Function at 0x402960
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x850
push ebx
mov ebx, dword [sym.imp.user32.dll_GetAsyncKeyState]
push ebp
mov ebp, dword [esp + 0x884]
push esi
push edi
mov edi, dword [esp + 0x888]
mov esi, ecx
xor eax, eax
cmp edi, eax
mov dword [esp + 0x1c], eax
jne 0x40298f
mov dword [0x46759c], eax
push 0x11
call ebx
test ax, ax
jge 0x4029a5
push 0x7b
call ebx
test ax, ax
jl 0x403604
cmp edi, dword [esi + 0x14]
jae 0x403611
mov edi, dword [esp + 0x868]
mov eax, dword [esp + 0x864]
mov ecx, dword [esi + 0x10]
push 0x4675a0
push edi
push ebp
push eax
push ecx
call fcn.00429130
add esp, 0x14
test eax, eax
je 0x403611
cmp dword [0x4675a0], edi
jne 0x403611
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x868]
lea edx, [edi + 2]
cmp edx, eax
jae 0x403611
push 0
push 1
push 0x4675cc
push ebp
mov dword [0x4675cc], edi
call fcn.004025e0
add esp, 0x10
mov dword [0x4675ac], eax
test eax, eax
jne 0x402a22
inc edi
mov dword [esp + 0x1c], edi
jmp 0x4029e4
mov edx, dword [0x4675cc]
inc edx
mov dword [0x4675cc], edx
mov ecx, dword [eax + 8]
test ch, 0x40
jne 0x403620
mov eax, dword [eax]
push 0x460d24
push eax
call fcn.004348b0
add esp, 8
test eax, eax
jne 0x402b84
mov eax, dword [esi + 0x70]
test eax, eax
je 0x402b84
mov ecx, dword [esi + 0x60]
mov eax, dword [esi + 0x58]
lea edi, [esi + 0x58]
cmp ecx, eax
jne 0x402af6
mov eax, dword [esi + 0x64]
lea edx, [eax - 4]
mov dword [esi + 0x64], edx
mov eax, dword [eax]
push eax
call fcn.0044275b
mov eax, dword [esi + 0x70]
add esp, 4
test eax, eax
jne 0x402ace
mov eax, dword [esi + 0x54]
mov ecx, dword [esi + 0x64]
cmp eax, ecx
jne 0x402a9f
mov ecx, dword [eax]
push ecx
call fcn.0044275b
add esp, 4
lea ebx, [esi + 0x48]
xor eax, eax
xor ecx, ecx
xor edx, edx
mov dword [ebx], eax
mov dword [ebx + 4], ecx
mov dword [ebx + 8], edx
mov dword [ebx + 0xc], edx
mov ebx, edi
mov dword [ebx], eax
mov dword [ebx + 4], ecx
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], edx
mov edx, dword [esi + 0x68]
push edx
call fcn.0044275b
add esp, 4
jmp 0x402af6
mov eax, dword [esi + 0x64]
mov ebx, edi
mov edx, dword [eax]
mov dword [ebx], edx
lea ecx, [edx + 0x1000]
mov dword [esp + 0x54], ecx
mov ecx, edx
mov edx, dword [esp + 0x54]
add ecx, 0x1000
mov dword [ebx + 4], edx
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0x70]
test eax, eax
je 0x402b01
add dword [esi + 0x60], 0xfffffffc
dec eax
test eax, eax
mov dword [esi + 0x70], eax
jne 0x402b84
mov eax, dword [esi + 0x64]
lea ecx, [eax - 4]
mov dword [esi + 0x64], ecx
mov edx, dword [eax]
push edx
call fcn.0044275b
mov eax, dword [esi + 0x70]
add esp, 4
test eax, eax
jne 0x402b66
mov eax, dword [esi + 0x54]
mov ecx, dword [esi + 0x64]
cmp eax, ecx
jne 0x402b39
mov eax, dword [eax]
push eax
call fcn.0044275b
