Function at 0x4155f0
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling

Disassembly:
sub esp, 0x220
mov eax, 0x201
push ebx
push ebp
mov ebp, ecx
push esi
mov ecx, dword [esp + 0x234]
push edi
cmp ecx, eax
ja 0x41696e
je 0x4168ae
mov eax, ecx
dec eax
dec eax
je 0x4169e2
sub eax, 3
je 0x41687b
sub eax, 0xb
je 0x4169e2
sub eax, 0xf0
je 0x415bb3
dec eax
dec eax
je 0x415941
sub eax, 0xfe
jne 0x416b1e
mov edi, dword [esp + 0x240]
mov ax, word [0x445fd2]
mov dx, word [0x445fd4]
mov esi, edi
xor cl, cl
shr esi, 0x10
cmp ax, di
jne 0x415679
cmp dx, si
je 0x4158a8
cmp byte [ebp + 0x2a20], 0
jne 0x4156c6
cmp byte [ebp + 0x373], 0
jne 0x4156c6
cmp byte [ebp + 0x36d], 0
jne 0x4156c6
cmp byte [ebp + 0x36e], 0
jne 0x4156c6
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
mov dword [ebp + 0x214], eax
call ebx
mov dword [ebp + 0x210], eax
mov word [0x445fd2], di
mov word [0x445fd4], si
jmp 0x41588c
movzx eax, ax
movzx edi, di
mov ecx, dword [0x445fd8]
sub edi, eax
movzx eax, dx
movzx edx, si
add ecx, edi
sub edx, eax
add dword [0x445fdc], edx
mov dword [0x445fd8], ecx
cmp byte [ebp + 0x2a20], 0
je 0x4157aa
xor edi, edi
cmp dword [ebp + 0x15bc], edi
jle 0x4157a2
cmp byte [ebp + 0x37b], 0
jne 0x4157a2
mov eax, dword [ebp + 0x1590]
mov edx, dword [ebp + 0x1584]
add eax, edx
mov edx, eax
neg edx
cmp ecx, edx
jge 0x415746
mov esi, dword [ebp + 0x15b4]
lea ecx, [ebp + 0x15b4]
mov eax, esi
cdq
idiv dword [ebp + 0x15bc]
test edx, edx
je 0x415755
dec esi
mov dword [ecx], esi
jmp 0x415755
cmp ecx, eax
jle 0x41575b
lea ecx, [ebp + 0xd58]
call fcn.00414cbb
mov dword [0x445fd8], edi
mov eax, dword [ebp + 0x1594]
mov ecx, dword [ebp + 0x1588]
add eax, ecx
mov ecx, dword [0x445fdc]
mov edx, eax
neg edx
cmp ecx, edx
jge 0x415784
lea ecx, [ebp + 0xd58]
call fcn.00414d55
jmp 0x415797
cmp ecx, eax
jle 0x415859
lea ecx, [ebp + 0xd58]
call fcn.00414dfa
mov dword [0x445fdc], edi
jmp 0x415859
mov dword [0x445fd8], edi
jmp 0x415797
cmp byte [ebp + 0x36e], 0
je 0x4157e7
mov eax, dword [ebp + 0x19ec]
mov edx, dword [ebp + 0x19e0]
add eax, edx
mov edx, eax
neg edx
cmp ecx, edx
jge 0x4157d6
lea ecx, [ebp + 0x15d4]
call fcn.00419a1f
jmp 0x415809
cmp ecx, eax
jle 0x415859
lea ecx, [ebp + 0x15d4]
call fcn.00419a82
jmp 0x415809
cmp byte [ebp + 0x373], 0
je 0x415827
mov esi, dword [ebp + 0x2c74]
push 0xffffffffffffffd7
mov eax, esi
pop edi
cdq
idiv edi
cmp ecx, eax
jge 0x415812
mov ecx, ebp
call fcn.004149d0
and dword [0x445fd8], 0
jmp 0x415859
mov eax, esi
push 0x29
cdq
pop esi
idiv esi
cmp ecx, eax
jle 0x415859
mov ecx, ebp
call fcn.00414b4c
jmp 0x415809
cmp byte [ebp + 0x36d], 0
je 0x415859
cmp dword [0x445fdc], 0xffffffcf
jge 0x415842
mov ecx, ebp
call fcn.00414ce6
jmp 0x415852
cmp dword [0x445fdc], 0x31
jle 0x415859
mov ecx, ebp
call fcn.00414d88
and dword [0x445fdc], 0
cmp byte [ebp + 0x2d04], 0
je 0x41586b
push 0
mov ecx, ebp
call fcn.00416b4d
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ax, word [esp + 0x18]
mov word [0x445fd2], ax
