Function at 0x46b9ad
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffef4
mov bl, 0x18
lea ecx, [esp + 0x50]
mov byte [ecx], 0
inc ecx
dec bl
jne 0x46b800
lea esi, [esp + 0x50]
lea edi, [esp + 0x68]
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
lea esi, [esp + 0x50]
lea edi, [esp + 0x80]
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
lea esi, [esp + 0x50]
lea edi, [esp + 0x98]
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0x470f68]
mov edi, eax
lea esi, [esp + 0x50]
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0x470c68]
mov eax, dword [eax]
mov eax, dword [eax + 0x300]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov eax, dword [0x470c68]
mov eax, dword [eax]
mov eax, dword [eax + 0x314]
mov si, 0xffeb
call fcn.00403778
mov eax, dword [0x470e38]
mov eax, dword [eax]
call fcn.004603d0
call fcn.0046ab64
mov eax, dword [0x470ed4]
mov dword [eax + 0x2c], 0xff
mov eax, dword [0x470ed4]
mov dword [eax + 0x28], 0x34
mov dword [esp + 0xb0], 1
mov word [esp + 0xb4], 0
xor eax, eax
mov dword [esp + 0xbc], eax
xor eax, eax
mov dword [esp + 0xc0], eax
xor eax, eax
mov dword [esp + 0xcc], eax
xor eax, eax
mov dword [esp + 0xd0], eax
xor eax, eax
mov dword [esp + 0xd4], eax
xor eax, eax
mov dword [esp + 0xe0], eax
xor eax, eax
mov dword [esp + 0xe4], eax
xor eax, eax
mov dword [esp + 0xe8], eax
xor eax, eax
mov dword [esp + 0xec], eax
xor eax, eax
mov dword [esp + 0xf0], eax
xor eax, eax
mov dword [esp + 0xf4], eax
mov dword [esp + 0xf8], 1
xor eax, eax
mov dword [esp + 0xfc], eax
xor eax, eax
mov dword [esp + 0x100], eax
xor eax, eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
xor eax, eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
lea esi, [esp + 0x30]
lea edi, [esp + 0x40]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov byte [esp + 0x10], 0xff
mov byte [esp + 0x11], 0
mov byte [esp + 0x12], 0
mov byte [esp + 0x13], 0
mov word [esp + 0x16], 0
mov byte [esp + 0x14], 1
mov byte [esp], 0
mov eax, dword [0x470ed4]
add eax, 0x28
push eax
mov eax, dword [0x470dec]
mov eax, dword [eax + 4]
push eax
call sub.winmm.dll_joyGetPosEx
test eax, eax
je 0x46ba57
mov eax, dword [0x470dec]
mov al, byte [eax]
mov edx, dword [0x470d3c]
cmp al, byte [edx]
je 0x46ba43
push 0x64
push 0x3e8
call sub.kernel32.dll_Beep
push 0x64
push 0x258
call sub.kernel32.dll_Beep
mov eax, dword [0x470e38]
mov eax, dword [eax]
mov edx, 0x46ccec
call fcn.004600dc
mov bl, 0xa
mov ecx, dword [0x470ed4]
add ecx, 0x18
mov byte [ecx], 0
inc ecx
dec bl
jne 0x46b9e1
mov bl, 4
mov ecx, dword [0x470ed4]
add ecx, 0x22
mov byte [ecx], 0
inc ecx
dec bl
jne 0x46b9f4
mov bl, 2
mov ecx, dword [0x470ed4]
mov esi, dword [0x470ed4]
add esi, 0x26
xor eax, eax
mov dword [ecx], eax
xor eax, eax
mov dword [ecx + 4], eax
mov byte [esi], 0
inc esi
add ecx, 0xc
dec bl
jne 0x46ba0d
mov bl, 0x18
mov esi, dword [0x470dd8]
add esi, 0x34
cmp byte [esi], 2
jne 0x46ba34
mov byte [esi], 1
inc esi
dec bl
jne 0x46ba2c
call fcn.0046ab64
jmp 0x46bf8c
cmp byte [esp], 0
jne 0x46bf8c
call fcn.0046ab64
jmp 0x46bf8c
mov eax, dword [0x470dec]
mov al, byte [eax]
mov edx, dword [0x470d3c]
cmp al, byte [edx]
jne 0x46ba96
push 0x64
push 0x258
call sub.kernel32.dll_Beep
push 0x64
push 0x3e8
call sub.kernel32.dll_Beep
mov eax, dword [0x470e38]
mov eax, dword [eax]
mov edx, 0x46cd00
call fcn.004600dc
call fcn.0046ab64
xor ebx, ebx
