Function at 0x404a10
Capabilities:
Inspect section memory permissions
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0xa0
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], eax
call eax
mov ecx, 0x8000
mov ebx, 0x30
and ax, cx
movzx edi, ax
cmp ebx, 0x60
je 0x404bbd
cmp ebx, 0x61
je 0x404bbd
cmp ebx, 0x62
je 0x404bbd
cmp ebx, 0x63
je 0x404bbd
cmp ebx, 0x64
je 0x404bbd
cmp ebx, 0x65
je 0x404bbd
cmp ebx, 0x66
je 0x404bbd
cmp ebx, 0x67
je 0x404bbd
cmp ebx, 0x68
je 0x404bbd
cmp ebx, 0x69
je 0x404bbd
push ebx
call fcn.004067f0
test al, al
je 0x404bbd
cmp ebx, 0x6a
je 0x404bbd
cmp ebx, 0x6f
je 0x404bbd
cmp ebx, 0x6d
je 0x404bbd
cmp ebx, 0x6b
je 0x404bbd
mov cl, bl
mov byte [esp + 0x14], cl
test di, di
jne 0x404aea
push ebx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
mov cl, al
add esp, 4
mov byte [esp + 0x14], cl
cmp cl, 0x31
jne 0x404aff
test di, di
je 0x404b86
mov cl, 0x21
jmp 0x404b82
cmp cl, 0x32
jne 0x404b0d
test di, di
je 0x404b86
mov cl, 0x40
jmp 0x404b82
cmp cl, 0x33
jne 0x404b1b
test di, di
je 0x404b86
mov cl, 0x23
jmp 0x404b82
cmp cl, 0x34
jne 0x404b29
test di, di
je 0x404b86
mov cl, 0x24
jmp 0x404b82
cmp cl, 0x35
jne 0x404b37
test di, di
je 0x404b86
mov cl, 0x25
jmp 0x404b82
cmp cl, 0x36
jne 0x404b45
test di, di
je 0x404b86
mov cl, 0x5e
jmp 0x404b82
cmp cl, 0x37
jne 0x404b53
test di, di
je 0x404b86
mov cl, 0x26
jmp 0x404b82
cmp cl, 0x38
jne 0x404b61
test di, di
je 0x404b86
mov cl, 0x2a
jmp 0x404b82
cmp cl, 0x39
jne 0x404b6f
test di, di
je 0x404b86
mov cl, 0x28
jmp 0x404b82
cmp cl, 0x30
jne 0x404b86
test di, di
movzx ecx, cl
mov eax, 0x29
cmovne ecx, eax
mov byte [esp + 0x14], cl
mov edx, dword [esi + 0x10]
cmp edx, dword [esi + 0x14]
jae 0x404ba8
cmp dword [esi + 0x14], 0x10
lea eax, [edx + 1]
mov dword [esi + 0x10], eax
mov eax, esi
jb 0x404b9e
mov eax, dword [esi]
mov byte [eax + edx], cl
mov byte [eax + edx + 1], 0
jmp 0x404bbd
push dword [esp + 0x14]
mov byte [esp + 0x14], 0
push dword [esp + 0x14]
push ecx
mov ecx, esi
call fcn.004060e0
inc ebx
cmp ebx, 0x70
jl 0x404a43
push 0xbc
call dword [esp + 0x1c]
bt ax, 0xf
jae 0x404c8e
mov edx, dword [0x40cfdc]
xor eax, eax
mov ebx, dword [0x40cfd8]
mov ecx, edx
and ecx, 0x10000000
or eax, ecx
jne 0x404ca2
or edx, 0x10000000
mov dword [0x40cfd8], ebx
lea eax, [esi + 0x14]
mov dword [0x40cfdc], edx
mov edx, dword [eax]
lea ebx, [esi + 0x10]
mov ecx, dword [ebx]
mov dword [esp + 0x14], eax
mov eax, edx
sub eax, ecx
test di, di
jne 0x404c58
cmp eax, 1
jb 0x404c3d
lea eax, [ecx + 1]
mov dword [ebx], eax
mov eax, esi
cmp edx, 0x10
jb 0x404c35
mov eax, dword [esi]
mov word [eax + ecx], 0x2c
jmp 0x404cac
push 1
push str.______:_______n0123456789
mov byte [esp + 0x18], 0
mov ecx, esi
push dword [esp + 0x18]
push 1
call fcn.00406220
jmp 0x404cac
cmp eax, 1
jb 0x404c73
lea eax, [ecx + 1]
mov dword [ebx], eax
mov eax, esi
