Function at 0x464144
Capabilities:
Get keyboard layout
Log keystrokes via polling
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x17c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x144], eax
mov edi, ecx
mov dword [ebp - 0x150], esi
mov ecx, dword [ebp + 0x14]
mov ebx, ecx
push esi
mov dword [ebp - 0x148], ecx
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov dword [ebp - 0x17c], eax
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
jne 0x4641b2
mov eax, 0x100
push eax
lea eax, [ebp - 0x10c]
push esi
push eax
call dword [sym.imp.msvcrt.dll_memset]
add esp, 0xc
jmp 0x46423a
mov edx, dword [ebp - 0x144]
mov ecx, 0x100
cmp edx, 0x12
jne 0x4641dc
mov eax, dword [ebp + 0x10]
shr eax, 0x10
test cx, ax
movzx ecx, byte [ebp - 0x67]
movzx eax, byte [ebp - 0xfa]
cmovne ecx, eax
mov byte [ebp - 0x67], cl
mov eax, dword [edi + 0x14d8]
cmp eax, 3
je 0x464201
xor ecx, ecx
inc ecx
cmp eax, ecx
jg 0x46422d
mov eax, dword [edi + 4]
cmp dword [eax + 0x140], esi
je 0x46422d
cmp dword [edi + 0x14e0], esi
jne 0x46422d
cmp edx, 0x90
jne 0x46422d
test byte [ebp - 0xfc], 0x80
jne 0x46422d
mov eax, dword [ebp + 0x10]
shr eax, 0x10
mov dword [ebp - 0x144], 0x2b
test eax, 0xc000
jne 0x46422d
xor byte [ebp - 0x7c], 1
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
mov eax, dword [edi + 4]
xor edx, edx
cmp dword [eax + 0x148], edx
je 0x464263
mov eax, dword [ebp + 0x10]
mov ecx, 0x4000
shr eax, 0x10
and eax, 0xc000
cmp ax, cx
jne 0x464263
xor eax, eax
jmp 0x46504f
mov eax, dword [ebp + 0x10]
shr eax, 0x10
mov dword [ebp + 0x10], eax
test eax, 0x2000
je 0x464283
test byte [ebp - 0x67], 0x80
push 1
pop ecx
cmove esi, ecx
mov dword [ebp - 0x150], esi
mov ecx, eax
shr eax, 0xf
not eax
and eax, 1
mov dword [ebp - 0xc], eax
mov al, byte [ebp - 0xfb]
test esi, esi
je 0x4642b8
test al, al
jns 0x4642b8
cmp dword [edi + 0x153c], edx
je 0x4642ae
mov byte [ebp - 0xfa], dl
jmp 0x4642b8
mov byte [ebp - 0x67], 0x80
mov dword [ebp - 0x150], edx
mov esi, dword [ebp - 0x144]
and ecx, 0x81ff
mov dword [ebp - 0x16c], ecx
movzx ecx, al
movzx eax, byte [ebp - 0xfc]
shr ecx, 7
shr eax, 7
lea eax, [eax + ecx*2]
mov dword [ebp - 0x160], eax
cmp dword [edi + 0x35c4], edx
jne 0x464326
mov ecx, 0x100
mov dword [0x5248e8], ecx
cmp dword [edi + 0x1538], edx
je 0x46430a
cmp esi, 0x12
jne 0x46430a
test dword [ebp + 0x10], ecx
je 0x464369
push esi
pop ecx
cmp esi, 0x5d
mov dword [ebp - 0x15c], 0x5d
cmove ecx, dword [ebp - 0x15c]
mov dword [0x5248e8], ecx
jmp 0x46432c
mov ecx, dword [0x5248e8]
cmp esi, ecx
jne 0x464369
mov ecx, dword [edi + 0x35c4]
test ecx, ecx
jne 0x46434f
test dword [ebp + 0x10], 0xc000
jne 0x46434f
mov dword [edi + 0x35c4], 1
jmp 0x46437d
cmp ecx, 1
jne 0x464377
test dword [ebp + 0x10], 0x8000
je 0x464377