mov esi, dword [0x470ed4]
xor ebp, ebp
mov eax, dword [0x470dec]
movzx eax, byte [eax]
shl eax, 2
lea eax, [eax + eax*2]
mov edx, dword [0x470f50]
lea eax, [edx + eax*8]
xor edx, edx
mov dl, bl
add edx, edx
add edx, ebp
movzx eax, byte [eax + edx + 0x59]
cmp eax, 4
ja case.default.0x46bacd
jmp dword [eax*4 + 0x46bad4]
mov eax, dword [0x470ed4]
mov eax, dword [eax + 0x30]
shr eax, 7
sub eax, 0xff
mov dword [esp + 4], eax
jmp 0x46bb6a
mov eax, dword [0x470ed4]
mov eax, dword [eax + 0x34]
shr eax, 7
sub eax, 0xff
mov dword [esp + 4], eax
jmp 0x46bb6a
mov eax, dword [0x470ed4]
mov eax, dword [eax + 0x38]
shr eax, 7
sub eax, 0xff
mov dword [esp + 4], eax
jmp 0x46bb6a
mov eax, dword [0x470ed4]
mov eax, dword [eax + 0x3c]
shr eax, 7
sub eax, 0xff
mov dword [esp + 4], eax
jmp 0x46bb6a
mov eax, dword [0x470ed4]
mov eax, dword [eax + 0x40]
shr eax, 7
sub eax, 0xff
mov dword [esp + 4], eax
jmp 0x46bb6a
mov eax, dword [0x470ed4]
mov eax, dword [eax + 0x44]
shr eax, 7
sub eax, 0xff
mov dword [esp + 4], eax
cmp dword [esp + 4], 1
jl 0x46bb75
dec dword [esp + 4]
mov eax, esi
test ebp, ebp
jne 0x46bb83
mov edx, dword [esp + 4]
mov dword [eax], edx
jmp 0x46bb8a
mov edx, dword [esp + 4]
mov dword [eax + 4], edx
inc ebp
cmp ebp, 2
jne 0x46baa0
mov eax, esi
imul edx, dword [eax], 0x5fd
mov ecx, dword [0x470fa8]
lea edx, [ecx + edx*4]
mov ecx, dword [eax + 4]
lea ecx, [ecx + ecx*2]
mov dl, byte [edx + ecx*4 + 0x17e80a]
mov byte [eax + 8], dl
mov eax, esi
imul edx, dword [eax], 0x5fd
mov ecx, dword [0x470fa8]
lea edx, [ecx + edx*4]
mov ecx, dword [eax + 4]
lea ecx, [ecx + ecx*2]
mov dx, word [edx + ecx*4 + 0x17e808]
mov word [eax + 0xa], dx
mov eax, esi
imul edx, dword [eax], 0x5fd
mov ecx, dword [0x470fa8]
lea edx, [ecx + edx*4]
mov ecx, dword [eax + 4]
lea ecx, [ecx + ecx*2]
mov dl, byte [edx + ecx*4 + 0x17e80b]
mov byte [eax + 9], dl
inc ebx
add esi, 0xc
cmp bl, 2
jne 0x46ba9e
mov eax, dword [0x470ed4]
mov eax, dword [eax + 0x48]
mov dword [esp + 4], eax
mov bl, 0xa
mov esi, dword [0x470ed4]
add esi, 0x18
mov eax, dword [0x470ed4]
mov eax, dword [eax + 0x48]
and eax, 1
cmp eax, 1
sete al
mov byte [esi], al
mov eax, dword [0x470ed4]
shr dword [eax + 0x48], 1
inc esi
dec bl
jne 0x46bc1d
mov eax, dword [0x470dec]
movzx eax, byte [eax]
shl eax, 2
lea eax, [eax + eax*2]
mov edx, dword [0x470f50]
cmp byte [edx + eax*8 + 0x5d], 0
jne 0x46bc9f
mov eax, dword [0x470ed4]
mov eax, dword [eax + 0x48]
and eax, 1
cmp eax, 1
sete al
mov edx, eax
shl eax, 8
sub eax, edx
mov edx, dword [0x470ed4]
mov byte [edx + 0x26], al
mov eax, dword [0x470ed4]
mov eax, dword [eax + 0x48]
and eax, 2
cmp eax, 2
sete al
mov edx, eax
shl eax, 8
sub eax, edx
mov edx, dword [0x470ed4]
mov byte [edx + 0x27], al
jmp 0x46bd34
mov eax, dword [0x470bd0]
cmp byte [eax], 0
je 0x46bce1
lea eax, [esp + 0x20]
push eax
push 0
mov eax, dword [0x470e6c]
mov eax, dword [eax]
call eax
test eax, eax
je 0x46bcc7
mov byte [esp + 0x26], 0
mov byte [esp + 0x27], 0
mov eax, dword [0x470ed4]
mov dl, byte [esp + 0x26]
mov byte [eax + 0x26], dl
mov eax, dword [0x470ed4]
mov dl, byte [esp + 0x27]
mov byte [eax + 0x27], dl
jmp 0x46bd34
mov eax, dword [0x470ed4]
cmp dword [eax + 0x38], 0x8000
jb 0x46bd13
mov eax, dword [0x470ed4]
mov eax, dword [eax + 0x38]
sub eax, 0x8000
shr eax, 7
mov edx, dword [0x470ed4]
mov byte [edx + 0x26], al
mov eax, dword [0x470ed4]
