Function at 0x418190
Capabilities:
Check for time delay via gettickcount
Get keyboard layout
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x8c4
push ebx
mov ebx, ecx
push esi
mov esi, edx
push edi
cmp word [ebx], 0
mov dword [ebp + 0x54], esi
je case.0x418206.0
mov eax, dword [0x4e37f8]
mov dword [ebp + 0x4c], eax
mov eax, dword [0x4e961c]
mov dword [ebp + 0x10], eax
xor al, al
mov byte [ebp + 0x6f], al
test esi, esi
jne 0x418244
push 6
push 0x4d3630
push ebx
call fcn.0049ee82
add esp, 0xc
test eax, eax
jne 0x418241
movzx eax, word [ebx + 0xc]
add ebx, 0xc
mov byte [0x4e989c], 1
mov dword [ebp + 0x68], ebx
cmp eax, 0x7d
je 0x418255
mov dl, byte [ebp + 0x6f]
mov ecx, eax
movzx eax, cx
cmp eax, 0x5e
ja case.0x418206.1
movzx eax, byte [eax + 0x4193d8]
jmp dword [eax*4 + 0x4193c0]
or byte [ebp + 0x6f], 3
mov dl, byte [ebp + 0x6f]
jmp case.0x418206.1
or byte [ebp + 0x6f], 0x30
mov dl, byte [ebp + 0x6f]
jmp case.0x418206.1
or byte [ebp + 0x6f], 0xc
mov dl, byte [ebp + 0x6f]
jmp case.0x418206.1
or dl, 0xc0
mov byte [ebp + 0x6f], dl
movzx eax, word [ebx + 2]
add ebx, 2
mov dword [ebp + 0x68], ebx
mov ecx, eax
cmp eax, 0x7d
jne 0x4181f7
jmp 0x418255
mov al, byte [ebp + 0x6f]
mov byte [0x4e989c], 0
mov byte [ebp + 0x6f], al
mov dword [ebp + 0x68], ebx
test esi, esi
jne 0x418276
push 6
push 0x4d3284
push ebx
call fcn.0049ee82
add esp, 0xc
test eax, eax
jne 0x418276
add ebx, 0xc
mov dword [ebp + 0x54], 2
mov dword [ebp + 0x68], ebx
mov ecx, dword [ebp + 0x4c]
mov edi, dword [ebp + 0x78]
mov eax, dword [ecx + 0x6c]
mov dword [ebp + 0xc], eax
mov eax, dword [ecx + 0x74]
mov dword [ebp + 0x34], eax
cmp edi, 1
je 0x418296
cmp edi, 3
jne 0x418350
mov eax, dword [0x4e9800]
mov edi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
test eax, eax
je 0x4182a8
push eax
call edi
push 0x4d2544
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateMutexW]
mov esi, eax
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp dword [0x4e9800], 0
mov ebx, eax
je 0x4182d2
mov dword [0x4e9800], esi
jmp 0x4182d9
test esi, esi
je 0x4182d9
push esi
call edi
cmp ebx, 0xb7
je 0x41831a
cmp dword [ebp + 0x54], 0
jne 0x41830d
call fcn.00412f80
mov ebx, dword [ebp + 0x68]
test al, al
je 0x418310
mov edx, 0x4d3640
mov ecx, ebx
call fcn.00481a00
test eax, eax
jne 0x41831d
mov edi, 1
mov dword [ebp + 0x78], edi
jmp 0x418350
mov ebx, dword [ebp + 0x68]
mov edi, 1
mov dword [ebp + 0x78], edi
jmp 0x418350
mov ebx, dword [ebp + 0x68]
cmp dword [ebp + 0x78], 3
jne 0x41832d
mov edi, 2
mov dword [ebp + 0x78], edi
jmp 0x418350
mov ecx, dword [ebp + 0x4c]
xor edi, edi
mov dword [ebp + 0x78], edi
cmp dword [ecx + 0x6c], edi
jge 0x418344
cmp dword [ecx + 0x74], edi
jge 0x418344
or eax, 0xffffffff
jmp 0x418346
xor eax, eax
mov dword [ecx + 0x74], eax
mov dword [ecx + 0x6c], 0xffffffff
mov eax, dword [ebp + 0x7c]
xor esi, esi
mov byte [ebp + 0x5c], 0
test eax, eax
je 0x418408
mov edi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push esi
push eax
