Function at 0x404470
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa4
mov eax, dword [ebp + 0x24]
mov dl, byte [ebp + 0x18]
push ebx
mov ebx, dword [ebp + 0x1c]
push esi
push edi
mov dword [esp + 0x20], 0x3fff
cmp eax, 0xffc3d44f
je 0x4044aa
cmp eax, 0xffc3d44e
je 0x4044aa
mov byte [esp + 0xd], 0
cmp eax, 0xffc3d44d
jne 0x4044af
mov byte [esp + 0xd], 1
mov ecx, dword [0x4a14b4]
test ecx, ecx
jne 0x4044c6
lea edi, [esp + 0x40]
mov dword [esp + 0x1c], edi
jmp 0x40456d
mov eax, dword [0x4a14b8]
mov edi, eax
imul edi, edi, 0x70
inc eax
add edi, ecx
mov dword [esp + 0x1c], edi
mov dword [0x4a14b8], eax
cmp eax, dword [0x49d32c]
jl 0x4044ee
mov dword [0x4a14b8], 0
mov al, byte [ebp + 0x18]
mov cl, byte [ebp + 0x20]
mov byte [edi], al
mov byte [edi + 5], cl
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, eax
sub edx, dword [0x4a32fc]
mov dword [0x4a14bc], eax
mov dword [esp + 0x34], edx
fild dword [esp + 0x34]
jns 0x40451c
fadd dword [0x497be0]
fdiv qword [0x497bd8]
mov dword [0x4a32fc], eax
fstp dword [edi + 8]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
test esi, esi
je 0x40455d
cmp esi, dword [0x4a14c0]
je 0x404557
mov ecx, dword [0x4a0a38]
push esi
lea eax, [edi + 0xc]
push eax
push 0x418
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x404564
mov byte [edi + 0xc], 0
jmp 0x404564
mov dword [edi + 0xc], 0x412f4e
mov dl, byte [ebp + 0x18]
mov dword [0x4a14c0], esi
cmp dl, 0xe7
jne 0x40458a
mov edx, dword [ebp + 0x14]
mov ax, word [edx + 4]
mov word [edi + 2], ax
mov byte [edi + 4], 0x55
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [edx + 0x64]
mov word [edi + 2], bx
cmp cl, 3
ja 0x40459b
xor ebx, ebx
mov dword [ebp + 0x1c], ebx
mov eax, dword [ebp + 8]
cmp eax, dword [0x4a0b6c]
jne 0x4045cf
mov al, byte [ebp + 0x28]
and al, 1
mov byte [esp + 0xf], al
jne 0x4046ff
cmp byte [ebp + 0x20], 0
movzx edx, dl
setne cl
dec cl
and cl, 0x80
mov byte [edx + 0x4a0a58], cl
jmp 0x4046ff
mov eax, dword [ebp + 0x28]
shr eax, 4
and al, 1
mov byte [esp + 0xf], al
test ebx, 0x100
jne case.0x404611.13
push 0x90
call dword [sym.imp.USER32.dll_GetKeyState]
test al, 1
je case.0x404611.13
movzx eax, byte [ebp + 0x18]
add eax, 0xfffffff4
cmp eax, 0x62
ja case.0x404611.13
movzx ecx, byte [eax + 0x405f94]
jmp dword [ecx*4 + 0x405f64]
cmp byte [ebp + 0x20], 0
sete dl
mov byte [0x49f92c], dl
jmp case.0x404611.13
cmp byte [ebp + 0x20], 0
sete al
mov byte [0x49f92d], al
jmp case.0x404611.13
cmp byte [ebp + 0x20], 0
sete cl
mov byte [0x49f92e], cl
jmp case.0x404611.13
cmp byte [ebp + 0x20], 0
sete dl
mov byte [0x49f92f], dl
jmp case.0x404611.13
cmp byte [ebp + 0x20], 0
sete al
mov byte [0x49f930], al
jmp case.0x404611.13
cmp byte [ebp + 0x20], 0
sete cl
mov byte [0x49f931], cl
jmp case.0x404611.13
cmp byte [ebp + 0x20], 0
sete dl
mov byte [0x49f932], dl
jmp case.0x404611.13
cmp byte [ebp + 0x20], 0
sete al
mov byte [0x49f933], al
jmp case.0x404611.13
cmp byte [ebp + 0x20], 0
sete cl
mov byte [0x49f934], cl
jmp case.0x404611.13
cmp byte [ebp + 0x20], 0
sete dl
mov byte [0x49f935], dl
jmp case.0x404611.13
cmp byte [ebp + 0x20], 0
sete al
mov byte [0x49f936], al
movzx esi, byte [ebp + 0x18]
mov edx, dword [0x4a14d8]
lea ecx, [esi + esi*8]
shl ecx, 5
cmp byte [ecx + edx + 4], 0
jne 0x4046ff
test byte [ebp + 0x28], 0x10
jne 0x4046ff
mov eax, dword [ebp + 0x20]
push eax
mov al, byte [ebp + 0x18]
call fcn.004073a0
add esp, 4
test al, al
je 0x4046ff
cmp byte [ebp + 0x20], 0
setne cl
dec cl
and cl, 0x80
mov byte [esi + 0x4a0a58], cl
cmp byte [esp + 0xd], 0
je 0x40470a
mov al, 0x69
jmp 0x404716
mov al, byte [esp + 0xf]
neg al
sbb al, al
and al, 0x41
add al, 0x20
cmp byte [0x4a0b58], 0
mov byte [edi + 4], al
je 0x40475c
mov al, byte [ebp + 0x18]
cmp al, 0x5b
je 0x40472d
cmp al, 0x5c
jne 0x40475c
cmp byte [ebp + 0x20], 0
jne 0x40475c
mov edx, dword [ebp + 0x18]
push 0
push SysReAllocString
push 0x3fff
push edi
push ebx
push edx
xor bl, bl
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x14]
call fcn.00406090
add esp, 0x18
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [0x49f951], 0
je 0x404800
cmp byte [ebp + 0x18], 0x1b
jne 0x404800
cmp byte [ebp + 0x20], 0
jne 0x404800
push 0
push str.32771
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x404800
push 0
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp esi, eax
jne 0x404800
push 0xffc3d44d
push 0
push 0
push 0
push 0x1b
push 0