mov dword [edi + 0x35c4], 2
jmp 0x46437d
cmp dword [edi + 0x35c4], 1
jne 0x464384
cmp esi, 0x11
je 0x46437d
mov dword [edi + 0x35c4], edx
cmp dword [edi + 0x35c4], 1
mov ecx, dword [ebp - 0x150]
jle 0x464396
test ecx, ecx
je 0x46439a
mov dword [edi + 0x35c4], edx
test ecx, ecx
jne 0x4643cf
mov ecx, dword [edi + 4]
cmp dword [ecx + 0x140], edx
je 0x4643b6
cmp dword [edi + 0x14e0], edx
jne 0x4643b6
cmp dword [edi + 0x14d8], 2
jne 0x4643cf
cmp dword [edi + 0x14d8], 3
je 0x4643cf
cmp dword [edi + 0x1508], edx
jne 0x4643cf
cmp dword [edi + 0x35c4], edx
je 0x46444b
test dword [ebp + 0x10], 0x100
jne 0x46444b
cmp esi, 0x25
ja 0x46440c
je 0x464408
mov ecx, esi
sub ecx, 0xc
je 0x464404
sub ecx, 0x15
je 0x464400
dec ecx
je 0x4643fc
dec ecx
je 0x4643f8
dec ecx
jne 0x46444b
push 0x67
jmp 0x464433
push 0x61
jmp 0x464433
push 0x63
jmp 0x464433
push 0x69
jmp 0x464433
push 0x65
jmp 0x464433
push 0x64
jmp 0x464433
mov ecx, esi
sub ecx, 0x26
je 0x464431
dec ecx
je 0x46442d
dec ecx
je 0x464429
sub ecx, 5
je 0x464425
dec ecx
jne 0x46444b
push 0x6e
jmp 0x464433
push 0x60
jmp 0x464433
push 0x62
jmp 0x464433
push 0x66
jmp 0x464433
push 0x68
test byte [ebp - 0x7c], 1
pop esi
mov dword [ebp - 0x144], esi
je 0x46444b
xor ecx, ecx
inc ecx
or eax, ecx
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0xc], edx
je 0x464d0d
test byte [ebp - 0x67], 0x80
jne 0x464d0d
cmp dword [edi + 0x35c4], edx
jne 0x464d0d
cmp dword [ebp - 0x150], edx
je 0x46447a
mov ecx, ebx
mov byte [ecx], 0x1b
lea ebx, [ecx + 1]
mov dword [ebp - 0x154], 0x22
mov dword [ebp - 0x164], 0x21
cmp esi, 0x21
jne 0x4644b7
cmp eax, 1
jne 0x4644ae
push edx
push 2
push 0x115
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x46425c
cmp eax, 2
jne 0x4644d2
push edx
push edx
jmp 0x46449b
cmp esi, 0x22
jne 0x4644f0
cmp eax, 1
jne 0x4644c6
push edx
push 3
jmp 0x46449b
cmp eax, 2
jne 0x4644d2
xor eax, eax
push edx
inc eax
push eax
jmp 0x46449b
cmp eax, 3
jne 0x4644f0
mov ecx, dword [edi + 4]
xor eax, eax
cmp esi, dword [ebp - 0x164]
setne al
push eax
call fcn.0049e1d2
jmp 0x46425c
cmp esi, 0x2d
jne 0x464506
cmp eax, 1
jne 0x464506
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x38]
jmp 0x46425c
mov dword [ebp - 0x178], 0x20
cmp dword [ebp - 0x150], edx
je 0x46458d
cmp esi, 0x73
jne 0x464567
cmp dword [edi + 0x1514], edx
jne 0x46504c
mov dword [ebp - 0x15c], 8
cmp dword [edi + 0x1508], edx
je 0x464615
cmp dword [ebp - 0x150], edx
jne 0x4647b8
lea eax, [esi - 0x61]
cmp eax, 8
mov eax, dword [ebp - 0x160]
ja case.default.0x464560
lea ecx, [esi - 0x61]
jmp dword [ecx*4 + 0x465064]
cmp esi, 0x20
jne 0x46458d
cmp dword [edi + 0x1518], edx
je 0x464529
push edx
push 0xf100
push 0x112
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x46504c
cmp esi, 0x13
jne 0x464529