call edi
mov edi, eax
mov dword [ebp + 0x20], edi
test edi, edi
je 0x4184dd
cmp edi, dword [0x4e8f18]
je 0x4184dd
mov ecx, dword [0x4ea0fc]
test cl, 1
jne 0x4183b6
push 0x4db778
or ecx, 1
push 0x4d3a20
mov dword [0x4ea0fc], ecx
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [0x4ea100], eax
jmp 0x4183bb
mov eax, dword [0x4ea100]
mov ecx, dword [ebp + 0x7c]
test eax, eax
je 0x4183c7
push ecx
call eax
jmp 0x4183e4
lea eax, [ebp + 0x1c]
push eax
push 0x1388
push 2
push 0
push 0
push 0
push ecx
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
neg eax
sbb eax, eax
inc eax
test eax, eax
jne 0x4184dd
push 1
push edi
push dword [0x4e8f18]
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
mov esi, edi
setne byte [ebp + 0x5c]
jmp 0x4184dd
test byte [0x4e95e2], 0xc0
je 0x41849b
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
sub eax, dword [0x4e95d8]
cmp eax, 0x32
jae 0x41849b
cmp edi, 2
je 0x41849b
cmp byte [0x4e989c], 0
jne 0x41849b
mov esi, dword [ebp + 0x54]
cmp esi, 2
je 0x41849b
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
cmp eax, dword [0x4e8f18]
jne 0x41849b
test esi, esi
je 0x41852b
mov edi, ebx
test ebx, ebx
je 0x418491
movzx eax, word [ebx]
test ax, ax
je 0x418491
mov esi, eax
mov ecx, 0x4d3650
mov edx, 0x4c
nop dword [eax]
cmp si, dx
je 0x418493
movzx eax, word [ecx + 2]
add ecx, 2
mov edx, eax
test ax, ax
jne 0x418470
movzx eax, word [edi + 2]
add edi, 2
mov esi, eax
test ax, ax
jne 0x418462
xor edi, edi
test edi, edi
jne 0x4185dd
call dword [sym.imp.USER32.dll_GetForegroundWindow]
xor esi, esi
test eax, eax
je 0x4184d7
mov edi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push esi
push eax
call edi
mov esi, eax
mov dword [ebp - 0x54], 0x30
lea eax, [ebp - 0x54]
push eax
push esi
call dword [sym.imp.USER32.dll_GetGUIThreadInfo]
test eax, eax
je 0x4184d7
mov eax, dword [ebp - 0x48]
test eax, eax
je 0x4184d7
push 0
push eax
call edi
mov esi, eax
mov eax, dword [ebp + 0x34]
mov dword [ebp + 0x20], eax
push esi
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov ecx, eax
mov dword [0x4e9878], eax
call fcn.0041c740
mov cl, 1
mov dword [0x4e987c], eax
call fcn.0041c1c0
mov bl, al
and byte [0x4e9827], bl
cmp dword [0x4e7ef4], 0
je 0x41861e
mov al, byte [0x4e8005]
mov dl, byte [0x4e7eff]
not al
and al, dl
mov byte [ebp + 0x6c], dl
mov byte [ebp + 0x65], al
jmp 0x418647
mov esi, ebx
nop dword [eax]
test esi, esi
je 0x41849b
movzx eax, word [esi]
test ax, ax
je 0x41849b
mov edi, eax
nop word [eax + eax]
mov ecx, 0x4d3650
mov edx, 0x4c
nop word [eax + eax]
cmp di, dx
je 0x418586
movzx eax, word [ecx + 2]
add ecx, 2
mov edx, eax
test ax, ax
jne 0x418560
movzx eax, word [esi + 2]
add esi, 2
mov edi, eax
test ax, ax
jne 0x418550
jmp 0x41849b
add esi, 2
je 0x4185dd
movzx eax, word [esi]
test ax, ax
je 0x4185dd
mov edi, eax
nop word [eax + eax]
mov eax, 0x4d3658
mov edx, 0x7b
nop word [eax + eax]
cmp di, dx
je 0x4185d3
movzx ecx, word [eax + 2]
add eax, 2
mov edx, ecx
test cx, cx