cmp edx, 0x10
jb 0x404c6b
mov eax, dword [esi]
mov word [eax + ecx], 0x3c
jmp 0x404ca5
push 1
push 0x40989c
mov byte [esp + 0x18], 0
mov ecx, esi
push dword [esp + 0x18]
push 1
call fcn.00406220
jmp 0x404ca5
mov eax, dword [0x40cfd8]
and dword [0x40cfdc], 0xefffffff
mov dword [0x40cfd8], eax
lea ebx, [esi + 0x10]
lea eax, [esi + 0x14]
mov dword [esp + 0x14], eax
push 0xbf
call dword [esp + 0x1c]
bt ax, 0xf
mov eax, dword [0x40cfd8]
jae 0x404d6b
mov ecx, dword [0x40cfdc]
test ecx, ecx
jl 0x404d7a
jg 0x404cdd
test eax, eax
jb 0x404d7a
mov dword [0x40cfd8], eax
or ecx, 0x80000000
mov eax, dword [esp + 0x14]
mov dword [0x40cfdc], ecx
mov ecx, dword [ebx]
mov edx, dword [eax]
mov eax, edx
sub eax, ecx
test di, di
jne 0x404d35
cmp eax, 1
jb 0x404d1a
lea eax, [ecx + 1]
mov dword [ebx], eax
mov eax, esi
cmp edx, 0x10
jb 0x404d12
mov eax, dword [esi]
mov word [eax + ecx], 0x2f
jmp 0x404d7a
push 1
push 0x4098a0
mov byte [esp + 0x18], 0
mov ecx, esi
push dword [esp + 0x18]
push 1
call fcn.00406220
jmp 0x404d7a
cmp eax, 1
jb 0x404d50
lea eax, [ecx + 1]
mov dword [ebx], eax
mov eax, esi
cmp edx, 0x10
jb 0x404d48
mov eax, dword [esi]
mov word [eax + ecx], 0x3f
jmp 0x404d7a
push 1
push 0x4098a4
mov byte [esp + 0x18], 0
mov ecx, esi
push dword [esp + 0x18]
push 1
call fcn.00406220
jmp 0x404d7a
and dword [0x40cfdc], 0x7fffffff
mov dword [0x40cfd8], eax
push 0xbe
call dword [esp + 0x1c]
bt ax, 0xf
jae 0x404e39
mov edx, dword [0x40cfdc]
xor eax, eax
mov ecx, edx
and ecx, 0x40000000
or eax, ecx
jne 0x404e4d
mov eax, dword [0x40cfd8]
or edx, 0x40000000
mov dword [0x40cfd8], eax
mov eax, dword [esp + 0x14]
mov dword [0x40cfdc], edx
mov ecx, dword [ebx]
mov edx, dword [eax]
mov eax, edx
sub eax, ecx
test di, di
jne 0x404e03
cmp eax, 1
jb 0x404de8
lea eax, [ecx + 1]
mov dword [ebx], eax
mov eax, esi
cmp edx, 0x10
jb 0x404de0
mov eax, dword [esi]
mov word [eax + ecx], 0x2e
jmp 0x404e4d
push 1
push 0x4095b4
mov byte [esp + 0x18], 0
mov ecx, esi
push dword [esp + 0x18]
push 1
call fcn.00406220
jmp 0x404e4d
cmp eax, 1
jb 0x404e1e
lea eax, [ecx + 1]
mov dword [ebx], eax
mov eax, esi
cmp edx, 0x10
jb 0x404e16
mov eax, dword [esi]
mov word [eax + ecx], 0x3e
jmp 0x404e4d
push 1
push 0x4098a8
mov byte [esp + 0x18], 0
mov ecx, esi
push dword [esp + 0x18]
push 1
call fcn.00406220
jmp 0x404e4d
mov eax, dword [0x40cfd8]
and dword [0x40cfdc], 0xbfffffff
mov dword [0x40cfd8], eax
push 0xba
call dword [esp + 0x1c]
bt ax, 0xf
jae 0x404f0c
mov edx, dword [0x40cfdc]
xor eax, eax
mov ecx, edx
and ecx, 0x4000000
or eax, ecx
jne 0x404f20
mov eax, dword [0x40cfd8]
or edx, 0x4000000
mov dword [0x40cfd8], eax
mov eax, dword [esp + 0x14]
mov dword [0x40cfdc], edx
mov ecx, dword [ebx]
mov edx, dword [eax]
mov eax, edx
sub eax, ecx
test di, di
jne 0x404ed6
cmp eax, 1
jb 0x404ebb
lea eax, [ecx + 1]
mov dword [ebx], eax
