Function at 0x4f6ab1
Capabilities:
Log keystrokes via polling

Disassembly:
jmp 0x4f6ab1
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x1b4
mov eax, dword [0x6294a0]
xor eax, ebp
mov dword [ebp + 0x74], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x36
lea eax, [ebp + 0x3d]
push ebx
push eax
mov byte [ebp + 0x3c], bl
call fcn.00508d00
xor eax, eax
mov dword [ebp - 0xec], ebx
lea edi, [ebp - 0xe8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0x34]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
push 9
pop ecx
xor eax, eax
mov dword [ebp - 0x7c], ebx
lea edi, [ebp - 0x78]
rep stosd dword es:[edi], eax
mov dword [ebp + 0xc], ebx
mov dword [ebp + 0x2c], ebx
mov dword [ebp + 0x28], ebx
mov dword [ebp + 0x34], ebx
mov dword [ebp + 0x38], ebx
mov dword [ebp + 0x1c], ebx
mov dword [ebp - 0x3c], ebx
call fcn.004011ef
test eax, eax
je 0x4f6b3e
call fcn.00402739
call fcn.00401da2
mov dword [ebp - 0x54], eax
jmp 0x4f6b41
mov dword [ebp - 0x54], ebx
call fcn.004022d4
cmp eax, 0x35a5011f
je 0x4f6b52
call fcn.004026a3
push 0x5acdbc
call fcn.00401a7d
push ebx
call fcn.00402d42
pop ecx
pop ecx
push 0x309
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
push ebx
call fcn.004031fc
push eax
push str._sSoundsKaChing.wav
push ebx
call fcn.00402176
push eax
call fcn.00402a27
push ebx
push ebx
mov dword [ebp - 0xc4], eax
call fcn.004031fc
push eax
push str._sSoundsIntroWait1.dav
push ebx
call fcn.00402176
push eax
call fcn.00402a27
push ebx
push ebx
mov dword [ebp - 0xa0], eax
call fcn.004031fc
push eax
push str._sSoundsIntroWait2.dav
push ebx
call fcn.00402176
add esp, 0x44
push eax
call fcn.00402a27
push ebx
push ebx
mov dword [ebp - 0x88], eax
call fcn.004031fc
push eax
push str._sSoundsIntroWait3.dav
push ebx
call fcn.00402176
push eax
call fcn.00402a27
push ebx
push ebx
mov dword [ebp - 0xb0], eax
call fcn.004031fc
push eax
push str._sSoundsIntroWait4.dav
push ebx
call fcn.00402176
push eax
call fcn.00402a27
push ebx
push ebx
mov dword [ebp - 0x90], eax
call fcn.004031fc
push eax
push str._sSoundsIntroWait5.dav
push ebx
call fcn.00402176
add esp, 0x48
push eax
call fcn.00402a27
push ebx
push ebx
mov dword [ebp - 0x80], eax
call fcn.004031fc
push eax
push str._sSoundsIntroWait6.dav
push ebx
call fcn.00402176
push eax
call fcn.00402a27
mov dword [ebp - 0x98], eax
push ebx
push ebx
call fcn.004031fc
push eax
push str._sSoundsIntroWait7.dav
push ebx
call fcn.00402176
push eax
call fcn.00402a27
push ebx
push ebx
mov dword [ebp - 0xa4], eax
call fcn.004031fc
push eax
push str._sSoundsIntroWait8.dav
push ebx
call fcn.00402176
add esp, 0x48
push eax
call fcn.00402a27
push ebx
push ebx
mov dword [ebp - 0xac], eax
call fcn.004031fc
push eax
push str._sSoundsIntroPaulaDrop.dav
push ebx
call fcn.00402176
push eax
call fcn.00402a27
push ebx
push ebx
mov dword [ebp - 0xc0], eax
call fcn.004031fc
push eax
push str._sSoundsIntroRevision.dav
push ebx
call fcn.00402176
push eax
call fcn.00402a27
push ebx
push ebx
mov dword [ebp - 0xa8], eax
call fcn.004031fc
push eax
push str._sSoundsIntroNapaLogo.dav
push ebx
call fcn.00402176
add esp, 0x48
push eax
call fcn.00402a27
push ebx
push ebx
mov dword [ebp - 0x84], eax
call fcn.004031fc
push eax
push str._sSoundsIntroLeaving.dav
push ebx
call fcn.00402176