jne 0x4185b0
movzx eax, word [esi + 2]
add esi, 2
mov edi, eax
test ax, ax
jne 0x4185a0
jmp 0x4185dd
cmp word [esi], 0x7b
jne 0x418530
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x5b
call esi
test ax, ax
js 0x4185f9
push 0x5c
call esi
test ax, ax
jns 0x41849b
mov edx, 1
mov dword [0x4e37f0], 0
mov ecx, 0x8000012f
call fcn.004015e0
mov dword [0x4e37f0], 1
jmp 0x4185e3
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
sub eax, dword [0x4e95d8]
cmp eax, dword [0x4e3d70]
jae 0x41863f
mov dl, byte [0x4e95e2]
and dl, bl
mov byte [ebp + 0x6c], dl
jmp 0x418643
mov byte [ebp + 0x6c], 0
mov byte [ebp + 0x65], 0
mov cl, byte [0x4e9826]
and cl, bl
mov byte [ebp + 0x66], 0
cmp byte [0x4e989c], 0
mov byte [ebp + 0x6e], cl
mov byte [0x4e9826], cl
je 0x418689
mov al, byte [ebp + 0x6f]
mov cl, bl
mov byte [ebp + 0x6e], cl
mov byte [ebp + 0x5d], cl
test al, al
je 0x41868c
mov dl, al
not dl
and dl, bl
mov al, dl
xor dl, bl
mov byte [ebp + 0x6e], al
mov byte [ebp + 0x5d], al
mov byte [ebp + 0x66], dl
jmp 0x41868c
mov byte [ebp + 0x5d], cl
mov eax, dword [ebp + 0x4c]
cmp byte [eax + 0x98], 0
je 0x4186b8
cmp byte [0x4e989c], 0
jne 0x4186b8
cmp dword [ebp + 0x54], 2
je 0x4186b8
mov edx, 2
mov cl, 0x14
call fcn.0041b9b0
mov dword [ebp + 0x24], eax
jmp 0x4186bf
mov dword [ebp + 0x24], 0
mov ecx, dword [ebp + 0x78]
mov eax, 0x1f4
mov dword [0x4e9898], ecx
mov edi, 0x5dc
test ecx, ecx
je 0x418738
cmp ecx, 1
mov edx, 0x2ee0
cmovne eax, edi
mov dword [0x4e9884], eax
mov eax, 0x36b0
cmovne eax, edx
call fcn.004b53e0
mov eax, dword [0x4e4ea4]
mov ecx, esp
mov byte [0x4e988c], bl
mov byte [0x4e988d], 0
mov dword [0x4e9880], 0
mov dword [eax], ecx
mov ecx, dword [ebp + 0x78]
mov dword [0x4e9890], 0x80000000
mov dword [0x4e9894], 0x80000000
mov byte [0x4e988e], 0
mov byte [0x4e988f], 1
mov al, byte [0x4e7cde]
mov byte [ebp + 0x5a], al
mov eax, dword [0x4e3c80]
cmp eax, 7
je 0x41874f
cmp eax, 9
jne 0x41876f
mov esi, dword [ebp + 0x7c]
test ecx, ecx
jne 0x418772
test esi, esi
jne 0x418772
push 1
mov byte [ebp + 0x5b], 1
call dword [sym.imp.USER32.dll_BlockInput]
mov byte [0x4e7cde], 1
jmp 0x418776
mov esi, dword [ebp + 0x7c]
mov byte [ebp + 0x5b], 0
mov ebx, dword [ebp + 0x68]
xor dl, dl
mov byte [ebp + 0x6f], dl
mov byte [ebp + 0x61], dl
cmp word [ebx], 0
je 0x4190a8
jmp 0x418793
mov esi, dword [ebp + 0x7c]
cmp dword [0x4e9898], 0
mov byte [ebp + 0x67], 0
jne 0x4187fa
mov edi, dword [sym.imp.KERNEL32.DLL_GetTickCount]
call edi
mov ecx, dword [0x4e37f8]
sub eax, dword [0x4e961c]
cmp eax, dword [ecx + 0x5c]
jbe 0x4187f7
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x4187f0
mov edx, 1
mov dword [0x4e37f0], 0
or ecx, 0xffffffff
call fcn.004015e0
mov dword [0x4e37f0], 1
call edi
mov dword [0x4e961c], eax
mov dl, byte [ebp + 0x6f]
mov ecx, dword [ebp + 0x54]
test ecx, ecx
jne 0x418fc7
movzx eax, word [ebx]
push eax
push 0x4d3660
call fcn.0049c891
add esp, 8
test eax, eax
je 0x418ffb
movzx eax, word [ebx]
add eax, 0xffffffdf