mov ax, word [esp + 0x1c]
mov word [0x445fd4], ax
cmp byte [ebp + 0x29d8], 0
je 0x4158a6
cmp byte [0x43e5f0], 0
jne 0x4158a6
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov cl, 1
and byte [0x43e5f0], 0
cmp byte [ebp + 0x29d8], 0
jne 0x416b1e
test cl, cl
je 0x416b1e
cmp byte [ebp + 0x2a20], 0
jne 0x4158e4
cmp dword [ebp + 0x188], 6
lea eax, [ebp + 0x188]
jne 0x4158e4
mov ecx, dword [ebp + 0x18c]
mov dword [eax], ecx
mov eax, dword [ebp + 0x188]
cmp eax, dword [ebp + 0x18c]
je 0x416b1e
cmp byte [ebp + 0x2a20], 0
jne 0x416b1e
cmp byte [ebp + 0x201], 0
jne 0x416b1e
add ebp, 0x200
cmp byte [ebp], 0
jne 0x415928
push 1
mov byte [ebp], 1
call dword [sym.imp.USER32.dll_ShowCursor]
push 0x7f03
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
jmp 0x416b1e
cmp byte [ebp + 0x2a20], 0
mov bl, byte [esp + 0x23c]
je 0x415ba7
movsx edi, bl
mov esi, 0x440070
push edi
push esi
call fcn.0042a190
pop ecx
test eax, eax
pop ecx
je 0x41597d
push edi
push esi
call fcn.0042a190
pop ecx
pop ecx
mov ecx, str.IGUSIOCGUSIOC
sub ecx, esi
mov bl, byte [eax + ecx]
mov eax, dword [ebp + 0x2d00]
inc eax
cmp eax, 0x64
jae 0x416b1e
cmp bl, 0x20
je 0x416b1e
fld qword [ebp + 0x278]
cmp bl, 0x61
fstp qword [ebp + 0x2cf8]
jl 0x4159af
cmp bl, 0x7a
jg 0x4159af
add bl, 0xe0
mov eax, dword [ebp + 0x2d00]
mov byte [eax + ebp + 0x2c91], bl
inc dword [ebp + 0x2d00]
mov eax, dword [ebp + 0x2d00]
and byte [eax + ebp + 0x2c91], 0
mov eax, dword [ebp + 0x2d00]
cmp eax, 1
jne 0x4159ef
cmp byte [ebp + 0x2c91], 0x4c
jne 0x4159ef
push 0
mov ecx, ebp
call fcn.0041552e
jmp 0x415a1a
cmp eax, 2
jne 0x415a1a
cmp byte [ebp + 0x2c91], 0x4c
jne 0x415a1a
cmp byte [ebp + 0x2c92], 0x4c
je 0x415a0a
push 1
jmp 0x4159e6
push 0
mov ecx, ebp
call fcn.0041552e
and dword [ebp + 0x2d00], 0
cmp dword [ebp + 0x2d00], 0
jle 0x416b1e
mov ecx, dword [ebp + 0x15ac]
and dword [esp + 0x14], 0
test ecx, ecx
jle 0x416b1e
mov eax, dword [ebp + 0x15b4]
cmp eax, 0xffffffff
jne 0x415a49
xor edx, edx
jmp 0x415a52
mov edx, dword [esp + 0x14]
add eax, edx
cdq
idiv ecx
mov dword [esp + 0x18], edx
imul edx, edx, 0x154
add edx, dword [ebp + 0x15d0]
push edx
call fcn.004058fa
mov esi, eax
push 4
push 0x43e230
push esi
call fcn.0042a690
add esp, 0x10
test eax, eax
jne 0x415a81
add esi, 4
xor eax, eax
xor edi, edi
cmp byte [esi], al
je 0x415b2d
mov cl, byte [eax + esi]
and byte [esp + edi + 0x12c], 0
lea ebx, [esp + edi + 0x12c]
cmp cl, 0x61
jl 0x415ad2
cmp cl, 0x7a
jg 0x415ad2
test eax, eax
jle 0x415ac5
mov dl, byte [eax + esi - 1]
cmp dl, 0x61
jl 0x415abb
cmp dl, 0x7a
jle 0x415ac8
cmp dl, 0x41
jl 0x415ac5
cmp dl, 0x5a
jle 0x415ac8
mov byte [ebx], 1
sub cl, 0x20
mov byte [esp + edi + 0x28], cl
inc edi
jmp 0x415b22
cmp cl, 0x41
jl 0x415b01
cmp cl, 0x5a
jg 0x415b01
mov dl, byte [eax + esi + 1]
cmp dl, 0x61
jl 0x415aea
cmp dl, 0x7a
jle 0x415afc
test eax, eax
jle 0x415afc
mov dl, byte [eax + esi - 1]
cmp dl, 0x41
jl 0x415afc
cmp dl, 0x5a
jle 0x415acb
mov byte [ebx], 1
jmp 0x415acb
cmp cl, 0x30