mov eax, esi
cmp edx, 0x10
jb 0x404eb3
mov eax, dword [esi]
mov word [eax + ecx], 0x3b
jmp 0x404f20
push 1
push 0x4098ac
mov byte [esp + 0x18], 0
mov ecx, esi
push dword [esp + 0x18]
push 1
call fcn.00406220
jmp 0x404f20
cmp eax, 1
jb 0x404ef1
lea eax, [ecx + 1]
mov dword [ebx], eax
mov eax, esi
cmp edx, 0x10
jb 0x404ee9
mov eax, dword [esi]
mov word [eax + ecx], 0x3a
jmp 0x404f20
push 1
push 0x4098b0
mov byte [esp + 0x18], 0
mov ecx, esi
push dword [esp + 0x18]
push 1
call fcn.00406220
jmp 0x404f20
mov eax, dword [0x40cfd8]
and dword [0x40cfdc], 0xfbffffff
mov dword [0x40cfd8], eax
push 0xc0
call dword [esp + 0x1c]
bt ax, 0xf
jae 0x404fda
mov ecx, dword [0x40cfe0]
mov eax, ecx
mov edx, dword [0x40cfe4]
and eax, 1
or eax, 0
jne 0x404feb
mov eax, dword [esp + 0x14]
or ecx, 1
mov dword [0x40cfe0], ecx
mov dword [0x40cfe4], edx
mov ecx, dword [ebx]
mov edx, dword [eax]
mov eax, edx
sub eax, ecx
test di, di
jne 0x404fa4
cmp eax, 1
jb 0x404f89
lea eax, [ecx + 1]
mov dword [ebx], eax
mov eax, esi
cmp edx, 0x10
jb 0x404f81
mov eax, dword [esi]
mov word [eax + ecx], 0x60
jmp 0x404feb
push 1
push 0x4098b4
mov byte [esp + 0x18], 0
mov ecx, esi
push dword [esp + 0x18]
push 1
call fcn.00406220
jmp 0x404feb
cmp eax, 1
jb 0x404fbf
lea eax, [ecx + 1]
mov dword [ebx], eax
mov eax, esi
cmp edx, 0x10
jb 0x404fb7
mov eax, dword [esi]
mov word [eax + ecx], 0x7e
jmp 0x404feb
push 1
push 0x4098b8
mov byte [esp + 0x18], 0
mov ecx, esi
push dword [esp + 0x18]
push 1
call fcn.00406220
jmp 0x404feb
mov eax, dword [0x40cfe4]
and dword [0x40cfe0], 0xfffffffe
mov dword [0x40cfe4], eax
push 0xdb
call dword [esp + 0x1c]
bt ax, 0xf
jae 0x4050aa
mov ecx, dword [0x40cfe0]
mov eax, ecx
mov edx, dword [0x40cfe4]
and eax, 0x8000000
or eax, 0
jne 0x4050be
mov eax, dword [esp + 0x14]
or ecx, 0x8000000
mov dword [0x40cfe0], ecx
mov dword [0x40cfe4], edx
mov ecx, dword [ebx]
mov edx, dword [eax]
mov eax, edx
sub eax, ecx
test di, di
jne 0x405074
cmp eax, 1
jb 0x405059
lea eax, [ecx + 1]
mov dword [ebx], eax
mov eax, esi
cmp edx, 0x10
jb 0x405051
mov eax, dword [esi]
mov word [eax + ecx], 0x5b
jmp 0x4050be
push 1
push 0x4098bc
mov byte [esp + 0x18], 0
mov ecx, esi
push dword [esp + 0x18]
push 1
call fcn.00406220
jmp 0x4050be
cmp eax, 1
jb 0x40508f
lea eax, [ecx + 1]
mov dword [ebx], eax
mov eax, esi
cmp edx, 0x10
jb 0x405087
mov eax, dword [esi]
mov word [eax + ecx], 0x7b
jmp 0x4050be
push 1
push 0x4098c0
mov byte [esp + 0x18], 0
mov ecx, esi
push dword [esp + 0x18]
push 1
call fcn.00406220
jmp 0x4050be
mov eax, dword [0x40cfe4]
and dword [0x40cfe0], 0xf7ffffff
mov dword [0x40cfe4], eax
push 0xdc
call dword [esp + 0x1c]
bt ax, 0xf
jae 0x40517d
mov ecx, dword [0x40cfe0]
mov eax, ecx
mov edx, dword [0x40cfe4]
and eax, 0x10000000
or eax, 0
jne 0x405191
mov eax, dword [esp + 0x14]
or ecx, 0x10000000
mov dword [0x40cfe0], ecx
