Function at 0x418340
Capabilities:
Check for time delay via gettickcount
Get keyboard layout
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x8c0
push ebx
mov ebx, ecx
push esi
mov esi, edx
push edi
cmp word [ebx], 0
mov dword [ebp + 0x54], esi
je case.0x4183b6.0
mov eax, dword [0x4e4798]
mov dword [ebp + 0x4c], eax
mov eax, dword [0x4ea534]
mov dword [ebp + 0x14], eax
xor al, al
mov byte [ebp + 0x6f], al
test esi, esi
jne 0x4183f4
push 6
push str.Blind
push ebx
call fcn.0049f2a2
add esp, 0xc
test eax, eax
jne 0x4183f1
movzx eax, word [ebx + 0xc]
add ebx, 0xc
mov byte [0x4ea7b4], 1
mov dword [ebp + 0x68], ebx
cmp eax, 0x7d
je 0x418405
mov dl, byte [ebp + 0x6f]
mov ecx, eax
movzx eax, cx
cmp eax, 0x5e
ja case.0x4183b6.1
movzx eax, byte [eax + 0x4195ac]
jmp dword [eax*4 + 0x419594]
or byte [ebp + 0x6f], 3
mov dl, byte [ebp + 0x6f]
jmp case.0x4183b6.1
or byte [ebp + 0x6f], 0x30
mov dl, byte [ebp + 0x6f]
jmp case.0x4183b6.1
or byte [ebp + 0x6f], 0xc
mov dl, byte [ebp + 0x6f]
jmp case.0x4183b6.1
or dl, 0xc0
mov byte [ebp + 0x6f], dl
movzx eax, word [ebx + 2]
add ebx, 2
mov dword [ebp + 0x68], ebx
mov ecx, eax
cmp eax, 0x7d
jne 0x4183a7
jmp 0x418405
mov al, byte [ebp + 0x6f]
mov byte [0x4ea7b4], 0
mov byte [ebp + 0x6f], al
mov dword [ebp + 0x68], ebx
test esi, esi
jne 0x418426
push 6
push 0x4d4264
push ebx
call fcn.0049f2a2
add esp, 0xc
test eax, eax
jne 0x418426
add ebx, 0xc
mov dword [ebp + 0x54], 2
mov dword [ebp + 0x68], ebx
mov ecx, dword [ebp + 0x4c]
mov edi, dword [ebp + 0x78]
mov eax, dword [ecx + 0x6c]
mov dword [ebp + 0x10], eax
mov eax, dword [ecx + 0x74]
mov dword [ebp + 0x38], eax
cmp edi, 1
je 0x418446
cmp edi, 3
jne 0x418500
mov eax, dword [0x4ea714]
mov edi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
test eax, eax
je 0x418458
push eax
call edi
push str.AHK_Keybd
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateMutexW]
mov esi, eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp dword [0x4ea714], 0
mov ebx, eax
je 0x418482
mov dword [0x4ea714], esi
jmp 0x418489
test esi, esi
je 0x418489
push esi
call edi
cmp ebx, 0xb7
je 0x4184ca
cmp dword [ebp + 0x54], 0
jne 0x4184bd
call fcn.004130d0
mov ebx, dword [ebp + 0x68]
test al, al
je 0x4184c0
mov edx, 0x4d4620
mov ecx, ebx
call fcn.004812d0
test eax, eax
jne 0x4184cd
mov edi, 1
mov dword [ebp + 0x78], edi
jmp 0x418500
mov ebx, dword [ebp + 0x68]
mov edi, 1
mov dword [ebp + 0x78], edi
jmp 0x418500
mov ebx, dword [ebp + 0x68]
cmp dword [ebp + 0x78], 3
jne 0x4184dd
mov edi, 2
mov dword [ebp + 0x78], edi
jmp 0x418500
mov ecx, dword [ebp + 0x4c]
xor edi, edi
mov dword [ebp + 0x78], edi
cmp dword [ecx + 0x6c], edi
jge 0x4184f4
cmp dword [ecx + 0x74], edi
jge 0x4184f4
or eax, 0xffffffff
jmp 0x4184f6
xor eax, eax
mov dword [ecx + 0x74], eax
mov dword [ecx + 0x6c], 0xffffffff
mov eax, dword [ebp + 0x7c]
xor esi, esi
mov byte [ebp + 0x5c], 0
test eax, eax
je 0x4185b8
mov edi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push esi
push eax
call edi