cmp eax, 2
jne 0x464529
mov eax, dword [edi + 4]
xor ecx, ecx
inc ecx
xor dword [eax + 0x140], ecx
jmp 0x46425c
and eax, 3
mov cl, byte [eax + 0x4ea098]
mov byte [ebx], cl
sub ebx, dword [ebp - 0x148]
lea eax, [ebx + 1]
jmp 0x46504f
and eax, 3
mov al, byte [eax + str.jJ_n_n]
mov byte [ebx], al
jmp 0x4645b3
and eax, 3
mov al, byte [eax + 0x4ea0a8]
jmp 0x4645ca
and eax, 3
mov al, byte [eax + str.hH_b_b]
jmp 0x4645ca
mov byte [ebx], 0x2e
jmp 0x4645b3
and eax, 3
mov al, byte [eax + str.lL_f_f]
jmp 0x4645ca
and eax, 3
mov al, byte [eax + 0x4ea0c0]
jmp 0x4645ca
and eax, 3
mov al, byte [eax + str.kK_v_v]
jmp 0x4645ca
and eax, 3
mov al, byte [eax + 0x4ea0d0]
jmp 0x4645ca
cmp dword [ebp - 0x150], edx
jne 0x4647b8
mov eax, dword [edi + 0x14d8]
mov ecx, edx
mov dword [ebp - 0x174], eax
cmp eax, 3
je 0x46464c
cmp eax, 1
jg 0x464670
mov eax, dword [edi + 4]
cmp dword [eax + 0x140], edx
je 0x464670
cmp dword [edi + 0x14e0], edx
jne 0x464670
mov eax, esi
sub eax, 0x2b
je 0x46466d
sub eax, 0x3f
je 0x464669
sub eax, 3
je 0x464665
dec eax
dec eax
jne 0x464670
push 0x51
jmp 0x46466f
push 0x53
jmp 0x46466f
push 0x52
jmp 0x46466f
push 0x50
pop ecx
mov eax, dword [edi + 4]
cmp dword [eax + 0x140], edx
je 0x46476e
cmp dword [edi + 0x14e0], edx
jne 0x46476e
cmp esi, 0x67
ja 0x4646f8
je 0x4646f4
cmp esi, 0x63
ja 0x4646d7
je 0x4646d3
mov eax, esi
sub eax, 0xd
je 0x4646bf
sub eax, 0x53
je 0x4646bb
dec eax
je 0x4646b7
dec eax
jne 0x46476e
push 0x72
pop ecx
jmp 0x464772
push 0x71
jmp 0x4646b1
push 0x70
jmp 0x4646b1
test dword [ebp + 0x10], 0x100
je 0x46476e
push 0x4d
jmp 0x46476d
push 0x73
jmp 0x4646b1
mov eax, esi
sub eax, 0x64
je 0x4646f0
dec eax
je 0x4646ec
dec eax
jne 0x46476e
push 0x76
jmp 0x4646b1
push 0x75
jmp 0x4646b1
push 0x74
jmp 0x4646b1
push 0x77
jmp 0x4646b1
mov eax, esi
sub eax, 0x68
je 0x46476b
dec eax
je 0x464764
dec eax
je 0x464757
dec eax
je 0x464730
dec eax
dec eax
je 0x464723
dec eax
je 0x46471f
dec eax
jne 0x46476e
cmp dword [edi + 0x14d8], 2
jne 0x46476e
push 0x6f
jmp 0x46476d
push 0x6e
jmp 0x4646b1
cmp dword [edi + 0x14d8], 2
jne 0x46476e
push 0x6d
jmp 0x46476d
xor ecx, ecx
cmp dword [ebp - 0x174], 2
jne 0x464749
cmp dword [ebp - 0x160], ecx
setne cl
add ecx, 0x6b
jmp 0x464772
cmp dword [ebp - 0x160], ecx
setne cl
add ecx, 0x6c
jmp 0x464772
cmp dword [edi + 0x14d8], 2
jne 0x46476e
push 0x6a
jmp 0x46476d
push 0x79
jmp 0x4646b1
push 0x78
pop ecx
test ecx, ecx
je 0x4647b2
mov eax, dword [edi + 4]
push ecx
cmp dword [eax + 0x144], edx
je 0x464794
lea eax, [ecx - 0x50]
cmp eax, 3
ja 0x46478d
push 0x4ea0d8
jmp 0x464799
push 0x4ea0dc
jmp 0x464799
push str.eO_c
push ebx
call dword [sym.imp.msvcrt.dll_sprintf]
add esp, 0xc
add ebx, eax
sub ebx, dword [ebp - 0x148]
mov eax, ebx
jmp 0x46504f
mov eax, dword [ebp - 0x160]