call fcn.0040e2a0
mov al, byte [0x4a0a35]
push 0xffc3d44d
shr al, 3
push 0
and al, 1
or al, 0xa4
push 0
movzx ecx, al
push 0
push ecx
push 1
call fcn.0040e2a0
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 8]
push 0
push SysReAllocString
push 0x3fff
push edi
push ebx
push 0x1b
xor bl, bl
call fcn.00406090
add esp, 0x48
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx eax, bx
lea edx, [eax + eax*8]
mov dword [esp + 0x30], eax
mov eax, dword [0x4a14dc]
shl edx, 5
mov cl, byte [eax + edx + 0x12]
add eax, edx
mov edx, dword [0x4a0b68]
mov byte [esp + 0x27], cl
cmp dword [ebp + 8], edx
jne 0x404832
test cl, cl
je 0x404832
mov cl, byte [ebp + 0x18]
mov esi, eax
jmp 0x404844
mov cl, byte [ebp + 0x18]
movzx eax, cl
lea esi, [eax + eax*8]
shl esi, 5
add esi, dword [0x4a14d8]
cmp byte [esp + 0xd], 0
mov dword [esp + 0x18], esi
je 0x404889
cmp dword [ebp + 0x24], 0xffc3d44e
jne 0x404878
cmp byte [ebp + 0x20], 0
je 0x404878
cmp dword [0x49f94c], esi
jne 0x404878
mov byte [esi + 0xc], 0
mov byte [esi + 0xf], 0
mov dword [0x49f94c], 0
mov ecx, dword [ebp + 0x20]
push 0
push 0x3fff
push edi
push ecx
jmp 0x405f3f
cmp byte [ebp + 0x20], 0
jne 0x40489c
mov eax, 0x3fff
mov byte [esi + 0x10], 0
mov word [esi + 6], ax
cmp dword [ebp + 8], edx
jne 0x404956
cmp byte [ebp + 0x20], 0
je 0x4049c5
cmp byte [0x49f955], 0
je 0x4048bd
cmp cl, 0x5b
je 0x4048ef
cmp byte [0x49f954], 0
je 0x4048cb
cmp cl, 0x5c
je 0x4048ef
cmp byte [0x49f953], 0
je 0x4048d9
cmp cl, 0xa4
je 0x4048ef
cmp byte [0x49f952], 0
je 0x4049c5
cmp cl, 0xa5
jne 0x4049c5
movzx eax, cl
add eax, 0xffffffa5
cmp eax, 0x4a
ja case.0x404901.93
movzx ecx, byte [eax + 0x40600c]
jmp dword [ecx*4 + 0x405ff8]
mov byte [0x49f955], 0
jmp case.0x404901.93
mov byte [0x49f954], 0
jmp case.0x404901.93
mov byte [0x49f953], 0
jmp case.0x404901.93
mov byte [0x49f952], 0
test byte [0x4a0a35], 3
jne 0x4049c5
movzx edx, byte [0x49d2f9]
push 0xffc3d44d
push 0
push 0
push 0
push edx
push 2
call fcn.0040e2a0
add esp, 0x18
jmp 0x4049c5
test cl, cl
jne 0x404988
mov eax, dword [ebp + 0x20]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push 0
push 0x3fff
push edi
push eax
mov eax, dword [ebp + 8]
push 0
push ecx
mov ecx, dword [ebp + 0x14]
push edx
push eax
mov eax, ebx
call fcn.00406180
add esp, 0x20
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp cl, 1
je 0x404992
cmp cl, 2
jne 0x4049c5
cmp dword [0x4a0bb0], 0
jne 0x405f27
push 0
push str.32768
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x4049c5
push 0
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [0x4a2bbc]
je 0x405f27
mov ecx, dword [0x49f94c]
test ecx, ecx
je 0x4049fd
cmp ecx, esi
je 0x4049fd
mov dl, byte [ebp + 0x20]
test dl, dl
jne 0x404a00
mov eax, dword [ebp + 8]
cmp eax, dword [0x4a0b68]
jne 0x4049ef
xor eax, eax
cmp byte [esi + 4], al
sete al
jmp 0x4049f3
movzx eax, byte [ecx + 4]
test eax, eax
je 0x404a00
mov byte [ecx + 0x11], 1
jmp 0x404a00
mov dl, byte [ebp + 0x20]
cmp byte [esi + 8], 0
jne 0x404a10
cmp byte [esi + 9], 0
je 0x404878
mov byte [esp + 0x2b], 0
mov dword [esp + 0x10], 0x3fff
mov dword [esp + 0x3c], 0
test dl, dl
je 0x404a58
mov al, byte [esi + 0xc]
mov cl, byte [esi + 0xf]
mov byte [esp + 0x17], al
movzx eax, word [esi + 6]
mov byte [esp + 0x15], cl
mov ecx, 0x3fff
mov byte [esi + 0xf], 0
cmp ax, cx
je 0x404a56
mov dword [esp + 0x10], eax
mov byte [esp + 0x2b], 1
mov word [esi + 6], cx
test dl, dl
sete al
mov byte [esi + 0xc], al
mov eax, dword [0x4a0b68]
mov byte [esp + 0xd], 0
cmp dword [ebp + 8], eax
jne 0x404ae8
cmp byte [esi + 4], 0
je 0x404b08
mov ecx, dword [0x4a14d8]
cmp byte [ecx + 0xb64c], 0
jne 0x404a93
cmp byte [ecx + 0xb76c], 0
jne 0x404a93
xor eax, eax
jmp 0x404a98
mov eax, 1
cmp byte [ecx + 0xb88c], 0
mov byte [ecx + 0x132c], al
jne 0x404ab4
cmp byte [ecx + 0xb9ac], 0
jne 0x404ab4
xor eax, eax
jmp 0x404ab9
mov eax, 1
cmp byte [ecx + 0xb40c], 0
mov byte [ecx + 0x144c], al
jne 0x404adb
cmp byte [ecx + 0xb52c], 0
jne 0x404adb
xor eax, eax
mov byte [ecx + 0x120c], al
jmp 0x404b0e
mov eax, 1
mov byte [ecx + 0x120c], al
jmp 0x404b0e
test eax, eax
jne 0x404b08
push 1
call fcn.00410850
mov dl, byte [ebp + 0x20]
add esp, 4
mov byte [0x4a0a36], al
mov byte [0x4a0a35], al
mov byte [esp + 0xd], 1
mov ecx, dword [0x4a14d8]
mov eax, dword [esi]
test eax, eax
je 0x404b1e
cmp dword [eax], 7
mov byte [esp + 0xf], 1
je 0x404b23
mov byte [esp + 0xf], 0