add esp, 4
lea ebx, [esi + 0x48]
xor eax, eax
xor ecx, ecx
xor edx, edx
mov dword [ebx], eax
mov dword [edi], eax
mov dword [edi + 4], ecx
mov dword [edi + 8], eax
mov dword [ebx + 4], ecx
mov ecx, dword [esi + 0x68]
push ecx
mov dword [edi + 0xc], edx
mov dword [ebx + 8], edx
mov dword [ebx + 0xc], edx
call fcn.0044275b
add esp, 4
jmp 0x402b84
mov eax, dword [esi + 0x64]
mov edx, dword [eax]
mov ecx, edx
mov dword [edi], edx
lea ebx, [edx + 0x1000]
add ecx, 0x1000
mov dword [edi + 4], ebx
mov dword [edi + 8], ecx
mov dword [edi + 0xc], eax
mov edx, dword [0x4675ac]
push str.push
mov eax, dword [edx]
push eax
call fcn.004348b0
add esp, 8
test eax, eax
je 0x402c6c
mov eax, dword [0x4675ac]
mov ecx, dword [eax + 8]
test ch, 0x16
je 0x402bde
mov edi, 1
push edi
push ecx
mov ecx, dword [0x4675cc]
mov dl, byte [ecx + ebp + 1]
mov cl, byte [ecx + ebp]
push edx
mov edx, dword [eax + 0xc]
push ecx
push edx
call fcn.004024c0
add esp, 0x14
test al, al
ja 0x402c71
mov eax, dword [0x4675ac]
mov ecx, dword [eax + 8]
push 1
push ecx
mov ecx, dword [0x4675cc]
mov dl, byte [ecx + ebp + 1]
mov cl, byte [ecx + ebp]
push edx
mov edx, dword [eax + 0x14]
push ecx
push edx
call fcn.004024c0
mov edi, dword [0x4675cc]
mov bl, al
mov eax, dword [0x4675ac]
push 1
mov dl, byte [edi + ebp + 1]
and ebx, 0xff
mov ecx, dword [eax + 8]
push ecx
mov cl, byte [edi + ebp]
push edx
mov edx, dword [eax + 0x10]
push ecx
push edx
call fcn.004024c0
mov edi, dword [0x4675cc]
and eax, 0xff
add ebx, eax
mov eax, dword [0x4675ac]
mov dl, byte [edi + ebp + 1]
push 1
mov ecx, dword [eax + 8]
push ecx
mov cl, byte [edi + ebp]
push edx
mov edx, dword [eax + 0xc]
push ecx
push edx
call fcn.004024c0
mov ecx, dword [0x4675cc]
and eax, 0xff
add ecx, ebx
add esp, 0x3c
add eax, ecx
mov dword [esp + 0x1c], eax
jmp 0x4029e4
mov edi, 1
mov edx, dword [0x4675ac]
mov dword [0x4675a8], 0
mov eax, dword [edx + 0xc]
add eax, 0xfffffffe
cmp eax, 0x45
ja case.0x402c98.8
xor ecx, ecx
mov cl, byte [eax + 0x40390c]
jmp dword [ecx*4 + 0x4038f0]
mov eax, dword [0x4675cc]
mov edx, dword [esp + 0x864]
movsx ecx, byte [eax + ebp]
mov dword [0x4675c8], ecx
add ecx, eax
lea eax, [ecx + edx + 1]
mov ecx, dword [esp + 0x86c]
mov dword [ecx], eax
jmp 0x402db2
mov eax, dword [0x4675cc]
mov ecx, dword [esp + 0x86c]
xor edx, edx
mov dl, byte [eax + ebp]
mov dword [ecx], edx
jmp 0x402db2
mov eax, dword [0x4675cc]
mov ecx, dword [esp + 0x86c]
xor edx, edx
mov dx, word [eax + ebp]
mov dword [ecx], edx
jmp 0x402db2
mov eax, dword [0x4675cc]
mov edx, dword [esp + 0x864]
mov ecx, dword [eax + ebp]
mov dword [0x4675c8], ecx
add ecx, eax
lea eax, [ecx + edx + 4]
mov ecx, dword [esp + 0x86c]
mov dword [ecx], eax
mov dword [0x4675a8], edi
jmp 0x402db2
mov edx, dword [0x4675cc]
mov ecx, dword [esp + 0x86c]