push eax
call fcn.00402a27
push ebx
push ebx
mov dword [ebp - 0xb8], eax
call fcn.004031fc
push eax
push str._sSoundsIntroAcronym.dav
push ebx
call fcn.00402176
push eax
call fcn.00402a27
push ebx
push ebx
mov dword [ebp + 0x14], eax
call fcn.004031fc
push eax
push str._sSoundsIntroPing.dav
push ebx
call fcn.00402176
add esp, 0x48
push eax
call fcn.00402a27
push ebx
push ebx
mov dword [ebp - 0x8c], eax
call fcn.004031fc
push eax
push str._sSoundsIntroPing2.dav
push ebx
call fcn.00402176
push eax
call fcn.00402a27
add esp, 0x1c
mov dword [ebp - 0x94], eax
call fcn.00401681
push eax
call fcn.004027de
push eax
call fcn.004020cc
mov esi, 0x5f41e0
push esi
mov dword [ebp - 0x18], eax
call fcn.004011d1
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0xec]
push esi
push eax
call fcn.004032c4
add esp, 0x14
mov eax, esi
call fcn.004f52f6
xor esi, esi
mov dword [ebp - 0x50], eax
call fcn.004f5665
xor edx, edx
call fcn.004f6162
push 0x37
call fcn.00403193
push eax
lea eax, [ebp + 0x3c]
push eax
call fcn.00402abd
push ebx
lea eax, [ebp + 0x3c]
push 0x2e
push eax
call fcn.004025ea
add esp, 0x18
cmp dword [0x762e28], ebx
je 0x4f6e2d
xor eax, eax
mov word [ebp - 0xd4], bx
lea edi, [ebp - 0xd2]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x241
stosw word es:[edi], ax
lea eax, [ebp - 0xd4]
push str..TitlePage.c
push eax
call fcn.0040169a
push ecx
lea esi, [ebp - 0xd4]
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.00401f55
push eax
push str.._04d
lea eax, [ebp + 0x3c]
push 0x37
push eax
call fcn.00402dbf
add esp, 0x20
push 0x24
pop eax
xor edi, edi
mov dword [ebp - 0x10], 0x59
mov dword [ebp - 0x38], 9
mov dword [ebp - 0xc], 0x13
mov dword [ebp - 0x34], 0xffffffd4
mov dword [ebp - 8], 0x1b
mov dword [ebp - 0x30], 0xffffffce
mov dword [ebp - 4], eax
mov dword [ebp - 0x2c], 0xffffffc8
mov dword [ebp], 0x2d
mov dword [ebp - 0x28], 0xffffffc2
mov dword [ebp + 4], 0x35
mov dword [ebp - 0x24], 0xffffffbc
mov dword [ebp + 8], ebx
mov dword [ebp + 0x24], eax
inc edi
call fcn.00401e97
mov dword [ebp + 0x30], eax
xor esi, esi
cmp dword [ebp + esi - 0x7c], ebx
jne 0x4f6eb1
push ebx
push dword [ebp + esi - 0x38]
push dword [ebp + esi - 0x10]
push dword [ebp + esi - 0xec]
call fcn.00401d25
add esp, 0x10
add esi, 4
cmp esi, 0x18
jl 0x4f6e93
cmp dword [ebp - 0x64], ebx
jne 0x4f6ed0
push ebx
push dword [ebp + 0x24]
push dword [ebp + 8]
push dword [ebp - 0x50]
call fcn.00401d25
add esp, 0x10
cmp dword [ebp - 0x10], ebx
mov dword [ebp - 0x7c], edi
jle 0x4f6ee2
sub dword [ebp - 0x10], 3
cmp dword [ebp - 0x10], ebx
mov dword [ebp - 0x7c], ebx
jge 0x4f6ee7
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x38], 9
jge 0x4f6ef3
inc dword [ebp - 0x38]
mov dword [ebp - 0x7c], ebx
xor esi, esi
lea eax, [ebp + esi - 0x34]
mov ecx, dword [eax]
cmp ecx, edi
jge 0x4f6f08
inc ecx
mov dword [eax], ecx
mov dword [ebp + esi - 0x78], ebx
jmp 0x4f6f20
lea eax, [ebp + esi - 0x78]
cmp dword [eax], ebx
jne 0x4f6f20
push ebx
push dword [ebp - 0xc0]
mov dword [eax], edi
call fcn.00401541
pop ecx
pop ecx
add esi, 4
cmp esi, 0x14
jl 0x4f6ef5
cmp dword [ebp + 8], ebx
mov dword [ebp - 0x64], edi
jle 0x4f6f36
dec dword [ebp + 8]
mov dword [ebp - 0x64], ebx
cmp dword [ebp + 0x24], 0xb
jle 0x4f6f42
dec dword [ebp + 0x24]
mov dword [ebp - 0x64], ebx