mov al, byte [esi + 8]
test al, al
je 0x404cc1
test dl, dl
jne 0x404cc1
mov edx, dword [0x49f94c]
test edx, edx
je 0x404b4e
cmp byte [esi + 9], 0
je 0x404b4e
cmp esi, edx
jne 0x404cc1
cmp al, 1
jne 0x404b7a
cmp byte [esp + 0x27], 0
mov eax, dword [esp + 0x30]
jne 0x404b61
movzx eax, byte [ebp + 0x18]
mov ecx, dword [esp + 0x27]
push ecx
push eax
call fcn.00409590
add esp, 8
test al, al
je 0x404b7a
mov byte [esp + 0xe], 1
jmp 0x404b91
mov byte [esp + 0xe], 0
cmp esi, dword [0x49f94c]
je 0x404b91
mov dword [0x49f94c], esi
mov byte [esi + 0x11], 0
cmp byte [esi + 9], 0
je 0x404c41
cmp byte [esp + 0xd], 0
jne 0x404bb1
push 1
mov byte [esp + 0x11], 1
call fcn.00410850
add esp, 4
mov al, byte [esi + 4]
mov cl, byte [0x4a0a36]
test al, al
je 0x404bc2
not al
and cl, al
test cl, cl
jne 0x404bcc
cmp byte [esp + 0xe], cl
je 0x404c41
mov edx, dword [ebp + 8]
cmp edx, dword [0x4a0b68]
jne 0x404bf4
cmp byte [esp + 0x27], 0
je 0x404bf4
movzx eax, cl
mov ecx, dword [0x4a14d0]
shl eax, 8
add eax, dword [esp + 0x30]
movzx ecx, word [ecx + eax*2]
jmp 0x404c0a
movzx eax, byte [ebp + 0x18]
movzx edx, cl
mov ecx, dword [0x4a14cc]
shl edx, 8
add edx, eax
movzx ecx, word [ecx + edx*2]
mov dword [esp + 0x10], ecx
test ecx, 0x4000
je 0x404c1c
mov word [esi + 6], cx
jmp 0x404c4f
mov edx, dword [0x49e4e0]
mov eax, ecx
and eax, 0x3fff
cmp ax, word [edx]
jae 0x404c45
mov edx, dword [0x4a14d4]
movzx eax, ax
mov ax, word [edx + eax*2]
mov word [esi + 6], ax
jmp 0x404c45
mov ecx, dword [esp + 0x10]
mov edx, 0x3fff
cmp cx, dx
jne 0x404cbb
mov al, byte [esp + 0xe]
test al, al
je 0x404c5f
or byte [esi + 0xb], 8
mov byte [edi + 4], 0x23
cmp byte [esi + 4], 0
jne 0x404c8d
test byte [esi + 0xb], 1
jne 0x404c8d
cmp byte [esp + 0xf], 0
jne 0x404c8d
test al, al
jne 0x404c8d
mov eax, dword [ebp + 0x18]
push 0
push SysReAllocString
push 0x3fff
push edi
push ebx
push eax
jmp 0x404745
push 0
push 0x3fff
push edi
push 0
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 8]
push edx
push eax
push ecx
mov ecx, dword [ebp + 0x14]
mov eax, ebx
call fcn.00406180
add esp, 0x20
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x4a14d8]
cmp byte [esi + 9], 0
mov byte [esp + 0x16], 0
je 0x404d35
cmp byte [ebp + 0x20], 0
je 0x404d35
cmp dword [0x49f94c], esi
jne 0x404ceb
cmp byte [esp + 0x15], 0
je 0x404d35
mov dword [0x49f94c], 0
cmp byte [esi + 0xa], 0
jne 0x404d30
mov al, byte [esi + 0xb]
test al, 8
je 0x404d01
xor cl, cl
and al, 0xf7
mov byte [esi + 0xb], al
jmp 0x404d03
mov cl, 1
cmp byte [esp + 0x15], 0
je 0x404e38
test cl, cl
je 0x404e38
mov edx, dword [ebp + 0x18]
push 0
push SysReAllocString
push 0x3fff
push edi
push ebx
mov bl, byte [ebp + 0x20]
push edx
jmp 0x404747
mov byte [esp + 0x16], 1
cmp byte [esi + 8], 0
je 0x404f24
cmp byte [ebp + 0x20], 0
je 0x404f24
cmp dword [0x49f94c], esi
jne 0x404d5b
mov dword [0x49f94c], 0
cmp byte [esi + 0xd], 0
je 0x404d82
push 0xffc3d44d
push 0
push 0
push 0
push 0x12
push 1
mov byte [esi + 0xd], 0
call fcn.0040e2a0
mov ecx, dword [0x4a14d8]
add esp, 0x18
cmp byte [esi + 0xe], 0
je 0x404da9
push 0xffc3d44d
push 0
push 0
push 0
push 0x10
push 1
mov byte [esi + 0xe], 0
call fcn.0040e2a0
mov ecx, dword [0x4a14d8]
add esp, 0x18
mov edx, dword [esp + 0x10]
mov eax, 0x3fff
cmp dx, ax
jne 0x404dd4
mov al, byte [esi + 0xb]
test al, 8
je 0x404dd4
mov ecx, dword [ebp + 0x20]
push 0
push 0x3fff
and al, 0xf7
push edi
mov byte [esi + 0xb], al
push ecx
jmp 0x405f3f
cmp byte [esp + 0xf], 0
mov al, byte [esi + 0x11]
je 0x404e49
cmp al, 2
jne 0x404e30
mov esi, dword [ebp + 0x18]
push 0xffc3d44e
push 0
push 0
push ebx
push esi
push 1
call fcn.0040e2a0
push 0xffc3d44d
push 0
push 0
push ebx
push esi
push 2
call fcn.0040e2a0
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 8]
push 0
push SysReAllocString
push 0x3fff
push edi
push ebx
mov bl, byte [ebp + 0x20]
push esi
call fcn.00406090
add esp, 0x48
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp al, 1
jne 0x404ec7
push 0
mov eax, dword [ebp + 0x20]
push 0x3fff
push edi
push eax
jmp 0x404c97
test al, al
je 0x404ec7
mov ecx, 0x3fff
cmp dx, cx
jne 0x404ec1
cmp byte [esi + 4], 0
je 0x404e91
cmp al, 2
jne 0x404878
mov edx, dword [ebp + 0x20]
mov eax, dword [ebp + 0x18]
push 1
push ecx
mov ecx, dword [ebp + 0x10]
push edi
push edx
mov edx, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push ecx
mov ecx, dword [ebp + 0x14]
push edx
push eax
mov eax, ebx