jl 0x415b1d
cmp cl, 0x39
jg 0x415b1d
test eax, eax
jle 0x415afc
mov dl, byte [eax + esi - 1]
cmp dl, 0x30
jl 0x415afc
cmp dl, 0x39
jmp 0x415afa
cmp cl, 0x2e
je 0x415b2d
inc eax
cmp byte [eax + esi], 0
jne 0x415a8d
and byte [esp + edi + 0x28], 0
xor esi, esi
cmp byte [esp + 0x28], 0
je 0x415b83
cmp byte [esp + esi + 0x12c], 0
je 0x415b63
push dword [ebp + 0x2d00]
lea eax, [ebp + 0x2c91]
push eax
lea eax, [esp + esi + 0x30]
push eax
call fcn.0042a690
add esp, 0xc
test eax, eax
je 0x415b6d
inc esi
cmp byte [esp + esi + 0x28], 0
jne 0x415b3b
jmp 0x415b83
mov eax, dword [esp + 0x18]
mov dword [ebp + 0x15b4], eax
sub eax, dword [ebp + 0x15bc]
mov dword [ebp + 0x15c4], eax
cmp byte [esp + esi + 0x28], 0
jne 0x416b1e
inc dword [esp + 0x14]
mov ecx, dword [ebp + 0x15ac]
cmp dword [esp + 0x14], ecx
jl 0x415a3a
jmp 0x416b1e
and dword [ebp + 0x2d00], 0
jmp 0x416b1e
cmp byte [ebp + 0x29d8], 0
jne 0x4169e2
and byte [esp + 0x11], 0
and byte [esp + 0x12], 0
push 3
mov esi, 0x445dfc
push 0x445dfd
push esi
call fcn.0042b030
mov ebx, dword [esp + 0x248]
push 4
push str.1876
push esi
mov byte [0x445dff], bl
call fcn.0042a690
add esp, 0x18
test eax, eax
jne 0x415c04
mov byte [0x445fd0], 1
test byte [esp + 0x243], 1
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov esi, 0x8000
je 0x415d39
sub ebx, 0x21
je 0x415ce2
dec ebx
je 0x415c73
dec ebx
dec ebx
je 0x415c68
dec ebx
je 0x415c58
dec ebx
je 0x415c4f
dec ebx
je 0x415c46
dec ebx
jne 0x416415
mov ecx, ebp
call fcn.00414d88
jmp 0x415c5f
mov ecx, ebp
call fcn.00414b4c
jmp 0x415c5f
mov ecx, ebp
call fcn.00414ce6
jmp 0x415c5f
mov ecx, ebp
call fcn.004149d0
mov byte [esp + 0x11], al
jmp 0x416415
push 0
mov ecx, ebp
call fcn.00416b4d
jmp 0x415cd8
cmp byte [ebp + 0x2a20], 0
je 0x415ca7
lea edi, [ebp + 0xd58]
xor ebx, ebx
cmp dword [edi + 0x868], ebx
lea esi, [edi + 0x868]
jle 0x416415
mov ecx, edi
call fcn.00414dfa
inc ebx
cmp ebx, dword [esi]
jl 0x415c96
jmp 0x416415
fld qword [ebp + 0x1d0]
fmul qword [0x438648]
lea ecx, [ebp + 0x1c8]
lea edx, [ebp + 0x1b0]
fst qword [ecx]
fcomp qword [edx]
fnstsw ax
sahf
jbe 0x415ccc
fld qword [edx]
fstp qword [ecx]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp + 0x284], eax
mov byte [esp + 0x11], 1
jmp 0x416415
cmp byte [ebp + 0x2a20], 0
je 0x415d16
lea edi, [ebp + 0xd58]
xor ebx, ebx
cmp dword [edi + 0x868], ebx
lea esi, [edi + 0x868]
jle 0x416415
mov ecx, edi
call fcn.00414d55
inc ebx
cmp ebx, dword [esi]
jl 0x415d05
jmp 0x416415
fld qword [ebp + 0x1d0]
fmul qword [0x438640]
lea ecx, [ebp + 0x1c8]
lea edx, [ebp + 0x1a0]
fst qword [ecx]
fcomp qword [edx]
fnstsw ax
sahf
jae 0x415ccc
jmp 0x415cc8
cmp ebx, 0x72
jg 0x415ee5
je 0x415ec8
cmp ebx, 0xd
je 0x415ebc
cmp ebx, 0x1b
je 0x415dc0
cmp ebx, 0x20
je 0x415db4
cmp ebx, 0x4c
je 0x415d99
cmp ebx, 0x70
jne 0x415f12
cmp byte [ebp + 0x36b], 0
jne 0x415d7b
mov ecx, ebp
call fcn.0040bd26
jmp 0x415d84
push 1
mov ecx, ebp
call fcn.00416b4d
cmp byte [ebp + 0x36b], 0
sete al
mov byte [ebp + 0x36b], al