cmp eax, 0x5c
ja case.0x418834.34
movzx eax, byte [eax + 0x419454]
jmp dword [eax*4 + 0x419438]
test byte [ebp + 0x6e], 3
jne case.0x418834.34
mov dl, byte [ebp + 0x6f]
or dl, 1
jmp 0x419088
test byte [ebp + 0x6e], 0x30
jne case.0x418834.34
mov dl, byte [ebp + 0x6f]
or dl, 0x10
jmp 0x419088
test byte [ebp + 0x6e], 0xc
jne case.0x418834.34
mov dl, byte [ebp + 0x6f]
or dl, 4
jmp 0x419088
test byte [ebp + 0x6e], 0xc0
jne case.0x418834.34
mov dl, byte [ebp + 0x6f]
or dl, 0x40
jmp 0x419088
lea esi, [ebx + 2]
push 0x7d
push esi
call fcn.0049c891
add esp, 8
mov dword [ebp + 0x40], eax
test eax, eax
je case.0x418834.34
mov ebx, esi
nop word [eax + eax]
movzx ecx, word [ebx]
cmp ecx, 0x20
je 0x4188bd
cmp ecx, 9
jne 0x4188c2
add ebx, 2
jmp 0x4188b0
mov edi, eax
sub edi, ebx
sar edi, 1
mov dword [ebp + 0x3c], edi
jne 0x418963
lea ecx, [eax + 2]
movzx eax, word [ecx]
cmp eax, 0x7d
jne 0x4188ec
mov edi, 1
mov dword [ebp + 0x40], ecx
mov dword [ebp + 0x3c], edi
jmp 0x41896f
cmp eax, 0x20
je 0x4188fa
cmp eax, 9
jne 0x418fb7
mov esi, ecx
nop dword [eax]
cmp ax, 0x20
je 0x41890c
cmp ax, 9
jne 0x418915
movzx eax, word [esi + 2]
add esi, 2
jmp 0x418900
push 4
push 0x4d24bc
push esi
mov dword [ebp + 0x44], esi
call fcn.0049ee82
add esp, 0xc
test eax, eax
je 0x418944
push 2
push 0x4d24b4
push esi
call fcn.0049ee82
add esp, 0xc
test eax, eax
jne 0x418fb7
push 0x7d
push esi
call fcn.0049c891
add esp, 8
mov dword [ebp + 0x40], eax
test eax, eax
je case.0x418834.34
mov edi, eax
sub edi, ebx
sar edi, 1
mov dword [ebp + 0x3c], edi
cmp edi, 0x400
jae 0x418fb7
lea esi, [edi + edi]
push esi
lea eax, [ebp - 0x854]
push ebx
push eax
call fcn.0049c940
xor eax, eax
push 5
mov word [ebp + esi - 0x854], ax
lea eax, [ebp - 0x854]
push 0x4d3670
push eax
call fcn.0049ee82
add esp, 0x18
test eax, eax
jne 0x418a2b
lea ecx, [ebp - 0x84a]
nop
movzx eax, word [ecx]
cmp eax, 0x20
je 0x4189bd
cmp eax, 9
jne 0x4189c2
add ecx, 2
jmp 0x4189b0
lea eax, [ebp + 0x28]
push eax
lea eax, [ebp + 0x38]
push eax
lea eax, [ebp + 0x68]
push eax
lea eax, [ebp + 0x6d]
push eax
lea eax, [ebp + 0x18]
push eax
lea edx, [ebp + 0x30]
call fcn.0041a170
mov eax, dword [ebp + 0x38]
add esp, 0x14
push dword [ebp + 0x28]
cmp eax, 1
jge 0x418a11
mov eax, dword [ebp + 0x4c]
lea edx, [ebp + 0x18]
lea ecx, [ebp + 0x30]
movzx eax, byte [eax + 0x97]
push eax
lea eax, [ebp + 8]
push eax
call fcn.0041adc0
mov ebx, dword [ebp + 0x40]
add esp, 0xc
jmp 0x419086
push dword [ebp + 0x18]
mov edi, dword [ebp + 0x7c]
xor edx, edx
push dword [ebp + 0x30]
mov cl, byte [ebp + 0x6d]
push edi
push 0
push dword [ebp + 0x68]
push eax
jmp 0x418fa9
lea eax, [ebp - 0x854]
push 0x4d367c
push eax
call fcn.0049ed01
add esp, 8
test eax, eax
jne 0x418a52
mov ebx, dword [ebp + 0x40]
mov dword [ebp + 0x54], 1
jmp 0x419086
lea eax, [ebp - 0x854]
push 0x4d3684
push eax
call fcn.0049ed01
add esp, 8
test eax, eax
jne 0x418a79
mov ebx, dword [ebp + 0x40]
mov dword [ebp + 0x54], 2
jmp 0x419086
mov eax, 1
mov dword [ebp + 0x2c], edi