mov eax, dword [edx + ebp]
mov dword [ecx], eax
mov dword [0x4675a8], edi
jmp 0x402db2
mov edx, dword [0x4675cc]
mov ecx, dword [esp + 0x86c]
mov eax, dword [edx + ebp + 1]
mov dword [0x4675c4], eax
mov eax, dword [esp + 0x884]
test eax, eax
mov dword [ecx], 0
je 0x402db2
mov eax, dword [0x4675c4]
mov edx, dword [esi + 4]
cmp eax, edx
jb 0x402db2
cmp eax, dword [esi + 8]
ja 0x402db2
push 0x4675a0
push 4
push ecx
mov ecx, dword [esi + 0x10]
push eax
push ecx
call fcn.00429130
add esp, 0x14
test eax, eax
je 0x402db2
cmp dword [0x4675a0], 4
jne 0x402db2
mov dword [0x4675a8], edi
jmp 0x402db2
mov edx, dword [esp + 0x86c]
mov dword [edx], 0
mov eax, dword [0x4675ac]
push 1
mov ecx, dword [eax + 8]
push ecx
mov ecx, dword [0x4675cc]
mov dl, byte [ecx + ebp + 1]
mov cl, byte [ecx + ebp]
push edx
mov edx, dword [eax + 0x14]
push ecx
push edx
call fcn.004024c0
mov edi, dword [0x4675cc]
mov bl, al
mov eax, dword [0x4675ac]
push 1
mov dl, byte [edi + ebp + 1]
and ebx, 0xff
mov ecx, dword [eax + 8]
push ecx
mov cl, byte [edi + ebp]
push edx
mov edx, dword [eax + 0x10]
push ecx
push edx
call fcn.004024c0
mov edi, dword [0x4675cc]
and eax, 0xff
add ebx, eax
mov eax, dword [0x4675ac]
mov dl, byte [edi + ebp + 1]
push 1
mov ecx, dword [eax + 8]
push ecx
mov cl, byte [edi + ebp]
push edx
mov edx, dword [eax + 0xc]
push ecx
push edx
call fcn.004024c0
mov ecx, dword [0x4675cc]
mov edx, dword [0x4675ac]
and eax, 0xff
add ecx, ebx
add eax, ecx
push str.push
mov dword [esp + 0x5c], eax
mov eax, dword [edx]
push eax
call fcn.004348b0
add esp, 0x44
test eax, eax
jne 0x40323d
push 0x11
call dword [sym.imp.user32.dll_GetAsyncKeyState]
test ax, ax
jge 0x402f3f
xor eax, eax
mov dword [0x4675b0], eax
mov ecx, dword [esi + 0x1c]
test ecx, ecx
jle 0x402f3f
mov edi, dword [esp + 0x87c]
mov ebx, dword [esp + 0x878]
mov ecx, dword [esp + 0x874]
mov edx, dword [esp + 0x870]
push 0
push edi
push ebx
push ecx
mov ecx, dword [esp + 0x87c]
push edx
mov edx, dword [ecx]
mov ecx, eax
shl ecx, 4
add ecx, eax
push edx
mov edx, dword [esi + 0x18]
shl ecx, 4
sub ecx, eax
lea ecx, [edx + ecx*4]
call fcn.00409de0
test eax, eax
jne 0x402ed9
mov eax, dword [0x4675b0]
inc eax
mov dword [0x4675b0], eax
mov ecx, dword [esi + 0x1c]
cmp eax, ecx
jl 0x402e8c
jmp 0x402f3f
push 0x10
call dword [sym.imp.user32.dll_GetAsyncKeyState]
test ax, ax
jge 0x402f2e
mov eax, dword [esp + 0x870]
mov edx, dword [0x4675cc]
xor ecx, ecx
push eax
mov cx, word [ebx]
mov eax, dword [esp + 0x868]
push ecx
lea ecx, [edx + eax - 1]
lea edx, [esp + 0x468]
push ecx
push str.VA:_08X
push edx
call fcn.0043367e
add esp, 0x14
lea eax, [esp + 0x460]
push 0
push edi
push eax
push 0
call dword [sym.imp.user32.dll_MessageBoxA]
push 0x10
call dword [sym.imp.user32.dll_GetAsyncKeyState]
test ax, ax
jge 0x4038af
