Function at 0x403f9b
Capabilities:
Get keyboard layout
Log keystrokes via polling
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
and dword [ebp - 8], 0
push ebx
mov ebx, dword [ebp + 0x14]
push esi
push edi
push 0
mov dword [ebp - 4], ebx
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov esi, dword [ebp + 0x10]
mov edi, 0xc000
test eax, eax
jne 0x403fed
push 0x100
lea eax, [ebp - 0x118]
push 0
push eax
call fcn.00428790
add esp, 0xc
jmp 0x40405e
cmp dword [ebp + 0xc], 0x12
jne 0x404006
mov eax, esi
shr eax, 0x10
test ah, 1
je 0x404006
mov al, byte [ebp - 0x106]
mov byte [ebp - 0x73], al
mov eax, dword [0x4539ec]
cmp eax, 3
je 0x404027
cmp eax, 1
jg 0x404051
cmp dword [0x454e28], 0
je 0x404051
cmp dword [0x4539f4], 0
jne 0x404051
cmp dword [ebp + 0xc], 0x90
jne 0x404051
test byte [ebp - 0x108], 0x80
jne 0x404051
mov eax, esi
mov dword [ebp + 0xc], 0x2b
shr eax, 0x10
test di, ax
jne 0x404051
xor byte [ebp - 0x88], 1
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
xor eax, eax
cmp dword [0x453000], eax
je 0x40407b
mov ecx, esi
shr ecx, 0x10
and cx, di
cmp cx, 0x4000
je 0x40429a
mov ecx, esi
shr ecx, 0x10
test ch, 0x20
mov dword [ebp - 0xc], ecx
je 0x404095
test byte [ebp - 0x73], 0x80
jne 0x404095
mov dword [ebp - 8], 1
mov edx, ecx
not edx
movzx esi, dx
shr esi, 0xf
cmp dword [ebp - 8], eax
mov dword [ebp - 0x14], esi
je 0x4040c8
test byte [ebp - 0x107], 0x80
je 0x4040c8
cmp dword [0x453a2c], eax
je 0x4040c1
and byte [ebp - 0x106], 0
jmp 0x4040c8
mov byte [ebp - 0x73], pe_nt_image_headers32
mov dword [ebp - 8], eax
movzx edx, byte [ebp - 0x107]
mov eax, ecx
and eax, 0x81ff
mov dword [ebp - 0x18], eax
movzx eax, byte [ebp - 0x108]
shr eax, 7
shr edx, 7
lea eax, [eax + edx*2]
mov dword [ebp + 0x10], eax
mov eax, dword [0x444f10]
test eax, eax
jne 0x40412a
cmp dword [0x453a28], eax
mov dword [0x444f54], 0x100
je 0x40411c
cmp dword [ebp + 0xc], 0x12
jne 0x40411c
test ch, 1
je 0x40411c
mov dword [0x444f54], 0x12
push 0x5d
pop ecx
cmp dword [ebp + 0xc], ecx
jne 0x40412a
mov dword [0x444f54], ecx
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [0x444f54]
jne 0x404153
test eax, eax
jne 0x404143
test word [ebp - 0xc], di
jne 0x404143
push 1
jmp 0x404150
cmp eax, 1
jne 0x40415d
test byte [ebp - 0xb], 0x80
je 0x40415d
push 2
pop eax
jmp 0x40415f
cmp eax, 1
jne 0x404164
cmp ecx, 0x11
je 0x404164
xor eax, eax
mov dword [0x444f10], eax
cmp ecx, 0x10
je 0x40417d
cmp ecx, 0x21
je 0x40417d
cmp ecx, 0x22
je 0x40417d
mov dword [0x455070], 1
test esi, esi
je 0x40418b
call fcn.0040ee6b
mov eax, dword [0x444f10]
cmp eax, 1
jle 0x4041a0
xor edx, edx
cmp dword [ebp - 8], edx
