Function at 0x4196d0
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, 0x2408
call fcn.004204b0
push ebx
push ebp
push esi
push edi
mov ebp, ecx
mov byte [esp + 0x10], 0
mov byte [esp + 0x11], 0
mov byte [esp + 0x12], 0
mov byte [esp + 0x13], 0
mov byte [esp + 0x14], 0
mov byte [esp + 0x15], 0
mov byte [esp + 0x16], 0
call fcn.004164b0
mov eax, dword [ebp + 0x18]
add eax, 0xffffffa6
cmp eax, 0x36
ja case.default.0x419717
jmp dword [eax*4 + 0x41a7a0]
mov ecx, dword [ebp + 0x300c]
call fcn.00403b40
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2408
ret
mov ecx, dword [ebp + 0x300c]
call fcn.00403b60
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2408
ret
mov ecx, dword [ebp + 0x300c]
call fcn.00406d70
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2408
ret
mov ecx, dword [ebp + 0x300c]
call fcn.00406e30
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2408
ret
mov ecx, dword [ebp + 0x34]
mov eax, dword [ebp + 0x50]
add eax, ecx
cmp ecx, eax
jae 0x41a794
lea eax, [ebp + ecx*4 + 0xb84]
mov dl, byte [eax - 0x400]
inc ecx
mov byte [eax], dl
mov dl, byte [eax - 0x3ff]
mov byte [eax + 1], dl
mov dl, byte [eax - 0x3fe]
mov byte [eax + 2], dl
mov edx, dword [ebp + 0x34]
mov edi, dword [ebp + 0x50]
add eax, 4
add edx, edi
cmp ecx, edx
jb 0x41978d
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2408
ret
lea eax, [ebp + 0x784]
mov ecx, 0x100
mov dl, byte [eax + 0x400]
mov byte [eax], dl
mov dl, byte [eax + 0x401]
mov byte [eax + 1], dl
mov dl, byte [eax + 0x402]
mov byte [eax + 2], dl
add eax, 4
dec ecx
jne 0x4197cd
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2408
ret
lea eax, [ebp + 0x784]
mov ecx, 0x10
mov dl, byte [eax + 0x802]
mov byte [eax], dl
mov dl, byte [eax + 0x801]
mov byte [eax + 1], dl
mov dl, byte [eax + 0x800]
mov byte [eax + 2], dl
add eax, 4
dec ecx
jne 0x419803
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2408
ret
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
xor ecx, ecx
test ax, ax
setl cl
mov word [0x4633f8], cx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2408
ret
mov ebp, dword [ebp + 0x34]
mov eax, dword [0x4634b4]
mov ecx, dword [0x4634c0]
xor edx, edx
lea esi, [ebp + ebp*2]
mov dx, word [eax + ecx + 0x462350]
shl esi, 4
add esi, ebp
add eax, edx
lea eax, [eax + esi*4]
lea eax, [eax + ecx + 0x462350]
mov cx, word [eax + 4]
mov word [0x4633d4], cx
mov dx, word [eax + 6]
mov word [0x4633d6], dx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2408
ret
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0xd
call esi
test ax, ax
jl 0x41a2ff
push 1
call esi
test ax, ax
jl 0x41a2ff
mov word [0x4633f8], 0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2408
ret
mov ecx, dword [ebp + 0x2ff0]
push 0
call fcn.0041f470
cmp eax, 1
jne 0x419905
mov ecx, dword [ebp + 0x2ff4]
call fcn.00412720
test eax, eax
je 0x419905
mov ecx, dword [ebp + 0x2ff0]
push 0
call fcn.0041f470
cmp eax, 1
je 0x4198e4
mov ecx, dword [ebp + 0x2ff0]
push 1
call fcn.0041f470
cmp eax, 1
jne 0x41a794
mov ecx, dword [ebp + 0x2ff4]
call fcn.00412720
test eax, eax
je 0x41a794
mov ecx, dword [ebp + 0x2ff0]
push 1
call fcn.0041f470
cmp eax, 1
je 0x41991b
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2408
ret
call dword [sym.imp.WINMM.dll_timeGetTime]
mov dword [ebp + 0x2fe8], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2408
ret
call dword [sym.imp.WINMM.dll_timeGetTime]
mov ecx, dword [ebp + 0x2fe8]
add ecx, 0x320
sub ecx, eax
mov eax, 0x51eb851f
mul ecx
shr edx, 6
mov dword [ebp + 0x2fe8], edx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2408
ret
mov ax, word [ebp + 0xfd8]
test ax, ax
je 0x41a794
mov ecx, dword [ebp + 0x2ff4]
and eax, 0xffff
shr eax, 2
mov esi, eax
call fcn.00412af0
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, dword [ebp + 0x2ff4]
call fcn.00412720
test eax, eax
je 0x41a794
mov ecx, dword [ebp + 0x2ff4]
call fcn.00412b00
cmp eax, esi
jae 0x41a794
push 0x10
call edi
test ax, ax
je 0x4199bc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2408
ret
mov eax, 0x43a6c1
lea ecx, [ebp + 0x7c5]
mov dl, byte [eax + 1]
add eax, 4
mov byte [ecx - 1], dl
mov dl, byte [eax - 4]
mov byte [ecx], dl
mov dl, byte [eax - 5]
mov byte [ecx + 1], dl
add ecx, 4
cmp eax, 0x43a781
jl 0x419a01
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2408
ret
mov ecx, dword [ebp + 0x2ff8]
lea eax, [ebp + 0xb84]
push eax
call fcn.00411480
lea esi, [ebp + 0xbc5]
mov edi, 0xf0
xor ecx, ecx
xor edx, edx
mov cl, byte [esi - 1]
mov dl, byte [esi + 1]
xor eax, eax
add ecx, edx
mov al, byte [esi]
add ecx, eax
mov eax, 0x55555556
imul ecx
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
mov ebx, edx
mov dword [esp + 0x10], ebx
fild dword [esp + 0x10]
fld st(0)
fmul qword [str.333333]
fcom qword [0x434538]
fnstsw ax
test ah, 0x41
jne 0x419a8e
fstp st(0)
fld qword [0x434538]
call fcn.00420410
fmul qword [0x434540]
mov byte [esi - 0x401], al
fcom qword [0x434538]
fnstsw ax
test ah, 0x41
jne 0x419ab4
fstp st(0)
fld qword [0x434538]
call fcn.00420410
mov byte [esi - 0x400], al
mov byte [esi - 0x3ff], bl
add esi, 4
dec edi
jne 0x419a47
lea edx, [ebp + 0x784]
push edx
jmp 0x41a0e0
lea eax, [ebp + 0x7c4]
mov ecx, 0xf0
mov dl, byte [eax + 0x400]
mov byte [eax], dl
mov dl, byte [eax + 0x401]
mov byte [eax + 1], dl
mov dl, byte [eax + 0x402]
mov byte [eax + 2], dl
add eax, 4
dec ecx
jne 0x419ae6
lea eax, [ebp + 0x784]
push eax
jmp 0x41a0e0
lea ecx, [esp + 0x418]
push ecx
mov ecx, dword [ebp + 0x2ffc]
push str.flag08
call fcn.0040ef50
mov ecx, 8
lea esi, [esp + 0x23f8]
mov edi, 0x464330
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2408
ret
push 1
jmp 0x41a760
mov eax, 0x43aa81
lea ecx, [ebp + 0x785]
mov dl, byte [eax + 1]
add eax, 4
mov byte [ecx - 1], dl
mov dl, byte [eax - 4]
mov byte [ecx], dl
mov dl, byte [eax - 5]
mov byte [ecx + 1], dl
add ecx, 4
cmp eax, 0x43ae81
jl 0x419b5a
jmp 0x419f30
mov eax, 0x40
lea ecx, [ebp + 0x7c5]
mov edx, dword [ebp + 0x34]
mov esi, dword [ebp + 0x50]
add eax, 4
add ecx, 4
lea edx, [esi + edx*4]
cmp eax, 0x2f0
mov edx, dword [edx*4 + 0x43f280]
mov dl, byte [edx + eax - 2]
mov byte [ecx - 5], dl
mov edx, dword [ebp + 0x34]
mov esi, dword [ebp + 0x50]
lea edx, [esi + edx*4]
mov edx, dword [edx*4 + 0x43f280]
mov dl, byte [edx + eax - 3]
mov byte [ecx - 4], dl
mov edx, dword [ebp + 0x34]
mov esi, dword [ebp + 0x50]
lea edx, [esi + edx*4]
mov edx, dword [edx*4 + 0x43f280]
mov dl, byte [edx + eax - 4]
mov byte [ecx - 3], dl
jl 0x419b88
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2408
ret
mov ecx, dword [ebp + 0x34]
mov eax, 0xd1b71759
mul ecx
shr edx, 0xd
mov byte [esp + 0x15], dl
mov eax, ecx
xor edx, edx
mov ecx, 0x2710
div ecx
mov eax, 0x10624dd3
mov ecx, edx
mul ecx
shr edx, 6
mov byte [esp + 0x14], dl
mov eax, ecx
xor edx, edx
mov ecx, 0x3e8
div ecx
mov eax, 0x51eb851f
mov ecx, edx
mul ecx
shr edx, 5
mov byte [esp + 0x13], dl
mov eax, ecx
xor edx, edx
mov ecx, 0x64
div ecx
mov eax, 0xcccccccd
mov ecx, edx
mul ecx
shr edx, 3
mov byte [esp + 0x12], dl
mov eax, ecx
xor edx, edx
mov ecx, 0xa
div ecx
mov dword [ebp + 0x34], edx
mov dl, byte [ebp + 0x34]
mov byte [esp + 0x11], dl
mov dx, word [0x463422]
and dx, 0xff
jne 0x419c83
mov edx, 5
mov al, byte [esp + edx + 0x10]
test al, al
jne 0x419c7a
dec edx
jns 0x419c6f
test edx, edx
jge 0x419c83
mov edx, 1
mov eax, dword [0x56451c]
mov ecx, dword [0x564518]
mov byte [eax + ecx], 1
mov eax, dword [0x46234c]
mov edi, dword [0x56451c]
and eax, 0xffff
inc edi
lea eax, [eax + eax*2]
mov dword [0x56451c], edi
mov ecx, dword [eax*4 + 0x564530]
inc ecx
and edx, 0xffff
mov dword [eax*4 + 0x564530], ecx
jle 0x419d61
mov ax, word [0x463422]
mov esi, dword [0x564518]
movzx cx, byte [esp + edx + 0x10]
and eax, 0x100
mov edi, dword [0x56451c]
neg eax
sbb eax, eax
and eax, 0xffff7de1
add eax, 0x824f
add eax, ecx
xor ecx, ecx
mov cl, ah
mov byte [edi + esi], cl
mov ecx, dword [0x46234c]
mov esi, dword [0x56451c]
and ecx, 0xffff
inc esi
lea ecx, [ecx + ecx*2]
mov dword [0x56451c], esi
mov ebp, dword [ecx*4 + 0x564530]
inc ebp
mov dword [ecx*4 + 0x564530], ebp
mov ecx, dword [0x564518]
mov byte [esi + ecx], al
mov eax, dword [0x46234c]
mov ebx, dword [0x56451c]
and eax, 0xffff
inc ebx
lea eax, [eax + eax*2]
mov dword [0x56451c], ebx
mov esi, dword [eax*4 + 0x564530]
inc esi
dec edx
test edx, edx
mov dword [eax*4 + 0x564530], esi
jg 0x419cc7
mov edx, dword [0x564518]
mov eax, dword [0x56451c]
mov byte [eax + edx], 0
mov eax, dword [0x46234c]
mov esi, dword [0x56451c]
and eax, 0xffff
inc esi
lea eax, [eax + eax*2]
mov dword [0x56451c], esi
inc dword [eax*4 + 0x564530]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2408
ret
mov eax, 0x40
lea ecx, [ebp + 0x7c5]
mov edx, dword [ebp + 0x34]
mov esi, dword [ebp + 0x50]
add eax, 4
add ecx, 4
lea edx, [esi + edx*4]
cmp eax, 0x3b0
mov edx, dword [edx*4 + 0x45e400]
mov dl, byte [edx + eax - 2]
mov byte [ecx - 5], dl
mov edx, dword [ebp + 0x34]
mov esi, dword [ebp + 0x50]
lea edx, [esi + edx*4]
mov edx, dword [edx*4 + 0x45e400]
mov dl, byte [edx + eax - 3]
mov byte [ecx - 4], dl
mov edx, dword [ebp + 0x34]
mov esi, dword [ebp + 0x50]
lea edx, [esi + edx*4]
mov edx, dword [edx*4 + 0x45e400]
mov dl, byte [edx + eax - 4]
mov byte [ecx - 3], dl
jl 0x419da7
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2408
ret
mov eax, 0x40
lea ecx, [ebp + 0x7c5]
mov edx, dword [ebp + 0x34]
mov esi, dword [ebp + 0x50]
add eax, 4
add ecx, 4
lea edx, [esi + edx*4]
cmp eax, 0x3b0
mov edx, dword [edx*4 + 0x45e300]
mov dl, byte [edx + eax - 2]
mov byte [ecx - 5], dl
mov edx, dword [ebp + 0x34]
mov esi, dword [ebp + 0x50]
lea edx, [esi + edx*4]
mov edx, dword [edx*4 + 0x45e300]
mov dl, byte [edx + eax - 3]
mov byte [ecx - 4], dl
mov edx, dword [ebp + 0x34]
mov esi, dword [ebp + 0x50]
lea edx, [esi + edx*4]
mov edx, dword [edx*4 + 0x45e300]
mov dl, byte [edx + eax - 4]
mov byte [ecx - 3], dl
jl 0x419e0f
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2408
ret
mov eax, 0x45e2c1
lea ecx, [ebp + 0x785]
mov dl, byte [eax + 1]
add eax, 4
mov byte [ecx - 1], dl
mov dl, byte [eax - 4]
mov byte [ecx], dl
mov dl, byte [eax - 5]
mov byte [ecx + 1], dl
add ecx, 4
cmp eax, 0x45e301
jl 0x419e77
mov byte [ebp + 0xfd0], 0xff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2408
ret
lea eax, [ebp + 0x7c5]
mov ecx, 0xdc
mov byte [eax - 1], 0
mov byte [eax], 0
mov byte [eax + 1], 0
add eax, 4
dec ecx
jne 0x419eb2
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2408
ret
mov ecx, dword [ebp + 0x2ff4]
call fcn.00412af0
mov ecx, dword [ebp + 0x2ff4]
call fcn.00412720
test eax, eax
je 0x41a794
mov ecx, dword [ebp + 0x2ff4]
call fcn.00412b00
cmp eax, dword [ebp + 0x34]
jbe 0x419ed9
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2408
ret
mov eax, 0x43ae81
lea ecx, [ebp + 0x785]
mov dl, byte [eax + 1]
add eax, 4
mov byte [ecx - 1], dl
mov dl, byte [eax - 4]
mov byte [ecx], dl
mov dl, byte [eax - 5]
mov byte [ecx + 1], dl
add ecx, 4
cmp eax, 0x43b281
jl 0x419f12
mov ecx, dword [ebp + 0x2ff8]
lea eax, [ebp + 0x784]
push eax
call fcn.004114c0
push 0xff
jmp 0x41a0ed
mov ecx, dword [ebp + 0x300c]
call fcn.00406e40
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2408
ret
mov ecx, dword [ebp + 0x300c]
call fcn.00406f00
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2408
ret
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [ebp + 0x2ff8]
call fcn.00411480
lea esi, [ebp + 0x784]
mov ecx, 0xec
mov eax, esi
mov dl, byte [eax + 0x400]
mov byte [eax], dl
mov dl, byte [eax + 0x401]
mov byte [eax + 1], dl
mov dl, byte [eax + 0x402]
mov byte [eax + 2], dl
add eax, 4
dec ecx
jne 0x419f95
lea eax, [ebp + 0xb84]
lea ecx, [esp + 0x18]
push eax
push ecx
mov ecx, dword [ebp + 0x300c]
call fcn.00406f10
test eax, eax
jne 0x41a697
lea eax, [ebp + 0x7c5]
mov ecx, 0xdc
mov byte [eax - 1], 0
mov byte [eax], 0
mov byte [eax + 1], 0
add eax, 4
dec ecx
jne 0x419fdf
mov ecx, dword [ebp + 0x2ff8]
push esi
call fcn.004114c0
mov ecx, dword [ebp + 0x2ff8]
push 0x10
call fcn.00411760
mov ecx, dword [ebp + 0x2ff8]
push 0xec
push 0
call fcn.00411570
mov word [0x4633f8], 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2408
ret
mov ecx, dword [ebp + 0x2ff8]
lea edx, [esp + 0x18]
push edx
call fcn.00411480
mov eax, 0x43a681
lea ecx, [ebp + 0xb85]
mov dl, byte [eax + 1]
add eax, 4
mov byte [ecx - 1], dl
mov dl, byte [eax - 4]
mov byte [ecx], dl
mov dl, byte [eax - 5]
mov byte [ecx + 1], dl
add ecx, 4
cmp eax, 0x43a6c1
jl 0x41a04a
lea esi, [ebp + 0x784]
mov ecx, 0xec
mov eax, esi
mov dl, byte [eax + 0x400]
mov byte [eax], dl
mov dl, byte [eax + 0x401]
mov byte [eax + 1], dl
mov dl, byte [eax + 0x402]
mov byte [eax + 2], dl
add eax, 4
dec ecx
jne 0x41a075
lea eax, [ebp + 0xb84]
lea ecx, [esp + 0x18]
push eax
push ecx
mov ecx, dword [ebp + 0x300c]
call fcn.00406f10
test eax, eax
jne 0x41a794
lea eax, [ebp + 0x7c4]
mov ecx, 0xdc
mov dl, byte [eax + 0x400]
mov byte [eax], dl
mov dl, byte [eax + 0x401]
mov byte [eax + 1], dl
mov dl, byte [eax + 0x402]
mov byte [eax + 2], dl
add eax, 4
dec ecx
jne 0x41a0bf
push esi
mov ecx, dword [ebp + 0x2ff8]
call fcn.004114c0
push 0x10
mov ecx, dword [ebp + 0x2ff8]
call fcn.00411760
mov ecx, dword [ebp + 0x2ff8]
push 0xec
push 0
call fcn.00411570
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2408
ret
mov ecx, dword [ebp + 0x2ff8]
lea eax, [ebp + 0x784]
push eax
call fcn.00411480
lea eax, [ebp + 0x7c4]
mov ecx, 0x70
mov dl, byte [eax + 0x400]
mov byte [eax], dl
mov dl, byte [eax + 0x401]
mov byte [eax + 1], dl
mov dl, byte [eax + 0x402]
mov byte [eax + 2], dl
add eax, 4
dec ecx
jne 0x41a132
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2408
ret
mov ecx, dword [ebp + 0x2ff8]
lea eax, [esp + 0x18]
push eax
call fcn.00411480
mov eax, 0x43a681
lea ecx, [ebp + 0xb85]
mov dl, byte [eax + 1]
add eax, 4
mov byte [ecx - 1], dl
mov dl, byte [eax - 4]
mov byte [ecx], dl
mov dl, byte [eax - 5]
mov byte [ecx + 1], dl
add ecx, 4
cmp eax, 0x43a6c1
jl 0x41a178
lea esi, [ebp + 0x784]
mov ecx, 0xec
mov eax, esi
mov dl, byte [eax + 0x400]
mov byte [eax], dl
mov dl, byte [eax + 0x401]
mov byte [eax + 1], dl
mov dl, byte [eax + 0x402]
mov byte [eax + 2], dl
add eax, 4
dec ecx
jne 0x41a1a3
lea eax, [ebp + 0xb84]
lea ecx, [esp + 0x18]
push eax
push ecx
mov ecx, dword [ebp + 0x300c]
call fcn.00406f70
test eax, eax
jne 0x41a697
lea eax, [ebp + 0x7ad]
mov ecx, 0xe2
mov byte [eax - 1], 0
mov byte [eax], 0
mov byte [eax + 1], 0
add eax, 4
dec ecx
jne 0x41a1ed
mov ecx, dword [ebp + 0x2ff8]
push esi
call fcn.004114c0
mov ecx, dword [ebp + 0x2ff8]
push 0x10
call fcn.00411760
mov ecx, dword [ebp + 0x2ff8]
push 0xec
push 0
call fcn.00411570
xor ecx, ecx
xor edx, edx
mov cx, word [ebp + 0x3020]
mov dx, word [ebp + 0x3022]
xor eax, eax
imul ecx, edx
mov al, byte [0x463421]
mov edi, dword [ebp + 0x3018]
and eax, 0xff
mov edx, ecx
mov bl, al
mov bh, bl
mov eax, ebx
shl eax, 0x10
mov ax, bx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ax, word [ebp + 0x3022]
mov cx, word [ebp + 0x3020]
push eax
push ecx
mov ecx, dword [ebp + 0x2ff8]
push 0
push 0
call fcn.00410de0
mov word [0x4633f8], 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2408
ret
mov ecx, dword [ebp + 0x300c]
call fcn.00406e30
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2408
ret
mov ecx, dword [ebp + 0x300c]
call fcn.00406fd0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2408
ret
mov ecx, dword [ebp + 0x2ff0]
push 2
call fcn.0041f470
cmp eax, 1
jne 0x41a697
mov ecx, dword [ebp + 0x2ff0]
push 2
call fcn.0041f470
test eax, eax
je 0x41a2ff
mov ecx, dword [ebp + 0x2ff4]
call fcn.00412720
test eax, eax
jne 0x41a2df
mov word [0x4633f8], 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2408
ret
mov edx, dword [ebp + 0xa4]
mov eax, dword [ebp + 0x88]
mov ecx, dword [ebp + 0x6c]
push edx
mov edx, dword [ebp + 0x50]
push eax
mov eax, dword [ebp + 0x34]
push ecx
mov ecx, dword [ebp + 0x300c]
push edx
push eax
call fcn.00405e90
mov ecx, dword [ebp + 0x300c]
call fcn.00406960
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2408
ret
mov ecx, dword [ebp + 0x50]
mov edx, dword [ebp + 0x34]
push ecx
mov ecx, dword [ebp + 0x300c]
push edx
call fcn.00406990
mov ecx, dword [ebp + 0x300c]
call fcn.00406d40
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2408
ret
mov ecx, dword [ebp + 0x300c]
call fcn.00405770
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2408
ret
mov ecx, dword [ebp + 0x300c]
call fcn.00405e70
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2408
ret
mov ecx, dword [ebp + 0x2ff8]
lea eax, [ebp + 0xb84]
push eax
call fcn.00411480
lea eax, [ebp + 0xf86]
mov ecx, 0x10
mov dl, byte [eax - 0x402]
mov byte [eax], dl
mov dl, byte [eax - 0x401]
mov byte [eax - 1], dl
mov dl, byte [eax - 0x400]
mov byte [eax - 2], dl
add eax, 4
dec ecx
jne 0x41a3c0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2408
ret
mov eax, dword [ebp + 0x300c]
mov ecx, dword [eax]
call fcn.00413ae0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2408
ret
lea ecx, [esp + 0x418]
push ecx
mov ecx, dword [ebp + 0x2ffc]
push str.flag08
call fcn.0040ef50
mov ecx, 8
mov esi, 0x464330
lea edi, [esp + 0x23f8]
lea edx, [esp + 0x418]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 0x2ffc]
push edx
push str.flag08
call fcn.0040ef70
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2408
ret
xor dx, dx
mov word [0x462348], dx
mov ecx, dword [0x462348]
mov eax, ecx
and eax, 0xffff
lea eax, [eax + eax*2]
mov esi, dword [eax*4 + 0x564528]
test esi, esi
je 0x41a48c
inc dx
cmp dx, 0x80
mov word [0x462348], dx
jb 0x41a45b
mov ecx, dword [0x462348]
test dx, dx
je 0x41a794
and ecx, 0xffff
lea ecx, [ecx + ecx*2]
mov edx, dword [ecx*4 + 0x564520]
mov dword [0x564b28], edx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2408
ret
mov edx, dword [0x564b28]
xor si, si
mov word [0x462348], si
mov ecx, dword [0x462348]
mov eax, ecx
and eax, 0xffff
lea eax, [eax + eax*2]
cmp dword [eax*4 + 0x56452c], edx
je 0x41a4f5
inc si
cmp si, 0x80
mov word [0x462348], si
jb 0x41a4c6
mov ecx, dword [0x462348]
cmp si, 0x80
jae 0x41a794
and ecx, 0xffff
lea ecx, [ecx + ecx*2]
mov dword [ecx*4 + 0x564528], 0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2408
ret
mov edx, dword [ebp + 0x50]
mov esi, dword [ebp + 0x34]
inc edx
cmp esi, edx
jae 0x41a794
lea ecx, [ebp + esi*4 + 0xb85]
mov eax, dword [ebp + 0xc0]
xor edx, edx
mov dl, byte [ecx - 1]
mov edi, 0x64
sub edi, eax
imul edx, eax
imul edi, dword [ebp + 0x6c]
add edx, edi
mov eax, 0x51eb851f
mul edx
shr edx, 5
mov byte [ecx - 1], dl
mov eax, dword [ebp + 0xc0]
xor edx, edx
mov edi, 0x64
mov dl, byte [ecx]
sub edi, eax
imul edi, dword [ebp + 0x88]
imul edx, eax
add edx, edi
mov eax, 0x51eb851f
mul edx
shr edx, 5
mov byte [ecx], dl
mov eax, dword [ebp + 0xc0]
xor edx, edx
mov edi, 0x64
mov dl, byte [ecx + 1]
sub edi, eax
imul edi, dword [ebp + 0xa4]
imul edx, eax
add edx, edi
mov eax, 0x51eb851f
mul edx
shr edx, 5
mov byte [ecx + 1], dl
mov eax, dword [ebp + 0x50]
inc esi
add ecx, 4
inc eax
cmp esi, eax
jb 0x41a535
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2408
ret
mov esi, dword [sym.imp.WINMM.dll_timeGetTime]
call esi
mov dword [esp + 0x10], eax
call esi
mov ecx, dword [esp + 0x10]
mov edi, dword [ebp + 0x34]
add ecx, edi
cmp ecx, eax
jb 0x41a794
mov ecx, dword [ebp + 0x2ff4]
call fcn.00412720
test eax, eax
je 0x41a794
call esi
mov edx, dword [esp + 0x10]
mov edi, dword [ebp + 0x34]
add edx, edi
cmp edx, eax
jae 0x41a5eb
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2408
ret
mov ecx, dword [ebp + 0x300c]
lea eax, [ebp + 0x784]
push eax
call fcn.00403bb0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2408
ret
mov eax, dword [ebp + 0x2fe8]
test eax, eax
je 0x41a794
cmp eax, 5
jb 0x41a65d
mov dword [ebp + 0x2fe8], 0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2408
ret
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2408
ret
mov eax, dword [ebp + 0xfc8]
test eax, eax
je 0x41a697
mov ecx, dword [ebp + 0x3008]
push 0
call fcn.0041d950
mov word [0x4633f8], ax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2408
ret
mov word [0x4633f8], 0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2408
ret
call dword [sym.imp.WINMM.dll_timeGetTime]
mov dword [ebp + 0x2fec], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2408
ret
call dword [sym.imp.WINMM.dll_timeGetTime]
mov ebx, dword [ebp + 0x2fec]
mov esi, eax
sub esi, ebx
mov eax, 0x45e7b273
mul esi
mov ecx, edx
mov eax, esi
xor edx, edx
mov esi, 0xea60
div esi
mov eax, 0x10624dd3
shr ecx, 0xe
mul edx
mov esi, edx
shr esi, 6
cmp ecx, 0x63
jbe 0x41a704
mov ecx, 0x63
mov esi, 0x3b
mov eax, 0xcccccccd
mul ecx
shr edx, 3
mov byte [0x4623e2], dl
mov eax, ecx
xor edx, edx
mov ecx, 0xa
div ecx
mov eax, 0xcccccccd
mov byte [0x4623e3], dl
mul esi
shr edx, 3
mov byte [0x4623e4], dl
mov eax, esi
xor edx, edx
div ecx
mov byte [0x4623e5], dl
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2408
ret
mov byte [ebp + 0x3210], 0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2408
ret
push 0
mov ecx, dword [ebp + 0x2ff0]
call fcn.0041f470
dec eax
neg eax
sbb eax, eax
inc eax
mov word [0x4633f8], ax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2408
ret
push 0x45e6a8
push str.call
call fcn.00412360
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2408
ret