mov edi, eax
mov dword [ebp + 0x24], edi
test edi, edi
je 0x41868d
cmp edi, dword [0x4e9e38]
je 0x41868d
mov ecx, dword [0x4eb014]
test cl, 1
jne 0x418566
push str.IsHungAppWindow
or ecx, 1
push str.user32
mov dword [0x4eb014], ecx
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [0x4eb018], eax
jmp 0x41856b
mov eax, dword [0x4eb018]
mov ecx, dword [ebp + 0x7c]
test eax, eax
je 0x418577
push ecx
call eax
jmp 0x418594
lea eax, [ebp + 0x20]
push eax
push 0x1388
push 2
push 0
push 0
push 0
push ecx
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
neg eax
sbb eax, eax
inc eax
test eax, eax
jne 0x41868d
push 1
push edi
push dword [0x4e9e38]
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
mov esi, edi
setne byte [ebp + 0x5c]
jmp 0x41868d
test byte [0x4ea4fa], 0xc0
je 0x41864b
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
sub eax, dword [0x4ea4f0]
cmp eax, 0x32
jae 0x41864b
cmp edi, 2
je 0x41864b
cmp byte [0x4ea7b4], 0
jne 0x41864b
mov esi, dword [ebp + 0x54]
cmp esi, 2
je 0x41864b
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
cmp eax, dword [0x4e9e38]
jne 0x41864b
test esi, esi
je 0x4186dc
mov edi, ebx
test ebx, ebx
je 0x418641
movzx eax, word [ebx]
test ax, ax
je 0x418641
mov esi, eax
mov ecx, 0x4d4630
mov edx, 0x4c
nop dword [eax]
cmp si, dx
je 0x418643
movzx eax, word [ecx + 2]
add ecx, 2
mov edx, eax
test ax, ax
jne 0x418620
movzx eax, word [edi + 2]
add edi, 2
mov esi, eax
test ax, ax
jne 0x418612
xor edi, edi
test edi, edi
jne 0x41878d
call dword [sym.imp.USER32.dll_GetForegroundWindow]
xor esi, esi
test eax, eax
je 0x418687
mov edi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push esi
push eax
call edi
mov esi, eax
mov dword [ebp - 0x50], 0x30
lea eax, [ebp - 0x50]
push eax
push esi
call dword [sym.imp.USER32.dll_GetGUIThreadInfo]
test eax, eax
je 0x418687
mov eax, dword [ebp - 0x44]
test eax, eax
je 0x418687
push 0
push eax
call edi
mov esi, eax
mov eax, dword [ebp + 0x38]
mov dword [ebp + 0x24], eax
push esi
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov ecx, eax
mov dword [0x4ea790], eax
call fcn.0041c8b0
mov cl, 1
mov dword [0x4ea794], eax
call fcn.0041c350
mov bl, al
and byte [0x4ea73f], bl
cmp dword [0x4e8e34], 0
je 0x4187d2
mov al, byte [0x4e8f40]
mov ah, byte [0x4e8e3e]
mov cl, al
not al
and cl, ah
and al, ah
mov byte [ebp + 0x65], al
jmp 0x4187f8
mov esi, ebx
nop
test esi, esi
je 0x41864b
movzx eax, word [esi]
test ax, ax
je 0x41864b
mov edi, eax
nop word [eax + eax]
mov ecx, 0x4d4630
mov edx, 0x4c
nop word [eax + eax]
cmp di, dx
je 0x418736
movzx eax, word [ecx + 2]
add ecx, 2
mov edx, eax
test ax, ax
jne 0x418710
movzx eax, word [esi + 2]
add esi, 2
mov edi, eax
test ax, ax
jne 0x418700
jmp 0x41864b
add esi, 2
je 0x41878d
movzx eax, word [esi]
test ax, ax
je 0x41878d
mov edi, eax
nop word [eax + eax]
mov eax, 0x4d4638
mov edx, 0x7b
nop word [eax + eax]
cmp di, dx
je 0x418783
movzx ecx, word [eax + 2]
add eax, 2
mov edx, ecx
test cx, cx
jne 0x418760