je 0x4041a5
xor eax, eax
mov dword [0x444f10], eax
jmp 0x4041a2
xor edx, edx
cmp dword [ebp - 8], edx
mov ecx, dword [0x4539ec]
jne 0x4041d3
cmp dword [0x454e28], edx
je 0x4041c2
cmp dword [0x4539f4], edx
jne 0x4041c2
cmp ecx, 2
jne 0x4041d3
cmp ecx, 3
je 0x4041d3
cmp dword [0x453a00], edx
jne 0x4041d3
cmp eax, edx
je 0x40423a
test byte [ebp - 0xb], 1
jne 0x40423a
xor edx, edx
cmp dword [ebp + 0xc], 0x21
ja 0x4041f1
je 0x4041ed
cmp dword [ebp + 0xc], 0xc
jne case.0x4041fc.41
push 0x65
jmp 0x404225
push 0x69
jmp 0x404225
mov ecx, dword [ebp + 0xc]
add ecx, 0xffffffde
cmp ecx, 0xc
ja case.0x4041fc.41
jmp dword [ecx*4 + 0x404baa]
push 0x60
jmp 0x404225
push 0x61
jmp 0x404225
push 0x62
jmp 0x404225
push 0x63
jmp 0x404225
push 0x64
jmp 0x404225
push 0x66
jmp 0x404225
push 0x67
jmp 0x404225
push 0x68
jmp 0x404225
push 0x6e
pop edx
test edx, edx
je 0x40423a
test byte [ebp - 0x88], 1
je 0x404237
or dword [ebp + 0x10], 1
mov dword [ebp + 0xc], edx
test esi, esi
je 0x404870
test byte [ebp - 0x73], 0x80
jne 0x404870
test eax, eax
jne 0x404870
mov ecx, dword [ebp - 8]
xor edi, edi
cmp ecx, edi
je 0x404267
mov ebx, dword [ebp + 0x14]
mov byte [ebx], 0x1b
inc ebx
mov dword [ebp - 4], ebx
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
cmp edx, 0x21
jne 0x40427c
cmp esi, 1
jne 0x40427c
push edi
push 2
jmp 0x404289
cmp edx, 0x22
jne 0x4042a1
cmp esi, 1
jne 0x4042a1
push edi
push 3
push 0x115
push dword [0x4449a8]
call dword [sym.imp.USER32.dll_SendMessageA]
xor eax, eax
jmp 0x404a5c
cmp edx, 0x2d
jne 0x4042b2
cmp esi, 1
jne 0x4042b2
call fcn.0040e724
jmp 0x40429a
cmp ecx, edi
je 0x40430d
cmp edx, 0x73
jne 0x4042c7
cmp dword [0x453a08], edi
jne 0x404a59
cmp ecx, edi
je 0x40430d
cmp edx, 0x20
jne 0x40430d
cmp dword [0x453a0c], edi
je 0x40430d
push edi
push edx
push 0x102
mov dword [0x444f48], edi
push dword [0x4449a8]
call dword [sym.imp.USER32.dll_PostMessageA]
push edi
push 0xf100
push 0x112
push dword [0x4449a8]
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x404a59
push 2
cmp edx, 0x13
pop edi
jne 0x404325
cmp esi, edi
jne 0x404325
xor dword [0x454e28], 1
jmp 0x40429a
cmp dword [0x453a00], 0
je case.default.0x404346
test ecx, ecx
jne 0x404517
lea eax, [edx - 0x61]
cmp eax, 8
ja case.default.0x404346
jmp dword [eax*4 + 0x404bde]
mov eax, esi
neg eax
sbb eax, eax
and al, 0xe0
add eax, 0x62
jmp 0x40459b
mov eax, esi
neg eax
sbb eax, eax
and al, 0xe0
add eax, 0x6a
jmp 0x40459b
mov eax, esi
neg eax
sbb eax, eax
and al, 0xe0
add eax, 0x6e
jmp 0x40459b
mov eax, esi
neg eax
sbb eax, eax
and al, 0xe0
add eax, 0x68
jmp 0x40459b
mov byte [ebx], 0x2e
jmp 0x4045d8
mov eax, esi
neg eax
sbb eax, eax
and al, 0xe0
add eax, 0x6c
jmp 0x40459b
mov eax, esi
neg eax
sbb eax, eax
and al, 0xe0
add eax, 0x79
jmp 0x40459b
mov eax, esi
neg eax
sbb eax, eax
and al, 0xe0
add eax, 0x6b
jmp 0x40459b
mov eax, esi
neg eax
sbb eax, eax
and al, 0xe0
add eax, 0x75
jmp 0x40459b
test ecx, ecx
jne 0x404517
mov eax, dword [0x4539ec]
cmp eax, 3
je 0x404400
cmp eax, 1
jg 0x404424
cmp dword [0x454e28], ecx
je case.0x404468.108
cmp dword [0x4539f4], ecx
jne 0x404424
mov eax, edx
sub eax, 0x2b
je 0x404421
sub eax, 0x3f
je 0x40441d
sub eax, 3
je 0x404419
sub eax, edi
jne 0x404424
push 0x51
jmp 0x404423
push 0x53
jmp 0x404423
push 0x52
jmp 0x404423
push 0x50
pop ecx
cmp dword [0x454e28], 0
je case.0x404468.108
cmp dword [0x4539f4], 0
jne case.0x404468.108
cmp edx, 0x60
ja 0x404460
je 0x40445c
cmp edx, 0xd
jne case.0x404468.108
test byte [ebp - 0xb], 1
je case.0x404468.108
push 0x4d
jmp 0x4044d9
push 0x70
jmp 0x4044d9
lea eax, [edx - 0x61]
cmp eax, 0xe
ja case.0x404468.108
jmp dword [eax*4 + 0x404c02]
push 0x71
jmp 0x4044d9
push 0x72
jmp 0x4044d9
push 0x73
jmp 0x4044d9
push 0x74
jmp 0x4044d9
push 0x75
jmp 0x4044d9
push 0x76
jmp 0x4044d9
push 0x77
jmp 0x4044d9
push 0x78
jmp 0x4044d9
push 0x79
jmp 0x4044d9
push 0x6e
jmp 0x4044d9
cmp dword [0x4539ec], edi
jne 0x4044ab
xor ecx, ecx
test esi, esi
setne cl
add ecx, 0x6b
jmp case.0x404468.108
xor ecx, ecx
test esi, esi
setne cl
add ecx, 0x6c
jmp case.0x404468.108
cmp dword [0x4539ec], edi
jne case.0x404468.108
push 0x6f
jmp 0x4044d9
cmp dword [0x4539ec], edi
jne case.0x404468.108
push 0x6a
jmp 0x4044d9
cmp dword [0x4539ec], edi
jne case.0x404468.108
push 0x6d
pop ecx
test ecx, ecx
je 0x404517
cmp dword [0x454c04], 0
je 0x404501
cmp ecx, 0x50
jl 0x4044f9
cmp ecx, 0x53
jg 0x4044f9
push ecx
push 0x43b520
jmp 0x404507
push ecx
push str.e__c
jmp 0x404507
push ecx
push str.eO_c
push ebx
call fcn.00428720
add esp, 0xc
add ebx, eax
jmp 0x4045d9
cmp edx, 8
jne 0x404532
test esi, esi
jne 0x404532
mov eax, dword [0x4539e4]
neg eax
sbb eax, eax
and eax, 0x77
add eax, edx
mov byte [ebx], al
jmp 0x40457e
cmp edx, 9
jne 0x40454c
cmp esi, 1
jne 0x40454c
mov byte [ebx], 0x1b
inc ebx
mov byte [ebx], 0x5b
inc ebx
mov byte [ebx], 0x5a
jmp 0x4045d8
cmp edx, 0x20
jne 0x404569
cmp esi, edi
jne 0x40455a
and byte [ebx], 0
jmp 0x4045d8
cmp edx, 0x20
jne 0x404569
cmp esi, 3
jne 0x404569
mov byte [ebx], 0xa0
jmp 0x4045d8
cmp edx, 3
jne 0x404576
cmp esi, edi
jne 0x404576
mov byte [ebx], dl
jmp 0x40457e
cmp edx, 0x13
jne 0x404587
mov byte [ebx], 0x1a
and byte [ebx + 1], 0
jmp 0x404840
cmp esi, edi
jne 0x4045c1
cmp edx, 0x32
jb 0x40459f
cmp edx, 0x38
ja 0x40459f
mov al, byte [edx + 0x43b4d6]
mov byte [ebx], al
jmp 0x4045d8
cmp esi, edi
jne 0x4045c1
cmp edx, 0xbd
jne 0x4045b0
mov byte [ebx], 0x1f
jmp 0x4045d8
cmp esi, edi
jne 0x4045c1
cmp edx, 0xdf
jne 0x4045c1
mov byte [ebx], 0x1c
jmp 0x4045d8
test esi, esi
jne 0x4045e0
cmp edx, 0xd
jne 0x4045e0
cmp dword [0x454e2c], esi
je 0x4045e0
mov byte [ebx], dl
inc ebx
mov byte [ebx], 0xa
inc ebx
mov eax, ebx
jmp 0x404829
mov esi, dword [ebp + 0xc]
xor edi, edi
xor eax, eax
push 0xb
cmp esi, 0x2d
pop ebx
ja 0x404628
je 0x404621
mov ecx, esi
sub ecx, 0x21
je 0x40461a
dec ecx
je 0x404613
dec ecx
je 0x40460c
dec ecx
jne case.default.0x404661
push 1
jmp 0x40474e
push 4
jmp 0x40474e
push 6
jmp 0x40474e
push 5
jmp 0x40474e
push 2
jmp 0x40474e
cmp esi, 0x70
ja 0x404655
je 0x40463f
cmp esi, 0x2e
jne case.default.0x404661
push 3
jmp 0x40474e
mov al, byte [ebp - 0x108]
and al, 0x80
neg al
sbb eax, eax
and eax, 0xc
add eax, ebx
jmp case.default.0x404661
lea ecx, [esi - 0x71]
cmp ecx, 0x12
ja case.default.0x404661
jmp dword [ecx*4 + 0x404c3e]
mov al, byte [ebp - 0x108]
and al, 0x80
neg al
sbb eax, eax
and eax, 0xc
add eax, 0xc
jmp case.default.0x404661
mov al, byte [ebp - 0x108]
and al, 0x80
neg al
sbb eax, eax
and eax, 0xc
add eax, 0xd
jmp case.default.0x404661
mov al, byte [ebp - 0x108]
and al, 0x80
neg al
sbb eax, eax
and eax, 0xc
add eax, 0xe
jmp case.default.0x404661
mov al, byte [ebp - 0x108]
and al, 0x80
neg al
sbb eax, eax
and eax, 0xd
add eax, 0xf
jmp case.default.0x404661
mov al, byte [ebp - 0x108]
and al, 0x80
neg al
sbb eax, eax
and eax, 0xc
add eax, 0x11
jmp case.default.0x404661
mov al, byte [ebp - 0x108]
and al, 0x80
neg al
sbb eax, eax
and eax, 0xd
add eax, 0x12
jmp case.default.0x404661
mov al, byte [ebp - 0x108]
and al, 0x80
neg al
sbb eax, eax
and eax, 0xd
add eax, 0x13
jmp case.default.0x404661
mov al, byte [ebp - 0x108]
and al, 0x80
neg al
sbb eax, eax
and eax, 0xd
add eax, 0x14
jmp case.default.0x404661
mov al, byte [ebp - 0x108]
and al, 0x80
neg al
sbb eax, eax
and eax, 0xd
add eax, 0x15
jmp case.default.0x404661
push 0x17
jmp 0x40474e
push 0x18
jmp 0x40474e
push 0x19
jmp 0x40474e
push 0x1a
jmp 0x40474e
push 0x1c
jmp 0x40474e
push 0x1d
jmp 0x40474e
push 0x1f
jmp 0x40474e
push 0x20
jmp 0x40474e
push 0x21
jmp 0x40474e
push 0x22
pop eax
mov ecx, dword [0x4539ec]
cmp ecx, 3
jne 0x404766
cmp eax, 6
jg 0x404766
movsx eax, byte [eax + 0x43b500]
mov edx, dword [0x454c04]
cmp edx, edi
je 0x404785
cmp eax, edi
jle 0x404785
cmp eax, 6
jg 0x404785
movsx eax, byte [eax + str._HLMEIG]
jmp 0x404b59
cmp ecx, 5
jne 0x404a61
cmp eax, ebx
jl 0x404a61
cmp eax, 0x22
jg 0x404a61
push 0xc
mov esi, str.MNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz_____
pop ecx
lea edi, [ebp - 0x14c]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 0xc]
xor eax, eax
add ecx, 0xffffff90
cmp ecx, ebx
movsb byte es:[edi], byte [esi]
ja case.default.0x4047bc
jmp dword [ecx*4 + 0x404c8a]
xor eax, eax
jmp case.default.0x4047bc
push 1
jmp 0x4047ed
push 2
jmp 0x4047ed
push 3
jmp 0x4047ed
push 4
jmp 0x4047ed
push 5
jmp 0x4047ed
push 6
jmp 0x4047ed
push 7
jmp 0x4047ed
push 8
jmp 0x4047ed
push 9
jmp 0x4047ed
push 0xa
pop eax
jmp case.default.0x4047bc
mov eax, ebx
test byte [ebp - 0x108], 0x80
je 0x4047fe
add eax, 0xc
test byte [ebp - 0x107], 0x80
je 0x40480a
add eax, 0x18
movsx eax, byte [ebp + eax - 0x14c]
push eax
push 0x43b4bc
push dword [ebp - 4]
call fcn.00428720
add esp, 0xc
add dword [ebp - 4], eax
mov eax, dword [ebp - 4]
sub eax, dword [ebp + 0x14]
jmp 0x404a5c
cmp esi, 0xd
jne 0x404848
mov eax, dword [ebp - 4]
mov byte [eax], 0xd
and byte [eax + 1], 0
push 0xfffffffffffffffe
pop eax
jmp 0x404a5c
cmp dword [ebp - 8], edi
je 0x40486a
cmp esi, 0x60
jb 0x40486a
cmp esi, 0x69
ja 0x40486a
mov eax, dword [0x444f4c]
lea eax, [eax + eax*4]
lea eax, [esi + eax*2 - 0x60]
mov dword [0x444f4c], eax
jmp 0x404870
mov dword [0x444f4c], edi
push dword [ebp - 0x10]
xor ebx, ebx
mov esi, 0x4449a0
lea eax, [ebp - 0x118]
push ebx
push esi
push eax
push dword [ebp - 0x18]
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_ToAsciiEx]
mov edi, eax
cmp edi, ebx
jle 0x4049c5
test edi, edi
jle 0x4049ab
mov ecx, dword [0x444f10]
mov al, byte [esi]
cmp ecx, 2
mov byte [ebp + 0x14], al
jne 0x4048d0
test al, 0x80
jne 0x4048d0
cmp al, 0x20
jbe 0x4048d0
movzx eax, al
mov dword [0x444f50], eax
mov dword [0x444f10], 3
jmp 0x4049a0
cmp ecx, 3
jne 0x404913
test al, 0x80
jne 0x404913
cmp al, 0x20
jbe 0x404913
and dword [0x444f10], 0
movzx eax, al
push eax
push dword [0x444f50]
call fcn.0040fc37
pop ecx
cmp eax, 0xffffffff
pop ecx
je 0x4049b8
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push 1
push eax
call fcn.0040fad1
pop ecx
pop ecx
jmp 0x4049a0
xor ecx, ecx
cmp dword [ebp - 0x14], ecx
mov dword [0x444f10], ecx
jne 0x404975
mov eax, dword [0x444f4c]
cmp eax, ecx
je 0x40496e
cmp dword [0x454e34], ecx
jne 0x404955
cmp dword [0x454e3c], 0xfde9
je 0x404955
cmp dword [0x45506c], ecx
jne 0x404955
mov byte [ebp + 0x14], al
lea eax, [ebp + 0x14]
push 1
push eax
call fcn.0041121e
jmp 0x404963
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push 1
push eax
call fcn.0040fad1
and dword [0x444f4c], 0
pop ecx
pop ecx
jmp 0x4049a0
push 1
lea eax, [ebp + 0x14]
jmp 0x404991
mov byte [0x43b041], al
xor eax, eax
cmp dword [ebp - 8], eax
setne al
inc eax
push eax
xor eax, eax
cmp dword [ebp - 8], eax
sete al
add eax, 0x43b040
push eax
push dword [0x454e20]
call fcn.0040fa60
add esp, 0xc
inc ebx
inc esi
inc esi
cmp ebx, edi
jl 0x4048a1
and word [0x4449a0], 0
jmp 0x40429a
push 0x10
call dword [sym.imp.USER32.dll_MessageBeep]
jmp 0x40429a
cmp dword [ebp - 8], ebx
jne 0x4049d3
mov word [0x4449a0], bx
jmp 0x404a01
cmp word [0x4449a0], bx
je 0x404a01
cmp dword [0x454e34], ebx
jne 0x4049f8
cmp dword [0x454e3c], 0xfde9
je 0x4049f8
cmp dword [0x45506c], ebx
je 0x404a01
mov word [0x4449a0], 0xa
cmp dword [ebp + 0xc], 0x12
jne 0x404a53
cmp dword [0x453a10], ebx
je 0x40429a
cmp dword [ebp + 8], 0x104
mov esi, 0x105
jne 0x404a2d
mov dword [0x444f48], 1
jmp 0x404a4e
cmp dword [ebp + 8], esi
jne 0x404a59
cmp dword [0x444f48], ebx
je 0x404a4e
push ebx
push 0x20
push 0x102
push dword [0x4449a8]
call dword [sym.imp.USER32.dll_PostMessageA]
cmp dword [ebp + 8], esi
jne 0x404a59
mov dword [0x444f48], ebx
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
cmp edx, edi
jne 0x404a6a
cmp ecx, 4
jne 0x404aa2
cmp eax, ebx
jl 0x404aa2
cmp eax, 0x18
jg 0x404aa2
xor ecx, ecx
cmp eax, 0xf
jle 0x404a7d
push 1
pop ecx
cmp eax, 0x15
jle 0x404a83
inc ecx
cmp edx, edi
je 0x404a97
sub eax, ecx
add eax, 0x45
push eax
push 0x43b520
jmp 0x404818
sub eax, ecx
add eax, 0x45
push eax
jmp 0x404ba0
cmp ecx, 1
jne 0x404abe
cmp eax, ebx
jl 0x404abe
cmp eax, 0xf
jg 0x404abe
add eax, 0x36
push eax
push str.e___c
jmp 0x404818
cmp ecx, 2
jne 0x404ade
cmp eax, ebx
jl 0x404ade
cmp eax, 0xe
jg 0x404ade
cmp edx, edi
je 0x404a99
add eax, 0x45
push eax
push 0x43b520
jmp 0x404818
cmp dword [0x4539e8], edi
je 0x404b11
cmp eax, 1
je 0x404af5
cmp eax, 4
jne 0x404b11
cmp eax, 1
jne 0x404afc
mov eax, 0x43b4b0
jmp 0x404b01
mov eax, 0x43b4ac
push eax
push dword [ebp - 4]
call fcn.00428720
pop ecx
pop ecx
jmp 0x404823
cmp eax, edi
je 0x404b20
push eax
push str.e__d
jmp 0x404818
mov eax, esi
xor cl, cl
sub eax, 0xc
je 0x404b48
sub eax, 0x19
je 0x404b44
dec eax
je 0x404b40
dec eax
je 0x404b3c
dec eax
jne 0x404b4a
add cl, 0x42
jmp 0x404b4a
mov cl, 0x43
jmp 0x404b4a
mov cl, 0x41
jmp 0x404b4a
mov cl, 0x44
jmp 0x404b4a
mov cl, 0x47
test cl, cl
je 0x404831
cmp edx, edi
je 0x404b64
movsx eax, cl
push eax
push 0x43b520
jmp 0x404818
cmp dword [0x455064], edi
je 0x404b79
cmp dword [0x4539f0], edi
jne 0x404b79
push 1
pop eax
jmp 0x404b7b
xor eax, eax
cmp dword [0x454e28], edi
jne 0x404b85
xor eax, eax
cmp dword [ebp + 0x10], 2
jne 0x404b94
xor edx, edx
cmp eax, edi
sete dl
mov eax, edx
cmp eax, edi
movsx eax, cl
push eax
je 0x404813
push str.eO_c
jmp 0x404818