mov byte [eax + 0x27], 0
jmp 0x46bd34
mov eax, dword [0x470ed4]
mov edx, 0x7fff
sub edx, dword [eax + 0x38]
shr edx, 7
mov eax, dword [0x470ed4]
mov byte [eax + 0x27], dl
mov eax, dword [0x470ed4]
mov byte [eax + 0x26], 0
mov eax, dword [0x470ed4]
mov edx, dword [esp + 4]
mov dword [eax + 0x48], edx
mov eax, dword [0x470dec]
cmp byte [eax], 5
jne 0x46be73
mov bl, 2
mov esi, dword [0x470ed4]
add esi, 0x20
mov byte [esi], 0
inc esi
dec bl
jne 0x46bd59
mov bl, 2
mov esi, dword [0x470ed4]
add esi, 0x26
mov byte [esi], 0
inc esi
dec bl
jne 0x46bd6c
mov eax, dword [0x470ed4]
test dword [eax + 0x48], 0x800
jbe 0x46bdcf
mov eax, dword [0x470ed4]
test dword [eax + 0x48], 0x200
jbe 0x46bda1
mov eax, dword [0x470ed4]
mov dword [eax + 0x50], 0x1194
jmp 0x46be67
mov eax, dword [0x470ed4]
test dword [eax + 0x48], 0x100
jbe 0x46bdc0
mov eax, dword [0x470ed4]
mov dword [eax + 0x50], 0x7b0c
jmp 0x46be67
mov eax, dword [0x470ed4]
xor edx, edx
mov dword [eax + 0x50], edx
jmp 0x46be67
mov eax, dword [0x470ed4]
test dword [eax + 0x48], 0x400
jbe 0x46be23
mov eax, dword [0x470ed4]
test dword [eax + 0x48], 0x200
jbe 0x46bdf9
mov eax, dword [0x470ed4]
mov dword [eax + 0x50], 0x34bc
jmp 0x46be67
mov eax, dword [0x470ed4]
test dword [eax + 0x48], 0x100
jbe 0x46be15
mov eax, dword [0x470ed4]
mov dword [eax + 0x50], 0x57e4
jmp 0x46be67
mov eax, dword [0x470ed4]
mov dword [eax + 0x50], 0x4650
jmp 0x46be67
mov eax, dword [0x470ed4]
test dword [eax + 0x48], 0x200
jbe 0x46be3f
mov eax, dword [0x470ed4]
mov dword [eax + 0x50], 0x2328
jmp 0x46be67
mov eax, dword [0x470ed4]
test dword [eax + 0x48], 0x100
jbe 0x46be5b
mov eax, dword [0x470ed4]
mov dword [eax + 0x50], 0x6978
jmp 0x46be67
mov eax, dword [0x470ed4]
mov dword [eax + 0x50], 0xffff
mov eax, dword [0x470ed4]
and dword [eax + 0x48], 0xff
mov edx, dword [0x470ed4]
cmp dword [edx + 0x50], 0xffff
je 0x46bea8
mov eax, dword [0x470ed4]
mov eax, dword [eax + 0x50]
test eax, eax
je 0x46beac
mov edx, dword [0x470ed4]
cmp eax, 0x1194
je 0x46beac
mov edx, dword [0x470ed4]
cmp eax, 0x7b0c
je 0x46beac
xor eax, eax
jmp 0x46beae
mov al, 1
mov edx, dword [0x470ed4]
mov byte [edx + 0x22], al
mov edx, dword [0x470ed4]
cmp dword [edx + 0x50], 0xffff
je 0x46beef
mov eax, dword [0x470ed4]
mov eax, dword [eax + 0x50]
cmp eax, 0x1194
je 0x46bef3
mov edx, dword [0x470ed4]
cmp eax, 0x2328
je 0x46bef3
mov edx, dword [0x470ed4]
cmp eax, 0x34bc
je 0x46bef3
xor eax, eax
jmp 0x46bef5
mov al, 1
mov edx, dword [0x470ed4]
mov byte [edx + 0x23], al
mov edx, dword [0x470ed4]
cmp dword [edx + 0x50], 0xffff
je 0x46bf36
mov eax, dword [0x470ed4]
mov eax, dword [eax + 0x50]
cmp eax, 0x34bc
je 0x46bf3a
mov edx, dword [0x470ed4]
cmp eax, 0x4650
je 0x46bf3a
mov edx, dword [0x470ed4]
cmp eax, 0x57e4
je 0x46bf3a
xor eax, eax
jmp 0x46bf3c
mov al, 1
mov edx, dword [0x470ed4]
mov byte [edx + 0x24], al
mov edx, dword [0x470ed4]
cmp dword [edx + 0x50], 0xffff
je 0x46bf7d
mov eax, dword [0x470ed4]
mov eax, dword [eax + 0x50]
cmp eax, 0x57e4
je 0x46bf81
mov edx, dword [0x470ed4]
cmp eax, 0x6978
je 0x46bf81
mov edx, dword [0x470ed4]
cmp eax, 0x7b0c
je 0x46bf81
xor eax, eax
jmp 0x46bf83
mov al, 1
mov edx, dword [0x470ed4]
mov byte [edx + 0x25], al
mov bl, 0xa
mov esi, dword [0x470ed4]
add esi, 0x18
lea ecx, [esp + 0x50]
cmp byte [esi], 0
je 0x46bfa5
mov byte [ecx], 2
jmp 0x46bfa8
mov byte [ecx], 0
inc ecx
inc esi
dec bl