movzx eax, word [esi + 2]
add esi, 2
mov edi, eax
test ax, ax
jne 0x418750
jmp 0x41878d
cmp word [esi], 0x7b
jne 0x4186e0
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x5b
call esi
bt ax, 0xf
jb 0x4187ad
push 0x5c
call esi
bt ax, 0xf
jae 0x41864b
mov edx, 1
mov dword [0x4e4790], 0
mov ecx, 0x8000012f
call fcn.00401600
mov dword [0x4e4790], 1
jmp 0x418793
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
sub eax, dword [0x4ea4f0]
cmp eax, dword [0x4e4d10]
jae 0x4187f0
mov ah, byte [0x4ea4fa]
and ah, bl
jmp 0x4187f2
xor ah, ah
mov cl, ah
mov byte [ebp + 0x65], 0
mov dl, byte [0x4ea73e]
not cl
and cl, bl
mov byte [ebp + 0x6c], ah
and dl, cl
mov byte [ebp + 0x66], 0
cmp byte [0x4ea7b4], 0
mov byte [ebp + 0x6e], dl
mov byte [0x4ea73e], dl
je 0x418841
mov al, byte [ebp + 0x6f]
mov cl, bl
mov byte [ebp + 0x6e], cl
mov byte [ebp + 0x5d], cl
test al, al
je 0x418844
mov cl, al
not cl
and cl, bl
mov al, cl
xor cl, bl
mov byte [ebp + 0x6e], al
mov byte [ebp + 0x5d], al
mov byte [ebp + 0x66], cl
jmp 0x418844
mov byte [ebp + 0x5d], dl
mov eax, dword [ebp + 0x4c]
cmp byte [eax + 0x98], 0
je 0x418870
cmp byte [0x4ea7b4], 0
jne 0x418870
cmp dword [ebp + 0x54], 2
je 0x418870
mov edx, 2
mov cl, 0x14
call fcn.0041bb40
mov dword [ebp + 0x28], eax
jmp 0x418877
mov dword [ebp + 0x28], 0
mov ecx, dword [ebp + 0x78]
mov eax, 0x1f4
mov dword [0x4ea7b0], ecx
mov edi, 0x5dc
test ecx, ecx
je 0x4188f0
cmp ecx, 1
mov edx, 0x2ee0
cmovne eax, edi
mov dword [0x4ea79c], eax
mov eax, 0x36b0
cmovne eax, edx
call fcn.004b5750
mov eax, dword [0x4e5e34]
mov ecx, esp
mov byte [0x4ea7a4], bl
mov byte [0x4ea7a5], 0
mov dword [0x4ea798], 0
mov dword [eax], ecx
mov ecx, dword [ebp + 0x78]
mov dword [0x4ea7a8], 0x80000000
mov dword [0x4ea7ac], 0x80000000
mov byte [0x4ea7a6], 0
mov byte [0x4ea7a7], 1
mov al, byte [0x4e8c38]
mov byte [ebp + 0x5a], al
mov eax, dword [0x4e485c]
cmp eax, 7
je 0x418907
cmp eax, 9
jne 0x418927
mov esi, dword [ebp + 0x7c]
test ecx, ecx
jne 0x41892a
test esi, esi
jne 0x41892a
push 1
mov byte [ebp + 0x5b], 1
call dword [sym.imp.USER32.dll_BlockInput]
mov byte [0x4e8c38], 1
jmp 0x41892e
mov esi, dword [ebp + 0x7c]
mov byte [ebp + 0x5b], 0
mov ebx, dword [ebp + 0x68]
xor dl, dl
mov byte [ebp + 0x6f], dl
mov byte [ebp + 0x61], dl
cmp word [ebx], 0
je 0x41927b
jmp 0x418953
mov esi, dword [ebp + 0x7c]
cmp dword [0x4ea7b0], 0
mov byte [ebp + 0x67], 0
jne 0x4189ba
mov edi, dword [sym.imp.KERNEL32.DLL_GetTickCount]
call edi
mov ecx, dword [0x4e4798]
sub eax, dword [0x4ea534]
cmp eax, dword [ecx + 0x5c]
jbe 0x4189b7
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x4189b0
mov edx, 1
mov dword [0x4e4790], 0
or ecx, 0xffffffff
call fcn.00401600
mov dword [0x4e4790], 1
call edi
mov dword [0x4ea534], eax
mov dl, byte [ebp + 0x6f]
mov ecx, dword [ebp + 0x54]
test ecx, ecx
jne 0x419193
movzx eax, word [ebx]
push eax
push 0x4d4640
call fcn.0049ccaf
add esp, 8
test eax, eax
je 0x4191d0
movzx eax, word [ebx]
add eax, 0xffffffdf
cmp eax, 0x5c
ja case.0x4189f4.34