mov dword [ebp + 0x50], eax
lea edi, [ebp - 0x854]
mov dword [ebp + 0x38], eax
mov eax, dword [ebp - 0x854]
mov dword [ebp + 0x68], 2
test ax, ax
je 0x418c3d
movzx esi, ax
nop word [eax + eax]
mov edx, 0x4d3690
mov ecx, 0x20
nop word [eax + eax]
cmp si, cx
je 0x418b76
movzx eax, word [edx + 2]
add edx, 2
mov ecx, eax
test ax, ax
jne 0x418ac0
movzx eax, word [edi + 2]
add edi, 2
mov esi, eax
test ax, ax
jne 0x418ab0
mov edi, dword [ebp + 0x50]
push dword [0x4e9878]
lea eax, [ebp + 0x61]
push eax
lea eax, [ebp + 0x14]
push eax
lea edx, [ebp + 0x6d]
lea ecx, [ebp - 0x854]
call fcn.0041ccf0
add esp, 0xc
cmp edi, 1
jl 0x418fb7
mov bh, byte [ebp + 0x6d]
mov esi, dword [ebp + 0x14]
test bh, bh
jne 0x418ef4
test si, si
jne 0x418ef4
cmp dword [ebp + 0x2c], 1
jne 0x418c69
cmp dword [ebp + 0x68], 1
je 0x418fb7
mov ecx, dword [ebp + 0x7c]
test ecx, ecx
je 0x418c47
test edi, edi
jle 0x418fb7
mov ebx, dword [sym.imp.USER32.dll_PostMessageW]
movzx eax, word [ebp - 0x854]
push 0
push eax
push 0x102
push ecx
call ebx
mov ecx, dword [ebp + 0x7c]
sub edi, 1
jne 0x418b54
mov ebx, dword [ebp + 0x40]
jmp 0x419086
test edi, edi
je 0x418ae5
xor eax, eax
mov ebx, edi
mov word [edi], ax
lea eax, [ebp - 0x854]
sub ebx, eax
sar ebx, 1
mov dword [ebp + 0x2c], ebx
lea ebx, [edi + 2]
movzx eax, word [ebx]
cmp eax, 0x20
je 0x418ba2
cmp eax, 9
jne 0x418ba7
add ebx, 2
jmp 0x418b95
mov eax, dword [ebp + 0x40]
sub eax, ebx
mov dword [ebp + 0x44], ebx
sar eax, 1
je 0x418ae5
push 4
push 0x4d24bc
push ebx
call fcn.0049ee82
add esp, 0xc
test eax, eax
jne 0x418c0e
push 4
lea esi, [ebx + 8]
mov dword [ebp + 0x68], eax
push 0x4d3698
push esi
call fcn.0049ee82
add esp, 0xc
test eax, eax
jne 0x418bed
mov dword [ebp + 0x48], eax
jmp 0x418ae5
xor eax, eax
cmp word [esi], 0x52
sete al
push eax
call fcn.004a9769
add esp, 4
neg eax
sbb ebx, ebx
neg ebx
inc ebx
mov dword [ebp + 0x48], ebx
jmp 0x418ae5
push 0x4d24b4
push ebx
call fcn.0049ed01
add esp, 8
test eax, eax
jne 0x418c2c
mov dword [ebp + 0x68], 1
jmp 0x418ae5
mov ecx, ebx
call fcn.00481e30
mov edi, eax
mov dword [ebp + 0x38], edi
jmp 0x418ae8
mov edi, 1
jmp 0x418ae8
mov al, byte [ebp + 0x61]
mov edx, edi
or al, byte [ebp + 0x6e]
mov ecx, dword [ebp - 0x854]
movzx eax, al
push eax
call fcn.00419680
mov ebx, dword [ebp + 0x40]
add esp, 4
jmp 0x419086
cmp dword [ebp + 0x7c], 0
lea ecx, [ebp - 0x854]
mov esi, dword [ebp + 0x3c]
mov edx, esi
sete al
movzx eax, al
push eax
lea eax, [ebp + 0x5d]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.0041cdc0
mov bl, al
add esp, 0xc
mov byte [ebp + 0x6d], bl
test bl, bl
je 0x418d7a
cmp dword [ebp + 0x7c], 0
mov esi, dword [ebp + 0x68]
jne 0x418cb5
test esi, esi
jne 0x418cae
mov byte [ebp + 0x67], bl
jmp 0x418cb5
mov cl, bl
call fcn.00417ec0
cmp dword [0x4e9898], 0
je 0x418cc5
mov al, byte [0x4e988c]
jmp 0x418ccc
xor cl, cl
call fcn.0041c1c0
mov ecx, dword [ebp + 0x7c]
mov dl, al
mov al, byte [ebp + 0x5d]
push 0xffc3d44d
push 0
push 0
push ecx
mov cl, al