jmp 0x416415
cmp byte [ebp + 0x2a20], 0
jne 0x416415
push 0
mov ecx, ebp
call fcn.0041552e
jmp 0x416415
mov ecx, ebp
call fcn.00408afa
jmp 0x416415
push 1
mov ecx, ebp
call fcn.00416b4d
cmp byte [ebp + 0x373], 0
je 0x415e0e
and dword [ebp + 0x374], 0
and byte [ebp + 0x373], 0
cmp byte [ebp + 0x37a], 0
lea eax, [ebp + 0x37a]
je 0x416415
and byte [eax], 0
cmp byte [ebp + 0x373], 0
push dword [ebp + 0x29d0]
sete al
push 0
push eax
jmp 0x416407
cmp byte [ebp + 0x36d], 0
lea eax, [ebp + 0x36d]
jne 0x415e74
cmp byte [ebp + 0x371], 0
lea eax, [ebp + 0x371]
jne 0x415e74
cmp byte [ebp + 0x36b], 0
lea eax, [ebp + 0x36b]
jne 0x415e74
cmp byte [ebp + 0x36c], 0
je 0x415e5c
push 0
push 0
push 0x10
push dword [esp + 0x240]
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x416415
cmp byte [ebp + 0x2a20], 0
lea eax, [ebp + 0x2a20]
je 0x415e7c
cmp dword [ebp + 0x15b0], 0
jle 0x415e7c
and byte [eax], 0
jmp 0x416415
xor esi, esi
cmp dword [ebp + 0xc9c], esi
jne 0x415eb8
test byte [ebp + 0x2ac], 1
jne 0x415eb8
call fcn.00405dd2
test al, al
je 0x415eb8
cmp byte [ebp + 0x23b8], 0
je 0x415eb8
mov ecx, ebp
call fcn.004078df
test al, al
jne 0x415eb8
mov byte [ebp + 0x36c], 1
jmp 0x416415
push esi
push esi
jmp 0x415e48
mov ecx, ebp
call fcn.0041521c
jmp 0x416415
mov eax, dword [ebp + 0x298]
lea ecx, [ebp + 0x29dc]
shr eax, 1
cmp dword [ecx], eax
je 0x416415
mov dword [ecx], eax
jmp 0x4163fd
mov eax, ebx
sub eax, 0x73
je 0x4163eb
dec eax
je 0x416286
dec eax
je 0x41625b
push 2
pop ecx
sub eax, ecx
je 0x416205
dec eax
je 0x4161b9
jmp 0x415f15
push 2
pop ecx
cmp byte [ebp + 0x2a20], 0
jne 0x416415
cmp ebx, 0x48
jg 0x41611e
je 0x4160fa
cmp ebx, 0x35
jg 0x416012
je 0x415ff5
mov eax, ebx
sub eax, 0x30
je 0x415fd8
dec eax
je 0x415fb1
dec eax
je 0x415f94
dec eax
je 0x415f78
dec eax
jne 0x416128
cmp byte [ebp + 0x2d04], 0
je 0x416415
cmp dword [ebp + 0x2b8], ecx
jne 0x416415
push 3
jmp 0x415fcc
cmp byte [ebp + 0x2d04], 0
je 0x416415
cmp dword [ebp + 0x2b8], ecx
jne 0x416415
push ecx
jmp 0x415fcc
cmp byte [ebp + 0x2d04], 0
je 0x416415
cmp dword [ebp + 0x2b8], ecx
jne 0x416415
push 1
jmp 0x415fcc
cmp byte [ebp + 0x2d04], 0
je 0x416415
cmp dword [ebp + 0x2b8], ecx
jne 0x416415
push 0
mov ecx, ebp
call fcn.00414e47
jmp 0x416415
cmp byte [ebp + 0x2d04], 0
je 0x416415
cmp dword [ebp + 0x2b8], ecx
jne 0x416415
push 7
jmp 0x415fcc
cmp byte [ebp + 0x2d04], 0
je 0x416415
cmp dword [ebp + 0x2b8], ecx
jne 0x416415
push 4
jmp 0x415fcc
mov eax, ebx
sub eax, 0x36
je 0x4160da
sub eax, ecx
je 0x4160b0
sub eax, 9
je 0x416052
sub eax, ecx
jne 0x416128
cmp byte [ebp + 0x2d04], 0
je 0x416415
cmp dword [ebp + 0x2b8], ecx
jne 0x416415
push 8
jmp 0x415fcc
push 0x11
call edi
test si, ax
je 0x416415
mov ecx, dword [ebp + 0x18c]
cmp dword [ebp + 0x188], ecx
jne 0x416092
cmp byte [ebp + 0x204], 0
lea eax, [ebp + 0x204]
je 0x416092
and byte [eax], 0
mov dword [ebp + 0x188], 6
mov byte [ebp + 0x203], 1
jmp 0x41609f
mov dword [ebp + 0x188], ecx