call fcn.00406180
add esp, 0x20
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test byte [esi + 0xb], 1
push 0
jne 0x404e3a
push SysReAllocString
push 0x3fff
push edi
push ebx
mov edx, dword [ebp + 0x18]
push edx
mov bl, byte [ebp + 0x20]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x14]
call fcn.00406090
add esp, 0x18
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x4a14d8]
cmp byte [esi + 9], 0
jne 0x404f06
cmp byte [esi + 4], 0
jne 0x404878
test byte [esi + 0xb], 1
jne 0x404878
cmp byte [esp + 0xf], 0
jne 0x404878
mov eax, dword [ebp + 0x18]
push 0
push SysReAllocString
push 0x3fff
push edi
push ebx
mov bl, byte [ebp + 0x20]
push eax
jmp 0x404747
cmp byte [esp + 0x17], 0
jne 0x404f28
cmp byte [esi + 0xa], 0
jne 0x404f28
mov eax, dword [ebp + 0x20]
push 0
push 0x3fff
push edi
push eax
jmp 0x404c97
mov edx, dword [esp + 0x10]
cmp byte [esp + 0xd], 0
jne 0x404f4d
mov eax, 0x3fff
cmp dx, ax
jne 0x404f4d
push 1
call fcn.00410850
mov edx, dword [esp + 0x14]
mov ecx, dword [0x4a14d8]
add esp, 4
cmp dword [0x49f94c], 0
mov byte [esp + 0xe], 0
je 0x405608
cmp byte [ebp + 0x20], 0
je 0x404f73
mov eax, dword [esp + 0x18]
cmp byte [eax + 0xa], 0
je 0x405608
mov eax, 0x3fff
cmp dx, ax
jne 0x40585c
mov edi, dword [esp + 0x18]
cmp byte [edi + 0x13], 0
mov dword [esp + 0x2c], 0
jbe 0x40501e
mov ebx, dword [0x4a14d8]
lea esi, [edi + 0x16]
mov cl, byte [esi]
movzx eax, cl
lea eax, [eax + eax*8]
shl eax, 5
cmp byte [eax + ebx + 0xc], 0
je 0x404fec
movzx eax, word [esi + 2]
test eax, 0x4000
je 0x404fda
cmp byte [ebp + 0x20], 0
jne 0x405002
mov ecx, 0x3fff
mov word [edi + 6], ax
cmp dx, cx
je 0x404fec
mov dword [esp + 0x10], edx
jmp 0x4050c0
cmp byte [ebp + 0x20], 0
mov ebx, dword [0x4a14d8]
jne 0x404fec
mov edx, eax
mov byte [esp + 0xd], cl
mov eax, dword [esp + 0x2c]
movzx ecx, byte [edi + 0x13]
inc eax
add esi, 4
mov dword [esp + 0x2c], eax
cmp eax, ecx
jl 0x404fa0
jmp 0x40500c
mov al, byte [esi]
movzx edx, word [esi + 2]
mov byte [esp + 0xd], al
mov ecx, 0x3fff
mov dword [esp + 0x10], edx
cmp dx, cx
jne 0x4050ba
cmp byte [edi + 0x14], 0
mov dword [esp + 0x2c], 0
jbe 0x4050a1
lea esi, [edi + 0xde]
movzx ecx, word [esi]
mov ebx, dword [0x4a14dc]
mov eax, ecx
lea eax, [eax + eax*8]
shl eax, 5
cmp byte [eax + ebx + 0xc], 0
je 0x405141
movzx eax, word [esi + 2]
test eax, 0x4000
je 0x405133
cmp byte [ebp + 0x20], 0
jne 0x40515b
mov ecx, 0x3fff
mov word [edi + 6], ax
cmp dx, cx
je 0x405141
mov dword [esp + 0x10], edx
movzx eax, word [esp + 0x38]
lea eax, [eax + eax*8]
shl eax, 5
add eax, dword [0x4a14dc]
mov dword [0x49f94c], eax
mov eax, 0x3fff
cmp dx, ax
jne case.default.0x4050b3
movzx eax, byte [ebp + 0x18]
add eax, 0xffffff60
cmp eax, 5
ja case.default.0x4050b3
jmp dword [eax*4 + 0x406058]
mov ebx, dword [0x4a14d8]
movzx ecx, byte [esp + 0xd]
mov eax, ecx
sub eax, 0x10
je 0x405117
dec eax
je 0x4050fb
dec eax
je 0x4050e2
lea ecx, [ecx + ecx*8]
shl ecx, 5
add ecx, ebx
mov dword [0x49f94c], ecx
jmp 0x405093
xor eax, eax
cmp byte [ebx + 0xb9ac], al
setne al
lea eax, [eax + eax*8 + 0x5c4]
shl eax, 5
add eax, ebx
jmp 0x40508e
xor eax, eax
cmp byte [ebx + 0xb76c], al
setne al
lea eax, [eax + eax*8 + 0x5b2]
shl eax, 5
add eax, ebx
jmp 0x40508e
xor eax, eax
cmp byte [ebx + 0xb52c], al
setne al
lea eax, [eax + eax*8 + 0x5a0]
shl eax, 5
add eax, ebx
jmp 0x40508e
cmp byte [ebp + 0x20], 0
jne 0x405141
mov edx, eax
mov eax, ecx
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x2c]
movzx ecx, byte [edi + 0x14]
inc eax
add esi, 4
mov dword [esp + 0x2c], eax
cmp eax, ecx
jl 0x405032
jmp 0x405166
movzx eax, word [esi]
movzx edx, word [esi + 2]
mov dword [esp + 0x38], eax
mov ecx, 0x3fff
mov dword [esp + 0x10], edx
cmp dx, cx
je 0x4050a1
jmp 0x40507d
mov al, 0x11
jmp 0x405187
mov al, 0x12
jmp 0x405187
mov al, 0x10
mov ebx, dword [0x4a14d8]
movzx eax, al
lea ecx, [eax + eax*8]
shl ecx, 5
movzx eax, byte [ecx + ebx + 0x13]
lea esi, [ecx + ebx]
xor edi, edi
mov dword [esp + 0x34], esi
mov dword [esp + 0x2c], eax
test eax, eax
jle 0x405251
add esi, 0x16
mov cl, byte [esi]
movzx eax, cl
lea eax, [eax + eax*8]
shl eax, 5
cmp byte [eax + ebx + 0xc], 0
je 0x40522f
movzx eax, word [esi + 2]
test eax, 0x4000
je 0x40521d
cmp byte [ebp + 0x20], 0
jne 0x40523f
mov ecx, dword [esp + 0x18]
mov word [ecx + 6], ax
mov eax, 0x3fff
cmp dx, ax
je 0x40522f
mov dword [esp + 0x10], edx
movzx ecx, byte [esp + 0xd]
mov eax, ecx