mov byte [ebp + 0x6e], al
call fcn.0041bac0
add esp, 0x10
test edi, edi
jle 0x418fb7
push 0xffc3d44d
push 1
push dword [ebp + 0x7c]
mov dl, bl
mov ecx, esi
push 0
call fcn.00419a70
add esp, 0x10
cmp dword [0x4e9898], 0
jne 0x418d6d
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov ecx, dword [0x4e37f8]
sub eax, dword [0x4e961c]
cmp eax, dword [ecx + 0x5c]
jbe 0x418d6d
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x418d62
mov edx, 1
mov dword [0x4e37f0], 0
or ecx, 0xffffffff
call fcn.004015e0
mov dword [0x4e37f0], 1
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [0x4e961c], eax
sub edi, 1
jne 0x418cf3
mov ebx, dword [ebp + 0x40]
jmp 0x419086
cmp esi, 4
jbe 0x418de0
lea eax, [ebp - 0x854]
push 0x4d36a4
push eax
call fcn.0049ed01
mov edi, dword [ebp + 0x7c]
add esp, 8
test eax, eax
jne 0x418de8
test edi, edi
jne 0x418de8
mov ecx, dword [ebp + 0x44]
call fcn.00419790
cmp dword [0x4e9898], 2
mov eax, dword [0x4e37f8]
jne 0x418dca
mov ecx, dword [eax + 0x70]
call fcn.0041b630
mov al, byte [ebp + 0x5d]
mov ebx, dword [ebp + 0x40]
mov byte [ebp + 0x6e], al
jmp 0x419086
mov ecx, dword [eax + 0x6c]
call fcn.0041b630
mov al, byte [ebp + 0x5d]
mov ebx, dword [ebp + 0x40]
mov byte [ebp + 0x6e], al
jmp 0x419086
cmp esi, 2
jbe 0x418dd2
mov edi, dword [ebp + 0x7c]
push 2
lea eax, [ebp - 0x854]
push 0x4d36ac
push eax
call fcn.0049ee82
add esp, 0xc
test eax, eax
jne 0x418dd2
push 0x10
push eax
lea eax, [ebp - 0x850]
push eax
call fcn.004a47ad
mov edx, eax
add esp, 0xc
cmp edx, 0x10000
jb 0x418e49
sub edx, 0x10000
mov ecx, edx
mov eax, edx
shr ecx, 0xa
and eax, 0x3ff
and ecx, 0x3ff
sub ecx, 0x2800
sub eax, 0x2400
movzx ecx, cx
movzx esi, ax
jmp 0x418e4e
movzx ecx, dx
xor esi, esi
mov al, byte [ebp + 0x5d]
mov byte [ebp + 0x6e], al
test edi, edi
je 0x418e81
mov ebx, dword [sym.imp.USER32.dll_PostMessageW]
push 0
movzx eax, cx
push eax
push 0x102
push edi
call ebx
test si, si
je 0x418ec6
push 0
movzx eax, si
push eax
push 0x102
push edi
call ebx
jmp 0x418ec6
cmp dword [0x4e9898], 2
je 0x418ea6
mov bl, byte [ebp + 0x61]
or bl, al
mov dl, bl
call fcn.00417f40
test si, si
je 0x418ec6
mov dl, bl
mov ecx, esi
call fcn.00417f40
jmp 0x418ec6
mov eax, 0x30
mov word [ebp - 8], ax
lea eax, [ebp - 6]
push 0xa
push eax
push edx
call fcn.004a38a1
add esp, 0xc
lea ecx, [ebp - 8]
call fcn.00419790
cmp dword [0x4e9898], 2
mov eax, dword [0x4e37f8]
jne 0x418ee4
mov ecx, dword [eax + 0x70]
call fcn.0041b630
mov ebx, dword [ebp + 0x40]
jmp 0x419086
mov ecx, dword [eax + 0x6c]
call fcn.0041b630
mov ebx, dword [ebp + 0x40]
jmp 0x419086
push 0
mov edx, esi
mov cl, bh
call fcn.0041c400
mov bl, al
add esp, 4
mov eax, dword [ebp + 0x68]
mov byte [ebp + 0x1c], bl
test bl, bl
je 0x418f90
cmp dword [ebp + 0x7c], 0
jne 0x418f90
test eax, eax
jne 0x418f52
mov ecx, dword [ebp + 0x48]
mov byte [ebp + 0x67], bh
cmp ecx, 1
jne 0x418f3a
mov cl, byte [ebp + 0x6e]
or byte [0x4e9826], bl
or cl, bl
mov byte [ebp + 0x6e], cl
mov byte [ebp + 0x5d], cl
jmp 0x418f90
cmp ecx, 2
jne 0x418f45
or byte [0x4e9827], bl
mov cl, byte [ebp + 0x6e]
or cl, bl
mov byte [ebp + 0x6e], cl
mov byte [ebp + 0x5d], cl
jmp 0x418f90
cmp eax, 1
jne 0x418f90
mov cl, bh
call fcn.00417ec0
not bl
and byte [0x4e9826], bl
and byte [0x4e9827], bl
and bl, byte [ebp + 0x6e]
mov al, bl
mov byte [ebp + 0x6e], al
mov byte [ebp + 0x5d], al
cmp bh, 0xa5
jne 0x418f8d
cmp dword [0x4e987c], 3
jne 0x418f8d
and al, 0xfe
mov byte [ebp + 0x6e], al
mov byte [ebp + 0x5d], al
mov eax, dword [ebp + 0x68]
mov ecx, dword [ebp + 0x7c]
mov edx, esi
push 0
push SysReAllocStringLen
push SysReAllocStringLen
push ecx
push dword [ebp + 0x1c]
mov cl, bh
push eax
push edi
push dword [ebp + 0x5d]
push dword [ebp + 0x61]
call fcn.004194d0
add esp, 0x24
mov ebx, dword [ebp + 0x40]
jmp 0x419086
mov dl, byte [ebp + 0x6f]
jmp 0x41908e
cmp ecx, 2
jne 0x418ffe
movzx eax, word [ebx]
add eax, 0xfffffff8
cmp eax, 5
ja case.0x418fd7.11
jmp dword [eax*4 + 0x4194b4]
cmp word [ebx + 2], 0xa
lea eax, [ebx + 2]
cmove ebx, eax
mov al, 0xd
jmp 0x419028
mov al, 8
jmp 0x419028
mov al, 9
jmp 0x419028
xor al, al
xor cl, cl
jmp 0x41902a
mov ecx, dword [ebp + 0x54]
mov al, byte [ebp + 0x6f]
or al, byte [ebp + 0x6e]
je 0x41900e
test ecx, ecx
jne 0x41900e
mov al, 1
jmp 0x419010
xor al, al
mov cx, word [ebx]
lea edx, [ebp + 0x61]
push eax
push dword [0x4e9878]
call fcn.0041cc20
mov dl, byte [ebp + 0x61]
add esp, 8
mov cl, al
mov byte [ebp + 0x6d], al
test cl, cl
je 0x419058
push 0
push SysReAllocStringLen
push SysReAllocStringLen
push esi
push 0
push 2
push 1
push dword [ebp + 0x5d]
xor edx, edx
mov cl, al
push dword [ebp + 0x61]
call fcn.004194d0
add esp, 0x24
jmp 0x419086
movzx ecx, word [ebx]
test esi, esi
je 0x419072
push 0
mov eax, ecx
push eax
push 0x102
push esi
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x419086
or dl, byte [ebp + 0x6e]
movzx eax, dl
mov edx, 1
push eax
call fcn.00419680
add esp, 4
xor dl, dl
mov byte [ebp + 0x61], dl
mov byte [ebp + 0x6f], dl
mov al, byte [ebp + 0x67]
add ebx, 2
mov byte [0x4e9825], al
cmp word [ebx], 0
jne 0x418790
mov edi, 0x5dc
cmp dword [0x4e9898], 0
je 0x41914f
or esi, 0xffffffff
cmp byte [0x4e988e], 0
mov dword [ebp + 0x48], esi
jne 0x419114
cmp dword [0x4e9880], 0
jbe 0x419114
cmp byte [0x4e989c], 0
je 0x4190db
mov bl, byte [ebp + 0x66]
jmp 0x4190e3
mov bl, byte [ebp + 0x65]
not bl
and bl, byte [ebp + 0x6c]
or bl, byte [0x4e9827]
or bl, byte [ebp + 0x6e]
mov dl, byte [0x4e988c]
mov cl, bl
push 0xffc3d44d
push 1
push 1
push 0
call fcn.0041bac0
add esp, 0x10
lea ecx, [ebp + 0x48]
mov dl, bl
call fcn.0041b4c0
mov esi, dword [ebp + 0x48]
cmp dword [0x4e9898], 1
mov eax, 0x1f4
cmove edi, eax
cmp dword [0x4e9884], edi
jbe 0x419139
push dword [0x4e806c]
call fcn.0049ee02
add esp, 4
mov ecx, esi
mov dword [0x4e9898], 0
call fcn.0041b630
jmp 0x4191e2
cmp dword [0x4e7ef4], 0
je 0x419163
mov cl, byte [0x4e7eff]
mov dl, byte [ebp + 0x6c]
jmp 0x41918c
cmp dword [0x4e3d70], 0
jl 0x419187
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
sub eax, dword [0x4e95d8]
cmp eax, dword [0x4e3d70]
jb 0x419187
mov dl, byte [ebp + 0x6c]
xor cl, cl
jmp 0x41918c
mov dl, byte [ebp + 0x6c]
mov cl, dl
or cl, byte [0x4e9827]
cmp byte [0x4e989c], 0
je 0x4191b3
mov al, cl
xor al, dl
mov bl, al
and al, cl
and bl, dl
mov dl, byte [ebp + 0x6e]
or dl, byte [ebp + 0x66]
not bl
and bl, dl
or bl, al
jmp 0x4191bd
mov bl, byte [ebp + 0x65]
not bl
and bl, cl
or bl, byte [ebp + 0x6e]
push 0xffc3d44d
push 1
push 1
push dword [ebp + 0x7c]
xor cl, cl
call fcn.0041c1c0
or al, byte [0x4e7efe]
mov cl, bl
mov dl, al
call fcn.0041bac0
add esp, 0x10
cmp dword [0x4e7ef4], 0
je 0x419205
mov cl, byte [0x4e8004]
mov al, cl
xor al, byte [0x4e8005]
and al, cl
not al
and cl, al
mov byte [0x4e8004], cl
cmp dword [ebp + 0x24], 1
jne 0x41929c
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x14
call esi
test al, 1
jne 0x41929c
push 0x14
call esi
test ax, ax
jns 0x419244
push 0xffc3d44d
push 0
push 0
push 0
mov dl, 0x14
mov ecx, 1
call fcn.00419a70
add esp, 0x10
push 0xffc3d44d
push 0
push 0
push 0
mov dl, 0x14
mov ecx, 2
call fcn.00419a70
mov esi, dword [sym.imp.USER32.dll_GetForegroundWindow]
add esp, 0x10
push 0
call esi
mov ebx, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call ebx
cmp eax, dword [0x4e8f18]
jne 0x4192a8
mov edx, 1
mov dword [0x4e37f0], 0
or ecx, 0xffffffff
call fcn.004015e0
mov dword [0x4e37f0], 1
jmp 0x4192a8
mov esi, dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebx, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp byte [ebp + 0x5c], 0
je 0x4192bf
push 0
push dword [ebp + 0x20]
push dword [0x4e8f18]
call dword [sym.imp.USER32.dll_AttachThreadInput]
cmp byte [ebp + 0x5b], 0
je 0x4192da
cmp byte [ebp + 0x5a], 0
jne 0x4192da
push 0
call dword [sym.imp.USER32.dll_BlockInput]
mov byte [0x4e7cde], 0
mov eax, dword [ebp + 0x78]
test eax, eax
jne 0x41936c
mov eax, dword [ebp + 0x10]
cmp dword [0x4e961c], eax
je 0x4193a1
cmp dword [0x4e37f0], 0
je 0x4193a1
cmp dword [0x4e7ca4], 0
jne 0x4193a1
cmp dword [0x4e7cbc], 0
je 0x41935d
mov ecx, dword [0x4e37f8]
cmp byte [ecx + 0x53], 0
jne 0x41935d
cmp dword [ecx + 0x44], 0xffffffff
jle 0x419357
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov ecx, dword [0x4e37f8]
sub eax, dword [ecx + 0x48]
cmp eax, dword [ecx + 0x44]
jb 0x419357
cmp dword [ecx + 0x40], 0
je 0x419357
cmp byte [ecx + 0x96], 0
mov byte [ecx + 0x53], 1
jne 0x419357
mov dword [ecx + 0x5c], 5
cmp byte [ecx + 0x53], 0
je 0x4193a1
mov edx, 1
or ecx, 0xffffffff
call fcn.004015e0
jmp 0x4193a1
cmp eax, 1
jne 0x4193a1
push 0
call esi
push eax
call ebx
cmp eax, dword [0x4e8f18]
jne 0x4193a1
mov edx, 1
mov dword [0x4e37f0], 0
or ecx, 0xffffffff
call fcn.004015e0
mov dword [0x4e37f0], 1
mov eax, dword [ebp + 0x4c]
mov ecx, dword [ebp + 0xc]
mov dword [eax + 0x6c], ecx
mov ecx, dword [ebp + 0x34]
mov dword [eax + 0x74], ecx
lea esp, [ebp - 0x860]
pop edi
pop esi
pop ebx
lea esp, [ebp + 0x70]
pop ebp
ret