mov dword [0x40cfe4], edx
mov ecx, dword [ebx]
mov edx, dword [eax]
mov eax, edx
sub eax, ecx
test di, di
jne 0x405147
cmp eax, 1
jb 0x40512c
lea eax, [ecx + 1]
mov dword [ebx], eax
mov eax, esi
cmp edx, 0x10
jb 0x405124
mov eax, dword [esi]
mov word [eax + ecx], 0x5c
jmp 0x405191
push 1
push 0x4098c4
mov byte [esp + 0x18], 0
mov ecx, esi
push dword [esp + 0x18]
push 1
call fcn.00406220
jmp 0x405191
cmp eax, 1
jb 0x405162
lea eax, [ecx + 1]
mov dword [ebx], eax
mov eax, esi
cmp edx, 0x10
jb 0x40515a
mov eax, dword [esi]
mov word [eax + ecx], 0x7c
jmp 0x405191
push 1
push 0x4098c8
mov byte [esp + 0x18], 0
mov ecx, esi
push dword [esp + 0x18]
push 1
call fcn.00406220
jmp 0x405191
mov eax, dword [0x40cfe4]
and dword [0x40cfe0], 0xefffffff
mov dword [0x40cfe4], eax
push 0xdd
call dword [esp + 0x1c]
bt ax, 0xf
jae 0x405250
mov ecx, dword [0x40cfe0]
mov eax, ecx
mov edx, dword [0x40cfe4]
and eax, 0x20000000
or eax, 0
jne 0x405264
mov eax, dword [esp + 0x14]
or ecx, 0x20000000
mov dword [0x40cfe0], ecx
mov dword [0x40cfe4], edx
mov ecx, dword [ebx]
mov edx, dword [eax]
mov eax, edx
sub eax, ecx
test di, di
jne 0x40521a
cmp eax, 1
jb 0x4051ff
lea eax, [ecx + 1]
mov dword [ebx], eax
mov eax, esi
cmp edx, 0x10
jb 0x4051f7
mov eax, dword [esi]
mov word [eax + ecx], 0x5d
jmp 0x405264
push 1
push 0x4098cc
mov byte [esp + 0x18], 0
mov ecx, esi
push dword [esp + 0x18]
push 1
call fcn.00406220
jmp 0x405264
cmp eax, 1
jb 0x405235
lea eax, [ecx + 1]
mov dword [ebx], eax
mov eax, esi
cmp edx, 0x10
jb 0x40522d
mov eax, dword [esi]
mov word [eax + ecx], 0x7d
jmp 0x405264
push 1
push 0x4098d0
mov byte [esp + 0x18], 0
mov ecx, esi
push dword [esp + 0x18]
push 1
call fcn.00406220
jmp 0x405264
mov eax, dword [0x40cfe4]
and dword [0x40cfe0], 0xdfffffff
mov dword [0x40cfe4], eax
push 8
call dword [esp + 0x1c]
bt ax, 0xf
mov ecx, dword [esp + 0x1c]
jae 0x4052e1
movss xmm0, dword [ecx + 0x178]
xorps xmm1, xmm1
comiss xmm0, dword [0x4099a8]
jae 0x405292
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x4052d5
mov eax, dword [ebx]
test eax, eax
je 0x4052b2
mov edx, dword [esp + 0x14]
lea ecx, [eax - 1]
mov dword [ebx], ecx
mov eax, esi
cmp dword [edx], 0x10
jb 0x4052aa
mov eax, dword [esi]
mov byte [eax + ecx], 0
mov ecx, dword [esp + 0x1c]
movss xmm0, dword [ecx + 0x178]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jnp 0x4052d5
movss xmm0, dword [0x4099a4]
mov dword [ecx + 0x178], 0x3ee66666
mov eax, dword [0x40cf90]
addss xmm0, dword [eax + 8]
jmp 0x4052e4
xorps xmm0, xmm0
push 0xde
movss dword [ecx + 0x178], xmm0
call dword [esp + 0x1c]
bt ax, 0xf
jae 0x4053ab
mov ecx, dword [0x40cfe0]
mov eax, ecx
mov edx, dword [0x40cfe4]
and eax, 0x40000000
or eax, 0
jne 0x4053bf
mov eax, dword [esp + 0x14]
or ecx, 0x40000000
mov dword [0x40cfe0], ecx
mov dword [0x40cfe4], edx
mov ecx, dword [ebx]
mov edx, dword [eax]