mov eax, dword [esi + 0x70]
test eax, eax
je 0x4030c0
mov eax, dword [esi + 0x60]
mov edx, dword [esi + 0x5c]
cmp eax, edx
je 0x4030c0
lea ecx, [eax + 4]
cmp ecx, edx
mov dword [esi + 0x60], ecx
jne 0x4030b3
test eax, eax
je 0x402f75
mov ecx, dword [esp + 0x86c]
mov edx, dword [ecx]
mov dword [eax], edx
push 0x1000
call fcn.00442732
mov ebx, eax
mov eax, dword [esi + 0x70]
add esp, 4
test eax, eax
jne 0x402fd8
push 8
mov dword [esi + 0x6c], 2
call fcn.00442732
mov dword [esi + 0x68], eax
mov dword [eax + 4], ebx
mov eax, dword [esi + 0x68]
lea edi, [esi + 0x48]
add eax, 4
add esp, 4
add ebx, 0x800
mov ecx, dword [eax]
mov dword [edi], ecx
lea edx, [ecx + 0x1000]
mov dword [edi + 4], edx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], eax
lea edi, [esi + 0x58]
mov dword [esi + 0x58], ecx
mov dword [edi + 4], edx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], eax
jmp 0x403224
mov ecx, dword [esi + 0x6c]
mov edx, dword [esi + 0x68]
mov eax, dword [esi + 0x64]
lea ecx, [edx + ecx*4 - 4]
cmp eax, ecx
jae 0x403010
add eax, 4
mov dword [esi + 0x64], eax
mov dword [eax], ebx
mov eax, dword [esi + 0x64]
mov ecx, dword [eax]
lea edi, [esi + 0x58]
mov dword [esi + 0x58], ecx
lea edx, [ecx + 0x1000]
mov dword [edi + 4], edx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], eax
jmp 0x403224
sub eax, dword [esi + 0x54]
sar eax, 2
inc eax
mov dword [esp + 0x14], eax
lea edi, [eax + eax]
lea eax, [edi*4]
test eax, eax
jge 0x40302b
xor eax, eax
push eax
call fcn.00442732
mov ecx, dword [esi + 0x54]
mov dword [esp + 0x1c], eax
shr edi, 2
add esp, 4
lea edi, [eax + edi*4]
mov eax, dword [esi + 0x64]
add eax, 4
mov edx, edi
cmp ecx, eax
je 0x403062
mov ebp, dword [ecx]
add ecx, 4
mov dword [edx], ebp
add edx, 4
cmp ecx, eax
jne 0x40304d
mov ebp, dword [esp + 0x88c]
mov edx, dword [esi + 0x68]
push edx
call fcn.0044275b
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov dword [esi + 0x68], eax
add esp, 4
lea eax, [ecx + ecx]
mov dword [esi + 0x6c], eax
lea eax, [edi + ecx*4]
mov dword [eax], ebx
mov ecx, dword [edi]
lea edx, [ecx + 0x1000]
mov dword [esp + 0x34], edx
mov edx, dword [esi + 0x50]
mov dword [esp + 0x38], edx
lea edx, [esi + 0x48]
mov dword [esi + 0x48], ecx
mov ecx, dword [esp + 0x34]
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0x38]
mov dword [edx + 8], ecx
mov dword [edx + 0xc], edi
jmp 0x402ff4
test eax, eax
je 0x403224
jmp 0x403219
push 0x1000
call fcn.00442732
mov ebx, eax
mov eax, dword [esi + 0x70]
add esp, 4
test eax, eax
jne 0x403138
push 8
mov dword [esi + 0x6c], 2
call fcn.00442732
mov dword [esi + 0x68], eax
mov dword [eax + 4], ebx
mov edx, dword [esi + 0x68]
add esp, 4
add edx, 4
add ebx, 0x800
push edx
push ebx
lea ecx, [esp + 0x28]
call fcn.00406260
mov ecx, dword [esp + 0x24]