sub eax, 0x10
je 0x405391
dec eax
je 0x405375
dec eax
je 0x405359
lea ecx, [ecx + ecx*8]
shl ecx, 5
add ecx, ebx
mov dword [0x49f94c], ecx
jmp case.default.0x4050b3
cmp byte [ebp + 0x20], 0
mov ebx, dword [0x4a14d8]
jne 0x40522f
mov edx, eax
mov byte [esp + 0xd], cl
inc edi
add esi, 4
cmp edi, dword [esp + 0x2c]
jl 0x4051b3
jmp 0x405249
mov cl, byte [esi]
movzx edx, word [esi + 2]
mov byte [esp + 0xd], cl
mov esi, dword [esp + 0x34]
mov dword [esp + 0x10], edx
mov eax, 0x3fff
cmp dx, ax
jne 0x4051ec
movzx eax, byte [esi + 0x14]
xor edi, edi
mov dword [esp + 0x2c], eax
test eax, eax
jle case.default.0x4050b3
add esi, 0xde
nop
movzx ecx, word [esi]
mov ebx, dword [0x4a14dc]
mov eax, ecx
lea eax, [eax + eax*8]
shl eax, 5
cmp byte [eax + ebx + 0xc], 0
je 0x4053b9
movzx eax, word [esi + 2]
test eax, 0x4000
je 0x4053ad
cmp byte [ebp + 0x20], 0
jne 0x4053c9
mov ecx, dword [esp + 0x18]
mov word [ecx + 6], ax
mov eax, 0x3fff
cmp dx, ax
je 0x4053b9
mov dword [esp + 0x10], edx
movzx eax, word [esp + 0x38]
lea eax, [eax + eax*8]
shl eax, 5
add eax, dword [0x4a14dc]
mov dword [0x49f94c], eax
mov eax, edx
and eax, 0x3fff
mov ecx, 0x3fff
mov esi, eax
cmp dx, cx
je 0x405402
mov eax, dword [0x49e4e0]
cmp si, word [eax]
jae 0x4053f9
mov edi, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov esi, dword [ebp + 0x20]
lea eax, [edi + 4]
push eax
lea ecx, [esp + 0x12]
push ecx
add edx, 0xb
push edx
lea eax, [esp + 0x1c]
push esi
push eax
call fcn.004097f0
add esp, 0x14
mov dword [esp + 0x3c], eax
test eax, eax
jne 0x4053eb
push eax
push 0x3fff
push edi
push esi
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 8]
push edx
push eax
push ecx
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x14]
call fcn.00406180
add esp, 0x20
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
cmp byte [ebx + 0xb9ac], al
setne al
lea eax, [eax + eax*8 + 0x5c4]
shl eax, 5
add eax, ebx
jmp 0x4052d0
xor eax, eax
cmp byte [ebx + 0xb76c], al
setne al
lea eax, [eax + eax*8 + 0x5b2]
shl eax, 5
add eax, ebx
jmp 0x4052d0
xor eax, eax
cmp byte [ebx + 0xb52c], al
setne al
lea eax, [eax + eax*8 + 0x5a0]
shl eax, 5
add eax, ebx
jmp 0x4052d0
cmp byte [ebp + 0x20], 0
jne 0x4053b9
mov edx, eax
mov dword [esp + 0x38], ecx
inc edi
add esi, 4
cmp edi, dword [esp + 0x2c]
jl 0x405270
jmp 0x4053d4
movzx eax, word [esi]
movzx edx, word [esi + 2]
mov dword [esp + 0x38], eax
mov ecx, 0x3fff
mov dword [esp + 0x10], edx
cmp dx, cx
je case.default.0x4050b3
jmp 0x4052bf
mov esi, dword [esp + 0x10]
mov edx, dword [esp + 0x10]
and esi, 0x3fff
mov eax, dword [0x49f94c]
mov byte [eax + 0x11], 2
mov ecx, 0x3ffe
cmp si, cx
je 0x40541a
mov eax, 0x3ffd
cmp si, ax
jne 0x405608
cmp byte [ebp + 0x20], 0
jne 0x405428
mov ecx, dword [esp + 0x18]
mov byte [ecx + 0xf], 1
test byte [0x4a0a35], 0xc
jne 0x405448
push 0xffc3d44d
push 0
push 0
push 0
push 0x12
push 0
call fcn.0040e2a0
add esp, 0x18
mov al, byte [ebp + 0x18]
cmp al, 0xa2
je 0x405453
cmp al, 0xa3
jne 0x405474
cmp byte [ebp + 0x20], 0
jne 0x405474
mov edx, dword [ebp + 0x1c]
mov eax, dword [ebp + 0x18]
push 0xffc3d44d
push 0
push 0
push edx
push eax
push 1
call fcn.0040e2a0
add esp, 0x18
mov ecx, dword [0x49f94c]
mov edx, 0x3ffd
mov byte [ecx + 0xd], 1
cmp si, dx
jne 0x4054b6
test byte [0x4a0a35], 0x30
jne 0x4054a8
push 0xffc3d44d
push 0
push 0
push 0
push 0x10
push 0
call fcn.0040e2a0
add esp, 0x18
mov eax, dword [0x49f94c]
mov byte [eax + 0xe], 1
jmp 0x405532
mov ecx, 0x3ffe
cmp si, cx
jne 0x405532
mov al, byte [ebp + 0x18]
cmp al, 0xa0
je 0x4054cb
cmp al, 0xa1
jne 0x4054ec
cmp byte [ebp + 0x20], 0
jne 0x4054ec
mov edx, dword [ebp + 0x1c]
mov eax, dword [ebp + 0x18]
push 0xffc3d44d
push 0
push 0
push edx
push eax
push 1
call fcn.0040e2a0
add esp, 0x18
test byte [0x4a0a35], 0x10
je 0x40550f
push 0xffc3d44d
push 0
push 0
push 0
push 0xa0
push 1
call fcn.0040e2a0
add esp, 0x18
test byte [0x4a0a35], 0x20
je 0x405532
push 0xffc3d44d
push 0
push 0
push 0
push 0xa1
push 1
call fcn.0040e2a0
add esp, 0x18
test byte [0x4a0a35], 1
je 0x405555
push 0xffc3d44d
push 0
push 0
push 0
push 0xa2
push 1
call fcn.0040e2a0
add esp, 0x18
test byte [0x4a0a35], 2
je 0x405578
push 0xffc3d44d
push 0
push 0
push 0
push 0xa3
push 1
call fcn.0040e2a0
add esp, 0x18
push 0xffc3d44d
push 0
push 0
push 0
push 9
push 2
call fcn.0040e2a0
mov ecx, 0x3ffd
add esp, 0x18
cmp si, cx
jne 0x4055d4
mov edx, dword [0x49f94c]
cmp byte [edx + 0xe], 0
je 0x4055d4
mov al, byte [ebp + 0x18]
cmp al, 0x60
jb 0x4055b0
cmp al, 0x69
jbe 0x4055b4
cmp al, 0x6e
jne 0x4055d4
push 0xffc3d44d
push 0
push 0
push 0
push 0x10
push 1
call fcn.0040e2a0
mov eax, dword [0x49f94c]
add esp, 0x18
mov byte [eax + 0xe], 0
cmp byte [ebp + 0x20], 0
mov eax, dword [esp + 0x1c]
mov byte [eax + 4], 0x68
jne 0x4055ea
mov ecx, dword [esp + 0x18]
mov byte [ecx + 0x10], 1
mov edx, dword [esp + 0x1c]
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
push 0
push SysReAllocString
push 0x3fff
push edx
push eax
push ecx
jmp 0x404ea9
mov eax, 0x3fff
cmp dx, ax
jne 0x405856
mov esi, dword [esp + 0x18]
mov cl, byte [esi + 4]
mov al, byte [0x4a0a36]
test cl, cl
je 0x40562c
mov dl, cl
not dl
and al, dl
mov edi, dword [ebp + 8]
cmp edi, dword [0x4a0b68]
jne 0x405650
cmp byte [esp + 0x27], 0
je 0x405650
mov ebx, dword [0x4a14d0]
movzx edx, al
shl edx, 8
add edx, dword [esp + 0x30]
jmp 0x405662
movzx ebx, byte [ebp + 0x18]
movzx edx, al
shl edx, 8
add edx, ebx
mov ebx, dword [0x4a14cc]
movzx edx, word [ebx + edx*2]
mov ebx, 0x3fff
mov dword [esp + 0x10], edx
cmp dx, bx
jne 0x4056e5
cmp byte [0x49f951], 0
je 0x4056e5
mov bl, byte [ebp + 0x18]
cmp bl, 9
je 0x4056e5
and al, 0xf3
cmp edi, dword [0x4a0b68]
jne 0x4056a8
cmp byte [esp + 0x27], 0
je 0x4056a8
mov edx, dword [0x4a14d0]
movzx eax, al
shl eax, 8
add eax, dword [esp + 0x30]
jmp 0x4056b9
movzx eax, al
movzx edx, bl
shl eax, 8
add eax, edx
mov edx, dword [0x4a14cc]
movzx edx, word [edx + eax*2]
mov eax, edx
and eax, 0x3fff
mov ebx, 0x3ff9
mov dword [esp + 0x10], edx
cmp ax, bx
jbe 0x4056dc
mov ebx, 0x3fff
cmp ax, bx
jb 0x4056e5
mov edx, 0x3fff
mov dword [esp + 0x10], edx
test edx, 0x4000
je 0x40571f
cmp byte [ebp + 0x20], 0
jne 0x405779
mov word [esi + 6], dx
lea eax, [esi + 6]
mov ecx, 0x3fff
push 0
cmp word [eax], cx
jne 0x405808
mov edx, dword [esp + 0x20]
push 0x3fff
push edx
push 0
jmp 0x4057e6
mov eax, 0x3fff
cmp dx, ax
je 0x405787
mov ebx, dword [0x49e4e0]
mov eax, edx
and eax, 0x3fff
cmp byte [ebp + 0x20], 0
je 0x405766
cmp ax, word [ebx]
jae 0x40575d
mov ebx, dword [0x4a14d4]
movzx eax, word [ebx + eax*2]
mov ebx, 0x3fff
cmp ax, bx
je 0x40575d
mov edx, eax
mov dword [esp + 0x10], edx
jmp 0x405779
cmp byte [esp + 0x16], 0
jne 0x405787
jmp 0x405779
cmp ax, word [ebx]
jae 0x405779
mov ebx, dword [0x4a14d4]
mov ax, word [ebx + eax*2]
mov word [esi + 6], ax
mov eax, 0x3fff
cmp dx, ax
jne 0x405856
cmp byte [ebp + 0x20], 0
je 0x4056fb
test cl, cl
jne 0x4057d6
test byte [esi + 0xb], 1
jne 0x4057d6
cmp byte [esi + 8], cl
je 0x4057d6
cmp byte [esp + 0xf], cl
jne 0x4057d6
mov ecx, dword [esp + 0x1c]
mov edx, dword [ebp + 0x1c]
mov eax, dword [ebp + 0x18]
mov bl, byte [ebp + 0x20]
push 0
push SysReAllocString
push 0x3fff
push ecx
mov ecx, dword [ebp + 0x14]
push edx
push eax
mov eax, edi
call fcn.00406090
add esp, 0x18
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x1c]
mov edx, dword [ebp + 0x20]
push 0
push 0x3fff
push ecx
push edx
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push eax
push ecx
push edx
push edi
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x14]
call fcn.00406180
add esp, 0x20
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [esp + 0x12]
push ecx
add esi, 0xb
push esi
push 1
push eax
call fcn.004097f0
add esp, 0x14
cmp byte [esp + 0xe], 0
push 0
jne 0x40570e
mov eax, dword [esp + 0x20]
mov ecx, dword [ebp + 0x1c]
mov edx, dword [ebp + 0x18]
push SysReAllocString
push 0x3fff
push eax
push ecx
mov ecx, dword [ebp + 0x14]
push edx
xor bl, bl
mov eax, edi
call fcn.00406090
add esp, 0x18
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x4a14d8]
mov esi, dword [esp + 0x18]
mov al, byte [esi + 0xb]
add esi, 0xb
mov dword [esp + 0x34], esi
test al, 8
je 0x40587d
cmp byte [ebp + 0x20], 0
je 0x40587d
and al, 0xf7
mov byte [esp + 0xe], 1
mov byte [esi], al
mov edi, dword [0x49e4e0]
mov ebx, dword [esp + 0x1c]
mov eax, edx
and eax, 0x3fff
cmp ax, word [edi]
jae 0x4058e4
cmp dword [esp + 0x3c], 0
jne 0x4058e4
mov edi, dword [ebp + 0x20]
lea eax, [ebx + 4]
push eax
lea ecx, [esp + 0x12]
push ecx
push esi
lea edx, [esp + 0x1c]
push edi
push edx
call fcn.004097f0
add esp, 0x14
mov dword [esp + 0x3c], eax
test eax, eax
jne 0x4058da
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x18]
push 0x3fff
push ebx
push edi
push eax
mov eax, dword [ebp + 8]
push ecx
push edx
push eax