mov eax, edx
sub eax, ecx
test di, di
jne 0x405375
cmp eax, 1
jb 0x40535a
lea eax, [ecx + 1]
mov dword [ebx], eax
mov eax, esi
cmp edx, 0x10
jb 0x405352
mov eax, dword [esi]
mov word [eax + ecx], 0x27
jmp 0x4053bf
push 1
push 0x4098d4
mov byte [esp + 0x18], 0
mov ecx, esi
push dword [esp + 0x18]
push 1
call fcn.00406220
jmp 0x4053bf
cmp eax, 1
jb 0x405390
lea eax, [ecx + 1]
mov dword [ebx], eax
mov eax, esi
cmp edx, 0x10
jb 0x405388
mov eax, dword [esi]
mov word [eax + ecx], 0x22
jmp 0x4053bf
push 1
push 0x4098d8
mov byte [esp + 0x18], 0
mov ecx, esi
push dword [esp + 0x18]
push 1
call fcn.00406220
jmp 0x4053bf
mov eax, dword [0x40cfe4]
and dword [0x40cfe0], 0xbfffffff
mov dword [0x40cfe4], eax
push 0xbd
call dword [esp + 0x1c]
bt ax, 0xf
jae 0x40547e
mov edx, dword [0x40cfdc]
xor eax, eax
mov ecx, edx
and ecx, 0x20000000
or eax, ecx
jne 0x405492
mov eax, dword [0x40cfd8]
or edx, 0x20000000
mov dword [0x40cfd8], eax
mov eax, dword [esp + 0x14]
mov dword [0x40cfdc], edx
mov ecx, dword [ebx]
mov edx, dword [eax]
mov eax, edx
sub eax, ecx
test di, di
jne 0x405448
cmp eax, 1
jb 0x40542d
lea eax, [ecx + 1]
mov dword [ebx], eax
mov eax, esi
cmp edx, 0x10
jb 0x405425
mov eax, dword [esi]
mov word [ecx + eax], 0x2d
jmp 0x405492
push 1
push 0x4098dc
mov byte [esp + 0x18], 0
mov ecx, esi
push dword [esp + 0x18]
push 1
call fcn.00406220
jmp 0x405492
cmp eax, 1
jb 0x405463
lea eax, [ecx + 1]
mov dword [ebx], eax
mov eax, esi
cmp edx, 0x10
jb 0x40545b
mov eax, dword [esi]
mov word [eax + ecx], 0x5f
jmp 0x405492
push 1
push 0x4098e0
mov byte [esp + 0x18], 0
mov ecx, esi
push dword [esp + 0x18]
push 1
call fcn.00406220
jmp 0x405492
mov eax, dword [0x40cfd8]
and dword [0x40cfdc], 0xdfffffff
mov dword [0x40cfd8], eax
push 0xbb
call dword [esp + 0x1c]
bt ax, 0xf
jae 0x405551
mov edx, dword [0x40cfdc]
xor eax, eax
mov ecx, edx
and ecx, 0x8000000
or eax, ecx
jne 0x405565
mov eax, dword [0x40cfd8]
or edx, 0x8000000
mov dword [0x40cfd8], eax
mov eax, dword [esp + 0x14]
mov dword [0x40cfdc], edx
mov ecx, dword [ebx]
mov edx, dword [eax]
mov eax, edx
sub eax, ecx
test di, di
jne 0x40551b
cmp eax, 1
jb 0x405500
lea eax, [ecx + 1]
mov dword [ebx], eax
mov eax, esi
cmp edx, 0x10
jb 0x4054f8
mov eax, dword [esi]
mov word [eax + ecx], 0x3d
jmp 0x405565
push 1
push 0x4098e4
mov byte [esp + 0x18], 0
mov ecx, esi
push dword [esp + 0x18]
push 1
call fcn.00406220
jmp 0x405565
cmp eax, 1
jb 0x405536
lea eax, [ecx + 1]
mov dword [ebx], eax
mov eax, esi
cmp edx, 0x10
jb 0x40552e
mov eax, dword [esi]
mov word [eax + ecx], 0x2b
jmp 0x405565
push 1
push 0x4098e8
mov byte [esp + 0x18], 0
mov ecx, esi
push dword [esp + 0x18]
push 1
call fcn.00406220
jmp 0x405565
mov eax, dword [0x40cfd8]
and dword [0x40cfdc], 0xf7ffffff
mov dword [0x40cfd8], eax
push 0x20
call dword [esp + 0x1c]
bt ax, 0xf
jae 0x4055da