lea eax, [esi + 0x48]
mov edx, dword [esp + 0x28]
mov ebx, eax
mov eax, dword [esp + 0x20]
mov edi, dword [esp + 0x2c]
mov dword [ebx], eax
mov dword [ebx + 4], ecx
mov dword [ebx + 8], edx
mov dword [ebx + 0xc], edi
lea ebx, [esi + 0x58]
mov dword [esi + 0x58], eax
mov dword [ebx + 4], ecx
mov dword [ebx + 8], edx
mov dword [ebx + 0xc], edi
jmp 0x40320c
mov ecx, dword [esi + 0x6c]
mov edx, dword [esi + 0x68]
mov eax, dword [esi + 0x64]
lea ecx, [edx + ecx*4 - 4]
cmp eax, ecx
jae 0x40316f
add eax, 4
lea edi, [esi + 0x58]
mov dword [esi + 0x64], eax
mov dword [eax], ebx
mov eax, dword [esi + 0x64]
mov ecx, dword [eax]
mov dword [edi], ecx
lea edx, [ecx + 0x1000]
mov dword [edi + 4], edx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], eax
jmp 0x40320c
sub eax, dword [esi + 0x54]
sar eax, 2
inc eax
mov dword [esp + 0x14], eax
add eax, eax
shl eax, 2
test eax, eax
jge 0x403185
xor eax, eax
push eax
call fcn.00442732
mov edx, dword [esp + 0x18]
mov ebp, eax
mov ecx, dword [esi + 0x54]
lea eax, [edx + edx]
shr eax, 2
lea edi, [ebp + eax*4]
mov eax, dword [esi + 0x64]
add eax, 4
push edi
push eax
push ecx
call fcn.004062b0
mov edx, dword [esi + 0x68]
push edx
call fcn.0044275b
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x28]
add esp, 0x14
add eax, eax
mov dword [esi + 0x6c], eax
lea eax, [edi + ecx*4]
mov dword [esi + 0x68], ebp
mov dword [eax], ebx
mov ebp, dword [esi + 0x50]
mov ecx, dword [edi]
mov dword [esp + 0x48], ebp
lea ebp, [esi + 0x48]
lea edx, [ecx + 0x1000]
mov dword [ebp], ecx
mov dword [ebp + 4], edx
mov edx, dword [esp + 0x48]
mov dword [ebp + 8], edx
mov dword [ebp + 0xc], edi
mov ecx, dword [eax]
lea edi, [esi + 0x58]
mov ebp, dword [esp + 0x88c]
lea edx, [ecx + 0x1000]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x60]
test eax, eax
lea ecx, [eax + 4]
mov dword [esi + 0x60], ecx
je 0x403224
mov edx, dword [esp + 0x86c]
mov ecx, dword [edx]
mov dword [eax], ecx
mov eax, dword [esi + 0x70]
mov edx, dword [esp + 0x86c]
inc eax
mov dword [esi + 0x70], eax
mov dword [edx], 0
jmp 0x4029e4
mov eax, dword [esp + 0x86c]
mov dword [0x4675b8], 1
cmp dword [eax], 0
je 0x40345a
mov eax, dword [0x4675a8]
test eax, eax
je 0x40345a
xor eax, eax
mov dword [0x4675b0], eax
mov ecx, dword [esi + 0x1c]
test ecx, ecx
jle 0x40345a
mov edi, dword [esp + 0x87c]
mov ebx, dword [esp + 0x878]
mov ecx, dword [esp + 0x874]
mov edx, dword [esp + 0x870]
push 0
push edi
push ebx
push ecx
mov ecx, dword [esp + 0x87c]
push edx
mov edx, dword [ecx]
mov ecx, eax
shl ecx, 4
add ecx, eax
push edx
mov edx, dword [esi + 0x18]
shl ecx, 4
sub ecx, eax
lea ecx, [edx + ecx*4]
call fcn.00409de0
test eax, eax
jne 0x4032d4
mov eax, dword [0x4675b0]
inc eax
mov dword [0x4675b0], eax
mov ecx, dword [esi + 0x1c]
cmp eax, ecx
jl 0x403284
jmp 0x40344d
push 0x10
mov byte [esp + 0x17], 0
call dword [sym.imp.user32.dll_GetAsyncKeyState]
test ax, ax
jge 0x40332d
mov eax, dword [esp + 0x870]
mov edx, dword [0x4675cc]
xor ecx, ecx
push eax
mov cx, word [ebx]
mov eax, dword [esp + 0x868]
push ecx
mov byte [esp + 0x1b], 1
lea ecx, [edx + eax - 1]
lea edx, [esp + 0x68]
push ecx
push str.VA:_08X
push edx
call fcn.0043367e
add esp, 0x14
lea eax, [esp + 0x60]
push 0
push edi
push eax
push 0
call dword [sym.imp.user32.dll_MessageBoxA]
push 0x10
call dword [sym.imp.user32.dll_GetAsyncKeyState]
test ax, ax
jl 0x403374
mov al, byte [esp + 0x13]
test al, al
jne 0x4038cf
cmp dword [0x4675cc], 1
jne 0x4038cf
mov eax, dword [esp + 0x890]
test eax, eax
je 0x4038cf
mov ecx, dword [0x4675ac]
mov eax, dword [ecx + 8]
test ah, 4
je 0x4038cf
mov ecx, dword [0x46759c]
mov eax, dword [0x4634d4]
inc ecx
mov dword [esp + 0x18], 0
test eax, eax
mov dword [0x46759c], ecx
jle 0x40344d
mov dword [esp + 0x14], str.advapi32.dll
mov eax, dword [0x4675b0]
mov edx, eax
shl edx, 4
add edx, eax
shl edx, 4
sub edx, eax
mov eax, dword [esi + 0x18]
lea ecx, [eax + edx*4]
call fcn.00409690
mov ecx, dword [esp + 0x14]
mov edx, eax
xor eax, eax
mov ebx, dword [ecx]
or ecx, 0xffffffff
mov edi, ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, edx
mov ebp, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, ebp
jb 0x403424
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, edx
mov ebp, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, ebp
jbe 0x403412
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, edx
mov ebp, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
sub ecx, ebp
add edx, ecx
push ebx
push edx
call fcn.004348b0
add esp, 8
test eax, eax
je 0x4034fd
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov ecx, dword [0x4634d4]
inc eax
add edx, 4
cmp eax, ecx
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], edx
jl 0x40339e
mov ebp, dword [esp + 0x88c]
mov eax, dword [0x4675b8]
test eax, eax
je 0x40351f
mov eax, dword [esp + 0x86c]
mov ecx, dword [esi + 4]
mov eax, dword [eax]
cmp eax, ecx
jb 0x40351f
cmp eax, dword [esi + 8]
ja 0x40351f
mov edx, dword [0x4675ac]
mov ecx, dword [edx + 8]
test ch, 0x12
je 0x4035be
test ch, 0x10
je 0x403536
cmp dword [edx + 0xc], 0x19
jne 0x403536
mov ecx, dword [esp + 0x888]
mov edx, dword [esp + 0x884]
push 1
inc ecx
push ebp
push ecx
mov ecx, dword [esp + 0x88c]
push edx
mov edx, dword [esp + 0x88c]
mov edi, dword [esp + 0x878]
push ecx
mov ecx, dword [esp + 0x88c]
push edx
mov edx, dword [esp + 0x88c]
push ecx
mov ecx, dword [esp + 0x88c]
push edx
mov edx, dword [esp + 0x88c]
push ecx
push edx
push edi
push eax
mov ecx, esi
call fcn.00402960
test eax, eax
jne 0x40389d
jmp 0x403592
mov edx, dword [esp + 0x18]
mov eax, dword [0x4634d4]
