Function at 0x10043500
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10092658
push eax
mov dword fs:[0], esp
sub esp, 0x1a4
cmp byte [0x101d8508], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
push esi
push edi
je 0x1004355d
mov esi, dword [0x101ce6b8]
lea eax, [ebp - 0x38]
push eax
push 0x40
push 5
push esi
call ebx
mov eax, 0x10043450
mov byte [esi], 0xe9
sub eax, esi
sub eax, 5
mov dword [esi + 1], eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x38]
push 5
push esi
call ebx
mov eax, dword [0x10b3c4d0]
mov ebx, dword [sym.imp.OPENGL32.dll_glDeleteTextures]
test eax, eax
jne 0x10043b09
mov eax, dword [0x101ce3f0]
push 0x1002c340
push 0xfffffffffffffffc
push eax
mov dword [0x10b3c4d0], 1
mov dword [0x101da0e4], eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov esi, dword [sym.imp.OPENGL32.dll_glGetIntegerv]
mov dword [0x101da0ec], eax
lea eax, [ebp - 0x38]
push eax
push 0x821b
call esi
lea eax, [ebp - 0x20]
push eax
push 0x821c
call esi
mov eax, dword [ebp - 0x38]
xor edx, edx
mov esi, dword [0x101da090]
lea ecx, [eax + eax*4]
mov eax, dword [ebp - 0x20]
lea eax, [eax + ecx*2]
movzx ecx, byte [0x10b3c264]
cmp eax, 0x20
cmovge ecx, edx
mov byte [0x10b3c264], cl
test esi, esi
je 0x100435e4
inc dword [esi + 0xa8]
push 0x60b0
call fcn.1007b185
add esp, 4
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0x45]
test eax, eax
je 0x10043605
push ecx
mov ecx, eax
call fcn.10005610
jmp 0x10043607
xor eax, eax
mov dword [0x101da090], eax
call fcn.1000aee0
mov eax, dword [0x101da090]
test esi, esi
cmovne eax, esi
mov dword [0x101da090], eax
call fcn.10027ba0
cmp byte [0x10b3c264], 0
jne 0x10043638
call fcn.1002c2f0
call fcn.10027040
mov edi, dword [0x101da090]
mov eax, dword [edi + 0x378c]
lea esi, [edi + 8]
test eax, eax
jns 0x1004367f
je 0x1004365f
cdq
sub eax, edx
lea edx, [esi + 0x3780]
mov ecx, eax
sar ecx, 1
add ecx, dword [edx + 4]
jmp 0x1004366a
mov ecx, 8
lea edx, [esi + 0x3780]
xor eax, eax
test ecx, ecx
cmovg eax, ecx
mov ecx, edx
push eax
call fcn.10018510
mov edi, dword [0x101da090]
mov ecx, esi
mov dword [esi + 0x3780], 0
call fcn.10006e30
movss xmm2, dword [0x100ad0d0]
push 0x100a6b24
push ecx
mov byte [esi + 0x50], 0
mov ecx, dword [edi + 0x40]
push str.c:WindowsFonts_arial.ttf
call fcn.10023870
mov edx, 0x65
xor ecx, ecx
nop word [eax + eax]
mov al, byte [ecx + 0x100a8d48]
xor al, dl
mov byte [ebp + ecx - 0x68], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x1d
jb 0x100436c0
movss xmm2, dword [0x100ad0e0]
lea eax, [ebp - 0x68]
push 0x100a6b24
push ecx
mov ecx, dword [esi + 0x38]
push eax
mov byte [ebp - 0x4b], 0
call fcn.10023870
mov dword [0x101da3b0], eax
mov edx, 0x35
xor ecx, ecx
mov al, byte [ecx + str.ejdHU_HTajV__b_r7_g__]
xor al, dl
mov byte [ebp + ecx - 0x63], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x18
jb 0x10043702
movss xmm2, dword [0x100ad0d8]
lea eax, [ebp - 0x63]
push 0
push ecx
mov ecx, dword [esi + 0x38]
push eax
mov byte [ebp - 0x4b], 0
call fcn.10023870
push 0x101da43c
push 1
mov dword [0x101da384], eax
mov dword [0x101da43c], 0
call ebx
mov edx, 0xb1
xor ecx, ecx
mov al, byte [ecx + 0x100a8d84]
xor al, dl
mov byte [ebp + ecx - 0x60], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x15
jb 0x10043754
push 0x101ce410
push 0x101ce40c
mov edx, 0x101da43c
mov byte [ebp - 0x4b], 0
lea ecx, [ebp - 0x60]
call fcn.10042af0
movaps xmm0, xmmword [0x100ad6f0]
add esp, 8
mov dword [edi + 0x37c0], 0x41200000
mov dword [edi + 0x37f4], 0x41400000
mov dword [edi + 0x381c], 0x41c80000
mov dword [edi + 0x3824], 0x41700000
mov dword [edi + 0x3828], 0x41100000
mov dword [edi + 0x382c], 0x41a00000
mov dword [edi + 0x3830], 0x41400000
mov dword [edi + 0x37e4], 0x40e00000
mov dword [edi + 0x37b0], 0x3f800000
mov dword [ebp - 0x34], 0x41700000
mov eax, dword [ebp - 0x34]
mov dword [edi + 0x37b8], eax
mov dword [ebp - 0x30], 0x41700000
mov eax, dword [ebp - 0x30]
mov dword [edi + 0x37bc], eax
mov dword [ebp - 0x34], 0x40a00000
mov eax, dword [ebp - 0x34]
mov dword [edi + 0x37ec], eax
mov dword [ebp - 0x30], 0x40a00000
mov eax, dword [ebp - 0x30]
mov dword [edi + 0x37f0], eax
mov dword [ebp - 0x34], 0x41400000
mov eax, dword [ebp - 0x34]
mov dword [edi + 0x37fc], eax
mov dword [ebp - 0x30], 0x41000000
mov eax, dword [ebp - 0x30]
mov dword [edi + 0x3800], eax
mov dword [ebp - 0x34], 0x41000000
mov eax, dword [ebp - 0x34]
mov dword [edi + 0x3804], eax
mov dword [ebp - 0x30], 0x40c00000