jmp 0x4057f3
mov edx, dword [esp + 0x10]
mov ecx, dword [0x4a14d8]
mov edi, dword [ebp + 8]
mov eax, dword [0x4a0b68]
and edx, 0x3fff
mov esi, edx
cmp edi, eax
jne 0x405955
test byte [0x4a0a35], 0x3f
jne 0x405933
test byte [0x4a0a35], 0x40
je 0x40591a
cmp byte [ecx + 0x6668], 0
jne 0x40591a
mov byte [0x49f955], 1
test byte [0x4a0a35], 0x80
je 0x405933
cmp byte [ecx + 0x6788], 0
jne 0x405933
mov byte [0x49f954], 1
test byte [0x4a0a35], 4
je 0x40598e
cmp byte [ecx + 0xb888], 0
jne 0x40598e
test eax, eax
je 0x405979
mov byte [0x49f953], 1
jmp 0x4059d8
test byte [0x4a0a35], 0xc
jne 0x405933
test byte [0x4a0a35], 0x40
je 0x40591a
cmp byte [ecx + 0x6668], 0
jne 0x40591a
mov byte [0x49f955], 1
jmp 0x405933
movzx ecx, byte [0x49d2f9]
push 0xffc3d44d
push 0
push 0
push 0
push ecx
jmp 0x4059ce
test byte [0x4a0a35], 8
je 0x4059d8
cmp byte [ecx + 0xb9a8], 0
jne 0x4059d8
call fcn.00410d10
test al, al
jne 0x4059d8
cmp dword [0x4a0b68], 0
je 0x4059bb
mov byte [0x49f952], 1
jmp 0x4059d8
movzx edx, byte [0x49d2f9]
push 0xffc3d44d
push 0
push 0
push 0
push edx
push 2
call fcn.0040e2a0
add esp, 0x18
movzx eax, si
lea ecx, [eax - 0x3ffa]
cmp ecx, 4
ja case.default.0x4059ea
jmp dword [ecx*4 + 0x406070]
cmp byte [0x49f951], 0
jne case.0x4059ea.16379
mov eax, dword [ebp + 0x20]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x10]
push 0
push 0x3fff
push ebx
push eax
mov eax, dword [ebp + 0xc]
push ecx
push edx
push eax
jmp 0x4057f2
mov cl, byte [0x4a0a35]
xor al, al
mov byte [esp + 0xd], al
test cl, 4
je 0x405a2c
mov al, 0xa4
jmp 0x405a33
test cl, 8
je 0x405a37
mov al, 0xa5
mov byte [esp + 0xd], al
cmp byte [0x49f951], 0
je 0x405aad
mov ecx, 0x3ffb
cmp si, cx
je case.0x4059ea.16381
test al, al
movzx eax, al
jne 0x405a5a
mov eax, 0x12
push 0xffc3d44d
push 0
push 0
push 0
push eax
push 1
call fcn.0040e2a0
mov edx, dword [esp + 0x30]
add esp, 0x18
cmp byte [edx + 4], 0
je 0x405aa1
mov eax, dword [ebp + 0x18]
cmp al, 0x5b
je 0x405aa1
cmp al, 0x5c
je 0x405aa1
cmp byte [ebp + 0x20], 0
jne 0x405aa1
push 0xffc3d44d
push 0
push 0
push 0
push eax
push 1
call fcn.0040e2a0
add esp, 0x18
mov byte [0x49f951], 0
jmp 0x405d0e
mov al, byte [ebp + 0x18]
cmp al, 0xa4
je 0x405abd
mov byte [esp + 0x15], 0
cmp al, 0xa5
jne 0x405ac2
mov byte [esp + 0x15], 1
cmp al, 0xa0
je 0x405ace
cmp al, 0xa1
je 0x405ace
xor dl, dl
jmp 0x405ad0
mov dl, 1
mov byte [esp + 0x17], dl
cmp al, 0xa2
je 0x405ae1
mov byte [esp + 0x16], 0
cmp al, 0xa3
jne 0x405ae6
mov byte [esp + 0x16], 1
mov bl, byte [0x4a0a35]
xor cl, cl
mov byte [esp + 0x30], cl
test bl, 0x10
je 0x405aff
mov cl, 0xa0
mov byte [esp + 0x30], cl
jmp 0x405b22
test bl, 0x20
je 0x405b0c
mov cl, 0xa1
mov byte [esp + 0x30], cl
jmp 0x405b22
cmp byte [ebp + 0x20], 0
jne 0x405b1c
test dl, dl
je 0x405b1c
mov cl, al
mov byte [esp + 0x30], cl
mov bl, byte [0x4a0a35]
mov byte [esp + 0x27], 0
test bl, 1
je 0x405b33
mov byte [esp + 0x27], 0xa2
jmp 0x405b50
test bl, 2
je 0x405b3f
mov byte [esp + 0x27], 0xa3
jmp 0x405b50
cmp byte [ebp + 0x20], 0
jne 0x405b50
cmp byte [esp + 0x16], 0
je 0x405b50
mov byte [esp + 0x27], al
mov edi, dword [esp + 0x30]
xor bl, bl
test cl, cl
je 0x405b72
push 0xffc3d44d
push 0
push 0
push 0
push edi
push 1
call fcn.0040e2a0
add esp, 0x18
mov bl, 1
cmp byte [esp + 0x27], 0
je 0x405b93
mov eax, dword [esp + 0x27]
push 0xffc3d44d
push 0
push 0
push 0
push eax
push 1
call fcn.0040e2a0
add esp, 0x18
cmp byte [esp + 0x15], 0
je 0x405ba5
cmp byte [ebp + 0x20], 0
jne 0x405bad
mov al, byte [ebp + 0x18]
jmp 0x405ba9
mov al, byte [esp + 0xd]
test al, al
jne 0x405bc4
push 0xffc3d44d
push 0
push 0
push 0
push 0x12
push 0
call fcn.0040e2a0
add esp, 0x18
push 0xffc3d44d
push 0
push 0
push 0
push 9
push 2
call fcn.0040e2a0
add esp, 0x18
test bl, bl
je 0x405bfc
cmp byte [esp + 0x17], 0
jne 0x405bfc
push 0xffc3d44d
push 0
push 0
push 0
push edi
push 0
call fcn.0040e2a0
add esp, 0x18
mov byte [0x49f951], 1
jmp 0x405d0e
cmp byte [0x49f951], 0
jne 0x405c2e
mov ecx, dword [ebp + 0x20]
mov edx, dword [ebp + 0x18]
mov eax, dword [ebp + 0x10]
push 0
push 0x3fff
push ebx
push ecx
mov ecx, dword [ebp + 0xc]
push edx
push eax
push ecx
jmp 0x4057f2
cmp byte [ebp + 0x20], 0
mov al, byte [ebp + 0x18]
jne 0x405c63
cmp al, 0xa2
je 0x405c47
cmp al, 0xa3
je 0x405c47
cmp al, 0xa0
je 0x405c47
cmp al, 0xa1
jne 0x405c63
mov edx, dword [ebp + 0x18]
push 0xffc3d44d
push 0
push 0
push 0
push edx
push 1
call fcn.0040e2a0