movzx eax, byte [eax + 0x419628]
jmp dword [eax*4 + 0x41960c]
test byte [ebp + 0x6e], 3
jne case.0x4189f4.34
mov dl, byte [ebp + 0x6f]
or dl, 1
jmp 0x41925b
test byte [ebp + 0x6e], 0x30
jne case.0x4189f4.34
mov dl, byte [ebp + 0x6f]
or dl, 0x10
jmp 0x41925b
test byte [ebp + 0x6e], 0xc
jne case.0x4189f4.34
mov dl, byte [ebp + 0x6f]
or dl, 4
jmp 0x41925b
test byte [ebp + 0x6e], 0xc0
jne case.0x4189f4.34
mov dl, byte [ebp + 0x6f]
or dl, 0x40
jmp 0x41925b
lea esi, [ebx + 2]
push 0x7d
push esi
call fcn.0049ccaf
add esp, 8
mov dword [ebp + 0x44], eax
test eax, eax
je case.0x4189f4.34
mov ebx, esi
nop word [eax + eax]
movzx ecx, word [ebx]
cmp ecx, 0x20
je 0x418a7d
cmp ecx, 9
jne 0x418a82
add ebx, 2
jmp 0x418a70
mov edi, eax
sub edi, ebx
sar edi, 1
mov dword [ebp + 0x40], edi
jne 0x418b17
lea esi, [eax + 2]
movzx eax, word [esi]
cmp eax, 0x7d
jne 0x418aa9
mov edi, 1
mov dword [ebp + 0x44], esi
mov dword [ebp + 0x40], edi
jmp 0x418b23
cmp eax, 0x20
je 0x418ab7
cmp eax, 9
jne 0x419183
cmp ax, 0x20
je 0x418ac3
cmp ax, 9
jne 0x418acc
movzx eax, word [esi + 2]
add esi, 2
jmp 0x418ab7
push 4
push str.Down
push esi
call fcn.0049f2a2
add esp, 0xc
test eax, eax
je 0x418af8
push 2
push 0x4d3494
push esi
call fcn.0049f2a2
add esp, 0xc
test eax, eax
jne 0x419183
push 0x7d
push esi
call fcn.0049ccaf
add esp, 8
mov dword [ebp + 0x44], eax
test eax, eax
je case.0x4189f4.34
mov edi, eax
sub edi, ebx
sar edi, 1
mov dword [ebp + 0x40], edi
cmp edi, 0x400
jae 0x419183
lea esi, [edi + edi]
push esi
lea eax, [ebp - 0x850]
push ebx
push eax
call fcn.0049cd60
xor eax, eax
push 5
mov word [ebp + esi - 0x850], ax
lea eax, [ebp - 0x850]
push str.Click
push eax
call fcn.0049f2a2
add esp, 0x18
test eax, eax
jne 0x418bdd
lea ecx, [ebp - 0x846]
movzx eax, word [ecx]
cmp eax, 0x20
je 0x418b6f
cmp eax, 9
jne 0x418b74
add ecx, 2
jmp 0x418b62
lea eax, [ebp + 0x2c]
push eax
lea eax, [ebp + 0x3c]
push eax
lea eax, [ebp + 0x68]
push eax
lea eax, [ebp + 0x6d]
push eax
lea eax, [ebp + 0x1c]
push eax
lea edx, [ebp + 0x34]
call fcn.0041a320
mov eax, dword [ebp + 0x3c]
add esp, 0x14
push dword [ebp + 0x2c]
cmp eax, 1
jge 0x418bc3
mov eax, dword [ebp + 0x4c]
lea edx, [ebp + 0x1c]
lea ecx, [ebp + 0x34]
movzx eax, byte [eax + 0x97]
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.0041af60
mov ebx, dword [ebp + 0x44]
add esp, 0xc
jmp 0x419259
push dword [ebp + 0x1c]
mov edi, dword [ebp + 0x7c]
xor edx, edx
push dword [ebp + 0x34]
mov cl, byte [ebp + 0x6d]
push edi
push 0
push dword [ebp + 0x68]
push eax
jmp 0x419175
lea eax, [ebp - 0x850]
push 0x4d465c
push eax
call fcn.0049f121
add esp, 8
test eax, eax
jne 0x418c04
mov ebx, dword [ebp + 0x44]
mov dword [ebp + 0x54], 1
jmp 0x419259
lea eax, [ebp - 0x850]
push str.Text
push eax
call fcn.0049f121
add esp, 8
test eax, eax
jne 0x418c2b
mov ebx, dword [ebp + 0x44]
mov dword [ebp + 0x54], 2
jmp 0x419259
mov eax, 1
mov dword [ebp + 0x30], edi
mov dword [ebp + 0x50], eax
lea edi, [ebp - 0x850]
mov dword [ebp + 0x3c], eax
mov eax, dword [ebp - 0x850]
mov dword [ebp + 0x68], 2
test ax, ax
je 0x418dea
movzx esi, ax
nop dword [eax + eax]
mov edx, 0x4d4670
mov ecx, 0x20
nop word [eax + eax]
cmp si, cx
je 0x418d26
movzx eax, word [edx + 2]
add edx, 2
mov ecx, eax
test ax, ax
jne 0x418c70
movzx eax, word [edi + 2]
add edi, 2
mov esi, eax
test ax, ax
jne 0x418c60
mov edi, dword [ebp + 0x50]
push dword [0x4ea790]
lea eax, [ebp + 0x61]
push eax
lea eax, [ebp + 0x18]
push eax
lea edx, [ebp + 0x6d]
lea ecx, [ebp - 0x850]
call fcn.0041ce50
add esp, 0xc
cmp edi, 1
jl 0x419183
mov bh, byte [ebp + 0x6d]
mov esi, dword [ebp + 0x18]
test bh, bh
jne 0x4190bc
test si, si
jne 0x4190bc
cmp dword [ebp + 0x30], 1
jne 0x418e16
cmp dword [ebp + 0x68], 1
je 0x419183
mov ecx, dword [ebp + 0x7c]
test ecx, ecx
je 0x418df4
test edi, edi
jle 0x419183
mov ebx, dword [sym.imp.USER32.dll_PostMessageW]
movzx eax, word [ebp - 0x850]
push 0
push eax
push 0x102
push ecx
call ebx
mov ecx, dword [ebp + 0x7c]
sub edi, 1
jne 0x418d04
mov ebx, dword [ebp + 0x44]
jmp 0x419259
test edi, edi
je 0x418c95
xor eax, eax
lea esi, [edi + 2]
mov word [edi], ax
mov ebx, edi
lea eax, [ebp - 0x850]
sub ebx, eax
sar ebx, 1
mov dword [ebp + 0x30], ebx
movzx eax, word [esi]
cmp eax, 0x20
je 0x418d52
cmp eax, 9
jne 0x418d57
add esi, 2
jmp 0x418d45
mov eax, dword [ebp + 0x44]
sub eax, esi
sar eax, 1
je 0x418c95
push 4
push str.Down
push esi
call fcn.0049f2a2
add esp, 0xc
test eax, eax
jne 0x418dbb
push 4
add esi, 8
mov dword [ebp + 0x68], eax
push str.Temp
push esi
call fcn.0049f2a2
add esp, 0xc
test eax, eax
jne 0x418d9a
mov dword [ebp + 0x48], eax
jmp 0x418c95
xor eax, eax
cmp word [esi], 0x52
sete al
push eax
call fcn.004a9ffe
add esp, 4
neg eax
sbb ebx, ebx
neg ebx
inc ebx
mov dword [ebp + 0x48], ebx
jmp 0x418c95
push 0x4d3494
push esi
call fcn.0049f121
add esp, 8
test eax, eax
jne 0x418dd9
mov dword [ebp + 0x68], 1
jmp 0x418c95
mov ecx, esi
call fcn.00481720
mov edi, eax
mov dword [ebp + 0x3c], edi
jmp 0x418c98
mov edi, 1
jmp 0x418c98
mov al, byte [ebp + 0x61]
mov edx, edi
or al, byte [ebp + 0x6e]
mov ecx, dword [ebp - 0x850]
movzx eax, al
push eax
call fcn.00419850
mov ebx, dword [ebp + 0x44]
add esp, 4
jmp 0x419259
cmp dword [ebp + 0x7c], 0
lea ecx, [ebp - 0x850]
mov esi, dword [ebp + 0x40]
mov edx, esi
sete al
movzx eax, al
push eax
lea eax, [ebp + 0x5d]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.0041cf20
mov bl, al
add esp, 0xc
mov byte [ebp + 0x6d], bl
test bl, bl
je 0x418f27
cmp dword [ebp + 0x7c], 0
mov esi, dword [ebp + 0x68]
jne 0x418e62
test esi, esi
jne 0x418e5b
mov byte [ebp + 0x67], bl
jmp 0x418e62
mov cl, bl
call fcn.00418070
cmp dword [0x4ea7b0], 0
je 0x418e72
mov al, byte [0x4ea7a4]
jmp 0x418e79
xor cl, cl
call fcn.0041c350
mov ecx, dword [ebp + 0x7c]
mov dl, al
mov al, byte [ebp + 0x5d]
push 0xffc3d44d
push 0
push 0
push ecx
mov cl, al
mov byte [ebp + 0x6e], al
call fcn.0041bc50
add esp, 0x10
test edi, edi
jle 0x419183
push 0xffc3d44d
push 1
push dword [ebp + 0x7c]
mov dl, bl
mov ecx, esi
push 0
call fcn.00419c40
add esp, 0x10
cmp dword [0x4ea7b0], 0
jne 0x418f1a
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov ecx, dword [0x4e4798]
sub eax, dword [0x4ea534]
cmp eax, dword [ecx + 0x5c]
jbe 0x418f1a
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x418f0f
mov edx, 1
mov dword [0x4e4790], 0
or ecx, 0xffffffff
call fcn.00401600
mov dword [0x4e4790], 1
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [0x4ea534], eax
sub edi, 1
jne 0x418ea0
mov ebx, dword [ebp + 0x44]
jmp 0x419259
cmp esi, 4
jbe 0x418fa8
push 4
lea eax, [ebp - 0x850]
push str.ASC
push eax
call fcn.0049f2a2
mov edi, dword [ebp + 0x7c]
add esp, 0xc
test eax, eax
jne 0x418fb0
test edi, edi
jne 0x418fb0
lea ecx, [ebp - 0x84a]
movzx eax, word [ecx]
cmp eax, 0x20
je 0x418f64
cmp eax, 9
jne 0x418f69
add ecx, 2
jmp 0x418f57
call fcn.00419960
cmp dword [0x4ea7b0], 2
mov eax, dword [0x4e4798]
jne 0x418f92
mov ecx, dword [eax + 0x70]
call fcn.0041b7d0
mov al, byte [ebp + 0x5d]
mov ebx, dword [ebp + 0x44]
mov byte [ebp + 0x6e], al
jmp 0x419259
mov ecx, dword [eax + 0x6c]
call fcn.0041b7d0
mov al, byte [ebp + 0x5d]
mov ebx, dword [ebp + 0x44]
mov byte [ebp + 0x6e], al
jmp 0x419259
cmp esi, 2
jbe 0x418f9a
mov edi, dword [ebp + 0x7c]
push 2
lea eax, [ebp - 0x850]
push 0x4d4690
push eax
call fcn.0049f2a2
add esp, 0xc
test eax, eax
jne 0x418f9a
push 0x10
push eax
lea eax, [ebp - 0x84c]
push eax
call fcn.004a4e29
mov edx, eax
add esp, 0xc
cmp edx, 0x10000
jb 0x419011
sub edx, 0x10000
mov ecx, edx
mov eax, edx
shr ecx, 0xa
and eax, 0x3ff
and ecx, 0x3ff
sub ecx, 0x2800
sub eax, 0x2400
movzx ecx, cx
movzx esi, ax
jmp 0x419016
movzx ecx, dx
xor esi, esi
mov al, byte [ebp + 0x5d]
mov byte [ebp + 0x6e], al
test edi, edi
je 0x419049
mov ebx, dword [sym.imp.USER32.dll_PostMessageW]
push 0
movzx eax, cx
push eax
push 0x102
push edi
call ebx
test si, si
je 0x41908e
push 0
movzx eax, si
push eax
push 0x102
push edi
call ebx
jmp 0x41908e
cmp dword [0x4ea7b0], 2
je 0x41906e
mov bl, byte [ebp + 0x61]
or bl, al
mov dl, bl
call fcn.004180f0
test si, si
je 0x41908e
mov dl, bl
mov ecx, esi
call fcn.004180f0
jmp 0x41908e
mov eax, 0x30
mov word [ebp - 4], ax
lea eax, [ebp - 2]
push 0xa
push eax
push edx
call fcn.004a3f2a
add esp, 0xc
lea ecx, [ebp - 4]
call fcn.00419960
cmp dword [0x4ea7b0], 2
mov eax, dword [0x4e4798]
jne 0x4190ac
mov ecx, dword [eax + 0x70]
call fcn.0041b7d0
mov ebx, dword [ebp + 0x44]
jmp 0x419259
mov ecx, dword [eax + 0x6c]
call fcn.0041b7d0
mov ebx, dword [ebp + 0x44]
jmp 0x419259
push 0
mov edx, esi
mov cl, bh
call fcn.0041c570
mov bl, al
add esp, 4
mov eax, dword [ebp + 0x68]
mov byte [ebp + 0x20], bl
test bl, bl
je 0x41915c
cmp dword [ebp + 0x7c], 0
jne 0x41915c
test eax, eax
jne 0x41911e
mov ecx, dword [ebp + 0x48]
mov byte [ebp + 0x67], bh
cmp ecx, 1
jne 0x419106
mov cl, byte [ebp + 0x6e]
or byte [0x4ea73e], bl
or cl, bl
mov byte [ebp + 0x6e], cl
mov byte [ebp + 0x5d], cl
jmp 0x41915c
cmp ecx, 2
jne 0x419111
or byte [0x4ea73f], bl
mov cl, byte [ebp + 0x6e]
or cl, bl
mov byte [ebp + 0x6e], cl
mov byte [ebp + 0x5d], cl
jmp 0x41915c
cmp eax, 1
jne 0x41915c
mov cl, bh
call fcn.00418070
not bl
and byte [0x4ea73e], bl
and byte [0x4ea73f], bl
and bl, byte [ebp + 0x6e]
mov al, bl
mov byte [ebp + 0x6e], al
mov byte [ebp + 0x5d], al
cmp bh, 0xa5
jne 0x419159
cmp dword [0x4ea794], 3
jne 0x419159
and al, 0xfe
mov byte [ebp + 0x6e], al
mov byte [ebp + 0x5d], al
mov eax, dword [ebp + 0x68]
mov ecx, dword [ebp + 0x7c]
mov edx, esi
push 0
push SysReAllocString
push SysReAllocString
push ecx
push dword [ebp + 0x20]
mov cl, bh
push eax
push edi
push dword [ebp + 0x5d]
push dword [ebp + 0x61]
call fcn.004196a0
add esp, 0x24
mov ebx, dword [ebp + 0x44]
jmp 0x419259
mov dl, byte [ebp + 0x6f]
jmp 0x419261
cmp ecx, 2
jne 0x4191d3
movzx eax, word [ebx]
add eax, 0xfffffff8
cmp eax, 5
ja case.0x4191a3.11
jmp dword [eax*4 + 0x419688]
cmp word [ebx + 2], 0xa
lea eax, [ebx + 2]
cmove ebx, eax
mov al, 0xd
mov byte [ebp + 0x6d], al
jmp 0x419201
mov al, 8
mov byte [ebp + 0x6d], al
jmp 0x419201
mov al, 9
mov byte [ebp + 0x6d], al
jmp 0x419201
mov byte [ebp + 0x6d], 0
jmp 0x41922b
mov ecx, dword [ebp + 0x54]
mov al, byte [ebp + 0x6f]
or al, byte [ebp + 0x6e]
je 0x4191e3
test ecx, ecx
jne 0x4191e3
mov al, 1
jmp 0x4191e5
xor al, al
mov cx, word [ebx]
lea edx, [ebp + 0x61]
push eax
push dword [0x4ea790]
call fcn.0041cd80
add esp, 8
mov byte [ebp + 0x6d], al
test al, al
je 0x419228
push 0
push SysReAllocString
push SysReAllocString
push esi
push 0
push 2
push 1
push dword [ebp + 0x5d]
xor edx, edx
mov cl, al
push dword [ebp + 0x61]
call fcn.004196a0
add esp, 0x24
jmp 0x419259
mov dl, byte [ebp + 0x61]
movzx ecx, word [ebx]
test esi, esi
je 0x419245
push 0
mov eax, ecx
push eax
push 0x102
push esi
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x419259
or dl, byte [ebp + 0x6e]
movzx eax, dl
mov edx, 1
push eax
call fcn.00419850
add esp, 4
xor dl, dl
mov byte [ebp + 0x61], dl
mov byte [ebp + 0x6f], dl
mov al, byte [ebp + 0x67]
add ebx, 2
mov byte [0x4ea73d], al
cmp word [ebx], 0
jne 0x418950
mov edi, 0x5dc
cmp dword [0x4ea7b0], 0
je 0x419322
or esi, 0xffffffff
cmp byte [0x4ea7a6], 0
mov dword [ebp + 0x48], esi
jne 0x4192e7
cmp dword [0x4ea798], 0
jbe 0x4192e7
cmp byte [0x4ea7b4], 0
je 0x4192ae
mov bl, byte [ebp + 0x66]
jmp 0x4192b6
mov bl, byte [ebp + 0x65]
not bl
and bl, byte [ebp + 0x6c]
or bl, byte [0x4ea73f]
or bl, byte [ebp + 0x6e]
mov dl, byte [0x4ea7a4]
mov cl, bl
push 0xffc3d44d
push 1
push 1
push 0
call fcn.0041bc50
add esp, 0x10
lea ecx, [ebp + 0x48]
mov dl, bl
call fcn.0041b670
mov esi, dword [ebp + 0x48]
cmp dword [0x4ea7b0], 1
mov eax, 0x1f4
cmove edi, eax
cmp dword [0x4ea79c], edi
jbe 0x41930c
push dword [0x4e8f90]
call fcn.0049f222
add esp, 4
mov ecx, esi
mov dword [0x4ea7b0], 0
call fcn.0041b7d0
jmp 0x4193b5
cmp dword [0x4e8e34], 0
je 0x419336
mov cl, byte [0x4e8e3e]
mov dl, byte [ebp + 0x6c]
jmp 0x41935f
cmp dword [0x4e4d10], 0
jl 0x41935a