cmp edx, eax
jge 0x403446
mov ebp, dword [esp + 0x88c]
mov dword [0x4675b8], 0
mov edx, dword [0x4675ac]
mov eax, dword [edx + 8]
test ah, 4
jne 0x403611
jmp 0x4029e4
mov ecx, dword [esp + 0x888]
mov edx, dword [esp + 0x884]
push 0
inc ecx
push ebp
push ecx
mov ecx, dword [esp + 0x88c]
push edx
mov edx, dword [esp + 0x88c]
mov edi, dword [esp + 0x878]
push ecx
mov ecx, dword [esp + 0x88c]
push edx
mov edx, dword [esp + 0x88c]
push ecx
mov ecx, dword [esp + 0x88c]
push edx
mov edx, dword [esp + 0x88c]
push ecx
push edx
push edi
push eax
mov ecx, esi
call fcn.00402960
test eax, eax
jne 0x40389d
mov eax, dword [esp + 0x864]
mov ecx, dword [esi + 0x10]
push 0x4675a0
push edi
push ebp
push eax
push ecx
call fcn.00429130
add esp, 0x14
test eax, eax
je 0x403611
cmp dword [0x4675a0], edi
jne 0x403611
jmp 0x4029e4
test ch, 4
jne 0x4035c8
jmp 0x4029e4
mov eax, dword [esp + 0x888]
mov ebx, dword [sym.imp.user32.dll_GetAsyncKeyState]
inc eax
mov dword [esp + 0x890], 0
mov dword [esp + 0x888], eax
mov eax, dword [esp + 0x86c]
mov edi, dword [esp + 0x888]
mov ecx, dword [eax]
mov dword [esp + 0x864], ecx
jmp 0x402980
mov edx, dword [esp + 0x880]
mov dword [edx], 0xfffffffe
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x850
ret 0x30
cmp dword [esi + 0x70], 1
jb 0x403611
lea eax, [esi + 0x58]
mov edx, eax
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov dword [esp + 0x44], eax
mov eax, dword [edx + 8]
mov edi, dword [edx + 0xc]
lea edx, [eax - 4]
mov eax, edx
sub eax, ecx
sar eax, 2
js 0x40364d
mov ecx, eax
shr ecx, 0xa
jmp 0x403659
mov ecx, 0x3ff
sub ecx, eax
shr ecx, 0xa
neg ecx
test ecx, ecx
jne 0x403661
mov eax, edx
jmp 0x40366c
mov edx, dword [edi + ecx*4]
shl ecx, 0xa
sub eax, ecx
lea eax, [edx + eax*4]
mov edx, dword [esp + 0x86c]
mov ecx, dword [eax]
lea edi, [esi + 0x58]
mov dword [edx], ecx
mov eax, dword [esi + 0x60]
cmp eax, dword [edi]
jne 0x40371c
mov eax, dword [esi + 0x64]
lea ecx, [eax - 4]
mov dword [esi + 0x64], ecx
mov edx, dword [eax]
push edx
call fcn.0044275b
mov eax, dword [esi + 0x70]
add esp, 4
test eax, eax
jne 0x4036fb
mov eax, dword [esi + 0x54]
mov ecx, dword [esi + 0x64]
cmp eax, ecx
jne 0x4036b5
mov eax, dword [eax]
push eax
call fcn.0044275b
add esp, 4
lea ecx, [esp + 0x20]
call fcn.00406250
mov eax, dword [esp + 0x20]
lea ecx, [esi + 0x48]
mov edx, dword [esp + 0x28]
mov ebp, ecx
mov ecx, dword [esp + 0x24]
mov ebx, dword [esp + 0x2c]
mov dword [ebp], eax
mov dword [ebp + 4], ecx
mov dword [ebp + 8], edx
mov dword [ebp + 0xc], ebx
mov ebp, edi
mov dword [ebp], eax
mov dword [ebp + 4], ecx
mov dword [ebp + 8], edx
mov edx, dword [esi + 0x68]
push edx
mov dword [ebp + 0xc], ebx
call fcn.0044275b
add esp, 4
jmp 0x40371c
mov eax, dword [esi + 0x64]
mov ebp, edi
mov edx, dword [eax]