mov al, byte [ebp + 0x18]
add esp, 0x18
test byte [0x4a0a35], 0xc
je 0x405c7a
cmp byte [ebp + 0x20], 0
je 0x405c91
cmp al, 0xa4
je 0x405c7a
cmp al, 0xa5
jne 0x405c91
push 0xffc3d44d
push 0
push 0
push 0
push 0x12
push 0
call fcn.0040e2a0
add esp, 0x18
mov eax, 0x3ffd
xor bl, bl
cmp si, ax
jne 0x405cbf
test byte [0x4a0a35], 0x30
jne 0x405cbf
push 0xffc3d44d
push 0
push 0
push 0
push 0x10
push 0
call fcn.0040e2a0
add esp, 0x18
mov bl, 1
push 0xffc3d44d
push 0
push 0
push 0
push 9
push 2
call fcn.0040e2a0
add esp, 0x18
test bl, bl
je 0x405d0e
push 0xffc3d44d
push 0
push 0
push 0
push 0x10
push 1
call fcn.0040e2a0
add esp, 0x18
jmp 0x405d0e
mov ecx, dword [esp + 0x3c]
cmp byte [ecx + 0x1e], 5
mov dword [esp + 0x20], eax
jne 0x405d0e
mov edx, ecx
movzx eax, word [edx + 0x1c]
shl eax, 0x10
or dword [esp + 0x20], eax
cmp byte [esp + 0xf], 0
mov edi, dword [esp + 0x1c]
mov ebx, dword [ebp + 0x20]
mov byte [edi + 4], 0x68
je 0x405d83
test bl, bl
je 0x405e6b
mov ecx, dword [esp + 0x18]
cmp byte [ecx + 8], 0
je 0x405d83
mov ebx, dword [ebp + 0x1c]
mov esi, dword [ebp + 0x18]
push 0xffc3d44e
push 0
push 0
push ebx
push esi
push 1
call fcn.0040e2a0
push 0xffc3d44d
push 0
push 0
push ebx
push esi
push 2
call fcn.0040e2a0
mov edx, dword [esp + 0x50]
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 8]
push 0
push SysReAllocString
push edx
push edi
push ebx
mov bl, byte [ebp + 0x20]
push esi
call fcn.00406090
add esp, 0x48
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test bl, bl
je 0x405e6b
mov ecx, dword [esp + 0x18]
cmp byte [ecx + 4], 0
je 0x405dc2
cmp byte [ecx + 0x10], 0
mov eax, dword [esp + 0x20]
je 0x405db8
mov ecx, dword [ebp + 0x1c]
mov edx, dword [ebp + 0x18]
mov bl, byte [ebp + 0x20]
push 0
push SysReAllocString
push eax
push edi
push ecx
push edx
jmp 0x404747
push 1
push eax
push edi
push ebx
jmp 0x405334
cmp byte [esp + 0xe], 0
jne 0x405dd6
mov edx, dword [esp + 0x34]
test byte [edx], 1
je 0x405f09
mov esi, dword [ebp + 8]
cmp esi, dword [0x4a0b6c]
jne 0x405dfc
mov eax, dword [esp + 0x20]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x10]
push 0
push eax
mov eax, dword [ebp + 0xc]
push edi
push ebx
push ecx
push edx
push eax
push esi
jmp 0x405344
mov eax, dword [ecx]
test eax, eax
je 0x405e0b
cmp dword [eax], 7
je 0x405e0b
mov al, 1
jmp 0x405e0d
xor al, al
cmp byte [ecx + 0x10], 0
je 0x405e3b
cmp byte [esp + 0x2b], 0
jne 0x405e3b
test al, al
jne 0x405e3f
mov ecx, dword [ebp + 0x1c]
mov edx, dword [ebp + 0x18]
push 0xffc3d44d
push 0
push 0
push ecx
push edx
push 0
call fcn.0040e2a0
add esp, 0x18
jmp 0x405de1
test al, al
je 0x405de1
mov eax, dword [esp + 0x20]
mov ecx, dword [ebp + 0x1c]
mov edx, dword [ebp + 0x18]
mov bl, byte [ebp + 0x20]
push 0
push SysReAllocString
push eax
push edi
push ecx
mov ecx, dword [ebp + 0x14]
push edx
mov eax, esi
call fcn.00406090
add esp, 0x18
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x49f94c]
mov ecx, dword [esp + 0x18]
mov byte [ecx + 0xf], 1
test eax, eax
je 0x405e86
cmp byte [eax + 4], 0
je 0x405e86
mov byte [eax + 0x11], 2
cmp byte [esp + 0xe], 0
je 0x405eb2
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x34]
or byte [eax], 8
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x10]
push 0
push edx
mov edx, dword [ebp + 0xc]
push edi
push ebx
push eax
mov eax, dword [ebp + 8]
push ecx
push edx
push eax
jmp 0x405344
mov eax, dword [ebp + 0x18]
cmp al, 0xa4
je 0x405ebd
cmp al, 0xa5
jne 0x405f05
mov cl, byte [0x4a0a35]
test cl, 0xc0
je 0x405eed
test cl, 0x33
jne 0x405eed
movzx ecx, byte [0x49d2f9]
push 0xffc3d44d
push 0
push 0
push 0
push ecx
push 2
call fcn.0040e2a0
mov eax, dword [ebp + 0x18]
add esp, 0x18
mov edx, dword [ebp + 0x1c]
push 0xffc3d44d
push 0
push 0
push edx
push eax
push 1
call fcn.0040e2a0
add esp, 0x18
mov ecx, dword [esp + 0x18]
test bl, bl
jne 0x405f11
mov byte [ecx + 0x10], 1
mov eax, dword [esp + 0x20]
mov ecx, dword [ebp + 0x1c]
push 0
push SysReAllocString
push eax
push edi
push ecx
jmp 0x404ea5
mov eax, dword [ebp + 0x20]
push 0
push 0x3fff
test al, al
sete cl
push edi
mov byte [esi + 0xf], 0
mov byte [esi + 0xc], cl
push eax
mov edx, dword [ebp + 0x18]
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push edx
mov edx, dword [ebp + 8]
push eax
push ecx
mov ecx, dword [ebp + 0x14]
push edx
mov eax, ebx
call fcn.00406180
add esp, 0x20
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret