b930c.278
cmp esi, 0x63
jne 0x4b8efd
mov edx, str.MouseIcon
mov byte [esp + 0xf], 0
mov ecx, ebx
call fcn.004ba360
mov esi, eax
test esi, esi
je case.0x4b930c.278
mov ecx, dword [esi]
lea eax, [esp + 0x1c]
push eax
push 0x51cff4
push esi
mov dword [esp + 0x28], 0
call dword [ecx]
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x4b8ee7
mov dword [esp + 0x30], 0
lea edx, [esp + 0x30]
mov eax, dword [ecx]
push edx
push ecx
call dword [eax + 0xc]
mov eax, dword [esp + 0x30]
test eax, eax
je 0x4b8edd
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov eax, dword [ebp + 0x18]
mov byte [esp + 0xf], 1
mov dword [eax], 1
mov dword [edi + 0x10], 1
mov eax, dword [esp + 0x1c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esi]
push esi
call dword [eax + 8]
mov ebx, dword [ebp + 0x18]
mov dl, byte [esp + 0xf]
mov byte [edi + 0x14], 1
jmp 0x4b8b28
cmp esi, 0x13
jl 0x4b8f3b
mov eax, dword [ebp + 8]
xor esi, esi
test eax, eax
je 0x4b8f3b
push 0xfffffffffffffff4
push eax
call dword [sym.imp.USER32.dll_GetClassLongA]
mov ebx, eax
mov eax, dword [0x4cef68]
test eax, eax
jne 0x4b8f30
push 0x7f00
push eax
call dword [sym.imp.USER32.dll_LoadCursorW]
mov dword [0x4cef68], eax
test ebx, ebx
je 0x4b8f3b
cmp ebx, eax
je 0x4b8f3b
push ebx
jmp 0x4b8f48
mov eax, dword [str.xnf]
mov eax, dword [eax + esi*4]
test eax, eax
je 0x4b8f4e
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov ebx, dword [ebp + 0x18]
mov dl, 1
mov dword [ebx], 1
mov dword [edi + 0x10], 1
mov byte [edi + 0x14], dl
jmp 0x4b8b28
mov eax, dword [edi + 8]
movzx ecx, word [eax + 2]
movzx eax, word [eax]
mov dword [esp + 0x30], ecx
mov dword [esp + 0x10], eax
test esi, esi
je 0x4b8fa6
mov ebx, ecx
mov edi, eax
mov edx, dword [esi + 4]
test edx, edx
je 0x4b8f94
mov ecx, dword [edx]
push edi
movzx eax, bx
push eax
push edx
call dword [ecx + 0xc]
mov esi, dword [esi]
test esi, esi
jne 0x4b8f82
mov edi, dword [esp + 0x28]
mov ebx, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
test cx, cx
jne case.0x4b930c.278
cmp dword [ebx + 0x7c], 0xffffffff
je case.0x4b930c.278
test dword [ebx + 0x70], 0x1000
je 0x4b8fd1
mov ecx, ebx
call fcn.004b6a64
test al, al
je case.0x4b930c.278
mov eax, dword [ebx + 0x2c]
push 0
push dword [ebx + 0x7c]
mov edx, dword [eax + 0x24]
mov ecx, dword [edx + 0x18]
add ecx, 4
call fcn.004c13c4
mov ebx, dword [ebp + 0x18]
mov dl, byte [esp + 0xf]
mov byte [edi + 0x14], 1
jmp 0x4b8b28
test esi, esi
je case.0x4b930c.278
xor ecx, ecx
mov ebx, ecx
mov dword [esp + 0x120], ecx
mov dword [esp + 0x124], ecx
mov dword [esp + 0x128], ebx
mov dword [esp + 0x12c], ecx
mov edx, dword [esi + 4]
test edx, edx
je 0x4b904a
mov ecx, dword [edx]
lea eax, [esp + 0x120]
push eax
mov eax, dword [edi + 0xc]
push dword [eax]
push edx
call dword [ecx + 0x98]
mov ebx, dword [esp + 0x128]
mov ecx, dword [esp + 0x120]
test cx, cx
je 0x4b921c
xor edx, edx
mov byte [esp + 0xcc], 0
mov word [esp + 0xbc], dx
lea eax, [esp + 0x120]
cmp cx, 3
jne 0x4b908b
mov edx, ebx
mov dword [esp + 0xcd], 0
mov dword [esp + 0xb8], edx
jmp 0x4b91f5
mov edx, 0x4003
cmp cx, dx
jne 0x4b90ae
mov edx, dword [ebx]
mov dword [esp + 0xb8], edx
mov dword [esp + 0xcd], 0
jmp 0x4b91f5
xor edx, edx
mov dword [esp + 0xb8], edx
cmp cx, 0xa
jne 0x4b90e1
cmp ebx, 0x80020004
jne 0x4b915a
mov byte [esp + 0xcc], 1
mov dword [esp + 0xcd], 0x80020005
jmp 0x4b91f5
cmp cx, 9
je 0x4b90ee
cmp cx, word [esp + 0x10]
jne 0x4b915a
test ecx, 0x4000
je 0x4b90f8
mov ebx, dword [ebx]
test ebx, ebx
je 0x4b91ea
push 0
push 0
lea ecx, [esp + 0xc4]
xor eax, eax
push ecx
lea ecx, [esp + 0x74]
mov dword [esp + 0x74], eax
push ecx
push 3
push 0
push 0x519ca0
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], eax
mov dword [esp + 0x90], eax
mov eax, dword [ebx]
push 0
push ebx
call dword [eax + 0x18]
mov dword [esp + 0xcd], eax
test eax, eax
js 0x4b91e1
mov edx, dword [esp + 0xb8]
lea eax, [esp + 0xbc]
movzx ecx, word [eax]
cmp ecx, 1
jne 0x4b9172
mov dword [esp + 0xcd], 0x800a005e
jmp 0x4b91f5
xor edx, edx
mov dword [esp + 0xa0], edx
mov dword [esp + 0xa4], edx
mov dword [esp + 0xa8], edx
mov dword [esp + 0xac], edx
mov edx, 0x400c
cmp cx, dx
jne 0x4b91a3
nop
mov eax, dword [eax + 8]
cmp word [eax], dx
je 0x4b919b
push 3
push 2
push 0x400
push eax
lea eax, [esp + 0xb0]
push eax
call dword [sym.imp.OLEAUT32.dll_SafeArrayPtrOfIndex]
mov dword [esp + 0xcd], eax
test eax, eax
js 0x4b91e1
mov edx, dword [esp + 0xa8]
mov dword [esp + 0xb8], edx
mov dword [esp + 0xcd], 0
jmp 0x4b91f5
mov edx, dword [esp + 0xb8]
jmp 0x4b91f5
mov dword [esp + 0xcd], 0x800a005b
cmp word [esp + 0xbc], 0
mov ebx, dword [ebp + 0x18]
mov dword [ebx], edx
mov dword [edi + 0x10], edx
mov byte [edi + 0x14], 1
je 0x4b921f
lea eax, [esp + 0xbc]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
jmp 0x4b921f
mov ebx, dword [ebp + 0x18]
mov esi, dword [esi]
test esi, esi
jne 0x4b8fff
mov dl, byte [esp + 0xf]
mov byte [edi + 0x14], 1
jmp 0x4b8b28
mov dword [esp + 0x30], 0
test esi, esi
je case.0x4b930c.278
jmp 0x4b924b
mov edx, dword [esi + 4]
test edx, edx
je 0x4b9262
mov ecx, dword [edx]
lea eax, [esp + 0x30]
push eax
mov eax, dword [edi + 0xc]
push dword [eax]
push edx
call dword [ecx + 0x7c]
mov esi, dword [esi]
test esi, esi
jne 0x4b924b
jmp 0x4b929b
mov dword [esp + 0x30], 0
test esi, esi
je case.0x4b930c.278
nop
mov edx, dword [esi + 4]
test edx, edx
je 0x4b9295
mov ecx, dword [edx]
lea eax, [esp + 0x30]
push eax
mov eax, dword [edi + 0xc]
push dword [eax]
push edx
call dword [ecx + 0x80]
mov esi, dword [esi]
test esi, esi
jne 0x4b927b
cmp word [esp + 0x30], 0
mov ebx, dword [ebp + 0x18]
mov dl, byte [esp + 0xf]
je 0x4b9414
mov dword [ebx], 1
mov byte [edi + 0x14], 1
jmp 0x4b8b28
test esi, esi
je case.0x4b930c.278
lea ebx, [ebx]
mov edx, dword [esi + 4]
test edx, edx
je 0x4b92e1
mov eax, dword [edi + 8]
mov ecx, dword [edx]
push 0xffffffffffffffff
movzx eax, word [eax]
push eax
push edx
call dword [ecx + 0x20]
mov esi, dword [esi]
test esi, esi
jne 0x4b92cb
mov ebx, dword [ebp + 0x18]
mov dl, byte [esp + 0xf]
mov byte [edi + 0x14], 1
jmp 0x4b8b28
sub eax, 0x115
cmp eax, 0x23
ja case.0x4b930c.278
movzx eax, byte [eax + 0x4b7073]
jmp dword [eax*4 + 0x4b705b]
test esi, esi
je case.0x4b930c.278
mov edx, dword [esi + 4]
test edx, edx
je 0x4b9331
mov eax, dword [edi + 8]
mov ecx, dword [edx]
push 0
movzx eax, word [eax]
push eax
push edx
call dword [ecx + 0x20]
mov esi, dword [esi]
test esi, esi
jne 0x4b931b
mov ebx, dword [ebp + 0x18]
mov dl, byte [esp + 0xf]
mov byte [edi + 0x14], 1
jmp 0x4b8b28
test esi, esi
je case.0x4b930c.278
mov edx, dword [esi + 4]
test edx, edx
je 0x4b9367
mov ecx, dword [edx]
lea eax, [edi + 0x10]
push 0
push eax
mov eax, dword [edi + 8]
push dword [eax]
push edx
call dword [ecx + 0x18]
mov esi, dword [esi]
test esi, esi
jne 0x4b934f
mov ebx, dword [ebp + 0x18]
mov dl, byte [esp + 0xf]
mov byte [edi + 0x14], 1
jmp 0x4b8b28
test esi, esi
je case.0x4b930c.278
lea ebx, [ebx]
mov edx, dword [esi + 4]
test edx, edx
je 0x4b93a3
mov ecx, dword [edx]
lea eax, [edi + 0x10]
push 8
push eax
mov eax, dword [edi + 8]
push dword [eax]
push edx
call dword [ecx + 0x18]
mov esi, dword [esi]
test esi, esi
jne 0x4b938b
mov ebx, dword [ebp + 0x18]
mov dl, byte [esp + 0xf]
mov byte [edi + 0x14], 1
jmp 0x4b8b28
test esi, esi
je case.0x4b930c.278
mov edx, dword [esi + 4]
test edx, edx
je 0x4b93d5
mov ecx, dword [edx]
lea eax, [edi + 0x10]
push 1
push eax
mov eax, dword [edi + 8]
push dword [eax]
push edx
call dword [ecx + 0x18]
mov esi, dword [esi]
test esi, esi
jne 0x4b93bd
mov ebx, dword [ebp + 0x18]
mov dl, byte [esp + 0xf]
mov byte [edi + 0x14], 1
jmp 0x4b8b28
test esi, esi
je case.0x4b930c.278
mov edx, dword [esi + 4]
test edx, edx
je 0x4b9407
mov ecx, dword [edx]
lea eax, [edi + 0x10]
push 6
push eax
mov eax, dword [edi + 8]
push dword [eax]
push edx
call dword [ecx + 0x18]
mov esi, dword [esi]
test esi, esi
jne 0x4b93ef
mov ebx, dword [ebp + 0x18]
mov dl, byte [esp + 0xf]
mov byte [edi + 0x14], 1
jmp 0x4b8b28
mov ebx, dword [ebp + 0x18]
mov dl, byte [esp + 0xf]
jmp 0x4b8b28