call fcn.00401e97
sub eax, dword [ebp + 0x30]
push 0xa
pop edx
cmp eax, edx
ja 0x4f6f68
mov ecx, edx
sub ecx, eax
js 0x4f6f61
cmp ecx, 0x7fffffff
jge 0x4f6f61
sub edx, eax
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
cmp dword [ebp + eax*4 - 0x7c], ebx
je 0x4f6f76
inc eax
cmp eax, 6
jle 0x4f6f6a
cmp eax, 6
jge 0x4f6f8d
mov esi, 0x762e34
call fcn.004f5665
test eax, eax
je 0x4f6e89
mov esi, 0x762e34
mov dword [ebp + 0x20], 0xfffffff3
mov dword [ebp + 0x18], 2
call fcn.004f5665
test eax, eax
jne 0x4f6fb7
push ebx
push dword [ebp - 0x84]
call fcn.00401541
pop ecx
pop ecx
call fcn.00401e97
push ebx
push dword [ebp + 0x18]
mov dword [ebp + 0x30], eax
push dword [ebp + 0x20]
push dword [ebp - 0x48]
call fcn.00401d25
add esp, 0x10
cmp dword [ebp + 0x20], 3
mov dword [ebp - 0x7c], edi
jge 0x4f6fe0
inc dword [ebp + 0x20]
mov dword [ebp - 0x7c], ebx
cmp dword [ebp + 0x18], 2
jge 0x4f6fec
inc dword [ebp + 0x18]
mov dword [ebp - 0x7c], ebx
call fcn.00401e97
sub eax, dword [ebp + 0x30]
push 0xa
pop edx
cmp eax, edx
ja 0x4f7012
mov ecx, edx
sub ecx, eax
js 0x4f700b
cmp ecx, 0x7fffffff
jge 0x4f700b
sub edx, eax
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x7c], ebx
jne 0x4f7025
mov esi, 0x762e34
call fcn.004f5665
test eax, eax
je 0x4f6fb7
mov esi, 0x762e34
call fcn.004f5665
test eax, eax
jne 0x4f709b
xor edi, edi
mov esi, 0x762e34
call fcn.004f5665
test eax, eax
jne 0x4f7051
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 5
jl 0x4f7035
push ebx
push dword [ebp - 0xc4]
call fcn.00401541
push 2
push 0x3b
call fcn.004032a1
push 0x5f5d38
call fcn.0040292d
push str.____2
call fcn.00401528
add esp, 0x18
xor edi, edi
mov esi, 0x762e34
call fcn.004f5665
test eax, eax
jne 0x4f709b
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 0xa
jl 0x4f707f
cmp dword [0x762e2c], ebx
je 0x4f70ad
call fcn.00401e97
mov dword [0x762e30], eax
mov esi, 0x762e34
call fcn.004f5665
test eax, eax
jne 0x4f79a7
inc eax
push 9
pop ecx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x4c], eax
xor eax, eax
push 9
lea edi, [ebp - 0x138]
mov dword [ebp - 0x13c], ebx
rep stosd dword es:[edi], eax
pop ecx
lea edi, [ebp - 0x110]
mov dword [ebp - 0x114], ebx
push 0xa
rep stosd dword es:[edi], eax
mov dword [ebp - 0x9c], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0xb4], ebx
mov dword [ebp + 0x10], 2
mov dword [ebp - 0xbc], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x14], ebx
xor edi, edi
pop esi
call fcn.0050ea90
and eax, reloc.WSOCK32.dll_closesocket
jns 0x4f7125
dec eax
or eax, 0xfffffffc
inc eax
add eax, 5
mov dword [ebp + edi*4 - 0x114], eax
inc edi
cmp edi, esi
jl 0x4f7114
xor eax, eax
lea ecx, [eax + 0x40]
mov dword [ebp + eax*4 - 0x13c], ecx
inc eax
cmp eax, esi
jl 0x4f7136
call fcn.00401e97
mov dword [ebp + 0x30], eax
test byte [ebp - 0x40], 1
push 0x17
pop edi
je 0x4f715f
cmp dword [ebp - 0x1c], ebx
je 0x4f7172
push 0x1e
jmp 0x4f7166
cmp dword [ebp - 0x1c], ebx
je 0x4f7172
push 0x1f
push 2
push 0x3f
call fcn.00401811
add esp, 0xc
mov dword [ebp - 0x1c], ebx
call fcn.00401e97
sub eax, dword [ebp - 0x9c]
cmp eax, 0x87
jb 0x4f719c
call fcn.00401e97
inc dword [ebp - 0x40]
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x1c], 1
call fcn.00401e97
sub eax, dword [ebp - 0x14]
cmp eax, 0x16