jne 0x46bf9b
xor ebx, ebx
mov ecx, dword [0x470ed4]
add ecx, 0x26
mov esi, dword [0x470dd8]
add esi, 0x2f
mov al, byte [ecx]
cmp al, byte [esi]
jb 0x46bfd6
xor eax, eax
mov al, bl
add eax, 0xa
mov byte [esp + eax + 0x50], 2
jmp 0x46bff4
test al, al
jbe 0x46bfe8
xor eax, eax
mov al, bl
add eax, 0xa
mov byte [esp + eax + 0x50], 1
jmp 0x46bff4
xor eax, eax
mov al, bl
add eax, 0xa
mov byte [esp + eax + 0x50], 0
inc ebx
inc esi
inc ecx
cmp bl, 2
jne 0x46bfc2
xor ebx, ebx
mov esi, dword [0x470ed4]
add esi, 0x22
cmp byte [esi], 0
je 0x46c01a
xor eax, eax
mov al, bl
add eax, 0xc
mov byte [esp + eax + 0x50], 2
jmp 0x46c026
xor eax, eax
mov al, bl
add eax, 0xc
mov byte [esp + eax + 0x50], 0
inc ebx
inc esi
cmp bl, 4
jne 0x46c007
mov eax, dword [0x470dd8]
cmp byte [eax + 0x31], 1
jb 0x46c091
cmp byte [esp + 0x5c], 2
je 0x46c046
cmp byte [esp + 0x5e], 2
jne 0x46c091
cmp byte [esp + 0x5d], 2
je 0x46c054
cmp byte [esp + 0x5f], 2
jne 0x46c091
mov eax, dword [0x470dd8]
cmp byte [eax + 0x31], 1
jne 0x46c079
cmp byte [esp + 0x5c], 2
jne 0x46c06b
mov byte [esp + 0x5c], 1
cmp byte [esp + 0x5e], 2
jne 0x46c091
mov byte [esp + 0x5e], 1
jmp 0x46c091
cmp byte [esp + 0x5d], 2
jne 0x46c085
mov byte [esp + 0x5d], 1
cmp byte [esp + 0x5f], 2
jne 0x46c091
mov byte [esp + 0x5f], 1
xor ebx, ebx
mov esi, dword [0x470ed4]
mov ecx, dword [0x470dd8]
add ecx, 0x2d
mov eax, esi
cmp dword [eax], 0
jg 0x46c0ba
xor edx, edx
mov dl, bl
shl edx, 2
add edx, 0x11
mov byte [esp + edx + 0x50], 0
jmp 0x46c0f0
mov dl, byte [eax + 8]
cmp dl, byte [ecx]
jb 0x46c0d0
cmp word [eax + 0xa], 0x16
jb 0x46c0d0
cmp word [eax + 0xa], 0x9d
jbe 0x46c0e1
xor edx, edx
mov dl, bl
shl edx, 2
add edx, 0x11
mov byte [esp + edx + 0x50], 1
jmp 0x46c0f0
xor edx, edx
mov dl, bl
shl edx, 2
add edx, 0x11
mov byte [esp + edx + 0x50], 2
cmp dword [eax], 0
jl 0x46c106
xor edx, edx
mov dl, bl
shl edx, 2
add edx, 0x13
mov byte [esp + edx + 0x50], 0
jmp 0x46c13d
mov dl, byte [eax + 8]
cmp dl, byte [ecx]
jb 0x46c11d
cmp word [eax + 0xa], 0xca
jb 0x46c11d
cmp word [eax + 0xa], 0x151
jbe 0x46c12e
xor edx, edx
mov dl, bl
shl edx, 2
add edx, 0x13
mov byte [esp + edx + 0x50], 1
jmp 0x46c13d
xor edx, edx
mov dl, bl
shl edx, 2
add edx, 0x13
mov byte [esp + edx + 0x50], 2
cmp dword [eax + 4], 0
jl 0x46c154
xor edx, edx
mov dl, bl
shl edx, 2
add edx, 0x10
mov byte [esp + edx + 0x50], 0
jmp 0x46c18c
mov dl, byte [eax + 8]
cmp dl, byte [ecx]
jb 0x46c16c
mov di, word [eax + 0xa]
cmp di, 0x124
jae 0x46c17d
cmp di, 0x43
jbe 0x46c17d
xor edx, edx
mov dl, bl
shl edx, 2
add edx, 0x10
mov byte [esp + edx + 0x50], 1
jmp 0x46c18c
xor edx, edx
mov dl, bl
shl edx, 2
add edx, 0x10
mov byte [esp + edx + 0x50], 2
cmp dword [eax + 4], 0
jg 0x46c1a3
xor eax, eax
mov al, bl
shl eax, 2
add eax, 0x12
mov byte [esp + eax + 0x50], 0
jmp 0x46c1d9
mov dl, byte [eax + 8]
cmp dl, byte [ecx]
jb 0x46c1b9
cmp word [eax + 0xa], 0xf7
ja 0x46c1b9
cmp word [eax + 0xa], 0x70
jae 0x46c1ca
xor eax, eax
mov al, bl
shl eax, 2
add eax, 0x12
mov byte [esp + eax + 0x50], 1
jmp 0x46c1d9
xor eax, eax
mov al, bl
shl eax, 2
add eax, 0x12
mov byte [esp + eax + 0x50], 2
inc ebx
inc ecx
add esi, 0xc
cmp bl, 2
jne 0x46c0a2
lea esi, [esp + 0x50]
lea edi, [esp + 0x80]
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
mov bl, 0x18
mov ecx, dword [0x470dd8]
add ecx, 0x34
lea esi, [esp + 0x50]
lea eax, [esp + 0x68]
mov dword [esp + 0x1c], eax
lea edi, [esp + 0x80]
cmp byte [ecx], 0
jbe 0x46c238
cmp byte [esi], 2
jne 0x46c230
mov eax, dword [esp + 0x1c]
cmp byte [eax], 2
je 0x46c230
mov al, 3
sub al, byte [ecx]
mov byte [ecx], al
cmp byte [ecx], 2
jne 0x46c238
mov byte [edi], 2
cmp byte [ecx + 0x18], 0
je 0x46c25e
cmp byte [edi], 2
jne 0x46c25e
xor eax, eax
mov al, byte [esp]
mov ebp, 0xa
xor edx, edx
div ebp
cmp edx, 5
jae 0x46c25b
mov byte [edi], 2
jmp 0x46c25e
mov byte [edi], 0
inc edi
inc dword [esp + 0x1c]
inc esi
inc ecx
dec bl
jne 0x46c217
lea esi, [esp + 0x50]
lea edi, [esp + 0x68]
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0x470e38]
mov eax, dword [eax]
call fcn.004603d0
cmp byte [esp + 0x13], 0
jne 0x46c423
push 0x11
call sub.user32.dll_GetKeyState
and ax, 0x80
cmp ax, 0x80
jne 0x46c2c2
push 0x10
call sub.user32.dll_GetKeyState
and ax, 0x80
cmp ax, 0x80
jne 0x46c2c2
push 0x4d
call sub.user32.dll_GetKeyState
and ax, 0x80
cmp ax, 0x80
je 0x46c2cb
cmp word [esp + 0x16], 0xbb8
jne 0x46c30c
mov al, byte [esp + 0x12]
xor al, 1
mov byte [esp + 0x12], al
cmp byte [esp + 0x12], 0
je 0x46c2ea
push 0x64
push 0x3e8
call sub.kernel32.dll_Beep
jmp 0x46c2f6
push 0x64
push 0x258
call sub.kernel32.dll_Beep
mov byte [esp + 0x14], 1
mov byte [esp + 0x13], 0x19
mov word [esp + 0x16], 0
jmp 0x46c423
cmp byte [esp + 0x12], 0
je 0x46c423
xor ebp, ebp
xor ebx, ebx
mov edi, dword [0x470dd8]
add edi, 0x32
xor eax, eax
mov al, byte [edi]
mov dword [esp + 4], eax
test bl, bl
jne 0x46c341
push 0x27
call sub.user32.dll_GetKeyState
and ax, 0x80
cmp ax, 0x80
je 0x46c357
cmp bl, 1
jne 0x46c372
push 0x26
call sub.user32.dll_GetKeyState
and ax, 0x80
cmp ax, 0x80
jne 0x46c372
xor eax, eax
mov al, byte [esp + 0x14]
add eax, dword [esp + 4]
cmp eax, 0xff
jg 0x46c372
xor eax, eax
mov al, byte [esp + 0x14]
add dword [esp + 4], eax
test bl, bl
jne 0x46c387
push 0x25
call sub.user32.dll_GetKeyState
and ax, 0x80
cmp ax, 0x80
je 0x46c39d
cmp bl, 1
jne 0x46c3b5
push 0x28
call sub.user32.dll_GetKeyState
and ax, 0x80
cmp ax, 0x80
jne 0x46c3b5
xor eax, eax
mov al, byte [esp + 0x14]
mov edx, dword [esp + 4]
sub edx, eax
js 0x46c3b5
xor eax, eax
mov al, byte [esp + 0x14]
sub dword [esp + 4], eax
xor eax, eax
mov al, byte [edi]
cmp eax, dword [esp + 4]
je 0x46c40f
test bl, bl
jne 0x46c3db
mov eax, dword [0x470c50]
mov eax, dword [eax]
mov eax, dword [eax + 0x3c4]
mov edx, dword [esp + 4]
call fcn.0042feb4
jmp 0x46c3f1
mov eax, dword [0x470c50]
mov eax, dword [eax]
mov eax, dword [eax + 0x3dc]
mov edx, dword [esp + 4]
call fcn.0042feb4
mov byte [esp + 0x13], 0xa
mov word [esp + 0x16], 0
cmp byte [esp], 0xa
jae 0x46c40e
cmp byte [esp + 0x14], 8
jae 0x46c40e
inc byte [esp + 0x14]
inc ebp
inc ebx
inc edi
cmp bl, 2
jne 0x46c324
test ebp, ebp
jne 0x46c423
mov byte [esp + 0x14], 1
mov eax, dword [0x470e48]
cmp byte [eax], 0
je 0x46c43e
mov bl, 0x18
lea edi, [esp + 0x80]
mov byte [edi], 0
inc edi
dec bl
jne 0x46c436
call sub.user32.dll_GetActiveWindow
test eax, eax
jbe 0x46c451
mov eax, dword [0x470b1c]
cmp byte [eax], 0
je 0x46c455
xor eax, eax
jmp 0x46c457
mov al, 1
mov byte [esp + 0x18], al
cmp byte [esp + 0x18], 0
je 0x46c525
mov eax, dword [0x470dec]
mov al, byte [eax]
mov edx, dword [0x470d3c]
cmp al, byte [edx]
je 0x46c525
xor ebp, ebp
xor ebx, ebx
lea edi, [esp + 0x80]
mov eax, dword [0x470f68]
mov dword [esp + 0x1c], eax
mov al, byte [edi]
mov edx, dword [esp + 0x1c]
cmp al, byte [edx]
je 0x46c4ab
mov edx, dword [esp + 0x1c]
mov byte [edx], al
xor ecx, ecx
xor edx, edx
mov eax, ebx
call fcn.0046835c
inc ebp
inc ebx
inc dword [esp + 0x1c]
inc edi
cmp bl, 0x18
jne 0x46c48f
test ebp, ebp
jle 0x46c4cc
mov eax, dword [0x470f28]
mov eax, dword [eax]
mov eax, dword [eax + 0x504]
call fcn.004411ec
xor eax, eax
mov al, byte [esp]
mov ecx, 5
xor edx, edx
div ecx
test edx, edx
jne 0x46c525
mov eax, dword [0x470c50]
mov eax, dword [eax]
cmp byte [eax + 0x57], 0
je 0x46c4f0
call fcn.0046934c
mov eax, dword [0x470e94]
mov eax, dword [eax]
cmp byte [eax + 0x57], 0
je 0x46c525
mov eax, dword [0x470e94]
mov eax, dword [eax]
mov eax, dword [eax + 0x2f8]
mov eax, dword [eax + 0x26c]
mov edx, dword [0x470e94]
mov edx, dword [edx]
cmp eax, dword [edx + 0x33c]
jne 0x46c525
call fcn.004693c0
xor ebx, ebx
mov eax, dword [0x470dd8]
add eax, 0x15
mov dword [esp + 0x1c], eax
lea edi, [esp + 0x80]
lea esi, [esp + 0x98]
mov eax, dword [esp + 0x1c]
mov al, byte [eax]
test al, al
jbe 0x46c9a3
sub al, 0xf0
jb 0x46c570
sub al, 3
jb 0x46c612
sub al, 2
jb 0x46c6bc
sub al, 4
jb 0x46c732
jmp 0x46c9a3
cmp byte [esp + 0x18], 0
jne 0x46c9a3
cmp byte [edi], 2
jne 0x46c58c
cmp byte [esi], 2
jne 0x46c59e
cmp byte [esp + 0x11], 0
je 0x46c59e
cmp byte [esi], 2
jne 0x46c9a3
cmp byte [edi], 2
je 0x46c9a3
cmp bl, byte [esp + 0x10]
jne 0x46c5b0
cmp byte [esi], 2
jne 0x46c5b0
mov byte [esp + 0x11], 4
jmp 0x46c5b5
mov byte [esp + 0x11], 0x32
mov byte [esp + 0x10], bl
mov eax, dword [esp + 0x1c]
movzx eax, byte [eax]
mov word [esp + 0xb6], ax
mov dword [esp + 0xb8], 8
cmp byte [edi], 2
je 0x46c5e0
or dword [esp + 0xb8], 2
cmp word [esp + 0xb6], 0x60
jb 0x46c5fc
or dword [esp + 0xb8], 1
sub word [esp + 0xb6], 0x50
push 0x1c
lea eax, [esp + 0xb4]
push eax
push 1
call sub.user32.dll_SendInput
jmp 0x46c9a3
cmp byte [edi], 2
jne 0x46c61c
cmp byte [esi], 2
jne 0x46c62e
cmp byte [edi], 2
je 0x46c9a3
cmp byte [esi], 2
jne 0x46c9a3
xor eax, eax
mov dword [esp + 0xd8], eax
mov eax, dword [esp + 0x1c]
mov al, byte [eax]
sub al, 0xf0
je 0x46c64b
dec al
je 0x46c66a
dec al
je 0x46c689
jmp 0x46c6a6
cmp byte [edi], 2
jne 0x46c65d
mov dword [esp + 0xdc], 2
jmp 0x46c6a6
mov dword [esp + 0xdc], 4
jmp 0x46c6a6
cmp byte [edi], 2
jne 0x46c67c
mov dword [esp + 0xdc], 8
jmp 0x46c6a6
mov dword [esp + 0xdc], 0x10
jmp 0x46c6a6
cmp byte [edi], 2
jne 0x46c69b
mov dword [esp + 0xdc], 0x20
jmp 0x46c6a6
mov dword [esp + 0xdc], 0x40
push 0x1c
lea eax, [esp + 0xd0]
push eax
push 1
call sub.user32.dll_SendInput
jmp 0x46c9a3
cmp byte [edi], 2
jne 0x46c9a3
cmp byte [esi], 2
jne 0x46c6d5
cmp byte [esp + 0x11], 0
jne 0x46c9a3
cmp bl, byte [esp + 0x10]
jne 0x46c6e7
cmp byte [esi], 2
jne 0x46c6e7
mov byte [esp + 0x11], 0x19
jmp 0x46c6ec
mov byte [esp + 0x11], 0x32
mov byte [esp + 0x10], bl
mov dword [esp + 0xdc], 0x800
mov eax, dword [esp + 0x1c]
cmp byte [eax], 0xf3
jne 0x46c711
mov dword [esp + 0xd8], 0x78
jmp 0x46c71c
mov dword [esp + 0xd8], 0xffffff88
push 0x1c
lea eax, [esp + 0xd0]
push eax
push 1
call sub.user32.dll_SendInput
jmp 0x46c9a3
mov eax, ebx
sub al, 0xa
je 0x46c74b
dec al
je 0x46c7b4
add al, 0xfb
sub al, 8
jb 0x46c81d
jmp 0x46c93d
cmp byte [edi], 2
je 0x46c75b
xor eax, eax
mov dword [esp + 4], eax
jmp 0x46c952
mov eax, dword [0x470ed4]
movzx eax, byte [eax + 0x26]
mov edx, dword [0x470dd8]
movzx edx, byte [edx + 0x2f]
sub eax, edx
inc eax
mov dword [esp + 0x104], eax
fild dword [esp + 0x104]
mov eax, dword [0x470dd8]
movzx eax, byte [eax + 0x2f]
mov edx, 0xff
sub edx, eax
inc edx
mov dword [esp + 0x108], edx
fild dword [esp + 0x108]
fdivp st(1)
fmul dword [0x46cd08]
call fcn.00402ce4
mov dword [esp + 4], eax
jmp 0x46c952
cmp byte [edi], 2
je 0x46c7c4
xor eax, eax
mov dword [esp + 4], eax
jmp 0x46c952
mov eax, dword [0x470ed4]
movzx eax, byte [eax + 0x27]
mov edx, dword [0x470dd8]
movzx edx, byte [edx + 0x30]
sub eax, edx
inc eax
mov dword [esp + 0x104], eax
fild dword [esp + 0x104]
mov eax, dword [0x470dd8]
movzx eax, byte [eax + 0x30]
mov edx, 0xff
sub edx, eax
inc edx
mov dword [esp + 0x108], edx
fild dword [esp + 0x108]
fdivp st(1)
fmul dword [0x46cd08]
call fcn.00402ce4
mov dword [esp + 4], eax
jmp 0x46c952
cmp bl, 0x13
ja 0x46c826
xor ebp, ebp
jmp 0x46c82b
mov ebp, 1
cmp byte [edi], 2
je 0x46c866
cmp byte [edi], 1
jne 0x46c935
lea eax, [ebp + ebp*2]
mov edx, dword [0x470ed4]
mov al, byte [edx + eax*4 + 8]
mov edx, dword [0x470dd8]
cmp al, byte [edx + ebp + 0x2d]
jb 0x46c935
mov eax, dword [0x470dd8]
cmp byte [eax + 0x64], 1
jne 0x46c935
lea eax, [ebp + ebp*2]
mov edx, dword [0x470ed4]
movzx eax, byte [edx + eax*4 + 8]
mov edx, dword [0x470dd8]
movzx edx, byte [edx + ebp + 0x2d]
sub eax, edx
inc eax
mov dword [esp + 0x104], eax
fild dword [esp + 0x104]
mov eax, dword [0x470dd8]
movzx eax, byte [eax + ebp + 0x2d]
mov edx, 0xff
sub edx, eax
inc edx
mov dword [esp + 0x108], edx
fild dword [esp + 0x108]
fdivp st(1)
fmul dword [0x46cd08]
fstp qword [esp + 8]
wait
test bl, 1
jne 0x46c8fc
lea eax, [ebp + ebp*2]
mov edx, dword [0x470ed4]
movzx eax, byte [edx + eax*4 + 9]
mov dword [esp + 0x104], eax
fild dword [esp + 0x104]
fld xword [0x46cd0c]
fmulp st(1)
call fcn.00402cb8
fmul qword [esp + 8]
call fcn.00402ce4
mov dword [esp + 4], eax
jmp 0x46c952
lea eax, [ebp + ebp*2]
mov edx, dword [0x470ed4]
movzx eax, byte [edx + eax*4 + 9]
mov dword [esp + 0x104], eax
fild dword [esp + 0x104]
fld xword [0x46cd0c]
fmulp st(1)
call fcn.00402cc8
fmul qword [esp + 8]
call fcn.00402ce4
mov dword [esp + 4], eax
jmp 0x46c952
xor eax, eax
mov dword [esp + 4], eax
jmp 0x46c952
cmp byte [edi], 2
jne 0x46c94c
mov dword [esp + 4], 0xff
jmp 0x46c952
xor eax, eax
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
je 0x46c9a3
mov eax, dword [esp + 0x1c]
mov al, byte [eax]
sub al, 0xf5
je 0x46c971
dec al
je 0x46c97e
dec al
je 0x46c98b
dec al
je 0x46c998
jmp 0x46c9a3
mov eax, dword [esp + 4]
sub dword [esp + 0xf0], eax
jmp 0x46c9a3
mov eax, dword [esp + 4]
add dword [esp + 0xec], eax
jmp 0x46c9a3
mov eax, dword [esp + 4]
add dword [esp + 0xf0], eax
jmp 0x46c9a3
mov eax, dword [esp + 4]
sub dword [esp + 0xec], eax
inc ebx
inc esi
inc edi
inc dword [esp + 0x1c]
cmp bl, 0x18
jne 0x46c541
cmp dword [esp + 0xec], 0
jne 0x46c9cb
cmp dword [esp + 0xf0], 0
je 0x46cbfe
mov eax, dword [esp + 0xec]
cdq
xor eax, edx
sub eax, edx
mov ebp, eax
mov eax, dword [esp + 0xf0]
cdq
xor eax, edx
sub eax, edx
mov ebx, eax
cmp ebp, 0xff
jle 0x46c9f4
mov ebp, 0xff
cmp ebx, 0xff
jle 0x46ca01
mov ebx, 0xff
cmp ebp, 0xff
jne 0x46ca1b
cmp ebx, 0xff
jne 0x46ca1b
mov ebp, 0xb4
mov ebx, 0xb4
mov eax, ebp
imul ebp
mov edx, ebx
imul edx, ebx
add eax, edx
mov dword [esp + 0x104], eax
fild dword [esp + 0x104]
fsqrt
call fcn.00402cd8