mov edx, dword [0x40cfcc]
xor eax, eax
mov edi, dword [0x40cfc8]
mov ecx, edx
and ecx, 1
or eax, ecx
jne 0x4055eb
mov dword [0x40cfc8], edi
or edx, 1
mov edi, dword [esp + 0x14]
mov dword [0x40cfcc], edx
mov ecx, dword [ebx]
mov edx, dword [edi]
mov eax, edx
sub eax, ecx
cmp eax, 1
jb 0x4055bf
lea eax, [ecx + 1]
mov dword [ebx], eax
mov eax, esi
cmp edx, 0x10
jb 0x4055b7
mov eax, dword [esi]
mov word [ecx + eax], 0x20
jmp 0x4055ef
push 1
push 0x409670
mov byte [esp + 0x18], 0
mov ecx, esi
push dword [esp + 0x18]
push 1
call fcn.00406220
jmp 0x4055ef
mov eax, dword [0x40cfc8]
and dword [0x40cfcc], 0xfffffffe
mov dword [0x40cfc8], eax
mov edi, dword [esp + 0x14]
push 0xd
call dword [esp + 0x1c]
bt ax, 0xf
jae 0x405669
mov ecx, dword [0x40cfc8]
mov eax, ecx
mov edx, dword [0x40cfcc]
and eax, 0x2000
or eax, 0
jne 0x40567d
or ecx, 0x2000
mov dword [0x40cfcc], edx
mov dword [0x40cfc8], ecx
cmp byte [ebp + 0xc], al
je 0x40567d
mov edx, dword [edi]
mov eax, edx
mov ecx, dword [ebx]
sub eax, ecx
cmp eax, 1
jb 0x40564e
lea eax, [ecx + 1]
mov dword [ebx], eax
mov eax, esi
cmp edx, 0x10
jb 0x405646
mov eax, dword [esi]
mov word [eax + ecx], 0xa
jmp 0x40567d
push 1
push 0x4098ec
mov byte [esp + 0x18], 0
mov ecx, esi
push dword [esp + 0x18]
push 1
call fcn.00406220
jmp 0x40567d
mov eax, dword [0x40cfcc]
and dword [0x40cfc8], 0xffffdfff
mov dword [0x40cfcc], eax
push 0x60
call dword [esp + 0x1c]
bt ax, 0xf
jae 0x4056f2
mov edx, dword [0x40cfd4]
xor eax, eax
mov edi, dword [0x40cfd0]
mov ecx, edx
and ecx, 1
or eax, ecx
jne 0x405703
mov eax, dword [esp + 0x14]
or edx, 1
mov dword [0x40cfd0], edi
mov dword [0x40cfd4], edx
mov ecx, dword [ebx]
mov edx, dword [eax]
mov eax, edx
sub eax, ecx
cmp eax, 1
jb 0x4056d7
lea eax, [ecx + 1]
mov dword [ebx], eax
mov eax, esi
cmp edx, 0x10
jb 0x4056cf
mov eax, dword [esi]
mov word [eax + ecx], 0x30
jmp 0x405703
push 1
push 0x4098f0
mov byte [esp + 0x18], 0
mov ecx, esi
push dword [esp + 0x18]
push 1
call fcn.00406220
jmp 0x405703
mov eax, dword [0x40cfd0]
and dword [0x40cfd4], 0xfffffffe
mov dword [0x40cfd0], eax
push 0x61
call dword [esp + 0x1c]
bt ax, 0xf
jae 0x405778
mov edx, dword [0x40cfd4]
xor eax, eax
mov edi, dword [0x40cfd0]
mov ecx, edx
and ecx, 2
or eax, ecx
jne 0x405789
mov eax, dword [esp + 0x14]
or edx, 2
mov dword [0x40cfd0], edi
mov dword [0x40cfd4], edx
mov ecx, dword [ebx]
mov edx, dword [eax]
mov eax, edx
sub eax, ecx
cmp eax, 1
jb 0x40575d
lea eax, [ecx + 1]
mov dword [ebx], eax
mov eax, esi
cmp edx, 0x10
jb 0x405755
mov eax, dword [esi]
mov word [eax + ecx], 0x31
jmp 0x405789
push 1
push 0x4098f4
mov byte [esp + 0x18], 0
mov ecx, esi
push dword [esp + 0x18]
push 1
call fcn.00406220
jmp 0x405789
mov eax, dword [0x40cfd0]
and dword [0x40cfd4], 0xfffffffd
mov dword [0x40cfd0], eax
push 0x62
call dword [esp + 0x1c]
bt ax, 0xf
jae 0x4057fe
mov edx, dword [0x40cfd4]