mov byte [ebp + 0x204], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp + 0x214], eax
jmp 0x416415
push 0x10
call edi
fld qword [ebp + 0x2d8]
test si, ax
lea eax, [ebp + 0x2d8]
je 0x4160cd
fadd qword [0x4383f8]
jmp 0x4160d3
fsub qword [0x4383f8]
fstp qword [eax]
jmp 0x416415
cmp byte [ebp + 0x2d04], 0
je 0x416415
cmp dword [ebp + 0x2b8], ecx
jne 0x416415
push 5
jmp 0x415fcc
lea eax, [ebp + 0x18c]
xor ecx, ecx
cmp dword [eax], 7
setne cl
dec ecx
and ecx, 0xfffffffe
add ecx, 7
mov dword [eax], ecx
mov eax, ecx
mov dword [ebp + 0x188], eax
jmp 0x416415
cmp ebx, 0x52
je 0x41616b
cmp ebx, 0x56
je 0x416158
cmp ebx, 0x41
jl 0x416132
cmp ebx, 0x5a
jle 0x41614e
cmp ebx, 0x30
jl 0x41613c
cmp ebx, 0x31
jle 0x41614e
cmp ebx, 0x70
jl 0x416415
cmp ebx, 0x7b
jg 0x416415
mov byte [esp + 0x12], 1
jmp 0x416415
lea eax, [ebp + 0xc80]
cmp byte [eax], 0
sete cl
mov byte [eax], cl
jmp 0x416415
push 0x11
call edi
test si, ax
je 0x4161ad
fld qword [ebp + 0x29f8]
and byte [ebp + 0x204], 0
mov dword [ebp + 0x188], 6
fstp qword [ebp + 0x29e8]
push 1
mov ecx, ebp
mov byte [ebp + 0x203], 1
mov byte [ebp + 0x29d8], 1
call fcn.00416c7d
jmp 0x416415
push 0x10
call edi
lea eax, [ebp + 0x36a]
jmp 0x41615e
cmp byte [ebp + 0x373], 0
jne 0x416415
cmp byte [ebp + 0x2a20], 0
jne 0x4161d8
mov ecx, ebp
call fcn.0040bd26
jmp 0x4161e1
push 1
mov ecx, ebp
call fcn.00416b4d
cmp byte [ebp + 0x2a20], 0
sete al
test al, al
mov byte [ebp + 0x2a20], al
je 0x416415
or dword [ebp + 0x15b4], 0xffffffff
jmp 0x416415
cmp byte [ebp + 0x2d04], 0
je 0x416415
cmp dword [ebp + 0x2b8], ecx
jne 0x416415
cmp byte [ebp + 0x373], 0
jne 0x416415
cmp byte [ebp + 0x36d], 0
jne 0x41623d
mov ecx, ebp
call fcn.0040bd26
jmp 0x416246
push 1
mov ecx, ebp
call fcn.00416b4d
cmp byte [ebp + 0x36d], 0
sete al
mov byte [ebp + 0x36d], al
jmp 0x416415
cmp dword [ebp + 0xc9c], 0
jne 0x416415
mov ecx, ebp
call fcn.0040cc06
mov ecx, ebp
call fcn.00407d9d
push str.http:__www.3dmekanlar.com
call fcn.00405dea
pop ecx
jmp 0x416415
cmp byte [ebp + 0x23b8], 0
jne 0x41629c
call fcn.00405dd2
test al, al
jne 0x416415
push 0x10
xor bl, bl
mov byte [esp + 0x17], 1
call edi
push 0x11
mov esi, eax
call edi
test si, 0x8000
je 0x4162b8
and byte [esp + 0x13], bl
test ah, 0x80
je 0x416321
cmp byte [ebp + 0x200], 0
mov esi, dword [sym.imp.USER32.dll_ShowCursor]
jne 0x4162d0
push 1
call esi
xor edi, edi
push 0x7f00
push edi
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov ecx, ebp
call fcn.0040cc06
lea eax, [ebp + 0x27c8]
mov ecx, ebp
push eax
push eax
call fcn.00407cd0
cmp eax, 0xffffffff
jne 0x416302
mov bl, 1
cmp byte [ebp + 0x200], 0
jne 0x41630e
push edi
call esi
push 1
mov ecx, ebp
call fcn.0040c484
test bl, bl
jne 0x416415
jmp 0x416323
xor edi, edi
and byte [esp + 0x28], 0
mov byte [ebp + 0x37b], 1
cmp byte [ebp + 0x2a20], 0
je 0x41633e
mov dword [ebp + 0x15b4], edi
cmp byte [esp + 0x13], 0
je 0x41634c
mov ecx, ebp
call fcn.00408b7d
cmp byte [ebp + 0x2a20], 0
je 0x416369
lea esi, [ebp + 0x37a]
push edi
mov ecx, ebp
mov byte [esi], 1
call fcn.0040739e
and byte [esi], 0
cmp byte [esp + 0x28], 0
lea esi, [ebp + 0x24bc]
lea eax, [esp + 0x28]
push esi
push eax
jne 0x416385
call fcn.00429850
pop ecx
pop ecx
jmp 0x416390
call fcn.00429f30
pop ecx
test eax, eax
pop ecx
je 0x4163c6
cmp byte [esi], 0
je 0x4163c6
mov ecx, ebp
call fcn.00414891
cmp eax, 0xffffffff
je 0x4163ac
cmp byte [ebp + 0x2a20], 0
je 0x4163c6
jmp 0x41634c
cmp byte [ebp + 0x2a20], 0
je 0x4163e2
and byte [ebp + 0x2a20], 0
push edi
mov ecx, ebp
call fcn.0040739e
jmp 0x4163e2
cmp byte [esp + 0x13], 0
je 0x4163e2
mov ecx, ebp
call fcn.00408bdb
mov ecx, ebp
call fcn.00407d9d
mov ecx, ebp
call fcn.0041490c
and byte [ebp + 0x37b], 0
jmp 0x416415
cmp dword [ebp + 0x29dc], 0xffffffff
lea eax, [ebp + 0x29dc]
je 0x416415
or dword [eax], 0xffffffff
push dword [ebp + 0x29d0]
push 0
push 0
lea eax, [ebp + 0x24bc]
mov ecx, ebp
push eax
call fcn.0040986d
cmp byte [0x445fd0], 0
je 0x41684a
cmp byte [ebp + 0x2a20], 0
jne 0x41684a
mov eax, dword [esp + 0x23c]
and byte [esp + 0x13], 0
cmp eax, 0x71
jg 0x416832
je 0x41681e
cmp eax, 0x53
jg 0x416674
je 0x416598
sub eax, 0x42
je 0x416559
push 2
pop ecx
sub eax, ecx
je 0x41654e
sub eax, ecx
je 0x4164e4
dec eax
je 0x4164d9
sub eax, 6
je 0x4164a3
dec eax
jne 0x416832
mov ecx, ebp
call fcn.0040c3fe
mov eax, dword [ebp + 0x2a2c]
lea ecx, [ebp + 0x2a2c]
inc eax
xor edx, edx
div dword [ebp + 0x2a28]
mov dword [ecx], edx
jmp 0x416576
mov ecx, dword [ebp + 0x294]
lea eax, [ebp + 0x294]
dec ecx
neg ecx
sbb ecx, ecx
and ecx, 0xfffffffd
add ecx, 4
mov dword [eax], ecx
push dword [ebp + 0x29d0]
push 0
push 0
lea eax, [ebp + 0x24bc]
mov ecx, ebp
push eax
call fcn.0040986d
jmp 0x416837
lea eax, [ebp + 0x369]
jmp 0x4167c8
mov eax, dword [ebp + 0x28c]
push 1
pop edx
cmp eax, edx
jne 0x4164f9
mov dword [ebp + 0x28c], ecx
jmp 0x416515
cmp eax, ecx
jne 0x41650f
mov dword [ebp + 0x28c], 3
mov dword [ebp + 0x290], ecx
jmp 0x416515
mov dword [ebp + 0x28c], edx
push dword [ebp + 0x28c]
mov eax, dword [ebp + 0x2c60]
lea esi, [ebp + 0x2c60]
mov ecx, dword [eax]
push 0x11
push 0
push eax
call dword [ecx + 0x94]
push dword [ebp + 0x28c]
mov esi, dword [esi]
mov eax, dword [esi]
push 0x10
push 0
push esi
call dword [eax + 0x94]
jmp 0x416837
lea eax, [ebp + 0x368]
jmp 0x4167c8
lea eax, [ebp + 0x23a8]
xor ecx, ecx
cmp dword [eax], 0x10
setne cl
dec ecx
and ecx, 0x10
add ecx, 0x10
mov dword [eax], ecx
mov dword [ebp + 0x23ac], ecx
cmp byte [ebp + 0x2d04], 0
je 0x416837
mov ecx, ebp
call fcn.0040cc06
push 1
mov ecx, ebp
call fcn.0040c484
jmp 0x416837
cmp byte [ebp + 0x2d04], 0
je 0x416837
lea esi, [ebp + 0x2f24]
lea edi, [esp + 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ecx, ebp
movsd dword es:[edi], dword [esi]
call fcn.0040cc06
mov eax, dword [ebp + 0x2f3c]
mov esi, dword [esp + 0x20]
cmp esi, eax
mov edx, 0x500
mov ecx, 0x400
mov edi, 0x320
mov ebx, 0x280
jne 0x4165ec
cmp eax, edx
je 0x4165ec
cmp eax, ecx
je 0x4165ec
cmp eax, edi
je 0x4165ec
cmp eax, ebx
jne 0x416663
cmp esi, edx
jne 0x416602
mov dword [ebp + 0x2f2c], ecx
mov dword [ebp + 0x2f30], 0x300
jmp 0x41658a
cmp esi, ecx
jne 0x41661b
mov dword [ebp + 0x2f2c], edi
mov dword [ebp + 0x2f30], 0x258
jmp 0x41658a
cmp esi, edi
jne 0x416634
mov dword [ebp + 0x2f2c], ebx
mov dword [ebp + 0x2f30], 0x1e0
jmp 0x41658a
cmp esi, ebx
jne 0x41658a
cmp eax, edx
je 0x416663
cmp eax, ecx
je 0x416663
cmp eax, edi
je 0x416663
cmp eax, ebx
je 0x416663
mov dword [ebp + 0x2f2c], eax
mov eax, dword [ebp + 0x2f40]
mov dword [ebp + 0x2f30], eax
jmp 0x41658a
mov dword [ebp + 0x2f2c], edx
mov dword [ebp + 0x2f30], ecx
jmp 0x41658a
sub eax, 0x54
je 0x4167d5
dec eax
je 0x4167c2
dec eax
dec eax
je 0x416759
dec eax
je 0x4166cd
dec eax
dec eax
jne 0x416832
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ah, 0x80
je 0x416837
fld qword [ebp + 0xc68]
fsub qword [0x4383f8]
fst qword [ebp + 0xc68]
fcomp qword [0x438448]
fnstsw ax
sahf
jae 0x416837
fldz
jmp 0x4166fd
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ah, 0x80
je 0x416708
fld qword [ebp + 0xc68]
fadd qword [0x4383f8]
fst qword [ebp + 0xc68]
fcomp qword [0x4382f0]
fnstsw ax
sahf
jbe 0x416837
fld1
fstp qword [ebp + 0xc68]
jmp 0x416837
mov eax, dword [ebp + 0x29e0]
xor ecx, ecx
cmp eax, ecx
jne 0x416720
mov dword [ebp + 0x29e0], 0x200
jmp 0x41674c
cmp eax, 0x200
jne 0x416733
mov dword [ebp + 0x29e0], 0x100
jmp 0x41674c
cmp eax, 0x100
jne 0x416746
mov dword [ebp + 0x29e0], 0x80
jmp 0x41674c
mov dword [ebp + 0x29e0], ecx
push dword [ebp + 0x29d0]
push ecx
push ecx
jmp 0x4164c6
cmp byte [ebp + 0x23a5], 0
lea esi, [ebp + 0x23a5]
sete al
cmp byte [ebp + 0x2d04], 0
mov byte [esi], al
je 0x416837
mov ecx, ebp
call fcn.0040cc06
cmp byte [esi], 0
jne 0x41658a
lea eax, [ebp + 0x2f24]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
push 0x10
push dword [ebp + 0x2f30]
push dword [ebp + 0x2f2c]
push 0
push 0
push 0xffffffffffffffff
push dword [esp + 0x24c]
call dword [sym.imp.USER32.dll_SetWindowPos]
jmp 0x41658a
lea eax, [ebp + 0x379]
cmp byte [eax], 0
sete cl
mov byte [eax], cl
jmp 0x4164bc
mov ecx, dword [ebp + 0x29dc]
mov eax, dword [ebp + 0x298]
cmp ecx, eax
je 0x416811
cmp ecx, 0xffffffff
je 0x416811
mov edx, eax
shr edx, 1
cmp ecx, edx
jne 0x4167f7
shr eax, 2
jmp 0x416813
mov edx, eax
shr edx, 2
cmp ecx, edx
jne 0x416805
shr eax, 3
jmp 0x416813
or dword [ebp + 0x29dc], 0xffffffff
jmp 0x4164bc
shr eax, 1
mov dword [ebp + 0x29dc], eax
jmp 0x4164bc
cmp byte [ebp + 0x370], 0
lea eax, [ebp + 0x370]
sete cl
mov byte [eax], cl
jmp 0x416837
mov byte [esp + 0x13], 1
cmp byte [esp + 0x12], 0
je 0x41685f
cmp byte [esp + 0x13], 0
jne 0x41684a
and byte [esp + 0x12], 0
cmp byte [esp + 0x12], 0
je 0x41685f
mov ecx, ebp
call fcn.0040bd26
mov byte [ebp + 0x36b], 1
cmp byte [esp + 0x11], 0
je 0x416b1e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp + 0x214], eax
jmp 0x416b1e
cmp byte [ebp + 0x2d04], 0
je 0x416b1e
lea eax, [ebp + 0x2f24]
push eax
push dword [esp + 0x238]
call dword [sym.imp.USER32.dll_GetWindowRect]
cmp byte [ebp + 0x29d8], 0
je 0x416b1e
jmp 0x4169e2
cmp byte [ebp + 0x373], 0
jne 0x416962
cmp byte [ebp + 0x36d], 0
jne 0x416962
cmp byte [ebp + 0x36e], 0
jne 0x416962
cmp byte [ebp + 0x29d8], 0
jne 0x4169e2
cmp byte [ebp + 0x2a20], 0
lea eax, [ebp + 0x2a20]
je 0x416941
and byte [eax], 0
mov eax, dword [ebp + 0x15b4]
lea esi, [ebp + 0x15b4]
test eax, eax
jl 0x416b1e
push eax
mov ecx, ebp
call fcn.00417031
cmp eax, 0xffffffff
je 0x416b1e
mov eax, dword [esi]
mov ecx, dword [ebp + 0x15d0]
imul eax, eax, 0x154
push dword [eax + ecx + 0x138]
add eax, ecx
mov ecx, ebp
push 1
push 1
push eax
call fcn.0040986d
jmp 0x416b1e
mov eax, dword [ebp + 0x2b0]
test eax, eax
jle 0x416954
cmp eax, 0x64
jl 0x416b1e
push 1
mov ecx, ebp
call fcn.0040739e
jmp 0x416b1e
mov ecx, ebp
call fcn.0041521c
jmp 0x416b1e
mov eax, ecx
sub eax, 0x204
je 0x416ae8
dec eax
je 0x416acf
dec eax
dec eax
je 0x416ae8
dec eax
je 0x416acf
dec eax
dec eax
je 0x4169d9
sub eax, 0x108
jne 0x416b1e
cmp byte [ebp + 0x29d8], 0
je 0x4169b9
mov ecx, ebp
call fcn.0040bd26
mov byte [ebp + 0x36b], 1
jmp 0x4169e2
cmp byte [0x445fd0], 0
jne 0x416b1e
mov ecx, ebp
call fcn.0040bd26
mov byte [ebp + 0x36b], 1
jmp 0x416b1e
cmp byte [ebp + 0x29d8], 0
je 0x4169ef
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x416b1e
cmp dword [ebp + 0x2b0], 0x64
jne 0x416b1e
mov esi, dword [esp + 0x23c]
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
shr esi, 0x10
call edi
mov dword [ebp + 0x214], eax
cmp dword [ebp + 0x188], 6
lea eax, [ebp + 0x188]
jne 0x416a2b
mov ecx, dword [ebp + 0x18c]
mov dword [eax], ecx
movsx eax, si
push 0x78
cdq
pop ecx
idiv ecx
add dword [ebp + 0x19c], eax
mov ecx, dword [ebp + 0x19c]
mov eax, dword [ebp + 0x190]
cmp ecx, eax
jge 0x416a50
mov dword [ebp + 0x19c], eax
mov eax, dword [ebp + 0xc84]
cmp dword [ebp + 0x19c], eax
jl 0x416a65
dec eax
mov dword [ebp + 0x19c], eax
mov eax, dword [ebp + 0x19c]
cmp eax, dword [ebp + 0x190]
jle 0x416a9a
mov ecx, dword [ebp + 0x19c]
mov eax, ecx
shl eax, 4
fld qword [eax + 0x43e308]
fcomp qword [ebp + 0x1a0]
fnstsw ax
sahf
jae 0x416a9a
lea eax, [ecx - 1]
mov dword [ebp + 0x19c], eax
jmp 0x416a6b
mov eax, dword [ebp + 0x19c]
lea ecx, [ebp + 0x1a0]
shl eax, 4
add eax, 0x43e318
fld qword [eax]
fst qword [ebp + 0x1c8]
fcomp qword [ecx]
fnstsw ax
sahf
jae 0x416ac5
fld qword [ecx]
fstp qword [ebp + 0x1c8]
call edi
mov dword [ebp + 0x284], eax
jmp 0x416b1e
cmp dword [ebp + 0x188], 8
lea eax, [ebp + 0x188]
jne 0x416b1e
mov ecx, dword [ebp + 0x18c]
mov dword [eax], ecx
jmp 0x416b1e
cmp byte [ebp + 0x29d8], 0
jne 0x4169e2
mov eax, dword [ebp + 0x188]
cmp eax, 3
je 0x416b14
cmp eax, 4
je 0x416b14
cmp eax, 5
je 0x416b14
cmp eax, 6
je 0x416b14
cmp eax, 7
jne 0x416b1e
mov dword [ebp + 0x188], 8
push dword [esp + 0x240]
push dword [esp + 0x240]
push dword [esp + 0x240]
push dword [esp + 0x240]
call dword [sym.imp.USER32.dll_DefWindowProcA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x220
ret 0x10