Function at 0x4fef3a
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1e8
mov dword [ebp - 0x1c4], ecx
mov eax, dword [ebp - 0x1c4]
cmp dword [eax + 0x1c8], 0
je 0x4fef5d
jmp 0x50013a
cmp dword [ebp + 8], 0
jne 0x4fef68
jmp 0x50013a
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x20], 0
jb 0x4fef89
mov edx, dword [ebp + 8]
cmp dword [edx + 0x20], 0x3e8
jae 0x4fef89
mov dword [ebp - 0x1c8], 1
jmp 0x4fef93
mov dword [ebp - 0x1c8], 0
cmp dword [ebp - 0x1c8], 0
jne 0x4fefad
mov ecx, dword [ebp + 8]
call fcn.004fa230
test eax, eax
je 0x4fefad
jmp 0x50013a
mov eax, dword [ebp - 0x1c4]
xor ecx, ecx
mov cl, byte [eax + 0x620]
and ecx, 0xf
cmp ecx, 0xf
jne 0x4ff00e
mov edx, dword [0x6f0ab0]
mov eax, dword [edx + 0x4c]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x1c4]
movsx edx, byte [ecx + 0xa5a]
test edx, edx
jle 0x4ff00e
mov eax, dword [ebp - 0x14]
movsx ecx, byte [eax + 0xa5a]
test ecx, ecx
jle 0x4ff00e
mov edx, dword [ebp - 0x1c4]
movsx eax, byte [edx + 0xa5a]
mov ecx, dword [ebp - 0x14]
movsx edx, byte [ecx + 0xa5a]
cmp eax, edx
jne 0x4ff00e
jmp 0x50013a
mov eax, dword [ebp - 0x1c4]
movsx ecx, byte [eax + 0xa2d]
test ecx, ecx
je 0x4ff024
jmp 0x50013a
mov edx, dword [ebp + 8]
cmp dword [edx + 0x218], 0x42
jne 0x4ff058
mov eax, dword [ebp + 8]
movsx ecx, byte [eax + 0xa25]
cmp ecx, 1
jne 0x4ff058
mov edx, dword [0x6f0ab0]
mov eax, dword [edx + 0x4c]
movsx ecx, byte [eax + 0xa36]
test ecx, ecx
jne 0x4ff058
jmp 0x50013a
mov edx, dword [ebp - 0x1c4]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x1c4]
call dword [eax + 0x50]
cmp eax, 1
je 0x4ff07e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov ecx, dword [ebp + 8]
call dword [edx + 0x50]
cmp eax, 1
jne 0x4ff083
jmp 0x50013a
mov eax, dword [ebp - 0x1c4]
fld dword [eax + 0x28]
call fcn.005c5ef0
cmp eax, 0x93a
jl 0x4ff0e3
mov ecx, dword [ebp - 0x1c4]
fld dword [ecx + 0x28]
call fcn.005c5ef0
cmp eax, 0x942
jg 0x4ff0e3
mov edx, dword [ebp - 0x1c4]
fld dword [edx + 0x2c]
call fcn.005c5ef0
cmp eax, 0xf57
jl 0x4ff0e3
mov eax, dword [ebp - 0x1c4]
fld dword [eax + 0x2c]
call fcn.005c5ef0
cmp eax, 0xf5f
jg 0x4ff0e3
mov dword [ebp - 0x1cc], 1
jmp 0x4ff0ed
mov dword [ebp - 0x1cc], 0
cmp dword [ebp - 0x1cc], 0
je 0x4ff102
mov dword [ebp + 8], 0
jmp 0x50013a
mov ecx, dword [0x6f0ab0]
cmp dword [ecx + 0x24], 0x7530
je 0x4ff116
jmp 0x50013a
mov edx, dword [0x6f0ab0]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x27210], 0
je 0x4ff130
jmp 0x50013a
mov ecx, dword [ebp - 0xc]
cmp dword [ecx + 0x2720c], 0
je 0x4ff141
jmp 0x50013a
mov edx, dword [ebp - 0xc]
cmp dword [edx + 0x27204], 0
je 0x4ff152
jmp 0x50013a
cmp dword [0x277c05c], 0
je 0x4ff160
jmp 0x50013a
cmp dword [0x63a2b4], 0
jne 0x4ff276
mov eax, dword [ebp + 8]