xor eax, eax
mov edi, dword [0x40cfd0]
mov ecx, edx
and ecx, 4
or eax, ecx
jne 0x40580f
mov eax, dword [esp + 0x14]
or edx, 4
mov dword [0x40cfd0], edi
mov dword [0x40cfd4], edx
mov ecx, dword [ebx]
mov edx, dword [eax]
mov eax, edx
sub eax, ecx
cmp eax, 1
jb 0x4057e3
lea eax, [ecx + 1]
mov dword [ebx], eax
mov eax, esi
cmp edx, 0x10
jb 0x4057db
mov eax, dword [esi]
mov word [eax + ecx], 0x32
jmp 0x40580f
push 1
push 0x4098f8
mov byte [esp + 0x18], 0
mov ecx, esi
push dword [esp + 0x18]
push 1
call fcn.00406220
jmp 0x40580f
mov eax, dword [0x40cfd0]
and dword [0x40cfd4], 0xfffffffb
mov dword [0x40cfd0], eax
push 0x63
call dword [esp + 0x1c]
bt ax, 0xf
jae 0x405884
mov edx, dword [0x40cfd4]
xor eax, eax
mov edi, dword [0x40cfd0]
mov ecx, edx
and ecx, 8
or eax, ecx
jne 0x405895
mov eax, dword [esp + 0x14]
or edx, 8
mov dword [0x40cfd0], edi
mov dword [0x40cfd4], edx
mov ecx, dword [ebx]
mov edx, dword [eax]
mov eax, edx
sub eax, ecx
cmp eax, 1
jb 0x405869
lea eax, [ecx + 1]
mov dword [ebx], eax
mov eax, esi
cmp edx, 0x10
jb 0x405861
mov eax, dword [esi]
mov word [eax + ecx], 0x33
jmp 0x405895
push 1
push 0x4098fc
mov byte [esp + 0x18], 0
mov ecx, esi
push dword [esp + 0x18]
push 1
call fcn.00406220
jmp 0x405895
mov eax, dword [0x40cfd0]
and dword [0x40cfd4], 0xfffffff7
mov dword [0x40cfd0], eax
push 0x64
call dword [esp + 0x1c]
bt ax, 0xf
jae 0x40590a
mov edx, dword [0x40cfd4]
xor eax, eax
mov edi, dword [0x40cfd0]
mov ecx, edx
and ecx, 0x10
or eax, ecx
jne 0x40591b
mov eax, dword [esp + 0x14]
or edx, 0x10
mov dword [0x40cfd0], edi
mov dword [0x40cfd4], edx
mov ecx, dword [ebx]
mov edx, dword [eax]
mov eax, edx
sub eax, ecx
cmp eax, 1
jb 0x4058ef
lea eax, [ecx + 1]
mov dword [ebx], eax
mov eax, esi
cmp edx, 0x10
jb 0x4058e7
mov eax, dword [esi]
mov word [eax + ecx], 0x34
jmp 0x40591b
push 1
push 0x409900
mov byte [esp + 0x18], 0
mov ecx, esi
push dword [esp + 0x18]
push 1
call fcn.00406220
jmp 0x40591b
mov eax, dword [0x40cfd0]
and dword [0x40cfd4], 0xffffffef
mov dword [0x40cfd0], eax
push 0x65
call dword [esp + 0x1c]
bt ax, 0xf
jae 0x405990
mov edx, dword [0x40cfd4]
xor eax, eax
mov edi, dword [0x40cfd0]
mov ecx, edx
and ecx, 0x20
or eax, ecx
jne 0x4059a1
mov eax, dword [esp + 0x14]
or edx, 0x20
mov dword [0x40cfd0], edi
mov dword [0x40cfd4], edx
mov ecx, dword [ebx]
mov edx, dword [eax]
mov eax, edx
sub eax, ecx
cmp eax, 1
jb 0x405975
lea eax, [ecx + 1]
mov dword [ebx], eax
mov eax, esi
cmp edx, 0x10
jb 0x40596d
mov eax, dword [esi]
mov word [eax + ecx], 0x35
jmp 0x4059a1
push 1
push 0x409904
mov byte [esp + 0x18], 0
mov ecx, esi
push dword [esp + 0x18]
push 1
call fcn.00406220
jmp 0x4059a1
mov eax, dword [0x40cfd0]
and dword [0x40cfd4], 0xffffffdf
mov dword [0x40cfd0], eax
push 0x66
call dword [esp + 0x1c]
bt ax, 0xf
jae 0x405a16
mov edx, dword [0x40cfd4]
xor eax, eax