jae 0x4f71b2
cmp eax, 0x2d
jb 0x4f7240
lea eax, [ebp + 0x3c]
push eax
xor edi, edi
call fcn.00508320
test eax, eax
pop ecx
jle 0x4f7235
cmp dword [ebp + edi*4 - 0x114], 2
jg 0x4f71dd
lea eax, [ebp + 0x3c]
push eax
inc edi
call fcn.00508320
cmp edi, eax
pop ecx
jl 0x4f71c2
jmp 0x4f7235
lea eax, [ebp + edi*4 - 0x114]
dec dword [eax]
mov esi, dword [eax]
push 0x5f5d2c
call fcn.0040292d
mov eax, dword [ebp + edi*4 - 0x13c]
push esi
push eax
mov dword [ebp - 0x14], eax
call fcn.004032a1
movsx eax, byte [ebp + edi + 0x3c]
push eax
call fcn.00401e56
push 0x20
lea eax, [esi + 1]
push eax
push dword [ebp - 0x14]
call fcn.00402dd3
add esp, 0x1c
cmp esi, 2
jg 0x4f7232
push ebx
push dword [ebp - 0xa8]
call fcn.00401541
pop ecx
pop ecx
push 0xa
pop esi
call fcn.00401e97
push 0x17
mov dword [ebp - 0x14], eax
pop edi
mov eax, dword [0x762e2c]
cmp eax, ebx
je 0x4f7284
call fcn.00401e97
sub eax, dword [0x762e30]
cmp eax, 0x493e0
jbe 0x4f7264
xor eax, eax
mov dword [0x762e2c], eax
jmp 0x4f7269
mov eax, dword [0x762e2c]
cmp eax, ebx
je 0x4f7284
cmp dword [ebp + 0xc], ebx
jne 0x4f729c
call fcn.00401e97
sub eax, dword [ebp + 0x30]
mov dword [ebp + 0xc], eax
mov eax, dword [0x762e2c]
jmp 0x4f729c
cmp dword [ebp + 0xc], ebx
je 0x4f7299
call fcn.00401e97
sub eax, dword [ebp + 0xc]
mov dword [ebp + 0x30], eax
mov eax, dword [0x762e2c]
mov dword [ebp + 0xc], ebx
cmp dword [ebp - 0x44], ebx
je 0x4f73a8
mov ecx, dword [ebp + 0x10]
sub ecx, 3
je 0x4f7380
dec ecx
je 0x4f7362
dec ecx
je 0x4f7344
dec ecx
je 0x4f7325
dec ecx
je 0x4f7306
push edi
push esi
push 0xf
call fcn.00401811
push edi
push esi
push edi
call fcn.00401811
push edi
push esi
push 0x21
call fcn.00401811
push edi
push esi
push 0x2f
call fcn.00401811
push edi
push esi
push 0x38
call fcn.00401811
add esp, 0x3c
cmp dword [ebp + 0x10], 3
jbe 0x4f73a5
mov dword [ebp + 0x10], ebx
jmp 0x4f73a5
cmp eax, ebx
jne 0x4f7315
push ebx
push dword [ebp + 0x14]
call fcn.00401541
pop ecx
pop ecx
push edi
push esi
push 0x2f
call fcn.00401811
push 0x1f
push esi
push 0x38
jmp 0x4f739d
cmp eax, ebx
jne 0x4f7334
push ebx
push dword [ebp + 0x14]
call fcn.00401541
pop ecx
pop ecx
push edi
push esi
push 0x21
call fcn.00401811
push 0x1f
push esi
push 0x2f
jmp 0x4f739d
cmp eax, ebx
jne 0x4f7353
push ebx
push dword [ebp + 0x14]
call fcn.00401541
pop ecx
pop ecx
push edi
push esi
push edi
call fcn.00401811
push 0x1f
push esi
push 0x21
jmp 0x4f739d
cmp eax, ebx
jne 0x4f7371
push ebx
push dword [ebp + 0x14]
call fcn.00401541
pop ecx
pop ecx
push edi
push esi
push 0xf
call fcn.00401811
push 0x1f
push esi
push edi
jmp 0x4f739d
cmp eax, ebx
jne 0x4f738f
push ebx
push dword [ebp + 0x14]
call fcn.00401541
pop ecx
pop ecx
push edi
push esi
push 0x38
call fcn.00401811
push 0x1f
push esi
push 0xf
call fcn.00401811
add esp, 0x18
mov dword [ebp - 0x44], ebx
call fcn.00401e97
sub eax, dword [ebp - 0xb4]
mov esi, 0x309
cmp eax, esi
jb 0x4f73e0
call fcn.00401e97
sub eax, dword [ebp + 0x30]
cmp eax, 0xbb8
jbe 0x4f73e0
call fcn.00401e97
inc dword [ebp + 0x10]
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0x44], 1
cmp dword [ebp - 0x4c], ebx
je 0x4f746e
test byte [ebp - 0x20], 3
je 0x4f7410
push edi
push 0x15
call fcn.004032a1
push 0x5858c8
call fcn.0040292d
push str.Press_New_Line_to_Begin_Accounting.
call fcn.00401528
add esp, 0x10
jmp 0x4f746b
cmp dword [ebp - 0x20], ebx
jbe 0x4f746b
cmp dword [0x762e2c], ebx
jne 0x4f7442
inc dword [0x762e90]
cmp dword [0x762e90], 4
push ebx
jg 0x4f7435
push dword [ebp - 0x8c]
jmp 0x4f743b
push dword [ebp - 0x94]
call fcn.00401541
pop ecx
pop ecx
push edi
push 0x15
call fcn.004032a1
push 0x5858cc
call fcn.0040292d
push str.Press_New_Line_to_Begin_Accounting.
call fcn.00401528
push 0x5858c8
call fcn.0040292d
add esp, 0x14
mov dword [ebp - 0x4c], ebx
call fcn.00401e97
sub eax, dword [ebp - 0xbc]
cmp eax, esi
jb 0x4f74a1
call fcn.00401e97
sub eax, dword [ebp + 0x30]
cmp eax, 0x7d0
jbe 0x4f74a1
call fcn.00401e97
inc dword [ebp - 0x20]
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0x4c], 1
cmp dword [0x762e44], ebx
jne 0x4f780b
cmp dword [0x762e2c], ebx
jne 0x4f780b
push 7
pop esi
cmp dword [ebp + 0x34], esi
ja case.default.0x4f74c8
mov eax, dword [ebp + 0x34]
jmp dword [eax*4 + 0x4f7d71]
call fcn.00401e97
sub eax, dword [ebp + 0x30]
cmp eax, 0x2710
jbe 0x4f7815
mov edi, dword [ebp - 0xa0]
push ebx
push edi
call fcn.00401541
pop ecx
pop ecx
mov dword [ebp + 0x2c], edi
call fcn.00401e97
mov dword [ebp + 0x38], eax
mov dword [ebp + 0x34], 1
jmp 0x4f7815
call fcn.00401e97
sub eax, dword [ebp + 0x38]
cmp eax, 0x7530
jbe 0x4f7815
call fcn.00401e97
sub eax, dword [ebp + 0x1c]
cmp eax, 0x2710
jbe 0x4f7815
mov edi, dword [ebp - 0x88]
push ebx
push edi
call fcn.00401541
pop ecx
pop ecx
mov dword [ebp + 0x2c], edi
call fcn.00401e97
mov dword [ebp + 0x38], eax
mov dword [ebp + 0x34], 2
jmp 0x4f7815
call fcn.00401e97
sub eax, dword [ebp + 0x38]
cmp eax, 0x7530
jbe 0x4f7815
call fcn.00401e97
sub eax, dword [ebp + 0x1c]
cmp eax, 0x2710
jbe 0x4f7815
mov edi, dword [ebp - 0xb0]
push ebx
push edi
call fcn.00401541
pop ecx
pop ecx
mov dword [ebp + 0x2c], edi
call fcn.00401e97
mov dword [ebp + 0x38], eax
mov dword [ebp + 0x34], 3
jmp 0x4f7815
call fcn.00401e97
sub eax, dword [ebp + 0x38]
cmp eax, 0x7530
jbe 0x4f7815
call fcn.00401e97
sub eax, dword [ebp + 0x1c]
cmp eax, 0x2710
jbe 0x4f7815
mov edi, dword [ebp - 0x90]
push ebx
push edi
call fcn.00401541
pop ecx
pop ecx
mov dword [ebp + 0x2c], edi
call fcn.00401e97
mov dword [ebp + 0x38], eax
mov dword [ebp + 0x34], 4
jmp 0x4f7815
call fcn.00401e97
sub eax, dword [ebp + 0x38]
cmp eax, 0xea60
jbe 0x4f7815
call fcn.00401e97
sub eax, dword [ebp + 0x1c]
cmp eax, 0x2710
jbe 0x4f7815
mov edi, dword [ebp - 0x80]
push ebx
push edi
call fcn.00401541
pop ecx
pop ecx
mov dword [ebp + 0x2c], edi
call fcn.00401e97
mov dword [ebp + 0x38], eax
mov dword [ebp + 0x34], 5
jmp 0x4f7815
push 0xd
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x4f790d
push 0x1b
pop esi
push esi
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x4f7856
cmp byte [esi + 0x762eb0], bl
jne 0x4f785c
mov byte [esi + 0x762eb0], 1
mov esi, 0x762e34
call fcn.004f5665
test eax, eax
jne 0x4f790d
cmp dword [ebp + 0x34], ebx
jbe 0x4f790d
cmp dword [0x762e2c], ebx
jne 0x4f790d
call fcn.00401e97
sub eax, dword [0x762e94]
cmp eax, 0xbb8
jbe 0x4f78fd
call fcn.00401e97
mov ecx, dword [0x762e9c]
sub eax, dword [ebp + 0x38]
add ecx, 0xbb8
cmp eax, ecx
jbe 0x4f78fd
push dword [ebp + 0x2c]
call fcn.00401b77
test eax, eax
pop ecx
jne 0x4f78df
call fcn.00401e97
sub eax, dword [0x762e98]
cmp eax, 0x1b58
jb 0x4f78df
call fcn.00401e97
mov edi, dword [ebp - 0x3c]
mov ecx, dword [0x762ea0]
inc edi
cmp ecx, ebx
mov dword [0x762e94], eax
mov dword [ebp - 0x3c], edi
jle 0x4f786e
xor esi, esi
call fcn.0050ea90
mov ecx, dword [0x762ea0]
cdq
idiv ecx
inc edx
cmp edx, dword [0x762ea4]
jne 0x4f7870
inc esi
cmp esi, 0xa
jl 0x4f77d5
jmp 0x4f7870
call fcn.00401e97
sub eax, dword [ebp + 0x38]
cmp eax, 0x1f40
ja 0x4f796b
cmp dword [ebp + 0x34], 7
ja 0x4f76fd
call fcn.00401e97
sub eax, dword [ebp + 0x38]
cmp eax, 0x2710
jbe 0x4f76fd
call fcn.00401e97
sub eax, dword [ebp + 0x30]
cmp eax, 0x50910
jbe 0x4f76fd
cmp dword [0x762e2c], ebx
jne 0x4f790d
mov dword [ebp + 0x34], 7
mov dword [ebp + 0x38], ebx
jmp 0x4f790d
mov byte [esi + 0x762eb0], bl
inc esi
cmp esi, 0x87
jl 0x4f7711
jmp 0x4f790d
mov edx, edi
cmp ecx, ebx
mov dword [0x762ea4], edx
jle 0x4f788d
lea eax, [ecx + ecx]
cmp edi, eax
jle 0x4f788d
mov dword [ebp + 0x34], 7
mov dword [ebp + 0x38], ebx
jmp 0x4f78fd
push ebx
push edx
push ebx
push ebx
call fcn.004031fc
pop ecx
pop ecx
push eax
push str._sSoundsIntroIntel_d.dav
push ebx
call fcn.00402176
add esp, 0x10
push eax
call fcn.0040155f
test eax, eax
pop ecx
pop ecx
jne 0x4f78d0
cmp dword [0x762ea0], ebx
jne 0x4f78d0
cmp edi, ebx
jle 0x4f78d0
add dword [0x762e9c], 0x2ee0
dec edi
mov dword [0x762ea0], edi
call fcn.00401e97
mov dword [ebp + 0x38], eax
mov dword [0x762e98], eax
jmp 0x4f78fd
cmp dword [0x762e94], ebx
jne 0x4f78f3
call fcn.00401e97
mov dword [0x762e94], eax
jmp 0x4f78fd
add dword [0x762e94], 0x7d0
cmp dword [0x762ea0], ebx
jne 0x4f790d
call fcn.00401e97
mov dword [ebp + 0x1c], eax
mov esi, 0x762e34
mov edx, esi
call fcn.004f6162
cmp eax, ebx
je 0x4f7939
cmp eax, 0x13
jne 0x4f7976
call fcn.004026a3
call fcn.00401e97
mov dword [ebp + 0x38], eax
call fcn.00401e97
mov dword [0x762e30], eax
call fcn.00401e6f
test eax, eax
je 0x4f7952
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.004014bf
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.004f5665
test eax, eax
jne 0x4f79a7
push 0xa
pop esi
jmp 0x4f714d
inc dword [ebp + 0x34]
mov dword [ebp + 0x28], ebx
jmp 0x4f7b81
push 0x20001
push ebx
push ebx
push ebx
mov dword [ebp + 0x28], eax
call fcn.004031fc
push eax
push str._sSoundsCodeEntered.wav
push ebx
call fcn.00402176
add esp, 0x14
push eax
call dword [sym.imp.WINMM.dll_PlaySoundA]
push 0x2ee
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00402158
mov esi, 0x762e34
call fcn.004f5665
test eax, eax
je 0x4f79dc
cmp dword [ebp + 0x28], ebx
jne 0x4f79c3
or dword [ebp + 0x28], 0xffffffff
call fcn.00401e6f
test eax, eax
je 0x4f79dc
push 0x4e20
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.004014bf
cmp dword [ebp - 0x34], ebx
jl 0x4f79ef
push ebx
push dword [ebp - 0xb8]
call fcn.00401541
pop ecx
pop ecx
push 0x28
lea eax, [ebp - 0x7c]
push ebx
push eax
call fcn.00508d00
add esp, 0xc
jmp 0x4f7b75
call fcn.00401e97
push ebx
mov dword [ebp + 0x30], eax
call fcn.00401a7d
mov esi, dword [ebp - 0x18]
push eax
push esi
call fcn.00402784
push esi
call fcn.00402879
push ebx
push ebx
push dword [ebp + 0x18]
push dword [ebp + 0x20]
push esi
push dword [ebp - 0x48]
call fcn.00402b53
add esp, 0x28
xor edi, edi
push ebx
push ebx
push dword [ebp + edi - 0x38]
push dword [ebp + edi - 0x10]
push esi
push dword [ebp + edi - 0xec]
call fcn.00402b53
add edi, 4
add esp, 0x18
cmp edi, 0x18
jl 0x4f7a37
push ebx
push ebx
push dword [ebp + 0x24]
push dword [ebp + 8]
push esi
push dword [ebp - 0x50]
call fcn.00402b53
push ebx
push ebx
push ebx
push esi
call fcn.00401d25
add esp, 0x28
xor eax, eax
push 7
inc eax
cmp dword [ebp - 0x10], ebx
pop ecx
lea edi, [ebp - 0x7c]
rep stosd dword es:[edi], eax
jle 0x4f7a92
cmp dword [ebp - 0x10], 0x50
jge 0x4f7a9f
add dword [ebp - 0x10], 7
jmp 0x4f7a9c
cmp dword [ebp - 0x10], 0xffffffb0
jle 0x4f7a9f
sub dword [ebp - 0x10], 8
mov dword [ebp - 0x7c], ebx
cmp dword [ebp + 0x20], 0xfffffff1
jle 0x4f7ab2
cmp dword [ebp + 0x18], 0xfffffff7
jle 0x4f7ab2
sub dword [ebp + 0x20], 4
mov dword [ebp - 0x7c], ebx
cmp dword [ebp - 0xc], 0xfffffff6
jle 0x4f7ac7
cmp dword [ebp - 0x34], 0xfffffff7
jle 0x4f7ac7
sub dword [ebp - 0xc], 3
mov dword [ebp - 0x78], ebx
jmp 0x4f7ada
cmp dword [ebp - 8], 0xfffffff6
jle 0x4f7ada
cmp dword [ebp - 0x30], 0xfffffff7
jle 0x4f7ada
sub dword [ebp - 8], 5
mov dword [ebp - 0x74], ebx
cmp dword [ebp + 4], 0x50
jge 0x4f7aef
cmp dword [ebp - 0x24], 0xfffffff7
jle 0x4f7aef
add dword [ebp + 4], 3
mov dword [ebp - 0x68], ebx
jmp 0x4f7b02
cmp dword [ebp], 0x50
jge 0x4f7b02
cmp dword [ebp - 0x28], 0xfffffff7
jle 0x4f7b02
add dword [ebp], 5
mov dword [ebp - 0x6c], ebx
cmp dword [ebp - 0x24], eax
jge 0x4f7b12
cmp dword [ebp - 0x2c], 0xfffffff7
jle 0x4f7b29
dec dword [ebp - 0x2c]
jmp 0x4f7b26
cmp dword [ebp - 0x78], ebx
je 0x4f7b29
cmp dword [ebp - 0x68], ebx
je 0x4f7b29
cmp dword [ebp - 0x2c], 0x51
jge 0x4f7b29
add dword [ebp - 0x2c], 5
mov dword [ebp - 0x70], ebx
cmp dword [ebp + 0x24], 0x1c
jge 0x4f7b36
add dword [ebp + 0x24], 2
mov dword [ebp - 0x64], ebx
call fcn.00401e97
sub eax, dword [ebp + 0x30]
cmp eax, 0x14
ja 0x4f7b62
push 0x14
pop ecx
sub ecx, eax
js 0x4f7b5a
cmp ecx, 0x7fffffff
jge 0x4f7b5a
push 0x14
pop ecx
sub ecx, eax
push ecx
jmp 0x4f7b5c
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
cmp dword [ebp + eax*4 - 0x7c], ebx
je 0x4f7b70
inc eax
cmp eax, 6
jle 0x4f7b64
cmp eax, 6
jge 0x4f7b81
cmp dword [0x5f2e54], ebx
jne 0x4f7a03
xor edi, edi
inc edi
push 0x5acdbc
mov dword [0x762e34], edi
call fcn.00402d42
push dword [ebp - 0xc4]
call fcn.004011e5
push dword [ebp - 0xa0]
call fcn.004011e5
push dword [ebp - 0x88]
call fcn.004011e5
push dword [ebp - 0xb0]
call fcn.004011e5
push dword [ebp - 0x90]
call fcn.004011e5
push dword [ebp - 0x80]
call fcn.004011e5
push dword [ebp - 0x98]
call fcn.004011e5
push dword [ebp - 0xa4]
call fcn.004011e5
push dword [ebp - 0xac]
call fcn.004011e5
push dword [ebp - 0xc0]
call fcn.004011e5
push dword [ebp - 0xa8]
call fcn.004011e5
push dword [ebp - 0xb8]
call fcn.004011e5
push dword [ebp - 0x84]
call fcn.004011e5
push dword [ebp + 0x14]
call fcn.004011e5
push dword [ebp - 0x8c]
call fcn.004011e5
add esp, 0x40
push dword [ebp - 0x94]
call fcn.004011e5
push dword [ebp - 0x48]
call fcn.00401b3b
push dword [ebp - 0x50]
call fcn.00401b3b
push dword [ebp - 0x18]
call fcn.00401b3b
add esp, 0x10
xor esi, esi
push dword [ebp + esi*4 - 0xec]
call fcn.00401b3b
inc esi
cmp esi, 6
pop ecx
jl 0x4f7c5e
cmp dword [0x762e40], ebx
je 0x4f7c7c
mov dword [ebp + 0x28], ebx
cmp dword [ebp + 0x28], ebx
jne 0x4f7cb7
push ebx
call fcn.00401230
push ebx
push ebx
call fcn.004031fc
push eax
push str._sSoundsIntroWait9.dav
push ebx
call fcn.00402176
push eax
call fcn.00402a27
mov esi, eax
push edi
push esi
call fcn.00401541
push esi
call fcn.004011e5
add esp, 0x28
jmp 0x4f7d41
jg 0x4f7d41
cmp dword [ebp + 0x34], 6
jae 0x4f7d22
call fcn.00401e97
sub eax, dword [ebp + 0x30]
cmp eax, 0x2bf20
ja 0x4f7d22
cmp dword [ebp + 0x34], 4
jae 0x4f7d12
call fcn.00401e97
sub eax, dword [ebp + 0x30]
cmp eax, 0x1d4c0
ja 0x4f7d12
cmp dword [ebp + 0x34], 2
jae 0x4f7d02
call fcn.00401e97
sub eax, dword [ebp + 0x30]
cmp eax, 0x7530
ja 0x4f7d02
cmp dword [ebp - 0x3c], 2
jl 0x4f7d41
push ebx
push ebx
push ebx
call fcn.004031fc
push eax
push str._sSoundsIntroResponse1.dav
jmp 0x4f7d30
push ebx
push ebx
push ebx
call fcn.004031fc
push eax
push str._sSoundsIntroResponse2.dav
jmp 0x4f7d30
push ebx
push ebx
push ebx
call fcn.004031fc
push eax
push str._sSoundsIntroResponse3.dav
push ebx
call fcn.00402176
add esp, 0x14
push eax
call fcn.004023e7
pop ecx
pop ecx
cmp dword [ebp - 0x54], ebx
je 0x4f7d4f
push dword [ebp - 0x54]
call fcn.00403026
pop ecx
push 0x5acdbc
call fcn.00401a7d
mov eax, dword [ebp + 0x28]
pop ecx
mov ecx, dword [ebp + 0x74]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00508cf0
add ebp, 0x78
leave
ret