mov ecx, dword [ebp - 0x15c]
cmp esi, ecx
jne 0x4647f8
test eax, eax
jne 0x4647df
cmp dword [edi + 0x14d0], edx
push 0x7f
pop eax
cmovne ecx, eax
mov byte [ebx], cl
mov byte [ebx + 1], dl
push 0xfffffffffffffffe
pop eax
jmp 0x46504f
cmp eax, 1
jne 0x46486e
cmp dword [edi + 0x14d0], edx
push 0x7f
pop eax
cmovne eax, ecx
mov byte [ebx], al
jmp 0x4647d4
cmp esi, 9
jne 0x464818
xor ecx, ecx
inc ecx
cmp eax, ecx
jne 0x46486e
push 0x1b
pop eax
mov byte [ebx], al
mov byte [ebx + 1], 0x5b
add ebx, 2
mov byte [ebx], 0x5a
jmp 0x4645b3
cmp esi, dword [ebp - 0x178]
jne 0x464839
cmp eax, 2
jne 0x46482c
mov byte [ebx], dl
jmp 0x4645b3
cmp eax, 3
jne 0x46486e
mov byte [ebx], 0xa0
jmp 0x4645b3
cmp esi, 3
jne 0x46485f
cmp eax, 2
jne 0x4648b6
mov ecx, dword [edi + 0x20e8]
test ecx, ecx
je 0x46425c
mov eax, dword [ecx]
xor edx, edx
inc edx
push edx
call dword [eax + 0x1c]
jmp 0x46425c
cmp esi, 0x13
jne 0x46486e
mov word [ebx], 0x1a
jmp 0x4647d7
cmp eax, 2
jne 0x4648b6
lea eax, [esi - 0x32]
cmp eax, 6
ja 0x464886
mov al, byte [esi + 0x4ea0ba]
jmp 0x4645ca
cmp esi, 0xbd
je 0x4648ae
cmp esi, 0xbf
je 0x4648ae
cmp esi, 0xdf
je 0x4648a6
cmp esi, 0xdc
jne 0x4648eb
mov byte [ebx], 0x1c
jmp 0x4645b3
mov byte [ebx], 0x1f
jmp 0x4645b3
cmp eax, 3
jne 0x4648cb
cmp esi, 0xde
jne 0x4648eb
mov byte [ebx], 0x1e
jmp 0x4645b3
test eax, eax
jne 0x4648eb
cmp esi, 0xd
jne 0x4648eb
mov eax, dword [edi + 4]
cmp dword [eax + 0x14c], edx
je 0x4648eb
mov byte [ebx], 0xd
inc ebx
mov byte [ebx], 0xa
jmp 0x4645b3
lea eax, [esi - 0x70]
mov dword [ebp - 0x168], 0x18
mov dword [ebp - 0x174], eax
cmp eax, 0x13
mov eax, dword [ebp - 0x160]
mov ecx, edx
mov dword [ebp - 0x158], 0x19
mov dword [ebp - 0x170], 0x17
ja case.default.0x464929
mov esi, dword [ebp - 0x174]
jmp dword [esi*4 + 0x465088]
test byte [ebp - 0xfc], 0x80
push 0xb
pop ecx
cmovne ecx, dword [ebp - 0x170]
jmp case.default.0x464929
test byte [ebp - 0xfc], 0x80
push 0xc
pop ecx
cmovne ecx, dword [ebp - 0x168]
jmp case.default.0x464929
test byte [ebp - 0xfc], 0x80
push 0xd
pop ecx
cmovne ecx, dword [ebp - 0x158]
jmp case.default.0x464929
test byte [ebp - 0xfc], 0x80
push 0xe
pop ecx
mov dword [ebp - 0x154], 0x1a
cmovne ecx, dword [ebp - 0x154]
jmp case.default.0x464929
test byte [ebp - 0xfc], 0x80
push 0xf
pop ecx
mov dword [ebp - 0x154], 0x1c
cmovne ecx, dword [ebp - 0x154]
jmp case.default.0x464929
test byte [ebp - 0xfc], 0x80
push 0x11
pop ecx
mov dword [ebp - 0x154], 0x1d
cmovne ecx, dword [ebp - 0x154]
jmp case.default.0x464929
test byte [ebp - 0xfc], 0x80
push 0x12
pop ecx
mov dword [ebp - 0x154], 0x1f
cmovne ecx, dword [ebp - 0x154]
jmp case.default.0x464929
test byte [ebp - 0xfc], 0x80
push 0x13
pop ecx
cmovne ecx, dword [ebp - 0x178]
jmp case.default.0x464929
test byte [ebp - 0xfc], 0x80
push 0x14
pop ecx
cmovne ecx, dword [ebp - 0x164]
jmp case.default.0x464929
test byte [ebp - 0xfc], 0x80
push 0x15
pop ecx
cmovne ecx, dword [ebp - 0x154]
jmp case.default.0x464929
mov ecx, dword [ebp - 0x170]
jmp case.default.0x464929
mov ecx, dword [ebp - 0x168]
jmp case.default.0x464929
mov ecx, dword [ebp - 0x158]
jmp case.default.0x464929
push 0x1a
pop ecx
jmp case.default.0x464929
push 0x1c
jmp 0x464a42
push 0x1d
jmp 0x464a42
push 0x1f
jmp 0x464a42
mov ecx, dword [ebp - 0x178]
jmp case.default.0x464929
mov ecx, dword [ebp - 0x164]
jmp case.default.0x464929
mov ecx, dword [ebp - 0x154]
mov esi, dword [ebp - 0x144]
test al, 2
jne 0x464aa3
mov eax, esi
sub eax, 0x21
je 0x464aa0
dec eax
je 0x464a9c
dec eax
je 0x464a98
dec eax
je 0x464a91
sub eax, 9
je 0x464a8d
dec eax
jne 0x464aa3
push 3
jmp 0x464aa2
push 2
jmp 0x464aa2
xor eax, eax
lea ecx, [eax + 1]
jmp 0x464aa3
push 4
jmp 0x464aa2
push 6
jmp 0x464aa2
push 5
pop ecx
cmp dword [edi + 0x14d8], 3
jne 0x464ab8
cmp ecx, 6
jg 0x464ab8
movsx ecx, byte [ecx + 0x4ea0f4]
mov eax, dword [edi + 4]
cmp dword [eax + 0x144], edx
je 0x464aef
lea eax, [ecx - 1]
cmp eax, 5
ja 0x464aef
movsx eax, byte [ecx + str._HLMEIG]
push eax
push 0x4ea0d8
push ebx
call dword [sym.imp.msvcrt.dll_sprintf]
add esp, 0xc
sub ebx, dword [ebp - 0x148]
add eax, ebx
jmp 0x46504f
cmp dword [edi + 0x14d8], 5
jne 0x464bc6
lea eax, [ecx - 0xb]
cmp eax, 0x17
ja 0x464b8b
mov eax, dword [ebp - 0x174]
lea edi, [ebp - 0x140]
mov esi, str.MNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz_____
push 0xc
pop ecx
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
cmp eax, 0xb
ja case.0x464b24.0
jmp dword [eax*4 + 0x4650d8]
xor eax, eax
lea edx, [eax + 1]
jmp case.0x464b24.0
push 2
jmp 0x464b5c
push 3
jmp 0x464b5c
push 4
jmp 0x464b5c
push 5
jmp 0x464b5c
push 6
jmp 0x464b5c
push 7
jmp 0x464b5c
mov edx, dword [ebp - 0x15c]
jmp case.0x464b24.0
push 9
jmp 0x464b5c
push 0xa
jmp 0x464b5c
push 0xb
pop edx
test byte [ebp - 0xfc], 0x80
je 0x464b69
add edx, 0xc
test byte [ebp - 0xfb], 0x80
je 0x464b78
add edx, dword [ebp - 0x168]
movsx eax, byte [ebp + edx - 0x140]
push eax
push str.e__c
jmp 0x464ad8
cmp dword [edi + 0x14d8], 5
jne 0x464bc6
lea eax, [ecx - 1]
cmp eax, 5
ja 0x464bc6
lea edi, [ebp - 0xc]
mov esi, str.HL.FIG
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
cmp ecx, 3
jne 0x464bb6
mov byte [ebx], 0x7f
inc ebx
jmp 0x4647a5
movsx eax, byte [ebp + ecx - 0xd]
push eax
push str.e__c
jmp 0x464799
mov eax, dword [edi + 4]
cmp dword [eax + 0x144], edx
jne 0x464bda
cmp dword [edi + 0x14d8], 4
jne 0x464c0c
lea eax, [ecx - 0xb]
cmp eax, 0xd
ja 0x464c0c
cmp ecx, 0xf
push 1
pop eax
cmovg edx, eax
cmp ecx, 0x15
jle 0x464bf1
inc edx
mov eax, dword [edi + 4]
sub ecx, edx
add ecx, 0x45
push ecx
cmp dword [eax + 0x144], 0
je 0x464794
jmp 0x464786
xor eax, eax
inc eax
cmp dword [edi + 0x14d8], eax
jne 0x464c2d
lea eax, [ecx - 0xb]
cmp eax, 4
ja 0x464c2d
lea eax, [ecx + 0x36]
push eax
push str.e___c
jmp 0x464ad8
cmp dword [edi + 0x14d8], 2
jne 0x464c4d
lea eax, [ecx - 0xb]
cmp eax, 3
ja 0x464c4d
mov eax, dword [edi + 4]
cmp dword [eax + 0x144], edx
lea eax, [ecx + 0x45]
push eax
jmp 0x464c01
cmp dword [edi + 0x14d4], edx
je 0x464c82
xor eax, eax
inc eax
cmp ecx, eax
je 0x464c61
cmp ecx, 4
jne 0x464c82
xor esi, esi
mov edx, 0x4ea154
inc esi
mov eax, 0x4ea150
cmp ecx, esi
cmovne eax, edx
push eax
push ebx
call dword [sym.imp.msvcrt.dll_sprintf]
pop ecx
pop ecx
jmp 0x464ae2
test ecx, ecx
je 0x464c91
push ecx
push str.e__d
jmp 0x464ad8
mov eax, esi
sub eax, 0xc
je 0x464cf3
sub eax, dword [ebp - 0x158]
je 0x464cef
dec eax
je 0x464ceb
dec eax
je 0x464ce7
dec eax
je 0x464ce3
cmp esi, 0xd
jne 0x464cb6
mov word [ebx], si
jmp 0x4647d7
mov ebx, dword [ebp - 0x150]
test ebx, ebx
je 0x464cdb
lea eax, [esi - 0x60]
cmp eax, 9
ja 0x464cdb
imul eax, dword [0x5248e4], 0xa
add eax, 0xffffffa0
add eax, esi
mov dword [0x5248e4], eax
jmp 0x464d13
mov dword [0x5248e4], edx
jmp 0x464d13
mov al, 0x42
jmp 0x464cf5
mov al, 0x43
jmp 0x464cf5
mov al, 0x41
jmp 0x464cf5
mov al, 0x44
jmp 0x464cf5
mov al, 0x47
push dword [ebp - 0x160]
mov ecx, dword [edi + 4]
movsx eax, al
push eax
push ebx
call fcn.0049f233
jmp 0x464ae2
mov ebx, dword [ebp - 0x150]
mov dword [ebp - 0x15c], edx
cmp dword [edi + 0x1ca0], edx
je 0x464d3c
cmp byte [ebp - 0xf8], dl
je 0x464d3c
xor eax, eax
mov byte [ebp - 0xf8], dl
test ebx, ebx
sete al
mov dword [ebp - 0x15c], eax
cmp dword [0x5164e0], 2
push dword [ebp - 0x17c]
push edx
jne 0x464d89
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 0x16c]
push esi
call dword [sym.imp.USER32.dll_ToAsciiEx]
xor esi, esi
mov dword [ebp - 0x168], eax
mov edx, esi
movzx ecx, byte [ebp + edx - 0x148]
mov word [edx*2 + 0x524d14], cx
inc edx
cmp edx, 3
jl 0x464d71
jmp 0x464daa
push 0x524d14
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 0x16c]
push esi
call dword [sym.imp.USER32.dll_ToAsciiEx]
mov dword [ebp - 0x168], eax
xor esi, esi
test eax, eax
jle 0x464ffd
mov ecx, dword [edi + 4]
call fcn.0049f296
cmp dword [ebp - 0x168], 0
mov ebx, esi
jle 0x464fe3
mov al, byte [ebx*2 + 0x524d14]
mov ecx, dword [edi + 0x35c4]
mov byte [ebp - 0x149], al
cmp ecx, 2
jne 0x464e00
test al, al
js 0x464e00
cmp al, 0x20
jbe 0x464e00
movzx eax, al
mov dword [0x5248e0], eax
mov dword [edi + 0x35c4], 3
jmp 0x464fd6
cmp ecx, 3
jne 0x464e61
test al, al
js 0x464e61
cmp al, 0x20
jbe 0x464e61
mov ecx, dword [0x5248e0]
movzx edx, al
push esi
mov dword [edi + 0x35c4], esi
call fcn.004a21b9
pop ecx
cmp eax, 0xffffffff
je 0x464ff0
mov ecx, dword [edi + 4]
movzx eax, ax
mov dword [ebp - 0x158], eax
call fcn.004998c3
mov ecx, dword [edi + 0x20f4]
test ecx, ecx
je 0x464fd6
xor eax, eax
inc eax
push eax
push eax
lea eax, [ebp - 0x158]
push eax
call fcn.0047fcb0
jmp 0x464fd6
cmp dword [ebp - 0xc], 0
mov dword [edi + 0x35c4], esi
jne 0x464f19
mov edx, dword [0x5248e4]
mov ecx, dword [edi + 4]
test edx, edx
je 0x464ef6
cmp dword [ecx + 0xf4], esi
jne 0x464ec2
mov eax, dword [ecx + 0x10]
cmp dword [eax + 0xc], 0xfde9
je 0x464ec2
cmp dword [edi + 0x2178], esi
jne 0x464ec2
mov byte [ebp - 0x149], dl
call fcn.004998c3
mov ecx, dword [edi + 0x20f4]
test ecx, ecx
je 0x464eeb
xor eax, eax
inc eax
push eax
push eax
lea eax, [ebp - 0x149]
push eax
call fcn.0047f66c
jmp 0x464eeb
movzx eax, dx
mov dword [ebp - 0x158], eax
call fcn.004998c3
mov ecx, dword [edi + 0x20f4]
test ecx, ecx
je 0x464eeb
xor eax, eax
inc eax
push eax
push eax
lea eax, [ebp - 0x158]
push eax
call fcn.0047fcb0
mov dword [0x5248e4], esi
jmp 0x464fce
call fcn.004998c3
mov ecx, dword [edi + 0x20f4]
test ecx, ecx
je 0x464fce
xor eax, eax
inc eax
push eax
push eax
lea eax, [ebp - 0x149]
jmp 0x464fc2
cmp dword [ebp - 0x15c], 0
je 0x464f80
cmp al, 0x80
jae 0x464f80
movzx eax, al
and eax, 0x7f
push 0x1b
pop ecx
mov word [ebp - 0x16c], cx
mov ax, word [eax*2 + 0x4f3778]
mov ecx, dword [edi + 4]
mov word [ebp - 0x16a], ax
call fcn.004998c3
mov ecx, dword [edi + 0x20f4]
test ecx, ecx
je 0x464fce
mov edx, dword [ebp - 0x150]
xor eax, eax
inc eax
push eax
xor eax, eax
test edx, edx
setne al
inc eax
push eax
xor eax, eax
test edx, edx
sete al
lea eax, [ebp + eax*2 - 0x16c]
push eax
call fcn.0047fcb0
jmp 0x464fce
push 0x1b
pop ecx
mov byte [ebp - 0x148], cl
mov ecx, dword [edi + 4]
mov byte [ebp - 0x147], al
call fcn.004998c3
mov ecx, dword [edi + 0x20f4]
test ecx, ecx
je 0x464fce
mov edx, dword [ebp - 0x150]
xor eax, eax
inc eax
push eax
xor eax, eax
test edx, edx
setne al
inc eax
push eax
xor eax, eax
test edx, edx
sete al
lea eax, [ebp + eax - 0x148]
push eax
push dword [edi + 0x2170]
call fcn.0047fc4e
push esi
mov ecx, edi
call fcn.004630ed
inc ebx
cmp ebx, dword [ebp - 0x168]
jl 0x464dc9
xor eax, eax
mov word [0x524d14], ax
jmp 0x46425c
push 0x10
call dword [sym.imp.USER32.dll_MessageBeep]
jmp 0x46425c
test ebx, ebx
jne 0x465005
xor eax, eax
jmp 0x465031
cmp word [0x524d14], 0
je 0x465037
mov eax, dword [edi + 4]
cmp dword [eax + 0xf4], esi
jne 0x46502e
mov eax, dword [eax + 0x10]
cmp dword [eax + 0xc], 0xfde9
je 0x46502e
cmp dword [edi + 0x2178], esi
je 0x465037
push 0xa
pop eax
mov word [0x524d14], ax
cmp dword [ebp - 0x144], 0x12
jne 0x46504c
cmp dword [edi + 0x151c], esi
je 0x46425c
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401000
mov esp, ebp
pop ebp
ret 0x10