mov dword [ebp], edx
mov ecx, edx
lea ebx, [edx + 0x1000]
add ecx, 0x1000
mov dword [ebp + 4], ebx
mov dword [ebp + 8], ecx
mov dword [ebp + 0xc], eax
mov eax, dword [esi + 0x70]
test eax, eax
je 0x403727
add dword [esi + 0x60], 0xfffffffc
dec eax
test eax, eax
mov dword [esi + 0x70], eax
jne 0x4037ad
mov eax, dword [esi + 0x64]
lea ecx, [eax - 4]
mov dword [esi + 0x64], ecx
mov edx, dword [eax]
push edx
call fcn.0044275b
mov eax, dword [esi + 0x70]
add esp, 4
test eax, eax
jne 0x40378f
mov eax, dword [esi + 0x54]
mov ecx, dword [esi + 0x64]
cmp eax, ecx
jne 0x40375f
mov eax, dword [eax]
push eax
call fcn.0044275b
add esp, 4
lea ebp, [esi + 0x48]
xor eax, eax
xor ecx, ecx
xor edx, edx
mov dword [ebp], eax
mov dword [edi], eax
mov dword [edi + 4], ecx
xor ebx, ebx
mov dword [ebp + 4], ecx
mov ecx, dword [esi + 0x68]
mov dword [edi + 8], edx
push ecx
mov dword [ebp + 8], edx
mov dword [edi + 0xc], ebx
mov dword [ebp + 0xc], ebx
call fcn.0044275b
add esp, 4
jmp 0x4037ad
mov eax, dword [esi + 0x64]
mov edx, dword [eax]
mov ecx, edx
mov dword [edi], edx
lea ebx, [edx + 0x1000]
add ecx, 0x1000
mov dword [edi + 4], ebx
mov dword [edi + 8], ecx
mov dword [edi + 0xc], eax
mov edx, dword [esp + 0x86c]
cmp dword [edx], 0
je 0x403611
xor eax, eax
mov dword [0x4675b0], eax
mov ecx, dword [esi + 0x1c]
test ecx, ecx
jle 0x403611
mov edi, dword [esp + 0x87c]
mov ebx, dword [esp + 0x878]
mov ebp, dword [esp + 0x870]
mov ecx, dword [esp + 0x874]
mov edx, dword [esp + 0x86c]
push 0
push edi
push ebx
push ecx
mov ecx, dword [edx]
mov edx, eax
shl edx, 4
add edx, eax
push ebp
shl edx, 4
sub edx, eax
mov eax, dword [esi + 0x18]
push ecx
lea ecx, [eax + edx*4]
call fcn.00409de0
test eax, eax
jne 0x403837
mov eax, dword [0x4675b0]
inc eax
mov dword [0x4675b0], eax
mov ecx, dword [esi + 0x1c]
cmp eax, ecx
jl 0x4037e4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x850
ret 0x30
mov esi, dword [sym.imp.user32.dll_GetAsyncKeyState]
push 0x10
call esi
test ax, ax
jge 0x403881
mov edx, dword [0x4675cc]
mov eax, dword [esp + 0x864]
xor ecx, ecx
push ebp
mov cx, word [ebx]
push ecx
lea ecx, [edx + eax - 1]
push ecx
lea edx, [esp + 0x6c]
push str.VA:_08X
push edx
call fcn.0043367e
add esp, 0x14
lea eax, [esp + 0x60]
push 0
push edi
push eax
push 0
call dword [sym.imp.user32.dll_MessageBoxA]
push 0x10
call esi
test ax, ax
jl 0x403611
mov edx, dword [esp + 0x880]
mov ecx, dword [0x4675b0]
mov dword [edx], ecx
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x850
ret 0x30
mov ecx, dword [esp + 0x880]
mov eax, dword [0x4675b0]
pop edi
pop esi
mov dword [ecx], eax
pop ebp
mov eax, 1
pop ebx
add esp, 0x850
ret 0x30
mov eax, dword [esp + 0x880]
mov edx, dword [0x4675b0]
pop edi
pop esi
mov dword [eax], edx
pop ebp
mov eax, 1
pop ebx
add esp, 0x850
ret 0x30