movsx ecx, byte [eax + 0x215]
cmp ecx, 1
jne 0x4ff276
mov edx, dword [0x277c024]
xor eax, eax
mov ax, word [edx + 0xf60]
mov ecx, dword [ebp + 8]
xor edx, edx
mov dx, word [ecx + 0x878]
cmp eax, edx
je 0x4ff276
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cx, word [eax + 0x878]
test ecx, ecx
je 0x4ff276
cmp dword [0x63a2a0], 0
jne 0x4ff22d
mov edx, dword [ebp - 0x1c4]
fld dword [edx + 0x28]
call fcn.005c5ef0
sar eax, 7
cmp eax, 0x10
jle 0x4ff20e
mov eax, dword [ebp - 0x1c4]
fld dword [eax + 0x28]
call fcn.005c5ef0
sar eax, 7
cmp eax, 0x14
jge 0x4ff20e
mov ecx, dword [ebp - 0x1c4]
fld dword [ecx + 0x2c]
call fcn.005c5ef0
sar eax, 7
cmp eax, 0x1d
jle 0x4ff20e
mov dword [ebp - 0x1d0], 1
jmp 0x4ff218
mov dword [ebp - 0x1d0], 0
cmp dword [ebp - 0x1d0], 0
jne 0x4ff22d
mov dword [ebp - 0x1d4], 1
jmp 0x4ff237
mov dword [ebp - 0x1d4], 0
cmp dword [ebp - 0x1d4], 0
je 0x4ff245
jmp 0x50013a
mov edx, dword [ebp - 0x1c4]
movsx eax, byte [edx + 0xa5a]
test eax, eax
jle 0x4ff276
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx + 0xa5a]
mov eax, dword [ebp - 0x1c4]
movsx ecx, byte [eax + 0xa5a]
cmp edx, ecx
jne 0x4ff276
jmp 0x50013a
cmp dword [0x63a2b4], 0
jne 0x4ff3f0
cmp dword [0x63a2a0], 0
jne 0x4ff2f9
mov edx, dword [ebp - 0x1c4]
fld dword [edx + 0x28]
call fcn.005c5ef0
sar eax, 7
cmp eax, 0x10
jle 0x4ff2da
mov eax, dword [ebp - 0x1c4]
fld dword [eax + 0x28]
call fcn.005c5ef0
sar eax, 7
cmp eax, 0x14
jge 0x4ff2da
mov ecx, dword [ebp - 0x1c4]
fld dword [ecx + 0x2c]
call fcn.005c5ef0
sar eax, 7
cmp eax, 0x1d
jle 0x4ff2da
mov dword [ebp - 0x1d8], 1
jmp 0x4ff2e4
mov dword [ebp - 0x1d8], 0
cmp dword [ebp - 0x1d8], 0
jne 0x4ff2f9
mov dword [ebp - 0x1dc], 1
jmp 0x4ff303
mov dword [ebp - 0x1dc], 0
cmp dword [ebp - 0x1dc], 0
je 0x4ff3bf
mov edx, dword [ebp + 8]
xor eax, eax
mov ax, word [edx + 0x878]
test eax, eax
je 0x4ff344
mov ecx, dword [0x277c024]
xor edx, edx
mov dx, word [ecx + 0xf60]
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cx, word [eax + 0x878]
cmp edx, ecx
je 0x4ff344
jmp 0x50013a
mov edx, dword [ebp - 0xc]
movsx eax, byte [edx + 0x26ee0]
cmp eax, 1
jne 0x4ff3bd
mov ecx, dword [0x277c024]
xor edx, edx
mov dx, word [ecx + 0xf60]
test edx, edx
je 0x4ff3bd
mov eax, dword [0x277c024]
xor ecx, ecx
mov cx, word [eax + 0xf60]
mov edx, dword [ebp + 8]
xor eax, eax
mov ax, word [edx + 0x878]
cmp ecx, eax
je 0x4ff3bd
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x20], 0
jb 0x4ff3a5
mov edx, dword [ebp + 8]
cmp dword [edx + 0x20], 0x3e8
jae 0x4ff3a5
mov dword [ebp - 0x1e0], 1
jmp 0x4ff3af
mov dword [ebp - 0x1e0], 0
cmp dword [ebp - 0x1e0], 1
jne 0x4ff3bd
jmp 0x50013a
jmp 0x4ff3f0
mov eax, dword [ebp - 0x1c4]
movsx ecx, byte [eax + 0xa5a]
test ecx, ecx
jle 0x4ff3f0
mov edx, dword [ebp + 8]
movsx eax, byte [edx + 0xa5a]
mov ecx, dword [ebp - 0x1c4]
movsx edx, byte [ecx + 0xa5a]
cmp eax, edx
jne 0x4ff3f0
jmp 0x50013a
mov eax, dword [0x9a21cc]
mov edx, dword [eax]
mov ecx, dword [0x9a21cc]
call dword [edx + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
mov dword [eax + 0x26ebc], ecx
mov edx, dword [0x277c024]
add edx, 0x750
mov dword [ebp - 0x10], edx
mov dword [ebp - 8], 0
cmp dword [ebp - 0x10], 0
je 0x4ff445
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x30c]
and ecx, 0x20000000
test ecx, ecx
je 0x4ff445
mov dword [ebp - 8], 1
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x2754c]
add eax, 0x3e8
cmp dword [ebp - 4], eax
jbe 0x50013a
mov ecx, dword [ebp - 0x1c4]
fld dword [ecx + 0x28]
call fcn.005c5ef0
mov dword [ebp - 0x28], eax
mov edx, dword [ebp - 0x1c4]
fld dword [edx + 0x2c]
call fcn.005c5ef0
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 8]
fld dword [eax + 0x28]
call fcn.005c5ef0
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp + 8]
fld dword [ecx + 0x2c]
call fcn.005c5ef0
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x34]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call fcn.00541324
add esp, 0x10
mov dword [ebp - 0x30], eax
push 0x1b
mov eax, dword [0x277c024]
add eax, 0x750
push eax
call fcn.00539c2c
add esp, 8
add eax, dword [ebp - 8]
mov dword [ebp - 0x2c], eax
push 8
mov ecx, dword [ebp - 0xc]
add ecx, 0xd4
push ecx
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x34]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call fcn.0054139a
add esp, 0x18
mov eax, dword [ebp + 8]
cmp dword [eax + 0x218], 0x38
jne 0x4ff542
mov ecx, dword [ebp + 8]
xor edx, edx
mov dx, word [ecx + 0x166]
test edx, edx
jne 0x4ff542
mov eax, dword [ebp - 0x30]
sub eax, 0xc
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jge 0x4ff526
mov dword [ebp - 0x30], 0
mov ecx, dword [ebp + 8]
fld dword [ecx + 0x28]
call fcn.005c5ef0
mov dword [ebp - 0x18], eax
mov edx, dword [ebp + 8]
fld dword [edx + 0x2c]
call fcn.005c5ef0
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], 3
mov eax, dword [ebp - 0x1c4]
movsx ecx, byte [eax + 0xa43]
test ecx, ecx
je 0x4ff561
mov dword [ebp - 0x20], 3
mov edx, dword [0x277c024]
add edx, 0x750
mov dword [ebp - 0x24], edx
mov eax, dword [0x9a2660]
add eax, 1
mov dword [0x9a2660], eax
mov eax, dword [0x9a2660]
cdq
idiv dword [ebp - 0x20]
mov dword [0x9a2660], edx
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx + 0xa25]
cmp edx, 1
jne 0x4ff5c0
mov eax, dword [ebp + 8]
cmp dword [eax + 0x218], 0x42
jne 0x4ff5c0
mov ecx, dword [0x6f0ab0]
mov edx, dword [ecx + 0x4c]
movsx eax, byte [edx + 0xa36]
test eax, eax
jne 0x4ff5c0
jmp 0x50013a
mov ecx, dword [ebp - 0x30]
cmp ecx, dword [ebp - 0x2c]
jg 0x4fff48
mov edx, dword [ebp + 8]
fld dword [edx + 0x28]
call fcn.005c5ef0
cmp dword [ebp - 0x18], eax
jne 0x4fff48
mov eax, dword [ebp + 8]
fld dword [eax + 0x2c]
call fcn.005c5ef0
cmp dword [ebp - 0x1c], eax
jne 0x4fff48
push 0xa8
push 0
lea ecx, [ebp - 0x190]
push ecx
call fcn.005c5b80
add esp, 0xc
mov word [ebp - 0x18c], 0x39d
mov edx, dword [ebp - 0x1c4]
mov ax, word [edx + 0x20]
mov word [ebp - 0x18a], ax
mov ecx, dword [ebp - 0x1c4]
mov dx, word [ecx + 0x20]
mov word [ebp - 0x166], dx
mov eax, dword [ebp - 0x1c4]
fld dword [eax + 0x28]
call fcn.005c5ef0
mov word [ebp - 0x16e], ax
mov ecx, dword [ebp - 0x1c4]
fld dword [ecx + 0x2c]
call fcn.005c5ef0
mov word [ebp - 0x16c], ax
mov edx, dword [ebp - 0xc]
cmp dword [edx + 0x8b688], 0
je 0x4ff68d
mov eax, dword [ebp - 0xc]
mov cx, word [eax + 0x8b688]
mov word [ebp - 0x16e], cx
mov edx, dword [ebp - 0xc]
mov ax, word [edx + 0x8b68c]
mov word [ebp - 0x16c], ax
mov dword [ebp - 0x15c], 0xffffffff
mov word [ebp - 0x158], 0xffff
mov byte [ebp - 0x15f], 0
mov ecx, dword [0x9a2660]
add ecx, 4
mov byte [ebp - 0x162], cl
push 0x15
mov edx, dword [ebp - 0x24]
add edx, 0xbc
push edx
call fcn.00537962
add esp, 8
cmp eax, 0x65
jne 0x4ff6dd
mov word [ebp - 0x158], 0x97
jmp 0x4ff9da
push 0x15
mov eax, dword [ebp - 0x24]
add eax, 0xbc
push eax
call fcn.00537962
add esp, 8
cmp eax, 0x66
jne 0x4ff74f
mov word [ebp - 0x158], 0x98
mov ecx, dword [ebp - 0x24]
movsx edx, word [ecx + 0xbc]
imul edx, edx, 0x8c
movsx eax, word [edx + 0xfb9648]
cmp eax, 0x367
jne 0x4ff725
mov byte [ebp - 0x15f], 0
jmp 0x4ff74a
mov ecx, dword [ebp - 0x24]
movsx edx, word [ecx + 0xbc]
imul edx, edx, 0x8c
movsx eax, word [edx + 0xfb9648]
cmp eax, 0x368
jne 0x4ff74a
mov byte [ebp - 0x15f], 1
jmp 0x4ff9da
push 0x15
mov ecx, dword [ebp - 0x24]
add ecx, 0xbc
push ecx
call fcn.00537962
add esp, 8
cmp eax, 0x67
jne 0x4ff96a
mov word [ebp - 0x158], 0x99
mov edx, dword [ebp - 0x24]
movsx eax, word [edx + 0xbc]
imul eax, eax, 0x8c
movsx ecx, word [eax + 0xfb9648]
cmp ecx, 0x369
jne 0x4ff7a0
mov byte [ebp - 0x15f], 0
jmp 0x4ff968
mov edx, dword [ebp - 0x24]
movsx eax, word [edx + 0xbc]
imul eax, eax, 0x8c
movsx ecx, word [eax + 0xfb9648]
cmp ecx, 0x36a
jne 0x4ff7cb
mov byte [ebp - 0x15f], 1
jmp 0x4ff968
mov edx, dword [ebp - 0x24]
movsx eax, word [edx + 0xbc]
imul eax, eax, 0x8c
movsx ecx, word [eax + 0xfb9648]
cmp ecx, 0x36b
jne 0x4ff7f6
mov byte [ebp - 0x15f], 2
jmp 0x4ff968
mov edx, dword [ebp - 0x24]
movsx eax, word [edx + 0xbc]
imul eax, eax, 0x8c
movsx ecx, word [eax + 0xfb9648]
cmp ecx, 0x36c
jne 0x4ff821
mov byte [ebp - 0x15f], 3
jmp 0x4ff968
mov edx, dword [ebp - 0x24]
movsx eax, word [edx + 0xbc]
imul eax, eax, 0x8c
movsx ecx, word [eax + 0xfb9648]
cmp ecx, 0x36d
jne 0x4ff84c
mov byte [ebp - 0x15f], 4
jmp 0x4ff968
mov edx, dword [ebp - 0x24]
movsx eax, word [edx + 0xbc]
imul eax, eax, 0x8c
movsx ecx, word [eax + 0xfb9648]
cmp ecx, 0x37c
jne 0x4ff877
mov byte [ebp - 0x15f], 5
jmp 0x4ff968
mov edx, dword [ebp - 0x24]
movsx eax, word [edx + 0xbc]
imul eax, eax, 0x8c
movsx ecx, word [eax + 0xfb9648]
cmp ecx, 0x38b
jne 0x4ff8a2
mov byte [ebp - 0x15f], 6
jmp 0x4ff968
mov edx, dword [ebp - 0x24]
movsx eax, word [edx + 0xbc]
imul eax, eax, 0x8c
movsx ecx, word [eax + 0xfb9648]
cmp ecx, 0x38c
jne 0x4ff8cd
mov byte [ebp - 0x15f], 7
jmp 0x4ff968
mov edx, dword [ebp - 0x24]
movsx eax, word [edx + 0xbc]
imul eax, eax, 0x8c
movsx ecx, word [eax + 0xfb9648]
cmp ecx, 0x38d
jne 0x4ff8f5
mov byte [ebp - 0x15f], 8
jmp 0x4ff968
mov edx, dword [ebp - 0x24]
movsx eax, word [edx + 0xbc]
imul eax, eax, 0x8c
movsx ecx, word [eax + 0xfb9648]
cmp ecx, 0x25
jne 0x4ff91a
mov byte [ebp - 0x15f], 9
jmp 0x4ff968
mov edx, dword [ebp - 0x24]
movsx eax, word [edx + 0xbc]
imul eax, eax, 0x8c
movsx ecx, word [eax + 0xfb9648]
cmp ecx, 0x2ff
jne 0x4ff942
mov byte [ebp - 0x15f], 0xa
jmp 0x4ff968
mov edx, dword [ebp - 0x24]
movsx eax, word [edx + 0xbc]
imul eax, eax, 0x8c
movsx ecx, word [eax + 0xfb9648]
cmp ecx, 0xafe
jne 0x4ff968
mov byte [ebp - 0x15f], 0xb
jmp 0x4ff9da
push 0x15
mov edx, dword [ebp - 0x24]
add edx, 0xbc
push edx
call fcn.00537962
add esp, 8
cmp eax, 0x68
jne 0x4ff9da
mov word [ebp - 0x158], 0x68
mov eax, dword [ebp - 0x24]
movsx ecx, word [eax + 0xbc]
imul ecx, ecx, 0x8c
movsx edx, word [ecx + 0xfb9648]
cmp edx, 0x36e
jne 0x4ff9b4
mov byte [ebp - 0x15f], 0
jmp 0x4ff9da
mov eax, dword [ebp - 0x24]
movsx ecx, word [eax + 0xbc]
imul ecx, ecx, 0x8c
movsx edx, word [ecx + 0xfb9648]
cmp edx, 0x36f
jne 0x4ff9da
mov byte [ebp - 0x15f], 1
mov eax, dword [ebp + 8]
mov cx, word [eax + 0x20]
mov word [ebp - 0x154], cx
mov edx, dword [ebp - 0x154]
and edx, 0xffff
push edx
mov eax, dword [0x277c024]
mov edx, dword [eax]
mov ecx, dword [0x277c024]
call dword [edx + 0x34]
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jne 0x4ffa13
jmp 0x50013a
mov eax, dword [0x277c024]
xor ecx, ecx
mov cl, byte [eax + 0xa6a]
mov dword [ebp - 0xe8], ecx
mov dword [ebp - 0x150], 0xfffffffe
mov dx, word [0x63a2b0]
mov word [ebp - 0x164], dx
lea eax, [ebp - 0x160]
push eax
push 0x63a2b0
push 0
mov ecx, dword [0x277c024]
add ecx, 0x750
push ecx
call fcn.0054066a
add esp, 0x10
mov edx, dword [ebp - 0x3c]
fld dword [edx + 0x28]
call fcn.005c5ef0
mov word [ebp - 0x16a], ax
mov eax, dword [ebp - 0x3c]
fld dword [eax + 0x2c]
call fcn.005c5ef0
mov word [ebp - 0x168], ax
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x38], 0xa8
mov ecx, dword [ebp - 0x24]
xor edx, edx
mov dl, byte [ecx + 0x14]
cmp edx, 3
jne 0x4ffac3
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x30c]
and ecx, 0x200000
test ecx, ecx
je 0x4ffac3
mov word [ebp - 0x18c], 0x39e
mov dword [ebp - 0x38], 0x50
mov edx, dword [ebp - 0x24]
xor eax, eax
mov al, byte [edx + 0x14]
cmp eax, 3
jne 0x4ffebc
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 0x30c]
and edx, 0x40
test edx, edx
je 0x4ffebc
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x4c]
mov edx, dword [ebp - 0x3c]
fld dword [edx + 0x28]
fsub dword [ecx + 0x28]
call fcn.005c5ef0
mov dword [ebp - 0x194], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x4c]
mov edx, dword [ebp - 0x3c]
fld dword [edx + 0x2c]
fsub dword [ecx + 0x2c]
call fcn.005c5ef0
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x194], 0
jle 0x4ffb31
mov dword [ebp - 0x194], 1
jmp 0x4ffb44
cmp dword [ebp - 0x194], 0
jge 0x4ffb44
mov dword [ebp - 0x194], 0xffffffff
cmp dword [ebp - 0x198], 0
jle 0x4ffb59
mov dword [ebp - 0x198], 1
jmp 0x4ffb6c
cmp dword [ebp - 0x198], 0
jge 0x4ffb6c
mov dword [ebp - 0x198], 0xffffffff
mov eax, dword [ebp - 0x3c]
fld dword [eax + 0x28]
call fcn.005c5ef0
add eax, dword [ebp - 0x194]
mov dword [ebp - 0x1a0], eax
mov ecx, dword [ebp - 0x3c]
fld dword [ecx + 0x2c]
call fcn.005c5ef0
add eax, dword [ebp - 0x198]
mov dword [ebp - 0x1a4], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x34]
mov ecx, dword [eax + 0x10]
mov dword [ebp - 0x19c], ecx
mov edx, dword [ebp - 0x19c]
cmp dword [edx + 0xc], 0
je 0x4ffe7a
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x19c]
cmp ecx, dword [eax + 0x4c]
je 0x4ffe66
mov edx, dword [ebp - 0x19c]
cmp edx, dword [ebp - 0x3c]
je 0x4ffe66
mov eax, dword [ebp - 0x19c]
fld dword [eax + 0x28]
call fcn.005c5ef0
cmp eax, dword [ebp - 0x1a0]
jne 0x4ffe66
mov ecx, dword [ebp - 0x19c]
fld dword [ecx + 0x2c]
call fcn.005c5ef0
cmp eax, dword [ebp - 0x1a4]
jne 0x4ffe66
mov edx, dword [ebp - 0x19c]
cmp dword [edx + 0x20], 0
jb 0x4ffc35
mov eax, dword [ebp - 0x19c]
cmp dword [eax + 0x20], 0x3e8
jae 0x4ffc35
mov dword [ebp - 0x1e4], 1
jmp 0x4ffc3f
mov dword [ebp - 0x1e4], 0
cmp dword [ebp - 0x1e4], 1
jne 0x4ffdd2
mov ecx, dword [ebp - 0x19c]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x19c]
call dword [edx + 0x54]
test eax, eax
je 0x4ffc74
mov eax, dword [ebp - 0x19c]
xor ecx, ecx
mov cl, byte [eax + 0x214]
cmp ecx, 1
jne 0x4ffc88
mov edx, dword [ebp - 0x19c]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x19c], eax
jmp 0x4ffba9
cmp dword [0x63a2b4], 0
jne 0x4ffdd0
mov ecx, dword [0x277c024]
xor edx, edx
mov dx, word [ecx + 0xf60]
mov eax, dword [ebp - 0x19c]
xor ecx, ecx
mov cx, word [eax + 0x878]
cmp edx, ecx
je 0x4ffcd4
cmp dword [0x63a2a0], 0
jne 0x4ffcd4
mov edx, dword [ebp - 0x19c]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x19c], eax
jmp 0x4ffba9
cmp dword [0x63a2a0], 0
jle 0x4ffdd0
mov ecx, dword [ebp - 0x1c4]
movsx edx, byte [ecx + 0xa5a]
test edx, edx
jle 0x4ffd24
mov eax, dword [ebp - 0x1c4]
movsx ecx, byte [eax + 0xa5a]
mov edx, dword [ebp - 0x19c]
movsx eax, byte [edx + 0xa5a]
cmp ecx, eax
jne 0x4ffd24
mov ecx, dword [ebp - 0x19c]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x19c], edx
jmp 0x4ffba9
mov eax, dword [ebp - 0x1c4]
movsx ecx, byte [eax + 0xa5a]
cmp ecx, 3
jne 0x4ffda7
mov edx, dword [ebp - 0x19c]
cmp dword [edx + 0x20], 0
jb 0x4ffd5d
mov eax, dword [ebp - 0x19c]
cmp dword [eax + 0x20], 0x3e8
jae 0x4ffd5d
mov dword [ebp - 0x1e8], 1
jmp 0x4ffd67
mov dword [ebp - 0x1e8], 0
cmp dword [ebp - 0x1e8], 0
jne 0x4ffd93
mov ecx, dword [ebp - 0x19c]
movsx edx, byte [ecx + 0xa5a]
test edx, edx
jle 0x4ffda7
mov eax, dword [ebp - 0x19c]
movsx ecx, byte [eax + 0xa5a]
cmp ecx, 4
je 0x4ffda7
mov edx, dword [ebp - 0x19c]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x19c], eax
jmp 0x4ffba9
mov ecx, dword [ebp - 0x19c]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x19c]
call dword [edx + 0x58]
test eax, eax
jne 0x4ffdd0
mov eax, dword [ebp - 0x19c]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x19c], ecx
jmp 0x4ffba9
jmp 0x4ffe49
cmp dword [0x63a2b4], 0
jne 0x4ffe49
mov edx, dword [ebp - 0x19c]
movsx eax, byte [edx + 0x215]
cmp eax, 1
jne 0x4ffe49
mov ecx, dword [0x277c024]
xor edx, edx
mov dx, word [ecx + 0xf60]
mov eax, dword [ebp - 0x19c]
xor ecx, ecx
mov cx, word [eax + 0x878]
cmp edx, ecx
je 0x4ffe22
mov edx, dword [ebp - 0x19c]
xor eax, eax
mov ax, word [edx + 0x878]
test eax, eax
jne 0x4ffe35
mov ecx, dword [ebp - 0x19c]
xor edx, edx
mov dx, word [ecx + 0x878]
test edx, edx
jne 0x4ffe49
mov eax, dword [ebp - 0x19c]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x19c], ecx
jmp 0x4ffba9
mov edx, dword [ebp - 0x19c]
mov ax, word [edx + 0x20]
mov word [ebp - 0x14c], ax
mov dword [ebp - 0x148], 0xfffffffe
jmp 0x4ffe7a
mov ecx, dword [ebp - 0x19c]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x19c], edx
jmp 0x4ffba9
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x30c]
and ecx, 0x200000
cmp ecx, 0x200000
je 0x4ffeac
cmp dword [ebp - 0x148], 0xfffffffe
je 0x4ffeac
mov word [ebp - 0x18c], 0x39d
mov dword [ebp - 0x38], 0x48
jmp 0x4ffebc
mov word [ebp - 0x18c], 0x39e
mov dword [ebp - 0x38], 0x50
mov edx, dword [ebp - 0x38]
push edx
lea eax, [ebp - 0x190]
push eax
call fcn.0054da23
add esp, 8
mov ecx, dword [ebp - 0x38]
push ecx
lea edx, [ebp - 0x190]
push edx
lea eax, [ebp - 0xe4]
push eax
call fcn.005c5f60
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dx, word [ecx + 0x20]
mov word [ebp - 0xde], dx
mov byte [ebp - 0xb5], 1
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x30c]
and ecx, 0x20000000
test ecx, ecx
je 0x4fff20
mov dl, byte [ebp - 0xb4]
or dl, 4
mov byte [ebp - 0xb4], dl
lea eax, [ebp - 0xe4]
push eax
push 0x39d
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xc]
call dword [edx + 4]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
mov dword [eax + 0x2754c], ecx
jmp 0x50013a
mov edx, dword [ebp - 0xc]
movsx eax, byte [edx + 0x26ee0]
cmp eax, 1
jne 0x50013a
mov ecx, dword [ebp - 0x1c4]
cmp dword [ecx + 0x9d8], 0
je 0x4fff7d
mov edx, dword [ebp - 0x1c4]
cmp dword [edx + 0x9d8], 1
jne 0x50013a
mov eax, dword [ebp - 0x1c4]
movsx ecx, byte [eax + 0xa2c]
test ecx, ecx
je 0x4fff93
jmp 0x50013a
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
mov word [ebp - 0x1b0], ax
mov edx, dword [ebp - 0x1b0]
and edx, 0xffff
sar edx, 8
test edx, edx
jle 0x4fffba
jmp 0x50013a
mov eax, dword [ebp - 0x1c4]
fld dword [eax + 0x28]
call fcn.005c5ef0
mov dword [ebp - 0x1bc], eax
mov ecx, dword [ebp - 0x1c4]
fld dword [ecx + 0x2c]
call fcn.005c5ef0
mov dword [ebp - 0x1c0], eax
mov edx, dword [ebp + 8]
fld dword [edx + 0x28]
call fcn.005c5ef0
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
fld dword [eax + 0x2c]
call fcn.005c5ef0
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x1c0]
push eax
mov ecx, dword [ebp - 0x1bc]
push ecx
call fcn.00541324
add esp, 0x10
mov dword [ebp - 0x1a8], eax
mov dword [ebp - 0x1b4], 1
mov dword [ebp - 0x1b8], 1
mov edx, dword [ebp - 0x1bc]
cmp edx, dword [ebp - 0x18]
jle 0x50004b
mov dword [ebp - 0x1b4], 0xffffffff
mov eax, dword [ebp - 0x1c0]
cmp eax, dword [ebp - 0x1c]
jle 0x500060
mov dword [ebp - 0x1b8], 0xffffffff
mov dword [ebp - 0x1ac], 0
mov ecx, dword [ebp - 0x1a8]
cmp ecx, dword [ebp - 0x2c]
jle 0x5000fc
cmp dword [ebp - 0x1ac], 0x1f4
jle 0x50008a
jmp 0x50013a
mov edx, dword [ebp - 0x1bc]
cmp edx, dword [ebp - 0x18]
je 0x5000a7
mov eax, dword [ebp - 0x1bc]
add eax, dword [ebp - 0x1b4]
mov dword [ebp - 0x1bc], eax
mov ecx, dword [ebp - 0x1c0]
cmp ecx, dword [ebp - 0x1c]
je 0x5000c4
mov edx, dword [ebp - 0x1c0]
add edx, dword [ebp - 0x1b8]
mov dword [ebp - 0x1c0], edx
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x1c0]
push edx
mov eax, dword [ebp - 0x1bc]
push eax
call fcn.00541324
add esp, 0x10
mov dword [ebp - 0x1a8], eax
mov ecx, dword [ebp - 0x1ac]
add ecx, 1
mov dword [ebp - 0x1ac], ecx
jmp 0x50006a
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x1bc]
mov dword [edx + 0x276dc], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x1c0]
mov dword [ecx + 0x276e0], edx
push 0
push 0
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x276e0]
push ecx
mov edx, dword [eax + 0x276dc]
push edx
mov ecx, dword [ebp - 0x1c4]
call fcn.005054e8
mov esp, ebp
pop ebp
ret 4