mov edi, dword [0x40cfd0]
mov ecx, edx
and ecx, 0x40
or eax, ecx
jne 0x405a27
mov eax, dword [esp + 0x14]
or edx, 0x40
mov dword [0x40cfd0], edi
mov dword [0x40cfd4], edx
mov ecx, dword [ebx]
mov edx, dword [eax]
mov eax, edx
sub eax, ecx
cmp eax, 1
jb 0x4059fb
lea eax, [ecx + 1]
mov dword [ebx], eax
mov eax, esi
cmp edx, 0x10
jb 0x4059f3
mov eax, dword [esi]
mov word [eax + ecx], 0x36
jmp 0x405a27
push 1
push 0x409908
mov byte [esp + 0x18], 0
mov ecx, esi
push dword [esp + 0x18]
push 1
call fcn.00406220
jmp 0x405a27
mov eax, dword [0x40cfd0]
and dword [0x40cfd4], 0xffffffbf
mov dword [0x40cfd0], eax
push 0x67
call dword [esp + 0x1c]
bt ax, 0xf
jae 0x405aa2
mov edx, dword [0x40cfd4]
xor eax, eax
mov edi, dword [0x40cfd0]
mov ecx, edx
and ecx, 0x80
or eax, ecx
jne 0x405ab6
mov eax, dword [esp + 0x14]
or edx, 0x80
mov dword [0x40cfd0], edi
mov dword [0x40cfd4], edx
mov ecx, dword [ebx]
mov edx, dword [eax]
mov eax, edx
sub eax, ecx
cmp eax, 1
jb 0x405a87
lea eax, [ecx + 1]
mov dword [ebx], eax
mov eax, esi
cmp edx, 0x10
jb 0x405a7f
mov eax, dword [esi]
mov word [eax + ecx], 0x37
jmp 0x405ab6
push 1
push 0x40990c
mov byte [esp + 0x18], 0
mov ecx, esi
push dword [esp + 0x18]
push 1
call fcn.00406220
jmp 0x405ab6
mov eax, dword [0x40cfd0]
and dword [0x40cfd4], 0xffffff7f
mov dword [0x40cfd0], eax
push 0x68
call dword [esp + 0x1c]
bt ax, 0xf
jae 0x405b31
mov edx, dword [0x40cfd4]
xor eax, eax
mov edi, dword [0x40cfd0]
mov ecx, edx
and ecx, 0x100
or eax, ecx
jne 0x405b45
mov eax, dword [esp + 0x14]
or edx, 0x100
mov dword [0x40cfd0], edi
mov dword [0x40cfd4], edx
mov ecx, dword [ebx]
mov edx, dword [eax]
mov eax, edx
sub eax, ecx
cmp eax, 1
jb 0x405b16
lea eax, [ecx + 1]
mov dword [ebx], eax
mov eax, esi
cmp edx, 0x10
jb 0x405b0e
mov eax, dword [esi]
mov word [eax + ecx], 0x38
jmp 0x405b45
push 1
push 0x409910
mov byte [esp + 0x18], 0
mov ecx, esi
push dword [esp + 0x18]
push 1
call fcn.00406220
jmp 0x405b45
mov eax, dword [0x40cfd0]
and dword [0x40cfd4], 0xfffffeff
mov dword [0x40cfd0], eax
push 0x69
call dword [esp + 0x1c]
bt ax, 0xf
jae 0x405bcc
mov edx, dword [0x40cfd4]
xor eax, eax
mov edi, dword [0x40cfd0]
mov ecx, edx
and ecx, 0x200
or eax, ecx
jne 0x405be0
mov eax, dword [esp + 0x14]
or edx, 0x200
mov dword [0x40cfd0], edi
mov dword [0x40cfd4], edx
mov ecx, dword [ebx]
mov edx, dword [eax]
mov eax, edx
sub eax, ecx
cmp eax, 1
jb 0x405baa
lea eax, [ecx + 1]
mov dword [ebx], eax
cmp edx, 0x10
jb 0x405b9b
mov esi, dword [esi]
mov word [esi + ecx], 0x39
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 1
push 0x409914
mov byte [esp + 0x18], 0
mov ecx, esi
push dword [esp + 0x18]
push 1
call fcn.00406220
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [0x40cfd0]
and dword [0x40cfd4], 0xfffffdff
mov dword [0x40cfd0], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8