mov dword [esp + 4], eax
cmp dword [esp + 4], 0xff
jle 0x46ca51
mov dword [esp + 4], 0xff
mov dword [esp + 0x104], ebp
fild dword [esp + 0x104]
fild dword [esp + 4]
fdivp st(1)
mov eax, dword [0x470bf4]
mov edx, dword [esp + 4]
movzx eax, word [eax + edx*2]
mov dword [esp + 0x108], eax
fild dword [esp + 0x108]
fmulp st(1)
call fcn.00402cd8
mov ebp, eax
mov dword [esp + 0x104], ebx
fild dword [esp + 0x104]
fild dword [esp + 4]
fdivp st(1)
mov eax, dword [0x470bf4]
mov edx, dword [esp + 4]
movzx eax, word [eax + edx*2 + 0x200]
mov dword [esp + 0x108], eax
fild dword [esp + 0x108]
fmulp st(1)
call fcn.00402cd8
mov ebx, eax
cmp dword [esp + 0xec], 0
jge 0x46cada
neg ebp
mov dword [esp + 0xec], ebp
jmp 0x46cae1
mov dword [esp + 0xec], ebp
cmp dword [esp + 0xf0], 0
jge 0x46caf6
neg ebx
mov dword [esp + 0xf0], ebx
jmp 0x46cafd
mov dword [esp + 0xf0], ebx
fild dword [esp + 0xec]
fdiv dword [0x46cd18]
fadd qword [esp + 0x30]
fstp qword [esp + 0x30]
wait
fild dword [esp + 0xf0]
fdiv dword [0x46cd18]
fadd qword [esp + 0x38]
fstp qword [esp + 0x38]
wait
fld qword [esp + 0x30]
call fcn.00402ce4
push edx
push eax
fld qword [esp + 0x48]
call fcn.00402ce4
cmp edx, dword [esp + 4]
jne 0x46cb46
cmp eax, dword [esp]
pop edx
pop eax
je 0x46cb69
fld qword [esp + 0x30]
call fcn.00402ce4
mov ebx, eax
fld qword [esp + 0x40]
call fcn.00402ce4
sub ebx, eax
mov dword [esp + 0xec], ebx
jmp 0x46cb72
xor eax, eax
mov dword [esp + 0xec], eax
fld qword [esp + 0x38]
call fcn.00402ce4
push edx
push eax
fld qword [esp + 0x50]
call fcn.00402ce4
cmp edx, dword [esp + 4]
jne 0x46cb8f
cmp eax, dword [esp]
pop edx
pop eax
je 0x46cbb2
fld qword [esp + 0x38]
call fcn.00402ce4
mov ebx, eax
fld qword [esp + 0x48]
call fcn.00402ce4
sub ebx, eax
mov dword [esp + 0xf0], ebx
jmp 0x46cbbb
xor eax, eax
mov dword [esp + 0xf0], eax
cmp dword [esp + 0xec], 0
jne 0x46cbcf
cmp dword [esp + 0xf0], 0
je 0x46cbe0
push 0x1c
lea eax, [esp + 0xec]
push eax
push 1
call sub.user32.dll_SendInput
xor eax, eax
mov dword [esp + 0xec], eax
xor eax, eax
mov dword [esp + 0xf0], eax
lea esi, [esp + 0x30]
lea edi, [esp + 0x40]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [esp + 0x80]
lea edi, [esp + 0x98]
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
push 0xa
call sub.kernel32.dll_Sleep
cmp byte [esp], 0x63
jae 0x46cc25
inc byte [esp]
jmp 0x46cc29
mov byte [esp], 0
cmp byte [esp + 0x11], 0
jbe 0x46cc34
dec byte [esp + 0x11]
cmp byte [esp + 0x13], 0
jbe 0x46cc3f
dec byte [esp + 0x13]
cmp byte [esp + 0x12], 0
je 0x46cc4b
inc word [esp + 0x16]
mov eax, dword [0x470e48]
cmp byte [eax], 0
je 0x46b979
mov eax, dword [0x470e94]
mov eax, dword [eax]
cmp byte [eax + 0x57], 0
je 0x46cc72
mov eax, dword [0x470e94]
mov eax, dword [eax]
call fcn.0045ce00
mov eax, dword [0x470c50]
mov eax, dword [eax]
cmp byte [eax + 0x57], 0
je 0x46cc8b
mov eax, dword [0x470c50]
mov eax, dword [eax]
call fcn.0045ce00
mov eax, dword [0x470dec]
mov al, byte [eax]
mov edx, dword [0x470d3c]
cmp al, byte [edx]
je 0x46cccb
mov eax, dword [0x470d3c]
movzx eax, byte [eax]
mov edx, dword [0x470e94]
mov edx, dword [edx]
mov edx, dword [edx + 0x338]
mov dword [edx + 0xc], eax
mov eax, dword [0x470e94]
mov eax, dword [eax]
mov eax, dword [eax + 0x338]
mov si, 0xffeb
call fcn.00403778
mov eax, dword [0x470e38]
mov eax, dword [eax]
call fcn.00460678
add esp, 0x10c
pop ebp
pop edi
pop esi
pop ebx
ret