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
sub eax, dword [0x4ea4f0]
cmp eax, dword [0x4e4d10]
jb 0x41935a
mov dl, byte [ebp + 0x6c]
xor cl, cl
jmp 0x41935f
mov dl, byte [ebp + 0x6c]
mov cl, dl
or cl, byte [0x4ea73f]
cmp byte [0x4ea7b4], 0
je 0x419386
mov al, cl
xor al, dl
mov bl, al
and al, cl
and bl, dl
mov dl, byte [ebp + 0x6e]
or dl, byte [ebp + 0x66]
not bl
and bl, dl
or bl, al
jmp 0x419390
mov bl, byte [ebp + 0x65]
not bl
and bl, cl
or bl, byte [ebp + 0x6e]
push 0xffc3d44d
push 1
push 1
push dword [ebp + 0x7c]
xor cl, cl
call fcn.0041c350
or al, byte [0x4e8e3d]
mov cl, bl
mov dl, al
call fcn.0041bc50
add esp, 0x10
cmp dword [0x4e8e34], 0
je 0x4193d8
mov cl, byte [0x4e8e3f]
mov al, cl
xor al, byte [0x4e8f40]
and al, cl
not al
and cl, al
mov byte [0x4e8e3f], cl
cmp dword [ebp + 0x28], 1
jne 0x419471
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x14
call esi
test al, 1
jne 0x419471
push 0x14
call esi
bt ax, 0xf
jae 0x419419
push 0xffc3d44d
push 0
push 0
push 0
mov dl, 0x14
mov ecx, 1
call fcn.00419c40
add esp, 0x10
push 0xffc3d44d
push 0
push 0
push 0
mov dl, 0x14
mov ecx, 2
call fcn.00419c40
mov esi, dword [sym.imp.USER32.dll_GetForegroundWindow]
add esp, 0x10
push 0
call esi
mov ebx, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call ebx
cmp eax, dword [0x4e9e38]
jne 0x41947d
mov edx, 1
mov dword [0x4e4790], 0
or ecx, 0xffffffff
call fcn.00401600
mov dword [0x4e4790], 1
jmp 0x41947d
mov esi, dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebx, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp byte [ebp + 0x5c], 0
je 0x419494
push 0
push dword [ebp + 0x24]
push dword [0x4e9e38]
call dword [sym.imp.USER32.dll_AttachThreadInput]
cmp byte [ebp + 0x5b], 0
je 0x4194af
cmp byte [ebp + 0x5a], 0
jne 0x4194af
push 0
call dword [sym.imp.USER32.dll_BlockInput]
mov byte [0x4e8c38], 0
mov eax, dword [ebp + 0x78]
test eax, eax
jne 0x419541
mov eax, dword [ebp + 0x14]
cmp dword [0x4ea534], eax
je 0x419576
cmp dword [0x4e4790], 0
je 0x419576
cmp dword [0x4e8bcc], 0
jne 0x419576
cmp dword [0x4e8be4], 0
je 0x419532
mov ecx, dword [0x4e4798]
cmp byte [ecx + 0x53], 0
jne 0x419532
cmp dword [ecx + 0x44], 0xffffffff
jle 0x41952c
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov ecx, dword [0x4e4798]
sub eax, dword [ecx + 0x48]
cmp eax, dword [ecx + 0x44]
jb 0x41952c
cmp dword [ecx + 0x40], 0
je 0x41952c
cmp byte [ecx + 0x96], 0
mov byte [ecx + 0x53], 1
jne 0x41952c
mov dword [ecx + 0x5c], 5
cmp byte [ecx + 0x53], 0
je 0x419576
mov edx, 1
or ecx, 0xffffffff
call fcn.00401600
jmp 0x419576
cmp eax, 1
jne 0x419576
push 0
call esi
push eax
call ebx
cmp eax, dword [0x4e9e38]
jne 0x419576
mov edx, 1
mov dword [0x4e4790], 0
or ecx, 0xffffffff
call fcn.00401600
mov dword [0x4e4790], 1
mov eax, dword [ebp + 0x4c]
mov ecx, dword [ebp + 0x10]
mov dword [eax + 0x6c], ecx
mov ecx, dword [ebp + 0x38]
mov dword [eax + 0x74], ecx
lea esp, [ebp - 0x85c]
pop edi
pop esi
pop ebx
lea esp, [ebp + 0x70]
pop ebp
ret