mov eax, dword [ebp - 0x30]
mov dword [edi + 0x3808], eax
movups xmmword [edi + 0x3878], xmm0
movaps xmm0, xmmword [0x100ad6f0]
movups xmmword [edi + 0x3888], xmm0
movaps xmm0, xmmword [0x100ad550]
movups xmmword [edi + 0x3898], xmm0
movaps xmm0, xmmword [0x100ad550]
movups xmmword [edi + 0x38a8], xmm0
movaps xmm0, xmmword [0x100ad550]
movups xmmword [edi + 0x38b8], xmm0
movaps xmm0, xmmword [0x100ad4e0]
movups xmmword [edi + 0x38c8], xmm0
movaps xmm0, xmmword [0x100ad4e0]
movups xmmword [edi + 0x38d8], xmm0
movaps xmm0, xmmword [0x100ad620]
movups xmmword [edi + 0x38e8], xmm0
movaps xmm0, xmmword [0x100ad670]
movups xmmword [edi + 0x38f8], xmm0
movaps xmm0, xmmword [0x100ad600]
movups xmmword [edi + 0x3908], xmm0
movaps xmm0, xmmword [0x100ad690]
movups xmmword [edi + 0x3918], xmm0
movaps xmm0, xmmword [0x100ad690]
movups xmmword [edi + 0x3928], xmm0
movaps xmm0, xmmword [0x100ad690]
movups xmmword [edi + 0x3938], xmm0
movaps xmm0, xmmword [0x100ad6b0]
movups xmmword [edi + 0x3948], xmm0
movaps xmm0, xmmword [0x100ad360]
movups xmmword [edi + 0x3958], xmm0
movaps xmm0, xmmword [0x100ad440]
movups xmmword [edi + 0x3968], xmm0
movaps xmm0, xmmword [0x100ad430]
movups xmmword [edi + 0x3978], xmm0
movaps xmm0, xmmword [0x100ad640]
movups xmmword [edi + 0x3988], xmm0
movaps xmm0, xmmword [0x100ad560]
movups xmmword [edi + 0x3998], xmm0
movaps xmm0, xmmword [0x100ad400]
movups xmmword [edi + 0x39a8], xmm0
movaps xmm0, xmmword [0x100ad390]
movups xmmword [edi + 0x39b8], xmm0
mov eax, dword [0x10b3c4d0]
movaps xmm0, xmmword [0x100ad620]
movups xmmword [edi + 0x39c8], xmm0
movaps xmm0, xmmword [0x100ad670]
movups xmmword [edi + 0x39d8], xmm0
movaps xmm0, xmmword [0x100ad600]
movups xmmword [edi + 0x39e8], xmm0
movaps xmm0, xmmword [0x100ad620]
movups xmmword [edi + 0x39f8], xmm0
movaps xmm0, xmmword [0x100ad670]
movups xmmword [edi + 0x3a08], xmm0
movaps xmm0, xmmword [0x100ad600]
movups xmmword [edi + 0x3a18], xmm0
movaps xmm0, xmmword [0x100ad5f0]
movups xmmword [edi + 0x3a28], xmm0
movaps xmm0, xmmword [0x100ad3f0]
movups xmmword [edi + 0x3a38], xmm0
movaps xmm0, xmmword [0x100ad550]
movups xmmword [edi + 0x3a48], xmm0
movaps xmm0, xmmword [0x100ad380]
movups xmmword [edi + 0x3a58], xmm0
movaps xmm0, xmmword [0x100ad3a0]
movups xmmword [edi + 0x3a68], xmm0
movaps xmm0, xmmword [0x100ad4a0]
movups xmmword [edi + 0x3a78], xmm0
movaps xmm0, xmmword [0x100ad3e0]
movups xmmword [edi + 0x3a88], xmm0
movaps xmm0, xmmword [0x100ad470]
movups xmmword [edi + 0x3a98], xmm0
movaps xmm0, xmmword [0x100ad520]
movups xmmword [edi + 0x3aa8], xmm0
movaps xmm0, xmmword [0x100ad4c0]
movups xmmword [edi + 0x3ab8], xmm0
movaps xmm0, xmmword [0x100ad550]
movups xmmword [edi + 0x3ac8], xmm0
movaps xmm0, xmmword [0x100ad5f0]
movups xmmword [edi + 0x3ad8], xmm0
movaps xmm0, xmmword [0x100ad5e0]
movups xmmword [edi + 0x3ae8], xmm0
movaps xmm0, xmmword [0x100ad510]
movups xmmword [edi + 0x3af8], xmm0
movaps xmm0, xmmword [0x100ad4f0]
movups xmmword [edi + 0x3b08], xmm0
movaps xmm0, xmmword [0x100ad2e0]
movups xmmword [edi + 0x3b68], xmm0
movaps xmm0, xmmword [0x100ad4a0]
movups xmmword [edi + 0x3b78], xmm0
movaps xmm0, xmmword [0x100ad420]
movups xmmword [edi + 0x3b88], xmm0
movaps xmm0, xmmword [0x100ad3c0]
movups xmmword [edi + 0x3b98], xmm0
movaps xmm0, xmmword [0x100ad2a0]
movups xmmword [edi + 0x3ba8], xmm0
movaps xmm0, xmmword [0x100ad2f0]
movups xmmword [edi + 0x3bb8], xmm0
cmp eax, 1
jne 0x100451d9
cmp byte [0x101ce3f4], 0
jne 0x10043b2e
cmp byte [0x101ce3f5], 0
mov dword [0x101da0e8], 0
je 0x10043b38
mov dword [0x101da0e8], 1
cmp byte [0x10b3c264], 0
je 0x10043b51
cmp dword [0x101da094], 0
jne 0x10043b5f
call fcn.10026f40
jmp 0x10043b5f
cmp dword [0x101da0d8], 0
jne 0x10043b5f
call fcn.10027980
call fcn.10028670
call fcn.1000a3e0
mov esi, dword [0x101da090]
lea eax, [esi + 8]
mov edi, dword [eax + 0x3784]
lea ecx, [eax + 0x3780]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x20], ecx
test edi, edi
jns 0x10043bb8
je 0x10043b97
mov eax, edi
cdq
sub eax, edx
mov ecx, eax
sar ecx, 1
add ecx, edi
jmp 0x10043b9c
mov ecx, 8
xor eax, eax
test ecx, ecx
cmovg eax, ecx
mov ecx, dword [ebp - 0x20]
push eax
call fcn.10018510
mov esi, dword [0x101da090]
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x20]
mov dword [ecx], 0
mov ecx, eax
call fcn.10006e30
mov eax, dword [ebp - 0x30]
mov edi, 1
push str.Foreground
mov edx, edi
mov byte [eax + 0x50], 0
mov eax, dword [esi + 0x3fe0]
mov eax, dword [eax]
movss xmm0, dword [eax + 0xc]
movss dword [0x101da440], xmm0
movss xmm0, dword [eax + 0x10]
or dword [esi + 0x3f14], 0x40
mov dword [esi + 0x3f68], 0x3f000000
add byte [0x101ce414], 2
add byte [0x101ce415], 3
add byte [0x101ce416], 4
mov eax, dword [esi + 0x3fe0]
movss dword [0x101da3a8], xmm0
mov ecx, dword [eax]
call fcn.10009260
mov esi, dword [0x101d92a8]
add esp, 4
cmp byte [0x101d8509], 0
mov dword [0x101da340], eax
je 0x10044276
mov eax, dword [0x101ce6b0]
cmp dword [eax], 5
jb 0x1004425a
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, dword [0xe8c578]
jne 0x10043deb
cmp byte [0x101d8509], 8
movzx ecx, byte [0x101d8509]
cmovae ecx, edi
mov byte [0x101d8509], cl
mov ecx, 0x101ce39c
call fcn.10034190
test al, al
je 0x10043cb3
cmp byte [0x101d8509], 1
jne 0x10043cb3
cmp byte [0x101ce3f4], 0
sete al
mov byte [0x101ce3f4], al
test al, al
jne 0x10043cb3
mov dword [0xe8cb3c], 0
mov ecx, 0x101ce3a4
call fcn.10034190
test al, al
je 0x10043ce7
cmp byte [0x101d8509], 2
jne 0x10043ce7
cmp byte [0x101ce3f4], 0
sete al
mov byte [0x101ce3f4], al
test al, al
jne 0x10043ce7
mov dword [0xe8cb3c], 0
mov ecx, 0x101ce37c
call fcn.10034190
test al, al
je 0x10043d1b
cmp byte [0x101d8509], 3
jne 0x10043d1b
cmp byte [0x101ce3f4], 0
sete al
mov byte [0x101ce3f4], al
test al, al
jne 0x10043d1b
mov dword [0xe8cb3c], 0
mov ecx, 0x101ce394
call fcn.10034190
test al, al
je 0x10043d4f
cmp byte [0x101d8509], 4
jne 0x10043d4f
cmp byte [0x101ce3f4], 0
sete al
mov byte [0x101ce3f4], al
test al, al
jne 0x10043d4f
mov dword [0xe8cb3c], 0
mov ecx, 0x101ce384
call fcn.10034190
test al, al
je 0x10043d83
cmp byte [0x101d8509], 5
jne 0x10043d83
cmp byte [0x101ce3f4], 0
sete al
mov byte [0x101ce3f4], al
test al, al
jne 0x10043d83
mov dword [0xe8cb3c], 0
mov ecx, 0x101ce3ac
call fcn.10034190
test al, al
je 0x10043db7
cmp byte [0x101d8509], 6
jne 0x10043db7
cmp byte [0x101ce3f4], 0
sete al
mov byte [0x101ce3f4], al
test al, al
jne 0x10043db7
mov dword [0xe8cb3c], 0
mov ecx, 0x101ce360
call fcn.10034190
test al, al
je 0x10043deb
cmp byte [0x101d8509], 7
jne 0x10043deb
cmp byte [0x101ce3f4], 0
sete al
mov byte [0x101ce3f4], al
test al, al
jne 0x10043df0
mov dword [0xe8cb3c], 0
mov al, byte [0x101ce3f4]
cmp al, 1
jne 0x1004423c
cmp dword [0x101da43c], 0
jne 0x10043e56
push 0x101da43c
push 1
mov dword [0x101da43c], 0
call ebx
mov edx, 0x34
xor ecx, ecx
nop dword [eax + eax]
mov al, byte [ecx + 0x100a8d9c]
xor al, dl
mov byte [ebp + ecx - 0x60], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x15
jb 0x10043e20
push 0x101ce410
push 0x101ce40c
mov edx, 0x101da43c
mov byte [ebp - 0x4b], 0
lea ecx, [ebp - 0x60]
call fcn.10042af0
add esp, 8
mov ecx, dword fs:[0x2c]
mov dword [0xe8cb3c], edi
mov eax, dword [0x10b3c4dc]
mov ecx, dword [ecx + esi*4]
cmp eax, dword [ecx + 4]
jle 0x10043eaa
push 0x10b3c4dc
call fcn.1006882c
add esp, 4
cmp dword [0x10b3c4dc], 0xffffffff
jne 0x10043eaa
push 0x10b3c4dc
mov dword [0x10b3c4bc], 0
mov dword [0x10b3c4c0], 0
call fcn.100687ed
add esp, 4
push 0x15e65824
lea ecx, [ebp - 0x15]
call fcn.10059110
push 0xbb
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.1000e8e0
add esp, 4
mov dword [ebp - 4], 0xffffffff
xorps xmm0, xmm0
movq qword [ebp - 0x15], xmm0
test al, al
je 0x10044276
mov eax, dword [0x101da090]
movss xmm0, dword [0x100ad100]
mov ecx, dword [eax + 0x3e30]
mov eax, dword [ecx + 0x10]
mov dword [0x10b3c4bc], eax
mov eax, dword [ecx + 0x14]
mov dword [0x10b3c4c0], eax
call fcn.10012030
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0x439d8000
mov dword [ebp - 0x14], 0x437a0000
call fcn.100111c0
mov edx, dword [0x101ce40c]
mov ecx, dword [0x101da43c]
movss xmm1, dword [0x100ad0e0]
movss xmm0, dword [0x100ad0c0]
mov dword [ebp - 0x38], 0x44140000
push dword [ebp - 0x38]
mov dword [ebp - 0x3c], 0x43938000
push dword [ebp - 0x3c]
mov dword [ebp - 0x20], 0x43e10000
push dword [ebp - 0x20]
mov dword [ebp - 0x24], 0
push dword [ebp - 0x24]
push dword [0x101ce410]
call fcn.10042c20
mov edx, dword [0x101ce40c]
mov ecx, dword [0x101da43c]
movss xmm1, dword [0x100ad0fc]
movss xmm0, dword [0x100ad0cc]
mov dword [ebp - 0x38], 0x43160000
push dword [ebp - 0x38]
mov dword [ebp - 0x3c], 0x43920000
push dword [ebp - 0x3c]
mov dword [ebp - 0x20], 0x42920000
push dword [ebp - 0x20]
mov dword [ebp - 0x24], 0x40400000
push dword [ebp - 0x24]
push dword [0x101ce410]
call fcn.10042c20
mov edx, dword [0x101ce40c]
xorps xmm1, xmm1
mov ecx, dword [0x101da43c]
movss xmm0, dword [0x100ad0c0]
mov dword [ebp - 0x38], 0x428a0000
push dword [ebp - 0x38]
mov dword [ebp - 0x3c], 0x43d78000
push dword [ebp - 0x3c]
mov dword [ebp - 0x20], 0x40400000
push dword [ebp - 0x20]
mov dword [ebp - 0x24], 0
push dword [ebp - 0x24]
push dword [0x101ce410]
call fcn.10042c20
mov ecx, dword [0x101da384]
add esp, 0x3c
call fcn.10010d30
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0x428c0000
mov dword [ebp - 0x14], 0x42200000
call fcn.10011f80
mov edx, 0x6b
xor ecx, ecx
nop word [eax + eax]
mov al, byte [ecx + str.KLMNOPQ1_:__84]
xor al, dl
mov byte [ebp + ecx - 0x1c], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0xe
jb 0x10044040
mov byte [ebp - 0xe], 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 1
movaps xmm0, xmmword [0x100ad580]
push eax
lea eax, [ebp - 0x44]
push eax
movups xmmword [ebp - 0x44], xmm0
call fcn.1002a920
add esp, 8
call fcn.10010e00
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0x432f0000
mov dword [ebp - 0x14], 0x42960000
call fcn.10011f80
call fcn.100120d0
push 0x8bf4b376
lea ecx, [ebp - 0x18]
call fcn.10059180
push ecx
push str.Hnh_nh_map_nv_mt_s_object_monster
mov edx, 0x101ce36c
mov dword [ebp - 4], 2
mov ecx, eax
call fcn.10042d20
add esp, 8
mov edx, 0xe4
xor ecx, ecx
nop
mov al, byte [ecx + 0x100a8e18]
xor al, dl
mov byte [ebp + ecx - 0x1b], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0xd
jb 0x100440d0
mov byte [ebp - 0xe], 0
push ecx
push str._phm_ctrl
mov edx, 0x101ce368
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x1b]
call fcn.10042d20
add esp, 8
mov edx, 0x3c
xor ecx, ecx
mov al, byte [ecx + str.kTP__61c___ha_fzd]
xor al, dl
mov byte [ebp + ecx - 0x5d], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x12
jb 0x10044110
mov byte [ebp - 0x4b], 0
push ecx
push str.F12:_hide_window_nCtrlF11:_show_all_the_windows
mov edx, 0x101ce36b
mov dword [ebp - 4], 4
lea ecx, [ebp - 0x5d]
call fcn.10042d20
add esp, 8
call fcn.10012240
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0x41d80000
mov dword [ebp - 0x14], 0x42960000
call fcn.10011f80
call fcn.100120d0
mov edx, 0x97
xor ecx, ecx
mov al, byte [ecx + 0x100a8e8c]
xor al, dl
mov byte [ebp + ecx - 0x1c], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0xe
jb 0x10044170
mov byte [ebp - 0xe], 0
push ecx
push 0x100a8e6c
mov edx, 0x101ce36d
mov dword [ebp - 4], 5
lea ecx, [ebp - 0x1c]
call fcn.10042d20
add esp, 8
mov edx, 0xc6
xor ecx, ecx
mov al, byte [ecx + 0x100a8ec8]
xor al, dl
mov byte [ebp + ecx - 0x1c], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0xe
jb 0x100441b0
mov byte [ebp - 0xe], 0
push ecx
push str.Hnh_nh_hiu_ng_chuyn_ng
mov edx, 0x101ce36e
mov dword [ebp - 4], 6
lea ecx, [ebp - 0x1c]
call fcn.10042d20
add esp, 8
mov edx, 0xf2
xor ecx, ecx
mov al, byte [ecx + 0x100a8f00]
xor al, dl
mov byte [ebp + ecx - 0x42], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0xd
jb 0x100441f0
mov byte [ebp - 0x35], 0
push ecx
push str.Hnh_nh_hiu_ng_c_nh
mov edx, 0x101ce36f
mov dword [ebp - 4], 7
lea ecx, [ebp - 0x42]
call fcn.10042d20
add esp, 8
mov dword [ebp - 4], 0xffffffff
call fcn.10012240
call fcn.10010800
jmp 0x10044276
cmp dword [0x101da43c], 0
je 0x10044276
push 0x101da43c
push 1
mov dword [0x101da43c], 0
call ebx
jmp 0x10044276
cmp dword [0x101da43c], 0
je 0x10044276
push 0x101da43c
push 1
call ebx
mov dword [0x101da43c], 0
cmp dword [0x101ce6b4], 0
mov eax, dword [0x101ce6ac]
mov edi, dword [eax]
mov dword [ebp - 0x38], edi
je 0x10044f91
cmp byte [0x101d8508], 0
je 0x10044f91
cmp byte [0x101ce3f5], 1
jne 0x10044f48
push 0x7a196022
lea ecx, [ebp - 0x15]
mov dword [0xe8cb3c], 1
call fcn.10059210
push 0xbf
mov ecx, eax
mov dword [ebp - 4], 8
call fcn.1000e8e0
add esp, 4
mov dword [ebp - 4], 0xffffffff
xorps xmm0, xmm0
movq qword [ebp - 0x15], xmm0
test al, al
je 0x10044f3f
mov eax, dword [0x101ce6d8]
mov eax, dword [eax]
cmp dword [0x100b9b50], eax
je 0x10044325
push 0x101da33c
push 1
mov dword [0x100b9b50], eax
mov dword [0x101da33c], 0
call ebx
push 0x101da424
push 1
mov dword [0x101da424], 0
call ebx
movss xmm0, dword [edi + 0x404]
divss xmm0, dword [0x100ad104]
cvttss2si ecx, xmm0
movss xmm0, dword [edi + 0x408]
divss xmm0, dword [0x100ad104]
mov byte [edi + 0xac], cl
mov dword [0x101da430], ecx
cvttss2si eax, xmm0
mov byte [edi + 0xb0], al
cmp dword [0x101da33c], 0
mov dword [0x101da464], eax
jne 0x10044457
push 0x101da33c
push 1
mov dword [0x101da33c], 0
call ebx
mov edx, 0x5a
xor ecx, ecx
nop dword [eax + eax]
mov al, byte [ecx + 0x100a8f18]
xor al, dl
mov byte [ebp + ecx - 0x60], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x15
jb 0x10044390
mov eax, dword [0x101ce6d8]
mov byte [ebp - 0x4b], 0
mov eax, dword [eax]
inc eax
push eax
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x1b0]
push eax
call fcn.1002c420
push 0x101ce400
push 0x101ce3fc
mov edx, 0x101da33c
lea ecx, [ebp - 0x1b0]
call fcn.10042af0
push 0x104
lea eax, [ebp - 0x1b0]
push 0
push eax
call fcn.10070060
add esp, 0x20
mov dword [0x101da424], 0
push 0x101da424
push 1
call ebx
mov edx, 0x58
xor ecx, ecx
nop
mov al, byte [ecx + 0x100a8f30]
xor al, dl
mov byte [ebp + ecx - 0x61], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x16
jb 0x10044410
push 0x101ce408
push 0x101ce404
mov edx, 0x101da424
mov byte [ebp - 0x4b], 0
lea ecx, [ebp - 0x61]
call fcn.10042af0
add esp, 8
call fcn.10010800
mov byte [0x101ce3f5], 0
jmp 0x10044f91
mov eax, dword fs:[0x2c]
mov ecx, dword [eax + esi*4]
mov eax, dword [0x10b3c4e4]
cmp eax, dword [ecx + 4]
jle 0x100444a4
push 0x10b3c4e4
call fcn.1006882c
add esp, 4
cmp dword [0x10b3c4e4], 0xffffffff
jne 0x100444a4
push 0x10b3c4e4
mov dword [0x10b3c4a8], 0
mov dword [0x10b3c4ac], 0
call fcn.100687ed
add esp, 4
movd xmm0, dword [0x101ce3fc]
mov esi, dword [0x101da090]
cvtdq2ps xmm0, xmm0
mov ecx, dword [esi + 0x3e30]
movss dword [ebp - 0x18], xmm0
movd xmm0, dword [0x101ce400]
mov eax, dword [ecx + 0x10]
cvtdq2ps xmm0, xmm0
mov dword [0x10b3c4a8], eax
mov eax, dword [ecx + 0x14]
lea ecx, [ebp - 0x18]
mov dword [0x10b3c4ac], eax
movss dword [ebp - 0x14], xmm0
call fcn.100111c0
mov eax, dword [0x101ce3fc]
movss xmm1, dword [0x101da440]
mulss xmm1, dword [0x100ad034]
cdq
sub eax, edx
mov ecx, dword [esi + 0x3e30]
sar eax, 1
push 0
movd xmm0, eax
mov eax, dword [0x101ce400]
cvtdq2ps xmm0, xmm0
cdq
sub eax, edx
lea edx, [ebp - 0x18]
sar eax, 1
subss xmm1, xmm0
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [ebp - 0x18], xmm1
movss xmm1, dword [0x101da3a8]
mulss xmm1, dword [0x100ad034]
subss xmm1, xmm0
movss dword [ebp - 0x14], xmm1
call fcn.10010fb0
mov edx, dword [0x101ce3fc]
mov eax, dword [0x101ce400]
mov ecx, dword [0x101da33c]
movss xmm1, dword [0x100ad14c]
movd xmm0, edx
cvtdq2ps xmm0, xmm0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
movss dword [ebp - 0x24], xmm0
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [ebp - 0x20], xmm0
push dword [ebp - 0x20]
movss xmm0, dword [0x100ad148]
push dword [ebp - 0x24]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push eax
call fcn.10042c20
mov eax, dword [ebp - 0x30]
add esp, 0x18
movss xmm4, dword [0x10b3c4a8]
xor ecx, ecx
movss xmm3, dword [0x10b3c4ac]
movss xmm5, dword [eax + 0xd48]
movss xmm6, dword [eax + 0xd4c]
movaps xmm0, xmm5
subss xmm0, xmm4
movaps xmm1, xmm6
subss xmm1, xmm3
mulss xmm0, dword [0x100ad034]
mulss xmm1, dword [0x100ad034]
cvttss2si esi, xmm0
movss xmm0, dword [0x100ad114]
subss xmm0, xmm1
cvttss2si eax, xmm0
mov dword [ebp - 0x30], eax
call fcn.10008ff0
test al, al
je 0x100447ba
comiss xmm5, xmm4
jb 0x100447ba
comiss xmm6, xmm3
jb 0x100447ba
movd xmm0, dword [0x101ce3fc]
cvtdq2ps xmm0, xmm0
addss xmm0, xmm4
comiss xmm0, xmm5
jb 0x100447ba
movd xmm0, dword [0x101ce400]
cvtdq2ps xmm0, xmm0
addss xmm0, xmm3
comiss xmm0, xmm6
jb 0x100447ba
mov ecx, dword [ebp - 0x30]
mov eax, dword [0x101ce6b4]
shl ecx, 8
add ecx, esi
movzx eax, word [eax + ecx*2]
test ax, ax
je 0x10044670
cmp eax, 1
jne 0x100447ba
xor ecx, ecx
call fcn.10012ae0
mov eax, dword [0x101da090]
movss xmm0, dword [eax + 0x3bcc]
mulss xmm0, dword [0x100ad0ec]
call fcn.10010e70
mov edx, 0xed
xor ecx, ecx
nop dword [eax + eax]
mov al, byte [ecx + 0x100a8f48]
xor al, dl
mov byte [ebp + ecx - 0xa9], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x40
jb 0x100446a0
push dword [ebp - 0x30]
mov eax, dword [0x101ce6d8]
push esi
mov byte [ebp - 0x69], 0
push dword [eax]
lea eax, [ebp - 0xa9]
push eax
lea eax, [ebp - 0x1b0]
push eax
call fcn.1002c420
add esp, 0x10
lea ecx, [ebp - 0x1b0]
xor edx, edx
call fcn.1002a440
call fcn.10010ef0
call fcn.10010800
push 0x104
lea eax, [ebp - 0x1b0]
push 0
push eax
call fcn.10070060
add esp, 0x10
mov ecx, 0x101ce38c
call fcn.10034190
test al, al
je 0x100447ba
cmp byte [0x101da1f7], 0
jne 0x100447ba
mov edx, dword [ebp - 0x30]
mov ecx, esi
call fcn.10043470
cmp dword [0x101da3d4], 0
mov eax, dword [ebp - 0x30]
mov dword [0x101da3a0], esi
mov dword [0x101da3ac], eax
jne 0x1004476d
push 0
push 0
push ecx
push 0
push 0x10043290
sub esp, 8
mov dword [0x101da3d4], 1
push 0
call fcn.10062a20
mov eax, dword [0x101da430]
mov ecx, dword [0x101da464]
mov byte [edi + 0xac], al
imul eax, eax, 0x64
mov dword [0x101da3d4], 2
mov byte [edi + 0xb0], cl
add eax, 0x32
movd xmm0, eax
imul eax, ecx, 0x64
cvtdq2ps xmm0, xmm0
add eax, 0x32
movss dword [edi + 0x404], xmm0
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [edi + 0x408], xmm0
jmp 0x100447c8
mov eax, dword [0x101da3d4]
cmp eax, 2
jne 0x10044954
movss xmm0, dword [0x101da440]
lea eax, [ebp - 0x18]
addss xmm0, dword [0x100ad0d0]
movss xmm3, dword [0x10b3c4ac]
xorps xmm1, xmm1
push 0
push ecx
mov ecx, dword [0x101da340]
movss dword [ebp - 0x18], xmm0
movaps xmm0, xmm3
subss xmm3, dword [0x100ad0e8]
mov dword [esp], 0
subss xmm0, xmm1
push 0x96000000
push eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0xc1200000
push eax
movss dword [ebp - 0x14], xmm0
movss dword [ebp - 0x20], xmm3
call fcn.100229b0
mov ecx, dword [0x101da3b0]
call fcn.10010d30
push 0x694f1056
lea ecx, [ebp - 0x5d]
call fcn.10059280
movzx ecx, byte [0x101ce414]
movss xmm1, dword [0x100ad008]
mov dword [ebp - 0x20], 0x3f800000
movd xmm0, ecx
movzx ecx, byte [0x101ce415]
cvtdq2ps xmm0, xmm0
mulss xmm0, xmm1
movss dword [ebp - 0x2c], xmm0
movd xmm0, ecx
movzx ecx, byte [0x101ce416]
cvtdq2ps xmm0, xmm0
push ecx
push eax
mulss xmm0, xmm1
movss dword [ebp - 0x28], xmm0
movd xmm0, ecx
lea ecx, [ebp - 0x2c]
cvtdq2ps xmm0, xmm0
mulss xmm0, xmm1
movss dword [ebp - 0x24], xmm0
movss xmm0, dword [0x101da440]
mulss xmm0, dword [0x100ad034]
subss xmm0, dword [0x100ad104]
addss xmm0, dword [0x100ad068]
movss dword [ebp - 0x18], xmm0
movss xmm0, dword [0x10b3c4ac]
subss xmm0, dword [0x100ad0e4]
addss xmm0, dword [0x100ad068]
movss dword [ebp - 0x14], xmm0
call fcn.10007750
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.10022ce0
push 0x694f1056
lea ecx, [ebp - 0x5d]
call fcn.10059280
movaps xmm0, xmmword [0x100ad6f0]
movups xmmword [ebp - 0x2c], xmm0
push ecx
movss xmm0, dword [0x101da440]
lea ecx, [ebp - 0x2c]
mulss xmm0, dword [0x100ad034]
push eax
subss xmm0, dword [0x100ad104]
movss dword [ebp - 0x18], xmm0
movss xmm0, dword [0x10b3c4ac]
subss xmm0, dword [0x100ad0e4]
movss dword [ebp - 0x14], xmm0
call fcn.10007750
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.10022ce0
call fcn.10010e00
mov eax, dword [0x101da3d4]
cmp byte [0x101da1f7], 0
je 0x10044ced
cmp eax, 1
jne 0x10044b04
movss xmm0, dword [0x101da440]
lea eax, [ebp - 0x18]
addss xmm0, dword [0x100ad0d0]
movss xmm3, dword [0x10b3c4ac]
xorps xmm1, xmm1
push 0
push ecx
mov ecx, dword [0x101da340]
movss dword [ebp - 0x18], xmm0
movaps xmm0, xmm3
subss xmm3, dword [0x100ad0e8]
mov dword [esp], 0
subss xmm0, xmm1
push 0x96000000
push eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0xc1200000
push eax
movss dword [ebp - 0x14], xmm0
movss dword [ebp - 0x20], xmm3
call fcn.100229b0
mov ecx, dword [0x101da3b0]
call fcn.10010d30
mov al, byte [0x10b3c48c]
mov edi, dword [0x101d8910]
test al, al
jne 0x100449e9
inc edi
jmp 0x100449ee
cmp al, 1
jne 0x100449f4
dec edi
mov dword [0x101d8910], edi
cmp edi, 0x64
jge 0x100449fd
test edi, edi
jg 0x10044a06
test al, al
sete byte [0x10b3c48c]
mov esi, 0x100a8fa0
lea ecx, [ebp - 0x60]
sub esi, 0x4aa5565d
push esi
call fcn.100592c0
movaps xmm0, xmmword [0x100ad4d0]
movss xmm1, dword [0x101da440]
mulss xmm1, dword [0x100ad034]
push ecx
movups xmmword [ebp - 0x2c], xmm0
lea ecx, [ebp - 0x2c]
movd xmm0, edi
subss xmm1, dword [0x100ad104]
cvtdq2ps xmm0, xmm0
push eax
addss xmm1, dword [0x100ad068]
subss xmm0, dword [0x100ad0f4]
addss xmm1, xmm0
movss xmm0, dword [0x10b3c4ac]
subss xmm0, dword [0x100ad0e4]
movss dword [ebp - 0x18], xmm1
addss xmm0, dword [0x100ad068]
movss dword [ebp - 0x14], xmm0
call fcn.10007750
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.10022ce0
push esi
lea ecx, [ebp - 0x60]
call fcn.100592c0
movaps xmm0, xmmword [0x100ad540]
movd xmm1, dword [0x101d8910]
movups xmmword [ebp - 0x2c], xmm0
push ecx
movss xmm0, dword [0x101da440]
lea ecx, [ebp - 0x2c]
mulss xmm0, dword [0x100ad034]
push eax
cvtdq2ps xmm1, xmm1
subss xmm0, dword [0x100ad104]
subss xmm1, dword [0x100ad0f4]
addss xmm1, xmm0
movss xmm0, dword [0x10b3c4ac]
subss xmm0, dword [0x100ad0e4]
movss dword [ebp - 0x18], xmm1
movss dword [ebp - 0x14], xmm0
call fcn.10007750
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.10022ce0
call fcn.10010e00
mov edi, dword [0x101da87c]
mov esi, dword [0x101da878]
mov edx, dword [0x101da3a0]
mov ecx, dword [0x101da3ac]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x30], ecx
cmp esi, edi
je 0x10044c4e
nop word [eax + eax]
mov ebx, dword [esi]
cmp ebx, 0x100
je 0x10044c2f
mov eax, dword [esi + 4]
cmp eax, 0x100
je 0x10044c2f
sub ecx, eax
mov eax, edx
sub eax, ebx
imul ecx, ecx
imul eax, eax
add eax, ecx
movd xmm0, eax
cvtdq2pd xmm0, xmm0
call fcn.100906d0
cvttsd2si eax, xmm0
cmp eax, 0xa
jl 0x10044bdc
mov eax, dword [esi + 4]
lea edx, [ebp - 0x5c]
movaps xmm0, xmmword [0x100ad530]
movss xmm1, dword [0x10b3c4ac]
addss xmm1, dword [0x100ad114]
mov dword [ebp - 0x30], eax
add eax, eax
movups xmmword [ebp - 0x5c], xmm0
push ecx
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x20], ebx
movd xmm0, eax
lea eax, [ebx + ebx]
cvtdq2ps xmm0, xmm0
addss xmm0, dword [0x10b3c4a8]
movss dword [ebp - 0x18], xmm0
movd xmm0, eax
cvtdq2ps xmm0, xmm0
subss xmm1, xmm0
addss xmm1, dword [0x100ad114]
movss dword [ebp - 0x14], xmm1
movss xmm1, dword [0x100ad0a0]
call fcn.1002c3c0
add esp, 4
mov ecx, dword [0x101da430]
mov eax, dword [0x101da464]
mov ebx, dword [esi + 4]
sub ecx, ebx
sub eax, dword [esi]
imul ecx, ecx
imul eax, eax
add ecx, eax
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
call fcn.100906d0
cvttsd2si eax, xmm0
cmp eax, 2
jg 0x10044c29
mov edx, dword [esi]
mov ecx, ebx
call fcn.10043470
mov dword [esi], 0x100
mov dword [esi + 4], 0x100
mov byte [0x101da26d], 1
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x20]
add esi, 8
cmp esi, edi
jne 0x10044b30
mov edx, dword [0x101da3a0]
mov esi, dword [0x101da3ac]
mov ebx, dword [sym.imp.OPENGL32.dll_glDeleteTextures]
jmp 0x10044c50
mov esi, ecx
mov eax, dword [0x10b3c4f4]
mov dword [ebp - 0x14], 0x42680000
push dword [ebp - 0x14]
mov dword [ebp - 0x20], 0x420c0000
lea ecx, [eax*8]
sub ecx, eax
lea eax, [ecx*2 + 0x32]
movd xmm0, eax
lea eax, [ecx*2 + 0x26]
cvtdq2ps xmm0, xmm0
mov ecx, 0x1e5
movss dword [ebp - 0x18], xmm0
push dword [ebp - 0x18]
movd xmm0, eax
lea eax, [esi + esi]
push dword [ebp - 0x20]
cvtdq2ps xmm0, xmm0
sub ecx, eax
lea eax, [edx*2 - 0xa]
mov edx, dword [0x101ce404]
movd xmm1, ecx
mov ecx, dword [0x101da424]
movss dword [ebp - 0x24], xmm0
push dword [ebp - 0x24]
movd xmm0, eax
push dword [0x101ce408]
cvtdq2ps xmm1, xmm1
cvtdq2ps xmm0, xmm0
call fcn.10042c20
mov eax, dword [0x10b3c4f4]
xor ecx, ecx
mov edi, dword [ebp - 0x38]
inc eax
add esp, 0x14
cmp eax, 3
cmovge eax, ecx
mov dword [0x10b3c4f4], eax
movzx eax, byte [0x101ce414]
lea edx, [ebp - 0x2c]
movss xmm1, dword [0x100ad008]
push ecx
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x20], 0x3f800000
movd xmm0, eax
movzx eax, byte [0x101ce415]
cvtdq2ps xmm0, xmm0
mulss xmm0, xmm1
movss dword [ebp - 0x2c], xmm0
movd xmm0, eax
movzx eax, byte [0x101ce416]
cvtdq2ps xmm0, xmm0
mulss xmm0, xmm1
movss dword [ebp - 0x28], xmm0
movd xmm0, eax
mov eax, dword [0x101da430]
cvtdq2ps xmm0, xmm0
add eax, eax
mulss xmm0, xmm1
movss xmm1, dword [0x10b3c4ac]
addss xmm1, dword [0x100ad114]
movss dword [ebp - 0x24], xmm0
movd xmm0, eax
mov eax, dword [0x101da464]
cvtdq2ps xmm0, xmm0
add eax, eax
addss xmm0, dword [0x10b3c4a8]
movss dword [ebp - 0x18], xmm0
movd xmm0, eax
cvtdq2ps xmm0, xmm0
subss xmm1, xmm0
addss xmm1, dword [0x100ad114]
movss dword [ebp - 0x14], xmm1
movss xmm1, dword [0x100ad0bc]
call fcn.1002c3c0
mov ecx, dword [0x101da378]
add esp, 4
cmp ecx, 0x64
jg 0x10044e78
movzx eax, byte [0x101ce414]
lea edx, [ebp - 0x2c]
movss xmm1, dword [0x100ad008]
inc ecx
movss xmm2, dword [0x10b3c4ac]
addss xmm2, dword [0x100ad114]
movd xmm0, eax
movzx eax, byte [0x101ce415]
cvtdq2ps xmm0, xmm0
mov dword [0x101da378], ecx
push ecx
mov dword [ebp - 0x20], 0x3f169697
mulss xmm0, xmm1
movss dword [ebp - 0x2c], xmm0
movd xmm0, eax
movzx eax, byte [0x101ce416]
cvtdq2ps xmm0, xmm0
mulss xmm0, xmm1
movss dword [ebp - 0x28], xmm0
movd xmm0, eax
mov eax, dword [0x101da430]
cvtdq2ps xmm0, xmm0
add eax, eax
mulss xmm0, xmm1
movss xmm1, dword [0x100ad104]
movss dword [ebp - 0x24], xmm0
movd xmm0, eax
mov eax, dword [0x101da464]
cvtdq2ps xmm0, xmm0
add eax, eax
addss xmm0, dword [0x10b3c4a8]
movss dword [ebp - 0x18], xmm0
movd xmm0, eax
cvtdq2ps xmm0, xmm0
subss xmm2, xmm0
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
lea ecx, [ebp - 0x18]
addss xmm2, dword [0x100ad114]
subss xmm1, xmm0
movss dword [ebp - 0x14], xmm2
call fcn.1002c3c0
add esp, 4
cmp byte [edi + 0x30c], 0
je 0x10044e87
cmp byte [edi + 0x24], 0
je 0x10044ed9
mov eax, dword [0x101da3d4]
mov esi, 1
test eax, eax
mov byte [0x101da26d], 0
push 0x101da33c
cmovne eax, esi
mov byte [0x101da1f7], 0
push esi
mov dword [0x101da3d4], eax
mov dword [0x101da378], 0
mov dword [0x101da33c], 0
call ebx
push 0x101da424
push esi
mov dword [0x101da424], 0
call ebx
jmp 0x10044ede
mov esi, 1
cmp byte [0x101da26d], 0
je 0x10044f3a
cmp byte [edi + 0x78], 0
jne 0x10044f3a
mov eax, dword [0x101da3d4]
test eax, eax
push 0x101da33c
cmovne eax, esi
mov byte [0x101da26d], 0
push 1
mov dword [0x101da3d4], eax
mov byte [0x101da1f7], 0
mov dword [0x101da378], 0
mov dword [0x101da33c], 0
call ebx
push 0x101da424
push 1
mov dword [0x101da424], 0
call ebx
call fcn.10010800
mov byte [0x101ce3f5], 0
jmp 0x10044f91
mov eax, dword [0x101da3d4]
mov esi, 1
test eax, eax
mov byte [0x101da1f7], 0
push 0x101da33c
cmovne eax, esi
mov dword [0x101da378], 0
push esi
mov dword [0x101da3d4], eax
mov dword [0x101da33c], 0
call ebx
push 0x101da424
push esi
mov dword [0x101da424], 0
call ebx
call fcn.1000b8b0
call fcn.1000bb80
mov eax, dword [0x101da090]
xor ecx, ecx
mov eax, dword [eax + 0x3fe0]
mov eax, dword [eax]
add eax, 0x38
cmp byte [0x10b3c264], cl
je 0x10044fc1
cmp byte [eax], cl
cmovne ecx, eax
call fcn.10026b90
jmp 0x10044fcb
cmp byte [eax], cl
cmovne ecx, eax
call fcn.10027090
push dword [0x101ce374]
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x10044fee
cmp byte [0x101ce378], 0
jne 0x10044ff5
mov byte [0x101ce378], 1
jmp 0x10044ff5
mov byte [0x101ce378], 0
mov eax, dword [0x10b3c498]
test eax, eax
je 0x1004512f
cmp byte [eax], 0
jne 0x1004512f
cmp byte [0x101ce36c], 0
mov ebx, 0x100a8fb8
mov edi, dword [0x101ce66c]
mov eax, 0x1009ef5c
mov esi, ebx
cmovne esi, eax
lea eax, [ebp - 0x20]
push eax
push 0x40
push 1
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov al, byte [esi]
mov byte [edi], al
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 1
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp byte [0x101ce36d], 0
mov eax, 0x1009ef5c
mov edi, dword [0x101ce670]
mov esi, ebx
cmovne esi, eax
lea eax, [ebp - 0x20]
push eax
push 0x40
push 1
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov al, byte [esi]
mov byte [edi], al
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 1
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp byte [0x101ce36d], 0
mov eax, 0x1009ef5c
mov edi, dword [0x101ce674]
mov esi, ebx
cmovne esi, eax
lea eax, [ebp - 0x20]
push eax
push 0x40
push 1
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov al, byte [esi]
mov byte [edi], al
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 1
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp byte [0x101ce36e], 0
mov eax, 0x1009ef5c
mov edi, dword [0x101ce678]
mov esi, ebx
cmovne esi, eax
lea eax, [ebp - 0x20]
push eax
push 0x40
push 1
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov al, byte [esi]
mov byte [edi], al
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 1
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call edi
cmp byte [0x101ce36f], 0
mov eax, 0x1009ef5c
cmovne ebx, eax
mov esi, dword [0x101ce67c]
lea eax, [ebp - 0x20]
push eax
push 0x40
push 1
push esi
call edi
mov al, byte [ebx]
mov byte [esi], al
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push 1
push esi
call edi
mov edi, dword [ebp - 0x38]
jmp 0x1004514d
push 0x3f6f144f
lea ecx, [ebp - 0x17]
call fcn.10059300
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
add eax, 0x555
mov dword [0x10b3c498], eax
cmp byte [0x101ce368], 0
je 0x100451b2
cmp byte [edi + 0xe], 0
jne 0x100451a9
mov eax, dword [0x101ce6bc]
mov eax, dword [eax]
test eax, eax
js 0x100451a9
cmp eax, 0x190
jge 0x100451a9
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, dword [0xe8c578]
jne 0x100451a9
push 0
push 0
push 0
push 0x11
call dword [sym.imp.USER32.dll_keybd_event]
pop edi
pop esi
mov byte [0x10b3c4b4], 1
mov byte [0x10b3c49c], 1
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov byte [0x10b3c4b4], 0
jmp 0x100451bb
cmp byte [0x10b3c4b4], 0
jne 0x100451d9
cmp byte [0x10b3c49c], 1
jne 0x100451d9
push 0
push 2
push 0
push 0x11
call dword [sym.imp.USER32.dll_keybd_event]
mov byte [0x10b3c49c], 0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret